perf(isolation): add TCP and DNS benchmark harnesses by drew · Pull Request #3229 · NVIDIA/OpenShell

drew · 2026-09-08T22:33:17Z

Summary

Add benchmark harnesses for the RFC 0012 stack. The tests separate startup, DNS, new TCP connections, reused TCP streams, policy denial, and representative live-Internet workloads.

This is a measurement-only layer. General application UDP remains out of scope; DNS retains its normal UDP and TCP behavior through supervisor mediation.

Related Issue

Part of #1737.

Changes

Add a focused native-versus-filtered TCP microbenchmark.
Measure intercepted connection setup and the established-stream fast path.
Add live-Internet and end-to-end network scenarios.
Keep benchmark code behind the perf-harness feature and outside production paths.
Cancel prepared workers and return promptly when another worker fails setup.

Testing

mise run pre-commit
Feature-enabled setup-failure regression test
Feature-enabled Clippy checks
Full benchmark runs delegated to remote CI or dedicated benchmark hosts

Checklist

Follows Conventional Commits
Authored commits are signed off (DCO)

Stack

feat(isolation): implement the RFC 0012 sandbox architecture #2942 — RFC 0012 core architecture
feat(vm): run the supervisor outside the guest workload #2945 — VM driver
feat(docker): isolate workloads behind a companion supervisor #2965 — Docker driver
feat(kubernetes): isolate workloads behind a dedicated supervisor #3144 — Kubernetes driver
feat(podman): isolate workloads behind a separate supervisor #3230 — Podman driver
perf(isolation): add TCP and DNS benchmark harnesses #3229 — performance harnesses (this PR)

copy-pr-bot · 2026-09-08T22:33:20Z

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

github-actions · 2026-09-08T22:36:02Z

Label test:e2e applied, but pull-request/3229 does not exist yet. A maintainer needs to comment /ok to test ef9f882d2b4cddc495f5489638ee2506c237cd38 to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

github-actions · 2026-09-09T04:42:47Z

🌿 Preview your docs: https://nvidia-preview-pr-3229.docs.buildwithfern.com/openshell

johntmyers · 2026-09-14T03:17:46Z

Maintainer Convergence Decision

The autonomous Warning budget is exhausted, and a specific maintainer decision is required before review can proceed. Current head 05d0946bbcb99d6a6c8532e6bf43a3baaa4415ab is rebase-equivalent to the last reviewed performance-harness patch, so Gator did not run another independent review.

Root-cause findings:

GATOR-6ea5a915-02: still unresolved — a worker can fail during connection or warmup before reaching the fixed-participant barrier, leaving the coordinator waiting indefinitely instead of returning the setup error.

Scope growth:

None. This remains the incremental TCP and DNS performance-harness layer atop feat(podman): isolate workloads behind a separate supervisor #3230 in the six-PR RFC 0012 isolation stack.

Reviewer-quality signals:

The ledger carries the same stable finding across reviewed heads; no new or duplicate finding is proposed this cycle.

Maintainer action: decide whether GATOR-6ea5a915-02 must be fixed before pipeline handoff or explicitly waive it as acceptable for this benchmark-only harness. If a fix is required, @drew should push an update that reports readiness or initialization failure before timed execution and cancels or releases the other workers on failure.

Gator metadata

Head SHA: 05d0946bbcb99d6a6c8532e6bf43a3baaa4415ab
Base SHA: 5aad11b3400b71a3cb27d9268bf6693a0dcfb7be
Merge base SHA: 5aad11b3400b71a3cb27d9268bf6693a0dcfb7be
Patch ID: a1e153dca682d0ed125328b0c0808658dd7e0c0f
Gator payload: 8
Review mode: already_reviewed (rebase-equivalent)
Previous reviewed SHA: 8541b56dd908436282f228c0f77845d0f0e0e7c2
Review budget exhausted: yes
Maintainer decision required: yes — resolve or explicitly waive GATOR-6ea5a915-02
Checks: Current-head Branch Checks and E2E are running; Helm Lint and Trivy Changes are green.
E2E: test:e2e is applied and the current-head Branch E2E workflow is dispatched; no /ok to test or rerun action is needed this cycle.
Next state: gator:blocked
Blocked reason: review_convergence_decision_required

johntmyers · 2026-09-14T03:35:19Z

Maintainer Convergence Decision

The autonomous Warning budget is exhausted, and a specific maintainer decision is still required before review can proceed. Current head 15d4cb2c5bb5a6b8d650485102a64d5450cbfd83 is a rebase-equivalent update stacked directly on the current #3230 head, so Gator did not run another independent review.

