okengine 0.17.2 → 0.18.3

package/src/bench/g05-sustained-full.bench.ts

@@ -0,0 +1,265 @@
+/**
+ * G5 — sustained full-app baseline + memory (≥5 min).
+ *
+ * Boots `load-child serve`, then drives fixed concurrency 50 closed-loop:
+ * 30 workers on `/ping`, 20 workers round-robining mixed element endpoints
+ * (vault read, json stream, rate gate, store insert). RSS/fd sampled every
+ * 10 s (`lib/rss-sampler.ts`). Duration `OKE_BENCH_DURATION_S` (default 300);
+ * auto-extends to 600 s ONLY if the trailing RSS slope is still rising.
+ * p99 spikes are annotated as likely-JSC-GC unless correlated with errors.
+ *
+ * Leak protocol: if a leak appears mid-run, STOP, fix, restart from t=0 —
+ * never resume. (Enforced by failing the run when errors spike.)
+ *
+ * Run: OKE_BENCH=1 OKE_TEST_POSTGRES=1 DATABASE_URL=… OKE_TEST_REDIS_URL=… bun test ./src/bench/g05-sustained-full.bench.ts --timeout 600000
+ */
+
+import { describe, expect, test } from "bun:test";
+import { LIVE_PG } from "./lib/infra.ts";
+import { rssSlopeMbPerMin, startSampler } from "./lib/rss-sampler.ts";
+import { DISCLAIMER, HARDWARE, percentile, writeArtifact } from "./lib/report.ts";
+
+const CAL = process.env.OKE_BENCH_CAL === "1";
+const PORT = 6675;
+const BASE = `http://127.0.0.1:${PORT}`;
+const DURATION_S = CAL ? 20 : Math.max(60, Number(process.env.OKE_BENCH_DURATION_S ?? "300"));
+const EXTEND_S = CAL ? 0 : 300;
+const CONCURRENCY = 50;
+const PING_WORKERS = 30;
+const MIXED = ["/_/bench/vault-read", "/_/bench/stream", "/rate", "/_/bench/rls"] as const;
+
+interface Sample {
+  tMs: number;
+  rssMb: number;
+  fds: number;
+}
+
+type Server = Bun.Subprocess<"ignore", "pipe", "ignore">;
+
+function spawnServe(): Server {
+  return Bun.spawn(["bun", "run", "src/bench/load-child.ts", "serve", String(PORT)], {
+    stdout: "pipe",
+    stderr: "ignore",
+    env: process.env,
+  });
+}
+
+async function readReadyPid(proc: Server): Promise<number> {
+  const reader = proc.stdout.getReader();
+  const dec = new TextDecoder();
+  let buf = "";
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) throw new Error("server died before ready");
+    buf += dec.decode(value, { stream: true });
+    const nl = buf.indexOf("\n");
+    if (nl >= 0) {
+      const line = buf.slice(0, nl).trim();
+      if (line.startsWith("{")) {
+        void (async () => {
+          try {
+            for (;;) {
+              const r = await reader.read();
+              if (r.done) break;
+            }
+          } catch {
+            /* closed */
+          }
+        })();
+        return (JSON.parse(line) as { pid: number }).pid;
+      }
+    }
+  }
+}
+
+describe.skipIf(!process.env.OKE_BENCH || !LIVE_PG)("G5 — sustained baseline", () => {
+  test(
+    `${CONCURRENCY} closed-loop × ${DURATION_S}s (+${EXTEND_S}s if rising) — rps, RSS slope, GC spikes`,
+    async () => {
+      const server = spawnServe();
+      try {
+        const pid = await readReadyPid(server);
+        // Warm-up so boot/JIT isn't counted.
+        await Bun.sleep(CAL ? 2_000 : 5_000);
+
+        const sampler = startSampler(pid, 10_000);
+        const t0 = performance.now();
+        const deadlineMs = DURATION_S * 1000;
+
+        const latencies: Record<string, number[]> = { ping: [], mixed: [] };
+        // Thin latency samples beyond 200k so percentile sorting and memory
+        // stay bounded on long runs; request counts remain exact.
