/// Calls with these resolved item names can create wall-clock waits or /// failure-producing deadlines. They are denied in every workspace role unless /// the exact compiler-resolved call site is registered below. const GUARDED_TIMING_ITEMS: &[&str] = &[ "park_timeout", "recv_deadline", "set_read_timeout", "recv_timeout", "sleep", "sleep_until", "timeout", "timeout_at", "wait_timeout", "wait_timeout_while", ]; #[derive(Clone, Copy)] struct TimingAllowance { package: &'static str, caller: &'static str, callee: &'static str, calls: usize, purpose: &'static str, } const fn timing( package: &'static str, caller: &'static str, callee: &'static str, calls: usize, purpose: &'static str, ) -> TimingAllowance { TimingAllowance { package, caller, callee, calls, purpose, } } /// Exact audited boundaries. A rename, a different API, or one additional call /// exceeds this registry and fails compilation. Never register a generic /// timeout wrapper: callers of a timing API must remain visible to this guard. const TIMING_ALLOWANCES: &[TimingAllowance] = &[ // Runtime and external-resource boundaries. timing( "swactor-engine", "::poll", "tokio::time::sleep", 1, "Tokio execution-backend adapter", ), timing( "swactor-process", "::read", "std::thread::sleep", 1, "external process-file polling", ), timing( "swactor-process", "operations::find_process_identities_with_retry", "std::thread::sleep", 1, "external process discovery retry", ), timing( "swactor-process", "operations::spawn_identity_exit_wait::{closure#0}", "std::thread::sleep", 1, "external process exit polling", ), timing( "swactor-process", "operations::spawn_shared_child_wait::{closure#0}", "std::thread::sleep", 1, "external child exit polling", ), timing( "swactor-process", "operations::terminate_process_group", "std::thread::sleep", 1, "process termination grace period", ), timing( "swactor-process", "operations::wait_for_path", "std::thread::sleep", 1, "external path publication polling", ), timing( "iroh-driver", "edge_transport::spawn_edge_send_pump", "std::sync::mpsc::Receiver::recv_timeout", 1, "edge sender startup handoff", ), timing( "iroh-driver", "edge_transport::spawn_edge_send_pump::{closure#0}::{closure#0}", "swactor_engine::EngineHandle::timeout", 2, "edge stream write and finish deadlines", ), timing( "iroh-driver", "iroh_driver::AdapterPump::spawn_connect::{closure#0}::{closure#0}", "swactor_engine::EngineHandle::timeout", 1, "peer connection deadline", ), timing( "iroh-driver", "iroh_driver::IrohDriver::send_tagged_gossip::{closure#0}::{closure#0}", "swactor_engine::EngineHandle::timeout", 1, "gossip connection deadline", ), timing( "iroh-driver", "iroh_driver::IrohDriver::connect_peer::{closure#0}", "swactor_engine::EngineHandle::timeout", 1, "peer connection deadline", ), timing( "iroh-driver", "iroh_driver::PeerConnector::connect::{closure#2}::{closure#0}", "swactor_engine::EngineHandle::timeout", 1, "peer connection deadline", ), timing( "iroh-driver", "iroh_driver::IrohDriver::spawn_join_request::{closure#0}::{closure#0}", "swactor_engine::EngineHandle::timeout", 1, "seed connection deadline", ), timing( "iroh-driver", "stream_transport::IrohStreamTransport::accept_connection::{closure#0}", "swactor_engine::EngineHandle::timeout", 1, "untrusted inbound stream preamble read deadline before stream identity is known", ), timing( "swactor-vastai", "blocking::BlockingVastClient::list_by_label_with_retry::{closure#0}", "tokio::time::timeout", 1, "one absolute provider-discovery owner across all requests and rate pacing", ), timing( "swactor-vastai", "blocking::BlockingVastClient::list_by_label_with_retry::{closure#0}::{closure#0}", "tokio::time::sleep", 1, "external provider discovery retry pace under the enclosing owner deadline", ), timing( "swactor-vastai", "observation::ProviderObserver::census::{closure#0}", "tokio::time::timeout_at", 3, "same absolute deadline bounds shared provider observer lock, rate wait, and HTTP response", ), timing( "swactor-vastai", "observation::ProviderObserver::census::{closure#0}", "tokio::time::sleep_until", 