v1.0.0 — first stable public developer release

Statewave v1.0 is the first stable public developer release of the open-source memory runtime that gives AI agents reproducible, provenance-tagged context. The v1 API contract (/v1/*) and the v0.9 governance surfaces (HMAC-signed receipts, replay, sensitivity labels with declarative policy, opt-in detector-suggested labels, per-region residency pinning) are now considered stable for developer use under a self-hosted deployment model. Limitations are documented in why-statewave.md; see v1.0-readiness-checklist.md for the full sign-off artefact.

What is stable in v1.0

• The /v1 API contract — backward-compatible additions only from here.
• The v0.9 governance surfaces — HMAC-signed state-assembly receipts, receipt-driven replay (current code + original policy), per-memory sensitivity labels + declarative YAML policy, opt-in detector-suggested labels, per-region data residency.
• Both SDKs at v1.0.0 — statewave (PyPI) and @statewavedev/sdk (npm), typed surfaces matching the REST contract, semver-stable from 1.0.0.
• Multi-replica API deployment — supported and verified since v0.8 (single-Postgres only).

What landed for v1.0

• Public GET /v1/version (#178).
• Python SDK governance helpers — list_suggested_labels() / promote_suggested_labels() (#176).
• session_id on create_episode in both SDKs (#174).
• Webhook delivery stats + tenant scoping; a correctness lap across admin / receipts / conflicts / backup / embeddings / snapshots surfaces.

What v1.0 does NOT promise

Carried forward honestly from why-statewave.md: not load-tested at >10k subjects; single-Postgres only (no cross-region clustering); app-layer tenant isolation (no Postgres RLS yet); no second-region failover; no admin-action identity (promoted_by); LLM-vs-heuristic compiler eval not yet published. Not "GA", not "production-ready", not "battle-tested", not "enterprise-ready".

Full notes: release-notes/v1.0-launch.md.