[Release] Publish the first verified Renderflow integration-candidate release and reconcile distribution truth #419

Depends on: #415, #416, #417, and #418
Suite roadmap: egohygiene/flow#11
Flow adapter owner: egohygiene/flow#3

Observed release truth

At main 170c3d5985af073d3da8f6ac2e0c4b639cfd2b3e, Cargo declares 0.2.1; the only tag is historical unsigned v0.2.1 at 96d1e55231c30449b12f4849d7cdda63853abc68; GitHub has no release; and public documentation advertises release/package channels that are not all observed live.

Outcome

Publish the first verified Renderflow integration-candidate release that Flow and clean-room consumers can install and lock by immutable version and digest, while making every public distribution claim match observed reality.

Scope

• Select a new SemVer candidate; never move or reuse v0.2.1.
• Reconcile Cargo/package versions, generated version surfaces, changelog, roadmap, README, docs, manifests, and capability metadata.
• Publish an immutable GitHub prerelease/release from one exact green commit.
• Produce supported binaries/packages, SHA-256 checksums, SBOM, dependency/license notices, provenance/attestation, and an explicit signing decision.
• Record exact CLI, schema, plugin SDK, provider contract, capability, supported-platform, and external-tool compatibility versions.
• Clean-install and smoke-test downloaded release artifacts, not worktrees.
• Test every advertised distribution channel that is actually published; mark unavailable channels planned/unsupported.
• Publish a machine-readable release manifest suitable for Flow's provider lock and compatibility matrix.

Acceptance criteria

• A new immutable GitHub release resolves to the exact reviewed commit.
• Historical v0.2.1 is documented and not reused or moved.
• Every required artifact and checksum is independently verified.
• SBOM, notices, provenance/attestation, and signing status are attached or linked.
• Clean hosts install and run supported artifacts without repository source.
• --version, help, doctor, planning, dry-run, deterministic fixture execution, and failure exits are smoke-tested.
• README, docs, package metadata, changelog, release metadata, and observed binary version agree.
• Unsupported or unpublished package-manager channels are labeled honestly.
• Flow can pin the release by version and digest without importing Renderflow source.
• Main CI, docs, conformance, scheduled evidence, and release verification are green.
• Rollback and compromised-release response are documented.

Non-goals

• Declaring final stable v1 before Flow integration and the final audit.
• Adding unrelated product capabilities.
• Pretending an unavailable package-manager account or channel published successfully.
• Mutating or replacing an existing tag.

Audit-to-roadmap reconciliation — 2026-10-21

Audit: https://github.com/egohygiene/renderflow/blob/audit/flow-suite-20261021T025401Z/audits/flow-suite-20261021T025401Z.md · Complete roadmap: #367

First immutable integration candidate is Ubuntu 24.04 x86_64 GNU; no GitHub release exists at this snapshot.

Bounded preparation: Review exact-tag workflow inputs, release manifest, rollback and source-qualified matrix.

Full outcome remains gated (*): Restore exact-source baseline, resume authorized qualification, then immutable release/download verification; #415–#418 are closed historical prerequisites.

The maintainer's implementation-sprint qualification deferral remains in force. This audit ran no Renderflow tests, compiler/build/Cargo resolution, product lint/format/schema qualification, native/CLI/provider/visual execution, installers or new CI. Reading existing exact-source provider records is not a qualification rerun. Source implementation and authored tests are not passing-test, native-fidelity, release or downstream-consumer evidence.

This is an additive planning note. The full original issue, acceptance criteria, scope, parent references and historical checkpoints remain authoritative and unchanged. No acceptance box or issue is closed by this audit. Recommended ledger parent: #367.