From 7443df245f41f1347c9be6ea1379721bebda3f89 Mon Sep 17 00:00:00 2001
From: Ompragash <ompragash.viswanathan@gmail.com>
Date: Tue, 28 Jul 2026 11:12:33 +0530
Subject: [PATCH] document agentctl 0.3.0 workflow API v1

---
 .github/workflows/pages.yml                    |  2 +-
 astro.config.mjs                               |  2 +-
 docs/execution/AGENTCTL_DOCS_DECISIONS.md      |  7 ++++++-
 .../AGENTCTL_DOCS_INFORMATION_ARCHITECTURE.md  |  2 +-
 public/meta/agentctl-source.json               |  6 +++---
 scripts/content-manifest.mjs                   |  6 +++---
 scripts/sync-agentctl.mjs                      |  2 +-
 src/components/Header.astro                    |  2 +-
 src/components/Homepage.astro                  |  6 +++---
 .../_generated/architecture/decisions/0001.md  |  2 +-
 .../_generated/architecture/decisions/0002.md  |  2 +-
 .../_generated/architecture/decisions/0003.md  |  2 +-
 .../_generated/architecture/decisions/0004.md  |  2 +-
 .../_generated/architecture/decisions/0005.md  |  2 +-
 .../_generated/architecture/decisions/0006.md  |  2 +-
 .../_generated/architecture/decisions/0007.md  |  2 +-
 .../docs/_generated/architecture/diagrams.md   |  5 +++--
 .../docs/_generated/architecture/index.md      |  2 +-
 .../concepts/framework-completeness.md         |  2 +-
 src/content/docs/_generated/concepts/memory.md |  2 +-
 src/content/docs/_generated/concepts/packs.md  |  2 +-
 .../docs/_generated/concepts/policies.md       |  2 +-
 .../docs/_generated/concepts/product.md        | 17 +++++++++++++----
 src/content/docs/_generated/concepts/tools.md  |  2 +-
 .../docs/_generated/concepts/workflow-model.md |  8 +++++---
 .../docs/_generated/contributing/add-action.md |  2 +-
 .../_generated/contributing/add-migration.md   |  2 +-
 .../_generated/contributing/add-provider.md    |  2 +-
 .../_generated/contributing/developer-guide.md |  2 +-
 .../_generated/contributing/documentation.md   |  2 +-
 .../docs/_generated/contributing/index.md      |  2 +-
 .../docs/_generated/contributing/release.md    | 13 +++++++------
 .../docs/_generated/contributing/testing.md    |  2 +-
 .../docs/_generated/durable-execution/index.md |  2 +-
 .../docs/_generated/examples/approval-gated.md |  4 ++--
 .../_generated/examples/ci-quality-gate.md     |  4 ++--
 .../examples/provider-portability.md           |  6 +++---
 .../_generated/examples/recorded-replay.md     |  4 ++--
 .../_generated/examples/release-readiness.md   |  4 ++--
 .../_generated/examples/repository-audit.md    |  4 ++--
 .../_generated/examples/scheduled-review.md    |  4 ++--
 .../_generated/getting-started/first-agent.md  |  2 +-
 .../docs/_generated/getting-started/index.md   |  2 +-
 .../_generated/getting-started/installation.md |  9 +++++----
 src/content/docs/_generated/guides/ci-cd.md    |  4 ++--
 .../docs/_generated/guides/container.md        | 18 +++++++++---------
 .../docs/_generated/guides/local-operation.md  |  2 +-
 .../docs/_generated/guides/selective-repair.md |  2 +-
 .../_generated/guides/workflow-authoring.md    |  4 ++--
 .../docs/_generated/observability/index.md     |  2 +-
 .../docs/_generated/operations/scheduled.md    |  2 +-
 src/content/docs/_generated/providers/a2a.md   |  2 +-
 src/content/docs/_generated/providers/index.md |  2 +-
 src/content/docs/_generated/providers/mcp.md   |  2 +-
 .../docs/_generated/reference/capabilities.md  |  2 +-
 src/content/docs/_generated/reference/cli.md   |  6 +++---
 .../docs/_generated/reference/compatibility.md | 17 ++++++++++++-----
 .../reference/completeness-verification.md     |  2 +-
 .../docs/_generated/reference/database.md      |  2 +-
 .../docs/_generated/reference/environment.md   |  2 +-
 .../reference/limitation-burndown.md           |  2 +-
 .../docs/_generated/reference/limitations.md   |  9 ++++++---
 .../reference/live-framework-verification.md   |  2 +-
 .../docs/_generated/reference/migration.md     |  4 ++--
 .../docs/_generated/reference/output.md        |  2 +-
 .../docs/_generated/reference/terminology.md   |  2 +-
 src/content/docs/_generated/reference/yaml.md  |  4 ++--
 src/content/docs/_generated/security/index.md  |  2 +-
 .../docs/_generated/security/threat-model.md   |  2 +-
 .../docs/_generated/troubleshooting/index.md   |  5 +++--
 src/content/docs/overview.md                   | 14 +++++++++++---
 src/content/docs/why-agentctl.md               |  6 +++++-
 src/data/agentctl-source.json                  |  6 +++---
 src/data/home-workflow.yaml                    |  2 +-
 tests/site.spec.ts                             |  2 +-
 75 files changed, 170 insertions(+), 128 deletions(-)

diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 607d2c0..43b012b 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -15,7 +15,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  AGENTCTL_COMMIT: "736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47"
+  AGENTCTL_COMMIT: "2aeaa88fba71162206b5f08f5bda4f0150247e4f"
   NODE_VERSION: "24.4.1"
   PNPM_VERSION: "11.9.0"
   RUST_TOOLCHAIN: "1.88.0"
diff --git a/astro.config.mjs b/astro.config.mjs
index 1717fbe..3f7303d 100644
--- a/astro.config.mjs
+++ b/astro.config.mjs
@@ -56,7 +56,7 @@ export default defineConfig({
         {
           label: 'Start here',
           items: [
-            { slug: 'overview', label: 'Overview', badge: 'v1alpha1' },
+            { slug: 'overview', label: 'Overview', badge: 'v1' },
             { slug: 'why-agentctl', label: 'Why agentctl' },
             { slug: 'concepts/product', label: 'Product definition' },
             { slug: 'concepts/framework-completeness', label: 'Framework completeness' },
diff --git a/docs/execution/AGENTCTL_DOCS_DECISIONS.md b/docs/execution/AGENTCTL_DOCS_DECISIONS.md
index 758269c..338500f 100644
--- a/docs/execution/AGENTCTL_DOCS_DECISIONS.md
+++ b/docs/execution/AGENTCTL_DOCS_DECISIONS.md
@@ -28,7 +28,12 @@ A checked manifest maps canonical source files to public routes. The importer fa
 
 Status: accepted, 2026-07-23.
 
-Public pages distinguish deterministic tests, mock-protocol tests, retained live OpenAI evidence, locally executed container evidence, hosted CI configuration, hosted CI execution, syntax validation, deferred work, and unsupported work. The site calls the project a `v1alpha1` release candidate preparation, not stable or production proven.
+Public pages distinguish deterministic tests, mock-protocol tests, retained
+live OpenAI evidence, locally executed container evidence, hosted CI execution,
+syntax validation, deferred work, and unsupported work. The site identifies
+`agentctl.dev/v1` as the stable workflow document API while keeping the 0.3 CLI
+and crates explicitly pre-1.0 and avoiding unsupported production or provider
+claims.
 
 ## D006: Static and restrained design
 
diff --git a/docs/execution/AGENTCTL_DOCS_INFORMATION_ARCHITECTURE.md b/docs/execution/AGENTCTL_DOCS_INFORMATION_ARCHITECTURE.md
index b878462..39baa84 100644
--- a/docs/execution/AGENTCTL_DOCS_INFORMATION_ARCHITECTURE.md
+++ b/docs/execution/AGENTCTL_DOCS_INFORMATION_ARCHITECTURE.md
@@ -16,7 +16,7 @@
 - Architecture
 - Contributing
 - GitHub
-- `v1alpha1` maturity indicator
+- workflow API `v1` indicator
 
