diff --git a/docs/plans/AUTHS_PUBLIC_NAMING_MIGRATION.md b/docs/plans/AUTHS_PUBLIC_NAMING_MIGRATION.md
new file mode 100644
index 0000000..da62527
--- /dev/null
+++ b/docs/plans/AUTHS_PUBLIC_NAMING_MIGRATION.md
@@ -0,0 +1,144 @@
+# Auths public naming migration
+
+## Status
+
+Execution plan and human-readable interpretation of
+[AP-SPEC-034](../specs/0034-auths-public-naming-consolidation.md). The sole
+machine-readable naming authority is
+[`release/public-naming.toml`](../../release/public-naming.toml).
+
+This plan does not authorize publication, package deletion or yanking, owner
+changes, an RC tag, a repository rename or archive, deployment, or DNS work.
+
+## Outcome
+
+Users should encounter one product:
+
+```text
+Auths
+├── Rust core: auths
+│   └── proof component: auths-proof
+├── Rust SDK: auths-sdk
+├── JavaScript/TypeScript SDK: @auths-dev/sdk
+├── Python SDK: auths
+├── website: auths.dev
+└── first RC: auths-v1.0.0-rc.1
+```
+
+“Proof” remains useful vocabulary. It describes the portable proof format,
+deterministic verifier boundary, proof exchange, and their implementation
+packages. It no longer competes with Auths as the product name.
+
+## Registry snapshot
+
+The registry snapshot was taken on 2026-07-31 from the official crates.io,
+npm, and PyPI APIs.
+
+- The crates.io owner index for user ID `345389` contains 33 `auths` or
+  `auths-*` packages attributable to `auths-dev/auths`, including
+  repository-less `auths-utils`.
+- Every one of those crates lists `bordumb` as its named owner.
+- `auths`, `auths-sdk`, and `auths-verifier` are already owned coordinates at
+  version `0.1.16`.
+- `@auths-dev/sdk` exists on npm at version `0.1.16` and points to the
+  predecessor repository. `@auths-dev/proof` returns 404.
+- `auths` exists on PyPI at version `0.1.16` and points to the predecessor
+  repository. `auths-proof` returns 404.
+- All visible reverse dependencies of the predecessor crates are other
+  predecessor `auths-*` packages. No non-predecessor registry reverse
+  dependency was observed.
+
+That last observation narrows migration risk; it does not prove there are no
+external users. Registry download totals are nonzero and can include CI,
+mirrors, dependency builds, and direct downloads. Git, path, vendored, copied,
+or unpublished use is not visible in the reverse-dependency API.
+
+## Disposition summary
+
+| Disposition | Count | Coordinates |
+| --- | ---: | --- |
+| Continue | 4 | `auths`, `auths-sdk`, `auths-verifier`, `auths-receipts` |
+| Replace | 10 | `auths-core`, `auths-crypto`, `auths-evidence`, `auths-id`, `auths-index`, `auths-keri`, `auths-mcp-core`, `auths-policy`, `auths-rp`, `auths-storage` |
+| Retire | 19 | All other predecessor coordinates in the authoritative inventory |
+| Delete and reclaim | 0 | None |
+
+Continue does not mean source compatibility. Each continued coordinate crosses
+from the experimental `0.1.x` predecessor to the current architecture through
+an intentional `1.0.0-rc` major transition.
+
+Replace means the old package encoded a boundary the current architecture
+intentionally split. Examples include:
+
+- `auths-crypto` becoming suite and adapter boundaries such as
+  `auths-signature`, `auths-multikey`, and `auths-raw-key`;
+- `auths-id` becoming identity-method adapters and custody boundaries;
+- `auths-keri` becoming the optional `auths-did-keri` adapter;
+- `auths-policy` becoming the pure authority/composition packages plus the
+  separately bounded policy layer; and
+- `auths-storage` becoming custody and explicitly stateful store boundaries.
+
+Retire means no first-RC package adopts the old coordinate. It does not release
+the name or authorize a deprecation upload.
+
+## Why deletion is off the table
+
+Every predecessor coordinate has published bytes. The official Cargo
+publishing documentation states that publication is permanent: versions
+cannot be overwritten and code cannot be deleted. Yanking only prevents new
+resolution in some circumstances; it does not delete the archive or free the
+crate name.
+
+The safe policy is therefore to retain custody. There is no deletion/reclaim
+sequence to approve, and issue 54 authorizes no yank.
+
+## New Rust publication order
+
+The new core facade increases the expected crates.io closure from 27 to 28
+packages. The inventory records nine topological tiers:
+
+1. leaf model/algebra/multikey/exchange-model packages;
+2. assurance, codec, composition, ports, and exchange port;
+3. authority, identity adapters, raw key, receipts, registries, and signature;
+4. author and verifier;
+5. custody, proof component, and base profile API;
+6. configuration and composed profiles;
+7. operations;
+8. runtime; and
+9. the public `auths` and `auths-sdk` roots.
+
+Hosted CI must derive the edges from the candidate manifests. The checked-in
+tiers are a contract, not a substitute for dependency validation. An edge from
+a lower-numbered tier to a higher-numbered tier is a terminal error.
+
+## Migration sequence
+
+| Unit | Repository effect | External effect |
+| --- | --- | --- |
+| `AP34-PR1` | Naming authority, registry evidence, spec and governing amendments | None |
+| `AP34-PR2` | `auths` facade, `auths-sdk`, Cargo graph and Rust examples | None |
+| `AP34-PR3` | npm/Python metadata, imports, current docs and canonical links | None |
+| `AP34-PR4` | Release identity, semantic freeze and adversarial stale-name CI | None |
+| `AP34-PR5` | Accurate predecessor notice and migration/deferral ledger | No archive, rename, yank, or publication |
+| `AP34-PR6` | Align the repository that owns `auths.dev` content | No DNS or deployment without separate approval |
+
+AP-SPEC-032 release-evidence work resumes only after all six units and their
+hosted gates are complete. Its preserved draft must be rebased onto the new
+package catalogue and must regenerate every artifact identity rather than
+editing previously generated evidence by hand.
+
+## Remaining external facts
+
+The following are real gates, not repository-local checkboxes:
+
+- `auths.dev` currently contains predecessor-era package and GitHub links. Its
+  content owner must adopt this inventory before the site can be release
+  evidence for the current implementation.
+- The old repository needs an accurate notice. Calling it wholly unpublished
+  would be false because its `0.1.x` registry packages exist.
+- Registry publication permission for the target `1.0.0-rc` packages is not
+  granted. Custody evidence is not publication authorization.
+- Repository rename and archive decisions remain open and must not be smuggled
+  into naming cleanup.
+
+Until those facts change with evidence, the first-RC naming gate remains
