Skip to content

Commit 6aea10c

Browse files
ShaelzShaelz
committed
docs: freeze v1.0.0 validation record and release changelog
Compiles all M1-M6 evidence into a frozen validation record, moves Unreleased to v1.0.0 in the changelog, and updates the open questions to reflect that publication gates are actively in progress.
1 parent d26302a commit 6aea10c

3 files changed

Lines changed: 238 additions & 13 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
# Changelog
22

3-
## Unreleased
3+
## v1.0.0 - 2026-06-09
44

5+
- Freeze v1.0.0 validation record compiled from all M1–M6 evidence.
56
- Refresh exact-candidate validation for the current private `main` tip after
67
the final readiness docs, including working-tree, fresh-clone, CLI help,
78
public-history, audit, and WSL2 quick-check evidence.

‎docs/ai/OPEN_QUESTIONS.md‎

Lines changed: 6 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -11,18 +11,12 @@ Last refreshed: 2026-06-06
1111
copied-package, package-independence, and bash-installer evidence. macOS
1212
remains explicitly unverified for v1 unless direct validation becomes
1313
available.
14-
- **Final publication gates:** The private remote history has been rewritten,
15-
the publishable-history audit passes, private-safe GitHub settings are
16-
applied, and the current validated candidate content has deterministic
17-
release-candidate evidence from both the working tree and a fresh private
18-
clone. An agent-mediated cold-user rehearsal from a disposable GitHub clone is
19-
recorded in `docs/releases/M6_PRE_PUBLIC_REHEARSAL.md`. A final pre-public
20-
API/readiness pass found no new hosted-surface blocker. Remaining gates are
21-
final manual GitHub UI-only checks, public-only security/ruleset setup, and
22-
the final tag/release/publication decision. The maintainer may still choose
23-
to perform an additional external human-through-agent validation pass before
24-
publication. If maintainers choose a later content commit for tagging,
25-
refresh exact-candidate validation for that content.
14+
- **Final publication gates:** The frozen v1.0.0 validation record is in
15+
`docs/releases/v1.0-validation-record.md`. Manual GitHub UI-only checks,
16+
public-only security/ruleset setup, and the final tag/release/publication
17+
decision are actively in progress. Once the tag is published, compact
18+
`docs/V1_RELEASE_PLAN.md` into a short historical pointer and mark this
19+
question resolved.
2620
- **Manual GitHub UI checks:** The maintained API audit is in
2721
`docs/releases/M6_GITHUB_EXPOSURE_AUDIT.md`. Before changing visibility,
2822
manually glance at UI-only surfaces such as social preview and any package

