haveapi 0.30.2 → 0.31.1

data/spec/performance/event_baseline_spec.rb

@@ -3,6 +3,7 @@ require 'open3'
 require 'tmpdir'
 require 'yaml'
 require_relative '../../../../utils/performance_ci'
+require_relative 'support/samples'
 
 RSpec.describe HaveAPI::PerformanceCI do
   let(:candidate) { sha('c') }
@@ -43,27 +44,111 @@ RSpec.describe HaveAPI::PerformanceCI do
     expect(result).to include(candidate_sha: candidate, baseline_sha: base, profile: 'quick', relevant: true)
   end
 
-  it 'compares an entire default-branch push batch against event before' do
-    event.merge!('ref' => 'refs/heads/master', 'after' => candidate, 'before' => base)
-    allow(repository).to receive(:merge_base)
+  %w[master feature].each do |branch|
+    it "compares the exact #{branch} push batch against event before" do
+      event.merge!('ref' => "refs/heads/#{branch}", 'after' => candidate, 'before' => base)
+      allow(repository).to receive(:merge_base)
+
+      expect(resolve('push', event)).to include(baseline_sha: base, candidate_sha: candidate,
+                                                reason: 'push event before/after batch',
+                                                push_pair: { 'event_name' => 'push', 'before' => base, 'after' => candidate })
+      expect(repository).to have_received(:paths).with(base, candidate)
+      expect(repository).not_to have_received(:merge_base)
+    end
+
+    it "permits a nonancestor #{branch} rewrite only for the exact pushed pair" do
+      event.merge!('ref' => "refs/heads/#{branch}", 'after' => candidate, 'before' => base, 'forced' => true)
+      allow(repository).to receive(:ancestor?).with(base, candidate).and_return(false)
+      allow(repository).to receive(:merge_base)
 
-    expect(resolve('push', event)).to include(baseline_sha: base, candidate_sha: candidate)
-    expect(repository).not_to have_received(:merge_base)
+      result = resolver.resolve(event_name: 'push', event:, event_sha: sha('e'))
+      expect(result).to include(baseline_sha: base, candidate_sha: candidate,
+                                push_pair: { 'event_name' => 'push', 'before' => base, 'after' => candidate })
+      expect(repository).to have_received(:paths).with(base, candidate)
+      expect(repository).not_to have_received(:merge_base)
+    end
   end
 
-  [false, true].each do |new_branch|
-    it "uses the whole feature merge-base for a #{new_branch ? 'new' : 'subsequent'} push" do
+  [false, true].each do |created|
+    it "uses the captured default merge-base for a zero-before push with created=#{created}" do
       event.merge!('ref' => 'refs/heads/feature', 'after' => candidate,
-                   'before' => new_branch ? '0' * 40 : sha('a'), 'created' => new_branch)
+                   'before' => '0' * 40, 'created' => created)
       allow(repository).to receive(:merge_base).with(candidate, default).and_return(base)
 
-      expect(resolve('push', event, default_sha: default)).to include(baseline_sha: base, captured_default_sha: default)
+      result = resolve('push', event, default_sha: default)
+      expect(result).to include(baseline_sha: base, captured_default_sha: default,
+                                reason: 'new-branch merge-base against captured default')
+      expect(result[:push_pair]).to be_nil
+      expect(repository).to have_received(:paths).with(base, candidate)
     end
   end
 
