Publish v0.11.0: canonical onboarding and read-only project entry

CONTRIBUTING.md

@@ -78,7 +78,7 @@ gate against the final checked public candidate on native Windows and native
 Ubuntu:
 
 ```text
-python checks/check_coordinator_release.py <external-candidate-directory> --expected-tag v0.10.0
+python checks/check_coordinator_release.py <external-candidate-directory> --expected-tag v0.11.0
 ```
 
 The gate copies the candidate to temporary build space, builds and installs the

PROJECTION-MANIFEST.sha256

@@ -5,9 +5,9 @@ b2e36dfcfc6eb31570c9340640bcd73abc62f57c80b4794abf36e3d3e89ab34f  .github/depend
 9e90d43615b02a265b08692ef7a1c00a37477a5c6b1e8233a8fc7bedefaedea6  .github/pull_request_template.md
 3c35b31bc2b80d101a3a549da68fec55587b6a6428ce6b32112670276490ce23  .github/workflows/ci.yml
 e544abe8ffd83c81c7b002cbd2e552f9d56f226ea20e1e0722c5d1bdec914fe0  .gitignore
-32800f8e4b24c8bc96ad6ddb80ddb2c523d20719945a3042d81e09a74d3ce301  ADOPTING.md
+3ab922d5b7962f571f0680224a52b55a84c0b0b9a6d1a5dfd775697172338582  ADOPTING.md
 1179c999034f4ec1c1d44c1946bd2955c4625905e80767abe760c8c3ab01c493  CLAUDE.md
-881dc7401aaaa3aa148be143bd3e191fc7f883466027cbc77e47ed4cc8f79b6a  CONTRIBUTING.md
+074908ecfc14027823851f9cea118a985c85dd947c17870a44f9c903cd28a348  CONTRIBUTING.md
 664196054cd98585105be457afa09c788a482416ccb48a87bb269b2156e49ae6  DOCTRINE.md
 9ba9550ad48438d0836ddab3da480b3b69ffa0aac7b7878b5a0039e7ab429411  LICENSE
 a38775f2d68b40577253ee48061ba67af3c75b7620dc506b34b40ce2a3b660ee  LICENSE-MAP.md
@@ -16,21 +16,21 @@ c274f80372d90c012937370f0e1f15087d22e308ef98b27cea5dc0d2d088366c  LICENSES/Apach
 a2010f343487d3f7618affe54f789f5487602331c0a8d03f49e9a7c547cf0499  LICENSES/CC0-1.0.txt
 59746d6285ffa44bfc7ecada352aa5d6a20dc8eab418a60ce091cc739012c135  LICENSES/MIT-0.txt
 35e6d37b7c5fa0c1fc872315cbd362cd24bfa41e1b7dc3019fbcd31e99350f51  NAMING.md
-a4322cd5b31594139c3f5bde2f7442aad89812ba56cdaa32818f976217149544  PROJECTION-PROVENANCE.md
-925d0d79412b04c9a4f80d4adef2f6dd21d76b4492d37f3d1fcf40b20a70c235  PUBLICATION.md
-d76060c70c361a64b52e9df88e400789c24fbc4fecd2b731dfe8a709a34e5e5e  README.md
+3bc783a329e09fb149c0c9f6e8da9187d8bf9a8a753350d54c78900431c7d7d7  PROJECTION-PROVENANCE.md
+5dec4f02eeaef72ea93b66dd548520ef5af6c7d246b261a5c82804da94f71b63  PUBLICATION.md
+bb9083c43def4a803c3f01e296ccbdb0402068ec39145e3ddd892ac3e922eea3  README.md
 284a0862f3be77e8d867aa4d3ef92ed1a64ad4315d6d9074f6bb64771b6d1dd0  REUSE.toml
 ab75b39490b4db4e203f5b23b480a1c998d87cf07d760cb787cb260778b21d0a  SECURITY.md
 6a51c1211cc675599634d144ca24a705ec1696f84640a6464b14efb1d6c3a629  SELF-HOSTING.md
-d9eb0445ef4da08bae1e3a7e81a03e92f2488eee1c1e68254f5c5fc640a99ff8  START-HERE.md
