docs(v1): synchronize published stable state

.github/workflows/v1-post-release-metadata-sync.yml

@@ -0,0 +1,68 @@
+name: V1 Post-Release Metadata Sync
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - 'docs/releases/v1.0.0.md'
+      - '.github/workflows/v1-post-release-metadata-sync.yml'
+  push:
+    branches: [main]
+    paths:
+      - 'docs/releases/v1.0.0.md'
+      - '.github/workflows/v1-post-release-metadata-sync.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    name: Validate published v1 metadata source
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Validate repository release record and live stable release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          grep -F 'PUBLISHED STABLE RELEASE — INTERNALLY QUALIFIED BOUNDED' docs/releases/v1.0.0.md
+          grep -F 'Independent external validation is not claimed' docs/releases/v1.0.0.md
+          grep -F '37771109825' docs/releases/v1.0.0.md
+          grep -F '37771295572' docs/releases/v1.0.0.md
+          gh release view v1.0.0 --repo "$GITHUB_REPOSITORY" \
+            --json tagName,isDraft,isPrerelease \
+            --jq 'select(.tagName == "v1.0.0" and .isDraft == false and .isPrerelease == false)' >/dev/null
+
+  sync:
+    name: Synchronize GitHub Release body
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    needs: validate
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Replace release body without changing tag or maturity
+        env:
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          before="$(gh release view v1.0.0 --repo "$GITHUB_REPOSITORY" --json tagName,isDraft,isPrerelease)"
+          python3 -c 'import json,sys; d=json.loads(sys.argv[1]); assert d["tagName"]=="v1.0.0"; assert d["isDraft"] is False; assert d["isPrerelease"] is False' "$before"
+
+          gh release edit v1.0.0 \
+            --repo "$GITHUB_REPOSITORY" \
+            --notes-file docs/releases/v1.0.0.md
+
+          after="$(gh release view v1.0.0 --repo "$GITHUB_REPOSITORY" --json tagName,isDraft,isPrerelease,body)"
+          python3 -c 'import json,sys; d=json.loads(sys.argv[1]); assert d["tagName"]=="v1.0.0"; assert d["isDraft"] is False; assert d["isPrerelease"] is False; assert "PUBLISHED STABLE RELEASE — INTERNALLY QUALIFIED BOUNDED" in d["body"]; assert "PUBLICATION PENDING" not in d["body"]' "$after"

.github/workflows/v1-r1-release-control-plane.yml

@@ -28,15 +28,15 @@ jobs:
         run: cargo test --locked -p execsurface --test v1_release_control_plane -- --test-threads=1 --nocapture
 
   synthetic-v1-dry-contract:
-    name: Synthetic stable-v1 classification / no publication
+    name: Published stable-v1 contract / classifier regression
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
-      - name: Active request is frozen RC or explicitly authorized stable v1
+      - name: Active request and records identify the published stable v1 state
         shell: bash
         run: |
           set -euo pipefail
@@ -45,26 +45,18 @@ jobs:
           from pathlib import Path
 
           data=json.load(open(".release/release-request.json"))
-          rc_unarmed = data == {
-              "version":"0.1.0-alpha.6",
-              "tag":"v0.1.0-alpha.6",
-              "stable_channel":"v0.1",
-              "request_revision":1,
-          }
-          release_armed = data == {
+          assert data == {
               "version":"1.0.0",
               "tag":"v1.0.0",
               "stable_channel":"v1",
               "request_revision":2,
           }
 
-          if release_armed:
-              decision=Path("docs/release/V1_0_0_RELEASE_DECISION.md").read_text()
-              notes=Path("docs/releases/v1.0.0.md").read_text()
-              assert "RELEASE_V1_0_AUTHORIZED_BOUNDED" in decision
-              assert "PUBLICATION PENDING" in notes
-
-          assert rc_unarmed or release_armed
+          decision=Path("docs/release/V1_0_0_RELEASE_DECISION.md").read_text()
+          notes=Path("docs/releases/v1.0.0.md").read_text()
+          assert "RELEASE_V1_0_AUTHORIZED_BOUNDED" in decision
+          assert "PUBLISHED STABLE RELEASE — INTERNALLY QUALIFIED BOUNDED" in notes
+          assert "Independent external validation is not claimed" in notes
           PY
 
       - name: Classify current Alpha line
@@ -98,17 +90,21 @@ jobs:
           fi
 
   no-v1-side-effects:
-    name: No v1 tag/channel side effect during V1-R1
+    name: Published v1 tag/channel source identity
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
-      - name: Prove V1-R1 did not publish v1 refs
+      - name: Prove published moving and immutable refs resolve to one source
         shell: bash
         run: |
           set -euo pipefail
-          test -z "$(git ls-remote --tags origin refs/tags/v1)"
-          test -z "$(git ls-remote --tags origin refs/tags/v1.0.0)"
+          git fetch --force --tags origin
+          stable_sha="$(git rev-parse 'v1^{commit}')"
+          immutable_sha="$(git rev-parse 'v1.0.0^{commit}')"
+          test "$stable_sha" = "$immutable_sha"
+          git merge-base --is-ancestor "$immutable_sha" HEAD
+          test "$(git show v1.0.0:action/release-tag.txt | tr -d '[:space:]')" = "v1.0.0"

