dotSYSTEMX 1.8.9-alpha.1

dotSYSTEMX 1.8.9-alpha.1

Public alpha — use at your own risk. The format can change during this series. Pin a reviewed release, keep recoverable backups, and verify behavior in your own project. Template checks do not certify a downstream application or process for production.

This release adds blank, project-owned Access Matrix and System MAP records to the root .SYSTEMX format and to newly created .SYSTEMXP projects. They help document who may do what, where sources and boundaries live, and what still needs verification. They do not grant permissions or duplicate the canonical task ledger. Existing project records remain preserved on update, and older 1.8.8 snapshots remain readable.

The manager now rejects special-file inputs that could stall local reads, explicit empty target or source paths, and slow opt-in startup metadata discovery after a five-second wait. A timed-out check warns and continues with installed defaults; it does not fetch an archive or select a release. Optional white-paper publishing tools have stronger path and HTTPS-link guards. The public README is shorter and starts with a preview-first setup path, with detailed procedures in the wiki.

The upstream repository now has secret scanning, push protection, and Dependabot vulnerability alerts enabled. main and Alpha1 have a ruleset blocking deletion and force pushes. GitHub Actions remains disabled. These settings do not transfer to repositories generated from this template.

Validation: 182 .SYSTEMX tests passed on each of Python 3.9.6 and 3.14.5 on macOS (five case-sensitive-filesystem skips in each run); template validation passed for 148 portable files and 92 Markdown documents; 10 media-publication tests passed. The release ZIP and wheel each contain exactly those 148 files with byte-for-byte source matches. Disposable wheel install, offline validation, uninstall, restore, and a real 1.8.8 → 1.8.9 upgrade preserved user files. A remote install accepted the pinned raw codeload digest and rejected a wrong digest before installation. Native Linux and Windows runtime tests were not performed. The requested Codex Security Deep Scan did not start because this host lacked its managed filesystem permission profile; no plugin scan result is claimed. See PUBLIC-REVIEW-1.8.9-alpha.1.json for evidence and limits.

For a remote install or update, --archive-sha256 must use the raw codeload tag ZIP digest, not the downloadable SYSTEMX-1.8.9-alpha.1.zip asset digest:

db352a37972489fff6590103f0535721ec570cce2f3c2ec668ffbd66081f6e98

The checksum helps only when obtained through a separately trusted channel; it is not a publisher signature. See First-Time Setup, Installation and Updates, Access Matrix, System MAP, and the version history.