docs: record the verified v0.4.1 provenance

[wonkwonlee]

v0.4.1 is live: all five packages published, and the claim this repository has been careful not to make until now is finally checkable.

What was verified, not assumed

Every 0.4.1 attestation decodes to the same source:

workflow: .github/workflows/publish.yml
repo:     https://github.com/wonkwonlee/ChangeSafe
ref:      refs/tags/v0.4.1
commit:   bafdeeb601828a1b3544fae9909a8a0a61eeda1b

npm audit signatures against a throwaway install reports verified registry signatures and verified attestations for the whole tree. The registry-installed CLI was then exercised end to end:

• changesafe --version → 0.4.1
• gating a destructive Terraform plan → exit 1, blocked=true, CRITICAL
• import { KubernetesSnapshotSchema } from '@changesafe/domain-kubernetes' under Node ESM → works, which is the exact defect that forced the v0.3.1 patch

This is the project's first release with provenance.

What the docs now say

• README points readers at npm audit signatures rather than asking them to trust a paragraph — appropriate for a project whose thesis is that claims should be checkable — and states that 0.4.0 is an incomplete set: the three packages published there are genuine and attested, but the CLI and the Kubernetes domain do not exist at that version.
• LAUNCH records the verification with its date, so the posting checklist's "state package provenance honestly" has something concrete behind it.
• MEMORY was a month stale (still describing v0.3.1 as current). It now records v0.4.1, why v0.4.0 could not simply be retried — a release event runs the workflow at the tagged commit — and that publishing is resumable.

Nothing here changes product code.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
change-safe	Ready	Preview	Aug 7, 2026 1:53am

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0c538025d3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[wonkwonlee]

Fixed in 5b53fe1 — the finding was right, and it was the kind of imprecision this repository should be least tolerant of.

MEMORY.md contradicted itself one bullet apart: it called v0.4.1 "the project's first release with provenance" and then recorded that three packages reached the registry during the failed v0.4.0 run — packages that are attested. v0.4.1 is the first release where all five are.

It now reads:

This is the first complete set the project has published with provenance — the three packages that reached the registry during the failed v0.4.0 run were attested too, so v0.4.1 is the first release where all five are.

While auditing every provenance statement for the same problem I also tightened the README, which said the 0.4.0 packages were "genuine" without saying they were attested. It now says "those three are genuine and attested, but the set is incomplete", so the same fact reads the same way in both places. LAUNCH.md and the v0.4.1 release notes were already consistent.

A project that tells readers to run npm audit signatures rather than trust its prose does not get to overstate its own provenance history in the durable record.