Document package release readiness

Author: ithiria894

docs/NPM_RELEASE.md

@@ -41,7 +41,25 @@ npx intentprobe --help
 Only after the package is live should the root README advertise `npx
 intentprobe ...` as the primary install path.
 
+## Local gate status seen on 2026-06-08
+
+Passed:
+
+- `INTENTPROBE_PYTHON=.venv/bin/python node npm/bin/intentprobe.mjs --help`
+- `npm --prefix npm run check`
+- `npm --prefix npm run pack:dry`
+- `npm publish ./npm --dry-run`
+
+Observed but time-bound:
+
+- `npm view intentprobe name version dist-tags --json` returned `E404` on
+  2026-06-08. Treat this as a local check, not a durable public claim about name
+  availability.
+
 ## Auth blocker seen locally
 
 `npm whoami` returned `ENEEDAUTH`, so publishing needs an npm login or npm
 automation token before this can go live.
+
+The dry-run publish can still show the package tarball and publish target, but
+the real publish requires npm auth.

docs/PYPI_RELEASE.md

@@ -0,0 +1,64 @@
+# PyPI Release Notes
+
+IntentProbe's Python package is the primary scanner package. The npm package is
+a thin launcher that depends on this package being available first.
+
+## Package
+
+- PyPI package name: `intentprobe`
+- current version: `0.1.0`
+- Python: `>=3.10,<3.14`
+- entry points: `intentprobe`, `intentprobe-hook`
+
+## Local build gate
+
+The release wheel should be built from a freshly extracted sdist, not directly
+from the live repo checkout. The repo may have an ignored `build/` directory,
+and a direct wheel build can accidentally reuse stale files.
+
+The local release gate was run on 2026-06-08:
+
+- `python -m build --sdist` from the repo: passed.
+- extract `intentprobe-0.1.0.tar.gz`, then `python -m build --wheel`: passed.
+- `twine check` on sdist and wheel: passed.
+- `check-wheel-contents`: passed.
+- wheel contains `metadata.json`, `probe_weights.npz`, `targets.py`, and entry
+  points.
+- sdist contains release docs, runtime docs, operator decision docs, evidence
+  packet, examples, research fixtures, and scanner artifact.
+- no-deps wheel smoke import passed: package version `0.1.0`, metadata file
+  present, probe weights present.
+
+## Registry status seen locally
+
+On 2026-06-08, `python3 -m pip index versions intentprobe` returned no matching
+distribution. Treat that as a time-bound check, not a durable public claim. The
+name can change before publish.
+
+## Publish command
+
+After PyPI auth is configured:
+
+```bash
+. /tmp/intentprobe-release-paths.env
+/tmp/intentprobe-release-tools/bin/python -m twine upload \
+  "$sdist_dist"/intentprobe-0.1.0.tar.gz \
+  "$wheel_dist"/intentprobe-0.1.0-py3-none-any.whl
+```
+
+Do not upload from old `dist/` files unless they were rebuilt during the same
+release gate.
+
+## Post-publish verification
+
+```bash
+python3 -m pip index versions intentprobe
+python3 -m venv /tmp/intentprobe-pypi-smoke
+/tmp/intentprobe-pypi-smoke/bin/python -m pip install --upgrade pip
+/tmp/intentprobe-pypi-smoke/bin/python -m pip install intentprobe
+/tmp/intentprobe-pypi-smoke/bin/intentprobe --help
+/tmp/intentprobe-pypi-smoke/bin/intentprobe doctor --pretty
+```
+
+After PyPI is live, publish npm and then update the root README to advertise
+the simpler `pipx install intentprobe` and `npx intentprobe ...` paths.

docs/RELEASE_CHECKLIST.md

@@ -85,13 +85,16 @@ cd "$sdist_src"/intentprobe-0.1.0
 python3 -m zipfile -l "$wheel_dist"/intentprobe-0.1.0-py3-none-any.whl | \
   rg 'probe_weights|metadata.json|targets.py|entry_points'
 python3 -m tarfile -l "$sdist_dist"/intentprobe-0.1.0.tar.gz | \
-  rg 'probe_weights|metadata.json|targets.py|SECURITY.md|SAMPLE_REPORTING|RELEASE_CHECKLIST|RUNTIME_HOOKS|OPERATOR_DECISIONS|EVIDENCE_PACKET|runtime_toy_agent'
+  rg 'probe_weights|metadata.json|targets.py|SECURITY.md|SAMPLE_REPORTING|RELEASE_CHECKLIST|RUNTIME_HOOKS|OPERATOR_DECISIONS|EVIDENCE_PACKET|PYPI_RELEASE|runtime_toy_agent'
 ```
 
 Build the release wheel from the freshly extracted sdist. The repo can have an
 ignored `build/` directory from setuptools, and direct local wheel builds may
 reuse stale `build/lib` contents.
 
+PyPI notes: [docs/PYPI_RELEASE.md](PYPI_RELEASE.md)
+npm notes: [docs/NPM_RELEASE.md](NPM_RELEASE.md)
+
 ## Hygiene
 
 ```bash