release: prepare Sandwich Hime v1 beta
Publish the sanitized Beta 1 source candidate with version-stable generated provenance, classroom/evaluation support boundaries, provisional macOS support, signed-source release policy, and an exact candidate preflight. Material implementation, drafting, and review were assisted by OpenAI Codex. Cole Speelman reviewed the public snapshot and accepts human responsibility for the contribution. Signed-off-by: Cole Speelman <crspeelman@gmail.com>
This commit is contained in:
+63
-4
@@ -2,10 +2,69 @@
|
||||
|
||||
# Compatibility policy
|
||||
|
||||
Before v1.0.0, source syntax and generated ABI may change without compatibility shims, but each public change must be documented and deterministic. Private prototype history is intentionally outside the sanitized public repository and carries no public compatibility promise.
|
||||
## Beta 1 contract
|
||||
|
||||
At v1, semantic versions apply independently to the compiler and `sando` runtime. Generated files record the exact compiler version and required runtime ABI. Patch releases do not intentionally change accepted source semantics or generated public signatures. Minor releases may add fail-closed syntax or API capabilities while continuing to render previously valid components. Major releases may remove or reinterpret behavior.
|
||||
`v1.0.0-beta.1` and `sando/v1.0.0-beta.1` are semantic-version
|
||||
prereleases. They are supported for learning, classroom projects, evaluation,
|
||||
and compatibility testing. Before final v1, source syntax, generated output,
|
||||
the runtime API, CLI behavior, diagnostics, and configuration may change
|
||||
without compatibility shims. Every public change must still be documented and
|
||||
generation must remain deterministic.
|
||||
|
||||
The compiler supports the latest two Go release lines validated in CI. A support change is announced before release. Generated files are source artifacts, not a stable interchange format across compiler versions; `himesan check` defines whether they are current.
|
||||
The beta is not a production-stability commitment. Maintainers accept and
|
||||
triage security reports within the boundary described in
|
||||
[SECURITY.md](../SECURITY.md), but cannot promise that a beta fix preserves its
|
||||
public API.
|
||||
|
||||
The project makes no compatibility promise for internal packages, development SSE payloads before v1, or hand-edited generated files.
|
||||
## Final-v1 contract
|
||||
|
||||
At final v1, semantic versions apply independently to the compiler and
|
||||
`sando` runtime. Generated files record the exact compiler version and
|
||||
required runtime ABI. Patch releases do not intentionally change accepted
|
||||
source semantics or generated public signatures. Minor releases may add
|
||||
fail-closed syntax or API capabilities while continuing to render previously
|
||||
valid components. Major releases may remove or reinterpret behavior.
|
||||
|
||||
Generated files are source artifacts, not a stable interchange format across
|
||||
compiler versions; `himesan check` defines whether they are current. The
|
||||
project makes no compatibility promise for internal packages, development SSE
|
||||
payloads before final v1, or hand-edited generated files.
|
||||
|
||||
## Go and platform support
|
||||
|
||||
Beta 1 targets Go 1.25 and Go 1.26. Support is based on point-in-time,
|
||||
maintainer-run release matrices, not an implication of continuous CI coverage.
|
||||
A Go support change is announced in release notes before it takes effect.
|
||||
|
||||
The current public evidence is a **pre-beta baseline** on commit
|
||||
`113c95c21e57227b4675c9fda015ada59cc9e9a6` (tree
|
||||
`a2aeb4dac22853cb3894e3e487b94bbeff5051e5`):
|
||||
|
||||
| Platform | Go lanes | Maintainer-run result |
|
||||
| --- | --- | --- |
|
||||
| Windows 11/amd64 on NTFS | 1.25.12, 1.26.5 | Native tests, race, vet, builds, generation, process cleanup, watcher boundaries, and temporary consumer compilation passed; privileged symlink and POSIX-only permission cases were not exercised |
|
||||
| Linux/amd64 on WSL2 with an ext4 checkout | 1.25.12, 1.26.5 | Tests, race, vet, builds, generation, focused filesystem/development cases, and license checks passed |
|
||||
| Linux/amd64 in isolated containers on a Linux server | 1.25.12, 1.26.5 | Tests, race, vet, builds, deterministic generation, and license checks passed |
|
||||
| macOS | — | Native maintainer validation pending; provisional for Beta 1 |
|
||||
|
||||
The golden generated file had SHA-256
|
||||
`63fa75a3049a3a8a12d769d7f9b6b510dfe763baacf706775b75cef2c57a984f`
|
||||
on every tested Windows and Linux lane.
