Cut Release Tag

Cut one signed annotated semver tag from a generated plan. Use the release scripts for tag writes. Use Run Maintainer E2E for maintainer-requested workflow dispatches. Do not improvise tag, push, version-bump, or other release-state GitHub writes.

Treat these as separate states:

• Tag can be cut: the release entry and required image checks pass. The maintainer chooses to proceed with the displayed documentation coverage and general E2E state. The release brief records both decisions and contains no unresolved prompts.
• Tag cut: the remote signed tag exists and peels to the planned candidate.
• Post-tag follow-through: after reporting the tag as cut, continue the same task. Monitor latest, release labels, public documentation, and release images. Draft the Announcement and report lkg state.

Hard Rules

• Use the requested version. Generate the plan with --version vX.Y.Z; never infer a bump.
• Tag only the candidate captured in the plan.
• By default, plan origin/main without an exception. For urgent QA qualification, a maintainer may select a historical ancestor with --candidate <full-sha> --exception <reason>.
• Require the release entry for a current-main plan. A historical plan records its explicit release-entry exception in the signed release brief.
• Treat documentation coverage as maintainer context, not a tag gate. Show the coverage point, later commits and PRs, review and check state, changed paths, and open managed docs PRs.
• Record the maintainer's documentation decision in the signed release brief.
• Require applicable GHCR base and managed-image publication evidence.
• Treat E2E as maintainer context, not a tag gate. Show the newest full E2E result and let the maintainer run focused tests, run the full suite, or proceed with the displayed status.
• Record every displayed or requested E2E result and the decision in the release brief, the signed Markdown release record. Record a plain-language exception reason when the status is exceptional or a requested run remains unresolved.
• Pass the final release brief to release:cut with --message-file. The file becomes the signed tag annotation; do not maintain another exception record.
• Ask the maintainer to paste the plan's full confirmation phrase before cutting.
• Push only the planned semver tag. Never push or move latest or lkg here.
• Report the tag as cut immediately after remote readback. This report is a progress checkpoint, not the final response.
• Continue the same task through post-tag follow-through. Do not make a post-tag result a tag gate.
• Ask before a workflow rerun. Never create a GitHub Discussion.
• Never move, delete, or replace an existing remote semver tag unless the maintainer starts a protected-tag remediation.
• Follow the release-train policy and the shared Git and GitHub Access Hard Stop.

Work to the requested outcome

• Prepare: follow Prepare the Release and its linked candidate evidence. Start independent read-only checks early and prepare authorized documentation during image waits. Keep the planned candidate immutable.
• Cut: after the final brief is reviewable and the required confirmation is supplied, follow Cut and Follow Through. Its tag readback establishes tag success.
• Follow through: continue the same task through automatic release workflows, the local Announcement draft, and lkg classification using the same reference.
• Recover: use Recovery for failed evidence or post-tag work. Retain the specific rerun authorization and immutable-tag boundaries.

The release confirmation protects a signed public tag. Do not apply that confirmation requirement to preliminary reads or already-authorized preparation. Report tag success as a progress checkpoint; report final completion only after the follow-through conditions are classified.