Release Sandwich Hime v1 source and contribution policy
Signed-off-by: Cole Speelman <crspeelman@gmail.com>
This commit is contained in:
+37
-2
@@ -2,14 +2,49 @@
|
||||
|
||||
# Changelog
|
||||
|
||||
Sandwich Hime follows semantic versioning after final v1. Compiler and nested
|
||||
Sandwich Hime follows semantic versioning from v1.0.0. Compiler and nested
|
||||
runtime releases are versioned independently and listed together when they form
|
||||
one coordinated release.
|
||||
|
||||
## Unreleased
|
||||
## v1.0.0 — 2026-09-09
|
||||
|
||||
The coordinated compiler `v1.0.0` and runtime `sando/v1.0.0` release retains
|
||||
runtime ABI `sando.v1`. Canonical Gitea tags and release announcements establish
|
||||
version and artifact availability.
|
||||
|
||||
### Stable release contract
|
||||
|
||||
- Apply the v1 compatibility policy to the source syntax, generated public API,
|
||||
runtime API, CLI, diagnostics, and schemas on the maintained Linux/amd64 and
|
||||
Apple Silicon macOS/arm64 targets.
|
||||
- Promote runtime-first installation instructions to the exact final versions.
|
||||
- Retain best-effort security fixes for the latest stable v1 patch, without an
|
||||
SLA, independent-audit claim, or expanded platform support promise.
|
||||
|
||||
### Publication tooling
|
||||
|
||||
- Reject references to excluded operator documentation in exported Markdown,
|
||||
with positive and negative regression fixtures.
|
||||
- Keep operator/archive continuity out of the public roadmap and clarify
|
||||
stable public publication history, immutable version tags and separate
|
||||
private development storage.
|
||||
|
||||
### Documentation
|
||||
|
||||
- Finalize the version 1.0 prospective individual CLA with recorded-license
|
||||
grants, contributor safeguards, reciprocal stewardship commitments, and
|
||||
explicit paired contributor/Steward acceptance for future contributions.
|
||||
This does not assert that any contributor has signed, apply retroactively,
|
||||
assign copyright, or require signatures to use or learn from the project.
|
||||
Document commercial freedom and the compiler/runtime/application boundary
|
||||
without changing the software licenses.
|
||||
- Clarify Sandwich Hime as the primary identity and Hime-san as its tool name.
|
||||
- Retain DCO sign-off and existing output-permission records alongside the
|
||||
prospective CLA process; preserve prior contributions under their recorded
|
||||
terms.
|
||||
- Record the maintainer's explicit v1.0.0 deferral of offline restoration and
|
||||
independent second-person recovery without representing those drills as done.
|
||||
|
||||
- Give the installable `himesan` command its own Go package overview covering
|
||||
installation, generation, read-only checking, local development, editor
|
||||
integration, and machine-readable operational contracts.
|
||||
|
||||
@@ -1,15 +1,212 @@
|
||||
<!-- SPDX-License-Identifier: AGPL-3.0-only -->
|
||||
|
||||
# Individual contribution agreement — counsel-review draft
|
||||
# Individual contribution and stewardship agreement
|
||||
|
||||
**This draft is not active, is not offered for signature, and creates no rights or obligations. Public pre-1.0 contributions use DCO 1.1 instead.**
|
||||
**Version 1.0 — prospective contribution terms.** This version takes effect for
|
||||
new contribution intake when first published in the canonical public repository.
|
||||
An individual agreement is formed only through the explicit contributor and
|
||||
Steward acceptance in section 9. Existing contributions remain under their
|
||||
recorded licenses, DCO sign-offs and output permissions; publication does not
|
||||
create retroactive acceptance. Nobody must sign this agreement to learn, install,
|
||||
use or build applications with Sandwich Hime.
|
||||
|
||||
The intended agreement preserves contributor ownership. For each contribution, the contributor represents that they have the right to submit it and grants the project and recipients a perpetual, worldwide, non-exclusive, royalty-free copyright license to use, reproduce, modify, distribute, publicly perform, publicly display, and sublicense the contribution under the license identified by the contributed file.
|
||||
Purpose: keep the shared project available for lawful use, study, improvement
|
||||
and commercial work, without collecting contributors' ownership or giving
|
||||
official stewards a private route around the project's copyleft. The practical
|
||||
scope and practical limits are in
|
||||
[Licensing intent](docs/LICENSING_INTENT.md).
|
||||
|
||||
The intended patent grant covers patent claims the contributor can license that are necessarily infringed by their contribution alone or in combination with the project as submitted. Patent litigation over the contribution terminates the patent grant to the extent counsel determines lawful and appropriate.
|
||||
## 1. Parties and contribution scope
|
||||
|
||||
The intended agreement requires no copyright assignment. For AGPL-covered compiler contributions, it is not intended to grant a separate general right to proprietary-relicense contributor code; this does not restrict permissions already granted by a file's license, including Apache-2.0 or 0BSD. Emitted compiler scaffolding would need the narrow additional permission recorded in `OUTPUT_EXCEPTION.md`. The agreement does not promise that a contribution will be accepted or retained.
|
||||
The parties are the individual identified in the acceptance record ("you") and
|
||||
Cole Speelman, acting in his individual capacity as maintainer of Sandwich
|
||||
Hime ("the Steward"). Sandwich Hime is the project name, not a separate legal
|
||||
entity. An organization does not become a party merely because you work for it.
|
||||
|
||||
The contributor represents that disclosed material AI assistance was reviewed by a responsible human, that the human can make the same provenance and rights representations, and that no AI system is presented as the legal contributor.
|
||||
A "Contribution" is material you intentionally submit for inclusion in this
|
||||
repository after accepting this agreement, identified by a patch, commit or
|
||||
pull request in the contribution record. Ordinary discussion, support requests,
|
||||
confidential security reports, and material marked "not a contribution" are
|
||||
not submissions under this agreement. Earlier work requires a separate,
|
||||
explicit identification and acceptance; nothing applies retroactively by default.
|
||||
|
||||
If the project later considers activating a contribution agreement, qualified counsel review should address parties, definitions, governing law, notice, entity contributions, employer authorization, moral-rights treatment, patent language, and signature mechanics. Any active agreement would be announced prospectively. Until then, repository DCO sign-off is the operative contribution certification and does not activate this draft.
|
||||
The "Recorded License" is the file license and any explicit additional
|
||||
permission identified for that Contribution at submission, with the applicable
|
||||
repository revision retained. The current map is [LICENSES.md](LICENSES.md):
|
||||
AGPL-3.0-only for compiler/project material and Apache-2.0 for the nested
|
||||
runtime. Existing third-party material keeps its own terms. A later edit to
|
||||
the map does not change a Contribution's Recorded License.
|
||||
|
||||
## 2. Your ownership and the public grant
|
||||
|
||||
You retain ownership of rights you hold. You license your Contribution to the
|
||||
Steward and recipients under its Recorded License, including that license's
|
||||
copyright and patent provisions, conditions, duration, termination and cure
|
||||
rules. No copyright assignment, exclusive license or agency is created.
|
||||
|
||||
There is no additional general grant to sublicense or relicense your work
|
||||
under arbitrary terms. AGPL recipients obtain their rights under the AGPL;
|
||||
this agreement is not an alternate proprietary license. Permissions already
|
||||
granted by Apache-2.0 or another Recorded License are not narrowed here.
|
||||
|
||||
You remain free to use or license rights you actually own elsewhere. You may
|
||||
stop making future contributions at any time. That does not withdraw rights
|
||||
already granted to recipients who comply with the applicable license. No
|
||||
contribution fee, royalty, revenue share or exclusivity is required.
|
||||
|
||||
## 3. Generated-output permission is specific
|
||||
|
||||
Contributor-owned scaffolding intended to be emitted into generated output
|
||||
requires your explicit `Himesan-Output-Permission: v1.0` trailer on the signed-off
|
||||
submission, as described in [OUTPUT_EXCEPTION.md](OUTPUT_EXCEPTION.md). That
|
||||
record identifies the affected material and retains the exact permission text
|
||||
and version. This is an additional copyright permission, not an additional
|
||||
patent grant.
|
||||
|
||||
General CLA acceptance and DCO sign-off do not supply this separate grant.
|
||||
Without it, the Steward must reject or redesign the contribution so that your
|
||||
unpermitted material is not emitted. The grant does not license the compiler
|
||||
as a whole permissively or give rights in material you do not own.
|
||||
|
||||
## 4. Authority, provenance and patents
|
||||
|
||||
You represent that you own, or have sufficient authorization to submit and
|
||||
license, the Contribution under its Recorded License. Where an employer or
|
||||
another rights holder has an interest, obtain the necessary permission before
|
||||
submission. If that authority is uncertain, disclose the issue and withhold
|
||||
the affected material; your signature cannot grant someone else's rights.
|
||||
|
||||
Identify incorporated third-party material, its source and known restrictions.
|
||||
Disclose material AI assistance under the revision of
|
||||
[AI_CONTRIBUTIONS.md](AI_CONTRIBUTIONS.md) identified in your acceptance record;
|
||||
a responsible human must review the submission and make the representations.
|
||||
Later policy edits do not amend these contractual representations without
|
||||
express agreement under section 8.
|
||||
Do not send confidential prompts, personal data or secrets as provenance.
|
||||
Notify the Steward if you later learn a material representation was inaccurate.
|
||||
|
||||
The patent grant is the one in the Recorded License, including AGPL section 11
|
||||
or Apache-2.0 section 3 as applicable. This agreement adds no patent assignment,
|
||||
new retaliation trigger, or guarantee that no third party holds a patent. It
|
||||
does not purport to license claims outside your authority.
|
||||
|
||||
## 5. Steward commitments: preserve the common project
|
||||
|
||||
In accepting Contributions under this agreement, the Steward undertakes to:
|
||||
|
||||
- Publish accepted material included in an official public release under its
|
||||
Recorded License, with source available as that license requires. The
|
||||
agreement does not promise immediate publication of every submitted patch.
