Make the README read as of a release

README.md

@@ -10,7 +10,7 @@
 
 <p align="center">
   <a href="https://github.com/alethic/weft/actions/workflows/weft.yml"><img src="https://github.com/alethic/weft/actions/workflows/weft.yml/badge.svg?branch=main" alt="CI"></a>
-  <a href="https://github.com/alethic/weft/releases"><img src="https://img.shields.io/github/v/release/alethic/weft?include_prereleases&sort=semver" alt="Release"></a>
+  <a href="https://github.com/alethic/weft/releases"><img src="https://img.shields.io/github/v/release/alethic/weft?sort=semver" alt="Latest release"></a>
   <a href="LICENSE"><img src="https://img.shields.io/github/license/alethic/weft" alt="License"></a>
 </p>
 
@@ -113,13 +113,20 @@ helm install weft oci://ghcr.io/alethic/charts/weft \
   --namespace weft-system --create-namespace
 ```
 
-Pin a version with `--version` for anything you care about. Builds of `main`
-are also published as prereleases; add `--devel` to install the newest one.
+That installs the latest release. Add `--version` with a version from the
+[releases page](https://github.com/alethic/weft/releases) to pin one, which is
+what you want anywhere you care about repeatability.
 
-The controller image (`ghcr.io/alethic/weft`) and the chart are both signed
-with [cosign](https://github.com/sigstore/cosign), keyless. Each
-[release](https://github.com/alethic/weft/releases) lists the image digest and
-the command to verify it. A released chart pins the image by digest.
+Each chart pins the controller image (`ghcr.io/alethic/weft`) by digest, so an
+installed release cannot drift under a moved tag. The image and the chart are
+both signed with [cosign](https://github.com/sigstore/cosign), keyless, and
+each release lists the image digest. To verify an image before you run it:
+
+```bash
+cosign verify ghcr.io/alethic/weft@<digest> \
+  --certificate-identity-regexp '^https://github.com/alethic/weft/' \
+  --certificate-oidc-issuer https://token.actions.githubusercontent.com
+```
 
 Every chart value is documented in [charts/weft/README.md](charts/weft/README.md),
 including hardening options such as confining impersonation to a set of
@@ -188,26 +195,9 @@ workloads.
 | [Operating Weft](docs/operating.md) | status conditions, pruning, teardown, controller flags, metrics, uninstalling |
 | [Design and alternatives](docs/design.md) | how Weft compares with kro, Crossplane, Flux and Kyverno; why Starlark; non-goals |
 | [Helm chart](charts/weft/README.md) | installation, every value, common configurations |
-| [Moving from weft.run](docs/migrating.md) | for installations that predate `weft.alethic.solutions/v1` |
+| [Moving from weft.run](docs/migrating.md) | for installations that use the older `weft.run` API group |
 | [Security](SECURITY.md) | threat model, hardening, reporting a vulnerability |
 
-## Project status
-
-The API is `weft.alethic.solutions/v1`. Weft itself is pre-1.0, so the
-controller, the chart and their defaults may still change between minor
-releases. Every such change is called out in the release notes.
-
-Weft was first deployed under the API group `weft.run/v1alpha1`. That group is
-still served alongside v1, with the same schema, so existing installations
-upgrade without changing anything and can move their Weaves to v1 one at a
-time. [docs/migrating.md](docs/migrating.md) explains how. Both groups are
-served until a future release removes `weft.run`.
-
-CI runs the reconcile loop against a real API server on Kubernetes 1.27 (the
-minimum supported), 1.33 and 1.37, alongside unit tests of the evaluator and
-planner, rendering tests of the Helm chart, and a check that every shipped
-example evaluates.
-
 ## Contributing
 
 Issues and pull requests are welcome. [CONTRIBUTING.md](CONTRIBUTING.md) covers

charts/weft/README.md

@@ -15,16 +15,17 @@ helm install weft oci://ghcr.io/alethic/charts/weft \
 ```
 
 The chart lives in GitHub Packages as an OCI artifact. Without `--version`,
-Helm resolves the newest release; pin an exact `--version` for anything you
-care about. Every build of `main` is also published as a prerelease
-(`0.1.1-pre.3` and so on), which Helm only considers with `--devel`.
+Helm installs the latest release; pin an exact `--version` from the
+[releases page](https://github.com/alethic/weft/releases) for anything you
+care about. Builds of `main` between releases are published as prereleases, which Helm
+only considers with `--devel`.
 
 ```bash
 helm show chart oci://ghcr.io/alethic/charts/weft
 ```
 
 The chart's `appVersion` selects the image tag, so a chart and the controller it
-installs always carry the same version. A released chart additionally pins
+installs always carry the same version. A published chart additionally pins
 the image by digest, so it cannot drift under a moved tag. That digest ships in
 the chart itself rather than in its values, so `helm upgrade --reuse-values`
 still moves you to the new release's image.