1561 lines
61 KiB
Rust
1561 lines
61 KiB
Rust
use std::path::PathBuf;
|
|
|
|
fn repository_root() -> PathBuf {
|
|
PathBuf::from(env!("CARGO_MANIFEST_DIR"))
|
|
.parent()
|
|
.unwrap()
|
|
.parent()
|
|
.unwrap()
|
|
.to_path_buf()
|
|
}
|
|
|
|
#[test]
|
|
fn canonical_small_commit_workload_cannot_be_batch_gamed() {
|
|
let text = std::fs::read_to_string(repository_root().join("bench/workloads/small-commit.toml"))
|
|
.unwrap();
|
|
let workload: toml::Value = toml::from_str(&text).unwrap();
|
|
assert_eq!(workload["schema_version"].as_integer(), Some(1));
|
|
assert_eq!(workload["blob_bytes"].as_integer(), Some(1_024));
|
|
assert_eq!(workload["max_client_batch_commits"].as_integer(), Some(64));
|
|
assert_eq!(
|
|
workload["max_writer_group_transactions"].as_integer(),
|
|
Some(512)
|
|
);
|
|
assert_eq!(
|
|
workload["counting"]["expected_objects_new_per_commit"].as_integer(),
|
|
Some(3)
|
|
);
|
|
for (_, value) in workload["validation"].as_table().unwrap() {
|
|
assert_eq!(value.as_bool(), Some(true));
|
|
}
|
|
let topologies = workload["topology"].as_array().unwrap();
|
|
assert_eq!(topologies.len(), 4);
|
|
// Pin all four required topology/selection combinations by name, not
|
|
// just two of them, and require the exact persistent-client count on
|
|
// every row.
|
|
for (name, repositories, refs_per_repository, selection, zipf_exponent) in [
|
|
("many-ref-uniform", 1, 1_024, "uniform", None),
|
|
("many-ref-zipf", 1, 1_024, "zipf", Some(0.9)),
|
|
("many-repo-uniform", 256, 16, "uniform", None),
|
|
("many-repo-zipf", 256, 16, "zipf", Some(0.9)),
|
|
] {
|
|
let row = topologies
|
|
.iter()
|
|
.find(|value| value["name"].as_str() == Some(name))
|
|
.unwrap_or_else(|| panic!("missing topology row {name}"));
|
|
assert_eq!(
|
|
row["repositories"].as_integer(),
|
|
Some(repositories),
|
|
"{name}"
|
|
);
|
|
assert_eq!(
|
|
row["refs_per_repository"].as_integer(),
|
|
Some(refs_per_repository),
|
|
"{name}"
|
|
);
|
|
assert_eq!(row["persistent_clients"].as_integer(), Some(64), "{name}");
|
|
assert_eq!(row["selection"].as_str(), Some(selection), "{name}");
|
|
assert_eq!(
|
|
row.get("zipf_exponent").and_then(|v| v.as_float()),
|
|
zipf_exponent,
|
|
"{name}"
|
|
);
|
|
}
|
|
|
|
let measurement = &workload["measurement"];
|
|
assert_eq!(measurement["p2_p3_warmup_seconds"].as_integer(), Some(300));
|
|
assert_eq!(
|
|
measurement["p2_p3_measured_seconds"].as_integer(),
|
|
Some(900)
|
|
);
|
|
assert_eq!(measurement["p4_warmup_seconds"].as_integer(), Some(600));
|
|
assert_eq!(measurement["p4_measured_seconds"].as_integer(), Some(1_800));
|
|
assert_eq!(measurement["repetitions"].as_integer(), Some(3));
|
|
assert_eq!(
|
|
measurement["correct_coordinated_omission"].as_bool(),
|
|
Some(true)
|
|
);
|
|
assert_eq!(
|
|
measurement["one_minute_window_target_met_percent_min"].as_integer(),
|
|
Some(95),
|
|
"plan §3: >=95% of one-minute windows must meet the target"
|
|
);
|
|
assert_eq!(
|
|
measurement["one_minute_window_floor_percent"].as_integer(),
|
|
Some(90),
|
|
"plan §3: no window may fall below 90% of the target"
|
|
);
|
|
let latency = &measurement["latency_micros"];
|
|
assert_eq!(latency["p2_p99_max"].as_integer(), Some(50_000));
|
|
assert_eq!(latency["p3_p50_max"].as_integer(), Some(20_000));
|
|
assert_eq!(latency["p3_p95_max"].as_integer(), Some(50_000));
|
|
assert_eq!(latency["p3_p99_max"].as_integer(), Some(100_000));
|
|
assert_eq!(latency["p4_p50_max"].as_integer(), Some(20_000));
|
|
assert_eq!(latency["p4_p95_max"].as_integer(), Some(50_000));
|
|
assert_eq!(latency["p4_p99_max"].as_integer(), Some(100_000));
|
|
|
|
assert_eq!(workload["seed"].as_integer(), Some(126_394_451_485_337));
|
|
assert!(!workload["generator"].as_str().unwrap().is_empty());
|
|
}
|
|
|
|
fn assert_required_names(schema: &serde_json::Value, path: &[&str], expected: &[&str]) {
|
|
let mut node = schema;
|
|
for segment in path {
|
|
node = &node[segment];
|
|
}
|
|
let required: Vec<&str> = node["required"]
|
|
.as_array()
|
|
.unwrap()
|
|
.iter()
|
|
.map(|value| value.as_str().unwrap())
|
|
.collect();
|
|
let mut sorted_required = required.clone();
|
|
sorted_required.sort_unstable();
|
|
let mut sorted_expected = expected.to_vec();
|
|
sorted_expected.sort_unstable();
|
|
assert_eq!(
|
|
sorted_required, sorted_expected,
|
|
"required names at {path:?} do not match the frozen set"
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn result_schema_requires_integrity_durability_and_all_independent_verdicts() {
|
|
let text = std::fs::read_to_string(repository_root().join("bench/result-schema.json")).unwrap();
|
|
let schema: serde_json::Value = serde_json::from_str(&text).unwrap();
|
|
assert_eq!(
|
|
schema["$schema"].as_str(),
|
|
Some("https://json-schema.org/draft/2020-12/schema")
|
|
);
|
|
let required = schema["required"].as_array().unwrap();
|
|
for field in [
|
|
"attestation",
|
|
"source",
|
|
"artifacts",
|
|
"workload",
|
|
"hardware",
|
|
"deployment",
|
|
"measurement",
|
|
"counts",
|
|
"bytes",
|
|
"latency_micros",
|
|
"resources",
|
|
"durability",
|
|
"verification",
|
|
"verdicts",
|
|
] {
|
|
assert!(
|
|
required.iter().any(|value| value == field),
|
|
"missing {field}"
|
|
);
|
|
}
|
|
assert_eq!(
|
|
schema["$defs"]["workload"]["properties"]["client_batch_commits"]["maximum"].as_u64(),
|
|
Some(64)
|
|
);
|
|
assert_eq!(
|
|
schema["$defs"]["workload"]["properties"]["writer_group_limit"]["maximum"].as_u64(),
|
|
Some(512)
|
|
);
|
|
// `tmpfs` and `persistent_data_mount` stopped being unconditional consts in
|
|
// contract review 2026-07-28-C so a diagnostic run is representable. They
|
|
// are re-pinned under `reference_profile` fidelity, which a passing run
|
|
// must declare — asserted in full by
|
|
// `a_diagnostic_environment_is_representable_but_can_never_pass`.
|
|
assert_eq!(
|
|
schema["$defs"]["deployment"]["properties"]["tmpfs"]["type"].as_str(),
|
|
Some("boolean")
|
|
);
|
|
assert_eq!(
|
|
schema["$defs"]["deployment"]["properties"]["remote_storage"]["const"].as_bool(),
|
|
Some(false)
|
|
);
|
|
assert_required_names(
|
|
&schema,
|
|
&["$defs", "workload", "properties", "validation_flags"],
|
|
&[
|
|
"request_signature",
|
|
"replay",
|
|
"pack_hash_and_framing",
|
|
"outer_embedded_type_match",
|
|
"complete_graph",
|
|
"authority_and_role",
|
|
"instance_policy",
|
|
"repository_policy",
|
|
"typed_ref_cas",
|
|
"fast_forward",
|
|
"durability_fence_before_response",
|
|
],
|
|
);
|
|
assert_eq!(
|
|
schema["$defs"]["durability"]["properties"]["acknowledged_loss"]["const"].as_u64(),
|
|
Some(0)
|
|
);
|
|
assert_eq!(
|
|
schema["$defs"]["durability"]["properties"]["torn_transactions"]["const"].as_u64(),
|
|
Some(0)
|
|
);
|
|
assert_required_names(
|
|
&schema,
|
|
&["properties", "verdicts"],
|
|
&[
|
|
"storage_primitive",
|
|
"in_process_protocol",
|
|
"deployed_30k",
|
|
"deployed_60k",
|
|
"recovery",
|
|
"overload",
|
|
"compaction",
|
|
"federation",
|
|
"release",
|
|
],
|
|
);
|
|
|
|
// Aggregate one-minute-window rule from plan §3: >=95% of windows must
|
|
// meet target and none may fall below 90%.
