test(perf): add Employment separation buyer-path workload - #317
test(perf): add Employment separation buyer-path workload#317seonghobae wants to merge 160 commits into
Conversation
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review Please review the exact current head for performance-evidence false-GREEN risk: right-cleared/non-synthetic fixture enforcement, cross-profile Employment isolation, contention semantics, bearer handling, p95 threshold scoping, result provenance, and any k6 runtime incompatibility. This PR must not claim measured acceptance. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '=== HEAD / PR FILES ==='
git rev-parse HEAD
git diff --name-status HEAD^ HEAD
git diff --check HEAD^ HEAD
echo '=== REPOSITORY MAP ==='
fd -HI -t f | rg -i '(k6|perf|performance|employment|fixture|workload|package\.json|readme|requirements)'
echo '=== JAVASCRIPT/TYPECRIPT OUTLINES ==='
while IFS= read -r file; do
echo "--- $file"
ast-grep outline "$file" --items all 2>/dev/null || true
done < <(fd -HI -t f -e js -e mjs -e cjs -e ts | rg -i '(k6|perf|performance|employment|fixture|workload)')
echo '=== DIFF ==='
git diff --find-renames --find-copies --unified=80 HEAD^ HEADLength of output: 3432 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '=== OUTLINE: WORKLOAD ==='
ast-grep outline tests/performance/employment_separation_buyer_path.js --items all || true
echo '=== OUTLINE: FIXTURE CONTRACT ==='
ast-grep outline tests/performance/employment_separation_fixture_contract.mjs --items all || true
echo '=== OUTLINE: FIXTURE CONTRACT TEST ==='
ast-grep outline tests/performance/employment_separation_fixture_contract.test.mjs --items all || true
echo '=== WORKLOAD ==='
cat -n tests/performance/employment_separation_buyer_path.js
echo '=== FIXTURE CONTRACT ==='
cat -n tests/performance/employment_separation_fixture_contract.mjs
echo '=== FIXTURE CONTRACT TEST ==='
cat -n tests/performance/employment_separation_fixture_contract.test.mjs
echo '=== RELATED PERFORMANCE POLICY ==='
cat -n docs/adr/0009-performance-criterion-observation-scope.md
echo '=== ALL SHARED-CONTRACT IMPORTS AND CALL SITES ==='
rg -n -C 4 --glob '*.mjs' --glob '*.js' \
'(from .*\bemployment_separation_fixture_contract\b|require\(.+employment_separation_fixture_contract|validateFixture|fixtureIdentity|candidateSha|resourceEvidence)' \
tests services packagesLength of output: 37674 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '=== PACKAGE METADATA ==='
cat -n package.json
echo '=== PERFORMANCE DOCUMENTATION AND EXECUTION REFERENCES ==='
rg -n -C 5 -i \
'(employment[-_ ]separation.*(performance|buyer|k6)|ORGMETRA_PERFORMANCE_|k6 run|performance-result|candidate_sha|right_cleared)' \
README.md docs tests package.json .github 2>/dev/null || true
echo '=== SERVICE ROUTE CONTRACT ==='
rg -n -C 8 --glob '*.py' --glob '*.md' --glob '*.json' \
'(/v1/employment-separations|employment-separations|separation_conflict|X-Actor-Reference|X-Purpose-Code|X-Tenant-Reference)' \
services/people-api packages tests | head -n 500
echo '=== K6 VERSION PINNING OR CONTAINER CONFIGURATION ==='
fd -HI -t f | rg -i '(dockerfile|compose|k6|tool-versions|mise|asdf|package-lock|pnpm-lock|yarn\.lock|github/workflows)'
rg -n -C 3 -i '(grafana/k6|k6(\s|:|@)|xk6)' .github README.md package.json Dockerfile docker-compose.yml 2>/dev/null || true
echo '=== CURRENT HEAD ID REFERENCES ==='
rg -n -C 3 '(2046bc4bea97cf8e0a11694fe3b707c23d5273df|ORGMETRA_PERFORMANCE_TARGET_SHA|candidate_sha)' .Length of output: 54948
The fixture contract otherwise enforces the requested controls: right-cleared and non-synthetic flags, full-SHA format and fixture/runtime SHA equality, non-empty evidence references, cross-profile Employment isolation, contention command equivalence except for idempotency key, runtime bearer credentials, and a first-commit-only p95 trend. The workload does not contain a measured acceptance claim.
