perf: separate downstream TLS/H2 handshake and reuse latency

[seonghobae]

Scope

Writer-safe child of #88. Adds release-built downstream TLS/H2 performance evidence and keeps the directly affected operability/test-strategy documentation code-current; no production routing/auth/identity/security authority changes.

Findings and repairs

Current load evidence enforces p95 <20 ms on cleartext/routed paths, while OPERABILITY.md requires downstream TLS/H2 new-connection/handshake latency to be reported separately from reused-connection traffic. Without a separate exact-SHA gate, warm H2 reuse can hide handshake cost and cutover evidence remains incomplete. TEST_STRATEGY.md and OPERABILITY.md also contained stale claims that already-proven H2 behavior and handshake-vs-reuse timing were still future work; those are repaired here.

The first workflow revision listened to unrestricted push and pull_request, duplicating the expensive PR-head performance run. Push execution is now limited to protected main, while PR heads execute through pull_request.

Fresh exact-head review then found a release-evidence defect: the TLS/H2 lane installed Rust 1.98.0 even though foundation #56 establishes Rust 1.98.1 as the release compiler. Exact 5a1a9e25823fba5f81b0fc2ce5fd3b1205148c6a had all hosted gates GREEN, but its TLS/H2 performance receipt is historical/diagnostic only because the compiler identity was non-authoritative. The workflow now installs, selects and verifies Rust 1.98.1 before Cargo. tests/tls_h2_performance_toolchain_contract.rs prevents fallback to 1.98.0, rustup override, RUSTUP_TOOLCHAIN, or command-local Cargo toolchain selectors.

The first contract exact 422fceadb2059b012b5f159d449de08a6ea5469d failed before compile/test only at cargo fmt --all -- --check; current exact bf66d0317f2f7709dee611b513f1a44551c1fac9 applies exactly that formatter output. No workflow policy, performance oracle, production Rust or authority boundary changed in the formatter repair.

Exact-current acceptance

Current exact bf66d0317f2f7709dee611b513f1a44551c1fac9 is terminal GREEN across:

• CI 34609583884 — formatting, complete compile/test, Clippy, warnings-denied rustdoc, owned-production coverage, load-contract and OCI runtime;
• Supply Chain 34609584385 — dependency audit, candidate images, SPDX SBOM, image scans and exact-source binding;
• PgErd bounded-origin capacity 34609583944;
• TLS H2 Performance 34609584142 using verified Rust 1.98.1.

Exact TLS/H2 artifact k6-tls-h2-performance-bf66d0317f2f7709dee611b513f1a44551c1fac9 has digest sha256:e1ea3b1ffe265ac4c2fc8ccee98f9117f6423fb309512f3e1abf5a37dc047754.

The executable performance evidence preserves 4 VUs / 400 iterations without warm-up sample removal:

• fresh TLS/H2: buyer-path p95 6.86521945 ms, TLS-handshake p95 4.60297085 ms, 400/400 HTTP/2 responses, 400/400 non-zero TLS handshakes, zero request failures;
• reused H2: reused buyer-path p95 0.72026125 ms, 396/400 requests classified as reused, 400/400 HTTP/2 responses, zero request failures.

Both p95 thresholds remain <20 ms. The measured application route is not pre-warmed; only readiness is exercised before measurement. Local CA verification remains enabled, and the exact performance candidate is built only after Rust 1.98.1 is installed, selected and verified.

Fresh review-thread enumeration is empty. Exact-current technical COMMENT review 5179832365 re-read the seven-path child range after terminal execution and found no additional writer-safe source/test/documentation/DDD or authority-boundary defect; it is evidence only, not independent approval. This PR is Ready for independent governance review.

Historical evidence — no promotion transfer

Exact 5a1a9e25823fba5f81b0fc2ce5fd3b1205148c6a completed TLS H2 Performance 34607895241, CI 34607895209, Supply Chain 34607895118, and capacity 34607895187 GREEN, but its performance workflow used Rust 1.98.0. Those receipts remain diagnostic only and are not promotion evidence.

An earlier cdfc013097c52385d57f6406cc38fbae84a5c07b measured fresh buyer-path p95 6.2440582 ms, fresh handshake p95 4.16506905 ms, reused buyer-path p95 0.671991 ms, and 396/400 reused requests; it likewise predates the compiler repair and carries no current promotion credit.

