[vybe]

Summary

Brings docs/user-docs/ up to date with dev since the 10-12 review, documents the agent Settings home that landed in #3798, and adds the v1.0.0 What's New page ahead of the 1.0 cut.

v1.0.0 What's New (whats-new/v1.0.0.md)

• Covers everything since 0.9.5. The payload is counted from the dev commit 0.9.5 was cut from (6c7e3d2); releases land on main as squash merges, so tag ancestry does not bound it.
• Improvements: one Inbox for every decision, skills that wait for approval, Projects, roles and business metrics, the Settings home, limits on what agents may change or reach, git sync that pulls, A2A across instances, AWS and Vultr installs.
• Fixes, Security & Hardening, Upgrade Notes and Known Limitations. The last two come from the v1.0.0 freeze plan, checked against live issue state; limitations already fixed on dev are left out.
• The freeze plan says the new default limits are set in "Settings → Ops". No such tab exists, so the page points at PUT /api/settings/ops/config.
• The release date reads 2026-10. Set the day at the cut.
• No screenshots. The 1.0 images under docs/screenshots/ show real working data, so they were not reused (see below).

Agent Settings home (#3798)

The rail of six panes, Find a setting, the restart banner, ?section=, and the legacy ?tab= aliases. Every page that named the retired Info, Credentials, Access or Folders tab now points at the right pane.

Changes on dev since 10-12

• Files: who may read, write and delete each kind of file, with the refusal codes.
• Agent keys and skills: agent-key reach on fleet-wide routes; peer skill grants; role-based skill approvers.
• Approvals and Workspace: the approval card, withdrawn asks, Inbox sorting, rail and composer changes, the project page and Steward card.
• A2A: inbound calls need a credential; AAuth agent identity, off by default, with its AAUTH_* env rows.
• Sign-in and integrations: sign-in with no email provider, https URLs behind a proxy, public-link expiry, Telegram chunking, chat_with_agent receipts, agent-dev 1.22.3.

Corrections to existing text

• The MCP tool count was 160; the code registers 168, and the projects module has 13 tools, not 11.
• Schedule webhook URLs come from the request host, not PUBLIC_CHAT_URL.
• Telegram and WhatsApp webhooks read only the Public URL setting, not the env var.

FAQ

632 → 658 questions. The index was regenerated from page headings; dev's index said 630 and had drifted.

Checks

• Relative links and anchors across docs/user-docs/: 0 problems.
• enterprise-docs-guard pattern over docs/user-docs/: clean.
• No issue numbers or codenames in faq/ or whats-new/v1.0.0.md.
• Deploy-guide public-safety greps: clean. Added lines carry no keys, real emails or IPs.

Follow-up outside this PR

Five of the seven 1.0 README screenshots in docs/screenshots/ show real working data: an AWS Marketplace pricing and monetization discussion, a line naming the enterprise-module seam, a named company in a sidebar row, a personal name and tracker references. That conflicts with the public-repo rules in CLAUDE.md. They should be recaptured with demo data.

🤖 Generated with Claude Code

[trinity-ability]

Validated via /validate-pr: Lane A docs-only, security greps + enterprise-docs guard clean, Tier 1 green, dev-ci green.