-  it 'rejects initial default-branch pushes without an available predecessor' do
+  it 'does not guess a fallback when the captured default commit is unavailable' do
+    event.merge!('ref' => 'refs/heads/feature', 'after' => candidate, 'before' => '0' * 40)
+    allow(repository).to receive(:commit!).with(default).and_raise(described_class::Error, 'unavailable default')
+    expect { resolve('push', event, default_sha: default) }.to raise_error(described_class::Error, /unavailable default/)
+  end
+
+  it 'rejects a new branch whose captured-default merge-base equals its head' do
     event.merge!('ref' => 'refs/heads/master', 'after' => candidate, 'before' => '0' * 40)
+    allow(repository).to receive(:merge_base).with(candidate, default).and_return(candidate)
+    expect { resolve('push', event) }.to raise_error(described_class::Error, /differ/)
+  end
+
+  it 'does not replace an unavailable new-branch merge-base with another commit' do
+    event.merge!('ref' => 'refs/heads/feature', 'after' => candidate, 'before' => '0' * 40)
+    allow(repository).to receive(:merge_base).with(candidate, default).and_raise(described_class::Error, 'no merge-base')
+    expect { resolve('push', event) }.to raise_error(described_class::Error, /no merge-base/)
+  end
+
+  it 'requires ancestry for the new-branch fallback instead of granting a push-pair exception' do
+    event.merge!('ref' => 'refs/heads/feature', 'after' => candidate, 'before' => '0' * 40)
+    allow(repository).to receive(:merge_base).with(candidate, default).and_return(base)
+    allow(repository).to receive(:ancestor?).with(base, candidate).and_return(false)
+    expect { resolve('push', event) }.to raise_error(described_class::Error, /ancestor/)
+  end
+
+  it 'does not grant the quick push exception to a weekly push profile' do
+    event.merge!('ref' => 'refs/heads/feature', 'after' => candidate, 'before' => described_class::REFERENCE,
+                 'inputs' => { 'profile' => 'weekly' })
+    allow(repository).to receive(:ancestor?).with(described_class::REFERENCE, candidate).and_return(false)
+    expect { resolve('push', event) }.to raise_error(described_class::Error, /ancestor/)
+  end
+
+  %w[before after].each do |endpoint|
+    [nil, '', 'short', 'A' * 40].each do |invalid|
+      it "rejects an invalid push #{endpoint} #{invalid.inspect}" do
+        event.merge!('ref' => 'refs/heads/feature', 'before' => base, 'after' => candidate, endpoint => invalid)
+        expect { resolve('push', event) }.to raise_error(described_class::Error)
+        expect(repository).not_to have_received(:paths)
+      end
+    end
+
+    it "rejects a missing push #{endpoint}" do
+      event.merge!('ref' => 'refs/heads/feature', 'before' => base, 'after' => candidate)
+      event.delete(endpoint)
+      expect { resolve('push', event) }.to raise_error(described_class::Error)
+      expect(repository).not_to have_received(:paths)
+    end
+
+    %w[noncommit unavailable].each do |failure|
+      it "rejects a #{failure} push #{endpoint} without substituting a merge-base" do
+        event.merge!('ref' => 'refs/heads/feature', 'before' => base, 'after' => candidate)
+        allow(repository).to receive(:commit!).with(event.fetch(endpoint)).and_raise(described_class::Error, failure)
+        allow(repository).to receive(:merge_base)
+        expect { resolve('push', event) }.to raise_error(described_class::Error, failure)
+        expect(repository).not_to have_received(:merge_base)
+        expect(repository).not_to have_received(:paths)
+      end
+    end
+  end
+
+  it 'rejects zero after and equal push endpoints' do
+    event.merge!('ref' => 'refs/heads/feature', 'before' => base, 'after' => '0' * 40)
     expect { resolve('push', event) }.to raise_error(described_class::Error)
+    event['after'] = base
+    expect { resolve('push', event) }.to raise_error(described_class::Error, /differ/)
+    expect(repository).not_to have_received(:paths)
   end
 
   context 'with the verified maintenance lineage' do
@@ -83,22 +168,28 @@ RSpec.describe HaveAPI::PerformanceCI do
     it 'compares the complete maintenance push batch using event before' do
       event.merge!('ref' => 'refs/heads/haveapi-0.30', 'before' => base, 'after' => candidate)
       expect(resolve('push', event)).to include(baseline_sha: base, candidate_sha: candidate,
-                                                release_lineage: lineage, reason: 'maintenance event before/after batch')
+                                                release_lineage: lineage, reason: 'push event before/after batch',
+                                                push_pair: { 'event_name' => 'push', 'before' => base, 'after' => candidate })
     end
 
-    [false, true].each do |created|
-      it "captures the release head for a #{created ? 'new' : 'subsequent'} release feature" do
-        event.merge!('ref' => 'refs/heads/feature', 'before' => created ? '0' * 40 : sha('a'), 'after' => candidate)
-        allow(repository).to receive(:merge_base).with(candidate, release).and_return(base)
-        expect(resolve('push', event)).to include(baseline_sha: base, captured_release_sha: release,
-                                                  captured_default_sha: default, release_lineage: lineage)
-      end
+    it 'permits a proven maintenance rewrite with the exact push pair' do
+      event.merge!('ref' => 'refs/heads/haveapi-0.30', 'before' => base, 'after' => candidate, 'forced' => true)
+      allow(repository).to receive(:ancestor?).with(base, candidate).and_return(false)
+      expect(resolve('push', event)).to include(baseline_sha: base, candidate_sha: candidate, release_lineage: lineage,
+                                                push_pair: { 'event_name' => 'push', 'before' => base, 'after' => candidate })
     end
 
-    it 'fails if the captured release reference is unavailable' do
-      event.merge!('ref' => 'refs/heads/feature', 'after' => candidate)
-      allow(repository).to receive(:default_sha).with('haveapi-0.30').and_raise(described_class::Error, 'missing release ref')
-      expect { resolve('push', event) }.to raise_error(described_class::Error, /missing release ref/)
+    it 'uses exact before for an existing maintenance feature without looking up a release head' do
+      event.merge!('ref' => 'refs/heads/feature', 'before' => base, 'after' => candidate)
+      expect(resolve('push', event)).to include(baseline_sha: base, candidate_sha: candidate, release_lineage: lineage)
+      expect(repository).not_to have_received(:default_sha).with('haveapi-0.30')
+    end
+
+    it 'uses the captured default merge-base for a new maintenance feature' do
+      event.merge!('ref' => 'refs/heads/feature', 'before' => '0' * 40, 'after' => candidate)
+      allow(repository).to receive(:merge_base).with(candidate, default).and_return(base)
+      expect(resolve('push', event)).to include(baseline_sha: base, captured_default_sha: default, release_lineage: lineage)
+      expect(repository).not_to have_received(:default_sha).with('haveapi-0.30')
     end
 
     it 'accepts only the original weekly reference through the proven mapping' do
@@ -137,6 +228,15 @@ RSpec.describe HaveAPI::PerformanceCI do
     expect { resolve('workflow_dispatch', event) }.to raise_error(described_class::Error, /differ/)
   end
 
