Reproducible benchmark

The public benchmark measures the local harness without calling model APIs.

01

Run

python -m hpp doctor
python -m hpp benchmark -k 3
python -m hpp benchmark -k 3 --json

02

Scenarios

Scenario	Positive control	Negative control	Gate
manifest	ten modules resolved	integration points at a missing module	validation blocks
policy	safe command	destructive operation	enforce returns 2
event log	valid sequence reaches verified	verified without evidence	append is refused without creating the log
WorkGraph	DAG with two waves	cycle A→B→A	compilation fails
Lane Map	dead lane does not block	live overlap	collision appears
Monitor Map	fresh signal	service probe fresh, data probe old	one status per monitor: the service reads healthy, the data reads stale
context	source with hash and budget	secret-like material	compilation refuses
routing	safe work uses economy	high risk without frontier	floor is not lowered
graphs	same input twice	empty projection	identical and non-empty JSON
evidence attestation	approval bound to the file bytes verifies as valid	file changed after approval	verify blocks on the snapshot mismatch

03

Criterion

The benchmark runs each local control k=3; it does not use replayed outcomes as ready-made truth. Release-critical cases require pass^k=1.00. hpp benchmark always runs gate both (pass@k >= 0.90 and pass^k = 1.0); hpp eval run defaults to gate capability (pass@k >= 0.90 only) unless --gate regression or --gate both is passed. The JSON output includes version, platform, suite hash, attempts and individual results. ZIP integrity is a separate release gate.

The benchmark proves only the checkout, the platform and the scenarios that ran. It does not measure the general quality of a model and does not turn an explicit-command capability into automatic enforcement.