Repository navigation
Verify Pages handoff on the next justified manual official benchmark #59
Description
Current scope — 2026-09-17
Open verification follow-up; not a request for another scheduled run or a publisher redesign. The maintainer has chosen explicit official measurements after performance-relevant changes, with justified investigation/reproducibility runs by explicit request. Weekly invocation removal is tracked in #65. Publication automation and main protection are deferred separately in #52.
Use the next genuinely needed and explicitly authorized official run to verify its existing dependent Pages handoff. Do not run a benchmark solely to refresh a date, repair presentation, obtain green checks for this issue, or manufacture evidence for closing it. Do not restore a timer or make the dedicated App/result-PR proposals #63/#64 prerequisites.
The reusable handoff was implemented in #60, and the unrelated Pages release bootstrap was removed in #62. Current main 51b16dc797f2c061bb6a4fdbb9ae74b67d3b89b6 still calls pages-deploy.yml directly after audited publication. Invocation-policy work in #65 must retain this existing route and its integrity checks without choosing a new publication architecture.
Remaining verification criteria
- On the next explicitly authorized, justified official run, record the reason for measurement, trusted measured source SHA, original run ID/attempt and complete successful measurement/raw-audit evidence.
- Verify the actual atomic publication SHA, measured-source parent, exact generated manifest, immutable history, and unchanged measurement provenance. Treat stale-main rejection as safe refusal, not permission failure.
- Verify that the dependent reusable Pages build/deploy succeeds for that exact publication and that the publicly served report/history match the verified bytes. Record caller/build/deploy identities separately from the content SHA.
- Preserve failed/cancelled/skipped producer rejection, no duplicate/stale deployment, trusted-main/repository checks, current-main revalidation and read-only PR/smoke paths.
- If handoff fails after publication, use the existing exact-current-main Pages recovery path; do not remeasure just to repair display or rewrite the original report.
- Leave this issue open until actual producer-to-dependent-deployment evidence is recorded. Ordinary Pages success, fixtures and a policy decision are not substitutes for that evidence.
Explicit workflow invocation currently includes automatic audited publication and Pages. Authorization to run that workflow must account for these side effects; the decision to remove weekly invocation is not authorization for a real run now. Historical scheduled-run records remain valid; new scheduled-run experiments are no longer required under the chosen policy.
Original observation and evidence (preserved historical context)
During the authorized eight-stack rollout (#50 / #58), measurement and atomic result publication succeeded, but no downstream Pages workflow_run was observed for the publication commit. The exact published result was recovered via the existing trusted-main Pages dispatch.
- Measured source:
c8e033ea176366644f5bed5ded12cab79e6fcbeb. - Official run 34925168324, attempt 1:
workflow_dispatch, actorgithub-actions[bot], completed successfully on 2026-09-15. - Publication:
25fa3f086919f7124afe3c8d22f0791bd83768ef, the sole child of the measured source, with the seven generated publication paths. - Repeated run-list reads at the original investigation found no automatic Pages run for that publication before recovery. Source-CI Pages run
34925163861was not the new-publication deployment. - Recovery Pages run 34928391910 succeeded on the unchanged publication SHA.
- Read-only live verification 34928788012 checked served bytes and real-browser controls/history/mobile behavior.
The missing event was the observation; token-origin/chaining was a hypothesis, not a proven platform root cause. The original comments retain the investigation, approved reusable-workflow design and prior verification. Earlier references to waiting for a normally scheduled run are superseded by the policy in #65, not evidence that the original measurement was invalid.
Non-goals
No new official measurement/publication is authorized by this issue edit. Do not introduce App credentials, result-PR auto-merge, protection changes, unrelated workflow redesign, synthetic official data, history rewrites, or a recurring notification/measurement task. #59 does not block #65 or ordinary ChatGPT/Codex development.
Activity
tappe9 commentedon Sep 15, 2026
Investigation and proposed handoff design (2026-09-15)
Fresh baseline and reproduced boundary
Re-fetched main as
25fa3f086919f7124afe3c8d22f0791bd83768ef(tree2e96d151a108b4e154d01d7de614bc8774f1c3a3), open issues and PRs, the latest source CI, the official run, and the runs for the publication SHA. There are no open PRs. Source CI34924589999remains successful. Official run34925168324, attempt 1, remains successful on sourcec8e033ea176366644f5bed5ded12cab79e6fcbeb. The publication-SHA run listing still contains only the successful explicit Pages dispatch34928391910, not an automatic Pages workflow_run.Reconstructed the existing published tree in a disposable local checkout from the previously verified source bundle and actual report; its complete Git tree matches the freshly fetched main tree exactly. No repository code or published data was changed.
