[tianxiaochannel-oss88]

Summary

CI runs were taking about 40 minutes because a failed setup path could leave a test HTTP relay listening after the test had already reported its failure. This change bounds each test file, closes relays on startup and shutdown failures, balances core and daemon work across stable shards, and records durable reports so a stuck worker fails visibly instead of holding the job until its outer cap.

Blast radius

The change is limited to GitHub Actions orchestration, CI runner utilities, their contract tests, and daemon test fixtures. Existing complete coverage, four real macOS daemon shards, platform gates, aggregate quality gate, job caps, and Draft policy remain in place; local contract and cleanup probes pass, while hosted runner behavior remains to be verified.

Test Coverage

Coverage: 93.3% value-weighted (28/30 behavioral paths covered; 0 weak paths).

Tests ran: CI contracts 273 pass, 0 fail, 1 expected environment-gated skip.
Tests ran: Bun entry supplemental 2 pass, 0 fail, 0 skip.
Tests ran: channel-workspace 226 pass; normal exit in approximately 134.6 seconds.
Tests ran: daemon runner probe 6 files pass, including both exclusive Kimi lifecycle files.
Tests ran: core runtime-permissions probe pass.
Tests ran: markdown links 446 files pass; public repository safety 6068 files pass; workflow YAML 10 jobs parsed; whitespace checks pass.

Known verification gaps: the real shard CLI boundary (invalid-plan rejection and OS signal handoff) and the pinned Gitleaks container boundary (actual detection/exit/redaction) still require hosted or container-capable verification. No confirmed regression was found. Hosted Linux/macOS duration and artifact transfer are not yet verified, so this PR makes no speedup percentage claim.

Pre-Landing Review

No confirmed correctness or security regression found in the scoped review. Gate scan against origin/main inspected 14 eligible hunks with no open findings; two RH-15? notices were unpaired timeout-value markers, not actionable findings.

Outside review: unavailable; the documentation review subagent did not return before its bound. This is recorded as missing coverage, not a pass.

Exploratory QA

Reproduced the original relay leak path and verified the cleanup-only control exits normally while preserving the two expected assertion failures. The fixed channel workspace suite exits normally. The runner probes cover per-file timeout, cancellation, process ownership, detached descendants, report durability, and failure continuation.

Design Review

No frontend files changed - design review skipped.

Eval Results

No prompt-related files changed - evals skipped.

Greptile Review

No Greptile comments; no Greptile signal was detected.

Plan Completion

Implemented the bounded runner, stable shard plan, timing-aware balancing, durable reports, history-aware secret scan, and HTTP relay cleanup. Version/CHANGELOG updates were intentionally left out because this is a CI-only change; VERSION remains 0.2.0.

Issues

ISSUE_LINKS: none

Verification Results

PASS: local CI contract suite 273 pass, 0 fail, 1 expected environment-gated skip.
PASS: supplemental Bun entry test 2 pass, 0 fail, 0 skip.
PASS: channel-workspace 226 pass with normal process exit.
PASS: daemon runner probe, core permissions probe, markdown links, public repo safety, YAML parse, and whitespace checks.
NOT RUN: hosted Linux/macOS CI, Docker scanner image, actionlint, and speed comparison on the candidate.

TODOS

No TODO items completed in this PR.

Documentation

Documentation status: current for the reviewed CI scope. The audit snapshot covered docs/maintenance/ci.md and scripts/ci/README.md; both describe the new shard layout, bounded execution, cleanup limits, reports, timing cache rules, secret-scan scope, and hosted-verification limitation. The separate documentation review subagent was unavailable before its bound, so this is not claimed as independent doc-review completion.

Test plan

• node --test --test-concurrency=1 scripts/check-public-repo-safety.test.mjs scripts/ci/*.test.mjs scripts/native-execution-engines/verify-codex.test.mjs packages/daemon/test/mock-openai-compatible-server.test.mjs: 273 pass, 0 fail, 1 expected environment-gated skip
• supplemental Bun entry test: 2 pass, 0 fail, 0 skip
• channel-workspace suite: 226 pass, normal exit
• daemon/core probes and static checks: pass

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-01T18:02:57.977309Z	dd1212c	New commits
🔒 Security Review	✅ Completed 2026-11-01T18:06:20.222389Z	dd1212c	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 19b01d6a64

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dd1212c2bb

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[tianxiaochannel-oss88]

This case is already covered by the ownership ledger and the existing regression test. trackTestProcesses stores each observed PID together with its lstart identity in owned (scripts/ci/test-processes.mjs:24-30), and later live(true) returns those entries by PID plus start identity even after their parent/PGID or environment marker changes (lines 39-50). signal() and waitForExit() both use that ledger, so a reparented descendant that was observed before coordinator exit is still terminated.

The test observed detached descendants retain ownership after reparenting with a cleared environment in scripts/ci/test-processes.test.mjs:44-50 verifies exactly this behavior. The separate node-test-shard fixture also exercises detached cleanup after successful coordinator exit and timeout. A process that deliberately clears its marker and escapes before the first observation remains outside the documented guarantee because this is not a security sandbox; reliably identifying such an unobserved process without cgroups or platform-specific containment would risk killing unrelated CI processes.

[tianxiaochannel-oss88]

Addressed in commit dd1212c2bb215487c6fa6928e42cedab266620a6.

The runner now takes an ownership snapshot immediately after spawning the coordinator, samples every 25ms instead of 200ms, and takes one final snapshot on the coordinator exit event before teardown. This narrows the unobserved reparenting window while preserving the existing PID plus lstart ownership ledger and the documented non-sandbox boundary. The focused test-processes and node-test-shard suite passes: 16/16.