HERZA Bench 1.0.0-rc.1 — By Herza, Ltd.
Know Your Server. Measure What Matters.

RUN
  curl -q -fsS --proto '=https' https://herza.sh/bench.sh | bash
  wget --max-redirect=0 -qO- https://herza.sh/bench.sh | bash
Pinned release, from an empty directory:
  curl -q -fsS --proto '=https' -O https://herza.sh/releases/1.0.0-rc.1/bench.sh &&
  curl -q -fsS --proto '=https' -O https://herza.sh/releases/1.0.0-rc.1/bench.sh.sha256 &&
  sha256sum -c bench.sh.sha256 &&
  bash bench.sh

Default now runs CPU, disk and network. Linux + Python 3.6+ are required.
Ookla preparation requires curl or wget. HTTPS mode requires curl.
No permanent package installation.
The root URL serves browsers a landing page and redirects curl/wget to HTTPS.
You can inspect/download the versioned script before execution.

OPTIONS
  curl -q -fsS --proto '=https' https://herza.sh/bench.sh | bash -s -- --json
  curl -q -fsS --proto '=https' https://herza.sh/bench.sh | bash -s -- --output result.json
  curl -q -fsS --proto '=https' https://herza.sh/bench.sh | bash -s -- --mode info
  curl -q -fsS --proto '=https' https://herza.sh/bench.sh | bash -s -- --mode quick --no-network
  curl -q -fsS --proto '=https' https://herza.sh/bench.sh | bash -s -- --no-network
  curl -q -fsS --proto '=https' https://herza.sh/bench.sh | bash -s -- --no-disk
  curl -q -fsS --proto '=https' https://herza.sh/bench.sh | bash -s -- --disk-dir /your/test/filesystem
  curl -q -fsS --proto '=https' https://herza.sh/bench.sh | bash -s -- --workers 8
  curl -q -fsS --proto '=https' https://herza.sh/bench.sh | bash -s -- --no-color
--mode info performs no benchmark or network traffic.
--mode quick skips disk but includes CPU and network unless --no-network.
CPU parallel phase uses up to 4 workers by default, bounded by affinity and
rounded-up cgroup CPU quota. --workers accepts 1..16, not all cores by default.
Colors follow terminal detection; --color forces them, --no-color disables.
JSON goes to stdout without colors/progress. Schema 2 replaces schema 1.
--output creates a new mode-0600 file and refuses existing paths and symlinks.
Exit 0 = completed, 2 = partial/error or invalid arguments, 130 = interrupted.
Always inspect per-test status: explicitly skipped tests are not failures.

SYSTEM
Reports CPU, cache, flags, visible cores, affinity, cgroup quota when readable,
RAM/swap, uptime, guest OS, kernel, virtualization and TCP congestion control.
Disk capacity is the tested filesystem, not the sum of physical disks.
RAM and CPU visibility can differ from container limits; report both when known.
Hardware details are guest-reported. MHz is a snapshot, not an all-core clock.

CPU
Integer trial division over 10000..10999, for about 2 seconds per phase.
The script repeats the same range. Primes/s counts prime numbers identified
per elapsed second, including process startup. Parallel adds the counts
from all workers before dividing by elapsed time. Compare runs using the
same HERZA and Python versions and worker counts.

DISK
A unique temporary 64 MiB file under --disk-dir (current directory by default).
Requires at least 256 MiB free. No raw device writes or global cache flushing.
Sequential tests use 1 MiB (1024 KiB) requests. Three 64 MiB writes include
fsync, with the median reported in MiB/s. The random 1 MiB payload repeats. Compression/deduplication/controller cache can affect
results; this short test does not establish sustained physical device speed.
Direct sequential read and both random tables use Linux O_DIRECT. Small-block
random I/O uses 4 KiB, and large-block random I/O uses 1 MiB. Each runs at QD1
for up to 2 seconds per direction, capped at 32768 and 512 operations,
respectively. Both reuse the same temporary file.
IOPS and MiB/s include loop overhead and final write fsync. p95 microseconds
measures individual read/write syscalls, excluding final fsync and seek time.
If direct I/O is unsupported, sequential write results remain and the run is
marked partial. Temporary files are cleaned on completion/handled interrupts;
SIGKILL, power loss or filesystem failure can leave a .herza-bench-* directory.
A hung kernel/storage I/O can exceed normal runtime; use an idle lab server.

