Finalize VSTD 1.2.0 publication metadata

[TimeLordRaps]

Coordinate

Acronyms: application programming interface (API); CycloneDX Software Bill of Materials (SBOM); digital object identifier (DOI); GNU Privacy Guard (GPG); Python Package Index (PyPI); Verifier Standard (VSTD); ZIP archive format (ZIP).

• VSTD numbered profile or closure coordinate: no numbered-profile or closure-coordinate change; repository release metadata only
• Repository release or target commit: VSTD 1.2.0; base 3489953e8da2b6ff746932f42649aaf4ffe09444; head fc23298f1057ec5d78ce92902fb5fc5d74c78ebc; tree 4cf5b2106b43dc6e6aa8e87ef458e9a862f2deed
• Claim, schema, or implementation seam: final publication date and release-state consistency across human-readable, machine-readable, and generated presentation surfaces

Change and evidence

• What changes: records the actual publication date 2026-09-01; replaces current release-candidate metadata with the final VSTD 1.2.0 coordinate; makes .zenodo.json carry publication_date; makes release and presentation gates reject date drift; makes generated Pages report RELEASED.
• What does not change: normative VSTD documents, wire identifiers, schemas, public Python API, command-line behavior, receipt semantics, conformance mechanisms, and package version remain unchanged.
• Falsification condition: this change is not release-ready if any finalized surface still represents 1.2.0 as an unpublished candidate, if changelog/Citation File Format/Zenodo dates diverge, if generated Pages does not report RELEASED, or if any protected check fails at the exact head.
• Tests added or updated: direct release-metadata rejection for a mismatched Zenodo publication date; generated Pages release-state and dated-prose assertions.

Consequences

• Serialized-format and compatibility impact: none. This is a release-finalization metadata and presentation change.
• Trust roots, unknowns, residuals, and horizons: the date identifies the intended public release coordinate; it does not establish adoption, semantic correctness, standards-body recognition, external archiving, a DOI, or publication until the downstream release mechanisms complete.
• Downstream documents, schemas, examples, and receipts reviewed: README.md, CHANGELOG.md, CITATION.cff, .zenodo.json, Pages entry surfaces, release/presentation gates, and their tests. Normative specifications, schemas, examples, and receipts are unchanged.

Exact local evidence

• Signed commit: fc23298f1057ec5d78ce92902fb5fc5d74c78ebc, automation OpenPGP fingerprint 257B38745D5AC330DB5933639964E5CDED1761F8; local verification passed and GitHub reports verified=true, reason valid.
• Focused tests: 52 passed.
• Complete suite: 553 passed, 38 skipped under Python 3.12 with PYTHONPATH=src.
• Presentation, generated reference, compilation, diff, TIME.md, and finalized-metadata gates: passed.
• Generated Pages: release_state=RELEASED; dated release prose present; candidate prose absent from current Pages surfaces.
• Exact committed artifact set: source ZIP, wheel, source distribution, external manifest, and CycloneDX SBOM built and verified.
• Packaging: Twine checks passed; installed-wheel demo, generic receipt lifecycle, hardware registry, and deterministic virtual hardware verification passed.
• Public/private boundary scan: 506 text members across all five candidate artifacts, zero prohibited matches.
• Repository setting: immutable GitHub releases was enabled before this finalization pull request. The tag workflow rechecks it before publication.

Release boundary

This pull request does not create a tag, GitHub release, PyPI publication, deployment, or Zenodo record. After this exact tree passes protected checks and merges, the release procedure must rebuild from the final main commit, recheck immutable releases and TIME.md, create and verify the signed v1.2.0 tag, and let the protected release workflow publish the exact tested artifacts.

Checklist

• I did not turn UNKNOWN or CONFLICTED into a clean result.
• I did not strengthen a claim without stronger evidence.
• I did not include secrets, private data, or proprietary operational material.
• Normative text, machine-readable surfaces, examples, and tests agree.
• README maturity, claims guidance, generated reference, and Pages status still agree.