policy: maintain Linux as the release target

Publishes the exact allowlisted snapshot from the private Beta 2 development line. Historical platform evidence remains truthful; native Windows and macOS are no longer release gates or support promises. Material AI assistance was reviewed by the maintainer. Signed-off-by: Cole Speelman <crspeelman@gmail.com>
2026-08-16 17:50:00 -04:00
parent 4fef65f9b0
commit c11552b87a
14 changed files with 142 additions and 250 deletions
@@ -2,10 +2,11 @@

 # Repository verification tools

-These scripts are intentionally understandable shell and PowerShell rather than a release framework with hidden defaults.
+These scripts are intentionally understandable shell rather than a release
+framework with hidden defaults. The maintained verification and release path
+is Linux.

 - `verify.sh` runs root and nested-module tests and vet, builds `himesan`, checks the compiler-owned golden output, and proves two generation passes leave the same bytes and unchanged modification times. Set `HIMESAN_RACE=1` for race tests.
- `verify.ps1` provides the equivalent native Windows lane; pass `-Race` to include the race detector.
 - `check-licenses.sh` enforces the AGPL compiler / Apache runtime boundary and prevents generated application Go from inheriting an AGPL identifier.
 - `release-check.sh --version vX.Y.Z` is a clean-checkout technical preflight, including exact candidate-version and generated-provenance checks. Beta publication follows the narrower prerelease gates in `RELEASE.md`; release candidates and final v1 additionally use `--public` with a human-reviewed `HIMESAN_RELEASE_EVIDENCE_DIR`. The script never tags, pushes, publishes, or deploys.
 - `verify-public-install.sh --version vX.Y.Z` is a post-tag/publication check. It verifies exact `go-get=1` package routes, adds the nested runtime before installing the parent compiler, and exercises fresh direct-fetch and public-proxy caches without interactive Git credentials.
@@ -16,6 +17,9 @@ The release preflight invokes `govulncheck` from the official Go vulnerability p

 ## Preview automation status

-Forge workflows are intentionally excluded from the sanitized pre-1.0 public snapshot until the project has confirmed its own Gitea runner availability and reviewed locally hosted or otherwise pinned dependencies. Local `verify.sh`, `verify.ps1`, license, and release-preflight results are the preview gates.
+Forge workflows are intentionally excluded from the sanitized pre-1.0 public
+snapshot. The private development repository uses pinned Linux runners; the
+public source remains independently verifiable with `verify.sh`, the license
+check, and the Linux release preflight.

 If Gitea automation is later added to the public repository, pin every external action to a reviewed immutable commit, document its provenance, grant minimum permissions, and keep a local verification path. A secondary forge may host a sanitized, read-only discovery snapshot, but hosted workflows stay disabled there and it does not become a release or contribution authority.
@@ -253,23 +253,14 @@ go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./...
 	go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./...
 )

-printf '\n==> cross-compiling release binary smoke set\n'
+printf '\n==> building supported Linux release binary\n'
 for target in \
-	linux/amd64 \
-	linux/arm64 \
-	darwin/amd64 \
-	darwin/arm64 \
-	windows/amd64 \
-	windows/arm64; do
+	linux/amd64; do
 	target_os=${target%/*}
 	target_arch=${target#*/}
-	extension=''
-	if [[ "$target_os" == windows ]]; then
-		extension='.exe'
-	fi
 	CGO_ENABLED=0 GOOS="$target_os" GOARCH="$target_arch" \
 		go build -trimpath -ldflags "$compiler_linker_flags" \
-		-o "$artifact_dir/himesan-$target_os-$target_arch$extension" ./cmd/himesan
+		-o "$artifact_dir/himesan-$target_os-$target_arch" ./cmd/himesan
 done

