release: cut v0.1.0-alpha.1 (first public alpha)

[EricAndrechek]

Problem

Tracking issue for cutting v0.1.0-alpha.1 — the first public release.

Today:

• No git tags (git tag -l returns only _observability_2_pre_rebase)
• No GitHub releases
• No alpha milestone
• release.yml + goreleaser are fully wired but have never fired in production

Preconditions (must land before tag)

• feat(cache): implement per-table tagging and raw SQL bypass #119 cache invalidation merged (read-your-writes correctness; closes perf(cache): query cache returns stale data after writes (read-your-writes) #73/feat(ingest): implement per-table cache invalidation on Bento batch flush #85/feat(api): bypass cache for raw admin SQL queries #93)
• feat(auth): RequireRoles middleware — fail closed, no permissive fallback #145 RequireRoles fail-closed shipped (RBAC enforcement actually exists; README claims it)
• feat(observability): direct-to-cloud OTLP (#97) #136 direct-to-cloud OTLP merged (closes feat(observability): direct-to-cloud OTLP — TLS + auth headers (no sidecar) #97)
• feat(deploy): local dev o11y stack (#121) #137 local SigNoz dev stack merged (closes feat(observability): o11y dev-stack cleanup + wire into make #121)
• feat(docs): rebuild site with wavehouse logo and design tokens #142 docs redesign merged with the quickstart curl path bug fixed (/v1/events → /v1/ingest/events)
• deploy-docs.yml shipping wavehouse.dev (tracked in the docs-deploy issue)
• bug: TRUNCATE via /v1/query returns HTTP 500 #118 TRUNCATE 500 fixed
• feat(api): align health endpoints with K8s convention (/healthz, /readyz + per-dependency sub-endpoints) #144 /healthz//readyz aliases registered (breaking-change is cheaper pre-alpha than post-)
• Branding regen: apple-touch-icon.png + og.png reflect the new mark (follow-up from feat(docs): rebuild site with wavehouse logo and design tokens #142)
• document docs(deploy): JetStream SyncAlways=true durability vs throughput on commodity storage #84
• document policies, pipes, config, etc thouroughly w/ detailed comprehensive annotated examples
• Setup CodeRabbit (or similar) + CodeCov
• Migrate back to github actions runners (free for OSS/public)
• Make GitHub repo public (last thing) and set OG image

Launch-blocking issues (dogfooding triage, 2026-06-04)

Surfaced from the WaveHouse-Stats (WAVEHOUSE-FEEDBACK.md) + nas-observability (WHissues.md) dogfooding passes and Eric's notes; all validated by code-read against 0f8826c. Full triage + post-launch breakdown is in the pinned comment below. These gate the flip / first alpha:

P0 — must fix before the public flip:

• [security] structured-query column allowlist not enforced on every column reference (omit/*, group_by, order_by, filters) #223 — [security] structured-query column allowlist bypassed by SELECT * (fail-open data exposure; the live demo returned columns denied to the public role)

P1 — for the first alpha:

• Policy filter/check: _in accepted but never enforced; check honors only _eq #224 — policy _in accepted but never enforced (filter-side fail-open; cheap Validate() guard is the pre-launch piece)
• bug(query): time_range since/until emits RFC3339 (T…Z) that DateTime64 columns reject #238 — time_range emits RFC3339 that DateTime64 columns reject (the demo's own "last 24h" queries 500)
• Warn/metric (or strict mode) when dedupe is enabled but a row has no id_field #219 — warn/metric when dedupe is enabled but a row has no id_field
• docs(deploy): JetStream SyncAlways=true durability vs throughput on commodity storage #84 — document JetStream durability (also a precondition above)
• feat(observability): direct-to-cloud OTLP — TLS + auth headers (no sidecar) #97 — direct-to-cloud OTLP (also a precondition above; PR feat(observability): direct-to-cloud OTLP with TLS + auth headers #218)

Quick polish wins (visible on the public demo):

• SSE: emit periodic keepalive heartbeats so idle streams survive proxy timeouts #226 — SSE keepalive heartbeat (idle streams reset ~2 min through Cloudflare; reproduced live)

⚠️ Disclosure: #223 describes a live data-exposure bug and is only private while the repo is. Fix + close it (or convert to a GitHub Security Advisory) before the public flip — don't flip with an open issue spelling out the vuln.

Release verification (after tag)

• goreleaser produces all GOOS/GOARCH binaries from the matrix.
• GHCR image ghcr.io/wave-rf/wavehouse:v0.1.0-alpha.1 pulls and runs (docker run … wavehouse health exits 0).
• go install github.com/Wave-RF/WaveHouse/cmd/wavehouse@v0.1.0-alpha.1 works on a clean machine.
• docker compose -f deployments/compose/standalone.yaml up -d against the released image runs the full quickstart from docs/getting-started.md successfully.
• Release notes match the [Unreleased] CHANGELOG.md section and cross-check against actually-shipped features.
• Confirm npm module/package ships + works
• Confirm go get works for binary running

Announcement

• Draft for HN / X / any community channels prepared.
• SECURITY.md is linked from the README before broadcast.
• Public triage/support policy in place (tracked separately).

[jfwoods]

Will also want to add docs source to context7 registry -- allows AI coding tools to pull most recent documentation and/or release-based documentation. Just need to fill out this form and add a context7.json to the repo. https://context7.com/docs/adding-libraries