release: record v2.0.0 GA cutover state

README.md

@@ -6,12 +6,11 @@
 
 | Version | License | Install | Release notes |
 | --- | --- | --- | --- |
-| `2.0.0` | [Apache-2.0](LICENSE) | `brew install basefoundry/base/base-bash-libs` | [v2.0.0 (planned)](https://github.com/basefoundry/base-bash-libs/issues/215) |
+| `2.0.0` | [Apache-2.0](LICENSE) | `brew install basefoundry/base/base-bash-libs` | [v2.0.0](https://github.com/basefoundry/base-bash-libs/releases/tag/v2.0.0) |
 
-The v2.0.0 row describes the planned next stable release. The v2.0.0-rc.1
-candidate was verified against the same release contract before GA publication.
-Until its canonical GA asset is published and the first-party cutover is
-complete, v1.4.0 remains the current stable package.
+The v2.0.0 release is published with a deterministic bundle archive, checksum
+manifest, SPDX SBOM, and provenance statement. First-party consumer and
+Homebrew pins are being promoted to the exact GA commit as part of issue #240.
 
 Reusable Bash standard library for reliable shell scripts.
 
@@ -226,11 +225,10 @@ The repo-root `VERSION` file is the source of truth for the package version.
 The top strip in this README and the runtime `BASE_BASH_LIBS_VERSION` constant
 are validated against that file.
 
-`v1.4.0` remains stable during the clean-break v2 release preparation. The
-sole next stable target is `v2.0.0`; there will be no stable v1.5.0 or version
-reset to 0.x. See the [versioning and release-line policy](docs/versioning-policy.md)
-for prerelease identifiers, the withdrawn July 2026 v2 event, immutable
-consumption, and the post-GA support contract.
+`v2.0.0` is the current stable release. It is intentionally a clean break from
+the v1 surface; SemVer compatibility guarantees apply from v2.0.0 onward. See
+the [versioning and release-line policy](docs/versioning-policy.md) for
+immutable consumption and the post-GA support contract.
 
 Pinned checkout, archive, Homebrew, vendored, and standalone consumption is
 documented in [`docs/pinned-consumption.md`](docs/pinned-consumption.md).

docs/consumer-validation-status.md

@@ -10,22 +10,22 @@ has approved publication.
 
 ## Framework reference
 
-The validation below used the immutable `base-bash-libs` v2.0.0-rc.1
-candidate at commit
-`c134fb8a3397e2cfee1d90845cec44f56dacae7b`. The annotated tag
-[v2.0.0-rc.1](https://github.com/basefoundry/base-bash-libs/releases/tag/v2.0.0-rc.1)
-and its canonical archive, SHA256SUMS, SPDX SBOM, and provenance assets were
-downloaded and verified. This is RC evidence, not a GA support claim.
+The release gate used the immutable `base-bash-libs` v2.0.0 GA at merge commit
+`b4243765726c133499feeabdc50154f99c0fec12`. The
+[v2.0.0 release](https://github.com/basefoundry/base-bash-libs/releases/tag/v2.0.0)
+archive, SHA256SUMS, SPDX SBOM, and provenance assets were downloaded and
+verified. The canonical archive SHA256 is
+`73d6f92fab8f1a8ded7f3b4312ebbe51aa8ec0c16eacf18c2d8fa23fb5664333`.
 
