diff --git a/docs/remediation-plan.md b/docs/remediation-plan.md index ec0a6d3..0959078 100644 --- a/docs/remediation-plan.md +++ b/docs/remediation-plan.md @@ -111,4 +111,10 @@ Repeat explicit/missing-schema and non-finite-number CLI probes on Linux, macOS, - [x] Schema discovery and the constraint matrix are documented. - [x] The audited missing-schema command now fails with the intended exit code. - [x] All native-platform jobs and analyzers pass. -- [ ] A tagged release is verified in full before publication. +- [x] A tagged release is verified in full before publication. + +## Completion evidence + +Envguard v0.1.0 was released from protected `main` at `f05fd50bf188773cbe5362fff6c037122f82a86b` after every required CI and CodeQL check passed. The release workflow built the six Linux, macOS, and Windows archives without publishing, independently verified their checksums, contents, executable formats and architectures, and native version output, rejected a deliberately corrupted candidate, attested the verified bytes, and only then published them. + +Post-publication verification downloaded the seven public assets, repeated the full distribution check, verified every provenance attestation against `.github/workflows/release.yml`, `refs/tags/v0.1.0`, and the source commit, and confirmed that `go install github.com/1337lean/envguard/cmd/envguard@v0.1.0` reports `v0.1.0`.