20260722 新增密码学签名验证缓存（#126）：5个验签收口点接入独立缓存，observe-only/enable双开关默认关闭，消融脚本新增crypto-sig等case set，verification contract补crypto_signature字段

scripts/soak/run_cache_ablation_experiment.sh

@@ -38,7 +38,7 @@ Environment:
   EXPERIMENT_RUN_ROOT          shared run root/state root; default PACKAGE_ROOT
   EXPERIMENT_DIR               experiment metadata output directory
   CASE_RUNS                    delta runs per case; default 10
-  EXPERIMENT_CASE_SET          default or cache-only; default runs the original 4-case matrix
+  EXPERIMENT_CASE_SET          default, cache-only, crypto-sig or sig-pp-compare; default runs the original 4-case matrix
   RUN_START_INTERVAL_SECS      fixed start cadence for all runs; default 600
   FIRST_RUN_DELAY_SECS         delay before the first scheduled run; default 0
   SNAPSHOT_EXTRA_ARGS          extra rpki args for snapshot warmup
@@ -95,7 +95,10 @@ case_count() {
   case "$EXPERIMENT_CASE_SET" in
     default) printf '%s' 4 ;;
     cache-only) printf '%s' 3 ;;
-    *) die "EXPERIMENT_CASE_SET must be default or cache-only: $EXPERIMENT_CASE_SET" ;;
+    crypto-sig) printf '%s' 4 ;;
+    sig-pp-compare) printf '%s' 2 ;;
+    baseline-combo) printf '%s' 2 ;;
+    *) die "EXPERIMENT_CASE_SET must be default, cache-only, crypto-sig or sig-pp-compare: $EXPERIMENT_CASE_SET" ;;
   esac
 }
 
@@ -108,6 +111,14 @@ case_id_for_index() {
     cache-only:1) printf '%s' "pp-only" ;;
     cache-only:2) printf '%s' "object-only" ;;
     cache-only:3) printf '%s' "pp-object-only" ;;
+    crypto-sig:1) printf '%s' "baseline" ;;
+    crypto-sig:2) printf '%s' "sig-only" ;;
+    crypto-sig:3) printf '%s' "pp-object" ;;
+    crypto-sig:4) printf '%s' "pp-object-sig" ;;
+    sig-pp-compare:1) printf '%s' "sig-only" ;;
+    sig-pp-compare:2) printf '%s' "pp-only" ;;
+    baseline-combo:1) printf '%s' "baseline" ;;
+    baseline-combo:2) printf '%s' "pp-object-sig" ;;
     *) die "unknown case index: $1 for set $EXPERIMENT_CASE_SET" ;;
   esac
 }
@@ -121,6 +132,14 @@ case_name_for_index() {
     cache-only:1) printf '%s' "pp-cache-only" ;;
     cache-only:2) printf '%s' "object-cache-only" ;;
     cache-only:3) printf '%s' "pp-cache-object-cache-only" ;;
+    crypto-sig:1) printf '%s' "all-cache-off" ;;
+    crypto-sig:2) printf '%s' "crypto-sig-cache-only" ;;
+    crypto-sig:3) printf '%s' "pp-cache-object-cache" ;;
+    crypto-sig:4) printf '%s' "pp-cache-object-crypto-sig-cache" ;;
+    sig-pp-compare:1) printf '%s' "crypto-sig-cache-only" ;;
+    sig-pp-compare:2) printf '%s' "pp-cache-only" ;;
+    baseline-combo:1) printf '%s' "all-cache-off" ;;
+    baseline-combo:2) printf '%s' "pp-cache-object-crypto-sig-cache" ;;
     *) die "unknown case index: $1 for set $EXPERIMENT_CASE_SET" ;;
   esac
 }
@@ -134,14 +153,22 @@ case_extra_args_for_index() {
     cache-only:1) printf '%s' "--enable-publication-point-validation-cache" ;;
     cache-only:2) printf '%s' "--enable-roa-validation-cache" ;;
     cache-only:3) printf '%s' "--enable-publication-point-validation-cache --enable-roa-validation-cache" ;;
+    crypto-sig:1) printf '%s' "" ;;
+    crypto-sig:2) printf '%s' "--enable-crypto-signature-cache" ;;
+    crypto-sig:3) printf '%s' "--enable-publication-point-validation-cache --enable-roa-validation-cache" ;;
+    crypto-sig:4) printf '%s' "--enable-publication-point-validation-cache --enable-roa-validation-cache --enable-crypto-signature-cache" ;;
+    sig-pp-compare:1) printf '%s' "--enable-crypto-signature-cache" ;;
+    sig-pp-compare:2) printf '%s' "--enable-publication-point-validation-cache" ;;
+    baseline-combo:1) printf '%s' "" ;;
+    baseline-combo:2) printf '%s' "--enable-publication-point-validation-cache --enable-roa-validation-cache --enable-crypto-signature-cache" ;;
     *) die "unknown case index: $1 for set $EXPERIMENT_CASE_SET" ;;
   esac
 }
 
