[vishr]

Summary

The benchmark harness now exercises Pitot's shipped contracts instead of requesting retired archives, settings, headers and metrics.

- fanout-bench / --fanout-* / FANOUT_BENCH_*
+ pitot-bench / --pitot-* / PITOT_BENCH_*
- old release archives, request header, session cookie and metric prefix
+ Pitot release archives, Pitot-Request, pitot_session and pitot_ metrics

New reports use pitot-bench/v1 with pitot_* JSON fields and reject the previous report contract. Published evidence stays byte-for-byte unchanged; use its recorded harness revision to reproduce or render it. Managed runs isolate current and retired product settings from the caller without forwarding or accepting aliases.

Evidence

• Before: managed runs configured the wrong namespace and downloaded the previous executable; metric sampling read the previous prefix.
  After: release tests verify the named Pitot archive and SHA-256; managed-environment tests use the current product schema and prove retired inherited settings cannot reach the product.
• just test (all Go tests and vet), go test -race ./..., ShellCheck, formatting, git diff --check, and staged Gitleaks passed. Historical report rejection is tested.
• No live load run or cloud provisioning was performed.

Merge Danger

Door: one-way for the new report contract

Consumers must update CLI/settings and report field names. No aliases or old-format fallback are provided.

Blast Radius: tooling