Using the actual completed official-run metadata and actual published report, replayed a hypothetical received workflow_run payload against the unchanged
benchmark.pages.validate_event: it is accepted. Seven negative replays (failed/cancelled upstream, wrong run ID/attempt, foreign branch, incorrect publication manifest, incorrect parent) are rejected. Existing Pages authorization tests: 7/7 passed. Existing workflow/security tests: 12/12 passed. This validates the local authorization boundary; it does not claim that GitHub delivered the missing event or that the Actions expression engine was simulated.What the platform evidence does and does not establish
[skip ci]is not a justified fix: https://docs.github.com/en/actions/how-tos/manage-workflow-runs/skip-workflow-runs34707725705failed, while the earlier scheduled run33979190013used an older source/workflow revision. Neither is a controlled reproduction of this successful bot-dispatched publication with the current Pages workflow. No new scheduled or manual official run was started for this investigation.Recommended design for maintainer approval
Prefer a reusable Pages build/deploy workflow called directly as a dependent job after successful publication, rather than adding an Actions-API dispatcher and another asynchronous handoff.
pages.ymlremains the entry point for successful main CI and explicit recovery;benchmark.ymlcalls the reusable workflow only afterpublishsucceeds. Remove Official benchmark from the separate Pages workflow_run subscription so there is only one automatic official-publication route.Alternatives: (a) a dedicated explicit-dispatch job with job-scoped actions:write, SHA-qualified receiver validation and duplicate/transport handling is viable but adds permissions and asynchronous state; (b) a broad PAT/App-token workaround or periodic polling is not recommended. Reusable-workflow context/permission rules: https://docs.github.com/en/actions/reference/workflows-and-actions/reusing-workflow-configurations . Dispatch permission requirement: https://docs.github.com/en/rest/actions/workflows#create-a-workflow-dispatch-event .
This is a proposed persistent workflow/permission arrangement, not an implemented fix or an approval claim. No branch/PR, workflow changes, deployment, new benchmark, credentials, protection changes, or result rewrites were performed in this investigation. Await the maintainer's decision on the concrete arrangement before implementing it.
tappe9 commentedon Sep 15, 2026
Approved implementation scope
The maintainer approved the reusable Pages build/deploy design proposed above, including implementation, normal CI, final review, squash merge and post-merge verification. Re-fetched baseline main:
25fa3f086919f7124afe3c8d22f0791bd83768ef(tree2e96d151a108b4e154d01d7de614bc8774f1c3a3); no open PRs, latest source CI remains successful.Implement one direct
publish -> reusable Pagesroute, preserve producer run/attempt outputs after audited publication, explicitly validate caller and target identities without spoofing GitHub context, and serialize deployments with a current-main recheck. No Actions-write permission, additional secrets, protection changes, measurement changes or result rewrites are authorized or required. The existing release bootstrap remains outside the reusable workflow for #53.No new official benchmark will be started for this change. The new official-producer-to-deployment live path must remain explicitly unverified until an authorized or normal scheduled official run exercises it. Existing published results can be used to verify post-merge ordinary Pages deployment.
