session-peer v1.0.0-rc.1

session-peer v1.0.0-rc.1

The first 1.0 release candidate completes the planned v1 implementation and
asks for final compatibility and packaging feedback before the stable release.

Changes since beta.1

• Add a fail-closed lost-key and restored-device recovery workflow with durable
  reconciliation, control fencing, explicit peer approval and fresh identities.
• Split the maintainable Python core into owned functional segments while
  deterministically preserving the dependency-free single-file SSH artifact.
• Harden releases with one complete gate, immutable action pins, reproducible
  archives, exact content checks, provenance, attestations and runtime audits.
• Reorganize tests by subsystem and require exact wheel and source archive
  contracts that exclude private state and development-only trees.
• Add a real Codex-to-Claude-to-Codex demo, refresh the PyPI summary and raise
  the optional relay cryptography floor to the patched 50.0.1 release.

Install the release candidate

Python package managers do not normally select prereleases. Opt in explicitly:

pipx install 'session-peer[relay]==1.0.0rc1'
# or
uv tool install 'session-peer[relay]==1.0.0rc1'

Use the same package version on both paired endpoints. The core supports Python
3.9+; the optional relay runtime requires Unix or WSL and Python 3.11+.

• Project overview
• Paired-device guide
• v1 compatibility contract
• Security policy

Release candidate boundaries

• This is a prerelease for explicit testers. Normal stable upgrades continue to
  select v0.9.1 until the final 1.0.0 publication.
• The v1 compatibility contract is frozen for the candidate; incompatible
  findings block stable promotion instead of being accepted silently.
• Hosted relay availability and OAuth provider policy remain operational
  services separate from package publication.
• Antigravity remains experimental, and the receiver and optional relay runtime
  do not run natively on Windows; use the documented WSL boundary.
• The recorded operational campaign preserves its interrupted 24-hour result
  and the explicit waiver; this candidate does not claim uninterrupted service.

Report bugs through GitHub issues and security problems through the repository's
private advisory channel. Do not include tokens, device keys, certificates,
session IDs or conversation content in reports.