diff --git a/.changeset/ci-provenance.md b/.changeset/ci-provenance.md
deleted file mode 100644
index c9e289db..00000000
--- a/.changeset/ci-provenance.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-"@cloudhal/cli": patch
----
-Cloudhal packages are now published from GitHub Actions with npm trusted publishing and provenance: each version on npm links to the commit and workflow run that built it, and `npm audit signatures` verifies it.
diff --git a/packages/agent-runtime/CHANGELOG.md b/packages/agent-runtime/CHANGELOG.md
index 235ed918..9b729f7c 100644
--- a/packages/agent-runtime/CHANGELOG.md
+++ b/packages/agent-runtime/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @cloudhal/agent-runtime
 
+## 0.3.5
+
+### Patch Changes
+
+- @cloudhal/core-contracts@0.3.5
+  - @cloudhal/storage@0.3.5
+
 ## 0.3.4
 
 ### Patch Changes
diff --git a/packages/agent-runtime/package.json b/packages/agent-runtime/package.json
index 3e661eb6..cadb2ee7 100644
--- a/packages/agent-runtime/package.json
+++ b/packages/agent-runtime/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/agent-runtime",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "Cloudhal agent runtime: policy engine (actors, scopes, approvals), skill loader, audit log",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",
diff --git a/packages/analytics/CHANGELOG.md b/packages/analytics/CHANGELOG.md
index 20191ef3..7983028c 100644
--- a/packages/analytics/CHANGELOG.md
+++ b/packages/analytics/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @cloudhal/analytics
 
+## 0.3.5
+
+### Patch Changes
+
+- @cloudhal/core-contracts@0.3.5
+  - @cloudhal/storage@0.3.5
+
 ## 0.3.4
 
 ### Patch Changes
diff --git a/packages/analytics/package.json b/packages/analytics/package.json
index fe5d3be3..1649adb4 100644
--- a/packages/analytics/package.json
+++ b/packages/analytics/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/analytics",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "Cloudhal site analytics (RFC-0006): query model, classifiers, beacon handler, SQLite/D1 store, daily rollups and Workers Analytics Engine adapters. Worker-safe.",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",
diff --git a/packages/api/CHANGELOG.md b/packages/api/CHANGELOG.md
index 66449c66..d587a4a4 100644
--- a/packages/api/CHANGELOG.md
+++ b/packages/api/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @cloudhal/api
 
+## 0.3.5
+
+### Patch Changes
+
+- @cloudhal/agent-runtime@0.3.5
+  - @cloudhal/analytics@0.3.5
+  - @cloudhal/astro-renderer@0.3.5
+  - @cloudhal/comments@0.3.5
+  - @cloudhal/core-contracts@0.3.5
+  - @cloudhal/core-ts@0.3.5
+  - @cloudhal/mcp-server@0.3.5
+  - @cloudhal/schedules@0.3.5
+  - @cloudhal/storage@0.3.5
+
 ## 0.3.4
 
 ### Patch Changes
diff --git a/packages/api/package.json b/packages/api/package.json
index 36d54a03..8cc3ac5a 100644
--- a/packages/api/package.json
+++ b/packages/api/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/api",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "Cloudhal HTTP API (Hono): sites, pages, entries, snapshots, auth — runs on Node and Cloudflare Workers",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",
diff --git a/packages/astro-renderer/CHANGELOG.md b/packages/astro-renderer/CHANGELOG.md
index bcf15489..6287a5cb 100644
--- a/packages/astro-renderer/CHANGELOG.md
+++ b/packages/astro-renderer/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @cloudhal/astro-renderer
 
+## 0.3.5
+
+### Patch Changes
+
+- @cloudhal/analytics@0.3.5
+  - @cloudhal/comments@0.3.5
+  - @cloudhal/core-contracts@0.3.5
+  - @cloudhal/core-ts@0.3.5
+  - @cloudhal/storage@0.3.5
+
 ## 0.3.4
 
 ### Patch Changes
diff --git a/packages/astro-renderer/package.json b/packages/astro-renderer/package.json
index 8f883881..f9be4685 100644
--- a/packages/astro-renderer/package.json
+++ b/packages/astro-renderer/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/astro-renderer",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "Render a Cloudhal Site Graph with Astro: data sources (live/snapshot), section components and the cloudhal() integration",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",
diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md
index eb271b6b..3ab419ef 100644
--- a/packages/cli/CHANGELOG.md
+++ b/packages/cli/CHANGELOG.md
@@ -1,5 +1,21 @@
 # @cloudhal/cli
 
