Skip to content

HIVE v1.0.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 18 Sep 09:44
· 27 commits to main since this release
v1.0.0
a53b5b9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

HIVE v1.0.0 release notes

Status: Published stable release.

Summary

HIVE v1.0.0 is the first stable professional release of the product baseline
accepted internally as HIVE V0.1 — Foundation. It is a release-engineering,
maintenance-governance and repository-presentation promotion: the product
architecture, PostgreSQL/pgvector/Redis/CAS data model and the accepted V0.1
closure evidence are unchanged.

Highlights

  • Stable SemVer distribution identity 1.0.0 synchronized across VERSION,
    backend runtime surfaces and the dashboard package metadata.
  • Professional public repository presentation: README landing page, All Rights
    Reserved rights notice, CONTRIBUTING, SECURITY, SUPPORT, AGENTS, issue/PR
    templates and release/maintenance documentation.
  • Deterministic release metadata verification
    (scripts/verify_release_metadata.py) integrated into the mandatory Validate
    gate, failing closed on version/notes/CHANGELOG/README drift.
  • Hardened release workflow: annotated-tag identity, exact tag/VERSION match,
    release-note and CHANGELOG coherence, full validation and integration smoke on
    the tag commit, deterministic ZIP + SHA256 + machine-readable release manifest.
  • Release-candidate provenance receipt under .engineering/release/ recording
    the immutable V0.1 closure lineage without fabricating post-publication values.
  • Weekly grouped Dependabot cadence (pip, npm, GitHub Actions) with breaking
    majors kept separately reviewable and dependency PRs never auto-merged.
  • CodeQL analysis (Python, JavaScript/TypeScript) and Dependency Review on pull
    requests; both are advisory-only in this increment and are not ruleset checks.

The capability set below is the accepted V0.1 baseline and is documented in the
canonical Project Brain sources rather than duplicated here:

  • Durable Project Registry, task/prompt intake with content-addressed original
    preservation (SHA-256 + lossless Zstandard), Git-aware incremental repository
    indexing with Python AST symbol metadata.
  • Project-scoped lexical, semantic (pgvector) and hybrid RRF retrieval with
    provider-independent embedding adapters, optional reranking and deterministic
    fallback behavior.
  • Checkpoint-first Context Manager, progressive disclosure (L0–L5), adaptive
    token budgeting, context fingerprints, delta context and provider/prompt cache
    adapters, over durable memory with provenance and lifecycle.
  • Governed autonomous execution foundation (tool gating, staged noncanonical
    output, local verified runner), MCP read-only core surface, telemetry/event
    bus and the full HIVE Control Center.
  • Local Docker Compose deployment, backup/recovery and secondary-disk
    persistence.

Fixed

  • Removed stale pre-alpha/bootstrap positioning from the repository
    presentation and active version surfaces.
  • Release package verification now fails closed on missing required stable
    release files and on forbidden secret/local paths.

Security

  • No secrets, credentials, keys, .env files or user runtime data are included
    in the release diff or package; scripts/check_secrets.py remains mandatory
    and is not weakened.
  • GitHub secret scanning and push protection are enabled; CodeQL and Dependency
    Review are added as advisory security automation in this increment.
  • Dependency security: all 16 open HIGH Dependabot advisories on the default
    branch are remediated in this candidate by pinned patched versions —
    fastapi==0.133.0 (enabling starlette==1.3.1), python-multipart==0.0.31
    and Mako==1.3.12 — covering both runtime and development manifests. The
    bounded receipt is
    .engineering/release/HIVE-V1.0.0-SECURITY-TRIAGE.json with
    release_gate = PASS and runtime_high_critical_remaining = false.
  • Remaining open dependency alerts are MEDIUM and development-only
    (vitest/@vitest/mocker and pytest); they have no runtime exposure, are
    not hidden and are recorded in the triage receipt. GitHub may keep the
    remediated alerts open on main until this candidate is merged.
  • Project isolation, provenance and fail-closed security behavior are covered by
    the accepted V0.1 evidence; product defect counts (HIGH/CRITICAL 0/0) are
    distinct from dependency advisories and are not used to claim dependency
    security.

Compatibility

  • The supported line starts at 1.0.x; public API, schema and operational
    contract begin with this release, so no compatibility break relative to any
    published release exists.
  • Migration head is 0007_telemetry_events. This increment introduces no
    migrations.

Upgrade

See UPGRADING.md. Upgrading from the historical bootstrap
pre-release is a clean source upgrade with a backup of PostgreSQL and
HIVE_DATA_ROOT; no release-specific migration step is required for v1.0.0.

Rollback

Roll back by redeploying the previous revision (v0.0.1-bootstrap for the
historical pre-release) and restoring the pre-upgrade PostgreSQL and data-root
backups as described in UPGRADING.md.

Known limitations

  • Deterministic embedding, rerank and token benchmarks prove contract mechanics,
    not production model quality; no local embedding model or local reranker is
    promoted.
  • Exact provider token, cost and cache-hit values remain unavailable without
    provider receipts and are never rendered as zero.
  • Source release is the required distribution channel; no container-image,
    npm-package or binary distribution exists in this increment.
  • Tag signing, SBOM generation and build-provenance attestations are not
    claimed.
  • Three MEDIUM development-only dependency alerts remain open and are documented
    in the security triage receipt; there are no remaining LOW alerts.
  • The fastapi/starlette upgrade introduces one non-blocking
    StarletteDeprecationWarning about httpx in starlette.testclient
    (httpx2 migration is deferred to dependency maintenance).
  • Historical v0.0.1-bootstrap notes and the internal V0.1 Foundation history
    remain as originally accepted and are not rewritten.

Validation evidence

Exact validation, integration health, security and Review Evidence results are
recorded for the audited release-preparation head in the PR Review Evidence and
the .engineering/release/HIVE-V1.0.0-RELEASE-CANDIDATE.json receipt. The
dependency alert inventory and dispositions are recorded in
.engineering/release/HIVE-V1.0.0-SECURITY-TRIAGE.json. The accepted product
closure evidence remains DoD 46/46 PASS, 0 FAIL, 0 UNKNOWN, HIGH/CRITICAL 0/0.

Checksums and artifacts

hive-v1.0.0.zip, hive-v1.0.0.zip.sha256 and
hive-v1.0.0.manifest.json are generated deterministically by the release
workflow from the exact tag commit. They do not exist before publication and are
not fabricated here; verify them against the published GitHub Release assets.

Lineage

  • Accepted V0.1 product closure: PR #95, audited head
    649e7f90fc4f2d4e3cbc17ca0f38d5f2c9dd46ad, Sol review 5233591627, squash
    merge 05d142511f849d002c4ec8558fe4f43dca3e788b, post-merge CI
    35204484706.
  • Final promotion: PR #98, audited head
    1e480a815da16276a57fa85ee7c1eb9ef87adc41, final main
    90cc1b91b48d628dfb3e4773e1672535b4cb8991, post-merge CI 35278763114.
  • Release preparation: HIVE-REL-001 / issue #105, branch
    release/v1.0.0-professionalization, authorized base
    90cc1b91b48d628dfb3e4773e1672535b4cb8991.
Assets 8
Loading