# KitJS release readiness

This file records evidence for the standalone KitJS browser package. It does
not add public API and it does not infer public availability from a local build
or a version string. Source checks, publication, immutable retrieval, and
mutable npm/CDN channel verification are separate evidence boundaries.

## Stable `1.0.0` release identity

The stable source and deterministic distributions have this identity:

| Profile | Bytes | SHA-256 | SRI |
|---|---:|---|---|
| Kit | 206,607 | `2d7b750cae101b8decbac50dc334d0a7b1f4e3a1b5fe038d74e84101c5d52192` | `sha256-LXt1DK4QG43susUNwzTQp7H046G1/gONdOhBAcXVIZI=` |
| Hydrate | 314,424 | `01b23e3e45ce5604b1643362323402c5e86b70049642e5be9891eb4a67d2e7b9` | `sha256-AbI+PkXOVgSxZDNiMjQCxehrcASWQuW+mJHrSmfS57k=` |

The tag workflow may publish this identity only after the complete source,
distribution, browser, package, static-example, release-verifier, and benchmark
gates pass against one unchanged commit. A plain stable version publishes
directly to npm `latest`; the workflow then verifies the immutable npm
tarball/exact CDN files as well as npm `latest` and the default unversioned CDN
entry points. Exact public commit, run, tarball, signature, provenance, and CDN
evidence is added here only after those retrievals succeed.

## Historical verified `1.0.0-rc.2` prerelease

The exact tag, npm package, registry tarball, clean install, jsDelivr files,
unpkg files, and source checkout have been verified at commit
`0041fd7faf979d706f43dc708352caefea8d3742`.

| Profile | Bytes | SHA-256 | SRI |
|---|---:|---|---|
| Kit | 206,612 | `eea53fc9619efdb2fb5f7fdd57019f6c4cc1f3f63e1c31923af89339ae87a62f` | `sha256-7qU/yWGe/bL7X3/dVwGfbEzB8/Y+HDGSOviTOa6Hpi8=` |
| Hydrate | 314,429 | `1688e2d5cf4d1c5b4c2407487ebe2fb4a8e3b183ebf5834cd3705153dc402c50` | `sha256-Foji1c9NHFtMJAdIfr4vtKjjsYPr9YNM03BRU9xALFA=` |

The published `package.json` SHA-256 is
`990020888ba0a172e9994ffdaad6d4c70689beadb6be583a0450d6d0e472ee28`.
The published `dist/integrity.json` SHA-256 is
`7fcde7b332587cb85e9b5815857eda294dee0ed1f89ce42034b382282b8fe770`.
That manifest has a fixed schema and profile order and records the package,
version, filename, byte length, lowercase SHA-256, and canonical SRI with no
timestamp or machine-specific path.

The standalone public browser object exposes `kit.version` and
`kit.component`. Direct client components use the unversioned
`data-kit-component="name"` host. A missing definition does not fetch code or
reload the page; the authored fallback remains and the runtime reports the
missing definition. The split `data-kit-version` attribute is rejected and
there is no `data-kit-local` directive.

This RC also permits `data-kit-if` directly on one ordinary element while
retaining `<template data-kit-if>` for inert or multi-node fragments.
`data-kit-for` and `data-kit-key` remain template-only. An initially truthy
direct branch retains the exact authored host; a later false-to-true remount
creates fresh identity.

### Package release gates

The following gates passed against the unchanged tagged commit and exact
artifacts above:

| Gate | Evidence boundary |
|---|---|
| Reproducible distribution | `npm run build`, `node ./scripts/build.mjs --check`, source/dist parity, and the deterministic integrity manifest agree without mutation. |
| Package contract | Classic-script entries, no runtime dependency/install hook, README links, and the exact `npm pack --dry-run` tree pass. |
| Browser behavior | The deep Chromium corpus and required Chromium/Firefox/WebKit critical matrix pass for both profiles without silently skipping a required browser. |
| Component lifecycle | Tests cover direct components, missing definitions, `owned()`, listener/AbortSignal cleanup, LIFO disposers, post-render cancellation, retained Morph, and disposal safety. |
| Hydrate fallback | Tests cover executable topology, response/document budgets, forms, fragments, history, focus, cleanup, and native fallback before live mutation. |
| Static example | The packaged static site proves an immutable external-script topology, component registration, compatible navigation, and intentional native fallback. |
| Release verifier | Offline tests cover exact versions, bounded retries, tar traversal rejection, registry/tarball metadata, and CDN byte comparison. |
| Performance smoke | Both profiles complete the required large-DOM shapes without using workstation timing as a release threshold. |
| Documentation | README, browser specification, Vietnamese guide, deployment, support, security, and release evidence agree on the standalone CDN contract. |

Any runtime-byte or normative-contract change requires a new version, freshly
generated integrity evidence, and the complete gate again.

