@meada/meada 1.0.0 → 1.1.0

package/CHANGELOG.md

@@ -6,6 +6,382 @@ All notable changes to Meada are recorded here. The format follows
 
 ## [Unreleased]
 
+## [1.1.0] - 2026-11-02
+
+A minor release on the [1.x stability promise](https://github.com/ClaudioMascaro/meada/blob/main/docs/site/en/stability.md):
+local accounts (ADR 0024) in the console, the proposal server and the nodes, carried by the
+`cloud` image, the Compose recipe and the Helm chart; the export's `format` and indexed commit;
+client-side deadlines on every Postgres call; durable pulled-generation writes; resolver fixes
+for C#, Kotlin, Rust and Swift (tier b3); and the fixes of tiers b1 and b2. The index schema
+version changes, so existing indexes are rebuilt once on first use. `meada-core` 1.1.0 adds `format`, `commit` and `dirty` to `Export`, and its
+`export::parse` refuses a document without `format`: re-export with 1.1.0 before parsing an export
+written by 1.0.0. The tree, the `meada-core` pin, the Dockerfile, the compose defaults and the
+Helm chart declare `1.1.0`, and the `v1.1.0` tag follows this entry's merge on main. Publication
+(crates, the staged npm package, the GitHub draft release) belongs to the maintainer.
+Release notes are available in
+[pt-BR](https://github.com/ClaudioMascaro/meada/blob/main/docs/releases/1.1.0.md),
+[English](https://github.com/ClaudioMascaro/meada/blob/main/docs/releases/1.1.0.en.md) and
+[Spanish](https://github.com/ClaudioMascaro/meada/blob/main/docs/releases/1.1.0.es.md).
+
+### Added
+
+- The export format and the indexed commit (#512, ADR 0004 "Canonical export"): every export
+  starts with `format` (`meada_core::export::FORMAT`, 1), which rises only when a reader of the
+  previous shape would misread the new one, never for an added optional field; then
+  `repository`, then `commit` and `dirty`, both optional and left out together. Locally `meada export` reads `HEAD` before and
+  after its refresh and the checkout's status after it (ignored files, `.meada/` among them, do
+  not count), and names the commit only when `HEAD` did not move and the index is fresh; outside
+  git or before the first commit both are left out. In server mode they come from the commit
+  `meada index --workspace` recorded beside the index, or a generation's `head`, never from the
+  mirror's live `HEAD`, with `dirty` false. For `meada-core` crate users: `Export` gains
+  `format`, `commit` and `dirty` (a minor change, the struct being `#[non_exhaustive]`, so the
+  next `meada-core` release is 1.1.0), and `export::parse` refuses a document without `format`,
+  naming the field, so an export written before this release no longer parses. Every `*.export.json` golden gained the three fields.
+
+- Named workspaces and the proposal server with local accounts (#562, ADR 0024, from #551):
+  `[catalog]` and `[workspaces]` (and so `[proposals]`) accept `[accounts.github]` in place of
+  `[oidc.github]` and still need one of the two (`[catalog] needs [oidc.github] or
+  [accounts.github]`; `[workspaces]` now names `[ui]` and `[catalog]`, the catalog naming the
+  provider). Eligibility reads the account's verified login, an operator account is the platform
+  administrator, and workspace operator lists, version authors, history and audit records name
+  `local:` subjects. `POST /api/v1/account/tokens` takes `{"surface": "proposals"}` when the
+  console's bootstrap has `[proposals]` (audience `meada:proposals`; a 422 `invalid_surface`
+  without it), `config` carries `"proposals": true` and the profile page offers the surface. The
+  proposal server with `[accounts]` and no `[oidc]` reads the public key at start and admits only
+  those tokens (a session token or a node's agent token is a 401 with `WWW-Authenticate: Bearer`,
+  no protected resource metadata), deriving the subject, login, groups, grant and role from the
+  token alone. No golden changed.