+        const pushLat = (arr: number[], ms: number): void => {
+          if (arr.length < 200_000 || arr.length % 8 === 0) arr.push(ms);
+        };
+        let requests = 0;
+        let errors = 0;
+        let stop = false;
+        const classCount = { ping: 0, mixed: 0 };
+
+        const pingWorker = async (): Promise<void> => {
+          while (!stop) {
+            const s = performance.now();
+            try {
+              const res = await fetch(`${BASE}/ping`);
+              await res.arrayBuffer();
+              if (!res.ok) errors++;
+            } catch {
+              errors++;
+              continue;
+            }
+            pushLat(latencies.ping!, performance.now() - s);
+            requests++;
+            classCount.ping++;
+          }
+        };
+
+        let mixedIdx = 0;
+        let gated429 = 0;
+        const mixedWorker = async (): Promise<void> => {
+          while (!stop) {
+            const path = MIXED[mixedIdx++ % MIXED.length]!;
+            const s = performance.now();
+            try {
+              const res =
+                path === "/rate"
+                  ? await fetch(`${BASE}${path}`)
+                  : await fetch(`${BASE}${path}`, {
+                      method: "POST",
+                      headers: { "content-type": "application/json" },
+                      body: JSON.stringify(path === "/_/bench/stream" ? { chunks: 8 } : { n: 1 }),
+                    });
+              await res.arrayBuffer();
+              if (res.status === 429 && path === "/rate") {
+                // Expected physics: the bench deliberately overruns the
+                // 1000/min gate — count separately, not as an error.
+                gated429++;
+              } else if (!res.ok) {
+                errors++;
+              }
+            } catch {
+              errors++;
+              continue;
+            }
+            pushLat(latencies.mixed!, performance.now() - s);
+            requests++;
+            classCount.mixed++;
+          }
+        };
+
+        const running = Promise.all([
+          ...Array.from({ length: PING_WORKERS }, () => pingWorker()),
+          ...Array.from({ length: CONCURRENCY - PING_WORKERS }, () => mixedWorker()),
+        ]);
+
+        // Phase 1: baseline duration; extend only while RSS slope still rises.
+        let phase1Samples: readonly Sample[] = [];
+        for (;;) {
+          await Bun.sleep(CAL ? 5_000 : 30_000);
+          phase1Samples = [...sampler.samples()];
+          const elapsed = performance.now() - t0;
+          if (stop) break;
+          if (elapsed >= deadlineMs) {
+            const tailSlope = rssSlopeMbPerMin(phase1Samples, 6);
+            if (!CAL && tailSlope > 2 && elapsed < deadlineMs + EXTEND_S * 1000 - 60_000) {
+              console.log(
+                `[G5] RSS slope still rising (${tailSlope} MB/min) at ${DURATION_S}s — extending to ${DURATION_S + EXTEND_S}s`,
+              );
+              continue;
+            }
+            stop = true;
+          }
+        }
+        await running;
+        const wallS = (performance.now() - t0) / 1000;
+        await sampler.stop();
+
+        const all = [...phase1Samples];
+        const pingLats = latencies.ping!;
+        const mixedLats = latencies.mixed!;
+        const flat = [...pingLats, ...mixedLats];
+
+        // Windowed p99 (per ~30 s slice) → spikes annotated as likely JSC GC
+        // unless correlated with request errors in the same window.
+        const windowP99s: number[] = [];
+        const buckets = new Map<number, number[]>();
+        const sliceCount = Math.max(1, Math.floor(wallS / 30));
+        for (let i = 0; i < flat.length; i++) {
+          const slice = Math.min(sliceCount - 1, Math.floor((i / flat.length) * sliceCount));
+          const arr = buckets.get(slice) ?? [];
+          arr.push(flat[i]!);
+          buckets.set(slice, arr);
+        }
+        for (const arr of buckets.values()) windowP99s.push(percentile(arr, 99));
+        const medianWindowP99 = percentile(windowP99s, 50) || 0;
+        const gcSpikeWindows = windowP99s.filter(
+          (p) => medianWindowP99 > 0 && p > medianWindowP99 * 3,
+        ).length;
+
+        const rssSlopeFull = rssSlopeMbPerMin(all);
+        const rssSlopeTail = rssSlopeMbPerMin(all, 6);
+        // Spread-into-Math.max overflows the call stack at millions of
+        // samples — always reduce instead.
