Adopt the updated release policy

docs/oss/attribution.md

@@ -2,7 +2,11 @@
 
 ## Standard Repository Policies
 
-Material: All documents under `docs/policy/`, root `AGENTS.md`, and the Policy Reading Guide in `docs/development.md`, adapted for this repository.
+Material: All documents under `docs/policy/`, root `AGENTS.md`, and the Policy
+Reading Guide in `docs/development.md`, adapted for this repository.
+`docs/policy/release.md` incorporates revision
+`e833faddf120c789a9b45348edaf75720de16348`; the remaining listed material
+incorporates revision `d84a38ebab26f048cafbe59a2246700c35d29843`.
 
 Copyright (C) 2026 Eric Rakestraw
 
@@ -10,10 +14,14 @@ SPDX-License-Identifier: CC-BY-SA-4.0
 
 License and notices: [CC BY-SA 4.0](licenses/CC-BY-SA-4.0.txt) |
 [COPYRIGHT](https://gitea.maximumdirect.net/eric/policy/src/commit/d84a38ebab26f048cafbe59a2246700c35d29843/COPYRIGHT) |
-[LICENSE](https://gitea.maximumdirect.net/eric/policy/src/commit/d84a38ebab26f048cafbe59a2246700c35d29843/LICENSE).
+[LICENSE](https://gitea.maximumdirect.net/eric/policy/src/commit/d84a38ebab26f048cafbe59a2246700c35d29843/LICENSE) |
+[COPYRIGHT](https://gitea.maximumdirect.net/eric/policy/src/commit/e833faddf120c789a9b45348edaf75720de16348/COPYRIGHT) |
+[LICENSE](https://gitea.maximumdirect.net/eric/policy/src/commit/e833faddf120c789a9b45348edaf75720de16348/LICENSE).
 
 [Source](https://gitea.maximumdirect.net/eric/policy/src/commit/d84a38ebab26f048cafbe59a2246700c35d29843).
 
+[Source](https://gitea.maximumdirect.net/eric/policy/src/commit/e833faddf120c789a9b45348edaf75720de16348).
+
 ## ConfigKit
 
 Selected module: `gitea.maximumdirect.net/eric/ConfigKit` at `v0.5.0`.

docs/policy/release.md

@@ -1,9 +1,9 @@
 # Release Policy
 
-**Base Policy Version:** 1.4
+**Base Policy Version:** 1.6
 
-**Last Updated**: 2026-10-07
+**Last Updated**: 2026-10-08
-**Upstream Source:** [Standard Repository Policies release](https://gitea.maximumdirect.net/eric/policy/src/commit/d84a38ebab26f048cafbe59a2246700c35d29843/docs/policy/release.md)
+**Upstream Source:** [Standard Repository Policies release](https://gitea.maximumdirect.net/eric/policy/src/commit/e833faddf120c789a9b45348edaf75720de16348/docs/policy/release.md)
 
 ## Purpose
 
@@ -11,6 +11,9 @@ This policy defines a proportionate workflow for validating and publishing an
 intended source revision under a fresh version. Releases should require little
 routine intervention, avoid repeated work, and preserve published contents.
 
+Adopt stronger verification or reproducibility requirements through an explicit
+project-specific decision justified by the intended audience and support needs.
+
 The repository-specific commands belong in `docs/release.md`. Historical release
 summaries belong in `docs/releases/`. The procedure must agree with the adopted
 policy and link to it rather than introduce additional release requirements.
@@ -75,7 +78,8 @@ requires a deliberate update to the policy and procedure where needed.
 For releases at or after `v1.0.0`:
 
 - a major release may make intentional incompatible changes;
-- a minor release may add backward-compatible behavior; and
+- a minor release may add backward-compatible behavior or raise the Go consumer
+  minimum as described below; and
 - a patch release may make backward-compatible fixes.
 