|
|
Finding verification on current stack: the initial performance fixture validator accepted short idempotency keys, while the live People contract requires 16–200 visible ASCII characters. A real run with those fixtures would have returned request-validation 400s and produced a false performance RED. Repaired ordinary-forward in |
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
target='6dc5e2806b566ca8952eaf2d5bd65de6fa41d836'
base='d9cc516d54b4642f59fe126c331a19945fdf75f1'
echo '=== VERIFY EXACT HEAD ==='
git rev-parse HEAD
git cat-file -t "$target"
git merge-base --is-ancestor "$base" "$target" && echo "base_is_ancestor=yes"
git diff --check "$base" "$target"
echo '=== CHANGED FILES ==='
git diff --name-status "$base" "$target"
echo '=== JAVASCRIPT OUTLINES ==='
git diff --name-only "$base" "$target" | while IFS= read -r f; do
case "$f" in
*.js|*.mjs|*.cjs)
echo "--- $f"
ast-grep outline "$f" --items all || true
;;
esac
done
echo '=== PERFORMANCE HARNESS FILES AT TARGET ==='
fd -HI -t f . tests 2>/dev/null | rg 'tests/performance/(employment_separation|.*performance)' || true
echo '=== TARGET DIFF ==='
git diff --find-renames --unified=100 "$base" "$target" -- tests/performance docs package.json
echo '=== RELATED PRODUCTION BOUNDARY LOCATIONS ==='
rg -n -C 5 --glob '*.py' \
'(Idempotency-Key|X-Actor-Reference|X-Purpose-Code|X-Tenant-Reference|Bearer |employment-separations|separation_reason|evidence_version|confirmation_reference)' \
services packages tests | head -n 1000
echo '=== EXECUTION / VERSION REFERENCES ==='
rg -n -C 4 --glob '*.md' --glob '*.json' --glob '*.yml' --glob '*.yaml' --glob '*.js' --glob '*.mjs' \
'(k6 run|grafana/k6|shared-iterations|maxDuration|handleSummary|thresholds|ORGMETRA_PERFORMANCE|candidate_sha|resource_evidence)' \
README.md docs tests package.json .github 2>/dev/null || trueLength of output: 146825 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '=== PEOPLE SEPARATION SOURCE MAP ==='
rg -n -l --glob '*.py' '(employment.separation|employment-separation|separation_conflict|separation_effective_on)' services/people-api | while IFS= read -r f; do
echo "--- $f"
ast-grep outline "$f" --items all 2>/dev/null || true
done
echo '=== PEOPLE SEPARATION HTTP AND COMMAND IMPLEMENTATIONS ==='
rg -n -C 12 --glob '*.py' \
'(def .*separation|class .*Separation|/v1/employment-separations|separation_conflict|Idempotency-Key|idempotency.*(16|200)|evidence_version_code|confirmation_reference)' \
services/people-api/src services/people-api/tests | head -n 1600
echo '=== PERFORMANCE CONTRACT TEST COMPLETE ==='
cat -n tests/performance/employment_separation_fixture_contract.test.mjs
echo '=== K6-SPECIFIC API PATTERNS IN REPOSITORY ==='
rg -n -C 5 --glob '*.js' --glob '*.mjs' \
'(handleSummary|execution|iterationInTest|http\.batch|shared-iterations)' . 2>/dev/null
echo '=== COMMIT HISTORY FOR HARNESS ==='
git log --format='%H%n%s%n%b%n---' --reverse d9cc516d54b4642f59fe126c331a19945fdf75f1..6dc5e2806b566ca8952eaf2d5bd65de6fa41d836 -- tests/performanceLength of output: 210212
The remaining reviewed controls are consistent with the stated harness scope. The fixture validator enforces right-cleared non-synthetic input, candidate-SHA equality, resource-evidence presence, cross-profile Employment isolation, and contention pair equivalence except for idempotency key. The workload supplies the bearer token only from the runtime environment. The result envelope does not explicitly contain the target endpoint. The You are interacting with an AI system. |
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
target='beff0210c24f5d179f8a6717fbfeb5881f7c5365'
base='d9cc516d54b4642f59fe126c331a19945fdf75f1'
echo '=== EXACT-HEAD VERIFICATION ==='
printf 'checked_out='
git rev-parse HEAD
git cat-file -t "$target"
git merge-base --is-ancestor "$base" "$target" && echo 'base_is_ancestor=yes'
git diff --check "$base" "$target"
echo '=== CHANGED FILES ==='
git diff --name-status "$base" "$target"
echo '=== PERFORMANCE FILES AT TARGET ==='
git ls-tree -r --name-only "$target" | rg '^tests/performance/|(^|/)(package\.json|README\.md)$|^docs/' | rg -i '(employment|separation|performance|buyer|fixture|workload|package\.json|readme)' || true
echo '=== JAVASCRIPT OUTLINES ==='
git diff --name-only "$base" "$target" | while IFS= read -r file; do
case "$file" in
*.js|*.mjs|*.cjs)
echo "--- $file"
ast-grep outline "$file" --items all 2>/dev/null || true
;;
esac
done
echo '=== HARNESS DIFF ==='
git diff --find-renames --unified=100 "$base" "$target" -- tests/performance docs package.json README.md
echo '=== CURRENT HARNESS SOURCES ==='
for file in \
tests/performance/employment_separation_buyer_path.js \
tests/performance/employment_separation_fixture_contract.mjs \
tests/performance/employment_separation_fixture_contract.test.mjs
do
if git cat-file -e "$target:$file" 2>/dev/null; then
echo "--- $file"
git show "$target:$file" | cat -n
fi
done
echo '=== PEOPLE REQUEST-BOUNDARY IMPLEMENTATION ==='
rg -n -C 10 --glob '*.py' \
'(Idempotency-Key|X-Actor-Reference|X-Purpose-Code|X-Tenant-Reference|Authorization|Bearer |/v1/employment-separations|separation_reason|evidence_version|confirmation_reference)' \
services/people-api packages 2>/dev/null | head -n 1800 || true
echo '=== K6 RUNTIME/PATTERN REFERENCES ==='
rg -n -C 6 --glob '*.js' --glob '*.mjs' --glob '*.md' --glob '*.json' --glob '*.yml' --glob '*.yaml' \
'(shared-iterations|maxDuration|handleSummary|execution|iterationInTest|Trend|Counter|thresholds|k6 run|grafana/k6|ORGMETRA_PERFORMANCE|candidate_sha|prepared_state|preparation_protocol|resource_evidence)' \
tests docs README.md package.json .github 2>/dev/null || true