+        const maxOf = (arr: readonly number[]): number => arr.reduce((a, b) => (b > a ? b : a), 0);
+        const issues: string[] = [];
+        if (errors > 0) {
+          issues.push(
+            `${errors} request errors under sustained load — investigate before trusting p99`,
+          );
+        }
+        if (rssSlopeFull > 5 && rssSlopeTail > 2) {
+          issues.push(
+            `RSS slope ${rssSlopeFull} MB/min full-run and still ${rssSlopeTail} MB/min over the last minute — suspected leak; re-run from t=0 after any fix`,
+          );
+        } else if (rssSlopeFull > 5) {
+          issues.push(
+            `RSS slope ${rssSlopeFull} MB/min full-run but tail is flat (${rssSlopeTail} MB/min last minute) — consistent with JSC heap expansion ramp, not an unbounded leak`,
+          );
+        }
+
+        const metrics: Record<string, number> = {
+          durationS: Number(wallS.toFixed(1)),
+          concurrency: CONCURRENCY,
+          totalRequests: requests,
+          reqPerSec: Number((requests / wallS).toFixed(1)),
+          pingReqPerSec: Number((classCount.ping / wallS).toFixed(1)),
+          mixedReqPerSec: Number((classCount.mixed / wallS).toFixed(1)),
+          pingP50Ms: Number(percentile(pingLats, 50).toFixed(2)),
+          pingP99Ms: Number(percentile(pingLats, 99).toFixed(2)),
+          mixedP50Ms: Number(percentile(mixedLats, 50).toFixed(2)),
+          mixedP99Ms: Number(percentile(mixedLats, 99).toFixed(2)),
+          overallMaxMs: flat.length ? Number(maxOf(flat).toFixed(2)) : 0,
+          gcSpikeWindows,
+          windowP99MedianMs: Number(medianWindowP99.toFixed(2)),
+          rssSlopeMbPerMin: rssSlopeFull,
+          rssSlopeLastMinute: rssSlopeTail,
+          rssMaxMb: all.length ? Number(maxOf(all.map((x) => x.rssMb)).toFixed(1)) : -1,
+          fdsFinal: all.length ? all[all.length - 1]!.fds : -1,
+          gateLimited429: gated429,
+          errors,
+        };
+        console.log("[G5] metrics:", JSON.stringify(metrics));
+
+        const path = await writeArtifact({
+          group: "G5-sustained-full",
+          hardware: HARDWARE,
+          disclaimer: DISCLAIMER,
+          command:
+            "OKE_BENCH=1 OKE_TEST_POSTGRES=1 DATABASE_URL=$DATABASE_URL OKE_TEST_REDIS_URL=$OKE_TEST_REDIS_URL bun test ./src/bench/g05-sustained-full.bench.ts --timeout 600000",
+          metrics,
+          issues,
+          fixes: [],
+          remeasured: null,
+        });
+        console.log(`[G5] artifact: ${path}`);
+
+        expect(errors / Math.max(1, requests)).toBeLessThan(0.001);
+        expect(requests).toBeGreaterThan(0);
+      } finally {
+        server.kill();
+        await server.exited.catch(() => {});
+      }
+    },
+    CAL ? 120_000 : 700_000,
+  );
+});

package/src/bench/g06-mixed-load.bench.ts

@@ -0,0 +1,260 @@
+/**
+ * G6 — mixed load + event-loop lag on a single child.
+ *
+ * One `load-child serve` process, driven concurrently by:
+ *   - HTTP flood (20 closed-loop workers on `/ping`)
+ *   - once-signal emit (8 workers on `/_/bench/emit`) + periodic drain
+ *   - live-signal emits (8 workers on `/_/bench/emit-live`) fanned out to
+ *     ≥50 in-process SSE subscribers whose received frames are counted
+ *   - the child's internal clock tick loop (20 ms) under all of the above
+ *
+ * Reports per-subsystem throughput compared against the newest G5 artifact
+ * (cross-contention delta) plus harness-side `measureEventLoopLag()` p99.
