diff --git a/CHANGELOG.md b/CHANGELOG.md
index d4ddeb5f..667d934b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,227 @@
 # Changelog
 
+## 1.0.0 (2026-06-28)
+
+
+### Features
+
+* add intelligent data strength assessment and audit script ([1b45d08](https://github.com/beyondnetcode/evolith_arch32/commit/1b45d08be1861b4b35e6c8cfba723e7abb6b320e))
+* add merge method selector + owner-gated CI skip to husky hooks ([30adda6](https://github.com/beyondnetcode/evolith_arch32/commit/30adda61ca32d074e541f541229658a4df6e61d0))
+* add Spanish gap reference catalog entries for intelligent data audit gaps (GT-283-GT-311) ([e0dda8d](https://github.com/beyondnetcode/evolith_arch32/commit/e0dda8d50a978f57131275fc3093043e28504a71))
+* **agentic-ai:** implement GT-169 operational controls ([19fb0c4](https://github.com/beyondnetcode/evolith_arch32/commit/19fb0c41c54719c21ed9024b6fa816eddf92ef13))
+* **agents:** enhance BMAD agents with Evolith Core governance context ([361acd4](https://github.com/beyondnetcode/evolith_arch32/commit/361acd4615fd1e56ad839570402ab91e500c6db7))
+* **agents:** enhance BMAD agents with Evolith Core governance context ([361acd4](https://github.com/beyondnetcode/evolith_arch32/commit/361acd4615fd1e56ad839570402ab91e500c6db7))
+* **agents:** enhance BMAD agents with Evolith Core governance context ([48d59ae](https://github.com/beyondnetcode/evolith_arch32/commit/48d59aee0cdd95789d5979dd73186d8ef6583728))
+* **agents:** enhance BMAD agents with Evolith Core governance context and self-improvement mandate ([48d59ae](https://github.com/beyondnetcode/evolith_arch32/commit/48d59aee0cdd95789d5979dd73186d8ef6583728))
+* **agents:** enhance BMAD agents with Evolith Core governance context, self-improvement mandate, and full bilingual parity ([00839f2](https://github.com/beyondnetcode/evolith_arch32/commit/00839f2cee24b46878e90adb099345db67d4d14e))
+* **api:** enable Swagger via SWAGGER_ENABLED env var ([25c26f1](https://github.com/beyondnetcode/evolith_arch32/commit/25c26f1d415f4c818d37863ae2aa40acc7a7111e))
+* **api:** enable Swagger via SWAGGER_ENABLED env var ([d20ff41](https://github.com/beyondnetcode/evolith_arch32/commit/d20ff4169127b90d4ac501841bc6d1625b0a6032))
+* **arch:** comprehensive HA/resilience/security/governance overhaul ([20d9b10](https://github.com/beyondnetcode/evolith_arch32/commit/20d9b10028dfdd57f29e328a9fc32d3c8c9564dd))
+* **architecture:** add operationalBudgets to agentic-ai manifest (GT-219) ([7da34b3](https://github.com/beyondnetcode/evolith_arch32/commit/7da34b372b7f16b000e39e9e2ecc879ac700a514))
+* **architecture:** create agnostic baseline (GT-209) + reorder gap-tracking pending-first ([2e58fd4](https://github.com/beyondnetcode/evolith_arch32/commit/2e58fd46661bd0592783ad85c00de4554168e84b))
+* **bmad:** role-specialized QA agent suite + orchestration (GT-330 mitigation) ([f740774](https://github.com/beyondnetcode/evolith_arch32/commit/f740774c6267043f5418e22b3046933d6969e1e5))
+* **cache:** implement Redis caching layer for Core API and MCP (GT-249) ([4a876d5](https://github.com/beyondnetcode/evolith_arch32/commit/4a876d5ac46be74a05f69730753a48f19c6800fc))
+* **ci:** add skip mode + sync option to CI menu ([37c23a6](https://github.com/beyondnetcode/evolith_arch32/commit/37c23a664e44f3fbf17867035aebfe542524a868))
+* **ci:** close GT-147 — operational capability & efficiency drift audit ([f4b163b](https://github.com/beyondnetcode/evolith_arch32/commit/f4b163b7fb92d6c6deaea81b2eb56fc6f9aa63ad))
+* **ci:** executable OPA evaluator + Native/OPA parity gate (GT-149) ([5f9fd11](https://github.com/beyondnetcode/evolith_arch32/commit/5f9fd110c9488e2abfc1e4f16b5e85737a28a0b7))
+* **ci:** GT-149 progress — executable OPA + Native/OPA parity gate (~70%, not closed) ([0c5c57d](https://github.com/beyondnetcode/evolith_arch32/commit/0c5c57d52a89db364626725b40062d6d9ce9da03))
+* **ci:** GT-343 stage 5 — phase/topology namespace anti-collision guard ([560cae4](https://github.com/beyondnetcode/evolith_arch32/commit/560cae4ac41dc4b2d3c7a364051fb10ed1d1a344))
+* **ci:** parity gate scoping, version stamps, scheduled full run (GT-149) ([06ffd2f](https://github.com/beyondnetcode/evolith_arch32/commit/06ffd2f69f05fecfdb166460db6ff707d2a0edce))
+* close all pending gaps — infrastructure + closure evidence (GT-216/217/220-227/231/232/234/235/237-248) ([1244af0](https://github.com/beyondnetcode/evolith_arch32/commit/1244af0721f80a3dae1a2aed35f69d89c8713553))
+* close GT-155 and GT-156 core API conformance and documentation ([a9297f4](https://github.com/beyondnetcode/evolith_arch32/commit/a9297f4e580b1fb462a52b879f175ab06ea2fbca))
+* complete GT-312 composable validation engine ([00bb08d](https://github.com/beyondnetcode/evolith_arch32/commit/00bb08d5bdbabcd3ae27d74c16c58421df9e6630))
+* **contracts:** GT-343 stage 3 — public SDLC phase enums accept canonical ids ([5f97625](https://github.com/beyondnetcode/evolith_arch32/commit/5f9762561898b8240ffd3d387ae28dd15cbf4afe))
