Archive shipped performance specs: batch 4

docs/development/performance.md

@@ -792,7 +792,7 @@ and the identical-scope verifier confirmed a 69.945% improvement. A second
 micro-optimization improved the largest case by only 8.863% and regressed the
 smallest by 4.079%; it was reverted after the verifier returned inconclusive.
 See the active OpenSpec
-[qualification](../../openspec/changes/add-scaled-parsing-challenge/qualification.md)
+[qualification](../../openspec/changes/archive/2026-08-15-add-scaled-parsing-challenge/qualification.md)
 for the complete evidence and limitations.
 
 The challenge is not an official submission and does not claim one- or

openspec/specs/cross-runtime-scaled-parsing/spec.md

@@ -0,0 +1,53 @@
+# cross-runtime-scaled-parsing Specification
+
+## Purpose
+Provide comparable, bounded-memory Node and Go parsing workloads that let an
+agent distinguish algorithm, parallelism, runtime, and machine effects using
+the same deterministic file and correctness contract.
+## Requirements
+### Requirement: File-backed workloads share one correctness contract
+The challenge SHALL generate a deterministic file whose row grammar and output
+semantics match the documented 1BRC contract. Every runtime and execution
+variant MUST process the same identified file and produce the same exact result
+digest before performance evidence is accepted.
+
+#### Scenario: Runtime variants process a qualified input
+- **WHEN** Node and Go variants execute a comparison campaign
+- **THEN** every receipt identifies the same input bytes, row count, and digest
+- **AND** any result mismatch invalidates that variant's performance result
+
+### Requirement: Default execution uses bounded memory and storage
+Every default challenge variant SHALL process input incrementally without
+loading the complete file as a decoded string. The default campaign MUST enforce
+documented row, byte, duration, and worker bounds and remove generated data after
+the campaign unless retention was explicitly requested.
+
+#### Scenario: Agent runs the default campaign
+- **WHEN** no large-run opt-in is supplied
+- **THEN** the campaign stays within its documented laptop-safe bounds
+- **AND** does not invoke a network, cloud service, production database, or deployment
+
+#### Scenario: Agent requests one billion rows
+- **WHEN** the requested input exceeds the default storage or duration bound
+- **THEN** the runner refuses before generation unless explicit large-run authorization and sufficient local capacity are recorded
+
+### Requirement: Parallel variants preserve independent aggregation
+The Node and Go parallel variants SHALL partition only at complete row
+boundaries, maintain worker-local aggregates, and merge after parsing. Worker
+count MUST be recorded and bounded independently of the host's reported logical
+CPU count.
+
+#### Scenario: Parallel and sequential results are compared
+- **WHEN** the same qualified input is processed with one and multiple workers
+- **THEN** both produce the identical result digest
+- **AND** the receipt records worker count, wall time, throughput, and peak memory
+
+### Requirement: Cross-runtime conclusions use paired evidence
+The challenge SHALL report observed Node and Go results separately from inferred
+language or leaderboard conclusions. A runtime comparison MUST use the same
+machine, input identity, worker bound, cache-state policy, and timing boundary.
+
+#### Scenario: Agent asks whether language caused a performance gap
+- **WHEN** compatible Node and Go receipts exist from the same campaign
+- **THEN** the report attributes only the measured paired difference to runtime and implementation together
+- **AND** labels unmeasured language-ceiling or cross-machine claims as unverified

