release: promote CivicZone v1.0.0 public use

.agent-runs/2026-05-21-civiczone-v1-public-use/active-control-state.md

@@ -0,0 +1,25 @@
+# Active Control State
+
+Run: `2026-05-21-civiczone-v1-public-use`
+Pipeline: `module-release`
+Pipeline version: `agent-pipeline-codex v0.9.0`
+Active module: `CivicZone`
+Target: `v1.0.0 public-use module release`
+Status: `IN_PROGRESS`
+
+## Current Rung
+
+Scope read and gap audit.
+
+## Stop Condition
+
+No valid stop condition is active.
+
+## Scope Boundary
+
+Implementation writes are limited to `C:\Users\scott\OneDrive\Desktop\Claude\civiczone`.
+Minimum required suite-level installer/control-plane truth may be written under
+`C:\Users\scott\OneDrive\Desktop\Claude\CivicSuite-clerk-core-city-release`.
+Queue evidence may be written to `C:\Users\scott\OneDrive\Desktop\Claude\ACTIVE_RELEASE_QUEUE.md`.
+
+Queued module repos are read-only references.

.agent-runs/2026-05-21-civiczone-v1-public-use/implementation-report.md

@@ -0,0 +1,44 @@
+# CivicZone v1.0.0 Implementation Report
+
+**DoD readiness: READY**
+
+**DoD checklist: 18 total, 18 ready, 0 blocked, 0 deferred**
+
+## Scope
+
+Active release lock: CivicZone only.
+
+Implemented the source-repo v1.0.0 release candidate for CivicZone. Queued
+module repos remained read-only.
+
+## Changes
+
+- Promoted CivicZone version truth to `1.0.0`.
+- Aligned CivicCore dependency and GitHub workflows to the published
+  CivicCore `1.1.0` wheel.
+- Rebuilt `/civiczone` as a browser-usable resident workflow surface with live
+  parcel lookup, cited Q&A, empty, error, and planner-review states.
+- Added `/civiczone/staff` as a browser staff workflow shell for planner Q&A,
+  ambiguity review, analytics, and staff-report outline actions.
+- Hardened staff API access with CivicCore trusted-header/proxy validation.
+- Updated tests for version truth, CivicCore compatibility, public/staff UI,
+  staff role checks, and spoofed-header rejection from untrusted sources.
+- Updated current-facing docs, QA evidence, careful-coding evidence, and
+  release-gate audit evidence.
+
+## Verification
+
+- `python -m pytest -q`: 71 passed, 3 warnings.
+- `bash scripts/verify-docs.sh`: PASS.
+- `python -m ruff check .`: PASS.
+- `bash scripts/verify-release.sh`: PASS, built wheel, sdist, and SHA256SUMS.
+- `git diff --check`: clean, CRLF warnings only.
+- Browser QA: resident and staff desktop/mobile surfaces, loading/success/empty
+  /error/partial states, console checks, keyboard/focus, and layout evidence
+  saved under `docs/qa/`.
+
+## Remaining Release Mechanics
+
+The source repo release candidate is ready for branch, commit, push, PR, CI,
+merge, tag/release, then CivicSuite installer/module-selection truth. The full
+module Definition of Done is not complete until those follow-through gates pass.

