feat(release): quantify zero-event benchmark safety bounds

ARCHITECTURE.md

@@ -78,6 +78,18 @@ Owns stable value contracts without I/O:
 - exact action, target-origin, and intent-bound `ApprovalScope` and `ApprovalEvidence`;
 - `ActionRequest` and `PolicyContext`.
 
+#### Active PR #240 — benchmark release acceptance migration
+
+PR #240 moves the pure, bounded benchmark release-evidence contract out of `originweave-core` into the dedicated `originweave-release` bounded context. This subsection is active-PR architecture, not protected-main truth, and [ADR 0015](docs/adr/0015-benchmark-release-acceptance.md) remains Proposed until policy-compliant integration. `originweave-core` retains only stable cross-context value contracts and does not depend on `originweave-release`; this pre-GA breaking migration intentionally provides no compatibility shim that duplicates release policy back into core.
+
+- `BenchmarkFailureClass` preserves first-causal-boundary failure taxonomy so deterministic/stochastic product failures become failed suite evidence while site drift, outages, unsupported capability, infrastructure failure, and benchmark defects remain `Inconclusive` rather than being promoted to success.
+- `DeclaredLimitation` makes narrowed buyer-facing claims explicit and resource-bounded; it cannot erase failed or missing mandatory evidence.
+- `ZeroEventSafetyEvidence` retains exact trial count and confidence instead of claiming that zero observed events imply zero risk.
+- `ZeroEventSafetyThreshold` evaluates fixed-point safety policy separately from retained observations, and the zero-event safety gate remains release-neutral when evidence is missing, statistically insufficient, or above threshold.
+- Caller-controlled suite, limitation, requirement, and observation collections are bounded before cloning, sorting, or map population where applicable.
+
+This value-contract layer does not execute benchmarks, authenticate artifacts, select supported browser/profile claims, inspect GitHub governance, or approve/publish releases. A satisfied safety gate or accepted report is evidence only and **does not grant release authority**; the higher-level integrated release boundary must still combine authenticated current-head evidence, provenance, required checks, review, policy, operational acceptance, and release authorization.
+
 ### `originweave-policy`
 
 Owns a pure decision function. It denies human-mode agent control, untrusted instruction promotion, missing capabilities, unauthorized origins, crawler mutation, cross-origin mutation, absent robots evidence, unsafe secret delivery, R5 actions, and mismatched action, target-origin, or intent approvals.
@@ -305,4 +317,4 @@ No deployment mode may depend on an in-process singleton. Session, policy, desti
 
 ## 15. Change control
 
-Changes to the compatibility-kernel boundary, risk taxonomy, secret model, origin model, canonical intent model, evidence semantics, destination taxonomy, DNS pinning semantics, direct socket authority, TLS reference identity, trust-root semantics, trusted-time semantics, ALPN policy, redirect policy, resource mitigation semantics, or protocol versioning require a new ADR. The current baseline decisions are recorded under `docs/adr/`.
+Changes to the compatibility-kernel boundary, risk taxonomy, secret model, origin model, canonical intent model, evidence semantics, destination taxonomy, DNS pinning semantics, direct socket authority, TLS reference identity, trust-root semantics, trusted-time semantics, ALPN policy, redirect policy, resource mitigation semantics, release-acceptance semantics, rollback/recovery requirements, or protocol versioning require a new or superseding ADR. The current baseline and Proposed decisions are recorded under `docs/adr/`.

CHANGELOG.md

@@ -10,7 +10,8 @@ All notable changes to OriginWeave are documented in this file. The format follo
 - Corrected the 2026-08-26 product-gap snapshot with current #229 presentation-identity evidence, stacked-only #205 integration evidence, current base/head pairs, the 126-PR queue count, explicit root-versus-child merge ordering, and the active GitHub counted-approval gate.
 - Refreshed the product and technical gap baseline onto the 2026-08-26 live inventory: 126 open pull requests (54 ready, 72 draft), protected-main promotion of #168/#194/#196/#216/#151, a verified maintenance-loop record (supersession closure of #153, conflict reconciliations on #37/#149/#152/#173/#175, issue #212 option-(b) authorization on #43, Strix vuln-0001 homoglyph remediation on #124), provider-rerun outcome evidence, an organization review-pipeline congestion record, and refreshed merge-order queue guidance. Documentation evidence contracts were aligned to the same snapshot so the baseline, its dated markers, and the pinned exact-head rows cannot silently diverge.
 
-- Added `originweave_core::release_acceptance`, a deterministic fail-closed benchmark release-decision contract that requires one authoritative result for every mandatory suite, bounds explicit buyer-visible limitations, rejects duplicate limitation claim identities, and rejects non-canonical surrounding whitespace rather than normalizing it into an alternate claim spelling.
+- Moved benchmark release-acceptance ownership out of `originweave-core` into the dedicated `originweave-release` bounded context. The pre-GA `originweave_core::release_acceptance` public path is removed without a compatibility shim; repository consumers must migrate to `originweave_release::*`, while core retains only stable cross-context value contracts.
+- Added the public benchmark-failure taxonomy, fixed-point zero-event threshold evaluator, bounded zero-event safety gate, and `decide_commercial_release_with_zero_event_safety` evidence combiner; missing, invalid, inconclusive, or statistically insufficient mandatory evidence remains non-passing and these APIs do not grant merge, tag, publication, or release authority.
 - Refreshed the product and technical gap baseline with the 2026-08-24 live inventory: 158 open pull requests (44 ready, 114 draft), refreshed exact base/head evidence for the #208–#222 release, enterprise-approval, BAP, and WARC/PROV chains, the governance issue additions #212 and #215, and a required-check provider-failure record for the fail-closed Strix re-dispatches on #208/#218/#220.
 - Added a dated product and technical gap baseline that separates protected-main implementation truth, active pull-request evidence, live review/check blockers, and the next buyer-visible Phase 1 acceptance work.
 - Refreshed the product and technical gap baseline with the current open-PR inventory and exact base/head evidence for the newest Chromium, BAP, extraction, WARC, and idempotency slices.

Cargo.toml

@@ -8,6 +8,7 @@ members = [
     "crates/originweave-destination",
     "crates/originweave-network",
     "crates/originweave-tls",
+    "crates/originweave-release",
 ]
 resolver = "3"
 

crates/originweave-core/src/root.rs

@@ -1,7 +1,8 @@
 //! Shared security and governance contracts for OriginWeave.
 //!
-//! The historical core contracts remain source-compatible while adapter-specific
-//! boundaries can live in focused modules without changing their authority model.
+//! The shared kernel owns stable cross-context security vocabulary. Independently reusable
+//! product responsibilities belong to their focused bounded contexts and must not depend back
+//! through this crate merely to preserve historical module paths.
 
 #![forbid(unsafe_code)]
 #![deny(missing_docs)]
@@ -13,5 +14,3 @@ pub use contracts::*;
 
 /// Stateless MCP routing validation that maps only explicit tools to typed actions.
 pub mod mcp;
-/// Deterministic fail-closed release benchmark acceptance aggregation.
-pub mod release_acceptance;

crates/originweave-release/Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "originweave-release"
+description = "OriginWeave commercial release-acceptance evidence contracts."
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+authors.workspace = true
+repository.workspace = true
+homepage.workspace = true
+publish = false
+
+[dependencies]
+unicode-normalization = "=0.1.25"
+
+[lints]
+workspace = true

crates/originweave-release/src/benchmark_failure.rs

@@ -0,0 +1,65 @@
+//! Typed classification for benchmark execution failures.
+//!
+//! The classification separates known product-threshold failures from evidence
+//! that is insufficient to make a product release claim. It never converts an
+//! infrastructure, external-outage, unsupported-capability, site-drift, or
+//! benchmark-harness failure into passing evidence.
+
+use crate::release_acceptance::BenchmarkSuiteOutcome;
+
+/// First-causal-boundary classification for one benchmark failure.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub enum BenchmarkFailureClass {
+    /// A deterministic product contract or required post-condition failed.
+    DeterministicContractFailure,
+    /// A stochastic product-quality threshold failed with valid benchmark evidence.
+    StochasticModelFailure,
+    /// The external benchmark site changed outside the reviewed benchmark contract.
+    ExternalSiteDrift,
+    /// A required third-party benchmark dependency or external service was unavailable.
+    ExternalOutage,
+    /// The declared product profile does not support a capability required by the case.
+    UnsupportedCapability,
+    /// Execution infrastructure failed before valid product evidence was established.
+    InfrastructureFailure,
+    /// The benchmark harness or oracle is defective or otherwise non-authoritative.
+    BenchmarkDefect,
+}
+
+impl BenchmarkFailureClass {
+    /// Return the stable snake-case identifier retained in benchmark evidence.
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::DeterministicContractFailure => "deterministic_contract_failure",
+            Self::StochasticModelFailure => "stochastic_model_failure",
+            Self::ExternalSiteDrift => "external_site_drift",
+            Self::ExternalOutage => "external_outage",
+            Self::UnsupportedCapability => "unsupported_capability",
+            Self::InfrastructureFailure => "infrastructure_failure",
+            Self::BenchmarkDefect => "benchmark_defect",
+        }
+    }
+
+    /// Map the failure class to the only release-suite outcome it can establish.
+    ///
+    /// Known product failures are authoritative failed-suite evidence. Site drift,
+    /// external outages, unsupported capabilities, infrastructure failures, and
+    /// benchmark defects remain inconclusive because they do not establish that
+    /// the product passed the governed threshold. Unsupported capability must be
+    /// handled separately by the supported-profile or release-limitation boundary;
+    /// this classification never turns it into passing benchmark evidence.
+    #[must_use]
+    pub const fn suite_outcome(self) -> BenchmarkSuiteOutcome {
+        match self {
+            Self::DeterministicContractFailure | Self::StochasticModelFailure => {
+                BenchmarkSuiteOutcome::Failed
+            }
+            Self::ExternalSiteDrift
+            | Self::ExternalOutage
+            | Self::UnsupportedCapability
+            | Self::InfrastructureFailure
+            | Self::BenchmarkDefect => BenchmarkSuiteOutcome::Inconclusive,
+        }
+    }
+}

crates/originweave-release/src/lib.rs

@@ -0,0 +1,17 @@
+//! Deterministic, fail-closed commercial release-acceptance evidence contracts.
+//!
+//! This bounded context owns benchmark failure causality, bounded release evidence,
+//! and zero-event statistical safety gates. It performs no benchmark I/O and grants
+//! no merge, tag, publication, or operator release authority.
+
+#![forbid(unsafe_code)]
+#![deny(missing_docs)]
+
+/// Typed fail-closed benchmark failure classification.
+pub mod benchmark_failure;
+/// Deterministic fail-closed release benchmark acceptance aggregation.
+pub mod release_acceptance;
+/// Fail-closed evaluation of declared zero-event benchmark safety requirements.
+pub mod zero_event_safety_gate;
+/// Fixed-point statistical thresholds for zero-event benchmark safety evidence.
+pub mod zero_event_threshold;