Stabilize chronic CI build diagnostics in sandbox teardown and CPU shortest-path handling

[Copilot]

Pull Request

For EPIC-branch workflow PRs, use .github/PULL_REQUEST_TEMPLATE/epic-branch-flow.md.
This applies to both feature/* -> epic/* and epic/* -> develop integration PRs.

Target Version (Required)

Target Version: [Unreleased]

Chronic compiler diagnostics from the 24h aggregation window were triaged and addressed as maintenance hardening on develop.

---

Description

Chronic build aggregation reported repeated compiler failures/warnings concentrated in sandbox/platform and acceleration paths. This PR applies focused fixes in those hotspots to reduce recurring diagnostics without broad refactors.

• Sandbox lifecycle guard (platform correctness)

  • Scoped teardownCgroupV2() invocation to Linux-only build paths in ModuleSandbox::shutdown().
  • Prevents non-Linux compilation breakage from Linux-only cgroup symbols.

• CPU graph shortest-path finite-sentinel path

  • Replaced infinity-dependent behavior with finite/saturating distance handling in CPUGraphBackend::batchShortestPath.
  • Added explicit reachability tracking to decouple “reachable” state from sentinel value collisions.
  • Preserved stale-entry guard semantics in the Dijkstra loop.

• Diagnostic intent

  • Targets chronic recurring diagnostics from CI aggregation (compiler error/warning classes), not feature behavior expansion.

// Linux-only teardown path
#if defined(__linux__)
    teardownCgroupV2();
#endif

Linked Issues

Type of Change

• Bug fix (non-breaking)
• New feature (non-breaking)
• Refactoring (non-breaking)
• Documentation
• Breaking change (requires MAJOR version bump — see VERSIONING.md)
• Security fix
• Other: CI/build maintenance triage for chronic diagnostics

Breaking Change Checklist

• MAJOR version bump planned in VERSION and CMakeLists.txt
• Migration guide added in docs/migration/
• Announcement prepared for GitHub Discussions (≥ 2 weeks before release)
• CHANGELOG ### Removed / ### Changed section updated

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• Benchmarks run (if performance-sensitive change)

Security Tiering Impact (Required for Runtime Changes)

• Impacted tier(s):

  • T0 Trusted Core
  • T1 Security & Platform Services
  • T2 Data Plane Engines
  • T3 Interface & Protocol Edge
  • T4 Managed Extension Runtime
  • T5 Plugin Boundary
  • N/A (docs-only / non-runtime)

• Trust-boundary crossings documented in PR description (example: T3 -> T2, T5 -> T4 brokered call)

• Boundary controls validated for affected T3/T4/T5 paths (AuthN/AuthZ, validation, rate limits, audit)

• Boundary-focused tests added/updated or explicit N/A rationale provided

• If trust level/privilege increased, security maintainer approval is attached

📚 Research & Knowledge (wenn applicable)

• Diese PR basiert auf wissenschaftlichen Paper(s) oder Best Practices?
  • Falls JA: Research-Dateien in /docs/research/ angelegt?
  • Falls JA: Im Modul-README unter "Wissenschaftliche Grundlagen" verlinkt?
  • Falls JA: In /docs/research/implementation_influence/ eingetragen?

Relevante Quellen:

• Paper:
• Best Practice:
• Architecture Decision:

AI-Generated Code (KI-generierter Code)

• Symbol-Referenzen mit GetSymbolReferences_CppTools geprüft (siehe .github/instructions/cpp-language-service-tools.instructions.md)
• Keine rohen Pointer und kein new/delete ohne explizites Review eingeführt
• RAII und Exception-Safety für neue/angepasste Pfade geprüft
• Keine unnötig komplexen KI-Abstraktionen eingeführt
• Performance-Metriken geprüft, falls Hotpath betroffen

AI Review Workflow (Required for AI-assisted PRs)

• Findings-first review performed with .github/prompts/pr-diff-findings-review.prompt.md
• Security hardening review performed for security-sensitive/runtime changes with .github/prompts/security-hardening-review.prompt.md (or N/A documented)
• API impact review performed for API/contract changes with .github/prompts/api-change-impact-review.prompt.md (or N/A documented)
• All Critical/High findings are resolved or explicitly accepted with rationale in PR description
• Residual risks and follow-up actions documented in PR description
• Severity policy applied according to .github/copilot/REVIEW_SEVERITY_POLICY.md

High-Finding Exception Record (only if High is accepted)

• High-finding exception claimed in this PR

• Finding reference:

• Maintainer approver:

• Mitigation in current release:

• Target fix milestone:

• Tracking issue:

• Validation evidence:

Release Readiness Gate (Required for release-scoped changes)