### Publication channel and public verification

The trusted tag workflow accepts only exact `x.y.z-next.n`, `x.y.z-rc.n`, or
plain `x.y.z` versions whose tag is exactly `v${package.version}`. Prereleases
publish to npm `next`; a plain release publishes directly to npm `latest`.

Only after an exact version exists publicly does the bounded verifier run:

```sh
node ./scripts/verify-public-release.mjs <exact-version> --git-sha <40-hex-tag-commit>
```

It checks npm metadata and `gitHead`, registry tarball SHA-512/SHA-1, exact
packaged metadata and integrity manifest, both profile files, and their
jsDelivr and unpkg copies. A stable run adds `--latest` to require npm
`latest` and the default unversioned CDN entry points to resolve to that same
release. npm signatures, provenance, hosted browser evidence, and a clean exact
install remain separately recorded checks.

## Post-publication verification for `1.0.0-rc.2`

Publication and independent retrieval completed on 2026-08-22:

- Git tag `v1.0.0-rc.2`, npm `gitHead`, and reviewed source resolve to
  `0041fd7faf979d706f43dc708352caefea8d3742`.
- [Master CI run 32579518466](https://github.com/kitwork/kit.js/actions/runs/32579518466)
  and [tag CI run 32579675165](https://github.com/kitwork/kit.js/actions/runs/32579675165)
  passed at that exact commit.
- [Publish run 32579675157](https://github.com/kitwork/kit.js/actions/runs/32579675157)
  repeated the build, package, and browser gates and published through npm
  Trusted Publishing.
- An independent
  `verify-public-release.mjs 1.0.0-rc.2 --git-sha 0041fd7faf979d706f43dc708352caefea8d3742`
  run passed npm metadata, registry tarball, both packaged profiles, both exact
  jsDelivr files, and both exact unpkg files.
- A clean exact install reproduced both profile bytes. npm signature audit and
  signed SLSA v1 provenance checks passed.
- npm dist-tag `next` points to `1.0.0-rc.2`; `latest` remains `0.8.0`.
- The registry tarball is 291,029 bytes. Its SHA-512 is
  `sha512-VTACQ54nzeB8AvopPDndcp+os8z1MIw39RZVrQyUBnJRK+sxKl2Zyx3ukzJ4r/EuhEsIRC0pRfP6HAqW++XYqg==`
  and its SHA-1 is `0bcb440ff76e2f32edd55774a89902d1859d2335`, matching
  registry metadata.

The immutable source, exact install and CDN snippets, and public evidence are
collected in the
[GitHub release](https://github.com/kitwork/kit.js/releases/tag/v1.0.0-rc.2).

## Historical `1.0.0-rc.1` evidence

`1.0.0-rc.1` is immutable historical evidence and does not acquire the
ordinary-element `data-kit-if` behavior introduced by rc.2.

| Profile | Bytes | SHA-256 | SRI |
|---|---:|---|---|
| Kit | 203,061 | `76acfba4d7195882757292476a3fd8e23f75201e4405fe634c84993d5c3d8584` | `sha256-dqz7pNcZWIJ1cpJHaj/Y4j91IB5EBf5jTISZPVw9hYQ=` |
| Hydrate | 310,808 | `8431002ca0b441fd6ae3a34d715e250cc12389d1df94fb187165909c26525d7c` | `sha256-hDEALKC0Qf1q46NNcV4lDMEjidHflPsYcWWQnCZSXXw=` |

Publication and independent retrieval completed on 2026-08-22:

