docs: clean release policy and metadata guidance

Author: ndycode

CHANGELOG.md

@@ -3,7 +3,9 @@
 All notable changes to this project are documented in this file.
 Dates use ISO format (`YYYY-MM-DD`).
 
-This repository's canonical public release line is currently `0.x`.
+This repository's current stable release line is `1.x`.
+Current stable release notes live in `docs/releases/`.
+This top-level changelog preserves the foundational `0.x` milestones and points older iteration history to `docs/releases/legacy-pre-0.1-history.md`.
 
 ## [0.1.8] - 2026-03-11
 

README.md

@@ -11,6 +11,7 @@ Codex CLI-first multi-account OAuth manager for the official `@openai/codex` CLI
 > [!NOTE]
 > Legacy scoped prerelease package `@ndycode/codex-multi-auth` is migration-only.
 > Use `codex-multi-auth` for all new installs.
+
 ## What You Get
 
 - Canonical `codex auth ...` workflow for account login, switching, checks, and diagnostics
@@ -322,9 +323,9 @@ codex auth doctor --json
 ## Release Notes
 
 - Current stable: [docs/releases/v1.2.6.md](docs/releases/v1.2.6.md)
-- Recent patch release: [docs/releases/v1.2.5.md](docs/releases/v1.2.5.md)
-- Previous stable: [docs/releases/v1.2.2.md](docs/releases/v1.2.2.md)
-- Earlier stable: [docs/releases/v1.2.1.md](docs/releases/v1.2.1.md)
+- Previous stable: [docs/releases/v1.2.5.md](docs/releases/v1.2.5.md)
+- Earlier stable: [docs/releases/v1.2.4.md](docs/releases/v1.2.4.md)
+- Full release archive: [docs/README.md#release-history](docs/README.md#release-history)
 - Archived prerelease: [docs/releases/v0.1.0-beta.0.md](docs/releases/v0.1.0-beta.0.md)
 
 ## License

SECURITY.md

@@ -6,8 +6,8 @@ Security updates are provided for the current maintained release line.
 
 | Version line | Status |
 | --- | --- |
-| `0.x` latest | Supported |
-| pre-`0.x` historical branches | Not supported |
+| `1.x` latest | Supported |
+| pre-`1.0` historical releases | Not supported |
 
 ---
 
@@ -77,7 +77,7 @@ The following are not treated as vulnerabilities in this repository:
 
 Security override rationale (`package.json` -> `overrides`):
 
-- `hono`: pinned to `^4.12.3` to keep builds out of the vulnerable `4.12.0-4.12.1` range reported in `GHSA-xh87-mx6m-69f3` (authentication bypass advisory).
+- `hono`: pinned to `4.12.10` to keep builds out of the vulnerable `4.12.0-4.12.1` range reported in `GHSA-xh87-mx6m-69f3` (authentication bypass advisory).
 - `rollup`: pinned to `^4.59.0` to keep the Vite and Vitest transitive graph above the vulnerable `<4.59.0` range surfaced by `npm audit`.
 
 Before release and after dependency changes:

docs/DOCUMENTATION.md

@@ -56,7 +56,7 @@ Canonical governance for repository documentation quality and consistency.
 3. Canonical storage root: `~/.codex/multi-auth` unless explicitly overridden.
 4. Compatibility aliases (`codex multi auth`, `codex multi-auth`, `codex multiauth`) belong only in command reference, troubleshooting, or migration sections.
 5. Legacy paths/flows and scoped package references belong only in migration and compatibility sections.
-6. Public release line is `0.x`; historical pre-`0.1.0` entries are archived separately.
+6. Current stable release line is `1.x`; foundational `0.x` and pre-`0.1.0` entries stay archived separately.
 
