* ci: split fast and deep static checks
Fast PRs run typecheck, lint, and format before provider admission.
Knip, duplication, architecture guards, and Python stay on the full tier.
Shared-boundary fallbacks keep the Linux x64 baseline, and Turbo jobs
export remote-cache credentials when they are configured.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: keep pull requests from writing the remote cache
Trusted default-branch runs still receive TURBO_TOKEN. Pull requests get an
empty token and remote read-only mode. Knip saves a per-commit cache key so
the next trusted full run can refresh the restored snapshot.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: forward the release cache token and upload deep static reports
Release qualification now passes TURBO_TOKEN into the called workflow.
Labeled pull requests still do not. The deep static job records its task
context and uploads duplication reports after a failed gate.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* style: format the turbo cache policy test
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: keep fast checks exclusive and trusted cache writes explicit
Declare the static artifact name and context script so typecheck matches the
implementations. Lock check:ci:fast around dist, and publish the remote cache
only for release qualification or default-branch push, schedule, and dispatch.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: record static task graphs without nesting the artifacts lock
Keep check:ci:fast locked, and point graph recording at the unlocked
check:ci:fast:tasks script so check:pr and check:test can record hashes
while they already hold that lock.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: keep unauthenticated Turbo runs on the local cache
Open pull requests do not receive TURBO_TOKEN, so a remote read mode cannot
authenticate. Those runs now use the local cache. Trusted runs still publish.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* test(ida): treat unchanged invalid requests as nonretryable
Main already stopped marking invalid_request retryable. The pull request
merge runs that projector, while the IDA lookup tests still expected
retryable true. Match the merged behavior.
Co-authored-by: morluto <morluto@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(application): retain completed evidence through cancellation
Validate completed provider reports before classifying cancellation and preserve Evidence and captured diagnostics. Share MCP recording and delivery across custom observation handlers. Add source-owned completion and public SDK recording controls. Refs #3923, #3927, #4261.
* fix(wasm): retain final observations through cancellation
Keep completed Evidence after finalization and through CLI/MCP delivery. Preserve output and cleanup failure precedence. Refs #4254.
* fix(browser): retain final observations and forward cancellation
Classify final CDP detach and completed scenario cleanup at the provider boundary. Translate completed partials into canonical Evidence for MCP recording, and forward CLI cancellation to passive Electron tools. Refs #4255, #4256, #4257.
* fix(ghidra): isolate cancellation of shared startup waiters
Keep startup group-owned while each caller has an independent abortable wait. Await final-owner cleanup and preserve cleanup facts before retrying. Reuse the shared abortable promise helper. Refs #3983.
* fix(mcp): keep shutdown registrations until cleanup succeeds
Retain repeated event requests while unresolved owners need cleanup, and unregister only after success. Verify coalescing and failed-owner retry. Refs #4253.
* fix(adb): own transfer snapshots and stage screen publication
Bind transfer digests to the exact private input bytes and preserve caller APK names. Retain failed descriptors and private-root owners with typed cleanup evidence; publish captures exclusively after the cancellation cutoff. Refs #4251, #4252.
* fix(verification): report ADB cleanup failures
Always close after attempted verification and keep unexpected primary failures and cleanup details visible. Exercise the production script with controlled imports, including null and undefined throws. Refs #4260.
* fix(runner): stop owned Windows commands on cancellation
Use the retained ChildProcess handle for IPC cancellation and parent disconnection. Keep the SQLite lock until observed child close, and include native Windows regressions in the curated CI lane. Native Windows results remain pending. Refs #4258.
* fix(website): canonicalize link containment boundaries
Compare resolved targets with resolved repository and site roots. Accept directory aliases while preserving escape checks and keep fixtures within their temporary owner. Refs #4264.
* docs(testing): cover completion races and cleanup retry
Clarify validation-before-cancellation, independent startup waiter controls, producer and adapter coverage, and repeated shutdown events.
* fix(filesystem): retain file owners and completed reads after close failure
* fix(session): report retained snapshot staging in cleanup status
Fixes#4277. Include both snapshot and profile file-resource scopes in the owning status fact, preserving publication receipts and cleanup retry.
* docs(mcp): clarify recovery of raw partial observations
Document the observed SDK cancellation boundary and the open design decision in #4276 without promoting raw errors to Evidence.