+  it 'does not extend the push exception to pull requests or schedules' do
+    event['pull_request'] = { 'head' => { 'sha' => candidate }, 'base' => { 'sha' => default } }
+    allow(repository).to receive(:merge_base).with(candidate, default).and_return(base)
+    allow(repository).to receive(:ancestor?).with(base, candidate).and_return(false)
+    expect { resolve('pull_request', event) }.to raise_error(described_class::Error, /ancestor/)
+    allow(repository).to receive(:ancestor?).with(described_class::REFERENCE, candidate).and_return(false)
+    expect { resolve('schedule', event) }.to raise_error(described_class::Error, /ancestor/)
+  end
+
   it 'uses the exact scheduled event SHA and preserves fixed reference ancestry' do
     expect(resolve('schedule', event)).to include(candidate_sha: candidate, baseline_sha: described_class::REFERENCE, profile: 'weekly')
     expect(repository).to have_received(:ancestor?).with(described_class::REFERENCE, candidate)
@@ -169,7 +269,7 @@ RSpec.describe HaveAPI::PerformanceCI do
   end
 
   it 'skips only irrelevant valid push/PR changes and still forces scheduled/manual work' do
-    allow(repository).to receive(:paths).and_return(['clients/php/README.md'])
+    allow(repository).to receive(:paths).and_return(['LICENSE.txt'])
     event.merge!('ref' => 'refs/heads/master', 'after' => candidate, 'before' => base)
     expect(resolve('push', event)).to include(relevant: false)
     expect(resolve('schedule', event)).to include(relevant: true)
@@ -178,12 +278,40 @@ RSpec.describe HaveAPI::PerformanceCI do
 
   it 'detects configuration, dependencies, harness and workflow changes' do
     %w[flake.lock Gemfile Makefile .ruby-version servers/ruby/benchmarks/endpoints.rb
+       servers/ruby/benchmarks/Gemfile servers/ruby/benchmarks/Gemfile.lock servers/ruby/benchmarks/shell.nix
        servers/ruby/test_support/performance_sqlite_fixture.rb clients/ruby/Gemfile clients/rust/Gemfile
-       doc/performance.md utils/performance_ci.rb .github/workflows/servers-ruby-performance.yml].each do |path|
+       doc/performance.md utils/performance_ci.rb .github/workflows/servers-ruby-performance.yml
+       servers/ruby/benchmarks/spec/client_examples_spec.rb servers/ruby/test_support/all_client_performance_fixture.rb
+       clients/go/lib/haveapi/go_client/documentation.rb clients/typescript/lib/haveapi/typescript_client/documentation.rb
+       clients/js/src/client.ts clients/python/haveapi/client.py clients/php/src/Client.php clients/new-client/renderer.rb].each do |path|
       expect(described_class::RELEVANT).to match(path)
     end
   end
 
+  it 'requires the current-client contract before comparison and rejects a missing contract outcome' do
+    path = File.expand_path('../../../../.github/workflows/servers-ruby-performance.yml', __dir__)
+    steps = YAML.load_file(path).fetch('jobs').fetch('performance').fetch('steps')
+    contract = steps.find { |step| step['id'] == 'clients' }
+    comparison = steps.find { |step| step['name'] == 'Run the selected pair outside Bundler' }
+    expect(steps.index(contract)).to be < steps.index(comparison)
+    expect(contract.fetch('if')).to eq(comparison.fetch('if'))
+    expect(contract.fetch('run')).to include('make test-performance-clients', "echo 'outcome=passed'")
+    completion = steps.find { |step| step['id'] == 'completion' }
+    Dir.mktmpdir('haveapi-client-contract-gate-') do |directory|
+      File.write(File.join(directory, 'selection.json'), '{}')
+      File.write(File.join(directory, 'runner.exit'), "0\n")
+      FileUtils.mkdir_p(File.join(directory, 'results'))
+      File.write(File.join(directory, 'results/report.json'), '{}')
+      File.write(File.join(directory, 'all-client-contract.log'), 'passed')
+      [nil, '', 'failed', 'passed'].each do |outcome|
+        environment = { 'RELEVANT' => 'true', 'CLIENT_CONTRACT' => outcome,
+                        'PERFORMANCE_EVIDENCE' => directory, 'GITHUB_OUTPUT' => File.join(directory, 'output') }
+        _output, _error, status = Open3.capture3(environment, 'bash', '-euo', 'pipefail', '-c', completion.fetch('run'))
+        expect(status.success?).to eq(outcome == 'passed')
+      end
+    end
+  end
+
   it 'only accepts successful job completion in the aggregate gate' do
     expect(described_class.aggregate!('success', 'compared')).to be(true)
     expect(described_class.aggregate!('success', 'no-work')).to be(true)
@@ -206,20 +334,30 @@ RSpec.describe HaveAPI::PerformanceCI do
     end
   end
 
