chore(main): release 1.0.0

[beyondnetPeru]

🤖 I have created a release beep boop

1.0.0 (2026-07-03)

Features

• agent-runtime: add Evolith Agent Runtime, deployment, and CORE-API auth (8c05501)
• agent-runtime: filesystem-durable scheduler + memory adapters (GT-386) (e29129c)
• agent-runtime: freeze the public contract surface, sans version bump (GT-388) (532256e)
• agent-runtime: implement Interaction Adapter Port architecture and Smart CLI vertical slice (5c2f6ed)
• agent-runtime: implement Multi-Engine Routing and Swarms Adapter (GT-385 / GT-398) (e58d160)
• agent-runtime: real Core-evaluation adapters, replacing the simulated stub (GT-384) (8511dc9)
• agentic: integrate Agent Runtime connectivity to MCP, CLI and SDK with 100% SDLC audit compliance (74213eb)
• api: enable Swagger via SWAGGER_ENABLED env var (25c26f1)
• api: enable Swagger via SWAGGER_ENABLED env var (d20ff41)
• api: GT-367 add SatellitesController and SatelliteRegistryService for satellite CRUD (4e2380c)
• api: GT-371 add satellite linking endpoint — POST /api/v1/satellites/:id/link (38334bf)
• api: GT-400 add POST /v1/agent/hermes endpoint for chatbox integration (c3043b1)
• arch: comprehensive HA/resilience/security/governance overhaul (20d9b10)
• bmad: role-specialized QA agent suite + orchestration (GT-330 mitigation) (f740774)
• ci: GT-343 stage 5 — phase/topology namespace anti-collision guard (560cae4)
• ci: implement core-health-checklist automated gate (GT-423) (64dbca9)
• cli,mcp: evolith evaluate + core.evaluate surfaces (GT-378/GT-381, L2 parity) (bd04748)
• cli: GT-365 add satellite:create command (d57e5e4)
• cli: GT-366 add satellite:adopt command (34ebcff)
• compose: add focused docker-compose for the 3 Evolith services (42368f4)
• contracts: GT-343 stage 3 — public SDLC phase enums accept canonical ids (5f97625)
• core-api: blueprint + deployment kind-evaluators → GT-379 DONE (b5f52f0)
• core-api: enforce ADR-0073 envelope on evaluation endpoint — GT-361 (11e9a43)
• core-api: implement SatelliteManifest schema and ADR-0073 envelope (9a69c2c)
• core-api: wire checkpoint + topology evaluation kinds (GT-379) (c61464e)
• core-api: wire POST /v1/evaluate to the EvaluationOrchestrator (GT-378, L2) (8cb6ea0)
• core-domain,core-api: multi-kind evaluation dispatch + architecture engine (GT-379) (8fbd93f)
• core-domain: canonical EvaluationContext/EvaluationResult contracts (GT-377, R1) (e340b17)
• core-domain: EvaluationOrchestrator + context builder + legacy result mapper (GT-378, L1b) (8134d9f)
• core-domain: formalize SatelliteManifest ingestion contract schema — GT-359 (2e8e021)
• core-domain: GT-343 stage 1 — canonical SDLC PhaseId + alias normalizer (7ecc560)
• core: Contract Schema Registry — evaluation-context/result JSON schemas (GT-377 AC-1) (347299b)
• core: implement GT-359 to GT-362 for evaluation pipeline (ce9a53f)
• core: implement stateless Architecture Planning Gate (Phase 00) (ad00d8e)
• core: remove story coupling from gates/policies — GT-380 AC1 (L1c) (f0016c2)
• core: thread EvaluationContext facts into the OPA input (GT-380, L1c) (2dc2a32)
• domain: GT-364 add InitializeSatelliteUseCase for create and adopt modes (2ff50b1)
• domain: GT-369 add SatelliteRecord entity, schema and InitializeSatelliteInput/Output types (880e17e)
• domain: GT-372 add SatelliteAuditService and SatelliteAuditEntry type (94cad95)
• evaluation: complete MVP dimensions 4 and 5 (3624633)
• evaluation: register the full KindEvaluator set on CLI + MCP (W-Parity / BR-008) (b403d02)
• gaps: close GT-314–GT-330 — 329/330 gaps resolved, 0 pending (d26877d)
• gaps: close GT-314–GT-330 — all 17 pending gaps resolved (d2b7d2b)
• governance: GT-357 DONE — board now reconciles with executed build/test evidence (42cc1cb)
• governance: implement GT-419 to GT-423 architectural health and observability gaps (4f00d51)
• harness: seed self-improving loop (5805eb0)
• harness: transition Winston playbooks to JSON Schema output (GT-421) (583ee30)
• infra: GT-324 — CD pipeline builds+pushes core-api/mcp-server to GHCR + guarded Coolify deploy (ab64c60)
• infra: GT-363 add IGitHubApiClient interface and GitHubApiAdapter (native fetch, no new deps) (daab4f7)
• mcp: GT-368 add satellite-create, satellite-adopt, satellite-list, satellite-status tools (3dd6215)
• mcp: production-ready Dockerfile for SSE deployment (16c9699)
• mcp: production-ready Dockerfile for SSE deployment (3bccdbb)
• opa: re-anchor compliance-baseline.rego to input.context.{spec,satellite} (GT-380, L1c) (f0d1cee)
• opa: re-anchor dod.rego off input.story root → input.context.dod (GT-380, L1c) (8a24969)
• opa: wire phase-gates.rego into the aggregate + add schema/tests (GT-380, L1c) [PENDING CI] (59be0d2)
• orchestrator: implement harness orchestrator router agent (GT-422) (e2ce64f)
• release: add npm publish pipeline for core-domain and infra-providers (26907ce)
• runtime-api: instrument API with OpenTelemetry Node SDK (c07f1e5)
• runtime: add OpenTelemetry and Composite tracker adapters (6f09344)
• runtime: GT-405 add McpInteractionAdapter via InteractionAdapterPort (70a4572)
• runtime: GT-407 PolicyBasedEngineRouter with risk/privacy/cost routing (3a36622)
• runtime: GT-408 IKnowledgePort + InMemoryKnowledgeAdapter for corpus querying (27e99b2)
• sdk: GT-373 add SatellitesClient — register, list, get, update, link (51e1577)
• visual-map: add i18n support and didactic callouts (2a1419a)

