diff --git a/.github/scripts/benchmark/setup.sh b/.github/scripts/benchmark/setup.sh
new file mode 100755
index 00000000..44dd1685
--- /dev/null
+++ b/.github/scripts/benchmark/setup.sh
@@ -0,0 +1,139 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir="$( cd "$(dirname "${0}")" && pwd )"
+
+
+: "${benchmark_config_file:?}"
+: "${provider:?provider is required (s3|gcs|azurebs|alioss)}"
+CONFIG_FILE="${benchmark_config_file}"
+
+case "${provider}" in
+
+  s3)
+    : "${aws_access_key_id:?}"
+    : "${aws_secret_access_key:?}"
+    : "${aws_region:=us-east-1}"
+    : "${aws_stack_name:=s3cli-public-bucket}"
+
+    # translate to names the s3 setup-aws-infrastructure.sh script expects
+    export access_key_id="${aws_access_key_id}"
+    export secret_access_key="${aws_secret_access_key}"
+    export region_name="${aws_region}"
+    export stack_name="${aws_stack_name}"
+
+    bash "${script_dir}/../s3/setup-aws-infrastructure.sh"
+
+    # source utils to use get_stack_info functions
+    # re-export AWS vars since subprocess env does not propagate back
+    export AWS_ACCESS_KEY_ID="${aws_access_key_id}"
+    export AWS_SECRET_ACCESS_KEY="${aws_secret_access_key}"
+    export AWS_DEFAULT_REGION="${aws_region}"
+    source "${script_dir}/../s3/utils.sh"
+    stack_info=$(get_stack_info "${aws_stack_name}")
+    bucket_name=$(get_stack_info_of "${stack_info}" "BucketName")
+    : "${bucket_name:?failed to read bucket name from stack outputs}"
+
+    jq -n \
+      --arg access_key_id     "${aws_access_key_id}" \
+      --arg secret_access_key "${aws_secret_access_key}" \
+      --arg bucket_name       "${bucket_name}" \
+      --arg region            "${aws_region}" \
+      '{
+        access_key_id:     $access_key_id,
+        secret_access_key: $secret_access_key,
+        bucket_name:       $bucket_name,
+        region:            $region
+      }' > "${CONFIG_FILE}"
+    ;;
+
+  gcs)
+    : "${google_json_key_data:?}"
+
+    # login via gcloud
+    source "${script_dir}/../gcs/utils.sh"
+    gcloud_login
+
+    # create the regional bucket
+    make -C "${script_dir}/../gcs" regional-bucket
+
+    # read bucket name from the lock file
+    bucket_name="$(read_bucket_name "regional")"
+    : "${bucket_name:?failed to read bucket name from gcs lock file}"
+
+    jq -n \
+      --arg json_key    "${google_json_key_data}" \
+      --arg bucket_name "${bucket_name}" \
+      '{
+        provider:                    "Google",
+        credentials_source:          "static",
+        json_key:                    $json_key,
+        bucket_name:                 $bucket_name,
+        uniform_bucket_level_access: true
+      }' > "${CONFIG_FILE}"
+    ;;
+
+  azurebs)
+    : "${azure_storage_account:?}"
+    : "${azure_storage_key:?}"
+    export environment="AzureCloud"
+
+    # create the container
+    bash "${script_dir}/../azurebs/setup.sh"
+
+    # read the container name from the lock file
+    source "${script_dir}/../azurebs/utils.sh"
+    container_name="$(read_container_name_from_file "${environment}")"
+    : "${container_name:?failed to read container name from lock file}"
+
+    jq -n \
+      --arg account_name   "${azure_storage_account}" \
+      --arg account_key    "${azure_storage_key}" \
+      --arg container_name "${container_name}" \
+      '{
+        account_name:   $account_name,
+        account_key:    $account_key,
+        container_name: $container_name
+      }' > "${CONFIG_FILE}"
+    ;;
+
+  alioss)
+    : "${alioss_access_key_id:?}"
+    : "${alioss_access_key_secret:?}"
+    : "${alioss_region:=eu-central-1}"
+
+    # translate to names the alioss script expects
+    export access_key_id="${alioss_access_key_id}"
+    export access_key_secret="${alioss_access_key_secret}"
+    export region="${alioss_region}"
+    export test_name="benchmark"
+
+    # create the bucket
+    bash "${script_dir}/../alioss/setup.sh"
+
+    # read the bucket name from the lock file
+    source "${script_dir}/../alioss/utils.sh"
+    bucket_name="$(read_bucket_name_from_file "${test_name}")"
+    : "${bucket_name:?failed to read bucket name from alioss lock file}"
+
+    jq -n \
+      --arg access_key_id     "${alioss_access_key_id}" \
+      --arg access_key_secret "${alioss_access_key_secret}" \
+      --arg bucket_name       "${bucket_name}" \
+      --arg endpoint          "oss-${alioss_region}.aliyuncs.com" \
+      '{
+        access_key_id:     $access_key_id,
+        access_key_secret: $access_key_secret,
+        bucket_name:       $bucket_name,
+        endpoint:          $endpoint
+      }' > "${CONFIG_FILE}"
+    ;;
+
+  *)
+    echo "Unknown provider: ${provider}. Must be one of: s3, gcs, azurebs, alioss"
+    exit 1
+    ;;
+esac
+
+echo "Setup complete. Config written to ${CONFIG_FILE}"
+chmod 600 "${CONFIG_FILE}"
diff --git a/.github/scripts/benchmark/teardown.sh b/.github/scripts/benchmark/teardown.sh
new file mode 100755
index 00000000..9ccd1eea
--- /dev/null
+++ b/.github/scripts/benchmark/teardown.sh
@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir="$( cd "$(dirname "${0}")" && pwd )"
+
+: "${benchmark_config_file:?}"
+: "${provider:?provider is required (s3|gcs|azurebs|alioss)}"
+CONFIG_FILE="${benchmark_config_file}"
+
+# always remove the config file even if teardown fails
+trap 'rm -f "${CONFIG_FILE}"' EXIT
+
+case "${provider}" in
+
+  s3)
+    : "${aws_access_key_id:?}"
+    : "${aws_secret_access_key:?}"
+    : "${aws_region:=us-east-1}"
+    : "${aws_stack_name:=s3cli-public-bucket}"
+
+    # translate to names the s3 teardown script expects
+    export access_key_id="${aws_access_key_id}"
+    export secret_access_key="${aws_secret_access_key}"
+    export region_name="${aws_region}"
+    export stack_name="${aws_stack_name}"
+
+    bash "${script_dir}/../s3/teardown-infrastructure.sh"
+    ;;
+
+  gcs)
+    : "${google_json_key_data:?}"
+
+    source "${script_dir}/../gcs/utils.sh"
+    gcloud_login
+
+    # read bucket name and delete — cannot use make clean-gcs since it
+    # requires all three lock files (regional, multiregional, public)
+    # but we only created the regional bucket
+    bucket_name="$(read_bucket_name "regional")"
+    : "${bucket_name:?failed to read bucket name from gcs lock file}"
+
+    gsutil rm -r "gs://${bucket_name}" || true
+    ;;
+
+  azurebs)
+    : "${azure_storage_account:?}"
+    : "${azure_storage_key:?}"
+    export environment="AzureCloud"
+
+    bash "${script_dir}/../azurebs/teardown.sh"
+    ;;
+
+  alioss)
+    : "${alioss_access_key_id:?}"
+    : "${alioss_access_key_secret:?}"
+    : "${alioss_region:=eu-central-1}"
+
+    # translate to names the alioss teardown script expects
+    export access_key_id="${alioss_access_key_id}"
+    export access_key_secret="${alioss_access_key_secret}"
+    export region="${alioss_region}"
+    export test_name="benchmark"
+
+    bash "${script_dir}/../alioss/teardown.sh"
+    ;;
+
+  *)
+    echo "Unknown provider: ${provider}. Must be one of: s3, gcs, azurebs, alioss"
+    exit 1
+    ;;
+esac
+
+echo "Teardown complete."
diff --git a/.github/scripts/gcs/utils.sh b/.github/scripts/gcs/utils.sh
index ba4f5a5c..3f505507 100644
--- a/.github/scripts/gcs/utils.sh
+++ b/.github/scripts/gcs/utils.sh
@@ -69,4 +69,12 @@ function gcloud_login {
     echo "${google_json_key_data:-}" > "${keyfile}"
     gcloud auth activate-service-account --key-file="${keyfile}"
     gcloud config set project "${google_project:-}"
+}
+
+
+function read_bucket_name {
+    # mirrors TMP_DIR in .github/scripts/gcs/Makefile
+    local gcs_tmp_dir="/tmp/storage-cli-gcs-${GITHUB_RUN_ID:-${USER}}"
+    local storage_class="${1:?storage class required}"
+    cat "${gcs_tmp_dir}/${storage_class}.lock"
 }
\ No newline at end of file
diff --git a/.github/workflows/benchmark-manual.yml b/.github/workflows/benchmark-manual.yml
new file mode 100644
index 00000000..c4043a81
--- /dev/null
+++ b/.github/workflows/benchmark-manual.yml
@@ -0,0 +1,104 @@
+name: Benchmark Manual
+
+on:
+  workflow_dispatch:
+    inputs:
+      profile:
+        description: "Benchmark profile"
+        required: true
+        type: choice
+        default: quick
+        options:
+          - quick
+          - full
+      provider:
+        description: "Storage provider"
+        required: true
+        type: choice
+        default: s3
+        options:
+          - s3
+          - gcs
+          - azurebs
+          - alioss
+    
+jobs:
+  benchmarking:
+    name: Run Benchmarking
+    runs-on: [ubuntu-latest]
+    env:
+      BENCHMARK_CONFIG_FILE: /tmp/benchmark-config.json
+    steps:
+      - name: Checkout Into Source Code
+        uses: actions/checkout@v7
+
+      - name: Set up Go    
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: go.mod
+      
+      - name: Build benchmarker
+        run: |
+              echo "Building Benchmarker."