+d4fc267f4ebacad09ef6c357aa339c0fb22e1a9b75392fcf80e3ec3ebff0caf7  START-HERE.md
 75c7ae0f569148f489570d63df916a70b6ccf24b77db2076cdee29663f747428  adapters/claude-code/README.md
 aeb7f81d139e7ffa6de9a1782444b99eb6d549ac1c3a8b9c0f8bcb9c6addfa6d  adapters/claude-code/SECURITY.md
 dd29af2a39d25e0270ad9acc23ee912f81e39c674e1179759f4a3010c6a0c1a0  adapters/claude-code/wo_capability_wall.py
-ecc969827cb19e9d8cba3e7b369ff2b81d6407544f86a12a139b5c482624bbb7  checks/check_coordinator_release.py
-b872c46f8a8ea2fc317b4c4fd0af00c9145012b11256c923987d878d79c726c2  checks/check_distribution.py
+edfc5e7622a7a48c826e8bad5192d072ad3f0e3f29fa897f3e607cb04191cb9d  checks/check_coordinator_release.py
+20df8e937b6efeb7930894b7d4eba42761283b6d0166e78bcabaa2ab6dc75a7c  checks/check_distribution.py
 60fe377dac32b8d1697f859371ef40d26ed4e695fdceeda6d29ec0318d539504  checks/check_identity.py
 30986c40ff7c9b29e2fba39ec04c18af3c1c351490410bd532a8391bcb92ed11  checks/check_licenses.py
-e843892f24360174620fa02f3adf142a5eb5e2aac4bbfea786648f8b49375192  checks/check_name_clearance.py
+6a5162c40e9df9bf198d391a937603907a019e04029298c3567f5e1df647c73b  checks/check_name_clearance.py
 cf7e0c4523ba9335b78c1fe51dd744e5c4806c3f431705df3553f9b37591c2f8  checks/check_public_projection.py
 bb54d108d1dff56291169624d26eac4f44db00ebf98e38bf7e6d56cd9b8d9647  checks/check_work_order_dispatch.py
 b49e8c6fb8ef321e5a8f8b2012a77ab3870df2d4826ecb8fe0b33345d57d060a  decisions/DR-001.md
@@ -42,15 +42,15 @@ d9f01820bd45d8dad46e7fd307e0b6986a41d6cd2071da353530421aeea46f70  decisions/LICE
 fa88788242d920999b6e6737ea60b03dfe3f9ba2e0d90386b6bbcfeb6acd0509  docs/agents/domain.md
 98305d69cb8ff9ebdd44d815248c4619aecc09295891c043e1423d1189888a49  docs/agents/issue-tracker.md
 2177e1dbec58d14cb20e3b15fcb2cfb3ba6671025ba86a72e603c59d5cc09a06  docs/agents/triage-labels.md
-3c7c89cbe276c65fddf565a743042a5c1a58f7dfe0208b3957260177eb327a27  docs/architect-interview.md
+09038d48dfb92a83cc18cdd966dca5ebce8c870f5a74dcb7d47e9a08adefafe4  docs/architect-interview.md
 5200a1511a781cfe49baf10177880cfc6e4e18eb8f9a55ca9e17ab4f9b35a312  docs/assets/writwall-og.png
 55816569390363947ecc7735d7de13a3f59b8dae51f92383967e130b3a56d2a6  docs/assets/writwall-og.svg
 0a5259d80265765aee16a421546e44458a1aabeecfa8c7f7dea8aead6a79655b  docs/assets/writwall-readme-banner-0a5259d8.png
 ad0fb4f671b8da9e3ab9720af7b39ac9c93201e6131c1df996e090a2bb2acc8a  docs/assets/writwall-readme-banner.svg
 7cfd0ae28d07cdfbb367adc4f7e606a1538ebf61ff140a32f8e793028110cedf  docs/bootstrap-charter-addendum.md
-fdab8ed3cbb4f0ac24f9d39565baddea6b83984f698c2c48166b05590aff21ef  docs/day-zero-coordinator.md
+b961435c3e50093e590cdf151de8d4831d35dc7397c665c7fd9e5334d994d4ad  docs/day-zero-coordinator.md
