@hadden-industries/markdown-quality 0.1.0-alpha.3 → 0.1.0-alpha.4

package/SECURITY.md

@@ -0,0 +1,40 @@
+# Security policy
+
+Before stable release, security support covers only the single prerelease designated by npm's `pilot` tag.
+After stable release, it covers only the latest stable release designated by `latest`, unless an explicit policy accepts another line.
+Consumers should pin exact versions and qualify upgrades.
+Older releases remaining downloadable does not imply maintenance or backport support.
+The supported runtime is Node 24.21.0 on Windows x64 and Ubuntu 24.04 x64 with glibc 2.39, with the qualified core/native tuple and explicit preset.
+
+Report suspected vulnerabilities privately through [GitHub private vulnerability reporting](https://github.com/Hadden-Industries/markdown-quality/security/advisories/new).
+If unavailable or unsuitable, use `security@haddenindustries.com`.
+Avoid public disclosure in issues or pull requests.
+Include affected release, environment, impact, reproduction and possible mitigation, while minimizing credentials, personal data and unrelated document content.
+
+Maksym Shostak / Hadden Industries owns manual report handling and dependency/advisory review.
+No unattended monitoring or notification service is assumed.
+Maintainer targets, accepted on 2026-10-05, are:
+
+| Stage                                               | Target                                          |
+| --------------------------------------------------- | ----------------------------------------------- |
+| Acknowledge a private report                        | Five working days from receipt                  |
+| Initial severity/reachability triage                | Five further working days after acknowledgement |
+| Confirmed critical/high fix or effective mitigation | Five working days from confirmation             |
+| Confirmed medium fix or effective mitigation        | 30 calendar days from confirmation              |
+| Confirmed low fix or effective mitigation           | 90 calendar days from confirmation              |
+
+These targets are not an SLA or guaranteed resolution.
+A missed target requires a responsible owner, interim disposition or mitigation, and dated next review through the private reporting channel.
+Upon observation, suspected critical/high issues block affected promotion immediately.
+Prioritize active exploitation, exposed credentials, reachability, impact and exploit prerequisites regardless of score; [CVSS v4](https://www.first.org/cvss/v4.0/specification-document) informs documented severity.
+
+Coordinate confirmed issues through private advisories and disclose after a qualified fix or effective mitigation, unless an overriding safety or legal reason is recorded.
+Keep embargoed evidence and reporter information restricted.
+Security fixes retain component/rights, native parity, corpus, platform, package, registry and consumer qualification requirements.
+Containment, credential changes, registry deprecation and external messages require their applicable authorization.
+
+Review dependency/advisory health at every release preparation and monthly while a release is maintained.
+Native upgrades require fresh source/component rights, output/parity and platform qualification; no unattended adoption is authorized.
+Retain release source, build inputs, notices, recipient delivery/qualification evidence and accepted recovery inputs for the maintained lifetime plus three years after support ends, honoring license obligations requiring more.
+The retention period is an operational floor, not a legal interpretation.
+Preserve AGPL-3.0-only and provide corresponding source/build materials and third-party notices to recipients.

package/docs/ci-trust.md

@@ -9,8 +9,8 @@ A private shared Action is optional and does not solve public caller access.
 
 | Event                    | Trusted graph and policy                              | Acquisition                                     | Candidate processing                                 | Current status                               |
 | ------------------------ | ----------------------------------------------------- | ----------------------------------------------- | ---------------------------------------------------- | -------------------------------------------- |
-| Package pull request     | Public locked dependencies and fixed native manifests | Public upstream inputs, no private secrets      | Package tests run without elevated authority         | Hosted qualification pending                 |
-| Pilot protected branch   | Reviewed capability release and consumer policy       | Public locked graph, lifecycle scripts disabled | Full authored scope without credentials              | Public registry qualification pending        |
+| Package pull request     | Public locked dependencies and fixed native manifests | Public upstream inputs, no private secrets      | Package tests run without elevated authority         | Hosted package qualification passed          |
+| Pilot protected branch   | Reviewed capability release and consumer policy       | Public locked graph, lifecycle scripts disabled | Full authored scope without credentials              | Alpha.3 registry passed; pilot proof pending |
 | Pilot same-repository PR | Reviewed base tooling and policy                      | Separate trusted acquisition                    | Candidate Markdown and link target tree only         | Architecture selected; qualification pending |
 | Pilot fork PR            | Reviewed base tooling and policy                      | Separate trusted acquisition                    | Candidate data only; no candidate scripts or graph   | Architecture selected; qualification pending |
 | Tool or policy update PR | Existing accepted graph until review                  | New graph requires owner review                 | Never treat candidate graph or exclusions as trusted | Required review remains explicit             |
@@ -27,6 +27,18 @@ Candidate checkout must not execute application tooling, Git hooks, package life
 The checking process must not inherit checkout write credentials, npm configuration, or OIDC issuance authority.
 Trusted policy review is required for any change to required scope or exclusions.
 
