# NFT-PERF-04 — Spoofing-promotion latency budget

**Task**: AZ-431_nft_perf_04_spoof_promotion
**Name**: AC-NEW-2 spoofing-promotion latency p95 ≤ 600 ms (AC-NEW-2)
**Description**: Implement NFT-PERF-04 — Tier-1 OR Tier-2; replay multiple blackout-onset events with paired GPS spoof injection (sample N=20+ via `blackout_spoof.py` with random window starts); per event measure `t_label_switch_to_dead_reckoned − t_blackout_onset`; assert `p95 ≤ 600 ms`.
**Complexity**: 3 points
**Dependencies**: AZ-406, AZ-407, AZ-408
**Component**: Blackbox Tests / Performance / Security (epic AZ-262)
**Tracker**: AZ-431
**Epic**: AZ-262 (E-BBT)

## Problem

Spoofing-promotion latency (the time from a spoof+blackout event to the SUT correctly labeling estimates `dead_reckoned`) is a security-critical metric — slow promotion means the FC may briefly trust spoofed GPS. AC-NEW-2 sets the p95 ≤ 600 ms budget; this requires statistical sampling.

## Outcome

- pytest scenario at `e2e/tests/performance/test_nft_perf_04_spoof_promotion.py`. Tier-1 OR Tier-2.
- N=20 events (configurable; balances confidence vs CI time): each iteration places `blackout_spoof.py` at a different random window start in the Derkachi flight.
- Per event: `t_blackout_onset` = injector-emitted timestamp; `t_label_switch_to_dead_reckoned` = first outbound emission with `source_label = dead_reckoned` after onset.
- Assert `p95(latency) ≤ 600 ms`.

## Scope

### Included
- N=20 spoof-blackout events at randomized window starts.
- Per-event latency measurement.
- p95 assertion.

### Excluded
- Functional correctness of the failsafe ladder — owned by FT-N-04 (AZ-426).

## Acceptance Criteria

**AC-1: N events sampled**
Given the test runs
Then N≥20 spoof-blackout events are exercised across the Derkachi flight.

**AC-2: latency p95**
Given the per-event latencies
Then `p95(latency) ≤ 600 ms`.

**AC-3: parameterization**
Given conftest parameterization
Then the scenario runs per `(fc_adapter, vio_strategy)`.

## System Under Test Boundary

End-to-end through public boundaries.

- **Allowed**: blackout_spoof injector timestamps, SITL outbound capture.
- **Forbidden**: instrumenting SUT internals for the switch event; the switch is detected via outbound stream.

## Constraints

- The injector emits a timestamp at the moment of onset (a public artifact); this is the `t_blackout_onset` reference.

## Document Dependencies

- `_docs/02_document/tests/performance-tests.md` § NFT-PERF-04
- `_docs/02_document/tests/test-data.md` § Performance (NFT-PERF-04 row)
