v1.0.0

v1.0.0

• Release type: stable GA package and local dashboard release
• Release source SHA: 23d66717c0627b25a8c56895bba9627bcdd69cca
• Previous prerelease: v0.4.46-beta.1
• Tracking issues / source PRs: #396, #421, #443, #444, #445, #446, #447, #448, #450, #451
• Release metadata base SHA: 7453349008ca8f23641fab1665ac909d0b51b10a
• Package artifact: neondiff@1.0.0 published to npm latest
• Rollback baseline: v0.4.46-beta.1

Purpose

Cut the first stable NeonDiff release.

The 1.0 launch bar is intentionally narrow: npm install -g neondiff installs
the CLI, neondiff dashboard opens the local HTML setup/status dashboard, the
dashboard can verify provider API-key readiness with redacted output, and the
minimal Mac launcher opens that same dashboard. Signed desktop packaging,
notarization, Sparkle appcast, and auto-update maturity remain post-launch work.

Included Changes

• Publish the public npm package as neondiff@1.0.0.
• Move first-run install docs and the website installer default from the held
  beta package to the latest npm path.
• Keep the local dashboard as the GA setup surface for license status, GitHub
  App status, daemon status, and provider readiness.
• Include the minimal Mac launcher/smoke lane as GA proof only for opening the
  same dashboard, not as signed desktop maturity.
• Promote the license API from health-only proof to configured checkout
  issuance proof:
  • unauthenticated issuance fails closed with HTTP 401;
  • owner-held authenticated smoke writes only a redacted prefix/fingerprint
    proof;
  • product validator activation accepts a live nd_live_ key minted by the
    license API.

Required Gates

• Release metadata PR checks must pass on the current head.
• Focused public readiness checks:
  • npm test -- --run tests/public-release-readiness.test.ts tests/release-status.test.ts --pool=forks --maxWorkers=1
  • npm run build
  • node scripts/check-public-claims.mjs
  • node scripts/check-secret-scan.mjs
  • git diff --check
• License API proof:
  • docs/evidence/v1.0.0-license-api-healthz.json
  • docs/evidence/v1.0.0-license-checkout-issuance-unauthenticated.json
  • docs/evidence/license-checkout-issuance-authenticated.json
• Runtime/payment proof:
  • docs/evidence/v1.0.0-live-checkout-success-redacted.json
  • docs/evidence/license-checkout-issuance-authenticated.json
• Rollback target proof:
  • docs/evidence/v1.0.0-rollback-refs.json
• After merge and publish:
  • npm view neondiff version dist-tags --json shows latest at 1.0.0;
  • npm install -g neondiff installs 1.0.0;
  • neondiff dashboard --config config.local.json opens the local HTML dashboard;
  • GitHub Release v1.0.0 is non-prerelease and points at this packet.

Caveats

• This release does not claim CodeRabbit parity, calibrated 95% review accuracy,
  auto-merge, approvals, native ZCode skills/MCP/memory, or target-repo mutation.
• This release does not ship signed/notarized desktop artifacts, Sparkle
  appcast, or auto-update proof. Those remain tracked by #116 and #449.
• Live checkout proof used the owner-approved QA promo path, redacted success
  page state, and a Stripe-style signed replay after the schema fix. It does
  not claim the original in-flight Stripe delivery was accepted before that
  fix, and it does not publish raw license keys, webhook secrets, fulfillment
  tokens, customer-sensitive checkout payloads, or operator-local scratch paths.

Rollback

: "${REPO_ROOT:?set REPO_ROOT to your local NeonDiff checkout}"

cd "$REPO_ROOT"
git fetch origin --tags
git checkout main
git reset --hard refs/tags/v0.4.46-beta.1
npm dist-tag add neondiff@0.4.30-beta.1 latest

Website rollback is scoped to the website repo, not this product checkout:

git -C /path/to/neon-diff-agent-website revert 6b670d00cd587fb7d564347b6bc0d4d3e8d13186