# Forge 4.0.1

Matched patch release for Anvil, Anvil Administration, Hammer, Connect, and their
setup programs. Supersedes the workspace-discovery correction previously packaged
as 4.0.0 RC.3. The original 4.0.0 and RC.3 artifacts must remain distinguishable
by immutable versioned download paths and hashes.

## Included correction

- Evidence-backed workspace discovery executes fixed read-only Git probes through
  the assigned, approved, online Spark against a real Git workspace with committed HEAD.
- Authorized Directors/Administrators can use Hammer's VERIFY WORKSPACE action
  or Connect's `forge_connect_verify_workspace` before opening the engineer.
- Mock, pending, deferred, fabricated and incomplete discovery remain unverified.
- Signed discovery evidence and previous discovery history are retained. Failed
  re-verification and changed workspace bindings remain fail-closed.
- Permanent knowledge reconstruction remains bounded; detailed evidence is loaded
  on demand. Authority revocations/removals apply on refresh.

## Installation

Use the matched 4.0.1 installers:

- forge-anvil-setup.exe
- forge-hammer-setup.exe
- forge-connect-setup.exe

Verify the downloaded SHA-256 against the 4.0.1 checksum file before installing.
Installer and runtime file versions must be 4.0.1.0; Connect's plugin manifest and
MCP initialization must report 4.0.1. Start a fresh Codex chat after installing
Connect so the application loads the newly installed tools.

Back up the Anvil database, configuration, encrypted Secrets directory and required
certificate/private-key recovery material using the supported backup procedure
before a runtime upgrade. Keep previous signed installers for rollback.

Spark is not repackaged by this three-product release. Discovery requires an
approved execution-capable Spark; SSH-only and non-Git discovery are not included.
Authenticated Spark host/runtime advertisements are not independent OS attestation.

## Release discipline

Changed publicly released binaries require a new release number. Do not rebuild
or overwrite a published versioned artifact. Standard-name aliases may advance
only to the entire matched, verified release set. A version string alone is not
proof of installed payload identity: retain and verify the release hashes.

Controlled acceptance is not acceptance of any external customer environment.
Publishing downloads does not authorize installing production runtimes or changing
customer records. Internal source snapshots, rollback archives, fixture databases
and acceptance evidence must not be copied into the public download directory.