Harden stable runtime for 1.0

.env.example

@@ -18,6 +18,7 @@ ARTIFACT_CURRENT_KEY_ID=v1
 ARTIFACT_KEYRING={"v1":"replace-with-a-base64-encoded-32-byte-key"}
 ARTIFACT_DIR=.data/production-artifacts
 ARTIFACT_DIR_HOST=./.data/production-artifacts
+BACKUP_MANIFEST_KEY=replace-with-a-base64-encoded-32-byte-key
 
 # Any OpenAI-compatible endpoint returning the configured vector dimensions.
 EMBEDDING_BASE_URL=https://api.openai.com/v1
@@ -42,3 +43,7 @@ BIND_ADDRESS=127.0.0.1
 HTTPS_PORT=8443
 SERVER_NAME=localhost
 LOG_LEVEL=info
+TRUSTED_PROXY_HOPS=1
+WORKER_MONITOR_HOST=127.0.0.1
+WORKER_MONITOR_PORT=4319
+SHUTDOWN_TIMEOUT_MS=10000

.github/release.yml

@@ -0,0 +1,19 @@
+changelog:
+  categories:
+    - title: Breaking changes
+      labels:
+        - breaking
+    - title: Features
+      labels:
+        - enhancement
+        - feature
+    - title: Fixes
+      labels:
+        - bug
+        - security
+    - title: Documentation
+      labels:
+        - documentation
+    - title: Other changes
+      labels:
+        - "*"

.github/workflows/ci.yml

@@ -34,6 +34,8 @@ jobs:
       - run: npm run build
       - run: npm test
       - run: npm run test:package
+      - if: matrix.node == 24
+        run: npm run test:backup-manifest
 
   container:
     name: Production container
@@ -77,12 +79,16 @@ jobs:
       - name: Apply migrations
         env:
           DATABASE_URL: postgresql://postgres:ci-administrator-password@127.0.0.1:54329/agentic_data
+          DATABASE_SSL: disable
         run: node dist/production/cli.js migrate
       - run: npm test
       - name: Run SRE comparison and verify published evidence
         env:
           BENCHMARK_REPETITIONS: 3
         run: npm run benchmark:sre:verify
+      - name: Run backup and restore drill
+        shell: pwsh
+        run: ./scripts/test-backup-restore.ps1
       - name: Show container logs
         if: failure()
         run: docker compose logs postgres

.github/workflows/release.yml

@@ -16,6 +16,11 @@ jobs:
   package:
     name: Validate release package
     runs-on: ubuntu-latest
+    env:
+      POSTGRES_PASSWORD: release-administrator-password
+      APP_DATABASE_PASSWORD: release-application-password
+      PRODUCTION_TEST_DATABASE_URL: postgresql://agentic_app:release-application-password@127.0.0.1:54329/agentic_data
+      PRODUCTION_TEST_MIGRATION_DATABASE_URL: postgresql://postgres:release-administrator-password@127.0.0.1:54329/agentic_data
     permissions:
       contents: read
     steps:
@@ -26,6 +31,8 @@ jobs:
         with:
           node-version: 24
           cache: npm
+      - uses: docker/setup-qemu-action@v4
+      - uses: docker/setup-buildx-action@v4
       - name: Use supported npm
         run: npm install --global npm@12.0.2
       - run: npm ci
@@ -34,19 +41,55 @@ jobs:
           git fetch origin main:refs/remotes/origin/main
           git merge-base --is-ancestor "$GITHUB_SHA" origin/main
           node scripts/validate-release-tag.mjs "$GITHUB_REF_NAME"
+      - run: docker compose up -d postgres
+      - run: docker compose run --rm bootstrap
+      - run: npm run build
+      - name: Apply migrations
+        env:
+          DATABASE_URL: postgresql://postgres:release-administrator-password@127.0.0.1:54329/agentic_data
+          DATABASE_SSL: disable
+        run: node dist/production/cli.js migrate
       - run: npm run release:check
+      - run: npm run deployment:check
+      - name: Verify SRE evidence
+        env:
+          BENCHMARK_REPETITIONS: 3
+        run: npm run benchmark:sre:verify
+      - name: Run backup and restore drill
+        shell: pwsh
+        run: ./scripts/test-backup-restore.ps1
+      - name: Smoke supported container architectures
+        run: |
+          docker buildx build \
+            --platform linux/amd64 \
+            --load \
+            --tag agentic-data-kernel:release-amd64 \
+            .
+          docker run --rm agentic-data-kernel:release-amd64 \
+            node dist/production/cli.js --help
+          docker buildx build \
+            --platform linux/arm64 \
+            --load \
+            --tag agentic-data-kernel:release-arm64 \
+            .
+          docker run --rm agentic-data-kernel:release-arm64 \
+            node dist/production/cli.js --help
       - name: Create npm artifact
         run: |
           mkdir release-artifacts
           npm pack --json --pack-destination release-artifacts
+          npm sbom --sbom-format spdx > release-artifacts/npm-sbom.spdx.json
           cd release-artifacts
-          sha256sum *.tgz > SHA256SUMS
+          sha256sum *.tgz *.json > SHA256SUMS
       - uses: actions/upload-artifact@v7
         with:
           name: npm-package
           path: release-artifacts
           if-no-files-found: error
           retention-days: 14
+      - name: Stop containers
+        if: always()
+        run: docker compose down -v
 
