gamertan
113c95c21e
Publish the reviewed security policy and evidence, exact runtime ABI enforcement, orphan-output and permission safeguards, dead-upstream cleanup, and the evidence-gated v1 launch plan. This commit is an exact sanitized export from the private development record. Material implementation and review were assisted by OpenAI Codex; Cole Speelman reviewed the changes and accepts human responsibility. Himesan-Output-Permission: v1.0 Signed-off-by: Cole Speelman <gamertan@noreply.localhost>
sando runtime
gamertan.com/sandwich-hime/sando is the independent Apache-2.0 runtime ABI for Go generated by Sandwich Hime. It contains no compiler, router, HTTP server, middleware, reflection registry, project discovery, or development supervisor.
The stable surface is:
type Component interface {
Render(context.Context, io.Writer) error
}
type ComponentFunc func(context.Context, io.Writer) error
Render invokes components; generated code uses the context-specific writer helpers and checks ABI. Opaque TrustedHTML, TrustedURL, TrustedJS, and TrustedCSS values can be constructed only by conspicuous Trust* calls in trusted application code.
The runtime has its own go.mod, Apache-2.0 license, COPYRIGHT record, semantic version, and sando/vX.Y.Z tags. It never imports the AGPL compiler. Importing the runtime does not make an application AGPL under the project's terms. Applications may license their own code and generated files under terms they choose to the extent they hold the necessary rights, while redistribution of the runtime remains subject to Apache-2.0.