v1.9.0

Stable release of the 1.9.0 line. Records-only promotion of
v1.9.0-rc.7
— no template behaviour changes since rc.7. Cut from protected main via
release-record PR #56.

The 1.9.0 line at a glance

• Search that scales — worker-backed index with concept matching beyond
  exact keywords, interaction-latency budgets enforced to 1,000 entries.
• Staleness/refresh cycle — monthly verification sweep opens refresh
  reminders per stale entry; refresh-entry issue flow stamps the schema's
  own verified-date key.
• "Also deployed by" — other organizations attach their implementation
  info to an existing entry through a dedicated issue flow.
• Security signals — per-entry security posture surfaced from repository
  metadata.
• Full details per release candidate in the
  CHANGELOG.

Release evidence

• npm run verify at cut commit 05008c274352846f6661728a5f35042428305da4:
  799 Node tests across 3 suites, 233 Ruby tests with 578 assertions,
  109 build-matrix tests across 6 suites, plus every non-browser release gate.
• RR-H08 soak: rc.7 deployment ran clean on the intended Pages configuration
  2026-08-28T18:29Z → 2026-08-29T08:17Z (29 half-hourly probes; no P0/P1
  defect), accepted by the release owner; the window absorbed the live
  rollback drill (BCHC PRs #35/#36 — revert and byte-identical roll-forward
  both proven through required checks, Pages redeploys and live verification).
• Exact update rehearsal: rc.7 consumed by the live updater
  (run 33144777338
  → machine-verified
  BCHC PR #34,
  merged after human review).
• Full ledger: release-readiness status.

Upgrading

Run Update from PHCT (workflow_dispatch with release=v1.9.0) in your
deployment, or npm run upgrade:check -- --to v1.9.0 for a read-only preview.
No ownership-contract changes since rc.6, so no migration is required first.

Rollback point

v1.9.0-rc.7 at b97432bc1d5298407046e599248bc62a6f09ce37.

🤖 Generated with Claude Code

v1.9.0-rc.7

Seventh release candidate for v1.9.0. Cut from protected main at
b97432bc1d5298407046e599248bc62a6f09ce37 (release record PR #54), carrying the two
rc.6 refresh-cycle robustness fixes found in downstream review
(PR #49, merged at af54f2810ed9d94fbfbb9b92ecf500ceaba18ddb, all required
contexts green). No feature changes since rc.6.

What changed since rc.6

• Refresh reminders name the deployment's own field — the refresh-entry
  workflow reads the schema's entry.verified_key from the script instead of
  assuming a field literally named verified, so a catalog that renamed its
  verified-date field is told to stamp the right key.
• The verification sweep's issue bodies travel by file, not environment —
  the sweep hands its drafted issue bodies to the follow-up step through a
  file under the runner's temp directory ($SWEEP_ISSUES_FILE) instead of a
  step output, so a sweep that drafts many reminders in one run can no longer
  hit the runner's per-environment-entry size cap; count, slugs and
  max_new remain ordinary outputs.

npm run verify recorded at release-record commit
f1e5699f147ce770137cc50d3d7c86c372c83a37: 799 Node tests across 3 suites,
233 Ruby tests with 578 assertions, 109 build-matrix tests across 6 suites,
plus every non-browser release gate.

Full details: CHANGELOG
and the release-readiness status.

Known notes

• Code-scanning alerts #42 (js/client-side-request-forgery on
  assets/js/search-worker.js) remains a documented false positive awaiting
  maintainer dismissal in the repository Security tab (#43 was dismissed).
• BCHC consumed v1.9.0-rc.6 via
  its update PR #30
  on 2026-08-28 and is locked there; the rc.6 feature adoption and drill
  records followed in BCHC PRs #31 and #33. The rc.7 candidate update PR
  follows from rerunning Update from PHCT against this tag — no ownership
  contract changes since rc.6, so no migration is required first.

Rollback point

v1.9.0-rc.6 at c33e76b05fda6a9bdaa7beea7527414b13d74c1b.

🤖 Generated with Claude Code

v1.9.0-rc.6

Sixth release candidate for v1.9.0. Cut from protected main at
c33e76b05fda6a9bdaa7beea7527414b13d74c1b (release record PR #47), carrying the entry-lifecycle,
concept-search, search-performance, and searchable-deployments line merged in
PRs #43, #44, #45 and #46 (feature head
cf55fd735d091172222801d551ee989abb3b0319, all required contexts plus scale,
audit, and CodeQL green on each).