|
||||
- Preserve contributor copyright notices, required attribution, license and
|
||||
permission records. Public squashes must not misrepresent authorship; keep
|
||||
the original signed contribution record without publishing private intake data.
|
||||
- Not use this agreement to remove copyleft from contributor-owned AGPL code,
|
||||
issue an exclusive or proprietary license for that code, or sell a paid
|
||||
exception to its source-sharing duties. The expressly recorded output
|
||||
permission remains the narrow exception already described above.
|
||||
- Not seek a private side agreement to evade that official stewardship
|
||||
commitment. This is a promise about the Steward's official use of accepted
|
||||
material, not a restriction on a contributor's independent use of their work.
|
||||
- Give no sponsor, purchaser or voting majority authority through this
|
||||
agreement to acquire contributor ownership or override existing grants.
|
||||
- Before voluntarily transferring official stewardship, obtain the successor's
|
||||
written assumption of these stewardship obligations. Delegating maintenance
|
||||
does not itself release the Steward from contractual obligations or transfer
|
||||
contributor copyrights.
|
||||
|
||||
These are commitments by the contracting Steward, not new downstream license
|
||||
conditions. They do not bind unrelated forks or non-signing third parties,
|
||||
restrict permissive-license freedoms, or confer authority over rights that
|
||||
another person owns. Retained public licenses remain available independently
|
||||
of changes in maintainers, sponsorship or repository ownership.
|
||||
|
||||
## 6. Contributor and maintainer safeguards
|
||||
|
||||
Contributions are voluntary. Neither party promises that a patch will be
|
||||
accepted, merged unchanged, maintained indefinitely or kept in every future
|
||||
version. Removing a feature does not revoke licenses already granted.
|
||||
|
||||
No employment, partnership, governance seat, support obligation, indemnity or
|
||||
obligation to fund litigation is created. Warranty disclaimers and liability
|
||||
limits remain those in the Recorded License, subject to mandatory law. You
|
||||
are not asked to certify worldwide freedom from infringement or waive all
|
||||
claims against the Steward.
|
||||
|
||||
No blanket moral-rights waiver is requested. To the extent law permits, you
|
||||
consent to ordinary licensed editing, combination, compilation and distribution
|
||||
of the Contribution, while retaining protection against false attribution or
|
||||
endorsement. Neither party may use the other's name to imply an endorsement
|
||||
that was not given. This is not a power to forbid lawful criticism or forks.
|
||||
|
||||
The Steward may coordinate compliance reports but receives no assignment,
|
||||
power of attorney or assumed standing to litigate another owner's copyright.
|
||||
Separate authority may be necessary for particular enforcement action.
|
||||
|
||||
## 7. Commercial freedom and license limits
|
||||
|
||||
Users may charge for lawful services, support, distribution and applications
|
||||
subject to the relevant software licenses. A complying commercial competitor
|
||||
or independently branded fork does not breach this agreement merely by being
|
||||
successful, and upstream contribution is not mandatory.
|
||||
|
||||
No customer must sign this CLA to use the software. A blanket SaaS prohibition,
|
||||
competition veto, moral-use test or mandatory payment to the project is not
|
||||
added to the AGPL. Network-source duties come from the applicable license;
|
||||
they do not automatically reach applications built with the compiler.
|
||||
|
||||
## 8. Changes, disputes and succession
|
||||
|
||||
Changing this document or the governance policy does not amend an accepted
|
||||
agreement. Any amendment requires the affected parties' express agreement to
|
||||
identified new terms; continued use of the software is not acceptance.
|
||||
Contract disputes do not retract lawful downstream grants or add license
|
||||
termination grounds beyond the relevant software license.
|
||||
|
||||
The proposed governing law is Ontario law and applicable federal Canadian law,
|
||||
without excluding non-waivable rights or remedies available under applicable
|
||||
law. The parties should first try good-faith written resolution where practical;
|
||||
no mandatory arbitration, class-action waiver or bar to urgent relief is added.
|
||||
This agreement makes no guarantee about a particular court's interpretation.
|
||||
|
||||
## 9. Acceptance and minimal records
|
||||
|
||||
Identify version 1.0 using an immutable canonical commit containing this text
|
||||
and the incorporated AI policy, not a moving branch link. The contributor sends
|
||||
the statement below with their name, date and identified contribution through
|
||||
their canonical Gitea account. A public pull-request comment is sufficient if
|
||||
the contributor chooses to make it public. For private acceptance, request a
|
||||
private contact channel from the maintainer before sending personal details.
|
||||
Do not post employer documents, private contact details or identity documents.
|
||||
|
||||
> I agree to the Sandwich Hime Individual contribution and stewardship agreement
|
||||
> version 1.0 and its incorporated AI policy at canonical commit [full commit],
|
||||
> for contribution [pull request or commit]. I intend this statement, sent from
|
||||
> my account and signed with my name and date, as my electronic acceptance.
|
||||
|
||||
The Steward must reply with explicit matching acceptance of the identified
|
||||
agreement and contribution before merging it. Retain both statements, their
|
||||
dates/account identifiers, the exact agreement and policy texts with SHA-256
|
||||
digests, and the contribution's Recorded License and source identifiers.
|
||||
Neither a DCO sign-off, a merge, nor silence substitutes for this exchange.
|
||||
Later contributions need their own acceptance unless both parties expressly
|
||||
include future intentional submissions under that exact agreement version.
|
||||
Every commit still requires DCO sign-off; affected output scaffolding still
|
||||
requires its separate explicit permission.
|
||||
|
||||
Keep private acceptance and any necessary authority records in restricted
|
||||
maintainer storage, not in the public source snapshot. Do not request a home
|
||||
address, government identification or unrelated employer/customer records.
|
||||
The public attribution and sign-offs the contributor intentionally submits are
|
||||
distinct from private intake records. The Steward uses retained records only
|
||||
to administer contributions, document rights and handle related disputes, and
|
||||
does not sell them or repurpose contacts for marketing.
|
||||
|
||||
A contributor may request access, correction or deletion through the same
|
||||
private channel. Retain only records reasonably necessary to substantiate grants
|
||||
still relied upon or meet applicable legal obligations; delete unnecessary
|
||||
copies and explain any retention needed when responding to a request.
|
||||
Withdrawing from future participation does not revoke valid existing grants.
|
||||
If an individual's authority does not cover employer-owned material, do not
|
||||
accept it until the rights holder's authorization is recorded. A separate
|
||||
entity agreement may be needed; this document does not bind an employer by
|
||||
assumption.
|
||||
|
||||
+15
-3
@@ -8,7 +8,19 @@ Repository maintainers may temporarily disable issue or patch intake during the
|
||||
pre-1.0 period; do not route around a closed intake channel by sending
|
||||
unsolicited private patches.
|
||||
|
||||
Public pre-1.0 contributions use Developer Certificate of Origin 1.1 sign-off. The proposed `CLA.md` is an inactive draft, is not a condition of contribution, and creates no contributor or project obligations. If a contribution agreement is ever activated after legal review, the project will announce its prospective terms rather than silently applying the draft.
|
||||
New public contributions use DCO 1.1 sign-off and the prospective
|
||||
[Individual contribution and stewardship agreement, version 1.0](CLA.md).
|
||||
The agreement starts with this version's first canonical publication and binds
|
||||
only people who expressly accept it; no earlier contribution is retroactively
|
||||
covered. [Section 9](CLA.md#9-acceptance-and-minimal-records) gives the short
|
||||
contributor statement and matching maintainer acceptance. A public Gitea
|
||||
pull-request comment can record it, or contributors can request a private
|
||||
channel first. Never post private identity or employer documents.
|
||||
|
||||
The agreement preserves ownership, the existing public licenses and reciprocal
|
||||
official-steward duties. See [Licensing intent](docs/LICENSING_INTENT.md).
|
||||
Learning, downloading, using Hime, and building private or commercial applications
|
||||
require no contribution agreement. Ask ordinary usage questions without signing.
|
||||
|
||||
For local work:
|
||||
|
||||
@@ -20,7 +32,7 @@ go vet ./...
|
||||
./scripts/check-licenses.sh
|
||||
```
|
||||
|
||||
Changes require focused tests, stable diagnostics, formatted generated goldens when applicable, documentation for public behavior, and a signed-off commit (`git commit -s`). The sign-off certifies the [DCO](DCO.txt); it is not a copyright assignment or acceptance of the inactive CLA. Do not commit production data, private application fixtures, secrets, build candidates, or developer cache files.
|
||||
Changes require focused tests, stable diagnostics, formatted generated goldens when applicable, documentation for public behavior, and a signed-off commit (`git commit -s`). The sign-off certifies the [DCO](DCO.txt); it is not a copyright assignment or a substitute for the separate agreement acceptance. Do not commit production data, private application fixtures, secrets, build candidates, or developer cache files.
|
||||
|
||||
The project requires no copyright assignment. Ownership remains determined by applicable law and any employer or other agreement. Contributors submit each file under the license identified for that repository area, and the DCO records their certification that they have the right to do so. Material AI assistance must follow [AI_CONTRIBUTIONS.md](AI_CONTRIBUTIONS.md). Review considers provenance, safety, maintenance cost, compatibility, and fit—not just whether code passes tests.
|
||||
|
||||
@@ -30,6 +42,6 @@ If a compiler contribution adds or changes contributor-owned scaffolding that Hi
|
||||
Himesan-Output-Permission: v1.0
|
||||
```
|
||||
|
||||
That trailer records the contributor's grant of the additional permission in [OUTPUT_EXCEPTION.md](OUTPUT_EXCEPTION.md) for the affected contribution. DCO sign-off does not supply that separate grant. Maintainers must preserve the signed grant in the private contribution record even when a sanitized public snapshot uses fresh history. A patch without it must not cause contributor-owned text to be emitted; maintainers must reject or redesign such a patch rather than assume permission.