+closed.
diff --git a/docs/plans/GO_TO_MARKET_STRATEGY.md b/docs/plans/GO_TO_MARKET_STRATEGY.md
index 4ad8124..cf18b03 100644
--- a/docs/plans/GO_TO_MARKET_STRATEGY.md
+++ b/docs/plans/GO_TO_MARKET_STRATEGY.md
@@ -422,6 +422,15 @@ Restricted integrations:               =========>
 Customer-operated pilots:                            ===========>
 ```
 
+### Phase 7 prerequisite: one Auths identity
+
+[Specification: AP-SPEC-034, Auths public naming
+consolidation](../specs/0034-auths-public-naming-consolidation.md)
+
+Before release artifacts are frozen, align the product, package, documentation,
+predecessor, website, and release identities under Auths. The proof protocol
+remains an explicit component boundary; it is not a competing product name.
+
 ### Phases 7–8: reproducible candidate and exact claim
 
 [Specification: AP-SPEC-032, Reproducible release candidate and exact
@@ -597,11 +606,11 @@ When using this document to plan or implement work:
 11. Stop at each phase gate and record what was learned before widening
     scope.
 
-The immediate execution program is AP-SPEC-032: record its owner decisions,
-produce the reproducible release candidate, and publish the exact claim bundle.
-AP-SPEC-033 independent review follows. AP-SPEC-027 and AP-SPEC-028 remain
-blocked until that review gate permits the explicitly labeled Phase 10
-developer preview.
+The immediate execution program is AP-SPEC-034 followed by the remaining
+AP-SPEC-032 work: establish one Auths identity, produce the reproducible release
+candidate, and publish the exact claim bundle. AP-SPEC-033 independent review
+follows. AP-SPEC-027 and AP-SPEC-028 remain blocked until that review gate
+permits the explicitly labeled Phase 10 developer preview.
 
 ## Related architecture
 
diff --git a/docs/plans/PHASE_7_OWNER_DECISION_GUIDE.md b/docs/plans/PHASE_7_OWNER_DECISION_GUIDE.md
index cdf21a4..2b54e4e 100644
--- a/docs/plans/PHASE_7_OWNER_DECISION_GUIDE.md
+++ b/docs/plans/PHASE_7_OWNER_DECISION_GUIDE.md
@@ -1,5 +1,11 @@
 # Phase 7 owner decision guide
 
+> **Historical decision aid:** this guide predates the owner's issue 54 naming
+> decision. Package and tag alternatives recorded here are not current
+> recommendations. `P7-OD-012`, AP-SPEC-034, and
+> [`release/public-naming.toml`](../../release/public-naming.toml) govern the
+> Auths coordinates.
+
 ## Purpose
 
 This guide explains the choices in the
diff --git a/docs/plans/PHASE_7_RELEASE_OWNER_DECISIONS.md b/docs/plans/PHASE_7_RELEASE_OWNER_DECISIONS.md
index 5b58565..7ff5df9 100644
--- a/docs/plans/PHASE_7_RELEASE_OWNER_DECISIONS.md
+++ b/docs/plans/PHASE_7_RELEASE_OWNER_DECISIONS.md
@@ -2,7 +2,7 @@
 
 ## Status
 
-All 11 decisions were approved by the repository owner on 2026-07-31. This
+All 12 decisions were approved by the repository owner on 2026-07-31. This
 document records policy approval only. It does not authorize an artifact
 publication, RC tag, package upload, claim publication, repository-setting
 change, secret upload, or external-review engagement.
@@ -16,6 +16,12 @@ The read-only
 [Phase 7 release readiness audit](PHASE_7_RELEASE_READINESS_AUDIT.md) maps each
 decision to the current repository and the implementation it blocks.
 
+[AP-SPEC-034](../specs/0034-auths-public-naming-consolidation.md) and
+[issue 54](https://github.com/auths-dev/auths-proof/issues/54) supersede the
+public-coordinate portion of `P7-OD-003` and all of `P7-OD-007`. Their original
+text remains below as decision history; `P7-OD-012` is the governing public
+naming record.
+
 The
 [Phase 7 owner decision guide](PHASE_7_OWNER_DECISION_GUIDE.md) explains the
 available choices and their tradeoffs without approving them.
@@ -32,15 +38,16 @@ or represent the Phase 7 entry gate as passed.
 | --- | --- | --- | --- | --- |
 | `P7-OD-001` | Release license | Keep `MIT OR Apache-2.0` through v1 | Exact license expression approved for RC package and release metadata | approved |
 | `P7-OD-002` | Inbound contribution policy | Choose DCO or CLA with counsel | Selected policy, responsible owner, and effective date | approved |
-| `P7-OD-003` | Artifact catalogue | Source archive, publishable crates, maintained bindings, WASM/native artifacts, assurance bundle | Exact in-scope and excluded release subjects | approved |
+| `P7-OD-003` | Artifact catalogue | Source archive, publishable crates, maintained bindings, WASM/native artifacts, assurance bundle | Exact in-scope and excluded release subjects | approved; coordinates amended by `P7-OD-012` |
 | `P7-OD-004` | Registry publication | Prepare all approved subjects; publish only to explicitly approved registries | Registry list and whether the first RC is staged, private, or public in each | approved |
 | `P7-OD-005` | Supply-chain target | SLSA Build L3 for the first RC | Approved target and any explicitly accepted limitation | approved |
 | `P7-OD-006` | SBOM baseline | SPDX JSON; retain CycloneDX only as additional evidence | Required SPDX version/profile and optional secondary formats | approved |
-| `P7-OD-007` | Tag convention | One immutable semver-compatible RC form | Exact tag pattern and initial ordinal policy | approved |
+| `P7-OD-007` | Tag convention | One immutable semver-compatible RC form | Exact tag pattern and initial ordinal policy | superseded by `P7-OD-012` |
 | `P7-OD-008` | Release approvers | At least one named human approver distinct from build identity | Named approver or approver role and protected-environment rule | approved |
 | `P7-OD-009` | Signing identity | GitHub artifact attestation backed by public Sigstore | Exact issuer, subject, workflow identity, and verification policy | approved |
 | `P7-OD-010` | Public claim approver | Named technical owner | Approver identity or role and approval-record location | approved |
 | `P7-OD-011` | Vulnerability and CRA ownership | Name a security contact and obtain counsel review when external EU distribution is in scope | Security contact, disclosure owner, distribution scope, and counsel decision or explicit not-yet-in-scope record | approved interim policy |
+| `P7-OD-012` | Public Auths identity | One Auths product identity across package coordinates, tags, artifacts, documentation, and the predecessor transition | Exact public map and first-RC identity | approved; execution blocked on AP-SPEC-034 |
 
 ## Approved records
 
@@ -73,6 +80,10 @@ conditions:
 
 ### `P7-OD-003`
 
+> **Historical coordinate record:** the catalogue-shape decision remains
+> approved, but the package names in this block were superseded by
+> `P7-OD-012` before publication or RC tagging.
+
 ```yaml
 decision_id: P7-OD-003
 status: approved
@@ -134,6 +145,9 @@ conditions:
 
