Merge remote-tracking branch 'origin/integration/human-team-memory-v1' into codex/setup-onboarding-v08

Author: theDakshJaitly

.github/workflows/ci.yml

@@ -123,11 +123,15 @@ jobs:
           if-no-files-found: ignore
           retention-days: 7
 
-  release-performance:
-    # Runtime budgets are characterized and enforced only on this exact image.
-    # Node 24 remains compatibility coverage in the check matrix above.
+  release_performance_attempt_1:
+    name: release-performance-attempt-1
+    # Runtime budgets are characterized only on this exact image and Node patch.
+    # A potentially material crossing is confirmed by a separately allocated job.
     runs-on: ubuntu-24.04
     timeout-minutes: 60
+    outputs:
+      requires_confirmation: ${{ steps.decision.outputs.requires_confirmation }}
+      artifact_name: ${{ steps.decision.outputs.artifact_name }}
     steps:
       - uses: actions/checkout@v5
       - uses: actions/setup-node@v5
@@ -136,11 +140,109 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npx playwright install --with-deps chromium
-      - name: Enforce release performance budgets
+      - run: npm run build
+      - name: Measure the first release-performance attempt
         env:
           MEX_ENFORCE_RELEASE_BUDGETS: "1"
-        run: npm run benchmark:release
-      - name: Upload release benchmark report
+        run: >-
+          node scripts/release-benchmark/ci-orchestrator.mjs attempt
+          --report test-results/release-benchmark/attempt-1/report.attempt-1.json
+          --manifest test-results/release-benchmark/attempt-1/manifest.json
+      - name: Publish the bounded confirmation decision
+        id: decision
+        shell: bash
+        run: |
+          REQUIRED="$(node scripts/release-benchmark/ci-orchestrator.mjs retry-required --manifest test-results/release-benchmark/attempt-1/manifest.json)"
+          echo "requires_confirmation=$REQUIRED" >> "$GITHUB_OUTPUT"
+          echo "artifact_name=release-performance-attempt-1-$GITHUB_RUN_ATTEMPT" >> "$GITHUB_OUTPUT"
+      - name: Upload first release benchmark evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ steps.decision.outputs.artifact_name }}
+          path: test-results/release-benchmark/attempt-1/
+          if-no-files-found: ignore
+          retention-days: 14
+
+  release_performance_attempt_2:
+    name: release-performance-attempt-2
+    needs: release_performance_attempt_1
+    if: needs.release_performance_attempt_1.outputs.requires_confirmation == 'true'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    outputs:
+      artifact_name: ${{ steps.evidence.outputs.artifact_name }}
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 22.22.0
+          cache: npm
+      - run: npm ci
+      - run: npx playwright install --with-deps chromium
+      - run: npm run build
+      - name: Measure the fresh-runner confirmation attempt
+        env:
+          MEX_ENFORCE_RELEASE_BUDGETS: "1"
+        run: >-
+          node scripts/release-benchmark/ci-orchestrator.mjs attempt
+          --report test-results/release-benchmark/attempt-2/report.attempt-2.json
+          --manifest test-results/release-benchmark/attempt-2/manifest.json
+      - name: Publish the bounded evidence identity
+        id: evidence
+        shell: bash
+        run: echo "artifact_name=release-performance-attempt-2-$GITHUB_RUN_ATTEMPT" >> "$GITHUB_OUTPUT"
+      - name: Upload second release benchmark evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ steps.evidence.outputs.artifact_name }}
+          path: test-results/release-benchmark/attempt-2/
+          if-no-files-found: ignore
+          retention-days: 14
+
+  release-performance:
+    # Preserve this final job name as the stable release gate. It always runs so
+    # a skipped, cancelled, or malformed producer cannot silently bypass CI.
+    needs: [release_performance_attempt_1, release_performance_attempt_2]
+    if: always()
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 22.22.0
+      - name: Download first release benchmark evidence
+        continue-on-error: true
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{ needs.release_performance_attempt_1.outputs.artifact_name }}
+          path: test-results/release-benchmark/attempt-1/
+      - name: Download fresh-runner confirmation evidence
+        if: needs.release_performance_attempt_1.outputs.requires_confirmation == 'true'
+        continue-on-error: true
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{ needs.release_performance_attempt_2.outputs.artifact_name }}
+          path: test-results/release-benchmark/attempt-2/
+      - name: Finalize release performance without a confirmation
+        if: needs.release_performance_attempt_1.outputs.requires_confirmation != 'true'
+        run: >-
+          node scripts/release-benchmark/ci-orchestrator.mjs finalize
+          --first-report test-results/release-benchmark/attempt-1/report.attempt-1.json
+          --first-manifest test-results/release-benchmark/attempt-1/manifest.json
+          --output test-results/release-benchmark/report.json
+      - name: Finalize release performance with fresh-runner confirmation
+        if: needs.release_performance_attempt_1.outputs.requires_confirmation == 'true'
+        run: >-
+          node scripts/release-benchmark/ci-orchestrator.mjs finalize
+          --first-report test-results/release-benchmark/attempt-1/report.attempt-1.json
+          --first-manifest test-results/release-benchmark/attempt-1/manifest.json
+          --second-report test-results/release-benchmark/attempt-2/report.attempt-2.json
+          --second-manifest test-results/release-benchmark/attempt-2/manifest.json
+          --output test-results/release-benchmark/report.json
+      - name: Upload final release benchmark report
         if: always()
         uses: actions/upload-artifact@v4
         with:

