haveapi 0.30.2 → 0.31.0

data/spec/documentation/client_examples_spec.rb

@@ -42,10 +42,10 @@ describe HaveAPI::ClientExample do
     expect(last_response.body).to include('Initialization', '<h4>Ruby</h4>', '<h4>PHP</h4>', '<h4>curl</h4>')
   end
 
-  it 'hides unconfigured Go and Rust SDKs in overview, initialization, authentication and actions' do
+  it 'hides unconfigured generated SDKs in overview, initialization, authentication and actions' do
     get '/v1/'
     expect(last_response.status).to eq(200)
-    expect(last_response.body).not_to include('clients/go', 'clients/rust', 'init-go', 'init-rust', '>Go</h', '>Rust (')
+    expect(last_response.body).not_to include('clients/go', 'clients/rust', 'init-go', 'init-rust', 'typescript-generated', '>Go</h', '>Rust (')
     expect(last_response.body).to include('init-javascript-callback', 'init-typescript-async', 'init-python-sync')
     expect(last_response.body).to include('example-widget-show-0-javascript-callback')
   end

data/spec/performance/comparator_spec.rb

@@ -4,12 +4,12 @@ require 'open3'
 require_relative 'support/samples'
 
 describe HaveAPI::Performance::Comparator do
-  def compare_cli(samples, budgets)
+  def compare_cli(samples, budgets, sample_bytes: JSON.generate(samples))
     Dir.mktmpdir('haveapi-comparator-') do |directory|
       input = File.join(directory, 'samples.json')
       policy = File.join(directory, 'budgets.json')
       output = File.join(directory, 'result')
-      File.write(input, JSON.generate(samples))
+      File.binwrite(input, sample_bytes)
       File.write(policy, budgets)
       _stdout, _stderr, status = Open3.capture3(RbConfig.ruby, File.expand_path('../../benchmarks/endpoints.rb', __dir__),
                                                 'compare', '--input', input, '--budgets', policy, '--output', output)
@@ -25,6 +25,14 @@ describe HaveAPI::Performance::Comparator do
     output.merge!('body_sha256' => digest, 'body_bytes' => body.bytesize)
   end
 
+  def replace_response(sample, body, json: true)
+    replace_raw_body(sample, body)
+    canonical = json ? JSON.parse(body) : nil
+    sample['bodies'].values.first['canonical_body'] = canonical
+    sample['outputs'].first.merge!('envelope_status' => json ? canonical.fetch('status') : nil,
+                                   'canonical_sha256' => json ? HaveAPI::Performance::Identity.digest(canonical) : Digest::SHA256.hexdigest(body))
+  end
+
   def rebind_source(samples, role, sha)
     samples["#{role}_sha"] = sha
     samples['sources'][role]['sha'] = sha
@@ -44,6 +52,99 @@ describe HaveAPI::Performance::Comparator do
     expect(JSON.generate(report)).not_to include('canonical_body', 'body_sha256', 'self_pairs', 'observations', 'loaded_sources')
   end
 