Root-cause findings:

GATOR-6ea5a915-02: still unresolved — a worker can fail during connection or warmup before reaching the fixed-participant barrier, leaving the coordinator waiting indefinitely instead of returning the setup error.

Scope growth:

None. This remains the incremental TCP and DNS performance-harness layer atop feat(podman): isolate workloads behind a separate supervisor #3230 in the six-PR RFC 0012 isolation stack.

Reviewer-quality signals:

No reviewer ran and no new finding was proposed this cycle. The ledger's repeated-ID telemetry reflects durable findings carried across head SHAs, not a new author defect.

Maintainer action: decide whether GATOR-6ea5a915-02 must be fixed before pipeline handoff or explicitly waive it as acceptable for this benchmark-only harness. If a fix is required, @drew should push an update that reports readiness or initialization failure before timed execution and cancels or releases the other workers on failure.

Gator metadata

Head SHA: 15d4cb2c5bb5a6b8d650485102a64d5450cbfd83
Base SHA: 4ff4dcdd3e3a29ef023edffddc67142d6652f210
Merge base SHA: 4ff4dcdd3e3a29ef023edffddc67142d6652f210
Patch ID: a1e153dca682d0ed125328b0c0808658dd7e0c0f
Gator payload: 8
Review mode: already_reviewed (rebase-equivalent)
Previous reviewed SHA: 8541b56dd908436282f228c0f77845d0f0e0e7c2
Review budget exhausted: yes
Maintainer decision required: yes — resolve or explicitly waive GATOR-6ea5a915-02
Checks: Current-head Branch Checks and E2E are running; Helm Lint and Trivy Changes are green.
E2E: test:e2e is applied and the current-head Branch E2E workflow is dispatched; no /ok to test or rerun action is needed this cycle.
Next state: gator:blocked
Blocked reason: review_convergence_decision_required

johntmyers · 2026-09-14T03:53:02Z

Maintainer Convergence Decision

The autonomous Warning budget is exhausted, and a specific maintainer decision is still required before review can proceed. Current head 77fc224f6db6abd6aa692cd2aaec4af6c6e39c56 is a rebase-equivalent update stacked directly on the current #3230 head, so Gator did not run another independent review.

Root-cause findings:

GATOR-6ea5a915-02: still unresolved — a worker can fail during connection or warmup before reaching the fixed-participant barrier, leaving the coordinator waiting indefinitely instead of returning the setup error.

Scope growth:

None. This remains the incremental TCP and DNS performance-harness layer atop feat(podman): isolate workloads behind a separate supervisor #3230 in the six-PR RFC 0012 isolation stack.

Reviewer-quality signals:

No reviewer ran and no new finding was proposed this cycle. The ledger's repeated-ID telemetry reflects durable findings carried across head SHAs, not a new author defect.

Maintainer action: decide whether GATOR-6ea5a915-02 must be fixed before pipeline handoff or explicitly waive it as acceptable for this benchmark-only harness. If a fix is required, @drew should push an update that reports readiness or initialization failure before timed execution and cancels or releases the other workers on failure.

Gator metadata

Head SHA: 77fc224f6db6abd6aa692cd2aaec4af6c6e39c56
Base SHA: be63ec235411c416f1192b7ba7fc7561765e9747
Merge base SHA: be63ec235411c416f1192b7ba7fc7561765e9747
Patch ID: a1e153dca682d0ed125328b0c0808658dd7e0c0f
Gator payload: 8
Review mode: already_reviewed (rebase-equivalent)
Previous reviewed SHA: 8541b56dd908436282f228c0f77845d0f0e0e7c2
Review budget exhausted: yes
Maintainer decision required: yes — resolve or explicitly waive GATOR-6ea5a915-02
Checks: Current-head Branch Checks and E2E are running; Helm Lint and Trivy Changes are green.
E2E: test:e2e is applied and the current-head Branch E2E workflow is dispatched; no /ok to test or rerun action is needed this cycle.
Next state: gator:blocked
Blocked reason: review_convergence_decision_required

johntmyers · 2026-09-14T04:10:13Z

Maintainer Convergence Decision

The autonomous Warning budget is exhausted, and a specific maintainer decision is still required before review can proceed. Current head 547884aeb15831a113256f1b08f471411edfaa7e is a rebase-equivalent update stacked directly on the current #3230 head, so Gator did not run another independent review.

Root-cause findings:

GATOR-6ea5a915-02: still unresolved — a worker can fail during connection or warmup before reaching the fixed-participant barrier, leaving the coordinator waiting indefinitely instead of returning the setup error.

