Prepare unsigned stable 1.0.0 with verified content and exact-draft acceptance

.gitattributes

@@ -162,3 +162,10 @@ content/source-materials/objects/ef5518c5a3aaa7458e074a7e41e87837f8a1c74da009382
 
 # Exact stable shipped catalogs; small manifests/notices remain ordinary blobs.
 content/release-packs/**/catalog.json filter=lfs diff=lfs merge=lfs -text
+
+# Exact public review shipped in the signed stable bundle.
+docs/releases/1.0.0-independent-public-review.json text eol=lf
+docs/releases/1.0.0-independent-public-review-v2.json text eol=lf
+
+# Authored evidence/procedures are exact signed bundle resources.
+content/release-packs/authored-v2/**/*.md text eol=lf

.github/workflows/coverage.yml

@@ -77,6 +77,8 @@ jobs:
       - run: rustup component add llvm-tools-preview
       - name: Install pinned native coverage collector
         run: cargo install cargo-llvm-cov --version 0.9.1 --locked
+      - name: Owned profile output and clean-source regressions
+        run: node --test scripts/coverage/profile-output.test.mjs scripts/coverage/clean-source.test.mjs scripts/coverage/native-bundle.test.mjs scripts/coverage/bundle-instrumentation.test.mjs
       - name: Native tests, build scripts, examples and bounded Windows app smoke
         run: node scripts/coverage/collect-rust.mjs "${{ runner.temp }}/coverage-rust"
       - name: Retain native raw profiles, reports and exact source receipts

.github/workflows/package-windows.yml

@@ -31,7 +31,7 @@ jobs:
     name: Windows installer and addon package
     runs-on: windows-2025
     # A release-signing request waits for a manual SignPath approval.
-    timeout-minutes: ${{ github.ref_type == 'tag' && 170 || 110 }}
+    timeout-minutes: 170
     permissions:
       contents: read
       actions: read # the SignPath connector reads this job and downloads the unsigned artifact
@@ -84,12 +84,32 @@ jobs:
       - name: Stable preparation and hosted evidence tests (Windows PowerShell 5.1)
         shell: powershell
         run: ./scripts/windows/Test-StablePreparation.ps1
+      - name: Hosted timestamp parsing tests (Windows PowerShell 5.1)
+        shell: powershell
+        run: |
+          ./scripts/windows/Test-HostedTimestampParsing.ps1
+          ./scripts/windows/Test-HostedRecorderBoundary.ps1
+      - name: Hosted timestamp parsing tests (PowerShell 7)
+        shell: pwsh
+        run: |
+          ./scripts/windows/Test-HostedTimestampParsing.ps1
+          ./scripts/windows/Test-HostedRecorderBoundary.ps1
       - name: Hosted producer helper tests (Windows PowerShell 5.1 mocks)
         shell: powershell
         run: ./scripts/windows/Test-StableAcceptanceHelpers.ps1
       - name: Hosted producer helper tests (PowerShell 7 mocks)
         shell: pwsh
         run: ./scripts/windows/Test-StableAcceptanceHelpers.ps1
+      - name: Downloaded draft producer tests (Windows PowerShell 5.1 mocks)
+        shell: powershell
+        run: |
+          ./scripts/windows/Test-DraftInstallerSmoke.ps1
+          ./scripts/windows/Test-SupplementalUpgrade.ps1
+      - name: Downloaded draft producer tests (PowerShell 7 mocks)
+        shell: pwsh
+        run: |
+          ./scripts/windows/Test-DraftInstallerSmoke.ps1
+          ./scripts/windows/Test-SupplementalUpgrade.ps1
       - name: Stable preparation and hosted evidence tests (PowerShell 7)
         shell: pwsh
         run: ./scripts/windows/Test-StablePreparation.ps1
@@ -462,7 +482,7 @@ jobs:
           echo "smoke=${{ steps.native_smoke.outcome }} upgrade=${{ steps.native_upgrade.outcome }}"
           [ "${{ steps.native_smoke.outcome }}" != failure ] && [ "${{ steps.native_upgrade.outcome }}" != failure ]
 
