release: v1.3.0 (Phase 1 CivicCore extraction)

CHANGELOG.md

@@ -7,17 +7,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-Post-v1.2.0 commits on `master`. No version bump yet.
+No commits beyond v1.3.0 yet.
 
 ### Added
-- New external dependency on `civiccore`, now pinned to the versioned `v0.1.0` GitHub release wheel rather than a Git SHA.
-- Backend migrations now run the `civiccore` shared-schema baseline before records' own chain via `backend/alembic/env.py`. See [ADR-0003](https://github.com/CivicSuite/civicsuite/blob/main/docs/architecture/ADR-0003-civiccore-alembic-baseline-strategy.md) for the rationale and gate contract.
-- 3 migration gate tests at `backend/tests/test_civiccore_migration_gates.py` covering fresh-install, v1.2.x upgrade, and reapplication idempotency scenarios.
+
+### Changed
+
+### Deprecated
+
+### Removed
+
+### Fixed
+
+### Security
+
+## [1.3.0] - 2026-04-25
+
+Phase 1 CivicCore extraction release. Records now consumes `civiccore` v0.1.0 as a versioned dependency, two-layer Alembic migration order is in place, and the release-gate scaffolding (verify-release.sh, ADR-0003 migration gates, .dockerignore build hardening) is wired into CI.
+
+### Added
+- Phase 1 CivicCore extraction landed: `civiccore` v0.1.0 is now a declared dependency (release wheel, not source). Shared models (User, Role, Department, audit_log) and migrations now live in civiccore and are consumed via the shim layer.
+- Two-layer migration order: civiccore migrations run first via `civiccore.migrations.runner.upgrade_to_head()`, then records-side migrations run as before. Fresh installs and upgrades both tested.
+- Migration idempotency guards: 14 records-side migrations carry guards for shared-table ops (create_table, add_column, alter_column, create_index, create_foreign_key, create_unique_constraint, create_check_constraint) so they no-op when civiccore has already created the objects.
+- CI merge bar hardened: 3 ADR-0003 migration gate tests (fresh install, v1.2.x upgrade, civiccore-first install) are standing required-pass checks on every PR.
+- `scripts/verify-release.sh` added: 6-step release gate (pytest, ruff, version lockstep, doc presence, build, fresh-virtualenv wheel install).
+- Build context hardening: `.dockerignore` added at the repo root. Frontend build context dropped from 241.93 MB to 0.88 MB (-99.6%) and now completes on a clean clone (was failing on transient `node_modules/.bin/.<random>` symlinks). Api build context dropped from 2.41 MB to 1.22 MB (-49%). `backend/tests/fixtures/` is intentionally NOT excluded — the v1.2.0 schema fixture lives there and must remain in the api build context. (PR #29, master `fe5d7e3`.)
 
 ### Changed
 - `Dockerfile.backend` no longer installs `git`; the backend now resolves `civiccore` from a versioned wheel URL and no longer needs Git at image-build time.
 - 14 records migrations updated to use `civiccore.migrations.guards.idempotent_*` helpers, making them safe to re-apply on databases where the civiccore baseline has already created the shared tables (users, service_accounts, audit_log, data_sources, documents, document_chunks, model_registry, exemption_rules, connector_templates, departments, system_catalog, city_profile, notification_templates, prompt_templates, sync_run_log, sync_failures).
-- Build performance: added `.dockerignore` at repo root to exclude `.git`, `node_modules`, `__pycache__`, virtualenvs, and other dev artifacts from docker build context. Image build size and time reduced — see PR description for exact delta. Frontend build also fixed: without `.dockerignore`, transient npm `.bin/.<random>` symlinks in `node_modules` could fail the BuildKit "load build context" step with `invalid file request`.
 
