@meada/meada 0.1.0 → 1.1.0

package/CHANGELOG.md

@@ -6,6 +6,531 @@ All notable changes to Meada are recorded here. The format follows
 
 ## [Unreleased]
 
+## [1.1.0] - 2026-11-02
+
+A minor release on the [1.x stability promise](https://github.com/ClaudioMascaro/meada/blob/main/docs/site/en/stability.md):
+local accounts (ADR 0024) in the console, the proposal server and the nodes, carried by the
+`cloud` image, the Compose recipe and the Helm chart; the export's `format` and indexed commit;
+client-side deadlines on every Postgres call; durable pulled-generation writes; resolver fixes
+for C#, Kotlin, Rust and Swift (tier b3); and the fixes of tiers b1 and b2. The index schema
+version changes, so existing indexes are rebuilt once on first use. `meada-core` 1.1.0 adds `format`, `commit` and `dirty` to `Export`, and its
+`export::parse` refuses a document without `format`: re-export with 1.1.0 before parsing an export
+written by 1.0.0. The tree, the `meada-core` pin, the Dockerfile, the compose defaults and the
+Helm chart declare `1.1.0`, and the `v1.1.0` tag follows this entry's merge on main. Publication
+(crates, the staged npm package, the GitHub draft release) belongs to the maintainer.
+Release notes are available in
+[pt-BR](https://github.com/ClaudioMascaro/meada/blob/main/docs/releases/1.1.0.md),
+[English](https://github.com/ClaudioMascaro/meada/blob/main/docs/releases/1.1.0.en.md) and
+[Spanish](https://github.com/ClaudioMascaro/meada/blob/main/docs/releases/1.1.0.es.md).
+
+### Added
+
+- The export format and the indexed commit (#512, ADR 0004 "Canonical export"): every export
+  starts with `format` (`meada_core::export::FORMAT`, 1), which rises only when a reader of the
+  previous shape would misread the new one, never for an added optional field; then
+  `repository`, then `commit` and `dirty`, both optional and left out together. Locally `meada export` reads `HEAD` before and
+  after its refresh and the checkout's status after it (ignored files, `.meada/` among them, do
+  not count), and names the commit only when `HEAD` did not move and the index is fresh; outside
+  git or before the first commit both are left out. In server mode they come from the commit
+  `meada index --workspace` recorded beside the index, or a generation's `head`, never from the
+  mirror's live `HEAD`, with `dirty` false. For `meada-core` crate users: `Export` gains
+  `format`, `commit` and `dirty` (a minor change, the struct being `#[non_exhaustive]`, so the
+  next `meada-core` release is 1.1.0), and `export::parse` refuses a document without `format`,
+  naming the field, so an export written before this release no longer parses. Every `*.export.json` golden gained the three fields.
+
+- Named workspaces and the proposal server with local accounts (#562, ADR 0024, from #551):
+  `[catalog]` and `[workspaces]` (and so `[proposals]`) accept `[accounts.github]` in place of
+  `[oidc.github]` and still need one of the two (`[catalog] needs [oidc.github] or
+  [accounts.github]`; `[workspaces]` now names `[ui]` and `[catalog]`, the catalog naming the
+  provider). Eligibility reads the account's verified login, an operator account is the platform
+  administrator, and workspace operator lists, version authors, history and audit records name
+  `local:` subjects. `POST /api/v1/account/tokens` takes `{"surface": "proposals"}` when the
+  console's bootstrap has `[proposals]` (audience `meada:proposals`; a 422 `invalid_surface`
+  without it), `config` carries `"proposals": true` and the profile page offers the surface. The
+  proposal server with `[accounts]` and no `[oidc]` reads the public key at start and admits only
+  those tokens (a session token or a node's agent token is a 401 with `WWW-Authenticate: Bearer`,
+  no protected resource metadata), deriving the subject, login, groups, grant and role from the
+  token alone. No golden changed.
+- The verified GitHub login of local accounts (#561, ADR 0024, from #551): `[accounts.github]`
+  (`host`, `roles`, `max_age_seconds` as `[oidc.github]`, plus `api`, `https://api.github.com` by
+  default on `github.com` and required on any other host) is the GitHub grant provider of local
+  accounts. A person pastes a GitHub personal access token on their profile page or sends it to
+  `POST /api/v1/account/github`; the console calls `GET /user` on `api` once, keeps the lowercase
+  login and drops the token, and answers a fresh session token carrying the login. A login
+  another account holds is a 409 `login_taken`, GitHub's refusal a 422, GitHub out of reach a
+  503. `POST /api/v1/account/github/remove` and the accounts page's `remove_github` action remove
+  it. Session and agent tokens carry the verified login, so the GitHub grant joins the groups
+  grant in the console (`session` shows `login`, `github_host` and `github_grant`), on nodes, in
+  a team operator's additions (`added_by`), in the audit's `login` column and in the exclusions
+  marks; `meada github-app roles` reads `[accounts.github]`. Recorded `account.github` and
+  `account.remove_github`; the personal access token is never stored, logged or audited. No
+  golden changed.
+
+- Helm chart support for local accounts (#565, ADR 0024, from #551): `modules.accounts` renders
+  `[accounts]` from values, with `values-accounts.yaml` as the proof-of-concept shape (a writable
+  console with `operations = true`, Postgres and no identity provider). The Ed25519 private key
+  comes from its own Secret and is mounted only in the console's `console` container, the public
+  key from another Secret in the console and the nodes (a node also gets `[ui] public_url`, the
+  token issuer, and `[postgres]`), the initial admin password from an optional Secret in the
+  console. `modules.accounts.groups` and `modules.accounts.github` carry `[accounts.groups]` and
+  `[accounts.github]` (the refresh job, with `modules.githubApp`, gets the GitHub grant provider and runs the role check, and
+  `modules.workspaces` accepts it in place of `modules.oidc.github`); `modules.accounts.breakGlass`
+  keeps `[accounts]` in the console alone beside `modules.oidc`. The chart refuses a missing
+  Postgres or console, equal key Secrets, accounts beside OIDC without break glass, and groups or
+  GitHub under break glass. `scripts/helm-check` covers the sections, the mounts and the refusals;
+  the chart READMEs (pt-BR, English, Spanish) no longer say a writable console needs OIDC. The
+  proposal server is not part of the chart. `[accounts.github]` renders as the spec names it and
+  is parsed once #561 lands. No golden changed.
+
+- One-command proof of concept in the Compose recipe (#564, ADR 0024, from #551):
+  `cp .env.accounts.example .env && docker compose up -d` starts the generations fleet, Valkey,
+  the store, Postgres with its migration, a writable console with local accounts and nodes that
+  admit agent tokens. `compose.accounts.yaml` adds the Ed25519 key pair (made once by the
+  `certificates` step, never printed, the private key mounted read-only in the console alone and
+  the public one in the nodes), the console's and the nodes' `[accounts]` manifests, a one-shot
+  `seed` of the first workspace version (only while the store has none) and a node proxy that
