chore(main): release 1.0.0

[beyondnetPeru]

🤖 I have created a release beep boop

1.0.0 (2026-06-28)

Features

• add intelligent data strength assessment and audit script (1b45d08)
• add merge method selector + owner-gated CI skip to husky hooks (30adda6)
• add Spanish gap reference catalog entries for intelligent data audit gaps (GT-283-GT-311) (e0dda8d)
• agentic-ai: implement GT-169 operational controls (19fb0c4)
• agents: enhance BMAD agents with Evolith Core governance context (361acd4)
• agents: enhance BMAD agents with Evolith Core governance context (361acd4)
• agents: enhance BMAD agents with Evolith Core governance context (48d59ae)
• agents: enhance BMAD agents with Evolith Core governance context and self-improvement mandate (48d59ae)
• agents: enhance BMAD agents with Evolith Core governance context, self-improvement mandate, and full bilingual parity (00839f2)
• api: enable Swagger via SWAGGER_ENABLED env var (25c26f1)
• api: enable Swagger via SWAGGER_ENABLED env var (d20ff41)
• arch: comprehensive HA/resilience/security/governance overhaul (20d9b10)
• architecture: add operationalBudgets to agentic-ai manifest (GT-219) (7da34b3)
• architecture: create agnostic baseline (GT-209) + reorder gap-tracking pending-first (2e58fd4)
• bmad: role-specialized QA agent suite + orchestration (GT-330 mitigation) (f740774)
• cache: implement Redis caching layer for Core API and MCP (GT-249) (4a876d5)
• ci: add skip mode + sync option to CI menu (37c23a6)
• ci: close GT-147 — operational capability & efficiency drift audit (f4b163b)
• ci: executable OPA evaluator + Native/OPA parity gate (GT-149) (5f9fd11)
• ci: GT-149 progress — executable OPA + Native/OPA parity gate (~70%, not closed) (0c5c57d)
• ci: GT-343 stage 5 — phase/topology namespace anti-collision guard (560cae4)
• ci: parity gate scoping, version stamps, scheduled full run (GT-149) (06ffd2f)
• close all pending gaps — infrastructure + closure evidence (GT-216/217/220-227/231/232/234/235/237-248) (1244af0)
• close GT-155 and GT-156 core API conformance and documentation (a9297f4)
• complete GT-312 composable validation engine (00bb08d)
• contracts: GT-343 stage 3 — public SDLC phase enums accept canonical ids (5f97625)
• core-api: close GT-159 REST versioning and deprecation linter/tests (956bba2)
• core-api: GT-155 envelope conformance with ADR-0073 (6f266f3)
• core-api: GT-159 REST URI versioning + deprecation policy (ADR-0098) (f57294e)
• core-domain: GT-343 stage 1 — canonical SDLC PhaseId + alias normalizer (7ecc560)
• core: implement GT-359 to GT-362 for evaluation pipeline (ce9a53f)
• cross: close GT-160 correlation-ID and context propagation (af62206)
• evaluator: implement 5 native rule handlers + parity fixtures for GT-229 (6ba915c)
• examples: implement GT-168 cross-topology composition reference (4e8fcad)
• execute 20 gaps in parallel — docs, OPA, CI, security, CLI/MCP (GT-216/217/220-226/232/234/235/237/240/241/244/247/248) (f1d9814)
• extend GT-312 to composable multi-entry-point validation (f5fdcd1)
• gaps: add GT-266 - API key provisioning service for MCP HTTP (67fb9df)
• gaps: add GT-266 - API key provisioning service for MCP HTTP (7370aaf)
• gaps: close GT-102/104/107/114/116 closureCommits, integrate 34 NXT items as GT-175-208, translate 18 ES files (bef6d47)
• gaps: close GT-150 (topology maturity) and GT-149 (OPA parity gate) (8606a96)
• gaps: close GT-150 (topology maturity) and GT-149 (OPA parity gate) (85d2e4a)
• gaps: close GT-151 — complete Native/OPA rule-ID coverage (5d46b8a)
• gaps: close GT-152/153/154 — knowledge contract, lifecycle, RAG parity (572c59a)
• gaps: close GT-171 GT-172 GT-173 - surface parity, contract test, OTel (c6ff59c)
