@hadden-industries/markdown-quality 0.1.0-alpha.3 → 1.0.0

package/README.md

@@ -4,11 +4,9 @@ This package supplies one CLI and library for Markdown layout, sentence lines, G
 Consumers declare their authored-document scope in `.markdown-quality.json`.
 The package preserves the existing AGPL-3.0-only license.
 
-The current version is a candidate for public alpha distribution.
-Controlled native component clearance and Windows/Linux packed qualification passed for the retained binaries.
-The published alpha.2 tuple failed Linux registry execution because its Windows-packed native archive omitted executable permissions.
-Alpha.3 corrects the archive header and retains every native executable/source/notice byte.
-The corrected public tuple requires fresh registry qualification before use; both accepted pilots and recovery evidence still block stable v1.0.
+Core and platform packages share one exact release version.
+Install a release after its coordinated tuple passes registry and consumer qualification.
+Registry publication and promotion to `latest` are separate outcomes.
 
 ```sh
 markdown-quality check --root /path/to/repository

package/SECURITY.md

@@ -0,0 +1,40 @@
+# Security policy
+
+Before stable promotion, security support covers only the single candidate designated by npm's `pilot` tag.
+After stable promotion, it covers only the latest stable release designated by `latest`, unless an explicit policy accepts another line.
+Consumers should pin exact versions and qualify upgrades.
+Older releases remaining downloadable does not imply maintenance or backport support.
+The supported runtime is Node 24.21.0 on Windows x64 and Ubuntu 24.04 x64 with glibc 2.39, with the qualified core/native tuple and explicit preset.
+
+Report suspected vulnerabilities privately through [GitHub private vulnerability reporting](https://github.com/Hadden-Industries/markdown-quality/security/advisories/new).
+If unavailable or unsuitable, use `security@haddenindustries.com`.
+Avoid public disclosure in issues or pull requests.
+Include affected release, environment, impact, reproduction and possible mitigation, while minimizing credentials, personal data and unrelated document content.
+
+Maksym Shostak / Hadden Industries owns manual report handling and dependency/advisory review.
+No unattended monitoring or notification service is assumed.
+Maintainer targets, accepted on 2026-10-05, are:
+
+| Stage                                               | Target                                          |
+| --------------------------------------------------- | ----------------------------------------------- |
+| Acknowledge a private report                        | Five working days from receipt                  |
+| Initial severity/reachability triage                | Five further working days after acknowledgement |
+| Confirmed critical/high fix or effective mitigation | Five working days from confirmation             |
+| Confirmed medium fix or effective mitigation        | 30 calendar days from confirmation              |
+| Confirmed low fix or effective mitigation           | 90 calendar days from confirmation              |
+
+These targets are not an SLA or guaranteed resolution.
+A missed target requires a responsible owner, interim disposition or mitigation, and dated next review through the private reporting channel.
+Upon observation, suspected critical/high issues block affected promotion immediately.
+Prioritize active exploitation, exposed credentials, reachability, impact and exploit prerequisites regardless of score; [CVSS v4](https://www.first.org/cvss/v4.0/specification-document) informs documented severity.
+
+Coordinate confirmed issues through private advisories and disclose after a qualified fix or effective mitigation, unless an overriding safety or legal reason is recorded.
+Keep embargoed evidence and reporter information restricted.
+Security fixes retain component/rights, native parity, corpus, platform, package, registry and consumer qualification requirements.
+Containment, credential changes, registry deprecation and external messages require their applicable authorization.
+
+Review dependency/advisory health at every release preparation and monthly while a release is maintained.
+Native upgrades require fresh source/component rights, output/parity and platform qualification; no unattended adoption is authorized.
+Retain release source, build inputs, notices, recipient delivery/qualification evidence and accepted recovery inputs for the maintained lifetime plus three years after support ends, honoring license obligations requiring more.
+The retention period is an operational floor, not a legal interpretation.
+Preserve AGPL-3.0-only and provide corresponding source/build materials and third-party notices to recipients.

package/docs/ci-trust.md

@@ -9,14 +9,16 @@ A private shared Action is optional and does not solve public caller access.
