plugin-security: the delegated-organization-membership parity test runs 2.2–3.6 s under shard load against vitest's 5 s timeout and evicts merge-queue builds

Filing gate: ① a defect with a named landing. A plugin-security test runs close enough to vitest's 5 s default timeout that it fails under shard load, and it has evicted a merge-queue build. Found while landing #25521 cut 16 (PR #26669). Filed by the domain:server seat 2 (session_0186vfjHHMsRXC9EUT9hTFMo). ⛔ Not a claim. Dedupe: the newest 100 issues of every state grepped for delegated-organization-membership found none. The merge-queue triage bot found no earlier PR with this signature in 24 h, though its ledger was not fully read. Reader: domain:server seat (plugin-security tests).

Measured:

packages/plugins/plugin-security/src/delegated-organization-membership.test.ts:646, describe "[plugin-security: delegation probes and diagnostics (canReadObject / canWriteObject / canExport, field mask, explain) answer for an on-behalf-of context the operation prologue now refuses (PR #25101) #25107 · ADR-0090 D10] parity: each probe agrees with the engine operation it describes". The per-posture it (a read, an insert and an export through the engine for each posture) runs under the default 5 s timeout.
Red three times:
- main push run 40499879396 (job 122175491737, b49b752d17);
- PR run 40502080135 (job 122182885154);
- merge-group run 40509204270 (job 122207296005), which dequeued refactor(driver-sql): move the filter compiler's leaf predicate emitters out of sql-driver.ts into sql-driver-predicate-emitters.ts (#25521 cut 16) #26669.
All three carry the annotation packages/plugins/plugin-security pnpm run test exited (1). The merge-group failure is named by the queue-triage bot as "group: refused by … — Error: Test timed out in 5000ms".
Timings (CI-shaped leg: shard 6/8, --concurrency=4, VITEST_MAX_WORKERS=3, 4 vCPU):

Test Under shard load File alone

group 2,166 / 3,637 / 2,789 ms on the merge content; 2,862 ms on main about 0.75 to 1.2 s

isolated 2,407 / 3,523 / 2,420 ms; 3,089 ms on main —

A slower hosted runner crosses 5 s. Evidence (per-run vitest JSON, leg summaries) is in the project's pm-orders/server/evidence/25521/cut16-ci-6of8/.
Not a regression: a call-counting wrapper shows the parity tests never reach the code refactor(driver-sql): move the filter compiler's leaf predicate emitters out of sql-driver.ts into sql-driver-predicate-emitters.ts (#25521 cut 16) #26669 moved, and main is equally slow.
Why it surfaces rarely: plugin-security runs in a PR's affected set only when the PR widens to it. A main push seldom schedules it, so the flake shows up mostly in merge groups, where it costs the whole queue a rebuild.

Business reason: every eviction rebuilds every PR queued behind it, and a seat that cannot read the log treats a timeout as a regression.

Wanted: make the parity test fast and deterministic under load. That could mean sharing its booted stack across postures (one boot, beforeAll), shrinking per-posture work, or splitting the three operations into separate its, whichever keeps every assertion. A raised timeout is the last resort, and only with the measured budget in a comment. ⛔ Never skip or quarantine it.

Acceptance: under the CI-shaped leg the slowest parity it stays well under the timeout, measured over at least 3 runs, and every parity assertion is still there.

Generated by Claude Code

Triage: audit line · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-27T17:00Z

⛔ Not a claim, ⛔ not a dispatch.

Triage: lands in the plugin-security delegated-organization-membership parity test; rationale: p2 → p1: it has evicted merge-queue builds (2.2–3.6 s under shard load against a 5 s timeout). Make the test cheap: share the fixture, and cut redundant rounds. ⛔ No raised timeout as the fix, no quarantine.