+  it 'attributes replay success and loaded-input errors to exact input/comparator bytes and the original measurement harness' do
+    samples, budgets = PerformanceSamples.fixture
+    [false, true].each do |broken|
+      samples['schema_version'] = broken ? 1 : 2
+      bytes = "#{JSON.pretty_generate(samples)}\n"
+      code, report = compare_cli(samples, budgets, sample_bytes: bytes)
+      expect(code).to eq(broken ? 3 : 0)
+      expect(report['harness_sha256']).to eq('e' * 64)
+      expect(report.values_at('baseline_sha', 'candidate_sha', 'budget_sha256')).to eq(samples.values_at('baseline_sha', 'candidate_sha', 'budget_sha256'))
+      expect(report['comparison']).to eq('policy' => 'per-revision-response-stability-v1',
+                                         'comparator_sha256' => Digest::SHA256.file(File.expand_path('../../benchmarks/performance_compare.rb', __dir__)).hexdigest,
+                                         'samples_sha256' => Digest::SHA256.hexdigest(bytes))
+    end
+    code, report = compare_cli(samples, budgets, sample_bytes: '{')
+    expect(code).to eq(3)
+    expect(report).not_to have_key('harness_sha256')
+    expect(report.dig('comparison', 'samples_sha256')).to eq(Digest::SHA256.hexdigest('{'))
+  end
+
+  it 'classifies stable changed JSON and HTML normally without changing performance budgets' do
+    samples, budgets = PerformanceSamples.fixture
+    samples['cases'].each do |item|
+      html = item['id'].start_with?('docs.')
+      (item['self_pairs'] + item['pairs']).each do |pair|
+        %w[baseline candidate].each do |role|
+          actual = samples['observations'][pair[role]['observation']]['source']['sha']
+          value = actual == samples['baseline_sha'] ? 'before' : 'after'
+          body = html ? "<!doctype html><html><body>#{value}</body></html>" : JSON.generate(status: true, response: value)
+          replace_response(pair[role], body, json: !html)
+        end
+      end
+    end
+    code, report = compare_cli(samples, budgets)
+    expect(code).to eq(0)
+    expect(report['status']).to eq('pass')
+    expect(report['cases'].map { |item| item['responses'].slice('raw_changed', 'canonical_changed') }).to all(eq('raw_changed' => true, 'canonical_changed' => true))
+    %w[wall_seconds cpu_seconds allocated_objects].each do |metric|
+      changed = Marshal.load(Marshal.dump(samples))
+      changed['cases'].first['pairs'].each { |pair| pair['candidate'][metric] = metric == 'allocated_objects' ? 140 : 3.0 }
+      regression_code, regression_report = compare_cli(changed, budgets)
+      expect(regression_code).to eq(1), metric
+      expect(regression_report['status']).to eq('regression')
+    end
+  end
+
+  it 'rejects canonical variation within a source including the second baseline/self column' do
+    %w[self_pairs pairs].each do |group|
+      samples, budgets = PerformanceSamples.fixture
+      replace_response(samples['cases'].first[group].last['candidate'], '{"status":true,"response":"changed"}')
+      code, report = compare_cli(samples, budgets)
+      expect(code).to eq(3)
+      expected_sha = samples[group == 'self_pairs' ? 'baseline_sha' : 'candidate_sha']
+      expect(report.dig('error', 'message')).to eq("Response identity differs within revision #{expected_sha}")
+    end
+  end
+
+  it 'replays benchmark inputs with different unused contributor flakes and rejects tampered consumed or source inputs' do
+    %w[quick weekly].each do |profile|
+      samples, budgets = PerformanceSamples.fixture(profile:)
+      tool = HaveAPI::Performance::BENCHMARK_INPUTS.to_h do |path|
+        content = "controlled #{path}\n"
+        [path, { 'content' => content, 'sha256' => Digest::SHA256.hexdigest(content) }]
+      end
+      samples.fetch('observations').each_value do |observation|
+        role = observation.fetch('source').fetch('sha') == samples['baseline_sha'] ? 'baseline' : 'candidate'
+        inputs = Marshal.load(Marshal.dump(observation.fetch('inputs')))
+        inputs['benchmark'] = tool
+        inputs['locks'] = { 'servers/ruby/benchmarks/Gemfile.lock' => tool.fetch('servers/ruby/benchmarks/Gemfile.lock').fetch('sha256') }
+        inputs['contributor_flakes'] = %w[flake.nix flake.lock].to_h { |path| [path, { 'content' => "#{role} #{path}" }] }
+        inputs['contributor_flakes'].each do |path, input|
+          samples['sources'][role]['files_sha256'][path] = Digest::SHA256.hexdigest(input.fetch('content'))
+        end
+        inputs['manifests']['.ruby-version'] = Digest::SHA256.hexdigest('3.2.0')
+        samples['sources'][role]['files_sha256']['.ruby-version'] = inputs['manifests']['.ruby-version']
+        observation['inputs'] = inputs
+      end
+      samples['inputs'] = HaveAPI::Performance::Release.graph(samples['observations']['baseline']['inputs'])
+      expect(compare_cli(samples, budgets).first).to eq(0)
+      %w[tool lock raw-flake declaration ruby].each do |fault|
+        changed = Marshal.load(Marshal.dump(samples))
+        inputs = changed['observations']['candidate']['inputs']
+        case fault
+        when 'tool' then inputs['benchmark']['servers/ruby/benchmarks/shell.nix']['content'] << 'tampered'
+        when 'lock' then inputs['locks']['servers/ruby/benchmarks/Gemfile.lock'] = 'f' * 64
+        when 'raw-flake' then inputs['contributor_flakes']['flake.nix']['content'] << 'tampered'
+        when 'declaration' then inputs['manifests']['servers/ruby/Gemfile'] = 'f' * 64
+        else inputs['manifests']['.ruby-version'] = 'f' * 64
+        end
+        expect(compare_cli(changed, budgets).first).to eq(3), "#{profile}:#{fault}"
+      end
+    end
+  end
+
   it 'rejects unsupported sample formats without converting historical evidence' do
     samples, budgets = PerformanceSamples.fixture
     samples['schema_version'] = 1
@@ -170,7 +271,7 @@ describe HaveAPI::Performance::Comparator do
     end
   end
 