+ *
+ * Run: OKE_BENCH=1 OKE_TEST_POSTGRES=1 DATABASE_URL=… OKE_TEST_REDIS_URL=… bun test ./src/bench/g06-mixed-load.bench.ts --timeout 300000
+ */
+
+import { describe, expect, test } from "bun:test";
+import { LIVE_PG } from "./lib/infra.ts";
+import { measureEventLoopLag } from "./lib/event-loop-lag.ts";
+import { DISCLAIMER, HARDWARE, percentile, writeArtifact } from "./lib/report.ts";
+
+const CAL = process.env.OKE_BENCH_CAL === "1";
+const PORT = 6676;
+const BASE = `http://127.0.0.1:${PORT}`;
+const DURATION_S = CAL ? 15 : Math.max(30, Number(process.env.OKE_BENCH_G6_S ?? "60"));
+const SSE_SUBSCRIBERS = 50;
+const PING_WORKERS = 20;
+const EMIT_WORKERS = 8;
+const LIVE_WORKERS = 8;
+
+type Server = Bun.Subprocess<"ignore", "pipe", "ignore">;
+
+function spawnServe(): Server {
+  return Bun.spawn(["bun", "run", "src/bench/load-child.ts", "serve", String(PORT)], {
+    stdout: "pipe",
+    stderr: "ignore",
+    env: process.env,
+  });
+}
+
+async function readReadyPid(proc: Server): Promise<number> {
+  const reader = proc.stdout.getReader();
+  const dec = new TextDecoder();
+  let buf = "";
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) throw new Error("server died before ready");
+    buf += dec.decode(value, { stream: true });
+    const nl = buf.indexOf("\n");
+    if (nl >= 0) {
+      const line = buf.slice(0, nl).trim();
+      if (line.startsWith("{")) {
+        void (async () => {
+          try {
+            for (;;) {
+              const r = await reader.read();
+              if (r.done) break;
+            }
+          } catch {
+            /* closed */
+          }
+        })();
+        return (JSON.parse(line) as { pid: number }).pid;
+      }
+    }
+  }
+}
+
+/** SSE subscriber that counts received data frames until aborted. */
+async function sseSubscriber(
+  target: string,
+  ac: AbortController,
+  onFrame: () => void,
+): Promise<void> {
+  while (!ac.signal.aborted) {
+    try {
+      const res = await fetch(target, {
+        signal: ac.signal,
+        headers: { accept: "text/event-stream" },
+      });
+      if (!res.body) return;
+      const reader = res.body.getReader();
+      const dec = new TextDecoder();
+      let buf = "";
+      for (;;) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        buf += dec.decode(value, { stream: true });
+        let sep = buf.indexOf("\n\n");
+        while (sep >= 0) {
+          if (buf.slice(0, sep).includes("data:")) onFrame();
+          buf = buf.slice(sep + 2);
+          sep = buf.indexOf("\n\n");
+        }
+      }
+    } catch {
+      if (ac.signal.aborted) return;
+    }
+    await Bun.sleep(100); // reconnect briefly if dropped
+  }
+}
+
+/** Newest G5 artifact metrics for cross-contention comparison. */
+async function latestG5(): Promise<Record<string, number> | null> {
+  try {
+    const proc = Bun.spawnSync([
+      "sh",
+      "-c",
+      "ls -t src/bench/results/G5-*.json 2>/dev/null | head -1",
+    ]);
+    const file = proc.stdout.toString().trim();
+    if (!file) return null;
+    return JSON.parse(await Bun.file(file).text()).metrics as Record<string, number>;
+  } catch {
+    return null;
+  }
+}
+
+describe.skipIf(!process.env.OKE_BENCH || !LIVE_PG)("G6 — mixed load contention", () => {
+  test(
+    `HTTP flood + emit/drain + live SSE(${SSE_SUBSCRIBERS}) + clock tick × ${DURATION_S}s`,
+    async () => {
+      const server = spawnServe();
+      try {
+        await readReadyPid(server);
+        await Bun.sleep(CAL ? 2_000 : 4_000); // warm-up
+
+        const lag = measureEventLoopLag(100);
+        const target = `${BASE}/_oke/live/bench-live`;
+        let sseFrames = 0;
+        const sseCtrl = new AbortController();
+        const subscribers = Array.from({ length: SSE_SUBSCRIBERS }, () =>
+          sseSubscriber(target, sseCtrl, () => sseFrames++),
+        );
+        // Let every subscriber connect before load starts.