+              GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -tags benchmark -o "benchmarker" ./benchmark/
+
+      - name: Build storage-cli
+        run: |
+              echo "Building Storage CLI."
+              GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -ldflags "-X main.version=0.0.0" -o "storage-cli" .
+
+      - name: Set up Aliyun CLI
+        if: inputs.provider == 'alioss'
+        uses: aliyun/setup-aliyun-cli-action@v1
+
+      - name: Setup The Environment
+        run: |
+              export aws_access_key_id="${{ secrets.AWS_ACCESS_KEY_ID }}"
+              export aws_secret_access_key="${{ secrets.AWS_SECRET_ACCESS_KEY }}"
+              echo "${{ secrets.GCP_SERVICE_ACCOUNT_BASE64 }}" | base64 -d > /tmp/gcp-key.json
+              export google_json_key_data="$(cat /tmp/gcp-key.json)"
+              export azure_storage_account="${{ secrets.AZURE_STORAGE_ACCOUNT }}"
+              export azure_storage_key="${{ secrets.AZURE_STORAGE_KEY }}"
+              export alioss_access_key_id="${{ secrets.ALI_ACCESS_KEY_ID }}"
+              export alioss_access_key_secret="${{ secrets.ALI_ACCESS_KEY_SECRET }}"
+              export provider="${{ inputs.provider }}"
+              export benchmark_config_file="${{ env.BENCHMARK_CONFIG_FILE }}"
+              ./.github/scripts/benchmark/setup.sh
+
+      - name: Run Benchmark
+        run: |
+              mkdir -p "${GITHUB_WORKSPACE}/benchmark-results"
+              ./benchmarker \
+                -candidate ./storage-cli \
+                -provider  "${{ inputs.provider }}" \
+                -config    "${{ env.BENCHMARK_CONFIG_FILE }}" \
+                -profile   "${{ inputs.profile }}" \
+                -output    "${GITHUB_WORKSPACE}/benchmark-results"
+
+      - name: Upload Artifacts
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: benchmark-results-${{ inputs.provider }}-${{ inputs.profile }}
+          path: ${{ github.workspace }}/benchmark-results/
+          retention-days: 90
+
+      - name: Append Summary
+        if: always()
+        run: |
+              cat "${GITHUB_WORKSPACE}/benchmark-results/summary.md" >> "${GITHUB_STEP_SUMMARY}"
+
+      - name: Teardown The Environment
+        if: always()
+        run: |
+              export aws_access_key_id="${{ secrets.AWS_ACCESS_KEY_ID }}"
+              export aws_secret_access_key="${{ secrets.AWS_SECRET_ACCESS_KEY }}"
+              echo "${{ secrets.GCP_SERVICE_ACCOUNT_BASE64 }}" | base64 -d > /tmp/gcp-key.json
+              export google_json_key_data="$(cat /tmp/gcp-key.json)"
+              export azure_storage_account="${{ secrets.AZURE_STORAGE_ACCOUNT }}"
+              export azure_storage_key="${{ secrets.AZURE_STORAGE_KEY }}"
+              export alioss_access_key_id="${{ secrets.ALI_ACCESS_KEY_ID }}"
+              export alioss_access_key_secret="${{ secrets.ALI_ACCESS_KEY_SECRET }}"
+              export provider="${{ inputs.provider }}"
+              export benchmark_config_file="${{ env.BENCHMARK_CONFIG_FILE }}"
+              ./.github/scripts/benchmark/teardown.sh
\ No newline at end of file
diff --git a/.github/workflows/release-cron.yml b/.github/workflows/release-cron.yml
index 840a7481..b9a0c545 100644
--- a/.github/workflows/release-cron.yml
+++ b/.github/workflows/release-cron.yml
@@ -116,6 +116,8 @@ jobs:
     needs: [check, tests, integration-s3, integration-gcs, integration-azurebs, integration-alioss, integration-dav]
     if: needs.tests.result == 'success'
     runs-on: ubuntu-latest
+    outputs:
+      version_number: ${{ steps.version.outputs.VERSION_NUMBER }}
     steps:
       - name: Checkout Into Source Code
         uses: actions/checkout@v7
@@ -201,3 +203,86 @@ jobs:
           draft: false
           makeLatest: true
           generateReleaseNotes: true
+
+  benchmark:
+    name: Performance Benchmark - ${{ matrix.provider }}
+    needs: [build-and-release]
+    if: needs.build-and-release.result == 'success'
+    runs-on: ubuntu-latest
+    env:
+      BENCHMARK_CONFIG_FILE: /tmp/benchmark-config.json
+    strategy:
+      fail-fast: false
+      matrix:
+        provider: [s3, gcs, azurebs, alioss]
+    steps:
+      - name: Checkout Into Source Code
+        uses: actions/checkout@v7
+
+      - name: Set up Go
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: go.mod
+
+      - name: Set up Aliyun CLI
+        uses: aliyun/setup-aliyun-cli-action@v1
+
+      - name: Build benchmarker
+        run: |
+          GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -tags benchmark -o "benchmarker" ./benchmark/
+
+      - name: Build storage-cli
+        run: |
+          GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -ldflags "-X main.version=${{ needs.build-and-release.outputs.version_number }}" -o "storage-cli" .
+
+      - name: Setup The Environment
+        run: |
+              export aws_access_key_id="${{ secrets.AWS_ACCESS_KEY_ID }}"
+              export aws_secret_access_key="${{ secrets.AWS_SECRET_ACCESS_KEY }}"
+              echo "${{ secrets.GCP_SERVICE_ACCOUNT_BASE64 }}" | base64 -d > /tmp/gcp-key.json
+              export google_json_key_data="$(cat /tmp/gcp-key.json)"
+              export azure_storage_account="${{ secrets.AZURE_STORAGE_ACCOUNT }}"
+              export azure_storage_key="${{ secrets.AZURE_STORAGE_KEY }}"
+              export alioss_access_key_id="${{ secrets.ALI_ACCESS_KEY_ID }}"
+              export alioss_access_key_secret="${{ secrets.ALI_ACCESS_KEY_SECRET }}"
+              export provider="${{ matrix.provider }}"
+              export benchmark_config_file="${{ env.BENCHMARK_CONFIG_FILE }}"
+              ./.github/scripts/benchmark/setup.sh
+
+      - name: Run Benchmark
+        run: |
+              mkdir -p "${GITHUB_WORKSPACE}/benchmark-results"
+              ./benchmarker \
+                -candidate ./storage-cli \
+                -provider  "${{ matrix.provider }}" \
+                -config    "${BENCHMARK_CONFIG_FILE}" \
+                -profile   full \
+                -output    "${GITHUB_WORKSPACE}/benchmark-results"
+
+      - name: Upload Artifacts
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: benchmark-results-${{ matrix.provider }}-full
+          path: ${{ github.workspace }}/benchmark-results/
+          retention-days: 90
+
+      - name: Append Summary
+        if: always()
+        run: |
+              cat "${GITHUB_WORKSPACE}/benchmark-results/summary.md" >> "${GITHUB_STEP_SUMMARY}"
+
+      - name: Teardown The Environment
+        if: always()
+        run: |
+              export aws_access_key_id="${{ secrets.AWS_ACCESS_KEY_ID }}"
+              export aws_secret_access_key="${{ secrets.AWS_SECRET_ACCESS_KEY }}"
+              export azure_storage_account="${{ secrets.AZURE_STORAGE_ACCOUNT }}"
+              export azure_storage_key="${{ secrets.AZURE_STORAGE_KEY }}"
+              export alioss_access_key_id="${{ secrets.ALI_ACCESS_KEY_ID }}"
+              export alioss_access_key_secret="${{ secrets.ALI_ACCESS_KEY_SECRET }}"
+              echo "${{ secrets.GCP_SERVICE_ACCOUNT_BASE64 }}" | base64 -d > /tmp/gcp-key.json
+              export google_json_key_data="$(cat /tmp/gcp-key.json)"
+              export provider="${{ matrix.provider }}"
+              export benchmark_config_file="${{ env.BENCHMARK_CONFIG_FILE }}"
+              ./.github/scripts/benchmark/teardown.sh
diff --git a/benchmark/README.md b/benchmark/README.md
new file mode 100644
index 00000000..92dde385
--- /dev/null
+++ b/benchmark/README.md
@@ -0,0 +1,94 @@
+# Benchmarker
+Standalone benchmark harness for storage-cli. Measures wall-clock transfer performance of the CLI binary against real provider buckets.