+- The verified GitHub login of local accounts (#561, ADR 0024, from #551): `[accounts.github]`
+  (`host`, `roles`, `max_age_seconds` as `[oidc.github]`, plus `api`, `https://api.github.com` by
+  default on `github.com` and required on any other host) is the GitHub grant provider of local
+  accounts. A person pastes a GitHub personal access token on their profile page or sends it to
+  `POST /api/v1/account/github`; the console calls `GET /user` on `api` once, keeps the lowercase
+  login and drops the token, and answers a fresh session token carrying the login. A login
+  another account holds is a 409 `login_taken`, GitHub's refusal a 422, GitHub out of reach a
+  503. `POST /api/v1/account/github/remove` and the accounts page's `remove_github` action remove
+  it. Session and agent tokens carry the verified login, so the GitHub grant joins the groups
+  grant in the console (`session` shows `login`, `github_host` and `github_grant`), on nodes, in
+  a team operator's additions (`added_by`), in the audit's `login` column and in the exclusions
+  marks; `meada github-app roles` reads `[accounts.github]`. Recorded `account.github` and
+  `account.remove_github`; the personal access token is never stored, logged or audited. No
+  golden changed.
+
+- Helm chart support for local accounts (#565, ADR 0024, from #551): `modules.accounts` renders
+  `[accounts]` from values, with `values-accounts.yaml` as the proof-of-concept shape (a writable
+  console with `operations = true`, Postgres and no identity provider). The Ed25519 private key
+  comes from its own Secret and is mounted only in the console's `console` container, the public
+  key from another Secret in the console and the nodes (a node also gets `[ui] public_url`, the
+  token issuer, and `[postgres]`), the initial admin password from an optional Secret in the
+  console. `modules.accounts.groups` and `modules.accounts.github` carry `[accounts.groups]` and
+  `[accounts.github]` (the refresh job, with `modules.githubApp`, gets the GitHub grant provider and runs the role check, and
+  `modules.workspaces` accepts it in place of `modules.oidc.github`); `modules.accounts.breakGlass`
+  keeps `[accounts]` in the console alone beside `modules.oidc`. The chart refuses a missing
+  Postgres or console, equal key Secrets, accounts beside OIDC without break glass, and groups or
+  GitHub under break glass. `scripts/helm-check` covers the sections, the mounts and the refusals;
+  the chart READMEs (pt-BR, English, Spanish) no longer say a writable console needs OIDC. The
+  proposal server is not part of the chart. `[accounts.github]` renders as the spec names it and
+  is parsed once #561 lands. No golden changed.
+
+- One-command proof of concept in the Compose recipe (#564, ADR 0024, from #551):
+  `cp .env.accounts.example .env && docker compose up -d` starts the generations fleet, Valkey,
+  the store, Postgres with its migration, a writable console with local accounts and nodes that
+  admit agent tokens. `compose.accounts.yaml` adds the Ed25519 key pair (made once by the
+  `certificates` step, never printed, the private key mounted read-only in the console alone and
+  the public one in the nodes), the console's and the nodes' `[accounts]` manifests, a one-shot
+  `seed` of the first workspace version (only while the store has none) and a node proxy that
+  forwards `Authorization` with no static bearer. The other profiles are unchanged, and
+  `scripts/compose-check` covers the new one. The Compose README (pt, en, es) starts with it and
+  covers `MEADA_ADMIN_PASSWORD`, `meada ui reset-admin`, key rotation and rate limiting the
+  sign-in route at the proxy.
+
+- Agent tokens for the nodes (#560, ADR 0024, from #551): a signed-in local account generates,
+  on its profile page or through `POST /api/v1/account/tokens` (`{surface: "nodes", hours}`, 1 to
+  168 hours, 8 by default), an agent token shown once (`{token, expires_at, surface}`), signed
+  with the account's role and groups as its row stands and a random token id, recorded
+  `account.token` (surface, hours, token id, never the token). A change-required account gets the
+  403 `password_change_required`, a suspended one the role refusal; the console answers an agent
+  token with 401. A node with `[accounts]` and no `[oidc]` (`meada mcp --listen`) now reads the
+  signing public key at start, and the console's `[ui] public_url` from a `[ui]` section its
+  manifest must carry, refusing to start without either; it admits only agent tokens for the
+  nodes (a 401 `Bearer` before routing for any other, a session token included) and answers
+  under the grant `[accounts.groups]` gives their groups (every repository without the table),
+  as an identity provider's token is answered. The `accounts` feature now implies `ui`. No golden
+  changed.
