From b28b3d496bbd45d1759ecba629954a4154bbcc93 Mon Sep 17 00:00:00 2001
From: 1337lean <177236079+1337lean@users.noreply.github.com>
Date: Thu, 6 Aug 2026 23:46:24 -0400
Subject: [PATCH] complete Envguard remediation record

---
 docs/remediation-plan.md | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/docs/remediation-plan.md b/docs/remediation-plan.md
index ec0a6d3..0959078 100644
--- a/docs/remediation-plan.md
+++ b/docs/remediation-plan.md
@@ -111,4 +111,10 @@ Repeat explicit/missing-schema and non-finite-number CLI probes on Linux, macOS,
 - [x] Schema discovery and the constraint matrix are documented.
 - [x] The audited missing-schema command now fails with the intended exit code.
 - [x] All native-platform jobs and analyzers pass.
-- [ ] A tagged release is verified in full before publication.
+- [x] A tagged release is verified in full before publication.
+
+## Completion evidence
+
+Envguard v0.1.0 was released from protected `main` at `f05fd50bf188773cbe5362fff6c037122f82a86b` after every required CI and CodeQL check passed. The release workflow built the six Linux, macOS, and Windows archives without publishing, independently verified their checksums, contents, executable formats and architectures, and native version output, rejected a deliberately corrupted candidate, attested the verified bytes, and only then published them.
+
+Post-publication verification downloaded the seven public assets, repeated the full distribution check, verified every provenance attestation against `.github/workflows/release.yml`, `refs/tags/v0.1.0`, and the source commit, and confirmed that `go install github.com/1337lean/envguard/cmd/envguard@v0.1.0` reports `v0.1.0`.