1.0.0

The version, the changelog entry, the plan and the README. Nothing else,
which is what makes this readable as a release rather than as work.

CHANGELOG.md's 1.0.0 entry is assembled from every version below it, as
that file has said it would be since it was written: those shipped as a
running deployment rather than as releases, and this is what they add up
to. It is also what an administrator reads -- /admin/updates takes release
notes out of the annotated tag, so the tag message is this entry.

It says what arrived, then the part worth reading: the nine things that
had shipped looking correct and were found by five audit passes. Then
where the edges are, because a first release should say what it does not
do before somebody finds out.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -16,6 +16,99 @@ for 1.0.0 have something to be assembled from.
 
 ## Unreleased
 
+## 1.0.0
+
+The first release. Every version before it shipped as a running deployment
+rather than as a release; this is what those add up to, and the point at which
+it is worth somebody else installing.
+
+**What it is.** A self-hosted web interface for OpenAI-compatible endpoints.
+Server-rendered, no build step, no CDN, one SQLite file. Point it at whatever
+you run — llama.cpp, LM Studio, vLLM, Ollama, OpenRouter, OpenAI — and it works
+the same.
+
+### What arrived since 0.8.1
+
+- **Things that happen because time passed.** Say "every Monday at nine" and a
+  model sets it up itself, against the same recurrence rule the manual form
+  uses. A run can file a **report** you read later, send you a message, or work
+  in a chat of its own.
+- **News that finds you.** A dot in the sidebar, a count in the tab title while
+  you are looking elsewhere, and **web push** so a schedule firing at seven in
+  the morning reaches a browser that is shut. Opt-in per device, and the one
+  thing here that contacts an outside service — `services/push.py` says so
+  plainly and says what it costs.
+- **Helpers.** A reply can hand a self-contained piece of work to another model
+  that runs on its own and reports back, several at once. A helper cannot ask
+  questions, cannot send helpers of its own, changes nothing unless asked, and
+  on a machine runs only a fixed list of read-only commands.
+- **Drawing.** Point it at a ComfyUI and a model can make images, against
+  workflow templates and defaults you set — size, steps, sampler, scheduler,
+  checkpoint. It reviews its own result and can try again.
+- **Semantic search.** Pick an embedding model and library search fuses keyword
+  and meaning, so *"how do I get paid"* finds a document that says *"invoicing"*.
+  Choosing none is not a degraded mode: it is byte-for-byte the keyword search
+  that was always there, with nothing written and no requests made.
+- **Quotas and sharing.** Monthly tokens, concurrent replies, agent wall clock,
+  images a day, helpers a reply — resolved by maximum across a person's groups,
+  with zero meaning *no limit*. Documents, notes, skills and reports can be
+  handed to a group or a person, read-only, with a *Shared with me* filter
+  everywhere. And a screen that answers **"what can this account actually do?"**
+  by naming where each permission came from.
+- **Make it yours.** Name, tagline, logo, favicon and launcher icons; the
+  Middle-earth wording is editable data; custom themes defined as a set of
+  colours rather than a stylesheet.
+- **Install it and update it.** A Dockerfile, a Proxmox container script, and an
+  `/admin/updates` page showing what is running, what is available and what
+  changed between. The button that applies an update is opt-in and cannot do the
+  work itself — it writes a file that a systemd unit picks up, because a web
+  application that can restart its own service is one whose worst day is much
+  worse.
+
+### The part worth reading
+
+Five audit passes went into this release rather than one, and they found things
+that had shipped looking correct. These are the entries somebody stops working
+around a bug because of:
+
+- **Every model was told the time in a zone with no name** — on any account that
+  had not chosen one, which is every account by default.
+- **A helper could write files and run programs on a remote machine,
+  unattended, in a mode that promises to change nothing.** `find` was on the
+  read-only command list, and `find -fprintf` writes a file.
+- **Two ways to get root out of the update helper**, one of which needed no
+  compromise at all: root ran a script the unprivileged service account owns,
+  and an update fetches that script as that account.
+- **Deleting a chat left every file it held on disk** — attachments, generated
+  images, all of it, with nothing that would ever look at them again.
+- **Folder nesting was fully built, documented in the README, and reachable by
+  nothing.** So was moving a chat into a folder.
+- **The terminal silently stopped accepting input after a reconnect**, while
+  output kept arriving so the panel looked healthy.
+- **On the Messages screen, half the keyboard shortcuts did nothing**, because
+  two scripts were loaded twice and each toggle ran twice.
+- **The prompt preview could not show two thirds of what it previews.**
+- **Hints and timestamps failed the contrast minimum in both themes.**
+
+### Where the edges are
+
+Stated because they are the things worth knowing before you rely on it:
+
+- **Nothing executes on the machine LLeMbas runs on.** Agent chats run their
+  commands over SSH on a host you choose, and the security of an agent chat is
+  the security of that host. There is no sandbox here and that is deliberate —
+  `PLAN.md` records the one that was designed and dropped, and why.
+- **One worker.** The generation registry, the terminal sessions and the
+  schedule ticker are all in-process. Two workers means two tickers and every
+  schedule firing twice.
+- **A restart abandons replies in flight**, keeping whatever each had.
+- **Schema changes are additive.** New tables and columns apply themselves at
+  startup; renames and drops are manual. The upgrade path is tested from an
+  0.8.1-shaped database with rows in it.
+- **Sharing grants reading only.**
+
+2283 tests on Python 3.11, 3.12 and 3.14.
+
 ## 0.9.13
 
 **The testing pass.** 2140 tests became 2283, and writing them found four bugs