ai-capability-framework 1.0.0-rc.5 → 1.0.1

package/CHANGELOG.md

@@ -4,8 +4,17 @@ All notable public changes to AI Capability Framework are documented here.
 
 ## Unreleased
 
-- Prepared the `1.0.0-rc.5` release candidate and made `@aicf/agent-skills` a
-  first-class same-version npm artifact in certification, CI, release dry-run, and
+## 1.0.1 - 2026-07-27
+
+- Updated the resolved `fast-uri` dependency to `3.1.4` to address the high-severity URI
+  host-confusion advisories reported by the scheduled security audit.
+- Kept `ai-capability-framework`, `@aicf/agent-skills`, and Codex plugin metadata
+  aligned under the coordinated `1.0.1` patch release.
+
+## 1.0.0 - 2026-06-09
+
+- Prepared the `1.0.0` stable release and made `@aicf/agent-skills` a first-class
+  same-version npm artifact in certification, CI, release dry-run, and
   trusted-publishing workflows.
 - Added the final v1.0 certification gate with `check:public`, `check:certification`,
   public certification docs, workflow hardening, and release-readiness assertions for

package/README.md

@@ -272,15 +272,14 @@ npm run skills:check
 npm run skills:pack:dry
 npm pack
 npm run release:preflight:npm
-npm publish --dry-run --access public --tag next
-npm publish ./agent-skills --dry-run --access public --tag next
+npm run release:publish:dry
 npm run archive:source
 npm run check:source-archive
 ```
 
 Release tags publish two npm artifacts from the same commit and version:
-`ai-capability-framework` and `@aicf/agent-skills`. For example, package version
-`1.0.0-rc.5` uses tag `v1.0.0-rc.5` and the `next` dist tag for both packages.
+`ai-capability-framework` and `@aicf/agent-skills`. For example, package version `1.0.0`
+uses tag `v1.0.0` and the `latest` dist tag for both packages.
 
 Use `npm pack` for npm package review and `npm run archive:source` for public source
 review. Do not zip the working directory manually; raw workspace archives can include

package/docs/public/npm-release-preflight.md

@@ -11,7 +11,7 @@ boundary and makes the release operator verify ownership and publishing setup.
 | `@aicf/agent-skills`      | `@aicf` npm scope       | public | Published from the same release tag and version, before the root package. |
 
 Both packages must use the same version. Release tags must match that version exactly:
-package version `1.0.0-rc.5` uses tag `v1.0.0-rc.5`.
+package version `1.0.0` uses tag `v1.0.0`.
 
 ## Ownership
 
@@ -29,7 +29,7 @@ trusted publishing setup must exist before the tag is pushed.
 
 ## Dist Tags
 
-- Prerelease versions with a hyphen, such as `1.0.0-rc.5`, publish with `next`.
+- Prerelease versions with a hyphen, such as `1.0.0-rc.6`, publish with `next`.
 - Stable versions, such as `1.0.0`, publish with `latest`.
 - Do not move `latest` to a prerelease intentionally. If a prerelease lands on `latest`,
   fix the dist tags before announcing the release.
@@ -41,6 +41,11 @@ tokens, one-time passwords, local `.npmrc` auth lines, or long-lived release
 credentials. The publish workflow must keep `id-token: write` and publish only from `v*`
 tags that point at `origin/main`.
 
+AICF uses npm Trusted Publishing / GitHub OIDC for both public packages:
+
+- `ai-capability-framework`
+- `@aicf/agent-skills`
+
 ## Preflight Commands
 
 See [Final Certification Matrix](../public-framework/final-certification-matrix.md) for
@@ -52,6 +57,10 @@ Run the final matrix and local metadata/registry preflight:
 npm run check:final-matrix
 ```
 
+```bash
+npm run check:release-tag
+```
+
 ```bash
 npm run release:preflight:npm
 ```

package/docs/public-framework/final-certification-matrix.md

@@ -36,6 +36,7 @@ npm run check:release-install
 npm run check:metadata
 npm run check:licenses
 npm run check:final-matrix
+npm run check:release-tag
 npm run skills:check
 npm run check:certification
 ```
@@ -87,7 +88,7 @@ both package dry-runs with public access:
 npm run release:publish:dry
 ```
 
-Prereleases such as `1.0.0-rc.5` use `next`. Stable releases use `latest`. This command
+Prereleases such as `1.0.0-rc.6` use `next`. Stable releases use `latest`. This command
 does not publish.
 
