ragops 2.2.0__tar.gz → 2.3.0__tar.gz

{ragops-2.2.0 → ragops-2.3.0}/.github/ISSUE_TEMPLATE/bug.yml

@@ -10,7 +10,7 @@ body:
     id: version
     attributes:
       label: RAGOps version or commit
-      placeholder: v2.1.0 or commit SHA
+      placeholder: v2.3.0 or commit SHA
     validations:
       required: true
   - type: textarea

{ragops-2.2.0 → ragops-2.3.0}/.github/workflows/ragops-gate.yml

@@ -12,7 +12,7 @@ on:
         description: RAGOps Git revision or tag to install
         required: false
         type: string
-        default: "v2.1.0"
+        default: "v2.3.0"
       scenario:
         description: Caller-relative scenario JSON path
         required: true

{ragops-2.2.0 → ragops-2.3.0}/CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes follow Keep a Changelog. This project uses Semantic Versioni
 
 ## [Unreleased]
 
+## [2.3.0] - 2026-07-13
+
+### Added
+
+- `ragops --version` for installed-package and support diagnostics.
+- Clean-wheel installation smoke testing in the local release verification lane.
+
+### Changed
+
+- Local artifact checksum verification is dependency-free and portable across
+  supported operating systems.
+- Public documentation, roadmap, release evidence, and integration examples now
+  identify the current stable release consistently.
+
 ## [2.2.0] - 2026-07-13
 
 ### Added

{ragops-2.2.0 → ragops-2.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ragops
-Version: 2.2.0
+Version: 2.3.0
 Summary: Evaluation and red-team release gates for RAG and agent systems
 Project-URL: Homepage, https://github.com/thangldw/ragops
 Project-URL: Documentation, https://github.com/thangldw/ragops#readme
@@ -94,7 +94,7 @@ ragops demo --output ragops-demo
 For the latest published stable CLI without cloning the repository:
 
 ```bash
-pip install ragops==2.1.0
+pip install ragops==2.3.0
 ragops demo --output ragops-demo
 ```
 
@@ -136,7 +136,7 @@ validate the harness and architecture comparison; they do not establish
 Japanese semantic quality, customer adoption, or production ROI.
 
 The repository currently validates its core, adapters, reference deployment,
-showcase, and demo paths with 138 automated tests.
+showcase, and demo paths with 140+ automated tests.
 
 <p align="center">
   <img src="docs/demo/infographics/evidence-stack.svg" alt="RAGOps evidence stack combining quality, safety, operational budgets, and regression comparison into a release decision" width="100%">

{ragops-2.2.0 → ragops-2.3.0}/README.md

@@ -63,7 +63,7 @@ ragops demo --output ragops-demo
 For the latest published stable CLI without cloning the repository:
 
 ```bash
-pip install ragops==2.1.0
+pip install ragops==2.3.0
 ragops demo --output ragops-demo
 ```
 
@@ -105,7 +105,7 @@ validate the harness and architecture comparison; they do not establish
 Japanese semantic quality, customer adoption, or production ROI.
 
 The repository currently validates its core, adapters, reference deployment,
-showcase, and demo paths with 138 automated tests.
+showcase, and demo paths with 140+ automated tests.
 
 <p align="center">
   <img src="docs/demo/infographics/evidence-stack.svg" alt="RAGOps evidence stack combining quality, safety, operational budgets, and regression comparison into a release decision" width="100%">

ragops-2.3.0/docs/architecture/adr/0020-local-release-integrity.md

@@ -0,0 +1,17 @@
+# ADR 0020: Verify local release integrity before publication
+
+Status: Accepted for owner review
+
+## Decision
+
+The quota-independent release lane must install its newly built wheel in a fresh
+virtual environment before publication. SHA-256 verification is implemented in
+dependency-free Python rather than delegating to platform-specific `shasum` or
+`sha256sum` commands. The installed CLI exposes its package version.
+
+## Consequences
+
+Local releases catch missing-package and metadata errors before tags are pushed,
+and PyPI promotion works consistently on macOS, Linux, and Windows. Verification
+takes slightly longer because it creates an isolated environment. This does not
+replace the supported-Python matrix when GitHub Actions capacity returns.

