RC-04: publish immutable relocation bootstrap release candidate

[skylarbpayne]

RC-04

Publishes immutable hermes-workflows==0.0.1rc1 after the merged registry-location and package-resource foundations. Release/build metadata only; no runtime Python behavior changes.

Immutable anchors

• Base / merged framework SHA: d99da904455a33a0406062289cad5ce5cea17fe2
• FND-REGLOC consumed: ad9e83091d72cab2f79b8324944d1dea4b740951
• FND-PKG consumed: e1e7a09e0c52702b4ab93e9a70520fd5ede4f9e3
• RC source/head: aa1ed739681f500b84cf76a5e7d81df01f2b7796
• Excluded PR feat: support custom select values in review queue #131 head fc9eb5ae0797c5cbdfcf51d6b9be551e6ba85331 remains outside ancestry.

Artifact receipt

• Version: 0.0.1rc1
• Wheel: hermes_workflows-0.0.1rc1-py3-none-any.whl
• Size: 183555 bytes
• SHA-256: 9995dfcdfbb05057d21401896d94f3fdc9e89891f18fe6f6f6097c616e595ba2
• Immutable release: https://github.com/skylarbpayne/hermes-workflows/releases/tag/v0.0.1rc1
• Immutable wheel URL: https://github.com/skylarbpayne/hermes-workflows/releases/download/v0.0.1rc1/hermes_workflows-0.0.1rc1-py3-none-any.whl
• GitHub release API: immutable=true; asset digest sha256:9995dfcdfbb05057d21401896d94f3fdc9e89891f18fe6f6f6097c616e595ba2
• Wheel METADATA version: 0.0.1rc1
• Package-resource identity: sha256:8c7dc41504681d7acdc0b1a9e085e99fb4445c2e5440e6ea29077fb599aec3fc

The wheel was downloaded from the immutable URL into a clean temporary directory. Retrieval returned the same 183555-byte SHA-256. A fresh Python 3.11 venv installed only that wheel with --no-deps; importlib.metadata.version("hermes-workflows") returned 0.0.1rc1, import resolved inside the clean venv, and foundation_manifest() matched the packaged canonical resource and ownership key. The temporary wheel/venv were removed after verification.

Verification

• Focused: 90 passed, 1 skipped
• Python 3.9 full: 675 passed, 1 skipped
• Python 3.11 full: 674 passed, 2 skipped
• Clean committed-source rm -rf dist && uv build: wheel hash/size exactly matched the release receipt
• Wheel contents/METADATA/manifest identity verified
• Workflow YAML parsed; referenced actions/*@v6 tags exist
• git diff --check: clean
• Exact diff from base:
  • .github/workflows/test.yml
  • docs/releases/0.0.1rc1.json
  • pyproject.toml
  • src/hermes_workflows/plugin_payload_manifest.v1.json
• High-confidence secret/private-host-path scan across wheel and release metadata: clean
• Full-suite run: https://github.com/skylarbpayne/hermes-workflows/actions/runs/29374779948
  • Python 3.9: passed — https://github.com/skylarbpayne/hermes-workflows/actions/runs/29374779948/job/87225809505
  • Python 3.11: passed — https://github.com/skylarbpayne/hermes-workflows/actions/runs/29374779948/job/87225809488
  • RC build/hash/identity + CI artifact: passed — https://github.com/skylarbpayne/hermes-workflows/actions/runs/29374779948/job/87226078735
• Docs build: passed — https://github.com/skylarbpayne/hermes-workflows/actions/runs/29374779912/job/87225808115 (deploy correctly skipped on PR)

Rollback and mutation receipt

A bad RC is superseded by a new version; bytes at v0.0.1rc1 are never replaced. Roll back source metadata by reverting this PR while preserving immutable release evidence.

No Palmer repository, profile, registry, database, service, live runtime, cron, or user data was mutated. Repository immutable-release enforcement was enabled before publication so the tag and asset became immutable at publish time.

Do not merge yet. Fresh independent RC-04-SR, then RC-04-QR, must review this exact head.