gamertan
113c95c21e
Publish the reviewed security policy and evidence, exact runtime ABI enforcement, orphan-output and permission safeguards, dead-upstream cleanup, and the evidence-gated v1 launch plan. This commit is an exact sanitized export from the private development record. Material implementation and review were assisted by OpenAI Codex; Cole Speelman reviewed the changes and accepts human responsibility. Himesan-Output-Permission: v1.0 Signed-off-by: Cole Speelman <gamertan@noreply.localhost>
153 lines
8.0 KiB
Markdown
153 lines
8.0 KiB
Markdown
<!-- SPDX-License-Identifier: AGPL-3.0-only -->
|
|
|
|
# v1.0.0 launch initiative
|
|
|
|
Sandwich Hime v1 is a compatibility and evidence milestone, not a reason to
|
|
accumulate features. The intended product is already visible: an HTML-first,
|
|
ahead-of-time template engine for Go, typed generated components, a small
|
|
HTTP-independent runtime, and an optional opinionated local development loop.
|
|
|
|
The private development initiative lives on `codex/v1-launch` in
|
|
`sandwich-hime-dev`. Public releases never originate from that private history.
|
|
|
|
## Repository and publication topology
|
|
|
|
| Surface | Purpose | History and tags |
|
|
| --- | --- | --- |
|
|
| Private Gitea `sandwich-hime-dev` | development, working branches, private review records, and historical context | normal private history; no public release tags |
|
|
| Public Gitea `sandwich-hime` | canonical sanitized source, contribution venue, module origin, releases, and signed tags | fresh reviewed publication history; authoritative `sando/vX.Y.Z` and `vX.Y.Z` tags |
|
|
| GitHub `gamertan/sandwich-hime` | discoverability and a convenient sanitized source snapshot | no private refs, force-mirrors, workflows, contribution authority, release artifacts, or semver tags |
|
|
|
|
Each public update is exported through the exact committed allowlist, inspected,
|
|
committed as a fresh public snapshot, and compared byte-for-byte with the
|
|
reviewed export. GitHub receives that public tree only. It never receives the
|
|
private repository or an indiscriminate Git mirror.
|
|
|
|
## Current readiness
|
|
|
|
At the 2026-08-12 v1 initiative baseline, the project is a strong engineering
|
|
preview, but not yet a release candidate. Exact private/public commit mappings
|
|
remain in the non-exported operational ledger.
|
|
|
|
### Demonstrated now
|
|
|
|
- race-enabled tests, vet, builds, deterministic generation, license checks,
|
|
and sanitized-export tests pass on Linux;
|
|
- the compiler module and nested `sando` runtime declare zero third-party Go
|
|
module requirements;
|
|
- generated/runtime compatibility uses a version-specific compile-time ABI
|
|
marker with an incompatible-runtime regression;
|
|
- owned-output, orphan, stale, symlink, nested-module, restrictive-permission,
|
|
last-good, writer-error, and enumerated contextual-output cases are tested;
|
|
- the development proxy is loopback-only, browser-origin hardened, and clears
|
|
a dead selected upstream immediately; and
|
|
- the security policy, threat model, and dated evidence ledger state both the
|
|
demonstrated controls and the unresolved limits.
|
|
|
|
### Not demonstrated yet
|
|
|
|
- native Windows and macOS execution of the complete supported matrix;
|
|
- a stable public API/CLI/schema snapshot and compatibility test;
|
|
- systematic browser-parser and `html/template` differential testing;
|
|
- a long semantic fuzz campaign beyond bounded no-panic smoke;
|
|
- committed, reproducible comparative benchmarks and a predefined regression
|
|
threshold;
|
|
- real-browser SSE/reload/overlay evidence for `himesan dev`;
|
|
- deterministic release artifacts, checksums, SBOMs, signatures, and tested
|
|
signing/recovery procedures; or
|
|
- clean direct and public-proxy installation of signed release tags.
|
|
|
|
## Milestone 1: contract freeze
|
|
|
|
Required before security/platform release-candidate work is declared complete:
|
|
|
|
- [ ] Decide and specify whether generic component function signatures are v1.
|
|
- [ ] Inventory and freeze every exported `sando` symbol, trusted type,
|
|
sentinel error, concrete error field, helper, and ABI marker.
|
|
- [ ] Freeze CLI commands, exit-code meanings, diagnostic codes, JSON schemas,
|
|
`himesan.json` schema, and generated provenance fields.
|
|
- [ ] Specify nil/stringification behavior, supported HTML-context matrix,
|
|
component trust boundary, URL semantics, and explicit unsupported cases.
|
|
- [ ] Add machine-checked public API, CLI, diagnostic, schema, and generated
|
|
output compatibility snapshots.
