diff --git a/CHANGELOG.md b/CHANGELOG.md
index a92bc2117..b523b10a3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,38 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+## [5.5.2] - 2026-08-31
+
+Corrective patch release preparation. Published installation pins remain on
+`v5.5.1` until the new release assets and packages have been verified. Existing
+tags and published artifacts are not replaced.
+
+### Fixed
+- Update the locked `chacha20` dependency from yanked 0.10.0 to 0.10.2, which
+  repairs upstream's use of an SSE4.1 intrinsic in an SSE2-gated backend. The
+  dependency is reachable through `rand` and `object_store` in the evidence/MCP
+  dependency graph (#2728, #2729). This is not a claim of a reproduced Assay
+  crash or a newly discovered cryptographic weakness.
+- Bind assembled release README platform coverage to the release version and
+  reject duplicate coverage claims, including same-line duplicates (#2708,
+  #2711). Windows tests decode the generated text as UTF-8.
+- Keep the Claude plugin workflow safe to import and remove the inherited
+  credential-storage override when preparing a fresh configuration namespace
+  (#2690, #2727). This does not establish complete account isolation.
+
+### Documentation And Verification
+- The Claude plugin installation recipe includes both CLI and MCP prerequisites;
+  RFC 8785 adequacy documentation separates three declared dependency rules from
+  the wrapper control (#2723, #2666).
+- The published-release harness exercises doctor preflight, allowed requests,
+  unsupported wire requests and policy-record drift (#2670, #2669). A closed
+  protocol-gate test binds accepted revisions to public support claims (#2671).
+
+Authenticated Claude and Codex launch acceptance remains separate
+post-publication work (#2194, #2684). Synthetic transcripts and successful
+installation are not host-discovery or model-mediated invocation proof. MCP
+`2026-07-28` remains unaccepted; this patch does not activate it.
+
 ## [5.5.1] - 2026-08-30
 
 Recovery release for the unpublished `v5.5.0` attempt. It includes the changes
diff --git a/CLAUDE.md b/CLAUDE.md
index 6d7deff31..3330d57eb 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -10,7 +10,7 @@ Assay is a **Policy-as-Code** engine for Model Context Protocol (MCP) that valid
 
 ## Workspace Structure
 
-Rust monorepo, workspace version `5.5.1`, 22 workspace packages (21 under `crates/` plus
+Rust monorepo, workspace version `5.5.2`, 22 workspace packages (21 under `crates/` plus
 `assay-python-sdk`; 7 are `publish = false`). Curated view, grouped by role:
 
 ```
diff --git a/Cargo.lock b/Cargo.lock
index ef2adc0c9..b0ec6911f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -167,7 +167,7 @@ dependencies = [
 
 [[package]]
 name = "assay-adapter-a2a"
-version = "5.5.1"
+version = "5.5.2"
 dependencies = [
  "assay-adapter-api",
  "assay-evidence",
@@ -181,7 +181,7 @@ dependencies = [
 
 [[package]]
 name = "assay-adapter-acp"
-version = "5.5.1"
+version = "5.5.2"
 dependencies = [
  "assay-adapter-api",
  "assay-evidence",
@@ -195,7 +195,7 @@ dependencies = [
 
 [[package]]
 name = "assay-adapter-api"
-version = "5.5.1"
+version = "5.5.2"
 dependencies = [
  "assay-evidence",
  "hex",
@@ -207,7 +207,7 @@ dependencies = [
 
 [[package]]
 name = "assay-adapter-ucp"
-version = "5.5.1"
+version = "5.5.2"