 ## Consumer matrix
 
 | Checkout | Relationship | Reference | Deployment exercised | Result | Classification |
 | --- | --- | --- | --- | --- | --- |
-| Base | First-party direct consumer | merged [6038cba](https://github.com/basefoundry/base/commit/6038cbaf93eb21ccb26c17a612aded85deedb04b) | CI pinned to `c134fb8` (v2.0.0-rc.1) | PR [#1934](https://github.com/basefoundry/base/pull/1934): Python/pylint, integration, security, BATS, Ubuntu source-checkout, macOS smoke, and branch policy all passed | Pass; useful readiness evidence, not independent adoption evidence |
-| Base Demo | First-party representative consumer | merged [b54bf00](https://github.com/basefoundry/base-demo/commit/b54bf008a9dfb542c5c51dc919c3e10698a2f5eb) | CI pinned to `c134fb8` (v2.0.0-rc.1) | PR [#214](https://github.com/basefoundry/base-demo/pull/214): validation, Ubuntu, source-checkout, and branch policy all passed; local full validation passed with isolated caches | Pass; useful readiness evidence, not independent adoption evidence |
+| Base | First-party direct consumer | merged [6038cba](https://github.com/basefoundry/base/commit/6038cbaf93eb21ccb26c17a612aded85deedb04b) | CI currently pinned to `c134fb8` (v2.0.0-rc.1); GA pin PR pending | PR [#1934](https://github.com/basefoundry/base/pull/1934): Python/pylint, integration, security, BATS, Ubuntu source-checkout, macOS smoke, and branch policy all passed | RC pass; GA promotion pending |
+| Base Demo | First-party representative consumer | merged [b54bf00](https://github.com/basefoundry/base-demo/commit/b54bf008a9dfb542c5c51dc919c3e10698a2f5eb) | CI currently pinned to `c134fb8` (v2.0.0-rc.1); GA pin PR pending | PR [#214](https://github.com/basefoundry/base-demo/pull/214): validation, Ubuntu, source-checkout, and branch policy all passed; local full validation passed with isolated caches | RC pass; GA promotion pending |
 | BankBuddy | Adjacent repository; no direct `base-bash-libs` reference | `e32561c` | None | Repository validation: **312 passed** | Excluded from the consumer count |
 | BanyanLabs | Adjacent repository; no direct `base-bash-libs` reference | `15ef6cd` | None | Repository baseline present | Excluded from the consumer count |
-| Homebrew | First-party package-manager consumer | stable tap remains `v1.4.0` | Disposable RC tap using canonical `v2.0.0-rc.1` archive | `brew audit --new`, source build, formula smoke test, and stable restore all passed; stable tap was not changed | Pass for RC rehearsal; GA formula PR remains pending |
+| Homebrew | First-party package-manager consumer | stable tap remains `v1.4.0` | Disposable RC tap passed; GA formula PR pending | RC audit, source build, formula smoke test, and stable restore all passed | RC pass; GA promotion pending |
 
 The Base and Base Demo checkouts are controlled by the primary author. They
 are valuable first-party regression signals, but they do not satisfy the
@@ -40,20 +40,18 @@ No independent production consumer has yet supplied a reproducible run
 covering installed, vendored, and bundled deployments together.
 
 The local vendor and reference-application rollback suites pass, and the
-Homebrew RC-to-v1.4 restore was rehearsed. A true RC-to-GA upgrade still
-cannot be validated until the immutable `v2.0.0` GA asset exists. That
-remaining release prerequisite is tracked by
-[#240](https://github.com/basefoundry/base-bash-libs/issues/240) and
-[#215](https://github.com/basefoundry/base-bash-libs/issues/215).
+Homebrew RC-to-v1.4 restore was rehearsed. A true RC-to-GA upgrade is now
+reproducible against the immutable v2.0.0 asset; downstream pin and formula
+promotion remains tracked by
+[#240](https://github.com/basefoundry/base-bash-libs/issues/240).
 
