L01-05 — Qualify hostile and production resource envelopes

[mberrys]

Outcome

Run bounded parser, image, page-count, cache, timing, cancellation, and recovery workloads under declared budgets.

Parent and boundary

Parent: #2. Owner: LoopLibCore. This issue owns one bounded slice of Evidence Core; consume accepted upstream contracts and keep PDF/verdict/publication authority with Core.

Acceptance

• Each required workload yields measured max memory/time and explicit terminal disposition.
• Failure case: Crashes, OOM, hangs, or skipped workloads cannot count as a passing envelope.

Required proof

Reproducible corpus manifest, metrics, and exact CI run IDs. Record the exact source SHA, test command or hosted run, fixture/artifact identity, and any skipped or unavailable lane. Run the repository's mapped proof and check-change gate for a PR.

Handoff

Record changed files, observed result, remaining risk, and a 1–3 sentence anti-slop review. Completion means acceptance evidence, not merely a merged implementation.

Sources

Approved master roadmap · Legacy/research input (legacy #619).

[mberrys]

Acceptance evidence

• Source SHA: 4388ca36db44cc187ba22031ef5e5aed8e3e2477 on unstable, in PR [0.3.0 first half] L01 Evidence Core train — unstable → stable #155 (unstable -> stable). The hosted PR runs checked out merge commit 2fa707a47677e56ca825ed9e28460d6edc3e138c; its tree (f4a0696645f24cf9fdecf87c7da7bb6a9748519f) is identical to the tree of 4388ca36 (checked with git rev-parse). The qualification evidence reports candidate_sha: 2fa707a47677e56ca825ed9e28460d6edc3e138c.
• Implementing commits: be4edcd4 (L01-05 — Qualify hostile and production resource envelopes #19, merged to dev as PR feat(envelope): qualify hostile and production resource envelopes (#19) #107) and the envelope follow-ups f6b48584, 64de840b, 4d9d02f0, f8b46038, 8a789dd9, 04ead25a, 14264ad6, 648d160b, c9af5df2, d7eeebb7, 7d24c836, 0f10c873, plus manifest commits 52079abb and e3c26269.

Criteria to command to hosted run

Hosted run: Resource envelope qualification 36782669570, workflow .github/workflows/resource-envelope-qualification.yml. Per platform it runs python -m scripts.resource_envelope.run_matrix --strict (3 repetitions, 1800 s per-process timeout, cancellation fixture ten-thousand-page), then an evidence job builds and validates the evidence.

Criterion	Evidence	Result
Each required workload yields measured max memory/time and an explicit terminal disposition	Strict matrix summary printed by each platform job: "total": 6, "measured": 5, "flagged": 0, "skipped": 1, "failed": 0, "candidate_sha_verified": true, "cancellation_recovery_probe": "measured", "hostile_contained": "7/7". Linux: job 110116493149. Windows: job 110116493342. In scripts/resource_envelope/run_matrix.py (run_fixture), a record is measured only when it has no validation errors, every run reported envelope status complete, RSS stayed within the resident policy, and identity matched the candidate SHA and fixture digest.	Both jobs succeeded
Required workloads	FIXTURE_SPECS marks office-2mb, image-heavy-500mb, ten-thousand-page, pathological-vector, transparency-spots as required: 5 measured, 0 flagged. The 1 skipped record is multi-gb, which FIXTURE_SPECS marks required: False.	As stated
Evidence disposition	evidence job, job 110148797045: "disposition": "passed", "reasons": [], then validate_resource_envelope_evidence.py printed "status": "valid" with "candidate_sha": "2fa707a47677e56ca825ed9e28460d6edc3e138c".	Success
Failure case: crashes, OOM, hangs, skipped workloads cannot count as passing	matrix_passes(strict=True) fails on any failed record, any uncontained hostile case, a failed or missing cancellation probe, or any required workload flagged or unavailable. Python tests in the Release Gate run 36782669896 (Ran 59 tests ... OK in both linux / build 110116570084 and windows / build 110116569911) include test_crashed_process_fails_even_with_an_envelope, test_timeout_fails, test_hung_interrupt_fails, test_high_water_above_limit_is_rejected, test_partial_output_exit_is_flagged_not_measured, test_matrix_records_missing_required_and_optional_fixtures, test_strict_requires_probe_hostile_and_no_flags, test_uncontained_hostile_case_fails_even_without_strict, test_passed_claim_with_unavailable_measurement_is_invalid, test_passed_disposition_is_rejected.	All ok; none FAIL, ERROR or skipped
Cancellation and recovery	Probe status measured on both platforms (summary above); test_cancelled_run_and_reopen_are_measured is ok in the Release Gate log.	As stated
Hostile corpus	hostile_contained: 7/7 on both platforms.	As stated

Fixture and artifact identity

The synthetic corpus is deterministic: the fixture manifest printed by the Linux and Windows jobs carries identical SHA-256 values.

