[pranems]

Summary

Prepare one bounded, non-admitting fixed 100/1000-warmup diagnostic on an
exact checkout image, without retrying or changing original qualification.

Stacked on held #251 after the corrected evidence prerequisite #264. The
study is not a release gate waiver or a claim that longer warmup is a fix.
It runs exactly two current/current BAAB blocks on one existing Linux host
and one source-bound image, retaining all warmup/measured spans and raw values.
Original 0.5 CPU / 1 GiB limits, 1000 measured cycles and admission bounds
are unchanged. Every calibration-marked receipt is rejected by the original
assessor and by native-function comparisons.

The shared exact-image builder now has two real workflow callers. The
existing trace lifecycle gains a finite owner/trace/source-guarded parameter,
not a second resource orchestrator. There is no new dependency, paid Azure
host, secret, application behavior, public image push or deployment.

Study stop rules are frozen in the feature doc before allocation. Each
block retains its 15-minute cooperative deadline, 20-minute step cap and
exact cleanup; the 65-minute job reserves separate build/upload time.
Do not adapt warmup, discard observations, select favorable windows, retry
failed visits or turn descriptive stability into admission. Sequential
host-time/history differences and observer perturbation remain limitations.

Linked Defect / Plan Reference

• DELIVERY_PLAN.md defect ID: ci: qualify membership performance on isolated Linux runners #251 measured same-image stability gap.
• Audit doc reference: docs/ENDPOINT_SNAPSHOT_REVISION.md, Bounded fixed-warmup study.
• ADR (if applicable): N/A; reuse of existing diagnostic lifecycle and two-caller image-builder extraction.

TDD Process

• RED test written first; observed it fail for the expected reason
• GREEN: minimal implementation that turns the test green
• Refactor (if any) keeps the test green
• Permanent regression guard added (where applicable - see existing patterns in api/src/security/)

Observed RED: absent calibration identity, 100 rather than 1000 warmup cycles,
missing preflight/builder/workflow, original diagnostic cardinality rejection
and native comparison accepting cross-experiment evidence. Current focused
GREEN is 137/137, including twelve new cases and the existing native caller.

Feature / Bug-Fix Commit Checklist (standing rule)

Every behavioral change must include all that apply. Tick or strike through with N/A + reason.

• Unit Tests - service-level and controller-level coverage of the new behavior. N/A for serving services/controllers; Node/PowerShell tooling has twelve additional regression cases.
• E2E Tests - end-to-end spec under api/test/e2e/ exercising the feature through HTTP. Actual HTTP client and real CLI/PowerShell contracts cover the changed tooling; API source is unchanged.
• Live Integration Tests - new section in scripts/live-test.ps1 runnable against local + Docker + Azure. N/A for Azure; bounded hosted diagnostic remains required before using its observations.
• Feature Documentation - dedicated doc in docs/ with architecture, RFC references, Mermaid diagrams, test coverage. Existing feature, infrastructure, lessons and RCA documents updated; no new diagram.
• INDEX.md Update - add the new doc reference to docs/INDEX.md. N/A; no new document.
• CHANGELOG.md Update - [Unreleased] entry with full test counts and feature summary
• Session & Context Updates - Session_starter.md and docs/CONTEXT_INSTRUCTIONS.md
• Version Management - bump api/package.json (and any other version refs) when behavior changed. N/A; this is a prerequisite for unreleased parent 0.55.67, not a new product release. No local lock regeneration.
• Response Contract Tests - API responses contain ONLY documented fields (key allowlist assertion at unit + E2E + live). N/A; no serving contract change. Tooling verifies exact sample/span/cardinality and experiment markers.

Validation Output

node --test scripts\test\membership-performance.test.cjs scripts\test\membership-cpu-trace.test.cjs scripts\test\membership-stability.test.cjs scripts\test\membership-warmup.test.cjs
PASS: 95 tests, zero skips or failures.

node --test scripts\test\membership-v8-profile.test.cjs
PASS: 42 tests, zero skips or failures. Combined focused coverage: 137.

node --test scripts\test\membership-warmup.test.cjs
PASS: 4 final boundary contracts after checking both calibration settings
are included in the actual environment-restoration list.