+  forwards `Authorization` with no static bearer. The other profiles are unchanged, and
+  `scripts/compose-check` covers the new one. The Compose README (pt, en, es) starts with it and
+  covers `MEADA_ADMIN_PASSWORD`, `meada ui reset-admin`, key rotation and rate limiting the
+  sign-in route at the proxy.
+
+- Agent tokens for the nodes (#560, ADR 0024, from #551): a signed-in local account generates,
+  on its profile page or through `POST /api/v1/account/tokens` (`{surface: "nodes", hours}`, 1 to
+  168 hours, 8 by default), an agent token shown once (`{token, expires_at, surface}`), signed
+  with the account's role and groups as its row stands and a random token id, recorded
+  `account.token` (surface, hours, token id, never the token). A change-required account gets the
+  403 `password_change_required`, a suspended one the role refusal; the console answers an agent
+  token with 401. A node with `[accounts]` and no `[oidc]` (`meada mcp --listen`) now reads the
+  signing public key at start, and the console's `[ui] public_url` from a `[ui]` section its
+  manifest must carry, refusing to start without either; it admits only agent tokens for the
+  nodes (a 401 `Bearer` before routing for any other, a session token included) and answers
+  under the grant `[accounts.groups]` gives their groups (every repository without the table),
+  as an identity provider's token is answered. The `accounts` feature now implies `ui`. No golden
+  changed.
+
+- Accounts page in the console (#559, ADR 0024, from #551): the global operator of a console with
+  local accounts gets `/accounts`, listing every account (role, groups, state with a suspended
+  account marked and a locked one saying until when, change required, last password change), a
+  create form (username pattern and password length checked first, "change on first sign-in"
+  checked by default) and, per account, role, groups, suspend, reactivate and reset password,
+  each behind the shared confirmation dialog with the server's refusals (`last_operator` and the
+  rest) shown unchanged. Any other role, and a console under break glass, gets the not-found
+  page at that path. The audit page names every `account.*` action in Portuguese and English.
+  The password rule `common_password` now has its own copy. Front end only, no golden changed.
+
+- Groups of local accounts (#558, ADR 0024, from #551): the global operator gives accounts groups
+  (`groups` on `POST /api/v1/accounts`, and the `groups` action of
+  `POST /api/v1/accounts/<username>`, each an owner name, else a 422 `invalid_group`);
+  `GET /api/v1/accounts` lists them, and each change is recorded `account.groups`.
+  `[accounts.groups]` maps groups to identities as `[oidc.groups]` does: once it exists, a local
+  session's grant is what its groups map to, and it bounds every view (the manifest, the
+  workspace and its versions, the store, the repositories, the credentials, the playground, the
+  exports and the graph views) as an identity provider's grant does; without it every local
+  account still reads every repository. A local viewer whose group owns an entry of the current
+  workspace version its grant reads is a team operator (ADR 0015). Session tokens carry the
+  groups, so a change reaches reads at the next sign-in and writes at once (the account row is
+  read before each). `GET /api/v1/admission` with `[accounts]` now answers: `accounts` (the mode,
+  `accounts` or `break_glass`, and the signing public key's fingerprint, `blake3:` and the hex
+  BLAKE3 hash of the raw Ed25519 key) and, without `[oidc]`, the groups table bounded by the
+  caller's grant. No golden changed.
+
+- Account administration for local accounts (#557, ADR 0024, from #551): the global operator
+  lists every account (`GET /api/v1/accounts`: username, role, state, the end of a lock, change
+  required, last password change, created and created by, never a hash), creates one
+  (`POST /api/v1/accounts`, `{username, role, password, change_required}`, the policy applied to
+  the temporary password, a change required unless the body turns it off; a malformed username a
+  422 `invalid_username`, a taken one a 409 `username_taken`) and changes one
+  (`POST /api/v1/accounts/<username>`, one `action`: `role`, `suspend`, `reactivate` or
+  `reset_password`, which clears a lock and requires a change unless told not to; an unknown
+  account a 404). Suspending or demoting the last active operator is a 409 `last_operator`,
+  decided under the schema's advisory lock so two requests at once never leave none. Anyone else
+  gets a 403. The routes answer whatever `[ui] operations` says; workspace and generation writes
+  keep requiring it. Every console write of a local account now reads the account's row first,
+  so a suspended or demoted account loses its writes at once, while its reads last until its
+  token expires. Audit actions `account.create`, `account.role`, `account.suspend`,
+  `account.reactivate` and `account.reset_password` name the account and the fields changed,
+  never a password, written before the change (503 `audit_unavailable` otherwise); `account` is
+  the route-level action of a change refused before its body is read. No route deletes or
+  renames an account; under `[accounts] break_glass` (#563) none of these routes exists, each a
+  404. No golden changed.
+
+- Break-glass account beside the identity provider (#563, ADR 0024, from #551): `[accounts]
+  break_glass = true` lets the section sit beside `[oidc]`; without `[oidc]` it is an error, and
+  `[accounts.groups]` or `[accounts.github]` under it is an error naming the table. The console
+  then signs in only the default account (any other username gets the wrong password's 401,
+  audited `not_break_glass`, the table never read) as the global operator, and admits its session
+  token beside the identity provider's, each bearer routed by its issuer to one verifier, so the
+  identity provider's keys never check a console token and the signing key never checks an
+  identity provider's; a console whose `[oidc] issuer` is its own `public_url` refuses to start.
+  The password change works; no other route of local accounts exists. Nodes and the proposal
+  server keep admitting only the identity provider and read no key. `config` adds `break_glass:
+  true`, and the front end offers a discreet break-glass sign-in (`/break-glass`) beside the
+  identity provider's, which now waits for a click under break glass. No golden changed.
+
+- Hardening of local sign-in (#555, ADR 0024, from #551): the password policy refuses an embedded
+  common-password list (SecLists, MIT, the entries of 12 to 128 characters, compared ignoring
+  case; rule `common_password`). Ten consecutive failed password checks, at sign-in or as a
+  password change's current password, lock an account for fifteen minutes, counted in a
+  transaction holding the account row so parallel attempts never pass ten; a success resets the
+  count. A locked account gets the wrong password's 401 at a hash's cost, its password unchecked
+  and its lock never extended, audited `locked_now` and then `locked`. A stored hash weaker than
+  the console's parameters is redone at the next successful sign-in. `meada ui reset-admin
