fix: single-source and property-test the measured-performance path in audit.mjs

[thomasluizon]

Closes https://github.com/thomasluizon/orbit-tickets/issues/288

Ticket: #288 (https://github.com/thomasluizon/orbit-tickets/issues/288)

Summary

• Single-source the measured-performance arithmetic: tools/lib/performance-measurement.mjs is the one copy, and .claude/workflows/audit.mjs is generated from it by tools/generate-performance-workflow.mjs with a drift gate in guards.yml.
• Replace positional regex SQL parsing with a parser that returns null and suppresses the signal when it cannot read a shape.
• Property-test the three invariants from the ticket (egress bound, projected-column bound, no signal under budget).

Salvage note

The worker committed this work (9ea9b09) and was killed at the 10-minute no-progress cap while waiting for the repository-wide tools/test-tools.mjs run. The orchestrator ran both harnesses in the worktree after the kill: node tools/test-tools.mjs exit 0, node .claude/hooks/test-hooks.mjs exit 0, at this head. No code was added or changed after the worker's commit.

Assumptions

• The generated-workflow approach (emitter plus drift gate, mirroring arch-map.yml) was chosen over a shared imported module; the ticket delegated this choice.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
orbit-ui-mobile-web	Ignored		Aug 14, 2026 5:03pm

[pullfrog]

Important

The SQL parser still treats unsupported valid PostgreSQL forms as confidently parsed, allowing measured audit signals to be computed or suppressed from incorrect facts.

Reviewed changes in the measured-performance normalization, its generated audit-workflow copy, the generation/drift gate, and the expanded deterministic and property-based harness coverage.

• Canonical generated path — moves measured-performance logic into tools/lib/performance-measurement.mjs, generates the sandboxed workflow block from it, and adds a CI drift check.
• Conservative SQL analysis — replaces positional regular expressions with tokenized query-shape analysis and suppresses signals when analysis returns unknown.
• Invariant coverage — adds fast-check properties for egress, projection width, and background-budget bounds while executing both the canonical module and generated consumer.
• Tool integration — registers the generator in the tool harness and updates package manifests, lockfile, and tool documentation.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using GPT Sol ｜ 𝕏}

[pullfrog]

Important

No new issue was introduced by this delta, but one earlier parser thread remains partially addressed and must be completed before merge.

Reviewed changes since the prior Pullfrog review at 9ea9b095:

• Unbounded limit handling — Treated PostgreSQL LIMIT ALL as unbounded so request mappings retain unbounded-user-list.
• Comma-source handling — Recognized comma-separated FROM sources without mistaking commas in later clauses for joins.
• Regression coverage — Added canonical and generated-path cases for LIMIT ALL, comma joins, and ORDER BY commas.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using GPT Sol ｜ 𝕏}

[pullfrog]

Important

Joined expressions can still produce a false measured projection signal and should be fixed before merge.

Reviewed changes since the prior Pullfrog review at 4525f56 focused on the joined-projection follow-up:

• Joined projection attribution — Required direct non-star columns in joined queries to name the root alias before preserving the projection count.
• Regression coverage — Added canonical and generated-path coverage for an unqualified column list over a comma join.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using GPT Sol ｜ 𝕏}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[pullfrog]

✅ No new issues found.

Reviewed changes since the prior Pullfrog review at 873c028f focused on completing joined-projection attribution:

• Unclassified joined expressions — Made projection width unknown whenever any joined expression cannot be proven to be a direct, non-star root-alias column.
• Regression coverage — Added the mixed-alias COALESCE case to both the canonical module and generated workflow execution paths.

  ^{｜ View workflow run ｜ Using GPT Sol ｜ 𝕏}