fix(release): preserve the monotonic sequence ledger

.github/workflows/release-bundle.yml

@@ -16,6 +16,10 @@ on:
           - canary
           - stable
           - frozen
+      release_sequence:
+        description: "Monotonic sequence greater than every previously accepted GDS release"
+        required: true
+        type: number
       minimum_cli_version:
         description: "Minimum compatible GDS CLI SemVer"
         required: true
@@ -66,7 +70,7 @@ jobs:
     env:
       GOTOOLCHAIN: go1.26.5
       VERSION: ${{ inputs.version }}
-      RELEASE_SEQUENCE: ${{ github.run_number }}
+      RELEASE_SEQUENCE: ${{ inputs.release_sequence }}
       CHANNEL: ${{ inputs.channel }}
       MINIMUM_CLI_VERSION: ${{ inputs.minimum_cli_version }}
       HARNESS_EVIDENCE_BUNDLE_BASE64: ${{ inputs.harness_evidence_bundle_base64 }}

CHANGELOG.md

@@ -37,6 +37,9 @@ Versioning.
   tool-managed interpreter.
 - The declared `gds-drakkars` plugin now has its canonical source manifest, so
   full and release validation cannot silently stop at a redirected JSON result.
+- Release sequence is an explicit monotonic dispatch input rather than the
+  repository-local workflow run number, preserving the accepted sequence ledger
+  across the public-authority migration.
 
 ## [0.1.1] - 2026-08-16
 

core/releasebuilder/workflow_contract_test.go

@@ -96,11 +96,15 @@ func TestHostedReleaseWorkflowUsesOutputOutsideSourceRoot(t *testing.T) {
 		`HARNESS_EVIDENCE_TRUST_POLICY_DIGEST: ${{ vars.HARNESS_EVIDENCE_TRUST_POLICY_DIGEST }}`,
 		`stable/frozen requires signed active-five harness evidence`,
 		`--harness-evidence-directory $EVIDENCE_INPUT_ROOT/records`,
+		`RELEASE_SEQUENCE: ${{ inputs.release_sequence }}`,
 	} {
 		if !strings.Contains(content, required) {
 			t.Fatalf("hosted workflow is missing output contract %q", required)
 		}
 	}
+	if strings.Contains(content, "RELEASE_SEQUENCE: ${{ github.run_number }}") {
+		t.Fatal("release sequence regressed to repository-local workflow run numbering")
+	}
 	if strings.Contains(content, `$GITHUB_WORKSPACE/$RELEASE_DIRECTORY`) {
 		t.Fatal("hosted workflow still writes release output beneath the source root")
 	}

docs/runbooks/release-lifecycle.md

@@ -36,6 +36,11 @@ proven:
 - the repository visibility and active GitHub plan support artifact
   attestations.
 
+The dispatch must provide an explicit `release_sequence` greater than every
+sequence already accepted in the consumer ledger. Repository transfer or
+republication never resets that ledger, and `github.run_number` is local to one
+workflow lineage, so it is not a release sequence.
+
 The whole release chain runs on GitHub-hosted runners. The consumer
 does not constrain the runner environment: `gh attestation verify` binds the
 attestation to this repository, this reusable-workflow path, this source commit