 ---
 

docs/README.md

@@ -23,16 +23,24 @@ Public documentation for `codex-multi-auth`.
 | [configuration.md](configuration.md) | Stable defaults, precedence, and environment overrides |
 | [architecture.md](architecture.md) | Public system overview of the wrapper, storage, and optional plugin runtime |
 | [privacy.md](privacy.md) | Data handling and local storage behavior |
-| [releases/v1.2.6.md](releases/v1.2.6.md) | Stable release notes |
+
+---
+
+## Release History
+
+| Document | Focus |
+| --- | --- |
+| [releases/v1.2.6.md](releases/v1.2.6.md) | Current stable release notes |
 | [releases/v1.2.5.md](releases/v1.2.5.md) | Previous stable release notes |
 | [releases/v1.2.4.md](releases/v1.2.4.md) | Earlier stable release notes |
-| [releases/v1.2.2.md](releases/v1.2.2.md) | Earlier stable release notes |
-| [releases/v1.2.1.md](releases/v1.2.1.md) | Earlier stable release notes |
-| [releases/v1.2.0.md](releases/v1.2.0.md) | Archived stable release notes |
-| [releases/v0.1.7.md](releases/v0.1.7.md) | Archived stable release notes |
-| [releases/v0.1.6.md](releases/v0.1.6.md) | Archived stable release notes |
-| [releases/v0.1.5.md](releases/v0.1.5.md) | Archived stable release notes |
+| [releases/v1.2.2.md](releases/v1.2.2.md) | Stable archive |
+| [releases/v1.2.1.md](releases/v1.2.1.md) | Stable archive |
+| [releases/v1.2.0.md](releases/v1.2.0.md) | Stable archive |
+| [releases/v0.1.7.md](releases/v0.1.7.md) | Pre-1.0 stable archive |
+| [releases/v0.1.6.md](releases/v0.1.6.md) | Pre-1.0 stable archive |
+| [releases/v0.1.5.md](releases/v0.1.5.md) | Pre-1.0 stable archive |
 | [releases/v0.1.0-beta.0.md](releases/v0.1.0-beta.0.md) | Archived prerelease notes |
+| [releases/legacy-pre-0.1-history.md](releases/legacy-pre-0.1-history.md) | Archived pre-0.1 changelog history |
 
 ---
 
@@ -56,8 +64,7 @@ Public documentation for `codex-multi-auth`.
 | [reference/error-contracts.md](reference/error-contracts.md) | CLI, JSON, and helper error semantics |
 | [releases/v1.2.6.md](releases/v1.2.6.md) | Current stable release notes |
 | [releases/v0.1.0-beta.0.md](releases/v0.1.0-beta.0.md) | Archived prerelease reference |
-| [Daily Use release notes](#daily-use) | Stable, previous, and archived release notes |
-| [releases/legacy-pre-0.1-history.md](releases/legacy-pre-0.1-history.md) | Archived pre-0.1 changelog history |
+| [Release history](#release-history) | Stable, previous, and archived release notes |
 
 ---
 

docs/_config.yml

@@ -1,4 +1,4 @@
 theme: jekyll-theme-hacker
-title: codex-multi-auth docs
+title: Codex Multi Auth Docs
 description: Codex CLI multi-account OAuth documentation
 show_downloads: false

docs/reference/public-api.md

@@ -10,7 +10,7 @@ This project uses tiered API stability.
 
 ### Tier A: Stable APIs
 
-Stable APIs are covered by semver compatibility guarantees and must remain backward-compatible inside the `0.x` line unless explicitly documented.
+Stable APIs are covered by semver compatibility guarantees and must remain backward-compatible inside the current `1.x` line unless explicitly documented.
 
 - Package root plugin entrypoint exports:
   - `OpenAIOAuthPlugin`
@@ -103,7 +103,7 @@ These behaviors are compatibility guarantees for the current release line becaus
 - Tier A bug fix or doc-only clarification: `PATCH`
 - Tier B additive compatibility improvement: usually `PATCH` or `MINOR` depending on caller impact
 
-This repository currently ships on a `0.x` line, but breaking changes still require explicit migration documentation and review sign-off.
+This repository currently ships on a `1.x` line, and breaking changes still require explicit migration documentation and review sign-off.
 
 ---
 

docs/upgrade.md

@@ -1,6 +1,6 @@
 # Upgrade Guide
 
-Migrate legacy installs to the canonical `codex-multi-auth` workflow on the `0.x` release line.
+Migrate legacy installs to the canonical `codex-multi-auth` workflow on the current `1.x` release line.
 
 ---
 

test/documentation.test.ts

@@ -34,8 +34,18 @@ function readPackageVersion(): string {
 let packageVersion = "";
 let currentStableReleaseDoc = "";
 // These stay manual so the docs portal keeps an intentional short stable-history window.
-const previousStableReleaseDoc = "docs/releases/v1.2.2.md";
-const earlierStableReleaseDoc = "docs/releases/v1.2.1.md";
+const previousStableReleaseDoc = "docs/releases/v1.2.5.md";
+const earlierStableReleaseDoc = "docs/releases/v1.2.4.md";
+const stableArchiveReleaseDocs = [
+	"docs/releases/v1.2.2.md",
+	"docs/releases/v1.2.1.md",
+	"docs/releases/v1.2.0.md",
+];
+const preOneArchiveReleaseDocs = [
+	"docs/releases/v0.1.7.md",
+	"docs/releases/v0.1.6.md",
+	"docs/releases/v0.1.5.md",
+];
 
