5pm 0.1.0

data/docs/live-validation-report.json

@@ -0,0 +1,177 @@
+{
+  "result": "passed",
+  "version": "0.1.0",
+  "checked_at": "2026-10-30T18:54:14Z",
+  "evidence_commit": "8c23afad10bb7c66166012f9c6dff669d26972cf",
+  "worktree_dirty": true,
+  "source_sha256": "78dc8399633fc1f848b5cde1fc86f5a2b5b562a54bb921318f5cfc1583522459",
+  "disposable_tenant": true,
+  "mutations_enabled": true,
+  "release_evidence": false,
+  "api_operations_verified": [
+    "activity.add",
+    "activity.attachFiles",
+    "activity.downloadFile",
+    "activity.getById",
+    "activity.getFilesList",
+    "activity.getList",
+    "activity.remove",
+    "activity.removeFile",
+    "activity.update",
+    "authentication.getAuthorizedUser",
+    "authentication.isSsl",
+    "authentication.nop",
+    "authentication.signIn",
+    "authentication.signOut",
+    "projects.add",
+    "projects.getAll",
+    "projects.getById",
+    "projects.getList",
+    "projects.remove",
+    "projects.update",
+    "projectsgroups.add",
+    "projectsgroups.getAll",
+    "projectsgroups.getById",
+    "projectsgroups.remove",
+    "projectsgroups.update",
+    "tasks.add",
+    "tasks.getById",
+    "tasks.getList",
+    "tasks.remove",
+    "tasks.update",
+    "users.add",
+    "users.getAll",
+    "users.getAuthorizedUser",
+    "users.getByEmail",
+    "users.getById",
+    "users.remove",
+    "users.update"
+  ],
+  "api_operations_missing": [],
+  "reports": [
+    {
+      "check": "live_reads",
+      "passed": true,
+      "report": {
+        "result": "passed",
+        "checks": [
+          "contract.authentication",
+          "contract.projects",
+          "contract.tasks",
+          "contract.projectsgroups",
+          "contract.activity",
+          "contract.users",
+          "contract.schema",
+          "authentication.authorized_user",
+          "authentication.nop",
+          "authentication.isSsl",
+          "projects.list",
+          "projects.get",
+          "projects.pagination",
+          "project_groups.list",
+          "tasks.list",
+          "tasks.get",
+          "tasks.pagination",
+          "activity.list",
+          "activity.get",
+          "activity.pagination",
+          "users.list",
+          "users.get",
+          "projects.getAll",
+          "users.getAuthorizedUser",
+          "users.find_by_email",
+          "activity.files",
+          "mcp.stdio",
+          "cleanup.no_disposable_records"
+        ],
+        "mutations_tested": false
+      },
+      "diagnostics": []
+    },
+    {
+      "check": "live_mutations",
+      "passed": true,
+      "report": {
+        "result": "passed",
+        "checks": [
+          "project_groups.create",
+          "project_groups.update",
+          "projects.create",
+          "projects.update",
+          "tasks.create",
+          "tasks.update",
+          "activity.create",
+          "activity.update",
+          "project_groups.get",
+          "projects.get",
+          "tasks.get",
+          "activity.get",
+          "mcp.all_read_tools",
+          "activity.delete",
+          "tasks.delete",
+          "projects.delete",
+          "project_groups.delete",
+          "mcp.approval",
+          "mcp.projects.create",
+          "mcp.tasks.create",
+          "mcp.projects.update",
+          "mcp.projects.get",
+          "mcp.tasks.update",
+          "mcp.tasks.get",
+          "mcp.tasks.delete_denied",
+          "mcp.tasks.delete",
+          "mcp.projects.delete_denied",
+          "mcp.projects.delete",
+          "mcp.audit"
+        ],
+        "mcp_tools_verified": [
+          "five_pm_create_projects",
+          "five_pm_create_tasks",
+          "five_pm_delete_projects",
+          "five_pm_delete_tasks",
+          "five_pm_get_activity",
+          "five_pm_get_project_groups",
+          "five_pm_get_projects",
+          "five_pm_get_tasks",
+          "five_pm_get_users",
+          "five_pm_list_activity",
+          "five_pm_list_project_groups",
+          "five_pm_list_projects",
+          "five_pm_list_tasks",
+          "five_pm_list_users",
+          "five_pm_update_projects",
+          "five_pm_update_tasks"
+        ],
+        "cleanup": true
+      },
+      "diagnostics": []
+    },
+    {
+      "check": "live_attachments_users",
+      "passed": true,
+      "report": {
+        "result": "passed",
+        "checks": [
+          "users.create",
+          "users.update",
+          "users.get",
+          "users.delete",
+          "activity.attach_files",
+          "activity.files",
+          "activity.download_file",
+          "activity.delete_file"
+        ]
+      },
+      "diagnostics": []
+    },
+    {
+      "check": "live_cleanup",
+      "passed": true,
+      "report": {
+        "result": "passed",
+        "cleanup_verified": true
+      },
+      "diagnostics": []
+    }
+  ]
+}

data/docs/live-validation.md

@@ -0,0 +1,109 @@
+# Disposable-account validation
+
+Live validation is optional and runs only when Stan requests it. It is not a release
+or CI prerequisite and requires no ongoing subscription. Historical results remain
+valid records of their original runs. See [release policy](releasing.md) and
+[cached validation](cached-validation.md) for owner-controlled refreshes.
