opensourceops · Ompragash · Jul 28, 2026 · Jul 28, 2026
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
@@ -15,7 +15,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  AGENTCTL_COMMIT: "736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47"
+  AGENTCTL_COMMIT: "2aeaa88fba71162206b5f08f5bda4f0150247e4f"
   NODE_VERSION: "24.4.1"
   PNPM_VERSION: "11.9.0"
   RUST_TOOLCHAIN: "1.88.0"

diff --git a/astro.config.mjs b/astro.config.mjs
@@ -56,7 +56,7 @@ export default defineConfig({
         {
           label: 'Start here',
           items: [
-            { slug: 'overview', label: 'Overview', badge: 'v1alpha1' },
+            { slug: 'overview', label: 'Overview', badge: 'v1' },
             { slug: 'why-agentctl', label: 'Why agentctl' },
             { slug: 'concepts/product', label: 'Product definition' },
             { slug: 'concepts/framework-completeness', label: 'Framework completeness' },

diff --git a/docs/execution/AGENTCTL_DOCS_DECISIONS.md b/docs/execution/AGENTCTL_DOCS_DECISIONS.md
@@ -28,7 +28,12 @@ A checked manifest maps canonical source files to public routes. The importer fa
 
 Status: accepted, 2026-07-23.
 
-Public pages distinguish deterministic tests, mock-protocol tests, retained live OpenAI evidence, locally executed container evidence, hosted CI configuration, hosted CI execution, syntax validation, deferred work, and unsupported work. The site calls the project a `v1alpha1` release candidate preparation, not stable or production proven.
+Public pages distinguish deterministic tests, mock-protocol tests, retained
+live OpenAI evidence, locally executed container evidence, hosted CI execution,
+syntax validation, deferred work, and unsupported work. The site identifies
+`agentctl.dev/v1` as the stable workflow document API while keeping the 0.3 CLI
+and crates explicitly pre-1.0 and avoiding unsupported production or provider
+claims.
 
 ## D006: Static and restrained design
 

diff --git a/docs/execution/AGENTCTL_DOCS_INFORMATION_ARCHITECTURE.md b/docs/execution/AGENTCTL_DOCS_INFORMATION_ARCHITECTURE.md
@@ -16,7 +16,7 @@
 - Architecture
 - Contributing
 - GitHub
-- `v1alpha1` maturity indicator
+- workflow API `v1` indicator
 
 ## Learning paths
 

diff --git a/public/meta/agentctl-source.json b/public/meta/agentctl-source.json
@@ -1,8 +1,8 @@
 {
   "product": "agentctl",
-  "version": "0.2.0",
-  "workflowApi": "agentctl.dev/v1alpha1",
-  "commit": "736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47",
+  "version": "0.3.0",
+  "workflowApi": "agentctl.dev/v1",
+  "commit": "2aeaa88fba71162206b5f08f5bda4f0150247e4f",
   "dirty": false,
   "sourceRepository": "https://github.com/opensourceops/agentctl",
   "importedFiles": 61

diff --git a/scripts/content-manifest.mjs b/scripts/content-manifest.mjs
@@ -6,7 +6,7 @@ export const contentManifest = [
   ['docs/TOOLS.md', '_generated/concepts/tools.md', 'Tools and effects', 'Tool contracts, effect classes, idempotency, and deterministic checks.'],
   ['docs/memory.md', '_generated/concepts/memory.md', 'State and memory', 'Separate runtime state, working memory, long-term memory, and prompt cache.'],
   ['docs/PACKS.md', '_generated/concepts/packs.md', 'Reusable packs', 'Use versioned local content with integrity verification.'],
-  ['docs/guides/INSTALLATION.md', '_generated/getting-started/installation.md', 'Installation', 'Build or install the current v1alpha1 candidate from reviewed source.'],
+  ['docs/guides/INSTALLATION.md', '_generated/getting-started/installation.md', 'Installation', 'Build or install agentctl 0.3 with workflow API v1 from reviewed source.'],
   ['docs/guides/GETTING_STARTED.md', '_generated/getting-started/index.md', 'Getting started', 'Run and inspect a credential-free deterministic workflow.'],
   ['docs/guides/FIRST_AGENT_WORKFLOW.md', '_generated/getting-started/first-agent.md', 'First agent workflow', 'Run a bounded tool-using agent without a paid API key.'],
   ['docs/guides/WORKFLOW_AUTHORING.md', '_generated/guides/workflow-authoring.md', 'Author workflows', 'Learn workflow YAML in execution order.'],
@@ -42,7 +42,7 @@ export const contentManifest = [
   ['docs/execution/COMPLETENESS_VERIFICATION.md', '_generated/reference/completeness-verification.md', 'Completeness verification', 'Deterministic, container, security, and independent review evidence.'],
   ['docs/execution/LIVE_FRAMEWORK_VERIFICATION.md', '_generated/reference/live-framework-verification.md', 'Live framework verification', 'Sanitized GPT-5.6 scenario, recovery, replay, usage, and container evidence.'],
   ['docs/COMPATIBILITY.md', '_generated/reference/compatibility.md', 'Compatibility', 'Preserved, migrated, changed, removed, and explicit non-goal contracts.'],
-  ['docs/MIGRATING_FROM_TYPESCRIPT.md', '_generated/reference/migration.md', 'Migrate from TypeScript', 'Translate supported legacy workflows to strict v1alpha1 YAML.'],
+  ['docs/MIGRATING_FROM_TYPESCRIPT.md', '_generated/reference/migration.md', 'Migrate from TypeScript', 'Translate supported legacy workflows to strict workflow API v1 YAML.'],
   ['docs/ARCHITECTURE.md', '_generated/architecture/index.md', 'Architecture overview', 'Crate boundaries, execution, determinism, concurrency, and packaging.'],
   ['docs/architecture/DIAGRAMS.md', '_generated/architecture/diagrams.md', 'Architecture diagrams', 'Fourteen verified diagrams for compilation, state, effects, recovery, deployment, and crates.'],
   ['docs/adr/0001-deterministic-core-explicit-effects.md', '_generated/architecture/decisions/0001.md', 'ADR 0001: Deterministic core', 'Keep graph, policy, state, and replay model-independent.'],
@@ -59,5 +59,5 @@ export const contentManifest = [
   ['docs/development/ADD_MIGRATION.md', '_generated/contributing/add-migration.md', 'Add a store migration', 'Version and test forward SQLite migrations.'],
   ['docs/development/DOCUMENTATION.md', '_generated/contributing/documentation.md', 'Write documentation', 'Own content in the right repository and verify it end to end.'],
   ['docs/TESTING.md', '_generated/contributing/testing.md', 'Testing strategy', 'Credential-free gates, acceptance layers, fuzzing, and live evidence.'],
-  ['docs/RELEASE_PROCESS.md', '_generated/contributing/release.md', 'Release process', 'Prepare and verify a v1alpha1 release candidate without overstating evidence.']
+  ['docs/RELEASE_PROCESS.md', '_generated/contributing/release.md', 'Release process', 'Prepare and verify an exact-commit release without overstating evidence.']
 ];
diff --git a/scripts/sync-agentctl.mjs b/scripts/sync-agentctl.mjs
@@ -221,7 +221,7 @@ await copyFile(
 const metadata = {
   product: 'agentctl',
   version,
-  workflowApi: 'agentctl.dev/v1alpha1',
+  workflowApi: 'agentctl.dev/v1',
   commit,
   dirty,
   sourceRepository: 'https://github.com/opensourceops/agentctl',

diff --git a/src/components/Header.astro b/src/components/Header.astro
@@ -14,7 +14,7 @@ const base = import.meta.env.BASE_URL;
 <div class="site-header">
   <div class="title-wrapper sl-flex">
     <SiteTitle />
-    <span class="maturity" aria-label="Workflow API maturity: version 1 alpha 1">v1alpha1</span>
+    <span class="maturity" aria-label="Workflow API version 1">v1</span>
   </div>
   <nav class="top-links" aria-label="Primary">
     <a href={`${base}overview/`}>Docs</a>

diff --git a/src/components/Homepage.astro b/src/components/Homepage.astro
@@ -166,15 +166,15 @@ const shortCommit = source.commit.slice(0, 8);
       <p class="eyebrow">Current maturity</p>
       <h2 id="maturity-title">Exact-commit evidence across local and hosted gates</h2>
       <p>
-        The workflow API is <code>agentctl.dev/v1alpha1</code>. Deterministic composition, durable recovery,
+        The workflow API is <code>agentctl.dev/v1</code>. Deterministic composition, durable recovery,
         local persistence, native Linux arm64 containers, and bounded GPT-5.6 journeys have executable evidence.
-        The pinned candidate also passed hosted Linux x64, macOS arm64, Windows x64, container, security,
+        The pinned 0.3 release source also passed hosted Linux x64, macOS arm64, Windows x64, container, security,
         package, SBOM, and release-preparation gates. Other native providers and protocols have mock coverage
         at documented levels.
       </p>
     </div>
     <ul>
-      <li>No stable v1 compatibility promise</li>
+      <li>Stable workflow API v1; CLI and crates remain pre-1.0</li>
       <li>No exactly-once or in-process sandbox claim</li>
       <li>No distributed or cross-run scheduler claim</li>
       <li>No claim of live validation across every provider</li>

diff --git a/src/content/docs/_generated/architecture/decisions/0001.md b/src/content/docs/_generated/architecture/decisions/0001.md
@@ -8,4 +8,4 @@ Status: accepted, 2026-07-22.
 The graph, policy, state machine, persistence decisions, and recorded replay remain model-independent. Provider, tool, filesystem, process, MCP, A2A, internal-state mutation, clock, and ID behavior cross injected interfaces and receive durable effect identity when externally observable.
 
 This keeps models replaceable and tests credential-free. It requires more records and conservative uncertain states, but avoids hidden calls during replay. Dynamic model-owned orchestration is rejected.
-> Canonical source: [`docs/adr/0001-deterministic-core-explicit-effects.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0001-deterministic-core-explicit-effects.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/adr/0001-deterministic-core-explicit-effects.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0001-deterministic-core-explicit-effects.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/architecture/decisions/0002.md b/src/content/docs/_generated/architecture/decisions/0002.md
@@ -8,4 +8,4 @@ Status: accepted, 2026-07-22.
 Workflows use `apiVersion`, `kind`, `metadata`, and `spec`. The envelope is adopted because identity/version and evolution need unambiguous locations, not because another system uses it. All typed objects deny unknown fields and a generated JSON Schema is checked in.
 
 A narrow legacy translator provides actionable migration. General aliases and silent coercion are rejected because they make security review and durable reproduction ambiguous.
-> Canonical source: [`docs/adr/0002-versioned-strict-workflow-envelope.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0002-versioned-strict-workflow-envelope.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/adr/0002-versioned-strict-workflow-envelope.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0002-versioned-strict-workflow-envelope.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/architecture/decisions/0003.md b/src/content/docs/_generated/architecture/decisions/0003.md
@@ -8,4 +8,4 @@ Status: accepted, 2026-07-22.
 One versioned SQLite database is the local correctness store. Transactional task transitions/checkpoints/audits and a request-before-start effect ledger support resume and no-effect replay. Confirmed results are reused; started unconfirmed work becomes uncertain.
 
 No exactly-once claim is made. Automatic retry of ambiguous external effects is rejected. Fork is the explicit operation for fresh effects. Distributed history services are outside this release.
-> Canonical source: [`docs/adr/0003-sqlite-history-and-conservative-recovery.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0003-sqlite-history-and-conservative-recovery.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/adr/0003-sqlite-history-and-conservative-recovery.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0003-sqlite-history-and-conservative-recovery.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/architecture/decisions/0004.md b/src/content/docs/_generated/architecture/decisions/0004.md
@@ -8,4 +8,4 @@ Status: accepted, 2026-07-22.
 OpenAI Responses, Azure OpenAI Responses, Anthropic Messages, Google Gemini generateContent, and a scripted fake implement one provider-neutral internal interface. Capabilities are negotiated before execution; provider SDK/HTTP shapes never enter durable core state.
 
 “OpenAI-compatible” shims are rejected as a support claim because they hide native tool, continuation, reasoning, error, and usage differences. Every provider requires mock protocol coverage; live credentials are optional evidence only.
-> Canonical source: [`docs/adr/0004-native-provider-adapters.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0004-native-provider-adapters.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/adr/0004-native-provider-adapters.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0004-native-provider-adapters.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/architecture/decisions/0005.md b/src/content/docs/_generated/architecture/decisions/0005.md
@@ -13,4 +13,4 @@ their deterministic semantics existed. ADRs 0008, 0010, and 0011 now define
 those contracts. Sub-workflows, teams/handoffs, automatic
 reconnection/resubmission, executable plugin ABIs, and registries remain
 separate product decisions.
-> Canonical source: [`docs/adr/0005-narrow-v1-scheduling-and-extensions.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0005-narrow-v1-scheduling-and-extensions.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/adr/0005-narrow-v1-scheduling-and-extensions.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0005-narrow-v1-scheduling-and-extensions.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/architecture/decisions/0006.md b/src/content/docs/_generated/architecture/decisions/0006.md
@@ -20,4 +20,4 @@ resource requires serialization.
 ## Consequences
 
 Cron, systemd, Kubernetes, and CI can use normal process semantics without hidden terminal waits. The product avoids an eventing/distributed-control-plane surface. A future schedule-run key may improve deduplication, but it cannot replace external overlap controls or effect idempotency.
-> Canonical source: [`docs/adr/0006-schedulable-runtime-and-noninteractive-contract.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0006-schedulable-runtime-and-noninteractive-contract.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/adr/0006-schedulable-runtime-and-noninteractive-contract.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0006-schedulable-runtime-and-noninteractive-contract.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/architecture/decisions/0007.md b/src/content/docs/_generated/architecture/decisions/0007.md
@@ -14,4 +14,4 @@ The image entrypoint is `agentctl`. Callers supply ordinary CLI arguments and on
 ## Consequences
 
 No vendor-specific plugin API is required. Platforms without direct entrypoint/argument support can invoke `docker run` from their normal shell step. Distroless reduces runtime surface but deliberately has no shell; debugging uses the public CLI or a separate diagnostic image, not mutation of production images.
-> Canonical source: [`docs/adr/0007-generic-oci-step-contract.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0007-generic-oci-step-contract.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/adr/0007-generic-oci-step-contract.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0007-generic-oci-step-contract.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/architecture/diagrams.md b/src/content/docs/_generated/architecture/diagrams.md
@@ -3,7 +3,8 @@ title: "Architecture diagrams"
 description: "Fourteen verified diagrams for compilation, state, effects, recovery, deployment, and crates."
 editUrl: "https://github.com/opensourceops/agentctl/edit/main/docs/architecture/DIAGRAMS.md"
 ---
-These diagrams explain implemented `v1alpha1` behavior. Each diagram is paired with text so the relationship is available when Mermaid cannot render.
+These diagrams explain implemented workflow API v1 behavior. Each diagram is
+paired with text so the relationship is available when Mermaid cannot render.
 
 ## High-level system architecture
 
@@ -313,4 +314,4 @@ flowchart TD
 ```
 
 `agentctl-core` has no dependency on HTTP, SQLite, CLI parsing, or concrete executor types. `xtask` drives the built CLI for generation and acceptance.
-> Canonical source: [`docs/architecture/DIAGRAMS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/architecture/DIAGRAMS.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/architecture/DIAGRAMS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/architecture/DIAGRAMS.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/architecture/index.md b/src/content/docs/_generated/architecture/index.md
@@ -78,4 +78,4 @@ ADR 0020. Run budget coordination is described by ADR 0021.
 The OCI build is multi-stage: only the optimized Rust binary enters a maintained distroless runtime with CA roots and a non-root identity. `/config` is workflow configuration, `/workspace` is the read-only working tree, `/state` holds SQLite and the content-addressed artifact store, and `/artifacts` receives declared workflow outputs. State must be mounted again for inspect/resume/replay/repair and artifact export. The root filesystem may be read-only. See [Container contract](/agentctl/guides/container/) and ADR 0007.
 
 See the [architecture diagrams](/agentctl/architecture/diagrams/), [ADRs](https://github.com/opensourceops/agentctl/blob/main/docs/adr/), and [Durable execution](/agentctl/durable-execution/) for failure semantics.
-> Canonical source: [`docs/ARCHITECTURE.md`](https://github.com/opensourceops/agentctl/blob/main/docs/ARCHITECTURE.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/ARCHITECTURE.md`](https://github.com/opensourceops/agentctl/blob/main/docs/ARCHITECTURE.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/concepts/framework-completeness.md b/src/content/docs/_generated/concepts/framework-completeness.md
@@ -143,4 +143,4 @@ restricted-token/job-object backend is claimed.
 External schedulers own triggers and overlap policy. Containers, VMs, platform
 identities, and egress controls remain the strongest isolation boundary for
 hostile workloads.
-> Canonical source: [`docs/execution/FRAMEWORK_COMPLETENESS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/execution/FRAMEWORK_COMPLETENESS.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/execution/FRAMEWORK_COMPLETENESS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/execution/FRAMEWORK_COMPLETENESS.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/concepts/memory.md b/src/content/docs/_generated/concepts/memory.md
@@ -83,4 +83,4 @@ Entries are capped at 1 MiB, queries at 64 KiB, results at 100, embedding
 dimensions from 8 through 4096, and a local search scan at 10,000 active
 candidates. Corrupt or mismatched vector dimensions fail closed. Retention is
 applied during reads/search and by garbage collection, not by replay.
-> Canonical source: [`docs/memory.md`](https://github.com/opensourceops/agentctl/blob/main/docs/memory.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/memory.md`](https://github.com/opensourceops/agentctl/blob/main/docs/memory.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/concepts/packs.md b/src/content/docs/_generated/concepts/packs.md
@@ -121,4 +121,4 @@ bundles, identity policy, unsigned process denial, and dependency reachability.
 Packaged acceptance scenario 42 verifies the checked-in transitive example,
 locks an extension pack, proves that its process cannot start before explicit
 trust authorization, executes it once, and replays without another invocation.
-> Canonical source: [`docs/PACKS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/PACKS.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/PACKS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/PACKS.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.
diff --git a/src/content/docs/_generated/concepts/policies.md b/src/content/docs/_generated/concepts/policies.md
@@ -43,4 +43,4 @@ An approval stores the run/trace/task/agent, tool, capability, risk, redacted in
 Provider, MCP, A2A, filesystem, process, and environment allowlists are
 necessary controls, not a containment boundary. Use `isolation: container` or
 an externally managed container/VM boundary for untrusted executors.
-> Canonical source: [`docs/policies.md`](https://github.com/opensourceops/agentctl/blob/main/docs/policies.md). Verified against agentctl commit `736379ed5f49b0dbe1ad79ac4e4ba794e2c73c47`.
+> Canonical source: [`docs/policies.md`](https://github.com/opensourceops/agentctl/blob/main/docs/policies.md). Verified against agentctl commit `2aeaa88fba71162206b5f08f5bda4f0150247e4f`.