docs: record 0.1.1 as the published release status

[dichovsky]

Closes #38

docs/README.md's "Current readiness" section declares itself "the single source of truth for release status" (:48-49), and it recorded 0.1.0 as the published state. 0.1.1 shipped on 2026-07-13. Five other passages echoed the same stale claim.

Published state, verified directly rather than from the issue body:

• npm view @dichovsky/crew dist-tags → latest: 0.1.1; versions is exactly ["0.1.0","0.1.1"]; 0.1.1 published 2026-07-13T15:51:28Z.
• git tag -l 'v*' → v0.1.1, the only tag. package.json version is 0.1.1. CHANGELOG.md:29-33 records [0.1.1] — 2026-07-13 as the first release through the automated OIDC pipeline, carrying build provenance, with no functional CLI changes.

One delta against the issue body, noted rather than silently absorbed: it cites README.md:47; the line is :49 (:45-47 is the Node-floor paragraph).

What changed and why

Every one of the six passages already carried the 0.1.0-manual-bootstrap / 0.1.1-onward-OIDC narrative correctly. The defect was that each also asserted 0.1.0 as the current published state. Only that assertion is removed.

docs/README.md is the one file permitted to name a concrete current version, because it is the declared source of truth for release status and is expected to move each release. The other five are reworded to state the durable fact without pinning a version that rots — which is the Acceptance's stated goal.

File	Change
docs/README.md:62-66	Now leads with 0.1.1 as the current published release and the first through the OIDC pipeline, so it carries provenance; keeps why 0.1.0 could not (OIDC can only attach to an existing package) and that it therefore carries no CI provenance. Links to publish.yml, the release-gate table, and publishing.md are unchanged, as is the 1.0.0-reserved sentence.
README.md:49	"0.1.0 is published to npm." → "crew is published to npm." The install code block is untouched.
CLAUDE.md:29, AGENTS.md:29	"0.1.0 is published to npm." → "The package is published to npm." Both paragraphs already defer to docs/README.md for release status, and they remain byte-identical to each other, as before.
docs/design/decisions.md:27-31 (DEC-7)	"0.1.0 is published:" → "The package is published to npm: the first publish (0.1.0) was …". The naming rationale, @dichovsky/crew, and the 1.0.0 parenthetical are unchanged.
docs/design/product-spec.md:107-110	"The first publish (0.1.0) has shipped to npm." → "crew has shipped to npm", with the "must not keep a separate copy" principle extended to release status and pointed at docs/README.md.

Two wording notes for a reviewer:

• CLAUDE.md/AGENTS.md keep "The first publish was a one-time manual npm publish" without re-naming 0.1.0. Adding "(0.1.0)" would push the line past the files' ~90-char wrap and force a reflow of an otherwise-unchanged seven-line paragraph in two files. That detail still lives in DEC-7 and docs/README.md.
• In product-spec.md, "the first release (0.1.0) was published once by hand" rather than "the first publish … was published", to avoid a publish/published repetition the rewording would otherwise introduce. Same fact.

Verification

Tests: none added — claiming the docs-only exemption. The diff is six Markdown files and zero code, which CONTRIBUTING.md ("tests are not applicable for docs-only changes") and .github/ISSUE_TRIAGE.md both grant.

Run under Node 24.18.0 (CI's pinned version) on the branch as pushed. Every command was run twice — once by the implementer, once independently — with identical results:

Command	Exit	Result
npm run typecheck	0	clean (root + web/ + docs-site/)
npm run lint	0	clean
npm run format:check	0	"All matched files use Prettier code style!"
npm run build	0	dist/ + dist/ui-assets/main.js (88.4kb)
npx vitest run tests/unit/docs-facts.test.ts	0	2 passed
npm run test:coverage	1	1395 passed, 3 skipped, 2 failed — both pre-existing and environmental

tests/unit/docs-facts.test.ts was run standalone because it is the guard that reads project facts. It takes the version from package.json (:82-92), not from prose, so docs-site/generated/facts.json:4 already read 0.1.1 and needed no regeneration.