+* **core-api:** close GT-159 REST versioning and deprecation linter/tests ([956bba2](https://github.com/beyondnetcode/evolith_arch32/commit/956bba247a8bcfbb68ecc2d891e6a52cb0ab4be7))
+* **core-api:** GT-155 envelope conformance with ADR-0073 ([6f266f3](https://github.com/beyondnetcode/evolith_arch32/commit/6f266f3b54ce851e812e9e5f0ef20fde76d1d041))
+* **core-api:** GT-159 REST URI versioning + deprecation policy (ADR-0098) ([f57294e](https://github.com/beyondnetcode/evolith_arch32/commit/f57294ee52862cda765b96677844d74c9683f970))
+* **core-domain:** GT-343 stage 1 — canonical SDLC PhaseId + alias normalizer ([7ecc560](https://github.com/beyondnetcode/evolith_arch32/commit/7ecc560666586b99e7612a12e9660a313d8bf13b))
+* **core:** implement GT-359 to GT-362 for evaluation pipeline ([ce9a53f](https://github.com/beyondnetcode/evolith_arch32/commit/ce9a53fe7f68d4a0ddf25befde015b0513dd93b8))
+* **cross:** close GT-160 correlation-ID and context propagation ([af62206](https://github.com/beyondnetcode/evolith_arch32/commit/af62206817f277aa41494251f2196ac8dca8217c))
+* **evaluator:** implement 5 native rule handlers + parity fixtures for GT-229 ([6ba915c](https://github.com/beyondnetcode/evolith_arch32/commit/6ba915c118c9637554c5523a94cc557e2136f1e4))
+* **examples:** implement GT-168 cross-topology composition reference ([4e8fcad](https://github.com/beyondnetcode/evolith_arch32/commit/4e8fcad3c912e49208c9a198adb7b76abbdc9cf2))
+* execute 20 gaps in parallel — docs, OPA, CI, security, CLI/MCP (GT-216/217/220-226/232/234/235/237/240/241/244/247/248) ([f1d9814](https://github.com/beyondnetcode/evolith_arch32/commit/f1d9814f74ea78fce65baf4374fd3fd34a364f6e))
+* extend GT-312 to composable multi-entry-point validation ([f5fdcd1](https://github.com/beyondnetcode/evolith_arch32/commit/f5fdcd1084b9d225ed99446995b221a8de439940))
+* **gaps:** add GT-266 - API key provisioning service for MCP HTTP ([67fb9df](https://github.com/beyondnetcode/evolith_arch32/commit/67fb9dfed4419bb8de1568764c7ba49e6bc79ff7))
+* **gaps:** add GT-266 - API key provisioning service for MCP HTTP ([7370aaf](https://github.com/beyondnetcode/evolith_arch32/commit/7370aaf5c90d7c8ec07817056deb7084a9bd4be6))
+* **gaps:** close GT-102/104/107/114/116 closureCommits, integrate 34 NXT items as GT-175-208, translate 18 ES files ([bef6d47](https://github.com/beyondnetcode/evolith_arch32/commit/bef6d470e5c39e492a81b68d6b951c134cca692a))
+* **gaps:** close GT-150 (topology maturity) and GT-149 (OPA parity gate) ([8606a96](https://github.com/beyondnetcode/evolith_arch32/commit/8606a96d217d1d00485dd2bb305364664e103c47))
+* **gaps:** close GT-150 (topology maturity) and GT-149 (OPA parity gate) ([85d2e4a](https://github.com/beyondnetcode/evolith_arch32/commit/85d2e4acc7bc161ec34d6f8676218515e6cef077))
+* **gaps:** close GT-151 — complete Native/OPA rule-ID coverage ([5d46b8a](https://github.com/beyondnetcode/evolith_arch32/commit/5d46b8a6939dfa3c8c2c5a0b37f6e8e8c900597f))
+* **gaps:** close GT-152/153/154 — knowledge contract, lifecycle, RAG parity ([572c59a](https://github.com/beyondnetcode/evolith_arch32/commit/572c59a50c9a7aeffda17e747576460301fe20f0))
+* **gaps:** close GT-171 GT-172 GT-173 - surface parity, contract test, OTel ([c6ff59c](https://github.com/beyondnetcode/evolith_arch32/commit/c6ff59cd809e3ce05614202b91500fb49f0d651c))
+* **gaps:** close GT-314–GT-330 — 329/330 gaps resolved, 0 pending ([d26877d](https://github.com/beyondnetcode/evolith_arch32/commit/d26877d00cc7f4330786eff73451d1b1fec83b93))
+* **gaps:** close GT-314–GT-330 — all 17 pending gaps resolved ([d2b7d2b](https://github.com/beyondnetcode/evolith_arch32/commit/d2b7d2b79c91750b47549ade447fb158aa68982c))
+* **governance:** add governance metadata to all 8 topology manifests (GT-213) ([67fac2b](https://github.com/beyondnetcode/evolith_arch32/commit/67fac2bd8188970edbf7cbe055c96eff1190f888))
+* **governance:** close GT-174 envelope schemaVersion compatibility matrix ([4078471](https://github.com/beyondnetcode/evolith_arch32/commit/407847150b2a3b55f6487b81f3e5eddc198a7a3b))
+* **governance:** GT-357 DONE — board now reconciles with executed build/test evidence ([42cc1cb](https://github.com/beyondnetcode/evolith_arch32/commit/42cc1cb817e8af516c31ec492c9f2e18fea60a83))
+* **governance:** R-25 parity certification 39/39, R-30, SDLC gate fixes, infrastructure OPA ([abe29e2](https://github.com/beyondnetcode/evolith_arch32/commit/abe29e2e15c025adb438100317f1cb83bf09cd22))
+* GT-273 — ephemeral DAST ZAP scan in CI + GT-20 ADR Technology Watch backfill ([2d51059](https://github.com/beyondnetcode/evolith_arch32/commit/2d510597f75c0151a91a89c6a0140bebb67538cd))
+* implement GT-312 composable validation engine ([d067857](https://github.com/beyondnetcode/evolith_arch32/commit/d067857d486905e7eec7ee26c20164677c3630e7))