{ragops-2.2.0 → ragops-2.3.0}/docs/demo/cv-linkedin-copy.md

@@ -15,7 +15,7 @@ not customer production adoption.
   candidate with 25-point citation coverage/precision regressions. The fixture
   validates harness behavior, not Japanese semantic quality.
 - Published architecture decisions, threat model, rollout plan, executive
-  go/no-go recommendation, reproducible reports, and 138 automated tests.
+  go/no-go recommendation, reproducible reports, and 140+ automated tests.
 
 ## LinkedIn project description
 

ragops-2.3.0/docs/design-audit/v2.3/audit.md

@@ -0,0 +1,20 @@
+# v2.3 workbench product-flow audit
+
+## Flow
+
+1. **Evaluation input — healthy.** API key is explicitly tab-local; scenario and
+   response fixtures are prefilled and labeled.
+2. **Release decision — healthy empty state.** Before evaluation the UI says
+   “Waiting for a run” and “Not evaluated”; it does not display stale PASS data.
+3. **Experiment history — healthy with setup guidance.** The run limit is labeled
+   and the page explains the `RAGOPS_STORE` requirement.
+
+## Highest-impact follow-up
+
+No release-blocking redesign is justified. A future usability study should test
+whether adopters prefer file upload over large JSON textareas; screenshots alone
+cannot establish this. Keyboard behavior, screen-reader announcements, focus
+movement after evaluation, and color contrast require dedicated accessibility
+testing and are not claimed here.
+
+![Workbench desktop](01-workbench-desktop.png)

{ragops-2.2.0 → ragops-2.3.0}/docs/engineering/github-pr-gate.md

@@ -22,7 +22,7 @@ jobs:
   release-gate:
     uses: thangldw/ragops/.github/workflows/ragops-gate.yml@main
     with:
-      ragops-version: v2.1.0
+      ragops-version: v2.3.0
       scenario: evals/scenario.json
       baseline: evals/baseline.json
       candidate: evals/candidate.json

