chore(release): prepare v0.1.4

CHANGELOG.md

@@ -7,6 +7,18 @@ and this project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.ht
 
 ## [Unreleased]
 
+## [0.1.4] - 2026-09-18
+
+### Changed
+
+- The Decernor consumer contract now pins published `v0.1.7` at peeled commit
+  `70efa26`. Exact committed-synthetic fingerprint goldens remain byte-identical,
+  and generated-real checks remain transient.
+- The Go directive moves from 1.26.4 to 1.26.6, clearing the applicable standard
+  library advisories reported against the prior toolchain.
+- `go.yaml.in/yaml/v3` moves from v3.0.4 to v3.0.5. `edwards25519` remains at
+  v1.2.0.
+
 ## [0.1.3] - 2026-08-25
 
 ### Added
@@ -110,7 +122,8 @@ and this project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.ht
 - The generator rejects Git worktrees and Git directories, stages output before
   publication, and restricts replacement to synthcorpus-owned directories.
 
-[Unreleased]: https://github.com/3leaps/synthcorpus/compare/v0.1.3...HEAD
+[Unreleased]: https://github.com/3leaps/synthcorpus/compare/v0.1.4...HEAD
+[0.1.4]: https://github.com/3leaps/synthcorpus/releases/tag/v0.1.4
 [0.1.3]: https://github.com/3leaps/synthcorpus/releases/tag/v0.1.3
 [0.1.2]: https://github.com/3leaps/synthcorpus/releases/tag/v0.1.2
 [0.1.1]: https://github.com/3leaps/synthcorpus/releases/tag/v0.1.1

README.md

@@ -20,8 +20,8 @@ One-line: Synthetic, scanner-safe security-fixture corpus + throwaway-key genera
 | `cmd/synthcorpus-gen` | Generated-real mint (dogfooding roots only; never inside git) |
 | `cmd/synthcorpus-lexgen` | Lexical-mutation corpus generator (same never-inside-git rule) |
 | `docs/lexical-matrix.md` | Lexical-mutation matrix v1 — grammar, cells, floors, output planes |
-| `manifests/decernor-pin.json` | Consumer pin for drift-check locate-by-binary (tagged decernor `v0.1.5`) |
-| `docs/releases/` | Per-cut notes; current pack is [`v0.1.3`](docs/releases/v0.1.3.md) |
+| `manifests/decernor-pin.json` | Consumer pin for drift-check locate-by-binary (tagged decernor `v0.1.7`) |
+| `docs/releases/` | Per-cut notes; current pack is [`v0.1.4`](docs/releases/v0.1.4.md) |
 | `manifests/decernor-fingerprint-golden.json` | Deterministic committed-synthetic fingerprint contract |
 | `manifests/decernor-generated-real-properties.json` | Property-only generated-real contract (no exact random values) |
 | `AGENTS.md` | Agent guide — **safety header first** |

RELEASE_CHECKLIST.md

@@ -217,6 +217,6 @@ ceremony.
 
 - [ ] Confirm the tag and GitHub release resolve to the intended `main` commit.
 - [ ] Confirm the three required checks remain green on that commit.
-- [ ] Verify `[Unreleased]` in `CHANGELOG.md` starts from `v0.1.3`.
+- [ ] Verify `[Unreleased]` in `CHANGELOG.md` starts from `v0.1.4`.
 - [ ] Keep only the three most recent entries in `RELEASE_NOTES.md`; retain the
       complete per-release narrative under `docs/releases/`.

RELEASE_NOTES.md

@@ -4,6 +4,39 @@ This file contains release notes for up to the three most recent releases in rev
 