|
|
//
|
|
// Enforced conditionally on `outcome` since contract review 2026-07-24-B.
|
|
// Unconditionally, the floor made a failed or preliminary run
|
|
// unrepresentable: even a bundle whose verdicts were all `not-applicable`
|
|
// had to claim compliance, so a failure could not be archived as evidence.
|
|
// The rule is unchanged for any run claiming a pass.
|
|
assert!(schema["$defs"]["measurement"]["required"]
|
|
.as_array()
|
|
.unwrap()
|
|
.iter()
|
|
.any(|v| v == "windows_meeting_target_percent"));
|
|
let window_rule = schema["allOf"]
|
|
.as_array()
|
|
.unwrap()
|
|
.iter()
|
|
.find(|rule| {
|
|
// The per-gate latency ceilings became `outcome`-conditional too,
|
|
// so `outcome == "pass"` alone now matches four other rules, and
|
|
// since contract review 2026-07-28-C the environment-fidelity rule
|
|
// keys on `outcome` and nothing else as well. The window rule is the
|
|
// gate-independent one that constrains `measurement`.
|
|
rule["if"]["properties"]["outcome"]["const"] == "pass"
|
|
&& rule["if"]["properties"]["gate"].is_null()
|
|
&& !rule["then"]["properties"]["measurement"].is_null()
|
|
})
|
|
.expect("missing the outcome-conditional window rule");
|
|
assert_eq!(
|
|
window_rule["then"]["properties"]["measurement"]["properties"]
|
|
["windows_meeting_target_percent"]["minimum"]
|
|
.as_u64(),
|
|
Some(95)
|
|
);
|
|
assert_eq!(
|
|
window_rule["then"]["properties"]["measurement"]["properties"]["windows_below_floor_count"]
|
|
["const"]
|
|
.as_u64(),
|
|
Some(0)
|
|
);
|
|
assert!(
|
|
schema["required"]
|
|
.as_array()
|
|
.unwrap()
|
|
.iter()
|
|
.any(|v| v == "outcome"),
|
|
"outcome must be required so the window rule always has something to key on"
|
|
);
|
|
|
|
// Per-gate latency ceilings are enforced conditionally on `gate`, not
|
|
// left to the raw p50/p95/p99 fields alone.
|
|
let all_of = schema["allOf"].as_array().unwrap();
|
|
let gate_p99_ceiling = |gate: &str| -> u64 {
|
|
all_of
|
|
.iter()
|
|
.find(|rule| rule["if"]["properties"]["gate"]["const"] == gate)
|
|
.unwrap_or_else(|| panic!("missing latency rule for gate {gate}"))["then"]["properties"]
|
|
["latency_micros"]["properties"]["p99"]["maximum"]
|
|
.as_u64()
|
|
.unwrap()
|
|
};
|
|
assert_eq!(gate_p99_ceiling("storage_primitive"), 50_000);
|
|
assert_eq!(gate_p99_ceiling("in_process_protocol"), 100_000);
|
|
assert_eq!(gate_p99_ceiling("deployed_30k"), 100_000);
|
|
assert_eq!(gate_p99_ceiling("deployed_60k"), 100_000);
|
|
|
|
// Empty strings must not satisfy the descriptive deployment/hardware
|
|
// fields the plan requires be recorded.
|
|
for field in ["systemd", "cgroup", "proxy", "tls"] {
|
|
assert_eq!(
|
|
schema["$defs"]["deployment"]["properties"][field]["minLength"].as_u64(),
|
|
Some(1),
|
|
"{field}"
|
|
);
|
|
}
|
|
assert_eq!(
|
|
schema["$defs"]["hardware"]["properties"]["barriers"]["enum"],
|
|
serde_json::json!(["enabled"])
|
|
);
|
|
}
|
|
|
|
/// Contract review 2026-07-24-B.
|
|
///
|
|
/// A P2 run measures the `levcs-store` API, which plan §5.1 forbids from making
|
|
/// identity-role, merge-policy, or federation decisions and which runs
|
|
/// in-process with no proxy or TLS. Reporting the validation flags as true
|
|
/// would be false; reporting them false failed the original unconditional
|
|
/// schema. They are now pinned per flag, conditionally on `gate`.
|
|
///
|
|
/// The danger in that amendment is un-pinning by accident: relaxing
|
|
/// `const: true` in `$defs.validation_flags` without re-pinning it for every
|
|
/// other gate would let a deployed-node bundle declare `complete_graph: false`
|
|
/// and still validate, which is a strictly worse defect than the one being
|
|
/// fixed. This test asserts both halves.
|
|
#[test]
|
|
fn validation_flags_and_promotability_are_pinned_per_gate() {
|
|
const FLAGS: &[&str] = &[
|
|
"request_signature",
|
|
"replay",
|
|
"pack_hash_and_framing",
|
|
"outer_embedded_type_match",
|
|
"complete_graph",
|
|
"authority_and_role",
|
|
"instance_policy",
|
|
"repository_policy",
|
|
"typed_ref_cas",
|
|
"fast_forward",
|
|
"durability_fence_before_response",
|
|
];
|
|
/// The only two a store-level run genuinely performs: the fence is the
|
|
/// claim under test, and the shard sequencer really does perform the typed
|
|
/// CAS against speculative state. `fast_forward` is not among them — the
|
|
/// sequencer consumes precomputed ancestry facts (plan §7 stage 9) rather
|
|
/// than deriving them, and a validation flag must state what the measured
|
|
/// system performed.
|
|
const TRUE_AT_P2: &[&str] = &["typed_ref_cas", "durability_fence_before_response"];
|
|
|
|
let text = std::fs::read_to_string(repository_root().join("bench/result-schema.json")).unwrap();
|
|
let schema: serde_json::Value = serde_json::from_str(&text).unwrap();
|
|
|
|
// `promotable` is required at top level for every gate, so an evaluator's
|
|
// refusal to promote is a mechanical schema check rather than prose.
|
|
assert!(
|
|
schema["required"]
|
|
.as_array()
|
|
.unwrap()
|
|
.iter()
|
|
.any(|v| v == "promotable"),
|
|
"promotable must be required for every gate, not only storage_primitive"
|
|
);
|
|
|
|
let rule = schema["allOf"]
|
|
.as_array()
|
|
.unwrap()
|
|
.iter()
|
|
.find(|r| {
|
|
r["if"]["properties"]["gate"]["const"] == "storage_primitive" && r.get("else").is_some()
|
|
})
|
|
.expect("missing the per-gate validation-flag rule");
|
|
|
|
let branch_flags = |branch: &str| -> serde_json::Value {
|
|
rule[branch]["properties"]["workload"]["properties"]["validation_flags"]["properties"]
|
|
.clone()
|
|
};
|
|
|
|
// storage_primitive: per-flag, stating exactly what the store performed.
|
|
let p2 = branch_flags("then");
|
|
for flag in FLAGS {
|
|
let expected = TRUE_AT_P2.contains(flag);
|
|
assert_eq!(
|
|
p2[flag]["const"].as_bool(),
|
|
Some(expected),
|
|
"storage_primitive must pin {flag} to {expected}"
|
|
);
|
|
}
|
|
assert_eq!(
|
|
rule["then"]["properties"]["promotable"]["const"].as_bool(),
|
|
Some(false),
|
|
"a storage primitive result can never be promoted to an instance claim"
|
|
);
|
|
|
|
// Every other gate: all eleven re-pinned true. This is the half that
|
|
// fails if the amendment un-pins validation for P3/P4/P5.
|
|
let other = branch_flags("else");
|
|
for flag in FLAGS {
|
|
assert_eq!(
|
|
other[flag]["const"].as_bool(),
|
|
Some(true),
|
|
"every non-storage_primitive gate must re-pin {flag} to true; \
|
|
relaxing the shared definition without re-pinning here would let \
|
|
a deployed-node bundle declare it false and still validate"
|
|
);
|
|
}
|
|
assert_eq!(
|
|
rule["else"]["properties"]["promotable"]["const"].as_bool(),
|
|
Some(true)
|
|
);
|
|
|
|
// The shared definition still requires every flag to be present; only its
|
|
// value moved to the conditional rules.
|
|
assert_required_names(
|
|
&schema,
|
|
&["$defs", "workload", "properties", "validation_flags"],
|
|
FLAGS,
|
|
);
|
|
}
|
|
|
|
/// Contract review 2026-07-24-B, second pass.