.agent-runs/2026-05-21-civiczone-v1-public-use/manifest.yaml

@@ -0,0 +1,22 @@
+run_id: "2026-05-21-civiczone-v1-public-use"
+pipeline: "module-release"
+pipeline_version: "agent-pipeline-codex v0.9.0"
+goal: "Release CivicZone v1.0.0 as a public-use CivicSuite module with spec scope, UX QA, docs, tests, adversarial validation, installer/module-selection truth, PR/merge/tag/release, and CI evidence."
+active_module: "CivicZone"
+target_version: "1.0.0"
+source_of_truth:
+  - "C:\\Users\\scott\\OneDrive\\Desktop\\Claude\\ACTIVE_RELEASE_QUEUE.md"
+  - "C:\\Users\\scott\\OneDrive\\Desktop\\Claude\\CivicSuite-clerk-core-city-release\\docs\\CivicSuiteUnifiedSpec.md"
+  - "C:\\Users\\scott\\OneDrive\\Desktop\\Claude\\civiczone\\AGENTS.md"
+acceptance:
+  - "CivicZone version truth is 1.0.0 across code, docs, tests, release verifier, artifacts, tag, and suite truth."
+  - "CivicZone implements the required CivicSuiteUnifiedSpec section 10 public/staff workflows without making zoning determinations."
+  - "Resident and staff routes have desktop/mobile browser QA, console, keyboard/focus, copy, and loading/success/empty/error/partial evidence."
+  - "Local tests, lint/static checks, docs checks, release verifier, build artifacts, and SHA256SUMS pass."
+  - "Adversarial local integration mocks cover bad inputs, stale/missing data, spoofed roles/providers, unavailable dependencies, air-gap boundaries, and public/staff permission boundaries."
+  - "Release-gate audit has no unresolved Blocker or Critical findings."
+  - "CivicSuite installer/module-selection truth includes CivicZone 1.0.0 and passes live main verification after merge."
+platform_boundary:
+  linux: "full lifecycle evidence required where suite installer gates exercise lifecycle"
+  windows: "supported; archive/readiness and available matching-host evidence must be recorded honestly"
+  macos: "beta-level support unless a real matching-host lifecycle is proven; do not claim macOS lifecycle certification"

.agent-runs/2026-05-21-civiczone-v1-public-use/run.log

@@ -0,0 +1,8 @@
+2026-05-21T12:00:00Z | START | CivicZone v1.0.0 module-release run created under agent-pipeline-codex v0.9.0 pattern.
+2026-05-21T12:00:00Z | ACTIVE_LOCK | CivicZone only. Queued modules read-only.
+2026-05-21T12:00:00Z | SCOPE | Scope read started from ACTIVE_RELEASE_QUEUE.md, CivicSuiteUnifiedSpec.md section 10, live GitHub main, and current CivicZone source.
+2026-05-21T13:00:00Z | BASELINE | Initial pytest failed 1 test due CivicCore 1.1.0 runtime vs stale 1.0.1 expectation; docs and Ruff passed.
+2026-05-21T13:30:00Z | EXECUTE | CivicZone source v1.0.0 release candidate implemented with public/staff browser surfaces and trusted staff auth.
+2026-05-21T14:00:00Z | BROWSER_QA | Resident and staff desktop/mobile browser QA passed; console clean after favicon fix.
+2026-05-21T14:15:00Z | VERIFY | scripts/verify-release.sh passed with 71 tests, docs gate, placeholder import gate, Ruff, build artifacts, and SHA256SUMS.
+2026-05-21T14:20:00Z | AUDIT | Release-gate audit recorded with 0 unresolved Blocker/Critical findings for source repo release candidate.