openspec/specs/local-performance-governance/spec.md

@@ -4,9 +4,7 @@
 
 Define reproducible local IPC and disk measurements plus reversible,
 evidence-gated cache consolidation.
-
 ## Requirements
-
 ### Requirement: Dashboard and cache performance is reproducibly measured
 CodeVetter SHALL provide a repository-owned qualification that measures bounded
 p50, p95, maximum latency, result bytes, and error state for dashboard IPC paths
@@ -32,3 +30,26 @@ duplicate evidence, a reversible plan, and before/after receipts.
 - **WHEN** profiling does not show a dashboard IPC or TypeScript/Rust boundary exceeding its budget
 - **THEN** CodeVetter records no service rewrite recommendation
 - **AND** does not add another runtime
+
+### Requirement: External-frontier comparisons are qualified
+CodeVetter SHALL NOT express proximity to an external performance frontier as a
+direct measured gap unless the local and external results share compatible
+input, correctness, timing, resource, and machine conditions. Otherwise it MUST
+identify the arithmetic as an extrapolation and enumerate the incompatible
+conditions.
+
+#### Scenario: Local bounded parser is compared with the 1BRC leaderboard
+- **WHEN** the local result excludes file I/O, uses fewer rows, or runs on different hardware
+- **THEN** CodeVetter labels any projected multiplier as non-comparable
+- **AND** reports the missing end-to-end evidence needed for a direct claim
+
+### Requirement: Large local campaigns require resource qualification
+Before a performance campaign generates or retains a materially large fixture,
+CodeVetter SHALL calculate the requested bytes, confirm available local space,
+record the retention policy, and require explicit authorization above the
+documented default bound.
+
+#### Scenario: Requested fixture is approximately 12 GB
+- **WHEN** an agent requests a full one-billion-row challenge
+- **THEN** CodeVetter does not generate the fixture under default settings
+- **AND** reports the expected local storage and authorization requirement

openspec/specs/scaled-runtime-challenges/spec.md

@@ -0,0 +1,62 @@
+# scaled-runtime-challenges Specification
+
+## Purpose
+TBD - created by archiving change add-scaled-parsing-challenge. Update Purpose after archive.
+## Requirements
+### Requirement: Deterministic parsing challenge
+
+CodeVetter SHALL provide a repository-owned parsing challenge with fixed input
+identity, exact row counts, and no external dependencies.
+
+#### Scenario: Challenge runs locally
+- **WHEN** an agent executes the temperature aggregation challenge
+- **THEN** every input row is generated deterministically in memory and no network, database, cloud service, or persistent generated dataset is used
+
+#### Scenario: Challenge spans representative scales
+- **WHEN** the scale workload completes
+- **THEN** it emits at least three positive `ms/op` measurements whose largest row count is at least 40 times the smallest
+
+### Requirement: Correctness before performance
+
+Every measured parser result MUST match count, minimum, maximum, sum, and a
+stable complete aggregate digest.
+
+#### Scenario: Candidate parser drops or changes data
+- **WHEN** any aggregate differs from the independently derived expected result
+- **THEN** the test fails before emitting a successful benchmark metric line and CodeVetter cannot confirm the optimization
+
+### Requirement: Official task compatibility
+
+The artifact MUST preserve the official 1BRC row and output semantics while
+identifying its Node and bounded-execution differences.
+
+#### Scenario: Valid challenge rows are aggregated
+- **WHEN** rows contain variable UTF-8 station names and signed one-decimal temperatures within the official bounds
+- **THEN** the artifact emits stations alphabetically with minimum, round-toward-positive mean, and maximum values to one decimal place
+
+#### Scenario: An agent inspects artifact provenance
+- **WHEN** the benchmark is used as CodeVetter evidence
+- **THEN** the repository identifies the upstream challenge and license and does not claim an official submission or unexecuted billion-row result
+
+### Requirement: Evidence-led iteration
+
+The initial parser SHALL be captured before optimization, and each candidate
+change SHALL be evaluated against the identical adapter, target, exact test
+name, input sizes, units, and correctness contract.
+
+#### Scenario: Runtime evidence selects a parser candidate
+- **WHEN** the baseline produces a scale curve and repository-owned CPU evidence
+- **THEN** CodeVetter reports observed measurements separately from its inferred candidate and supplies an identical-scope verification action
+
+#### Scenario: Candidate is faster at representative scale
+- **WHEN** the same workload reruns after one implementation change
+- **THEN** CodeVetter reports the measured per-size deltas and confirms only when the largest-input improvement crosses policy without a material smaller-input regression
+
+### Requirement: Bounded claims
+
+The challenge MUST distinguish measured local evidence from extrapolation to
+billion-row datasets.
+
+#### Scenario: Local benchmark completes
+- **WHEN** CodeVetter records bounded row counts and durations
+- **THEN** the qualification identifies those exact counts and MUST NOT claim an unexecuted nine-billion-row completion time, memory bound, or production throughput

