docs: record v0.1.23 release verification

PILOT.md

@@ -1865,3 +1865,5 @@ A full audit accounted for every VCR identifier used by the acceptance and task
 ## VCR410 — v0.1.23 release candidate
 
 Version 0.1.23 is a packaging release, not an acceptance result. It publishes the explicit strategy, test-order and triage commands, diagnostic-cost metadata, the typed-decision cache and five opt-in skills; per-change details and boundaries are in CHANGELOG.md. Pre-publication evidence at the release revision: 858 offline tests pass on Linux, `git diff --check` is clean, the exact-tree wheel and sdist pass `tools/check_distribution.py`, and the registry was rechecked (latest published 0.1.22; 0.1.23 unused). Hosted CI and the tag-gated publish workflow remain the merge and release gates. This release claims no speed, quality, cost, host-delivery or platform benefit; the frozen cohorts remain censored or mixed and fresh Desktop delivery stays unverified.
+
+Published receipts: PR #310 passed hosted CI and squash-merged as `d5b4772`; tag-gated publish run 36792180928 passed the suite, build, distribution check and Trusted Publishing; a fresh registry pipx install of published 0.1.23 passed `doctor` with both advisory hooks and a keyless local triage smoke with a diagnostic cost resolved locally (no remote call). Artifact digests are recorded in TASKS.md VCR410. These validate packaging, publication and local setup only; they do not measure advice delivery or task benefit, and overall acceptance remains not established.

README.md

@@ -197,7 +197,7 @@ JevCompass does not infer Codex Plan UI mode. Check `/hooks` and start a fresh s
 
 Evidence is deliberately limited to the environments tested:
 
-- Version 0.1.23 publishes the three explicit coding-decision commands (`strategy choose`, `tests discover`/`rank`, `triage` with observations, ranking and diagnostic costs), the opt-in typed-decision cache, and five opt-in bundled skills; per-change details and evidence boundaries are in [CHANGELOG.md](CHANGELOG.md). The release revision passed 858 offline Python tests on Linux, and the release pull request and publish workflow re-run the full suite on Python 3.11 with exact-tag distribution checks; registry receipts are recorded in [TASKS.md](TASKS.md) after publication. No repeatable task benefit is claimed.
+- Version 0.1.23 publishes the three explicit coding-decision commands (`strategy choose`, `tests discover`/`rank`, `triage` with observations, ranking and diagnostic costs), the opt-in typed-decision cache, and five opt-in bundled skills; per-change details and evidence boundaries are in [CHANGELOG.md](CHANGELOG.md). The release revision passed 858 offline Python tests on Linux; PR #310 passed hosted CI and merged as `d5b4772`; tag-gated publish run 36792180928 passed the Python 3.11 suite, build, exact-tag distribution checks and Trusted Publishing. PyPI 0.1.23 wheel SHA-256 `5293e33c3879129756712132bae42aa8955884f3bc2c289984c71ffc2e87c87b`, sdist `bacbe3a3ac8d657802dc197155f41de561aea0ea45af26d2246e51d778135f6f`; a fresh registry pipx install on Python 3.14 passed `doctor` with both advisory hooks and a keyless diagnostic-cost triage smoke resolved locally. No repeatable task benefit is claimed.
 
 - The published 0.1.22 package places selected IDs at the top of each advisory. A fresh isolated CLI 0.155.1 session reported `exec_command` and `unittest` with correlated advice ID `0623c35b` before its first tool. The matching local hook took 5.99 ms, exit was 0, and the fictional fixture was unchanged. This single smoke does not measure task benefit.
 

