// Python/JS reporting parity: assert the shared golden fixture

// (tests/fixtures/reporting_golden.json) against the worker's exported

// formulas. The same fixture is asserted from the Python side in

// tests/test_reporting_golden.py, so the two implementations cannot drift.

//

// Run: node --test cloudflare/reporting_parity.test.mjs

import assert from "node:assert/strict";

import { createHmac } from "node:crypto";

import { readFileSync } from "node:fs";

import { dirname, join } from "node:path";

import { test } from "node:test";

import { fileURLToPath } from "node:url";

import worker, {

  computeAggregates,

  computeComparisons,

  effectiveSubject,

  effectiveSubjectKind,

  ingestRows,

  MAX_UPLOAD_BYTES,

  rowsToMeasurements,

  scorecardFromCells,

  trendSeries,

  upsertSubjects,

  verifySignature,

} from "./worker.js";

import { TAIL_MIN_SAMPLES, deltaPct, percentileNearest, subjectKey } from "./reporting.mjs";

const HERE = dirname(fileURLToPath(import.meta.url));

const GOLDEN = JSON.parse(readFileSync(join(HERE, "..", "tests", "fixtures", "reporting_golden.json"), "utf8"));

const NOW = "2026-06-12T00:00:00Z";

test("percentile_nearest matches Python golden cases (empty, single, ties)", () => {

  for (const { values, p, expected } of GOLDEN.percentile_nearest) {

    assert.strictEqual(

      percentileNearest(values, p),

      expected,

      `percentileNearest(${JSON.stringify(values)}, ${p})`,

    );

  }

});

test("delta_pct matches Python golden cases including base == 0 guard", () => {

  for (const { base, value, expected } of GOLDEN.delta_pct) {

    assert.strictEqual(deltaPct(base, value), expected, `deltaPct(${base}, ${value})`);

  }

});

test("aggregate group matches Python golden (nulls preserved, skips/failures excluded)", () => {

  const { rows, expected } = GOLDEN.aggregate_group;

  const measurements = rowsToMeasurements(rows, "golden:profile", NOW);

  // Null preservation: unmeasured stays null, NEVER 0.

  const nullElapsed = measurements.find((m) => rows[measurements.indexOf(m)].elapsed_ms === null);

  assert.strictEqual(nullElapsed.elapsed_ms, null);

  const nullTokens = measurements.filter((m) => m.estimated_tokens_total === null);

  assert.ok(nullTokens.length >= 1, "null estimated_tokens_total preserved");

  const aggregates = computeAggregates(measurements, "golden", NOW);

  assert.strictEqual(aggregates.length, 1);

  const agg = aggregates[0];

  assert.strictEqual(agg.p50_ms, expected.median);

  assert.strictEqual(agg.p90_ms, expected.p90);

  // Tail honesty: at n=5 (< TAIL_MIN_SAMPLES) the aggregate reports p95/p99

  // as null — the fixture's expected.p95/p99 remain the RAW nearest-rank

  // values, still asserted below so the formula itself cannot drift.

  assert.strictEqual(agg.p95_ms, null);

  assert.strictEqual(agg.p99_ms, null);

  const elapsedValues = rows

    .filter((row) => row.returncode === 0 && row.elapsed_ms !== null)

    .map((row) => row.elapsed_ms);

  assert.strictEqual(percentileNearest(elapsedValues, 95), expected.p95);

  assert.strictEqual(percentileNearest(elapsedValues, 99), expected.p99);

  assert.strictEqual(agg.n, expected.n);

  assert.ok(expected.n < TAIL_MIN_SAMPLES.p95, "fixture group stays below the p95 gate");

  // 1 failure among 6 counted samples (skip row excluded entirely).

  assert.strictEqual(agg.failure_count, 1);

  assert.strictEqual(agg.sample_count, 7);

