chore(main): release 0.1.0 (#20)

Finalize the generated stable release, align stable documentation, and remove the one-time recovery bridge.

0.1.0 is approved for PyPI publication.

Author: github-actions[bot]

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.1.0-alpha.1"
+  ".": "0.1.0"
 }

AGENTS.md

@@ -97,9 +97,9 @@ Post-alpha invariants:
 2. Keep `.github/CODEOWNERS` absent until a real multi-maintainer model exists.
 3. Keep scheduled and manually dispatched live smoke fail-closed behind
    `LIVE_SMOKE_ENABLED=true`, and keep `RELEASE_PLEASE_ENABLED` disabled outside
-   an explicitly authorized release sequence. The stable-readiness
-   configuration establishes the recovery alpha boundary with a reviewed and
-   tested `last-release-sha` bridge.
+   an explicitly authorized release sequence. The reviewed `last-release-sha`
+   bridge was used once to generate the stable release PR and must remain absent
+   after its human finalization.
 4. Treat the recorded public rules, security reporting, immutable releases, and
    protected environments as readiness invariants. Any drift invalidates the
    readiness claim until it is explicitly authorized, restored, and verified.
@@ -265,11 +265,10 @@ committed.
   `v0.1.0-alpha.1+recovery.1`, which maps to package version `0.1.0a1`.
   Later releases must use their ordinary canonical tag spelling.
 - Keep Release Please disabled outside an explicitly authorized release
-  sequence. Its stable-readiness configuration uses the reviewed and tested
-  `last-release-sha` bridge because the recovery tag's build metadata cannot be
-  inferred from the manifest. Remove the one-time bridge and prerelease
-  versioning controls in the human-finalized stable release PR before it is
-  merged.
+  sequence. The stable-readiness configuration used a reviewed and tested
+  `last-release-sha` bridge because the recovery tag's build metadata could not
+  be inferred from the manifest. The human-finalized stable release PR removed
+  that bridge and its prerelease-versioning controls; keep them absent.
 - Keep third-party Actions pinned to full commit SHAs. Grant `id-token: write`
   only to the reusable publication caller and the protected publishing job;
   the caller passes this maximum permission and only the publishing job uses

ARCHITECTURE.md

@@ -141,9 +141,10 @@ recovery release uses SemVer build metadata in
 artifact identity: the PyPI version remains `0.1.0a1`.
 
 Release Please remains disabled outside an explicitly authorized release
-sequence. The stable-readiness configuration establishes the recovery commit
-as the previous-release boundary with a tested `last-release-sha` bridge, so
-the one-time build-metadata recovery tag cannot replay earlier history.
+sequence. The stable-readiness configuration used a tested `last-release-sha`
+bridge to establish the recovery commit as the previous-release boundary and
+generate the stable release PR without replaying earlier history. Human
+finalization then removed that one-time bridge.
 
 ## Rejected 0.1 approaches
 

CHANGELOG.md

@@ -6,7 +6,15 @@ automation.
 
 ## [Unreleased]
 
-### Changed
+## [0.1.0] - 2026-07-28
+
+### Features
+
+- Prepare the stable release ([#19](https://github.com/cometapi-dev/cometapi-python/issues/19)) ([2e5407c](https://github.com/cometapi-dev/cometapi-python/commit/2e5407c106b6bc557c51e629b4713012dbce3744)).
+
+### Documentation
+
+- Record Registry Alpha release evidence ([#18](https://github.com/cometapi-dev/cometapi-python/issues/18)) ([f39b4dc](https://github.com/cometapi-dev/cometapi-python/commit/f39b4dc9f2e18e91ab3cbac202246f85658f71fd)).
 