 ## Learning paths
 
diff --git a/public/meta/agentctl-source.json b/public/meta/agentctl-source.json
index eb3f9d8..95c4d07 100644
--- a/public/meta/agentctl-source.json
+++ b/public/meta/agentctl-source.json
@@ -1,8 +1,8 @@
 {
   "product": "agentctl",
-  "version": "0.2.0",
-  "workflowApi": "agentctl.dev/v1alpha1",
-  "commit": "736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47",
+  "version": "0.3.0",
+  "workflowApi": "agentctl.dev/v1",
+  "commit": "2aeaa88fba71162206b5f08f5bda4f0150247e4f",
   "dirty": false,
   "sourceRepository": "https://github.com/opensourceops/agentctl",
   "importedFiles": 61
diff --git a/scripts/content-manifest.mjs b/scripts/content-manifest.mjs
index 703cf6b..28c54ae 100644
--- a/scripts/content-manifest.mjs
+++ b/scripts/content-manifest.mjs
@@ -6,7 +6,7 @@ export const contentManifest = [
   ['docs/TOOLS.md', '_generated/concepts/tools.md', 'Tools and effects', 'Tool contracts, effect classes, idempotency, and deterministic checks.'],
   ['docs/memory.md', '_generated/concepts/memory.md', 'State and memory', 'Separate runtime state, working memory, long-term memory, and prompt cache.'],
   ['docs/PACKS.md', '_generated/concepts/packs.md', 'Reusable packs', 'Use versioned local content with integrity verification.'],
-  ['docs/guides/INSTALLATION.md', '_generated/getting-started/installation.md', 'Installation', 'Build or install the current v1alpha1 candidate from reviewed source.'],
+  ['docs/guides/INSTALLATION.md', '_generated/getting-started/installation.md', 'Installation', 'Build or install agentctl 0.3 with workflow API v1 from reviewed source.'],
   ['docs/guides/GETTING_STARTED.md', '_generated/getting-started/index.md', 'Getting started', 'Run and inspect a credential-free deterministic workflow.'],
   ['docs/guides/FIRST_AGENT_WORKFLOW.md', '_generated/getting-started/first-agent.md', 'First agent workflow', 'Run a bounded tool-using agent without a paid API key.'],
   ['docs/guides/WORKFLOW_AUTHORING.md', '_generated/guides/workflow-authoring.md', 'Author workflows', 'Learn workflow YAML in execution order.'],
@@ -42,7 +42,7 @@ export const contentManifest = [
   ['docs/execution/COMPLETENESS_VERIFICATION.md', '_generated/reference/completeness-verification.md', 'Completeness verification', 'Deterministic, container, security, and independent review evidence.'],
   ['docs/execution/LIVE_FRAMEWORK_VERIFICATION.md', '_generated/reference/live-framework-verification.md', 'Live framework verification', 'Sanitized GPT-5.6 scenario, recovery, replay, usage, and container evidence.'],
   ['docs/COMPATIBILITY.md', '_generated/reference/compatibility.md', 'Compatibility', 'Preserved, migrated, changed, removed, and explicit non-goal contracts.'],
-  ['docs/MIGRATING_FROM_TYPESCRIPT.md', '_generated/reference/migration.md', 'Migrate from TypeScript', 'Translate supported legacy workflows to strict v1alpha1 YAML.'],
+  ['docs/MIGRATING_FROM_TYPESCRIPT.md', '_generated/reference/migration.md', 'Migrate from TypeScript', 'Translate supported legacy workflows to strict workflow API v1 YAML.'],
   ['docs/ARCHITECTURE.md', '_generated/architecture/index.md', 'Architecture overview', 'Crate boundaries, execution, determinism, concurrency, and packaging.'],
   ['docs/architecture/DIAGRAMS.md', '_generated/architecture/diagrams.md', 'Architecture diagrams', 'Fourteen verified diagrams for compilation, state, effects, recovery, deployment, and crates.'],
   ['docs/adr/0001-deterministic-core-explicit-effects.md', '_generated/architecture/decisions/0001.md', 'ADR 0001: Deterministic core', 'Keep graph, policy, state, and replay model-independent.'],
@@ -59,5 +59,5 @@ export const contentManifest = [
   ['docs/development/ADD_MIGRATION.md', '_generated/contributing/add-migration.md', 'Add a store migration', 'Version and test forward SQLite migrations.'],
   ['docs/development/DOCUMENTATION.md', '_generated/contributing/documentation.md', 'Write documentation', 'Own content in the right repository and verify it end to end.'],
   ['docs/TESTING.md', '_generated/contributing/testing.md', 'Testing strategy', 'Credential-free gates, acceptance layers, fuzzing, and live evidence.'],
-  ['docs/RELEASE_PROCESS.md', '_generated/contributing/release.md', 'Release process', 'Prepare and verify a v1alpha1 release candidate without overstating evidence.']
+  ['docs/RELEASE_PROCESS.md', '_generated/contributing/release.md', 'Release process', 'Prepare and verify an exact-commit release without overstating evidence.']
 ];
diff --git a/scripts/sync-agentctl.mjs b/scripts/sync-agentctl.mjs
index c16b620..e2f86ca 100644
--- a/scripts/sync-agentctl.mjs
+++ b/scripts/sync-agentctl.mjs
@@ -221,7 +221,7 @@ await copyFile(
 const metadata = {
   product: 'agentctl',
   version,
-  workflowApi: 'agentctl.dev/v1alpha1',
+  workflowApi: 'agentctl.dev/v1',
   commit,
   dirty,
   sourceRepository: 'https://github.com/opensourceops/agentctl',
diff --git a/src/components/Header.astro b/src/components/Header.astro
index abbd5f9..548d6c7 100644
--- a/src/components/Header.astro
+++ b/src/components/Header.astro
@@ -14,7 +14,7 @@ const base = import.meta.env.BASE_URL;
 <div class="site-header">
   <div class="title-wrapper sl-flex">
     <SiteTitle />
-    <span class="maturity" aria-label="Workflow API maturity: version 1 alpha 1">v1alpha1</span>
+    <span class="maturity" aria-label="Workflow API version 1">v1</span>
   </div>
   <nav class="top-links" aria-label="Primary">
     <a href={`${base}overview/`}>Docs</a>
diff --git a/src/components/Homepage.astro b/src/components/Homepage.astro
index 8ecf114..5deb7b4 100644
--- a/src/components/Homepage.astro
+++ b/src/components/Homepage.astro
@@ -166,15 +166,15 @@ const shortCommit = source.commit.slice(0, 8);
       <p class="eyebrow">Current maturity</p>
       <h2 id="maturity-title">Exact-commit evidence across local and hosted gates</h2>
       <p>
-        The workflow API is <code>agentctl.dev/v1alpha1</code>. Deterministic composition, durable recovery,
+        The workflow API is <code>agentctl.dev/v1</code>. Deterministic composition, durable recovery,
         local persistence, native Linux arm64 containers, and bounded GPT-5.6 journeys have executable evidence.
-        The pinned candidate also passed hosted Linux x64, macOS arm64, Windows x64, container, security,
+        The pinned 0.3 release source also passed hosted Linux x64, macOS arm64, Windows x64, container, security,
         package, SBOM, and release-preparation gates. Other native providers and protocols have mock coverage
         at documented levels.
       </p>
     </div>
     <ul>
-      <li>No stable v1 compatibility promise</li>
+      <li>Stable workflow API v1; CLI and crates remain pre-1.0</li>
       <li>No exactly-once or in-process sandbox claim</li>
       <li>No distributed or cross-run scheduler claim</li>
       <li>No claim of live validation across every provider</li>
diff --git a/src/content/docs/_generated/architecture/decisions/0001.md b/src/content/docs/_generated/architecture/decisions/0001.md
index 31e9815..b56bde5 100644
--- a/src/content/docs/_generated/architecture/decisions/0001.md
+++ b/src/content/docs/_generated/architecture/decisions/0001.md
@@ -8,4 +8,4 @@ Status: accepted, 2026-07-22.
 The graph, policy, state machine, persistence decisions, and recorded replay remain model-independent. Provider, tool, filesystem, process, MCP, A2A, internal-state mutation, clock, and ID behavior cross injected interfaces and receive durable effect identity when externally observable.
 
 This keeps models replaceable and tests credential-free. It requires more records and conservative uncertain states, but avoids hidden calls during replay. Dynamic model-owned orchestration is rejected.
-> Canonical source: [`docs/adr/0001-deterministic-core-explicit-effects.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0001-deterministic-core-explicit-effects.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/adr/0001-deterministic-core-explicit-effects.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0001-deterministic-core-explicit-effects.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/architecture/decisions/0002.md b/src/content/docs/_generated/architecture/decisions/0002.md
index fc53244..c97b1c0 100644
--- a/src/content/docs/_generated/architecture/decisions/0002.md
+++ b/src/content/docs/_generated/architecture/decisions/0002.md
@@ -8,4 +8,4 @@ Status: accepted, 2026-07-22.
 Workflows use `apiVersion`, `kind`, `metadata`, and `spec`. The envelope is adopted because identity/version and evolution need unambiguous locations, not because another system uses it. All typed objects deny unknown fields and a generated JSON Schema is checked in.
 
 A narrow legacy translator provides actionable migration. General aliases and silent coercion are rejected because they make security review and durable reproduction ambiguous.
-> Canonical source: [`docs/adr/0002-versioned-strict-workflow-envelope.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0002-versioned-strict-workflow-envelope.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/adr/0002-versioned-strict-workflow-envelope.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0002-versioned-strict-workflow-envelope.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/architecture/decisions/0003.md b/src/content/docs/_generated/architecture/decisions/0003.md
index 998227f..234d5ed 100644
--- a/src/content/docs/_generated/architecture/decisions/0003.md
+++ b/src/content/docs/_generated/architecture/decisions/0003.md
@@ -8,4 +8,4 @@ Status: accepted, 2026-07-22.
 One versioned SQLite database is the local correctness store. Transactional task transitions/checkpoints/audits and a request-before-start effect ledger support resume and no-effect replay. Confirmed results are reused; started unconfirmed work becomes uncertain.
 
 No exactly-once claim is made. Automatic retry of ambiguous external effects is rejected. Fork is the explicit operation for fresh effects. Distributed history services are outside this release.
-> Canonical source: [`docs/adr/0003-sqlite-history-and-conservative-recovery.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0003-sqlite-history-and-conservative-recovery.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/adr/0003-sqlite-history-and-conservative-recovery.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0003-sqlite-history-and-conservative-recovery.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/architecture/decisions/0004.md b/src/content/docs/_generated/architecture/decisions/0004.md
index 5bd3da9..217fcd4 100644
--- a/src/content/docs/_generated/architecture/decisions/0004.md
+++ b/src/content/docs/_generated/architecture/decisions/0004.md
@@ -8,4 +8,4 @@ Status: accepted, 2026-07-22.
 OpenAI Responses, Azure OpenAI Responses, Anthropic Messages, Google Gemini generateContent, and a scripted fake implement one provider-neutral internal interface. Capabilities are negotiated before execution; provider SDK/HTTP shapes never enter durable core state.
 
 “OpenAI-compatible” shims are rejected as a support claim because they hide native tool, continuation, reasoning, error, and usage differences. Every provider requires mock protocol coverage; live credentials are optional evidence only.
-> Canonical source: [`docs/adr/0004-native-provider-adapters.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0004-native-provider-adapters.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/adr/0004-native-provider-adapters.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0004-native-provider-adapters.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/architecture/decisions/0005.md b/src/content/docs/_generated/architecture/decisions/0005.md
index 1c82840..bb07edb 100644
--- a/src/content/docs/_generated/architecture/decisions/0005.md
+++ b/src/content/docs/_generated/architecture/decisions/0005.md
@@ -13,4 +13,4 @@ their deterministic semantics existed. ADRs 0008, 0010, and 0011 now define
 those contracts. Sub-workflows, teams/handoffs, automatic
 reconnection/resubmission, executable plugin ABIs, and registries remain
 separate product decisions.
-> Canonical source: [`docs/adr/0005-narrow-v1-scheduling-and-extensions.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0005-narrow-v1-scheduling-and-extensions.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/adr/0005-narrow-v1-scheduling-and-extensions.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0005-narrow-v1-scheduling-and-extensions.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/architecture/decisions/0006.md b/src/content/docs/_generated/architecture/decisions/0006.md
index 4f9ab6c..50dad2f 100644
--- a/src/content/docs/_generated/architecture/decisions/0006.md
+++ b/src/content/docs/_generated/architecture/decisions/0006.md
@@ -20,4 +20,4 @@ resource requires serialization.
 ## Consequences
 
 Cron, systemd, Kubernetes, and CI can use normal process semantics without hidden terminal waits. The product avoids an eventing/distributed-control-plane surface. A future schedule-run key may improve deduplication, but it cannot replace external overlap controls or effect idempotency.
-> Canonical source: [`docs/adr/0006-schedulable-runtime-and-noninteractive-contract.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0006-schedulable-runtime-and-noninteractive-contract.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/adr/0006-schedulable-runtime-and-noninteractive-contract.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0006-schedulable-runtime-and-noninteractive-contract.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/architecture/decisions/0007.md b/src/content/docs/_generated/architecture/decisions/0007.md
index a2a3f58..c97576c 100644
--- a/src/content/docs/_generated/architecture/decisions/0007.md
+++ b/src/content/docs/_generated/architecture/decisions/0007.md
@@ -14,4 +14,4 @@ The image entrypoint is `agentctl`. Callers supply ordinary CLI arguments and on
 ## Consequences
 
 No vendor-specific plugin API is required. Platforms without direct entrypoint/argument support can invoke `docker run` from their normal shell step. Distroless reduces runtime surface but deliberately has no shell; debugging uses the public CLI or a separate diagnostic image, not mutation of production images.
-> Canonical source: [`docs/adr/0007-generic-oci-step-contract.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0007-generic-oci-step-contract.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/adr/0007-generic-oci-step-contract.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0007-generic-oci-step-contract.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/architecture/diagrams.md b/src/content/docs/_generated/architecture/diagrams.md
index fd2ed99..789e87f 100644
--- a/src/content/docs/_generated/architecture/diagrams.md
+++ b/src/content/docs/_generated/architecture/diagrams.md
@@ -3,7 +3,8 @@ title: "Architecture diagrams"
 description: "Fourteen verified diagrams for compilation, state, effects, recovery, deployment, and crates."
 editUrl: "https://github.com/opensourceops/agentctl/edit/main/docs/architecture/DIAGRAMS.md"
 ---
-These diagrams explain implemented `v1alpha1` behavior. Each diagram is paired with text so the relationship is available when Mermaid cannot render.
+These diagrams explain implemented workflow API v1 behavior. Each diagram is
+paired with text so the relationship is available when Mermaid cannot render.
 