|
||||
That trailer records the contributor's grant of the additional permission in [OUTPUT_EXCEPTION.md](OUTPUT_EXCEPTION.md) for the affected contribution. DCO sign-off does not supply that separate grant. Maintainers must preserve the signed grant in the private contribution record even when development commits are squashed into a public publication commit. Public attribution must remain accurate; squashing does not transfer ownership. A patch without it must not cause contributor-owned text to be emitted; maintainers must reject or redesign such a patch rather than assume permission.
|
||||
|
||||
Potential vulnerabilities follow [SECURITY.md](SECURITY.md), not the ordinary contribution channel. Do not place confidential vulnerability details in an issue or patch description.
|
||||
|
||||
+28
-2
@@ -4,10 +4,36 @@
|
||||
|
||||
Sandwich Hime is founder-led. Cole Speelman is lead maintainer and has final authority over product direction, merges, releases, project identity, and security coordination. Authority is exercised through reviewable public releases, written rationale for material public decisions, and the published compatibility and release policies. Publishing a prerelease creates only the support commitment stated for that version; it does not transfer stewardship.
|
||||
|
||||
Pre-1.0 contributions use the DCO process described in `CONTRIBUTING.md`; the CLA draft is inactive. Acceptance is never guaranteed. Maintainers may close work that expands the product beyond an HTML-first, ahead-of-time Go template engine, weakens fail-closed safety, couples the runtime to a framework, or imposes unsustainable maintenance.
|
||||
New contributions use the DCO and prospective versioned agreement process in
|
||||
`CONTRIBUTING.md`. Acceptance is never guaranteed. Maintainers may close work
|
||||
that expands the product beyond an HTML-first, ahead-of-time Go template engine,
|
||||
weakens fail-closed safety, couples the runtime to a framework, or imposes
|
||||
unsustainable maintenance.
|
||||
|
||||
Maintainers disclose relevant employment or financial conflicts and recuse when a conflict would compromise review. If the project reaches three maintainers, no single employer may control a majority of seats.
|
||||
|
||||
Repository ownership, domain control, package namespace, release signing, and security recovery must not depend on a sponsor account. Before a supported v1.0.0 release, at least two independent humans must hold documented recovery capability. Succession may transfer official stewardship to a person or mission-aligned organization committed to the license map, public source releases, and trademark policy.
|
||||
Repository ownership, domain control, package namespace, release signing, and security recovery must not depend on a sponsor account. Independent recovery capability remains a governance aim; the maintainer explicitly deferred offline restoration and second-person recovery/verification for v1.0.0. They remain unproven assurance follow-ups in `ROADMAP.md`, not a claim of resilient stewardship. Succession may transfer official stewardship to a person or mission-aligned organization committed to the license map, public source releases, and trademark policy.
|
||||
|
||||
The project does not accept copyright assignment as a condition of contribution. It will not represent that it can proprietary-relicense contributor-owned code unless it has permission from every rights holder whose permission is required. This governance statement does not alter rights already granted by an applicable file license.
|
||||
|
||||
## Shared value and independent stewardship
|
||||
|
||||
Official stewardship preserves the compiler's open, reciprocal licensing.
|
||||
Commercial users, paid services and compliant independent forks are welcome;
|
||||
funding does not purchase ownership, a governance seat, a veto, or authority to
|
||||
erase attribution. Maintainers must not use a contribution agreement or private
|
||||
side deal to remove copyleft from accepted contributor-owned AGPL work. The
|
||||
existing runtime and output permissions remain deliberate separate boundaries.
|
||||
|
||||
Material licensing, governance and stewardship transfers require a public
|
||||
rationale and respect for recorded rights; a vote or repository transfer cannot
|
||||
supply someone else's copyright permission. A successor to a contribution
|
||||
agreement must expressly assume its steward obligations. Preserve accessible
|
||||
released source and provenance so lawful community continuation remains possible
|
||||
without ownership of official domains, release accounts or marks. This is not a
|
||||
promise of perpetual free hosting or a restriction on independent fork rights.
|
||||
|
||||
The reciprocal agreement requires explicit contributor and Steward acceptance.
|
||||
Publication alone does not bind a contributor, an earlier submission or an
|
||||
unrelated third party. No agreement is required to learn or use the software.
|
||||
See [Licensing intent](docs/LICENSING_INTENT.md) for the distinctions and limits.
|
||||
|
||||
+5
-1
@@ -36,4 +36,8 @@ SPDX identifiers state the applicable license for comment-capable source and doc
|
||||
|
||||
The snapshot exporter's `PUBLIC-SNAPSHOT.json` and `PUBLIC-SNAPSHOT.sha256` are generated factual provenance records and intentionally carry no inline SPDX comment. They do not change the license of any listed file.
|
||||
|
||||
These are practical project licensing terms, not legal advice or a prediction of how every jurisdiction will classify a particular work. The inactive CLA draft and pre-registration trademark policy say so explicitly. Qualified legal review remains prudent before changing these terms, activating a CLA, registering marks, or making a fact-specific licensing decision; it is not represented as a prerequisite to publishing the current narrowly scoped public beta.
|
||||
These are practical project licensing terms, not a prediction of how every
|
||||
jurisdiction will classify a particular work. The prospective contribution
|
||||
agreement and pre-registration trademark policy preserve that distinction.
|
||||
Professional advice may help with a specific dispute or change in circumstances;
|
||||
it is not a prerequisite to this release and is not claimed to have occurred.
|
||||
|
||||
@@ -1 +1 @@
|
||||
{"schema_version":2,"project":"sandwich-hime","export_policy":"exact-allowlist-v1","export_mode":"release","file_count":127,"allowlist_sha256":"4fa75caba7d96db619006b2d961da726e5a5c44c724a73a64bb9770c542d7e17","manifest_sha256":"370420e042f66865fc475047ba53d872b269d85b071ae62081d67b59dac89eb4"}
|
||||
{"schema_version":2,"project":"sandwich-hime","export_policy":"exact-allowlist-v1","export_mode":"release","file_count":128,"allowlist_sha256":"4f067a37de73082f3534ebfeb5a73b53b37ace9e4c6b21956405e2fefacbeb38","manifest_sha256":"90192f06c4ae7182834e5c1bc6890568698635b71530cb9593fb946ea2e6b3f4"}
|
||||
|
||||
+20
-19
@@ -2,23 +2,23 @@
|
||||
658ba4b4645426f8c3249337f47669074ae9249a31703dcd9ea4c1afec45e20b ./.gitattributes
|
||||
d5ae411fb422b2388cac220f9655900eecbc49ece961b2bb2a6610347733b756 ./.gitignore
|
||||
98f663ab0f376b4550094465ec2e06192d1e0b0707604ec6794f20b0d10952c1 ./AI_CONTRIBUTIONS.md
|
||||
eb5a0df1c6c3392d50e7df2a45af25c7e1586edd02800a932b6e1429c051d852 ./CHANGELOG.md
|
||||
b696cab3cf482ff5737501371cca749369b119351383e698ced42bcdbcbfc8ae ./CLA.md
|
||||
797e884105738fc931b585b695424f43ec5f296d8ab9bba5191b096e87a9e2c2 ./CONTRIBUTING.md
|
||||
1b8da729e4311d8839683177ae917927d6c9e28b5e82f5d9778031b737bb7d88 ./CHANGELOG.md
|
||||
9f0d4fd40cb2e789a6007d29fe31e00391c687b6cfd4941f3b69cbb2c5e14b03 ./CLA.md
|
||||
018d21c429ef5a94b2bc5b5535086bba0b2b3849d45c5cfff3e758622a76c722 ./CONTRIBUTING.md
|
||||
86d7e49d5d90e0f98a4ad0f14b5d8b9f11ed09a1e29ecdf27388316b28e195e8 ./COPYRIGHT
|
||||