 
 | Event                    | Trusted graph and policy                              | Acquisition                                     | Candidate processing                                 | Current status                               |
 | ------------------------ | ----------------------------------------------------- | ----------------------------------------------- | ---------------------------------------------------- | -------------------------------------------- |
-| Package pull request     | Public locked dependencies and fixed native manifests | Public upstream inputs, no private secrets      | Package tests run without elevated authority         | Hosted qualification pending                 |
-| Pilot protected branch   | Reviewed capability release and consumer policy       | Public locked graph, lifecycle scripts disabled | Full authored scope without credentials              | Public registry qualification pending        |
+| Package pull request     | Public locked dependencies and fixed native manifests | Public upstream inputs, no private secrets      | Package tests run without elevated authority         | Hosted package qualification passed          |
+| Pilot protected branch   | Reviewed capability release and consumer policy       | Public locked graph, lifecycle scripts disabled | Full authored scope without credentials              | Alpha.3 registry passed; pilot proof pending |
 | Pilot same-repository PR | Reviewed base tooling and policy                      | Separate trusted acquisition                    | Candidate Markdown and link target tree only         | Architecture selected; qualification pending |
 | Pilot fork PR            | Reviewed base tooling and policy                      | Separate trusted acquisition                    | Candidate data only; no candidate scripts or graph   | Architecture selected; qualification pending |
 | Tool or policy update PR | Existing accepted graph until review                  | New graph requires owner review                 | Never treat candidate graph or exclusions as trusted | Required review remains explicit             |
 
-The package CI has no registry secret or OIDC permission.
-It installs with lifecycle scripts disabled and qualifies both OS targets.
+Package tests and candidate/registry qualification have no registry secret or OIDC permission.
+They install with lifecycle scripts disabled and qualify both OS targets.
+The separately dispatched publisher grants OIDC issuance only to its main-restricted npm-publication job.
+Its exact candidate/source/manifest gate precedes public pilot publication; registry qualification remains credential-free and latest promotion remains separately gated.
 Packed-consumer tests acquire public JavaScript dependencies before testing offline frozen-lock reinstallation and runtime execution.
 The source lock acquisition alone does not populate metadata for a fresh consumer install.
 It cannot serve as evidence that a pilot's private access works.
@@ -27,6 +29,18 @@ Candidate checkout must not execute application tooling, Git hooks, package life
 The checking process must not inherit checkout write credentials, npm configuration, or OIDC issuance authority.
 Trusted policy review is required for any change to required scope or exclusions.
 
+The owner accepted a manual trusted-run boundary for the two pilots on 2026-10-05.
+GitHub required checks select a name/context and App identity, not a workflow revision or event.
+App 15368 identifies GitHub Actions, including candidate-controlled jobs.
+Preserve OwlAPI's `CI / required` and WebVOWL's `WebVOWL application`, `Dependency review`, and `CodeQL gate` required checks.
+Before each pilot merge, the owner accepts the exact candidate head/tree and attributable trusted hosted run, including trusted workflow source, core/native hashes, policy/ignore digests, selected paths, run/job/check IDs, outputs and required-status readback.
+Any changed candidate, base policy/workflow or tool identity invalidates that acceptance.
+A same-name candidate job or green PR summary cannot substitute for this record.
+This route provides manual owner enforcement; it does not claim automatic workflow-specific enforcement.
+The pilot trusted-run boundary creates no separate App, paid entitlement, write-capable status reporter, OIDC authority or new secret.
+Negative hosted probes must still show malformed-link failure, candidate policy/ignore non-authority, candidate marker non-execution and credential absence.
+The single owner's own PR does not constitute independent human approval; any necessary integration route must be explicit and recorded.
+
 Do not give publication or repository-write credentials to a PR-controlled dependency graph.
 Do not execute candidate source in an elevated `pull_request_target` job.
 Public capability archives are available to all recipients; source/notice and integrity obligations still apply.
@@ -38,3 +52,4 @@ The subsequent owner request selects public distribution and removes the paid-pr
 Pilot cutover still requires exact public tuple readback, fresh credential-free installation, event/policy isolation and accepted consumer deltas.
