haveapi 0.30.1 → 0.30.2

data/spec/performance/endpoint_contract_spec.rb

@@ -0,0 +1,226 @@
+require 'spec_helper'
+require_relative '../../test_support/performance_endpoint_fixture'
+
+RSpec.describe HaveAPI::PerformanceFixtures::Endpoints do
+  let(:scenarios) { [] }
+
+  def build(id = 'api.basic_get', **dimensions)
+    scenario = described_class.build(id:, dimensions:)
+    scenarios << scenario
+    scenario
+  end
+
+  def headers(user = 'member')
+    { 'HTTP_HOST' => 'example.test', 'HTTP_ACCEPT' => 'application/json',
+      'HTTP_AUTHORIZATION' => "Basic #{["#{user}:#{described_class::PASSWORD}"].pack('m0')}",
+      'CONTENT_TYPE' => 'application/json' }
+  end
+
+  def json_request(request, method, path, body = nil, user: 'member')
+    response = request.request(method, "/performance/v1/#{path}",
+                               headers(user).merge(input: body.nil? ? '' : JSON.generate(body)))
+    [response, JSON.parse(response.body)]
+  end
+
+  after do
+    scenarios.each(&:close)
+  end
+
+  it 'retains the seven quick cases and adds only the accepted weekly shapes' do
+    quick = described_class.cases
+    expect(quick.map { |item| item[:id] }).to eq(described_class::CASE_IDS)
+    expect(quick.last).to eq(id: 'api.list', dimensions: { rows: 32 })
+    expect(quick[0...-1].map { |item| item[:dimensions] }).to all(eq({}))
+    weekly = described_class.cases(profile: 'weekly')
+    expect(weekly.first(quick.length)).to eq(quick)
+    additions = [
+      { id: 'api.list', dimensions: { rows: 1024, user: 'member' } },
+      { id: 'api.list', dimensions: { rows: 1024, user: 'admin' } },
+      { id: 'api.basic_get', dimensions: { user: 'admin' } }
+    ]
+    expect(weekly.drop(quick.length)).to eq(additions)
+    expect(weekly.uniq).to eq(weekly)
+  end
+
+  it 'executes and validates every real quick-case response and counter record' do
+    described_class.cases.each do |item|
+      scenario = build(item[:id], **item[:dimensions])
+      scenario.reset!(iterations: 3)
+      responses = Array.new(3) { scenario.call }
+      responses.each_with_index do |response, index|
+        identity = scenario.validate!(response, index:)
+        expect(identity).to include(http_status: 200, body_bytes: response.body.bytesize,
+                                    body_sha256: Digest::SHA256.hexdigest(response.body))
+        expect(identity[:envelope_status]).to eq(item[:id] != 'api.invalid_post')
+        expect(identity[:canonical_body]).to eq(JSON.parse(response.body))
+        expect(identity[:canonical_sha256]).to eq(HaveAPI::Performance::Identity.digest(JSON.parse(response.body)))
+      end
+      executions = item[:id] == 'api.invalid_post' ? 0 : 1
+      expect(scenario.counters).to eq(operations: Array.new(3) { { queries: 0, authorizations: 1, executions: } })
+    end
+  end
+
+  it 'validates the weekly large-list and administrator shapes' do
+    described_class.cases(profile: 'weekly').drop(described_class::CASE_IDS.length).each do |item|
+      scenario = build(item[:id], **item[:dimensions])
+      scenario.reset!(iterations: 1)
+      identity = scenario.validate!(scenario.call, index: 0)
+      output = identity.fetch(:canonical_body).fetch('response').fetch('probe')
+      records = item[:id] == 'api.list' ? output : [output]
+      expect(records.length).to eq(item[:dimensions].fetch(:rows, 1))
+      records.each do |record|
+        expect(record.has_key?('secret')).to eq(item[:dimensions][:user] == 'admin')
+      end
+      expect(scenario.counters).to eq(operations: [{ queries: 0, authorizations: 1, executions: 1 }])
+    end
+  end
+
+  it 'rejects a corrupted early response even when the final response is valid' do