|
|
///
|
|
/// The first pass split `workload.validation_flags` per gate but left
|
|
/// `verification.*` blanket `const: true` — the same defect one block over.
|
|
/// `commits_in_recovered_closure` cannot honestly be true at
|
|
/// `storage_primitive` for exactly the reason `complete_graph` is false: plan
|
|
/// §5.1 forbids the store from traversing the graph, so no ref closure exists
|
|
/// below the engine. Fixing one and not the other left the bundle asserting by
|
|
/// a different field precisely what it had just stopped asserting.
|
|
///
|
|
/// The replacement at P2 is the storage-layer analogue —
|
|
/// `acknowledged_sequences_reconciled` — which is required at every gate, so
|
|
/// nothing is weakened: P2 trades a claim it cannot make for one it can prove.
|
|
#[test]
|
|
fn verification_claims_are_pinned_per_gate_like_validation_flags() {
|
|
let text = std::fs::read_to_string(repository_root().join("bench/result-schema.json")).unwrap();
|
|
let schema: serde_json::Value = serde_json::from_str(&text).unwrap();
|
|
|
|
// Only the claims a run at *any* gate can earn are unconditionally
|
|
// required. The five object-graph claims moved to the per-gate rule below
|
|
// (contract review 2026-07-24-B, third amendment).
|
|
assert_required_names(
|
|
&schema,
|
|
&["$defs", "verification"],
|
|
&[
|
|
"setup_traffic_excluded",
|
|
"commits_in_recovered_closure",
|
|
"acknowledged_sequences_reconciled",
|
|
],
|
|
);
|
|
|
|
// The ACK-journal proof is unconditional. It is the only detector for a
|
|
// device that lost a write it acknowledged (scope 3.8), so no gate may
|
|
// opt out of it.
|
|
assert_eq!(
|
|
schema["$defs"]["verification"]["properties"]["acknowledged_sequences_reconciled"]["const"]
|
|
.as_bool(),
|
|
Some(true)
|
|
);
|
|
|
|
let rule = schema["allOf"]
|
|
.as_array()
|
|
.unwrap()
|
|
.iter()
|
|
.find(|r| {
|
|
r["if"]["properties"]["gate"]["const"] == "storage_primitive" && r.get("else").is_some()
|
|
})
|
|
.expect("missing the per-gate rule");
|
|
|
|
assert_eq!(
|
|
rule["then"]["properties"]["verification"]["properties"]["commits_in_recovered_closure"]
|
|
["const"]
|
|
.as_bool(),
|
|
Some(false),
|
|
"the store cannot traverse a commit graph, so P2 must not claim closure"
|
|
);
|
|
assert_eq!(
|
|
rule["else"]["properties"]["verification"]["properties"]["commits_in_recovered_closure"]
|
|
["const"]
|
|
.as_bool(),
|
|
Some(true),
|
|
"every instance gate must still re-pin closure to true"
|
|
);
|
|
|
|
// Two of the five object-graph claims are forbidden at storage_primitive on
|
|
// *every* path, not merely optional: no path below the instance can
|
|
// recompute a blob or complete object metadata, so `false` would be its own
|
|
// untrue statement — it claims the check applied and did not pass. Absence
|
|
// is the only honest encoding.
|
|
//
|
|
// The other three moved to the mutation-path rules in contract review
|
|
// 2026-07-28-C, because `StoreEngine::submit` genuinely earns two of them
|
|
// and can express the third. They are still forbidden on the journal-drive
|
|
// seam, which is pinned by
|
|
// `the_drive_path_may_not_assert_the_claims_the_submit_path_earns`.
|
|
const GRAPH_CLAIMS: &[&str] = &[
|
|
"unique_blob_tree_commit_ids",
|
|
"objects_new_equals_three_per_commit",
|
|
"blobs_recomputed",
|
|
"operation_receipts_reconciled",
|
|
"metadata_complete",
|
|
];
|
|
const FORBIDDEN_ON_EVERY_PATH: &[&str] = &["blobs_recomputed", "metadata_complete"];
|
|
let forbidden = rule["then"]["properties"]["verification"]["not"]["anyOf"]
|
|
.as_array()
|
|
.expect("storage_primitive must forbid the unearnable claims outright");
|
|
assert_eq!(
|
|
forbidden.len(),
|
|
FORBIDDEN_ON_EVERY_PATH.len(),
|
|
"the gate-wide forbidden set must be exactly the claims no path can earn; \
|
|
anything else belongs in a mutation-path rule where the path is named"
|
|
);
|
|
for claim in FORBIDDEN_ON_EVERY_PATH {
|
|
assert!(
|
|
forbidden
|
|
.iter()
|
|
.any(|clause| clause["required"][0] == serde_json::json!(claim)),
|
|
"{claim} must be forbidden at storage_primitive on every path"
|
|
);
|
|
}
|
|
|
|
// Every one of them is required *and* true again at every other gate.
|
|
// This is the half of the split that is easy to lose: relaxing a claim for
|
|
// one gate must never un-pin it for the rest. It has already been lost
|
|
// once, by the very edit that introduced this assertion.
|
|
let other = &rule["else"]["properties"];
|
|
for claim in GRAPH_CLAIMS {
|
|
assert!(
|
|
other["verification"]["required"]
|
|
.as_array()
|
|
.unwrap()
|
|
.iter()
|
|
.any(|v| v == claim),
|
|
"{claim} must be required again at every non-storage gate"
|
|
);
|
|
assert_eq!(
|
|
other["verification"]["properties"][claim]["const"].as_bool(),
|
|
Some(true),
|
|
"{claim} must be pinned true at every non-storage gate"
|
|
);
|
|
}
|
|
assert_eq!(
|
|
other["promotable"]["const"].as_bool(),
|
|
Some(true),
|
|
"the else branch must keep re-pinning promotability"
|
|
);
|
|
let flags = other["workload"]["properties"]["validation_flags"]["properties"]
|
|
.as_object()
|
|
.expect("the else branch must keep re-pinning every validation flag");
|
|
assert_eq!(flags.len(), 11, "all eleven flags, not a subset");
|
|
for (name, spec) in flags {
|
|
assert_eq!(spec["const"].as_bool(), Some(true), "{name}");
|
|
}
|
|
|
|
// Coordinated omission is the other shape: applicable at every gate, but a
|
|
// closed-loop driver does not correct for it. So the base permits either
|
|
// value and the else pins true — the honest `false` is representable
|
|
// exactly where it is the truth, and nowhere else.
|
|
assert_eq!(
|
|
schema["$defs"]["measurement"]["properties"]["coordinated_omission_corrected"]["type"]
|
|
.as_str(),
|
|
Some("boolean"),
|
|
"a closed-loop storage run must be able to report false"
|
|
);
|
|
assert_eq!(
|
|
other["measurement"]["properties"]["coordinated_omission_corrected"]["const"].as_bool(),
|
|
Some(true),
|
|
"every instance gate must still require CO correction"
|
|
);
|
|
}
|
|
|
|
/// Plan §13 names index bytes/object and checkpoint lookup fan-out as stop
|
|
/// conditions and requires result bundles to report them; §5.2 requires P2 to
|
|
/// measure signing cost separately. Every schema object is
|
|
/// `additionalProperties: false`, so before 2026-07-24-B there was nowhere to
|
|
/// put any of them and they would have been smuggled into a free-form map.
|
|
#[test]
|
|
fn the_bundle_has_a_home_for_every_figure_phase_one_must_report() {
|
|
let text = std::fs::read_to_string(repository_root().join("bench/result-schema.json")).unwrap();
|
|
let schema: serde_json::Value = serde_json::from_str(&text).unwrap();
|
|
|
|
assert!(
|
|
schema["required"]
|
|
.as_array()
|
|
.unwrap()
|
|
.iter()
|
|
.any(|v| v == "storage"),
|
|
"the storage block must be required, not optional"
|
|
);
|
|
assert_required_names(
|
|
&schema,
|
|
&["$defs", "storage"],
|
|
&[
|
|
"index_bytes_per_object",
|
|
"checkpoint_lookup_fanout",
|
|
"evidence_signing_micros_p50",
|
|
"fences",
|
|
"transactions",
|
|
],
|
|
);
|
|
// Fences and transactions together are the mechanical form of the Phase 1
|
|
// exit criterion "no per-object fsync" — a reader can divide.
|
|
for field in ["fences", "transactions"] {
|
|
assert_eq!(
|
|
schema["$defs"]["storage"]["properties"][field]["type"].as_str(),
|
|
Some("integer"),
|
|
"{field}"
|
|
);
|
|
}
|
|
}
|
|
|
|
/// The generator string is pinned so a bundle can be reproduced rather than
|
|
/// believed: an evaluator recomputes every deterministic 1,024-byte blob from
|
|
/// `workload.seed` and `workload.generator` and checks them against the
|
|
/// recovered store (scope 9.5).