-  it 'compares response occurrence totals across revisions without retaining request order' do
+  it 'compares response occurrence totals within each revision without retaining request order' do
     samples, json = PerformanceSamples.fixture
     spec = samples['cases'].first
     spec['iterations'] = 3
@@ -178,7 +279,7 @@ describe HaveAPI::Performance::Comparator do
       %w[baseline candidate].each do |role|
         sample = pair[role]
         output = sample['outputs'].first
-        body = sample['bodies'].values.first['body'].sub('"zero":0', '"zero":1')
+        body = sample['bodies'].values.first['body'].sub('"zero":0', '"zero":100')
         canonical = JSON.parse(body)
         digest = Digest::SHA256.hexdigest(body)
         sample['bodies'][digest] = { 'body' => body, 'canonical_body' => canonical }
@@ -189,9 +290,16 @@ describe HaveAPI::Performance::Comparator do
       end
     end
     comparator = described_class.new(samples, JSON.parse(json), budget_sha256: samples['budget_sha256'])
-    expect(comparator.compare['status']).to eq('pass')
+    report = comparator.compare
+    expect(report['status']).to eq('pass')
+    original_bytes = spec['pairs'].first['baseline']['outputs'].first['body_bytes']
+    expect(report['cases'].first.dig('responses', 'bytes_per_request', 'baseline')).to be_within(0.00001).of(original_bytes + (4.0 / 3))
     spec['pairs'].last['candidate']['outputs'].reverse!
     expect(comparator.compare['status']).to eq('pass')
+    spec['pairs'].each { |pair| pair['candidate']['outputs'].each { |example| example['count'] = 3 - example['count'] } }
+    report = comparator.compare
+    expect(report['status']).to eq('pass')
+    expect(report['cases'].first.dig('responses', 'canonical_changed')).to be(true)
     spec['pairs'].last['candidate']['outputs'].each { |example| example['count'] = 3 - example['count'] }
     expect { comparator.compare }.to raise_error(HaveAPI::Performance::ContractError, /Response identity/)
   end
@@ -226,7 +334,29 @@ describe HaveAPI::Performance::Comparator do
     body = JSON.parse(target['bodies'].values.first['body'])
     body['response'] = body['response'].to_a.reverse.to_h
     replace_raw_body(target, JSON.generate(body.to_a.reverse.to_h))
-    expect(compare_cli(samples, budgets).first).to eq(0)
+    code, report = compare_cli(samples, budgets)
+    expect(code).to eq(0)
+    expect(report['cases'].first['responses']).to include('raw_changed' => true, 'canonical_changed' => false)
+    expect(report['cases'].first.dig('responses', 'bytes_per_request', 'delta')).to eq(0)
+  end
+
+  it 'reports weighted byte deltas from baseline/candidate pairs without self-pair bias or a raw determinism requirement' do
+    samples, budgets = PerformanceSamples.fixture
+    item = samples['cases'].first
+    baseline_bytes = item['pairs'].first['baseline']['outputs'].first['body_bytes']
+    item['self_pairs'].each do |pair|
+      %w[baseline candidate].each { |role| replace_raw_body(pair[role], " #{pair[role]['bodies'].values.first['body']}") }
+    end
+    item['pairs'].last(2).each do |pair|
+      replace_raw_body(pair['candidate'], "  #{pair['candidate']['bodies'].values.first['body']}")
+    end
+    code, report = compare_cli(samples, budgets)
+    expect(code).to eq(0)
+    response = report['cases'].first['responses']
+    expect(response).to include('raw_changed' => true, 'canonical_changed' => false)
+    expect(response['bytes_per_request']).to include('baseline' => baseline_bytes, 'candidate' => baseline_bytes + 0.8)
+    expect(response['bytes_per_request']['delta']).to be_within(0.00001).of(0.8)
+    expect(response['bytes_per_request']['delta_percent']).to be_within(0.00001).of(80.0 / baseline_bytes)
   end
 
   it 'rejects identical source SHAs even with consistently rebound provenance' do

data/spec/performance/event_baseline_spec.rb

@@ -3,6 +3,7 @@ require 'open3'
 require 'tmpdir'
 require 'yaml'
 require_relative '../../../../utils/performance_ci'
+require_relative 'support/samples'
 
 RSpec.describe HaveAPI::PerformanceCI do
   let(:candidate) { sha('c') }
@@ -43,27 +44,111 @@ RSpec.describe HaveAPI::PerformanceCI do
     expect(result).to include(candidate_sha: candidate, baseline_sha: base, profile: 'quick', relevant: true)
   end
 
