docs: prepare v1.2.0 release

CHANGELOG.md

@@ -16,6 +16,22 @@ On a release, the maintainer moves the accumulated `[Unreleased]` entries into a
 
 ## [Unreleased]
 
+## [1.2.0] — 2026-07-12
+
+NilCore now presents as one serious coding agent across conversation, single-task, project,
+swarm, browser, and desktop work. The core task surfaces route through the unified kernel; every
+surface remains governed by the verifier, sandbox, human gate, and append-only log. This release completes Phases 14–16:
+agentic browser and computer use, the modern OpenAI/OpenRouter/compatible provider surface,
+closed-loop learning and bounded autonomy, recursive decomposition, and the provider
+compatibility eval suite.
+
+The release also incorporates the full defect-hunt/features-review remediation body and closes
+the distribution gap: patched Go and system dependencies, reachable-vulnerability scanning,
+fail-closed checksums and installer tests, complete four-platform asset verification, and version
+identity stamped and executed before publication.
+
+- **release-v1.2.0** — Cut the v1.2.0 changelog boundary, refresh the public release/reference metrics from the live tree, and record the fully gated release baseline; tag publication remains a separately approved irreversible action. _Owns:_ `CHANGELOG.md`, `README.md`, `STATE.md`, `docs/REFERENCE.md`. _(release)_
+
 - **release-version-stamp** — Stamp validated version tags into every release binary, execute the native matrix asset to prove `nilcore version` matches the tag, and refuse malformed release refs before publication; the release E2E now verifies identity as well as checksums and completeness. _Owns:_ `.github/workflows/release.yml`, `test/release-assets-e2e.sh`, `CHANGELOG.md`. _(release hardening)_
 
 - **P15-completion-docs** — Reconcile the canonical task, provider-roadmap, and architecture docs after P15-T13: Phase 15 is complete, the hermetic golden eval is shipped, and the documented I7 boundary now matches the implemented native drop-on-decode plus client-side untrusted-data fence. _Owns:_ `docs/{TASKS,ROADMAP-PROVIDERS,ARCHITECTURE}.md`, `CHANGELOG.md`. _(Phase 15 documentation)_

README.md

@@ -336,8 +336,8 @@ Dependencies point inward; leaf packages never import the orchestrator. The full
 | | |
 |--:|:--|
 | **~90,000** | lines of Go — *the agent itself* (~8k single‑task core · multi‑agent supervisor · conversational front door · verified swarm · recursive decompose · closed‑loop autonomy — all on one orchestration kernel) |
-| ~178,000 | lines including its tests (406 test files) |
-| **120** | small, single‑responsibility packages |
+| ~183,000 | lines including its tests (420 test files) |
+| **121** | small, single‑responsibility packages |
 | **2** | core deps in the default binary — pure‑Go SQLite · `golang.org/x/sys` (Go's extended stdlib); the Charm TUI's 3 modules link only under `make tui`. The browser driver (incl. a pure‑Go CDP/WebSocket client), the multi‑language parser backends, embedder, forge, the provider pool, the swarm runner, and the orchestration kernel + router are all pure stdlib — no module added |
 | **7 / 7** | invariants held |
 | **Phases 0–16** | shipped — incl. the **unified orchestration kernel** (`run`/`build`/`swarm`/`decompose` collapse onto one recursive engine; `nilcore do` routes the goal), **closed‑loop autonomy** (trust‑routing, learned lessons + verify‑cache, a verified self‑improvement flywheel, and graduated auto‑approval fenced by a blast‑budget — opt‑in, never on `main`), the **verifier‑backed artifact factory**, and **verified swarm mode**, atop behavioral browser verification, semantic (HNSW) + multi‑language (**19 languages** / 34 extensions) code intel, event/scheduled triggers, gated draft PRs, and trusted operator steering |

STATE.md

@@ -1,7 +1,7 @@
 # STATE.md — NilCore state snapshot
 
-> **Point-in-time snapshot, 2026-07-12** (`origin/main` after the merged
-> features-completeness review #101 and adversarial remediation #100). This is a
+> **Point-in-time snapshot, 2026-07-12** (v1.2.0 release baseline at `origin/main`
+> after provider completion #105–#106 and release identity hardening #107). This is a
 > derived report, not a contract. The sources of truth remain the mirrored
 > `AGENTS.md` / `CLAUDE.md` constitutions, `docs/ARCHITECTURE.md` (technical law +
 > invariants), and `CHANGELOG.md` (the ledger). Where this file and those disagree,
@@ -26,9 +26,9 @@ the audit trail.
 