+    scenario = build
+    scenario.reset!(iterations: 2)
+    first = scenario.call
+    last = scenario.call
+    body = JSON.parse(first.body)
+    body['response']['probe']['count'] = '0'
+    broken = Rack::MockResponse.new(200, first.headers, JSON.generate(body))
+
+    expect { scenario.validate!(last, index: 1) }.not_to raise_error
+    expect { scenario.validate!(broken, index: 0) }.to raise_error(/Unexpected output/)
+    expect { scenario.validate!(Rack::MockResponse.new(403, {}, '{}'), index: 0) }
+      .to raise_error(/HTTP status/)
+    duplicate = Rack::MockResponse.new(200, first.headers, first.body.sub('"status":true', '"status":false,"status":true'))
+    expect { scenario.validate!(duplicate, index: 0) }.to raise_error(HaveAPI::Performance::ContractError, /duplicate/i)
+  end
+
+  it 'preserves typed zero, false, empty, null, nested Custom data and omission' do
+    scenario = build('api.typed_post')
+    scenario.reset!(iterations: 1)
+    response = scenario.call
+    scenario.validate!(response, index: 0)
+    output = JSON.parse(response.body).fetch('response').fetch('probe')
+
+    expect(output).to include('count' => 0, 'ratio' => 1.25, 'enabled' => false, 'label' => '', 'nullable' => nil,
+                              'at' => '2020-01-01T00:00:00+00:00', 'payload' => { 'nested' => [0, false, '', nil] })
+    expect(output).not_to have_key('omitted')
+  end
+
+  it 'uses distinct Basic and token providers with real credential failures' do
+    basic = build('api.basic_get')
+    token = build('api.token_get')
+    [basic, token].each { |scenario| scenario.reset!(iterations: 1) }
+    expect(basic.validate!(basic.call, index: 0)).to eq(token.validate!(token.call, index: 0))
+    request = Rack::MockRequest.new(basic.app)
+    missing = request.get('/performance/v1/probes/secure', 'HTTP_HOST' => 'example.test')
+    bad_basic = request.get('/performance/v1/probes/secure', headers.merge('HTTP_AUTHORIZATION' => 'Basic invalid'))
+    bad_token = request.get('/performance/v1/probes/secure', headers.merge('HTTP_AUTHORIZATION' => '',
+                                                                           'HTTP_X_HAVEAPI_AUTH_TOKEN' => 'invalid'))
+    expect([missing.status, bad_basic.status, bad_token.status]).to eq([401, 401, 401])
+    [missing, bad_basic, bad_token].each { |response| expect(JSON.parse(response.body)['status']).to be(false) }
+    denied, body = json_request(request, 'GET', 'probes/admin')
+    expect(denied.status).to eq(403)
+    expect(body.fetch('status')).to be(false)
+    allowed, body = json_request(request, 'GET', 'probes/admin', user: 'admin')
+    expect(allowed.status).to eq(200)
+    expect(body.dig('response', 'probe', 'secret')).to eq('ADMIN_ONLY_VALUE')
+  end
+
+  it 'executes real CRUD, isolates stores and resets writes outside measured requests' do
+    scenario = build('api.list', rows: 1)
+    other = build('api.list', rows: 1)
+    scenario.reset!(iterations: 1)
+    other.reset!(iterations: 1)
+    request = Rack::MockRequest.new(scenario.app)
+    created, body = json_request(request, 'POST', 'items', { probe: { label: 'created' } })
+    expect(created.status).to eq(200)
+    expect(body.fetch('status')).to be(true)
+    expect(body.dig('response', 'probe')).to include('id' => 2, 'label' => 'created')
+    _, body = json_request(request, 'GET', 'items/2')
+    expect(body.dig('response', 'probe', 'label')).to eq('created')
+    _, body = json_request(request, 'PUT', 'items/2', { probe: { label: 'updated' } })
+    expect(body.dig('response', 'probe', 'label')).to eq('updated')
+    _, body = json_request(request, 'DELETE', 'items/2')
+    expect(body.dig('response', 'probe', 'label')).to eq('updated')
