test(collector): add bounded one-shot tape seal benchmark

[proerror77]

Change contract

Add one GitHub-hosted, workflow-dispatch-only benchmark contract that deterministically generates a legal 4 GiB Polymarket market tape, runs the existing full-scan-versus-seal attribution/equivalence harness exactly once, and always removes its temporary data.

Issue relationship

Refs #716

Out of scope

Production, canary, Gate, Reference, ACK, ECS, OSS, ACR, credentials, image publication, uploader tuning, data-path semantics, and any automatic/scheduled benchmark execution.

Dependencies and merge order

Depends on merged PR #772 / main 1d94b43a42ca9abfa2783e84c416a4595952204d.

Focused validation

• Static contract checks require workflow-dispatch-only triggering, exact trusted-main identity, one exact selected test, 45-minute timeout, 6 GiB post-build disk headroom, 3.7–4.3 GiB fixture bounds, four phase attribution records, manifest equivalence, fixture SHA-256, and fail-closed cleanup.
• The synthetic fixture uses the existing incremental manifest builder and the same benchmark helper as the immutable-fixture test.
• No Rust test or data workload was run locally; GitHub CI is the authorized validation environment.

Rollout and rollback

After exact-head CI/review and normal merge, manually dispatch once from the then-current exact main SHA. The workflow has read-only repository permission and no external connection. Rollback is deletion/revert of this manual-only workflow; it has no production effect.

Scope exception

None.

Summary by CodeRabbit

• New Features

  • Added a manually triggered market-tape seal benchmark for validating performance against a fixed revision.
  • Added a deterministic large-scale synthetic tape benchmark with checksum reporting and phase timing.
  • Benchmark runs now publish redacted evidence and automatically clean up temporary data.

• Bug Fixes

  • Added automated validation to prevent unsafe credentials, cloud tooling, container operations, or production connections during benchmark execution.
  • Added continuous integration checks to verify the benchmark configuration and execution safeguards.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 861131d9-861f-4ead-9f24-09fdfb07dfb6

📥 Commits

Reviewing files that changed from the base of the PR and between 042d317 and b42e105.

📒 Files selected for processing (3)

• .github/scripts/test-market-tape-seal-benchmark.sh
• .github/workflows/market-tape-seal-benchmark.yml
• rust_hft/tools/collector/src/polymarket_upload.rs

🚧 Files skipped from review as they are similar to previous changes (3)

• .github/scripts/test-market-tape-seal-benchmark.sh
• .github/workflows/market-tape-seal-benchmark.yml
• rust_hft/tools/collector/src/polymarket_upload.rs

---

📝 Walkthrough

Walkthrough

Adds a deterministic synthetic 4 GiB market-tape benchmark, a manually dispatched workflow pinned to an exact main commit, and CI validation for workflow, benchmark, fixture, cleanup, and integration constraints.

Changes

Market-tape benchmark

Layer / File(s)	Summary
Deterministic fixture benchmark rust_hft/tools/collector/src/polymarket_upload.rs	The benchmark generates, seals, hashes, reports, validates, and removes a synthetic immutable fixture. Output includes fixture_sha256 and manifest equivalence.
Pinned benchmark workflow .github/workflows/market-tape-seal-benchmark.yml	The workflow validates the selected benchmark and exact main SHA, builds and runs one ignored benchmark, checks evidence and disk space, publishes filtered results, and always cleans up temporary data.
Benchmark contract validation .github/scripts/test-market-tape-seal-benchmark.sh, .github/workflows/ploy-ci.yml	A Bash contract test validates workflow and Rust harness requirements. Workflow lint runs the contract test.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant MainCheckout
  participant RustBenchmark
  participant StepSummary
  GitHubActions->>MainCheckout: checkout refs/heads/main at exact SHA
  GitHubActions->>RustBenchmark: compile and run one ignored benchmark
  RustBenchmark->>GitHubActions: return status and benchmark evidence
  GitHubActions->>StepSummary: publish filtered evidence
  GitHubActions->>RustBenchmark: remove benchmark data

Loading

Possibly related PRs

• proerror77/monday#34: Introduced the polymarket_upload.rs implementation extended by this PR.
• proerror77/monday#772: Introduced the sealed market-tape functionality benchmarked by this PR.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the new bounded one-shot tape seal benchmark.
Description check	✅ Passed	The description completes every required template section and provides the contract, scope, validation, rollout, and rollback details.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/pm-uploader-seal-benchmark-716

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/scripts/test-market-tape-seal-benchmark.sh:
- Around line 46-49: Update .github/scripts/test-market-tape-seal-benchmark.sh
lines 46-49 to reject all credential configurations except the exact safe
persist-credentials: false setting, while preserving the existing checks. Update
.github/workflows/market-tape-seal-benchmark.yml lines 58-62 by adding
persist-credentials: false under the actions/checkout with block.

In `@rust_hft/tools/collector/src/polymarket_upload.rs`:
- Around line 3438-3442: Remove the MIN_FIXTURE_BYTES/MAX_FIXTURE_BYTES
assertion from the shared immutable-fixture test helper around
regular_identity(&fixture).unwrap(). Add the same synthetic size validation to
synthetic_immutable_fixture_reports_full_scan_and_seal_lookup_phases, while
keeping immutable_fixture_reports_full_scan_and_seal_lookup_phases limited to
verifying an immutable closed tape.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: fdd8c225-9b75-44b6-a604-f880d9d300a8

📥 Commits

Reviewing files that changed from the base of the PR and between 1d94b43 and 042d317.

📒 Files selected for processing (4)

• .github/scripts/test-market-tape-seal-benchmark.sh
• .github/workflows/market-tape-seal-benchmark.yml
• .github/workflows/ploy-ci.yml
• rust_hft/tools/collector/src/polymarket_upload.rs