perf(cpg): build JavaScript in one engine start, gated on the census (M2 11.6)

JavaScript was the only language paying two engine starts: the declared frontend
and then a separate overlay pass. joern-parse applies the overlays itself. On the
pinned Node tree that is 11.0 s against 21.0 s.

The declared frontend stays as the fallback, because it is what the versioned
retention adaptation and the explicit exclusion policy run through, and the census
decides per build: a graph that does not hold every readable declared file is
rebuilt through the frontend rather than trusted. Exclusions keep the frontend path
outright.

Measured under the production retention environment, both paths produce the same 44
files, the same 579 methods, the same file names, the same five overlays, the
Gruntfile and all eighteen first-party test files, with no file present in one
graph and missing from the other.

My first measurement did not establish that. It ran without the retention
environment, both paths dropped to 25 files, and the apparent equivalence was two
runs discarding the same things. The existing control named for that decision
failed against the change built on it, which is exactly what it is for; the
evidence was wrong, not the control. That control now asserts the intent directly:
the faster path is tried first, and a short census rebuilds through the frontend.

1,401 tests passed, nine skipped. A build saving is not the latency gate; the
profile rerun decides that. Rollout stays NO-GO.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
2026-09-17 08:44:48 +02:00
co-authored by Claude Opus 5
parent 7acb897d77
commit f04a839181
3 changed files with 200 additions and 14 deletions
@@ -0,0 +1,150 @@
{
"experiment": "javascript-build-path-v1",
"root": "/cache/nodegoat/c5cb68a7084e",
"paths": [
{
"path": "frontend_then_overlay",
"frontend_seconds": 6.20875704404898,
"overlay_seconds": 14.808171501965262,
"total_seconds": 21.016928546014242,
"frontend_exit": 0,
"overlay_exit": 0,
"census": {
"files": "44",
"methods": "579",
"calls": "4134",
"file_names": [
"Gruntfile.js",
"app/assets/js/chart/chart-data-morris.js",
"app/assets/js/tour/redirects-steps.js",
"app/data/allocations-dao.js",
"app/data/benefits-dao.js",
"app/data/contributions-dao.js",
"app/data/memos-dao.js",
"app/data/profile-dao.js",
"app/data/research-dao.js",
"app/data/user-dao.js",
"app/routes/allocations.js",
"app/routes/benefits.js",
"app/routes/contributions.js",
"app/routes/error.js",
"app/routes/index.js",
"app/routes/memos.js",
"app/routes/profile.js",
"app/routes/research.js",
"app/routes/session.js",
"app/routes/tutorial.js",
"artifacts/db-reset.js",
"config/config.js",
"config/env/all.js",
"config/env/development.js",
"config/env/production.js",
"config/env/test.js",
"server.js",
"test/e2e/integration/allocations_spec.js",
"test/e2e/integration/benefits_spec.js",
"test/e2e/integration/contributions_spec.js",
"test/e2e/integration/dashboard_spec.js",
"test/e2e/integration/general_spec.js",
"test/e2e/integration/learn_spec.js",
"test/e2e/integration/login_spec.js",
"test/e2e/integration/logout_spec.js",
"test/e2e/integration/memos_spec.js",
"test/e2e/integration/profile_spec.js",
"test/e2e/integration/research_spec.js",
"test/e2e/integration/signup_spec.js",
"test/e2e/integration/tutorial_spec.js",
"test/e2e/plugins/index.js",
"test/e2e/support/commands.js",
"test/e2e/support/index.js",
"test/security/profile-test.js"
],
"overlays": "base,controlflow,typerel,callgraph,dataflowOss",
"maxHeapMB": "2048"
}
},
{
"path": "joern_parse_only",
"total_seconds": 10.995579135953449,
"exit": 0,
"stderr_tail": "Picked up JAVA_TOOL_OPTIONS: -Xmx2048m\n2026-09-17 06:41:16.285 WARN CfgCreator$ Using order fallback for try statement finally body\n",
"census": {
"files": "44",
"methods": "579",
"calls": "4134",
"file_names": [
"Gruntfile.js",
"app/assets/js/chart/chart-data-morris.js",
"app/assets/js/tour/redirects-steps.js",
"app/data/allocations-dao.js",
"app/data/benefits-dao.js",
"app/data/contributions-dao.js",
"app/data/memos-dao.js",
"app/data/profile-dao.js",
"app/data/research-dao.js",
"app/data/user-dao.js",
"app/routes/allocations.js",
"app/routes/benefits.js",
"app/routes/contributions.js",
"app/routes/error.js",
"app/routes/index.js",
"app/routes/memos.js",
"app/routes/profile.js",
"app/routes/research.js",
"app/routes/session.js",
"app/routes/tutorial.js",
"artifacts/db-reset.js",
"config/config.js",
"config/env/all.js",
"config/env/development.js",
"config/env/production.js",
"config/env/test.js",
"server.js",
"test/e2e/integration/allocations_spec.js",
"test/e2e/integration/benefits_spec.js",
"test/e2e/integration/contributions_spec.js",
"test/e2e/integration/dashboard_spec.js",
"test/e2e/integration/general_spec.js",
"test/e2e/integration/learn_spec.js",
"test/e2e/integration/login_spec.js",
"test/e2e/integration/logout_spec.js",
"test/e2e/integration/memos_spec.js",
"test/e2e/integration/profile_spec.js",
"test/e2e/integration/research_spec.js",
"test/e2e/integration/signup_spec.js",
"test/e2e/integration/tutorial_spec.js",
"test/e2e/plugins/index.js",
"test/e2e/support/commands.js",
"test/e2e/support/index.js",
"test/security/profile-test.js"
],
"overlays": "base,controlflow,typerel,callgraph,dataflowOss",
"maxHeapMB": "2048"
}
}
],
"source_files": 50,
"source_bytes": 367111,
"retention": {
"frontend_has_gruntfile": true,
"joern_parse_has_gruntfile": true,
"frontend_test_files": 18,
"joern_parse_test_files": 18,
"only_in_frontend": [],
"only_in_joern_parse": []
},
"comparison": {
"same_files": true,
"same_methods": true,
"same_overlays": true,
"same_file_names": true,
"seconds_saved": 10.02
},
"milestone": "M2 task 11.6",
"instrument_note": "A first run without OUSAST_INCLUDE_TESTS and OUSAST_INCLUDE_BUILD_CONFIGS reported 25 files from both paths and appeared to show equivalence. It did not: both runs dropped the retained files, so the comparison said nothing about the retention adaptation the frontend path exists for. An existing control caught the change built on it. This run sets the production environment.",
"decision": "JavaScript now builds through joern-parse, one engine start including overlays, and falls back to the declared frontend plus overlay pass whenever the census is short. Both paths hold the same 44 files, 579 methods, file names, overlays, the Gruntfile and all eighteen first-party test files.",
"limits": [
"One pinned JavaScript tree. PHP keeps the frontend path, which it needs for exclusions and retries.",
"A build saving is not the latency gate: the profile rerun decides that."
]
}