From d6434efc28237a5ff27a8fc4f61ca401199e7ab8 Mon Sep 17 00:00:00 2001 From: "Timothy J. Aveni" Date: Fri, 9 Oct 2026 16:50:50 -0700 Subject: [PATCH] Reuse checked bootstrap catalogs and coordinate execution deadlines --- PORTABLE_ARTIFACTS.md | 10 +++++++++- restricted-execution/service.mjs | 2 +- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/PORTABLE_ARTIFACTS.md b/PORTABLE_ARTIFACTS.md index cb92feb..12fa668 100644 --- a/PORTABLE_ARTIFACTS.md +++ b/PORTABLE_ARTIFACTS.md @@ -111,7 +111,7 @@ and supplies an explicit SDK for value codecs, identities and declared graph por service = { restricted = true; limits = { - deadlineMs = 4000; + deadlineMs = 10000; maxBytes = 1048576; maxPortCalls = 1000; maxQueued = 8; @@ -128,6 +128,14 @@ invocation identity; authored code cannot choose another frame or workspace. Native graph grants and transaction commit remain enforced by Camino outside the guest. Initialization and synchronous loops are subject to the same deadline. +The default root/Package Invocation wall deadline is 10 seconds. The separate +root CPU allowance remains at most 4 CPU seconds; extra wall time accommodates +queueing and graph-port waits. Ordinary graph database transactions and idle +transactions allow 30 seconds, and ordinary client HTTP requests allow 45 seconds +so server failures can be returned. Nested calls inherit the remaining root +budget; explicit smaller limits still apply. Restore/activation jobs retain their +separate budgets. These defaults are starting limits, not latency targets. + Direct network access, native filesystem imports, ambient clock and entropy, parent environment credentials, and unlisted modules are denied. Explicit dates, `Intl.Segmenter`, deterministic hashes and normal JavaScript computation remain diff --git a/restricted-execution/service.mjs b/restricted-execution/service.mjs index 9edc8bf..a30d290 100644 --- a/restricted-execution/service.mjs +++ b/restricted-execution/service.mjs @@ -108,7 +108,7 @@ export async function serveRestrictedRegistry(config, io = process) { const limits = { maxBytes: config.maxBytes ?? 1024 * 1024, maxPortCalls: config.maxPortCalls ?? 1000, - deadlineMs: config.deadlineMs ?? 4000, + deadlineMs: config.deadlineMs ?? 10000, maxQueued: config.maxQueued ?? 8, maxActive: config.maxActive ?? 2, maxNested: config.maxNested ?? 4,