 ## High-level system architecture
 
@@ -313,4 +314,4 @@ flowchart TD
 ```
 
 `agentctl-core` has no dependency on HTTP, SQLite, CLI parsing, or concrete executor types. `xtask` drives the built CLI for generation and acceptance.
-> Canonical source: [`docs/architecture/DIAGRAMS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/architecture/DIAGRAMS.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/architecture/DIAGRAMS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/architecture/DIAGRAMS.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/architecture/index.md b/src/content/docs/_generated/architecture/index.md
index 9616f35..84a8a73 100644
--- a/src/content/docs/_generated/architecture/index.md
+++ b/src/content/docs/_generated/architecture/index.md
@@ -78,4 +78,4 @@ ADR 0020. Run budget coordination is described by ADR 0021.
 The OCI build is multi-stage: only the optimized Rust binary enters a maintained distroless runtime with CA roots and a non-root identity. `/config` is workflow configuration, `/workspace` is the read-only working tree, `/state` holds SQLite and the content-addressed artifact store, and `/artifacts` receives declared workflow outputs. State must be mounted again for inspect/resume/replay/repair and artifact export. The root filesystem may be read-only. See [Container contract](/agentctl/guides/container/) and ADR 0007.
 
 See the [architecture diagrams](/agentctl/architecture/diagrams/), [ADRs](https://github.com/opensourceops/agentctl/blob/main/docs/adr/), and [Durable execution](/agentctl/durable-execution/) for failure semantics.
-> Canonical source: [`docs/ARCHITECTURE.md`](https://github.com/opensourceops/agentctl/blob/main/docs/ARCHITECTURE.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/ARCHITECTURE.md`](https://github.com/opensourceops/agentctl/blob/main/docs/ARCHITECTURE.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/concepts/framework-completeness.md b/src/content/docs/_generated/concepts/framework-completeness.md
index 9f45f61..3afe1e2 100644
--- a/src/content/docs/_generated/concepts/framework-completeness.md
+++ b/src/content/docs/_generated/concepts/framework-completeness.md
@@ -143,4 +143,4 @@ restricted-token/job-object backend is claimed.
 External schedulers own triggers and overlap policy. Containers, VMs, platform
 identities, and egress controls remain the strongest isolation boundary for
 hostile workloads.
-> Canonical source: [`docs/execution/FRAMEWORK_COMPLETENESS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/execution/FRAMEWORK_COMPLETENESS.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/execution/FRAMEWORK_COMPLETENESS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/execution/FRAMEWORK_COMPLETENESS.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/concepts/memory.md b/src/content/docs/_generated/concepts/memory.md
index 9621459..f2f1266 100644
--- a/src/content/docs/_generated/concepts/memory.md
+++ b/src/content/docs/_generated/concepts/memory.md
@@ -83,4 +83,4 @@ Entries are capped at 1 MiB, queries at 64 KiB, results at 100, embedding
 dimensions from 8 through 4096, and a local search scan at 10,000 active
 candidates. Corrupt or mismatched vector dimensions fail closed. Retention is
 applied during reads/search and by garbage collection, not by replay.
-> Canonical source: [`docs/memory.md`](https://github.com/opensourceops/agentctl/blob/main/docs/memory.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/memory.md`](https://github.com/opensourceops/agentctl/blob/main/docs/memory.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/concepts/packs.md b/src/content/docs/_generated/concepts/packs.md
index 706e794..63823a3 100644
--- a/src/content/docs/_generated/concepts/packs.md
+++ b/src/content/docs/_generated/concepts/packs.md
@@ -121,4 +121,4 @@ bundles, identity policy, unsigned process denial, and dependency reachability.
 Packaged acceptance scenario 42 verifies the checked-in transitive example,
 locks an extension pack, proves that its process cannot start before explicit
 trust authorization, executes it once, and replays without another invocation.
-> Canonical source: [`docs/PACKS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/PACKS.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/PACKS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/PACKS.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/concepts/policies.md b/src/content/docs/_generated/concepts/policies.md
index 7189cd8..fbf36aa 100644
--- a/src/content/docs/_generated/concepts/policies.md
+++ b/src/content/docs/_generated/concepts/policies.md
@@ -43,4 +43,4 @@ An approval stores the run/trace/task/agent, tool, capability, risk, redacted in
 Provider, MCP, A2A, filesystem, process, and environment allowlists are
 necessary controls, not a containment boundary. Use `isolation: container` or
 an externally managed container/VM boundary for untrusted executors.
-> Canonical source: [`docs/policies.md`](https://github.com/opensourceops/agentctl/blob/main/docs/policies.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/policies.md`](https://github.com/opensourceops/agentctl/blob/main/docs/policies.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/concepts/product.md b/src/content/docs/_generated/concepts/product.md
index febe67e..77dd78c 100644
--- a/src/content/docs/_generated/concepts/product.md
+++ b/src/content/docs/_generated/concepts/product.md
@@ -29,13 +29,22 @@ Workflow and pack authors are trusted to request work, but their requests remain
 
 ## Compatibility and maturity
 
-The current document API is `agentctl.dev/v1alpha1`; breaking changes may occur with explicit diagnostics and migration support. Machine output, plan, effects, runtime state, checkpoints, database schema, audit events, and protocol continuation all carry independent versions. Deprecations are documented for at least one compatibility window; incompatible durable state fails explicitly.
-
-Version 0.2 is a production-oriented alpha with executable evidence for the stated local, scheduled, and generic-container journeys. The workflow schema remains `v1alpha1`, so callers must pin the binary/image version. A stable release requires a frozen v1 workflow schema, accumulated cross-platform CI history, documented long-horizon database upgrade support, expanded compatibility fixtures, and a security review of any newly added executor.
+The current document API is `agentctl.dev/v1`. Additive compatible changes may
+extend it; incompatible workflow changes require a new document API version and
+explicit migration diagnostics. Machine output, plan, effects, runtime state,
+checkpoints, database schema, audit events, and protocol continuation all carry
+independent versions. Deprecations are documented for at least one compatibility
+window; incompatible durable state fails explicitly.
+
+Version 0.3 freezes the workflow schema as `agentctl.dev/v1` and has executable
+evidence for the stated local, scheduled, and generic-container journeys. The
+CLI and crates remain pre-1.0, so callers must still pin the binary or image
+version for runtime, provider, and storage behavior outside the workflow
+document contract.
 
 ## Differentiation
 
 This is not a chat-agent or multi-agent conversation framework: workflows, not conversations, own control flow. It is not CI/CD: it can run inside CI but does not manage runners or deployment environments. It borrows idempotence and check/diff vocabulary from Ansible without becoming configuration management. It borrows plan/effect separation from Terraform without owning infrastructure state. It is not a hosted orchestrator or general scripting language: one local process, SQLite, constrained templates, typed actions, and explicit remote effects are intentional boundaries.
 
 The differentiator is the combination of deterministic compilation, honest predictability, durable effect identity, recorded no-effect replay, compatibility-checked task-boundary repair, native provider portability, and policy decisions made outside the model.
-> Canonical source: [`docs/PRODUCT.md`](https://github.com/opensourceops/agentctl/blob/main/docs/PRODUCT.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/PRODUCT.md`](https://github.com/opensourceops/agentctl/blob/main/docs/PRODUCT.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/concepts/tools.md b/src/content/docs/_generated/concepts/tools.md
index 4b155bf..3631fb5 100644
--- a/src/content/docs/_generated/concepts/tools.md
+++ b/src/content/docs/_generated/concepts/tools.md
@@ -19,4 +19,4 @@ implicit shell, clears inherited environment, applies allowlisted variables,
 and is not an OS sandbox.
 
 Check mode executes pure/internal simulation and observation needed for dataflow but never filesystem, process, remote, or model mutation. Results say fully predictable, partially predictable, or requires execution; unknown external work is never reported as predicted.
-> Canonical source: [`docs/TOOLS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/TOOLS.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/TOOLS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/TOOLS.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/concepts/workflow-model.md b/src/content/docs/_generated/concepts/workflow-model.md
index 0abf213..247a2f3 100644
--- a/src/content/docs/_generated/concepts/workflow-model.md
+++ b/src/content/docs/_generated/concepts/workflow-model.md
@@ -3,7 +3,7 @@ title: "Workflow model"
 description: "Strict YAML, tasks, templates, actions, agents, and validation."
 editUrl: "https://github.com/opensourceops/agentctl/edit/main/docs/DSL.md"
 ---
-The current document version is `agentctl.dev/v1alpha1`, with `kind: Workflow`. The generated, authoritative JSON Schema is [`schemas/workflow.schema.json`](/agentctl/downloads/workflow.schema.json). YAML documents are limited to 1 MiB and reject unknown fields.
+The current document version is `agentctl.dev/v1`, with `kind: Workflow`. The generated, authoritative JSON Schema is [`schemas/workflow.schema.json`](/agentctl/downloads/workflow.schema.json). YAML documents are limited to 1 MiB and reject unknown fields.
 
 `metadata` contains the name, description, and labels. `spec` contains typed inputs/outputs; providers; bounded agents; actions; tool contracts; reusable sub-workflows; compensation policy; ordered tasks; policy; memory; MCP servers; A2A peers; packs; runtime; and output settings. A task `uses` `action:<name>`, `agent:<name>`, `workflow:<name>`, or the pure `router` construct. Tasks declare `needs`, optional bounded `foreach`, `matrix`, or `loop` expansion, optional working-memory `memoryWrites`, an optional `when`, local `vars`, typed `with` input, optional `outputSchema`, retry, timeout, failure behavior, and an optional effectful `compensate` action.
 
@@ -89,5 +89,7 @@ budgets](https://github.com/opensourceops/agentctl/blob/main/docs/guides/RESOURC
 
 The parser translates a limited unversioned `playbook:` document and emits a migration warning. Use `agentctl migrate old.yaml --write new.yaml`. Legacy pack-backed, MCP, A2A, provider-specific, and broad module configurations need manual migration; see [Migrating from TypeScript](/agentctl/reference/migration/).
 
-Not implemented in v1alpha1: `finally`, handlers, or event triggers. Parallelism is expressed by independent graph tasks rather than a separate parallel-group construct.
-> Canonical source: [`docs/DSL.md`](https://github.com/opensourceops/agentctl/blob/main/docs/DSL.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+Not implemented in workflow API v1: `finally`, handlers, or event triggers.
+Parallelism is expressed by independent graph tasks rather than a separate
+parallel-group construct.
+> Canonical source: [`docs/DSL.md`](https://github.com/opensourceops/agentctl/blob/main/docs/DSL.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/contributing/add-action.md b/src/content/docs/_generated/contributing/add-action.md
index 5a27276..0528fb9 100644
--- a/src/content/docs/_generated/contributing/add-action.md
+++ b/src/content/docs/_generated/contributing/add-action.md
@@ -42,4 +42,4 @@ cargo xtask generate
 cargo xtask docs-verify
 cargo xtask verify
 ```
-> Canonical source: [`docs/development/ADD_ACTION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/ADD_ACTION.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/development/ADD_ACTION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/ADD_ACTION.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/contributing/add-migration.md b/src/content/docs/_generated/contributing/add-migration.md
index 8438db8..644538c 100644
--- a/src/content/docs/_generated/contributing/add-migration.md
+++ b/src/content/docs/_generated/contributing/add-migration.md
@@ -24,4 +24,4 @@ Create the previous schema in a temporary database, insert representative durabl
 ## 5. Document operator impact
 
