Merge branch 'main' into claude/adoring-volta-LCdCJ - resolve conflicts

Conflicts resolved:
- .github/workflows/e2e.yml: Accepted main version with updated actions (v6.0.2 checkout, v6.4.0 setup-node, node 25), new cargo-verify job

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

Author: hyperpolymath

.github/workflows/cargo-audit.yml

@@ -0,0 +1,52 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+#
+# cargo-audit.yml — RustSec advisory check for the Rust workspace.
+#
+# Catches CVEs in transitive dependencies of crates/typed-wasm-verify
+# without waiting for dependabot to file a PR. Distinct from e2e.yml's
+# cargo-verify job (which runs `cargo build` + `cargo test`) — audit is
+# concerned with security advisories, not API breakage.
+#
+# Track C deliverable from the production-path Phase 0 work
+# (docs/PRODUCTION-PATH.adoc §Phase 0). Tracks under issue #48.
+
+name: Cargo Audit
+
+on:
+  pull_request:
+    branches: ['**']
+  push:
+    branches: [main, master]
+  # Weekly scheduled run so new advisories surface even on quiescent code.
+  # Monday 04:17 UTC — off the typical hour boundary to avoid GH Actions
+  # cron contention.
+  schedule:
+    - cron: '17 4 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  cargo-audit:
+    name: Cargo audit (RustSec advisories)
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      # Match the cargo-verify pattern in e2e.yml: use the preinstalled
+      # rustup directly rather than a SHA-pinned third-party action.
+      - name: Install Rust toolchain
+        run: |
+          rustup toolchain install stable --profile minimal --no-self-update
+          rustup default stable
+          cargo --version
+
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --locked
+
+      - name: Run cargo audit
+        run: cargo audit --deny warnings

.github/workflows/e2e.yml

@@ -46,7 +46,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Node.js
-        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '25'
 
@@ -98,19 +98,22 @@ jobs:
       # comment "Updated for Zig 0.15+ API (addLibrary / createModule
       # pattern)"). 0.12 lacks `b.addLibrary` and the `.root_module` field
       # and will not parse the build script.
-      # Direct curl was failing on every PR (#44 CI: curl exit 22 / 404)
-      # because Zig 0.14+ flipped tarball naming from zig-OS-ARCH-VERSION
-      # to zig-ARCH-OS-VERSION. mlugg/setup-zig handles the naming, fetches
-      # from ziglang.org with a community mirror fallback, and is SHA-pinned
-      # to v2.2.1.
       - name: Install Zig
-        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
-        with:
-          version: '0.15.1'
+        run: |
+          ZIG_VERSION="0.15.1"
+          # Zig 0.14+ flipped its tarball naming from zig-OS-ARCH-VERSION to
+          # zig-ARCH-OS-VERSION. The old name 404s on ziglang.org for 0.15.1,
+          # which was failing this step with curl exit 22 on every PR (#44 CI).
+          ZIG_DIR="zig-x86_64-linux-${ZIG_VERSION}"
+          curl -fsSL \
+            "https://ziglang.org/download/${ZIG_VERSION}/${ZIG_DIR}.tar.xz" \
+            -o /tmp/zig.tar.xz
+          tar -xJf /tmp/zig.tar.xz -C /opt
+          ln -s "/opt/${ZIG_DIR}/zig" /usr/local/bin/zig
 
       # ---- Node (for smoke test within E2E script) ----
       - name: Set up Node.js
-        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '25'
 

README.adoc

@@ -177,8 +177,15 @@ docs/WHITEPAPER.md              # Full academic treatment
 **Pre-alpha / Research.** The checked L1-L10 ABI core, Zig FFI, parser tests,
 and smoke tests are in place. L11-L12 files are experimental drafts: they are
 not part of the default proof package and are not yet claimable as integrated
-proofs. The next step is to de-template the release path, expand end-to-end and
-aspect coverage, and either complete or withdraw the higher-level claims.
+proofs.
+
+The path from here to a production-quality compile target adopted outside
+the hyperpolymath ecosystem is documented in
+link:docs/PRODUCTION-PATH.adoc[`docs/PRODUCTION-PATH.adoc`] — six phases
+with explicit gates, load-bearing decisions, and a comparison landscape
+locating typed-wasm against neighbouring wasm-safety projects at each
+maturity level. `ROADMAP.adoc` tracks the version-by-version delivery
+against that plan.
 
 == Related Projects
 

ROADMAP.adoc

@@ -1,7 +1,33 @@
 // SPDX-License-Identifier: MPL-2.0
 = typed-wasm Roadmap
 :author: Jonathan D.A. Jewell
-:revdate: 2026-03-29
+:revdate: 2026-05-24
+
+== Relation to the production path
+
+This roadmap tracks specific version milestones (v0.1.0 ... v1.0.0). The
+long-form strategic plan — six phases from pre-alpha to production-ready,
+with explicit gates, load-bearing decisions, and a comparison landscape —
+lives in `docs/PRODUCTION-PATH.adoc`. The two documents stay in sync as
+follows:
+
+[cols="1,3",options="header"]
+|===
+| Version axis (this file) | Phase axis (`docs/PRODUCTION-PATH.adoc`)
+
+| v0.1 -- v0.4    | Phase 0 (stabilize foundation)
+| v1.0            | Phase 1 (end-to-end producer)
+| v1.x            | Phase 2 (multi-producer adoption)
+| v2.0 (planned)  | Phase 3 (runtime-side enforcement)
+| v2.x -- v3.0    | Phases 4-5 (tooling, spec, standards)
+| v3.x stable     | Phase 6 (production hardening)
+|===
+
+When this roadmap says "complete" it means a specific deliverable shipped.
+When `PRODUCTION-PATH.adoc` says "gate met" it means an entire phase's
+preconditions are satisfied and the next phase can credibly begin. The
+two views diverge intentionally: version cuts can happen mid-phase;
+phase transitions usually require multiple version cuts to accumulate.
 
 == Current State