 ### `P7-OD-007`
 
+> **Superseded:** no tag using this pattern was created. `P7-OD-012` replaces
+> it with `auths-v<semver>-rc.<positive-ordinal>`.
+
 ```yaml
 decision_id: P7-OD-007
 status: approved
@@ -206,6 +220,25 @@ conditions:
   - "The first RC is technical prerelease evidence, not a general-availability product."
 ```
 
+### `P7-OD-012`
+
+```yaml
+decision_id: P7-OD-012
+status: approved
+decision: "Present the product as Auths. Use auths and auths-sdk on crates.io, @auths-dev/sdk on npm, auths on PyPI, and immutable tags matching auths-v<semver>-rc.<positive-ordinal>, beginning with auths-v1.0.0-rc.1. Retain auths-proof only for accurate proof-specific components and temporary repository identity."
+owner: repository-owner
+decided_at: 2026-07-31
+evidence_or_advice:
+  - "https://github.com/auths-dev/auths-proof/issues/54"
+  - "../../release/public-naming.toml"
+conditions:
+  - "AP-SPEC-034 is a hard gate before remaining AP-SPEC-032 release artifact, metadata, provenance, or tag-contract freeze work."
+  - "The auths crate is a thin consumer core facade over the bounded auths-proof component; the facade must not absorb provider or runtime behavior."
+  - "The predecessor 0.1.x coordinates are an intentional major-version transition, not a source-compatibility promise."
+  - "No deletion, yank, publication, owner change, repository rename, repository archive, tag, deployment, or DNS action is authorized by this record."
+  - "Registry custody, publication order, current documentation, predecessor notice, external website content, and hosted stale-name checks must pass before AP-SPEC-032 release evidence resumes."
+```
+
 ## Auths-native release authorization boundary
 
 Auths MAY produce a separate authorization proof and receipt for the exact
diff --git a/docs/plans/PHASE_7_RELEASE_READINESS_AUDIT.md b/docs/plans/PHASE_7_RELEASE_READINESS_AUDIT.md
index dcf4a0a..a01e6c6 100644
--- a/docs/plans/PHASE_7_RELEASE_READINESS_AUDIT.md
+++ b/docs/plans/PHASE_7_RELEASE_READINESS_AUDIT.md
@@ -6,6 +6,14 @@ Read-only repository audit for AP-SPEC-032. This document records current
 implementation facts and gaps; it does not approve owner decisions or
 authorize release changes.
 