-  [0, 1, 3].each do |code|
-    it "preserves actual runner exit #{code} with a matching report" do
+  [[0, 'pass', false], [0, 'inconclusive', false], [1, 'regression', false], [3, 'error', false], [0, 'pass', true]].each do |code, outcome, rewrite|
+    it "preserves actual runner exit #{code}/#{outcome} and writes its summary#{' for a nonancestor push' if rewrite}" do
       Dir.mktmpdir('haveapi-runner-wrapper-') do |directory|
         checkout = File.join(directory, 'checkout')
         FileUtils.mkdir_p(File.join(checkout, 'servers/ruby/benchmarks'))
+        samples, budget_json = PerformanceSamples.fixture
+        report = HaveAPI::Performance::Comparator.new(samples, JSON.parse(budget_json), budget_sha256: samples['budget_sha256']).compare
+        report.merge!('status' => outcome, 'baseline_sha' => base, 'candidate_sha' => candidate)
+        item = report['cases'].first
+        item['classification'] = outcome
+        item['timing']['wall_seconds']['classification'] = outcome
+        item['responses']['raw_changed'] = true
+        item['responses']['bytes_per_request'].merge!('baseline' => 100.0, 'candidate' => 112.0, 'delta' => 12.0, 'delta_percent' => 12.0)
+        summary_path = File.join(directory, 'summary.md')
+        allow(ENV).to receive(:[]).and_call_original
+        allow(ENV).to receive(:fetch).and_call_original
+        allow(ENV).to receive(:[]).with('GITHUB_STEP_SUMMARY').and_return(summary_path)
+        allow(ENV).to receive(:fetch).with('GITHUB_STEP_SUMMARY').and_return(summary_path)
         script = <<~RUBY
           require 'json'
           require 'fileutils'
           output = ARGV.fetch(ARGV.index('--output') + 1)
           FileUtils.mkdir_p(output)
-          File.write(File.join(output, 'report.json'), JSON.generate(
-            schema_version: #{HaveAPI::Performance::SAMPLE_SCHEMA}, status: '#{{ 0 => 'pass', 1 => 'regression', 2 => 'inconclusive', 3 => 'error' }.fetch(code)}',
-            baseline_sha: '#{base}', candidate_sha: '#{candidate}'
-          ))
+          File.write(File.join(output, 'report.json'), #{JSON.generate(report).dump})
           exit #{code}
         RUBY
         File.write(File.join(checkout, 'servers/ruby/benchmarks/endpoints.rb'), script)
@@ -228,6 +366,10 @@ RSpec.describe HaveAPI::PerformanceCI do
         allow(repository).to receive(:git).with('diff', 'HEAD', '--').and_return('')
         selection = { 'schema_version' => 1, 'relevant' => true, 'profile' => 'quick',
                       'baseline_sha' => base, 'candidate_sha' => candidate }
+        if rewrite
+          selection.merge!('event_name' => 'push', 'push_pair' => { 'event_name' => 'push', 'before' => base, 'after' => candidate })
+          allow(repository).to receive(:ancestor?).with(base, candidate).and_return(false)
+        end
         campaign = described_class::Campaign.new(repository:, selection:,
                                                  evidence: File.join(directory, 'evidence'), sources: File.join(directory, 'sources'))
         allow(campaign).to receive(:export).with(:baseline, base).and_return(directory)
@@ -235,6 +377,19 @@ RSpec.describe HaveAPI::PerformanceCI do
         allow(campaign).to receive_messages(verify_dependencies: nil, retain_inputs: nil, command!: nil)
         expect(campaign.run).to eq(code)
         expect(File.read(File.join(directory, 'evidence/runner.exit')).strip).to eq(code.to_s)
+        summary = File.read(summary_path)
+        expect(summary).to include("Performance comparison: #{outcome}", base, candidate)
+        if outcome == 'error'
+          expect(summary).not_to include('Bytes/request')
+        else
+          expect(summary).to include("| api.public_get {} | #{outcome} | #{outcome} | pass | pass | true | false | 100.00 → 112.00 | +12.00 (+12.00%) |")
+        end
+        if rewrite
+          push_event = File.join(directory, 'evidence/push-event.json')
+          expect(JSON.parse(File.read(push_event))).to eq(selection)
+          command = JSON.parse(File.read(File.join(directory, 'evidence/runner-command.json')))
+          expect(command.last(2)).to eq(['--push-event', push_event])
+        end
       end
     end
   end

data/spec/performance/release_lineage_spec.rb

@@ -76,7 +76,7 @@ describe HaveAPI::Performance::Release do
 
   def contents(version, profile: 'quick')
     original = described_class.paths(profile).to_h { |path| [path, File.read(File.join(root, path))] }
-    own = described_class.version(original)
+    own = original.fetch('VERSION').strip
     original.to_h do |path, value|
       value = "#{version}\n" if path == 'VERSION'
       value = value.sub("VERSION = '#{own}'", "VERSION = '#{version}'") if described_class::VERSIONS.has_key?(path)
@@ -85,6 +85,16 @@ describe HaveAPI::Performance::Release do
     end
   end
 