 | Metric | Value |
 |---|---|
-| Non-test Go | **~89.8K LOC** across **375 files** |
-| Test Go | **~87.7K LOC** across **406 files** (≈0.98 test:code ratio) |
-| Go packages | **120** total (`go list ./...`); **111** under `internal/` |
+| Non-test Go | **~91.8K LOC** across **382 files** |
+| Test Go | **~91.1K LOC** across **420 files** (≈0.99 test:code ratio) |
+| Go packages | **121** total (`go list ./...`); **111** under `internal/` |
 | Direct module deps | **3 sanctioned families** (5 direct requires) — `modernc.org/sqlite`, `golang.org/x/sys`, Charm TUI (`bubbletea`/`bubbles`/`lipgloss`, behind `//go:build tui`) |
 | `CGO_ENABLED` | **0** (pure-Go; cross-compiles cleanly) |
 | Gate | `make verify` (build + vet + lint + test) — green. Race, TUI, sandbox, browser E2E, `govulncheck`, and installer-integrity proofs are separate CI lanes. |

docs/REFERENCE.md

@@ -4,7 +4,7 @@
 
 > **Where this sits in the canon.** This is the *consolidated current-state* reference. It is **not** the technical law. When this file and a spoke doc (or the code) disagree, the **spoke doc and the code win** — fix this file. Authoritative sources: [`CLAUDE.md`](../CLAUDE.md) (constitution + invariants), [`docs/ARCHITECTURE.md`](ARCHITECTURE.md) (decided architecture + frozen contract), [`docs/TASKS.md`](TASKS.md) (master work DAG), [`CHANGELOG.md`](../CHANGELOG.md) (append-only ledger). The first three are contract files.
 >
-> **Snapshot:** v1.1.0 (2026-06-21) + unreleased work. Phases 0–16 (all eight Phase-16 closed-loop pillars, including Pillar 8 — the unified orchestration kernel, default-on) + computer-use (CU) + native-macOS host control (CU-MAC) **shipped**; deferred items D1–D4 shipped; the external-infrastructure tier (EXT-01..08) is gated/not-eligible. Every default, flag, count, and constant below was verified against source.
+> **Snapshot:** v1.2.0 (2026-07-12). Phases 0–16 (all eight Phase-16 closed-loop pillars, including Pillar 8 — the unified orchestration kernel, default-on) + computer-use (CU) + native-macOS host control (CU-MAC) **shipped**; deferred items D1–D4 shipped; the external-infrastructure tier (EXT-01..08) is gated/not-eligible. Every default, flag, count, and constant below was verified against source.
 
 ---
 
@@ -46,9 +46,10 @@ There is no other index of the documentation set; this is it.
 | `1.0.0` | 2026-06-20 | Phases 7–12 + deferred D1–D4 (the v1 product) |
 | `1.0.1` | 2026-06-21 | Fixes |
 | `1.1.0` | 2026-06-21 | Phase 13 (model-driven routing + Trust Ledger) |
-| **Unreleased** | — | Phase 14 (browse), CU + CU-MAC (desktop / macOS host), Phase 15 (providers + web search), Phase 16 (closed-loop: unified kernel, `nilcore do` router, `decompose`, lessons, flywheel, graduated auto-approval, autonomy daemon), chat `/ask` + `/save`, TUI verb parity, docs promotion, defect-hunt + features-review fix passes |
+| `1.2.0` | 2026-07-12 | Phases 14–16: browser/desktop agency, provider upgrade + evals, unified kernel/decompose, closed-loop autonomy, audit remediation, and release integrity |
+| **Unreleased** | — | — |
 
-`version` is `dev` unless ldflags-stamped at build (`-X main.version=<tag>`); an un-stamped binary reports the VCS revision.
+`version` is `dev` unless ldflags-stamped at build (`-X main.version=<tag>`); an un-stamped binary reports the VCS revision. The release workflow validates and stamps the tag, then executes the native asset and requires an exact match before publication.
 
 ### 1.2 Phases (all shipped)
 
@@ -82,9 +83,9 @@ There is no other index of the documentation set; this is it.
 
 | Metric | Value |
 |---|---|
-| Go packages | **120** (111 under `internal/`) |
-| Source files (non-test) | **375** |
-| Test files | **406** |
+| Go packages | **121** (111 under `internal/`) |
+| Source files (non-test) | **382** |
+| Test files | **420** |
 | Lines of Go — `internal/` + `cmd/` (non-test) | **~89,200** |
 | Lines of Go — `internal/` + `cmd/` with tests | **~175,900** |
 | Runtime dependencies (default binary) | **2** — pure-Go SQLite (`modernc.org/sqlite`) + `golang.org/x/sys` |