 Before `v1.0.0`, a minor release may change a documented public, operational,
@@ -87,6 +91,36 @@ Additional compatibility promises and deliberate exceptions belong in the
 adopted policy or canonical contract documentation. Release notes explain
 changes; they do not redefine current compatibility contracts.
 
+## Consumer Minimum And Release Toolchain
+
+Distinguish the minimum toolchain supported for consumers from the toolchain
+maintainers use to build and validate a release. Record the consumer minimum in
+the language's standard metadata and explain its support meaning in canonical
+documentation. Define the selected release toolchain and its setup commands in
+`docs/release.md`. Toolchain selection and upgrade cadence are repository-specific
+choices.
+
+For Go repositories, normally declare the initial stable release of the selected
+series as the consumer minimum, such as `go 1.26.0`. Use a higher patch minimum
+when a dependency or an identified correctness fix requires it, and document
+the reason.
+
+For release-policy purposes, successful build and release validation on the
+selected Go patch release are sufficient to presume support across that Go
+series, subject to the declared consumer minimum and concrete evidence of
+incompatibility. Investigate specific compatibility concerns as they arise.
+
+Use the selected release toolchain for candidate validation and release builds,
+including CI jobs performing those tasks. A newer validation patch version alone
+leaves the consumer minimum unchanged.
+
+A minor release may raise the Go consumer minimum, including from one Go series
+to the next, both before and after `v1.0.0`. This is an explicit exception to the
+backward-compatibility requirement for minor releases. Patch releases preserve
+the consumer minimum. Explain an increase's impact and required consumer action
+in the release note. Other incompatible changes remain subject to the versioning
+rules above.
+
 ## Release Documentation And Preparation
 
 Every new release must include `docs/releases/<version>.md` in the tagged
@@ -145,9 +179,10 @@ caches are not required. If the candidate changes, validate the new candidate.
 Cheap publication-state checks may be repeated immediately before pushing
 because local or remote state may have changed during validation.
 
-Automate mechanical guards. Do not require manual approvals, sign-offs, or
+Automate mechanical guards. Human review gates are strongly disfavored: add one
-routine confirmations as release gates. Version selection and
+only through an explicit project-specific policy decision explaining the
-a concise release summary remain preparation inputs, not separate approval rounds.
+concrete risk and why ordinary change review or automation is insufficient.
+Do not add routine confirmations for checks the command can perform itself.
 
 ## Publication Guards
 
@@ -201,7 +236,8 @@ release without replacing its contents or reusing its version.
 Maintain `docs/release.md` as a short, executable maintainer runbook. It must
 identify:
 
-1. prerequisites, primary branch, and authoritative remote;
+1. prerequisites, selected release toolchain, primary branch, and authoritative
+   remote;
 2. version and release-note preparation;
 3. one publication command with its selected local checks and automated guards;
 4. declared deliverables, required build targets, and automation responsibilities;

docs/release.md

@@ -7,11 +7,32 @@ Woodpecker reports binary delivery separately.
 
 ## Prerequisites
 
-Use Bash, Git, and Go 1.25.5 or newer. The authoritative remote is `origin`,
+Use Bash and Git. The authoritative remote is `origin`,
 which must point to `https://gitea.maximumdirect.net/eric/audita.git`; the
 primary branch is `main`. Source publication needs no delivery credential.
 Woodpecker uses the existing `GITEA_RELEASE_TOKEN` secret for delivery.
 
