2026-09-13 19:06:02 +02:00
|
|
|
|
# Runtime follow-up from pre-push-safety-net task 8.2
|
|
|
|
|
|
|
|
|
|
|
|
Status: frozen measurement complete, runtime NO-GO; investigation routed to the existing engine/runtime
|
|
|
|
|
|
owner. This note does not change contributor-scan task approvals or detector semantics.
|
|
|
|
|
|
Final scorecard and exact instrument identities are linked below.
|
|
|
|
|
|
|
|
|
|
|
|
The NodeGoat production transaction uses the existing evidence ranker and full tracked
|
|
|
|
|
|
first-party graph. Initial packaged process receipts show approximately 5 seconds for
|
|
|
|
|
|
the JavaScript frontend, 14 seconds for overlays and 12 seconds for census before the
|
|
|
|
|
|
first query. Each query invokes another JVM. Both comparison sides retain independent
|
|
|
|
|
|
graph/answer identities. These are observed single-stage costs, not p95 estimates.
|
|
|
|
|
|
|
|
|
|
|
|
The existing engine boundary owns frontend execution, overlays, graph census, queries,
|
|
|
|
|
|
process cancellation and validated graph leases. Investigate batching census and query
|
|
|
|
|
|
work into an engine session, amortizing JVM startup, and reusing complete immutable
|
|
|
|
|
|
base-side artifacts. Measure the additional costs of graph parsing, overlay work and
|
|
|
|
|
|
loading separately. A long-lived local engine would need request deadlines, isolated
|
|
|
|
|
|
leases, reliable cancellation/recovery and resource limits before it can replace the
|
|
|
|
|
|
current disposable subprocess lifecycle.
|
|
|
|
|
|
|
|
|
|
|
|
Any proposed change must preserve named source/census receipts, actual selected/deferred
|
|
|
|
|
|
question identities, first-party-only graph contents, exact base/head comparisons and
|
|
|
|
|
|
fresh-answer census validation. Compare evidence against cold execution. Keep the
|
|
|
|
|
|
30-second warm p95 and 2-second cancellation/report gates unchanged. Differential graph
|
|
|
|
|
|
mutation remains a separate experiment requiring cold-equivalence evidence. Ranker
|
|
|
|
|
|
retuning or shrinking the evaluation population cannot repair fixed engine startup cost.
|
|
|
|
|
|
|
|
|
|
|
|
The initial long-budget NodeGoat priming transaction finished in 224.47 seconds with
|
|
|
|
|
|
incomplete coverage. Its head partition records 44 input paths and 95,411 source bytes,
|
|
|
|
|
|
but the scan reports `cpg_empty` and `partition_file_census_incomplete`; the declared
|
|
|
|
|
|
contributions handler remains an unresolved file-level question. No qualified graph
|
|
|
|
|
|
or answer hit is established for the following identical comparison. This is a named
|
|
|
|
|
|
instrument/coverage gap, not evidence that the target is safe or that the ranker missed
|
|
|
|
|
|
a proven candidate. Reconcile raw frontend/census filenames with the 44 input paths,
|
|
|
|
|
|
including the explicit test-retention policy, before attributing this to cache identity
|
|
|
|
|
|
or detector semantics. Keep this investigation separate from JVM startup optimization.
|
|
|
|
|
|
|
|
|
|
|
|
Final task 8.2 receipts: `benchmarks/measurements/2026-09-13-nodegoat-feasibility.json`
|
|
|
|
|
|
and its compressed full evidence bundle. All 21 deadline-bound transactions timed out,
|
|
|
|
|
|
0/24 declared target checks completed, observed workload p95 30.631–30.912 seconds.
|
|
|
|
|
|
Every measured artifact matches the frozen installed semantics. No source, engine,
|
|
|
|
|
|
query, fact or ranking change was made during this run. The follow-up remains necessary
|
|
|
|
|
|
before rollout; the evaluation task does not authorize weakening its gates.
|
2026-09-13 19:32:43 +02:00
|
|
|
|
|
|
|
|
|
|
## VAmPI qualification follow-up, 2026-09-13
|
|
|
|
|
|
|
|
|
|
|
|
Task 8.3's packaged frozen regression (139,164 total snapshot bytes read per replay)
|
|
|
|
|
|
retains raw findings at `models/user_model.py:73:get_user`,
|
|
|
|
|
|
`api_views/users.py:187:update_password`, and `api_views/books.py:51:get_by_title`.
|
|
|
|
|
|
The SQLI target has no selected exact function question; the two authorization target
|
|
|
|
|
|
questions are selected at positions 93 and 63 but have `change_context_incomplete`.
|
|
|
|
|
|
Head scope retains 138 selected and 20 deferred questions. Raw findings do not prove
|
|
|
|
|
|
completed target questions or a transitive source-to-target witness.
|
|
|
|
|
|
|
|
|
|
|
|
The first lab run took 112.415s; same-snapshot cached replays took 6.816s and 6.684s,
|
|
|
|
|
|
all incomplete. This is diagnostic reuse, not changed-code performance qualification.
|
|
|
|
|
|
The 600-second budget is distinct from the hook acceptance profile. Full artifacts are
|
|
|
|
|
|
in `2026-09-13-push-qualification.json.gz` under the regression population.
|
|
|
|
|
|
|
|
|
|
|
|
Reconcile evidence normalization and the unsupported context projection at the shared
|
|
|
|
|
|
scan boundary before downstream admission: retain the actual query-origin/path witness
|
|
|
|
|
|
when available, resolve supported first-party context, and keep unresolved dynamic/vendor
|
|
|
|
|
|
boundaries explicit. Do not fabricate transitivity from a raw finding at the target.
|
|
|
|
|
|
Revalidate ordinary VAmPI scan, exact question accounting, push regressions and independent
|
|
|
|
|
|
qualification after an approved owner fix. This note records the prerequisite; it does
|
|
|
|
|
|
not silently approve an upstream implementation or change detector semantics.
|