+  --workspace <manifest>` (features `ui` and `accounts`) creates or reactivates `admin` as an
+  operator, clears its lock and sets the `MEADA_ADMIN_PASSWORD` value or a generated password
+  printed once on stdout, with a change required, recorded `account.reset_admin` `via` `cli`
+  before the write and refusing with exit 1 when the record cannot be written. No golden changed.
+
+- Local sign-in for the console (#554, ADR 0024, from #551): the new `accounts` cargo feature
+  (enabled by `cloud`) and its `[accounts]` section, which needs `[postgres]` and never sits
+  beside `[oidc]`, name the Ed25519 signing key pair and the default account's initial password,
+  each from a variable or a file. Migration 9 adds the `accounts` table, so `meada postgres
+  migrate` reaches version 9. On its start the console checks the key pair and creates the
+  default account `admin` (password `admin123` with a change required, or the policy-checked
+  `MEADA_ADMIN_PASSWORD` without) once, under an advisory lock. `POST /api/v1/login` answers a
+  session token the console signs with EdDSA for eight hours; a token carrying the change-required
+  mark opens only `POST /api/v1/account/password`. Every route but the static files, `config` and
+  `login` then needs a session token; `[ui] operations = true` is accepted with `[accounts]` and
+  no `[oidc]`; `config` names the sign-in mode (`sign_in`: `accounts`, or `oidc` with an identity
+  provider), `session` adds `account: true`, and
+  every account reads every repository while no groups table bounds it. Passwords are argon2id at
+  OWASP's parameters under a policy of 12 to 128 characters that refuses the default password and
+  the username, at most four hashes run at once, and every sign-in, refusal and password change
+  is audited (`account.login`, `account.password`, role `none` for an unknown username) before its
+  token. The module table gains `accounts`; no golden changed.
+
+- The console's sign-in pages for local accounts (#556, from #551): when `config` says
+  `"sign_in": "accounts"` the console shows its own sign-in page (labelled username and password,
+  one generic refusal, `busy` and `audit_unavailable` shown as themselves) instead of the identity
+  provider's redirect. A change-required sign-in goes straight to a forced password change page
+  (the current password and the new one twice, the server's rule shown on a refusal) that offers
+  nothing to navigate to until it succeeds, and then opens the workspace. The session token lives
+  in `sessionStorage` for the tab's life, is sent as the bearer and is cleared on sign-out and on
+  any 401 (which returns to sign-in; a refused current password in the change is not one); it is never in `localStorage`, a URL
+  or a log. A profile page offers the voluntary password change and sign-out. pt-BR and English
+  copy; the identity provider flow is unchanged. Front end only: no golden changed.
+
+- `meada status` names a Kotlin file the grammar misreads (#546, from #434). A declaration read
+  as an infix call leaves the file out of the index; the file now sets the new `Facts::misparsed`
+  (absent from every other file's stored facts) instead of `unbuilt`, and a new status line,
+  `Msg::FileMisparsed`, in English and Portuguese, names it beside the byte-budget and using
+  drops. The Java and Kotlin layout skips it as it skips the other drops. The schema version is
+  the same: a file dropped before the upgrade gets its line when it next changes, or at once
+  after deleting `.meada/index.db`. The `cli.status-budget` goldens gained the new line.
+
+### Changed
+
+- The grant providers take neutral inputs (#553, from #551): the new `grant` module computes a
+  subject's grant from its groups and its GitHub login (`Providers::grant`), with no reference
+  to a token, and holds the GitHub grant provider's permissions cache, which moved out of the
+  OIDC module; the OIDC module feeds it from a token's claims. Every reader of `[oidc.github]`
+  goes through `Manifest::github`, the console and the proposal server build their sessions
+  from a neutral admitted subject (`grant::Admitted`), and a node's pass carries only a grant.
+  Nothing a caller sees changes; no golden changed.
+
+- The axum provider reader walks each value once per file (#431): the values a file's rebound
+  `let`s reach share one `seen` set, and `Code::origins` is not asked for a call whose builder
+  chain goes through a method no router hands back, nor for a name written as text, a path, a
+  number, a boolean or a character. The reader's share of a one-file refresh on this repository
+  drops from about 1.4 s to about 0.1 s. No golden changed.
+
+### Fixed
+
+- Swift: a call whose labels differ from a known outside member's resolves as if that base
+  were absent (#463): `x.hash(seed: 1)` on a type that conforms to `Hashable` and declares
+  `hash(seed:)` is `exact`, while `x.hash(into: &h)` stays opaque. A call with no labels, or in
+  another language, is still compared by its bare name.
+- Swift: an alias of an outside type reaches the repository's extensions of that type (#440). A
+  receiver typed by `typealias Anim = Animation`, or by an alias of an alias, and `Anim.build()`
+  match `extension Animation { }` as `Animation` does; an alias of an outside type with no
+  extension stays unresolved.
+- Rust: a call after `?` or `.await` is typed by the value they unwrap (#435, after #401): the
+  pack keeps beside a function's written result the first type argument of a `Result` or
+  `Option` (`Def::unwrapped`) and the `Output = T` of `impl Future<Output = T>` and
+  `Pin<Box<dyn Future<Output = T>>>` (`Def::output`, read only through `.await`), so
+  `load()?.port()` and `fut().await.port()` resolve within `T`'s family, `exact` when it
+  declares one `port`, where `?` left a name match and a plain `fn` returning a future resolved
+  to nothing. A type outside the repository, or a `?` before an `.await`, leaves the call as
+  it was. The stored facts gain
+  `Def::unwrapped`, `Def::output`, `Call::unwraps` and `Call::awaits`, so the schema version
+  changes and Rust indexes are rebuilt once.
+- Kotlin: a class, object or interface nested in an `expect` declaration, at any depth, is
+  `expect` too (#437), so a use of it resolves to the `expect` one instead of staying
+  `ambiguous` among its `actual` declarations.
+- C# `using static T` imports only the static members and nested types `T` declares (#433): a bare
+  `Go()` with `Go` on a base of `T` was an `exact` link to the base's method, which C# rejects
+  ("inherited members aren't imported"), and is now a name match at best; `using static` of the
+  base itself still gives it. Java's `import static` and Kotlin keep reading inherited members.
+- Kotlin: a bare call resolves in Kotlin's order, an extension of the implicit receiver in scope
+  before a top-level function of its name (#436, from #402): inside `fun CoroutineScope.x() {
+  launch { } }` the call is `exact` to `CoroutineScope.launch`, not to the top-level `launch`
+  (`ambiguous` with it when the extension may apply to any receiver), and an `object`'s name is
+  its instance, so `Dispatchers.setMain(..)` reaches an imported `fun Dispatchers.setMain` (it