+    missing, body = json_request(request, 'GET', 'items/2')
+    expect(missing.status).to eq(404)
+    expect(body.fetch('status')).to be(false)
+    json_request(request, 'POST', 'items', { probe: { label: 'discarded by reset' } })
+    expect(other.validate!(other.call, index: 0)[:envelope_status]).to be(true)
+    scenario.reset!(iterations: 1)
+    expect(scenario.validate!(scenario.call, index: 0)[:envelope_status]).to be(true)
+  end
+
+  it 'does not mutate timed counter records through direct app requests' do
+    scenario = build
+    scenario.reset!(iterations: 1)
+    response = scenario.call
+    before = Marshal.dump(scenario.counters)
+    request = Rack::MockRequest.new(scenario.app)
+    json_request(request, 'GET', 'probes/secure')
+    json_request(request, 'POST', 'items', { probe: { label: 'untimed' } })
+
+    expect(Marshal.dump(scenario.counters)).to eq(before)
+    expect { scenario.validate!(response, index: 0) }.not_to raise_error
+  end
+
+  it 'rejects malformed bodies, missing routes and invalid typed input through real middleware' do
+    scenario = build
+    request = Rack::MockRequest.new(scenario.app)
+    ['{', '[]', 'null'].each do |input|
+      response = request.post('/performance/v1/probes/typed', headers.merge(input:))
+      expect(response.status).to eq(400)
+      expect(JSON.parse(response.body)['status']).to be(false)
+    end
+    response = request.get('/performance/v1/not-a-route', headers)
+    expect(response.status).to eq(404)
+    expect(JSON.parse(response.body)['status']).to be(false)
+    response = request.post('/performance/v1/probes/typed', headers.merge(input: '{"probe":{"count":"wrong"}}'))
+    expect(response.status).to eq(200)
+    expect(JSON.parse(response.body).fetch('errors')).to have_key('count')
+  end
+
+  it 'alternates privileged and restricted users without exposing hidden fields' do
+    scenario = build
+    request = Rack::MockRequest.new(scenario.app)
+    %w[admin member admin].each do |user|
+      _, body = json_request(request, 'GET', 'probes/secure', user:)
+      output = body.fetch('response').fetch('probe')
+      if user == 'admin'
+        expect(output.fetch('secret')).to eq('ADMIN_ONLY_VALUE')
+      else
+        expect(output).not_to have_key('secret')
+        expect(JSON.generate(body)).not_to include('ADMIN_ONLY_VALUE')
+      end
+    end
+  end
+
+  it 'requires reset and every operation record, and rejects overflow and damaged counters' do
+    scenario = build
+    expect { scenario.call }.to raise_error(/reset!/)
+    expect { scenario.counters }.to raise_error(/Missing operation/)
+    scenario.reset!(iterations: 2)
+    first = scenario.call
+    expect { scenario.counters }.to raise_error(/Missing operation/)
+    scenario.call
+    expect { scenario.call }.to raise_error(/More calls/)
+    expect { scenario.validate!(first, index: -1) }.to raise_error(ArgumentError)
+    expect { scenario.validate!(first, index: 2) }.to raise_error(/not called/)
+    scenario.counters[:operations].first[:queries] = 1
+    expect { scenario.validate!(first, index: 0) }.to raise_error(/counts/)
+    expect { scenario.counters }.to raise_error(/counts/)
+    scenario.reset!(iterations: 1)
+    scenario.validate!(scenario.call, index: 0)
+    scenario.close
+    expect { scenario.call }.to raise_error(/closed/)
+    expect { scenario.reset!(iterations: 1) }.to raise_error(/closed/)
+  end
+
+  it 'fails closed on unknown cases, profiles, dimensions, users and invalid batch sizes' do
+    expect { described_class.cases(profile: 'other') }.to raise_error(ArgumentError)
+    expect { build('api.unknown') }.to raise_error(ArgumentError)
+    expect { build('api.list', rows: 0) }.to raise_error(ArgumentError)
+    expect { build('api.list', rows: '32') }.to raise_error(ArgumentError)
+    expect { build('api.list', user: 'unknown') }.to raise_error(ArgumentError)
+    expect { build('api.list', accidental: true) }.to raise_error(ArgumentError)
+    expect { build.reset!(iterations: 0) }.to raise_error(ArgumentError)
+  end
+end

data/spec/performance/endpoint_scaling_spec.rb

@@ -0,0 +1,82 @@
+require 'spec_helper'
+require_relative '../../test_support/performance_endpoint_fixture'
+
+RSpec.describe HaveAPI::PerformanceFixtures::Endpoints, '.build' do
+  def run_list(rows)
+    scenario = described_class.build(id: 'api.list', dimensions: { rows: })
+    scenario.reset!(iterations: 2)
+    responses = Array.new(2) { scenario.call }
+    identities = responses.each_with_index.map { |response, index| scenario.validate!(response, index:) }
+    [identities, scenario.counters]
+  ensure
+    scenario&.close
+  end
+
+  def allocated_per_request(rows)
+    scenario = described_class.build(id: 'api.list', dimensions: { rows: })
+    2.times do
+      scenario.reset!(iterations: 10)
+      10.times { scenario.call }
+    end
+    Array.new(3) do
+      scenario.reset!(iterations: 10)
+      responses = Array.new(10)
+      GC.start
+      allocated = GC.stat(:total_allocated_objects)
+      index = 0
+      while index < responses.length
+        responses[index] = scenario.call
+        index += 1
+      end
+      delta = GC.stat(:total_allocated_objects) - allocated
+      responses.each_with_index { |response, operation| scenario.validate!(response, index: operation) }
+      scenario.counters
+      delta / 10.0
+    end.min
+  ensure
+    scenario&.close
+  end
+
+  it 'serializes complete ordered lists at sizes 1, 32 and 128 with fixed action work' do
+    bytes = [1, 32, 128].map do |rows|
+      identities, counters = run_list(rows)
+      expect(identities.first).to eq(identities.last)
+      output = identities.first[:canonical_body].fetch('response').fetch('probe')
+      expect(output.length).to eq(rows)
+      expect(output.map { |row| row.fetch('id') }).to eq((1..rows).to_a)
+      expect(output.last.fetch('label')).to eq("item-#{rows}")
+      output.each { |row| expect(row).not_to have_key('secret') }
+      expect(counters[:operations]).to eq(Array.new(2) { { queries: 0, authorizations: 1, executions: 1 } })
+      identities.first[:body_bytes]
+    end
+    expect(bytes.each_cons(2)).to all(satisfy { |small, large| small < large })
+  end
+
+  it 'keeps output and counters independent across reset batch sizes' do
+    scenario = described_class.build(id: 'api.list', dimensions: { rows: 32 })
+    scenario.reset!(iterations: 1)
+    first = scenario.validate!(scenario.call, index: 0)
+    records = scenario.counters[:operations]
+    scenario.reset!(iterations: 3)
+    responses = Array.new(3) { scenario.call }
+    responses.each_with_index do |response, index|
+      expect(scenario.validate!(response, index:)).to eq(first)
+    end
+    expect(scenario.counters[:operations].length).to eq(3)
+    expect(scenario.counters[:operations].first).not_to equal(records.first)
+    expect(scenario.counters[:operations].map(&:object_id).uniq.length).to eq(3)
+  ensure
+    scenario&.close
+  end
+
+  it 'bounds allocation growth by serialized rows rather than their square' do
+    small, medium, large = [1, 32, 128].map { |rows| allocated_per_request(rows) }
+
+    # Reference Ruby 3.4.11: 640/795/1275 objects per request. Output work
+    # grows with rows; the 96-row increment has a 4x allowance relative to
+    # the 31-row increment, plus 32 objects of fixed VM bookkeeping slack.