+* **infra:** GT-324 — CD pipeline builds+pushes core-api/mcp-server to GHCR + guarded Coolify deploy ([ab64c60](https://github.com/beyondnetcode/evolith_arch32/commit/ab64c609762171909b6f75918cce826215464bda))
+* **knowledge:** automate knowledge intake pipeline (GT-236) ([266f435](https://github.com/beyondnetcode/evolith_arch32/commit/266f4357af92594d6d7e52fa0e2b812549bb8dcf))
+* **knowledge:** establish governed multi-architecture intake ([de5521e](https://github.com/beyondnetcode/evolith_arch32/commit/de5521e9630734627ed117865f35bf8be9f8a28a))
+* **mcp-server:** close GT-158 Human-in-the-loop and ABAC scoping for mutative tools ([4fd5c6e](https://github.com/beyondnetcode/evolith_arch32/commit/4fd5c6ebbdb5cb499fc6c2ac54d7bfacb762d532))
+* **mcp:** production-ready Dockerfile for SSE deployment ([16c9699](https://github.com/beyondnetcode/evolith_arch32/commit/16c969953074162e59ddb836806f90ef34441632))
+* **mcp:** production-ready Dockerfile for SSE deployment ([3bccdbb](https://github.com/beyondnetcode/evolith_arch32/commit/3bccdbb6271704b17a3b1ef40009c5652e9b9fa8))
+* **opa:** add Phase 1 OPA policies for 5 cross-cutting rulesets (GT-216) ([96b17fe](https://github.com/beyondnetcode/evolith_arch32/commit/96b17fe8b96485ed590e83884b8631636444f3b5))
+* **opa:** close GT-161 JSON input schemas and validation gate ([ccfa947](https://github.com/beyondnetcode/evolith_arch32/commit/ccfa9471b3c6eaddf28884d16cd9ea78044270ce))
+* **p0-gaps:** close GT-283/284/285/295/296/297/298 — topology rulesets + core-domain gates/phases + mcp resources/watcher ([856912b](https://github.com/beyondnetcode/evolith_arch32/commit/856912b9ec7900ab7f017f0ad0737deed4296d83))
+* **p1-gaps:** close GT-299/300/301/302/303/304/305/306/307/310/311 — OpenAPI, CLI commands, core-domain models, CLI tests ([817986c](https://github.com/beyondnetcode/evolith_arch32/commit/817986cf46720febd3ce49808c01bf8dd5aafd52))
+* **p2-gaps:** close GT-308 and GT-309 — CLI plugin system + contribution validator ([34c0abd](https://github.com/beyondnetcode/evolith_arch32/commit/34c0abd078b8755cc5afbc0f50e8b8caa7e93730))
+* register GT-312 SDLC validation orchestration master gap ([08ab178](https://github.com/beyondnetcode/evolith_arch32/commit/08ab1789ed2d528d4c00ae37e389074ee333d4fd))
+* register intelligent data audit gaps in gap-tracking boards ([44b00d2](https://github.com/beyondnetcode/evolith_arch32/commit/44b00d2e0870b75d006fcb938723dd7e8aa7a0d6))
+* **release:** add npm publish pipeline for core-domain and infra-providers ([26907ce](https://github.com/beyondnetcode/evolith_arch32/commit/26907cee1e90767327807c460dd7f4a6f6c1fd97))
+* **rulesets:** add satellite-contracts standalone WS1 entrypoint (GT-292) ([cd40dd8](https://github.com/beyondnetcode/evolith_arch32/commit/cd40dd8b2da60081fdb182277740199023246b22))
+* **rulesets:** close GT-293 and GT-294 — executive-scorecards canonical dir + architecture OPA ([ad0fe74](https://github.com/beyondnetcode/evolith_arch32/commit/ad0fe74cb75f2326d57b299d1f307997f77bd7f7))
+* **rulesets:** implement GT-162 OPA aggregator tests and parity validator ([72bfe62](https://github.com/beyondnetcode/evolith_arch32/commit/72bfe629c784c400096499b4ede4edf8ba76f13d))
+* **rulesets:** implement GT-163 topology manifest references validation ([fcd5d2a](https://github.com/beyondnetcode/evolith_arch32/commit/fcd5d2af05ddab488698a8cda55866f3eb5cecb7))
+* **rulesets:** implement GT-164 event-driven and data-mesh ruleset richness ([bbe5db9](https://github.com/beyondnetcode/evolith_arch32/commit/bbe5db914965e11577574b488df30a735cea08d9))
+* **sdlc:** add Phase 05 rollback rehearsal + on-call handoff templates (GT-218) ([bb00773](https://github.com/beyondnetcode/evolith_arch32/commit/bb00773043ec798ec8060dc21be83ac466c48812))
+* **sdlc:** close GT-281 pipeline + GT-282 actionable reports, reach 75% (6/8) ([661a884](https://github.com/beyondnetcode/evolith_arch32/commit/661a8846e74336452ec8972eb13287d59cd0c1b9))
+* **sdlc:** implement 01.1 Knowledge-First Discovery / KDD Readiness subphase ([479a549](https://github.com/beyondnetcode/evolith_arch32/commit/479a549a0517c61265f9c9c822bc5d92e00bc8ee))
+* **sdlc:** Phase 3 Construction Baseline — playbook, docs, and code integration ([46697d3](https://github.com/beyondnetcode/evolith_arch32/commit/46697d3edc46ce447a0ce8f59ca8b7d5ba4f0839))
+* **sdlc:** Phase 5 Production Live — code, docs, and gate integration ([41a508a](https://github.com/beyondnetcode/evolith_arch32/commit/41a508a358b792df73d070dfc55c7012737352a8))
+* **topologies:** close GT-165 concrete SLO and cost budgets for serverless and edge ([a8e70ac](https://github.com/beyondnetcode/evolith_arch32/commit/a8e70ac3eff3768667dfcba6c7fe371fa4c4416a))
+* **topology:** add compliance audit playbook, register in Wilson, add GT-277/278/279 ([314d1df](https://github.com/beyondnetcode/evolith_arch32/commit/314d1df6acee48418104cc50c608a233aa4a7b6b))