What changed since rc.5

• Search understands more than exact words — the build derives a concept
  map from the catalog's own writing and quietly widens each query with its
  top related words; a widened hit always ranks strictly below every literal
  one. Deterministic, tunable via _data/search.yml, off below 12 entries.
• Search at 1,000 entries is a measured budget, not a hope — the
  performance fixture builds 0/1/10/100/500/1,000-entry catalogs and real
  Chrome drives search, filtering, sorting and compare at every size against
  enforced scale_budgets; the measured table lives in docs/search.md.
• The cost of building search moved off the reader's path — where the
  browser has workers, the fetch/parse/index build runs in
  assets/js/search-worker.js and the page revives the serialized result; a
  finished build is kept in IndexedDB keyed to a version covering both the
  content and the index implementation, so a return visit to an unchanged
  catalog searches instantly and any upgrade retires stale caches on its own.
  A low-powered device facing a 300+-entry catalog gets an honest Load full
  search button with real progress instead of a silent stall; every worker
  or cache failure falls back to the original inline path.
• "How search works" — a public /about/search/ page explains the
  serverless, no-query-log architecture honestly, including the one caveat
  (the search persists in the address bar, so a shared or reloaded URL does
  travel to the host).
• Stale entries ask to be refreshed — the monthly sweep opens per-entry
  reminder issues @mentioning the submitter (new optional GitHub-username
  form field), the Refresh an entry form turns "still accurate" into a
  one-line verified: PR, and reminders close themselves once confirmed.
• Organizations can attach themselves to an entry — the Also deployed
  by form splices {label, url, email, note} items into the entry's list
  via a bot PR (resubmissions update in place, flagged as replacements for
  reviewer scrutiny), rendered wherever links render — and the listings are
  searchable, with contact addresses and URLs kept out of the index.
• Security signals, observed rather than asserted — a monthly sweep
  records each linked repository's existence, archive state, last push,
  license, security policy and OpenSSF Scorecard into deployment-owned data,
  rendered beside the maintainer-only security_review status under a
  standing disclaimer.

Full details: CHANGELOG
and the release-readiness status.

Known notes

• Code-scanning alerts #42 and #43 (js/client-side-request-forgery,
  js/missing-origin-check on assets/js/search-worker.js) are documented
  false positives — a dedicated worker reachable only by its creating page,
  with the fetch target pinned to a same-origin path — awaiting maintainer
  dismissal in the repository Security tab.
• BCHC consumed v1.9.0-rc.5 via
  its update PR #14
  on 2026-08-26 and is locked there. The rc.6 update requires the
  security-signals ownership migration
  (BCHC PR #29)
  first — the updater correctly fails closed on the contract change — and the
  candidate update PR follows from rerunning Update from PHCT after it.

Rollback point

v1.9.0-rc.5 at 607169f1b12c6bb44e959e626c19f2ca9eefa6f0.

🤖 Generated with Claude Code

v1.9.0-rc.5

Fifth release candidate for v1.9.0. Cut from protected main at
607169f1b12c6bb44e959e626c19f2ca9eefa6f0 (release record PR #38), carrying the
visual polish pass and flat-by-default imagery merged in PRs #34, #35 and #37
(61150bba1737fa3a957f5040c52cc5f3b2a34765, all checks green after a full CI re-run
following the 2026-08-26 GitHub Actions outage).

What changed since rc.4

• Illustration slots on every surface — hero, social link-preview card, submit form
  and its paused state, about, events, resources, governance, cohort journey, four empty
  states, the 404 page, the wizard's success moment, and an optional background texture,
  all exposed as _data/*.yml keys a deployment fills with its own artwork
  (npm run images builds AVIF/WebP derivatives). The keys ship blank: every surface
  renders a polished flat treatment out of the box.
• Real steppers — the submit progress rail and the setup wizard's step pills became
  actual steppers; review and confirmation panels gained hierarchy and a drawn-check
  success moment; submit.accepting: false pauses intake without removing the page.
• AGENTS.md — a setup runbook for AI coding agents handed a copy of this
  template: what to ask before configuring, which files the copy owns versus the
  template, the configure → generate → validate loop, and the GitHub settings only a
  human can click.
• Accessibility gate expansion — /compare/, the A–Z directory and the 404 page
  are now audited on every pull request.
• Mobile and contrast fixes — past event rows keep WCAG AA text contrast (grayscale
  instead of opacity), three grid layouts no longer overflow 320–414px viewports, and
  the showcase example switcher's open menu no longer slides under the sticky header.

Full details: CHANGELOG
and the release-readiness status.