1, "provider Retry-After and shared account-query capacity boundary", ), timing( "swactor-vastai", "client::VastClient::execute::{closure#0}", "tokio::time::timeout_at", 1, "inherited absolute execution deadline; reserved cleanup remains independently owned", ), timing( "swactor-vastai", "observation::ProviderObserver::status::{closure#0}", "tokio::time::timeout_at", 1, "bounded shared exact-contract status observation", ), timing( "swactor-vastai", "observation::ProviderObserver::status::{closure#0}::{closure#0}::{closure#1}", "tokio::time::sleep_until", 1, "shared per-contract Retry-After floor survives observer cancellation", ), timing( "swactor-vastai", "observation::tests::header_retry_after_survives_cancelled_response_body::{closure#0}", "tokio::time::timeout", 2, "test cancellation during withheld body must preserve received provider cooldown", ), timing( "swactor-vastai", "observation::tests::inherited_execution_deadline_contains_label_retries_but_not_reserved_cleanup::{closure#0}", "tokio::time::timeout", 1, "test fuse for expired execution and independent reserved cleanup", ), timing( "swactor-vastai", "observation::tests::cancelled_status_wait_preserves_shared_retry_after_without_blocking_other_contracts::{closure#0}", "tokio::time::timeout", 3, "test cancellation and sibling progress under a retained provider cooldown", ), timing( "swactor-vastai", "monitor::tests::endpoint_discovery_uses_label_endpoint_before_running_status::{closure#0}", "tokio::time::timeout", 1, "test endpoint progress before provider running status", ), timing( "swactor-vastai", "monitor::tests::usable_exact_endpoint_cancels_listing_wait_without_resetting_provider_cooldown::{closure#0}", "tokio::time::timeout", 1, "test exact endpoint progress while account listing is rate limited", ), timing( "swactor-vastai", "client::VastClient::with_base_url", "reqwest::ClientBuilder::timeout", 1, "provider HTTP request deadline", ), timing( "swactor-vastai", "lease::provision_fleet::{closure#0}", "tokio::time::sleep", 1, "provider lease pacing", ), timing( "swactor-vastai", "provision::create_instance::{closure#0}", "tokio::time::sleep", 1, "provider create rate-limit backoff", ), timing( "swactor-vastai", "lease::provision_one::{closure#0}", "tokio::time::sleep", 1, "provider retry backoff", ), timing( "swactor-vastai", "monitor::wait_for_running_with_observer::{closure#0}", "tokio::time::sleep", 2, "provider lifecycle polling", ), timing( "swactor-vastai", "monitor::wait_for_ssh_endpoint_with_observer::{closure#0}", "tokio::time::sleep", 2, "provider endpoint polling", ), timing( "swactor-vastai", "teardown::destroy_instance_with_retry_policy::{closure#0}", "tokio::time::sleep", 1, "provider teardown backoff", ), timing( "telemetry", "endpoint::TelemetrySubscription::recv_timeout::{closure#0}", "crossbeam_channel::Receiver::recv_timeout", 1, "bounded external telemetry observation", ), // Test and harness safety fuses. These bound real external concurrency; // virtual-time behavior continues to use the stepping backend. timing( "dashboard", "control::properties::generated_concurrent_bridge_commands_forward_once_and_shutdown::{closure#1}", "std::sync::mpsc::Receiver::recv_timeout", 1, "test completion fuse", ), timing( "dashboard", "server::tests::send_control_request::{closure#0}", "tokio::time::timeout", 1, "test HTTP completion fuse", ), timing( "data-plane", "cancellation_and_transport_faults_reclaim_waiters_and_preserve_unrelated_progress::{closure#0}", "std::thread::sleep", 1, "test cleanup observation poll", ), timing( "data-plane", "cancelled_write_open_releases_queued_grant", "std::thread::sleep", 2, "test cancellation observation poll", ), timing( "data-plane", "host_read_resolves_file_source_and_seals_final_arena_lease", "std::thread::sleep", 4, "test lease reclamation observation poll", ), timing( "data-plane", "live_view_prevents_reclaim_until_last_guard_drops", "std::thread::sleep", 1, "test lease reclamation observation