Agentplat · douglas-grishen · Sep 22, 2026 · Sep 22, 2026 · Sep 22, 2026
diff --git a/AGENTS.md b/AGENTS.md
@@ -41,8 +41,11 @@ required CI, protected main, stage-only publishing, staged-byte review and npm
 2FA. See `docs/security/npm-release-security.md` for the exact boundary.
 
 
-The release-level OIDC alternative in `docs/security/npm-direct-release.md` is
-prepared but NOT activated. Do not enable its flags, create its trusted publisher
-relationships or publish a new cohort without the owner's final activation
-approval. Once explicitly enabled, its own single-release approval and exact
-artifact checks replace per-package staged approval for that profile only.
+The owner has authorized activation of the release-level OIDC alternative in
+`docs/security/npm-direct-release.md` and a fresh release cohort. Complete the
+specified trusted publisher/environment configuration and verify it before
+setting the enablement flags. Do not request that same activation approval again.
+The owner subsequently authorized 1.0.0 stable publication to latest, replacing
+the unpublished beta.10 candidate. Platform-required passkey authentication still belongs to the owner. Once enabled,
+that profile uses one release-level approval and exact artifact checks; legacy
+beta.9 staging and published versions remain intact.
diff --git a/AI.md b/AI.md
@@ -2,7 +2,7 @@
 
 AgentPlat is an open-source TypeScript framework for persistent human-agent collaboration, with shared artifacts, human approvals and controlled execution on your infrastructure.
 
-AgentPlat Agent Rooms provide the collaboration workspace. AgentPlat Collective Runtime and AgentPlat Agent Mesh add planning and distributed coordination when needed. AgentPlat is a developer preview; source availability, registry distribution and operational evidence must be checked separately.
+AgentPlat Agent Rooms provide the collaboration workspace. AgentPlat Collective Runtime and AgentPlat Agent Mesh add planning and distributed coordination when needed. AgentPlat 1.0.0 is being prepared for stable distribution under `docs/stability.md`. Publication is pending; source availability, registry distribution and operational evidence must be checked separately.
 
 - Canonical repository: https://github.com/Agentplat/agentplat
 - Website: https://agentplat.com

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,7 +2,30 @@
 
 ## Unreleased
 
-## 0.3.0-beta.9 — prepared, not yet published
+## 1.0.0 — prepared; publication pending
+
+- Establish a public API compatibility and maintenance policy for the 65-package
+  coordinated stable line, with explicit experimental capability boundaries.
+- Add production deployment and preview migration guidance.
+- Target `latest` only through the protected release workflow and complete
+  registry/consumer verification. No completed publication is claimed here.
+
+## 0.3.0-beta.10 — superseded before publication by 1.0.0
+
+- Carries the Morphogenesis supersession APIs, compensation adapter, Room
+  projection, fence timestamp recovery and persistent integration example from
+  beta.9 into a fresh coordinated 65-package release.
+- Uses the separately authorized release-level OIDC flow: exact prepared files,
+  one protected GitHub approval, dependency-order publication and registry checks.
+- No registry completion is claimed until all package signatures, bytes,
+  provenance and consumers pass. `latest` is not promoted.
+
+## 0.3.0-beta.9 — partially published; not a complete coordinated release
+
+Three package versions were verified public during migration. Remaining staged
+versions and the original artifact are preserved. This release was not announced
+as complete; use a subsequently verified coordinated release for adoption.
+
 
 - Add opt-in Morphogenesis supersession admission and terminal cleanup receipts,
   retaining stable owner operation identities and the accepted morphology head.

diff --git a/README.md b/README.md
@@ -8,7 +8,7 @@ AgentPlat is an open-source TypeScript framework for persistent human-agent coll
 
 [Website](https://agentplat.com) · [Documentation](https://doc.agentplat.com) · [GitHub](https://github.com/Agentplat/agentplat)
 
-> Developer preview: APIs may change between prereleases. Implementation, distribution and operational evidence are separate. See [component maturity](docs/component-maturity.md).
+> Version 1.0.0 is being prepared for stable distribution. See the [stability contract](docs/stability.md) and [production guide](docs/production.md). Publication remains pending; consult [release channels](docs/release-channels.md) for availability.
 
 ## A concrete use case
 

diff --git a/docs/component-maturity.md b/docs/component-maturity.md
@@ -3,7 +3,7 @@
 This is the editorial entry point for adoption status. Source availability,
 registry distribution, executable checks and operational evidence answer
 different questions. None implies another. The source checkout currently
-uses a coordinated preview version; it does not prove that version is on npm.
+prepares coordinated version 1.0.0; publication is pending. The [stability contract](stability.md) governs API compatibility independently of operational evidence.
 
