feat(benchmark): harden harness, add small-host profile, refresh dependencies

.codex/agents/architect.toml

@@ -4,5 +4,5 @@ sandbox_mode = "read-only"
 developer_instructions = """
 Act as the project architect for framework-benchmark. Read AGENTS.md, CODING_CONVENTION.md, CODEBASE.md, and relevant specialist instructions before planning. Apply relevant skills from .agents/skills/ by reading their SKILL.md files.
 
-Return explicit assumptions, scope, affected ownership boundaries, dependencies, a small ordered plan conforming to the 200 LOC per file hard ceiling, and verifiable acceptance criteria. Identify which existing domain specialist should guide or perform each slice. Keep the plan aligned with Rust 1.85+, zero-allocation hot paths, Data-Oriented Design, Functional Programming, Linux style, and zero emojis. Do not implement or edit files.
+Return explicit assumptions, scope, affected ownership boundaries, dependencies, a small ordered plan conforming to the 200 LOC per file hard ceiling, and verifiable acceptance criteria. Identify which existing domain specialist should guide or perform each slice. Keep the plan aligned with Rust 1.90+, zero-allocation hot paths, Data-Oriented Design, Functional Programming, Linux style, and zero emojis. Do not implement or edit files.
 """

.codex/config.toml

@@ -1,2 +1,8 @@
 [agents]
 max_concurrent_threads_per_session = 4
+
+[mcp_servers.graphify]
+command = "graphify-mcp"
+args = ["graphify-out/graph.json"]
+cwd = "."
+startup_timeout_sec = 20

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -47,7 +47,7 @@ body:
     attributes:
       label: Environment & Toolchain
       description: Information about your OS, Kernel version, Rust version, Docker/Nix setup, and libc (glibc/musl).
-      placeholder: E.g. Ubuntu 24.04 (Linux 6.8), Rust 1.85, Docker 27.0, Nix 2.24
+      placeholder: E.g. Ubuntu 24.04 (Linux 6.8), Rust 1.90, Docker 27.0, Nix 2.30
     validations:
       required: true
   - type: textarea

.github/workflows/benchmark.yml

@@ -11,6 +11,9 @@ on:
     # Run nightly at 00:00 UTC
     - cron: '0 0 * * *'
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: false
@@ -19,6 +22,7 @@ jobs:
   benchmark:
     name: Run Benchmark Suite
     runs-on: [self-hosted, linux, x64, benchmark-dedicated]
+    timeout-minutes: 360
     env:
       BENCHMARK_FRAMEWORK_FILTER: ${{ inputs.framework_filter || 'all' }}
       BENCHMARK_DEDICATED_HOST: '1'
@@ -27,13 +31,17 @@ jobs:
       BENCHMARK_CGROUP_PARENT: framework-benchmark
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Install stable Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+        with:
+          toolchain: "1.90.0"
 
       - name: Cache cargo dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: |
             ~/.cargo/registry/index/
@@ -48,13 +56,18 @@ jobs:
         run: sh scripts/verify_host.sh --require-dedicated
 
       - name: Build benchmark orchestrator
-        run: cargo build --release --bin orchestrator
+        run: cargo build --release --locked --bin orchestrator
 
       - name: Run orchestrator
         run: taskset --cpu-list "$BENCHMARK_LOAD_CPUS" ./target/release/orchestrator frameworks results
 
+      - name: Clean up benchmark resources
+        if: always()
+        continue-on-error: true
+        run: sh scripts/cleanup_environment.sh --apply
+
       - name: Upload benchmark artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: benchmark-results
           path: |

.github/workflows/benchmark_small_smoke.yml

@@ -0,0 +1,43 @@
+name: Benchmark Small-Host Smoke
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 3 * * 0"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  small-host:
+    name: Cpeak bounded smoke
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+        with:
+          toolchain: "1.90.0"
+          components: "clippy, rustfmt"
+
+      - name: Cache cargo dependencies
+        uses: Swatinem/rust-cache@e9d7b9f1e587218970671bac74e5511ed9506e6a # v2
+
+      - name: Validate the bounded profile
+        run: scripts/run_small_host.sh --check-only
+
+      - name: Build and run one framework
+        run: scripts/run_small_host.sh cpeak
+
+      - name: Show generated artifacts
+        if: always()
+        run: find results -maxdepth 3 -type f 2>/dev/null | sort | head -50

.github/workflows/benchmark_smoke.yml

@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
       - name: Build and exercise both variants
@@ -38,6 +38,7 @@ jobs:
           for libc in glibc musl; do
             image="benchmark-smoke:cpeak-${libc}"
             name="benchmark-smoke-${libc}"
+            trap 'docker stop --time 5 "$name" >/dev/null 2>&1 || true' EXIT
             docker build --file "Dockerfile.${libc}" --tag "$image" .
             docker run --detach --rm --network host --name "$name" "$image"
             for _ in $(seq 1 20); do
@@ -46,4 +47,5 @@ jobs:
             done
             test "$(curl --fail --silent http://127.0.0.1:8080/plaintext)" = 'Hello, World!'
             docker stop --time 5 "$name"
+            trap - EXIT
           done

.github/workflows/cpp-lint.yml

@@ -19,7 +19,7 @@ jobs:
     environment:
       name: lint-cpp
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
       - name: Install clang-format

