diff --git a/CHANGELOG.md b/CHANGELOG.md
index a1281fd..a4ee4b8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,7 +5,7 @@ All notable changes to **signetry-core** are documented here. The format follows
 [Semantic Versioning](https://semver.org/). Until `1.0.0` the public API may
 change between minor versions.
 
-## [Unreleased]
+## [0.8.0] — 2026-09-01
 
 ### Added — the receipt format is now a published, independently testable spec
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 5e83760..ffce7a2 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -42,6 +42,14 @@ CI should be green.
 and [Discussions](https://github.com/Signetry/signetry/discussions).
 Well-scoped areas in this repo:
 
+- **A policy for the registry** — the most approachable change here: one YAML file in
+  `signetry_core/policies/` describing a stack's safe blast radius. No Python required,
+  and no test to write — `tests/test_policy_registry.py` is parametrized over every
+  entry, so your file is checked the moment it lands (metadata complete, declared blocks
+  actually blocked, declared allows actually allowed, no overlap between them).
+  `signetry policies` lists what exists and
+  [docs/site/policy-registry.md](docs/site/policy-registry.md) explains the fields; a
+  policy installs byte-for-byte, so what you write is exactly what an adopter gets.
 - **A new detection rule** — add a vuln class or language to
   `signetry_core/pipeline/findings/` with a test in `tests/test_findings_engine.py`.
 - **An executor adapter** — wire a new coding agent behind the `Executor` protocol
diff --git a/README.md b/README.md
index ef967a3..b3f5749 100644
--- a/README.md
+++ b/README.md
@@ -58,12 +58,12 @@ One core (`run_admission`), five checkpoints an agent's change must pass through
 
 ```bash
 # Not on PyPI — install from the source repo:
-pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"
+pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"
 ```
 
 | Surface | Governs | Command |
 |---|---|---|
-| **Source install** | anything you script | `pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"` |
+| **Source install** | anything you script | `pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"` |
 | **CLI + git hook** | the agent on your machine | `signetry admit . --mission "..." --agent claude-code` |
 | **Detection scan** | find vulns in any repo (7 languages) + govern the fix | `signetry scan . --sarif` · `signetry scan . --fix` |
 | **GitHub Action** | **every** agent's PR (Claude Code, Codex, Cursor, Copilot, Devin) | [Marketplace: Signetry Admission](https://github.com/marketplace/actions/signetry-admission) · [`@v1`](https://github.com/Signetry/action) |
diff --git a/SECURITY.md b/SECURITY.md
index 962070b..0eeeafb 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -20,7 +20,7 @@ dev-key verification trust, and — in the companion GitHub Action `< v0.1.3` 
 workflow script-injection sink). `0.5.1+` adds bring-your-own-key credential
 redaction for `--fix`. Pin the Action to `@v1` (which moves forward) or
 `@v0.1.3+`, and install `signetry-core` from source at `@v0.5.3` or later
-(`pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"`).
+(`pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"`).
 
 ## Reporting a vulnerability
 
diff --git a/docs/INTEGRATIONS.md b/docs/INTEGRATIONS.md
index 1258b2e..389ec4c 100644
--- a/docs/INTEGRATIONS.md
+++ b/docs/INTEGRATIONS.md
@@ -14,7 +14,7 @@ Codex, Cursor, Copilot, Devin, or a human, identically.
 
 ```bash
 # BUSL-1.1 (Apache-2.0 on 2030-08-31); not on PyPI — install from source
-pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"
+pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"
 ```
 
 ```python
@@ -75,7 +75,7 @@ status check* in branch protection and nothing merges without a receipt.
 ## 4. MCP server (agents call governance themselves)
 
