RAGOps 2.0: verifiable offline AI release governance

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ragops",
-  "version": "1.0.0",
+  "version": "2.0.0",
   "description": "Explainable regression tests and release gates for RAG systems and AI agents.",
   "author": {
     "name": "Thang Luu",

.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ragops",
-  "version": "1.0.0",
-  "description": "Explainable regression tests and release gates for RAG systems and AI agents.",
+  "version": "2.0.0",
+  "description": "Offline, explainable release gates and evidence bundles for RAG systems and AI agents.",
   "author": {
     "name": "Thang Luu",
     "url": "https://github.com/thangldw"
@@ -14,7 +14,7 @@
   "interface": {
     "displayName": "RAGOps",
     "shortDescription": "Gate AI releases with evidence",
-    "longDescription": "Compare candidate AI behavior with an accepted baseline, explain failed gates, and produce reviewable release evidence without requiring a model provider.",
+    "longDescription": "Compare recorded candidate behavior with an accepted baseline, localize regressions by policy and case, and produce verifiable release evidence without requiring a model provider.",
     "developerName": "DUC THANG LUU",
     "category": "Productivity",
     "capabilities": ["Read"],

.github/workflows/ci.yml

@@ -0,0 +1,42 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - name: Install test dependencies
+        run: python -m pip install --disable-pip-version-check -e '.[dev]' build
+      - name: Lint
+        run: ruff check .
+      - name: Test
+        env:
+          PYTEST_DISABLE_PLUGIN_AUTOLOAD: "1"
+        run: pytest -q
+      - name: Build and inspect distributions
+        run: |
+          python -m build
+          python -m zipfile --list dist/ragops-*.whl | grep 'ragops/web/index.html'
+          python -m zipfile --list dist/ragops-*.whl | grep 'ragops/api/main.py'
+      - name: Run credential-free release gate
+        run: |
+          ragops demo --profile engineer --output demo-output
+          ragops evidence verify --bundle demo-output/evidence

.github/workflows/publish-pypi.yml

@@ -16,10 +16,10 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.tag }}
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
       - name: Verify tag and package version
@@ -53,6 +53,7 @@ jobs:
             --pattern 'ragops-*.whl' \
             --pattern 'ragops-*.tar.gz' \
             --pattern 'ragops-*.cdx.json' \
+            --pattern 'ragops-chatgpt-plugin-*.zip' \
             --pattern 'SHA256SUMS' \
             --dir release-assets
           (cd release-assets && sha256sum --check SHA256SUMS)

.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ragops",
-  "version": "1.0.0",
+  "version": "2.0.0",
   "description": "Explainable regression tests and release gates for RAG systems and AI agents.",
   "author": {
     "name": "Thang Luu",

CHANGELOG.md

@@ -4,7 +4,28 @@
 
 ### English
 
-- Added an offline Phoenix recorded-score adapter example that preserves producer-owned score meaning, scale, and direction while enforcing complete case coverage.
+- No unreleased changes.
+
+## [2.0.0] - 2026-08-23
+
+### English
+
+- Added versioned contract migration, content-addressed evidence bundles, slice/distribution gates, evaluator calibration, trace-graph evaluation, dataset leakage controls, CI renderers, portable vendor adapters, and audited blind review.
+- Packaged the optional FastAPI workbench with CSP-safe DOM rendering and added Python 3.11-3.13 CI.
+- Upgraded the synthetic flagship demo to generate canonical JSON, Markdown, HTML, JUnit, SARIF, GitHub Summary, and verified evidence for executive, engineer, and auditor profiles.
+- Added a deterministic ChatGPT skills-only plugin bundle and v2 release evidence.
+
+### Tiếng Việt
+
+- Bổ sung contract có version, evidence bundle content-addressed, slice/distribution gate, calibration, trace graph, chống dataset leakage, CI renderer, vendor adapter và blind review có audit.
+- Đóng gói FastAPI workbench tùy chọn với CSP/DOM an toàn và CI Python 3.11-3.13.
+- Nâng demo synthetic để xuất cùng một quyết định qua JSON, Markdown, HTML, JUnit, SARIF, GitHub Summary và evidence đã xác minh.
+
+### 日本語
+
+- versioned contract、content-addressed evidence、slice/distribution gate、calibration、trace graph、dataset leakage check、CI renderer、vendor adapter、blind review audit を追加しました。
+- CSP-safe な任意 FastAPI workbench と Python 3.11-3.13 CI を同梱しました。
+- synthetic flagship demo は同一判定を JSON、Markdown、HTML、JUnit、SARIF、GitHub Summary、検証済み evidence に出力します。
 
 ## [1.2.0] - 2026-08-02
 
@@ -46,5 +67,6 @@
 - リポジトリ所有の GitHub Actions をすべて削除し、リリースゲートはローカル CLI と API で引き続き利用できます。
 - 公開タグとパッケージ版を `v1.0.0` に統一しました。
 
+[2.0.0]: https://github.com/thangldw/ragops/releases/tag/v2.0.0
 [1.2.0]: https://github.com/thangldw/ragops/releases/tag/v1.2.0
 [1.0.0]: https://github.com/thangldw/ragops/releases/tag/v1.0.0

README.md

@@ -2,7 +2,7 @@
 
 [English](#english) · [Tiếng Việt](#tiếng-việt) · [日本語](#日本語)
 
