bootstrap과 feature 어댑터가 어댑터 내부 파일을 직접 겨누던 15곳을 그룹
배럴로 바꾼다. 커널(platform/**) 간선과 그룹 내부 import는 파일 경로를
유지한다 — check:adapter-inventory가 그 경로를 직접 검증한다.
번들 영향 없음: 초기 JS가 도입 전후 모두 181114 gzip bytes로 동일하다.
sideEffects 선언 없이도 재수출이 트리셰이킹된다.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The cgroup test read the live process tree with one `ps` per pid and asserted
while the provider was running. That was a race it used to win only because the
sandbox was slow; now a whole run finishes in a few hundred milliseconds and
`systemctl show` alone costs longer than the thing it describes. It records the
tree from `/proc` every 5ms and asserts on the recording once the run is over,
because the assertions were always about what the run contained.
That restructuring immediately paid for itself: the supervisor had been failing
to launch the sandbox at all, and the test was dying on the observation before
it ever checked the exit code.
It could not say why, because the supervisor consumed the child's output solely
to enforce a byte cap and then discarded it — `exit=1` and nothing else. It now
keeps the lines the sandbox tooling itself emits (`bwrap:`, `prlimit:`,
`systemd-run:`, `systemctl:`), which cannot carry provider credentials because
the provider command and its secrets travel in the args file. The failure now
reads:
sandboxed external provider failed: exit=1; sandbox reported:
bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted
which is a host restriction — `kernel.apparmor_restrict_unprivileged_userns=1`
— reproducible in two lines of shell containing none of this repository's code,
and recorded in the ledger as such rather than carried as a product defect.
Suites that spawn processes, build archives and sign evidence were given a 30s
budget. The 10s default is sized for pure-JS unit tests; raising it globally
would hide a genuinely hung test.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