Generated by Claude Code

Claim: PM loop round 1
Session: session_01QSeKYmQXM3rHJcPnrEPk4B
Account: os-justin
Branch: claude/issue-26754-parity-test-budget
Worktree: objectstack-issue-26754
Domain: domain:server
Seat: domain:server#3
File surface: packages/plugins/plugin-security/src/delegated-organization-membership.test.ts and, only if the fixture is shared there, the test helpers it imports under packages/plugins/plugin-security/src/** (test files only) (stop on breach; explain in the report). ⛔ No product source, ⛔ no timeout raise as the fix, ⛔ no skip or quarantine, ⛔ no packages/spec/**.
Container & model: M, mode:subagent, model: opus (dispatch-gates --tier: "no path-derived mandate … default opus"), effort: xhigh (p1)
Clause-②: no
Metadata-protocol: none
Responsibility: the parity it boots a stack and runs a read, an insert and an export per posture under vitest's 5 s default | none: no shared fixture or per-test budget covers it | every merge group whose affected set reaches plugin-security (evicted the queue at merge-group run 40509204270)
Thread-read: 6448237339
Premise: holds (seat re-check on origin/main 0ea90c7a18: the describe "[#25107 · ADR-0090 D10] parity: each probe agrees with the engine operation it describes" still loops ['group', 'isolated'] with one boot(posture) per it)
Serial constraints cleared: #26698 and #26596 (in flight, another account) declare packages/plugins/plugin-security/src/**, and #26641 declares security-plugin-explain-access.ts; this card edits one test file only: merge origin/main before the PR, and again if either lands first.

