policy: maintain Linux as the release target
Publishes the exact allowlisted snapshot from the private Beta 2 development line. Historical platform evidence remains truthful; native Windows and macOS are no longer release gates or support promises. Material AI assistance was reviewed by the maintainer. Signed-off-by: Cole Speelman <crspeelman@gmail.com>
This commit was merged in pull request #1.
This commit is contained in:
+22
-15
@@ -32,9 +32,17 @@ payloads before final v1, or hand-edited generated files.
|
||||
|
||||
## Go and platform support
|
||||
|
||||
The current beta targets Go 1.25 and Go 1.26. Support is based on point-in-time,
|
||||
maintainer-run release matrices, not an implication of continuous CI coverage.
|
||||
A Go support change is announced in release notes before it takes effect.
|
||||
The current beta targets Go 1.25 and Go 1.26 on Linux/amd64. Required release
|
||||
evidence runs in Linux CI and on Linux deployment hosts. WSL is treated as a
|
||||
Linux development environment. Native Windows, macOS, and other targets are
|
||||
not maintained release targets or release blockers; a successful build there
|
||||
is useful portability evidence, not a compatibility promise. A Go or platform
|
||||
support change is announced in release notes before it takes effect.
|
||||
|
||||
### Historical Beta 1 observations
|
||||
|
||||
The following table is retained because the tests genuinely ran. It records a
|
||||
point-in-time Beta 1 campaign and does not define the current support matrix.
|
||||
|
||||
The current public evidence is the exact Beta 1 source at commit
|
||||
`b7a84054d755e42285e50298e41e47f06a8325a5` (tree
|
||||
@@ -45,26 +53,25 @@ The current public evidence is the exact Beta 1 source at commit
|
||||
| Windows 11/amd64 on NTFS | 1.25.12, 1.26.5 | Native tests, race, vet, builds, generation, process cleanup, watcher boundaries, and temporary consumer compilation passed; privileged symlink and POSIX-only permission cases were not exercised |
|
||||
| Linux/amd64 on WSL2 with an ext4 checkout | 1.25.12, 1.26.5 | Tests, race, vet, builds, generation, focused filesystem/development cases, and license checks passed |
|
||||
| Linux/amd64 in isolated containers on a Linux server | 1.25.12, 1.26.5 | The earlier pre-beta baseline passed tests, race, vet, builds, deterministic generation, and license checks; this was not rerun on the exact Beta 1 commit |
|
||||
| macOS | — | Native maintainer validation pending; provisional for Beta 1 |
|
||||
| macOS | — | Not executed during the Beta 1 campaign |
|
||||
|
||||
The golden generated file had SHA-256
|
||||
`63fa75a3049a3a8a12d769d7f9b6b510dfe763baacf706775b75cef2c57a984f`
|
||||
on every tested Windows and Linux lane.
|
||||
on every tested Windows and Linux lane in that historical campaign.
|
||||
|
||||
The signed Beta tags and fresh direct/public-proxy installation were verified
|
||||
after publication. For Beta 1, add the nested runtime to an application module
|
||||
before installing the parent compiler at the same version; this avoids a Go
|
||||
module-cache path-selection ambiguity observed in the reverse order.
|
||||
|
||||
## macOS feedback
|
||||
## Portability feedback
|
||||
|
||||
Mac learners, teachers, and Go developers are warmly invited to try the beta.
|
||||
A useful compatibility report includes the macOS version, Intel or Apple
|
||||
Silicon architecture, `go version`, the exact command, and a minimal
|
||||
reproduction or diagnostic output. Ordinary compatibility reports belong on
|
||||
the canonical Gitea project. Suspected vulnerabilities must use the private
|
||||
route in [SECURITY.md](../SECURITY.md).
|
||||
Developers may try the beta on an unsupported target and report useful gaps. A
|
||||
good report includes the operating system and architecture, `go version`, the
|
||||
exact command, and a minimal reproduction or diagnostic output. Ordinary
|
||||
portability reports belong on the canonical Gitea project. Suspected
|
||||
vulnerabilities must use the private route in [SECURITY.md](../SECURITY.md).
|
||||
|
||||
Community reports can reveal gaps and help prioritize maintainer testing. They
|
||||
do not constitute an independent audit or shift responsibility for security
|
||||
review, triage, fixes, and release decisions to the community.
|
||||
Community reports can reveal gaps and help prioritize future work. They do not
|
||||
constitute an independent audit, create a support promise, or shift
|
||||
responsibility for security review, triage, fixes, and release decisions.