• gaps: close GT-314–GT-330 — 329/330 gaps resolved, 0 pending (d26877d)
• gaps: close GT-314–GT-330 — all 17 pending gaps resolved (d2b7d2b)
• governance: add governance metadata to all 8 topology manifests (GT-213) (67fac2b)
• governance: close GT-174 envelope schemaVersion compatibility matrix (4078471)
• governance: GT-357 DONE — board now reconciles with executed build/test evidence (42cc1cb)
• governance: R-25 parity certification 39/39, R-30, SDLC gate fixes, infrastructure OPA (abe29e2)
• GT-273 — ephemeral DAST ZAP scan in CI + GT-20 ADR Technology Watch backfill (2d51059)
• implement GT-312 composable validation engine (d067857)
• infra: GT-324 — CD pipeline builds+pushes core-api/mcp-server to GHCR + guarded Coolify deploy (ab64c60)
• knowledge: automate knowledge intake pipeline (GT-236) (266f435)
• knowledge: establish governed multi-architecture intake (de5521e)
• mcp-server: close GT-158 Human-in-the-loop and ABAC scoping for mutative tools (4fd5c6e)
• mcp: production-ready Dockerfile for SSE deployment (16c9699)
• mcp: production-ready Dockerfile for SSE deployment (3bccdbb)
• opa: add Phase 1 OPA policies for 5 cross-cutting rulesets (GT-216) (96b17fe)
• opa: close GT-161 JSON input schemas and validation gate (ccfa947)
• p0-gaps: close GT-283/284/285/295/296/297/298 — topology rulesets + core-domain gates/phases + mcp resources/watcher (856912b)
• p1-gaps: close GT-299/300/301/302/303/304/305/306/307/310/311 — OpenAPI, CLI commands, core-domain models, CLI tests (817986c)
• p2-gaps: close GT-308 and GT-309 — CLI plugin system + contribution validator (34c0abd)
• register GT-312 SDLC validation orchestration master gap (08ab178)
• register intelligent data audit gaps in gap-tracking boards (44b00d2)
• release: add npm publish pipeline for core-domain and infra-providers (26907ce)
• rulesets: add satellite-contracts standalone WS1 entrypoint (GT-292) (cd40dd8)
• rulesets: close GT-293 and GT-294 — executive-scorecards canonical dir + architecture OPA (ad0fe74)
• rulesets: implement GT-162 OPA aggregator tests and parity validator (72bfe62)
• rulesets: implement GT-163 topology manifest references validation (fcd5d2a)
• rulesets: implement GT-164 event-driven and data-mesh ruleset richness (bbe5db9)
• sdlc: add Phase 05 rollback rehearsal + on-call handoff templates (GT-218) (bb00773)
• sdlc: close GT-281 pipeline + GT-282 actionable reports, reach 75% (6/8) (661a884)
• sdlc: implement 01.1 Knowledge-First Discovery / KDD Readiness subphase (479a549)
• sdlc: Phase 3 Construction Baseline — playbook, docs, and code integration (46697d3)
• sdlc: Phase 5 Production Live — code, docs, and gate integration (41a508a)
• topologies: close GT-165 concrete SLO and cost budgets for serverless and edge (a8e70ac)
• topology: add compliance audit playbook, register in Wilson, add GT-277/278/279 (314d1df)
• topology: add compliance audit playbook, register in Wilson, add GT-277/278/279 (b7c379c)
• topology: close GT-277 with 8 OpenAPI specs, bump global score to 90% (8f14459)
• topology: close GT-277 with 8 OpenAPI specs, bump global score to 90% (78e9908)
• topology: close GT-278 with 8 MCP manifests, bump global score to 95% (2a4b3bd)
• topology: close GT-278 with 8 MCP manifests, bump global score to 95% (7bed54d)
• topology: close GT-279 with 16 CLI flow files, reach 100% (168/168) (0afeeb8)
• topology: close GT-279 with 16 CLI flow files, reach 100% (168/168) (089c9b1)
• topology: GT-165 operational budgets for serverless and edge (8a0be89)
• typescript: enable strict mode across all packages (GT-187) (7a3aa44)
• wiki: add auto-sync wiki generation and CI workflow (92142c9)

