Document verified GitHub SkillSync distribution

CHANGELOG.md

@@ -1,5 +1,9 @@
 ## 0.1.4 - 2026-10-09
 
+GitHub release run `37897733439` succeeded. Downloaded package/SBOM/manifest
+checksums and asset digests matched; isolated installation and the packaged
+synthetic delivery-coverage check passed with `execution: not-run`.
+
 - Publish new tagged packages through GitHub Releases with SHA256 checksums,
   validated CycloneDX SBOM and required GitHub provenance, without an npm account.
 - Keep npm-based CI defaults on the actually public 0.1.0 package; source and

README.md

@@ -32,8 +32,12 @@ node dist/cli/index.js verify --path fixtures/product/trust-loop/review --target
 
 Tagged builds now publish a CLI tarball, checksums, a validated CycloneDX SBOM
 and a source manifest on [GitHub Releases](https://github.com/Chumaniac/skillsync/releases).
-The current source candidate is 0.1.4; its release is complete only after the
-matching immutable tag workflow succeeds. Installation still uses Node.js 20+
+[GitHub v0.1.4](https://github.com/Chumaniac/skillsync/releases/tag/v0.1.4)
+is published. Release run 37897733439 passed its source/main binding, tests,
+actual package allowlist, locked production SBOM and required GitHub provenance.
+The downloaded archive, SBOM and source manifest matched their checksums and
+public asset digests; an isolated install reported 0.1.4 and passed the packaged
+synthetic delivery-coverage example with `execution: not-run`. Installation still uses Node.js 20+
 and fetches the package's public dependencies; it needs no npm login.
 
 ```bash

fixtures/product/delivery-coverage/README.md

@@ -1,12 +1,12 @@
-# Expected delivery coverage — local candidate
+# Expected delivery coverage — GitHub v0.1.4
 
-This source-only candidate detects a different omission from dangling references:
+This packaged synthetic example detects a different omission from dangling references:
 all delivered rows can point to valid orders while an expected order has no rows.
 The synthetic expected-order table is an explicit checklist, not an authenticated
 order system. `require_all_targets: true` requires every declared unique target ID
 to appear in the selected source field at least once. The default remains false.
 
-Build the candidate source, then run:
+Build the source or install the GitHub package, then run from the repository/package root:
 
 ```bash
 node dist/cli/index.js artifacts --contract fixtures/product/delivery-coverage/contract.json --path fixtures/product/delivery-coverage/artifacts --format json
@@ -27,5 +27,7 @@ All relation checks remain within the shared 100,000-cell index and 256-finding
 ceilings; the indexes store fingerprints and row numbers rather than ID contents.
 No runtime, network, account or real business integration is executed.
 
-The new coverage option is in the 0.1.3 source release candidate; npm publication
-is separately verified after its release workflow succeeds.
+The coverage option was introduced in source 0.1.3 and is included in the
+published GitHub v0.1.4 package. The packaged example passed after installing
+that public archive. The npm registry remains at 0.1.0; GitHub distribution and
+real business acceptance are separate evidence.