[Silthus]

Merge gate: passed. fleet proof gate passes on 024fd7b (shadow diff, review at HEAD, CI green, judge fail accepted by standing rule). Layer 3 of 4 in the node-store attachment stack: #133482, #131833, this PR, then #131944. The stack merges from its top PR.

Problem

• A send that attaches files must answer the caller within a fixed time, even while it renders a long template to size the email (PostHog/michaelr-context#77).
• Hog and Liquid rendering stop only at their own per-invocation limits, so the caller cannot bound one render by a shorter deadline.

Note

🟢 Merge risk: low · two-way door

• Every Hog render goes through the rewritten render queue; a run of 45,000 renders against the PR base kept their order, results and latency.
• No caller passes a deadline until feat(cdp): send transactional email files by reference #131944. Switch-off: none; fix forward.

Changes

• HogInputsService.buildInputs takes an optional deadline signal, and a passed deadline fails the inputs with the deadline error.
• A Hog render or a Liquid render stops at the earlier of its own limit and the deadline. Liquid checks the deadline before each leaf, and Hog checks it again after waiting for the event loop.
• A Hog render queued behind another render leaves the queue once the deadline passes, so buildInputs settles at once. Renders under one deadline share one abort listener.
• Nothing passes a deadline until feat(cdp): send transactional email files by reference #131944, so no current send behaves differently.

How did you test this code?

Test rationale: the new cases in hog-inputs.service.test.ts drive buildInputs with a deadline. They fail if a render outlives the deadline, if a passed deadline is ignored while an input waits for the event loop or after a Hog input yields it, if a queued input keeps waiting behind another render after the deadline (also once one of its own leaves holds the queue), if a Liquid input of many leaves runs more than one leaf past the deadline, or if a render ends with its own error in place of the deadline error. Breaking the Liquid deadline cap, the Hog deadline passthrough, or the shared abort listener turned a case red.

• Shadow run, the PR base e7a3351 against this head: 5,000 concurrent real execHog renders per trial, without a deadline, half under one deadline, and each under its own. Every render finished in order with its result at both commits, within trial noise; a render with its own deadline pays about 6 µs for its listener.
• nodejs/src/cdp/dev/hog-exec-queue-bench.test.ts times queuing and dropping 50,000 renders under one deadline. CI skips dev/, so it runs by hand; a filter-based removal and a listener per waiter each went past its 1 s ceiling.

Release status

• No feature flag controls this change

Docs update

• None.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Agent: Claude Code, Claude Opus 5.5

Skills: /writing-tests, /writing-pr-descriptions, /stacking-prs

More context for AI agents

• Decisions: split out of feat(cdp): send transactional email files by reference #131944 along the deadline seam to get each layer under the review size limit. Callers and the passthroughs that only cdp-api uses stay in feat(cdp): send transactional email files by reference #131944.
• Read closely: nodejs/src/cdp/utils/hog-exec.ts, the deadline checks around a Hog run, and sempahore.ts, the waiters grouped by deadline.

🤖 Generated with Claude Code

[github-actions]

🤖 CI report

✅ Trunk lane — non-backend lane

This PR is assigned to the non-backend lane. It does not run backend Python tests and may merge in parallel with PRs in other lanes.

✅ Duplication (Python) — clean

New Python code duplication introduced by this branch. Fails at 70+ tokens in app code, or 150+ tokens when both copies live in test files. Advisory while the gate proves itself: extract a shared helper instead of copying.

⚠️ Duplication (TypeScript) — 1 new duplicated block (worst 160 tokens)

New TypeScript code duplication introduced by this branch. Fails at 70+ tokens in app code, or 150+ tokens when both copies live in test files. Advisory while the gate proves itself: extract a shared helper instead of copying.

