@moretea-labs/forge 1.6.0 → 1.7.0

package/scripts/benchmark-mcp-transport.ts

@@ -0,0 +1,170 @@
+#!/usr/bin/env bun
+import { readFileSync } from 'fs';
+import { performance } from 'perf_hooks';
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { readMcpServiceBearerToken } from '../src/cli/mcp/auth';
+import { resolveRepoPreferredControllerHome } from '../src/cli/repositories/controller-home';
+import {
+  aggregateMcpTransportLatencySamples,
+  extractForgeServerDuration,
+  normalizeMcpTransportLatencySample,
+  type McpTransportLatencySample,
+} from '../src/runtime/diagnostics/mcp-transport-benchmark';
+
+function option(name: string): string | undefined {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : undefined;
+}
+
+function integerAtLeast(name: string, fallback: number, minimum: number): number {
+  const raw = option(name);
+  if (!raw) return fallback;
+  const value = Number(raw);
+  if (!Number.isInteger(value) || value < minimum) {
+    const requirement = minimum === 0 ? 'a non-negative integer' : `an integer >= ${minimum}`;
+    throw new Error(`${name} must be ${requirement}`);
+  }
+  return value;
+}
+
+function positiveInteger(name: string, fallback: number): number {
+  return integerAtLeast(name, fallback, 1);
+}
+
+function readSamples(path: string): McpTransportLatencySample[] {
+  const text = readFileSync(path, 'utf8').trim();
+  if (!text) return [];
+  if (text.startsWith('[')) {
+    const values = JSON.parse(text);
+    if (!Array.isArray(values)) throw new Error('--input JSON must be an array or JSONL');
+    return values.map(normalizeMcpTransportLatencySample);
+  }
+  return text.split(/\r?\n/).filter(Boolean).map((line) => normalizeMcpTransportLatencySample(JSON.parse(line)));
+}
+
+export function timingLedgerServerDuration(
+  path: string | undefined,
+  tool: string,
+  meta: Record<string, unknown>,
+): number | undefined {
+  if (!path) return undefined;
+  const traceId = typeof meta.traceId === 'string' ? meta.traceId : undefined;
+  const requestId = typeof meta.requestId === 'string' ? meta.requestId : undefined;
+  if (!traceId && !requestId) return undefined;
+  try {
+    const text = readFileSync(path, 'utf8').trim();
+    if (!text) return undefined;
+    const lines = text.split(/\r?\n/).filter(Boolean);
+    for (let index = lines.length - 1; index >= 0; index -= 1) {
+      let value: Record<string, unknown>;
+      try {
+        value = JSON.parse(lines[index]!) as Record<string, unknown>;
+      } catch {
+        continue;
+      }
+      if (value.tool !== tool) continue;
+      if (traceId && value.traceId !== traceId) continue;
+      if (requestId && value.requestId !== requestId) continue;
+      const duration = value.totalToolDurationMs;
+      if (typeof duration === 'number' && Number.isFinite(duration) && duration >= 0) return duration;
+    }
+  } catch {
+    return undefined;
+  }
+  return undefined;
+}
+
+async function probe(): Promise<McpTransportLatencySample[]> {
+  const endpointRaw = option('--endpoint');
+  if (!endpointRaw) throw new Error('--endpoint is required unless --input is used');
+  const endpoint = new URL(endpointRaw);
+  const label = option('--label')?.trim() || endpoint.hostname;
+  const tool = option('--tool')?.trim() || 'rh_status';
+  const iterations = positiveInteger('--iterations', 30);
+  const warmup = integerAtLeast('--warmup', 3, 0);
+  const timeoutMs = positiveInteger('--timeout-ms', 120_000);
+  const timingLog = option('--timing-log')?.trim();
+  const includeConnect = process.argv.includes('--include-connect');
+  const timingScope = includeConnect ? 'connect_and_tool_call' as const : 'tool_call' as const;
+  const tokenEnv = option('--token-env')?.trim() || 'FORGE_MCP_BENCH_TOKEN';
+  const localServiceAuth = process.argv.includes('--local-service-auth');
+  const token = process.env[tokenEnv]?.trim()
+    || (localServiceAuth
