Introduce the standalone stlab-execution library

[sean-parent]

Summary

Introduce STLab's independently buildable execution substrate using cpp-library:

• Task, executor APIs/backends, system timers, thread naming, pre-exit, and runtime lifecycle.
• Canonical existing stlab/ include paths and stlab:: APIs, independent configuration/version namespace, and no dependency on STLab futures/channels.
• stlab::execution source/installed target, independent install and static/shared controls, and legacy shared-option compatibility.
• Standalone contracts/lifecycle/ABI tests, installed consumer round trips, documentation, and platform CI.

Depends on stlab/cpp-library#27. The toolkit development SHA is now available remotely; it is not an approved release pin.

main is intentionally an empty bootstrap. This PR shows the complete library as one reviewed snapshot. The original implementation commits remain on extract-execution; its content is identical to this review branch. Existing STLab dependency SHAs remain reachable.

Validation

• Refreshed complete native execution suite: 16/16 passed.
• Final cross-repository matrix: 278/278 CTest entries across 25 configurations, including Windows shared/native/portable/ASan, Linux, and both Emscripten runtimes.
• Installed/static/shared consumers and DLL deployment verified with actual Windows CMake 3.24.4.
• Both Doxygen builds and workflow actionlint passed; inherited clang-tidy warnings are documented, not claimed clean.
• Final cross-repository review approved local delivery with no blocking findings.

C++ consumers must rebuild; v2 C runtime entry points and task-storage guards are preserved. No release or tag is created. Hosted macOS/Qt/TSan checks remain pending; release ordering is toolkit → execution → STLab.

Generated with GitHub Copilot CLI

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved executor wake and shutdown races, reusable-executor failures, and unsafe shell interpolation can cause deadlocks, termination, or command execution.

Review effort: Balanced
Findings: 5 · 4 · 2

Open (11)

• Unvalidated worktree name enables POSIX and Windows command injection · New
• Delayed executor becomes unusable after first submission · New
• Self-move assignment accesses destroyed model storage · New
• Shard-specific wakeups can leave queued tasks indefinitely blocked · New
• Thread vector races with expansion during join · New
• CI permits unsupported Node.js versions for Emscripten · New
• Move assignment leaks the previously owned dispatch group · New
• Zero hardware concurrency causes invalid clamp bounds · New
• Null handler registration bypasses shutdown cleanup · New
• Documented Node.js minimum conflicts with pinned Emscripten · New
• Duplicate nodiscard attributes on overload · New

What changed in this PR

Introduces STLab’s execution subsystem as an independently buildable, installable library while preserving existing headers and APIs.

Changes:

• Adds task, executor, timer, thread-naming, and lifecycle implementations across supported platforms.
• Adds standalone CMake packaging, documentation, presets, and CI.
• Adds extensive contract, lifecycle, ABI, backend, and installed-consumer tests.

