Skip to content

feat(xtest): measure two to four benchmark arms against a reference - #658

Draft
dmihalcik-virtru wants to merge 1 commit into
DSPX-4372-s3-arm-tuplefrom
DSPX-4372-s3-multi-arm
Draft

dmihalcik-virtru wants to merge 1 commit into
DSPX-4372-s3-arm-tuplefrom
DSPX-4372-s3-multi-arm

Conversation

@dmihalcik-virtru

@dmihalcik-virtru dmihalcik-virtru commented Oct 19, 2026 •

Copy link
Copy Markdown
Member

Part 3b of the DSPX-4372-t1 plan. Stacked on #669, which is based on main. Converting the runner and report to a tuple of arms moved out to #669; pytest reading the installation manifest moved out to #670.

What it does

--bench-refs go@v0.29.0,go@main,go@my-branch measures 2 to 4 builds of one SDK in the same randomized rounds. The first build is the reference, and each other build is gated against it. --bench-baseline/--bench-candidate still work, as the two-arm form of the same validated request, and mixing the forms is an error. Comparing candidates with each other is stage 4 (#659).

  • config: MAX_ARM_COUNT is 4. parse_refs and requested_arms build the ordered request. budget_seconds scales the default budget by K/2 and takes an explicit budget as given.
  • fixtures: select_arms resolves named arms in order and rejects two that resolve to one build. Comparability and the pinned target mode are checked across every arm, every decrypt arm reads one reference-made ciphertext, and the control runs K copies of the reference.
  • conftest: --bench-refs is validated before the session starts, with the other options, and the disk check counts the run's arms.

Compatibility

  • Existing two-arm invocations behave as before.

Validation

  • uv run pytest test_bench_*.py: 281 passed. ruff, ruff format and pyright are clean.
  • Tests cover ref parsing and refusal (count, duplicates, mixed SDKs), the baseline/candidate adapter, budget scaling, configure-time validation of --bench-refs, named-arm resolution, and build_arms at 2, 3 and 4 arms with a release as the reference.
  • Not yet run: the plan's live local multi-arm smoke run against a platform.

Stack (DSPX-4372-t1 plan)

Two parallel tracks from main; they share no imports and meet in stage 5.

Part PR Base
2a: bare-repo and js install fixes #667 main
2b: manifest contract #668 2a
2c: install benchmark #626 2b
2d: otdf-local env exports #642 2c
3a: arms as a tuple #669 main
3b: two to four arms #658 (this PR) 3a
3c: pytest reads the manifest #670 3b
4: candidate-to-candidate conclusions #659 3c
5, 6: CI and report #660, #661 not yet moved onto these stacks

@coderabbitai

coderabbitai Bot commented Oct 19, 2026

Copy link
Copy Markdown

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

  • Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

--bench-refs names 2 to 4 builds of one SDK, reference first; every other
arm is a candidate compared against it and can fail the run. The
existing --bench-baseline/--bench-candidate pair is a two-arm adapter
onto the same validated request, and mixing the forms is an error.

- config: MAX_ARM_COUNT is 4. parse_refs and requested_arms produce the
  ordered request; budget_seconds scales the default budget by K/2, so a
  K-arm run is about as precise as the two-arm run the default was chosen
  for, and an explicit budget is taken as given.
- fixtures: select_arms resolves named arms in order and rejects two that
  resolve to one build. BenchArms is a tuple with a reference.
  Comparability and the pinned target mode are checked across every arm,
  every decrypt arm reads one reference-made ciphertext, and the control
  runs K copies of the reference -- the last arm in a K-arm round drifts
  further from the first than an adjacent pair does, so a two-arm control
  would understate the noise.
- conftest: --bench-refs is validated before the session starts with the
  rest of the options, and the disk check counts the run's arms.

Part 3b of the DSPX-4372-t1 plan.

Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com>
@dmihalcik-virtru
dmihalcik-virtru changed the base branch from DSPX-4372-s2-bench-env to DSPX-4372-s3-arm-tuple October 21, 2026 12:33
@github-actions

Copy link
Copy Markdown

X-Test Failure Report

@sonarqubecloud

Copy link
Copy Markdown

dmihalcik-virtru added a commit that referenced this pull request Oct 23, 2026
…pted js installs (#667)

Part 2a of the [DSPX-4372-t1
plan](#657), split out of #626:
fixes the benchmark needs, which every `otdf-sdk-mgr` install benefits
from. **Based on `main`.**