+      ? readMcpServiceBearerToken(resolveRepoPreferredControllerHome(process.cwd()))?.trim()
+      : undefined);
+  if (!token) {
+    throw new Error(localServiceAuth
+      ? 'MCP_BENCH_LOCAL_SERVICE_TOKEN_UNAVAILABLE: no local Forge service bearer credential was found'
+      : `${tokenEnv} is not set; use --local-service-auth on the Forge host or keep benchmark bearer credentials in the environment, never CLI args`);
+  }
+  const argumentsRaw = option('--arguments');
+  const args = argumentsRaw ? JSON.parse(argumentsRaw) as Record<string, unknown> : {};
+  const repoId = option('--repo-id')?.trim();
+  if (repoId && args.repo_id === undefined) args.repo_id = repoId;
+
+  const createClient = () => {
+    const transport = new StreamableHTTPClientTransport(endpoint, {
+      requestInit: { headers: { Authorization: `Bearer ${token}` } },
+    });
+    const client = new Client({ name: 'forge-mcp-transport-benchmark', version: '1.0.0' });
+    return { client, transport };
+  };
+  const steadyState = includeConnect ? undefined : createClient();
+  const call = async (): Promise<{ response: unknown; totalMs: number }> => {
+    const connection = steadyState ?? createClient();
+    const started = performance.now();
+    try {
+      if (includeConnect) await connection.client.connect(connection.transport);
+      const response = await connection.client.callTool({ name: tool, arguments: args }, undefined, { timeout: timeoutMs });
+      return { response, totalMs: performance.now() - started };
+    } finally {
+      if (includeConnect) await connection.client.close().catch(() => undefined);
+    }
+  };
+  const samples: McpTransportLatencySample[] = [];
+  try {
+    if (steadyState) await steadyState.client.connect(steadyState.transport);
+    for (let index = 0; index < warmup; index += 1) await call();
+    for (let index = 0; index < iterations; index += 1) {
+      const { response, totalMs } = await call();
+      const structured = response && typeof response === 'object' && !Array.isArray(response)
+        ? (response as Record<string, unknown>).structuredContent
+        : undefined;
+      const responseMeta = structured && typeof structured === 'object' && !Array.isArray(structured)
+        ? (structured as Record<string, unknown>).responseMeta
+        : undefined;
+      const meta = responseMeta && typeof responseMeta === 'object' && !Array.isArray(responseMeta)
+        ? responseMeta as Record<string, unknown>
+        : {};
+      const serverDurationMs = extractForgeServerDuration(response)
+        ?? timingLedgerServerDuration(timingLog, tool, meta);
+      if (serverDurationMs === undefined) {
+        throw new Error('MCP_SERVER_DURATION_MISSING: target must return Forge responseMeta.serverDurationMs or expose a matching --timing-log ledger entry');
+      }
+      samples.push({
+        label,
+        tool,
+        timingScope,
+        clientTotalMs: totalMs,
+        serverDurationMs,
+        ...(typeof meta.traceId === 'string' ? { traceId: meta.traceId } : {}),
+        ...(typeof meta.requestId === 'string' ? { requestId: meta.requestId } : {}),
+        observedAt: new Date().toISOString(),
+      });
+    }
+  } finally {
+    if (steadyState) await steadyState.client.close().catch(() => undefined);
+  }
+  return samples;
+}
+
+if (import.meta.main) {
+  const input = option('--input');
+  const samples = input ? readSamples(input) : await probe();
+  const report = aggregateMcpTransportLatencySamples(samples);
+  console.log(JSON.stringify({
+    generatedAt: new Date().toISOString(),
+    ...report,
+  }, null, 2));
+}

package/scripts/benchmark-quality-harness.ts

@@ -0,0 +1,146 @@
+#!/usr/bin/env bun
+
+import { execFileSync, spawn } from 'child_process';
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'fs';
+import { tmpdir } from 'os';
+import { join } from 'path';
+import { performance } from 'perf_hooks';
