perf(dogfood): worker-shared plain-showcase boot — one boot per worker, not per file (#3705)

Measured before surgery: the gate's test BODIES are ~61s of aggregate
compute while per-file setup (TS module graph ~3.5s + kernel boot ~4.1s +
hooks) is ~800s — ~93% of the suite was booting the identical app over and
over (63 boots per run).

vitest.config.ts now defines two projects: shared-showcase runs 12 files
that boot the IDENTICAL plain showcase stack with isolate:false, so a
memoized helper (test/shared-showcase.ts) boots once per WORKER; isolated
keeps vitest defaults for everything else. Eligibility was audited file by
file, not assumed: candidates needed a plain bootStack(showcaseStack) call
AND zero /meta writes, zero org/BU mutation, zero exact-count assertions
over shared objects, zero process.env toggles. Two near-misses the grep
audit alone would have shipped — action-params-contract and
two-factor-lockout both flip boot-time env flags — stayed isolated.

Verified: full suite green under the new config (367 tests, same 364
passed / 3 skipped as baseline — no state bleed), wall 216s -> 190s
locally on 4 workers, boots 63 -> 54; --shard composes with projects
(1/8 shard: 9 files, green); eslint clean.

Not attempted, deliberately: the scope-depth pair (~30s of real test body)
boots three custom-security worlds by design — one isDefault profile per
boot IS the proof — and rewriting that for speed would change what the
gate proves.


Claude-Session: https://claude.ai/code/session_01ECTCrcCdZpCHw5zFSgcmGt

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-zhuang

.changeset/dogfood-shared-boot.md

@@ -0,0 +1,4 @@
+---
+---
+
+CI/test-only: dogfood suite splits into a `shared-showcase` vitest project (12 eligible files share one plain showcase boot per worker via `isolate: false`) and an `isolated` project keeping vitest defaults. Measured: ~93% of the gate's compute was per-file boot overhead. Releases nothing.

packages/qa/dogfood/test/form-self-auth.dogfood.test.ts

@@ -9,9 +9,9 @@
 // while staying least-privilege. Proven at the engine boundary (the same
 // middleware the HTTP form-submit route flows through).
 
-import { describe, it, expect, beforeAll, afterAll } from 'vitest';
-import showcaseStack from '@objectstack/example-showcase';
-import { bootStack, type VerifyStack } from '@objectstack/verify';
+import { describe, it, expect, beforeAll } from 'vitest';
+import { type VerifyStack } from '@objectstack/verify';
+import { getSharedShowcase } from './shared-showcase.js';
 
 const idOf = (r: any) => r?.id ?? r?.record?.id ?? r?.data?.id ?? r;
 
@@ -21,13 +21,11 @@ describe('ADR-0056 Option A — public-form grant (declaration-derived)', () =>
   let ql: any;
 
   beforeAll(async () => {
-    stack = await bootStack(showcaseStack);
+    stack = await getSharedShowcase();
     await stack.signIn();
     ql = await stack.kernel.getServiceAsync('objectql');
   }, 60_000);
 
-  afterAll(async () => { await stack?.stop(); });
-
   it('authorizes CREATE on exactly the declared object (no userId / no guest_portal)', async () => {
     const ctx = { publicFormGrant: { object: 'showcase_private_note' } };
     const r = await ql.insert('showcase_private_note', { title: 'from public form' }, { context: ctx });

