Release: freeze protocol to contextgraph/1.0 and promote workspace to 1.0.0; enforce schema/SPEC conformance and downstream canary fixes

[macanderson]

Motivation

• Finish the outstanding pre-freeze backlog and produce a coherent stable 1.0 protocol and crate release so downstreams can depend on a frozen wire contract.
• Make the repo's examples, schema, Rust types, SDKs, fixtures, and CI self-consistent so the normative SPEC.md examples and machine-serialized reference vectors all validate the same schema.
• Harden conformance checks that were only asserted (frame validity, digest/URI forms, ContextQuery required keys) so regressions are caught in CI rather than in downstream users.
• Repair the downstream canary so consumer builds (Stella) can be exercised against a local checkout without spurious dependency-resolution failures.

Description

• Freeze the protocol identifier to contextgraph/1.0 and promote the workspace and published artifacts to 1.0.0, updating PROTOCOL_VERSION and workspace version/SDK manifests and replacing in-tree drafts with the stable identifier.
• Extend schema/validate-examples.py to validate examples/, schema reference vectors, and fenced jsonc blocks in SPEC.md, and to check that the schema $id resolves to a byte-identical served copy.
• Enforce wire invariants in the conformance/validation path: frame-validity now rejects malformed content_digest values and relations with empty target_uri, and a regression guard ensures ContextQuery satisfies the schema required keys read from the schema.
• Rename and re-attest the golden fixture profile to contextgraph-1.0 (manifest and per-file sha256 coverage), update examples/reference vectors and badges, bump SDK versions and protocol constants for TypeScript/Go/Python, and update the release workflow to include the trace crate.
• Fix the downstream canary: downstream-canary-stella.sh now aligns downstream pins to the local workspace, writes both `[patch.

---

Codex Task

Summary by Sourcery

Freeze the Context Graph Protocol wire identifier at contextgraph/1.0, promote the workspace and SDKs to a 1.0.0 stable release, harden conformance/schema enforcement, and repair the downstream Stella canary and release pipeline to track the frozen contract.

Bug Fixes:

• Correct conformance and schema drift (e.g., invalid SPEC examples, frame content_digest and target_uri enforcement, ContextQuery required keys) so the documented contract matches the enforced behavior.
• Fix the downstream Stella canary so local workspaces can be exercised without dependency-resolution failures and catch source-compatibility issues instead.

Enhancements:

• Document the 1.0 stability guarantees, version-family negotiation, and governance updates for the frozen contextgraph/1.0 protocol family.
• Rename and re-attest the golden conformance fixture profile to contextgraph-1.0, keeping schema, Rust serialization, and fixtures aligned with the stable wire contract.
• Update Rust crates and non-Rust SDKs (TypeScript, Go, Python, scaffolding CLI) to advertise contextgraph/1.0 and use 1.x-compatible dependency/version requirements.
• Tighten schema and spec validation by extending schema/validate-examples.py to cover SPEC.md fenced JSONC blocks and to ensure the schema $id serves a byte-identical copy.

Build:

• Bump the workspace crate version to 1.0.0 and align internal dependency version floors to >=1.0.0 across host, conformance, bridge, MCP server, and trace crates.

CI:

• Extend the release workflow to publish the contextgraph-trace crate and adjust comments and checks for the 1.0 series.
• Improve the downstream-canary script to align Stella's pinned CGP crate versions with the local workspace and patch both direct and crates-io dependencies.

[sourcery-ai]

Sorry @macanderson, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[sourcery-ai]

Reviewer's Guide

Freezes the Context Graph Protocol to the stable identifier contextgraph/1.0, promotes the workspace and SDKs to version 1.0.0, tightens schema/conformance enforcement (including SPEC.md example validation and frame invariants), refreshes the attested fixture profile, and fixes the Stella downstream canary to test against the local 1.0 workspace reliably.