 Update the database reference, compatibility policy, release notes or status evidence, and backup guidance. Explain whether downgrade remains possible. Run the complete store tests and `cargo xtask verify`.
-> Canonical source: [`docs/development/ADD_MIGRATION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/ADD_MIGRATION.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/development/ADD_MIGRATION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/ADD_MIGRATION.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/contributing/add-provider.md b/src/content/docs/_generated/contributing/add-provider.md
index 03ab4a5..c3af561 100644
--- a/src/content/docs/_generated/contributing/add-provider.md
+++ b/src/content/docs/_generated/contributing/add-provider.md
@@ -42,4 +42,4 @@ Update the provider guide and matrix with the exact level: implemented,
 mock-protocol tested, retained live evidence, or outside the current supported
 surface. Add an example that passes `check` without resolving a secret. Run
 `cargo xtask generate`, `cargo xtask docs-verify`, and `cargo xtask verify`.
-> Canonical source: [`docs/development/ADD_PROVIDER.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/ADD_PROVIDER.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/development/ADD_PROVIDER.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/ADD_PROVIDER.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/contributing/developer-guide.md b/src/content/docs/_generated/contributing/developer-guide.md
index b89e380..2e212db 100644
--- a/src/content/docs/_generated/contributing/developer-guide.md
+++ b/src/content/docs/_generated/contributing/developer-guide.md
@@ -64,4 +64,4 @@ Provider adapters implement the neutral model contract and publish typed capabil
 Run `cargo xtask generate` whenever CLI help or the DSL changes. Run `cargo xtask docs-verify` for public content and examples. Update the Pages site's content manifest when adding a new canonical public page. Release decisions depend on hosted evidence for the exact candidate commit; local success alone does not approve an RC.
 
 Related guides: [Add an action](/agentctl/contributing/add-action/), [Add a provider](/agentctl/contributing/add-provider/), [Add a store migration](/agentctl/contributing/add-migration/), [Write documentation](/agentctl/contributing/documentation/), [Testing](/agentctl/contributing/testing/), and [Release process](/agentctl/contributing/release/).
-> Canonical source: [`docs/development/REPOSITORY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/REPOSITORY.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/development/REPOSITORY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/REPOSITORY.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/contributing/documentation.md b/src/content/docs/_generated/contributing/documentation.md
index ada1a0e..6ad3a39 100644
--- a/src/content/docs/_generated/contributing/documentation.md
+++ b/src/content/docs/_generated/contributing/documentation.md
@@ -44,4 +44,4 @@ The site command imports canonical content, records the source commit, validates
 ## Review
 
 Review technical claims against source, generated help, schema, tests, and evidence. Check keyboard navigation, heading order, link purpose, alt text, diagram explanations, mobile code blocks, and direct deep links. Do not claim accessibility certification from automated tooling alone.
-> Canonical source: [`docs/development/DOCUMENTATION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/DOCUMENTATION.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/development/DOCUMENTATION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/DOCUMENTATION.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/contributing/index.md b/src/content/docs/_generated/contributing/index.md
index a49ea54..dc5d063 100644
--- a/src/content/docs/_generated/contributing/index.md
+++ b/src/content/docs/_generated/contributing/index.md
@@ -80,4 +80,4 @@ Reviewers focus on correctness, deterministic behavior, explicit effects, safe f
 ## Release process
 
 Maintainers follow [Release process](/agentctl/contributing/release/). Candidate promotion requires the exact remote commit to pass required hosted checks and artifact verification. Contributors must not create tags, publish packages, or describe a local build as released.
-> Canonical source: [`docs/CONTRIBUTING.md`](https://github.com/opensourceops/agentctl/blob/main/docs/CONTRIBUTING.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/CONTRIBUTING.md`](https://github.com/opensourceops/agentctl/blob/main/docs/CONTRIBUTING.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/contributing/release.md b/src/content/docs/_generated/contributing/release.md
index b553e78..85daa97 100644
--- a/src/content/docs/_generated/contributing/release.md
+++ b/src/content/docs/_generated/contributing/release.md
@@ -1,9 +1,10 @@
 ---
 title: "Release process"
-description: "Prepare and verify a v1alpha1 release candidate without overstating evidence."
+description: "Prepare and verify an exact-commit release without overstating evidence."
 editUrl: "https://github.com/opensourceops/agentctl/edit/main/docs/RELEASE_PROCESS.md"
 ---
-This process applies to the `agentctl.dev/v1alpha1` release candidate. A release is not approved from local evidence alone.
+This process applies to agentctl releases carrying workflow API
+`agentctl.dev/v1`. A release is not approved from local evidence alone.
 
 ## Required hosted checks
 
@@ -76,7 +77,7 @@ For the candidate workflow run:
 
 ## Release decision
 
-Promote an exact commit to a framework candidate only after it has all required
-hosted checks and artifacts. Stable `v1.0` remains outside this `v1alpha1`
-gate.
-> Canonical source: [`docs/RELEASE_PROCESS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/RELEASE_PROCESS.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+Promote an exact commit only after it has all required hosted checks and
+artifacts. Shipping workflow API `agentctl.dev/v1` does not imply a 1.0 CLI,
+crate, storage, provider, or long-term-support contract.
+> Canonical source: [`docs/RELEASE_PROCESS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/RELEASE_PROCESS.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/contributing/testing.md b/src/content/docs/_generated/contributing/testing.md
index d75f009..51c28ed 100644
--- a/src/content/docs/_generated/contributing/testing.md
+++ b/src/content/docs/_generated/contributing/testing.md
@@ -50,4 +50,4 @@ dispatch, then proves that the next requested effect is denied.
 including the failed two-agent source, selective repair, and keyless replay,
 with a 40-request and conservative USD 10 guard. Never run these commands for
 debugging loops, fuzzing, load, or normal CI.
-> Canonical source: [`docs/TESTING.md`](https://github.com/opensourceops/agentctl/blob/main/docs/TESTING.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/TESTING.md`](https://github.com/opensourceops/agentctl/blob/main/docs/TESTING.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/durable-execution/index.md b/src/content/docs/_generated/durable-execution/index.md
index b251aec..59520b6 100644
--- a/src/content/docs/_generated/durable-execution/index.md
+++ b/src/content/docs/_generated/durable-execution/index.md
@@ -77,4 +77,4 @@ reconciled as compensated. This is best-effort inverse execution, not
 transactional rollback.
 
 The artifact root is `artifacts/` beside the database. `agentctl artifacts` lists references and blobs, verifies hashes, exports bytes atomically, and performs reachability-based collection. GC excludes referenced blobs and active ingestion leases, recovers interrupted quarantine operations on startup, and cleans stale untracked blobs and partial temporary files.
-> Canonical source: [`docs/DURABLE_EXECUTION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/DURABLE_EXECUTION.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/DURABLE_EXECUTION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/DURABLE_EXECUTION.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/examples/approval-gated.md b/src/content/docs/_generated/examples/approval-gated.md
index 2450bed..2e4253d 100644
--- a/src/content/docs/_generated/examples/approval-gated.md
+++ b/src/content/docs/_generated/examples/approval-gated.md
@@ -17,7 +17,7 @@ Source: `examples/v1/approval.yaml`.
 
 
 ```yaml
-apiVersion: agentctl.dev/v1alpha1
+apiVersion: agentctl.dev/v1
 kind: Workflow
 metadata:
   name: approval-gated-write
@@ -58,4 +58,4 @@ The approval includes redacted input, tool or action, capability, risk, expected
 ## Current limitation
 
 The CLI stores operator-provided identity text but does not provide a hosted identity or role system. The invoking platform must authenticate and authorize the operator.
-> Canonical source: [`docs/use-cases/APPROVAL_GATED_ACTION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/use-cases/APPROVAL_GATED_ACTION.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/use-cases/APPROVAL_GATED_ACTION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/use-cases/APPROVAL_GATED_ACTION.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/examples/ci-quality-gate.md b/src/content/docs/_generated/examples/ci-quality-gate.md
index 4eddc87..f70a3eb 100644
--- a/src/content/docs/_generated/examples/ci-quality-gate.md
+++ b/src/content/docs/_generated/examples/ci-quality-gate.md
@@ -17,7 +17,7 @@ Source: `examples/docs/ci-quality-gate/workflow.yaml`.
 
 
 ```yaml
-apiVersion: agentctl.dev/v1alpha1
+apiVersion: agentctl.dev/v1
 kind: Workflow
 metadata:
   name: ci-quality-gate
@@ -64,4 +64,4 @@ on failure only when its potentially confidential content is protected.
 ## Current limitation
 
 This workflow does not run tests itself. A surrounding pipeline can supply results, or a reviewed `builtin.shell.exec` action can run a specifically allowed executable.
-> Canonical source: [`docs/use-cases/CI_QUALITY_GATE.md`](https://github.com/opensourceops/agentctl/blob/main/docs/use-cases/CI_QUALITY_GATE.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/use-cases/CI_QUALITY_GATE.md`](https://github.com/opensourceops/agentctl/blob/main/docs/use-cases/CI_QUALITY_GATE.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/examples/provider-portability.md b/src/content/docs/_generated/examples/provider-portability.md
index cfe24be..318394f 100644
--- a/src/content/docs/_generated/examples/provider-portability.md
+++ b/src/content/docs/_generated/examples/provider-portability.md
@@ -17,7 +17,7 @@ Source: `examples/docs/provider-portability/fake.yaml`.
 
 
 ```yaml
-apiVersion: agentctl.dev/v1alpha1
+apiVersion: agentctl.dev/v1
 kind: Workflow
 metadata:
   name: portable-summary-fake
@@ -62,7 +62,7 @@ Source: `examples/docs/provider-portability/openai.yaml`.
 
 
 ```yaml
-apiVersion: agentctl.dev/v1alpha1
+apiVersion: agentctl.dev/v1
 kind: Workflow
 metadata:
   name: portable-summary-openai
@@ -112,4 +112,4 @@ Both workflows share the provider-neutral agent shape. Each provider still needs
 ## Current limitation
 
 Provider portability does not mean identical behavior or equal maturity. Fake is deterministic, OpenAI has retained bounded live evidence, and Azure OpenAI, Anthropic, and Google are mock-protocol tested only in this release.
-> Canonical source: [`docs/use-cases/PROVIDER_PORTABILITY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/use-cases/PROVIDER_PORTABILITY.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/use-cases/PROVIDER_PORTABILITY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/use-cases/PROVIDER_PORTABILITY.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/examples/recorded-replay.md b/src/content/docs/_generated/examples/recorded-replay.md
index 21dcbf7..b454661 100644
--- a/src/content/docs/_generated/examples/recorded-replay.md
+++ b/src/content/docs/_generated/examples/recorded-replay.md
@@ -17,7 +17,7 @@ Source: `examples/v1/crash-resume.yaml`.
 