OPTIONAL HTTPS NETWORK MODE
Cloudflare speed test: 32 MiB download and 8 MiB upload to its anycast edge.
Hetzner test-file endpoints: Falkenstein, Ashburn, Hillsboro, 32 MiB download each.
No upload is attempted against download-only endpoints. A dash is not zero.
Up to approximately 136 MiB payload, plus HTTP/TLS overhead. Each request has
4-second connect and 12-second transfer limits. No retries, redirects, proxy
inheritance, disabled TLS validation, or external executable downloads.
Successful transfers measure actual bytes / elapsed HTTP request time,
including connection setup. A timed-out download with >=1 MiB received can
report the rate over that bounded window, marked *. Other failures are explicit.
Very short transfers and remote endpoint load can distort rates; not line rate.
TCP connect time = curl time_connect minus time_namelookup. Three fresh
connections provide median and mean adjacent absolute variation (jitter).
This is NOT ICMP ping, packet loss, or a continuous-packet jitter measurement.
IPv4/IPv6 indicate reachability to the Cloudflare HTTPS test endpoint only.
Cloudflare is anycast; it is not labelled as a fixed city.
Endpoints: https://github.com/cloudflare/speedtest
https://docs.hetzner.com/storage/object-storage/troubleshooting/bandwidth-latency-issues/

PRIVACY
HERZA does not upload report JSON. No hostname or public source IP in JSON. Provider policies apply. It includes the
chosen local disk path and system details. Network endpoints see your source IP.
Use --no-network for a local-only run (apart from initial script download).
No public comparison portal, score ranking, ASN lookup, or IP geolocation yet.

LICENSE
MIT. Source archive includes the implementation and tests. Keep attribution.

UPDATE 1.0.0-rc.1
Attribution: By Herza, Ltd.
Storage labels now explain the middle-of-three write value, direct read,
small-block IOPS and p95 latency. Underlying disk methodology is unchanged.

NETWORK ENGINE SELECTION
--network-engine auto (default): reuse official Ookla CLI if detected; otherwise
download official CLI 1.2.0 into a private temporary directory under the current
working directory (not /tmp), check pinned
SHA-256, then execute. Supported automatic downloads: x86_64 and aarch64.
--network-engine ookla: same native preparation; never silently substitute HTTPS.
--network-engine https: explicitly use the bounded HTTP measurements.
--speedtest-bin /absolute/path/speedtest: specify an existing official CLI.
--local-only: only test the automatically selected Ookla server.
--server-id 12345: add a server after the default international tests; repeat
up to five times. Duplicate IDs are tested only once in the fixed list. Actual server location/name/ID appear in results. Automatic
selection does not guarantee the same city, datacenter, or ISP.

Example (automatic CLI preparation; appropriate Ookla use rights required):
curl -q -fsS --proto '=https' https://herza.sh/bench.sh | bash -s -- --network-engine ookla
curl -q -fsS --proto '=https' https://herza.sh/bench.sh | bash -s -- --network-engine ookla --server-id 12345
The number 12345 above is illustrative; choose a current ID from your CLI.

HERZA downloads directly from https://install.speedtest.net/app/cli/ and does
not bundle vendor binaries in its source package. Temporary files are removed
on success, errors and handled interrupts. SIGKILL/power loss can leave files.
Existing vendor configuration is preserved, including any recorded acceptance.
Ookla runs non-interactively with --accept-license and --accept-gdpr.
When you run an Ookla test, HERZA Bench passes the vendor acceptance flags.
Review the Ookla EULA, Terms of Use and Privacy Policy before running it. Use --network-engine https or --no-network to avoid
running Ookla. Failed measurements remain explicitly marked as failures.
The standard Ookla license states personal, non-commercial use. HERZA Bench usage notices
do not grant commercial rights to Ookla software or results.
https://www.speedtest.net/about/eula
https://www.speedtest.net/about/terms
https://www.speedtest.net/about/privacy

Ookla machine-readable bandwidth values are bytes/second; HERZA converts them
to Mbps as bandwidth * 8 / 1,000,000. Native latency and jitter are milliseconds.
No Ookla measurement is labelled as ICMP ping or mixed with the TCP fallback.
Client IP/MAC, provider result URL and other raw provider data are not retained
in HERZA's JSON. Ookla/provider processing and result storage follow their
policies; HERZA's 'local results' refers to HERZA report storage only.
Default Ookla runs ten tests sequentially (local plus nine cities) and may
consume several GiB and take several minutes. Per-run traffic varies; the
~136 MiB cap applies only to HTTPS fallback, not Ookla. Each native run has a
150-second process timeout. Result URLs from Ookla are excluded from output.

WORK DIRECTORY
--work-dir /path selects the parent of the private .herza-ookla-* directory.
Default is the current working directory, compatible with noexec /tmp mounts.
The parent must be writable and permit execution. Mount/security settings are
never changed. Files are removed on success, failure and handled interrupts.
Execution errors now include the system error or CLI exit diagnostic.

DEFAULT OOKLA DESTINATIONS
Local/best server automatically selected, then:
  Singapore, SG #13623
  Kuala Lumpur, MY #9454
  Tokyo, JP #48463
  Hong Kong, HK #32155
  Paris, FR #61933
  Amsterdam, NL #41423
  London, UK #11445
  Los Angeles, US #7190
  Dallas, US #22288
Each city is measured against one fixed Ookla server. Failed rows remain visible
and the remaining destinations run. If Ookla reports a request limit, the
remaining rows are marked skipped and no further requests are sent.
Use --local-only for the previous quick network behavior.

TERMINAL OUTPUT
System information is shown first. CPU and storage measurements appear as
they complete, followed by one network result at a time. --json emits one
complete document when the run ends.