[CO-2a] chore: stage civiccore v0.22.1 attested baseline

CHANGELOG.md

@@ -13,6 +13,8 @@ MINOR; bug fixes ship as PATCH.
 
 ## [Unreleased]
 
+## [0.22.1] - 2026-05-05
+
 ### Added
 - `civiccore.release_provenance` now provides the canonical CivicSuite
   release-provenance gate for the Sigstore attestation trust model, including

README.md

@@ -61,7 +61,10 @@ by downstream modules until they ship.
 
 ## Status
 
-**v0.22.0 is the current development-line release.** This line adds a shared
+**v0.22.1 is staged as the first attested baseline release.** This line adds
+the canonical Sigstore release-provenance helper, versioned attestation schema,
+fixture-driven gate, and tag-driven release workflow that signs and verifies
+`release-attestation.json` before publication. It also carries the shared
 connector source-list status projection that combines circuit health, active
 failure counts, pause state, actionable operator copy, and next-run calculation
 for module workspaces on top of shared cron schedule validation helpers for
@@ -113,10 +116,10 @@ shared-schema baseline extracted from CivicRecords AI).
 
 ## Install
 
-From the current GitHub release wheel (`v0.22.0`, once published):
+From the current GitHub release wheel (`v0.22.1`, once published):
 
 ```bash
-pip install https://github.com/CivicSuite/civiccore/releases/download/v0.22.0/civiccore-0.22.0-py3-none-any.whl
+pip install https://github.com/CivicSuite/civiccore/releases/download/v0.22.1/civiccore-0.22.1-py3-none-any.whl
 ```
 
 Each GitHub release also publishes `SHA256SUMS.txt` alongside the wheel and
@@ -133,7 +136,9 @@ signal only; use `scripts/verify-release-provenance.py` and
 `docs/ops/release-signing.md` for release-tag provenance.
 
 The current public `v0.22.0` release is in the Tier 1 correction window because
-its tag is lightweight. Do not republish, mirror, or rely on it as the corrected
+it predates the Sigstore attestation baseline. Treat `v0.22.1` as the staged
+baseline release candidate until the release workflow publishes its attestation
+and bundle. Do not republish, mirror, or rely on `v0.22.0` as the corrected
 provenance baseline until the Tier 1 correction is complete.
 
 For development from a clone:
@@ -516,7 +521,7 @@ Extraction Spec** in
 
 Every CivicSuite module's README declares its CivicCore dependency contract.
 Current v0.1.0 module foundations pin older civiccore lines. Production-depth
-consumers can move to `==0.22.0` once the release is published and the
+consumers can move to `==0.22.1` once the release is published and the
 compatibility matrix is updated. The suite-wide compatibility matrix — which
 module versions work with which CivicCore versions — is maintained at
 [CivicSuite/civicsuite/docs/compatibility/](https://github.com/CivicSuite/civicsuite/tree/main/docs/compatibility).

civiccore/__init__.py

@@ -14,7 +14,7 @@
 
 from __future__ import annotations
 
-__version__ = "0.22.0"
+__version__ = "0.22.1"
 
 from civiccore.audit import (
     AuditActor,

docs/browser-qa-v0221-summary.md

@@ -0,0 +1,32 @@
+# CivicCore v0.22.1 Browser QA Evidence
+
+Date: 2026-05-05
+
+Scope: `docs/index.html` rendered from the `release/v0.22.1-attested-baseline-staging` branch.
+
+## Viewports
+
+- Desktop: 1280 x 900, screenshot `docs/browser-qa-v0221-desktop.png`
+- Mobile: 390 x 844, screenshot `docs/browser-qa-v0221-mobile.png`
+
+## Results
+
+- Page title: `CivicCore v0.22.1 - CivicSuite shared platform library`
+- Main heading: `CivicCore`
+- Status copy includes `v0.22.1 is staged as the first attested baseline release`
+- Install copy includes the `v0.22.1` GitHub wheel URL
+- Browser console messages: none
+- Page errors: none
+- Horizontal overflow: false on desktop and mobile
+- Body contrast ratio: 15.26
+- Link contrast ratio: 6.83
+- Keyboard tab order reaches all documented links
+- Empty image alt count: 0
+
+## Browser Automation Command
+
+The check used bundled Playwright via the workspace Node runtime and opened:
+
+```text
+file:///C:/Users/scott/OneDrive/Desktop/Claude/civiccore/docs/index.html
+```

docs/index.html

@@ -3,8 +3,8 @@
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
-<meta name="description" content="CivicCore v0.22.0 - shared platform library for the open-source CivicSuite municipal operations suite. Not an end-user app. Apache 2.0.">
-<title>CivicCore v0.22.0 - CivicSuite shared platform library</title>
+<meta name="description" content="CivicCore v0.22.1 - shared platform library for the open-source CivicSuite municipal operations suite. Not an end-user app. Apache 2.0.">
+<title>CivicCore v0.22.1 - CivicSuite shared platform library</title>
   <style>
     :root {
       --text: #1f2328;
@@ -178,14 +178,14 @@ <h3>Still planned extraction targets</h3>
 