+  def with_maintenance_source
+    Dir.mktmpdir('haveapi-maintenance-source-') do |source|
+      contents('0.30.2').each do |path, value|
+        FileUtils.mkdir_p(File.dirname(File.join(source, path)))
+        File.write(File.join(source, path), value)
+      end
+      yield source
+    end
+  end
+
   it 'verifies the complete published binary delta and all four exact trees in an owned history' do
     expect(proof).to include('reference_sha' => HaveAPI::Performance::REFERENCE, 'mapped_sha' => described_class::MAPPED,
                              'metadata_sha' => described_class::METADATA, 'trees' => described_class::TREES)
@@ -150,6 +160,8 @@ describe HaveAPI::Performance::Release do
                                            '--baseline-root', root, '--candidate-root', root,
                                            '--budgets', 'unused', '--output', 'unused'])
       cli.send(:parse)
+      allow(cli).to receive(:verify_runtime)
+      allow(HaveAPI::Performance).to receive(:gemspec)
       allow(cli).to receive(:verify_source) { |role| { root: "/controlled/#{role}", sha: head } }
       allow(cli).to receive(:git) { |*arguments| repository.git(*arguments) }
       allow(cli).to receive(:ancestor?) { |left, right| repository.ancestor?(left, right) }
@@ -190,7 +202,20 @@ describe HaveAPI::Performance::Release do
     end
   end
 
+  it 'builds maintenance fixtures from a later minor source template without broadening the release guard' do
+    Dir.mktmpdir('haveapi-later-minor-template-') do |template|
+      contents('0.32.0').each do |path, value|
+        FileUtils.mkdir_p(File.dirname(File.join(template, path)))
+        File.write(File.join(template, path), value)
+      end
+      allow(self).to receive(:root).and_return(template)
+      expect(described_class.capture(contents('0.30.2')).fetch('own_version')).to eq('0.30.2')
+      expect { described_class.capture(contents('0.32.0')) }.to raise_error(error, /Expected own 0\.30 patch version/)
+    end
+  end
+
   it 'rejects mismatched own constants, package names, constraints and minor versions' do
+    expect { described_class.capture(contents('0.31.0')) }.to raise_error(error, /Expected own 0\.30 patch version/)
     [
       ['VERSION', "0.31.2\n"],
       ['VERSION', " 0.30.2\n"],
@@ -211,7 +236,6 @@ describe HaveAPI::Performance::Release do
       File.write(File.join(harness, 'servers/ruby/Gemfile.lock'), "controlled server lock\n")
       FileUtils.mkdir_p(File.join(harness, 'clients/rust'))
       File.write(File.join(harness, 'clients/rust/Gemfile.lock'), "controlled Rust lock\n")
-      stub_const('HaveAPI::RustClient::VERSION', HaveAPI::VERSION) unless defined?(HaveAPI::RustClient::VERSION)
       stub_const('HaveAPI::Performance::ROOT', harness)
       ordinary = JSON.parse(JSON.generate(HaveAPI::Performance::Worker.inputs(root, 'quick')))
       preparation = ordinary.fetch('json_preparation')
@@ -220,10 +244,23 @@ describe HaveAPI::Performance::Release do
       expect do
         described_class.validate_json_preparation(ordinary, 'files_sha256' => preparation.fetch('raw_sha256'))
       end.not_to raise_error
-      captured = HaveAPI::Performance::Worker.inputs(root, 'quick', release: true)
-      expect(captured[:locks]).to have_key('clients/rust/Gemfile.lock')
-      expect(captured[:manifests]).to have_key('clients/rust/Gemfile')
-      expect(captured.fetch(:release_versions)).to eq(described_class.capture(contents(File.read(File.join(root, 'VERSION')).strip)))
+      %w[HaveAPI::VERSION HaveAPI::Client::VERSION HaveAPI::RustClient::VERSION].each do |name|
+        stub_const(name, '0.30.2')
+      end
+      HaveAPI::Performance::BENCHMARK_INPUTS.each do |path|
+        FileUtils.mkdir_p(File.dirname(File.join(harness, path)))
+        FileUtils.cp(File.join(root, path), File.join(harness, path))
+      end
+      with_maintenance_source do |source|
+        captured = HaveAPI::Performance::Worker.inputs(source, 'quick', release: true)
+        expect(captured[:locks]).to have_key('clients/rust/Gemfile.lock')
+        expect(captured[:manifests]).to have_key('clients/rust/Gemfile')
+        expect(captured.fetch(:release_versions)).to eq(described_class.capture(contents('0.30.2')))
+        benchmark = JSON.parse(JSON.generate(HaveAPI::Performance::Worker.inputs(source, 'quick', release: true, benchmark: true)))
+        expect(benchmark.fetch('manifests')).not_to have_key('flake.lock')
+        expect(benchmark.fetch('contributor_flakes')).to have_key('flake.lock')
+        expect(described_class.validate_inputs(benchmark, { 'files_sha256' => benchmark.fetch('release_versions').fetch('raw_sha256') }, 'quick')).to eq('0.30.2')
+      end
       Dir.mktmpdir('haveapi-release-inputs-') do |source|
         contents('0.30.99').each do |path, value|
           FileUtils.mkdir_p(File.dirname(File.join(source, path)))
@@ -340,7 +377,7 @@ describe HaveAPI::Performance::Release do
   end
 