 for required in \
@@ -289,7 +280,7 @@ if (( public_release == 1 )); then
 	fi
 	for evidence in \
 		legal-review.md \
-		cross-platform.md \
+		linux-platform.md \
 		security.md \
 		development-supervisor.md \
 		benchmark-methodology.md \
@@ -1,133 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-only
-
-[CmdletBinding()]
-param(
-    [switch]$Race
-)
-
-$ErrorActionPreference = "Stop"
-$RepoRoot = (Resolve-Path (Join-Path $PSScriptRoot "..")).Path
-Set-Location $RepoRoot
-
-function Invoke-Checked {
-    param(
-        [Parameter(Mandatory = $true)]
-        [string]$Label,
-        [Parameter(Mandatory = $true)]
-        [scriptblock]$Command
-    )
-
-    Write-Host "`n==> $Label"
-    & $Command
-    if ($LASTEXITCODE -ne 0) {
-        throw "$Label failed with exit code $LASTEXITCODE"
-    }
-}
-
-function Invoke-ModuleChecks {
-    param(
-        [Parameter(Mandatory = $true)]
-        [string]$Directory,
-        [Parameter(Mandatory = $true)]
-        [string]$Label
-    )
-
-    Push-Location $Directory
-    try {
-        Invoke-Checked "$Label`: go test" { go test ./... }
-        Invoke-Checked "$Label`: go vet" { go vet ./... }
-    }
-    finally {
-        Pop-Location
-    }
-}
-
-function Get-SandoSources {
-    if (-not (Test-Path "internal/compiler/testdata/golden" -PathType Container)) {
-        return @()
-    }
-
-    return @(Get-ChildItem "internal/compiler/testdata/golden" -File -Filter "*.sando" |
-        Sort-Object FullName)
-}
-
-function Get-GeneratedManifest {
-    $lines = foreach ($source in (Get-SandoSources)) {
-        $output = "$($source.FullName).go"
-        if (-not (Test-Path $output -PathType Leaf)) {
-            "missing  $output"
-            continue
-        }
-        $hash = (Get-FileHash -Algorithm SHA256 $output).Hash.ToLowerInvariant()
-        $modified = (Get-Item -LiteralPath $output).LastWriteTimeUtc.Ticks
-        "$hash  $modified  $output"
-    }
-    return ($lines -join "`n")
-}
-
-$TempRoot = Join-Path ([System.IO.Path]::GetTempPath()) ("himesan-verify-" + [guid]::NewGuid())
-New-Item -ItemType Directory -Path $TempRoot | Out-Null
-
-try {
-    Invoke-ModuleChecks "." "compiler module"
-    Invoke-Checked "compiler module: go build" {
-        go build -trimpath -o (Join-Path $TempRoot "himesan.exe") ./cmd/himesan
-    }
-
-    if (-not (Test-Path "sando/go.mod" -PathType Leaf)) {
-        throw "nested Apache runtime module sando/go.mod is missing"
-    }
-    Invoke-ModuleChecks "sando" "sando runtime module"
-
-    $Sources = @(Get-SandoSources)
-    if ($Sources.Count -eq 0) {
-        throw "compiler-owned golden .sando fixture is missing"
-    }
-    else {
-        $SourcePaths = @($Sources | ForEach-Object { $_.FullName })
-        $CheckArgs = @("run", "./cmd/himesan", "check") + $SourcePaths
-        $GenerateArgs = @("run", "./cmd/himesan", "generate") + $SourcePaths
-        Invoke-Checked "golden generation: read-only freshness check" {
-            & go $CheckArgs
-        }
-        $Before = Get-GeneratedManifest
-
-        Invoke-Checked "golden generation: first deterministic pass" {
-            & go $GenerateArgs
-        }
-        $First = Get-GeneratedManifest
-        if ($Before -cne $First) {
-            throw "generation changed committed output after check declared it fresh"
-        }
-
-        Invoke-Checked "golden generation: second deterministic pass" {
-            & go $GenerateArgs
-        }
-        $Second = Get-GeneratedManifest
-        if ($First -cne $Second) {
-            throw "repeated generation changed output bytes or an unchanged timestamp"
-        }
-
-        Invoke-Checked "golden generation: final freshness check" {
-            & go $CheckArgs
-        }
-    }
-
-    if ($Race) {
-        Invoke-Checked "compiler module: race tests" { go test -race ./... }
-        Push-Location "sando"
-        try {
-            Invoke-Checked "sando runtime module: race tests" { go test -race ./... }
-        }
-        finally {
-            Pop-Location
-        }
-    }
-
-    Write-Host "`n==> verification complete"
-}
-finally {
-    if (Test-Path $TempRoot -PathType Container) {
-        Remove-Item -LiteralPath $TempRoot -Recurse -Force
-    }
-}