From 8de2ecee35c7baa0e4e1dc5500e555a25ab82496 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20=C5=A0otek?= Date: Tue, 21 Jul 2026 07:59:32 +0200 Subject: [PATCH] chore(release): release version 1.0.0 Set the single package version to 1.0.0 across pyproject, the version module, the citation record, and the Zenodo archive descriptor, bump the README install command to the 1.0.0 pin, and replace the pre-release status note with the 1.0.0 stability statement: a digest-bound public compatibility contract over the CLI commands, the package Python API, and the inventoried schema versions, with detection rules kept in explicit maturity probation. Cut the accumulated Unreleased entries into a dated 1.0.0 changelog section with a fresh empty Unreleased heading, and update the release-tag and metadata guard tests to the new version. The frozen public compatibility contract and its digest are unchanged. Authored by Anulum Fortis & Arcane Sapience (protoscience@anulum.li) Seat: a7c1 --- .zenodo.json | 2 +- CHANGELOG.md | 2 ++ CITATION.cff | 2 +- README.md | 23 +++++++++++++++-------- pyproject.toml | 2 +- src/rigor_foundry/version.py | 2 +- tests/test_check_metadata.py | 4 ++-- tests/test_check_release_tag.py | 14 +++++++------- 8 files changed, 30 insertions(+), 21 deletions(-) diff --git a/.zenodo.json b/.zenodo.json index ec7a797..b164e38 100644 --- a/.zenodo.json +++ b/.zenodo.json @@ -4,7 +4,7 @@ "upload_type": "software", "license": "apache-2.0", "access_right": "open", - "version": "0.1.1", + "version": "1.0.0", "creators": [ { "name": "Šotek, Miroslav", diff --git a/CHANGELOG.md b/CHANGELOG.md index c1c005c..a8b42a8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,8 @@ based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ## [Unreleased] +## [1.0.0] - 2026-07-21 + ### Added - An internal release-quorum certificate binds one exact release candidate to diff --git a/CITATION.cff b/CITATION.cff index 9c29af6..20a37ac 100644 --- a/CITATION.cff +++ b/CITATION.cff @@ -10,7 +10,7 @@ cff-version: 1.2.0 message: "If you use RigorFoundry, cite the software using this metadata." title: RigorFoundry type: software -version: 0.1.1 +version: 1.0.0 license: Apache-2.0 repository-code: "https://github.com/anulum/rigor-foundry" url: "https://github.com/anulum/rigor-foundry" diff --git a/README.md b/README.md index e40dfd6..e5f25c5 100644 --- a/README.md +++ b/README.md @@ -28,14 +28,21 @@ RigorFoundry inventories Git-tracked repository content, emits reproducible audit candidates, binds review decisions to exact evidence, and prepares remediation inputs without treating static heuristics as defect verdicts. -> **Current status:** standalone pre-alpha. Versioned -> [GitHub Releases](https://github.com/anulum/rigor-foundry/releases) and +> **Current status:** stable public interface, detection rules in maturity probation. +> RigorFoundry 1.0.0 freezes a digest-bound compatibility contract over the installed +> CLI commands and their option and positional spellings, the package-level Python +> API, and the inventoried schema versions: a wire-incompatible change requires a new +> schema identifier and an explicit migration, never a silent reinterpretation. That +> contract is the whole of the stability commitment — it does not extend to the audit +> findings. Every detection rule stays an anchored review candidate in explicit +> maturity probation until an adopter policy is met by source-bound completed reviews, +> so a rule match is input for human evidence review, not an automatic defect verdict. +> Versioned [GitHub Releases](https://github.com/anulum/rigor-foundry/releases) and > [GHCR images](https://github.com/anulum/rigor-foundry/pkgs/container/rigor-foundry) -> are published through the repository, beginning with `v0.1.0`. PyPI -> availability is established from the -> [public registry](https://pypi.org/project/rigor-foundry/), not inferred from -> a tag or workflow result. RigorFoundry has not been promoted as a -> fleet-wide audit authority. A clean static scan is not a clean-repository claim. +> are