|
||||
|
||||
Because the Beta 1 candidate contains changes after that public baseline, the
|
||||
complete Windows/Linux matrix must be rerun on the exact candidate before the
|
||||
tags are published. The baseline does not become beta evidence merely because
|
||||
its code is nearby in history.
|
||||
|
||||
## macOS feedback
|
||||
|
||||
Mac learners, teachers, and Go developers are warmly invited to try the beta.
|
||||
A useful compatibility report includes the macOS version, Intel or Apple
|
||||
Silicon architecture, `go version`, the exact command, and a minimal
|
||||
reproduction or diagnostic output. Ordinary compatibility reports belong on
|
||||
the canonical Gitea project. Suspected vulnerabilities must use the private
|
||||
route in [SECURITY.md](../SECURITY.md).
|
||||
|
||||
Community reports can reveal gaps and help prioritize maintainer testing. They
|
||||
do not constitute an independent audit or shift responsibility for security
|
||||
review, triage, fixes, and release decisions to the community.
|
||||
|
||||
+64
-21
@@ -11,19 +11,30 @@ verification, or guarantee that no vulnerability exists.
|
||||
| Field | Value |
|
||||
| --- | --- |
|
||||
| Assessment date | 2026-08-12 |
|
||||
| Public evidence identity | Exact file checksums in the co-published `PUBLIC-SNAPSHOT.sha256`; private/public commit mapping is retained only in the non-exported operational ledger |
|
||||
| Assessment phases | Clean pre-remediation source followed by clean remediated source |
|
||||
| Primary environment | Linux amd64 under WSL, Go 1.26.5 |
|
||||
| Evidence sets | Clean security self-assessment plus an exact-commit pre-beta platform baseline; neither is evidence for the later Beta 1 candidate |
|
||||
| Public commit | `113c95c21e57227b4675c9fda015ada59cc9e9a6` |
|
||||
| Public tree | `a2aeb4dac22853cb3894e3e487b94bbeff5051e5` |
|
||||
| Maintainer-run environments | Windows 11/amd64 on NTFS; Ubuntu 20.04/amd64 under WSL2 on ext4; Linux/amd64 server containers |
|
||||
| Supported Go lanes exercised | Go 1.25.12 and Go 1.26.5 |
|
||||
| Declared minimum Go | Go 1.25 |
|
||||
| Assessor | Project maintainer with AI-assisted code review; human responsibility retained |
|
||||
|
||||
Security remediation discovered during this assessment was committed and the
|
||||
named checks were rerun from a clean source state. Before this ledger can support
|
||||
a versioned release, the complete campaign must be rerun from the exact
|
||||
sanitized public release commit. Private-to-public commit mappings are retained
|
||||
outside the exported source rather than being disclosed here.
|
||||
The named platform runs used the exact public commit and tree above. Hostnames,
|
||||
network addresses, account names, private paths, private repository identities,
|
||||
and private commit mappings are intentionally absent from this public ledger.
|
||||
|
||||
## Observed evidence
|
||||
Beta 1 necessarily changes the tree through versioning, provenance,
|
||||
documentation, or source fixes. Therefore this baseline cannot be relabeled as
|
||||
Beta 1 evidence. The required Windows/Linux campaign must pass again on the
|
||||
exact Beta 1 candidate before either tag is published. Native macOS execution
|
||||
remains pending and is provisional for the beta.
