Release Sift 1.0 with verified local delivery and MIT licensing

.github/workflows/check.yml

@@ -1,13 +1,14 @@
 name: Sift checks
-
 on:
   pull_request:
   push:
     branches: [main]
-
+  workflow_dispatch:
 permissions:
   contents: read
-
+concurrency:
+  group: sift-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
 jobs:
   verify:
     strategy:
@@ -17,8 +18,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 24.19.0
       - run: npm install --global pnpm@11.19.0
@@ -29,3 +30,58 @@ jobs:
       - run: pnpm audit --audit-level=low
       - run: pnpm run release
       - run: pnpm run verify:package
+      - name: Keep the tested Linux release archive
+        if: matrix.os == 'ubuntu-22.04'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: sift-release
+          path: |
+            artifacts/sift-local-*.tgz
+            artifacts/sift-local-*.tgz.sha256
+            artifacts/SHA256SUMS
+          if-no-files-found: error
+  package_acceptance:
+    name: Released archive on ${{ matrix.os }}
+    needs: verify
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, ubuntu-22.04, macos-latest]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 24.19.0
+      - run: npm install --global pnpm@11.19.0
+      - run: pnpm install --frozen-lockfile
+      - name: Download the exact Linux archive from this checked run
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: sift-release
+          path: artifacts
+      - run: pnpm run verify:package
+  publish:
+    name: Publish verified release
+    needs: [verify, package_acceptance]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    concurrency:
+      group: sift-release
+      cancel-in-progress: false
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - name: Read the same accepted archive
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: sift-release
+          path: release-artifacts
+      - name: Publish complete archive and checksum assets
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        with:
+          script: |
+            const publish = require('./scripts/publish-release.cjs');
+            await publish({ github, context, core });

CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 1.0.0
+
+Defined the bounded local documentation/MCP contract, supported-source matrix and backup-first upgrade from 0.1.2. Sift's own source and bundled release are now MIT licensed; third-party notices retain their original licenses.
+
+Updated MCP SDK to 1.31.0 and patched the compatible proxy-addr and source-map-js dependencies. Collection behavior, SQLite schema, extraction, search and five read-only MCP tool names remain unchanged.
+
+Separated the mobile collection-deletion action from the footer explanation so the destructive control remains clear.
+
+Added an immutable GitHub release archive with SHA256 sidecars. Publication requires source checks and fresh package installation on Windows, Linux and macOS. All three platforms check the exact Linux-built archive before it is published. The archive includes the UI, bundled backend, documentation, migrations, examples and license; it needs Node 24 and no runtime npm installation.
+
 ## 0.1.2 — 2026-10-02
 
 Updated compatible `fast-uri` and `ip-address` dependencies used by the MCP SDK. The complete dependency audit now reports no known advisories. The release bundles the updated runtime.

CONTRIBUTING.md

@@ -58,4 +58,4 @@ For an installable artifact, follow the complete [release procedure](docs/RELEAS
 
 Use [GitHub Issues](https://github.com/agammann/sift/issues) for reproducible bugs or focused feature proposals. Include the Sift version, Node version, operating system, expected result, actual result, and minimal steps. Remove credentials, private URLs, database paths containing personal information, and document content before sharing logs.
 
-Discuss substantial changes before implementing them. Keep proposed patches focused and describe how they were verified. Public source visibility does not grant an open source license; the project remains `UNLICENSED`, and licensing decisions belong to the repository owner.
+Discuss substantial changes before implementing them. Keep proposed patches focused and describe how they were verified. Sift's own source is available under the [MIT License](LICENSE). Bundled third-party dependencies retain their original licenses in [Third party notices](THIRD_PARTY_NOTICES.md).

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 agammann
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -4,32 +4,32 @@
 
 Collect the public documentation your project needs, search it locally, and let your coding assistant retrieve passages with source URLs and revision history through MCP.
 
-[Website](https://sift-docs.alx21.chatgpt.site/) · [Download 0.1.2](https://sift-docs.alx21.chatgpt.site/downloads/sift-local-0.1.2.tgz) · [Getting started](docs/GETTING_STARTED.md) · [MCP setup](docs/MCP.md)
+[Website](https://sift-docs.alx21.chatgpt.site/) · [Download 1.0.0](https://github.com/agammann/sift/releases/download/v1.0.0/sift-local-1.0.0.tgz) · [Getting started](docs/GETTING_STARTED.md) · [MCP setup](docs/MCP.md)
 
 ## What Sift does
 
 1. **Collect:** choose public documentation URLs, allowed paths, and optional version labels. Refresh manually when you need new content.
 2. **Inspect:** search retained pages, open their original sources, compare refresh outcomes, and read previous revisions.
 3. **Connect:** expose selected collections to a local coding assistant through five read only MCP tools.
 
