@hadden-industries/markdown-quality 0.1.0-alpha.4 → 1.0.1

package/README.md

@@ -4,11 +4,9 @@ This package supplies one CLI and library for Markdown layout, sentence lines, G
 Consumers declare their authored-document scope in `.markdown-quality.json`.
 The package preserves the existing AGPL-3.0-only license.
 
-The current version is a candidate for public alpha distribution.
-Controlled native component clearance and Windows/Linux packed qualification passed for the retained binaries.
-The published alpha.2 tuple failed Linux registry execution because its Windows-packed native archive omitted executable permissions.
-Alpha.3 corrects the archive header and retains every native executable/source/notice byte.
-The corrected public tuple requires fresh registry qualification before use; both accepted pilots and recovery evidence still block stable v1.0.
+Core and platform packages share one exact release version.
+Install a release after its coordinated tuple passes registry and consumer qualification.
+Registry publication and promotion to `latest` are separate outcomes.
 
 ```sh
 markdown-quality check --root /path/to/repository

package/SECURITY.md

@@ -1,7 +1,7 @@
 # Security policy
 
-Before stable release, security support covers only the single prerelease designated by npm's `pilot` tag.
-After stable release, it covers only the latest stable release designated by `latest`, unless an explicit policy accepts another line.
+Before stable promotion, security support covers only the single candidate designated by npm's `pilot` tag.
+After stable promotion, it covers only the latest stable release designated by `latest`, unless an explicit policy accepts another line.
 Consumers should pin exact versions and qualify upgrades.
 Older releases remaining downloadable does not imply maintenance or backport support.
 The supported runtime is Node 24.21.0 on Windows x64 and Ubuntu 24.04 x64 with glibc 2.39, with the qualified core/native tuple and explicit preset.

package/docs/ci-trust.md

@@ -15,8 +15,10 @@ A private shared Action is optional and does not solve public caller access.
 | Pilot fork PR            | Reviewed base tooling and policy                      | Separate trusted acquisition                    | Candidate data only; no candidate scripts or graph   | Architecture selected; qualification pending |
 | Tool or policy update PR | Existing accepted graph until review                  | New graph requires owner review                 | Never treat candidate graph or exclusions as trusted | Required review remains explicit             |
 
-The package CI has no registry secret or OIDC permission.
-It installs with lifecycle scripts disabled and qualifies both OS targets.
+Package tests and candidate/registry qualification have no registry secret or OIDC permission.
+They install with lifecycle scripts disabled and qualify both OS targets.
+The separately dispatched publisher grants OIDC issuance only to its main-restricted npm-publication job.
+Its exact candidate/source/manifest gate precedes public pilot publication; registry qualification remains credential-free and latest promotion remains separately gated.
 Packed-consumer tests acquire public JavaScript dependencies before testing offline frozen-lock reinstallation and runtime execution.
 The source lock acquisition alone does not populate metadata for a fresh consumer install.
 It cannot serve as evidence that a pilot's private access works.
@@ -35,7 +37,7 @@ Before each pilot merge, the owner accepts the exact candidate head/tree and att
 Any changed candidate, base policy/workflow or tool identity invalidates that acceptance.
 A same-name candidate job or green PR summary cannot substitute for this record.
 This route provides manual owner enforcement; it does not claim automatic workflow-specific enforcement.
-No separate App, paid entitlement, write-capable status reporter, OIDC authority or new secret is created.
+The pilot trusted-run boundary creates no separate App, paid entitlement, write-capable status reporter, OIDC authority or new secret.
 Negative hosted probes must still show malformed-link failure, candidate policy/ignore non-authority, candidate marker non-execution and credential absence.
 The single owner's own PR does not constitute independent human approval; any necessary integration route must be explicit and recorded.
 

package/docs/consumer-guide.md

@@ -4,12 +4,14 @@ Install an exact coordinated public release after registry availability is verif
 Acquisition needs no npm account or token; disable lifecycle scripts.
 
 ```sh
-npm install --save-dev --save-exact --ignore-scripts @hadden-industries/markdown-quality@0.1.0-alpha.3
+npm install --save-dev --save-exact --ignore-scripts @hadden-industries/markdown-quality@1.0.0
 npm ci --ignore-scripts
 ```
 
-Version `0.1.0-alpha.3` is published under the `pilot` tag and qualified for fresh anonymous root and isolated installations on Windows x64 and Ubuntu 24.04 x64.
-It remains a prerelease; pilot acceptance and stable promotion are pending.
+The source candidate is `1.0.0`; confirm its registry availability and exact tuple qualification before using the command above.
+Publication under `pilot` and promotion to `latest` are separate steps.