.agent-runs/2026-05-21-civiczone-v1-public-use/scope-lock.yaml

@@ -0,0 +1,36 @@
+run_id: "2026-05-21-civiczone-v1-public-use"
+active_module: "CivicZone"
+allowed_write_paths:
+  - "C:\\Users\\scott\\OneDrive\\Desktop\\Claude\\civiczone"
+  - "C:\\Users\\scott\\OneDrive\\Desktop\\Claude\\CivicSuite-clerk-core-city-release"
+  - "C:\\Users\\scott\\OneDrive\\Desktop\\Claude\\ACTIVE_RELEASE_QUEUE.md"
+allowed_suite_paths:
+  - "installer/modules.json"
+  - "scripts/verify-suite-state.py"
+  - "README.md"
+  - "README.txt"
+  - "STATUS.md"
+  - "FAQ.md"
+  - "USER-MANUAL.md"
+  - "USER-MANUAL.txt"
+  - "CHANGELOG.md"
+  - "docs/CivicSuiteUnifiedSpec.md"
+  - "docs/release-recovery-status.md"
+  - "docs/release-lockstep/downstream-pins.md"
+  - "docs/compatibility/index.md"
+  - "docs/installer/**"
+  - "installer/dist/**"
+forbidden_write_paths:
+  - "C:\\Users\\scott\\OneDrive\\Desktop\\Claude\\civicplan"
+  - "C:\\Users\\scott\\OneDrive\\Desktop\\Claude\\civicpermit"
+  - "C:\\Users\\scott\\OneDrive\\Desktop\\Claude\\civicinspect"
+  - "C:\\Users\\scott\\OneDrive\\Desktop\\Claude\\civicboards"
+  - "C:\\Users\\scott\\OneDrive\\Desktop\\Claude\\civicnotice"
+  - "C:\\Users\\scott\\OneDrive\\Desktop\\Claude\\civic311"
+  - "C:\\Users\\scott\\OneDrive\\Desktop\\Claude\\civiccomms"
+rules:
+  - "Queued module repos are read-only references."
+  - "No public-use, product-ready, finished, or released claim until Definition of Done evidence exists."
+  - "No macOS lifecycle certification claim."
+  - "All frontend changes require browser evidence before commit."
+  - "Non-trivial fixes require careful-coding evidence."

.github/workflows/release.yml

@@ -21,7 +21,7 @@ jobs:
           cache: pip
 
       - name: Install CivicCore release wheel
-        run: python -m pip install https://github.com/CivicSuite/civiccore/releases/download/v1.0.1/civiccore-1.0.1-py3-none-any.whl
+        run: python -m pip install https://github.com/CivicSuite/civiccore/releases/download/v1.1.0/civiccore-1.1.0-py3-none-any.whl
 
       - name: Install package and test dependencies
         run: python -m pip install -e ".[dev]"

.github/workflows/verify.yml

@@ -13,7 +13,7 @@ jobs:
         with:
           python-version: "3.11"
       - name: Install CivicCore release wheel
-        run: python -m pip install https://github.com/CivicSuite/civiccore/releases/download/v1.0.1/civiccore-1.0.1-py3-none-any.whl
+        run: python -m pip install https://github.com/CivicSuite/civiccore/releases/download/v1.1.0/civiccore-1.1.0-py3-none-any.whl
       - name: Install package
         run: python -m pip install -e ".[dev]"
       - name: Run release gate

AGENTS.md

@@ -18,7 +18,7 @@
 
 ## Placeholder Package Warning
 
-Do not import from CivicCore placeholder packages until CivicCore ships real implementations for them: `audit`, `auth`, `catalog`, `connectors`, `exemptions`, `ingest`, `notifications`, `onboarding`, `scaffold`, `search`, `verification`.
+Do not import from CivicCore placeholder packages until CivicCore ships real implementations for them: `audit`, `catalog`, `connectors`, `exemptions`, `ingest`, `notifications`, `onboarding`, `scaffold`, `search`, `verification`. CivicCore `auth` is no longer treated as a placeholder for CivicZone v1.0.0 because the current release uses its trusted-header helpers for staff access validation.
 
 ## Milestone Rule
 

CHANGELOG.md

@@ -13,31 +13,27 @@ The format follows Keep a Changelog, and this project follows Semantic Versionin
 
 ## [Unreleased]
 
-### Changed
-
-- feat(deps): bump civiccore pin to v1.0.1 (security hardening recovery patch)
-
-## [1.0.0] - 2026-05-07
+## [1.0.0] - 2026-05-21
 
-### Recovery note
+### Release note
 
-- The `1.0.0` label was checked through the suite release-recovery pass with a
-  fresh local release gate and live browser QA. Treat the original release date
-  as historical; the recovery evidence is recorded in
-  `docs/release-recovery-status.md`.
+- CivicZone is promoted from the demoted `0.2.0` recovery posture to the active
+  `1.0.0` public-use module release after the current scope, UX, docs, tests,
+  adversarial validation, and release-gate pass.
 
