Merge pull request #253 from preloopdev/improve/runner-watch-conformance

fix: improve runner fidelity and real-world conformance

Author: Bnjoroge1

.gitignore

@@ -142,6 +142,10 @@ skills-lock.json
 /plans/
 /logo.png
 /logo-square.png
-
-.wrangler/
+.ori/
 .pi/
+.pi/extensions/entire/index.ts
+dist-packages
+# Supply-chain gate: parked until the cargo vet backlog is dealt with
+/.github/workflows/supply-chain.yml
+.wrangler/

Cargo.lock

@@ -4,12 +4,12 @@
 #           flask, gin, json-c, nlohmann/json, node-fetch, bat, vite, uv,
 #           nextcloud, caddy, bento, agent-ci, openclaw, buzz, qm, runner,
 #           ripgrep, click, yq, axios, fd (lightweight wave 2026-08-29)
-# New picks (diverse, popular, ubuntu-latest dominated, lightweight):
-#   - ajeetdsouza/zoxide (Rust, 1 ubuntu)
-#   - junegunn/fzf (Go, 1 ubuntu-24.04)
-#   - golangci/golangci-lint (Go, 2 ubuntu)
-#   - jqlang/jq (C, 17 cross but ubuntu-latest)
-#   - starship/starship (Rust, 5 ubuntu)
+# New picks (varied, medium-to-large, and not covered by prior campaigns):
+#   - prometheus/prometheus (Go observability server)
+#   - helm/helm (Go package manager)
+#   - pypa/pip (Python packaging)
+#   - rails/rails (Ruby web framework)
+#   - webpack/webpack (Node/JavaScript bundler)
 set -Eeuo pipefail
 ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
 WORKSPACE_ROOT="${CONFORMANCE_WORKSPACE_ROOT:-/tmp/preloop-conformance-new5repos/workspaces}"
@@ -20,6 +20,7 @@ POLL_SECONDS="${CONFORMANCE_POLL_SECONDS:-10}"
 TIMEOUT_SECONDS="${CONFORMANCE_TIMEOUT_SECONDS:-7200}"
 POOL_SIZE="${PRELOOP_RUNNER_POOL_SIZE:-1}"
 HOST_HOME="${HOME:-}"
+SMOLVM_HOME_DIR="${SMOLVM_HOME_DIR:-$HOST_HOME/.smolvm/1.15.0}"
 SMOLVM_PROCESS_HOME="${CONFORMANCE_SMOLVM_HOME:-$CAMPAIGN_HOME/smolvm-home}"
 if [[ -z "${PRELOOP_SYSTEM_TOKEN:-}" ]]; then
   export PRELOOP_SYSTEM_TOKEN="$(python3 -c 'import secrets; print(secrets.token_hex(32))')"
@@ -35,48 +36,45 @@ SERVER_PID=""
 FAILED_TARGETS=""
 if [ "$(uname -s)" = Darwin ]; then
   if [ -z "${DYLD_FALLBACK_LIBRARY_PATH:-}" ]; then
-    export DYLD_FALLBACK_LIBRARY_PATH="$HOST_HOME/.smolvm/lib:/opt/homebrew/lib:/usr/lib"
+    export DYLD_FALLBACK_LIBRARY_PATH="$SMOLVM_HOME_DIR/lib:/opt/homebrew/lib:/usr/lib"
   else
     case ":$DYLD_FALLBACK_LIBRARY_PATH:" in
-      *":$HOST_HOME/.smolvm/lib:"*) ;;
-      *) export DYLD_FALLBACK_LIBRARY_PATH="$HOST_HOME/.smolvm/lib:$DYLD_FALLBACK_LIBRARY_PATH" ;;
+      *":$SMOLVM_HOME_DIR/lib:"*) ;;
+      *) export DYLD_FALLBACK_LIBRARY_PATH="$SMOLVM_HOME_DIR/lib:$DYLD_FALLBACK_LIBRARY_PATH" ;;
     esac
   fi
 fi
 usage() {
   cat <<'EOF'
-Usage: conformance-new5repos.sh [all|requests|axios|typescript|react|nextjs] [--workflow NAME]
+Usage: conformance-new5repos.sh [all|prometheus|helm|pip|rails|webpack] [--workflow NAME]
 EOF
 }
 fail() { echo "conformance-new5repos: $*" >&2; exit 1; }
 target_cfg() {
   case "$1" in
-    zoxide/ci)
-      echo "zoxide https://github.com/ajeetdsouza/zoxide.git main .github/workflows/ci.yml push refs/heads/main" ;;
-    fzf/ci)