+The source-build minimum is Go 1.25.5, declared in [go.mod](../go.mod).
+This patch minimum is required by the selected PromptKit dependency.
+Distributed executables do not require a Go installation. The selected release
+toolchain is Go 1.25.5, matching the current Woodpecker image and distributed
+runtime notices. Use that local installation for tool bootstrap, candidate
+validation, and release builds. Replace the installation path below with its
+actual directory:
+
+```sh
+export PATH="/path/to/go1.25.5/bin:$PATH"
+export GOTOOLCHAIN=local
+go version
+```
+
+Record the reported toolchain with the validation results. The
+[release policy](policy/release.md#consumer-minimum-and-release-toolchain)
+governs the distinction between the consumer minimum and release toolchain,
+support across a Go series, and versioning of minimum increases. When selecting
+a different release toolchain, update the CI image and applicable runtime
+attribution together; a newer build patch alone need not raise the minimum.
+
 Prepare dependencies before offline candidate validation:
 
 ```sh

docs/roadmap/releasekit.md

@@ -1,7 +1,7 @@
 # ReleaseKit v0.3.0 Upgrade Roadmap
 
 **Last updated:** 2026-10-08
-**Status:** Agreed scope; implementation pending.
+**Status:** Release policy adopted; library and toolchain upgrade pending.
 
 ## Purpose
 
@@ -41,6 +41,11 @@ At Audita commit `17421bc5f352f3fdeb67561b2b60b49979822228`:
 The initial adoption's [review findings](remediation.md) are resolved. They are
 historical context, not additional work for this upgrade.
 
+Since that baseline, Audita has adopted release policy 1.6 and updated its
+provenance, policy attribution, and release runbook. The current Go minimum and
+selected release toolchain remain 1.25.5. The dependency, tool registration,
+bootstrap simplification, and Go 1.26 upgrade described below remain pending.
+
 ## Selected Upstream Revisions
 
 Adopt ReleaseKit **v0.3.0**, commit
@@ -56,7 +61,7 @@ structured diagnostics. Audita already uses its module-selected CI bootstrap
 approach. The largest file-validation performance gains apply only when those
 checks are selected; this upgrade does not enable them merely to obtain gains.
 
-For the release-policy update, use Standard Repository Policies **version 1.6**
+The adopted release policy uses Standard Repository Policies **version 1.6**
 at commit `e833faddf120c789a9b45348edaf75720de16348`, following its
 [adoption guide](https://gitea.maximumdirect.net/eric/policy/src/commit/e833faddf120c789a9b45348edaf75720de16348/docs/adoption.md).
 Other locally adopted policies retain their existing upstream revisions.
@@ -118,18 +123,14 @@ tag verification before Go bootstrap and temporary metadata outside the tagged
 checkout where the upstream CI template uses it. The local and CI integrations
 need not have identical preparation machinery when their responsibilities differ.
 
-### Release Policy and Documentation
+### Policy Alignment and Documentation
 
-Update `docs/policy/release.md` using the selected upstream 1.6 revision. Adopt
+The release-policy update is complete. `docs/policy/release.md` now incorporates
-upstream wording for shared requirements, remove template-only instructions,
+the selected upstream 1.6 revision, with template-only instructions removed and
-and retain Audita's justified platform commitments and accepted native-host
+Audita's platform commitments and accepted native-host version check retained.
-version check. Preserve main-first publication, independent source completion,
+It preserves independent source completion and proportionate automated gates.
-and proportionate automated gates. No human release gate is introduced.
+Mixed-revision attribution records the policy's exact source separately from
-
+the other adopted policies. No human release gate was introduced.
-Record the adopted version, local update date, and exact per-document upstream
-source. Keep mixed-revision policy attribution accurate rather than implying
-that the whole policy suite was refreshed. Existing public discovery links and
-unrelated policy adoption metadata remain applicable.
 
 Update `docs/release.md` and `docs/development.md` for the source minimum,
 selected release toolchain, dependency preparation, and simplified local
@@ -150,8 +151,9 @@ requirement alone does not establish incorporation into Audita binaries.
 
 Update Go runtime and standard-library notices, including relevant vendored
 components, for the selected Go 1.26.8 release-build toolchain. Reuse existing
-license texts where applicable. Update the copied release policy's scope and
+license texts where applicable. The copied release policy's scope and
-commit-specific source and notice links under the existing OSS policy.
+commit-specific source and notice links have already been updated; preserve
+that accurate mixed-revision attribution during the remaining upgrade work.
 
 ### Consumer Verification and Test Maintenance