devlyn-cli 2.9.3 → 2.10.1

package/config/skills/_shared/spec-verify-check.py

@@ -260,13 +260,19 @@ EXPECTED_TOP_LEVEL_KEYS = {
 EXPECTED_VERIFICATION_COMMAND_KEYS = {
     "cmd",
     "exit_code",
+    "timeout_sec",
     "stdout_contains",
     "stdout_not_contains",
     "contract_refs",
 }
+DEFAULT_TIMEOUT_SEC = 60
 SPEC_COMPLEXITY_VALUES = {"trivial", "medium", "high", "large"}
 
 
+def verification_timeout_sec(command: dict) -> int:
+    return command.get("timeout_sec", DEFAULT_TIMEOUT_SEC)
+
+
 def extract_verification_block(text: str) -> tuple[bool, str | None]:
     """Locate the verification section via the `<!-- devlyn:verification -->`
     sentinel (language-neutral — the human-readable heading after it may be
@@ -579,10 +585,12 @@ def validate_shape(data) -> str | None:
     Schema (iter-0019.8): top-level object with a non-empty
     `verification_commands` list of objects. Each object requires a
     non-empty string `cmd`; `exit_code` defaults to 0 and must be a
-    non-bool int; `stdout_contains` and `stdout_not_contains` default to
-    empty list and must be lists of strings. Bool is rejected explicitly
-    because Python's `bool` subclasses `int` — `isinstance(True, int) is
-    True` would otherwise let `exit_code: true` slip through.
+    non-bool int; `timeout_sec` defaults to DEFAULT_TIMEOUT_SEC and must be a
+    non-bool int from 1 through 600; `stdout_contains` and
+    `stdout_not_contains` default to empty list and must be lists of strings.
+    Bool is rejected explicitly because Python's `bool` subclasses `int` —
+    `isinstance(True, int) is True` would otherwise let numeric fields accept
+    true.
     """
     if not isinstance(data, dict):
         return "top-level must be a JSON object"
@@ -600,6 +608,13 @@ def validate_shape(data) -> str | None:
         ec = c.get("exit_code", 0)
         if isinstance(ec, bool) or not isinstance(ec, int):
             return f"verification_commands[{i}].exit_code must be int (not bool)"
+        timeout_sec = c.get("timeout_sec", DEFAULT_TIMEOUT_SEC)
+        if (
+            isinstance(timeout_sec, bool)
+            or not isinstance(timeout_sec, int)
+            or not 1 <= timeout_sec <= 600
+        ):
+            return f"verification_commands[{i}].timeout_sec must be int from 1 to 600 (not bool)"
         for k in ("stdout_contains", "stdout_not_contains"):
             v = c.get(k, [])
             if not isinstance(v, list) or not all(isinstance(s, str) for s in v):
@@ -810,7 +825,7 @@ def validate_risk_probe(
         if not isinstance(actual, list) or not all(isinstance(item, str) for item in actual):
             return f"risk-probes[{index}].tag_evidence.shape_contract must be a list of strings"
         required_shape = set(SHAPE_CONTRACT_REQUIRED_EVIDENCE)
-        if {"error_contract", "http_error_contract"} & set(tags):
+        if "visible_text_names_exact_json_error_object" in set(actual):
             required_shape.add("asserts_exact_error_object")
         missing_shape = sorted(required_shape - set(actual))
         if missing_shape:
@@ -1738,6 +1753,13 @@ def run_check_expected_mode(expected_path: Path) -> int:
 
 
 def run_self_test() -> int:
+    # Hermeticity: a pipeline replay exports BENCH_WORKDIR at the live repo;
+    # inherited into scenario children it wins over their tmp cwd (the
+    # default-mode work resolution below) and re-executes the LIVE
+    # .devlyn/spec-verify.json — with lint as the live command this mutually
+    # recursed (lint runs this self-test) into an unbounded spawn storm
+    # (observed 2026-08-03, iter-0089 canary).