Fixture	SHA-256	Bytes
office-2mb	6305dc367a4d2f3f11bcdb39459adfbb48275958622916cf03807f29a490bca6	2016212
image-heavy-500mb	172940d3b3f27a5a278de606948b8fa799b3a298fc7ba24cc60759fcbef1c5a9	501532857
ten-thousand-page	984bcf837d312510144bc659624f866ff1419e5279170cd8f3658ea459a82874	61960867
pathological-vector	5517185518d353635366270ff41e3e2a56cf1d6d21187e84aba8fc6a44aa6c0f	6369566
transparency-spots	d4316776aaacb9f056da41925cea51fd68bf1b00ae7b53e1326306e1d85810b3	3266105

Uploaded artifacts (not expired when checked; expires_at 2026-12-29): resource-envelope-matrix-linux id 11130488864 (sha256:f2139edf42fb4056563c395ddf50c9d99088b858960abcf886a5a7f74020bc32), resource-envelope-matrix-windows id 11132815265 (sha256:e8327d33cc3a983ea34a83144032a65dd23668436179e13d91b3c25cfb285972), resource-envelope-evidence id 11132760204 (sha256:a348d1a74f1b2365df045284c3a4501c3f8e78d9c8c534516fb7d1e2a6f45461).

Check-change and architecture gates

Hosted agent_contract (job 110116496019) succeeded; it runs check-change.py --dry-run, so it plans and does not execute the proof. Local read-only run at 4388ca36: check-change.py --base origin/stable --head 4388ca36db44cc187ba22031ef5e5aed8e3e2477 --head-branch unstable --dry-run --skip-changelog exited 0, and check-architecture.py printed architecture contracts ok. The native proof ran in Release Gate: linux / build and windows / build both printed 100% tests passed, 0 tests failed out of 91, with UnitTestsWorkloadEnvelope, UnitTestsResourceBudget, UnitTestsBudgetExhaustion, UnitTestsBudgetCorpus and UnitTestsPdfToolContract each Passed.

Skipped or unavailable lanes

• multi-gb workload: skipped, optional by design (see above).
• The push CI run on unstable (36782282330) skipped linux, windows and agent-fast; the PR-event runs above executed them.

Changed files

.github/workflows/resource-envelope-qualification.yml, .github/workflows/reusable-linux.yml, .github/workflows/reusable-windows.yml, LoopLibCore/sources/pdfcolorinventory.{cpp,h}, pdfevidencegraph.{cpp,h}, pdfrenderer.cpp, pdfresourcebudget.h, pdfworkloadenvelope.cpp, preflightengine.cpp, PdfTool/main.cpp, pdftoolabstractapplication.{cpp,h}, pdftoolrender.{cpp,h}, scripts/resource_envelope/run_matrix.py, synthetic_workload.py and their tests, scripts/qualification/build_resource_envelope_evidence.py, validate_resource_envelope_evidence.py and tests, UnitTests/tst_evidencegraphtest.cpp, tst_pdftoolcontract.cpp, tst_resourcebudgettest.cpp, tst_workloadenvelopetest.cpp, docs/RESOURCE_ENVELOPE.md, docs/RESOURCE_ENVELOPE_QUALIFICATION.md, docs/RESOURCE_BUDGETS.md, docs/RESOURCE_ENVELOPE_BUDGETS.json, docs/generated/huge-document-envelope.json, changes/cc-issue-19-resource-envelopes.{md,evidence.yaml}.

Observed result

Both hosted platforms finished the strict matrix with 5 of 5 required workloads measured, 0 flagged or failed, the cancellation/reopen probe measured, the hostile corpus 7/7 contained, and evidence disposition passed and valid.

Remaining risk

• The per-workload maximum-memory and time values are in the uploaded artifacts above. I did not download or open them, and the run logs print only the summary counts, so the numbers are not quoted here.
• changes/cc-issue-19-resource-envelopes.evidence.yaml says the hosted measurements would be recorded under docs/evidence/issue-19-resource-envelope/ after the run. That directory does not exist on unstable, so the artifacts (90-day retention) are the only record until it is added.
• The same manifest lists unresolved: core:scripts/ci/check_independent_validation_gate.py (belongs to L01-04 — Prove independent standards and rendering claims #18).
• One run per platform on GitHub-hosted runners; this says nothing about other hardware.

Quality review

The qualification path is fail-closed: required, optional, flagged and failed outcomes are separate states, and the strict gate refuses skipped required workloads, so the pass is not a green aggregate. I read run_matrix.py and the tests named above but did not review the native changes line by line.

Closes on merge of #155 into stable.