[TristanKruse]

Summary

• Prepare the first stable 1.0.0 API baseline after the reviewed fixes in Fail closed on malformed Ruby with structured parse diagnostics #68, Resolve conditional constant declarations in expanded analysis #69, and Enforce coverage thresholds on runtime library files only #70 reached main.
• Synchronize the library version, local lock entry, dated changelog, and installation examples without changing locked dependencies.
• Define the documented 1.x compatibility contract and migration from the published 0.0.1 prototype, including strict parse errors, opt-in constant analysis, source exclusions, and explicit cache invalidation.
• Separate release preparation from publication in the maintainer checklist and release guide.

Verification

• Full suite: 614 examples, 0 failures; 8 native-symlink cases skipped on this Windows machine and covered by Linux CI.
• Runtime-library-only coverage: 98.48% line and 91.51% branch; all 267 Ruby files lint-clean.
• Strict release metadata, 179 generated documentation pages with API/link checks, and both public dependency-analysis smoke scripts.
• Fresh dependency security scan: 1,269 advisories, no findings, vulnerable-fixture health check passed.
• Pinned Rack, Rake, and RSpec Core baselines in both dependency modes: all six graph fingerprints, passing/failing rules, and cache-reuse checks passed.
• Strictly built gem installed in a fresh isolated gem home and exercised from a clean project: exact 1.0.0 version and installed path, passing/failing policy after a one-line code change, conditional constants, exclusions, and malformed-source errors.

Release boundary

This PR does not publish to RubyGems, create a tag, or dispatch the Release workflow. RubyGems still has 0.0.1 as the published predecessor at preparation time. Review/merge this preparation, verify the exact resulting main revision, then obtain explicit authorization to publish. Reconfirm the changelog date if publication happens later.

The broader capability roadmap in #66 remains open; a CLI, richer semantic/protocol rules, presets, and gradual-adoption baselines are not claimed by the current API.

[TristanKruse]

1.0.0 publication verified — 2026-10-26

The publication gates in .github/PRE_RELEASE_CHECKLIST.md are now satisfied. This comment records the post-publication evidence without changing the released source or tag.

• Preparation PR merged normally; exact release commit: 4baf08aeb169b887582dba6b8eb3d01a1b99acd0.
• Fresh main CI, security scan, and documentation deployment passed on that commit.
• Strict release metadata passed; maintainer authorized publication. RubyGems ownership confirmed as TristanKruse. The existing release environment has no required-review protection; its settings were not changed or bypassed.
• Trusted-publisher Release workflow succeeded for version 1.0.0 on the validated main commit.
• RubyGems 1.0.0 independently confirmed; peeled annotated tag v1.0.0 matches the validated commit.
• Installed directly from RubyGems into a fresh empty gem home, outside Bundler and without loading the source checkout. Downloaded archive SHA256 matches RubyGems: 6d6154848d2d0100b11aa19cb44e1e3a26e3fc913458e354c2ae53666f90a8ef.
• Installed API acceptance checks passed: clean rule, intentionally failing one-line import change with rationale, import-only default, conditional-constant policies, exclusion refresh, strict malformed-source diagnostics, and both dependency-analysis reproducer scripts.

The fresh installation used Ruby 4.0.6 with csv 3.3.6 and Ruby's default json 2.18.0 / prism 1.8.1. Preparation also passed with locked json 2.21.2 / prism 1.9.0. Real-world canary results remain unchanged for all six pinned project/mode combinations.

Install with gem install archunit --version 1.0.0.

The broader capability roadmap #66 and unrelated Dependabot PR #67 remain separate follow-up work; they are not included in this publication claim.