published through the repository; PyPI availability is established from the +> [public registry](https://pypi.org/project/rigor-foundry/), not inferred from a tag +> or workflow result. RigorFoundry has not been promoted as a fleet-wide audit +> authority, and a clean static scan is not a clean-repository claim. ## Operating contract @@ -102,7 +109,7 @@ After the exact version appears in the it with: ```bash -python -m pip install "rigor-foundry==0.1.1" +python -m pip install "rigor-foundry==1.0.0" ``` ## Quick start from source diff --git a/pyproject.toml b/pyproject.toml index a6f82bf..511612e 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -18,7 +18,7 @@ build-backend = "hatchling.build" [project] name = "rigor-foundry" -version = "0.1.1" +version = "1.0.0" description = "Evidence-bound codebase transformation" readme = "README.md" license = "Apache-2.0" diff --git a/src/rigor_foundry/version.py b/src/rigor_foundry/version.py index 4bc0ee9..f2cd63e 100644 --- a/src/rigor_foundry/version.py +++ b/src/rigor_foundry/version.py @@ -7,4 +7,4 @@ # RigorFoundry — package version identity """Own the single import-safe package version used by APIs and the CLI.""" -__version__ = "0.1.1" +__version__ = "1.0.0" diff --git a/tests/test_check_metadata.py b/tests/test_check_metadata.py index 3fcfc3f..ec8b7b1 100644 --- a/tests/test_check_metadata.py +++ b/tests/test_check_metadata.py @@ -37,8 +37,8 @@ def test_release_metadata_rejects_drift_in_the_version_owner(tmp_path: Path) -> shutil.copy2(source, destination) version = repository / "src/rigor_foundry/version.py" version.write_text( - version.read_text(encoding="utf-8").replace('"0.1.1"', '"0.1.2"'), + version.read_text(encoding="utf-8").replace('"1.0.0"', '"1.0.1"'), encoding="utf-8", ) - assert metadata_errors(repository) == ["package version '0.1.2' does not match '0.1.1'"] + assert metadata_errors(repository) == ["package version '1.0.1' does not match '1.0.0'"] diff --git a/tests/test_check_release_tag.py b/tests/test_check_release_tag.py index 50d07a6..3ad97a8 100644 --- a/tests/test_check_release_tag.py +++ b/tests/test_check_release_tag.py @@ -39,13 +39,13 @@ def _run_release_guard(*arguments: str) -> subprocess.CompletedProcess[str]: def test_release_tag_matches_the_single_package_version() -> None: """Release automation rejects aliases and metadata drift.""" - assert release_tag_errors("v0.1.1") == [] - assert release_tag_errors("0.1.1") == ["release tag '0.1.1' does not match 'v0.1.1'"] + assert release_tag_errors("v1.0.0") == [] + assert release_tag_errors("1.0.0") == ["release tag '1.0.0' does not match 'v1.0.0'"] def test_release_tag_cli_runs_before_package_installation() -> None: """The workflow guard runs without site packages or source-path injection.""" - completed = _run_release_guard("v0.1.1") + completed = _run_release_guard("v1.0.0") assert completed.returncode == 0, completed.stderr assert completed.stdout == "Release tag guard passed\n" @@ -55,7 +55,7 @@ def test_release_tag_cli_runs_before_package_installation() -> None: def test_release_tag_module_entrypoint_executes() -> None: """The public module entry point delegates to the validated CLI boundary.""" completed = subprocess.run( - [sys.executable, "-m", "tools.check_release_tag", "v0.1.1"], + [sys.executable, "-m", "tools.check_release_tag", "v1.0.0"], cwd=_REPOSITORY_ROOT, check=False, capture_output=True, @@ -75,7 +75,7 @@ def test_release_tag_module_entrypoint_executes() -> None: ( ("v9.9.9",), 1, - "release tag 'v9.9.9' does not match 'v0.1.1'\n", + "release tag 'v9.9.9' does not match 'v1.0.0'\n", ), ], ) @@ -96,8 +96,8 @@ def test_release_tag_cli_rejects_invalid_invocations( ("arguments", "expected_code", "expected_output"), [ ([], 2, "usage: python -m tools.check_release_tag \n"), - (["v9.9.9"], 1, "release tag 'v9.9.9' does not match 'v0.1.1'\n"), - (["v0.1.1"], 0, "Release tag guard passed\n"), + (["v9.9.9"], 1, "release tag 'v9.9.9' does not match 'v1.0.0'\n"), + (["v1.0.0"], 0, "Release tag guard passed\n"), ], ) def test_release_tag_main_reports_each_public_outcome(