|
||||
|
||||
## Observed security self-assessment evidence
|
||||
|
||||
These commands were observed on clean remediated source during the dated
|
||||
assessment. Except where the exact-commit platform matrix below says otherwise,
|
||||
the table does not claim that every command was rerun on the named public
|
||||
baseline commit.
|
||||
|
||||
| Property examined | Enforcement or test surface | Result observed on 2026-08-12 |
|
||||
| --- | --- | --- |
|
||||
@@ -41,7 +52,7 @@ outside the exported source rather than being disclosed here.
|
||||
| URL scheme handling | ordinary/trusted URL test matrix | Pass for enumerated cases |
|
||||
| Filesystem boundaries | symlink, nested-module, VCS, ownership, stale-output tests | Pass for tested cases; see open findings |
|
||||
| Development proxy browser boundary | Host, Origin, Fetch Metadata, CSP, fragment and response tests | Pass for tested cases |
|
||||
| Native platform behavior | Linux execution; Windows/macOS cross-compilation | Native Windows/macOS execution not yet evidenced |
|
||||
| Platform behavior | Native Windows and executed Linux matrices; macOS cross-compilation | Windows/Linux pass for tested lanes; native macOS pending |
|
||||
|
||||
Coverage measures statements executed by tests. It is not branch completeness
|
||||
and is not evidence that the executed behavior is secure.
|
||||
@@ -50,6 +61,31 @@ and is not evidence that the executed behavior is secure.
|
||||
and reachable through its analysis. A clean result cannot detect unknown flaws,
|
||||
design errors, or vulnerabilities outside its model.
|
||||
|
||||
## Pre-beta native compatibility matrix
|
||||
|
||||
These are maintainer-run, point-in-time results, not continuous CI and not an
|
||||
independent audit.
|
||||
|
||||
| Environment | Go lanes | Commands and focused evidence | Result and limits |
|
||||
| --- | --- | --- | --- |
|
||||
| Windows 11/amd64, NTFS | 1.25.12, 1.26.5 | Native PowerShell verifier with race; root/runtime tests, vet, trimpath build, freshness, two generation passes, process-tree cleanup, watcher boundaries, and temporary consumer compilation | Pass. Symlink-output rejection skipped because the test account lacked symlink privilege; the read-only-directory case is POSIX-only |
|
||||
| Ubuntu 20.04/amd64 under WSL2, native ext4 checkout | 1.25.12, 1.26.5 | Race-enabled verifier; root/runtime tests, vet, build, two generation passes, ten focused filesystem cases, five focused development-process/watcher cases, and license check | Pass. This is Linux execution under WSL2, not bare-metal or Linux/arm64 evidence |
|
||||
| Linux/amd64 server containers | 1.25.12, 1.26.5 | Root/runtime tests, vet, builds, race, licensing, and deterministic generation in sequential isolated official Go containers | Pass. Container resources were capped at 1 CPU and 2 GiB; this is not Linux/arm64 evidence |
|
||||
| macOS | — | Cross-compilation only | Native maintainer execution pending; provisional for Beta 1 |
|
||||
|
||||
The generated golden `basic.sando.go` was 1,399 bytes and had SHA-256
|
||||
`63fa75a3049a3a8a12d769d7f9b6b510dfe763baacf706775b75cef2c57a984f`
|
||||
on every tested Windows and Linux lane. Repeated generation also preserved its
|
||||
timestamp. This demonstrates cross-host agreement for one compiler-owned
|
||||
fixture, not equivalence for every possible template.
|
||||
|
||||
Mac learners and Go developers are warmly invited to report ordinary
|
||||
compatibility results with macOS version, architecture, `go version`, exact
|
||||
command, and a minimal reproduction. Suspected vulnerabilities use the private
|
||||
route in [SECURITY.md](../SECURITY.md). Community reports help find gaps;
|
||||
maintainers remain responsible for reproducing security-relevant behavior,
|
||||
triage, remediation, and release decisions.
