v1.0.1

v1.0.1

Maintenance and feature-reconciliation release. v1.0.1 tags main so the shipped
identity matches the code: the v1.0.0 annotated tag points at an earlier commit and
its notes describe features (US-5 gitprovider sync, keep-login, organization-ADMIN
management, M5 US-14/14b/15) as "open / not in release" that have since landed on
main. This release moves those into "included" and records their residual gaps
honestly. Prefer digest-pinned images from the GitHub Release; do not install from a
floating latest tag.

Highlights

• M5 / US-14 — project member add + project-level deactivate, with console flows.
• M5 / US-14b — account-level deactivate, organization-ADMIN only (new is_org_admin
  role storage). Project-ADMIN cannot deactivate accounts (403); organization-ADMIN is
  required.
• M5 / US-15 — project create / archive / restore + repository register from the
  console.
• Organization-ADMIN grant/revoke + account reactivate — POST /organization/members/{user}/changes with a HumanChange oneOf active /
  is_org_admin; LAST_ORG_ADMIN → 409, INACTIVE_ACCOUNT → 422. Reactivating an
  account does not auto-restore prior project memberships or re-sign live sessions
  (documented behavior).
• Keep OIDC session across same-tab refresh — the Web console stores OIDC user and
  state in tab-scoped window.sessionStorage so a same-tab reload no longer forces a new
  login. automaticSilentRenew remains false; token expiry still requires
  re-authentication; closing the tab clears the session. (Not localStorage; not shared
  across tabs.)
• US-5 (partial, honest) — live gitprovider token sync with 401/403 split and a live
  acceptance path. This release does not close US-5: acceptance passed with an oauth
  token only (gh auth token), not the fine-grained read-only PAT, and the
  end-to-end sync through the control plane / database was not exercised here. See Known
  limits.
• Stage C P2 closures — docs de-staleness (P2-1), additional DB-free control-plane
  short tests (P2-2), Windows Playwright exit fix (P2-3), bundle-size assessment (P2-4).
• OIDC CI assertion sweep — browser acceptance assertions scoped to unique targets,
  exact repo-URL matching, and select-trigger / getByLabel locator fixes across the
  OIDC acceptance suite.

All four Validate workflows (go control-plane+execution, Web console browser,
isolated-oidc production foundation, documentation+contracts) ran green on the tagged
commit (0bac07d): control-plane 40519334263,
Web console 40519334407,
production foundation 40519334315,
documentation 40519334296.

Compatibility

Supported upgrade-from: v1.0.0 (docs/releases/v1.0.0.md) and v0.1.0-rc.1
(docs/releases/v0.1.0-rc.1.md). Fresh install is also supported.

• Upgrade from v1.0.0: apply the one new migrate file 007_org_admin.sql and re-run
  grants (see Migrations / Grants). No other schema change is required.
• Upgrade from v0.1.0-rc.1: apply 006_task_query.sql (per the v1.0.0 notes) and
  then 007_org_admin.sql, then re-run grants.

Untagged or pre-RC builds should treat this as a new install after backup, or follow the
documented adopt path separately.

Migrations

Apply the normal production Compose sequence (migrate then grants) before returning
traffic.

1. 007_org_admin.sql (new on main relative to the v1.0.0 tag): adds
   human_users.is_org_admin boolean NOT NULL DEFAULT false and backfills the single
   lowest-id active ADMIN-role member as the initial organization-ADMIN. This is
   required before the organization-ADMIN management and account-level deactivate flows
   (US-14b) work on an upgraded install.
2. 006_task_query.sql is still required for the M4 Web task list/search (unchanged
   from v1.0.0). It runs CREATE EXTENSION IF NOT EXISTS pg_trgm; existing upgrades
   must ensure pg_trgm already exists (created once by a privileged role). Do not
   grant the migrator durable database-level CREATE solely for this step. Installs
   already at v1.0.0 have this applied.
3. No additional migrate files beyond current main are required for this tag once
   006_task_query.sql, 007_org_admin.sql, and grants have succeeded.
4. After restore, confirm accp.tasks_search_trgm (or equivalent) is present; production
   dumps include --extension=pg_trgm so restore recreates the extension with the schema
   dump.

