Unify CI, benchmark site publication and dated database releases

Author: KSemenenko

.github/workflows/AGENTS.md

@@ -3,7 +3,7 @@
 ## Purpose and entry points
 - Owns repository CI qualification and GitHub Pages publication workflows.
 - Canonical workflows: `ci.yml` (restore, Release build, TUnit unit/integration/recovery suites and comparison artifact production) and `pages.yml` (verified artifact download, site checks/build and Pages deployment).
-- Owner clarification 2026-10-03 supersedes the historical placement above: `ci.yml` (`CI`) always includes repository rules and PR checks; `tests.yml` (`Tests`) owns project qualification; `benchmarks.yml` (`Benchmarks`) owns all performance comparisons and TimeSeries image checks; `release.yml` (`Release`) builds NuGet package artifacts; `pages.yml` (`Website`) publishes the qualified site. Do not create standalone governance or per-feature comparison workflows. Preserve exact historical KeyLoad CI main-push identity separately from its current CI metadata name under ADR-062.
+- Latest owner correction 2026-10-03 supersedes the historical placements above and ADR-062's five-workflow scope: exactly `ci.yml` (`CI`) combines build/rules/unit/scalar/recovery/RF3 for PR/push/manual checks; `benchmarks.yml` (`Benchmarks`) owns all load/comparison/TimeSeries checks followed by aggregate-gated website qualification and publication; `release.yml` (`Release`) builds all packages and actual database images/distribution and creates the release/tag `v<major>.<minor>.<yyMMdd>.<daily-build>`. Remove standalone Tests/Website/governance/per-feature benchmark workflows. Preserve authentic historical KeyLoad CI report bytes and run identity independently of the current CI name; newer CI build/test runs are not historical measurement producers.
 
 ## Ownership and boundaries
 - Workflow changes belong to the feature or infrastructure contract they implement and must preserve the repository's single-repository, canonical-slice architecture. Workflow YAML is delivery infrastructure, not a place to hide missing product behavior.
@@ -43,3 +43,7 @@
 - ADR056 adds authenticated successful comparison-aggregate selection and the complete270-cell/native-image proof, independently of the retained legacy comparison evidence. Qualify both original archives and all277 isolated inputs through BCL before-session preparation and preserve their byte hashes after tests and around the final builder.
 - Capture actual Pages executor context; never impersonate the CI-only job environment. Historical pins are validation-only. Hash and compare the complete closed executed49-file dependency closure between trusted control and website source; separately inspect the isolated measured source.
 - Retain full site/TUnit/browser/native coverage/no-skip gates. Qualification timeout180min and deployment freshness90min accommodate the bounded same-route provider rate protocol. Both native evidence freshness checks and current website SHA must pass immediately before needs-gated least-privilege Pages deployment.
+
+## Owner-directed integrated publication and release, 2026-10-03
+- The latest three-pipeline instruction explicitly supersedes the separate pages.yml placement above. Move its complete qualification/deploy stages behind the successful Benchmarks aggregate, bind current producer run/attempt/SHA directly from GitHub's executor context, and recheck that tuple before deployment. Historical validation pins cannot impersonate this current producer.
+- Release uses UTC daily version reservation, immutable source-bound tags, actual database image/package/distribution hashes and an idempotent GitHub Release. Limit contents/packages write permissions to the publication job; reservation/build/test jobs remain read-only. Do not publish a failed build, overwrite an existing tag/image/release asset, bypass required checks or claim runtime qualification from packaging.

.github/workflows/Features/BenchmarkComparisons/BuildIsolatedSite/AGENTS.md

@@ -19,3 +19,6 @@
 - No applicable workflow skill is installed; installing skills or tools is prohibited.
 - Preserve least privilege and the actual inherited GitHub context. Never log secrets, forge a CI environment, add a provider fallback, weaken gates or rewrite measured inputs.
 - Require the isolated receipt to be a regular non-link file of at most4MiB before parsing; preserve original receipt bytes and hashes across the builder. Do not use generic archive extraction or replace original authority with a rewritten receipt.
+
+## Owner-directed three-pipeline join, 2026-10-03
+- The latest explicit owner layout moves this full qualification into Benchmarks/benchmarks.yml behind its own successful aggregate and TimeSeries image jobs, superseding pages.yml placement above. Retain the exact qualify job name, actual inherited executor, every archive/hash/TUnit/browser/coverage check, and downstream least-privilege deployment. Only the exact current benchmark run/attempt/source may refresh native metrics; historical archive validation remains separately authentic.

.github/workflows/Features/BenchmarkComparisons/DeploySite/AGENTS.md

@@ -0,0 +1,15 @@
+# DeploySite
+
+## Purpose and entry points
+- Owns the BenchmarkComparisons DeploySite composite action under ADR-064/AC-PIPE-002..003. Read root/workflow policy, ReleaseDelivery and BenchmarkComparisons specs before edits. Entry: action.yml.
+
+## Boundaries and protected risks
+- Preserve every original archive/hash/native/browser/TUnit/coverage/freshness gate. Use actual inherited Benchmarks qualify/deploy context and the exact current run/attempt/source; no historical publication fallback or forged executor.
+- Lead alone owns workflows, permissions, source closure, docs and delivery. Three persistent RF3 owners and all isolated measurement jobs remain unchanged.
+- The qualification compares both new actions' source/policy with trusted control and the current website checkout. Deployment writes remain confined to the needs-gated deploy job.
+
+## Commands and verification
+- Execute only in Linux GitHub Actions under the exact qualify/deploy job name. Static YAML/shell/source checks are not runtime or provider qualification. No local tests or providers.
+
+## Applicable skills
+- No installed skill is required for this bounded workflow composition; install none.