+import { buildControllerContextPackAsync } from '../src/cli/controller/context-pack';
+import { getMcpPolicy } from '../src/cli/mcp/policy';
+import { closeCodeGraphReadProviderSessions } from '../src/runtime/context/codegraph-read-provider';
+import { clearAllSessionCachesForTest } from '../src/cli/repository/session-cache';
+import { startLightweightRepositoryCommand } from '../src/runtime/execution/process-runtime/lightweight-managed';
+import { registerRepository } from '../src/cli/repositories/registry';
+
+function percentile(values: number[], ratio: number): number {
+  const sorted = [...values].sort((a, b) => a - b);
+  return Math.round((sorted[Math.min(sorted.length - 1, Math.floor(sorted.length * ratio))] ?? 0) * 100) / 100;
+}
+async function rawGitStatus(root: string): Promise<number> {
+  const started = performance.now();
+  await new Promise<void>((resolve, reject) => {
+    const child = spawn('git', ['status', '--short'], { cwd: root, stdio: 'ignore' });
+    child.on('error', reject); child.on('close', () => resolve());
+  });
+  return performance.now() - started;
+}
+
+const iterationsIndex = process.argv.indexOf('--iterations');
+const iterations = Math.max(2, Number(iterationsIndex >= 0 ? process.argv[iterationsIndex + 1] : 7) || 7);
+const structuralIndex = process.argv.indexOf('--structural');
+const structuralContext = process.argv[structuralIndex + 1] === 'off' ? 'off' as const : 'auto' as const;
+const sandboxRoot = mkdtempSync(join(tmpdir(), 'forge-quality-harness-benchmark-'));
+const root = join(sandboxRoot, 'repo');
+const controllerHome = join(sandboxRoot, 'controller');
+try {
+  mkdirSync(root, { recursive: true });
+  execFileSync('git', ['init', '-q', '-b', 'main'], { cwd: root });
+  execFileSync('git', ['config', 'user.email', 'benchmark@example.test'], { cwd: root });
+  execFileSync('git', ['config', 'user.name', 'Forge Benchmark'], { cwd: root });
+  mkdirSync(join(root, 'src'), { recursive: true });
+  for (let index = 0; index < 120; index += 1) {
+    writeFileSync(join(root, 'src', `module-${index}.ts`), `export function symbol${index}(value: number) {\n  return value + ${index};\n}\n`);
+  }
+  writeFileSync(join(root, 'src', 'target.ts'), 'export function benchmarkTarget(value: number) {\n  const next = value + 1;\n  return next;\n}\n');
+  writeFileSync(join(root, 'src', 'consumer.ts'), "import { benchmarkTarget } from './target';\nexport function consumeBenchmarkTarget(value: number) {\n  return benchmarkTarget(value) * 2;\n}\n");
+  execFileSync('git', ['add', '.'], { cwd: root }); execFileSync('git', ['commit', '-qm', 'fixture'], { cwd: root });
+  const repository = registerRepository({ path: root, controllerHome, displayName: 'quality-harness-benchmark' });
+
+  const contextCold: number[] = [];
+  const contextHot: number[] = [];
+  const structuralProcess: number[] = [];
+  const structuralOpen: number[] = [];
+  const structuralQuery: number[] = [];
+  let hotCacheEvidence: unknown;
+  let contextAccuracyEvidence: { selected: string[]; required: string[]; recall: number; precision: number } | undefined;
+  const requiredContextPaths = ['src/target.ts', 'src/consumer.ts'];
+  for (let index = 0; index < iterations; index += 1) {
+    clearAllSessionCachesForTest();
+    const session = { sessionId: `benchmark-${index}`, repoId: repository.repoId, checkoutId: repository.activeCheckoutId };
+    let started = performance.now();
+    const cold = await buildControllerContextPackAsync(root, getMcpPolicy('controller'), { description: 'benchmarkTarget implementation and impact', searchTerms: ['benchmarkTarget'], knownPaths: ['src/target.ts'], structuralContext, session });
+    contextCold.push(performance.now() - started);
+    const structuralTimings = cold.structuralContext?.timingsMs;
+    if (typeof structuralTimings?.process === 'number') structuralProcess.push(structuralTimings.process);