});

test("skip-only aggregate failure_rate is null, not fabricated zero", () => {

  const rows = [

    {

      subject: "git", subject_kind: "git", scenario: "s", operation: "skipped",

      run: 1, elapsed_ms: null, returncode: 77, skipped: true,

    },

    {

      subject: "oak_installed", subject_kind: "oak", scenario: "s", operation: "skipped",

      run: 1, elapsed_ms: null, returncode: 77, skipped: true,

    },

  ];

  const aggregates = computeAggregates(rowsToMeasurements(rows, "k:p", NOW), "p", NOW);

  assert.strictEqual(aggregates.length, 2);

  for (const agg of aggregates) {

    assert.strictEqual(agg.sample_count, 0);

    assert.strictEqual(agg.failure_count, 0);

    assert.strictEqual(agg.failure_rate, null);

    assert.strictEqual(agg.p50_ms, null);

  }

  const comparisons = computeComparisons(aggregates);

  assert.strictEqual(comparisons.length, 1);

  assert.strictEqual(comparisons[0].failure_rate_delta_pp, null);

});

test("oak/git comparison ratio and delta_pct match Python golden", () => {

  const { oak_values, git_values } = GOLDEN.comparison;

  const rows = [

    ...git_values.map((elapsed, run) => ({

      subject: "git", subject_kind: "git", scenario: "synthetic", operation: "status",

      run: run + 1, elapsed_ms: elapsed, returncode: 0,

    })),

    ...oak_values.map((elapsed, run) => ({

      subject: "oak_installed", subject_kind: "oak", scenario: "synthetic", operation: "status",

      run: run + 1, elapsed_ms: elapsed, returncode: 0,

    })),

  ];

  const measurements = rowsToMeasurements(rows, "golden:profile", NOW);

  const aggregates = computeAggregates(measurements, "golden", NOW);

  const comparisons = computeComparisons(aggregates);

  assert.strictEqual(comparisons.length, 1);

  const comparison = comparisons[0];

  assert.strictEqual(comparison.baseline_kind, "git");

  assert.strictEqual(comparison.p50_ratio, GOLDEN.comparison.expected_ratio);

  assert.strictEqual(comparison.p50_delta_pct_better, GOLDEN.comparison.expected_delta_pct);

  const oakAgg = aggregates.find((agg) => agg.subject === "oak_installed");

  const gitAgg = aggregates.find((agg) => agg.subject === "git");

  assert.strictEqual(oakAgg.p50_ms, GOLDEN.comparison.expected_oak_median);

  assert.strictEqual(gitAgg.p50_ms, GOLDEN.comparison.expected_git_median);

});

test("zero-baseline comparison: ratio is null, delta_pct guard yields 0", () => {

  const rows = [

    { subject: "git", subject_kind: "git", scenario: "z", operation: "noop", run: 1, elapsed_ms: 0.0, returncode: 0 },

    { subject: "oak_installed", subject_kind: "oak", scenario: "z", operation: "noop", run: 1, elapsed_ms: 3.0, returncode: 0 },

  ];

  const comparisons = computeComparisons(computeAggregates(rowsToMeasurements(rows, "k:p", NOW), "p", NOW));

  assert.strictEqual(comparisons.length, 1);

  assert.strictEqual(comparisons[0].p50_ratio, null);

  assert.strictEqual(comparisons[0].p50_delta_pct_better, 0.0);

  assert.strictEqual(comparisons[0].p50_slower_pct, null);

});

test("upsertSubjects keys on (subject, subject_kind, binary_sha256)", async () => {

  const rows = [

    { subject: "git", subject_kind: "git", binary_sha256: "aa" },

    { subject: "git", subject_kind: "git", binary_sha256: "aa" },

    { subject: "git", subject_kind: "git", binary_sha256: "bb" },

    { subject: "oak_installed", subject_kind: "oak", binary_sha256: null },

  ];

  const { records, idsByKey } = await upsertSubjects(rows, "run:profile", {

    git: { kind: "git", label: "Git", bin: "git", version: "git version 2.49.0" },

  });

  assert.strictEqual(records.length, 3);

  assert.strictEqual(idsByKey.size, 3);

  assert.strictEqual(records[0].version, "git version 2.49.0");

  const again = await upsertSubjects(rows, "run:profile", {});

  assert.deepStrictEqual(

    [...again.idsByKey.values()],

    [...idsByKey.values()],

    "subject ids are deterministic",

  );

