@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+# REQ-WEB-002: collect data from authenticated, completed main workflow runs.
+set -euo pipefail
+destination="${1:?Expected a new output directory}"
+repository="${GITHUB_REPOSITORY:?Expected the source repository}"
+[[ "$repository" == managedcode/Synapse ]]
+[[ ! -e "$destination" ]]
+mkdir -p "$destination"
+printf '{"verification":null,"performance":null}\n' > "$destination/runs.json"
+
+collect_artifact() {
+  local stream="$1" name="$2" filename="$3" metadata="$4" started="$5"
+  local selected artifact_id digest archive target
+  selected="$(jq -c --arg name "$name" --arg started "$started" \
+    '[.artifacts[] | select(.name == $name and .expired == false and .created_at >= $started)]
+     | sort_by(.created_at, .id) | last // empty' "$metadata")"
+  [[ -n "$selected" ]] || return 0
+  artifact_id="$(jq -r '.id' <<< "$selected")"
+  digest="$(jq -r '.digest // empty' <<< "$selected")"
+  [[ "$artifact_id" =~ ^[0-9]+$ ]]
+  # Refuse legacy unhashed, oversized, or otherwise unverifiable artifacts.
+  [[ "$digest" =~ ^sha256:[0-9a-f]{64}$ ]] || return 0
+  [[ "$(jq -r '.size_in_bytes <= 16777216' <<< "$selected")" == true ]] || return 0
+  archive="$destination/$artifact_id.zip"
+  if ! gh api "repos/$repository/actions/artifacts/${artifact_id}/zip" > "$archive"; then
+    rm -f "$archive"
+    return 0
+  fi
+  [[ "$(shasum -a 256 "$archive" | awk '{ print $1 }')" == "${digest#sha256:}" ]]
+  # Read one expected root member; never extract archive paths or executable files.
+  if [[ "$(unzip -Z -1 "$archive" | awk -v file="$filename" '$0 == file { count++ } END { print count+0 }')" != 1 ]]; then
+    rm "$archive"
+    return 0
+  fi
+  target="$destination/$stream/$name"
+  mkdir -p "$target"
+  unzip -p "$archive" "$filename" | head -c 16777217 > "$target/$filename"
+  [[ "$(wc -c < "$target/$filename")" -le 16777216 ]]
+  rm "$archive"
+  jq --arg stream "$stream" --argjson artifact "$selected" \
+    '.[$stream].artifact_manifest += [$artifact | {id,name,digest,created_at}]' \
+    "$destination/runs.json" > "$destination/runs.next.json"
+  mv "$destination/runs.next.json" "$destination/runs.json"
+}
+
+for stream in verification performance; do
+  workflow=verify
+  [[ "$stream" != performance ]] || workflow=performance
+  gh api "repos/$repository/actions/workflows/$workflow.yml/runs?branch=main&status=completed&per_page=100" \
+    > "$destination/$stream-runs.json"
+  run="$(jq -c --arg repository "$repository" \
+    '[.workflow_runs[] | select(.head_branch == "main" and .head_repository.full_name == $repository
+       and (.event == "push" or .event == "workflow_dispatch"))]
+     | sort_by(.run_number, .run_attempt) | last // empty' "$destination/$stream-runs.json")"
+  [[ -n "$run" ]] || continue
+  run_id="$(jq -r '.id' <<< "$run")"
+  [[ "$run_id" =~ ^[0-9]+$ ]]
+  jq --arg stream "$stream" --argjson run "$run" \
+    '.[$stream] = ($run | {id,run_number,run_attempt,head_sha,html_url,conclusion,updated_at,
+      run_started_at,head_branch,event,repository:.head_repository.full_name,artifact_manifest:[]})' \
+    "$destination/runs.json" > "$destination/runs.next.json"
+  mv "$destination/runs.next.json" "$destination/runs.json"
+  metadata="$destination/$stream-artifacts.json"
+  gh api --paginate --slurp "repos/$repository/actions/runs/$run_id/artifacts?per_page=100" \
+    | jq '{artifacts:[.[] | .artifacts[]]}' > "$metadata"
+  started="$(jq -r '.run_started_at' <<< "$run")"
+  if [[ "$stream" == verification ]]; then
+    for runner in osx-arm64 linux-x64 win-x64; do
+      collect_artifact "$stream" "test-results-$runner" test-results.json "$metadata" "$started"
+    done
+  else
+    collect_artifact "$stream" performance-summary performance-results.json "$metadata" "$started"
+  fi
+  # A rerun may begin during collection; never attribute its artifacts to an old attempt.
+  [[ "$(gh api "repos/$repository/actions/runs/$run_id" | jq -r \
+    --argjson attempt "$(jq -r '.run_attempt' <<< "$run")" --arg started "$started" \
+    --arg sha "$(jq -r '.head_sha' <<< "$run")" \
+    '.status == "completed" and .run_attempt == $attempt and .run_started_at == $started and .head_sha == $sha')" == true ]]
+done
@@ -7,10 +7,18 @@ on:
       - docs/images/**
       - site/**
       - .github/workflows/pages.yml
+      - .github/scripts/collect-site-results.sh
+      - experiments/Synapse.ReferenceBenchmarks/Features/Website/**
+      - experiments/Synapse.ReferenceBenchmarks/HostedArtifactReportCommand.cs
+      - experiments/Synapse.ReferenceBenchmarks/Program.cs
   workflow_dispatch:
+  workflow_run:
+    workflows: [verify, performance]
+    types: [completed]
 