+The owner accepted a manual trusted-run boundary for the two pilots on 2026-10-05.
+GitHub required checks select a name/context and App identity, not a workflow revision or event.
+App 15368 identifies GitHub Actions, including candidate-controlled jobs.
+Preserve OwlAPI's `CI / required` and WebVOWL's `WebVOWL application`, `Dependency review`, and `CodeQL gate` required checks.
+Before each pilot merge, the owner accepts the exact candidate head/tree and attributable trusted hosted run, including trusted workflow source, core/native hashes, policy/ignore digests, selected paths, run/job/check IDs, outputs and required-status readback.
+Any changed candidate, base policy/workflow or tool identity invalidates that acceptance.
+A same-name candidate job or green PR summary cannot substitute for this record.
+This route provides manual owner enforcement; it does not claim automatic workflow-specific enforcement.
+No separate App, paid entitlement, write-capable status reporter, OIDC authority or new secret is created.
+Negative hosted probes must still show malformed-link failure, candidate policy/ignore non-authority, candidate marker non-execution and credential absence.
+The single owner's own PR does not constitute independent human approval; any necessary integration route must be explicit and recorded.
+
 Do not give publication or repository-write credentials to a PR-controlled dependency graph.
 Do not execute candidate source in an elevated `pull_request_target` job.
 Public capability archives are available to all recipients; source/notice and integrity obligations still apply.
@@ -38,3 +50,4 @@ The subsequent owner request selects public distribution and removes the paid-pr
 Pilot cutover still requires exact public tuple readback, fresh credential-free installation, event/policy isolation and accepted consumer deltas.
 
 References: [GitHub event trust](https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target), [public scoped publication](https://docs.npmjs.com/creating-and-publishing-scoped-public-packages/), and [npm trusted publishing](https://docs.npmjs.com/trusted-publishers/).
+Required-check identity limitations are documented in [GitHub ruleset troubleshooting](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/troubleshooting-rules).