fix: deploy verified results through reusable Pages workflow
fix: deploy verified results through reusable Pages workflow (#60)
tappe9 commentedon Sep 15, 2026
Implementation merged; shared Pages deployment verified
PR #60 was squash-merged as
3da76bccd66ff56e04ab199ffec2f216f1b4bdc5. Its tree is exactly the reviewed/tested4f8e5c59b0d37f13e1baad4f1716a10a7c8bc1b1. Main was re-fetched after deployment and remains on that merge commit.Delivered
The official workflow now calls local
pages-deploy.ymldirectly after successful audited publication. The ordinarypages.ymlsubscribes only to main CI and retains explicit recovery. Publisher outputs are emitted after the verified push, and the shared controller separately validates caller and current-main content identities without changing GitHub environment variables. The official path verifies original producer run/attempt, measured-source tree, sole parent, exact seven-path manifest, matching history and deterministic README/SVG contents. Build outputs retain the original artifact identity during deployment-only retries. Deployment is serialized with a new current-main verification immediately before deploy.No Actions-write permission, new credentials, protection changes, measurement changes or result rewrites were introduced. The existing release bootstrap remains outside the common workflow for #53; the post-merge release log confirms
v0.1.0 already exists; leaving it unchanged.Temporary development and transfer files are absent from the merged tree.Verification
34933306274.4f47b28b122052a7a81ce473b993797940feebc2.required, all eight real-container acceptance/shared contracts, non-publishing smoke and Axum diagnostic. Shared gates include the unfiltered benchmark suite, Python 3.10, optimized tests, syntax/security, generated-content checks and real Chrome tests.pages-deploy.ymlat the exact merge SHA.deploy / build(job104270170335) anddeploy / deploy(job104270211717) both succeeded, including real caller authorization and the lock-scoped current-main check.10382842987, namedgithub-pages-3da76bccd66ff56e04ab199ffec2f216f1b4bdc5-34934757815-1; ZIP SHA-2567574c8fa7ebbe64ab468ab6e1eefa9d4ccb08f17b7c9606d6d7664f371976d25verified. All 10 contained files match an independent rebuild byte-for-byte, including all three historical reports and the index.34925168324/ attempt 1, measured sourcec8e033ea176366644f5bed5ded12cab79e6fcbeb, selected JSON SHA-25615f22d39e3b1ab7b73e61effdbaec378767845889ae6ab969cb631c11393e82d. No new official measurement or result publication was initiated.Remaining live verification
Keep this issue open. The new complete official producer -> dependent reusable deployment path has not yet run with a new real official publication. The ordinary CI route verified above is not a substitute for that evidence. A normally scheduled or separately authorized official run should record the original producer source/run/attempt, actual publication SHA and dependent build/deploy job IDs, then verify the served result identity. No extra benchmark is authorized merely by this comment.
The platform-internal cause of the former missing completion event remains unproven; this change removes that asynchronous event dependency rather than asserting an unsupported root cause. Final self-review is recorded on the PR; no independent reviewer approval is claimed.
tappe9 commentedon Sep 15, 2026
Supplementary post-merge live verification
Continued from merged PR #60 without duplicating the implementation or starting another official benchmark. Re-fetched main after verification:
3da76bccd66ff56e04ab199ffec2f216f1b4bdc5, tree4f8e5c59b0d37f13e1baad4f1716a10a7c8bc1b1. The previous post-merge note's direct-web limitation is now supplemented by a fresh HTTP check from a read-only GitHub-hosted verification job.requiredaggregate.pages-deploy.ymlat the merge SHA. Both reusable build and deploy jobs succeeded; the existing release bootstrap explicitly left v0.1.0 unchanged.make test-siteincluding real Chrome, README generation, unchanged results, and a clean tracked tree.2026-09-15T05:57:16.534099+00:00, all 9 publicly served files returned HTTP 200 and matched an independent build byte-for-byte. No cache-busting query was required. The build-only.nojekyllmarker is excluded from this HTTP count.10382842987, ZIP SHA-2567574c8fa7ebbe64ab468ab6e1eefa9d4ccb08f17b7c9606d6d7664f371976d25) and the verification evidence (10382752257, ZIP SHA-256eee38ccb9f7af58d52ce3f478ca36d2a9cebae54f43d7cb45fe9586de6db8a89). All 10 deployed files match the verification build AND the preceding verified eight-stack publication, including all historical reports. Verified the exported Git bundle's actual head/tree against the freshly fetched merge identity.15f22d39e3b1ab7b73e61effdbaec378767845889ae6ab969cb631c11393e82d, measured by official run34925168324from sourcec8e033ea176366644f5bed5ded12cab79e6fcbeb. No measurement or historical value changed.The temporary
verify-pages-handoff-60.ymlused onlycontents: read, never entered main, and was removed from its owned operations branch after success. Cleanup commitf76ec2c638cffdc89f4800b340f392eec2ecb0a8has zero file differences from the merge baseline.Keep #59 open for the already documented remaining boundary: a new real official producer -> direct dependent reusable deployment has not yet run. Normal CI-triggered Pages, fixture tests and these public HTTP checks are not a substitute for that official end-to-end evidence. No extra official measurement is authorized or requested by this verification note.
docs: align roadmap and separate releases from Pages
docs: align roadmap and separate releases from Pages (#62)
[-]Investigate missing Pages handoff after a bot-dispatched official benchmark[/-][+]Verify Pages handoff on the next justified manual official benchmark[/+]tappe9 commentedon Sep 27, 2026
Authorized official run — pending dispatch (2026-09-28)
The maintainer explicitly requested a manual official benchmark and publication of the new verified results in the current ChatGPT conversation. The reason is the performance-relevant Flask/Waitress -> Gunicorn gthread change merged in #77, not merely refreshing the report date or closing this issue.