+    expect(medium).to be >= small
+    expect(large).to be > medium
+    expect(large - medium).to be <= (4 * (medium - small)) + 32
+  end
+end

data/spec/performance/event_baseline_spec.rb

@@ -0,0 +1,279 @@
+require 'json'
+require 'open3'
+require 'tmpdir'
+require 'yaml'
+require_relative '../../../../utils/performance_ci'
+
+RSpec.describe HaveAPI::PerformanceCI do
+  let(:candidate) { sha('c') }
+  let(:default) { sha('d') }
+  let(:base) { sha('b') }
+  let(:event) { { 'repository' => { 'default_branch' => 'master' } } }
+  let(:repository) { instance_double(described_class::Repository) }
+
+  def sha(character)
+    character * 40
+  end
+
+  def resolver
+    described_class::Resolver.new(repository)
+  end
+
+  before do
+    allow(repository).to receive(:default_sha).with('master').and_return(default)
+    allow(repository).to receive(:commit!) do |value|
+      unless value.is_a?(String) && described_class::SHA.match?(value) && value != '0' * 40
+        raise described_class::Error, 'invalid commit'
+      end
+
+      value
+    end
+    allow(repository).to receive_messages(ancestor?: true, paths: ['servers/ruby/lib/haveapi/server.rb'], release_lineage: nil)
+  end
+
+  def resolve(name, data, **options)
+    resolver.resolve(event_name: name, event: data, event_sha: candidate, **options)
+  end
+
+  it 'selects the PR event head instead of its synthetic merge commit' do
+    event['pull_request'] = { 'head' => { 'sha' => candidate }, 'base' => { 'sha' => default } }
+    allow(repository).to receive(:merge_base).with(candidate, default).and_return(base)
+
+    result = resolver.resolve(event_name: 'pull_request', event:, event_sha: sha('e'))
+    expect(result).to include(candidate_sha: candidate, baseline_sha: base, profile: 'quick', relevant: true)
+  end
+
+  it 'compares an entire default-branch push batch against event before' do
+    event.merge!('ref' => 'refs/heads/master', 'after' => candidate, 'before' => base)
+    allow(repository).to receive(:merge_base)
+
+    expect(resolve('push', event)).to include(baseline_sha: base, candidate_sha: candidate)
+    expect(repository).not_to have_received(:merge_base)
+  end
+
+  [false, true].each do |new_branch|
+    it "uses the whole feature merge-base for a #{new_branch ? 'new' : 'subsequent'} push" do
+      event.merge!('ref' => 'refs/heads/feature', 'after' => candidate,
+                   'before' => new_branch ? '0' * 40 : sha('a'), 'created' => new_branch)
+      allow(repository).to receive(:merge_base).with(candidate, default).and_return(base)
+
+      expect(resolve('push', event, default_sha: default)).to include(baseline_sha: base, captured_default_sha: default)
+    end
+  end
+
+  it 'rejects initial default-branch pushes without an available predecessor' do
+    event.merge!('ref' => 'refs/heads/master', 'after' => candidate, 'before' => '0' * 40)
+    expect { resolve('push', event) }.to raise_error(described_class::Error)
+  end
+
+  context 'with the verified maintenance lineage' do
+    def release
+      sha('e')
+    end
+
+    def lineage
+      { 'candidate_sha' => candidate, 'mapped_sha' => HaveAPI::Performance::Release::MAPPED }
+    end
+
+    before do
+      allow(repository).to receive(:release_lineage).with(candidate).and_return(lineage)
+      allow(repository).to receive(:default_sha).with('haveapi-0.30').and_return(release)
+    end
+
+    it 'compares the complete maintenance push batch using event before' do
+      event.merge!('ref' => 'refs/heads/haveapi-0.30', 'before' => base, 'after' => candidate)
+      expect(resolve('push', event)).to include(baseline_sha: base, candidate_sha: candidate,
+                                                release_lineage: lineage, reason: 'maintenance event before/after batch')
+    end
+
+    [false, true].each do |created|
+      it "captures the release head for a #{created ? 'new' : 'subsequent'} release feature" do
