security: publish hardened v1 initiative snapshot
Publish the reviewed security policy and evidence, exact runtime ABI enforcement, orphan-output and permission safeguards, dead-upstream cleanup, and the evidence-gated v1 launch plan. This commit is an exact sanitized export from the private development record. Material implementation and review were assisted by OpenAI Codex; Cole Speelman reviewed the changes and accepts human responsibility. Himesan-Output-Permission: v1.0 Signed-off-by: Cole Speelman <gamertan@noreply.localhost>
This commit is contained in:
@@ -0,0 +1,152 @@
|
||||
<!-- SPDX-License-Identifier: AGPL-3.0-only -->
|
||||
|
||||
# v1.0.0 launch initiative
|
||||
|
||||
Sandwich Hime v1 is a compatibility and evidence milestone, not a reason to
|
||||
accumulate features. The intended product is already visible: an HTML-first,
|
||||
ahead-of-time template engine for Go, typed generated components, a small
|
||||
HTTP-independent runtime, and an optional opinionated local development loop.
|
||||
|
||||
The private development initiative lives on `codex/v1-launch` in
|
||||
`sandwich-hime-dev`. Public releases never originate from that private history.
|
||||
|
||||
## Repository and publication topology
|
||||
|
||||
| Surface | Purpose | History and tags |
|
||||
| --- | --- | --- |
|
||||
| Private Gitea `sandwich-hime-dev` | development, working branches, private review records, and historical context | normal private history; no public release tags |
|
||||
| Public Gitea `sandwich-hime` | canonical sanitized source, contribution venue, module origin, releases, and signed tags | fresh reviewed publication history; authoritative `sando/vX.Y.Z` and `vX.Y.Z` tags |
|
||||
| GitHub `gamertan/sandwich-hime` | discoverability and a convenient sanitized source snapshot | no private refs, force-mirrors, workflows, contribution authority, release artifacts, or semver tags |
|
||||
|
||||
Each public update is exported through the exact committed allowlist, inspected,
|
||||
committed as a fresh public snapshot, and compared byte-for-byte with the
|
||||
reviewed export. GitHub receives that public tree only. It never receives the
|
||||
private repository or an indiscriminate Git mirror.
|
||||
|
||||
## Current readiness
|
||||
|
||||
At the 2026-08-12 v1 initiative baseline, the project is a strong engineering
|
||||
preview, but not yet a release candidate. Exact private/public commit mappings
|
||||
remain in the non-exported operational ledger.
|
||||
|
||||
### Demonstrated now
|
||||
|
||||
- race-enabled tests, vet, builds, deterministic generation, license checks,
|
||||
and sanitized-export tests pass on Linux;
|
||||
- the compiler module and nested `sando` runtime declare zero third-party Go
|
||||
module requirements;
|
||||
- generated/runtime compatibility uses a version-specific compile-time ABI
|
||||
marker with an incompatible-runtime regression;
|
||||
- owned-output, orphan, stale, symlink, nested-module, restrictive-permission,
|
||||
last-good, writer-error, and enumerated contextual-output cases are tested;
|
||||
- the development proxy is loopback-only, browser-origin hardened, and clears
|
||||
a dead selected upstream immediately; and
|
||||
- the security policy, threat model, and dated evidence ledger state both the
|
||||
demonstrated controls and the unresolved limits.
|
||||
|
||||
### Not demonstrated yet
|
||||
|
||||
- native Windows and macOS execution of the complete supported matrix;
|
||||
- a stable public API/CLI/schema snapshot and compatibility test;
|
||||
- systematic browser-parser and `html/template` differential testing;
|
||||
- a long semantic fuzz campaign beyond bounded no-panic smoke;
|
||||
- committed, reproducible comparative benchmarks and a predefined regression
|
||||
threshold;
|
||||
- real-browser SSE/reload/overlay evidence for `himesan dev`;
|
||||
- deterministic release artifacts, checksums, SBOMs, signatures, and tested
|
||||
signing/recovery procedures; or
|
||||
- clean direct and public-proxy installation of signed release tags.
|
||||
|
||||
## Milestone 1: contract freeze
|
||||
|
||||
Required before security/platform release-candidate work is declared complete:
|
||||
|
||||
- [ ] Decide and specify whether generic component function signatures are v1.
|
||||
- [ ] Inventory and freeze every exported `sando` symbol, trusted type,
|
||||
sentinel error, concrete error field, helper, and ABI marker.
|
||||
- [ ] Freeze CLI commands, exit-code meanings, diagnostic codes, JSON schemas,
|
||||
`himesan.json` schema, and generated provenance fields.
|
||||
- [ ] Specify nil/stringification behavior, supported HTML-context matrix,
|
||||
component trust boundary, URL semantics, and explicit unsupported cases.
|
||||
- [ ] Add machine-checked public API, CLI, diagnostic, schema, and generated
|
||||
output compatibility snapshots.