+  was no link) while a class's name keeps companion and statics. "Known ceilings" drops the
+  bare-call line. No golden changed.
+- C#: an `internal`, `private` or `private protected` constructor or method of a public type is
+  a candidate from its own project's files alone (#441); `InternalsVisibleTo` stays unread.
+- The console writes one `ui: directory: unreadable` stderr line per request when the directory
+  cannot be read (#451, after #335): the request's session remembers the failure at admission,
+  so the flags, the admission counts and the owner picker take that answer and write no second
+  line (`workspace` wrote two), and a write it refuses as 503 `audit_unavailable` prints no
+  pre-authentication audit line beside it. Reads still answer with the flags unavailable, the
+  counts null and the picker a 503; writes still refuse as before. No golden changed.
+- Postgres calls that had no client-side deadline now have one (#447): a SCIM request (under the
+  directory's one write lock), the role check's fence read and write transaction, and the
+  console's start check, so a Postgres that accepts the connection and stops answering ends in a
+  503, an exit 1 with no exclusions file a reader admits, and a console that starts, instead of
+  holding them forever. `postgres::Config::bound(n)` now adds the version check's two statements
+  itself and every call site counts only its own (the audit and directory reads and the overage
+  lookup moved accordingly; the accounts' calls, which undercounted, and the permissions poll
+  gained the two). No golden changed.
+- A crash after the pointer swap can no longer leave `current` naming a version document that
+  never reached the disk (#518): the pointer, the version document `meada workspace pull` writes,
+  the pulled contexts file and the exclusions file are replaced through one helper
+  (`pull::replace`) that syncs the new file before the rename and removes `<name>.new` when a
+  step fails. A failed pointer rename now names `current`, not `current.new`.
+- The docs say what 1.0.0 ships: nine languages (TypeScript, JavaScript, Python, Go, Rust, Java,
+  Kotlin, C# and Swift). The three READMEs, the three 1.0.0 release notes and the three user
+  guides no longer call Java, Kotlin, C# and Swift later 1.x work, the user guides gain a section
+  for each of the four (9.5 to 9.8) with their brokers (JMS, Azure Service Bus) and package
+  ecosystems (Maven and Gradle, NuGet, SwiftPM), and ADR 0003 records the change in an
+  amendment. No code, default dependency or golden changed.
+- A server-mode mirror's `meada.toml` and `meada.decisions.toml` are read through no symbolic
+  link (#547, after #506), as a pulled generation's are: `mirror()`, behind `Manifest::read`
+  (`mcp --listen`, snapshot pull, the lock and pointer operations, workspace versions, the
+  heartbeat, the UI, the workspaces CLI, the GitHub App), now refuses a link unopened, one that
+  stays inside the mirror included, a file that is not regular and a file replaced while read,
+  with the generation's messages, and bounds each file at 1 MiB (`GENERATION_CONFIG_MAX`, now
+  built without the `snapshot` feature). A local checkout and an operator's own files still
+  follow links. The architecture map and the snapshots page, in its three languages, say so.
+- No manifest error quotes a written value (#545), after #449 stopped serde's `invalid type` and
+  `invalid value`: `unknown variant` names the key and the values it accepts (`` `workspace.source`:
+  is not one of the values it accepts (`file`, `store`) ``) instead of serde's text, an error no
+  key spans reads "a value is not valid here" instead of serde's message, and the rule errors
+  for `serve.prefix`, `serve.strip`, `serve.documents` and a resource's `kind` name the key and
+  the rule (`` `serve.strip`: must start with `/` ``) instead of the value. The console's cut of
+  an error to its position stays as a second guard (it still covers an error built outside
+  `describe` that names an identity). English and pt-BR texts changed; the workspace validation
+  fixture changed only by the new texts.
+- The deploy fetch reads a `[[repository]]` entry by its own keys (#544): any table header ends
+  the entry before it, so a `[[repository.peer]]` or `[[repository.resource]]` table no longer
+  replaces its `repo` or `path`, and a value is the text between its quotes, so a trailing
+  comment is not part of it. Before, such a version stopped the Compose refresh and let the chart
+  clone the peer's repository into the entry's path (or into a directory named after the
+  comment). `fetch-pulled.sh` and the chart's `workspace.fetch` carry one awk program, and a
+  test fails when the two copies drift. No golden changed.
+- A repository identity on the `[oidc.github]` host compares without case wherever it meets the
+  catalog (#508): the roles job gives a selected `github.com/Acme/API` and the catalog's
+  `github.com/acme/api` one `both` row keyed as written, the `max_repositories` cap does not
+  count it as extra, and the console's catalog check and listing match it. A repository selected
+  in two spellings (a deployment's `github.com/Acme/API`, a named workspace's
+  `github.com/acme/api`) keeps one `source` row under the first and gets its role rows under
+  each, so grants, which match exactly, read both. Other hosts compare exactly. No golden
+  changed.
+- Compose mirror origins (#445): `fetch.sh` and `fetch-pulled.sh` read an existing mirror's
+  `origin` before fetching and refuse one whose HTTP(S) URL carries credentials (a mirror cloned
+  from a URL with a token keeps it there), naming the identity and never the URL, and the refresh
+  stops before index and publish as a failed fetch does. The READMEs tell the operator to run
+  `git remote set-url origin <URL without credentials>` in such a mirror.
+- Java and Kotlin: a file with thousands of fields and locals is read in linear time (#442, from
+  #424). The hides check indexes the fields by name instead of scanning every field per local,
+  the class around a write is found from the prefixes of its scope, and `declared_before` (and
+  Kotlin's `assigned`) read a node's parent from an index built once per file, since
+  `Node::parent()` is found from the root and made a deep file quadratic per write. Same answers;
+  no golden changed.
+- Indexing: a file a pack drops for passing a limit is named by `meada status` (#434, from
+  #419). The Java, Kotlin and Swift qualified-name budget (4 MiB) now sets `Facts::budget`, as the
+  C# one does, instead of `unbuilt`, which prints nothing; a C# project that gives its files more
+  than 256 usings (`PROJECT_USINGS`) marks each of them with the new `Facts::usings`, which a new
+  status line names (`Msg::FileTooManyUsings`, with the count). Kotlin's `misparsed` file stayed
+  `unbuilt` (a grammar defect, not a limit; #546 names it too). An index built before this change keeps a Java,
+  Kotlin or Swift file dropped by its budget as `unbuilt` until the file changes. No limit
+  changed. The `cli.status-budget` goldens gained the new cases; no stored format golden changed
+  (the new field is absent from every sample), so the schema version is the same.
