gamertan
113c95c21e
Publish the reviewed security policy and evidence, exact runtime ABI enforcement, orphan-output and permission safeguards, dead-upstream cleanup, and the evidence-gated v1 launch plan. This commit is an exact sanitized export from the private development record. Material implementation and review were assisted by OpenAI Codex; Cole Speelman reviewed the changes and accepts human responsibility. Himesan-Output-Permission: v1.0 Signed-off-by: Cole Speelman <gamertan@noreply.localhost>
2.4 KiB
2.4 KiB
Proof-in-the-pudding roadmap
Unchecked items are release blockers, not aspirational marketing.
The ordered initiative, repository topology, release-candidate sequence, and definition of confidence are maintained in docs/V1_RELEASE_PLAN.md.
Compiler and runtime
- Compiler-owned deterministic golden output repeated across Linux, macOS, and Windows.
- Temporary consumer modules compile using committed Go and only the Apache runtime.
- Parser, delimiter, context, path, and source-map fuzz targets survive the release campaign.
- Adversarial escaping and filesystem cases are evidenced.
- Latest two Go lines pass test, race, vet, vulnerability, and license gates.
- Signed compiler/runtime release artifacts, checksums, and SBOMs reproduce.
Development supervisor
- Generation/build/start/health failures keep the previous healthy server live.
- SSE reconnect/reload and mapped overlay diagnostics pass browser-level tests.
- CSP hash injection, fragment/API/download exclusion, and cache disabling pass.
- Replaced and interrupted child processes leave no descendants on supported systems.
Repository-owned release evidence
- Contextual escaping is differentially tested against Go's documented
html/templatesafety baseline. - Repository-owned synthetic benchmark cases and methodology are reproducible from a clean checkout.
- Generated output is reviewed for stable provenance, source mappings, and absence of compiler-license headers.
- Production application boundaries are documented: committed generated Go plus the Apache runtime, with no compiler or development supervisor in the deployed binary.
- Unsupported or unmeasured performance and production claims are absent from release materials.
Public launch
- Ownership notices, output permission, DCO contribution process, and pre-registration trademark terms receive final human review.
- Name clearance, security mailbox, two-person credential recovery, and signing keys complete.
gamertan.comvanity-import metadata and documented installs verified from a clean machine.- Sanitized fresh-history public Gitea snapshot contains no private paths, identifiers, history, or unsupported release claims.
- Canonical public Gitea source and project documentation launch, with any secondary forge explicitly limited to a sanitized discovery snapshot.