RELEASE_NOTES.md

@@ -1,6 +1,6 @@
 # JevCompass v0.1.23
 
-Publishes the three explicit coding-decision commands (pretask strategy, post-change test order, ambiguous-failure triage) with verified-evidence local routing, bounded decision reasons and selection provenance, opt-in hypothesis ranking, caller-verified diagnostic-cost metadata, the opt-in typed-decision cache, and the fifth bundled skill `jevcompass-coding-workflow`; the opt-in installer now offers five skills. The full change list with evidence boundaries is in [CHANGELOG.md](CHANGELOG.md). The seven "Included in v0.1.23" sections below were written while these changes were unreleased: their statements about the then-published distribution describe v0.1.22 and earlier, and their evidence limits continue to apply. Local verification at the release revision: 858 offline Python tests on Linux with `git diff --check` clean; the release pull request and the publish workflow re-run the full suite on Python 3.11 with exact-tag distribution checks. Registry receipts (Trusted Publishing run, artifact digests, fresh install) are recorded in [TASKS.md](TASKS.md) and [PILOT.md](PILOT.md) after publication. No speed, quality, or cost benefit is claimed; macOS runtime and fresh Desktop prompt delivery remain unverified.
+Publishes the three explicit coding-decision commands (pretask strategy, post-change test order, ambiguous-failure triage) with verified-evidence local routing, bounded decision reasons and selection provenance, opt-in hypothesis ranking, caller-verified diagnostic-cost metadata, the opt-in typed-decision cache, and the fifth bundled skill `jevcompass-coding-workflow`; the opt-in installer now offers five skills. The full change list with evidence boundaries is in [CHANGELOG.md](CHANGELOG.md). The seven "Included in v0.1.23" sections below were written while these changes were unreleased: their statements about the then-published distribution describe v0.1.22 and earlier, and their evidence limits continue to apply. Local verification at the release revision: 858 offline Python tests on Linux with `git diff --check` clean; the release pull request and the publish workflow re-run the full suite on Python 3.11 with exact-tag distribution checks. Trusted Publishing run 36792180928 passed from tag `v0.1.23` (PR #310, squash `d5b4772`): the Python 3.11 suite, build and exact-tag distribution checks all green. PyPI wheel SHA-256 `5293e33c3879129756712132bae42aa8955884f3bc2c289984c71ffc2e87c87b`, sdist `bacbe3a3ac8d657802dc197155f41de561aea0ea45af26d2246e51d778135f6f`; a fresh registry pipx install passed `doctor` and a keyless local triage smoke. Full receipts: [TASKS.md](TASKS.md) VCR410. No speed, quality, or cost benefit is claimed; macOS runtime and fresh Desktop prompt delivery remain unverified.
 
 ---
 

ROADMAP.md

@@ -16,7 +16,7 @@ For each stage: define fixtures and scoring before execution, implement typed an
 
 ## 0.1.23 candidate and release evidence
 
-Version 0.1.23 publishes everything the coding-decision track implemented since v0.1.22: `strategy choose` with contract-evidence and resolved-strategy local routing, the opt-in strategy hook, `tests discover`/`rank` with coverage/runtime signals and decision reasons, `triage` with observation enums, opt-in hypothesis ranking and caller-verified diagnostic costs, the opt-in typed-decision cache, and five opt-in bundled skills. Trial tooling (paired runners, supervisor bridges, case profiles) stays repository-only and is not in the wheel. Local release evidence: 858 offline Python tests on Linux with `git diff --check` clean at the release revision; the release pull request re-runs the full suite on hosted CI, and the publish workflow rebuilds from the exact tag with distribution checks before Trusted Publishing. Registry receipts, artifact digests and the fresh-install check are recorded after publication. A ledger-numbering audit (VCR409) confirms the evidence ledgers have no lost records. Efficacy remains open: the frozen benchmark cohorts are censored or mixed, and fresh Desktop prompt delivery plus macOS runtime stay unverified.
+Version 0.1.23 publishes everything the coding-decision track implemented since v0.1.22: `strategy choose` with contract-evidence and resolved-strategy local routing, the opt-in strategy hook, `tests discover`/`rank` with coverage/runtime signals and decision reasons, `triage` with observation enums, opt-in hypothesis ranking and caller-verified diagnostic costs, the opt-in typed-decision cache, and five opt-in bundled skills. Trial tooling (paired runners, supervisor bridges, case profiles) stays repository-only and is not in the wheel. Local release evidence: 858 offline Python tests on Linux with `git diff --check` clean at the release revision; the release pull request re-runs the full suite on hosted CI, and the publish workflow rebuilds from the exact tag with distribution checks before Trusted Publishing. Registry receipts: PR #310 passed hosted CI and merged as `d5b4772`; tag-gated publish run 36792180928 passed the Python 3.11 suite, build and distribution checks through Trusted Publishing; PyPI 0.1.23 wheel SHA-256 `5293e33c3879129756712132bae42aa8955884f3bc2c289984c71ffc2e87c87b` and sdist `bacbe3a3ac8d657802dc197155f41de561aea0ea45af26d2246e51d778135f6f`; a fresh registry pipx install on Python 3.14 passed `doctor` with both advisory hooks and a keyless diagnostic-cost triage smoke resolved locally. A ledger-numbering audit (VCR409) confirms the evidence ledgers have no lost records. Efficacy remains open: the frozen benchmark cohorts are censored or mixed, and fresh Desktop prompt delivery plus macOS runtime stay unverified.
 