Bug Fixes

• adr: renumber OPA bundle ADR 0076 to 0099 to resolve duplicate ID (GT-175) (47e670b)
• adrs: resolve 0049/0056 status — 0049 Accepted, 0056 Accepted (extends, not supersedes) (cfb4acb)
• agents: GT-260 add Spanish translation of PO agent persona (8ba7b74)
• align gap statuses with closure evidence (cecda24)
• audit: wire MetricsService into SecurityAuditInterceptor so recordHttpRequest fires (ed51556)
• ci: add npm ci to core-validation jobs missing it (GT-197) (507382f)
• ci: add SECURITY.md to optimize-repo allowedFiles + remove stale release-please entries (f8e848b)
• ci: add wiki/ to root cleanliness whitelist, fix wiki-sync workflow (0de7b8a)
• ci: allowlist standard root files (root-cleanliness gate) (d8e1c94)
• ci: build @evolith/* deps in the smart-cli Test job (TS2307 in CI) (189b9c8)
• ci: build sdk/cli before its tests (integration specs spawn dist/main.js) (d8c2ff2)
• ci: CD gate runs smart-cli unit suite, not the env-sensitive e2e (2cde7b1)
• ci: docs validator — exclude inline code from prose-corruption checks + fix ES anchor (88c9656)
• ci: fix test compilation errors + lint boundary crash (1a79899)
• ci: GT-259 change publish trigger to tag-based (dae62ce)
• ci: regenerate package-lock.json — npm ci was out of sync (broke all CI jobs) (d07e8a2)
• ci: resolve sdk-cli-ci pipeline failures (920210c)
• ci: restore 3 missing CI scripts + add CI mode selector, close GT-268 (c3fc078)
• ci: restore SECURITY.md and add to root cleanliness whitelist (79da82d)
• ci: sync package-lock.json + fix opa-parity npm ci failure (b10e6e6)
• cli,mcp: align architecture commands with the 8 canonical topologies (f9e5d6b)
• cli,mcp: merge — align architecture commands with 8 canonical topologies (695fdb7)
• cli: GT-345 — restore validate @command registration + gate.e2e version (875fb3c)
• cli: GT-345 — smart-cli unit suite green (905/905) + add --version support (b3cf0e2)
• cli: merge — 1.1.3 release + build-info fix (1693795)
• cli: release 1.1.3 + prevent empty incremental builds (2597fe1)
• close GT-276 bilingual coverage dashboard area pairing (c047eb7)
• config: add SWAGGER_ENABLED to env schema (c340fdc)
• config: add SWAGGER_ENABLED to env schema (dca137e)
• consolidate gap tracking — reopen GT-20, sync progress, fix GT-229/GT-250 status (b36ee9e)
• core-api: add missing type deps + explicit Dirent type for TS build (a725978)
• core-api: bust Docker cache — packages now live on npm (35e81dc)
• core-api: include reference/ corpus so topologies endpoint returns data (8845934)
• core-api: include reference/ corpus so topologies endpoint returns data (685bd10)
• core-api: upgrade keyv to 5.6.0 + legacy-peer-deps in Dockerfile (de9b150)
• core-domain: bundle rulesets inside npm package + fix __dirname path (56b012f)
• core-domain: GT-344 — embedded default workflow so published CLI never crashes (1bdbc47)
• core-domain: GT-350 — remove new Function() code-exec sink in standards rule checks (d243bab)
• core-domain: remove dead PhaseGateValidatorService inject in PhaseTransitionUseCase factory (ed51556)
• correct maturity reconciliation pending count (29→0) to match OPEN status (3bfca4b)
• deps: pin all dependency versions and sync lockfile (a17473d)
• docker: copy root package-lock.json to builder (4afe9e3)
