Final RC closure: status accuracy and immutable ref protection

docs/ATTRIBUTABLE_PUBLICATION.md

@@ -54,7 +54,11 @@ Required properties:
 - [ ] tag points directly to one commit;
 - [ ] direct target equals the exact release candidate SHA;
 - [ ] tag version exactly matches package release metadata;
-- [ ] historical tags are not moved or re-attributed.
+- [ ] historical tags are not moved or re-attributed;
+- [ ] live repository settings protect the release-tag namespace against update and deletion after tag creation;
+- [ ] `main` is protected against force-push and deletion by branch protection or an active equivalent ruleset.
+
+Ref protection is defense in depth, not a substitute for cryptographic identity checks. The release authorizer must still resolve and verify the annotated tag object and direct candidate target on every authorization run. Repository-setting evidence must be checked live; documentation cannot self-assert that the protection exists.
 
 The production Publish workflow must itself be dispatched on `refs/tags/<tag>`. Checking out a tag from a branch-bound workflow is not equivalent because the Sigstore workflow identity would remain branch-bound.
 
@@ -210,6 +214,7 @@ Promotion to a production-stable `v1.3.0` claim additionally requires the projec
 ## Final maintainer checklist
 
 - [ ] exact final candidate passes the complete development matrix;
+- [ ] `main` and the release-tag namespace have live verified ref protection;
 - [ ] signed annotated immutable tag exists and is GitHub-verified;
 - [ ] all seven required release-evidence workflows succeed as tag-bound `workflow_dispatch` runs;
 - [ ] label-free prediction → exact-run evaluation handoff is retained and digest-bound;

docs/CURRENT_RELEASE_STATUS.md

@@ -4,7 +4,7 @@ Living release/adoption status for Open Verification Kernel.
 
 **Last reviewed:** 2026-08-26
 
-**Current judgment:** `1.3.0-rc.1` is an **engineering release candidate under final review in PR #23** (`hardening/final-release-closure-2026-08-25`). It is not yet an attributable `v1.3.0-rc.1` release. The last previously signed immutable release remains `v1.2.1`; evidence from that tag must not be re-attributed to the RC source tree.
+**Current judgment:** `1.3.0-rc.1` is an **engineering release candidate after the merge of final technical-closure PR #23**. It is not yet an attributable `v1.3.0-rc.1` release. The last previously signed immutable release remains `v1.2.1`; evidence from that tag must not be re-attributed to the RC source tree. The exact RC source identity is the final post-documentation candidate SHA that passes the complete exact-head development matrix; later movement of `main` does not redefine or authorize that candidate.
 
 The authoritative publication procedure is [RELEASE.md](RELEASE.md). The evidence threshold is [ATTRIBUTABLE_PUBLICATION.md](ATTRIBUTABLE_PUBLICATION.md). The generated TCB is [TRUSTED_COMPUTING_BASE.md](TRUSTED_COMPUTING_BASE.md).
 
@@ -68,6 +68,17 @@ The exact final candidate SHA must pass all of the following after the last code
 
 A historical green SHA is not enough after the tree changes. The final exact-head matrix is the pre-tag engineering gate.
 
+## Repository ref-integrity gate
+
+Release identity depends on repository refs remaining non-rewritable after they become authoritative. Before public publication:
+
+- [ ] `main` is protected against force-push and deletion, either by branch protection or an active equivalent ruleset;
+- [ ] the release-tag namespace (`v*`, or a stricter equivalent covering this RC and future releases) is protected against update and deletion after tag creation;
+- [ ] the signed annotated tag points directly to the exact final candidate SHA and GitHub reports the tag signature as verified;
+- [ ] repository settings are checked live rather than inferred from documentation.
+
+The current protection gap is tracked in issue #25. Ref protection is defense in depth and does not replace exact-SHA, signed-tag, or release-ledger verification.
+
 ## Tag-bound release authorization gate
 
 After the engineering candidate is frozen and a signed annotated tag is created, release authorization requires **new** `workflow_dispatch` runs on that exact tag for:
@@ -120,6 +131,7 @@ Until an attributable `v1.3.0-rc.1` release exists, do not present that tag as a
 These cannot be truthfully marked complete merely from repository code:
 
 - [ ] freeze the exact final candidate after its complete development matrix is green;
+- [ ] configure and live-verify `main` plus release-tag ref protection (issue #25);
 - [ ] create and push the signed annotated `v1.3.0-rc.1` tag;
 - [ ] execute all seven tag-bound release-evidence workflows;
 - [ ] retain governed holdout and consumer artifacts for those exact run IDs;

docs/RELEASE.md

@@ -63,7 +63,15 @@ For this RC, that is `1.3.0-rc.1` and `v1.3.0-rc.1`. PyPI normalizes the version
 
 ## 2. Create a signed annotated immutable tag
 
-Create the tag only after the candidate commit is final:
+Before creating or pushing the release tag, live-verify repository ref protection:
+
+- `main` must be protected against force-push and deletion by branch protection or an active equivalent ruleset;
+- the release-tag namespace (`v*`, or a stricter equivalent covering the RC and future release tags) must be protected against update and deletion after creation;
+- these settings must be checked from live GitHub repository state, not inferred from this document.
+
+For `v1.3.0-rc.1`, the current ref-protection closure is tracked in issue #25. Do not treat the existence of that issue as evidence that the settings are configured.
+
+Create the tag only after the candidate commit is final and the ref-integrity precondition above is satisfied:
 
 ```bash
 export CANDIDATE_SHA='<exact 40-hex candidate commit>'
@@ -75,6 +83,8 @@ git push origin "$TAG"
 
 The production authorizer requires an **annotated** tag whose signature GitHub reports as verified and whose direct target is exactly `CANDIDATE_SHA`. Lightweight tags, unsigned annotated tags, indirect/wrong targets, moved historical tags, or tags whose version differs from package metadata fail closed.
 
+Ref protection is additional integrity control, not a substitute for those cryptographic and exact-target checks. The release authorizer must independently resolve the annotated tag object and candidate target on every run.
+
 Do not move `v1.2.1` or earlier historical tags. Do not re-attribute historical Sigstore evidence to the new candidate.
 
 ## 3. Produce tag-bound release evidence