Grants / privileges

Production installs must apply deploy/production/grants.sql after migrate. This release
adds one targeted grant beyond v1.0.0:

• accp_api gains UPDATE(id, active) on accp.human_users so account-level deactivate
  (US-14b) can toggle human_users.active. human_users.is_org_admin stays
  operator/bootstrap-only — runtime roles are not granted UPDATE on it. The existing
  targeted DELETE on accp.task_contexts (for editable-task context re-select after
  D09) is unchanged.

deploy/production/check-privileges.sql now also asserts that accp_api has
UPDATE on human_users.active and does not have UPDATE on
human_users.is_org_admin.

Verify with:

accp-ops check --database-url-file /run/secrets/migrator_url

On failure, re-run grants:

docker compose -f deploy/production/compose.yaml run --rm grants

Skipping grants can silently break D07 context re-select and the US-14b account-deactivate
path on upgraded or adopted environments.

Config / secrets / compose

1. No new secret file names and no new env vars for this release. The optional
   ACCP_DATABASE_MAX_CONNS (default 10, valid 1–1000) on API/Worker introduced in
   v1.0.0 is unchanged.
2. Keep the SPA client ID (ACCP_OIDC_CLIENT_ID, example accp-web) distinct from the API
   audience (ACCP_OIDC_AUDIENCE, example accp-api).
3. Production still pins ACCP_IMAGE (and the ops image for backups) to Release digests;
   dev Compose may expose metrics on ACCP_METRICS_ADDR / host ACCP_METRICS_PORT.

Breaking / operator actions

1. Apply 007_org_admin.sql and re-run grants before returning traffic. On an
   upgrade from v1.0.0, the organization-ADMIN management and US-14b account-deactivate
   flows require both the new column and the new UPDATE(id, active) grant on
   human_users. Confirm with accp-ops check.
2. Pin ACCP_IMAGE (and the ops image for backups) to the digests published on this
   Release; do not use mutable local tags as the install identity.
3. After migrate, always run grants and confirm with accp-ops check before returning
   traffic.
4. Do not use down -v during upgrade or maintenance; named volumes hold PostgreSQL,
   JetStream, and Caddy state.
5. Organization-ADMIN is a distinct, scarce role. Revoking the last organization-ADMIN
   returns 409 LAST_ORG_ADMIN; acting on an inactive account returns 422 INACTIVE_ACCOUNT. Reactivating an account does not restore prior project memberships or
   re-sign existing sessions — re-grant memberships explicitly if needed.
6. Web session on reload: a same-tab refresh now keeps the OIDC session (tab-scoped
   sessionStorage). Closing the tab or token expiry still requires re-authentication;
   operators should not assume cross-tab or persistent sign-in.

Known limits

1. US-5: live gitprovider token sync is included but not closed. Acceptance passed
   with an oauth token only, not a fine-grained read-only PAT, and the end-to-end sync
   through the control plane / database was not exercised in this release. Closing US-5 to
   spec is tracked as WP-3 (requires an FG-PAT + fixture repo).
2. US-16 / D04 restore drill: only a modest-seed drill is recorded
   (docs/restore-drill-w0-2026-10-26.md: RPO 90s, command RTO 0.586s, pg_trgm
   present). Full business RTO at ~50-user W0 data volume is not measured; the full
   drill is tracked as WP-4.
3. US-17 / Q8: documentation only. The real enterprise IdP rotation/expiry drill
   remains deferred by product decision.

(M5 US-14/14b/15 and keep-login, listed as limits in the v1.0.0 notes, are now
included in this release and removed from this list.)

Known follow-up / P1

1. Multi-user load hardening (WP-5): re-run the W0 load test with distinct-user
   concurrency and characterize the thin (~58ms) event-visibility margin across ≥3 runs.
2. Control-plane integration coverage beyond -short (WP-6 / Stage C P2-2): run the
   Postgres/NATS integration suite and record the ratio delta beyond the DB-free
   validation_test.go.
3. Full US-16 restore drill at W0 scale (WP-4), superseding the modest-drill caveat.
4. Windows Playwright re-verify (WP-8): confirm the web/scripts/test-ui.mjs exit fix
   yields exit 0 on a real Windows host.

