diff --git a/PLAN.md b/PLAN.md index f106e55..018c9e5 100644 --- a/PLAN.md +++ b/PLAN.md @@ -71,10 +71,10 @@ encryption, retention, backup, and deployment policy remain host concerns. ## Slice 7 — v1 compatibility and closure - [ ] **User value:** maintainers and adopters receive a reproducible, migration-aware v1 with no known material contradiction and no hidden publication side effect. -- **State:** In progress — the compatibility audit now names the actually supported matrix, replaces the vague migration-fixture gate with checked-in ABI-v1 bytes plus the real legacy durable-record browser migration, and proves all four canonical example packages together. +- **State:** Blocked only on externally unavailable audit tools — all reachable local release gates pass, but `cargo-audit` and `cargo-deny` are not installed and dependency installation is not authorized. - **Build:** freeze the supported Rust/browser/WASM/integration matrix; reconcile public/generated/Surface/symbol/wire/runtime/persisted-schema compatibility; add migration fixtures; make canonical examples compatibility tests; update the progressive tutorial path; run all local release gates and disposition every P0/P1, advisory, unsafe-code, license, performance, accessibility, and documentation finding. - **Refusals:** no publish, deploy, upload, store submission, speculative feature, or weakening a gate to make it pass. - **Requirements:** `v1_release/001-010`, `versioning/*`, `test/*`, `diag/*`, `performance/*`, `security/008`, and all requirements changed by the preceding slices. - **Proof:** clean-tree formatting, workspace tests, strict all-target Clippy, compile-fail, browser/WASM/offline/multiplayer scenarios, benchmark budgets, approved pinned lockfile audit, requirements proof audit, docs/examples checks, and independent contradiction review all pass with no unresolved P0/P1. -`cargo test -p hemx-core --test effect_batch compatibility_fixture_accepts_only_the_declared_v1_wire_version -- --exact`, `cargo test -p hemx-wasm --test browser flat_patch_persists_offline_then_uploads_with_same_operation_identity -- --exact`, and `cargo test -p hemx-v0-examples -p hemx-client-local-example -p hemx-kanban-example -p hemx-saas-example --lib --bins` prove the first compatibility gate. The release audit fixed three genuine local failures: the app-facing durable-sync primitive now accepts ordinary `IntoEffect`, the canonical example contract recognizes the explicitly isolated legacy fixture, and the requirement corpus is mechanically migrated from duplicated legacy headings/ring prefixes to the installed redgate `## component` plus `IDSUMMARY` format without changing its 413 obligations. `cargo run -p hemx-xtask -- test` now passes the complete workspace, browser, techdemo, and citation-reference gate. `cargo audit --version` and `cargo deny --version` both fail with Cargo `no such command`; dependency installation and an approved pinned-lockfile audit therefore remain externally blocked. Execution cursor: run the remaining local performance/docs/examples/contradiction gates, then obtain explicit authority or a supplied environment for `cargo-audit` and `cargo-deny` before claiming release readiness. +`cargo test -p hemx-core --test effect_batch compatibility_fixture_accepts_only_the_declared_v1_wire_version -- --exact`, `cargo test -p hemx-wasm --test browser flat_patch_persists_offline_then_uploads_with_same_operation_identity -- --exact`, and the four canonical example package tests prove compatibility. The release audit fixed genuine local failures: the app-facing durable-sync primitive accepts ordinary `IntoEffect`, the canonical example contract recognizes the isolated legacy fixture, the 413-requirement corpus is migrated losslessly to installed redgate format, and `html-examples-smoke` launches its child from the workspace rather than the caller directory. `cargo run -p hemx-xtask -- test`, `cargo run -p hemx-xtask -- bench`, `cargo run -p hemx-xtask -- html-examples-smoke`, strict all-target Clippy, warning-denied workspace docs, and workspace doctests pass. README/readiness contradiction review now matches the proven cursor. `cargo audit --version` and `cargo deny --version` both fail with Cargo `no such command`; dependency installation and the approved pinned dependency/license audit remain externally blocked. Execution cursor: obtain explicit installation authority or a supplied environment containing `cargo-audit` and `cargo-deny`, run the pinned lockfile audits, then close Slice 7 if clean. diff --git a/README.md b/README.md index 2e6637d..2911f5c 100644 --- a/README.md +++ b/README.md @@ -5,13 +5,14 @@ handlers, and return generated UI commands. The browser receives checked UI commands; ordinary server-first apps do not need a frontend framework, handwritten UI JavaScript, selector targeting, or raw runtime primitives. req: pitch/001 req: canonical_authoring/001 -Status: the repository has a proven server-first/page-enhanced baseline, a -compile-tested SaaS tutorial, an advanced Kanban sketch, and a full techdemo. -Full v1 is not yet feature-complete: client-local WASM, durable offline/sync, the -production integration reference, and their browser/recovery gates remain active. -See `docs/v1-product-evidence.md` for the evidence-backed product boundary, -`REQUIREMENTS.md` for authority, `PLAN.md` for implementation order, and -`docs/v1-readiness.md` for proven baseline evidence. No publishing is implied. +Status: the evidence-backed v1 behavior slices are implemented and browser-proven: +server-first/page-enhanced behavior, client-local WASM, durable offline/sync, the +multiplayer Kanban milestone, and the production reference. Local workspace, +browser, performance, documentation, and canonical-example gates pass; the +pinned dependency/license audits remain blocked because `cargo-audit` and +`cargo-deny` are not installed. See `docs/v1-product-evidence.md` for the product +boundary, `REQUIREMENTS.md` for authority, `PLAN.md` for execution state, and +`docs/v1-readiness.md` for evidence. No publishing is implied. Template authoring: `.heml` is HTML plus a small hemplate overlay for escaped text, trusted HTML, dynamic attributes, Rust-shaped control directives, generated diff --git a/docs/v1-readiness.md b/docs/v1-readiness.md index f28e8e2..c426d63 100644 --- a/docs/v1-readiness.md +++ b/docs/v1-readiness.md @@ -10,10 +10,15 @@ closure. Their implementation order lives in `PLAN.md`. req: examples/001 req: p ## Current status - Server-first and page-enhanced baseline: proven by the evidence below. -- Client-local WASM: not implemented; first active v1 slice. -- Durable offline/sync: contracts shaped, implementation blocked by the local - execution boundary. -- Full production reference and v1 closure matrix: not yet proven. +- Client-local WASM: real generated-resource browser/WASM execution proven. +- Durable offline/sync and multiplayer milestone: framework-owned replay, + acknowledgement, convergence, presence, recovery, and accessibility proven. +- Production reference: authenticated mutation, origin/CSRF denial, atomic + rollback-safe persistence, restart recovery, health/readiness, diagnostics, + metrics, CSP, and mixed-build fail-closed recovery proven. +- V1 closure matrix: local workspace, browser, performance, docs, and example + gates pass; `cargo-audit` and `cargo-deny` remain unavailable and block the + approved pinned dependency/license audit. - Publishing and deployment: explicitly unauthorized. ## Baseline evidence diff --git a/hemx-xtask/src/main.rs b/hemx-xtask/src/main.rs index 4564a4e..39202e9 100644 --- a/hemx-xtask/src/main.rs +++ b/hemx-xtask/src/main.rs @@ -130,6 +130,7 @@ fn pick_unused_port() -> Result { fn start_html_examples_server(addr: &str) -> Result { let mut child = Command::new("cargo") + .current_dir(workspace_root()) .args(["run", "-p", "hemx-html-examples"]) .env( "HEMX_HTML_EXAMPLES_PORT",