Add runtime performance baseline capture

Author: eldryoth

CHANGELOG.md

@@ -22,6 +22,11 @@ behavior when the change improves security or project direction.
   `scripts/capture-runtime-baseline.sh` to record locked dependency trees,
   per-profile Pingora dependency presence, release metadata, and default
   release-binary size before the runtime cutover work begins.
+- Add `scripts/capture-runtime-performance-baseline.sh` and wire it into
+  release-mode runtime baseline capture. It records local startup time, idle
+  RSS/file descriptors, static HTTP latency, cache MISS/HIT latency,
+  load-balancer route timing, keep-alive throughput, and fresh TLS connection
+  timing.
 - Add `docs/pingora-dependency-exceptions.tsv` and
   `scripts/validate-pingora-dependency-policy.sh` so the 1.6 line has a
   release-gated inventory of allowed Pingora crates per official profile.

docs/release-checklist.md

@@ -46,11 +46,12 @@ scripts/check_latest_crates.sh
 - During the `1.6.x` Pingora-exit line, capture the runtime baseline evidence
   before tagging. `check` mode records locked dependency trees and the
   per-profile Pingora dependency surface; `release` mode also records the
-  default release-binary size:
+  default release-binary size and local performance baseline:
 
 ```bash
 scripts/capture-runtime-baseline.sh check
 scripts/capture-runtime-baseline.sh release
+scripts/capture-runtime-performance-baseline.sh release
 scripts/validate-pingora-dependency-policy.sh check
 scripts/validate-runtime-fixtures.sh check
 ```

docs/runtime-baseline.md

@@ -34,6 +34,13 @@ The generated files are:
 | `cargo-tree/*.txt` | Locked dependency trees for default, full, cache-edge, proxy-edge, load-balancer-edge, PHP, and privacy profiles. |
 | `pingora-dependency-surface.tsv` | Report-only list of Pingora crates still present per profile. |
 | `binary-size.tsv` | Default release binary size when release/build mode is used. |
+| `startup-time.tsv` | Milliseconds from process spawn to first successful local HTTP response. |
+| `process-idle.tsv` | Idle RSS, file-descriptor count, sample counts, and TLS availability. |
+| `http-latency.tsv` | Local static HTTP request timing samples. |
+| `cache-latency.tsv` | Local static-cache MISS/HIT timing samples and cache status headers. |
+| `load-balancer-latency.tsv` | Local round-robin route timing samples and observed backend labels. |
+| `keepalive-throughput.tsv` | Single-connection HTTP keep-alive throughput samples. |
+| `tls-handshake-latency.tsv` | HTTPS request timing samples that create a fresh TLS connection per sample when OpenSSL is available to generate the local certificate. |
 
 The stricter release policy is tracked in
 [Pingora Dependency Exceptions](pingora-dependency-exceptions.tsv) and checked
@@ -43,6 +50,13 @@ by:
 scripts/validate-pingora-dependency-policy.sh check
 ```
 
+Release mode invokes the performance baseline automatically. To skip it for a
+local emergency run, set:
+
+```bash
+FLUXHEIM_RUNTIME_BASELINE_PERFORMANCE=0 scripts/capture-runtime-baseline.sh release
+```
+
 ## Comparison Rules
 
 The first `1.6.0` baseline is not a pass/fail performance benchmark. It is the
@@ -55,10 +69,10 @@ Later `1.6.x` releases should compare against this baseline as follows:
 - binary size: default and focused profile binaries should not grow without a
   release-note explanation;
 - behavior: smoke tests and fixture parity are stronger than raw speed numbers;
-- performance: startup time, idle memory, connection cost, HTTP/1.1 latency,
-  keep-alive throughput, cache HIT/MISS latency, load-balancer selection cost,
-  TLS handshake cost, and container image size should be added as measured TSV
-  files before the corresponding runtime component is replaced;
+- performance: startup time, idle memory, file-descriptor count, HTTP/1.1
+  latency, keep-alive throughput, cache HIT/MISS latency, load-balancer route
+  timing, and TLS fresh-connection timing are captured by the 1.6.0 baseline;
+  container image size should be added before container/runtime cutover work;
 - environment: every measurement must record enough host/toolchain information
   to explain differences between local developer machines, CI runners, and
   release builders.

release-notes/RELEASE_NOTES_1.6.0.md

@@ -18,6 +18,11 @@ remove Pingora safely in later 1.6.x releases.
   `scripts/capture-runtime-baseline.sh` to record locked dependency trees,
   per-profile Pingora dependency presence, release metadata, and default
   release-binary size before the runtime cutover work begins.
+- Added `scripts/capture-runtime-performance-baseline.sh` and wired it into
+  release-mode runtime baseline capture. It records local startup time, idle
+  RSS/file descriptors, static HTTP latency, cache MISS/HIT latency,
+  load-balancer route timing, keep-alive throughput, and fresh TLS connection
+  timing.
 - Added `docs/pingora-dependency-exceptions.tsv` and
   `scripts/validate-pingora-dependency-policy.sh` so the 1.6 line has a
   release-gated inventory of allowed Pingora crates per official profile.

scripts/capture-runtime-baseline.sh

@@ -108,6 +108,12 @@ if [ "$mode" = "release" ] || [ "${FLUXHEIM_RUNTIME_BASELINE_BUILD:-0}" = "1" ];
         bytes="$(wc -c <"$binary" | tr -d ' ')"
         printf 'default\t%s\t%s\n' "$binary" "$bytes"
     } >"$out_dir/binary-size.tsv"
+
+    if [ "${FLUXHEIM_RUNTIME_BASELINE_PERFORMANCE:-1}" = "1" ]; then
+        scripts/capture-runtime-performance-baseline.sh release
+    else
+        echo "runtime baseline: skipping performance baseline because FLUXHEIM_RUNTIME_BASELINE_PERFORMANCE=0"
+    fi
 else
     {
         printf 'profile\tpath\tbytes\n'