release: 0.1.0

[cemhurturk]

This is the release branch for 0.1.0, the first release. It bumps the version, adds CHANGELOG.md, and makes every document that said there was no release true of one.

The version

No code changes beyond the version constant. The tag goes on this PR's merge commit, dated 2026-09-26.

Ten places, counted rather than assumed: "version" in the root package.json and in each of the eight packages/*/package.json, and VERSION in packages/core/src/version.ts. packages/core/src/version.test.ts holds them to one number and counts the manifests, so a new package fails it until the count in the test is raised. The public CLAUDE.md now lists those places under "Cutting a release", step 2, where it said they would be listed once the stack existed.

The README's install steps check out the release. "Installing" was git clone then ./install.sh, which installs main, and after the next commit to main that is code no release contains while clickmonk version still prints the last release. It now runs git checkout v0.1.0 first. "Cutting a release" step 2 names that line as one more place to bump, and gives the command that counts it, because the version test cannot see a README. pnpm install rewrote nothing in pnpm-lock.yaml.

The changelog

One entry, 0.1.0, with "Added" and "What 0.1.0 does not do". There is no "Fixed" or "Changed" section, because nothing was released before it. "Added" was read against the whole history and every merged PR, #5 through #50. The fonts sentence is #48's, and the notifications line carries #49's rule for a domain verified by hand. The brand assets (#1) and CI changes are not user-facing and have no entry.

The "does not do" list and the README's "What does not work yet" say the same things. Reconciling them added three items to the README's list that only the interface section or "Upgrading" stated before: no time zone setting for the install (#43), no bulk operations (#39), and no published container image. The bulk item says one link and one domain at a time, and the interface section's "one setting at a time" is gone, because settings are saved several at once. The changelog's list gained the report limits, the export that ends the connection, and the IPv6 test coverage that the README already listed. The TLS line says "domains you have verified" rather than "verified with a DNS record", because a domain added with --verified gets a certificate too.

Releases are git tags, and there is no published image. The changelog's opening says so. An install builds from the checkout, as install.sh does.

The documents

README "Status" opens with "0.1.0, the first release. It has not yet carried anyone's production traffic, and the list below of what it does not do is part of the release." The public CLAUDE.md's "Current status" says "Released as 0.1.0; early."

SECURITY.md gains its supported-versions table: the latest release is supported and nothing older is, with no backports. It shows how to find the version to put in a report. The reporting channels are unchanged.

CONTRIBUTING.md no longer says most of the product is not built. It points at the README's status section for what 0.1.0 does and does not do. Its pointer to "The stack suites" now names CLAUDE.md, where that section is. It said "above", and the section was never in CONTRIBUTING.md.

Verification

pnpm lint, pnpm lint:sh, pnpm typecheck and pnpm build are clean. pnpm test passes: 1565 tests in 67 files, and the interface's 592 in 46. The count is 9 manifests at "version": "0.1.0" and 1 VERSION = '0.1.0', and nothing at 0.0.0 in either. The image built from this branch prints clickmonk 0.1.0 (schema version 10) for clickmonk version. The version guard was mutated twice. The first mutation set one package's manifest back to 0.0.0, and the second set VERSION to 0.1.1. Each failed version.test.ts's agreement test, and the file's other two tests passed. That one test covers both cases. The stack and durability suites were not run on this branch because nothing they exercise changed. CI runs them. The IPv6 published-port test, which CI skips, passed in the gate for #50 on a host whose IPv6 addresses are unique-local, and nothing it exercises changed here.