@publisle/research 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 VoidReg
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/NOTICE.md

@@ -0,0 +1,31 @@
+# Third-party resources
+
+Citation formatting uses citeproc-js (`citeproc` 2.4.63), by Frank Bennett and
+contributors, https://github.com/Juris-M/citeproc-js. Its original LICENSE is
+included by the dependency. That file offers CPAL 1.0 or AGPL 3-or-later;
+upstream npm SPDX metadata reads `CPAL-1.0 OR AGPL-1.0`. Publisle's own source
+license does not replace dependency licenses.
+
+The bundled locale data comes from the Citation Style Language project,
+https://CitationStyles.org/, under CC BY-SA 3.0. Translator metadata is preserved
+in every locale. The exact upstream revision and notices are retained under
+`vendor/locales`.
+
+The reviewed citation corpus under `packages/contracts/fixtures/citations.json`
+is generated with this pinned processor and those locale resources. The
+independent Python implementation is authored in-repository and vendors no CSL
+processor or locale XML; its dependency evaluation is recorded in
+`tools/python/NOTICE.md`. Both implementations expose a limited portable role,
+not a general CSL parity claim.
+
+JATS Archiving 1.3 schema files retain their original NLM/W3C/ISO notices under
+`vendor/jats`; download provenance is recorded there. Springer class/style
+assets belong to the separate template package and retain their original LPPL
+notices and unmodified source bytes. The compiler's Mozilla CA bundle retains
+its notices; see `compiler/README.md`.
+
+The optional PDF accessibility gate downloads veraPDF Greenfield 1.28.2 from
+https://software.verapdf.org/releases/1.28/ with a pinned SHA-256 digest. Its
+installed notices describe GPL v3 and MPL v2-or-later licensing. No veraPDF
+binaries are vendored in this repository. Upstream TeX Live packages retain
+their individual license notices in the explicitly installed compiler image.

package/README.md

@@ -1,3 +1,15 @@
-# Temporary Holding Version
+# @publisle/research
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Citation resolution and BibTeX, CSL, LaTeX, JATS, and PDF export. Tooling only; readers must not import it.
+
+Requires Node.js 24 or later. Framework adapters also require their declared peer dependencies.
+This package is part of Publisle, independently versioned at `0.1.1` and published under the npm `beta` tag.
+Frozen contract version integers are independent of npm package versions.
+
+- [Core standard](https://github.com/VoidReg/publisle/blob/main/docs/standards/README.md)
+- [Quickstart and package usage](https://github.com/VoidReg/publisle#readme)
+- [Distribution and release checklist](https://github.com/VoidReg/publisle/blob/main/docs/guides/releases.md)
+- [Research export guide](https://github.com/VoidReg/publisle/blob/main/docs/guides/journal-export.md)
+
+Research tooling is optional and is excluded from Core-only installations. Read any
+included `NOTICE.md` for third-party licensing obligations.

package/compiler/Dockerfile

@@ -0,0 +1,18 @@
+# Base and OS packages are frozen independently of the upstream TeX distribution.
+FROM ubuntu@sha256:72297848456d5d37d1262630108ab308d3e9ec7ed1c3286a32fe09856619a782
+ARG TARGETARCH
+COPY cacert.pem /etc/ssl/certs/ca-certificates.crt
+RUN set -eu; \
+    case "$TARGETARCH" in amd64) archive=ubuntu ;; arm64) archive=ubuntu ;; *) exit 1 ;; esac; \
+    rm -f /etc/apt/sources.list.d/ubuntu.sources; \
+    printf 'deb https://snapshot.ubuntu.com/%s/20250301T000000Z noble main universe\ndeb https://snapshot.ubuntu.com/%s/20250301T000000Z noble-updates main universe\ndeb https://snapshot.ubuntu.com/%s/20250301T000000Z noble-security main universe\n' "$archive" "$archive" "$archive" > /etc/apt/sources.list; \
+    apt-get update; \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ca-certificates curl perl xz-utils fontconfig fonts-paktype; \
+    rm -rf /var/lib/apt/lists/*
+COPY install-texlive.sh /tmp/install-texlive.sh
+RUN sh /tmp/install-texlive.sh "$TARGETARCH" && rm /tmp/install-texlive.sh
+ENV PATH="/opt/texlive/bin/platform:${PATH}"
+RUN tlmgr install latexmk tex-gyre tex-gyre-math fandol luahbtex luaotfload luatexbase lualibs luamml unicode-math tagpdf latex-lab pdfmanagement-testphase ulem natbib cite ieeetran elsarticle acmart xstring totpages environ trimspaces framed hyperxmp draftwatermark ncctools comment preprint pbalance libertine newtx inconsolata sttools threeparttable appendix breakurl wrapfig vruler && \
+    fc-cache -f /opt/texlive/texmf-dist/fonts/opentype && luaotfload-tool --update
+RUN tlmgr install ifmtarg lualatex-math luacode upquote
+WORKDIR /work