echo '=== RESULT-EVIDENCE FIELD AND SECRET/ENDPOINT AUDIT ==='
rg -n -C 5 --glob '*.js' --glob '*.mjs' \
'(handleSummary|JSON\.stringify|result|envelope|endpoint|target|base_url|authorization|bearer|token|ORGMETRA_PERFORMANCE)' \
tests/performance 2>/dev/null || true
echo '=== FIXTURE/PROFILE CROSS-REFERENCE ==='
rg -n -C 5 --glob '*.js' --glob '*.mjs' \
'(first_commit|replay|rejection|contention|employment_id|employment_reference|profile_precondition|prepared_state|preparation_protocol)' \
tests/performance 2>/dev/null || trueLength of output: 203259 🏁 Script executed: #!/bin/bash
set -euo pipefail
target='beff0210c24f5d179f8a6717fbfeb5881f7c5365'
log='/tmp/coderabbit-shell-logs/shell-output-5yYGg9'
echo '=== EXACT HEAD AND DIFF STAT ==='
git rev-parse HEAD
git show -s --format='%H%n%P%n%s' "$target"
git diff --stat d9cc516d54b4642f59fe126c331a19945fdf75f1 "$target"
git diff --name-status 6dc5e2806b566ca8952eaf2d5bd65de6fa41d836 "$target"
echo '=== COMPLETE TARGET: WORKLOAD ==='
git show "$target:tests/performance/employment_separation_buyer_path.js" | nl -ba
echo '=== COMPLETE TARGET: FIXTURE CONTRACT ==='
git show "$target:tests/performance/employment_separation_fixture_contract.mjs" | nl -ba
echo '=== COMPLETE TARGET: CONTRACT TESTS ==='
git show "$target:tests/performance/employment_separation_fixture_contract.test.mjs" | nl -ba
echo '=== PREVIOUS COMMAND: KEY SECTIONS ==='
rg -n -C 3 '^=== EXACT-HEAD|^checked_out=|^base_is_ancestor|^=== CHANGED FILES|^=== HARNESS DIFF|^=== CURRENT HARNESS SOURCES' "$log" || true
echo '=== TARGET: ALL PERFORMANCE OUTPUT SINKS AND ENVIRONMENT USE ==='
git grep -n -E '(handleSummary|console\.|JSON\.stringify|__ENV|http\.(post|batch)|open\()' "$target" -- tests/performance || true
echo '=== TARGET: DOCUMENTED K6 INVOCATION ==='
git grep -n -i -E '(k6 run|ORGMETRA_PERFORMANCE_|employment-separation-performance-result)' "$target" -- README.md docs tests package.json .github 2>/dev/null || trueLength of output: 36295
The prepared-state provenance is structurally explicit. The fixture requires The result envelope does not explicitly emit k6 runtime execution was not available in this environment. The source uses standard k6 module imports, You are interacting with an AI system. |
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
target='2ef2f39449bcaa0ce8a077f43649af4a70a8e0e3'
base='d9cc516d54b4642f59fe126c331a19945fdf75f1'
echo '=== EXACT HEAD ==='
printf 'checked_out='
git rev-parse HEAD
printf 'target_type='
git cat-file -t "$target"
git merge-base --is-ancestor "$base" "$target" && echo 'base_is_ancestor=yes'
git diff --check "$base" "$target"
git show -s --format='target=%H%nparents=%P%nsubject=%s' "$target"
echo '=== CHANGED FILES ==='
git diff --name-status "$base" "$target"
echo '=== PERFORMANCE SOURCE OUTLINES ==='
for file in \
tests/performance/employment_separation_buyer_path.js \
tests/performance/employment_separation_fixture_contract.mjs \
tests/performance/employment_separation_fixture_contract.test.mjs
do
if git cat-file -e "$target:$file" 2>/dev/null; then
echo "--- $file"
git show "$target:$file" > "/tmp/$(basename "$file")"
ast-grep outline "/tmp/$(basename "$file")" --items all 2>/dev/null || true
fi
done
echo '=== WORKLOAD ==='
git show "$target:tests/performance/employment_separation_buyer_path.js" | nl -ba
echo '=== FIXTURE CONTRACT ==='
git show "$target:tests/performance/employment_separation_fixture_contract.mjs" | nl -ba
echo '=== CONTRACT TESTS ==='
git show "$target:tests/performance/employment_separation_fixture_contract.test.mjs" | nl -ba
echo '=== HARNESS DIFF ==='
git diff --find-renames --unified=100 "$base" "$target" -- \
tests/performance docs README.md package.json
echo '=== RESPONSE BOUNDARY ==='
rg -n -C 12 --glob '*.py' \
'(/v1/employment-separations|separation_conflict|replayed|recorded_at|employment_id|Idempotency-Key|X-Actor-Reference|X-Purpose-Code|X-Tenant-Reference)' \
services packages tests | head -n 1800 || true
echo '=== K6, THRESHOLD, AND RESULT-EVIDENCE AUDIT ==='
git grep -n -E \
'(shared-iterations|maxDuration|thresholds|Trend|Counter|handleSummary|JSON\.stringify|__ENV|http\.(post|batch)|iterationInTest|baseUrl|bearer|token|endpoint|candidate_sha|prepared_state|preparation_protocol|resource_evidence)' \
"$target" -- tests/performance docs README.md package.json 2>/dev/null || true
echo '=== TARGET PERFORMANCE INVOCATION REFERENCES ==='
git grep -n -i -E \
'(k6 run|ORGMETRA_PERFORMANCE_PROFILE|first_commit|replay|rejection|contention|employment-separation-performance-result)' \
"$target" -- README.md docs tests package.json .github 2>/dev/null || trueLength of output: 202926 🏁 Script executed: #!/bin/bash
set -euo pipefail
target='2ef2f39449bcaa0ce8a077f43649af4a70a8e0e3'
echo '=== EXACT HEAD SUMMARY ==='
git show -s --format='target=%H%nparents=%P%nsubject=%s' "$target"
git diff --name-status 'd9cc516d54b4642f59fe126c331a19945fdf75f1' "$target"
echo '=== WORKLOAD 1-240 ==='
git show "$target:tests/performance/employment_separation_buyer_path.js" | nl -ba | sed -n '1,240p'
echo '=== RUN CONTRACT ==='
git show "$target:tests/performance/employment_separation_run_contract.mjs" | nl -ba
echo '=== RESPONSE CONTRACT ==='
git show "$target:tests/performance/employment_separation_response_contract.mjs" | nl -ba
echo '=== FIXTURE CONTRACT 1-280 ==='
git show "$target:tests/performance/employment_separation_fixture_contract.mjs" | nl -ba | sed -n '1,280p'
echo '=== RESPONSE AND RUN CONTRACT TESTS ==='
for file in \
tests/performance/employment_separation_response_contract.test.mjs \
tests/performance/employment_separation_run_contract.test.mjs
do
echo "--- $file"