 ## Source and integration map
 

diff --git a/docs/production.md b/docs/production.md
@@ -0,0 +1,46 @@
+# Production deployment
+
+AgentPlat's maintainer reports that AgentPlat packages are already used in
+production. This is a maintainer-reported deployment statement, not a published
+customer study: package versions, workload, observation period and incident
+metrics have not yet been recorded here. It does not expand the paper's evidence.
+
+Version 1.0.0 is being prepared for stable publication. Until the distribution
+record confirms the complete release, do not assume it is available on npm.
+
+## Supported application boundaries
+
+Use the exported APIs under the [stability contract](stability.md). Start from
+[persistent collaboration](getting-started/persistent-collaboration.md) and
+[integration controls](getting-started/integration-controls.md). Reference demos
+supply development defaults; applications must configure their actual host.
+
+| Deployment concern | Application configuration and acceptance check |
+| --- | --- |
+| Runtime and installation | Use a Node version supported by every selected package and adapter; the release includes a Node 22 consumer check. Pin coordinated package versions and commit the lockfile. |
+| Persistence | Choose durable PostgreSQL/Redis/Temporal adapters as applicable. Apply documented migrations, back up data and exercise restore before accepting production traffic. In-memory stores provide no restart durability. |
+| Identity and authorization | Verify principals and tenant boundaries at ingress. Connect policy and approval checkpoints to the actual execution path; direct provider or handler calls do not inherit opt-in controls. |
+| External effects | Supply idempotency keys, bounded retries and reconciliation for uncertain outcomes. Verify that restart after an effect does not duplicate the action. |
+| Distributed work | Configure lease expiry, fencing and drain behavior in the owning adapters. Test interruption and recovery with the selected database and worker topology. |
+| Operations | Collect structured errors and audit events, monitor backlog and failed/reconciling work, and define alerts, retention and operator recovery procedures. |
+| Secrets and network | Supply credentials outside source, restrict database/tool access, and configure authenticated transport and peer key custody for Mesh. |
+| Capacity | Measure latency, throughput and recovery on the intended workload. Local deterministic tests do not define a production capacity limit. |
+
+## Migration from previews
+
+The 1.0.0 candidate carries the beta.9 runtime improvements and release tooling;
+it introduces the stability policy without intentionally changing runtime APIs.
+It replaces the unpublished beta.10 candidate. The partially published beta.9
+cohort is not a coordinated upgrade target.
+
+Once publication is verified, select exact 1.0.0 versions for all @agentplat
+packages your application uses and regenerate the lockfile. Compile the
+application, run its integration tests and verify its actual adapters in staging.
+Exercise restart, approval, failed external-effect and recovery paths before
+rolling out. Preserve the old lockfile and deployment artifact for rollback;
+restore data only under the adapter's documented migration/restore procedure.
+
+Publication acceptance requires the complete 65-package release, registry
+bytes/signatures/provenance/tag checks, and clean package consumers. Deployment
+acceptance additionally depends on the application's configuration and workload.
+The [component matrix](component-maturity.md) records the available evidence.
diff --git a/docs/release-channels.md b/docs/release-channels.md
@@ -1,19 +1,23 @@
 # Release channels
 
-AgentPlat uses one fixed version for all publishable packages. Preview work is
-published under the npm `next` tag; `latest` remains the last promoted preview
-until the maintainers explicitly promote a tested release.
+AgentPlat uses one fixed version for all 65 publishable packages. The next
+planned stable release is **1.0.0**, targeting npm `latest`. It replaces the
+unpublished beta.10 candidate. Publication is pending; this document does not
+assert that registry tags have moved.
 
-Install the current preview deliberately:
+Stable 1.x releases follow the [stability contract](stability.md). Prereleases
+use `next` and must never promote `latest`. Stable promotion requires successful
+public checks, exact artifact verification, reference integration validation,
+and clean registry consumers for the entire coordinated release.
+
+After the 1.0.0 distribution record is verified, install exact versions:
 
 ```sh
-pnpm add @agentplat/framework@next @agentplat/sessions@next
+pnpm add @agentplat/framework@1.0.0 @agentplat/sessions@1.0.0
 ```
 
-Preview APIs are supported for evaluation and production-preview validation,
-but may change between prereleases. A preview is promoted to `latest` only after
-the public checks, package smoke test, reference examples and downstream
-integration validation are green.
+See the [production and migration guide](production.md). Historical observations
+below describe previews; they do not override the stable 1.x policy.
 
 `0.3.0-alpha.4` was the coordinated Evidence and Trust preview.
 This paragraph describes that historical release, not the current npm tag.
@@ -36,7 +40,7 @@ server-only adapters live at `@agentplat/mesh/trust` and
 adapters receive Trust filtering or restriction; direct Mesh, provider,
 handler and dispatcher calls keep their existing behavior.
 
