daichunghy · daichunghy · Aug 23, 2026 · Aug 23, 2026
@@ -4,7 +4,7 @@
 
 | Version | Supported |
 |---|---|
-| `v0.1.0-beta.4` / `0.1.0-dev` | Best effort during pre-release |
+| `v0.1.0-beta.5` / `0.1.0-dev` | Best effort during pre-release |
 | Stable versions | None released yet |
 
 ## 2. Reporting a Vulnerability

@@ -2,8 +2,7 @@
 
 Thank you for using PatchGate.
 
-PatchGate is a public pre-release (`0.1.0-dev`, Action tag `v0.1.0-beta.4`, commit
-`d8c67a848a95d456707e6c580a43e4e56e6071a0`).
+PatchGate is a public pre-release (`0.1.0-dev`, Action tag `v0.1.0-beta.5`).
 Support is **best effort**. There is no SLA for consumer questions, no
 on-call, and no promise that a maintainer will debug a specific repository's
 GitHub Ruleset, branch protection, or workflow graph. PatchGate reports

@@ -98,14 +98,14 @@ readiness.
 
 | Area | Current evidence | Status and limit |
 | --- | --- | --- |
-| G0 public foundation | Public repository `https://github.com/daichunghy/patchgate`, Apache-2.0 license, Community Profile 100%, seven repository topics, Discussions, private vulnerability reporting, protected `main`, CI workflow, and successful public `main` CI runs | Foundation is present at public `main@d8c67a8`; `main` requires six CI contexts and one approving review, `0.1.0-dev` remains an unpublished package, and beta.4 is the current public Action pre-release. There is no downstream usage; maintainer-bypass merges remain recorded as maintainer decisions rather than independent-review evidence |
+| G0 public foundation | Public repository `https://github.com/daichunghy/patchgate`, Apache-2.0 license, Community Profile 100%, seven repository topics, Discussions, private vulnerability reporting, protected `main`, CI workflow, and successful public `main` CI runs | Foundation is present on public `main`; `main` requires six CI contexts and one approving review, `0.1.0-dev` remains an unpublished package, and beta.5 is the current public Action pre-release. There is no downstream usage; maintainer-bypass merges remain recorded as maintainer decisions rather than independent-review evidence |
 | G1 deterministic contract | TypeScript evaluator, schemas, receipt digests, recorded fixtures, security coverage, and deterministic tests | Locally verified; this does not prove a live GitHub integration |
 | G2 local preflight | `preflight`, `validate`, `init`, `doctor`, Git-ref loading, discovery classification, text/JSON parity, and six CLI process tests (the sixth covers the `evaluate --output` alias and its fail-closed conflict, PR #40) | Local user flow is verified; three consented usability sessions and UR acceptance evidence are still open |
 | G3 GitHub adapter | Recorded/mock authenticated snapshot flow, bounded requests, source and SHA binding, TOCTOU re-read, redaction, branch-protection and Rulesets subset contract, 25 integration tests and the latest recorded GET-only smoke for PR #9 head `5f9ccb5` | The tested head built a schema-valid live snapshot and receipt with final status `human_review_required`; missing approval/ownership/linkage evidence remains explicit; unsupported Ruleset semantics and merge-group membership remain fail-closed |
 | G4 Action | Root `action.yml`, `src/action/index.ts`, committed ncc bundle, pinned workflows, required CI/CodeQL merge-group triggers, clean-room bundle verification, idempotent check delivery including a neutral check run when the snapshot is rejected (PR #26), consumer fixture smoke and explicit non-ready merge-group handling are merged into `main` | Local consumer boundary is verified; no live external consumer E2E, production release or two consenting non-blocking shadow installations |
-| User value and release | Protocols, roadmap, public Discussions, pilot request, contribution issues, public Project #1, merged hardening work and the `v0.1.0-beta.4` pre-release with a recorded shadow-installation no-go decision exist | No completed G2 sessions, external replies or contributions, external shadow installations, enforcement pilots, production release, or `v0.1` claim |
+| User value and release | Protocols, roadmap, public Discussions, pilot request, contribution issues, public Project #1, merged hardening work and the `v0.1.0-beta.5` pre-release with a recorded shadow-installation no-go decision exist | No completed G2 sessions, external replies or contributions, external shadow installations, enforcement pilots, production release, or `v0.1` claim |
 