   it 'normalizes the actual worker HTML outside timing and retains its raw bytes' do
-    own = File.read(File.join(root, 'VERSION')).strip
+    own = '0.30.2'
     body = "<a href=\"https://webui.haveapi.org/v#{own}/#api\">Connect</a>#{framework_footer(own)}"
     scenario = HaveAPI::Performance::DocumentationScenario.allocate
     allow(scenario).to receive(:reset!)
@@ -348,13 +385,15 @@ describe HaveAPI::Performance::Release do
                                         validate!: { http_status: 200, envelope_status: nil, body_bytes: body.bytesize,
                                                      body_sha256: Digest::SHA256.hexdigest(body), canonical_sha256: Digest::SHA256.hexdigest(body) },
                                         counters: { operations: [{ queries: 0, authorizations: 0, executions: 0 }] })
-    worker = HaveAPI::Performance::Worker.new('source_root' => root, 'release_versions' => true)
-    worker.instance_variable_set(:@current_workload, 'docs.html_resources')
-    result = worker.measure(scenario, 1)
-    output = result.fetch(:outputs).first
-    expect(output.fetch('comparison')).to include('own_version' => File.read(File.join(root, 'VERSION')).strip)
-    expect(result.fetch(:bodies).values.first.fetch(:body)).to eq(body)
-    expect(output.fetch('canonical_sha256')).to eq(Digest::SHA256.hexdigest(described_class.html(body, output['comparison']['own_version'])))
+    with_maintenance_source do |source|
+      worker = HaveAPI::Performance::Worker.new('source_root' => source, 'release_versions' => true)
+      worker.instance_variable_set(:@current_workload, 'docs.html_resources')
+      result = worker.measure(scenario, 1)
+      output = result.fetch(:outputs).first
+      expect(output.fetch('comparison')).to include('own_version' => own)
+      expect(result.fetch(:bodies).values.first.fetch(:body)).to eq(body)
+      expect(output.fetch('canonical_sha256')).to eq(Digest::SHA256.hexdigest(described_class.html(body, output['comparison']['own_version'])))
+    end
   end
 
   it 'leaves lookalike attributes, other URLs, JSON and example code byte exact' do

data/spec/performance/runner_spec.rb

@@ -3,6 +3,9 @@ require 'open3'
 require 'tmpdir'
 require 'fileutils'
 require_relative '../../benchmarks/endpoints'
+require_relative '../../../../utils/performance_ci'
+require_relative '../../../../clients/ruby/lib/haveapi/client/version'
+require_relative '../../../../clients/rust/lib/haveapi/rust_client/version'
 require_relative 'support/samples'
 require_relative '../../test_support/performance_endpoint_fixture'
 require_relative '../../test_support/documentation_performance_fixture'
@@ -109,6 +112,70 @@ describe HaveAPI::Performance::Worker do
     end
   end
 