+The previously qualified alpha.4 tuple remains immutable historical evidence.
+Both consumer pilots must accept the exact stable tuple before promotion.
 Keep the consumer lockfile.
 An isolated `tooling/markdown` npm project supports consumers that do not use Node for their application.
 Its commands must pass the actual repository root.
@@ -75,6 +77,7 @@ Lint messages describe the violated rule without quoting document content.
 These are conservative operational limits; benchmark and platform acceptance remains part of candidate qualification.
 
 Formatting compares maintained parsed structure and literals before replacement and verifies convergence.
+Fenced and indented code retain literal whitespace, including whitespace-only lines and trailing spaces; embedded code formatting remains disabled.
 The parsed comparison is an additional backstop, not a universal rendered-equivalence guarantee.
 It conservatively refuses unsupported semantic or literal changes.
 Ordinary file permission bits are preserved; ownership changes, alternate streams, ACL inheritance, arbitrary metadata, and adversarial filesystem races are not promised as preserved.

package/docs/support-and-release.md

@@ -15,9 +15,16 @@ An opt-in compatible feature may use a minor version.
 Changed defaults require a new preset major, and a package major when existing invocations change.
 Dependency upgrades are classified from observed corpus and consumer deltas.
 Never overwrite a published version.
+After npm accepts publication, allow up to five minutes for anonymous version metadata and both installer metadata representations to expose the exact approved integrity.
+Only a processing 404 is retried; mismatched integrity and other failures stop delivery.
+Publication is never repeated by this availability check.
+The three bounded waits fit within the publisher's thirty-minute job limit.
 
-The current alpha is not stable v1.0.
+The current source prepares version 1.0.0 under the pilot tag; stable promotion remains gated.
 Stable promotion requires the same qualified tuple on both platforms, public registry readback and unauthenticated installation, both pilot acceptances, and a timed restoration exercise.
+The 1.0.1 corrective candidate restores checking and formatting of literal code lines containing trailing or whitespace-only spaces.
+This repair changes shipped JavaScript and therefore requires a new coordinated patch version; completing the unchanged 1.0.0 archives remains a separate recovery operation.
+Keep latest promotion blocked until the literal-preservation repair and exact candidate satisfy the same platform, registry and pilot gates.
 Changed/referrer mode and later fleet adoptions remain deferred.
 
 Prepare assets explicitly from their frozen manifest.
@@ -40,16 +47,29 @@ An upstream Cargo lock is a superset of features and development inputs and does
 The original upstream license and per-asset repack identity are retained.
 
 The owner selected public distribution after npm rejected the private publication with E402.
-All three packages declare public access and share the candidate version 0.1.0-alpha.4.
-The alpha.4 candidate avoids duplicate formatting of byte-identical documents while retaining independent prose checks and the changed-document preservation/convergence checks.
+All three packages declare public access and share the source candidate version 1.0.0.
+It retains alpha.4's qualified native executable/source/notice bytes and avoids duplicate formatting of byte-identical documents while retaining independent prose checks and preservation/convergence checks.
 The first alpha.3 hosted OWLAPI shadow checks passed correctness but exceeded the accepted 30-second budget on both platforms.
-Alpha.3 remains immutable historical evidence; alpha.4 requires fresh transported-archive, registry, and pilot qualification before promotion.
+Alpha.3 and alpha.4 remain immutable historical evidence; every new tuple requires fresh transported-archive, registry, and exact-version pilot qualification before promotion.
 The public alpha.2 archives remain immutable historical delivery evidence and are unqualified for Linux execution.
 The packer normalizes the Linux npm member's executable mode with Python tarfile, verifies all member bytes are unchanged, and recomputes the final archive integrity.
 Qualify the exact transported release archives on both platforms, rather than each platform's independently generated package.
 The unpublished private alpha.1 candidate and all rejected attempts remain historical evidence.
 Direct first publication uses explicit public access; a staged placeholder is unnecessary.
-OIDC publication is preferred after actual package/workflow eligibility is configured.
+The manual publisher uses npm 12.2.0 in hosted CI and requires all three npm trusted-publisher mappings for this repository, publish.yml and the npm-publication environment.
+That environment must permit exactly the main branch.
+Ordinary publication verifies a successful same-source candidate run, all three same-attempt jobs, the approved manifest digest and exact frozen archive bytes.
+Recovery preserves the original candidate's source and archives separately from the current reviewed publishing-control source.
+An admission job without OIDC binds a complete three-package origin map before effects; both platform jobs qualify previously attempted packages before the publisher may run.
+Only a prior planned effect with an explicitly skipped publication step is eligible for first publication; an attempted or unknown outcome must be verified in the registry and cannot become eligible through a 404.
+Each downstream job rehashes its downloaded archives against the admitted manifest.
