Historical milestone record: This document preserves the Phase 1–6 roadmap and status language at the
RC0_FINAL_1era. For current public project status, see the root roadmap. Phase 7 planning and acceptance records are indexed in docs/README.md.
Each phase requires explicit approval. Scope never rolls forward automatically. Phase completion requires documented public API, negative coverage for every applicable invariant, complete tests, strict formatting, and structural checks.
The historical RC0_FINAL tag froze a Phase 1–6 baseline that retained one
superseded issue-time equality check in validation. The current narrowly scoped
errata aligns validation with ADR-0041's already accepted issuance contract. It
introduces no protocol, API, confirmation, audit, consumption, execution,
persistence, networking, cryptography, hashing, or trusted-time behavior. Phase
7 has not begun.
The historical RC0.2 baseline passed package description, build, 397 normal and
verbose XCTest methods with zero failures, strict formatter lint, Phase 1–6
structural checks, and git diff --check under Swift 6.0.3 in the official
Ubuntu container on 2026-07-16. Current-baseline macOS validation remains
pending for the corrected baseline. The corrected worktree passed package
description, build, 407 normal and verbose XCTest methods with zero failures,
strict formatter lint, Phase 1–6 structural checks, Markdown and public API
documentation checks, and git diff --check under Swift 6.0.3 in the official
Ubuntu container on 2026-07-17. The historical RC0_FINAL tag is not moved or
described as defect-free. After current-baseline macOS validation and committed
evidence, the recommended successor annotated tag is RC0_FINAL_1. This is not
a production-deployment approval.
Established repository goals, vocabulary, trust boundaries, threat model, security invariants, API philosophy, roadmap, and ADR process. Execution is permanently outside SecureToolKit.
Established Swift 6/SPM baselines, one platform-neutral library target, immutable
Sendable public shells, tests, formatting, CI, Apache-2.0 licensing, and the
initial invariant matrix.
Implemented exact tool identity/version rules, immutable complete definitions, metadata/capability boundaries, atomic snapshot publication, exact lookup, lifecycle transitions, deterministic limits, and negative tests.
Implemented the closed typed schema/value model, occurrence-preserving objects, exact definition/schema binding, strict validation without parsing or coercion, reviewed typed resource derivation, and canonicalization v1. Canonical bytes have not changed during RC0 remediation.
Implemented controlled host authority and attestations, authenticated context,
structured exact intent, conservative provenance, boundary-local influence
completeness, proposal assessment continuity, explicit freshness/renewal, and
complete immutable EvaluationInput binding.
Implemented bounded closed policy conditions, immutable exact snapshots, role-specific policy administration, full-rule deterministic evaluation, deny-before-confirmation-before-allow precedence, stable reasons, inert obligations, domain closure, and intersection-only scope evidence.
Implemented controlled immutable structural authorization artifacts, sole-path issuance, exact full-value bindings, independently expected authorization identity, explicit bounded lifetime/freshness, capability/resource intersection, complete future consumption binding, repeatable non-consuming validation, and a declarative host atomic-single-use contract. No executor or store exists.
Resolved host-authority ceilings, argument-derived resources, exact schema/tool continuity, opaque host-domain capability binding, and empty policy operand validation. The historical validated baseline was 372 tests.
Resolved proposal lineage continuity, role-specific authority, domain closure, exact resource-free composition, independent authorization identity, complete consumption binding, exact policy content, strong boundary lifetime, measurable freshness, overflow guards, aggregate limits, CI coverage, and documentation consistency. The current validated Linux baseline is 397 tests.
Scope: ApprovalChallenge, safe display, host adapter contracts,
authenticated response binding, expiry, cancellation, and single-use handling.
No library-owned UI or Face ID implementation.
Exit criteria: Mutation, display-confusion, replay, and subject-swap negatives; unavailable confirmation fails closed; adapters remain separately scoped.
Scope: Versioned privacy-minimized AuditEvent, event sequencing,
tamper-evidence design, sink contract, redaction/classification, failure behavior,
and external anchoring guidance.
Exit criteria: Mutation, reorder, insertion, gap, leakage, and unavailable-sink negative tests; durability responsibilities are explicit.
Scope: A separate host-owned reference application showing provisioning, proposal assessment, confirmation adapter, verification/atomic consumption, and a harmless non-production executor.
Exit criteria: Trust boundaries are visible and threat-model attacks reject; the demo cannot be mistaken for production configuration.
Scope: Independent security/API review, platform CI matrix, fuzzing strategy, resource testing, supply-chain controls, disclosure process, release signing, and operations documentation.
Exit criteria: Findings resolved or accepted; supported versions declared; reproducible release process and security contact published.
- Phase decisions: Phase 1, Phase 2, Phase 3, Phase 4, Phase 5, and Phase 6.
- Remediations: RC0.1 and RC0.2.
- Ordered source migrations: MIGRATIONS.md.
- ADR status: adr/README.md.
- Security review archive: security/reviews.
The published private security contact and code-of-conduct choice remain release governance gaps. Production facilities listed in the RC0 final assessment remain deliberately deferred to separately approved work.