feat(REL-08): bind package release gates to candidate evidence

refactor/changes/2026-09-14-REL-08-release-ledger.md

@@ -0,0 +1,84 @@
+# REL-08: candidate-bound package release ledger
+
+The previous plan described batch release gates but had no executable per-package
+binding between current source, candidate archives and reviewed evidence. Added
+release-ledger.json for22 packages, a pure decision model, a filesystem/CLI adapter
+and a maintained procedure in release-ledger.md. This completes the ledger task,
+not package verification, version preparation, remote workflow activation or release.
+
+## Scope and ownership
+
+The JSON registry owns target versions, explicit historical distribution mappings,
+capability requirements, rollback basis and future candidate/evidence bindings. It
+does not duplicate task/risk status: the adapter reads tasks.json, risks.json,
+third-party.json and the existing dependency/impact model. Open package-specific
+risks propagate through dependencies; a generic review owner alone does not widen
+a concrete HLS finding to unrelated packages. Truly global risks stay global.
+
+Source fingerprints include own/dependent packages and shared scripts, tests,
+toolchain, contracts and frozen release/SDK inputs. Text CRLF is normalized with
+explicit algorithm labels and separate raw-byte hashes; binary fonts/WASM/media,
+candidate SRI and evidence attachments use exact bytes. A per-report input table
+avoids duplicating hashes across22 package rows. Unrelated package source changes
+can leave another batch unchanged; shared engineering/test/provenance changes are
+conservatively revalidated. Unknown dynamic imports widen the dependency scope.
+
+Actual tarball name/version, source commit existence, SRI and archive members are
+checked. Site manifests additionally require an exact build tree inventory and
+matching bytes. Evidence envelopes bind package/version/gate, candidate integrity,
+input fingerprint, actual environment, command, reviewer, successful check IDs and
+hashed underlying reports. Device requirements reject missing device identity,
+mock/emulation and skipped results. Remote CI requires a remote run reference;
+license coverage includes relevant vendor/SDK and direct runtime dependency IDs.
+
+This is mechanical bookkeeping, not a verifier of the truth of prose. Candidate
+build origin, complete scenario coverage, report interpretation and device/vendor
+evidence still require the three independent reviews. A source fingerprint must
+be captured in the actual build/validation snapshot, not copied onto an old package.
+No historical done task or old report is automatically accepted for a new candidate.
+
+## Distribution and compatibility
+
+All22 independent next-major targets are recorded without changing manifests. The
+iframe row explicitly maps its frozen artplayer-plugin-iframe predecessor; the
+recovered Thumbnail tool remains blocked for missing complete historical archive.
+VitePress stays a site/URL/build gate, without inferred new npm publication.
+Rollback links the historical basis and requires an actual rehearsal report.
+
+No core/plugin public API, runtime, declaration, dependency or lockfile changed.
+Four Yarn scripts expose structural check, immutable report output, strict
+preflight and tests. ci:check includes the structural check; test:baseline already
+discovers the new test. Strict preflight runs the existing pinned toolchain check.
+Normal check exit0 explicitly permits incomplete package evidence; only strict
+mode is a release gate. publicationAuthorized stays false even in the synthetic
+evidence-complete test. CI-03 already depends on REL-08 and will integrate strict
+preflight into the later publication workflow.
+
+## Validation
+
+See [recorded validation](../baselines/release-ledger-validation.json).
+
+- 30 regression cases pass. They reject stale source/test/SDK/lock inputs, wrong
+  version/package/gate, old tarball reports, tampered reports/attachments, missing
+  license/capability/review evidence, simulated devices and local-as-remote CI.
+  Real temporary archives/site files exercise SRI, manifest, complete output
+  inventory and byte checks; these are synthetic tooling fixtures, not product
+  package/browser/device acceptance.
+- Package source isolation, dependency propagation, unknown import fallback,
+ 22-package coverage and text/binary hashing are tested. Site cannot silently be
+  changed to npm scope or lose mandatory review gates.
+- CI script suite50 passes; targeted lint passes after ordinary formatting fixes.
+  Strict Node24.21.0/Yarn1.22.22 toolchain check passes with unchanged dependencies.
+- Current all-package report has22 blocked packages and zero candidate bindings.
+  The explicit HLS strict preflight exits1 for the expected missing gates; this is
+  correct rejection, not a failed tooling implementation. Generated reports use
+  separate cache directories and previous evidence remains intact.
+
+## Rollback and next work
+
+Revert this task commit to remove the new scripts, registry, tests and ci:check
+step. No package rebuild is necessary. Continue outstanding runtime/device/source
+tasks; REL-01/09 prepare final versions, REL-02 generates real candidates, REL-04
+executes rollback and CI-03/04 plus the reviews supply candidate-bound evidence.
+Do not fill pass envelopes from plans or rename existing historical report fields
+to manufacture a ready state.