Close patch 0.1.2 package tag creation

.github/scripts/test_patch_0_1_2_package_tag_closeout.py

@@ -0,0 +1,154 @@
+#!/usr/bin/env python3
+#
+# Copyright 2026 The Ethos maintainers
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+#
+
+from __future__ import annotations
+
+import re
+import subprocess
+import unittest
+from pathlib import Path
+
+from makefile_guard import target_block
+
+
+ROOT = Path(__file__).resolve().parents[2]
+RECORD = ROOT / "docs/validation/patch-0-1-2-package-tag-closeout-validation-2026-06-25.md"
+DECISION = ROOT / "docs/validation/patch-0-1-2-package-tag-approval-decision-validation-2026-06-25.md"
+VALIDATION_README = ROOT / "docs/validation/README.md"
+EXECUTION_STATUS = ROOT / "docs/execution-status.md"
+PUBLIC_RELEASE_CHECKLIST = ROOT / "docs/public-release-checklist.md"
+MAKEFILE = ROOT / "Makefile"
+
+SOURCE_SHORT = "8ab9e18"
+SOURCE_COMMIT = "8ab9e180cfb96a1e6659dff97db7fb7a4288817b"
+SOURCE_TREE = "1a40205d4d87614e14278ab7d0107fa58bbeeb46"
+PACKAGE_SOURCE_COMMIT = "3bc3564e38c1168b2db72f38863d324b6b57bd4d"
+PACKAGE_SOURCE_TREE = "eda8c7a605a4eb29c155ae3b9e6e9f0c35798f8c"
+TAG_OBJECTS = {
+    "ethos-package-ethos-doc-core-0.1.2": "4ced327565020277d7a1eb63b1d471e570b1f4a1",
+    "ethos-package-ethos-verify-0.1.2": "57dd49a6b8a6cbb44dbff1fd70f221ee36c50819",
+    "ethos-package-ethos-pdf-0.1.2": "024315d5a9735d6d6c68abe6f3aeb2e0f110dfe3",
+}
+TAG_OBJECT_PREFIXES = {
+    "ethos-package-ethos-doc-core-0.1.2": "4ced-3275-6502",
+    "ethos-package-ethos-verify-0.1.2": "57dd-49a6-b8a6",
+    "ethos-package-ethos-pdf-0.1.2": "0243-15d5-a973",
+}
+FORBIDDEN = (
+    "hosted surfaces approved",
+    "production-ready",
+    "windows packaged artifacts approved",
+    "bundled pdfium approved",
+    "ethos-doc approved",
+    "ethos-rag approved",
+    "public benchmark claims approved",
+)
+
+
+def read(path: Path) -> str:
+    return path.read_text(encoding="utf-8")
+
+
+def normalized(path: Path) -> str:
+    return re.sub(r"\s+", " ", read(path))
+
+
+def git(*args: str) -> str:
+    return subprocess.check_output(
+        ["git", *args],
+        cwd=ROOT,
+        encoding="utf-8",
+        stderr=subprocess.DEVNULL,
+    ).strip()
+
+
+def remote_tag_refs() -> dict[str, str]:
+    output = git("ls-remote", "--tags", "origin", "refs/tags/ethos-package-*-0.1.2*")
+    refs: dict[str, str] = {}
+    for line in output.splitlines():
+        sha, ref = line.split("\t", 1)
+        refs[ref] = sha
+    return refs
+
+
+class Patch012PackageTagCloseoutTests(unittest.TestCase):
+    def test_record_is_source_bound_and_indexed(self) -> None:
+        record = normalized(RECORD)
+        readme = normalized(VALIDATION_README)
+
+        self.assertIn(RECORD.name, readme)
+        self.assertIn("patch 0.1.2 package tag closeout", readme.lower())
+        self.assertIn(f"Validated source HEAD before this record: `{SOURCE_SHORT}`", read(RECORD))
+        self.assertIn(f"Patch 0.1.2 package tag closeout source commit: `{SOURCE_COMMIT}`", record)
+        self.assertIn(f"Patch 0.1.2 package tag closeout source tree: `{SOURCE_TREE}`", record)
+        self.assertEqual(SOURCE_COMMIT, git("rev-parse", SOURCE_SHORT))
+        self.assertEqual(SOURCE_TREE, git("rev-parse", f"{SOURCE_SHORT}^{{tree}}"))