Scope growth:

None. This remains the incremental TCP and DNS performance-harness layer atop feat(podman): isolate workloads behind a separate supervisor #3230 in the six-PR RFC 0012 isolation stack rooted at feat(isolation): implement the RFC 0012 sandbox architecture #2942.

Reviewer-quality signals:

No reviewer ran and no new finding was proposed this cycle. The ledger's repeated-ID telemetry reflects durable findings carried across head SHAs, not a new author defect.

Maintainer action: decide whether GATOR-6ea5a915-02 must be fixed before pipeline handoff or explicitly waive it as acceptable for this benchmark-only harness. If a fix is required, @drew should push an update that reports readiness or initialization failure before timed execution and cancels or releases the other workers on failure.

Gator metadata

Head SHA: 547884aeb15831a113256f1b08f471411edfaa7e
Base SHA: d8d7def7637f60af45b82a2676cea44265d39c73
Merge base SHA: d8d7def7637f60af45b82a2676cea44265d39c73
Patch ID: a1e153dca682d0ed125328b0c0808658dd7e0c0f
Gator payload: 8
Review mode: already_reviewed (rebase-equivalent)
Previous reviewed SHA: 8541b56dd908436282f228c0f77845d0f0e0e7c2
Review budget exhausted: yes
Maintainer decision required: yes — resolve or explicitly waive GATOR-6ea5a915-02
Checks: Current-head Branch Checks and E2E are running; Helm Lint and Trivy Changes are green.
E2E: test:e2e is applied and the current-head Branch E2E workflow is dispatched; no /ok to test or rerun action is needed this cycle.
Next state: gator:blocked
Blocked reason: review_convergence_decision_required

johntmyers · 2026-09-14T04:27:13Z

Maintainer Convergence Decision

The autonomous Warning budget is exhausted, and a specific maintainer decision is still required before review can proceed. Current head 88252a42297b61b1451114060746f543eeeda3cd is a rebase-equivalent update stacked directly on the current #3230 head, so Gator did not run another independent review.

Root-cause findings:

GATOR-6ea5a915-02: still unresolved — a worker can fail during connection or warmup before reaching the fixed-participant barrier, leaving the coordinator waiting indefinitely instead of returning the setup error.

Scope growth:

None. This remains the incremental TCP and DNS performance-harness layer atop feat(podman): isolate workloads behind a separate supervisor #3230 in the six-PR RFC 0012 isolation stack rooted at feat(isolation): implement the RFC 0012 sandbox architecture #2942.

Reviewer-quality signals:

No reviewer ran and no new finding was proposed this cycle. The ledger's repeated-ID telemetry reflects durable findings carried across head SHAs, not a new author defect.

Maintainer action: decide whether GATOR-6ea5a915-02 must be fixed before pipeline handoff or explicitly waive it as acceptable for this benchmark-only harness. If a fix is required, @drew should push an update that reports readiness or initialization failure before timed execution and cancels or releases the other workers on failure.

Gator metadata

Head SHA: 88252a42297b61b1451114060746f543eeeda3cd
Base SHA: 6bf038bc8f0de0bbe2397c125c09e5f97d50550b
Merge base SHA: 6bf038bc8f0de0bbe2397c125c09e5f97d50550b
Patch ID: a1e153dca682d0ed125328b0c0808658dd7e0c0f
Gator payload: 8
Review mode: already_reviewed (rebase-equivalent)
Previous reviewed SHA: 8541b56dd908436282f228c0f77845d0f0e0e7c2
Review budget exhausted: yes
Maintainer decision required: yes — resolve or explicitly waive GATOR-6ea5a915-02
Checks: Current-head Branch Checks and E2E are running; Helm Lint and Trivy Changes are green.
E2E: test:e2e is applied and the current-head Branch E2E workflow is dispatched; no /ok to test or rerun action is needed this cycle.
Next state: gator:blocked
Blocked reason: review_convergence_decision_required

johntmyers · 2026-09-14T04:45:26Z

Maintainer Convergence Decision

The autonomous Warning budget is exhausted, and a specific maintainer decision is still required before review can proceed. Current head d29731708ac04a2278b3128a9c633ee4b52fbee5 is a rebase-equivalent update stacked directly on the current #3230 head, so Gator did not run another independent review.

Root-cause findings:

GATOR-6ea5a915-02: still unresolved — a worker can fail during connection or warmup before reaching the fixed-participant barrier, leaving the coordinator waiting indefinitely instead of returning the setup error.

Scope growth:

None. This remains the incremental TCP and DNS performance-harness layer atop feat(podman): isolate workloads behind a separate supervisor #3230 in the six-PR RFC 0012 isolation stack rooted at feat(isolation): implement the RFC 0012 sandbox architecture #2942.

