feat(release): Add Stable 1.0 RC freeze

apps/feed-reader/src/staged/cryptad-app.properties.template

@@ -13,7 +13,7 @@ app.permissions=content.fetch,content.subscribe,content.insert.app-document,queu
 app.beta.readiness=ready
 app.beta.qualityLevel=beta
 app.beta.support.owner=crypta-core
-app.beta.support.uri=https://example.invalid/crypta/apps/feed-reader/support
+app.beta.support.uri=https://github.com/crypta-network/cryptad/issues
 app.beta.support.diagnostics=redacted-summary-only
 app.beta.ui.emptyState=true
 app.beta.ui.errorState=true

apps/profile-publisher/src/staged/cryptad-app.properties.template

@@ -13,7 +13,7 @@ app.permissions=queue.read,queue.write,content.insert.app-document,vault.identit
 app.beta.readiness=ready
 app.beta.qualityLevel=beta
 app.beta.support.owner=crypta-core
-app.beta.support.uri=https://example.invalid/crypta/apps/profile-publisher/support
+app.beta.support.uri=https://github.com/crypta-network/cryptad/issues
 app.beta.support.diagnostics=redacted-summary-only
 app.beta.ui.emptyState=true
 app.beta.ui.errorState=true

apps/publisher/src/staged/cryptad-app.properties.template

@@ -13,7 +13,7 @@ app.permissions=queue.read,queue.write,content.insert
 app.beta.readiness=ready
 app.beta.qualityLevel=beta
 app.beta.support.owner=crypta-core
-app.beta.support.uri=https://example.invalid/crypta/apps/publisher/support
+app.beta.support.uri=https://github.com/crypta-network/cryptad/issues
 app.beta.support.diagnostics=redacted-summary-only
 app.beta.ui.emptyState=true
 app.beta.ui.errorState=true

apps/queue-manager/src/staged/cryptad-app.properties.template

@@ -13,7 +13,7 @@ app.permissions=queue.read,queue.write
 app.beta.readiness=ready
 app.beta.qualityLevel=beta
 app.beta.support.owner=crypta-core
-app.beta.support.uri=https://example.invalid/crypta/apps/queue-manager/support
+app.beta.support.uri=https://github.com/crypta-network/cryptad/issues
 app.beta.support.diagnostics=redacted-summary-only
 app.beta.ui.emptyState=true
 app.beta.ui.errorState=true

apps/site-publisher/src/staged/cryptad-app.properties.template

@@ -13,7 +13,7 @@ app.permissions=queue.read,queue.write,content.insert
 app.beta.readiness=ready
 app.beta.qualityLevel=beta
 app.beta.support.owner=crypta-core
-app.beta.support.uri=https://example.invalid/crypta/apps/site-publisher/support
+app.beta.support.uri=https://github.com/crypta-network/cryptad/issues
 app.beta.support.diagnostics=redacted-summary-only
 app.beta.ui.emptyState=true
 app.beta.ui.errorState=true

apps/social-inbox/src/staged/cryptad-app.properties.template

@@ -13,7 +13,7 @@ app.permissions=vault.identities.read,vault.identities.create,vault.identities.u
 app.beta.readiness=ready
 app.beta.qualityLevel=beta
 app.beta.support.owner=crypta-core
-app.beta.support.uri=https://example.invalid/crypta/apps/social-inbox/support
+app.beta.support.uri=https://github.com/crypta-network/cryptad/issues
 app.beta.support.diagnostics=redacted-summary-only
 app.beta.ui.emptyState=true
 app.beta.ui.errorState=true

apps/trust-graph/src/staged/cryptad-app.properties.template

@@ -3,7 +3,7 @@ app.id=trust-graph
 app.name=Trust Graph Local RC
 app.version=${appVersion}
 api.minimumVersion=22
-api.maximumTestedVersion=22
+api.maximumTestedVersion=23
 api.targetStability=experimental
 api.experimentalCapabilitiesAccepted=true
 app.exec=bin/trust-graph.sh
@@ -13,7 +13,7 @@ app.permissions=trust.read,trust.write,content.fetch,content.subscribe,content.i
 app.beta.readiness=ready
 app.beta.qualityLevel=beta
 app.beta.support.owner=crypta-core
-app.beta.support.uri=https://example.invalid/crypta/apps/trust-graph/support
+app.beta.support.uri=https://github.com/crypta-network/cryptad/issues
 app.beta.support.diagnostics=redacted-summary-only
 app.beta.ui.emptyState=true
 app.beta.ui.errorState=true

apps/trust-graph/src/test/java/network/crypta/apps/trustgraph/TrustGraphBundleStagingTest.java

