L01-05 — Qualify hostile and production resource envelopes #19

Activity

1. mberrys

   added this to the L01 - Evidence Core milestone on Sep 24, 2026
2. mberrys

   added a parent issue on Sep 24, 2026

   • L01 — Evidence Core module gate #2
3. github-actions

   set

   Promotion stage

   to

   Dev present

   on Sep 30, 2026
4. github-actions

   changed

   Promotion stage

   to

   Unstable present

   on Sep 30, 2026
5. mberrys commented on Oct 1, 2026

   

   mberrys

   on Oct 1, 2026

   ContributorAuthor

   More actions

   Acceptance evidence

   • Source SHA: 4388ca36db44cc187ba22031ef5e5aed8e3e2477 on unstable, in PR [0.3.0 first half] L01 Evidence Core train — unstable → stable #155 (unstable -> stable). The hosted PR runs checked out merge commit 2fa707a47677e56ca825ed9e28460d6edc3e138c; its tree (f4a0696645f24cf9fdecf87c7da7bb6a9748519f) is identical to the tree of 4388ca36 (checked with git rev-parse). The qualification evidence reports candidate_sha: 2fa707a47677e56ca825ed9e28460d6edc3e138c.
   • Implementing commits: be4edcd4 (L01-05 — Qualify hostile and production resource envelopes #19, merged to dev as PR feat(envelope): qualify hostile and production resource envelopes (#19) #107) and the envelope follow-ups f6b48584, 64de840b, 4d9d02f0, f8b46038, 8a789dd9, 04ead25a, 14264ad6, 648d160b, c9af5df2, d7eeebb7, 7d24c836, 0f10c873, plus manifest commits 52079abb and e3c26269.

   Criteria to command to hosted run

   Hosted run: Resource envelope qualification 36782669570, workflow .github/workflows/resource-envelope-qualification.yml. Per platform it runs python -m scripts.resource_envelope.run_matrix --strict (3 repetitions, 1800 s per-process timeout, cancellation fixture ten-thousand-page), then an evidence job builds and validates the evidence.

   Criterion	Evidence	Result
   Each required workload yields measured max memory/time and an explicit terminal disposition	Strict matrix summary printed by each platform job: "total": 6, "measured": 5, "flagged": 0, "skipped": 1, "failed": 0, "candidate_sha_verified": true, "cancellation_recovery_probe": "measured", "hostile_contained": "7/7". Linux: job 110116493149. Windows: job 110116493342. In scripts/resource_envelope/run_matrix.py (run_fixture), a record is measured only when it has no validation errors, every run reported envelope status complete, RSS stayed within the resident policy, and identity matched the candidate SHA and fixture digest.	Both jobs succeeded
   Required workloads	FIXTURE_SPECS marks office-2mb, image-heavy-500mb, ten-thousand-page, pathological-vector, transparency-spots as required: 5 measured, 0 flagged. The 1 skipped record is multi-gb, which FIXTURE_SPECS marks required: False.	As stated
   Evidence disposition	evidence job, job 110148797045: "disposition": "passed", "reasons": [], then validate_resource_envelope_evidence.py printed "status": "valid" with "candidate_sha": "2fa707a47677e56ca825ed9e28460d6edc3e138c".	Success
   Failure case: crashes, OOM, hangs, skipped workloads cannot count as passing	matrix_passes(strict=True) fails on any failed record, any uncontained hostile case, a failed or missing cancellation probe, or any required workload flagged or unavailable. Python tests in the Release Gate run 36782669896 (Ran 59 tests ... OK in both linux / build 110116570084 and windows / build 110116569911) include test_crashed_process_fails_even_with_an_envelope, test_timeout_fails, test_hung_interrupt_fails, test_high_water_above_limit_is_rejected, test_partial_output_exit_is_flagged_not_measured, test_matrix_records_missing_required_and_optional_fixtures, test_strict_requires_probe_hostile_and_no_flags, test_uncontained_hostile_case_fails_even_without_strict, test_passed_claim_with_unavailable_measurement_is_invalid, test_passed_disposition_is_rejected.	All ok; none FAIL, ERROR or skipped
   Cancellation and recovery	Probe status measured on both platforms (summary above); test_cancelled_run_and_reopen_are_measured is ok in the Release Gate log.	As stated
   Hostile corpus	hostile_contained: 7/7 on both platforms.	As stated

   Fixture and artifact identity

   The synthetic corpus is deterministic: the fixture manifest printed by the Linux and Windows jobs carries identical SHA-256 values.