Bug Fixes

• adr: bilingual + multi-format ADR header validation, add 20 missing dates (2279499)
• agent-runtime: stabilize opa adapter and fix policy drifts (GT-413, GT-414, GT-415) (030e9dd)
• api: GT-393 enforce auth on /metrics endpoint via MetricsAuthGuard (84545dc)
• api: GT-411 wrap evaluation/gate/phase controllers in ADR-0073 envelope (d8bb772)
• audit: correct docStatus and path matching in topology compliance script (8cd470b)
• audit: wire MetricsService into SecurityAuditInterceptor so recordHttpRequest fires (ed51556)
• bmad: GT-410 adapter maturity analysis skill + checklist + executable (f6f6e47)
• ci: allowlist standard root files (root-cleanliness gate) (d8e1c94)
• ci: build @evolith/* deps in the smart-cli Test job (TS2307 in CI) (189b9c8)
• ci: build sdk/cli before its tests (integration specs spawn dist/main.js) (d8c2ff2)
• ci: CD gate runs smart-cli unit suite, not the env-sensitive e2e (2cde7b1)
• ci: docs validator — exclude inline code from prose-corruption checks + fix ES anchor (88c9656)
• ci: fix test compilation errors + lint boundary crash (1a79899)
• ci: regenerate package-lock.json — npm ci was out of sync (broke all CI jobs) (d07e8a2)
• ci: resolve sdk-cli-ci pipeline failures (920210c)
• ci: sync package-lock.json + fix opa-parity npm ci failure (b10e6e6)
• ci: unblock bilingual-parity + root-cleanliness in Evolith Core Validation (1f46b04)
• ci: unblock dependency PR validation (b72a87e)
• cli,mcp: align architecture commands with the 8 canonical topologies (f9e5d6b)
• cli,mcp: merge — align architecture commands with 8 canonical topologies (695fdb7)
• cli: correct directory structure for agents and upgrade commands (b7dcf06)
• cli: GT-345 — restore validate @command registration + gate.e2e version (875fb3c)
• cli: GT-345 — smart-cli unit suite green (905/905) + add --version support (b3cf0e2)
• cli: GT-374 remove dead upgrade.command stub — real impl at commands/init/upgrade.command (556f7c9)
• cli: GT-399 replace hardcoded stubs with createAgentRuntime bootstrap + env-var overrides (ba0e3a2)
• cli: merge — 1.1.3 release + build-info fix (1693795)
• cli: release 1.1.3 + prevent empty incremental builds (2597fe1)
• cli: route smart cli through runtime adapter (9ef081b)
• cli: skip cli.integration tests gracefully when dist/main.js not built (4c921af)
• cli: update stale test references from commands/upgrade to commands/update (a832ad4)
• config: add SWAGGER_ENABLED to env schema (c340fdc)
• config: add SWAGGER_ENABLED to env schema (dca137e)
• core-api: add missing type deps + explicit Dirent type for TS build (a725978)
• core-api: bust Docker cache — packages now live on npm (35e81dc)
• core-api: include reference/ corpus so topologies endpoint returns data (8845934)
• core-api: include reference/ corpus so topologies endpoint returns data (685bd10)
• core-api: upgrade keyv to 5.6.0 + legacy-peer-deps in Dockerfile (de9b150)
• core-domain: add src/index.ts and src/application/index.ts so tsc generates dist entry points (20c8108)
• core-domain: align InitializeSatelliteUseCase spec with current implementation (bbcb271)
• core-domain: bundle rulesets inside npm package + fix __dirname path (56b012f)
• core-domain: enforce Rego policy execution in evaluation pipeline — GT-362 (e2b1c12)
• core-domain: export GitHub API client types from domain barrel (74f7c46)
