docs: publish rc2 release truth

Author: rozmiarD

CHANGELOG.md

@@ -8,6 +8,13 @@ experimental and fixture classifications.
 
 ## Unreleased
 
+## 1.0.0rc2 - 2026-08-08 - independently reviewed public release candidate
+
+- Publishes `govengine==1.0.0rc2` with exact `sclite-core==2.0.1` from
+  immutable tag `v1.0.0rc2` through the confirmed GitHub OIDC workflow.
+  Reviewed source A and record child B produce byte-identical wheel and sdist;
+  clean public-index installs pass and the seven-day observation window is
+  active through `2026-08-15T11:15:02.258488Z`.
 - Adds a private complete-payload seal to compiled policy packs and requires a
   stable, detached canonical snapshot before policy evaluation, pack digesting
   or enforcement admission. Post-compilation mutation of nested condition,
@@ -24,10 +31,8 @@ experimental and fixture classifications.
   approval-expiry bounds. This is fail-closed issuance-time validation and
   does not claim continuous activation lookup or background invalidation.
 
-## 1.0.0rc2 - prepared/unpublished source candidate
-
 - Prepares the next GovEngine candidate with exact `sclite-core==2.0.1` while
-  retaining immutable published rc1 history and deferring the record-only
+  retaining immutable published rc1 history and using a separate record-only
   authentic-review child.
 - Seeds the final rc2 external-review JSON path with a fail-closed pending form
   for the authentic reviewer to complete in GitHub Web. The record-only child