Sequence diagram for updated downstream-canary-stella.sh behavior

sequenceDiagram
  actor Developer
  participant DownstreamCanaryScript as downstream-canary-stella.sh
  participant StellaCargoToml as stella/Cargo.toml

  Developer->>DownstreamCanaryScript: run downstream-canary-stella.sh
  DownstreamCanaryScript->>StellaCargoToml: sed (align version pins to local workspace version)
  DownstreamCanaryScript->>StellaCargoToml: echo / printf (append local path deps)
  DownstreamCanaryScript->>StellaCargoToml: echo / printf (append [patch.crates-io] section)
  DownstreamCanaryScript->>StellaCargoToml: tail (print patched manifest tail)
  DownstreamCanaryScript->>Developer: report crates depending on contextgraph-* and run canary build

Loading

File-Level Changes

Change	Details	Files
Freeze protocol identifier to contextgraph/1.0 and bump crate/SDK versions to 1.0.0, with updated stability/governance docs.	Updated PROTOCOL_VERSION constant and all references from contextgraph/1.0-draft to contextgraph/1.0 across Rust, TypeScript, Python, Go SDKs, examples, badges, and registry entries. Promoted workspace and public crates to version 1.0.0, including release notes for the 1.0.0 stable protocol/crate release. Rewrote stability and governance docs to describe the frozen contextgraph/1.0 family, version-family negotiation, conformance expectations, and dependency guidance.	contextgraph-types/src/lib.rs Cargo.toml CHANGELOG.md docs/stability.md GOVERNANCE.md README.md docs/overview.md docs/protocol-surface.md docs/protocol-advantages.md docs/index.md docs/context-reuse.md docs/implementing-a-provider.md docs/registry.md SECURITY.md SPEC.md sdk/typescript/src/types.ts sdk/typescript/package.json sdk/typescript/package-lock.json sdk/python/contextgraph_sdk/types.py sdk/python/pyproject.toml sdk/go/contextgraph/types.go sdk/create-contextgraph-provider/index.js sdk/create-contextgraph-provider/package.json examples/*.md examples/*.json assets/badges/conformant.svg schema/reference-vectors.ndjson examples/reference-messages.json examples/full-stdio-session.ndjson Cargo.lock
Strengthen schema and SPEC conformance by expanding example validation and enforcing wire invariants in host/conformance code.	Extended schema/validate-examples.py to validate fenced jsonc blocks in SPEC.md and ensure the schema $id serves a byte-identical copy, updating docstring comments accordingly. Adjusted SPEC examples (e.g., verify envelopes) and JSON Schema to match the reference types, including fixing ContextFrame and ContextQuery required fields and narrative clarifications. Added/updated regression guards and frame-validity checks so malformed content_digest values and relations with empty target_uri are rejected, and ContextQuery must satisfy required keys read from the schema.	schema/validate-examples.py SPEC.md schema/contextgraph-envelope.schema.json docs/protocol-surface.md docs/adaptive-context-reconciliation.md docs/adr/0005-frame-representations.md docs/adr/0006-prompt-ingestion-as-a-local-provider.md contextgraph-host/src/wire.rs contextgraph-types/src/record.rs contextgraph-conformance/tests/golden_fixtures.rs contextgraph-conformance/README.md contextgraph-conformance/fixtures/contextgraph-1.0/manifest.json
Refresh and rename the golden fixture profile to contextgraph-1.0 and keep it attested as the 1.0 reference bundle.	Renamed the golden fixture directory and manifest from contextgraph-1.0-draft to contextgraph-1.0 while preserving fixture profile versioning and SHA-256 coverage. Updated conformance tests and documentation to refer to the new contextgraph-1.0 profile and clarified comments around representation vectors and strict frame field allow-lists.	contextgraph-conformance/tests/golden_fixtures.rs contextgraph-conformance/README.md contextgraph-conformance/fixtures/contextgraph-1.0/manifest.json
Update internal crate dependency floors and CI release workflow to align with 1.0.0 and publish contextgraph-trace.	Raised internal contextgraph-types/contextgraph-host dependency requirements from >=0.1.0 to >=1.0.0 in host, conformance, MCP bridge/server, and trace crates. Modified the release GitHub workflow to publish all four public crates (including contextgraph-trace) in dependency order, and updated comments to match the new dependency floor. Adjusted doc references to reflect that contextgraph-trace is now a public, published crate.	contextgraph-host/Cargo.toml contextgraph-conformance/Cargo.toml contextgraph-mcp-bridge/Cargo.toml contextgraph-mcp-server/Cargo.toml contextgraph-trace/Cargo.toml .github/workflows/release.yml
Fix and harden the Stella downstream canary script to test the local workspace as a patched dependency under aligned version pins.	Updated downstream-canary-stella.sh to read the local workspace version and rewrite Stella’s Cargo.toml contextgraph-* dependencies to exact =version pins for the canary run. Ensured [patch.crates-io] entries are written alongside direct path dependencies so downstream resolution uses the local workspace crates. Broadened the manifest search to cover nested Stella crates and updated the tail output length to account for the expanded patch block.	.github/scripts/downstream-canary-stella.sh

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.