|
|
#[test]
|
|
fn the_bundle_records_the_frozen_workload_generator_and_seed() {
|
|
let schema_text =
|
|
std::fs::read_to_string(repository_root().join("bench/result-schema.json")).unwrap();
|
|
let schema: serde_json::Value = serde_json::from_str(&schema_text).unwrap();
|
|
for field in ["seed", "generator"] {
|
|
assert!(
|
|
schema["$defs"]["workload"]["required"]
|
|
.as_array()
|
|
.unwrap()
|
|
.iter()
|
|
.any(|v| v == field),
|
|
"workload.{field} must be required in the result bundle"
|
|
);
|
|
}
|
|
assert_eq!(
|
|
schema["$defs"]["workload"]["properties"]["generator"]["minLength"].as_u64(),
|
|
Some(1)
|
|
);
|
|
|
|
// And the frozen workload still carries both, so the bundle has something
|
|
// to equal.
|
|
let workload_text =
|
|
std::fs::read_to_string(repository_root().join("bench/workloads/small-commit.toml"))
|
|
.unwrap();
|
|
let workload: toml::Value = toml::from_str(&workload_text).unwrap();
|
|
assert_eq!(workload["seed"].as_integer(), Some(126_394_451_485_337));
|
|
assert_eq!(
|
|
workload["generator"].as_str(),
|
|
Some("blake3-xof(seed || repo_ordinal_le || ref_ordinal_le || commit_ordinal_le)")
|
|
);
|
|
}
|
|
|
|
/// The store-directory attributes are part of the frozen profile, not
|
|
/// per-bundle metadata.
|
|
///
|
|
/// A profile that silently permits two on-disk configurations for the files
|
|
/// carrying the throughput is not frozen: a P2 number measured nodatacow is
|
|
/// not comparable to one measured copy-on-write. The bundle additionally
|
|
/// records what it verified at startup (scope 9.2).
|
|
#[test]
|
|
fn store_directory_attributes_are_frozen_in_the_profile_and_recorded_in_the_bundle() {
|
|
let text =
|
|
std::fs::read_to_string(repository_root().join("bench/reference-hardware.toml")).unwrap();
|
|
let hardware: toml::Value = toml::from_str(&text).unwrap();
|
|
let profiles = hardware["profile"].as_array().unwrap();
|
|
assert_eq!(profiles.len(), 2);
|
|
for profile in profiles {
|
|
let fs = &profile["filesystem"];
|
|
assert_eq!(
|
|
fs["store_directory_attributes"].as_str(),
|
|
Some("nodatacow"),
|
|
"profile {:?}",
|
|
profile["name"].as_str()
|
|
);
|
|
let dirs = fs["store_directories"].as_array().unwrap();
|
|
assert!(
|
|
dirs.iter().any(|d| d.as_str() == Some("shards/*/active")),
|
|
"the journal directory must be covered"
|
|
);
|
|
assert!(
|
|
dirs.iter().any(|d| d.as_str() == Some("shards/*/segments")),
|
|
"the segment directory must be covered"
|
|
);
|
|
}
|
|
|
|
let schema_text =
|
|
std::fs::read_to_string(repository_root().join("bench/result-schema.json")).unwrap();
|
|
let schema: serde_json::Value = serde_json::from_str(&schema_text).unwrap();
|
|
assert!(
|
|
schema["$defs"]["deployment"]["required"]
|
|
.as_array()
|
|
.unwrap()
|
|
.iter()
|
|
.any(|v| v == "store_directory_attributes"),
|
|
"every bundle must record the attributes it verified"
|
|
);
|
|
assert_eq!(
|
|
schema["$defs"]["deployment"]["properties"]["store_directory_attributes"]["minLength"]
|
|
.as_u64(),
|
|
Some(1)
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn reference_profiles_freeze_every_required_hardware_and_stack_field() {
|
|
let text =
|
|
std::fs::read_to_string(repository_root().join("bench/reference-hardware.toml")).unwrap();
|
|
let hardware: toml::Value = toml::from_str(&text).unwrap();
|
|
let profiles = hardware["profile"].as_array().unwrap();
|
|
assert_eq!(profiles.len(), 2);
|
|
assert_eq!(profiles[0]["name"].as_str(), Some("minimum-30k"));
|
|
assert_eq!(profiles[1]["name"].as_str(), Some("release-60k"));
|
|
for profile in profiles {
|
|
for table in ["cpu", "memory", "nvme", "filesystem", "network", "software"] {
|
|
assert!(profile[table].is_table(), "{table} must be frozen");
|
|
}
|
|
assert_eq!(profile["memory"]["swap_enabled"].as_bool(), Some(false));
|
|
assert_eq!(profile["filesystem"]["barriers"].as_str(), Some("enabled"));
|
|
assert!(profile["network"]["link_mbps"].as_integer().unwrap() >= 1_000);
|
|
assert!(!profile["software"]["kernel"].as_str().unwrap().is_empty());
|
|
assert!(!profile["software"]["proxy"].as_str().unwrap().is_empty());
|
|
}
|
|
assert_eq!(
|
|
profiles[1]["network"]["link_mbps"].as_integer(),
|
|
Some(10_000),
|
|
"release profile must have deployed-network headroom"
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn federation_workload_freezes_projection_rtt_partition_and_digest_gates() {
|
|
let text =
|
|
std::fs::read_to_string(repository_root().join("bench/workloads/federation.toml")).unwrap();
|
|
let workload: toml::Value = toml::from_str(&text).unwrap();
|
|
let projections: Vec<&str> = workload["projections"]
|
|
.as_array()
|
|
.unwrap()
|
|
.iter()
|
|
.map(|v| v.as_str().unwrap())
|
|
.collect();
|
|
assert_eq!(projections, vec!["full", "release", "metadata"]);
|
|
let rtts: Vec<i64> = workload["round_trip_milliseconds"]
|
|
.as_array()
|
|
.unwrap()
|
|
.iter()
|
|
.map(|v| v.as_integer().unwrap())
|
|
.collect();
|
|
assert_eq!(rtts, vec![1, 20, 80], "plan §8: 1ms/20ms/80ms RTT");
|
|
// Plan §8 requires testing across "RTT, loss, a 10-minute partition"; the
|
|
// loss dimension must actually be present, not only RTT/partition.
|
|
assert!(
|
|
!workload["packet_loss_percent"]
|
|
.as_array()
|
|
.unwrap()
|
|
.is_empty(),
|
|
"federation workload must exercise packet loss, not just RTT"
|
|
);
|
|
assert_eq!(workload["partition_seconds"].as_integer(), Some(600));
|
|
assert_eq!(
|
|
workload["same_rack_ref_lag_p99_seconds"].as_integer(),
|
|
Some(5)
|
|
);
|
|
assert_eq!(workload["wan_ref_lag_p99_seconds"].as_integer(), Some(30));
|
|
assert_eq!(
|
|
workload["partition_catchup_seconds"].as_integer(),
|
|
Some(120)
|
|
);
|
|
assert_eq!(
|
|
workload["maximum_source_degradation_percent"].as_integer(),
|
|
Some(10)
|
|
);
|
|
assert_eq!(workload["require_source_restart"].as_bool(), Some(true));
|
|
assert_eq!(
|
|
workload["require_mirror_restart_during_apply"].as_bool(),
|
|
Some(true)
|
|
);
|
|
assert_eq!(
|
|
workload["require_exact_projection_digest"].as_bool(),
|
|
Some(true)
|
|
);
|
|
assert_eq!(
|
|
workload["require_atomic_destination_generation"].as_bool(),
|
|
Some(true)
|
|
);
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Contract review 2026-07-28-C: the run-conditions block and the two
|
|
// mutation-path branches
|
|
// ---------------------------------------------------------------------------
|
|
//
|
|
// Scope §6.6 requires contract tests for both the submit and journal-drive
|
|
// branches. The tests above assert the *shape* of the schema — which rule
|
|
// exists, what it pins — which is necessary and is not sufficient: a
|
|
// conditional can be structurally present and still admit the document it was
|
|
// written to reject. Everything below validates whole bundles through the same
|
|
// validator `scripts/verify-store-recovery.sh` and `store-bench`'s own tests
|
|
// use, so the gate, the emitter, and this file cannot disagree about what valid
|
|
// means.
|
|
//
|
|
// There is no JSON Schema crate in the workspace and adding one is a
|
|
// `Cargo.toml` change; validation therefore shells out to `python3` with
|
|
// `jsonschema`. A missing interpreter or module is a test *failure*, never a
|
|
// skip. A validation that silently does not run reads as a passing suite, which
|
|
// is exactly how a schema stops being a contract.