poll", ), timing( "distribution", "snapshot_and_swim_telemetry::swim_telemetry_records_probe_events_and_timeout_state_without_fabricating_rtt", "std::thread::sleep", 2, "wall-clock telemetry contract", ), timing( "iroh-driver", "common::iroh::IrohTestCluster::pump_until", "std::thread::sleep", 1, "live network convergence fuse", ), timing( "iroh-driver", "common::iroh::pump_until", "std::thread::sleep", 1, "live network convergence fuse", ), timing( "iroh-driver", "common::iroh::pump_until_pair", "std::thread::sleep", 1, "live network convergence fuse", ), timing( "iroh-driver", "endpoint_addr_includes_home_relay", "std::thread::sleep", 1, "live relay convergence fuse", ), timing( "iroh-driver", "pull_collector_cancellation_interrupts_inflight_io", "std::sync::mpsc::Receiver::recv_timeout", 1, "test setup completion fuse", ), timing( "iroh-driver", "pull_collector_cancellation_interrupts_inflight_io", "std::thread::sleep", 2, "live network cancellation observation", ), timing( "iroh-driver", "pull_replays_startup_and_disconnect_frames_without_duplicates::{closure#0}", "swactor_engine::EngineHandle::timeout", 1, "engine-owned live telemetry replay test completion fuse", ), timing( "iroh-driver", "real_iroh_transfer_delivers_exact_file_bytes", "std::sync::mpsc::Receiver::recv_timeout", 2, "live transfer completion fuse", ), timing( "iroh-driver", "real_iroh_transfer_delivers_exact_file_bytes", "std::thread::sleep", 2, "live transfer progress poll", ), timing( "iroh-driver", "same_runtime_transfer_bypasses_iroh_self_connection", "std::sync::mpsc::Receiver::recv_timeout", 4, "local transfer completion fuse", ), timing( "iroh-driver", "edge_transport::EdgeSendHandle::finish", "std::sync::mpsc::Receiver::recv_timeout", 1, "edge transport completion fuse", ), timing( "iroh-driver", "recv_until", "std::sync::mpsc::Receiver::recv_timeout", 1, "live transport observation fuse", ), timing( "myelin", "node::worker_node_runtime::control_flow_properties::agent_cpu_sampler_emits_decodable_host_stats", "std::thread::sleep", 1, "hardware sampler observation", ), timing( "myelin", "orchestration::app::hardware_telemetry_tests::orchestrator_emits_all_host_hardware_channels", "std::thread::sleep", 1, "hardware sampler observation", ), timing( "myelin", "provisioning::tests::local_process_stop_releases_all_observer_actors", "std::thread::sleep", 1, "process shutdown observation", ), timing( "myelin", "provisioning::tests::recv_provider_event", "std::sync::mpsc::Receiver::recv_timeout", 1, "provider observation fuse", ), timing( "myelin", "tests::data_namespace_guarantees::wait_until", "std::thread::sleep", 1, "live namespace convergence fuse", ), timing( "myelin", "tests::engine_composition::poll_connect", "std::thread::sleep", 1, "live server connection fuse", ), timing( "myelin", "tests::engine_composition::recv_within", "std::thread::sleep", 1, "engine observation fuse", ), timing( "swactor-vastai", "teardown::cleanup_owned_reconciled_with_observer::{closure#0}", "tokio::time::sleep_until", 2, "absolute owned-contract cleanup deadline and unchanged-provider reconciliation", ), timing( "swactor-process", "operations::command_output_until", "std::sync::mpsc::Receiver::recv_timeout", 1, "inherited command deadline with synchronous owned kill, reap and I/O join", ), timing( "myelin-e2e-fuzz", "harness::raw_fleet::wait_for_ssh_banner", "std::net::TcpStream::set_read_timeout", 1, "raw fixture sshd banner read bound", ), timing( "myelin-e2e-fuzz", "budget::Budget::wait", "std::sync::Condvar::wait_timeout", 1, "execution-owner cancellation wake and reconciliation bounded by inherited absolute budget", ), timing( "myelin-e2e-fuzz", "resources::http_read", "std::net::TcpStream::set_read_timeout", 1, "control HTTP response read bounded by the caller's remaining absolute budget", ), timing( "myelin-e2e-fuzz", "harness::control::tests::canceled_stalled_http_joins_and_preserves_final_channel_outcome", "std::sync::mpsc::Receiver::recv_timeout", 1, "test-only canceled HTTP channel completion fuse", ), timing( "myelin-e2e-fuzz", "harness::control::tests::canceled_stalled_http_joins_and_preserves_final_channel_outcome::{closure#0}", "std::sync::mpsc::Receiver::recv_timeout", 