 ## Manual Acceptance
@@ -96,3 +97,8 @@ Before stable v1, maintainers should also review README positioning, MIT license
 consistency, provider-neutral onboarding, at least one non-OpenAI quickstart, agent
 skills install docs, npm ownership, trusted publishing, source archive contents, opt-in
 live test boundaries, and root import optional-dependency isolation.
+
+- GitHub repository About/description says AICF is a provider-agnostic governed AI
+  capability framework.
+- GitHub topics include at least: ai, agents, tool-calling, evals, governance,
+  model-context-protocol, langchain, gemini, anthropic, openai, typescript.

package/docs/public-framework/release-process.md

@@ -22,6 +22,7 @@ npm run check:certification
 npm run check:final-matrix
 npm run check:metadata
 npm run check:licenses
+npm run check:release-tag
 npm run check:release-install
 npm run skills:ci
 npm run skills:check
@@ -29,10 +30,13 @@ npm run skills:pack:dry
 npm run release:preflight:npm
 npm run release:publish:dry
 npm pack --dry-run --json
-npm publish --dry-run --access public --tag next
-npm publish ./agent-skills --dry-run --access public --tag next
 ```
 
+`npm run release:publish:dry` runs package publish dry-runs while the target version is
+unpublished. After both public packages at the current version are already on npm, it
+exits successfully with a skip message. A partial state, where only one package version
+is published, remains a failure and must be handled with the documented recovery path.
+
 Use `npm pack` for npm artifact review and `npm run archive:source` for source review.
 Do not zip the working directory manually.
 
@@ -40,6 +44,10 @@ Use [Final Certification Matrix](final-certification-matrix.md) to confirm the l
 command set, workflows, package contents, source archive rule, and publish dry-run
 commands are still aligned.
 
+The Release Dry Run workflow is a manual release-review workflow. Run it from GitHub
+Actions when preparing a release candidate or stable tag; ordinary `main` pushes rely on
+CI, validation, docs, and security workflows instead.
+
 AICF uses MIT for the v1 public release. The root package, `@aicf/agent-skills`, the
 Codex plugin manifest, skill metadata, README, and release docs must agree; see
 [License Decision](license-decision.md).

package/docs/public-framework/v1-certification.md

@@ -66,6 +66,12 @@ Run the local publish dry-run wrapper before a release tag:
 npm run release:publish:dry
 ```
 
+Run the release tag alignment guard before tagging or reviewing publish workflows:
+
+```bash
+npm run check:release-tag
+```
+
 For final manual release review, run
 `node scripts/check-npm-release-preflight.mjs --strict` after npm ownership and trusted
 publishing are configured.
@@ -118,6 +124,10 @@ Before a public v1.0 tag, manually inspect:
 - `@aicf/agent-skills` package contents.
 - README quickstart from a fresh machine or clean container.
 - fresh-machine quickstart using the public npm package or a clean checkout.
+- GitHub repository About/description says AICF is a provider-agnostic governed AI
+  capability framework.
+- GitHub topics include at least: ai, agents, tool-calling, evals, governance,
+  model-context-protocol, langchain, gemini, anthropic, openai, typescript.
 - examples with fake data.
 - generated API docs.
 - governance/lifecycle docs.

package/docs/release.md

@@ -1,7 +1,6 @@
 # Release Checklist
 
-This checklist prepares an AICF 1.0 release candidate for GitHub and public npm
-distribution.
+This checklist prepares an AICF public release for GitHub and npm distribution.
 
 ## Preflight
 
@@ -66,6 +65,7 @@ npm run skills:check
 npm run skills:pack:dry
 npm run check:metadata
 npm run check:licenses
+npm run check:release-tag
 npm run check:final-matrix
 npm run check:release
 npm run check:release:providers
@@ -95,11 +95,17 @@ npm test -- openai-agents
 npm pack --dry-run --json
 npm run release:preflight:npm
 npm run release:publish:dry
-npm publish --dry-run --access public --tag next
-npm publish ./agent-skills --dry-run --access public --tag next
 npm pack
 ```
 
+`npm run release:publish:dry` wraps `npm publish --dry-run` for the root package and for
+`@aicf/agent-skills` with the computed `next` or `latest` dist tag.
+
+If both package versions are already published, the command exits successfully and
+reports that publish dry-runs were skipped. That keeps post-release `main` checks from
+failing on npm's immutable-version rule. If only one package version is published, the
+command fails and the partial publish recovery steps below apply.
+
 Then inspect:
 
