Live probes limit counts agent-planning's probe and teardown; clearer missing-record failures (#189)

Review round 53: the comment counted four probes, before #193 added
agent-planning's; with its 11-minute probe and 2-minute teardown the limits
total 90 minutes plus setup, so the job limit rises to 100 (pinned in
vitest-config); the refused-network and refused-proxy tests say so when their
shim recorded nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: mchwang

.github/workflows/live-probes.yml

@@ -13,13 +13,14 @@ concurrency:
 jobs:
   live-probes:
     runs-on: ubuntu-latest
-    # The probes' own time limits total 33 min (6, 8, 8 and 11). agent-container and agent-supervisor may each spend
-    # up to 10 min building the image before their probes; agent-question builds inside its probe's own 11 min. The
-    # teardown hooks have Vitest limits that total 24 min: agent-container 2 after each test and 13 at the end (two
-    # sweeps of up to 5.5 min each, #189), agent-supervisor 7 and agent-question 2. That is 77 min, plus setup. These
-    # are only Vitest's limits: Vitest's hook timer cannot fire while a synchronous docker call blocks, and some calls in
-    # these hooks have no timeout of their own (the sweeps' calls have 30 s each). The 90 min job limit caps the run.
-    timeout-minutes: 90
+    # The probes' own time limits total 44 min (6, 8, 8, 11 and 11). agent-container and agent-supervisor may each spend
+    # up to 10 min building the image before their probes; agent-question and agent-planning build inside their probes'
+    # own 11 min. The teardown hooks have Vitest limits that total 26 min: agent-container 2 after each test and 13 at
+    # the end (two sweeps of up to 5.5 min each, #189), agent-supervisor 7, agent-question 2 and agent-planning 2. That
+    # is 90 min, plus setup. These are only Vitest's limits: Vitest's hook timer cannot fire while a synchronous docker
+    # call blocks, and some calls in these hooks have no timeout of their own (the sweeps' calls have 30 s each). The
+    # 100 min job limit caps the run.
+    timeout-minutes: 100
     steps:
       # Fail at once when the secret is missing, so a missing secret never looks like a passing run.
       - name: Require the Claude token

test/agent-network.test.ts

@@ -143,6 +143,7 @@ describe('vendor-only egress', () => {
     expect(error).toBeInstanceOf(Error);
     expect(error).not.toBeInstanceOf(VendorNetworkCreationCleanupError);
     expect(String(error)).toMatch(/already exists/);
+    expect(foreign, 'the shim recorded no foreign network').not.toBe('');
     expect(survived).toBe(true);
   }, 60_000);
 
@@ -199,6 +200,7 @@ describe('vendor-only egress', () => {
     expect(error).toBeInstanceOf(Error);
     expect(error).not.toBeInstanceOf(VendorNetworkCreationCleanupError);
     expect(String(error)).toMatch(/already in use|Conflict/);
+    expect(foreign, 'the shim recorded no foreign proxy').not.toBe('');
     expect(survived).toBe(true);
   }, 60_000);
 

test/vitest-config.test.ts

@@ -317,7 +317,7 @@ describe('CI workflows', () => {
     const job = live.jobs['live-probes']!;
     // No `defaults`, `env`, `strategy` or `container`: any of them could change what the steps run.
     expect(Object.keys(job).toSorted()).toEqual(['runs-on', 'steps', 'timeout-minutes']);
-    expect(job).toMatchObject({ 'runs-on': 'ubuntu-latest', 'timeout-minutes': 90 });
+    expect(job).toMatchObject({ 'runs-on': 'ubuntu-latest', 'timeout-minutes': 100 });
     const token = { CLAUDE_CODE_OAUTH_TOKEN: '${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}' };
     expect(job.steps.map(step => Object.keys(step).toSorted())).toEqual([['env', 'name', 'run'], ['uses'], ['uses', 'with'],
       ['run'], ['env', 'name', 'run'], ['name', 'run']]);