+
+Live validation on 2026-10-30 exercised both packages using a disposable tenant.
+Reports and fixtures exclude its hostname, credentials, session tokens, record IDs,
+account payloads and attachment contents.
+
+## Qualification prerequisites
+
+Before live qualification, independently verify the designated disposable tenant is
+active, isolated from production, and contains no business records requiring
+preservation. Verify the credential is Cora's standard User, not Admin. Owner
+confirmation alone does not replace these read-only checks. Do not change roles,
+create replacement users or elevate privileges without separate authorization.
+
+Run the sandbox preflight first, then compare the tenant's six WSDL inventories and
+XSD against the snapshots before running the documented bounded mutation suite.
+Operate only on newly created labelled records; verify attachment removal, deletion
+readbacks, zero labelled leftovers and session cleanup. Stop on unverified isolation,
+permissions or cleanup. Record failures and the exact tested commit without secrets
+or account payloads. Live testing remains opt-in and is never part of CI.
+
+On 2026-10-30 qualification stopped before the sandbox/contract/mutation suite:
+the supplied test credential was Admin, the saved browser session was signed out,
+and independent isolation/record inventory could not be completed. Read-only
+role-verification sessions were closed. No new qualification success is claimed.
+A securely supplied standard User account and independent tenant verification are
+required to resume. The earlier historical report remains development evidence.
+
+## Reproduce
+
+Inject `FIVE_PM_HOST`, `FIVE_PM_LOGIN` and `FIVE_PM_PASSWORD` from an environment or
+secret manager. Set `FIVE_PM_SANDBOX=1` and `FIVE_PM_SANDBOX_HOST` to the same host.
+Run `bundle exec ruby bin/live-check` for read-only validation. Authentication creates
+temporary API sessions, which the suite closes.
+
+For explicitly authorized disposable CRUD checks, also set
+`FIVE_PM_ALLOW_MUTATIONS=1` and run `bundle exec ruby bin/live-check --mutations`.
+This creates labelled temporary records, a reserved-domain test user, and a tiny
+synthetic text attachment. It deletes those records, checks the attachment's exact
+bytes, verifies missing-record errors and confirms no labelled records remain.
+Never enable this against a production tenant. Live tests are not part of CI.
+
+The single JSON report identifies the base commit, dirty-worktree status and a
+SHA-256 digest of the tested source. The digest covers the sorted Git tracked and
+untracked, non-ignored files as `path`, NUL, byte length, NUL, then file bytes;
+`docs/live-validation-report.json` itself is excluded. It is development evidence,
+not a fresh validation of a different source commit. `bin/release-check` does not require live evidence.
+
+The harness records successful transport operation names only, including calls made
+by the actual stdio process. With `--mutations`, it fails unless every one of the
+37 inventoried SDK operations was exercised. The report lists both verified and
+missing operations. It also requires a successful live call to every one of the
+16 tools advertised by the mutation-enabled MCP server (10 reads, six writes).
+No arguments, record IDs, return payloads or credentials enter this operation audit.
+
+The web UI normally shows only the original demo data after verification because
+all labelled test records are deleted. Write verification includes read-after-update
+assertions, post-delete failures and a final scan for leftover records; it does not
+depend on retaining records in the UI.
+Attachment removal requires a successful deletion result and a new attachment-list
+request showing the target file is absent before parent-record cleanup begins.