+    if (typeof structuralTimings?.open === 'number') structuralOpen.push(structuralTimings.open);
+    if (typeof structuralTimings?.query === 'number') structuralQuery.push(structuralTimings.query);
+    started = performance.now();
+    const hot = await buildControllerContextPackAsync(root, getMcpPolicy('controller'), { description: 'benchmarkTarget implementation and impact', searchTerms: ['benchmarkTarget'], knownPaths: ['src/target.ts'], structuralContext, session });
+    contextHot.push(performance.now() - started);
+    hotCacheEvidence = hot.cache;
+    const selected = [...new Set(hot.files.map((file) => file.path))].sort();
+    const requiredHits = requiredContextPaths.filter((path) => selected.includes(path)).length;
+    contextAccuracyEvidence = {
+      selected,
+      required: requiredContextPaths,
+      recall: requiredHits / requiredContextPaths.length,
+      precision: selected.length === 0 ? 0 : requiredHits / selected.length,
+    };
+  }
+
+  const rawChild: number[] = [];
+  const harnessTotal: number[] = [];
+  const preSpawnHarness: number[] = [];
+  for (let index = 0; index < iterations; index += 1) {
+    rawChild.push(await rawGitStatus(root));
+    const started = performance.now();
+    const run = await startLightweightRepositoryCommand({
+      controllerHome, repository, interactiveWaitMs: 5_000, timeoutMs: 30_000,
+      execution: {
+        command: ['git', 'status', '--short'],
+        authorizationDecision: { decision: 'allow', source: 'full_access', reason: 'benchmark fixture' },
+      },
+    });
+    harnessTotal.push(performance.now() - started);
+    if (run.metrics.preSpawnHarnessMs !== undefined) preSpawnHarness.push(run.metrics.preSpawnHarnessMs);
+  }
+
+  const steadyContextCold = contextCold.slice(1);
+  const output = {
+    schemaVersion: 1,
+    iterations,
+    context: {
+      structuralContext,
+      coldP50Ms: percentile(contextCold, 0.5), coldP95Ms: percentile(contextCold, 0.95),
+      startupColdMs: Math.round((contextCold[0] ?? 0) * 100) / 100,
+      steadyColdP50Ms: percentile(steadyContextCold, 0.5),
+      steadyColdP95Ms: percentile(steadyContextCold, 0.95),
+      coldSamplesMs: contextCold.map((value) => Math.round(value * 100) / 100),
+      structuralProcessP50Ms: percentile(structuralProcess, 0.5),
+      structuralProcessP95Ms: percentile(structuralProcess, 0.95),
+      structuralOpenP50Ms: percentile(structuralOpen, 0.5),
+      structuralQueryP50Ms: percentile(structuralQuery, 0.5),
+      hotP50Ms: percentile(contextHot, 0.5), hotP95Ms: percentile(contextHot, 0.95),
+      hotToColdRatio: Math.round((percentile(contextHot, 0.5) / Math.max(0.01, percentile(contextCold, 0.5))) * 1_000) / 1_000,
+      cacheEvidence: hotCacheEvidence,
+      accuracy: contextAccuracyEvidence,
+    },
+    command: {
+      rawChildP50Ms: percentile(rawChild, 0.5), lightweightTotalP50Ms: percentile(harnessTotal, 0.5),
+      preSpawnHarnessP50Ms: percentile(preSpawnHarness, 0.5),
+      preSpawnHarnessP95Ms: percentile(preSpawnHarness, 0.95),
+      durableProcessWrites: 0, leaseOperations: 0,
+    },
+    thresholds: {
+      hotContextToColdP50MaxRatio: 0.9,
+      contextRecallMin: 1,
+      contextPrecisionMin: 1,
+      lightweightPreSpawnHarnessP95MaxMs: 750,
+      durableProcessWritesMax: 0,
+      leaseOperationsMax: 0,
+    },
+  };
+  const assertions = {
+    hotContextReuse: output.context.hotToColdRatio <= output.thresholds.hotContextToColdP50MaxRatio,
+    completeRequiredContext: (output.context.accuracy?.recall ?? 0) >= output.thresholds.contextRecallMin,
+    boundedContextNoise: (output.context.accuracy?.precision ?? 0) >= output.thresholds.contextPrecisionMin,
+    boundedPreSpawnHarness: output.command.preSpawnHarnessP95Ms <= output.thresholds.lightweightPreSpawnHarnessP95MaxMs,
+    zeroDurableWrites: output.command.durableProcessWrites <= output.thresholds.durableProcessWritesMax,
