Publish final completion release after external certifications

[dayflaree]

Goal

Publish the final completion release after all certification and production-signing issues are closed.

This is the final release gate after the project has real external evidence for the previously unvalidated claims.

Dependencies

• Certify Hammer/Hammer++ open-save compatibility #141 closed with Hammer/Hammer++ evidence.
• Certify native Windows Source compiler execution #142 closed with native Windows VBSP/VVIS/VRAD evidence.
• Configure and verify production release signing #143 closed with production signing evidence.
• Complete successful real game-runtime map-load validation #145 closed with real successful game-runtime map-load evidence.
• Certify rendered HLMV/HLMV++ model preview #146 closed with rendered HLMV/HLMV++ evidence.
• Add external certification evidence bundle validator #160 closed with external certification evidence bundle validator, unless explicitly superseded by a stronger evidence procedure.
• Harden final release workflow for production-mode signing requirements #162 closed with final release workflow production-mode signing hardening.
• Dispose final-release cargo audit unmaintained advisory warnings #163 closed with final-release cargo audit advisory disposition.

Tasks

• Decide release version and tag.
• Update README, CHANGELOG, release docs, compatibility matrix, signing docs, runtime docs, compiler docs, Hammer docs, and model docs.
• Remove or rewrite any stale limitation wording that is now validated.
• Keep unvalidated future claims blocked by scripts/check-validation-claims.py.
• Run full local gate.
• Publish tag release.
• Verify production signatures, checksums, SBOM, provenance, attestations, update manifest, and release assets.
• Post final release evidence comment.
• Close Completion epic: final certification and production release checklist #155 after this release issue is closed.

Acceptance criteria

• Final release is published with signed artifacts.
• Release notes link every completed certification issue.
• SHA256SUMS, SBOM, provenance/attestations, and signatures verify.
• The compatibility matrix contains only evidence-backed claims.
• No proprietary tools, private credentials, game content, private assets, or private paths are committed or redistributed.

[dayflaree]

Final release gate status update after continuing the completion milestone on 2026-08-08.

#160 is now closed, so the external evidence bundle validator is available for final evidence rows. #159 is also closed, so legal synthetic VMF/model fixture sources and /tmp evidence workspace generation are available.

This issue remains blocked because the certification and production-signing dependencies are still open:

• Certify Hammer/Hammer++ open-save compatibility #141: blocked by missing real Hammer/Hammer++ GUI editor evidence from Provision external Source GUI/runtime evidence workstation #156.
• Certify native Windows Source compiler execution #142: blocked by missing native Windows vbsp.exe/vvis.exe/vrad.exe host evidence from Provision native Windows Source compiler certification host #157.
• Configure and verify production release signing #143: blocked by missing production signing credentials and repository secret/variable provisioning from Provision production signing credentials and repository secrets #158.
• Complete successful real game-runtime map-load validation #145: blocked by missing real successful game-runtime map-load evidence; it depends on Provision external Source GUI/runtime evidence workstation #156 and likely Provision native Windows Source compiler certification host #157 for a real compiled BSP.
• Certify rendered HLMV/HLMV++ model preview #146: blocked by missing real HLMV/HLMV++ rendered-window evidence from Provision external Source GUI/runtime evidence workstation #156.

Latest blocker evidence:

• Provision external Source GUI/runtime evidence workstation #156: Provision external Source GUI/runtime evidence workstation #156 (comment)
• Provision native Windows Source compiler certification host #157: Provision native Windows Source compiler certification host #157 (comment)
• Provision production signing credentials and repository secrets #158: Provision production signing credentials and repository secrets #158 (comment)

No final completion release should be tagged yet. The release must wait for real external evidence rows, production signing verification, release artifact hashes, SBOM/provenance/attestation verification, and final docs updates.

[dayflaree]

Tracker update from the 2026-08-08 full review:

#161 now has two additional explicit blockers:

• Harden final release workflow for production-mode signing requirements #162 — Final release workflow must support a true production/final-release mode and fail closed when required signatures or signed update metadata are missing.
• Dispose final-release cargo audit unmaintained advisory warnings #163 — The current allowed cargo audit unmaintained warnings must either be removed/upgraded or documented as an accepted production-release risk.

Do not publish the final completion release until these are resolved along with #141, #142, #143, #145, and #146.

[dayflaree]

Tracker updated after the latest repo-side work.

Completed dependency updates:

• Add external certification evidence bundle validator #160 is now checked in this issue body because the evidence bundle validator is closed.
• Harden final release workflow for production-mode signing requirements #162 and Dispose final-release cargo audit unmaintained advisory warnings #163 are now listed and checked in this issue body because final release signing-mode hardening and final-release audit disposition are closed.
• f05bb374b7a8bbf075ad43c78a0390bbf7cd6c3e adds a reusable prerequisite probe for the still-open upstream blockers Provision external Source GUI/runtime evidence workstation #156/Provision native Windows Source compiler certification host #157/Provision production signing credentials and repository secrets #158.

Validation for f05bb374b7a8bbf075ad43c78a0390bbf7cd6c3e:

• Full local gate passed.
• CI passed: https://github.com/dayflaree/sourceweaver/actions/runs/31328155007

Current final-release blockers remain:

• Certify Hammer/Hammer++ open-save compatibility #141: waiting for Provision external Source GUI/runtime evidence workstation #156 real Hammer/Hammer++ GUI open-save evidence.
• Certify native Windows Source compiler execution #142: waiting for Provision native Windows Source compiler certification host #157 real native Windows VBSP/VVIS/VRAD evidence.
• Configure and verify production release signing #143: waiting for Provision production signing credentials and repository secrets #158 production signing credentials and repository secret/variable provisioning.
• Complete successful real game-runtime map-load validation #145: waiting for real successful runtime map-load evidence.
• Certify rendered HLMV/HLMV++ model preview #146: waiting for Provision external Source GUI/runtime evidence workstation #156 real HLMV/HLMV++ rendered-window evidence.

No final completion release should be tagged yet.