-  it 'compares an entire default-branch push batch against event before' do
-    event.merge!('ref' => 'refs/heads/master', 'after' => candidate, 'before' => base)
-    allow(repository).to receive(:merge_base)
+  %w[master feature].each do |branch|
+    it "compares the exact #{branch} push batch against event before" do
+      event.merge!('ref' => "refs/heads/#{branch}", 'after' => candidate, 'before' => base)
+      allow(repository).to receive(:merge_base)
+
+      expect(resolve('push', event)).to include(baseline_sha: base, candidate_sha: candidate,
+                                                reason: 'push event before/after batch',
+                                                push_pair: { 'event_name' => 'push', 'before' => base, 'after' => candidate })
+      expect(repository).to have_received(:paths).with(base, candidate)
+      expect(repository).not_to have_received(:merge_base)
+    end
+
+    it "permits a nonancestor #{branch} rewrite only for the exact pushed pair" do
+      event.merge!('ref' => "refs/heads/#{branch}", 'after' => candidate, 'before' => base, 'forced' => true)
+      allow(repository).to receive(:ancestor?).with(base, candidate).and_return(false)
+      allow(repository).to receive(:merge_base)
 
-    expect(resolve('push', event)).to include(baseline_sha: base, candidate_sha: candidate)
-    expect(repository).not_to have_received(:merge_base)
+      result = resolver.resolve(event_name: 'push', event:, event_sha: sha('e'))
+      expect(result).to include(baseline_sha: base, candidate_sha: candidate,
+                                push_pair: { 'event_name' => 'push', 'before' => base, 'after' => candidate })
+      expect(repository).to have_received(:paths).with(base, candidate)
+      expect(repository).not_to have_received(:merge_base)
+    end
   end
 
-  [false, true].each do |new_branch|
-    it "uses the whole feature merge-base for a #{new_branch ? 'new' : 'subsequent'} push" do
+  [false, true].each do |created|
+    it "uses the captured default merge-base for a zero-before push with created=#{created}" do
       event.merge!('ref' => 'refs/heads/feature', 'after' => candidate,
-                   'before' => new_branch ? '0' * 40 : sha('a'), 'created' => new_branch)
+                   'before' => '0' * 40, 'created' => created)
       allow(repository).to receive(:merge_base).with(candidate, default).and_return(base)
 
-      expect(resolve('push', event, default_sha: default)).to include(baseline_sha: base, captured_default_sha: default)
+      result = resolve('push', event, default_sha: default)
+      expect(result).to include(baseline_sha: base, captured_default_sha: default,
+                                reason: 'new-branch merge-base against captured default')
+      expect(result[:push_pair]).to be_nil
+      expect(repository).to have_received(:paths).with(base, candidate)
     end
   end
 
-  it 'rejects initial default-branch pushes without an available predecessor' do
+  it 'does not guess a fallback when the captured default commit is unavailable' do
+    event.merge!('ref' => 'refs/heads/feature', 'after' => candidate, 'before' => '0' * 40)
+    allow(repository).to receive(:commit!).with(default).and_raise(described_class::Error, 'unavailable default')
+    expect { resolve('push', event, default_sha: default) }.to raise_error(described_class::Error, /unavailable default/)
+  end
+
+  it 'rejects a new branch whose captured-default merge-base equals its head' do
     event.merge!('ref' => 'refs/heads/master', 'after' => candidate, 'before' => '0' * 40)
+    allow(repository).to receive(:merge_base).with(candidate, default).and_return(candidate)
+    expect { resolve('push', event) }.to raise_error(described_class::Error, /differ/)
+  end
+
+  it 'does not replace an unavailable new-branch merge-base with another commit' do
+    event.merge!('ref' => 'refs/heads/feature', 'after' => candidate, 'before' => '0' * 40)
+    allow(repository).to receive(:merge_base).with(candidate, default).and_raise(described_class::Error, 'no merge-base')
+    expect { resolve('push', event) }.to raise_error(described_class::Error, /no merge-base/)
+  end
+
+  it 'requires ancestry for the new-branch fallback instead of granting a push-pair exception' do
+    event.merge!('ref' => 'refs/heads/feature', 'after' => candidate, 'before' => '0' * 40)
+    allow(repository).to receive(:merge_base).with(candidate, default).and_return(base)
+    allow(repository).to receive(:ancestor?).with(base, candidate).and_return(false)
+    expect { resolve('push', event) }.to raise_error(described_class::Error, /ancestor/)
+  end
+
+  it 'does not grant the quick push exception to a weekly push profile' do
+    event.merge!('ref' => 'refs/heads/feature', 'after' => candidate, 'before' => described_class::REFERENCE,
+                 'inputs' => { 'profile' => 'weekly' })
+    allow(repository).to receive(:ancestor?).with(described_class::REFERENCE, candidate).and_return(false)
+    expect { resolve('push', event) }.to raise_error(described_class::Error, /ancestor/)
+  end
+
+  %w[before after].each do |endpoint|
+    [nil, '', 'short', 'A' * 40].each do |invalid|
+      it "rejects an invalid push #{endpoint} #{invalid.inspect}" do
+        event.merge!('ref' => 'refs/heads/feature', 'before' => base, 'after' => candidate, endpoint => invalid)
+        expect { resolve('push', event) }.to raise_error(described_class::Error)
+        expect(repository).not_to have_received(:paths)
+      end
+    end
+
+    it "rejects a missing push #{endpoint}" do
+      event.merge!('ref' => 'refs/heads/feature', 'before' => base, 'after' => candidate)
+      event.delete(endpoint)
+      expect { resolve('push', event) }.to raise_error(described_class::Error)
+      expect(repository).not_to have_received(:paths)
+    end
+
+    %w[noncommit unavailable].each do |failure|
+      it "rejects a #{failure} push #{endpoint} without substituting a merge-base" do
+        event.merge!('ref' => 'refs/heads/feature', 'before' => base, 'after' => candidate)
+        allow(repository).to receive(:commit!).with(event.fetch(endpoint)).and_raise(described_class::Error, failure)
+        allow(repository).to receive(:merge_base)
+        expect { resolve('push', event) }.to raise_error(described_class::Error, failure)
+        expect(repository).not_to have_received(:merge_base)
+        expect(repository).not_to have_received(:paths)
+      end
+    end
+  end
+
+  it 'rejects zero after and equal push endpoints' do
+    event.merge!('ref' => 'refs/heads/feature', 'before' => base, 'after' => '0' * 40)
     expect { resolve('push', event) }.to raise_error(described_class::Error)
+    event['after'] = base
+    expect { resolve('push', event) }.to raise_error(described_class::Error, /differ/)
+    expect(repository).not_to have_received(:paths)
   end
 
