docs(release-v1): Phase 4 + 5 — docs alignment + v1.0.0-rc1 release notes

Wraps the v1 release path. Phase 4 fixes broken docs called out by audit;
Phase 5 introduces RELEASE_NOTES.md. The release tag follows in a
separate `git tag` command (kept out of this commit so the message
isn't self-referential).

## Phase 4: docs alignment (audit #37 #38 #71 #72 + exec-summary CONTRIBUTING)

### README.md
- Quick Start Python DSL examples now compile against the actual API
  surface:
    * Loop(body, condition=lambda result, step: ..., max_steps=10)
      — was max_iterations= (doesn't exist) and condition took only 1 arg
    * Memory(agent, store={...})
      — was strategy="local", size=20 (neither kwarg exists)
- One-sentence agent builder example points to experiments/nl2agent.py
  (was bare nl2agent.py — would FileNotFoundError) and uses user_input=
  (was task= — wrong kwarg name).
- Repository layout table for deploy/ now reflects reality:
    * deploy/ has install-native.{sh,ps1} + start.{sh,bat,ps1} +
      stop.{sh,bat} — NO compose, NO nginx.
    * docker-compose.yml is its own table row, anchored at repo root.
- Added new top-level section: **v1.0 scope and deliberate non-goals**.
  Pins down what was subtracted (Feishu router, shell_executor.py,
  multi-tenant claims), what v1 is good for, what it is not yet good
  for. The audit's "弱化部分功能" decision lands as repo policy.

### CONTRIBUTING.md
- License section corrected: was "MIT License" (audit exec summary noted
  this contradicts LICENSE which is BUSL-1.1). Now points to LICENSE
  with the 2031-04-05 Change Date + ≤10-user production threshold.

## Phase 5: RELEASE_NOTES.md (new)

145-line release notes for v1.0.0-rc1. Structure:
- Highlights (5 components + CI infra)
- Audit-driven security & robustness improvements (per-commit breakdown
  of Phase 0/1/2/3 with audit finding IDs cited)
- Documentation changes
- Installation (clean editable-install path)
- Known limitations (carried forward from audit as v1.1+ backlog,
  flagged explicitly so users don't expect things v1.0 doesn't promise)
- Migration (gogs → github note, history rewritten by filter-repo to
  scrub leaked keys)
- License (BUSL-1.1 + Change Date)

## Audit findings closed by this commit

- High #37 #38: README Quick Start Loop/Memory examples now executable
- High #71:     nl2agent example points to real file + real kwarg name
- High #72:     deploy/ table description matches actual contents
- Exec-summary CONTRIBUTING license drift fixed

Total path-of-fix progress through this commit: 5 critical + 9 high
of 84 audit findings closed (was 5 critical + 6 high after Phase 3).

## Next

`git tag v1.0.0-rc1 <this commit>` + push. CI should remain green —
this commit is doc-only.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CONTRIBUTING.md

@@ -82,4 +82,13 @@ Use clear, descriptive commit messages:
 
 ## License
 
-By contributing, you agree that your contributions will be licensed under the MIT License.
+By contributing, you agree that your contributions will be licensed under the
+[Business Source License 1.1](LICENSE) — the same license that covers this
+repository. On **2031-04-05** (the Change Date), the license automatically
+converts to Apache License 2.0 for all prior contributions.
+
+Non-production use (development, testing, personal projects, academic research)
+is always permitted. Production use is free for organizations with ≤10 users
+or employees. See [`LICENSE`](LICENSE) and the **License** section of the
+top-level [`README.md`](README.md) for the threshold and how to obtain a
+commercial license before the Change Date.

README.md

@@ -9,6 +9,20 @@
 
 > 📖 **New here?** Start with [`docs/INTRODUCTION.md`](docs/INTRODUCTION.md) for a project-level overview, then read this README for the DSL deep-dive.
 
