docs(changelog): record today's distribution wins and classifier upgrades

Backfills the [Unreleased] section with what shipped between 179f1e9
and 561bbd7 — none of it had landed in the changelog yet.

Added (new):
  - public npm distribution (3 packages live, OIDC Trusted Publishing)
  - Official MCP Registry listing (io.github.toonight/mnemoscope @ 0.1.1)
  - Obsidian community plugin PR (#12354, "Ready for review")
  - classifier principled synthetic baseline (1k rows, multi-family,
    auditable metadata)
  - classifier dogfood harness (collect_measurements.py + DOGFOOD.md)

Changed (new sub-section):
  - release workflow on npm OIDC, NPM_TOKEN no longer needed
  - mcp-server bumped to 0.1.1 for MCP Registry validation
  - README roadmap + "What works today" reflect the day's wins
  - Obsidian manifests aligned (description, authorUrl)

Fixed (new sub-section):
  - cli package.json bin paths committed in their npm-canonical form
    (no leading ./), so the tree matches what the registry serves.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: 2 people

CHANGELOG.md

@@ -6,6 +6,11 @@ All notable changes to Mnemoscope are documented here. The project follows [Keep
 
 ### Added
 
+- **Public npm distribution** — `@mnemoscope/core@0.1.0`, `@mnemoscope/mcp-server@0.1.1` and `@mnemoscope/cli@0.1.0` are live on the npm registry under the `@mnemoscope` org. The bootstrap publish (manual, for the first version of each package) was followed by registering [npm OIDC Trusted Publishing](https://docs.npmjs.com/trusted-publishers/) for the GitHub Actions workflow `release.yml` on every package, so subsequent releases authenticate via short-lived OIDC tokens rather than a rotating `NPM_TOKEN` secret. Provenance attestations are emitted automatically.
+- **Official MCP Registry listing** — `io.github.toonight/mnemoscope @ 0.1.1` is indexed at [registry.modelcontextprotocol.io](https://registry.modelcontextprotocol.io/v0/servers?search=mnemoscope). PulseMCP and other downstream catalogs ingest the official registry on a daily/weekly cadence so listing here fans out automatically. Surface area: `server.json` at the repo root declares the `io.github.toonight/mnemoscope` namespace, points at the npm package, and tags the server `memory / developer-tools / knowledge-management`.
+- **Obsidian community plugin submission** — pull request [obsidianmd/obsidian-releases#12354](https://github.com/obsidianmd/obsidian-releases/pull/12354) is open and labelled "Ready for review" (the automated `plugin-validation` workflow is green). Required pre-conditions baked in along the way: a `manifest.json` mirror at the repo root for Obsidian's validator to fetch, an extra GitHub release tagged `0.1.0` (no `v` prefix) carrying the three required plugin assets (`main.js`, `manifest.json`, `styles.css`), an `authorUrl` pointing at the author profile rather than the plugin repo, and the description in `community-plugins.json` kept in lockstep with the description in the plugin's `manifest.json`.
+- **Predictive context-rot classifier — principled synthetic baseline.** The classifier ships with a 1 000-row synthetic training set (`research/classifier/synthetic-large.csv`) generated by `research/classifier/generate_synthetic.py` (deterministic, seed=42). Each row's label is the same v0 heuristic the runtime uses (mean of the 5 factors, normalised to 0..1) plus 0.05 σ Gaussian noise, so the resulting model is a smooth interpolant of the heuristic — safe to swap in at runtime. `train.py` now compares **three model families** (Ridge, Random Forest, Gradient Boosting) on the same held-out split and exports the best to ONNX. On the synthetic baseline Ridge wins (R² = 0.85, MAE = 0.04), as expected because the synthetic label is a noisy linear combination; with real measurements RF/GBR are expected to take over. A `model.json` metadata file records per-family metrics + ONNX round-trip delta so every published model is auditable.
+- **Predictive context-rot classifier — dogfood harness.** New `research/classifier/collect_measurements.py` builds N procedurally-varied synthetic vaults (Pareto-skewed note-size distribution, controllable redundancy / distractor / heading / link / freshness axes), computes their signatures via a Python port of `@mnemoscope/core/src/rot-score.ts` (bit-for-bit identical), runs `replication.run.run_cell` against an OpenAI-compatible endpoint (`MMB_LLM_API_KEY`), and writes a `measurements.csv` ready for `train.py`. Safety rails: `--dry-run` (no LLM calls, prints signatures only) for budget estimation; rows produced offline are tagged `offline=1` and `--offline-ok` is required to write them. `research/classifier/DOGFOOD.md` is the runbook with cost estimates per provider (OpenAI, Anthropic, local Ollama) and success criteria for a useful collection (RF/GBR > Ridge, R² ∈ [0.4, 0.7], per-factor variance > ~10).
 - `mnemoscope-init` CLI that bootstraps `<vault>/.mnemoscope/` (creates state dir, generates per-vault Ed25519 keypair, writes a small README explaining the directory). Idempotent.
 - Obsidian plugin upgrade: real sidebar view with an SVG rot-risk gauge, per-factor breakdown bars, top-risk-notes list, and a settings tab to tune working/episodic age thresholds and toggle auto-scan on Obsidian open. Bundle grew from 8 KB to 15 KB.
 - `.github/workflows/release.yml` — pushes a `v*.*.*` tag to publish `@mnemoscope/{core,mcp-server,cli}` to npm with provenance and create a matching GitHub Release. Requires `NPM_TOKEN` repo secret.
@@ -19,6 +24,17 @@ All notable changes to Mnemoscope are documented here. The project follows [Keep
 - **Obsidian onboarding auto** — on first layout-ready, the plugin checks whether `<vault>/.mnemoscope/` exists; if not, it surfaces a one-time modal that explains the four files that initialization will create and offers an "Initialize" button (mirrors `mnemoscope-init` on disk: mkdir, generate Ed25519 keypair via `Journal.open`, write a small README, mode 0600 enforced by core). The modal is gated by a new `onboardingDismissed` setting so it never nags. A "Initialize this vault for Mnemoscope" command and a settings-tab button also let the user trigger init manually. Plugin bundle grew from 15 KB to 28 KB (Journal pulled into the plugin path).
 - **OpenTimestamps anchoring** — new `core/timestamp.ts` module + `mnemoscope-timestamp` CLI. Each journal entry's signature is hashed (SHA-256) and POSTed to a public OTS calendar; the calendar's response is composed with the OTS magic+version+digest header into a valid `.ots` file stored at `<vault>/.mnemoscope/timestamps/<sigHashHex>.ots`. Idempotent (re-runs make zero network requests). `--dry-run` and `--calendar URL` supported. Local verification confirms the OTS file structurally references the right digest; full Bitcoin upgrade and verification are intentionally delegated to the upstream `ots upgrade` / `ots verify` CLIs from `opentimestamps-client`. 12 new unit tests cover the round-trip, digest mismatch, magic mismatch, calendar-error surfacing, empty-body rejection, and stubbed-fetch payload shape. Smoke-tested end-to-end against a fake local calendar (3 entries → 3 .ots files, second pass = 3 already proved). Full threat model and upgrade flow documented in `docs/timestamping.md`.
 