 - Release documentation now records completed Registry Alpha publication,
   provenance, digest, clean-install, import, and mocked-call verification.
@@ -53,3 +61,5 @@ automation.
 - Unsupported aliases `CometClient` and `AsyncCometClient`.
 - Account, balance, token, log, task, and platform helpers from the 0.1 scope.
 - The provisional single-maintainer `CODEOWNERS` requirement.
+
+[0.1.0]: https://github.com/cometapi-dev/cometapi-python/compare/v0.1.0-alpha.1%2Brecovery.1...v0.1.0

CONTRIBUTING.md

@@ -1,9 +1,8 @@
 # Contributing to the CometAPI Python SDK
 
-Thank you for helping improve the SDK. The repository has released the
-`0.1.0a1` Registry Alpha. Contributions must stay within the supported 0.1
-scope described in `README.md`, `ROADMAP.md`, and `COMPATIBILITY.md`. The
-canonical repository is
+Thank you for helping improve the SDK. The repository targets the stable 0.1
+contract. Contributions must stay within the supported 0.1 scope described in
+`README.md`, `ROADMAP.md`, and `COMPATIBILITY.md`. The canonical repository is
 <https://github.com/cometapi-dev/cometapi-python>.
 
 ## Development setup
@@ -79,7 +78,7 @@ Use Conventional Commit subjects where practical, for example:
 ```text
 feat: add a supported client option
 fix: preserve an upstream error type
-docs: clarify alpha installation
+docs: clarify installation
 test: cover async response streaming
 ```
 

README.md

@@ -1,7 +1,6 @@
 # CometAPI Python SDK
 
-> **Pre-release:** `0.1.0a1` is available from PyPI. Its API may change before
-> `0.1.0`.
+> **Stable release:** `0.1.0` is approved for PyPI publication.
 
 `cometapi` is a thin Python adapter over the official OpenAI SDK for the
 OpenAI-compatible CometAPI endpoint. It changes the default API key and base
@@ -30,15 +29,16 @@ Project links: [CometAPI](https://www.cometapi.com),
 
 ## Installation
 
-Install the exact alpha from PyPI with:
+After the protected publication workflow and public-registry verification
+succeed, install the stable release from PyPI with:
 
 ```bash
-python -m pip install --pre 'cometapi==0.1.0a1'
+python -m pip install 'cometapi==0.1.0'
 ```
 
-See the immutable
-[GitHub prerelease](https://github.com/cometapi-dev/cometapi-python/releases/tag/v0.1.0-alpha.1%2Brecovery.1)
-and exact [PyPI release](https://pypi.org/project/cometapi/0.1.0a1/) for the
+After those gates succeed, the immutable
+[GitHub release](https://github.com/cometapi-dev/cometapi-python/releases/tag/v0.1.0)
+and exact [PyPI release](https://pypi.org/project/cometapi/0.1.0/) for the
 published artifact.
 
 ## Authentication and configuration
@@ -160,7 +160,7 @@ This is an interoperability option, not the primary `cometapi` experience.
 
 ## Explicit non-goals for 0.1
 
-The alpha does not add Anthropic or Gemini adapters, CometAPI account or
+The 0.1 release does not add Anthropic or Gemini adapters, CometAPI account or
 platform resources, media APIs, provider-neutral message translation, CLI
 behavior, or custom HTTP/SSE/retry implementations. There are no compatibility
 aliases named `CometClient` or `AsyncCometClient`.

RELEASING.md

@@ -46,10 +46,11 @@ one active maintainer.
 Before the historical first push, scheduled and manually dispatched live
 execution was required to fail closed unless `LIVE_SMOKE_ENABLED=true`.
 `RELEASE_PLEASE_ENABLED` was kept disabled. The reviewed stable-readiness
-configuration now uses an explicit `last-release-sha` bridge to establish the
-recovery alpha as the previous-release boundary; the repository variable stays
-disabled until maintainers intentionally start the stable release sequence. An
-unset or non-true value prevents the corresponding gated job from executing.
+configuration later used an explicit `last-release-sha` bridge to establish the
+recovery alpha as the previous-release boundary. Maintainers enabled the
+repository variable only to start the stable release sequence, and human
+finalization removed the bridge. An unset or non-true variable prevents the
+corresponding gated job from executing.
 The release live-model configuration resolves an unset or empty
 `COMETAPI_LIVE_MODEL` to `gpt-5.4`.
 
