Release candidate: Agnir v1.0.2 locator-only bootstrap

.agnir/evidence/2026-09-18-v1.0.2-publication-candidate.md

@@ -0,0 +1,65 @@
+# Agnir v1.0.2 publication candidate
+
+Date: 2026-09-18
+
+## Authorization
+
+The Principal explicitly authorized: **publish `v1.0.2`**.
+
+## Scope
+
+`1.0.2` is a PATCH-only distribution/onboarding release for the already accepted ChatGPT Project locator simplification.
+
+Accepted persistent handoff:
+
+```text
+Canonical Project: <owner/repository> (<ref>)
+At the first substantive turn of every new conversation, open it, read root AGENTS.md, and follow it before doing Project work.
+```
+
+The release does not change Core `1.0`, `repository-filesystem/1.0`, Project identity, Continuity Lineage, checkpoint semantics, or historical compatibility lines.
+
+## Accepted implementation input
+
+- implementation PR: `#58`;
+- implementation merge: `2c62d026c48405c3e299f0f57d6a674b3f6f9e1c`;
+- implementation post-merge conformance: `35353464865` — success;
+- Principal acceptance/checkpoint merge: `4fde39128e5edf3fba3d7906a279918b1c38b7c2`;
+- acceptance post-merge conformance: `35353700740` — success;
+- acceptance repository job: `105627739027` — success.
+
+## Candidate packaging
+
+Staging ref: `release/v1.0.2`.
+
+The candidate changes:
+
+- repository `VERSION` to `1.0.2` while keeping Core/profile `1.0`;
+- records `1.0.2` candidate metadata while `latest_stable` remains `v1.0.1` pre-publication;
+- defines the `1.0.2` locator-only upgrade behavior in `SKILL.md`;
+- extends 1.0.x self-host/stable package conformance to `1.0.2`;
+- adds a publication job that can run only on authoritative `main` when the head commit message is exactly `release: publish v1.0.2 stable`;
+- requires the publication job to verify immutable `v1.0.1`, `v1.0.0`, and accepted `v1.0.0-rc.1` tag receipts before and after creating `v1.0.2`.
+
+## Publication boundary
+
+Candidate implementation or merge does not publish. Publication is accepted only after:
+
+1. candidate conformance succeeds;
+2. authoritative-main reconciliation and post-merge conformance succeed;
+3. the exact publication-arm commit triggers the `v1.0.2` publication job;
+4. `refs/tags/v1.0.2` resolves to the exact arm commit;
+5. the GitHub Release is non-draft/non-prerelease;
+6. `releases/latest == v1.0.2`;
+7. `v1.0.1`, `v1.0.0`, and `v1.0.0-rc.1` remain unchanged.
+
+## Pre-checkpoint candidate receipts
+
+- exact candidate head before this Evidence reconciliation: `907479d79921a8733052adb3384a58270a79bee1`;
+- workflow: `35354730577` — success;
+- repository job: `105631181979` — success;
+- stable package gates: success;
+- full conformance suite: success;
+- publication jobs: skipped, as required on the staging branch.
+
+This Evidence update becomes the final staging checkpoint and therefore advances the branch once more. The resulting checkpointed head requires one final branch conformance run before PR merge.