 ```bash
-pip install "signetry-core[mcp] @ git+https://github.com/Signetry/core@v0.7.0"
+pip install "signetry-core[mcp] @ git+https://github.com/Signetry/core@v0.8.0"
 python -m signetry_core.mcp_server            # stdio transport
 ```
 
diff --git a/docs/LAUNCH.md b/docs/LAUNCH.md
index 9f6547b..01e2600 100644
--- a/docs/LAUNCH.md
+++ b/docs/LAUNCH.md
@@ -35,7 +35,7 @@ provenance. Make it a required status check and nothing merges without a receipt
 
 Agent-agnostic; **open core** — the engine is source-available under BUSL-1.1
 (Apache-2.0 on 2030-08-31) and every integration is Apache-2.0 — installed from
-source (`pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"`).
+source (`pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"`).
 On the GitHub Marketplace:
 https://github.com/marketplace/actions/signetry-admission
 
@@ -97,7 +97,7 @@ jobs:
 Live demo — a permitted change passes, a forbidden `deploy.yml` edit is blocked:
 https://github.com/Signetry/autofix-demo/pulls
 
-Also usable as a CLI (`pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"`
+Also usable as a CLI (`pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"`
 → `signetry admit`), a git pre-push hook, an MCP server, or a Python library.
 Open core: the engine is source-available under BUSL-1.1 (Apache-2.0 on 2030-08-31)
 and every integration around it is Apache-2.0.
diff --git a/docs/RELEASING.md b/docs/RELEASING.md
index 1ef3dec..8c0002e 100644
--- a/docs/RELEASING.md
+++ b/docs/RELEASING.md
@@ -5,7 +5,7 @@ Apache-2.0 on 2030-08-31) and is **not published to PyPI** — it is distributed
 installed **from source by tag**:
 
 ```bash
-pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"
+pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"
 ```
 
 Pushing a version tag runs [`.github/workflows/release.yml`](../.github/workflows/release.yml),
@@ -15,14 +15,24 @@ as all prior PyPI releases were yanked).
 
 ## Cutting a release
 
-1. Bump the version in [`pyproject.toml`](../pyproject.toml) (`[project].version`).
-2. Commit: `git commit -am "release: v0.5.3"`.
-3. Tag and push:
+1. Move `## [Unreleased]` in [`CHANGELOG.md`](../CHANGELOG.md) to `## [X.Y.Z] — <date>`.
+   The release notes are extracted from that heading, so a release cut without it
+   ships the fallback text instead of its own changelog.
+2. Bump the version in [`pyproject.toml`](../pyproject.toml) (`[project].version`) to
+   match. The workflow fails the release if the two disagree.
+3. Update every `core@vX.Y.Z` pin that names the current release — the README, the
+   docs, `install.sh`, and the bundled integrations all print an install command a
+   user copies. `grep -rn 'core@v'` finds them; leave the `@v0.5.3 or later`-style
+   floors alone.
+4. Open a PR with those changes and merge it. `main` is protected and requires its
+   status checks, so a release cannot be pushed straight to it.
+5. Tag the merged commit and push the tag alone:
    ```bash
-   git tag v0.5.3
-   git push origin main --tags
+   git checkout main && git pull
+   git tag vX.Y.Z
+   git push origin vX.Y.Z
    ```
-4. The `Release` workflow will:
+6. The `Release` workflow will:
    - verify the tag matches `pyproject.toml`,
    - run `ruff` + `pytest`,
    - build sdist + wheel and run `twine check`,
diff --git a/docs/site/index.md b/docs/site/index.md
index 99f00e4..efb4d45 100644
--- a/docs/site/index.md
+++ b/docs/site/index.md
@@ -35,7 +35,7 @@ false — a human merges.
 
 ```bash
 # BUSL-1.1 (Apache-2.0 on 2030-08-31); not on PyPI — install from source
-pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"
+pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"
 ```
 
 - Source (install from here): <https://github.com/Signetry/core>
diff --git a/docs/site/quickstart.md b/docs/site/quickstart.md
index ca4e81c..68cd21f 100644
--- a/docs/site/quickstart.md
+++ b/docs/site/quickstart.md
@@ -4,7 +4,7 @@
 
 ```bash
 # BUSL-1.1 (Apache-2.0 on 2030-08-31); not on PyPI — install from source
-pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"
+pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"
 signetry completion zsh >> ~/.zshrc   # optional: shell completion (bash | zsh | fish)
 ```
 
diff --git a/docs/site/scan-quickstart.md b/docs/site/scan-quickstart.md
index 0e385f6..ad7e26d 100644
--- a/docs/site/scan-quickstart.md
+++ b/docs/site/scan-quickstart.md
@@ -10,7 +10,7 @@ proving it — start at [Quickstart](quickstart.md).
 