 ## [1.2.0] - 2026-04-23
 

README.md

@@ -187,6 +187,8 @@ Service accounts with hashed API keys enable instance-to-instance federation acc
 
 ## Status
 
+**v1.3.0** — 2026-04-25 release. Phase 1 CivicCore extraction landed: `civiccore` v0.1.0 is now consumed as a release-wheel dependency. Two-layer migration order — civiccore migrations run first via subprocess, then records-side. No API or UI changes (infrastructure only). See [CHANGELOG](CHANGELOG.md) and the v1.3.0 release notes for operator upgrade guidance.
+
 **v1.2.0** — 2026-04-23 release. Tier 5 (installer + onboarding + seeding + model picker + portal mode) and Tier 6 (at-rest encryption, ENG-001 closed) ship together. CI green on `d556904` (run 24853147133). Backend 617/617 pytest, frontend 36/36 vitest, unsigned Windows installer produced on tag push.
 
 **v1.1.0** — Phase 2 release with department access controls, 50-state exemption rules, and compliance templates.
@@ -241,4 +243,4 @@ Service accounts with hashed API keys enable instance-to-instance federation acc
 | **Phase 3** | Public portal | Public homepage, search, guided request wizard, request tracker, help pages | Partial — T5D minimal surface shipped (landing + resident-registration + authenticated submission); published-records search, resident dashboard, and track-my-request remain Planned |
 | **Phase 4** | Transparency layer | Open records library, reporting dashboards, public archive, federation | Planned (v2.0) |
 
-*Note: Version numbers (semver) track release history. Phase numbers track design completeness per the canonical spec. They are separate systems. Current build (v1.2.0) includes backend work from Phases 0-2 and partial Phase 3 (T5D minimal public portal surface), but has not completed the full scope of any phase. See [canonical spec](docs/UNIFIED-SPEC.md) for complete requirements and [reconciliation](docs/RECONCILIATION-2026-04-13.md) for current gap analysis.*
+*Note: Version numbers (semver) track release history. Phase numbers track design completeness per the canonical spec. They are separate systems. Current build (v1.3.0) includes backend work from Phases 0-2 and partial Phase 3 (T5D minimal public portal surface), but has not completed the full scope of any phase. See [canonical spec](docs/UNIFIED-SPEC.md) for complete requirements and [reconciliation](docs/RECONCILIATION-2026-04-13.md) for current gap analysis.*

README.txt

@@ -181,6 +181,8 @@ Service accounts with hashed API keys enable instance-to-instance federation acc
 
 ## Status
 
+**v1.3.0** — 2026-04-25 release. Phase 1 CivicCore extraction landed: `civiccore` v0.1.0 is now consumed as a release-wheel dependency. Two-layer migration order — civiccore migrations run first via subprocess, then records-side. No API or UI changes (infrastructure only). See [CHANGELOG](CHANGELOG.md) and the v1.3.0 release notes for operator upgrade guidance.
+
 **v1.2.0** — 2026-04-23 release. Tier 5 (installer + onboarding + seeding + model picker + portal mode) and Tier 6 (at-rest encryption, ENG-001 closed) ship together. CI green on `d556904` (run 24853147133). Backend 617/617 pytest, frontend 36/36 vitest, unsigned Windows installer produced on tag push.
 
 **v1.1.0** — Phase 2 release with department access controls, 50-state exemption rules, and compliance templates.
@@ -235,4 +237,4 @@ Service accounts with hashed API keys enable instance-to-instance federation acc
 | **Phase 3** | Public portal | Public homepage, search, guided request wizard, request tracker, help pages | Partial — T5D minimal surface shipped (landing + resident-registration + authenticated submission); published-records search, resident dashboard, and track-my-request remain Planned |
 | **Phase 4** | Transparency layer | Open records library, reporting dashboards, public archive, federation | Planned (v2.0) |
 
-*Note: Version numbers (semver) track release history. Phase numbers track design completeness per the canonical spec. They are separate systems. Current build (v1.2.0) includes backend work from Phases 0-2 and partial Phase 3 (T5D minimal public portal surface), but has not completed the full scope of any phase. See [canonical spec](docs/UNIFIED-SPEC.md) for complete requirements and [reconciliation](docs/RECONCILIATION-2026-04-13.md) for current gap analysis.*
+*Note: Version numbers (semver) track release history. Phase numbers track design completeness per the canonical spec. They are separate systems. Current build (v1.3.0) includes backend work from Phases 0-2 and partial Phase 3 (T5D minimal public portal surface), but has not completed the full scope of any phase. See [canonical spec](docs/UNIFIED-SPEC.md) for complete requirements and [reconciliation](docs/RECONCILIATION-2026-04-13.md) for current gap analysis.*

backend/app/config.py

@@ -3,7 +3,7 @@
 from pydantic import field_validator, model_validator
 from pydantic_settings import BaseSettings
 
