Release React Data Inspector 1.0.0

[Cylop]

Summary

• promote the read-only inspector API and public documentation to stable 1.0.0
• enforce an exact eight-file npm archive and verify ESM, CommonJS, types, CSS, examples, documentation snippets, and SSR in isolated React 18.3.1 and 19.3.0 consumers
• separate verification, OIDC publication, and deployment so the privileged publisher only accepts the previously verified artifact
• bind release metadata and SHA-512 integrity in an exact artifact manifest, with executable tamper tests
• refresh model, browser, and model-lifetime benchmark evidence

Verification

• npm ci and npm audit: 0 vulnerabilities
• npm run check: formatting, TypeScript, 87 unit/component tests, 23 release-policy tests, package/site builds, 29 routes, 24 documentation examples, and packed consumers pass
• npm run test:e2e: 111/111 Chromium, Firefox, and WebKit cases pass
• model, memory, and browser benchmarks pass; 0 of 50 discarded model roots retained
• npm run release:check -- --dry-run: registry guard, exact archive, both React consumers, and npm publish dry-run pass without publishing
• npm pack: exactly 8 files, 32,694 bytes

Qualification boundaries

Stable describes the documented API and compatibility contract. Human VoiceOver/NVDA testing, current physical mobile Safari testing, representative application dogfooding, and mounted-browser retained-heap/frame-timing qualification remain explicitly documented adopter checks.

Publication

A non-prerelease GitHub Release triggers the dedicated release workflow. It verifies the exact release commit, creates and hashes the artifact, runs all benchmark lanes, uploads only the approved artifact pair, publishes through the npm environment with OIDC/provenance and no checkout or build in the privileged job, then deploys website copy only after the exact 1.0.0 registry version is readable on latest.