Parse saved CI log groups without quadratic open-group searches #1027

Reported concern

The parser searches the complete open-group list for every log line while allowing supplied opening records to grow that list. Consequently, a modest saved log can require quadratic CPU work and stall offline collection.

Evidence

• Source/control: Saved per-job log text selected through --log-dir or supplied through CollectorInputs.logs.
• Sink/decision: The membership test for Runner Image in the growing groups list.
• Missing mitigation: The parser recomputes group membership by scanning an attacker-sized list. Neither log ingestion nor group tracking supplies an effective work or nesting bound.

Suggested remediation

Track the number of active Runner Image groups as groups open and close, making membership checks constant time. Add a nesting limit to bound retained parser state.

Report provenance

• Finding ID: d11461c8-cc3d-4102-96c1-be7fb7cc87a7
• Fingerprint: 717018018919392c926c7c9d1cd3197d11bfabe362e961d923950f72ab73e977
• Reported severity: low (CWE-407).
• Reported location: scripts/ci_test_evidence_logs.py:149-149.
• Reported revision: e52d3ef49429392eebeb484aa4d6622ca79782dd.

Acceptance criteria

• Add a focused regression test for the reported trigger and affected operation before fixing it.
• Implement the remediation so the reported unsafe behaviour is rejected or safely bounded, while preserving supported inputs.
• Exercise the relevant integration or behavioural path and document any remaining platform or dependency constraints.
• Update applicable user, architecture, or developer documentation and pass the repository's relevant quality gates.

Tracking context

Raised from the user-supplied agent-findings export generated on 29 October 2026. The description, severity, evidence, and assumptions above are reported findings; issue creation does not establish independent reproduction. Existing open and closed issues were checked for matching identifiers and root causes.