f7ac75b443f4ca16b503241344b41aeff9503b0c30bedc2b119551d83cb0fa90 ./DCO.txt
|
||||
8ac46ef4e559f0bb43a8acb8cf6013052e09d41aa591a25c5e6fd462179eb067 ./GENERATED_CODE.md
|
||||
a4570d054f072d33b8f17b0c8b162a6ee0ca37d7df2b1aee7e4b728ab350a892 ./GOVERNANCE.md
|
||||
2c206b42bf864ff6b2e52fa83d536f209601601c272753f4c09d1e8f44b9c8f9 ./GOVERNANCE.md
|
||||
0d96a4ff68ad6d4b6f1f30f713b18d5184912ba8dd389f86aa7710db079abcb0 ./LICENSE
|
||||
9957e4aea02effb4d4b8012a3cc0e2d6ee1ce8be3761555c2c3e8aee27a5ee08 ./LICENSES.md
|
||||
4db1cfa504d3c80e06a3b3fde2854b3d01fbd2e5498d5f28d257297cd79b88c2 ./LICENSES.md
|
||||
b6aa08e5ccaec3c5dccdc19d7cd7f54a70adae4d57966263c7aa353c7ba70e08 ./MAINTAINERS.md
|
||||
6638db2f1fba831c79de835ce95c847a5b36c5b5c693b99a28655b2d096cc440 ./OUTPUT_EXCEPTION.md
|
||||
80de7a9ede0fbe2f364456e72b08c5a4b965ea656eaab63f3e1d246abeb9c01e ./README.md
|
||||
14fbed2a6de1496d7ad3783bac1b79f3f340de72545fe0dcf39de829622d7d32 ./RELEASE.md
|
||||
d4ae7927633d42851581d2bcbc94777aef9853b4880883cc50bfc94ce0c78842 ./ROADMAP.md
|
||||
b9ee0e394494a66ba6291a8e06a14fd159ba9fb3f46997e1b2de03e1cc2ef77c ./SECURITY.md
|
||||
007ffcafd32b50ed6ba4241ced90ef2e22a79cc7ad10f768e9e1f9560453b41f ./README.md
|
||||
fd2f45bb683d804afc127414e88e6b8ab75754af0596efe58fcb4ca3f4a55b9f ./RELEASE.md
|
||||
953e226cb5179c17b1b2ce091653cbdaf83e92dd4913cc3b34a3cc893843496f ./ROADMAP.md
|
||||
44a895f8a738d21121379a5a417445ecc953f2ebfb64a7e575543769f642d1b6 ./SECURITY.md
|
||||
d566b8b27777cb33209602df81d654a94072ad875440c089ac41764a349b6c17 ./SPEC.md
|
||||
3d9e680cdfe147df7cc9ff29ecf1d3e566e9cd559ae84db4880e559b9c7c7205 ./TRADEMARKS.md
|
||||
8906258cc7aaadf03bd7e84b69efc3be6a01d1c392b0711fbcee9abf4863b25b ./TRADEMARKS.md
|
||||
e2ce8cbc43e4575984839b61332207f7c90e2848fa270d4c68dbc5fc394f28e7 ./cmd/himesan-release/main.go
|
||||
9dda7402f76b38d417981f9e7658880b592c282c00163a3fdbfb0ab55e1edcba ./cmd/himesan/contract_test.go
|
||||
d53548ffa05a386bd869cf6b70d1ebe3397eb49bf0c05d9dc48ed94ed85a052c ./cmd/himesan/doc.go
|
||||
@@ -33,14 +33,15 @@ e6fb36b274bf44143497b2af454e9ee0fabe6122f935cbf97e785a003277e211 ./contracts/hi
|
||||
1ecbba46f8b1b2d548a01d7e98afae17b2dd17a814338ff1f88db885655d1c07 ./docs/ARCHITECTURE.md
|
||||
c26f1f2030f0661aaf3bab963efc132aa63e8fae61be05ff18b4c9c8bc35cb0d ./docs/BENCHMARKS.md
|
||||
015e15c7b00edd0f5d3d4906745f0a6def526cb66422aa27eb8b5c6a935d9e3d ./docs/BENCHMARK_RESULTS.md
|
||||
5c3a62fed80ca28d56558b8c75e8b5be8ba7d2554127adf4609d96da314e85b0 ./docs/BRAND.md
|
||||
60f0c1257cfce8388a252a105042be57c2978820d37ef81e46c6d3a49474fde3 ./docs/COMPATIBILITY.md
|
||||
ae6043d4687708ce583e15e064c3baec2d9735b499a0f7c56a166d4bac5b18da ./docs/BRAND.md
|
||||
4e9085e89db89427849509ab36a59e0e06243e65c65cb948da8f577a9d043411 ./docs/COMPATIBILITY.md
|
||||
d1b4ef192e02b59a9d8d0eb3b1072392e633116433fa308f6ca9bbe17b75e213 ./docs/DEVELOPMENT_SERVER.md
|
||||
4d92dc88ef33d4f7d952de039f842e54a3f3bfb4dbe56debf7ddb6e6c4a428f6 ./docs/DIAGNOSTICS.md
|
||||
a62cc7174f3c92d8ef77e4bd9607fbf5d4b80bc514ff05bd433c02a9b0578f18 ./docs/LANGUAGE_SERVER.md
|
||||
32253dbe59d9b0da40354b48c2e54feb8c38d441b41efba046125571d3dabb50 ./docs/SECURITY_EVIDENCE.md
|
||||
f66134e7a45a378e09fda4098d4fc706a280bb4ffdafe42a38a875f6ff82b3bb ./docs/LICENSING_INTENT.md
|
||||
c80d0ee5d2b467c696f45bac26fedc5cce04cc69148d42a3d5a103f8760da515 ./docs/SECURITY_EVIDENCE.md
|
||||
e600caf17a87997de330ca787bfc5f16c1b20e07f467f8d1ad450e96e2421910 ./docs/THREAT_MODEL.md
|
||||
978c6fdb8ed82aa2b118bbfb3d6217adf8edf425370ecdffdfc96ac24a9cbdce ./docs/V1_RELEASE_PLAN.md
|
||||
96c5be9c958c6005c7d1fcea3843a71f501b10b5d12b545906ae1cfdd9a771db ./docs/V1_RELEASE_PLAN.md
|
||||
f27c46ca63707bb8cc570eab1ea521824e94bc59b1d153998a5e91c2c7340d16 ./go.mod
|
||||
ca0bf5051d356d2602f46201fb1637ce48b629ad42161877eec13f743f215dc5 ./internal/compiler/abi_test.go
|
||||
d891b9b075617050471b2ca34de73d926aaebde4ec638a5039b0d5001d3172f4 ./internal/compiler/analysis.go
|
||||
@@ -98,7 +99,7 @@ d8c6f37c94ef426fc2d95c82331265f7d700d2e2a23100ad78c92849280ff6d8 ./internal/ver
|
||||
a1ee0ec44dc45f01a3357cf93e13a81587af7f061497c25df374e2a88231f3b7 ./internal/version/version_test.go
|
||||
e8a3026ec920d7312f843e2001e50ae4e34fd1ba5f9b2ae25a6113de1fa88385 ./sando/COPYRIGHT
|
||||
c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4 ./sando/LICENSE
|
||||
9b9b09b595658cf65aef8f7ace9cc955f026cdd71ece0f79671bfada8bd9c260 ./sando/README.md
|
||||
e66858232f401e112bd5f072943bc286e9a8564ad77558cdf115c023940ef318 ./sando/README.md
|
||||
acfbbc860417aeabba486ca4fea530e711c3e488bc3f5f6588db102b8a58bec2 ./sando/api_contract_test.go
|
||||
7e862661f19fc9fcd694ef64e65fda898186c51836335c27c21397e8dcf09c05 ./sando/benchmark_test.go
|
||||
7ec3fe73755a385e0950b9fbf833dd4b6a753a769ab743e97b9d94e77370a32c ./sando/component.go
|
||||
@@ -110,17 +111,17 @@ ed2b8d8040689c608623d30085a55678ae3c9d70a8a40a42435e04bff47a31ab ./sando/testda
|
||||
85621a44c730582f4410ac2c70418b739fb55e916f7e6b73a1a619982c459572 ./sando/write.go
|
||||
b188917e258890e6b6e4840a6fd946fc9a77cabc2068da3764f221e4a6a5df97 ./sando/write_test.go
|
||||
6ea995e9d7d22e09a13065a6e340df4efa0f1860b0b42409f84835c93f29962c ./scripts/PUBLIC_SNAPSHOT.md
|
||||
2d152851bc77f6eb5ca842a8021cde386a3cae91db819cd99cedc31b3b62518f ./scripts/README.md
|
||||
0482438a902e1f5368af3707c1348007dc0c2efeb854be85bf4f410e6d2f4a1f ./scripts/README.md
|
||||
81ab4c10a436bc9b345828a55c2fe446f297fa6cfd1debfe95e1082b6e28c969 ./scripts/check-licenses.sh
|
||||
3adba1428df83d6180d4fa3c683f0604dc7cdc0c4358f3dae7595189cc40f949 ./scripts/export-public-snapshot.sh
|
||||
f391ac912cdeb6b139d4feaec29a992cb53faea0fc4bbe805fd380450b238f7c ./scripts/native-gate.sh
|
||||
a038a002f0c895fef38a7265bcb7df01efdda57de5c4d36d0dc7c8e377798a95 ./scripts/package-macos.sh
|
||||
7d1e3606f3159e0d5d222bb5b02171ad90bb2c42b0e041042dcf8e6b7692c40a ./scripts/package-native.sh
|
||||
1fddbdf81e86f4310a603cedd0f24a39d6c62d810c7e1e2e6c5f7bff1d1d4198 ./scripts/public-snapshot-lib.sh
|
||||
4fa75caba7d96db619006b2d961da726e5a5c44c724a73a64bb9770c542d7e17 ./scripts/public-snapshot.allow
|
||||
ed17f6225971af8ca9ba88dc53f307f46dcc6cb5d9f3b08d42c466ac4d0e4214 ./scripts/public-snapshot-lib.sh
|
||||
4f067a37de73082f3534ebfeb5a73b53b37ace9e4c6b21956405e2fefacbeb38 ./scripts/public-snapshot.allow
|
||||
8fa4ee6c6ae80c261a8f5c1ff18a89185b4ce6472ccb577e1daf61afaa146e14 ./scripts/release-check.sh
|
||||
494cf5573cc6a891d4243ec01a98c43263de75090cb3b55c9c398e545b1ec1a8 ./scripts/sign-notarize-macos.sh
|
||||
7c65325664e95df1a63262bc440a599fb799b36123a68c5cc26cfb81ddd08efa ./scripts/test-public-snapshot.sh
|
||||
485f2eb4bba187e22dae820e75b4fa4ee807a1e526f21de08108c3e987390bcb ./scripts/test-public-snapshot.sh
|
||||
39a80708b1c1a64c837032c6570e77dea28b2c6e6058eea40efac63ad5827431 ./scripts/verify-consumer.sh
|
||||
ddcb5602a51a515ee6649e26f27d919addb0590abdcc095c374c90f5b0c2f8a3 ./scripts/verify-public-install.sh
|
||||
1673257efa50b906363ccab45f4ebcf7cb377185861a1c37221c98292c2c7cf6 ./scripts/verify-real-browser.sh
|
||||
|
||||
@@ -42,12 +42,15 @@ request object, or production server.
|
||||
|
||||
## Status
|
||||
|
||||
`v1.0.0-rc.1` is the current release candidate for both the compiler and the
|
||||
independently tagged runtime. The intended v1 source syntax, generated API,
|
||||
runtime API, CLI, diagnostics, and schemas are frozen except for
|
||||
release-blocking corrections. It remains a semantic-version prerelease while
|
||||
the project completes its public observation period; a finding is fixed in a
|
||||
new RC rather than by moving either tag.
|
||||
This is the source and documentation for compiler `v1.0.0` and independently
|
||||
tagged runtime `sando/v1.0.0`. The v1 source syntax, generated API, runtime
|
||||
API, CLI, diagnostics, and schemas follow the
|
||||
[v1 compatibility policy](docs/COMPATIBILITY.md). Corrections receive new
|
||||
immutable versions rather than moving a published tag.