+    os.environ.pop("BENCH_WORKDIR", None)
     script_path = str(Path(__file__).resolve())
     with tempfile.TemporaryDirectory() as td:
         work = Path(td)
@@ -1762,6 +1784,7 @@ def run_self_test() -> int:
             "derived_from": "probe must pass visible marker.",
             "cmd": "python3 .devlyn/probes/P1.py",
             "exit_code": 0,
+            "timeout_sec": 5,
             "stdout_contains": ["probe-ok"],
             "stdout_not_contains": [],
             "tags": ["shape_contract"],
@@ -1774,6 +1797,211 @@ def run_self_test() -> int:
             },
         }
         (devlyn / "risk-probes.jsonl").write_text(json.dumps(risk_probe_payload) + "\n")
+        loaded_probes, loaded_probe_error = load_risk_probes(
+            devlyn, spec_md, require_present=True
+        )
+        if loaded_probe_error or loaded_probes[0].get("timeout_sec") != 5:
+            print("risk-probe timeout_sec was not preserved", file=sys.stderr)
+            print(loaded_probe_error, file=sys.stderr)
+            return 1
+
+        if verification_timeout_sec({"cmd": "printf default"}) != DEFAULT_TIMEOUT_SEC:
+            print("absent timeout_sec did not resolve to DEFAULT_TIMEOUT_SEC", file=sys.stderr)
+            return 1
+
+        inline_timeout_spec = work / "inline-timeout-spec.md"
+        inline_timeout_devlyn = work / "inline-timeout-devlyn"
+        for invalid_timeout in (True, 0, -1, 601, "60"):
+            inline_timeout_spec.write_text(
+                "# Timeout validation\n\n<!-- devlyn:verification -->\n## Verification\n\n```json\n"
+                + json.dumps({
+                    "verification_commands": [
+                        {"cmd": "printf ok", "timeout_sec": invalid_timeout}
+                    ]
+                })
+                + "\n```\n",
+                encoding="utf-8",
+            )
+            staged, inline_error = stage_from_source(
+                inline_timeout_spec, inline_timeout_devlyn
+            )
+            if staged or not inline_error or "timeout_sec" not in inline_error:
+                print(
+                    f"inline carrier accepted invalid timeout_sec={invalid_timeout!r}",
+                    file=sys.stderr,
+                )
+                return 1
+
+        inline_timeout_spec.write_text(
+            "# Timeout preservation\n\n<!-- devlyn:verification -->\n## Verification\n\n```json\n"
+            + json.dumps({
+                "verification_commands": [
+                    {"cmd": "printf ok", "timeout_sec": 5}
+                ]
+            })
+            + "\n```\n",
+            encoding="utf-8",
+        )
+        staged, inline_error = stage_from_source(
+            inline_timeout_spec, inline_timeout_devlyn
+        )
+        inline_staged = loads_strict_json(
+            (inline_timeout_devlyn / "spec-verify.json").read_text()
+        )
+        if (
+            not staged
+            or inline_error
+            or inline_staged["verification_commands"][0].get("timeout_sec") != 5
+        ):
+            print("inline carrier did not preserve timeout_sec", file=sys.stderr)
+            return 1
+
+        sibling_timeout_root = work / "sibling-timeout"
+        sibling_timeout_root.mkdir()
+        sibling_timeout_devlyn = sibling_timeout_root / ".devlyn"
+        sibling_timeout_spec = sibling_timeout_root / "spec.md"
+        sibling_timeout_spec.write_text("# Sibling timeout\n", encoding="utf-8")
+        sibling_timeout_expected = sibling_timeout_root / "spec.expected.json"
+        for invalid_timeout in (True, 601):
+            sibling_timeout_expected.write_text(json.dumps({
+                "verification_commands": [
+                    {"cmd": "printf ok", "timeout_sec": invalid_timeout}
+                ]
+            }) + "\n")
+            found, staged, sibling_error, _path, _data = stage_from_expected(