|
|
|
|
/// Exit 0 clean, exit 1 with one error per line on stdout, exit 2 if the
|
|
/// validator itself is unavailable.
|
|
const VALIDATE_PY: &str = "\
|
|
import json, sys
|
|
try:
|
|
import jsonschema
|
|
except ImportError:
|
|
sys.stderr.write('jsonschema is not installed\\n')
|
|
sys.exit(2)
|
|
schema = json.load(open(sys.argv[1]))
|
|
instance = json.load(open(sys.argv[2]))
|
|
validator = jsonschema.Draft202012Validator(
|
|
schema, format_checker=jsonschema.FormatChecker()
|
|
)
|
|
errors = sorted(validator.iter_errors(instance), key=lambda e: list(e.path))
|
|
for error in errors:
|
|
sys.stdout.write(f'{list(error.path)}: {error.message}\\n')
|
|
sys.exit(1 if errors else 0)
|
|
";
|
|
|
|
/// Every validator error for `bundle`, or an empty vector.
|
|
fn schema_errors(bundle: &serde_json::Value) -> Vec<String> {
|
|
let directory = tempfile::tempdir().expect("tempdir");
|
|
let instance = directory.path().join("bundle.json");
|
|
std::fs::write(
|
|
&instance,
|
|
serde_json::to_vec_pretty(bundle).expect("encode"),
|
|
)
|
|
.expect("write");
|
|
let schema = repository_root().join("bench/result-schema.json");
|
|
|
|
let output = std::process::Command::new("python3")
|
|
.arg("-c")
|
|
.arg(VALIDATE_PY)
|
|
.arg(&schema)
|
|
.arg(&instance)
|
|
.output()
|
|
.expect(
|
|
"python3 must be available: these tests validate bundles against \
|
|
bench/result-schema.json, and a validation that cannot run is not a \
|
|
passing test",
|
|
);
|
|
let stdout = String::from_utf8_lossy(&output.stdout).to_string();
|
|
let stderr = String::from_utf8_lossy(&output.stderr).to_string();
|
|
match output.status.code() {
|
|
Some(0) => Vec::new(),
|
|
Some(1) => stdout.lines().map(str::to_string).collect(),
|
|
other => panic!(
|
|
"the schema validator could not run (exit {other:?}). jsonschema must be \
|
|
installed; a skipped validation would let the schema and the emitter \
|
|
drift with nothing to notice.\nstdout: {stdout}\nstderr: {stderr}"
|
|
),
|
|
}
|
|
}
|
|
|
|
fn assert_valid(bundle: &serde_json::Value, why: &str) {
|
|
let errors = schema_errors(bundle);
|
|
assert!(errors.is_empty(), "{why}\n{}", errors.join("\n"));
|
|
}
|
|
|
|
fn assert_invalid(bundle: &serde_json::Value, why: &str) {
|
|
assert!(!schema_errors(bundle).is_empty(), "{why}");
|
|
}
|
|
|
|
const HEX64: &str = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
|
|
|
|
/// A bundle that a `--path submit` run can honestly emit *today*, and the exact
|
|
/// shape §6.6's emitter follow-up must produce.
|
|
///
|
|
/// Every declaration in `run_conditions` is the truthful value for the emitter
|
|
/// as it stands at `store-bench.rs`: the root is seeded by
|
|
/// `segment::initialize_root`, `StoreEngine::checkpoint` is unimplemented, the
|
|
/// index-run ceiling is raised to 1,000,000 because delta sealing is
|
|
/// unimplemented, and the reconciliation accepts any `Committed(_)` status. So
|
|
/// the fixture is not a hypothetical: if this validates and the emitter's output
|
|
/// does not, the difference is the emitter's to close.
|
|
fn submit_path_bundle() -> serde_json::Value {
|
|
serde_json::json!({
|
|
"schema_version": 1,
|
|
"gate": "storage_primitive",
|
|
"run_id": "engine-wave-b-0123456789abcdef",
|
|
"attestation": {
|
|
"signer": format!("ed25519:{HEX64}"),
|
|
"key_epoch": 0,
|
|
"content_digest": HEX64,
|
|
"signature": format!("{HEX64}{HEX64}")
|
|
},
|
|
"source": {
|
|
"revision": "e050b6de050b6de050b6de050b6de050b6de050b",
|
|
"dirty_tree_digest": HEX64,
|
|
"cargo_lock_digest": HEX64,
|
|
"rustc": "rustc 1.90.0",
|
|
"rustflags": ""
|
|
},
|
|
"artifacts": {
|
|
"binary_digest": HEX64,
|
|
"config_digest": HEX64,
|
|
"workload_digest": HEX64,
|
|
"corpus_digest": HEX64,
|
|
"raw_metrics_digest": HEX64,
|
|
"telemetry_versions": { "store-bench": "0.1.0" }
|
|
},
|
|
"workload": {
|
|
"name": "canonical-small-commit",
|
|
"seed": 126_394_451_485_337i64,
|
|
"topology": "many-repo",
|
|
"selection": "uniform",
|
|
"client_batch_commits": 1,
|
|
"writer_group_limit": 512,
|
|
"persistent_clients": 64,
|
|
"validation_flags": {
|
|
"request_signature": false,
|
|
"replay": false,
|
|
"pack_hash_and_framing": false,
|
|
"outer_embedded_type_match": false,
|
|
"complete_graph": false,
|
|
"authority_and_role": false,
|
|
"instance_policy": false,
|
|
"repository_policy": false,
|
|
"typed_ref_cas": true,
|
|
"fast_forward": false,
|
|
"durability_fence_before_response": true
|
|
},
|
|
"generator": "blake3-xof(seed || repo_ordinal_le || ref_ordinal_le || commit_ordinal_le)"
|
|
},
|
|
"hardware": {
|
|
"profile": "diagnostic",
|
|
"cpu": "AMD Ryzen 7 9800X3D",
|
|
"numa": "nodes=1",
|
|
"governor": "performance",
|
|
"microcode": "0x0b404023",
|
|
"ram_bytes": 68_719_476_736i64,
|
|
"swap_events": 0,
|
|
"filesystem": "btrfs",
|
|
"mount_options": ["nodatacow"],
|
|
"nvme": "Samsung SSD 990 PRO 1TB",
|
|
"firmware": "4B2QJXD7",
|
|
"write_cache": "enabled",
|
|
"barriers": "enabled",
|
|
"scheduler": "none",
|
|
"temperature_celsius": 41.0,
|
|
"nic": "none (in-process P2)",
|
|
"driver": "none (in-process P2)",
|
|
"link_mbps": 1,
|
|
"mtu": 1500,
|
|
"kernel": "Linux 6.18.30-p1-gentoo-dist"
|
|
},
|
|
"deployment": {
|
|
"persistent_data_mount": true,
|
|
"tmpfs": false,
|
|
"overlay": false,
|
|
"remote_storage": false,
|
|
"durability_enabled": true,
|
|
"systemd": "none (in-process P2)",
|
|
"cgroup": "none (in-process P2)",
|
|
"proxy": "none (in-process P2)",
|
|
"tls": "none (in-process P2)",
|
|
"store_directory_attributes": "nodatacow"
|
|
},
|
|
"run_conditions": {
|
|
"initialization_path": "segment_initialize_root",
|
|
"mutation_path": "store_engine_submit",
|
|
"checkpointing": "unimplemented",
|
|
"index_maintenance": "deltas_retained_in_memory",
|
|
// Deliberately the deprecated spelling: this fixture is the standing
|
|
// proof that an archived v1 bundle still validates. The emitter
|
|
// writes `raised_above_store_default` now, and
|
|
// `both_raised_spellings_are_accepted_and_bound_the_same_way`
|
|
// covers the pair. Contract review 2026-08-09-B.