 dependencies = [
  "assay-adapter-api",
  "assay-evidence",
@@ -221,7 +221,7 @@ dependencies = [
 
 [[package]]
 name = "assay-canonical"
-version = "5.5.1"
+version = "5.5.2"
 dependencies = [
  "hex",
  "serde",
@@ -233,7 +233,7 @@ dependencies = [
 
 [[package]]
 name = "assay-cli"
-version = "5.5.1"
+version = "5.5.2"
 dependencies = [
  "anyhow",
  "assay-canonical",
@@ -295,7 +295,7 @@ dependencies = [
 
 [[package]]
 name = "assay-common"
-version = "5.5.1"
+version = "5.5.2"
 dependencies = [
  "aya",
  "chrono",
@@ -307,7 +307,7 @@ dependencies = [
 
 [[package]]
 name = "assay-core"
-version = "5.5.1"
+version = "5.5.2"
 dependencies = [
  "anyhow",
  "assay-adapter-api",
@@ -357,7 +357,7 @@ dependencies = [
 
 [[package]]
 name = "assay-ebpf"
-version = "5.5.1"
+version = "5.5.2"
 dependencies = [
  "assay-common",
  "aya-ebpf",
@@ -366,7 +366,7 @@ dependencies = [
 
 [[package]]
 name = "assay-evidence"
-version = "5.5.1"
+version = "5.5.2"
 dependencies = [
  "anyhow",
  "assay-canonical",
@@ -403,7 +403,7 @@ dependencies = [
 
 [[package]]
 name = "assay-it"
-version = "5.5.1"
+version = "5.5.2"
 dependencies = [
  "assay-core",
  "pyo3",
@@ -415,7 +415,7 @@ dependencies = [
 
 [[package]]
 name = "assay-mcp-server"
-version = "5.5.1"
+version = "5.5.2"
 dependencies = [
  "anyhow",
  "assay-common",
@@ -445,7 +445,7 @@ dependencies = [
 
 [[package]]
 name = "assay-metrics"
-version = "5.5.1"
+version = "5.5.2"
 dependencies = [
  "anyhow",
  "assay-common",
@@ -465,7 +465,7 @@ dependencies = [
 
 [[package]]
 name = "assay-monitor"
-version = "5.5.1"
+version = "5.5.2"
 dependencies = [
  "anyhow",
  "assay-common",
@@ -480,7 +480,7 @@ dependencies = [
 
 [[package]]
 name = "assay-policy"
-version = "5.5.1"
+version = "5.5.2"
 dependencies = [
  "anyhow",
  "ipnet",
@@ -492,7 +492,7 @@ dependencies = [
 
 [[package]]
 name = "assay-registry"
-version = "5.5.1"
+version = "5.5.2"
 dependencies = [
  "anyhow",
  "assay-common",
@@ -529,7 +529,7 @@ dependencies = [
 
 [[package]]
 name = "assay-runner-core"
-version = "5.5.1"
+version = "5.5.2"
 dependencies = [
  "assay-common",
  "assay-monitor",
@@ -547,7 +547,7 @@ dependencies = [
 
 [[package]]
 name = "assay-runner-linux"
-version = "5.5.1"
+version = "5.5.2"
 dependencies = [
  "anyhow",
  "libc",
@@ -556,7 +556,7 @@ dependencies = [
 
 [[package]]
 name = "assay-runner-schema"
-version = "5.5.1"
+version = "5.5.2"
 dependencies = [
  "serde",
  "serde_json",
@@ -565,7 +565,7 @@ dependencies = [
 
 [[package]]
 name = "assay-sim"
-version = "5.5.1"
+version = "5.5.2"
 dependencies = [
  "anyhow",
  "assay-adapter-api",
@@ -586,7 +586,7 @@ dependencies = [
 
 [[package]]
 name = "assay-xtask"
-version = "5.5.1"
+version = "5.5.2"
 dependencies = [
  "anyhow",
  "clap",
@@ -2073,7 +2073,7 @@ dependencies = [
 
 [[package]]
 name = "gateway-evidence-replay"
-version = "5.5.1"
+version = "5.5.2"
 dependencies = [
  "anyhow",
  "chrono",
diff --git a/Cargo.toml b/Cargo.toml
index 4dd1e7cd7..0f67a1cdd 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -44,7 +44,7 @@ print_stdout = "allow"
 missing_errors_doc = "allow"
 
 [workspace.package]
-version = "5.5.1"
+version = "5.5.2"
 edition = "2021"
 rust-version = "1.89"
 license = "MIT"
@@ -76,19 +76,19 @@ codegen-units = 1
 
 [workspace.dependencies]