Reviewed-against

• docs/d07-d09.md
• docs/w0-baseline-2026-10-25.md
• docs/restore-drill-w0-2026-10-26.md
• docs/loadtest/w0-2026-10-26.md
• docs/web-console-guide.md
• docs/production-deployment.md
• docs/product-delivery-plan.md

Artifacts

Image digests, Bridge archives, and SHA256SUMS.txt are produced by the release workflow
on tag push and attached to the GitHub Release for this tag. Digests are not listed in
these notes in advance — read them from the published Release after the tag is pushed, and
use them in Compose (ACCP_IMAGE=ghcr.io/javaweh/accp@sha256:…) and backup --image /
--ops-image flags.

Published digests

{
  "tag": "v1.0.1",
  "accp": "ghcr.io/javaweh/accp@sha256:d0f7fb94442599c7eab0b21507c2d947c0e8785d985c45aa41f610686985b91f",
  "accp_ops": "ghcr.io/javaweh/accp-ops@sha256:7c858a9a58f74eb588112edc06bf042616ddaef4a9526b3f40f3b24400bd6185"
}

Bridge che...

v1.0.0

v1.0.0

First general release of ACCP after Stage A (M1–M3) and Stage B M4. Prefer digest-pinned images from the GitHub Release; do not install from a floating latest tag.

Highlights

Stage A (M1–M3)

• M1 verification: US-13a Idempotency-Replayed: true response header (PR #22); US-4 race+integration evidence recorded; US-6 accp-ops check for task_contexts DELETE grants. US-5 (live GitHub token sync) remains open.
• M2 release pipeline: US-7/8 tag→CI→GHCR + GitHub Release with Bridge packages and upgrade-notes gate (first exercised as v0.1.0-rc.1).
• M3 capacity: US-2/3/16 W0 load test and restore drill; optional ACCP_DATABASE_MAX_CONNS; backups include pg_trgm via pg_dump --extension=pg_trgm.

Stage B (M4)

• US-10: Web console split of workspace/tasks/main into feature modules (structure only).
• US-11a / US-11b: Task list sort/order with composite cursors; console server-side filter/sort and load-more (no total count).
• US-12: OIDC returnTo keeps search + hash; copy-link for filtered views.
• US-13a / US-13b: Idempotent replay header (PR #22) and safe write-retry / replayed-success feedback (PR #23).
• US-17: Docs only — SPA client ID vs API audience wording aligned; real target-IdP drill deferred (Q8).
• Web follow-ups: prettier alignment (ecbea4e), modal Escape with select overlay (bd2907e), forbidden deep-link copy (64c301c), browser acceptance locators (fb12b4d).

Compatibility

Supported upgrade-from: installs documented as v0.1.0-rc.1 (docs/releases/v0.1.0-rc.1.md). Fresh install is also supported. Untagged or pre-RC builds should treat this as a new install after backup, or follow the documented adopt path separately.

Migrations

Apply the normal production Compose sequence (migrate then grants) before returning traffic.

1. 006_task_query.sql (required before enabling the M4 Web task list/search): creates task list indexes and a GIN trigram search index. It runs CREATE EXTENSION IF NOT EXISTS pg_trgm. New installs create the extension during migrate/init; existing upgrades must ensure pg_trgm already exists in the application database (created once by a privileged role). Do not grant the migrator durable database-level CREATE solely for this step.
2. No additional migrate files beyond current main are required for this tag once 006_task_query.sql and grants have succeeded.
3. After restore, confirm accp.tasks_search_trgm (or equivalent) is present; production dumps include --extension=pg_trgm so restore recreates the extension with the schema dump.

Grants / privileges

Production installs must apply deploy/production/grants.sql after migrate so accp_api receives the targeted DELETE privilege on accp.task_contexts (required for editable-task context re-select after D09).

Verify with:

accp-ops check --database-url-file /run/secrets/migrator_url

On failure, re-run grants:

docker compose -f deploy/production/compose.yaml run --rm grants

Skipping grants can silently break D07 context re-select on upgraded or adopted environments.

