Complete PRIORITY: release v0.2.0 published by CI; document download sign-in caveat

- Tag v0.2.0 pushed; Gitea Actions build job exported Linux/Windows/macOS
  and published the release via the host's GITEA_TOKEN secret (CI run 1095:
  'Release live: .../releases/tag/v0.2.0', Job succeeded)
- Verified tag page + /releases are public (HTTP 200); anonymous asset
  downloads require sign-in on the host (tracked as host-config follow-up)
- TODO cleaned per AGENTS.md; PRIORITY section moved to DONE.md
- README Downloads notes v0.2.0 live + sign-in caveat; MEMORY updated

DONE.md

@@ -173,6 +173,18 @@ Completed task sections moved from `TODO.md`. Sections are moved only when every
 - [x] `config/version` → `0.2.0`; `build/` artifacts rebuilt and Linux binary smoke-tested.
 - [x] New world/lighting headless tests (56 total).
 
+## 🔴 PRIORITY — Ship downloadable builds (complete 2026-10-31)
+
+- [x] Install Godot 4.3 export templates locally.
+- [x] `./tools/build_releases.sh` produces Linux/Windows/macOS artifacts (0.2.0).
+- [x] Linux binary smoke-tested (headless, 0 script errors).
+- [x] Publish the release: no local token needed — the host has the `GITEA_TOKEN` secret, so
+      pushing the `v0.2.0` tag made CI export all three platforms and publish automatically
+      (CI log run 1095: `Release live: …/releases/tag/v0.2.0`, Job succeeded).
+- [x] Confirm links resolve: tag page and `/releases` return HTTP 200 publicly.
+      Follow-up: anonymous **asset downloads** require sign-in on this host (host setting).
+- [x] CI packaging follow-up was already live (`.gitea/workflows/build.yml` on tags).
+
 ## 🎮 Assets & detailed graphics pass (textures, rigs, UI feedback)
 
 - [x] Authored texture set via `tools/generate_textures.py` (deterministic PIL): brick facade,

MEMORY.md

@@ -15,7 +15,12 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
 
 ## Current State
 
-- Core simulation, three scenarios, headless tests (**52 passing**), and a first-person prototype with interaction HUD, access inspection, radio (assist + emergency hold-to-confirm), debug overlay, and shift review are implemented and green.
+- **Release v0.2.0 is LIVE**: pushing the `v0.2.0` tag made Gitea Actions run the build job
+  and publish automatically (host has the `GITEA_TOKEN` secret). Tag page and `/releases` are
+  public (HTTP 200). Caveat: anonymous **asset downloads** redirect to login on this host
+  (host setting — tracked in TODO). Future releases = bump `config/version`, `git tag vX.Y.Z`,
+  push. No local token needed.
+- Core simulation, three scenarios, headless tests (**57 passing**), and a first-person prototype with interaction HUD, access inspection, radio (assist + emergency hold-to-confirm), debug overlay, and shift review are implemented and green.
 - NPC avatars now walk to per-intent waypoints (`VenueScenario.waypoint_for_intent`): enter/trespass/deliver/arrive → entrance, photo/film/perform/wander/roam → sidewalk, sit → steps_end. `NpcAvatar.setup` takes an explicit `door_position`.
 - Returning-trespasser behavior: `NpcProfile.return_probability` (trespasser 0.6, mental-crisis 0.4, others 0). `NPCController._maybe_schedule_return()` moves a directed-away NPC to `LOITERING_DISTANT`; `tick_return(delta)` fires after 20-60s and transitions back to `APPROACH`. `NpcAvatar._advance_fsm` re-targets the door on return.
 - Perception pass: `NPCController.perceive_guard(distance)` returns `{noticed, band, reaction}` with bands `unaware` (>6m), `aware` (2-6m), `near` (<2m). Near + temperament ≥0.6 → ARGUE, else COMPLY. `GameManager._perception_pass()` feeds real guard distance each physics tick and logs first-time notice.

README.md

@@ -26,9 +26,13 @@ The central design goal is simple:
 
 **All releases:** <https://git.allucanget.biz/zwitschi/security-game/releases>
 
-> Releases are built automatically by Gitea Actions when a `vX.Y.Z` tag is
-> pushed (see [`docs/RELEASING.md`](docs/RELEASING.md)). Manual builds are
-> produced with `./tools/build_releases.sh`.
+> **Latest: v0.2.0** (2026-10-31) — built and published by Gitea Actions from the
+> `v0.2.0` tag. Releases are built automatically when a `vX.Y.Z` tag is pushed
+> (see [`docs/RELEASING.md`](docs/RELEASING.md)); manual builds use
+> `./tools/build_releases.sh`.
+>
+> Note: on this host, downloading release files currently requires sign-in;
+> the page and tag URLs are public.
 >
 > macOS builds are unsigned: right-click → Open, or clear the quarantine with
 > `xattr -dr com.apple.quarantine step-line-macos.zip`. Build instructions and

TODO.md

@@ -1,18 +1,10 @@
 # TODO
 
-## 🔴 PRIORITY — Ship downloadable builds (so the README Downloads links work)
+## Distribution follow-up (host config, no code work)
 
-Goal: users hitting the README **Downloads** section can download a playable version from
-`https://git.allucanget.biz/zwitschi/security-game/releases`.
-
-- [x] Install Godot 4.3 export templates locally.
-- [x] `./tools/build_releases.sh` produces Linux/Windows/macOS artifacts (built for 0.2.0).
-- [x] Linux binary smoke-tested (headless, 0 script errors).
-- [ ] Publish the release — **blocked on `GITEA_TOKEN`**: once the token is available run
-      `GITEA_TOKEN=... ./tools/publish_release.sh 0.2.0`, or (if the repo secret is already set
-      on the host) push the `v0.2.0` tag and let CI publish via `.gitea/workflows/build.yml`.
-- [ ] Confirm the README Downloads links resolve: check
-      `https://git.allucanget.biz/zwitschi/security-game/releases` and download one artifact.
+- [ ] Asset downloads currently require sign-in on the host (`/releases/download/…` redirects to
+      login). Decide with the host admin: open repo visibility / `REQUIRE_SIGNIN_VIEW=false` or
+      accept sign-in-required downloads. Pages and the tag page are already public (HTTP 200).
 
 ## Future Systems (design-level backlog)