 ```bash
 # BUSL-1.1 (Apache-2.0 on 2030-08-31); not on PyPI — install from source
-pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"
+pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"
 ```
 
 ## Scan
diff --git a/install.sh b/install.sh
index 7ab1b9b..f9afa6c 100755
--- a/install.sh
+++ b/install.sh
@@ -20,7 +20,7 @@
 set -eu
 
 # optional: SIGNETRY_VERSION=0.5.3 sh install.sh  (defaults to the latest hardened tag)
-VERSION="${SIGNETRY_VERSION:-0.6.0}"
+VERSION="${SIGNETRY_VERSION:-0.8.0}"
 SPEC="signetry-core @ git+https://github.com/Signetry/core@v${VERSION}"
 
 say() { printf '  %s\n' "$1"; }
diff --git a/integrations/git-hooks/pre-push b/integrations/git-hooks/pre-push
index 4eb9256..538db7b 100755
--- a/integrations/git-hooks/pre-push
+++ b/integrations/git-hooks/pre-push
@@ -20,7 +20,7 @@ if [[ "${SIGNETRY_SKIP:-0}" == "1" ]]; then
 fi
 
 if ! command -v signetry >/dev/null 2>&1; then
-  echo "signetry: CLI not found — install from source with 'pip install \"signetry-core @ git+https://github.com/Signetry/core@v0.7.0\"'." >&2
+  echo "signetry: CLI not found — install from source with 'pip install \"signetry-core @ git+https://github.com/Signetry/core@v0.8.0\"'." >&2
   echo "signetry: skipping the governance gate (not installed)." >&2
   exit 0
 fi
diff --git a/integrations/github-action/action.yml b/integrations/github-action/action.yml
index c4dad8a..945a447 100644
--- a/integrations/github-action/action.yml
+++ b/integrations/github-action/action.yml
@@ -46,7 +46,7 @@ runs:
     - name: Install signetry-core
       shell: bash
       # BUSL-1.1 (Apache-2.0 on 2030-08-31); not on PyPI — install from source.
-      run: pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"
+      run: pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"
 
     - name: Stage the PR change as a working-tree diff
       id: stage
diff --git a/pyproject.toml b/pyproject.toml
index 3c3783e..f7850dc 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "signetry-core"
-version = "0.7.0"
+version = "0.8.0"
 description = "An agent-agnostic change-control plane for coding agents. Governs Codex, Claude Code, Cursor, or any agent behind one admission pipeline and proves every change with a signed receipt."
 readme = "README.md"
 requires-python = ">=3.11"
diff --git a/signetry_core/mcp_server.py b/signetry_core/mcp_server.py
index 86fb652..9ad24ff 100644
--- a/signetry_core/mcp_server.py
+++ b/signetry_core/mcp_server.py
@@ -7,7 +7,7 @@
 receipt; the verdict is produced outside the model.
 
 Run it:
-    pip install "signetry-core[mcp] @ git+https://github.com/Signetry/core@v0.7.0"
+    pip install "signetry-core[mcp] @ git+https://github.com/Signetry/core@v0.8.0"
     python -m signetry_core.mcp_server        # stdio transport
 
 Register it with an MCP client (e.g. Claude Code) pointing at this command.
@@ -106,7 +106,7 @@ def build_server():  # pragma: no cover - exercised only when mcp is installed
     except ImportError as exc:  # noqa: F841
         raise SystemExit(
             "The MCP server needs the optional dependency: pip install "
-            "'signetry-core[mcp] @ git+https://github.com/Signetry/core@v0.7.0'"
+            "'signetry-core[mcp] @ git+https://github.com/Signetry/core@v0.8.0'"
         ) from None
 
     mcp = FastMCP("signetry-core")
diff --git a/uv.lock b/uv.lock
index d3967ef..9abe44b 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1258,7 +1258,7 @@ wheels = [
 
 [[package]]
 name = "signetry-core"
-version = "0.7.0"
+version = "0.8.0"
 source = { editable = "." }
 dependencies = [
     { name = "cryptography" },