+                sibling_timeout_spec, sibling_timeout_devlyn
+            )
+            if not found or staged or not sibling_error or "timeout_sec" not in sibling_error:
+                print(
+                    f"sibling carrier accepted invalid timeout_sec={invalid_timeout!r}",
+                    file=sys.stderr,
+                )
+                return 1
+
+        sibling_timeout_expected.write_text(json.dumps({
+            "verification_commands": [
+                {"cmd": "printf ok", "timeout_sec": 5}
+            ]
+        }) + "\n")
+        found, staged, sibling_error, _path, _data = stage_from_expected(
+            sibling_timeout_spec, sibling_timeout_devlyn
+        )
+        sibling_staged = loads_strict_json(
+            (sibling_timeout_devlyn / "spec-verify.json").read_text()
+        )
+        if (
+            not found
+            or not staged
+            or sibling_error
+            or sibling_staged["verification_commands"][0].get("timeout_sec") != 5
+        ):
+            print("sibling carrier did not preserve timeout_sec", file=sys.stderr)
+            return 1
+
+        timeout_run_root = work / "timeout-run"
+        timeout_run_root.mkdir()
+        timeout_run_devlyn = timeout_run_root / ".devlyn"
+        timeout_run_devlyn.mkdir()
+        timeout_run_spec = timeout_run_root / "spec.md"
+        timeout_run_spec.write_text(
+            "# Timeout execution\n\n<!-- devlyn:verification -->\n## Verification\n\n```json\n"
+            + json.dumps({
+                "verification_commands": [
+                    {
+                        "cmd": "python3 -c \"import time; time.sleep(2)\"",
+                        "timeout_sec": 1,
+                    },
+                    {
+                        "cmd": "python3 -c \"import time; time.sleep(1)\"",
+                        "timeout_sec": 5,
+                    },
+                ]
+            })
+            + "\n```\n",
+            encoding="utf-8",
+        )
+        (timeout_run_devlyn / "pipeline.state.json").write_text(json.dumps({
+            "source": {"type": "spec", "spec_path": str(timeout_run_spec)}
+        }))
+        timeout_run = subprocess.run(
+            [sys.executable, script_path],
+            cwd=timeout_run_root,
+            capture_output=True,
+            text=True,
+        )
+        if timeout_run.returncode == 0:
+            print("declared one-second timeout did not fail", file=sys.stderr)
+            return 1
+        timeout_results = loads_strict_json(
+            (timeout_run_devlyn / "spec-verify.results.json").read_text()
+        )["commands"]
+        timeout_findings = [
+            loads_strict_json(line)
+            for line in (timeout_run_devlyn / output_findings_name()).read_text().splitlines()
+            if line.strip()
+        ]
+        if (
+            timeout_results[0].get("reason") != "timeout"
+            or timeout_results[0].get("timeout_sec") != 1
+            or not timeout_results[1].get("pass")
+        ):
+            print("declared timeout budgets were not honored", file=sys.stderr)
+            print(timeout_results, file=sys.stderr)
+            return 1
+        timeout_finding = timeout_findings[0] if timeout_findings else {}
+        if (
+            timeout_finding.get("rule_id") != "correctness.verification-timeout"
+            or "after 1s" not in timeout_finding.get("message", "")
+            or "timeout_sec" not in timeout_finding.get("message", "")
+            or "600" not in timeout_finding.get("fix_hint", "")
+        ):
+            print("timeout finding did not carry the distinct budget contract", file=sys.stderr)
+            print(timeout_finding, file=sys.stderr)
+            return 1
+
+        runner_env_root = work / "runner-env-isolation"
+        runner_env_root.mkdir()
