v1.0.0

v1.0.0

First general release of ACCP after Stage A (M1–M3) and Stage B M4. Prefer digest-pinned images from the GitHub Release; do not install from a floating latest tag.

Highlights

Stage A (M1–M3)

• M1 verification: US-13a Idempotency-Replayed: true response header (PR #22); US-4 race+integration evidence recorded; US-6 accp-ops check for task_contexts DELETE grants. US-5 (live GitHub token sync) remains open.
• M2 release pipeline: US-7/8 tag→CI→GHCR + GitHub Release with Bridge packages and upgrade-notes gate (first exercised as v0.1.0-rc.1).
• M3 capacity: US-2/3/16 W0 load test and restore drill; optional ACCP_DATABASE_MAX_CONNS; backups include pg_trgm via pg_dump --extension=pg_trgm.

Stage B (M4)

• US-10: Web console split of workspace/tasks/main into feature modules (structure only).
• US-11a / US-11b: Task list sort/order with composite cursors; console server-side filter/sort and load-more (no total count).
• US-12: OIDC returnTo keeps search + hash; copy-link for filtered views.
• US-13a / US-13b: Idempotent replay header (PR #22) and safe write-retry / replayed-success feedback (PR #23).
• US-17: Docs only — SPA client ID vs API audience wording aligned; real target-IdP drill deferred (Q8).
• Web follow-ups: prettier alignment (ecbea4e), modal Escape with select overlay (bd2907e), forbidden deep-link copy (64c301c), browser acceptance locators (fb12b4d).

Compatibility

Supported upgrade-from: installs documented as v0.1.0-rc.1 (docs/releases/v0.1.0-rc.1.md). Fresh install is also supported. Untagged or pre-RC builds should treat this as a new install after backup, or follow the documented adopt path separately.

Migrations

Apply the normal production Compose sequence (migrate then grants) before returning traffic.

1. 006_task_query.sql (required before enabling the M4 Web task list/search): creates task list indexes and a GIN trigram search index. It runs CREATE EXTENSION IF NOT EXISTS pg_trgm. New installs create the extension during migrate/init; existing upgrades must ensure pg_trgm already exists in the application database (created once by a privileged role). Do not grant the migrator durable database-level CREATE solely for this step.
2. No additional migrate files beyond current main are required for this tag once 006_task_query.sql and grants have succeeded.
3. After restore, confirm accp.tasks_search_trgm (or equivalent) is present; production dumps include --extension=pg_trgm so restore recreates the extension with the schema dump.

Grants / privileges

Production installs must apply deploy/production/grants.sql after migrate so accp_api receives the targeted DELETE privilege on accp.task_contexts (required for editable-task context re-select after D09).

Verify with:

accp-ops check --database-url-file /run/secrets/migrator_url

On failure, re-run grants:

docker compose -f deploy/production/compose.yaml run --rm grants

Skipping grants can silently break D07 context re-select on upgraded or adopted environments.

Config / secrets / compose

1. Optional ACCP_DATABASE_MAX_CONNS (default 10, valid 1–1000) on API/Worker. Documented in Compose; omit to keep historical behavior. Size pools so API + Worker totals stay under PostgreSQL max_connections (W0 evidence used 40+40 with max_connections=100).
2. Dev Compose may expose metrics on ACCP_METRICS_ADDR / host ACCP_METRICS_PORT; production still pins ACCP_IMAGE (and ops image) to Release digests.
3. No new secret file names for this release. Keep SPA client ID (ACCP_OIDC_CLIENT_ID, example accp-web) distinct from API audience (ACCP_OIDC_AUDIENCE, example accp-api).

Breaking / operator actions

1. Pin ACCP_IMAGE (and ops image for backups) to digests published on this Release; do not use mutable local tags as the install identity.
2. After migrate, always run grants and confirm with accp-ops check before returning traffic.
3. Do not use down -v during upgrade or maintenance; named volumes hold PostgreSQL, JetStream, and Caddy state.
4. Task list API (US-11a): clients that need a meaningful order must pass sort (updated_at or title) and optional order (asc/desc). Omitting sort keeps the legacy id-keyset walk for old clients, but that order is not a product promise (ids are random). Default order when sort=updated_at is desc; when sort=title is asc. Unsupported sort/order values return 400 with INVALID_SORT / INVALID_ORDER.
5. Composite cursors: next_cursor binds sort/order and active filters. Reusing a cursor with a different sort, order, or filter returns 400 INVALID_CURSOR. Drop the cursor and restart paging when the query signature changes.
6. Idempotency: successful replays add response header Idempotency-Replayed: true (additive). Clients that ignore unknown headers remain compatible; the Web console uses the header for “already succeeded” feedback.

Known limits

1. US-17: documentation only this release; real enterprise IdP rotation/expiry drill remains deferred per product decision Q8.
2. US-5: live GitHub token commit-pinned context sync verification is not closed.
3. M5 / US-14, US-14b, US-15: day-2 project member management, organization-ADMIN account deactivate, and console project/repo provisioning are not in this release.
4. Web auth tokens live in memory only; a full page reload clears them and requires re-authentication (sessionStorage holds short-lived OIDC callback state only).

Reviewed-against

• docs/product-plan-next-phase.md
• docs/w0-baseline-2026-10-25.md
• docs/web-console-guide.md
• docs/production-deployment.md
• docs/loadtest/w0-2026-10-26.md
• docs/m1-control-plane.md

Artifacts

Image digests, Bridge archives, and SHA256SUMS.txt are attached to the GitHub Release for this tag. Use those digests in Compose (ACCP_IMAGE=ghcr.io/javaweh/accp@sha256:…) and backup --image / --ops-image flags.

Published digests

{
  "tag": "v1.0.0",
  "accp": "ghcr.io/javaweh/accp@sha256:eb5a39db7bb1693458f3bdf948c0d5b4ca5d0a268c1f74661605afa3b5b25eae",
  "accp_ops": "ghcr.io/javaweh/accp-ops@sha256:ad96925a026f18df56f3171470ab66e1c5778d576bec9f26f80736ddae4b6792"
}

Bridge checksums

e1e9e9fb8e2e675f5598a66955b617e98ad21da014de90688b3001c55dfd4d0a  accp-bridge-v1.0.0-linux-amd64.tar.gz
a30848aef6a160a509d46446680fef004a2ecb1967776227074a60471c0a159b  accp-bridge-v1.0.0-linux-arm64.tar.gz
a5adda0a362c45b33ee337aedb1c3557a53705f280f8e70855bf1055738cfbdb  accp-bridge-v1.0.0-darwin-amd64.tar.gz
24745fc2cc01da955e33c764fc0ee1b2a97b28e0939262933a34f97f1734a4ca  accp-bridge-v1.0.0-darwin-arm64.tar.gz
ada9536f1b0eb6842091dba2205c2883f4d13b7d74f2e544cd90b574cf94d670  accp-bridge-v1.0.0-windows-amd64.zip