-Regression tests and explainable release gates for RAG systems and AI agents.
+Offline, reproducible release gates for RAG systems and AI agents.
 
 ```mermaid
 %%{init: {"theme":"base","themeVariables":{"background":"#FFFFFF","fontFamily":"Arial, sans-serif","lineColor":"#667085","primaryTextColor":"#172B4D"}}}%%
@@ -11,7 +11,7 @@ flowchart LR
     B["Accepted baseline<br/>Mốc chuẩn / 基準"]:::blue
     C["Candidate traces<br/>Ứng viên / 候補"]:::purple
     E["Evaluators & policy<br/>Đánh giá / 評価"]:::green
-    G{"PASS / WARN / FAIL"}:::pink
+    G{"PASS / WARN / BLOCK"}:::pink
     S --> E
     B --> E
     C --> E --> G
@@ -24,31 +24,34 @@ flowchart LR
 
 ## English
 
-RAGOps compares recorded candidate behavior with an accepted baseline, applies versioned release policy and returns explainable `PASS`, `WARN` or `FAIL` evidence. The dependency-free core works offline; optional adapters expose API and UI surfaces. Runtime integrations use the local CLI or API; the repository-owned GitHub Actions workflow is limited to PyPI publishing.
+RAGOps compares recorded candidate behavior with an accepted baseline, applies a versioned release policy, and emits one canonical `PASS`, `WARN`, or `BLOCK` decision across JSON, Markdown, HTML, JUnit, SARIF, and GitHub Summary. The dependency-free core performs no network calls. Optional adapters import vendor exports; the API/workbench ships in the wheel through the `api` extra.
 
 Requirements: Python 3.11+.
 
-Current technical references: [architecture](docs/ARCHITECTURE.md), [operations](docs/OPERATIONS.md), [security](SECURITY.md) and [v1.2.0 release notes](docs/releases/v1.2.0.md).
+Current technical references: [architecture](docs/ARCHITECTURE.md), [contracts](docs/CONTRACTS.md), [governance](docs/governance.md), [operations](docs/OPERATIONS.md), [security](SECURITY.md), and [v2.0.0 release notes](docs/releases/v2.0.0.md).
 
 The repository is also a skills-only plugin for ChatGPT, Codex, Claude Code and Cowork. It does not include a hosted MCP connector. See the [directory submission package](docs/submission/DIRECTORY_SUBMISSION.md), [privacy policy](PRIVACY.md), [terms](TERMS.md), and [support guidance](SUPPORT.md).
 
 ```bash
-python -m venv .venv
-.venv/bin/pip install -e '.[dev]'
-.venv/bin/ragops inspect --scenario scenarios/japanese_troubleshooting/benchmark-v0.2.json
-.venv/bin/ruff check .
-PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 .venv/bin/pytest -q
+pip install ragops
+ragops demo --profile engineer --output ./demo-output
+ragops evidence verify --bundle ./demo-output/evidence
+open ./demo-output/release-report.html
 ```
 
+The credential-free demo intentionally returns `BLOCK`: citation coverage `1.0 -> 0.5`, citation precision `1.0 -> 0.5`, and lexical groundedness `1.0 -> 0.6`. It is synthetic benchmark evidence, not production adoption evidence.
+
+Install `ragops[api]` and run `ragops serve` for the local authenticated API/workbench. Use `ragops adapter list` for Phoenix, Ragas, DeepEval, LangSmith, MLflow, Promptfoo, custom JSON, and installed entry-point adapters.
+
 ## Tiếng Việt
 
-RAGOps so sánh hành vi ứng viên đã ghi lại với baseline được chấp nhận, áp dụng policy phát hành có version và trả về bằng chứng giải thích được ở trạng thái `PASS`, `WARN` hoặc `FAIL`. Core không có dependency và chạy offline; adapter tùy chọn cung cấp API/UI. Tích hợp runtime dùng CLI hoặc API cục bộ; GitHub Actions thuộc repo chỉ dùng để phát hành PyPI.
+RAGOps so sánh trace ứng viên với baseline được chấp nhận, áp dụng release policy có version và xuất cùng một quyết định `PASS`, `WARN` hoặc `BLOCK` sang JSON/Markdown/HTML/JUnit/SARIF. Core không dependency, chạy offline; API/workbench là extra tùy chọn. Demo synthetic cố ý tạo `BLOCK`, không phải bằng chứng production adoption.
 
 Yêu cầu: Python 3.11+. Dùng các lệnh ở phần English để cài đặt, kiểm tra scenario, lint và test.
 
 ## 日本語
 
-RAGOps は、記録済みの候補動作を承認済みベースラインと比較し、バージョン管理されたリリースポリシーを適用して、説明可能な `PASS`・`WARN`・`FAIL` の根拠を返します。依存関係のないコアはオフラインで動作し、任意のアダプターが API と UI を提供します。runtime integration はローカル CLI/API を使い、repository-owned GitHub Actions は PyPI 公開のみに使用します。
+RAGOps は記録済み候補を承認済みベースラインと比較し、バージョン管理された方針から一つの `PASS`・`WARN`・`BLOCK` 判定を JSON、Markdown、HTML、JUnit、SARIF に出力します。依存関係のない core はオフラインで動作し、API/workbench は任意の extra です。デモは synthetic evidence であり、本番導入実績ではありません。
 
 必要環境は Python 3.11 以上です。セットアップ、lint、テストには English セクションのコマンドを使用してください。