CONTRIBUTING.md

@@ -1,8 +1,9 @@
 # Contributing to GovEngine
 
-GovEngine source is the prepared/unpublished `1.0.0rc2` candidate for the stable v1
-governance facade. Legacy top-level surfaces retain their documented
-compatibility/alpha posture. Contributions should preserve the package boundary:
+GovEngine source tracks the published `1.0.0rc2` candidate for the stable v1
+governance facade while its observation window is active. Legacy top-level
+surfaces retain their documented compatibility/alpha posture. Contributions
+should preserve the package boundary:
 
 ```text
 domain profile -> host runtime -> GovEngine -> SCLite

PUBLIC_STATUS.md

@@ -1,41 +1,41 @@
 # GovEngine public status
 
 GovEngine is an in-process Python governance kernel. The published
-`govengine==1.0.0rc1` package evaluates policy, approval, scope and capability
+`govengine==1.0.0rc2` package evaluates policy, approval, scope and capability
 facts for one concrete operation attempt and returns a deterministic governance
 decision. It does not execute the operation or define artifact truth.
 
 ## Current release
 
 | Item | Current truth |
 | --- | --- |
-| Current source version | `govengine==1.0.0rc2`; prepared and unpublished |
-| Published immutable artifact | `govengine==1.0.0rc1` from tag `v1.0.0rc1` |
+| Current source version | `govengine==1.0.0rc2`; published with active observation |
+| Published immutable artifact | `govengine==1.0.0rc2` from tag `v1.0.0rc2` |
 | Python | `>=3.11`; CI covers 3.11, 3.12 and 3.13 |
 | Source dependency | `sclite-core==2.0.1` |
 | Stable-candidate facade | `govengine.v1`, exactly 40 exports |
 | GovEngine-owned v1 records | 15 |
 | Conformance corpus | 33 cases: 5 valid, 28 negative |
-| Independent review | published `rc1` complete; rc2 awaits authentic review-record child |
-| RC observation | rc1 history retained; rc2 prepared record is not yet created |
+| Independent review | rc2 external re-review #4 approved with zero open P0/P1 |
+| RC observation | active through `2026-08-15T11:15:02.258488Z` |
 | Reference runtime | `rexecop==1.0.0rc1` |
 | Profile alignment | Tecrax `0.4.0rc3` source-aligned/unpublished on the rc1 train |
 
-The release was published from immutable tag `v1.0.0rc1` through the
-tag-confirmed OIDC workflow. Current `main` is the `1.0.0rc2`
-prepared/unpublished source candidate. It remains `publishable=false` until an
-authentic review-record child binds the reviewed source and artifacts; rc1
-observation evidence does not qualify it by itself.
+The release was published from immutable tag `v1.0.0rc2` through confirmed
+workflow run `31254483143`, including source-A recovery, authentic review and
+window validation, exact A/B artifact equality, provenance and PyPI OIDC.
+Current `main` contains only post-tag evidence updates. Stable promotion
+remains `publishable=false` until the active seven-day observation is completed
+and downstream RExecOp qualification against the public rc2 pair passes.
 
-The immutable PyPI long description for `1.0.0rc1` is stale: it contains the
-pre-publication README, including obsolete release-blocked and `0.16.11`
-installation wording. The wheel version, exact dependency and recorded hashes
-remain valid. The corrected description will ship with the next candidate.
+The public wheel and normalized sdist exactly match the reviewed artifacts.
+Their SHA-256 values are recorded in the rc2 external-review record and
+[PUBLISHING.md](PUBLISHING.md).
 The machine-readable current release train is
 [`docs/release-train.json`](docs/release-train.json).
 
 Source/package version: `1.0.0rc2`.
-Latest published PyPI package: `govengine==1.0.0rc1`.
+Latest published PyPI package: `govengine==1.0.0rc2`.
 
 ## Supported contract
 

PUBLISHING.md

@@ -6,25 +6,22 @@ releases. It describes the repository as it exists; release history belongs in
 
 ## Current state
 
-- Current source version: `1.0.0rc2`, prepared and unpublished.
-- Published immutable candidate: `govengine==1.0.0rc1` from `v1.0.0rc1`.
-- Source dependency: `sclite-core==2.0.1`; published rc1 remains on `2.0.0`.
-- Published `rc1` review: independently reviewed, with no open P0/P1 findings.
-- Current source review: fail-closed pending form seeded at its final path;
-  authentic reviewer completion and review-record child B remain pending.
+- Current source version: `1.0.0rc2`, published with active observation.
+- Published immutable candidate: `govengine==1.0.0rc2` from `v1.0.0rc2`.
+- Published and source dependency: `sclite-core==2.0.1`.
+- Published `rc2` external review: approved with no open P0/P1 findings.
+- Authentic review-record child B: merged and named by `v1.0.0rc2`.
 - Publication: tag-bound GitHub OIDC workflow, run
-  [29764475143](https://github.com/rozmiarD/GovEngine/actions/runs/29764475143).
-- RC observation window: active until `2026-07-27T17:39:58.058090Z`.
+  [31254483143](https://github.com/rozmiarD/GovEngine/actions/runs/31254483143).
+- RC observation window: active until `2026-08-15T11:15:02.258488Z`.
 
-Current `main` is the prepared/unpublished `1.0.0rc2` source candidate. Do not
-treat it as a public package or immutable artifact; it remains
-`publishable=false` until authentic review child B and its tag exist.
+Current `main` tracks the published `1.0.0rc2` candidate and contains normal
+post-tag evidence updates. Stable promotion remains `publishable=false` until
+the rc2 observation completes and downstream qualification remains green.
 
-The immutable PyPI long description for `1.0.0rc1` is stale because the tag was
-built from the pre-publication README. It still contains obsolete
-release-blocked and `0.16.11` installation wording. The uploaded wheel/sdist,
-dependency metadata and recorded hashes remain immutable; correct the long
-description only through the next version, never by recreating the tag.
+The immutable PyPI description comes from `PYPI_LONG_DESCRIPTION.md`. The
+uploaded wheel/sdist, dependency metadata and recorded hashes match the
+external review and workflow artifact; never recreate or move the tag.
 
 The relevant commits have different roles and must not be conflated:
 
@@ -33,6 +30,9 @@ The relevant commits have different roles and must not be conflated:
 - `0b5d483f1259aef681521a185e0cdfb19a538314` is the frozen RC-window baseline;
 - `33aefcd386351be622794e10cf5c43c8e812d6bc` is the immutable `v1.0.0rc1`
   release-tag commit;
+- `f4845c1076df848c1be2df7aa7817450472e6e11` is reviewed rc2 source A;
+- `e65ad22ec25d74bbbb4969bd614981a8ed5e47c8` is authentic record child B and
+  the immutable `v1.0.0rc2` tag target;
 - later `main` commits may change documentation or non-frozen fixes, but may not
   silently change the frozen facade, schemas, corpus, or reason registry.
 
@@ -44,14 +44,18 @@ Publish in dependency order:
 sclite-core 2.0.1     truth/contracts; published and frozen
         |
         v
-govengine 1.0.0rc2    governance; prepared/unpublished
+govengine 1.0.0rc2    governance; published RC, observation active
         |
         v
 rexecop 1.0.0rc1      reference runtime; published RC
 
 tecrax 0.4.0rc3       profile source candidate; source-aligned/unpublished
 ```
 