 e1214e3e6018642809339249bb091a6fd754847b4f77c4bc7a39c5c87e6769cc  docs/identity-migration.md
-4d54cd53db8c165b40af7eb11b97a7f4faf5f23479c0efc8238e5d463b159008  docs/name-clearance.md
+b664a305cea2ea7de364df3aa05b9644c334c6ded7e4e0771ae11a512205d4d8  docs/name-clearance.md
 1eef400dd2e12b109ceb9b30c107dbd7f25d3c64182346dd0f370bf9ccaa7088  docs/privacy-screen.md
 55716ad256ad76dd355d10ab872ffcd29b03fbf9651763b21351e813ef89d0c5  examples/README.md
 f5c83009bcb248eccc8e861b5fc52b208a193c0b02293c72c0f4e96fcf3072de  examples/name-clearance-incident-2026-08.md
@@ -62,10 +62,10 @@ d2c5a8ca21edf842dfd17a83862024afa0a92349abf693a60e55ce454c8d78fa  examples/name-
 30cdb11fbeb2fd9bbf4048255331ccbbdd6e516fae5adfa5317af00ce53607c9  governance/ADOPTION-MAPPING.md
 08b235351ab7799715b1e2df4fa3dd9fa88bb85084c8aade4d01039bf255b489  governance/LOG-denials-probes.md
 5dba70f7d7263ecd10ecb2c18867b6c2c5870a3e001c25c7797d3d61feae680a  governance/LOG-denials.jsonl
-0720409460b68d93ae72010abab3162d1cc09cd275ddae6fa309ef7fe7b6eef3  governance/LOG.md
-020bfe95a6b70da6a14dcc63087f1d90f1625fd6c08454ff8951044e04a2b0be  governance/PLAN.md
+ffa9029e76fbe660f9c4eced42b11960bfd96ef0451f7d18e874c349de264aba  governance/LOG.md
+ed0bdab770d734e83debbecc4d740f95018b39a290946d1941e2bbec09f57ee0  governance/PLAN.md
 dd445eb2994e0d9615bc61fe2ae157a6b14ba7b190c65b705d380b31c49fdfe0  governance/ROUTING.md
-acea5eaf4e6dbee69d8e425c2848fd7f324fd67ea3a57f29a953efab46e28ce6  governance/STATE.md
+646887c40607a97b418ec8f09be1c94c51f7eb053bca08908441007a397d31c7  governance/STATE.md
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  governance/archive/.gitkeep
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  governance/briefs/.gitkeep
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  governance/decisions/.gitkeep
@@ -82,24 +82,24 @@ b567ce0c0867464328e81774d888f6491fa66b68ac73be01f993e5c4c66d3ed8  governance/tem
 d355e46f978f17de8824af805e05124e0f20b1c072523b518422044f88c6f079  governance/templates/D-adoption-record.md
 2b586efadab716a59fcafb74312a45a05401a4787fee6ae18cb5c9dd14ef3a09  governance/templates/E-adoption-mapping.md
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  governance/work-orders/.gitkeep
-51963137bf9d19220e4164072e7b3dee7d1312b714494b8728466e22ad8e63c9  identity/legacy-references.json
+9e6cb17ec4a468bdd9e0f60333d9ea77b83579e4f3c7926e87d2ab9b34cc077f  identity/legacy-references.json
 345b7e962731c085a95aea66a344eae000b27c9bde13b0d790c76b73273dbe7a  init.sh
 5c90584642f405534b2071f27396ff293ab01632e4dbb8ccb6b8ec043dca4cc9  migration-guides/0.1-to-0.6.md
 ba4eff258ca5b9a45f3f9f1cbf646ba5bc5521fae812adacac65cd2e78698c9d  migration-guides/0.6-to-0.7.md
 7be9ff49c33830f929584e9e6756f06be8634b1c79ff7210bf5184b51bfc0769  migration-guides/0.7-to-0.8.md