• Release readiness reviewed with .github/prompts/release-readiness-check.prompt.md for branch transition scope
• Branch governance validated against BRANCHING_STRATEGY.md and RELEASE_STRATEGY.md
• Versioning/changelog impact validated against VERSIONING.md and CHANGELOG.md

Checklist

• Code follows project style guidelines (clang-format / clang-tidy)
• Self-review completed
• Documentation updated (if needed)
• CHANGELOG.md updated under [Unreleased]
• No new warnings introduced
• Security-sensitive paths reviewed by security maintainer (if applicable)

Scanner and IntelliSense Gates

• IntelliSense/Compiler: no new errors in changed files
• clang-tidy/cppcheck: no new high-risk findings in changed files
• Gap Scanner: no new critical findings in categories security, input_validation, query_correctness, distributed_consistency, concurrency, memory
• Gap Scanner: no new high findings in the same categories (or explicitly approved)
• Gap Scanner delta report attached (baseline vs current), not only absolute totals
• New unknown scanner findings triaged (fixed, re-categorized, or justified)

• Fixes 🔴 Chronic Build Failures — Error Report #6340

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

@copilot resolve the merge conflicts in this pull request

Merged develop into this PR branch and resolved all merge conflicts in code and tests. The merge-resolution commit is 2451d0443.

[github-actions]

✅ Wave C Policy Gate: Edition & License Validation

Result: ✅ Edition & License Validation PASSED
Workflow run: #34829571007
Triggered by: @copilot

Checks

• ✅ Edition matrix consistency check
• ✅ License feature gate validation
• ✅ Enterprise/military marker detection
• ℹ️ Target branch: develop

See .github/workflows/gate-pr-edition-license.yml for details.

[github-actions]

✅ Wave C Policy Gate: Hash & SBOM Integrity

Result: ✅ Hash & SBOM Integrity PASSED
Workflow run: #34829571007
Triggered by: @copilot

Checks

• ✅ Dependency hash integrity check
• ✅ SBOM generation and registry consistency
• ✅ Edition-correct SBOM composition
• ✅ Private plugin variance detection
• ℹ️ Approved SBOM registry: docs/governance/SBOM_APPROVED_VERSIONS.md

See .github/workflows/gate-pr-hash-sbom.yml for details.

[github-actions]

Target: pr

Doxygen Governance Gate

• Verdict: PASS
• Base branch: develop
• Changed C/C++ files: 45
• Changed public headers: 2
• Scoped modules: acceleration, themis
• Release lane: no
• Phase 6 modules in scope: none
• Coverage enforced: no
• Coverage threshold: 95.0%
• Coverage result: skipped
• Coverage waiver active: no
• Approved waivers: none
• Structural findings: 0
• Advisory findings: 0
• Blocking Doxygen warnings: 0
• Suppressed out-of-scope Doxygen warnings: 0
• XML generated: yes

Changed source files

• artifacts/import_docs_rocksdb.cpp
• include/acceleration/vllm_resource_manager.h
• include/themis/base/module_sandbox.h
• src/acceleration/break_even_validator.cc
• src/acceleration/cpu_backend.cpp
• src/acceleration/graphics_backends.cpp
• src/acceleration/vec_knn.cpp
• src/acceleration/vllm_resource_manager.cpp
• src/analytics/streaming_window.cpp
• src/api/graphql.cpp
• src/aql/aql_syntax_highlighter.cpp
• src/auth/distributed_token_blacklist.cpp
• src/auth/rocksdb_open_compat.h
• src/auth/rocksdb_token_blacklist.cpp
• src/base/module_sandbox.cpp
• src/chimera/neo4j_adapter.cpp
• src/exporters/streaming_exporter.cpp
• src/governance/operational_audit.cpp
• src/index/multi_gpu_vector_index.cpp
• src/index/secondary_index.cpp
• ... 25 more

---

source_workflow: Gate: PR Doxygen Governance
source_run: 34829570694
source_sha: 1d39944

[github-actions]

✅ Wave C Policy Gate: Community Fail-Closed Validation

Result: ✅ Community Fail-Closed Validation PASSED
Workflow run: #34829571007
Triggered by: @Copilot

Checks

• ✅ No silent fallback patterns
• ✅ License disclaimers present
• ✅ No unguarded telemetry/tracking
• ✅ No private plugin references in community/minimal scope
• ✅ Community-only build config validation
• ✅ No enterprise secrets leakage

See .github/workflows/gate-pr-community-failclosed.yml for details.

[github-actions]

✅ Wave C Policy Gate: Private Plugin Boundary Enforcement

Result: ✅ Private Plugin Boundary Enforcement PASSED
Workflow run: #34829571007
Triggered by: @copilot

Checks

• ✅ Private plugin leakage detection
• ✅ Plugin manifest visibility validation
• ✅ Submodule commit-pin enforcement (no branch refs for private)

See .github/workflows/gate-pr-plugin-boundary.yml for details.