Pre-existing-failure proof (performed, not assumed). The two failures are tests/integration/commands/doctor.test.ts:319 ("degrades a raw filesystem read failure in project roles instead of aborting doctor") and :373 ("degrades unreadable roles and teams directories to whole-listing warnings"). Both chmod 000 a directory and expect the read to fail; this sandbox runs as uid 0, which ignores mode bits, so the reads succeed and the expected INVALID_CONFIG warnings never fire. Proven by git stash push -u, confirming git status --porcelain empty at 97d7f88, re-running that file on the clean tree for the identical 2 failed / 31 passed, then git stash pop. A Markdown-only edit cannot influence them, and CI is neither root nor affected.

Coverage thresholds were NOT evaluated locally. Because test:coverage exited non-zero, vitest suppressed the coverage table — the 95% statements/branches/functions/lines numbers were never printed, and no claim is made about them. This PR's CI run is authoritative. The diff touches no src/** or bin/** file, so coverage cannot have moved.

Branch was cut from and rebased onto origin/main @ 97d7f88; the pre-push rebase was a no-op — main had not moved. No force-push.

Contract impact

None. product-spec.md and decisions.md sit outside the authority order in docs/README.md:9-12 (they are build-packet and index documents), and the other four files are not contract documents at all. No ADR is amended, no FR-*/NFR-* is added, renumbered, or given new meaning, and no CLI grammar rule, record type, error code, command, or flag moves. package.json is not touched, so nothing here can influence a future npm publish. CURRENT_SCHEMA_VERSION stays 7.

Out of scope

Deliberately untouched:

• docs/release/publishing.md, docs/release/live-smoke-checklist.md:76-77, docs/design/testing-strategy.md:254-256 — all name 0.1.0/0.1.1 in a purely historical frame ("0.1.0 was a one-time manual publish, 0.1.1+ publish from CI") and none claims a current version, so none rots. Listed because a reviewer might expect them in the diff.
• The release-gate table (product-spec.md:124-131) and the "SQLite-stress and Security-review gates are closed" sentence at :112-113 — ADR-0009 stress coverage claims exceed what stress.yml actually runs #37's territory, and that issue is triage/plan-ready awaiting a human decision.
• Per-version feature scope. CHANGELOG.md still has an [Unreleased] section carrying Little Coder, pi, and opencode, so the eight-Participant roster described in docs/README.md's readiness paragraph is ahead of what 0.1.1 actually shipped. Nothing here claims 0.1.1 contains them — the new wording makes no claim about its feature content — and resolving that mismatch is a separate question this change does not answer.

Related open PRs

#91 (docs/adr-cross-reference-drift) also touches docs/design/decisions.md. Checked at file level, not from PR prose: #91 edits the "Structural decisions" paragraph (:13-18) and the Console-decisions section (:124-135); this PR edits DEC-7 (:24-31). No line overlap, so a conflict is unlikely, but they must not both be merged without a rebase check. #91's other three files (docs/adr/0011-*.md, docs/adr/0014-*.md, docs/adr/README.md) are not touched here.

#85 (docs/cli-contract-json-surface-drift) touches docs/design/cli-contract.md and docs/design/architecture.md — no overlap with this PR.

---

Generated by Claude Code

[dichovsky]

Two reviewers ran per .github/ISSUE_TRIAGE.md: the general code reviewer, and — the diff being docs-only — a documentation-accuracy reviewer verifying the new prose against the code it describes and against the authority order, in place of the TypeScript reviewer. No security reviewer: the diff touches none of src/store/, src/process.ts, src/which.ts, src/fs-safe.ts, src/setup/, or the Launcher.

No CRITICAL. No HIGH. 2 MEDIUM, 6 LOW. Both reviewers independently landed on the same MEDIUM, and it concerns a clause this PR introduces.

Verified clean

Fact-checked against the live registry, not just the repo:

• npm view @dichovsky/crew@0.1.1 --json → _npmUser: "GitHub Actions <npm-oidc-no-reply@github.com>", dist.attestations.provenance.predicateType = https://slsa.dev/provenance/v1. So "first one published through the OIDC pipeline, so it carries build provenance" is TRUE.
• npm view @dichovsky/crew@0.1.0 --json → dist has no attestations key. So "0.1.0 carries no CI provenance" is TRUE.
• publish.yml:22-24 (id-token: write) and :96-105 (npm publish --provenance on both branches) corroborate.
• docs/README.md:69 "six gates" still matches the six rows at product-spec.md:126-133.
• Every relative link and anchor in the six changed files resolves. product-spec.md:108 [docs/README.md](../README.md) → docs/README.md (correct; the root README would be ../../README.md). #release-gates → ## Release gates.
• diff CLAUDE.md AGENTS.md differs on exactly the two pre-existing title lines; the edited paragraph is byte-identical in both.
• Scope: all six hunks trace to #38. No adjacent-code improvements, git diff --check clean.
• Rot resistance holds: after the change, docs/README.md:62 is the only prose assertion of a current published version anywhere in the repo. The remaining 0.1.x strings are historical/procedural boundary statements, CHANGELOG.md (dated history by construction), package.json (the artifact's own version), and docs-site/generated/facts.json (generated from package.json, pinned by tests/unit/docs-facts.test.ts:80-92). The PR's out-of-scope claim for publishing.md, live-smoke-checklist.md:76-77, and testing-strategy.md:254-256 was checked and is correct.

MEDIUM 1 — the extended "no separate copy" rule is falsified by its own paragraph

docs/design/product-spec.md:107-108, new text:

Other documents reference it and must not keep a separate copy — release status included, which docs/README.md owns. crew has shipped to npm. Because npm's OIDC Trusted Publishing…

Two defects. The antecedent of "which" is ambiguous — read naturally it says docs/README.md owns the release-gate list, contradicting the sentence's own opening claim that this document is canonical for it. And having just forbidden a separate copy of release status, the next three sentences are one, as are decisions.md:27-31, CLAUDE.md:29-33, AGENTS.md:29-33, testing-strategy.md:254-256, publishing.md:10-20, and live-smoke-checklist.md:76-79. docs/README.md:48-49 grants the summarize-and-defer carve-out to AGENTS.md and CLAUDE.md only, so the rest have no cover under the new rule.

The rule is faithful in direction — docs/README.md:48-49 already claims single-source ownership of release status, so nothing is invented — but it is overbroad as written. The fix is to own the volatile fact (the current published version) rather than the whole publishing narrative, which is also what #38 actually fixed.

MEDIUM 2 — the rewording half-turns the SRS's release-status pointer

docs/design/srs.md:12-13 (same pointer at :1205, :1215-1216) routes release status to the product-spec:

Release status is deliberately not repeated in this document; see the product-spec release-gate table.

After this diff, product-spec.md:108 disclaims exactly that subject. A reader following the SRS — authority level 2 — lands on a document saying the subject isn't its. Nothing dangles yet (product-spec still carries the prose), but pointer and target now disagree. Narrowing MEDIUM 1 resolves this too, and is the right direction: editing the SRS to accommodate a level-below document would be backwards.

No authority-order violation otherwise — none of the six changed files sits in the authority order, no ADR states release status, and srs.md:63 ("@dichovsky/crew, published") names no version and stays true.

LOW

1. docs/README.md:62-66 — "The first release, 0.1.0, could not:" elides its verb across a tense shift and colons into a because-clause. The paragraph also states twice each that 0.1.0 lacks provenance and that OIDC starts at 0.1.1.
2. docs/README.md:66-68 — the publish.yml summary omits the pre-release next dist-tag branch (publish.yml:93-105) and the already-published preflight skip (:75-91). Nothing stated is false. One consequence: "the current published release" is unqualified, and a future next pre-release would be published but not current. 0.1.1 is the current latest" would be tighter.
3. docs/README.md:48-49 — still names only AGENTS.md and CLAUDE.md as documents that defer here; product-spec.md:108 now defers too and is unlisted.
4. product-spec.md:108-111 — rewrap residue: line 108 is 102 chars, line 110 is 63, in a paragraph otherwise wrapping at 87–93. Passes format:check (Prettier's proseWrap defaults to preserve), but visible editing residue.
5. docs/README.md:51-62 — the feature-complete paragraph immediately precedes "0.1.1 is the current published release", while CHANGELOG.md:7-27 still has Little Coder / pi / opencode under [Unreleased]. The juxtaposition pre-dates this PR, but "is the current published release" reads more like a claim about shipped feature content than the old wording did.
6. docs/release/publishing.md:57 — "Re-cutting v0.1.0 is safe … so the Release still validates the pipeline end-to-end" is now moot, since 0.1.1 validated it with a real publish. Not a current-version claim, so outside #38; adjacent rot.