+
+## How it works
+The harness invokes the real `storage-cli` binary as a subprocess for every `put` and `get`, measures elapsed wall-clock time, and verifies downloaded content against a SHA-256 computed before the timer starts. This exercises flags, config parsing, client construction, SDK behaviour, and exit status at exactly the CLI boundary used by Cloud Controller.
+
+Failed or timed-out samples are retained in the output and mark the run as failed; they never appear as successful timing samples.
+
+## Test Profiles
+| Profile | Object sizes | Samples | When to use |
+|---------|-------------|---------|-------------|
+| `quick` | 1 KiB, 1 MiB, 10 MiB, 128 MiB | 3 measured round trips per size | Fast sanity check on relevant changes — covers latency-dominated (1 KiB) through large-object (128 MiB) transfers without a warm-up |
+| `full`  | 1 KiB, 1 MiB, 10 MiB, 128 MiB, 1 GiB | 5 measured round trips per size | Weekly runs, pre-release validation, and investigations — the extra 1 GiB size exercises transfers well beyond provider multipart/chunk thresholds (Azure 32 MiB, GCS 100 MiB, S3 5 MiB parts) |
+
+## Usage
+```sh
+# Build the harness
+go build -tags benchmark -o benchmarker ./benchmarks
+
+# Quick run against AWS S3
+./benchmarker \
+  -candidate ./storage-cli-linux-amd64 \
+  -provider  s3 \
+  -config    /path/to/config-s3.json \
+  -profile   quick \
+  -output    ./results/s3
+
+# Full run with baseline comparison against AWS ceph
+./benchmarker \
+  -candidate ./storage-cli-linux-amd64 \
+  -baseline  ./storage-cli-1.0.12-linux-amd64 \
+  -provider  s3 \
+  -config    /path/to/config-s3.json \
+  -backend-label ceph \
+  -profile   full \
+  -timeout   20m \
+  -namespace benchmark/my-run \
+  -output    ./results/ceph
+```
+
+## Flags
+| Flag | Default | Description |
+|------|---------|-------------|
+| `-candidate` | *(required)* | Path to the CLI binary under test |
+| `-baseline` | *(none)* | Path to a previous release binary for comparison |
+| `-provider` | *(required)* | CLI storage selector: `s3`, `gcs`, `azurebs`, `alioss` |
+| `-config` | *(required)* | Path to provider JSON configuration file |
+| `-backend-label` | *(same as -provider)* | Label used in reports to identify the actual storage backend. Defaults to the provider name. Set explicitly when the backend differs, e.g. `-provider s3 -backend-label ceph` |
+| `-profile` | `quick` | `quick` or `full` |
+| `-timeout` | `10m` | Per-operation timeout applied to each put and get. Must include a unit, e.g. `30s`, `10m`, `1h` |
+| `-namespace` | `benchmark` | Top-level prefix for every object key written to the bucket, e.g. `benchmark/1731.../s3/candidate/1KiB/sample-0`. Used to group benchmark objects so bucket lifecycle rules and cleanup stay scoped away from other data in the same bucket. |
+| `-run-id` | *(timestamp)* | Unique identifier embedded in all object keys |
+| `-output` | `.` | Directory for output files |
+
+## Output Files
+| File | Contents |
+|------|----------|
+| `results.json` | Raw per-sample timings, statuses, and metadata |
+| `summary.md` | Markdown table with median latency and throughput; suitable for GitHub job summary |
+
+## Configuration Files
+Provider configuration is read from the JSON file specified by `-config`. The format is the same as the file CC passes to the CLI (provider-specific).
+Example structure (AWS S3 — exact field names match the `s3/config` package):
+
+```json
+{
+  "access_key_id": "...",
+  "secret_access_key": "...",
+  "bucket_name": "my-benchmark-bucket",
+  "region": "eu-central-1"
+}
+```
+
+## Infrastructure Requirements
+- Use a dedicated benchmark bucket or container, not a production or shared integration bucket. The harness deletes objects it creates, but lifecycle expiration should be configured as a backstop for interrupted runs.
+- The IAM/service-account used for benchmarking needs only object-level read/write/delete on the dedicated bucket; no bucket-management permissions are required.
+- Object keys are namespaced as `<namespace>/<run-id>/<provider>/<label>/<size>/<sample>`. The harness never calls `delete-recursive` against shared prefixes.
+
+## Running Unit Tests
+```sh
+go test -tags benchmark ./benchmarks/
+```
+The tests build a fake CLI binary that stores objects locally and exercise invocation, integrity verification, failure modes, cleanup isolation, and all report formats without contacting any cloud provider.
+
+## Editor Setup
+The `//go:build benchmark` tag excludes these files from normal builds, which
+means gopls will show a "no packages found" warning in your editor. Fix it by
+adding the tag to your gopls build flags in VS Code settings:
+
+```json
+"gopls": {
+    "buildFlags": ["-tags=benchmark"]
+}
+```
diff --git a/benchmark/benchmark_suite_test.go b/benchmark/benchmark_suite_test.go
new file mode 100644
index 00000000..25bea38c
--- /dev/null
+++ b/benchmark/benchmark_suite_test.go
@@ -0,0 +1,13 @@
+package main
+
+import (
+	"testing"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+)
+
+func TestBenchmarks(t *testing.T) {
+	RegisterFailHandler(Fail)
+	RunSpecs(t, "Benchmarks Suite")
+}
diff --git a/benchmark/helpers_test.go b/benchmark/helpers_test.go
new file mode 100644
index 00000000..aea57bdf
--- /dev/null
+++ b/benchmark/helpers_test.go
@@ -0,0 +1,107 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+const testOpTimeout = 30 * time.Second
+
+// testRunConfig returns a RunConfig wired for tests.
+func testRunConfig(name string, profile Profile) RunConfig {
+	return RunConfig{
+		Provider:     "s3",
+		BackendLabel: "s3",
+		Profile:      profile,
+		OpTimeout:    testOpTimeout,
+		Namespace:    "test",
+		RunID:        name,
+	}
+}
+
+type mockStore struct {
+	dir string
+}
+
+func newMockStore(dir string) *mockStore {
+	return &mockStore{dir: dir}
+}
+
+func (s *mockStore) storePath(key string) string {
+	parts := strings.Split(key, "/")
+	return filepath.Join(append([]string{s.dir}, parts...)...)
+}
+
+// runner returns a CLIRunner that stores and retrieves objects locally.
+func (s *mockStore) runner() CLIRunner {
+	return func(_ context.Context, op OperationType, key, localFile string) (time.Duration, bool, error) {
+		p := s.storePath(key)
+		switch op {
+		case Put:
+			if err := os.MkdirAll(filepath.Dir(p), 0750); err != nil {
+				return 0, false, err
+			}
+			return time.Millisecond, false, copyFile(localFile, p)
+		case Get:
+			return time.Millisecond, false, copyFile(p, localFile)
+		case Delete:
+			err := os.Remove(p)
+			if os.IsNotExist(err) {
+				return time.Millisecond, false, nil
+			}
+			return time.Millisecond, false, err
+		}
+		return time.Millisecond, false, nil
+	}
+}
+
+// failRunner returns a CLIRunner that fails for the specified operation
+// and delegates all others to the store runner.
+func failRunner(store *mockStore, failOp OperationType) CLIRunner {
+	base := store.runner()
+	return func(ctx context.Context, op OperationType, key, localFile string) (time.Duration, bool, error) {
+		if op == failOp {
+			return 0, false, fmt.Errorf("injected failure for %s", failOp)
+		}
+		return base(ctx, op, key, localFile)
+	}
+}
+
+// deleteFailRunner returns a CLIRunner that succeeds on put/get but fails on delete.