});

test("platform rows (no subject field) ingest under platform/driver identity", async () => {

  // Platform-lane rows (rows.py LANE_REQUIRED_KEYS["platform"]) carry

  // platform/driver instead of subject; effective subject is "github/cli"

  // with subject_kind "github". A row with neither subject nor platform is

  // skipped from subject-keyed tables and counted, never silent.

  const rows = [

    {

      platform: "github", driver: "cli", scenario: "pr_flow", operation: "pr.create",

      run: 1, elapsed_ms: 120.0, returncode: 0, runner_id: "r-1", runner_class: "hosted",

    },

    {

      platform: "github", driver: "cli", scenario: "pr_flow", operation: "pr.create",

      run: 2, elapsed_ms: 140.0, returncode: 0, runner_id: "r-1", runner_class: "hosted",

    },

    { scenario: "pr_flow", operation: "pr.create", run: 3, elapsed_ms: 1.0, returncode: 0 },

  ];

  assert.strictEqual(effectiveSubject(rows[0]), "github/cli");

  assert.strictEqual(effectiveSubjectKind(rows[0]), "github");

  assert.strictEqual(effectiveSubject(rows[2]), null);

  const { records, idsByKey, skipped } = await upsertSubjects(rows, "run:platform");

  assert.strictEqual(records.length, 1);

  assert.strictEqual(records[0].name, "github/cli");

  assert.strictEqual(records[0].kind, "github");

  assert.strictEqual(skipped, 1);

  const subjectId = idsByKey.get(subjectKey(rows[0]));

  assert.ok(subjectId, "platform identity present in idsByKey");

  const report = {};

  const measurements = rowsToMeasurements(rows, "run:platform", NOW, idsByKey, report);

  assert.strictEqual(measurements.length, 2, "identity-less row excluded from measurements");

  assert.strictEqual(report.skipped_no_subject, 1);

  for (const m of measurements) {

    assert.strictEqual(m.subject, "github/cli");

    assert.strictEqual(m.subject_kind, "github");

    assert.strictEqual(m.subject_id, subjectId);

  }

  const aggregates = computeAggregates(measurements, "platform", NOW);

  assert.strictEqual(aggregates.length, 1, "both platform rows group under one identity");

  assert.strictEqual(aggregates[0].subject, "github/cli");

  assert.strictEqual(aggregates[0].subject_kind, "github");

  assert.strictEqual(aggregates[0].subject_id, subjectId);

  assert.strictEqual(aggregates[0].n, 2);

});

test("same subject name with different binary_sha256 stays two identities", async () => {

  const rows = [

    {

      subject: "oak_local", subject_kind: "oak", binary_sha256: "sha-a",

      scenario: "s", operation: "status", run: 1, elapsed_ms: 10.0, returncode: 0,

    },

    {

      subject: "oak_local", subject_kind: "oak", binary_sha256: "sha-b",

      scenario: "s", operation: "status", run: 1, elapsed_ms: 20.0, returncode: 0,

    },

  ];

  const { records, idsByKey } = await upsertSubjects(rows, "run:profile");

  assert.strictEqual(records.length, 2, "two subject records for two shas");

  assert.notStrictEqual(records[0].subject_id, records[1].subject_id);

  assert.deepStrictEqual(records.map((r) => r.name), ["oak_local", "oak_local"], "name stays the subject string");

  const measurements = rowsToMeasurements(rows, "run:profile", NOW, idsByKey);

  const aggregates = computeAggregates(measurements, "p", NOW);

  assert.strictEqual(aggregates.length, 2, "two aggregate groups, one per sha");

  assert.deepStrictEqual(

    new Set(aggregates.map((a) => a.subject_id)),

    new Set(records.map((r) => r.subject_id)),

  );

  assert.deepStrictEqual(aggregates.map((a) => a.p50_ms).sort((x, y) => x - y), [10, 20]);

