docs: publish v0.2.0 release notes document

docs/V0.2.0-RELEASE-NOTES-DRAFT.md → docs/V0.2.0-RELEASE-NOTES.md

@@ -1,16 +1,16 @@
-# v0.2.0 Release Notes Draft
+# v0.2.0 Release Notes
 
-Status: draft only. Do not publish yet.
+Status: published GitHub Release.
 
-Date prepared: 2026-06-15.
+Date published: 2026-06-15.
 
-Target version: `0.2.0`.
+Version: `0.2.0`.
 
-This document is a release notes draft for the future `v0.2.0` GitHub Release.
+GitHub Release: `v0.2.0`.
 
-It is not a tag, not a GitHub Release, not an artifact manifest, and not a PyPI publication.
+PyPI: not published.
 
-## Release summary draft
+## Release summary
 
 `agent-rules-kit` v0.2.0 moves the project from a basic AI-agent instruction-file diagnostic CLI toward a conservative local-first governance diagnostic tool for AI agent instructions.
 
@@ -26,7 +26,7 @@ The release keeps the original product boundary:
 
 ## Main changes
 
-v0.2.0 is expected to include:
+v0.2.0 includes:
 
 - governance diagnostics for unsupported security, production-readiness, or maturity claims;
 - governance diagnostics for review or CI bypass guidance;
@@ -40,6 +40,14 @@ v0.2.0 is expected to include:
 - Node 24-compatible GitHub Actions workflow actions;
 - release-readiness, packaging dry-run, and governance-boundaries evidence documents.
 
+## Release artifacts
+
+The published `v0.2.0` GitHub Release includes final release artifacts attached to the release.
+
+The release artifacts were built, uploaded, downloaded, installed, and smoke-tested as part of the release workflow.
+
+The release remains intentionally unpublished to PyPI.
+
 ## Security and reporting notes
 
 This project is not a security scanner and does not prove that a repository is safe.
@@ -50,17 +58,9 @@ Do not claim private vulnerability reporting is enabled.
 
 Sensitive vulnerabilities should not be opened as public issues. If private reporting is unavailable, reporters should avoid publishing secrets, exploit details, private URLs, customer data, or sensitive repository contents.
 
-## Packaging notes
-
-A packaging dry-run was completed before the version cut, but final `v0.2.0` artifacts are still pending.
-
-Final release artifacts must be built after this metadata phase is merged and verified.
-
-The pre-version-cut dry-run checksums must not be reused as final `v0.2.0` release checksums.
-
 ## Not included
 
-v0.2.0 must not claim:
+v0.2.0 does not claim:
 
 - stable public maturity;
 - PyPI availability;
@@ -72,27 +72,14 @@ v0.2.0 must not claim:
 - complete secret scanning;
 - runtime repository command execution.
 
-## Remaining release gates
+## Release status
 
-Before publishing a GitHub Release, the maintainer must still verify:
+The `v0.2.0` GitHub Release is published.
 
-- final release SHA;
-- local checks on final release SHA;
-- CI on final release SHA;
-- final wheel and sdist build;
-- final artifact SHA256 checksums;
-- clean virtual environment install from wheel;
-- clean virtual environment install from sdist;
-- console script smoke test;
-- `python -m agent_rules_kit.cli` smoke test;
-- exact `v0.2.0` tag creation;
-- GitHub Release creation;
-- uploaded release assets;
-- downloaded release assets install and smoke test;
-- no PyPI claim unless PyPI publication is completed in a separate explicit phase.
+The exact `v0.2.0` tag exists.
 
-## Draft decision
+Final release assets are attached to the GitHub Release.
 
-This draft may be used only after AIRK-REL021 is merged and verified on `main`.
+PyPI publication has not been completed and must not be claimed.
 
-The next phase after this metadata cut should build and verify final `v0.2.0` artifacts before any tag or GitHub Release is created.
+Future release work should happen in a new explicit phase.