docs(integration): record 2.2.3 release notes in CHANGELOG (ticket-208)

CHANGELOG.md

@@ -1,3 +1,32 @@
+## [2.2.3] - 2026-10-25
+
+### Added
+- Governed publication completion: on a clean synchronized base with a
+  pre-bumped release, `goal -a` finishes the waited-for registry publication
+  (tag + upload) without creating a commit, and reports it explicitly.
+- Registry-baseline fallback: when a publish-only release leaves no tag on the
+  base branch, a tree version newer than the published registry version counts
+  as pending publication.
+
+### Changed
+- Version-spec discovery skips tooling caches and governed runtime state
+  (`.pytest_cache`, `.subactor`, `.worktrees`), so release-evidence snapshots
+  are never learned as version carriers.
+- An explicit non-empty `versioning.files` projection is authoritative;
+  auto-detection is bootstrap-only and never replaces it.
+- Governed targets load the frozen `goal.yaml` from every command, so
+  auto-detection can no longer rewrite a protected configuration as a side
+  effect of `goal publish` or other subcommands.
+- A `__version__` assignment with a non-literal right-hand side is an observed
+  contract (not managed, no selector error), supporting dynamic discovery.
+- Unreleased sources after the last tag now fail with an actionable
+  "requires a release ticket" message instead of the confusing clean
+  force-publish validation.
+
+### Fixed
+- Publish-completion runs no longer attempt a pull-request epilogue, which
+  previously pushed an empty synthetic branch and could orphan it.
+
 ## [2.2.0] - 2026-09-05
 
 - Add `goal dependencies --catalog FILE --check` and transactional `--update` for explicitly catalogued stable PyPI packages in uv lockfiles.

project/TICKETS.md

@@ -274,4 +274,5 @@ This file indexes governance tickets without taking ownership of
 | **ticket-205** | [`README.md`](./ticket-205/README.md) | - | - | - | - | - |
 | **ticket-206** | [`README.md`](./ticket-206/README.md) | - | - | - | - | - |
 | **ticket-207** | [`README.md`](./ticket-207/README.md) | - | - | - | - | - |
+| **ticket-208** | [`README.md`](./ticket-208/README.md) | - | - | - | - | - |
 <!-- AUTO:TICKET_INDEX:END -->

project/ticket-208/README.md

@@ -0,0 +1,20 @@
+# Ticket 208: Record 2.2.3 release notes in CHANGELOG
+
+- **ID**: ticket-208
+- **Owner**: unresolved:human
+- **Status**: IN_PROGRESS
+- **Workflow state**: EDIT
+- **Created**: 2026-10-24
+
+## Goal and scope
+
+To be completed from human-owned input.
+
+## Acceptance criteria
+
+- [ ] AC-01: Scope is approved by a human owner.
+
+## Tracking boundary
+
+This directory contains the minimal reviewed intent. Optional participant prose
+and raw command logs are not required delivery output.

project/ticket-208/intent.json

@@ -0,0 +1,79 @@
+{
+  "schema": "new-project.intent/v3",
+  "ticket": "ticket-208",
+  "summary": "Record 2.2.3 release notes in CHANGELOG",
+  "workstream": "integration",
+  "classification": {
+    "kind": "SERVICE",
+    "priority": "P2",
+    "origin": "requested"
+  },
+  "allowedPaths": [
+    "project/ticket-208/**",
+    "TODO.md",
+    "project/TICKETS.md",
+    "CHANGELOG.md"
+  ],
+  "forbiddenPaths": [
+    "project/ticket-*/user-*.md"
+  ],
+  "stacks": [],
+  "dependsOn": [],
+  "conflictsWith": [],
+  "integrationTicket": null,
+  "delivery": {
+    "acceptedBaseSha": "62cb4c8979c10b012bbb715987aa19039aa6c6c4",
+    "targetBranch": "main",
+    "outcome": "CHANGELOG gains the 2.2.3 entry documenting the governed publication completion, registry-baseline fallback, cache-safe discovery, frozen-config guarantee, dynamic __version__ contracts, unreleased-sources message and the epilogue fix.",
+    "nonGoals": [
+      "No source or version changes",
+      "No README edits in this ticket"
+    ],
+    "complexity": "XS",
+    "estimatedMinutes": 10,
+    "budgets": {
+      "maxImplementationFiles": 1,
+      "maxAffectedComponents": 1,
+      "maxPublicInterfaceChanges": 0,
+      "maxRuntimeDependencies": 0
+    },
+    "architecture": {
+      "status": "accepted",
+      "decision": "Documentation-only delta in the existing changelog file.",
+      "components": [
+        {
+          "name": "goal-changelog",
+          "paths": [
+            "CHANGELOG.md"
+          ]
+        }
+      ],
+      "responsibilityChanges": false,
+      "interfaceChanges": [],
+      "dataChanges": [],
+      "ui": {
+        "impact": "none",
+        "states": [],
+        "evidence": []
+      },
+      "rollback": "Protected revert of CHANGELOG.md; no data migration."
+    },
+    "runtimeDependencies": [],
+    "validation": [
+      {
+        "criterion": "AC-01",
+        "commands": [
+          "git diff shows only CHANGELOG.md delta besides ticket carriers"
+        ],
+        "evidence": "receipt:goal208/changelog"
+      },
+      {
+        "criterion": "AC-02",
+        "commands": [
+          "./project/governance-check.sh"
+        ],
+        "evidence": "receipt:goal208/governance-check"
+      }
+    ]
+  }
+}