gamertan/sandwich-hime
1
0
Fork 0
Code Actions Releases Activity

refactor: keep compiler source standalone

Browse Source 
Signed-off-by: Cole Speelman <crspeelman@gmail.com>
This commit is contained in:
gamertan
2026-08-11 23:58:25 -04:00
parent 0941075baa
commit 7b839f8155
40 changed files with 130 additions and 1581 deletions
Download Patch File Download Diff File Expand all files Collapse all files
RELEASE.md
+19 -2
View File
@@ -6,11 +6,23 @@ Sandwich Hime uses separate root and runtime version lines. Compiler tags are `v
The public pre-1.0 source snapshot is not a supported release and does not imply that the v1 gates below have passed.
No v1.0.0 release occurs until every gate in this repository is evidenced, including cross-platform deterministic generation, temporary-module compilation, fuzz/adversarial suites, race/vet/vulnerability/license checks on the latest two supported Go lines, development-supervisor failure tests, an EQL differential pilot, and a completed 14-day production soak without Hime render failures or security/accessibility regression.
No v1.0.0 release occurs until every gate in this repository is evidenced,
including cross-platform deterministic generation, temporary-module
compilation, fuzz/adversarial suites, race/vet/vulnerability/license checks on
the latest two supported Go lines, development-supervisor failure tests, and
reproducible repository-owned benchmark and security results. A deployment,
example, or case study in another repository is neither imported nor required
as release evidence.
Release candidates require a clean canonical checkout, reviewed changelog, compatible vanity-import metadata, reproducible binaries, signed annotated tags, checksums, SBOMs, vulnerability results, and verification on Linux, macOS, and Windows. The runtime is tagged and published independently before the compiler that references its ABI.
Gitea is the only canonical public forge. Public source is exported into a separate, sanitized Gitea repository with fresh history; private development history and the private-to-public commit mapping are not published. Release binaries and provenance are built from the reviewed public commit. Publishing documentation, binaries, runtime tag, EQL mark, and case study is one coordinated v1 launch step.
Gitea is the only canonical public forge. Public source is exported into a
separate, sanitized Gitea repository with fresh history; private development
history and the private-to-public commit mapping are not published. Release
binaries and provenance are built from the reviewed public commit. Compiler
documentation, binaries, checksums, SBOMs, and the independently versioned
runtime tag form the coordinated v1 release. Example applications and product
sites keep their own history, deployment, and evidence.
The hosting configuration must answer exact package discovery requests, not
only module-root pages. In particular,
@@ -22,3 +34,8 @@ fresh direct-fetch and public-proxy caches. This post-publication check is
separate from the pre-tag, read-only `scripts/release-check.sh`.
Release notes report hardware, commit, datasets, commands, `ns/op`, allocations, response latency, and methodology for performance claims. “Fastest” or equivalent language is prohibited without durable, reproducible evidence.
Production applications compile and deploy their committed `.sando.go` files
with the Apache-2.0 `sando` runtime. They do not need the AGPL compiler or the
local development supervisor. Release checks verify that boundary without
executing or inspecting an unrelated application repository.