-The public default branch is currently `main@d8c67a8`. [PR #9](https://github.com/daichunghy/patchgate/pull/9)
+The public default branch is currently `main`; the current immutable Action commit is recorded on the beta.5 release page. [PR #9](https://github.com/daichunghy/patchgate/pull/9)
 and follow-ups #15–#21, #23, #25 and #26 were merged on 2026-08-22, and #28,
 #36 and #40 were merged on 2026-08-23, each by the repository
 administrator after temporarily lifting `enforce_admins`; the setting was
@@ -121,7 +121,7 @@ and CodeQL `32563526929` on `main@e4052f2`, earlier runs through
 [32559824706](https://github.com/daichunghy/patchgate/actions/runs/32559824706)
 on `main@c9f643e`, and the first public run
 [CI 32333914059](https://github.com/daichunghy/patchgate/actions/runs/32333914059).
-For `main@d8c67a8`, default-branch CI run
+For the current public `main`, default-branch CI run
 [32616034636](https://github.com/daichunghy/patchgate/actions/runs/32616034636)
 completed successfully while CodeQL `32616034425` was still in progress when
 this snapshot was written.
@@ -141,13 +141,13 @@ and #39 (`actions/checkout` 7) were merged on 2026-08-23 after green CI, and
 the split CodeQL 4.37.7 PRs #35/#37 were superseded by a combined init+analyze
 bump; the `create-check-run` default flip also shipped in that PR. Every merge
 used the recorded admin-bypass pattern and is a maintainer decision. The pre-release
-[`v0.1.0-beta.4`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.4)
-is pinned to `main@d8c67a8` after a live maintainer smoke
+[`v0.1.0-beta.5`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.5)
+is the current public beta after a live maintainer smoke
 ([daichunghy/patchgate-beta-smoke](https://github.com/daichunghy/patchgate-beta-smoke))
 found and fixed a critical Action input-parsing bug that made `v0.1.0-beta.1`
 unusable on real runners
 ([findings](docs/reviews/2026-08-22-live-smoke-findings.md),
-[release record](docs/releases/2026-08-23-beta.4.md)); it is beta
+[release record](docs/releases/2026-08-23-beta.5.md)); it is beta
 shadow-evidence scope only — not production, adoption or a `v0.1` claim.
 
 The current milestone audit is [the 2026-08-20 G4/G0 continuation audit](docs/reviews/2026-08-20-g4-g0-audit.md). The newest records are the [2026-08-22 multi-persona review round](docs/reviews/2026-08-22-multi-persona-review.md), the [2026-08-22 live consumer smoke findings](docs/reviews/2026-08-22-live-smoke-findings.md) and the [2026-08-22 Mimosa static-advisory adjudication](docs/reviews/2026-08-22-mimosa-static-advisory-adjudication.md) — re-run the sealed scan after any change to `src/github/client.ts` transport handling. The latest verification command to rerun after a change is:
@@ -212,14 +212,14 @@ produced by the adapter — not a raw GitHub event payload.
 Current allowed Action form (shadow only):
 
 ```yaml
-- uses: daichunghy/patchgate@d8c67a848a95d456707e6c580a43e4e56e6071a0
+- uses: daichunghy/patchgate@v0.1.0-beta.5
   with:
     fail-on: never
     create-check-run: true
 ```
 
 `fail-on: blocked` is the enforcement form intended for the first stable
-release, not for this pre-release. Pin the beta.4 full SHA above; older beta
+release, not for this pre-release. Pin the beta.5 immutable release commit; older beta
 tags are superseded.
 
 The first supported rule classes are:

@@ -18,8 +18,8 @@ it cannot force external automation to stop working.
 
 **Status:** public pre-release. The npm package remains unpublished (`private: true`,
 `0.1.0-dev`). The current Action release is
-[`v0.1.0-beta.4`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.4),
-and consumers should pin commit `d8c67a848a95d456707e6c580a43e4e56e6071a0` for
+[`v0.1.0-beta.5`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.5),
+and consumers should pin the immutable commit shown on that release page for
 **shadow** evaluation only. This is not production, not a `v0.1` claim, and
 not evidence of external pilots or adoption.
 
@@ -64,8 +64,8 @@ Longer walkthrough: [Getting started](docs/getting-started.md).
 ## GitHub Action candidate
 
 The Action is bundled for the repository's local shadow workflow. The tagged
-pre-release [`v0.1.0-beta.4`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.4)
-is the current release; pin commit `d8c67a848a95d456707e6c580a43e4e56e6071a0`
+pre-release [`v0.1.0-beta.5`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.5)
+is the current release; pin its immutable commit SHA
 for shadow evaluation.
 Production consumers must still wait for a stable public release. Do not use
 the placeholder `patchgate/patchgate@v0.1.0-dev` as an installable public
@@ -209,7 +209,7 @@ The repository maintains a clean root directory structure (9 files max) with mod
 - [Project constitution](docs/PROJECT_CONSTITUTION.md)
 - [Example policy](docs/patchgate.example.yml)
 - [Action usage guide](docs/github-action-usage.md)
-- [v0.1.0-beta.4 release record](docs/releases/2026-08-23-beta.4.md)
+- [v0.1.0-beta.5 release record](docs/releases/2026-08-23-beta.5.md)
 - [Contributing](.github/CONTRIBUTING.md)
 - [Security policy](.github/SECURITY.md)
 - [Code of conduct](.github/CODE_OF_CONDUCT.md)

@@ -2,6 +2,10 @@
 
 All notable changes to PatchGate will be documented in this file.
 