.github/workflows/v1-rc1-internal-qualification.yml

@@ -38,7 +38,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Prove v1 release state is frozen or explicitly authorized
+      - name: Prove published v1 release state is exact and bounded
         shell: bash
         run: |
           set -euo pipefail
@@ -50,35 +50,35 @@ jobs:
           from pathlib import Path
 
           request=json.load(open(".release/release-request.json"))
-          rc_unarmed = request == {
-              "version":"0.1.0-alpha.6",
-              "tag":"v0.1.0-alpha.6",
-              "stable_channel":"v0.1",
-              "request_revision":1,
-          }
-          release_armed = request == {
+          assert request == {
               "version":"1.0.0",
               "tag":"v1.0.0",
               "stable_channel":"v1",
               "request_revision":2,
           }
 
-          if release_armed:
-              decision=Path("docs/release/V1_0_0_RELEASE_DECISION.md").read_text()
-              notes=Path("docs/releases/v1.0.0.md").read_text()
-              assert "RELEASE_V1_0_AUTHORIZED_BOUNDED" in decision
-              assert "PUBLICATION PENDING" in notes
+          decision=Path("docs/release/V1_0_0_RELEASE_DECISION.md").read_text()
+          notes=Path("docs/releases/v1.0.0.md").read_text()
+          readme=Path("README.md").read_text()
+          status=Path("docs/STATUS.md").read_text()
 
-          assert rc_unarmed or release_armed
+          assert "RELEASE_V1_0_AUTHORIZED_BOUNDED" in decision
+          assert "PUBLISHED STABLE RELEASE — INTERNALLY QUALIFIED BOUNDED" in notes
+          assert "Current stable release" in readme and "v1.0.0" in readme
+          assert "Public release: `v1.0.0`" in status
+          assert "Independent external validation is not claimed" in notes
           PY
-          grep -F 'v0.1.0-alpha.6' README.md >/dev/null
-          grep -F 'v0.1.0-alpha.6' docs/STATUS.md >/dev/null
 
-      - name: Prove qualification has not created public v1 refs
+      - name: Prove published v1 channel and immutable tag resolve to one release source
         shell: bash
         run: |
           set -euo pipefail
-          test -z "$(git ls-remote --tags origin refs/tags/v1 refs/tags/v1.0.0)"
+          git fetch --force --tags origin
+          stable_sha="$(git rev-parse 'v1^{commit}')"
+          immutable_sha="$(git rev-parse 'v1.0.0^{commit}')"
+          test "$stable_sha" = "$immutable_sha"
+          git merge-base --is-ancestor "$immutable_sha" HEAD
+          test "$(git show v1.0.0:action/release-tag.txt | tr -d '[:space:]')" = "v1.0.0"
 
       - name: Attack RC identity, generated channel and registry chain
         run: cargo test --locked -p execsurface --test v1_internal_rc1 -- --test-threads=1 --nocapture
@@ -296,6 +296,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          fetch-depth: 0
           persist-credentials: false
       - name: Re-read repository rulesets and classify admin state
         env:
@@ -311,13 +312,14 @@ jobs:
             printf '\n' >> "$evidence"
           done
 
-          if python3 .github/scripts/verify_tag_ruleset.py --rulesets-jsonl "$evidence" --tag v1.0.0; then
-            echo "IQ6_GOVERNANCE_READY"
-          else
-            echo "IQ6_ADMIN_PENDING"
-          fi
+          python3 .github/scripts/verify_tag_ruleset.py --rulesets-jsonl "$evidence" --tag v1.0.0
+          echo "IQ6_GOVERNANCE_READY"
 
-          test -z "$(git ls-remote --tags origin refs/tags/v1 refs/tags/v1.0.0)"
+          git fetch --force --tags origin
+          stable_sha="$(git rev-parse 'v1^{commit}')"
+          immutable_sha="$(git rev-parse 'v1.0.0^{commit}')"
+          test "$stable_sha" = "$immutable_sha"
+          git merge-base --is-ancestor "$immutable_sha" HEAD
 
 
   iq8-destruction-round-b:
@@ -340,11 +342,15 @@ jobs:
       - name: Execute release-lifecycle destruction corpus
         run: cargo test --locked -p execsurface --test v1_internal_destruction_b -- --test-threads=1 --nocapture
 
