Remove the upgrade contract

.github/workflows/api-acceptance.yml

@@ -23,12 +23,12 @@ jobs:
         image: postgres:16-alpine
         env:
           POSTGRES_DB: oac_ci_tests
-          POSTGRES_USER: agents_api
-          POSTGRES_PASSWORD: agents_api_test_only
+          POSTGRES_USER: oac
+          POSTGRES_PASSWORD: oac_test_only
         ports:
           - 5432/tcp
         options: >-
-          --health-cmd "pg_isready -U agents_api -d oac_ci_tests"
+          --health-cmd "pg_isready -U oac -d oac_ci_tests"
           --health-interval 5s
           --health-timeout 5s
           --health-retries 10
@@ -58,7 +58,7 @@ jobs:
           PY
       - name: Verify official-client HTTP compatibility
         env:
-          OAC_TEST_DATABASE_URL: postgres://agents_api:agents_api_test_only@127.0.0.1:${{ job.services.postgres.ports['5432'] }}/oac_ci_tests?sslmode=disable
+          OAC_TEST_DATABASE_URL: postgres://oac:oac_test_only@127.0.0.1:${{ job.services.postgres.ports['5432'] }}/oac_ci_tests?sslmode=disable
           OAC_TEST_SERVER_BIN: ${{ runner.temp }}/oac-core-build/oac-core
           OAC_TEST_OFFICIAL_SDK_PYTHON: python
         run: |
@@ -70,7 +70,7 @@ jobs:
       - name: Verify the distribution's Core image
         if: inputs.container
         env:
-          OAC_TEST_DATABASE_URL: postgres://agents_api:agents_api_test_only@127.0.0.1:${{ job.services.postgres.ports['5432'] }}/oac_ci_tests?sslmode=disable
+          OAC_TEST_DATABASE_URL: postgres://oac:oac_test_only@127.0.0.1:${{ job.services.postgres.ports['5432'] }}/oac_ci_tests?sslmode=disable
           OAC_DEV_CORE_IMAGE: oac-core:ci
           OAC_TEST_OFFICIAL_SDK_PYTHON: python
         run: make check-core-container

.github/workflows/check.yml

@@ -49,8 +49,8 @@ jobs:
       - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref || github.sha }}
-      - name: Verify names, documentation and CI selection invariants
-        run: make check-names check-docs check-ci
+      - name: Verify documentation and CI selection invariants
+        run: make check-docs check-ci
 
   # Parts run in parallel; the serial integration package is split into deterministic shards.
   backend:
@@ -76,12 +76,12 @@ jobs:
         image: postgres:16-alpine
         env:
           POSTGRES_DB: oac_core_ci_tests
-          POSTGRES_USER: agents_api
+          POSTGRES_USER: oac
           POSTGRES_PASSWORD: core_test_only
         ports:
           - 5432/tcp
         options: >-
-          --health-cmd "pg_isready -U agents_api -d oac_core_ci_tests"
+          --health-cmd "pg_isready -U oac -d oac_core_ci_tests"
           --health-interval 5s
           --health-timeout 5s
           --health-retries 10
@@ -119,7 +119,7 @@ jobs:
           sudo apt-get install -y build-essential pkg-config libssl-dev
       - name: Verify dedicated test database
         env:
-          OAC_TEST_DATABASE_URL: postgres://agents_api:core_test_only@127.0.0.1:${{ job.services.postgres.ports['5432'] }}/oac_core_ci_tests?sslmode=disable
+          OAC_TEST_DATABASE_URL: postgres://oac:core_test_only@127.0.0.1:${{ job.services.postgres.ports['5432'] }}/oac_core_ci_tests?sslmode=disable
         run: |
           echo "OAC_TEST_DATABASE_URL=$OAC_TEST_DATABASE_URL" >> "$GITHUB_ENV"
           make check-database

AGENTS.md

@@ -69,7 +69,7 @@ The categories are [process settings](docs/configuration.md#process-settings), [
 
 ### Pre-release: no compatibility layers
 
-OpenAgentCore is pre-release. Replace superseded interfaces, execution paths and files outright. Keep no version fallback, compatibility shim or migration for superseded behavior unless an explicit upgrade contract requires it. The [in-place upgrade](docs/getting-started/operations.md#upgrade) from v0.0.10 or later is that contract: persisted changes ship as forward migrations (goose for PostgreSQL, `oac init` for the data volume), and a landed migration is never edited. Protocols may change; the release notes list each change with the operator actions it requires. Keep the pinned official public protocol, valid data and still-used, verified infrastructure. Do not rewrite working infrastructure only to rename it.
+OpenAgentCore has had no public release. Replace superseded interfaces, execution paths and files outright. Keep no version fallback, compatibility shim or migration for superseded behavior. An installation of another release is reinstalled, never upgraded. A schema change adds a forward migration, so existing development and test databases follow it; the migrations may be folded into one baseline at any time. Keep the pinned official public protocol, valid data and still-used, verified infrastructure. Do not rewrite working infrastructure only to rename it.
 