-APP_VERSION = "1.2.0"
+APP_VERSION = "1.3.0"
 
 _INSECURE_SECRETS = {"CHANGE-ME", "CHANGE-ME-generate-with-openssl-rand-hex-32", ""}
 

backend/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "civicrecords-ai"
-version = "1.2.0"
+version = "1.3.0"
 description = "Open-source AI-powered open records support for American cities"
 requires-python = ">=3.12"
 license = "Apache-2.0"

docs/SUPERVISOR.md

@@ -24,7 +24,7 @@ Red flag if any of these disagree with each other. Ask Claude to reconcile befor
 2. **Run the sovereignty check yourself before a push.** `bash scripts/verify-sovereignty.sh`. No `verify-release.sh` exists in this repo — do not accept a claim that one was run.
 3. **Check lint + types on touched code.** `cd backend && ruff check app tests`. `cd frontend && npx tsc --noEmit`. `cd frontend && npm run build` is the integrated check.
 4. **Watch OpenAPI drift.** If backend schemas changed, `docs/openapi.json` must be regenerated and `frontend/src/generated/api.ts` refreshed via `npm run generate:types`. Zero-diff regen is the Tier-6 standard.
-5. **Verify version lockstep before any push.** `backend/pyproject.toml` `version = "1.2.0"` must equal `frontend/package.json` `"version": "1.2.0"` must equal the top `[x.y.z]` entry in `CHANGELOG.md` must equal the "Current release" line in `docs/UNIFIED-SPEC.md`. A mismatch is a dealbreaker — no push.
+5. **Verify version lockstep before any push.** `backend/pyproject.toml` `version = "1.3.0"` must equal `frontend/package.json` `"version": "1.3.0"` must equal the top `[x.y.z]` entry in `CHANGELOG.md` must equal the "Current release" line in `docs/UNIFIED-SPEC.md`. A mismatch is a dealbreaker — no push.
 
 ---
 

docs/UNIFIED-SPEC.md

@@ -8,7 +8,7 @@ April 13, 2026
 | Status | Canonical — verified against repository at commit head |
 | Supersedes | All prior spec versions (v2.0, v2.2, v3.0, v3.0.1) |
 | Repository | github.com/scottconverse/civicrecords-ai |
-| Current release | v1.2.0 (April 23, 2026) — versions aligned across all files |
+| Current release | v1.3.0 (April 24, 2026) — versions aligned across all files |
 | Test suite | 617 automated backend tests + 36 frontend tests — all passing; GitHub Actions CI-verified (run 24853147133 on commit `d556904`) |
 | Method | GitHub API crawl of repo structure, README, CHANGELOG, config files, module directories, and in-repo RECONCILIATION doc |
 
@@ -19,11 +19,11 @@ This is the single source of truth for CivicRecords AI. It merges comprehensive
 When narrative claims and repository evidence disagree, repository evidence wins. This document replaces all prior spec versions.
 
 ### 1.1 Version Alignment (Resolved)
-As of v1.2.0, version numbers are aligned across all four authoritative files:
-backend/app/config.py: APP_VERSION = "1.2.0"
-backend/pyproject.toml: version = "1.2.0"
-frontend/package.json: version = "1.2.0"
-CHANGELOG.md: [1.2.0] - 2026-04-23
+As of v1.3.0, version numbers are aligned across all four authoritative files:
+backend/app/config.py: APP_VERSION = "1.3.0"
+backend/pyproject.toml: version = "1.3.0"
+frontend/package.json: version = "1.3.0"
+CHANGELOG.md: [1.3.0] - 2026-04-24
 The version drift documented in prior spec versions has been resolved and remains resolved. The CHANGELOG now covers four releases: 0.1.0 (foundation), 1.0.0 (design system + core features), 1.1.0 (department scoping, compliance, and feature sprint), and 1.2.0 (Tier 5 installer/onboarding/seeding/model-picker/portal-mode + Tier 6 at-rest encryption ENG-001 closure).
 