git show "$target:$file" | nl -ba
done
echo '=== PUBLISHED SEPARATION ERROR ENVELOPE ==='
sed -n '300,385p' services/people-api/src/orgmetra_people_api/separation_http.py | nl -ba -v300
echo '=== K6 PACKAGE / VERSION DECLARATIONS ==='
fd -HI -t f -a 'package.json' -a 'Dockerfile*' -a 'docker-compose*.yml' -a 'docker-compose*.yaml' -a '*.tool-versions' -a 'mise.toml' -a '.github/workflows' | while IFS= read -r file; do
echo "--- $file"
rg -n -i -C 3 '(k6|grafana/k6|xk6)' "$file" || true
doneLength of output: 33949
The reviewed response contract matches the published boundary. First-commit and replay require The selected-profile design prevents replay, rejection, and contention traffic from entering the first-commit duration trend. The p95 threshold exists only for The fixture contract requires right-cleared, non-synthetic data, exact candidate-SHA binding, explicit preparation and prepared-state references, resource evidence, minimum profile cardinality, and Employment isolation across profiles. The result envelope does not emit the endpoint or bearer token. This is a Draft stacked on You are interacting with an AI system. |
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
target='38c6ee346bc21416a48c287facf0d72fd667caa8'
previous='2ded2f0cdac52d0db5f481b4c97c118df8c9057c'
base='c0ba482c57a77820128f259b4a43c06df643c0f3'
echo '=== EXACT HEAD ==='
printf 'checked_out='; git rev-parse HEAD
git cat-file -t "$target"
git merge-base --is-ancestor "$base" "$target" && echo 'stacked_base_is_ancestor=yes'
git show -s --format='target=%H%nparents=%P%nsubject=%s' "$target"
git diff --check "$base" "$target"
echo '=== DELTA SINCE PUBLICATION REVIEW ==='
git diff --name-status "$previous" "$target"
git diff --find-renames --unified=140 "$previous" "$target" -- tests/performance docs README.md package.json .github
echo '=== PERFORMANCE FILE MAP ==='
git ls-tree -r --name-only "$target" -- tests/performance | sort
echo '=== OUTLINES ==='
for file in \
tests/performance/run_employment_separation_benchmark.sh \
tests/performance/employment_separation_buyer_path.js \
tests/performance/employment_separation_acceptance_check.mjs \
tests/performance/employment_separation_acceptance_contract.mjs \
tests/performance/employment_separation_run_contract.mjs \
tests/performance/employment_separation_k6_runtime_contract.mjs \
tests/performance/employment_separation_k6_evidence_contract.mjs
do
if git cat-file -e "$target:$file" 2>/dev/null; then
echo "--- $file"
git show "$target:$file" > "/tmp/$(basename "$file")"
ast-grep outline "/tmp/$(basename "$file")" --items all 2>/dev/null || true
fi
done
echo '=== RUNNER ==='
git show "$target:tests/performance/run_employment_separation_benchmark.sh" | nl -ba
echo '=== ACCEPTANCE AND WORKLOAD BOUNDARIES ==='
for file in \
tests/performance/employment_separation_buyer_path.js \
tests/performance/employment_separation_acceptance_check.mjs \
tests/performance/employment_separation_acceptance_contract.mjs \
tests/performance/employment_separation_run_contract.mjs \
tests/performance/employment_separation_k6_runtime_contract.mjs \
tests/performance/employment_separation_k6_evidence_contract.mjs
do
echo "--- $file"
git show "$target:$file" | nl -ba
done
echo '=== FOCUSED REGRESSIONS ==='
git ls-tree -r --name-only "$target" -- tests/performance | \
rg '(runner|benchmark|publication|summary|workload|provenance|k6.*(runtime|evidence)|acceptance.*(binding|contract|cardinality|load)).*test\.(mjs|js)$' | \
while IFS= read -r file; do
echo "--- $file"
git show "$target:$file" | nl -ba
done
echo '=== USERNS, PODMAN, PERMISSION, AND PUBLICATION AUDIT ==='
git grep -n -E -i \
'(userns|keep-id|--user |Config\.User|12345|podman (info|image|run|import)|remote|rootless|rootful|mount|--mount|--volume|umask|chmod|chown|mktemp|summary_run_file|SUMMARY_FILE|test -[efLs]|ln |sha256|stat|open|O_NOFOLLOW|fixture|staging|/workspace|--pull=never)' \
"$target" -- tests/performance docs README.md package.json .github 2>/dev/null || true
echo '=== NON-TEST EXECUTION REFERENCES ==='
git grep -n -E \
'(run_employment_separation_benchmark|ORGMETRA_PERFORMANCE_SUMMARY_FILE|employment_separation_acceptance_check)' \
"$target" -- . ':!tests/performance/*test.mjs' 2>/dev/null || trueLength of output: 203682 🤖 web_search executed:
Length of output: 17085 🏁 Script executed: #!/bin/bash
set -euo pipefail
target='38c6ee346bc21416a48c287facf0d72fd667caa8'
previous='2ded2f0cdac52d0db5f481b4c97c118df8c9057c'
echo '=== RUNNER, COMPLETE ==='
git show "$target:tests/performance/run_employment_separation_benchmark.sh" | nl -ba
echo '=== USER-MAPPING DELTA ==='
git diff --unified=100 "$previous" "$target" -- \
tests/performance/run_employment_separation_benchmark.sh \
tests/performance/employment_separation_k6_runtime_contract.test.mjs
echo '=== RUNNER-RELATED TEST FILES ==='
git ls-tree -r --name-only "$target" -- tests/performance | rg '(runner|benchmark).*test\.(mjs|js)$' | while IFS= read -r file; do
echo "--- $file"
git show "$target:$file" | nl -ba
done
echo '=== REMOTE AND PODMAN CONFIGURATION REFERENCES ==='
git grep -n -i -E '(CONTAINER_HOST|CONTAINER_CONNECTION|podman.*remote|remote.*podman|PODMAN_USERNS|containers\.conf|--remote|podman info)' \
"$target" -- tests/performance docs README.md .github package.json 2>/dev/null || true
echo '=== SUMMARY PUBLICATION REFERENCES ==='
git grep -n -E '(summary_run_file|summary_target|ln "\$\{summary_run_file\}"|O_NOFOLLOW|stat |sha256sum|shasum|mktemp -d)' \
"$target" -- tests/performance/run_employment_separation_benchmark.sh tests/performance 2>/dev/null || trueLength of output: 21741
The user-mapping repair is otherwise correct for its supported topology.