 
 References: [GitHub event trust](https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target), [public scoped publication](https://docs.npmjs.com/creating-and-publishing-scoped-public-packages/), and [npm trusted publishing](https://docs.npmjs.com/trusted-publishers/).
+Required-check identity limitations are documented in [GitHub ruleset troubleshooting](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/troubleshooting-rules).

package/docs/consumer-guide.md

@@ -4,11 +4,14 @@ Install an exact coordinated public release after registry availability is verif
 Acquisition needs no npm account or token; disable lifecycle scripts.
 
 ```sh
-npm install --save-dev --save-exact --ignore-scripts @hadden-industries/markdown-quality@0.1.0-alpha.3
+npm install --save-dev --save-exact --ignore-scripts @hadden-industries/markdown-quality@1.0.0
 npm ci --ignore-scripts
 ```
 
-The version above identifies the candidate; it is not currently a published registry promise.
+The source candidate is `1.0.0`; confirm its registry availability and exact tuple qualification before using the command above.
+Publication under `pilot` and promotion to `latest` are separate steps.
+The previously qualified alpha.4 tuple remains immutable historical evidence.
+Both consumer pilots must accept the exact stable tuple before promotion.
 Keep the consumer lockfile.
 An isolated `tooling/markdown` npm project supports consumers that do not use Node for their application.
 Its commands must pass the actual repository root.

package/docs/support-and-release.md

@@ -16,7 +16,7 @@ Changed defaults require a new preset major, and a package major when existing i
 Dependency upgrades are classified from observed corpus and consumer deltas.
 Never overwrite a published version.
 
-The current alpha is not stable v1.0.
+The current source prepares version 1.0.0 under the pilot tag; stable promotion remains gated.
 Stable promotion requires the same qualified tuple on both platforms, public registry readback and unauthenticated installation, both pilot acceptances, and a timed restoration exercise.
 Changed/referrer mode and later fleet adoptions remain deferred.
 
@@ -40,13 +40,23 @@ An upstream Cargo lock is a superset of features and development inputs and does
 The original upstream license and per-asset repack identity are retained.
 
 The owner selected public distribution after npm rejected the private publication with E402.
-All three corrective packages declare public access and share version 0.1.0-alpha.3.
+All three packages declare public access and share the source candidate version 1.0.0.
+It retains alpha.4's qualified native executable/source/notice bytes and avoids duplicate formatting of byte-identical documents while retaining independent prose checks and preservation/convergence checks.
+The first alpha.3 hosted OWLAPI shadow checks passed correctness but exceeded the accepted 30-second budget on both platforms.
+Alpha.3 and alpha.4 remain immutable historical evidence; every new tuple requires fresh transported-archive, registry, and exact-version pilot qualification before promotion.
 The public alpha.2 archives remain immutable historical delivery evidence and are unqualified for Linux execution.
 The packer normalizes the Linux npm member's executable mode with Python tarfile, verifies all member bytes are unchanged, and recomputes the final archive integrity.
 Qualify the exact transported release archives on both platforms, rather than each platform's independently generated package.
 The unpublished private alpha.1 candidate and all rejected attempts remain historical evidence.
 Direct first publication uses explicit public access; a staged placeholder is unnecessary.
-OIDC publication is preferred after actual package/workflow eligibility is configured.
+The manual publisher uses npm 12.2.0 in hosted CI and requires all three npm trusted-publisher mappings for this repository, publish.yml and the npm-publication environment.
+That environment must permit exactly the main branch.
+It verifies a successful same-source candidate run, all three same-attempt jobs, the approved manifest digest and exact frozen archive bytes before publishing native packages and then core under pilot.
+Only the publication job has OIDC issuance permission; no long-lived npm token is supplied.
+Both registry jobs use native npm signature/attestation verification and bind the verified provenance to the approved source, workflow and publication run.
+Structural provenance fixtures do not establish cryptographic acceptance.
+The workflow does not promote latest; both pilots and recovery must accept the exact tuple first.
+GitHub artifacts expire after 30 days, so export the complete frozen source, manifest, archives and verification bundles to the retained evidence store before expiry, for the security policy's maintained-lifetime-plus-three-years floor.
 Public installation needs no registry token, subscription, or OIDC authority.
