SYN-343: Canonical release documentation

The published v1.5.0 Windows archive contains a full changelog with 1,317 CRLF sequences. Normalizing those sequences to LF reproduces the tagged source digest exactly. The strict npm consumer correctly refused the changed bytes before publication. This repair prepares a new patch release and preserves all existing v1.5.0 tags, assets, notes and manifests.

The producer now packages README.md, LICENSE and CHANGELOG.md directly from exact HEAD Git blobs. Source metadata retains its schema version 1 field set and hashes committed inputs after checking for dirty manifest, lockfile and changelog edits. The actual source validation stage checks each staged archive full changelog against the verified receipt before generating a signable manifest.

Executed evidence

At RED commit 6422c9f9efd1e8c54f92ff3782414cc0ac55ae7d, three new methods produce eight typed AssertionError failures, zero errors and zero skips. An actual Git autocrlf checkout changes the three document files. The actual Bash packaging stage and local tar then expose the changed archive bytes. A separate receipt assertion observes a worktree-dependent digest. The actual pre-sign source validation stage wrongly admits changed full changelogs in each of four platform archives. A canonical control succeeds before the platform corruption checks.

After the correction, the complete release control scope passes 26 methods: 13 existing validator methods, 10 existing workflow methods and three new canonical-document methods. There are zero failures, errors or skips. The existing actual-tar fixture now commits README and LICENSE before packaging. Its original assertions are unchanged, verified by comparing assertion ASTs. The npm consumer is unchanged.

python3 scripts/check-release-tests.py -v
python3 scripts/check-release-independent-tests.py -v
python3 scripts/check-release-document-tests.py -v

The new test module is invoked by actual source CI, whose scripts/** path selection already includes it. The allowlisted receipt records source, evidence and observed published-archive digests. Raw logs remain private. Three earlier harness attempts are excluded: incorrect shell comment extraction, subtest cleanup contamination and zero unittest discovery. They remain preserved as invalid attempts rather than assertion evidence.

Limits and next gates

Local execution uses real Git, Bash and tar with representative ZIP archives. It does not establish Windows 7z execution, real platform binary builds, real Sigstore verification, registry publication or the new hosted release. Existing recording gh, cosign and cargo fixture controls remain recording fixtures. No Rust compilation was performed for this packaging change. Independent mutation review is recorded below; exact final-head required CI remains pending before publication.

The bounded reader checks the declared full-changelog member without extracting archive files. It complements the strict downstream consumer and does not claim independent build reproducibility or general archive authenticity.

Frozen patch candidate repeat

After the separately reviewed 1.5.1 version and notes preparation, frozen commit 30ce83f93cc36e1c98cfa6dc1535d775f263e59f passed the same complete 26-method release control scope in 31.246 seconds with zero failures, errors or skips. The before and after source/test hashes match. This is a local fixture gate, not execution of the new four-platform release matrix.

The patch input receipt records the installed git-cliff version, generated commit range, root-package-only manifest/lock change and exact preservation of the v1.5.0 and older changelog sections. Required source CI and actual release publication remain pending.

Additional independent producer review

A different reviewer executed eight plausible wrong-production variants against the frozen assertions. All eight failed relevant assertions, with 22 explicit AssertionError failures, no unrelated errors, no skips and no survivors. The complete 26-method scope passed before the campaign and again after exact source and test restoration.

The controls challenge working-copy packaging and receipt hashes, dirty-input admission, omitted Windows or other platform checks, newline normalization, manifest generation before validation, and ignored validation failure. The order control fails because a signable manifest exists even though document rejection still returns a failure. An additional actual Git autocrlf probe confirms schema version 1, its six top-level fields and all three committed input hashes.

The independent receipt and reviewed patches retain frozen hashes, per-control assertion witnesses and exact limits. This review does not establish Windows 7z execution, real platform builds, actual Sigstore signing or the forward release’s hosted acceptance.