META: v1.0.0 release readiness — gates + what's left

[MartinCastroAlvarez]

Are we ready for v1.0.0? — No, not yet. We're at 0.2.0a4 (alpha). This meta-issue is the single source of truth for what's left to cut 1.0.0, gated by ACCEPTANCE.md §5 (every applicable §2/§3/§4 criterion ✅ + quality gates + repo-owner go-ahead). Below: what's done, what's left, who owns it.

Where we are

• ✅ PyPI: 0.2.0a4 live; GitHub Releases aligned; main matches.
• ✅ Security: CodeQL 0, Dependabot 0, secret scanning + push protection on, threat model current.
• ✅ Backend: full CRUD + list_filter, date_hierarchy, autocomplete, actions, bulk, M2M, OpenAPI schema, inlines read+write, file fields, login/logout, get_app_list, history, delete-preview, save_options, PWA manifest+SW.
• ✅ Repo public.

What's left for v1.0.0

A. Frontend parity — "delete admin.site.urls and lose zero workflows" (#160)

Most deprecation-blocking rows have shipped (inlines render+edit #54, list_filter, date_hierarchy, FK links, M2M, files, actions, session-expiry, PWA install). Remaining SPA work:

• Dark mode — Dark mode: theme toggle with no-flash server-side resolution (Sec-CH-Prefers-Color-Scheme) #84
• Mobile patterns (FAB / bottom-sheet / swipe) — Mobile-first creative UX: FAB, bottom-sheet detail, pull-to-refresh, swipe actions, long-press select #85
• Skeleton loading states everywhere — SPA loading states: use skeletons everywhere (not spinners / empty flashes) #231
• Sidebar collapsible app groups — SPA sidebar: collapsible app-group sections (caret expand/collapse, persisted to localStorage) #227
• Column customizer drag-reorder — SPA column customizer: add drag-and-drop REORDER (the half #214 dropped from #196) #218
• Save-flow buttons (Save / continue / add another / save as new) — Save flow buttons — Save / continue / add another / save as new (Django admin parity) #154
• Delete-confirmation page + cascade preview UI — Delete confirmation page + cascade preview (Django admin parity) #153 (backend feat(api): delete-confirmation preview endpoint — Django admin parity (#153 backend) #164 done)
• Logout affordance + cache-purge-on-logout — PWA §5: wire cache-purge-on-logout + SPA logout affordance (SW handler exists, trigger doesn't) #225 (SW handler done feat(pwa): manifest + service worker backend — #86 (backend half) #200)
• README / PyPI screenshots (light+dark, desktop+mobile) — README + PyPI screenshots: registry / list / detail in light + dark, desktop + mobile #87
• Parity-audit "needs audit" rows (list_display_links, search_help_text, sticky header/breadcrumbs) — Meta: Django admin parity audit — feature-by-feature tracker (the package's baseline) #147

B. Docs / contract reconciliation

• ARCHITECTURE.md §8 is stale — it still lists inlines / custom actions / bulk actions / autocomplete / React-extension as "deferred to v1.x", but all shipped. Must be reconciled before declaring v1 (the architecture contract can't claim a shipped feature is deferred). → new issue.
• Range field WRITE path — Structured range serializer + tests (PR #94 follow-up — contract says it; code doesn't emit it) #141 shipped the read envelope; the symmetric write coercion (accept the structured envelope → Range(...)) is unbuilt. → new issue.
• docs/api-contract.md final freeze pass (the v1 wire contract becomes a stability commitment).

C. Quality gate (ACCEPTANCE.md §3.5 T-2)

• Coverage ≥ 90% overall; permissions.py/serializers.py 100%; views/* ≥ 95%.
• ACCEPTANCE.md §2 (PM/UX), §3 (Architect), §4 (Security) audited all-green for the milestone.

D. Hardening (#144) — agent items done; owner actions remain

• Branch protection on main (owner).
• Rotate the .git/config PAT (owner).

E. Release (Tier 6, human)

• All §5 rows ✅ → tag 1.0.0 (not …aN).
• Repo-owner provides the go-ahead + holds the PyPI token.

