[soulbah]

Spec and outcome

• Spec or repository-only rationale: ADR-007 relies on immutable releases to protect each vX.Y.Z tag, but the repository setting was off, so the claim was not true and release.yml only printed the flag. Release immutability is now enabled on the repository (GET /repos/rootform-dev/action/immutable-releases returns enabled: true).
• Accepted outcome: after publishing vX.Y.Z, release.yml waits up to about 75 seconds for GitHub to report the release immutable and fails before moving the major tag otherwise, with the recovery in the error. ADR-007 and CONTRIBUTING state the rule.
• Explicit non-goals: no release, tag or major-tag change in this PR; semantic-release rules and the qualification gate are unchanged.

Done when and evidence

• Done when command or protocol: quality passes on this head; the loop accepts a release that becomes immutable and fails one that stays mutable.
• Evidence path or exact output: local stub run of the loop: OK after 2 refetches (rc 0) when the flag turns true, v1.0.0 is published but not immutable (rc 1) when it never does. bun run check:foundation (154 paths), bun run check:format, actionlint .github/workflows/release.yml pass.
• Full gate: bun run verify runs in quality.

Risk and privacy

• Security/privacy impact: stronger supply chain guarantee; the floating major tag still only names an immutable, qualified release.
• Offline and determinism impact: none.
• Dependency or toolchain change: none.
• Rollback path: revert this commit; the repository setting can be disabled with DELETE /repos/rootform-dev/action/immutable-releases (only future releases are affected).

Review checklist

• Scope matches accepted spec or repository-only rationale.
• Success, boundary, failure, and regression paths have evidence proportional to risk.
• No secret, real Terraform material, private AI material, or generated noise enters Git.
• Primary reviewer inspected final diff and recorded remaining limits.