+> **Historical baseline:** this audit predates issue 54 and AP-SPEC-034. Its
+> `auths-proof-sdk`, `@auths-dev/proof`, PyPI `auths-proof`, and
+> `auths-proof-v*` references describe the reviewed baseline and the now-
+> superseded owner decision. The governing targets are in
+> [`release/public-naming.toml`](../../release/public-naming.toml): `auths`,
+> `auths-sdk`, `@auths-dev/sdk`, PyPI `auths`, and
+> `auths-v1.0.0-rc.1`.
+
 The code and workflow baseline reviewed was `main` at `6f8df76`. The audit was
 prepared on the documentation-only specification branch. That branch does not
 change release behavior.
diff --git a/docs/specs/0032-reproducible-release-candidate-and-exact-assurance-claim.md b/docs/specs/0032-reproducible-release-candidate-and-exact-assurance-claim.md
index edd2d37..f4d5496 100644
--- a/docs/specs/0032-reproducible-release-candidate-and-exact-assurance-claim.md
+++ b/docs/specs/0032-reproducible-release-candidate-and-exact-assurance-claim.md
@@ -1,8 +1,8 @@
 # AP-SPEC-032: Reproducible release candidate and exact assurance claim
 
-**Status:** Specified — owner-decision subgate approved; execution still
-requires the remaining Phase 7 entry evidence and separate Phase 7 and Phase 8
-pull requests
+**Status:** Specified — owner-decision subgate approved; remaining execution is
+blocked on AP-SPEC-034 public naming consolidation, the remaining Phase 7 entry
+evidence, and separate Phase 7 and Phase 8 pull requests
 
 **Governs:** Phase 7 and Phase 8 of the
 [Post-Milestone 6 Productization and Release Plan](../target-state/POST_MILESTONE_6_PRODUCTIZATION_AND_RELEASE_PLAN.md)
@@ -10,7 +10,8 @@ pull requests
 **Aligned with:** [Post-Milestone-6 Technical and Go-to-Market
 Alignment](../plans/POST_MILESTONE_6_TECHNICAL_AND_GO_TO_MARKET_ALIGNMENT.md)
 
-**Depends on:** AP-SPEC-0011, AP-SPEC-0025, AP-SPEC-0026, the completed
+**Depends on:** AP-SPEC-0011, AP-SPEC-0025, AP-SPEC-0026,
+[AP-SPEC-034](0034-auths-public-naming-consolidation.md), the completed
 Milestone 6 baseline on `main`, the formal assurance manifest, canonical
 fixtures, conformance inventories, benchmark evidence, and the existing
 release-check machinery
@@ -143,6 +144,13 @@ The current decision state is maintained in the
 [Phase 7 release owner decision register](../plans/PHASE_7_RELEASE_OWNER_DECISIONS.md).
 An unresolved recommendation in that register is not approval.
 
+[AP-SPEC-034](0034-auths-public-naming-consolidation.md) supersedes the public
+coordinates previously selected in `P7-OD-003` and `P7-OD-007`. Remaining
+release implementation MUST use
+[`release/public-naming.toml`](../../release/public-naming.toml) and MUST NOT
+freeze an artifact or metadata graph using `auths-proof-sdk`,
+`@auths-dev/proof`, PyPI `auths-proof`, or an `auths-proof-v*` RC tag.
+
 | Decision | Recommended default | Required before |
 | --- | --- | --- |
 | Release license | Keep `MIT OR Apache-2.0` through v1 | Freezing package and release metadata |
@@ -159,6 +167,9 @@ An unresolved recommendation in that register is not approval.
 
 The entry revision MUST also satisfy:
 
+- AP-SPEC-034's exit gate has passed, including registry custody, package
+  publication order, current documentation, predecessor notice, external
+  website alignment, and hosted stale-name enforcement;
 - Milestones 0 through 6 are complete on `main`;
 - no open branch contains a required semantic or evidence fix;
 - all required checks on the candidate revision are terminal and successful;
@@ -591,6 +602,8 @@ large pull request.
 
 The minimum boundaries are:
 
+0. **AP-SPEC-034 naming PRs.** Complete every bounded naming, predecessor, and
+   external-content unit before release metadata or artifacts are frozen.
 1. **Decision and specification PR.** Record owner decisions, this
    specification, schemas, and the execution plan. No release implementation.
 2. **Semantic-freeze PR.** Add the freeze inventory and drift enforcement.
@@ -620,16 +633,19 @@ behavior. Provider/domain behavior MUST remain profile- or domain-owned.
 ## 15. Delivery order
 
 1. Record the owner decisions in Section 5.
-2. Freeze the semantic and artifact schemas.
-3. Implement and validate the semantic-freeze inventory.
-4. Upgrade release evidence to the approved SBOM and provenance contract.
-5. Implement clean preparation and no-rebuild promotion.
-6. Run two isolated preparations and close reproducibility gaps.
-7. Merge the final candidate revision after all checks pass.
-8. Promote the immutable RC tag and publish its evidence bundle.
-9. Build the exact claim registry against those immutable subjects.
-10. Publish and synchronize the human-readable assurance statement.
-11. Submit the fixed candidate and claim bundle to Phase 9 independent review.
+2. Complete AP-SPEC-034 and reconcile every release input to the Auths naming
+   inventory.
+3. Freeze the semantic and artifact schemas.
+4. Implement and validate the semantic-freeze inventory.
+5. Upgrade release evidence to the approved SBOM and provenance contract.
+6. Implement clean preparation and no-rebuild promotion.
+7. Run two isolated preparations and close reproducibility gaps.
+8. Merge the final candidate revision after all checks pass.
+9. Promote the immutable `auths-v1.0.0-rc.1` tag and publish its evidence
+   bundle only after separate exact-manifest authorization.
+10. Build the exact claim registry against those immutable subjects.
+11. Publish and synchronize the human-readable assurance statement.
+12. Submit the fixed candidate and claim bundle to Phase 9 independent review.
 