 ## 2. Product Summary

docs/admin-manual-it.html

@@ -3,11 +3,11 @@
 <head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
-<title>CivicRecords AI &mdash; IT Administrator Manual v1.2.0</title>
+<title>CivicRecords AI &mdash; IT Administrator Manual v1.3.0</title>
 <style>
 /* ═══════════════════════════════════════════════════════════════════════════
    CivicRecords AI — IT Administrator Manual
-   Version 1.2.0 | Professional Operations Manual
+   Version 1.3.0 | Professional Operations Manual
    ═══════════════════════════════════════════════════════════════════════════ */
 
 :root {
@@ -347,7 +347,7 @@
   <h1>IT Administrator Manual</h1>
   <div class="subtitle">CivicRecords AI &mdash; AI-Powered Open Records Support for American Cities</div>
   <div class="meta">
-    <span class="badge badge-version">v1.2.0</span>
+    <span class="badge badge-version">v1.3.0</span>
     <span class="badge badge-date">April 2026</span>
     <span class="badge badge-class">CAIA: Not High-Risk</span>
     <span class="badge badge-license">Apache 2.0</span>
@@ -599,7 +599,7 @@ <h3>Post-Installation Verification</h3>
 
 <span class="comment"># Test API health endpoint</span>
 <span class="cmd">curl http://localhost:8000/health</span>
-<span class="output">{"status":"ok","version":"1.2.0"}</span>
+<span class="output">{"status":"ok","version":"1.3.0"}</span>
 
 <span class="comment"># Verify OpenAPI documentation is accessible</span>
 <span class="cmd">curl -s http://localhost:8000/docs | head -1</span>
@@ -1353,7 +1353,7 @@ <h2><a class="anchor" href="#monitoring">12. Monitoring &amp; Troubleshooting</a
 
   <h3>Health Endpoint</h3>
   <pre><span class="cmd">curl http://localhost:8000/health</span>
-<span class="output">{"status":"ok","version":"1.2.0"}</span></pre>
+<span class="output">{"status":"ok","version":"1.3.0"}</span></pre>
   <p>
     The <code>GET /health</code> endpoint returns HTTP 200 with the application version when the API is operational. Use this for load balancer health checks and monitoring systems.
   </p>
@@ -1739,7 +1739,7 @@ <h3>Appendix D: Supported Platforms Matrix</h3>
      FOOTER
      ═══════════════════════════════════════════════════════════════════════ -->
 <div class="footer">
-  CivicRecords AI v1.2.0 &mdash; IT Administrator Manual<br>
+  CivicRecords AI v1.3.0 &mdash; IT Administrator Manual<br>
   Apache License 2.0 &mdash; Open Source<br>
   Generated April 2026
 </div>

docs/architecture/decomposition.html

@@ -256,7 +256,7 @@ <h2 class="subsection-title">Sub-Project Build Sequence (from master spec sectio
 </div>
 
 <div style="text-align: center; padding: 2rem; color: var(--gray-500); font-size: .8rem;">
-  CivicRecords AI v1.2.0 &nbsp;&middot;&nbsp; Apache License 2.0 &nbsp;&middot;&nbsp;
+  CivicRecords AI v1.3.0 &nbsp;&middot;&nbsp; Apache License 2.0 &nbsp;&middot;&nbsp;
   <a href="https://github.com/scottconverse/civicrecords-ai" style="color: var(--blue-500);">github.com/scottconverse/civicrecords-ai</a>
 </div>
 </body>

docs/architecture/system-architecture.html

@@ -3,7 +3,7 @@
 <head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
-<title>CivicRecords AI — System Architecture (v1.2.0)</title>
+<title>CivicRecords AI — System Architecture (v1.3.0)</title>
 <style>
   *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
   :root {
@@ -72,7 +72,7 @@
 