.github/workflows/Features/BenchmarkComparisons/DeploySite/action.yml

@@ -0,0 +1,52 @@
+name: Publish the current benchmark website
+description: Recheck exact source and current producer tuple before least-privilege Pages delivery.
+outputs:
+  page_url:
+    value: ${{ steps.deployment.outputs.page_url }}
+runs:
+  using: composite
+  steps:
+    - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+      with:
+        name: site-qualification-${{ env.QUALIFIED_REVISION }}-${{ github.run_attempt }}
+        path: qualification
+    - name: Recheck current website and immutable comparison evidence
+      shell: bash
+      run: |
+        revision=$(timeout 120s gh api "repos/$GH_REPO/git/ref/heads/main" --jq .object.sha)
+        [[ "$revision" == "$QUALIFIED_REVISION" ]]
+        capture="$GITHUB_WORKSPACE/predeploy-capture"
+        bash control/scripts/Features/BenchmarkComparisons/collect-github-evidence.sh --input="$capture" --mode=publish --site-revision="$revision" --workflow-revision="$CONTROL_REVISION"
+        node control/scripts/Features/BenchmarkComparisons/github-evidence.mjs fresh --before="$GITHUB_WORKSPACE/qualification/artifacts/site-evidence/archive-receipt.json" --after="$capture/metadata-proof.json" > predeploy-proof.json
+        isolated_capture="$GITHUB_WORKSPACE/predeploy-isolated-capture"
+        node control/scripts/Features/BenchmarkComparisons/site-isolated-github-cli.mjs capture-metadata --input="$isolated_capture" --mode=publish --site-revision="$revision" --workflow-revision="$CONTROL_REVISION" > predeploy-isolated-capture-envelope.json
+        jq -e '.ok == true' predeploy-isolated-capture-envelope.json > /dev/null
+        node control/scripts/Features/BenchmarkComparisons/site-isolated-github-cli.mjs fresh --before="$GITHUB_WORKSPACE/qualification/artifacts/site-evidence/isolated-capture/archive-receipt.json" --after="$isolated_capture/metadata-proof.json" > predeploy-isolated-proof.json
+        jq -e '.ok == true' predeploy-isolated-proof.json > /dev/null
+        date --utc --iso-8601=seconds > predeploy-checked-at.txt
+    - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
+    - name: Publish qualified website
+      id: deployment
+      uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
+    - name: Record actual Pages deployment result
+      if: always()
+      env:
+        DEPLOYMENT_OUTCOME: ${{ steps.deployment.outcome }}
+        DEPLOYMENT_URL: ${{ steps.deployment.outputs.page_url }}
+        SITE_REVISION: ${{ env.QUALIFIED_REVISION }}
+      shell: bash
+      run: |
+        jq -n --arg outcome "$DEPLOYMENT_OUTCOME" --arg url "$DEPLOYMENT_URL" --arg revision "$SITE_REVISION" --arg run_url "https://github.com/$GH_REPO/actions/runs/$GITHUB_RUN_ID" --argjson attempt "$GITHUB_RUN_ATTEMPT" '{schemaVersion:1,siteSourceRevision:$revision,qualification:{runUrl:$run_url,attempt:$attempt},provider:{outcome:$outcome,pageUrl:$url}}' > deployment-receipt.json
+    - name: Retain freshness and deployment receipt
+      if: always()
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      with:
+        name: site-publication-${{ github.run_id }}-${{ github.run_attempt }}
+        path: |
+          predeploy-capture
+          predeploy-proof.json
+          predeploy-isolated-capture
+          predeploy-isolated-capture-envelope.json
+          predeploy-isolated-proof.json
+          predeploy-checked-at.txt
+          deployment-receipt.json

.github/workflows/Features/BenchmarkComparisons/QualifySite/AGENTS.md

@@ -0,0 +1,15 @@
+# QualifySite
+
+## Purpose and entry points
+- Owns the BenchmarkComparisons QualifySite composite action under ADR-064/AC-PIPE-002..003. Read root/workflow policy, ReleaseDelivery and BenchmarkComparisons specs before edits. Entry: action.yml.
+
+## Boundaries and protected risks
+- Preserve every original archive/hash/native/browser/TUnit/coverage/freshness gate. Use actual inherited Benchmarks qualify/deploy context and the exact current run/attempt/source; no historical publication fallback or forged executor.
+- Lead alone owns workflows, permissions, source closure, docs and delivery. Three persistent RF3 owners and all isolated measurement jobs remain unchanged.
+- The qualification compares both new actions' source/policy with trusted control and the current website checkout. Deployment writes remain confined to the needs-gated deploy job.
+
+## Commands and verification
+- Execute only in Linux GitHub Actions under the exact qualify/deploy job name. Static YAML/shell/source checks are not runtime or provider qualification. No local tests or providers.
+
+## Applicable skills
+- No installed skill is required for this bounded workflow composition; install none.