# CLI prerelease publication records — 2026-09-11

These four files are exact byte copies from `.local/cli-packaging-20260911/`.
They contain sanitized publication results and release prose only. No credential,
configuration, authentication helper or upload script is included.

| File | Bytes | SHA256 |
| --- | ---: | --- |
| `upload-binaries-verified.json` | 678 | `e945e2724020c48bfe15be7b4258861bd6c01291b98eae036eca786bb022ebde` |
| `upload-validation-verified.json` | 277 | `73581acbb5b5fe4aca1fda1b626f80a28bcb3d6c036f7ce793c62bf5a8ef4a72` |
| `published-verified.json` | 382 | `b5fe8a38579fb8399c78bca9db9fd91b64e8b7b7de7c664049cf5e615a671100` |
| `RELEASE-NOTES.md` | 2010 | `86a1b5b0744c8f63f6ed640e14b23bdbcb34b63a25320d67eb1fa7da4128a0a5` |

All four originals use CRLF. `preserve.py` rereads source and destination bytes,
refuses any unequal existing destination, and records the inventory in
`manifest.json`. It does not upload or execute application binaries. Running it
again requires the original private source records and preserved MCP readbacks.

`mcp-release-readback.json` and `mcp-tag-readback.json` are locally serialized
parsed responses from fresh read-only Gitea MCP calls. They are observations,
not original HTTP wire bytes. Release 2 is published as a prerelease at
`cli-v0.2.0-preview.authoring.20260911`, pointing to integration commit
`27df4a3945ebc97cd7cbde61f6aeea7a91c680d3`.

The publisher's `notes_sha256` is
`1b83b9c904a79ff7acbde421851c9da9b520f3fa0aea920bf55fb71bea392a9d`.
It binds the **1988-byte UTF-8 LF public body**, not the raw CRLF Markdown file
above. Converting only CRLF to LF makes the preserved prose exactly equal to
the MCP public body, including its final newline. `preservation.log` records
the corrected successful check. `preservation-initial-failure.txt` discloses
the initial checker assumption and its correction; no publication changed.

The asset readback PASS fields are the original publisher's downloaded-asset
verification, preserved without re-downloading or repeating runtime checks.
The semantic source (`01b76a1`), packaging assembly (`a0a48e8`) and release
integration (`27df4a3`) remain distinct in `manifest.json` and the report.

Proposed repository attribute rule for root integration:

```gitattributes
harness/experiments/cli-prerelease-20260911/** -text
```

The preserving worker did not edit `.gitattributes` or Git state. Root must
apply the rule before adding these exact evidence bytes and verify index or
checkout hashes. The standalone report is
`harness/release-cli-prerelease-published-20260911.md`.