|
||||
|
||||
+20
-17
@@ -23,8 +23,10 @@ The named Windows and WSL2 platform runs used the exact public commit and tree
|
||||
above. The isolated server-container matrix preceded the final candidate and
|
||||
is retained only as supplementary Linux evidence. Hostnames, network addresses,
|
||||
account names, private paths, private repository identities, and private commit
|
||||
mappings are intentionally absent from this public ledger. Native macOS
|
||||
execution remains pending and is provisional for the beta.
|
||||
mappings are intentionally absent from this public ledger. These platform
|
||||
observations are historical evidence, not the current support matrix.
|
||||
Linux/amd64 is now the maintained release target; WSL is a Linux development
|
||||
environment, while native Windows and macOS are not release blockers.
|
||||
|
||||
## Beta 2 compiler publication addendum
|
||||
|
||||
@@ -48,7 +50,8 @@ focused process-tree/watcher/consumer tests, candidate-stamped version checks,
|
||||
and deterministic generation on Go 1.25.12 and Go 1.26.5. Clean isolated
|
||||
`GOPROXY=direct` and public-proxy-only installs produced
|
||||
`features:["lsp-stdio"]`; the public-proxy path also verified the retained
|
||||
runtime through `sum.golang.org`. Native macOS execution remains provisional.
|
||||
runtime through `sum.golang.org`. The Windows result is retained as historical
|
||||
portability evidence and does not create an ongoing support promise.
|
||||
|
||||
The Beta 2 language server is additive development tooling. Its tested
|
||||
security boundary includes protocol-only stdout; bounded header and message
|
||||
@@ -83,7 +86,7 @@ baseline commit.
|
||||
| URL scheme handling | ordinary/trusted URL test matrix | Pass for enumerated cases |
|
||||
| Filesystem boundaries | symlink, nested-module, VCS, ownership, stale-output tests | Pass for tested cases; see open findings |
|
||||
| Development proxy browser boundary | Host, Origin, Fetch Metadata, CSP, fragment and response tests | Pass for tested cases |
|
||||
| Platform behavior | Exact-candidate native Windows and executed Linux matrices; macOS cross-compilation | Windows/Linux pass for tested lanes; native macOS pending |
|
||||
| Platform behavior | Historical exact-candidate native Windows and executed Linux matrices | Windows/Linux passed for the tested lanes; current releases require Linux/amd64 evidence |
|
||||
|
||||
Coverage measures statements executed by tests. It is not branch completeness
|
||||
and is not evidence that the executed behavior is secure.
|
||||
@@ -92,7 +95,7 @@ and is not evidence that the executed behavior is secure.
|
||||
and reachable through its analysis. A clean result cannot detect unknown flaws,
|
||||
design errors, or vulnerabilities outside its model.
|
||||
|
||||
## Beta 1 native compatibility matrix
|
||||
## Historical Beta 1 compatibility matrix
|
||||
|
||||
These are maintainer-run, point-in-time results, not continuous CI and not an
|
||||
independent audit.
|
||||
@@ -102,7 +105,7 @@ independent audit.
|
||||
| Windows 11/amd64, NTFS | 1.25.12, 1.26.5 | Native PowerShell verifier with race; root/runtime tests, vet, trimpath build, freshness, two generation passes, process-tree cleanup, watcher boundaries, and temporary consumer compilation | Pass. Symlink-output rejection skipped because the test account lacked symlink privilege; the read-only-directory case is POSIX-only |
|
||||
| Ubuntu 20.04/amd64 under WSL2, native ext4 checkout | 1.25.12, 1.26.5 | Race-enabled verifier; root/runtime tests, vet, build, two generation passes, ten focused filesystem cases, five focused development-process/watcher cases, and license check | Pass. This is Linux execution under WSL2, not bare-metal or Linux/arm64 evidence |
|
||||
| Linux/amd64 server containers | 1.25.12, 1.26.5 | Earlier pre-beta root/runtime tests, vet, builds, race, licensing, and deterministic generation in sequential isolated official Go containers | Pass on the earlier baseline only. Container resources were capped at 1 CPU and 2 GiB; this is supplementary evidence, not an exact Beta 1 lane or Linux/arm64 evidence |
|
||||
| macOS | — | Cross-compilation only | Native maintainer execution pending; provisional for Beta 1 |
|
||||
| macOS | — | Cross-compilation only | No native Beta 1 evidence; not a maintained release target |
|
||||
|
||||
The generated golden `basic.sando.go` was 1,399 bytes and had SHA-256
|
||||
`63fa75a3049a3a8a12d769d7f9b6b510dfe763baacf706775b75cef2c57a984f`
|
||||
@@ -110,12 +113,12 @@ on every tested Windows and Linux lane. Repeated generation also preserved its
|
||||
timestamp. This demonstrates cross-host agreement for one compiler-owned
|
||||
fixture, not equivalence for every possible template.