‎docs/releases/v1.0-validation-record.md‎

Lines changed: 230 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,230 @@
1+
# v1.0.0 Validation Record
2+
3+
Status: frozen; publication gates in progress
4+
5+
Date: 2026-06-09
6+
7+
## Tag Target And Self-Referential Note
8+
9+
Product behavior was validated through commit `d26302a` (docs: refresh exact
10+
candidate validation), which itself documents content validated at
11+
`c7855e07c40df5220df446d81e5639c5ecc55aa5`. This frozen record and the
12+
companion CHANGELOG update are documentation-only commits that follow the
13+
validated content. A quick `npm run check` pass before tagging confirms no
14+
behavioral regression was introduced by these documentation commits. The tag
15+
target is the HEAD that includes this record.
16+
17+
- Product version: `0.0.1`
18+
- Graph schema version: `1.0.0`
19+
- Branch: `main`
20+
- Repository visibility at record creation: private
21+
22+
## V1 Release Criteria Summary
23+
24+
All criteria from `docs/V1_RELEASE_PLAN.md` section 7 are addressed below.
25+
26+
### Packaging and installation
27+
28+
| Criterion | Status |
29+
| --- | --- |
30+
| Canonical installable skill package complete and independently runnable | Passed |
31+
| Scanner and renderer have testable internal boundaries | Passed |
32+
| V1 retains Node.js, graph JSON, self-contained HTML, SVG, vanilla JS | Passed |
33+
| Renderer CSS no longer requires Tailwind | Passed |
34+
| Claude Code user-level PowerShell installer | Passed |
35+
| Claude Code user-level bash installer | Passed |
36+
| Claude Code project-local installer | Passed |
37+
| Codex user-level PowerShell installer | Passed |
38+
| Codex user-level bash installer | Passed |
39+
| Codex project-local installer | Passed |
40+
| Existing-target refusal and explicit force behavior verified | Passed |
41+
| Installed files match canonical source | Passed |
42+
| Adversarial and installer suites pass on real Linux or WSL2 | Passed (WSL2 Ubuntu) |
43+
| macOS support explicitly documented | Passed (documented unverified) |
44+
45+
### Runtime and safety
46+
47+
| Criterion | Status |
48+
| --- | --- |
49+
| Write-boundary contract selected, enforced, and documented | Passed |
50+
| Scanner handles unreadable or unusual filesystem entries predictably | Passed |
51+
| Generated output excluded from subsequent scans | Passed |
52+
| Repository-controlled text cannot inject executable HTML or JS | Passed |
53+
| Renderer rejects or clearly handles malformed/incompatible graphs | Passed |
54+
| Generated HTML has no external runtime resources | Passed |
55+
| Full checks do not leave tracked generated assets dirty | Passed |
56+
| Failure behavior does not leave misleading partial outputs | Passed |
57+
58+
### Product usefulness
59+
60+
| Criterion | Status |
61+
| --- | --- |
62+
| Tree and graph views usable on bundled fixture | Passed |
63+
| Search, filters, selection, detail, and routing interactions work | Passed |
64+
| Desktop and mobile visual checks pass | Passed |
65+
| Copied-package behavioral evals pass across five fixture shapes | Passed |
66+
| Frontend and backend live-fire maps provide useful routing context | Passed |
67+
| Medium-repository behavior acceptable and uncertainty documented | Passed |
68+
| Sibling operation with codebase-orient conflict-free | Passed |
69+
70+
### Documentation and trust
71+
72+
| Criterion | Status |
73+
| --- | --- |
74+
| README provides a cold-user path from acquisition to first map | Passed |
75+
| SKILL.md commands work from an installed package | Passed |
76+
| README, SKILL.md, CLI help, and architecture docs agree | Passed |
77+
| Claim labels and authority limits are explicit | Passed |
78+
| Known limitations and non-goals are explicit | Passed |
79+
| LICENSE, CHANGELOG.md, SECURITY.md, CODE_OF_CONDUCT.md exist | Passed |
80+
| V1 validation record complete and frozen before final tagging | This document |
81+
82+
### Release hygiene
83+
84+
| Criterion | Status |
85+
| --- | --- |
86+
| Full local release check passes | Passed |
87+
| npm audit --audit-level=high passes | Passed (zero vulnerabilities) |
88+
| git diff --check passes | Passed |
89+
| Worktree clean | Passed |
90+
| Agent-mediated cold-user rehearsal from a disposable GitHub clone passes | Passed |
91+
| Exact public release-candidate checkout passes final validation matrix | Passed |
92+
| Public-surface sanitation passes | Passed |
93+
| Reachable pre-public history passes check:public:history | Passed |
94+
| Public release candidate passes independent cold-user validation | Not completed; agent-mediated rehearsal accepted as sufficient for v1 |
95+
| GitHub repository settings match sibling-grade target before visibility change | Manual gate — in progress |
96+
| Final version identifiers and tag aligned intentionally | Manual gate — in progress |
97+
98+
## Automated Evidence
99+
100+
All checks run from the maintainer working tree and separately from a fresh
101+
private GitHub clone.
102+
103+
- `npm run check`: passed (working tree and fresh clone)
104+
- `npm run check:evals`: passed (working tree and WSL2)
105+
- `npm run check:public`: passed (working tree and fresh clone)
106+
- `npm run check:public:history`: passed (working tree, fresh clone, and WSL2)
107+
- `npm run check:public:contracts`: passed (working tree and fresh clone)
108+
- `npm audit --audit-level=high`: passed, zero vulnerabilities
109+
- `git diff --check`: passed
110+
- Worktree after checks: clean
111+
- CLI help (scan, render, visualize): passed from both contexts
112+
- Copied-package integrity check: passed
113+
- Installer matrix: passed
114+
- Generated-map interaction smoke check: passed
115+
116+
## Platform Evidence
117+
118+
| Platform | Status |
119+
| --- | --- |
120+
| Windows with PowerShell (primary) | All checks passed |