 ---
 
+## v0.1.4 (2026-09-18)
+
+**Patched Go baseline and Decernor v0.1.7 consumer pin**
+
+synthcorpus v0.1.4 moves to Go 1.26.6, updates YAML to v3.0.5, and pins the
+Decernor consumer contract to published `v0.1.7` at peeled commit `70efa26`.
+The corpus, schemas, and expected fingerprint records are unchanged.
+
+### Highlights
+
+- **Decernor consumer pin is tagged `v0.1.7`.** Exact committed-synthetic
+  goldens remain byte-identical; generated-real checks remain transient. Locate
+  remains an absolute `DECERNOR_BIN` or `PATH` lookup.
+- **Go 1.26.6** clears the standard-library advisories applicable to the prior
+  Go 1.26.4 baseline.
+- **YAML v3.0.5** provides the available direct dependency patch;
+  `edwards25519` remains at v1.2.0.
+- Repository and both generators report version `0.1.4`. Releases remain
+  GPG-signed tags plus notes, with zero uploaded assets.
+
+### Governing invariant
+
+Generated-real material never enters the repository. Only registered,
+provably unusable committed-synthetic specimens live under `fixtures/`.
+
+### Compatibility
+
+No migration is required. Consumer contract callers must supply a Decernor
+binary satisfying `manifests/decernor-pin.json` (`v0.1.7` / `70efa26`).
+
+See [docs/releases/v0.1.4.md](docs/releases/v0.1.4.md) for the complete release
+narrative.
+
 ## v0.1.3 (2026-08-25)
 
 **Decernor v0.1.5 pin and public baseline**
@@ -69,40 +102,3 @@ for that cut.
 
 See [docs/releases/v0.1.2.md](docs/releases/v0.1.2.md) for the complete release
 narrative.
-
-## v0.1.1 (2026-08-20)
-
-**Lexical lane and tagged Decernor pin**
-
-synthcorpus v0.1.1 adds a second generator lane for deterministic
-lexical-mutation corpora and pins the Decernor consumer contract to tagged
-`v0.1.4`. Generated-real material still never enters Git.
-
-### Highlights
-
-- **Lexical-mutation corpus generator.** `synthcorpus-lexgen` emits a 49-cell
-  matrix of visibly synthetic terms (`zzlx` plus a seed-derived body) with
-  sterile and protected output planes. Population floors and generation-time
-  guards fail the run rather than emit a thin or colliding corpus.
-- **Decernor consumer pin is tagged `v0.1.4`.** Exact committed-synthetic
-  fingerprint goldens track that binary. Locate remains `DECERNOR_BIN` / PATH.
-  Fingerprint output is unchanged from the prior tagged cut; goldens are not
-  rewritten.
-- **Per-generator ownership markers.** Each generator owns a distinct marker
-  file and kind so `--force` can only replace a root its own lane created.
-- Repository and generator report version `0.1.1`. Releases remain signed tags
-  plus notes, with no prebuilt generator binary or attached corpus bundle.
-
-### Governing invariant
-
-Generated-real material never enters the repository. Only registered,
-provably unusable committed-synthetic specimens live under `fixtures/`.
-
-### Compatibility
-
-No migration is required. The generator remains a repository-local dogfooding
-tool and is not distributed. Consumer contract callers must supply a Decernor
-binary that satisfies `manifests/decernor-pin.json` (`v0.1.4` / `32d0176`).
-
-See [docs/releases/v0.1.1.md](docs/releases/v0.1.1.md) for the complete release
-narrative.

VERSION

@@ -1 +1 @@
-0.1.3
+0.1.4

docs/decernor-pin.md

@@ -8,9 +8,9 @@ worktree path, never a Go module import from decernor into synthcorpus.
 | Field | Value |
 |-------|-------|
 | Source | https://github.com/3leaps/decernor |
-| Min version | `0.1.5` |
-| Preferred tag | `v0.1.5` |
-| Preferred commit | `5dfd574` (object named by the tag; GPG-primary contract token and hex minisign blob SHA) |
+| Min version | `0.1.7` |
+| Preferred tag | `v0.1.7` |
+| Preferred commit | `70efa26` (commit peeled from the annotated tag; fingerprint contracts remain separate) |
 | Machine pin file | [`manifests/decernor-pin.json`](../manifests/decernor-pin.json) |
 
 The **tag** is the locate contract. `preferred_commit` records the tagged
@@ -28,8 +28,8 @@ Verify identity with extended version output (never parse secret material):
 
 ```sh
 "$DECERNOR_BIN" version -e
-# Version: 0.1.5
-# Commit:  5dfd574
+# Version: 0.1.7
+# Commit:  70efa26
 ```
 
 Package helper: `internal/decernorloc` (`Locate`, `ReadIdentity`, `CheckPin`).

