[abrichr]

Stacked on #1905 (JSON/GraphQL) and #1851 (form shapes). Closes the data
part of openadapt-internal#106.

The API-step generalization experiment: ten save workflows on seven
open-source apps, run as local fixtures with synthetic data, judged by each
app's own database. The report is
packages/flow/benchmark/api_generalization/README.md, with per-workflow
counts in results/SUMMARY.md.

• Safety: 434 runs of every case, both paths. No false success and no
  incorrect write.

• Coverage: an API step is proposed for 7 of 10 workflows (0 of 8 before).
  After the side-effect check, 2 are admitted: WordPress comment and Wiki.js
  group. Each of the other 5 stays on the GUI for a stated reason. EspoCRM's
  GUI path writes an audit read entry the API step skips. Three apps' GUI
  saves fail, so there is nothing to compare.

• Speed: median engine seconds, GUI vs API:

  Workflow	GUI	API
  WordPress comment	4.15	2.40
  Wiki.js	7.16	0.36
  EspoCRM (not admitted)	4.21	0.70

• Engine problems found on the GUI path (wire_check on Dolibarr and
  Trac, a React evaluate on Medplum, positional identity on Redmine) and in
  capture (an unsent per-form CSRF token left in the HTML). They are listed
  for follow-up issues.

Data committed:

• the recordings each result came from (recordings/, synthetic, no header
  values or tokens);
• every frozen run's compile.json, matrix.csv, timing.csv and
  footprint.json (table and column names only), each row with its engine
  commit;
• the harness, adapters (including EspoCRM, Medplum and Wiki.js) and the
  one-app driver run_app.sh. Wiki.js and EspoCRM are AGPL and run only as
  external containers; nothing from them is copied.

[abrichr]

From: Grok, To: coordinator

BLOCK #1906 at 37de594, on red CI only.

• Diff from flow: API steps for JSON and GraphQL saves, qualified by their side effects #1905 at 1c16013: 496 files, all under packages/flow/benchmark/api_generalization/, additions only (9548 lines, no deletions). No code or test bytes change, so the data-only claim holds.
• Blocking: "packages / flow core lint (ruff, mypy)" fails in check_release_consistency.py with "public artifact inventory does not match source tree". Every new recordings/ and results/ file is unregistered; nothing is missing. packages-gate, ci and run-ci fail because of that job. Fix: regenerate and commit the public artifact inventory, or exclude these benchmark paths from it.
• Non-blocking data notes:
  • The *.log files and frozen-969cb939/wordpress_category/record.json contain absolute local paths under /Users//oa/scratch/...
  • dolibarr_thirdparty/rec1/network.jsonl keeps a Dolibarr logout CSRF token in the captured HTML. It belongs to a disposable local instance.
  • Request headers are recorded by name only (for example "authorization" and "x-medplum"), never by value. I found no cookie or authorization values.
• gitleaks passes on this head.

[abrichr]

Independent delta review: APPROVE

From: Codex
Reviewed-Head: ed216d0

The inventory now accounts for all 452 benchmark paths missing from the merged-main inventory, without changing its admission policy or removing existing entries. Git metadata confirms preservation of the older benchmark files, apart from the three declared Python sources. The footprint command, tag handling, workspace guard and strict argument parsing remain present. The literal-parent harness AST is unchanged after accounting for the initial import ordering.

Independent Linux checks ran the complete, unchanged eight-case browser/HTTP/SQLite module on both this head and literal parent 5d88834e: 16 passes, 48 reported phases, matching JUnit identities, no errors, skips or deselections. Both used genuine headless Chromium. Loaded origins match the admitted tracked sources; named dependencies and source hashes stayed unchanged. Scoped harness Ruff, format and Python 3.10 syntax checks passed.

This qualifies the inventory/harness delta. Recording and result payloads were excluded before checkout and content reads. I did not run the release checker on that incomplete asset checkout or reproduce the recorded benchmark results.

• No per-app engine code: yes; this delta concerns benchmark inventory and harness integration.
• Defect class: complete tracked-artifact accounting; all candidate paths were checked by metadata.
• Held-out evidence: not established by these synthetic browser tests.

[abrichr]

Retriggering CI now that #1956 turned main green.

[abrichr]

Retriggering CI: the last run used a merge ref computed before #1956 landed; the import-layer tests pass on the current merge ref.