 # Internal crates
-assay-core = { path = "crates/assay-core", version = "5.5.1" }
-assay-common = { path = "crates/assay-common", version = "5.5.1", default-features = false }
-assay-monitor = { path = "crates/assay-monitor", version = "5.5.1" }
-assay-metrics = { path = "crates/assay-metrics", version = "5.5.1" }
-assay-policy = { path = "crates/assay-policy", version = "5.5.1" }
-assay-mcp-server = { path = "crates/assay-mcp-server", version = "5.5.1" }
-assay-canonical = { path = "crates/assay-canonical", version = "5.5.1" }
-assay-evidence = { path = "crates/assay-evidence", version = "5.5.1" }
-assay-sim = { path = "crates/assay-sim", version = "5.5.1" }
-assay-registry = { path = "crates/assay-registry", version = "5.5.1" }
-assay-runner-schema = { path = "crates/assay-runner-schema", version = "5.5.1" }
-assay-runner-core = { path = "crates/assay-runner-core", version = "5.5.1" }
-assay-runner-linux = { path = "crates/assay-runner-linux", version = "5.5.1" }
+assay-core = { path = "crates/assay-core", version = "5.5.2" }
+assay-common = { path = "crates/assay-common", version = "5.5.2", default-features = false }
+assay-monitor = { path = "crates/assay-monitor", version = "5.5.2" }
+assay-metrics = { path = "crates/assay-metrics", version = "5.5.2" }
+assay-policy = { path = "crates/assay-policy", version = "5.5.2" }
+assay-mcp-server = { path = "crates/assay-mcp-server", version = "5.5.2" }
+assay-canonical = { path = "crates/assay-canonical", version = "5.5.2" }
+assay-evidence = { path = "crates/assay-evidence", version = "5.5.2" }
+assay-sim = { path = "crates/assay-sim", version = "5.5.2" }
+assay-registry = { path = "crates/assay-registry", version = "5.5.2" }
+assay-runner-schema = { path = "crates/assay-runner-schema", version = "5.5.2" }
+assay-runner-core = { path = "crates/assay-runner-core", version = "5.5.2" }
+assay-runner-linux = { path = "crates/assay-runner-linux", version = "5.5.2" }
 
 # Common dependencies
 anyhow = "1"
diff --git a/crates/assay-adapter-a2a/Cargo.toml b/crates/assay-adapter-a2a/Cargo.toml
index 83bf85c75..1b8dc6389 100644
--- a/crates/assay-adapter-a2a/Cargo.toml
+++ b/crates/assay-adapter-a2a/Cargo.toml
@@ -10,8 +10,8 @@ readme.workspace = true
 publish = false
 
 [dependencies]
-assay-adapter-api = { path = "../assay-adapter-api", version = "5.5.1" }
-assay-evidence = { path = "../assay-evidence", version = "5.5.1" }
+assay-adapter-api = { path = "../assay-adapter-api", version = "5.5.2" }
+assay-evidence = { path = "../assay-evidence", version = "5.5.2" }
 serde = { workspace = true, features = ["derive", "std"] }
 serde_json = { workspace = true, features = ["std"] }
 chrono = { workspace = true, features = ["std"] }
diff --git a/crates/assay-adapter-acp/Cargo.toml b/crates/assay-adapter-acp/Cargo.toml
index 55195e35c..87bdb49db 100644
--- a/crates/assay-adapter-acp/Cargo.toml
+++ b/crates/assay-adapter-acp/Cargo.toml
@@ -10,8 +10,8 @@ readme.workspace = true
 publish = false
 
 [dependencies]
-assay-adapter-api = { path = "../assay-adapter-api", version = "5.5.1" }
-assay-evidence = { path = "../assay-evidence", version = "5.5.1" }
+assay-adapter-api = { path = "../assay-adapter-api", version = "5.5.2" }
+assay-evidence = { path = "../assay-evidence", version = "5.5.2" }
 serde = { workspace = true, features = ["derive", "std"] }
 serde_json = { workspace = true, features = ["std"] }