+* **topology:** add compliance audit playbook, register in Wilson, add GT-277/278/279 ([b7c379c](https://github.com/beyondnetcode/evolith_arch32/commit/b7c379c00f2143490073c830177ca89a810016ae))
+* **topology:** close GT-277 with 8 OpenAPI specs, bump global score to 90% ([8f14459](https://github.com/beyondnetcode/evolith_arch32/commit/8f14459bf4d3dcaf1834b5f86ee3d335326b31df))
+* **topology:** close GT-277 with 8 OpenAPI specs, bump global score to 90% ([78e9908](https://github.com/beyondnetcode/evolith_arch32/commit/78e9908100b2c743223da090e4202563ff9bbce6))
+* **topology:** close GT-278 with 8 MCP manifests, bump global score to 95% ([2a4b3bd](https://github.com/beyondnetcode/evolith_arch32/commit/2a4b3bd4d53fbcb92b3dbb3c7461e75b9432ae80))
+* **topology:** close GT-278 with 8 MCP manifests, bump global score to 95% ([7bed54d](https://github.com/beyondnetcode/evolith_arch32/commit/7bed54d05814bb2d4fe8e5b2f93839387e6eb0b6))
+* **topology:** close GT-279 with 16 CLI flow files, reach 100% (168/168) ([0afeeb8](https://github.com/beyondnetcode/evolith_arch32/commit/0afeeb8264b94ab8bc1f71b3131b08f6055b6ae3))
+* **topology:** close GT-279 with 16 CLI flow files, reach 100% (168/168) ([089c9b1](https://github.com/beyondnetcode/evolith_arch32/commit/089c9b16a8c68338091bb4447609824e88d0cfdd))
+* **topology:** GT-165 operational budgets for serverless and edge ([8a0be89](https://github.com/beyondnetcode/evolith_arch32/commit/8a0be8954690fd0eae8106cb28b899a1e2cd79d8))
+* **typescript:** enable strict mode across all packages (GT-187) ([7a3aa44](https://github.com/beyondnetcode/evolith_arch32/commit/7a3aa44caffe4102eeaf51f4edd4897cddc96099))
+* **wiki:** add auto-sync wiki generation and CI workflow ([92142c9](https://github.com/beyondnetcode/evolith_arch32/commit/92142c9b3fec78f25fa4fbf95ad7dbe0bf4108a5))
+
+
+### Bug Fixes
+
+* **adr:** renumber OPA bundle ADR 0076 to 0099 to resolve duplicate ID (GT-175) ([47e670b](https://github.com/beyondnetcode/evolith_arch32/commit/47e670b7c2fb79b8220396c8123e1a7dd3a1b437))
+* **adrs:** resolve 0049/0056 status — 0049 Accepted, 0056 Accepted (extends, not supersedes) ([cfb4acb](https://github.com/beyondnetcode/evolith_arch32/commit/cfb4acb531600bd4f1158897de51621332f3fde0))
+* **agents:** GT-260 add Spanish translation of PO agent persona ([8ba7b74](https://github.com/beyondnetcode/evolith_arch32/commit/8ba7b7469752a79766bf9e3f8761461e5036f6e6))
+* align gap statuses with closure evidence ([cecda24](https://github.com/beyondnetcode/evolith_arch32/commit/cecda2404080750f4a11f8214d8681828c02b349))
+* **audit:** wire MetricsService into SecurityAuditInterceptor so recordHttpRequest fires ([ed51556](https://github.com/beyondnetcode/evolith_arch32/commit/ed51556f9cde43efcfec8e231b86e5fda1fd6239))
+* **ci:** add npm ci to core-validation jobs missing it (GT-197) ([507382f](https://github.com/beyondnetcode/evolith_arch32/commit/507382f3d64403a553ba3b562bfc6781385c8e54))
+* **ci:** add SECURITY.md to optimize-repo allowedFiles + remove stale release-please entries ([f8e848b](https://github.com/beyondnetcode/evolith_arch32/commit/f8e848bc02398b65b929b3b42e359e9a05e23b67))
+* **ci:** add wiki/ to root cleanliness whitelist, fix wiki-sync workflow ([0de7b8a](https://github.com/beyondnetcode/evolith_arch32/commit/0de7b8a3547ddf14433372c1769d54c2e753a5fa))
+* **ci:** allowlist standard root files (root-cleanliness gate) ([d8e1c94](https://github.com/beyondnetcode/evolith_arch32/commit/d8e1c94056829c61eba34385df704e3e601f0424))
+* **ci:** build @evolith/* deps in the smart-cli Test job (TS2307 in CI) ([189b9c8](https://github.com/beyondnetcode/evolith_arch32/commit/189b9c82f084bab30c9234b13d13a42a55cb4ac6))
+* **ci:** build sdk/cli before its tests (integration specs spawn dist/main.js) ([d8c2ff2](https://github.com/beyondnetcode/evolith_arch32/commit/d8c2ff24961660ae007afcf5fd76670773ebde05))
+* **ci:** CD gate runs smart-cli unit suite, not the env-sensitive e2e ([2cde7b1](https://github.com/beyondnetcode/evolith_arch32/commit/2cde7b18a69db1f1b5dccab082a9d70449b19d14))
+* **ci:** docs validator — exclude inline code from prose-corruption checks + fix ES anchor ([88c9656](https://github.com/beyondnetcode/evolith_arch32/commit/88c9656dbd831ac156446f4592cdafa9c511df9a))
+* **ci:** fix test compilation errors + lint boundary crash ([1a79899](https://github.com/beyondnetcode/evolith_arch32/commit/1a7989928e2edb7f1b97239cf9cfdbce1a44796c))
+* **ci:** GT-259 change publish trigger to tag-based ([dae62ce](https://github.com/beyondnetcode/evolith_arch32/commit/dae62ce3a22d4f8741adfc3b9ee418900fe95d39))
+* **ci:** regenerate package-lock.json — npm ci was out of sync (broke all CI jobs) ([d07e8a2](https://github.com/beyondnetcode/evolith_arch32/commit/d07e8a20b3d8222c1b5f0d35fb8098fa297609ee))
