Cap each guarded job's CPU where the user manager delegates cpu

[seathatflowsinourveins]

Summary

• adoption/tools/ecosystem-bounded-run adds CPUQuota to the scope when the user manager delegates the cpu controller, which is systemd's default from v252.
  • The default is (online CPUs − 2) × 100%. ECOSYSTEM_JOB_CPU_QUOTA overrides it.
  • Inside the scope, the job's own cpu.max must equal the request, or the runner exits 78 before the command runs. This is the same pattern as the existing memory.max and pids.max checks.
• Without cpu delegation (systemd < 252, e.g. Ubuntu 22.04):
  • The default quota is skipped with one stderr note, and the memory, task and runtime limits still apply.
  • An explicit quota is refused with 78, because it cannot be enforced.
  • A controllers file that cannot be read means a wrong manager path, and is refused with 78.
• gitleaks-guarded unsets ECOSYSTEM_JOB_CPU_QUOTA, so every scan gets the runner default.
• Provenance: the runner is byte-identical to the authoring host's copy, and gitleaks-guarded still differs from its source only on lines 5-6.
• Closes the "CPU limit in ecosystem-bounded-run" needed-now item in docs/next-host-stages.md, apart from the interactive-contention comparison that page names.
  • The per-job default leaves two CPUs free, so it does not throttle the measured 8.4-core Gitleaks scan.
  • macOS installs neither script, so it has no CPU cap. This is recorded as a limitation in adoption/tools/README.md.
• Scope:
  • Install content only. It touches no TRUST_PATHS file and no verdict rows (verdict-review-gate dry run: no verdict rows changed (base 8eacd8b60f1d)).
  • It rides in v2026.09.23.2.
  • Coordinated with the catalog finalization board, Grand catalog finalization (2026-09-23): live board #140.

Tests: tests/test_adoption_guarded_runners.py, BoundedRunCpuQuotaTests

These are local integration checks. The kernel-level quota tests are gated on a host whose user manager delegates cpu.

• The default and an explicit 50% reach the job's own cpu.max.
• Stand-in launchers are refused with 78:
  • one that drops CPUQuota, run in a fresh slice so the missing-cpu.max branch is deterministic;
  • one that alters it to 37%, which hits the mismatch branch.
• No-delegation path: the default is skipped with the note, and an explicit quota is refused with 78.
• An unreadable controllers file is refused with 78.
• 0%, max, 150, 1000000% and -5% are each refused with 78.
• Mutation-checked on the authoring host. Each of these runner edits fails at least one test:
  • removing the in-scope check;
  • tolerating a missing cpu.max;
  • not refusing an explicit quota without delegation;
  • dropping the CPUQuota property;
  • using a CPUs − 1 default;
  • opening the quota regex;
  • reading an unreadable controllers file as "no cpu".

Verification (authoring host, WSL2, systemd 255, 24 CPUs)

• python3 -m unittest: 3593 tests OK (363 skipped), run in a bounded scope.
• tests.test_adoption_guarded_runners: 31 OK, on the containment branch.
• Each of these exits 0:
  • scripts/validate.py
  • scripts/host_receipts.py validate
  • scripts/release_due.py --strict-if-repinned origin/main, with due: []
  • scripts/landscape.py
  • validate_catalogs, validate_foundation and validate_convergence --all-recorded
  • build_verdicts, component_matrix, new_host_grand_list, gap_crosswalk, gap_wave_ledger and build_ecosystem, each with --check
  • audit_reports --check
• zizmor --offline --persona regular --strict-collection .github/workflows: exit 0.
• Guarded gitleaks git --log-opts=origin/main..HEAD: no leaks.
• Host-side evidence (the private ecosystem record): 24/24 real-cgroup stability checks, and two independent Opus/max review rounds with all findings addressed. The last round's lows (fail closed on an unreadable controllers file, the deterministic dropped-quota check) are included here.

Not established

• There has been no run on a real systemd < 252 host. The no-delegation path is exercised through an instrumented controllers file.
• The Delegate=cpu memory pids drop-in remedy in the README has not been run.
• The aggregate effect of several concurrent bounded jobs on interactive CPU pressure is the named, unrun comparison.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-24T03:48:33.624824Z	a7f2be1	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.