 ## Documentation
 

CONTRIBUTING.md

@@ -74,7 +74,7 @@ Toolchain setup and focused commands are in [Develop OpenAgentCore](docs/develop
 
 ### Checks for a change
 
-Validate the current diff and the behavior it directly affects, with the smallest checks that establish correctness. Include migration or cross-component tests only when those behaviors change. A review, documentation edit or CI configuration change does not need a full repository test run. After a follow-up edit, rerun only the checks that edit affects, and record what passed and any limits.
+Validate the current diff and the behavior it directly affects, with the smallest checks that establish correctness. Include cross-component tests only when those behaviors change. A review, documentation edit or CI configuration change does not need a full repository test run. After a follow-up edit, rerun only the checks that edit affects, and record what passed and any limits.
 
 The [CI selection policy](docs/maintainers.md#continuous-integration) names affected groups. A narrower check is enough when it covers the change. `make check` is the full gate for an explicitly requested full validation and for releases. [Live acceptance](#live-acceptance) applies when native execution behavior changes.
 
@@ -95,7 +95,7 @@ The role needs `CREATE DATABASE`: tests of database-wide state, such as the exec
 - The standard fields are generated into `v1/official.gen.go`. `go-bindings.json` lists the types Core consumes and overrides only the Go representation or field order that existing storage or custom JSON encoding requires; shared shapes use one Go type. Selected discriminated unions also generate JSON serializers that keep required nullable fields for each variant. Go input projections exclude `packages.system` to preserve its explicit rejection. Other union serializers, Core's local limits, execution admission and state transitions remain implementation code.
 - `packages/agents-client/src/generated/public-api.ts` generates the TypeScript client's types, enum values and field names from the resulting public schema. The same generator projects the `/core/v1` document into `core-api.ts`, which imports the public types it references from `public-api.ts`. The internal `/core/v1` and `/api/v1` documents come from handler annotations: a response field Core always sends carries `binding:"required"`, a nullable field carries `extensions:"x-nullable"`, and a Core-owned closed set uses a named Go type with typed constants in its producing package, from which Swag derives one shared enum definition. Single-value discriminators keep `enums:` tags; fields mirroring official or Runtime-owned sets keep tags that contract tests check against their owners. The annotations only shape the documents, and the client rejects a response that breaks them.
 - Contract tests verify that the public schema preserves the official definitions, extensions stay in `x_agents_core`, and all documents match registered routes. Official-client and raw HTTP tests verify behavior. Schema generation does not qualify an unimplemented feature; the known gaps in [OpenAI compatibility](contracts/agents-api/index.md#known-gaps) still apply. Upstream upgrades update the OpenAPI and SDK pins together after comparison and compatibility tests.
-- `make sqlc-generate` owns only `services/core/internal/db/sqlc` (sqlc v1.29.0). Do not rewrite landed migrations.
+- `make sqlc-generate` owns only `services/core/internal/db/sqlc` (sqlc v1.29.0).
 - `make check-runtime-contract` is the focused Core–Runtime contract entry point; see [Contract verification](docs/runtime-protocol.md#contract-verification). It also runs through `check-go` and `check-core`.
 
 ### Compatibility evidence
@@ -123,23 +123,6 @@ Native adapter changes require their build/check targets and live provider accep
 
 Provider bootstrap, Runtime images and Harness adapters must agree on these names.
 
-[Upgrade](docs/getting-started/operations.md#upgrade) owns release changes and preservation of installed data and resources.
-
 ## Branding
 
 Use OpenAgentCore for public project branding. The canonical mark is `docs/assets/openagentcore-logo.svg`; Web uses its outline with cropped transparent margins, theme-aware favicon colors and dark-surface inversion. The README wordmark is `docs/assets/openagentcore-wordmark-light.svg` with a dark variant, and `docs/assets/og-image.png` is the social preview. The architecture diagram that README and the website show, `docs/assets/architecture.svg` and `architecture-dark.svg`, is generated by `scripts/generate-architecture-diagram.py`; change the script and run it again. The `example/parsar/` workbench keeps its own name, logo and favicon. Preserve external repository URLs and data identifiers when changing display copy.
-
-## OpenAgentCore name guard
-
-`make check-names` scans tracked text for retired branding, GitHub organization, settings and installed command names. Each exception in `scripts/name-allowlist.json` names a path glob, a regular expression and a reason.
-
-- An exception covers only its matched text: an allowed repository import cannot hide a retired setting elsewhere on the line.
-- Keep exceptions narrow and explain the preserved contract or detection input.
-- The guard fails on an exception that excuses no retired identifier. Remove an exception together with the last text it covers.
-
-These identities stay unchanged:
-
-- public `AgentCoreError`, upstream contract fields and the separate Parsar product;
-- persisted credential encryption domains and native-session resume keys, so existing data can be decrypted and Sessions can resume.
-
-Detection inputs name the identifiers they reject. Landed migrations keep their original identifiers; application and operator examples use the current names.