+        event.merge!('ref' => 'refs/heads/feature', 'before' => created ? '0' * 40 : sha('a'), 'after' => candidate)
+        allow(repository).to receive(:merge_base).with(candidate, release).and_return(base)
+        expect(resolve('push', event)).to include(baseline_sha: base, captured_release_sha: release,
+                                                  captured_default_sha: default, release_lineage: lineage)
+      end
+    end
+
+    it 'fails if the captured release reference is unavailable' do
+      event.merge!('ref' => 'refs/heads/feature', 'after' => candidate)
+      allow(repository).to receive(:default_sha).with('haveapi-0.30').and_raise(described_class::Error, 'missing release ref')
+      expect { resolve('push', event) }.to raise_error(described_class::Error, /missing release ref/)
+    end
+
+    it 'accepts only the original weekly reference through the proven mapping' do
+      event['inputs'] = { 'profile' => 'weekly', 'candidate_sha' => candidate, 'baseline_sha' => described_class::REFERENCE }
+      allow(repository).to receive(:ancestor?).with(described_class::REFERENCE, candidate).and_return(false)
+      expect(resolve('workflow_dispatch', event)).to include(baseline_sha: described_class::REFERENCE, release_lineage: lineage)
+      event['inputs']['profile'] = 'quick'
+      expect { resolve('workflow_dispatch', event) }.to raise_error(described_class::Error, /ancestor/)
+      event['inputs']['profile'] = 'weekly'
+      allow(repository).to receive(:release_lineage).with(candidate).and_return(nil)
+      expect { resolve('workflow_dispatch', event) }.to raise_error(described_class::Error, /ancestor/)
+    end
+
+    it 'does not accept an unrelated explicit quick baseline' do
+      event['inputs'] = { 'candidate_sha' => candidate, 'baseline_sha' => base }
+      allow(repository).to receive(:ancestor?).with(base, candidate).and_return(false)
+      expect { resolve('workflow_dispatch', event) }.to raise_error(described_class::Error, /ancestor/)
+    end
+  end
+
+  it 'rejects unproven maintenance branch history' do
+    event.merge!('ref' => 'refs/heads/haveapi-0.30', 'before' => base, 'after' => candidate)
+    expect { resolve('push', event) }.to raise_error(described_class::Error, /Unproven/)
+  end
+
+  it 'rejects deleted pushes and tag events' do
+    expect { resolve('push', event.merge('deleted' => true)) }.to raise_error(described_class::Error, /Deleted/)
+    expect { resolve('push', event.merge('ref' => 'refs/tags/v1')) }.to raise_error(described_class::Error, /branch/)
+  end
+
+  it 'requires a real ancestor and never substitutes a same-head baseline' do
+    event['inputs'] = { 'candidate_sha' => candidate, 'baseline_sha' => base }
+    allow(repository).to receive(:ancestor?).with(base, candidate).and_return(false)
+    expect { resolve('workflow_dispatch', event) }.to raise_error(described_class::Error, /ancestor/)
+    event['inputs']['baseline_sha'] = candidate
+    expect { resolve('workflow_dispatch', event) }.to raise_error(described_class::Error, /differ/)
+  end
+
+  it 'uses the exact scheduled event SHA and preserves fixed reference ancestry' do
+    expect(resolve('schedule', event)).to include(candidate_sha: candidate, baseline_sha: described_class::REFERENCE, profile: 'weekly')
+    expect(repository).to have_received(:ancestor?).with(described_class::REFERENCE, candidate)
+  end
+
+  it 'defaults manual runs to captured default and fixed reference' do
+    expect(resolve('workflow_dispatch', event)).to include(candidate_sha: default, baseline_sha: described_class::REFERENCE)
+  end
+
+  it 'accepts complete explicit manual SHA pairs and weekly profile' do
+    event['inputs'] = { 'candidate_sha' => candidate, 'baseline_sha' => described_class::REFERENCE, 'profile' => 'weekly' }
+    expect(resolve('workflow_dispatch', event)).to include(candidate_sha: candidate, baseline_sha: described_class::REFERENCE, profile: 'weekly')