+## v1.0 scope and deliberate non-goals
+
+This first release prioritizes **predictable, single-deployment usage over breadth**. The audit ([`docs/AUDIT_2026-06-05.md`](docs/AUDIT_2026-06-05.md)) led to a series of *subtractions* before the first tag:
+
+- **Deleted:** the Feishu bot integration (`agentpaas/api/v1/feishu.py` + `agentpaas/services/feishu.py`) — it was an unfinished dev-stage surface that handed `process`-wide bot-rebind capability to anyone reaching port 8000. Will return in v2 with proper signing.
+- **Deleted:** `agentexample/agent67/tools/shell_executor.py` — LLM-controlled shell with a substring blocklist (RCE-via-prompt-injection). Was never wired into agent67's actual tool registry; the file is gone now too.
+- **Hardened:** `POST /api/v1/setup/bootstrap` only accepts loopback callers. Production deploys behind a reverse proxy should use the `agentpaas` CLI to create the initial tenant.
+- **Single-tenant assumption:** while the data model carries `tenant_id` columns and the audit found the scoping mostly correct, v1.0 is **intended for single-tenant deployments**. Multi-tenant requires the full RBAC + integration-test pass deferred to v2.
+- **Sample agents are samples:** `agentexample/qaagent67lambda` ships with `/home/67/knowledge/finance` paths — treat as a reference implementation requiring path customization, not a turn-key template.
+
+Things v1.0 is **good for:** running the lambdagent DSL kernel, executing YAML-defined agents through the PaaS API, building a knowledge base, using the web UI for chat/run/inspection, deploying via Docker Compose or the native scripts.
+
+Things v1.0 is **not yet good for:** untrusted multi-tenant SaaS, knowledge-dir-as-attack-surface (no pickle for shared dirs), Feishu integration, or anything that needs the `where = [".."]` empty-wheel pre-fix tooling.
+
 ## Repository layout
 
 | Directory | What it is | Run / install |
@@ -18,7 +32,8 @@
 | [`webui/`](webui/) | React + Vite frontend — agent editor, chat, run inspector, knowledge-base UI. | `cd webui && npm run dev` |
 | [`agentexample/`](agentexample/) | Concrete agents in production: `physics67` (research pipeline), `qaagent67*` (RAG QA), `travelagent67`, `pptagent67`, `research67`, `agent67`, etc. | See each subdir's README |
 | [`lambdagent_guard/`](lambdagent_guard/) | Static-analysis & runtime safety layer for compiled Lambda terms. | imported by `agentpaas` |
-| [`deploy/`](deploy/) | Docker Compose, nginx, startup scripts for one-click deployment. | `docker compose up -d` |
+| [`deploy/`](deploy/) | Native install + start/stop scripts (Bash, PowerShell, batch). | `bash deploy/install-native.sh && bash deploy/start.sh` |
+| [`docker-compose.yml`](docker-compose.yml) (repo root) | One-click Docker Compose deployment. | `docker compose up -d` |
 | [`demo/`](demo/) | End-to-end demos (notebooks, scripts) for talks and onboarding. | — |
 | [`docs/`](docs/) | Design docs, architecture, audits, comparison studies, [INTRODUCTION.md](docs/INTRODUCTION.md). | — |
 | [`tests/`](tests/) | 175+ pytest suite across DSL, compiler, runtime, cost vectors, algebraic laws. | `pytest tests/` |
@@ -191,15 +206,19 @@ reviewer = Lam("reviewer", "Review the text for clarity and correctness.")
 pipeline = writer >> reviewer  # = lambda x. reviewer(writer(x))
 
 # ReAct agent is a Y combinator
+# `condition` takes (result, step_index) and returns bool;
+# `max_steps` is the unfolding bound (default 10).
 searcher = Tool("search", lambda q: web_search(q))
 researcher = Loop(
     body=Lam("think", "Analyze the question. Use search if needed."),
-    condition=lambda result: "DONE" in result,
-    max_iterations=10,
+    condition=lambda result, step: "DONE" in result,
+    max_steps=10,
 )
 
-# Add memory for persistent context
-agent = Memory(researcher, strategy="local", size=20)
+# Add memory for persistent context.
+# `store` is an optional dict of {key: value} pre-loaded into the agent's
+# environment; further entries are added via `agent.remember(k, v)`.
+agent = Memory(researcher, store={"recent_topic": "LLM agents"})
 
