chore(release): 0.1.3

.github/workflows/release.yml

@@ -31,7 +31,7 @@ jobs:
           version="$GITHUB_REF_NAME"
           [[ "$version" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]
           [ "$(cat VERSION)" = "$version" ]
-          grep -Fxq "## [$version] - 2026-08-26" CHANGELOG.md
+          grep -q "^## \[$version\]" CHANGELOG.md
           git fetch --no-tags origin main
           git merge-base --is-ancestor "$GITHUB_SHA" origin/main
           printf 'version=%s\n' "$version" >>"$GITHUB_OUTPUT"

CHANGELOG.md

@@ -5,6 +5,8 @@ Versioning.
 
 ## [Unreleased]
 
+## [0.1.3] - 2026-09-15
+
 - Repair five contract-authorization workflows that compared an input with an
   unset authorization output before producing it. Execute regression tests
   against the actual shell blocks and use the verified output for every contract
@@ -16,6 +18,8 @@ Versioning.
 - Publish unsuccessful completed self-workflow attempts as unassigned,
   repository-local CI evidence; preserve actual conclusions and exact attempts.
 
+- Match the release changelog heading on version only, not a frozen 0.1.2 date.
+
 ## [0.1.2] - 2026-08-26
 
 ### Changed

VERSION

@@ -1 +1 @@
-0.1.2
+0.1.3

tests/test_release_tag_ruleset.py

@@ -29,3 +29,11 @@ def test_actual_release_refs_receive_immutable_tag_protection(self):
         for ref in ("refs/heads/0.1.2", "refs/tags/main", "refs/tags/preview/0.1.2", "refs/tags/v1"):
             with self.subTest(ref=ref):
                 self.assertFalse(any(matches(pattern, ref) for pattern in patterns))
+
+class ReleaseChangelogMatchTests(unittest.TestCase):
+    def test_resolve_matches_any_dated_heading_for_the_tag_version(self):
+        """A frozen 0.1.2 date in the grep made every later tag fail resolve."""
+        source = (ROOT / ".github/workflows/release.yml").read_text()
+        self.assertIn(r'grep -q "^## \[$version\]" CHANGELOG.md', source)
+        self.assertNotIn("2026-08-26", source.split("Validate exact release identity", 1)[1].split("git fetch", 1)[0])
+