Record release audit and link public documentation

README.md

@@ -1,7 +1,7 @@
 # randaba
 
 [![CI](https://github.com/finite-sample/randaba/actions/workflows/ci.yml/badge.svg)](https://github.com/finite-sample/randaba/actions/workflows/ci.yml)
-[![Docs](https://github.com/finite-sample/randaba/actions/workflows/docs.yml/badge.svg)](https://github.com/finite-sample/randaba/tree/main/docs)
+[![Docs](https://github.com/finite-sample/randaba/actions/workflows/docs.yml/badge.svg)](https://finite-sample.github.io/randaba/)
 
 Randomized assignment-based anticlustering: random assignment to many arms
 that keeps the arms alike on baseline covariates. Assignment-based

docs/index.md

@@ -7,4 +7,5 @@
 
 api
 releasing
+release-audit
 ```

docs/release-audit.md

@@ -0,0 +1,43 @@
+# Release audit
+
+Audit date: October 19, 2026. Candidate version: `0.1.0`.
+
+The release-preparation work was merged in
+[PR #5](https://github.com/finite-sample/randaba/pull/5), at commit
+`e31367aec2f0f1af3578353bc6f96d4068e31407`. The repository is public. The
+distribution and import names are both `randaba`, and the license is MIT.
+
+## Validation
+
+| Check | Result |
+|---|---|
+| Native Python 3.13 and Docker Python 3.12/3.14 | 95 tests pass; 100% line coverage |
+| Installed wheel on all three Python versions | 95 tests pass |
+| Minimum runtime dependencies: NumPy 2.0.0, SciPy 1.13.0, Python 3.12 | 95 installed-wheel tests pass |
+| Ruff lint/format, Pyright, Pydoclint, pre-commit | Pass |
+| Sphinx with warnings treated as errors | Pass |
+| Wheel built from source distribution; strict Twine metadata checks | Pass |
+| Preen strict release audit | All 27 checks pass |
+| actionlint and Zizmor | Pass |
+| Gitleaks scan of all local Git history and release changes | No secrets detected |
+| Research note built with latexmk | Pass |
+
+The [merged-commit CI run](https://github.com/finite-sample/randaba/actions/runs/39368294599)
+checks the package, wheel, dependency lock, and workflow security.
+The [release rehearsal](https://github.com/finite-sample/randaba/actions/runs/39368318827)
+passed with publishing disabled, producing the wheel and source distribution
+through the release workflow.
+
+The vulnerability audit cannot assess `py-canon` against PyPI advisories
+because it is a Git-sourced documentation dependency. Its commit is pinned
+in `uv.lock`. The full research simulation campaigns were not rerun; the
+package tests include the checked-in R anticlust parity fixtures.
+
+## Publication status
+
+The GitHub repository is public. PyPI publication has not been attempted.
+The GitHub environment `pypi` exists. Before pushing a release tag, configure
+the matching PyPI pending trusted publisher and finalize the dated changelog.
+See [Releasing randaba](releasing.md) for the exact publisher settings and
+release procedure. A successful build rehearsal does not validate PyPI
+credentials or reserve the package name.

docs/releasing.md

@@ -2,20 +2,19 @@
 
 The first public version is prepared as `0.1.0`. The package is not yet
 published on PyPI. Both the distribution and Python import are `randaba`.
+The repository and [documentation site](https://finite-sample.github.io/randaba/)
+are public. The [release audit](release-audit.md) records the completed checks.
 
 ## First public release
 
-1. Merge the release-preparation branch after CI passes. It brings the
-   unpublished `randaba` implementation onto the existing repository history.
+1. The release-preparation branch is merged and the public launch is complete.
+   Confirm the release commit has passing CI before tagging.
 2. Run `make ci-docker` and `make ci-docker PYTHON_VERSION=3.14` on the release
    commit. The checks build a source distribution, build its wheel, validate
    metadata, and run tests against the installed wheel in an isolated environment.
-3. Change repository visibility to public in GitHub Settings. Configure
-   Pages to use GitHub Actions, then dispatch the Docs workflow on `main`.
-   The workflow builds while private and deploys only from public `main`.
-   Once Pages is live, the documentation URL can point to
-   `https://finite-sample.github.io/randaba/`.
-4. Create the GitHub Actions environment `pypi`. In PyPI, add a pending
+3. Pages is configured to use GitHub Actions. Confirm the Docs workflow
+   deploys successfully from `main`.
+4. The GitHub Actions environment `pypi` exists. In PyPI, add a pending
    trusted publisher with these exact values:
 
    | Field | Value |

pyproject.toml

@@ -27,7 +27,7 @@ dependencies = [
 
 [project.urls]
 Homepage = "https://github.com/finite-sample/randaba"
-Documentation = "https://github.com/finite-sample/randaba/tree/main/docs"
+Documentation = "https://finite-sample.github.io/randaba/"
 Repository = "https://github.com/finite-sample/randaba"
 Issues = "https://github.com/finite-sample/randaba/issues"
 Changelog = "https://github.com/finite-sample/randaba/blob/main/CHANGELOG.md"