chore(release): prepare 0.1.0-alpha.1 source preview

CHANGELOG.md

@@ -1,9 +1,11 @@
 # Changelog
 
-Delivered changes are recorded here. Version tags use `v` followed by a semantic version. Foundation releases describe repository infrastructure; the first runnable preview is planned as `v0.1.0-alpha.1`.
+Delivered changes are recorded here. Version tags use `v` followed by a semantic version. Foundation releases describe repository infrastructure; `v0.1.0-alpha.1` is the first research source-preview version.
 
 ## [Unreleased]
 
+## [0.1.0-alpha.1] - 2026-10-25
+
 ### Added
 
 - Static capability plugins for Markdown/LaTeX editing, recoverable drafts, immutable human revisions, comparison, BusyTeX compilation, PDF.js preview and portable v2 archives with v1 import compatibility.
@@ -29,9 +31,20 @@ Delivered changes are recorded here. Version tags use `v` followed by a semantic
 ### Fixed
 
 - Keep comparison revision reads within the selected document; prepare pinned TeX components before browser CI and retain failed compiler diagnostics, screenshots and traces.
-- Align development and acceptance documentation with implemented plugin capabilities, request limits and independent archive/database versions; separate historical local verification from the unresolved PR #11 XeLaTeX CI timeout.
+- Download the unchanged, hash-pinned Fandol font from a fixed CTAN mirror after candidate CI exposed a certificate failure through the rotating mirror endpoint; retain TLS verification.
+- Merge concurrently completed material uploads into the latest conversation selection, preserving every selected file through refresh and run creation.
+- Align development and acceptance documentation with implemented plugin capabilities, request limits and independent archive/database versions; retain the initial XeLaTeX CI failure separately from the subsequent passing checks.
 - Preserve the selected report revision when navigating to its producing step, bind creation keys to limits/retry ancestry, reject invalid replay cursor indices, close interrupted AG-UI projections and retain TLS verification during isolated Windows Git installation.
 
+### Preview boundary
+
+- Source preview for Node.js 24 and a locally launched browser workspace; no installer, hosted deployment or npm package is provided.
+- Windows user-scoped credential protection; Crossref metadata research; dated DeepSeek non-thinking compatibility. Metadata and model interpretation do not establish full-text access or scientific claim support.
+- Static trusted plugins and supervised workers are not an untrusted-code sandbox. No arbitrary execution, multiple agents, team hosting or automatic process-loss recovery.
+- TeX/font resources are downloaded separately (202,592,248 bytes), with checksums and resumable ranges; first preparation needs network access and curl. Cached offline compilation is tested. Missing packages fail while retaining the prior PDF; the Worker deadline is 120 seconds.
+- Supervisor-Skills, local research data, credentials, installed local Skills/hooks, generated bundles and compiler/font binaries are excluded from source archives. Third-party licenses remain independent; see THIRD_PARTY_NOTICES.md.
+- Validation includes 57 Node tests and 13 browser scenarios on the candidate, plus required Windows/Linux/browser CI. Historical live model/retrieval evidence remains dated; no new paid provider calls were made for this release preparation.
+
 ## [0.0.1] - 2026-10-24
 
 ### Added
@@ -47,5 +60,6 @@ Delivered changes are recorded here. Version tags use `v` followed by a semantic
 
 This foundation release contains specifications and repository tooling. It does not contain a runnable research application, an installer, a verified Supervisor-Skills integration, or runtime security guarantees.
 
-[Unreleased]: https://github.com/IsaacHuo/OpenLab/compare/v0.0.1...HEAD
+[Unreleased]: https://github.com/IsaacHuo/OpenLab/compare/v0.1.0-alpha.1...HEAD
+[0.1.0-alpha.1]: https://github.com/IsaacHuo/OpenLab/releases/tag/v0.1.0-alpha.1
 [0.0.1]: https://github.com/IsaacHuo/OpenLab/releases/tag/v0.0.1

