Shaan-alpha · Shaan-alpha · May 28, 2026 · May 28, 2026 · May 28, 2026 · May 28, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -8,6 +8,20 @@ Every version listed here must correspond to a slice in [`PLAN.md`](./PLAN.md) w
 
 ---
 
+## [1.0.0] — 2026-05-29
+
+First stable release. Caps the v0.9.x beta-hardening line with launch polish.
+
+### Added
+- **Rich link previews for the homepage.** Sharing the site now renders a branded Open Graph / Twitter card (image, title, description).
+- **The search box is focused on arrival** (desktop), so you can type a username immediately.
+- **Analyze another profile without leaving a report** — a search box now lives on the report page.
+
+### Changed
+- Removed unused starter assets.
+
+---
+
 ## [0.9.8] — 2026-05-29
 
 ### Added

diff --git a/PLAN.md b/PLAN.md
@@ -47,7 +47,7 @@
 | **v0.9.6** | Load-test harness (warm /analyze; full 100 RPS run = operator step) | ✅ shipped |
 | **v0.9.7** | Privacy policy + terms + global footer | ✅ shipped |
 | **v0.9.8** | Launch landing sections (examples + how-it-works + star CTA) | ✅ shipped |
-| **v1.0.0** | Public launch | pending |
+| **v1.0.0** | First stable release (launch polish) — public-launch ops in docs/LAUNCH.md | ✅ shipped |
 
 ---
 
@@ -723,21 +723,19 @@ The narrative-mode CHECK constraint was a third drift in the same family — the
 
 ---
 
-## v1.0.0 — Public launch
+## v1.0.0 — First stable release (shipped 2026-05-29)
 
-**Goal:** Ship it.
+**Goal:** Cap the v0.9.x beta-hardening line as the first stable (1.0) release, with launch-readiness polish. The *public launch itself* (domain, posts, traffic) is operator-run, not a code milestone — tracked in [`docs/LAUNCH.md`](./docs/LAUNCH.md).
 
-**Slice scope:**
-- Production domain + SSL
-- Launch post (HN, X, LinkedIn, Reddit r/programming)
-- Marketing landing variant with social proof / testimonials
-- Public roadmap moved to GitHub Issues / Projects
+**Delivered (launch polish):** homepage Open Graph / Twitter link-preview cards (`app/opengraph-image.tsx` + `metadataBase`/`openGraph`/`twitter` in `layout.tsx`); desktop autofocus on the landing search (prop-gated so the results-page instance doesn't steal focus); an inline "analyze another" search on the report page (reuses `SearchBar`); removed unused Next starter svgs. The marketing landing sections shipped earlier in v0.9.8.
 
-**Exit criteria:**
-- [ ] Production traffic stable for 72 hours
-- [ ] On-call rotation documented
-- [ ] Post-launch retro in `docs/PROGRESS_LOG.md`
-- [ ] `CHANGELOG.md` bumped to `1.0.0`
+**Design spec / plan:** none — scope was locked directly with the user (the four polish items), implemented inline at the user's "make it v1.0.0 then ship it" direction.
+
+**Exit criteria (code release):**
+- [x] Launch-polish items implemented; frontend lint/tsc/test/build clean (58 vitest); backend 290.
+- [x] Version bumped to `1.0.0` across literals; CHANGELOG `[1.0.0]`; tag + release.
+
+**Public-launch ops (operator-run, see `docs/LAUNCH.md`):** production domain + SSL, launch posts (HN/X/Reddit/LinkedIn), 72h traffic watch, on-call notes, post-launch retro. Pre-launch reminders still open: professional legal review of `/privacy` + `/terms`; run the full 100 RPS load test.
 
 ---
 

diff --git a/README.md b/README.md
@@ -43,7 +43,7 @@ Engineering insight first. AI flavor second. Scoring is deterministic and explai
 