|
||||
|
||||
## Security-relevant design evidence
|
||||
|
||||
### Production boundary
|
||||
@@ -115,8 +151,8 @@ not yet prove semantic HTML safety.
|
||||
|
||||
## Assessment findings and remediation status
|
||||
|
||||
The 2026-08-12 assessment identified six concrete gaps. Their current
|
||||
working-tree status is recorded here without rewriting the original baseline:
|
||||
The 2026-08-12 assessment identified six concrete gaps. Their status in the
|
||||
named public pre-beta baseline is recorded here:
|
||||
|
||||
| Finding | Current remediation | Executable evidence |
|
||||
| --- | --- | --- |
|
||||
@@ -127,19 +163,26 @@ working-tree status is recorded here without rewriting the original baseline:
|
||||
| Trusted-value warnings were described more broadly than their analysis supports | Policy and threat-model copy now call them best-effort lexical audit hints rather than type or taint analysis | Documentation assertion and review |
|
||||
| Public copy implied a completed systematic `html/template` differential campaign | Policy and public security copy now describe fixed adversarial cases and list systematic differential work as open | Documentation assertion and review |
|
||||
|
||||
The remediated clean source passed the race-enabled repository verifier,
|
||||
sanitized-snapshot tests, both bounded fuzz-smoke targets, compiler/runtime
|
||||
known-vulnerability scans, and Windows/macOS cross-compilation on 2026-08-12.
|
||||
Those results do not become release evidence until the changes are committed,
|
||||
exported to the sanitized canonical public tree, and re-run from that exact
|
||||
public commit. Native Windows/macOS execution and the other gaps below remain
|
||||
separate release decisions.
|
||||
The clean remediated assessment source passed the race-enabled repository
|
||||
verifier, sanitized-snapshot tests, both bounded fuzz-smoke targets,
|
||||
compiler/runtime known-vulnerability scans, and Windows/macOS cross-compilation
|
||||
on 2026-08-12. Separately, the exact public pre-beta commit passed the native
|
||||
Windows and executed Linux matrices recorded above. These results still do not
|
||||
become Beta 1 evidence: both sets of required checks must run on the exact
|
||||
candidate after all candidate changes. Native macOS and the other gaps below
|
||||
remain separate release decisions.
|
||||
|
||||
## Open assurance gaps
|
||||
|
||||
- the exact Beta 1 candidate Windows/Linux matrix and post-tag install checks
|
||||
must still run;
|
||||
- confidential mailbox delivery and response/recovery procedure must be tested;
|
||||
- release signing, checksum, SBOM, and provenance rehearsal is incomplete;
|
||||
- native Windows/macOS execution remains outstanding;
|
||||
- SSH tag-signing rehearsal passed, but the candidate tags still require
|
||||
post-publication verification; prebuilt-artifact signing, checksums, SBOM,
|
||||
reproducible provenance, and key recovery remain incomplete;
|
||||
- native macOS, Linux/arm64, and Windows/arm64 execution remain outstanding;
|
||||
- Windows symlink rejection was not natively exercised because the test account
|
||||
lacked symlink privilege;
|
||||
- browser-parser differential and semantic property testing need expansion;
|
||||
- compiler input size, CPU, and memory have no built-in hard budget;
|
||||
- filesystem checks do not defend against a hostile local actor racing path
|
||||
|
||||
+61
-33
@@ -7,55 +7,83 @@ accumulate features. The intended product is already visible: an HTML-first,
|
||||
ahead-of-time template engine for Go, typed generated components, a small
|
||||
HTTP-independent runtime, and an optional opinionated local development loop.
|
||||
|
||||
The private development initiative lives on `codex/v1-launch` in
|
||||
`sandwich-hime-dev`. Public releases never originate from that private history.