1, "test-only stalled HTTP peer release fuse", ), timing( "myelin-e2e-fuzz", "harness::control::tests::canceled_stalled_http_joins_and_preserves_final_channel_outcome::{closure#1}", "std::sync::mpsc::Receiver::recv_timeout", 1, "test-only accepted HTTP connection setup fuse", ), timing( "myelin-e2e-fuzz", "resources::resource_deadline_tests::read_request", "std::net::TcpStream::set_read_timeout", 1, "scripted HTTP peer request-read bound", ), timing( "myelin-e2e-fuzz", "harness::control::tests::withheld_terminal_event_expires_after_healthy_sibling_and_drains_remaining_stops::{closure#2}::{closure#0}", "std::net::TcpStream::set_read_timeout", 1, "test-only loopback control peer request-read fuse while execution terminal evidence is withheld", ), timing( "myelin", "orchestration::provider_adapters::ssh_bootstrap::tests::withheld_ssh_banner_reaps_transport_and_preserves_sibling_cleanup::{closure#0}::{closure#0}", "std::net::TcpStream::set_read_timeout", 1, "test-only SSH peer EOF observation fuse after supervised transport cancellation", ), timing( "myelin", "orchestration::provider_adapters::ssh_bootstrap::tests::withheld_ssh_banner_reaps_transport_and_preserves_sibling_cleanup::{closure#0}", "std::sync::mpsc::Receiver::recv_timeout", 2, "test-only bounded observation of independent engine-owned process and cleanup completion", ), timing( "myelin", "orchestration::provider_adapters::ssh_bootstrap::tests::withheld_ssh_banner_reaps_transport_and_preserves_sibling_cleanup", "std::sync::mpsc::Receiver::recv_timeout", 1, "test-only observation actor retirement fuse after final process completion", ), timing( "myelin-e2e-fuzz", "resources::resource_deadline_tests::withheld_dashboard_response_expires_and_releases_connection::{closure#0}", "std::sync::mpsc::Receiver::recv_timeout", 1, "test-only withheld HTTP peer release fuse", ), timing( "myelin-e2e-fuzz", "resources::resource_deadline_tests::trickle_response_cannot_renew_total_deadline::{closure#0}", "std::sync::mpsc::Receiver::recv_timeout", 1, "scripted slow HTTP body pacing interrupted by test completion", ), timing( "myelin-e2e-fuzz", "resources::resource_deadline_tests::framed_response_finishes_without_waiting_for_peer_close::{closure#0}", "std::sync::mpsc::Receiver::recv_timeout", 1, "test-only keep-alive peer release fuse after framed response", ), timing( "myelin-e2e-fuzz", "resources::resource_deadline_tests::ambiguous_post_is_not_duplicated_by_transport::{closure#0}", "std::sync::mpsc::Receiver::recv_timeout", 1, "test-only ambiguous HTTP POST peer release fuse", ), timing( "myelin-e2e-fuzz", "remote::spawn_cleanup_supervisor::{closure#1}", "std::thread::sleep", 1, "bounded independent cleanup-process readiness observation before paid authorization", ), timing( "myelin-e2e-fuzz", "remote::run_cleanup_supervisor", "std::thread::sleep", 2, "OS-held cleanup-worker lock observation and restart backoff; durable duty survives foreground expiry", ), timing( "myelin-e2e-fuzz", "remote::tests::supervisor_tests::release_after_supervisor_probe", "std::thread::sleep", 1, "test-only bounded observation of the initial supervisor-lock probe", ), timing( "myelin-e2e-fuzz", "remote::tests::supervisor_tests::exiting_observed_supervisor_restarts_renewed_cleanup", "std::os::unix::net::UnixStream::set_read_timeout", 2, "test-only subprocess ownership startup and release handshake fuses", ), timing( "myelin-e2e-fuzz", "remote::run_cleanup_owner", "std::thread::sleep", 1, "durable external-provider cleanup supervisor heartbeat and retry reconciliation", ), timing( "myelin-e2e-fuzz", "remote::await_cleanup_owner", "std::thread::sleep", 1, "foreground deadline for observing independent durable cleanup completion", ), timing( "myelin-e2e-fuzz", "remote::cleanup_paid_ownership::{closure#0}", "std::thread::sleep", 1, "bounded durable cleanup-owner completion and recovery observation", ), timing( "myelin", "orchestration::control::actor_snapshot::{closure#0}", "tokio::time::timeout", 