|
||||
|
||||
The commands below target that final pair. Canonical Gitea tags and release
|
||||
announcements establish version and artifact availability; check them before
|
||||
installing a newly announced version.
|
||||
|
||||
Linux/amd64 and Apple Silicon macOS/arm64 are the maintained v1 execution and
|
||||
release targets. Native release evidence runs with pinned Go 1.26.7 and Go
|
||||
@@ -64,13 +67,13 @@ decisions on both supported native targets.
|
||||
Inside an application module, add the small runtime first:
|
||||
|
||||
```sh
|
||||
go get gamertan.com/sandwich-hime/sando@v1.0.0-rc.1
|
||||
go get gamertan.com/sandwich-hime/sando@v1.0.0
|
||||
```
|
||||
|
||||
Then install the matching release-candidate compiler:
|
||||
Then install the matching compiler:
|
||||
|
||||
```sh
|
||||
go install gamertan.com/sandwich-hime/cmd/himesan@v1.0.0-rc.1
|
||||
go install gamertan.com/sandwich-hime/cmd/himesan@v1.0.0
|
||||
```
|
||||
|
||||
Keep that runtime-first order. It avoids path-selection ambiguity between the
|
||||
@@ -81,19 +84,19 @@ does not contain `sando`, seed the exact nested module without clearing the
|
||||
global cache, then retry:
|
||||
|
||||
```sh
|
||||
go mod download gamertan.com/sandwich-hime/sando@v1.0.0-rc.1
|
||||
go get gamertan.com/sandwich-hime/sando@v1.0.0-rc.1
|
||||
go mod download gamertan.com/sandwich-hime/sando@v1.0.0
|
||||
go get gamertan.com/sandwich-hime/sando@v1.0.0
|
||||
```
|
||||
|
||||
For a reproducible one-off or classroom invocation that does not depend on the
|
||||
learner's `PATH`:
|
||||
|
||||
```sh
|
||||
go run gamertan.com/sandwich-hime/cmd/himesan@v1.0.0-rc.1 --help
|
||||
go run gamertan.com/sandwich-hime/cmd/himesan@v1.0.0 --help
|
||||
```
|
||||
|
||||
The runtime implementation retains ABI `sando.v1` and zero third-party module
|
||||
requirements. The coordinated RC tags make the intended v1 pair explicit even
|
||||
requirements. The coordinated v1 tags make the release pair explicit even
|
||||
though compiler and runtime versions remain independently addressable. Signed
|
||||
tags, direct fetching, the public Go proxy, and the checksum database are
|
||||
verified after publication. A newly announced version may still need a short
|
||||
@@ -123,9 +126,8 @@ or starts the dev supervisor. See
|
||||
Skill and VS Code preview live in the separate
|
||||
[tooling repository](https://gitea.speelman.ca/gamertan/sandwich-hime-tooling).
|
||||
|
||||
Final-v1 installs will use the same paths with `@v1.0.0`. A version is
|
||||
advertised as available only after its immutable tags, `gamertan.com`
|
||||
metadata, and clean direct-fetch installation have been verified.
|
||||
A version is advertised as available only after its immutable tags,
|
||||
`gamertan.com` metadata, and clean direct-fetch installation have been verified.
|
||||
|
||||
## The contract
|
||||
|
||||
|
||||
+13
-3
@@ -29,8 +29,10 @@ portability input but are not v1 release blockers or maintained promises.
|
||||
Beta tags are signed, annotated, and immutable. Beta 1 is a source/module
|
||||
release installed through the Go toolchain; it does not promise downloadable
|
||||
prebuilt binaries. Signed binary artifacts, checksums, SBOMs, reproducible
|
||||
archives, and key-recovery rehearsal are mandatory for release candidates and
|
||||
final v1.
|
||||
archives are mandatory for release candidates and final v1. Offline signing-key
|
||||
restoration and independent second-person recovery/verification were explicitly
|
||||
deferred by the maintainer for v1.0.0. Record that assurance gap in the release
|
||||
review; retain the drills as follow-up work rather than claiming they passed.
|
||||
|
||||
### Release candidate
|
||||
|
||||
@@ -48,6 +50,12 @@ published assurance gap, and the documented RC observation period. A
|
||||
deployment, example, classroom project, or case study in another repository is
|
||||
neither imported nor required as release evidence.
|
||||
|
||||
For v1.0.0 the maintainer explicitly accepted the missing timed dogfooding-note
|
||||
gap and deferred independent Mac installation to available alternate hardware.
|
||||
Keep those dispositions visible in `ROADMAP.md`; do not recreate historical
|
||||
reviews, call the install tested, or require another local profile as a
|
||||
substitute. A reproduced product defect remains distinct from missing notes.
|
||||
|
||||
## Beta 1 publication gates (historical)
|
||||
|
||||
The first beta used a broader one-time platform campaign. The completed items
|
||||
@@ -166,7 +174,9 @@ being mistaken for the reviewed native receipt set.
|
||||
## Public source and artifacts
|
||||
|
||||
Gitea is the only canonical public forge. Public source is exported into a
|
||||
separate, sanitized Gitea repository with fresh reviewed history. A sanitized
|
||||
separate, sanitized Gitea repository with its own reviewed history. Append
|
||||
reviewed publication commits to the existing public main; do not create a new
|
||||
orphan history per version or push private development branches into it. A sanitized
|
||||
GitHub discovery snapshot may copy reviewed public source, but it is not an
|
||||
issue, contribution, release, or module origin and must never receive private
|
||||
development refs or an indiscriminate Git mirror. Release binaries and
|
||||
|
||||
+45
-7
@@ -66,13 +66,51 @@ it is not a production-stability promise.
|
||||
|
||||
## Final public launch
|
||||
|
||||
- [ ] Complete final human review of ownership notices, output permission, DCO
|
||||
contribution process, and pre-registration trademark terms.
|
||||
- [ ] Complete name clearance, security-mailbox recovery, release signing, and
|
||||
two-person credential recovery.
|
||||
- [ ] Verify `gamertan.com` vanity metadata and documented RC installs from clean
|
||||
machines.
|
||||
Final-release preparation is active. Preserve the existing reviewed public
|
||||
history and append allowlisted updates; keep operator and archival records
|
||||
outside the public snapshot. Completed native and signing evidence remains
|
||||
bound to its exact candidate, not automatically to a later documentation or
|
||||
export-tool update. Final tags and artifacts have not been published.
|
||||
|
||||
Use [RELEASE.md](RELEASE.md) for the remaining final-publication requirements.
|
||||
Passing CI is evidence for that review, not an automatic publication decision.
|
||||
|
||||
- [x] Finalize the maintainer-approved individual [contribution agreement](CLA.md)
|
||||
version 1.0 and explicit prospective acceptance process. Preserve the AGPL
|
||||
compiler, Apache runtime, chosen application license and existing DCO/output
|
||||
grants. Publication is not contributor acceptance or retroactive assent.
|
||||
The maintainer chose to proceed without an outside legal-review prerequisite;
|
||||
see [the rationale](docs/LICENSING_INTENT.md).
|
||||
- [x] Record the maintainer's approval to proceed with ownership notices, output
|
||||
permission, reciprocal contribution terms and pre-registration naming scope.
|
||||
This is not a statement of external legal review or guaranteed enforceability.
|
||||
- [x] Record the maintainer's decision to proceed with Sandwich Hime as the
|
||||
primary project identity and Hime-san as its tool name. This is acceptance of
|
||||
the documented name-review limitations, not formal trademark clearance,
|
||||
completed similarity analysis or a registration requirement.
|
||||
- [ ] Complete final security/signing readiness review. Distinguish successful
|
||||
signing from the explicitly deferred recovery drills below.
|
||||
- [x] Verify `gamertan.com` vanity metadata and documented RC installs using clean
|
||||
direct-fetch and public-proxy caches. Final-version installs remain post-tag
|
||||
checks; an independent Mac installation is an accepted follow-up below.
|
||||
- [ ] Confirm the sanitized public Gitea source contains no private paths,
|
||||
identifiers, history, or unsupported claims.
|
||||
- [ ] Publish and observe signed RC artifacts on Linux/amd64 and Darwin/arm64.
|
||||
- [x] Publish signed RC.1 artifacts on Linux/amd64 and Darwin/arm64.
|
||||
- [x] Record the maintainer's v1 acceptance of existing live dogfooding despite
|
||||
missing timed checkpoint notes. This is an explicit assurance-gap acceptance,
|
||||
not reconstructed reviews or a claim of measured error-free operation. Missing
|
||||
notes alone do not restart the observation period or block release.
|
||||
- [ ] Publish `sando/v1.0.0`, then `v1.0.0`, without moving either tag.
|
||||
|
||||
## Accepted assurance follow-ups
|
||||
|
||||
- [ ] Exercise the published Mac download/install and CLI on independent Apple
|
||||
Silicon hardware when available. The maintainer accepted this gap for v1 and
|
||||
prefers an independent machine over another profile on the development Mac.
|
||||
Record the result in documentation; fix any reproduced defect in an appropriate
|
||||
patch release. This is not a current launch blocker or completed install test.
|
||||
- [ ] Exercise offline signing-key restoration and independent second-person
|
||||
credential recovery/verification. The maintainer explicitly deferred these
|
||||
for v1.0.0; they are not launch blockers or completed recovery evidence. Loss
|
||||
of the current credentials or operator access remains an incident-response
|
||||
risk until these drills and independent access are proven.
|
||||
|
||||
+18
-16
@@ -2,13 +2,12 @@
|
||||
|
||||
# Security policy
|
||||
|
||||
Sandwich Hime compiler `v1.0.0-rc.1` and runtime
|
||||
`sando/v1.0.0-rc.1` are the current release-candidate pair. The intended v1
|
||||
interfaces are frozen except for release-blocking corrections while the RC
|
||||
completes its public observation period. Security reports are welcome and
|
||||
receive best-effort maintainer assessment and fixes while this pair is current.
|
||||
This is not an SLA, certification, fitness guarantee, or final-v1 support
|
||||
promise.
