From 965b0d5a7c21a19e1ed07e9b52b14d64c890f257 Mon Sep 17 00:00:00 2001
From: Garry Tan <garrytan@gmail.com>
Date: Sat, 15 Aug 2026 10:40:21 -0700
Subject: [PATCH] test: opt-in gate for live-playwright ML tests; ios-qa build
 hygiene
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

security-live-playwright's L4 tests dlopen onnxruntime inside a bun
--parallel worker whenever the dev box has a warm model cache — the
source of the intermittent 'panic: Segmentation fault' + crashed-worker
retries (and likely the residual run wedges). Same SECURITY_BENCH=1
opt-in as security-bench.test.ts; the L1-L3 tests in the file still run
everywhere.

Also: gitignore the ios-qa gen-accessors-tool Swift .build/ output (a
side-effect of running its tests that kept polluting git status) and
commit its Package.resolved so tool builds resolve reproducibly.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .gitignore                                         |  3 +++
 browse/test/security-live-playwright.test.ts       |  8 +++++++-
 ios-qa/scripts/gen-accessors-tool/Package.resolved | 14 ++++++++++++++
 3 files changed, 24 insertions(+), 1 deletion(-)
 create mode 100644 ios-qa/scripts/gen-accessors-tool/Package.resolved

diff --git a/.gitignore b/.gitignore
index 5196c0d05..7c3a3ad59 100644
--- a/.gitignore
+++ b/.gitignore
@@ -44,3 +44,6 @@ docs/throughput-*.json
 
 # gbrain local source-staging dir (capability checks, source clones) — runtime artifact
 .sources/
+
+# Swift build output from the ios-qa gen-accessors tool (built on demand by its tests)
+ios-qa/scripts/gen-accessors-tool/.build/
diff --git a/browse/test/security-live-playwright.test.ts b/browse/test/security-live-playwright.test.ts
index b46e4b8c9..415073977 100644
--- a/browse/test/security-live-playwright.test.ts
+++ b/browse/test/security-live-playwright.test.ts
@@ -42,7 +42,13 @@ const MODEL_CACHE = path.join(
   'onnx',
   'model.onnx',
 );
-const ML_AVAILABLE = fs.existsSync(MODEL_CACHE);
+// Opt-in only (SECURITY_BENCH=1), same rationale as security-bench.test.ts:
+// gating on model-cache existence alone auto-ran ONNX inference on any dev box
+// that ever warmed the classifier — and dlopen'ing onnxruntime inside a
+// `bun test --parallel` worker segfaults Bun intermittently (observed twice:
+// "panic: Segmentation fault ... a bug in Bun" followed by a crashed-worker
+// retry, sometimes wedging the run).
+const ML_AVAILABLE = process.env.SECURITY_BENCH === '1' && fs.existsSync(MODEL_CACHE);
 
 describe('defense-in-depth — live Playwright fixture', () => {
   let testServer: ReturnType<typeof startTestServer>;
diff --git a/ios-qa/scripts/gen-accessors-tool/Package.resolved b/ios-qa/scripts/gen-accessors-tool/Package.resolved
new file mode 100644
index 000000000..15af7fb83
--- /dev/null
+++ b/ios-qa/scripts/gen-accessors-tool/Package.resolved
@@ -0,0 +1,14 @@
+{
+  "pins" : [
+    {
+      "identity" : "swift-syntax",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/swiftlang/swift-syntax.git",
+      "state" : {
+        "revision" : "2bc86522d115234d1f588efe2bcb4ce4be8f8b82",
+        "version" : "510.0.3"
+      }
+    }
+  ],
+  "version" : 2
+}