 
 ```yaml
-apiVersion: agentctl.dev/v1alpha1
+apiVersion: agentctl.dev/v1
 kind: Workflow
 metadata:
   name: crash-resume
@@ -60,4 +60,4 @@ Replay needs only the database, but the stored record may contain confidential i
 ## Current limitation
 
 Replay is not a new validation, retry, or exactly-once guarantee. It rejects non-terminal source runs. Use resume for safe continuation and fork only when fresh effects are intentional.
-> Canonical source: [`docs/use-cases/RECORDED_REPLAY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/use-cases/RECORDED_REPLAY.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/use-cases/RECORDED_REPLAY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/use-cases/RECORDED_REPLAY.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/examples/release-readiness.md b/src/content/docs/_generated/examples/release-readiness.md
index 608bf05..a018bb1 100644
--- a/src/content/docs/_generated/examples/release-readiness.md
+++ b/src/content/docs/_generated/examples/release-readiness.md
@@ -17,7 +17,7 @@ Source: `examples/docs/release-readiness/workflow.yaml`.
 
 
 ```yaml
-apiVersion: agentctl.dev/v1alpha1
+apiVersion: agentctl.dev/v1
 kind: Workflow
 metadata:
   name: release-readiness
@@ -81,4 +81,4 @@ The database records which gate failed and whether the analysis task started. A
 ## Current limitation
 
 The example uses the fake provider. It demonstrates graph and policy behavior, not a live model quality claim or a release approval system.
-> Canonical source: [`docs/use-cases/RELEASE_READINESS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/use-cases/RELEASE_READINESS.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/use-cases/RELEASE_READINESS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/use-cases/RELEASE_READINESS.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/examples/repository-audit.md b/src/content/docs/_generated/examples/repository-audit.md
index d4cb81e..eabacaa 100644
--- a/src/content/docs/_generated/examples/repository-audit.md
+++ b/src/content/docs/_generated/examples/repository-audit.md
@@ -17,7 +17,7 @@ Source: `examples/acceptance/mock-tool/workflow.yaml`.
 
 
 ```yaml
-apiVersion: agentctl.dev/v1alpha1
+apiVersion: agentctl.dev/v1
 kind: Workflow
 metadata:
   name: acceptance-mock-tool
@@ -121,4 +121,4 @@ The database records the provider session, strict tool call, read effect, assert
 ## Current limitation
 
 The checked journey proves orchestration and tool boundaries, not the quality of a live model's repository analysis. Production workflows need task-specific verification stronger than a fixed marker.
-> Canonical source: [`docs/use-cases/REPOSITORY_AUDIT.md`](https://github.com/opensourceops/agentctl/blob/main/docs/use-cases/REPOSITORY_AUDIT.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/use-cases/REPOSITORY_AUDIT.md`](https://github.com/opensourceops/agentctl/blob/main/docs/use-cases/REPOSITORY_AUDIT.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/examples/scheduled-review.md b/src/content/docs/_generated/examples/scheduled-review.md
index a605d26..80f1925 100644
--- a/src/content/docs/_generated/examples/scheduled-review.md
+++ b/src/content/docs/_generated/examples/scheduled-review.md
@@ -17,7 +17,7 @@ Source: `examples/docs/scheduled-review/workflow.yaml`.
 
 
 ```yaml
-apiVersion: agentctl.dev/v1alpha1
+apiVersion: agentctl.dev/v1
 kind: Workflow
 metadata:
   name: scheduled-operational-review
@@ -71,4 +71,4 @@ Persist the database and artifact directory with restrictive permissions. Config
 ## Current limitation
 
 `agentctl` is a schedulable runtime, not a scheduling service. It does not provide clocks, calendars, distributed leases, or log rotation.
-> Canonical source: [`docs/use-cases/SCHEDULED_REVIEW.md`](https://github.com/opensourceops/agentctl/blob/main/docs/use-cases/SCHEDULED_REVIEW.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/use-cases/SCHEDULED_REVIEW.md`](https://github.com/opensourceops/agentctl/blob/main/docs/use-cases/SCHEDULED_REVIEW.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/getting-started/first-agent.md b/src/content/docs/_generated/getting-started/first-agent.md
index b3969bd..3bdd69e 100644
--- a/src/content/docs/_generated/getting-started/first-agent.md
+++ b/src/content/docs/_generated/getting-started/first-agent.md
@@ -84,4 +84,4 @@ The live command makes a paid network request to `api.openai.com` and writes pro
 ## Next step
 
 Read [Workflow authoring](/agentctl/guides/workflow-authoring/) to replace the scripted journey with your own reviewed workflow.
-> Canonical source: [`docs/guides/FIRST_AGENT_WORKFLOW.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/FIRST_AGENT_WORKFLOW.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/guides/FIRST_AGENT_WORKFLOW.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/FIRST_AGENT_WORKFLOW.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/getting-started/index.md b/src/content/docs/_generated/getting-started/index.md
index baf436c..f39e8ce 100644
--- a/src/content/docs/_generated/getting-started/index.md
+++ b/src/content/docs/_generated/getting-started/index.md
@@ -87,4 +87,4 @@ If a command fails, read [Troubleshooting](/agentctl/troubleshooting/).
 ## Next step
 
 Run [your first bounded agent workflow](/agentctl/getting-started/first-agent/) without a paid API key.
-> Canonical source: [`docs/guides/GETTING_STARTED.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/GETTING_STARTED.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/guides/GETTING_STARTED.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/GETTING_STARTED.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/getting-started/installation.md b/src/content/docs/_generated/getting-started/installation.md
index 7b99658..2e896ce 100644
--- a/src/content/docs/_generated/getting-started/installation.md
+++ b/src/content/docs/_generated/getting-started/installation.md
@@ -1,9 +1,10 @@
 ---
 title: "Installation"
-description: "Build or install the current v1alpha1 candidate from reviewed source."
+description: "Build or install agentctl 0.3 with workflow API v1 from reviewed source."
 editUrl: "https://github.com/opensourceops/agentctl/edit/main/docs/guides/INSTALLATION.md"
 ---
-This guide installs the `v1alpha1` Rust CLI from crates.io, reviewed source, or a locally built OCI image.
+This guide installs the agentctl 0.3 Rust CLI with workflow API v1 from
+crates.io, reviewed source, or a locally built OCI image.
 
 ## Prerequisites
 
@@ -73,9 +74,9 @@ Expected evidence includes `valid: hello`, task order `greet`, and `FullyPredict
 
 ## Upgrade safely
 
-The workflow API is `agentctl.dev/v1alpha1`. Pin the CLI or image version, read [compatibility](/agentctl/reference/compatibility/) and [limitations](/agentctl/reference/limitations/), back up the SQLite database with its WAL files, then validate workflows before replacing a binary. `agentctl update` explains supported update paths but does not modify the installation.
+The workflow API is `agentctl.dev/v1`. Pin the CLI or image version, read [compatibility](/agentctl/reference/compatibility/) and [limitations](/agentctl/reference/limitations/), back up the SQLite database with its WAL files, then validate workflows before replacing a binary. `agentctl update` explains supported update paths but does not modify the installation.
 
 ## Next step
 
 Continue with [Getting started](/agentctl/getting-started/).
-> Canonical source: [`docs/guides/INSTALLATION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/INSTALLATION.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/guides/INSTALLATION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/INSTALLATION.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/guides/ci-cd.md b/src/content/docs/_generated/guides/ci-cd.md
index 88786e8..5f38222 100644
--- a/src/content/docs/_generated/guides/ci-cd.md
+++ b/src/content/docs/_generated/guides/ci-cd.md
@@ -30,7 +30,7 @@ docker run --rm --read-only --user 65532:65532 \
   --mount type=bind,src="$PWD",dst=/workspace,readonly \
   --mount type=bind,src="$PWD/.agentctl-state",dst=/state \
   --mount type=bind,src="$PWD/artifacts",dst=/artifacts \
-  ghcr.io/OWNER/agentctl:0.2.0 \
+  ghcr.io/OWNER/agentctl:0.3.0 \
   run /config/workflow.yaml --workspace /workspace \
   --db /state/runtime.db --output json --color never
 ```
@@ -82,4 +82,4 @@ Do not set a pipeline retry policy that blindly repeats exit `5`, `6`, or `130`.
 - Treat remote content and model output as untrusted.
 - Retain state for approval or recovery, then delete it under policy.
 - Set the external platform's overlap and timeout controls.
-> Canonical source: [`docs/guides/CI_CD.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/CI_CD.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/guides/CI_CD.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/CI_CD.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/guides/container.md b/src/content/docs/_generated/guides/container.md
index 8bb6e0e..e569499 100644
--- a/src/content/docs/_generated/guides/container.md
+++ b/src/content/docs/_generated/guides/container.md
@@ -79,7 +79,7 @@ docker run --rm --read-only --user 65532:65532 \
   --mount type=bind,src="$PWD/state",dst=/state \
   --mount type=bind,src="$PWD/artifacts",dst=/artifacts \
   --env OPENAI_API_KEY \
-  ghcr.io/OWNER/agentctl:0.2.0 \
+  ghcr.io/OWNER/agentctl:0.3.0 \
   run /config/workflow.yaml --workspace /workspace --db /state/runtime.db \
   --input reportPath=/artifacts/report.txt --timeout-seconds 600 \
   --output json --color never
@@ -99,7 +99,7 @@ docker run --rm --read-only --user 65532:65532 \
   --mount type=bind,src="$PWD/workspace",dst=/workspace,readonly \
   --mount type=bind,src="$PWD/state",dst=/state \
   --mount type=bind,src="$PWD/openai.key",dst=/run/secrets/openai,readonly \
-  ghcr.io/OWNER/agentctl:0.2.0 \
+  ghcr.io/OWNER/agentctl:0.3.0 \
   run /config/workflow.yaml --workspace /workspace --db /state/runtime.db \
   --output json --color never
 ```
@@ -114,7 +114,7 @@ docker run --rm --read-only --user 65532:65532 --network none \
   --mount type=bind,src="$PWD/config",dst=/config,readonly \
   --mount type=bind,src="$PWD/workspace",dst=/workspace,readonly \
   --mount type=bind,src="$PWD/state",dst=/state \
-  ghcr.io/OWNER/agentctl:0.2.0 \
+  ghcr.io/OWNER/agentctl:0.3.0 \
   repair /config/repaired.yaml SOURCE_RUN_ID --from failed_task --plan \
   --workspace /workspace --db /state/runtime.db --output json --color never
 ```
@@ -143,7 +143,7 @@ jobs:
             --mount type=bind,src="$GITHUB_WORKSPACE",dst=/workspace,readonly \
             --mount type=bind,src="$GITHUB_WORKSPACE/.agentctl-state",dst=/state \
             --mount type=bind,src="$GITHUB_WORKSPACE/artifacts",dst=/artifacts \
-            --env OPENAI_API_KEY ghcr.io/OWNER/agentctl:0.2.0 \
+            --env OPENAI_API_KEY ghcr.io/OWNER/agentctl:0.3.0 \
             run /config/workflow.yaml --workspace /workspace --db /state/runtime.db \
             --input reportPath=/artifacts/report.txt --timeout-seconds 600 \
             --output json --color never
@@ -168,7 +168,7 @@ This syntax assumes a runner configured with Docker CLI access to the host daemo
 agentctl:
   image: docker:27-cli
   variables:
-    AGENTCTL_IMAGE: ghcr.io/OWNER/agentctl:0.2.0
+    AGENTCTL_IMAGE: ghcr.io/OWNER/agentctl:0.3.0
   before_script:
     - mkdir -p .agentctl-state artifacts && chmod 0777 .agentctl-state artifacts
   script:
@@ -211,7 +211,7 @@ pipeline {
               --mount type=bind,src="$WORKSPACE",dst=/workspace,readonly \
               --mount type=bind,src="$WORKSPACE/.agentctl-state",dst=/state \
               --mount type=bind,src="$WORKSPACE/artifacts",dst=/artifacts \
-              --env OPENAI_API_KEY ghcr.io/OWNER/agentctl:0.2.0 \
+              --env OPENAI_API_KEY ghcr.io/OWNER/agentctl:0.3.0 \
               run /config/workflow.yaml --workspace /workspace --db /state/runtime.db \
               --input reportPath=/artifacts/report.txt --timeout-seconds 600 \
               --output json --color never
@@ -252,7 +252,7 @@ The runner needs Docker CLI/socket access and four workspace directories. The se
           --mount type=bind,src=/harness,dst=/workspace,readonly \
           --mount type=bind,src=/harness/.agentctl-state,dst=/state \
           --mount type=bind,src=/harness/artifacts,dst=/artifacts \
-          --env OPENAI_API_KEY ghcr.io/OWNER/agentctl:0.2.0 \
+          --env OPENAI_API_KEY ghcr.io/OWNER/agentctl:0.3.0 \
           run /config/workflow.yaml --workspace /workspace --db /state/runtime.db \
           --input reportPath=/artifacts/report.txt --timeout-seconds 600 \
           --output json --color never
@@ -291,7 +291,7 @@ spec:
             fsGroup: 65532
           containers:
             - name: agentctl
-              image: ghcr.io/OWNER/agentctl:0.2.0
+              image: ghcr.io/OWNER/agentctl:0.3.0
               args:
                 - run
                 - /config/workflow.yaml
@@ -360,4 +360,4 @@ GitLab, Jenkins, Harness, and Kubernetes examples remain
 documentation-reviewed only. The automatic Ubuntu Linux x64 build, scan, and
 SBOM job passed on the exact pull-request head and retained its image SBOM
 artifact and digest.
-> Canonical source: [`docs/CONTAINER.md`](https://github.com/opensourceops/agentctl/blob/main/docs/CONTAINER.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/CONTAINER.md`](https://github.com/opensourceops/agentctl/blob/main/docs/CONTAINER.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/guides/local-operation.md b/src/content/docs/_generated/guides/local-operation.md
index da0e1bf..3a55967 100644
--- a/src/content/docs/_generated/guides/local-operation.md
+++ b/src/content/docs/_generated/guides/local-operation.md
@@ -73,4 +73,4 @@ agentctl gc --db .agentctl/runtime.db --older-than-days 30 --output json --color
 ```
 