   Fixture	SHA-256	Bytes
   office-2mb	6305dc367a4d2f3f11bcdb39459adfbb48275958622916cf03807f29a490bca6	2016212
   image-heavy-500mb	172940d3b3f27a5a278de606948b8fa799b3a298fc7ba24cc60759fcbef1c5a9	501532857
   ten-thousand-page	984bcf837d312510144bc659624f866ff1419e5279170cd8f3658ea459a82874	61960867
   pathological-vector	5517185518d353635366270ff41e3e2a56cf1d6d21187e84aba8fc6a44aa6c0f	6369566
   transparency-spots	d4316776aaacb9f056da41925cea51fd68bf1b00ae7b53e1326306e1d85810b3	3266105

   Uploaded artifacts (not expired when checked; expires_at 2026-12-29): resource-envelope-matrix-linux id 11130488864 (sha256:f2139edf42fb4056563c395ddf50c9d99088b858960abcf886a5a7f74020bc32), resource-envelope-matrix-windows id 11132815265 (sha256:e8327d33cc3a983ea34a83144032a65dd23668436179e13d91b3c25cfb285972), resource-envelope-evidence id 11132760204 (sha256:a348d1a74f1b2365df045284c3a4501c3f8e78d9c8c534516fb7d1e2a6f45461).

   Check-change and architecture gates

   Hosted agent_contract (job 110116496019) succeeded; it runs check-change.py --dry-run, so it plans and does not execute the proof. Local read-only run at 4388ca36: check-change.py --base origin/stable --head 4388ca36db44cc187ba22031ef5e5aed8e3e2477 --head-branch unstable --dry-run --skip-changelog exited 0, and check-architecture.py printed architecture contracts ok. The native proof ran in Release Gate: linux / build and windows / build both printed 100% tests passed, 0 tests failed out of 91, with UnitTestsWorkloadEnvelope, UnitTestsResourceBudget, UnitTestsBudgetExhaustion, UnitTestsBudgetCorpus and UnitTestsPdfToolContract each Passed.

   Skipped or unavailable lanes

   • multi-gb workload: skipped, optional by design (see above).
   • The push CI run on unstable (36782282330) skipped linux, windows and agent-fast; the PR-event runs above executed them.

   Changed files

   .github/workflows/resource-envelope-qualification.yml, .github/workflows/reusable-linux.yml, .github/workflows/reusable-windows.yml, LoopLibCore/sources/pdfcolorinventory.{cpp,h}, pdfevidencegraph.{cpp,h}, pdfrenderer.cpp, pdfresourcebudget.h, pdfworkloadenvelope.cpp, preflightengine.cpp, PdfTool/main.cpp, pdftoolabstractapplication.{cpp,h}, pdftoolrender.{cpp,h}, scripts/resource_envelope/run_matrix.py, synthetic_workload.py and their tests, scripts/qualification/build_resource_envelope_evidence.py, validate_resource_envelope_evidence.py and tests, UnitTests/tst_evidencegraphtest.cpp, tst_pdftoolcontract.cpp, tst_resourcebudgettest.cpp, tst_workloadenvelopetest.cpp, docs/RESOURCE_ENVELOPE.md, docs/RESOURCE_ENVELOPE_QUALIFICATION.md, docs/RESOURCE_BUDGETS.md, docs/RESOURCE_ENVELOPE_BUDGETS.json, docs/generated/huge-document-envelope.json, changes/cc-issue-19-resource-envelopes.{md,evidence.yaml}.

   Observed result

   Both hosted platforms finished the strict matrix with 5 of 5 required workloads measured, 0 flagged or failed, the cancellation/reopen probe measured, the hostile corpus 7/7 contained, and evidence disposition passed and valid.

   Remaining risk

   • The per-workload maximum-memory and time values are in the uploaded artifacts above. I did not download or open them, and the run logs print only the summary counts, so the numbers are not quoted here.
   • changes/cc-issue-19-resource-envelopes.evidence.yaml says the hosted measurements would be recorded under docs/evidence/issue-19-resource-envelope/ after the run. That directory does not exist on unstable, so the artifacts (90-day retention) are the only record until it is added.
   • The same manifest lists unresolved: core:scripts/ci/check_independent_validation_gate.py (belongs to L01-04 — Prove independent standards and rendering claims #18).
   • One run per platform on GitHub-hosted runners; this says nothing about other hardware.

   Quality review

   The qualification path is fail-closed: required, optional, flagged and failed outcomes are separate states, and the strict gate refuses skipped required workloads, so the pass is not a green aggregate. I read run_matrix.py and the tests named above but did not review the native changes line by line.

   Closes on merge of #155 into stable.
6. mberrys

   closed this as completedin #155on Oct 1, 2026
7. github-actions

   changed

   Promotion stage

   to

   Stable present

   on Oct 1, 2026