-Sift 0.1.2 is a local application for one user. Your collections live in a SQLite database on your computer. No Sift account, model API key, paid service, or telemetry is required. The public website provides information and downloads; the application runs on your machine.
+Sift 1.0.0 is a local application for one user. Your collections live in a SQLite database on your computer. No Sift account, model API key, paid service, or telemetry is required. Current immutable archives and checksums are available from GitHub Releases. The companion website retains earlier downloads; the application runs on your machine.
 
 ## Quick start
 
-Requires **Node.js 24.15 or later within the Node 24 release line**. Select Node 24 on the [official download page](https://nodejs.org/en/download), then open a new terminal and check `node --version`. Node 22 and Node 25 or later are not supported by this release. Clean package installation, CLI, HTTP interface and stdio MCP checks passed on Windows, Ubuntu 22.04 and macOS with Node 24.19.0. The browser walkthrough ran on Windows; see the [verification record](docs/verification-2026-10-02.md) for scope.
+Requires **Node.js 24.15 or later within the Node 24 release line**. Select Node 24 on the [official download page](https://nodejs.org/en/download), then open a new terminal and check `node --version`. Node 22 and Node 25 or later are not supported by this release. Version 1.0 requires the exact release archive to pass clean CLI, HTTP interface and stdio MCP installation checks on Windows, Ubuntu 22.04 and macOS with Node 24.19.0. The browser walkthrough runs on Windows; see the [v1 contract](docs/V1.md) and [verification record](docs/verification-v1.md) for scope.
 
-1. Download the [Sift archive](https://sift-docs.alx21.chatgpt.site/downloads/sift-local-0.1.2.tgz) and [SHA256 checksum](https://sift-docs.alx21.chatgpt.site/downloads/sift-local-0.1.2.tgz.sha256).
+1. Download the [Sift archive](https://github.com/agammann/sift/releases/download/v1.0.0/sift-local-1.0.0.tgz) and [SHA256 checksum](https://github.com/agammann/sift/releases/download/v1.0.0/sift-local-1.0.0.tgz.sha256).
 2. Put the archive in a new folder you will keep, and open a terminal in that folder. See the [installation guide](docs/GETTING_STARTED.md) for checksum commands and Windows instructions.
 3. Extract and start Sift:
 
 ```sh
-tar -xzf sift-local-0.1.2.tgz
+tar -xzf sift-local-1.0.0.tgz
 node package/dist/cli.js version
 node package/dist/cli.js doctor
 node package/dist/cli.js start
 ```
 
-Expect `Sift 0.1.2`, a doctor result with `"ok": true`, and a startup message containing `http://127.0.0.1:4587`.
+Expect `Sift 1.0.0`, a doctor result with `"ok": true`, and a startup message containing `http://127.0.0.1:4587`.
 
 4. Open **http://127.0.0.1:4587** in your browser. Keep the terminal running. Press **Ctrl+C** to stop.
 
@@ -58,7 +58,8 @@ For a small, repeatable walkthrough, use the [one page first collection](docs/GE
 | Find my data, back it up, upgrade, or troubleshoot | [Operations](docs/OPERATIONS.md) |
 | Build from source or propose a change | [Development and contributions](CONTRIBUTING.md) |
 | Understand crawling, storage, and access boundaries | [Architecture](docs/ARCHITECTURE.md) |
-| See what was tested and what remains unverified | [October 2 acceptance checks](docs/verification-2026-10-02.md) · [0.1.1 checks](docs/REAL_WORLD_VERIFICATION.md) · [0.1.0 report](docs/VERIFICATION.md) |
+| Understand supported sources, stable interfaces and upgrade | [v1 contract](docs/V1.md) |
+| See what was tested and what remains unverified | [v1 checks](docs/verification-v1.md) · [October 2 acceptance checks](docs/verification-2026-10-02.md) · [0.1.1 checks](docs/REAL_WORLD_VERIFICATION.md) · [0.1.0 report](docs/VERIFICATION.md) |
 | Prepare a release | [Release procedure](docs/RELEASING.md) |
 | See release history and dependency notices | [Changelog](CHANGELOG.md) · [Third party notices](THIRD_PARTY_NOTICES.md) |
 
@@ -68,4 +69,4 @@ Sift collects public, server rendered UTF-8 HTML. It does not sign in to website
 
 The management interface binds to `127.0.0.1`. MCP uses local stdio, with an explicit collection allowlist. The website address and management URL are not remote MCP endpoints.
 
