[rmcdaniel]

Addresses #781.

codec-native-build builds the bounded optimized server artifact for deadline health. It ran in a container capped at 4 GiB with no swap (--cpus=1 --memory=4g --memory-swap=4g, one cargo job).

Measured. I ran local release builds with CI's flags (--release --locked, jobs 1, incremental off, release debug 0) in an exact 4 GiB container on the same compiler image. Both builds completed:

• main before Rust #325: serve bridge adapter webhooks #776: cgroup memory.peak was 3,994,550,272 B.
• Rust #325: serve bridge adapter webhooks #776's head, now main: 4,060,192,768 B.

That is within about 6% of the cap. Attempt 1 of #776's exact-head run (40321678938) lost this job's final rustc to signal 9, with no compiler diagnostic; its single rerun passed. The script's comment ("peaks near 2 GiB") was stale.

Change. The bound becomes 6 GiB, still with no swap and one job at a time, so it still means one rustc. build.json records the new memory_bytes. The standard hosted runner has 16 GB, and this job runs only this container. Nothing else reads the recorded bound.

This is a CI script change only; product source is untouched.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security review: clear at exact head 7e3b1dd (tree f486727e366a8a20e9c3440afcdb6e7d8fbbb7e3).

• Verified the one-file, CI-only delta. The build remains limited to one CPU and one Cargo job; memory and total memory-plus-swap are both 6 GiB, so the container has a hard RAM bound and no swap. The recorded build.json resource values match the runtime flags.
• The 6 GiB bound is proportionate to the measured approximately 4.06 GB cgroup peak and retains substantial headroom on the standard 16 GB public Linux runner. Docker documents that equal memory and memory-swap values disable container swap: https://docs.docker.com/engine/containers/resource_constraints/#prevent-a-container-from-using-swap. GitHub documents the 16 GB runner specification: https://docs.github.com/en/actions/reference/runners/github-hosted-runners#standard-github-hosted-runners-for-public-repositories.
• Exact-head hosted codec-native-build job 121595672213 completed successfully at 2026-10-26T13:31:41Z, including artifact publication and task-owned container cleanup.
• Public Boundary, central action policy, repository contracts, and completed CodeQL analyses are green. Remaining active required checks stay ordinary merge gates; this clearance does not waive them.

No product/runtime source, credential, access-control, or secret-handling surface changed. No Security hold remains on this exact head.

[rmcdaniel]

Merge receipt.

• Merged: 0ef7c9321c33963db20df146d18c383189952b6d
  • tree f486727e366a8a20e9c3440afcdb6e7d8fbbb7e3, equal to the cleared head's tree
  • parents 47f4c5447a33dfede4e0f908bfaec7d68bd1a40c (main) and 7e3b1dd1850a5ece6dce253beb2b9f53103cc7e0 (head)
  • merged SHA-pinned to the cleared head
• Security clearance: exact head 7e3b1dd1 (6417277707); final check re-confirmed after attempt 2.
• CI: Shared Server fixtures run 40329690090.
  • Attempt 1: codec-native-build passed under the 6 GiB bound. execution-and-codec (corpus) failed on published PHP 2.11.1 workflow-poll-request-replay, the SQLite "database is locked" flake recorded on Server parity: legacy-marker 503 recovery check fails intermittently on published PHP (SQLite) #754 (6417369509).
  • Attempt 2 reran only that job: 43/43 jobs successful.
  • PR rollup at the head: 56 successes and 1 intended skip.

🤖 Generated with Claude Code