 permissions:
   contents: read
+  actions: read
 
 concurrency:
   group: github-pages
@@ -19,10 +27,40 @@ concurrency:
 jobs:
   build:
     name: Build public site
+    if: >-
+      github.ref == 'refs/heads/main' &&
+      (github.event_name != 'workflow_run' ||
+       (github.event.workflow_run.head_branch == 'main' &&
+        github.event.workflow_run.head_repository.full_name == github.repository &&
+        (github.event.workflow_run.event == 'push' ||
+         github.event.workflow_run.event == 'workflow_dispatch')))
     runs-on: ubuntu-24.04
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: main
+          persist-credentials: false
+
+      - name: Install pinned .NET SDK
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        with:
+          global-json-file: global.json
+
+      - name: Install pinned Rust toolchain required by the reporter build
+        run: rustup toolchain install 1.98.1 --profile minimal
+
+      - name: Collect latest completed main CI result artifacts
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: bash .github/scripts/collect-site-results.sh "${RUNNER_TEMP}/site-results"
+
+      - name: Build C# result validator
+        run: |
+          dotnet restore experiments/Synapse.ReferenceBenchmarks/Synapse.ReferenceBenchmarks.csproj --locked-mode
+          dotnet build experiments/Synapse.ReferenceBenchmarks/Synapse.ReferenceBenchmarks.csproj --configuration Release --no-restore
 
       - name: Configure GitHub Pages
         uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
@@ -32,8 +70,12 @@ jobs:
         run: |
           mkdir -p _site/images
           cp site/index.html site/styles.css site/site.js site/favicon.svg _site/
+          cp site/metrics.js _site/
           cp docs/images/*.svg _site/images/
           touch _site/.nojekyll
+          dotnet experiments/Synapse.ReferenceBenchmarks/bin/Release/net10.0/Synapse.ReferenceBenchmarks.dll site-data \
+            --artifacts "${RUNNER_TEMP}/site-results" --runs "${RUNNER_TEMP}/site-results/runs.json" \
+            --output _site/data/latest.json
 
       - name: Upload GitHub Pages artifact
         uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
 
@@ -376,13 +376,16 @@ jobs:
             --artifacts "${RUNNER_TEMP}/performance-artifacts" \
             --model-set benchmarks/model-sets/foundry-local-families.json \
             --output "${RUNNER_TEMP}/performance-summary.md" \
+            --json "${RUNNER_TEMP}/performance-results.json" \
             --summary "${GITHUB_STEP_SUMMARY}"
 