PLAN.md

@@ -2,13 +2,13 @@
 
 更新时间：2026-10-25（Asia/Shanghai）。本文件是用户指定的计划入口，文件名固定为大写 `PLAN.md`。本次按 [ROADMAP](docs/ROADMAP.md) 的 ENG-00 至 ENG-06 顺序执行；当前事实和实际检查结果见 [STATUS](docs/STATUS.md)，详细证据见 [verification](docs/verification.md)。下方保留前两轮历史台账，不把历史限制误当成本轮授权。
 
-## 当前阶段：ENG-04 数据与权限验收
+## 当前阶段：ENG-05 alpha 源码候选
 
-- 前置：ENG-03 已通过本地构建、57 项 Node 测试和 13 项浏览器；[PR #11](https://github.com/IsaacHuo/OpenLab/pull/11) 的 Windows/Linux/browser、actionlint、Gitleaks、required-checks 全通过，已合并至 main `c9a96f3`。
-- 范围：将 alpha 数据和权限门槛逐项映射到现有实现及测试，不改变已确认的架构。
-- 完成条件：新轮确认、权限拒绝、只读重放、取消/重启、凭据隔离、人工修订、档案 v1/v2 和跨项目引用各有通过证据；预览限制明确记录。
-- 精确验证：`node --test app/tests/platform.test.ts app/tests/runtime.test.ts app/tests/service.test.ts app/tests/store.test.ts app/tests/documents.test.ts app/tests/context.test.ts app/tests/workflow.test.ts`；本轮已运行 30 项，全部通过。
-- 交付：更新验收表、STATUS 和本文件，通过本地文档检查及精确 PR CI 后合并。
+- 前置：[PR #11](https://github.com/IsaacHuo/OpenLab/pull/11) 修复和 [PR #12](https://github.com/IsaacHuo/OpenLab/pull/12) 数据/权限验收均在精确 PR CI 全通过、无待解决讨论后合并。ENG-04 的 30 项边界测试通过；新基线为 main `14b8a65`。
+- 范围：统一 `VERSION`、npm 根版本、OpenAPI 版本元数据为 `0.1.0-alpha.1`，整理双语启动说明、第三方清单、预览限制和带日期的 changelog；不改变 API 形状或数据库/档案版本。
+- 完成条件：候选只含明确纳入的源码，第三方声明和使用边界完整；本地全检查及精确候选 PR CI 通过后合并。
+- 精确验证：`npm run check`、`npm run build`、`npm run test:browser`、`npm run check:actions`、`npm run check:secrets`、`git diff --check`；核对源代码档案与版本一致性。
+- 交付：候选 PR；随后 ENG-06 等精确 main 的 push CI 通过，再 `npm run release:check -- 0.1.0-alpha.1` 并按既有工作流源码预发布，核对 tag、提交和 prerelease 标志。
 
 ## 阶段清单
 
@@ -18,8 +18,8 @@
 | ENG-01 收敛既有实现 | 已完成 | 项目源码、设计与许可纳入 PR #11，本地工具和研究数据排除 |
 | ENG-02 文档口径 | 已完成 | 能力、限制、版本及历史证据对齐，文档检查通过 |
 | ENG-03 构建与浏览器 | 已完成 | CI 独立准备 TeX；跨文档对比回归先失败后通过；本地 13 项和远程门槛通过，PR #11 已合并 |
-| ENG-04 数据与权限 | 进行中 | 30 项边界测试通过，验收表与预览限制需提交并通过 PR 门槛 |
-| ENG-05 alpha 候选 | 待 ENG-04 | 统一版本 `0.1.0-alpha.1`、启动说明、许可和发布说明；完整检查、构建、浏览器、actionlint、Gitleaks 及精确候选 CI |
+| ENG-04 数据与权限 | 已完成 | 30 项边界测试通过，验收表/预览限制和大写 PLAN 入口在 PR #12 通过全部 CI 后合并 |
+| ENG-05 alpha 候选 | 进行中 | 统一版本 `0.1.0-alpha.1`、启动说明、许可和发布说明；完整检查、构建、浏览器、actionlint、Gitleaks 及精确候选 CI |
 | ENG-06 源码预发布 | 待 ENG-05 | 精确 main 的 push CI、release dry-run 通过后，按既有工作流创建不可变 tag 和 GitHub prerelease，核对版本/提交/说明一致 |
 