+func deleteFailRunner(store *mockStore) CLIRunner {
+	return failRunner(store, Delete)
+}
+
+// timeoutRunner returns a CLIRunner that reports a timeout for the specified
+// operation without blocking, and delegates others to the store.
+func timeoutRunner(store *mockStore, timeoutOp OperationType) CLIRunner {
+	base := store.runner()
+	return func(ctx context.Context, op OperationType, key, localFile string) (time.Duration, bool, error) {
+		if op == timeoutOp {
+			return 200 * time.Millisecond, true, fmt.Errorf("operation timed out")
+		}
+		return base(ctx, op, key, localFile)
+	}
+}
+
+func copyFile(src, dst string) error {
+	sf, err := os.Open(src)
+	if err != nil {
+		return err
+	}
+	defer sf.Close() //nolint:errcheck
+
+	df, err := os.Create(dst)
+	if err != nil {
+		return err
+	}
+	defer df.Close() //nolint:errcheck
+
+	_, err = io.Copy(df, sf)
+	return err
+}
diff --git a/benchmark/main.go b/benchmark/main.go
new file mode 100644
index 00000000..6f07c608
--- /dev/null
+++ b/benchmark/main.go
@@ -0,0 +1,84 @@
+//go:build benchmark
+
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+	"time"
+)
+
+func main() {
+	var (
+		candidate    = flag.String("candidate", "", "path to candidate binary (required)")
+		baseline     = flag.String("baseline", "", "path to baseline binary for comparison (optional)")
+		provider     = flag.String("provider", "", "storage provider: s3|gcs|azurebs|alioss (required)")
+		configPath   = flag.String("config", "", "path to provider JSON configuration file (required)")
+		backendLabel = flag.String("backend-label", "", "backend label used in reports (defaults to the provider name; set explicitly when the backend differs, e.g. -provider s3 -backend-label ceph)")
+		profileFlag  = flag.String("profile", "quick", "benchmark profile: quick|full")
+		opTimeout    = flag.Duration("timeout", 10*time.Minute, "per-operation timeout (applied to each put and get)")
+		namespace    = flag.String("namespace", "benchmark", "object key namespace prefix; scope cleanup to owned keys only")
+		outputDir    = flag.String("output", ".", "directory in which to write results.json and summary.md")
+		runID        = flag.String("run-id", "", "unique run identifier; defaults to a nanosecond timestamp")
+	)
+	flag.Parse()
+
+	if *candidate == "" || *provider == "" || *configPath == "" {
+		fmt.Fprintln(os.Stderr, "benchmark: -candidate, -provider, and -config are required")
+		flag.Usage()
+		os.Exit(1)
+	}
+
+	if *backendLabel == "" {
+		*backendLabel = *provider
+	}
+
+	p := Profile(*profileFlag)
+	if p != ProfileQuick && p != ProfileFull {
+		fmt.Fprintf(os.Stderr, "benchmark: invalid profile %q; must be quick or full\n", *profileFlag)
+		os.Exit(1)
+	}
+
+	if *runID == "" {
+		*runID = fmt.Sprintf("%d", time.Now().UnixNano())
+	}
+
+	if err := os.MkdirAll(*outputDir, 0750); err != nil {
+		fmt.Fprintf(os.Stderr, "benchmark: failed to create output directory: %v\n", err)
+		os.Exit(1)
+	}
+
+	cfg := RunConfig{
+		CandidateBinary: *candidate,
+		BaselineBinary:  *baseline,
+		Provider:        *provider,
+		BackendLabel:    *backendLabel,
+		ConfigPath:      *configPath,
+		Profile:         p,
+		OpTimeout:       *opTimeout,
+		Namespace:       *namespace,
+		RunID:           *runID,
+	}
+
+	result := RunBenchmark(cfg)
+
+	if err := WriteJSON(result, *outputDir); err != nil {
+		fmt.Fprintf(os.Stderr, "benchmark: write results.json: %v\n", err)
+		os.Exit(1)
+	}
+
+	stats := ComputeRunStats(result)
+
+	if err := WriteSummary(stats, *outputDir); err != nil {
+		fmt.Fprintf(os.Stderr, "benchmark: write summary.md: %v\n", err)
+		os.Exit(1)
+	}
+
+	if result.HasFailures {
+		fmt.Fprintln(os.Stderr, "benchmark: run completed with failures; see results.json for details")
+		os.Exit(1)
+	}
+
+	fmt.Printf("benchmark: run completed successfully; results written to %s\n", *outputDir)
+}
diff --git a/benchmark/report.go b/benchmark/report.go
new file mode 100644
index 00000000..da75b88d
--- /dev/null
+++ b/benchmark/report.go
@@ -0,0 +1,201 @@
+//go:build benchmark
+
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	texttemplate "text/template"
+	"time"
+)
+
+// Stats holds summary statistics over a set of float64 samples.
+// NoData is set when no samples are available (e.g. all failed).
+type Stats struct {
+	Count  int     `json:"count"`
+	Min    float64 `json:"min"`
+	Max    float64 `json:"max"`
+	Median float64 `json:"median"`
+	NoData bool    `json:"no_data"`
+}
+
+// SizeStats holds computed statistics for one object size within a BinaryResult.
+type SizeStats struct {
+	SizeBytes     Size   `json:"size_bytes"`
+	SizeLabel     string `json:"size_label"`
+	Put           Stats  `json:"put"`
+	Get           Stats  `json:"get"`
+	PutThroughput Stats  `json:"put_throughput"`
+	GetThroughput Stats  `json:"get_throughput"`
+	FailedCount   int    `json:"failed_count"`
+	TimeoutCount  int    `json:"timeout_count"`
+}
+
+// BinaryStats holds computed statistics for all sizes of one binary.
+type BinaryStats struct {
+	Label  string      `json:"label"`
+	SHA256 string      `json:"sha256"`
+	Sizes  []SizeStats `json:"sizes"`
+}
+
+// RunStats holds all computed statistics derived from a RunResult.
+type RunStats struct {
+	RunID         string       `json:"run_id"`
+	Profile       Profile      `json:"profile"`
+	BackendLabel  string       `json:"backend_label"`
+	Provider      string       `json:"provider"`
+	HasFailures   bool         `json:"has_failures"`
+	CleanupErrors []string     `json:"cleanup_errors,omitempty"`
+	Candidate     BinaryStats  `json:"candidate"`
+	Baseline      *BinaryStats `json:"baseline,omitempty"`
+	GeneratedAt   time.Time    `json:"generated_at"`
+}
+
+// ComputeRunStats derives RunStats from a RunResult without contacting cloud storage.
+func ComputeRunStats(r RunResult) RunStats {
+	rs := RunStats{
+		RunID:         r.RunID,
+		Profile:       r.Profile,
+		BackendLabel:  r.BackendLabel,
+		Provider:      r.Provider,
+		HasFailures:   r.HasFailures,
+		CleanupErrors: r.CleanupErrors,
+		GeneratedAt:   time.Now(),
+	}
+	rs.Candidate = computeBinaryStats(r.Candidate)
+	if r.Baseline != nil {
+		bs := computeBinaryStats(*r.Baseline)
+		rs.Baseline = &bs
+	}
+	return rs
+}
+
+func computeBinaryStats(br BinaryResult) BinaryStats {
+	bs := BinaryStats{Label: br.Label, SHA256: br.SHA256}
+	for _, sr := range br.Sizes {
+		ss := SizeStats{SizeBytes: sr.SizeBytes, SizeLabel: sr.SizeLabel}
+
+		var putDurs, putThru, getDurs, getThru []float64
+		for _, s := range sr.Samples {
+			switch s.Status {
+			case StatusFailed:
+				ss.FailedCount++
+				continue
+			case StatusTimeout:
+				ss.TimeoutCount++
+				continue
+			}
+			switch s.Operation {
+			case Put:
+				putDurs = append(putDurs, s.DurationMs)
+				putThru = append(putThru, s.ThroughputMiBs)
+			case Get:
+				getDurs = append(getDurs, s.DurationMs)
+				getThru = append(getThru, s.ThroughputMiBs)
+			}
+		}
+
+		ss.Put = computeStats(putDurs)
+		ss.PutThroughput = computeStats(putThru)
+		ss.Get = computeStats(getDurs)
+		ss.GetThroughput = computeStats(getThru)
+		bs.Sizes = append(bs.Sizes, ss)
+	}
+	return bs
+}
+
+func computeStats(values []float64) Stats {
+	if len(values) == 0 {
+		return Stats{NoData: true}
+	}
+	sorted := make([]float64, len(values))
+	copy(sorted, values)
+	sort.Float64s(sorted)
+	return Stats{
+		Count:  len(sorted),
+		Min:    sorted[0],
+		Max:    sorted[len(sorted)-1],
+		Median: medianSorted(sorted),
+	}
+}
+
+func medianSorted(sorted []float64) float64 {
+	n := len(sorted)
+	if n == 0 {
+		return 0
+	}
+	if n%2 == 0 {
+		return (sorted[n/2-1] + sorted[n/2]) / 2
+	}
+	return sorted[n/2]
+}
+
+// WriteJSON writes the raw RunResult as indented JSON to results.json in outputDir.