.github/workflows/csharp-lint.yml

@@ -19,12 +19,12 @@ jobs:
     environment:
       name: lint-csharp
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: actions/setup-dotnet@v6
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
         with:
-          dotnet-version: 9.0.x
+          dotnet-version: 10.0.x
       - name: Check formatting
         shell: bash
         run: |

.github/workflows/go-lint.yml

@@ -19,12 +19,12 @@ jobs:
     environment:
       name: lint-go
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
-          go-version: 1.23.0
+          go-version: 1.26.10
           check-latest: false
           cache-dependency-path: frameworks/web-server/go/*/go.mod
       - name: Check formatting

.github/workflows/java-lint.yml

@@ -19,10 +19,10 @@ jobs:
     environment:
       name: lint-java
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: actions/setup-java@v6
+      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
         with:
           distribution: temurin
           java-version: 21

.github/workflows/javascript-lint.yml

@@ -19,11 +19,11 @@ jobs:
     environment:
       name: lint-javascript
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.3
+          bun-version: 1.4.3
       - name: Check formatting
-        run: bunx --bun prettier@3.5.3 --check 'frameworks/web-server/javascript/**/*.{js,ts}'
+        run: bunx --bun prettier@3.9.10 --check 'frameworks/web-server/javascript/**/*.{js,ts}'

.github/workflows/lint.yml

@@ -5,44 +5,56 @@ on:
     branches:
       - main
     paths:
+      - "**/*.md"
+      - "**/*.toml"
+      - "**/*.yml"
+      - "**/*.yaml"
       - Cargo.toml
       - Cargo.lock
       - crates/**
-      - scripts/check_conventions.sh
+      - frameworks/**
+      - scripts/**
+      - templates/**
       - .github/workflows/lint.yml
   pull_request:
     branches:
       - main
     paths:
+      - "**/*.md"
+      - "**/*.toml"
+      - "**/*.yml"
+      - "**/*.yaml"
       - Cargo.toml
       - Cargo.lock
       - crates/**
-      - scripts/check_conventions.sh
+      - frameworks/**
+      - scripts/**
+      - templates/**
       - .github/workflows/lint.yml
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: Lint Rust Codebase
     runs-on: ubuntu-24.04
     timeout-minutes: 10
-    permissions:
-      contents: read
-
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
       - name: Install stable Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
-          toolchain: "1.85.0"
+          toolchain: "1.90.0"
           components: "clippy, rustfmt"
 
       - name: Cache cargo dependencies
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@e9d7b9f1e587218970671bac74e5511ed9506e6a # v2
 
       - name: Ensure ripgrep
         shell: bash

.github/workflows/php-lint.yml

@@ -19,8 +19,12 @@ jobs:
     environment:
       name: lint-php
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
+      - uses: shivammathur/setup-php@d52fc211a0436f8839a587b3b5b8efddab4744ea # v2
+        with:
+          php-version: '8.5'
+          coverage: none
       - name: Check syntax
         run: find frameworks/web-server/php -name '*.php' -print0 | xargs -0 -n1 php -l

.github/workflows/python-lint.yml

@@ -19,13 +19,13 @@ jobs:
     environment:
       name: lint-python
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: '3.13'
       - name: Install ruff
-        run: python -m pip install ruff==0.9.10
+        run: python -m pip install ruff==0.17.1
       - name: Check lint and format
         run: ruff check frameworks/web-server/python && ruff format --check frameworks/web-server/python

.github/workflows/ruby-lint.yml

@@ -19,11 +19,11 @@ jobs:
     environment:
       name: lint-ruby
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@824c0e29fdfc7d689c191c27acc969d2d04b7dd8 # v1
         with:
-          ruby-version: '3.3'
+          ruby-version: '3.4.11'
       - name: Check syntax
         run: find frameworks/web-server/ruby -name '*.rb' -print0 | xargs -0 -n1 ruby -c

.github/workflows/rust-lint.yml

@@ -19,13 +19,14 @@ jobs:
     environment:
       name: lint-rust
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: dtolnay/rust-toolchain@1.88.0
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
+          toolchain: "1.99.1"
           components: clippy, rustfmt
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@e9d7b9f1e587218970671bac74e5511ed9506e6a # v2
       - name: Check formatting and clippy
         shell: bash
         run: |

.github/workflows/zig-lint.yml

@@ -19,10 +19,10 @@ jobs:
     environment:
       name: lint-zig
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: mlugg/setup-zig@v2
+      - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2
         with:
           version: 0.16.0
       - name: Check formatting

.gitignore

@@ -1,6 +1,18 @@
 # Build artifacts
 target/
 __pycache__/
+frameworks/web-server/go/*/*-benchmark
+frameworks/web-server/rust/*/target/
+frameworks/web-server/csharp/*/bin/
+frameworks/web-server/csharp/*/obj/
+node_modules/
+.venv/
+vendor/
+frameworks/web-server/**/out
+frameworks/web-server/**/server.log
+
+# Generated code knowledge graph
+graphify-out/
 
 # Operating System
 .DS_Store

.graphifyignore

@@ -0,0 +1,7 @@
+.git/
+.agents/
+.direnv/
+.graphifyignore
+graphify-out/
+results/
+target/