Prepare 1.0 with current dependencies and patched runtime support

.github/workflows/ci.yml

@@ -18,7 +18,7 @@ jobs:
       base: ${{ steps.scope.outputs.base }}
       head: ${{ steps.scope.outputs.head }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
       - name: Test CI scope classification
@@ -62,16 +62,16 @@ jobs:
     if: needs.classify.outputs.route == 'docs'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1
         with:
           # The local-link gate diffs the event's base and head. A rebased PR
           # head does not retain its base in checkout's default shallow clone.
           fetch-depth: 0
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7.1.0
         with:
-          node-version: 22.13.0
+          node-version: 24.22.1
           cache: npm
-      - run: npm install -g npm@11
+      - run: npm install -g npm@12.2.1
       - run: npm ci --engine-strict
       - name: Verify documentation contracts
         run: npx --no-install vitest run dev/test/skill.test.ts dev/test/node-support.test.ts
@@ -124,16 +124,16 @@ jobs:
     if: needs.classify.outputs.route == 'skill'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1
         with:
           # The local-link gate diffs the event's base and head. A rebased PR
           # head does not retain its base in checkout's default shallow clone.
           fetch-depth: 0
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7.1.0
         with:
-          node-version: 22.13.0
+          node-version: 24.22.1
           cache: npm
-      - run: npm install -g npm@11
+      - run: npm install -g npm@12.2.1
       - run: npm ci --engine-strict
       - name: Verify documentation and skill CLI contracts
         run: npx --no-install vitest run dev/test/skill.test.ts dev/test/node-support.test.ts dev/test/cli.test.ts
@@ -177,42 +177,62 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # engines.node: ^22.13.0 || >=24.0.0. These are its exact lowest
-        # releases; Node 20, 21, and 23 are intentionally unsupported.
-        node: [22.13.0, 24.0.0]
+        # Current WordPress development/proof tooling requires Node 24+.
+        # The separate packed-node22 job verifies the production Node 22 floor.
+        node: [24.22.1, 26.12.1]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7.0.1
+      - uses: actions/setup-node@v7.1.0
         with:
           node-version: ${{ matrix.node }}
           cache: npm
-      # Pin npm 11: lockfile is npm-10/11 compatible; npm 12 needs newer Node
-      # and changed `npm pack --json` shape (handled in check-private-refs, but
-      # avoid `npm@latest` floating across majors on the matrix).
-      - run: npm install -g npm@11
+      # Pin the package manager across the security-patched Node matrix.
+      - run: npm install -g npm@12.2.1
       - run: npm ci --engine-strict
       - name: Verify
         run: npm run verify
       - name: Verify benchmark and evidence tooling
-        if: matrix.node == '22.13.0'
+        if: matrix.node == '24.22.1'
         run: npm run test:tools
       - name: Smoke the packed CLI in a clean engine-strict consumer
         run: npm run smoke:package
       - name: Reject unsupported Node before packed CLI dependencies load
-        if: matrix.node == '22.13.0'
+        if: matrix.node == '24.22.1'
         run: npm run smoke:package:unsupported-node
 