+func WriteJSON(r RunResult, outputDir string) error {
+	data, err := json.MarshalIndent(r, "", "  ")
+	if err != nil {
+		return err
+	}
+	return os.WriteFile(filepath.Join(outputDir, "results.json"), data, 0600)
+}
+
+var summaryTmplText = `# Benchmark Summary: {{ .BackendLabel }}
+
+Run ID: {{ .RunID }}  
+Profile: {{ .Profile }}  
+Provider: {{ .Provider }}  
+Generated: {{ formatTime .GeneratedAt }}  
+Failures: {{ .HasFailures }}  
+
+## Candidate (SHA256: {{ truncate .Candidate.SHA256 16 }})
+
+| Size | PUT median ms | PUT MiB/s | GET median ms | GET MiB/s | Samples | Failures |
+|------|--------------|-----------|--------------|-----------|---------|----------|
+{{ range .Candidate.Sizes -}}
+| {{ .SizeLabel }} | {{ fmtF .Put.Median }} | {{ fmtF .PutThroughput.Median }} | {{ fmtF .Get.Median }} | {{ fmtF .GetThroughput.Median }} | {{ .Put.Count }} | {{ add .FailedCount .TimeoutCount }} |
+{{ end }}
+{{ if .Baseline -}}
+## Baseline (SHA256: {{ truncate .Baseline.SHA256 16 }})
+
+| Size | PUT median ms | PUT MiB/s | GET median ms | GET MiB/s |
+|------|--------------|-----------|--------------|-----------|
+{{ range .Baseline.Sizes -}}
+| {{ .SizeLabel }} | {{ fmtF .Put.Median }} | {{ fmtF .PutThroughput.Median }} | {{ fmtF .Get.Median }} | {{ fmtF .GetThroughput.Median }} |
+{{ end }}
+{{ end -}}
+{{ if .CleanupErrors -}}
+## Cleanup Errors
+
+{{ range .CleanupErrors -}}
+- {{ . }}
+{{ end }}
+{{ end -}}
+`
+
+// WriteSummary writes a Markdown job summary to summary.md in outputDir.
+func WriteSummary(rs RunStats, outputDir string) error {
+	funcs := texttemplate.FuncMap{
+		"truncate": func(s string, n int) string {
+			if len(s) <= n {
+				return s
+			}
+			return s[:n] + "…"
+		},
+		"add":        func(a, b int) int { return a + b },
+		"fmtF":       func(f float64) string { return fmt.Sprintf("%.1f", f) },
+		"formatTime": func(t time.Time) string { return t.UTC().Format("2006-01-02T15:04:05Z") },
+	}
+	tmpl, err := texttemplate.New("summary").Funcs(funcs).Parse(summaryTmplText)
+	if err != nil {
+		return err
+	}
+	var buf bytes.Buffer
+	if err := tmpl.Execute(&buf, rs); err != nil {
+		return err
+	}
+	return os.WriteFile(filepath.Join(outputDir, "summary.md"), buf.Bytes(), 0600)
+}
diff --git a/benchmark/report_test.go b/benchmark/report_test.go
new file mode 100644
index 00000000..6ba53868
--- /dev/null
+++ b/benchmark/report_test.go
@@ -0,0 +1,176 @@
+package main
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"time"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+)
+
+func fixtureResult(withBaseline bool) RunResult {
+	putDurs := []float64{100, 200, 300}
+	getDurs := []float64{400, 500, 600}
+
+	makeSamples := func() []OperationSample {
+		var samples []OperationSample
+		for i, d := range putDurs {
+			samples = append(samples, OperationSample{
+				Operation:      Put,
+				SizeBytes:      KiB,
+				SampleIndex:    i,
+				Status:         StatusOK,
+				DurationMs:     d,
+				ThroughputMiBs: float64(KiB) / float64(MiB) / (d / 1000),
+			})
+		}
+		for i, d := range getDurs {
+			samples = append(samples, OperationSample{
+				Operation:      Get,
+				SizeBytes:      KiB,
+				SampleIndex:    i,
+				Status:         StatusOK,
+				DurationMs:     d,
+				ThroughputMiBs: float64(KiB) / float64(MiB) / (d / 1000),
+			})
+		}
+		return samples
+	}
+
+	r := RunResult{
+		RunID:        "test-run-1",
+		Profile:      ProfileQuick,
+		Provider:     "s3",
+		BackendLabel: "test-backend",
+		Namespace:    "test",
+		StartedAt:    time.Now(),
+		FinishedAt:   time.Now(),
+		Candidate: BinaryResult{
+			Label:  "candidate",
+			SHA256: "abcdef1234567890",
+			Sizes:  []SizeResult{{SizeBytes: KiB, SizeLabel: "1KiB", Samples: makeSamples()}},
+		},
+	}
+
+	if withBaseline {
+		var baseSamples []OperationSample
+		for i, d := range putDurs {
+			baseSamples = append(baseSamples, OperationSample{
+				Operation: Put, SizeBytes: KiB, SampleIndex: i,
+				Status: StatusOK, DurationMs: d * 0.9,
+			})
+		}
+		for i, d := range getDurs {
+			baseSamples = append(baseSamples, OperationSample{
+				Operation: Get, SizeBytes: KiB, SampleIndex: i,
+				Status: StatusOK, DurationMs: d * 0.9,
+			})
+		}
+		bl := BinaryResult{
+			Label:  "baseline",
+			SHA256: "baseline1234567890",
+			Sizes:  []SizeResult{{SizeBytes: KiB, SizeLabel: "1KiB", Samples: baseSamples}},
+		}
+		r.Baseline = &bl
+	}
+
+	return r
+}
+
+func fixtureResultWithFailure() RunResult {
+	r := fixtureResult(false)
+	r.Candidate.Sizes[0].Samples = append(r.Candidate.Sizes[0].Samples, OperationSample{
+		Operation: Put, SizeBytes: KiB, SampleIndex: 3,
+		Status: StatusFailed, Error: "injected failure",
+	})
+	r.HasFailures = true
+	return r
+}
+
+var _ = Describe("ComputeStats", func() {
+	It("computes median correctly for odd count", func() {
+		s := computeStats([]float64{300, 100, 200})
+		Expect(s.Median).To(Equal(200.0))
+		Expect(s.Min).To(Equal(100.0))
+		Expect(s.Max).To(Equal(300.0))
+		Expect(s.Count).To(Equal(3))
+	})
+
+	It("computes median correctly for even count", func() {
+		s := computeStats([]float64{100, 200, 300, 400})
+		Expect(s.Median).To(Equal(250.0))
+	})
+
+	It("returns NoData for empty input", func() {
+		s := computeStats(nil)
+		Expect(s.NoData).To(BeTrue())
+		Expect(s.Count).To(Equal(0))
+	})
+})
+
+var _ = Describe("ComputeRunStats", func() {
+	It("computes candidate medians correctly", func() {
+		rs := ComputeRunStats(fixtureResult(false))
+
+		Expect(rs.Candidate.Sizes).To(HaveLen(1))
+		ss := rs.Candidate.Sizes[0]
+		Expect(ss.Put.Median).To(Equal(200.0))  // put durations: 100,200,300
+		Expect(ss.Get.Median).To(Equal(500.0))  // get durations: 400,500,600
+		Expect(ss.FailedCount).To(Equal(0))
+	})
+
+	It("excludes failed samples from statistics", func() {
+		rs := ComputeRunStats(fixtureResultWithFailure())
+		ss := rs.Candidate.Sizes[0]
+
+		Expect(ss.Put.Median).To(Equal(200.0), "failed sample should not skew median")
+		Expect(ss.FailedCount).To(Equal(1))
+	})
+
+	It("produces nil baseline and no comparisons when no baseline was run", func() {
+		rs := ComputeRunStats(fixtureResult(false))
+		Expect(rs.Baseline).To(BeNil())
+	})
+
+	It("populates baseline stats when baseline was run", func() {
+		rs := ComputeRunStats(fixtureResult(true))
+		Expect(rs.Baseline).NotTo(BeNil())
+		Expect(rs.Baseline.Sizes).To(HaveLen(1))
+	})
+})
+
+var _ = Describe("WriteJSON", func() {
+	It("produces valid parseable JSON with correct run_id", func() {
+		outDir := GinkgoT().TempDir()
+		r := fixtureResult(false)
+
+		Expect(WriteJSON(r, outDir)).To(Succeed())
+
+		data, err := os.ReadFile(filepath.Join(outDir, "results.json"))
+		Expect(err).NotTo(HaveOccurred())
+
+		var parsed RunResult
+		Expect(json.Unmarshal(data, &parsed)).To(Succeed())
+		Expect(parsed.RunID).To(Equal(r.RunID))
+		Expect(parsed.Candidate.Sizes).To(HaveLen(1))
+	})
+})
+
+var _ = Describe("WriteSummary", func() {
+	It("contains expected sections and labels", func() {
+		outDir := GinkgoT().TempDir()
+		rs := ComputeRunStats(fixtureResult(true))
+
+		Expect(WriteSummary(rs, outDir)).To(Succeed())
+
+		data, err := os.ReadFile(filepath.Join(outDir, "summary.md"))
+		Expect(err).NotTo(HaveOccurred())
+		content := string(data)
+
+		for _, want := range []string{rs.BackendLabel, rs.RunID, "Candidate", "Baseline", "1KiB"} {
+			Expect(content).To(ContainSubstring(want))
+		}
+	})
+})
diff --git a/benchmark/runner.go b/benchmark/runner.go
new file mode 100644
index 00000000..f9796f30
--- /dev/null
+++ b/benchmark/runner.go
@@ -0,0 +1,473 @@
+//go:build benchmark
+
+package main
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"math/rand/v2"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"time"
+)
+
+// Profile selects the set of object sizes and sample counts for a run.