+- Resolution: the receiver and call depth (`RECEIVER_DEPTH`) is one count for the whole lookup
+  (#432, from #417), carried through a glob, an alias or an on-demand import as the link count is,
+  so a chain that alternates receivers and imports costs its length, not `RECEIVER_DEPTH` per link
+  up to `LINK_DEPTH`. No limit changed and no answer under the limits; no golden changed.
+- Helm: the default `workspace.fetch` (#444, from #316) reads the repositories from `$1` when
+  given (the pulled list under `modules.oidc.github`) else from `workspace.repositories`, now
+  mounted as `repositories.toml` so a store-sourced refresh, whose bootstrap lists none, still
+  fetches the operator's list, refuses a URL carrying a credential and, as the compose
+  scripts do (#445), an existing mirror whose `origin` carries one, keeps each mirror strictly
+  under `/data/mirrors`, and on failure prints `refresh: fetch failed for <identity>; the refresh
+  stops before publication` and exits nonzero without echoing a URL or token.
+  `scripts/helm-check` runs the rendered script under `sh` with a stub `git` to check these; the
+  chart READMEs describe it.
+- Workspace import (#450): `meada workspace import` reads its file once, bounded by the version
+  size limit, and audits the id of the text it stored; a file past the bound or not a regular
+  file is refused before any audit record is written.
+- Manifest type errors (#449): a `meada.toml` or workspace manifest key of the wrong type, or
+  with an invalid value, reports the key and the expected kind (`` `oidc.entra`: has the wrong
+  type (a table was expected) ``) instead of serde's message, which echoed the written value, so a
+  secret pasted under the wrong key no longer reaches stderr.
+- Pulled generations (#506): a mirror's `meada.toml` or `meada.decisions.toml` that is a symbolic
+  link is refused unopened, the error naming the file, so a repository can no longer make a node
+  read and parse a file of the host. A link into the mirror (`meada.toml -> conf/meada.toml`) is
+  refused too, as the index refuses a linked pack config. The file opened is checked to be the one
+  checked. Secrets and CAs a manifest names still follow links (Kubernetes mounts them through
+  one). The snapshots page says so in its three languages.
+- Named workspaces on a node (#510): a node shows a named workspace's route
+  (`/-/workspaces/<id>/<identity>`, pinned or not) and lists it in a 404 only to a token whose
+  grant reads every entry of the workspace's version, the entries the sponsor rule excluded
+  included, as the console does. Before, once A of a Y+A workspace lost its sponsor, a subject
+  reading Y alone found the workspace on a node. A generation's context now records `excluded`,
+  the identities the sponsor rule left out, sorted, and its digest covers them; a context without
+  one is written as before, with the same generation id, and a generation published earlier reads
+  as none excluded. A node on an older binary refuses a generation that records an exclusion, so
+  upgrade nodes before or with the publisher. No golden changed.
+
+## [1.0.0] - 2026-10-30
+
+The tree declares `1.0.0`: this release raises the workspace, the `meada-core` pin, the Dockerfile,
+the compose defaults and the Helm chart from `0.1.0`, and the `v1.0.0` tag follows its merge on
+main. Publication is still ahead and belongs to the maintainer under
+[#154](https://github.com/ClaudioMascaro/meada/issues/154): `cargo publish` of the crates (core
+first), approval of the staged npm package with 2FA, and publication of the GitHub draft release,
+which triggers the OCI image and Helm chart workflow.
+Release notes and the scope evidence checklist are available in
+[pt-BR](https://github.com/ClaudioMascaro/meada/blob/main/docs/releases/1.0.0.md),
+[English](https://github.com/ClaudioMascaro/meada/blob/main/docs/releases/1.0.0.en.md) and
+[Spanish](https://github.com/ClaudioMascaro/meada/blob/main/docs/releases/1.0.0.es.md).
+The [1.x stability promise](https://github.com/ClaudioMascaro/meada/blob/main/docs/site/en/stability.md)
+starts at publication. The [#32 tracking checklist](https://github.com/ClaudioMascaro/meada/issues/32)
+still needs the post-publication evidence.
+
+### Added
+
+- Public fixture benchmark (issue #149): release-profile index/reindex timings, root and
+  workspace index sizes, and default-answer/tool-list token estimates in every PR/main CI
+  summary and retained JSON/Markdown artifact. Timings are informational.
+
+- The English user guide and README (#150, spec #32): `docs/user-guide.en.md` translates both
+  halves of the pt-BR guide section by section (sections 1 to 11) with the same neutral examples
+  and links the English stability page; `README.en.md` now links it instead of the pt-BR guide.
+  No code, default dependency or golden changed.
+- The Spanish user guide (#151, spec #32): `docs/user-guide.es.md`, sections 1 to 11 of the pt-BR
+  guide with the same structure and neutral names, linking the Spanish stability page. The Spanish
+  README links it instead of the Portuguese guide, and the three READMEs link the stability page
+  from the Status section. No code, default dependency or golden changed.
+- The output grammar reference (#145, spec R1): `docs/reference/output-grammar.md`, in English like
+  the MCP surface, specifies every line kind of `search`, `context` and `trace`, the link notation
+  with its level and reason, the levels in order, the contract identifiers (`http::`, `http::ANY::`
+  for a provider of every method, `channel::`, `package::`, `resource::`), the `search` kinds, the
+  chain footer, the cut note and the token estimate, and tells readers to skip line kinds and
+  fields they do not know. Its tables are the grammar check's input: `tests/it/grammar.rs` matches
+  every line of every rendered-answer golden against the line kinds of its tool and fails naming
+  the golden and the line, fails on a documented line kind no golden shows, and holds the
+  document's levels, entry kinds, open item kinds and `search` kinds to the code's. The stability
+  document links it. No output changed; new goldens pin the answers only inline assertions covered (`no symbol
+  matches`, `no resource matches`, the server's `index behind the mirror`, and `trace` with no
+  start, several symbols, several call sites or a clean working tree).
+- The pt-BR user guide, second half (#147, spec #32), in `docs/user-guide.md` (sections 8 to 11):
+  each contract kind (HTTP routes, declared resources and gateway prefixes, OpenAPI and AsyncAPI
+  documents, channels with the limit that broker clusters are not modelled, packages), each 1.0
+  language pack (TypeScript and JavaScript, Python, Go, Rust) with its frameworks, clients,
+  environment reads, manifests, channel clients and known limits (including that Rust calls inside
+  macros are not indexed), shape drift, and communities and processes. Java, Kotlin, C# and Swift
+  are named only as planned Release 2 work. No code, default dependency or golden changed.
+- The pt-BR user guide, first half (#146, spec #32), in `docs/user-guide.md`: installation through
+  every channel (Cargo, prebuilt binary, shell installer, `npx @meada/meada`, container), MCP setup with