Sequencing

A (frontend, the long pole — other-lane) and B/C (docs+quality, mostly my lane) can proceed in parallel. When A's deprecation-blocking rows + B + C are green, cut 0.2.0rc1, soak, then 1.0.0. D + E are the final human gates.

— filed by the Security & Compliance Lead at the repo owner's request ("what's left for v1.0.0").

[MartinCastroAlvarez]

Frontend-parity progress (PM/UX lane) — Section A movement, 2026-05-27:

Shipped + merged this session:

• ✅ Dark mode Dark mode: theme toggle with no-flash server-side resolution (Sec-CH-Prefers-Color-Scheme) #84 (feat(spa): dark mode — sidebar settings cog + Light/Dark toggle modal #259) — sidebar settings cog → Light/Dark modal, persisted, no-flash. (Server-side Sec-CH no-flash remains the only open sub-item on Dark mode: theme toggle with no-flash server-side resolution (Sec-CH-Prefers-Color-Scheme) #84.)
• ✅ Delete confirm UI (fix(spa): delete confirm uses the shared overlay Modal #224) — proper overlay Modal. Closes the confirm-dialog half of Delete confirmation page + cascade preview (Django admin parity) #153; cascade-preview UI still open (feat(api): delete-confirmation preview endpoint — Django admin parity (#153 backend) #164 backend exists).
• ✅ README/PyPI screenshots (docs(readme): absolute raw URLs for screenshots so PyPI renders them #256, closes PyPI README screenshots are broken (relative image paths don't resolve on PyPI) #249) — fixed the broken PyPI images (absolute raw URLs). The light+dark / desktop+mobile variants of README + PyPI screenshots: registry / list / detail in light + dark, desktop + mobile #87 remain.
• ✅ Bulk actions async, no redirect (fix(actions): bulk actions run async in the SPA — no redirect, confirm actually deletes #239) — delete_selected actually deletes; SPA stays put.
• ✅ Filter persistence (feat(spa): persist applied list filters to localStorage (URL stays source of truth) #258) — applied filters survive revisits; URL stays source of truth.
• ✅ Polish: list title shows model-name only (fix(spa): list title shows the model name only, not "App · Model" #254), scrollbars hidden app-wide (fix(spa): hide scrollbars app-wide while keeping scroll #255).

Net effect on Section A remaining: #84 effectively done (toggle UX); #153 / #87 downgraded to partial. Still open in A: #85 mobile patterns, #231 skeletons, #227 collapsible groups, #218 reorder, #154 save-flow buttons, #225 logout affordance, #147 audit rows.

[MartinCastroAlvarez]

Quality-gate (§3.5 T-2) — measured on main today (Security & Compliance Lead). CI only enforces overall --cov-fail-under=90; the per-file T-2 targets are not wired in, so gaps exist. Exact punch list:

poetry run pytest --cov=django_admin_react --cov-branch → overall 89% (target ≥90% — just under).

Module	Now	T-2 target	Gap
api/permissions.py	100%	100% stmt+branch	✅
api/serializers.py	94%	100% stmt+branch	missing 127, 235-236, 401, 436, 439-440, branch 430→433 (model-serialize, __str__-raises fallback, choices, decimal_places, FK-with-null-related)
api/views/detail.py	85%	≥95%	❌
api/views/list.py	88%	≥95%	❌
api/views/history.py	88%	≥95%	❌
api/views/actions.py	88%	≥95%	❌
api/views/bulk.py	90%	≥95%	❌
api/views/autocomplete.py	92%	≥95%	❌
api/views/auth.py	97%	≥95%	✅
api/views/{create,create_form,delete_preview,destroy,registry,schema,password}.py	100%	≥95%	✅

Recommendations for the §5 gate:

1. Wire the per-file thresholds into CI (a [tool.coverage] per-module fail_under, or a small assertion in a coverage test) so the gate is enforced, not aspirational.
2. Close serializers.py to 100/100 first (security-critical denylist module) — best done after chore(types): make mypy clean across the API (41 → 0) #260 merges (it edits the same FK/related_model lines).
3. Bring the six views to ≥95% (test-only additions).

I'll pick these up as the hot files (#260, swarm's detail.py/list.py) settle, to avoid churn collisions.