ai-capability-framework 1.0.0 → 1.0.1

package/CHANGELOG.md

@@ -4,6 +4,15 @@ All notable public changes to AI Capability Framework are documented here.
 
 ## Unreleased
 
+## 1.0.1 - 2026-07-27
+
+- Updated the resolved `fast-uri` dependency to `3.1.4` to address the high-severity URI
+  host-confusion advisories reported by the scheduled security audit.
+- Kept `ai-capability-framework`, `@aicf/agent-skills`, and Codex plugin metadata
+  aligned under the coordinated `1.0.1` patch release.
+
+## 1.0.0 - 2026-06-09
+
 - Prepared the `1.0.0` stable release and made `@aicf/agent-skills` a first-class
   same-version npm artifact in certification, CI, release dry-run, and
   trusted-publishing workflows.

package/docs/public-framework/release-process.md

@@ -32,6 +32,11 @@ npm run release:publish:dry
 npm pack --dry-run --json
 ```
 
+`npm run release:publish:dry` runs package publish dry-runs while the target version is
+unpublished. After both public packages at the current version are already on npm, it
+exits successfully with a skip message. A partial state, where only one package version
+is published, remains a failure and must be handled with the documented recovery path.
+
 Use `npm pack` for npm artifact review and `npm run archive:source` for source review.
 Do not zip the working directory manually.
 
@@ -39,6 +44,10 @@ Use [Final Certification Matrix](final-certification-matrix.md) to confirm the l
 command set, workflows, package contents, source archive rule, and publish dry-run
 commands are still aligned.
 
+The Release Dry Run workflow is a manual release-review workflow. Run it from GitHub
+Actions when preparing a release candidate or stable tag; ordinary `main` pushes rely on
+CI, validation, docs, and security workflows instead.
+
 AICF uses MIT for the v1 public release. The root package, `@aicf/agent-skills`, the
 Codex plugin manifest, skill metadata, README, and release docs must agree; see
 [License Decision](license-decision.md).

package/docs/release.md

@@ -101,6 +101,11 @@ npm pack
 `npm run release:publish:dry` wraps `npm publish --dry-run` for the root package and for
 `@aicf/agent-skills` with the computed `next` or `latest` dist tag.
 
+If both package versions are already published, the command exits successfully and
+reports that publish dry-runs were skipped. That keeps post-release `main` checks from
+failing on npm's immutable-version rule. If only one package version is published, the
+command fails and the partial publish recovery steps below apply.
+
 Then inspect:
 
 ```bash
@@ -197,9 +202,10 @@ and examples should be present at `docs/index.md`, `docs/getting-started/`,
 - `.github/workflows/ci.yml` runs root and agent-skills installs, generated-type
   freshness, build, typecheck, repository lint, tests, validation, conformance,
   governance gate, package checks, agent-skills checks, and docs build.
-- `.github/workflows/release-dry-run.yml` runs the full release gate, package dry-run,
-  source archive creation/checking, final certification, root npm publish dry-run, and
-  agent-skills npm publish dry-run.
+- `.github/workflows/release-dry-run.yml` is a manual release-review gate. It runs the
+  full release gate, package dry-run, source archive creation/checking, final
+  certification, root npm publish dry-run, and agent-skills npm publish dry-run when a
+  maintainer starts it with `workflow_dispatch`.
 - `.github/workflows/security.yml` runs production dependency audit, high-confidence
   secret scanning, package public hygiene, and workspace public hygiene.
 - `.github/workflows/docs.yml` runs TypeDoc generation and docs checks for docs and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-capability-framework",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "private": false,
   "description": "Provider-agnostic AI capability contracts, runtime controls, evals, and model/provider adapters.",
   "license": "MIT",