+Subprocess deadlines cover process exit and pipe draining; timed-out process groups
+are killed and reaped rather than waiting indefinitely in Open3 cleanup.
+Cleanup entries remain tracked until both a successful deletion result and absence
+are verified. False results and failed readbacks preserve entries for recovery.
+Users/groups use generic API errors for missing records, so their complete getAll
+lists must independently confirm absence. Cleanup first checks whether an earlier
+deletion already succeeded before sending another deletion request.
+
+## Verified scope
+
+- Six account-specific WSDL POST operation inventories and the XSD model inventory
+  match the public snapshots.
+- Sign-in/out, authorized-user readers, SSL check, no-op, all resource lists and
+  individual reads, email lookup, and bounded offset pagination.
+- Create/update/get/delete of disposable projects, tasks, project groups, activity
+  and a user; the test user uses a reserved `.invalid` email address.
+- Attachment upload with explicit base64 content, metadata listing, bounded binary
+  download with byte-for-byte verification, and deletion.
+- Actual MCP stdio initialization, discovery, all five list tools and default write
+  denial; embedded project/task creation, update, get and deletion with exact per-call
+  approval, denied reuse, rejected agent booleans and redacted audit fields.
+- Offline schema/protocol/security regressions, package installation checks and
+  the supported Ruby 3.2/3.3/3.4/4.0 matrix.
+
+## Observed differences from the WSDL
+
+- JSON results use `data` instead of WSDL response-part names. Reader views map
+  these to the operation's declared part; raw JSON is retained unchanged.
+- `User.canViewProfiles` is a JSON boolean despite the XSD string declaration.
+  Both strings and booleans are retained in their original representation.
+- Project/task deletion returns an integer marker; group/activity deletion returns
+  a boolean. Integer markers are preserved without assigning undocumented meaning.
+- API errors can arrive with HTTP 200 and numeric `code` plus `message`, including
+  code 0 for missing required parameters and code 441 for missing records. Only
+  the numeric code is exposed; remote messages are discarded.
+- User creation accepts symbolic role names (the suite uses `user`) and rejects
+  the numeric role representations shown in the help reference.
+- `nop` returns `data: null`. File downloads return binary bytes despite JSON options.
+
+Dates remain exact strings; no timezone inference or conversion is performed.
+Retries, rate limits, transport failures and malformed schemas are tested with
+synthetic responses rather than inducing failures or load on the live account.
+Publication, hosted-CI acceptance and accepted-commit release evidence remain separate gates.

data/docs/mcp-plan.md

@@ -0,0 +1,19 @@
+# Standalone MCP adapter status
+
+Tracks [issue #4](https://github.com/scarver2/5pm-ruby/issues/4).
+The separately packaged implementation lives in `mcp/`; see its README for setup,
+security boundaries, supported tools and test commands.
+
+Implemented with synthetic regression tests and disposable-account checks:
+
+- Official MCP Ruby SDK for protocol handling; no MCP dependency in the core gem.
+- Read-only stdio executable and allowlisted resource tools.
+- Optional embedded task/project mutations require explicit enablement and a trusted
+  per-request approval callback over immutable exact arguments.
+- Redacted responses/errors and audit events, bounded frames/pages, and no URL fetching.
+- Real stdio integration tests, executable tests, and isolated installed-package checks.
+- Generic host setup usable by Rodeo/A1Web without integration-specific dependencies.
+
+Live verification also covers the actual stdio executable and project/task mutation
+tools, including fresh operator approval and denied calls. See [live validation](live-validation.md).
+Remaining: source review, accepted-commit release evidence, and explicit approval before publication.

