[djh58]

Fixes what is blocking #233: Core Checks' build smoke job has timed out on every attempt on its head, 529e19f. Everything else in #233's CI passed.

Cause. The job installs about 240 MB of packages on every run: its build dependencies, plus the cross compilers, qemu and Clang that the ML-KEM build-policy test needs (#225). Hosted runners fetch packages from the Azure mirror of their own region first. The westus3 mirror served packages at about 30 kB/s while other regions served the same packages at 40 MB/s:

Run	Job	Region	Build dependencies (24.9 MB)
#233, Core Checks attempt 1	build smoke	westus3	11 min 47 s, then timed out in the toolchain install
#233, same run	focused unit suites	centralus	1 s
#233, attempts 2 and 3	build smoke	westus3	8 min 41 s, then timed out; timed out
1.x.x push after #252	build smoke	westus3	9 min 52 s (17.9 MB)
#252	build smoke	eastus2	1 s

1.x.x's job still passed because it has no toolchain install. apt moves to the next mirror only when a download fails, not when it is slow.

Fix.

• Mirror order: try the main Ubuntu archive first. The regional mirror stays in the list as the last fallback. The change edits the runner's mirror list only if it exists.
• Package cache: keep the downloaded packages between runs. apt reuses a cached package of the expected size without checking its hash; I checked this with apt 3.2 and a modified package. So only push runs save the cache, as with the ccache caches, and a pull request can't change what another run installs.
• Time limit: 45 → 90 minutes, so that a run that misses the cache can still finish on a slower mirror.

Tests run.

• The mirror-list rewrite, on a copy of the runner's list. It is 144 bytes, the size the runner logs show. The regional mirror's priority becomes 9 and the other entries are unchanged.
• The workflow contract tests in ci/checks all pass:
  • test_classify_merge_profile (31 tests);
  • test_ibd_timeout_wiring (7, 2 skipped);
  • test_pq_merge_gate_contract (17);
  • test_ci_pq_contract (29);
  • test_merge_gate_poller (44).
• actionlint 1.7.12, with shellcheck: clean.
• zizmor 1.31.1, offline audits: the same 8 findings as before the change, none new.
• Not run: the job itself on a hosted runner. Hybrid post-quantum v2 transport (#184) — integration #233's CI runs it once this merges. Since ci: stop validating feature/pq-transport by name #245, pull requests into feature/pq-transport don't run CI.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[djh58]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T16:43:28.270575Z	2a8c92a	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[qbit-reviewer]

Reviewed at 2a8c92a: 0 findings shared privately with maintainers.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 2a8c92a2bb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".