+type Profile string
+
+const (
+	ProfileQuick Profile = "quick"
+	ProfileFull  Profile = "full"
+)
+
+// Size represents an object size in bytes.
+type Size int64
+
+const (
+	KiB Size = 1 * 1024
+	MiB Size = 1 * 1024 * 1024
+	GiB Size = 1 * 1024 * 1024 * 1024
+)
+
+// OperationStatus records whether a timed operation succeeded.
+type OperationStatus string
+
+const (
+	StatusOK      OperationStatus = "ok"
+	StatusTimeout OperationStatus = "timeout"
+	StatusFailed  OperationStatus = "failed"
+)
+
+// OperationType identifies a storage CLI operation.
+type OperationType string
+
+const (
+	Put    OperationType = "put"
+	Get    OperationType = "get"
+	Delete OperationType = "delete"
+)
+
+// OperationSample holds timing and status for one timed put or get invocation.
+type OperationSample struct {
+	Operation      OperationType   `json:"operation"`
+	SizeBytes      Size            `json:"size_bytes"`
+	SampleIndex    int             `json:"sample_index"` // 0-based
+	Status         OperationStatus `json:"status"`
+	DurationMs     float64         `json:"duration_ms"`
+	ThroughputMiBs float64         `json:"throughput_mibs"` // 0 when status != ok
+	Error          string          `json:"error,omitempty"`
+	ObjectKey      string          `json:"object_key"`
+}
+
+// SizeResult holds all samples for one object size.
+type SizeResult struct {
+	SizeBytes Size              `json:"size_bytes"`
+	SizeLabel string            `json:"size_label"`
+	Samples   []OperationSample `json:"samples"`
+}
+
+// BinaryResult holds all size results for one binary under test.
+type BinaryResult struct {
+	Label      string       `json:"label"` // "candidate" | "baseline"
+	BinaryPath string       `json:"binary_path"`
+	SHA256     string       `json:"sha256"`
+	Sizes      []SizeResult `json:"sizes"`
+}
+
+// RunResult is the complete output of a benchmark run.
+type RunResult struct {
+	RunID         string        `json:"run_id"`
+	Profile       Profile       `json:"profile"`
+	Provider      string        `json:"provider"`
+	BackendLabel  string        `json:"backend_label"`
+	Namespace     string        `json:"namespace"`
+	StartedAt     time.Time     `json:"started_at"`
+	FinishedAt    time.Time     `json:"finished_at"`
+	Candidate     BinaryResult  `json:"candidate"`
+	Baseline      *BinaryResult `json:"baseline,omitempty"`
+	CleanupErrors []string      `json:"cleanup_errors,omitempty"`
+	HasFailures   bool          `json:"has_failures"`
+}
+
+// RunConfig holds all parameters for a benchmark run.
+type RunConfig struct {
+	CandidateBinary string
+	BaselineBinary  string // empty = no baseline
+	Provider        string
+	BackendLabel    string
+	ConfigPath      string
+	Profile         Profile
+	OpTimeout       time.Duration
+	Namespace       string
+	RunID           string
+}
+
+// CLIRunner executes one storage operation and returns timing results.
+// For Put: key is the remote object key, localFile is the source file path.
+// For Get: key is the remote object key, localFile is the destination file path.
+// For Delete: key is the remote object key, localFile is unused.
+type CLIRunner func(ctx context.Context, op OperationType, key, localFile string) (elapsed time.Duration, timedOut bool, err error)
+
+// newCLIRunner returns a CLIRunner that invokes the real storage-cli binary.
+func newCLIRunner(binaryPath, configPath, provider string) CLIRunner {
+	return func(ctx context.Context, op OperationType, key, localFile string) (time.Duration, bool, error) {
+		var args []string
+		switch op {
+		case Put:
+			args = []string{string(Put), localFile, key}
+		case Get:
+			args = []string{string(Get), key, localFile}
+		default: // Delete
+			args = []string{string(Delete), key}
+		}
+
+		cmdArgs := append([]string{"-c", configPath, "-s", provider}, args...)
+		cmd := exec.CommandContext(ctx, binaryPath, cmdArgs...)
+		start := time.Now()
+		runErr := cmd.Run()
+		elapsed := time.Since(start)
+
+		if ctx.Err() != nil {
+			return elapsed, true, fmt.Errorf("operation timed out")
+		}
+		return elapsed, false, runErr
+	}
+}
+
+// profileSizes returns object sizes for the given profile.
+func profileSizes(p Profile) []Size {
+	quick := []Size{1 * KiB, 1 * MiB, 10 * MiB, 128 * MiB}
+	if p == ProfileFull {
+		return append(quick, 1*GiB)
+	}
+	return quick
+}
+
+// profileSampleCount returns the number of measured round trips per size.
+func profileSampleCount(p Profile) int {
+	if p == ProfileFull {
+		return 5
+	}
+	return 3
+}
+
+// labelForSize returns a human-readable label for a size.
+func labelForSize(s Size) string {
+	switch {
+	case s < MiB:
+		return fmt.Sprintf("%dKiB", s/KiB)
+	case s < GiB:
+		return fmt.Sprintf("%dMiB", s/MiB)
+	default:
+		return fmt.Sprintf("%dGiB", s/GiB)
+	}
+}
+
+// fileSHA256 returns the hex-encoded SHA-256 of the file at path.
+func fileSHA256(path string) (string, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return "", err
+	}
+	defer f.Close() //nolint:errcheck
+
+	h := sha256.New()
+	if _, err := io.Copy(h, f); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(h.Sum(nil)), nil
+}
+
+// generatePayload writes n deterministic pseudo-random bytes to path.
+// Uses a fixed seed derived from the object size so the same size always
+// produces the same content, enabling reproducible round-trip integrity checks.
+func generatePayload(path string, n Size) error {
+	f, err := os.Create(path)
+	if err != nil {
+		return err
+	}
+	defer f.Close() //nolint:errcheck
+
+	rng := rand.New(rand.NewPCG(uint64(n), 0)) //nolint:gosec
+	buf := make([]byte, 32*KiB)
+	written := Size(0)
+	for written < n {
+		toWrite := Size(len(buf))
+		if n-written < toWrite {
+			toWrite = n - written
+		}
+		chunk := buf[:toWrite]
+		i := 0
+		for ; i+8 <= len(chunk); i += 8 {
+			v := rng.Uint64()
+			chunk[i] = byte(v)
+			chunk[i+1] = byte(v >> 8)
+			chunk[i+2] = byte(v >> 16)
+			chunk[i+3] = byte(v >> 24)
+			chunk[i+4] = byte(v >> 32)
+			chunk[i+5] = byte(v >> 40)
+			chunk[i+6] = byte(v >> 48)
+			chunk[i+7] = byte(v >> 56)
+		}
+		if i < len(chunk) {
+			v := rng.Uint64()
+			for ; i < len(chunk); i++ {
+				chunk[i] = byte(v)
+				v >>= 8
+			}
+		}
+		if _, err := f.Write(chunk); err != nil {
+			return err
+		}
+		written += toWrite
+	}
+	return nil
+}
+
+// objectKey returns the remote key for a specific sample, namespaced to avoid
+// collisions across runs.
