Make Ubuntu Node CI pass snapshot tests and finish in budget.

Why:
The Alpha CI job on ubuntu-latest failed four broker-core snapshot
tests because they called host xcrun simctl. The same run spent 17
minutes in verify:public-surface spawning one git cat-file per tracked
file, so the 20-minute job budget could not cover the remaining suites.

Changed:
The four app-snapshot tests now pass the fixture simctl adapter through
runtimeOptions. The default public-surface scan reads index blobs only
for dirty or missing worktree files. CI and release jobs use a 30-minute
budget. Front-door tests require timeout-minutes of at least 30.

Verification:
npm run agent:verify -- --profile spec-only --paths broker-core/test/broker-core.test.mjs,client/public-surface.mjs,client/test/public-surface.test.mjs,.github/workflows/ci.yml,.github/workflows/release.yml,docs/test/front-door.test.mjs,spec/build-and-test.md,CHANGELOG.md --session-dir task-sessions/20260818-alpha-ci-ubuntu-fix
npm run agent:verify -- --profile implementation --paths broker-core/test/broker-core.test.mjs,client/public-surface.mjs,client/test/public-surface.test.mjs,.github/workflows/ci.yml,.github/workflows/release.yml,docs/test/front-door.test.mjs,spec/build-and-test.md,CHANGELOG.md --session-dir task-sessions/20260818-alpha-ci-ubuntu-fix

Affected:
broker-core/test/broker-core.test.mjs
client/public-surface.mjs
client/test/public-surface.test.mjs
.github/workflows/ci.yml
.github/workflows/release.yml
docs/test/front-door.test.mjs
spec/build-and-test.md
CHANGELOG.md

Refs:
#6
https://github.com/fiveonecode/simulator-broker/actions/runs/32114159922
spec/build-and-test.md

Session:
task-sessions/20260818-alpha-ci-ubuntu-fix

Author: VladimirBrejcha

.github/workflows/ci.yml

@@ -1,5 +1,7 @@
-# Public Node test surface. This job is intentionally cheap: Ubuntu, no
-# npm install (the repo has no runtime dependencies), and no macOS app suite.
+# Public Node test surface. Ubuntu, no npm install (the repo has no runtime
+# dependencies), and no macOS app suite. timeout-minutes is 30 because a
+# prior 20-minute budget was consumed by per-file git cat-file in
+# verify:public-surface on a clean checkout.
 name: Node tests
 
 on:
@@ -18,7 +20,7 @@ jobs:
   node:
     name: broker-core client harness-adoption public-surface
     runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/release.yml

@@ -15,7 +15,7 @@ jobs:
   release:
     name: attach CLI tarball
     runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
 

CHANGELOG.md

@@ -16,6 +16,9 @@ downloadable CLI tarball.
 - Public Node test workflow on GitHub-hosted Ubuntu for
   `verify:public-surface`, `test:broker-core`, `test:client`, and
   `test:harness-adoption`. That job does not run the macOS app suite.
+  Snapshot tests inject the fixture `simctl` adapter so the suite does not
+  call host `xcrun`. The default public-surface scan skips identical index
+  blobs on a clean worktree, and the job budget is 30 minutes.
 - `scripts/package_cli.sh` (`npm run package:cli`) builds a versioned CLI
   tarball without XcodeGen or an app build.
 - Tag-driven GitHub Release workflow that attaches the CLI tarball and its

broker-core/test/broker-core.test.mjs

@@ -9350,7 +9350,7 @@ test("events and app snapshots honor a zero event limit", () => {
   });
 
   assert.equal(readEventsBroker(resolvedPaths, { limit: 0 }).events.length, 0);
-  assert.equal(appSnapshotBroker(resolvedPaths, { eventLimit: 0 }).recentEvents.length, 0);
+  assert.equal(appSnapshotBroker(resolvedPaths, runtimeOptions(paths, { eventLimit: 0 })).recentEvents.length, 0);
 });
 
 test("app snapshot reuses one process sample for active lease checks", () => {
@@ -9379,13 +9379,13 @@ test("app snapshot reuses one process sample for active lease checks", () => {
   const liveSampler = liveProcessSampler({ command: "node broker-core.test.mjs", pid: process.pid });
   let sampleCount = 0;
 