-      echo "fzf https://github.com/junegunn/fzf.git master .github/workflows/linux.yml push refs/heads/master" ;;
-    golangci-lint/ci)
-      echo "golangci-lint https://github.com/golangci/golangci-lint.git main .github/workflows/pr-tests.yml push refs/heads/main" ;;
-    jq/ci)
-      echo "jq https://github.com/jqlang/jq.git master .github/workflows/ci.yml push refs/heads/master" ;;
-    starship/ci)
-      echo "starship https://github.com/starship/starship.git main .github/workflows/workflow.yml push refs/heads/main" ;;
-    cobra/ci)
-      echo "cobra https://github.com/spf13/cobra.git main .github/workflows/test.yml push refs/heads/main" ;;
+    prometheus/ci)
+      echo "prometheus https://github.com/prometheus/prometheus.git main .github/workflows/ci.yml push refs/heads/main" ;;
+    helm/build-test)
+      echo "helm https://github.com/helm/helm.git main .github/workflows/build-test.yml push refs/heads/main" ;;
+    pip/ci)
+      echo "pip https://github.com/pypa/pip.git main .github/workflows/ci.yml push refs/heads/main" ;;
+    rails/smoke)
+      echo "rails https://github.com/rails/rails.git main .github/workflows/devcontainer-smoke-test.yml push refs/heads/main" ;;
+    webpack/test)
+      echo "webpack https://github.com/webpack/webpack.git main .github/workflows/test.yml push refs/heads/main" ;;
     *) return 1 ;;
   esac
 }
 all_targets() {
-  echo "zoxide/ci fzf/ci golangci-lint/ci jq/ci starship/ci cobra/ci"
+  echo "prometheus/ci helm/build-test pip/ci rails/smoke webpack/test"
 }
 repo_targets() {
   case "$1" in
-    zoxide) echo "zoxide/ci" ;;
-    fzf) echo "fzf/ci" ;;
-    golangci-lint) echo "golangci-lint/ci" ;;
-    jq) echo "jq/ci" ;;
-    starship) echo "starship/ci" ;;
-    cobra) echo "cobra/ci" ;;
+    prometheus) echo "prometheus/ci" ;;
+    helm) echo "helm/build-test" ;;
+    pip) echo "pip/ci" ;;
+    rails) echo "rails/smoke" ;;
+    webpack) echo "webpack/test" ;;
     *) return 1 ;;
   esac
 }
@@ -93,17 +91,15 @@ prepare_golden_home() {
   sudo umount -f "$CAMPAIGN_HOME/externals" 2>/dev/null || true
   rm -rf "$CAMPAIGN_HOME" || true
   [ -f "$OFFICIAL_GOLDEN_ARTIFACT" ] || fail "missing 9GB official golden: $OFFICIAL_GOLDEN_ARTIFACT"
-  local bytes expected fingerprint
+  local bytes expected
   bytes="$(file_size "$OFFICIAL_GOLDEN_ARTIFACT")"
   [ "$bytes" -ge 8589934592 ] || fail "golden is ${bytes} bytes, not the required ~9GB"
-  fingerprint="$(python3 - "$OFFICIAL_GOLDEN_BASE" <<'INNERPY'
-import hashlib, json, sys, platform
-rosetta = platform.system() == "Darwin" and platform.machine() in ("arm64", "aarch64")
-normalized = {"base": sys.argv[1], "toolchains": [], "curated": False, "bake": "", "rosetta_libs": rosetta}
-print(hashlib.sha256(json.dumps(normalized, separators=(",", ":")).encode()).hexdigest())
-INNERPY
-)"
-  expected="$CAMPAIGN_HOME/vms/$OFFICIAL_GOLDEN_NAME-$fingerprint"
+  # Ask the CLI for the same fingerprinted payload path the server computes.
+  # Reimplementing EnvironmentSpec here drifted when runner-root and smolvm
+  # inputs changed, silently causing a fresh multi-GiB image pull.
