Record publication receipts in manifest, changelog and acceptance report

CHANGELOG.md

@@ -177,8 +177,24 @@ release is uploaded, and every accepted result below was produced with
   change and the acceptance chain re-run; `READY_TO_UPLOAD` conditions are
   all satisfied.
 
+### Published (same day)
+
+- v0.1.0 was uploaded to
+  [`WayneRR/cognitive-learning-lab`](https://huggingface.co/WayneRR/cognitive-learning-lab)
+  as a single commit `4225068d…` (14 files: 10 hash-surface documents,
+  manifest, SHA256SUMS, wheel, sdist). Nothing but the thin package went up —
+  no weights, no private paths, no experiment data.
+- Post-download verification passed: wheel and sdist re-downloaded from the
+  published repo hash-match the uploaded build byte-for-byte, and a fresh
+  venv smoke of the downloaded-back wheel runs the full chain
+  (`answered`/`verified_judgment`, replay reuse).
+- Package state: `LOCAL_ACCEPTED_REAL_MODEL_SMOKE / PUBLISHED`.
+  PR-M2/v0.2.0 is next and has not been started.
+
 ### Not done
 
-- Nothing was uploaded to any remote; the destination repository id is chosen
-  (`cognitive-learning-lab`) but not yet recorded as a created repository, and
-  revision `55cf4c4e…` is still awaiting publication approval.
+- (2026-11-05, superseded the same day) the two items that used to be listed
+  here — an un-uploaded build and an unapproved revision — were both closed:
+  the owner approved the revision and the package was published; see
+  "Published" above. Still genuinely open: the byte-level clean install of
+  `requirements-lock.txt` (conditional, unchanged) and all of PR-M2/PR-M3.

RELEASE-MANIFEST.json

@@ -77,19 +77,23 @@
     "blocked_on": [],
     "decisions": "destination repo id and publication revision approved by the owner on 2026-11-05",
     "destination": "huggingface.co/WayneRR/cognitive-learning-lab (model repo)",
+    "post_download_verification": "wheel+sdist re-downloaded from the published repo via hf-mirror (the file CDN behind huggingface.co times out on this network; hashes are endpoint-independent) and both SHA-256 match the uploaded build exactly: wheel 803ee8248669030d97fedc2d185af5ce5d0821711eb3a911b30e3857e9dce667, sdist 37375e949ab869cccd431342a87c1d6dc9db0af98c504e79538c89ad68cb4753. A fresh uv venv installed the downloaded-back wheel: doctor rc=0, infer rc=0 answered/mock/verified_judgment, second-process replay rc=0 answered with memory reuse.",
     "publication_revision": "55cf4c4ebb4ebe31b2550e8bdf3bd21b99753851",
-    "status": "UPLOAD_EXECUTION_PENDING",
-    "uploaded": false
+    "remote_commit": "4225068d5f589f1bea843cce313475ce197c3b79",
+    "remote_commit_url": "https://huggingface.co/WayneRR/cognitive-learning-lab/commit/4225068d5f589f1bea843cce313475ce197c3b79",
+    "status": "PUBLISHED",
+    "uploaded": true,
+    "uploaded_at_utc": "2026-11-05T09:20:00+00:00 (approx; single upload_folder commit)"
   },
   "release_bundle_files_sha256": {
-    "CHANGELOG.md": "2690f7e5dcbba1d77649f77542a66aa359fe446c4c1d42de601f9ead68a20759",
+    "CHANGELOG.md": "de097210d06989e82d0cfc07f38d7acd486b1b2440b17d0142742a16185b11cb",
     "LICENSE": "d55f3052cc51ef8bb0fb0161b55f98d93cb7542c1c6b19e1ebf5655a8c1408a1",
     "MODEL_CARD.md": "50093c10d4c51f9cfa96d6bad44a3c9d3377ca96dc073d5e37fe5d2ba0d284e1",
     "PAPER-ARTIFACT-NOTE.md": "922482bb820725975e920a5367a13bec8413890b8cc8eedbb4c4e09f31dd1526",
     "README.md": "201e6222421c8fa1aca0fa21c87fbff558f740d4c690329f7bb1c8ba84c8069c",
     "SOURCE-INVENTORY.md": "9da97103cbd853534c6e5d9f866bc1608330c213ffad76d7d6d2ef6317edee82",
     "THIRD_PARTY_NOTICES.md": "4d4222fba571ec4621f22c6a199925375fbb3d43bbec774a8f800bea7417dbc4",
-    "acceptance/PR-M1.md": "bd703c067e492b03d525a1d1fc5ff271fcaa6592d8970fe231e32058e4027fbc",
+    "acceptance/PR-M1.md": "a5135a6209bafa3cd71dee5fd90df5e8f4861d041b3272cab666b229707443db",
     "pyproject.toml": "bdedce510fda22aed93b9035cba67afa6f939785e4f78eab8b799f2109db0b4b",
     "requirements-lock.txt": "adb192fbfd6a98c79c5e59bb7345c8e2db66183d6494d25dd233b1bbcc8ad1f6"
   },

acceptance/PR-M1.md

@@ -450,3 +450,28 @@ and the source tree, sdist mock infer rc=0, SHA256SUMS regenerated with zero
 integrity mismatches. Build identity for the upload: wheel `803ee8248669…`
 46,414 B · sdist `37375e949ab8…` 51,157 B (the two earlier same-day
 identities are superseded and live only in the harness logs).
+
+## Upload and post-download verification (2026-11-05)
+
+Published to `https://huggingface.co/WayneRR/cognitive-learning-lab` as a
+public model repo, single `upload_folder` commit `4225068d5f589f1bea…`
+(14 files: the 10 hash-surface documents, `RELEASE-MANIFEST.json`,
+`SHA256SUMS`, wheel, sdist). Upload ran directly against huggingface.co with
+the owner's write token; no token is stored in any file.
+
+Post-download verification (the checklist's final item):
+
+- the wheel and sdist were re-downloaded **from the published repo** —
+  via hf-mirror, because the file CDN behind huggingface.co times out on
+  this network (the API does not); hashes are endpoint-independent. Both
+  match the uploaded build exactly: wheel `803ee8248669…`,
+  sdist `37375e949ab8…`.
+- a fresh `uv venv` (cr-m1-venv13) installed the **downloaded-back** wheel:
+  `doctor` rc=0, `infer` rc=0 `answered`/`provider_class=mock`/
+  `authorization=verified_judgment`, and a second process replayed the store
+  rc=0 with memory reuse.
+
+This closes the publication loop; package state is recorded as
+`LOCAL_ACCEPTED_REAL_MODEL_SMOKE / PUBLISHED` in `RELEASE-CHECKLIST.md` and
+`RELEASE-MANIFEST.json`. The documents recording the upload were re-uploaded
+to the repo afterwards, so the remote carries the same receipts.