-Source is publicly visible, but an open source license has not been selected. The package is marked `UNLICENSED`. See the [verification report](docs/VERIFICATION.md) for the limits of the tested first release.
+Sift’s own source and bundled release are available under the [MIT License](LICENSE). Third-party dependencies retain their original licenses in [Third party notices](THIRD_PARTY_NOTICES.md). See the [v1 contract](docs/V1.md) for supported use and the initial release stopping point.

THIRD_PARTY_NOTICES.md

@@ -76,7 +76,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 
 
-## @modelcontextprotocol/sdk@1.30.0
+## @modelcontextprotocol/sdk@1.31.0
 
 Declared license: "MIT"
 
@@ -6960,7 +6960,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 
 
-## proxy-addr@2.0.7
+## proxy-addr@2.0.8
 
 Declared license: "MIT"
 
@@ -7760,7 +7760,7 @@ SOFTWARE.
 
 
 
-## source-map-js@1.2.1
+## source-map-js@1.2.2
 
 Declared license: "BSD-3-Clause"
 

docs/GETTING_STARTED.md

@@ -2,7 +2,7 @@
 
 [Back to the README](../README.md)
 
-This guide takes you from the downloadable archive to a searchable collection. Sift runs on your computer. The [public website](https://sift-docs.alx21.chatgpt.site/) hosts information and downloads.
+This guide takes you from the downloadable archive to a searchable collection. Sift runs on your computer. The [public website](https://sift-docs.alx21.chatgpt.site/) provides information and earlier downloads. Use the pinned [GitHub release](https://github.com/agammann/sift/releases/tag/v1.0.0) for the current archive.
 
 ## Before you begin
 
@@ -12,36 +12,36 @@ Install **Node.js 24.15 or later within Node 24** from the [official Node.js dow
 node --version
 ```
 
-Expect `v24.15.0` or a newer `v24.x.x`. Other major versions are not supported by Sift 0.1.2. With Node 24.19.0, clean package installation, CLI, HTTP interface and stdio MCP checks passed on Windows, Ubuntu 22.04 and macOS. The complete browser walkthrough ran on Windows. See the [verification record](verification-2026-10-02.md) for exact scope; the manual checksum commands below have not been executed on macOS/Linux.
+Expect `v24.15.0` or a newer `v24.x.x`. Other major versions are not supported by Sift 1.0.0. The release workflow requires the exact archive to pass clean CLI, HTTP interface and stdio MCP installation checks on Windows, Ubuntu 22.04 and macOS with Node 24.19.0. See the [v1 checks](verification-v1.md) and [supported-source matrix](V1.md#supported-sources-and-delivery).
 
 ## Download and verify
 
 Download both files into the same new folder, such as a folder named `Sift` in your Documents directory:
 
-1. [sift-local-0.1.2.tgz](https://sift-docs.alx21.chatgpt.site/downloads/sift-local-0.1.2.tgz)
-2. [sift-local-0.1.2.tgz.sha256](https://sift-docs.alx21.chatgpt.site/downloads/sift-local-0.1.2.tgz.sha256)
+1. [sift-local-1.0.0.tgz](https://github.com/agammann/sift/releases/download/v1.0.0/sift-local-1.0.0.tgz)
+2. [sift-local-1.0.0.tgz.sha256](https://github.com/agammann/sift/releases/download/v1.0.0/sift-local-1.0.0.tgz.sha256)
 
 Keep their original filenames. Open a terminal in that folder. On Windows, open the folder in File Explorer, right click an empty area, and choose **Open in Terminal**. Use a fresh folder so extraction will not overwrite another application named `package`.
 
 In **PowerShell**, compare the download with its checksum:
 
 ```powershell
-$siftExpectedHash = ((Get-Content .\sift-local-0.1.2.tgz.sha256 -Raw).Trim() -split '\s+')[0]
-$siftActualHash = (Get-FileHash .\sift-local-0.1.2.tgz -Algorithm SHA256).Hash
+$siftExpectedHash = ((Get-Content .\sift-local-1.0.0.tgz.sha256 -Raw).Trim() -split '\s+')[0]
+$siftActualHash = (Get-FileHash .\sift-local-1.0.0.tgz -Algorithm SHA256).Hash
 if ($siftActualHash -ne $siftExpectedHash) { throw 'Checksum mismatch. Download the archive again.' }
 'Checksum matches.'
 ```
 
 On **macOS**, use:
 
