Publish verified hardening release

.github/workflows/release.yml

@@ -0,0 +1,55 @@
+name: Publish versioned release
+on:
+  push:
+    branches: [main]
+    paths: [VERSION, '.github/workflows/release.yml']
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: release-${{ github.repository }}
+  cancel-in-progress: false
+jobs:
+  release:
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - run: pip install build twine pytest pytest-asyncio httpx -e .
+      - run: python -m pytest tests -q
+      - run: python -m build && twine check dist/*
+      - name: Validate release version
+        run: |
+          python -c "import pathlib,re; v=pathlib.Path('VERSION').read_text().strip(); assert re.fullmatch(r'[0-9]+\.[0-9]+\.[0-9]+(?:a[0-9]+)?',v)"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: distributions
+          path: dist/
+      - name: Publish versioned GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          version=$(cat VERSION)
+          if gh release view "v$version" >/dev/null 2>&1; then
+            echo 'This version already has a release; refusing to overwrite it.'
+            exit 1
+          fi
+          gh release create "v$version" --target "$GITHUB_SHA" --title "v$version" --notes-file RELEASE-NOTES.md dist/*
+  pypi:
+    needs: release
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: distributions
+          path: downloaded/
+      - run: mkdir dist && cp downloaded/*.whl downloaded/*.tar.gz dist/
+      - name: Publish to PyPI using the configured trusted publisher
+        uses: pypa/gh-action-pypi-publish@release/v1

RELEASE-NOTES.md

@@ -0,0 +1,5 @@
+# Release 0.6.1
+
+Includes the reviewed September 2026 integrity, replay, persistence, async-lifecycle and compatibility repairs applicable to this repository. Wire/profile versions are unchanged unless explicitly described in the repository hardening notes.
+
+See HARDENING.md for supported verification scopes and migration boundaries. Registry publication and service deployment are reported by their workflows; a source merge alone is not a published package.

VERSION

@@ -0,0 +1 @@
+0.6.1

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "jep-cli"
-version = "0.6.0"
+version = "0.6.1"
 description = "Command-line tool for creating and verifying JEP v0.6 events through the JEP API"
 readme = "README.md"
 license = { text = "MIT" }
@@ -29,9 +29,9 @@ dev = [
 jep = "jep_cli.main:main"
 
 [project.urls]
-Homepage = "https://github.com/hjs-spec/jep-cli"
-Repository = "https://github.com/hjs-spec/jep-cli"
-Issues = "https://github.com/hjs-spec/jep-cli/issues"
+Homepage = "https://github.com/hjs-spec/cli"
+Repository = "https://github.com/hjs-spec/cli"
+Issues = "https://github.com/hjs-spec/cli/issues"
 
 [tool.setuptools.packages.find]
 include = ["jep_cli*"]