diff --git a/documentation/history/2026-07-17.md b/documentation/history/2026-07-17.md
new file mode 100644
index 0000000..195e2ca
--- /dev/null
+++ b/documentation/history/2026-07-17.md
@@ -0,0 +1,5 @@
+# 2026-07-17
+
+## Release workflow: two-phase design so attestations bind to the tag commit
+
+Ported the fixed `release.yml` from obsidian-remarkable-sync (verbatim copy). The old shared workflow built and attested artifacts at the triggering commit, then created the version-bump commit and tag — so build-provenance attestations were bound to a different commit than the release tag, and the community-catalog review rejected releases ("attestation failed cryptographic verification"). The new workflow has a "prepare" job (dispatch on a branch: bump/changelog/commit/tag behind a `bun run build` + `bun test` gate, then re-dispatch at the tag with `publish=true`) and a "publish" job (dispatch-at-tag or bare tag push: build, attest without `continue-on-error`, create release at `github.sha` == tag commit). Design proven live on remarkable-sync 1.5.0. `scripts/release.sh` messaging updated to match; `bun test` kept in the gate (85 tests pass) and `docs/release-notes.md` kept in the release commit (generated by `scripts/generate-changelog.ts`).