File	Description
.clang-format	Defines C++ formatting rules.
.clang-tidy	Configures static analysis.
.gitattributes	Enables text normalization.
.gitignore	Ignores builds and caches.
CMakeLists.txt	Defines the execution library target.
CMakePresets.json	Adds build and test presets.
LICENSE	Adds the Boost license.
README.md	Documents building and consumption.
.github/​matrix.json	Defines the CI platform matrix.
.github/​workflows/​ci.yml	Builds, tests, and documents the library.
.vscode/​extensions.json	Recommends development extensions.
.vscode/​tasks.json	Adds editor build and worktree tasks.
cmake/​CPM.cmake	Bootstraps CPM dependency management.
cmake/​ExecutionConfig.cmake	Resolves and validates backend settings.
cmake/​ExecutionPlatform.cmake	Detects platform execution backends.
cmake/​Findlibdispatch.cmake	Locates libdispatch.
cmake/​Platform/​Emscripten-Execution.cmake	Configures Emscripten builds.
include/​stlab/​pre_exit.hpp	Exposes lifecycle shutdown APIs.
include/​stlab/​execution/​config.hpp.in	Defines generated execution configuration.
include/​stlab/​concurrency/​task.hpp	Implements move-only tasks and ABI guards.
include/​stlab/​concurrency/​default_executor.hpp	Exposes priority executors.
include/​stlab/​concurrency/​executor_base.hpp	Provides executor composition helpers.
include/​stlab/​concurrency/​immediate_executor.hpp	Provides synchronous execution.
include/​stlab/​concurrency/​main_executor.hpp	Exposes main-queue execution.
include/​stlab/​concurrency/​set_current_thread_name.hpp	Implements portable thread naming.
include/​stlab/​concurrency/​system_timer.hpp	Exposes asynchronous timer scheduling.
include/​stlab/​concurrency/​detail/​libdispatch_executor_group.hpp	Manages libdispatch work groups.
src/​pre_exit.cpp	Implements pre-exit handler processing.
src/​execution.def	Exports Windows shared-library symbols.
src/​concurrency/​executor_abi.cpp	Implements executor backends and ABI.
src/​concurrency/​core_shutdown.cpp	Coordinates runtime shutdown.
src/​concurrency/​cooperative_executor.cpp	Implements threadless cooperative execution.
src/​concurrency/​main_executor_emscripten.cpp	Implements Emscripten main execution.
src/​concurrency/​main_executor_libdispatch.cpp	Implements libdispatch main execution.
src/​concurrency/​main_executor_none.cpp	Provides disabled-main-executor stubs.
src/​concurrency/​main_executor_portable.cpp	Implements a portable main queue.
src/​concurrency/​main_executor_qt.cpp	Implements Qt main execution.
src/​concurrency/​system_timer_emscripten.cpp	Implements Emscripten timers.
src/​concurrency/​system_timer_libdispatch.cpp	Implements libdispatch timers.
src/​concurrency/​system_timer_portable.cpp	Implements portable timers.
src/​concurrency/​system_timer_windows.cpp	Implements Windows timers.
src/​concurrency/​detail/​cooperative_executor.hpp	Declares cooperative scheduling internals.
src/​concurrency/​detail/​core_shutdown.hpp	Declares shutdown coordination.
src/​concurrency/​detail/​main_task_queue.hpp	Implements the shared main queue.
src/​concurrency/​detail/​system_timer_shutdown.hpp	Declares timer shutdown.
src/​concurrency/​detail/​timer_common.hpp	Shares timer validation and timing logic.
src/​concurrency/​detail/​waiter_state.hpp	Tracks portable-worker wake state.
test/​CMakeLists.txt	Registers the complete test suite.
test/​RuntimeDlls.cmake	Adds runtime DLL deployment.
test/​check_node_configuration.cmake	Validates nested Node configuration.
test/​cooperative_shutdown_test.cpp	Tests cooperative shutdown ordering.
test/​copy_runtime_dlls.cmake	Copies required runtime DLLs.
test/​core_shared_smoke_main.cpp	Runs shared-core smoke tests.
test/​core_shared_smoke_test.cpp	Verifies shared ABI exports.
test/​core_shutdown_first.cpp	Tests submission after shutdown.
test/​emscripten_config_test.cmake	Tests invalid Emscripten configurations.
test/​emscripten_timer_test.cpp	Tests Emscripten timer lifecycle.
test/​executor_abi_test.cpp	Tests executor ABI submissions.
test/​executor_contract_test.cpp	Tests executor contracts.
test/​executor_priority_shutdown.cpp	Tests priority draining at shutdown.
test/​expect_emscripten_terminate.cmake	Validates expected Emscripten termination.
test/​expect_task_abi_mismatch.cmake	Validates ABI mismatch link failures.
test/​header_smoke.cpp	Smoke-tests public headers.
test/​main.cpp	Provides the doctest entry point.
test/​main_executor_concurrent_test.cpp	Tests concurrent main submissions.
test/​main_executor_order_test.cpp	Tests main-queue ordering.
test/​main_executor_pre_exit_before_submit_test.cpp	Tests post-shutdown first submission.
test/​main_executor_pre_exit_test.cpp	Tests main queue after pre-exit.
test/​main_executor_shutdown_order_test.cpp	Tests producer shutdown ordering.
test/​main_executor_test_host.hpp	Provides platform main-loop fixtures.
test/​package/​CMakeLists.txt	Configures installed-package consumers.
test/​package/​main.cpp	Exercises the installed package.
test/​record_node_emulator.cmake	Records the selected Node emulator.
test/​shared_reconfiguration.cmake	Tests shared-option reconfiguration.
test/​shared_selection.cmake	Tests shared-library defaults.
test/​system_timer_application_shutdown.cpp	Tests application shutdown handlers.
test/​system_timer_executor_shutdown.cpp	Tests timer/executor shutdown interaction.
test/​system_timer_lifecycle.cpp	Tests timer cancellation and joining.
test/​system_timer_resource_failure.cpp	Tests allocation-failure recovery.
test/​system_timer_shutdown_first.cpp	Tests post-shutdown timer rejection.
test/​system_timer_test.cpp	Tests timer contracts and limits.
test/​task_abi_mismatch_test.cpp	Creates an incompatible ABI target.
test/​task_contract_test.cpp	Tests task ownership and movement.
test/​verify_package.cmake	Verifies standalone installation.
test/​waiter_state_test.cpp	Tests retained wake requests.
docs/​Doxyfile	Configures API documentation.
docs/​doxygen/​execution_groups.hpp	Defines documentation groups.
docs/​doxygen/​mainpage.dox	Adds the documentation landing page.
docs/​index.html	Redirects to generated documentation.
scripts/​flatten_json.py	Flattens the CI matrix JSON.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[sean-parent]

