From dfc4c1abd6dc7f2e514601628a5548b3d39c7165 Mon Sep 17 00:00:00 2001
From: ruv <ruv@ruv.net>
Date: Tue, 21 Jul 2026 16:07:40 -0700
Subject: [PATCH] docs(adr-184): record P1 OIDC workflow migration status
 (cc153e8b5), await pypi.org registration

---
 ...DR-184-adr117-completion-pypi-trusted-publishing.md | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/docs/adr/ADR-184-adr117-completion-pypi-trusted-publishing.md b/docs/adr/ADR-184-adr117-completion-pypi-trusted-publishing.md
index de703e9f..8e913fc0 100644
--- a/docs/adr/ADR-184-adr117-completion-pypi-trusted-publishing.md
+++ b/docs/adr/ADR-184-adr117-completion-pypi-trusted-publishing.md
@@ -300,6 +300,16 @@ migrate  promote   publish  #785
 - [ ] (fallback per §3.2) If OIDC is declined: regenerate `PYPI_API_TOKEN`, keep
   `password:` inputs, and skip the rest of P1.
 
+**Status 2026-07-21:** pip-release.yml migrated to OIDC Trusted Publishing
+(commit cc153e8b5) — id-token: write + environment: pypi on both publish jobs,
+all four PYPI_API_TOKEN password inputs removed. Awaiting the §3.1 manual Trusted
+Publisher registration on pypi.org (owner=ruvnet, repo=RuView,
+workflow=pip-release.yml, environment=pypi) for BOTH wifi-densepose and ruview
+before this path activates. Until then the publish step will fail 'no trusted
+publisher configured' if the rotated PYPI_API_TOKEN interim credential is fully
+removed — recommend keeping both paths (OIDC first with a token fallback per §3.2)
+until the OIDC path is confirmed working.
+
 ### P2 — Version promotion + changelog
 
 - [ ] `python/pyproject.toml`: `version = "2.0.0"` (drop the `a1` suffix).