-Session/browser APIs remain on `next` until the reference Next.js controls,
+Historically, session/browser APIs remained on `next` until the reference Next.js controls,
 public contract tests, package smoke test, downstream validation and a stable
 API review are all green for a promotion candidate. `latest` is intentionally
 not advanced merely because a preview release is published.
@@ -49,7 +53,7 @@ in Alpha 1. Consumers should still install the coordinated channel explicitly
 while the framework is in preview.
 
 
-A disabled-by-default [release-level OIDC profile](security/npm-direct-release.md)
-prepares one verified cohort for one protected deployment approval. It requires
-explicit activation of separate npm publisher permissions; the existing staged
-release workflow remains the active default until that activation.
+The owner-authorized [release-level OIDC profile](security/npm-direct-release.md)
+prepares one verified cohort for one protected deployment approval. Its setup is
+in progress; enablement follows verification of every npm publisher relationship.
+The existing staged workflow remains available for historical cohorts.
diff --git a/docs/security/npm-direct-release.md b/docs/security/npm-direct-release.md
@@ -1,9 +1,11 @@
-# Release-level OIDC publication (prepared, not activated)
+# Release-level OIDC publication (activation authorized; setup in progress)
 
 The owner requested preparation of this alternative after interactive staged
 approval failed to reuse a passkey across the coordinated package cohort.
-This document is the reviewable activation proposal. No npm publisher permissions,
-GitHub environments or enablement variables are changed by merging the code.
+The owner subsequently authorized activation and preparation of 1.0.0. The
+reviewed implementation is integrated. External configuration is being installed;
+publication remains blocked until every package relationship is verified and the
+explicit flags are enabled. No repeated activation approval is required.
 
 ## Change in authority
 
@@ -53,7 +55,7 @@ publisher verifies existing versions rather than rebuilding, republishing or
 silently repairing tags. A mismatched existing version requires investigation.
 The progress report is diagnostic; registry evidence determines resume behavior.
 
-## Activation proposal — requires owner's final authorization
+## Authorized activation procedure
 
 After the reviewed code is integrated and required CI passes:
 
@@ -75,7 +77,7 @@ After the reviewed code is integrated and required CI passes:
   using the authenticated maintainer CLI. It checks the owner, exact main-only
   deployment rule, enablement flags and existing main/Actions protections.
 - Prepare a fresh coordinated version and run a dry-run first. Then dispatch the
-  same reviewed main source with `dry_run=false`, tag `next`, scope `all`.
+  same reviewed main source with `dry_run=false`, tag `latest` for 1.0.0 (`next` for prereleases), scope `all`.
   After preparation passes, approve the one environment deployment, or use
   `node scripts/approve-owner-npm-release.mjs RUN_ID --direct` on the owner's
   behalf. It refuses foreign original/rerun actors, failed preparation, another
@@ -93,11 +95,10 @@ Staged and public versions share npm's version uniqueness constraint. The new
 publisher must not overwrite them, automatically reject staging, unpublish a
 version or move old tags to disguise this partial release.
 
-Use a fresh coordinated version, proposed `0.3.0-beta.10`, after checking current
+Use a fresh coordinated version, proposed `1.0.0`, after checking current
 registry availability. Bump all package manifests through the existing version
 script, add the supported release-line entry, regenerate/verify the lockfile if
-needed, and produce a NEW manifest from the approved source. No such version
-bump or publication is included in this preparation change. Historical paper
+needed, and produce a NEW manifest from the approved source. The 1.0.0 version bump is prepared; publication is still pending. Historical paper
 and beta.9 artifacts keep their original source references. Handling leftover
 private staging is a separate, explicitly authorized cleanup.
 

diff --git a/docs/security/npm-release-security.md b/docs/security/npm-release-security.md
@@ -4,12 +4,12 @@
 to npm. **Status:** implemented repository controls plus explicitly identified
 external configuration.
 
-## Prepared alternative (not activated)
+## Release-level alternative (activation authorized; setup in progress)
 
 A release-level OIDC profile has been prepared at the owner's request. See
 [npm direct release](npm-direct-release.md) for its gates, tests, migration and
-explicit activation proposal. It remains disabled until the owner authorizes
-npm permission changes and the enablement flags are set. The stage-only rules
+explicit activation proposal. The owner has authorized npm permission changes. It remains disabled until all
+relationships are verified and the enablement flags are set. The stage-only rules
 below remain the active policy for `release.yml` / `npm-production`.
 