packages/qa/dogfood/test/shared-showcase.ts

@@ -0,0 +1,42 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+//
+// Worker-scoped shared showcase stack for the `shared-showcase` vitest project.
+//
+// A plain `bootStack(showcaseStack)` costs ~7.8s per test file (~3.5s TS module
+// graph + ~4.1s kernel assembly, metadata parse, security/seed bootstrap) —
+// measured on a 4-vCPU class host. With the default isolated pool, each of the
+// files that boot the IDENTICAL plain showcase paid that price separately:
+// ~29 boots per suite run, ~25% of the whole gate's compute.
+//
+// The `shared-showcase` project runs with `isolate: false`, so files assigned
+// to the same worker share one module registry — this module's memoized boot
+// then runs once per WORKER (≤4 per run) instead of once per file. The suite
+// process tears the worker down at the end of the run; the stack is in-memory
+// SQLite, so no explicit stop() is needed (and shared files must NOT call
+// stack.stop() — that would kill the instance under the worker's later files).
+//
+// ELIGIBILITY — a file may use the shared stack ONLY if all of these hold:
+//   1. It boots `bootStack(showcaseStack)` or `bootStack(showcaseStack, {})` —
+//      no custom security/plugins/automation/multiTenant options.
+//   2. It does not mutate shared global surfaces: no /meta writes, no
+//      organization/business-unit creation, no permission-set metadata edits.
+//   3. Its assertions tolerate other files' rows existing in shared objects:
+//      no exact-count / exhaustive-list assertions over data it didn't create.
+//      Scope every list assertion to records the file itself created (unique
+//      emails / name prefixes).
+// Anything else stays in the `isolated` project (plain vitest defaults).
+import showcaseStack from '@objectstack/example-showcase';
+import { bootStack, type VerifyStack } from '@objectstack/verify';
+
+let booted: Promise<VerifyStack> | undefined;
+
+/** Boot (once per worker) and return the shared plain-showcase stack. */
+export function getSharedShowcase(): Promise<VerifyStack> {
+  booted ??= bootStack(showcaseStack).then(async (stack) => {
+    // First sign-in provisions the dev admin; later files' own signIn() calls
+    // are idempotent (~0.16s) and just mint fresh admin tokens.
+    await stack.signIn();
+    return stack;
+  });
+  return booted;
+}

packages/qa/dogfood/test/showcase-agent-intersection.dogfood.test.ts

@@ -18,9 +18,9 @@
 //
 // @proof: showcase-agent-intersection
 
-import { describe, it, expect, beforeAll, afterAll } from 'vitest';
-import showcaseStack from '@objectstack/example-showcase';
-import { bootStack, type VerifyStack } from '@objectstack/verify';
+import { describe, it, expect, beforeAll } from 'vitest';
+import { type VerifyStack } from '@objectstack/verify';
+import { getSharedShowcase } from './shared-showcase.js';
 
 const SYS = { isSystem: true } as const;
 
@@ -35,7 +35,7 @@ describe('showcase: ADR-0090 D10 agent intersection (served engine)', () => {
     (await ql.findOne('sys_user', { where: { email }, context: SYS }))?.id;
 
   beforeAll(async () => {
-    stack = await bootStack(showcaseStack);
+    stack = await getSharedShowcase();
     await stack.signIn(); // admin (ensures bootstrap)
     ownerTok = await stack.signUp('int-owner@verify.test');
     await stack.signUp('int-agent@verify.test');
@@ -66,10 +66,6 @@ describe('showcase: ADR-0090 D10 agent intersection (served engine)', () => {
     expect(delsNoteId, "delegator's note id").toBeTruthy();
   }, 120_000);
 
-  afterAll(async () => {
-    await stack?.stop();
-  });
-
   // Agent context as it reaches the engine middleware (auth layer resolved the
   // agent's own grants into `permissions`; the delegator's are reconstructed
   // from the DB by the D10 path).

packages/qa/dogfood/test/showcase-agent-scope-ceiling.dogfood.test.ts

@@ -18,9 +18,9 @@
 //
 // @proof: showcase-agent-scope-ceiling
 
-import { describe, it, expect, beforeAll, afterAll } from 'vitest';
-import showcaseStack from '@objectstack/example-showcase';
-import { bootStack, type VerifyStack } from '@objectstack/verify';
+import { describe, it, expect, beforeAll } from 'vitest';
+import { type VerifyStack } from '@objectstack/verify';
+import { getSharedShowcase } from './shared-showcase.js';
 
 const SYS = { isSystem: true } as const;
 const idOf = (r: any): string => r?.id ?? r?.record?.id;
@@ -36,7 +36,7 @@ describe('showcase: ADR-0090 D10 agent scope ceiling (served engine)', () => {
     (await ql.findOne('sys_user', { where: { email }, context: SYS }))?.id;
 
   beforeAll(async () => {
-    stack = await bootStack(showcaseStack);
+    stack = await getSharedShowcase();
     await stack.signIn(); // admin bootstrap
     aliceTok = await stack.signUp('scope-alice@verify.test');
     ql = await stack.kernel.getServiceAsync('objectql');
@@ -50,10 +50,6 @@ describe('showcase: ADR-0090 D10 agent scope ceiling (served engine)', () => {
     expect(noteId, 'note id resolved').toBeTruthy();
   }, 120_000);
 