{ragops-2.2.0 → ragops-2.3.0}/docs/engineering/gitlab-ci-gate.md

@@ -19,7 +19,7 @@ Set these repository-relative variables:
 
 ```yaml
 variables:
-  RAGOPS_VERSION: "2.1.0"
+  RAGOPS_VERSION: "2.3.0"
   RAGOPS_SCENARIO: "evaluation/scenario.json"
   RAGOPS_BASELINE: "evaluation/baseline.json"
   RAGOPS_CANDIDATE: "evaluation/candidate.json"

{ragops-2.2.0 → ragops-2.3.0}/docs/engineering/pypi-publishing.md

@@ -9,10 +9,10 @@ PyPI API token and publishes only an existing tag whose `vX.Y.Z` value matches
 
 - Project: [ragops on PyPI](https://pypi.org/project/ragops/)
 - First Trusted Publishing release: `1.6.0`
-- Current verified release: `2.1.0`
+- Current verified release: `2.2.0`
 - GitHub environment: `pypi`
 - Publisher: `thangldw/ragops`, workflow `publish-pypi.yml`
-- Verification: 2.1.0 wheel and sdist present; clean install and
+- Verification: 2.2.0 wheel and sdist present; clean install and
   credential-free proposal-review demo pass
 
 ## One-time owner setup
@@ -32,7 +32,7 @@ GitHub's current OIDC guidance is linked from the
 ## Publish an accepted tag
 
 1. Open **Actions → Publish package to PyPI → Run workflow**.
-2. Enter an existing tag such as `v2.1.0`.
+2. Enter an existing tag such as `v2.2.0`.
 3. Approve the `pypi` environment when protection rules require it.
 4. After success, install in a clean environment and compare the installed
    version and wheel hash with the GitHub Release asset.

{ragops-2.2.0 → ragops-2.3.0}/docs/examples/gitlab-ci-ragops.yml

@@ -2,7 +2,7 @@ ragops_release_gate:
   stage: test
   image: python:3.12-slim
   variables:
-    RAGOPS_VERSION: "2.1.0"
+    RAGOPS_VERSION: "2.3.0"
     RAGOPS_SCENARIO: "scenarios/japanese_troubleshooting/benchmark-v0.2.json"
     RAGOPS_BASELINE: "scenarios/japanese_troubleshooting/benchmark-baseline.json"
     RAGOPS_CANDIDATE: "scenarios/japanese_troubleshooting/benchmark-regressed.json"

ragops-2.3.0/docs/product/requirements-v2.3.md

@@ -0,0 +1,24 @@
+# Requirements v2.3 — release integrity and discoverability
+
+## User story
+
+As a maintainer or adopter, I can identify the installed RAGOps version and
+verify that a locally built wheel installs cleanly before publication, even when
+GitHub Actions is unavailable.
+
+## Acceptance criteria
+
+- `ragops --version` prints the package version and exits zero.
+- Local release verification installs the built wheel into a fresh virtualenv.
+- Artifact checksums are verified in dependency-free Python on every supported
+  operating system and reject missing, traversing, or tampered targets.
+- Current-state documentation and integration examples reference one stable
+  release; historical release records remain unchanged.
+- Ruff, full tests, deterministic PASS/BLOCK fixtures, package build, clean
+  install, GitHub Release, and exact PyPI promotion pass locally.
+
+## Compatibility and non-goals
+
+The CLI flag and release checks are additive. No schema, metric, gate meaning,
+API contract, or open-core boundary changes. Hosted infrastructure, real-user
+adoption evidence, and security testing are outside this release.

{ragops-2.2.0 → ragops-2.3.0}/docs/product/roadmap.md

@@ -59,7 +59,7 @@ PR comment integration and notifications remain hosted/integration work.
 - GitHub discovery metadata, Discussions, and real starter issues.
 - GitLab CI release-gate recipe and reviewed least-privilege PR-comment design.
 
-## 1.8 — review visibility and measured adoption (complete on main, unreleased)
+## 1.8 — review visibility and measured adoption (released)
 
 - Isolated, write-enabled PR comment publisher with bounded artifact parsing,
   exact metadata verification, pinned actions, and idempotent updates.
@@ -84,6 +84,17 @@ PR comment integration and notifications remain hosted/integration work.
   dependencies in the core.
 - Copyable downstream PR-comment publisher recipe with explicit trust boundary.
 
+## 2.2 — quota-independent release fallback (released)
+
+- Local quality gates, build-once packages, SBOM, checksums, and evidence.
+- Direct GitHub CLI publication and fail-closed project-token PyPI promotion.
+
+## 2.3 — release integrity and discoverability
+
+- Installed CLI version diagnostics.
+- Clean-wheel smoke testing before tagging.
+- Dependency-free cross-platform checksum verification.
+