+  it 'retains the single benchmark bundle and raw unused contributor flakes without library locks' do
+    root = File.expand_path('../../../..', __dir__)
+    inputs = JSON.parse(JSON.generate(described_class.inputs(root, 'quick', benchmark: true)))
+    tool = inputs.fetch('benchmark')
+    expect(tool.keys).to match_array(HaveAPI::Performance::BENCHMARK_INPUTS)
+    expect(inputs.fetch('locks')).to eq('servers/ruby/benchmarks/Gemfile.lock' => tool.fetch('servers/ruby/benchmarks/Gemfile.lock').fetch('sha256'))
+    expect(inputs.fetch('manifests')).to have_key('.ruby-version')
+    expect(inputs.fetch('manifests')).not_to have_key('flake.lock')
+    expect(inputs.fetch('contributor_flakes').keys).to match_array(%w[flake.nix flake.lock])
+    tool.each do |path, input|
+      expect(input.fetch('content')).to eq(File.read(File.join(root, path)))
+      expect(input.fetch('sha256')).to eq(Digest::SHA256.hexdigest(input.fetch('content')))
+    end
+  end
+
+  it 'rejects changed Ruby and unavailable calibrated dependencies before starting workers' do
+    samples, json = PerformanceSamples.fixture
+    Dir.mktmpdir('haveapi-runtime-guard-') do |directory|
+      budget = File.join(directory, 'budgets.json')
+      cli = HaveAPI::Performance::CLI.new(['run', '--baseline-root', directory, '--baseline-sha', samples['baseline_sha'],
+                                           '--candidate-root', directory, '--candidate-sha', samples['candidate_sha'],
+                                           '--budgets', budget, '--output', File.join(directory, 'result')])
+      cli.send(:parse)
+      File.write(budget, json)
+      allow(cli).to receive(:child)
+      expect { cli.send(:run_samples, 'f' * 64) }.to raise_error(HaveAPI::Performance::ContractError, 'Calibration Ruby mismatch')
+      budgets = JSON.parse(json)
+      budgets['environment']['weekly']['ruby'] = JSON.parse(JSON.generate(described_class.new({}).environment.fetch(:ruby)))
+      budgets['environment']['weekly']['gems'] = { 'haveapi-missing-calibrated-gem' => { 'version' => '99.0', 'platform' => 'ruby' } }
+      File.write(budget, JSON.generate(budgets))
+      expect { cli.send(:run_samples, 'f' * 64) }.to raise_error(HaveAPI::Performance::ContractError, /Missing calibrated dependency/)
+      expect(cli).not_to have_received(:child)
+    end
+  end
+
+  it 'limits the nonancestor runner exception to an exact quick push event pair' do
+    samples, = PerformanceSamples.fixture
+    Dir.mktmpdir('haveapi-push-guard-') do |directory|
+      event = File.join(directory, 'selection.json')
+      selection = samples.slice('baseline_sha', 'candidate_sha').merge('event_name' => 'push', 'profile' => 'quick',
+                                                                       'push_pair' => { 'event_name' => 'push', 'before' => samples['baseline_sha'], 'after' => samples['candidate_sha'] })
+      %w[valid changed missing weekly].each do |control|
+        value = Marshal.load(Marshal.dump(selection))
+        value['push_pair']['before'] = 'c' * 40 if control == 'changed'
+        value.delete('push_pair') if control == 'missing'
+        File.write(event, JSON.generate(value))
+        cli = HaveAPI::Performance::CLI.new(['run', '--baseline-root', directory, '--baseline-sha', samples['baseline_sha'],
+                                             '--candidate-root', directory, '--candidate-sha', samples['candidate_sha'],
+                                             '--profile', control == 'weekly' ? 'weekly' : 'quick', '--push-event', event,
+                                             '--budgets', '/unused', '--output', '/unused'])
+        cli.send(:parse)
+        allow(cli).to receive(:verify_runtime)
+        allow(HaveAPI::Performance).to receive(:gemspec)
+        allow(cli).to receive(:verify_source) { |role| samples['sources'].fetch(role) }
+        allow(cli).to receive(:ancestor?).and_return(false)
+        allow(HaveAPI::Performance::Release).to receive(:lineage).and_return(nil)
+        allow(cli).to receive(:child).and_raise(HaveAPI::Performance::ContractError, 'pilot boundary')
+        expect { cli.send(:run_samples, 'f' * 64) }.to raise_error(HaveAPI::Performance::ContractError,
+                                                                   control == 'valid' ? 'pilot boundary' : /push|Push|Weekly/)
+        expect(cli).not_to have_received(:child) unless control == 'valid'
+      end
+    end
+  end
+
   it 'validates every response after the timed loop' do
     scenario = Class.new do
       attr_reader :calls, :validations
@@ -252,6 +319,8 @@ describe HaveAPI::Performance::Worker do
                                            '--candidate-root', '/controlled/candidate', '--candidate-sha', samples['candidate_sha'],
                                            '--budgets', '/unused', '--output', '/unused'])
       cli.send(:parse)
+      allow(cli).to receive(:verify_runtime)
+      allow(HaveAPI::Performance).to receive(:gemspec)
       allow(cli).to receive(:verify_source) { |role| samples['sources'].fetch(role) }
       allow(cli).to receive(:ancestor?).and_return(true)
       allow(HaveAPI::Performance::Release).to receive(:lineage).and_return(nil)
@@ -354,6 +423,8 @@ describe HaveAPI::Performance::Worker do
                                              '--candidate-sha', samples['candidate_sha'], '--budgets', policy, '--output', output])
         # Control source verification and worker replies, retaining the real run
         # assembly, child protocol validation, direct comparator and report path.
+        allow(cli).to receive(:verify_runtime)
+        allow(HaveAPI::Performance).to receive(:gemspec)
         allow(cli).to receive_messages(git: '', ancestor?: true)
         allow(HaveAPI::Performance::Release).to receive(:lineage).and_return(nil)