 ## Status
 
-Pre-alpha. Latest shipped release is **v0.9.8** (launch landing sections — example reports, a "how it works" methodology section, and a GitHub-star CTA). v0.9.7 before it added a Privacy Policy and Terms of Service, linked from a new site-wide footer; v0.9.6 added a reusable load-test harness for the warm `/analyze` path (full 100 RPS run is an operator step); v0.9.5 ran a full pre-launch security audit — no high/critical findings — tightening the GitHub OAuth scope to read-only and adding HTTP security headers; v0.9.4 made the DB connection pool size env-tunable and genuinely fixed the back-nav search spinner; v0.9.3 added deletable `/me` history with undo, a golden "creator" scorecard for the project's creator account, and a first (incomplete) attempt at the back-nav spinner fix. Live at https://skill-issue-tau.vercel.app — GitHub OAuth sign-in, Neon Postgres persistence, `/me` history, opt-in `/share/[slug]` public links. The AI narrative layer (Roast + Mentor) runs on **Groq** (`llama-3.3-70b-versatile`). v0.7.0 added Upstash Redis caching (warm `/analyze` ≤ 200 ms); v0.7.2 prod-certified the perf budget (CLS 0.080 → **0** structurally, perf 90 → 94, LCP 2,804 → 2,773 ms); v0.8.0 shipped Sentry (FE+BE), PostHog (events + web vitals), structlog JSON logging, on-voice 404, and a full axe a11y pass; v0.8.1 ships the nightly cron with bearer auth; v0.8.2 pairs it with the manual force-refresh button on `/me`; v0.8.3 hotfixes the empty-repo crash; v0.8.4 fixes the silent narrative misattribution; v0.8.5 closes the post-deploy-Sentry loop with a pre-merge CI gate; v0.8.6 closes v0.7.1's deferred share-page caching; v0.8.7 modernizes project config; v0.9.0 opens Beta hardening with bounded GH fan-out; v0.9.1 closes the /me N+1 + adds per-namespace Report cache versioning; v0.9.2 adds rate limiting (per-IP for anonymous, higher per-user caps for signed-in) on `/analyze` and `/narrative`; v0.9.3 adds deletable `/me` history with undo, attempts the back-nav search-spinner fix, and gilds the creator's scorecard. v0.9.4 makes the DB connection pool size env-tunable (defaults unchanged — RUM showed no pool exhaustion) and lands the real back-nav spinner fix (the v0.9.3 attempt addressed the wrong mechanism); v0.9.5 runs a full pre-launch security audit (no high/critical findings), tightens the OAuth scope to `read:user`, and adds HTTP security headers; v0.9.6 adds a reusable load-test harness for the warm `/analyze` path (the full 100 RPS run is an operator step); v0.9.7 adds a Privacy Policy and Terms of Service, linked from a new global footer; v0.9.8 adds launch landing sections (example reports, a how-it-works section, a GitHub-star CTA). **v1.0.0 — public launch** is next. See [`CHANGELOG.md`](./CHANGELOG.md) for shipped slices, [`PLAN.md`](./PLAN.md) for the full roadmap, and [`docs/PROGRESS_LOG.md`](./docs/PROGRESS_LOG.md) for the most recent session handoff.
+Now at **v1.0.0** — the first stable release (homepage link-preview cards, an autofocused search, an inline "analyze another" search on reports, and repo cleanup). v0.9.8 before it added launch landing sections — example reports, a "how it works" methodology section, and a GitHub-star CTA; v0.9.7 added a Privacy Policy and Terms of Service, linked from a new site-wide footer; v0.9.6 added a reusable load-test harness for the warm `/analyze` path (full 100 RPS run is an operator step); v0.9.5 ran a full pre-launch security audit — no high/critical findings — tightening the GitHub OAuth scope to read-only and adding HTTP security headers; v0.9.4 made the DB connection pool size env-tunable and genuinely fixed the back-nav search spinner; v0.9.3 added deletable `/me` history with undo, a golden "creator" scorecard for the project's creator account, and a first (incomplete) attempt at the back-nav spinner fix. Live at https://skill-issue-tau.vercel.app — GitHub OAuth sign-in, Neon Postgres persistence, `/me` history, opt-in `/share/[slug]` public links. The AI narrative layer (Roast + Mentor) runs on **Groq** (`llama-3.3-70b-versatile`). v0.7.0 added Upstash Redis caching (warm `/analyze` ≤ 200 ms); v0.7.2 prod-certified the perf budget (CLS 0.080 → **0** structurally, perf 90 → 94, LCP 2,804 → 2,773 ms); v0.8.0 shipped Sentry (FE+BE), PostHog (events + web vitals), structlog JSON logging, on-voice 404, and a full axe a11y pass; v0.8.1 ships the nightly cron with bearer auth; v0.8.2 pairs it with the manual force-refresh button on `/me`; v0.8.3 hotfixes the empty-repo crash; v0.8.4 fixes the silent narrative misattribution; v0.8.5 closes the post-deploy-Sentry loop with a pre-merge CI gate; v0.8.6 closes v0.7.1's deferred share-page caching; v0.8.7 modernizes project config; v0.9.0 opens Beta hardening with bounded GH fan-out; v0.9.1 closes the /me N+1 + adds per-namespace Report cache versioning; v0.9.2 adds rate limiting (per-IP for anonymous, higher per-user caps for signed-in) on `/analyze` and `/narrative`; v0.9.3 adds deletable `/me` history with undo, attempts the back-nav search-spinner fix, and gilds the creator's scorecard. v0.9.4 makes the DB connection pool size env-tunable (defaults unchanged — RUM showed no pool exhaustion) and lands the real back-nav spinner fix (the v0.9.3 attempt addressed the wrong mechanism); v0.9.5 runs a full pre-launch security audit (no high/critical findings), tightens the OAuth scope to `read:user`, and adds HTTP security headers; v0.9.6 adds a reusable load-test harness for the warm `/analyze` path (the full 100 RPS run is an operator step); v0.9.7 adds a Privacy Policy and Terms of Service, linked from a new global footer; v0.9.8 adds launch landing sections (example reports, a how-it-works section, a GitHub-star CTA); **v1.0.0 is the first stable release** (homepage Open Graph previews, autofocused + inline search, repo cleanup). Public launch — domain, posts, traffic watch — is tracked in [`docs/LAUNCH.md`](./docs/LAUNCH.md). See [`CHANGELOG.md`](./CHANGELOG.md) for shipped slices, [`PLAN.md`](./PLAN.md) for the full roadmap, and [`docs/PROGRESS_LOG.md`](./docs/PROGRESS_LOG.md) for the most recent session handoff.
 