data/docs/release-preparation/0.1.0-manual-artifacts.json

@@ -0,0 +1,112 @@
+{
+  "status": "preparation_only_blocked",
+  "publication_authorized": false,
+  "proposed_version": "0.1.0",
+  "source_commit": "9322e03f75604d7279775dc88c9192add840e76e",
+  "source_date_epoch": 1793399403,
+  "source_worktree_clean": true,
+  "changelog_state": "0.1.0 \u2014 unreleased",
+  "runtime": {
+    "ruby": "4.0.9",
+    "rubygems": "4.0.23",
+    "bundler": "4.0.23"
+  },
+  "supported_ruby": [
+    "3.2",
+    "3.3",
+    "3.4",
+    "4.0"
+  ],
+  "source_ci_run": 41138526407,
+  "source_ci_conclusion": "success",
+  "independent_rebuild_byte_identical": true,
+  "isolated_install_and_load": "passed",
+  "names_public_api_status": {
+    "5pm": 404,
+    "5pm-mcp": 404
+  },
+  "manual_authentication": "Sheriff existing local credentials only; no Cora access or token issuance; actual account/key scopes unverified",
+  "blockers": [
+    "One leftover labelled User requires owner cleanup and independent read-only verification",
+    "users.update API code 8; attachments not qualified",
+    "Required exact-source docs/live-validation.json absent/incomplete",
+    "Changelog still unreleased; dated final source must be rebuilt and requalified",
+    "Final exact artifact/candidate acceptance and separate Sheriff push authorization absent"
+  ],
+  "artifacts": [
+    {
+      "name": "5pm",
+      "file": "5pm-0.1.0.gem",
+      "sha256": "160b09db75dd1cf0aebac21e64f0f6a1216ea437c3155816481a1c7f0faff0e6",
+      "files": [
+        "CHANGELOG.md",
+        "LICENSE",
+        "README.md",
+        "SECURITY.md",
+        "docs/api-support.md",
+        "docs/implementation-guides.md",
+        "docs/implementation-status.md",
+        "docs/live-validation-report.json",
+        "docs/live-validation.md",
+        "docs/mcp-plan.md",
+        "docs/releasing.md",
+        "examples/read_only.rb",
+        "lib/five_pm.rb",
+        "lib/five_pm/client.rb",
+        "lib/five_pm/download.rb",
+        "lib/five_pm/errors.rb",
+        "lib/five_pm/operations.json",
+        "lib/five_pm/pagination.rb",
+        "lib/five_pm/request.rb",
+        "lib/five_pm/resource.rb",
+        "lib/five_pm/response.rb",
+        "lib/five_pm/retry_policy.rb",
+        "lib/five_pm/services.rb",
+        "lib/five_pm/transport.rb",
+        "lib/five_pm/types.json",
+        "lib/five_pm/version.rb",
+        "sig/five_pm.rbs",
+        "sig/models.rbs"
+      ],
+      "dependencies": [
+        {
+          "name": "json",
+          "requirement": ">= 2.6, < 4"
+        },
+        {
+          "name": "net-http",
+          "requirement": ">= 0.3, < 1"
+        }
+      ],
+      "license": "MIT",
+      "required_ruby": ">= 3.2"
+    },
+    {
+      "name": "5pm-mcp",
+      "file": "5pm-mcp-0.1.0.gem",
+      "sha256": "8ac7c8a5dc175b7ecd4d934b3c720ee3d4b0f019deacd3c5e94d249a3e22d601",
+      "files": [
+        "LICENSE",
+        "README.md",
+        "exe/five-pm-mcp",
+        "lib/five_pm/mcp.rb",
+        "lib/five_pm/mcp/server.rb",
+        "lib/five_pm/mcp/version.rb",
+        "sig/five_pm-mcp.rbs",
+        "sig/manifest.yaml"
+      ],
+      "dependencies": [
+        {
+          "name": "5pm",
+          "requirement": "~> 0.1.0"
+        },
+        {
+          "name": "mcp",
+          "requirement": "~> 1.6.1"
+        }
+      ],
+      "license": "MIT",
+      "required_ruby": ">= 3.2"
+    }
+  ]
+}

data/docs/release-preparation/limited-first-release-decision.md

@@ -0,0 +1,28 @@
+# Historical limited-release proposal — NOT APPROVED
+
+This proposal predates Stan's owner-controlled live-validation policy. It does not
+impose a current live qualification gate. No API exclusions below are implemented.
+See [current release policy](../releasing.md). The original proposal follows.
+
+Default recommendation: HOLD until current qualification gates pass. If Sheriff and
+Deputy instead want an intentionally limited first release, review this as a separate
+scope/policy proposal before code or gate changes:
+
+- Exclude User mutations (`users.add`, `users.update`, `users.remove`) and unqualified
+  attachment transfers/removal (`activity.attachFiles`, `activity.downloadFile`,
+  `activity.removeFile`) from the supported first-release surface. User reads and
+  attachment metadata reads can remain only where already verified.
+- Require explicit consumer warnings in README, API support matrix and changelog,
+  plus enforcement preventing excluded calls from being presented as supported.