@@ -182,14 +183,14 @@ violations in one run and still returns non-zero when any violation exists.
   `LIVE_SMOKE_ENABLED=true`.
 - `release-please.yml` maintains a human-reviewed version and changelog pull
   request from Conventional Commits after maintainers enable the
-  `RELEASE_PLEASE_ENABLED` repository variable. The checked-in stable-readiness
-  configuration establishes the recovery release boundary with the reviewed
-  `last-release-sha` bridge. Keep the variable disabled except while executing
-  an explicitly authorized release sequence. When it creates an approved
-  release with the GitHub workflow token, it polls the GitHub API until that
-  exact tag and commit are independently reported as immutable, then invokes
-  the protected publication chain directly; workflow-token release events do
-  not trigger a second workflow run.
+  `RELEASE_PLEASE_ENABLED` repository variable. A reviewed one-time
+  `last-release-sha` bridge established the recovery release boundary and was
+  removed during human finalization of the stable release PR. Keep the variable
+  disabled except while executing an explicitly authorized release sequence.
+  When it creates an approved release with the GitHub workflow token, it polls
+  the GitHub API until that exact tag and commit are independently reported as
+  immutable, then invokes the protected publication chain directly;
+  workflow-token release events do not trigger a second workflow run.
 - `publish.yml` is called only with the independently verified immutable tag,
   commit, and default branch. It resolves the tag to the checked-out commit,
   fetches the protected default branch, and rejects a commit that is not
@@ -238,9 +239,9 @@ Maintainers then completed these steps in order:
    OIDC publication but failed before PyPI accepted any distribution. The
    recovery build suffix preserves the equivalent PEP 440 package version
    `0.1.0a1`; it is a one-time exception and must not be incremented or reused
-   for later releases. Keep Release Please disabled until a separate reviewed
-   and tested `last-release-sha` bridge establishes this recovery commit as its
-   previous-release boundary.
+   for later releases. Release Please was kept disabled until a separate
+   reviewed and tested `last-release-sha` bridge established this recovery
+   commit as its previous-release boundary.
 5. The release workflow proved `immutable=true`, resolved the tag to the
    checked-out commit, verified that commit was reachable from the protected
    default branch, and ran the bounded protected live suite against that exact
@@ -280,8 +281,9 @@ changelog, GitHub release, wheel, and source distribution.
   and source-distribution SHA256
   `98d86829ef14771e8b7ec180d452c6638289f49c14a39b7207be5c47cb64cde7`.
 - `LIVE_SMOKE_ENABLED=false`. Release Please remains disabled outside an
-  explicitly authorized release sequence; the reviewed `last-release-sha`
-  bridge is configured for the alpha-to-stable transition.
+  explicitly authorized release sequence. The reviewed `last-release-sha`
+  bridge generated the stable release PR and was removed during human
+  finalization.
 
 ## Stable release sequence
 

ROADMAP.md

@@ -314,9 +314,9 @@ Public Preview readiness evidence on 2026-07-27:
   `LIVE_SMOKE_ENABLED` opt-in was reset to `false` after the run.
 - At this Public Preview checkpoint, no tag, GitHub release, Trusted Publisher,
   PyPI OIDC publication, provenance, or public-registry installation existed.
-  Those later Registry Alpha actions are recorded below. Release Please remains
+  Those later Registry Alpha actions are recorded below. Release Please remained
   disabled until a separately reviewed and tested `last-release-sha` bridge
-  establishes the recovery alpha as its previous-release boundary.
+  established the recovery alpha as its previous-release boundary.
 
