release: v1.3.0 (Phase 1 CivicCore extraction)

[scottconverse]

Release: v1.3.0 (Phase 1 CivicCore extraction)

Mechanics-only release. No API or UI changes. v1.3.0 cuts the records side after Phase 1 CivicCore extraction, with the release path hardened through Step 2b (real v1.2.0 schema fixture for Gate 2) and pre-Step-3 build hygiene (.dockerignore, PR #29).

What's in v1.3.0

See CHANGELOG.md [1.3.0] for the full bullet list. Highlights:

• Phase 1 CivicCore extraction landed: civiccore v0.1.0 is a declared dependency (release wheel, not source). Shared models (User, Role, Department, audit_log) and migrations live in civiccore.
• Two-layer migration order: civiccore migrations run first via civiccore.migrations.runner.upgrade_to_head(), then records-side.
• Migration idempotency guards on 14 records-side migrations.
• CI merge bar: 3 ADR-0003 migration gate tests are standing required-pass.
• scripts/verify-release.sh 6-step gate.
• Build context hardening: .dockerignore (PR #29).

Operator upgrade notes (will appear in the GitHub release body too)

Operators upgrading from v1.2.0 need exactly three things:

1. New dependency: civiccore. Backend installs civiccore-0.1.0 automatically from the GitHub release URL. Docker Compose users: rebuild the backend image (docker compose build backend).
2. Migration order changed. On docker compose up, civiccore migrations run first via the app startup path, then records migrations. Manual Alembic users: run civiccore's runner first (python -c "from civiccore.migrations.runner import upgrade_to_head; upgrade_to_head()") before alembic upgrade head. Fresh installs unaffected.
3. No API or UI changes. Infrastructure only. No endpoint changes, no frontend changes, no new env vars beyond v1.2.0.

3d Verification Log

Check	Source	Status	Evidence
bash scripts/verify-release.sh — all 6 steps green	local	✅ PASS (exit 0)	Sovereignty: 8 PASS / 1 WARN / 0 FAIL (the WARN is a pre-existing telemetry-pattern match in 3 backend files — analytics/router.py, connectors/rest_api.py, main.py — carried from PR #29's run, not a release blocker). Version lockstep: 1.3.0 across 4 surfaces (backend/pyproject.toml, frontend/package.json, CHANGELOG.md, docs/UNIFIED-SPEC.md). All 6 required docs present (README.md, CHANGELOG.md, CONTRIBUTING.md, LICENSE, .gitignore, docs/index.html).
Backend pytest (incl. 3 ADR-0003 migration gate tests)	CI	✅ PASS (13m33s)	Run 24923458587, backend job 72989183324. CI's Hard Rule 1e gate (collected == passed) is enforced — every collected test ran and passed; no pytest.skip, no xfail, no swallowed errors. The 3 ADR-0003 migration gates (test_gate1_fresh_install, test_gate2_upgrade_from_v1_2, test_gate3_civiccore_first_install) are inside this suite.
Frontend vitest + build	CI	✅ PASS (34s)	Same run, frontend job 72989183326. Includes the bumped v1.3.0 mock payloads in Dashboard.test.tsx + Settings.test.tsx.
T2C bootstrap-failure smoke test	CI	✅ PASS (44s)	Same run, smoke job 72989183325. Placeholder-password fatal at startup; strong-password sanity OK.
ruff: 0 violations	local	❌ DIVERGES from directive	ruff: 82 violations, pre-existing, not gated by CI, deferred to issue #33. docker compose exec -T api ruff check . exit 1, "Found 82 errors" (72 auto-fixable). None introduced by v1.3.0 source bumps. CI workflow (.github/workflows/ci.yml) does not run ruff anywhere. Path B ruling (mechanics-only release; lint cleanup deserves its own focused PR with the CI gate as a forcing function — issue #33 covers both the cleanup and the CI wiring).

Out of scope (tracked separately)

• Binary artifact regen (README.{docx,pdf}, USER-MANUAL.{docx,pdf}, docs/*.docx and *.pdf): #31. Per Path B ruling — Hard Rule 0 is a quality bar not a release blocker, regen is real work with risk + binary diff noise, source files are canonical truth.
• ruff cleanup (82 pre-existing violations) + wire ruff into CI as required check: #33. Per Path B ruling — release scope is mechanics, not lint cleanup; CI doesn't gate on ruff anyway. Issue lint: ruff cleanup (82 pre-existing violations) + wire ruff into CI as required check #33's two-part scope: fix the 82 + install ruff as a CI required check (forcing function so the next release doesn't surface the same divergence).
• DataSources.test.tsx label-association flake: #30. Surfaced once during PR chore(build): add .dockerignore to exclude dev artifacts from build context #29's CI history; passed on rerun and locally; not a release blocker.
• CivicSuite compatibility matrix update (records-ai row → 1.3.0, last verified → 2026-04-25, notes → "Phase 1 merged; civiccore 0.1.0 consumed as release wheel"): per directive's "After v1.3.0 ships" section, done in CivicSuite repo after this merges + tags.

Refs

• Dev directive: dev_directive_civicsuite_step2b_step3_2026-04-24.md
• Canonical sequence: project_civicsuite_release_hardening.md
• Phase 1 merge: 0cd5a7a (PR #24)
• civiccore wheel pin: ca11d08 (PR #26)
• Step 2b real fixture: 3825cc4 (PR #28)
• .dockerignore: fe5d7e3 (PR #29)
• Binary-regen follow-up: #31
• Ruff cleanup + CI-gate follow-up: #33
• DataSources flake: #30

🤖 Generated with Claude Code