chore(main): release 0.1.2 (#16)

First published immutable standards bundle containing policies, profiles, architectures, configs, workflows, templates, and tooling. Version and manifest are 0.1.2; changelog describes the complete snapshot and the corrected secret contract. v0.1.0 and v0.1.1 remain unpublished and reserved.

Release checklist: https://github.com/KofTwentyTwo/standards/issues/17

Validated package regression tests, Markdown lint, recorded AI review, and required PR gates. Substantial AI assistance: OpenAI GPT-6 Codex under maintainer authorization.

Signed-off-by: James Maes <james@kof22.com>
Co-Authored-By: OpenAI GPT-6 Codex <noreply@openai.com>

.github/workflows/release-standards.yml

@@ -2,6 +2,10 @@ name: release-standards
 
 on:
   workflow_call:
+    secrets:
+      RELEASE_APP_PRIVATE_KEY:
+        description: App key resolved from the protected release environment.
+        required: true
 
 permissions: {}
 

.github/workflows/release.yml

@@ -15,6 +15,9 @@ jobs:
   release:
     if: startsWith(github.ref, 'refs/tags/v')
     uses: ./.github/workflows/release-standards.yml
+    # Required even when the value exists only in the called job's environment.
+    secrets:
+      RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
     permissions:
       contents: write
       issues: read

.release-please-manifest.json

@@ -1 +1 @@
-{".":"0.1.1"}
+{".":"0.1.2"}

CHANGELOG.md

@@ -4,11 +4,23 @@
 <!-- markdownlint-disable MD012 -->
 <!-- markdownlint-configure-file { "MD024": { "siblings_only": true } } -->
 
-## [0.1.1](https://github.com/KofTwentyTwo/standards/compare/v0.1.0...v0.1.1) (2026-10-10)
+## [0.1.2](https://github.com/KofTwentyTwo/standards/compare/v0.1.1...v0.1.2) (2026-10-10)
 
 First published standards bundle: policies, language profiles, architectures,
-configs, reusable workflows, templates, and tooling. The `0.1.0` baseline below was
-never published; its signed tag remains reserved after a workflow startup failure.
+configs, reusable workflows, templates, and tooling. The earlier `0.1.0` and
+`0.1.1` versions were never published; their signed tags remain reserved after
+the workflow failures documented below.
+
+
+### Bug Fixes
+
+* **releases:** declare the protected environment secret contract ([#15](https://github.com/KofTwentyTwo/standards/issues/15)) ([08b5ac8](https://github.com/KofTwentyTwo/standards/commit/08b5ac84a7b4d0a06d0b4c5f3ba9e643799084ad))
+
+## 0.1.1 (2026-10-10) — unpublished
+
+The bundle passed CI, checksums, and all five provenance checks, but publication
+stopped before draft creation because the reusable caller omitted its environment
+secret contract. This signed tag and the `0.1.0` baseline remain reserved.
 
 ### Bug Fixes
 

docs/releases.md

@@ -46,7 +46,9 @@ version and notes before merging. A `breaking` label alone does not change the v
    `release` with a maintainer reviewer and deployment access for `v*` tags only.
    Store `RELEASE_APP_PRIVATE_KEY` separately in these **environment secrets**;
    never as a repository secret or committed file. Environments in the reusable
-   publisher resolve their own secrets; caller workflows do not pass the key.
+   publisher resolve their own secrets, but the caller must explicitly pass the
+   secret name and the reusable workflow must declare it. The named contract does
+   not expose the tag-only value to caller jobs or nested CI gates.
    Keep `protect-main` and `protect-release-tags` intact; the App does not create
    tags or bypass review. Allow the SHA-pinned Release Please action if repository
    action restrictions require an explicit allowlist entry.
@@ -71,9 +73,9 @@ and Release Please actions are pinned and tracked by Dependabot. See the
 
    ```bash
    git fetch origin main
-   git tag -s v0.1.0 <release-pr-merge-sha> \
+   git tag -s v0.1.2 <release-pr-merge-sha> \
      -m "Release checklist: https://github.com/KofTwentyTwo/standards/issues/123"
-   git push origin v0.1.0
+   git push origin v0.1.2
    ```
 
 4. The tag workflow validates ancestry, version files, the pending release PR, and
@@ -95,10 +97,10 @@ Every release includes `KofTwentyTwo-standards-<version>.zip`, `.tar.gz`,
 and license split. Download assets from a specific version, then verify:
 
 ```bash
-gh release download v0.1.0 --repo KofTwentyTwo/standards --dir standards-0.1.0
-cd standards-0.1.0
+gh release download v0.1.2 --repo KofTwentyTwo/standards --dir standards-0.1.2
+cd standards-0.1.2
 sha256sum --check SHA256SUMS
-gh attestation verify KofTwentyTwo-standards-0.1.0.zip --repo KofTwentyTwo/standards
+gh attestation verify KofTwentyTwo-standards-0.1.2.zip --repo KofTwentyTwo/standards
 ```
 
 On Windows, compare `Get-FileHash -Algorithm SHA256` to the corresponding entry in
@@ -108,7 +110,7 @@ version comment; do not use a moving branch or tag as a workflow pin.
 To reproduce from a checkout containing the release commit:
 
 ```powershell
-pwsh tools/Build-StandardsPackage.ps1 -Version 0.1.0 -Ref v0.1.0 -OutputPath artifacts/rebuild-0.1.0
+pwsh tools/Build-StandardsPackage.ps1 -Version 0.1.2 -Ref v0.1.2 -OutputPath artifacts/rebuild-0.1.2
 pwsh tools/Test-StandardsPackage.ps1
 ```
 
@@ -119,8 +121,10 @@ same Git/archive tool versions. The builder refuses an existing output directory
 ## Failed releases
 
 The initial `v0.1.0` tag was reserved by a workflow-startup failure; no bundle was
-published for it. The first published bundle is `v0.1.1`. Keep the original tag
-unchanged; use a new version when a tagged workflow needs a source fix.
+published for it. The `v0.1.1` publisher then stopped before draft creation because
+the caller omitted the environment secret contract. Both tags remain reserved;
+`v0.1.2` is the planned first published bundle. Keep these tags unchanged; use a new
+version when a tagged workflow needs a source fix.
 
 Never replace published assets or move/reuse a version tag. Fix a published error
 with a new release. A failed upload or publication leaves a draft; inspect its run

docs/security/threat-model.md

@@ -71,6 +71,12 @@ trust boundaries change.
 
 ## Review log
 
+- **2026-10-10, v0.1.2:** Reviewed the explicit reusable-workflow secret contract
+  after the unpublished v0.1.1 publisher failed. Only the named App key is passed;
+  its value remains restricted to the reviewer-protected tag environment. Nested
+  CI receives no secrets, and permissions, interfaces, and recovery boundaries
+  remain unchanged. Failed version tags stay reserved.
+
 - **2026-10-10, v0.1.0:** Reviewed source-only packaging, release-PR validation,
   preflight approval, App token scopes, environment restrictions, provenance, and
   immutable publication. Main and tag protections remain in place. Most likely

version.txt

@@ -1 +1 @@
-0.1.1
+0.1.2