Publish and verify the first immutable Flow policy release

[jmcte]

Problem statement

Flow has an exact v1.0.0 tag but no published GitHub Release. The first Publish Policy Release run failed at an administrator-only immutable-release preflight. PR #22 repaired the workflow permission boundary, but the release has not been retried from a tag containing that repair.

Desired outcome

Publish and independently verify the first immutable Flow policy release from a fresh exact SemVer patch tag that contains PR #22.

Scope

• Verify immutable releases are enabled with an administrator-capable credential before tagging.
• Select the next exact patch version without moving v1.0.0.
• Create the exact tag from the reviewed main commit.
• Dispatch Publish Policy Release with this issue as the governing release issue.
• Verify the published archive, manifest, checksums, standalone verifier, and GitHub immutability evidence.

Non-goals

• Moving or overwriting v1.0.0.
• Publishing from main, latest, v1, or another floating reference.
• Beginning the fleet-wide Bootstrap rollout.

Acceptance criteria

• Administrator-capable preflight evidence confirms immutable releases are enabled.
• A fresh exact SemVer tag containing commit 504c79e or its descendant is created without moving an existing tag.
• Publish Policy Release completes successfully.
• The GitHub Release contains the expected archive, manifest, checksums, and standalone verifier.
• Downloaded assets verify successfully without a repository checkout.
• GitHub reports the release as immutable.
• Workflow, commit, tag, release, and postpublication evidence are recorded on this issue.
• Issue Dogfood Public Repository Standard v1 in Flow #13 is updated with the immutable release reference that Bootstrap should consume.

Test expectations

• Run the complete Python unit suite and all four policy validators on the tagged commit.
• Build and verify the release locally before tagging.
• Download and verify the published assets in a clean directory.

Security implications

This is a policy supply-chain publication. The built-in workflow token must remain least-privileged; administrator credentials are used only for the preflight and are not stored in the repository or workflow.

Documentation implications

Record the exact consumer reference and postpublication evidence in the release documentation and governing issue.

Dependencies

• Publish an immutable v1 policy bundle and migration contract #12
• PR fix: make immutable release gate executable #22
• Repository immutable-release setting enabled by an administrator

Human decision points

• Administrator-capable immutable-release preflight
• Any attempt to move or replace an existing exact tag

[jmcte]

Release preflight passed for proposed v1.0.1 at 504c79e59689f906a234e7145ee5752588b438b3.

• Administrator-capable repository check: immutable releases are enabled (enabled: true).
• Existing exact tag check: v1.0.1 does not exist.
• Existing release check: no prior GitHub Release exists, so workflow previous_version is 0.0.0.
• Full unit suite: 68 tests passed.
• Policy validators: bundle, transitions, contribution lifecycle, and security/provenance all passed.
• Offline build: python3 scripts/flow/build_policy_release.py --output /tmp/flow-policy-release-v1.0.1-preflight --version 1.0.1 --verify passed.
• Independent reviewed commit evidence: merged and approved PR fix: make immutable release gate executable #22 produced 504c79e.
• Major/first-release evidence paths: docs/decisions/ADR-0001-public-repository-standard-v1.md and docs/public-repository-standard-compatibility.md.

Next action: create exact tag v1.0.1 without moving v1.0.0, then dispatch Publish Policy Release against that tag with this issue as the governing issue.

[github-actions]

Material action notification: publishing immutable Flow policy release v1.0.1 from 504c79e. Execution continues after required gates.

[github-actions]

Postpublication verification passed for v1.0.1. Workflow: https://github.com/OMT-Global/flow/actions/runs/29316966840; commit: 504c79e.

[jmcte]

Flow policy release v1.0.1 is complete and independently verified.

• Release: https://github.com/OMT-Global/flow/releases/tag/v1.0.1
• Workflow: https://github.com/OMT-Global/flow/actions/runs/29316966840
• Tagged commit: 504c79e59689f906a234e7145ee5752588b438b3
• GitHub immutable flag: true
• Assets: flow-policy-v1.0.1.zip, policy-release-v1.0.1.json, SHA256SUMS, verify_policy_release.py
• Published ZIP digest: sha256:25137ba7b3d8eea8db1c125f9a6de27dbf263d1996d5b1d581233ffd28b48fd0
• Independent clean-directory verification: verify_policy_release.py --verify-only passed.
• Workflow validation: all policy tests, validators, build, publication, download, verification, and postpublication evidence steps passed.

This satisfies the released-policy prerequisite for #13. Closing as completed.