### What it does
- **Bare repos refresh their branches.** `git clone --bare` records no
fetch refspec, so the `fetch --all --tags` before every checkout
refreshed tags only. Every branch stayed where the first clone found it,
and `install tip main` or `--platform main` built that stale commit.
`checkout.BARE_REFRESH` now fetches origin's branches into
`refs/remotes/origin/*` with `--prune`, for the SDK and platform bare
repos alike, and `checkout.upstream_ref` maps a branch name onto them.
Fetching into the bare repo's own `refs/heads/*` instead would move
branches that other worktrees have checked out, leaving their HEAD ahead
of their files, and would fail for good once upstream replaced a branch
`foo` with `foo/bar`.
- **Worktrees are detached** and reset to the refreshed ref. A branch
origin no longer has is refused rather than built from the clone's stale
copy, and `HEAD` means origin's default branch as of the clone; a
platform `HEAD` worktree used to reset to itself.
- **Go source rebuilds work a second time.** `checkout_go_from_platform`
reset an existing worktree to a `FETCH_HEAD` fetched into the bare repo,
which no worktree can see, so every rebuild after the first failed with
`pathspec 'FETCH_HEAD' did not match`. It now resets to the refreshed
ref, like the SDK and platform paths.
- **`install tip` reports checkout failures as errors.** A refused
branch, or a failed git command with git's stderr, now prints `Error: …`
and exits 1 for go, js and java, as the platform path already did,
instead of a traceback.
- **An interrupted js install leaves nothing behind.** #663 already
removes a partial `dist/` when npm fails. A Ctrl-C mid-install still
left a directory holding only `cli.sh`, which `install_release` then
skipped as installed from then on. Both js install paths now remove it
unless the install finished.
- `AGENTS.md` claimed the bare clone mapped `refs/heads/*`, which is
what hid the first bug. It and the code comments also said `git pull`
fails in a worktree; it merges origin's default branch into whatever is
checked out.

### Validation
- `uv run pytest` in `otdf-sdk-mgr`: 207 passed, and 321 at the top of
this track (#642). ruff, ruff format and pyright are clean.
- `test_checkout.py` runs real git against a local origin. Every shared
behaviour is parametrized over the SDK, go and platform entry points:
new and existing worktrees follow their branch, `HEAD` (including beside
a tag named `main`), a deleted branch is refused, tags and SHAs are
checked out and then reused, and a force-pushed `refs/pull/N/head` is
followed. This replaces the stubbed command-string test for platform PR
refs. SDK-only tests guard other worktrees, force pushes and `x` → `x/y`
renames; platform-only tests cover the helper-scripts worktree. A
`CliRunner` test covers the `install tip` error path.
- Mutation-checked: `symbolic-ref --short`, treating every non-origin
name as a deleted branch, dropping go's explicit PR-ref fetch or its
`+`, swallowing go's refusal, and dropping the `install tip` catch each
fail a test.
- Two new tests interrupt each js install path.
- `isolated_git` keeps those tests off the developer's git config, any
inherited `GIT_DIR`, and the network (`GIT_ALLOW_PROTOCOL=file`).

### Follow-ups
Older problems found while reviewing this PR are fixed in a stack of
drafts based on it: #673 (don't reset a directory that isn't a worktree)
→ #674 (branch names vs versions) → #675 (tags moved upstream) → #676
(`checkout go` / `--all`).

### Stack ([DSPX-4372-t1
plan](#657))

Two parallel tracks from `main`; they share no imports and meet in stage
5.

| Part | PR | Base |
|---|---|---|
| 2a: bare-repo and js install fixes | **#667 (this PR)** | `main` |
| 2b: manifest contract | #668 | 2a |
| 2c: `install benchmark` | #626 | 2b |
| 2d: `otdf-local env` exports | #642 | 2c |
| 3a: arms as a tuple | #669 | `main` |
| 3b: two to four arms | #658 | 3a |
| 3c: pytest reads the manifest | #670 | 3b |
| 4: candidate-to-candidate conclusions | #659 | 3c |
| 5, 6: CI and report | #660, #661 | not yet moved onto these stacks |



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

<!-- coderabbit-ai-generated:v1 -->

## Summary by CodeRabbit

* **Bug Fixes**
* SDK and platform worktrees now follow updated branches and pull
request refs, including after force-pushes. Missing branches produce a
clear error instead of a traceback.
* Interrupted JavaScript installations no longer leave partial
distribution files behind.

* **Documentation**
* Updated platform installation guidance for branch refreshes, detached
worktrees, and pull request refs.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant