feat(core): enforce controlled benchmark acceptance thresholds

ARCHITECTURE.md

@@ -77,6 +77,10 @@ Owns stable value contracts without I/O:
 - `RiskClass`, `Capability`, and `ActionKind`;
 - exact action, target-origin, and intent-bound `ApprovalScope` and `ApprovalEvidence`;
 - `ActionRequest` and `PolicyContext`.
+- versioned controlled-deterministic benchmark case identities and bounded raw-evidence
+  threshold evaluation, including support-profile-specific required cases. This
+  foundation reports controlled-suite evidence only; it does not execute benchmarks,
+  authenticate artifacts, or replace the product-wide release gate.
 
 ### `originweave-policy`
 

CHANGELOG.md

@@ -11,6 +11,7 @@ All notable changes to OriginWeave are documented in this file. The format follo
 - Refreshed the product and technical gap baseline onto the 2026-08-26 live inventory: 126 open pull requests (54 ready, 72 draft), protected-main promotion of #168/#194/#196/#216/#151, a verified maintenance-loop record (supersession closure of #153, conflict reconciliations on #37/#149/#152/#173/#175, issue #212 option-(b) authorization on #43, Strix vuln-0001 homoglyph remediation on #124), provider-rerun outcome evidence, an organization review-pipeline congestion record, and refreshed merge-order queue guidance. Documentation evidence contracts were aligned to the same snapshot so the baseline, its dated markers, and the pinned exact-head rows cannot silently diverge.
 
 - Added `originweave_core::release_acceptance`, a deterministic fail-closed benchmark release-decision contract that requires one authoritative result for every mandatory suite, bounds explicit buyer-visible limitations, rejects duplicate limitation claim identities, and rejects non-canonical surrounding whitespace rather than normalizing it into an alternate claim spelling.
+- Added active PR #237's versioned controlled-deterministic benchmark registry and raw-evidence threshold evaluator: exactly 100 clean trials are required per case, missing or inconclusive required cases cannot pass the suite, conditional cases follow the declared support profile, registry versions are exact, and impossible aggregate counters fail closed.
 - Refreshed the product and technical gap baseline with the 2026-08-24 live inventory: 158 open pull requests (44 ready, 114 draft), refreshed exact base/head evidence for the #208–#222 release, enterprise-approval, BAP, and WARC/PROV chains, the governance issue additions #212 and #215, and a required-check provider-failure record for the fail-closed Strix re-dispatches on #208/#218/#220.
 - Added a dated product and technical gap baseline that separates protected-main implementation truth, active pull-request evidence, live review/check blockers, and the next buyer-visible Phase 1 acceptance work.
 - Refreshed the product and technical gap baseline with the current open-PR inventory and exact base/head evidence for the newest Chromium, BAP, extraction, WARC, and idempotency slices.
@@ -102,4 +103,4 @@ All notable changes to OriginWeave are documented in this file. The format follo
 - The hourly product agent has no Git metadata or repository authority. A separate post-verification publisher opens one PR and cannot approve or merge it.
 - The unprivileged OpenCode user is restricted to loopback egress during model execution, preventing runner-wide allow-listed endpoints from becoming direct source-exfiltration channels.
 
-[Unreleased]: https://github.com/ContextualWisdomLab/OriginWeave/compare/main...HEAD
+[Unreleased]: https://github.com/ContextualWisdomLab/OriginWeave/compare/main...HEAD

crates/originweave-core/src/root.rs

@@ -11,6 +11,8 @@ mod contracts;
 
 pub use contracts::*;
 
+/// Deterministic case-level acceptance for the controlled benchmark suite.
+pub mod controlled_benchmark;
 /// Stateless MCP routing validation that maps only explicit tools to typed actions.
 pub mod mcp;
 /// Deterministic fail-closed release benchmark acceptance aggregation.