.agnir/next-actions.md

@@ -1,16 +1,17 @@
 # Agnir Next Actions
 
-Agnir `v1.0.1` is published and verified as the latest stable repository/distribution release. Core/profile remain `1.0` / `repository-filesystem/1.0`.
-
-1. **Operate the 1.0 line in stable-maintenance mode.** Preserve Core/profile 1.0 semantics and historical 0.1/0.2 compatibility/migration surfaces. Future patch releases must not silently expand or redefine the stable contract.
-2. **Observe the accepted locator-only handoff in the next genuine fresh ChatGPT Project initialization.** The packaging contract is accepted and conformance-protected. Treat a future verbose handoff as a regression; do not solve it by duplicating Agnir operational semantics back into Project Instructions.
-3. **Optionally repair the v1.0.1 GitHub Release-body wording.** One cosmetic sentence omitted the literal `AGNIR.md` because of shell command substitution in an unquoted heredoc. Any repair must update host metadata only; do not move/recreate `v1.0.1` or change release identity.
-4. **Complete human visual review of the refined Install-section two-session preview.** PR `#55` is published. Confirm the live install area now reads unmistakably as two different Agent sessions: Session A above, Fresh Session B below, with the “open a fresh session” divider, consistent four-point Agent icon, clean desktop/mobile balance, and usable dark/light plus English / Simplified Chinese / Japanese / Korean presentation. Also confirm the hero comparison caption now reads **“两个新会话都只收到一句：‘继续。’ 但大有不同。”** in Simplified Chinese. This is public-surface polish, not a Core or adoption gate.
-5. **Recruit the first external design users and collect material adoption evidence.** The synchronized split-screen fresh-session demo v3 has passed Principal human visual review and is the primary first-contact proof surface. Prioritize genuine external cold-start resumes, second-session value, cross-Executor cases, new execution surfaces, repeat use, and independently built integrations.
-6. **Keep brand/public-surface truth locked.** README, website, adoption/demo and social materials may consume approved brand assets/deterministic derivatives but must not reinterpret approved identity or Core semantics.
-7. **Keep merged-head cleanup enabled.** `main` remains the sole intended long-lived authoritative branch; completed staging branches should remain retired after their material result and evidence are durably represented.
-8. **Shift active product execution back to Svif where appropriate.** Svif owns its own canonical continuity and ChatGPT/Plugins publication path; do not smuggle Svif changes into Agnir maintenance.
-9. **Keep FishUp production publication separate.** No FishUp main advancement without separate authorization.
+Agnir `v1.0.1` remains the published latest stable release while repository source `1.0.2` is staged as an explicitly authorized PATCH publication candidate. Core/profile remain `1.0` / `repository-filesystem/1.0`.
+
+1. **Complete and publish the v1.0.2 candidate.** Require green candidate conformance, merge/reconcile onto authoritative `main`, require green post-merge conformance, then create an exact empty publication-arm commit `release: publish v1.0.2 stable`. Accept publication only after tag/Release/latest readback and immutable earlier-tag checks pass.
+2. **After successful publication, reconcile stable metadata.** Update `AGNIR.yaml`, RELEASE/versioning/README surfaces, State/Next Actions, and publication Evidence so `v1.0.2` becomes the recorded latest stable while the immutable release tag continues to point to the exact publication-arm revision.
+3. **Observe the accepted locator-only handoff in the next genuine fresh ChatGPT Project initialization.** Treat a future verbose handoff as a packaging regression; do not solve it by duplicating Agnir operational semantics back into Project Instructions.
+4. **Optionally repair the v1.0.1 GitHub Release-body wording.** One historical cosmetic sentence omitted the literal `AGNIR.md`; any repair must update host metadata only and must not move/recreate `v1.0.1`.
+5. **Complete human visual review of the refined Install-section two-session preview.** PR `#55` is published. Confirm the live install area now reads unmistakably as two different Agent sessions: Session A above, Fresh Session B below, with the “open a fresh session” divider, consistent four-point Agent icon, clean desktop/mobile balance, and usable dark/light plus English / Simplified Chinese / Japanese / Korean presentation. Also confirm the hero comparison caption now reads **“两个新会话都只收到一句：‘继续。’ 但大有不同。”** in Simplified Chinese. This is public-surface polish, not a Core or adoption gate.
+6. **Recruit the first external design users and collect material adoption evidence.** The synchronized split-screen fresh-session demo v3 has passed Principal human visual review and is the primary first-contact proof surface. Prioritize genuine external cold-start resumes, second-session value, cross-Executor cases, new execution surfaces, repeat use, and independently built integrations.
+7. **Keep brand/public-surface truth locked.** README, website, adoption/demo and social materials may consume approved brand assets/deterministic derivatives but must not reinterpret approved identity or Core semantics.
+8. **Keep merged-head cleanup enabled.** `main` remains the sole intended long-lived authoritative branch; completed staging branches should remain retired after their material result and evidence are durably represented.
+9. **Shift active product execution back to Svif where appropriate.** Svif owns its own canonical continuity and ChatGPT/Plugins publication path; do not smuggle Svif changes into Agnir maintenance.
+10. **Keep FishUp production publication separate.** No FishUp main advancement without separate authorization.
 
 ## Install preview split-session refinement receipts
 

.agnir/state.md

@@ -42,6 +42,21 @@ The GitHub Release body has one cosmetic omission: the intended literal `` `AGNI
 
 This is a repository-host presentation defect, not a package-integrity or protocol defect. It must not be repaired by moving/recreating the published tag. A future authorized metadata repair may update only the Release body while preserving release identity.
 
+## v1.0.2 publication candidate
+
+On 2026-09-18, the Principal explicitly authorized **publish `v1.0.2`** after accepting the locator-only ChatGPT Project bootstrap contract.
+
+The release scope is intentionally PATCH-only:
+
+- publish the already accepted two-line ChatGPT Project locator handoff;
+- keep Project continuity behind `AGENTS.md -> AGNIR.md -> AGNIR.yaml -> selected durable continuity`;
+- add exact `v1.0.2` release packaging, conformance, and an authoritative-main publication gate;
+- preserve Core `1.0`, `repository-filesystem/1.0`, Project identity, Continuity Lineage, checkpoint semantics, and historical `0.1`/`0.2` compatibility.
+
+Candidate staging branch: `release/v1.0.2`. Repository source version is `1.0.2`; **latest stable remains `v1.0.1` until publication actually succeeds**. Publication is allowed only through an exact `main` commit message `release: publish v1.0.2 stable`, after candidate and authoritative-main conformance are green.
+
+Accepted implementation inputs are PR `#58` / merge `2c62d026c48405c3e299f0f57d6a674b3f6f9e1c` and acceptance checkpoint `4fde39128e5edf3fba3d7906a279918b1c38b7c2`, with authoritative conformance run `35353700740` success.
+
 ## Public product state
 
