docs: reconcile post-GA release-line evidence

CHANGELOG.md

@@ -74,9 +74,8 @@ The v2.0.0-rc.1 candidate was published and verified before this GA release.
 
 ### Changed
 
-- Unlocked guarded v2 prerelease publication after the deterministic artifact,
-  checksum, SBOM, and provenance contract landed; GA publication remains locked
-  until the #214 and #240 release-candidate gates pass.
+- Promoted the guarded v2.0.0 GA after the deterministic artifact, checksum,
+  SBOM, provenance, and #240 first-party cutover gates passed.
 - Made `base_require_version` compare the supported v2 prerelease identifiers
   (`alpha.N`, `beta.N`, and `rc.N`) correctly against GA and older releases.
 - Established the v2 API charter in `docs/v2-api-contract.md`: public

SECURITY.md

@@ -6,9 +6,8 @@ every vendored copy as executable supply-chain input.
 
 ## Supported releases
 
-The supported release line begins at `v2.0.0` GA. Until that release exists,
-the repository's current stable line is `v1.4.0`; it is maintained only as a
-historical reference while the v2 train is completed. After v2 GA, only the
+The supported release line begins at the published `v2.0.0` GA. The former
+`v1.4.0` line is now maintained only as a historical reference. Only the
 latest supported v2 security release receives fixes. All 0.x releases and
 pre-v2 1.x releases are historical and unsupported; the withdrawn July 2026
 v2 tag/formula event was not a supported release. See

docs/versioning-policy.md

@@ -2,10 +2,10 @@
 
 ## Current Release Line
 
-`v1.4.0` remains the last stable Base Bash release until the verified
-`v2.0.0` GA asset is published. The release-preparation candidate is now
-`v2.0.0`; the 5/5 initiative has one stable target and will not create a
-stable `v1.5.0` or reset the version to 0.x.
+`v2.0.0` is the current stable Base Bash release, backed by its verified
+canonical GA asset. `v1.4.0` and earlier releases are historical references;
+the 5/5 initiative has one stable target and will not create a stable `v1.5.0`
+or reset the version to 0.x.
 
 Those choices would either hide breaking changes inside the current 1.x
 compatibility range or move version precedence backward.
@@ -38,11 +38,11 @@ and dry runs to Base's guarded release command.
 
 Prerelease publication became available because #233 and the follow-up
 release-artifact contract landed. The reviewed `v2.0.0-rc.1` artifact and the
-pre-GA work in #240 then validated and rehearsed the exact release candidate
-across Base, Base Demo, Homebrew, vendored, and bundled paths. The guard now
-permits `v2.0.0` GA publication; maintainers must still build and verify the
-canonical archive, checksum manifest, SBOM, and provenance from the reviewed
-GA commit before publishing and completing the remaining first-party handoff.
+pre-GA work in #240 validated and rehearsed the exact release candidate across
+Base, Base Demo, Homebrew, vendored, and bundled paths. The canonical
+`v2.0.0` archive, checksum manifest, SBOM, and provenance are now published and
+the first-party handoff is complete; future releases must preserve the same
+verified-asset contract.
 
 The GA lock is code-reviewed policy, not an environment-variable or
 sentinel-file override. The PR that satisfies each gate must update the guard

examples/reference-apps/README.md

@@ -34,6 +34,6 @@ examples/reference-apps/release-rehearsal.sh \
 ```
 
 The required evidence schema and platform matrix live in
-[`release-evidence.yaml`](release-evidence.yaml). Placeholders remain marked
-`pending-ga-asset` until the canonical v2 asset, checksum, and provenance are
-published; the repository never treats a moving checkout as release evidence.
+[`release-evidence.yaml`](release-evidence.yaml). It records the verified
+canonical `v2.0.0` asset, checksum, and provenance; the repository never treats
+a moving checkout as release evidence.

examples/reference-apps/release-evidence.yaml

@@ -1,13 +1,13 @@
 schema_version: 1
 release_line: v2.0.0
-status: pending-ga-asset
+status: verified
 
-# Fill these fields only from the canonical release asset and its independently
-# verified checksum. A local checkout or a moving branch is not acceptable.
+# These identities come from the canonical release asset and its independently
+# verified provenance. A local checkout or a moving branch is not acceptable.
 candidate:
-  ref: pending-v2.0.0-rc-or-ga
-  commit: pending
-  sha256: pending
+  ref: v2.0.0
+  commit: b4243765726c133499feeabdc50154f99c0fec12
+  sha256: 73d6f92fab8f1a8ded7f3b4312ebbe51aa8ec0c16eacf18c2d8fa23fb5664333
 rollback:
   ref: v1.4.0
   commit: 2c5ef2c3a9edfbe2cf68d0645be65b920255abff