+  `npx @meada/meada mcp` and the three tools with their parameters, the `meada.toml` reference (every
+  table and key), decisions and deciders (protocols, environment variables, what is sent,
+  privacy), every CLI command and the export. The READMEs in all three languages gain the
+  installation channels, first steps, MCP setup and a 1.0 status section with the stability
+  promise. No code, default dependency or golden changed.
+- Surface goldens (#144, spec #32): `tests/golden/mcp.tools.json` holds the MCP tool list (names,
+  descriptions and parameter schemas of `search`, `context` and `trace`), checked beside the
+  1,000-token limit of the descriptions, and `tests/golden/cli.help-all.en.txt` the English help of
+  every command of the default build. A test pins the default token budget of 2,000. Both
+  goldens change only with `MEADA_BLESS=1`.
+- The stability document (#148, spec #32), `docs/site/{pt,en,es}/stability.md`: the surface 1.x
+  freezes (the MCP tools, the output grammar, CLI commands and flags, the `meada.toml`,
+  `meada.decisions.toml` and `meada.workspace.toml` schemas, the export), what is breaking, what is
+  minor, what is not frozen, and the review gate. The READMEs and the site home pages link it.
+- `search`, `context` and `trace` read from each index its contract rows and only the symbols,
+  calls and communities of their answer (#396, **Partial export**), instead of every row of every
+  repository. Answers are the same bytes; on junit5 a `search` or `context` peaks at about 40 MB
+  instead of 170 to 190 MB and answers in about 0.3 s instead of 1 to 1.4 s. The index gains
+  seven lookup indexes (about 40% larger on junit5) and its schema version changes, so existing
+  indexes are rebuilt. `meada export`, `status` and the decision report still read every row.
+- A Meada skill for agents, `skills/meada/SKILL.md`: when to reach for `search`, `context` and
+  `trace`, how to read each level, and that a missing caller is unproven. The READMEs and the
+  site's MCP page show how to install it.
+- Per-channel install and MCP setup: the READMEs open with one row per channel (npx, Cargo, shell
+  installer, archive, Docker) with its install line and MCP server command, and gain a Docker MCP
+  line that mounts the folder holding the repository at the same path and runs without a network.
+  `scripts/container-smoke` runs that line as a stdio client.
+- The site's Deploy page (`docs/site/{pt,en,es}/deploy.md`) covers Docker, Compose and Helm, and
+  the chart gains `values-minimal.yaml`, which `scripts/helm-check` renders.
+
+### Changed
+
+- For `meada-core` crate users: the export's structs (`Export` and each of its pieces, with
+  `Shape` and `Drift`) are `#[non_exhaustive]`, so a field added in 1.x is a minor change. Build
+  one with `T::default()` and named field assignments, or, for a struct with a field that has no
+  default (`Document`, `Import`, `Link`, `Process`, `Step`, `Stale`), with `T::new` taking every
+  field in declaration order (`Shape::new` takes the source, the rest set after it). A struct
+  literal or an exhaustive pattern of these types outside `meada-core` no longer compiles. No
+  output, golden or exported byte changed.
+- The stability promise (spec #32) lets 1.x grow the MCP surface. In
+  `docs/site/{pt,en,es}/stability.md` and the three READMEs, these are minor changes: adding an MCP
+  tool while the tool list stays within its 1,000-token budget, adding an accepted value to an
+  existing parameter (a new value of `changes`) and adding a field at the end of an existing line
+  kind. Removing or renaming a tool or parameter and changing what an existing one means stay
+  breaking. ADR 0008 is amended: three tools is where the surface started, not a ceiling.
+- `SECURITY` (pt-BR, English and Spanish): the latest published 1.x version receives security
+  fixes, which ship as a patch or minor release.
+
+### Fixed
+
+- Console GitHub grant (#496): a session's GitHub grant and its state (`unread`, `current`,
+  `expired`) are read from the same permissions set at the same instant, so a session never shows
+  `expired` with a grant read while the set was fresh.
+- Release preparation keeps the GitHub release in draft state for the maintainer to publish.
+  A pinned cargo-dist regeneration helper compares the entire workflow after the explicit
+  draft policy; OCI publication follows the human `release: published` event.
+
+### Prepared
+
+- The v1 scope: HTTP, declared resources and gateway paths, OpenAPI/AsyncAPI, channels and
+  packages; levels and cross-repository chains, recorded decisions with optional deciders,
+  shape drift, TypeScript/JavaScript, Python, Go, Rust, communities and processes.
+- The R1 stability promise, normative MCP output grammar, surface goldens, complete user
+  references and public-fixture CI benchmark. Fixture timings are informational.
+- Configured Cargo, binary, shell, npm and OCI distribution. Configuration is not evidence
+  of actual publication or a successful published-installer smoke check.
+
+### Acceptance
+
+The [public #152 receipt](https://github.com/ClaudioMascaro/meada/issues/152#issuecomment-6379316350)
+retains both complete runs on AMD Ryzen 7 5825U, 16 logical CPUs, 7.16 GiB RAM,
+Ubuntu 24.04.5 LTS, x86_64. The measured build was
+`9b99c3a4091b6c1b2c590c43059763f25b6987ef`, `meada 0.1.0`, not every later documentation head.
+
+| Metric | Target | First complete run | Complete rerun |
+| --- | --- | --- | --- |
+| Cold configured-workspace index | <= 7 s | 12.680 s, not met | 2.711 s, met |
+| Root index size | <= 37 MB | 21.057536 MB, met | 21.057536 MB, met |
+| Single-file configured-workspace reindex | <= 1 s | 1.346 s, not met | 1.152 s, not met |
+| Compact MCP `tools/list` result | <= 1,000 tokens | 622, met | 622, met |
+| Largest default answer among 11 queries | <= 2,000 tokens | 1,996, met | 1,996, met |
+
+MB means 10^6 bytes; tokens are ceil(UTF-8 bytes / 4). Public fixture peers supplement the
+private workload; the receipt does not claim every feature naturally occurs in the private root.
+The [rerun of 2026-10-30](https://github.com/ClaudioMascaro/meada/issues/152#issuecomment-6531862493)
+on main `1d648ad6` uses a reconstructed workspace (not directly comparable) and meets four of the
+five targets: cold index (medians 5.586 to 6.625 s, <= 7 s), root index size (31.883266 MB,
+<= 37 MB), `tools/list` (643 tokens, <= 1,000) and largest default answer (1,999 tokens,
+<= 2,000). The single-file reindex (<= 1 s) met the target in the two quieter runs (0.99 and
+0.931 s) and missed it in the two runs at a load average near 3 (1.068 and 1.123 s). The
+maintainer [waived the reindex target for 1.0.0](https://github.com/ClaudioMascaro/meada/issues/350#issuecomment-6532716065),
+recorded on [#350](https://github.com/ClaudioMascaro/meada/issues/350).
+
+Known limit: the single-file reindex sits near 1 s and exceeds it under load. #350 stays open for
+1.x, with the goal of 1 s with headroom under ordinary load; a speedup changes no output, so it
+ships as a patch or minor release. Publication is done separately by the maintainer under
+[#154](https://github.com/ClaudioMascaro/meada/issues/154).
+
 ## [0.1.0] - 2026-10-30
 