 Garbage collection deletes eligible terminal history and expired long-term memory. Back up before deletion when the history is audit evidence.
-> Canonical source: [`docs/guides/LOCAL_OPERATION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/LOCAL_OPERATION.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/guides/LOCAL_OPERATION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/LOCAL_OPERATION.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/guides/selective-repair.md b/src/content/docs/_generated/guides/selective-repair.md
index 2f21837..f7c9d7e 100644
--- a/src/content/docs/_generated/guides/selective-repair.md
+++ b/src/content/docs/_generated/guides/selective-repair.md
@@ -197,4 +197,4 @@ Recorded replay has a new replay run ID but the same semantic outputs. It dispat
 | `unreconciled_effect` | Fresh execution may duplicate a mutation. | Inspect and reconcile external reality first. |
 
 Use [`agentctl retry`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/TERMINAL_RETRY.md) instead when the workflow definition is unchanged and the intent is to rerun failed or explicitly selected boundaries of a terminal source. Use repair for a corrected definition and fork for a broader intentionally fresh execution.
-> Canonical source: [`docs/guides/repair-a-failed-workflow.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/repair-a-failed-workflow.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/guides/repair-a-failed-workflow.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/repair-a-failed-workflow.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/guides/workflow-authoring.md b/src/content/docs/_generated/guides/workflow-authoring.md
index 0ff2c2f..8e122ca 100644
--- a/src/content/docs/_generated/guides/workflow-authoring.md
+++ b/src/content/docs/_generated/guides/workflow-authoring.md
@@ -10,7 +10,7 @@ This guide teaches the YAML model in the order you need it. The generated JSON S
 Every document has a strict versioned envelope:
 
 ```yaml
-apiVersion: agentctl.dev/v1alpha1
+apiVersion: agentctl.dev/v1
 kind: Workflow
 metadata:
   name: repository-check
@@ -126,4 +126,4 @@ agentctl run workflow.yaml --check --diff --db .agentctl/preview.db
 ```
 
 The preview may write run history to its database, but it does not perform filesystem, process, remote, or model mutation. Read [Workflow DSL](/agentctl/concepts/workflow-model/) and the [YAML reference](/agentctl/reference/yaml/) for the complete contract.
-> Canonical source: [`docs/guides/WORKFLOW_AUTHORING.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/WORKFLOW_AUTHORING.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/guides/WORKFLOW_AUTHORING.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/WORKFLOW_AUTHORING.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/observability/index.md b/src/content/docs/_generated/observability/index.md
index de233f5..a0cdae0 100644
--- a/src/content/docs/_generated/observability/index.md
+++ b/src/content/docs/_generated/observability/index.md
@@ -60,4 +60,4 @@ content, remote payloads, and identifying metadata; a run ID alone is
 sufficient for local correlation.
 
 See [CLI output and exit codes](/agentctl/reference/output/), [local operation](/agentctl/guides/local-operation/), and [runtime database and migrations](/agentctl/reference/database/) for the complete operating contract.
-> Canonical source: [`docs/OBSERVABILITY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/OBSERVABILITY.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/OBSERVABILITY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/OBSERVABILITY.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/operations/scheduled.md b/src/content/docs/_generated/operations/scheduled.md
index 2755ed9..c886c54 100644
--- a/src/content/docs/_generated/operations/scheduled.md
+++ b/src/content/docs/_generated/operations/scheduled.md
@@ -71,4 +71,4 @@ A oneshot service has one active invocation at a time. Use distinct databases on
 Repair planning exits `3` when compatibility or effect safety blocks reuse. Read `blockedReuse`, choose an earlier/additional root, restore a verified artifact, or reconcile an effect. Do not bypass the plan with a fresh fork unless repeating all effects is an intentional operator decision.
 
 Use `agentctl gc --db PATH --older-than-days N` for expired memory and old terminal histories. Then use `agentctl artifacts --db PATH gc --older-than-days N --dry-run` to preview unreferenced blobs before running it without `--dry-run`. SQLite WAL files and the sibling artifact root belong together during backup. A future schedule-run key may improve deduplication; today the external scheduler owns overlap prevention.
-> Canonical source: [`docs/OPERATIONS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/OPERATIONS.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/OPERATIONS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/OPERATIONS.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/providers/a2a.md b/src/content/docs/_generated/providers/a2a.md
index 8441e21..390bb5c 100644
--- a/src/content/docs/_generated/providers/a2a.md
+++ b/src/content/docs/_generated/providers/a2a.md
@@ -31,4 +31,4 @@ agentctl effects --db .agentctl/runtime.db continue-remote EFFECT_ID \
 The command observes the existing remote task, ingests completed inline or same-origin URL artifacts into the local CAS, and records an applied effect reconciliation. A following failed-only retry materializes that completed boundary and executes only its descendants. Repair, retry, and replay retain source-linked protocol evidence without submitting the task again.
 
 Each artifact part must contain exactly one of `text`, `raw`, `data`, or `url`. Retrieval is bounded to 16 MiB per part and same-origin URL policy. Mock peers cover known-task continuation, ambiguous-send refusal, task polling, artifacts, streaming fallback, cancellation, protocol mismatch, origin enforcement, timeout, and zero-resubmission retry.
-> Canonical source: [`docs/A2A.md`](https://github.com/opensourceops/agentctl/blob/main/docs/A2A.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/A2A.md`](https://github.com/opensourceops/agentctl/blob/main/docs/A2A.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/providers/index.md b/src/content/docs/_generated/providers/index.md
index e6b5b33..68b36ca 100644
--- a/src/content/docs/_generated/providers/index.md
+++ b/src/content/docs/_generated/providers/index.md
@@ -85,4 +85,4 @@ Streaming persists each accepted fragment before reading more transport data.
 Records are bounded and redacted, while the terminal response still follows
 the normal validation path. See [Durable provider
 streaming](https://github.com/opensourceops/agentctl/blob/main/docs/guides/DURABLE_STREAMING.md).
-> Canonical source: [`docs/PROVIDERS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/PROVIDERS.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/PROVIDERS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/PROVIDERS.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/providers/mcp.md b/src/content/docs/_generated/providers/mcp.md
index 9aa3001..0fa79b6 100644
--- a/src/content/docs/_generated/providers/mcp.md
+++ b/src/content/docs/_generated/providers/mcp.md
@@ -21,4 +21,4 @@ actions:
 SQLite schema 13 records session generation, immutable call identity, idempotency, status, selected remote, and encrypted-capable protocol state. `agentctl inspect RUN_ID` exposes `protocolSessions`, `protocolCalls`, and bounded protocol stream events. Recorded replay copies source-linked protocol evidence but performs no network effect.
 