@@ -53,7 +53,7 @@ class TrustGraphBundleStagingTest {
           "app.data.read",
           "app.data.write");
   private static final int EXPECTED_PLATFORM_API_MINIMUM_VERSION = 22;
-  private static final int EXPECTED_PLATFORM_API_MAXIMUM_TESTED_VERSION = 22;
+  private static final int EXPECTED_PLATFORM_API_MAXIMUM_TESTED_VERSION = 23;
   private static final Path PLATFORM_SDK_SOURCE_PATH =
       Path.of(
           "platform-sdk-js",

docs/catalog-operations-and-mirrors.md

@@ -91,6 +91,10 @@ separate from ordinary refresh:
 5. Cryptad records the current revision in history and replaces the active catalog sidecars with
    the selected verified revision.
 
+The selected rollback target must precede the active catalog revision and bind different signed
+catalog bytes. A same-revision, newer-revision, or same-digest target is not rollback evidence and
+must fail release verification.
+
 Rollback does not uninstall apps, change app data, bypass advisories, bypass denylists, or change
 app-update policy. Installed apps remain under the normal AppHost and app-update rollback rules.
 

docs/cryptad-release-workflow-and-runbook.md

@@ -51,6 +51,18 @@
 ## Platform Release Gates
 Treat these as release blockers, in order:
 
+When the candidate targets the Stable 1.0 product milestone, run the protected
+[Stable 1.0 RC execution and release-freeze workflow](stable-1.0-rc-execution-and-release-freeze.md)
+after the prerequisite production evidence passes and before generating release descriptors,
+tags, or publication material. The RC command uses the existing `stable-review` profile and the
+repository's integer build identity; it does not replace the `v<build-number>` tag policy. A
+blocker fix after freeze invalidates the old archive, checksums, provenance, and freeze and requires
+a complete authorized re-freeze to final `no-drift`.
+
+An RC `go` or policy-compliant `go-with-waivers` authorizes review of the frozen candidate. It does
+not authorize a tag, GitHub Release, merge, update-descriptor insertion, or Stable 1.0 GA
+publication. Those remain separate release-manager operations later in this runbook.
+
 1. **Normal Gradle checks** - run the standard repository build and test path before any publish step. For release readiness, this means the usual Gradle verification path for the branch, including `./gradlew clean build` and any project-required test tasks used in CI.
 2. **Production beta app-ecosystem pipeline, when shipping production beta app artifacts** - use
    the top-level production beta wrapper when the release includes first-party app bundles,

docs/production-beta-go-no-go-dashboard.md

@@ -29,6 +29,13 @@ ecosystem matrix, app-platform, live-network, network-scale, multi-node, securit
 candidate, waiver, and optional Stable evidence. It does not trust `promotionReady` without
 validating the underlying rows.
 
+This is the production-beta launch decision, not by itself the final Stable 1.0 RC decision. The
+[Stable RC release-freeze workflow](stable-1.0-rc-execution-and-release-freeze.md) preserves the
+same `go`, `no-go`, and `go-with-waivers` vocabulary, then adds passing Stable readiness, immutable
+freeze generation, post-package `no-drift`, provenance/checksum binding, and RC-wide redaction as
+mandatory final gates. Allowed Stable limitations are reported separately and are not converted
+into hidden dashboard waivers.
+
 ## Waivers
 
 Waivers require an ID, evidence ID, severity, exact scope, rationale, approver, owner, references,

docs/production-beta-release-pipeline.md

@@ -50,6 +50,13 @@ a promotable production-beta result.
 Security drill operations and incident-response evidence follow the
 [production security response runbook](production-security-response-runbook.md).
 