-  const snapshot = appSnapshotBroker(resolvedPaths, {
+  const snapshot = appSnapshotBroker(resolvedPaths, runtimeOptions(paths, {
     processExists: (pid) => pid === process.pid,
     processSampler: () => {
       sampleCount += 1;
       return liveSampler();
     },
-  });
+  }));
 
   assert.equal(snapshot.activeLeases.length, 2);
   assert.equal(sampleCount, 1);
@@ -9422,7 +9422,7 @@ test("app snapshot reads only a bounded event tail for recent events", (t) => {
     return originalReadFileSync.call(this, target, ...args);
   };
 
-  const snapshot = appSnapshotBroker(resolvedPaths, { eventLimit: 3 });
+  const snapshot = appSnapshotBroker(resolvedPaths, runtimeOptions(paths, { eventLimit: 3 }));
 
   assert.deepEqual(snapshot.recentEvents.map((event) => event.eventId), [
     "event-119",
@@ -9661,7 +9661,7 @@ test("broker-owned state files are restricted to the current user", () => {
     purposeId: "agent-ui-session",
     simctlAdapter: paths.simctl.adapter,
   });
-  writeAppSnapshotArtifact(resolvedPaths);
+  writeAppSnapshotArtifact(resolvedPaths, runtimeOptions(paths));
 
   const statePaths = [
     resolvedPaths.stateRoot,

client/public-surface.mjs

@@ -79,6 +79,24 @@ function defaultCandidateFiles(root) {
   return output.split("\0").filter(Boolean);
 }
 
+// Clean checkouts match the index, so skip per-file `git cat-file`. A prior
+// Ubuntu CI run spent 17 minutes spawning one process per tracked file.
+function dirtyWorktreeFiles(root) {
+  try {
+    const output = execGit([
+      "diff-files",
+      "-z",
+      "--name-only",
+    ], {
+      cwd: root,
+      encoding: "utf8",
+    });
+    return new Set(output.split("\0").filter(Boolean));
+  } catch {
+    return null;
+  }
+}
+
 function defaultCandidateIndexModes(root) {
   const output = execGit([
     "ls-files",
@@ -318,6 +336,7 @@ export function scanPublicSurface({
   const candidateFiles = files ?? defaultCandidateFiles(resolvedRoot);
   const scanIndexBlobs = files === undefined;
   const indexModes = scanIndexBlobs ? defaultCandidateIndexModes(resolvedRoot) : new Map();
+  const dirtyFiles = scanIndexBlobs ? dirtyWorktreeFiles(resolvedRoot) : new Set();
   const resolvedDenylistPath = denylistPath ?? path.join(resolvedRoot, LOCAL_DENYLIST_NAME);
   const denylistRules = localDenylistRules(resolvedDenylistPath);
   const builtInRules = [
@@ -421,6 +440,7 @@ export function scanPublicSurface({
     if (!absoluteFile.startsWith(`${resolvedRoot}${path.sep}`)) {
       continue;
     }
+    let worktreeMissing = false;
     try {
       const fileStats = fs.lstatSync(absoluteFile);
       if (fileStats.isSymbolicLink()) {
@@ -438,8 +458,9 @@ export function scanPublicSurface({
       if (error?.code !== "ENOENT") {
         throw error;
       }
+      worktreeMissing = true;
     }
-    if (scanIndexBlobs) {
+    if (scanIndexBlobs && (dirtyFiles === null || dirtyFiles.has(relativeFile) || worktreeMissing)) {
       scanText(normalizedRelativeFile, indexBlobContent(resolvedRoot, relativeFile));
     }
   }

client/test/public-surface.test.mjs

@@ -546,6 +546,29 @@ test("default public surface candidates ignore untracked scratch files", () => {
   }]);
 });
 