Addressed all five accepted findings from the local review in 140d46a:

1. Installed libdispatch discovery: ship the existing system resolver as a package-local config and use the toolkit's dependency mapping. Apple target creation is repeatable; macOS static/shared installed consumers are now in CI.
2. CI hardening: pin MSVC setup v4.1.0 and emsdk 6.0.10 to verified immutable commits; restrict workflow permissions to contents: read.
3. Correct executor_t documentation to show its by-value task parameter.
4. Name stlab-execution, not stlab-core, as the owner of main-executor configuration.
5. Distinguish bad_function_call for empty throwing tasks from termination for empty noexcept tasks.

The unrelated working-tree documentation edit and compile_commands.json were not included. These findings were local, so there were no corresponding GitHub review threads to resolve.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[sean-parent]

Evaluated the ten findings from the unpublished dry-run screenshot. The dispositions below include the clarified queued-task lifecycle contract and the corrections in 84d0565, daba653, and b71e7fc. Item 3 supersedes the earlier pointer-detachment fix: the excluded lifecycle reentry does not justify a separate allocation for every task.

#	Finding	Verification and resolution
1	Reference-returning task copies its result	Pre-fix type, address, and mutation checks failed. The call operator now returns the declared R, preserving references.
2	Throwing callable move terminates task relocation	Pre-fix regression aborted when moving an lvalue-copied callable. SBO now requires nonthrowing move construction; other targets relocate through heap ownership. The task storage ABI is unchanged.
3	Capture destruction reenters locked queues/timers	Clarified requirement: callable construction (including copy/move) and destruction of moved-from callables must not submit executor or timer work. Restored inline executor/main queue entries and portable timer records; removed separate per-entry allocations. Scheduling from task bodies and executed-target cleanup remains supported. Replaced unsupported lifecycle-reentry tests with valid submission and warmed-storage allocation regressions; all pass. Container growth and throwing-move callable fallback may still allocate.
4	pre_exit inside executor work hangs	The native shutdown restriction is documented on default/high/low executors and timers: their task/callback bodies and capture cleanup must not call pre_exit(). It is not a precondition on pre_exit(). Existing native callback assert/terminate diagnosis is retained; main-queue tasks may initiate shutdown, and threadless Emscripten cooperative behavior is preserved.
5	Static ASan consumers miss runtime linkage	Installed consumers previously failed with undefined __asan symbols. GCC/Clang sanitizer link requirements are now PUBLIC; installed C++17/20 consumers build/run without manually supplying sanitizer flags.
6	ABI fixture publishes completion before final mutex/CV access	Pre-fix litmus observed remaining==0 while the completion mutex was held by the host. Decrements and notification now publish completion under that mutex. The regression checks callback progress before observing publication.
7	Leading-zero pool limits become octal	Generated 010u failed a static assertion as 8 rather than 10. Decimal spelling is normalized before header generation; 010, 00017, and 000 compile as 10, 17, and 0. Cache input spelling is retained.
8	Portable priority documentation promises OS thread priority	Corrected docs to describe queue ordering on portable executors and platform hints on Windows/libdispatch.
9	task documentation advertises unsupported member pointers	Superseded the lambda-only documentation workaround: both inline and heap-backed models now call std::invoke. Direct member-function and data-member pointer regressions failed to compile with the old direct call and now pass, including const member functions, noexcept signatures, reference results, object references/pointers, reference wrappers, and smart pointers. Null member pointers remain empty; argument forwarding and storage ABI are unchanged. Updated the documentation to describe supported member pointers.
10	Findlibdispatch documents nonexistent results	Corrected the contract to FOUND, the imported target, and actual singular cache paths on non-Apple platforms; fixed the header name.