|
||||
|
||||
Mac learners and Go developers are warmly invited to report ordinary
|
||||
compatibility results with macOS version, architecture, `go version`, exact
|
||||
command, and a minimal reproduction. Suspected vulnerabilities use the private
|
||||
route in [SECURITY.md](../SECURITY.md). Community reports help find gaps;
|
||||
maintainers remain responsible for reproducing security-relevant behavior,
|
||||
triage, remediation, and release decisions.
|
||||
Portability reports for unsupported targets may include the operating system,
|
||||
architecture, `go version`, exact command, and a minimal reproduction.
|
||||
Suspected vulnerabilities use the private route in
|
||||
[SECURITY.md](../SECURITY.md). Such reports help find gaps but do not create a
|
||||
support promise; maintainers remain responsible for security triage and fixes
|
||||
on the supported Linux target.
|
||||
|
||||
## Security-relevant design evidence
|
||||
|
||||
@@ -203,8 +206,9 @@ known-vulnerability scans, candidate-version provenance checks, native Windows
|
||||
and executed Linux matrices, and Windows/macOS cross-compilation on 2026-08-12.
|
||||
Signed annotated runtime and compiler tags were then published from that commit
|
||||
in that order. Fresh runtime-first installation passed through both direct Git
|
||||
resolution and the public Go proxy after normal proxy propagation. Native
|
||||
macOS and the other gaps below remain separate release decisions.
|
||||
resolution and the public Go proxy after normal proxy propagation. Future
|
||||
release decisions use the current Linux-only support policy rather than
|
||||
requiring this historical multi-platform campaign.
|
||||
|
||||
## Open assurance gaps
|
||||
|
||||
@@ -214,9 +218,8 @@ macOS and the other gaps below remain separate release decisions.
|
||||
- the signed annotated Beta tags and their common peeled commit were verified;
|
||||
prebuilt-artifact signing, checksums, SBOM, reproducible provenance, and key
|
||||
recovery remain incomplete;
|
||||
- native macOS, Linux/arm64, and Windows/arm64 execution remain outstanding;
|
||||
- Windows symlink rejection was not natively exercised because the test account
|
||||
lacked symlink privilege;
|
||||
- Linux/arm64 and non-Linux portability are outside the current maintained
|
||||
release target;
|
||||
- browser-parser differential and semantic property testing need expansion;
|
||||
- compiler input size, CPU, and memory have no built-in hard budget;
|
||||
- filesystem checks do not defend against a hostile local actor racing path
|
||||
|
||||
@@ -177,7 +177,7 @@ Sandwich Hime does not:
|
||||
## Open release work
|
||||
|
||||
- broaden semantic and browser-parser differential testing;
|
||||
- execute the native Windows/macOS security and process-lifecycle matrix;
|
||||
- execute the Linux/amd64 security and process-lifecycle release matrix;
|
||||
- complete signed release provenance, checksums, and SBOM evidence;
|
||||
- test the confidential reporting and signing-key recovery procedures; and
|
||||
- close or explicitly accept every finding listed in the evidence ledger before
|
||||
|
||||
+17
-19
@@ -28,17 +28,18 @@ private history or an indiscriminate Git mirror.
|
||||
|
||||
Beta 1 is deliberately earlier than a release candidate. It creates a real,
|
||||
repeatable install for learners and evaluators without claiming that the final
|
||||
v1 compatibility, native-platform, artifact, signing, or soak gates are
|
||||
complete.
|
||||
v1 compatibility, Linux release, artifact, signing, or soak gates are complete.
|
||||
|
||||
### Demonstrated for Beta 1
|
||||
|
||||
Public commit `b7a84054d755e42285e50298e41e47f06a8325a5` (tree
|
||||
`be9e118e38dfebed19f60403ededdadabe07d2aa`) passed maintainer-run Go
|
||||
1.25.12 and Go 1.26.5 matrices on native Windows/amd64, Linux/amd64 under WSL2,
|
||||
with the earlier pre-beta server-container run retained only as supplementary
|
||||
Linux evidence. The same generated golden SHA-256 was observed across the exact
|
||||
Beta Windows and Linux lanes.
|
||||
1.25.12 and Go 1.26.5 matrices on native Windows/amd64 and Linux/amd64 under
|
||||
WSL2, with the earlier pre-beta server-container run retained only as
|
||||
supplementary Linux evidence. The same generated golden SHA-256 was observed
|
||||
across the exact Beta Windows and Linux lanes. This is historical evidence,
|
||||
not the current support definition; Linux/amd64 is now the maintained release
|
||||
target.
