docs: complete v0.5.4 candidate handoff

Author: parousia8888

docs/V0.5.4_ENGINEERING_PLAN.md

@@ -1,7 +1,7 @@
 # v0.5.4 engineering plan
 
 Date: 2026-08-16  
-Status: in progress  
+Status: awaiting release approval
 Release boundary: candidate source may be committed and pushed; tag, GitHub Release, npm publish
 and the movable `v1` Action tag require a separate author approval.
 
@@ -42,7 +42,7 @@ opens a lower-friction support channel and submits the one currently eligible cu
 | G3 | First-trial and v0.5.4 candidate surfaces | Main-branch first trial is unpinned; CI/release/trusted install examples stay pinned; candidate version surfaces agree on 0.5.4 while published release state remains 0.5.3 | completed |
 | G4 | Focused and final verification | New focused tests pass, generated artifacts are byte-current, one bounded complete-suite pass and Skill Creator validation pass | completed |
 | G5 | Authorized external actions | Discussions is enabled and verified; awesome-devsecops rules are rechecked and a factual v0.5.3 PR is submitted if still eligible | completed |
-| G6 | Release approval checkpoint | Candidate commits and external evidence are pushed; exact release operations and residual risks are presented to the author | in progress |
+| G6 | Release approval checkpoint | Candidate commits and external evidence are pushed; exact release operations and residual risks are presented to the author | completed |
 | G7 | Public v0.5.4 release | Signed tag/assets, GitHub Release, npm provenance, `v1` consumer verification and release-state update | blocked on explicit approval |
 
 ## G0 - Scope and baseline
@@ -255,6 +255,42 @@ Before asking for release approval, report:
 - current published state still pinned to v0.5.3;
 - the exact G7 commands/actions that approval would authorize.
 
+Completion record (2026-08-16):
+
+- Implementation candidate `0f4a64e34bdd0b426d72be5e1989d4b19f9c653e` is pushed to `main`.
+  Remote CI and CodeQL both completed successfully:
+  [CI run 31948081852](https://github.com/parousia8888/web-app-security-skill/actions/runs/31948081852)
+  and [CodeQL run 31948081858](https://github.com/parousia8888/web-app-security-skill/actions/runs/31948081858).
+- Rule-contract conformance: 22 contracts, 22 positive passes, 22 negative passes, 0 positive
+  failures, 0 negative failures and 0 evidence-state mismatches. This remains an author-maintained
+  planted contract suite, not production precision or recall evidence.
+- Real-world regression corpus: 5 cases passed, 0 failed; 4 resolved historical regressions and
+  1 unsuppressed expected benign match. These minimized cases guard named failures only and are not
+  a representative vulnerability benchmark.
+- GitHub Discussions reads back enabled at
+  <https://github.com/parousia8888/web-app-security-skill/discussions>. The awesome-devsecops
+  submission remains OPEN and mergeable at
+  [devsecops/awesome-devsecops#172](https://github.com/devsecops/awesome-devsecops/pull/172),
+  head `b24339b5ac2e16cda9eca5e92ecd847493bd38bc`; it is not an accepted listing or endorsement.
+- `npm pack --dry-run --json` produced candidate `0.5.4` with 140 files and 335872 packed bytes.
+  Both new evidence sets are included; tests, adoption working material and engineering plans are
+  excluded from the package.
+- Public state remains unchanged: npm `latest` is `0.5.3`; signed `v0.5.3` and movable `v1` both
+  resolve to `621e0bc2ad044f9390fa9d567bf4b9fca138a959`; release-state and installer trust still record
+  v0.5.3.
+- A bounded live-surface check found one pre-existing metadata drift: the public v0.5.3 GitHub
+  Release body does not contain the repository's current canonical promise, so
+  `node scripts/check-p7-surfaces.mjs --live` exits 1. The old published Release was not rewritten;
+  v0.5.4 must publish its own canonical text and then pass the live check against the new state.
+- Residual product limits are unchanged: v0.5.4 adds no detector family, data-flow analysis,
+  generic suppression engine or production accuracy claim. The real-world corpus is deliberately
+  small, and the curated-list PR remains third-party pending work.
+- Release approval authorizes only G7: freeze the candidate; create and push signed `v0.5.4`;
+  publish GitHub assets, SBOM, checksums and provenance; publish npm `0.5.4` with provenance and
+  compare its tarball to the tag; move signed `v1`; run consumer verification; then update
+  release-state, installer trust and public metadata from observed facts. None of these release
+  mutations has been performed at this checkpoint.
+
 ## G7 - Release procedure after approval
 
 1. Freeze the approved candidate commit and update release evidence/checksums.