- Git tag `v1.0.0-rc.1`, npm `gitHead`, and published provenance resolve to
  `d0680d74a6266b4b6e57eb91ac490e834c7fc2a2`.
- [Tag CI run 32571280744](https://github.com/kitwork/kit.js/actions/runs/32571280744)
  passed at that exact commit.
- [Publish run 32571280715](https://github.com/kitwork/kit.js/actions/runs/32571280715)
  passed its build, test, package-tree, and npm publish steps. Its bounded
  post-publication retries still received HTTP 404 from unpkg, so the overall
  run failed and its later signature/provenance step was skipped. It is not
  represented as a successful workflow run.
- After unpkg exposed the exact file, an independent
  `verify-public-release.mjs 1.0.0-rc.1 --git-sha d0680d74a6266b4b6e57eb91ac490e834c7fc2a2`
  run passed npm metadata, registry tarball, both packaged profiles, both exact
  jsDelivr files, and both exact unpkg files.
- A clean exact install reproduced both profiles. `npm audit signatures`
  passed, and the npm signature and attestations were verified independently
  of the failed workflow run.
- At verification time npm `next` pointed to `1.0.0-rc.1`; `latest` remained
  `0.8.0`.
- The registry tarball is 283,344 bytes. Its SHA-512 is
  `sha512-8d1c2kvtciPGKK7ncWhTZkCOc/kLgi0DHZKYMzsT82sV1JtLFxj2TQnpk6daI7cxEgs5Kd8KxGVHsue+5oQA4A==`
  and its SHA-1 is `b2d3bba5b31a346b19ae3126014b431f41b5c563`, matching
  registry metadata.
- SLSA provenance is recorded at
  [Rekor log index 2564042468](https://search.sigstore.dev/?logIndex=2564042468),
  and the npm publish attestation at
  [Rekor log index 2564042804](https://search.sigstore.dev/?logIndex=2564042804).

The immutable source remains at the
[GitHub tag](https://github.com/kitwork/kit.js/tree/v1.0.0-rc.1).

## Historical `0.9.0-next.15` evidence

`0.9.0-next.15` remains the immutable verified migration predecessor to the
1.0 candidates.

| Profile | Bytes | SHA-256 | SRI |
|---|---:|---|---|
| Kit | 203,492 | `88622bd8b1275d6d14447443bf0eac6771a0baaf34b952cc1e5001b74f14631c` | `sha256-iGIr2LEnXW0URHRDvw6sZ3Gguq80uVLMHlABt08UYxw=` |
| Hydrate | 311,181 | `2abd911412813b3ff6782dbca4eea5f397dd19130361d582a35bea66052fcb16` | `sha256-Kr2RFBKBOz/2eC28pO6l85fdGRMDYdWCo1vqZgUvyxY=` |

Its package-local release run passed eight source/dist checks, 32 browser tests
including exact Kit/Hydrate coverage in Chromium, Firefox, and WebKit, 11
benchmark-smoke scenarios, and seven package/tarball checks. The benchmark
completed the 1,000- and 10,000-node matrix with one warmup and five samples.
The recorded 10,000-node medians changed from 514.9 ms to 486.1 ms for Kit
Promise settlement, 569.2 ms to 464.6 ms for Hydrate Promise settlement,
94.3 ms to 77.7 ms for Kit keyed reconciliation, and 99.9 ms to 69.0 ms for
Hydrate keyed reconciliation. These timings remain comparative evidence, not
release thresholds.

Publication and independent retrieval completed on 2026-08-22:

- Git tag `v0.9.0-next.15`, npm `gitHead`, and provenance resolve to
  `20d2b82508967fa3c3c2a69813ff6f838e0a5927`.
- [Master CI run 32557053343](https://github.com/kitwork/kit.js/actions/runs/32557053343)
  and [tag CI run 32557167034](https://github.com/kitwork/kit.js/actions/runs/32557167034)
  passed the complete browser and package gates.
- [Publish run 32557167048](https://github.com/kitwork/kit.js/actions/runs/32557167048)
  repeated the release gates and published through npm Trusted Publishing.
- npm exposes signed SLSA v1 provenance for the exact tag and commit. At
  publication time `next` pointed to `0.9.0-next.15`, while `latest` remained
  `0.8.0`; `npm audit signatures` reported no invalid or missing signatures.
- The registry tarball was retrieved as 256,810 bytes. Its SHA-512 is
  `Unwrrpaso4Lck4HGZN6WHVGukqlq/WCJ4r8WxA2LXItyJ2OH9rCkFCTm8bFqqcKM0XFcKqcPGKf+5wQ8F1CLeQ==`
  and its SHA-1 is `178862968fdfe56c6ade7d4610a69c484b236f00`, matching
  registry metadata.
- A clean exact install reproduced both profile bytes and passed a Chromium
  browser smoke for Kit and Hydrate.
- Both exact jsDelivr URLs returned HTTP 200 immutable JavaScript with
  `x-jsd-version: 0.9.0-next.15`; byte counts, SHA-256 values, and SRI matched
  the table above.