docs/releases/v0.1.4.md

@@ -0,0 +1,57 @@
+# synthcorpus v0.1.4 Release Notes
+
+**Release date:** 2026-09-18
+
+## Summary
+
+**Patched Go baseline and Decernor v0.1.7 consumer pin**
+
+synthcorpus v0.1.4 moves to Go 1.26.6, updates the YAML dependency to v3.0.5,
+and pins the Decernor consumer contract to published `v0.1.7`. The corpus,
+schemas, expected fingerprint records, and generated-real boundary are
+unchanged.
+
+## Highlights
+
+- **Decernor consumer pin is tagged `v0.1.7`.** Machine pin and docs name
+  `min_version` `0.1.7`, `preferred_tag` `v0.1.7`, and peeled commit `70efa26`.
+  Exact committed-synthetic fingerprint goldens remain byte-identical. Locate
+  remains an absolute `DECERNOR_BIN` or `PATH` lookup.
+- **Go 1.26.6.** The patched standard library clears the advisories applicable
+  to the previous Go 1.26.4 baseline.
+- **YAML v3.0.5.** The direct YAML dependency receives its patch update;
+  `edwards25519` remains at v1.2.0.
+- Repository and both generators report version `0.1.4`.
+
+## Governing invariant
+
+Generated-real material never enters the repository. Only registered,
+provably unusable committed-synthetic specimens live under `fixtures/`.
+
+## Decernor contract
+
+The consumer pin is tagged Decernor `v0.1.7` (`70efa26`). Exact goldens are
+unchanged from the prior pin. Generated-real checks validate properties only in
+an isolated output root and retain no generated key material or fingerprints.
+
+## Verification
+
+- `GOTOOLCHAIN=go1.26.6 go run golang.org/x/vuln/cmd/govulncheck@v1.8.0 ./...`
+  reports no symbol-, package-, or module-level vulnerabilities.
+- `DECERNOR_BIN=/absolute/path/to/decernor make check-all` runs formatting,
+  tests, build, scanner canaries, negative-crypto proofs, release controls, and
+  both consumer-contract lanes.
+- Dependency licenses pass the existing high-severity assessment.
+
+## Compatibility
+
+No migration is required. Consumer contract callers must supply a Decernor
+binary satisfying `manifests/decernor-pin.json` (`v0.1.7` / `70efa26`).
+
+## Release vehicle
+
+v0.1.4 is a GPG-signed Git tag plus GitHub release notes. GitHub's automatic
+source archives are expected. No prebuilt generator binary, package-manager
+artifact, separately attached corpus bundle, artifact signature or key,
+checksum manifest, or provenance asset is published. Generated-real material
+is not part of the source tree or release.

go.mod

@@ -1,8 +1,8 @@
 module github.com/3leaps/synthcorpus
 
-go 1.26.4
+go 1.26.6
 
 require (
 	filippo.io/edwards25519 v1.2.0
-	go.yaml.in/yaml/v3 v3.0.4
+	go.yaml.in/yaml/v3 v3.0.5
 )

go.sum

@@ -1,6 +1,4 @@
 filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
 filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=

internal/decernorloc/locate_test.go

@@ -72,7 +72,7 @@ func TestLoadPinRoundTrip(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if pin.MinVersion != "0.1.5" || pin.PreferredTag != "v0.1.5" || pin.PreferredCommit != "5dfd574" {
+	if pin.MinVersion != "0.1.7" || pin.PreferredTag != "v0.1.7" || pin.PreferredCommit != "70efa26" {
 		t.Fatalf("pin = %#v", pin)
 	}
 	if pin.Locate.Env != EnvBinary {

manifests/decernor-pin.json

@@ -3,9 +3,9 @@
   "kind": "synthcorpus-decernor-pin",
   "consumer": "synthcorpus",
   "tool": "decernor",
-  "min_version": "0.1.5",
-  "preferred_tag": "v0.1.5",
-  "preferred_commit": "5dfd574",
+  "min_version": "0.1.7",
+  "preferred_tag": "v0.1.7",
+  "preferred_commit": "70efa26",
   "source_repo": "https://github.com/3leaps/decernor",
   "locate": {
     "env": "DECERNOR_BIN",