 ## Security invariant

diff --git a/docs/stability.md b/docs/stability.md
@@ -0,0 +1,49 @@
+# Stability and maintenance
+
+Version 1.0.0 is the first coordinated stable release candidate in source.
+Registry publication is pending. This policy takes effect for published 1.x
+versions; use the distribution record to identify a verified release.
+
+## Public compatibility contract
+
+The 65 packages in `config/public-packages.json` share one release version.
+The supported API consists of their package.json export entry points, exported
+TypeScript contracts and documented behavior. Internal source paths, examples,
+research scripts and undocumented implementation details are outside that API.
+
+Within 1.x, patches fix defects without intentionally breaking supported
+contracts. Minor releases add compatible functionality and deprecations.
+Removing exports, incompatible type or behavior changes, or requiring an
+incompatible persistence/protocol migration requires a new major release.
+Deprecations include an alternative and migration instructions before removal.
+Security fixes describe any necessary behavior changes in release notes.
+
+Persisted data and protocol versions retain their documented compatibility
+rules. Back up before migrations; a successful package install does not prove
+that a database downgrade is safe. Consumers should upgrade the coordinated
+package set together and retain a lockfile.
+
+## Experimental capabilities
+
+AgentPlat Agent Morphogenesis, including its V1–V8 entry points and associated
+opt-in integrations, remains experimental in operational maturity. Simulation,
+research evaluation and features explicitly marked experimental or research-only
+are not promises of production reliability. Their public exports still receive
+the 1.x compatibility protection above; experimental status is not permission
+to silently break a stable package.
+
+The component maturity matrix and frozen evidence baseline continue to describe
+what has actually been exercised. Stable versioning is a maintainer commitment
+to compatibility, not a claim that every adapter combination or deployment scale
+has been validated.
+
+## Maintenance and support
+
+Report reproducible defects through repository issues and follow SECURITY.md
+for security reports. Fixes target the current 1.x release; support for older
+patch versions and prereleases is not promised. There is no response-time SLA
+or implied commercial support. Release notes identify migrations and supported
+runtime changes. Future retirement of the 1.x line will be announced explicitly.
+
+See [production deployment](production.md), [component maturity](component-maturity.md)
+and [release channels](release-channels.md).
@@ -1,6 +1,6 @@
 {
   "name": "agentplat",
-  "version": "0.3.0-beta.9",
+  "version": "1.0.0",
   "private": true,
   "description": "Open-source TypeScript framework for persistent human-agent collaboration, with shared artifacts, human approvals and controlled execution on your infrastructure.",
   "keywords": [

@@ -1,6 +1,6 @@
 {
   "name": "@agentplat/a2a",
-  "version": "0.3.0-beta.9",
+  "version": "1.0.0",
   "description": "Governed A2A 1.0 interoperability for AgentPlat agents and Room services.",
   "type": "module",
   "license": "Apache-2.0",

@@ -1,6 +1,6 @@
 {
   "name": "@agentplat/agent-registry-postgres",
-  "version": "0.3.0-beta.9",
+  "version": "1.0.0",
   "description": "PostgreSQL persistence for the AgentPlat Agent Registry.",
   "type": "module",
   "license": "Apache-2.0",

@@ -1,6 +1,6 @@
 {
   "name": "@agentplat/agent-registry",
-  "version": "0.3.0-beta.9",
+  "version": "1.0.0",
   "description": "Tenant-scoped capability discovery with revisioned agent descriptors.",
   "type": "module",
   "license": "Apache-2.0",

@@ -1,6 +1,6 @@
 {
   "name": "@agentplat/audit-postgres",
-  "version": "0.3.0-beta.9",
+  "version": "1.0.0",
   "description": "PostgreSQL audit and session event sinks for AgentPlat without Agent Rooms.",
   "type": "module",
   "license": "Apache-2.0",

@@ -1,6 +1,6 @@
 {
   "name": "@agentplat/audit",
-  "version": "0.3.0-beta.9",
+  "version": "1.0.0",
   "description": "Audit contracts, recursive redaction and an in-memory sink for AgentPlat.",
   "type": "module",
   "license": "Apache-2.0",

@@ -1,6 +1,6 @@
 {
   "name": "@agentplat/auth",
-  "version": "0.3.0-beta.9",
+  "version": "1.0.0",
   "description": "Provider-neutral auth and tenant-resolution contracts for AgentPlat.",
   "type": "module",
   "license": "Apache-2.0",

@@ -1,6 +1,6 @@
 {
   "name": "@agentplat/autonomy-postgres",
-  "version": "0.3.0-beta.9",
+  "version": "1.0.0",
   "description": "PostgreSQL state and decision journal for AgentPlat progressive autonomy.",
   "type": "module",
   "license": "Apache-2.0",

@@ -1,6 +1,6 @@
 {
   "name": "@agentplat/autonomy",
-  "version": "0.3.0-beta.9",
+  "version": "1.0.0",
   "description": "Evidence-gated progressive supervision for governed AgentPlat actions.",
   "type": "module",
   "license": "Apache-2.0",