+* **ci:** resolve sdk-cli-ci pipeline failures ([920210c](https://github.com/beyondnetcode/evolith_arch32/commit/920210c1687d1006cacf3c320c8488c4dd22fb2b))
+* **ci:** restore 3 missing CI scripts + add CI mode selector, close GT-268 ([c3fc078](https://github.com/beyondnetcode/evolith_arch32/commit/c3fc0782a7f1feaade32f835d4878d34fc7419dc))
+* **ci:** restore SECURITY.md and add to root cleanliness whitelist ([79da82d](https://github.com/beyondnetcode/evolith_arch32/commit/79da82d33a822900e717fa9f66d40998634dd48e))
+* **ci:** sync package-lock.json + fix opa-parity npm ci failure ([b10e6e6](https://github.com/beyondnetcode/evolith_arch32/commit/b10e6e663e96b2f173f452d30dae4f933ca16be6))
+* **cli,mcp:** align architecture commands with the 8 canonical topologies ([f9e5d6b](https://github.com/beyondnetcode/evolith_arch32/commit/f9e5d6ba096f24c1054d6ec5c2057b276d114814))
+* **cli,mcp:** merge — align architecture commands with 8 canonical topologies ([695fdb7](https://github.com/beyondnetcode/evolith_arch32/commit/695fdb745f01851003c42cf30e4e70fe987d1f05))
+* **cli:** GT-345 — restore validate @Command registration + gate.e2e version ([875fb3c](https://github.com/beyondnetcode/evolith_arch32/commit/875fb3c93df63b1a9d2d65a8f99c4aae0cce0345))
+* **cli:** GT-345 — smart-cli unit suite green (905/905) + add --version support ([b3cf0e2](https://github.com/beyondnetcode/evolith_arch32/commit/b3cf0e223ede2f14a3c55dff4cfdeef51891cbb0))
+* **cli:** merge — 1.1.3 release + build-info fix ([1693795](https://github.com/beyondnetcode/evolith_arch32/commit/16937956f31bfac79c08c12d646a6b2db788eda5))
+* **cli:** release 1.1.3 + prevent empty incremental builds ([2597fe1](https://github.com/beyondnetcode/evolith_arch32/commit/2597fe1fc33627f51aaa479a058f453328da6308))
+* close GT-276 bilingual coverage dashboard area pairing ([c047eb7](https://github.com/beyondnetcode/evolith_arch32/commit/c047eb7165c02bc9af9eb4ce1e6a81531ec66b49))
+* **config:** add SWAGGER_ENABLED to env schema ([c340fdc](https://github.com/beyondnetcode/evolith_arch32/commit/c340fdcad3f2beb75e1c75370899efc965fa2d8d))
+* **config:** add SWAGGER_ENABLED to env schema ([dca137e](https://github.com/beyondnetcode/evolith_arch32/commit/dca137ed138861019c814fa0d919f24265085273))
+* consolidate gap tracking — reopen GT-20, sync progress, fix GT-229/GT-250 status ([b36ee9e](https://github.com/beyondnetcode/evolith_arch32/commit/b36ee9ef27c536b278847cc765ce71655c754a96))
+* **core-api:** add missing type deps + explicit Dirent type for TS build ([a725978](https://github.com/beyondnetcode/evolith_arch32/commit/a725978b0a0f826dc4bd5fd05f1f21e2863d4c13))
+* **core-api:** bust Docker cache — packages now live on npm ([35e81dc](https://github.com/beyondnetcode/evolith_arch32/commit/35e81dceba7f2ce8167a27859b3705cf06cec697))
+* **core-api:** include reference/ corpus so topologies endpoint returns data ([8845934](https://github.com/beyondnetcode/evolith_arch32/commit/88459340e5eefb558d7789e7d50280a846092dc7))
+* **core-api:** include reference/ corpus so topologies endpoint returns data ([685bd10](https://github.com/beyondnetcode/evolith_arch32/commit/685bd10ad1aa3b78677144409b537abb6701f40d))
+* **core-api:** upgrade keyv to 5.6.0 + legacy-peer-deps in Dockerfile ([de9b150](https://github.com/beyondnetcode/evolith_arch32/commit/de9b150826e1fb6ba1d1610eb4fede9fcb2bd7e9))
+* **core-domain:** bundle rulesets inside npm package + fix __dirname path ([56b012f](https://github.com/beyondnetcode/evolith_arch32/commit/56b012f4c13259e5f449696230eb48c05a67fe00))
+* **core-domain:** GT-344 — embedded default workflow so published CLI never crashes ([1bdbc47](https://github.com/beyondnetcode/evolith_arch32/commit/1bdbc478250e97a47c7a54760d07cb71d0f6a9e8))
+* **core-domain:** GT-350 — remove new Function() code-exec sink in standards rule checks ([d243bab](https://github.com/beyondnetcode/evolith_arch32/commit/d243bab7d51f24f8221278a8f8e7c843592df8df))
+* **core-domain:** remove dead PhaseGateValidatorService inject in PhaseTransitionUseCase factory ([ed51556](https://github.com/beyondnetcode/evolith_arch32/commit/ed51556f9cde43efcfec8e231b86e5fda1fd6239))
+* correct maturity reconciliation pending count (29→0) to match OPEN status ([3bfca4b](https://github.com/beyondnetcode/evolith_arch32/commit/3bfca4bb2dbfc9dd3cb02a011a4db3de70fd4fe8))
+* **deps:** pin all dependency versions and sync lockfile ([a17473d](https://github.com/beyondnetcode/evolith_arch32/commit/a17473d1a44727b9b133f03da0d6e17a259f4ebd))
+* **docker:** copy root package-lock.json to builder ([4afe9e3](https://github.com/beyondnetcode/evolith_arch32/commit/4afe9e3060595a7603f08702832f574e24ebc843))
+* **docker:** copy root package-lock.json to builder — npm ci requires it ([9572e24](https://github.com/beyondnetcode/evolith_arch32/commit/9572e2427185d41d318a9c09a250c24dcb3e6237))
+* **docker:** copy rulesets to node_modules/ path expected by core-domain ([0c90560](https://github.com/beyondnetcode/evolith_arch32/commit/0c90560a77664e940e700ac802f3072f188a3dc7))