-      - name: Actual schema4 hosted Windows acceptance over the signed full bundle
+      - name: Actual stable hosted Windows acceptance over the signed full bundle
         id: stable_acceptance
         if: steps.build_windows.outputs.stable == 'true'
         continue-on-error: true
@@ -490,14 +510,17 @@ jobs:
           $setup = Get-NativeSmokeSetup dist/windows
           $hash = (Get-FileHash $setup.FullName -Algorithm SHA256).Hash.ToLowerInvariant()
           $baselineSetup = Get-NativeSmokeSetup $baseline
+          # Uninstall keeps user data: drop the native smoke database so the cases start fresh.
+          $data = Join-Path ([Environment]::GetFolderPath('ApplicationData')) 'io.github.laymer.azeroth-navigator'
+          if (Test-Path -LiteralPath $data) { Remove-Item -LiteralPath $data -Recurse -Force }
           ./scripts/windows/Stable-Acceptance.ps1 -Root . -Directory dist/windows -InstallerSha256 $hash -BaselineInstaller $baselineSetup.FullName -BaselineSha256 $pin[0].sha256 -BuildIdentity release/v1/bundled-content-build-identity.json -OutputDirectory (Join-Path $env:RUNNER_TEMP 'native-smoke/stable-cases')
-      - name: Record schema4 hosted observations without inventing missing cases
+      - name: Record stable hosted observations without inventing missing cases
         id: hosted_evidence
         if: always() && steps.build_windows.outputs.stable == 'true' && steps.stable_acceptance.outcome != 'skipped'
         shell: pwsh
         run: |
           ./scripts/windows/Write-HostedAcceptanceEvidence.ps1 -Root . -Version '1.0.0' -InstallerDirectory dist/windows -ResultsDirectory (Join-Path $env:RUNNER_TEMP 'native-smoke/stable-cases') -OutputDirectory dist/acceptance-evidence
-      - name: Retain schema4 acceptance evidence separately from release assets
+      - name: Retain stable acceptance evidence separately from release assets
         if: always() && steps.build_windows.outputs.stable == 'true'
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
@@ -544,7 +567,7 @@ jobs:
         with:
           name: azeroth-navigator-windows-${{ github.sha }}
           path: dist/release-artifacts
-      - name: Download schema4 hosted evidence
+      - name: Download stable hosted evidence
         if: github.ref_name == 'v1.0.0'
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:

.github/workflows/pages.yml

@@ -2,18 +2,18 @@ name: Pages
 on:
   pull_request:
     branches: [main]
-    paths: ['site/**', 'scripts/site/**', '.github/workflows/pages.yml', 'pnpm-lock.yaml']
+    paths: ['docs/site/**', 'scripts/site/**', '.github/workflows/pages.yml', 'pnpm-lock.yaml']
   push:
     branches: [main]
     paths:
-      - "site/**"
+      - "docs/site/**"
       - ".github/workflows/pages.yml"
       - "scripts/site/**"
       - "pnpm-lock.yaml"
   workflow_dispatch:
     inputs:
       capture_release:
-        description: Capture the verified public RC in a disposable Windows runner (no deployment)
+        description: Capture the historical verified public RC in a disposable Windows runner (no deployment)
         type: boolean
         default: false
 permissions:
@@ -42,6 +42,8 @@ jobs:
           echo "$RUNNER_TEMP/corepack/node_modules/.bin" >> "$GITHUB_PATH"
           "$RUNNER_TEMP/corepack/node_modules/.bin/corepack" pnpm install --frozen-lockfile
           "$RUNNER_TEMP/corepack/node_modules/.bin/corepack" pnpm --dir apps/desktop exec playwright install --with-deps chromium
+      - name: Check supported publication metadata contracts
+        run: node --test scripts/site/release-metadata.test.mjs
       - name: Check links, project paths, release identity and browser accessibility
         run: node scripts/site/validate.mjs
   build:
@@ -57,7 +59,7 @@ jobs:
       - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
       - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
-          path: site
+          path: docs/site
   deploy:
     name: Deploy site
     needs: build
@@ -87,7 +89,7 @@ jobs:
         id: release
         shell: pwsh
         run: |
-          $release = Get-Content -Raw site/release.json | ConvertFrom-Json
+          $release = Get-Content -Raw docs/site/capture-release.json | ConvertFrom-Json
           if ($release.tag -cne 'v1.0.0-rc.1' -or -not $release.public_verified -or $release.source_commit -cnotmatch '^[a-f0-9]{40}$') { throw 'Expected verified public RC metadata' }
           "commit=$($release.source_commit)" >> $env:GITHUB_OUTPUT
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -113,7 +115,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           $ErrorActionPreference = 'Stop'
-          $release = Get-Content -Raw site/release.json | ConvertFrom-Json
+          $release = Get-Content -Raw docs/site/capture-release.json | ConvertFrom-Json
           $metadataJson = gh release view $release.tag --repo $env:GITHUB_REPOSITORY --json isDraft,isPrerelease,tagName
           if ($LASTEXITCODE -ne 0) { throw 'Cannot read public release' }
           $metadata = $metadataJson | ConvertFrom-Json