First copy	Second copy	Lines	Tokens
nodejs/src/cdp/services/hog-inputs.service.test.ts:419	nodejs/src/cdp/services/hog-inputs.service.test.ts:555	28	160

[parameterai]

Risk: No findings

The only change since the last review is a merge of origin/master into the deadline branch; the PR's own deadline code (deadline.ts, hog-exec.ts, sempahore.ts, liquid.ts) is byte-identical to what was reviewed at 9d0d9e3. I reviewed the merged-in code that touches the PR's area plus the highest-risk new surfaces (credentials-service auth, admin console results, CDP integration decrypt-failure and rebuildable-inputs handling, workflows email sandbox) and found no vulnerability introduced by this change.

_{Sentinel reviewed 9702e97 · Review settings}

[stamphog]

Review requests went to the owners of the changed code. These owners were not requested because their part of this change looks trivial:

• @PostHog/team-ingestion: Your only change is a new generated Hog bytecode fixture file used by the tests, with no runtime code or test assertions changed, so this PR doesn't need your review.

If you were listed here and want to review, you can still assign yourself as a reviewer.

[veria-ai]

PR overview

No security issues were found in this pull request.

Reviews

• 105fed9 — No new issues
• 9d0d9e3 — No new issues
• 024fd7b — No new issues

[posthog]

PostHog Review · Standard · reviewed 5e7d68d: 1 Should fix.

See this review and its findings in PostHog Review. Comment @posthog review --deep for a Deep review. A Deep review takes longer and looks deeper than a Standard review.

[stamphog]

Not approved — this change needs a human reviewer.

Re-add the stamphog label to request another review once you have addressed this.

@PostHog's current-head concern about deadline enforcement during semaphore waits remains unresolved. Make semaphore acquisition deadline-aware, remove expired waiters, and add queue-contention coverage before re-requesting review.

• Author wrote 0% of the modified lines and has 9 merged PRs in these paths (familiarity MODERATE).
• PostHog Review (Standard) reviewed the current head: 1 finding, posted on the PR.
• posthog[bot] reviewed the current head.
• @PostHog, nodejs/src/cdp/utils/hog-exec.ts: The deadline is checked only inside semaphore.run, after acquisition. In nodejs/src/cdp/utils/sempahore.ts:6–11, queued acquisition waits without cancellation, so an expired render remains pending behind preceding renders. The current code does not fix the reviewer's request for abortable acquisition and removal of expired waiters.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✓	no deny categories matched
size	✓	102L, 4F substantive, 436L/6F incl. docs/generated/snapshots — within ceiling
tier	✓	T1-agent / T1d-complex (436L, 6F, single-area, feat)
stamphog 2.7.0		.stamphog/policy.yml @ 5e7d68d · reviewed head 5e7d68d

[posthog]

PostHog Review · Standard · reviewed a1a6e32: 1 Should fix.

[posthog]

PostHog Review · Standard · reviewed 32d13cc: 1 Should fix.

This is review round 3 on this pull request. When findings keep coming back in the same code, the approach is usually the problem. Before the next fix, check whether a different design would remove the whole class of findings.

[posthog]

PostHog Review · Standard · reviewed 024fd7b: 1 Should fix.

This is review round 4 on this pull request. When findings keep coming back in the same code, the approach is usually the problem. Before the next fix, check whether a different design would remove the whole class of findings.

[posthog]

PostHog Review · Standard · reviewed 9702e97: 1 Must fix, 5 Should fix. This pull request is large, so the review ran in 4 parts with less depth than usual.

This is review round 5 on this pull request. When findings keep coming back in the same code, the approach is usually the problem. Before the next fix, check whether a different design would remove the whole class of findings.

[trunk-io]

This pull request is queued for merge as part of 131944, which will merge 133482, 131833, 133495, 131944.

[trunk-io]

This pull request was merged into master as part of stacked PR 131944.

[deployment-status-posthog]

Deploy status

Environment	Status	Deployed At	Workflow
dev	✅ Deployed	2026-11-11 16:27 UTC	Run
prod-us	✅ Deployed	2026-11-11 18:14 UTC	Run
prod-eu	✅ Deployed	2026-11-11 17:23 UTC	Run

_{This table shows the posthog release only. Hogstation shows every service that this PR reaches, Kargo services included.}