chore(release): bump to 1.0.0 — the Trust Spine release

Machine-verified findings with portable proof: verifier + receipt contract,
recipe-driven oracles, proof capsules + replay, prove-or-kill gating,
verified-only SARIF export, REST path-parameter injection, and honest verdicts.
Field-validated against live OWASP Juice Shop.

Author: 0xSteph

CHANGELOG.md

@@ -2,6 +2,30 @@
 
 All notable changes to ptai are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/), versioning follows [Semantic Versioning](https://semver.org/).
 
+## [1.0.0] - 2026-06-25
+
+The Trust Spine release. ptai now proves what it finds: a finding earns the VERIFIED badge only when a machine oracle re-runs the exploit and reproduces it N out of N times. No oracle, no badge, and no verdict from an LLM assertion.
+
+### Added
+
+- **Verifier + receipt contract.** A verified verdict must name the machine oracle that earned it, enforced in code.
+- **Recipe-driven oracles:** unescaped reflection, open redirect, IDOR/BOLA differential, error signature, MCP exposure, SQLi boolean and boolean-blind, SSTI (including error-based), sensitive data exposure, and HTTP request smuggling (CL.TE), plus an out-of-band OAST callback oracle for blind SSRF/XXE over a self-hosted loopback collaborator.
+- **Portable proof capsules and `ptai replay`**, plus multi-hop chain capsules, so a finding's proof travels and replays without trusting ptai.
+- **Prove-or-kill gating:** third-party scanner output (nuclei, nikto, zap) is held back until an oracle re-proves it.
+- **Verified-only SARIF export** (`ptai export --sarif`) with a frozen, versioned export-properties contract.
+- **REST path-parameter injection** in the SQLi/XSS/SSTI fuzzers, so injection in `/rest/products/<id>` style routes is caught, not just query parameters.
+- **Experimental CL.TE request-smuggling discovery probe**, oracle-gated.
+- **CI gate** (`--fail-on verified`) with a composite action, and a bundled `ptai demo`.
+
+### Changed
+
+- **Honest verdicts.** An oracle miss now reads as `candidate` (could not re-prove), never `refuted`; `refuted` is reserved for an oracle that can truly disprove a vulnerability.
+- **Impact-honest severity:** a bare out-of-band callback proves existence, not impact, so it is rated medium until impact is reproduced.
+
+### Verified
+
+- 100% precision with zero false positives on the honeypot benchmark, and field-validated against live OWASP Juice Shop: a real broken-object-level-authorization bug verified end to end with a replayable proof capsule.
+
 ## [0.17.2] - 2026-06-09
 
 Patch release: tool-installer fixes from user feedback on issue #12 (`lukeswitz`).

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ptai"
-version = "0.17.2"
+version = "1.0.0"
 description = "Autonomous AI pentesting with 200+ tools, exploit chaining, PoC validation, and credential-safe MCP server"
 readme = "README.md"
 license = {text = "MIT"}