chore: prepare v1.0.0-beta.1 release

[RentnerKev]

Summary

Final release gate for v1.0.0-beta.1 on the published v1.0.0-alpha.6 baseline.

Do not publish Beta 1 as part of planning or feature work. Release publication requires a
separate, explicit operation after every gate below is satisfied.

Feature disposition

• CrowdSec protection feat: integrate CrowdSec protection #64: complete or explicitly deferred with rationale
• Forward Auth access policies feat: add Forward Auth access policies #65: complete or explicitly deferred with rationale
• NPM importer feat: add Nginx Proxy Manager importer #66: complete or explicitly deferred with rationale

Compatibility and reliability gates

• Upgrade hardening fix: harden alpha-to-beta upgrade path #67 complete with supported/unsupported paths documented
• Compatibility matrix test: add release upgrade compatibility matrix #68 green
• Mandatory real-image v1.0.0-alpha.6 -> v1.0.0-beta.1 upgrade green
• Fresh Beta install green
• Long-running reliability test: add long-running runtime reliability tests #69 green
• Scale/concurrency coverage test: add proxy scale and concurrency coverage #70 green
• Backup/restore compatibility fix: harden backup and restore compatibility #71 green
• Representative rollback into fresh volumes with the prior exact image verified

Final review gates

• Final security review security: complete v1 beta security review #72 includes every shipped Beta feature and has no known P0/P1 blocker
• Alpha 3 tester feedback fix: address v1.0.0-alpha.3 tester feedback #73 completed
• Final Alpha-6/Beta UX and accessibility review fix: complete beta accessibility and UX review #74 complete
• Release notes, known limitations, upgrade, rollback, backup, and feature-freeze documentation
  reviewed
• No open P0/P1 release blocker

Exact release-candidate evidence

• Format
• Lint
• Typecheck
• Web/Bun tests
• Rust format, Clippy, tests, and build
• Workflow lint and PR-title checks
• Dependency Review
• CodeQL for JavaScript/TypeScript, Rust, and GitHub Actions
• Gitleaks and applicable dependency/container scans
• Production Smokes, including certificates and backup/restore
• real Caddy smoke for shipped CrowdSec/Forward Auth behavior
• Docker production build and fresh-appliance smoke
• all repository-required checks green on the exact final commit

Do not bypass or disable a failing check. Fix the root cause, push a clean commit, and wait for all
required checks again on the new head.

Release contract

Target tag: v1.0.0-beta.1

GitHub Release: pre-release

Immutable container tag:

ghcr.io/rentnerkev/rentnerproxy:v1.0.0-beta.1

Moving pre-release channel: beta

latest remains reserved for stable releases. Verify repository policy again immediately before
publication.

During a separately authorized release operation:

• publish from the exact reviewed and green commit
• verify release metadata, image digest, SBOM/provenance, assets, generated notes, and the moving
  beta tag
• run published-image verification
• account for the documented lack of cryptographic release signing/reproducibility guarantees

Feature freeze

Beta 1 begins stabilization. Do not add new large v1 features. Focus on bugs, compatibility,
performance, reliability, security, and tester feedback. DDNS, WireGuard, Docker Discovery,
Cloudflare Tunnel, Status Pages, a large monitoring dashboard, TCP/UDP Streams, general proxy
caching, a new proxy engine, and a generic plugin platform are outside this gate.

Acceptance criteria

• Every linked gate is complete or explicitly dispositioned with no unresolved P0/P1 blocker.
• Exact release-candidate CI, production smokes, supported upgrade/restore matrix, soak, scale,
  and fresh-install evidence are green.
• Commit history and final diff have been reviewed.
• Publication occurs only through a separately authorized release operation.
• Published image and release artifacts are verified before this issue closes.

Priority

P0 / final gate. Keep this issue open until the separately authorized Beta release and
published-image verification succeed.

[github-actions]

🔍 Similar issues found

This issue may overlap with existing reports. Please take a look at these related items.

Match	Issue	Status
Medium	#36 – chore: prepare v1.0.0-alpha.2 release	CLOSED · COMPLETED
Medium	#15 – chore: prepare v1.0.0-alpha.1 release	CLOSED · COMPLETED
Medium	#61 – chore: prepare v1.0.0-alpha.3 release	CLOSED · COMPLETED

This is an automated suggestion. This issue has not been closed automatically.