release: v1.3.0

CHANGELOG.md

@@ -7,6 +7,29 @@ Open problems and known blockers are tracked separately in
 
 ## [2026-09-14]
 
+### Added
+- **PR #266** — deliverables: added `deliverables/official-docs/`, an official
+  documentation registry for the tools and services this project depends on.
+  `src/official-docs.json` carries the registry and `src/official_docs.py`
+  (Python) plus `src/official-docs.js` / `src/utils.ts` (JS/TS) read it from
+  either side of the stack. Every link is verified rather than assumed:
+  `scripts/verify_links.py` checks the registry against the live URLs and
+  `tests/test_official_docs.py` / `tests/official-docs.test.mjs` cover the
+  loaders. The React side (`src/Company.jsx` + `Company.module.css`) renders a
+  docs bar and an image gallery from the same registry, so the UI cannot drift
+  from the data; `scripts/export_registry.mjs` and `scripts/render_smoke.mjs`
+  round out the build-and-check path.
+- **PR #265** — deliverables: added `deliverables/fig-best-practices/`, a
+  quality gate for projects built on the Fig platform. `BEST-PRACTICES.md` is the
+  policy, `SKILL.yaml` wires it up as a skill, and the checker engine runs it
+  against a project tree; `ci/quality-gate.yml` is the GitHub Actions entry
+  point. Six agent briefs (`agents/developer.md`, `reviewer.md`, `security.md`,
+  `designer.md`, `performance.md`, `deployment.md`) state what each role is
+  expected to enforce, and `design/design-tokens.json` holds the shared tokens.
+  Two fixture projects ship with it — `examples/broken-project/` and
+  `examples/clean-project/` — so the gate is exercised against a known-bad and a
+  known-good tree rather than only in the happy path. 69 tests.
+
 ### Changed
 - **PR #269** — rewrote `README.md` so it matches the repository as it stands
   (+119/−767). The previous content was a pasted CI/CD-and-branch-strategy draft