+
+- Accounts page in the console (#559, ADR 0024, from #551): the global operator of a console with
+  local accounts gets `/accounts`, listing every account (role, groups, state with a suspended
+  account marked and a locked one saying until when, change required, last password change), a
+  create form (username pattern and password length checked first, "change on first sign-in"
+  checked by default) and, per account, role, groups, suspend, reactivate and reset password,
+  each behind the shared confirmation dialog with the server's refusals (`last_operator` and the
+  rest) shown unchanged. Any other role, and a console under break glass, gets the not-found
+  page at that path. The audit page names every `account.*` action in Portuguese and English.
+  The password rule `common_password` now has its own copy. Front end only, no golden changed.
+
+- Groups of local accounts (#558, ADR 0024, from #551): the global operator gives accounts groups
+  (`groups` on `POST /api/v1/accounts`, and the `groups` action of
+  `POST /api/v1/accounts/<username>`, each an owner name, else a 422 `invalid_group`);
+  `GET /api/v1/accounts` lists them, and each change is recorded `account.groups`.
+  `[accounts.groups]` maps groups to identities as `[oidc.groups]` does: once it exists, a local
+  session's grant is what its groups map to, and it bounds every view (the manifest, the
+  workspace and its versions, the store, the repositories, the credentials, the playground, the
+  exports and the graph views) as an identity provider's grant does; without it every local
+  account still reads every repository. A local viewer whose group owns an entry of the current
+  workspace version its grant reads is a team operator (ADR 0015). Session tokens carry the
+  groups, so a change reaches reads at the next sign-in and writes at once (the account row is
+  read before each). `GET /api/v1/admission` with `[accounts]` now answers: `accounts` (the mode,
+  `accounts` or `break_glass`, and the signing public key's fingerprint, `blake3:` and the hex
+  BLAKE3 hash of the raw Ed25519 key) and, without `[oidc]`, the groups table bounded by the
+  caller's grant. No golden changed.
+
+- Account administration for local accounts (#557, ADR 0024, from #551): the global operator
+  lists every account (`GET /api/v1/accounts`: username, role, state, the end of a lock, change
+  required, last password change, created and created by, never a hash), creates one
+  (`POST /api/v1/accounts`, `{username, role, password, change_required}`, the policy applied to
+  the temporary password, a change required unless the body turns it off; a malformed username a
+  422 `invalid_username`, a taken one a 409 `username_taken`) and changes one
+  (`POST /api/v1/accounts/<username>`, one `action`: `role`, `suspend`, `reactivate` or
+  `reset_password`, which clears a lock and requires a change unless told not to; an unknown
+  account a 404). Suspending or demoting the last active operator is a 409 `last_operator`,
+  decided under the schema's advisory lock so two requests at once never leave none. Anyone else
+  gets a 403. The routes answer whatever `[ui] operations` says; workspace and generation writes
+  keep requiring it. Every console write of a local account now reads the account's row first,
+  so a suspended or demoted account loses its writes at once, while its reads last until its
+  token expires. Audit actions `account.create`, `account.role`, `account.suspend`,
+  `account.reactivate` and `account.reset_password` name the account and the fields changed,
+  never a password, written before the change (503 `audit_unavailable` otherwise); `account` is
+  the route-level action of a change refused before its body is read. No route deletes or
+  renames an account; under `[accounts] break_glass` (#563) none of these routes exists, each a
+  404. No golden changed.
+
+- Break-glass account beside the identity provider (#563, ADR 0024, from #551): `[accounts]
+  break_glass = true` lets the section sit beside `[oidc]`; without `[oidc]` it is an error, and
+  `[accounts.groups]` or `[accounts.github]` under it is an error naming the table. The console
+  then signs in only the default account (any other username gets the wrong password's 401,
+  audited `not_break_glass`, the table never read) as the global operator, and admits its session
+  token beside the identity provider's, each bearer routed by its issuer to one verifier, so the
+  identity provider's keys never check a console token and the signing key never checks an
+  identity provider's; a console whose `[oidc] issuer` is its own `public_url` refuses to start.
+  The password change works; no other route of local accounts exists. Nodes and the proposal
+  server keep admitting only the identity provider and read no key. `config` adds `break_glass:
+  true`, and the front end offers a discreet break-glass sign-in (`/break-glass`) beside the
+  identity provider's, which now waits for a click under break glass. No golden changed.
