diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2360f24..7893c95 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,6 +22,28 @@ a patch.
 
 ---
 
+## v0.28.0 — 2026-11-07
+
+D209, from the fourth project: in a project whose checks are attested, the forge's CI reads the record it judges.
+
+This is a minor version: a pull request whose head has no attested record, or a failed one, was green on the forge and is now red (A1, A2).
+
+**In the engine**
+
+- **An attested project's CI reads the record it judges** (D209): `nstack pr-check` under GitHub Actions fetches the remote's notes (`refs/notes/nstack/checks`) and judges the head as a workstation does — no record refused (A1), a failed or incomplete one refused (A2). The fetch carries the job's token in git's environment, masked for the runner, only towards GitHub and only under GitHub Actions; on a workstation the remote's own credential answers. A remote that cannot be read is a warning naming git's reason, never the silent `judged where nstack attest runs, not in CI` line it replaces.
+
+**In your project** — 4 files, text
+
+- **`.copier-answers.yml`**: `_commit`.
+- **`.github/workflows/pull-request.yml`** (D209): the comment on `contents: read` says it covers the attested record.
+- **`.nstack/handbook/07-governance.md`** §7, **`.nstack/handbook/RULES.md`** (D209): A1 and A2 are judged in CI too.
+
+**Migration**
+
+- **An open pull request red on `FAIL [A1] no record of the head`** after the update: run `nstack attest` on its head, push — the check reads the record again at its next run, a push or an edit of the description.
+
+---
+
 ## v0.27.0 — 2026-11-07
 
 D208, from the third project: a person named verifier of a test sheet must have a hand on the pull request.
diff --git a/README.md b/README.md
index 065e629..21e6098 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,7 @@ modules, contracts, guardrails in CI. On the Django or Rails model, one command
 the project, which then receives new versions on demand; no application stack is imposed.
 Positioning and vocabulary: [`PRODUCT.md`](PRODUCT.md) §1.
 
-> **Status: v0.27.0, published** on [PyPI](https://pypi.org/project/napkinstack/).
+> **Status: v0.28.0, published** on [PyPI](https://pypi.org/project/napkinstack/).
 > What each version changes, engine and project apart: [`CHANGELOG.md`](CHANGELOG.md).
 > What is open: [`docs/governance/workstreams.md`](docs/governance/workstreams.md).
 
@@ -69,8 +69,8 @@ To try it without installing anything, or to install it from this repository ins
 registry — always pinned to a release tag:
 
 ```bash
-uvx --from "git+https://github.com/NapkinStack/engineering-os@v0.27.0" nstack init my-project
-uv tool install "napkinstack @ git+https://github.com/NapkinStack/engineering-os@v0.27.0"
+uvx --from "git+https://github.com/NapkinStack/engineering-os@v0.28.0" nstack init my-project
+uv tool install "napkinstack @ git+https://github.com/NapkinStack/engineering-os@v0.28.0"
 ```
 
 **Two channels, one published artefact.** The registry publishes: the PyPI artefact of a
diff --git a/pyproject.toml b/pyproject.toml
index 679e9a6..72f3106 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "napkinstack"
-version = "0.27.0"
+version = "0.28.0"
 description = "Engineering framework for several teams and their agents working in one repository: modules, contracts, guardrails in CI."
 requires-python = ">=3.12"
 license = "MIT"
diff --git a/uv.lock b/uv.lock
index 92c1cd2..5c419dc 100644
--- a/uv.lock
+++ b/uv.lock
@@ -348,7 +348,7 @@ wheels = [
 
 [[package]]
 name = "napkinstack"
-version = "0.27.0"
+version = "0.28.0"
 source = { editable = "." }
 dependencies = [
     { name = "copier" },