Rootful Podman is not a false-GREEN path. Podman documents that Remote Podman is also not explicitly supported or rejected. Remote execution does not provide the local host-path ownership assumption used by this runner. A commercial run should use a local rootless Podman engine unless the runner adds a remote-engine evidence and mount contract. I did not execute Podman, k6, or repository tests. This review does not claim measured buyer p95 acceptance, hosted execution, protected status, or release status. You are interacting with an AI system. |
|
Current authority receipt after CodeRabbit P1 repair: exact head CodeRabbit correctly found that predecessor This receipt supersedes the prior body’s volatile exact-head line; the durable scope and earlier lineage remain unchanged. No hosted exact-head workflow, Podman/k6 buyer run, measured p50/p95/p99/max, protected integration, or release is claimed. |
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
target='44dedef4412ac0c49e3f8facda25a0b85f3a9af3'
previous='38c6ee346bc21416a48c287facf0d72fd667caa8'
base='c0ba482c57a77820128f259b4a43c06df643c0f3'
echo '=== EXACT HEAD ==='
printf 'checked_out='; git rev-parse HEAD
git cat-file -t "$target"
git merge-base --is-ancestor "$base" "$target" && echo 'stacked_base_is_ancestor=yes'
git show -s --format='target=%H%nparents=%P%nsubject=%s' "$target"
git diff --check "$base" "$target"
echo '=== PUBLICATION-REPAIR DELTA ==='
git diff --name-status "$previous" "$target"
git diff --find-renames --unified=160 "$previous" "$target" -- tests/performance docs README.md package.json .github
echo '=== FOCUSED OUTLINES ==='
for file in \
tests/performance/run_employment_separation_benchmark.sh \
tests/performance/employment_separation_acceptance_check.mjs \
tests/performance/employment_separation_acceptance_contract.mjs
do
if git cat-file -e "$target:$file" 2>/dev/null; then
echo "--- $file"
git show "$target:$file" > "/tmp/$(basename "$file")"
ast-grep outline "/tmp/$(basename "$file")" --items all 2>/dev/null || true
fi
done
echo '=== RUNNER ==='
git show "$target:tests/performance/run_employment_separation_benchmark.sh" | nl -ba
echo '=== RUNNER/PUBLICATION REGRESSIONS ==='
git ls-tree -r --name-only "$target" -- tests/performance | \
rg '(runner|benchmark|publication|summary|workload|provenance).*test\.(mjs|js)$' | \
while IFS= read -r file; do
echo "--- $file"
git show "$target:$file" | nl -ba
done
echo '=== PUBLICATION, PATH, AND CLEANUP AUDIT ==='
git grep -n -E \
'(summary_run_file|summary_target|ORGMETRA_PERFORMANCE_SUMMARY_FILE|mktemp|umask|trap|stat |sha256sum|shasum|ln |rm -f|rm -rf|test -[efLs]|\\[\\[ -e|--out|handleSummary|podman run|--mount|--volume|userns|keep-id|--user=|/workspace)' \
"$target" -- tests/performance docs README.md package.json .github 2>/dev/null || true
echo '=== ACCEPTANCE ARTIFACT BINDINGS ==='
for file in \
tests/performance/employment_separation_acceptance_check.mjs \
tests/performance/employment_separation_acceptance_contract.mjs \
tests/performance/employment_separation_runtime_evidence_artifact.mjs
do
if git cat-file -e "$target:$file" 2>/dev/null; then
echo "--- $file"
git show "$target:$file" | nl -ba
fi
done
echo '=== NON-TEST ENTRY POINTS ==='
git grep -n -E \
'(run_employment_separation_benchmark|ORGMETRA_PERFORMANCE_SUMMARY_FILE|employment_separation_acceptance_check)' \
"$target" -- . ':!tests/performance/*test.mjs' 2>/dev/null || trueLength of output: 58226
The current repair closes the earlier source-path race before the final verification:
I did not execute repository tests, Podman, or k6. This source review does not claim measured buyer p95 acceptance, hosted execution, protected status, or release status. You are interacting with an AI system. |
|
Current authority receipt: exact head The CodeRabbit P1 repair at No hosted exact-head workflow or production-equivalent k6 run is claimed yet; the prior body’s volatile exact-head line is superseded by this receipt. |
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
target='2ba21d88aa3c9837fa08d54554d2e94edf04b6f6'
previous='44dedef4412ac0c49e3f8facda25a0b85f3a9af3'
base='c0ba482c57a77820128f259b4a43c06df643c0f3'
echo '=== EXACT HEAD ==='
printf 'checked_out='; git rev-parse HEAD
printf 'target_type='; git cat-file -t "$target"
git merge-base --is-ancestor "$base" "$target" && echo 'stacked_base_is_ancestor=yes'
git show -s --format='target=%H%nparents=%P%nsubject=%s' "$target"
git diff --check "$base" "$target"
echo '=== DELTA SINCE PRIOR PUBLICATION REVIEW ==='
git diff --name-status "$previous" "$target"
git diff --find-renames --unified=180 "$previous" "$target" -- tests/performance docs README.md package.json .github
echo '=== PERFORMANCE FILE MAP ==='
git ls-tree -r --name-only "$target" -- tests/performance | sort
echo '=== OUTLINES ==='
for file in \
tests/performance/run_employment_separation_benchmark.sh \
tests/performance/employment_separation_runner_contract.test.mjs \
tests/performance/employment_separation_benchmark_runner.test.mjs \