.mex/patterns/release-performance-gate.md

@@ -12,7 +12,7 @@ edges:
   - target: "patterns/safe-graph-snapshot-evolution.md"
     condition: "when changing Graph maintenance or corpus inspection"
 grounds_to: []
-last_updated: 2026-08-29
+last_updated: 2026-09-02
 ---
 
 # Release Performance Gate
@@ -43,7 +43,9 @@ calibration environment.
    before and after ordinary reads.
 5. Use the first healthy pinned report as characterization. Freeze runtime,
    time, RSS, and heap limits at `ceil(p95 * 1.15)` and built asset limits at
-   `ceil(bytes * 1.05)`, then rerun the same pinned job in enforcement mode.
+   `ceil(bytes * 1.05)`. During CI enforcement, collect a potentially material
+   confirmation in a separately allocated pinned hosted job at the exact same
+   repository HEAD; two child processes on one VM are not independent evidence.
 6. Commit the budget file, its versioned schema/golden, and the retained runner
    identity together. Never copy wall-clock numbers from a local machine.
 7. When a new deterministic team fixture adds canonical and checkout-local
@@ -69,6 +71,10 @@ calibration environment.
 - Corpus byte caps prevent runaway allocation, but maintenance should also
   release source bodies and parser state as each file or bounded compiler batch
   completes.
+- Back-to-back confirmation processes on one hosted VM share CPU steal,
+  throttling, and I/O contention. Keep the raw reports as artifacts, pass only
+  a bounded retry decision between jobs, and make missing or same-allocation
+  confirmation evidence fail operationally.
 - An unavailable-route placeholder can already have a frozen asset or heap
   budget. Replacing it with a real lazy workbench should initially fail only
   that route's owned leaves; do not reinterpret the placeholder budget as a
@@ -89,8 +95,9 @@ calibration environment.
 
 If asset hashes change unexpectedly, inspect the built chunks for React
 development sentinels before recalibrating. If runtime enforcement is noisy,
-confirm the exact OS/architecture/Node patch and fixture digest; do not widen a
-budget until the retained raw samples show a real regression or stable shift.
+confirm the exact OS/architecture/Node patch, fixture digest, repository HEAD,
+and distinct hosted-job allocations; do not widen a budget until the retained
+raw samples show a real regression or stable shift.
 
 ## Update Scaffold
 

docs/design/release-performance-baseline.md

@@ -97,6 +97,19 @@ bytes respectively. Initial CSS/fonts and every unrelated route/runtime budget
 remain unchanged. A clean pinned enforcing run on the final exact head remains
 required before release.
 
+The fresh-runner confirmation topology was added after PR run
+[`33616707003`](https://github.com/mex-memory/mex/actions/runs/33616707003)
+and integration push run
+[`33619416840`](https://github.com/mex-memory/mex/actions/runs/33619416840)
+produced materially different Graph, Wiki, and Search failure sets for Git
+commits with the same tree SHA
+`950182277ee98719ec6971618cb83b597323e468`. The earlier confirmation logic
+started two child processes back-to-back on one hosted VM, so sustained host
+contention could satisfy both sides of the exact-metric rule. This hardening
+changes only confirmation allocation and provenance: `budgets.json`, sample
+counts, material thresholds, category floors, and calibration formulas remain
+byte-for-byte unchanged.
+
 ## Runner contract
 