+## 0.3.5
+
+### Patch Changes
+
+- 0a6ac44: Cloudhal packages are now published from GitHub Actions with npm trusted publishing and provenance: each version on npm links to the commit and workflow run that built it, and `npm audit signatures` verifies it.
+- @cloudhal/agent-runtime@0.3.5
+  - @cloudhal/analytics@0.3.5
+  - @cloudhal/api@0.3.5
+  - @cloudhal/cloudflare@0.3.5
+  - @cloudhal/comments@0.3.5
+  - @cloudhal/core-contracts@0.3.5
+  - @cloudhal/core-ts@0.3.5
+  - @cloudhal/mcp-server@0.3.5
+  - @cloudhal/schedules@0.3.5
+  - @cloudhal/storage@0.3.5
+
 ## 0.3.4
 
 ### Patch Changes
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 19d94215..a4761f90 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/cli",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "cloudhal — create, run and build Cloudhal sites locally",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",
diff --git a/packages/cloudflare/CHANGELOG.md b/packages/cloudflare/CHANGELOG.md
index f5e94add..e016dc66 100644
--- a/packages/cloudflare/CHANGELOG.md
+++ b/packages/cloudflare/CHANGELOG.md
@@ -1,5 +1,18 @@
 # @cloudhal/cloudflare
 
+## 0.3.5
+
+### Patch Changes
+
+- @cloudhal/agent-runtime@0.3.5
+  - @cloudhal/analytics@0.3.5
+  - @cloudhal/api@0.3.5
+  - @cloudhal/comments@0.3.5
+  - @cloudhal/core-ts@0.3.5
+  - @cloudhal/mcp-server@0.3.5
+  - @cloudhal/schedules@0.3.5
+  - @cloudhal/storage@0.3.5
+
 ## 0.3.4
 
 ### Patch Changes
diff --git a/packages/cloudflare/package.json b/packages/cloudflare/package.json
index 043960f9..da807932 100644
--- a/packages/cloudflare/package.json
+++ b/packages/cloudflare/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/cloudflare",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "Cloudhal on Cloudflare: the admin Worker (API, auth, MCP, Studio) over D1 + R2",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",
diff --git a/packages/comments/CHANGELOG.md b/packages/comments/CHANGELOG.md
index 22b0be38..c01d4790 100644
--- a/packages/comments/CHANGELOG.md
+++ b/packages/comments/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @cloudhal/comments
 
+## 0.3.5
+
+### Patch Changes
+
+- @cloudhal/core-contracts@0.3.5
+  - @cloudhal/core-ts@0.3.5
+  - @cloudhal/storage@0.3.5
+
 ## 0.3.4
 
 ### Patch Changes
diff --git a/packages/comments/package.json b/packages/comments/package.json
index fd53b975..941c36f6 100644
--- a/packages/comments/package.json
+++ b/packages/comments/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/comments",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "Cloudhal reader comments (RFC-0007): settings and thread state, text normalising and content rules, linkify, first-party proof of work, the submission pipeline, purge planner, retention plan and the SQLite/D1 store. Worker-safe.",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",
diff --git a/packages/core-contracts/CHANGELOG.md b/packages/core-contracts/CHANGELOG.md
index 01c71d41..aeac52c8 100644
--- a/packages/core-contracts/CHANGELOG.md
+++ b/packages/core-contracts/CHANGELOG.md
@@ -1,5 +1,9 @@
 # @cloudhal/core-contracts
 
+## 0.3.5
+
+No changes in this release.
+
 ## 0.3.4
 
 No changes in this release.
diff --git a/packages/core-contracts/package.json b/packages/core-contracts/package.json
index b65ae2f0..187a9360 100644
--- a/packages/core-contracts/package.json
+++ b/packages/core-contracts/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/core-contracts",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "Cloudhal domain contracts: JSON Schema source of truth plus generated TypeScript types",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",
diff --git a/packages/core-ts/CHANGELOG.md b/packages/core-ts/CHANGELOG.md
index e70fbec1..9b265bc2 100644
--- a/packages/core-ts/CHANGELOG.md
+++ b/packages/core-ts/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @cloudhal/core-ts
 
+## 0.3.5
+
+### Patch Changes
+
+- @cloudhal/core-contracts@0.3.5
+  - @cloudhal/schedules@0.3.5
+  - @cloudhal/storage@0.3.5
+
 ## 0.3.4
 