});

test("comparisons run against every git-kind baseline, order-independent", () => {

  const rows = [

    { subject: "git", subject_kind: "git", scenario: "s", operation: "status", run: 1, elapsed_ms: 100.0, returncode: 0 },

    { subject: "git", subject_kind: "git", scenario: "s", operation: "status", run: 2, elapsed_ms: 110.0, returncode: 0 },

    { subject: "git_fsmonitor", subject_kind: "git", scenario: "s", operation: "status", run: 1, elapsed_ms: 50.0, returncode: 0 },

    { subject: "git_fsmonitor", subject_kind: "git", scenario: "s", operation: "status", run: 2, elapsed_ms: 60.0, returncode: 0 },

    { subject: "oak_local", subject_kind: "oak", scenario: "s", operation: "status", run: 1, elapsed_ms: 40.0, returncode: 0 },

    { subject: "oak_local", subject_kind: "oak", scenario: "s", operation: "status", run: 2, elapsed_ms: 45.0, returncode: 0 },

  ];

  const build = (input) => computeComparisons(computeAggregates(rowsToMeasurements(input, "k:p", NOW), "p", NOW));

  const comparisons = build(rows);

  assert.strictEqual(comparisons.length, 2, "one comparison per git-kind baseline");

  assert.ok(comparisons.every((c) => c.target_subject_id === "oak_local"));

  assert.deepStrictEqual(

    comparisons.map((c) => c.baseline_subject_id).sort(),

    ["git", "git_fsmonitor"],

    "distinct baseline ids",

  );

  assert.deepStrictEqual(comparisons.map((c) => c.baseline_subject).sort(), ["git", "git_fsmonitor"]);

  const vsGit = comparisons.find((c) => c.baseline_subject_id === "git");

  const vsFsmonitor = comparisons.find((c) => c.baseline_subject_id === "git_fsmonitor");

  assert.strictEqual(vsGit.p50_ratio, 42.5 / 105.0);

  assert.strictEqual(vsFsmonitor.p50_ratio, 42.5 / 55.0);

  // Deterministic regardless of input order: reversed and seeded-shuffled

  // permutations produce byte-identical comparison arrays.

  assert.deepStrictEqual(build([...rows].reverse()), comparisons);

  let seed = 1337;

  const next = () => {

    seed = (seed * 1103515245 + 12345) % 2147483648;

    return seed / 2147483648;

  };

  for (let round = 0; round < 5; round += 1) {

    const shuffled = [...rows];

    for (let i = shuffled.length - 1; i > 0; i -= 1) {

      const j = Math.floor(next() * (i + 1));

      [shuffled[i], shuffled[j]] = [shuffled[j], shuffled[i]];

    }

    assert.deepStrictEqual(build(shuffled), comparisons, `shuffle round ${round}`);

  }

});

test("scorecardFromCells summarizes verdicts with worst-first overall", () => {

  const summary = scorecardFromCells([

    { verdict: "GREEN" },

    { verdict: "AMBER" },

    { verdict: "RED" },

    { verdict: "GREEN" },

  ]);

  assert.deepStrictEqual(summary, {

    total: 4,

    counts: { GREEN: 2, AMBER: 1, RED: 1 },

    overall: "RED",

  });

  assert.strictEqual(scorecardFromCells([]).overall, "UNMEASURED");

});

test("trendSeries groups aggregate rows per subject in time order", () => {

  const rows = [

    { timestamp_utc: "2026-06-02T00:00:00Z", run_key: "b:p", subject: "git", scenario: "s", operation: "o", p50_ms: 21 },

