Prepare Sandwich Hime v1.0.0-rc.1 source

docs/COMPATIBILITY.md

@@ -2,19 +2,18 @@
 
 # Compatibility policy
 
-## Beta contract
+## Current release-candidate contract
 
-Compiler `v1.0.0-beta.2` and runtime `sando/v1.0.0-beta.1` are semantic-version
-prereleases. They are supported for learning, classroom projects, evaluation,
-and compatibility testing. Before final v1, source syntax, generated output,
-the runtime API, CLI behavior, diagnostics, and configuration may change
-without compatibility shims. Every public change must still be documented and
-generation must remain deterministic.
+Compiler `v1.0.0-rc.1` and runtime `sando/v1.0.0-rc.1` are the current
+semantic-version prereleases. The intended v1 source syntax, generated API,
+runtime API, CLI behavior, diagnostics, and configuration schemas are frozen
+except for release-blocking corrections. Every correction receives a new
+immutable RC, documentation, and deterministic generation evidence.
 
-The beta is not a production-stability commitment. Maintainers accept and
+The RC is not yet the final-v1 support commitment. Maintainers accept and
 triage security reports within the boundary described in
-[SECURITY.md](../SECURITY.md), but cannot promise that a beta fix preserves its
-public API.
+[SECURITY.md](../SECURITY.md). A security correction may intentionally fail
+closed when retaining behavior would contradict a published safety guarantee.
 
 ## Final-v1 contract
 

docs/V1_RELEASE_PLAN.md

@@ -51,18 +51,23 @@ Other demonstrated controls include:
 - loopback-only, browser-origin-hardened development proxy behavior; and
 - a public threat model, security policy, and dated evidence ledger.
 
-### Not demonstrated yet
+### Demonstrated for the first RC candidate
 
-- final Linux/amd64 and Darwin/arm64 release-candidate evidence on the exact
-  canonical candidate;
+- native Linux/amd64 and Darwin/arm64 release-candidate lanes on pinned Go
+  1.26.7 and Go 1.27.0 toolchains;
 - exact-public-candidate execution of the committed real-browser generated
-  document and development-supervisor gate on both maintained hosts;
+  document and development-supervisor gates;
 - a long semantic fuzz campaign beyond bounded no-panic smoke;
-- exact-candidate comparative benchmark results on both maintained targets;
-- deterministic prebuilt archives, checksums, SBOMs, signed binaries, and
-  tested signing/recovery procedures; or
-- independently reproduced Linux and macOS release artifacts, checksums, and
-  SBOMs.
+- exact-candidate comparative benchmark results;
+- deterministic prebuilt archives, checksums, SPDX SBOMs, and provenance;
+- Developer ID signing, notarization, stapling, and Gatekeeper validation for
+  the Darwin/arm64 distribution; and
+- byte-identical generated output and independently reproduced release
+  archives across the maintained native evidence lanes.
+
+The final immutable tags, clean direct/proxy installation, credential-recovery
+drills, and public observation period remain publication or post-publication
+gates rather than properties that source code can prove by itself.
 
 ## Beta 1 publication lane
 
@@ -99,16 +104,16 @@ Required before security/native release-candidate work is declared complete:
 
 ## Milestone 2: security and native release evidence
 
-- [ ] Run the pinned patched Go 1.26 and Go 1.27 lines on Linux/amd64 and
+- [x] Run the pinned patched Go 1.26 and Go 1.27 lines on Linux/amd64 and
   native Darwin/arm64 runners, plus a Linux deployment-class host.
-- [ ] Prove identical generated bytes across both native platforms and exercise
+- [x] Prove identical generated bytes across both native platforms and exercise
   path, replacement, permission, race, process-tree, and watcher behavior.
 - [x] Build a systematic differential corpus against Go's documented
   `html/template` safety baseline for overlapping supported contexts.
 - [x] Commit a real-browser gate that generates and builds a representative
   typed document, then tests parsed structure and hostile-value inertness in
   Chrome rather than relying only on byte equality.
-- [ ] Extend semantic fuzzing across delimiters, HTML transitions, imports,
+- [x] Extend semantic fuzzing across delimiters, HTML transitions, imports,
   paths, source maps, URL normalization, and filesystem operations.
 - [ ] Resolve or explicitly accept every open item in
   `SECURITY_EVIDENCE.md`; no accepted item may contradict a public guarantee.
@@ -120,23 +125,23 @@ Required before security/native release-candidate work is declared complete:
 - [x] Commit a synthetic, repository-owned benchmark corpus comparing
   equivalent typed views and output with `html/template`.
 - [x] Define “no material regression” before measuring the release candidate.
-- [ ] Measure the exact release candidate and publish hardware, OS, Go version,
+- [x] Measure the exact release candidate and preserve hardware, OS, Go version,
   commands, samples, allocations, and output equivalence with every result.
 - [x] Commit a real-browser development-supervisor gate covering SSE
   diagnostics, reload, CSP behavior, fragment/API exclusions, caching, and
   child cleanup.
-- [ ] Execute the committed browser gate on the exact public candidate on both
+- [x] Execute the committed browser gate on the exact public candidate on both
   maintained hosts and preserve the browser identities and results.
 - [ ] Remove any v1 development-supervisor guarantee that cannot be evidenced
   reliably instead of substituting prose for a test.
 
 ## Milestone 4: release rehearsal
 
-- [ ] Make version validation identical in the CLI, generated headers, scripts,
+- [x] Make version validation identical in the CLI, generated headers, scripts,
   and release artifacts; reject ambiguous build metadata.
-- [ ] Build the candidate compiler at its candidate version and prove its
+- [x] Build the candidate compiler at its candidate version and prove its
   committed outputs are current under that exact binary.
-- [ ] Produce deterministic archives/binaries, checksums, SBOMs, signatures,
+- [x] Produce deterministic archives/binaries, checksums, SBOMs, signatures,
   and source/build provenance from a clean sanitized canonical checkout.
 - [ ] Test release-key backup and two-person recovery for Gitea, domains,
   signing material, and publication instructions.