tests/performance/employment_separation_acceptance_check.mjs \
tests/performance/employment_separation_acceptance_contract.mjs \
tests/performance/employment_separation_runtime_evidence_artifact.mjs
do
if git cat-file -e "$target:$file" 2>/dev/null; then
echo "--- $file"
git show "$target:$file" > "/tmp/$(basename "$file")"
ast-grep outline "/tmp/$(basename "$file")" --items all 2>/dev/null || true
fi
done
echo '=== COMPLETE RUNNER ==='
git show "$target:tests/performance/run_employment_separation_benchmark.sh" | nl -ba
echo '=== RUNNER/PUBLICATION REGRESSIONS ==='
git ls-tree -r --name-only "$target" -- tests/performance | \
rg '(runner|benchmark|publication|summary|workload|provenance).*test\.(mjs|js)$' | \
while IFS= read -r file; do
echo "--- $file"
git show "$target:$file" | nl -ba
done
echo '=== SUMMARY PATH, RACE, LINK, AND CLEANUP AUDIT ==='
git grep -n -E \
'(summary_run_file|summary_target|ORGMETRA_PERFORMANCE_SUMMARY_FILE|mktemp|umask|trap|stat |sha256sum|shasum|ln |rm -f|rm -rf|test -[efLs]|\\[\\[ -e|--out|handleSummary|rename|open|O_NOFOLLOW|flock|mkdir|chmod|chown)' \
"$target" -- tests/performance docs README.md package.json .github 2>/dev/null || true
echo '=== ARTIFACT BINDING AND EXECUTION BOUNDARY ==='
for file in \
tests/performance/employment_separation_acceptance_check.mjs \
tests/performance/employment_separation_acceptance_contract.mjs \
tests/performance/employment_separation_runtime_evidence_artifact.mjs \
tests/performance/employment_separation_buyer_path.js
do
if git cat-file -e "$target:$file" 2>/dev/null; then
echo "--- $file"
git show "$target:$file" | nl -ba
fi
done
echo '=== NON-TEST ENTRY POINTS ==='
git grep -n -E \
'(run_employment_separation_benchmark|ORGMETRA_PERFORMANCE_SUMMARY_FILE|employment_separation_acceptance_check)' \
"$target" -- . ':!tests/performance/*test.mjs' 2>/dev/null || trueLength of output: 66185
The new regression closes the earlier staged-source replacement path.
The pinned k6 OCI boundary, immutable workload image, private staging directory, non-root I did not execute repository tests, Podman, or k6. This review does not claim a hosted run, measured buyer latency, protected integration, or release status. You are interacting with an AI system. |
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
target='2ba21d88aa3c9837fa08d54554d2e94edf04b6f6'
previous='38c6ee346bc21416a48c287facf0d72fd667caa8'
base='c0ba482c57a77820128f259b4a43c06df643c0f3'
echo '=== EXACT COMMIT ==='
printf 'checked_out='; git rev-parse HEAD
printf 'target_type='; git cat-file -t "$target"
git merge-base --is-ancestor "$base" "$target" && echo 'stacked_base_is_ancestor=yes'
git show -s --format='target=%H%nparents=%P%nsubject=%s' "$target"
git diff --check "$base" "$target"
echo '=== REPAIR DELTA ==='
git diff --name-status "$previous" "$target"
git diff --find-renames --unified=160 "$previous" "$target" -- tests/performance docs README.md package.json .github
echo '=== PERFORMANCE FILE MAP ==='
git ls-tree -r --name-only "$target" -- tests/performance | sort
echo '=== OUTLINES ==='
for file in \
tests/performance/run_employment_separation_benchmark.sh \
tests/performance/employment_separation_benchmark_runner.test.mjs \
tests/performance/employment_separation_runner_contract.test.mjs \
tests/performance/employment_separation_acceptance_check.mjs \
tests/performance/employment_separation_acceptance_contract.mjs \
tests/performance/employment_separation_runtime_evidence_artifact.mjs
do
if git cat-file -e "$target:$file" 2>/dev/null; then
echo "--- $file"
git show "$target:$file" > "/tmp/$(basename "$file")"
ast-grep outline "/tmp/$(basename "$file")" --items all 2>/dev/null || true
fi
done
echo '=== RUNNER ==='
git show "$target:tests/performance/run_employment_separation_benchmark.sh" | nl -ba
echo '=== RUNNER/PUBLICATION TESTS ==='
git ls-tree -r --name-only "$target" -- tests/performance | \
rg '(runner|benchmark|publication|summary|workload|provenance).*test\.(mjs|js)$' | \
while IFS= read -r file; do
echo "--- $file"
git show "$target:$file" | nl -ba
done
echo '=== ACCEPTANCE AND ARTIFACT CONSUMPTION ==='
for file in \
tests/performance/employment_separation_acceptance_check.mjs \
tests/performance/employment_separation_acceptance_contract.mjs \
tests/performance/employment_separation_runtime_evidence_artifact.mjs \
tests/performance/employment_separation_buyer_path.js
do
if git cat-file -e "$target:$file" 2>/dev/null; then
echo "--- $file"
git show "$target:$file" | nl -ba
fi
done
echo '=== PATH / IDENTITY / RACE AUDIT ==='
git grep -n -E \
'(summary_run_file|summary_target|ORGMETRA_PERFORMANCE_SUMMARY_FILE|mktemp|umask|trap|stat |sha256sum|shasum|ln |rm -f|rm -rf|test -[efLs]|rename|open|O_NOFOLLOW|flock|mkdir|chmod|chown|readFile|readFileSync|performance_result_sha256|runtime_evidence_sha256)' \
"$target" -- tests/performance docs README.md package.json .github 2>/dev/null || trueLength of output: 110474
The staged-summary identity binding otherwise works as intended at source level.
