[zibi-pplx]

Summary

Two costs shared by many of the tests listed in ci/test-duration-budget.toml go away:

• bcrypt in pplx-space-api tests. hash_password hashed every test password at cost 12, which takes 0.3-0.5 s per hash on a loaded CI runner. The external-console fixture, the session and identity tests, and the native-build ownership cases each pay for two to four hashes. Under the crate's own tests it now uses cost 4, bcrypt's minimum; outside them it stays at 12. verify_password reads the cost from the stored hash, so login and verification run the same code either way.
• sha2 at opt-level 0. The template-mgr tests hash mebibytes of rootfs images. sha2 now joins libsqlite3-sys, bcrypt and blowfish in the per-package test overrides.

It removes 59 exceptions, so 220 remain: the 57 affected tests that now run under 0.8 s (their old slowest runs were about twice their median), and two whose tests #1222 deleted.

Why only two crates. A throwaway trial, #1418, set [profile.test.package."*"] opt-level = 2 on top of #1417:

	#1417	#1418 (every dependency optimized)
Building every workspace test	2m28s	6m03s
nextest run	60.8 s	72.8 s

Optimizing everything costs build time and gave the test run nothing. Per crate, on the same tests in both runs:

Crate	Tests	Before	After
sha2 (template-mgr rootfs and import)	25	26.0 s, slowest 2.2 s	6.0 s, slowest 0.4 s
md-5 (object-store uploads)	7	6.1 s	4.0 s
aes and related (common-io)	3	2.5 s	1.0 s
regex crates (archcheck)	2	9.3 s	6.1 s, still over 2 s
base64, crc, volmgr's crypto			no gain

Only sha2 gave a clear gain. md-5 looked faster in the trial, but this PR's first CI run showed no gain (6.1 s before, 6.3 s after), so it is not included.

Stack

1. #1407: shorten the Rust tests job's slowest tail.
2. #1408: hold every Rust test to a 2-second budget.
3. #1414: split the sbx-mgr-store state-write sweeps into per-state cases.
4. #1417: drop the exceptions of tests that stay under the limit.
5. This PR: shared test costs, and the exceptions they clear.

Validation

• Locally the 69 password-handling api tests pass, the slowest in 0.23 s. Locally the template-mgr and object-store suites pass (377 tests).
• The per-crate effect of optimizing sha2 and md-5 comes from trial: optimize every dependency under cargo test (do not merge) #1418's Rust tests job, compared test by test with ci: drop the duration exceptions of tests that stay under the limit #1417's.
• CI, first head (job 126495270104, against ci: drop the duration exceptions of tests that stay under the limit #1417): the 48 bcrypt-affected api tests went from 75.8 s to 35.4 s in total, and 45 of them are under 1 s. The one still at 9.9 s waits out a builder connect retry, which is a separate fix. The template-mgr tests went from 27.1 s to 8.3 s, the slowest from 2.17 s to 0.52 s.
• The exceptions removed are only for tests in those two groups that ran under 0.8 s on that head. This head's Rust tests job checks the budget without them.

Severity and risk

Severity: does not apply; this is a CI speedup.

Risk:

• bcrypt: only the api crate's own test build sees cost 4. Production, and any other crate's tests that call hash_password, keep 12. No test asserts the cost.
• Profile: sha2 changes profile, so the first build after merge rebuilds it and every crate that depends on it; on the first head that build took 3m36s against 2m28s. Later builds reuse main's copy. Debugging into sha2 from a test is harder.
• To roll back, revert this PR.

AI assistance: Claude Code drafted the change, measured it and wrote this description.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Tests
  • Updated test timing budgets and optimized the sha2 dependency in test builds.
• Chores
  • Revised test-profile notes with dependency optimization timing details.
• No user-facing changes: Production password-hashing settings and password verification behavior remain unchanged.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

Test builds now use a lower password-hash cost and compile sha2 with optimization level 3. The duration-budget exception list adds, removes, and replaces test entries.

Changes: Test Build Tuning

Layer / File(s)	Summary
Password-hash cost selection crates/libs/api/src/auth.rs	hash_password uses cost 4 in test builds and cost 12 otherwise. Password verification remains unchanged.
sha2 test optimization Cargo.toml	The test profile compiles sha2 with opt-level = 3. The adjacent comment reports a CI timing change from 27 seconds to 8 seconds for template-manager tests.
Duration-budget exceptions ci/test-duration-budget.toml	The exception list adds ceilings for API, native-build session-ownership, and archcheck tests. It removes prior ownership, archcheck, SQLite-patterns, and template-manager exceptions. The global limit and exception-list policy remain unchanged.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Possibly related PRs

• perplexityai/SPACE#1417: It updates the same duration-budget list, and this PR uses its CI runs as a timing baseline.
• perplexityai/SPACE#1408: It adds the duration-budget file and the CI enforcement that checks it.
• perplexityai/SPACE#1222: It removes archcheck tests that are still named in duration-budget entries.

Suggested reviewers: nikhilbirmiwal-pplx, ac-pplx

Merge Risk: Minimal · up to dae0b

The performance and duration-budget changes have no established production or CI-blocking regression.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title names the two changes in the PR: test passwords hashed at bcrypt's minimum cost, and sha2 optimized for tests. Both match the Cargo.toml and auth.rs changes in the raw summary. It is specifi…
Description check		The description covers the Summary (effect and reasons), Validation (local and CI results, with what was not validated), and Severity and risk (severity stated, risk and rollback described). It also i…
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names the two changes in the PR: test passwords hashed at bcrypt's minimum cost, and sha2 optimized for tests. Both match the Cargo.toml and auth.rs changes in the raw summary. It is specific and accurate, though long at 72 characters.

Full details: Description check

Explanation

The description covers the Summary (effect and reasons), Validation (local and CI results, with what was not validated), and Severity and risk (severity stated, risk and rollback described). It also includes a Stack section and the AI assistance line. Optional sections are used where they apply. The Validation section names no test that fails on main, but this is a CI speedup, not a bug fix, so the template does not require one.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 1 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 20499f45-9fb2-40a1-aba6-7cb8f43987ca

Commits

Reviewing files that changed from the base of the PR and between 139fccb and dae0b10.

Files selected for processing: 2

• Cargo.toml
• ci/test-duration-budget.toml

Files with no reviewable changes: 1

• ci/test-duration-budget.toml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

[zibi-pplx]

Combined into #1426 with the rest of the test burn-down, so the stack is #1407, #1408 and #1426.