|
|
"index_run_ceiling": "raised_because_index_sealing_unimplemented",
|
|
"receipt_reconciliation": "acceptance_of_any_committed_status",
|
|
"objects_new_source": "summed_from_receipts",
|
|
"commit_id_uniqueness": "checked_globally_across_ack_records",
|
|
"build_profile": "debug",
|
|
"environment_fidelity": "diagnostic"
|
|
},
|
|
"measurement": {
|
|
"warmup_seconds": 0,
|
|
"measured_seconds": 2,
|
|
"repetition": 1,
|
|
"started_at": "2026-07-28T00:00:00Z",
|
|
"ended_at": "2026-07-28T00:00:02Z",
|
|
"one_minute_windows": [8052.0],
|
|
"histogram_format": "ascending-micros-csv/blake3",
|
|
"coordinated_omission_corrected": false,
|
|
"windows_meeting_target_percent": 100.0,
|
|
"windows_below_floor_count": 0
|
|
},
|
|
"counts": {
|
|
"offered_requests": 16104,
|
|
"accepted_requests": 16104,
|
|
"rejected_requests": 0,
|
|
"duplicate_requests": 0,
|
|
"acknowledged_requests": 16104,
|
|
"counted_commits": 16104,
|
|
"objects_new": 48312
|
|
},
|
|
"bytes": { "raw": 21_004_800, "pack_compressed": 0, "application": 21_004_800, "wire": 0 },
|
|
"latency_micros": {
|
|
"p50": 900, "p95": 3000, "p99": 7000, "max": 40000,
|
|
"histogram_digest": HEX64
|
|
},
|
|
"resources": {
|
|
"configured_ceilings": {
|
|
"max_index_runs": 1_000_000,
|
|
"writer_group_transactions": 512.0,
|
|
"journal_preallocate_bytes": 67_108_864.0,
|
|
"free_space_required_bytes": 1_073_741_824.0,
|
|
"latency_p99_ceiling_micros": 50_000.0
|
|
},
|
|
"observed_peaks": { "free_space_available_bytes": 1_099_511_627_776.0 },
|
|
"time_series_digest": HEX64,
|
|
"cpu_percent": 0.0,
|
|
"storage_utilization_percent": 0.0,
|
|
"memory_current_bytes": 0,
|
|
"open_fds": 0,
|
|
"compaction_debt_returned_low": true,
|
|
"no_growth_passed": true
|
|
},
|
|
"durability": {
|
|
"external_ack_journal_digest": HEX64,
|
|
"ack_journal_fenced_before_count": true,
|
|
"recovery_reconciled": true,
|
|
"acknowledged_loss": 0,
|
|
"torn_transactions": 0
|
|
},
|
|
"verification": {
|
|
"setup_traffic_excluded": true,
|
|
"commits_in_recovered_closure": false,
|
|
"acknowledged_sequences_reconciled": true,
|
|
"unique_blob_tree_commit_ids": true,
|
|
"objects_new_equals_three_per_commit": true
|
|
},
|
|
"verdicts": {
|
|
"storage_primitive": "not-applicable",
|
|
"in_process_protocol": "not-applicable",
|
|
"deployed_30k": "not-applicable",
|
|
"deployed_60k": "not-applicable",
|
|
"recovery": "not-applicable",
|
|
"overload": "not-applicable",
|
|
"compaction": "not-applicable",
|
|
"federation": "not-applicable",
|
|
"release": "not-applicable"
|
|
},
|
|
"promotable": false,
|
|
"outcome": "preliminary",
|
|
"storage": {
|
|
"index_bytes_per_object": 47.0,
|
|
"checkpoint_lookup_fanout": 1.0,
|
|
"evidence_signing_micros_p50": 12.0,
|
|
"fences": 1007,
|
|
"transactions": 16104,
|
|
"trim_settle_seconds": 0.0,
|
|
"store_directory_attributes_verified": true
|
|
}
|
|
})
|
|
}
|
|
|
|
/// The Wave A journal seam. The same bundle with every declaration reduced to
|
|
/// what a path below `engine.rs` can observe, and the three claims gone.
|
|
fn drive_path_bundle() -> serde_json::Value {
|
|
let mut bundle = submit_path_bundle();
|
|
bundle["run_id"] = serde_json::json!("skeleton-wave-a-0123456789abcdef");
|
|
bundle["run_conditions"] = serde_json::json!({
|
|
"initialization_path": "shard_drive_create",
|
|
"mutation_path": "journal_drive",
|
|
"checkpointing": "unimplemented",
|
|
"index_maintenance": "no_index_in_path",
|
|
"index_run_ceiling": "store_default",
|
|
"receipt_reconciliation": "no_receipts_in_path",
|
|
"objects_new_source": "derived_from_transaction_count",
|
|
"commit_id_uniqueness": "not_checked",
|
|
"build_profile": "debug",
|
|
"environment_fidelity": "diagnostic"
|
|
});
|
|
bundle["resources"]["configured_ceilings"]["max_index_runs"] = serde_json::json!(64);
|
|
bundle["storage"]["evidence_signing_micros_p50"] = serde_json::json!(0.0);
|
|
bundle["verification"] = serde_json::json!({
|
|
"setup_traffic_excluded": true,
|
|
"commits_in_recovered_closure": false,
|
|
"acknowledged_sequences_reconciled": true
|
|
});
|
|
bundle
|
|
}
|
|
|
|
/// The negative control for every test below it.
|
|
///
|
|
/// Without it, a `schema_errors` that returns empty for all input — a validator
|
|
/// that never ran, a schema that failed to load — reads as a green suite. The
|
|
/// substring version of the emitter's own tests stayed green against a bundle
|
|
/// with four validator errors for exactly this reason.
|
|
#[test]
|
|
fn both_reference_bundles_validate_and_the_validator_can_still_fail() {
|
|
assert_valid(
|
|
&submit_path_bundle(),
|
|
"the submit-path reference bundle must validate; it is the shape the \
|
|
emitter follow-up has to produce",
|
|
);
|
|
assert_valid(
|
|
&drive_path_bundle(),
|
|
"the journal-seam reference bundle must validate; the drive path stays \
|
|
emittable after the amendment",
|
|
);
|
|
|
|
let mut broken = submit_path_bundle();
|
|
broken["storage"] = serde_json::Value::Null;
|
|
assert_invalid(
|
|
&broken,
|
|
"the validator must reject something, or every assertion below is vacuous",
|
|
);
|
|
}
|
|
|
|
/// Amendment 1. The run conditions are required and enumerated, never prose.
|
|
#[test]
|
|
fn a_bundle_without_machine_readable_run_conditions_is_not_a_bundle() {
|
|
let text = std::fs::read_to_string(repository_root().join("bench/result-schema.json")).unwrap();
|
|
let schema: serde_json::Value = serde_json::from_str(&text).unwrap();
|
|
|
|
assert!(
|
|
schema["required"]
|
|
.as_array()
|
|
.unwrap()
|
|
.iter()
|
|
.any(|v| v == "run_conditions"),
|
|
"run_conditions must be required at every gate: a bundle whose caveats \
|
|
live only in a human report reads as unconditional to everyone who \
|
|
receives it"
|
|
);
|
|
assert_required_names(
|
|
&schema,
|
|
&["$defs", "run_conditions"],
|
|
&[
|
|
"initialization_path",
|
|
"mutation_path",
|
|
"checkpointing",
|
|
"index_maintenance",
|
|
"index_run_ceiling",
|
|
"receipt_reconciliation",
|
|
"objects_new_source",
|
|
"commit_id_uniqueness",
|
|
"build_profile",
|
|
"environment_fidelity",
|
|
],
|
|
);
|
|
|
|
// Charter item 6: every value named, no catch-all, and no free-text member
|
|
// a consumer would have to read rather than check.
|
|
let properties = schema["$defs"]["run_conditions"]["properties"]
|
|
.as_object()
|
|
.expect("run_conditions must declare its properties");
|
|
for (name, spec) in properties {
|
|
assert!(
|
|
spec.get("enum").is_some() || spec["type"] == "boolean",
|
|
"run_conditions.{name} must be a closed enumeration or a boolean; a \
|
|
free-text caveat is not a condition anything can check"
|
|
);
|
|
if let Some(values) = spec["enum"].as_array() {
|
|
for value in values {
|
|
let value = value.as_str().unwrap_or_default();
|
|
assert!(
|
|
!value.is_empty() && value != "other" && value != "unknown",
|
|
"run_conditions.{name} must not carry a catch-all value"
|
|
);
|
|
}
|
|
}
|
|
}
|
|
|
|
// Every field is enforced, not merely recorded: a bundle missing any one of
|
|
// them is invalid.
|
|
for field in properties.keys() {
|
|
let mut bundle = submit_path_bundle();
|
|
bundle["run_conditions"]
|
|
.as_object_mut()
|
|
.unwrap()
|
|
.remove(field.as_str());
|
|
assert_invalid(
|
|
&bundle,
|
|
&format!("a bundle omitting run_conditions.{field} must be rejected"),
|
|
);
|
|
}
|
|
|
|
let mut absent = submit_path_bundle();
|
|
absent.as_object_mut().unwrap().remove("run_conditions");
|
|
assert_invalid(
|
|
&absent,
|
|
"a bundle with no run_conditions block must be rejected",
|
|
);
|
|
}
|
|
|
|
/// Amendments 2 and 4, and the half of amendment 3 that is landable.
|
|
///
|
|
/// The submit path earns `unique_blob_tree_commit_ids` and
|
|
/// `objects_new_equals_three_per_commit` and must state them. It does not earn
|
|
/// `operation_receipts_reconciled` — and the schema says so mechanically rather
|
|
/// than in a comment, because the emitter can only declare the reconciliation
|
|
/// it performed and that declaration forbids the claim.