 ---
 
@@ -76,7 +76,7 @@ cp .env.example .env        # then edit .env and add your GITHUB_TOKEN and OPENA
 uv run uvicorn app.main:app --reload --port 8000
 ```
 
-Verify: `curl http://localhost:8000/health` → `{"status":"ok","version":"0.9.8","db":"up"|"down","cache":"up"|"down"|"unconfigured"}`. The `db` field reports DB reachability when `DATABASE_URL` is configured; the `cache` field reports Upstash reachability (`unconfigured` when `UPSTASH_REDIS_REST_URL` isn't set — perfectly fine for local dev, the in-process fallback covers it).
+Verify: `curl http://localhost:8000/health` → `{"status":"ok","version":"1.0.0","db":"up"|"down","cache":"up"|"down"|"unconfigured"}`. The `db` field reports DB reachability when `DATABASE_URL` is configured; the `cache` field reports Upstash reachability (`unconfigured` when `UPSTASH_REDIS_REST_URL` isn't set — perfectly fine for local dev, the in-process fallback covers it).
 Hit the analyzer: `curl http://localhost:8000/analyze/octocat`.
 
 ### Frontend (`:3000`)

diff --git a/backend/app/settings.py b/backend/app/settings.py
@@ -2,7 +2,7 @@
 
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
-VERSION = "0.9.8"
+VERSION = "1.0.0"
 
 
 class Settings(BaseSettings):

diff --git a/backend/pyproject.toml b/backend/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "skill-issue-backend"
-version = "0.9.8"
+version = "1.0.0"
 description = "Skill Issue backend — FastAPI service that ingests a GitHub profile and returns a deterministic engineering report."
 readme = "README.md"
 authors = [

diff --git a/backend/uv.lock b/backend/uv.lock
diff --git a/docs/PROGRESS_LOG.md b/docs/PROGRESS_LOG.md
@@ -19,6 +19,33 @@ Format:
 
 ---
 
+## 2026-05-29 — Claude (Opus 4.7) — v1.0.0 shipped (first stable release + launch polish)
+
+**Slice:** v1.0.0 — the 1.0 code release. Per the user: v1.0.0 = the stable release + launch polish; the *public launch* (marketing, domain, posts, traffic) they run themselves (see `docs/LAUNCH.md`). They picked four polish items, then "make it v1.0.0 then ship it."
+
+**Done (four user-chosen polish items):**
+- **Homepage link previews** — `app/opengraph-image.tsx` (branded next/og card, Inter fonts) + `app/twitter-image.tsx` re-export + `metadataBase`/`openGraph`/`twitter` in `layout.tsx`. Sharing the site root now renders a rich card. (Was a real gap — layout had no OG metadata.)
+- **Autofocus the landing search** (desktop) — `SearchBar` gained an `autoFocus` prop; effect focuses the input via a scoped form query, guarded by `matchMedia("(pointer: fine)")` so mobile keyboards don't pop. Prop-gated so the new results-page `SearchBar` never steals focus. `page.tsx` passes `<SearchBar autoFocus />`.
+- **Inline "analyze another" on the report page** — `results-view.tsx` renders `<SearchBar />` in a row after the header (reuses the working component → inherits validation + the v0.9.4 back-nav fix).
+- **Removed unused Next starter svgs** from `public/`.
+- Version bump 0.9.8 → 1.0.0 + docs ritual (CHANGELOG `[1.0.0]`, PLAN, README de-"pre-alpha"'d).
+
+**Decisions:**
+- **`Input` (base-ui) doesn't forward a ref**, so autofocus uses a scoped `formRef.current.querySelector("input")` rather than a ref on the Input. Desktop-gated + prop-gated to avoid mobile-keyboard pop and cross-instance focus theft.
