Upgrade ReleaseKit and align release profiles with SSH

docs/release.md

@@ -15,17 +15,18 @@ release runs only the root module's default suite; it need not run suites for
 independently released integrations.
 
 Use branch `main`, remote `origin`, and expected effective push endpoint
-`https://gitea.maximumdirect.net/eric/CommandKit.git`. The selected module profile
-enforces the endpoint. The maintainer needs the selected
+`ssh://git@forge.maximumdirect.net:22222/base-layer/commandkit.git`. The selected
+module profile enforces the endpoint. The maintainer needs the selected
 [release toolchain](#release-toolchain), Git push access, and a POSIX shell.
 This procedure follows the [release policy](policy/release.md); release-note
 footers follow the [OSS discoverability policy](policy/oss.md#discoverability).
 
-ReleaseKit v0.4.2 owns candidate validation, publication guards, tag creation,
-tag publication, and outcome reporting. Its pinned public contracts are the
-[CLI reference](https://gitea.maximumdirect.net/eric/ReleaseKit/src/commit/7d033c5ca1c95aec7db9690293638a0a1ac887b8/docs/cli.md),
-[profile reference](https://gitea.maximumdirect.net/eric/ReleaseKit/src/commit/7d033c5ca1c95aec7db9690293638a0a1ac887b8/docs/config.md),
-and [publication guide](https://gitea.maximumdirect.net/eric/ReleaseKit/src/commit/7d033c5ca1c95aec7db9690293638a0a1ac887b8/docs/consumers/publish.md).
+ReleaseKit v0.8.0 (`go.maximumdirect.net/releasekit`) owns candidate validation,
+publication guards, tag creation, tag publication, and outcome reporting.
+Its pinned public contracts are the
+[CLI reference](https://forge.maximumdirect.net/base-layer/releasekit/src/commit/23203f235cc414c4ffe0fd3941030eb0c9f9943f/docs/cli.md),
+[profile reference](https://forge.maximumdirect.net/base-layer/releasekit/src/commit/23203f235cc414c4ffe0fd3941030eb0c9f9943f/docs/config.md),
+and [publication guide](https://forge.maximumdirect.net/base-layer/releasekit/src/commit/23203f235cc414c4ffe0fd3941030eb0c9f9943f/docs/consumers/publish.md).
 The repository selects one default module suite per invocation. The launcher
 bootstraps the native tool into ignored `.releasekit/` storage and delegates to
 its `publish` command.
@@ -73,7 +74,7 @@ All three release profiles explicitly select the repository-root `COPYRIGHT`,
 `LICENSE`, and `docs/oss/attribution.md` through `validation.shared_files`.
 ReleaseKit requires these committed files to exist in the candidate even when
 no optional file checks are enabled. The list does not enable content checks
-or expand Go validation scope; see the pinned [profile reference](https://gitea.maximumdirect.net/eric/ReleaseKit/src/commit/b96262eb0ce9c8f2eb3e948a5841db2b799bc91b/docs/config.md).
+or expand Go validation scope; see the pinned [profile reference](https://forge.maximumdirect.net/base-layer/releasekit/src/commit/23203f235cc414c4ffe0fd3941030eb0c9f9943f/docs/config.md).
 
 Each integration also distributes its own `COPYRIGHT`, `LICENSE`, and
 `docs/oss/attribution.md`. These module-local materials are separate from the
@@ -121,14 +122,41 @@ proxy availability, or downstream installation.
 
 ## Completion and ambiguous publication
 
-A successful push to the expected endpoint completes the source release. On an
-ambiguous result, use the exact endpoint, full tag, and annotated tag object
-reported by that invocation. Confirm endpoint resolution has not changed, then
-query only that exact tag ref. Compare the remote annotated tag-object ID with
-the reported object: an exact match confirms publication, a different object is
-a conflict, successful output without the ref proves absence at that endpoint,
+A successful push to the expected endpoint completes the source release.
+ReleaseKit also attempts to save private publication evidence under the
+repository's Git common directory, shared by linked worktrees. It reports the
+saved record path or a recording warning separately from publication status;
+a storage failure does not change publication status. Records can contain
+credential-bearing endpoints. Retain them privately while recovery is needed
+and remove them when their recovery value expires; retention is maintainer-owned.
+
+On an ambiguous result, use the recovery command printed for that invocation's
+saved record. To discover records and explicitly select the matching attempt,
+the bootstrapped executable can also be used from the repository root:
+
+```sh
+./.releasekit/bin/releasekit publication-attempts --repo .
+./.releasekit/bin/releasekit reconcile --record /absolute/path/to/attempt.json
+```
+
+Replace the example record path with the saved path for the intended attempt.
+Discovery lists local evidence without querying remotes or selecting an attempt.
+Reconciliation observes the recorded endpoint, full tag, and tag object without
+rerunning candidate validation or changing tags. It distinguishes confirmed
+publication, current absence, conflict, and an unresolved observation. Current
+absence does not prove that a version was never published. The pinned
+[CLI reference](https://forge.maximumdirect.net/base-layer/releasekit/src/commit/23203f235cc414c4ffe0fd3941030eb0c9f9943f/docs/cli.md#recover-a-saved-publication-attempt-or-discover-local-attempts)
+owns recovery statuses and structured output; the
+[publication guide](https://forge.maximumdirect.net/base-layer/releasekit/src/commit/23203f235cc414c4ffe0fd3941030eb0c9f9943f/docs/consumers/publish.md#retain-and-reconcile-publication-evidence)
+describes record storage and recovery entry points.
+
+If no usable record was saved, use the exact endpoint, full tag, and annotated
+tag object reported by that invocation. Query only that exact tag ref at the
+captured endpoint. An exact tag-object match confirms publication, a different
+object is a conflict, successful output without the ref shows current absence,
 and a failed query leaves the result unresolved. Do not infer the captured
-endpoint's state from another remote or a rewritten URL.
+endpoint's state from another remote or a rewritten URL. Resolve unknown
+publication state before retrying.
 
 ReleaseKit may retain a local tag after a failed push. Remove an unpublished
 local tag only after proving absence at the captured endpoint and confirming