ci: the sip codec gate names its features instead of asking for all

With the gate split, codec-features-sip finished inside its budget and
then failed honestly: perf_ai_agent_load panics with "perf tests must be
run with --release; debug-build numbers are not citable".

That guard is deliberate. The perf targets are release-only by contract
-- the release catalog runs them as `--release --features perf-tests,...
--test <name>` -- so a debug gate that enables perf-tests measures
nothing and fails by construction. `--all-features` was enabling them
only as a side effect of asking for everything.

So rvoip-sip now names its features: all thirteen except the `perf-*`
family. The codec surface the gate exists for is untouched, and
generated-validation and dev-insecure-tls stay on, so nothing this gate
covered before goes uncovered now. The other three packages keep
--all-features, having no perf harness to exclude.

The list is written out to keep the command readable, and a test derives
the same set from rvoip-sip's manifest, so a new feature fails the suite
rather than silently sitting outside the gate.

Verified with the gate's exact command: 20 test targets, no failures.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: eisenzopf

scripts/ci/run_checks.py

@@ -32,6 +32,15 @@
     "codec-features-core": "rvoip-core",
 }
 
+# Every `rvoip-sip` feature except the release-only `perf-*` harness. Written
+# out rather than computed so the command is inspectable from here; the
+# accompanying test derives the same set from the manifest and fails if a new
+# feature is added without a decision about this gate.
+NON_PERF_SIP_FEATURES = (
+    "all-codecs,amr,amr-nb,amr-wb,dev-insecure-tls,dhat,event-history,g729,"
+    "generated-validation,opus,opus-sim,persistence,tokio-console"
+)
+
 
 class CheckError(RuntimeError):
     """Invalid CI input or environment."""
@@ -372,42 +381,51 @@ def specialty_commands(
         # and its own cache key. The patterns in `policy.json` stay identical
         # across the four, so any change that selected the combined gate still
         # verifies all four packages.
-        commands = []
-        for package in (CODEC_FEATURE_GATES[gate],):
-            commands.extend(
+        package = CODEC_FEATURE_GATES[gate]
+        # `--all-features` everywhere except `rvoip-sip`, whose feature set
+        # includes the `perf-*` harness. Those targets are release-only by
+        # contract -- `EnvironmentBlock::capture` panics under
+        # `debug_assertions` rather than publish a number nobody should cite,
+        # and the release catalog runs them as `--release --features
+        # perf-tests,... --test <name>`. Turning them on in a debug gate does
+        # not measure anything, it just fails. Every other feature stays on,
+        # so the codec surface this gate exists for is unchanged.
+        selection = (
+            ["--features", NON_PERF_SIP_FEATURES]
+            if package == "rvoip-sip"
+            else ["--all-features"]
+        )
+        return [
+            (
                 [
-                    (
-                        [
-                            "cargo",
-                            "test",
-                            "--locked",
-                            "--all-features",
-                            "--lib",
-                            "--tests",
-                            "--bins",
-                            "--examples",
-                            "-p",
-                            package,
-                        ],
-                        None,
-                        None,
-                    ),
-                    (
-                        [
-                            "cargo",
-                            "clippy",
-                            "--locked",
-                            "--all-features",
-                            "--all-targets",
-                            "-p",
-                            package,
-                        ],
-                        None,
-                        None,
-                    ),
-                ]
-            )
-        return commands
+                    "cargo",
+                    "test",
+                    "--locked",
+                    *selection,
+                    "--lib",
+                    "--tests",
+                    "--bins",
+                    "--examples",
+                    "-p",
+                    package,
+                ],
+                None,
+                None,
+            ),
+            (
+                [
+                    "cargo",
+                    "clippy",
+                    "--locked",
+                    *selection,
+                    "--all-targets",
+                    "-p",
+                    package,
+                ],
+                None,
+                None,
+            ),
+        ]
     if gate == "rtp-interop":
         return [(["bash", "scripts/test_libsrtp_interop.sh"], None, None)]
     if gate == "amazon-connect-aws-control":

scripts/ci/test_run_checks.py

@@ -3,9 +3,11 @@
 import importlib.util
 from pathlib import Path
 import sys
+import tomllib
 import unittest
 
 
+ROOT = Path(__file__).resolve().parents[2]
 SCRIPT = Path(__file__).with_name("run_checks.py")
 SPEC = importlib.util.spec_from_file_location("run_checks", SCRIPT)
 assert SPEC and SPEC.loader
@@ -153,10 +155,17 @@ def test_codec_gate_runs_what_the_default_feature_shards_compile_out(self) -> No
                 # a gate that quietly grew a second package would restore the
                 # timeout this split exists to remove.
                 self.assertEqual(len(argv), 2)
-                # Every command asks for all features. A command here without
-                # it is a command that duplicates the shard and proves nothing.
+                # Every command turns the optional features on. A command here
+                # limited to the defaults duplicates the shard and proves
+                # nothing. `rvoip-sip` names them instead of asking for all,
+                # because "all" includes the release-only perf harness.
                 for command in argv:
-                    self.assertIn("--all-features", command)
+                    if package == "rvoip-sip":
+                        self.assertIn("--features", command)
+                        self.assertIn(run_checks.NON_PERF_SIP_FEATURES, command)
+                        self.assertNotIn("--all-features", command)
+                    else:
+                        self.assertIn("--all-features", command)
                 # Exact list membership, not a substring match, so
                 # "rvoip-core" does not also claim rvoip-codec-core's rows.
                 owned = [command for command in argv if package in command]
@@ -165,6 +174,23 @@ def test_codec_gate_runs_what_the_default_feature_shards_compile_out(self) -> No
                     sorted(command[1] for command in owned), ["clippy", "test"]
                 )
 
+    def test_sip_codec_gate_names_every_feature_except_the_perf_harness(self) -> None:
+        # Derived from the manifest rather than restated, so adding a feature
+        # to rvoip-sip fails here instead of silently going ungated -- the
+        # same staleness that let the hard-coded package count above rot.
+        manifest = ROOT / "crates/sip/rvoip-sip/Cargo.toml"
+        with manifest.open("rb") as handle:
+            features = tomllib.load(handle)["features"]
+        expected = sorted(
+            name
+            for name in features
+            if name != "default" and not name.startswith("perf")
+        )
+        self.assertEqual(run_checks.NON_PERF_SIP_FEATURES.split(","), expected)
+        # The exclusion is the perf harness and nothing else. If rvoip-sip
+        # ever stops having one, this gate should go back to --all-features.
+        self.assertTrue(any(name.startswith("perf") for name in features))
+
     def test_shards_alone_never_reach_the_optional_codecs(self) -> None:
         # The reason the gate above exists, asserted rather than assumed: the
         # shard that owns rvoip-codec-core builds it with its default features,