+    event['inputs']['baseline_sha'] = base
+    expect { resolve('workflow_dispatch', event) }.to raise_error(described_class::Error, /fixed/)
+  end
+
+  it 'rejects partial manual pairs, invalid profiles and missing event data' do
+    event['inputs'] = { 'candidate_sha' => candidate }
+    expect { resolve('workflow_dispatch', event) }.to raise_error(described_class::Error)
+    event['inputs'] = { 'profile' => 'unbounded' }
+    expect { resolve('workflow_dispatch', event) }.to raise_error(described_class::Error, /profile/)
+    expect { resolve('pull_request', {}) }.to raise_error(described_class::Error, /Incomplete/)
+    expect { resolve('pull_request_target', event.merge('inputs' => {})) }.to raise_error(described_class::Error, /Unsupported/)
+  end
+
+  it 'does not hide unavailable commits behind a no-path success' do
+    event['inputs'] = { 'candidate_sha' => candidate, 'baseline_sha' => base }
+    allow(repository).to receive(:commit!).with(base).and_raise(described_class::Error, 'unavailable')
+    expect { resolve('workflow_dispatch', event) }.to raise_error(described_class::Error, 'unavailable')
+  end
+
+  it 'skips only irrelevant valid push/PR changes and still forces scheduled/manual work' do
+    allow(repository).to receive(:paths).and_return(['clients/php/README.md'])
+    event.merge!('ref' => 'refs/heads/master', 'after' => candidate, 'before' => base)
+    expect(resolve('push', event)).to include(relevant: false)
+    expect(resolve('schedule', event)).to include(relevant: true)
+    expect(resolve('workflow_dispatch', event)).to include(relevant: true)
+  end
+
+  it 'detects configuration, dependencies, harness and workflow changes' do
+    %w[flake.lock Gemfile Makefile .ruby-version servers/ruby/benchmarks/endpoints.rb
+       servers/ruby/test_support/performance_sqlite_fixture.rb clients/ruby/Gemfile clients/rust/Gemfile
+       doc/performance.md utils/performance_ci.rb .github/workflows/servers-ruby-performance.yml].each do |path|
+      expect(described_class::RELEVANT).to match(path)
+    end
+  end
+
+  it 'only accepts successful job completion in the aggregate gate' do
+    expect(described_class.aggregate!('success', 'compared')).to be(true)
+    expect(described_class.aggregate!('success', 'no-work')).to be(true)
+    %w[failure cancelled skipped unknown].each do |result|
+      expect { described_class.aggregate!(result, 'compared') }.to raise_error(described_class::Error)
+    end
+    [nil, '', 'unknown'].each do |outcome|
+      expect { described_class.aggregate!('success', outcome) }.to raise_error(described_class::Error)
+    end
+  end
+
+  it 'fails aggregate shell execution for missing outcomes and cancelled or skipped work' do
+    path = File.expand_path('../../../../.github/workflows/servers-ruby-performance.yml', __dir__)
+    script = YAML.load_file(path).fetch('jobs').fetch('gate').fetch('steps').first.fetch('run')
+    [['success', 'compared', true], ['success', 'no-work', true], ['success', '', false],
+     ['failure', 'compared', false], ['cancelled', 'compared', false], ['skipped', 'no-work', false]].each do |result, outcome, accepted|
+      _output, _error, status = Open3.capture3({ 'PERFORMANCE_RESULT' => result, 'PERFORMANCE_OUTCOME' => outcome },
+                                               'bash', '-e', '-c', script)
+      expect(status.success?).to eq(accepted), "#{result}/#{outcome}"
+    end
+  end
+
+  [0, 1, 3].each do |code|
+    it "preserves actual runner exit #{code} with a matching report" do
+      Dir.mktmpdir('haveapi-runner-wrapper-') do |directory|
+        checkout = File.join(directory, 'checkout')
+        FileUtils.mkdir_p(File.join(checkout, 'servers/ruby/benchmarks'))
+        script = <<~RUBY
+          require 'json'
+          require 'fileutils'
+          output = ARGV.fetch(ARGV.index('--output') + 1)
+          FileUtils.mkdir_p(output)
