Prepare Sandwich Hime v1.0.0-rc.1 source

docs/V1_RELEASE_PLAN.md

@@ -51,18 +51,23 @@ Other demonstrated controls include:
 - loopback-only, browser-origin-hardened development proxy behavior; and
 - a public threat model, security policy, and dated evidence ledger.
 
-### Not demonstrated yet
+### Demonstrated for the first RC candidate
 
-- final Linux/amd64 and Darwin/arm64 release-candidate evidence on the exact
-  canonical candidate;
+- native Linux/amd64 and Darwin/arm64 release-candidate lanes on pinned Go
+  1.26.7 and Go 1.27.0 toolchains;
 - exact-public-candidate execution of the committed real-browser generated
-  document and development-supervisor gate on both maintained hosts;
+  document and development-supervisor gates;
 - a long semantic fuzz campaign beyond bounded no-panic smoke;
-- exact-candidate comparative benchmark results on both maintained targets;
-- deterministic prebuilt archives, checksums, SBOMs, signed binaries, and
-  tested signing/recovery procedures; or
-- independently reproduced Linux and macOS release artifacts, checksums, and
-  SBOMs.
+- exact-candidate comparative benchmark results;
+- deterministic prebuilt archives, checksums, SPDX SBOMs, and provenance;
+- Developer ID signing, notarization, stapling, and Gatekeeper validation for
+  the Darwin/arm64 distribution; and
+- byte-identical generated output and independently reproduced release
+  archives across the maintained native evidence lanes.
+
+The final immutable tags, clean direct/proxy installation, credential-recovery
+drills, and public observation period remain publication or post-publication
+gates rather than properties that source code can prove by itself.
 
 ## Beta 1 publication lane
 
@@ -99,16 +104,16 @@ Required before security/native release-candidate work is declared complete:
 
 ## Milestone 2: security and native release evidence
 
-- [ ] Run the pinned patched Go 1.26 and Go 1.27 lines on Linux/amd64 and
+- [x] Run the pinned patched Go 1.26 and Go 1.27 lines on Linux/amd64 and
   native Darwin/arm64 runners, plus a Linux deployment-class host.
-- [ ] Prove identical generated bytes across both native platforms and exercise
+- [x] Prove identical generated bytes across both native platforms and exercise
   path, replacement, permission, race, process-tree, and watcher behavior.
 - [x] Build a systematic differential corpus against Go's documented
   `html/template` safety baseline for overlapping supported contexts.
 - [x] Commit a real-browser gate that generates and builds a representative
   typed document, then tests parsed structure and hostile-value inertness in
   Chrome rather than relying only on byte equality.
-- [ ] Extend semantic fuzzing across delimiters, HTML transitions, imports,
+- [x] Extend semantic fuzzing across delimiters, HTML transitions, imports,
   paths, source maps, URL normalization, and filesystem operations.
 - [ ] Resolve or explicitly accept every open item in
   `SECURITY_EVIDENCE.md`; no accepted item may contradict a public guarantee.
@@ -120,23 +125,23 @@ Required before security/native release-candidate work is declared complete:
 - [x] Commit a synthetic, repository-owned benchmark corpus comparing
   equivalent typed views and output with `html/template`.
 - [x] Define “no material regression” before measuring the release candidate.
-- [ ] Measure the exact release candidate and publish hardware, OS, Go version,
+- [x] Measure the exact release candidate and preserve hardware, OS, Go version,
   commands, samples, allocations, and output equivalence with every result.
 - [x] Commit a real-browser development-supervisor gate covering SSE
   diagnostics, reload, CSP behavior, fragment/API exclusions, caching, and
   child cleanup.
-- [ ] Execute the committed browser gate on the exact public candidate on both
+- [x] Execute the committed browser gate on the exact public candidate on both
   maintained hosts and preserve the browser identities and results.
 - [ ] Remove any v1 development-supervisor guarantee that cannot be evidenced
   reliably instead of substituting prose for a test.
 
 ## Milestone 4: release rehearsal
 
-- [ ] Make version validation identical in the CLI, generated headers, scripts,
+- [x] Make version validation identical in the CLI, generated headers, scripts,
   and release artifacts; reject ambiguous build metadata.
-- [ ] Build the candidate compiler at its candidate version and prove its
+- [x] Build the candidate compiler at its candidate version and prove its
   committed outputs are current under that exact binary.
-- [ ] Produce deterministic archives/binaries, checksums, SBOMs, signatures,
+- [x] Produce deterministic archives/binaries, checksums, SBOMs, signatures,
   and source/build provenance from a clean sanitized canonical checkout.
 - [ ] Test release-key backup and two-person recovery for Gitea, domains,
   signing material, and publication instructions.