 ```sh
-shasum -a 256 -c sift-local-0.1.2.tgz.sha256
+shasum -a 256 -c sift-local-1.0.0.tgz.sha256
 ```
 
 On **Linux**, use:
 
 ```sh
-sha256sum -c sift-local-0.1.2.tgz.sha256
+sha256sum -c sift-local-1.0.0.tgz.sha256
 ```
 
 Expect `Checksum matches.` in PowerShell, or a result ending in `OK` on macOS/Linux. A mismatch means the file does not match the published checksum; do not continue with that copy.
@@ -51,7 +51,7 @@ Expect `Checksum matches.` in PowerShell, or a result ending in `OK` on macOS/Li
 From the same folder:
 
 ```sh
-tar -xzf sift-local-0.1.2.tgz
+tar -xzf sift-local-1.0.0.tgz
 node package/dist/cli.js version
 node package/dist/cli.js doctor
 node package/dist/cli.js start
@@ -61,7 +61,7 @@ The archive creates a `package` folder. Keep it where you intend to run Sift, es
 
 | Step | Expected result |
 | --- | --- |
-| `version` | `Sift 0.1.2` |
+| `version` | `Sift 1.0.0` |
 | `doctor` | JSON containing `"ok": true`, `"integrity": "ok"`, and the database path |
 | `start` | A message containing `http://127.0.0.1:4587` and the data path |
 
@@ -108,7 +108,7 @@ Version labels describe what you know about the source; Sift does not infer vers
 If Node's npm command is available, you can install the downloaded archive globally instead of using its extracted CLI:
 
 ```sh
-npm install --global ./sift-local-0.1.2.tgz
+npm install --global ./sift-local-1.0.0.tgz
 sift version
 sift doctor
 sift start

docs/MCP.md

@@ -42,7 +42,7 @@ On October 2, 2026, Codex app-server 0.159.2 on Windows launched the extracted 0
 | Built in test passes, assistant fails | The test uses Sift's own paths. Check the assistant's saved configuration, machine, and filesystem access. |
 | Terminal appears to wait after launching mcp | Stdio waits for a protocol client. Use the assistant or Test MCP connection instead of typing into it. |
 
-Sift uses the official MCP TypeScript SDK 1.30.0. API references: [server](https://ts.sdk.modelcontextprotocol.io/server) and [client](https://ts.sdk.modelcontextprotocol.io/client).
+Sift 1.0 uses the official MCP TypeScript SDK 1.31.0. API references: [server](https://ts.sdk.modelcontextprotocol.io/server) and [client](https://ts.sdk.modelcontextprotocol.io/client).
 
 ## Tool contract
 

docs/OPERATIONS.md

@@ -12,7 +12,7 @@
 
 Run `sift doctor` while the management process is stopped to see the exact path and database health. For an extracted archive, replace `sift` in commands throughout this guide with `node package/dist/cli.js`, running from the extraction folder.
 
-Set `SIFT_DATA_DIR` to a directory, or pass `--db ABSOLUTE_DATABASE_FILE` to use a custom workspace. Use the same database for management and MCP. In 0.1.1, **Connect → Copy configuration** includes the running executable and database paths automatically.
+Set `SIFT_DATA_DIR` to a directory, or pass `--db ABSOLUTE_DATABASE_FILE` to use a custom workspace. Use the same database for management and MCP. In 1.0, **Connect → Copy configuration** includes the running executable and database paths automatically.
 
 ## Start and stop
 
@@ -45,7 +45,7 @@ Only restore trusted Sift backups you control. SQLite file validation is not a s
 
 Current and previous successful revisions are retained by default, configurable per source up to 20. A failed refresh does not consume a successful revision slot. Confirmed 404/410 documents leave active search but keep retained revisions. An expired revision ID returns an explicit missing-content error. Change events retain their revision IDs even if the content later expires.
 
-Source/job/outcome/change records remain until their source or collection is deleted. There is no automatic time-based pruning in 0.1.0; monitor disk usage for long-lived high-refresh workspaces. UI deletion prompts identify the affected scope and permanently delete its source content/history. Back up first if recovery is needed. Whole-workspace restore also has explicit confirmation and a recovery copy.
+Source/job/outcome/change records remain until their source or collection is deleted. There is no automatic time-based pruning in 1.0; monitor disk usage for long-lived high-refresh workspaces. UI deletion prompts identify the affected scope and permanently delete its source content/history. Back up first if recovery is needed. Whole-workspace restore also has explicit confirmation and a recovery copy.
 
 ## Interrupted jobs