chore(release): prepare v0.1.4 notes and identity

.fulmen/app.yaml

@@ -12,6 +12,6 @@ app:
   # Config file name (without extension); resolves to ~/.config/3leaps/decernor.yaml.
   config_name: decernor
   description: "Local key-material hygiene and readiness checks"
-  version: "0.1.3"
+  version: "0.1.4"
 metadata:
   repository_category: cli

CHANGELOG.md

@@ -6,6 +6,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.1.4] - 2026-08-20
+
+Signed cut. Same two-phase provenance walk as v0.1.3. Toolchain and
+landing-page notes catch up; no new CLI verbs.
+
 ### Changed
 
 - README provenance story describes the signed two-phase cut and the
@@ -68,5 +73,6 @@ release is the intended publish shape for this cut.
 - Upstream baseline changelog and release-note history inherited from the
   template.
 
+[0.1.4]: https://github.com/3leaps/decernor/releases/tag/v0.1.4
 [0.1.3]: https://github.com/3leaps/decernor/releases/tag/v0.1.3
 [0.1.2]: https://github.com/3leaps/decernor/releases/tag/v0.1.2

README.md

@@ -237,7 +237,7 @@ Inserter: [`keys/README.md`](keys/README.md).
 ## Verify a signed release
 
 Consume fingerprints, not secrets. Per-cut commands live in
-[`docs/releases/v0.1.3.md`](docs/releases/v0.1.3.md).
+[`docs/releases/v0.1.4.md`](docs/releases/v0.1.4.md).
 
 Download the release assets (archives, signed SUMS, exported publics,
 staged pin pair). Verify SUMS signatures, then:

RELEASE_NOTES.md

@@ -1,19 +1,25 @@
 # Release Notes
 
 Landing page for the latest Decernor cut. Per-cut payload:
-[`docs/releases/v0.1.3.md`](docs/releases/v0.1.3.md).
+[`docs/releases/v0.1.4.md`](docs/releases/v0.1.4.md).
 
-## v0.1.3 — 2026-08-18
+## v0.1.4 — 2026-08-20
+
+Signed cut. Same two-phase walk as v0.1.3: tag, then `make release` on an
+operator host. Pins in `keys/expected-fingerprints.txt` are produced by
+`decernor fingerprint` (not hand-typed) and copied into `dist/release/`
+**before** checksums.
 
-First **signed** private release. Pins in `keys/expected-fingerprints.txt`
-are produced by `decernor fingerprint` (not hand-typed) and copied into
-`dist/release/` **before** checksums, then signed with the rest of the
-payload.
+CI and Release run `goneat-tools-runner-glibc:v0.5.2` (goneat `v0.5.16`).
+The README provenance story matches that walk.
 
 Signing uses `DECERNOR_*` environment variables only. No key paths live
 in this repository.
 
-Still private. Draft GitHub release until a maintainer undrafts.
+## v0.1.3 — 2026-08-18
+
+First signed cut. The repository was private for that tag. See
+[`docs/releases/v0.1.3.md`](docs/releases/v0.1.3.md).
 
 ## v0.1.2 — 2026-08-18
 

VERSION

@@ -1 +1 @@
-0.1.3
+0.1.4

docs/releases/README.md

@@ -2,5 +2,6 @@
 
 Per-cut notes for tagged releases. Landing page: [`RELEASE_NOTES.md`](../../RELEASE_NOTES.md).
 
-- [v0.1.3](v0.1.3.md) — first signed private cut
+- [v0.1.4](v0.1.4.md) — signed cut; toolchain and provenance notes
+- [v0.1.3](v0.1.3.md) — first signed cut
 - [v0.1.2](v0.1.2.md) — first tagged snapshot (unsigned)

docs/releases/v0.1.3.md

@@ -1,6 +1,6 @@
 # v0.1.3 — 2026-08-18
 
-First **signed** private release.
+First signed cut. The repository was private for this tag.
 
 Fingerprint pins are generated with `decernor fingerprint` on exported
 public files and staged into the checksum set before signing. Bindings
@@ -10,11 +10,9 @@ are `DECERNOR_*` environment variables only.
 `fingerprint`/`fp`, `validate`, `readiness validate-config`, `version`,
 `envinfo`, `doctor`.
 
-Still private. Do not treat an undrafted GitHub release as a public launch.
+## Verify a signed release
 
-## Verify a draft
-
-Download the draft assets: archives, `SHA256SUMS` / `SHA512SUMS` and their
+Download the release assets: archives, `SHA256SUMS` / `SHA512SUMS` and their
 signatures, exported publics, and the staged pin pair
 (`expected-fingerprints.txt`, `expected-fingerprints.ndjson`). Check the
 signatures on the SUMS, then check the SUMS against the files.

docs/releases/v0.1.4.md

@@ -0,0 +1,37 @@
+# v0.1.4 — 2026-08-20
+
+Signed cut. Same two-phase provenance walk as v0.1.3.
+
+**Shipped verbs** are unchanged: `scan`, `guardread`, `fingerprint`/`fp`,
+`validate`, `readiness validate-config`, `version`, `envinfo`, `doctor`.
+
+This cut catches the landing-page provenance story up to the signed walk
+and refreshes the CI toolchain (`goneat-tools-runner-glibc:v0.5.2`,
+goneat `v0.5.16`). Direct `spf13/pflag` is `v1.0.10`. Indirect
+`fulmenhq/crucible` is `v0.4.18`.
+
+Fingerprint pins are generated with `decernor fingerprint` on exported
+public files and staged into the checksum set before signing. Bindings
+are `DECERNOR_*` environment variables only.
+
+## Verify a signed release
+
+Download the assets: archives, `SHA256SUMS` / `SHA512SUMS` and their
+signatures, exported publics, and the staged pin pair
+(`expected-fingerprints.txt`, `expected-fingerprints.ndjson`). Check the
+signatures on the SUMS, then check the SUMS against the files.
+
+Recompute fingerprints from the **exported publics** and compare them to
+the two-line pin file. Do not hand-type hex.
+
+```sh
+decernor fingerprint decernor-release-signing-key.asc \
+  --class public --kind gpg --format json --path-mode none --gpg-role primary
+decernor fingerprint decernor-minisign.pub \
+  --class public --kind minisign --format json --path-mode none
+```
+
+The GPG primary fingerprint and the minisign public-blob SHA-256 must
+match the `gpg` and `minisign` lines in `expected-fingerprints.txt`.
+See `keys/README.md` and
+`docs/decisions/PDR-0001-committed-signing-anchors.md`.

internal/assets/appidentity/app.yaml

@@ -12,6 +12,6 @@ app:
   # Config file name (without extension); resolves to ~/.config/3leaps/decernor.yaml.
   config_name: decernor
   description: "Local key-material hygiene and readiness checks"
-  version: "0.1.3"
+  version: "0.1.4"
 metadata:
   repository_category: cli