 fafcbf659c40d7260dddaa8a64b6b59c3b7de484f77d879a90323bb4b3e1a4a7  projection/public-files.txt
-1d9014a4540d81ecfd3b2bbe24577c5bc98999b53e3ca8158dd8600744772449  pyproject.toml
+90a4b90139c1a23bbd98a2fb8b150a82cef0c17973d4c445c1206a26eeb4f8b6  pyproject.toml
 455ca1ab3c9e7e78afbb9946e13b94497ba24003ab6f411ea96cce26d4ecc39e  scripts/build_distribution.py
-bdbe47e8ea246ceafb874229d5582a9cc18db7c66250c9873d50a787bd5d9fe2  scripts/build_public_projection.py
+08fa88f3a1de7a26c14c383ea3f18e86838499d9eacb7cf57819fb27c2f20c30  scripts/build_public_projection.py
 3cf88f936599e0e84bc2368bc0503a39b9f96e47b473e09b26569e5c3c9edbd9  scripts/collect_name_clearance.py
 c372f7f1736eb77bedaca43696ea0b060333733f912053479b363442022c4b24  scripts/privacy_screen.py
-c367c7f4397c926701dda0a4118a2e1286787157d7de1d8f51fa207ec50021c4  scripts/start_writwall.py
+61f8f3302322b704a090c6e4b5110c8189687705be244adcdd7d997e2bc0a9a9  scripts/start_writwall.py
 374f4e8a80b7b9e162b9360a3907b6ffe12ce94ba0ed827058c7b3c9c0658b2c  skills/writwall-adopt/LICENSE-MAP.md
 02e75310dca3d528b4c5cd2ee9d8a57a89390365037c941010a6b2c1c9eb918e  skills/writwall-adopt/SKILL.md
 75c7ae0f569148f489570d63df916a70b6ccf24b77db2076cdee29663f747428  skills/writwall-adopt/assets/adapters/claude-code/README.md
 dd29af2a39d25e0270ad9acc23ee912f81e39c674e1179759f4a3010c6a0c1a0  skills/writwall-adopt/assets/adapters/claude-code/wo_capability_wall.py
 7cfd0ae28d07cdfbb367adc4f7e606a1538ebf61ff140a32f8e793028110cedf  skills/writwall-adopt/assets/bootstrap-charter-addendum.md
-e843892f24360174620fa02f3adf142a5eb5e2aac4bbfea786648f8b49375192  skills/writwall-adopt/assets/checks/check_name_clearance.py
+6a5162c40e9df9bf198d391a937603907a019e04029298c3567f5e1df647c73b  skills/writwall-adopt/assets/checks/check_name_clearance.py
 bb54d108d1dff56291169624d26eac4f44db00ebf98e38bf7e6d56cd9b8d9647  skills/writwall-adopt/assets/checks/check_work_order_dispatch.py
 3cf88f936599e0e84bc2368bc0503a39b9f96e47b473e09b26569e5c3c9edbd9  skills/writwall-adopt/assets/scripts/collect_name_clearance.py
 b567ce0c0867464328e81774d888f6491fa66b68ac73be01f993e5c4c66d3ed8  skills/writwall-adopt/assets/templates/A-charter.md
@@ -111,7 +111,7 @@ d355e46f978f17de8824af805e05124e0f20b1c072523b518422044f88c6f079  skills/writwal
 5c90584642f405534b2071f27396ff293ab01632e4dbb8ccb6b8ec043dca4cc9  skills/writwall-adopt/references/migration-guides/0.1-to-0.6.md
 ba4eff258ca5b9a45f3f9f1cbf646ba5bc5521fae812adacac65cd2e78698c9d  skills/writwall-adopt/references/migration-guides/0.6-to-0.7.md
 7be9ff49c33830f929584e9e6756f06be8634b1c79ff7210bf5184b51bfc0769  skills/writwall-adopt/references/migration-guides/0.7-to-0.8.md
