diff --git a/.github/release-signers b/.github/release-signers
new file mode 100644
index 0000000..cc018d9
--- /dev/null
+++ b/.github/release-signers
@@ -0,0 +1 @@
+ilyaantonievich@gmail.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKahT4jyO69Vc8ZAAplYvbOTFNSl01ioCBAobQnMQ11t
diff --git a/.github/workflows/ghostapi-pr-safety.yml b/.github/workflows/ghostapi-pr-safety.yml
index 25058bb..ea472d8 100644
--- a/.github/workflows/ghostapi-pr-safety.yml
+++ b/.github/workflows/ghostapi-pr-safety.yml
@@ -11,7 +11,7 @@ on:
 permissions: {}
 
 env:
-  GHOSTAPI_VERSION: "0.1.8"
+  GHOSTAPI_VERSION: "0.2.0"
 
 jobs:
   safety:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d52900e..60ab586 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,6 +24,8 @@ jobs:
           node-version: 24
           cache: npm
           registry-url: https://registry.npmjs.org
+      - name: Configure release tag verification
+        run: git config gpg.ssh.allowedSignersFile "$GITHUB_WORKSPACE/.github/release-signers"
       - run: node scripts/release-verify.mjs "$GITHUB_REF_NAME"
       - run: npm ci
       - run: npm run lint
@@ -56,4 +58,5 @@ jobs:
         run: |
           tarball="$(find release -maxdepth 1 -name '*.tgz' -type f -print -quit)"
           test -n "$tarball"
-          gh release create "$GITHUB_REF_NAME" "$tarball" release/SHA256SUMS release/sbom.cdx.json --verify-tag --generate-notes
+          release_version="${GITHUB_REF_NAME#v}"
+          gh release create "$GITHUB_REF_NAME" "$tarball" release/SHA256SUMS release/sbom.cdx.json --verify-tag --title "GhostAPI $release_version: Local SDK Compatibility and Release Evidence" --generate-notes
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6b242d1..d177e9b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,8 @@ The format follows the spirit of [Keep a Changelog](https://keepachangelog.com/e
 
 ## Unreleased
 
+## 0.2.0 - 2026-09-01
+
 ### Security
 
 - Corrected evidence semantics so unmeasured production-egress attempt counts are reported as `not measured` instead of a fabricated zero.
@@ -18,6 +20,7 @@ The format follows the spirit of [Keep a Changelog](https://keepachangelog.com/e
 
 - Repositioned GhostAPI as an AI-assisted local API simulation experiment with explicit non-goals and no customer-validation claims.
 - Added project provenance, contribution authorship guidance, full-tree formatting, and type-aware ESLint parsing.
+- Corrected 36 pre-0.2 Git author and committer identities from an accidental local tool identity to the contributing maintainer while preserving file trees, messages, and dates.
 - Removed fundraising, commercial, design-partner, community-operations, and enterprise-roadmap material from the public tree and npm package.
 - Added a release workflow for signed annotated tags, exact-tarball smoke testing, checksums, SBOM generation, build attestations, npm provenance, and post-publish `gitHead` verification.
 - Centered the README hero and dashboard product identity, and added responsive navigation and request/detail layouts for mobile screens.
diff --git a/PROVENANCE.md b/PROVENANCE.md
index 1bf0cf6..56598bc 100644
--- a/PROVENANCE.md
+++ b/PROVENANCE.md
@@ -4,8 +4,10 @@ GhostAPI is maintained by Yiaany.
 
 AI-assisted development tools, including OpenCode, were used for code generation, review, test generation, documentation drafting, and refactoring. The maintainer selected the architecture, defined product and security boundaries, reviewed and modified generated changes, ran verification, and accepts responsibility for the published code.
 
-Commits authored as `OpenCode <opencode@localhost>` represent AI-assisted working sessions, not an independent human contributor. No claim is made that every line was typed manually.
+AI assistance does not imply independent authorship. No claim is made that every line was typed manually.
 
 Security-sensitive changes require maintainer review, tests, and release evidence from the exact published commit.
 
-Published history is not rewritten to obscure prior AI-assisted authorship. New changes should use a human author and may include an `Assisted-by: OpenCode` trailer when the assistance was substantial.
+On September 1, 2026, the pre-0.2 history was rewritten to correct 36 commits accidentally recorded under the local `OpenCode <opencode@localhost>` identity to `hizyyo <kapolol2266@gmail.com>`. The reviewed replacement preserved every file tree, commit message, author date, and committer date; PR #20 records the validation and application procedure. This metadata correction does not remove this disclosure of AI-assisted development.
+
+New changes should use a human author and may include an `Assisted-by: OpenCode` trailer when the assistance was substantial.
diff --git a/README.md b/README.md
index ded2abd..4e8815c 100644
--- a/README.md
+++ b/README.md
@@ -177,7 +177,7 @@ Generic MCP configuration:
   "mcpServers": {
     "ghostapi": {
       "command": "npx",
-      "args": ["-y", "@yiaany/ghostapi@0.1.9", "mcp"]
+      "args": ["-y", "@yiaany/ghostapi@0.2.0", "mcp"]
     }
   }
 }
diff --git a/docs/ci.md b/docs/ci.md
index bd20a2e..e0935a3 100644
--- a/docs/ci.md
+++ b/docs/ci.md
@@ -12,7 +12,7 @@ Set `GHOSTAPI_DATA_DIR` to an ephemeral CI directory and use one immutable Ghost
 set -u
 
