rdmpw3275m changelog — tyrelld repo CPU fix and Build 18 release gate

Fixed the source-level repository-inventory loop that drove the canonical rollback tyrelld into a sustained CPU runaway, filed the defect, published an exact Build 18 candidate, and kept production on the known signed Build 15 rollback pending canonical signing and canary acceptance.

Scope

• Execution and coordination host: rdmpw3275m.
• Canonical source/signing host inspected without changing canonical main: rdmsm4x.
• Canonical source root remained clean at /Users/richh/dev/apps/tyrell, commit 53c0d8c17a4858fda4c182678e0baa823e603f77.
• Source changes were confined to the isolated worktree /Users/richh/dev/_worktrees/tyrell-build17-permission-cache-20260909 on branch codex/tyrelld-permission-cache-20260909.
• Canonical validation was confined to detached worktree /Users/richh/dev/_worktrees/tyrell-build18-validation-rdmpw3275m-20260910 at exact commit 9a0fe66f8fb7a3d8251d3340efc6467255bb7265.
• No unsigned candidate was installed or launched on any production or canary host.

Incident and root cause

• At 2026-09-11 03:48 EDT, devmon restarted exact signed rollback Build 15 PID 10993 on rdmsm4x after three CPU samples up to 124%. Evidence is preserved at /Users/richh/.devmon/incidents/20260911-034828-tyrelld-10993-cpu_runaway_crit on that host.
• The hot path was ClientLoop.autoInventory: it repeated ProjectIdentity.repoState Git subprocesses per root/worktree and RepoBundler.spool full-hashed unchanged bundle content. A direct one-second sample of the replacement process placed 499 of 596 inventory-thread samples in autoInventory, including 420 below the Git probes and 94 in bundle spooling, 76 of those in SHA-256.
• The canonical database held 1,743 repository rows; the replacement pass rediscovered 1,162 roots. The bundle spool held 1,653 files totaling 103 GiB, while bundle database rows represented 168.32 GiB and 1,478 distinct full hashes.
• This second incident is filed as ISSUE-20260911-01 and blocks the Build 18 recovery gate ISSUE-20260909-12.

Source changes

Published branch head: 9a0fe66f8fb7a3d8251d3340efc6467255bb7265.

• 1da4ded — fix(tyrelld): coalesce repo bundle work per inventory pass
• adad0e3 — fix(inventory): skip snapshot pruning after partial scans
• 9a0fe66 — docs(ops): record repo inventory CPU restart and Build 18 fix

Files changed in the isolated Tyrell worktree:

• /Users/richh/dev/_worktrees/tyrell-build17-permission-cache-20260909/Sources/TyrellCore/ProjectIdentity.swift
• /Users/richh/dev/_worktrees/tyrell-build17-permission-cache-20260909/Sources/TyrellCore/RepoBundler.swift
• /Users/richh/dev/_worktrees/tyrell-build17-permission-cache-20260909/Sources/tyrelld/ClientLoop.swift
• /Users/richh/dev/_worktrees/tyrell-build17-permission-cache-20260909/Tests/TyrellCoreTests/ProjectIdentityTests.swift
• /Users/richh/dev/_worktrees/tyrell-build17-permission-cache-20260909/Tests/TyrellCoreTests/RepoBundlePassTests.swift
• /Users/richh/dev/_worktrees/tyrell-build17-permission-cache-20260909/ISSUES.md
• /Users/richh/dev/_worktrees/tyrell-build17-permission-cache-20260909/SESSION-STATE.md

The implementation now plans one spool per shared Git store, preserves per-worktree state, uses a stable checked-out-head set, reuses an exact-path hash only when both size and modification time match, full-hashes newly created or changed bundles, preserves divergent independent-clone snapshots, prunes only after a readable hashed replacement, and skips destructive snapshot pruning whenever any scan root is partial. Porcelain-v2 parsing combines branch, HEAD, and dirty-count collection, reducing the normal repo-state path from four Git processes to two.

Ticket, coordination, and automation changes

• Filed and claimed canonical ticket /Users/richh/dev/issues/open/ISSUE-20260911-01-tyrelld-repo-inventory-rehashes-unchange.md on rdmsm4x; added root-cause, commit, test, artifact, and rollout-gate evidence.
• Updated and refreshed /Users/richh/dev/issues/open/ISSUE-20260909-12-tyrelld-build-16-exact-universal-daemon-.md on rdmsm4x to make the new defect a release blocker.
• Refreshed and updated /Users/richh/dev/issues/open/TASK-20260906-01-resume-and-supervise-incomplete-local-ag.md with the current local agy no-resume audit.
• Sent high-priority canonical owner request 20260911-043153-E7DE1BDE, asking for review/integration, Developer ID signing/notarization, and a rollback-protected rdmbair15m5 full-inventory plus repeated-unchanged-pass canary.
• Updated /Users/richh/.codex/automations/finish-tyrell-build-16/automation.toml so the active 15-minute heartbeat tracks ISSUE-20260911-01, exact head 9a0fe66, and owner request 20260911-043153-E7DE1BDE without installing unsigned artifacts.