.github/workflows/verify-release-downloads.yml

@@ -12,6 +12,11 @@ on:
         type: string
         default: ''
         required: false
+      reviewed_evidence_commit:
+        description: Public stable only, independently reviewed inert evidence commit (excludes evidence_run_id)
+        type: string
+        default: ''
+        required: false
       phase:
         description: Release state to verify
         type: choice
@@ -37,7 +42,9 @@ jobs:
       contents: write
       actions: read
     runs-on: windows-2025
-    timeout-minutes: 30
+    # Includes dependency/source checks and the new bounded native UI suite.
+    # Each workload remains capped at 20 minutes; the UI suite at 60 minutes.
+    timeout-minutes: 90
     steps:
       - shell: bash
         run: git config --global core.autocrlf false
@@ -56,6 +63,22 @@ jobs:
           npm install --prefix "$RUNNER_TEMP/corepack" --no-package-lock --no-audit --no-fund corepack@0.36.0
           "$RUNNER_TEMP/corepack/node_modules/.bin/corepack" pnpm install --frozen-lockfile
           cargo fetch --locked
+      - name: Test inert reviewed evidence transport
+        shell: pwsh
+        run: |
+          python -m unittest discover -s scripts/windows -p test_import_reviewed_evidence.py
+          if ($LASTEXITCODE -ne 0) { throw 'Reviewed evidence transport regression failed' }
+      - name: Import explicitly reviewed public evidence data
+        shell: pwsh
+        env:
+          REVIEWED_EVIDENCE_COMMIT: ${{ inputs.reviewed_evidence_commit }}
+          EVIDENCE_RUN_ID: ${{ inputs.evidence_run_id }}
+          EXPECTED_SOURCE: ${{ inputs.source_commit }}
+          RELEASE_VERSION: ${{ inputs.version }}
+          RELEASE_PHASE: ${{ inputs.phase }}
+        run: |
+          python scripts/windows/import-reviewed-evidence.py --commit "$env:REVIEWED_EVIDENCE_COMMIT" --expected-source "$env:EXPECTED_SOURCE" --repository "$env:GITHUB_REPOSITORY" --version "$env:RELEASE_VERSION" --phase "$env:RELEASE_PHASE" --evidence-run "$env:EVIDENCE_RUN_ID"
+          if ($LASTEXITCODE -ne 0) { throw 'Reviewed evidence data transport refused' }
       - name: Download separately reviewed acceptance evidence
         if: inputs.evidence_run_id != ''
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
@@ -75,6 +98,7 @@ jobs:
         run: |
           $ErrorActionPreference = 'Stop'
           if ($env:EXPECTED_COMMIT -cnotmatch '^[a-f0-9]{40}$') { throw 'Expected a full source commit' }
+          if ($env:GITHUB_SHA -cne $env:EXPECTED_COMMIT) { throw 'Dispatch this workflow on the exact release tag' }
           . ./scripts/windows/Release-Policy.ps1
           $version = $env:RELEASE_VERSION
           $policy = Get-UnsignedReleasePolicy $PWD $version
@@ -90,16 +114,33 @@ jobs:
           New-Item -ItemType Directory -Path $downloads | Out-Null
           gh release download $tag --repo $env:GITHUB_REPOSITORY --dir $downloads
           if ($LASTEXITCODE -ne 0) { throw 'Release download failed' }
-          $receiptDir = Join-Path $env:RUNNER_TEMP 'download-receipt'
+          $receiptPath = if ($env:RELEASE_PHASE -ceq 'public') { 'dist/public-download-evidence' } else { 'dist/draft-evidence' }
+          $receiptDir = Join-Path $PWD $receiptPath
           New-Item -ItemType Directory -Path $receiptDir | Out-Null
           $json | Set-Content -LiteralPath (Join-Path $receiptDir 'github-release.json') -Encoding utf8
           $options = @{}
           if (Test-Path -LiteralPath 'dist/acceptance-evidence/acceptance-evidence.json') { $options['Evidence'] = 'dist/acceptance-evidence/acceptance-evidence.json' }
           ./scripts/windows/Verify-DownloadedRelease.ps1 -Directory $downloads -Version $version -InstallerSha256 $env:EXPECTED_INSTALLER -Receipt (Join-Path $receiptDir 'verification.json') -Phase $env:RELEASE_PHASE @options
           if ($LASTEXITCODE -ne 0) { throw 'Downloaded release verification failed' }
+          $contract=Read-BoundedReleaseContractText (Join-Path $PWD 'release/v1/acceptance-evidence.json') | ConvertFrom-Json
+          if ($env:RELEASE_PHASE -ceq 'draft' -and $contract.schema_version -eq 5) {
+            . ./scripts/windows/Draft-Installer-Smoke.ps1
+            $releaseJson=gh api "repos/$env:GITHUB_REPOSITORY/releases/tags/$tag"
+            if ($LASTEXITCODE -ne 0) { throw 'Cannot obtain draft release API identity' }
+            $releaseApi=$releaseJson | ConvertFrom-Json
+            $jobsJson=gh api "repos/$env:GITHUB_REPOSITORY/actions/runs/$env:GITHUB_RUN_ID/attempts/$env:GITHUB_RUN_ATTEMPT/jobs?per_page=100"
+            if ($LASTEXITCODE -ne 0) { throw 'Cannot obtain current workflow job identity' }
+            $jobs=$jobsJson | ConvertFrom-Json
+            if ($jobs.total_count -gt 100) { throw 'Workflow job list exceeds the bounded query' }
+            $current=@($jobs.jobs | Where-Object { $_.name -ceq 'Verify downloaded unsigned release' })
+            if ($current.Count -ne 1) { throw 'Current verifier job is absent or ambiguous' }
+            $raw=New-DraftDownloadResult -Root $PWD -ReceiptDirectory $receiptDir -Release $releaseApi -Job $current[0] -SourceCommit $env:EXPECTED_COMMIT -InstallerSha256 $env:EXPECTED_INSTALLER -RunId ([long]$env:GITHUB_RUN_ID) -RunAttempt ([long]$env:GITHUB_RUN_ATTEMPT)
+            [IO.File]::WriteAllText((Join-Path $receiptDir 'raw-result.json'),(($raw | ConvertTo-Json -Depth 16)+"`n"),(New-Object Text.UTF8Encoding($false)))
+          }
           [ordered]@{ schema_version = 2; version = $version; signature = $policy.signature; prerelease = $policy.prerelease; phase = $env:RELEASE_PHASE; tag = $tag; commit = $env:EXPECTED_COMMIT; run_id = $env:GITHUB_RUN_ID; repository = $env:GITHUB_REPOSITORY } | ConvertTo-Json | Set-Content -LiteralPath (Join-Path $receiptDir 'identity.json') -Encoding utf8
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        if: always()
         with:
           name: release-download-receipt-${{ inputs.phase }}-${{ github.run_id }}
-          path: ${{ runner.temp }}/download-receipt
+          path: ${{ inputs.phase == 'public' && 'dist/public-download-evidence' || 'dist/draft-evidence' }}
           if-no-files-found: error