+  expected="$(PRELOOP_HOME="$CAMPAIGN_HOME" \
+    PRELOOP_RUNNER_BASE_IMAGE="$OFFICIAL_GOLDEN_BASE" \
+    "$SERVER_BIN" golden-path)" || fail "could not compute golden payload path"
   mkdir -p "$(dirname "$expected")"
   ln -sfn "$OFFICIAL_GOLDEN_ARTIFACT" "$expected"
   [ -f "$expected" ] || fail "failed to expose official golden at $expected"
@@ -138,15 +134,20 @@ start_server() {
   local log="$OUTPUT_ROOT/server.log"
   mkdir -p "$OUTPUT_ROOT" "$CAMPAIGN_HOME" "$SMOLVM_PROCESS_HOME"
   rm -f "$log"
-  if [ -z "${PRELOOP_GITHUB_TOKEN:-}" ] && command -v gh >/dev/null 2>&1; then
-    PRELOOP_GITHUB_TOKEN="$(gh auth token 2>/dev/null || true)"
-    export PRELOOP_GITHUB_TOKEN
-  fi
+  mkdir -p "$CAMPAIGN_HOME/bin"
+  ln -sfn "$SMOLVM_HOME_DIR/smolvm" "$CAMPAIGN_HOME/bin/smolvm"
+  export PATH="$CAMPAIGN_HOME/bin:$PATH"
+  hash -r 2>/dev/null || true
+  command -v smolvm
+  smolvm --version
+  # Do not mint PRELOOP_GITHUB_TOKEN from `gh auth token`. These campaigns
+  # execute foreign public workflows; an operator PAT must be supplied
+  # explicitly (short-lived, narrowly scoped) or omitted.
   PRELOOP_HOME="$CAMPAIGN_HOME" \
   HOME="$SMOLVM_PROCESS_HOME" \
   SMOLVM_DATA_DIR="${SMOLVM_DATA_DIR:-$CAMPAIGN_HOME/smolvm}" \
-  SMOLVM_AGENT_ROOTFS="${SMOLVM_AGENT_ROOTFS:-$HOST_HOME/.smolvm/agent-rootfs}" \
-  SMOLVM_LIB_DIR="${SMOLVM_LIB_DIR:-$HOST_HOME/.smolvm/lib}" \
+  SMOLVM_AGENT_ROOTFS="${SMOLVM_AGENT_ROOTFS:-$SMOLVM_HOME_DIR/agent-rootfs}" \
+  SMOLVM_LIB_DIR="${SMOLVM_LIB_DIR:-$SMOLVM_HOME_DIR/lib}" \
   PRELOOP_RUNNER_BASE_IMAGE="$OFFICIAL_GOLDEN_BASE" \
   PRELOOP_RUNNER_BUNDLE="$GUEST_RUNNER_BUNDLE" \
   PRELOOP_RUNNER_NAME_PREFIX="conformance-new5repos" \
@@ -155,7 +156,7 @@ start_server() {
   PRELOOP_RUNNER_POOL_SIZE="$POOL_SIZE" \
   PRELOOP_USE_FORK=1 \
   PRELOOP_RUNNER_MEMORY_MIB="${PRELOOP_RUNNER_MEMORY_MIB:-8192}" \
-  PRELOOP_RUNNER_STORAGE_GB="${PRELOOP_RUNNER_STORAGE_GB:-160}" \
+  PRELOOP_RUNNER_STORAGE_GB="${PRELOOP_RUNNER_STORAGE_GB:-80}" \
   PRELOOP_RUNNER_LABELS="${PRELOOP_RUNNER_LABELS:-X64,ubuntu-arm64-small,ubuntu-x64-small,ubuntu-x64,ubuntu-latest,ubuntu-22.04,ubuntu-24.04,ubuntu-20.04}" \
   PRELOOP_PUBLIC_URL="http://127.0.0.1:$PORT" \
   RUST_LOG="${RUST_LOG:-info,preloop=info}" \
@@ -284,7 +285,7 @@ EOF
   echo "=== [$target] final status: $final_status ==="
   case "$final_status" in
     success|skipped) ;;
-    *) FAILED_TARGETS="${FAILED_TARGETS}${target}=${final_status}\n" ;;
+    *) FAILED_TARGETS="${FAILED_TARGETS:-}${target}=${final_status}\n" ;;
   esac
 }
 main() {

benchmarks/real-world/conformance-10repos.sh

@@ -0,0 +1,172 @@
+# 10-Repo Conformance Campaign — Final Report
+
+**Date:** 2026-09-11 · **Branch:** `improve/runner-watch-conformance` rebased onto
+`origin/main@008893a3` · **Stack:** preloop server + preloop Rust runner,
+both built from the branch (incl. 10 fixes below) · **Golden:** official
+`ubuntu24-arm64-runner-large` packed image · **Isolation:** smolvm microVMs,
+pool of 4×(4 vCPU/16 GB); nothing on host · **Labels:** X64 + ubuntu-* +
+ubuntu-slim
+
+All 10 repos are NEW (no overlap with the 41 previously covered). Real
+`.github/workflows` files, submitted as push payloads, run to completion.