   context 'with the verified maintenance lineage' do
@@ -83,22 +168,28 @@ RSpec.describe HaveAPI::PerformanceCI do
     it 'compares the complete maintenance push batch using event before' do
       event.merge!('ref' => 'refs/heads/haveapi-0.30', 'before' => base, 'after' => candidate)
       expect(resolve('push', event)).to include(baseline_sha: base, candidate_sha: candidate,
-                                                release_lineage: lineage, reason: 'maintenance event before/after batch')
+                                                release_lineage: lineage, reason: 'push event before/after batch',
+                                                push_pair: { 'event_name' => 'push', 'before' => base, 'after' => candidate })
     end
 
-    [false, true].each do |created|
-      it "captures the release head for a #{created ? 'new' : 'subsequent'} release feature" do
-        event.merge!('ref' => 'refs/heads/feature', 'before' => created ? '0' * 40 : sha('a'), 'after' => candidate)
-        allow(repository).to receive(:merge_base).with(candidate, release).and_return(base)
-        expect(resolve('push', event)).to include(baseline_sha: base, captured_release_sha: release,
-                                                  captured_default_sha: default, release_lineage: lineage)
-      end
+    it 'permits a proven maintenance rewrite with the exact push pair' do
+      event.merge!('ref' => 'refs/heads/haveapi-0.30', 'before' => base, 'after' => candidate, 'forced' => true)
+      allow(repository).to receive(:ancestor?).with(base, candidate).and_return(false)
+      expect(resolve('push', event)).to include(baseline_sha: base, candidate_sha: candidate, release_lineage: lineage,
+                                                push_pair: { 'event_name' => 'push', 'before' => base, 'after' => candidate })
     end
 
-    it 'fails if the captured release reference is unavailable' do
-      event.merge!('ref' => 'refs/heads/feature', 'after' => candidate)
-      allow(repository).to receive(:default_sha).with('haveapi-0.30').and_raise(described_class::Error, 'missing release ref')
-      expect { resolve('push', event) }.to raise_error(described_class::Error, /missing release ref/)
+    it 'uses exact before for an existing maintenance feature without looking up a release head' do
+      event.merge!('ref' => 'refs/heads/feature', 'before' => base, 'after' => candidate)
+      expect(resolve('push', event)).to include(baseline_sha: base, candidate_sha: candidate, release_lineage: lineage)
+      expect(repository).not_to have_received(:default_sha).with('haveapi-0.30')
+    end
+
+    it 'uses the captured default merge-base for a new maintenance feature' do
+      event.merge!('ref' => 'refs/heads/feature', 'before' => '0' * 40, 'after' => candidate)
+      allow(repository).to receive(:merge_base).with(candidate, default).and_return(base)
+      expect(resolve('push', event)).to include(baseline_sha: base, captured_default_sha: default, release_lineage: lineage)
+      expect(repository).not_to have_received(:default_sha).with('haveapi-0.30')
     end
 
     it 'accepts only the original weekly reference through the proven mapping' do
@@ -137,6 +228,15 @@ RSpec.describe HaveAPI::PerformanceCI do
     expect { resolve('workflow_dispatch', event) }.to raise_error(described_class::Error, /differ/)
   end
 
