# Downstream source releases Mnemosyne (Forgejo `origin`) is the source of truth. GitHub is a mirror. Downstream releases are **manual, source-only** Forgejo Releases with tags in this form: ```text fork-YYYY.MM.DD.N ``` `N` distinguishes releases on the same date. The tag identifies one exact, reviewed commit. Record its full SHA and the package version in the release notes. The Rust package version remains `0.10.0`; the source-release tag does not restamp `Cargo.toml`, `Cargo.lock`, or packaged version metadata. ## Release gate 1. Review the candidate through a Forgejo PR against the current `origin/main`. Preserve `archive/typescript-2026-10-18` at `239dbe344fcaf671af9898906ff952be73995614` as the TypeScript rollback checkpoint. 2. Verify the exact candidate with `make check` in the pinned `nix develop` environment and with `nix flake check --no-update-lock-file`. The full Rust gate is formatting, workspace clippy with `-D warnings`, and workspace tests. The audited Nix test subset is additional evidence, not a replacement. Include the parity-diff evidence required by `AGENTS.md` for user-visible changes. Keep test state and credentials isolated. 3. Validate the installed Nix wrapper and its Python kernel in isolated state. A source build alone does not prove installed runtime readiness. Do not use a shared Cargo target as evidence without proving the executed binary's source identity. 4. Obtain explicit authorization for the release. Create the fork-date tag at the exact verified commit and publish a non-draft, non-prerelease Forgejo Release. Release notes must state the SHA, package version, verification, known limits, and rollback commit. Push only to `origin`; its mirror handles GitHub. Do not move a published release tag. No binary archives, npm packages, catalog updates, installers, channel manifests, or R2 assets are published. Forgejo's source archives are sufficient; no custom release payload is required. CI validates commits but never publishes releases…