@hadden-industries/markdown-quality 0.1.0-alpha.4 → 1.0.0

package/README.md

@@ -4,11 +4,9 @@ This package supplies one CLI and library for Markdown layout, sentence lines, G
 Consumers declare their authored-document scope in `.markdown-quality.json`.
 The package preserves the existing AGPL-3.0-only license.
 
-The current version is a candidate for public alpha distribution.
-Controlled native component clearance and Windows/Linux packed qualification passed for the retained binaries.
-The published alpha.2 tuple failed Linux registry execution because its Windows-packed native archive omitted executable permissions.
-Alpha.3 corrects the archive header and retains every native executable/source/notice byte.
-The corrected public tuple requires fresh registry qualification before use; both accepted pilots and recovery evidence still block stable v1.0.
+Core and platform packages share one exact release version.
+Install a release after its coordinated tuple passes registry and consumer qualification.
+Registry publication and promotion to `latest` are separate outcomes.
 
 ```sh
 markdown-quality check --root /path/to/repository

package/SECURITY.md

@@ -1,7 +1,7 @@
 # Security policy
 
-Before stable release, security support covers only the single prerelease designated by npm's `pilot` tag.
-After stable release, it covers only the latest stable release designated by `latest`, unless an explicit policy accepts another line.
+Before stable promotion, security support covers only the single candidate designated by npm's `pilot` tag.
+After stable promotion, it covers only the latest stable release designated by `latest`, unless an explicit policy accepts another line.
 Consumers should pin exact versions and qualify upgrades.
 Older releases remaining downloadable does not imply maintenance or backport support.
 The supported runtime is Node 24.21.0 on Windows x64 and Ubuntu 24.04 x64 with glibc 2.39, with the qualified core/native tuple and explicit preset.

package/docs/ci-trust.md

@@ -15,8 +15,10 @@ A private shared Action is optional and does not solve public caller access.
 | Pilot fork PR            | Reviewed base tooling and policy                      | Separate trusted acquisition                    | Candidate data only; no candidate scripts or graph   | Architecture selected; qualification pending |
 | Tool or policy update PR | Existing accepted graph until review                  | New graph requires owner review                 | Never treat candidate graph or exclusions as trusted | Required review remains explicit             |
 
-The package CI has no registry secret or OIDC permission.
-It installs with lifecycle scripts disabled and qualifies both OS targets.
+Package tests and candidate/registry qualification have no registry secret or OIDC permission.
+They install with lifecycle scripts disabled and qualify both OS targets.
+The separately dispatched publisher grants OIDC issuance only to its main-restricted npm-publication job.
+Its exact candidate/source/manifest gate precedes public pilot publication; registry qualification remains credential-free and latest promotion remains separately gated.
 Packed-consumer tests acquire public JavaScript dependencies before testing offline frozen-lock reinstallation and runtime execution.
 The source lock acquisition alone does not populate metadata for a fresh consumer install.
 It cannot serve as evidence that a pilot's private access works.
@@ -35,7 +37,7 @@ Before each pilot merge, the owner accepts the exact candidate head/tree and att
 Any changed candidate, base policy/workflow or tool identity invalidates that acceptance.
 A same-name candidate job or green PR summary cannot substitute for this record.
 This route provides manual owner enforcement; it does not claim automatic workflow-specific enforcement.
-No separate App, paid entitlement, write-capable status reporter, OIDC authority or new secret is created.
+The pilot trusted-run boundary creates no separate App, paid entitlement, write-capable status reporter, OIDC authority or new secret.
 Negative hosted probes must still show malformed-link failure, candidate policy/ignore non-authority, candidate marker non-execution and credential absence.
 The single owner's own PR does not constitute independent human approval; any necessary integration route must be explicit and recorded.
 

package/docs/consumer-guide.md

@@ -4,12 +4,14 @@ Install an exact coordinated public release after registry availability is verif
 Acquisition needs no npm account or token; disable lifecycle scripts.
 