 `npm run benchmark:release` builds the package and writes the bounded JSON
@@ -178,18 +191,31 @@ Deterministic failures remain immediate: built-asset bytes, outbound requests,
 database-to-input ratios, and any unknown runtime metric never receive a retry.
 The read and maintenance nonmutation contracts likewise remain ordinary hard
 tests. A first pass containing only wall-clock, RSS, CPU, or browser-heap
-breaches triggers one independent full benchmark pass on the same pinned
-runner and exact repository HEAD only when at least one crossing could still
-become material. A crossing is potentially material when its p95 is strictly
-above the material threshold and at least two of its raw samples are also
-strictly above that threshold. If every first-pass crossing is below the
-threshold or has fewer than two supporting samples, enforcement records the
-advisories and passes without spending another full benchmark run. CI fails a
-noisy metric only when that exact metric breaches again, both p95 measurements
-exceed its material threshold, and both attempts have at least two supporting
-raw samples. This avoids treating the single maximum selected by nearest-rank
-p95 over either ten timing samples or five memory samples as
-distribution-level evidence. The committed p95 budgets remain the raw
+breaches requests one independent full benchmark pass only when at least one
+crossing could still become material. In CI that conditional confirmation runs
+in a separately allocated Ubuntu 24.04 hosted job, not as another process on
+the first job's VM. Both jobs measure the exact same repository HEAD and pinned
+Node version; a final fail-closed aggregation job validates their bounded raw
+reports and runner-allocation records before applying the existing exact-metric
+rule. A missing, malformed, same-runner, or different-HEAD confirmation is an
+operational failure rather than a pass. The local `npm run benchmark:release`
+command remains self-contained and uses its existing in-process orchestration.
+Producer-specific artifact identities allow GitHub's failed-only rerun to reuse
+valid evidence from an earlier attempt of the same workflow run. Aggregation
+accepts only the same run and SHA, nondecreasing producer attempts, and evidence
+no newer than the finalizer attempt.
+
+A crossing is potentially material when its p95 is strictly above the material
+threshold and at least two of its raw samples are also strictly above that
+threshold. If every first-pass crossing is below the threshold or has fewer
+than two supporting samples, enforcement records the advisories and passes
+without allocating a confirmation runner. CI fails a noisy metric only when
+that exact metric breaches on the fresh confirmation runner, both p95
+measurements exceed its material threshold, and both attempts have at least two
+supporting raw samples. This avoids treating the single maximum selected by
+nearest-rank p95 over either ten timing samples or five memory samples as
+distribution-level evidence, while preventing one contended VM from supplying
+both sides of the confirmation. The committed p95 budgets remain the raw
 alert/crossing line and are not recalibrated. For each exact metric key, the
 blocking threshold is
 `budget + max(15% of budget, minimum excess)`:
@@ -217,16 +243,20 @@ inconsistent raw sample evidence, are never retried as budget noise.
 Enforcement exits 0 for a pass, 1 for a budget failure, and 2 when a pass cannot
 produce a valid bounded report.
 
-The dedicated `release-performance` CI job installs Chromium on the pinned
-runner, enforces the budgets, and retains the final report plus both attempt
-reports when confirmation was required. It also retains the first raw attempt
-when advisory sample support makes a second pass unnecessary. Runtime
-candidates in that report are `ceil(p95 * 1.15)` independently for each fixture profile,
-route, read, and maintenance operation. The committed values are copied exactly
-from the first healthy retained pinned report; its enforcing rerun must pass
-before Checkpoint A is considered green. Future recalibration uses the same
-retained-report workflow. Do not derive runtime limits from an unpinned local
-run or collapse fixture profiles into one worst-case envelope.
+The dedicated CI topology uses `release-performance-attempt-1`, a conditional
+`release-performance-attempt-2`, and the final required
+`release-performance` aggregation job. Each measuring job installs Chromium on
+the pinned image and retains its raw report and bounded decision manifest for
+14 days. The final job retains the combined report; it runs even if a producer
+was cancelled or failed so missing evidence cannot silently skip the gate. The
+first raw attempt is still retained when advisory sample support makes a second
+runner unnecessary. Runtime candidates in that report are `ceil(p95 * 1.15)`
+independently for each fixture profile, route, read, and maintenance operation.
+The committed values are copied exactly from the first healthy retained pinned
+report; its enforcing rerun must pass before Checkpoint A is considered green.
+Future recalibration uses the same retained-report workflow. Do not derive
+runtime limits from an unpinned local run or collapse fixture profiles into one
+worst-case envelope.
 
 The report is capped at 2 MiB. Response bodies, child-process diagnostics,
 recorded request paths, asset lists, and violation lists also have explicit