 export GHOSTAPI_DATA_DIR="$CI_WORKSPACE/.ghostapi-ci"
-export GHOSTAPI_VERSION="0.1.8"
+export GHOSTAPI_VERSION="0.2.0"
 npm install --global "@yiaany/ghostapi@$GHOSTAPI_VERSION"
 
 run_status=0
diff --git a/docs/github-actions.md b/docs/github-actions.md
index 68d5d50..d4c593c 100644
--- a/docs/github-actions.md
+++ b/docs/github-actions.md
@@ -6,7 +6,7 @@ The repository workflow at [`.github/workflows/ghostapi-pr-safety.yml`](../.gith
 
 ```yaml
 env:
-  GHOSTAPI_VERSION: "0.1.8"
+  GHOSTAPI_VERSION: "0.2.0"
 
 - name: Install pinned GhostAPI
   run: npm install --global "@yiaany/ghostapi@$GHOSTAPI_VERSION"
diff --git a/docs/mcp.md b/docs/mcp.md
index c24ceba..4038475 100644
--- a/docs/mcp.md
+++ b/docs/mcp.md
@@ -15,7 +15,7 @@ npx @yiaany/ghostapi mcp
   "mcpServers": {
     "ghostapi": {
       "command": "npx",
-      "args": ["-y", "@yiaany/ghostapi@0.1.9", "mcp"]
+      "args": ["-y", "@yiaany/ghostapi@0.2.0", "mcp"]
     }
   }
 }
diff --git a/docs/releases/README.md b/docs/releases/README.md
index ff3d3cb..15ecc36 100644
--- a/docs/releases/README.md
+++ b/docs/releases/README.md
@@ -10,4 +10,4 @@ For each release, verify:
 - the tarball has a GitHub build-provenance attestation;
 - npm shows provenance and its `gitHead` matches the tagged commit.
 
-Historical `0.1.x` artifacts may not satisfy this complete chain. Do not rewrite their Git history. The first release intended to use the complete workflow is `v0.2.0`.
+Historical `0.1.x` artifacts may not satisfy this complete chain and retain their immutable original npm `gitHead` metadata. A reviewed metadata-only history correction was applied before `v0.2.0`; PR #20 records the unchanged trees, messages, and dates. The first release intended to use the complete workflow is `v0.2.0`.
diff --git a/package-lock.json b/package-lock.json
index 642ab25..dc884c1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@yiaany/ghostapi",
-  "version": "0.1.8",
+  "version": "0.2.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@yiaany/ghostapi",
-      "version": "0.1.8",
+      "version": "0.2.0",
       "license": "MIT",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.30.0",
diff --git a/package.json b/package.json
index e9de6b6..c2fd61e 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@yiaany/ghostapi",
-  "version": "0.1.8",
+  "version": "0.2.0",
   "description": "Local API simulation and test evidence for AI-assisted development.",
   "type": "module",
   "repository": {
diff --git a/test/githubWorkflow.test.ts b/test/githubWorkflow.test.ts
index b6541a1..1529d42 100644
--- a/test/githubWorkflow.test.ts
+++ b/test/githubWorkflow.test.ts
@@ -29,7 +29,7 @@ describe("GhostAPI PR safety workflow", () => {
   it("uses immutable actions, enforced execution, sanitized evidence, and safe comment boundaries", async () => {
     const workflow = await readWorkflow(workflowPath);
 
-    expect(workflow).toContain('GHOSTAPI_VERSION: "0.1.8"');
+    expect(workflow).toContain('GHOSTAPI_VERSION: "0.2.0"');
     expect(workflow).toContain(
       "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683",
     );
diff --git a/test/setupGenerator.test.ts b/test/setupGenerator.test.ts
index f9b65ef..e928e13 100644
--- a/test/setupGenerator.test.ts
+++ b/test/setupGenerator.test.ts
@@ -56,7 +56,7 @@ describe("repo setup generator", () => {
     ).toContain('"command": "npx"');
     expect(
       setup.files.find((file) => file.path === ".cursor/mcp.json")?.content,
-    ).toContain('"@yiaany/ghostapi@0.1.8"');
+    ).toContain('"@yiaany/ghostapi@0.2.0"');
     expect(
       setup.files.find((file) => file.path === "AGENTS.md")?.content,
     ).toContain("do not run it manually in a terminal");