 case_child_cert_cache_for_index() {
   case "$EXPERIMENT_CASE_SET:$1" in
-    default:4|cache-only:2|cache-only:3) printf '%s' "1" ;;
-    default:1|default:2|default:3|cache-only:1) printf '%s' "0" ;;
+    default:4|cache-only:2|cache-only:3|crypto-sig:3|crypto-sig:4|baseline-combo:2) printf '%s' "1" ;;
+    default:1|default:2|default:3|cache-only:1|crypto-sig:1|crypto-sig:2|sig-pp-compare:1|sig-pp-compare:2|baseline-combo:1) printf '%s' "0" ;;
     *) die "unknown case index: $1 for set $EXPERIMENT_CASE_SET" ;;
   esac
 }
@@ -163,6 +190,23 @@ elif case_set == "cache-only":
         {"caseId": "object-only", "caseName": "object-cache-only", "extraArgs": "--enable-roa-validation-cache", "enableChildCertificateValidationCache": True},
         {"caseId": "pp-object-only", "caseName": "pp-cache-object-cache-only", "extraArgs": "--enable-publication-point-validation-cache --enable-roa-validation-cache", "enableChildCertificateValidationCache": True},
     ]
+elif case_set == "crypto-sig":
+    cases = [
+        {"caseId": "baseline", "caseName": "all-cache-off", "extraArgs": "", "enableChildCertificateValidationCache": False},
+        {"caseId": "sig-only", "caseName": "crypto-sig-cache-only", "extraArgs": "--enable-crypto-signature-cache", "enableChildCertificateValidationCache": False},
+        {"caseId": "pp-object", "caseName": "pp-cache-object-cache", "extraArgs": "--enable-publication-point-validation-cache --enable-roa-validation-cache", "enableChildCertificateValidationCache": True},
+        {"caseId": "pp-object-sig", "caseName": "pp-cache-object-crypto-sig-cache", "extraArgs": "--enable-publication-point-validation-cache --enable-roa-validation-cache --enable-crypto-signature-cache", "enableChildCertificateValidationCache": True},
+    ]
+elif case_set == "sig-pp-compare":
+    cases = [
+        {"caseId": "sig-only", "caseName": "crypto-sig-cache-only", "extraArgs": "--enable-crypto-signature-cache", "enableChildCertificateValidationCache": False},
+        {"caseId": "pp-only", "caseName": "pp-cache-only", "extraArgs": "--enable-publication-point-validation-cache", "enableChildCertificateValidationCache": False},
+    ]
+elif case_set == "baseline-combo":
+    cases = [
+        {"caseId": "baseline", "caseName": "all-cache-off", "extraArgs": "", "enableChildCertificateValidationCache": False},
+        {"caseId": "pp-object-sig", "caseName": "pp-cache-object-crypto-sig-cache", "extraArgs": "--enable-publication-point-validation-cache --enable-roa-validation-cache --enable-crypto-signature-cache", "enableChildCertificateValidationCache": True},
+    ]
 else:
     raise SystemExit(f"unknown case set: {case_set}")
 print(json.dumps(cases, ensure_ascii=False, indent=8))
@@ -345,6 +389,7 @@ else:
         "publication_point_cache_index_load",
         "publication_point_cache_index_refresh",
         "roa_validation_cache",
+        "crypto_signature_cache_observe",
     ]:
         if key in stage:
             record[key] = stage.get(key)
@@ -360,6 +405,11 @@ else:
         "child_certificate_cache_miss_not_found",
         "fresh_publication_points",
         "fresh_manifest_files_total",
+        "crypto_signature_cache_observe_calls",
+        "crypto_signature_cache_observe_would_hit",
+        "crypto_signature_cache_observe_new_keys",
+        "crypto_signature_cache_verify_executed",
+        "crypto_signature_cache_verify_skipped",
     ]
     record["cacheCounts"] = {k: analysis_counts.get(k) for k in interesting if k in analysis_counts}
     record["repoSyncStats"] = summary.get("repoSyncStats")

scripts/verification/README.md

@@ -29,7 +29,7 @@
 - `vrps.csv`、`vaps.csv`
 - `stage-timing.json`、`validation-events.jsonl`
 - `validation-contract.json`、`verification-meta.json`
-- `compare/ccr-state-compare.json`、`compare/ccr-state-compare.md`
+- `compare/ccr-state-digest.json`、`compare/ccr-state-digest.md`
 - `stdout.log`、`stderr.log`、`process-time.txt`、`wrapper-timing.json`
 
 通过条件是 compare JSON 中 `stateDigestMatch=true`。`producedAt` 不参与比较。