• core-domain: GT-344 — embedded default workflow so published CLI never crashes (1bdbc47)
• core-domain: GT-350 — remove new Function() code-exec sink in standards rule checks (d243bab)
• core-domain: remove dead PhaseGateValidatorService inject in PhaseTransitionUseCase factory (ed51556)
• core: GT-395 wire canonical ruleset validation into pipeline verdict (e63cfa5)
• core: remove tenant-isolation from Core scope — belongs to Tracker (ff4c8a2)
• core: rephrase vendor rule — principle over name list (49b12f6)
• cross: GT-375/381 close umbrella + tracker integration with mock adapter (8212ba0)
• docker: copy root package-lock.json to builder (4afe9e3)
• docker: copy root package-lock.json to builder — npm ci requires it (9572e24)
• docker: copy rulesets to node_modules/ path expected by core-domain (0c90560)
• docker: correct healthcheck path /api/v1/health → /health + longer start period (d4f96c2)
• docker: use npm install instead of npm ci + add VPS Coolify deployment guide (19e1a56)
• docker: use standalone package-lock.json for core-api (b6bbc9c)
• docker: use standalone package-lock.json for core-api build (6148556)
• docs: green the documentation validator (links, symbols, mermaid) (aae9052)
• docs: remove semicolon that broke mermaid sequenceDiagram render (ef0ca21)
• docs: translate flagged terms to Spanish + make terminology lint prose-only (4de15df)
• docs: update visual map links to point to github pages (1cc44b8)
• domain: GT-377 boundary guard — no *Repository for business entities in core-domain (065b3b6)
• domain: GT-396 formal SatelliteManifest schema — add facts + align phase enum (11e059f)
• env: remove dead ALLOWED_ORIGINS from .env.example (field removed from schema) (ed51556)
• eslint: ESLint 9 flat-config boundary guards for mcp-server + core-api (b0970ad)
• eslint: real flat-config boundary guard for core-domain + stateless-repo ban (b9f5048)
• gap-tracking: merge Spanish table separator fix from develop (097e6e2)
• gap-tracking: merge table separator fix from develop (26775d9)
• gap-tracking: remove extra column separator in gap table header (84ad713)
• gap-tracking: remove extra column separator in Spanish gap table (864b873)
• governance: add source interface OPA parity (f826a92)
• governance: close GT-385/392/409, defer GT-387/394/404/406 (dcc2632)
• governance: correct status inconsistencies in gap-tracking board (3e6f055)
• governance: GT-357 — register 36 missing closure-evidence records + reconcile maturity (f5261bb)
• governance: GT-390 consolidate duplicate phase-gates.rules.json + CI guard (f2b0eb4)
• governance: GT-391 CI schema validation via ajv over *.rules.json (4acd6ab)
• governance: repoint stale closure-evidence paths so 08-validate-tracking is green (270c5cd)
• harness: GT-397 create 04-check-bilingual-parity.mjs wrapper (34074dd)
• health-spec: rewrite spec for async ready() with IFileSystem + ConfigService mocks (ed51556)
• hook+maturity: sync-project-board local priority + maturity 329/330 (a51b2e8)
• hook: sync-project-board prefers local when tracking file was last committed (32f663a)
• infra: GT-351 slice 1 — harden WebhookAdapter (timeout + retry + SSRF guard) + tests (f66c802)
• maturity: update reconciliation to 329/330 — all pending gaps closed (26a0198)
• mcp-server: accurate startup auth log in production (8e9869f)
• mcp-server: GT-349 — ABAC OPA fails closed in production when policy.wasm is missing (460e65f)