 ## 16. Completion and handoff
 
diff --git a/docs/specs/0033-independent-review-and-remediation-gate.md b/docs/specs/0033-independent-review-and-remediation-gate.md
index c362ae0..585865f 100644
--- a/docs/specs/0033-independent-review-and-remediation-gate.md
+++ b/docs/specs/0033-independent-review-and-remediation-gate.md
@@ -10,6 +10,7 @@ completed both exit gates
 Alignment](../plans/POST_MILESTONE_6_TECHNICAL_AND_GO_TO_MARKET_ALIGNMENT.md)
 
 **Depends on:** [AP-SPEC-032](0032-reproducible-release-candidate-and-exact-assurance-claim.md),
+[AP-SPEC-034](0034-auths-public-naming-consolidation.md),
 one immutable and non-withdrawn release candidate, its exact assurance-claim
 bundle, and approved review ownership, budget, disclosure, and severity policy
 
@@ -276,7 +277,7 @@ and renders review status without editing findings:
 
 ```text
 +------------------------------------------------------------------+
-| Auths Phase 9 review · auths-proof-v1.0.0-rc.N                   |
+| Auths Phase 9 review · auths-v1.0.0-rc.N                         |
 +------------------------------------------------------------------+
 | Packet      verified · commit 8f62... · manifest 14ac...        |
 | Formal      complete · findings 0C 1H 3M 2L                     |
@@ -304,7 +305,7 @@ track: rust-protocol-security
 severity: high
 title: bounded non-sensitive title
 status: open
-rc_tag: auths-proof-v1.0.0-rc.N
+rc_tag: auths-v1.0.0-rc.N
 subject_digests:
   - sha256:...
 source_locations:
diff --git a/docs/specs/0034-auths-public-naming-consolidation.md b/docs/specs/0034-auths-public-naming-consolidation.md
new file mode 100644
index 0000000..73e5e51
--- /dev/null
+++ b/docs/specs/0034-auths-public-naming-consolidation.md
@@ -0,0 +1,382 @@
+# AP-SPEC-034: Auths public naming consolidation
+
+**Status:** Specified — the owner-approved target map in issue 54 blocks all
+remaining AP-SPEC-032 artifact and metadata freeze work until the repository,
+registry, predecessor, and external-content gates below are satisfied
+
+**Governs:** The naming prerequisite inserted before the remaining Phase 7
+release-candidate work in AP-SPEC-032
+
+**Authority:** [Issue 54](https://github.com/auths-dev/auths-proof/issues/54)
+and the checked-in
+[`release/public-naming.toml`](../../release/public-naming.toml) inventory
+
+**Depends on:** The merged AP-SPEC-032 semantic-freeze implementation, the
+Phase 7 owner decision register, registry custody evidence, and the current
+prelaunch workspace
+
+**Scope:** One coherent Auths product identity across public packages,
+documentation, examples, workflows, release artifacts, provenance, generated
+documentation, deployment references, and predecessor-project disposition
+
+**Normative language:** **MUST**, **MUST NOT**, **SHOULD**, and **MAY** are
+requirements on conforming repository and release work.
+
+## 1. Decision
+
+The public project and product are **Auths**. “Proof” names the bounded proof
+protocol and related implementation components where that is technically
+accurate; it is not the umbrella product name.
+
+The first-RC public coordinates are:
+
+| Surface | Coordinate |
+| --- | --- |
+| Product | **Auths** |
+| Website | `https://auths.dev` |
+| Rust core facade | `auths` |
+| Rust SDK | `auths-sdk` |
+| JavaScript/TypeScript SDK | `@auths-dev/sdk` |
+| Python distribution and import root | `auths` |
+| Proof-protocol component | `auths-proof` |
+| First RC tag | `auths-v1.0.0-rc.1` |
+
+The current `auths-dev/auths-proof` repository coordinate MAY remain until a
+separate repository-rename migration is approved. A literal repository name
+inside a GitHub attestation subject is identity evidence, not permission to
+present “Auths Proof” as the product.
+
+This decision supersedes the public-coordinate portions of `P7-OD-003` and all
+of `P7-OD-007`. It does not change the lean SDK-first catalogue, the
+prepare-before-publish decision, or any publication authorization boundary.
+
+## 2. Why this blocks release evidence
+
+AP-SPEC-032 binds package names, subjects, artifact filenames, tags,
+attestations, SBOM relationships, checksums, and documentation to one release
+manifest. Freezing those fields under the abandoned coordinates would turn a
+prelaunch correction into a compatibility migration across every registry and
+assurance artifact.
+
+Therefore:
+
+```text
+merged semantic freeze
+        |
+        v
+AP-SPEC-034 naming inventory and custody evidence
+        |
+        v
+Rust facade + SDK coordinates
+        |
+        v
+npm/Python/docs + predecessor notice
+        |
+        v
+release identity + stale-name enforcement
+        |
+        v
+resume AP-SPEC-032 release-evidence work
+```
+
+No remaining release manifest, SBOM, provenance subject set, source archive,
+assurance bundle, prepare/promote workflow, or exact public claim may be
+frozen before the AP-SPEC-034 exit gate passes.
+
+## 3. Authoritative inventory
+
+`release/public-naming.toml` is the sole machine-readable authority for:
+
+- current and target public names;
+- compatibility consequences and bounded owner PRs;
+- the exact first-RC package publication tiers;
+- every crates.io package published from the predecessor project;
+- current registry owner, version, download, and reverse-dependency evidence;
+- Continue, Retire, or Replace disposition;
+- deletion eligibility; and
+- destructive-action authorization state.
+
+Human-readable plans and generated reports MUST agree with that file. They
+MUST NOT become competing naming sources. A change to a target public
+coordinate, predecessor disposition, or publication tier requires:
+
+1. a focused inventory change;
+2. an explicit compatibility explanation;
+3. registry evidence refreshed on the change date;
+4. repository-owner approval; and
+5. release and stale-name checks updated in the same PR or an earlier blocking
+   PR.
+
+Registry download totals are weak operational evidence. They include
+automation and dependent-package resolution and MUST NOT be represented as
+independent users. crates.io reverse-dependency results cover published
+registry relationships only; absence there does not prove the absence of Git,
+path, vendored, or copied use.
+
+## 4. Rust package architecture
+
+### 4.1 `auths`
+
+The `auths` crate is the supported consumer-facing core facade. The first
+implementation SHOULD remain thin: it re-exports the stable embedded proof
+verification surface from `auths-proof` without moving provider, profile,
+custody, transport, or stateful runtime behavior into core.
+
+This preserves two different statements:
+
+- users install and import **Auths** through `auths`; and
+- the bounded proof-protocol implementation remains `auths-proof`.
+
+The facade MUST NOT become a generic executor or a dumping ground for every
+workspace crate merely to justify the product name.
+
+### 4.2 `auths-sdk`
+
+The product SDK package is `auths-sdk`. The temporary local package name
+`auths-proof-sdk`, introduced before issue 54, has never been published by this
+implementation and receives no compatibility shim.
+
+The predecessor published `auths-sdk` `0.1.x`. Reuse of that owned coordinate
+is an intentional major-version transition. Package documentation MUST state
+that the new SDK is a semantic and architectural replacement and MUST NOT
+imply source compatibility with the experimental `0.1.x` line.
+
+### 4.3 Supporting closure
+
+The public roots are `auths` and `auths-sdk`. Their crates.io normal-dependency
+closure is supporting implementation surface, not a promise that every crate
+is a separate product.
+
+The publication tiers in `release/public-naming.toml` are normative. Packages
+within one tier MAY be packaged in parallel; tier `N+1` MUST NOT be published
+or dry-run resolved against a registry until all of its tier-`N` dependencies
+are available in the isolated staging model. CI MUST derive the dependency
+graph from manifests and reject an inventory tier that violates an edge.
+
+Adding `auths` changes the previously frozen 27-crate closure to an expected
+28-crate closure. Any further expansion blocks the candidate pending focused
+review.
+
+## 5. Language SDKs
+
+### 5.1 npm
+
+The public package is `@auths-dev/sdk`. The internal Rust/WASM build package
+MAY remain `auths-proof-wasm` because it implements the proof boundary. Public
+imports, package metadata, README examples, tarball names, provenance
+subjects, SBOM package identities, and clean-consumer tests MUST use
+`@auths-dev/sdk`.
+
+The npm registry currently contains predecessor version `0.1.16` at the target
+coordinate. No new version may be published without the separate exact-
+manifest authorization required by `P7-OD-004`.
+
+### 5.2 Python
+
+The public distribution and import root are both `auths`. The internal native
+binding crate MAY remain `auths-proof-python` where it accurately describes
+the proof binding.
+
+The PyPI registry currently contains predecessor version `0.1.16` at the
+target coordinate. The new package MUST document the major transition and
+MUST pass isolated wheel installation and import tests in hosted CI before
+publication is considered. No publication is authorized here.
+
+## 6. Predecessor registry policy
+
+Every predecessor crate has at least one published version. Cargo's official
+publishing contract treats publication as permanent: published code cannot be
+deleted or overwritten, and yanking does not delete the bytes or free the
+name. Consequently, no predecessor crate is eligible for **Delete and
+reclaim**.
+
+The dispositions mean:
+
+- **Continue:** the public responsibility remains recognizable. The current
+  implementation may use the owned coordinate only through an explicit major