+Published RExecOp `1.0.0rc1` remains pinned to the rc1 dependency pair.
+Qualification against public GovEngine rc2 is the next downstream gate, not a
+claim that the published runtime already consumes rc2.
+
 Ravenclaw is a legacy/external consumer, not the next package in the current
 release train. Tecrax is source-aligned/unpublished and pins the published
 `rexecop==1.0.0rc1` runtime line; it is not itself a release authority. A
@@ -126,14 +130,14 @@ git diff --check
 ```
 
 On current post-tag `main`, `validate_release_readiness.py` intentionally
-reports `publishable=false`. The `rc2` release slice must update version,
-dependency, review and candidate records before any tag is created.
+reports stable promotion as `publishable=false` while the rc2 observation and
+downstream qualification remain incomplete.
 
 For an RC, the candidate-specific RC-window validator must pass.
 RC-window status must be `prepared` before first publication.
-The current `scripts/validate_rc_window.py` still validates immutable `rc1` evidence; the
-`rc2` release slice must retarget it to a new record before tagging. Stable
-promotion requires the new candidate record, not the completed `rc1` record.
+`scripts/validate_rc_window.py` validates both immutable rc1 history and the
+rc2 v2 record. Current rc2 must pass `--require-published`; stable promotion
+requires `--require-completed` after the full observation interval.
 
 The clean-install script is the dependency-consistency gate. Do not use
 `pip check` from a broad system interpreter as release evidence.
@@ -154,12 +158,12 @@ name, version, `sclite-core==2.0.1`, Markdown content type and publication
 description bytes. Package smoke is an explicit disposable `/tmp` check for
 both wheel and sdist; it is deliberately outside normal unit tests.
 
-## Future rc2 review child
+## Completed rc2 review child
 
-The future `v1.0.0rc2` tag must name B, a single-parent child of reviewed source
+The immutable `v1.0.0rc2` tag names B, a single-parent child of reviewed source
 A. Source A contains a valid-JSON, explicitly pending external-review form at
 `docs/security-review/rc2-external-review.json` and no rc2 window. The authentic
-reviewer edits that existing form through GitHub Web. B modifies the seeded
+reviewer edited that existing form through GitHub Web. B modifies the seeded
 external security-review JSON and adds the prepared RC-window JSON. Those must
 be the only two changed paths, as enforced by
 `validate_release_record_commit.py`. The completed external security record
@@ -169,7 +173,7 @@ and zero unresolved P0/P1 findings. The prepared window binds A and frozen-input
 hashes and cryptographically references that review record without copying its
 fields.
 
-The publish workflow rebuilds A and B, requires artifact equality before OIDC,
+The publish workflow rebuilt A and B, required artifact equality before OIDC,
 and never creates or fills authentic records itself. The seeded form is not
 approval, identity proof or publication authority and contains no confidential
 report content. `scripts/release_ab_repro_gate.sh` modifies the seeded form and
@@ -182,7 +186,7 @@ Tagging and publication require explicit operator approval. Set the intended
 version and verify that it matches `pyproject.toml`:
 