openspec/specs/verification-receipt-comparison/spec.md

@@ -0,0 +1,130 @@
+# verification-receipt-comparison Specification
+
+## Purpose
+Define deterministic ingestion and comparison of project-owned verification
+receipts so agents can evaluate correctness, performance, and changed-test
+blast radius without replacing the project's own test runner.
+## Requirements
+### Requirement: Receipt ingestion is closed, bounded, and immutable
+CodeVetter SHALL accept only a versioned closed receipt containing repository
+and revision identity, runner profile, environment identity, selection,
+attempts, terminal outcomes, resource measurements, safety observations, and
+explicit budgets. It MUST reject unknown fields, unsupported versions,
+credential-shaped content, unsafe paths, inconsistent totals, duplicate
+identities, and evidence beyond recorded bounds. Ingestion MUST leave the
+source receipt unchanged and bind the normalized bundle to its exact SHA-256
+identity.
+
+#### Scenario: Valid receipt is ingested twice
+- **WHEN** the same valid receipt bytes are ingested with the same repository scope
+- **THEN** CodeVetter emits byte-equivalent normalized bundles with the same source receipt identity and verdict
+
+#### Scenario: Receipt contains undeclared data
+- **WHEN** a receipt contains an unknown field, credential-shaped value, absolute path, or repository escape
+- **THEN** CodeVetter rejects it before emitting a qualified bundle
+
+### Requirement: Correctness and performance verdicts remain independent
+Every normalized bundle SHALL report correctness, performance, safety, and
+overall qualification separately. A passing test outcome MUST NOT hide a
+performance-budget failure, and a performance improvement MUST NOT hide a test
+failure, incomplete inventory, live-network escape, fixed wait, or missing
+required evidence.
+
+#### Scenario: Tests pass but resource budget fails
+- **WHEN** all terminal tests pass and peak RSS exceeds the declared maximum
+- **THEN** correctness is `passed`, performance is `failed`, and the overall bundle is `failed`
+
+#### Scenario: Required evidence is unavailable
+- **WHEN** a declared budget cannot be evaluated because its measurement is missing
+- **THEN** the corresponding verdict and overall qualification are `no_confidence`
+
+#### Scenario: No performance or safety budget is configured
+- **WHEN** every metric in a verdict component is unconfigured
+- **THEN** that component is `no_confidence` rather than a vacuous pass
+
+### Requirement: Receipt comparison qualifies evidence compatibility
+CodeVetter SHALL compare only receipts with compatible schema, repository,
+runner profile, environment, and inventory identities. It MUST label evidence
+as `same_commit`, `cross_commit`, or `incompatible`; cross-commit evidence MAY
+report observed deltas but MUST NOT be presented as a controlled same-commit
+speedup. Comparisons SHALL preserve raw values, absolute deltas, percentage
+deltas, sample counts, and declared budget policies.
+
+#### Scenario: Same-commit receipts are compared
+- **WHEN** baseline and current receipts share the exact commit and all compatibility identities
+- **THEN** CodeVetter emits qualified performance and failure-set deltas labeled `same_commit`
+
+#### Scenario: Compatible commits differ
+- **WHEN** compatible baseline and current receipts differ only by revision
+- **THEN** CodeVetter labels the comparison `cross_commit`, reports directional deltas, and records the limitation
+
+#### Scenario: Runner profiles differ
+- **WHEN** baseline and current receipts use different runner, environment, or inventory identities
+- **THEN** CodeVetter emits `incompatible` and makes no regression or improvement claim
+
+### Requirement: Failure and inventory changes use a deterministic taxonomy
+Comparison SHALL classify new, recovered, stable, and transiently recovered
+failures by stable signature. It SHALL separately classify incomplete