+
+    def test_closeout_records_exact_local_and_remote_tag_bindings(self) -> None:
+        record = normalized(RECORD)
+        refs = remote_tag_refs()
+
+        self.assertIn(DECISION.name, record)
+        self.assertIn(f"Package tag source commit: `{PACKAGE_SOURCE_COMMIT}`", record)
+        self.assertIn(f"Package tag source tree: `{PACKAGE_SOURCE_TREE}`", record)
+        self.assertEqual(PACKAGE_SOURCE_TREE, git("rev-parse", f"{PACKAGE_SOURCE_COMMIT}^{{tree}}"))
+
+        for tag, tag_object in TAG_OBJECTS.items():
+            self.assertIn(tag, record)
+            self.assertIn(TAG_OBJECT_PREFIXES[tag], record)
+            self.assertEqual(tag_object, git("rev-parse", tag))
+            self.assertEqual(PACKAGE_SOURCE_COMMIT, git("rev-parse", f"{tag}^{{}}"))
+            self.assertEqual(tag_object, refs[f"refs/tags/{tag}"])
+            self.assertEqual(PACKAGE_SOURCE_COMMIT, refs[f"refs/tags/{tag}^{{}}"])
+
+    def test_closeout_keeps_unrelated_surfaces_blocked(self) -> None:
+        raw = read(RECORD)
+        record = normalized(RECORD)
+        lower = record.lower()
+
+        for expected in (
+            "Package tag creation closeout is complete for the three patch `0.1.2` package tags.",
+            "Hosted surfaces remain blocked.",
+            "Production positioning remains blocked.",
+            "Windows packaged artifacts remain blocked.",
+            "Bundled project-maintained PDFium builds remain blocked.",
+            "`ethos-doc` remains blocked.",
+            "`ethos-rag` remains blocked.",
+            "Public benchmark claims remain blocked.",
+        ):
+            self.assertIn(expected, record)
+        for forbidden in FORBIDDEN:
+            self.assertNotIn(forbidden, lower)
+        self.assertNotIn("/Users/", raw)
+        self.assertNotIn("/private/tmp", raw)
+        self.assertNotIn("/private/var", raw)
+        self.assertNotIn("/var/folders", raw)
+        self.assertNotIn("saumildiwaker", raw)
+
+    def test_status_docs_reference_closeout(self) -> None:
+        for path in (EXECUTION_STATUS, PUBLIC_RELEASE_CHECKLIST):
+            text = normalized(path)
+            self.assertIn(RECORD.name, text, str(path))
+            self.assertIn("package tag creation closeout is complete", text.lower(), str(path))
+            self.assertIn("hosted", text.lower(), str(path))
+            self.assertIn("production", text.lower(), str(path))
+
+    def test_release_candidate_prep_runs_after_decision_before_artifact_checks(self) -> None:
+        makefile = read(MAKEFILE)
+        decision_guard = "$(PYTHON) .github/scripts/test_patch_0_1_2_package_tag_approval_decision.py"
+        closeout_guard = "$(PYTHON) .github/scripts/test_patch_0_1_2_package_tag_closeout.py"
+        first_public_guard = "$(PYTHON) .github/scripts/test_first_public_release_artifact_evidence.py"
+        block = target_block("release-candidate-prep")
+
+        self.assertIn(closeout_guard, block)
+        self.assertEqual(1, makefile.count(closeout_guard))
+        self.assertLess(block.index(decision_guard), block.index(closeout_guard))
+        self.assertLess(block.index(closeout_guard), block.index(first_public_guard))
+
+
+if __name__ == "__main__":
+    unittest.main()