 ## 执行约束和完成边界

README.md

@@ -21,7 +21,7 @@ OpenLab is a local-first research workspace being designed to connect open resea
 
 ## Current status
 
-**The published v0.0.1 release is foundation-only.** Current development source includes a runnable local research preview; no installer is provided.
+**This source is the v0.1.0-alpha.1 research preview.** It runs locally with Node.js 24 and a browser; no installer is provided. The historical v0.0.1 release remains foundation-only. See the [changelog](CHANGELOG.md) for the preview boundary and [PLAN](PLAN.md) for delivery progress.
 
 The preview combines projects, a supervised Harness, DeepSeek-tested model configuration, Crossref metadata retrieval, plan confirmation, source-linked Markdown reports and portable research archives. See [development](docs/development.md) and the [implementation plan](docs/implementation-plan.md) for tested scope and remaining gates.
 
@@ -35,6 +35,7 @@ The preview combines projects, a supervised Harness, DeepSeek-tested model confi
 | Supervisor-Skills execution through the platform runtime adapter | Planned; not an endorsed or verified integration yet |
 | Conversation, execution state, and live artifacts workspace | React/assistant-ui with AG-UI; plan, input, denial and replay checked |
 | Source tracking, execution history, and artifact export | Immutable revisions, material copies and verified archive round trips |
+| Markdown/LaTeX document plugins | Recoverable drafts, immutable manual revisions, comparison, BusyTeX and PDF.js; portable v2 archives with v1 imports |
 
 ## Run the development preview
 
@@ -48,6 +49,8 @@ npm start
 
 Open the launch link printed in the terminal. Add and test your model provider in settings, create a project, and submit a question. Review the plan before research starts. Model planning and execution use your provider account. Windows protects credentials under the current user; saved projects remain readable without provider access. Crossref retrieval needs a network connection. Public-page reading asks for scoped access and can be unavailable; metadata alone does not verify a paper's conclusions. DeepSeek currently uses non-thinking mode.
 
+For direct metadata search, select the metadata tool without a model credential. Document editing and TeX compilation also require no model. Before first TeX use, optionally run `npm run plugins:prepare`: it downloads about 203 MB of pinned components using curl, separately from the source archive. The workspace can prepare them on demand; failed downloads retain ranges for an explicit retry. See [compiler setup and limits](docs/plugins.md#tex-compiler-and-pdf-preview). On PowerShell, use `npm.cmd` if execution policy blocks `npm.ps1`.
+
 ![Native Windows preview with a real DeepSeek/Crossref metadata research record](assets/docs/workspace-preview.png)
 
 This screenshot shows a real metadata-only task, not a full-text or scientific claim-verification result. [Verification details](docs/verification.md) distinguish live probes from synthetic browser fixtures.

README.zh-CN.md

@@ -1,6 +1,6 @@
 # OpenLab
 
-当前开发源码已提供可运行的本地科研预览，包括平台档案、通用 Harness、受监督的 worker 和浏览器工作区。已实现范围、验证结果与剩余验收项见[开发说明](docs/development.md)和[实施计划](docs/implementation-plan.md)。已发布的 v0.0.1 仍为仓库基础设施。
+当前源码为 v0.1.0-alpha.1 科研预览，包括平台档案、通用 Harness、受监督的 worker 和浏览器工作区。已实现范围、验证结果与后续任务见[开发说明](docs/development.md)和[执行计划](PLAN.md)。历史 v0.0.1 仍为仓库基础设施版。
 
