From e3c2c09652e1daa03f07d1f38027835de9e7bd00 Mon Sep 17 00:00:00 2001
From: chen21019 <19357113+chen21019@users.noreply.github.com>
Date: Sat, 24 Oct 2026 02:23:21 +0800
Subject: [PATCH 1/3] docs: record the published security release

---
 README.md | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 162814d1..604ee238 100644
--- a/README.md
+++ b/README.md
@@ -20,9 +20,13 @@ for the neutral runtime contract.
 
 ## Release status
 
-The current public release and Catalog image are `v0.8.0`. This source tree
-targets the next numeric candidate, `v0.8.1`; that candidate is not yet
-published and must not be copied into deployment configuration.
+The current public release is [v0.8.1](https://github.com/PastureStack/external-dns-sync/releases/tag/v0.8.1),
+built from producer `7ff253bd84c13fd6748b9ca9737370de9ff5535f`.
+The published Linux image is
+`ghcr.io/pasturestack/external-dns-sync:v0.8.1@sha256:0dd0a346573f1661abf920a0d87a153a312515882b16a8ef5983614fa725c751`.
+See the [official publication](https://github.com/PastureStack/external-dns-sync/actions/runs/39960962858)
+for artifact evidence. Catalog selection and managed-service upgrade acceptance
+remain separate; publishing does not update existing deployments.
 
 The reviewed runtime registers only Amazon Route 53 because that is the
 first-party infrastructure template being preserved in the current Catalog.

From eeee3ae6bb25bbf2335fec6317507598b183e7c1 Mon Sep 17 00:00:00 2001
From: chen21019 <19357113+chen21019@users.noreply.github.com>
Date: Sat, 24 Oct 2026 02:26:05 +0800
Subject: [PATCH 2/3] docs: separate version coordinates from manifest evidence

---
 README.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 604ee238..851dd214 100644
--- a/README.md
+++ b/README.md
@@ -23,7 +23,8 @@ for the neutral runtime contract.
 The current public release is [v0.8.1](https://github.com/PastureStack/external-dns-sync/releases/tag/v0.8.1),
 built from producer `7ff253bd84c13fd6748b9ca9737370de9ff5535f`.
 The published Linux image is
-`ghcr.io/pasturestack/external-dns-sync:v0.8.1@sha256:0dd0a346573f1661abf920a0d87a153a312515882b16a8ef5983614fa725c751`.
+`ghcr.io/pasturestack/external-dns-sync:v0.8.1`, with manifest digest
+`sha256:0dd0a346573f1661abf920a0d87a153a312515882b16a8ef5983614fa725c751`.
 See the [official publication](https://github.com/PastureStack/external-dns-sync/actions/runs/39960962858)
 for artifact evidence. Catalog selection and managed-service upgrade acceptance
 remain separate; publishing does not update existing deployments.

From b5ed520151314a521743c5ea5e56c81ebdd518f3 Mon Sep 17 00:00:00 2001
From: chen21019 <19357113+chen21019@users.noreply.github.com>
Date: Sat, 24 Oct 2026 02:40:00 +0800
Subject: [PATCH 3/3] docs: align current release and installation entries

---
 README.md | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 851dd214..51c5cbeb 100644
--- a/README.md
+++ b/README.md
@@ -28,6 +28,8 @@ The published Linux image is
 See the [official publication](https://github.com/PastureStack/external-dns-sync/actions/runs/39960962858)
 for artifact evidence. Catalog selection and managed-service upgrade acceptance
 remain separate; publishing does not update existing deployments.
+The previous `ghcr.io/pasturestack/external-dns-sync:v0.8.0` image remains
+historical release evidence.
 
 The reviewed runtime registers only Amazon Route 53 because that is the
 first-party infrastructure template being preserved in the current Catalog.
@@ -109,11 +111,11 @@ run a provider update against a production zone as part of a source migration
 proof of concept. CI/CD publication and release automation are outside this
 scope.
 
-After packaging a local image, the entrypoint and binary can be checked without
-contacting a provider:
+The published image's entrypoint and binary can be checked without contacting
+a provider:
 
 ```bash
-docker run --rm ghcr.io/pasturestack/external-dns-sync:v0.8.0 --help
+docker run --rm ghcr.io/pasturestack/external-dns-sync:v0.8.1 --help
 ```
 
 ## Runtime boundary