+  transition and separately authorized publication.
+- **Retire:** no first-RC package adopts the coordinate. Ownership is retained
+  and the predecessor package is marked superseded through a future
+  non-destructive metadata release only if separately authorized.
+- **Replace:** the predecessor boundary encoded an architecture the current
+  project rejected. The inventory names its narrower replacement coordinates;
+  no compatibility package is implied.
+- **Delete and reclaim:** prohibited for this inventory.
+
+No issue, spec, or documentation PR authorizes a yank, owner change, package
+upload, or deprecation release.
+
+## 7. Documentation, URLs, and deployments
+
+User-facing current documentation MUST call the project Auths and SHOULD link
+to `auths.dev` and `docs.auths.dev`. It MAY say “Auths proof,” “Auths proof
+protocol,” or use an `auths-proof*` package name when the sentence points to
+the bounded proof mechanism.
+
+Historical plans and ADRs MAY retain “Auths Proof” when rewriting would falsify
+the record. Each retained historical document MUST carry a visible historical
+or supersession note and be listed in the stale-name check allowlist with a
+reason. An unbounded directory exclusion is forbidden.
+
+Existing Fly, Vercel, and GHCR demo names beginning with `auths-` already
+conform. The `auths-proof-site.vercel.app` and
+`auths-proof-docs.vercel.app` preview aliases MAY remain as infrastructure
+coordinates, but current user-facing links must use the canonical Auths URLs
+once the destinations are verified. This spec authorizes no deployment rename
+or DNS change.
+
+Generated Rust documentation must lead consumers to `docs.rs/auths` and
+`docs.rs/auths-sdk`; proof-component API references may use
+`docs.rs/auths-proof`.
+
+## 8. Release identity and provenance
+
+The first RC identity is `auths-v1.0.0-rc.1`. All release parsers,
+documentation, artifact catalogues, source archives, assurance bundles,
+checksums, SBOM names, attestation subject paths, and claim registries MUST use
+the same `auths` product/version identity.
+
+The immutable GitHub repository subject remains:
+
+```text
+repo:auths-dev@260513770/auths-proof@1310728509:environment:release-candidate
+```
+
+while the repository retains its current name and ID. Validators MUST compare
+that value literally. They MUST also distinguish it from public artifact
+names, which use `auths-*`.
+
+No RC tag may be created by any AP-SPEC-034 PR. AP-SPEC-032 promotion remains a
+separate owner-authorized event for one exact manifest digest.
+
+## 9. Stale-name enforcement
+
+Hosted CI MUST add one authoritative check that:
+
+- loads `release/public-naming.toml`;
+- validates unique surface and predecessor-package entries;
+- validates the complete predecessor inventory and non-destructive policy;
+- derives Rust dependency edges and rejects invalid publication tiers;
+- rejects `auths-proof-sdk`, `@auths-dev/proof`, `pypi:auths-proof`, and
+  `auths-proof-v` outside explicitly identified historical records;
+- rejects “Auths Proof” as a current product heading or package-installation
+  instruction;
+- permits `auths-proof` only for inventory-declared bounded components,
+  temporary repository/provenance coordinates, and exact historical records;
+- verifies package metadata, release workflow names, and the semantic-freeze
+  public surface against the inventory; and
+- fails on an allowlist entry whose path or reason is absent.
+
+The check MUST include negative fixtures proving that each stale public name
+fails. A grep-only check without semantic exceptions is insufficient because
+`auths-proof` remains a valid component name.
+
+## 10. Predecessor repository
+
+Before archival, `auths-dev/auths` MUST receive a concise, prominent notice
+that truthfully says:
+
+- it was an experimental predecessor and was not released as the supported
+  Auths v1 product;
+- experimental `0.1.x` packages were published from it;
+- the current Auths implementation supersedes it;
+- it remains available as research history and prior art; and
+- new adopters should use `auths.dev` and the current repository.
+
+The notice MUST NOT call the repository wholly “unpublished,” because the
+registry inventory proves that packages were published.
+
+Before the notice PR declares the codebase ready to archive, the Secure
+Enclave bridge, custody/keychain concepts, storage work, and signing workflow
+must each point to either:
+
+- a migrated current implementation or specification; or
+- an explicit deferral issue with scope, rationale, and future trigger.
+
+Merging the notice does not authorize GitHub archival, repository renaming,
+package yanking, or owner changes.
+
+## 11. Bounded PR units
+
+AP-SPEC-034 is implemented through these independently reviewable units:
+
+1. **`AP34-PR1` — naming authority and governing amendments.** Add this spec,
+   the authoritative inventory, registry evidence, predecessor dispositions,
+   publication tiers, and AP-SPEC-032/033 owner-decision amendments. No package
+   or workflow behavior changes.
+2. **`AP34-PR2` — Rust facade and SDK coordinates.** Add the thin `auths`
+   facade; restore `auths-sdk`; update Cargo manifests, lockfile, Rust imports,
+   package metadata, architecture inventories, and clean-consumer examples.
+3. **`AP34-PR3` — npm, Python, and current documentation.** Rename public
+   language packages and imports, update current READMEs/examples/generated-doc
+   inputs, and retain proof-specific internal build names.
+4. **`AP34-PR4` — release identity and enforcement.** Update semantic-freeze
+   release metadata, tag parser, artifact names, package catalogue,
+   provenance/SBOM subjects, publication-order validation, and adversarial
+   stale-name CI.
+5. **`AP34-PR5` — predecessor notice and archival-readiness ledger.** In the
+   predecessor repository, add the accurate notice and migrated/deferred
+   ledger. Do not archive or rename it.
+6. **`AP34-PR6` — external Auths content alignment.** In the repository that
+   owns `auths.dev`, replace predecessor-era package/repository instructions
+   with the current inventory. Do not change DNS or deploy without separate
+   authorization.
+
+Every PR must identify tests/evidence, affected release claims, exclusions,
+and remaining gates. Documentation-only PRs do not establish code or external
+gate completion.
+
+## 12. Entry and exit gates
+
+### Entry gate
+
+Implementation begins only when:
+
+- issue 54 is open and its target map has not been superseded;
+- the release-evidence draft is not merged or frozen under old names;
+- registry queries show the target coordinates remain under intended custody;
+- no publication, tag, deletion, yank, rename, archive, deployment, or DNS
+  action is bundled into the migration; and
+- the repository owner has approved the target map.
+
+### Exit gate
+
+AP-SPEC-034 is complete only when:
+
+- `release/public-naming.toml` validates and covers every listed public
+  surface;
+- current product documentation consistently presents Auths;
+- Rust, npm, and Python package metadata use `auths-sdk`, `@auths-dev/sdk`, and
+  `auths` respectively;
+- `auths` is the supported Rust core facade and `auths-proof` is confined to
+  accurate proof-component or temporary repository contexts;
+- all predecessor crates have current registry evidence and a disposition;
+- the 28-crate publication order is derived and verified in hosted CI;
+- the old repository notice and migration/deferral ledger are merged;
+- `auths.dev` current content no longer directs new users to the predecessor
+  package line as the supported implementation;
+- release specifications, semantic freeze, artifacts, and tag checks agree on
+  `auths-v1.0.0-rc.1`;
+- stale-name adversarial checks pass in hosted CI; and
+- package builds, examples, documentation links, and release dry runs pass in
+  hosted CI.
+
+Only then may the stashed AP-SPEC-032 release-evidence work be reconciled to
+the new inventory and resumed. Passing this gate still does not authorize
+publication, tag creation, external review, repository archival, repository
+renaming, deployment, or DNS changes.
+
+## 13. Explicit exclusions
+
+This specification does not authorize:
+
+- deleting or yanking a registry package or version;
+- publishing any crate, npm package, wheel, deprecation release, or metadata
+  release;
+- changing package ownership;
+- creating or promoting any RC tag;
+- renaming or archiving either GitHub repository;
+- deploying a website or changing DNS;
+- engaging reviewers or design partners;
+- accepting compatibility or security risk; or
+- claiming AP-SPEC-032, Phase 7, or any external gate has passed.
diff --git a/docs/target-state/POST_MILESTONE_6_PRODUCTIZATION_AND_RELEASE_PLAN.md b/docs/target-state/POST_MILESTONE_6_PRODUCTIZATION_AND_RELEASE_PLAN.md
index 39922e0..93eadd7 100644
--- a/docs/target-state/POST_MILESTONE_6_PRODUCTIZATION_AND_RELEASE_PLAN.md
+++ b/docs/target-state/POST_MILESTONE_6_PRODUCTIZATION_AND_RELEASE_PLAN.md
@@ -22,14 +22,16 @@ program is complete:
 - Milestone 6 optimizes only measured bottlenecks while proving equivalence to
   the reference evaluators.
 
-At that point, Auths Proof should stop behaving primarily like a research
-project accumulating demonstrations. It should become a releasable,
-independently reviewable platform for bounded machine authority.
+At that point, Auths should stop behaving primarily like a research project
+accumulating demonstrations. It should become a releasable, independently
+reviewable platform for bounded machine authority. The proof-specific kernel
+may continue to use the `auths-proof` component name.
 
 The required sequence is:
 