|
||||
|
||||
Other demonstrated controls include:
|
||||
|
||||
@@ -52,7 +53,7 @@ Other demonstrated controls include:
|
||||
|
||||
### Not demonstrated yet
|
||||
|
||||
- native maintainer-run macOS execution; macOS is provisional for Beta 1;
|
||||
- final Linux/amd64 release-candidate evidence on the exact candidate;
|
||||
- stable final-v1 API, CLI, schema, diagnostic, and generated snapshots;
|
||||
- systematic browser-parser and `html/template` differential testing;
|
||||
- a long semantic fuzz campaign beyond bounded no-panic smoke;
|
||||
@@ -60,7 +61,7 @@ Other demonstrated controls include:
|
||||
- complete real-browser development-supervisor evidence;
|
||||
- deterministic prebuilt archives, checksums, SBOMs, signed binaries, and
|
||||
tested signing/recovery procedures; or
|
||||
- native macOS installation of the published Beta 1 tags.
|
||||
- independently reproduced Linux release artifacts, checksums, and SBOMs.
|
||||
|
||||
## Beta 1 publication lane
|
||||
|
||||
@@ -68,9 +69,8 @@ Beta 1 is supported for learning, classroom projects, evaluation, prototypes,
|
||||
and compatibility feedback. It is not recommended as a production-stable
|
||||
dependency, and its interfaces may change.
|
||||
|
||||
- [x] Define beta support, security, compatibility, and macOS-provisional
|
||||
language.
|
||||
- [x] Establish the named public pre-beta Linux/Windows baseline.
|
||||
- [x] Define beta support, security, and compatibility language.
|
||||
- [x] Establish the historical public pre-beta Linux/Windows evidence baseline.
|
||||
- [x] Rerun the supported Go matrix and deterministic generation on the exact
|
||||
Beta 1 candidate.
|
||||
- [x] Run the candidate-version freshness, bounded fuzz, vulnerability, and
|
||||
@@ -79,12 +79,10 @@ dependency, and its interfaces may change.
|
||||
`v1.0.0-beta.1`, from the same reviewed public commit.
|
||||
- [x] Verify clean runtime-first direct and public-proxy installs and record the
|
||||
result.
|
||||
- [ ] Add native macOS maintainer evidence before RC; community reports inform
|
||||
that work but do not replace maintainer responsibility.
|
||||
|
||||
## Milestone 1: contract freeze
|
||||
|
||||
Required before security/platform release-candidate work is declared complete:
|
||||
Required before security/Linux release-candidate work is declared complete:
|
||||
|
||||
- [ ] Decide and specify whether generic component function signatures are v1.
|
||||
- [ ] Inventory and freeze every exported `sando` symbol, trusted type,
|
||||
@@ -97,11 +95,11 @@ Required before security/platform release-candidate work is declared complete:
|
||||
output compatibility snapshots.
|
||||
- [ ] Define the v1 deprecation and security-support policy.
|
||||
|
||||
## Milestone 2: security and native-platform evidence
|
||||
## Milestone 2: security and Linux release evidence
|
||||
|
||||
- [ ] Run the minimum supported Go line and the latest two stable Go lines on
|
||||
native Linux, macOS, and Windows hosts.
|
||||
- [ ] Prove identical generated bytes across those hosts and exercise native
|
||||
Linux/amd64 runners and a Linux deployment-class host.
|
||||
- [ ] Prove identical generated bytes across those Linux lanes and exercise
|
||||
path, replacement, permission, race, process-tree, and watcher behavior.
|
||||
- [ ] Build a systematic differential corpus against Go's documented
|
||||
`html/template` safety baseline for overlapping supported contexts.
|
||||
@@ -147,7 +145,7 @@ Required before security/platform release-candidate work is declared complete:
|
||||
2. Publish signed `sando/v1.0.0-rc.1`, then signed `v1.0.0-rc.1` from the same
|
||||
reviewed public Gitea commit.
|
||||
3. Verify documented installs through fresh `GOPROXY=direct` and
|
||||
`proxy.golang.org` caches on supported Go versions and native platforms.
|
||||
`proxy.golang.org` caches on supported Go versions under Linux/amd64.
|
||||
4. Run the complete evidence suite again from the exact public commit.
|
||||
5. Operate the official Sandwich Hime website on the RC runtime for a 14-day
|
||||
observation period with no unresolved Hime render, security, accessibility,
|
||||
@@ -172,6 +170,6 @@ marketing. New features do not outrank a small stable contract.
|
||||
## Definition of confidence
|
||||
|
||||
“Ready for v1” means a reviewer can trace each promise to a stable public
|
||||
contract, executable evidence from supported native environments, and a signed
|
||||
contract, executable evidence from supported Linux environments, and a signed
|
||||
artifact built from the exact canonical source. It does not mean perfect,
|
||||
invulnerable, or finished forever.
|
||||
|
||||
Reference in New Issue
Block a user