.github/scripts/test_release_candidate_prep.py

@@ -79,6 +79,7 @@
     "$(PYTHON) .github/scripts/test_patch_0_1_2_python_public_install_wording_closeout.py",
     "$(PYTHON) .github/scripts/test_patch_0_1_2_package_tag_approval_request.py",
     "$(PYTHON) .github/scripts/test_patch_0_1_2_package_tag_approval_decision.py",
+    "$(PYTHON) .github/scripts/test_patch_0_1_2_package_tag_closeout.py",
     "$(PYTHON) .github/scripts/test_first_public_release_artifact_evidence.py",
     "$(PYTHON) .github/scripts/test_first_public_release_final_decider.py",
     "$(PYTHON) .github/scripts/test_first_public_release_linux_x64_artifact_evidence.py",

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## Unreleased
 
+- boundary-exception: close patch `0.1.2` package tag creation with exact remote tag evidence while retaining hosted, production, Windows, bundled PDFium, benchmark, `ethos-doc`, and `ethos-rag` blockers.
 - boundary-exception: record decider approval for exact patch `0.1.2` package tag creation while keeping actual tag creation as a later operator action and retaining hosted, production, Windows, bundled PDFium, benchmark, `ethos-doc`, and `ethos-rag` blockers.
 - boundary-exception: request decider review for exact patch `0.1.2` package tag creation while keeping tag creation, hosted, production, Windows, bundled PDFium, benchmark, `ethos-doc`, and `ethos-rag` surfaces blocked pending a separate approval decision.
 - boundary-exception: close patch `0.1.2` Python public install wording for published PyPI wheel `ethos-pdf==0.1.2` while keeping package tag creation, hosted, production, Windows, bundled PDFium, benchmark, `ethos-doc`, and `ethos-rag` surfaces blocked.

Makefile

@@ -330,6 +330,7 @@ release-candidate-prep:
 	$(PYTHON) .github/scripts/test_patch_0_1_2_python_public_install_wording_closeout.py
 	$(PYTHON) .github/scripts/test_patch_0_1_2_package_tag_approval_request.py
 	$(PYTHON) .github/scripts/test_patch_0_1_2_package_tag_approval_decision.py
+	$(PYTHON) .github/scripts/test_patch_0_1_2_package_tag_closeout.py
 	$(PYTHON) .github/scripts/test_first_public_release_artifact_evidence.py
 	$(PYTHON) .github/scripts/test_first_public_release_final_decider.py
 	$(PYTHON) .github/scripts/test_first_public_release_linux_x64_artifact_evidence.py

docs/execution-status.md

@@ -120,6 +120,13 @@ merged source, and hosted surfaces, production positioning, Windows packaged art
 project-maintained PDFium builds, `ethos-doc`, `ethos-rag`, and public benchmark claims remain
 blocked.
 
+Patch `0.1.2` package tag closeout is recorded in
+`docs/validation/patch-0-1-2-package-tag-closeout-validation-2026-06-25.md`. Package tag creation
+closeout is complete for the three approved annotated package tags, and remote `origin` tag refs
+dereference to the approved package source commit. Hosted surfaces, production positioning, Windows
+packaged artifacts, bundled project-maintained PDFium builds, `ethos-doc`, `ethos-rag`, and public
+benchmark claims remain blocked.
+
 Public approval lane blocker prep is recorded in
 `docs/milestone-e-public-approval-lane-blockers.json` and schema-bound by
 `schemas/ethos-milestone-e-public-approval-lane-blockers.schema.json`. This public approval lane

docs/public-release-checklist.md

@@ -201,6 +201,13 @@ merged source; hosted surfaces, production positioning, Windows packaged artifac
 project-maintained PDFium builds, `ethos-doc`, `ethos-rag`, and public benchmark claims remain
 blocked.
 