Disposition

MEDIUM 1 and 2 concern text this PR introduces and share one fix, so the implementer is taking a pass to narrow that clause to the current published version. LOW 1 is being folded in as it is the same paragraph. The rest are left: LOW 2–5 are pre-existing or stylistic and outside #38's scope, and LOW 6 belongs to a separate cleanup.

One finding is a distinct problem rather than a defect in this diff, and is being filed as its own issue per .github/ISSUE_TRIAGE.md:253-256 rather than folded in: docs/release/publishing.md:35-64's "Cutting a release" checklist has no step to update docs/README.md's readiness paragraph. Steps 1–7 cover CI, smoke evidence, the gate table, package.json + CHANGELOG.md, the GitHub Release, and verification — but not the document that declares itself the single source of truth for release status. That omission is why #38 was filed, and it regenerates the same issue at 0.1.2.

---

Generated by Claude Code

[dichovsky]

Fix pass taken and re-checked. 0fb71ae — docs: narrow the release-status ownership clause in the release gates. Two files, +10 / −11. Fast-forward on top of 378a4e7; no amend, no force-push.

MEDIUM 1 and 2 resolved by one edit. product-spec.md:107-108 now reads:

Other documents reference it and must not keep a separate copy; the current published version likewise lives only in docs/README.md.

The semicolon gives the clause its own independent subject, so nothing binds back to the release-gate list — killing the ambiguous antecedent. And it claims ownership of one volatile fact rather than the whole subject "release status", so the paragraph no longer falsifies its own rule three sentences later, and the restatements in decisions.md:27-31, CLAUDE.md/AGENTS.md:29-33, testing-strategy.md:254-256, publishing.md:10-20, and live-smoke-checklist.md:76-79 are legal again. srs.md:12-13 (and :1205, :1215-1216) now points here honestly — product-spec still owns the release-gate table it routes readers to. docs/design/srs.md was not opened or modified, which was the point: a level-2 document does not get edited to accommodate a level-below one.

LOW 1 folded in (same paragraph). docs/README.md:62-65 drops the elided "could not:" and the doubled facts:

0.1.1 is the current published release on npm and the first published through the OIDC pipeline, so it carries build provenance. 0.1.0 does not: npm's OIDC Trusted Publishing can only attach to a package that already exists, so the first publish was a one-time manual npm publish. From 0.1.1 onward, …

All three links, the release-gate-table reference, and the 1.0.0 sentence are byte-identical to before.

LOW 4 fixed as a consequence: the release-gates paragraph rewraps to 63–93 chars (was 102 on :108, 63 on :110), inside the file's band. The rewrap stops short of the "SQLite-stress and Security-review gates are closed" sentence — that is #37's territory and is untouched.

LOW 2, 3, 5, and 6 were left deliberately: pre-existing or stylistic, and outside #38's scope.

Re-check on 0fb71ae (Node 24.18.0, run twice — implementer and independently)

Command	Exit	Result
npm run typecheck	0	clean
npm run lint	0	clean
npm run format:check	0	"All matched files use Prettier code style!"
npm run build	0	dist/ + dist/ui-assets/main.js
npx vitest run tests/unit/docs-facts.test.ts	0	2 passed
npm run test:coverage	1	1395 passed, 3 skipped, 2 failed — byte-identical to the pre-fix run and to the stashed-clean-tree proof; the same two uid-0 doctor.test.ts cases (:319, :373). Nothing new.

Coverage thresholds remain unevaluated locally (vitest suppresses the table on a non-zero exit); CI is authoritative, and the diff still touches no src/** or bin/** file.

origin/main was re-fetched and is still 97d7f88; the rebase reported up to date.

Note on the earlier red check

The publish dry-run failure on 378a4e7 (job) was a GitHub Actions infrastructure outage, not a defect in this branch: Failed to resolve action download info. Error: Service Unavailable, retried twice and given up before the runner ever checked out the repository. No step of the job ran. Both checks have re-queued against 0fb71ae.

Nothing CRITICAL or HIGH was found at any point, and both MEDIUMs are closed, so the PR is moving out of draft. One finding was filed separately rather than folded in: #95, the release runbook's "Cutting a release" checklist never updates docs/README.md — the process gap that generated #38 in the first place.

---

Generated by Claude Code