Release Cove1.0.0 with verified source installation and handoffs

.dockerignore

@@ -5,6 +5,7 @@ node_modules
 .pnpm-store
 .cache
 dist
+release-artifacts
 backups
 test-results
 playwright-report

.github/workflows/ci.yml

@@ -1,5 +1,9 @@
 name: Cove verification
-on: [push, pull_request]
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
 permissions:
   contents: read
 jobs:
@@ -96,7 +100,7 @@ jobs:
           } finally { await pool.end(); }
           NODE
       - run: node scripts/backup-verify.mjs
-      - run: docker build -t cove:0.1.0 .
+      - run: docker build -t cove:1.0.0 .
       - run: node scripts/verify-container.mjs
       - uses: actions/upload-artifact@v4
         if: always()
@@ -108,3 +112,52 @@ jobs:
       - name: Remove this disposable CI stack
         if: always()
         run: docker compose down --volumes --remove-orphans
+
+  source:
+    name: Package committed source
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: "24"
+      - run: node scripts/package-release.mjs
+      - name: Check source archive and checksum
+        run: |
+          cd release-artifacts
+          sha256sum -c cove_*.zip.sha256
+          unzip -t cove_*.zip
+      - name: Keep versioned source
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: cove-source
+          path: |
+            release-artifacts/cove_*_source.zip
+            release-artifacts/cove_*_source.zip.sha256
+          if-no-files-found: error
+          overwrite: true
+  publish:
+    name: Publish verified source release
+    needs: [verify, recovery, source]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    concurrency:
+      group: cove-release
+      cancel-in-progress: false
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - name: Read source package from this verified run
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: cove-source
+          path: release-artifacts
+      - name: Publish complete source package
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        with:
+          script: |
+            const { pathToFileURL } = require('node:url');
+            const { resolve } = require('node:path');
+            const { default: publish } = await import(pathToFileURL(resolve('scripts/release.mjs')).href);
+            await publish({ github, context, core });

.gitignore

@@ -1,5 +1,6 @@
 node_modules/
 dist/
+release-artifacts/
 .env
 .env.*
 !.env.example

CHANGELOG.md

@@ -0,0 +1,9 @@
+# Changelog
+
+## 1.0.0
+
+Cove's first stable source release defines the website, installed Codex plugin, and PostgreSQL source-installation paths. It includes structured private project context, revision history, pinned handoffs, explicit assistant project grants, and JSON/Markdown portability.
+
+The release adds a source ZIP with a SHA256 checksum, consistent package/container/MCP version metadata, and a bounded v1 support contract. It updates the MCP client to 2.2.0 and the transitive Sharp dependency to 0.35.5 for the upstream published fixes.
+
+See [v1 delivery and limitations](docs/v1.md) and [October 6 verification](docs/verification-2026-10-06.md) before choosing an installation path.

README.md

@@ -6,6 +6,8 @@ Cove keeps your project's goals, decisions, sources, progress, and next steps in
 
 **[Open Cove](https://cove-context.alx21.chatgpt.site)** · **[Getting started](docs/getting-started.md)** · **[Documentation](docs/README.md)**
 
+[Cove v1](docs/v1.md) defines the supported website, installed Codex plugin, and PostgreSQL source-installation paths. [Versioned releases](https://github.com/agammann/cove/releases) include source and SHA256 checksums.
+
 ## Start with the website
 
 1. Open Cove and sign in with ChatGPT.

compose.production.yaml

@@ -15,7 +15,7 @@ services:
       retries: 20
   api:
     build: .
-    image: cove:0.1.0
+    image: cove:1.0.0
     env_file: .env.production
     environment:
       NODE_ENV: production

docs/README.md

@@ -15,6 +15,7 @@
 
 | Guide | Applies to |
 | --- | --- |
+| [Cove v1](v1.md) | Supported paths, versioned source installation, stable interfaces and release limits |
 | [Local development](development.md) | Setup, build commands, testing, and troubleshooting for both distributions |
 | [Sites](sites.md) | The public app: Worker, D1, ChatGPT sign in, deployment configuration, and hosted verification |
 | [PostgreSQL architecture](architecture.md) | The original Fastify service and PostgreSQL data model |
@@ -29,6 +30,7 @@ Current automated results are in [GitHub Actions](https://github.com/agammann/co
 
 | Record | Scope |
 | --- | --- |
+| [October 6 verification](verification-2026-10-06.md) | Native connector retries/conflicts, fresh-assistant pinned continuation, updated dependencies and isolated source-installation checks |
 | [October 2 verification](verification-2026-10-02.md) | Dependency updates, compiled browser journey, actual HTTP OAuth/MCP checks and the native Codex MCP host against the public app |
 | [September 19 live acceptance](live-acceptance-2026-09-19.md) | Public browser and mobile journeys, live OAuth/MCP, reproduced issues, fixes, and remaining boundaries |
 | [Sites verification](sites.md#verification-on-september-13-2026) | Hosted browser verification, local Worker tests, and remaining external host checks |
@@ -39,4 +41,4 @@ Current automated results are in [GitHub Actions](https://github.com/agammann/co
 | [Design research](design-research.md) | Visual references and redesign direction |
 | [Pilot plan](pilot.md) | Proposed evaluation, not completed customer research |
 
-The native Codex MCP host and signed-in public browser workflow have live verification. ChatGPT's assistant connection, model-generated save/continue conversations and production disaster recovery remain unverified. Each report distinguishes host tool calls, SDK fixtures, browser use and local recovery exercises.
+The native Codex MCP host, installed Cove plugin save/continue workflow, and signed-in public browser workflow have dated live verification. A separate ChatGPT web assistant connection and production disaster recovery remain unverified. Each report distinguishes host tool calls, SDK fixtures, browser use and local recovery exercises.

docs/development.md

@@ -36,6 +36,8 @@ pnpm start
 
 The setup script creates `.env` with a random session secret and preserves an existing file. Compose starts PostgreSQL and Mailpit. Database data persists in the named `cove-data` volume. These defaults are for local development; see [operations](operations.md) for an independent production installation.
 
+For a versioned source installation, download `cove_1.0.0_source.zip` and its `.sha256` file from the [GitHub release](https://github.com/agammann/cove/releases/tag/v1.0.0), verify the checksum as described in [v1 delivery](v1.md#source-release), and extract it. Open a terminal in `cove-1.0.0` and start with `pnpm install --frozen-lockfile` above. The archive includes source, locked dependencies, migrations, and documentation; install dependencies and build the local server on your machine.
+
 Keep that terminal running and open `http://localhost:4317` on the same computer. Create an account with a password of at least 12 characters. Open `http://localhost:8025` for Mailpit and follow the verification email's link. Mailpit captures development email; it does not deliver it to your real inbox. Password recovery uses it too.
 
 Create a project and follow the [first handoff walkthrough](getting-started.md#create-your-first-project). Local accounts are separate from the public app's ChatGPT accounts. There is no seeded administrator.
@@ -128,8 +130,8 @@ The [CI workflow](../.github/workflows/ci.yml) builds both distributions and run
 
 ```sh
 node scripts/backup-verify.mjs
+docker build -t cove:1.0.0 .
 node scripts/verify-container.mjs
-docker build -t cove:0.1.0 .
 ```
 
 The recovery exercise restarts this Compose project's database and leaves an ignored local dump. Run it when no one is actively using that local instance. Read the [backup and recovery procedure](operations.md) first. These checks do not establish production disaster recovery or real external assistant host compatibility.

docs/mcp.md

@@ -14,6 +14,8 @@ Custom assistant clients continue to use `/api/mcp` and the existing Cove OAuth
 
 The [October 4 production check](verification-assistant-2026-10-04.md) verified the installed Cove plugin in Codex: an assistant saved context, read it back exactly, created a pinned handoff, and a fresh assistant retrieved that handoff and correctly used its saved context. This uses the managed route and is separate from the earlier custom OAuth host checks below.
 
+The [October 6 check](verification-2026-10-06.md) repeated an exact save/readback, identical retry, rejected stale write, and pinned handoff retrieval through the installed plugin. A fresh assistant retrieved the pinned snapshot with newer context present and distinguished its saved facts from the later changes.
+
 | Tool | Inputs | Result |
 | --- | --- | --- |
 | `cove_list_projects` | offset, limit (1–50) | Granted projects, IDs, versions, next offset |
@@ -50,7 +52,7 @@ Retrieve Cove handoff HANDOFF_ID for project PROJECT_ID. Keep its original snaps
 | Official TypeScript SDK 2.0.0, two independent OAuth clients | Loopback HTTP, native callbacks, S256 PKCE, resource audience, separate grants | Executed in integration tests; see verification report |
 | Cove browser/manual workflow | Same-origin UI, private copy formats | Executed by Playwright; see browser report |
 | Native Codex 0.159.2 MCP host on Windows | Public remote MCP URL, browser OAuth, one project with read/write/handoff grants | [October 2 live host checks](verification-2026-10-02.md#public-app-and-native-codex-host): all seven tools, save/handoff retries, conflict rejection, pinned snapshots and browser-visible persistence passed through the app-server's MCP tool-call interface; model-generated save/continue conversations were not exercised |
-| Installed Cove plugin in Codex | Production managed `/mcp`, Sites identity, explicit read/write/handoff grant for one disposable project | [October 4 live assistant check](verification-assistant-2026-10-04.md): save from version 3 to 4, exact readback, pinned handoff and fresh-assistant continuation passed through native plugin tools |
+| Installed Cove plugin in Codex | Production managed `/mcp`, Sites identity, explicit read/write/handoff grant for one disposable project | [October 6 live check](verification-2026-10-06.md): exact save/readback, retry/conflict handling, pinned handoff and fresh-assistant continuation with newer context present passed through native plugin tools; [October 4 record](verification-assistant-2026-10-04.md) remains available |
 | ChatGPT web UI client | Installed plugin and account's available connection flow | A separate ChatGPT web UI run was not performed; the October 4 installed-plugin test above ran in Codex |
 
 Checked official instructions: [Codex MCP](https://learn.chatgpt.com/docs/extend/mcp?surface=cli) and [ChatGPT connection testing](https://developers.openai.com/plugins/deploy/connect-chatgpt). Exact host UI and availability can vary by account. The October 2 check used a temporary host configuration and did not change the user's persistent MCP configuration. Record client/version, date, endpoint, configuration, grants, and actual saved IDs when verifying a host. Do not call provider support verified based only on registration or discovery.

docs/release-readiness.md

@@ -1,5 +1,7 @@
 # Release readiness
 
+The current release contract and supported delivery paths are in [Cove v1](v1.md). The record below describes the earlier PostgreSQL candidate and keeps its original scope and prerequisites.
+
 **Historical PostgreSQL release snapshot, before the Sites launch.** The original status and prerequisites below are preserved for that distribution. The public app subsequently launched on OpenAI Sites; see [Sites status and verification](sites.md) and [current automated checks](https://github.com/agammann/cove/actions/workflows/ci.yml). Start with [the user guide](getting-started.md) to use the hosted app.
 
 **Local release candidate. Public launch readiness has not been established.**

docs/v1.md

@@ -0,0 +1,42 @@
+# Cove v1
+
+[Documentation](README.md) · [Getting started](getting-started.md) · [Release notes](../CHANGELOG.md)
+
+Cove v1 lets an individual keep structured project context, save revisions, create a pinned handoff, and continue from that handoff in another assistant. The three supported delivery paths are:
+
+| Path | How to use it | Scope |
+| --- | --- | --- |
+| Public website | [Open Cove](https://cove-context.alx21.chatgpt.site) and sign in with ChatGPT | Private projects, revisions, manual handoffs, JSON/Markdown export, JSON import, account deletion |
+| Installed Cove plugin in Codex | Grant selected projects through Assistant connections | Discover/read, save with revision checks, create/retrieve a pinned handoff, identify newer context; a fresh assistant can continue from the saved snapshot |
+| PostgreSQL source installation | Follow [local setup](development.md#set-up-the-postgresql-app) with Node.js 24, pnpm 11.19.0, Git and Docker Compose | Email/password accounts, verified email, the same project and handoff workflow, PostgreSQL persistence and the documented operator procedures |
+
+Website and PostgreSQL accounts and data belong to separate installations. Sites local verification uses a synthetic identity fixture; real hosted sign in uses the public website.
+
+## Source release
+
+Each versioned GitHub release provides `cove_<version>_source.zip` and `cove_<version>_source.zip.sha256`. The ZIP contains the source tree at that release commit, including the MIT license, lockfile, migrations, and setup guides. The PostgreSQL server is built with `pnpm build:local` and started with `pnpm start`. The Sites distribution is built with `pnpm build`; website deployment follows [Sites operations](sites.md).
+
+After downloading both files into the same directory, verify the ZIP before extracting it. On Windows PowerShell:
+
+```powershell
+$expected = (Get-Content -LiteralPath 'cove_1.0.0_source.zip.sha256').Split(' ')[0]
+$actual = (Get-FileHash -LiteralPath 'cove_1.0.0_source.zip' -Algorithm SHA256).Hash.ToLowerInvariant()
+if ($actual -ne $expected) { throw 'Cove source checksum mismatch' }
+Expand-Archive -LiteralPath 'cove_1.0.0_source.zip' -DestinationPath '.'
+```
+
+On Linux or macOS, compare the first field in the `.sha256` file with `sha256sum cove_1.0.0_source.zip` or `shasum -a 256 cove_1.0.0_source.zip`, respectively, then extract the ZIP. Continue with [the setup commands](development.md#set-up-the-postgresql-app) inside the extracted `cove-1.0.0` directory.
+
+The release workflow packages a clean committed tree. Publication runs only for a push to `main` after the existing verification and recovery jobs succeed. It checks the archive checksum, uploads and verifies the complete asset set, binds `v<version>` to that exact commit, and publishes last. A retry resumes only a draft for the same commit; published versions stay unchanged. Maintainers bump the version and add release notes for the next source release.
+
+## Interfaces and limits
+
+The v1 interface consists of the seven tools in the [MCP reference](mcp.md), revision-pinned handoffs, and the version 1 JSON portability schema. Changes that remove these interfaces or make existing valid v1 exports incompatible require a major version change. Keep a JSON export before upgrading and follow the documented migrations and backup procedure for your installation.
+
+JSON browser import/export is bounded to 8 MiB. Assistant access requires explicit project grants; reconnecting a revoked custom OAuth binding requires a new client registration. Cove stores submitted context and source pointers; it does not read conversations or fetch linked documents automatically. Copied handoff text remains outside Cove's control.
+
+Native Codex and the installed Cove plugin have dated live verification, including a fresh assistant reading a pinned snapshot with newer context present. A separate ChatGPT web assistant connection has not been verified. See [October 6 verification](verification-2026-10-06.md) and the [compatibility matrix](mcp.md#host-compatibility-matrix) for scope.
+
+For an independent public PostgreSQL deployment, configure HTTPS, real SMTP delivery, credentials, monitored encrypted backups, and the durable deletion ledger before serving customer data. Local restart and disposable recovery exercises do not establish production disaster recovery, capacity testing, or a customer pilot. Read [operations](operations.md) for those requirements.
+
+Teams, orchestration, billing, automatic conversation ingestion, and native mobile applications remain outside v1.