Actual HTTP assertions: 4407/8007 requests, 100/1000 warmup cycles,
1000 timings per operation, all warmup/measured spans and exact cleanup.
Actual image-builder PowerShell and real binding CLI: PASS using explicitly
mocked Git/Docker boundaries; this is not a real Docker-build claim.

Published tip: 991a9ce0caf6e66f44705bc039b6f5de8140ad48.
$env:PREPUSH_MODE='Validate'
$env:DATABASE_URL='postgresql://localhost:5432/scim_codegen?schema=public'
git push --set-upstream origin fix/qualification-warmup-study-20261103
PASS: all30 normal protected gates, exit0,1317.2 seconds.
Complete tooling:247 PASS/8 explicit skips/0 FAIL,255 total.
API unit:6254 PASS/216 suites.
API inmemory E2E:2514 PASS/42 explicit skips;118 passing/2 skipped suites.
Web Vitest:1661 PASS/125 files.
API/web types and builds, lint, actual-browser Mermaid render, source/ownership,
codegen/migration lint, supply chain, documentation and governance all PASS.
Post-validation worktree clean; frozen protocol and manifests/locks unchanged.
Hosted run41629105026 at exact991a9ce0: PASS.
Actual validate steps include tooling, API unit/HTTP, web tests and production
build. Actual image job includes build/push, container smoke and Trivy gating;
no skipped job is relabelled as evidence.
Independent Copilot review at991a9ce0: COMMENTED, no open code issues.
It explicitly requires actual hosted artifact inspection beyond mocked tests;
it is not formal APPROVED or deployment permission.
After verifying source/base and preserving #251 draft, deliberate readiness
started study41632439081 at exact PR head991a9ce0. It completed successfully
as a diagnostic in6m47s, not release admission. Actual synthetic checkout
196000e518464c4b185f13217e308740ff57a345 has verified parents ff0b3a46/991a9ce0.
Actual image ID:
sha256:18901aded38abfabd53b0a045f765d84396af71c51fd9ad81cc5fe6645a3b648.
Read-only inspection verifies all eight .67 rounds, client Node v24.22.2,
49656 benchmark requests,32000 chronological measured values, all warmup
spans, original quota/memory, per-block66 functional/200 privacy checks,
capture, separate work deadlines and exact cleanup. Committed PS1 CRLF
checkout policy is applied exactly when matching retained source hashes.
Longer warmup does NOT establish repeatability: at1000 cycles, descriptive
same-image add p95 ratio0.808043 and remove p95 ratio1.171626 still differ
materially. Sequential treatments/tracing cannot establish causality or
convergence. The original untraced admission failure is unchanged. No
diagnostic flags are removed and no original assessor is run on these rows.
Actual image bytes are not archived or claimed as a published registry digest.
Normal prerequisite merge into held251:
0b6490f7cbc1d728fe338579d764d2e29fabb3e2.
This is integration of diagnostic tooling, not release admission.
No release or deployment admission.

Standing Rules Acknowledgment

• No em-dash (Unicode U+2014) anywhere in the diff. Verified via Select-String -Pattern ([char]0x2014).
• No git commit --amend on history that has been pushed.
• No new credentials, tokens, or secrets committed to source. Forbidden patterns regression spec at api/src/security/forbidden-source-patterns.spec.ts will catch known anti-patterns.
• Migrations are additive-only (expand-contract for column changes). Migration linter at api/src/scripts/lint-migrations.ts enforces this.

No migration change. Standing source/security gates pass in the complete
normal protected push, without amend, force, no-verify or lockfile rewrites.