+inventory, inventory drift, selector widening, selector narrowing, fixed waits,
+live-network escapes, retries, timeouts, and operational failures. Operational
+failures MUST remain outside the successful-test denominator.
+
+#### Scenario: Failed attempt passes on bounded recheck
+- **WHEN** an executed test fails and a later declared recheck passes with the same test identity
+- **THEN** CodeVetter classifies it as `transient_recovery` rather than a stable pass or stable failure
+
+#### Scenario: Selected inventory silently narrows
+- **WHEN** the current receipt omits tests present in a compatible baseline without declaring an allowed selector change
+- **THEN** CodeVetter reports `unsafe_selector_narrowing` independently of executed-test outcomes
+
+### Requirement: Blast-radius evidence is explicit and bounded
+Every qualified bundle SHALL emit a machine-readable graph derived only from
+declared changed files, selection reasons, executed tests, and failure
+signatures. Edges SHALL identify their evidence kind and MUST NOT infer source
+dependencies that the receipt did not declare. Unknown or truncated selection
+relationships SHALL remain limitations.
+
+#### Scenario: Changed file selects a failing test
+- **WHEN** a receipt declares that a changed file selected a test which emitted a failure signature
+- **THEN** the graph connects changed file to selected test to failure signature with observed evidence labels
+
+#### Scenario: Selection reason is absent
+- **WHEN** an executed test has no declared changed-file selection relationship
+- **THEN** the test remains in the graph without a fabricated changed-file edge and the bundle records the missing explanation
+
+### Requirement: CLI and MCP expose the same pure operations
+The machine CLI and repository-scoped read-only MCP process SHALL call the same
+ingestion and comparison implementation and return the same normalized bundle.
+Inputs MUST be repository-relative bounded receipt paths. MCP calls MUST NOT
+execute tests, accept shell commands, modify the target repository, switch
+repository scope, or write bundles implicitly.
+
+#### Scenario: CLI and MCP ingest the same receipt
+- **WHEN** both transports ingest the same repository-relative receipt
+- **THEN** their normalized bundle documents are semantically identical
+
+#### Scenario: MCP input escapes its repository
+- **WHEN** an MCP call supplies an absolute path, traversal, or escaping symlink
+- **THEN** the process rejects the call before reading the receipt
+
+### Requirement: Real-project claims preserve provenance and limitations
+Qualification SHALL include hermetic receipts and at least one real
+project-runner receipt with exact revision, environment, inventory, and
+measurement provenance. Any cross-commit, single-sample, incomplete resource,
+or partial process-tree evidence MUST remain explicit and MUST bound published
+claims.
+
+#### Scenario: Existing runner receipt has partial RSS evidence
+- **WHEN** qualification ingests a receipt whose RSS metric excludes part of the process tree
+- **THEN** the bundle retains the measurement and limitation without claiming total process-tree memory
+
+### Requirement: Bounded producer-native receipts preserve authority
+CodeVetter MAY adapt an explicitly recognized producer-native receipt into the
+canonical contract. The adapter MUST bind the canonical bundle to the raw
+source SHA-256, reject unsupported formats, omit producer-only sensitive or
+machine-local fields, and preserve missing inventory, measurements, budgets,
+or execution evidence as `no_confidence`.
+
+#### Scenario: Producer fails before test execution
+- **WHEN** a recognized producer-native receipt records a setup failure but no test inventory or attempts
+- **THEN** CodeVetter emits an operational failure with missing evidence and makes no correctness, performance, safety, or inventory pass claim