Known notes

• The CodeQL annotations recorded on the rc.4 release remain documented false positives
  awaiting maintainer dismissal in the repository Security tab.

Rollback point

v1.9.0-rc.4 at c41149eaacab353c82403477bf0c5b2f26a48650.

🤖 Generated with Claude Code

v1.9.0-rc.4

Fourth release candidate for v1.9.0. Cut from protected main at
c41149eaacab353c82403477bf0c5b2f26a48650 (release record PR #33), carrying the
non-coder workflow audit remediation merged in PR #32
(f22c67b277cc6005d8217410b4ab7aa56827b846).

What changed since rc.3

• Every issue-form flow answers the submitter on every exit — script rejections in
  plain English, a catch-all comment with the exact Workflow permissions click-path
  when the pull request itself is refused, dedicated replies for already-exists /
  nothing-changed / closed states, and "Updated the pull request from your edit" on
  issue edits instead of a repeated first-time comment.
• Downstream updater legibility — a step summary for every way a run can end, and
  "already up to date" is now a reachable green no-op (re-recording an unchanged release
  preserves the version lock's original recorded_at). The tag gate is a whole-string
  match, closing a GITHUB_OUTPUT injection window.
• New missing-label workflow flags issue-form submissions whose content:* label
  was dropped because Bootstrap labels never ran.
• Scheduled workflows explain themselves when their module is off and post
  what-to-do summaries on failure; the verification sweep caps its listing and can be
  run manually.
• Setup wizard repository guard — derives the repository from the *.github.io
  address it is served on and refuses, case-insensitively and only on a positively
  detected copy, a configuration still pointing at the template repository.
• Docs — docs/launch.md is the single settings walkthrough; docs/admin-guide.md
  gains bot-PR and scheduled-workflow troubleshooting; the repository transfer
  procedure is a numbered checklist.

Full details: CHANGELOG
and the release-readiness status.

Known notes

• Seven open CodeQL annotations on PR #32 are documented false positives awaiting
  maintainer dismissal (six test-assertion URL-substring flags, one by-design
  http-to-file-access in scripts/metrics.mjs); reasoning is recorded on the PR.

Rollback point

v1.9.0-rc.3 at a9741c9845e0928ec6b6654e6e04b6ebe71c2233.

🤖 Generated with Claude Code

PHCT v1.9.0-rc.3

PHCT v1.9.0-rc.3

PHCT v1.9.0-rc.3 is the release candidate that adds the stepped submission form to the wider-demo validation line. It is not the stable release or a BCHC organizational handoff.

• Full commit: a9741c9845e0928ec6b6654e6e04b6ebe71c2233
• Git tree: 3e2bfbb449d509ad398412c088c3824530afd6bd
• Stable rollback point: v1.8.1
• Supersedes: v1.9.0-rc.2, which the published BCHC demo is currently locked to

Change summary

• The submission form now walks one schema group at a time: Next validates the step it leaves, Back and completed rail sections move freely, and the section heading takes focus on every move. A "Hide the optional questions" toggle trims the form to required fields only, and the saved draft remembers both the step and the toggle. A single-group schema and the no-JavaScript fallback keep the flat one-page form. (#30)
• THIRD_PARTY_NOTICES.md now records provenance and complete license text for every copied script, generated icon, and bundled font, pinned by SHA-256 in quality/vendored-assets.json; the license gate fails closed on unreviewed changes.
• The issue chooser routes documentation corrections through a structured form and security vulnerabilities to GitHub's private advisory form; setup (browser, terminal, and issue-driven) regenerates the same chooser so fresh copies cannot retain upstream reporting links.
• The modified Adobe font subsets use the distinct family names PHCT Sans and PHCT Serif with upstream license metadata retained, satisfying the Reserved Font Name condition without changing deployed typography.
• Shared mobile actions meet the 44 × 44 px touch-target contract across all surfaces, measured on rendered boxes by the real-Chrome assistive-flow gate.
• Downstream update check dispatches have a 45-second bound and three-attempt backoff, with safe failure and nontechnical recovery steps; the downstream generator rebuilds the complete issue chooser from protected repository identity after an update.

Security and compatibility

• Exact npm and Bundler advisory audits, CodeQL, dependency-license review, security-exception validation, CycloneDX generation, browser/accessibility checks, and performance/scale gates passed on this exact commit (links below).
• The tested support ceiling is 100 entries. The 500- and 1,000-entry fixtures remain characterization evidence, not a support claim.
• The downstream updater protects BCHC identity, governance, schema, content, media, naming, and demo configuration with before/after checksums, and requires the repository-scoped PHCT_UPDATE_TOKEN for releases that change .github/workflows (this release does not).

