[ralyodio]

Why

Watching the new queue serve jobs live (dev2 gateway on v0.3.2/0.3.3, 12:42 to 13:09Z), queued images never completed. The fastest remaining bidder, AmaKBdpB (bench 1,606, against dev2's ~5,500 reference), needs about 7 min per image, but the gateway gives a winner 6 min (IMAGE_RECEIPT_TIMEOUT) before "winner never delivered; benched". The job re-queued, and the bench fallback (#212) handed it straight back to the same node, the only bidder, so it looped on wasted renders. The node's bids quote the default 60 s ETA because it has not completed a job since restarting.

What

buyer::receipt_wait(base, winner) replaces the fixed receipt timeout. It is the auction's timeout, made longer for a winner that says it needs longer (2.5x its quoted ETA) or that benchmarks slower than the reference score of 5,000 (scaled by how much slower), and never more than 4x the timeout. A reference-speed node keeps the plain timeout; AmaKBdpB gets about 19 min instead of 6. Applies to every buyer, gateway or CLI.

Also bumps to v0.3.6 (v0.3.5 is claimed by #225, which is merged, and by open #227/#228).

Tests

• New unit test: reference node, slow node, 2.5x ETA, cap.
• cargo test -p c0mpute-core --lib --test auction_e2e --test video_e2e: 468 + 3 + 6 pass.

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

13 finding(s)

HIGH/CRITICAL: 1 | MEDIUM: 8 | LOW: 4

Severity	Rule	Location
HIGH	js-ssrf-outbound-request	apps/web/public/sw.js:24
MEDIUM	js-unescaped-html-sink	apps/web/src/app/blog/[slug]/page.tsx:53
MEDIUM	js-unescaped-html-sink	apps/web/src/app/layout.tsx:89
MEDIUM	sh-remote-script-execution	scripts/dev-setup.sh:25
MEDIUM	sh-eval-expansion	scripts/dev-setup.sh:35
MEDIUM	sh-remote-script-execution	scripts/install.sh:181
MEDIUM	sh-remote-script-execution	scripts/install.sh:206
MEDIUM	sh-remote-script-execution	scripts/install.sh:399
MEDIUM	sh-remote-script-execution	scripts/install.sh:441
LOW	py-ssrf-outbound-request	examples/business-strategist-agent/chat.py:37
LOW	py-ssrf-outbound-request	examples/business-strategist-agent/train.py:54
LOW	secret-generic-credential	node/crates/c0mpute-core/src/webhook.rs:1171
LOW	py-path-traversal	node/crates/c0mpute-core/tests/fixtures/fake-infernet-text:29

Snippets are redacted; ThreatCrush never prints matched credential material.

[ralyodio]

Merging with one red check: gameserver_e2e::watch_fails_over_to_another_worker_from_the_latest_backup fails identically on master at 91d42bf (#228), without this PR. This change only lengthens how long a buyer waits for a winner's receipt; a crashed winner sends none either way. The hosting_e2e flake from the first run passed on the rerun. Everything else is green.