+        runner_env_devlyn = runner_env_root / ".devlyn"
+        runner_env_devlyn.mkdir()
+        runner_env_spec = runner_env_root / "spec.md"
+        runner_env_spec.write_text(
+            "# Runner environment isolation\n\n<!-- devlyn:verification -->\n"
+            "## Verification\n\n```json\n"
+            + json.dumps({
+                "verification_commands": [{
+                    "cmd": (
+                        "python3 -c \"import os, sys; sys.exit(any(name in os.environ "
+                        "for name in ('SPEC_VERIFY_PHASE', 'SPEC_VERIFY_FINDINGS_FILE', "
+                        "'SPEC_VERIFY_FINDING_PREFIX')))\""
+                    )
+                }]
+            })
+            + "\n```\n",
+            encoding="utf-8",
+        )
+        (runner_env_devlyn / "pipeline.state.json").write_text(json.dumps({
+            "source": {"type": "spec", "spec_path": str(runner_env_spec)}
+        }))
+        runner_env = os.environ.copy()
+        runner_env.update({
+            "SPEC_VERIFY_PHASE": "verify_mechanical",
+            "SPEC_VERIFY_FINDINGS_FILE": "runner-env.findings.jsonl",
+            "SPEC_VERIFY_FINDING_PREFIX": "RUNNER-ENV",
+        })
+        runner_env_run = subprocess.run(
+            [sys.executable, script_path],
+            cwd=runner_env_root,
+            env=runner_env,
+            capture_output=True,
+            text=True,
+        )
+        runner_env_results = loads_strict_json(
+            (runner_env_devlyn / "spec-verify.results.json").read_text()
+        )["commands"]
+        if runner_env_run.returncode != 0 or not runner_env_results[0].get("pass"):
+            print("runner-directed environment leaked into a verification command", file=sys.stderr)
+            print(runner_env_run.stderr, file=sys.stderr)
+            return 1
         env = os.environ.copy()
         env["BENCH_WORKDIR"] = str(work)
         validate_without_digest = subprocess.run(
@@ -1830,7 +2058,7 @@ def run_self_test() -> int:
         if mutated_script.returncode == 0:
             print("--include-risk-probes accepted mutated probe script bytes", file=sys.stderr)
             return 1
-        integrity_findings = (devlyn / "spec-verify-findings.jsonl").read_text(encoding="utf-8")
+        integrity_findings = (devlyn / output_findings_name()).read_text(encoding="utf-8")
         if "correctness.risk-probe-integrity" not in integrity_findings:
             print("mutated probe script did not emit correctness.risk-probe-integrity", file=sys.stderr)
             print(integrity_findings, file=sys.stderr)
@@ -1850,7 +2078,7 @@ def run_self_test() -> int:
         if mutated_jsonl.returncode == 0:
             print("--include-risk-probes accepted mutated risk-probes.jsonl bytes", file=sys.stderr)
             return 1
-        integrity_findings = (devlyn / "spec-verify-findings.jsonl").read_text(encoding="utf-8")
+        integrity_findings = (devlyn / output_findings_name()).read_text(encoding="utf-8")
         if "correctness.risk-probe-integrity" not in integrity_findings:
             print("mutated risk-probes.jsonl did not emit correctness.risk-probe-integrity", file=sys.stderr)
             print(integrity_findings, file=sys.stderr)
@@ -1871,7 +2099,7 @@ def run_self_test() -> int:
         if missing_digest.returncode == 0:
             print("--include-risk-probes accepted enabled risk probes with missing digest", file=sys.stderr)
             return 1
-        integrity_findings = (devlyn / "spec-verify-findings.jsonl").read_text(encoding="utf-8")
+        integrity_findings = (devlyn / output_findings_name()).read_text(encoding="utf-8")
         if "correctness.risk-probe-integrity" not in integrity_findings:
             print("missing risk_probes_digest did not emit correctness.risk-probe-integrity", file=sys.stderr)