+
+- Hardening of local sign-in (#555, ADR 0024, from #551): the password policy refuses an embedded
+  common-password list (SecLists, MIT, the entries of 12 to 128 characters, compared ignoring
+  case; rule `common_password`). Ten consecutive failed password checks, at sign-in or as a
+  password change's current password, lock an account for fifteen minutes, counted in a
+  transaction holding the account row so parallel attempts never pass ten; a success resets the
+  count. A locked account gets the wrong password's 401 at a hash's cost, its password unchecked
+  and its lock never extended, audited `locked_now` and then `locked`. A stored hash weaker than
+  the console's parameters is redone at the next successful sign-in. `meada ui reset-admin
+  --workspace <manifest>` (features `ui` and `accounts`) creates or reactivates `admin` as an
+  operator, clears its lock and sets the `MEADA_ADMIN_PASSWORD` value or a generated password
+  printed once on stdout, with a change required, recorded `account.reset_admin` `via` `cli`
+  before the write and refusing with exit 1 when the record cannot be written. No golden changed.
+
+- Local sign-in for the console (#554, ADR 0024, from #551): the new `accounts` cargo feature
+  (enabled by `cloud`) and its `[accounts]` section, which needs `[postgres]` and never sits
+  beside `[oidc]`, name the Ed25519 signing key pair and the default account's initial password,
+  each from a variable or a file. Migration 9 adds the `accounts` table, so `meada postgres
+  migrate` reaches version 9. On its start the console checks the key pair and creates the
+  default account `admin` (password `admin123` with a change required, or the policy-checked
+  `MEADA_ADMIN_PASSWORD` without) once, under an advisory lock. `POST /api/v1/login` answers a
+  session token the console signs with EdDSA for eight hours; a token carrying the change-required
+  mark opens only `POST /api/v1/account/password`. Every route but the static files, `config` and
+  `login` then needs a session token; `[ui] operations = true` is accepted with `[accounts]` and
+  no `[oidc]`; `config` names the sign-in mode (`sign_in`: `accounts`, or `oidc` with an identity
+  provider), `session` adds `account: true`, and
+  every account reads every repository while no groups table bounds it. Passwords are argon2id at
+  OWASP's parameters under a policy of 12 to 128 characters that refuses the default password and
+  the username, at most four hashes run at once, and every sign-in, refusal and password change
+  is audited (`account.login`, `account.password`, role `none` for an unknown username) before its
+  token. The module table gains `accounts`; no golden changed.
+
+- The console's sign-in pages for local accounts (#556, from #551): when `config` says
+  `"sign_in": "accounts"` the console shows its own sign-in page (labelled username and password,
+  one generic refusal, `busy` and `audit_unavailable` shown as themselves) instead of the identity
+  provider's redirect. A change-required sign-in goes straight to a forced password change page
+  (the current password and the new one twice, the server's rule shown on a refusal) that offers
+  nothing to navigate to until it succeeds, and then opens the workspace. The session token lives
+  in `sessionStorage` for the tab's life, is sent as the bearer and is cleared on sign-out and on
+  any 401 (which returns to sign-in; a refused current password in the change is not one); it is never in `localStorage`, a URL
+  or a log. A profile page offers the voluntary password change and sign-out. pt-BR and English
+  copy; the identity provider flow is unchanged. Front end only: no golden changed.
+
+- `meada status` names a Kotlin file the grammar misreads (#546, from #434). A declaration read
+  as an infix call leaves the file out of the index; the file now sets the new `Facts::misparsed`
+  (absent from every other file's stored facts) instead of `unbuilt`, and a new status line,
+  `Msg::FileMisparsed`, in English and Portuguese, names it beside the byte-budget and using
+  drops. The Java and Kotlin layout skips it as it skips the other drops. The schema version is
+  the same: a file dropped before the upgrade gets its line when it next changes, or at once
+  after deleting `.meada/index.db`. The `cli.status-budget` goldens gained the new line.
+
+### Changed
+
+- The grant providers take neutral inputs (#553, from #551): the new `grant` module computes a
+  subject's grant from its groups and its GitHub login (`Providers::grant`), with no reference
+  to a token, and holds the GitHub grant provider's permissions cache, which moved out of the
+  OIDC module; the OIDC module feeds it from a token's claims. Every reader of `[oidc.github]`
+  goes through `Manifest::github`, the console and the proposal server build their sessions
+  from a neutral admitted subject (`grant::Admitted`), and a node's pass carries only a grant.
+  Nothing a caller sees changes; no golden changed.
