CodeSigils · Oct 13, 2026 · Oct 13, 2026 · Oct 13, 2026
diff --git a/.github/workflows/commit-messages.yml b/.github/workflows/commit-messages.yml
@@ -11,6 +11,7 @@ permissions:
 
 jobs:
   check:
+    name: Commit messages
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4

diff --git a/README.md b/README.md
@@ -25,7 +25,7 @@ Reviewers treat repeated semantic values—such as versions, runners, paths, and
 SHAs—as possible duplication or drift smells. Centralization is recommended
 only when the values should change together and the trade-off improves clarity.
 
-**Compatibility status:** The current published source (`6b279b3`, checked
+**Compatibility status:** The immutable `v1.0.0` tag (`6b279b3`, checked
 2026-10-13) passed the copied-package smoke matrix for Codex and Claude Code
 with Skills CLI 1.7.2. Hermes external-directory setup is documented but not
 part of the verification matrix.

diff --git a/SECURITY.md b/SECURITY.md
@@ -6,7 +6,8 @@ Report security vulnerabilities via [GitHub Security Advisories](https://github.
 
 ## Supported Versions
 
-Only the latest release on the `main` branch receives security updates.
+Only the latest immutable release tag and the current `main` branch receive
+security updates.
 
 ## Repo-Specific Concerns
 

diff --git a/docs/release-checklist.md b/docs/release-checklist.md
@@ -18,8 +18,11 @@ checks that cannot be meaningfully run against the local source tree.
    published-package check below.
 4. Do not add a skill self-version, version-consistency gate, or release
    automation at the current maintenance scale.
-5. GitHub Releases and semver tags are not required. Add an immutable tag only
-   when consumers need a stable, machine-addressable release point.
+5. Keep releases event-driven. After a runtime-payload change passes this
+   checklist, create one annotated immutable semver tag: major for a breaking
+   scope/routing removal, minor for a backward-compatible workflow expansion,
+   or patch for a compatible correction. Do not tag documentation-only or
+   CI-only changes. GitHub Releases are not required.
 
 6. Before release, review repeated semantic values (versions, runners, OS
    names, paths, SHAs, ports, and feature flags) as possible duplication/drift
@@ -53,6 +56,12 @@ source or the payload being checked.
 - [x] The commit bodies on `main` use `what:`/`why:` and the detailed rationale
   remains in commits and research/decision notes; no `CHANGELOG.md` exists.
 
+## Immutable consumer releases
+
+- [x] `v1.0.0` is an annotated tag at `6b279b3`, the payload commit validated
+  by the 2026-10-13 Codex and Claude Code smoke matrix. It does not have a
+  GitHub Release or changelog.
+
 ## Published-package smoke matrix
 
 Run each row from a separate empty temporary directory. The commands use

diff --git a/docs/research.md b/docs/research.md
@@ -599,10 +599,13 @@ needs independent discovery, different tools, or a large body of guidance.
 
 **Decision (revised 2026-10-13):** Record notable changes in the git commit
 history (`what:`/`why:` commit bodies) while publishing from `main`; do not keep
-a `CHANGELOG.md` and do not require GitHub Releases or semver tags. History and
-per-phase progress live in the git log and `docs/roadmap.md`, not a changelog
-file. Prior `CHANGELOG.md` entries were folded into this model on 2026-10-13.
-`SKILL.md` declares no skill self-version (no top-level `version:`;
+a `CHANGELOG.md`, GitHub Releases, or a calendar release cadence. `v1.0.0` is
+an annotated immutable consumer-release tag for the validated payload at
+`6b279b3`. Create a later semver tag only for a release-worthy runtime-payload
+change after the checklist passes, not for documentation-only or CI-only work.
+History and per-phase progress live in the git log and `docs/roadmap.md`, not a
+changelog file. Prior `CHANGELOG.md` entries were folded into this model on
+2026-10-13. `SKILL.md` declares no skill self-version (no top-level `version:`;
 `metadata.version` stays the pinned Zola tool version, not a skill release).
 
 **Rationale:** The 2026-09-03 skill-repo git-polish survey (study note
@@ -617,7 +620,7 @@ had accepted. The repository therefore uses the conservative
 `metadata.compatibility` shape, while `metadata.version` stays an opaque custom
 key for the pinned Zola tool version.
 
-**Revisit when:** a consumer needs an immutable, machine-readable release point
+**Revisit when:** a release tag fails to provide sufficient consumer stability,
 or the repository grows a multi-maintainer release process.
 
 ## External skill evidence — jim60105/blog `blog-post` (2026-09-05)

diff --git a/docs/roadmap.md b/docs/roadmap.md
@@ -81,10 +81,15 @@ full terms are in [`LICENSE`](../LICENSE), and `skills/zola/SKILL.md` declares
 
 Publish changes from `main` and record notable updates in the git commit
 history (`what:`/`why:` commit bodies); do not keep a `CHANGELOG.md` and do not
-require GitHub Releases or semver tags. Do not add a `version` field to
-`SKILL.md` frontmatter. Tags `phase-1`..`phase-5` are historical roadmap
-milestones; the validation runner's pinned Zola version is the tool version the
-skill is validated against and is independent of a skill release identity.
+require GitHub Releases or a calendar release cadence. `v1.0.0` is the first
+immutable consumer-release tag. Create another semver tag only after a payload
+change that has passed the release checklist: increment major for a breaking
+scope/routing removal, minor for a backward-compatible workflow expansion, and
+patch for a compatible correction. Do not tag documentation-only or CI-only
+changes. Do not add a `version` field to `SKILL.md` frontmatter. Tags
+`phase-1`..`phase-5` are historical roadmap milestones; the validation runner's
+pinned Zola version is the tool version the skill is validated against and is
+independent of a skill release identity.
 
 The `Commit messages` workflow checks the commit-message contract on pull
 requests and pushes to `main`. Fixture, structural, and published-package

diff --git a/docs/vision.md b/docs/vision.md
@@ -78,7 +78,9 @@ terms are present in the repository. Changes are published from `main` and
 recorded in the git commit history (`what:`/`why:` commit bodies), which the
 commit-message workflow verifies on pull requests and pushes to `main`; this
 repository keeps no `CHANGELOG.md` and does not require GitHub Releases or
-semver tags. `SKILL.md` declares no skill self-version, and
+semver tags on a calendar. The immutable `v1.0.0` tag identifies the first
+consumer release; future tags are event-driven release records, not a cadence.
+`SKILL.md` declares no skill self-version, and
 `metadata.version` is the pinned Zola tool version the skill is validated
 against, not a skill release number.
-Original file line number
+Diff line change
@@ Expand Up / @@ -11,6 +11,7 @@ permissions: @@
     jobs:
       check:
+        name: Commit messages
         runs-on: ubuntu-latest
         steps:
           - uses: actions/checkout@v4
@@ Expand Down @@