+  Current provisional artifacts expose the existing full API; they are NOT artifacts
+  of this hypothetical limited release.
+- Precisely revise the release evidence policy to a reviewed, version-specific
+  supported-operation inventory, with unsupported operations recorded as excluded,
+  not PASS. Continue requiring clean actual-source contract/read/supported-write
+  evidence and complete cleanup. Do not simply set three verification flags true.
+- Rationale: release verified core project/task/activity functionality while deferring
+  unqualified User/attachment capabilities. Risk: a narrower SDK/support contract and
+  future compatibility changes. This does not resolve or erase issue #14.
+- Approval requires explicit Sheriff policy authorization and independent Deputy
+  review of a separate PR. Rebuild/requalify that actual new source and accept new
+  hashes. No such policy/source changes are included here.

data/docs/release-preparation/manual-first-publication.md

@@ -0,0 +1,192 @@
+# Sheriff-only manual first-publication preparation
+
+**Preparation only. Publication requires Stan's approval of the final source and
+exact artifact hashes.** Live API checks are optional at Stan's discretion. No
+active 5PM trial or subscription is required. The [release policy](../releasing.md)
+supersedes the historical live-test blockers recorded in the frozen manifest.
+
+## Frozen proposed source and artifacts
+
+Proposed version: **0.1.0** for both gems. Frozen source baseline:
+`9322e03f75604d7279775dc88c9192add840e76e` (accepted master, not an accepted release).
+Changelog: **0.1.0 — unreleased**. Current artifacts are provisional and blocked.
+A dated changelog/source change requires rebuilding, offline verification and new hashes;
+do not publish these bytes after substituting a different candidate SHA.
+
+[Machine-readable provenance/inventories](0.1.0-manual-artifacts.json) records:
+
+| Artifact | SHA-256 |
+| --- | --- |
+| `5pm-0.1.0.gem` | `160b09db75dd1cf0aebac21e64f0f6a1216ea437c3155816481a1c7f0faff0e6` |
+| `5pm-mcp-0.1.0.gem` | `8ac7c8a5dc175b7ecd4d934b3c720ee3d4b0f019deacd3c5e94d249a3e22d601` |
+
+Build environment: Ruby 4.0.9, RubyGems 4.0.23, Bundler 4.0.23,
+`SOURCE_DATE_EPOCH=1793399403` (source commit timestamp). Two independent builds
+produced identical bytes. Core inventory: 28 files; MCP: eight. MIT licenses, RBS,
+installed load paths and both exact versions passed isolated verification.
+
+Both gems require Ruby >=3.2. Supported/tested versions: 3.2, 3.3, 3.4, 4.0.
+[Source CI run 41138526407](https://github.com/scarver2/5pm-ruby/actions/runs/41138526407)
+passed all four jobs (143 examples, RBS/runtime, lint and package verification).
+Core depends on json >=2.6,<4 and net-http >=0.3,<1; MCP depends on 5pm ~>0.1.0
+and mcp ~>1.6.1. The locked dependency set is tested, not every possible version
+within these ranges. MCP is not a core runtime dependency.
+
+## Offline build, inspect and install (no publishing credentials)
+
+Use a clean worktree of the exact candidate with locked dependencies installed.
+The prepared local worktree is `/private/tmp/5pm-maiden-voyage-0.1.0/source`.
+The public source can be reproduced as follows; do not overwrite an existing worktree:
+
+```sh
+set -eu
+cd /Users/cora/Projects/OSS/5pm-ruby/sdk
+candidate_sha=9322e03f75604d7279775dc88c9192add840e76e
+source_dir=/private/tmp/5pm-maiden-voyage-0.1.0/source
+# Already executed for the prepared worktree; only create if absent:
+# git worktree add --detach "$source_dir" "$candidate_sha"
+cd "$source_dir"
+test "$(git rev-parse HEAD)" = "$candidate_sha"
+test -z "$(git status --porcelain)"
+export PATH=/Users/cora/.local/share/mise/installs/ruby/4.0.9/bin:$PATH
+export BUNDLE_PATH=/Users/cora/Projects/OSS/5pm-ruby/sdk/vendor/bundle
+export BUNDLE_FROZEN=true
+export SOURCE_DATE_EPOCH=1793399403
+bundle check
+bin/spec
+bin/lint --cache false
+bin/package-mcp
+# bin/package-mcp builds/inspects both gems and verifies disposable installs/RBS.