   npm:
     name: Publish npm package
@@ -69,8 +112,6 @@ jobs:
           name: npm-package
           path: release-artifacts
       - name: Publish package
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           VERSION=$(node -p "require('./package.json').version")
           if npm view "agentic-data-kernel@$VERSION" version --json >/dev/null 2>&1; then
@@ -114,6 +155,8 @@ jobs:
           flavor: latest=auto
           tags: |
             type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
             type=raw,value=next,enable=${{ contains(github.ref_name, '-') }}
           labels: |
             org.opencontainers.image.title=Agentic Data Kernel
@@ -130,6 +173,8 @@ jobs:
           labels: ${{ steps.metadata.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+          sbom: true
+          provenance: mode=max
       - name: Attest image provenance
         uses: actions/attest@v4
         with:
@@ -158,6 +203,7 @@ jobs:
           RELEASE_ARGS=(
             release create "$GITHUB_REF_NAME"
             release-artifacts/*.tgz
+            release-artifacts/*.json
             release-artifacts/SHA256SUMS
             --repo "$GITHUB_REPOSITORY"
             --verify-tag

CHANGELOG.md

@@ -2,6 +2,28 @@
 
 ## Unreleased
 
+## 1.0.0
+
+- Declared Agent Intent 1.0 and the documented TypeScript, HTTP, MCP, CLI,
+  migration, and deployment surfaces stable. Protocol 0.1 remains accepted
+  throughout 1.x.
+- Added per-operation credential, tenant, purpose, and scope revalidation,
+  explicit tenant predicates, strict runtime-role verification, explicit
+  database TLS mode, redirect-free embeddings, and bounded query timeouts.
+- Hardened effect execution with tenant-fair leasing, authorization fences,
+  abort propagation, expired-dispatch reconciliation, worker health endpoints,
+  and crash-after-provider-apply recovery coverage.
+- Added signed coordinated backups, exact migration-manifest verification,
+  artifact integrity reconciliation, filesystem durability barriers, and
+  documented restore-only rollback after migrations begin.
+- Added cumulative Prometheus histograms, worker liveness metrics, bounded
+  timer processing, effect pagination, and graceful process shutdown.
+- Added validated Helm, Azure Container Apps, AWS ECS Fargate, and GKE
+  deployment paths with retained storage and separate runtime and
+  administrative secrets.
+- Added stable compatibility, upgrade, rollback, runbook, package, SBOM,
+  provenance, benchmark, and release gates.
+
 ## 0.3.0-alpha.5
 
 - Added validated Helm, Azure Bicep, AWS OpenTofu, and GCP OpenTofu deployment

Dockerfile

@@ -2,12 +2,12 @@ FROM node:22-bookworm-slim AS build
 
 WORKDIR /app
 COPY package.json package-lock.json ./
-RUN npm ci
+RUN npm ci --no-audit --no-fund
 COPY tsconfig.json tsconfig.examples.json tsconfig.examples.build.json ./
 COPY src ./src
 COPY examples ./examples
 RUN npm run build
-RUN npm prune --omit=dev
+RUN npm prune --omit=dev --no-audit --no-fund
 
 FROM node:22-bookworm-slim AS runtime
 

README.md

@@ -143,12 +143,12 @@ stale or inconsistent published evidence.
 | Application-authored tables | 8 | 0 |
 | Total operated tables | 8 | 18 |
 | Median database footprint | 540,672 bytes | 1,572,864 bytes |
-| Informational median runtime | 58.12 ms | 876.17 ms |
+| Informational median runtime | 50.65 ms | 911.14 ms |
 
 The result is deliberately not presented as a universal win:
 
 - PostgreSQL matches the kernel on correctness.
-- The smaller adapter reuses 929 lines of shipped scenario code and a 13,750
+- The smaller adapter reuses 930 lines of shipped scenario code and a 14,973
   line dependency. It is not an equal from-scratch implementation comparison.
 - The kernel operates more tables, uses more storage, and takes substantially
   longer in this deterministic smoke run.
@@ -214,7 +214,7 @@ embedded CLI accepts it from a file:
 
 ```json
 {
-  "protocolVersion": "0.1",
+  "protocolVersion": "1.0",
   "requestId": "observe-1001",
   "idempotencyKey": "observe-1001",
   "principal": {
@@ -365,9 +365,10 @@ lineage                verification
  PostgreSQL + pgvector + RLS
 ```
 