Config / secrets / compose

1. Optional ACCP_DATABASE_MAX_CONNS (default 10, valid 1–1000) on API/Worker. Documented in Compose; omit to keep historical behavior. Size pools so API + Worker totals stay under PostgreSQL max_connections (W0 evidence used 40+40 with max_connections=100).
2. Dev Compose may expose metrics on ACCP_METRICS_ADDR / host ACCP_METRICS_PORT; production still pins ACCP_IMAGE (and ops image) to Release digests.
3. No new secret file names for this release. Keep SPA client ID (ACCP_OIDC_CLIENT_ID, example accp-web) distinct from API audience (ACCP_OIDC_AUDIENCE, example accp-api).

Breaking / operator actions

1. Pin ACCP_IMAGE (and ops image for backups) to digests published on this Release; do not use mutable local tags as the install identity.
2. After migrate, always run grants and confirm with accp-ops check before returning traffic.
3. Do not use down -v during upgrade or maintenance; named volumes hold PostgreSQL, JetStream, and Caddy state.
4. Task list API (US-11a): clients that need a meaningful order must pass sort (updated_at or title) and optional order (asc/desc). Omitting sort keeps the legacy id-keyset walk for old clients, but that order is not a product promise (ids are random). Default order when sort=updated_at is desc; when sort=title is asc. Unsupported sort/order values return 400 with INVALID_SORT / INVALID_ORDER.
5. Composite cursors: next_cursor binds sort/order and active filters. Reusing a cursor with a different sort, order, or filter returns 400 INVALID_CURSOR. Drop the cursor and restart paging when the query signature changes.
6. Idempotency: successful replays add response header Idempotency-Replayed: true (additive). Clients that ignore unknown headers remain compatible; the Web console uses the header for “already succeeded” feedback.

Known limits

1. US-17: documentation only this release; real enterprise IdP rotation/expiry drill remains deferred per product decision Q8.
2. US-5: live GitHub token commit-pinned context sync verification is not closed.
3. M5 / US-14, US-14b, US-15: day-2 project member management, organization-ADMIN account deactivate, and console project/repo provisioning are not in this release.
4. Web auth tokens live in memory only; a full page reload clears them and requires re-authentication (sessionStorage holds short-lived OIDC callback state only).

Reviewed-against

• docs/product-plan-next-phase.md
• docs/w0-baseline-2026-10-25.md
• docs/web-console-guide.md
• docs/production-deployment.md
• docs/loadtest/w0-2026-10-26.md
• docs/m1-control-plane.md

Artifacts

Image digests, Bridge archives, and SHA256SUMS.txt are attached to the GitHub Release for this tag. Use those digests in Compose (ACCP_IMAGE=ghcr.io/javaweh/accp@sha256:…) and backup --image / --ops-image flags.

Published digests

{
  "tag": "v1.0.0",
  "accp": "ghcr.io/javaweh/accp@sha256:eb5a39db7bb1693458f3bdf948c0d5b4ca5d0a268c1f74661605afa3b5b25eae",
  "accp_ops": "ghcr.io/javaweh/accp-ops@sha256:ad96925a026f18df56f3171470ab66e1c5778d576bec9f26f80736ddae4b6792"
}

Bridge checksums

e1e9e9fb8e2e675f5598a66955b617e98ad21da014de90688b3001c55dfd4d0a  accp-bridge-v1.0.0-linux-amd64.tar.gz
a30848aef6a160a509d46446680fef004a2ecb1967776227074a60471c0a159b  accp-bridge-v1.0.0-linux-arm64.tar.gz
a5adda0a362c45b33ee337aedb1c3557a53705f280f8e70855bf1055738cfbdb  accp-bridge-v1.0.0-darwin-amd64.tar.gz
24745fc2cc01da955e33c764fc0ee1b2a97b28e0939262933a34f97f1734a4ca  accp-bridge-v1.0.0-darwin-arm64.tar.gz
ada9536f1b0eb6842091dba2205c2883f4d13b7d74f2e544cd90b574cf94d670  accp-bridge-v1.0.0-windows-amd64.zip