121+
| WSL2 Ubuntu with Linux-native Node.js | check:public, check:public:history, check:package, check:evals passed |
122+
| macOS | Explicitly unverified; documented limitation |
123+
124+
WSL2 closes the Linux-native adversarial, copied-package, package-independence,
125+
and bash-installer evidence requirements. macOS is not a v1 blocker; it is
126+
documented as unverified in README limitations.
127+
128+
## Installer Matrix Evidence
129+
130+
All eight install paths were exercised in disposable locations:
131+
132+
| Tool | Scope | Shell | Result |
133+
| --- | --- | --- | --- |
134+
| Claude Code | user | PowerShell | fresh, refuse, force, execute: passed |
135+
| Claude Code | user | bash | fresh, refuse, force, execute: passed |
136+
| Claude Code | project | PowerShell | fresh, refuse, force, execute: passed |
137+
| Claude Code | project | bash | fresh, refuse, force, execute: passed |
138+
| Codex | user | PowerShell | fresh, refuse, force, execute: passed |
139+
| Codex | user | bash | fresh, refuse, force, execute: passed |
140+
| Codex | project | PowerShell | fresh, refuse, force, execute: passed |
141+
| Codex | project | bash | fresh, refuse, force, execute: passed |
142+
143+
## Behavioral Eval Evidence
144+
145+
Five copied-package behavioral cases from `evals/cases.json`, exercised via
146+
`npm run check:evals` using a disposable copied skill package:
147+
148+
| Case | Result |
149+
| --- | --- |
150+
| backend-service | Passed |
151+
| frontend-app | Passed |
152+
| docs-unfamiliar | Passed |
153+
| ambiguous-honesty | Passed |
154+
| sibling-orient | Passed |
155+
156+
## Live-Fire Evidence
157+
158+
Sanitized live-fire metrics (raw artifacts outside tracked source):
159+
160+
| Target shape | Files | Folders | Edges | Unknowns | Result |
161+
| --- | ---: | ---: | ---: | ---: | --- |
162+
| backend service | 7 | 6 | 16 | 1 | Useful routing context |
163+
| frontend application | 8 | 7 | 17 | 0 | Useful routing context |
164+
| dispatch-sized repo (medium/large) | 349 | 109 | 593 | 102 | Navigable with scoped views and guidance |
165+
166+
The medium/large run confirmed large-map guidance, graph controls, search,
167+
references mode, minimap, and copyable agent briefing all functioned. High-volume
168+
artifact-like areas can feel crowded; this is a known documented limitation and
169+
not a v1 blocker.
170+
171+
## Cold-User Rehearsal Evidence
172+
173+
An agent-mediated cold-user rehearsal was performed from a disposable private
174+
GitHub clone. Full evidence in `docs/releases/M6_PRE_PUBLIC_REHEARSAL.md`.
175+
176+
Directly proven:
177+
- Codex and Claude Code user-level installs from the cloned source
178+
- Codex project-local install
179+
- Existing-target refusal without force
180+
- Force reinstall with stale-file removal and package-hash verification
181+
- Installed package invocation from outside the source checkout
182+
- Small target (8 files, 16 nodes, 20 edges) and medium target (100 files, 142 nodes, 274 edges)
183+
- Map interpretation surfaces present: claim labels, authority cues, cold-user guidance, agent briefing
184+
185+
Not covered by this rehearsal: fully independent external human-through-agent
186+
validation, macOS, manual GitHub UI-only surfaces.
187+
188+
## Public Surface And History Evidence
189+
190+
- History rewrite completed: private-target names, workstation paths, and
191+
author/committer identities generalized via `git-filter-repo`
192+
- `check:public:history` passes from working tree, fresh clone, and WSL2
193+
- `check:public` passes for tracked current tree
194+
- GitHub exposure audit complete: `docs/releases/M6_GITHUB_EXPOSURE_AUDIT.md`
195+
- Private-safe sibling settings applied while repository remains private
196+
- No unexpected branches, tags, releases, issues, PRs, Actions runs, or
197+
other exposure surfaces found
198+
199+
## Supporting Records
200+
201+
| Record | Role |
202+
| --- | --- |
203+
| `docs/releases/M6_RELEASE_CANDIDATE_VALIDATION.md` | Deterministic candidate evidence, fresh-clone checks, WSL2 |
204+
| `docs/releases/M6_PRE_PUBLIC_REHEARSAL.md` | Cold-user acquisition, install, invocation, and rehearsal evidence |
205+
| `docs/releases/MEDIUM_LARGE_PRESSURE_VALIDATION.md` | Medium/large map pressure and visual evidence |
206+
| `docs/releases/M5_VALIDATION_RECORD.md` | Local M5 baseline, live-fire, gitignore, and WSL2 evidence |
207+
| `docs/releases/M6_GITHUB_EXPOSURE_AUDIT.md` | GitHub exposure audit |
208+
| `docs/releases/M6_HISTORY_REWRITE_PLAN.md` | Rewrite procedure and verification |
209+
| `docs/releases/M6_REWRITE_DRY_RUN_RECORD.md` | Dry-run proof and real rewrite follow-up |
210+
| `docs/releases/PUBLIC_RELEASE_CHECKLIST.md` | Publication order and manual GitHub action checklist |
211+
212+
## Known Limitations
213+
214+
- macOS is explicitly unverified. WSL2 closes the Linux-native evidence
215+
requirement. macOS is documented as unverified in the README.
216+
- Fully independent external human-through-agent cold-user validation was not
217+
completed. The agent-mediated rehearsal is accepted as sufficient for v1 by
218+
the maintainer.
219+
- Manual GitHub UI-only publication gates (visibility, security features,
220+
rulesets, tag, release) are in progress at time of record creation.
221+
- If any commit beyond this documentation batch is chosen as the tag target,
222+
this record must be refreshed for that content.
223+
224+
## Release Decision
225+
226+
All v1 release criteria are passed or explicitly accepted as sufficient. The
227+
remaining gates are manual GitHub UI actions being completed by the maintainer.
228+
This record is frozen. After the tag is published, compact `docs/V1_RELEASE_PLAN.md`
229+
into a short historical pointer and update `docs/ai/OPEN_QUESTIONS.md` to
230+
reflect publication completion.

0 commit comments

Comments
 (0)