+- **Reused `SearchBar` for the inline results search** (DRY; inherits validation + the useTransition back-nav fix) rather than a new compact variant — keeps surface area small right at 1.0.
+- **OG image via next/og** mirroring the existing `/u` opengraph-image conventions (Inter fonts from `public/fonts`, 1200×630). Static branded card (no per-request data).
+- **v1.0.0 is the code release, not the launch.** Launch ops are operator-run (`docs/LAUNCH.md`); PLAN/CHANGELOG framed accordingly so we don't claim 72h-traffic/on-call/retro as done. No spec/plan docs — scope locked directly with the user.
+
+**Verified:**
+- Frontend `lint` + `tsc` clean; vitest 58 passed; `next build` clean — `/opengraph-image` + `/twitter-image` routes generate. Backend untouched (290 pass).
+- Visual behavior (autofocus, OG card appearance, inline-search layout, mobile): operator's eyeball check on prod — build/tests cover structure only.
+
+**Blocked / open:** none for the 1.0 code release. Public launch is operator-run; pre-launch reminders open: legal review, full 100 RPS load test.
+
+**Next:** public launch (operator, per `docs/LAUNCH.md`); post-launch retro back here. Beyond v1.0: GitLab / LinkedIn / Resume checkers (PLAN "Beyond v1.0").
+
+---
+
 ## 2026-05-29 — Claude (Opus 4.7) — v0.9.8 shipped (launch landing sections)
 
 **Slice:** v0.9.8 — below-the-fold launch sections beneath the hero. First v1.0.0-prep piece (the user picked "marketing landing variant"); the launch itself stays human-gated as v1.0.0.

diff --git a/frontend/package.json b/frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "frontend",
-  "version": "0.9.8",
+  "version": "1.0.0",
   "private": true,
   "scripts": {
     "dev": "next dev",

diff --git a/frontend/public/file.svg b/frontend/public/file.svg
diff --git a/frontend/public/globe.svg b/frontend/public/globe.svg
diff --git a/frontend/public/next.svg b/frontend/public/next.svg
diff --git a/frontend/public/vercel.svg b/frontend/public/vercel.svg
diff --git a/frontend/public/window.svg b/frontend/public/window.svg
diff --git a/frontend/src/app/layout.tsx b/frontend/src/app/layout.tsx
@@ -16,10 +16,25 @@ const geistMono = Geist_Mono({
   subsets: ["latin"],
 });
 
+const SITE_DESCRIPTION =
+  "Deterministic, evidence-based engineering reports from any GitHub profile. Six signals, one hundred points, zero hallucinations.";
+
 export const metadata: Metadata = {
+  metadataBase: new URL("https://skill-issue-tau.vercel.app"),
   title: "Skill Issue — your GitHub, read honestly",
-  description:
-    "Deterministic, evidence-based engineering reports from any GitHub profile. Six signals, one hundred points, zero hallucinations.",
+  description: SITE_DESCRIPTION,
+  openGraph: {
+    title: "Skill Issue — your GitHub, read honestly",
+    description: SITE_DESCRIPTION,
+    url: "/",
+    siteName: "Skill Issue",
+    type: "website",
+  },
+  twitter: {
+    card: "summary_large_image",
+    title: "Skill Issue — your GitHub, read honestly",
+    description: SITE_DESCRIPTION,
+  },
 };
 
 export const viewport: Viewport = {