package/docs/consumer-guide.md

@@ -8,7 +8,8 @@ npm install --save-dev --save-exact --ignore-scripts @hadden-industries/markdown
 npm ci --ignore-scripts
 ```
 
-The version above identifies the candidate; it is not currently a published registry promise.
+Version `0.1.0-alpha.3` is published under the `pilot` tag and qualified for fresh anonymous root and isolated installations on Windows x64 and Ubuntu 24.04 x64.
+It remains a prerelease; pilot acceptance and stable promotion are pending.
 Keep the consumer lockfile.
 An isolated `tooling/markdown` npm project supports consumers that do not use Node for their application.
 Its commands must pass the actual repository root.

package/docs/support-and-release.md

@@ -40,7 +40,10 @@ An upstream Cargo lock is a superset of features and development inputs and does
 The original upstream license and per-asset repack identity are retained.
 
 The owner selected public distribution after npm rejected the private publication with E402.
-All three corrective packages declare public access and share version 0.1.0-alpha.3.
+All three packages declare public access and share the candidate version 0.1.0-alpha.4.
+The alpha.4 candidate avoids duplicate formatting of byte-identical documents while retaining independent prose checks and the changed-document preservation/convergence checks.
+The first alpha.3 hosted OWLAPI shadow checks passed correctness but exceeded the accepted 30-second budget on both platforms.
+Alpha.3 remains immutable historical evidence; alpha.4 requires fresh transported-archive, registry, and pilot qualification before promotion.
 The public alpha.2 archives remain immutable historical delivery evidence and are unqualified for Linux execution.
 The packer normalizes the Linux npm member's executable mode with Python tarfile, verifies all member bytes are unchanged, and recomputes the final archive integrity.
 Qualify the exact transported release archives on both platforms, rather than each platform's independently generated package.
@@ -66,8 +69,22 @@ One pilot rehearsal is required before stable promotion.
 Security reports use GitHub's private vulnerability reporting route when enabled; otherwise contact the repository owner through the project's existing private channel.
 No unattended observation service is assumed.
 During this authorized session, critical/high reports block promotion immediately.
-Durable acknowledgement, triage, mitigation targets, reporting availability, and maintenance ownership require owner acceptance before stable release.
-Retain release source, build inputs, notices, recipient delivery evidence, and recovery inputs for the maintained release lifetime and its accepted retention period.
+The owner accepted maintained support targets on 2026-10-05; see [the security policy](../SECURITY.md).
+Maksym Shostak / Hadden Industries owns manual report handling and dependency/advisory review.
+Private reporting is enabled for this repository, as read back from GitHub on 2026-10-05; the existing organization security mailbox is the fallback.
+Review dependency/advisory health at each release preparation and monthly while maintained.
+Retain release source, build inputs, notices, recipient delivery/qualification evidence, and accepted recovery inputs for the maintained release lifetime plus three years after support ends, honoring any applicable license obligations requiring more.
+This is an operational retention floor, not a legal interpretation.
+Before stable, only the prerelease designated by `pilot` is maintained; after stable, only the latest stable release designated by `latest` is maintained unless another line is explicitly accepted.
+Consumers remain exactly pinned and upgrades individually qualified; older downloadable releases have no implied support or backport promise.
+
+Pilot qualification uses six consecutive valid full checks per frozen corpus/platform, excluding installation, with observed nearest-rank sample p95 at most 30 seconds.
+With six samples, that is the observed maximum; it is not a statistical tail or arbitrary-repository guarantee.
+The memory budgets are 512 MiB Windows Job Object committed memory and 512 MiB Linux whole-process-tree resident memory, reported separately as different metrics.
+These budgets do not impose OS runtime limits or raise existing package limits.
+Require zero unexpected errors or adjudicated false positives in the window and accepted fixture/probe corpus, retaining expected negative probes separately.
+Rehearse one task-owned pilot restoration within 60 minutes through byte/sentinel readback and incumbent local checks; hosted required-status recovery remains separate acceptance evidence.
+Accepted budgets do not establish that the pending Linux corpus, hosted pilots, or restoration have passed.
 
 Provide AGPL corresponding source and build materials alongside object-code delivery to actual recipients.
 Preserve third-party license texts and attribution.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hadden-industries/markdown-quality",
-  "version": "0.1.0-alpha.3",
+  "version": "0.1.0-alpha.4",
   "description": "Shared, bounded Markdown formatting, GFM linting, and local-link checking",
   "type": "module",
   "license": "AGPL-3.0-only",
@@ -21,6 +21,7 @@
     "assets",
     "LICENSE",
     "LICENSES",
+    "SECURITY.md",
     "README.md",
     "THIRD-PARTY-NOTICES.md",
     "docs/consumer-guide.md",
@@ -45,7 +46,7 @@
     "prettier": "3.9.9"
   },
   "optionalDependencies": {
-    "@hadden-industries/markdown-quality-win32-x64": "0.1.0-alpha.3",
-    "@hadden-industries/markdown-quality-linux-x64": "0.1.0-alpha.3"
+    "@hadden-industries/markdown-quality-win32-x64": "0.1.0-alpha.4",
+    "@hadden-industries/markdown-quality-linux-x64": "0.1.0-alpha.4"
   }
 }

package/src/formatting.js

@@ -32,6 +32,10 @@ export async function formatDocument(text, context, tool) {
   };
   const layout = await prettier.format(text, options);
   const result = await prettier.format(runNative(tool, layout), options);
+  // Byte identity proves preservation and an observed fixed point of the entire
+  // deterministic formatter pipeline. The independent prose check still runs.
+  if (result === text)
+    return { output: result, diagnostics: checkProse(tool, result) };
   if (
     JSON.stringify(semantic(parse(text))) !==
     JSON.stringify(semantic(parse(result)))