|
|
- [ ] Define the v1 deprecation and security-support policy.
|
|
|
|
## Milestone 2: security and native-platform evidence
|
|
|
|
- [ ] Run the minimum supported Go line and the latest two stable Go lines on
|
|
native Linux, macOS, and Windows hosts.
|
|
- [ ] Prove identical generated bytes across those hosts and exercise native
|
|
path, replacement, permission, race, process-tree, and watcher behavior.
|
|
- [ ] Build a systematic differential corpus against Go's documented
|
|
`html/template` safety baseline for overlapping supported contexts.
|
|
- [ ] Parse representative outputs in real browsers and test structure/code
|
|
invariants rather than only byte equality.
|
|
- [ ] Extend semantic fuzzing across delimiters, HTML transitions, imports,
|
|
paths, source maps, URL normalization, and filesystem operations.
|
|
- [ ] Resolve or explicitly accept every open item in
|
|
`SECURITY_EVIDENCE.md`; no accepted item may contradict a public guarantee.
|
|
- [ ] Test delivery and reply through `security@sandwichhime.com`.
|
|
- [ ] Define severity, advisory, retraction, and CVE-request handling.
|
|
|
|
## Milestone 3: measured performance and development UX
|
|
|
|
- [ ] Commit a synthetic, repository-owned benchmark corpus comparing
|
|
equivalent typed views and output with `html/template`.
|
|
- [ ] Define “no material regression” before measuring the release candidate;
|
|
publish hardware, OS, Go version, commands, samples, allocations, and output
|
|
equivalence with every result.
|
|
- [ ] Test SSE reconnect, reload, diagnostic overlays, CSP changes, fragment/API
|
|
exclusions, caching, and child cleanup in a real browser on supported hosts.
|
|
- [ ] Remove any v1 development-supervisor guarantee that cannot be evidenced
|
|
reliably instead of substituting prose for a test.
|
|
|
|
## Milestone 4: release rehearsal
|
|
|
|
- [ ] Make version validation identical in the CLI, generated headers, scripts,
|
|
and release artifacts; reject ambiguous build metadata.
|
|
- [ ] Build the candidate compiler at its candidate version and prove its
|
|
committed outputs are current under that exact binary.
|
|
- [ ] Produce deterministic archives/binaries, checksums, SBOMs, signatures,
|
|
and source/build provenance from a clean sanitized canonical checkout.
|
|
- [ ] Test release-key backup and two-person recovery for Gitea, domains,
|
|
signing material, and publication instructions.
|
|
- [ ] Make evidence gates validate content and commit identity rather than only
|
|
the presence of non-empty files.
|
|
- [ ] Rehearse runtime-first publication and rollback without creating public
|
|
semver tags.
|
|
|
|
## Milestone 5: release candidates and final launch
|
|
|
|
1. Export and review the sanitized canonical release tree.
|
|
2. Publish signed `sando/v1.0.0-rc.1`, then signed `v1.0.0-rc.1` from the same
|
|
reviewed public Gitea commit.
|
|
3. Verify documented installs through fresh `GOPROXY=direct` and
|
|
`proxy.golang.org` caches on supported Go versions and native platforms.
|
|
4. Run the complete evidence suite again from the exact public commit.
|
|
5. Operate the official Sandwich Hime website on the RC runtime for a 14-day
|
|
observation period with no unresolved Hime render, security, accessibility,
|
|
or rollback regression. This is product dogfooding, not a dependency on EQL
|
|
or another application's private repository.
|
|
6. Fix findings in a new RC; restart the observation period when the affected
|
|
boundary warrants it.
|
|
7. Finalize the changelog, supported-version table, migration notes, release
|
|
notes, legal/trademark review, checksums, SBOMs, and signatures.
|
|
8. Publish `sando/v1.0.0` first and `v1.0.0` second. Never move a tag.
|
|
9. Refresh the untagged GitHub discovery snapshot and point it to canonical
|
|
Gitea releases and contribution channels.
|
|
|
|
## Explicitly deferrable after v1
|
|
|
|
Unless testing finds a release-blocking consequence, v1 need not include every
|
|
possible context, hostile-local filesystem hardening, typed trust-flow analysis,
|
|
complete dynamic cycle detection, an encrypted reporting key, or an external
|
|
audit. Those limits must remain visible and must not be contradicted by
|
|
marketing. New features do not outrank a small stable contract.
|
|
|
|
## Definition of confidence
|
|
|
|
“Ready for v1” means a reviewer can trace each promise to a stable public
|
|
contract, executable evidence from supported native environments, and a signed
|
|
artifact built from the exact canonical source. It does not mean perfect,
|
|
invulnerable, or finished forever.
|