[CI] Ventura x64 Security tests fail with NoSuchKeyChain / InvalidHandle

[dalexsoto]

Failure signature

On the M1 - Mac Ventura (13) macOS tests job, the macOS/osx-x64 monotouch-test Security/Keychain tests fail together with SecStatusCode.InvalidHandle, PKCS#12 import failures, and key-generation failures. The matching system log contains repeated Security errors NoSuchKeyChain (-25294) and InvalidHandle (-25304).

Classification: CI infrastructure failure.

Confirmed occurrences

PR / head	Azure run / job	Evidence	Outcome
#26232 / e094a26829c95306641819f4d16876738bf0507b	build 14730280, Ventura macOS tests	17 Security/Keychain failures; 290 -25294 and 7 -25304 log entries	Failed-job retry succeeded
#26414 / 349cd4737d1e7e0b4726779bb4e6ca561619cdae	build 14889519, attempt 1, Ventura macOS tests	15 failures including GenerateKeyPairTest, AccessCertificates, identity import, keychain add, and crypto tests; 989 -25294 and 8 -25304 log entries	Build still active; no retry submitted

This is 2 confirmed occurrences across 2 monitored PRs.

Reproduction pattern and impact

The Ventura job runs both macOS architectures. The x64 monotouch-test process fails a cluster of otherwise unrelated Security APIs because the Keychain is unavailable or returns invalid handles. This causes the complete Ventura stage and PR simulator check to fail even though the PR changes are unrelated.

The #26414 job also has an independent arm64 600-second HTTP-suite timeout; that separate signature is tracked in #25687 and is not part of this issue.

Investigation performed

• Inspected Azure build metadata and the first failed Run tests task.
• Read the TestSummary and HtmlReport output for both architectures.
• Correlated exact test names, InvalidHandle results, and Security error codes with the retained [tests] Stabilize NSPasteboard metadata detection Fixes #25446 #26232 occurrence.
• Searched all open and closed issues separately for the stable signature, exact test names, InvalidHandle, NoSuchKeyChain, -25294, and Security/Keychain terms. No matching issue was found; [CI Postmortem] Widespread LaunchTimedOut failures on iOS/tvOS simulator tests #25299 appeared only through an unrelated PR-number text match.

Observation window

• First observed: 2026-07-22T10:41:16Z
• Latest observed: 2026-08-06T07:01:41Z

Workaround

A failed-job rerun cleared the #26232 occurrence. For #26414, no retry is permitted until build 14889519 is terminal and the normal merge, head, budget, and equivalent-run gates are refreshed.

Azure diagnostic artifacts are retention-limited; links and only the minimal stable diagnostic lines are recorded here.

[dalexsoto]

Retry update for PR #26414 at 349cd4737d1e7e0b4726779bb4e6ca561619cdae:

• Build 14889519 completed failed after the reported Ventura x64 Keychain recurrence.
• After refreshing the unchanged MERGEABLE/BLOCKED head, retained run history, retry budgets, and equivalent attempts, the monitor submitted Ventura stage mac_13_m1 attempt 2, which is now in progress.
• Two separate accepted requests rerun unrelated iOS/tvOS and Sonoma network failures. Total accounting is 3 PR-lifetime / 3 current-head retries.

The Keychain signature remains 2 confirmed occurrences across 2 PRs. Classification remains CI infrastructure failure; no source change is indicated, and no Additional info to collect checklist is present.

[dalexsoto]

Retry outcome for PR #26414 at 349cd4737d1e7e0b4726779bb4e6ca561619cdae:

• Ventura stage mac_13_m1 attempt 2 in build 14889519 completed successfully at 2026-08-06T08:39:36Z.
• The x64 Keychain NoSuchKeyChain / InvalidHandle failure did not recur.
• The separate simulator-stage retry remains active. Total accounting remains 3 PR-lifetime / 3 current-head retries.

The canonical count remains 2 occurrences across 2 PRs. No source change was needed, and no Additional info to collect checklist is present.

[dalexsoto]

Final retry outcome for PR #26414 at 349cd4737d1e7e0b4726779bb4e6ca561619cdae:

• Simulator stage attempt 2 in build 14889519 completed successfully at 2026-08-06T10:28:20Z.
• The full build completed successfully at 2026-08-06T10:31:55Z.
• Ventura Keychain, Ventura timeout, Sonoma TLS, and iOS/tvOS network failures all cleared.
• Retry accounting remains 3 PR-lifetime / 3 current-head retries.

The Keychain count remains 2 occurrences across 2 PRs. No source change was needed, and no Additional info to collect checklist is present.