 <div align="center">
 
@@ -23,7 +23,7 @@ OpenLab 致力于建立本地优先的科研工作空间，将已有的开源科
 
 ## 当前状态
 
-**已发布的 v0.0.1 仅交付仓库规范、协作流程和设计文档。** 当前开发源码已提供本地科研应用预览，尚不提供安装包。
+**当前源码为 v0.1.0-alpha.1 科研预览。** 使用 Node.js 24 和浏览器在本地运行，尚不提供安装包。历史 v0.0.1 仅交付仓库基础设施；预览边界见[变更日志](CHANGELOG.md)，交付进度见[PLAN](PLAN.md)。
 
 | 能力 | 状态 |
 | --- | --- |
@@ -35,6 +35,7 @@ OpenLab 致力于建立本地优先的科研工作空间，将已有的开源科
 | 通过平台运行时适配器执行 Supervisor-Skills | 计划集成，尚未通过执行验证 |
 | 对话、执行状态与实时研究产物工作台 | React/assistant-ui 与 AG-UI，已验证确认、回答、拒绝与重放 |
 | 来源追踪、运行历史与成果导出 | 不可变修订、附件副本与校验后的档案导入导出 |
+| Markdown/LaTeX 文档插件 | 可恢复草稿、不可变人工修订、对比、BusyTeX 与 PDF.js；v2 档案及 v1 导入兼容 |
 
 ## 运行开发预览
 
@@ -48,6 +49,8 @@ npm start
 
 打开终端输出的启动链接，在设置中添加并测试模型服务，新建项目后提交研究问题。研究工具会等待你确认计划；生成计划和执行研究会使用你的模型账户。Windows 使用当前用户保护凭据，已保存项目不依赖模型服务即可查看。Crossref 检索需要网络。公开页面读取会请求具体授权，也可能不可用；仅有元数据不能证明论文支持某个结论。当前 DeepSeek 使用非思考模式。
 
+直接元数据检索可选择工具模式，无需模型凭据。文档编辑和 TeX 编译也不调用模型。首次使用 TeX 前可先运行 `npm run plugins:prepare`，通过 curl 下载约 203 MB 固定组件；这些组件独立于源码档案。工作区也可按需准备，下载失败会保留分片供显式重试。[编译准备与限制](docs/plugins.md#tex-compiler-and-pdf-preview)有详细说明。PowerShell 若阻止 `npm.ps1`，请使用 `npm.cmd`。
+
 ![原生 Windows 上真实 DeepSeek/Crossref 元数据研究预览](assets/docs/workspace-preview.png)
 
 截图展示真实的元数据研究任务，不代表全文或科学论点已经核实。[验证记录](docs/verification.md)分别说明真实测试与合成浏览器夹具。

SECURITY.md

@@ -2,7 +2,12 @@
 
 ## Supported versions
 
-During the foundation stage, maintainers address security problems in the current `main` branch and latest published foundation release. No application runtime has shipped in v0.0.1. A version support matrix will be added before the first application release.
+Maintainers address security problems in the current `main` branch and latest published research prerelease. The v0.1.0-alpha.1 source preview targets a local Windows-first service; it is not a hosted or multi-user service. No application runtime shipped in v0.0.1.
+
+| Version line | Security scope |
+| --- | --- |
+| Current main / latest v0.1.0 alpha | Current source-preview fixes, with limitations below |
+| v0.0.1 foundation | Historical repository tooling and documentation; no application runtime |
 
 ## Report privately
 

THIRD_PARTY_NOTICES.md

@@ -38,10 +38,31 @@ These application components are not installed or bundled in the historical v0.0
 