+* **docker:** correct healthcheck path /api/v1/health → /health + longer start period ([d4f96c2](https://github.com/beyondnetcode/evolith_arch32/commit/d4f96c2bc6e3f219025652ff34835cb3427bcf8a))
+* **docker:** use npm install instead of npm ci + add VPS Coolify deployment guide ([19e1a56](https://github.com/beyondnetcode/evolith_arch32/commit/19e1a564e00aca4118d20167f609a6ec553a33f1))
+* **docker:** use standalone package-lock.json for core-api ([b6bbc9c](https://github.com/beyondnetcode/evolith_arch32/commit/b6bbc9cdc4ff315d78b436cde98613cdb4b18f3e))
+* **docker:** use standalone package-lock.json for core-api build ([6148556](https://github.com/beyondnetcode/evolith_arch32/commit/61485567b2c4a015cf97b13e64519295ba96a1c5))
+* **docs:** fix BILINGUAL_INDEX 1,740 broken links + .bmad-core stale references ([22a6612](https://github.com/beyondnetcode/evolith_arch32/commit/22a661227843e1dcf114801bb035fa4cb4215736))
+* **docs:** resolve critical issues from 3-audit sweep ([3de3233](https://github.com/beyondnetcode/evolith_arch32/commit/3de3233928ca8d825a93e9921e467e1b4782e5c2))
+* **docs:** resolve critical issues from 3-audit sweep ([5cdee3e](https://github.com/beyondnetcode/evolith_arch32/commit/5cdee3e34258fef1d6605c87d0109ec1a186908d))
+* **engine:** fix async import bug in orchestration engine (GT-228) ([a426801](https://github.com/beyondnetcode/evolith_arch32/commit/a42680110a67624b577872c7d7fb942a4b09cb55))
+* **engine:** GT-228 add CLI wrapper for orchestration engine ([593f5a6](https://github.com/beyondnetcode/evolith_arch32/commit/593f5a6e133315cc63bccaab69afd76044aee2df))
+* **env:** remove dead ALLOWED_ORIGINS from .env.example (field removed from schema) ([ed51556](https://github.com/beyondnetcode/evolith_arch32/commit/ed51556f9cde43efcfec8e231b86e5fda1fd6239))
+* executive summary now data-driven — accurate when all gaps closed ([6ad78d9](https://github.com/beyondnetcode/evolith_arch32/commit/6ad78d9e32a6b0504ba9dda145adf3b7a6bf0c2c))
+* **gaps:** reorder gap-tracking by status, criticality, complexity ([e33016c](https://github.com/beyondnetcode/evolith_arch32/commit/e33016cd87fbc5d59d7d7a6078e1aa6e4f88de26))
+* **governance:** GT-357 — register 36 missing closure-evidence records + reconcile maturity ([f5261bb](https://github.com/beyondnetcode/evolith_arch32/commit/f5261bbf7b66b13e792cdbe75499ec6771a1e5b0))
+* **gt-151:** fail closed on topology rule divergence ([b443dcd](https://github.com/beyondnetcode/evolith_arch32/commit/b443dcd25560c0354cde08a83f2d67bea008558f))
+* **gt-250:** fail-closed MCP auth when no API key configured ([866bbe8](https://github.com/beyondnetcode/evolith_arch32/commit/866bbe8ddb8dbe61e998c5de905dfc7bc20543e4))
+* **gt-250:** resolve merge conflicts in gap-tracking ([2251e5f](https://github.com/beyondnetcode/evolith_arch32/commit/2251e5f2cb9f9d6324ece78f0671e59e1562be64))
+* **gt-274:** harden cleanup-temp-files against tracked-file deletion ([60221b3](https://github.com/beyondnetcode/evolith_arch32/commit/60221b30b7bf4b43ad81a259b9eaceb2941745c6))
+* **health-spec:** rewrite spec for async ready() with IFileSystem + ConfigService mocks ([ed51556](https://github.com/beyondnetcode/evolith_arch32/commit/ed51556f9cde43efcfec8e231b86e5fda1fd6239))
+* **hook+maturity:** sync-project-board local priority + maturity 329/330 ([a51b2e8](https://github.com/beyondnetcode/evolith_arch32/commit/a51b2e886dce00be85f1063dd2f87c291a407da4))
+* **hook:** sync-project-board prefers local when tracking file was last committed ([32f663a](https://github.com/beyondnetcode/evolith_arch32/commit/32f663a4d240aa75bc92429b64879b9da74bc8ea))
+* implement GT-286 compliance baseline ruleset path ([2396bc7](https://github.com/beyondnetcode/evolith_arch32/commit/2396bc77a7309e704804a238d879e2f3f01bc87b))
+* implement GT-287 definition of done ruleset path ([c001e60](https://github.com/beyondnetcode/evolith_arch32/commit/c001e6029dd422fbad826a0a78c233548577d39e))
+* implement GT-288 engineering manifesto ruleset path ([fd2ba02](https://github.com/beyondnetcode/evolith_arch32/commit/fd2ba022a8c1ebf950d59939fbd60df6b1b58523))
+* implement GT-289 repository taxonomy ruleset path ([c41e7d7](https://github.com/beyondnetcode/evolith_arch32/commit/c41e7d77021845983ed1421a37a87c8d284583bc))
+* implement GT-290 phase gates ruleset path ([fba055e](https://github.com/beyondnetcode/evolith_arch32/commit/fba055ef97d4d204d3227b8cd554b48e18324185))
+* implement GT-291 quality thresholds ruleset path ([46beae2](https://github.com/beyondnetcode/evolith_arch32/commit/46beae2630d346901f508d9b7e00a38206b6865e))
+* **infra:** GT-256 add --ping=true to Traefik healthcheck ([e83abea](https://github.com/beyondnetcode/evolith_arch32/commit/e83abeaf63fb857d0c28b3a15a71a2550052f646))