Makefile

@@ -8,7 +8,7 @@ SWAG_VERSION ?= v1.16.4
 help:
 	@printf '%s\n' 'make build-core        Build standalone Core commands' 'make build-daemon      Build the execution daemon' 'make check             Run Core, persistence and runtime checks' 'See README.md for runtime prerequisites and deployment.'
 
-check: check-ci check-harness-catalog check-names check-distribution check-database check-sqlc check-go check-microsandbox-provider check-core check-claude-sdk check-web check-example check-mcode-harness
+check: check-ci check-harness-catalog check-distribution check-database check-sqlc check-go check-microsandbox-provider check-core check-claude-sdk check-web check-example check-mcode-harness
 	@printf 'OpenAgentCore checks passed.\n'
 
 .PHONY: generate-harness-catalog check-harness-catalog
@@ -19,11 +19,6 @@ check-harness-catalog:
 	python3 scripts/generate-harness-catalog.py --check
 	python3 scripts/generate-harness-catalog.test.py
 
-.PHONY: check-names
-check-names:
-	python3 scripts/check-names.test.py
-	python3 scripts/check-names.py
-
 check-database:
 	@test -n "$${OAC_TEST_DATABASE_URL:-}" || { echo 'Set OAC_TEST_DATABASE_URL to a dedicated test PostgreSQL database' >&2; exit 1; }
 

contracts/agents-api/source-files.md

@@ -55,8 +55,6 @@ A missing or foreign File returns 404 with type `invalid_request_error`, a null
 
 Core stores File bytes as PostgreSQL large objects in its own database. An upload and a deletion each commit in one transaction, so a failure leaves neither partial bytes nor metadata. [Back up](../../docs/getting-started/operations.md#back-up) the database with its large objects; deleting a File does not remove it from write-ahead logs or earlier backups.
 
-The source Files schema refuses a downgrade while File rows remain. Delete Files through the API first so their large objects are removed.
-
 A copy into a workspace reads a consistent snapshot of the File and can finish after the File is deleted; later lookups fail. Deleting a File never changes a workspace copy.
 
 ## Skills

contracts/agents-api/zh/source-files.md

@@ -1,7 +1,7 @@
 ---
 title: "文件与 Skill"
 source: contracts/agents-api/source-files.md
-source_hash: 320216a4e7ac0d1e3e2455dfe622e0f91576ea1d0aa00d11911683b0e98387f1
+source_hash: 86d63f3ea780394ed99c0f5ec9d566117140a8650cb780e4b038e4ab45155ba9
 ---
 
 Files（`/v1/files`）和 Skills（`/v1/skills`）是具有独立生命周期的项目资源，不依赖 Session。File 保存上传字节，Environment 通过 ID 复制它们。Skill 保存不可变、版本化的包，由模板和 Session 引用。项目的所有 API 密钥共享这些资源。
@@ -57,8 +57,6 @@ Files（`/v1/files`）和 Skills（`/v1/skills`）是具有独立生命周期的
 
 Core 在自身数据库中以 PostgreSQL 大对象存储 File 字节。上传和删除分别在单一事务中提交，失败不会留下部分字节或元数据。[备份](../../../docs/zh/getting-started/operations.md#back-up)数据库时包含大对象；删除 File 不会将其从预写日志或旧备份移除。
 
-存在 File 行时，源文件 schema 拒绝降级。先通过 API 删除 File，以清理大对象。
-
 复制到工作区时读取 File 一致快照，可在 File 删除后完成；后续查询失败。删除 File 不改变工作区副本。
 
 ## Skill {#skills}

deploy/README.md

@@ -14,9 +14,9 @@
 
 Preparation happens in `<install-dir>.staging`. On entry, the installer removes an empty stage or one with the empty ownership directory `.oac-installer-<hash of the installation path>`; it preserves unrecognized directories. Ordinary failures remove owned staging immediately. The ownership marker is created atomically before downloading files. A killed process leaves staging for the next attempt. The release's `compose.yaml` is verified against its published checksum in the stage and must name the installer's own release in `OAC_REVISION`. Publication happens only after downloads, checks and pulls succeed. Later failures preserve saved configuration, containers and the Docker data volume. `<install-dir>.lock` is a persistent lock directory shared by installation and mutating operator commands; the existing `runtimefs` platform adapter owns locking.
 
