fix(release): align v0.5.0 evidence and status checks

[lamemustafa]

Summary

• Record repository/GitHub release v0.5.0 as a pre-release and its Chrome Web Store package only as submitted and in review as a draft.
• Preserve v0.3.2 as the last confirmed Store publication and sole basis for Store-published public claims; keep the historical v0.4.0 sequence explicit.
• Keep the canonical full-year recovery matrix entirely unfilled: all 54 live-observation cells remain not-yet-run. The matrix now accepts only closed state/reason/date grammar, parses every row, and rejects impossible calendar dates.
• Run the read-only Chrome Web Store status checker for both tool-supported credential forms. Only a non-strict scheduled run with the canonical missing-credential result is skipped; manual, strict, and other failures retain the checker exit code.
• Align the linked listing, closeout, and readiness records to v0.5.0. The listing's Current Store State section is the canonical source-controlled record, with tests deriving the consumer version references from it.

Root Cause / Decision Record

• The initial lane left five review gaps: strict dispatch could false-green, matrix reasons remained free text, unknown rows could evade validation, syntactically shaped but impossible dates passed, and linked Store records retained stale v0.4.0 forms.
• A related defect was found while tracing the workflow contract: OAuth credentials supported by the checker were not recognized by the workflow's configuration logic.
• The smallest safe fix remains documentation, CI workflow logic, and focused tests. Runtime acquisition, persistence, download binding, permissions, data flow, and public Store claims are unchanged.
• This addresses the noisy missing-configuration behavior tracked in Configure read-only Chrome Web Store status credentials #59. Supplying credentials or live evidence remains a maintainer action and is not performed here.

Scope

• Runtime: None; no src/ changes.
• Tests: Closed matrix vocabulary, all-row parsing, exact canonical row order, normalized real calendar dates, completion coupling, linked-document version consistency, and scheduled/manual plus service-account/OAuth workflow branches.
• Docs/governance: v0.5.0 release/Store-draft state, historical version sequence, bounded credential guidance, and the unfilled full-year recovery matrix.
• Explicitly out of scope: Creating live evidence, filling any matrix cell, configuring credentials, changing permissions/data flow, publishing or approving the Store package, or strengthening a public claim.

Pack Workflow Preflight

• pnpm workflow:preflight was run before editing/push, or the skip reason is documented.
• This PR was opened from a Pack branch, not master.
• I checked latest master Pack AGENTS guidance or recorded the stale-guidance warning.
• PR body keeps the required Pack privacy/review/verification checklist visible.

Sanchika Adoption Gate

• Not applicable: this PR consumes no @sanchika/* package or copied Sanchika guidance.
• Not applicable: no Sanchika completion evidence is required for this lane.
• This PR does not import ../sanchika, sanchika/packages/*/src, or parent source paths.

Privacy And Data-Flow Impact

• No new browser permissions.
• No new host permissions.
• No new network calls.
• No analytics, telemetry, ads, or session replay.
• No credential, OTP, CAPTCHA, cookie, token, GST file, or taxpayer-data capture.
• Public copy and privacy declarations are updated if behaviour changed. No behavior changed; the readiness record was corrected without expanding claims.

Sensitive Surface Review

• Current tab / portal target binding is preserved or intentionally changed.
• Download completion remains evidence-backed and fail-closed.
• Ambiguous side-effect delivery cannot be reported as confirmed success.
• Service-worker durability impact is understood and documented. Runtime durability is unchanged; the matrix remains unfilled pending authorised live runs.
• Real taxpayer data, local paths, raw URLs/referrers, portal HTML, and credential values are absent from the diff.

Chrome Web Store Impact

• This PR does not expand beyond the existing Chrome Web Store V0 listing unless every gate in docs/PUBLICATION_READINESS.md is checked.
• Full fiscal year remains source-build alpha and is not part of the Chrome Web Store V0 listing.
• Store copy, README status, Privacy QA, and reviewer instructions were reviewed if user-facing behavior changed. No user-facing behavior changed.
• CI ZIP creation, provenance, and protected publishing are treated as release evidence, not manual Store-submission sign-off.
• PR title uses Conventional Commits so Release Please can bump Pack after merge.