 ```bash
-VERSION=1.0.0rc1
+VERSION=1.0.0rc2
 TAG="v${VERSION}"
 test "$(git rev-parse HEAD)" = "$(git rev-parse origin/main)"
 test -z "$(git status --porcelain)"
@@ -194,8 +198,8 @@ gh workflow run publish.yml \
 gh run watch --exit-status
 ```
 
-Never recreate `v1.0.0rc1`; the commands above show the completed RC procedure.
-A later release uses its own new version and immutable tag.
+Never recreate `v1.0.0rc1` or `v1.0.0rc2`; the commands above show the completed
+rc2 procedure. A later release uses its own new version and immutable tag.
 
 ## Post-publish verification
 
@@ -204,13 +208,13 @@ automatic public-index install job. Until that workflow gains a post-publish
 gate, the following verification is mandatory and manual:
 
 ```bash
-VERSION=1.0.0rc1
+VERSION=1.0.0rc2
 python -m venv /tmp/govengine-public-release
 /tmp/govengine-public-release/bin/python -m pip install --upgrade pip
 /tmp/govengine-public-release/bin/python -m pip install \
   --index-url https://pypi.org/simple \
   --no-cache-dir \
-  "sclite-core==2.0.0" \
+  "sclite-core==2.0.1" \
   "govengine==${VERSION}"
 /tmp/govengine-public-release/bin/python -m pip check
 /tmp/govengine-public-release/bin/python -c \
@@ -236,11 +240,11 @@ move the release tag to include it.
 
 ## Stable promotion
 
-Stable `1.0.0` remains blocked on a new `1.0.0rc2` candidate containing current
-`main`. Completion of the existing `rc1` observation remains historical
-evidence but is insufficient for the post-tag changes. After `rc2` is
-published, at least seven complete days must elapse from its `published_at`
-time and all of the following must remain true:
+Stable `1.0.0` remains blocked on completion of the published `1.0.0rc2`
+candidate observation. Completion of the existing `rc1` observation remains
+historical evidence but is insufficient for the rc2 changes. At least seven
+complete days must elapse from rc2 `published_at`, and all of the following
+must remain true:
 
 - the RC record is `completed` with an aware `completed_at`;
 - frozen facade/schema/corpus/reason inputs have not drifted;

README.md

@@ -1,9 +1,9 @@
 # GovEngine
 
 [![CI: pytest](https://github.com/rozmiarD/GovEngine/actions/workflows/pytest.yml/badge.svg)](https://github.com/rozmiarD/GovEngine/actions/workflows/pytest.yml)
-[![Package: govengine 1.0.0rc1](https://img.shields.io/badge/package-govengine%201.0.0rc1-blueviolet.svg)](https://pypi.org/project/govengine/1.0.0rc1/)
+[![Package: govengine 1.0.0rc2](https://img.shields.io/badge/package-govengine%201.0.0rc2-blueviolet.svg)](https://pypi.org/project/govengine/1.0.0rc2/)
 [![Python: 3.11+](https://img.shields.io/badge/python-3.11%2B-blue.svg)](pyproject.toml)
-[![Dependency: SCLite ==2.0.0](https://img.shields.io/badge/dependency-SCLite%20%3D%3D2.0.0-informational.svg)](https://github.com/rozmiarD/SCLite)
+[![Dependency: SCLite ==2.0.1](https://img.shields.io/badge/dependency-SCLite%20%3D%3D2.0.1-informational.svg)](https://github.com/rozmiarD/SCLite)
 [![License: MIT](https://img.shields.io/badge/license-MIT-yellow.svg)](LICENSE)
 
 GovEngine is an in-process Python governance kernel designed to be integrated
@@ -17,20 +17,20 @@ bundles; those responsibilities belong to SCLite. GovEngine does not perform
 the operation, schedule jobs, manage credentials, contact targets or store
 evidence.
 