 Streaming progress is persisted with backpressure before the next frame is consumed. A final tool result enters workflow state only after complete JSON-RPC validation. Deterministic mock-server coverage includes server restart, one-reconnect bounds, stable and changed schemas, authentication refresh, unsafe-call refusal, SSE parsing, cancellation, timeout, inspection, and replay.
-> Canonical source: [`docs/MCP.md`](https://github.com/opensourceops/agentctl/blob/main/docs/MCP.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/MCP.md`](https://github.com/opensourceops/agentctl/blob/main/docs/MCP.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/reference/capabilities.md b/src/content/docs/_generated/reference/capabilities.md
index 52d1679..793d158 100644
--- a/src/content/docs/_generated/reference/capabilities.md
+++ b/src/content/docs/_generated/reference/capabilities.md
@@ -40,4 +40,4 @@ The compiler verifies that a built-in tool declaration matches its executor sema
 | `a2a.delegate` | remote agent | recorded result, no fresh delegation in replay |
 
 See [Providers](/agentctl/providers/), [Tools](/agentctl/concepts/tools/), and [Durable execution](/agentctl/durable-execution/).
-> Canonical source: [`docs/reference/MATRICES.md`](https://github.com/opensourceops/agentctl/blob/main/docs/reference/MATRICES.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/reference/MATRICES.md`](https://github.com/opensourceops/agentctl/blob/main/docs/reference/MATRICES.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/reference/cli.md b/src/content/docs/_generated/reference/cli.md
index 5bc0d67..99f4418 100644
--- a/src/content/docs/_generated/reference/cli.md
+++ b/src/content/docs/_generated/reference/cli.md
@@ -30,7 +30,7 @@ Commands:
   providers   Inspect provider capabilities or run the opt-in OpenAI smoke
   auth        Check configured secret references without revealing values
   schema      Print or write the generated workflow JSON Schema
-  migrate     Translate an unversioned TypeScript-era workflow into v1alpha1
+  migrate     Translate an unversioned TypeScript-era workflow into workflow API v1
   packs       Inspect and verify a local reusable pack
   artifacts   Inspect, verify, export, or collect durable artifacts
   db          Inspect the runtime database
@@ -716,7 +716,7 @@ Options:
 ## `agentctl migrate`
 
 ```text
-Translate an unversioned TypeScript-era workflow into v1alpha1
+Translate an unversioned TypeScript-era workflow into workflow API v1
 
 Usage: agentctl migrate [OPTIONS] <FILE>
 
@@ -1248,4 +1248,4 @@ Options:
       --locked           Require agentctl.pack.lock and reject all source or graph drift
   -h, --help             Print help
 ```
-> Canonical source: [`docs/generated/CLI.md`](https://github.com/opensourceops/agentctl/blob/main/docs/generated/CLI.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/generated/CLI.md`](https://github.com/opensourceops/agentctl/blob/main/docs/generated/CLI.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/reference/compatibility.md b/src/content/docs/_generated/reference/compatibility.md
index f052952..720a473 100644
--- a/src/content/docs/_generated/reference/compatibility.md
+++ b/src/content/docs/_generated/reference/compatibility.md
@@ -9,6 +9,12 @@ Declaration-order scheduling among ready tasks, `needs` dataflow, exact typed te
 
 ## Migrated
 
+Agentctl 0.3 promotes the workflow document identifier from
+`agentctl.dev/v1alpha1` to `agentctl.dev/v1` without changing the document
+shape. Update the `apiVersion` line before upgrading; the retired identifier is
+rejected with an explicit diagnostic. The separate pack-manifest identifier
+remains `agentctl.dev/pack/v1alpha1`.
+
 Unversioned `playbook:` YAML can be translated by `agentctl migrate`; `modules` become `actions`, `module:x` becomes `action:x`, heuristic agents map to the fake provider, and core memory/policy fields are normalized. Rust JSON output is a stable `agentctl.dev/cli/v1` envelope rather than the prototype JSONL/YAML mixture. The additive JSONL mode uses the same versioned envelopes for bounded progress and a final result. The production executable and runtime are Rust.
 
 ## Intentionally changed
@@ -49,11 +55,12 @@ guess security-sensitive intent.
 ## Separate product decisions
 
 A public pack registry, in-process plugin ABI, and general A2A resubmission are
-not compatibility promises for v1alpha1. Pack lock v1, the bounded process
-protocol v1, and source/trust policy are additive. MCP reconnect is bounded by
-explicit idempotency and schema stability. A2A continuation observes only a
-persisted task ID. Bounded loops, namespaced sub-workflows, explicit
+not part of the workflow API v1 compatibility promise. Pack lock v1, the
+bounded process protocol v1, and source/trust policy are additive. MCP
+reconnect is bounded by explicit idempotency and schema stability. A2A
+continuation observes only a persisted task ID. Bounded loops, namespaced
+sub-workflows, explicit
 source-linked compensation, graph-native structured handoffs, durable
 streaming, and protocol continuation records are additive; hidden or
 model-controlled orchestration is intentionally unsupported.
-> Canonical source: [`docs/COMPATIBILITY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/COMPATIBILITY.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/COMPATIBILITY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/COMPATIBILITY.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/reference/completeness-verification.md b/src/content/docs/_generated/reference/completeness-verification.md
index ea8ca0c..84a353c 100644
--- a/src/content/docs/_generated/reference/completeness-verification.md
+++ b/src/content/docs/_generated/reference/completeness-verification.md
@@ -225,4 +225,4 @@ were fixed and covered by focused tests or local validation. The final
 credential-free gates, actionlint, deterministic secret scan, native Linux
 arm64 OCI acceptance, exact-image Trivy/SBOM checks, and retained GPT-5.6
 evidence are green.
-> Canonical source: [`docs/execution/COMPLETENESS_VERIFICATION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/execution/COMPLETENESS_VERIFICATION.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/execution/COMPLETENESS_VERIFICATION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/execution/COMPLETENESS_VERIFICATION.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/reference/database.md b/src/content/docs/_generated/reference/database.md
index b12ba02..8dc7c06 100644
--- a/src/content/docs/_generated/reference/database.md
+++ b/src/content/docs/_generated/reference/database.md
@@ -68,4 +68,4 @@ Delete old terminal history only after retention requirements are met:
 agentctl gc --db .agentctl/runtime.db --older-than-days 30 --output json --color never
 agentctl artifacts --db .agentctl/runtime.db gc --older-than-days 30 --output json --color never
 ```
-> Canonical source: [`docs/reference/DATABASE.md`](https://github.com/opensourceops/agentctl/blob/main/docs/reference/DATABASE.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/reference/DATABASE.md`](https://github.com/opensourceops/agentctl/blob/main/docs/reference/DATABASE.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/reference/environment.md b/src/content/docs/_generated/reference/environment.md
index 9c79a48..5693471 100644
--- a/src/content/docs/_generated/reference/environment.md
+++ b/src/content/docs/_generated/reference/environment.md
@@ -56,4 +56,4 @@ Normal `cargo xtask docs-verify`, `cargo xtask verify`, and `cargo xtask accepta
 | `/tmp` | small runtime tmpfs when the root filesystem is read-only |
 
 State and artifacts must be writable by UID/GID 65532 in the production image.
-> Canonical source: [`docs/reference/ENVIRONMENT_AND_PATHS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/reference/ENVIRONMENT_AND_PATHS.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/reference/ENVIRONMENT_AND_PATHS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/reference/ENVIRONMENT_AND_PATHS.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/reference/limitation-burndown.md b/src/content/docs/_generated/reference/limitation-burndown.md
index 9150e40..c80c44f 100644
--- a/src/content/docs/_generated/reference/limitation-burndown.md
+++ b/src/content/docs/_generated/reference/limitation-burndown.md
@@ -942,4 +942,4 @@ Recorded on 2026-07-23 before framework-completeness implementation:
   OCI binary, acceptance failed with exit 3 because
   `/artifacts/report.txt` escaped the authorized workspace root. No credential
   was supplied and no OpenAI call occurred.
-> Canonical source: [`docs/execution/LIMITATION_BURNDOWN.md`](https://github.com/opensourceops/agentctl/blob/main/docs/execution/LIMITATION_BURNDOWN.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/execution/LIMITATION_BURNDOWN.md`](https://github.com/opensourceops/agentctl/blob/main/docs/execution/LIMITATION_BURNDOWN.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/reference/limitations.md b/src/content/docs/_generated/reference/limitations.md
index ed45b74..80d7ce1 100644
--- a/src/content/docs/_generated/reference/limitations.md
+++ b/src/content/docs/_generated/reference/limitations.md
@@ -16,7 +16,8 @@ and OCI journeys. The local container build has a secure optional CA secret
 path, and exact-head pull-request gates execute Linux x64, hosted macOS arm64,
 Windows x64, container, security, package, and SBOM validation without
 provider credentials. Exact run and artifact digests belong to the independent
-candidate report. This is a `v1alpha1` framework candidate, not stable v1.0.
+candidate report. Version 0.3 publishes workflow API `agentctl.dev/v1`; the CLI
+and crates remain pre-1.0 and do not imply long-term support.
 
 ## Required hardening completed for this release
 
@@ -60,7 +61,9 @@ These are extension points, not incomplete core runtime behavior:
 
 ## Current operational limits
 
-- The document API is `v1alpha1`; pin the binary/image version and validate before upgrading.
+- The document API is `agentctl.dev/v1`. Pin the binary or image version and
+  validate before upgrading because runtime, provider, and storage contracts
+  have independent versions.
 - Parallel scheduling is local to one run and process, bounded at 64 tasks, and defaults to sequential execution. Working-memory conflicts fail compilation, but tasks that target the same external resource still require explicit `needs` ordering or that system's concurrency controls. Separate runs also require external overlap controls when effects must not overlap.
 - Run budgets are optional. Provider input tokens and future token classes are
   estimated conservatively before dispatch; actual provider usage is
@@ -144,4 +147,4 @@ These are extension points, not incomplete core runtime behavior:
   vulnerability scan, and image SBOM run on Linux x64 and are labeled
   separately from that local evidence.
 - GitHub runner availability, organization action policy, branch protection, and required-check configuration are repository-owner operations and cannot be proven by repository-local lint.
-> Canonical source: [`docs/LIMITATIONS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/LIMITATIONS.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/LIMITATIONS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/LIMITATIONS.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/reference/live-framework-verification.md b/src/content/docs/_generated/reference/live-framework-verification.md
index 6ab1483..8a04d1a 100644
--- a/src/content/docs/_generated/reference/live-framework-verification.md
+++ b/src/content/docs/_generated/reference/live-framework-verification.md
@@ -100,4 +100,4 @@ was used.
 
 Sanitized machine-readable evidence is retained at the ignored path
 `.release-evidence/selective-repair/live-summary.json`.
-> Canonical source: [`docs/execution/LIVE_FRAMEWORK_VERIFICATION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/execution/LIVE_FRAMEWORK_VERIFICATION.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/execution/LIVE_FRAMEWORK_VERIFICATION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/execution/LIVE_FRAMEWORK_VERIFICATION.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/reference/migration.md b/src/content/docs/_generated/reference/migration.md
index d8b7ce0..a293c85 100644
--- a/src/content/docs/_generated/reference/migration.md
+++ b/src/content/docs/_generated/reference/migration.md
@@ -1,6 +1,6 @@
 ---
 title: "Migrate from TypeScript"
-description: "Translate supported legacy workflows to strict v1alpha1 YAML."
+description: "Translate supported legacy workflows to strict workflow API v1 YAML."
 editUrl: "https://github.com/opensourceops/agentctl/edit/main/docs/MIGRATING_FROM_TYPESCRIPT.md"
 ---
 1. Preserve a copy of the old workflow and run the archived test suite if its behavior matters: `NODE_OPTIONS=--no-deprecation npm test`.
@@ -16,4 +16,4 @@ editUrl: "https://github.com/opensourceops/agentctl/edit/main/docs/MIGRATING_FRO
 The automatic translator covers simple top-level metadata, modules/actions, tasks, heuristic agents, common approval mode, and initial working memory. It discards unsupported legacy provider endpoint/cache/profile fields with a migration warning rather than preserving unsafe or obsolete semantics. Pack-backed actions, remote transports, MongoDB/vector memory, arbitrary profiles, and custom TypeScript executors must be rewritten against the Rust contracts.
 
 Use `fixtures/compat/v0/assign.playbook.yaml` as the minimum preserved contract and compare changes against [Compatibility](/agentctl/reference/compatibility/). The old source is non-production reference material; do not add new behavior to it.
-> Canonical source: [`docs/MIGRATING_FROM_TYPESCRIPT.md`](https://github.com/opensourceops/agentctl/blob/main/docs/MIGRATING_FROM_TYPESCRIPT.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/MIGRATING_FROM_TYPESCRIPT.md`](https://github.com/opensourceops/agentctl/blob/main/docs/MIGRATING_FROM_TYPESCRIPT.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/reference/output.md b/src/content/docs/_generated/reference/output.md
index 08b57b9..3bdd13d 100644
--- a/src/content/docs/_generated/reference/output.md
+++ b/src/content/docs/_generated/reference/output.md
@@ -50,4 +50,4 @@ agentctl run examples/v1/hello.yaml --db /tmp/hello.db --output json --color nev
 ```
 
