Files

T

gamertan b7a84054d7 release: prepare Sandwich Hime v1 beta

Publish the sanitized Beta 1 source candidate with version-stable generated provenance, classroom/evaluation support boundaries, provisional macOS support, signed-source release policy, and an exact candidate preflight.

Material implementation, drafting, and review were assisted by OpenAI Codex. Cole Speelman reviewed the public snapshot and accepts human responsibility for the contribution.

Signed-off-by: Cole Speelman <crspeelman@gmail.com>

2026-08-12 14:37:53 -04:00

check-licenses.sh

refactor: keep compiler source standalone

2026-08-11 23:58:25 -04:00

README.md

release: prepare Sandwich Hime v1 beta

2026-08-12 14:37:53 -04:00

release-check.sh

release: prepare Sandwich Hime v1 beta

2026-08-12 14:37:53 -04:00

verify-public-install.sh

release: prepare Sandwich Hime v1 beta

2026-08-12 14:37:53 -04:00

verify.ps1

refactor: keep compiler source standalone

2026-08-11 23:58:25 -04:00

verify.sh

refactor: keep compiler source standalone

2026-08-11 23:58:25 -04:00

README.md

Repository verification tools

These scripts are intentionally understandable shell and PowerShell rather than a release framework with hidden defaults.

verify.sh runs root and nested-module tests and vet, builds himesan, checks the compiler-owned golden output, and proves two generation passes leave the same bytes and unchanged modification times. Set HIMESAN_RACE=1 for race tests.
verify.ps1 provides the equivalent native Windows lane; pass -Race to include the race detector.
check-licenses.sh enforces the AGPL compiler / Apache runtime boundary and prevents generated application Go from inheriting an AGPL identifier.
release-check.sh --version vX.Y.Z is a clean-checkout technical preflight, including exact candidate-version and generated-provenance checks. Beta publication follows the narrower prerelease gates in RELEASE.md; release candidates and final v1 additionally use --public with a human-reviewed HIMESAN_RELEASE_EVIDENCE_DIR. The script never tags, pushes, publishes, or deploys.
verify-public-install.sh --version vX.Y.Z is a post-tag/publication check. It verifies exact go-get=1 package routes and runs the documented compiler install and runtime get from fresh direct-fetch and public-proxy caches without interactive Git credentials.

The canonical Linux CI and release preflight also run bounded fuzz sessions for the parser/context compiler and Go-aware delimiter scanner. Seed-corpus execution remains part of ordinary go test; the bounded sessions are extra evidence, not a substitute for longer scheduled fuzzing before v1.

The release preflight invokes govulncheck from the official Go vulnerability project at the exact module version golang.org/x/vuln@v1.6.0. Updating that pin requires reviewing the upstream tag and rerunning the supported Go lines.

Preview automation status

Forge workflows are intentionally excluded from the sanitized pre-1.0 public snapshot until the project has confirmed its own Gitea runner availability and reviewed locally hosted or otherwise pinned dependencies. Local verify.sh, verify.ps1, license, and release-preflight results are the preview gates.

If Gitea automation is later added to the public repository, pin every external action to a reviewed immutable commit, document its provenance, grant minimum permissions, and keep a local verification path. A secondary forge may host a sanitized, read-only discovery snapshot, but hosted workflows stay disabled there and it does not become a release or contribution authority.