From 2784cef4d797cc8a36791010829c178b768a32b1 Mon Sep 17 00:00:00 2001
From: Henry Park <henrypark133@gmail.com>
Date: Mon, 16 Mar 2026 22:29:41 -0700
Subject: [PATCH] fix: relax timing thresholds in policy adversarial tests
 (100ms -> 500ms) (#1294)

These tests guard against catastrophic regex backtracking (seconds/minutes),
not 12ms differences. CI runners with coverage instrumentation (cargo-llvm-cov)
consistently exceed the 100ms threshold due to overhead, causing flaky failures.
500ms still catches real regressions while tolerating CI variability.

[skip-regression-check]

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 crates/ironclaw_safety/src/policy.rs | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/crates/ironclaw_safety/src/policy.rs b/crates/ironclaw_safety/src/policy.rs
index f731d687..d1784b98 100644
--- a/crates/ironclaw_safety/src/policy.rs
+++ b/crates/ironclaw_safety/src/policy.rs
@@ -324,7 +324,7 @@ mod tests {
             let violations = policy.check(&payload);
             let elapsed = start.elapsed();
             assert!(
-                elapsed.as_millis() < 100,
+                elapsed.as_millis() < 500,
                 "excessive_urls pattern took {}ms on 100KB near-miss",
                 elapsed.as_millis()
             );
@@ -349,7 +349,7 @@ mod tests {
             let violations = policy.check(&payload);
             let elapsed = start.elapsed();
             assert!(
-                elapsed.as_millis() < 100,
+                elapsed.as_millis() < 500,
                 "obfuscated_string pattern took {}ms on 100KB near-miss",
                 elapsed.as_millis()
             );
@@ -370,7 +370,7 @@ mod tests {
             let _violations = policy.check(&payload);
             let elapsed = start.elapsed();
             assert!(
-                elapsed.as_millis() < 100,
+                elapsed.as_millis() < 500,
                 "shell_injection pattern took {}ms on 100KB near-miss",
                 elapsed.as_millis()
             );
@@ -387,7 +387,7 @@ mod tests {
             let _violations = policy.check(&payload);
             let elapsed = start.elapsed();
             assert!(
-                elapsed.as_millis() < 100,
+                elapsed.as_millis() < 500,
                 "sql_pattern took {}ms on 100KB near-miss",
                 elapsed.as_millis()
             );
@@ -405,7 +405,7 @@ mod tests {
             let _violations = policy.check(&payload);
             let elapsed = start.elapsed();
             assert!(
-                elapsed.as_millis() < 100,
+                elapsed.as_millis() < 500,
                 "crypto_private_key pattern took {}ms on 100KB near-miss",
                 elapsed.as_millis()
             );
@@ -423,7 +423,7 @@ mod tests {
             let _violations = policy.check(&payload);
             let elapsed = start.elapsed();
             assert!(
-                elapsed.as_millis() < 100,
+                elapsed.as_millis() < 500,
                 "system_file_access pattern took {}ms on 100KB near-miss",
                 elapsed.as_millis()
             );
@@ -441,7 +441,7 @@ mod tests {
             let _violations = policy.check(&payload);
             let elapsed = start.elapsed();
             assert!(
-                elapsed.as_millis() < 100,
+                elapsed.as_millis() < 500,
                 "encoded_exploit pattern took {}ms on 100KB near-miss",
                 elapsed.as_millis()
             );