 ```text
 Milestone 6 complete
+  -> AP-SPEC-034 Auths naming consolidation
   -> reproducible release candidate
   -> exact assurance claim
   -> independent review
@@ -116,7 +118,7 @@ meaning requires an explicit new version.
 Create a release candidate tag such as:
 
 ```text
-auths-proof-v1.0.0-rc.1
+auths-v1.0.0-rc.1
 ```
 
 The tag must be generated from a clean checkout after all checks and artifact
@@ -609,6 +611,7 @@ This post-Milestone 6 program is complete when:
 - the public v1 release is reproducible and auditable;
 - new domains can be added without changing core or weakening boundaries.
 
-At that point, Auths Proof is no longer primarily a collection of impressive
-proofs and demonstrations. It is a credible execution substrate for bounded
-machine authority.
+At that point, Auths is no longer primarily a collection of impressive proofs
+and demonstrations. It is a credible execution substrate for bounded machine
+authority. `auths-proof` remains the accurate name of its bounded proof
+protocol component, not the umbrella product.
diff --git a/release/public-naming.toml b/release/public-naming.toml
new file mode 100644
index 0000000..4db759e
--- /dev/null
+++ b/release/public-naming.toml
@@ -0,0 +1,610 @@
+schema = "auths.public-naming/v1"
+snapshot_date = "2026-07-31"
+authority = "This file is the sole machine-readable authority for public Auths names and predecessor package dispositions."
+governing_issue = "https://github.com/auths-dev/auths-proof/issues/54"
+governing_spec = "docs/specs/0034-auths-public-naming-consolidation.md"
+product = "Auths"
+website = "https://auths.dev"
+first_rc_tag = "auths-v1.0.0-rc.1"
+
+[registry_evidence]
+crates_owner_id = 345389
+crates_owner = "bordumb"
+crates_snapshot = "https://crates.io/api/v1/crates?user_id=345389&page=1&per_page=100&sort=alpha"
+crates_policy = "https://doc.rust-lang.org/cargo/reference/publishing.html"
+npm_sdk = "https://registry.npmjs.org/@auths-dev%2fsdk"
+python_sdk = "https://pypi.org/pypi/auths/json"
+limitations = "Registry counters include automated and dependent-package downloads; they do not establish independent adoption. Reverse dependencies list published crates visible to crates.io and do not cover unpublished, Git, path, or vendored use."
+
+[[surfaces]]
+id = "product"
+kind = "product"
+current = "Auths Proof"
+target = "Auths"
+state = "replace"
+compatibility = "Prelaunch wording change; proof remains a mechanism, not the umbrella product."
+owner_pr = "AP34-PR3"
+
+[[surfaces]]
+id = "website"
+kind = "url"
+current = "https://auths.dev"
+target = "https://auths.dev"
+state = "continue-content-migration-required"
+compatibility = "The coordinate continues, but its predecessor-era package and repository links must agree with this inventory before the RC. DNS changes are separately authorized."
+owner_pr = "AP34-PR6"
+
+[[surfaces]]
+id = "repository-current"
+kind = "repository"
+current = "auths-dev/auths-proof"
+target = "auths-dev/auths-proof"
+state = "temporary-coordinate"
+compatibility = "Repository rename is excluded from issue 54 and requires a bounded migration. Product copy must call the project Auths."
+owner_pr = "DEFERRED-REPOSITORY-RENAME"
+
+[[surfaces]]
+id = "repository-predecessor"
+kind = "repository"
+current = "auths-dev/auths"
+target = "archived-predecessor"
+state = "retire"
+compatibility = "Add an accurate supersession notice after custody, Secure Enclave, storage, and signing ideas are migrated or explicitly deferred. Archival itself requires separate authorization."
+owner_pr = "AP34-PR5"
+
+[[surfaces]]
+id = "rust-core"
+kind = "cargo"
+current = "auths-proof"
+target = "auths"
+state = "new-public-facade"
+compatibility = "Add a thin consumer facade at auths; retain auths-proof as the bounded proof-protocol component. The existing crates.io auths coordinate continues through an intentional 1.0 major transition."
+owner_pr = "AP34-PR2"
+
+[[surfaces]]
+id = "rust-proof-component"
+kind = "cargo"
+current = "auths-proof"
+target = "auths-proof"
+state = "continue-bounded-component"
+compatibility = "The name remains accurate for the deterministic proof protocol and verifier facade, but is not presented as the product name."
+owner_pr = "AP34-PR2"
+
+[[surfaces]]
+id = "rust-sdk"
+kind = "cargo"
+current = "auths-proof-sdk"
+target = "auths-sdk"
+state = "replace-unpublished-local-name"
+compatibility = "auths-proof-sdk was never published from this implementation. The owned predecessor auths-sdk coordinate continues through an intentional 1.0 major transition."
+owner_pr = "AP34-PR2"
+
+[[surfaces]]
+id = "npm-sdk"
+kind = "npm"
+current = "@auths-dev/proof"
+target = "@auths-dev/sdk"
+state = "replace-unpublished-local-name"
+compatibility = "@auths-dev/proof is absent from npm. @auths-dev/sdk 0.1.16 is predecessor-owned and will continue only through separately authorized publication of the new major version."
+owner_pr = "AP34-PR3"
+
+[[surfaces]]
+id = "python-sdk"
+kind = "pypi"
+current = "auths-proof"
+target = "auths"
+state = "replace-unpublished-local-name"
+compatibility = "auths-proof is absent from PyPI. auths 0.1.16 is predecessor-owned and will continue only through separately authorized publication of the new major version."
+owner_pr = "AP34-PR3"
+
+[[surfaces]]
+id = "rc-tag"
+kind = "git-tag"
+current = "auths-proof-v<version>"
+target = "auths-v<version>"
+state = "replace"
+compatibility = "No RC tag has been issued; the first permitted form is auths-v1.0.0-rc.1. Tag creation remains separately authorized."
+owner_pr = "AP34-PR4"
+
+[[surfaces]]
+id = "release-evidence-artifact"
+kind = "github-artifact"
+current = "auths-proof-release-evidence-<run>-<attempt>"
+target = "auths-release-evidence-<run>-<attempt>"
+state = "replace"
+compatibility = "Workflow artifact locator only; no compatibility promise."
+owner_pr = "AP34-PR4"
+
+[[surfaces]]
+id = "source-archive"
+kind = "release-artifact"
+current = "unfrozen"
+target = "auths-<version>-source.tar.zst"
+state = "freeze-target"
+compatibility = "The filename and digest become immutable only for an approved candidate manifest."
+owner_pr = "AP34-PR4"
+
+[[surfaces]]
+id = "assurance-bundle"
+kind = "release-artifact"
+current = "unfrozen"
+target = "auths-<version>-assurance.tar.zst"
+state = "freeze-target"
+compatibility = "The filename and digest become immutable only for an approved candidate manifest."
+owner_pr = "AP34-PR4"
+
+[[surfaces]]
+id = "release-schema"
+kind = "schema"
+current = "auths.release-manifest/1"
+target = "auths.release-manifest/1"
+state = "continue"
+compatibility = "Already product-scoped rather than repository-scoped."
+owner_pr = "AP34-PR4"
+
+[[surfaces]]
+id = "github-attestation-subject"
+kind = "provenance"
+current = "repo:auths-dev@260513770/auths-proof@1310728509:environment:release-candidate"
+target = "repo:auths-dev@260513770/auths-proof@1310728509:environment:release-candidate"
+state = "temporary-repository-coordinate"
+compatibility = "The immutable GitHub repository identity must remain literal while the repository is named auths-proof. It is provenance identity, not product branding."
+owner_pr = "AP34-PR4"
+
+[[surfaces]]
+id = "rust-api-docs"
+kind = "url"
+current = "unpublished"
+target = "https://docs.rs/auths and https://docs.rs/auths-sdk"
+state = "freeze-target"
+compatibility = "Proof-component API documentation may also use https://docs.rs/auths-proof."
+owner_pr = "AP34-PR3"
+
+[[surfaces]]
+id = "internal-wasm-crate"
+kind = "cargo-private-build"
+current = "auths-proof-wasm"
+target = "auths-proof-wasm"
+state = "continue-bounded-component"
+compatibility = "Private Rust build boundary for proof verification; the public JavaScript artifact is @auths-dev/sdk."
+owner_pr = "AP34-PR3"
+
+[[surfaces]]
+id = "internal-python-crate"
+kind = "cargo-private-build"
+current = "auths-proof-python"
+target = "auths-proof-python"
+state = "continue-bounded-component"
+compatibility = "Private native proof-binding crate; the public Python distribution and import root are auths."
+owner_pr = "AP34-PR3"
+
+[[surfaces]]
+id = "proof-exchange-family"
+kind = "cargo"
+current = "auths-proof-exchange-*"
+target = "auths-proof-exchange-*"
+state = "continue-bounded-component"
+compatibility = "These names describe exchange of proof objects and are not the umbrella product identity. Only the model and port are in the first-RC dependency closure."
+owner_pr = "AP34-PR2"
+
+[[surfaces]]
+id = "container-images"
+kind = "oci"
+current = "ghcr.io/auths-dev/auths-*"
+target = "ghcr.io/auths-dev/auths-*"
+state = "continue"
+compatibility = "No core OCI image is in the first-RC catalogue. Existing Auths demo image names already conform."
+owner_pr = "AP34-PR4"
+
+[[surfaces]]
+id = "deployment-names"
+kind = "deployment"
+current = "auths-* Fly/Vercel applications; auths-proof-site and auths-proof-docs preview aliases"
+target = "auths-* applications with auths.dev/docs.auths.dev as user-facing product links"
+state = "continue-with-temporary-aliases"
+compatibility = "Do not rename deployments under this issue. Inventory the preview aliases and stop presenting them as the canonical product URL."
+owner_pr = "AP34-PR3"
+
+[[release_order]]
+tier = 0
+packages = ["auths-algebra-kernel", "auths-model", "auths-multikey", "auths-proof-exchange-model"]
+
+[[release_order]]
+tier = 1
+packages = ["auths-assurance", "auths-codec", "auths-composition", "auths-ports", "auths-proof-exchange-port"]
+
+[[release_order]]
+tier = 2
+packages = ["auths-authority", "auths-did-keri", "auths-did-key", "auths-raw-key", "auths-receipts", "auths-registries", "auths-signature"]
+
+[[release_order]]
+tier = 3
+packages = ["auths-author", "auths-verifier"]
+
+[[release_order]]
+tier = 4
+packages = ["auths-custody", "auths-proof", "auths-profile-api"]
+
+[[release_order]]
+tier = 5
+packages = ["auths-config", "auths-profile-domains", "auths-profile-mcp"]
+
+[[release_order]]
+tier = 6
+packages = ["auths-operations"]
+
+[[release_order]]
+tier = 7
+packages = ["auths-runtime"]
+
+[[release_order]]
+tier = 8
+packages = ["auths", "auths-sdk"]
+
+[[predecessor_crates]]
+name = "auths"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 218
+downloads_recent = 178
+reverse_dependencies = []
+classification = "Continue"
+replacement = ["auths"]
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-anchor"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 96