-## Current boundaries
+## Stable support and boundaries
 
-- The release is alpha.
+- Version 1.0.0 supports the bounded production profile documented in
+  [Stability and Compatibility](docs/STABILITY.md).
 - Production targets one PostgreSQL primary.
 - The default rate limiter is process-local.
 - One embedding model, version, and dimension is active per deployment.
@@ -392,6 +393,9 @@ See [Benefits and Tradeoffs](docs/TRADEOFFS.md) for a fuller fit assessment.
 - [Use cases](docs/USE_CASES.md)
 - [Integration guide](docs/INTEGRATIONS.md)
 - [Production profile](docs/PRODUCTION.md)
+- [Stability and compatibility](docs/STABILITY.md)
+- [Upgrade and rollback](docs/UPGRADING.md)
+- [Production runbooks](docs/RUNBOOKS.md)
 - [Threat model](docs/THREAT_MODEL.md)
 - [Release process](docs/RELEASING.md)
 - [Security policy](SECURITY.md)

SECURITY.md

@@ -1,5 +1,12 @@
 # Security
 
+## Supported versions
+
+| Version | Security support |
+| --- | --- |
+| 1.x | Supported |
+| 0.x | Unsupported after 1.0.0 |
+
 ## Supported profiles
 
 The PostgreSQL production profile is the only profile intended for deployment
@@ -21,10 +28,14 @@ issue.
 ## Production security requirements
 
 - Run the application with the non-superuser `agentic_app` database role.
+- Run `bootstrap-role` before migrations and require runtime role verification
+  at startup.
 - Reserve the PostgreSQL superuser connection for migrations, backup, and
   restore.
 - Terminate TLS at a trusted reverse proxy or service mesh. The included
   Compose profile uses Caddy and does not publish the Node.js listener.
+- Set `TRUSTED_PROXY_HOPS` to the exact trusted forwarding chain and prevent
+  direct access around it.
 - Store API keys, the authentication pepper, artifact keys, database
   passwords, and embedding-provider credentials in a secret manager.
 - Keep embedding model, version, and dimensions aligned with the database
@@ -39,6 +50,10 @@ issue.
 - Restrict `/metrics` and health endpoints at the network layer when operational
   metadata is considered sensitive.
 - Back up the PostgreSQL database and encrypted artifact directory together.
+- Sign backup manifests with `BACKUP_MANIFEST_KEY` stored outside the backup
+  location.
+- Reject backups whose signed migration versions and checksums do not exactly
+  match the restoring runtime.
 - Test restore procedures before relying on a backup.
 
 ## Security properties

SUPPORT.md

@@ -31,5 +31,10 @@ Do not open a public issue for a vulnerability. Follow
 
 ## Support level
 
-This project is maintained on a best-effort basis. The PostgreSQL profile is an
-alpha release and does not include a commercial support commitment.
+The latest 1.x release receives best-effort security and critical correctness
+fixes. Stable support covers the bounded profile in
+[Stability and Compatibility](docs/STABILITY.md).
+
+Older 0.x alpha releases are unsupported after 1.0.0. This project does not
+include a commercial support commitment, uptime SLA, hosted control plane, or
+managed cloud account.

benchmarks/sre/results/report.md

@@ -2,9 +2,9 @@
 
 Generated from `summary.json`.
 
-Source revision: `6163d2bc1f9a86a6947b30cd59523e3b0fb14246`
+Source revision: `dd9b422a18c0c5d64dc358c73a8bebaf2605d2d7`
 
-Source hash: `8ee99637371fc2d2492fcd107c03e72c0fb4d5b028a75dcc55496008dfcbd757`
+Source hash: `d9a990f81466c513ec346e0f9b75de922cc3b08ee62fb7d87c9acc40cbe037e4`
 
 ## Correctness
 
@@ -23,12 +23,12 @@ Both variants must resolve every run with one delivery and one reconciliation.
 | Agentic Data Kernel adapter | 43 | 0 | 18 |
 
 The adapter delegates to the shipped SRE scenario, which contains
-929 nonblank TypeScript source lines inside the
-dependency. The full kernel dependency contains 14181
+930 nonblank TypeScript source lines inside the
+dependency. The full kernel dependency contains 14973
 nonblank TypeScript source lines.
 
 The benchmark runner and engine-specific audit verification contain
-1439 nonblank TypeScript source lines.
+1443 nonblank TypeScript source lines.
 They are excluded from both application columns. Dependency and harness code
 is not application-authored, but it remains code that must be understood,
 operated, or upgraded.
@@ -44,8 +44,8 @@ operated, or upgraded.
 
 | Variant | Median milliseconds |
 | --- | ---: |
-| Conventional PostgreSQL | 105.72 |
-| Agentic Data Kernel | 1164.60 |
+| Conventional PostgreSQL | 50.65 |
+| Agentic Data Kernel | 911.14 |
 
 Runtime is not a headline metric. The variants perform different work and this
 deterministic smoke benchmark is not a latency study.