+test("default public surface scan inspects staged blobs when the worktree file is missing", () => {
+  const root = makeTempDir();
+  const localHome = path.join(root, "private-home");
+  execFileSync("git", ["init"], { cwd: root, stdio: "ignore" });
+  fs.writeFileSync(path.join(root, "README.md"), `machine path: ${localHome}/state\n`);
+  execFileSync("git", ["add", "README.md"], { cwd: root, stdio: "ignore" });
+  fs.rmSync(path.join(root, "README.md"));
+
+  const report = scanPublicSurface({
+    homePath: localHome,
+    root,
+  });
+
+  assert.equal(report.ok, false);
+  assert.equal(report.filesScanned, 1);
+  assert.deepEqual(report.issues, [{
+    line: 1,
+    path: "README.md",
+    rule: "local-home-path",
+  }]);
+  assert.equal(JSON.stringify(report).includes(localHome), false);
+});
+
 test("default public surface scan inspects staged blobs even after worktree cleanup", () => {
   const root = makeTempDir();
   const localHome = path.join(root, "private-home");

docs/test/front-door.test.mjs

@@ -153,6 +153,7 @@ test("public CI runs the Node suites on Ubuntu and skips the macOS app suite", (
   const ci = readRepoFile(".github/workflows/ci.yml");
 
   assert.ok(ci.includes("runs-on: ubuntu-latest"));
+  assert.match(ci, /timeout-minutes:\s*([3-9]\d|\d{3,})/);
   assert.ok(ci.includes("npm run verify:public-surface"));
   assert.ok(ci.includes("npm run test:broker-core"));
   assert.ok(ci.includes("npm run test:client"));

spec/build-and-test.md

@@ -39,7 +39,10 @@ A first extracted implementation slice now exists:
   tarball without XcodeGen or an app build
 - public GitHub-hosted Ubuntu CI runs `verify:public-surface`,
   `test:broker-core`, `test:client`, and `test:harness-adoption`; it does not
-  run `test:app`
+  run `test:app`. The job budget is 30 minutes. Broker tests that build an
+  app snapshot must inject the fixture `simctl` adapter. The default
+  public-surface scan reads index blobs only for dirty or missing worktree
+  files so a clean checkout does not spawn one `git cat-file` per file.
 - tagged versions such as `v0.1.0-alpha.1` attach the CLI tarball to a GitHub
   Release through `.github/workflows/release.yml`
 - local-debug portable bundle support through a zip bundle plus package-smoke verification of the bundled install path and installed-app launch proof
@@ -288,7 +291,7 @@ Add stronger profiles next for:
 - the installer prints the installed CLI path, app path when an app was installed, env helper path, any current-shell PATH warning, PATH persist result, and the next command (`command -v simbroker` after persist, or `source "<env-helper>"` when persist is skipped)
 - `bash scripts/install_local.sh --cli-only` installs the CLI runtime without invoking `xcodegen` or `xcodebuild` and without requiring an app bundle
 - `npm run package:cli` writes `artifacts/cli/simulator-broker-<version>-cli.tar.gz` plus a SHA-256 checksum and does not invoke XcodeGen or `xcodebuild`
-- `.github/workflows/ci.yml` runs the public Node suites on `ubuntu-latest` and does not run `npm run test:app`
+- `.github/workflows/ci.yml` runs the public Node suites on `ubuntu-latest` with a 30-minute budget and does not run `npm run test:app`
 - `host init --bootstrap-config` writes a warning that real Simulator devices will be created before it calls `simctl` create
 - `npm run test:install-smoke` proves a fresh-machine-style install can bootstrap host config, scaffold a repo, start the service, acquire a lease, generate an app snapshot from the installed CLI, launch the installed app bundle against the smoke fixture, assert the `SimulatorBrokerApp` process stays alive, restore any preexisting default install metadata including symlink target contents, and clean up only the simulators provisioned by the smoke run afterward
 - `npm run package:distribution` builds the app in `Release`, requires operator-supplied `SIMBROKER_DISTRIBUTION_TEAM_ID` plus `SIMBROKER_DISTRIBUTION_SIGNING_IDENTITY`, optionally consumes `SIMBROKER_NOTARYTOOL_PROFILE`, and writes a machine-readable readiness summary under `artifacts/distribution/`