ci: confirm release performance on fresh runners

[theDakshJaitly]

Summary

• run the first release-performance measurement in its own pinned Ubuntu 24.04 / Node 22.22 job
• allocate a second GitHub-hosted job only when the existing materiality policy requests confirmation
• aggregate bounded, digest-bound reports in the stable release-performance gate
• preserve deterministic failures, exact-metric confirmation, existing budgets, and the local benchmark command
• retain producer artifact identities across GitHub failed-only reruns while rejecting cross-run, cross-SHA, future, malformed, or reused-job evidence

Why

The previous confirmation passes ran back-to-back on one hosted VM. Retained CI evidence showed identical repository content oscillating across materially different Graph, Wiki, and Search failure sets, so sustained runner contention could satisfy both sides of the confirmation rule.

GitHub-hosted jobs provide the independent runner allocation the policy intended. This PR changes only CI orchestration and evidence validation; release-performance budgets, sample counts, thresholds, and formulas are unchanged.

Validation

• Node 22 focused release-performance tests: 49/49 passed
• npm run typecheck: passed
• npm run build: passed
• asset-only release benchmark: passed
• workflow YAML parse, Node syntax check, and git diff --check: passed
• full local Vitest run: 2,967 passed, 1 skipped, and 7 fixed 15-second timeouts under parallel load
• both timeout-affected contract files passed independently: 82/82
• independent review found no P0-P2 issues

No Graph, Wiki, Hub, skill, or budget implementation files are changed.

[Copilot]

🟢 Approval recommended

The CI orchestration changes are well-scoped, backed by explicit workflow/topology tests and thorough orchestrator validation tests, and preserve the existing performance budget semantics.

Pull request overview

This PR hardens the release-performance CI gate by splitting the first measurement and any policy-required confirmation into separately allocated GitHub-hosted jobs, then aggregating/validating bounded evidence in a stable final “release-performance” job.

Changes:

• Introduces a CI orchestrator that produces bounded attempt manifests, validates per-run allocation provenance, and finalizes a single combined report (fail-closed on missing/malformed/mismatched evidence).
• Updates the release benchmark report contract to record runner allocation provenance (runnerAllocations) alongside runtime confirmation results.
• Reworks the CI workflow to run attempt-1 always, attempt-2 only when required, and a final always-running aggregation gate; adds targeted tests asserting the workflow topology and orchestrator behavior.

File summaries

File	Description
scripts/release-benchmark/report.schema.json	Extends runtime confirmation schema to optionally include bounded runner allocation provenance.
scripts/release-benchmark/release-benchmark.test.js	Updates contract tests to cover the new runnerAllocations runtimeConfirmation property.
scripts/release-benchmark/ci-workflow.test.js	Adds a Vitest guard verifying the CI workflow’s release-performance job topology and artifact naming invariants.
scripts/release-benchmark/ci-orchestrator.test.js	Adds comprehensive tests for the new fresh-runner orchestration and evidence validation rules.
scripts/release-benchmark/ci-orchestrator.mjs	Implements bounded CI attempt/finalize commands with strict provenance and digest validation.
docs/design/release-performance-baseline.md	Documents the new fresh-runner confirmation topology and evidence constraints.
.mex/patterns/release-performance-gate.md	Updates the release-performance gate pattern guidance to require distinct hosted-job confirmations.
.github/workflows/ci.yml	Splits release-performance into attempt-1, conditional attempt-2, and an always-running final aggregation gate with bounded artifacts.

Review details

• Files reviewed: 8/8 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.