diff --git a/ROADMAP.md b/ROADMAP.md index 93c29fd..b8e033c 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -4,7 +4,7 @@ This roadmap is directional. Milestones may change as implementation and specifi ## v0.1 — Structural inspector MVP -Status: **implemented; final integration review tracked in #14.** +Status: **completed and released as v0.1.0.** Goal: provide a safe Pure Rust parser for top-level Zstandard structure plus a usable CLI. @@ -44,13 +44,19 @@ The parser's malformed-input safety invariant is covered by targeted boundary an ## v0.2 — Inspector ergonomics and robustness -Candidate scope: +Status: **in progress on `main`; not yet released.** + +Already implemented on `main` after v0.1.0: -- richer field-level spans for hex-view mapping; - configurable parser resource limits; +- a manual `cargo-fuzz` target with structural model-invariant checks on successful parses. + +Remaining candidate scope: + +- richer field-level spans for hex-view mapping; - more detailed diagnostics; - streaming or file-backed inspection API for very large files; -- initial fuzzing in continuous integration or OSS-Fuzz-compatible structure; +- scheduled or continuous fuzzing automation; - JSON schema documentation; - CLI output refinements. diff --git a/SECURITY.md b/SECURITY.md index cd7b5a0..de7673d 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -4,7 +4,12 @@ ZstdScope parses untrusted binary input, so parser safety is a core project requ ## Supported versions -ZstdScope is currently pre-release and has no supported published version yet. This section will be updated when releases begin. +ZstdScope is pre-1.0. Only the latest published pre-1.0 release receives security fixes. Older pre-1.0 releases become unsupported when a newer release is published. + +| Release | Security fixes | +| --- | --- | +| Latest published pre-1.0 release | Yes | +| Older pre-1.0 releases | No | ## Reporting a vulnerability @@ -38,7 +43,9 @@ Security-sensitive parser properties include: ## Fuzzing -Fuzz testing is planned as part of the parser's quality strategy. The baseline invariant is: +Fuzz testing is available as a manual developer workflow through `cargo-fuzz`; see [FUZZING.md](FUZZING.md). It is intentionally not part of normal pull-request CI. + +The baseline invariant is: ```text any byte sequence -> successful inspection or typed error, never panic diff --git a/docs/V0.1-INTEGRATION-REVIEW.md b/docs/V0.1-INTEGRATION-REVIEW.md index b966dcb..a4ae370 100644 --- a/docs/V0.1-INTEGRATION-REVIEW.md +++ b/docs/V0.1-INTEGRATION-REVIEW.md @@ -1,5 +1,7 @@ # v0.1 Integration Review +> **Historical record:** This document captures the pre-v0.1.0 release-readiness review. v0.1.0 has since been published. Future-tense release statements below are retained as historical context; current release and support status is documented in `README.md`, `README.ja.md`, `ROADMAP.md`, and `SECURITY.md`. + This document records the v0.1 Structural Inspector integration review and the release-blocker remediation that followed the repository-wide code review in Issue #31. Original Issue #14 review base: `dd1968620e076d770e727e52e8c9b5f0ec641ff4`.