-      - name: Re-prove no v1 public refs exist
+      - name: Re-prove published v1 refs remain source-identical
         shell: bash
         run: |
           set -euo pipefail
-          test -z "$(git ls-remote --tags origin refs/tags/v1 refs/tags/v1.0.0)"
+          git fetch --force --tags origin
+          stable_sha="$(git rev-parse 'v1^{commit}')"
+          immutable_sha="$(git rev-parse 'v1.0.0^{commit}')"
+          test "$stable_sha" = "$immutable_sha"
+          git merge-base --is-ancestor "$immutable_sha" HEAD
 
       - name: Build candidate for cross-version custody attack
         shell: bash

.github/workflows/v1-release-arming.yml

@@ -40,28 +40,33 @@ jobs:
           printf '%s\n' "$out"
           python3 -c 'import json,sys; d=json.load(sys.stdin); assert d["version"]=="1.0.0"; assert d["tag"]=="v1.0.0"; assert d["stable_channel"]=="v1"; assert d["release_kind"]=="stable"; assert d["is_prerelease"] is False; assert d["request_revision"]==2' <<<"$out"
 
-      - name: Prove release records are prepared but public status is not pre-announced
+      - name: Prove published stable-v1 records and public status
         shell: bash
         run: |
           set -euo pipefail
           test -s docs/releases/v1.0.0.md
           test -s docs/release/V1_0_0_RELEASE_DECISION.md
           grep -F 'RELEASE_V1_0_AUTHORIZED_BOUNDED' docs/release/V1_0_0_RELEASE_DECISION.md
+          grep -F 'PUBLISHED STABLE RELEASE — INTERNALLY QUALIFIED BOUNDED' docs/releases/v1.0.0.md
           grep -F 'Independent external validation is not claimed' docs/releases/v1.0.0.md
-          grep -F 'v0.1.0-alpha.6' README.md
-          grep -F 'Public release: `v0.1.0-alpha.6`' docs/STATUS.md
+          grep -F 'Current stable release' README.md
+          grep -F 'v1.0.0' README.md
+          grep -F 'Public release: `v1.0.0`' docs/STATUS.md
 
-      - name: Prove stable refs and release do not exist before arming merge
+      - name: Prove stable refs and GitHub Release exist with stable maturity
         env:
           GH_TOKEN: ${{ github.token }}
         shell: bash
         run: |
           set -euo pipefail
-          test -z "$(git ls-remote --tags origin refs/tags/v1 refs/tags/v1.0.0)"
-          if gh release view v1.0.0 --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
-            echo "::error::v1.0.0 GitHub Release already exists before arming merge"
-            exit 1
-          fi
+          git fetch --force --tags origin
+          stable_sha="$(git rev-parse 'v1^{commit}')"
+          immutable_sha="$(git rev-parse 'v1.0.0^{commit}')"
+          test "$stable_sha" = "$immutable_sha"
+          git merge-base --is-ancestor "$immutable_sha" HEAD
+          gh release view v1.0.0 --repo "$GITHUB_REPOSITORY" \
+            --json tagName,isDraft,isPrerelease \
+            --jq 'select(.tagName == "v1.0.0" and .isDraft == false and .isPrerelease == false)' >/dev/null
 
   immutable-tag-governance:
     name: Immutable v1 tag governance

CHANGELOG.md

@@ -4,7 +4,29 @@ All notable public-product changes are recorded here. The detailed pre-Alpha.5 e
 
 ## Unreleased
 
-- No unreleased public-product changes after Alpha.6 release preparation.
+- No unreleased public-product changes after the v1.0.0 stable release.
+
+## v1.0.0 — 2026-10-08
+
+### Stable contract
+
+- Published the first stable ExecSurface release for the documented Linux x86_64 + native ptrace boundary.
+- Froze PASS=0, ERROR=2, REVIEW=10, BLOCK=20 semantics and retained fail-closed incomplete-evidence behavior.
+- Froze the target-outcome separation: ExecSurface PASS does not prove the wrapped target command succeeded.
+- Preserved Alpha.6 profile-4 upgrade/rollback compatibility and explicit Alpha.5 profile-3 incompatibility.
+- Preserved policy schemas v1/v2 and opt-in v3 matcher semantics.
+
+### Release and distribution
+
+- Published stable GitHub Release `v1.0.0` with checksum and GitHub provenance attestation.
+- Promoted stable Action channel `AETHERXGLOBAL/execsurface@v1` only after immutable artifact and Action consumer proofs.
+- Published the full crates.io dependency chain and proved exact zero-contact installation of `execsurface = 1.0.0`.
+- Protected immutable `v1.*` release tags against update/deletion with no bypass actors.
+
+Release workflow: `37771109825`.  
+Registry publication workflow: `37771295572`.
+
+Independent external validation is not claimed.
 
 ## v0.1.0-alpha.6 — 2026-10-08