Reviewer-quality signals:

No reviewer ran and no new finding was proposed this cycle. The ledger's repeated-ID telemetry reflects durable findings carried across head SHAs, not a new author defect.

Maintainer action: decide whether GATOR-6ea5a915-02 must be fixed before pipeline handoff or explicitly waive it as acceptable for this benchmark-only harness. If a fix is required, @drew should push an update that reports readiness or initialization failure before timed execution and cancels or releases the other workers on failure.

Gator metadata

Head SHA: d29731708ac04a2278b3128a9c633ee4b52fbee5
Base SHA: 60ab7be71764b2b459a529d5a8f82d6bac132cc1
Merge base SHA: 60ab7be71764b2b459a529d5a8f82d6bac132cc1
Patch ID: a1e153dca682d0ed125328b0c0808658dd7e0c0f
Gator payload: 8
Review mode: already_reviewed (rebase-equivalent)
Previous reviewed SHA: 8541b56dd908436282f228c0f77845d0f0e0e7c2
Review budget exhausted: yes
Maintainer decision required: yes — resolve or explicitly waive GATOR-6ea5a915-02
Checks: Current-head Branch Checks and E2E are queued or running; Helm Lint and Trivy Changes are green.
E2E: test:e2e is applied and the current-head Branch E2E workflow is dispatched; no /ok to test or rerun action is needed this cycle.
Next state: gator:blocked
Blocked reason: review_convergence_decision_required

johntmyers · 2026-09-14T05:20:54Z

Maintainer Convergence Decision

The autonomous Warning budget is exhausted, and a specific maintainer decision is still required before review can proceed. Current head a98d434e714f967416c0085eed87ce377745049c is a rebase-equivalent update stacked directly on the current #3230 head, so Gator did not run another independent review.

Root-cause findings:

GATOR-6ea5a915-02: still unresolved — a worker can fail during connection or warmup before reaching the fixed-participant barrier, leaving the coordinator waiting indefinitely instead of returning the setup error.

Scope growth:

None. This remains the incremental TCP and DNS performance-harness layer atop feat(podman): isolate workloads behind a separate supervisor #3230 in the six-PR RFC 0012 isolation stack rooted at feat(isolation): implement the RFC 0012 sandbox architecture #2942.

Reviewer-quality signals:

No reviewer ran and no new finding was proposed this cycle. The ledger's repeated-ID telemetry reflects durable findings carried across head SHAs, not a new author defect.

Maintainer action: decide whether GATOR-6ea5a915-02 must be fixed before pipeline handoff or explicitly waive it as acceptable for this benchmark-only harness. If a fix is required, @drew should push an update that reports readiness or initialization failure before timed execution and cancels or releases the other workers on failure.

Gator metadata

Head SHA: a98d434e714f967416c0085eed87ce377745049c
Base SHA: 2524bee186a3e7fa8f320ac4d1cc94298a2c9e46
Merge base SHA: 2524bee186a3e7fa8f320ac4d1cc94298a2c9e46
Patch ID: a1e153dca682d0ed125328b0c0808658dd7e0c0f
Gator payload: 8
Review mode: already_reviewed (rebase-equivalent)
Previous reviewed SHA: 8541b56dd908436282f228c0f77845d0f0e0e7c2
Review budget exhausted: yes
Maintainer decision required: yes — resolve or explicitly waive GATOR-6ea5a915-02
Checks: Current-head Branch Checks and E2E are running and include failed jobs; Helm Lint and Trivy Changes are green.
E2E: test:e2e is applied and the current-head Branch E2E workflow is dispatched; no /ok to test or rerun action is needed this cycle.
Next state: gator:blocked
Blocked reason: review_convergence_decision_required

johntmyers · 2026-09-14T05:38:20Z

Maintainer Convergence Decision

The autonomous Warning budget is exhausted, and a specific maintainer decision is still required before review can proceed. Current head d230474fae8fc8b5a38387a06875315de2bafc72 is a rebase-equivalent update stacked directly on the current #3230 head, so Gator did not run another independent review.

Root-cause findings:

GATOR-6ea5a915-02: still unresolved — a worker can fail during connection or warmup before reaching the fixed-participant barrier, leaving the coordinator waiting indefinitely instead of returning the setup error.

Scope growth:

None. This remains the incremental TCP and DNS performance-harness layer atop feat(podman): isolate workloads behind a separate supervisor #3230 in the six-PR RFC 0012 isolation stack rooted at feat(isolation): implement the RFC 0012 sandbox architecture #2942.

Reviewer-quality signals:

No reviewer ran and no new finding was proposed this cycle. The ledger's repeated-ID telemetry reflects durable findings carried across head SHAs, not a new author defect.