Verification for the inline-storage revision daba653: Windows native 23/23; MSVC C++17 portable/main 41/41; GCC portable/main 40/40; Windows shared/DLL/package focused suite 13/13; GCC ASan allocation/lifetime/package focused suite 11/11; Doxygen generation passed. Post-push rebuild and allocation/valid-submission regressions passed 6/6 at daba653. The earlier deterministic moved-from-destructor timer reentry test exercised behavior now explicitly excluded by the contract and has been replaced. Suitable local libdispatch and Emscripten runtimes/toolchains were unavailable for execution. CI run 37552189502 targets daba653, not the subsequent invocation change.

Verification for b71e7fc: the MSVC C++17 build and 12 focused task/executor/ABI, header, allocation, and valid-submission tests passed; the GCC task/executor/ABI suite passed 3/3. Added coverage for heap-backed forwarding of move-only arguments and reference results. No current-head CI result is claimed.

No cpp-library-generated files were manually edited. The screenshot findings were never posted as review threads, so this comment records their individual dispositions. Existing posted threads are resolved; refetched review bodies contained no suppressed findings. Requested a fresh Copilot review of daba653.

Fresh-review result: review 5436077665 again declined the explicitly requested review because the requesting account has reached its review quota. No fresh bot analysis was performed; its body contains no suppressed findings. Refetched posted review threads are all resolved.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[sean-parent]

Talos PR Review

Verdict: Needs attention: 1 MEDIUM and 2 LOW findings. No blockers or security findings survived verification. All three accepted findings are posted inline.

Scope: PR #1, main (40635e1) to execution-library (b71e7fc), 97 changed files. The change introduces the standalone C++17 execution library, versioned task ABI, platform executors/timers, shutdown handling, and build/package/test infrastructure. The scope matches the PR's standalone-library intent.

Findings:

• MEDIUM: README commands refer to presets absent from the shipped configuration. The threadless Emscripten configuration test also invokes an absent preset.
• LOW: Linux portable executor thread names exceed the pthread limit and fail silently.
• LOW: Release Windows executor scheduling passes a null work handle to the threadpool when allocation fails.

Process: Security, correctness, standards, architecture, operations, and documentation personas ran independently, followed by an Opus challenge reviewer. Six valid candidates entered the challenge; three were accepted and three duplication/performance suggestions were rejected. Accepted/posting counts: 3/3. No overflow or unchallenged candidates. No base-revision project rules, applicable GitHub custom instructions, or active OpenSpec changes were found.

Verification: Challenge reproductions confirmed pthread ERANGE on glibc 2.39, STATUS_INVALID_PARAMETER from release SubmitThreadpoolWork(nullptr), and CMake No such preset for test-cpp17 and test-emscripten-threadless. CI run 37568365152 passed for this exact head: macOS, Ubuntu GCC, Ubuntu Clang, Windows, and clang-tidy; the docs job was skipped. Missing README presets do not break the current CI workflow, which does not consume .github/matrix.json.

Coverage and limits: This large changeset received prioritized review, not exhaustive line-by-line analysis by every persona. Critical implementation paths were examined; most test sources had partial coverage, and the standards persona performed pattern scans rather than a full pattern-reuse audit. The challenge reviewer read the full diff. Five marked generated files were excluded from findings. Windows work-allocation failure itself was not induced; its null-handle consequence was reproduced independently. No full Emscripten or Qt build was run. These are review findings, not implemented fixes.

Persona routing: static roster (DCAP routing off; rerun with --dcap to enable).

Scout

Not used: Scout attached with consent; its initial index remained 0/87 files after the 300-second wait, so this review proceeded without Scout evidence. A later review will use it once indexing finishes.
This review ran without Scout's caller, affected-test and dead-code evidence.

[sean-parent]

Talos Review: Scout-enabled follow-up

No additional verified findings. This rerun reviewed the unchanged 97-file PR at b71e7fc, now with Scout's completed index and cross-file leads. The scope remains aligned with introducing the standalone execution library.