|
|
#[test]
|
|
fn the_submit_path_must_state_the_claims_it_now_earns() {
|
|
for claim in [
|
|
"unique_blob_tree_commit_ids",
|
|
"objects_new_equals_three_per_commit",
|
|
] {
|
|
let mut bundle = submit_path_bundle();
|
|
bundle["verification"]
|
|
.as_object_mut()
|
|
.unwrap()
|
|
.remove(claim);
|
|
assert_invalid(
|
|
&bundle,
|
|
&format!(
|
|
"a submit-path bundle omitting {claim} must be rejected: the claim \
|
|
is earnable through StoreEngine::submit, so silence about it is a \
|
|
missing result and not an inapplicable one"
|
|
),
|
|
);
|
|
}
|
|
|
|
// Amendment 2's condition. `objects_new` summed from the transaction count
|
|
// makes the claim unfailable, so the declaration that says so forbids it —
|
|
// at this gate and at every other.
|
|
let mut tautology = submit_path_bundle();
|
|
tautology["run_conditions"]["objects_new_source"] =
|
|
serde_json::json!("derived_from_transaction_count");
|
|
assert_invalid(
|
|
&tautology,
|
|
"objects_new_equals_three_per_commit may not be asserted over a count \
|
|
derived from the transaction total: both sides would come from the same \
|
|
number and the check could not fail",
|
|
);
|
|
|
|
// Amendment 4's condition. Per-record uniqueness and distinct seed domains
|
|
// are both named, and both refuse the claim.
|
|
for weaker in ["inferred_from_seed_domains", "not_checked"] {
|
|
let mut bundle = submit_path_bundle();
|
|
bundle["run_conditions"]["commit_id_uniqueness"] = serde_json::json!(weaker);
|
|
assert_invalid(
|
|
&bundle,
|
|
&format!(
|
|
"unique_blob_tree_commit_ids may not be asserted with \
|
|
commit_id_uniqueness={weaker}: uniqueness must be checked globally \
|
|
across every recovered ACK record"
|
|
),
|
|
);
|
|
}
|
|
|
|
// Amendment 3. Expressible, correctly constrained, and not earned today.
|
|
let mut unearned = submit_path_bundle();
|
|
unearned["verification"]["operation_receipts_reconciled"] = serde_json::json!(true);
|
|
assert_invalid(
|
|
&unearned,
|
|
"operation_receipts_reconciled may not be asserted while the run declares \
|
|
that it accepted any Committed status: store-bench.rs compares no receipt \
|
|
and journals a digest of the operation id, not of the receipt",
|
|
);
|
|
|
|
let mut earned = submit_path_bundle();
|
|
earned["run_conditions"]["receipt_reconciliation"] =
|
|
serde_json::json!("exact_receipts_reconciled");
|
|
assert_invalid(
|
|
&earned,
|
|
"a run that declares exact receipt reconciliation must assert the claim \
|
|
rather than leave it optional",
|
|
);
|
|
earned["verification"]["operation_receipts_reconciled"] = serde_json::json!(true);
|
|
assert_valid(
|
|
&earned,
|
|
"the claim must be expressible once the reconciliation is real, so landing \
|
|
it is an emitter change and not a second schema amendment",
|
|
);
|
|
|
|
// The two that stay unavailable to this workload at either path.
|
|
for claim in [
|
|
"blobs_recomputed",
|
|
"metadata_complete",
|
|
"commits_in_recovered_closure",
|
|
] {
|
|
let mut bundle = submit_path_bundle();
|
|
bundle["verification"][claim] = serde_json::json!(true);
|
|
assert_invalid(
|
|
&bundle,
|
|
&format!("{claim} must stay unavailable at storage_primitive"),
|
|
);
|
|
}
|
|
}
|
|
|
|
/// The branch-conditional half. A schema that merely *permitted* the three
|
|
/// claims on both paths would hand the journal seam a way to assert what it
|
|
/// cannot observe, which is a worse defect than the one being fixed.
|
|
#[test]
|
|
fn the_drive_path_may_not_assert_the_claims_the_submit_path_earns() {
|
|
for claim in [
|
|
"unique_blob_tree_commit_ids",
|
|
"objects_new_equals_three_per_commit",
|
|
"operation_receipts_reconciled",
|
|
] {
|
|
let mut bundle = drive_path_bundle();
|
|
bundle["verification"][claim] = serde_json::json!(true);
|
|
assert_invalid(
|
|
&bundle,
|
|
&format!(
|
|
"a journal-drive bundle asserting {claim} must be rejected: there \
|
|
are no objects, no receipts, and no index below engine.rs"
|
|
),
|
|
);
|
|
}
|
|
|
|
// And it may not reach the claims by lying about provenance either: the
|
|
// seam's declarations are pinned to the only values it can make.
|
|
for (field, value) in [
|
|
("objects_new_source", "summed_from_receipts"),
|
|
(
|
|
"commit_id_uniqueness",
|
|
"checked_globally_across_ack_records",
|
|
),
|
|
("receipt_reconciliation", "exact_receipts_reconciled"),
|
|
("index_maintenance", "runs_sealed"),
|
|
] {
|
|
let mut bundle = drive_path_bundle();
|
|
bundle["run_conditions"][field] = serde_json::json!(value);
|
|
assert_invalid(
|
|
&bundle,
|
|
&format!(
|
|
"a journal-drive bundle declaring {field}={value} must be rejected: \
|
|
forbidding the claim while permitting the declaration that earns it \
|
|
leaves the same hole one field over"
|
|
),
|
|
);
|
|
}
|
|
}
|
|
|
|
/// `max_index_runs` must be the value the run configured. Absent is invalid,
|
|
/// and a declaration that contradicts the recorded value is invalid in both
|
|
/// directions — which is as close to "not a default" as a schema can get
|
|
/// without reading the process's options.
|
|
#[test]
|
|
fn the_configured_index_run_ceiling_must_be_recorded_and_consistent() {
|
|
let mut absent = submit_path_bundle();
|
|
absent["resources"]["configured_ceilings"]
|
|
.as_object_mut()
|
|
.unwrap()
|
|
.remove("max_index_runs");
|
|
assert_invalid(
|
|
&absent,
|
|
"a bundle that does not record max_index_runs must be rejected: the ceiling \
|
|
is the limit this workload actually reaches",
|
|
);
|
|
|
|
// Declared raised, recorded as the default.
|
|
let mut defaulted = submit_path_bundle();
|
|
defaulted["resources"]["configured_ceilings"]["max_index_runs"] = serde_json::json!(64);
|
|
assert_invalid(
|
|
&defaulted,
|
|
"a run that raised the ceiling may not record the store default",
|
|
);
|
|
|
|
// Declared default, recorded as the raise the emitter actually configures.
|
|
let mut mislabelled = drive_path_bundle();
|
|
mislabelled["resources"]["configured_ceilings"]["max_index_runs"] =
|
|
serde_json::json!(1_000_000);
|
|
assert_invalid(
|
|
&mislabelled,
|
|
"a run that declares the store default may not record a raised ceiling",
|
|
);
|
|
|
|
// The store default the schema bounds `store_default` at must still be the
|
|
// library's default, or the two have drifted and the bound means nothing.
|
|
let options =
|
|
std::fs::read_to_string(repository_root().join("crates/levcs-store/src/options.rs"))
|
|
.unwrap();
|
|
assert!(
|
|
options.contains("max_index_runs: 64,"),
|
|
"bench/result-schema.json bounds a declared store_default at 64; if \
|
|
StoreOptions::default changes, that bound must change with it"
|
|
);
|
|
}
|
|
|
|
/// The truthful-environment ruling. B4's debug/tmpfs diagnostic run was
|
|
/// unrepresentable — `persistent_data_mount` and `tmpfs` were unconditional
|
|
/// consts — so its number lived on a console and in prose. It is representable
|
|
/// now, and mechanically disqualified: recording a diagnostic run is worth
|
|
/// nothing unless the record also refuses to let it be read as a result.
|
|
#[test]
|
|
fn a_diagnostic_environment_is_representable_but_can_never_pass() {
|
|
let mut diagnostic = submit_path_bundle();
|
|
diagnostic["deployment"]["persistent_data_mount"] = serde_json::json!(false);
|
|
diagnostic["deployment"]["tmpfs"] = serde_json::json!(true);
|
|
assert_valid(
|
|
&diagnostic,
|
|
"a tmpfs debug diagnostic run must be recordable as itself rather than \
|
|
being unrepresentable and therefore console-only",
|
|
);
|
|
|
|
// Disqualified, not merely labelled.