Maintainer action: decide whether GATOR-6ea5a915-02 must be fixed before pipeline handoff or explicitly waive it as acceptable for this benchmark-only harness. If a fix is required, @drew should push an update that reports readiness or initialization failure before timed execution and cancels or releases the other workers on failure.

Gator metadata

Head SHA: d230474fae8fc8b5a38387a06875315de2bafc72
Base SHA: 851deaca46f3e60a157d191d90153a89eaca5ca9
Merge base SHA: 851deaca46f3e60a157d191d90153a89eaca5ca9
Patch ID: a1e153dca682d0ed125328b0c0808658dd7e0c0f
Gator payload: 8
Review mode: already_reviewed (rebase-equivalent)
Previous reviewed SHA: 8541b56dd908436282f228c0f77845d0f0e0e7c2
Review budget exhausted: yes
Maintainer decision required: yes — resolve or explicitly waive GATOR-6ea5a915-02
Checks: Current-head Branch Checks and E2E are queued or running; Helm Lint and Trivy Changes are green.
E2E: test:e2e is applied and the current-head Branch E2E workflow is dispatched; no /ok to test or rerun action is needed this cycle.
Next state: gator:blocked
Blocked reason: review_convergence_decision_required

johntmyers · 2026-09-14T05:56:39Z

Maintainer Convergence Decision

The autonomous Warning budget is exhausted, and a specific maintainer decision is still required before review can proceed. Current head e22c3e6867970c1c3de004f36f516a2a5ce18e5d is a rebase-equivalent update stacked directly on the current #3230 head, so Gator did not run another independent review.

Root-cause findings:

GATOR-6ea5a915-02: still unresolved — a worker can fail during connection or warmup before reaching the fixed-participant barrier, leaving the coordinator waiting indefinitely instead of returning the setup error.

Scope growth:

None. This remains the incremental TCP and DNS performance-harness layer atop feat(podman): isolate workloads behind a separate supervisor #3230 in the six-PR RFC 0012 isolation stack rooted at feat(isolation): implement the RFC 0012 sandbox architecture #2942.

Reviewer-quality signals:

No reviewer ran and no new finding was proposed this cycle. The ledger's repeated-ID telemetry reflects durable findings carried across head SHAs, not a new author defect.

Maintainer action: decide whether GATOR-6ea5a915-02 must be fixed before pipeline handoff or explicitly waive it as acceptable for this benchmark-only harness. If a fix is required, @drew should push an update that reports readiness or initialization failure before timed execution and cancels or releases the other workers on failure.

Gator metadata

Head SHA: e22c3e6867970c1c3de004f36f516a2a5ce18e5d
Base SHA: 93466075cc6e5d3c51c024c301fa9e8de59d55d1
Merge base SHA: 93466075cc6e5d3c51c024c301fa9e8de59d55d1
Patch ID: a1e153dca682d0ed125328b0c0808658dd7e0c0f
Gator payload: 8
Review mode: already_reviewed (rebase-equivalent)
Previous reviewed SHA: 8541b56dd908436282f228c0f77845d0f0e0e7c2
Review budget exhausted: yes
Maintainer decision required: yes — resolve or explicitly waive GATOR-6ea5a915-02
Checks: Current-head Branch Checks and E2E are queued or running; Helm Lint and Trivy Changes are green.
E2E: test:e2e is applied and the current-head Branch E2E workflow is dispatched; no /ok to test or rerun action is needed this cycle.
Next state: gator:blocked
Blocked reason: review_convergence_decision_required

johntmyers · 2026-09-14T06:15:37Z

Maintainer Convergence Decision

The autonomous Warning budget is exhausted, and a specific maintainer decision is still required before review can proceed. Current head 60c4c4f3d48c1287f1052e2678f7a82fee99bb22 is a rebase-equivalent update stacked directly on the current #3230 head, so Gator did not run another independent review.

Root-cause findings:

GATOR-6ea5a915-02: still unresolved — a worker can fail during connection or warmup before reaching the fixed-participant barrier, leaving the coordinator waiting indefinitely instead of returning the setup error.

Scope growth:

None. This remains the incremental TCP and DNS performance-harness layer atop feat(podman): isolate workloads behind a separate supervisor #3230 in the six-PR RFC 0012 isolation stack rooted at feat(isolation): implement the RFC 0012 sandbox architecture #2942.

Reviewer-quality signals:

No reviewer ran and no new finding was proposed this cycle. The ledger reports 3 finding-bearing rounds and 18 duplicate finding-ID occurrences; those repeats are durable findings carried across rebase-equivalent heads, not new author defects.