 ## 3.0 — hosted control plane (local alpha boundary implemented)
 
 - Workspace isolation, SSO/RBAC, audit retention, managed ingestion, and

{ragops-2.2.0 → ragops-2.3.0}/docs/product/success-metrics.md

@@ -24,6 +24,13 @@ backed by a versioned scenario and persisted report.
 - Core test and lint pass rate remains 100% on supported Python versions.
 - Median local deterministic run remains below one second for 1,000 cases.
 
+## Release integrity
+
+- Published GitHub and PyPI wheel/source hashes match exactly: target 100%.
+- Every stable release passes clean-wheel installation before tagging: target 100%.
+- Every local release records version, commit, checksums, SBOM, and validation result.
+- Release evidence must distinguish OIDC provenance from local-token publication.
+
 ## Commercial signals
 
 - Teams requesting shared datasets, SSO/RBAC, audit retention, or hosted runs.
@@ -32,4 +39,3 @@ backed by a versioned scenario and persisted report.
 
 These are proposed targets. Public claims must use measured repository or
 product telemetry, never illustrative values presented as real adoption.
-

{ragops-2.2.0 → ragops-2.3.0}/docs/project/program-completion-audit.md

@@ -24,6 +24,8 @@ public presentation assets.
 | v1.8 review visibility and measured adoption | Released | `docs/project/v1.8-acceptance.md` |
 | v2.0 trustworthy extensible release gates | Released | `docs/project/v2.0-acceptance.md` |
 | v2.1 portable external evaluator evidence | Released | `docs/project/v2.1-acceptance.md` |
+| v2.2 quota-independent release | Released | `docs/project/v2.2-acceptance.md` |
+| v2.3 release integrity | Ready | `docs/project/v2.3-acceptance.md` |
 
 ## FDE competency coverage
 
@@ -42,7 +44,8 @@ public presentation assets.
 ## Verification baseline
 
 - Python 3.11+ dependency-free core.
-- 126 automated tests on Python 3.11, 3.12, and 3.13 at the latest acceptance run.
+- 140+ automated tests; the last CI matrix covered Python 3.11, 3.12, and 3.13,
+  while v2.2+ release gates run locally during the Actions quota pause.
 - GitHub/PyPI distributions are byte-identical; GitHub Release includes a
   reproducible CycloneDX SBOM, SHA-256 manifest, and provenance attestation.
 - Ruff and diff checks pass.
@@ -63,6 +66,6 @@ therefore launch activities rather than missing repository implementation:
 
 ## Final recommendation
 
-Use release 2.1.0 for FDE interviews, OSS feedback, and customer discovery.
+Use the latest stable release for FDE interviews, OSS feedback, and customer discovery.
 Proceed to a real offline design-partner pilot; do not market the control-plane
 alpha as production SaaS or claim measured ROI until external evidence exists.

{ragops-2.2.0 → ragops-2.3.0}/docs/project/v2.2-acceptance.md

@@ -2,8 +2,9 @@
 
 ## Decision
 
-**READY FOR LOCAL RELEASE.** Owner authorization was given to implement and
-release without GitHub Actions while the monthly quota is exhausted.
+**RELEASED as 2.2.0 without GitHub Actions.** Owner authorization was given to
+implement and release while the monthly quota was exhausted. GitHub and PyPI
+publication are public and independently verified.
 
 ## Contract impact
 
@@ -17,10 +18,10 @@ gate meaning, existing CLI/API contracts, or the open-core boundary.
 | Requirement and ADR | Pass | Requirements v2.2 and ADR 0019 |
 | Fail-closed publication | Pass | Explicit `--yes`; PyPI also requires `PYPI_API_TOKEN` |
 | Exact artifact promotion | Pass | PyPI phase downloads and verifies GitHub Release checksums; no rebuild |
-| Core quality | Pass | Ruff clean; 133 passed, 1 skipped locally |
+| Core quality | Pass | Release virtualenv: Ruff clean; 141 tests passed locally |
 | GitHub Actions quota | Pass | Triggering workflows disabled manually before repository publication |
-| GitHub Release | Pending | Run local verify on the release commit, then publish with `gh` |
-| PyPI | Pending | Requires a project-scoped API token; GitHub OIDC is unavailable locally |
+| GitHub Release | Pass | Public v2.2.0 contains wheel, source, SBOM, checksums, and local evidence |
+| PyPI | Pass | Public 2.2.0 wheel/source hashes match GitHub byte-for-byte; clean install reports 2.2.0 |
 
 ## Limitations
 

ragops-2.3.0/docs/project/v2.3-acceptance.md

@@ -0,0 +1,30 @@
+# v2.3 release integrity acceptance
+
+## Decision
+
+**READY FOR LOCAL RELEASE.** Owner authorized staged implementation and stable