+* **infra:** GT-257 pin MongoDB image to 7.0 ([6fb9be1](https://github.com/beyondnetcode/evolith_arch32/commit/6fb9be1bdb19aff927b103d8f77ef1f0e3af55d2))
+* **infra:** GT-270 pin mutable images, disable dev defaults ([c5f4206](https://github.com/beyondnetcode/evolith_arch32/commit/c5f42067cf4fa3c6493c2ff860393444d4791649))
+* **infra:** GT-351 slice 1 — harden WebhookAdapter (timeout + retry + SSRF guard) + tests ([f66c802](https://github.com/beyondnetcode/evolith_arch32/commit/f66c8026a2e42838f06f9f7bc259efae0937e7ca))
+* **maturity:** update reconciliation to 329/330 — all pending gaps closed ([26a0198](https://github.com/beyondnetcode/evolith_arch32/commit/26a01989ffefc9ae23591277a84a4321ac6cfabb))
+* **mcp-server:** accurate startup auth log in production ([8e9869f](https://github.com/beyondnetcode/evolith_arch32/commit/8e9869f0a047cf0071dd921886735478567075e5))
+* **mcp-server:** GT-266 API key provisioning service for MCP HTTP transport ([c760bcf](https://github.com/beyondnetcode/evolith_arch32/commit/c760bcfd42765762f67a5137efce86f88848311f))
+* **mcp-server:** GT-349 — ABAC OPA fails closed in production when policy.wasm is missing ([460e65f](https://github.com/beyondnetcode/evolith_arch32/commit/460e65f7f506ba28f075ff0710c2ea37af688807))
+* **mcp-server:** make production build deployable to Docker/Coolify ([64885dd](https://github.com/beyondnetcode/evolith_arch32/commit/64885dd8bfbaabeb0ccd379acaf82e8c95b2b38a))
+* **mcp-server:** resolve GT-267 — fix CacheModule mock + handleListTools async + parseArgs boolean flags ([3b2e6ad](https://github.com/beyondnetcode/evolith_arch32/commit/3b2e6ad8edd723a027f7282cc9a55a18905a0a64))
+* **mcp-tools:** GT-352 — validate CallTool args against inputSchema + add README ([30b62b9](https://github.com/beyondnetcode/evolith_arch32/commit/30b62b9efb91174bdc7eee507ad33d4f17091f42))
+* **metrics:** @SkipThrottle() on MetricsController (Prometheus scraper was rate-limited) ([ed51556](https://github.com/beyondnetcode/evolith_arch32/commit/ed51556f9cde43efcfec8e231b86e5fda1fd6239))
+* **metrics:** store httpRequestsTotal reference so it can be incremented (was always 0) ([ed51556](https://github.com/beyondnetcode/evolith_arch32/commit/ed51556f9cde43efcfec8e231b86e5fda1fd6239))
+* move evolith.config.json to reference/config directory ([4e46ba6](https://github.com/beyondnetcode/evolith_arch32/commit/4e46ba61156fda437e8d77a6d51a5a96021bc7ac))
+* **opa:** fix syntax for OPA 0.65.0 + add missing test coverage ([5c2bc36](https://github.com/beyondnetcode/evolith_arch32/commit/5c2bc3683e743045a4c6254320018ac1c826342f))
+* **opa:** GT-347 — unblock the core governance test suite (was 100% unloadable) ([c915d01](https://github.com/beyondnetcode/evolith_arch32/commit/c915d0197ece433e5409d6adaf9289f4370b6b68))
+* **opa:** GT-358 — core governance suite green 197/197; complete GT-347 (gate + wasm) ([c5998d1](https://github.com/beyondnetcode/evolith_arch32/commit/c5998d1a60c9b3116817e1ac41b929164f47aded))
+* **opa:** wire 19 orphaned policies into main.rego aggregator (GT-252) ([08c883b](https://github.com/beyondnetcode/evolith_arch32/commit/08c883b65304585616f9c960304c08420fe40557))
+* **patterns:** remove duplicate patterns/es/ subdirectory (GT-176) ([825a668](https://github.com/beyondnetcode/evolith_arch32/commit/825a668ad91134667b7aec0ec1203ea7157f698e))
+* **post-audit:** 8 bugs found during secondary review ([ed51556](https://github.com/beyondnetcode/evolith_arch32/commit/ed51556f9cde43efcfec8e231b86e5fda1fd6239))
+* re-sync tracking after bidirectional gap sync ([426db1d](https://github.com/beyondnetcode/evolith_arch32/commit/426db1d9193fe969fab1571529c4542af71a1423))
+* rename agent ID from [@wilson](https://github.com/wilson) to [@winston](https://github.com/winston) across entire codebase ([940a45e](https://github.com/beyondnetcode/evolith_arch32/commit/940a45e2409425462ecbcadd213d567872ea4f77))
+* restore gap statuses after merge conflict ([742be2d](https://github.com/beyondnetcode/evolith_arch32/commit/742be2df2cabfd47cc01e7f49ebb3f29ae1f8bb5))
+* restore global documentation and tracking gates ([95159a9](https://github.com/beyondnetcode/evolith_arch32/commit/95159a9465c3ac18b090ec2c319c7b3b040a9fb3))
+* restore GT-267 workspace cache baseline ([96dc111](https://github.com/beyondnetcode/evolith_arch32/commit/96dc111b4d8c152aea428bac84f80ae73ab6833a))
+* **sdk-client:** initProject URL /projects/init → /projects/initialize (always 404) ([ed51556](https://github.com/beyondnetcode/evolith_arch32/commit/ed51556f9cde43efcfec8e231b86e5fda1fd6239))
+* **sdk-client:** ProposeAdvanceRequest missing currentPhase field (broke propose-advance) ([ed51556](https://github.com/beyondnetcode/evolith_arch32/commit/ed51556f9cde43efcfec8e231b86e5fda1fd6239))
+* **sdlc:** Phase 1+2 code corrections — artifact paths, blocking criteria, bounded context map ([0e7d141](https://github.com/beyondnetcode/evolith_arch32/commit/0e7d14189d5404f1421f185c5ad97f6e0d85927c))
