diff --git a/TODO.md b/TODO.md
index 01e8bb8..756fbdc 100644
--- a/TODO.md
+++ b/TODO.md
@@ -25,8 +25,8 @@
   credentials, including idempotency and conservative uninstall checks.
 - [x] Perform and record a pre-release manual security review of installer paths,
   file ownership, configuration edits, and failure limitations.
-- [ ] Publish the `0.1.0-rc.1` tarball as a repository pre-release and verify the
-  direct installation URL from a clean project.
+- [x] Publish the `0.1.0-rc.1` tarball and SHA-256 as a repository pre-release;
+  install from its public URL in a clean project and verify the checksum.
 - [ ] Add provider-backed verification after confirming credentials and model
   usage budget with the user.
 - [ ] Decide whether to publish the package to npm; repository pre-releases do
diff --git a/docs/IMPLEMENTATION-PLAN.md b/docs/IMPLEMENTATION-PLAN.md
index e2ae7d2..a75caca 100644
--- a/docs/IMPLEMENTATION-PLAN.md
+++ b/docs/IMPLEMENTATION-PLAN.md
@@ -139,7 +139,7 @@ provider-backed agent delegation and skill behavior remain unverified.
 runtime; config collisions are handled or reported before writes; the V2 plugin
 and its custom tool are confirmed active.
 
-### Phase 5 — Document and release (repository pre-release in progress)
+### Phase 5 — Document and release (repository pre-release published)
 
 - Document scope, installation, update/uninstall, compatibility, provenance,
   and known limitations.
@@ -151,9 +151,10 @@ pre-release tarball, as well as updating and uninstalling. A manual pre-release
 review of installer paths, ownership, JSONC edits, symlinks, and failure behavior
 found no release blocker for trusted project-local use; filesystem and
 provider-backed limitations are recorded in [`SECURITY-REVIEW.md`](SECURITY-REVIEW.md).
-Typecheck, all 16 tests, coverage (87.4% lines), and package dry-run passed.
-The `0.1.0-rc.1` tarball and repository release still need publication and a
-clean-project install check.
+Typecheck, all 16 tests, coverage (87.4% lines), and package build passed. The
+`v0.1.0-rc.1` pre-release and SHA-256 sidecar are published. A clean project
+installed the package using the public release URL, and the downloaded tarball
+matched its recorded SHA-256.
 
 **Acceptance:** another user can install from documented instructions and
 verify the deterministic behavior without credentials.