chore(release): tag 1.0.0 — API contract committed

Zero code delta vs 0.5.0 (verified `git log --stat v0.5.0..HEAD`
shows only the release-workflow CI file). This bump is a stability
commitment: from v1.0.0 onwards every breaking change to REST
routes, MCP wire shapes, audit-row JSON keys, the DB schema, or
public Rust APIs in the published crates needs a major bump per
SemVer.

CHANGELOG `[1.0.0]` section records the policy change explicitly.
The release workflow's pre-release detector ALSO flips: `v0.*` and
`*-rc/-beta/-alpha` stay version-pinned in Docker, but stable `v1.x`
tags publish `:latest`.

Operators pinning the chart should bump
`image.{server,web}.tag: "1.0.0"` (or unset to follow appVersion).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: fylorn

CHANGELOG.md

@@ -26,6 +26,27 @@ target.
 ### Security
 - _(nothing yet)_
 
+## [1.0.0] — 2026-05-27
+
+Stability commitment. No code delta since `0.5.0` — this tag marks
+the point at which the API surface becomes a [SemVer](https://semver.org/spec/v2.0.0.html)
+commitment.
+
+### Changed
+
+- **Versioning policy** — from this tag onwards every breaking
+  change (REST routes, MCP wire shapes, audit-row JSON keys,
+  database schema, public Rust APIs in published crates) requires
+  a major bump. Operators chasing the `:latest` tag on the GHCR
+  images can do so without surprise.
+
+### Notes
+
+- Docker images cut at this tag receive `:latest` for the first
+  time — the release workflow suppresses `:latest` on `0.x` and
+  pre-release tags. Pin the version in production rather than
+  tracking `:latest` unless you have a controlled rollback path.
+
 ## [0.5.0] — 2026-05-26
 
 First public beta. The product surface is stable enough to deploy
@@ -99,5 +120,6 @@ unreleased builds should: stop the gateway, run `db/schema.sql`
 against PostgreSQL, restart against this tag. The schema is
 idempotent end-to-end, so the apply is safe to repeat.
 
-[Unreleased]: https://github.com/ThinkWatchProject/ThinkWatch/compare/v0.5.0...HEAD
+[Unreleased]: https://github.com/ThinkWatchProject/ThinkWatch/compare/v1.0.0...HEAD
+[1.0.0]: https://github.com/ThinkWatchProject/ThinkWatch/releases/tag/v1.0.0
 [0.5.0]: https://github.com/ThinkWatchProject/ThinkWatch/releases/tag/v0.5.0

Cargo.toml

@@ -10,7 +10,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.5.0"
+version = "1.0.0"
 edition = "2024"
 # Pin the MSRV to the first stable rustc that ships edition 2024 (1.85,
 # released 2025-02-20). Without this, contributors on older toolchains

deploy/helm/think-watch/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: think-watch
 description: Enterprise AI API Gateway & MCP Management Platform
 type: application
-version: 0.5.0
-appVersion: "0.5.0"
+version: 1.0.0
+appVersion: "1.0.0"
 keywords:
   - ai
   - gateway

web/package.json

@@ -1,7 +1,7 @@
 {
   "name": "web",
   "private": true,
-  "version": "0.5.0",
+  "version": "1.0.0",
   "type": "module",
   "packageManager": "pnpm@11.0.0",
   "scripts": {