• docker: copy root package-lock.json to builder — npm ci requires it (9572e24)
• docker: copy rulesets to node_modules/ path expected by core-domain (0c90560)
• docker: correct healthcheck path /api/v1/health → /health + longer start period (d4f96c2)
• docker: use npm install instead of npm ci + add VPS Coolify deployment guide (19e1a56)
• docker: use standalone package-lock.json for core-api (b6bbc9c)
• docker: use standalone package-lock.json for core-api build (6148556)
• docs: fix BILINGUAL_INDEX 1,740 broken links + .bmad-core stale references (22a6612)
• docs: resolve critical issues from 3-audit sweep (3de3233)
• docs: resolve critical issues from 3-audit sweep (5cdee3e)
• engine: fix async import bug in orchestration engine (GT-228) (a426801)
• engine: GT-228 add CLI wrapper for orchestration engine (593f5a6)
• env: remove dead ALLOWED_ORIGINS from .env.example (field removed from schema) (ed51556)
• executive summary now data-driven — accurate when all gaps closed (6ad78d9)
• gaps: reorder gap-tracking by status, criticality, complexity (e33016c)
• governance: GT-357 — register 36 missing closure-evidence records + reconcile maturity (f5261bb)
• gt-151: fail closed on topology rule divergence (b443dcd)
• gt-250: fail-closed MCP auth when no API key configured (866bbe8)
• gt-250: resolve merge conflicts in gap-tracking (2251e5f)
• gt-274: harden cleanup-temp-files against tracked-file deletion (60221b3)
• health-spec: rewrite spec for async ready() with IFileSystem + ConfigService mocks (ed51556)
• hook+maturity: sync-project-board local priority + maturity 329/330 (a51b2e8)
• hook: sync-project-board prefers local when tracking file was last committed (32f663a)
• implement GT-286 compliance baseline ruleset path (2396bc7)
• implement GT-287 definition of done ruleset path (c001e60)
• implement GT-288 engineering manifesto ruleset path (fd2ba02)
• implement GT-289 repository taxonomy ruleset path (c41e7d7)
• implement GT-290 phase gates ruleset path (fba055e)
• implement GT-291 quality thresholds ruleset path (46beae2)
• infra: GT-256 add --ping=true to Traefik healthcheck (e83abea)
• infra: GT-257 pin MongoDB image to 7.0 (6fb9be1)
• infra: GT-270 pin mutable images, disable dev defaults (c5f4206)
• infra: GT-351 slice 1 — harden WebhookAdapter (timeout + retry + SSRF guard) + tests (f66c802)
• maturity: update reconciliation to 329/330 — all pending gaps closed (26a0198)
• mcp-server: accurate startup auth log in production (8e9869f)
• mcp-server: GT-266 API key provisioning service for MCP HTTP transport (c760bcf)
• mcp-server: GT-349 — ABAC OPA fails closed in production when policy.wasm is missing (460e65f)
• mcp-server: make production build deployable to Docker/Coolify (64885dd)
• mcp-server: resolve GT-267 — fix CacheModule mock + handleListTools async + parseArgs boolean flags (3b2e6ad)
• mcp-tools: GT-352 — validate CallTool args against inputSchema + add README (30b62b9)
• metrics: @SkipThrottle() on MetricsController (Prometheus scraper was rate-limited) (ed51556)
• metrics: store httpRequestsTotal reference so it can be incremented (was always 0) (ed51556)
• move evolith.config.json to reference/config directory (4e46ba6)
• opa: fix syntax for OPA 0.65.0 + add missing test coverage (5c2bc36)
