docs: align stable release state

Author: CometAPI

AGENTS.md

@@ -97,9 +97,9 @@ Post-alpha invariants:
 2. Keep `.github/CODEOWNERS` absent until a real multi-maintainer model exists.
 3. Keep scheduled and manually dispatched live smoke fail-closed behind
    `LIVE_SMOKE_ENABLED=true`, and keep `RELEASE_PLEASE_ENABLED` disabled outside
-   an explicitly authorized release sequence. The stable-readiness
-   configuration establishes the recovery alpha boundary with a reviewed and
-   tested `last-release-sha` bridge.
+   an explicitly authorized release sequence. The reviewed `last-release-sha`
+   bridge was used once to generate the stable release PR and must remain absent
+   after its human finalization.
 4. Treat the recorded public rules, security reporting, immutable releases, and
    protected environments as readiness invariants. Any drift invalidates the
    readiness claim until it is explicitly authorized, restored, and verified.
@@ -265,11 +265,10 @@ committed.
   `v0.1.0-alpha.1+recovery.1`, which maps to package version `0.1.0a1`.
   Later releases must use their ordinary canonical tag spelling.
 - Keep Release Please disabled outside an explicitly authorized release
-  sequence. Its stable-readiness configuration uses the reviewed and tested
-  `last-release-sha` bridge because the recovery tag's build metadata cannot be
-  inferred from the manifest. Remove the one-time bridge and prerelease
-  versioning controls in the human-finalized stable release PR before it is
-  merged.
+  sequence. The stable-readiness configuration used a reviewed and tested
+  `last-release-sha` bridge because the recovery tag's build metadata could not
+  be inferred from the manifest. The human-finalized stable release PR removed
+  that bridge and its prerelease-versioning controls; keep them absent.
 - Keep third-party Actions pinned to full commit SHAs. Grant `id-token: write`
   only to the reusable publication caller and the protected publishing job;
   the caller passes this maximum permission and only the publishing job uses

ARCHITECTURE.md

@@ -141,9 +141,10 @@ recovery release uses SemVer build metadata in
 artifact identity: the PyPI version remains `0.1.0a1`.
 
 Release Please remains disabled outside an explicitly authorized release
-sequence. The stable-readiness configuration establishes the recovery commit
-as the previous-release boundary with a tested `last-release-sha` bridge, so
-the one-time build-metadata recovery tag cannot replay earlier history.
+sequence. The stable-readiness configuration used a tested `last-release-sha`
+bridge to establish the recovery commit as the previous-release boundary and
+generate the stable release PR without replaying earlier history. Human
+finalization then removed that one-time bridge.
 
 ## Rejected 0.1 approaches
 

RELEASING.md

@@ -46,10 +46,11 @@ one active maintainer.
 Before the historical first push, scheduled and manually dispatched live
 execution was required to fail closed unless `LIVE_SMOKE_ENABLED=true`.
 `RELEASE_PLEASE_ENABLED` was kept disabled. The reviewed stable-readiness
-configuration now uses an explicit `last-release-sha` bridge to establish the
-recovery alpha as the previous-release boundary; the repository variable stays
-disabled until maintainers intentionally start the stable release sequence. An
-unset or non-true value prevents the corresponding gated job from executing.
+configuration later used an explicit `last-release-sha` bridge to establish the
+recovery alpha as the previous-release boundary. Maintainers enabled the
+repository variable only to start the stable release sequence, and human
+finalization removed the bridge. An unset or non-true variable prevents the
+corresponding gated job from executing.
 The release live-model configuration resolves an unset or empty
 `COMETAPI_LIVE_MODEL` to `gpt-5.4`.
 