I did not execute repository tests, Podman, or k6. This harness and provenance review does not claim measured buyer performance, hosted GREEN, protected integration, or release status. You are interacting with an AI system. |
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
target='108f1c0ee70eebfb0fa7d391aecb49a7927d912d'
previous='2ba21d88aa3c9837fa08d54554d2e94edf04b6f6'
base='c0ba482c57a77820128f259b4a43c06df643c0f3'
echo '=== EXACT HEAD ==='
printf 'checked_out='; git rev-parse HEAD
printf 'target_type='; git cat-file -t "$target"
git merge-base --is-ancestor "$base" "$target" && echo 'stacked_base_is_ancestor=yes'
git show -s --format='target=%H%nparents=%P%nsubject=%s' "$target"
git diff --check "$base" "$target"
echo '=== DELTA FROM PRIOR P1 HEAD ==='
git diff --name-status "$previous" "$target"
git diff --find-renames --unified=140 "$previous" "$target" -- tests/performance docs README.md package.json .github
echo '=== PERFORMANCE FILE MAP ==='
git ls-tree -r --name-only "$target" -- tests/performance | sort
echo '=== OUTLINES ==='
for file in \
tests/performance/run_employment_separation_benchmark.sh \
tests/performance/employment_separation_acceptance_check.mjs \
tests/performance/employment_separation_acceptance_contract.mjs \
tests/performance/employment_separation_runtime_evidence_artifact.mjs \
tests/performance/employment_separation_result_artifact.mjs \
tests/performance/employment_separation_buyer_path.js
do
if git cat-file -e "$target:$file" 2>/dev/null; then
echo "--- $file"
git show "$target:$file" > "/tmp/$(basename "$file")"
ast-grep outline "/tmp/$(basename "$file")" --items all 2>/dev/null || true
fi
done
echo '=== RUNNER AND ACCEPTANCE SOURCES ==='
for file in \
tests/performance/run_employment_separation_benchmark.sh \
tests/performance/employment_separation_acceptance_check.mjs \
tests/performance/employment_separation_acceptance_contract.mjs \
tests/performance/employment_separation_runtime_evidence_artifact.mjs \
tests/performance/employment_separation_result_artifact.mjs \
tests/performance/employment_separation_buyer_path.js
do
if git cat-file -e "$target:$file" 2>/dev/null; then
echo "--- $file"
git show "$target:$file" | nl -ba
fi
done
echo '=== DIGEST-HANDOFF AND ACCEPTANCE REGRESSIONS ==='
git ls-tree -r --name-only "$target" -- tests/performance | \
rg '(digest|handoff|acceptance.*(contract|binding|provenance|edge)|runtime_evidence|result_artifact|runner|benchmark).*test\.(mjs|js)$' | \
while IFS= read -r file; do
echo "--- $file"
git show "$target:$file" | nl -ba
done
echo '=== RESULT DIGEST, RAW BYTE, CLI, AND PATH AUDIT ==='
git grep -n -E \
'(ORGMETRA_PERFORMANCE_RESULT_SHA256|performance_result_sha256|runner.*digest|result.*digest|sha256|createHash|readFile|readFileSync|process\.argv|runtime_evidence|summary_target|SUMMARY_FILE|acceptance_check|validateEmploymentSeparationAcceptance|JSON\.parse|TextDecoder|utf)' \
"$target" -- tests/performance docs README.md package.json .github 2>/dev/null || true
echo '=== NON-TEST ENTRY POINTS ==='
git grep -n -E \
'(run_employment_separation_benchmark|employment_separation_acceptance_check|ORGMETRA_PERFORMANCE_RESULT_SHA256)' \
"$target" -- . ':!tests/performance/*test.mjs' 2>/dev/null || trueLength of output: 166565
The repair closes the prior pathname-only replacement path when the runner token remains intact.
I did not execute repository tests, Podman, or k6. This source review does not claim hosted execution, measured buyer latency, protected integration, or release status. You are interacting with an AI system. |
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
target='b6968520ef191fe8a3fd84d3cd5d4dc23a778281'
previous='108f1c0ee70eebfb0fa7d391aecb49a7927d912d'
base='c0ba482c57a77820128f259b4a43c06df643c0f3'
echo '=== EXACT COMMIT ==='
printf 'checked_out='; git rev-parse HEAD
printf 'target_type='; git cat-file -t "$target"
git merge-base --is-ancestor "$base" "$target" && echo 'stacked_base_is_ancestor=yes'
git show -s --format='target=%H%nparents=%P%nsubject=%s' "$target"
git diff --check "$base" "$target"
echo '=== DELTA FROM PRIOR DIGEST-HANDOFF HEAD ==='
git diff --name-status "$previous" "$target"
git diff --find-renames --unified=160 "$previous" "$target" -- tests/performance docs README.md package.json .github
echo '=== PERFORMANCE FILE MAP ==='
git ls-tree -r --name-only "$target" -- tests/performance | sort
echo '=== OUTLINES ==='
for file in \
tests/performance/employment_separation_acceptance_check.mjs \
tests/performance/employment_separation_acceptance_contract.mjs \
tests/performance/employment_separation_result_artifact.mjs \
tests/performance/employment_separation_runtime_evidence_artifact.mjs \
tests/performance/run_employment_separation_benchmark.sh
do
if git cat-file -e "$target:$file" 2>/dev/null; then
echo "--- $file"
git show "$target:$file" > "/tmp/$(basename "$file")"
ast-grep outline "/tmp/$(basename "$file")" --items all 2>/dev/null || true
fi
done
echo '=== ACCEPTANCE ENTRY POINTS AND RELATED SOURCES ==='
for file in \
tests/performance/employment_separation_acceptance_check.mjs \
tests/performance/employment_separation_acceptance_contract.mjs \
tests/performance/employment_separation_result_artifact.mjs \
tests/performance/employment_separation_runtime_evidence_artifact.mjs \
tests/performance/run_employment_separation_benchmark.sh
do
if git cat-file -e "$target:$file" 2>/dev/null; then
echo "--- $file"
git show "$target:$file" | nl -ba
fi
done
echo '=== ACCEPTANCE / ATTESTATION / RED-CASE TESTS ==='
git ls-tree -r --name-only "$target" -- tests/performance | \
rg '(acceptance|attest|digest|handoff|result_artifact|runtime_evidence).*test\.(mjs|js)$' | \
while IFS= read -r file; do
echo "--- $file"
git show "$target:$file" | nl -ba
done
echo '=== ALL POSITIVE-RECEIPT AND ACCEPTANCE PATHS ==='
git grep -n -E -i \
'(commercial.*accept|acceptance.*receipt|receipt|commercial_acceptance|validateEmploymentSeparationAcceptance|acceptance_check|authenticated.*(evidence|attestation)|attestation|ORGMETRA_PERFORMANCE_RESULT_SHA256|runnerResultSha256|process\.exit|console\.log|JSON\.stringify)' \
"$target" -- . ':!node_modules' ':!dist' ':!build' 2>/dev/null || true
echo '=== CALL SITES OUTSIDE TESTS ==='
git grep -n -E \
'(employment_separation_acceptance_check|validateEmploymentSeparationAcceptance|ORGMETRA_PERFORMANCE_RESULT_SHA256)' \
"$target" -- . ':!tests/performance/*test.mjs' 2>/dev/null || trueLength of output: 145837
The CLI repair correctly closes the prior caller-controlled digest path.
