aliasfoxkde · Nov 1, 2026 · Oct 29, 2026 · Oct 29, 2026 · Oct 29, 2026 · Oct 29, 2026
diff --git a/.gitforge.yml b/.gitforge.yml
@@ -87,6 +87,10 @@ jobs:
           export CARGO_TARGET_DIR=/tmp/oc-test-target
           export RUSTFLAGS="-D warnings -C debuginfo=0"
           cargo test --doc
+      - name: Prebuilt installer and attestation contract
+        run: |
+          sh -n scripts/install-prebuilt.sh
+          python3 -m unittest discover -s tests -p 'test_*.py' -v
 
   - name: doc
     image: opencodifier-ci-rust:2

diff --git a/.github/CHANGELOG.md b/.github/CHANGELOG.md
@@ -6,6 +6,38 @@ project does not yet guarantee a stable public API — version `0.x`
 releases may break, and every breaking change is recorded in this file
 (and reflected in `docs/DECISIONS.md` where a binding decision moves).
 
+## [0.6.2] — Unreleased
+
+The planned 0.6.2 release will package the current engine/CLI from a clean
+tagged source tree and add a verified prebuilt installation path. It will
+not include model weights in the binary release.
+
+### Added
+
+- Prebuilt CLI installer for Linux x86_64/aarch64 and macOS x86_64/arm64.
+  It verifies the adjacent release attestation, reported platform, file
+  size, SHA-256, clean source record, and binary version before atomically
+  replacing a user-local executable. Installing does not require Rust or
+  Cargo and does not start services.
+- CLI first-run flow (`init`, `doctor`), selectable lane presets, an
+  agent-facing `codify_gate` tool, feedback capture, and reusable CI
+  recipe controls, carried forward from the post-0.6.1 mainline.
+- Certified early exit for the rotation readout, with deterministic
+  release-binary regression coverage.
+- Version identity changes re-key the recorded decision cache hashes; the
+  three affected WASM conformance fixtures are re-recorded with their
+  answers/confidence/outcomes unchanged.
+
+### Release validation
+
+- Gate of record: GitForge pipeline receipt for the release commit.
+- Full target build matrix and per-target attestations: recorded in the
+  attached generated release notes and `sha256sums.txt`.
+- Linux x86_64 prebuilt installation and the 30-check serve/MCP E2E suite:
+  recorded from a disposable Fedora 44 validation environment.
+- Cross-target artifacts are labeled with their actual verification level;
+  targets not run on native hardware are not described as runtime-tested.
+
 ## [0.6.1] — 2026-10-15
 
 > Version note: `v0.6.0` was cut as a draft release and its tag pattern was
@@ -629,7 +661,9 @@ history.
   (563ad3f; folded from Unreleased — this item shipped in 0.1.0 but
   was left unstaged there).
 
-[Unreleased]: https://github.com/aliasfoxkde/OpenCodifier/compare/v0.4.0...HEAD
+[Unreleased]: https://github.com/aliasfoxkde/OpenCodifier/compare/v0.6.2...HEAD
+[0.6.2]: https://github.com/aliasfoxkde/OpenCodifier/compare/v0.6.1...v0.6.2
+[0.6.1]: https://github.com/aliasfoxkde/OpenCodifier/compare/v0.5.0...v0.6.1
 [0.4.0]: https://github.com/aliasfoxkde/OpenCodifier/releases/tag/v0.4.0
 [0.3.0]: https://github.com/aliasfoxkde/OpenCodifier/releases/tag/v0.3.0
 [0.2.0]: https://github.com/aliasfoxkde/OpenCodifier/releases/tag/v0.2.0

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -35,6 +35,8 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
       - run: cargo test --workspace
       - run: cargo test --doc
+      - run: sh -n scripts/install-prebuilt.sh
+      - run: python3 -m unittest discover -s tests -p 'test_*.py' -v
 
   doc:
     runs-on: ubuntu-latest

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -18,7 +18,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.6.1"
+version = "0.6.2"
 edition = "2024"
 # MSRV policy: the oldest stable toolchain the workspace is tested against
 # in CI. Bumps are breaking changes and recorded in .github/CHANGELOG.md.

diff --git a/README.md b/README.md
@@ -125,6 +125,7 @@ are broken into sections — read top-down only as deep as you need.
 
 **Running it**
 
+- [`scripts/install-prebuilt.sh`](scripts/install-prebuilt.sh) — install a verified release binary without Rust or Cargo; supports Linux x86_64/aarch64 and macOS x86_64/arm64.
 - [`recipes/`](recipes/) — runnable graphs + captured responses.
 - [`docs/FORK_LLAMA_SERVER.md`](docs/FORK_LLAMA_SERVER.md) — the
   llama.cpp fork that serves decision rungs.
@@ -152,6 +153,10 @@ are broken into sections — read top-down only as deep as you need.
 - [`docs/OPERATOR_ACTIONS.md`](docs/OPERATOR_ACTIONS.md) — items only
   the operator can do.
 