The evidence and delivery snippets remain in the
[GitHub release](https://github.com/kitwork/kit.js/releases/tag/v0.9.0-next.15).

## Earlier retained checkpoints

`0.9.0-next.14` was a local source checkpoint and was never tagged or
published:

| Profile | Bytes | SHA-256 | SRI |
|---|---:|---|---|
| Kit | 202,948 | `fdf4929495518422c233632cbab5edf0b017bd53f6e9de24f330e632b144e959` | `sha256-/fSSlJVRhCLCM2MsurXt8LAXvVP26d4k8zDmMrFE6Vk=` |
| Hydrate | 310,811 | `a720c17a0f1ec488f139f27d7dcc9f2f76bce849d4c083db6f71611cbb430393` | `sha256-pyDBeg8exIjxOfJ9fcyfL3a86EnUwIPbb3FhHLtDA5M=` |

The `0.9.0-next.13` source freeze and published files share these identities:

| Profile | Bytes | SHA-256 | SRI |
|---|---:|---|---|
| Kit | 200,645 | `0a8cf182582dbae048d1dbc197a55a4e6e0103a38388077e2a2991997d5929f9` | `sha256-CozxglgtuuBI0dvBl6VaTm4BA6ODiAd+KimRmX1ZKfk=` |
| Hydrate | 308,508 | `c04583f42282194d1dbd2f7da5cafc0ff37f07adfb220ce87a58639fcbcb1048` | `sha256-wEWD9CKCGU0dvS99pcr8D/N/B637Igzoelhjn8vLEEg=` |

- Git tag `v0.9.0-next.13` and npm `gitHead` resolve to
  `b19aa97443835c917b9af2074057624ecd21464f`.
- [Hosted CI run 32479521118](https://github.com/kitwork/kit.js/actions/runs/32479521118)
  passed the browser and package gates.
- [Publish run 32491771903, attempt 2](https://github.com/kitwork/kit.js/actions/runs/32491771903/attempts/2)
  published through npm Trusted Publishing with signed SLSA v1 provenance.
- At publication time npm `next` pointed to this prerelease and `latest`
  remained `0.8.0`; `npm audit signatures` reported no invalid or missing
  signatures.
- The registry tarball was 235,355 bytes. Its SHA-512 is
  `zefmE3r2tgs/Z10I3aPq3AeHFDzdfllPAWjzuQOj/CikQGe1kQmoSsmTHL/VLG7C8FS/87sBUBDPDz7XBit/xA==`
  and its SHA-1 is `917f804ac79cdd8b99cc88ac8a067d915cd0ffb4`, matching
  registry metadata.
- A clean exact install reproduced both profile bytes, and exact jsDelivr
  retrieval matched the table above.

The evidence remains in the
[GitHub release](https://github.com/kitwork/kit.js/releases/tag/v0.9.0-next.13).

## Package evidence after publication

The living repository also contains package-local evidence that does not alter
the immutable published bytes:

- `browser-drive-budgets.test.mjs` covers exact 8 MiB acceptance, declared and
  decoded over-limit fallback, parsed node/depth rejection, and native-only
  behavior for incompatible initial executable topology.
- `npm run bench` measures exact checked profiles at 1,000 and 10,000 nodes
  with fresh browser contexts, warmups, raw samples, median, p95, and
  completion shapes. `npm run bench:smoke` is part of `npm test` and has no
  wall-clock threshold.
- Browser security tests cover entity decoding, SVG/MathML namespaces,
  clobbering names, mutation-XSS-shaped bindings, malformed raw text, comments,
  templates, and script-safe native fallback.
- Expression conformance rejects source over 65,536 UTF-16 code units or a
  program that would exceed 32,768 stored tokens before evaluation.

Generated benchmark JSON stays machine-local and gitignored. A timing from one
workstation is never presented as a universal performance guarantee.

## Evidence update rule

Evidence changes only when executable checks or public retrieval change. A
version in `package.json` or a locally generated integrity manifest does not
establish npm/CDN availability. Stable releases select npm `latest` during the
trusted publish itself, then must pass both immutable exact-version retrieval
and mutable latest/default-CDN verification before the release is recorded as
fully verified.