 ## Findings and limitations
 
 - The Base and Base Demo hosted RC pin suites found no new `base-bash-libs`
   API or behavior finding.
 - The v2 release archive is a deterministic bundle, not the v1 full-source
   archive. The GA Homebrew formula must therefore install the bundle layout
-  and use the `base_` API in its smoke test; the v1.4 formula remains
-  intentionally unchanged until that GA handoff.
+  and use the `base_` API in its smoke test.
 - Base Demo local full validation passed with isolated Go and Gradle caches;
   the hosted Ubuntu and source-checkout jobs passed as well.
 - There are no permissioned public users or case studies yet, so

docs/first-party-cutover.md

@@ -1,8 +1,8 @@
 # First-party v2 cutover
 
-Issue #240 is the release handoff, not permission to publish an unverified
-dependency. The exact v2 GA asset, checksum, and provenance must exist before
-any downstream pin changes.
+Issue #240 is the first-party promotion handoff. The exact v2 GA asset,
+checksum, and provenance now exist; downstream pins and the Homebrew formula
+must still be promoted to that immutable release.
 
 ## Inventory and order
 
@@ -19,9 +19,10 @@ inventory. The release order is:
    namespaced test expectations; and
 5. verify installed, vendored, bundled, and rollback paths in every consumer.
 
-The cutover is blocked while `release_status` is `pending-ga-asset`. This is a
-deliberate fail-closed state; changing a version string before the asset exists
-would make a reproducible install impossible.
+The release asset gate is satisfied when `release_status` is `published`, the
+archive SHA256 matches the uploaded canonical bundle, and the provenance asset
+names the exact merge commit. Consumer promotion remains fail-closed until
+each pin and formula points at that same commit and passes its hosted checks.
 
 ## Verification and rollback
 
@@ -39,6 +40,6 @@ release notes, then resume from the failed consumer after a reviewed fix.
 ## Current state
 
 Base's `basectl help` integration defect is fixed in the merged issue-backed PR
-above and validated locally against the v2 API. Base Demo and Homebrew remain
-intentionally unchanged until the v2 GA artifact is published; their current
-v1.4 pins are historical inputs to the final cutover checklist.
+above and validated locally against the v2 API. Base and Base Demo currently
+retain their verified RC pins while the GA promotion PRs are prepared; the
+Homebrew stable formula remains v1.4.0 until its GA formula PR lands.

first-party-cutover.yaml

@@ -1,9 +1,9 @@
 schema_version: 1
 target_release: 2.0.0
-release_status: pending-ga-asset
+release_status: published
 required_asset:
   tag: v2.0.0
-  sha256: publish-with-ga-release
+  sha256: 73d6f92fab8f1a8ded7f3b4312ebbe51aa8ec0c16eacf18c2d8fa23fb5664333
   provenance: required
 publish_order:
   - base-bash-libs
@@ -15,12 +15,12 @@ consumers:
     repository: basefoundry/base
     tracker: https://github.com/basefoundry/base/issues/1880
     pull_request: https://github.com/basefoundry/base/pull/1881
-    current_state: rc-pin-merged-pending-ga
+    current_state: ga-published-pending-pin
   - name: base-demo
     repository: basefoundry/base-demo
     tracker: base-bash-libs-240
-    current_state: rc-pin-merged-pending-ga
+    current_state: ga-published-pending-pin
   - name: homebrew-base
     repository: basefoundry/homebrew-base
     formula: Formula/base-bash-libs.rb
-    current_state: rc-formula-rehearsed-stable-unchanged
+    current_state: ga-published-pending-formula

tests/first-party-cutover.bats

@@ -4,13 +4,13 @@ setup() {
     repo_root="$(cd "${BATS_TEST_DIRNAME}/.." && pwd -P)"
 }
 
-@test "cutover check is fail-closed before GA and inspectable in pending mode" {
+@test "cutover check accepts the published GA asset" {
     run "$repo_root/scripts/first-party-cutover" check
-    [ "$status" -eq 1 ]
-    [[ "$output" == *"locked until"* ]]
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"structurally valid"* ]]
     run "$repo_root/scripts/first-party-cutover" check --allow-pending
     [ "$status" -eq 0 ]
-    [[ "$output" == *"PENDING release_status=pending-ga-asset"* ]]
+    [[ "$output" == *"structurally valid"* ]]
 }
 
 @test "cutover check detects legacy Base symbols" {