 ```bash
@@ -196,15 +202,21 @@ and examples should be present at `docs/index.md`, `docs/getting-started/`,
 - `.github/workflows/ci.yml` runs root and agent-skills installs, generated-type
   freshness, build, typecheck, repository lint, tests, validation, conformance,
   governance gate, package checks, agent-skills checks, and docs build.
-- `.github/workflows/release-dry-run.yml` runs the full release gate, package dry-run,
-  source archive creation/checking, final certification, root npm publish dry-run, and
-  agent-skills npm publish dry-run.
+- `.github/workflows/release-dry-run.yml` is a manual release-review gate. It runs the
+  full release gate, package dry-run, source archive creation/checking, final
+  certification, root npm publish dry-run, and agent-skills npm publish dry-run when a
+  maintainer starts it with `workflow_dispatch`.
 - `.github/workflows/security.yml` runs production dependency audit, high-confidence
   secret scanning, package public hygiene, and workspace public hygiene.
 - `.github/workflows/docs.yml` runs TypeDoc generation and docs checks for docs and
   example changes.
 
-## Trusted Publishing
+## npm provenance and trusted publishing
+
+AICF uses npm Trusted Publishing / GitHub OIDC for both public packages:
+
+- `ai-capability-framework`
+- `@aicf/agent-skills`
 
 Before relying on GitHub Actions publishing, configure trusted publishing for both npm
 packages:
@@ -233,10 +245,42 @@ account before the first real publish, and npm trusted publishing must be config
 that scoped package too.
 
 The workflow publishes only when a `v*` tag is pushed and only if the tagged commit is
-already reachable from `origin/main`. Pre-release versions such as `1.0.0-rc.5` publish
+already reachable from `origin/main`. Pre-release versions such as `1.0.0-rc.6` publish
 with the `next` dist tag. Stable versions publish with the `latest` dist tag. Root and
-agent-skills releases use the same version and tag; for package version `1.0.0-rc.5`,
-push tag `v1.0.0-rc.5`.
+agent-skills releases use the same version and tag; for package version `1.0.0`, push
+tag `v1.0.0`.
+
+## Partial publish recovery
+
+Multi-package npm publishing is not atomic. If one package publishes and the second
+fails, first verify registry state:
+
+```bash
+VERSION=$(node -p "require('./package.json').version")
+npm view "ai-capability-framework@${VERSION}" version
+npm view "@aicf/agent-skills@${VERSION}" version
+```
+
+If only `@aicf/agent-skills` published, fix the workflow or npm ownership issue and
+retry the root package publish at the same version from the same tag. If only the root
+package published, retry the agent-skills publish at the same version from the same tag.
+Do not move the public tag, delete the published version, or reuse a published npm
+version as a normal recovery path.
+
+If the tagged code is wrong, or if the failed package cannot be safely published from
+the same commit, bump both package versions and ship a follow-up patch or release
+candidate. Update GitHub release notes to say which package versions were published,
+which package failed, and which follow-up version supersedes the partial release.
+
+## GitHub repository metadata
+
+Before stable v1, update the GitHub repository About panel manually:
+
+- Description: Provider-agnostic governed capability layer for AI-accessible application
+  functionality.
+- Website: use the docs site or npm package URL when available.
+- Topics: ai, agents, tool-calling, evals, governance, model-context-protocol,
+  langchain, gemini, anthropic, openai, typescript.
 