+          File.write(File.join(output, 'report.json'), JSON.generate(
+            schema_version: #{HaveAPI::Performance::SAMPLE_SCHEMA}, status: '#{{ 0 => 'pass', 1 => 'regression', 2 => 'inconclusive', 3 => 'error' }.fetch(code)}',
+            baseline_sha: '#{base}', candidate_sha: '#{candidate}'
+          ))
+          exit #{code}
+        RUBY
+        File.write(File.join(checkout, 'servers/ruby/benchmarks/endpoints.rb'), script)
+        allow(repository).to receive(:root).and_return(checkout)
+        allow(repository).to receive(:git).with('rev-parse', 'HEAD').and_return(candidate)
+        allow(repository).to receive(:git).with('diff', 'HEAD', '--').and_return('')
+        selection = { 'schema_version' => 1, 'relevant' => true, 'profile' => 'quick',
+                      'baseline_sha' => base, 'candidate_sha' => candidate }
+        campaign = described_class::Campaign.new(repository:, selection:,
+                                                 evidence: File.join(directory, 'evidence'), sources: File.join(directory, 'sources'))
+        allow(campaign).to receive(:export).with(:baseline, base).and_return(directory)
+        allow(campaign).to receive(:export).with(:candidate, candidate).and_return(directory)
+        allow(campaign).to receive_messages(verify_dependencies: nil, retain_inputs: nil, command!: nil)
+        expect(campaign.run).to eq(code)
+        expect(File.read(File.join(directory, 'evidence/runner.exit')).strip).to eq(code.to_s)
+      end
+    end
+  end
+
+  it 'returns error exit 3 from the actual resolver CLI on incomplete input' do
+    Dir.mktmpdir('haveapi-event-spec-') do |directory|
+      file = File.join(directory, 'event.json')
+      File.write(file, '{}')
+      script = File.expand_path('../../../../utils/performance_ci.rb', __dir__)
+      _output, error, status = Open3.capture3(RbConfig.ruby, script, 'resolve', '--event', file,
+                                              '--event-name', 'pull_request', '--event-sha', candidate,
+                                              '--repository', File.expand_path('../../../..', __dir__),
+                                              '--output', File.join(directory, 'selection.json'))
+      expect(status.exitstatus).to eq(3)
+      expect(error).to include('Incomplete event')
+      expect(File).not_to exist(File.join(directory, 'selection.json'))
+    end
+  end
+
+  it 'keeps the hosted workflow always-created, read-only and bounded' do
+    path = File.expand_path('../../../../.github/workflows/servers-ruby-performance.yml', __dir__)
+    workflow = YAML.load_file(path)
+    triggers = workflow.fetch('on') { workflow.fetch(true) }
+    expect(triggers.keys).to contain_exactly('push', 'pull_request', 'schedule', 'workflow_dispatch')
+    expect(triggers.fetch('push')).not_to have_key('paths')
+    expect(triggers.fetch('pull_request')).to be_nil
+    expect(triggers.fetch('schedule')).to eq([{ 'cron' => '0 3 * * 0' }])
+    expect(workflow.fetch('permissions')).to eq('contents' => 'read')
+    job = workflow.fetch('jobs').fetch('performance')
+    expect(job.fetch('runs-on')).to eq('ubuntu-24.04')
+    expect(job.fetch('timeout-minutes')).to include('45', '15')
+    gate = workflow.fetch('jobs').fetch('gate')
+    expect(gate).to include('name' => 'Performance gate', 'needs' => 'performance', 'if' => 'always()')
+    expect(gate.fetch('steps').first.fetch('run')).to include('test "$PERFORMANCE_RESULT" = success')
+    upload = job.fetch('steps').find { |step| step.fetch('uses', '').start_with?('actions/upload-artifact@') }
+    expect(upload).to include('if' => 'always()')
+    expect(upload.fetch('with')).to include('retention-days' => 30, 'if-no-files-found' => 'error')
+    job.fetch('steps').select { |step| step.fetch('uses', '').start_with?('actions/checkout@') }.each do |step|
+      expect(step.fetch('with')).to include('persist-credentials' => false, 'fetch-depth' => 0)
+    end
+  end
+end