Outcome: Every statement that CivicCore v1.2.0 is the current downstream line is corrected to v1.2.1, in both repositori

.github/workflows/release.yml

@@ -10,7 +10,7 @@ on:
       release_tag:
         description: "Published release tag to rehearse from cold caches"
         required: true
-        default: "v1.2.0"
+        default: "v1.2.1"
 
 permissions:
   contents: write

README.md

@@ -73,7 +73,7 @@ Phase work and must not be relied on by downstream modules until they ship.
 
 ## Status
 
-**v1.2.0 is the current CivicCore downstream productization line.** It carries
+**v1.2.1 is the current CivicCore downstream productization line.** It carries
 the shared document-ingestion pipeline used by the city-core release train,
 the CO-7 freeze-line trust anchor, the CO-8 procurement evidence pack, and the
 CO-9 closeout trail for modules that need a procurement-grade platform pin.
@@ -135,10 +135,10 @@ shared-schema baseline extracted from CivicRecords AI).
 
 ## Install
 
-From the current GitHub release wheel (`v1.2.0`):
+From the current GitHub release wheel (`v1.2.1`):
 
 ```bash
-pip install https://github.com/CivicSuite/civiccore/releases/download/v1.2.0/civiccore-1.2.0-py3-none-any.whl
+pip install https://github.com/CivicSuite/civiccore/releases/download/v1.2.1/civiccore-1.2.1-py3-none-any.whl
 ```
 
 Each GitHub release also publishes `SHA256SUMS.txt` alongside the wheel and
@@ -154,7 +154,7 @@ the annotated tag object is unsigned. Treat the release-page badge as a commit
 signal only; use `scripts/verify-release-provenance.py` and
 `docs/ops/release-signing.md` for release-tag provenance.
 
-`v1.2.0` is the current published downstream productization line. It adds the
+`v1.2.1` is the current published downstream productization line. It adds the
 shared document-ingestion pipeline used by the city-core release train. The
 original `v1.0` release remains historical and superseded. `v0.22.1` remains
 the first attested baseline release, and `civiccore-m1-freeze` remains the

README.txt

@@ -57,7 +57,7 @@ determinations are still not shipped platform behaviors.
 Status
 ------
 
-v1.2.0 is the current CivicCore downstream productization line. It carries the
+v1.2.1 is the current CivicCore downstream productization line. It carries the
 shared document-ingestion pipeline used by the city-core release train, the
 CO-7 freeze-line trust anchor, the CO-8 procurement evidence pack, and the
 CO-9 closeout trail.
@@ -77,11 +77,11 @@ Install
 
 From the current published GitHub release wheel:
 
-    pip install https://github.com/CivicSuite/civiccore/releases/download/v1.2.0/civiccore-1.2.0-py3-none-any.whl
+    pip install https://github.com/CivicSuite/civiccore/releases/download/v1.2.1/civiccore-1.2.1-py3-none-any.whl
 
 CivicCore is distributed as versioned GitHub release artifacts (not on PyPI).
 Each release publishes SHA256SUMS.txt alongside the wheel and sdist. Verify
-checksums before promoting an artifact downstream. v1.2.0 is the current
+checksums before promoting an artifact downstream. v1.2.1 is the current
 published downstream productization line and includes the shared
 document-ingestion pipeline used by the city-core release train. v0.22.0 and
 earlier releases are retained for historical installs only.

USER-MANUAL.md

@@ -1,6 +1,6 @@
 # CivicCore User Manual
 
-Version: v1.2.0 (current downstream productization line)
+Version: v1.2.1 (current downstream productization line)
 Repository: https://github.com/CivicSuite/civiccore
 License: Apache 2.0
 
@@ -94,19 +94,19 @@ not promote those behaviors as shipped CivicCore capability.
 CivicCore is distributed as GitHub release artifacts, not PyPI packages:
 
 ```bash
-pip install https://github.com/CivicSuite/civiccore/releases/download/v1.2.0/civiccore-1.2.0-py3-none-any.whl
+pip install https://github.com/CivicSuite/civiccore/releases/download/v1.2.1/civiccore-1.2.1-py3-none-any.whl
 ```
 
 Each release publishes `SHA256SUMS.txt` next to the wheel and source
 distribution. Verify checksums before promoting a release artifact:
 
 ```bash
 curl -L -o SHA256SUMS.txt \
-  https://github.com/CivicSuite/civiccore/releases/download/v1.2.0/SHA256SUMS.txt
+  https://github.com/CivicSuite/civiccore/releases/download/v1.2.1/SHA256SUMS.txt
 sha256sum -c SHA256SUMS.txt
 ```
 
-`v1.2.0` is the current published downstream productization line and includes
+`v1.2.1` is the current published downstream productization line and includes
 the shared document-ingestion pipeline used by the city-core release train.
 `v0.22.1` is the first
 CivicCore release with a Sigstore-signed

USER-MANUAL.txt

@@ -1,7 +1,7 @@
 CivicCore User Manual
 =====================
 
-Version: v1.2.0 (current downstream productization line)
+Version: v1.2.1 (current downstream productization line)
 Repository: https://github.com/CivicSuite/civiccore
 License: Apache 2.0
 
@@ -66,15 +66,15 @@ Technical Guide
 
 Install from the GitHub release wheel:
 
-    pip install https://github.com/CivicSuite/civiccore/releases/download/v1.2.0/civiccore-1.2.0-py3-none-any.whl
+    pip install https://github.com/CivicSuite/civiccore/releases/download/v1.2.1/civiccore-1.2.1-py3-none-any.whl
 