|
||||
This policy covers Sandwich Hime compiler `v1.0.0` and runtime `sando/v1.0.0`
|
||||
under the [v1 compatibility policy](docs/COMPATIBILITY.md). The latest published
|
||||
stable v1 patch receives best-effort maintainer security assessment and fixes.
|
||||
Canonical Gitea tags and release announcements establish availability. The
|
||||
published RC.1 pair remains covered until final v1 supersedes it. This policy is
|
||||
not an SLA, certification, or fitness guarantee.
|
||||
|
||||
The community is invited to help find portability gaps outside the maintained
|
||||
Linux/amd64 and Darwin/arm64 targets, but those reports do not create a support
|
||||
@@ -21,12 +20,14 @@ advisories, and release decisions.
|
||||
|
||||
| Version | Security status |
|
||||
| --- | --- |
|
||||
| `v1.0.0-rc.1` compiler and `sando/v1.0.0-rc.1` runtime | Current release-candidate pair; intended v1 interfaces frozen except for release-blocking corrections; best-effort security assessment and fixes during the RC observation period |
|
||||
| `v1.0.0` compiler and `sando/v1.0.0` runtime | Stable v1 line; latest published v1 patch receives best-effort security assessment and fixes |
|
||||
| `v1.0.0-rc.1` compiler and `sando/v1.0.0-rc.1` runtime | Published release-candidate pair; covered until final v1 supersedes it |
|
||||
| `v1.0.0-beta.2` compiler and `sando/v1.0.0-beta.1` runtime | Superseded evaluation/classroom pair after RC publication |
|
||||
| Public `main` | Development source; reports welcome, but no compatibility or production-support promise |
|
||||
| Older prereleases | Superseded when a newer prerelease or final version is published; reports are still triaged to determine affected versions |
|
||||
|
||||
Prerelease support lasts until it is superseded or explicitly withdrawn in the
|
||||
The latest stable v1 patch and current prerelease receive fixes. Prerelease
|
||||
support lasts until it is superseded or explicitly withdrawn in the
|
||||
supported-version table and release notes. Published tags are immutable. A
|
||||
security fix is issued as a new version, never by silently replacing a tag.
|
||||
|
||||
@@ -59,8 +60,8 @@ ownership, backup, and recovery procedure have been tested.
|
||||
## What to expect
|
||||
|
||||
These are best-effort targets for a founder-maintained project, not an SLA.
|
||||
They describe maintainer responsibilities; asking the community to test a beta
|
||||
does not ask reporters to investigate or remediate it:
|
||||
They describe maintainer responsibilities; inviting community testing
|
||||
does not make reporters responsible for investigation or remediation:
|
||||
|
||||
- acknowledge a report within 7 calendar days;
|
||||
- provide an initial severity/scope assessment within 14 calendar days when a
|
||||
@@ -166,10 +167,11 @@ unsaved overlays, workspace re-indexing, and no generated writes. Source review
|
||||
forbids process execution and network-client imports inside the server. Editor
|
||||
workspace trust and executable resolution remain editor-client responsibilities.
|
||||
|
||||
Beta 1 uses signed annotated source tags but predates the complete artifact
|
||||
system. The RC adds signed or checksummed binaries, SPDX SBOMs, reproducible
|
||||
archives, and source/build provenance. Those controls establish artifact
|
||||
identity and provenance; they do not constitute an independent security audit
|
||||
or prove the absence of vulnerabilities.
|
||||
Beta 1 used signed annotated source tags but predates the complete artifact
|
||||
system. RC.1 introduced signed or checksummed binaries, SPDX SBOMs, reproducible
|
||||
archives, and source/build provenance; final-v1 artifacts retain that release
|
||||
boundary and require their own exact-version verification. Those controls
|
||||
establish artifact identity and provenance; they do not constitute an
|
||||
independent security audit or prove the absence of vulnerabilities.
|
||||
|
||||
This policy is practical project guidance, not legal advice.
|
||||
|
||||
@@ -4,6 +4,11 @@
|
||||
|
||||
“Sandwich Hime,” “Hime-san,” the Sandwich Hime flag, mascot, and official project artwork identify the project stewarded by Cole Speelman. Code licenses do not grant trademark rights, and this policy does not limit anyone's rights to use the code under those licenses.
|
||||
|
||||
Sandwich Hime is the primary project identity. Hime-san names the tool within
|
||||
that project, not a separate framework brand. The project does not claim the
|
||||
word “Hime” in general. This naming scope is not a statement of registration
|
||||
or a conclusion about confusing similarity in any jurisdiction.
|
||||
|
||||
Truthful, non-confusing statements such as “Built with Sandwich Hime,” “compatible with Sandwich Hime,” and unmodified community badges are welcome. They must not imply sponsorship, certification, or official status.
|
||||
|
||||
If a modified distribution uses these project marks, it should use a distinct primary product name, clearly identify its changes, and avoid official artwork or presentation that could confuse users about origin. A fork that does not use the project marks is not restricted by this policy. Either kind of fork may truthfully describe compatibility.
|
||||
|
||||
+4
-1
@@ -2,7 +2,10 @@
|
||||
|
||||
# Brand vocabulary
|
||||
|
||||
Use **Sandwich Hime** for the project and **Hime-san** as its friendly short form. Use `himesan` for the command, `.sando` for source, `.sando.go` for generated Go, and `sando` for the runtime.
|
||||
Use **Sandwich Hime** as the primary project identity and **Hime-san** for its
|
||||
compiler/tool personality within that project, not as a separate framework
|
||||
brand. Use `himesan` for the command, `.sando` for source, `.sando.go` for
|
||||
generated Go, and `sando` for the runtime.
|
||||
|
||||
Never call the project bare “Hime,” which can be confused with an existing Go framework. Never use `.san`; it belongs exclusively to the separate San language project. “Sando” evokes a sandwich and keeps both projects unmistakable in editors, tooling, and search results.
|
||||
|
||||
|
||||
+11
-13
@@ -2,22 +2,20 @@
|
||||
|
||||
# Compatibility policy
|
||||
|
||||
## Current release-candidate contract
|
||||
## v1 release contract
|
||||
|
||||
Compiler `v1.0.0-rc.1` and runtime `sando/v1.0.0-rc.1` are the current
|
||||
semantic-version prereleases. The intended v1 source syntax, generated API,
|
||||
runtime API, CLI behavior, diagnostics, and configuration schemas are frozen
|
||||
except for release-blocking corrections. Every correction receives a new
|
||||
immutable RC, documentation, and deterministic generation evidence.
|
||||
This document defines the compatibility contract for compiler `v1.0.0` and
|
||||
runtime `sando/v1.0.0`. Canonical Gitea tags and release announcements establish
|
||||
version and artifact availability. Every correction receives a new immutable
|
||||
version, documentation, and deterministic generation evidence.
|
||||
|
||||
The RC is not yet the final-v1 support commitment. Maintainers accept and
|
||||
triage security reports within the boundary described in
|
||||
Maintainers accept and triage security reports within the boundary described in
|
||||
[SECURITY.md](../SECURITY.md). A security correction may intentionally fail
|
||||
closed when retaining behavior would contradict a published safety guarantee.
|
||||
|
||||
## Final-v1 contract
|
||||
## v1 compatibility contract
|
||||
|
||||
At final v1, semantic versions apply independently to the compiler and
|
||||
For v1, semantic versions apply independently to the compiler and
|
||||
`sando` runtime. Generated files record the exact compiler version and
|
||||
required runtime ABI. Patch releases do not intentionally change accepted
|
||||
source semantics or generated public signatures. Minor releases may add
|
||||
@@ -35,7 +33,7 @@ codes, `himesan.json`, and generated provenance. English diagnostic wording,
|
||||
internal packages, temporary paths, and compiler implementation details are not
|
||||
stable API.
|
||||
|
||||
An API deprecated after final v1 remains available for the rest of the v1
|
||||
An API deprecated during v1 remains available for the rest of the v1
|
||||
major line and may be removed in v2. A security correction may fail closed in
|
||||
a patch release when retaining old behavior would contradict a published safety
|
||||
guarantee; that exception receives an advisory and migration note rather than a
|
||||
@@ -58,7 +56,7 @@ support change is announced in release notes before it takes effect.
|
||||
The following table is retained because the tests genuinely ran. It records a
|
||||
point-in-time Beta 1 campaign and does not define the current support matrix.
|
||||
|
||||
The current public evidence is the exact Beta 1 source at commit
|
||||
The historical Beta 1 evidence is bound to source commit
|
||||
`b7a84054d755e42285e50298e41e47f06a8325a5` (tree
|
||||
`be9e118e38dfebed19f60403ededdadabe07d2aa`):
|
||||
|
||||
@@ -80,7 +78,7 @@ module-cache path-selection ambiguity observed in the reverse order.
|
||||
|
||||
## Portability feedback
|
||||
|
||||
Developers may try the beta on an unsupported target and report useful gaps. A
|
||||
Developers may try Hime-san on an unsupported target and report useful gaps. A
|
||||
good report includes the operating system and architecture, `go version`, the
|
||||
exact command, and a minimal reproduction or diagnostic output. Ordinary
|
||||
portability reports belong on the canonical Gitea project. Suspected
|
||||
|
||||
@@ -0,0 +1,115 @@
|
||||
<!-- SPDX-License-Identifier: AGPL-3.0-only -->
|
||||
|
||||
# Shared tools, commercial freedom
|
||||
|
||||
The design principle is **earn from useful work; preserve the shared freedoms
|
||||
that made the work possible**. Commercial users are welcome. Sponsorship is
|
||||
appreciated, not a license fee or a claim to project control. The intended users
|
||||
are software developers and maintainers; v1 is a maintained compatibility
|
||||
commitment, not a declaration that development has ended.
|
||||
|
||||
This document explains the [contribution agreement](../CLA.md) and official governance.
|
||||
It is not a new software license, a downstream contract or a claim that every
|
||||
future use or derivative of every component must be open source.
|
||||
|
||||
## Four different jobs
|
||||
|
||||
- The software license supplies recipients' permissions and obligations.