 The Principal-approved Agnir brand identity remains canonical under `brand/`. The bilingual README/website, scoped GitHub Pages publication, transparent render-self-contained brand surfaces, Apache-2.0 licensing, bilingual contribution guidance, repository topics/homepage, and GitHub Issues feedback intake remain accepted public surfaces on authoritative `main`.

.github/workflows/conformance.yml

@@ -27,7 +27,7 @@ jobs:
             0.2.0|0.2.0-rc.1)
               python conformance/check_agnir_0_2.py
               ;;
-            1.0.1|1.0.0|1.0.0-rc.1)
+            1.0.2|1.0.1|1.0.0|1.0.0-rc.1)
               python conformance/check_agnir_1_0.py
               ;;
             *)
@@ -70,14 +70,120 @@ jobs:
           github.ref == 'refs/heads/release/v0.2.0' ||
           github.ref == 'refs/heads/release/v1.0.0' ||
           github.ref == 'refs/heads/release/v1.0.1' ||
+          github.ref == 'refs/heads/release/v1.0.2' ||
           github.base_ref == 'main' ||
           github.head_ref == 'release/v0.2.0' ||
           github.head_ref == 'release/v1.0.0' ||
-          github.head_ref == 'release/v1.0.1'
+          github.head_ref == 'release/v1.0.1' ||
+          github.head_ref == 'release/v1.0.2'
         run: python -m unittest discover -s conformance -p 'test_stable_release_gates.py' -v
       - name: Full conformance suite
         run: python -m unittest discover -s conformance -p 'test_*.py' -v
 
