Skip to content

Delete a wall-clock bound that could never have fired - #293

Merged
pixexid merged 1 commit into
mainfrom
bb/gh-287-checkout-adversary-wall-clock-thr_2rbixgj33q
Aug 19, 2026
Merged

pixexid merged 1 commit into
mainfrom
bb/gh-287-checkout-adversary-wall-clock-thr_2rbixgj33q

Conversation

@pixexid

@pixexid pixexid commented Aug 19, 2026

Copy link
Copy Markdown
Owner

The assertion was option 2 — a smoke check the resolution already covers — but the reason is sharper than "redundant": it was unreachable.

expect(Date.now() - started).toBeLessThan(2_000) sat in the file GH-161 measured inflating 34x between local and CI, with an explicit }, 5_000) opting it out of the 15 s suite default PR #286 introduced.

Why it is not option 1

The invariant is laziness: readDiagnosticDivergence is a closure defined at load and invoked only by the doctor RPC and CLI. So the real property is "plugin load performs no checkout I/O", and the wall-clock bound is a proxy for it.

Mutating plugin load to call readDiagnosticDivergence() eagerly does not fail at 2,000 ms, at 5,000 ms, or at 15 s. readHead calls readFileSync on the adversary's FIFO .git/HEAD, which blocks the worker synchronously — nothing downstream of the await runs and vitest cannot interrupt a blocked worker. The mutated run was killed at 90 s having emitted no test output at all.

An assertion that control never reaches is not a proxy for anything, so there is no real property to swap it for and no observable counter to add to production source.

Mutation evidence

result
unmutated, before passes, 68 ms
eager read, assertion present killed at 90 s, no test output
eager read, assertion removed killed at 60 s, no test output

Identical mutation behaviour with and without the assertion is the proof it was carrying nothing.

What proves the invariant instead

resolves.toEqual([undefined, undefined]) — it checks the returned value as well as termination, and it is not weather-dependent. The explicit }, 5_000) goes with the assertion so the test inherits the suite default rather than keeping a second hand-chosen number in this file.

No production source changed. No other test touched.

npm run verify exit 0 — 367 passed, 2 skipped.

Closes #287

Acceptance: complete

Review tier: C

The checkout-adversary test asserted `Date.now() - started < 2_000`, in the
file GH-161 measured inflating 34x between local and CI. It was not a proxy
for a real property and it was not a needed smoke check: it was unreachable.

Mutating plugin load to resolve the checkout eagerly does not fail the test
at 2,000 ms, or at the explicit 5,000 ms timeout, or at the 15 s suite
default PR #286 introduced. `readHead` calls readFileSync on the adversary's
FIFO `.git/HEAD`, which blocks the worker synchronously — nothing downstream
of the await runs and vitest cannot interrupt it. The run was killed at 90 s
having emitted no test output at all. Removing the assertion reproduces that
mutation result exactly, which is the proof it was carrying nothing.

What proves the invariant is `resolves.toEqual([undefined, undefined])`: it
checks the value as well as the termination, and it is not weather-dependent.
The explicit `}, 5_000)` goes with it, so the test inherits the suite default
rather than keeping a second hand-chosen number in this file.

Closes #287
@pixexid
pixexid marked this pull request as ready for review August 19, 2026 03:09
@pixexid
pixexid merged commit 9dccb7a into main Aug 19, 2026
1 check passed
@pixexid
pixexid deleted the bb/gh-287-checkout-adversary-wall-clock-thr_2rbixgj33q branch August 19, 2026 03:09
@github-actions

Copy link
Copy Markdown

Merged PR #293 completed the declared acceptance for #287; the issue was closed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Timing-dependent assertion in a file measured inflating 34x on CI

1 participant