+func objectKey(namespace, runID, provider, label, sizeLabel string, idx int) string {
+	return filepath.Join(namespace, runID, provider, label, sizeLabel, fmt.Sprintf("sample-%d", idx))
+}
+
+// cleanup deletes a remote key using the runner with a 30-second timeout.
+// A separate short timeout ensures a hung delete does not stall the run.
+func cleanup(runner CLIRunner, key string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	_, _, err := runner(ctx, Delete, key, "")
+	return err
+}
+
+// runBinary measures all configured sizes using the provided runner and returns
+// the result together with any cleanup errors. Cleanup errors are reported
+// separately so a slow delete does not mask the original transfer status.
+func runBinary(cfg RunConfig, runner CLIRunner, binaryPath, binarySHA, label string) (BinaryResult, []string) {
+	result := BinaryResult{
+		Label:      label,
+		BinaryPath: binaryPath,
+		SHA256:     binarySHA,
+	}
+
+	sampleCount := profileSampleCount(cfg.Profile)
+	var cleanupErrors []string
+
+	for _, sz := range profileSizes(cfg.Profile) {
+		szLabel := labelForSize(sz)
+		sr := SizeResult{SizeBytes: sz, SizeLabel: szLabel}
+
+		// Generate source payload outside the timer.
+		srcFile, err := os.CreateTemp("", "bm-src-*")
+		if err != nil {
+			sr.Samples = append(sr.Samples, failedSample(Put, sz, 0, "", fmt.Sprintf("create temp: %v", err)))
+			result.Sizes = append(result.Sizes, sr)
+			continue
+		}
+		srcFile.Close() //nolint:errcheck
+
+		if err := generatePayload(srcFile.Name(), sz); err != nil {
+			os.Remove(srcFile.Name()) //nolint:errcheck
+			sr.Samples = append(sr.Samples, failedSample(Put, sz, 0, "", fmt.Sprintf("generate payload: %v", err)))
+			result.Sizes = append(result.Sizes, sr)
+			continue
+		}
+
+		// Hash source before timing; used for round-trip integrity verification.
+		srcHash, err := fileSHA256(srcFile.Name())
+		if err != nil {
+			os.Remove(srcFile.Name()) //nolint:errcheck
+			sr.Samples = append(sr.Samples, failedSample(Put, sz, 0, "", fmt.Sprintf("hash source: %v", err)))
+			result.Sizes = append(result.Sizes, sr)
+			continue
+		}
+
+		for i := 0; i < sampleCount; i++ {
+			key := objectKey(cfg.Namespace, cfg.RunID, cfg.Provider, label, szLabel, i)
+
+			// --- Timed PUT ---
+			putCtx, putCancel := context.WithTimeout(context.Background(), cfg.OpTimeout)
+			putDur, putTimedOut, putErr := runner(putCtx, Put, key, srcFile.Name())
+			putCancel()
+
+			putSample := OperationSample{
+				Operation:   Put,
+				SizeBytes:   sz,
+				SampleIndex: i,
+				ObjectKey:   key,
+			}
+			if putTimedOut {
+				putSample.Status = StatusTimeout
+				putSample.Error = "operation timed out"
+				putSample.DurationMs = durationMs(putDur)
+			} else if putErr != nil {
+				putSample.Status = StatusFailed
+				putSample.Error = putErr.Error()
+				putSample.DurationMs = durationMs(putDur)
+			} else {
+				putSample.Status = StatusOK
+				putSample.DurationMs = durationMs(putDur)
+				putSample.ThroughputMiBs = throughputMiBs(sz, putDur)
+			}
+			sr.Samples = append(sr.Samples, putSample)
+
+			if putSample.Status != StatusOK {
+				getSample := OperationSample{
+					Operation:   Get,
+					SizeBytes:   sz,
+					SampleIndex: i,
+					ObjectKey:   key,
+					Status:      StatusFailed,
+					Error:       "skipped: preceding put did not succeed",
+				}
+				sr.Samples = append(sr.Samples, getSample)
+				if cerr := cleanup(runner, key); cerr != nil {
+					cleanupErrors = append(cleanupErrors, fmt.Sprintf("cleanup %s: %v", key, cerr))
+				}
+				continue
+			}
+
+			// --- Timed GET ---
+			dstFile, err := os.CreateTemp("", "bm-dst-*")
+			if err != nil {
+				sr.Samples = append(sr.Samples, failedSample(Get, sz, i, key, fmt.Sprintf("create download temp: %v", err)))
+				if cerr := cleanup(runner, key); cerr != nil {
+					cleanupErrors = append(cleanupErrors, fmt.Sprintf("cleanup %s: %v", key, cerr))
+				}
+				continue
+			}
+			dstFile.Close()           //nolint:errcheck
+			os.Remove(dstFile.Name()) //nolint:errcheck // runner creates the destination file itself
+
+			getCtx, getCancel := context.WithTimeout(context.Background(), cfg.OpTimeout)
+			getDur, getTimedOut, getErr := runner(getCtx, Get, key, dstFile.Name())
+			getCancel()
+
+			getSample := OperationSample{
+				Operation:   Get,
+				SizeBytes:   sz,
+				SampleIndex: i,
+				ObjectKey:   key,
+			}
+			if getTimedOut {
+				getSample.Status = StatusTimeout
+				getSample.Error = "operation timed out"
+				getSample.DurationMs = durationMs(getDur)
+			} else if getErr != nil {
+				getSample.Status = StatusFailed
+				getSample.Error = getErr.Error()
+				getSample.DurationMs = durationMs(getDur)
+			} else {
+				// Verify integrity outside the timer.
+				dstHash, hashErr := fileSHA256(dstFile.Name())
+				if hashErr != nil {
+					getSample.Status = StatusFailed
+					getSample.Error = fmt.Sprintf("hash download: %v", hashErr)
+				} else if dstHash != srcHash {
+					getSample.Status = StatusFailed
+					getSample.Error = fmt.Sprintf("integrity mismatch: got %s want %s", dstHash, srcHash)
+				} else {
+					getSample.Status = StatusOK
+					getSample.DurationMs = durationMs(getDur)
+					getSample.ThroughputMiBs = throughputMiBs(sz, getDur)
+				}
+			}
+			os.Remove(dstFile.Name()) //nolint:errcheck
+			sr.Samples = append(sr.Samples, getSample)
+
+			if cerr := cleanup(runner, key); cerr != nil {
+				cleanupErrors = append(cleanupErrors, fmt.Sprintf("cleanup %s: %v", key, cerr))
+			}
+		}
+
+		os.Remove(srcFile.Name()) //nolint:errcheck
+		result.Sizes = append(result.Sizes, sr)
+	}
+
+	return result, cleanupErrors
+}
+
+// RunBenchmark creates CLI runners for the configured binaries and measures
+// transfer performance. Transfer and cleanup failures both set HasFailures.
+func RunBenchmark(cfg RunConfig) RunResult {
+	result := RunResult{
+		RunID:        cfg.RunID,
+		Profile:      cfg.Profile,
+		Provider:     cfg.Provider,
+		BackendLabel: cfg.BackendLabel,
+		Namespace:    cfg.Namespace,
+		StartedAt:    time.Now(),
+	}
+
+	candidateSHA, err := fileSHA256(cfg.CandidateBinary)
+	if err != nil {
+		candidateSHA = fmt.Sprintf("(error: %v)", err)
+	}
+	candidate, cleanupErrs := runBinary(cfg, newCLIRunner(cfg.CandidateBinary, cfg.ConfigPath, cfg.Provider), cfg.CandidateBinary, candidateSHA, "candidate")
+	result.Candidate = candidate
+	result.CleanupErrors = append(result.CleanupErrors, cleanupErrs...)
+
+	if cfg.BaselineBinary != "" {
+		baselineSHA, err := fileSHA256(cfg.BaselineBinary)
+		if err != nil {
+			baselineSHA = fmt.Sprintf("(error: %v)", err)
+		}
+		baseline, errs := runBinary(cfg, newCLIRunner(cfg.BaselineBinary, cfg.ConfigPath, cfg.Provider), cfg.BaselineBinary, baselineSHA, "baseline")
+		result.Baseline = &baseline
+		result.CleanupErrors = append(result.CleanupErrors, errs...)
+	}
+
+	result.FinishedAt = time.Now()
+	result.HasFailures = hasAnyFailures(result)
+	return result
+}
+
+// hasAnyFailures returns true when any sample failed or timed out,
+// or when any cleanup error was recorded.
+func hasAnyFailures(r RunResult) bool {
+	for _, sz := range r.Candidate.Sizes {
+		for _, s := range sz.Samples {
+			if s.Status != StatusOK {
+				return true
+			}
+		}
+	}
+	if r.Baseline != nil {
+		for _, sz := range r.Baseline.Sizes {
+			for _, s := range sz.Samples {
+				if s.Status != StatusOK {
+					return true
+				}
+			}
+		}
+	}
+	return len(r.CleanupErrors) > 0
+}
+
+// failedSample constructs a failed OperationSample without running any CLI.