       - name: Preserve combined results table
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: performance-summary
-          path: ${{ runner.temp }}/performance-summary.md
+          path: |
+            ${{ runner.temp }}/performance-summary.md
+            ${{ runner.temp }}/performance-results.json
           if-no-files-found: warn
-          retention-days: 30
+          retention-days: 90
@@ -126,7 +126,36 @@ jobs:
         run: echo "SYNAPSE_LLAMACPP_EXECUTABLE=${GITHUB_WORKSPACE}/_external/llama.cpp/${{ matrix.llama_binary_directory }}/llama-completion${{ matrix.executable_suffix }}" >> "${GITHUB_ENV}"
 
       - name: Test .NET
-        run: dotnet test Synapse.slnx --configuration Release --no-build
+        run: >-
+          dotnet test Synapse.slnx --configuration Release --no-build --
+          --report-trx --results-directory "${{ runner.temp }}/test-results"
+          --minimum-expected-tests 1 --zero-tests-policy strict
+
+      - name: Export real .NET test results as JSON
+        if: always()
+        shell: bash
+        run: |
+          dotnet experiments/Synapse.ReferenceBenchmarks/bin/Release/net10.0/Synapse.ReferenceBenchmarks.dll test-report \
+            --results "${RUNNER_TEMP}/test-results" --runner "${{ matrix.runtime_identifier }}" \
+            --output "${RUNNER_TEMP}/test-results.json"
+
+      - name: Publish .NET test JSON
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: test-results-${{ matrix.runtime_identifier }}
+          path: ${{ runner.temp }}/test-results.json
+          if-no-files-found: warn
+          retention-days: 90
+
+      - name: Preserve raw .NET TRX evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: test-trx-${{ matrix.runtime_identifier }}
+          path: ${{ runner.temp }}/test-results/*.trx
+          if-no-files-found: warn
+          retention-days: 90
 
       - name: Check Rust formatting
         run: cargo fmt --manifest-path native/Cargo.toml --all --check
 