+* **sdlc:** Phase 4 code + docs — artifact mappings, blocking criteria, quality thresholds ([1e2a063](https://github.com/beyondnetcode/evolith_arch32/commit/1e2a0638833030d1d763158c687125cfd697f63a))
+* secure GT-272 OPA sidecar bundles ([e26aa2e](https://github.com/beyondnetcode/evolith_arch32/commit/e26aa2eb8da9d6ed800344aa3d8c8a5a09093339))
+* **security:** GT-251 command injection fix, GT-253 trivy-action pinning, GT-250 evidence backfill ([bbd2e51](https://github.com/beyondnetcode/evolith_arch32/commit/bbd2e5173178f3422404ad09148625826c7d3d8a))
+* **security:** GT-254 path traversal protection in MCP resource resolution ([6d39274](https://github.com/beyondnetcode/evolith_arch32/commit/6d39274101286b3ecdaf8fc6e779c9096a6f2aee))
+* **security:** GT-255 add CSP/security headers to MCP HTTP transport ([46354c0](https://github.com/beyondnetcode/evolith_arch32/commit/46354c00f9dc9ae30c432e68e1e0c452d9f04c0e))
+* **security:** GT-313 part 1 — externalize GH_TOKEN; stop reading plaintext .env ([06a55da](https://github.com/beyondnetcode/evolith_arch32/commit/06a55dafc266e0a0d24aa509c2d65ef1646a4bf2))
+* **security:** GT-348/349 — remove file-system-race (TOCTOU) in abac-evaluator ([8feb045](https://github.com/beyondnetcode/evolith_arch32/commit/8feb04500b22065793adbfe62765d2a881681b0a))
+* **security:** resolve 72 code scanning alerts — unused imports, variables, and path sanitization ([1ecbd91](https://github.com/beyondnetcode/evolith_arch32/commit/1ecbd9159b73a4ba9f85c8d7c767b10a94dce648))
+* **security:** resolve code-scanning findings — 2 ReDoS, 2 dep CVEs, 2 unused ([31abf29](https://github.com/beyondnetcode/evolith_arch32/commit/31abf29f682023367a87b4ad7b62ace19fa2ae82))
+* **security:** resolve CodeQL code-scanning alerts ([9ff7e09](https://github.com/beyondnetcode/evolith_arch32/commit/9ff7e09eb5702079ec7b2826b9c1beaef433af53))
+* **smart-cli:** GT-346 — run scaffolding providers shell-free (executeFile) + fix latent GT-351 regression ([d34bc3a](https://github.com/beyondnetcode/evolith_arch32/commit/d34bc3a5549238814d89aeb586b4de889b624c57))
+* sync progress counters after gap-track sync hook ([825de9c](https://github.com/beyondnetcode/evolith_arch32/commit/825de9c5b6205fd789d3b3de802638c1c07c2fa2))
+* **tracing:** SIGTERM only shuts down OTel SDK when it was actually started (avoids crash) ([ed51556](https://github.com/beyondnetcode/evolith_arch32/commit/ed51556f9cde43efcfec8e231b86e5fda1fd6239))
+* **tracking:** demote 14 gaps to PENDING per catalog checkbox state ([c25270b](https://github.com/beyondnetcode/evolith_arch32/commit/c25270b0b3c22c955470f10360c1fcc901300b06))
+* **tracking:** revert GT-330 to IN-PROGRESS — premature closure on flawed E2E evidence ([93ae64e](https://github.com/beyondnetcode/evolith_arch32/commit/93ae64eb5a66cfdb75afb2aac9b2254e2b82dc5a))
+* update Last Updated date in gap tracking to 2026-06-23 ([4b54c3c](https://github.com/beyondnetcode/evolith_arch32/commit/4b54c3c7a64275c312a84824f275e731a9997802))
+* update maturity reconciliation with new gap totals (282→311) ([637f36e](https://github.com/beyondnetcode/evolith_arch32/commit/637f36eb865f0938514fff14cbb9d2db66e4524c))
+* use /dev/tty for TTY detection so prompts work with git commit -m ([3bf4c88](https://github.com/beyondnetcode/evolith_arch32/commit/3bf4c885ff3adc4e70b9c077b3a436dcaddcc37b))
+
+
+### Performance Improvements
+
+* **docker:** eliminate build context bloat + smaller dist ([155d87b](https://github.com/beyondnetcode/evolith_arch32/commit/155d87b85b772a6c560fad3ecbdc8613900616ea))
+* **docker:** faster builds — npm ci + drop reference/ from image ([32ef2b9](https://github.com/beyondnetcode/evolith_arch32/commit/32ef2b91e2f91ce42618f1838c317b55a61e9974))
+* **mcp-server:** GT-348 — cache compiled ABAC OPA policy instead of recompiling per dispatch ([b857b7f](https://github.com/beyondnetcode/evolith_arch32/commit/b857b7f3e28df6ec1ed7850a2c92bf9b60eedd3d))
+* **runtime:** disable Swagger in production + remove lockfile from image ([3824a5e](https://github.com/beyondnetcode/evolith_arch32/commit/3824a5e8c9818f1d429635ec7377f536455f3056))
+
 ## [1.1.0](https://github.com/beyondnetcode/evolith_arch32/compare/v1.0.0...v1.1.0) (2026-06-16)
 
 
diff --git a/package-lock.json b/package-lock.json
index 92c7866b..b04dfb95 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "evolith",
-  "version": "1.1.0",
+  "version": "1.0.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "evolith",
-      "version": "1.1.0",
+      "version": "1.0.0",
       "license": "MIT",
       "workspaces": [
         "sdk/*",
diff --git a/package.json b/package.json
index f49752da..ae0d452f 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "evolith",
-  "version": "1.1.0",
+  "version": "1.0.0",
   "private": true,
   "description": "Evolith Architecture Reference - Monorepo root",
   "license": "MIT",