The missing-preset documentation issue was independently reconfirmed as MEDIUM, but it is already recorded in the open README thread. No duplicate inline comment was posted. The second candidate, targeting .github/matrix.json, described the same mechanism and was rejected as a duplicate; its implication that current CI fails is unsupported because CI uses its own matrix and generic presets.

Process: Security, correctness, standards, architecture, operations, and documentation personas ran independently, followed by the challenge reviewer. Two valid candidates entered challenge: one recurring finding accepted, one same-mechanism duplicate rejected. Additional accepted/posted findings: 0/0. Previously posted findings were not automatically resolved or retracted.

Verification: Fresh cmake --list-presets=all confirms the available configure/build presets are default, test, docs, clang-tidy, init, and install; test presets are test, clang-tidy, and init. The documented test-* variants are absent. The matching existing thread is unresolved and not outdated. Current-head CI remains successful on macOS, Ubuntu GCC, Ubuntu Clang, Windows, and clang-tidy; docs was skipped.

Coverage and limits: The large changeset received domain-prioritized verification. Five personas reported reading the full diff; correctness read the implementation directly and only part of the tests. The challenge pass inspected candidate-related source and history rather than the entire diff. Scout's leads were consumed by the eligible personas, but they did not read the full packet; its affected-test list is bounded and contains conservative whole-file-root warnings. No full test suite or platform build was rerun in this pass. No source files were changed.

Persona routing: static roster (DCAP routing off; rerun with --dcap to enable).

Scout

Used: risk HIGH, evidence HIGH, status COMPLETE (scout 0.9.130, 1s).
Cross-file leads given to reviewers: 5 changed symbol(s) with uses outside the diff, 0 new value(s) not handled everywhere, 0 possibly unused symbol(s).

Tests to run (Scout: 127 Must Run test(s), in these files):

• CMakePresets.json
  Scout left 126 affected-test entries out of its packet; for the full list run scout affected-tests -r 'D:/repos/github.com/stlab/stlab-execution' -s compare -b main.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[sean-parent]

Talos local PR review

Verdict: Three LOW-priority maintenance/documentation findings. No verified runtime correctness or security defect survived this review. All three accepted findings are posted inline; this is a comment review, not an approval.

Scope: #1, main (40635e1) through execution-library (a80b956): 98 changed files, 10,170 diff lines. The changes introduce the standalone C++17 execution library, its platform executors/timers, task ABI, shutdown contracts, and build/package/test infrastructure. The scope remains aligned with the standalone-library intent.

Findings:

• LOW: The Emscripten toolchain retains obsolete commented Node flags. Both Node 26.7.0 and the installed SDK's Node 24.19.0 reject the two flags with bad option (exit 9).
• LOW: The toolchain retains Boost-specific rationale and an unused Boost configuration setting, although this standalone library has no Boost dependency.
• LOW: Three native timer backends duplicate the common ABI submission/error-mapping orchestration. This is a maintenance suggestion, not a demonstrated runtime defect.

Process: Six independent personas ran: security and correctness on Opus 5.5; standards, architecture, operations, and documentation on Sonnet 5.5. Their four candidates passed required-field and changed-file checks; there were no same-location duplicates. An Opus challenge reviewer accepted three at LOW/HIGH confidence and rejected the test-injection redesign suggestion as unverified and preference-based. Accepted/posted counts: 3/3; overflow: 0; unchallenged candidates: 0. Existing threads were checked: all 14 previous threads are resolved, and none duplicates these accepted findings. No code was changed or threads resolved by this review.

Coverage and limitations: All six personas reported reading the complete saved diff to EOF. Their coverage reports mark 91 non-generated files full and seven generated files skipped as finding targets: .clang-format, .gitattributes, .github/workflows/ci.yml, .gitignore, docs/index.html, CMakePresets.json, and .vscode/tasks.json. This large changeset received domain-specific analysis; full diff consumption is not a runtime proof. No base-revision project rule files, applicable GitHub custom instructions, active OpenSpec context, or i18n eligibility were found. Persona and challenge checks were static; no build, platform runtime, race, sanitizer, or Doxygen suite was rerun during this review. The Node flag check above was executed separately. In particular, the continued need for -sSUPPORT_LONGJMP=wasm was not established, so its removal is not recommended without verification.

Existing validation: CI run 37585185265 succeeded at this exact head for Ubuntu GCC, Ubuntu Clang, macOS, Windows, and clang-tidy; docs was skipped. This is existing exact-commit evidence, not a new review-time test run.

