fix(C-373 PR-4): retag v1 to main + release immutability policy

docs/MVP_SPEC_AMENDMENTS.md

@@ -0,0 +1,17 @@
+# MVP_SPEC Amendments (C-373)
+
+Recorded deviations from `MVP_SPEC.md` (authoritative handoff companion).
+The spec serves the build; amendments keep the trail coherent.
+
+## D1 — Validator location
+
+| Handoff | Shipped |
+| --- | --- |
+| `packages/validator/` | `packages/guard-core/` (`@epicon-guard/guard-core`) |
+
+**Rationale:** Validator extraction landed in `guard-core` during C-368 as shared
+engine for Action + App. Functionally identical scope: six invariants, deny-by-default,
+base-SHA policy pinning, zero runtime dependencies. Directory rename deferred as
+compliance theater.
+
+**Entrypoint:** `src/validate.mjs` imports from `../packages/guard-core/src/index.mjs`.

docs/releases/TAG_POLICY.md

@@ -0,0 +1,36 @@
+# EPICON Guard — Release Tag Policy
+
+**Effective:** 2026-07-15 (C-373 PR-4)  
+**Authority:** Custodian-approved; movements logged in this directory.
+
+## Tags
+
+| Tag | Semantics | Mutability |
+| --- | --- | --- |
+| `v1.0.0` | First public release matching truth-only README + guard-core validator | **Immutable** — never moved or deleted |
+| `v1` | Floating convenience ref for Quick Start (`kaizencycle/epicon@v1`) | **Moves only** on post-merge `main` when a release PR explicitly retags it |
+| `v1.1` | Feature release (base-SHA policy loading) | Immutable at its release SHA |
+
+## Rules
+
+1. **Immutable tags are append-only.** Once `vX.Y.Z` is pushed, it never moves.
+2. **Floating `v1` moves only after merge to `main`.** Never retag from a PR branch; never retag without a logged entry in [`v1.md`](./v1.md).
+3. **Retag requires witness.** Every `v1` movement records: date, target SHA, prior SHA, reason, and verifying test output.
+4. **README `@v1` must resolve to code matching the README.** If `main` advances the Action, either retag `v1` in the same release PR or change docs — never both diverge.
+
+## Verification commands (cycle-close canon)
+
+```bash
+git fetch origin main --tags
+git rev-parse origin/main^{}          # main SHA
+git rev-parse v1^{}                   # floating tag SHA — must match post-retag main
+git rev-parse v1.0.0^{}               # immutable release SHA
+node test/classify.test.mjs
+node test/policy-ref.test.mjs
+```
+
+Check **refs, not renders.** GitHub's rendered repo page and CDN can lag; SHAs cannot.
+
+## Movement log
+
+All `v1` movements are appended to [`v1.md`](./v1.md#movement-log).

docs/releases/v1.0.0.md

@@ -0,0 +1,38 @@
+# EPICON Guard v1.0.0
+
+**Tag:** `v1.0.0` (immutable)  
+**Floating tag:** `v1` retagged to this commit  
+**Date:** 2026-07-15
+
+First public release where `kaizencycle/epicon@v1` matches the truth-only README
+and the guard-core validator shipped on `main`.
+
+## Install
+
+```yaml
+- uses: actions/checkout@v4
+- uses: kaizencycle/epicon@v1
+  with:
+    mode: enforce
+```
+
+`policy-ref: base` is the default on pull requests — proposer-independent tier
+classification without a shell pin (see [`v1.1.md`](./v1.1.md) for migration notes).
+
+## Contents
+
+- `action.yml` — composite action entrypoint
+- `src/validate.mjs` — thin wrapper over `@epicon-guard/guard-core`
+- `packages/guard-core/` — shared validation engine (six invariants, deny-by-default)
+- `policy/epicon-policy.example.json` — default tier registry
+
+## Verification (at release)
+
+```text
+node test/classify.test.mjs   — 11/11 pass
+node test/policy-ref.test.mjs — 9/9 pass
+```
+
+## Policy
+
+See [`TAG_POLICY.md`](./TAG_POLICY.md). `v1.0.0` is immutable; `v1` floats per that policy.

docs/releases/v1.md

@@ -1,21 +1,32 @@
-# EPICON Guard v1
+# EPICON Guard v1 (floating tag)
 
-**Tag:** `v1`  
-**Date:** 2026-07-09
+**Tag:** `v1` — **floating** (see [`TAG_POLICY.md`](./TAG_POLICY.md))  
+**Current target:** set at each documented movement below.
 
-First stable release of the EPICON Guard GitHub Action — Intent Publication
-Gate with EP-1/EP-2/EP-3 tier classification.
+Convenience ref for Quick Start: `kaizencycle/epicon@v1`
 
 ## Install
 
 ```yaml
 - uses: kaizencycle/epicon@v1
 ```
 
-## Contents
+Prefer pinning an immutable tag (`v1.0.0`) for reproducible CI.
+
+## Contents (current)
 
 - `action.yml` — composite action entrypoint
-- `src/validate.mjs` — zero-dependency validator (Node ≥ 20)
+- `src/validate.mjs` — delegates to `packages/guard-core/`
+- `packages/guard-core/` — validation engine
 - `policy/epicon-policy.example.json` — default tier registry
 
 Canon: [Mobius-Substrate/docs/epicon](https://github.com/kaizencycle/Mobius-Substrate/tree/main/docs/epicon)
+
+---
+
+## Movement log
+
+| Date | Target SHA | Prior SHA | Reason | Witness |
+| --- | --- | --- | --- | --- |
+| 2026-07-09 | `c0e5e10` | — | Initial `v1` tag (pre-guard-core) | manual |
+| 2026-07-15 | *(set at PR-4 merge — see `git rev-parse v1^{}`)* | `c0e5e10` | C-373 PR-4: align `@v1` with guard-core + truth-only README on `main` | classify 11/11, policy-ref 9/9 |