[lidge-jun]

Summary

windows 9/11 in dev batch 42694893702 (4b38e9a) was cancelled at the 30-minute job limit in batch 42/48. No test failed. Its first big contributor is the ocx-child Rust conformance runner: since #8458 it compiles and passes in 48 s, where before it failed in 0.5 s. scripts/ci/test-durations.windows.tsv had no row for it, so the shard planner weighed it at the median. The table had no row for 131 files that exist today, all weighed at the median, and other rows no longer matched Windows timings, so one shard ran well past the planner's estimate.

This refreshes the Windows table with bun scripts/ci/test-durations.ts refresh --table scripts/ci/test-durations.windows.tsv from the eleven Windows job logs of that run: 3016 rows, 2949 measured, 67 retained. 125 of the 131 missing files gain a row; six were never reached by these logs and still weigh the median (tests/service/doctor-bun-install.test.ts, tests/update/update-bounded-json.test.ts, tests/update/update-root-snapshot.test.ts, tests/update/update-sync-mutex.test.ts, tests/usage/usage-telemetry-client.test.ts, tests/usage/usage-telemetry-collector-worker.test.ts). Two shards did not finish: 8/11 stopped at its failing batch and 9/11 was cancelled. The tool keeps the existing rows for files those logs never reached (67 rows: 40 on shard 8 and 27 on shard 9), so the refresh is partial for them; the heaviest retained row is tests/windows/windows-codex-cli-job-store.test.ts at 82211 ms. The script's header asks for a fully green lane=all run, which dev has not had in this round; this is the closest available. The planner and the job limits are unchanged.

The table is a pinned input of the release evidence policy, so this also appends a ci v1 entry to .github/scripts/release-evidence-policy.json that is identical to the latest one except for the table's new blob (18c65823…), following the procedure at the top of release-evidence.cjs and the precedent of #8377. Earlier entries stay, so evidence from older commits still verifies.

Verification

• node .github/scripts/release-evidence.cjs policy-check: fingerprints match (it reported policy fingerprint mismatch: scripts/ci/test-durations.windows.tsv before the policy entry). node --test .github/scripts/release-evidence.test.cjs: 25 pass, 0 fail.
• bun test over the eight tests/ci-workflows/ files that read the policy or the duration tables (release-resume-identity, release-pipeline-contract, ci-workflows, ci-scope-reduction, ci-test-lane, release-preflight, ci-shard-balance, ci-crash-disposition), isolated HOME: 295 pass, 0 fail.
• Planner simulation (heaviest file first onto the least-loaded of 11 shards, as run-bun-test-batches.sh assigns): the refreshed table plans 22.8 min of tests per shard, evenly. The old table planned 23.7 min per shard, yet 9/11 spent 27.4 min in tests (28.1 min from its first batch to its last log line) before the cancellation.
• Recorded rows include tests/clients/link-ocx-child-conformance.test.ts at 48373 ms (previously absent).
• NOT RUN: a Windows batch on this table. The next dev batch is the proof.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed. (CI data only)
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults. (timings and test paths; the policy entry changes one pinned digest)

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The CI evidence policy adds a record with the same file set as the preceding record. The Windows test-duration and OCX skill-surface hashes differ.

Changes: CI evidence policy

Layer / File(s)	Summary
Add CI evidence record .github/scripts/release-evidence-policy.json:241-272	Adds a record of CI evidence hashes. The Windows test-duration and OCX skill-surface hashes differ from the preceding record; the other listed hashes match.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk: Minimal · up to 7677a

No actionable merge-blocking risk was identified. The refreshed timings have not yet been validated in a Windows batch.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly describes the main change: refreshing Windows shard duration data using batch 42694893702.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: lidge-jun/opencodex
• Branch: ci/windows-durations-refresh
• File: .coderabbit.yaml
• Commit: 7677a33
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 64213d4b-565b-4b39-908a-b20f00eba9c3

Commits

Reviewing files that changed from the base of the PR and between a3485e9 and 7677a33.

Files selected for processing: 1

• .github/scripts/release-evidence-policy.json

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-09T21:24:22.873979Z	a3485e9	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

Merge judgment (maintainer, dev integration under the PR-only bypass in MAINTAINERS.md).

Head 7677a336c4. The first independent review verified the refreshed table reproduces byte for byte from the eleven Windows job logs of run 42694893702 and that unreached files keep their old rows rather than partial values; its one blocker was the missing release-evidence pin. That commit appends a ci v1 entry differing from the previous latest only in the scripts/ci/test-durations.windows.tsv digest (18c65823…); earlier entries are kept.

A fresh final review approved with nits and gave the security review MAINTAINERS.md:83 asks for: trusted workflow and helper digests are unchanged; the new entry admits only runs on trees containing this exact table and still requires a successful workflow_dispatch lane=all run on dev with the full job roster; the table only weights shard placement, and run-bun-test-batches.sh fails unless every test file is assigned, so it cannot skip tests. Removing the entry reproduces the original policy fingerprint mismatch. The nits were count errors in the description (67 retained rows, 131 missing at base, 27.4 min test time) and are corrected.

Exact-head CI: gates, ci, test 1/5–5/5, storage policy, api usage, changes, hygiene, enforce-target, CodeRabbit all pass.

NOT RUN: a Windows batch on this table; the next dev lane=all batch is the proof.