 ### Added
 
 - v1 resident zoning Q&A runtime with deterministic cited answers, refusal and escalation reasons, confidence metadata, and actionable next steps.
 - Staff workflow APIs for planner Q&A, ambiguity review queue, high-volume question analytics, staff-report outline support, and flagged-answer review.
 - Database-backed staff workflow records for planner questions, ambiguity queue items, and flagged answer reviews when `CIVICZONE_PARCEL_RULE_DB_URL` is configured.
 - Local adversarial integration mocks for Esri ArcGIS REST, GeoJSON fallback, CivicCode, CivicClerk, CivicPlan, CivicAccess, county assessor, and CKAN boundary validation.
-- Resident UI copy and visible state guidance for loading, success, empty, error, and partial outcomes.
+- Browser-usable resident UI for live parcel lookup, cited Q&A, empty, error, and planner-review states.
+- Browser staff workflow shell for planner Q&A, ambiguity queue creation, analytics, and staff-report outline support.
 
 ### Changed
 
-- Published CivicZone release surfaces at `1.0.0`; the later suite
-  release-recovery pass records fresh verification evidence.
+- CivicCore dependency alignment moves to the published CivicCore `1.1.0` wheel.
+- Staff workflow APIs now validate trusted municipal staff headers through the CivicCore trusted-proxy helper with loopback-only local defaults.
 - Updated runtime and documentation boundaries to describe the v1 product without claiming legal advice, official zoning determinations, or live external vendor calls by default.
 
 ## [0.1.2] - 2026-05-07

README.md

@@ -2,7 +2,7 @@
 
 CivicZone is CivicSuite's parcel-aware zoning and land-use Q&A module.
 
-Current state: **published v0.2.0 recovery label recovered through suite release-recovery evidence**. This repo contains a FastAPI service, health/root endpoints, documentation gates, canonical zoning schema models, Alembic migrations, deterministic parcel/zone lookup, cited use-rule lookup, cited dimensional-rule prechecks, resident Q&A with refusal and escalation rules, optional database-backed parcel/rule, resident-question ledger, and staff-workflow records through `CIVICZONE_PARCEL_RULE_DB_URL`, staff-only precedent protection, an accessible resident UI at `/civiczone`, adversarial local integration mocks, and CivicCore v1.0.0 release-wheel dependency alignment. See [docs/release-recovery-status.md](docs/release-recovery-status.md) for the local release gate, browser QA, and CI evidence.
+Current state: **CivicZone v1.0.0 public-use module release**. This repo contains a FastAPI service, health/root endpoints, documentation gates, canonical zoning schema models, Alembic migrations, deterministic parcel/zone lookup, cited use-rule lookup, cited dimensional-rule prechecks, resident Q&A with refusal and escalation rules, optional database-backed parcel/rule, resident-question ledger, and staff-workflow records through `CIVICZONE_PARCEL_RULE_DB_URL`, staff-only precedent protection, a browser-usable resident UI at `/civiczone`, a staff workflow shell at `/civiczone/staff`, adversarial local integration mocks, trusted-proxy staff access validation, and CivicCore v1.1.0 release-wheel dependency alignment. See [docs/release-recovery-status.md](docs/release-recovery-status.md) for historical recovery context and current release evidence.
 
 ## Product Boundaries
 
@@ -26,6 +26,7 @@ bash scripts/verify-release.sh
 - `GET /` returns current module status and operator next step.
 - `GET /health` returns package and CivicCore version information.
 - `GET /civiczone` returns the accessible resident lookup UI.
+- `GET /civiczone/staff` returns the staff workflow shell; staff API actions require trusted municipal access headers from an approved proxy/source.
 - `POST /api/v1/civiczone/parcels/lookup` returns sample parcel zone context for `100-200-300` / `123 Main St`.
 - `POST /api/v1/civiczone/rules/use` returns sample use status with citation.
 - `POST /api/v1/civiczone/rules/dimensional` returns sample dimensional rule values with citation.
@@ -42,7 +43,7 @@ Resident question text is stored only when `CIVICZONE_PARCEL_RULE_DB_URL` is con
 
 Set `CIVICZONE_PARCEL_RULE_DB_URL` to enable persistent parcel, use-rule, dimensional-rule, resident-question ledger, and staff workflow records. When unset, CivicZone uses deterministic in-memory sample data and does not persist question or staff workflow rows.
 