@@ -31,3 +31,34 @@ The repository does not maintain a generated `gh-pages` branch. A successful
 local source check or push is insufficient evidence: publication is complete
 only after the remote Pages workflow succeeds and the canonical HTTPS URL
 serves that revision.
+
+## 2026-10-03: CI result publication (`TASK-WEB-002`)
+
+Completed trusted `main` runs of `verify` and `performance` also trigger the
+Pages workflow. Pull-request and fork runs cannot publish. The build checks
+out trusted `main` source, reads Actions artifacts as data only, and selects
+the latest completed push/manual run of each workflow. Both streams retain
+their own run ID, attempt, source SHA, conclusion and time; they may describe
+different commits. Serialized deployments select current runs when building,
+so an older queued completion cannot deliberately republish its old snapshot.
+
+Each verification runner exports a version-1 JSON projection of real .NET TRX
+results. Zero tests, absent reports, malformed reports and failing tests never
+become a passing result. Rust remains part of the workflow conclusion; .NET
+counts explicitly name their scope. Performance aggregation exports a
+version-1 JSON projection of the validated raw benchmark artifacts, including
+missing/invalid evidence, nullable metrics and measured sample counts. Native
+eval and reported decode rates, and request and fresh-process wall times,
+retain distinct scopes. These diagnostics confer no statistical winner verdict.
+
+A C# command assembles `data/latest.json` with independent run provenance,
+validated test reports and performance rows. The public site displays these
+CI results separately from dated local Apple M2 Pro measurements. JSON and
+upstream run links are public; raw artifacts remain on GitHub Actions. Missing
+or expired artifacts are shown explicitly. No generated Git commits, runtime
+backend changes, Node.js or Python tooling are introduced.
+
+The collector uses authenticated API artifact IDs from the selected run and
+attempt, expected names only, bounded downloads and a confined extraction
+directory. Artifact paths, schemas and runner identities are checked before
+publication. Only deployment receives Pages/OIDC write privileges.
@@ -0,0 +1,84 @@
+# Website metrics publication evidence — 2026-10-03
+
+Scope: `REQ-WEB-002`, `AC-WEB-002-1..4`, `TASK-WEB-002`,
+`TEST-WEB-002-1..4`, ADR-010. Use the current checkout; preserve pre-existing
+model/runtime/docs changes. No worktree, stash, dependency or model change.
+
+## Behavior-first verification
+
+- Benchmark JSON export: initial 4/4 failed because `aggregate --json` was
+  unsupported (exit 2); final 4/4 passed. Existing hosted-report 2/2 passed.
+- TRX export: initial five real-child tests failed because `test-report` was
+  unsupported; the final seven test cases passed. They execute real TUnit
+  fixtures and mutate real XML for invalid input cases; no service double.
+- Pipeline/site data: the initial three cases had two failures (no trigger
+  and no site-data command). Four additional source/report regressions exposed
+  invalid-data exception handling and scalar metadata acceptance before the
+  repairs. The final positive case executes real TUnit -> TRX -> test JSON and
+  recorded raw benchmark -> numerical JSON -> public site JSON.
+- Final Website suite: 19/19 passed, zero failed/skipped, with the real TRX
+  retained under ignored `artifacts/website-publication/final-tests/`.
+
+## Commands and outcomes
+
+| Command | Outcome |
+|---|---|
+| `dotnet restore Synapse.slnx --locked-mode` | Exit 0, all six projects |
+| `dotnet build Synapse.slnx --configuration Release --no-restore --disable-build-servers -m:1` | Exit 0, zero warnings/errors |
+| `dotnet format Synapse.slnx --no-restore --verify-no-changes` | Exit 0 after the final constructor style fix |
+| `dotnet artifacts/website-publication/coverage-snapshot/ManagedCode.Synapse.IntegrationTests.dll --treenode-filter '/*/ManagedCode.Synapse.IntegrationTests.Features.Website/*/*' --minimum-expected-tests 19 --coverage --coverage-output-format cobertura --coverage-output /Users/ksemenenko/Developer/Synapse/artifacts/website-publication/coverage.cobertura.xml --results-directory /Users/ksemenenko/Developer/Synapse/artifacts/website-publication/final-tests --report-trx` | Exit 0, 19 passed, 17.105s |
+| `dotnet experiments/Synapse.ReferenceBenchmarks/bin/Release/net10.0/Synapse.ReferenceBenchmarks.dll test-report --results artifacts/website-publication/final-tests --runner osx-arm64 --output artifacts/website-publication/final-test-results.json` | Exit 0; actual 19 passed, zero failed/skipped |
+| `cargo test --manifest-path native/Cargo.toml --locked` | Exit 0; 32 actual tests, empty unit/doc targets do not count as required suites |
+| `cargo fmt --manifest-path native/Cargo.toml --all --check` | Exit 0 |
+| `cargo clippy --manifest-path native/Cargo.toml --workspace --all-targets -- -D warnings` | Exit 0 |
+| `dotnet list Synapse.slnx package --vulnerable --include-transitive` | Exit 0; no reported vulnerable packages in six projects |
+| `actionlint .github/workflows/pages.yml .github/workflows/verify.yml .github/workflows/performance.yml` | Exit 0 |
+| `bash -n .github/scripts/collect-site-results.sh` | Exit 0 |
+| `git diff --check`, `git diff --cached --check` | Exit 0 |
+
+Rust commands use `PATH=/opt/homebrew/opt/rustup/bin:$PATH`. Sandbox feed/IPC
+access was granted for required checks. Coverage runs from a copied binary
+directory to preserve the normal build. C# XML analysis deduplicates filename
+and line number: Website source coverage is 340/367 (92.64%). Overall benchmark
+assembly coverage is 9.3% for this focused filter; this is not a full-solution
+or changed-line coverage claim.
+
+## Artifact and source qualification
+
+The real collector verified existing GitHub artifact SHA-256 values and
+retained independent metadata for verification run `36547564346` (failure)
+and performance run `36547564428` (success), both source
+`7a219c6cb6fdb851962a3f23a2f141abde20679d`. These older runs have no new JSON,
+so the produced `current-latest-validated.json` truthfully contains absent
+test artifacts and a null benchmark report. Historical Markdown-only
+artifacts are not relabeled as numerical evidence.
+
+An independent source export consists of `git archive HEAD` plus exactly the
+staged publication patch; it contains none of the pre-existing model changes.
+Its first build caught an incorrectly positioned staged switch insertion;
+the staged-only patch coordinates were corrected before publication. The
+corrected export passed locked restore, Release solution build (5.80s,
+zero warnings/errors), 19/19 Website tests (12.268s) and 2/2 hosted-report
+compatibility tests (263ms), all exit 0. Remote publication follows separately.
+
+Architecture review: no new runtime engines/dependencies, generated branches,
+or Node/Python tooling. Files/types stay within repository size limits. Only
+trusted completed `main` push/manual workflow runs may publish; collector
+checks attempt freshness, artifact digests, bounded content and expected root
+members without extracting untrusted paths. The site uses textContent for
+report data and validates GitHub links and numeric/schema fields.
+
+## Current limitations
+
+The C# preview serves source-identical HTML/JS with HTTP 200 and a truthful
+404 before metrics data exists. CUA exposes no enabled browser/app surface, so
+desktop/mobile rendering and browser JavaScript execution are unverified.
+The broader runtime/statistical benchmark plans remain open; these tests do
+not establish a performance winner. `TASK-WEB-002` stays `in_progress` until
+remote/live evidence and the outstanding browser review are recorded.
+
+Automatic approval review initially rejected the scoped commit/push to `main`
+because the dependency-repair authorization does not cover this feature. No
+commit or push occurred during that attempt. On 2026-10-03 the user explicitly
+authorized pushing these prepared changes to `main`; publication proceeds
+under that authorization.
@@ -127,6 +127,15 @@
       "dependsOn": [],
       "tests": ["TEST-WEB-001-1"]
     },
+    {
+      "id": "TASK-WEB-002",
+      "requirement": "REQ-WEB-002",
+      "slice": "Website",
+      "stage": "D0",
+      "status": "in_progress",
+      "dependsOn": ["TASK-WEB-001"],
+      "tests": ["TEST-WEB-002-1", "TEST-WEB-002-2", "TEST-WEB-002-3", "TEST-WEB-002-4"]
+    },
     {
       "id": "TASK-CTX-001",
       "requirement": "REQ-CTX-001",
 