+**Portable binary installation**
+
+- [Prebuilt binary release and onboarding plan](docs/planning/prebuilt-binary-release-and-onboarding-2026-10-29.md) — audit, installer contract, provenance gates, rollout, and Amortyx integration.
+
 **Research**
 
 - [`docs/RESEARCH.md`](docs/RESEARCH.md) — sectioned research log
@@ -167,12 +172,30 @@ policy): [`docs/planning/`](docs/planning/), including the
 and the [offline campaign](docs/planning/offline-campaign-2026-10-23.md)
 tracker.
 
+## Install a prebuilt CLI
+
+On a supported Linux/macOS host, clone this repository and run:
+
+```sh
+sh scripts/install-prebuilt.sh
+```
+
+The script downloads the pinned stable release binary and its adjacent
+attestation, checks target, SHA-256, source cleanliness, and version, then
+atomically installs `opencodifier` into `~/.local/bin`. It requires `curl`
+and Python 3's standard library; it does **not** install Rust/Cargo, download
+model weights, or start a service. Override the target directory with
+`--install-dir`; select a specific release with `--version vX.Y.Z`. See the
+[binary release plan](docs/planning/prebuilt-binary-release-and-onboarding-2026-10-29.md)
+for the provenance, support, update, rollback, and validation contract.
+
 ## Development
 
 ```bash
 git clone https://github.com/aliasfoxkde/OpenCodifier
 cd OpenCodifier
 just ci        # fmt + clippy (strict) + tests + doc + cargo-deny + aegis
+python3 -m unittest discover -s tests -p 'test_*.py' -v  # binary installer contracts
 just coverage  # line coverage (cargo llvm-cov)
 ```
 

diff --git a/crates/opencodifier-config/Cargo.toml b/crates/opencodifier-config/Cargo.toml
@@ -9,8 +9,8 @@ authors.workspace = true
 description = "Configuration discovery, precedence, and strict validation for OpenCodifier"
 
 [dependencies]
-opencodifier-core = { path = "../opencodifier-core" }
-opencodifier-engine = { path = "../opencodifier-engine" }
+opencodifier-core = { path = "../opencodifier-core", version = "0.6.2" }
+opencodifier-engine = { path = "../opencodifier-engine", version = "0.6.2" }
 serde = { workspace = true }
 serde_json = { workspace = true }
 thiserror = { workspace = true }

diff --git a/docs/PLAN.md b/docs/PLAN.md
@@ -67,6 +67,7 @@ Remaining risks tracked in §6 below.
 | 24 | RESEARCH §15.6 enhancement program | **in progress** (2026-10-07) — items 1–4, 8–10 + §15.8 fold-ins done (ledger: RESEARCH §15.6.1); items 5/6 sized, model-rung options, deferred per the §15.6 note |
 | 25 | The gate program: escalation, lanes, first-run detection, CI/CD | **opened** (2026-10-21) — design `docs/ESCALATION_LANES_PLAN.md`; #188 premise validation first, tasks #188–#197 |
 | 26 | Amortyx pre-router integration + token-reduction stack | **in progress** (2026-10-26) — phase-2 consult LIVE in shadow (§14 of INTEGRATION_AMORTYX.md: consult p50 ~3 ms, task-signal agreement/divergence counters collecting, abstain-degrades verified on provider ranking); dual-arm parity baseline run (dispatch unchanged = arm parity by construction; shadow counters are the labeled evidence for enforce promotion after ≥1 week); token-reduction design of record `docs/planning/token-reduction-router-stack.md` (M1–M8, build queue 1–5) |
+| 27 | Prebuilt binary releases + no-Rust onboarding | **in progress** (2026-10-29) — design of record `docs/planning/prebuilt-binary-release-and-onboarding-2026-10-29.md`; v0.6.1 Linux x86_64 binary passes 30/30 E2E on Fedora but its attestation reports 29 dirty paths; verified installer and provenance contract underway; new clean patch release + Amortyx-Stack integration remain |
 
 ## Phase 2 — schema adapters + fixtures (done, 5952769)
 

diff --git a/docs/RELEASE_NOTES_TEMPLATE.md b/docs/RELEASE_NOTES_TEMPLATE.md
@@ -106,6 +106,7 @@ just release-preflight                 # toolchain readiness per target
 just release-matrix                    # build + stage + attest every target
 just release-verify                    # re-hash every artifact vs its attestation
 just release-notes                     # this file, from the attestations
+just release-set-verify                # exact tag, clean source, complete matrix, checksums
 just ci                                # the gate of record, before tagging
 just e2e                               # the run-tested claim, on the host target
 ```