+  packed-node22:
+    needs: classify
+    if: needs.classify.outputs.route == 'full'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7.0.1
+      - uses: actions/setup-node@v7.1.0
+        with:
+          node-version: 24.22.1
+          cache: npm
+      - run: npm install -g npm@12.2.1
+      - run: npm ci --engine-strict
+      - run: npm run build
+      - uses: actions/setup-node@v7.1.0
+        with:
+          node-version: 22.23.4
+      - run: npm install -g npm@12.2.1
+      - name: Verify Node 22 production dependency engines
+        run: npm run check:node-support
+      - name: Smoke a clean Node 22 engine-strict package consumer
+        run: npm run smoke:package
+
   package-boundary:
     needs: classify
     if: needs.classify.outputs.route == 'full'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7.0.1
+      - uses: actions/setup-node@v7.1.0
         with:
-          node-version: 22
+          node-version: 24.22.1
           cache: npm
-      - run: npm install -g npm@11
+      - run: npm install -g npm@12.2.1
       - run: npm ci
       - run: npm run build
       - name: Verify basic and proof-enabled packed consumers
@@ -226,12 +246,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 35
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7.0.1
+      - uses: actions/setup-node@v7.1.0
         with:
-          node-version: 22.13.0
+          node-version: 24.22.1
           cache: npm
-      - run: npm install -g npm@11
+      - run: npm install -g npm@12.2.1
       - run: npm ci --engine-strict
       - run: npx --no-install playwright install --with-deps chromium
       - name: Collect native WordPress Heading and Paragraph controls
@@ -257,7 +277,7 @@ jobs:
         run: npx --no-install wp-env --config=proof/wp-env.json stop
       - name: Upload WordPress 7.1 pattern-overrides receipt
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: wordpress-7.1-pattern-overrides-receipt
           path: |
@@ -269,7 +289,7 @@ jobs:
   ci-scope:
     name: CI scope
     if: always()
-    needs: [classify, documentation-contracts, skill-contracts, test, package-boundary, wordpress-proof]
+    needs: [classify, documentation-contracts, skill-contracts, test, packed-node22, package-boundary, wordpress-proof]
     runs-on: ubuntu-latest
     steps:
       - name: Require the selected route and accept only intentional skips
@@ -279,6 +299,7 @@ jobs:
           DOCS: ${{ needs.documentation-contracts.result }}
           SKILL: ${{ needs.skill-contracts.result }}
           TEST: ${{ needs.test.result }}
+          PACKED_NODE22: ${{ needs.packed-node22.result }}
           PACKAGE_BOUNDARY: ${{ needs.package-boundary.result }}
           WORDPRESS_PROOF: ${{ needs.wordpress-proof.result }}
         run: |
@@ -290,14 +311,14 @@ jobs:
           case "$ROUTE" in
             docs)
               selected="$DOCS"
-              skipped="$SKILL $TEST $PACKAGE_BOUNDARY $WORDPRESS_PROOF"
+              skipped="$SKILL $TEST $PACKED_NODE22 $PACKAGE_BOUNDARY $WORDPRESS_PROOF"
               ;;
             skill)
               selected="$SKILL"
-              skipped="$DOCS $TEST $PACKAGE_BOUNDARY $WORDPRESS_PROOF"
+              skipped="$DOCS $TEST $PACKED_NODE22 $PACKAGE_BOUNDARY $WORDPRESS_PROOF"
               ;;
             full)
-              selected="$TEST $PACKAGE_BOUNDARY $WORDPRESS_PROOF"
+              selected="$TEST $PACKED_NODE22 $PACKAGE_BOUNDARY $WORDPRESS_PROOF"
               skipped="$DOCS $SKILL"
               ;;
             *)

.github/workflows/release.yml

@@ -17,14 +17,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7.0.1
+      - uses: actions/setup-node@v7.1.0
         with:
-          node-version: 22.13.0
+          node-version: 24.22.1
           registry-url: https://registry.npmjs.org
-      # Trusted publishing needs npm >= 11.5.1; pin 11.x (npm 12 needs Node ≥22.22
-      # and changes pack --json shape — we support both, but stay on the proven line).
-      - run: npm install -g npm@11
+      # npm 12 supports Trusted Publishing on the patched Node baseline.
+      - run: npm install -g npm@12.2.1
       - run: npm ci --engine-strict
       - name: Verify benchmark and evidence tooling
         run: npm run test:tools
@@ -43,7 +42,7 @@ jobs:
       - name: Run the receipt-backed release candidate matrix
         # No --plans is intentional: the optional registered-block authoring
         # benchmark remains pending/unscored and is not a release prerequisite.
-        run: npm run release:check -- --matrix full-release-matrix --manual-review proof/reviews/0.9.0/owner-acceptance.json --receipt "dev/release/0.9-testing/receipts/${RELEASE_RECEIPT_TAG}.json"
+        run: npm run release:check -- --matrix full-release-matrix --manual-review proof/reviews/1.0.0/agent-review.json --receipt "dev/release/0.9-testing/receipts/${RELEASE_RECEIPT_TAG}.json"
         env:
           # Release names are data, never shell syntax. Keep the expansion
           # quoted so valid Git tag punctuation cannot alter this command.
@@ -53,7 +52,7 @@ jobs:
         run: npx --no-install wp-env --config=proof/wp-env.json stop
       - name: Retain release receipts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: release-receipts-${{ github.event.release.tag_name }}
           path: |

CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 1.0.0 — 2026-10-24
+
+- Establish the stable public CLI and library compatibility baseline. Future breaking changes require a major release.
+- Make visual finishing the default agent-skill workflow for rendered delivery: compare desktop and mobile, correct authored source, regenerate through the existing gate, and verify native edit/save/reopen.
+- Keep source-only work, unavailable render targets and explicit skips deliverable with clear verification gaps. A clean first comparison requires no correction loop.
+- Include reproducible visual-review fixtures and retained native editing evidence.
+- Refresh the Gutenberg, React, validation, browser and build toolchains, plus generated-plugin dependencies.
+- Require security-patched Node releases (^22.23.4 || ^24.22.1 || >=26.12.1) and target WordPress 7.1.3 for release proof.
+
 ## 0.9.11 — 2026-10-13
 
 - Add block-theme folder validation, in-place markup repair, WordPress 7.1 theme.json schema checks and local part/pattern/preset references.

README.md

@@ -17,10 +17,10 @@ Theme-folder and whole-site workflows, Wesper 0.5.0 and the Node 22.13/24 floor
 
 ## Quickstart
 
-Requires Node.js **22.13.0+ on 22.x, or 24.0.0+**. Node 20, 21 and 23 are unsupported. Basic conversion needs no AI agent, Docker or running WordPress site.
+Requires Node.js **22.23.4+ on 22.x, 24.22.1+ on 24.x, or 26.12.1+**. Node 20, 21, 23 and 25 are unsupported. Basic conversion needs no AI agent, Docker or running WordPress site.
 
 ```sh
-npm install block-runner # Node.js ^22.13.0 || >=24.0.0
+npm install block-runner # Node.js ^22.23.4 || ^24.22.1 || >=26.12.1
 printf '<p>Hello WordPress</p>\n' > hello.html
 npx --no-install block-runner convert hello.html
 ```

RELEASING.md

@@ -21,14 +21,14 @@ Block Runner publishes to npm from CI with **provenance** via **Trusted Publishi
 
 ## Per-release flow
 
-### 0.9 release
+### Stable releases
 
-The 0.9 line includes registered-block authoring and retains the pre-1.0 API policy below.
+The 1.x line establishes the public CLI and library compatibility baseline described below.
 Check `npm view block-runner dist-tags` for published versions. Before creating a release, run the
-deterministic release candidate gates from the candidate checkout:
+deterministic release candidate gates from the candidate checkout on Node 24.22.1+ or 26.12.1+:
 
 ```sh
-npm run release:check -- --manual-review proof/reviews/0.9.0/owner-acceptance.json --receipt dev/release/0.9-testing/receipts/<version>.json
+npm run release:check -- --manual-review proof/reviews/1.0.0/agent-review.json --receipt dev/release/0.9-testing/receipts/<version>.json
 ```
 
 The 13-fixture registered-block authoring benchmark is optional and does not
@@ -55,15 +55,21 @@ product-preview state live in
 3. Draft a **GitHub Release** for that tag and **Publish** it.
 4. The Release workflow runs the complete release candidate check then publishes with
    `npm publish --provenance --access public --tag latest`.
-5. Confirm afterward: `npm view block-runner@latest version` shows the new 0.9 version, and
+5. Confirm afterward: `npm view block-runner@latest version` shows the new release version, and
    `npm audit signatures` passes (provenance attestation present).
 
-## Pre-1.0 note
+## Compatibility policy
 
-While on `0.x`, any release may include breaking changes — that's expected semver for `0.x`.
-Do **not** promote 0.9 to 1.0 merely because the release matrix is green: 1.0 remains contingent
-on real-project feedback and resolution of all release failures. Move to `1.0.0` only when the
-public API (CLI flags + library exports) is stable enough to promise backward compatibility and
-those conditions are satisfied. At that point, consider adopting
-[changesets](https://github.com/changesets/changesets) to automate version bumps, changelogs, and
-the publish PR.
+Starting with 1.0.0, backward-incompatible changes to public CLI flags and library
+exports require a major release. Minor releases add compatible functionality;
+patch releases contain compatible fixes. Document behaviour changes and migration
+requirements in the changelog.
+
+The 1.0 release follows owner acceptance of a real-project rendered result and the
+required deterministic release checks. Valid block markup, rendered fidelity and
+native editing remain separate proof layers; the version does not promise fidelity
+for arbitrary input or remove warnings and verification gaps. Optional model
+benchmarks remain separately authorised and unscored when not run.
+
+Historical 0.x releases used the pre-1.0 policy and could include breaking changes
+in any release. Existing release-evidence paths retain their original names.