package/compiler/README.md

@@ -0,0 +1,80 @@
+# Compiler recipe
+
+Recipe 2 retains the Ubuntu noble-20250127 OCI index digest and the Ubuntu apt
+snapshot at 2025-03-01 for OS dependencies. TeX comes from the upstream frozen
+[TeX Live 2025 final repository](https://ftp.math.utah.edu/pub/tex/historic/systems/texlive/2025/tlnet-final/),
+frozen on 2026-03-01, rather than noble's older TeX packages. The installer and
+package database are pinned by SHA-512 in `install-texlive.sh`. TeX Live verifies
+package archive checksums from that database. The original database is retained
+as `/opt/texlive/tlpkg/frozen-source.tlpdb` in the image. Documentation and source
+packages are omitted. See [TUG's historic release policy](https://tug.org/texlive/acquire.html).
+
+The recipe maps Docker `amd64` to `x86_64-linux` and `arm64` to `aarch64-linux`,
+using the same frozen package database and its platform-specific archive
+checksums. Both architectures use the snapshot service's `ubuntu` archive,
+which includes arm64 package indices; the ordinary `ubuntu-ports` path is not
+a snapshot-service archive.
+
+`release.json` stores the reviewed multi-architecture registry reference. It is
+currently `null`: registry publication and a native arm64 CI run remain pending.
+Both platforms are locally verified against this recipe: the amd64 image passes
+the publisher smoke and PDF/UA fixture gates natively, and the arm64 image —
+confirmed `linux/arm64` by `docker image inspect` — passed the five-publisher
+smoke gate and all three PDF/UA fixtures (English UA-2, Arabic UA-2, English
+UA-1) with veraPDF 1.28.2 under QEMU emulation on 2026-10-10. Until a release is
+recorded, default setup builds locally.
+
+```sh
+docker build --tag publisle-compiler:2 packages/research/compiler
+pnpm cli setup compiler
+# Explicitly use the bundled local recipe, even after registry publication:
+pnpm cli setup compiler --build
+# Install a reviewed immutable registry reference:
+pnpm cli setup compiler --image ghcr.io/voidreg/publisle-compiler@sha256:<index-digest>
+```
+
+Setup prefers the digest-pinned published image when `release.json` contains a
+reference. It verifies the pulled repository digest and records the selected
+platform's immutable local `sha256` ID, recipe version, platform, and published
+index reference. Pull failures report the explicit `--build` fallback. The local
+build uses the same frozen recipe. `publisle doctor` reports native compiler
+readiness, container runtime readiness, installed image ID, platform and registry
+reference separately. Runtime exports never pull or build; they use
+`--pull=never`, a read-only container, a temporary cache, and no network. The
+container uses `openin_any=r` so LuaTeX can read absolute paths to Unicode data
+within its own compiler filesystem; its only host mount is the isolated source
+package. Native execution retains `openin_any=p`. Both disable shell escape and
+restrict output paths. Selection checks the LaTeX format before using a tagged
+compiler.
+Native tools remain supported; tagged output requires LaTeX 2025-11-01 or later.
+See the [accessibility guide](https://github.com/VoidReg/publisle/blob/main/docs/guides/accessibility.md) for the UA-2 fixture
+gate and checksum-pinned veraPDF installation.
+
+`cacert.pem` is the Mozilla CA bundle distributed by https://curl.se/ca/cacert.pem,
+retained to bootstrap HTTPS apt on the minimal base. Its SHA-256 is
+`a41b5d356aea97a529fe27e0f7316d2f9d946d75927476cf9cf1b90637d00505`.
+Original certificate notices are retained; Mozilla CA data is under MPL 2.0.
+TeX Live and installed packages retain their own license notices in the image.
+
+## Release workflow
+
+Run `.github/workflows/compiler-release.yml` manually with a new immutable
+`recipe-X.Y.Z` version after reviewing the recipe. It uses native GitHub amd64
+and arm64 runners, avoiding emulation. Each platform first builds the frozen
+recipe, compiles all five shipped publisher profiles, and passes both standard
+article profiles through the checksum-pinned veraPDF 1.28.2 PDF/UA-2 gate plus
+the English PDF/UA-1 fixture. It
+retains fixture PDFs and validation reports, then pushes that verified platform
+image to `ghcr.io/<repository-owner>/publisle-compiler`. The repository's
+`GITHUB_TOKEN` needs package write access and permission to create or update that
+package. Existing release tags are refused.
+
+The final job combines the two platform digests into an OCI index, checks that
+it contains exactly `linux/amd64` and `linux/arm64` with the expected digests,
+and uploads `compiler-release.json` plus the raw manifest. That record includes
+the index digest, both platform digests, recipe version, and veraPDF pin. Review
+and copy the generated record into `release.json` in the package release change;
+setup then pulls that immutable index. The workflow does not edit the repository
+or automatically change the default compiler. Recipe 2 release `recipe-2.0.0` passed this workflow on both native architectures.
+Its published index, platform digests and validator pin are recorded in
+[`release.json`](release.json).