docs/releases/v1.3.0.md

@@ -0,0 +1,106 @@
+## Version
+
+v1.3.0
+
+## What's included
+
+Minor release cut from `main`. Since `v1.2.0` (`a461cf3`, 2026-09-12) — 94 commits,
+of which 37 landed as merged PRs.
+
+**Added — deliverables**
+- **PR #266** — `deliverables/official-docs/`: an official documentation registry.
+  One JSON registry (`src/official-docs.json`) read from both sides of the stack
+  (`src/official_docs.py`, `src/official-docs.js`, `src/utils.ts`), every link
+  checked against the live URL by `scripts/verify_links.py` rather than assumed,
+  and a React docs bar + image gallery (`src/Company.jsx`) rendered from the same
+  registry so the UI cannot drift from the data.
+- **PR #265** — `deliverables/fig-best-practices/`: a quality gate for projects
+  built on the Fig platform. `BEST-PRACTICES.md` is the policy, six agent briefs
+  (developer / reviewer / security / designer / performance / deployment) state
+  who enforces what, `ci/quality-gate.yml` is the Actions entry point, and two
+  fixture projects — a known-bad and a known-good tree — exercise the gate.
+  69 tests.
+- **PR #258** — `deliverables/ci/`: the full CI/CD pipeline (orchestrator plus
+  reusable workflows).
+- **PR #238** — skills: `pr-triage-automove`, the automated form of
+  `organize-misplaced-files`. A root file is moved only when it is not canonical,
+  no tracked `.py` imports it (AST-parsed), and its name appears in no other
+  tracked file. Wrapped in an import probe so a poisoned import cannot kill the
+  run; dry-run by default, `--apply` required. 37 tests.
+- **PR #235** — `deliverables/agent-core/`: Dockerfile and Helm chart.
+- **PR #240** — skills: `ci-workflow-authoring` plus `lint.py` to check workflows
+  before they run. 16 tests.
+- **PR #241** — Claude endpoint tests: mock responses, timeout, auth and error
+  handling cases.
+
+**Changed**
+- **PR #267** — hardened JWT secret validation and moved users onto a database.
+  A signing key shorter than 32 characters, or one of a set of known placeholder
+  values, is now rejected so a misconfigured deployment fails loudly instead of
+  signing tokens with a guessable key. Added `app/user_store.py`, a
+  SQLAlchemy-backed user table that imports legacy JSON users on first init and
+  keeps the existing shape, so the API surface and per-user skill gating are
+  unchanged. `DATABASE_URL` selects Postgres, otherwise SQLite. 43 tests.
+- **PR #252**, **PR #259**, **PR #248** — agent task skills and merge protection,
+  cron automation, and the corresponding knowledge notes.
+- **PR #236** — rewrote `README.md` to describe the repository as it stands rather
+  than as it was intended: the real entrypoints, which one `app/Dockerfile` and
+  `vercel.json` serve, required vs optional configuration, the real test command,
+  and a `Known state` section recording what is genuinely broken.
+- **PR #233** — activated the WhatsApp notification workflow, moved out of
+  `templates/` (which Actions does not read) into `.github/workflows/`.
+
+**Fixed**
+- **PR #250** — SHA-pinned the workflow actions and repaired the broken workflow
+  YAML.
+- **PR #249** — pointed `knowledge/scripts/diff_policy.py` at `knowledge/` instead
+  of the missing `vault/`.
+- **PR #243** — repaired `auto-compress-manage.yml`, which had failed at
+  `Set up job` on all 781 runs: five action refs pointed at SHAs that do not exist
+  upstream. Four skip conditions added alongside the fix.
+- **PR #234** — corrected YAML syntax and indentation in `Auto-Index-Sync.yml`.
+- **PR #262** — dropped the unused `import sys` from
+  `knowledge/scripts/diff_policy.py`.
+- **PR #230** — `ci.yml` updated.
+
+**Direct to `main`** — besides the PRs above, 57 commits landed straight on `main`:
+new skill docs (`SKILL.md` files), knowledge notes, guideline documents, a
+`cron-automation/` directory, and several `Add files via upload`. These were not
+reviewed through PRs and are listed here rather than itemised.
+
+**Dependencies**
+- **PR #222** — `requirements.txt` updated.
+- **PR #223** — added a root `requirements-dev.txt` for test/lint tooling.
+- **PR #204 / #211** — npm dev-deps group bump; esbuild + vite bump in
+  `deliverables/product-crud/web`.
+
+## Changelog
+
+Full sections: [`CHANGELOG.md`](CHANGELOG.md) → `[2026-09-14]`, `[2026-09-13]`,
+`[2026-09-12]`. Two merged PRs had no changelog record at the time of this
+release — **#265** and **#266** — and are added in this release PR alongside the
+notes.
+
+## Migration / breaking changes
+
+None. No migration required. The JWT change (**#267**) is stricter than before by
+design: a deployment signing tokens with a short or placeholder key will now fail
+at startup instead of silently continuing. Set a key of at least 32 characters —
+or unset it and let the local fallback generate one.
+
+## Verification
+
+- [ ] CI green on `main` — see note below
+- [x] Tests pass — 69 (`fig-best-practices`), 43 (`app/`, clean venv),
+  37 (`pr-triage-automove`), 16 (`ci-workflow-authoring`)
+- [ ] Migration applied (if any) — N/A
+- [ ] Tag + GitHub Release created from this section
+
+**CI note:** every workflow on `main` still fails at *Set up job*, for the
+pre-existing org policy reason — all actions must be pinned to a full-length
+commit SHA. Repairs have been attempted repeatedly (**#243**, **#250**), and each
+attempt was subsequently overwritten or left unreconciled, so the repo remains in
+a state where the policy text (`README.md`, `SECURITY.md`) does not match the
+workflows that are actually on `main`. This is tracked in `PROBLEMS.md`; it is
+not introduced by this release and does not affect the artifacts above, which run
+their own tests. It does mean no PR on this repository can show green checks.