 The first release: the trunk of the roadmap (ADR 0003) and every spec merged since, with
@@ -555,5 +1080,7 @@ and `trace` from the two longest processes. The spec adds about 0.3 MB and 0.03
 The rise of the single-file reindex since 2026-10-14 predates it (specs #22 and #23), and at
 692 files it is close to its target.
 
-[Unreleased]: https://github.com/ClaudioMascaro/meada/compare/v0.1.0...HEAD
+[Unreleased]: https://github.com/ClaudioMascaro/meada/compare/v1.1.0...HEAD
+[1.1.0]: https://github.com/ClaudioMascaro/meada/releases/tag/v1.1.0
+[1.0.0]: https://github.com/ClaudioMascaro/meada/releases/tag/v1.0.0
 [0.1.0]: https://github.com/ClaudioMascaro/meada/releases/tag/v0.1.0

package/README.md

@@ -9,13 +9,127 @@ LLM.
 
 ## Instalação
 
+Escolha a linha que combina com o que você já tem. Todos os canais entregam o mesmo binário
+`meada`, e a última coluna é o comando que a configuração MCP do seu agente executa.
+
+| Você tem | Instalação | Comando do servidor MCP |
+| --- | --- | --- |
+| Node.js | nada: `npx -y @meada/meada --version` | `npx -y @meada/meada mcp` |
+| Rust | `cargo install meada` | `meada mcp` |
+| Linux ou macOS | o instalador de shell abaixo | `meada mcp` |
+| Qualquer sistema | o arquivo do seu sistema nas [releases do GitHub](https://github.com/ClaudioMascaro/meada/releases), com `meada` no `PATH` | `meada mcp` |
+| Docker | `docker pull ghcr.io/claudiomascaro/meada:1.1.0` | a linha `docker run` em [Conectar um agente](#conectar-um-agente-mcp) |
+
+```sh
+# Instalador de shell (Linux e macOS)
+curl --proto '=https' --tlsv1.2 -LsSf https://github.com/ClaudioMascaro/meada/releases/latest/download/meada-installer.sh | sh
+```
+
+Os arquivos prontos cobrem Linux, macOS e Windows, em x86_64 e arm64; a imagem cobre Linux amd64
+e arm64. A versão do pacote npm é sempre a da release. Para indexar, o Meada só precisa do
+binário e do git. Os detalhes de cada canal, da console e do contêiner estão em
+[Instalação](https://claudiomascaro.github.io/meada/installation/) e no
+[guia do usuário](docs/user-guide.md) (seção 1, Instalação).
+
+## Primeiros passos
+
+Na raiz de um repositório (aqui `web`, que consome a rota de `api`):
+
+```sh
+meada index     # monta o índice em .meada/, do repositório e dos pares
+meada status    # o estado de cada índice e os pares não encontrados
+```
+
+Para o Meada ligar `web` a `api`, o `meada.toml` de `web` nomeia o par:
+
+```toml
+[[peer]]
+repo = "example.com/acme/api"       # remoto git de origin, sem esquema nem .git
+base_url_env = ["API_URL"]          # variável de onde o cliente lê a URL base
+```
+
+A referência completa do `meada.toml` está no
+[guia do usuário](docs/user-guide.md) (seção 4, referência do `meada.toml`).
+
+## Conectar um agente (MCP)
+
+O cliente executa o comando do servidor MCP e fala com o Meada por stdio. Na configuração do seu
+agente (por exemplo o `.mcp.json` do Claude Code), com npx:
+
+```json
+{
+  "mcpServers": {
+    "meada": { "command": "npx", "args": ["-y", "@meada/meada", "mcp"] }
+  }
+}
+```
+
+No Claude Code, o mesmo em uma linha: `claude mcp add meada -- npx -y @meada/meada mcp`. Com
+`meada` já no `PATH` (Cargo, instalador ou arquivo pronto), use
+`"command": "meada", "args": ["mcp"]`.
+
+Com Docker (Linux e macOS):
+
+```json
+{
+  "mcpServers": {
+    "meada": {
+      "command": "sh",
+      "args": ["-c", "exec docker run -i --rm --network none --user \"$(id -u):$(id -g)\" -v \"${PWD%/*}:${PWD%/*}\" -w \"$PWD\" ghcr.io/claudiomascaro/meada:1.1.0 mcp"]
+    }
+  }
+}
+```
+
+O cliente inicia o servidor no seu repositório. O Meada responde sobre o caminho que o cliente
+envia como raiz, então o contêiner monta a pasta que contém o repositório, e os pares vizinhos,
+nesse mesmo caminho; roda com o seu usuário, para o `.meada/` continuar seu, e sem rede, que nem
+a indexação nem o stdio usam.
+
+O agente ganha três ferramentas, `search`, `context` e `trace`, que só leem. Veja