BCHC candidate procedure

1. In BCHC, run Actions → Update from PHCT with exact release v1.9.0-rc.3.
2. Confirm the generated pull request records this parent commit, the verified downstream commit, the publication bundle digest, and the previous v1.9.0-rc.2 lock.
3. Review the protected-path checksum report, generated-file changes, preview artifact, migrations, and every downstream check before merging.

Rollback

Before the downstream candidate merges, close its pull request and delete the machine branch; the published BCHC site remains at its v1.9.0-rc.2 lock. If the update is later merged, revert that merge through a normal reviewed pull request. Never rewrite main or move this tag.

Evidence

• Stepped submission form and release cut
• Exact-commit supply chain
• Exact-commit CodeQL
• Exact-commit build and deployment
• Exact-commit performance and scale
• Exact-commit browser quality and accessibility
• Attached CycloneDX 1.5 SBOM: 328 components; SHA-256 383d57d8d55467c6bec9d1e99973a7acd85e8ab76917d64118a16c9a13d0b65f

PHCT v1.9.0-rc.2

PHCT v1.9.0-rc.2

PHCT v1.9.0-rc.2 is the corrected, audited release candidate for the wider-demo validation. It is not the stable release or a BCHC organizational handoff.

• Full commit: bb2e44714969d261ce77860ddd27af8c5d9626d0
• Git tree: 2e4815abed84626524e119d8625e5509d3eed84f
• Stable rollback point: v1.8.1
• Supersedes: v1.9.0-rc.1, retained only as immutable failure evidence

Change summary

• Adds the protected, ownership-aware PHCT-to-deployment updater, immutable version lock, exact-toolchain verification, and the full release-readiness system introduced in rc.1.
• Fixes workflow-file publication with a dedicated, repository-scoped PHCT_UPDATE_TOKEN while leaving routine content automation on its narrower credential.
• Detects workflow changes and fails with actionable setup guidance when the required credential is absent.
• Keeps the workflow-capable credential out of checkout, dependency installation, generation, verification, candidate processes, and candidate-controlled Git hooks.
• Transfers the verified downstream commit through a digest-checked Git bundle into a fresh publication runner that never checks out or executes the candidate.

Security and compatibility

• Exact npm and Bundler advisory audits, CodeQL, dependency-license review, security-exception validation, CycloneDX generation, browser/accessibility checks, and performance/scale gates passed on this exact commit.
• The publication runner receives PHCT_UPDATE_TOKEN only after bundle integrity and exact commit matching succeed. The token is stored in neither the remote URL nor Git configuration.
• The tested support ceiling is 100 entries. The 500- and 1,000-entry fixtures remain characterization evidence, not a support claim.
• The downstream updater protects BCHC identity, governance, schema, content, media, naming, and demo configuration with before/after checksums.

BCHC candidate procedure

1. In BCHC, run Actions → Update from PHCT with exact release v1.9.0-rc.2.
2. Confirm the generated pull request records this parent commit, the verified downstream commit, the publication bundle digest, and the previous lock.
3. Review the protected-path checksum report, generated-file changes, preview artifact, migrations, and every downstream check.
4. Keep the candidate pull request unmerged until wider-demo review and rollback evidence are complete.

Rollback

Before the downstream candidate merges, close its pull request and delete the machine branch; the published BCHC site remains unchanged at its current lock. If an update is later merged, revert that merge through a normal reviewed pull request. Never rewrite main or move this tag.

Evidence

• Updater credential and clean-runner remediation
• Exact-commit supply chain
• Exact-commit CodeQL
• Exact-commit build and deployment
• Exact-commit performance and scale
• Exact-commit browser quality and accessibility
• Attached CycloneDX 1.5 SBOM: 326 components; SHA-256 8fd51a1fcfb661178372d36b97aa4e849491da51a8ed0350cfa7ef7c8eb4939b

PHCT v1.9.0-rc.1

PHCT v1.9.0-rc.1

Warning

Superseded by the v1.9.0-rc.2 remediation. The first real BCHC run resolved this tag, preserved
all 116 protected files, regenerated the deployment, passed npm run verify, and retained its
preview/checksum artifact. GitHub then refused the update-branch push because the built-in
Actions token cannot update .github/workflows. Do not use this candidate for a downstream
merge; the immutable tag remains as release evidence.

PHCT v1.9.0-rc.1 is the audited release candidate for wider-demo validation. It is not the stable release or a BCHC organizational handoff.

