chore(ci): finalize v1.7.0 release packaging

Author: eblackrps

.gitignore

@@ -12,6 +12,10 @@ coverage.out
 coverage
 .gocache/
 .gomodcache/
+.gotmp/
+.gocache-race/
+.gomodcache-race/
+.gotmp-race/
 dist/
 web/node_modules/
 web/dist/

Makefile

@@ -9,7 +9,7 @@ RM_DIST = powershell -NoProfile -Command "if (Test-Path 'dist') { Remove-Item -R
 RM_COVER = powershell -NoProfile -Command "$$paths = @('coverage','coverage.out','coverage.out;','coverage-fresh','coverage-fresh.out'); foreach ($$path in $$paths) { if (Test-Path $$path) { Remove-Item -Force $$path } }"
 BIN_TARGET = bin/viaduct.exe
 GO_RUN = powershell -NoProfile -ExecutionPolicy Bypass -File scripts/go_run_windows.ps1
-RUN_BIN = $(GO_RUN) ./cmd/viaduct
+RUN_BIN = $(GO_RUN) -Ldflags "-X main.version=$(VERSION) -X main.commit=$(COMMIT) -X main.date=$(DATE)" ./cmd/viaduct
 WEB_INSTALL = cd web && npm ci
 COVERPROFILE_ARG = "-coverprofile=coverage.out"
 COVERFUNC_ARG = "-func=coverage.out"

RELEASE.md

@@ -10,7 +10,7 @@ This document describes the stable packaging and release process for Viaduct.
 - `make plugin-check`: validate plugin manifest compatibility against the host version
 - `make contract-check`: verify the published OpenAPI reference still covers the stable operator routes
 
-On Windows, `make release-gate` still builds `bin/viaduct.exe`, but it validates the CLI smoke commands through a LocalAppData-staged `go run ./cmd/viaduct` helper because some operator workstations enforce Application Control policies that block freshly built unsigned binaries from direct execution or from `%TEMP%`.
+On Windows, `make release-gate` still builds `bin/viaduct.exe`, but it validates the CLI smoke commands through a LocalAppData-staged `go run ./cmd/viaduct` helper because some operator workstations enforce Application Control policies that block freshly built unsigned binaries from direct execution or from `%TEMP%`. The Windows test helpers stage race and coverage artifacts under repo-local cache directories so the canonical gate remains reproducible on locked-down workstations.
 
 ## Release Checklist
 1. Ensure the working tree is in the intended state and public docs are current.

docs/operations/demo/README.md

@@ -24,4 +24,4 @@ Use the files in this directory when you actually present.
 
 These assets are intentionally narrow. They support the VMware-exit assessment-to-pilot story Viaduct is currently hardening, not a broad repo tour.
 
-The current release-facing screenshots are aligned with the workspace-first operator experience introduced in v1.6.0.
+The current release-facing screenshots are aligned with the workspace-first operator experience shipped in v1.7.0.

docs/operations/demo/screenshots/pilot-bootstrap.svg

@@ -4,6 +4,7 @@ This directory contains release notes and other release-facing narrative assets
 
 ## Files
 
+- [v1.7.0 release notes](v1.7.0.md)
 - [v1.6.0 release notes](v1.6.0.md)
 
 Keep these notes aligned with:

docs/releases/README.md

@@ -0,0 +1,69 @@
+# Viaduct v1.7.0 Release Notes
+
+Published 2026-04-11.
+
+Viaduct v1.7.0 hardens the workspace-first operator flow introduced in v1.6.0. This release improves request validation, viewer permissions, persisted job recovery, dashboard credential handling, and locked-down workstation release verification without widening the product story beyond the current assessment-to-pilot wedge.
+
+## Highlights
+
+- Added stricter validation for pilot workspace create, update, job, and report export requests so invalid operator input fails early with field-level API errors.
+- Added viewer-safe read and export access while keeping workspace mutation, deletion, and background job execution operator-scoped.
+- Added persisted workspace deletion, queued-job recovery on API startup, configurable workspace job timeouts, and richer report handoff detail.
+- Switched dashboard runtime auth to session-scoped storage by default with an explicit remember option for trusted operator workstations.
+- Hardened the canonical Windows release-gate path so `make release-gate` stays reproducible on workstations that block freshly staged unsigned executables.
+
+## Operator Workflow Improvements
+
+The workspace-first operator flow is still:
+
+1. Bootstrap dashboard access with a service-account key or tenant key.
+2. Create a pilot workspace.
+3. Run discovery and persist source snapshots.
+4. Inspect workloads and dependency graph state.
+5. Run readiness simulation.
+6. Save a dry-run migration plan.
+7. Export a pilot report.
+
+What changed in this release is the reliability around that path:
+
+- invalid workspace or job payloads now fail with field-level API guidance instead of generic errors
+- workspace jobs can be retried from persisted history in the dashboard
+- queued and in-flight jobs are recovered cleanly when the API restarts
+- exported reports include richer job, approval, note, and report-history context for operator handoff
+
+## API And Security
+
+- Added `DELETE /api/v1/workspaces/{workspaceID}` for tenant-scoped workspace cleanup.
+- Added `VIADUCT_ALLOWED_ORIGINS` so the API can explicitly allow non-default dashboard origins.
+- Added `VIADUCT_WORKSPACE_JOB_TIMEOUT` so long-running workspace jobs stay bounded.
+- Tightened browser-facing API responses with explicit origin allowlisting and stronger default security headers.
+- Added an alternate-permission middleware path so viewer-safe routes can stay readable without broadening write access.
+
+## Dashboard And Auth
+
+- Runtime dashboard credentials now stay in session storage by default.
+- Trusted operators can opt into remembered local storage explicitly.
+- Authentication failures now surface a clearer recovery path, including an explicit forget-saved-key action.
+- Workspace history now shows persisted jobs, retry actions, and correlation-aware status detail.
+
+## Release Verification
+
+- `make release-gate` remains the canonical verification path.
+- The Windows helper scripts now stage test and smoke binaries under repo-local paths so release validation remains usable on Application Control-constrained workstations.
+- The default `examples/lab` flow remains the reproducible demo and evaluation path for this release.
+
+## Docs And Assets
+
+- Updated quickstart, installation, troubleshooting, configuration, lab, and workspace-flow docs for the hardened auth and workspace behavior.
+- Updated the OpenAPI contract to include the workspace delete route and current request/response behavior.
+- Refreshed the release-facing screenshot assets and current-version website/dashboard copy.
+
+Screenshot assets:
+- [Pilot bootstrap](../operations/demo/screenshots/pilot-bootstrap.svg)
+- [Pilot workspace flow](../operations/demo/screenshots/pilot-workspace-flow.svg)
+
+## Compatibility Notes
+
+- No breaking API removals were introduced in this release.
+- PostgreSQL remains the recommended non-demo backend for persistent operator state.
+- Viaduct remains evaluation-ready and is still best validated in a local lab or supervised pilot before higher-risk use.

docs/releases/v1.7.0.md

@@ -1,4 +1,6 @@
 param(
+    [string]$Ldflags = "",
+
     [Parameter(ValueFromRemainingArguments = $true)]
     [string[]]$GoRunArgs
 )
@@ -18,5 +20,12 @@ $env:TMP = $base
 $env:TEMP = $base
 
 $goBinary = (Get-Command go -ErrorAction Stop).Source
-& $goBinary run @GoRunArgs
+$goArgs = @("run")
+if ($Ldflags -ne "") {
+    $goArgs += "-ldflags"
+    $goArgs += $Ldflags
+}
+$goArgs += $GoRunArgs
+
+& $goBinary @goArgs
 exit $LASTEXITCODE