-An existing directory runs the release named by `OAC_REVISION` in its `compose.yaml`. When that is the installer's release, the installer resumes: it keeps the saved settings, pulls only missing images and starts the services the way `oac apply` does. The port check applies only to new directories. Another release is refused unless `--upgrade` is given. An upgrade stages the new `compose.yaml` and `oac`, pulls the new images, then runs `oac-core check-config` and init against the staged `compose.yaml` together with the directory's `.env` and `compose.override.yaml`. Init upgrades the data volume or refuses, for example a downgrade; until it succeeds, the running installation is unchanged. The installer then renames `oac` and `compose.yaml` into place and starts the services with `--pull never --remove-orphans`, recreating every changed container. Rerunning the same command retries an interrupted upgrade. The upgrade leaves the deployment's Runtime unchanged; the final message names the console step that applies the new one.
+An existing directory runs the release named by `OAC_REVISION` in its `compose.yaml`. When that is the installer's release, the installer resumes: it keeps the saved settings, pulls only missing images and starts the services the way `oac apply` does. The port check applies only to new directories. Another release is refused.
 
-`install.py --upgrade` upgrades a source-bundle installation the same way, under the same lock. It publishes the bundle's node payload beside earlier releases, renders the new `compose.yaml` and rewrites only its own `compose.override.yaml` entries, the four service images and Web's `/node-payload` bind, keeping every other entry. After the same two checks it moves the payload's `active.json`, renames `oac`, `compose.override.yaml` and `compose.yaml` into place and starts the services. On its own release it resumes like `oac install`; another release is refused without `--upgrade`, and `--public-url` is required only for a new directory.
+`install.py` resumes a source-bundle installation of its own release under the same lock; another release is refused, and `--public-url` is required only for a new directory.
 
 `install.py` prepares a new installation in a `.staging-*` directory inside the installation directory: the node payload, `.env`, `oac` and both Compose files. After `docker compose config` accepts them, it moves them into place, `compose.yaml` last. An earlier failure removes the stage, and the directory too when the run created it, so the same command can be rerun; the next run also removes a stage left by a killed run. A directory with other contents but no `compose.yaml` is refused.
 

deploy/compose/compose.yaml

@@ -22,8 +22,8 @@ services:
     depends_on:
       init: {condition: service_completed_successfully}
     environment:
-      POSTGRES_USER: agents_api
-      POSTGRES_DB: agents_api
+      POSTGRES_USER: oac
+      POSTGRES_DB: oac
       POSTGRES_PASSWORD_FILE: /run/database/password
     volumes:
       - type: volume
@@ -36,7 +36,7 @@ services:
         volume: {nocopy: true, subpath: secrets/database}
         read_only: true
     healthcheck:
-      test: [CMD-SHELL, "pg_isready -h 127.0.0.1 -U agents_api -d agents_api"]
+      test: [CMD-SHELL, "pg_isready -h 127.0.0.1 -U oac -d oac"]
       interval: 2s
       timeout: 5s
       retries: 30
@@ -54,7 +54,7 @@ services:
     environment:
       OAC_PUBLIC_URL: &public-url ${OAC_PUBLIC_URL:-http://localhost:${OAC_WEB_PORT:-8080}}
       OAC_INSTALLATION_ID_FILE: /run/oac/installation.id
-      OAC_DATABASE_URL: postgres://agents_api@database:5432/agents_api?sslmode=disable
+      OAC_DATABASE_URL: postgres://oac@database:5432/oac?sslmode=disable
       OAC_DATABASE_PASSWORD_FILE: /run/database/password
       OAC_CREDENTIAL_KEY_FILE: /run/oac/credential.key
       OAC_CORE_KEY_DIGESTS_FILE: /run/oac/core-key-digests.json

deploy/compose/test_compose.py

@@ -82,7 +82,6 @@ def test_compose_uses_private_services_and_ordered_initialization(self):
             self.assertEqual(services['core']['environment'][name], '', name)
 
     def test_database_stays_on_postgresql_16_pinned_by_digest(self):
-        # An upgrade keeps the data volume only within one PostgreSQL major version.
         self.assertRegex(render_compose.DATABASE_PIN, r'^postgres:16-alpine@sha256:[0-9a-f]{64}$')
 
     def test_public_url_can_be_configured_after_initial_startup(self):