+    zeroLeaseOperations: output.command.leaseOperations <= output.thresholds.leaseOperationsMax,
+  };
+  process.stdout.write(`${JSON.stringify({ ...output, assertions, passed: Object.values(assertions).every(Boolean) }, null, 2)}\n`);
+  if (!Object.values(assertions).every(Boolean)) process.exitCode = 1;
+} finally {
+  await closeCodeGraphReadProviderSessions();
+  rmSync(sandboxRoot, { recursive: true, force: true });
+}

package/scripts/benchmark-route-session-concurrency.ts

@@ -12,6 +12,9 @@ import { createMcpToolContext } from '../src/cli/mcp/server';
 import { callMultiRepositoryTool } from '../src/cli/mcp/multi-repository';
 import { callRuntimeTool } from '../src/runtime/gateway/mcp/runtime-tools';
 import { createWorkContract } from '../src/runtime/control-plane/facade/work-contract-store';
+import { createRequirement } from '../src/runtime/control-plane/persistence/requirement-store';
+import { startGoalWorkloop } from '../src/runtime/control-plane/facade/goal-workloop';
+import { withPrimaryWorkAdmissionLockAsync } from '../src/runtime/control-plane/facade/semantic-admission';
 import { executionIdentityForRepository } from '../src/runtime/control-plane/execution/execution-identity';
 import { acquireRuntimeOwnership } from '../src/runtime/root/ownership';
 import { ensureActiveRuntimeRelease } from '../src/runtime/root/release-store';
@@ -47,6 +50,30 @@ interface Sample {
   metrics?: Record<string, number>;
 }
 
+interface SemanticAdmissionWorkerResult {
+  index: number;
+  requirementId: string;
+  status: string;
+  decision: string;
+  created: boolean;
+  authorityWorkId?: string;
+  criticalSectionMs: number;
+  criticalSectionCpuMs: number;
+  totalAdmissionMs: number;
+}
+
+interface SemanticAdmissionBurstResult {
+  controllers: number;
+  createdAuthorities: number;
+  uniqueAuthorityCount: number;
+  deterministicResolutions: number;
+  criticalSectionP50Ms: number;
+  criticalSectionP95Ms: number;
+  criticalSectionCpuP95Ms: number;
+  totalAdmissionP95Ms: number;
+  success: boolean;
+}
+
 function phases(): Phases {
   return Object.fromEntries(PHASES.map((phase) => [phase, 0])) as Phases;
 }
@@ -178,6 +205,138 @@ async function guarded(operation: () => Promise<Sample>): Promise<Sample> {
   }
 }
 
+function cliValue(name: string): string | undefined {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1]?.trim() : undefined;
+}
+
+async function semanticAdmissionWorker(): Promise<void> {
+  const controllerHome = cliValue('--controller-home');
+  const repoId = cliValue('--repo-id');
+  const storeRoot = cliValue('--store-root');
+  const requirementId = cliValue('--requirement-id');
+  const mode = cliValue('--semantic-mode');
+  const index = Number(cliValue('--worker-index'));
+  const startAt = Number(cliValue('--start-at'));
+  if (!controllerHome || !repoId || !storeRoot || !requirementId || !['same', 'independent'].includes(mode ?? '') || !Number.isFinite(index) || !Number.isFinite(startAt)) {
+    throw new Error('semantic admission worker arguments are incomplete');
+  }
+  const delayMs = Math.max(0, startAt - Date.now());
+  if (delayMs > 0) await new Promise((resolve) => setTimeout(resolve, delayMs));
+  let criticalSectionMs = 0;
+  let criticalSectionCpuMs = 0;
+  const started = performance.now();
+  const facade = await withPrimaryWorkAdmissionLockAsync({ controllerHome, repoId }, () => {
+    const entered = performance.now();
+    const cpuEntered = process.cpuUsage();
+    const value = startGoalWorkloop({
+      workStore: { controllerHome, repoId },
+      handoffStore: { root: join(storeRoot, 'handoff') },
+      repoId,
+      checkoutId: `semantic-${mode}-${index}`,
+      principalId: `semantic-principal-${index}`,
+      controllerInstanceId: `semantic-controller-${index}`,
+      sourceRevision: 'semantic-admission-benchmark',
+      semanticAdmissionLocked: true,
+    }, {
+      objective: mode === 'same'
