refactor(bench): add public certification runner

benchmarks/Cargo.toml

@@ -1,9 +1,13 @@
 [workspace]
-members = ["runners/smoke"]
+members = ["runners/certify", "runners/smoke"]
 resolver = "2"
 
 [workspace.package]
 edition = "2024"
 license = "Apache-2.0"
 publish = false
 rust-version = "1.85"
+
+[workspace.dependencies]
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"

benchmarks/README.md

@@ -26,6 +26,56 @@ belongs to issue #959, after parity is proven.
 - `tests/` — no-cost workspace and fixture-discovery tests.
 - `runners/` — unpublished Rust benchmark runners.
 
+## Public-interface certification runner
+
+`runners/certify` owns the admission through reopen-proof lifecycle. A profile
+declares a typed benchmark-owned generator action for `generate` and one
+ordinary `gf` public command action for every product phase, in order. Runtime
+validation binds each product phase to its real command family and rejects
+global help/version no-ops. The runner does not link product crates, call
+storage internals, provision a host, or enforce CPU, memory, disk, or time
+limits. BenchExec or another outer orchestrator owns deadlines and may terminate
+the runner; the certification binary does not silently convert a policy timeout
+into product evidence.
+
+```bash
+cargo run --locked --manifest-path benchmarks/Cargo.toml \
+  --bin graphforge-benchmark-certify -- \
+  run PROFILE.json benchmarks/outputs/evidence.json
+```
+
+Tiny in-process fixtures exercise every phase and first-failure behavior without
+opening a project. Graph500 profiles supply the real generate, ingest, recount,
+query, portable export/verify/import, and reopen commands in #956; a placeholder
+profile that merely labels no-op commands as lifecycle work is intentionally not
+shipped.
+
+Evidence contains only phase names, typed pass/fail state, exit codes, elapsed
+milliseconds, and observed peak RSS bytes. Command arguments and child output
+are intentionally excluded so graph contents, credentials, and sensitive paths
+cannot be emitted. Missing RSS is represented as `null`; this runner records
+resource evidence but never enforces a resource policy. Certification stops at
+the first failed phase. One sanitized JSON phase event is written to standard
+output as each public command finishes; the final typed evidence document is
+written only to the requested output file.
+
+Phase RSS is an observation, not a memory budget. Ladder orchestration must
+compare the same phase across scales and treat sustained edge-count-linear RSS
+growth as an architectural failure signal. This runner does not infer that
+cross-profile trend or convert the M5 certification ceiling into a requirement.
+
+Legacy JSON can be converted into the same sanitized contract:
+
+```bash
+cargo run --locked --manifest-path benchmarks/Cargo.toml \
+  --bin graphforge-benchmark-certify -- \
+  normalize legacy-evidence.json benchmarks/outputs/normalized.json
+```
+
+The accepted legacy shape is `{profile, phases}` with each phase containing
+`name`, `ok`, `duration_secs`, optional `max_rss_kib`, and optional
+`exit_code`. Normalization is fail-closed and stops after the first failure.
+
 Generated datasets, credentials, execution outputs, and local environments are
 ignored. Fly execution is forbidden until the complete benchmark stack is
 merged and has passed local and hosted qualification.

benchmarks/runners/certify/Cargo.toml

@@ -0,0 +1,11 @@
+[package]
+name = "graphforge-benchmark-certify"
+version = "0.0.0"
+edition.workspace = true
+license.workspace = true
+publish.workspace = true
+rust-version.workspace = true
+
+[dependencies]
+serde.workspace = true
+serde_json.workspace = true