Publish Phase 3 release metadata

Author: chriswayneh

CHANGELOG.md

@@ -2,10 +2,10 @@
 
 All notable changes to RedDock are documented here.
 
-## [0.4.0] — Phase 3 Validation (development)
+## [0.4.0] — Phase 3 Validation
 
 Phase 3 adds a deliberately narrow path to recheck a conclusion without turning
-RedDock into a general-purpose scanner. It is not a tagged release yet.
+RedDock into a general-purpose scanner.
 
 ### Added
 

README.md

@@ -13,7 +13,7 @@ Container-native security assessment and validation platform with controlled exe
 [![License](https://img.shields.io/github/license/chriswayneh/RedDock)](LICENSE)
 [![Phase](https://img.shields.io/badge/phase-3%20Validation-C1121F)](ROADMAP.md)
 
-**Current development version:** 0.4.0 — Phase 3 Validation · Active development
+**Current release:** [v0.4.0](https://github.com/chriswayneh/RedDock/releases/tag/v0.4.0) — Phase 3 Validation
 
 [Quick Start](#quick-start) · [Current Capabilities](#what-you-get) · [Architecture](#architecture) · [Security](#security-by-design) · [Roadmap](ROADMAP.md) · [Contributing](CONTRIBUTING.md)
 
@@ -169,7 +169,7 @@ docs/          Architecture decisions and project documentation
 
 ## Project Status
 
-**0.4.0 completes Phase 3 — Validation:** an approval-gated, scope-rechecked, non-destructive HTTP-origin recheck for eligible open security-header findings, with `confirmed`, `not_reproduced`, or `indeterminate` outcomes, separate confidence, and a hashed raw/normalized/metadata/manifest evidence package. This development version is not represented by a release tag yet.
+**v0.4.0 delivered Phase 3 — Validation:** an approval-gated, scope-rechecked, non-destructive HTTP-origin recheck for eligible open security-header findings, with `confirmed`, `not_reproduced`, or `indeterminate` outcomes, separate confidence, and a hashed raw/normalized/metadata/manifest evidence package.
 
 **v0.3.0 delivered Phase 2 — Detection:** the detector contract and registry, detection runs, normalized findings with separate severity and confidence, deduplication by stable fingerprint, a lifecycle that resolves rather than deletes, evidence links from every finding back to the observations and hashes behind it, and the CVE enrichment boundary.
 

ROADMAP.md

@@ -16,7 +16,7 @@ RedDock ships no CVE data. Enrichment is a boundary with a local, operator-suppl
 
 ## Completed — Phase 3: Validation
 
-Controlled non-destructive validation is now limited to one fixed HTTP-origin recheck for an eligible open `http.security_headers` finding. Creating a request makes no network contact; a separate local approval note is required, DockGuard re-evaluates the recorded origin immediately before the probe, and a raw/normalized/metadata/manifest evidence package is SHA-256 hashed. Outcomes are `confirmed`, `not_reproduced`, or `indeterminate`, with confidence stated separately. There are no payloads, credentials, arbitrary URLs, redirects, response bodies, or commands. Implemented in development version 0.4.0; no release tag has been created.
+Controlled non-destructive validation is now limited to one fixed HTTP-origin recheck for an eligible open `http.security_headers` finding. Creating a request makes no network contact; a separate local approval note is required, DockGuard re-evaluates the recorded origin immediately before the probe, and a raw/normalized/metadata/manifest evidence package is SHA-256 hashed. Outcomes are `confirmed`, `not_reproduced`, or `indeterminate`, with confidence stated separately. There are no payloads, credentials, arbitrary URLs, redirects, response bodies, or commands. Released as v0.4.0.
 
 ## Phase 4 — Correlation
 

SECURITY.md

@@ -87,8 +87,8 @@ Do not open a public issue for a suspected security flaw. When GitHub Private Vu
 
 | Version | Supported |
 | --- | --- |
-| 0.4.x | Yes — current development version; no release tag yet |
-| 0.3.x | No — superseded by the current development version |
+| 0.4.x | Yes — current published release |
+| 0.3.x | No — superseded by 0.4.0 |
 | 0.2.x | No — superseded by 0.3.0 |
 | 0.1.x | No — superseded by 0.2.0 |