v1.0.0

The first stable release. Every package's public API and the platforms in the README's
Platform support table are now a commitment under Semantic
Versioning: breaking or dropping either takes a new major version. To get there, no Swift
door throws (bad data is the verdict's Fault, as in every binding), Python and Ruby build
every number format the core accepts, the Rust scalar types hold at every boundary, what
was deprecated or never used goes (Java's GraalWasm backend, Go's ErrNativeUnavailable,
Swift's NativeLibraryError, Python's BACKEND), and every shipped file verifies from the
release tag alone.

Changed

• Swift — no door throws, and neither does Cast.nativeVersion(). Every door and
  nativeVersion() declared throws and never threw: bad data is the Verdict's Fault,
  and the core is linked in, so there is nothing to fail to load. Call sites need no try;
  one left in place compiles with a warning. (Swift)
• C# — HyperCast.targets no longer lists an EmccExportedFunction per entry point. The
  NativeFileReference is the whole Blazor WebAssembly wiring: the SDK's generated pinvoke
  table calls each native function by symbol, so the link resolves them against the archive
  and LibraryImport("*") reaches them through that table. The smoke test calls all twenty-seven
  entry points with the list gone (on SDK 11.0.100-rc.2) and fails at the link with the
  archive unlinked, so the list was dead weight. (C#)
• The release is two acts at one tag, and every shipped file verifies from the tag.
  Pushing vX.Y.Z packs every registry input, attests each package and the release as a
  whole, preserves the bytes and plans every upload without publishing; a dispatch of
  release.yml with prepared_run_id publishes from the preserved bytes through what was
  the recovery path. The release attestation is one statement signed at the tag whose
  subjects are every registry package and every native library committed for Go, Swift and
  PHP, and whose predicate is the release inventory, so
  gh attestation verify <file> --repo SkunkWerkx/HyperCast --source-ref refs/tags/vX.Y.Z --predicate-type https://github.com/SkunkWerkx/.github/predicates/release/v1 answers for
  any of them, including the wheels and the committed natives that build provenance alone
  tied to the preparation commit on master (SkunkWerkx/HyperUuid#35). The GitHub Release notes come from this
  file's section for the version plus the verification commands, and a tag whose CHANGELOG
  lacks the section is refused before anything publishes. The job bodies of release.yml,
  prepare-release.yml, stage-native-binaries.yml and every static check in ci.yml
  moved to the Forge (SkunkWerkx/.github, called at master, composite actions where the
  repository's own identity signs or publishes), with this repository described to it by
  .github/hyper.json and .github/scripts/abi_probe.c. Dependabot bumps every ecosystem in
  one monthly pull request, every third-party action is pinned to a commit, and CodeQL runs
  weekly. (repository only)
• The Go, Swift and PHP suites check that the committed core is current. Those three
  link binaries committed under go/staticlib, swift/HyperCastCore.artifactbundle and
  php/src/native, refreshed only at release, so a plain local run after a core change
  tested the core as it was at the last staging. Outside CI, a run without the local core
  (hypercast_local, HYPERCAST_LOCAL_CORE, HYPERCAST_NATIVE_LIBRARY) now stops with the
  command to use when this checkout's rust/ differs from the commit those binaries were
  built from: Go and PHP before any test, Swift as a failing CoreFreshnessTests.
  .github/scripts/local-core.sh also finds the Forge at ../HyperForge. (repository only)

Fixed

• Python — a separator, sign or percent symbol follows the core's rule: 1 to 8 UTF-8
  bytes with no ASCII digit. Python alone also refused anything over two characters, so
  a format every other binding builds (four no-break spaces, say) raised ValueError
  there. The docs in every binding now state the rule the core enforces, where they said
  "one or two characters". (Python)

• Ruby — NumFormat.from_i18n fills a missing mark instead of raising.
  from_i18n({separator: ","}) raised ArgumentError, because the missing delimiter fell
  back to "," as well. A missing mark is now whichever of "," and "." the declared one
  is not, for the currency pair too, as Python's from_localeconv and PHP's
  fromLocaleconv already did. (Ruby)

• Rust — safe scalar representation boundaries. Symbol<N> rejects strings longer
  than its one-byte length can carry, including when N exceeds 255, preserving
  UTF-8 boundaries. Decimal display handles every public scale byte without a
  panic, allocation, clamping or precision loss; its public fields and ABI remain
  unchanged. Typed integer documentation makes the existing shortest-decimal
  behavior above 2^53 explicit. (crates.io)

• C# — the Mac Catalyst registrar note names the SDK it was observed on. The README
  said .NET 11 RC1 while global.json pins 11.0.100-rc.2. The abort on the
  trimmable-static registrar still reproduces on SDK 11.0.100-rc.2.26504.105, so the
  smoke test keeps managed-static there and the README states it in the present
  tense. (C#)

• PHP — no API or behaviour change. The package reaches 1.0.0 as 0.9.0 left it, its
  docs stating the core's separator rule; its committed libraries are restaged from this
  release's core, and the release attestation names each one. (Packagist)

Removed

• Java — the GraalWasm backend. The jar no longer carries the core a second time as a
  wasm32-wasip1 module, and Cast.backend(), the hypercast.backend property and the
  fall-back to the module on a platform without a native build are gone: the binding is FFM
  downcalls into the library it bundles, as the other bindings link or load theirs. The module
  served a platform nobody had asked for, and in HyperTabular, which carried the same backend,
  replaying the suite through it in interpreter mode had become the longest step of every CI
  leg. cargo wasm-module, the wasm32-wasip1 export flags in rust/.cargo/config.toml and
  the -Pwasm runs of the JMH suite and the Native Image smoke test leave with it. (Java)
• Go — ErrNativeUnavailable. The core is linked into the binary, so nothing ever
  returned the error or panicked with it; it was kept, deprecated, only so code testing for
  it kept compiling. Available, LoadError and NativeVersion stay. (Go)
• Swift — NativeLibraryError. The deprecated error type had no cases and was never
  thrown, since the core is linked in on every platform. Cast.isAvailable stays, always
  true, as the availability probe every binding carries. (Swift)
• Python — hypercast.BACKEND. It was always "native": the PyO3 extension is the only
  backend, in CPython and in Pyodide alike. Ruby's HyperCast::BACKEND stays, since it
  tells the Magnus extension from Fiddle. (Python)

The full list is in CHANGELOG.md.

Verifying

Every file in this release verifies from the tag alone. One attestation, signed by this
repository's release.yml at v1.0.0, names all 102 of them: every registry
package (NuGet, RubyGems, PyPI, crates.io and Maven Central), the 34 native
libraries committed for Go, Swift and PHP, and the 8 metadata files staged beside
them. Its predicate is the release inventory attached below.

gh attestation verify <file> --repo SkunkWerkx/HyperCast \
  --source-ref refs/tags/v1.0.0 --predicate-type https://github.com/SkunkWerkx/.github/predicates/release/v1

The native libraries, the Python wheels and the archives inside the NuGet package and the
jar also carry build provenance from CI run 40232760003
at commit 07c0f9a, the parent of the tagged commit, signed by the Forge:

gh attestation verify <file> --repo SkunkWerkx/HyperCast --signer-repo SkunkWerkx/.github --source-digest 07c0f9a140eed2899c64b5783a7c0eeb6d04794b

inventory.json lists every file with its size and SHA-256 and, for each file with build
provenance, the commit it was built from and the repository that signed it; it carries
build provenance of its own at the tagged commit. PyPI additionally holds a PEP 740 publish attestation for every wheel.