    { timestamp_utc: "2026-06-01T00:00:00Z", run_key: "a:p", subject: "git", scenario: "s", operation: "o", p50_ms: 20 },

    { timestamp_utc: "2026-06-01T00:00:00Z", run_key: "a:p", subject: "oak_installed", scenario: "s", operation: "o", p50_ms: 11 },

    { timestamp_utc: "2026-06-01T00:00:00Z", run_key: "a:p", subject: "git", scenario: "other", operation: "o", p50_ms: 99 },

  ];

  const series = trendSeries(rows, { scenario: "s", operation: "o", metric: "p50" });

  assert.strictEqual(series.metric, "p50_ms");

  const git = series.series.find((entry) => entry.subject === "git");

  assert.deepStrictEqual(git.points.map((point) => point.value), [20, 21]);

  assert.strictEqual(trendSeries(rows, { scenario: "s", operation: "o", metric: "bogus" }), null);

});

test("aggregate tail gating matches golden: p95 null below n=20, p99 null below n=100", () => {

  // Parity note: Python gates tail percentiles in

  // oakbench.reporting.tail_latency_summary (and at the rendering layer in

  // scripts/benchmark_stats.py) — there is no shared Python aggregate

  // function identical to computeAggregates. tests/test_reporting_golden.py

  // asserts these same golden cases against tail_latency_summary, so the

  // gate thresholds and gated values cannot drift between the two sides.

  assert.strictEqual(TAIL_MIN_SAMPLES.p95, 20);

  assert.strictEqual(TAIL_MIN_SAMPLES.p99, 100);

  const sizes = GOLDEN.aggregate_tail_gating.cases.map((c) => c.values.length);

  assert.deepStrictEqual(sizes, [1, 20, 100], "fixture covers n=1 and both gate boundaries");

  for (const { values, expected } of GOLDEN.aggregate_tail_gating.cases) {

    const rows = values.map((elapsed, index) => ({

      subject: "oak_installed", subject_kind: "oak", scenario: "tail", operation: "status",

      run: index + 1, elapsed_ms: elapsed, returncode: 0,

    }));

    const aggregates = computeAggregates(rowsToMeasurements(rows, "k:p", NOW), "p", NOW);

    assert.strictEqual(aggregates.length, 1);

    const agg = aggregates[0];

    assert.strictEqual(agg.n, values.length);

    assert.strictEqual(agg.p50_ms, expected.p50, `p50 stays ungated at n=${values.length}`);

    assert.notStrictEqual(agg.p90_ms, null, `p90 stays ungated at n=${values.length}`);

    assert.strictEqual(agg.p95_ms, expected.p95, `p95 at n=${values.length}`);

    assert.strictEqual(agg.p99_ms, expected.p99, `p99 at n=${values.length}`);

  }

});

test("p90-only regression flags is_regression and regression_dimensions", () => {

  const makeAgg = (subjectId, kind, p50, p90) => ({

    run_key: "k:p", subject_id: subjectId, subject: subjectId, subject_kind: kind,

    profile: "p", scenario: "s", operation: "status", is_canonical: 1,

    sample_count: 5, failure_count: 0, failure_rate: 0, n: 5,

    p50_ms: p50, p90_ms: p90, p95_ms: null, p99_ms: null,

    mean_ms: p50, min_ms: p50, max_ms: p90,

    avg_tokens: null, avg_output_bytes: null, truncated_count: 0, avg_tool_calls: null,

    updated_at: NOW,

  });

  const compare = (basP50, basP90, tgtP50, tgtP90) => {

    const comparisons = computeComparisons([

      makeAgg("git", "git", basP50, basP90),

      makeAgg("oak_installed", "oak", tgtP50, tgtP90),

    ]);

    assert.strictEqual(comparisons.length, 1);

    return comparisons[0];

  };

  // Reviewer repro: p50 flat (10 -> 10) but p90 blows up (10 -> 100).