|
||||
Development records may remain private, but their repository names, branch
|
||||
names, paths, commit mappings, and history are not release provenance. Public
|
||||
releases originate only from the reviewed canonical public tree.
|
||||
|
||||
## Repository and publication topology
|
||||
|
||||
| Surface | Purpose | History and tags |
|
||||
| --- | --- | --- |
|
||||
| Private Gitea `sandwich-hime-dev` | development, working branches, private review records, and historical context | normal private history; no public release tags |
|
||||
| Public Gitea `sandwich-hime` | canonical sanitized source, contribution venue, module origin, releases, and signed tags | fresh reviewed publication history; authoritative `sando/vX.Y.Z` and `vX.Y.Z` tags |
|
||||
| GitHub `gamertan/sandwich-hime` | discoverability and a convenient sanitized source snapshot | no private refs, force-mirrors, workflows, contribution authority, release artifacts, or semver tags |
|
||||
| Private development storage | Working branches, private review records, and historical context | identities and history are not exported; no public release tags |
|
||||
| Public Gitea `sandwich-hime` | Canonical sanitized source, contribution venue, module origin, and releases | fresh reviewed history; authoritative immutable `sando/vX.Y.Z` and `vX.Y.Z` tags |
|
||||
| GitHub `gamertan/sandwich-hime` | Discoverability and a convenient sanitized source snapshot | no private refs, force-mirrors, workflows, contribution authority, release artifacts, or semver tags |
|
||||
|
||||
Each public update is exported through the exact committed allowlist, inspected,
|
||||
committed as a fresh public snapshot, and compared byte-for-byte with the
|
||||
reviewed export. GitHub receives that public tree only. It never receives the
|
||||
private repository or an indiscriminate Git mirror.
|
||||
reviewed export. GitHub receives that public tree only. It never receives
|
||||
private history or an indiscriminate Git mirror.
|
||||
|
||||
## Current readiness
|
||||
|
||||
At the 2026-08-12 v1 initiative baseline, the project is a strong engineering
|
||||
preview, but not yet a release candidate. Exact private/public commit mappings
|
||||
remain in the non-exported operational ledger.
|
||||
Beta 1 is deliberately earlier than a release candidate. It creates a real,
|
||||
repeatable install for learners and evaluators without claiming that the final
|
||||
v1 compatibility, native-platform, artifact, signing, or soak gates are
|
||||
complete.
|
||||
|
||||
### Demonstrated now
|
||||
### Demonstrated in the pre-beta public baseline
|
||||
|
||||
- race-enabled tests, vet, builds, deterministic generation, license checks,
|
||||
and sanitized-export tests pass on Linux;
|
||||
- the compiler module and nested `sando` runtime declare zero third-party Go
|
||||
module requirements;
|
||||
- generated/runtime compatibility uses a version-specific compile-time ABI
|
||||
marker with an incompatible-runtime regression;
|
||||
- owned-output, orphan, stale, symlink, nested-module, restrictive-permission,
|
||||
last-good, writer-error, and enumerated contextual-output cases are tested;
|
||||
- the development proxy is loopback-only, browser-origin hardened, and clears
|
||||
a dead selected upstream immediately; and
|
||||
- the security policy, threat model, and dated evidence ledger state both the
|
||||
demonstrated controls and the unresolved limits.
|
||||
Public commit `113c95c21e57227b4675c9fda015ada59cc9e9a6` (tree
|
||||
`a2aeb4dac22853cb3894e3e487b94bbeff5051e5`) passed maintainer-run Go
|
||||
1.25.12 and Go 1.26.5 matrices on native Windows/amd64, Linux/amd64 under WSL2,
|
||||
and isolated Linux/amd64 server containers. The same generated golden SHA-256
|
||||
was observed across those lanes.