os-dev-report

{
  "issue": 26754,
  "status": "done",
  "branch": "claude/issue-26754-parity-test-budget",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/26872",
  "session": "session_01QSeKYmQXM3rHJcPnrEPk4B",
  "premise_still_valid": true,
  "summary": "The [#25107 · ADR-0090 D10] parity describe in packages/plugins/plugin-security/src/delegated-organization-membership.test.ts now boots one stack per posture in beforeAll (destroyed in afterAll), shared by three its: a read (find vs canReadObject and the read explanation), an export (find vs canExport) and an insert (insert vs canWriteObject insert), with the insert last. Each it asks only the probes it asserts. boot() gains lifetime: 'describe' so the file-level afterEach does not destroy the shared engine. Measured before cutting (instrumented copy, alone, warm, two rounds per posture, base 0ea90c7a18): boot and seed were 10.4-11.6% of the old it, the engine ops 15.7-17.6%, and the probes 71.4-73.9%, of which the five probes the it computed but never asserted (four field projections, the update probe; pinned per context elsewhere in the file) were 29.8-31.4%. The PM mechanism assumption that boot plus seeding is the cost is falsified. Sharing is sound: after all nine parity inserts, every asserted outcome is unchanged on both postures (outcomes-equal=true); only the rows a find returns change (rows-equal=false), which no parity assertion reads. Isolation is by order (the one writing it runs last), not by distinct rows. All 5 original assertion lines are kept byte-for-byte (modulo indentation, checked by script); the non-vacuity pin is repeated in the export it, so executed assertions go 74 to 76. Under the CI-shaped leg the slowest parity it went from 3 of 3 runs timing out (5403/5249/6126 ms) to at most 1885 ms over 6 loaded runs, and paired same-invocation runs show 2.2-2.8x on the slowest parity it. Test-only: no changeset (measured, nothing ships); per the dispatch the seat applies skip-changeset, and I applied no label. The card's assignee was already os-justin and was not touched.",
  "tests": "All readings on head e92c25a1b4 (git rev-parse --short HEAD, the PR head) unless marked base. LEG: the file at --maxWorkers=3 with VITEST_MAX_WORKERS=3 beside 11 pure-CPU node busy loops (12 runnable threads on 4 vCPU, approximating turbo --concurrency=4 x 3 workers), plus uncontrolled sibling-agent load (loadavg 4-17 recorded per run); every run under scripts/pm/os-verify-lock.sh. BEFORE (base 0ea90c7a18, 3 runs): group 5403 ms TIMED OUT / isolated 4830; group 3843 / isolated 5249 TIMED OUT; group 4509 / isolated 6126 TIMED OUT; vitest-exit=1 on all 3; the failing records' stacks anchor at the parity it (old line 648). AFTER (3 runs, vitest-exit=0, Tests 70 passed (70)): read/export/insert group then isolated = 1339/651/497 and 1486/311/528; 1216/680/776 and 1690/620/552; 1600/502/493 and 1885/682/812; 0 'timed out' lines. PAIRED (original file as an untracked byte-identical copy, blob 356eb401, plus the new file in ONE invocation, same burners, 3 runs, all exit 0): slowest parity it original/new 4159/1857 (2.2x), 4151/1523 (2.7x), 2957/1045 (2.8x); the unchanged control its agree within each run (2461/3054, 2413/2449, 1401/1511). The sequential after-runs met a lighter box (control its about 1.5x faster), so the paired ratio is the one to quote. ALONE: before group 897 / isolated 823 ms; after 315/153/167 and 286/116/115 ms. MUTATION CHECK (one-shot, nothing committed, scripts/ablation-replace.mjs wrap mode on security-plugin.ts): making each probe admit exactly the refused context (onBehalfOf plus tenantId org_d returns true) at canReadObject / canExport / canWriteObject reddened ONLY the read / export / insert it respectively, both postures, first failure e.g. 'delegated in org_d · qa_account: canExport ⇔ find (an export reads as a find): expected true to be false'; marker on disk 1 in each leg; each restore 'blob == HEAD (fe67e27b8705) and git diff HEAD is empty', marker after 0. A first attempt was a no-op: the replacement re-contained the anchor, the tool refused ('anchor count moved 1 -> 1'), and it was re-anchored and re-run. PACKAGE: vitest run --maxWorkers=3 over plugin-security: Test Files 231 passed (231), Tests 5036 passed | 45 skipped (5081). pnpm --filter @objectstack/plugin-security typecheck: exit 0, check:test-typecheck OK; tsc -p tsconfig.test.json --listFiles lists this file (1 hit, 231 test files). eslint on the changed file: exit 0, no output. Closure: turbo build --filter=@objectstack/plugin-security^... VERDICT command-exit 0 before and again after the merge. Not run locally: test:repo (CI's Test Core).",
  "gates": "Local, head e92c25a1b4: re-derived with no paths (node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack) = 52 commands, identical to the pre-merge derivation and to the seat's floor list. Each run with its exit code captured before any pipe: 50 exit 0; 2 exit 3 PREREQUISITE NOT MET = NOT MEASURED: pnpm check:dual-build-cjs-loads (needs every package's dist, 56 absent; 'This is NOT a pass: nothing was measured') and pnpm check:i18n (needs packages/cli/dist i18n extract plus its config closure; 'Nothing was checked'). Neither reads a test file, and both run in CI's Lint & Repo Gates. --ran over 'COMMAND :: exit CODE' lines: '52 derived famil(ies) accounted for — 50 run, 2 NOT-MEASURED (2 DERIVED from a recorded exit 3)'. Lane blind spot: pnpm exec eslint on the changed file, exit 0. CI, PR check-runs on e92c25a1b4 at report time (one read, no polling): 20 runs, 17 in_progress, Governed Surface Queue Guard completed/success, 2 skipped. Lint & Repo Gates, TypeScript Type Check, Test Core and Build Core were not yet listed or were in_progress: in_progress is the honest value. Check Changeset in_progress; it is expected to need the seat's skip-changeset label, since the diff ships nothing.",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm (Clause-②: no)",
  "mcp_calls": "0 — no MCP GitHub calls of any kind",
  "api_writes": "2 relay strokes, each a POST /repos/objectstack-ai/objectstack/dispatches executed by fleet-write as objectstack-fleet[bot]: (1) pr_create, run 40568226582 success: POST /repos/objectstack-ai/objectstack/pulls (draft) and POST /repos/objectstack-ai/objectstack/issues/26872/assignees (os-justin); the relay's read-back reports 17574 bytes sent and stored, identical, and my REST read-back matches the local body byte-for-byte; (2) this os-dev-report comment via scripts/pm/post-stamped.mjs: POST /repos/objectstack-ai/objectstack/issues/26754/comments. No label writes, no PATCH of the PR body, no card assignee write. git push x3 (empty-branch probe, the commit, the merge) is not REST.",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: none · noted, not filed (observation, nothing failed): with the parity its fixed, the slowest its left in delegated-organization-membership.test.ts are the three '[#25107] what the rule leaves alone in the probes' admitted-probe its (each runs probeAnswers over three objects). On the same CI-shaped leg they reached 1.9-3.9 s before and 1.5-3.1 s after, under 5 s in all 9 loaded runs. Recorded in the PR's Acceptance notes. Dedupe words: plugin-security, leave alone probes, probeAnswers, vitest timeout, shard load"
  ],
  "files_changed": [
    "packages/plugins/plugin-security/src/delegated-organization-membership.test.ts (+77 / -29 vs merge-base 8eef9a8db4; the only file in the branch's delta)"
  ],
  "line_budget": "n/a — no skills/**, no SKILL.md and no ratcheted ledger touched; diff is +77/-29 in one test file inside the claim's File surface",
  "deviations": [
    "Labels: os-dev.md has skip-changeset ride pr_create, but the dispatch forbids it ('the seat applies skip-changeset (do not try to add the label yourself)'). Under os-dev.md's forbidden-write clause I made zero label writes; the PR carries no labels.",
    "Not re-merged after e92c25a1b4 (merged origin/main 8eef9a8db4 before every reading). 9 commits landed since; none touches packages/plugins/plugin-security, and neither #26698 nor #26596 landed (git log 0ea90c7a18..origin/main grep exit 1; control #26801 counts 1 in the same range). This keeps the gate union on the PR head.",
    "Sequential before-runs are on base 0ea90c7a18 and after-runs on merge e92c25a1b4. The upstream path changes are moves plus #26801's explain-another-user check, which the parity read never takes (no request.userId). The paired runs on one tree remove the difference.",
    "Shard load is approximated by CPU busy loops, not a real Test Core shard.",
    "2 of 52 derived gates are NOT MEASURED locally (exit 3, prerequisite: whole-workspace build), left to CI's Lint & Repo Gates.",
    "test:repo not run locally (CI's Test Core); the diff touches no repo-project test.",
    "Commit trailers: the commit carries AGENTS.md's model-free pair (Claude-Session plus Co-authored-by: Claude), not the harness reminder's model-named Co-Authored-By, per os-dev.md's precedence rule. The merge commit e92c25a1b4 carries git's default message, with no trailer.",
    "First mutation attempt was a no-op (refused by ablation-replace before measuring); re-anchored and re-run, both reported."
  ]
}