 Verify the release artifact:
 
     curl -L -o SHA256SUMS.txt \
-      https://github.com/CivicSuite/civiccore/releases/download/v1.2.0/SHA256SUMS.txt
+      https://github.com/CivicSuite/civiccore/releases/download/v1.2.1/SHA256SUMS.txt
     sha256sum -c SHA256SUMS.txt
 
-v1.2.0 is the current published downstream productization line and includes
+v1.2.1 is the current published downstream productization line and includes
 the shared document-ingestion pipeline used by the city-core release train.
 v0.22.1 is the first
 CivicCore release with a Sigstore-signed release-attestation.json and bundle. Earlier CivicCore releases are retained

docs/index.html

@@ -3,8 +3,8 @@
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
-<meta name="description" content="CivicCore v1.2.0 - shared platform library for the open-source CivicSuite municipal operations suite. Not an end-user app. Apache 2.0.">
-<title>CivicCore v1.2.0 - CivicSuite shared platform library</title>
+<meta name="description" content="CivicCore v1.2.1 - shared platform library for the open-source CivicSuite municipal operations suite. Not an end-user app. Apache 2.0.">
+<title>CivicCore v1.2.1 - CivicSuite shared platform library</title>
   <style>
     :root {
       --text: #1f2328;
@@ -178,14 +178,14 @@ <h3>Still planned extraction targets</h3>
 
     <section aria-labelledby="install">
       <h2 id="install">Install</h2>
-      <p>From the current GitHub release wheel (<code>v1.2.0</code>) - civiccore is GitHub-wheel-only, not on PyPI:</p>
-      <pre><code>pip install https://github.com/CivicSuite/civiccore/releases/download/v1.2.0/civiccore-1.2.0-py3-none-any.whl</code></pre>
+      <p>From the current GitHub release wheel (<code>v1.2.1</code>) - civiccore is GitHub-wheel-only, not on PyPI:</p>
+      <pre><code>pip install https://github.com/CivicSuite/civiccore/releases/download/v1.2.1/civiccore-1.2.1-py3-none-any.whl</code></pre>
       <p>For development from a clone:</p>
       <pre><code>git clone https://github.com/CivicSuite/civiccore.git
 cd civiccore
 pip install -e .[dev]</code></pre>
       <p>Each release publishes <code>SHA256SUMS.txt</code> alongside the wheel and sdist. Verify the checksum before promoting an artifact downstream.</p>
-      <p><strong>Release provenance note:</strong> GitHub release pages can show a target commit as Verified even when the release tag itself is lightweight or unsigned. CivicCore treats tags as release pointers and verifies <code>release-attestation.json</code> plus its Sigstore/cosign bundle as the trust artifact. The exact workflow identity is pinned per repo and per tag; see <code>docs/ops/release-signing.md</code>, <code>docs/ops/release-attestation.schema.json</code>, <code>docs/ops/civiccore-tier1-retrofit-ledger.md</code>, and <code>docs/ops/historical-provenance.md</code>. The published <code>v1.2.0</code> release is the current downstream productization line and includes the shared document-ingestion pipeline used by the city-core release train; <code>v0.22.1</code> remains the first attested baseline. Earlier CivicCore releases are retained for historical installs only and must not be promoted as provenance baselines unless a future additive attestation is explicitly authorized, published, and ledgered.</p>
+      <p><strong>Release provenance note:</strong> GitHub release pages can show a target commit as Verified even when the release tag itself is lightweight or unsigned. CivicCore treats tags as release pointers and verifies <code>release-attestation.json</code> plus its Sigstore/cosign bundle as the trust artifact. The exact workflow identity is pinned per repo and per tag; see <code>docs/ops/release-signing.md</code>, <code>docs/ops/release-attestation.schema.json</code>, <code>docs/ops/civiccore-tier1-retrofit-ledger.md</code>, and <code>docs/ops/historical-provenance.md</code>. The published <code>v1.2.1</code> release is the current downstream productization line and includes the shared document-ingestion pipeline used by the city-core release train; <code>v0.22.1</code> remains the first attested baseline. Earlier CivicCore releases are retained for historical installs only and must not be promoted as provenance baselines unless a future additive attestation is explicitly authorized, published, and ledgered.</p>
       <figure style="margin: 2em 0;">
         <img src="diagrams/migration-order.svg" alt="Consumer apps invoke civiccore migrations before their own Alembic chain." style="max-width: 100%; height: auto; display: block; margin: 0 auto;">
         <figcaption style="text-align: center; color: #666; font-size: 0.9em; margin-top: 0.5em;">Migration order - civiccore runs first; consumer chain runs second.</figcaption>
@@ -196,7 +196,7 @@ <h2 id="install">Install</h2>
       <h2 id="status">Status</h2>
       <div class="status">
         <p>
-          <strong>v1.2.0 is the current published downstream productization line.</strong>
+          <strong>v1.2.1 is the current published downstream productization line.</strong>
           It carries the shared document-ingestion pipeline used by the city-core release train, plus the CO-7 freeze-line trust anchor, the CO-8 procurement evidence pack, and the CO-9 closeout trail.
           <code>v0.22.1</code> remains the first attested baseline release. The current development line includes the canonical Sigstore release-provenance helper,
           versioned attestation schema, fixture-driven gate, and release workflow that signs and verifies

tests/test_github_workflows.py

@@ -29,7 +29,7 @@ def test_release_workflow_uploads_explicit_downloaded_asset_files() -> None:
     publish_script = workflow["jobs"]["publish-release"]["steps"][0]["run"]
 
     assert release_tag["required"] is True
-    assert release_tag["default"] == "v1.2.0"
+    assert release_tag["default"] == "v1.2.1"
     assert "v*" in tag_triggers
     assert "civiccore-*-freeze" in tag_triggers
     assert workflow["jobs"]["cleanroom-rehearsal"]["if"] == "github.event_name == 'workflow_dispatch'"