  const p90Only = compare(10, 10, 10, 100);

  assert.strictEqual(p90Only.is_regression, 1);

  assert.deepStrictEqual(p90Only.regression_dimensions, ["p90"]);

  assert.strictEqual(p90Only.state, "regression");

  assert.strictEqual(p90Only.severity_score, 900, "severity follows the breaching dimension");

  // p50-only breach: p90 delta (1ms) stays under minDeltaMs (5ms).

  const p50Only = compare(10, 100, 100, 101);

  assert.strictEqual(p50Only.is_regression, 1);

  assert.deepStrictEqual(p50Only.regression_dimensions, ["p50"]);

  // Neither dimension breaches (4% slower, under the 10% threshold).

  const clean = compare(10, 10, 10.4, 10.4);

  assert.strictEqual(clean.is_regression, 0);

  assert.deepStrictEqual(clean.regression_dimensions, []);

  assert.strictEqual(clean.state, "ok");

  assert.strictEqual(clean.severity_score, 0);

});

// Minimal D1 stub for driving ingestRows: prepare(...).bind(...) statements

// carry their SQL + bound args; batch()/run() route to an in-memory table

// keyed by run_key (args[0] for measurements/aggregates/comparisons inserts,

// args[1] for subjects whose first bind is subject_id).

class StubD1 {

  constructor() {

    this.tables = { subjects: [], measurements: [], aggregates: [], comparisons: [] };

    this.failInsertsForTable = null;

    this.batchCalls = [];

  }

  prepare(sql) {

    const stub = this;

    return {

      bind(...args) {

        return {

          sql,

          args,

          run: async () => stub.execute(sql, args),

          first: async () => null,

        };

      },

    };

  }

  async batch(statements) {

    this.batchCalls.push(statements);

    const snapshot = Object.fromEntries(

      Object.entries(this.tables).map(([table, rows]) => [

        table,

        rows.map((row) => ({ runKey: row.runKey, args: [...row.args] })),

      ]),

    );

    try {

      for (const statement of statements) {

        this.execute(statement.sql, statement.args ?? []);

      }

    } catch (error) {

      this.tables = snapshot;

      throw error;

    }

  }

  execute(sql, args) {

    const del = sql.match(/DELETE FROM (\w+) WHERE run_key = \?/);

    if (del) {

      this.tables[del[1]] = this.tables[del[1]].filter((row) => row.runKey !== args[0]);

      return { success: true };

    }

    const ins = sql.match(/INSERT INTO (\w+)/);

    if (ins) {

      const table = ins[1];

      if (this.failInsertsForTable === table) {

        throw new Error(`injected insert failure for ${table}`);

      }

      const runKey = table === "subjects" ? args[1] : args[0];

      if (table === "subjects" && sql.includes("ON CONFLICT(subject_id)")) {

        this.tables.subjects = this.tables.subjects.filter((row) => row.args[0] !== args[0]);

      }

      this.tables[table].push({ runKey, args });

      return { success: true };

    }

    throw new Error(`StubD1: unsupported SQL: ${sql}`);

  }

}

test("re-upload with fewer groups leaves no stale aggregates/comparisons", async () => {

  const groupRows = (operations) => operations.flatMap((operation) => [

    { subject: "git", subject_kind: "git", scenario: "s", operation, run: 1, elapsed_ms: 10.0, returncode: 0 },

    { subject: "oak_installed", subject_kind: "oak", scenario: "s", operation, run: 1, elapsed_ms: 12.0, returncode: 0 },

  ]);

  const db = new StubD1();

  // A different run_key seeded first must survive the re-upload deletes.

  await ingestRows(db, groupRows(["keep"]), "other:p", "p", NOW);

  const first = await ingestRows(db, groupRows(["o1", "o2", "o3"]), "rk:p", "p", NOW);

  assert.strictEqual(first.aggregates, 6, "3 groups x 2 subjects");

  assert.strictEqual(first.comparisons, 3);

  assert.strictEqual(db.tables.aggregates.filter((r) => r.runKey === "rk:p").length, 6);

  assert.strictEqual(db.tables.comparisons.filter((r) => r.runKey === "rk:p").length, 3);