Verified preparation
c1d8e81b959e2c0ee0e5c4a1d8a7491790479f93(includes fix: run Flask with Gunicorn gthread #77 and docs: align implementation guides with registry and published results #78).benchmark/implementations.jsonstill selectseight-stack-v1. Java remains registered/CI-covered but outside the official cohorts. No cohort, profile, runtime or workflow change is part of this operation.benchmark.ymlalready performsmeasure -> audited atomic publish -> dependent reusable Pages. The maintainer's request includes these publication side effects; do not introduce a separate publisher or change permissions.Execution limitation — not a failed benchmark
No dispatch request has been sent and no new run ID exists from this session. The available GitHub connector exposes run inspection and job retries but no new
workflow_dispatchaction. The local execution environment has noghexecutable, no configured GitHub token/credential helper, and cannot resolveapi.github.com. This is a tool/runtime capability limitation, not evidence that GitHub rejected the maintainer's authorization or that repository permissions are broken. Do not rerun the old Waitress workflow as a substitute for measuring current main.The intended existing-workflow invocation from an authenticated GitHub CLI is:
Refresh main and check for an already-started equivalent run immediately before dispatch to avoid duplicate measurements. The observed SHA above is preparation evidence, not a reason to force or reset main.
Closure remains pending
Keep #59 open until the actual measured source, original run/attempt, complete measurement/raw audit, atomic publication SHA/parent/manifest, preserved history, dependent Pages identities and publicly served report/history byte equality are verified. Deployment success alone is insufficient for the served-byte criterion. If only Pages fails after publication, use the existing exact-current-main recovery path rather than remeasure. #52 remains deferred.
No benchmark results, repository files, workflow behavior, settings, release/tag or permissions were changed by this preparation.
tappe9 commentedon Sep 27, 2026
Authorized official run started — 2026-09-28
The maintainer manually dispatched the authorized official benchmark after the Flask/Gunicorn production change.
workflow_dispatchc1d8e81b959e2c0ee0e5c4a1d8a7491790479f93maintappe9measureis in progress.This is the justified run reserved by this issue. Keep #59 open until measurement/raw audit, atomic publication SHA and parent/manifest, immutable history, dependent reusable Pages deployment, and publicly served report/history byte equality are verified. Do not start another official measurement merely to complete those post-publication checks.
tappe9 commentedon Sep 30, 2026
Official producer → dependent Pages verified (2026-09-30)
The authorized Flask/Waitress → Gunicorn gthread measurement after #77 now supplies the outstanding live evidence. No new measurement or deployment was started for this audit.
workflow_dispatch, actortappe9, completed successfully at 2026-09-28 00:35:48 UTC. Trusted measured source:c1d8e81b959e2c0ee0e5c4a1d8a7491790479f93, treef58353952da6e3e1d773f38a9192e3dbab47b2e0. The eight-stack cohort is unchanged.814601d1d939b87179ef3630d783bcc566fe6082a5d3c588d12f716ecc0fd150against GitHub's digest, and reran the unchanged report validator/raw audit over all 72 measured runs and memory samples. Artifact selected JSON equals published latest/history bytes exactly.README.md,README.ja.md,results/latest.json,results/charts/{cpu,json,postgresql}-throughput.svg, andresults/history/2026-09-28T00-35-06Z-36360016510-1.json. Both READMEs and all three charts match deterministic generation; all three pre-existing history reports remain byte-identical. Source/run/attempt provenance is unchanged. Fresh remote-main recheck still returns this publication.pages-deploy.ymlat the measured source. Both logs independently verify current-main content5308aba…. Build artifactgithub-pages-5308aba701608f221228b7b0a3a2b30de9baaba5-36360016510-1/ ID10946550232is the artifact submitted by deploy. GitHub's caller SHA andpages_build_versionarec1d8e81…; they are distinct from the verified content SHA5308aba…..nojekyllmarker is excluded. Latest report and new history both have SHA-25616d9979311370a4c3178e5b8f9f5e5ea6c08ce291ec6f65eda0ebf6d4f566060.No recovery was needed. Repository code, reports, cohorts, history, workflows and permissions were not changed by this audit. The actual producer-to-dependent-deployment and served-byte criteria are now met; closing #59 as completed.