Commands and verification

Representative commands executed:

• swift build --target TyrellCoreTests --jobs 2
• swift build --product tyrelld --jobs 2
• Canonical Swift 6.4 focused test filters for RepoBundlePassTests, porcelain-v2 parsing, existing RepoBundler/history coverage, and repo-state coverage.
• Canonical Swift 6.4 full TyrellCoreTests run.
• Permission-cache, stable-daemon-install, and Build 18 version contract scripts.
• Universal Release builds for tyrelld and the Tyrell app executable, followed by lipo, shasum -a 256, and codesign -dv --verbose=4 inspection.
• Live ps, lsof, footprint, curl, symlink resolution, SHA-256, and code-signature checks on the canonical rollback daemon.
• ticket show, ticket heartbeat, and ticket comment for the three active tickets.
• pgrep, exact manifest/status stat, and targeted fleet-mail searches for the local agy monitor.

Results:

• Local target builds passed. The local full swift test remains blocked by the pre-existing Apple Swift 6.3.3 SettingsView.swift SmallVector IRGen compiler crash; this was not classified as a source or test failure.
• Canonical Swift 6.4 passed the two new bundle-pass tests, two new parser tests, six existing bundle/history tests, the existing repo-state test, all three release contracts, and all TyrellCoreTests: 468 tests in 34 suites.
• Canonical universal validation-only Release hashes:
  • tyrelld: b57cd0e51813f30386894857f20c428bb36772202d1d592c8cbe35ee8d5fe13f
  • app executable: 957660d2826b2b8d0bed51d2ac498dd2e8360276e1c2a1931f865d76de8bc52a
• Both validation binaries contain x86_64 and arm64, but they are linker/ad-hoc signed with no TeamIdentifier. They are evidence only and were not installed.
• At 04:36 EDT, canonical replacement PID 21749 had remained the same process for approximately 47 minutes, CPU was 0.0%, physical footprint was 41 MB with a 986 MB recorded peak, 37 open-file rows were observed, and both 43117/api/status and 43118/api/status returned HTTP 200.
• The live daemon symlink still resolves to /Users/richh/Library/Application Support/Tyrell/releases/daemon-dbc440bd54b8/tyrelld, exact SHA-256 dbc440bd54b85a54dd6c4150b23b3e508bff7d8d8080687d81b9ba7ac2cbbcf0, signed by Team ZU2882L4HT with Hardened Runtime. This is containment, not acceptance of the Build 18 fix.
• The local agy manifest remains 3,571 bytes at mtime 1788753991; STATUS.md remains 6,595 bytes at mtime 1788754201; no agy CLI process exists. Every parent remains complete_verified, local_complete_handoff_pending, or closed_no_resume. No real 429, RESOURCE_EXHAUSTED, reset boundary, incomplete parent, or canonical acceptance receipt was found, so no duplicate agy resume was launched.

Rollback and undo

• Production rollback remains the exact signed universal Build 15 daemon at /Users/richh/Library/Application Support/Tyrell/releases/daemon-dbc440bd54b8/tyrelld, SHA-256 dbc440bd54b85a54dd6c4150b23b3e508bff7d8d8080687d81b9ba7ac2cbbcf0.
• The source changes can be undone on the feature branch by reverting 9a0fe66, adad0e3, and 1da4ded in that order. Canonical main was not changed, so no canonical-source rollback is needed.
• Do not delete the active heartbeat until both the signed Tyrell release lane and local agy acceptance lane have evidence-backed completion.

Outstanding owner actions

• Canonical owner must explicitly accept and review exact head 9a0fe66, integrate it into an authorized release lane, build/sign with Team ZU2882L4HT and Hardened Runtime, notarize the app, and publish exact commit/hash/signature/version provenance.
• rdmbair15m5 must run the exact signed candidate through one complete inventory and at least one repeated unchanged pass, then a long same-PID soak covering CPU, physical memory, descriptors, sockets, concurrent permission requests, both status planes, and stable-path reboot recovery.
• Only the exact accepted artifacts may then replace the Build 15 daemon and installed GUI on rdmpw3275m and the fleet.
• Canonical owners still owe explicit accept/reject/integration receipts for the five completed local agy handoffs. No local agy work is currently eligible to resume.