Milestone 4.B.3 — Rate Limit Load & Correctness BenchmarkCopy Anchor Link

Status: Completed
Goal: Track B — Rate Limiting & Quota Enforcement
Phase: 4 — Operator Platform & Multi-Provider
Estimated effort: 1 day
Track: Track B — Rate Limiting & Quota Enforcement

---

Why This Milestone ExistsCopy Anchor Link

A permanent regression gate proves the Lua hierarchical limiter is atomic under concurrency — the property the Phase 1 soft slider could not guarantee. The proof is binary: 200 concurrent Checks against RPM 100 must admit exactly 100 and reject exactly 100 (maxAdmitOvershoot=0) at every binding tier.

---

Non-GoalsCopy Anchor Link

• New PR-gating k6 scenario or <5ms stage SLA
• testcontainers-go / Makefile target / ci.yml Redis for the coverage job
• Token-spend / month_tokens (#806)
• Redis Cluster hash tags (#803)

---

Shipped surfaceCopy Anchor Link

Real-Redis correctnessCopy Anchor Link

packages/ratelimit/hierarchical_integration_test.go (//go:build integration):

• Per-tier exact admit (agent / org / global): binding tier RPM=100, others high; 200 concurrent Checks; exactly 100 allowed / 100 denied; DeniedTier matches.
• Same-agent different-orgs independence under real Redis.
• One case seeds the binding limit via ApplyOrgOverrides (DB-override path from 4.B.2).
• Joins existing make test-integration → go test -tags=integration ./... with default REDIS_URL=redis://127.0.0.1:6380/14 (compose-test host mapping).
• CI permanent gate: job ratelimit-hierarchical-integration (wired into ci-gate-go) runs infra/scripts/ratelimit-hierarchical-integration-ci.sh, which Ping-fails closed and rejects any t.Skip.

Latency baseline + gateCopy Anchor Link

• BenchmarkStageRateLimit (miniredis + NewHierarchicalLimiter, huge RPM) unchanged harness.
• baseline.json field synthetic_rate_limit_us + regression_gate.py %Δ ≤ max_regression_pct (20%).
• Full proxy path remains policy.max_proxy_overhead_p99_ms: 20.

Fail-openCopy Anchor Link

Unchanged: TestSecurity_SEC4_6_RedisFailOpen builds hierarchical via mustProxyLimiter, closes miniredis, middleware still admits (fail-open). Package unit TestHierarchical_Check_redisError covers the error return.

Success signalsCopy Anchor Link

• Real-Redis 200/100 zero over-admission at agent, org, and global tiers (+ ApplyOrgOverrides path)
• Same-agent different-orgs independent under real Redis
• BenchmarkStageRateLimit pinned as synthetic_rate_limit_us with 20% regression gate
• Phase 2 proxy p99 < 20ms policy unchanged (no sketch <5ms k6)
• Fail-open covered by SEC-4.6 (no new case)
• Permanent gate via CI job ratelimit-hierarchical-integration (fail-on-skip) + local compose-test-up / make test-integration (REDIS_URL defaults to 6380/14)

Local verificationCopy Anchor Link

1. make compose-test-up — Redis on host 6380 (prints the default REDIS_URL).
2. make test-integration — exports REDIS_URL=redis://127.0.0.1:6380/14 when unset; hierarchical 200/100 tests run (not skip).
3. Or CI-equivalent: REDIS_URL=redis://127.0.0.1:6380/14 bash infra/scripts/ratelimit-hierarchical-integration-ci.sh

PrerequisitesCopy Anchor Link

• M4.B.1 Lua limiter merged
• M4.B.2 config / ApplyOrgOverrides merged