|
||||
- [ ] Define the v1 deprecation and security-support policy.
|
||||
|
||||
## Milestone 2: security and native-platform evidence
|
||||
|
||||
- [ ] Run the minimum supported Go line and the latest two stable Go lines on
|
||||
native Linux, macOS, and Windows hosts.
|
||||
- [ ] Prove identical generated bytes across those hosts and exercise native
|
||||
path, replacement, permission, race, process-tree, and watcher behavior.
|
||||
- [ ] Build a systematic differential corpus against Go's documented
|
||||
`html/template` safety baseline for overlapping supported contexts.
|
||||
- [ ] Parse representative outputs in real browsers and test structure/code
|
||||
invariants rather than only byte equality.
|
||||
- [ ] Extend semantic fuzzing across delimiters, HTML transitions, imports,
|
||||
paths, source maps, URL normalization, and filesystem operations.
|
||||
- [ ] Resolve or explicitly accept every open item in
|
||||
`SECURITY_EVIDENCE.md`; no accepted item may contradict a public guarantee.
|
||||
- [ ] Test delivery and reply through `security@sandwichhime.com`.
|
||||
- [ ] Define severity, advisory, retraction, and CVE-request handling.
|
||||
|
||||
## Milestone 3: measured performance and development UX
|
||||
|
||||
- [ ] Commit a synthetic, repository-owned benchmark corpus comparing
|
||||
equivalent typed views and output with `html/template`.
|
||||
- [ ] Define “no material regression” before measuring the release candidate;
|
||||
publish hardware, OS, Go version, commands, samples, allocations, and output
|
||||
equivalence with every result.
|
||||
- [ ] Test SSE reconnect, reload, diagnostic overlays, CSP changes, fragment/API
|
||||
exclusions, caching, and child cleanup in a real browser on supported hosts.
|
||||
- [ ] Remove any v1 development-supervisor guarantee that cannot be evidenced
|
||||
reliably instead of substituting prose for a test.
|
||||
|
||||
## Milestone 4: release rehearsal
|
||||
|
||||
- [ ] Make version validation identical in the CLI, generated headers, scripts,
|
||||
and release artifacts; reject ambiguous build metadata.
|
||||
- [ ] Build the candidate compiler at its candidate version and prove its
|
||||
committed outputs are current under that exact binary.
|
||||
- [ ] Produce deterministic archives/binaries, checksums, SBOMs, signatures,
|
||||
and source/build provenance from a clean sanitized canonical checkout.
|
||||
- [ ] Test release-key backup and two-person recovery for Gitea, domains,
|
||||
signing material, and publication instructions.
|
||||
- [ ] Make evidence gates validate content and commit identity rather than only
|
||||
the presence of non-empty files.
|
||||
- [ ] Rehearse runtime-first publication and rollback without creating public
|
||||
semver tags.
|
||||
|
||||
## Milestone 5: release candidates and final launch
|
||||
|
||||
1. Export and review the sanitized canonical release tree.
|
||||
2. Publish signed `sando/v1.0.0-rc.1`, then signed `v1.0.0-rc.1` from the same
|
||||
reviewed public Gitea commit.
|
||||
3. Verify documented installs through fresh `GOPROXY=direct` and
|
||||
`proxy.golang.org` caches on supported Go versions and native platforms.
|
||||
4. Run the complete evidence suite again from the exact public commit.
|
||||
5. Operate the official Sandwich Hime website on the RC runtime for a 14-day
|
||||
observation period with no unresolved Hime render, security, accessibility,
|
||||
or rollback regression. This is product dogfooding, not a dependency on EQL
|
||||
or another application's private repository.
|
||||
6. Fix findings in a new RC; restart the observation period when the affected
|
||||
boundary warrants it.
|
||||
7. Finalize the changelog, supported-version table, migration notes, release
|
||||
notes, legal/trademark review, checksums, SBOMs, and signatures.
|
||||
8. Publish `sando/v1.0.0` first and `v1.0.0` second. Never move a tag.
|
||||
9. Refresh the untagged GitHub discovery snapshot and point it to canonical
|
||||
Gitea releases and contribution channels.
|
||||
|
||||
## Explicitly deferrable after v1
|
||||
|
||||
Unless testing finds a release-blocking consequence, v1 need not include every
|
||||
possible context, hostile-local filesystem hardening, typed trust-flow analysis,
|
||||
complete dynamic cycle detection, an encrypted reporting key, or an external
|
||||
audit. Those limits must remain visible and must not be contradicted by
|
||||
marketing. New features do not outrank a small stable contract.
|
||||
|
||||
## Definition of confidence
|
||||
|
||||
“Ready for v1” means a reviewer can trace each promise to a stable public
|
||||
contract, executable evidence from supported native environments, and a signed
|
||||
artifact built from the exact canonical source. It does not mean perfect,
|
||||
invulnerable, or finished forever.
|
||||
Reference in New Issue
Block a user