 Public Preview remains ready only while:
 
@@ -417,9 +417,9 @@ Accepted release evidence:
   its source-distribution SHA256 is
   `98d86829ef14771e8b7ec180d452c6638289f49c14a39b7207be5c47cb64cde7`.
 - `LIVE_SMOKE_ENABLED=false`. Release Please remains disabled outside an
-  explicitly authorized release sequence; the reviewed stable-readiness
-  configuration now establishes the recovery alpha boundary with
-  `last-release-sha`.
+  explicitly authorized release sequence. The reviewed stable-readiness
+  `last-release-sha` bridge generated the stable release PR and was removed
+  during human finalization.
 
 ## `0.1.0`: OpenAI protocol foundation
 
@@ -480,9 +480,10 @@ successfully in the canonical GitHub repository.
 Scheduled and manually dispatched live smoke must require
 `LIVE_SMOKE_ENABLED=true`; an unset or other value prevents live execution.
 Release Please requires `RELEASE_PLEASE_ENABLED=true` and remains disabled
-outside an explicitly authorized release sequence. Its stable-readiness
-configuration uses the reviewed `last-release-sha` bridge for the recovery
-alpha boundary. Release jobs must resolve an unset or empty
+outside an explicitly authorized release sequence. Its reviewed one-time
+`last-release-sha` bridge established the recovery alpha boundary, generated
+the stable release PR, and was removed during human finalization. Release jobs
+must resolve an unset or empty
 `COMETAPI_LIVE_MODEL` to `gpt-5.4` rather than attempt a request with an empty
 model.
 

SECURITY.md

@@ -2,13 +2,13 @@
 
 ## Supported versions
 
-The SDK is in pre-release development. Published support claims begin only
-after a package is independently verified from PyPI.
+The SDK's supported 0.1 API surface is stable. Security support applies to
+packages that have been independently verified from PyPI.
 
 | Version | Status |
 | --- | --- |
-| `0.1.x` prereleases | Best-effort security fixes after verified publication |
-| `0.1.x` stable | Planned support after verified publication |
+| `0.1.x` stable | Supported |
+| `0.1.x` prereleases | Best-effort security fixes |
 | Older versions | Unsupported |
 
 ## Reporting a vulnerability
@@ -17,14 +17,13 @@ Do not disclose a suspected vulnerability, credential, customer data, or
 exploit details in a public issue.
 
 Use the repository's
-[private security advisory form](https://github.com/cometapi-dev/cometapi-python/security/advisories/new)
-when it is available. During private validation, before GitHub Private
-Vulnerability Reporting is enabled, email `support@cometapi.com` with the
-subject "Security report" and only the minimum details needed to establish a
+[private security advisory form](https://github.com/cometapi-dev/cometapi-python/security/advisories/new).
+If that form is unavailable, email `support@cometapi.com` with the subject
+"Security report" and only the minimum details needed to establish a
 confidential follow-up channel. Do not disclose sensitive details publicly.
 
 The maintainers will acknowledge and triage reports as soon as practical, but
-no response-time service-level agreement is promised for prereleases.
+no response-time service-level agreement is promised.
 Coordinated disclosure timing will be agreed with the reporter.
 
 ## Credential safety
@@ -47,8 +46,9 @@ Long-lived PyPI tokens are not an accepted publication path. A successful
 upload is incomplete until provenance and a clean public-registry installation
 have been verified.
 
-Third-party GitHub Actions must be pinned to full commit SHAs. Only the
-publishing job may receive `id-token: write`.
+Third-party GitHub Actions must be pinned to full commit SHAs. The reusable
+workflow caller and protected publishing job may declare `id-token: write`, but
+only the publishing job may request the OIDC token.
 
 ## Scope
 

SUPPORT.md

@@ -2,8 +2,8 @@
 
 ## Project status
 
-The SDK is in pre-release development. Support is best-effort, and no response
-or resolution time is guaranteed.
+The SDK's supported 0.1 API surface is stable. Support is best-effort, and no
+response or resolution time is guaranteed.
 
 ## Supported SDK surface