.github/workflows/windows-offline-adapter-probe.yml

@@ -0,0 +1,35 @@
+name: Hosted Windows offline adapter engineering probe
+# Opt-in diagnostic only. No protected gate, product build or acceptance result.
+on:
+  push:
+    branches: ['verify/offline-adapters-*']
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: offline-adapter-probe-${{ github.ref }}
+  cancel-in-progress: false
+jobs:
+  offline-adapter-engineering-probe:
+    name: Offline adapter engineering probe (not acceptance)
+    runs-on: windows-latest
+    timeout-minutes: 10
+    steps:
+      - name: Preserve exact source line endings
+        shell: pwsh
+        run: git config --global core.autocrlf false
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          lfs: false
+          persist-credentials: false
+      - name: Probe real adapter disablement and exact restoration
+        shell: pwsh
+        run: ./scripts/windows/Probe-HostedOfflineAdapters.ps1 -OutputDirectory "$env:RUNNER_TEMP/offline-adapter-probe"
+      - name: Retain bounded engineering diagnostics after restoration
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: offline-adapter-engineering-probe-${{ github.sha }}
+          path: ${{ runner.temp }}/offline-adapter-probe/
+          if-no-files-found: warn
+          retention-days: 7

.github/workflows/windows-offline-firewall-probe.yml

@@ -0,0 +1,35 @@
+name: Hosted Windows offline firewall engineering probe
+# Opt-in diagnostic only. No protected gate, product build or acceptance result.
+on:
+  push:
+    branches: ['verify/offline-firewall-*']
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: offline-firewall-probe-${{ github.ref }}
+  cancel-in-progress: false
+jobs:
+  offline-firewall-engineering-probe:
+    name: Offline firewall engineering probe (not acceptance)
+    runs-on: windows-2025
+    timeout-minutes: 40
+    steps:
+      - name: Preserve exact source line endings
+        shell: pwsh
+        run: git config --global core.autocrlf false
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          lfs: false
+          persist-credentials: false
+      - name: Hold firewall isolation past the 1200 s workload bound and restore exactly
+        shell: pwsh
+        run: ./scripts/windows/Probe-HostedOfflineFirewall.ps1 -OutputDirectory "$env:RUNNER_TEMP/offline-firewall-probe" -HoldSeconds 1260
+      - name: Retain bounded engineering diagnostics after restoration
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: offline-firewall-engineering-probe-${{ github.sha }}
+          path: ${{ runner.temp }}/offline-firewall-probe/
+          if-no-files-found: warn
+          retention-days: 7