             print(integrity_findings, file=sys.stderr)
@@ -3132,7 +3360,7 @@ def run_self_test() -> int:
         if contract_run.returncode == 0:
             print("expected contract violations were accepted", file=sys.stderr)
             return 1
-        findings_text = (contract_devlyn / "spec-verify-findings.jsonl").read_text()
+        findings_text = (contract_devlyn / output_findings_name()).read_text()
         for rule_id in (
             "correctness.forbidden-pattern",
             "correctness.required-file-missing",
@@ -3169,7 +3397,8 @@ def run_self_test() -> int:
         error_spec = error_root / "spec.md"
         error_spec.write_text(
             "# Spec\n\n<!-- devlyn:verification -->\n## Verification\n\n"
-            "- Invalid input must print a JSON error object to stderr and exit 2.\n"
+            "- Invalid input must print JSON error object `{ \"error\": \"bad_input\" }` to stderr and exit 2.\n"
+            "- Malformed input must exit 2 and print stderr JSON with keys `code` and `detail`; values are implementation-defined.\n"
         )
         (error_devlyn / "pipeline.state.json").write_text(json.dumps({
             "source": {"type": "spec", "spec_path": str(error_spec)}
@@ -3221,7 +3450,7 @@ def run_self_test() -> int:
 
         (error_devlyn / "risk-probes.jsonl").write_text(json.dumps({
             "id": "P7c",
-            "derived_from": "Invalid input must print a JSON error object to stderr and exit 2.",
+            "derived_from": "Invalid input must print JSON error object `{ \"error\": \"bad_input\" }` to stderr and exit 2.",
             "cmd": "printf json-error-shape-contract-missing-exact",
             "exit_code": 2,
             "tags": ["stdout_stderr_contract", "error_contract", "shape_contract"],
@@ -3235,6 +3464,7 @@ def run_self_test() -> int:
                     "uses_visible_input_key_names",
                     "asserts_visible_output_key_names",
                     "asserts_no_unexpected_output_keys",
+                    "visible_text_names_exact_json_error_object",
                 ],
             },
         }) + "\n")
@@ -3246,7 +3476,7 @@ def run_self_test() -> int:
         )
         if missing_exact_error_object.returncode == 0:
             print(
-                "shape_contract co-occurring with error_contract without "
+                "shape_contract claiming visible exact error object without "
                 "asserts_exact_error_object was accepted",
                 file=sys.stderr,
             )
@@ -3254,7 +3484,7 @@ def run_self_test() -> int:
 
         (error_devlyn / "risk-probes.jsonl").write_text(json.dumps({
             "id": "P7d",
-            "derived_from": "Invalid input must print a JSON error object to stderr and exit 2.",
+            "derived_from": "Invalid input must print JSON error object `{ \"error\": \"bad_input\" }` to stderr and exit 2.",
             "cmd": "printf json-error-shape-contract",
             "exit_code": 2,
             "tags": ["stdout_stderr_contract", "error_contract", "shape_contract"],
@@ -3268,6 +3498,7 @@ def run_self_test() -> int:
                     "uses_visible_input_key_names",
                     "asserts_visible_output_key_names",
                     "asserts_no_unexpected_output_keys",
+                    "visible_text_names_exact_json_error_object",
                     "asserts_exact_error_object",
                 ],
             },
@@ -3283,6 +3514,38 @@ def run_self_test() -> int:
             print(strong_json_error_shape_contract.stderr, file=sys.stderr)
             return 1
 
+        (error_devlyn / "risk-probes.jsonl").write_text(json.dumps({
+            "id": "P7e",
+            "derived_from": (
+                "Malformed input must exit 2 and print stderr JSON with keys `code` and `detail`; "
+                "values are implementation-defined."