+The publisher rechecks current main, all three local archive hashes and version absence immediately before each single eligible publication, verifies both native archives before core, and uses only pilot.
+Only the publication job has OIDC issuance permission; no long-lived npm token is supplied.
+Both registry jobs use native npm signature/attestation verification and bind each installed package to its admitted source, workflow, exact publication run and attempt.
+Each platform installs and cryptographically verifies its supported native package and core; opposite-platform native archives receive anonymous raw-byte verification, with the combined platform records covering the complete tuple.
+Structural provenance fixtures do not establish cryptographic acceptance.
+The workflow does not promote latest; both pilots and recovery must accept the exact tuple first.
+GitHub artifacts expire after 30 days, so export the complete frozen source, manifest, archives and verification bundles to the retained evidence store before expiry, for the security policy's maintained-lifetime-plus-three-years floor.
 Public installation needs no registry token, subscription, or OIDC authority.
 Public npm provenance is eligible only through a qualified supported publisher; do not claim it for the local bootstrap.
 Retain attributable source/build/repack evidence and qualify attestations separately.
@@ -60,6 +80,17 @@ Qualify root and isolated consumers on both supported platforms from the registr
 Do not perform registry publication while rights, publisher authentication, independent assurance, or platform evidence remains missing.
 A partial publication stays unpromoted and receives a new corrective version if bytes change.
 
+For unchanged-version recovery, manually dispatch `publish.yml` with the original `candidate-run` and `manifest-sha256`, plus the terminal prior `recovery-run` and exact `recovery-attempt`.
+The original legacy publication can omit `recovery-origins-sha256` only when its source is the original artifact source and its retained manifest matches exactly.
+For a later recovery, independently approve the prior admission map's SHA-256 and pass it as `recovery-origins-sha256`; never infer expected origins from the attestation being verified.
+Retain the actual dispatch inputs, original candidate/manifest, admission artifact, per-package map, provider attempts/jobs, effect outcomes and both registry reports.
+Use a new manual dispatch rather than blindly rerunning a partial publication.
+After known acceptance, availability polling retries metadata 404 or an installer metadata document whose version map has not yet acquired the target version for at most five minutes with bounded requests; it never invokes publication again.
+The version endpoint, abbreviated installer metadata and full installer metadata share that deadline; every visible target must match the approved name, version and integrity.
+Anonymous qualification repeats this admission before installing; malformed metadata, mismatched bytes and access failures are terminal.
+The publication job is bounded to 30 minutes to accommodate three independent visibility waits and native verification; failed or cancelled jobs require evidence reconciliation, not automatic publication retries.
+An unavailable attempted package, mismatched bytes/origin, non-404 registry failure or unresolved live producer stops delivery until its outcome is established.
+
 For recovery, retain the exact consumer base revision, old manifest and lock, workflows, selected document preimages, and unrelated-file sentinels.
 Restore only migration-owned changes.
 Verify byte identities and required checks, then record elapsed restoration time.
@@ -75,7 +106,7 @@ Private reporting is enabled for this repository, as read back from GitHub on 20
 Review dependency/advisory health at each release preparation and monthly while maintained.
 Retain release source, build inputs, notices, recipient delivery/qualification evidence, and accepted recovery inputs for the maintained release lifetime plus three years after support ends, honoring any applicable license obligations requiring more.
 This is an operational retention floor, not a legal interpretation.
-Before stable, only the prerelease designated by `pilot` is maintained; after stable, only the latest stable release designated by `latest` is maintained unless another line is explicitly accepted.
+Before stable promotion, only the candidate designated by `pilot` is maintained; after stable promotion, only the latest stable release designated by `latest` is maintained unless another line is explicitly accepted.
 Consumers remain exactly pinned and upgrades individually qualified; older downloadable releases have no implied support or backport promise.
 
 Pilot qualification uses six consecutive valid full checks per frozen corpus/platform, excluding installation, with observed nearest-rank sample p95 at most 30 seconds.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hadden-industries/markdown-quality",
-  "version": "0.1.0-alpha.4",
+  "version": "1.0.1",
   "description": "Shared, bounded Markdown formatting, GFM linting, and local-link checking",
   "type": "module",
   "license": "AGPL-3.0-only",
@@ -46,7 +46,7 @@
     "prettier": "3.9.9"
   },
   "optionalDependencies": {
-    "@hadden-industries/markdown-quality-win32-x64": "0.1.0-alpha.4",
-    "@hadden-industries/markdown-quality-linux-x64": "0.1.0-alpha.4"
+    "@hadden-industries/markdown-quality-win32-x64": "1.0.1",
+    "@hadden-industries/markdown-quality-linux-x64": "1.0.1"
   }
 }

package/src/formatting.js

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: AGPL-3.0-only
-import * as prettier from "prettier";
+import { formatLayout } from "./literal-layout.js";
 import { parse } from "./analysis.js";
 import { runNative } from "./native-tool.js";
 import { checkProse } from "./prose-diagnostics.js";
@@ -30,8 +30,8 @@ export async function formatDocument(text, context, tool) {
     tabWidth: context.config.layout.tabWidth,
     plugins: [],
   };
-  const layout = await prettier.format(text, options);
-  const result = await prettier.format(runNative(tool, layout), options);
+  const layout = await formatLayout(text, options);
+  const result = await formatLayout(runNative(tool, layout), options);
   // Byte identity proves preservation and an observed fixed point of the entire
   // deterministic formatter pipeline. The independent prose check still runs.
