docs: publish SignPath policy links

README.md

@@ -134,6 +134,7 @@ volume. See the [runtime-aligned capability reference](docs/PULSE_PRO.md) and
 - [Platform and agent guides](docs/README.md#platforms-and-agents)
 - [Pulse Intelligence](docs/AI.md)
 - [Security](SECURITY.md) and [privacy](docs/PRIVACY.md)
+- [Code signing policy](docs/CODE_SIGNING_POLICY.md)
 - [Troubleshooting](docs/TROUBLESHOOTING.md)
 - [API reference](docs/API.md) and [architecture](ARCHITECTURE.md)
 

docs/CODE_SIGNING_POLICY.md

@@ -10,7 +10,12 @@ community signing project.
 ## Signing service
 
 Pulse was accepted into the SignPath Foundation open-source programme on
-2026-08-06. The SignPath organization `Pulse [OSS]` and project `Pulse` are
+2026-08-06.
+
+> Free code signing provided by [SignPath.io](https://signpath.io/), certificate
+> by [SignPath Foundation](https://signpath.org/).
+
+The SignPath organization `Pulse [OSS]` and project `Pulse` are
 connected only to the public repository through SignPath's GitHub App and
 trusted build system. The production release certificate is still awaiting
 issuance (`CSR PENDING`), so the `release-signing` policy is not yet available

scripts/release_control/render_release_body.py

@@ -197,6 +197,8 @@ def build_installation_section(version: str) -> str:
             "",
             "See the [Installation Guide](https://github.com/rcourtman/Pulse#installation) for complete setup instructions.",
             "",
+            "Review the [Code signing policy](https://github.com/rcourtman/Pulse/blob/main/docs/CODE_SIGNING_POLICY.md) for release provenance, approval roles, and signing scope.",
+            "",
             "Paid Pulse Pro, Relay, and eligible legacy customers: public GitHub release assets and the public `rcourtman/pulse` Docker image are community builds. They do not include the private Pulse Pro runtime hooks. Use https://pulserelay.pro/download.html with your activation key to get the private Pulse Pro Docker image or Linux/LXC archive.",
         ]
     )

scripts/release_control/render_release_body_test.py

@@ -110,6 +110,10 @@ Old metadata section.
             self.assertEqual(body.count("## Installation"), 1)
             self.assertEqual(body.count("## Promotion Metadata"), 1)
             self.assertIn("docker pull rcourtman/pulse:6.0.0-rc.2", body)
+            self.assertIn(
+                "[Code signing policy](https://github.com/rcourtman/Pulse/blob/main/docs/CODE_SIGNING_POLICY.md)",
+                body,
+            )
             self.assertIn(
                 "public GitHub release assets and the public `rcourtman/pulse` Docker image are community builds",
                 body,