+Patch `0.1.2` package tag closeout is recorded in
+`docs/validation/patch-0-1-2-package-tag-closeout-validation-2026-06-25.md`. Package tag creation
+closeout is complete for the three approved annotated package tags, and remote `origin` tag refs
+dereference to the approved package source commit. Hosted surfaces, production positioning, Windows
+packaged artifacts, bundled project-maintained PDFium builds, `ethos-doc`, `ethos-rag`, and public
+benchmark claims remain blocked.
+
 ## Required Before Public Push
 
 - Package-name and trademark decision is closed by accepted ADR-0006 in

docs/validation/README.md

@@ -770,6 +770,10 @@ recording the exact current-main source candidate and required follow-up evidenc
   source tree, and later operator commands; package tag creation remains a separate operator
   action, and hosted, production, Windows, bundled PDFium, benchmark, `ethos-doc`, and `ethos-rag`
   surfaces remain blocked until separate approval or closeout records pass.
+- `patch-0-1-2-package-tag-closeout-validation-2026-06-25.md` - patch 0.1.2 package tag
+  closeout validation records completed annotated package tag creation and remote tag evidence for
+  the three approved package tags; hosted, production, Windows, bundled PDFium, benchmark,
+  `ethos-doc`, and `ethos-rag` surfaces remain blocked until separate approval records pass.
 - `milestone-e-validation-command-index-validation-2026-06-20.md` - internal Milestone E
   validation-command index validation passed through command-alignment checks, schema enum checks,
   row-record checks, public-surface posture checks, `make milestone-e-prep`, and diff hygiene; the