   if (result === text)
@@ -41,7 +41,7 @@ export async function formatDocument(text, context, tool) {
     JSON.stringify(semantic(parse(result)))
   )
     fail("PRESERVATION", "Formatting changed parsed meaning or a literal.");
-  const second = await prettier.format(runNative(tool, result), options);
+  const second = await formatLayout(runNative(tool, result), options);
   if (result !== second)
     fail("CONVERGENCE", "Formatter pipeline did not converge.");
   return { output: result, diagnostics: checkProse(tool, result) };

package/src/literal-layout.js

@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+import { createHash } from "node:crypto";
+import * as prettier from "prettier";
+import { parse } from "./analysis.js";
+import { fail } from "./contracts.js";
+
+// embeddedLanguageFormatting: off still allows Prettier to trim code-line
+// whitespace. Keep those lines nonempty until layout finishes, then remove the
+// absent marker before native analysis or the unchanged semantic guard runs.
+export async function formatLayout(text, options) {
+  const rows = text.split(/(\r\n|\r|\n)/u);
+  const selected = new Set();
+  function visit(node, quoteDepth = 0) {
+    if (node.type === "blockquote") quoteDepth++;
+    if (node.type === "code") {
+      // mdast locates actual opening fences at their marker; indented code
+      // starts at its indentation, even if its literal text resembles a fence.
+      const opening = /^(`{3,}|~{3,})/u.exec(
+        text.slice(node.position.start.offset),
+      );
+      let closing = rows[(node.position.end.line - 1) * 2];
+      for (let quote = 0; quote < quoteDepth; quote++) {
+        const prefix = /^[ \t]*>[ \t]?/u.exec(closing);
+        if (!prefix) {
+          closing = "";
+          break;
+        }
+        closing = closing.slice(prefix[0].length);
+      }
+      closing = closing.replace(/^[ \t]+|[ \t]+$/gu, "");
+      const closed =
+        opening &&
+        closing.length >= opening[1].length &&
+        [...closing].every((character) => character === opening[1][0]) &&
+        // A fence-shaped line can itself be literal content. The maintained
+        // parser omits a real closer from its value; compare source/value line
+        // counts rather than inferring valid closing indentation ourselves.
+        (node.value === "" ||
+          node.position.end.line -
+            node.position.start.line -
+            (node.position.end.column === 1 ? 1 : 0) >
+            node.value.split(/\r\n|\r|\n/u).length);
+      // An EOF position at column one names the following empty source row,
+      // not another literal line. Marking it would add a newline to the value.
+      const endLine =
+        node.position.end.line -
+        (closed || node.position.end.column === 1 ? 1 : 0);
+      for (
+        let line = node.position.start.line - (opening ? 0 : 1);
+        line < endLine;
+        line++
+      )
+        if (
+          rows[line * 2] !== undefined &&
+          (rows[line * 2] === "" || /\s$/u.test(rows[line * 2]))
+        )
+          selected.add(line * 2);
+    }
+    for (const child of node.children ?? []) visit(child, quoteDepth);
+  }
+  visit(parse(text));
+  if (!selected.size) return prettier.format(text, options);
+  let marker;
+  for (let code = 0xe000; code < 0xe100; code++) {
+    const candidate = String.fromCharCode(code);
+    if (!text.includes(candidate)) {
+      marker = candidate;
+      break;
+    }
+  }
+  marker ??= `MQ_LITERAL_${createHash("sha256").update(text).digest("hex")}`;
+  if (text.includes(marker))
+    fail("PRESERVATION", "Cannot protect literal layout without a collision.");
+  for (const line of selected) rows[line] += marker;
+  const formatted = await prettier.format(rows.join(""), options);
+  if (formatted.split(marker).length - 1 !== selected.size)
+    fail("PRESERVATION", "Formatting changed literal layout protection.");
+  return formatted.replaceAll(marker, "");
+}