v1.3.0 — Official Docs, Fig Best Practices, Hardened Auth

Version

v1.3.0

What's included

Minor release cut from main. Since v1.2.0 (a461cf3, 2026-09-12) — 94 commits,
of which 37 landed as merged PRs.

Added — deliverables

• PR #266 — deliverables/official-docs/: an official documentation registry.
  One JSON registry (src/official-docs.json) read from both sides of the stack
  (src/official_docs.py, src/official-docs.js, src/utils.ts), every link
  checked against the live URL by scripts/verify_links.py rather than assumed,
  and a React docs bar + image gallery (src/Company.jsx) rendered from the same
  registry so the UI cannot drift from the data.
• PR #265 — deliverables/fig-best-practices/: a quality gate for projects
  built on the Fig platform. BEST-PRACTICES.md is the policy, six agent briefs
  (developer / reviewer / security / designer / performance / deployment) state
  who enforces what, ci/quality-gate.yml is the Actions entry point, and two
  fixture projects — a known-bad and a known-good tree — exercise the gate.
  69 tests.
• PR #258 — deliverables/ci/: the full CI/CD pipeline (orchestrator plus
  reusable workflows).
• PR #238 — skills: pr-triage-automove, the automated form of
  organize-misplaced-files. A root file is moved only when it is not canonical,
  no tracked .py imports it (AST-parsed), and its name appears in no other
  tracked file. Wrapped in an import probe so a poisoned import cannot kill the
  run; dry-run by default, --apply required. 37 tests.
• PR #235 — deliverables/agent-core/: Dockerfile and Helm chart.
• PR #240 — skills: ci-workflow-authoring plus lint.py to check workflows
  before they run. 16 tests.
• PR #241 — Claude endpoint tests: mock responses, timeout, auth and error
  handling cases.

Changed

• PR #267 — hardened JWT secret validation and moved users onto a database.
  A signing key shorter than 32 characters, or one of a set of known placeholder
  values, is now rejected so a misconfigured deployment fails loudly instead of
  signing tokens with a guessable key. Added app/user_store.py, a
  SQLAlchemy-backed user table that imports legacy JSON users on first init and
  keeps the existing shape, so the API surface and per-user skill gating are
  unchanged. DATABASE_URL selects Postgres, otherwise SQLite. 43 tests.
• PR #252, PR #259, PR #248 — agent task skills and merge protection,
  cron automation, and the corresponding knowledge notes.
• PR #236 — rewrote README.md to describe the repository as it stands rather
  than as it was intended: the real entrypoints, which one app/Dockerfile and
  vercel.json serve, required vs optional configuration, the real test command,
  and a Known state section recording what is genuinely broken.
• PR #233 — activated the WhatsApp notification workflow, moved out of
  templates/ (which Actions does not read) into .github/workflows/.

Fixed

• PR #250 — SHA-pinned the workflow actions and repaired the broken workflow
  YAML.
• PR #249 — pointed knowledge/scripts/diff_policy.py at knowledge/ instead
  of the missing vault/.
• PR #243 — repaired auto-compress-manage.yml, which had failed at
  Set up job on all 781 runs: five action refs pointed at SHAs that do not exist
  upstream. Four skip conditions added alongside the fix.
• PR #234 — corrected YAML syntax and indentation in Auto-Index-Sync.yml.
• PR #262 — dropped the unused import sys from
  knowledge/scripts/diff_policy.py.
• PR #230 — ci.yml updated.

Direct to main — besides the PRs above, 57 commits landed straight on main:
new skill docs (SKILL.md files), knowledge notes, guideline documents, a
cron-automation/ directory, and several Add files via upload. These were not
reviewed through PRs and are listed here rather than itemised.

Dependencies

• PR #222 — requirements.txt updated.
• PR #223 — added a root requirements-dev.txt for test/lint tooling.
• PR #204 / #211 — npm dev-deps group bump; esbuild + vite bump in
  deliverables/product-crud/web.

Changelog

Full sections: CHANGELOG.md → [2026-09-14], [2026-09-13],
[2026-09-12]. Two merged PRs had no changelog record at the time of this
release — #265 and #266 — and are added in this release PR alongside the
notes.

Migration / breaking changes

None. No migration required. The JWT change (#267) is stricter than before by
design: a deployment signing tokens with a short or placeholder key will now fail
at startup instead of silently continuing. Set a key of at least 32 characters —
or unset it and let the local fallback generate one.

Verification

• CI green on main — see note below
• Tests pass — 69 (fig-best-practices), 43 (app/, clean venv),
  37 (pr-triage-automove), 16 (ci-workflow-authoring)
• Migration applied (if any) — N/A
• Tag + GitHub Release created from this section

CI note: every workflow on main still fails at Set up job, for the
pre-existing org policy reason — all actions must be pinned to a full-length
commit SHA. Repairs have been attempted repeatedly (#243, #250), and each
attempt was subsequently overwritten or left unreconciled, so the repo remains in
a state where the policy text (README.md, SECURITY.md) does not match the
workflows that are actually on main. This is tracked in PROBLEMS.md; it is
not introduced by this release and does not affect the artifacts above, which run
their own tests. It does mean no PR on this repository can show green checks.