+
+- The axum provider reader walks each value once per file (#431): the values a file's rebound
+  `let`s reach share one `seen` set, and `Code::origins` is not asked for a call whose builder
+  chain goes through a method no router hands back, nor for a name written as text, a path, a
+  number, a boolean or a character. The reader's share of a one-file refresh on this repository
+  drops from about 1.4 s to about 0.1 s. No golden changed.
+
+### Fixed
+
+- Swift: a call whose labels differ from a known outside member's resolves as if that base
+  were absent (#463): `x.hash(seed: 1)` on a type that conforms to `Hashable` and declares
+  `hash(seed:)` is `exact`, while `x.hash(into: &h)` stays opaque. A call with no labels, or in
+  another language, is still compared by its bare name.
+- Swift: an alias of an outside type reaches the repository's extensions of that type (#440). A
+  receiver typed by `typealias Anim = Animation`, or by an alias of an alias, and `Anim.build()`
+  match `extension Animation { }` as `Animation` does; an alias of an outside type with no
+  extension stays unresolved.
+- Rust: a call after `?` or `.await` is typed by the value they unwrap (#435, after #401): the
+  pack keeps beside a function's written result the first type argument of a `Result` or
+  `Option` (`Def::unwrapped`) and the `Output = T` of `impl Future<Output = T>` and
+  `Pin<Box<dyn Future<Output = T>>>` (`Def::output`, read only through `.await`), so
+  `load()?.port()` and `fut().await.port()` resolve within `T`'s family, `exact` when it
+  declares one `port`, where `?` left a name match and a plain `fn` returning a future resolved
+  to nothing. A type outside the repository, or a `?` before an `.await`, leaves the call as
+  it was. The stored facts gain
+  `Def::unwrapped`, `Def::output`, `Call::unwraps` and `Call::awaits`, so the schema version
+  changes and Rust indexes are rebuilt once.
+- Kotlin: a class, object or interface nested in an `expect` declaration, at any depth, is
+  `expect` too (#437), so a use of it resolves to the `expect` one instead of staying
+  `ambiguous` among its `actual` declarations.
+- C# `using static T` imports only the static members and nested types `T` declares (#433): a bare
+  `Go()` with `Go` on a base of `T` was an `exact` link to the base's method, which C# rejects
+  ("inherited members aren't imported"), and is now a name match at best; `using static` of the
+  base itself still gives it. Java's `import static` and Kotlin keep reading inherited members.
+- Kotlin: a bare call resolves in Kotlin's order, an extension of the implicit receiver in scope
+  before a top-level function of its name (#436, from #402): inside `fun CoroutineScope.x() {
+  launch { } }` the call is `exact` to `CoroutineScope.launch`, not to the top-level `launch`
+  (`ambiguous` with it when the extension may apply to any receiver), and an `object`'s name is
+  its instance, so `Dispatchers.setMain(..)` reaches an imported `fun Dispatchers.setMain` (it
+  was no link) while a class's name keeps companion and statics. "Known ceilings" drops the
+  bare-call line. No golden changed.
+- C#: an `internal`, `private` or `private protected` constructor or method of a public type is
+  a candidate from its own project's files alone (#441); `InternalsVisibleTo` stays unread.
+- The console writes one `ui: directory: unreadable` stderr line per request when the directory
+  cannot be read (#451, after #335): the request's session remembers the failure at admission,
+  so the flags, the admission counts and the owner picker take that answer and write no second
+  line (`workspace` wrote two), and a write it refuses as 503 `audit_unavailable` prints no
+  pre-authentication audit line beside it. Reads still answer with the flags unavailable, the
+  counts null and the picker a 503; writes still refuse as before. No golden changed.
+- Postgres calls that had no client-side deadline now have one (#447): a SCIM request (under the
+  directory's one write lock), the role check's fence read and write transaction, and the
+  console's start check, so a Postgres that accepts the connection and stops answering ends in a
+  503, an exit 1 with no exclusions file a reader admits, and a console that starts, instead of
+  holding them forever. `postgres::Config::bound(n)` now adds the version check's two statements
+  itself and every call site counts only its own (the audit and directory reads and the overage
+  lookup moved accordingly; the accounts' calls, which undercounted, and the permissions poll
+  gained the two). No golden changed.