Persona routing: static roster (DCAP routing off; rerun with --dcap to enable).

Scout

Used: risk HIGH, evidence HIGH, status COMPLETE (scout 0.9.130, 1s).
Cross-file leads given to reviewers: 0 changed symbol(s) with uses outside the diff, 0 new value(s) not handled everywhere, 0 possibly unused symbol(s).

Tests to run (Scout: 112 Must Run test(s), in these files):

• CMakePresets.json
  Scout left 111 affected-test entries out of its packet; for the full list run scout affected-tests -r 'D:/repos/github.com/stlab/stlab-execution' -s compare -b main.

Scout limits: The packet contains 34 conservative whole-file-root warnings. Security, correctness, and architecture consumed the packet; operations consumed the leads only; the challenge reviewer did not open Scout artifacts. Scout's test list is bounded and is not an assertion that the preset file itself is an executable test or that the listed tests were run.

[sean-parent]

Local Talos review

Verdict: One LOW consistency suggestion; no blocking defect found.

Scope: Complete #1 diff at 3fa7856e9f4d5b294116754d6bb427793cbf9adf against merge-base 40635e11a5f4ca6928b555d58240e0be1e92d3a0 (main): 98 changed files, 10,164 diff lines, 397,683 bytes. Each of six personas consumed the complete verbatim diff. 91 non-generated files were finding targets; seven generated outputs were context-only exclusions.

Reviewers: Security and correctness (Opus 5.5); standards, architecture, operations, documentation (Sonnet 5.5); independent challenge (Opus 5.5). No i18n eligibility or active OpenSpec. Base-owned rule files and applicable GitHub custom instructions: none.

Findings: Three candidates validated, one accepted and posted inline, two rejected by challenge, zero duplicates/overflow/latent risks. Challenge rejected the ABI callback test-name concern: the test deliberately protects the ABI fixture's completion-lock lifetime. It also rejected the missing C6553 comment concern: its claimed suppression-comment convention was contradicted by existing source. The previously discussed timer-wrapper extraction did not recur; its reviewed disposition remains unchanged.

Evidence limitations: Persona review was static, not a fresh all-platform runtime run or dependency audit. Generated toolkit outputs were excluded as finding targets. Scout supplied no cross-file leads, warned about 34 conservative whole-file roots, and omitted 111 affected-test entries. It does not establish that every suggested test was executed. The toolchain cleanup was separately validated with the actual Emscripten SDK build and four targeted configuration checks, and exact-head CI run 37685505978 succeeded.

Persona routing: static roster (DCAP routing off; rerun with --dcap to enable).

Scout

Used: risk HIGH, evidence HIGH, status COMPLETE (scout 0.9.130, 1s).
Cross-file leads given to reviewers: 0 changed symbol(s) with uses outside the diff, 0 new value(s) not handled everywhere, 0 possibly unused symbol(s).

Tests to run (Scout: 112 Must Run test(s), in these files):

• CMakePresets.json
  Scout left 111 affected-test entries out of its packet; for the full list run scout affected-tests -r 'D:/repos/github.com/stlab/stlab-execution' -s compare -b 40635e11a5f4ca6928b555d58240e0be1e92d3a0.

[sean-parent]

Local Talos review — complete

Verdict: No new validated findings. This is a comment review, not an approval.

Scope: Full #1 diff at 935d11bdc8e081795b9d2f7f74f26e2bb6ade93c against merge-base 40635e11a5f4ca6928b555d58240e0be1e92d3a0 (main): 98 changed files, 10,167 diff lines, 397,789 bytes. Every baseline persona consumed the complete verbatim diff. Finding targets: 91 non-generated files; seven generated outputs were context-only exclusions. Large changeset — domain analysis prioritized critical contracts within the fully consumed diff.

Reviewers: Security/correctness (Opus 5.5); standards/architecture/operations/documentation (Sonnet 5.5); independent challenge (Opus 5.5). No i18n eligibility, active OpenSpec, base-owned rule files, or applicable GitHub custom instructions.