     <section aria-labelledby="install">
       <h2 id="install">Install</h2>
-      <p>From the current GitHub release wheel (<code>v0.22.0</code>, once published) - civiccore is GitHub-wheel-only, not on PyPI:</p>
-      <pre><code>pip install https://github.com/CivicSuite/civiccore/releases/download/v0.22.0/civiccore-0.22.0-py3-none-any.whl</code></pre>
+      <p>From the current GitHub release wheel (<code>v0.22.1</code>, once published) - civiccore is GitHub-wheel-only, not on PyPI:</p>
+      <pre><code>pip install https://github.com/CivicSuite/civiccore/releases/download/v0.22.1/civiccore-0.22.1-py3-none-any.whl</code></pre>
       <p>For development from a clone:</p>
       <pre><code>git clone https://github.com/CivicSuite/civiccore.git
 cd civiccore
 pip install -e .[dev]</code></pre>
       <p>Each release publishes <code>SHA256SUMS.txt</code> alongside the wheel and sdist. Verify the checksum before promoting an artifact downstream.</p>
-      <p><strong>Release provenance note:</strong> GitHub release pages can show a target commit as Verified even when the release tag itself is lightweight or unsigned. CivicCore now treats tags as release pointers and verifies <code>release-attestation.json</code> plus its Sigstore/cosign bundle as the trust artifact. The exact workflow identity is pinned per repo and per tag; see <code>docs/ops/release-signing.md</code> and <code>docs/ops/release-attestation.schema.json</code>. The current public <code>v0.22.0</code> artifact is held for an additive Tier 1 attestation operation; no release notes or assets may be modified without explicit per-release authorization.</p>
+      <p><strong>Release provenance note:</strong> GitHub release pages can show a target commit as Verified even when the release tag itself is lightweight or unsigned. CivicCore now treats tags as release pointers and verifies <code>release-attestation.json</code> plus its Sigstore/cosign bundle as the trust artifact. The exact workflow identity is pinned per repo and per tag; see <code>docs/ops/release-signing.md</code> and <code>docs/ops/release-attestation.schema.json</code>. The staged <code>v0.22.1</code> baseline release candidate is expected to publish that attestation through the release workflow. The current public <code>v0.22.0</code> artifact is held for an additive Tier 1 attestation operation; no release notes or assets may be modified without explicit per-release authorization.</p>
       <figure style="margin: 2em 0;">
         <img src="diagrams/migration-order.svg" alt="Consumer apps invoke civiccore migrations before their own Alembic chain." style="max-width: 100%; height: auto; display: block; margin: 0 auto;">
         <figcaption style="text-align: center; color: #666; font-size: 0.9em; margin-top: 0.5em;">Migration order - civiccore runs first; consumer chain runs second.</figcaption>
@@ -196,8 +196,10 @@ <h2 id="install">Install</h2>
       <h2 id="status">Status</h2>
       <div class="status">
         <p>
-          <strong>v0.22.0 is the current development-line release.</strong>
-          The current development line adds source-list status projection helpers for connector workspaces,
+          <strong>v0.22.1 is staged as the first attested baseline release.</strong>
+          The current development line adds the canonical Sigstore release-provenance helper,
+          versioned attestation schema, fixture-driven gate, and release workflow that signs and verifies
+          <code>release-attestation.json</code> before publication, plus source-list status projection helpers for connector workspaces,
           cron schedule validation helpers,
           startup config validation helpers,
           vendor delta request planning, reusable mock-city proof contracts, live connector sync retry/circuit-breaker primitives
@@ -247,7 +249,7 @@ <h2 id="api">Public API overview</h2>
       <h2 id="compat">Compatibility</h2>
       <p>
         <strong>Current module foundations span older civiccore lines while newer product-depth consumers already target later releases.</strong>
-          Production-depth consumers can target civiccore v0.22.0 once the compatibility matrix is updated. Every CivicSuite
+          Production-depth consumers can target civiccore v0.22.1 once the compatibility matrix is updated. Every CivicSuite
           module's README declares a CivicCore version range.
         </p>
     </section>

docs/ops/release-signing.md

@@ -210,3 +210,26 @@ auditor output. Auditor decisions become operative only when explicitly written
 in the chat as directives, approvals, or authorizations. Code, PRs, fixtures,
 and runbooks produced by the development swarm are separate artifact classes
 and must preserve that distinction in the audit trail.
+
+## PR Review Report Format
+
+When reporting a PR for audit review, copy review-surface file paths verbatim
+from `git diff --name-only` or `git show --name-only --format=` output. Do not
+retype paths from memory. A mismatched path in a review report is an
+audit-trail-integrity defect even when the underlying artifact is correct,
+because it forces reviewers to spend evidence-gathering effort finding the
+actual file.
+
+## Historical Disclosure Publication
+
+The historical provenance disclosure remains a draft while it is named
+`docs/ops/historical-provenance-draft.md`. Final policy publication is a
+two-step operation in one verified PR:
+
+1. Remove draft-specific language and fill the authorized baseline date and
+   baseline tag.
+2. Rename the file to `docs/ops/historical-provenance.md` so the canonical
+   public disclosure is discoverable without the `-draft` suffix.
+
+Do not publish the disclosure as operative policy until both steps land
+together and the auditor explicitly authorizes publication.

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "civiccore"
-version = "0.22.0"
+version = "0.22.1"
 description = "CivicSuite shared platform package - migrations, shared SQLAlchemy base, LLM abstraction, audit/provenance, ingest and connector contracts, connector sync primitives, connector delta planning, reusable mock-city proof contracts, connector security helpers, startup config validation helpers, schedule validation helpers, encrypted config primitives, notice helpers, onboarding profile helpers, search access helpers, small auth helpers, manifests, exports, and city profile primitives"
 readme = "README.md"
 requires-python = ">=3.11"

tests/test_smoke.py

@@ -4,7 +4,7 @@
 def test_import_civiccore() -> None:
     import civiccore
 
-    assert civiccore.__version__ == "0.22.0"
+    assert civiccore.__version__ == "0.22.1"
     assert civiccore.roles_grant_access
     assert civiccore.access_level_allows
     assert civiccore.filter_records_by_access_level