gate: cpu-gates gets a budget that fits the work, and a timeout that says so

[noahgift]

Fixes the cause of paiml/paiml-mcp-agent-toolkit#1358.

cpu-gates: timeout-minutes: 30 has not been enough since v3.39.0 — and the way it failed is why nobody noticed.

The budget is too small, measured

clean-room-pmat on an idle box (paiml-mcp-agent-toolkit@v3.40.1, 2026-09-14):

A0 0s · A1 6s · A2 149s · A3 237s · A4 0s
B0 133s · B1 210s · B2 601s · B3 218s · B4 32s     = 1586s = 26.4 min

30 minutes left 3.6 minutes for runner setup, the infra sync, the target checkout, the container build and the cleanup — before any contention at all. On a 16-runner box with 23 runs queued it is not close.

What it cost

gh run list --workflow=release.yml --limit 6     (paiml-mcp-agent-toolkit)
  v3.40.1   cancelled   2026-09-14T15:12
  v3.40.0   cancelled   2026-09-07T18:12
  v3.39.0   cancelled   2026-09-06T14:19
  master    cancelled   2026-09-06T13:04

Run 34860654284 (v3.40.1):

job	result	window
create-release	success
gate / lint-gate	success
gate / cpu-gates	cancelled	15:17:48 → 15:48:27 — 30m39s
gate / gate	failure
prerelease	skipped
verify	skipped

prerelease is needs: [create-release, gate, verify], and binary-release.yml fires on release: published — so three releases shipped with no GitHub release and no attached binaries.

Two changes

1. timeout-minutes: 90 on the job — 3.4× the measured idle time, which is the headroom a contended box needs. Raised from a measurement, not a guess.

2. timeout-minutes: 75 on the Run clean-room Mode A+B step, deliberately below the job's.

A job-level timeout kills the job and GitHub records the conclusion as cancelled — the same word an operator pressing cancel produces. That is the whole reason four runs walked past: cancelled is not a word anyone has to answer for. A step-level timeout fails the step, and a failed step carries its own name into the check, so the gate says which thing ran out of time instead of saying nothing.

The second change is the one that matters. A budget can be wrong again; a timeout that names itself cannot be mistaken for someone pressing cancel.

actionlint .github/workflows/unified-gate.yml   nothing on the changed lines
                                                (the two SC2086 infos at :148 are pre-existing)
yaml-parses-guard.sh                            OK: every YAML file parses

🤖 Generated with Claude Code