Verification

• pnpm install --frozen-lockfile
• pnpm audit --audit-level high — not run; no dependency change and not part of this lane's requested gates.
• pnpm exec wxt prepare
• pnpm exec prettier --check .
• pnpm exec eslint . --max-warnings 0
• pnpm exec tsc --noEmit
• pnpm exec vitest run tests/docs/publication-readiness.test.ts tests/extension/ci-workflow.test.ts — 2 files / 16 tests passed.
• pnpm exec vitest run — 104 files / 1,663 tests passed; zero failures.
• pnpm exec wxt build
• node scripts/verify-extension-package.mjs .output/chrome-mv3
• pnpm exec wxt zip — release-only; this PR does not create release artifacts.
• node scripts/verify-extension-zip.mjs — no release ZIP created.
• node scripts/write-release-provenance.mjs — no release artifact created.
• node scripts/verify-github-release-assets.mjs --tag <tag> --zip <zip> --checksum <sha256> --provenance <json> — no release assets created.
• node scripts/publish-chrome-web-store.mjs --zip .output/<zip> --provenance .output/pack-release-provenance.v1.json --publisher-id <id> --dry-run true — no credential or Store submission action is in scope.
• git diff --check
• pnpm review:gate -- --strict-head-review --required-review-author chatgpt-codex-connector --wait-head-review-ms 180000 --allow-missing-head-review before merge/readiness claim: current-head CI and automated review are incomplete.

Additional requested gate:

• pnpm workflow:preflight on the clean committed head.
• pnpm exec actionlint

Artifact Evidence

• CI run: Current-head project checks are queued/in progress. CodeQL JavaScript/TypeScript analysis failed during setup because GitHub could not download github/codeql-action@v4 after HTTP 429/503 responses; no repository analysis ran.
• ZIP artifact: Not created; docs/CI lane only.
• ZIP SHA-256: Not applicable to a newly built artifact. The documented submitted v0.5.0 release ZIP digest is independently backed by the GitHub release asset receipt.
• Clean source/tag or head SHA: 810a6123d997098a5c59f0b264b6312aeb304023.

PR Review Follow-Up

• GitHub Actions completed for 810a6123d997098a5c59f0b264b6312aeb304023.
• Autogenerated Codex/bot review comments inspected after checks complete for the latest head SHA.
• All five existing inline review threads were answered with evidence and resolved.
• No commits were pushed after the last required human/bot review without re-review. The new head is awaiting current-head review.
• Any follow-up PRs are listed here instead of being left implicit. A future cleanup may generate the three Store-state records from one machine-readable manifest; this lane instead designates docs/chrome-web-store/listing.md as canonical and test-couples its version consumers.

Thread/comment	Disposition	Commit or evidence
Strict dispatch could false-green	fixed	58c30da; workflow execution tests prove non-strict scheduled skip and strict manual failure
Free-text matrix reason could carry filename/data	fixed	810a612; free-text class removed by closed reason tokens rather than pattern-detected
Unknown matrix row could evade validation	fixed	810a612; parser validates every nonblank row and compares exact canonical order
Impossible calendar dates passed regex validation	fixed	810a612; normalized UTC calendar validation rejects invalid dates
Linked closeout/version forms were stale	fixed	810a612; linked records now use v0.5.0 and a consistency test derives consumer versions from the canonical listing

Screenshots

Not applicable; docs and CI workflow only. No live or taxpayer data was used.

DCO

• Commits include Signed-off-by: trailers.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a45cc0880b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 810a6123d9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Regenerate the Store assets before v0.5.0 closeout

After the version links were corrected, fresh evidence is that this v0.5.0 closeout now directs maintainers to upload the checked-in PNGs even though docs/chrome-web-store/assets/README.md:3-8 still identifies them as the v0.4.0 set and screenshot-local-downloads-1280x800.svg:36 was edited after its PNG was last generated—the SVG says E-invoice details (Excel), while the export still displays the old label. Following this checklist can therefore upload an export that no longer matches its canonical source and falsely record exact-release image review; rerun the asset exporter and visually review/bind its outputs to v0.5.0 first.

AGENTS.md reference: AGENTS.md:L49-L54

Useful? React with 👍 / 👎.