 ## 0.1.22 candidate and remaining release evidence
 

TASKS.md

@@ -1268,4 +1268,6 @@ A full audit accounted for every VCR identifier across both evidence ledgers. Tw
 
 ## VCR410 — v0.1.23 release candidate
 
-Version 0.1.23 publishes the three explicit coding-decision commands with their local-routing and provenance features, caller-verified diagnostic costs, the opt-in typed-decision cache, and the fifth bundled skill; `pyproject.toml` and the package `__version__` are bumped to 0.1.23 and CHANGELOG.md carries the full change list. Pre-publication local evidence at the release revision: the full offline suite passes (858 tests, Linux), `git diff --check` is clean, `uv build` produced the wheel and sdist, and `tools/check_distribution.py` passed after its expected bundled-skill set was corrected to enumerate `bundled_skills/*/SKILL.md` (five skills) instead of a stale two-name list. The PyPI registry was rechecked before the release claim: the latest published version is 0.1.22 and 0.1.23 is unused. Hosted CI on the release pull request is required before merge; the publish workflow rebuilds from the exact tag, reruns the suite and distribution check, and publishes through Trusted Publishing. Registry receipts are appended after publication. No trial was run; no efficacy, delivery or platform claim is made.
+Version 0.1.23 publishes the three explicit coding-decision commands with their local-routing and provenance features, caller-verified diagnostic costs, the opt-in typed-decision cache, and the fifth bundled skill; `pyproject.toml` and the package `__version__` are bumped to 0.1.23 and CHANGELOG.md carries the full change list. Pre-publication local evidence at the release revision: the full offline suite passes (858 tests, Linux), `git diff --check` is clean, `uv build` produced the wheel and sdist, and `tools/check_distribution.py` passed after its expected bundled-skill set was corrected to enumerate `bundled_skills/*/SKILL.md` (five skills) instead of a stale two-name list. The PyPI registry was rechecked before the release claim: the latest published version is 0.1.22 and 0.1.23 is unused. Hosted CI on the release pull request is required before merge; the publish workflow rebuilds from the exact tag, reruns the suite and distribution check, and publishes through Trusted Publishing. No trial was run; no efficacy, delivery or platform claim is made.
+
+Release receipts: PR #310 passed hosted CI and squash-merged as `d5b4772`; annotated tag `v0.1.23`. Tag-gated publish run 36792180928 passed the version/tag check, the full Python 3.11 suite, `python -m build`, `tools/check_distribution.py` and Trusted Publishing. PyPI 0.1.23 reports wheel SHA-256 `5293e33c3879129756712132bae42aa8955884f3bc2c289984c71ffc2e87c87b` and sdist SHA-256 `bacbe3a3ac8d657802dc197155f41de561aea0ea45af26d2246e51d778135f6f`. A fresh registry pipx install of published 0.1.23 (Python 3.14.7) reported `JevCompass 0.1.23`, passed `doctor` with both advisory hooks and no PreToolUse gate, and a keyless local triage smoke with `--diagnostic-cost` returned `no-remote-choice` with `local_abstention`. The GitHub release publishes the same notes. This is packaging, publication and local-setup evidence only; no task-benefit claim is made.