Generated by Claude Code

ACCEPT → PR #26872 comment 6451533639 · domain:server seat 3 · 2026-10-27T19:28Z. The claim's mechanism assumption (boot + seed is the cost) is falsified by the dev's split (probes ~72%); corrected in that record. Landing waits on CI green.

Landed · domain:server seat 3 · 2026-10-27T20:19Z

reading	value
PR #26872	merged through the queue, merge commit `2551404ec`
this card	closed `completed` by the PR's `Fixes` line

State: pm:dispatched removed in the same pass.

Navigation Menu

Repository navigation

plugin-security: the delegated-organization-membership parity test runs 2.2–3.6 s under shard load against vitest's 5 s timeout and evicts merge-queue builds #26754

Triage: audit line · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-27T17:00Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Test	Under shard load	File alone
`group`	2,166 / 3,637 / 2,789 ms on the merge content; 2,862 ms on `main`	about 0.75 to 1.2 s
`isolated`	2,407 / 3,523 / 2,420 ms; 3,089 ms on `main`	—

plugin-security: the delegated-organization-membership parity test runs 2.2–3.6 s under shard load against vitest's 5 s timeout and evicts merge-queue builds #26754

Description

Activity

objectstack-fleet commented on Oct 27, 2026

Triage: audit line · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-27T17:00Z

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: audit line · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-27T17:00Z