docs/validation/patch-0-1-2-package-tag-closeout-validation-2026-06-25.md

@@ -0,0 +1,118 @@
+# Patch 0.1.2 Package Tag Closeout Validation - 2026-06-25
+
+Validated source HEAD before this record: `8ab9e18`.
+
+Patch 0.1.2 package tag closeout source commit: `8ab9e180cfb96a1e6659dff97db7fb7a4288817b`.
+
+Patch 0.1.2 package tag closeout source tree: `1a40205d4d87614e14278ab7d0107fa58bbeeb46`.
+
+Status: **patch 0.1.2 package tags created and pushed**
+
+This record closes the bounded patch `0.1.2` package tag creation lane for the three package tags
+approved in `docs/validation/patch-0-1-2-package-tag-approval-decision-validation-2026-06-25.md`.
+It records only the completed annotated package tag operator action and remote tag evidence. It does
+not change package contents, change public wording, approve hosted surfaces, approve production
+positioning, approve Windows packaged artifacts, approve bundled project-maintained PDFium builds,
+approve `ethos-doc`, approve `ethos-rag`, or approve public benchmark reports or claims.
+
+## Subject
+
+- Repository: `docushell/ethos`
+- Lane: patch `0.1.2` package tag closeout
+- Approval decision record:
+  `docs/validation/patch-0-1-2-package-tag-approval-decision-validation-2026-06-25.md`
+- Package tag source commit: `3bc3564e38c1168b2db72f38863d324b6b57bd4d`
+- Package tag source tree: `eda8c7a605a4eb29c155ae3b9e6e9f0c35798f8c`
+
+## Completed Package Tags
+
+- `ethos-package-ethos-doc-core-0.1.2`
+  - local tag object prefix: `4ced-3275-6502`
+  - remote tag object prefix: `4ced-3275-6502`
+  - dereferenced commit: `3bc3564e38c1168b2db72f38863d324b6b57bd4d`
+- `ethos-package-ethos-verify-0.1.2`
+  - local tag object prefix: `57dd-49a6-b8a6`
+  - remote tag object prefix: `57dd-49a6-b8a6`
+  - dereferenced commit: `3bc3564e38c1168b2db72f38863d324b6b57bd4d`
+- `ethos-package-ethos-pdf-0.1.2`
+  - local tag object prefix: `0243-15d5-a973`
+  - remote tag object prefix: `0243-15d5-a973`
+  - dereferenced commit: `3bc3564e38c1168b2db72f38863d324b6b57bd4d`
+
+## Operator Evidence
+
+Pre-tag checks passed:
+
+```sh
+python3 .github/scripts/test_patch_0_1_2_package_tag_approval_decision.py
+python3 .github/scripts/test_patch_0_1_2_package_tag_approval_request.py
+python3 .github/scripts/test_patch_0_1_2_python_public_install_wording_closeout.py
+make release-candidate-prep PYTHON=python3
+git diff --check
+```
+
+Pre-tag existence checks returned no existing patch `0.1.2` package tags locally or on `origin`.
+
+Approved local tag creation commands executed:
+
+```sh
+git tag -a ethos-package-ethos-doc-core-0.1.2 3bc3564e38c1168b2db72f38863d324b6b57bd4d -m "Package tag ethos-doc-core 0.1.2"
+git tag -a ethos-package-ethos-verify-0.1.2 3bc3564e38c1168b2db72f38863d324b6b57bd4d -m "Package tag ethos-verify 0.1.2"
+git tag -a ethos-package-ethos-pdf-0.1.2 3bc3564e38c1168b2db72f38863d324b6b57bd4d -m "Package tag ethos-pdf 0.1.2"
+```
+
+Approved remote push command executed:
+
+```sh
+git push origin refs/tags/ethos-package-ethos-doc-core-0.1.2 refs/tags/ethos-package-ethos-verify-0.1.2 refs/tags/ethos-package-ethos-pdf-0.1.2
+```
+
+Observed push result:
+
+```text
+* [new tag]         ethos-package-ethos-doc-core-0.1.2 -> ethos-package-ethos-doc-core-0.1.2
+* [new tag]         ethos-package-ethos-verify-0.1.2 -> ethos-package-ethos-verify-0.1.2
+* [new tag]         ethos-package-ethos-pdf-0.1.2 -> ethos-package-ethos-pdf-0.1.2
+```
+
+Remote verification:
+
+```text
+4ced-3275-6502... refs/tags/ethos-package-ethos-doc-core-0.1.2
+3bc3564e38c1168b2db72f38863d324b6b57bd4d refs/tags/ethos-package-ethos-doc-core-0.1.2^{}
+0243-15d5-a973... refs/tags/ethos-package-ethos-pdf-0.1.2
+3bc3564e38c1168b2db72f38863d324b6b57bd4d refs/tags/ethos-package-ethos-pdf-0.1.2^{}
+57dd-49a6-b8a6... refs/tags/ethos-package-ethos-verify-0.1.2
+3bc3564e38c1168b2db72f38863d324b6b57bd4d refs/tags/ethos-package-ethos-verify-0.1.2^{}
+```
+
+## Retained Blockers
+
+- Package tag creation closeout is complete for the three patch `0.1.2` package tags.
+- Hosted surfaces remain blocked.
+- Production positioning remains blocked.
+- Windows packaged artifacts remain blocked.
+- Bundled project-maintained PDFium builds remain blocked.
+- Public benchmark reports remain blocked.
+- Public benchmark claims remain blocked.
+- `ethos-doc` remains blocked.
+- `ethos-rag` remains blocked.
+- PDFium remains caller-provided through `ETHOS_PDFIUM_LIBRARY_PATH`.
+
+## Commands
+
+```sh
+python3 .github/scripts/test_patch_0_1_2_package_tag_closeout.py
+python3 .github/scripts/test_patch_0_1_2_package_tag_approval_decision.py
+python3 .github/scripts/test_patch_0_1_2_package_tag_approval_request.py
+make release-candidate-prep PYTHON=python3
+git diff --check
+```
+
+## Result
+
+```text
+patch 0.1.2 package tag closeout recorded
+The three approved annotated package tags exist on origin and dereference to the approved source commit
+Hosted, production, Windows, bundled PDFium, benchmark, ethos-doc, and ethos-rag surfaces remain blocked
+```