• mcp-server: make production build deployable to Docker/Coolify (64885dd)
• mcp-tools: GT-352 — validate CallTool args against inputSchema + add README (30b62b9)
• metrics: @SkipThrottle() on MetricsController (Prometheus scraper was rate-limited) (ed51556)
• metrics: store httpRequestsTotal reference so it can be incremented (was always 0) (ed51556)
• opa: GT-347 — unblock the core governance test suite (was 100% unloadable) (c915d01)
• opa: GT-358 — core governance suite green 197/197; complete GT-347 (gate + wasm) (c5998d1)
• opa: install policy.wasm to both runtime lookup paths so gates enforce (GT-382 follow-up) (ae3f373)
• opa: make threaded input.context facts enforce the gate verdict (GT-382) (175de3d)
• opa: unbreak OPA toolchain — untrack wrong-arch binary + harden download (GT-380) (68414dc)
• post-audit: 8 bugs found during secondary review (ed51556)
• readme: restore div tag, add direct Gap Tracking link, remove deleted file refs (57aee0a)
• runtime: close deferred gaps GT-387/394/404/406 with stub/mock implementations (00d8b02)
• runtime: enforce policy preflight (2f3e0bb)
• runtime: formalize interaction adapter contract (2e0814d)
• runtime: GT-383/384/388 close — version bump to 1.0.0 (27b51b5)
• runtime: GT-386 close — durable persistence adapters shipped (2465ad3)
• runtime: GT-389 pin @evolith/core-domain to ^1.0.5 + update public surface freeze (5e5efa3)
• sdk-client: initProject URL /projects/init → /projects/initialize (always 404) (ed51556)
• sdk-client: ProposeAdvanceRequest missing currentPhase field (broke propose-advance) (ed51556)
• security: GT-313 part 1 — externalize GH_TOKEN; stop reading plaintext .env (06a55da)
• security: GT-348/349 — remove file-system-race (TOCTOU) in abac-evaluator (8feb045)
• security: resolve code-scanning findings — 2 ReDoS, 2 dep CVEs, 2 unused (31abf29)
• security: resolve CodeQL code-scanning alerts (9ff7e09)
• smart-cli: GT-346 — run scaffolding providers shell-free (executeFile) + fix latent GT-351 regression (d34bc3a)
• tracing: SIGTERM only shuts down OTel SDK when it was actually started (avoids crash) (ed51556)
• tracking: revert GT-330 to IN-PROGRESS — premature closure on flawed E2E evidence (93ae64e)
• vision: remove Hybrid execution mode — no longer supported (e52688f)
• vision: remove tenant reference from Core value prop — Core is stateless (27314a8)
• visual-map: change default mode to Vista Libre to fix hidden layers UX (9aef3c9)

Performance Improvements

• docker: eliminate build context bloat + smaller dist (155d87b)
• docker: faster builds — npm ci + drop reference/ from image (32ef2b9)
• mcp-server: GT-348 — cache compiled ABAC OPA policy instead of recompiling per dispatch (b857b7f)
• runtime: disable Swagger in production + remove lockfile from image (3824a5e)

---

This PR was generated with Release Please. See documentation.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[github-actions]

📊 Bilingual Coverage Impact

PR Changes

• Paired EN/ES files modified: 0
• New EN files needing ES translation: 1

Repository Coverage

Metric	Value
Total EN files	586
Total ES files	587
Paired files	0
Coverage	0%

⚠️ Action required: 1 new EN file(s) added without ES counterparts.

To create skeletons:

node .harness/scripts/generate-es-skeleton.mjs <file.md>

---

Generated by GitHub Actions