+- A crash after the pointer swap can no longer leave `current` naming a version document that
+  never reached the disk (#518): the pointer, the version document `meada workspace pull` writes,
+  the pulled contexts file and the exclusions file are replaced through one helper
+  (`pull::replace`) that syncs the new file before the rename and removes `<name>.new` when a
+  step fails. A failed pointer rename now names `current`, not `current.new`.
+- The docs say what 1.0.0 ships: nine languages (TypeScript, JavaScript, Python, Go, Rust, Java,
+  Kotlin, C# and Swift). The three READMEs, the three 1.0.0 release notes and the three user
+  guides no longer call Java, Kotlin, C# and Swift later 1.x work, the user guides gain a section
+  for each of the four (9.5 to 9.8) with their brokers (JMS, Azure Service Bus) and package
+  ecosystems (Maven and Gradle, NuGet, SwiftPM), and ADR 0003 records the change in an
+  amendment. No code, default dependency or golden changed.
+- A server-mode mirror's `meada.toml` and `meada.decisions.toml` are read through no symbolic
+  link (#547, after #506), as a pulled generation's are: `mirror()`, behind `Manifest::read`
+  (`mcp --listen`, snapshot pull, the lock and pointer operations, workspace versions, the
+  heartbeat, the UI, the workspaces CLI, the GitHub App), now refuses a link unopened, one that
+  stays inside the mirror included, a file that is not regular and a file replaced while read,
+  with the generation's messages, and bounds each file at 1 MiB (`GENERATION_CONFIG_MAX`, now
+  built without the `snapshot` feature). A local checkout and an operator's own files still
+  follow links. The architecture map and the snapshots page, in its three languages, say so.
+- No manifest error quotes a written value (#545), after #449 stopped serde's `invalid type` and
+  `invalid value`: `unknown variant` names the key and the values it accepts (`` `workspace.source`:
+  is not one of the values it accepts (`file`, `store`) ``) instead of serde's text, an error no
+  key spans reads "a value is not valid here" instead of serde's message, and the rule errors
+  for `serve.prefix`, `serve.strip`, `serve.documents` and a resource's `kind` name the key and
+  the rule (`` `serve.strip`: must start with `/` ``) instead of the value. The console's cut of
+  an error to its position stays as a second guard (it still covers an error built outside
+  `describe` that names an identity). English and pt-BR texts changed; the workspace validation
+  fixture changed only by the new texts.
+- The deploy fetch reads a `[[repository]]` entry by its own keys (#544): any table header ends
+  the entry before it, so a `[[repository.peer]]` or `[[repository.resource]]` table no longer
+  replaces its `repo` or `path`, and a value is the text between its quotes, so a trailing
+  comment is not part of it. Before, such a version stopped the Compose refresh and let the chart
+  clone the peer's repository into the entry's path (or into a directory named after the
+  comment). `fetch-pulled.sh` and the chart's `workspace.fetch` carry one awk program, and a
+  test fails when the two copies drift. No golden changed.
+- A repository identity on the `[oidc.github]` host compares without case wherever it meets the
+  catalog (#508): the roles job gives a selected `github.com/Acme/API` and the catalog's
+  `github.com/acme/api` one `both` row keyed as written, the `max_repositories` cap does not
+  count it as extra, and the console's catalog check and listing match it. A repository selected
+  in two spellings (a deployment's `github.com/Acme/API`, a named workspace's
+  `github.com/acme/api`) keeps one `source` row under the first and gets its role rows under
+  each, so grants, which match exactly, read both. Other hosts compare exactly. No golden
+  changed.
+- Compose mirror origins (#445): `fetch.sh` and `fetch-pulled.sh` read an existing mirror's
+  `origin` before fetching and refuse one whose HTTP(S) URL carries credentials (a mirror cloned
+  from a URL with a token keeps it there), naming the identity and never the URL, and the refresh
+  stops before index and publish as a failed fetch does. The READMEs tell the operator to run
+  `git remote set-url origin <URL without credentials>` in such a mirror.
+- Java and Kotlin: a file with thousands of fields and locals is read in linear time (#442, from
+  #424). The hides check indexes the fields by name instead of scanning every field per local,
+  the class around a write is found from the prefixes of its scope, and `declared_before` (and
+  Kotlin's `assigned`) read a node's parent from an index built once per file, since
+  `Node::parent()` is found from the root and made a deep file quadratic per write. Same answers;
+  no golden changed.