-  afterAll(async () => {
-    await stack?.stop();
-  });
-
   // The agent context exactly as the producer emits it: acting on behalf of
   // Alice, whose OWN grants are the scope-derived ceiling (no member baseline).
   const agentCtx = (ceiling: string) => ({

packages/qa/dogfood/test/showcase-anonymous-deny-surfaces.dogfood.test.ts

@@ -12,9 +12,9 @@
 // is what a fresh production deployment gets) and asserts every surface denies
 // an anonymous caller with 401 while an authenticated member is unaffected.
 
-import { describe, it, expect, beforeAll, afterAll } from 'vitest';
-import showcaseStack from '@objectstack/example-showcase';
-import { bootStack, type VerifyStack } from '@objectstack/verify';
+import { describe, it, expect, beforeAll } from 'vitest';
+import { type VerifyStack } from '@objectstack/verify';
+import { getSharedShowcase } from './shared-showcase.js';
 
 const OBJ = '/data/showcase_private_note';
 
@@ -23,13 +23,11 @@ describe('showcase: anonymous posture is uniform across surfaces (#2567)', () =>
   let memberToken: string;
 
   beforeAll(async () => {
-    stack = await bootStack(showcaseStack); // platform default (deny anonymous)
+    stack = await getSharedShowcase(); // platform default (deny anonymous)
     await stack.signIn();
     memberToken = await stack.signUp('surfaces-member@verify.test');
   }, 60_000);
 
-  afterAll(async () => { await stack?.stop(); });
-
   // ── /meta ──────────────────────────────────────────────────────────────
   it('anonymous GET /meta is denied (401)', async () => {
     const r = await stack.api('/meta', { method: 'GET' });
@@ -41,7 +39,6 @@ describe('showcase: anonymous posture is uniform across surfaces (#2567)', () =>
     expect(r.status, 'authenticated metadata read must clear the auth gate').not.toBe(401);
   });
 
-
   // ── /data (surface-level; raw-hono handler proven in plugin-hono-server) ──
   it('anonymous READ of the data surface is denied (401)', async () => {
     const r = await stack.api(OBJ, { method: 'GET' });

packages/qa/dogfood/test/showcase-anonymous-deny.dogfood.test.ts

@@ -9,9 +9,9 @@
 // Public forms survive the same default via the declaration-derived
 // publicFormGrant — see showcase-public-form.dogfood.test.ts.
 
-import { describe, it, expect, beforeAll, afterAll } from 'vitest';
-import showcaseStack from '@objectstack/example-showcase';
-import { bootStack, type VerifyStack } from '@objectstack/verify';
+import { describe, it, expect, beforeAll } from 'vitest';
+import { type VerifyStack } from '@objectstack/verify';
+import { getSharedShowcase } from './shared-showcase.js';
 
 const OBJ = '/data/showcase_private_note';
 
@@ -20,13 +20,11 @@ describe('showcase: anonymous default-deny (ADR-0056 D2)', () => {
   let memberToken: string;
 
   beforeAll(async () => {
-    stack = await bootStack(showcaseStack); // harness boots on the platform default (deny anonymous)
+    stack = await getSharedShowcase(); // harness boots on the platform default (deny anonymous)
     await stack.signIn();
     memberToken = await stack.signUp('d2-member@verify.test'); // anonymous /auth call → proves control-plane is open
   }, 60_000);
 