+  it 'does not extend the push exception to pull requests or schedules' do
+    event['pull_request'] = { 'head' => { 'sha' => candidate }, 'base' => { 'sha' => default } }
+    allow(repository).to receive(:merge_base).with(candidate, default).and_return(base)
+    allow(repository).to receive(:ancestor?).with(base, candidate).and_return(false)
+    expect { resolve('pull_request', event) }.to raise_error(described_class::Error, /ancestor/)
+    allow(repository).to receive(:ancestor?).with(described_class::REFERENCE, candidate).and_return(false)
+    expect { resolve('schedule', event) }.to raise_error(described_class::Error, /ancestor/)
+  end
+
   it 'uses the exact scheduled event SHA and preserves fixed reference ancestry' do
     expect(resolve('schedule', event)).to include(candidate_sha: candidate, baseline_sha: described_class::REFERENCE, profile: 'weekly')
     expect(repository).to have_received(:ancestor?).with(described_class::REFERENCE, candidate)
@@ -178,6 +278,7 @@ RSpec.describe HaveAPI::PerformanceCI do
 
   it 'detects configuration, dependencies, harness and workflow changes' do
     %w[flake.lock Gemfile Makefile .ruby-version servers/ruby/benchmarks/endpoints.rb
+       servers/ruby/benchmarks/Gemfile servers/ruby/benchmarks/Gemfile.lock servers/ruby/benchmarks/shell.nix
        servers/ruby/test_support/performance_sqlite_fixture.rb clients/ruby/Gemfile clients/rust/Gemfile
        doc/performance.md utils/performance_ci.rb .github/workflows/servers-ruby-performance.yml].each do |path|
       expect(described_class::RELEVANT).to match(path)
@@ -206,20 +307,30 @@ RSpec.describe HaveAPI::PerformanceCI do
     end
   end
 
-  [0, 1, 3].each do |code|
-    it "preserves actual runner exit #{code} with a matching report" do
+  [[0, 'pass', false], [0, 'inconclusive', false], [1, 'regression', false], [3, 'error', false], [0, 'pass', true]].each do |code, outcome, rewrite|
+    it "preserves actual runner exit #{code}/#{outcome} and writes its summary#{' for a nonancestor push' if rewrite}" do
       Dir.mktmpdir('haveapi-runner-wrapper-') do |directory|
         checkout = File.join(directory, 'checkout')
         FileUtils.mkdir_p(File.join(checkout, 'servers/ruby/benchmarks'))
+        samples, budget_json = PerformanceSamples.fixture
+        report = HaveAPI::Performance::Comparator.new(samples, JSON.parse(budget_json), budget_sha256: samples['budget_sha256']).compare
+        report.merge!('status' => outcome, 'baseline_sha' => base, 'candidate_sha' => candidate)
+        item = report['cases'].first
+        item['classification'] = outcome
+        item['timing']['wall_seconds']['classification'] = outcome
+        item['responses']['raw_changed'] = true
+        item['responses']['bytes_per_request'].merge!('baseline' => 100.0, 'candidate' => 112.0, 'delta' => 12.0, 'delta_percent' => 12.0)
+        summary_path = File.join(directory, 'summary.md')
+        allow(ENV).to receive(:[]).and_call_original
+        allow(ENV).to receive(:fetch).and_call_original
+        allow(ENV).to receive(:[]).with('GITHUB_STEP_SUMMARY').and_return(summary_path)
+        allow(ENV).to receive(:fetch).with('GITHUB_STEP_SUMMARY').and_return(summary_path)
         script = <<~RUBY
           require 'json'
           require 'fileutils'
           output = ARGV.fetch(ARGV.index('--output') + 1)
           FileUtils.mkdir_p(output)
-          File.write(File.join(output, 'report.json'), JSON.generate(
-            schema_version: #{HaveAPI::Performance::SAMPLE_SCHEMA}, status: '#{{ 0 => 'pass', 1 => 'regression', 2 => 'inconclusive', 3 => 'error' }.fetch(code)}',
-            baseline_sha: '#{base}', candidate_sha: '#{candidate}'
-          ))
+          File.write(File.join(output, 'report.json'), #{JSON.generate(report).dump})
           exit #{code}
         RUBY
         File.write(File.join(checkout, 'servers/ruby/benchmarks/endpoints.rb'), script)
@@ -228,6 +339,10 @@ RSpec.describe HaveAPI::PerformanceCI do
         allow(repository).to receive(:git).with('diff', 'HEAD', '--').and_return('')
         selection = { 'schema_version' => 1, 'relevant' => true, 'profile' => 'quick',
                       'baseline_sha' => base, 'candidate_sha' => candidate }
+        if rewrite
+          selection.merge!('event_name' => 'push', 'push_pair' => { 'event_name' => 'push', 'before' => base, 'after' => candidate })
+          allow(repository).to receive(:ancestor?).with(base, candidate).and_return(false)
+        end
         campaign = described_class::Campaign.new(repository:, selection:,
                                                  evidence: File.join(directory, 'evidence'), sources: File.join(directory, 'sources'))
         allow(campaign).to receive(:export).with(:baseline, base).and_return(directory)
@@ -235,6 +350,19 @@ RSpec.describe HaveAPI::PerformanceCI do
         allow(campaign).to receive_messages(verify_dependencies: nil, retain_inputs: nil, command!: nil)
         expect(campaign.run).to eq(code)
         expect(File.read(File.join(directory, 'evidence/runner.exit')).strip).to eq(code.to_s)
+        summary = File.read(summary_path)
+        expect(summary).to include("Performance comparison: #{outcome}", base, candidate)
+        if outcome == 'error'
+          expect(summary).not_to include('Bytes/request')
+        else
+          expect(summary).to include("| api.public_get {} | #{outcome} | #{outcome} | pass | pass | true | false | 100.00 → 112.00 | +12.00 (+12.00%) |")
+        end
+        if rewrite
+          push_event = File.join(directory, 'evidence/push-event.json')
+          expect(JSON.parse(File.read(push_event))).to eq(selection)
+          command = JSON.parse(File.read(File.join(directory, 'evidence/runner-command.json')))
+          expect(command.last(2)).to eq(['--push-event', push_event])
+        end
       end
     end
   end