+        ? 'Own the semantic admission benchmark requirement'
+        : `Own independent semantic admission requirement ${index}`,
+      requirementId,
+      requestedBy: 'chatgpt',
+      modeInput: {
+        scopeClear: true,
+        mutation: true,
+        expectedFiles: 4,
+        expectedChangedLines: 200,
+        requiresRecovery: true,
+        risk: 'local_repo_write',
+      },
+    });
+    criticalSectionMs = elapsed(entered);
+    const cpuElapsed = process.cpuUsage(cpuEntered);
+    criticalSectionCpuMs = (cpuElapsed.user + cpuElapsed.system) / 1_000;
+    return value;
+  });
+  const data = facade.data && typeof facade.data === 'object' ? facade.data as Record<string, unknown> : {};
+  const work = data.work && typeof data.work === 'object' ? data.work as Record<string, unknown> : undefined;
+  const recommendedWork = data.recommendedWork && typeof data.recommendedWork === 'object' ? data.recommendedWork as Record<string, unknown> : undefined;
+  const candidates = Array.isArray(data.candidates) ? data.candidates as Record<string, unknown>[] : [];
+  const authorityWorkId = [work?.workId, recommendedWork?.workId, candidates[0]?.workId]
+    .find((value): value is string => typeof value === 'string' && value.length > 0);
+  const result: SemanticAdmissionWorkerResult = {
+    index,
+    requirementId,
+    status: facade.status,
+    decision: typeof data.admissionDecision === 'string'
+      ? data.admissionDecision
+      : data.workContractCreated === true ? 'create_new' : 'unknown',
+    created: data.workContractCreated === true,
+    ...(authorityWorkId ? { authorityWorkId } : {}),
+    criticalSectionMs: Math.round(criticalSectionMs * 1000) / 1000,
+    criticalSectionCpuMs: Math.round(criticalSectionCpuMs * 1000) / 1000,
+    totalAdmissionMs: Math.round(elapsed(started) * 1000) / 1000,
+  };
+  process.stdout.write(`${JSON.stringify(result)}\n`);
+}
+
+async function runSemanticAdmissionBurst(input: {
+  controllerHome: string;
+  repoId: string;
+  storeRoot: string;
+  mode: 'same' | 'independent';
+  controllers?: number;
+}): Promise<SemanticAdmissionBurstResult> {
+  const controllers = input.controllers ?? 32;
+  mkdirSync(input.storeRoot, { recursive: true });
+  const startAt = Date.now() + 1_500;
+  const scriptPath = process.argv[1]!;
+  const children = Array.from({ length: controllers }, (_, index) => {
+    const requirementId = input.mode === 'same'
+      ? 'REQ-semantic-admission-benchmark-shared'
+      : `REQ-semantic-admission-benchmark-${index}`;
+    return Bun.spawn([
+      process.execPath,
+      scriptPath,
+      '--semantic-admission-worker',
+      '--controller-home', input.controllerHome,
+      '--repo-id', input.repoId,
+      '--store-root', input.storeRoot,
+      '--requirement-id', requirementId,
+      '--semantic-mode', input.mode,
+      '--worker-index', String(index),
+      '--start-at', String(startAt),
+    ], { stdout: 'pipe', stderr: 'pipe' });
+  });
+  const rows = await Promise.all(children.map(async (child) => {
+    const [stdout, stderr, exitCode] = await Promise.all([
+      new Response(child.stdout).text(),
+      new Response(child.stderr).text(),
+      child.exited,
+    ]);
+    if (exitCode !== 0) throw new Error(`semantic admission worker failed (${exitCode}): ${stderr || stdout}`);
+    return JSON.parse(stdout.trim()) as SemanticAdmissionWorkerResult;
+  }));
+  const createdAuthorities = rows.filter((row) => row.created).length;
+  const authorityIds = new Set(rows.map((row) => row.authorityWorkId).filter((value): value is string => Boolean(value)));
+  const deterministicResolutions = rows.filter((row) => row.created || row.decision === 'reuse_existing' || row.decision === 'resolution_required').length;
+  const criticalValues = rows.map((row) => row.criticalSectionMs);
+  const success = input.mode === 'same'