+            ),
+            "cmd": "printf error-exit-shape-contract",
+            "exit_code": 2,
+            "tags": ["error_contract", "shape_contract"],
+            "tag_evidence": {
+                "error_contract": [
+                    "asserts_error_payload_or_stderr",
+                    "asserts_nonzero_or_exit_2",
+                ],
+                "shape_contract": [
+                    "uses_visible_input_key_names",
+                    "asserts_visible_output_key_names",
+                    "asserts_no_unexpected_output_keys",
+                ],
+            },
+        }) + "\n")
+        error_exit_shape_contract = subprocess.run(
+            [sys.executable, script_path, "--validate-risk-probes"],
+            cwd=error_root,
+            capture_output=True,
+            text=True,
+        )
+        if error_exit_shape_contract.returncode != 0:
+            print("error-exit shape_contract without visible exact error object was rejected", file=sys.stderr)
+            print(error_exit_shape_contract.stderr, file=sys.stderr)
+            return 1
+
         http_error_root = work / "http-error-contract-risk-probe"
         http_error_root.mkdir()
         http_error_devlyn = http_error_root / ".devlyn"
@@ -3336,6 +3599,7 @@ def run_self_test() -> int:
                     "uses_visible_input_key_names",
                     "asserts_visible_output_key_names",
                     "asserts_no_unexpected_output_keys",
+                    "visible_text_names_exact_json_error_object",
                 ],
             },
         }) + "\n")
@@ -3367,6 +3631,7 @@ def run_self_test() -> int:
                     "uses_visible_input_key_names",
                     "asserts_visible_output_key_names",
                     "asserts_no_unexpected_output_keys",
+                    "visible_text_names_exact_json_error_object",
                     "asserts_exact_error_object",
                 ],
             },
@@ -3670,12 +3935,15 @@ def run_self_test() -> int:
             print("--write-untracked-baseline wrote wrong content", file=sys.stderr)
             print(repr(baseline_lines), file=sys.stderr)
             return 1
-        scope_findings_path = scope_devlyn / "spec-verify-findings.jsonl"
+        scope_findings_path = scope_devlyn / output_findings_name()
+        scope_build_gate_env = os.environ.copy()
+        scope_build_gate_env["SPEC_VERIFY_PHASE"] = "build_gate"
 
         # Test 1: no .devlyn/plan.md at all -> fail-closed CRITICAL, not a no-op.
         (scope_root / "bin" / "cli.js").write_text("module.exports = { ok: true };\n")
         missing_plan_run = subprocess.run(
-            [sys.executable, script_path], cwd=scope_root, capture_output=True, text=True,
+            [sys.executable, script_path], cwd=scope_root, env=scope_build_gate_env,
+            capture_output=True, text=True,
         )
         if missing_plan_run.returncode == 0:
             print("BUILD_GATE accepted a run with no plan.md", file=sys.stderr)
@@ -3689,7 +3957,8 @@ def run_self_test() -> int:
             "# PLAN\n\n<!-- devlyn:authorized-surface -->\n## 1. Files to touch\n\n- `bin/cli.js` (edit): ship the fix.\n"
         )
         malformed_block_run = subprocess.run(
-            [sys.executable, script_path], cwd=scope_root, capture_output=True, text=True,
+            [sys.executable, script_path], cwd=scope_root, env=scope_build_gate_env,
+            capture_output=True, text=True,
         )
         if malformed_block_run.returncode == 0:
             print("BUILD_GATE accepted plan.md with no authorized_surface block", file=sys.stderr)
@@ -3734,7 +4003,8 @@ def run_self_test() -> int:
             return 1
         (scope_devlyn / "untracked.baseline").unlink()
         missing_baseline_run = subprocess.run(
-            [sys.executable, script_path], cwd=scope_root, capture_output=True, text=True,
+            [sys.executable, script_path], cwd=scope_root, env=scope_build_gate_env,
+            capture_output=True, text=True,
         )
         if missing_baseline_run.returncode == 0:
             print("BUILD_GATE accepted missing .devlyn/untracked.baseline", file=sys.stderr)
@@ -3750,7 +4020,8 @@ def run_self_test() -> int:
             print("--write-untracked-baseline re-run failed", file=sys.stderr)
             return 1
         in_scope_run = subprocess.run(
-            [sys.executable, script_path], cwd=scope_root, capture_output=True, text=True,
+            [sys.executable, script_path], cwd=scope_root, env=scope_build_gate_env,
+            capture_output=True, text=True,
         )
         if in_scope_run.returncode != 0:
             print("in-scope-only diff was rejected", file=sys.stderr)
@@ -3767,7 +4038,8 @@ def run_self_test() -> int:
         (scope_root / "data" / "usage-stats.json").write_text('{"leaked": true}\n')
         (scope_root / "data" / "scratch.json").write_text('{"untracked": true}\n')
         out_of_scope_run = subprocess.run(
-            [sys.executable, script_path], cwd=scope_root, capture_output=True, text=True,
+            [sys.executable, script_path], cwd=scope_root, env=scope_build_gate_env,
+            capture_output=True, text=True,
         )
         if out_of_scope_run.returncode == 0:
             print("out-of-scope file was accepted", file=sys.stderr)
@@ -3803,7 +4075,8 @@ def run_self_test() -> int:
         # (directory-prefix boundary, not a bare string-prefix match).
         (scope_root / "lib2" / "keep.js").write_text("module.exports = { touched: true };\n")
         subprocess.run(
-            [sys.executable, script_path], cwd=scope_root, capture_output=True, text=True,
+            [sys.executable, script_path], cwd=scope_root, env=scope_build_gate_env,
+            capture_output=True, text=True,
         )
         boundary_flagged = {
             loads_strict_json(line)["file"]
@@ -4100,6 +4373,12 @@ def main() -> int:
     findings_path = devlyn_dir / output_findings_name()
 
     verify_env = os.environ.copy()
+    for runner_key in (
+        "SPEC_VERIFY_PHASE",
+        "SPEC_VERIFY_FINDINGS_FILE",
+        "SPEC_VERIFY_FINDING_PREFIX",
+    ):
+        verify_env.pop(runner_key, None)
     verify_env["BENCH_WORKDIR"] = str(work)
 
     results: list[dict] = []
@@ -4117,6 +4396,7 @@ def main() -> int:
         expected_exit = vc.get("exit_code", 0)
         stdout_contains = vc.get("stdout_contains", []) or []
         stdout_not_contains = vc.get("stdout_not_contains", []) or []
+        timeout_sec = verification_timeout_sec(vc)
 
         try:
             proc = subprocess.run(
@@ -4126,7 +4406,7 @@ def main() -> int:
                 env=verify_env,
                 capture_output=True,
                 text=True,
-                timeout=60,
+                timeout=timeout_sec,
             )
             # Mirror run-fixture.sh post-run verifier: combined stdout+stderr.
             out = (proc.stdout or "") + (proc.stderr or "")
@@ -4226,20 +4506,16 @@ def main() -> int:
 
         except subprocess.TimeoutExpired:
             results.append({"index": idx, "cmd": cmd, "pass": False,
-                            "reason": "timeout"})
-            rule_id = (
-                "correctness.risk-probe-failed"
-                if vc.get("_risk_probe")
-                else "correctness.spec-literal-mismatch"
-            )
+                            "reason": "timeout", "timeout_sec": timeout_sec})
             findings.append({
                 "id": f"{output_finding_prefix()}-{finding_seq:04d}",
-                "rule_id": rule_id,
+                "rule_id": "correctness.verification-timeout",
                 "level": "error",
                 "severity": "CRITICAL",
                 "confidence": 1.0,
                 "message": (
-                    f"Verification command #{idx + 1} timed out after 60s."
+                    f"Verification command #{idx + 1} timed out after {timeout_sec}s "
+                    f"(timeout_sec={timeout_sec}, maximum 600)."
                 ),
                 "file": ".devlyn/risk-probes.jsonl" if vc.get("_risk_probe") else ".devlyn/spec-verify.json",
                 "line": 1,
@@ -4250,8 +4526,9 @@ def main() -> int:
                     else f"spec-verify://verification_commands/{idx}"
                 ),
                 "fix_hint": (
-                    f"Command `{cmd}` exceeded 60s. Reduce work or fix a "
-                    f"hang in the implementation."
+                    f"Command `{cmd}` exceeded its {timeout_sec}s timeout_sec budget. "
+                    "Increase timeout_sec up to 600 when the verification legitimately "
+                    "needs more time, or fix a hang in the implementation."
                 ),
                 "blocking": True,
                 "status": "open",