data/spec/performance/release_lineage_spec.rb

@@ -76,7 +76,7 @@ describe HaveAPI::Performance::Release do
 
   def contents(version, profile: 'quick')
     original = described_class.paths(profile).to_h { |path| [path, File.read(File.join(root, path))] }
-    own = described_class.version(original)
+    own = original.fetch('VERSION').strip
     original.to_h do |path, value|
       value = "#{version}\n" if path == 'VERSION'
       value = value.sub("VERSION = '#{own}'", "VERSION = '#{version}'") if described_class::VERSIONS.has_key?(path)
@@ -85,6 +85,16 @@ describe HaveAPI::Performance::Release do
     end
   end
 
+  def with_maintenance_source
+    Dir.mktmpdir('haveapi-maintenance-source-') do |source|
+      contents('0.30.2').each do |path, value|
+        FileUtils.mkdir_p(File.dirname(File.join(source, path)))
+        File.write(File.join(source, path), value)
+      end
+      yield source
+    end
+  end
+
   it 'verifies the complete published binary delta and all four exact trees in an owned history' do
     expect(proof).to include('reference_sha' => HaveAPI::Performance::REFERENCE, 'mapped_sha' => described_class::MAPPED,
                              'metadata_sha' => described_class::METADATA, 'trees' => described_class::TREES)
@@ -150,6 +160,8 @@ describe HaveAPI::Performance::Release do
                                            '--baseline-root', root, '--candidate-root', root,
                                            '--budgets', 'unused', '--output', 'unused'])
       cli.send(:parse)
+      allow(cli).to receive(:verify_runtime)
+      allow(HaveAPI::Performance).to receive(:gemspec)
       allow(cli).to receive(:verify_source) { |role| { root: "/controlled/#{role}", sha: head } }
       allow(cli).to receive(:git) { |*arguments| repository.git(*arguments) }
       allow(cli).to receive(:ancestor?) { |left, right| repository.ancestor?(left, right) }
@@ -190,7 +202,20 @@ describe HaveAPI::Performance::Release do
     end
   end
 