+    ? createdAuthorities === 1 && authorityIds.size === 1 && deterministicResolutions === controllers
+    : createdAuthorities === controllers && authorityIds.size === controllers && deterministicResolutions === controllers;
+  return {
+    controllers,
+    createdAuthorities,
+    uniqueAuthorityCount: authorityIds.size,
+    deterministicResolutions,
+    criticalSectionP50Ms: percentile(criticalValues, 0.50),
+    criticalSectionP95Ms: percentile(criticalValues, 0.95),
+    criticalSectionCpuP95Ms: percentile(rows.map((row) => row.criticalSectionCpuMs), 0.95),
+    totalAdmissionP95Ms: percentile(rows.map((row) => row.totalAdmissionMs), 0.95),
+    success,
+  };
+}
+
 async function main(): Promise<void> {
   const iterationsIndex = process.argv.indexOf('--iterations');
   const outputIndex = process.argv.indexOf('--output');
@@ -190,6 +349,38 @@ async function main(): Promise<void> {
     const first = repositoryFixture(root, controllerHome, 'repository-a');
     const second = repositoryFixture(root, controllerHome, 'repository-b');
     const firstIsolated = worktreeFixture(root, controllerHome, first);
+    createRequirement({ controllerHome }, {
+      requirementId: 'REQ-semantic-admission-benchmark-shared',
+      title: 'Semantic admission benchmark shared authority',
+      outcomeStatement: 'Measure deterministic concurrent admission for one shared Requirement authority.',
+    });
+    for (let index = 0; index < 32; index += 1) {
+      createRequirement({ controllerHome }, {
+        requirementId: `REQ-semantic-admission-benchmark-${index}`,
+        title: `Semantic admission benchmark independent authority ${index}`,
+        outcomeStatement: 'Measure deterministic concurrent admission for an independent Requirement authority.',
+      });
+    }
+    const sameAuthorityAdmission = await runSemanticAdmissionBurst({ controllerHome, repoId: first.repository.repoId, storeRoot: join(root, 'semantic-same-authority'), mode: 'same' });
+    const independentRequirementAdmission = await runSemanticAdmissionBurst({ controllerHome, repoId: first.repository.repoId, storeRoot: join(root, 'semantic-independent-requirements'), mode: 'independent' });
+    const semanticAdmissionCriticalWallP95Ms = Math.max(sameAuthorityAdmission.criticalSectionP95Ms, independentRequirementAdmission.criticalSectionP95Ms);
+    const semanticAdmissionCriticalCpuP95Ms = Math.max(sameAuthorityAdmission.criticalSectionCpuP95Ms, independentRequirementAdmission.criticalSectionCpuP95Ms);
+    const semanticAdmission = {
+      sameAuthority: sameAuthorityAdmission,
+      independentRequirements: independentRequirementAdmission,
+      acceptance: {
+        minimumControllers: 32,
+        criticalSectionCpuP95ThresholdMs: 10,
+        criticalSectionCpuP95TargetMs: 5,
+        criticalSectionWallP95GuardrailMs: 100,
+        observedCriticalSectionCpuP95Ms: semanticAdmissionCriticalCpuP95Ms,
+        observedCriticalSectionWallP95Ms: semanticAdmissionCriticalWallP95Ms,
+        passed: sameAuthorityAdmission.success
+          && independentRequirementAdmission.success
+          && semanticAdmissionCriticalCpuP95Ms <= 10
+          && semanticAdmissionCriticalWallP95Ms <= 100,
+      },
+    };
     const results = new Map<string, Sample[]>();
     const run = async (name: string, operation: () => Promise<Sample>) => {
       results.set(name, [...(results.get(name) ?? []), await guarded(operation)]);
@@ -200,10 +391,11 @@ async function main(): Promise<void> {
         const timing = phases();
         const started = performance.now();
         const projectionStarted = performance.now();
-        const value = await callRuntimeTool(first.context, 'controller_context_pack', {
+        const value = await callRuntimeTool(first.context, 'rh_context', {
           repo_id: first.repository.repoId,
-          variant: 'summary',
-          force_refresh: true,
+          operation: 'search',
