Release CLI v0.8.10 (#138)

Keeps the benchmark authority synchronized with the evaluator and
fixture sources used at release time, so source drift fails during
ordinary CI instead of after a tag is published. The established
conservative quality metrics remain unchanged, and the package version
advances to `v0.8.10`.

Author: morgaesis

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "postil-cli"
-version = "0.8.9"
+version = "0.8.10"
 edition = "2024"
 description = "Postil: a low-noise AI review gate. Silent on clean PRs, hard gate on real risk."
 license = "Apache-2.0"

Cargo.toml

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "corpus": {
     "fixtureCorpusSha256": "3c4f952f9411bf2c4e5f0a61b5975e47d203f7681a8235d53d717c743ea9cb54",
-    "evaluatorSha256": "64dd1975bd5743e15b073b8c6dbad91e37cef3388f793073b216d002de80d78a"
+    "evaluatorSha256": "b0d452b0c2f8d419ef6f4780791cde8cd760d318a82b439aa5746a226305e125"
   },
   "profiles": {
     "z-ai/glm-5.2": {

bench/baseline.json

@@ -1,4 +1,8 @@
 import { describe, expect, test } from "bun:test";
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { cases } from "../fixtures/cases";
 import {
   DETECTION_RATE_MAX_DROP_PP,
   FALSE_FINDINGS_MAX_INCREASE,
@@ -12,6 +16,22 @@ import {
   type BaselineProfile,
   type LiveReportForComparison,
 } from "./compare-baseline";
+import { benchmarkCase } from "./harness";
+import { evaluatorSourceSha256 } from "./live";
+
+test("committed baseline authority matches the current benchmark sources", async () => {
+  const baseline = JSON.parse(
+    await readFile(resolve(import.meta.dir, "..", "baseline.json"), "utf8"),
+  ) as {
+    corpus: { fixtureCorpusSha256: string; evaluatorSha256: string };
+  };
+  const fixtureCorpusSha256 = createHash("sha256")
+    .update(JSON.stringify(cases.map((input) => benchmarkCase.parse(input))))
+    .digest("hex");
+
+  expect(baseline.corpus.fixtureCorpusSha256).toBe(fixtureCorpusSha256);
+  expect(baseline.corpus.evaluatorSha256).toBe(await evaluatorSourceSha256());
+});
 
 function fakeReport(overrides: {
   falsePositives?: number;

bench/src/compare-baseline.test.ts

@@ -380,7 +380,7 @@ async function screeningProfileMetadata(path: string): Promise<{
   };
 }
 
-async function evaluatorSourceSha256(): Promise<string> {
+export async function evaluatorSourceSha256(): Promise<string> {
   const benchRoot = resolve(fileURLToPath(import.meta.url), "..", "..");
   const sources = [
     "fixtures/cases.ts",