+For Stable 1.0 RC execution, do not run a normal production-beta manifest and then assemble an RC
+with a separate script. The canonical
+[Stable RC release-freeze workflow](stable-1.0-rc-execution-and-release-freeze.md) uses one
+`stable-review` manifest and invokes this production pipeline, go/no-go, release certification,
+and Stable readiness inside the same marked workspace. Normal production-beta runs do not create
+a Stable freeze and retain their existing behavior.
+
 ## Pipeline stages
 
 The pipeline orchestrates:
@@ -109,6 +116,19 @@ security, distribution, checksum, archive, and detailed dashboard output lives b
 <out-root>/<release-id>/production-beta/artifacts/legacy/dist/checksums.txt
 ```
 
+When the canonical `stable-rc` command invokes this pipeline as its production stage, it also
+writes `dist/crypta-stable-1.0-rc-<build>-product.tar.gz`. The protected catalog-operations
+`artifactTimestamp` controls the signed catalog and review-receipt timestamps. The product archive
+contains only public product inputs and uses normalized gzip/tar metadata, so the same source,
+signing identities, artifact URI, catalog revision, and app payloads reproduce the same bytes.
+POSIX launcher entries and app-data migration commands declared by staged app manifests are
+normalized to executable mode; Windows command files and all other regular members are normalized
+to non-executable mode. A missing or path-unsafe declared migration command fails packaging.
+`dist/crypta-production-beta-<build>.tar.gz` remains the broader production-beta evidence archive
+and keeps its existing consumers; the Stable RC freeze binds the deterministic product archive.
+A direct `production-beta` command using the `stable-review` profile retains its existing input
+contract and does not require Stable RC catalog operations or create this product archive.
+
 Validated attached input extracts live under `artifacts/inputs/`. Those extracts are diagnostic
 copies, not a way to bypass candidate binding or redaction checks.
 
@@ -125,3 +145,9 @@ CI may upload or publish the workspace only when release artifact redaction, go/
 and any required Stable redaction all pass. Private interop insert URIs, raw support bundles, raw
 diagnostics, AppleDouble files, `.DS_Store`, `__MACOSX`, secret-like filenames, symlinks, and unsafe
 nested archives remain excluded.
+
+Stable RC upload is stricter: the protected workflow uploads only the public `stable-rc/`
+component after the final v2 envelope says `promotionReady=true`, the regenerated freeze verifies
+as `no-drift`, checksums and provenance match the package, redaction passes, and the decision is
+`go` or policy-compliant `go-with-waivers`. See the Stable RC runbook for the exact artifact set and
+non-publication boundary.

docs/release-certification.md

@@ -57,6 +57,7 @@ Each run writes:
   production-beta/
   go-no-go/
   stable-readiness/
+  stable-rc/
 ```
 
 Each component contains `summary.json`, `report.md`, `redaction-report.json`, and `artifacts/`.
@@ -104,6 +105,13 @@ redaction failures still produce a sanitized failed envelope with `promotionRead
 Completed migration records and component summaries cannot be overwritten with
 `output.reset=false`.
 
+The `stable-rc/` component is created only by the canonical Stable 1.0 RC command under the
+`stable-review` profile. It contains the common v2 summary/report/redaction surface plus the
+versioned freeze, drift report, promotion summary, RC go/no-go report, known limitations, release
+notes, checksums, provenance, and deterministic public archive. Its schema and release-manager
+procedure are documented in
+[Stable 1.0 RC execution and release freeze](stable-1.0-rc-execution-and-release-freeze.md).
+
 ## Required evidence
 
 Release-candidate certification continues to require:

docs/stable-1.0-known-limitations.md

@@ -70,6 +70,18 @@ Redaction findings, critical security failures, missing Platform API stable base
 breaking changes without deprecation/migration, missing previous-candidate upgrade evidence, and
 unresolved critical known issues are non-waivable.
 
+## Stable RC copy-through
+
+The [Stable 1.0 RC release-freeze workflow](stable-1.0-rc-execution-and-release-freeze.md) freezes
+the exact policy-recognized allowed-limitation records produced by Stable readiness. Each record
+must also appear in `stable-1.0-rc-known-limitations.json` and prominently in the generated RC
+release-note draft with its boundary, owner, and review or exit condition intact. A missing or
+changed copy is freeze drift and makes the RC `no-go`.
+
+Allowed limitations remain separate from `go-with-waivers`. A beta-only or disallowed limitation
+cannot be copied into the RC as an allowed limitation, and a freeze exception cannot reclassify or
+waive it.
+
 ## Redaction
 
 Known limitations and release notes must never include private insert URIs, private keys, app