sandwich-hime/ROADMAP.md

Proof-in-the-pudding roadmap

Unchecked items are release blockers for the milestone that contains them, not necessarily blockers for an earlier prerelease. The ordered initiative, repository topology, release-candidate sequence, and definition of confidence are maintained in docs/V1_RELEASE_PLAN.md.

Beta 1: public learning and evaluation (historical)

Beta 1 deliberately ships before the final-v1 compatibility and artifact gates. Its scope is classroom use, learning, prototypes, and compatibility feedback; it is not a production-stability promise.

• Define beta versus RC/final support and compatibility policy.
• Establish a one-time public pre-beta Linux/Windows evidence matrix on Go 1.25 and Go 1.26.
• Record the untested macOS boundary without presenting it as evidence.
• Rerun the historical Windows/Linux campaign and deterministic generation on the exact Beta 1 candidate.
• Publish immutable sando/v1.0.0-beta.1, then v1.0.0-beta.1, from the reviewed public commit.
• Verify clean runtime-first direct and public-proxy installs after publication.

Compiler and runtime for RC/final

• Freeze and machine-check the compiler, CLI, diagnostic, schema, generated, and runtime compatibility contracts.
• Repeat compiler-owned deterministic golden output across the supported Linux and macOS Go lanes on the exact candidate.
• Compile temporary consumer modules using committed Go and only the Apache runtime.
• Run the parser, delimiter, context, path, and source-map release fuzz campaign.
• Evidence adversarial escaping and filesystem cases.
• Pass test, race, vet, vulnerability, and license gates on the latest two supported Go lines.
• Reproduce compiler/runtime release artifacts, checksums, and SBOMs; sign and notarize the macOS distribution outside runner authority.

Development supervisor for RC/final

• Generation/build/start/health failures keep the previous healthy server live.
• SSE reconnect/reload and mapped overlay diagnostics pass browser-level tests.
• CSP hash injection, fragment/API/download exclusion, and cache disabling pass.
• Replaced and interrupted child processes leave no descendants on supported systems.

Repository-owned release evidence

• Differentially test contextual escaping against Go's documented html/template safety baseline.
• Reproduce repository-owned synthetic benchmark cases and methodology from a clean checkout.
• Review generated output for stable provenance, source mappings, and absence of compiler-license headers.
• Document the production boundary: committed generated Go plus the Apache runtime, with no compiler or development supervisor in the deployed binary.
• Keep unsupported or unmeasured performance and production claims out of release materials.

Final public launch

• Complete final human review of ownership notices, output permission, DCO contribution process, and pre-registration trademark terms.
• Complete name clearance, security-mailbox recovery, release signing, and two-person credential recovery.
• Verify gamertan.com vanity metadata and documented RC installs from clean machines.
• Confirm the sanitized public Gitea source contains no private paths, identifiers, history, or unsupported claims.
• Publish and observe signed RC artifacts on Linux/amd64 and Darwin/arm64.
• Publish sando/v1.0.0, then v1.0.0, without moving either tag.