docs: clarify release distribution status

README.md

@@ -39,18 +39,23 @@ Requirements:
 - Git 2.39 or newer
 - Codex CLI for managed execution
 
-Install and verify the environment:
+The current source is published as a GitHub prerelease. The npm registry may lag
+the GitHub candidate; check [Validation Status](docs/validation-status.md) before
+choosing an install source.
+
+Run the current source from a checkout:
 
 ```bash
-npm install -g @setrathex/codex-engineering-workflow-pack
-cewp init
-cewp doctor
+git clone https://github.com/SetraTheXX/Codex-Engineering-Workflow-Pack.git
+cd Codex-Engineering-Workflow-Pack
+node ./bin/cewp.js init
+node ./bin/cewp.js doctor
 ```
 
 Run the credential-free walkthrough:
 
 ```bash
-cewp demo supervised
+node ./bin/cewp.js demo supervised
 ```
 
 Create a bounded checkpoint in a disposable or reviewed repository:

docs/install.md

@@ -16,6 +16,13 @@ CEWP has three public surfaces:
 
 ## One-Time Repo Install
 
+The npm registry can trail the current GitHub prerelease. Check the published
+registry version before using `npx`:
+
+```bash
+npm view @setrathex/codex-engineering-workflow-pack version
+```
+
 Install CEWP skills into the current repo:
 
 ```bash
@@ -60,7 +67,9 @@ cewp list
 
 ## Codex Plugin Install
 
-The current beta plugin is installed from a CEWP source checkout through Codex's marketplace commands. The npm package remains the supported CLI distribution.
+The current beta plugin is installed from a CEWP source checkout through Codex's
+marketplace commands. CEWP is not listed as a bundled or curated Codex plugin.
+The npm package distributes the CLI when the matching version has been published.
 
 ```bash
 codex plugin marketplace add /path/to/Codex-Engineering-Workflow-Pack

docs/release-notes.md

@@ -8,6 +8,8 @@
   and the obsolete Codex capability probe matrix from the public package.
 - Kept operational, security, compatibility, recovery, and API documentation as
   the supported public documentation surface.
+- Clarified that the current GitHub prerelease leads the npm registry and that the
+  Codex plugin is installed from a source checkout rather than a global catalog.
 
 ## 0.14.0-beta.0 — 2026-07-27
 

docs/validation-status.md

@@ -7,12 +7,15 @@ the public repository.
 ## Current Candidate
 
 - Package: `0.14.0-beta.0`
+- GitHub prerelease: `v0.14.0-beta.0`
+- npm registry: `0.7.0-beta.0` (`0.14.0-beta.0` publication pending)
+- Codex plugin distribution: source-checkout marketplace only
 - Managed backend: `codex-exec`
 - Supported Node.js majors: 22, 24, and 26
 - Repository CI: Windows and Ubuntu
 - Technical acceptance: complete
 - Independent user validation: not claimed
-- Publication status: not released as `1.0.0`
+- Publication status: GitHub prerelease; not released as `1.0.0`
 
 `cewp compatibility --json` is the canonical machine-readable compatibility
 projection. A release still requires validation of the exact final source,

tests/contracts/pilot-release.js

@@ -35,6 +35,8 @@ function runContract() {
   const validation = read("docs/validation-status.md");
   assert(/technical acceptance: complete/i.test(validation), "validation status records technical acceptance");
   assert(/independent user validation: not claimed/i.test(validation), "validation status avoids an external-user claim");
+  assert(/GitHub prerelease: `v0\.14\.0-beta\.0`/i.test(validation), "validation status identifies the current GitHub prerelease");
+  assert(/npm registry: `0\.7\.0-beta\.0`.*publication pending/is.test(validation), "validation status discloses that npm trails the current source");
   assert(/local run identifiers.*not part of\s+the public repository/is.test(validation), "validation status excludes local run identities");
   assert(packageJson.files.includes("docs/validation-status.md"), "aggregate validation status is packaged");