@@ -15,3 +15,24 @@ that content changes.
 The files under `site/` own the rendered page; `docs/images/` owns its public
 diagrams. The workflow copies those sources without modifying them and keeps
 documentation links pointed at their canonical repository paths.
+
+## Automatic CI metrics (`REQ-WEB-002`, ADR-010)
+
+Functional test runners publish `test-results.json` from real .NET TRX files;
+benchmark aggregation publishes `performance-results.json` from validated raw
+JSON. Both use schema version 1. Missing values are null and missing/invalid
+evidence is retained. .NET counts and whole-workflow conclusions are separate.
+
+Pages runs after trusted `main` push/manual workflows complete, downloads the
+latest completed verification and performance artifacts by authenticated run
+and artifact ID, and publishes `data/latest.json`. The two streams retain
+independent commit/run/attempt/time provenance. Failed and partial runs remain
+visible. Public CI tables never imply a cross-hardware performance verdict or
+replace the dated M2 Pro diagnostics.
+
+| Acceptance criterion | Evidence |
+|---|---|
+| `AC-WEB-002-1` real nonzero TRX results export immutable JSON; failed, missing, zero and malformed results cannot pass | `TEST-WEB-002-1` `TestResultsPublicationTests` |
+| `AC-WEB-002-2` numerical benchmark JSON retains sample counts, nullable metrics, phase scopes and invalid/missing evidence | `TEST-WEB-002-2` `PerformancePublicationTests` |
+| `AC-WEB-002-3` trusted completed runs trigger a confined artifact-to-Pages build with independently attributable streams | `TEST-WEB-002-3` `MetricsPipelineTests`, remote Actions evidence |
+| `AC-WEB-002-4` the responsive site displays current test counts and filterable scoped benchmark rows, with provenance and honest unavailable states | `TEST-WEB-002-4` rendered desktop/mobile review and public JSON response |