-4d54cd53db8c165b40af7eb11b97a7f4faf5f23479c0efc8238e5d463b159008  skills/writwall-adopt/references/name-clearance.md
+b664a305cea2ea7de364df3aa05b9644c334c6ded7e4e0771ae11a512205d4d8  skills/writwall-adopt/references/name-clearance.md
 b567ce0c0867464328e81774d888f6491fa66b68ac73be01f993e5c4c66d3ed8  templates/A-charter.md
 0a0c3c8c2317733b7ca951799de74a045c35d9a944a6448985f023feb49dcb4e  templates/B-work-order.md
 5bfaa890ffddd423644428606753bc2e6562e3e5d67c1dc522172710708a4bf0  templates/C-owner-brief.md
@@ -121,15 +121,15 @@ d355e46f978f17de8824af805e05124e0f20b1c072523b518422044f88c6f079  templates/D-ad
 9924816cbbeade6f88f79d3e06fe04d143d801783888210ac2325925d69e4bdb  tests/test_check_distribution.py
 b046f2eea794070194294a33f2914e627eed384e63fccffc2ac46693db2a968c  tests/test_check_licenses.py
 9a106ff5182b4a15713575de42e90b0dc5cdeebcb17ba08d97522a4c9aa6b2fa  tests/test_check_work_order_dispatch.py
-6fc58f3e82282c51b0604c9bd24808f6f53c9d543fb4d4ccf18ec1fc5a638676  tests/test_coordinator_release.py
-6483f84819c08284b989252f4a40a42e8eca64fec5fda303cec62350c19328d0  tests/test_distribution.py
+a1f3472131beec3cd44fdd389d836a6a86b4269b94226b159e223b602bb8b32f  tests/test_coordinator_release.py
+13478c88a9d9951f4a90ef15fa389fc0bf19894f917cbada62fc366cbe70a635  tests/test_distribution.py
 e150a2f988a4b0beac5f70644f55f5e185a8aa575e988a19642bafabc0f07775  tests/test_identity_migration.py
 11cd8090dbc53e8aa6a2f14cb181c8a11696335da8f40700eae5116798e49ba5  tests/test_init_sh.py
-96c255d84e37b8884cde769897e763776b81027080c2308c33dc5e4b8df4a4bf  tests/test_name_clearance.py
+a2df93f79791a884d9c6c2db308591a3b18e95ee34702ad5330ccc7a4b683fa4  tests/test_name_clearance.py
 677d5b532450ace267be9c834269c081368697cd83defa5531ce673f6d0ca252  tests/test_privacy_screen.py
-ee771c239c0fc072675f88617dec7e330c1e19be90a8b22691d7049dbb5a4544  tests/test_public_projection.py
-2bc96f1dfd6febc1d281494720125602f01293838614ffe9850b3d2a9fb78f6b  tests/test_start_writwall.py
+0d1d5cc19779e3539d46caba978fe18de7af751c8c98fe435dbf2e924860ca81  tests/test_public_projection.py
+ef2ee15da47fa329f00961517d306fc8bfcba1b7514810fe5b006fdbb028e5fe  tests/test_start_writwall.py
 0684c04067eb95eadc9f72ab126d8662b4a5e2005c80b2dea174075a6140eebc  tests/test_wo_capability_wall.py
 e8caf7f4421dc7f78b0d766741ec2ef4c2ac6dab6117fab6e4175b27d31e4d49  writwall_cli/__init__.py
-9e0fbb2625b7a99ed80a3a708f8a0742d91bbf7e3cd2862d21a75515031083e5  writwall_cli/__main__.py
-3d90b5f1e6ec3e0f46a47c04060c84936425861adf66c39a9317cb26689805dc  writwall_cli/coordinator.py
+aee1a6d4437f468c6c21cef95e3e45181ed40ca402a11092fed5db587865c21f  writwall_cli/__main__.py
+76def9691b26cf48f692ae7a921ae3a52f8ccfa302724ad12debec2bf8bf36ac  writwall_cli/coordinator.py

