diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
index d77725e..f97e9c3 100644
--- a/.claude-plugin/marketplace.json
+++ b/.claude-plugin/marketplace.json
@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "Torque Loop — a single-plugin marketplace.",
-    "version": "0.9.0"
+    "version": "1.0.0"
   },
   "plugins": [
     {
       "name": "ratchet",
       "source": "./",
       "description": "Torque Loop: turns ambiguous work into shipped artifacts through target locking, adversarial validation, patching, and state serialization, plus a bounded /ratchet:evolve loop.",
-      "version": "0.9.0",
+      "version": "1.0.0",
       "author": {
         "name": "Danny Gillespie"
       },
diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
index 69ce86a..a3608bc 100644
--- a/.claude-plugin/plugin.json
+++ b/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "ratchet",
   "displayName": "Torque Loop",
-  "version": "0.9.0",
+  "version": "1.0.0",
   "description": "Torque Loop turns ambiguous work into shipped artifacts through target locking, adversarial validation, patching, and state serialization — plus a bounded /ratchet:evolve loop. A stateful advancement engine, not a prompt library. Not affiliated with Anthropic.",
   "author": {
     "name": "Danny Gillespie"
diff --git a/.codex-plugin/plugin.json b/.codex-plugin/plugin.json
index c3ec3e0..cf09afb 100644
--- a/.codex-plugin/plugin.json
+++ b/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "torque-loop",
-  "version": "0.9.0",
+  "version": "1.0.0",
   "description": "Torque Loop evolves ambiguous work into shipped, tested, serialized artifacts through evidence-gated loops.",
   "author": {
     "name": "Danny Gillespie",
diff --git a/CHANGELOG.md b/CHANGELOG.md
index be74d51..08148b0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.0.0] - 2026-07-30 — Boundary Gate
+
+0.2 gated proof; 0.3 the seam; 0.6 the fog; 0.7 the probe; 0.8 closure; 0.9 the write.
+Every one of those governed what the loop may *keep* — and every one quietly assumed the
+record was only ever read from inside the process that held it. 1.0 opens the record to
+anything that speaks MCP, and that changes the question from *what may be kept* to *who may
+reach in*. A pathname cannot answer it: the filesystem decides what a path means, a symlink
+re-points a component, `..` means the parent of where you actually arrived, and the object a
+name referred to can be exchanged between the check and the read. So nothing crosses as a
+name. A client names a path exactly once, to `workspace.open`, and gets back a capability
+bound to one connection and one filesystem object — re-verified on every use, refused the
+moment something else answers to that name. 1.0 gates the boundary:
+**no handle → no read.**
+
+The surface it opens is deliberately narrow: one tool, three read-only resources, and two
+real clients proven against it — Codex 0.142.5 on legacy `2025-06-18`, Claude Code on modern
+`2026-07-28`. What it does not yet do is write. Four limits are named rather than implied:
+verify-on-use narrows the validation-to-read race but does not close it (Node exposes no
+`openat`, and inode reuse can alias a deleted object); Torque state is keyed by a slug of the
+canonical root pathname, so two repositories occupying one path over time share one record;
+Codex registration stays explicit because a bundled config has nothing correct to put in it;
+and `Connected` proves a handshake, not which era a given client negotiated.
+
 ### Changed
 
 - **README restructured so value precedes setup, and the MCP server is no longer invisible.**
@@ -1297,7 +1320,8 @@ Initial public release.
 - Single-plugin marketplace manifest so the repo installs directly as a Claude Code plugin.
 - Zero-dependency smoke test suites for the state engine and the evolution helpers.
 
-[Unreleased]: https://github.com/Megaprompting/torque-loop/compare/v0.9.0...HEAD
+[Unreleased]: https://github.com/Megaprompting/torque-loop/compare/v1.0.0...HEAD
+[1.0.0]: https://github.com/Megaprompting/torque-loop/compare/v0.9.0...v1.0.0
 [0.9.0]: https://github.com/Megaprompting/torque-loop/compare/v0.8.0...v0.9.0
 [0.8.0]: https://github.com/Megaprompting/torque-loop/compare/v0.7.0...v0.8.0
 [0.7.0]: https://github.com/Megaprompting/torque-loop/compare/v0.6.0...v0.7.0
diff --git a/README.md b/README.md
index e3c4323..5ed1613 100644
--- a/README.md
+++ b/README.md
@@ -493,7 +493,7 @@ node bin/ratchet --help
 Verify:
 
 ```bash
-ratchet --version      # -> ratchet 0.9.0
+ratchet --version      # -> ratchet 1.0.0
 ratchet init
 ratchet status
 ```
diff --git a/package.json b/package.json
index 8691c20..7703475 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@torque-loop/plugin",
-  "version": "0.9.0",
+  "version": "1.0.0",
   "description": "Torque Loop — a Claude Code and Codex plugin that evolves ambiguity into shipped, tested, serialized artifacts through evidence-gated loops.",
   "license": "MIT",
   "author": "Danny Gillespie",