 function getUserDocs(): string[] {
 	return [
@@ -57,9 +67,8 @@ function getUserDocs(): string[] {
 		currentStableReleaseDoc,
 		previousStableReleaseDoc,
 		earlierStableReleaseDoc,
-		"docs/releases/v0.1.7.md",
-		"docs/releases/v0.1.6.md",
-		"docs/releases/v0.1.5.md",
+		...stableArchiveReleaseDocs,
+		...preOneArchiveReleaseDocs,
 		"docs/releases/v0.1.4.md",
 		"docs/releases/v0.1.3.md",
 		"docs/releases/v0.1.1.md",
@@ -160,17 +169,21 @@ function compareSemverDescending(left: string, right: string): number {
 		expect(portal).toContain(`releases/v${packageVersion}.md`);
 		expect(portal).toContain(previousStableReleaseDoc.replace("docs/", ""));
 		expect(portal).toContain(earlierStableReleaseDoc.replace("docs/", ""));
-		expect(portal).toContain("releases/v0.1.7.md");
-		expect(portal).toContain("releases/v0.1.6.md");
-		expect(portal).toContain("releases/v0.1.5.md");
+		for (const archivedDoc of stableArchiveReleaseDocs) {
+			expect(portal).toContain(archivedDoc.replace("docs/", ""));
+		}
+		for (const archivedDoc of preOneArchiveReleaseDocs) {
+			expect(portal).toContain(archivedDoc.replace("docs/", ""));
+		}
 		expect(portal).toContain("releases/v0.1.0-beta.0.md");
 		expect(portal).toContain("releases/legacy-pre-0.1-history.md");
 		expect(portal).toContain(
-			"| [Daily Use release notes](#daily-use) | Stable, previous, and archived release notes |",
+			"| [Release history](#release-history) | Stable, previous, and archived release notes |",
 		);
 		expect(readme).toContain(currentStableReleaseDoc);
 		expect(readme).toContain(previousStableReleaseDoc);
 		expect(readme).toContain(earlierStableReleaseDoc);
+		expect(readme).toContain("docs/README.md#release-history");
 
 		const beta = read("docs/releases/v0.1.0-beta.0.md");
 		expect(beta).toContain("Archived");
@@ -428,7 +441,24 @@ function compareSemverDescending(left: string, right: string): number {
 		expect(settingsRef).toContain("- `menuStatuslineFields`");
 	});
 
-	it("keeps changelog aligned with canonical 0.x release policy", () => {
+	it("keeps release-line docs aligned with the current 1.x policy", () => {
+		const changelog = read("CHANGELOG.md");
+		const security = read("SECURITY.md");
+		const docsGovernance = read("docs/DOCUMENTATION.md");
+		const upgradeGuide = read("docs/upgrade.md");
+		const publicApi = read("docs/reference/public-api.md");
+
+		expect(changelog).toContain("current stable release line is `1.x`");
+		expect(changelog).toContain("docs/releases/");
+		expect(security).toContain("`1.x` latest");
+		expect(security).toContain("pre-`1.0` historical releases");
+		expect(docsGovernance).toContain("Current stable release line is `1.x`");
+		expect(upgradeGuide).toContain("current `1.x` release line");
+		expect(publicApi).toContain("inside the current `1.x` line");
+		expect(publicApi).toContain("currently ships on a `1.x` line");
+	});
+
+	it("keeps the historical changelog aligned with the archived 0.x release set", () => {
 		const changelog = read("CHANGELOG.md");
 		expect(changelog).toContain("## [0.1.8] - 2026-03-11");
 		expect(changelog).toContain("## [0.1.7] - 2026-03-03");
@@ -497,6 +527,36 @@ function compareSemverDescending(left: string, right: string): number {
 		}
 	});
 
+	it("keeps package metadata aligned with the canonical owner surface", () => {
+		const packageJson = JSON.parse(read("package.json")) as {
+			name?: unknown;
+			author?: unknown;
+			license?: unknown;
+			repository?: { url?: unknown } | unknown;
+			homepage?: unknown;
+			bugs?: { url?: unknown } | unknown;
+			bin?: Record<string, unknown> | unknown;
+		};
+
+		expect(packageJson.name).toBe("codex-multi-auth");
+		expect(packageJson.author).toBe("ndycode");
+		expect(packageJson.license).toBe("MIT");
+		expect(packageJson.repository).toEqual({
+			type: "git",
+			url: "git+https://github.com/ndycode/codex-multi-auth.git",
+		});
+		expect(packageJson.homepage).toBe(
+			"https://github.com/ndycode/codex-multi-auth#readme",
+		);
+		expect(packageJson.bugs).toEqual({
+			url: "https://github.com/ndycode/codex-multi-auth/issues",
+		});
+		expect(packageJson.bin).toEqual({
+			codex: "scripts/codex.js",
+			"codex-multi-auth": "scripts/codex-multi-auth.js",
+		});
+	});
+
 	it("keeps governance templates and security reporting guidance present", () => {
 		const prTemplate = ".github/pull_request_template.md";
 		const issueConfig = ".github/ISSUE_TEMPLATE/config.yml";