Maintainer action: decide whether GATOR-6ea5a915-02 must be fixed before pipeline handoff or explicitly waive it as acceptable for this benchmark-only harness. If a fix is required, @drew should push an update that reports readiness or initialization failure before timed execution and cancels or releases the other workers on failure.

Gator metadata

Head SHA: 60c4c4f3d48c1287f1052e2678f7a82fee99bb22
Base SHA: b69287ac826e1999061a2dfc67e03024f41aef9a
Merge base SHA: b69287ac826e1999061a2dfc67e03024f41aef9a
Patch ID: a1e153dca682d0ed125328b0c0808658dd7e0c0f
Gator payload: 8
Review mode: already_reviewed (rebase-equivalent)
Previous reviewed SHA: 8541b56dd908436282f228c0f77845d0f0e0e7c2
Review budget exhausted: yes
Maintainer decision required: yes — resolve or explicitly waive GATOR-6ea5a915-02
Checks: Current-head Branch Checks and E2E are queued or running; Helm Lint and Trivy Changes are green.
E2E: test:e2e is applied and the current-head Branch E2E workflow is dispatched; no /ok to test or rerun action is needed this cycle.
Next state: gator:blocked
Blocked reason: review_convergence_decision_required

johntmyers · 2026-09-14T06:51:11Z

Maintainer Convergence Decision

The autonomous Warning budget is exhausted, and a specific maintainer decision is still required before review can proceed. Current head ebaba1891f8f2caba7020f31c74f29ac005222f7 is a rebase-equivalent update stacked directly on the current #3230 head, so Gator did not run another independent review.

Root-cause findings:

GATOR-6ea5a915-02: still unresolved — a worker can fail during connection or warmup before reaching the fixed-participant barrier, leaving the coordinator waiting indefinitely instead of returning the setup error.

Scope growth:

None. This remains the incremental TCP and DNS performance-harness layer atop feat(podman): isolate workloads behind a separate supervisor #3230 in the six-PR RFC 0012 isolation stack rooted at feat(isolation): implement the RFC 0012 sandbox architecture #2942.

Reviewer-quality signals:

No reviewer ran and no new finding was proposed this cycle. The ledger's repeated-ID telemetry reflects the same durable findings carried across rebased heads, not a new author defect.

Maintainer action: decide whether GATOR-6ea5a915-02 must be fixed before pipeline handoff or explicitly waive it as acceptable for this benchmark-only harness. If a fix is required, @drew should push an update that reports readiness or initialization failure before timed execution and cancels or releases the other workers on failure.

Gator metadata

Head SHA: ebaba1891f8f2caba7020f31c74f29ac005222f7
Base SHA: 0c9ba2a7185937438c91e0062fccba5b3ccb1854
Merge base SHA: 0c9ba2a7185937438c91e0062fccba5b3ccb1854
Patch ID: a1e153dca682d0ed125328b0c0808658dd7e0c0f
Gator payload: 8
Review mode: already_reviewed (rebase-equivalent)
Previous reviewed SHA: 8541b56dd908436282f228c0f77845d0f0e0e7c2
Review budget exhausted: yes
Maintainer decision required: yes — resolve or explicitly waive GATOR-6ea5a915-02
Checks: Current-head Branch Checks and E2E are running; Helm Lint and the latest Trivy Changes run are green.
E2E: test:e2e is applied and the current-head Branch E2E workflow is dispatched; no /ok to test or rerun action is needed this cycle.
Next state: gator:blocked
Blocked reason: review_convergence_decision_required

johntmyers · 2026-09-14T07:26:28Z

Maintainer Convergence Decision

The autonomous Warning budget is exhausted, and a specific maintainer decision is still required before review can proceed. Current head 2805520c7dcd254da741de0b2cf5564030e4684d is a rebase-equivalent update stacked directly on the current #3230 head, so Gator did not run another independent review.

Root-cause findings:

GATOR-6ea5a915-02: still unresolved — a worker can fail during connection or warmup before reaching the fixed-participant barrier, leaving the coordinator waiting indefinitely instead of returning the setup error.

Scope growth:

None. This remains the incremental TCP and DNS performance-harness layer atop feat(podman): isolate workloads behind a separate supervisor #3230 in the six-PR RFC 0012 isolation stack rooted at feat(isolation): implement the RFC 0012 sandbox architecture #2942.

Reviewer-quality signals:

No reviewer ran and no new finding was proposed this cycle. The ledger reports 3 finding-bearing rounds and 20 duplicate finding-ID occurrences; those repeats are durable findings carried across rebase-equivalent heads, not new author defects.