+        await Bun.sleep(3_000);
+
+        const t0 = performance.now();
+        let stop = false;
+        const counters = { ping: 0, emit: 0, live: 0, drain: 0, errors: 0 };
+        const pingLats: number[] = [];
+        const emitLats: number[] = [];
+        const liveEmitLats: number[] = [];
+
+        const loop = async (
+          path: string,
+          counter: keyof typeof counters,
+          lats?: number[],
+        ): Promise<void> => {
+          while (!stop) {
+            const s = performance.now();
+            try {
+              const res =
+                path === "/ping"
+                  ? await fetch(`${BASE}${path}`)
+                  : await fetch(`${BASE}${path}`, { method: "POST" });
+              await res.arrayBuffer();
+              if (!res.ok) counters.errors++;
+            } catch {
+              counters.errors++;
+              continue;
+            }
+            lats?.push(performance.now() - s);
+            counters[counter]++;
+          }
+        };
+
+        const pingWorkers = Array.from({ length: PING_WORKERS }, () =>
+          loop("/ping", "ping", pingLats),
+        );
+        const emitWorkers = Array.from({ length: EMIT_WORKERS }, () =>
+          loop("/_/bench/emit", "emit", emitLats),
+        );
+        const liveWorkers = Array.from({ length: LIVE_WORKERS }, () =>
+          loop("/_/bench/emit-live", "live", liveEmitLats),
+        );
+
+        // Periodic explicit drain calls alongside the child's internal drain.
+        const drainLoop = (async () => {
+          while (!stop) {
+            try {
+              const res = await fetch(`${BASE}/_/bench/drain`, { method: "POST" });
+              await res.arrayBuffer();
+              if (res.ok) counters.drain++;
+            } catch {
+              counters.errors++;
+            }
+            await Bun.sleep(50);
+          }
+        })();
+
+        await Bun.sleep(DURATION_S * 1000);
+        stop = true;
+        await Promise.all([...pingWorkers, ...emitWorkers, ...liveWorkers, drainLoop]);
+        sseCtrl.abort();
+        await Promise.race([Promise.all(subscribers), Bun.sleep(5_000)]);
+        lag.stop();
+
+        const wallS = (performance.now() - t0) / 1000;
+        const g5 = await latestG5();
+
+        const lags = lag.lags();
+        const metrics: Record<string, number> = {
+          durationS: Number(wallS.toFixed(1)),
+          pingReqPerSec: Number((counters.ping / wallS).toFixed(1)),
+          emitPerSec: Number((counters.emit / wallS).toFixed(1)),
+          liveEmitPerSec: Number((counters.live / wallS).toFixed(1)),
+          drainsPerSec: Number((counters.drain / wallS).toFixed(1)),
+          sseFramesReceived: sseFrames,
+          sseDeliveredPerSec: Number((sseFrames / wallS).toFixed(1)),
+          errors: counters.errors,
+          lagP50Ms: Number(percentile(lags, 50).toFixed(2)),
+          lagP99Ms: Number(percentile(lags, 99).toFixed(2)),
+          lagMaxMs: lags.length ? Number(Math.max(...lags).toFixed(2)) : 0,
+        };
+        if (g5) {
+          const g5Ping = g5.pingReqPerSec ?? -1;
+          metrics.g5BaselinePingRps = g5Ping;
+          metrics.pingDeltaVsG5Pct =
+            g5Ping > 0
+              ? Number(((((metrics.pingReqPerSec ?? 0) - g5Ping) / g5Ping) * 100).toFixed(1))
+              : -1;
+        }
+
+        const issues: string[] = [];
+        if ((metrics.errors ?? 0) > 0) {
+          issues.push(`${metrics.errors} request errors under mixed load`);
+        }
+        if (g5 && metrics.pingDeltaVsG5Pct! < -40) {
+          issues.push(
+            `ping throughput fell ${Math.abs(metrics.pingDeltaVsG5Pct!)}% vs G5 baseline under cross-subsystem contention`,
+          );
+        }
+
+        console.log("[G6] metrics:", JSON.stringify(metrics));
+        const path = await writeArtifact({
+          group: "G6-mixed-load",
+          hardware: HARDWARE,
+          disclaimer: DISCLAIMER,
+          command:
+            "OKE_BENCH=1 OKE_TEST_POSTGRES=1 DATABASE_URL=$DATABASE_URL OKE_TEST_REDIS_URL=$OKE_TEST_REDIS_URL bun test ./src/bench/g06-mixed-load.bench.ts --timeout 300000",
+          metrics,
+          issues,
+          fixes: [],
+          remeasured: null,
+        });
+        console.log(`[G6] artifact: ${path}`);
+
+        expect(
+          (metrics.errors ?? 0) / Math.max(1, counters.ping + counters.emit + counters.live),
+        ).toBeLessThan(0.001);
+        expect(metrics.sseFramesReceived).toBeGreaterThan(0);
+      } finally {
+        server.kill();
+        await server.exited.catch(() => {});
+      }
+    },
+    CAL ? 120_000 : 240_000,
+  );
+});

package/src/bench/g07-vault-crypto.bench.ts

@@ -0,0 +1,100 @@
+/**
+ * G7a — Vault raw crypto throughput (pure CPU).
