feat(sprint-gate): latency and idle-CPU limits are measured bands; the flat 10% is gone (c, 2/3)

[EtanHey]

Ratchet bolt-down (c), slice 2 of 3 — sprint_gate.py uses the measured band; the flat 10% is gone

Size XS. Base is main; #763 merged as 8aa562c3. Supersedes #764 (closed by GitHub when the stacked base branch was deleted; identical content, rebased onto main, no code changes). Review history — bot rounds, lead rounds 1 and 2, dispositions — lives on #764.

Definition of done — tests that FAIL on 3ee7c279 and pass here (verified by running them against a git archive 3ee7c279 tree)

test	on 3ee7c279	here
test_a_value_inside_measured_variance_is_no_longer_red — 294 ms (a value green main actually produced, w8-REPORT 2026-09-02) vs baseline 225 ms	RED (limit 247.5 = 225 × 1.10)	GREEN (limit 463.7, n=7)
test_a_two_fold_regression_no_longer_hides_behind_a_stale_baseline — 950 ms vs the corpus's 911.887 ms baseline	GREEN (limit 1003)	RED (limit 463.7)
test_fewer_than_five_attested_runs_is_unmeasured_never_a_verdict	verdict from a round number	UNMEASURED, values reported, no limits_ms
test_idle_cpu_goes_red_beyond_the_measured_band_even_under_the_ceiling — 20% idle, five green runs at 4.0–5.0%	PASS (under 30)	FAIL (limit 6.2%) — R3's worked example

What changed

• check_search: p50/p95 compared to the band from attested runs (--attestations <dir|file>), never baseline × 1.10. Fewer than five attested runs for either percentile → check status UNMEASURED: rc 0, listed in payload.unmeasured (same rule as SKIPPED — release consumers reject it themselves; the first five main runs must be able to complete for a band to exist). details.margins carries the full sentence (mean, σ, k, n, limit) per percentile.
• check_resource: the ratified 30% ceiling stays a hard budget; the measured band is added per process (cpu_over_measured_band, cpu_margins). Unmeasured band → ceiling alone decides, stated per process.
• corpus.json: latency_regression_fraction removed. latency_baseline_ms stays as the calibration record (hostname/captured_at), which (b) also hashes.
• Inline attestations are replay-only; a live config carrying them is refused ("the hand-editable baseline all over again"). Fixtures all_green / search_latency_red carry five inline runs so every check is still RED-provable.

Not done here, on purpose

• No live gate run: mcp_roundtrip stores a probe chunk in the canonical DB, which this seat may not touch. Replay fixtures only.
• ratchet.yml does not yet download N attestations for the collector — (b) is editing that workflow; wiring the download is a follow-up after (b) merges.

Tests

tests/test_sprint_gate.py + tests/test_ratchet_margins.py: 112 passed. ruff clean. Two pre-existing expectations updated (..._runs_latency_on_calibrated_host, ..._keg_built_from_this_sha_is_proof_eligible): a live run with no attestations is now UNMEASURED, not a PASS nobody measured.

— brainlayerClaude (worker) · claude-code/claude-fable-5-1

---

Note

Medium Risk
Changes release-gate semantics (UNMEASURED vs PASS, stricter latency/CPU drift detection) and attestation handling; incorrect wiring could block or mis-report CI until workflows pass --attestations.

Overview
Sprint gate ratchet (c): search_latency and idle CPU in resource_budget no longer use baseline × 1.10 or ceiling-only PASS. Limits come from scripts/ratchet_margins over attested green main runs (≥5 per metric); otherwise checks report UNMEASURED (real samples, no fake PASS) and appear in payload.unmeasured.

Live runs load attestations only via --attestations; inline config attestations are replay-only and validated (including duplicate run_id rejection). corpus.json drops latency_regression_fraction. Resource checks keep the hard CPU/RSS ceiling but add per-process measured bands; verdict order is FAIL → UNMEASURED → PASS so one bad percentile/process is not masked.

Fixtures and tests cover historical false RED/GREEN cases, attestation loading/refusal, and idle-CPU drift under the 30% ceiling.

^{Reviewed by Cursor Bugbot for commit 0c64d2a. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Replace flat 10% latency threshold with attestation-based measured bands in sprint_gate

• check_search and check_resource now judge p50/p95 latency and idle CPU against per-percentile, per-process margins derived from attestation histories instead of the removed latency_regression_fraction.
• Adds an UNMEASURED check status for cases where no usable band exists (fewer than five attested runs). gate_status accepts UNMEASURED alongside PASS and SKIPPED for aggregate success, and result_payload lists unmeasured checks.
• Adds a --attestations CLI argument for live runs; inline attestations are replay-only and validated (duplicate run IDs and malformed entries refuse the gate).
• Behavioral Change: gate_status now reports overall PASS when checks are only PASS, SKIPPED, and/or UNMEASURED; a measured-band FAIL takes precedence over an UNMEASURED sibling. Calibrated live hosts without attestations now report search_latency and resource_budget as UNMEASURED rather than PASS.

^{Macroscope summarized 0c64d2a.}

[EtanHey]

@coderabbitai review

— brainlayerClaude (worker) · claude-code/claude-fable-5-1

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_bff118f1-8eb2-41d9-a636-bdc5777c2844)

[coderabbitai]

@EtanHey I will review pull request #770.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[github-actions]

BrainLayer ratchet

Every Value below was measured by this run. A row this machine cannot measure says n/a — <reason> instead of a number; baselines in Notes name their own machine, method and date and were not measured here.

