Record Stage 2 transfer package verification results

.github/workflows/build.yml

@@ -33,8 +33,12 @@ jobs:
       - run: go test ./...
       - name: Anti-flake check (vpnruntime)
         run: go test ./internal/vpnruntime -count=20
+      - name: Targeted anti-flake (parallel flow window)
+        run: go test ./internal/vpnruntime -run TestFabricClientPacketIngressParallelFlowWindowDoesNotBlockIndependentChannel -count=50 -timeout=60s
       - name: Concurrency check (vpnruntime race)
         run: go test -race ./internal/vpnruntime
+      - name: One-shot vpnruntime guard script
+        run: pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/smoke/run-vpnruntime-ci-guards.ps1 -AntiFlakeCount 20 -TargetedCount 50
 
   worker:
     runs-on: ubuntu-24.04

docs/operations/VPNRUNTIME_CI_FIXES_TRANSFER_2026-05-12.md

@@ -7,11 +7,21 @@ Portable export includes two local commits:
 1. `a3c0998e` - Stabilize vpnruntime parallel flow test and add CI anti-flake gate
 2. `fea5174e` - Add vpnruntime race check to CI
 
+Extended stabilization chain now includes:
+
+3. `4603826b` - Add transfer notes for vpnruntime CI fix commits
+4. `6fec1d5c` - Add targeted anti-flake CI step for parallel flow window test
+5. `edf3836c` - Add vpnruntime CI stabilization changelog
+
 Generated files (local, ignored by git) are in:
 
 - `artifacts/git-patches/0001-Stabilize-vpnruntime-parallel-flow-test-and-add-CI-a.patch`
 - `artifacts/git-patches/0002-Add-vpnruntime-race-check-to-CI.patch`
 - `artifacts/git-patches/vpnruntime-ci-fixes.bundle`
+- `artifacts/git-patches/full-stabilization/` (5 patches)
+- `artifacts/git-patches/vpnruntime-ci-stabilization-5commits.bundle`
+- `artifacts/git-patches/full-stabilization-latest/` (10 patches)
+- `artifacts/git-patches/vpnruntime-ci-stabilization-latest-10commits.bundle`
 
 ## Apply as patches
 
@@ -27,6 +37,20 @@ git fetch ./vpnruntime-ci-fixes.bundle
 git cherry-pick a3c0998e fea5174e
 ```
 
+Full chain (5 commits):
+
+```bash
+git fetch ./vpnruntime-ci-stabilization-5commits.bundle
+git cherry-pick a3c0998e fea5174e 4603826b 6fec1d5c edf3836c
+```
+
+Latest chain (10 commits from `8ba0561f` baseline):
+
+```bash
+git fetch ./vpnruntime-ci-stabilization-latest-10commits.bundle
+git cherry-pick a3c0998e fea5174e 4603826b 6fec1d5c edf3836c 051d0242 84ba2ad7 f1070e1a d2cd9292 3778904c
+```
+
 ## Validate
 
 From `agents/rap-node-agent`:
@@ -36,3 +60,8 @@ go test ./internal/vpnruntime -count=20
 go test -race ./internal/vpnruntime
 ```
 
+Or run the one-shot guard from repo root:
+
+```powershell
+pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/smoke/run-vpnruntime-ci-guards.ps1
+```

docs/operations/VPNRUNTIME_CI_STABILIZATION_CHANGELOG_2026-05-12.md

@@ -0,0 +1,67 @@
+# VPN Runtime CI Stabilization Changelog
+
+Date: 2026-05-12
+
+This note summarizes local stabilization work for `agents/rap-node-agent/internal/vpnruntime`
+and related CI hardening.
+
+## Commit Chain
+
+1. `a3c0998e`  
+   Stabilize parallel flow-window test behavior and add initial CI anti-flake checks.
+
+2. `fea5174e`  
+   Add `-race` CI check for `vpnruntime`.
+
+3. `4603826b`  
+   Add transfer notes with patch/bundle usage instructions.
+
+4. `6fec1d5c`  
+   Add targeted CI anti-flake step for the previously flaky test:
+   `TestFabricClientPacketIngressParallelFlowWindowDoesNotBlockIndependentChannel`.
+
+## Key Technical Changes
+
+- Test determinism fix in `fabric_transport_test.go`:
+  fast send now waits for observed slow-send start boundary, so overlapping
+  in-flight behavior is exercised consistently.
+
+- CI workflow hardening in `.github/workflows/build.yml`:
+  - backend now runs `go test ./...`
+  - new `node-agent` job with:
+    - `go test ./...`
+    - `go test ./internal/vpnruntime -count=20`
+    - `go test ./internal/vpnruntime -run TestFabricClientPacketIngressParallelFlowWindowDoesNotBlockIndependentChannel -count=50 -timeout=60s`
+    - `go test -race ./internal/vpnruntime`
+
+## Local Validation Snapshot
+
+- `go test ./internal/vpnruntime -count=100` passed.
+- `go test ./internal/vpnruntime -run TestFabricClientPacketIngressParallelFlowWindowDoesNotBlockIndependentChannel -count=50 -timeout=60s` passed.
+- `go test -race ./internal/vpnruntime` passed.
+- `pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/smoke/run-vpnruntime-ci-guards.ps1 -AntiFlakeCount 20 -TargetedCount 50` passed.
+- `go test ./...` passed in:
+  - `agents/rap-node-agent`
+  - `backend`
+
+## One-Shot Guard Script
+
+- `scripts/smoke/run-vpnruntime-ci-guards.ps1`
+
+Example:
+
+```powershell
+pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/smoke/run-vpnruntime-ci-guards.ps1
+```
+
+## Transfer/Recovery Artifacts
+
+Local export files are available in ignored path:
+
+- `artifacts/git-patches/0001-Stabilize-vpnruntime-parallel-flow-test-and-add-CI-a.patch`
+- `artifacts/git-patches/0002-Add-vpnruntime-race-check-to-CI.patch`
+- `artifacts/git-patches/vpnruntime-ci-fixes.bundle`
+
+See:
+
+- `docs/operations/VPNRUNTIME_CI_FIXES_TRANSFER_2026-05-12.md`