  // Re-upload the SAME run_key with only 1 of the 3 groups.

  await ingestRows(db, groupRows(["o1"]), "rk:p", "p", NOW);

  const aggs = db.tables.aggregates.filter((r) => r.runKey === "rk:p");

  const comps = db.tables.comparisons.filter((r) => r.runKey === "rk:p");

  assert.strictEqual(aggs.length, 2, "exactly the re-uploaded group's aggregates");

  assert.strictEqual(comps.length, 1, "exactly the re-uploaded group's comparison");

  // Aggregates bind order: run_key, subject_id, profile, scenario, operation.

  assert.deepStrictEqual(new Set(aggs.map((r) => r.args[4])), new Set(["o1"]));

  // Comparisons bind order: ..., profile, scenario, operation at index 6.

  assert.deepStrictEqual(comps.map((r) => r.args[6]), ["o1"]);

  assert.strictEqual(db.tables.measurements.filter((r) => r.runKey === "rk:p").length, 2);

  // Other run untouched.

  assert.strictEqual(db.tables.aggregates.filter((r) => r.runKey === "other:p").length, 2);

  assert.strictEqual(db.tables.comparisons.filter((r) => r.runKey === "other:p").length, 1);

});

test("failed run rewrite leaves previous run rows intact", async () => {

  const groupRows = (operations) => operations.flatMap((operation) => [

    { subject: "git", subject_kind: "git", scenario: "s", operation, run: 1, elapsed_ms: 10.0, returncode: 0 },

    { subject: "oak_installed", subject_kind: "oak", scenario: "s", operation, run: 1, elapsed_ms: 12.0, returncode: 0 },

  ]);

  const db = new StubD1();

  await ingestRows(db, groupRows(["old"]), "rk:p", "p", NOW);

  db.failInsertsForTable = "measurements";

  await assert.rejects(

    () => ingestRows(db, groupRows(["new"]), "rk:p", "p", NOW),

    /injected insert failure for measurements/,

  );

  const measurements = db.tables.measurements.filter((r) => r.runKey === "rk:p");

  const aggs = db.tables.aggregates.filter((r) => r.runKey === "rk:p");

  const comps = db.tables.comparisons.filter((r) => r.runKey === "rk:p");

  assert.strictEqual(measurements.length, 2);

  assert.strictEqual(aggs.length, 2);

  assert.strictEqual(comps.length, 1);

  assert.deepStrictEqual(new Set(measurements.map((r) => r.args[3])), new Set(["old"]));

  assert.deepStrictEqual(new Set(aggs.map((r) => r.args[4])), new Set(["old"]));

  assert.deepStrictEqual(new Set(comps.map((r) => r.args[6])), new Set(["old"]));

});

test("regression_dimensions is persisted through the comparisons insert", async () => {

  // p90-only regression: oak medians match git (10), but oak's p90 hits the

  // 100ms outlier (nearest-rank p90 of 3 samples = the 3rd).

  const rows = [

    ...[1, 2, 3].map((run) => ({

      subject: "git", subject_kind: "git", scenario: "s", operation: "o", run,

      elapsed_ms: 10.0, returncode: 0,

    })),

    ...[10.0, 10.0, 100.0].map((elapsed, i) => ({

      subject: "oak_installed", subject_kind: "oak", scenario: "s", operation: "o", run: i + 1,

      elapsed_ms: elapsed, returncode: 0,

    })),

  ];

  const db = new StubD1();

  await ingestRows(db, rows, "rk:dims", "p", NOW);

  const comps = db.tables.comparisons.filter((r) => r.runKey === "rk:dims");

  assert.strictEqual(comps.length, 1);

  const insertSql = `run_key, target_subject_id, baseline_subject_id, baseline_kind, profile,