|
||||
|
||||
That result is a pre-beta baseline only. The exact Beta 1 candidate must rerun
|
||||
the required Windows/Linux matrix after all version, documentation, and source
|
||||
changes and before tags are created.
|
||||
|
||||
Other demonstrated controls include:
|
||||
|
||||
- zero third-party Go module requirements in the compiler and nested `sando`
|
||||
runtime;
|
||||
- a version-specific compile-time runtime ABI marker;
|
||||
- owned-output, orphan, stale, symlink, nested-module, permission, last-good,
|
||||
writer-error, and enumerated contextual-output tests;
|
||||
- loopback-only, browser-origin-hardened development proxy behavior; and
|
||||
- a public threat model, security policy, and dated evidence ledger.
|
||||
|
||||
### Not demonstrated yet
|
||||
|
||||
- native Windows and macOS execution of the complete supported matrix;
|
||||
- a stable public API/CLI/schema snapshot and compatibility test;
|
||||
- native maintainer-run macOS execution; macOS is provisional for Beta 1;
|
||||
- stable final-v1 API, CLI, schema, diagnostic, and generated snapshots;
|
||||
- systematic browser-parser and `html/template` differential testing;
|
||||
- a long semantic fuzz campaign beyond bounded no-panic smoke;
|
||||
- committed, reproducible comparative benchmarks and a predefined regression
|
||||
threshold;
|
||||
- real-browser SSE/reload/overlay evidence for `himesan dev`;
|
||||
- deterministic release artifacts, checksums, SBOMs, signatures, and tested
|
||||
signing/recovery procedures; or
|
||||
- clean direct and public-proxy installation of signed release tags.
|
||||
- committed comparative benchmarks and predefined regression thresholds;
|
||||
- complete real-browser development-supervisor evidence;
|
||||
- deterministic prebuilt archives, checksums, SBOMs, signed binaries, and
|
||||
tested signing/recovery procedures; or
|
||||
- clean direct and public-proxy installation of the not-yet-published Beta 1
|
||||
tags.
|
||||
|
||||
## Beta 1 publication lane
|
||||
|
||||
Beta 1 is supported for learning, classroom projects, evaluation, prototypes,
|
||||
and compatibility feedback. It is not recommended as a production-stable
|
||||
dependency, and its interfaces may change.
|
||||
|
||||
- [x] Define beta support, security, compatibility, and macOS-provisional
|
||||
language.
|
||||
- [x] Establish the named public pre-beta Linux/Windows baseline.
|
||||
- [ ] Rerun the supported Go matrix and deterministic generation on the exact
|
||||
Beta 1 candidate.
|
||||
- [ ] Run the candidate-version freshness, bounded fuzz, vulnerability, and
|
||||
license gates.
|
||||
- [ ] Publish immutable `sando/v1.0.0-beta.1`, then
|
||||
`v1.0.0-beta.1`, from the same reviewed public commit.
|
||||
- [ ] Verify clean direct and public-proxy installs and record the result.
|
||||
- [ ] Add native macOS maintainer evidence before RC; community reports inform
|
||||
that work but do not replace maintainer responsibility.
|
||||
|
||||
## Milestone 1: contract freeze
|
||||
|
||||
@@ -126,8 +154,8 @@ Required before security/platform release-candidate work is declared complete:
|
||||
4. Run the complete evidence suite again from the exact public commit.
|
||||
5. Operate the official Sandwich Hime website on the RC runtime for a 14-day
|
||||
observation period with no unresolved Hime render, security, accessibility,
|
||||
or rollback regression. This is product dogfooding, not a dependency on EQL
|
||||
or another application's private repository.
|
||||
or rollback regression. This is product dogfooding, not a dependency on
|
||||
another application's private repository.
|
||||
6. Fix findings in a new RC; restart the observation period when the affected
|
||||
boundary warrants it.
|
||||
7. Finalize the changelog, supported-version table, migration notes, release
|
||||
|
||||
Reference in New Issue
Block a user