I did not execute repository tests, Podman, or k6. This review does not claim measured buyer p95, hosted execution, protected acceptance, or release status. ✏️ Learnings added
You are interacting with an AI system. |
1 participant
Scope
This Draft PR owns executable performance-measurement and evidence-contract mechanics for #316 without changing People production semantics. It remains stacked on active People owner #64 rather than being retargeted merely to manufacture CI evidence.
Buyer-path workload
POST /v1/employment-separationsshape with governedworkforce_adminpurpose.first_commit,replay,rejection, orcontention.constant-arrival-rateload models. Ordinary profiles are currently 20 RPS × 50 s with 20 preallocated / 80 max VUs; contention is 10 pair-iterations/s × 10 s with 20 preallocated / 80 max VUs. These are reproducibility inputs, not capacity claims.p(95)<=20only to ordinaryfirst_commit; replay/rejection/contention remain separate distributions. The result records p50/p95/p99/max and exact sample cardinality.blocked + duration; k6 v2.2.0 nests TCP/TLS acquisition insideblocked, so addingconnectingandtls_handshakingagain would double-count cold-connection latency.Execution and local evidence integrity
ghcr.io/grafana/k6v2.2.0 by OCI digestsha256:9bd01d6941fca969cb61bb57d2da5ee9b385fe2aa8881df3798c196564d6ace6, verifies upstream container UID12345, and runs with--pull=never.HEADequalsORGMETRA_PERFORMANCE_TARGET_SHA, streamsgit archiveof that exact commit into an ephemeral Podman image, and mounts that image read-only at/workspace; the live host working tree is not the executed workload.ORGMETRA_PERFORMANCE_RESULT_SHA256=<digest>, but that value is now explicitly structural evidence only. A value copied from caller-visible stdout is not an authenticated commercial trust root.Commercial acceptance trust boundary — fail closed
CodeRabbit found a valid P1 on exact
108f1c0ee70eebfb0fa7d391aecb49a7927d912d: the attempted result-digest handoff still accepted the digest as a caller-supplied CLI argument. A caller able to replace the result could also calculate a replacement digest and construct matching runtime evidence. Equality between caller-controlled bytes and caller-controlled digest is integrity checking, not authentication.The product-local lane therefore no longer claims that the digest token closes commercial provenance. The current repair is deliberately fail closed:
d2ab0b057dd81610c53326fe60a96f9a3b7595daadds the RED contract: replacing both result identity and local digest must not produce commercial acceptance.5b8b49746c148240e3078745c714d33533aa2951adds an explicit authenticated-evidence gate.51da6578d279af8e25e0238f47d15e2a1d5b80afplaces that gate at the commercial acceptance entry point before pathname, digest, runtime, fixture, or latency evidence can be converted into a receipt. The CLI no longer accepts a caller-supplied runner digest as authority.b6968520ef191fe8a3fd84d3cd5d4dc23a778281corrects the runner documentation: its emitted digest is local structural evidence, not an immutable handoff authority.The authenticated owner path is now central
.github#2162,perf: attest exact product performance evidence before commercial acceptance. It requires an organization-owned immutable reusable workflow that re-hashes inert sealed result/runtime/fixture artifacts, binds exact caller repository/source SHA/run/artifact identity, signs a versioned performance-evidence predicate with GitHub/Sigstore, and verifies the signer workflow/OIDC/source/subject before a product may emit a positive commercial receipt..github#1228is a prerequisite warning: the existing reusable exact-artifact workflow'sgithub.workflow_shapattern is not a sound cross-repository reusable-workflow identity and must not be copied into this owner path.Until the released central contract is consumed here,
employment_separation_acceptance_check.mjsintentionally terminates non-zero with the.github#2162owner requirement. Local validators remain useful for structural/schema/cardinality/latency/runtime consistency tests, but cannot establish commercial acceptance.Verified earlier finding/repair lineage
The stack already repaired, test-first and ordinary-forward, false-GREEN/false-RED paths involving production-incompatible Idempotency-Key fixtures, hidden prepared DB state, wrong conflict response shape, mixed-profile load, missing p99, truncated samples, undersized cardinality, self-declared load models, coordinated omission, lossy UTF-8 artifacts, omitted transport time, double-counted TCP/TLS, substitutable k6 runner provenance, caller-controlled k6 CLI/load intensity, unbound checkout bytes, live-working-tree TOCTOU, stale-result reuse, non-root mount ownership, and staged-summary replacement during publication. The latest authenticated-attestation finding supersedes the earlier claim that a leaf-local digest token alone was a durable acceptance boundary.
Current authority
Exact performance head:
b6968520ef191fe8a3fd84d3cd5d4dc23a778281.Exact stacked base: #64
c0ba482c57a77820128f259b4a43c06df643c0f3.No hosted exact-head k6 execution, production-equivalent deployment, authenticated performance attestation, runtime-cleanup observation, measured p50/p95/p99/max, protected status, or release status is claimed. A real buyer RED/GREEN still requires the exact-candidate ASGI composition, sanctioned Keyverse/auth path, production-equivalent PostgreSQL/pool settings, right-cleared prepared records, pinned k6 runtime, independent runtime/load observer, resource/cleanup evidence, and the authenticated
.github#2162evidence boundary. #316 remains open.