chore(release): release version 1.0.0

.zenodo.json

@@ -4,7 +4,7 @@
   "upload_type": "software",
   "license": "apache-2.0",
   "access_right": "open",
-  "version": "0.1.1",
+  "version": "1.0.0",
   "creators": [
     {
       "name": "Šotek, Miroslav",

CHANGELOG.md

@@ -5,6 +5,8 @@ based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.0.0] - 2026-07-21
+
 ### Added
 
 - An internal release-quorum certificate binds one exact release candidate to

CITATION.cff

@@ -10,7 +10,7 @@ cff-version: 1.2.0
 message: "If you use RigorFoundry, cite the software using this metadata."
 title: RigorFoundry
 type: software
-version: 0.1.1
+version: 1.0.0
 license: Apache-2.0
 repository-code: "https://github.com/anulum/rigor-foundry"
 url: "https://github.com/anulum/rigor-foundry"

README.md

@@ -28,14 +28,21 @@ RigorFoundry inventories Git-tracked repository content, emits reproducible
 audit candidates, binds review decisions to exact evidence, and prepares
 remediation inputs without treating static heuristics as defect verdicts.
 
-> **Current status:** standalone pre-alpha. Versioned
-> [GitHub Releases](https://github.com/anulum/rigor-foundry/releases) and
+> **Current status:** stable public interface, detection rules in maturity probation.
+> RigorFoundry 1.0.0 freezes a digest-bound compatibility contract over the installed
+> CLI commands and their option and positional spellings, the package-level Python
+> API, and the inventoried schema versions: a wire-incompatible change requires a new
+> schema identifier and an explicit migration, never a silent reinterpretation. That
+> contract is the whole of the stability commitment — it does not extend to the audit
+> findings. Every detection rule stays an anchored review candidate in explicit
+> maturity probation until an adopter policy is met by source-bound completed reviews,
+> so a rule match is input for human evidence review, not an automatic defect verdict.
+> Versioned [GitHub Releases](https://github.com/anulum/rigor-foundry/releases) and
 > [GHCR images](https://github.com/anulum/rigor-foundry/pkgs/container/rigor-foundry)
-> are published through the repository, beginning with `v0.1.0`. PyPI
-> availability is established from the
-> [public registry](https://pypi.org/project/rigor-foundry/), not inferred from
-> a tag or workflow result. RigorFoundry has not been promoted as a
-> fleet-wide audit authority. A clean static scan is not a clean-repository claim.
+> are published through the repository; PyPI availability is established from the
+> [public registry](https://pypi.org/project/rigor-foundry/), not inferred from a tag
+> or workflow result. RigorFoundry has not been promoted as a fleet-wide audit
+> authority, and a clean static scan is not a clean-repository claim.
 
 ## Operating contract
 
@@ -102,7 +109,7 @@ After the exact version appears in the
 it with:
 
 ```bash
-python -m pip install "rigor-foundry==0.1.1"
+python -m pip install "rigor-foundry==1.0.0"
 ```
 
 ## Quick start from source

pyproject.toml

@@ -18,7 +18,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "rigor-foundry"
-version = "0.1.1"
+version = "1.0.0"
 description = "Evidence-bound codebase transformation"
 readme = "README.md"
 license = "Apache-2.0"

src/rigor_foundry/version.py

@@ -7,4 +7,4 @@
 # RigorFoundry — package version identity
 """Own the single import-safe package version used by APIs and the CLI."""
 
-__version__ = "0.1.1"
+__version__ = "1.0.0"

tests/test_check_metadata.py

@@ -37,8 +37,8 @@ def test_release_metadata_rejects_drift_in_the_version_owner(tmp_path: Path) ->
         shutil.copy2(source, destination)
     version = repository / "src/rigor_foundry/version.py"
     version.write_text(
-        version.read_text(encoding="utf-8").replace('"0.1.1"', '"0.1.2"'),
+        version.read_text(encoding="utf-8").replace('"1.0.0"', '"1.0.1"'),
         encoding="utf-8",
     )
 
-    assert metadata_errors(repository) == ["package version '0.1.2' does not match '0.1.1'"]
+    assert metadata_errors(repository) == ["package version '1.0.1' does not match '1.0.0'"]

tests/test_check_release_tag.py

@@ -39,13 +39,13 @@ def _run_release_guard(*arguments: str) -> subprocess.CompletedProcess[str]:
 
 def test_release_tag_matches_the_single_package_version() -> None:
     """Release automation rejects aliases and metadata drift."""
-    assert release_tag_errors("v0.1.1") == []
-    assert release_tag_errors("0.1.1") == ["release tag '0.1.1' does not match 'v0.1.1'"]
+    assert release_tag_errors("v1.0.0") == []
+    assert release_tag_errors("1.0.0") == ["release tag '1.0.0' does not match 'v1.0.0'"]
 
 
 def test_release_tag_cli_runs_before_package_installation() -> None:
     """The workflow guard runs without site packages or source-path injection."""
-    completed = _run_release_guard("v0.1.1")
+    completed = _run_release_guard("v1.0.0")
 
     assert completed.returncode == 0, completed.stderr
     assert completed.stdout == "Release tag guard passed\n"
@@ -55,7 +55,7 @@ def test_release_tag_cli_runs_before_package_installation() -> None:
 def test_release_tag_module_entrypoint_executes() -> None:
     """The public module entry point delegates to the validated CLI boundary."""
     completed = subprocess.run(
-        [sys.executable, "-m", "tools.check_release_tag", "v0.1.1"],
+        [sys.executable, "-m", "tools.check_release_tag", "v1.0.0"],
         cwd=_REPOSITORY_ROOT,
         check=False,
         capture_output=True,
@@ -75,7 +75,7 @@ def test_release_tag_module_entrypoint_executes() -> None:
         (
             ("v9.9.9",),
             1,
-            "release tag 'v9.9.9' does not match 'v0.1.1'\n",
+            "release tag 'v9.9.9' does not match 'v1.0.0'\n",
         ),
     ],
 )
@@ -96,8 +96,8 @@ def test_release_tag_cli_rejects_invalid_invocations(
     ("arguments", "expected_code", "expected_output"),
     [
         ([], 2, "usage: python -m tools.check_release_tag <tag>\n"),
-        (["v9.9.9"], 1, "release tag 'v9.9.9' does not match 'v0.1.1'\n"),
-        (["v0.1.1"], 0, "Release tag guard passed\n"),
+        (["v9.9.9"], 1, "release tag 'v9.9.9' does not match 'v1.0.0'\n"),
+        (["v1.0.0"], 0, "Release tag guard passed\n"),
     ],
 )
 def test_release_tag_main_reports_each_public_outcome(