+[Agentes e MCP](https://claudiomascaro.github.io/meada/mcp/) e o
+[guia do usuário](docs/user-guide.md) (seção 2, Conectar um agente).
+
+### Skill para agentes
+
+[`skills/meada/SKILL.md`](skills/meada/SKILL.md) ensina o agente a escolher cada ferramenta e a
+ler os níveis de uma resposta. No Claude Code:
+
 ```sh
-cargo install meada
+mkdir -p ~/.claude/skills/meada
+curl -fsSL https://raw.githubusercontent.com/ClaudioMascaro/meada/v1.1.0/skills/meada/SKILL.md -o ~/.claude/skills/meada/SKILL.md
 ```
 
-Comece pela instalação completa e escolha entre Cargo, binário, instalador, npm ou contêiner.
+Outros agentes: veja [Agentes e MCP](https://claudiomascaro.github.io/meada/mcp/#skill-para-agentes).
+
+## Status
+
+Meada 1.0 entrega todo o escopo da v1 do [ADR 0003](docs/adr/0003-v1-scope-and-roadmap.md):
+
+- **Contratos**: rotas HTTP, recursos declarados, documentos OpenAPI e AsyncAPI, filas e
+  tópicos, pacotes.
+- **Níveis**: um nível em cada ligação, cadeias que atravessam repositórios e decisões com
+  decisor opcional (`meada decide`).
+- **Análises**: drift de forma, comunidades e processos.
+- **Linguagens no 1.0**: nove, TypeScript, JavaScript, Python, Go, Rust, Java, Kotlin, C# e
+  Swift (#26 a #29, ADR 0003).
+
+**Promessa de estabilidade.** A partir do 1.0 vale o semver: uma mudança incompatível em um
+destes itens pede uma versão major.
+
+- os nomes, os parâmetros e a gramática de saída das ferramentas MCP (`search`, `context` e
+  `trace` hoje);
+- os comandos e as flags da CLI;
+- os esquemas do `meada.toml` e do `meada.decisions.toml`;
+- o formato do `meada export`.
 
-[Instalação](https://claudiomascaro.github.io/meada/installation/) · [GitHub releases](https://github.com/ClaudioMascaro/meada/releases)
+Acrescentar uma ferramenta MCP, um parâmetro opcional, um valor aceito a um parâmetro, um tipo de
+busca, um campo no fim de uma linha da saída, uma chave de configuração, um campo do export ou
+uma linguagem é mudança menor. Não entram na promessa o texto das mensagens da CLI, o
+texto das descrições das ferramentas, o arquivo de índice e o layout de `.meada/` (reconstruídos
+quando o esquema muda) e quais ligações o Meada encontra num código (melhorar a resolução é
+correção, não quebra). O detalhe do que é congelado e do que não é está em
+[Estabilidade](https://claudiomascaro.github.io/meada/stability/).
 
 ## Alimentar uma base de conhecimento
 
@@ -65,11 +179,14 @@ Meada (invariante 1, [ADR 0002](docs/adr/0002-product-invariants.md)).
 
 ## Documentação
 
+- [Guia do usuário](docs/user-guide.md)
 - [Configuração](https://claudiomascaro.github.io/meada/configuration/)
 - [Agentes e MCP](https://claudiomascaro.github.io/meada/mcp/)
 - [Modo servidor](https://claudiomascaro.github.io/meada/server/)
+- [Implantar com Docker, Compose ou Helm](https://claudiomascaro.github.io/meada/deploy/)
 - [Console](https://claudiomascaro.github.io/meada/console/)
 - [Capacidades e limites](https://claudiomascaro.github.io/meada/capabilities/)
+- [Estabilidade](https://claudiomascaro.github.io/meada/stability/)
 - [Participar](https://claudiomascaro.github.io/meada/contributing/)
 
 [Apache-2.0](LICENSE).

package/npm-shrinkwrap.json

@@ -19,7 +19,7 @@
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "name": "@meada/meada",
-      "version": "0.1.0"
+      "version": "1.1.0"
     },
     "node_modules/detect-libc": {
       "engines": {
@@ -48,5 +48,5 @@
     }
   },
   "requires": true,
-  "version": "0.1.0"
+  "version": "1.1.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "artifactDownloadUrls": [
-    "https://github.com/ClaudioMascaro/meada/releases/download/v0.1.0"
+    "https://github.com/ClaudioMascaro/meada/releases/download/v1.1.0"
   ],
   "bin": {
     "meada": "run-meada.js"
@@ -89,7 +89,7 @@
       "zipExt": ".tar.xz"
     }
   },
-  "version": "0.1.0",
+  "version": "1.1.0",
   "volta": {
     "node": "18.14.1",
     "npm": "9.5.0"