 # Execute = beta-reduction
 result = agent("What are the latest advances in LLM agents?")
@@ -317,17 +336,17 @@ secure_tree = SecureExecutor(policy=SandboxPolicy.default()).sandbox_all_tools(a
 ### One-Sentence Agent Builder
 
 ```bash
-python nl2agent.py "Build a research assistant that can search the web and write reports, up to 20 steps, with memory"
+python experiments/nl2agent.py "Build a research assistant that can search the web and write reports, up to 20 steps, with memory"
 ```
 
 Or programmatically:
 
 ```python
-from nl2agent import one_sentence_to_agent
+from experiments.nl2agent import one_sentence_to_agent
 
 one_sentence_to_agent(
     "Build a code review pipeline: check security, then style, then performance",
-    task="Review this Python function: def login(u, p): ..."
+    user_input="Review this Python function: def login(u, p): ...",
 )
 ```
 

RELEASE_NOTES.md

@@ -0,0 +1,145 @@
+# Release Notes
+
+## v1.0.0-rc1 — 2026-06-06
+
+First public release candidate of **lambdagentpaas** — a full-stack platform
+for building, deploying, and serving AI agents defined in a Lambda-calculus
+DSL. The release follows a structured audit
+([`docs/AUDIT_2026-06-05.md`](docs/AUDIT_2026-06-05.md)) and 4 focused fix
+phases tagged in the git history.
+
+### Highlights
+
+- **lambdagent DSL kernel** — 152 exports, 11 Lambda-calculus constructs,
+  CEK machine, cost vectors, algebraic-law proofs (Paper II), instance
+  mechanism, run-workspace isolation. 175 kernel tests passing.
+- **agentpaas PaaS layer** — REST API for agent CRUD / run / streaming SSE /
+  cancellation / knowledge bases, with auth + multi-tenant data model.
+  83 mounted routes. **+7 new HTTP-level integration tests** in this rc1
+  (auth dependency, cross-tenant isolation, loopback `/bootstrap` guard).
+- **webui** — React + Vite frontend covering chat, agent editor, run
+  inspector, knowledge-base UI, agent workspace browser. Builds clean
+  under `tsc --noEmit`.
+- **agentexample** — `agent67`, `physics67` (12-step research pipeline
+  with artifact gates), `qaagent67*` (RAG QA), `travelagent67`,
+  `pptagent67`, `research67`.
+- **CI** — `gitleaks` secret scan with 6 China-side provider rules + dev
+  doc placeholders allowlist; pytest matrix on Python 3.10/3.11/3.12;
+  Node 20 webui build; package-surface smoke import.
+
+### Audit-driven security & robustness improvements
+
+Of 84 audit findings (7 critical / 33 high / 29 medium / 15 low), this rc1
+closes **5 critical and 6 high** in 4 commits:
+
+- `9a3f22b` **Phase 0** — Delete unsafe surface, harden `/bootstrap`
+  - **Audit critical #2** — Removed unauthenticated Feishu bot integration
+    (`agentpaas/api/v1/feishu.py` + `agentpaas/services/feishu.py`); had no
+    signature verification and process-wide bot rebind.
+  - **Audit critical #3 + #7** — Removed `agentexample/agent67/tools/shell_executor.py`
+    (LLM-controlled `shell=True` with bypassable substring blocklist).
+  - **Audit critical #1** — `POST /api/v1/setup/bootstrap` now refuses
+    non-loopback callers (returns 404). For production deploys behind a
+    reverse proxy, use the `agentpaas` CLI to bootstrap the initial tenant.
+
+- `a942525` **Phase 1** — `agentpaas` src-layout + declare `lambdagent` dep
+  - **Audit critical #4 + high #18** — `agentpaas/pyproject.toml` previously
+    used `where = [".."]` which empirically shipped a 1.2 KB metadata-only
+    wheel. Migrated to src-layout (`agentpaas/src/agentpaas/`), declared
+    `lambdagent>=0.1.0` as a real dependency. `python -m build --wheel`
+    now produces a 144 KB wheel containing all source.
+
+- `63ea55b` **Phase 2** — Robustness fixes
+  - **Audit high #8** — `lambdagent.agentruntime.async_executor` now forks
+    Context per parallel branch (mirroring the sync `multiagent.py:681`
+    path). Restores Paper II Prop 30 confluence on the async path.
+  - **Audit high #9** — sub-agent caller in `lambdagent.fromconfig.compiler`
