feat(02-03): publish reproducible benchmark release

Author: Aitomates

.github/workflows/ci.yml

@@ -22,5 +22,6 @@ jobs:
           python-version: ${{ matrix.python-version }}
       - run: python -m pip install -e .
       - run: python -m unittest discover -s tests -v
-      - run: python -m cas_evals.cli benchmarks/v0.1/golden.json
-      - run: python -m cas_evals.cli benchmarks/v0.1/adversarial.json
+      - run: python -m cas_evals.cli benchmarks/v0.2/golden.json
+      - run: python -m cas_evals.cli benchmarks/v0.2/adversarial.json
+      - run: python -m cas_evals.release --check

.planning/phases/02-shared-contracts-and-corpus/02-03-SUMMARY.md

@@ -0,0 +1,28 @@
+---
+phase: 02-shared-contracts-and-corpus
+plan: "03"
+status: complete
+completed: 2026-06-11
+requirements: [REL-01]
+---
+
+# Plan 02-03 Summary
+
+Added a deterministic standard-library release publisher and checked-in v0.2.0 benchmark artifacts. The release manifest records shared-contract provenance plus fixture and result artifact digests. Local verification and cross-platform CI now run the v0.2 suites and reject release drift.
+
+Replaced the stale Phase 1 local result schema with a suite evidence schema that references the vendored published shared result contract.
+
+## Verification
+
+- `powershell -ExecutionPolicy Bypass -File scripts/verify.ps1` - 20 tests, both suites, and release reproducibility passed.
+- `python -m cas_evals.release --check` - passed.
+- `python -m compileall -q src tests` - passed.
+- `git diff --check` - passed.
+
+## Deviations from Plan
+
+**[Rule 2 - Missing Critical] Replaced stale local result schema** - The old local schema described the pre-shared-contract result shape and would mislead consumers. Replaced it with `evaluation-suite.schema.json`, which references the vendored published result contract.
+
+**Total deviations:** 1 auto-fixed missing critical requirement. **Impact:** Contract documentation now matches emitted evidence.
+
+## Self-Check: PASSED

CONTRIBUTING.md

@@ -4,8 +4,8 @@ Contributions must preserve deterministic, secretless execution.
 
 1. Add or update reviewable fixtures.
 2. Explain metric and threshold changes.
-3. Run `python -m unittest discover -s tests -v`.
-4. Run both benchmark suites through the CLI.
+3. Run `.\scripts\verify.ps1`.
+4. Regenerate release artifacts with `python -m cas_evals.release` when fixtures or evaluator behavior changes.
 5. Do not include real secrets, customer data, or network-dependent tests.
 
-Changes that alter result shape must update the schema and include compatibility notes.
+Changes that alter result shape must update the suite schema, shared-contract validation, release artifacts, and compatibility notes.

README.md

@@ -13,13 +13,14 @@ AI engineering claims are weak without reproducible evidence. This repository pr
 ```powershell
 python -m pip install -e .
 python -m unittest discover -s tests -v
-python -m cas_evals.cli benchmarks/v0.1/golden.json --output artifacts/golden.json
-python -m cas_evals.cli benchmarks/v0.1/adversarial.json --output artifacts/adversarial.json
+python -m cas_evals.cli benchmarks/v0.2/golden.json --output artifacts/golden.json
+python -m cas_evals.cli benchmarks/v0.2/adversarial.json --output artifacts/adversarial.json
+python -m cas_evals.release --check
 ```
 
 The CLI exits non-zero when any mandatory metric fails, making each suite usable as a CI regression gate.
 
-Windows users can run the complete verification path with `.\scripts\verify.ps1`. The checked-in [v0.1 benchmark report](docs/benchmark-report-v0.1.md) records the initial public baseline.
+Windows users can run the complete verification path with `.\scripts\verify.ps1`. The checked-in [v0.2 benchmark report](docs/benchmark-report-v0.2.md) and [`releases/v0.2.0/`](releases/v0.2.0/) artifacts record the reproducible public baseline.
 
 ## Metrics
 
@@ -34,15 +35,17 @@ Cost and latency are fixture-supplied in v0.1 so results remain deterministic. F
 
 ## Evidence Contract
 
-Results include `schemaVersion`, `evaluatorVersion`, `caseId`, `correlationId`, fixture SHA-256 digest, independent metric details, and pass/fail status. The schema is conceptually aligned with the CAS lifecycle and will consume versioned `cas-contracts` artifacts in the next phase.
+Every per-case result conforms to the published `cas-contracts` `EvaluationResult` v0.1.0 schema. The exact tagged shared schemas and immutable provenance are vendored under `vendor/cas-contracts/v0.1.0/`, so validation remains offline and standalone. Suite evidence adds fixture SHA-256 digests, independent threshold details, and mandatory pass/fail decisions.
 
-See [`schemas/evaluation-result.schema.json`](schemas/evaluation-result.schema.json).
+See [`schemas/evaluation-suite.schema.json`](schemas/evaluation-suite.schema.json) and [`vendor/cas-contracts/v0.1.0/provenance.json`](vendor/cas-contracts/v0.1.0/provenance.json).
 
 ## Repository Layout
 
 ```text
-benchmarks/v0.1/       Golden and adversarial fixtures
-schemas/               Machine-readable result contract
+benchmarks/v0.2/       Representative golden and adversarial fixtures
+releases/v0.2.0/       Reproducible benchmark release artifacts
+schemas/               Machine-readable suite evidence contract
+vendor/cas-contracts/  Pinned published shared contracts
 src/cas_evals/         Pure evaluator and CLI
 tests/                 Determinism, safety, and CLI contract tests
 .planning/             GSD project context, research, requirements, roadmap

SECURITY.md

@@ -4,4 +4,4 @@ Do not submit real secrets, proprietary prompts, customer data, or executable pa
 
 Report vulnerabilities through GitHub private vulnerability reporting. For urgent issues, include affected version, reproduction steps, impact, and a proposed mitigation. Do not open a public issue before coordinated disclosure.
 
-The v0.1 evaluator performs no network calls and executes no fixture content.
+The evaluator, shared-contract validator, tests, benchmarks, and release generator perform no network calls and execute no fixture content.

docs/benchmark-report-v0.2.md

@@ -0,0 +1,24 @@
+# CAS Evals v0.2 Benchmark Report
+
+**Released:** 2026-06-11  
+**Evaluator:** `cas-evals 0.2.0`  
+**Shared contract:** `cas-contracts v0.1.0`  
+**Execution:** Deterministic local reference evaluation, no network or secrets
+
+| Suite | Cases | Passed | Failed |
+|-------|------:|-------:|-------:|
+| `cas-golden-v0.2` | 8 | 8 | 0 |
+| `cas-adversarial-v0.2` | 6 | 6 | 0 |
+
+The golden corpus covers planning, implementation, debugging, Azure identity, Foundry Next Gen agents, evidence reporting, delivery, and shared contracts. The adversarial corpus covers independent secret, verification, repository, architecture, offline, and metric-safety risks.
+
+Every per-case result conforms to the provenance-pinned published shared evaluation contract. Safety remains a mandatory independent gate and cannot be offset by other metrics.
+
+## Reproduce
+
+```powershell
+python -m pip install -e .
+.\scripts\verify.ps1
+```
+
+`python -m cas_evals.release --check` regenerates artifacts in a temporary directory and verifies byte-for-byte equality with [`releases/v0.2.0/`](../releases/v0.2.0/).

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cas-evals"
-version = "0.1.0"
+version = "0.2.0"
 description = "Reproducible evaluation framework for the Coding Autopilot System"
 readme = "README.md"
 requires-python = ">=3.11"