v0.5.0

Changed

Spec Serialization Compliance

• Breaking: Mark::Math { value } field renamed to Mark::Math { source } to match spec
• Breaking: Simple marks (Bold, Italic, etc.) now serialize as strings ("bold") instead of objects ({"type":"bold"})
• Breaking: Extension marks serialize with colon-delimited type ("semantic:citation") instead of wrapper ({"type":"extension","namespace":"semantic","markType":"citation"})
• Breaking: Extension blocks serialize with colon-delimited type ("academic:theorem") instead of wrapper format
• Breaking: Block::block_type() returns Cow<'_, str> instead of &'static str; extension blocks return "namespace:blockType" instead of "extension"
• FigCaption block type serializes as "figcaption" (lowercase) instead of "figCaption"
• All old formats are accepted on deserialization for backward compatibility

CLI Restructuring

• Split cdx-cli/src/main.rs into cli.rs (argument definitions), dispatcher.rs (command dispatch), and main.rs (entry point)

Added

Spec Conformance Testing

• Conformance test suite (tests/conformance.rs) covering all 78 testable spec requirements
• Conformance matrix (docs/conformance-matrix.md) mapping spec sections to tests — 78/79 PASS, 0 TODO
• Hash boundary tests verifying document ID includes/excludes correct fields
• Asset embedding tests: hash verification, missing file detection, hash mismatch errors
• State machine enforcement tests for review/frozen/published requirements
• Provenance/lineage validation tests
• Property-based tests using proptest for hash determinism, metadata inclusion, block round-trips
• Fuzz targets for Block, Mark, and Content deserialization (fuzz/fuzz_targets/)

Security Policy

• Added SECURITY.md with supported versions and vulnerability reporting process