 chrono = { workspace = true, features = ["std"] }
diff --git a/crates/assay-adapter-api/Cargo.toml b/crates/assay-adapter-api/Cargo.toml
index 05397415a..876380cc8 100644
--- a/crates/assay-adapter-api/Cargo.toml
+++ b/crates/assay-adapter-api/Cargo.toml
@@ -24,7 +24,7 @@ readme.workspace = true
 publish = true
 
 [dependencies]
-assay-evidence = { path = "../assay-evidence", version = "5.5.1" }
+assay-evidence = { path = "../assay-evidence", version = "5.5.2" }
 serde = { workspace = true, features = ["derive", "std"] }
 serde_json = { workspace = true, features = ["std"] }
 thiserror = { workspace = true }
diff --git a/crates/assay-adapter-ucp/Cargo.toml b/crates/assay-adapter-ucp/Cargo.toml
index fa24ed40d..9c1e66826 100644
--- a/crates/assay-adapter-ucp/Cargo.toml
+++ b/crates/assay-adapter-ucp/Cargo.toml
@@ -10,8 +10,8 @@ readme.workspace = true
 publish = false
 
 [dependencies]
-assay-adapter-api = { path = "../assay-adapter-api", version = "5.5.1" }
-assay-evidence = { path = "../assay-evidence", version = "5.5.1" }
+assay-adapter-api = { path = "../assay-adapter-api", version = "5.5.2" }
+assay-evidence = { path = "../assay-evidence", version = "5.5.2" }
 serde = { workspace = true, features = ["derive", "std"] }
 serde_json = { workspace = true, features = ["std"] }
 chrono = { workspace = true, features = ["std"] }
diff --git a/crates/assay-core/Cargo.toml b/crates/assay-core/Cargo.toml
index 3b1fc519d..7de6cedf1 100644
--- a/crates/assay-core/Cargo.toml
+++ b/crates/assay-core/Cargo.toml
@@ -21,7 +21,7 @@ kill-switch-capture = ["kill-switch", "dep:procfs"]
 runtime-monitor = []
 
 [dependencies]
-assay-adapter-api = { path = "../assay-adapter-api", version = "5.5.1" }
+assay-adapter-api = { path = "../assay-adapter-api", version = "5.5.2" }
 assay-common = { workspace = true, features = ["std"] }
 anyhow.workspace = true
 async-trait.workspace = true
diff --git a/crates/assay-sim/Cargo.toml b/crates/assay-sim/Cargo.toml
index 0608d4786..a43b60590 100644
--- a/crates/assay-sim/Cargo.toml
+++ b/crates/assay-sim/Cargo.toml
@@ -23,6 +23,6 @@ sha2 = { workspace = true }
 hex = { workspace = true }
 tempfile = { workspace = true }
 
-assay-adapter-api = { path = "../assay-adapter-api", version = "5.5.1" }
+assay-adapter-api = { path = "../assay-adapter-api", version = "5.5.2" }
 assay-core = { workspace = true }
 assay-evidence = { workspace = true }
diff --git a/docs/generated/agent-golden-path.json b/docs/generated/agent-golden-path.json
index e6e62ec32..88852012d 100644
--- a/docs/generated/agent-golden-path.json
+++ b/docs/generated/agent-golden-path.json
@@ -2,8 +2,8 @@
   "schema": "assay.agent_golden_path.v1",
   "schema_version": 1,
   "generated_by": "scripts/docs/generate-agent-golden-path.py",
-  "source_version": "5.5.1",
-  "source_tag": "v5.5.1",
+  "source_version": "5.5.2",
+  "source_tag": "v5.5.2",
   "release_version": "5.5.1",
   "release_tag": "v5.5.1",
   "source_issue": 2154,
diff --git a/docs/guides/agent-golden-path.md b/docs/guides/agent-golden-path.md
index 50f15dfb9..8f781d14c 100644
--- a/docs/guides/agent-golden-path.md
+++ b/docs/guides/agent-golden-path.md
@@ -17,7 +17,7 @@ angle brackets are replaced with temporary files or committed fixtures.
 <!-- agent-golden-path-release:start -->
 ## Release-pinned start
 
-This source tree declares Assay `5.5.1` (`v5.5.1`).