+func failedSample(op OperationType, sz Size, idx int, key, errMsg string) OperationSample {
+	return OperationSample{
+		Operation:   op,
+		SizeBytes:   sz,
+		SampleIndex: idx,
+		Status:      StatusFailed,
+		Error:       errMsg,
+		ObjectKey:   key,
+	}
+}
+
+// durationMs converts a time.Duration to milliseconds as a float64.
+func durationMs(d time.Duration) float64 {
+	return float64(d) / float64(time.Millisecond)
+}
+
+// throughputMiBs computes MiB/s for a transfer of size bytes over duration d.
+func throughputMiBs(size Size, d time.Duration) float64 {
+	seconds := float64(d) / float64(time.Second)
+	if seconds <= 0 {
+		return 0
+	}
+	return float64(size) / float64(MiB) / seconds
+}
diff --git a/benchmark/runner_test.go b/benchmark/runner_test.go
new file mode 100644
index 00000000..297fe06e
--- /dev/null
+++ b/benchmark/runner_test.go
@@ -0,0 +1,201 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+)
+
+var _ = Describe("RunBinary", func() {
+	var (
+		store *mockStore
+		cfg   RunConfig
+	)
+
+	BeforeEach(func() {
+		store = newMockStore(GinkgoT().TempDir())
+		cfg = testRunConfig(GinkgoT().Name(), ProfileQuick)
+	})
+
+	Context("quick profile", func() {
+		It("all samples succeed with correct counts", func() {
+			result, cleanupErrs := runBinary(cfg, store.runner(), "", "test-sha", "candidate")
+
+			Expect(cleanupErrs).To(BeEmpty())
+			Expect(result.Sizes).To(HaveLen(4))
+			for _, sz := range result.Sizes {
+				put, get := 0, 0
+				for _, s := range sz.Samples {
+					Expect(s.Status).To(Equal(StatusOK), "size %s op %s sample %d error: %s",
+						sz.SizeLabel, s.Operation, s.SampleIndex, s.Error)
+					Expect(s.DurationMs).To(BeNumerically(">", 0), "size %s op %s: non-positive duration", sz.SizeLabel, s.Operation)
+					switch s.Operation {
+					case Put:
+						put++
+					case Get:
+						get++
+					}
+				}
+				Expect(put).To(Equal(3), "size %s: wrong put count", sz.SizeLabel)
+				Expect(get).To(Equal(3), "size %s: wrong get count", sz.SizeLabel)
+			}
+		})
+
+		It("verifies SHA256 round-trip integrity", func() {
+			result, _ := runBinary(cfg, store.runner(), "", "test-sha", "candidate")
+
+			for _, sz := range result.Sizes {
+				for _, s := range sz.Samples {
+					if s.Operation == Get && s.Status == StatusFailed {
+						Expect(s.Error).To(Equal("skipped: preceding put did not succeed"),
+							"size %s get sample %d unexpected failure", sz.SizeLabel, s.SampleIndex)
+					}
+				}
+			}
+		})
+	})
+
+	Context("full profile", func() {
+		BeforeEach(func() {
+			cfg = testRunConfig(GinkgoT().Name(), ProfileFull)
+		})
+
+		It("has 5 samples per size across 5 sizes", func() {
+			result, _ := runBinary(cfg, store.runner(), "", "test-sha", "candidate")
+
+			Expect(result.Sizes).To(HaveLen(5))
+			for _, sz := range result.Sizes {
+				put := 0
+				for _, s := range sz.Samples {
+					if s.Operation == Put {
+						put++
+					}
+				}
+				Expect(put).To(Equal(5), "size %s: wrong put count", sz.SizeLabel)
+			}
+		})
+	})
+
+	Context("put failure", func() {
+		It("marks put and get samples as failed", func() {
+			result, _ := runBinary(cfg, failRunner(store, Put), "", "test-sha", "candidate")
+
+			for _, sz := range result.Sizes {
+				for _, s := range sz.Samples {
+					Expect(s.Status).To(Equal(StatusFailed),
+						"size %s op %s sample %d: expected failed", sz.SizeLabel, s.Operation, s.SampleIndex)
+				}
+			}
+		})
+	})
+
+	Context("get failure", func() {
+		It("marks get samples failed and put samples ok", func() {
+			result, _ := runBinary(cfg, failRunner(store, Get), "", "test-sha", "candidate")
+
+			for _, sz := range result.Sizes {
+				for _, s := range sz.Samples {
+					switch s.Operation {
+					case Put:
+						Expect(s.Status).To(Equal(StatusOK), "size %s put sample %d", sz.SizeLabel, s.SampleIndex)
+					case Get:
+						Expect(s.Status).To(Equal(StatusFailed), "size %s get sample %d", sz.SizeLabel, s.SampleIndex)
+					}
+				}
+			}
+		})
+	})
+
+	Context("delete failure", func() {
+		It("records cleanup errors without affecting transfer status", func() {
+			result, cleanupErrs := runBinary(cfg, deleteFailRunner(store), "", "test-sha", "candidate")
+
+			Expect(cleanupErrs).NotTo(BeEmpty())
+			for _, sz := range result.Sizes {
+				for _, s := range sz.Samples {
+					Expect(s.Status).To(Equal(StatusOK),
+						"size %s op %s sample %d: delete failure should not affect transfer status",
+						sz.SizeLabel, s.Operation, s.SampleIndex)
+				}
+			}
+		})
+	})
+
+	Context("timeout", func() {
+		It("marks put samples as timeout", func() {
+			result, _ := runBinary(cfg, timeoutRunner(store, Put), "", "test-sha", "candidate")
+
+			for _, sz := range result.Sizes {
+				for _, s := range sz.Samples {
+					if s.Operation == Put {
+						Expect(s.Status).To(Equal(StatusTimeout),
+							"size %s put sample %d", sz.SizeLabel, s.SampleIndex)
+					}
+				}
+			}
+		})
+	})
+
+	Context("object key namespacing", func() {
+		It("prefixes all keys with namespace and run ID", func() {
+			cfg.Namespace = "ns-test"
+			cfg.RunID = "run-abc"
+			result, _ := runBinary(cfg, store.runner(), "", "test-sha", "candidate")
+
+			prefix := filepath.Join("ns-test", "run-abc")
+			for _, sz := range result.Sizes {
+				for _, s := range sz.Samples {
+					Expect(s.ObjectKey).To(HavePrefix(prefix),
+						"object key %q missing namespace prefix", s.ObjectKey)
+				}
+			}
+		})
+	})
+
+	Context("with baseline", func() {
+		It("runs both candidate and baseline independently", func() {
+			baselineStore := newMockStore(GinkgoT().TempDir())
+
+			candidate, candErrs := runBinary(cfg, store.runner(), "", "cand-sha", "candidate")
+			baseline, baseErrs := runBinary(cfg, baselineStore.runner(), "", "base-sha", "baseline")
+
+			Expect(candErrs).To(BeEmpty())
+			Expect(baseErrs).To(BeEmpty())
+			Expect(candidate.Sizes).To(HaveLen(4))
+			Expect(baseline.Sizes).To(HaveLen(4))
+			Expect(candidate.SHA256).To(Equal("cand-sha"))
+			Expect(baseline.SHA256).To(Equal("base-sha"))
+		})
+	})
+
+	Context("output files", func() {
+		It("writes results.json, results.csv, summary.md and report.html", func() {
+			outputDir := GinkgoT().TempDir()
+
+			candidate, cleanupErrs := runBinary(cfg, store.runner(), "", "test-sha", "candidate")
+			result := RunResult{
+				RunID:         cfg.RunID,
+				Profile:       cfg.Profile,
+				Provider:      cfg.Provider,
+				BackendLabel:  cfg.BackendLabel,
+				Namespace:     cfg.Namespace,
+				Candidate:     candidate,
+				CleanupErrors: cleanupErrs,
+			}
+			result.HasFailures = hasAnyFailures(result)
+
+			Expect(WriteJSON(result, outputDir)).To(Succeed())
+
+			stats := ComputeRunStats(result)
+			Expect(WriteSummary(stats, outputDir)).To(Succeed())
+
+			for _, name := range []string{"results.json", "summary.md"} {
+				info, err := os.Stat(filepath.Join(outputDir, name))
+				Expect(err).NotTo(HaveOccurred(), "output file %s missing", name)
+				Expect(info.Size()).To(BeNumerically(">", 0), "output file %s is empty", name)
+			}
+		})
+	})
+})