# v1.0.0 launch initiative Sandwich Hime v1 is a compatibility and evidence milestone, not a reason to accumulate features. The intended product is already visible: an HTML-first, ahead-of-time template engine for Go, typed generated components, a small HTTP-independent runtime, and an optional opinionated local development loop. The private development initiative lives on `codex/v1-launch` in `sandwich-hime-dev`. Public releases never originate from that private history. ## Repository and publication topology | Surface | Purpose | History and tags | | --- | --- | --- | | Private Gitea `sandwich-hime-dev` | development, working branches, private review records, and historical context | normal private history; no public release tags | | Public Gitea `sandwich-hime` | canonical sanitized source, contribution venue, module origin, releases, and signed tags | fresh reviewed publication history; authoritative `sando/vX.Y.Z` and `vX.Y.Z` tags | | GitHub `gamertan/sandwich-hime` | discoverability and a convenient sanitized source snapshot | no private refs, force-mirrors, workflows, contribution authority, release artifacts, or semver tags | Each public update is exported through the exact committed allowlist, inspected, committed as a fresh public snapshot, and compared byte-for-byte with the reviewed export. GitHub receives that public tree only. It never receives the private repository or an indiscriminate Git mirror. ## Current readiness At the 2026-08-12 v1 initiative baseline, the project is a strong engineering preview, but not yet a release candidate. Exact private/public commit mappings remain in the non-exported operational ledger. ### Demonstrated now - race-enabled tests, vet, builds, deterministic generation, license checks, and sanitized-export tests pass on Linux; - the compiler module and nested `sando` runtime declare zero third-party Go module requirements; - generated/runtime compatibility uses a version-specific compile-time ABI marker with an incompatible-runtime regression; - owned-output, orphan, stale, symlink, nested-module, restrictive-permission, last-good, writer-error, and enumerated contextual-output cases are tested; - the development proxy is loopback-only, browser-origin hardened, and clears a dead selected upstream immediately; and - the security policy, threat model, and dated evidence ledger state both the demonstrated controls and the unresolved limits. ### Not demonstrated yet - native Windows and macOS execution of the complete supported matrix; - a stable public API/CLI/schema snapshot and compatibility test; - systematic browser-parser and `html/template` differential testing; - a long semantic fuzz campaign beyond bounded no-panic smoke; - committed, reproducible comparative benchmarks and a predefined regression threshold; - real-browser SSE/reload/overlay evidence for `himesan dev`; - deterministic release artifacts, checksums, SBOMs, signatures, and tested signing/recovery procedures; or - clean direct and public-proxy installation of signed release tags. ## Milestone 1: contract freeze Required before security/platform release-candidate work is declared complete: - [ ] Decide and specify whether generic component function signatures are v1. - [ ] Inventory and freeze every exported `sando` symbol, trusted type, sentinel error, concrete error field, helper, and ABI marker. - [ ] Freeze CLI commands, exit-code meanings, diagnostic codes, JSON schemas, `himesan.json` schema, and generated provenance fields. - [ ] Specify nil/stringification behavior, supported HTML-context matrix, component trust boundary, URL semantics, and explicit unsupported cases. - [ ] Add machine-checked public API, CLI, diagnostic, schema, and generated output compatibility snapshots. - [ ] Define the v1 deprecation and security-support policy. ## Milestone 2: security and native-platform evidence - [ ] Run the minimum supported Go line and the latest two stable Go lines on native Linux, macOS, and Windows hosts. - [ ] Prove identical generated bytes across those hosts and exercise native path, replacement, permission, race, process-tree, and watcher behavior. - [ ] Build a systematic differential corpus against Go's documented `html/template` safety baseline for overlapping supported contexts. - [ ] Parse representative outputs in real browsers and test structure/code invariants rather than only byte equality. - [ ] Extend semantic fuzzing across delimiters, HTML transitions, imports, paths, source maps, URL normalization, and filesystem operations. - [ ] Resolve or explicitly accept every open item in `SECURITY_EVIDENCE.md`; no accepted item may contradict a public guarantee. - [ ] Test delivery and reply through `security@sandwichhime.com`. - [ ] Define severity, advisory, retraction, and CVE-request handling. ## Milestone 3: measured performance and development UX - [ ] Commit a synthetic, repository-owned benchmark corpus comparing equivalent typed views and output with `html/template`. - [ ] Define “no material regression” before measuring the release candidate; publish hardware, OS, Go version, commands, samples, allocations, and output equivalence with every result. - [ ] Test SSE reconnect, reload, diagnostic overlays, CSP changes, fragment/API exclusions, caching, and child cleanup in a real browser on supported hosts. - [ ] Remove any v1 development-supervisor guarantee that cannot be evidenced reliably instead of substituting prose for a test. ## Milestone 4: release rehearsal - [ ] Make version validation identical in the CLI, generated headers, scripts, and release artifacts; reject ambiguous build metadata. - [ ] Build the candidate compiler at its candidate version and prove its committed outputs are current under that exact binary. - [ ] Produce deterministic archives/binaries, checksums, SBOMs, signatures, and source/build provenance from a clean sanitized canonical checkout. - [ ] Test release-key backup and two-person recovery for Gitea, domains, signing material, and publication instructions. - [ ] Make evidence gates validate content and commit identity rather than only the presence of non-empty files. - [ ] Rehearse runtime-first publication and rollback without creating public semver tags. ## Milestone 5: release candidates and final launch 1. Export and review the sanitized canonical release tree. 2. Publish signed `sando/v1.0.0-rc.1`, then signed `v1.0.0-rc.1` from the same reviewed public Gitea commit. 3. Verify documented installs through fresh `GOPROXY=direct` and `proxy.golang.org` caches on supported Go versions and native platforms. 4. Run the complete evidence suite again from the exact public commit. 5. Operate the official Sandwich Hime website on the RC runtime for a 14-day observation period with no unresolved Hime render, security, accessibility, or rollback regression. This is product dogfooding, not a dependency on EQL or another application's private repository. 6. Fix findings in a new RC; restart the observation period when the affected boundary warrants it. 7. Finalize the changelog, supported-version table, migration notes, release notes, legal/trademark review, checksums, SBOMs, and signatures. 8. Publish `sando/v1.0.0` first and `v1.0.0` second. Never move a tag. 9. Refresh the untagged GitHub discovery snapshot and point it to canonical Gitea releases and contribution channels. ## Explicitly deferrable after v1 Unless testing finds a release-blocking consequence, v1 need not include every possible context, hostile-local filesystem hardening, typed trust-flow analysis, complete dynamic cycle detection, an encrypted reporting key, or an external audit. Those limits must remain visible and must not be contradicted by marketing. New features do not outrank a small stable contract. ## Definition of confidence “Ready for v1” means a reviewer can trace each promise to a stable public contract, executable evidence from supported native environments, and a signed artifact built from the exact canonical source. It does not mean perfect, invulnerable, or finished forever.