+
+## Scoreboard (final validated state)
+
+| Repo | Workflow | Verdict |
+|---|---|---|
+| spf13/hugo | test.yml | **ubuntu fully green** (codegen + asciidoc via fixes #13/#16, confirmed in full workflow rerun); windows starves (expected) |
+| grpc/grpc-go | testing.yml | **7/8 PASS** (vet-proto, static-checks, extras, latest, latest-1, -race, arm64); i386 red (env) |
+| pytest-dev/pytest | test.yml | **`package` fully green** (fetch-depth:0 checkout + hynek build via fixes #12/#16); 15 ubuntu tox legs starved on pool serialization (no test signal); macos/windows starved (expected) |
+
+## Rerun with fixes (2026-09-12/13)
+
+- Full workflow reruns on the final stack: hugo's Ubuntu jobs are green;
+  pytest's `package` job is green (including the `fetch-depth: 0` checkout
+  and hynek build); jekyll's profiler test is green; nushell's relabeled
+  std-lib workflow is green 5/5. The pytest tox matrix still has no signal
+  for its unavailable platform cells because this host has one serialized
+  Linux runner.
+- Django remains 1/4 (scripts green; Chrome-dependent JavaScript and
+  free-threaded Python environment gaps; Windows unavailable). Laravel has
+  one Linux matrix failure plus cancelled siblings and unavailable Windows
+  cells; the remaining Linux failure is workflow/environment-level after the
+  services-PATH fix. fmt still has the gcc-4.9 failure followed by fail-fast
+  cancellation. JUnit has six green jobs; OpenJ9, CodeQL/zizmor credentials,
+  and unavailable Windows/macOS account for the rest.
+- Testcontainers now expands its dynamic module matrix correctly:
+  `lint (modules/compose)` is materialized and runs. Its remaining failure
+  is `make generate` returning non-zero; the old literal
+  `${{ fromJSON(...) }}` job-name/dynamic-matrix gap is closed.
+- pytest `package` checkout now succeeds in the real workflow (fetch +
+  `checkout --force`); hugo codegen panic gone (`_work/hugo/hugo` in full
+  logs); jekyll keeps the identical single profiler assert (rename applied,
+  didn't fix it — open).
+- Both fixes unveiled the next blocker: `setup-python` 3.14.7 is broken in
+  later steps (`libpython3.14.so.1.0` missing; pip works in-step) — fails
+  pytest `package` and hugo asciidoc. Upstream tarball intact; the drop is
+  in GITHUB_ENV→later-step propagation (suspect composite-inner env).
+- The rerun died of disk exhaustion during junit (8/10 snapshotted; junit
+  and testcontainers unsalvaged). Late-run verdicts are contaminated by
+  600s pool starvation (grpc latest/latest-1/-race/arm show steps `pending`,
+  not build failures) — scheduling casualties, not regressions.
+- Targeted proofs (not the noisy rerun) remain dispositive; see
+  `pytest/validation/`, `hugo/validation/`, `jekyll/validation/`,
+  `nushell/` (relabel experiment).