+This source tree declares Assay `5.5.2` (`v5.5.2`).
 This journey is pinned to Assay `5.5.1` ([`v5.5.1`](https://github.com/Rul1an/assay/releases/tag/v5.5.1)).
 Install the CLI from a verified channel, then require `assay version` to print `5.5.1` before using the table below. Behavior merged after that tag is `Unreleased` and is not part of this release claim.
 
diff --git a/fuzz/Cargo.lock b/fuzz/Cargo.lock
index cd15355a1..984d12e32 100644
--- a/fuzz/Cargo.lock
+++ b/fuzz/Cargo.lock
@@ -60,7 +60,7 @@ checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
 
 [[package]]
 name = "assay-adapter-api"
-version = "5.5.1"
+version = "5.5.2"
 dependencies = [
  "assay-evidence",
  "hex",
@@ -72,7 +72,7 @@ dependencies = [
 
 [[package]]
 name = "assay-canonical"
-version = "5.5.1"
+version = "5.5.2"
 dependencies = [
  "hex",
  "serde",
@@ -84,7 +84,7 @@ dependencies = [
 
 [[package]]
 name = "assay-common"
-version = "5.5.1"
+version = "5.5.2"
 dependencies = [
  "chrono",
  "libc",
@@ -95,7 +95,7 @@ dependencies = [
 
 [[package]]
 name = "assay-core"
-version = "5.5.1"
+version = "5.5.2"
 dependencies = [
  "anyhow",
  "assay-adapter-api",
@@ -140,7 +140,7 @@ dependencies = [
 
 [[package]]
 name = "assay-evidence"
-version = "5.5.1"
+version = "5.5.2"
 dependencies = [
  "anyhow",
  "assay-canonical",
@@ -327,9 +327,9 @@ checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
 
 [[package]]
 name = "chacha20"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
  "cpufeatures",
diff --git a/packaging/agent-plugin/plugin.json b/packaging/agent-plugin/plugin.json
index 3d2d1dca5..cf4bfd80f 100644
--- a/packaging/agent-plugin/plugin.json
+++ b/packaging/agent-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "assay",
-  "version": "5.5.1",
+  "version": "5.5.2",
   "description": "Operate Assay's install-to-evidence golden path with explicit failure boundaries.",
   "author": {
     "name": "Assay"
diff --git a/packaging/agent-plugin/skills/assay-golden-path/references/agent-golden-path.json b/packaging/agent-plugin/skills/assay-golden-path/references/agent-golden-path.json
index e6e62ec32..88852012d 100644
--- a/packaging/agent-plugin/skills/assay-golden-path/references/agent-golden-path.json
+++ b/packaging/agent-plugin/skills/assay-golden-path/references/agent-golden-path.json
@@ -2,8 +2,8 @@
   "schema": "assay.agent_golden_path.v1",
   "schema_version": 1,
   "generated_by": "scripts/docs/generate-agent-golden-path.py",
-  "source_version": "5.5.1",
-  "source_tag": "v5.5.1",
+  "source_version": "5.5.2",
+  "source_tag": "v5.5.2",
   "release_version": "5.5.1",
   "release_tag": "v5.5.1",
   "source_issue": 2154,
diff --git a/packaging/claude-plugin/skills/assay-golden-path/references/agent-golden-path.json b/packaging/claude-plugin/skills/assay-golden-path/references/agent-golden-path.json
index e6e62ec32..88852012d 100644
--- a/packaging/claude-plugin/skills/assay-golden-path/references/agent-golden-path.json
+++ b/packaging/claude-plugin/skills/assay-golden-path/references/agent-golden-path.json
@@ -2,8 +2,8 @@
   "schema": "assay.agent_golden_path.v1",
   "schema_version": 1,
   "generated_by": "scripts/docs/generate-agent-golden-path.py",
-  "source_version": "5.5.1",
-  "source_tag": "v5.5.1",
+  "source_version": "5.5.2",
+  "source_tag": "v5.5.2",
   "release_version": "5.5.1",
   "release_tag": "v5.5.1",
   "source_issue": 2154,