Destructive Migration Override (skip if not applicable)

• This PR contains a NEW destructive Prisma migration (DROP TABLE/COLUMN, ALTER COLUMN ... TYPE, RENAME, INSERT ... SELECT FROM)
• I have set ALLOW_DESTRUCTIVE_MIGRATION=1 in the CI environment for this PR
• Justification (required if box above is ticked):

  <!-- Why this destructive change is necessary, what the rollback path is, and which release window it ships in -->
  

Reviewer Hint

Diff areas worth special attention from the reviewer:

• Exact-source build/binding preservation across both real workflow callers.
• Finite calibration ownership, source and trace preflight; request counts,
  complete raw warmup spans and cleanup under failure/deadline.
• No calibration receipt can enter ordinary qualification or native analysis.
• Read-only job authority, fixed treatment order, finite work/step/job/upload
  caps, no retry/adaptive policy and deliberate readiness allocation.
• Shared-validator caller compatibility: native fixtures now carry the actual
  client metadata, and the real native CLI rejects calibration-marked input.
• Design disposition: accepted. Reuse an existing lifecycle and extract only
  a builder with two concrete callers; no speculative experiment framework.
• Self-improvement applied: exercise every shared-validator caller and reject
  numerically compatible evidence from a different experiment explicitly.

[Copilot]

🔵 Needs a closer look

The Linux/Docker build and hosted study remain unexecuted, requiring human review of exact-tip run artifacts to verify image binding, deadline handling, artifact retention, and resource cleanup beyond mocked checks.

No open issues 🎉

What changed in this PR

Adds a bounded warmup diagnostic to investigate the stability gap holding #251, building on #264’s descriptive evidence tooling. The study does not change release admission criteria or authorize deployment; hosted execution remains pending.

Changes:

• Runs fixed 100- and 1000-cycle warmup treatments on one source-bound image, preserving resource limits, measured sample counts, evidence and cleanup.
• Shares the exact-checkout image builder and rejects calibration receipts from release assessment and native-function comparisons.
• Adds regression coverage and documents execution budgets, stop rules and interpretation limits.

File	Description
Session_starter.md	Records study preparation and the continuing release hold.
scripts/​test/​membership-warmup.test.cjs	Tests preflight guards, image binding, admission isolation and workflow bounds.
scripts/​test/​membership-v8-profile.test.cjs	Updates receipt fixtures and tests calibration rejection.
scripts/​test/​membership-performance.test.cjs	Tests both warmup counts, retained spans and invalid settings.
scripts/​test/​membership-cpu-trace.test.cjs	Tests calibration evidence validation and mismatched metadata.
scripts/​performance/​run-membership-qualification.ps1	Adds guarded calibration settings to the existing trace lifecycle.
scripts/​performance/​membership-v8-profile.cjs	Rejects calibration receipts from native comparisons.
scripts/​performance/​membership-cpu-trace.cjs	Validates fixed treatments and complete warmup spans.
scripts/​performance/​build-membership-image.ps1	Extracts the shared exact-checkout image builder.
scripts/​performance/​benchmark-membership.cjs	Supports bounded warmup selection and marks calibration receipts.
scripts/​performance/​assess-membership.cjs	Rejects calibration-marked release evidence.
docs/​strategy/​ENGINEERING_LESSONS_AND_PATTERNS.md	Documents shared-validator compatibility and experiment isolation.
docs/​ENDPOINT_SNAPSHOT_REVISION.md	Defines study design, stop rules, limitations and validation evidence.
docs/​DEPLOYMENT_INFRASTRUCTURE_AND_FORM_FACTORS.md	Documents workflow budgets and restricted authority.
docs/​CONTEXT_INSTRUCTIONS.md	Summarizes study status and deployment restrictions.
CHANGELOG.md	Records the diagnostic tooling and regression coverage.
.github/​workflows/​performance-qualification.yml	Uses the shared image builder.
.github/​workflows/​membership-warmup-diagnostic.yml	Adds the bounded two-treatment workflow and artifact retention.

_{Review effort: Balanced}