      scenario, operation,

      p50_delta_ms, p50_slower_pct, p90_delta_ms, p90_slower_pct,

      p99_delta_ms, p99_slower_pct,

      avg_token_delta, token_higher_pct, avg_output_byte_delta, output_byte_higher_pct,

      avg_tool_call_delta, tool_call_higher_pct, failure_rate_delta_pp,

      threshold_pct, min_delta_ms, is_regression, regression_dimensions, state, severity_score, updated_at`;

  const columns = insertSql.replace(/\s+/g, " ").split(", ").map((c) => c.trim());

  const dimsIndex = columns.indexOf("regression_dimensions");

  assert.ok(dimsIndex >= 0, "insert must include the regression_dimensions column");

  const persisted = comps[0].args[dimsIndex];

  assert.strictEqual(typeof persisted, "string", "dimensions persist as a JSON string");

  assert.deepStrictEqual(JSON.parse(persisted), ["p90"]);

  const isRegressionIndex = columns.indexOf("is_regression");

  assert.strictEqual(comps[0].args[isRegressionIndex], 1);

});

test("verifySignature accepts a valid X-Hub-Signature-256 and rejects tampering", async () => {

  const secret = "shhh-bench";

  const body = JSON.stringify({ action: "push", ref: "refs/heads/main" });

  const header = `sha256=${createHmac("sha256", secret).update(body).digest("hex")}`;

  assert.strictEqual(await verifySignature(secret, body, header), true);

  assert.strictEqual(await verifySignature(secret, body + "x", header), false);

  assert.strictEqual(await verifySignature("wrong", body, header), false);

  assert.strictEqual(await verifySignature(secret, body, "sha256=deadbeef"), false);

  assert.strictEqual(await verifySignature(secret, body, ""), false);

});

test("write routes fail closed without UPLOAD_TOKEN but GitHub webhook does not require it", async () => {

  const writeResponse = await worker.fetch(

    new Request("https://bench.example/api/scorecard", {

      method: "POST",

      body: JSON.stringify({ bench_id: "b", profile: "p", scorecard: [] }),

    }),

    {},

  );

  assert.strictEqual(writeResponse.status, 503);

  assert.deepStrictEqual(await writeResponse.json(), {

    ok: false,

    error: "upload_token_not_configured",

  });

  const secret = "webhook-secret";

  const body = JSON.stringify({ action: "push" });

  const signature = `sha256=${createHmac("sha256", secret).update(body).digest("hex")}`;

  const webhookResponse = await worker.fetch(

    new Request("https://bench.example/webhook/github", {

      method: "POST",

      body,

      headers: {

        "x-hub-signature-256": signature,

        "x-github-event": "push",

        "x-github-delivery": "delivery-1",

      },

    }),

    { GITHUB_WEBHOOK_SECRET: secret },

  );

  assert.strictEqual(webhookResponse.status, 200);

  assert.deepStrictEqual(await webhookResponse.json(), { ok: true, recorded: false });

});

test("upload limit is enforced on UTF-8 bytes, not UTF-16 string length", async () => {

  const body = "é".repeat(Math.floor(MAX_UPLOAD_BYTES / 2) + 1);

  assert.ok(body.length <= MAX_UPLOAD_BYTES, "fixture must be below the old UTF-16 length guard");

  assert.ok(new TextEncoder().encode(body).byteLength > MAX_UPLOAD_BYTES);

  const response = await worker.fetch(

    new Request("https://bench.example/api/upload", {

      method: "POST",

      body,

      headers: {

        authorization: "Bearer upload-token",

        "content-length": String(body.length),

      },

    }),

    { UPLOAD_TOKEN: "upload-token" },

  );

  assert.strictEqual(response.status, 413);

  assert.deepStrictEqual(await response.json(), {

    ok: false,

    error: "upload_too_large",

    max_bytes: MAX_UPLOAD_BYTES,

  });

});