test(integration): measure authenticated delivery status p95

apps/integration-service/migrations/0012_plugin_operator_context_replay_consume.sql

@@ -0,0 +1,47 @@
+CREATE OR REPLACE FUNCTION plugin_integration.consume_plugin_operator_context_replay(
+    p_evidence_id uuid,
+    p_consumed_at timestamptz,
+    p_expires_at timestamptz
+)
+RETURNS boolean
+LANGUAGE plpgsql
+AS $$
+DECLARE
+    consumed_evidence_id uuid;
+BEGIN
+    INSERT INTO plugin_integration.plugin_operator_context_replay_record (
+        evidence_id,
+        consumed_at,
+        expires_at
+    ) VALUES (
+        p_evidence_id,
+        p_consumed_at,
+        p_expires_at
+    )
+    ON CONFLICT (evidence_id) DO UPDATE
+    SET consumed_at = EXCLUDED.consumed_at,
+        expires_at = EXCLUDED.expires_at
+    WHERE plugin_integration.plugin_operator_context_replay_record.expires_at < now()
+    RETURNING evidence_id INTO consumed_evidence_id;
+
+    IF consumed_evidence_id IS NULL THEN
+        RETURN false;
+    END IF;
+
+    DELETE FROM plugin_integration.plugin_operator_context_replay_record AS replay_record
+    WHERE replay_record.evidence_id IN (
+        SELECT expired_record.evidence_id
+        FROM plugin_integration.plugin_operator_context_replay_record AS expired_record
+        WHERE expired_record.expires_at < now()
+          AND expired_record.evidence_id <> p_evidence_id
+        ORDER BY expired_record.expires_at
+        FOR UPDATE SKIP LOCKED
+        LIMIT 32
+    );
+
+    RETURN true;
+END;
+$$;
+
+COMMENT ON FUNCTION plugin_integration.consume_plugin_operator_context_replay(uuid, timestamptz, timestamptz) IS
+    'Atomically consumes one Plugin operator evidence identity and performs bounded post-consume expiry cleanup in the same PostgreSQL round trip.';

apps/integration-service/perf/generate-plugin-delivery-status-authority.mjs

@@ -0,0 +1,65 @@
+import { createHmac, randomUUID } from 'node:crypto';
+import { writeFile } from 'node:fs/promises';
+
+const DEFAULT_ITERATIONS = 1000;
+const MAX_ITERATIONS = 10000;
+const WORKSPACE_ID = '11111111-1111-4111-8111-111111111111';
+const USER_ID = '22222222-2222-4222-8222-222222222222';
+const DELIVERY_ID = '33333333-3333-4333-8333-333333333333';
+const PATH = `/v1/plugins/delivery-attempts/${DELIVERY_ID}`;
+
+function fail(message) {
+  throw new Error(message);
+}
+
+function iterations(value) {
+  const parsed = value === undefined ? DEFAULT_ITERATIONS : Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < 1 || parsed > MAX_ITERATIONS) {
+    return fail('K6_ITERATIONS must be an integer between 1 and 10000');
+  }
+  return parsed;
+}
+
+function secret(value) {
+  if (typeof value !== 'string' || Buffer.byteLength(value, 'utf8') < 32) {
+    return fail(
+      'INTEGRATION_OPERATOR_CONTEXT_SECRET must contain at least 32 UTF-8 bytes',
+    );
+  }
+  return value;
+}
+
+const outputPath = process.argv[2];
+if (!outputPath) {
+  fail('authority output path is required');
+}
+
+const count = iterations(process.env.K6_ITERATIONS);
+const contextSecret = secret(process.env.INTEGRATION_OPERATOR_CONTEXT_SECRET);
+const issuedAt = String(Math.floor(Date.now() / 1000));
+const authorities = Array.from({ length: count }, () => {
+  const evidenceId = randomUUID();
+  const signature = createHmac('sha256', contextSecret)
+    .update(
+      `life-os.integration-operator-context.v1\n${WORKSPACE_ID}\n${USER_ID}\n${evidenceId}\n${issuedAt}\nGET\n${PATH}`,
+      'utf8',
+    )
+    .digest('base64url');
+
+  return Object.freeze({
+    path: PATH,
+    deliveryId: DELIVERY_ID,
+    headers: Object.freeze({
+      'x-life-os-workspace-id': WORKSPACE_ID,
+      'x-life-os-user-id': USER_ID,
+      'x-life-os-context-evidence-id': evidenceId,
+      'x-life-os-context-issued-at': issuedAt,
+      'x-life-os-context-signature': signature,
+    }),
+  });
+});
+
+await writeFile(outputPath, `${JSON.stringify(authorities)}\n`, {
+  encoding: 'utf8',
+  mode: 0o600,
+});