Files

• .github/workflows/tls-h2-performance.yml
• tests/tls_h2_performance_toolchain_contract.rs
• tests/load/gateway_tls_h2_performance.js
• tests/load/run_tls_h2_performance.sh
• docs/doctoring/DOWNSTREAM_TLS_H2_PERFORMANCE_TRACEABILITY.md
• TEST_STRATEGY.md
• OPERABILITY.md

Non-claims

Hosted loopback is a regression bound, not production/NUMA/WAN SLO evidence. This does not close supplier Cookie/body framing, #46 representative NUMA execution, foundation #56 protected integration, independent approving review, immutable release, shadow/canary, rollback, cutover or legacy removal. It does not move product auth, Keyverse, Wardnet/EgressWeave, certificate lifecycle or deployment authority into the gateway.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: b71abd81-aea7-43c5-9ac3-793926b820fc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-current technical review only; this is not an independent approval. Scope is writer-safe and limited to release-built TLS/H2 performance evidence. The harness keeps the existing 4 VU / 400 iteration floor, separates fresh downstream connection/TLS cost from reused H2 traffic, verifies HTTP/2 on every measured response, performs no measured-route warm-up, keeps certificate verification enabled, and leaves production routing/auth/identity/security authority unchanged. Hosted workflow evidence is still nonterminal; Ready/merge/release credit must wait for exact-head terminal results and a fresh thread sweep.

[seonghobae]

Exact-current technical review only; not an independent approval. After the executable TLS/H2 performance lane produced a predecessor GREEN receipt, a docs-to-code sweep found TEST_STRATEGY.md and OPERABILITY.md still presenting already-proven H2 behaviors and handshake-vs-reuse timing as unresolved future work. Current head repairs those stale claims without production-code or performance-harness semantic changes. Because the head moved, predecessor performance/CI GREEN is historical only; Ready/merge/release credit waits for fresh exact-head gates and another review/thread sweep.

[seonghobae]

Exact-current technical review only; not an independent approval. Current head adds no production Rust or performance-oracle semantic change after the prior measured GREEN. It repairs stale TEST_STRATEGY/OPERABILITY claims and narrows the expensive workflow trigger so PR-head performance executes through pull_request while protected main retains push, avoiding duplicate branch runs. Because the exact head moved, all predecessor receipts remain historical; Ready/merge/release credit waits for current-head terminal gates and a fresh thread/review sweep.

[seonghobae]

Exact-current technical review only; not an independent approval. Fresh review found that the TLS/H2 performance lane was producing a release-built candidate with Rust 1.98.0 while the repository release compiler contract is Rust 1.98.1. The prior exact 5a1a9e25823fba5f81b0fc2ce5fd3b1205148c6a completed all hosted gates GREEN, but its performance receipt is historical/diagnostic rather than promotion evidence because compiler identity was wrong. Current head installs, selects, and verifies Rust 1.98.1 before Cargo, adds tests/tls_h2_performance_toolchain_contract.rs to prevent drift back to 1.98.0/override/command-local selectors, and updates TRACEABILITY accordingly. No production routing/TLS policy/auth/identity/security semantics changed. Ready/merge/release credit waits for current-head terminal gates and another clean review/thread sweep.

[seonghobae]

Exact-current technical review only; not an independent approval. bf66d0317f2f7709dee611b513f1a44551c1fac9 has independently reacquired CI 34609583884, Supply Chain 34609584385, PgErd bounded-origin capacity 34609583944, and TLS H2 Performance 34609584142 GREEN. The performance lane verified Rust 1.98.1 before the release build and uploaded exact-SHA artifact k6-tls-h2-performance-bf66d0317f2f7709dee611b513f1a44551c1fac9 with digest sha256:e1ea3b1ffe265ac4c2fc8ccee98f9117f6423fb309512f3e1abf5a37dc047754. Fresh/reuse summaries satisfy their executable thresholds; review threads are empty. Re-read of the seven-path child range found no additional writer-safe source/test/documentation/DDD or authority-boundary defect. This is Ready-state evidence only; independent ruleset approval, foundation #56 protected integration, representative NUMA, immutable release and deployment/cutover evidence remain separate.