+ruby bin/verify-package.rb pkg/5pm-0.1.0.gem
+shasum -a 256 pkg/5pm-0.1.0.gem mcp/pkg/5pm-mcp-0.1.0.gem
+```
+
+Explicit standalone isolated-install/load commands, using only bundled dependencies:
+
+```sh
+set -eu
+qualification_home="$(mktemp -d /private/tmp/5pm-install.XXXXXX)"
+trap 'rm -rf -- "$qualification_home"' EXIT
+dependency_path="$(bundle exec ruby -rbundler -e 'puts Bundler.load.specs.map(&:base_dir).uniq.join(File::PATH_SEPARATOR)')"
+for artifact in pkg/5pm-0.1.0.gem mcp/pkg/5pm-mcp-0.1.0.gem; do
+  GEM_HOME="$qualification_home" GEM_PATH="$dependency_path" ruby -rrubygems/installer -e \
+    'Gem::Installer.at(ARGV.fetch(0), install_dir: ARGV.fetch(1), ignore_dependencies: true, document: []).install' \
+    "$artifact" "$qualification_home"
+done
+GEM_HOME="$qualification_home" GEM_PATH="$dependency_path" ruby -rrubygems -e '
+  gem "5pm", "0.1.0"; require "five_pm"
+  gem "5pm-mcp", "0.1.0"; require "five_pm/mcp"
+  abort "core version mismatch" unless FivePM::VERSION == "0.1.0"
+  abort "MCP version mismatch" unless FivePM::MCPAdapter::VERSION == "0.1.0"
+  %w[5pm 5pm-mcp].each do |name|
+    actual = File.realpath(Gem.loaded_specs.fetch(name).full_gem_path)
+    abort "loaded outside disposable GEM_HOME" unless actual.start_with?(File.realpath(ENV.fetch("GEM_HOME")) + File::SEPARATOR)
+  end
+  puts "Both exact versions loaded from disposable GEM_HOME"
+'
+```
+
+No dependency downloads occur during these installs. The prepared artifact directory
+is `/private/tmp/5pm-maiden-voyage-0.1.0/artifacts`, with the two gems, `SHA256SUMS`
+and `provenance.json`. It is outside Git and outside the frozen source tree.
+Verify it with `cd` to that directory, then `shasum -a 256 -c SHA256SUMS`.
+
+## Preconditions before any push
+
+- Preserve historical API observations and failed receipts, including issue #14.
+  Stan confirmed the leftover test User was deleted. Another live session or
+  qualification run is not a publication prerequisite.
+- Review a dated changelog and final exact source. Pass offline specs, lint, package
+  checks, hosted CI and the read-only `bin/release-check VERSION SHA`.
+- Deputy accepts exact artifacts/source; Sheriff separately authorizes the final push.
+- Sheriff verifies his own existing local RubyGems authentication belongs to the
+  intended account (immutable ID 239830), permits `push_rubygem`/first publication of
+  both names and meets MFA requirements. Cora neither accesses nor uses it.
+- If existing authentication is missing/insufficient, STOP for owner action. Do not
+  run signin, generate credentials automatically, add repository secrets, print keys,
+  or pass credentials/MFA codes as command-line arguments. No new permanent key is
+  part of this procedure. An authenticated browser alone is not CLI authentication.
+
+Read-only public gem and owner API requests returned 404 for both names on 2026-10-30.
+No published ownership was observed; this neither reserves names nor proves manual
+push permission. Recheck immediately before publication. Any newly existing gem,
+version conflict, different owner or policy denial means STOP; do not overwrite/yank.
+
+Manual `gem push` uses Sheriff's own authenticated account, not OIDC token exchange.
+Thus owner-input action support is a later automation prerequisite, not a reason to
+alter this manual route. Leave the protected OIDC workflow and pending publishers
+unchanged. This distinction does not waive source/evidence/publication approval.
+
+## Sheriff-only stage — DO NOT EXECUTE NOW
+
+The following is a reviewed command specification, not a runnable automation added
+to the repository. Execute only after every precondition above and exact artifact
+acceptance. The frozen candidate has an undated changelog and is not a final release candidate.
+If candidate bytes/SHA change, replace the reviewed manifest/hashes only through new
+acceptance; do not edit these values to force an existing approval to match.