apps/integration-service/perf/plugin-delivery-attempt-status.k6.js

@@ -0,0 +1,83 @@
+import http from 'k6/http';
+import { check } from 'k6';
+import { SharedArray } from 'k6/data';
+import exec from 'k6/execution';
+
+function boundedInteger(name, fallback, minimum, maximum) {
+  const raw = __ENV[name];
+  const value = raw === undefined || raw === '' ? fallback : Number(raw);
+  if (!Number.isInteger(value) || value < minimum || value > maximum) {
+    throw new Error(
+      `${name} must be an integer between ${minimum} and ${maximum}`,
+    );
+  }
+  return value;
+}
+
+const iterations = boundedInteger('K6_ITERATIONS', 1000, 1, 10000);
+const vus = boundedInteger('K6_VUS', 10, 1, 100);
+const authorityFile = __ENV.K6_AUTHORITY_FILE;
+const baseUrl = __ENV.K6_BASE_URL;
+
+if (!authorityFile) {
+  throw new Error('K6_AUTHORITY_FILE is required');
+}
+if (!baseUrl || !/^http:\/\/127\.0\.0\.1:\d+$/u.test(baseUrl)) {
+  throw new Error('K6_BASE_URL must be an explicit loopback HTTP endpoint');
+}
+
+const authorities = new SharedArray('plugin-delivery-status-authority', () => {
+  const parsed = JSON.parse(open(authorityFile));
+  if (!Array.isArray(parsed) || parsed.length !== iterations) {
+    throw new Error(
+      'authority bundle must contain exactly K6_ITERATIONS entries',
+    );
+  }
+  return parsed;
+});
+
+export const options = {
+  scenarios: {
+    plugin_delivery_status: {
+      executor: 'shared-iterations',
+      vus,
+      iterations,
+      maxDuration: '45s',
+    },
+  },
+  thresholds: {
+    'http_req_duration{endpoint:plugin_delivery_status}': ['p(95)<20'],
+    'http_req_failed{endpoint:plugin_delivery_status}': ['rate==0'],
+    checks: ['rate==1'],
+  },
+  summaryTrendStats: ['avg', 'med', 'p(90)', 'p(95)', 'p(99)', 'max'],
+};
+
+export default function () {
+  const authority = authorities[exec.scenario.iterationInTest];
+  if (!authority) {
+    throw new Error('missing unique authority for iteration');
+  }
+
+  const response = http.get(`${baseUrl}${authority.path}`, {
+    headers: authority.headers,
+    redirects: 0,
+    timeout: '2s',
+    tags: { endpoint: 'plugin_delivery_status' },
+  });
+
+  check(response, {
+    'status is 200': (result) => result.status === 200,
+    'status evidence matches delivery': (result) =>
+      result.status === 200 &&
+      result.json('deliveryId') === authority.deliveryId,
+    'status evidence remains credential-free': (result) =>
+      result.status === 200 &&
+      !Object.prototype.hasOwnProperty.call(result.json(), 'claimToken') &&
+      !Object.prototype.hasOwnProperty.call(
+        result.json(),
+        'claimTokenDigest',
+      ) &&
+      !Object.prototype.hasOwnProperty.call(result.json(), 'credential'),
+  });
+}

apps/integration-service/perf/seed-plugin-delivery-attempt-status.sql

@@ -0,0 +1,81 @@
+BEGIN;
+
+INSERT INTO plugin_integration.plugin_installation_record (
+    installation_id,
+    workspace_id,
+    installed_by_user_id,
+    plugin_id,
+    plugin_contract_version,
+    manifest_sha256,
+    granted_capabilities,
+    installation_status,
+    installed_at,
+    revoked_at
+) VALUES (
+    '77777777-7777-4777-8777-777777777777',
+    '11111111-1111-4111-8111-111111111111',
+    '22222222-2222-4222-8222-222222222222',
+    'life-os.performance.status',
+    'life-os.plugin.v1',
+    repeat('0', 64),
+    ARRAY[]::text[],
+    'active',
+    clock_timestamp() - INTERVAL '10 minutes',
+    NULL
+);
+
+INSERT INTO plugin_integration.plugin_delivery_origin_grant_record (
+    authority_version,
+    grant_id,
+    installation_id,
+    workspace_id,
+    granted_by_user_id,
+    origin_uri,
+    grant_status,
+    granted_at,
+    revoked_at
+) VALUES (
+    'life-os.plugin-delivery-origin.v1',
+    '66666666-6666-4666-8666-666666666666',
+    '77777777-7777-4777-8777-777777777777',
+    '11111111-1111-4111-8111-111111111111',
+    '22222222-2222-4222-8222-222222222222',
+    'https://performance.example.test',
+    'active',
+    clock_timestamp() - INTERVAL '9 minutes',
+    NULL
+);
+
+INSERT INTO plugin_integration.plugin_delivery_attempt_record (
+    authority_version,
+    delivery_id,
+    grant_id,
+    installation_id,
+    workspace_id,
+    requested_by_user_id,
+    delivery_status,
+    attempt_count,
+    max_attempts,
+    requested_at,
+    updated_at,
+    next_attempt_at,
+    terminal_at,
+    last_outcome_code
+) VALUES (
+    'life-os.plugin-delivery-attempt.v1',
+    '33333333-3333-4333-8333-333333333333',
+    '66666666-6666-4666-8666-666666666666',
+    '77777777-7777-4777-8777-777777777777',
+    '11111111-1111-4111-8111-111111111111',
+    '22222222-2222-4222-8222-222222222222',
+    'pending',
+    0,
+    3,
+    clock_timestamp() - INTERVAL '1 minute',
+    clock_timestamp() - INTERVAL '1 minute',
+    clock_timestamp() + INTERVAL '5 minutes',
+    NULL,
+    NULL
+);
+
+COMMIT;