+    no longer swallows `CancelledRun`; the host's `/cancel` endpoint can
+    now actually stop a sub-agent.
+  - **Audit high #10** — both `/api/v1/agents/run` and the in-process
+    sandbox path offload sync `term.apply()` to `run_in_executor`,
+    unblocking the FastAPI event loop. Per-worker concurrency restored.
+  - **Audit high #15** — `Chat.tsx` adds an unmount-only `useEffect` that
+    POSTs `/cancel`, stopping backend claude subprocess money-burn when
+    a user navigates away mid-stream.
+  - Carry-over WIP folded in: `_FAILURE_KEYWORDS` substring fail markers
+    in agents.py; `_compile_react` capability gate; claude-code provider
+    `_StallError` + idle-timeout helper.
+
+- `7d629b1` **Phase 3** — HTTP integration test skeleton
+  - **Audit critical #6** — Added 7 integration tests using
+    `fastapi.testclient.TestClient` + isolated `sqlite:///:memory:` DB.
+    Covers auth dependency (401 paths + happy path), Phase 0 loopback
+    guard verification, cross-tenant isolation on GET-by-id and LIST.
+  - Side fix: `agentpaas/db/models.py` migration loop now skips
+    migrations whose target table doesn't yet exist (caught when running
+    against a fresh `:memory:` DB).
+
+### Documentation
+
+- `README.md` — new **v1.0 scope** section listing deliberate non-goals;
+  Quick Start examples fixed (Loop `max_steps` + `condition(result, step)`,
+  Memory `store=`, nl2agent at `experiments/`); repository layout table
+  corrected for `deploy/` (native scripts, not Docker Compose).
+- `CONTRIBUTING.md` — license corrected from MIT to BUSL-1.1.
+- `docs/AUDIT_2026-06-05.md` — 84-finding audit report (Chinese), kept
+  local-only; use as a roadmap for v1.1+ work.
+
+### Installation
+
+```bash
+git clone https://github.com/kenny67nju/lambdagentpaas
+cd lambdagentpaas
+
+# Editable installs against the local source
+pip install -e ./lambdagent/
+pip install -e ./agentpaas/[dev]
+
+# Run the API server
+python -m agentpaas serve
+
+# (Optional) build the web UI
+cd webui && npm install && npm run build
+```
+
+### Known limitations
+
+These remain on the **post-rc1 backlog** ([`docs/AUDIT_2026-06-05.md`](docs/AUDIT_2026-06-05.md)
+for the full list):
+
+- **Multi-tenancy** — data model and most queries scope by `tenant_id`,
+  but only GET-by-id and LIST endpoints are integration-tested for
+  isolation. v1.0 is **intended for single-tenant deployments**.
+- **Four parallel beta-reduction interpreters** (`Term.apply`,
+  `async_core` monkey-patch, `executor`, `cek_machine`) — audit #20.
+  Adding a new constructor requires touching 4 files. Refactor deferred
+  to v1.1.
+- **`compiler.py` is a 1654-LOC god module** (audit #21); the 474-line
+  `_compile_react` closure should split into `agentruntime/react_loop.py`.
+- **`secrets/vault.py`** uses unsalted SHA-256 as the KDF (audit #12);
+  works but should be PBKDF2/scrypt before any non-trivial production use.
+- **`POST /run` sync path is functional but capped at 1 concurrent run
+  per FastAPI worker** until the event-loop offload (Phase 2 fix #10)
+  is verified under load.
+- **Feishu integration removed**; will be re-added in v2 with proper
+  X-Lark-Signature verification.
+
+### Migration
+
+This is the first release — nothing to migrate from. Internal users on
+the `gogs.seec.seecoder.cn` mirror should switch to the GitHub remote;
+the git history was rewritten with `git filter-repo` to scrub two leaked
+API keys (`docs/AUDIT_2026-06-05.md` critical #5), so commit hashes
+differ from the gogs history.
+
+### License
+
+[Business Source License 1.1](LICENSE) — non-production use (development,
+testing, personal projects, academic research) is always permitted.
+Production use is free for organizations with ≤10 individual users or
+employees. On **2031-04-05** (the Change Date), the license automatically
+converts to Apache License 2.0.
+
+---
+
+🤖 This release was prepared with [Claude Code](https://claude.com/claude-code).