+  publish-v1-0-2:
+    name: Publish v1.0.2 stable release
+    needs: repository-filesystem
+    if: >-
+      github.event_name == 'push' &&
+      github.ref == 'refs/heads/main' &&
+      github.event.head_commit.message == 'release: publish v1.0.2 stable'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install conformance dependencies
+        run: python -m pip install --disable-pip-version-check -r conformance/requirements.txt
+      - name: Verify exact v1.0.2 publication candidate
+        run: |
+          set -euo pipefail
+          test "$(cat VERSION)" = "1.0.2"
+          test "$(git rev-parse HEAD)" = "${GITHUB_SHA}"
+          grep -q 'version: "1.0"' AGNIR.yaml
+          grep -q 'discovery_profile: "repository-filesystem/1.0"' AGNIR.yaml
+          grep -q 'repository_version: "1.0.2"' AGNIR.yaml
+          grep -q 'lineage: "urn:agnir:lineage:authoritative"' AGNIR.yaml
+          grep -q 'selector: "refs/heads/main"' AGNIR.yaml
+          grep -q 'Before doing Project work in this repository, read and follow `AGNIR.md`' AGENTS.md
+          grep -q '# Agnir Project Instructions' AGNIR.md
+          grep -q 'locator-only and intentionally small' SKILL.md
+          grep -q 'Canonical Project: <owner/repository> (<ref>)' SKILL.md
+          grep -q 'read root AGENTS.md, and follow it before doing Project work' SKILL.md
+          python conformance/check_agnir_1_0.py
+          python -m unittest discover -s conformance -p 'test_*.py' -v
+      - name: Create immutable v1.0.2 tag and release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          tag="v1.0.2"
+          previous_tag="v1.0.1"
+          previous_sha="f56d25b22997c259c660651e7357334b063093e1"
+          v1_tag="v1.0.0"
+          v1_sha="6d16dcfd17b8e9f22fd25804e22b9f8a516d06c3"
+          accepted_rc="v1.0.0-rc.1"
+          accepted_rc_sha="092945289f1a0a9803e4fe0583104aa380ceaadc"
+          repo="${GITHUB_REPOSITORY}"
+
+          test "$(gh api "repos/${repo}/git/ref/tags/${previous_tag}" --jq '.object.sha')" = "${previous_sha}"
+          test "$(gh api "repos/${repo}/git/ref/tags/${v1_tag}" --jq '.object.sha')" = "${v1_sha}"
+          test "$(gh api "repos/${repo}/git/ref/tags/${accepted_rc}" --jq '.object.sha')" = "${accepted_rc_sha}"
+
+          if tag_json=$(gh api "repos/${repo}/git/ref/tags/${tag}" 2>/dev/null); then
+            test "$(printf '%s' "${tag_json}" | jq -r '.object.sha')" = "${GITHUB_SHA}"
+          else
+            gh api --method POST "repos/${repo}/git/refs" \
+              -f ref="refs/tags/${tag}" \
+              -f sha="${GITHUB_SHA}" >/dev/null
+          fi
+
+          body=$(cat <<EOF
+          Agnir v1.0.2 stable patch release.
+
+          Exact authoritative candidate: ${GITHUB_SHA}
+          Conformance workflow: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}
+          Core: 1.0 (unchanged)
+          Profile: repository-filesystem/1.0 (unchanged)
+
+          This patch makes ChatGPT Project bootstrap configuration locator-only: canonical Project/ref plus a fresh-context locator to root AGENTS.md. Project-owned discovery, continuity authority, checkpoint, and repository-operation semantics remain behind the repository activation path.
+          EOF
+          )
+
+          if release_json=$(gh api "repos/${repo}/releases/tags/${tag}" 2>/dev/null); then
+            test "$(printf '%s' "${release_json}" | jq -r '.tag_name')" = "${tag}"
+            test "$(printf '%s' "${release_json}" | jq -r '.prerelease')" = "false"
+            test "$(printf '%s' "${release_json}" | jq -r '.draft')" = "false"
+          else
+            gh api --method POST "repos/${repo}/releases" \
+              -f tag_name="${tag}" \
+              -f target_commitish="${GITHUB_SHA}" \
+              -f name="Agnir ${tag}" \
+              -f body="${body}" \
+              -F draft=false \
+              -F prerelease=false >/dev/null
+          fi
+
+          tag_sha=$(gh api "repos/${repo}/git/ref/tags/${tag}" --jq '.object.sha')
+          prerelease=$(gh api "repos/${repo}/releases/tags/${tag}" --jq '.prerelease')
+          draft=$(gh api "repos/${repo}/releases/tags/${tag}" --jq '.draft')
+          latest=$(gh api "repos/${repo}/releases/latest" --jq '.tag_name')
+          previous_sha_after=$(gh api "repos/${repo}/git/ref/tags/${previous_tag}" --jq '.object.sha')
+          v1_sha_after=$(gh api "repos/${repo}/git/ref/tags/${v1_tag}" --jq '.object.sha')
+          accepted_rc_after=$(gh api "repos/${repo}/git/ref/tags/${accepted_rc}" --jq '.object.sha')
+          test "${tag_sha}" = "${GITHUB_SHA}"
+          test "${prerelease}" = "false"
+          test "${draft}" = "false"
+          test "${latest}" = "${tag}"
+          test "${previous_sha_after}" = "${previous_sha}"
+          test "${v1_sha_after}" = "${v1_sha}"
+          test "${accepted_rc_after}" = "${accepted_rc_sha}"
+          echo "PASS: ${tag} -> ${tag_sha}; latest=${latest}; v1.0.1=${previous_sha_after}; v1.0.0=${v1_sha_after}; accepted-rc=${accepted_rc_after}"
+
   publish-v1-0-1:
     name: Publish v1.0.1 stable release
     needs: repository-filesystem

AGNIR.yaml

@@ -30,8 +30,8 @@ extensions:
       kind: "vcs-ref"
       selector: "refs/heads/main"
   agnir/release:
-    phase: "stable-v1.0.1-published"
-    repository_version: "1.0.1"
+    phase: "stable-v1.0.2-implemented-publication-pending"
+    repository_version: "1.0.2"
     core_contract: "spec/AGNIR_CORE_1_0.md"
     profile_contract: "profiles/REPOSITORY_FILESYSTEM_1_0.md"
     promotion_contract: "spec/CORE_0_2_TO_1_0_PROMOTION.md"
@@ -65,7 +65,14 @@ extensions:
     accepted_rc_acceptance_checkpoint: "afc07d062b957e8dbfe3f859834c787e64aa52be"
     previous_latest_stable: "v1.0.0"
     latest_stable: "v1.0.1"
-    publication_status: "published-verified"
+    candidate_scope: "chatgpt-project-locator-only"
+    candidate_implementation_pr: 58
+    candidate_implementation_revision: "2c62d026c48405c3e299f0f57d6a674b3f6f9e1c"
+    candidate_implementation_verification_run: 35353464865
+    candidate_acceptance_checkpoint: "4fde39128e5edf3fba3d7906a279918b1c38b7c2"
+    candidate_acceptance_verification_run: 35353700740
+    candidate_acceptance_verification_job: 105627739027
+    publication_status: "v1.0.1-published-v1.0.2-candidate"
     target_ref: "refs/heads/main"
   agnir/operations:
     distribution: "agnir-agent-skill"