Connect release notes and complete policy alignment

.woodpecker/release.yml

@@ -17,6 +17,7 @@ steps:
       files:
         - dist/audita-*-linux-amd64
         - dist/audita-*-linux-arm64
+      note: docs/releases/${CI_COMMIT_TAG}.md
       checksum: sha256
       checksum-file: SHA256SUMS
       checksum-flatten: true

docs/release.md

@@ -7,8 +7,8 @@ source/tag push; binary delivery runs asynchronously.
 
 ## Prerequisites
 
-Use Bash, Git, and Go 1.25.5 or newer (CI uses Go 1.25.5 or newer), with dependencies available
+Use Bash, Git, and Go 1.25.5 or newer (CI uses Go 1.25.5), with dependencies
-locally or downloadable. Tests themselves are offline. Work from a
+available locally or downloadable. Tests themselves are offline. Work from a
 checkout of `main` with permission to push that branch and tags to `origin`.
 For this repository, `origin` is `https://gitea.maximumdirect.net/eric/audita.git`.
 The script uses the checkout's configured `origin`; set it correctly before use.
@@ -25,6 +25,17 @@ short summary and any compatibility or upgrade instructions relevant to the
 release. There are no mandatory boilerplate sections. Update affected canonical
 documentation with behavior changes.
 
+End each new note with these links, substituting the selected release version for
+`<version>`:
+
+```markdown
+[COPYRIGHT](https://gitea.maximumdirect.net/eric/audita/src/tag/<version>/COPYRIGHT) | [LICENSE](https://gitea.maximumdirect.net/eric/audita/src/tag/<version>/LICENSE) | [ATTRIBUTION](https://gitea.maximumdirect.net/eric/audita/src/tag/<version>/docs/oss/attribution.md)
+```
+
+Check that all three paths exist in the candidate source. Retire completed
+roadmaps when useful during preparation, preserving planned and deferred work
+and repairing affected links. This is ordinary preparation, not a script gate.
+
 Commit the intended changes, including the note, on `main`. The release script
 requires a clean index and worktree and does not create commits. There is no
 separate approval round. Published notes describe their tagged release; existing
@@ -75,6 +86,9 @@ checks compilation, not native execution on each architecture.
 The CI job status and logs show delivery progress or failure. Assets appear on
 the matching Gitea release page when delivery succeeds. A successful tag push
 must not be reported as confirmation that these files are available.
+For a new hosted release, the release plugin uses the checked-in note at the
+tag as its body, including the footer. On delivery retries it preserves
+existing release information and skips files that already exist.
 
 Consumers can download the binary for their Linux architecture and `SHA256SUMS`
 from that page, check its listed SHA-256 digest with `sha256sum`, and make it

docs/roadmap/decision-set-reconciliation.md

@@ -3,7 +3,7 @@
 **Last updated:** 2026-09-25
 
 **Status:** Implemented. This document owns the target behavior and user intent.
-[implementation.md](implementation.md) owns concrete decisions, ordered work,
+[historical implementation plan](https://gitea.maximumdirect.net/eric/audita/src/commit/91d9be68a7bb3a102900253fdfd8438f0a43f666/docs/roadmap/implementation.md) owns concrete decisions, ordered work,
 and verification.
 
 ## Purpose and User Intent
@@ -119,7 +119,7 @@ Debug evidence distinguishes unavailable validation from editorial rejection.
 
 The schema/transport boundary remains with PromptKit; reconciliation needs no
 additional model call. Concrete helper structures, reason names, mapping changes,
-and verification steps belong in the [implementation plan](implementation.md).
+and verification steps belong in the [historical implementation plan](https://gitea.maximumdirect.net/eric/audita/src/commit/91d9be68a7bb3a102900253fdfd8438f0a43f666/docs/roadmap/implementation.md).
 
 ## Scope Boundaries
 

docs/roadmap/implementation.md

@@ -2,7 +2,7 @@
 
 **Last updated:** 2026-09-28
 
-**Status:** In progress; Stages 1–3 complete.
+**Status:** Complete; Stages 1–4 implemented.
 **Audience:** gpt-5.6-terra coding agent.
 **Audita planning baseline:** `91d9be68a7bb3a102900253fdfd8438f0a43f666`.
 **Selected upstream revision:** `d84a38ebab26f048cafbe59a2246700c35d29843`.
@@ -232,6 +232,14 @@ inventory generator, or test suite is required.
 
 ## Stage 4 — Integrate Release Notes and Finish Cross-Document Validation
 
+**Completed:** 2026-09-28. Wired the checked-in release note into the hosted
+release plugin, documented immutable-tag notice links and release preparation,
+repaired the specified historical roadmap references, and marked the feature
+roadmap implemented. Parsed the YAML, substituted `v2.0.0` to a tracked note,
+checked non-overwrite settings and candidate footer paths, reviewed all seven
+policies against the pinned source, and checked repository-local Markdown links
+and `git diff --check`. Hosted execution awaits the next real release.
+
 **Files:** `.woodpecker/release.yml`, `docs/release.md`, affected documentation
 links, `docs/roadmap/policy.md`, and this plan. Repair the historical references
 specified below; do not retire unrelated roadmaps in this sprint.

docs/roadmap/library-adoption.md

@@ -4,8 +4,7 @@
 
 **Status:** Production implementation complete. ConfigKit v0.4.1 and PromptKit
 v0.11.1 are adopted; [historical implementation evidence](https://gitea.maximumdirect.net/eric/audita/src/commit/cb405f6/docs/roadmap/implementation.md) records the
-completed checks. The current `implementation.md` covers span deletion instead.
+completed checks. Release compliance and publication remain separate work.
-Release compliance and publication remain separate work.
 
 ## Goal and Ownership
 

docs/roadmap/policy.md

@@ -2,10 +2,10 @@
 
 **Last updated:** 2026-09-28
 
-**Status:** Accepted direction; implementation pending. This roadmap replaces
+**Status:** Implemented. This roadmap replaces its earlier licensing-only scope
-its earlier licensing-only scope and defines the desired end state, not a staged
+and records the accepted end state. [implementation.md](implementation.md)
-implementation plan. [implementation.md](implementation.md) owns the ordered
+records the ordered work and verification; the adopted policies are in
-work and verification. This roadmap does not itself adopt the policies below.
+`docs/policy/`.
 
 ## Purpose and Review Revision