Recipe 8 — Run the CRS differential and the bench harness on your own node

Tool Section Level Time Layer Tags
lab/bench-vm.sh + test/crs-differential, Linux VM, root Bench hard 45 min bench · crs bench, budgets, walls

Problem

You want the full suite under the CI shape on the node you own. You want the verdict walls measured against the spec 17 budgets, and the CRS posture re-checked on the same node.

Solution

  1. Run the CRS parity gate first (any host with Go):
go test ./test/crs-differential/ -run TestCorpusParity -count=1
  1. Run the bench rig inside a Linux VM copy of the tree (root):
sudo bash lab/bench-vm.sh
  1. Read the four sections the rig prints:
== G: full suite, new CI shape (p 1 + no_regex_multiline)
== H: old CI shape control (parallel, GOMAXPROCS=4)
== I: bench verdict walls, new CI shape
== J: prefilter-off control (same shape, directive removed)

The wall lines carry one row per measured scenario:

MEASURED <scenario> n=<n> size=<bytes> p50=<us> p99=<us> budget=<name> (<budget-hint us>) factor=<x>x

Discussion

Section G runs the suite serialized (-p 1) with the no_regex_multiline build tag; the CI fleet runs this shape. Section H runs the parallel-shape control; the delta shows what the serialization buys. Section I measures the live-path verdict walls against the named budget. The factor value reads the wall at 1.00x. Section J removes the SecRxPreFilter On directive and re-measures; the delta prices the prefilter. The rig restores the directive on exit.

A wall above 1.00x is a budget miss on your node. The hosted CI certifies the budgets; read the VM as the A and B surface. The parity gate from Recipe 5 rides the same tree: run it again after any rule or exclusion change.

See also

Provenance

Verified against trishula@10df4bee on main, 2026-10-25.

Smoke run, 2026-10-25, inside the sprint Linux VM:

  • The parity gate read green before the rig.

  • bash lab/bench-vm.sh ran the four sections inside the VM. The section I wall read the line below against the e2e-inline-hop-8k budget:

    MEASURED attack-sqli-small n=300 size=17 B p50=427.3 us p99=571.5 us budget=e2e-inline-hop-8k (1500 us) factor=0.38x