+| django/django | tests.yml | 1/4 — scripts-tests green; JS red (chrome libs); 3.14t red (missing step output); windows starved |
+| laravel/framework | tests.yml | 0 passing — runner bugs fixed (verified zero), now blocked on creds + mysql flake |
+| fmtlib/fmt | linux.yml | 0 executed — 1 env leg (gcc-4.9 amd64-only) + fail-fast cascade cancels 18 |
+| nushell/nushell | ci.yml | 0 runnable — all jobs pinned to Incredibuild custom fleet; submit fixed |
+| jekyll/jekyll | ci.yml | profiler assert fixed (single-test proof `0 failures` + Ruby 2.7 Linux green in rerun); 3.3/3.4/profile/rubocop never scheduled (pool starvation); JRuby red (locale); windows starved |
+| junit-team/junit5 | ci.yml | **6 green post-fix** (Build/Linux, docs, openjdk 26/27/28, reproducibility); windows/macOS starved; CodeQL+zizmor creds; openJ9 TBD; status cascade-correct |
+| testcontainers-go | ci.yml | dynamic matrix now expands to `modules/compose`; lint runs and fails in `make generate` (generated-file/workflow environment issue), remaining platform jobs skip |
+
+## Bugs found & fixed (branch, all with regression tests)
+
+1. **Expression `Index{base,key}`** (`preloop-gha-expressions`): `env[matrix.target.options]`
+   rejected (`unexpected token Dot`), nushell unsubmittable. Full bracket-expression
+   parsing; literal fast path preserved.
+2. **Composite `working-directory` never evaluated** (runner): literal
+   `${{ inputs.working-directory }}` became the spawn cwd (junit).
+3. **`$/` nested-local-action fallback** (runner): workspace-local composites
+   errored (junit main-build). Falls back to workspace join.
+4. **Node entry-point containment by repo root** (runner): gradle `../dist/...`
+   + codeql `../lib/...` legit layouts rejected; unblocked gradle + codeql init.
+5. **Per-action `INPUT_*` scoping** (runner composite+node+docker): parent inputs
+   leaked into nested actions; setup-gradle died on its removed `arguments`.
+6. **`github.action_path` empty in nested composites** (runner): produced
+   `/setup-testlens.sh` → 127 (junit). Save/restore per composite level.
+7. **Services-only jobs took container PATH branch** (runner): host-PATH fallback
+   skipped, first GITHUB_PATH write replaced PATH with extras-only, all later
+   spawns ENOENT (laravel). Flag now requires a real job container.
+8. **Empty-PATH fallback** (runner): defense + warning log.
+9. **Disk-backed `/tmp` provisioning** (orchestrator): 8 GB tmpfs killed heavy
+   Go builds; GitHub uses disk-backed /tmp. Verified live on fresh forks.
+10. **`preloop golden-path`** (hidden CLI): exact packed-artifact path from server
+    code; hand-rolled fingerprint drift caused full 9 GB rebuilds.
+11. **Spawn diagnostics** (runner, kept): program/cwd-exists/PATH in the error —
+    decisive in two investigations.
+12. **Snapshot git transport ignored `Content-Encoding: gzip`** (server):
+    git gzip-encodes large smart-HTTP POST bodies; the full-history fetch
+    (thousands of want lines, ~6 KB) arrived gzipped and was piped raw to
+    `git http-backend`, which died with `bad line length character` while the
+    client reported `fatal: expected 'packfile'`. This was pytest's
+    `fetch-depth: 0` killer. Fixed with `decode_git_request_body` + regression
+    test; verified live: depth-0 checkout succeeds (17732 commits), depth-1
+    still succeeds. Evidence in `pytest/validation/`.
+13. **Job workspace is now `<work>/<repo>/<repo>`** (runner): the claim
+    message carries no work directory, so every job landed in
+    `_work/default/default` while GitHub uses `/home/runner/work/<repo>/<repo>`.
+    hugo's codegen test panics unless the absolute path contains `"hugo"`.
+    `setup_workspace` derives both segments from
+    `contextData.github.repository` (decoded from the AzDO typed-dict wire
+    form), with strict `owner/repo` validation and the historical fallback.
+    Shared helper `workspace_dir_for_repository` + regression tests (plain
+    and tagged shapes; fails-without verified). Verified live: hugo checkout
+    lands in `_work/hugo/hugo` and the previously panicking
+    `TestMethods/MethodsFromTypes` passes (`ok codegen 1.020s`). Evidence in
+    `hugo/validation/`.
