Harden the ratchet, tests and CI ahead of the monorepo migration (step P)

[tap]

What this changes

This is RatioTap's half of step P, the pre-work before the monorepo migration. The plan lives in SampleRateTap at docs/MONOREPO_PLAN.md on claude/sample-rate-expansion-strategies-ezqzu6, and tap/SampleRateTap#48 is the companion PR.

P.2: harness and CI (df8cd61, 8550e07)

• scripts/icount.py is changed in step with SampleRateTap's copy; the two differ only in their constants.
  • New --exact, --json-out and --compare-json options.
  • A recorded workload with no binary is now a failure, and a missing baselines file is fatal.
  • Checksums are recorded.
  • Hexagon workloads now run isolated: fixed path, fixed argv[0], empty environment.
  • Hexagon baselines are re-recorded (8550e07). The first isolated run measured every scenario 3,724–3,809 instructions lower (−0.0004% to −0.0136%). The PLAN.md §7 ledger entry records this.
• Test names: every test gets a ratio. ctest prefix and a ratio label, including the bare-metal entry.
• New OutputHash suite: hashes are printed for comparison, never pinned.
• Cross-validation output: the lines now print their tolerance.
• CI:
  • contents: read permissions.
  • Runs on main and on the migration PR are never cancelled.
  • Every action is SHA-pinned.
  • QEMU and ratchet jobs are pinned to ubuntu-24.04, with the image OS in the cache key and the versions logged.
  • --no-tests=error everywhere.
  • QEMU jobs upload their full logs.

P.3: notebooks (9c92818)

• Pinned environment: requirements.in and requirements.lock at the repository root pin the notebook environment with hashes. The file is identical to SampleRateTap's, and it replaces the unversioned notebooks/requirements.txt.
• Bridge rebuilds: ratiotap_py now rebuilds build_capi/ incrementally on every import, and quietly; its CMake log used to land in ratio_demo's committed output.
• Figure digests: notebooks/figure_digest.py prints a data digest for each figure.
• Re-execution: all three notebooks were re-executed, and every committed number reproduces exactly. The only output changes are the added digest lines and the removed build log.

Why

The migration gates key tests by unique names. They compare exact icount, output hashes, full on-target logs and notebook outputs, all of which must exist before the step-0 snapshot.

Verification

• Host, GCC: 82/82 pass with -Werror, all named ratio.* and labelled ratio.
• Host, Clang: clean with -Werror. Hashes are identical to GCC's and stable across runs.
• clang-tidy-18: clean on the new and edited tests.
• Cortex-M33 under QEMU: all 10 workloads match exactly with --exact, and the emulated suite passes in 33 s.
• CI on the current head (9c92818): every job is green (10/10), including all three QEMU legs and the ratchet against the re-recorded Hexagon baselines. The earlier head, df8cd61, was also fully green.
• Notebooks: executed with pip install --require-hashes -r requirements.lock on Python 3.11.15. The digests are identical across two re-executions.

Notes for the reviewer

• Contract change: test naming only (ratio. prefix).
• Notebooks: re-executed and committed executed.
• Merge order: this needs to merge before the migration snapshot. Afterwards, submodules/sampleratetap is re-pinned to SampleRateTap's post-step-P main (P.4).

🤖 Generated with Claude Code

https://claude.ai/code/session_015VR1VC4SDGxHZQQsQvPBaA