 Public npm provenance is eligible only through a qualified supported publisher; do not claim it for the local bootstrap.
 Retain attributable source/build/repack evidence and qualify attestations separately.
@@ -66,8 +76,22 @@ One pilot rehearsal is required before stable promotion.
 Security reports use GitHub's private vulnerability reporting route when enabled; otherwise contact the repository owner through the project's existing private channel.
 No unattended observation service is assumed.
 During this authorized session, critical/high reports block promotion immediately.
-Durable acknowledgement, triage, mitigation targets, reporting availability, and maintenance ownership require owner acceptance before stable release.
-Retain release source, build inputs, notices, recipient delivery evidence, and recovery inputs for the maintained release lifetime and its accepted retention period.
+The owner accepted maintained support targets on 2026-10-05; see [the security policy](../SECURITY.md).
+Maksym Shostak / Hadden Industries owns manual report handling and dependency/advisory review.
+Private reporting is enabled for this repository, as read back from GitHub on 2026-10-05; the existing organization security mailbox is the fallback.
+Review dependency/advisory health at each release preparation and monthly while maintained.
+Retain release source, build inputs, notices, recipient delivery/qualification evidence, and accepted recovery inputs for the maintained release lifetime plus three years after support ends, honoring any applicable license obligations requiring more.
+This is an operational retention floor, not a legal interpretation.
+Before stable promotion, only the candidate designated by `pilot` is maintained; after stable promotion, only the latest stable release designated by `latest` is maintained unless another line is explicitly accepted.
+Consumers remain exactly pinned and upgrades individually qualified; older downloadable releases have no implied support or backport promise.
+
+Pilot qualification uses six consecutive valid full checks per frozen corpus/platform, excluding installation, with observed nearest-rank sample p95 at most 30 seconds.
+With six samples, that is the observed maximum; it is not a statistical tail or arbitrary-repository guarantee.
+The memory budgets are 512 MiB Windows Job Object committed memory and 512 MiB Linux whole-process-tree resident memory, reported separately as different metrics.
+These budgets do not impose OS runtime limits or raise existing package limits.
+Require zero unexpected errors or adjudicated false positives in the window and accepted fixture/probe corpus, retaining expected negative probes separately.
+Rehearse one task-owned pilot restoration within 60 minutes through byte/sentinel readback and incumbent local checks; hosted required-status recovery remains separate acceptance evidence.
+Accepted budgets do not establish that the pending Linux corpus, hosted pilots, or restoration have passed.
 
 Provide AGPL corresponding source and build materials alongside object-code delivery to actual recipients.
 Preserve third-party license texts and attribution.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hadden-industries/markdown-quality",
-  "version": "0.1.0-alpha.3",
+  "version": "1.0.0",
   "description": "Shared, bounded Markdown formatting, GFM linting, and local-link checking",
   "type": "module",
   "license": "AGPL-3.0-only",
@@ -21,6 +21,7 @@
     "assets",
     "LICENSE",
     "LICENSES",
+    "SECURITY.md",
     "README.md",
     "THIRD-PARTY-NOTICES.md",
     "docs/consumer-guide.md",
@@ -45,7 +46,7 @@
     "prettier": "3.9.9"
   },
   "optionalDependencies": {
-    "@hadden-industries/markdown-quality-win32-x64": "0.1.0-alpha.3",
-    "@hadden-industries/markdown-quality-linux-x64": "0.1.0-alpha.3"
+    "@hadden-industries/markdown-quality-win32-x64": "1.0.0",
+    "@hadden-industries/markdown-quality-linux-x64": "1.0.0"
   }
 }

package/src/formatting.js

@@ -32,6 +32,10 @@ export async function formatDocument(text, context, tool) {
   };
   const layout = await prettier.format(text, options);
   const result = await prettier.format(runNative(tool, layout), options);
+  // Byte identity proves preservation and an observed fixed point of the entire
+  // deterministic formatter pipeline. The independent prose check still runs.
+  if (result === text)
+    return { output: result, diagnostics: checkProse(tool, result) };
   if (
     JSON.stringify(semantic(parse(text))) !==
     JSON.stringify(semantic(parse(result)))