+publication without GitHub Actions while quota is exhausted.
+
+## Contract impact
+
+Additive CLI discoverability and release verification only. Public schemas,
+metrics, gate semantics, API behavior, and open-core boundaries are unchanged.
+
+## Acceptance evidence
+
+| Gate | Result | Evidence |
+| --- | --- | --- |
+| Requirement and ADR | Pass | Requirements v2.3 and ADR 0020 |
+| CLI version | Pending | Installed CLI must print `ragops 2.3.0` |
+| Cross-platform checksums | Pending | Unit and tamper tests plus release-download verification |
+| Clean wheel | Pending | Fresh virtualenv install in local release lane |
+| Product flow | Pass | Current workbench input/decision/history flow captured in `docs/design-audit/v2.3/` |
+| KPI evidence | Pass | Release integrity KPIs added without inventing adoption data |
+| Core quality | Pending | Ruff and full offline suite |
+| Public artifacts | Pending | GitHub and PyPI hashes must match |
+
+## Limitations
+
+- Supported-Python matrix CI is paused until Actions capacity returns.
+- Hosted infrastructure and design-partner outcomes remain external work.
+- Security testing is deferred by owner instruction.

ragops-2.3.0/docs/releases/v2.3.0.md

@@ -0,0 +1,22 @@
+# RAGOps v2.3.0 — release integrity and discoverability
+
+RAGOps v2.3.0 makes quota-independent releases easier to verify and diagnose.
+
+## Highlights
+
+- Inspect the installed package with `ragops --version`.
+- Install the newly built wheel in a clean virtualenv before any tag or release.
+- Verify GitHub Release checksums with dependency-free, cross-platform Python.
+- Keep current documentation and downstream integration examples aligned with
+  the stable public version.
+
+## Compatibility
+
+This additive minor release changes no schema, metric, release threshold,
+existing command, API contract, or open-core boundary.
+
+## Known limits
+
+The local lane does not carry GitHub OIDC build provenance. Hosted 3.0 and real
+design-partner evidence still require external infrastructure and users.
+Security testing remains deferred by owner instruction.

{ragops-2.2.0 → ragops-2.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ragops"
-version = "2.2.0"
+version = "2.3.0"
 description = "Evaluation and red-team release gates for RAG and agent systems"
 readme = "README.md"
 requires-python = ">=3.11"

{ragops-2.2.0 → ragops-2.3.0}/scripts/local_release.py

@@ -14,6 +14,7 @@ import os
 import shutil
 import subprocess
 import sys
+import tempfile
 import tomllib
 from datetime import UTC, datetime
 from pathlib import Path
@@ -59,6 +60,39 @@ def checksums(paths: list[Path]) -> Path:
     return manifest
 
 
+def verify_checksums(directory: Path) -> None:
+    manifest = directory / "SHA256SUMS"
+    if not manifest.is_file():
+        raise SystemExit("release is missing SHA256SUMS")
+    lines = manifest.read_text(encoding="utf-8").splitlines()
+    if not lines:
+        raise SystemExit("SHA256SUMS is empty")
+    for line in lines:
+        try:
+            digest, filename = line.split("  ", 1)
+        except ValueError as exc:
+            raise SystemExit("invalid SHA256SUMS line") from exc
+        path = directory / filename
+        if Path(filename).name != filename or not path.is_file():
+            raise SystemExit(f"invalid checksum target: {filename}")
+        actual = hashlib.sha256(path.read_bytes()).hexdigest()
+        if len(digest) != 64 or actual != digest:
+            raise SystemExit(f"checksum mismatch: {filename}")
+
+
+def verify_clean_install(wheel: Path, expected_version: str) -> None:
+    with tempfile.TemporaryDirectory(prefix="ragops-release-") as temp:
+        venv = Path(temp) / "venv"
+        run(sys.executable, "-m", "venv", str(venv))
+        python = venv / ("Scripts/python.exe" if os.name == "nt" else "bin/python")
+        run(str(python), "-m", "pip", "install", "--no-deps", str(wheel))
+        run(
+            str(python),
+            "-c",
+            f"import ragops; assert ragops.__version__ == {expected_version!r}",
+        )
+
+
 def verify(tag: str) -> None:
     assert_tag(tag)
     run("ruff", "check", ".")
@@ -77,6 +111,8 @@ def verify(tag: str) -> None:
     shutil.rmtree(DIST, ignore_errors=True)
     run(sys.executable, "-m", "build")
     built = artifacts()
+    wheel = next(path for path in built if path.suffix == ".whl")