+### Beta release — 2026-08-23 (`v0.1.0-beta.5`)
+- Published the current documentation-synchronized beta from the public default branch.
+- The Action behavior is unchanged from beta.4; consumers should pin the immutable release commit and keep shadow mode enabled.
+
 ### Beta release — 2026-08-23 (`v0.1.0-beta.4`)
 - Released [`v0.1.0-beta.4`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.4), pinned to `d8c67a848a95d456707e6c580a43e4e56e6071a0`.
 - Updated the consumer Action reference, default Check Run behavior, CLI `--output` alias, and full-SHA workflow pins.

@@ -1,10 +1,10 @@
 # Getting started
 
 PatchGate is a public pre-release. The npm package is unpublished
-(`private: true`, `0.1.0-dev`). The current Action release is `v0.1.0-beta.4`,
+(`private: true`, `0.1.0-dev`). The current Action release is `v0.1.0-beta.5`,
 which is for shadow evaluation only — not production, not a `v0.1` claim, and
 not evidence of external pilots. Pin commit
-`d8c67a848a95d456707e6c580a43e4e56e6071a0`.
+the immutable commit SHA shown on its release page.
 
 This walkthrough uses a clone and a local build. Do not run `npx patchgate`:
 that npm name is a different project. The direct GitHub install is available

@@ -15,9 +15,9 @@ after the documented gates have been reviewed.
 In **Shadow Mode**, PatchGate observes only (`fail-on: never`). It evaluates
 the PR, writes the `ContributionReceipt`, and can post a Check Run without
 blocking merge. Pin
-[`v0.1.0-beta.4`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.4)
+[`v0.1.0-beta.5`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.5)
 for this pre-release and pin commit
-`d8c67a848a95d456707e6c580a43e4e56e6071a0`. This is not production and not a
+the immutable commit SHA shown on that release page. This is not production and not a
 `v0.1` claim.
 
 The Action reads GitHub metadata through the API. Do **not** check out
@@ -58,9 +58,9 @@ jobs:
       # branch-protection snapshots fail closed (correct). A PAT/App token
       # with administration:read is required for a complete native-control
       # snapshot. beta.2 posts a Check Run for successful evaluations;
-      # snapshot-rejection Check Runs are included in beta.4.
+      # snapshot-rejection Check Runs are included in beta.5.
       - name: Run PatchGate Shadow Gate
-        uses: daichunghy/patchgate@d8c67a848a95d456707e6c580a43e4e56e6071a0
+        uses: daichunghy/patchgate@v0.1.0-beta.5
         with:
           fail-on: never
           create-check-run: true
@@ -76,7 +76,7 @@ workflow. It is still not production or a `v0.1` claim.
 
 ```yaml
       - name: Run PatchGate Enforcing Gate
-        uses: daichunghy/patchgate@d8c67a848a95d456707e6c580a43e4e56e6071a0
+        uses: daichunghy/patchgate@v0.1.0-beta.5
         with:
           fail-on: blocked
           create-check-run: true

@@ -0,0 +1,12 @@
+# PatchGate `v0.1.0-beta.5`
+
+**Release date:** 23 August 2026  
+**Tag:** [`v0.1.0-beta.5`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.5)
+
+Beta.5 is the current documentation-synchronized public Action pre-release.
+It carries the beta.4 Action behavior and makes the public README, usage guide,
+support/security pages, and release record point to one current release tag.
+
+Pin the immutable commit shown on the release page and keep `fail-on: never`.
+This remains shadow-only: it is not a production release, Marketplace listing,
+stable `v0.1` claim, or external adoption evidence.
@@ -20,7 +20,7 @@ Before publishing a beta, the maintainer must have independently recorded:
   no-go decision;
 - support, security-reporting, compatibility and unsupported-behavior wording.
 
-The current repository has public pre-release `v0.1.0-beta.4` and a private
+The current repository has public pre-release `v0.1.0-beta.5` and a private
 development package. The two external shadow installations and production
 gates remain open.