-Staff workflow endpoints require trusted municipal access headers:
+Staff workflow endpoints require trusted municipal access headers from a configured trusted proxy/source. Local development accepts loopback by default. Shared deployments should set `CIVICZONE_STAFF_TRUSTED_PROXY_CIDRS` and strip client-supplied staff headers before requests reach CivicZone.
 
 - `X-CivicZone-Principal`
 - `X-CivicZone-Role: planner`, `staff`, or `zoning_admin`

README.txt

@@ -3,7 +3,7 @@ CivicZone
 
 CivicZone is CivicSuite's parcel-aware zoning and land-use Q&A module.
 
-Current state: published v0.2.0 recovery label recovered through suite release-recovery evidence. This repo contains a FastAPI service, health/root endpoints, documentation gates, canonical zoning schema models, Alembic migrations, deterministic parcel/zone lookup, cited use-rule lookup, cited dimensional-rule prechecks, resident Q&A with refusal and escalation rules, optional database-backed parcel/rule, resident-question ledger, and staff-workflow records through CIVICZONE_PARCEL_RULE_DB_URL, staff-only precedent protection, an accessible resident UI at /civiczone, adversarial local integration mocks, and CivicCore v1.0.0 release-wheel dependency alignment. See docs/release-recovery-status.md for the local release gate, browser QA, and CI evidence.
+Current state: CivicZone v1.0.0 public-use module release. This repo contains a FastAPI service, health/root endpoints, documentation gates, canonical zoning schema models, Alembic migrations, deterministic parcel/zone lookup, cited use-rule lookup, cited dimensional-rule prechecks, resident Q&A with refusal and escalation rules, optional database-backed parcel/rule, resident-question ledger, and staff-workflow records through CIVICZONE_PARCEL_RULE_DB_URL, staff-only precedent protection, a browser-usable resident UI at /civiczone, a staff workflow shell at /civiczone/staff, adversarial local integration mocks, trusted-proxy staff access validation, and CivicCore v1.1.0 release-wheel dependency alignment. See docs/release-recovery-status.md for historical recovery context and current release evidence.
 
 Product boundaries:
 
@@ -14,7 +14,7 @@ Product boundaries:
 
 Set CIVICZONE_PARCEL_RULE_DB_URL to enable persistent parcel, use-rule, dimensional-rule, resident-question ledger, and staff workflow records. When unset, CivicZone uses deterministic in-memory sample data and does not persist question or staff workflow rows.
 
-Staff workflow endpoints require trusted municipal access headers:
+Staff workflow endpoints require trusted municipal access headers from a configured trusted proxy/source. Local development accepts loopback by default. Shared deployments should set CIVICZONE_STAFF_TRUSTED_PROXY_CIDRS and strip client-supplied staff headers before requests reach CivicZone.
 
 - X-CivicZone-Principal
 - X-CivicZone-Role: planner, staff, or zoning_admin

SECURITY.md

@@ -1,5 +1,5 @@
 # Security
 
-CivicZone Current version: 0.2.0. Deploy it behind the city's trusted access layer, with local parcel/rule data reviewed by planning staff, and with official zoning determinations routed to municipal staff.
+CivicZone Current version: 1.0.0. Deploy it behind the city's trusted access layer, set `CIVICZONE_STAFF_TRUSTED_PROXY_CIDRS` for the reverse proxy allowed to inject staff headers, review local parcel/rule data with planning staff, and route official zoning determinations to municipal staff.
 
 Report suspected vulnerabilities privately to the project maintainer. Do not open public issues containing exploit details, secrets, or sensitive municipal data.