 ### Patch Changes
diff --git a/packages/core-ts/package.json b/packages/core-ts/package.json
index 22338d4e..72799a6b 100644
--- a/packages/core-ts/package.json
+++ b/packages/core-ts/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/core-ts",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "Cloudhal Site Graph core (TypeScript): load/save nodes with optimistic locking, snapshots, diff, publish and rollback; taxonomies, terms, redirects and menus",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",
diff --git a/packages/create-cloudhal/CHANGELOG.md b/packages/create-cloudhal/CHANGELOG.md
index 5124d5f9..2f5b0cee 100644
--- a/packages/create-cloudhal/CHANGELOG.md
+++ b/packages/create-cloudhal/CHANGELOG.md
@@ -1,5 +1,12 @@
 # create-cloudhal
 
+## 0.3.5
+
+### Patch Changes
+
+- Updated dependencies [0a6ac44]
+  - @cloudhal/cli@0.3.5
+
 ## 0.3.4
 
 ### Patch Changes
diff --git a/packages/create-cloudhal/package.json b/packages/create-cloudhal/package.json
index e6cf77d7..b3d2c78e 100644
--- a/packages/create-cloudhal/package.json
+++ b/packages/create-cloudhal/package.json
@@ -1,6 +1,6 @@
 {
   "name": "create-cloudhal",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "Create a Cloudhal site: npm create cloudhal@latest",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",
diff --git a/packages/mcp-server/CHANGELOG.md b/packages/mcp-server/CHANGELOG.md
index 9c7602c5..9ed4256c 100644
--- a/packages/mcp-server/CHANGELOG.md
+++ b/packages/mcp-server/CHANGELOG.md
@@ -1,5 +1,18 @@
 # @cloudhal/mcp-server
 
+## 0.3.5
+
+### Patch Changes
+
+- @cloudhal/agent-runtime@0.3.5
+  - @cloudhal/analytics@0.3.5
+  - @cloudhal/astro-renderer@0.3.5
+  - @cloudhal/comments@0.3.5
+  - @cloudhal/core-contracts@0.3.5
+  - @cloudhal/core-ts@0.3.5
+  - @cloudhal/schedules@0.3.5
+  - @cloudhal/storage@0.3.5
+
 ## 0.3.4
 
 ### Patch Changes
diff --git a/packages/mcp-server/package.json b/packages/mcp-server/package.json
index 8b3a7082..0613f820 100644
--- a/packages/mcp-server/package.json
+++ b/packages/mcp-server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/mcp-server",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "Cloudhal MCP server: semantic site tools (pages, articles, snapshots, preview, publish) governed by the policy engine",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",
diff --git a/packages/schedules/CHANGELOG.md b/packages/schedules/CHANGELOG.md
index 5065d1e9..0fd0dd5c 100644
--- a/packages/schedules/CHANGELOG.md
+++ b/packages/schedules/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @cloudhal/schedules
 
+## 0.3.5
+
+### Patch Changes
+
+- @cloudhal/core-contracts@0.3.5
+  - @cloudhal/storage@0.3.5
+
 ## 0.3.4
 
 ### Patch Changes
diff --git a/packages/schedules/package.json b/packages/schedules/package.json
index b2c96b9c..309b192e 100644
--- a/packages/schedules/package.json
+++ b/packages/schedules/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/schedules",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "Cloudhal schedules (RFC-0008): the time model, the RRULE subset and its sentences, releases (pin, closure, rl1: hash, compose, conflicts, state machine), automation and run state, taint and budget accounting, the Scheduler and runDue, and the SQLite/D1 store. Worker-safe.",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",
diff --git a/packages/storage/CHANGELOG.md b/packages/storage/CHANGELOG.md
index 5b427f29..30933e8d 100644
--- a/packages/storage/CHANGELOG.md
+++ b/packages/storage/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @cloudhal/storage
 
+## 0.3.5
+
+### Patch Changes
+
+- @cloudhal/core-contracts@0.3.5
+
 ## 0.3.4
 
 ### Patch Changes
diff --git a/packages/storage/package.json b/packages/storage/package.json
index 2bbd119d..b3af6004 100644
--- a/packages/storage/package.json
+++ b/packages/storage/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/storage",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "Cloudhal storage interfaces (SQL driver, blob store) with Cloudflare D1/R2/Durable Object SQLite and local SQLite/filesystem adapters",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",