* fix(kuna): own the complete installation inspection lifetime
* test(kuna): cover session cleanup of shared cache resources
* fix(hopper): isolate publisher operation resource admission
* fix(hopper): preserve launcher cleanup failure classification
* fix(adb): retain ordered cleanup and screen publication outcomes
* fix(runner): retain Windows job ownership through cleanup retries
* docs: clarify inspection admission and ordered cleanup regressions
* fix(ghidra): preserve startup cleanup and request deadlines
* fix(runner): supervise stdin errors and bootstrap native controls
* docs: require queued lifecycle controls to survive admission
* fix(cli): leave cleanup resolution with resource owners
* test(adb): verify owned install snapshots through CLI
* fix(errors): exclude resolved primary cleanup resources
* fix(adb): resolve publication cleanup after its handle closes
* fix(android): resolve JADX hash cleanup after owned close
* refactor(android): share hash failure cause options
* fix(kuna): gate commands on retained descriptor cleanup
* docs: cover cleanup admission and owner-confirmed recovery
* refactor(artifacts): bind cleanup errors to confirmed release
* fix(adb): resolve recovered cleanup at retained owners
* fix(kuna): resolve installation cleanup after owned close
* fix(kuna): gate cache reads on retained hash cleanup
* fix(setup): preserve publisher cleanup admission failures
* fix(android): resolve the reported retirement cleanup error
* test(runner): scope post-spawn fault control to POSIX
* test(adb): cover persistent snapshot owner retirement
* fix(kuna): preserve file outcomes with explicit cleanup ownership
* fix(artifacts): resolve errors through retained cleanup owners
* docs(lifecycle): carry cleanup ownership in typed outcomes
* fix(adb): bind staged screen errors to their cleanup lease
* fix(kuna): bind profile cleanup through a close capability
* fix(artifacts): retain descriptor resources in cleanup errors
* fix(pcap): bind existing errors to snapshot retirement
* fix(windows): load source owner through its file URL
* test(build): copy the command runner helper into fixtures
* fix(mcp): own shared observation providers in the transport
* fix(jadx): resolve every retained cleanup retry error
* fix(kuna): bind retry errors to every retained cleanup owner
* fix(adb): bind admission and shutdown errors to exact cleanup leases
* fix(windows): resolve command paths before native ownership
* test(publisher): assert exact descriptor recovery without release metadata
* docs(lifecycle): require every retry error to follow its owners
* fix(kuna): keep hash cleanup state stable across concurrent retries
* test(windows): exercise surviving descendants with scoped shutdown deadlines
* fix(uninstall): preserve primary read errors through cleanup failure
* test(publisher): assert cleanup Result and exact owner recovery
* test(windows): observe supervisor resources through IPC disconnect
* fix(browser): retain typed cancellation after interrupted actions
* test(publisher): assert ownership phases without retry-count coupling
* fix(lifecycle): preserve abort reasons through shared provider execution
* fix(jadx): preserve execution and late hash cancellation causes
* fix(adb): compose late cancellation with exact cleanup failures
* test(mcp): use the shared budget for session workflows
* fix(ci): restore inherited validation failures
* perf(ci): share trusted caches and fail fast on PR test failures
* fix(ci): bound static cache and hash vitest config for knip
- Bound the rolling .turbo/cache snapshot with 7d/500MB eviction so each
trusted main save cannot accumulate history toward the GitHub limit.
- Hash vitest.config.ts in knip inputs so removing the CiTestSequencer
import invalidates the cached passing check.
- Cover both in cache-policy and task-hash regressions.
* ci: pin GitHub Actions to full commit SHAs
Replace every third-party `uses: owner/repo@vN` reference in
.github/workflows with the 40-character commit SHA that the tag
currently resolves to, keeping the exact release as a trailing comment.
Each pin was checked with `git ls-remote --tags`: the floating major tag
and the commented release dereference to the same commit. Local
reusable workflows are unchanged.
Re-pin reactivecircus/android-emulator-runner from the SHA of the
annotated `v2` tag object (4c44018e) to the commit it points to
(a421e438, v2.38.0); Actions resolves both, but only the commit SHA is
an immutable reference that tooling can compare with the release.
Update the Windows Ghidra workflow trust-boundary test to require
SHA-pinned setup-node and upload-artifact references instead of the
previous floating tags.
Validation: actionlint v1.7.7 (-shellcheck= -pyflakes=, as in CI), YAML
parse of all workflows, no remaining unpinned third-party `uses:`, and
the workflow boundary/conformance tests.
* style(ci): format action identity assertion
Retain formatting edits produced before the user stopped validation.
Source inspection and git diff --check only. Tests, builds and typechecks skipped by explicit user request. GitHub review writes paused globally.
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Summarize saved Wireshark4.x captures with enforced native resource limits, serialized admission, stable snapshot verification and retained fact/text pages. Preserve complete inventories within resource budgets and source uncertainty; report cleanup failure with partial Evidence and retained ownership.
Verified six recorded corpora /13026 packets with independent Scapy/Python oracles, real CLI/MCP/schema parity,60 SNI names,132 DNS addresses and1000 URIs. Real TShark CI now exercises summary/paging. Actual Windows/Bun Wireshark remains unverified; macOS capture requires a separate enforceable-bound decision.
Co-authored-by: 3QL <85309073+3QL@users.noreply.github.com>
Co-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>
Inspect selected fields in existing captures through shared CLI/MCP Evidence.
Page matching frames without changing dissection or two-pass read coverage;
retain failed descriptor/process cleanup ownership and reject excess admission.
Verified with real TShark 4.0.17 and 4.2.2, public Wireshark recordings,
owned HTTP application traffic, real CLI/MCP workflows and schema checks.
Co-authored-by: Olorinm <59321404+Olorinm@users.noreply.github.com>
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
morluto