 These commands need no credential. `check` writes no runtime database; `run` writes `/tmp/hello.db`.
-> Canonical source: [`docs/reference/CLI_OUTPUT.md`](https://github.com/opensourceops/agentctl/blob/main/docs/reference/CLI_OUTPUT.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/reference/CLI_OUTPUT.md`](https://github.com/opensourceops/agentctl/blob/main/docs/reference/CLI_OUTPUT.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/reference/terminology.md b/src/content/docs/_generated/reference/terminology.md
index d154781..6a7951d 100644
--- a/src/content/docs/_generated/reference/terminology.md
+++ b/src/content/docs/_generated/reference/terminology.md
@@ -36,4 +36,4 @@ Use these terms consistently in workflows, documentation, issues, and reviews.
 | Pack | A local versioned manifest and reviewed reusable content with integrity checking. |
 
 Do not use resume, replay, retry, repair, and fork interchangeably. None of them means exactly-once execution.
-> Canonical source: [`docs/reference/TERMINOLOGY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/reference/TERMINOLOGY.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/reference/TERMINOLOGY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/reference/TERMINOLOGY.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/reference/yaml.md b/src/content/docs/_generated/reference/yaml.md
index 758b97a..938d465 100644
--- a/src/content/docs/_generated/reference/yaml.md
+++ b/src/content/docs/_generated/reference/yaml.md
@@ -9,7 +9,7 @@ The generated [workflow JSON Schema](/agentctl/downloads/workflow.schema.json) i
 
 | Field | Required | Meaning |
 | --- | --- | --- |
-| `apiVersion` | yes | Must be `agentctl.dev/v1alpha1`. |
+| `apiVersion` | yes | Must be `agentctl.dev/v1`. |
 | `kind` | yes | Must be `Workflow`. |
 | `metadata.name` | yes | Stable human-readable workflow name. |
 | `metadata.description` | no | Short purpose. |
@@ -228,4 +228,4 @@ sub-workflows](https://github.com/opensourceops/agentctl/blob/main/docs/guides/S
 [Compensation](https://github.com/opensourceops/agentctl/blob/main/docs/guides/COMPENSATION.md), [Secret
 references](https://github.com/opensourceops/agentctl/blob/main/docs/guides/SECRET_REFERENCES.md), [Policies](/agentctl/concepts/policies/),
 [Tools](/agentctl/concepts/tools/), and [Workflow DSL](/agentctl/concepts/workflow-model/).
-> Canonical source: [`docs/reference/YAML.md`](https://github.com/opensourceops/agentctl/blob/main/docs/reference/YAML.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/reference/YAML.md`](https://github.com/opensourceops/agentctl/blob/main/docs/reference/YAML.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/security/index.md b/src/content/docs/_generated/security/index.md
index f484346..e7c0f78 100644
--- a/src/content/docs/_generated/security/index.md
+++ b/src/content/docs/_generated/security/index.md
@@ -94,4 +94,4 @@ encryption is enabled. The local hash provider is deterministic lexical
 indexing and must not be described as a confidential local neural model.
 
 Report vulnerabilities privately to the repository maintainer. Do not include credentials, database contents, or production prompts in a report.
-> Canonical source: [`docs/SECURITY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/SECURITY.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/SECURITY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/SECURITY.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/security/threat-model.md b/src/content/docs/_generated/security/threat-model.md
index 3804db0..398828a 100644
--- a/src/content/docs/_generated/security/threat-model.md
+++ b/src/content/docs/_generated/security/threat-model.md
@@ -42,4 +42,4 @@ The local operator and reviewed binary are trusted. Workflow authors are only as
 No unresolved critical or high-severity defect is knowingly accepted for the implemented boundary. Host process policy, native OS sandboxing, signature verification, and distributed concurrency are not implied controls. Container isolation is claimed only for actions that explicitly request and successfully preflight that mode. State encryption protects its documented columns only and is not described as full-database encryption.
 
 Run access control is the database file and operating-system identity. `agentctl` has no multi-tenant authorization layer; do not let an untrusted principal select another tenant's source run from a shared database.
-> Canonical source: [`docs/THREAT_MODEL.md`](https://github.com/opensourceops/agentctl/blob/main/docs/THREAT_MODEL.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/THREAT_MODEL.md`](https://github.com/opensourceops/agentctl/blob/main/docs/THREAT_MODEL.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/troubleshooting/index.md b/src/content/docs/_generated/troubleshooting/index.md
index 6d2cff9..0e73e73 100644
--- a/src/content/docs/_generated/troubleshooting/index.md
+++ b/src/content/docs/_generated/troubleshooting/index.md
@@ -25,7 +25,8 @@ The path separates pre-run validation from durable runtime failures. An uncertai
 
 **Symptom:** `check`, `plan`, or `run` reports invalid YAML, a missing reference, unsupported capability, or bad template.
 
-**Likely cause:** The strict `v1alpha1` schema rejected a field or the compiler could not prove the graph and capabilities.
+**Likely cause:** The strict workflow API v1 schema rejected a field or the
+compiler could not prove the graph and capabilities.
 
 **Diagnose:**
 
@@ -185,4 +186,4 @@ gates pass for the current candidate.
 ## Safe issue report
 
 Include the exact `agentctl version`, operating system, redacted command, exit code, diagnostic code, workflow API version, minimal non-secret workflow, and relevant run/trace IDs. Share a narrow redacted `inspect` excerpt only when needed. Report security problems through the private process in [Security](/agentctl/security/), not a public issue.
-> Canonical source: [`docs/guides/TROUBLESHOOTING.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/TROUBLESHOOTING.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/guides/TROUBLESHOOTING.md`](https://github.com/opensourceops/agentctl/blob/main/docs/guides/TROUBLESHOOTING.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/overview.md b/src/content/docs/overview.md
index f4b7b58..fdd10b5 100644
--- a/src/content/docs/overview.md
+++ b/src/content/docs/overview.md
@@ -24,9 +24,17 @@ description: Understand the problem agentctl solves, its control model, current
 
 ## Current maturity
 
-The workflow API is `agentctl.dev/v1alpha1`. The current source is production-oriented alpha software with exact-commit local and hosted release-candidate evidence. Deterministic and fake-provider journeys have executable local evidence, while Linux x64, macOS arm64, Windows x64, container, security, package, SBOM, and release-preparation gates have hosted evidence. Native provider and protocol evidence varies by adapter and is stated in the [capability matrices](/agentctl/reference/capabilities/).
-
-This site does not claim stable v1 compatibility, exactly-once execution, an operating-system sandbox, distributed scheduling, parallel task execution, or live validation across every provider.
+The workflow API is `agentctl.dev/v1`. Agentctl 0.3 has exact-commit local and
+hosted release evidence. Deterministic and fake-provider journeys have
+executable local evidence, while Linux x64, macOS arm64, Windows x64,
+container, security, package, SBOM, and release-preparation gates have hosted
+evidence. Native provider and protocol evidence varies by adapter and is stated
+in the [capability matrices](/agentctl/reference/capabilities/).
+
+The workflow document API is stable. The CLI and crates remain pre-1.0, and
+this site does not claim long-term support, exactly-once execution, an
+operating-system sandbox, distributed scheduling, or live validation across
+every provider.
 
 ## Source of truth
 
diff --git a/src/content/docs/why-agentctl.md b/src/content/docs/why-agentctl.md
index 3542b80..59ea217 100644
--- a/src/content/docs/why-agentctl.md
+++ b/src/content/docs/why-agentctl.md
@@ -31,4 +31,8 @@ A direct model call is easy to start. It becomes harder to review when prompts i
 
 ## Reasons not to choose it
 
-Do not choose the current release when you require a stable workflow API, distributed execution, parallel tasks, a hosted scheduler, a visual builder, an in-process sandbox, encrypted persistence, or a live support claim for every provider. Read [Limitations](/agentctl/reference/limitations/) before adopting the `v1alpha1` API.
+Do not choose the current release when you require a 1.0 CLI or long-term
+support contract, distributed execution, a hosted scheduler, a visual builder,
+an operating-system-enforced in-process sandbox, or live support evidence for
+every provider. Read [Limitations](/agentctl/reference/limitations/) before
+adopting workflow API `agentctl.dev/v1`.
diff --git a/src/data/agentctl-source.json b/src/data/agentctl-source.json
index eb3f9d8..95c4d07 100644
--- a/src/data/agentctl-source.json
+++ b/src/data/agentctl-source.json
@@ -1,8 +1,8 @@
 {
   "product": "agentctl",
-  "version": "0.2.0",
-  "workflowApi": "agentctl.dev/v1alpha1",
-  "commit": "736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47",
+  "version": "0.3.0",
+  "workflowApi": "agentctl.dev/v1",
+  "commit": "2aeaa88fba71162206b5f08f5bda4f0150247e4f",
   "dirty": false,
   "sourceRepository": "https://github.com/opensourceops/agentctl",
   "importedFiles": 61
diff --git a/src/data/home-workflow.yaml b/src/data/home-workflow.yaml
index ff6d5d4..36bc906 100644
--- a/src/data/home-workflow.yaml
+++ b/src/data/home-workflow.yaml
@@ -1,4 +1,4 @@
-apiVersion: agentctl.dev/v1alpha1
+apiVersion: agentctl.dev/v1
 kind: Workflow
 metadata:
   name: acceptance-mock-tool
diff --git a/tests/site.spec.ts b/tests/site.spec.ts
index 54fac60..f18be6c 100644
--- a/tests/site.spec.ts
+++ b/tests/site.spec.ts
@@ -40,7 +40,7 @@ test('homepage workflow copy control works', async ({ page }) => {
   await page.getByRole('button', { name: 'Copy workflow YAML' }).click();
   await expect(page.getByRole('button', { name: 'Copy workflow YAML' })).toHaveText('Copied');
   const clipboard = await page.evaluate(() => navigator.clipboard.readText());
-  expect(clipboard).toContain('apiVersion: agentctl.dev/v1alpha1');
+  expect(clipboard).toContain('apiVersion: agentctl.dev/v1');
 });
 
 test('navigation and sidebar reach important sections', async ({ page }) => {