+- Indexing: a file a pack drops for passing a limit is named by `meada status` (#434, from
+  #419). The Java, Kotlin and Swift qualified-name budget (4 MiB) now sets `Facts::budget`, as the
+  C# one does, instead of `unbuilt`, which prints nothing; a C# project that gives its files more
+  than 256 usings (`PROJECT_USINGS`) marks each of them with the new `Facts::usings`, which a new
+  status line names (`Msg::FileTooManyUsings`, with the count). Kotlin's `misparsed` file stayed
+  `unbuilt` (a grammar defect, not a limit; #546 names it too). An index built before this change keeps a Java,
+  Kotlin or Swift file dropped by its budget as `unbuilt` until the file changes. No limit
+  changed. The `cli.status-budget` goldens gained the new cases; no stored format golden changed
+  (the new field is absent from every sample), so the schema version is the same.
+- Resolution: the receiver and call depth (`RECEIVER_DEPTH`) is one count for the whole lookup
+  (#432, from #417), carried through a glob, an alias or an on-demand import as the link count is,
+  so a chain that alternates receivers and imports costs its length, not `RECEIVER_DEPTH` per link
+  up to `LINK_DEPTH`. No limit changed and no answer under the limits; no golden changed.
+- Helm: the default `workspace.fetch` (#444, from #316) reads the repositories from `$1` when
+  given (the pulled list under `modules.oidc.github`) else from `workspace.repositories`, now
+  mounted as `repositories.toml` so a store-sourced refresh, whose bootstrap lists none, still
+  fetches the operator's list, refuses a URL carrying a credential and, as the compose
+  scripts do (#445), an existing mirror whose `origin` carries one, keeps each mirror strictly
+  under `/data/mirrors`, and on failure prints `refresh: fetch failed for <identity>; the refresh
+  stops before publication` and exits nonzero without echoing a URL or token.
+  `scripts/helm-check` runs the rendered script under `sh` with a stub `git` to check these; the
+  chart READMEs describe it.
+- Workspace import (#450): `meada workspace import` reads its file once, bounded by the version
+  size limit, and audits the id of the text it stored; a file past the bound or not a regular
+  file is refused before any audit record is written.
+- Manifest type errors (#449): a `meada.toml` or workspace manifest key of the wrong type, or
+  with an invalid value, reports the key and the expected kind (`` `oidc.entra`: has the wrong
+  type (a table was expected) ``) instead of serde's message, which echoed the written value, so a
+  secret pasted under the wrong key no longer reaches stderr.
+- Pulled generations (#506): a mirror's `meada.toml` or `meada.decisions.toml` that is a symbolic
+  link is refused unopened, the error naming the file, so a repository can no longer make a node
+  read and parse a file of the host. A link into the mirror (`meada.toml -> conf/meada.toml`) is
+  refused too, as the index refuses a linked pack config. The file opened is checked to be the one
+  checked. Secrets and CAs a manifest names still follow links (Kubernetes mounts them through
+  one). The snapshots page says so in its three languages.
+- Named workspaces on a node (#510): a node shows a named workspace's route
+  (`/-/workspaces/<id>/<identity>`, pinned or not) and lists it in a 404 only to a token whose
+  grant reads every entry of the workspace's version, the entries the sponsor rule excluded
+  included, as the console does. Before, once A of a Y+A workspace lost its sponsor, a subject
+  reading Y alone found the workspace on a node. A generation's context now records `excluded`,
+  the identities the sponsor rule left out, sorted, and its digest covers them; a context without
+  one is written as before, with the same generation id, and a generation published earlier reads
+  as none excluded. A node on an older binary refuses a generation that records an exclusion, so
+  upgrade nodes before or with the publisher. No golden changed.
+
 ## [1.0.0] - 2026-10-30
 
 The tree declares `1.0.0`: this release raises the workspace, the `meada-core` pin, the Dockerfile,
@@ -704,6 +1080,7 @@ and `trace` from the two longest processes. The spec adds about 0.3 MB and 0.03
 The rise of the single-file reindex since 2026-10-14 predates it (specs #22 and #23), and at
 692 files it is close to its target.
