Complete when-ready release policy projection and verification

[jmcte]

Problem statement

Bootstrap's release automation has governed workflows, but v1 still requires exact immutable policy consumption, Conventional Commits, automated changelog proposals, agent-controlled when-ready publication, material notification, and post-publication verification as one resolved contract.

Desired outcome

Class-aware release projection and conformance implement the complete v1 release lifecycle without treating human approval as a universal gate.

Scope

• SemVer and Conventional Commit validation.
• Immutable vX.Y.Z tags and exact/SHA policy pins.
• Automated changelog proposal, material release notification, agent publish, and postpublish verification.
• Maintenance branches only for supported older lines.

Non-goals

• Publishing a real release in this issue.
• Floating tags as production policy references.

Acceptance criteria

• Production policy/workflow consumption rejects main and floating refs.
• Release proposals include deterministic changelog evidence.
• Agents may publish after gates pass; only configured environments or hard stops require human approval.
• Exact tags are immutable and postpublish evidence is verified.
• Patch/minor/major policy upgrades follow the defined review rules.

Test expectations

Begin with failing unpinned-ref, mutable-tag, invalid-title/commit, missing-notification, changelog, and postpublish-evidence tests.

Security implications

Release workflows use least privilege, protected environments where configured, signed provenance, and no fork secrets.

Documentation implications

Update release operator, compatibility-tag, and maintenance-branch guidance.

Dependencies

Flow release policy, resolved contract, conformance, security, and provenance issues.

Human decision points

External obligations, spending above threshold, license/ownership changes, and permanent policy exceptions only.