PROJECTION-PROVENANCE.md

@@ -5,14 +5,15 @@ Legacy commit identifiers in projected records refer to that private
 source and are intentionally not resolvable from fresh public history.
 No private remote URL is recorded here.
 
-- Source commit: `be8cfa99b53996d140433610b12886cf62c444f0`
-- Source commit time: `2026-09-03T17:19:47-05:00`
+- Source commit: `c8ad85737b7cd60360cee7561f28d666a9b73080`
+- Source commit time: `2026-09-04T19:05:51-05:00`
 - Projection allowlist SHA-256: `fafcbf659c40d7260dddaa8a64b6b59c3b7de484f77d879a90323bb4b3e1a4a7`
 
 ## Legacy identifier inventory
 
 - `0000000000000000000000000000000000000000` — `checks/check_coordinator_release.py`
 - `11d5960a326750d5838078e36cf38b85af677262` — `tests/test_distribution.py`
+- `2d7b23d33bf945b3e01460a1aaba773b17cf27e2` — `governance/STATE.md`
 - `3d3c42e5aac5ba805825da76410c181273ba90b1` — `.github/workflows/ci.yml`, `tests/test_distribution.py`
 - `5fda3b95a4ea91299a34e894583c3862153e4b97` — `.github/workflows/ci.yml`, `tests/test_distribution.py`
 - `6e165e585f907baf83a787ba5cc71270a5a4652e` — `checks/check_distribution.py`, `governance/decisions/DR-001.md`, `tests/test_distribution.py`
@@ -23,5 +24,5 @@ No private remote URL is recorded here.
 - `a905c87987f31094121c11a3b8163f97ef1abcf4` — `SELF-HOSTING.md`, `governance/STATE.md`, `governance/decisions/DR-001.md`
 - `ba3c0754e5019f1fa93779d110843562cfa07307` — `governance/STATE.md`
 - `d790a2b8d500a1c3a5e10af9f0a78d1c3c3f4e3a` — `governance/STATE.md`
-- `e0cef360843dff38d6a02dd48be8f61b2d2d300e` — `governance/PLAN.md`, `governance/STATE.md`
+- `e0cef360843dff38d6a02dd48be8f61b2d2d300e` — `governance/PLAN.md`
 - `e270fd3235d170a28a21fd198b88857740b74acd` — `governance/STATE.md`

PUBLICATION.md

@@ -13,17 +13,33 @@ point. Before creating a release tag, run this gate against the final external
 candidate on native Windows and native Ubuntu, naming the exact intended tag:
 
 ```text
-python checks/check_coordinator_release.py <candidate-directory> --expected-tag v0.10.0
+python checks/check_coordinator_release.py <candidate-directory> --expected-tag v0.11.0
 ```
 
+For a future GitHub release that is required to be immutable, save the
+platform's release JSON separately and supply it as bounded offline evidence:
+
+```text
+python checks/check_coordinator_release.py <candidate-directory> --expected-tag vX.Y.Z --published-release-json <release.json>
+```
+
+The checker performs no network request. When metadata is supplied, it rejects
+malformed or duplicate fields, a mismatched `tag_name`, and anything other
+than the JSON literal `immutable: true`. Repository release immutability was
+enabled prospectively after v0.10.0. That release is pinned to its published
+commit but GitHub reports it as `immutable: false`; do not describe it as
+platform-immutable. The setting applies to future releases, whose actual
+published metadata must still pass this gate.
+
 The command fails before building unless the canonical intended tag matches
 the candidate's package version. It is network-free. It copies the candidate into temporary build
 space, builds a wheel using the already-provisioned backend declared in
 `pyproject.toml`, creates a fresh virtual environment without assuming the
 host can bootstrap `pip` inside it, installs through the already-provisioned
 host `pip`, checks
-the installed version and help interface, runs the coordinator against a
-disposable external project, verifies the complete create-only handoff, and
+the installed version and help interface, runs `start` and the zero-write
+`inspect` route against disposable external projects, verifies the complete
+create-only handoff, and
 then verifies that the input candidate tree did not change. A pass is release
 readiness evidence; it does not create a tag, GitHub release, or publication.
 
@@ -111,6 +127,17 @@ independently built candidates byte-for-byte. It is derived as follows:
 7. Take the SHA-256 of those encoded bytes; that digest is the complete-tree
    ledger.
 
+Compute it without changing the candidate:
+
+```sh
+python -B scripts/build_public_projection.py --complete-tree-ledger <candidate-directory>
+```
+
+Run this against each bare candidate before adding Git metadata or build
+outputs. Every regular file, including the manifest itself, participates;
+linked entries and newline-bearing paths are rejected. Full-line ordering
+differs from ordering by path. Do not substitute a path-sorted tree hash.
+
 The complete-tree ledger digests two independently built candidates for
 equality; it is not shipped inside the candidate and is distinct from
 `PROJECTION-MANIFEST.sha256`, which enumerates only the allowlisted