 
-[Unreleased]: https://github.com/ClaudioMascaro/meada/compare/v1.0.0...HEAD
+[Unreleased]: https://github.com/ClaudioMascaro/meada/compare/v1.1.0...HEAD
+[1.1.0]: https://github.com/ClaudioMascaro/meada/releases/tag/v1.1.0
 [1.0.0]: https://github.com/ClaudioMascaro/meada/releases/tag/v1.0.0
 [0.1.0]: https://github.com/ClaudioMascaro/meada/releases/tag/v0.1.0

package/README.md

@@ -18,7 +18,7 @@ Escolha a linha que combina com o que você já tem. Todos os canais entregam o
 | Rust | `cargo install meada` | `meada mcp` |
 | Linux ou macOS | o instalador de shell abaixo | `meada mcp` |
 | Qualquer sistema | o arquivo do seu sistema nas [releases do GitHub](https://github.com/ClaudioMascaro/meada/releases), com `meada` no `PATH` | `meada mcp` |
-| Docker | `docker pull ghcr.io/claudiomascaro/meada:1.0.0` | a linha `docker run` em [Conectar um agente](#conectar-um-agente-mcp) |
+| Docker | `docker pull ghcr.io/claudiomascaro/meada:1.1.0` | a linha `docker run` em [Conectar um agente](#conectar-um-agente-mcp) |
 
 ```sh
 # Instalador de shell (Linux e macOS)
@@ -75,7 +75,7 @@ Com Docker (Linux e macOS):
   "mcpServers": {
     "meada": {
       "command": "sh",
-      "args": ["-c", "exec docker run -i --rm --network none --user \"$(id -u):$(id -g)\" -v \"${PWD%/*}:${PWD%/*}\" -w \"$PWD\" ghcr.io/claudiomascaro/meada:1.0.0 mcp"]
+      "args": ["-c", "exec docker run -i --rm --network none --user \"$(id -u):$(id -g)\" -v \"${PWD%/*}:${PWD%/*}\" -w \"$PWD\" ghcr.io/claudiomascaro/meada:1.1.0 mcp"]
     }
   }
 }
@@ -97,7 +97,7 @@ ler os níveis de uma resposta. No Claude Code:
 
 ```sh
 mkdir -p ~/.claude/skills/meada
-curl -fsSL https://raw.githubusercontent.com/ClaudioMascaro/meada/v1.0.0/skills/meada/SKILL.md -o ~/.claude/skills/meada/SKILL.md
+curl -fsSL https://raw.githubusercontent.com/ClaudioMascaro/meada/v1.1.0/skills/meada/SKILL.md -o ~/.claude/skills/meada/SKILL.md
 ```
 
 Outros agentes: veja [Agentes e MCP](https://claudiomascaro.github.io/meada/mcp/#skill-para-agentes).
@@ -111,8 +111,8 @@ Meada 1.0 entrega todo o escopo da v1 do [ADR 0003](docs/adr/0003-v1-scope-and-r
 - **Níveis**: um nível em cada ligação, cadeias que atravessam repositórios e decisões com
   decisor opcional (`meada decide`).
 - **Análises**: drift de forma, comunidades e processos.
-- **Linguagens no 1.0**: TypeScript e JavaScript, Python, Go e Rust. Java, Kotlin, C# e Swift
-  são trabalho planejado da Release 2 e chegam depois como versões 1.x (#26 a #29, ADR 0003).
+- **Linguagens no 1.0**: nove, TypeScript, JavaScript, Python, Go, Rust, Java, Kotlin, C# e
+  Swift (#26 a #29, ADR 0003).
 
 **Promessa de estabilidade.** A partir do 1.0 vale o semver: uma mudança incompatível em um
 destes itens pede uma versão major.

package/npm-shrinkwrap.json

@@ -19,7 +19,7 @@
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "name": "@meada/meada",
-      "version": "1.0.0"
+      "version": "1.1.0"
     },
     "node_modules/detect-libc": {
       "engines": {
@@ -48,5 +48,5 @@
     }
   },
   "requires": true,
-  "version": "1.0.0"
+  "version": "1.1.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "artifactDownloadUrls": [
-    "https://github.com/ClaudioMascaro/meada/releases/download/v1.0.0"
+    "https://github.com/ClaudioMascaro/meada/releases/download/v1.1.0"
   ],
   "bin": {
     "meada": "run-meada.js"
@@ -89,7 +89,7 @@
       "zipExt": ".tar.xz"
     }
   },
-  "version": "1.0.0",
+  "version": "1.1.0",
   "volta": {
     "node": "18.14.1",
     "npm": "9.5.0"