|
||||
- The CLA records the rights for submitted contributions and reciprocal
|
||||
promises by the named official steward; it is not a contract with every user.
|
||||
- Governance determines official decisions, repository access and succession.
|
||||
- The trademark policy addresses origin and endorsement, not ownership of
|
||||
ideas or a veto on honest independent development.
|
||||
|
||||
Open-source commercial freedoms include competition. A subjective ban on
|
||||
"greed," commercial hosting or businesses the maintainer dislikes would not
|
||||
preserve those freedoms. We instead use concrete source-sharing, attribution,
|
||||
no-hidden-relicensing and stewardship commitments. See the
|
||||
[Open Source Definition](https://opensource.org/osd).
|
||||
|
||||
## The deliberate compiler/application boundary
|
||||
|
||||
The current [license map](../LICENSES.md) remains unchanged:
|
||||
|
||||
- Compiler/project material is AGPL-3.0-only. Distribution and covered modified
|
||||
network use have source obligations under that license.
|
||||
- The `sando` runtime is Apache-2.0. That is permissive, not network copyleft;
|
||||
compliant closed-source derivatives are possible.
|
||||
- User templates and generated applications may use their authors' chosen
|
||||
terms, subject to input/dependency rights and the explicit output permission.
|
||||
A proprietary paid website built with Hime is deliberately possible.
|
||||
|
||||
This protects the compiler's shared code without requiring its developers'
|
||||
applications to become AGPL. Private production adoption is intentional: the
|
||||
maintainer has confirmed this split for the release. The runtime's rendering,
|
||||
escaping and URL-safety helpers are valuable implementation work; permissive
|
||||
embedding makes them useful without imposing compiler licensing on applications.
|
||||
It does not deliver "every part always open." Neither a later CLA nor a changed
|
||||
README retracts existing recipients' licenses. No license conversion is proposed.
|
||||
|
||||
## Concrete cases
|
||||
|
||||
- A consultant sells a website built with Hime: allowed under the existing
|
||||
application boundary; no mandatory payment, public badge or CLA for the client.
|
||||
- A business distributes a modified compiler: it must follow the AGPL's
|
||||
applicable source, licensing and notice requirements.
|
||||
- A business operates a modified AGPL compiler with remote user interaction:
|
||||
section 13 requires an offer of that version's Corresponding Source to those
|
||||
interacting users. This is not necessarily every unrelated part of its service.
|
||||
- A business merely hosts an unmodified program: hosting alone does not meet
|
||||
section 13's modification condition. Wrappers and combined works require
|
||||
fact-specific analysis, not an assumed universal SaaS prohibition.
|
||||
- A company publishes a complying, independently branded fork: permitted,
|
||||
even if it competes successfully and submits no changes upstream.
|
||||
- A sponsor wants official control or private permission to close contributor
|
||||
AGPL work: sponsorship grants neither; the steward covenant rejects
|
||||
that official relicensing route. A fork cannot claim official endorsement.
|
||||
|
||||
These examples summarize boundaries, not legal opinions on a specific service.
|
||||
The [AGPL text](https://opensource.org/license/agpl-3.0), including sections 2,
|
||||
7, 10 and 13, controls actual covered uses. The
|
||||
[Apache license](https://www.apache.org/licenses/LICENSE-2.0) controls the runtime.
|
||||
The AGPL permits removing additional permissions from a redistributed copy;
|
||||
do not promise that every independent fork must keep our output exception.
|
||||
|
||||
## What the contribution agreement adds
|
||||
|
||||
An identified contributor keeps ownership and grants only the recorded public
|
||||
license plus an expressly authorized output permission. No alternate broad
|
||||
sublicensing grant, copyright assignment, forced upstream labor, contributor
|
||||
indemnity or proprietary buyout permission is collected. Patent rights and
|
||||
termination follow the relevant established license.
|
||||
|
||||
The named Steward promises accurate attribution, preservation of contribution
|
||||
records, public licensing of accepted material in official releases, no official
|
||||
side deal to remove contributor copyleft, and written assumption of those duties
|
||||
before a voluntary transfer of official stewardship. Those contractual promises
|
||||
are not appended to downstream AGPL licenses. They cannot guarantee that a
|
||||
project will never be abandoned, that a competitor will never outperform it,
|
||||
or that every later actor is bound without agreement. Copyright enforcement
|
||||
for contributor-owned work may require separate cooperation or authority.
|
||||
|
||||
Contributors remain free to license their own work elsewhere. This is reciprocal
|
||||
stewardship rather than acquiring all rights from contributors. Existing public
|
||||
licenses, usable source and the ability to fork preserve continuity if official
|
||||
stewardship fails; governance and operational recovery still require real people.
|
||||
|
||||
## Deliberate adoption, without a barrier to learning
|
||||
|
||||
The AGPL compiler, Apache runtime and chosen application-license boundary is
|
||||
settled. Version 1.0 of the contribution agreement is prospective: explicit
|
||||
contributor and Steward acceptance is necessary, and no earlier contribution
|
||||
is silently covered. The small recordkeeping process is in its section 9.
|
||||
Nobody signs it merely to learn, download or build a private paid application.
|
||||
|
||||
The maintainer chose to proceed with this reviewed project-specific wording
|
||||
without making outside legal review a release prerequisite. It is not an
|
||||
ASF-approved agreement, a claim that counsel reviewed it, or a guaranteed
|
||||
takeover shield. The [ASF ICLA](https://www.apache.org/licenses/icla.pdf) is a
|
||||
useful comparison for contribution scope, authority and explicit acceptance;
|
||||
its broader licensing grant is not imported into this agreement. Specific
|
||||
future disputes or changes in jurisdiction may warrant professional advice.
|
||||
|
||||
The principle may inform other Gamertan projects, but each license, dependency
|
||||
and contributor history needs its own decision. This document does not change
|
||||
other repositories or turn "Canadian license" into a new license family.
|
||||
@@ -216,7 +216,13 @@ resolution and the public Go proxy after normal proxy propagation. Future
|
||||
release decisions require fresh evidence for the maintained Linux/amd64 and
|
||||
Darwin/arm64 targets rather than reusing this historical campaign.
|
||||
|
||||
## Open assurance gaps
|
||||
## Historical pre-RC assurance gaps
|
||||
|
||||
The list below preserves the pre-RC assessment, not current completion status.
|
||||
RC.1 native verification and artifact publication are recorded in
|
||||
`../CHANGELOG.md`; the final-release queue is `../ROADMAP.md`. The v1
|
||||
dispositions below distinguish required exact-candidate evidence from explicitly
|
||||
accepted recovery deferrals.
|
||||
|
||||
- delivery to `security@sandwichhime.com` is owner-confirmed through a
|
||||
controlled domain catch-all; encrypted reporting, documented backup, and
|
||||
@@ -250,8 +256,8 @@ subject to exact-public-candidate review:
|
||||
|
||||
| Gap | v1 disposition |
|
||||
| --- | --- |
|
||||
| Security mailbox delivery, backup, and recovery | Release blocker. Complete the delivery/reply and recovery drill before RC publication. Encrypted reporting may remain optional if the supported confidential channel and its limit are stated accurately. |
|
||||
| Artifact signing, provenance, and key recovery | Release blocker. Complete deterministic native artifacts, Developer ID notarization, signed-tag rehearsal, and recovery evidence. |
|
||||
| Security mailbox delivery, backup, and recovery | Delivery/reply remains required and is maintainer-confirmed. Offline restoration and independent second-person recovery/verification are explicitly deferred assurance work for v1.0.0, not completed drills. Encrypted reporting may remain optional if the supported confidential channel and its limit are stated accurately. |
|
||||
| Artifact signing, provenance, and key recovery | Deterministic native artifacts, Developer ID notarization and signed-tag evidence remain required for the exact release candidate. Offline signing-key restoration and independent second-person recovery/verification are explicitly deferred for v1.0.0; successful signing does not prove recovery. |
|
||||
| Maintained native matrix | Release blocker for Linux/amd64 and Darwin/arm64 only. Other architectures and operating systems are explicitly unsupported, not silently untested promises. |
|
||||
| Real-browser parser and supervisor evidence | Release blocker. The repository-owned gate covers a generated typed document, parsed structure, hostile-value inertness, and supervisor behavior. Execute it against the exact public candidate on both maintained hosts before publication. |
|
||||
| Compiler resource budgets | Accepted v1 boundary. The compiler is a trusted local build tool; operating-system and runner limits own CPU, memory, and input quotas. No hostile-input resource guarantee is made. |
|
||||
|
||||
+26
-10
@@ -16,13 +16,23 @@ releases originate only from the reviewed canonical public tree.
|
||||
| Surface | Purpose | History and tags |
|
||||
| --- | --- | --- |
|
||||
| Private development storage | Working branches, private review records, and historical context | identities and history are not exported; no public release tags |
|
||||
| Public Gitea `sandwich-hime` | Canonical sanitized source, contribution venue, module origin, and releases | fresh reviewed history; authoritative immutable `sando/vX.Y.Z` and `vX.Y.Z` tags |
|
||||
| Public Gitea `sandwich-hime` | Canonical sanitized source, contribution venue, module origin, and releases | stable reviewed public history; authoritative immutable `sando/vX.Y.Z` and `vX.Y.Z` tags |
|
||||
| GitHub `gamertan/sandwich-hime` | Discoverability and a convenient sanitized source snapshot | no private refs, force-mirrors, workflows, contribution authority, release artifacts, or semver tags |
|
||||
|
||||
Each public update is exported through the exact committed allowlist, inspected,
|
||||
committed as a fresh public snapshot, and compared byte-for-byte with the
|
||||
reviewed export. GitHub receives that public tree only. It never receives
|
||||
private history or an indiscriminate Git mirror.
|
||||
appended as a meaningful publication commit to the existing public `main`, and
|
||||
compared byte-for-byte with the reviewed export. Development commits may be
|
||||
squashed for publication; do not reset public ancestry for each version, merge
|
||||
private history into public branches, or force-push existing releases. Versions
|
||||
are immutable tags on that public history, not separate orphan branches.