+downloads_recent = 96
+reverse_dependencies = ["auths-cli", "auths-evidence", "auths-mcp-gateway", "auths-sdk", "auths-witness-node"]
+classification = "Retire"
+replacement = []
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-api"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 186
+downloads_recent = 186
+reverse_dependencies = ["auths-mcp-server"]
+classification = "Retire"
+replacement = []
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-cli"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 192
+downloads_recent = 177
+reverse_dependencies = []
+classification = "Retire"
+replacement = []
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-core"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 1423
+downloads_recent = 1020
+reverse_dependencies = ["auths-api", "auths-id", "auths-infra-git", "auths-infra-http", "auths-infra-rekor", "auths-pairing-daemon", "auths-scim-server", "auths-sdk", "auths-storage", "auths-witness", "auths-witness-node"]
+classification = "Replace"
+replacement = ["auths", "auths-model", "auths-ports"]
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-crypto"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 2234
+downloads_recent = 1618
+reverse_dependencies = ["auths-anchor", "auths-api", "auths-cli", "auths-core", "auths-evidence", "auths-id", "auths-infra-http", "auths-infra-rekor", "auths-keri", "auths-mcp-core", "auths-mcp-gateway", "auths-oidc-port", "auths-pairing-protocol", "auths-receipts", "auths-scim-server", "auths-sdk", "auths-storage", "auths-transparency", "auths-verifier", "auths-witness", "auths-witness-node"]
+classification = "Replace"
+replacement = ["auths-signature", "auths-multikey", "auths-raw-key"]
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-evidence"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 134
+downloads_recent = 134
+reverse_dependencies = ["auths-mcp-gateway", "auths-receipts"]
+classification = "Replace"
+replacement = ["auths-assurance", "auths-registries"]
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-id"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 1015
+downloads_recent = 752
+reverse_dependencies = ["auths-api", "auths-evidence", "auths-mcp-core", "auths-scim-server", "auths-sdk", "auths-storage"]
+classification = "Replace"
+replacement = ["auths-custody", "auths-did-key", "auths-did-keri"]
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-index"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 656
+downloads_recent = 401
+reverse_dependencies = ["auths-cli", "auths-id", "auths-storage"]
+classification = "Replace"
+replacement = ["auths-stores"]
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-infra-git"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 409
+downloads_recent = 290
+reverse_dependencies = ["auths-cli"]
+classification = "Retire"
+replacement = []
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-infra-http"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 996
+downloads_recent = 747
+reverse_dependencies = ["auths-cli", "auths-id", "auths-sdk"]
+classification = "Retire"
+replacement = []
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-infra-rekor"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 237
+downloads_recent = 237
+reverse_dependencies = ["auths-cli"]
+classification = "Retire"
+replacement = []
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-jwt"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 368
+downloads_recent = 292
+reverse_dependencies = ["auths-mcp-server"]
+classification = "Retire"
+replacement = []
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-keri"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 1326
+downloads_recent = 1231
+reverse_dependencies = ["auths-anchor", "auths-cli", "auths-core", "auths-evidence", "auths-id", "auths-index", "auths-infra-git", "auths-infra-http", "auths-jwt", "auths-mcp-core", "auths-mcp-gateway", "auths-pairing-daemon", "auths-pairing-protocol", "auths-sdk", "auths-storage", "auths-transparency", "auths-verifier", "auths-witness-node"]
+classification = "Replace"
+replacement = ["auths-did-keri"]
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-mcp-core"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 226
+downloads_recent = 226
+reverse_dependencies = ["auths-evidence", "auths-mcp-gateway", "auths-receipts"]
+classification = "Replace"
+replacement = ["auths-profile-mcp", "auths-runtime"]
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-mcp-gateway"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 140
+downloads_recent = 140
+reverse_dependencies = []
+classification = "Retire"
+replacement = []
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-mcp-server"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 220
+downloads_recent = 182
+reverse_dependencies = []
+classification = "Retire"
+replacement = []
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-oidc-port"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 839
+downloads_recent = 772
+reverse_dependencies = ["auths-infra-http", "auths-sdk"]
+classification = "Retire"
+replacement = []
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-pairing-daemon"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 337
+downloads_recent = 295
+reverse_dependencies = ["auths-cli", "auths-sdk"]
+classification = "Retire"
+replacement = []
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-pairing-protocol"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 1349
+downloads_recent = 1078
+reverse_dependencies = ["auths-cli", "auths-core", "auths-infra-http", "auths-pairing-daemon"]
+classification = "Retire"
+replacement = []
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-policy"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 1164
+downloads_recent = 833
+reverse_dependencies = ["auths-api", "auths-cli", "auths-id", "auths-sdk"]
+classification = "Replace"
+replacement = ["auths-authority", "auths-composition", "auths-bounded-policy"]
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-receipts"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 79
+downloads_recent = 79
+reverse_dependencies = []
+classification = "Continue"
+replacement = ["auths-receipts"]
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-rp"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 629
+downloads_recent = 629
+reverse_dependencies = ["auths-api", "auths-cli", "auths-mcp-server", "auths-sdk"]
+classification = "Replace"
+replacement = ["auths-proof-exchange-model", "auths-proof-exchange-port"]
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-scim"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 303
+downloads_recent = 303
+reverse_dependencies = ["auths-scim-server"]
+classification = "Retire"
+replacement = []
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-scim-server"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 236
+downloads_recent = 236
+reverse_dependencies = ["auths-cli"]
+classification = "Retire"
+replacement = []
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-sdk"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 788
+downloads_recent = 631
+reverse_dependencies = ["auths", "auths-api", "auths-cli", "auths-evidence", "auths-infra-git", "auths-mcp-core", "auths-mcp-gateway", "auths-mcp-server", "auths-scim-server", "auths-witness-node"]
+classification = "Continue"
+replacement = ["auths-sdk"]
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-storage"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 732
+downloads_recent = 564
+reverse_dependencies = ["auths-api", "auths-sdk"]
+classification = "Replace"
+replacement = ["auths-custody", "auths-stores"]
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-telemetry"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 1027
+downloads_recent = 749
+reverse_dependencies = ["auths-cli", "auths-mcp-gateway", "auths-mcp-server", "auths-sdk"]
+classification = "Retire"
+replacement = []
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-transparency"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 997
+downloads_recent = 955
+reverse_dependencies = ["auths-anchor", "auths-cli", "auths-core", "auths-infra-rekor", "auths-sdk", "auths-witness-node"]
+classification = "Retire"
+replacement = []
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-utils"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 902
+downloads_recent = 791
+reverse_dependencies = ["auths-cli", "auths-id"]
+classification = "Retire"
+replacement = []
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-verifier"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 1938
+downloads_recent = 1384
+reverse_dependencies = ["auths", "auths-anchor", "auths-api", "auths-cli", "auths-core", "auths-evidence", "auths-id", "auths-index", "auths-infra-git", "auths-infra-http", "auths-infra-rekor", "auths-mcp-core", "auths-mcp-server", "auths-policy", "auths-rp", "auths-scim", "auths-scim-server", "auths-sdk", "auths-storage", "auths-transparency", "auths-witness-node"]
+classification = "Continue"
+replacement = ["auths-verifier"]
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-witness"
+owner = "bordumb"
+latest_version = "0.1.12"
+downloads_total = 131
+downloads_recent = 131
+reverse_dependencies = []
+classification = "Retire"
+replacement = []
+deletion_eligible = false
+
+[[predecessor_crates]]
+name = "auths-witness-node"
+owner = "bordumb"
+latest_version = "0.1.16"
+downloads_total = 134
+downloads_recent = 134
+reverse_dependencies = ["auths-cli"]
+classification = "Retire"
+replacement = []
+deletion_eligible = false
+
+[deletion_policy]
+default_eligible = false
+reason = "Every predecessor coordinate in this inventory has at least one published version. crates.io publication is permanent: versions cannot be overwritten or deleted, and yanking does not delete code or free the name. No Delete and reclaim classification is valid."
+destructive_actions_authorized = false
diff --git a/release/semantic-freeze.json b/release/semantic-freeze.json
index a744de3..1b62bbf 100644
--- a/release/semantic-freeze.json
+++ b/release/semantic-freeze.json
@@ -640,7 +640,7 @@
         "xtask/src/fixtures.rs",
         "xtask/src/semantic_freeze.rs"
       ],
-      "sha256": "9f90d0025a03e87ff91df60c11e677a94fc602fbc9064c7900e71fadc1814f79"
+      "sha256": "3b50ecb1e6644e61ecabab462977aa65e4807114c7fc268eb6d06b410e1c08cc"
     }
   ]
 }