-The immutable published release-candidate package `1.0.0rc1` exposes the frozen
-candidate contract through `govengine.v1`. Current source is `1.0.0rc2`,
-prepared and unpublished; it requires an authentic review-record child before
-tagging or publication.
+The immutable published release-candidate package `1.0.0rc2` exposes the frozen
+candidate contract through `govengine.v1`. Current source is `1.0.0rc2`; the
+candidate was published from `v1.0.0rc2` after authentic external review, and
+its seven-day observation window is active through
+`2026-08-15T11:15:02.258488Z`.
 
 Current source package coordinate: `govengine==1.0.0rc2`.
 The wider package still contains explicitly classified compatibility,
 experimental and fixture surfaces.
 
-The immutable PyPI long description for `1.0.0rc1` is stale: it was built from
-the pre-publication README and still describes the old release posture and
-`0.16.11` installation path. The wheel, dependency pin and release hashes are
-unaffected. This repository README is the corrected project description; the
-next release candidate must publish it as package metadata.
+The PyPI long description is the immutable, distribution-specific
+`PYPI_LONG_DESCRIPTION.md`; repository-only release state remains in this
+README and `PUBLIC_STATUS.md`. Public wheel and sdist bytes match the reviewed
+GitHub workflow artifacts.
 
 ## Why GovEngine exists
 
@@ -155,18 +155,17 @@ SCLite owns truth and proof.
 Install the published release candidate:
 
 ```bash
-python -m pip install govengine==1.0.0rc1
+python -m pip install govengine==1.0.0rc2
 ```
 
-Use the exact pin shown above. Because `1.0.0rc1` is a pre-release, an
+Use the exact pin shown above. Because `1.0.0rc2` is a pre-release, an
 unqualified `pip install govengine` continues to select the latest stable
 `0.16.11` line.
 
 Requirements:
 
 - Python 3.11 or newer;
-- published rc1 dependency `sclite-core==2.0.0`; prepared rc2 source dependency
-  `sclite-core==2.0.1`;
+- exact published and source dependency `sclite-core==2.0.1`;
 - imports intended for 1.x compatibility should come from `govengine.v1`.
 
 ## Quick start: evaluate a typed policy
@@ -230,15 +229,15 @@ continue with the bound request and decision contracts described in
 
 | Item | Current status |
 | --- | --- |
-| Source/package version | `1.0.0rc2` prepared/unpublished |
+| Source/package version | `1.0.0rc2` published; observation active |
 | Package maturity | Public release candidate |
 | Candidate 1.x facade | `govengine.v1`, exactly 40 exports |
 | GovEngine-owned v1 records | 15 frozen records |
 | Source SCLite dependency | `sclite-core==2.0.1` |
 | Legacy root modules | Compatibility, experimental or fixture classifications |
 
-Current source/package version: `1.0.0rc2` prepared/unpublished.
-Latest public package pin: `govengine==1.0.0rc1`.
+Current source/package version: `1.0.0rc2` published with an active RC window.
+Latest public package pin: `govengine==1.0.0rc2`.
 
 The final `1.0.0` promotion state is maintained in
 [`PUBLIC_STATUS.md`](PUBLIC_STATUS.md). Exact facade and schema compatibility

SECURITY.md

@@ -5,12 +5,12 @@ framework, sandbox, execution runtime, or remote authorization authority.
 
 ## Supported versions
 
-GovEngine source is currently the prepared/unpublished `1.0.0rc2` release
-candidate. Security fixes should target `main` until the stable release line
-exists. The public `1.0.0rc1` package has passed independent contract review.
-Final `1.0.0` promotion requires rc2 authentic review and publication,
-review covering that release commit and a completed candidate observation
-window without an open P0/P1.
+GovEngine source currently tracks the published `1.0.0rc2` release candidate.
+Security fixes should target `main` until the stable release line exists. The
+public rc2 artifacts passed independent external review with zero open P0/P1
+and were published through the tag-confirmed OIDC workflow. Final `1.0.0`
+promotion requires the candidate observation window to complete without an
+open P0/P1 and the remaining downstream qualification to stay green.
 
 ## Reporting issues