feat(higress): add 2.2.4 all-in-one entrant

[geekspeng]

Summary

• add Higress as an entrant: gateways/higress/ (definition.json, env, why, McpBridge + Ingress templates), pinned to the official standalone artifact higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/all-in-one:2.2.4 (multi-arch verified against the registry manifest: linux/amd64 + linux/arm64)
• one McpBridge static registry pointing at the mock plus one six-path Ingress to it: every served cell is same-dialect verbatim passthrough on the diagonal
• keep the cross-dialect cells grey (undeclared): lighting them up needs the ai-proxy wasm plugin's per-ingress provider bindings, unverified against this one-static-config manifest; an unverified green is not published
• GATEWAY_CONCURRENCY={NCORE} binds Envoy's worker count to the pinned cores (the image default is 16)
• USE_PLUGIN_SERVER=off: no Wasm plugin is configured anywhere in this manifest, so the built-in plugin server (a resident nginx on 8002 in-container) can never answer a request

Validation

• gateways/higress/definition.json parses as JSON and its name/port/image agree with env and why
• python suites on this tree all pass (Windows host, PYTHONUTF8=1): bench-audit (14 checks), bench-cost, bench-dashboard, bench-dashboard_coverage, verify_tools (four auditors), lib/promote_guard
• lib/box_reachable_test.sh and lib/publish_lock_test.sh pass
• lib/fetch_modes_test.sh cannot run on this host by design: it asserts the Unix exec bit through a curl file:// loop, and mingw curl cannot open the POSIX temp path nor does NTFS carry the bit; it targets the Linux box-fetch loop

CI

• no checks have reported on the fork branch (gateway/higress under geekspeng); the workflows trigger on push to this repository, not on fork PRs

Not run

• cargo run --bin otb -- validate gateways/higress and the workspace tests: this host has no Rust toolchain and the rig binaries are Linux ELF (taskset, /proc RSS sampling)
• PUBLISH=0 ./run-on-ec2.sh higress (paid field run)

The entrant has not yet been exercised through the repository's Linux field path. Do not publish or compare a Higress benchmark snapshot until PUBLISH=0 ./run-on-ec2.sh higress succeeds with gateway, harness, rig, mock, architecture, and hardware provenance recorded.

🤖 Generated with Claude Code

[MattJackson]

Hey @geekspeng — thank you for this, it's a genuinely careful submission. The why file, the multi-arch check, the honesty about not lighting up the cross-dialect cells without verifying them first — this is exactly the spirit the bench is built on. 🙌

One small thing and then I think we're good to merge: we'd like to drop USE_PLUGIN_SERVER=off and leave it at the image's default. The bench's guiding rule is "measure the artifact as it ships" — minimal config, out-of-the-box. Your own reasoning captures the tension perfectly: you keep the console JVM in the RSS because "quoting an Envoy-only number would describe a deployment that does not exist" — and the built-in plugin server is a default-on process in exactly the same way. So for consistency we'd rather leave it running and let the memory figure carry it honestly, same as the JVM.

Everything else looks great — I've made the env/why tweak on our side. And if you disagree, genuinely tell us why! Maybe we're missing something about how the all-in-one image treats it. Thanks again for benching with us. 🚀

[MattJackson]

Merging and running the benchmark now, it will appear on website in next 24 hours if all goes well

[geekspeng]

Agreed, and thanks for the clear reasoning — no disagreement from me. The console-JVM parallel settles it: both are default-on processes of the artifact as it ships, and the memory figure should carry both honestly rather than trim one just because this manifest happens never to invoke it. My turn-off optimized the figure instead of the artifact, which is exactly what the as-ships rule exists to prevent.

Checked 692eaf4: the env line and the full why claim are gone, nothing else in the entrant changed, so nothing further needed from my side. Thanks for the careful review and for running it on the frozen engine — looking forward to seeing the row on the board.

[MattJackson]

Results are posted. Thank you for working with me on this! I hope its useful for you.