Maintainer action: decide whether GATOR-6ea5a915-02 must be fixed before pipeline handoff or explicitly waive it as acceptable for this benchmark-only harness. If a fix is required, @drew should push an update that reports readiness or initialization failure before timed execution and cancels or releases the other workers on failure.

Gator metadata

Head SHA: 2805520c7dcd254da741de0b2cf5564030e4684d
Base SHA: 5bf6e66596eee4c04ab4c7262897b2f9e59cd874
Merge base SHA: 5bf6e66596eee4c04ab4c7262897b2f9e59cd874
Patch ID: a1e153dca682d0ed125328b0c0808658dd7e0c0f
Gator payload: 8
Review mode: already_reviewed (rebase-equivalent)
Previous reviewed SHA: 8541b56dd908436282f228c0f77845d0f0e0e7c2
Review budget exhausted: yes
Maintainer decision required: yes — resolve or explicitly waive GATOR-6ea5a915-02
Checks: Current-head Branch Checks and E2E are running; Helm Lint and Trivy Changes are green.
E2E: test:e2e is applied and the current-head Branch E2E workflow is dispatched; no /ok to test or rerun action is needed this cycle.
Next state: gator:blocked
Blocked reason: review_convergence_decision_required

johntmyers · 2026-09-14T16:06:40Z

Re-check After Author Update

Thanks @drew. I re-evaluated head 505428f9ad1462386f19d73e21a5a28cc421acc1 after your reply explaining the worker-startup cancellation fix.

What I checked: the latest author-only perf.rs delta, the readiness and start-channel protocol, bounded connection/read/write behavior, the setup-failure regression case, and the durable Gator feedback ledger. Prepared workers are now released when a peer fails, every worker reports preparation before measurement, and the coordinator returns the setup error instead of waiting on a fixed-participant barrier.

Disposition: GATOR-6ea5a915-02 is resolved. The required critical-only review found no newly introduced Critical defect, so no blocking items remain and no maintainer convergence decision is needed.

Remaining items:

No blocking review items remain; current-head Branch Checks and E2E are running.

Gator metadata

Validation: Measurement-only TCP and DNS performance-harness layer for the six-PR RFC 0012 isolation stack rooted at feat(isolation): implement the RFC 0012 sandbox architecture #2942, incrementally based on current feat(podman): isolate workloads behind a separate supervisor #3230 and linked to feat: establish the Isolation Backend interface #1737.
Docs: Published Fern docs are not needed because this adds opt-in developer performance harnesses without changing product UX.
Checks: Current-head Branch Checks and E2E are queued or running; Helm Lint and Trivy Changes are green.
E2E: test:e2e is applied and the current-head Branch E2E workflow is running; no /ok to test or rerun action is needed this cycle.
Head SHA: 505428f9ad1462386f19d73e21a5a28cc421acc1
Base SHA: af59258799e2df7821e2424872f9b774fe775236
Merge base SHA: af59258799e2df7821e2424872f9b774fe775236
Patch ID: 975a50ff8381daa5991bf4c74b545c0037100500
Gator payload: 8
Review mode: critical_only
Previous reviewed SHA: 8541b56dd908436282f228c0f77845d0f0e0e7c2
Review budget exhausted: yes
Maintainer decision required: no
Next state: gator:watch-pipeline

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

johntmyers · 2026-09-14T16:59:13Z

Maintainer Approval Needed

Gator validation and PR monitoring are complete for the incremental TCP and DNS performance-harness layer atop #3230 in the six-PR RFC 0012 isolation stack rooted at #2942. The current patch is rebase-equivalent to the reviewed fix, all three durable findings are resolved, and the critical-only convergence review found no newly introduced Critical defect.

Human maintainer approval is now required.

Gator metadata

Validation: Measurement-only developer harnesses remain outside production paths and are linked to feat: establish the Isolation Backend interface #1737 and the RFC 0012 stack.
Docs: Published Fern docs are not needed because this adds opt-in developer performance tooling without changing product UX.
Checks: Current-head Branch Checks, Helm Lint, Trivy Changes, and all required E2E gates are green.
E2E: test:e2e is applied; Branch E2E run 34869062835 completed successfully for the current head.
Head SHA: 836859a8f59d7ebe1ab5581878705dbbcf0695fb
Base SHA: 238196fa56d5dab23133290c655c71ba717bf4e2
Merge base SHA: 238196fa56d5dab23133290c655c71ba717bf4e2
Patch ID: 975a50ff8381daa5991bf4c74b545c0037100500
Gator payload: 8
Review mode: already_reviewed (rebase-equivalent)
Previous reviewed SHA: 505428f9ad1462386f19d73e21a5a28cc421acc1
Review budget exhausted: yes
Maintainer decision required: no
Next state: gator:approval-needed

johntmyers · 2026-09-14T20:19:17Z

Monitoring Complete

Monitoring is complete because this PR has merged.