 ## GitHub Release
 
@@ -245,8 +289,8 @@ push tag `v1.0.0-rc.5`.
 - Summarize the framework as schemas, TypeScript core, CLI, deterministic decision APIs,
   OpenAI Responses adapter, eval runner, docs, and public examples, plus optional
   runtime, observability, live-eval, and self-hostable control-plane subpaths.
-- Publish both npm pre-release packages with a non-default dist tag such as `next` until
-  the final 1.0.0 release is ready.
+- Publish prerelease packages with a non-default dist tag such as `next`. Stable
+  releases publish with `latest`.
 - Link to `CHANGELOG.md`, `docs/start-here.md`, `docs/openai-walkthrough.md`,
   `docs/glossary.md`, `docs/api.md`, `docs/spec.md`, `docs/control-plane.md`,
   `docs/openai-responses.md`, `docs/ai-sdk-runtime.md`, `docs/anthropic-runtime.md`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-capability-framework",
-  "version": "1.0.0-rc.5",
+  "version": "1.0.1",
   "private": false,
   "description": "Provider-agnostic AI capability contracts, runtime controls, evals, and model/provider adapters.",
   "license": "MIT",
@@ -223,22 +223,24 @@
     "archive:source": "node scripts/create-source-archive.mjs",
     "build": "tsc -p tsconfig.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",
-    "check": "npm run check:generated && npm run build && npm run typecheck && npm run lint && npm test && npm run validate && npm run conformance && npm run format:check && npm run gate:examples && npm run docs:build && npm run check:package && npm run check:workspace-public",
+    "check": "npm run check:generated && npm run build && npm run typecheck && npm run lint && npm test && npm run validate && npm run conformance && npm run format:check && npm run check:readability && npm run gate:examples && npm run docs:build && npm run check:package && npm run check:workspace-public",
     "check:docs": "node scripts/check-docs.mjs",
     "check:generated": "node scripts/check-generated.mjs",
+    "check:readability": "node scripts/check-public-readability.mjs",
     "check:package": "npm run build && npm run check:package:contents && npm run check:package-public && npm run check:release-install",
     "check:package:contents": "node scripts/check-package.mjs",
     "check:package-public": "node scripts/check-package-public.mjs",
     "check:public": "npm run check:package-public && npm run check:workspace-public && npm run check:secrets",
     "check:metadata": "node scripts/check-metadata.mjs",
     "check:licenses": "node scripts/check-licenses.mjs",
+    "check:release-tag": "node scripts/check-release-tag-alignment.mjs",
     "check:final-matrix": "node scripts/check-final-certification-matrix.mjs",
     "check:optional": "vitest run src/__tests__/aws src/__tests__/mcp-server src/__tests__/promptfoo src/__tests__/langfuse src/__tests__/evalops src/__tests__/openai-agents src/__tests__/providers/anthropic src/__tests__/providers/gemini src/__tests__/providers/ai-sdk src/__tests__/providers/langchain src/__tests__/providers/mcp src/__tests__/providers/semantic-kernel src/__tests__/providers/conformance src/__tests__/conformance",
     "check:providers": "vitest run src/__tests__/providers",
     "check:providers:live": "npm run test:anthropic:live && npm run test:gemini:live && npm run test:ai-sdk:live && npm run test:langchain:live",
     "check:providers:mock": "npm run test:anthropic:mock && npm run test:gemini:mock && npm run test:ai-sdk:mock && npm run test:langchain:mock && npm run test:semantic-kernel && npm run test:mcp-provider && npm run test:providers:conformance && npm run test:conformance",
     "check:release": "npm run check && npm run check:optional && npm pack --dry-run --json",
-    "check:certification": "npm run check:generated && npm run build && npm run typecheck && npm run lint && npm test && npm run validate && npm run conformance && npm run gate:examples && npm run format:check && npm run docs:build && npm run check:package && npm run check:public && npm run check:metadata && npm run check:licenses && npm run check:final-matrix && npm run check:runtime && npm run check:optional && npm run check:providers:mock && npm run skills:ci && npm run skills:check && npm run skills:pack:dry && npm pack --dry-run --json && node scripts/check-certification.mjs",
+    "check:certification": "npm run check:generated && npm run build && npm run typecheck && npm run lint && npm test && npm run validate && npm run conformance && npm run gate:examples && npm run format:check && npm run check:readability && npm run docs:build && npm run check:package && npm run check:public && npm run check:metadata && npm run check:licenses && npm run check:release-tag && npm run check:final-matrix && npm run check:runtime && npm run check:optional && npm run check:providers:mock && npm run skills:ci && npm run skills:check && npm run skills:pack:dry && npm pack --dry-run --json && node scripts/check-certification.mjs",
     "check:release:providers": "npm run check && npm run check:providers:mock && npm run check:release-install && npm pack --dry-run --json",
     "check:release-install": "node scripts/check-release-install.mjs",
     "check:release-source": "npm run check:workspace-public && npm run check:git-clean && npm run check:source-archive",
@@ -249,7 +251,7 @@
     "check:secrets": "node scripts/check-secrets.mjs",
     "conformance": "node dist/cli.js conformance run examples --format text",
     "docs:api": "typedoc --options typedoc.json",
-    "docs:build": "npm run docs:api && npm run check:docs",
+    "docs:build": "npm run docs:api && npm run check:docs && npm run check:readability",
     "format": "prettier --write .",
     "format:check": "prettier --check .",
     "gate:examples": "node dist/cli.js gate examples --env production",
@@ -257,7 +259,7 @@
     "inspect": "npm run build --silent && node dist/cli.js inspect examples",
     "lint": "node scripts/check-repo-lint.mjs",
     "release:preflight:npm": "node scripts/check-npm-release-preflight.mjs",
-    "release:publish:dry": "node scripts/check-publish-dry-run.mjs",
+    "release:publish:dry": "npm run check:release-tag && node scripts/check-publish-dry-run.mjs",
     "skills:validate": "npm --prefix agent-skills run validate",
     "skills:test": "npm --prefix agent-skills run test",
     "skills:check": "npm --prefix agent-skills run check",