+  it 'builds maintenance fixtures from a later minor source template without broadening the release guard' do
+    Dir.mktmpdir('haveapi-later-minor-template-') do |template|
+      contents('0.32.0').each do |path, value|
+        FileUtils.mkdir_p(File.dirname(File.join(template, path)))
+        File.write(File.join(template, path), value)
+      end
+      allow(self).to receive(:root).and_return(template)
+      expect(described_class.capture(contents('0.30.2')).fetch('own_version')).to eq('0.30.2')
+      expect { described_class.capture(contents('0.32.0')) }.to raise_error(error, /Expected own 0\.30 patch version/)
+    end
+  end
+
   it 'rejects mismatched own constants, package names, constraints and minor versions' do
+    expect { described_class.capture(contents('0.31.0')) }.to raise_error(error, /Expected own 0\.30 patch version/)
     [
       ['VERSION', "0.31.2\n"],
       ['VERSION', " 0.30.2\n"],
@@ -211,7 +236,6 @@ describe HaveAPI::Performance::Release do
       File.write(File.join(harness, 'servers/ruby/Gemfile.lock'), "controlled server lock\n")
       FileUtils.mkdir_p(File.join(harness, 'clients/rust'))
       File.write(File.join(harness, 'clients/rust/Gemfile.lock'), "controlled Rust lock\n")
-      stub_const('HaveAPI::RustClient::VERSION', HaveAPI::VERSION) unless defined?(HaveAPI::RustClient::VERSION)
       stub_const('HaveAPI::Performance::ROOT', harness)
       ordinary = JSON.parse(JSON.generate(HaveAPI::Performance::Worker.inputs(root, 'quick')))
       preparation = ordinary.fetch('json_preparation')
@@ -220,10 +244,23 @@ describe HaveAPI::Performance::Release do
       expect do
         described_class.validate_json_preparation(ordinary, 'files_sha256' => preparation.fetch('raw_sha256'))
       end.not_to raise_error
-      captured = HaveAPI::Performance::Worker.inputs(root, 'quick', release: true)
-      expect(captured[:locks]).to have_key('clients/rust/Gemfile.lock')
-      expect(captured[:manifests]).to have_key('clients/rust/Gemfile')
-      expect(captured.fetch(:release_versions)).to eq(described_class.capture(contents(File.read(File.join(root, 'VERSION')).strip)))
+      %w[HaveAPI::VERSION HaveAPI::Client::VERSION HaveAPI::RustClient::VERSION].each do |name|
+        stub_const(name, '0.30.2')
+      end
+      HaveAPI::Performance::BENCHMARK_INPUTS.each do |path|
+        FileUtils.mkdir_p(File.dirname(File.join(harness, path)))
+        FileUtils.cp(File.join(root, path), File.join(harness, path))
+      end
+      with_maintenance_source do |source|
+        captured = HaveAPI::Performance::Worker.inputs(source, 'quick', release: true)
+        expect(captured[:locks]).to have_key('clients/rust/Gemfile.lock')
+        expect(captured[:manifests]).to have_key('clients/rust/Gemfile')
+        expect(captured.fetch(:release_versions)).to eq(described_class.capture(contents('0.30.2')))
+        benchmark = JSON.parse(JSON.generate(HaveAPI::Performance::Worker.inputs(source, 'quick', release: true, benchmark: true)))
+        expect(benchmark.fetch('manifests')).not_to have_key('flake.lock')
+        expect(benchmark.fetch('contributor_flakes')).to have_key('flake.lock')
+        expect(described_class.validate_inputs(benchmark, { 'files_sha256' => benchmark.fetch('release_versions').fetch('raw_sha256') }, 'quick')).to eq('0.30.2')
+      end
       Dir.mktmpdir('haveapi-release-inputs-') do |source|
         contents('0.30.99').each do |path, value|
           FileUtils.mkdir_p(File.dirname(File.join(source, path)))
@@ -340,7 +377,7 @@ describe HaveAPI::Performance::Release do
   end
 
   it 'normalizes the actual worker HTML outside timing and retains its raw bytes' do
-    own = File.read(File.join(root, 'VERSION')).strip
+    own = '0.30.2'
     body = "<a href=\"https://webui.haveapi.org/v#{own}/#api\">Connect</a>#{framework_footer(own)}"
     scenario = HaveAPI::Performance::DocumentationScenario.allocate
     allow(scenario).to receive(:reset!)
@@ -348,13 +385,15 @@ describe HaveAPI::Performance::Release do
                                         validate!: { http_status: 200, envelope_status: nil, body_bytes: body.bytesize,
                                                      body_sha256: Digest::SHA256.hexdigest(body), canonical_sha256: Digest::SHA256.hexdigest(body) },
                                         counters: { operations: [{ queries: 0, authorizations: 0, executions: 0 }] })
-    worker = HaveAPI::Performance::Worker.new('source_root' => root, 'release_versions' => true)
-    worker.instance_variable_set(:@current_workload, 'docs.html_resources')
-    result = worker.measure(scenario, 1)
-    output = result.fetch(:outputs).first
-    expect(output.fetch('comparison')).to include('own_version' => File.read(File.join(root, 'VERSION')).strip)
-    expect(result.fetch(:bodies).values.first.fetch(:body)).to eq(body)
-    expect(output.fetch('canonical_sha256')).to eq(Digest::SHA256.hexdigest(described_class.html(body, output['comparison']['own_version'])))
+    with_maintenance_source do |source|
+      worker = HaveAPI::Performance::Worker.new('source_root' => source, 'release_versions' => true)
+      worker.instance_variable_set(:@current_workload, 'docs.html_resources')
+      result = worker.measure(scenario, 1)
+      output = result.fetch(:outputs).first
+      expect(output.fetch('comparison')).to include('own_version' => own)
+      expect(result.fetch(:bodies).values.first.fetch(:body)).to eq(body)
+      expect(output.fetch('canonical_sha256')).to eq(Digest::SHA256.hexdigest(described_class.html(body, output['comparison']['own_version'])))
+    end
   end
 
   it 'leaves lookalike attributes, other URLs, JSON and example code byte exact' do