Final status: the incremental TCP and DNS performance-harness layer completed Gator review with all three durable findings resolved, the required current-head checks including E2E green, and was awaiting maintainer approval when it merged.

I removed the active gator:* label because there is nothing left for gator to monitor on this PR.

Gator metadata

Head SHA: 836859a8f59d7ebe1ab5581878705dbbcf0695fb
Gator payload: 8
Previous state: gator:approval-needed
Final state: merged

drew added the test:e2e Requires end-to-end coverage label Sep 8, 2026

drew marked this pull request as ready for review September 8, 2026 22:36

drew requested review from a team, derekwaynecarr, mrunalp and sjenning as code owners September 8, 2026 22:36

drew force-pushed the codex/1737-rfc12-network-perf branch 2 times, most recently from 3ab20c9 to cbef8e4 Compare September 9, 2026 04:39

drew mentioned this pull request Sep 9, 2026

feat(podman): isolate workloads behind a separate supervisor #3230

Merged

5 tasks

drew removed this pull request from stack #3152 September 9, 2026 04:42

drew changed the base branch from codex/kubernetes-proxy-pod-isolation to codex/podman-host-supervisor September 9, 2026 04:42

drew added this pull request to stack #3231 September 9, 2026 04:42

drew force-pushed the codex/1737-rfc12-network-perf branch from cbef8e4 to 1f345c2 Compare September 9, 2026 04:53

drew force-pushed the codex/1737-rfc12-network-perf branch from 1f345c2 to 1a88b94 Compare September 9, 2026 05:03

drew force-pushed the codex/1737-rfc12-network-perf branch from 1a88b94 to 002d3e8 Compare September 9, 2026 05:14

drew force-pushed the codex/1737-rfc12-network-perf branch from 002d3e8 to be8526a Compare September 9, 2026 05:27

johntmyers added gator:blocked Gator is blocked by process or repository gates and removed gator:in-review Gator is reviewing or awaiting PR review feedback labels Sep 14, 2026

drew force-pushed the codex/1737-rfc12-network-perf branch 2 times, most recently from 84b4789 to 15d4cb2 Compare September 14, 2026 03:31

drew force-pushed the codex/1737-rfc12-network-perf branch from 15d4cb2 to 74c3f9e Compare September 14, 2026 03:43

drew force-pushed the codex/1737-rfc12-network-perf branch from 74c3f9e to 77fc224 Compare September 14, 2026 03:50

drew added 4 commits September 14, 2026 09:29

perf(isolation): add TCP and DNS benchmark harnesses

d01fa6a

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

fix(perf): align benchmark timing and supported protocols

678d78c

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

fix(perf): report TCP benchmark metrics accurately

772e549

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

fix(perf): cancel failed worker startup

836859a

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Conversation

drew commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Issue

Changes

Testing

Checklist

Stack

Uh oh!

copy-pr-bot Bot commented Sep 8, 2026

Uh oh!

github-actions Bot commented Sep 8, 2026

Uh oh!

github-actions Bot commented Sep 9, 2026

Uh oh!

johntmyers commented Sep 14, 2026

Maintainer Convergence Decision

Uh oh!

johntmyers commented Sep 14, 2026

Maintainer Convergence Decision

Uh oh!

johntmyers commented Sep 14, 2026

Maintainer Convergence Decision

Uh oh!

johntmyers commented Sep 14, 2026

Maintainer Convergence Decision

Uh oh!

johntmyers commented Sep 14, 2026

Maintainer Convergence Decision

Uh oh!

johntmyers commented Sep 14, 2026

Maintainer Convergence Decision

Uh oh!

johntmyers commented Sep 14, 2026

Maintainer Convergence Decision

Uh oh!

johntmyers commented Sep 14, 2026

Maintainer Convergence Decision

Uh oh!

johntmyers commented Sep 14, 2026

Maintainer Convergence Decision

Uh oh!

johntmyers commented Sep 14, 2026

Maintainer Convergence Decision

Uh oh!

johntmyers commented Sep 14, 2026

Maintainer Convergence Decision

Uh oh!

johntmyers commented Sep 14, 2026

Maintainer Convergence Decision

Uh oh!

johntmyers commented Sep 14, 2026

Re-check After Author Update

Uh oh!

johntmyers commented Sep 14, 2026

Maintainer Approval Needed

Uh oh!

johntmyers commented Sep 14, 2026

Monitoring Complete

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

drew commented Sep 8, 2026 •

edited

Loading