 <div class="page-header">
   <h1>CivicRecords AI &mdash; System Architecture</h1>
-  <p>v1.2.0 &nbsp;|&nbsp; Tier 5 + Tier 6 complete &nbsp;|&nbsp; 7 Docker Services &nbsp;|&nbsp; 617 backend + 36 frontend tests</p>
+  <p>v1.3.0 &nbsp;|&nbsp; Tier 5 + Tier 6 complete &nbsp;|&nbsp; 7 Docker Services &nbsp;|&nbsp; 617 backend + 36 frontend tests</p>
 </div>
 
 <div class="legend">
@@ -236,7 +236,7 @@ <h2>Docker Compose Services</h2>
 </div>
 
 <div style="text-align: center; padding: 2rem; color: var(--gray-500); font-size: .8rem;">
-  CivicRecords AI v1.2.0 &nbsp;&middot;&nbsp; Apache License 2.0 &nbsp;&middot;&nbsp;
+  CivicRecords AI v1.3.0 &nbsp;&middot;&nbsp; Apache License 2.0 &nbsp;&middot;&nbsp;
   <a href="https://github.com/scottconverse/civicrecords-ai" style="color: var(--blue-500);">github.com/scottconverse/civicrecords-ai</a>
 </div>
 </body>

docs/civicrecords-ai-manual.html

@@ -3,7 +3,7 @@
 <head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
-<title>CivicRecords AI &mdash; Unified Manual v1.2.0</title>
+<title>CivicRecords AI &mdash; Unified Manual v1.3.0</title>
 <style>
 /* ===== RESET & BASE ===== */
 *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
@@ -140,7 +140,7 @@
   <div class="cover-logo">Municipal Open Records Platform</div>
   <h1>CivicRecords AI</h1>
   <div class="subtitle">Unified Operations Manual</div>
-  <div class="version-badge">Version 1.2.0</div>
+  <div class="version-badge">Version 1.3.0</div>
   <div class="meta">
     Staff User Guide &amp; IT Administration Reference<br>
     April 2026<br>
@@ -1946,7 +1946,7 @@ <h3>Docker Requirements</h3>
 
 <!-- FOOTER -->
 <div style="margin-top: 4rem; padding-top: 2rem; border-top: 2px solid #dde3ea; text-align: center; color: #5a6a7a; font-size: 0.85rem;">
-  <p>&copy; 2026 CivicRecords AI Project &mdash; Unified Operations Manual v1.2.0</p>
+  <p>&copy; 2026 CivicRecords AI Project &mdash; Unified Operations Manual v1.3.0</p>
   <p>AI-Powered Open Records Support for American Cities</p>
   <p style="margin-top: 0.5rem;">This document is confidential and intended for authorized municipal staff and IT personnel only.</p>
 </div>

docs/generate_docx.py

@@ -609,6 +609,11 @@ def build_readme_docx(out_path):
     # --- Status ---
     h = doc.add_heading("Status", level=1)
     apply_h1_style(h)
+    body_para(doc,
+        "v1.3.0 — Phase 1 CivicCore extraction landed. civiccore 0.1.0 is now a "
+        "release-wheel dependency; two-layer migration order (civiccore first via "
+        "subprocess, then records). Infrastructure-only release — no API or UI changes."
+    )
     body_para(doc,
         "v1.2.0 — Tier 5 + Tier 6 complete. Adds minimal public request portal (T5D), "
         "unsigned Windows installer (T5E), and ENG-001 closed "

docs/generate_pdfs.py

@@ -753,7 +753,7 @@ def build_readme_full(out_path):
         "Runs entirely on local hardware — no cloud, no telemetry, no vendor lock-in",
     ], styles)
     story.append(P(
-        "Current release: <b>v1.2.0</b> (April 23, 2026). 29 database tables, ~30 API endpoints, "
+        "Current release: <b>v1.3.0</b> (April 24, 2026). 29 database tables, ~30 API endpoints, "
         "617 backend + 36 frontend automated tests. Tier 5 and Tier 6 complete — ENG-001 "
         "(at-rest encryption for <tt>data_sources.connection_config</tt> via Fernet envelope) "
         "is closed. Tier 5 shipped the minimal public portal (T5D) and unsigned Windows "