|
||||
Preserve contributor attribution, sign-offs and any output-permission grants
|
||||
as required by [CONTRIBUTING.md](../CONTRIBUTING.md).
|
||||
|
||||
GitHub receives the reviewed public tree only. It never receives private
|
||||
branches, private notes or an indiscriminate Git mirror. Branch names and
|
||||
protected branches are not privacy boundaries: private development remains in
|
||||
a separate access-controlled repository. The tutorial, tooling and website
|
||||
remain independent projects, not archival branches of the compiler.
|
||||
|
||||
## Current readiness
|
||||
|
||||
@@ -65,9 +75,11 @@ Other demonstrated controls include:
|
||||
- byte-identical generated output and independently reproduced release
|
||||
archives across the maintained native evidence lanes.
|
||||
|
||||
The final immutable tags, clean direct/proxy installation, credential-recovery
|
||||
drills, and public observation period remain publication or post-publication
|
||||
gates rather than properties that source code can prove by itself.
|
||||
The final immutable tags, clean direct/proxy installation and public observation
|
||||
review remain publication or post-publication gates rather than properties
|
||||
that source code can prove by itself. Offline restoration and second-person
|
||||
recovery/verification are explicitly deferred assurance work for v1.0.0, as
|
||||
recorded in [ROADMAP.md](../ROADMAP.md).
|
||||
|
||||
## Beta 1 publication lane
|
||||
|
||||
@@ -143,8 +155,9 @@ Required before security/native release-candidate work is declared complete:
|
||||
committed outputs are current under that exact binary.
|
||||
- [x] Produce deterministic archives/binaries, checksums, SBOMs, signatures,
|
||||
and source/build provenance from a clean sanitized canonical checkout.
|
||||
- [ ] Test release-key backup and two-person recovery for Gitea, domains,
|
||||
signing material, and publication instructions.
|
||||
- [x] Record the explicit v1.0.0 deferral of offline release-key restoration and
|
||||
independent second-person recovery; retain the drills as assurance follow-ups
|
||||
in [ROADMAP.md](../ROADMAP.md), without claiming they passed.
|
||||
- [x] Make evidence gates validate content and commit identity rather than only
|
||||
the presence of non-empty files.
|
||||
- [ ] Rehearse runtime-first publication and rollback without creating public
|
||||
@@ -162,7 +175,10 @@ Required before security/native release-candidate work is declared complete:
|
||||
5. Operate the official Sandwich Hime website on the RC runtime for a 14-day
|
||||
observation period with no unresolved Hime render, security, accessibility,
|
||||
or rollback regression. This is product dogfooding, not a dependency on
|
||||
another application's private repository.
|
||||
another application's private repository. For v1.0.0 the maintainer accepted
|
||||
the existing live-use experience despite missing timed checkpoint notes;
|
||||
see [ROADMAP.md](../ROADMAP.md). This does not assert the missing reviews
|
||||
occurred or waive a reproduced Hime defect.
|
||||
6. Fix findings in a new RC; restart the observation period when the affected
|
||||
boundary warrants it.
|
||||
7. Finalize the changelog, supported-version table, migration notes, release
|
||||
|
||||
@@ -4,6 +4,24 @@
|
||||
|
||||
`gamertan.com/sandwich-hime/sando` is the independent Apache-2.0 runtime ABI for Go generated by Sandwich Hime. It contains no compiler, router, HTTP server, middleware, reflection registry, project discovery, or development supervisor.
|
||||
|
||||
## Install
|
||||
|
||||
This is the source and documentation for runtime `sando/v1.0.0`, paired with
|
||||
compiler `v1.0.0` without changing runtime ABI `sando.v1`. Canonical Gitea tags
|
||||
and release announcements establish availability. In an application module,
|
||||
add the runtime first, then install the compiler:
|
||||
|
||||
```sh
|
||||
go get gamertan.com/sandwich-hime/sando@v1.0.0
|
||||
go install gamertan.com/sandwich-hime/cmd/himesan@v1.0.0
|
||||
```
|
||||
|
||||
The runtime-first order avoids parent/nested-module path-selection ambiguity.
|
||||
The compiler is a development tool and is not a runtime dependency of the
|
||||
generated application. Compiler and runtime remain independently versioned.
|
||||
|
||||
## API and licensing
|
||||
|
||||
The stable surface is:
|
||||
|
||||
```go
|
||||
|
||||
@@ -16,6 +16,11 @@ Linux/amd64 and macOS/arm64.
|
||||
- `sign-notarize-macos.sh` is a deliberately manual boundary. It requires the explicitly approved unsigned archive digest, uses Cole's Developer ID and Keychain-held notary profile, regenerates provenance and checksums for the changed signed Mach-O bytes, and produces a signed, notarized, and stapled DMG. The native runner receives neither credential.
|
||||
- `verify-real-browser.sh` is opt-in release evidence. It runs the development client in an actual reviewed Chrome/Chromium binary, exercising CSP-restricted execution, SSE diagnostics, reload, and fragment/API exclusions, then reruns the process cleanup integration cases. Chrome is not a normal build or consumer dependency.
|
||||
|
||||
The export scanner also rejects Markdown references to known excluded operator
|
||||
documentation roots. It is a bounded publication check, not a complete Markdown
|
||||
link checker or a substitute for inspecting the exported diff. Source-code
|
||||
fixtures can still describe the scanner's rejected paths.
|
||||
|
||||
The canonical Linux and macOS CI gates run the contract and public-snapshot
|
||||
checks plus bounded fuzz sessions for the parser/context compiler, Go-aware
|
||||
delimiter scanner, URL policy, and LSP boundaries. The compiler target also
|
||||
|
||||
@@ -72,6 +72,9 @@ snapshot_validate_export_tree() {
|
||||
local provider_token='AKIA[0-9A-Z]{16}|(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}|glpat-[A-Za-z0-9_-]{20,}|xox[baprs]-[A-Za-z0-9-]{20,}'
|
||||
local private_commit_id='(private development (source|baseline)|private (development )?(commit|source))[^[:cntrl:]]*[0-9a-f]{12,64}'
|
||||
local private_repository='sandwich-hime-''dev'
|
||||
# Known excluded documentation roots, not ordinary prose about private work.
|
||||
# Scope this to Markdown: exported scanner code legitimately names its policy.
|
||||
local private_markdown_ref='(^|[^[:alnum:]_./%-])([.]{1,2}/)*(private|history)/'
|
||||
|
||||
if find "$root" -type l -print -quit | grep -q .; then
|
||||
echo "public snapshot: symbolic links are forbidden" >&2
|
||||
@@ -117,5 +120,13 @@ snapshot_validate_export_tree() {
|
||||
echo "public snapshot: private repository indicator in $rel" >&2
|
||||
return 1
|
||||
fi
|
||||
case $rel in
|
||||
*.[mM][dD] | *.[mM][aA][rR][kK][dD][oO][wW][nN])
|
||||
if LC_ALL=C grep -Eiq -- "$private_markdown_ref" "$file"; then
|
||||
echo "public snapshot: excluded documentation reference in $rel" >&2
|
||||
return 1
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
done < <(find "$root" -type f -print0 | LC_ALL=C sort -z)
|
||||
}
|
||||
|
||||
@@ -42,6 +42,7 @@ docs/COMPATIBILITY.md
|
||||
docs/DEVELOPMENT_SERVER.md
|
||||
docs/DIAGNOSTICS.md
|
||||
docs/LANGUAGE_SERVER.md
|
||||
docs/LICENSING_INTENT.md
|
||||
docs/SECURITY_EVIDENCE.md
|
||||
docs/THREAT_MODEL.md
|
||||
docs/V1_RELEASE_PLAN.md
|
||||
|
||||
@@ -77,6 +77,33 @@ mkdir -p "$safe_tree"
|
||||
printf 'ordinary reviewed source\n' >"$safe_tree/source.go"
|
||||
snapshot_validate_export_tree "$safe_tree"
|
||||
|
||||
# Public prose and ordinary public links are allowed. Source-code policy
|
||||
# fixtures may name excluded roots without becoming documentation links.
|
||||
printf '%s\n' 'Private development records remain separate.' \
|
||||
'[Releases](docs/releases.md)' '[History](https://example.invalid/history/releases)' \
|
||||
'[Design](private-design.md)' >"$safe_tree/README.md"
|
||||
printf '%s\n' '// Reject private/notes.md in an export policy.' >"$safe_tree/scanner_test.go"
|
||||
snapshot_validate_export_tree "$safe_tree"
|
||||
|
||||
markdown_tree=$temporary/markdown
|
||||
mkdir -p "$markdown_tree"
|
||||
for reference in '[Audit](private/audit.md)' '[Audit](./private/audit.md#resume)' \
|
||||
'[Audit](../../private/audit.md)' '[audit]: ../private/audit.md' '[audit]:private/audit.md' \
|
||||
'`private/audit.md`' '<a href="private/audit.md">Audit</a>' \
|
||||
'[Archive](history/story.md)' '[Audit](PRIVATE/AUDIT.md)'; do
|
||||
printf '%s\n' "$reference" >"$markdown_tree/README.Md"
|
||||
if snapshot_validate_export_tree "$markdown_tree" >"$temporary/markdown.log" 2>&1; then
|
||||
echo "excluded documentation reference was accepted: $reference" >&2
|
||||
exit 1
|
||||
fi
|
||||
grep -q 'excluded documentation reference in README.Md' "$temporary/markdown.log"
|
||||
done
|
||||
mv "$markdown_tree/README.Md" "$markdown_tree/notes.markdown"
|
||||
if snapshot_validate_export_tree "$markdown_tree" >/dev/null 2>&1; then
|
||||
echo "excluded reference in .markdown documentation was accepted" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
empty_tree=$temporary/empty
|
||||
mkdir -p "$empty_tree"
|
||||
: >"$empty_tree/empty.txt"
|
||||
|
||||
Reference in New Issue
Block a user