+ *
+ * AES-256-GCM round-trips via `src/elements/vault/crypto.ts` — encrypt /
+ * decrypt / full round-trip ops-per-second at 1 KiB and 64 KiB payloads,
+ * with AAD bound exactly as production secrets are.
+ *
+ * Run: bun test ./src/bench/g07-vault-crypto.bench.ts
+ */
+
+import { describe, expect, test } from "bun:test";
+import {
+  buildAad,
+  decryptSecret,
+  encryptSecret,
+  generateDek,
+  importAesKey,
+} from "../elements/vault/crypto.ts";
+import { DISCLAIMER, HARDWARE, summarize, writeArtifact } from "./lib/report.ts";
+
+const CAL = process.env.OKE_BENCH_CAL === "1";
+const ITERS = CAL ? 1_000 : 10_000;
+const SIZES = [
+  { label: "1KiB", bytes: 1024 },
+  { label: "64KiB", bytes: 64 * 1024 },
+] as const;
+
+describe.skipIf(!process.env.OKE_BENCH)("G7a — vault crypto", () => {
+  test(
+    "AES-GCM encrypt/decrypt/round-trip at 1 KiB and 64 KiB",
+    async () => {
+      const dek = await importAesKey(generateDek());
+      const metrics: Record<string, number> = {};
+
+      for (const size of SIZES) {
+        const plaintext = "x".repeat(size.bytes);
+        const aad = buildAad("bench/crypto", 1, "aes-256-gcm", 1);
+
+        // Encrypt.
+        const encSamples: number[] = [];
+        let sealed;
+        for (let i = 0; i < ITERS; i += 1) {
+          const s = performance.now();
+          sealed = await encryptSecret(dek, plaintext, aad);
+          encSamples.push(performance.now() - s);
+        }
+
+        // Decrypt (of the last sealed blob — same shape every time).
+        const decSamples: number[] = [];
+        for (let i = 0; i < ITERS; i += 1) {
+          const s = performance.now();
+          const out = await decryptSecret(dek, sealed!, aad);
+          if (out !== plaintext) throw new Error("decrypt mismatch");
+          decSamples.push(performance.now() - s);
+        }
+
+        // Full round-trip.
+        const rtSamples: number[] = [];
+        for (let i = 0; i < ITERS; i += 1) {
+          const s = performance.now();
+          const blob = await encryptSecret(dek, plaintext, aad);
+          const out = await decryptSecret(dek, blob, aad);
+          if (out !== plaintext) throw new Error("round-trip mismatch");
+          rtSamples.push(performance.now() - s);
+        }
+
+        const e = summarize(encSamples);
+        const d = summarize(decSamples);
+        const r = summarize(rtSamples);
+        metrics[`${size.label}.encrypt.p50Ms`] = e.p50Ms;
+        metrics[`${size.label}.encrypt.p99Ms`] = e.p99Ms;
+        metrics[`${size.label}.encrypt.opsPerSec`] = e.opsPerSec;
+        metrics[`${size.label}.decrypt.p50Ms`] = d.p50Ms;
+        metrics[`${size.label}.decrypt.p99Ms`] = d.p99Ms;
+        metrics[`${size.label}.decrypt.opsPerSec`] = d.opsPerSec;
+        metrics[`${size.label}.roundTrip.p50Ms`] = r.p50Ms;
+        metrics[`${size.label}.roundTrip.p99Ms`] = r.p99Ms;
+        metrics[`${size.label}.roundTrip.opsPerSec`] = r.opsPerSec;
+
+        console.log(
+          `[G7a] ${size.label}: enc=${e.opsPerSec}/s dec=${d.opsPerSec}/s rt=${r.opsPerSec}/s`,
+        );
+      }
+
+      const path = await writeArtifact({
+        group: "G7a-crypto",
+        hardware: HARDWARE,
+        disclaimer: DISCLAIMER,
+        command: "OKE_BENCH=1 bun test ./src/bench/g07-vault-crypto.bench.ts",
+        metrics,
+        issues: [],
+        fixes: [],
+        remeasured: null,
+      });
+      console.log(`[G7a] artifact: ${path}`);
+      expect(metrics["1KiB.roundTrip.opsPerSec"]).toBeGreaterThan(0);
+    },
+    CAL ? 60_000 : 300_000,
+  );
+});