@@ -182,14 +183,14 @@ violations in one run and still returns non-zero when any violation exists.
   `LIVE_SMOKE_ENABLED=true`.
 - `release-please.yml` maintains a human-reviewed version and changelog pull
   request from Conventional Commits after maintainers enable the
-  `RELEASE_PLEASE_ENABLED` repository variable. The checked-in stable-readiness
-  configuration establishes the recovery release boundary with the reviewed
-  `last-release-sha` bridge. Keep the variable disabled except while executing
-  an explicitly authorized release sequence. When it creates an approved
-  release with the GitHub workflow token, it polls the GitHub API until that
-  exact tag and commit are independently reported as immutable, then invokes
-  the protected publication chain directly; workflow-token release events do
-  not trigger a second workflow run.
+  `RELEASE_PLEASE_ENABLED` repository variable. A reviewed one-time
+  `last-release-sha` bridge established the recovery release boundary and was
+  removed during human finalization of the stable release PR. Keep the variable
+  disabled except while executing an explicitly authorized release sequence.
+  When it creates an approved release with the GitHub workflow token, it polls
+  the GitHub API until that exact tag and commit are independently reported as
+  immutable, then invokes the protected publication chain directly;
+  workflow-token release events do not trigger a second workflow run.
 - `publish.yml` is called only with the independently verified immutable tag,
   commit, and default branch. It resolves the tag to the checked-out commit,
   fetches the protected default branch, and rejects a commit that is not
@@ -238,9 +239,9 @@ Maintainers then completed these steps in order:
    OIDC publication but failed before PyPI accepted any distribution. The
    recovery build suffix preserves the equivalent PEP 440 package version
    `0.1.0a1`; it is a one-time exception and must not be incremented or reused
-   for later releases. Keep Release Please disabled until a separate reviewed
-   and tested `last-release-sha` bridge establishes this recovery commit as its
-   previous-release boundary.
+   for later releases. Release Please was kept disabled until a separate
+   reviewed and tested `last-release-sha` bridge established this recovery
+   commit as its previous-release boundary.
 5. The release workflow proved `immutable=true`, resolved the tag to the
    checked-out commit, verified that commit was reachable from the protected
    default branch, and ran the bounded protected live suite against that exact
@@ -280,8 +281,9 @@ changelog, GitHub release, wheel, and source distribution.
   and source-distribution SHA256
   `98d86829ef14771e8b7ec180d452c6638289f49c14a39b7207be5c47cb64cde7`.
 - `LIVE_SMOKE_ENABLED=false`. Release Please remains disabled outside an
-  explicitly authorized release sequence; the reviewed `last-release-sha`
-  bridge is configured for the alpha-to-stable transition.
+  explicitly authorized release sequence. The reviewed `last-release-sha`
+  bridge generated the stable release PR and was removed during human
+  finalization.
 
 ## Stable release sequence
 

ROADMAP.md

@@ -314,9 +314,9 @@ Public Preview readiness evidence on 2026-07-27:
   `LIVE_SMOKE_ENABLED` opt-in was reset to `false` after the run.
 - At this Public Preview checkpoint, no tag, GitHub release, Trusted Publisher,
   PyPI OIDC publication, provenance, or public-registry installation existed.
-  Those later Registry Alpha actions are recorded below. Release Please remains
+  Those later Registry Alpha actions are recorded below. Release Please remained
   disabled until a separately reviewed and tested `last-release-sha` bridge
-  establishes the recovery alpha as its previous-release boundary.
+  established the recovery alpha as its previous-release boundary.
 
 Public Preview remains ready only while:
 
@@ -417,9 +417,9 @@ Accepted release evidence:
   its source-distribution SHA256 is
   `98d86829ef14771e8b7ec180d452c6638289f49c14a39b7207be5c47cb64cde7`.
 - `LIVE_SMOKE_ENABLED=false`. Release Please remains disabled outside an
-  explicitly authorized release sequence; the reviewed stable-readiness
-  configuration now establishes the recovery alpha boundary with
-  `last-release-sha`.
+  explicitly authorized release sequence. The reviewed stable-readiness
+  `last-release-sha` bridge generated the stable release PR and was removed
+  during human finalization.
 
 ## `0.1.0`: OpenAI protocol foundation
 
@@ -480,9 +480,10 @@ successfully in the canonical GitHub repository.
 Scheduled and manually dispatched live smoke must require
 `LIVE_SMOKE_ENABLED=true`; an unset or other value prevents live execution.
 Release Please requires `RELEASE_PLEASE_ENABLED=true` and remains disabled
-outside an explicitly authorized release sequence. Its stable-readiness
-configuration uses the reviewed `last-release-sha` bridge for the recovery
-alpha boundary. Release jobs must resolve an unset or empty
+outside an explicitly authorized release sequence. Its reviewed one-time
+`last-release-sha` bridge established the recovery alpha boundary, generated
+the stable release PR, and was removed during human finalization. Release jobs
+must resolve an unset or empty
 `COMETAPI_LIVE_MODEL` to `gpt-5.4` rather than attempt a request with an empty
 model.
 

SECURITY.md

@@ -46,8 +46,9 @@ Long-lived PyPI tokens are not an accepted publication path. A successful
 upload is incomplete until provenance and a clean public-registry installation
 have been verified.
 
-Third-party GitHub Actions must be pinned to full commit SHAs. Only the
-publishing job may receive `id-token: write`.
+Third-party GitHub Actions must be pinned to full commit SHAs. The reusable
+workflow caller and protected publishing job may declare `id-token: write`, but
+only the publishing job may request the OIDC token.
 
 ## Scope