-  afterAll(async () => { await stack?.stop(); });
-
   it('control-plane is open for anonymous (sign-up succeeded without a token)', () => {
     expect(memberToken, 'anonymous /auth/sign-up returned a token').toBeTruthy();
   });

packages/qa/dogfood/test/showcase-declarative-rbac-seeding.dogfood.test.ts

@@ -7,20 +7,19 @@
 //
 // @proof: showcase-declarative-rbac-seeding
 
-import { describe, it, expect, beforeAll, afterAll } from 'vitest';
-import showcaseStack from '@objectstack/example-showcase';
-import { bootStack, type VerifyStack } from '@objectstack/verify';
+import { describe, it, expect, beforeAll } from 'vitest';
+import { type VerifyStack } from '@objectstack/verify';
+import { getSharedShowcase } from './shared-showcase.js';
 
 describe('showcase: declarative RBAC seeding (ADR-0057 D6 / #2077)', () => {
   let stack: VerifyStack;
   let ql: any;
 
   beforeAll(async () => {
-    stack = await bootStack(showcaseStack);
+    stack = await getSharedShowcase();
     await stack.signIn();
     ql = await stack.kernel.getServiceAsync('objectql');
   }, 60_000);
-  afterAll(async () => { await stack?.stop(); });
 
   it('declared roles land in sys_position (was count = 0)', async () => {
     const roles = await ql.find('sys_position', { where: {}, context: { isSystem: true } });

packages/qa/dogfood/test/showcase-permission-zoo.dogfood.test.ts

@@ -10,9 +10,9 @@
 //
 // @proof: showcase-permission-zoo
 
-import { describe, it, expect, beforeAll, afterAll } from 'vitest';
-import showcaseStack from '@objectstack/example-showcase';
-import { bootStack, type VerifyStack } from '@objectstack/verify';
+import { describe, it, expect, beforeAll } from 'vitest';
+import { type VerifyStack } from '@objectstack/verify';
+import { getSharedShowcase } from './shared-showcase.js';
 
 const SYS = { isSystem: true } as const;
 
@@ -28,7 +28,7 @@ describe('showcase: ADR-0090 permission-model zoo', () => {
     (await ql.findOne('sys_user', { where: { email }, context: SYS }))?.id;
 
   beforeAll(async () => {
-    stack = await bootStack(showcaseStack);
+    stack = await getSharedShowcase();
     adminTok = await stack.signIn();
     ownerTok = await stack.signUp('zoo-owner@verify.test');
     plainTok = await stack.signUp('zoo-plain@verify.test');
@@ -75,10 +75,6 @@ describe('showcase: ADR-0090 permission-model zoo', () => {
     expect(noteId, 'probe note id resolved').toBeTruthy();
   }, 120_000);
 
-  afterAll(async () => {
-    await stack?.stop();
-  });
-
   // ── The app seed can plant the platform org tree ─────────────────────────
   it('seeds the sys_business_unit tree with explicit ids and parent links', async () => {
     const units = await ql.find('sys_business_unit', { where: {}, context: SYS });

packages/qa/dogfood/test/showcase-private-owd.dogfood.test.ts

@@ -8,9 +8,9 @@
 // `owner_id`. This is the canonical "declare one word, get owner isolation"
 // capability — proven end-to-end through the real HTTP stack.
 
-import { describe, it, expect, beforeAll, afterAll } from 'vitest';
-import showcaseStack from '@objectstack/example-showcase';
-import { bootStack, type VerifyStack } from '@objectstack/verify';
+import { describe, it, expect, beforeAll } from 'vitest';
+import { type VerifyStack } from '@objectstack/verify';
+import { getSharedShowcase } from './shared-showcase.js';
 
 const OBJ = '/data/showcase_private_note';
 const idOf = (b: any) => b?.id ?? b?.record?.id ?? b?.data?.id ?? b?.recordId;
@@ -23,7 +23,7 @@ describe('showcase: declarative private OWD (ADR-0056)', () => {
   let bNoteId: string;
 
   beforeAll(async () => {
-    stack = await bootStack(showcaseStack);
+    stack = await getSharedShowcase();
     await stack.signIn(); // seed dev admin (first user)
     aToken = await stack.signUp('owd-alice@verify.test');
     bToken = await stack.signUp('owd-bob@verify.test');
@@ -41,8 +41,6 @@ describe('showcase: declarative private OWD (ADR-0056)', () => {
     expect(bNoteId, 'bob note id').toBeTruthy();
   }, 60_000);
 
-  afterAll(async () => { await stack?.stop(); });
-
   it('owner_id is auto-stamped (no manual assignment, no predicate)', async () => {
     const ql: any = await stack.kernel.getServiceAsync('objectql');
     const row = await ql.findOne('showcase_private_note', { where: { id: aNoteId }, context: { isSystem: true } });