Exercise local source publication

docs/roadmap/implementation.md

@@ -290,7 +290,7 @@ path, build, and delegation responsibilities. Commit the stage.
 
 ## Stage 4: exercise real publication against disposable Git repositories
 
-**Status:** pending. **Prerequisite:** Stage 3 and prepared dependency caches.
+**Status:** complete. **Prerequisite:** Stage 3 and prepared dependency caches.
 
 **Files:** `scripts/release_integration_test.go`, supporting fixture helpers in
 that tests-only package if needed, and stage evidence in this plan.
@@ -348,6 +348,21 @@ Record the passed publication and preflight observations. This exercise uses
 no real remote, credentials, provider, binary target, or hosted page. Retain the
 opt-in test for future tooling changes, without placing it in `releasekit.json`.
 
+Observed 2026-10-08: after `GOWORK=off GOTOOLCHAIN=local go mod download`, this
+offline publication exercise passed:
+
+```sh
+COMMANDKIT_RELEASE_INTEGRATION=1 GOWORK=off GOTOOLCHAIN=local GOPROXY=off GONOPROXY=none GOSUMDB=off go test -mod=readonly -count=1 ./scripts -run '^TestReleaseIntegration$'
+```
+
+The local publication produced an annotated
+`v0.0.1` tag whose object matched the bare remote and pointed to the candidate;
+remote `main` retained that commit, the candidate suite wrote one marker, the
+worktree was clean, and no `dist` output appeared. A second candidate with a
+mismatched expected endpoint returned status 1 with the endpoint diagnostic,
+added no tag, and did not run the suite again. The exercise used only temporary
+local Git repositories and the real cached module-selected publisher.
+
 **Completion:** the actual module-selected executable and copied integration
 publish a source tag locally and respect the configured endpoint guard. Commit
 the stage.