• Full commit: 4b02b7b19a2dc793d313d37da49acff66811e691
• Rollback point: v1.8.1

Change summary

• Adds the protected, ownership-aware PHCT-to-deployment updater and immutable version lock.
• Adds reproducible doctor/verify commands, complete preset and module builds, coverage, CodeQL, supply-chain, license, SBOM, accessibility, Lighthouse, link, and scale gates.
• Adds the real-Chrome supported-scale interaction budget and final search/filter performance fixes.
• Adds maintainer, support, incident, rollback, backup, and downstream-update documentation.

Security and compatibility

• Exact npm and Bundler advisory audits, CodeQL, secret scanning, license policy, expiring security exceptions, and CycloneDX evidence pass on this tree.
• The tested support ceiling is 100 entries. The 500- and 1,000-entry fixtures are characterization evidence, not a support claim.
• No BCHC identity, governance, schema, content, media, naming, or demo configuration should be copied from PHCT. The updater snapshots and verifies these protected paths byte-for-byte.

Migration actions

• Do not hand-copy this release into a deployment.
• In BCHC, run Actions → Update from PHCT with release v1.9.0-rc.1.
• Review generated-file changes, protected-path checksum evidence, the preview artifact, and every dispatched check before merging any downstream update.

Generated files

The downstream workflow regenerates declared generated outputs using the candidate generator after reconciling template-owned files. Those generated changes remain reviewable in the downstream pull request.

Rollback

Before a downstream merge, close the candidate update PR and retain the existing v1.7.0 lock. If an update is later merged, revert its merge commit through a normal reviewed PR; never rewrite main or move this tag.

Evidence

• Audit implementation
• Release-record correction
• Final merge supply chain
• Final merge performance
• Final merge browser quality
• Attached CycloneDX 1.5 SBOM SHA-256: fa47d85d41d6cf199393cdf799578c13fcdfc74aac10b98b51cd262268f32bf3

v1.8.1 — Pub Health Catalog Template (PHCT)

Changed

• The template has a name: Pub Health Catalog Template (PHCT). The repository
  is now crypticpy/phct, the landing is titled accordingly and the package is
  phct. GitHub redirects the old bchc-template remote and web URLs, so existing
  forks' template remotes keep working; update them at leisure (git remote set-url template https://github.com/crypticpy/phct.git). The Pages URL moved to
  https://crypticpy.github.io/phct/ — the old one does not redirect.

Removed

• The day-one starter site. crypticpy/bchc-catalog-starter is archived; with a
  live example of every preset it no longer earned its keep. demo_starter_url and
  the landing's starter_url ship blank — the feature stays (set either to a copy of
  your own and the links come back), only the default target is gone.

v1.8.0 — the template is a template again

The template is a template again. Its working tree used to be one
organization's live catalog, so a copy made from it started life wearing that
organization's name, tagline, logo mark, footer and governance text — and the
first job of anyone forking it was to find and undo all of that. The named
catalog now has its own repository and this one ships a generic identity.

Changed

• The shipped configuration is organization-agnostic. _data/site.yml,
  _data/governance.yml, _data/showcase.yml, _config.yml and the LICENSE
  no longer name a real organization. The site ships as "AI Use Case Catalog"
  by an invented "Civic AI Community of Practice", which is what choosing the
  ai-use-cases preset in the setup wizard describes: a public-sector
  community of practice sharing what it has built. The governance page keeps
  its structure and reads as a worked example rather than one body's adopted
  policy.
• The ai-use-cases showcase example (/examples/ai-use-cases/) carries
  that generic identity and a refreshed set of sample entries, so the flagship
  example demonstrates the preset rather than a particular deployment.
  The ten new entries are org-agnostic public-sector use cases (permit
  intake triage, council meeting summaries, records-request redaction, …),
  written to the same standard as before; docs worked examples and test
  fixtures were re-pointed at them so nothing in the repository quotes the
  old deployment's data.

Removed

• The named deployment moved out. The health-coalition catalog this
  template was first built for now lives at
  crypticpy/bchc-ai-use-case-catalog,
  where its content, branding and adopted governance text belong. This
  repository stays the generic template; the repository slug bchc-template
  is unchanged so existing forks, remotes and links keep working.
• docs/dmwg-alignment-plan.md and docs/BCHC_DMWG_AI_Resource_info.md,
  the source framework and the field-by-field plan behind v1.5.0 and v1.6.0.
  They describe one work group's adopted framework, so they moved to that
  repository with it. What they produced — the schema fields, the governance
  module, the review workflow — is unchanged and documented in
  docs/content-model.md and
  docs/configuration.md.