 ```sh
-npm install --save-dev --save-exact --ignore-scripts @hadden-industries/markdown-quality@0.1.0-alpha.3
+npm install --save-dev --save-exact --ignore-scripts @hadden-industries/markdown-quality@1.0.0
 npm ci --ignore-scripts
 ```
 
-Version `0.1.0-alpha.3` is published under the `pilot` tag and qualified for fresh anonymous root and isolated installations on Windows x64 and Ubuntu 24.04 x64.
-It remains a prerelease; pilot acceptance and stable promotion are pending.
+The source candidate is `1.0.0`; confirm its registry availability and exact tuple qualification before using the command above.
+Publication under `pilot` and promotion to `latest` are separate steps.
+The previously qualified alpha.4 tuple remains immutable historical evidence.
+Both consumer pilots must accept the exact stable tuple before promotion.
 Keep the consumer lockfile.
 An isolated `tooling/markdown` npm project supports consumers that do not use Node for their application.
 Its commands must pass the actual repository root.

package/docs/support-and-release.md

@@ -16,7 +16,7 @@ Changed defaults require a new preset major, and a package major when existing i
 Dependency upgrades are classified from observed corpus and consumer deltas.
 Never overwrite a published version.
 
-The current alpha is not stable v1.0.
+The current source prepares version 1.0.0 under the pilot tag; stable promotion remains gated.
 Stable promotion requires the same qualified tuple on both platforms, public registry readback and unauthenticated installation, both pilot acceptances, and a timed restoration exercise.
 Changed/referrer mode and later fleet adoptions remain deferred.
 
@@ -40,16 +40,23 @@ An upstream Cargo lock is a superset of features and development inputs and does
 The original upstream license and per-asset repack identity are retained.
 
 The owner selected public distribution after npm rejected the private publication with E402.
-All three packages declare public access and share the candidate version 0.1.0-alpha.4.
-The alpha.4 candidate avoids duplicate formatting of byte-identical documents while retaining independent prose checks and the changed-document preservation/convergence checks.
+All three packages declare public access and share the source candidate version 1.0.0.
+It retains alpha.4's qualified native executable/source/notice bytes and avoids duplicate formatting of byte-identical documents while retaining independent prose checks and preservation/convergence checks.
 The first alpha.3 hosted OWLAPI shadow checks passed correctness but exceeded the accepted 30-second budget on both platforms.
-Alpha.3 remains immutable historical evidence; alpha.4 requires fresh transported-archive, registry, and pilot qualification before promotion.
+Alpha.3 and alpha.4 remain immutable historical evidence; every new tuple requires fresh transported-archive, registry, and exact-version pilot qualification before promotion.
 The public alpha.2 archives remain immutable historical delivery evidence and are unqualified for Linux execution.
 The packer normalizes the Linux npm member's executable mode with Python tarfile, verifies all member bytes are unchanged, and recomputes the final archive integrity.
 Qualify the exact transported release archives on both platforms, rather than each platform's independently generated package.
 The unpublished private alpha.1 candidate and all rejected attempts remain historical evidence.
 Direct first publication uses explicit public access; a staged placeholder is unnecessary.
-OIDC publication is preferred after actual package/workflow eligibility is configured.
+The manual publisher uses npm 12.2.0 in hosted CI and requires all three npm trusted-publisher mappings for this repository, publish.yml and the npm-publication environment.
+That environment must permit exactly the main branch.
+It verifies a successful same-source candidate run, all three same-attempt jobs, the approved manifest digest and exact frozen archive bytes before publishing native packages and then core under pilot.
+Only the publication job has OIDC issuance permission; no long-lived npm token is supplied.
+Both registry jobs use native npm signature/attestation verification and bind the verified provenance to the approved source, workflow and publication run.
+Structural provenance fixtures do not establish cryptographic acceptance.
+The workflow does not promote latest; both pilots and recovery must accept the exact tuple first.
+GitHub artifacts expire after 30 days, so export the complete frozen source, manifest, archives and verification bundles to the retained evidence store before expiry, for the security policy's maintained-lifetime-plus-three-years floor.
 Public installation needs no registry token, subscription, or OIDC authority.
 Public npm provenance is eligible only through a qualified supported publisher; do not claim it for the local bootstrap.
 Retain attributable source/build/repack evidence and qualify attestations separately.
@@ -75,7 +82,7 @@ Private reporting is enabled for this repository, as read back from GitHub on 20
 Review dependency/advisory health at each release preparation and monthly while maintained.
 Retain release source, build inputs, notices, recipient delivery/qualification evidence, and accepted recovery inputs for the maintained release lifetime plus three years after support ends, honoring any applicable license obligations requiring more.
 This is an operational retention floor, not a legal interpretation.
-Before stable, only the prerelease designated by `pilot` is maintained; after stable, only the latest stable release designated by `latest` is maintained unless another line is explicitly accepted.
+Before stable promotion, only the candidate designated by `pilot` is maintained; after stable promotion, only the latest stable release designated by `latest` is maintained unless another line is explicitly accepted.
 Consumers remain exactly pinned and upgrades individually qualified; older downloadable releases have no implied support or backport promise.
 
 Pilot qualification uses six consecutive valid full checks per frozen corpus/platform, excluding installation, with observed nearest-rank sample p95 at most 30 seconds.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hadden-industries/markdown-quality",
-  "version": "0.1.0-alpha.4",
+  "version": "1.0.0",
   "description": "Shared, bounded Markdown formatting, GFM linting, and local-link checking",
   "type": "module",
   "license": "AGPL-3.0-only",
@@ -46,7 +46,7 @@
     "prettier": "3.9.9"
   },
   "optionalDependencies": {
-    "@hadden-industries/markdown-quality-win32-x64": "0.1.0-alpha.4",
-    "@hadden-industries/markdown-quality-linux-x64": "0.1.0-alpha.4"
+    "@hadden-industries/markdown-quality-win32-x64": "1.0.0",
+    "@hadden-industries/markdown-quality-linux-x64": "1.0.0"
   }
 }