+
+Run personally in Sheriff's local terminal with shell tracing/recording disabled.
+Use existing local CLI credentials; no API keys, passwords or MFA codes go in chat,
+logs, repository configuration, or agent input. Consult [RubyGems CLI](https://guides.rubygems.org/command-reference/#gem-push),
+[scopes](https://guides.rubygems.org/api-key-scopes/) and
+[MFA](https://guides.rubygems.org/using-mfa-in-command-line/).
+
+```sh
+bash <<'SHERIFF_ONLY'
+set -euo pipefail
+unset GEM_HOST_API_KEY RUBYGEMS_API_KEY BUNDLE_GEM__PUSH_KEY GEM_HOST_OTP_CODE
+# Set these in your terminal from the final reviewed acceptance packet.
+: "${SOURCE_DIR:?Set SOURCE_DIR to your clean local source worktree}"
+: "${ARTIFACT_DIR:?Set ARTIFACT_DIR to the final accepted artifact directory}"
+: "${CANDIDATE_SHA:?Set CANDIDATE_SHA to the final accepted full commit}"
+: "${CORE_SHA256:?Set CORE_SHA256 to the independently accepted core digest}"
+: "${MCP_SHA256:?Set MCP_SHA256 to the independently accepted MCP digest}"
+source_dir="$(cd "$SOURCE_DIR" && pwd -P)"
+artifact_dir="$(cd "$ARTIFACT_DIR" && pwd -P)"
+candidate_sha="$CANDIDATE_SHA"
+[[ "$CORE_SHA256" =~ ^[0-9a-f]{64}$ && "$MCP_SHA256" =~ ^[0-9a-f]{64}$ ]]
+cd "$source_dir"
+test "$(git rev-parse HEAD)" = "$candidate_sha"
+mise exec -- bin/release-check 0.1.0 "$candidate_sha"  # Never bypass.
+# Guard against automatic credential issuance when local authentication is absent.
+# This reads only inside Sheriff's local process and prints no key.
+mise exec -- ruby -rrubygems/config_file -e 'abort "STOP: existing local RubyGems authentication required" if Gem.configuration.rubygems_api_key.to_s.empty?'
+cd "$artifact_dir"
+# Digests must come from the independent acceptance packet, not this directory.
+printf '%s  %s\n' "$CORE_SHA256" '5pm-0.1.0.gem' \
+  "$MCP_SHA256" '5pm-mcp-0.1.0.gem' | shasum -a 256 -c -
+# Core first. These commands are not authorized until final acceptance/push approval.
+mise exec -- gem push --host https://rubygems.org "$artifact_dir/5pm-0.1.0.gem" </dev/tty
+verification_dir="$(mktemp -d)"
+trap 'rm -rf -- "$verification_dir"' EXIT
+cd "$verification_dir"
+mise exec -- gem fetch 5pm --version 0.1.0 --clear-sources --source https://rubygems.org
+cmp "$artifact_dir/5pm-0.1.0.gem" 5pm-0.1.0.gem
+# Only after the exact core artifact is publicly available:
+mise exec -- gem push --host https://rubygems.org "$artifact_dir/5pm-mcp-0.1.0.gem" </dev/tty
+mise exec -- gem fetch 5pm-mcp --version 0.1.0 --clear-sources --source https://rubygems.org
+cmp "$artifact_dir/5pm-mcp-0.1.0.gem" 5pm-mcp-0.1.0.gem
+SHERIFF_ONLY
+```
+
+If propagation delays a fetch, STOP and retry only the read-only fetch/compare once
+availability is confirmed; do not repeat an already successful push. Verify account
+ownership on RubyGems after publication. No automatic retries, yanks, tags or GitHub
+release dispatches are included. No push commands above were executed by Cora.
+
+## Historical proposals and current preparation
+
+The [limited-release proposal](limited-first-release-decision.md) and the frozen
+manifest are historical records, not current live-test requirements. Stan has
+removed the live API release gate; no fresh success report is required or fabricated.
+API observations remain documented without changing the supported API implicitly.
+
+The historical hashes above remain provisional. After the final source is dated,
+reviewed and offline-tested, rebuild both gems, independently accept their new
+hashes, and provide those values through exported environment variables to the
+owner-only procedure. Keep credentials outside these variables and the repository.
+
+—
+Stan Carver II
+Made in Texas 🤠
+https://stancarver.com