• opa: GT-347 — unblock the core governance test suite (was 100% unloadable) (c915d01)
• opa: GT-358 — core governance suite green 197/197; complete GT-347 (gate + wasm) (c5998d1)
• opa: wire 19 orphaned policies into main.rego aggregator (GT-252) (08c883b)
• patterns: remove duplicate patterns/es/ subdirectory (GT-176) (825a668)
• post-audit: 8 bugs found during secondary review (ed51556)
• re-sync tracking after bidirectional gap sync (426db1d)
• rename agent ID from @wilson to @winston across entire codebase (940a45e)
• restore gap statuses after merge conflict (742be2d)
• restore global documentation and tracking gates (95159a9)
• restore GT-267 workspace cache baseline (96dc111)
• sdk-client: initProject URL /projects/init → /projects/initialize (always 404) (ed51556)
• sdk-client: ProposeAdvanceRequest missing currentPhase field (broke propose-advance) (ed51556)
• sdlc: Phase 1+2 code corrections — artifact paths, blocking criteria, bounded context map (0e7d141)
• sdlc: Phase 4 code + docs — artifact mappings, blocking criteria, quality thresholds (1e2a063)
• secure GT-272 OPA sidecar bundles (e26aa2e)
• security: GT-251 command injection fix, GT-253 trivy-action pinning, GT-250 evidence backfill (bbd2e51)
• security: GT-254 path traversal protection in MCP resource resolution (6d39274)
• security: GT-255 add CSP/security headers to MCP HTTP transport (46354c0)
• security: GT-313 part 1 — externalize GH_TOKEN; stop reading plaintext .env (06a55da)
• security: GT-348/349 — remove file-system-race (TOCTOU) in abac-evaluator (8feb045)
• security: resolve 72 code scanning alerts — unused imports, variables, and path sanitization (1ecbd91)
• security: resolve code-scanning findings — 2 ReDoS, 2 dep CVEs, 2 unused (31abf29)
• security: resolve CodeQL code-scanning alerts (9ff7e09)
• smart-cli: GT-346 — run scaffolding providers shell-free (executeFile) + fix latent GT-351 regression (d34bc3a)
• sync progress counters after gap-track sync hook (825de9c)
• tracing: SIGTERM only shuts down OTel SDK when it was actually started (avoids crash) (ed51556)
• tracking: demote 14 gaps to PENDING per catalog checkbox state (c25270b)
• tracking: revert GT-330 to IN-PROGRESS — premature closure on flawed E2E evidence (93ae64e)
• update Last Updated date in gap tracking to 2026-06-23 (4b54c3c)
• update maturity reconciliation with new gap totals (282→311) (637f36e)
• use /dev/tty for TTY detection so prompts work with git commit -m (3bf4c88)

Performance Improvements

• docker: eliminate build context bloat + smaller dist (155d87b)
• docker: faster builds — npm ci + drop reference/ from image (32ef2b9)
• mcp-server: GT-348 — cache compiled ABAC OPA policy instead of recompiling per dispatch (b857b7f)
• runtime: disable Swagger in production + remove lockfile from image (3824a5e)

---

This PR was generated with Release Please. See documentation.

[github-actions]

📊 Bilingual Coverage Impact

PR Changes

• Paired EN/ES files modified: 0
• New EN files needing ES translation: 1

Repository Coverage

Metric	Value
Total EN files	550
Total ES files	544
Paired files	0
Coverage	0%

⚠️ Action required: 1 new EN file(s) added without ES counterparts.

To create skeletons:

node .harness/scripts/generate-es-skeleton.mjs <file.md>

---

Generated by GitHub Actions