Publish the audited v0.2.0 crate and GitHub release from one immutable commit

[plx]

Parent

#26

Purpose

This is the only ticket in the remediation program that authorizes the first formal post-audit publication. It converts an independently audited candidate into the crates.io 0.2.0 release and matching immutable GitHub Release. It must be a mechanical execution of the reviewed release process, not an opportunity for last-minute code or documentation fixes.

Hard gate

Do not publish unless #72 is closed with an unconditional PASS for the exact candidate commit and all blocking dependencies remain satisfied. A new commit after audit evidence was recorded invalidates the affected evidence and requires audit rerun/reapproval.

Required procedure

1. Identify the exact audited commit and verify a clean checkout, signed/approved release authorization, version 0.2.0, changelog, license clarification, package allowlist, MSRV, and SemVer baseline.
2. Re-run the fail-closed preflight from Build a fail-closed release pipeline with trusted publishing and traceable artifacts #63 using the exact commit and protected environment. Require all protected checks; do not use a manual bypass to compensate for failure.
3. Build/package artifacts once according to the release design. Record source commit, toolchain, package checksum, archive checksums, SBOM/provenance/signature metadata, and workflow run.
4. Publish the crate through the scoped Trusted Publisher (or the explicitly approved minimal fallback) and verify crates.io metadata, owners, README/docs links, license, dependencies, and downloadable package contents.
5. Create the protected v0.2.0 tag and GitHub Release from the same commit using the reviewed release notes. Attach only the audited artifacts and checksum/provenance material.
6. From clean environments on every supported OS, install from crates.io and from the released binary artifact where offered; run --version, help, quickstart generation, valid check, invalid check, recursive zero-guide failure, and representative symlink/containment smoke cases.
7. Verify documentation links and installation commands against the live release. Record non-sensitive evidence and artifact hashes in the release issue/report.
8. Monitor the workflow and distribution pages through completion. If any invariant fails, stop; do not quietly rebuild under the same tag/version. Document the incident and follow the version/yank policy.

Validation that must be recorded

• Candidate commit equals audited commit, tag target, provenance subject, and GitHub Release source.
• cargo info/crates.io API and installed binary all report 0.2.0.
• Downloaded crate checksum matches the published index/API and its contents match the package audit.
• Every GitHub artifact hash matches the released checksum manifest and smoke-tested bytes.
• Clean install and behavioral smoke results are recorded per supported OS.
• The release workflow used the protected environment and expected short-lived identity; logs contain no secret.
• The security supported-version table and changelog now identify 0.2.0 correctly.

Acceptance criteria

• crates.io contains one verified 0.2.0 artifact built from the audited commit.
• Protected tag v0.2.0 and the GitHub Release identify that same commit and artifact set.
• Checksums, SBOM/provenance/signature material, release notes, changelog, and license metadata agree.
• Live clean-install smoke tests pass on every supported OS and use downloaded release bytes.
• Release evidence is durable and contains no credentials or misleading rebuilds.
• Any failure follows the documented incident/yank/patch-release policy instead of mutating published history.

Dependencies

Blocked by:

• Execute an independent post-remediation production-readiness audit #72 — independent audit PASS for the exact candidate.
• Build a fail-closed release pipeline with trusted publishing and traceable artifacts #63 — fail-closed trusted release workflow.
• Establish the v0.2.0 release identity, changelog, license clarification, and SemVer baseline #64 — coherent v0.2 identity, changelog, licensing, and SemVer baseline.
• Protect required checks, release tags, and the publication environment #65 — required checks, tag, and environment protection.

The Homebrew tap is intentionally separate and follows this release in #74.