mirror of https://github.com/bdbrown4/peltier.io.git synced 2026-11-07 10:58:28 +00:00

Files

T

Claude 52089c0451 bench: GitHub Actions CI — trust-layer checks, no-net gates, runner calibration

Closes the CI-reachable slice of the Phase 1 infra gaps:
- trust-layer job: cargo test + clippy -D warnings + fmt
- target-gates-no-net: fetches pinned targets (new targets/fetch.sh),
  regenerates + verifies corpora, runs 'just gates tokei'
  mechanically, and executes the bench workload inside a
  --network=none container (SPEC 3.1/10 no-net requirement)
- runner-calibration (informational): A/A + injection harness measures
  the shared runner's noise floor per run, evidence uploaded as an
  artifact — environments are judged empirically, not assumed
- perf-probe (informational): reports which perf event sources work

docs/infra.md maps each remaining hardware requirement (pinned cores,
governor/SMT control, separate-uid trust layer) to the bench-metal
self-hosted runner setup a human can complete in ~15 min.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcKPWQ3MQD4NdEHwar96u2

2026-07-07 00:13:21 +00:00

2.1 KiB

Raw Blame History

Bench infrastructure — what Phase 1 still needs from hardware

The trust layer is code-complete for Phase 1 (calibration, gates, verdict, agent IPC), but SPEC-grade bench numbers need hardware this repo's CI cannot provide. Status by requirement:

Requirement (SPEC §3.1/§10)	GH-hosted runner	This repo's answer
No-network target execution	✅ docker `--network=none`	`target-gates-no-net` CI job
Gates run mechanically	✅	`just gates` in CI
Environment noise measured	✅ (measured, likely fails bars)	`runner-calibration` CI job, artifact per run
Profiling	⚠️ software `cpu-clock` only (VM PMU usually absent)	`perf-probe` CI job reports what works
Pinned cores, governor, SMT/turbo control	❌ shared VM	bench-metal box (below)
Separate-uid read-only trust layer	❌	bench-metal box setup

The bench-metal box (human setup, ~15 min + account)

Any dedicated bare-metal server works; the budget default is a Hetzner AX-line dedicated server (other options: OVH/Equinix Metal/AWS *.metal). Setup:

Ubuntu LTS; apt install linux-tools-$(uname -r) docker.io git build-essential.
Measurement discipline: cpupower frequency-set -g performance; disable SMT (echo off > /sys/devices/system/cpu/smt/control) and turbo; reserve two cores via isolcpus= kernel arg; set pin_prefix in config/accept.toml to those cores.
Register as a GitHub self-hosted runner with label bench-metal (repo Settings → Actions → Runners). Run the runner as an unprivileged user; make crates/, config/, corpora/ owned by a different user (this is the separate-uid enforcement from SPEC §10).
First act: just calibrate <real workload> results/calibration/bench-metal-01.json — the box is only trusted after its own A/A + injection evidence is committed. Then flip verdict bench jobs to runs-on: bench-metal.

Until that box exists, verdict-grade benches keep running wherever a human has verified calibration evidence first (as done for this container in results/calibration/).

2.1 KiB Raw Blame History

Bench infrastructure — what Phase 1 still needs from hardware

The bench-metal box (human setup, ~15 min + account)

2.1 KiB

Raw Blame History