.release-please-manifest.json

@@ -1 +1 @@
-{".":"0.1.1"}
+{".":"0.1.2"}

CHANGELOG.md

@@ -4,6 +4,18 @@
 <!-- markdownlint-disable MD012 -->
 <!-- markdownlint-configure-file { "MD024": { "siblings_only": true } } -->
 
+## [0.1.2](https://github.com/KofTwentyTwo/standards/compare/v0.1.1...v0.1.2) (2026-10-10)
+
+First published standards bundle: policies, language profiles, architectures,
+configs, reusable workflows, templates, and tooling. The earlier `0.1.0` and
+`0.1.1` versions were never published; their signed tags remain reserved after
+the workflow failures documented below.
+
+
+### Bug Fixes
+
+* **releases:** declare the protected environment secret contract ([#15](https://github.com/KofTwentyTwo/standards/issues/15)) ([08b5ac8](https://github.com/KofTwentyTwo/standards/commit/08b5ac84a7b4d0a06d0b4c5f3ba9e643799084ad))
+
 ## 0.1.1 (2026-10-10) — unpublished
 
 The bundle passed CI, checksums, and all five provenance checks, but publication

docs/releases.md

@@ -73,9 +73,9 @@ and Release Please actions are pinned and tracked by Dependabot. See the
 
    ```bash
    git fetch origin main
-   git tag -s v0.1.0 <release-pr-merge-sha> \
+   git tag -s v0.1.2 <release-pr-merge-sha> \
      -m "Release checklist: https://github.com/KofTwentyTwo/standards/issues/123"
-   git push origin v0.1.0
+   git push origin v0.1.2
    ```
 
 4. The tag workflow validates ancestry, version files, the pending release PR, and
@@ -97,10 +97,10 @@ Every release includes `KofTwentyTwo-standards-<version>.zip`, `.tar.gz`,
 and license split. Download assets from a specific version, then verify:
 
 ```bash
-gh release download v0.1.0 --repo KofTwentyTwo/standards --dir standards-0.1.0
-cd standards-0.1.0
+gh release download v0.1.2 --repo KofTwentyTwo/standards --dir standards-0.1.2
+cd standards-0.1.2
 sha256sum --check SHA256SUMS
-gh attestation verify KofTwentyTwo-standards-0.1.0.zip --repo KofTwentyTwo/standards
+gh attestation verify KofTwentyTwo-standards-0.1.2.zip --repo KofTwentyTwo/standards
 ```
 
 On Windows, compare `Get-FileHash -Algorithm SHA256` to the corresponding entry in
@@ -110,7 +110,7 @@ version comment; do not use a moving branch or tag as a workflow pin.
 To reproduce from a checkout containing the release commit:
 
 ```powershell
-pwsh tools/Build-StandardsPackage.ps1 -Version 0.1.0 -Ref v0.1.0 -OutputPath artifacts/rebuild-0.1.0
+pwsh tools/Build-StandardsPackage.ps1 -Version 0.1.2 -Ref v0.1.2 -OutputPath artifacts/rebuild-0.1.2
 pwsh tools/Test-StandardsPackage.ps1
 ```
 

docs/security/threat-model.md

@@ -71,6 +71,12 @@ trust boundaries change.
 
 ## Review log
 
+- **2026-10-10, v0.1.2:** Reviewed the explicit reusable-workflow secret contract
+  after the unpublished v0.1.1 publisher failed. Only the named App key is passed;
+  its value remains restricted to the reviewer-protected tag environment. Nested
+  CI receives no secrets, and permissions, interfaces, and recovery boundaries
+  remain unchanged. Failed version tags stay reserved.
+
 - **2026-10-10, v0.1.0:** Reviewed source-only packaging, release-PR validation,
   preflight approval, App token scopes, environment restrictions, provenance, and
   immutable publication. Main and tag protections remain in place. Most likely

version.txt

@@ -1 +1 @@
-0.1.1
+0.1.2