+### Changed
+
+- **Release workflow now uses npm OIDC Trusted Publishing** — `.github/workflows/release.yml` no longer carries `NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}` on the publish steps. The job upgrades npm to ≥ 11.5.1 (Node 22 still ships with 10.x) and relies on the `id-token: write` permission already granted to the workflow. Provenance attestations are emitted on every publish.
+- **`@mnemoscope/mcp-server` bumped to 0.1.1** to gain the `mcpName: "io.github.toonight/mnemoscope"` field that the official MCP Registry validator requires. `@mnemoscope/core` and `@mnemoscope/cli` stay at 0.1.0; the change is local to mcp-server.
+- **README "What works today" + "Roadmap"** updated to reflect the npm + MCP Registry shipping. Three roadmap items moved to *Done*: npm publish (via OIDC), MCP Registry listing, and the Obsidian community plugin submission. Periodic remote attestation moved to *Done* on the strength of the OpenTimestamps anchoring already shipped above. The classifier scientific-posture row now describes the multi-family comparison and points at `model.json` for auditable metrics.
+- **Obsidian plugin manifest** description aligned with the `community-plugins.json` entry; `authorUrl` switched from the plugin repo to the author profile (`https://github.com/toonight`) per Obsidian community policy. Both the in-tree manifest (`packages/obsidian-plugin/manifest.json`) and the root mirror (`manifest.json`) carry identical content.
+
+### Fixed
+
+- `packages/cli/package.json` — committed the `bin` paths in their npm-canonical form (`dist/init.js` etc., no leading `./`). npm 11 silently strips the prefix on publish, so the working tree previously drifted from what the registry actually serves.
+
 ## [0.1.0] — 2026-04-26
 
 First public, *production-grade* release. The previous tag was a scaffold; this release adds the things that make the scaffold actually load-bearing: chained Ed25519 signatures, a Claude Code auto-journal hook, integration tests against the real MCP server, and a complete research sub-project.