         allow(cli).to receive(:verify_source) { |role| samples['sources'].fetch(role).transform_keys(&:to_sym) }
@@ -387,6 +458,9 @@ describe HaveAPI::Performance::Worker do
         expect(cli.execute).to eq(0)
         retained = JSON.parse(File.read(File.join(output, 'samples.json')))
         expect(retained['sources']).to eq(samples['sources'])
+        saved_report = JSON.parse(File.read(File.join(output, 'report.json')))
+        expect(saved_report.dig('comparison', 'samples_sha256')).to eq(Digest::SHA256.file(File.join(output, 'samples.json')).hexdigest)
+        expect(saved_report['harness_sha256']).to eq(retained['harness_sha256'])
         report = HaveAPI::Performance::Comparator.new(retained, budgets, budget_sha256: Digest::SHA256.hexdigest(budget_json)).compare
         expect(report['status']).to eq('pass')
         expect(requests.map(&:first).count('calibration-adjusted')).to eq(expensive ? 0 : 1)
@@ -463,14 +537,76 @@ describe HaveAPI::Performance::Worker do
       cli = HaveAPI::Performance::CLI.new(['run', '--baseline-root', directory, '--baseline-sha', '0' * 40,
                                            '--candidate-root', directory, '--candidate-sha', '1' * 40,
                                            '--budgets', budget, '--output', missing])
+      allow(cli).to receive(:verify_runtime)
       expect(cli.execute).to eq(3)
       report = JSON.parse(File.read(File.join(missing, 'report.json')))
       expect(report['error']['message']).to include('Source SHA must be full immutable SHA')
       expect(report.values_at('baseline_sha', 'candidate_sha')).to eq(['0' * 40, '1' * 40])
+      expect(report).not_to have_key('harness_sha256')
+      expect(report.fetch('comparison')).not_to have_key('samples_sha256')
       equal = HaveAPI::Performance::CLI.new(['run', '--baseline-root', directory, '--baseline-sha', 'a' * 40,
                                              '--candidate-root', directory, '--candidate-sha', 'a' * 40,
                                              '--budgets', budget, '--output', File.join(directory, 'equal')])
       expect(equal.execute).to eq(3)
     end
   end
+
+  it 'checks declared Ruby and runtime requirements against installed tools including unloaded rake' do
+    campaign = HaveAPI::PerformanceCI::Campaign.new(repository: instance_double(HaveAPI::PerformanceCI::Repository),
+                                                    selection: {}, evidence: '/unused', sources: '/unused')
+    spec = { 'ruby' => '>= 3.2', 'dependencies' => [['rake', 'runtime', '>= 13.0'], ['haveapi-client', 'runtime', '~> 0.30.0']] }
+    status = instance_double(Process::Status, success?: true)
+    allow(Open3).to receive(:capture3).and_return([JSON.generate(spec), '', status])
+    expect(campaign.send(:gemspec, '/source', 'servers/ruby/haveapi.gemspec')).to eq(spec)
+    changed = spec.merge('ruby' => '>= 99')
+    allow(Open3).to receive(:capture3).and_return([JSON.generate(changed), '', status])
+    expect { campaign.send(:gemspec, '/source', 'servers/ruby/haveapi.gemspec') }.to raise_error(HaveAPI::PerformanceCI::Error, /Benchmark Ruby/)
+    changed = spec.merge('dependencies' => [['rake', 'runtime', '>= 99']])
+    allow(Open3).to receive(:capture3).and_return([JSON.generate(changed), '', status])
+    expect { campaign.send(:gemspec, '/source', 'servers/ruby/haveapi.gemspec') }.to raise_error(HaveAPI::PerformanceCI::Error, /Benchmark dependencies/)
+  end
+
+  it 'rejects unsupported Ruby or gem requirements in either direct source before the first child' do
+    samples, = PerformanceSamples.fixture
+    Dir.mktmpdir('haveapi-source-requirements-') do |directory|
+      roots = %w[baseline candidate].to_h { |role| [role, File.join(directory, role)] }
+      paths = HaveAPI::Performance::Release::VERSIONS.map { |path, name| "#{path.split('/lib/').first}/#{name}.gemspec" }
+      valid = <<~RUBY
+        Gem::Specification.new do |spec|
+          spec.name = 'haveapi-fixture'
+          spec.version = '1.0.0'
+          spec.required_ruby_version = '>= 3.2'
+          spec.add_dependency 'rake', '>= 13.0'
+        end
+      RUBY
+      roots.each_value do |root|
+        paths.each do |path|
+          FileUtils.mkdir_p(File.dirname(File.join(root, path)))
+          File.write(File.join(root, path), valid)
+        end
+      end
+      %w[baseline candidate].product(%w[valid ruby dependency]).each do |role, fault|
+        path = File.join(roots.fetch(role), paths.last)
+        text = case fault
+               when 'ruby' then valid.sub('>= 3.2', '>= 99')
+               when 'dependency' then valid.sub('>= 13.0', '>= 99')
+               else valid
+               end
+        File.write(path, text)
+        cli = HaveAPI::Performance::CLI.new(['run', '--baseline-root', roots['baseline'], '--baseline-sha', samples['baseline_sha'],
+                                             '--candidate-root', roots['candidate'], '--candidate-sha', samples['candidate_sha'],
+                                             '--budgets', '/unused', '--output', '/unused'])
+        cli.send(:parse)
+        allow(cli).to receive(:verify_runtime)
+        allow(cli).to receive(:verify_source) { |name| { root: roots.fetch(name), sha: samples.fetch("#{name}_sha") } }
+        allow(cli).to receive(:ancestor?).and_return(true)
+        allow(HaveAPI::Performance::Release).to receive(:lineage).and_return(nil)
+        allow(cli).to receive(:child).and_raise(HaveAPI::Performance::ContractError, 'pilot boundary')
+        expect { cli.send(:run_samples, 'f' * 64) }.to raise_error(HaveAPI::Performance::ContractError,
+                                                                   fault == 'valid' ? 'pilot boundary' : /Benchmark Ruby|Benchmark dependencies/)
+        expect(cli).not_to have_received(:child) unless fault == 'valid'
+        File.write(path, valid)
+      end
+    end
+  end
 end