fix(processes): bound system I/O and speed saved-item matching

[s1korrrr]

Summary

• Dispatch blocking scanner work outside Swift cooperative workers and terminate oversized command output promptly.
• Guard metric and elapsed-time boundaries; retain existing saved hashes with faster encoding and lexical executable names.
• Remove machine GPU attribution from process inspectors, keep four-digit rail counts readable, show accurate pending Access status, and use SwiftPM's default release backend.
• Add regression coverage and a bounded audit report at docs/verification/2026-10-07-audit.md.

Motivation

Native inspection with over 1,300 processes exposed saved-key matching on the main thread, a process count wrapping in its fixed-width rail, and misleading per-process GPU values. Numeric boundary inputs could trap, while unlimited command output remained active until its timeout. Synchronous scans also occupied cooperative workers.

Scope

Process acquisition/presentation, scanner scheduling, command output cleanup, release backend selection, regressions and verification documentation. No changes to process-action policy, automation ownership/transaction policy, user definitions, credentials, public signing/notarization, or AI authority.

Implementation

BlockingSystemWork bridges synchronous scanner calls through a utility dispatch queue, propagating errors and checking task cancellation before and after work. A pipe's first output overflow starts existing TERM/KILL process-group cleanup while both streams continue draining. Numeric parsing rejects unsafe values before arithmetic. Saved keys retain SHA-256 inputs and the v2: lowercase format; no-CWD aliases avoid duplicate hashing. Process histories leave GPU unavailable, with system GPU retained in the dashboard. Counts use intrinsic single-line width. Access assessment stays Checking before its first result and during refresh, withholding requirement guidance and diagnostic copying until success/error is assigned. Build and binary lookup retain matching architecture/scratch arguments under the default backend.

Behavioral changes

Oversized writers fail promptly instead of waiting for their deadline; malformed metric/elapsed input is rejected. Favorites/watch retain persisted membership. Process charts report CPU and memory without unsupported GPU attribution. Counts above 999 remain readable. Access no longer briefly labels an in-progress scan Blocked. Swift 6.4 release builds no longer emit the forced-native backend deprecation. No schema migration is needed.

Validation

• PASSED: swift test --jobs 4 -Xswiftc -warnings-as-errors, 685 XCTest cases (100 app, 585 core), zero failures on the final implementation.
• PASSED: swift build --jobs 4 -c release -Xswiftc -warnings-as-errors.
• PASSED: swift test --jobs 4 --filter ReleaseScriptTests -Xswiftc -warnings-as-errors, 63 tests after removing the obsolete flag.
• PASSED: git diff --check, bash -n script/*.sh, ./script/check_open_source_readiness.sh.
• PASSED: Gitleaks source directory and full reachable public candidate history scans. Unrelated personal refs contain historical findings absent from public main; they are outside this PR and no suppressions/history changes were made.
• PASSED: default-backend arm64 full-access bundle build, signature and entitlement/architecture validation. Native development bundle exact-path launch, PID search, CPU/memory inspector, favorite/watch, copy/recovery, TERM cancellation and actual TERM of an owned fixture.
• PASSED: Applications/Processes/Hierarchy/Workflows navigation; Settings tabs and access refresh, including Checking with disabled diagnostics while the initial scan runs; disposable LaunchAgent Start Now/Stop Current Run, with UI postconditions agreeing with native launchctl/ps; validated editor Cancel.
• PASSED: independent read-only review of implementation and final layout/build hunks, no confirmed blockers.
• PERFORMANCE: 6,500 isolated saved-key encodings produced identical old/new outputs, 1.171s versus 0.009s in an optimized local benchmark. This measures encoding only, not overall app speed.
• UNVERIFIED: Shortcuts on this macOS 27 host (pre-existing linkd.autoShortcut Cocoa 4097 errors), Apple Intelligence generation, notification delivery, and all permissions/appearance combinations. Host definition/administrator-approval warnings remain explicitly displayed.
• PASSED: final optimized presentation bundle relaunch and four-digit sidebar count inspection. An isolated copy re-signed with sandbox entitlements passes bundle-policy validation and reports the expected unrestricted-process inspection boundary; this is equivalent policy smoke, not the scripted multi-architecture sandbox smoke.
• PASSED: all three protected GitHub checks on the final head.
• PASSED: merged canonical main 68e77f3 has exactly the reviewed candidate tree. Rebuilt and installed local full-access arm64 version 0.1.0 (20261007). Installed bundle byte comparison, signature/entitlement/architecture validation and binary hash match passed.
• PASSED: installed application launches from Applications, shows live process data, and completes an owned LaunchAgent Start Now/Stop Current Run cycle. UI terminal postconditions agree with launchctl and ps; no fixture process remains.
• PASSED: obsolete release worktree, older bundles, task build caches, sandbox test container, both disposable definitions and their own recovery files, and task-only saved identities cleaned recoverably. Only the current staged bundle and installed app remain active. Local main is clean and tracks canonical main; personal history is retained locally.

Tests added or changed

Cover dispatch execution outside Swift tasks/main thread and error propagation; prompt cleanup of an endless TERM-ignoring oversized writer; invalid/non-finite/negative metric and unsafe RSS inputs; multicore CPU acceptance; exact maximum elapsed time and overflow; stable hash output and lexical executable basenames; unavailable per-process GPU samples.

CI status

All three required checks PASSED on final head 5ca654f: Full-history Gitleaks scan, macOS arm64, and macOS x86_64. Both architecture jobs passed constrained-executor checks, warnings-as-errors tests/release builds, universal sandbox/full-access bundle validation, and tracked-file cleanliness. No non-successful required checks remain; no bypass was used. Pre-existing host integration limitations are documented above.

Post-merge checks also PASSED on main 68e77f3: Secret Scan and Release Gates, including both macOS architectures.

Risk assessment

MEDIUM: subprocess cleanup and scanner scheduling touch runtime infrastructure. Existing timeout/cancellation/PID-group tests plus the added writer regression cover the changed cleanup path. Dispatch work cannot abort a synchronous scanner already in progress, whose existing tool bounds remain active. A deliberately escaping descendant retaining a pipe is not isolated by general process-group cleanup; no concrete production trigger was found in fixed system-tool callers. Numeric checks and saved-key compatibility are covered. The local ad-hoc bundle does not establish notarized distribution.

Rollback

Revert this commit to restore prior scanning, cleanup and presentation. Existing saved hashes remain compatible. The prior installed bundle was moved to Trash before replacement; no user automation or process data migration occurs.

Review focus

Inspect the first-overflow callback and existing group lifecycle, scanner bridge cancellation/error flow, numeric guards before arithmetic, persisted key format, accurate GPU attribution, matching build/path lookup arguments, and Access initial/pending/result transitions.

Follow-ups

Separately qualify permission-dependent Shortcuts, Foundation Models generation and notification delivery on supported host configurations. No required implementation or test work is deferred.