|
|
let mut passing = diagnostic.clone();
|
|
passing["outcome"] = serde_json::json!("pass");
|
|
assert_invalid(&passing, "a diagnostic run may never be a pass at any gate");
|
|
|
|
let mut verdict = diagnostic.clone();
|
|
verdict["verdicts"]["storage_primitive"] = serde_json::json!("pass");
|
|
assert_invalid(
|
|
&verdict,
|
|
"a diagnostic run may not pronounce a passing verdict on any gate",
|
|
);
|
|
|
|
// And the reference environment is unchanged for anything claiming it.
|
|
for (field, value) in [
|
|
("persistent_data_mount", serde_json::json!(false)),
|
|
("tmpfs", serde_json::json!(true)),
|
|
] {
|
|
let mut reference = submit_path_bundle();
|
|
reference["run_conditions"]["environment_fidelity"] =
|
|
serde_json::json!("reference_profile");
|
|
reference["run_conditions"]["build_profile"] = serde_json::json!("release");
|
|
reference["hardware"]["profile"] = serde_json::json!("minimum-30k");
|
|
reference["deployment"][field] = value.clone();
|
|
assert_invalid(
|
|
&reference,
|
|
&format!(
|
|
"reference_profile fidelity must re-pin deployment.{field}: relaxing \
|
|
the unconditional const without re-pinning it here would let a \
|
|
promotable bundle be measured on tmpfs"
|
|
),
|
|
);
|
|
}
|
|
|
|
let mut debug_reference = submit_path_bundle();
|
|
debug_reference["run_conditions"]["environment_fidelity"] =
|
|
serde_json::json!("reference_profile");
|
|
assert_invalid(
|
|
&debug_reference,
|
|
"reference_profile fidelity requires a release build and a named hardware \
|
|
profile; a debug diagnostic-profile run may not claim it",
|
|
);
|
|
}
|
|
|
|
/// Scope §7's two prose clauses, made mechanical: the P2 runs must not have
|
|
/// been achieved with checkpointing disabled, and a run holding every index
|
|
/// delta in memory for its whole duration is not the steady state a P2 number
|
|
/// describes. Neither could be checked from a bundle before this review.
|
|
#[test]
|
|
fn a_passing_storage_primitive_run_must_declare_a_production_steady_state() {
|
|
// The honest values today make a pass impossible, which is the point.
|
|
let mut passing = submit_path_bundle();
|
|
passing["outcome"] = serde_json::json!("pass");
|
|
passing["verdicts"]["storage_primitive"] = serde_json::json!("pass");
|
|
passing["run_conditions"]["environment_fidelity"] = serde_json::json!("reference_profile");
|
|
passing["run_conditions"]["build_profile"] = serde_json::json!("release");
|
|
passing["hardware"]["profile"] = serde_json::json!("minimum-30k");
|
|
assert_invalid(
|
|
&passing,
|
|
"today's harness may not emit a passing P2 bundle: checkpointing is \
|
|
unimplemented and the index holds every delta in memory",
|
|
);
|
|
|
|
passing["run_conditions"]["checkpointing"] = serde_json::json!("exercised");
|
|
passing["run_conditions"]["index_maintenance"] = serde_json::json!("runs_sealed");
|
|
passing["run_conditions"]["index_run_ceiling"] = serde_json::json!("store_default");
|
|
passing["resources"]["configured_ceilings"]["max_index_runs"] = serde_json::json!(64);
|
|
assert_invalid(
|
|
&passing,
|
|
"a P2 pass must have been measured against a root the production entry \
|
|
point created; ROOT_SEEDED_BY_NON_PRODUCTION_PATH is disclosable but not \
|
|
promotable",
|
|
);
|
|
|
|
passing["run_conditions"]["initialization_path"] = serde_json::json!("store_engine_open");
|
|
assert_valid(
|
|
&passing,
|
|
"a run that met every condition must still be able to pass, or the rule is \
|
|
a prohibition rather than a gate",
|
|
);
|
|
|
|
// The journal seam can never reach a P2 pass, whatever it declares.
|
|
let mut seam = drive_path_bundle();
|
|
seam["outcome"] = serde_json::json!("pass");
|
|
seam["run_conditions"]["environment_fidelity"] = serde_json::json!("reference_profile");
|
|
seam["run_conditions"]["build_profile"] = serde_json::json!("release");
|
|
seam["hardware"]["profile"] = serde_json::json!("minimum-30k");
|
|
seam["run_conditions"]["checkpointing"] = serde_json::json!("exercised");
|
|
assert_invalid(
|
|
&seam,
|
|
"a journal-drive measurement may never be a passing storage_primitive run",
|
|
);
|
|
}
|
|
|
|
/// The half of every per-gate split that is easy to lose: relaxing something
|
|
/// for one branch must never un-pin it for the others. It has been lost once
|
|
/// already, by the edit that introduced the assertion saying so.
|
|
#[test]
|
|
fn the_instance_gates_are_not_loosened_by_the_storage_path_split() {
|
|
let text = std::fs::read_to_string(repository_root().join("bench/result-schema.json")).unwrap();
|
|
let schema: serde_json::Value = serde_json::from_str(&text).unwrap();
|
|
let rule = schema["allOf"]
|
|
.as_array()
|
|
.unwrap()
|
|
.iter()
|
|
.find(|r| {
|
|
r["if"]["properties"]["gate"]["const"] == "storage_primitive" && r.get("else").is_some()
|
|
})
|
|
.expect("missing the per-gate rule");
|
|
let conditions = &rule["else"]["properties"]["run_conditions"]["properties"];
|
|
assert_eq!(
|
|
conditions["mutation_path"]["const"].as_str(),
|
|
Some("store_engine_submit"),
|
|
"no instance gate may be measured on the journal seam"
|
|
);
|
|
assert_eq!(
|
|
conditions["initialization_path"]["const"].as_str(),
|
|
Some("store_engine_open"),
|
|
"no instance gate may be measured against a root seeded outside production"
|
|
);
|
|
assert_eq!(
|
|
conditions["index_maintenance"]["const"].as_str(),
|
|
Some("runs_sealed")
|
|
);
|
|
assert_eq!(
|
|
conditions["checkpointing"]["enum"],
|
|
serde_json::json!(["exercised", "enabled_not_reached"]),
|
|
"an instance gate may not declare checkpointing unimplemented or disabled"
|
|
);
|
|
|
|
// And the five graph claims are still required and true at every instance
|
|
// gate, which the storage-path split must not have touched.
|
|
for claim in [
|
|
"unique_blob_tree_commit_ids",
|
|
"objects_new_equals_three_per_commit",
|
|
"blobs_recomputed",
|
|
"operation_receipts_reconciled",
|
|
"metadata_complete",
|
|
"commits_in_recovered_closure",
|
|
] {
|
|
assert_eq!(
|
|
rule["else"]["properties"]["verification"]["properties"][claim]["const"].as_bool(),
|
|
Some(true),
|
|
"{claim} must stay pinned true at every non-storage gate"
|
|
);
|
|
}
|
|
}
|
|
|
|
/// Both spellings of a raised ceiling are accepted, and both are bound the same
|
|
/// way.
|
|
///
|
|
/// The deprecated one is kept only so an archived v1 bundle stays valid --
|
|
/// `schema_version` is `const: 1`, so there is no later version to move it to,
|
|
/// and this repository has never held a bundle to check against. What must not
|
|
/// happen is the deprecation becoming a second, weaker rule: a bundle that
|
|
/// declares the old string still has to record a ceiling above the default, or
|
|
/// "deprecated" would have quietly turned into "unchecked".
|
|
///
|
|
/// The new spelling states only what the emitter observes. It compares the
|
|
/// configured ceiling with the store default and cannot know why they differ,
|
|
/// so it may not name a cause -- which is exactly what the old string did, for
|
|
/// a cause that is no longer true. Contract review 2026-08-09-B.
|
|
#[test]
|
|
fn both_raised_spellings_are_accepted_and_bound_the_same_way() {
|
|
for spelling in [
|
|
"raised_above_store_default",
|
|
"raised_because_index_sealing_unimplemented",
|
|
] {
|
|
let mut bundle = submit_path_bundle();
|
|
bundle["run_conditions"]["index_run_ceiling"] = serde_json::json!(spelling);
|
|
assert_valid(
|
|
&bundle,
|
|
&format!("{spelling} must be an accepted declaration of a raised ceiling"),
|
|
);
|
|
|
|
// The floor still applies. Recording the store default under either
|
|
// spelling is a bundle whose declaration and measurement disagree.
|
|
bundle["resources"]["configured_ceilings"]["max_index_runs"] = serde_json::json!(64);
|
|
assert_invalid(
|
|
&bundle,
|
|
&format!(
|
|
"{spelling} recording the store default must be refused; a deprecated \
|
|
spelling is still cross-checked"
|
|
),
|
|
);
|
|
}
|
|
}
|