+          query: 'benchmark repository context cold read',
+          structural_context: 'off',
         });
         timing.projectionMs = elapsed(projectionStarted);
         timing.gitObservationMs = timing.projectionMs;
@@ -218,9 +410,11 @@ async function main(): Promise<void> {
         const timing = phases();
         const started = performance.now();
         const projectionStarted = performance.now();
-        const value = await callRuntimeTool(first.context, 'controller_context_pack', {
+        const value = await callRuntimeTool(first.context, 'rh_context', {
           repo_id: first.repository.repoId,
-          variant: 'summary',
+          operation: 'search',
+          query: 'benchmark repository context cold read',
+          structural_context: 'off',
         });
         timing.projectionMs = elapsed(projectionStarted);
         const serializationStarted = performance.now();
@@ -696,7 +890,9 @@ async function main(): Promise<void> {
         sameCheckoutContention: 'leaseWaitMs is the bounded end-to-end admission time for the conflicting second Process, including identity/persistence work around the Lease decision.',
         checkIdentity: 'The cache identity is derived from repository-scoped storage plus content revision, check definition digest, environment/toolchain fingerprint, timeout contract, and reuse scope. Session and request ids are subscribers, not cache-key inputs.',
         checkCacheMetrics: 'physicalExecutions/logicalSubscribers/coalesced/cacheHits/invalidations/crossCheckoutReuses are summed across measured iterations.',
+        semanticAdmission: 'Two 32-process bursts share one repository-scoped semantic admission lock: one contends for a single Requirement authority and one admits 32 independent Requirement identities. Critical-section latency measures only canonical ownership resolution and persistence inside the lock.',
       },
+      semanticAdmission,
       scenarios: Object.fromEntries([...results].map(([name, samples]) => [name, summarize(samples)])),
     };
     const serialized = `${JSON.stringify(report, null, 2)}\n`;
@@ -705,10 +901,15 @@ async function main(): Promise<void> {
       writeFileSync(outputPath, serialized);
     }
     process.stdout.write(serialized);
+    if (!semanticAdmission.acceptance.passed) process.exitCode = 1;
   } finally {
     clearRuntimeWriteClaimForTests();
     rmSync(root, { recursive: true, force: true });
   }
 }
 
-await main();
+if (process.argv.includes('--semantic-admission-worker')) {
+  await semanticAdmissionWorker();
+} else {
+  await main();
+}

package/scripts/benchmark-thin-harness-mcp-e2e.ts

@@ -37,6 +37,7 @@ import {
 } from '../src/runtime/resources/leases/store';
 import type { MultiRepositoryMcpToolContext } from '../src/cli/mcp/multi-repository';
 import { waitForProcess } from '../src/runtime/execution/process-runtime/runtime';
+import { isLightweightProcessId, waitForLightweightProcess } from '../src/runtime/execution/process-runtime/lightweight-managed';
 
 function git(root: string, args: string[]): void {
   const result = spawnSync('git', ['-C', root, ...args], { encoding: 'utf-8' });
@@ -245,7 +246,12 @@ async function sampleCase(
   // the next sample so a correct same-checkout resource claim is not misreported
   // as a benchmark regression.
   if (phases.path === 'process_managed' && processId) {
-    await waitForProcess(fixture.controllerHome, fixture.repository.repoId, processId, { timeoutMs: 10_000 });
+    const settled = isLightweightProcessId(processId)
+      ? await waitForLightweightProcess(fixture.controllerHome, fixture.repository.repoId, processId, { timeoutMs: 10_000 })
+      : await waitForProcess(fixture.controllerHome, fixture.repository.repoId, processId, { timeoutMs: 10_000 });
+    if (!settled.completed) {
+      throw new Error(`BENCHMARK_PROCESS_DID_NOT_SETTLE: ${processId}`);
+    }
   }
   return {
     ...phases,