+14. **smolvm 1.8.2 → 1.15.0 (infra)**: clone boots died code 133 (`no
+    active virtual interrupt`) and rollback-resume failed (`EINVAL`), so
+    every job was a ~30 GB full materialization — the disk deaths and most
+    600s starvations trace here. 1.14.6 was unpairable (demands
+    `krun_set_cpu_template`, absent from both the 1.8.2-era shipped libs
+    and Homebrew upstream libkrun). 1.15.0 + bundled libs forks correctly
+    (second job boots in ~60s, clones ~1 GB). Harness pins
+    `~/.smolvm/1.15.0` via `SMOLVM_HOME_DIR`.
+15. **Node externals fallback to legacy baked path** (runner): packed VMs
+    never mount externals (IRQ budget) — they use the golden-baked
+    `/var/lib/preloop-runner/externals`. The `/home/runner` move put the
+    upward walk out of reach and every node action died (`bundled node24
+    is missing`). The lookup now falls back to the legacy root when the
+    walk misses (seam unit-tested incl. precedence). Proven live: jekyll
+    setup-ruby runs and the profiler test passes
+    (`1 tests, 5 assertions, 0 failures`).
+16. **Tool cache defaults to `/opt/hostedtoolcache`** (runner): version
+    tarballs bake an absolute RUNPATH there, and actions with
+    `update-environment: false` (hynek's composite, pytest `package`)
+    rely on the interpreter loading without `LD_LIBRARY_PATH` — true on
+    hosted, false with the old `_work/_tool` default (also fails on stock
+    self-hosted runners). `RUNNER_TOOL_CACHE` + `AGENT_TOOLSDIRECTORY`
+    now prefer the hosted path when present and writable (our provisioning
+    already creates/chmods it), else the old default. Proven live: pytest
+    `package` fully green (`Using CPython ... /opt/hostedtoolcache/...`,
+    sdist + wheel built). Evidence in `pytest/validation/`.
+
+## Fidelity findings for follow-up (not fixed)
+
+- **P1 — snapshot lifecycle vs queue wait**: `repository not found` when jobs
+  claim ~10 min after submit.
+- **P1 — builder-stop EAGAIN exits the whole server** (seen once).
+- **P2 — checkout dir naming**: `_work/default/default` vs repo name breaks
+  path-assuming tests (hugo codegen `MethodsFromTypes`, jekyll profiler —
+  identical signature on 3 rubies).
+- **Possible log-capture gap**: django 3.14t ran 3.5 min with zero step output.
+- **Env gaps (golden)**: qemu-i386 (grpc), chrome system libs (django JS),
+  JRuby locale (`Malformed input`, bundler), gcc-4.9 amd64 (fmt),
+  EA/OpenJ9 JDK legs, Incredibuild labels (nushell).
+- **Credentials (local-only box, no GitHub token)**: fake local GITHUB_TOKEN
+  poisons composer auth (laravel) and fails CodeQL/zizmor (401s).
+
+## Infra notes
+
+SUPERSEDED by fix #14: smolvm/libkrun must be a matched pair — 1.14.6
+demands `krun_set_cpu_template` (absent from 1.8.2-era libs and Homebrew
+upstream libkrun alike); 1.8.2's fork path is broken. Campaign now pins
+`~/.smolvm/1.15.0` (binary + bundled libs + agent-rootfs) via
+`SMOLVM_HOME_DIR`, still shadowed onto PATH through `$CAMPAIGN_HOME/bin`.
+- Disk: 258 stale VMs + 85 GB stale store deleted (was 99%); storage cap
+  160→100 GB; APFS clones share ~97% (6 VMs ≈ 6 GB real).
+- Server restart wipes run logs (state under CAMPAIGN_HOME); `run.json`
+  snapshots survive — diagnose live or lose logs.
+- `cargo zigbuild` needs `rust-std aarch64-unknown-linux-gnu` (vanished twice);
+  kache staleness linked two stale guests — verify rlib/binary mtimes.
+- mtplx server (Qwen Flash Next) ate ~50 GB; killed + `bootout`ed its system
+  daemon for the campaign; restore with
+  `sudo launchctl bootstrap system /Library/LaunchDaemons/com.nuraydia.mtplx.plist`.
+
+## Evidence
+
+Per-target `run.json` snapshots + server logs under
+`benchmarks/real-world/results/conformance-10repos/`; validation captures in
+`junit/validation/` (5-green run + logs) and `laravel/validation/`
+(composer-auth logs). Harness: `benchmarks/real-world/conformance-10repos.sh`.