Row	Status	Value (measured by this run)	Method	Notes
commit provenance	🔴 RED	checkout ac8287a203ee is neither 0c64d2a34551 nor a merge of it — this run was triggered for a commit it does not have checked out	commit graph + live PR head · in-process · runner	Which commit this whole table is about. On a pull_request event the checkout is GitHub's synthetic merge ref, whose sha is not on the PR — #759's table printed 13fa724278bf while that PR's head was 4632f979 — so this row names the PR-head parent instead, the sha a reviewer can actually see. The comparison sha is read live from repos/{owner}/{repo}/pulls/{n} when the table is collected, not taken from the event payload, because the payload cannot know the run has been overtaken. Residual window, stated rather than papered over: a push landing between that read and the comment being posted is not caught here — the run for that push refreshes the table.
provenance	🟢 GREEN	stamped ac8287a203ee == HEAD, tree clean	wheel stamp · in-process · runner	Sha half of #749 keg-mode provenance: a keg built from this wheel can answer __build_sha__. The helper-age and served-process predicates need a running BrainBar and are measured only by scripts/sprint_gate.py on an installed Mac. The sha here is the checkout's — the merge ref on a PR — because that is what publish.yml stamps at release time; the PR-head sha this table describes is the one in commit provenance above.
mapped bytes	⚪ n/a	n/a — no BrainBar daemon at /tmp/brainbar.sock: this row needs the daemon, its hybrid helper and the indexed corpus running together, and no GitHub-hosted runner has them (macOS included) — only a self-hosted Darwin/arm64 runner on an installed Mac would	socket · installed Mac	Baseline 26.2 GB — installed Mac, socket, 2026-09-03, after R2 drained 15,070 → 0. Up from 16.8 GB because the drain left more vectors mapped under the same cap: the change is the drain, not a leak. Not measured by this run.
search p50/p95	⚪ n/a	n/a — no BrainBar daemon at /tmp/brainbar.sock: this row needs the daemon, its hybrid helper and the indexed corpus running together, and no GitHub-hosted runner has them (macOS included) — only a self-hosted Darwin/arm64 runner on an installed Mac would	socket · installed Mac	Baseline p50 911.887 ms / p95 3167.985 ms, captured 2026-09-01T08:42:22Z on MacBook-Pro.local under active_sprint_load (tests/fixtures/sprint_gate/corpus.json). Not measured by this run.
idle CPU	⚪ n/a	n/a — no BrainBar daemon at /tmp/brainbar.sock: this row needs the daemon, its hybrid helper and the indexed corpus running together, and no GitHub-hosted runner has them (macOS included) — only a self-hosted Darwin/arm64 runner on an installed Mac would	ps sampling · installed Mac	Budget: average CPU < 30% over a 60 s window (resource_budget in scripts/sprint_gate.py). Needs the BrainBar daemon, helper and watcher actually running. Not measured by this run.
signature_valid	⚪ n/a	n/a — the macOS signature-parity job is trigger-gated and did not run on this PR: it touches no release or signing path (pyproject.toml, scripts/release-*, scripts/brainlayer-version-check.sh, publish.yml, ratchet.yml) and carries no ratchet:signatures label — a GitHub macOS runner bills at ~10× Linux minutes and rebuilds the keg venv from source	codesign · installed keg	scripts/release-verify-signatures.sh <keg> codesign-verifies every *.so/*.dylib under libexec/venv. The macOS parity job installs the published tap formula (etanhey/layers/brainlayer), so this row measures the release path — formula, published sdist and Homebrew's relocation — and not this PR's tree. Release-time baseline for the same keg on a different machine: 442 valid / 0 invalid — installed Mac (M4 Max), brew --prefix brainlayer 1.5.11, 2026-09-03.

🟢 GREEN measured, within budget · 🔴 RED measured, out of budget — a finding to clear before merge · ⚪ n/a not measurable on this machine, never guessed.

1 RED row(s) to clear: commit provenance.

Measured on Linux/x86_64 · measured 0c64d2a34551 · PR head 0c64d2a34551 · checkout ac8287a203ee · run · updated 2026-09-05 17:03:37 UTC

[coderabbitai]

Warning

Review limit reached

Next included review available in 30 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: ac0f27d6-8c61-4bbf-af11-b8a09a02992b

📥 Commits

Reviewing files that changed from the base of the PR and between 8aa562c and 0c64d2a.

📒 Files selected for processing (5)

• scripts/sprint_gate.py
• tests/fixtures/sprint_gate/all_green.json
• tests/fixtures/sprint_gate/corpus.json
• tests/fixtures/sprint_gate/search_latency_red.json
• tests/test_sprint_gate.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[deepsource-io]

DeepSource Code Review

We reviewed changes in 8aa562c...0c64d2a on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Python		Sep 5, 2026 12:42p.m.	Review ↗
Swift		Sep 5, 2026 12:42p.m.	Review ↗
JavaScript		Sep 5, 2026 12:42p.m.	Review ↗
Shell		Sep 5, 2026 12:42p.m.	Review ↗
Secrets		Sep 5, 2026 12:42p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[EtanHey]

Supersedes #764 (closed by GitHub when its base branch wt/ratchet-c1-margins-module was deleted at the #763 merge). Same patch series, rebased onto main past 8aa562c3.

— brainlayer lead (brainlayerClaude-3303a978, claude-fable-5-1)