 ## Document plugins and editor dependencies
 
+### Source-preview inventory, 2026-10-25
+
+The v0.1.0-alpha.1 candidate reuses the existing lockfile dependency graph; only the root application version changes. Direct package metadata in the installed lockfile-matched packages was checked as follows, in addition to the React/assistant-ui/AG-UI/Radix/Lucide inventory above:
+
+| Package | Installed version | Declared license |
+| --- | --- | --- |
+| `@codemirror/commands` | 6.11.1 | MIT |
+| `@codemirror/lang-markdown` | 6.5.2 | MIT |
+| `@codemirror/language` | 6.13.1 | MIT |
+| `@codemirror/legacy-modes` | 6.5.5 | MIT |
+| `@codemirror/search` | 6.7.2 | MIT |
+| `@codemirror/state` | 6.7.6 | MIT |
+| `@codemirror/view` | 6.43.15 | MIT |
+| `@lezer/highlight` | 1.2.5 | MIT |
+| `diff` | 9.0.0 | BSD-3-Clause |
+| `pdfjs-dist` | 6.4.299 | Apache-2.0 |
+
+GitHub source archives contain tracked OpenLab code and retained design/license notices. They exclude `node_modules`, `dist`, prepared BusyTeX/font components, research data, protected credentials, local `.agents`/`.codex` installations and unselected mockups. `npm ci` installs dependencies with their own license files. Preparing compiler resources downloads third-party components separately; their terms and sources below still apply. No Supervisor-Skills contents or compiler/font binaries are redistributed by this source release.
+
+### Editor and compiler provenance
+
 The default editors use CodeMirror 6 (`@codemirror/state`, `view`, `commands`, `search`, `language`, `lang-markdown`, `legacy-modes` and `@lezer/highlight`), under MIT licenses. Current upstream sources and licenses are linked from [CodeMirror](https://codemirror.net/); its repositories have moved to the maintainer's forge. OpenLab supplies a React host and a neutral theme, not a fork of the editor.
 
 Version comparison uses [jsdiff](https://github.com/kpdecker/jsdiff), BSD-3-Clause, in a bounded Worker. PDF previews use [PDF.js](https://github.com/mozilla/pdf.js), Apache-2.0; the dependency and worker are loaded only for PDF viewing. Installed versions are pinned in the npm lockfile.
 
 The default TeX adapter uses [BusyTeX](https://github.com/busytex/busytex) release `build_wasm_4499aa69fd3cf77ad86a47287d9a5193cf5ad993_7936974349_1`, source commit `4499aa69fd3cf77ad86a47287d9a5193cf5ad993`. BusyTeX's repository glue is MIT; its compiled binaries include TeX Live and other components under their respective licenses. Those binaries are downloaded into a separate runtime cache, with release/source references and checksums. They are not relicensed as OpenLab code. The pinned pipeline invokes TeX with shell escape disabled.
 
-The compiler additionally supplies [Fandol Song](https://ctan.org/tex-archive/fonts/fandol) 0.3 by the Fandol team, GPL with the font exception described in its COPYING file. Its SHA-256 is `a3820003227d4abe31fe28b493200d94a849ccfd078b50a019264f70353020b0`. Retain the upstream license/source materials when redistributing prepared compiler/font components. The plugin SDK, resource layout and scope are documented in [plugins](docs/plugins.md).
+The compiler additionally supplies [Fandol Song](https://ctan.org/tex-archive/fonts/fandol) 0.3 by the Fandol team, GPL with the font exception described in its COPYING file. Its SHA-256 is `a3820003227d4abe31fe28b493200d94a849ccfd078b50a019264f70353020b0`. Downloads use the [MIT CTAN mirror](https://ctan.csail.mit.edu/fonts/fandol/), with the same bytes and hash; TLS verification is retained. Retain the upstream license/source materials when redistributing prepared compiler/font components. The plugin SDK, resource layout and scope are documented in [plugins](docs/plugins.md).

VERSION

@@ -1 +1 @@
-0.0.1
+0.1.0-alpha.1

app/openapi.ts

@@ -47,7 +47,7 @@ for (const [path, item] of Object.entries(paths)) {
   if (parameters.length) item.parameters = parameters;
 }
 export const openapi = {
-  openapi: '3.1.0', info: { title: 'OpenLab local research API', version: '0.1.0-dev', description: 'Loopback only. Use the per-launch link to establish a local session. Mutations require Origin and x-openlab-csrf. Research records are authoritative; SSE attachment never starts work.' },
+  openapi: '3.1.0', info: { title: 'OpenLab local research API', version: '0.1.0-alpha.1', description: 'Loopback only. Use the per-launch link to establish a local session. Mutations require Origin and x-openlab-csrf. Research records are authoritative; SSE attachment never starts work.' },
   servers: [{ url: '/api/v1' }], paths,
   components: {
     securitySchemes: { LocalSession: { type: 'apiKey', in: 'cookie', name: 'openlab_session' } },