docs/operations/VPNRUNTIME_CI_STABILIZATION_COMMITS_2026-05-12.md

@@ -0,0 +1,24 @@
+# VPN Runtime CI Stabilization Commit Index
+
+Date: 2026-05-12
+Baseline commit: `8ba0561f`
+
+Ordered commit chain (`8ba0561f..HEAD` at capture time):
+
+1. `a3c0998e` - Stabilize vpnruntime parallel flow test and add CI anti-flake gate
+2. `fea5174e` - Add vpnruntime race check to CI
+3. `4603826b` - Add transfer notes for vpnruntime CI fix commits
+4. `6fec1d5c` - Add targeted anti-flake CI step for parallel flow window test
+5. `edf3836c` - Add vpnruntime CI stabilization changelog
+6. `051d0242` - Update transfer notes for full 5-commit stabilization chain
+7. `84ba2ad7` - Add one-shot vpnruntime CI guard smoke script
+8. `f1070e1a` - Wire one-shot vpnruntime guard script into CI
+9. `d2cd9292` - Record full one-shot vpnruntime guard validation
+10. `3778904c` - Update transfer notes for latest 9-commit stabilization bundle
+
+Command to re-check this list:
+
+```bash
+git log --oneline --reverse 8ba0561f..HEAD
+```
+

docs/operations/VPNRUNTIME_STAGE_EXECUTION_2026-05-12.md

@@ -0,0 +1,60 @@
+# VPN Runtime Stage Execution
+
+Date: 2026-05-12
+Current head at stage start: `874e2f14`
+
+## Stage Plan
+
+1. Stage 1 - Preflight baseline validation (local guard pipeline)
+2. Stage 2 - Transfer package refresh and integrity check
+3. Stage 3 - Remote push handoff readiness (auth-dependent)
+4. Stage 4 - Post-push verification checklist
+
+## Stage Status
+
+### Stage 1 - Completed
+
+Command:
+
+```powershell
+pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/smoke/run-vpnruntime-ci-guards.ps1 -AntiFlakeCount 20 -TargetedCount 50
+```
+
+Result:
+
+- `go test ./...` (rap-node-agent): PASS
+- `go test ./internal/vpnruntime -count=20`: PASS
+- targeted anti-flake test (`-count=50`): PASS
+- `go test -race ./internal/vpnruntime`: PASS
+
+Next:
+
+- Proceed to Stage 2 (transfer package refresh and integrity check).
+
+### Stage 2 - Completed
+
+Scope:
+
+- Refresh transfer artifacts from baseline `8ba0561f..c27bf084`.
+- Verify bundle metadata.
+- Verify patch chain applies cleanly on a detached baseline worktree.
+
+Artifacts:
+
+- `artifacts/git-patches/full-stabilization-current/` (12 patches)
+- `artifacts/git-patches/vpnruntime-ci-stabilization-current.bundle`
+
+Verification:
+
+- `git bundle verify artifacts/git-patches/vpnruntime-ci-stabilization-current.bundle`: PASS
+- `git am --3way <12 patches>` on detached worktree from `8ba0561f`: PASS
+
+Notes:
+
+- Local git version does not support `git am --dry-run`; compatibility check was
+  performed via real `git am --3way` in throwaway worktree and then worktree
+  removal.
+
+Next:
+
+- Proceed to Stage 3 (remote push handoff readiness; auth-dependent).

scripts/smoke/run-vpnruntime-ci-guards.ps1

@@ -0,0 +1,56 @@
+param(
+    [int]$AntiFlakeCount = 20,
+    [int]$TargetedCount = 50,
+    [string]$TargetedTimeout = "60s",
+    [switch]$SkipRace
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = "Stop"
+
+$repoRoot = Resolve-Path (Join-Path $PSScriptRoot "..\..")
+$agentDir = Join-Path $repoRoot "agents\rap-node-agent"
+
+function Invoke-Go {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string[]]$Args
+    )
+    & go @Args
+    if ($LASTEXITCODE -ne 0) {
+        throw "go $($Args -join ' ') failed with exit code $LASTEXITCODE"
+    }
+}
+
+Write-Host "[vpnruntime] repo root: $repoRoot"
+Write-Host "[vpnruntime] agent dir: $agentDir"
+
+Push-Location $agentDir
+try {
+    Write-Host "[vpnruntime] go test ./..."
+    Invoke-Go -Args @("test", "./...")
+
+    Write-Host "[vpnruntime] go test ./internal/vpnruntime -count=$AntiFlakeCount"
+    Invoke-Go -Args @("test", "./internal/vpnruntime", "-count=$AntiFlakeCount")
+
+    Write-Host "[vpnruntime] targeted anti-flake"
+    Invoke-Go -Args @(
+        "test",
+        "./internal/vpnruntime",
+        "-run", "TestFabricClientPacketIngressParallelFlowWindowDoesNotBlockIndependentChannel",
+        "-count=$TargetedCount",
+        "-timeout=$TargetedTimeout"
+    )
+
+    if (-not $SkipRace) {
+        Write-Host "[vpnruntime] race check"
+        Invoke-Go -Args @("test", "-race", "./internal/vpnruntime")
+    } else {
+        Write-Host "[vpnruntime] race check skipped"
+    }
+
+    Write-Host "[vpnruntime] all guards passed"
+}
+finally {
+    Pop-Location
+}