+    verify_clean_install(wheel, version())
     sbom = DIST / f"ragops-{version()}.cdx.json"
     if shutil.which("cyclonedx-py"):
         run("cyclonedx-py", "environment", sys.executable, "--output-reproducible",
@@ -123,7 +159,7 @@ def pypi(tag: str, yes: bool) -> None:
     shutil.rmtree(release_dir, ignore_errors=True)
     release_dir.mkdir(parents=True)
     run("gh", "release", "download", tag, "--dir", str(release_dir))
-    run("shasum", "-a", "256", "-c", "SHA256SUMS", cwd=release_dir)
+    verify_checksums(release_dir)
     distributions = sorted(release_dir.glob("ragops-*.whl")) + sorted(release_dir.glob("ragops-*.tar.gz"))
     if len(distributions) != 2:
         raise SystemExit("GitHub Release must contain exactly one wheel and one source distribution")

{ragops-2.2.0 → ragops-2.3.0}/src/ragops/__init__.py

@@ -3,7 +3,7 @@
 from ragops.engine import compare, evaluate
 from ragops.loader import load_responses, load_scenario, responses_from_data, scenario_from_dict
 
-__version__ = "2.2.0"
+__version__ = "2.3.0"
 
 __all__ = [
     "compare",

{ragops-2.2.0 → ragops-2.3.0}/src/ragops/cli.py

@@ -4,6 +4,7 @@ import argparse
 import json
 from pathlib import Path
 
+from ragops import __version__
 from ragops.adapters.external_metrics import (
     load_external_metric_evaluator,
     validate_external_metric_pair,
@@ -36,6 +37,7 @@ from ragops.traces import load_trace_jsonl
 
 def build_parser() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(prog="ragops")
+    parser.add_argument("--version", action="version", version=f"%(prog)s {__version__}")
     commands = parser.add_subparsers(dest="command", required=True)
     demo_parser = commands.add_parser("demo", help="Generate a credential-free release-gate demo")
     demo_parser.add_argument("--output", default="ragops-demo")

{ragops-2.2.0 → ragops-2.3.0}/tests/test_adoption_recipes.py

@@ -5,7 +5,7 @@ from pathlib import Path
 def test_gitlab_recipe_preserves_evidence_and_exit_code() -> None:
     recipe = Path("docs/examples/gitlab-ci-ragops.yml").read_text(encoding="utf-8")
 
-    assert 'RAGOPS_VERSION: "2.1.0"' in recipe
+    assert 'RAGOPS_VERSION: "2.3.0"' in recipe
     assert 'if: \'$CI_PIPELINE_SOURCE == "merge_request_event"\'' in recipe
     assert "gate_exit=$?" in recipe
     assert 'exit "$gate_exit"' in recipe

{ragops-2.2.0 → ragops-2.3.0}/tests/test_local_release.py

@@ -19,6 +19,31 @@ def test_checksum_manifest_is_deterministic(tmp_path, monkeypatch) -> None:
     manifest = local_release.checksums([artifact])
     assert manifest.read_text().endswith("  artifact.whl\n")
     assert len(manifest.read_text().split()[0]) == 64
+    local_release.verify_checksums(tmp_path)
+
+
+def test_checksum_verification_rejects_tampering(tmp_path, monkeypatch) -> None:
+    monkeypatch.setattr(local_release, "DIST", tmp_path)
+    artifact = tmp_path / "artifact.whl"
+    artifact.write_bytes(b"ragops")
+    local_release.checksums([artifact])
+    artifact.write_bytes(b"tampered")
+    try:
+        local_release.verify_checksums(tmp_path)
+    except SystemExit as error:
+        assert "checksum mismatch" in str(error)
+    else:
+        raise AssertionError("tampered artifact must be rejected")
+
+
+def test_checksum_verification_rejects_path_traversal(tmp_path) -> None:
+    (tmp_path / "SHA256SUMS").write_text(f"{'0' * 64}  ../outside.whl\n")
+    try:
+        local_release.verify_checksums(tmp_path)
+    except SystemExit as error:
+        assert "invalid checksum target" in str(error)
+    else:
+        raise AssertionError("checksum target must stay inside release directory")
 
 
 def test_pypi_requires_explicit_token(monkeypatch) -> None:

{ragops-2.2.0 → ragops-2.3.0}/tests/test_public_api.py

@@ -1,8 +1,19 @@
 from ragops import __version__, responses_from_data, scenario_from_dict
+from ragops.cli import build_parser
 
 
 def test_stable_version() -> None:
-    assert __version__ == "2.2.0"
+    assert __version__ == "2.3.0"
+
+
+def test_cli_exposes_version(capsys) -> None:
+    try:
+        build_parser().parse_args(["--version"])
+    except SystemExit as error:
+        assert error.code == 0
+    else:
+        raise AssertionError("argparse version action must exit")
+    assert capsys.readouterr().out.strip() == f"ragops {__version__}"
 
 
 def test_public_contract_parsers() -> None: