.release-please-manifest.json

@@ -1 +1 @@
-{".":"0.1.2"}
+{".":"1.0.0"}

CHANGELOG.md

@@ -3,6 +3,23 @@
 <!-- Generated by Release Please and GitHub; permit native spacing, links and repeated categories. -->
 <!-- markdownlint-disable MD012 MD022 MD024 MD032 MD034 -->
 
+## 1.0.0 (2026-10-10)
+
+<!-- Release notes generated using configuration in .github/release.yml at main -->
+
+## What's Changed
+### Breaking changes
+* feat(assurance)!: require applicable fuzzing and badge participation by @KofTwentyTwo in https://github.com/KofTwentyTwo/standards/pull/19
+### Changes
+* fix(releases): use professional repository and automation text by @KofTwentyTwo in https://github.com/KofTwentyTwo/standards/pull/23
+* fix(releases): allow native formatting in generated changelog by @KofTwentyTwo in https://github.com/KofTwentyTwo/standards/pull/24
+* docs(assurance): record OpenSSF passing badge by @KofTwentyTwo in https://github.com/KofTwentyTwo/standards/pull/25
+* docs(exceptions): scope temporary frontend audit exception by @KofTwentyTwo in https://github.com/KofTwentyTwo/standards/pull/27
+* ci(release-velopack): sign only unsigned files; verify before packing by @KofTwentyTwo in https://github.com/KofTwentyTwo/standards/pull/29
+
+
+**Full Changelog**: https://github.com/KofTwentyTwo/standards/compare/v0.1.2...v1.0.0
+
 ## [0.1.2](https://github.com/KofTwentyTwo/standards/compare/v0.1.1...v0.1.2) (2026-10-10)
 
 First published standards bundle: policies, language profiles, architectures,

README.md

@@ -8,23 +8,22 @@ reusable GitHub Actions workflows, repository templates, and a conformance check
 [![Docs: CC BY 4.0](https://img.shields.io/badge/docs-CC%20BY%204.0-lightgrey)](LICENSE-docs)
 [![Code: MIT](https://img.shields.io/badge/code-MIT-green)](LICENSE)
 [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/15366/badge)](https://www.bestpractices.dev/projects/15366)
-[![Status: draft](https://img.shields.io/badge/status-draft%20(pre--1.0)-orange)](#status)
+[![Status: versioned](https://img.shields.io/badge/status-versioned-blue)](#status)
 
 ## Status
 
-> **Draft standards, before `v1.0.0`.** The requirements are written and the
-> enforcement tooling exists, but no KofTwentyTwo repository has been verified against
-> them yet; adoption starts with this repository, then
-> [AppKit](https://github.com/KofTwentyTwo/AppKit) and
-> [gclo](https://github.com/KofTwentyTwo/gclo). The compliance crosswalks therefore list
-> controls as **Defined**, not met, and the response times in the security program are
-> targets until `v1.0.0`. See [how these standards work](policies/README.md).
+> **Versioned standards with repository-specific adoption.** Immutable releases
+> identify each published baseline. This repository has completed repository and CI
+> conformance checks; other repositories record their own checks and exceptions.
+> Compliance crosswalks describe requirements and evidence for individual controls.
+> See [how these standards work](policies/README.md) and the
+> [release checklists](https://github.com/KofTwentyTwo/standards/issues?q=is%3Aissue+%22Release+v%22).
 
 ---
 
-**Tier:** Product ([scope](policies/README.md#scope)). **Conformance:** this repository is
-the first to adopt the standards; it will state *Conforms to KofTwentyTwo standards
-v1.0* once the checker passes on it.
+**Tier:** Product ([scope](policies/README.md#scope)). **Conformance:** repository and
+CI checks reviewed on 2026-10-10: zero FAIL or UNKNOWN, with manual review items
+resolved in the release checklist and approved [exceptions](exceptions/register.md).
 
 ## How to use
 

docs/releases.md

@@ -132,7 +132,7 @@ same Git/archive tool versions. The builder refuses an existing output directory
 The initial `v0.1.0` tag was reserved by a workflow-startup failure; no bundle was
 published for it. The `v0.1.1` publisher then stopped before draft creation because
 the caller omitted the environment secret contract. Both tags remain reserved;
-`v0.1.2` is the planned first published bundle. Keep these tags unchanged; use a new
+`v0.1.2` is the first published bundle. Keep these tags unchanged; use a new
 version when a tagged workflow needs a source fix.
 
 Never replace published assets or move/reuse a version tag. Fix a published error
@@ -145,3 +145,14 @@ from `autorelease: pending` to `autorelease: tagged`; do not rebuild the release
 References: [GitHub immutable releases](https://docs.github.com/en/code-security/concepts/supply-chain-security/immutable-releases),
 [enabling immutability](https://docs.github.com/en/code-security/how-tos/secure-your-supply-chain/establish-provenance-and-integrity/prevent-release-changes),
 and [Release Please token behavior](https://github.com/googleapis/release-please-action#other-actions-on-release-please-prs).
+
+## Known limitations
+
+[Issue #22](https://github.com/KofTwentyTwo/standards/issues/22) tracks Windows App SDK
+publish resources and the missing shared launch-smoke gate in `release-velopack.yml`.
+Windows consumers must keep `WindowsAppSDKSelfContained` and `WindowsPackageType`
+consistent between build and publish, or clean intermediate output before publish.
+Run smoke tests against the published executable and test the installer on a clean
+machine before a stable application release. This remains a consumer-side check
+until the shared workflow implements it. The standards bundle contains source and
+configuration; it does not contain a compiled Windows application.

docs/security/threat-model.md

@@ -1,6 +1,6 @@
 # Threat model: standards distribution
 
-- **Version reviewed:** v0.1.0 release-bundle implementation
+- **Version reviewed:** v1.0.0 standards baseline
 - **Last updated:** 2026-10-10
 - **Status:** Implementation reviewed; provisioning is verified in the release checklist.
 
@@ -71,6 +71,21 @@ trust boundaries change.
 
 ## Review log
 
+- **2026-10-10, v1.0.0:** Reviewed changes since v0.1.2: mandatory applicable badge
+  participation and parser fuzzing, completed passing self-assessment, professional
+  release text, scoped frontend audit exception, and unsigned-file-only Windows
+  signing with verification before packing. Distribution credentials, channels,
+  environment restrictions and provenance boundaries remain unchanged. Badge
+  metadata adds a public provider link; fuzzing executes synthetic local inputs.
+  Signing continues to use the Windows consumer's existing Azure OIDC boundary.
+  The most likely release interruption remains a failed gate or unpublished draft;
+  recovery preserves tags and immutable assets. The highest-impact distribution
+  threat remains a compromised credential or pinned Action, constrained by the
+  existing scoped tokens, protected environments and required checks. Windows
+  publish/resource and launch-smoke limitations remain tracked in
+  [issue #22](https://github.com/KofTwentyTwo/standards/issues/22); consumer workarounds
+  and rehearsal expectations are recorded in [release guidance](../releases.md#known-limitations).
+
 - **2026-10-10, v0.1.2:** Reviewed the explicit reusable-workflow secret contract
   after the unpublished v0.1.1 publisher failed. Only the named App key is passed;
   its value remains restricted to the reviewer-protected tag environment. Nested

policies/README.md

@@ -1,16 +1,12 @@
 # How these standards work
 
-> **Status: draft, pre-v1.0.0.** The requirements are written but have not been
-> released. Until the first release (`v1.0.0`):
->
-> - the automated checks and conformance tooling are still being built, so no
->   requirement is yet *Enforced* or *Verified* (see [compliance](../compliance/README.md));
-> - no KofTwentyTwo repository claims conformance; adoption is in progress, starting
->   with this repository, [AppKit](https://github.com/KofTwentyTwo/AppKit), and
->   [gclo](https://github.com/KofTwentyTwo/gclo);
-> - commitments to people outside the project (vulnerability response and fix times in
->   the [security program](security-program.md#vulnerability-management)) are targets
->   that the maintainer works to, and become binding commitments at `v1.0.0`.
+> **Status: versioned baseline.** Published tags identify immutable requirements.
+> Each repository adopts a specific version and records its own conformance evidence
+> and approved exceptions. [Compliance](../compliance/README.md) labels describe the
+> evidence for each mapped control; publication alone does not verify every consumer.
+> External vulnerability response and fix deadlines in the
+> [security program](security-program.md#vulnerability-management) become binding
+> commitments with adoption of the stable `v1.0.0` baseline.
 
 This repository is the single source of truth for how KofTwentyTwo builds, secures,
 and ships software. It has three layers, each more specific than the last:

version.txt

@@ -1 +1 @@
-0.1.2
+1.0.0