Challenge: Three candidates validated; zero accepted, zero posted inline, zero overflow/latent risks. Rejected Qt receiver-allocation concern: the cited zero-wrapper statement belongs to a different backend, and no all-backend zero-allocation contract or measured regression was established. Rejected executor submission-wrapper extraction: the wrappers agree, no behavioral defect was shown, and it repeats the already-declined timer-wrapper consolidation rationale; no duplicate thread was created. Rejected thread-name namespace concern: the claimed collision was not established under the documented non-overlapping header sets, single runtime, and rebuild-all-consumers contract.

Received findings: Obsolete Node example and unused Boost configuration removed in 3fa7856; actual compiler/linker flags retained. Optional timer-wrapper extraction deliberately declined after verification. The newly published private-header guard consistency finding was fixed in 935d11b.

Verification and limits: Actual Emscripten SDK build plus four targeted configuration checks covered the toolchain cleanup. The mechanical header change was rebuilt with MSVC/GCC and covered by the focused MSVC waiter test and 26 relevant Linux executor/waiter checks. Exact-head CI run 37687337106 succeeded. Persona analysis itself was static, not a fresh all-platform runtime or dependency audit; Qt runtime behavior was not exercised. Generated toolkit outputs were not finding targets. Scout warned about 34 conservative whole-file roots and omitted 111 affected-test entries; its recommendations do not imply those tests were all run. Challenge history used an earlier receive snapshot, so live thread resolution state is verified separately at publication.

Persona routing: static roster (DCAP routing off; rerun with --dcap to enable).

Scout

Used: risk HIGH, evidence HIGH, status COMPLETE (scout 0.9.130, 1s).
Cross-file leads given to reviewers: 0 changed symbol(s) with uses outside the diff, 0 new value(s) not handled everywhere, 0 possibly unused symbol(s).

Tests to run (Scout: 112 Must Run test(s), in these files):

• CMakePresets.json
  Scout left 111 affected-test entries out of its packet; for the full list run scout affected-tests -r 'D:/repos/github.com/stlab/stlab-execution' -s compare -b 40635e11a5f4ca6928b555d58240e0be1e92d3a0.

[sean-parent]

Talos incremental review

Verdict: No new validated findings in the requested increment.

Reviewed SHA: 128754038da00a21c110c8ee79affd5751211aab

Scope: Changes since the latest published review at 935d11bdc8e081795b9d2f7f74f26e2bb6ade93c through the reviewed SHA: 20 changed files, 876 insertions and 98 deletions. The PR's actual base branch is main; this is an incremental review requested by the author, not a new review of the entire 104-file PR. Unchanged code was inspected as context where relevant.

Reviewed by: Security, correctness, standards, architecture, operations and documentation personas, followed by the required challenge reviewer.

Counts: 0 candidate observations; 0 accepted findings; 0 new inline comments; 0 body-only findings; 0 overflow; 0 duplicate findings suppressed; 0 recurrences. The accepted set contains no findings to duplicate against the 36 existing inline comments. Existing discussions are unchanged; no threads were resolved and this review does not approve the PR.

Coverage and verification limitations: Persona review was static; no new builds, runtime tests or sanitizers were executed as part of this review. Earlier implementation verification passed 109 targeted test invocations across native portable Windows, Windows timers, real Swift libdispatch, Linux/Qt and both Emscripten modes. The existing pthread-enabled execution.test.emscripten_timer failure (calling pre_exit() from a native callback) was separately reproduced on the implementation baseline 1b6830b and remains unchanged. Scout used conservative whole-file roots for seven changed files, omitted one cross-file lead group, and omitted affected-test details. This is not exhaustive whole-PR or whole-repository coverage.

Project context: No project rule files were found at the incremental base revision; the newly added CLAUDE.md was reviewed as changed content rather than enforced retroactively. GitHub custom instructions: 0 loaded, no diagnostics. No active OpenSpec context.

Persona routing: static roster (DCAP routing off; rerun with --dcap to enable).

Scout

Used: risk HIGH, evidence LOW, status COMPLETE (scout 0.9.130, 1s).
Cross-file leads given to reviewers: 6 changed symbol(s) with uses outside the diff, 0 new value(s) not handled everywhere, 0 possibly unused symbol(s).
Scout rated its evidence LOW for this change; reviewers used it only as leads.

Tests to run (Scout: 76 Must Run test(s)):
Scout left 76 affected-test entries out of its packet; for the full list run scout affected-tests -r 'D:/repos/github.com/stlab/stlab-execution' -s compare -b 935d11bdc8e081795b9d2f7f74f26e2bb6ade93c.