1, "HTTP producer-admin census response deadline", ), timing( "myelin", "orchestration::control::retained_blobs::{closure#0}", "tokio::time::timeout_at", 1, "single HTTP ownership-query deadline shared by every namespace resource lookup", ), timing( "myelin", "orchestration::control::namespace_cleanup::{closure#0}::{closure#1}", "tokio::time::timeout_at", 1, "single HTTP cleanup deadline shared by quiescence and committed-absence checks", ), timing( "myelin", "node::worker_node_runtime::send_debug_join_request", "std::os::unix::net::UnixStream::set_read_timeout", 1, "local diagnostic join socket read clamped to remaining command deadline", ), timing( "swactor-engine", "common::wait_for", "std::thread::sleep", 1, "engine test completion fuse", ), timing( "swactor-engine", "engine_interval_recurs", "std::sync::mpsc::Receiver::recv_timeout", 1, "engine test completion fuse", ), timing( "swactor-engine", "engine_runs_without_an_ambient_tokio_runtime", "std::sync::mpsc::Receiver::recv_timeout", 1, "engine test completion fuse", ), timing( "swactor-engine", "engine_timer_can_be_created_off_runtime", "std::sync::mpsc::Receiver::recv_timeout", 1, "engine test completion fuse", ), timing( "swactor-engine", "engine_timer_fires", "std::sync::mpsc::Receiver::recv_timeout", 1, "engine test completion fuse", ), timing( "swactor-engine", "idle_core_observes_late_external_work_within_idle_interval", "std::thread::sleep", 1, "real idle-driver timing contract", ), timing( "swactor-engine", "spawned_supporting_work_runs", "std::sync::mpsc::Receiver::recv_timeout", 1, "engine test completion fuse", ), timing( "swactor-engine", "stepping_blocking_work_runs_isolated", "std::thread::sleep", 1, "blocking worker completion poll", ), timing( "swactor-engine", "stepping_blocking_work_runs_isolated::{closure#0}", "std::thread::sleep", 1, "blocking worker timing probe", ), timing( "swactor-process", "drive_once", "std::thread::sleep", 1, "process integration driver pacing", ), timing( "swactor-process", "supervisor::tests::collect_until_finished", "std::thread::sleep", 1, "process supervisor completion fuse", ), timing( "swactor-process", "supervisor::tests::join_finished", "std::thread::sleep", 1, "process supervisor completion fuse", ), timing( "swactor-process", "supervisor::tests::supervisor_stop_escalates_to_kill_after_deadline", "std::thread::sleep", 1, "process escalation timing contract", ), timing( "swactor-vastai", "monitor::tests::loading_state_remains_slow_progress_before_terminal_evidence::{closure#0}", "tokio::time::timeout", 1, "provider test non-completion fuse", ), timing( "swactor-vastai", "teardown::tests::owned_cleanup_deadline_covers_parallel_deletions::{closure#0}", "tokio::time::timeout", 1, "provider cleanup test non-completion fuse", ), timing( "telemetry", "hardware::tests::blocking_sampler_runs_sequentially_with_monotonic_sequences", "std::sync::mpsc::Receiver::recv_timeout", 2, "sampler test completion fuse", ), timing( "telemetry", "submit_text_owned_queues_owned_string", "telemetry::TelemetrySubscription::recv_timeout", 1, "telemetry test observation fuse", ), timing( "xtask", "demo::feed::properties::generated_supervisor_transitions_are_once_only_nonblocking_and_clean::{closure#1}", "std::sync::mpsc::Receiver::recv_timeout", 1, "blocking-provider test completion fuse", ), timing( "actor-lint-test-wait-pass", "bounded_observation_wait_is_allowed", "std::sync::mpsc::Receiver::recv_timeout", 1, "compiler policy pass fixture", ), timing( "actor-lint-timing-overage", "exceeds_registered_timing_budget", "std::sync::mpsc::Receiver::recv_timeout", 1, "compiler policy overage fixture", ), timing( "swactor-vastai", "test_http::serve", "std::net::TcpStream::set_read_timeout", 1, "test HTTP request completion fuse", ), timing( "telemetry", "carry_over_real_socket", "std::net::UdpSocket::set_read_timeout", 1, "live telemetry socket completion fuse", ), timing( "python", "context::PyTestDataPlaneHost::run_contextual_process", "std::thread::sleep", 1, "debug test-host contextual output poll interval", ), ];