Skip to content

PHCT v1.9.0-rc.3

Pre-release
Pre-release

Choose a tag to compare

View all tags
@crypticpy crypticpy released this 24 Aug 22:21
Immutable release. Only release title and notes can be modified.
v1.9.0-rc.3
a9741c9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

PHCT v1.9.0-rc.3

PHCT v1.9.0-rc.3 is the release candidate that adds the stepped submission form to the wider-demo validation line. It is not the stable release or a BCHC organizational handoff.

  • Full commit: a9741c9845e0928ec6b6654e6e04b6ebe71c2233
  • Git tree: 3e2bfbb449d509ad398412c088c3824530afd6bd
  • Stable rollback point: v1.8.1
  • Supersedes: v1.9.0-rc.2, which the published BCHC demo is currently locked to

Change summary

  • The submission form now walks one schema group at a time: Next validates the step it leaves, Back and completed rail sections move freely, and the section heading takes focus on every move. A "Hide the optional questions" toggle trims the form to required fields only, and the saved draft remembers both the step and the toggle. A single-group schema and the no-JavaScript fallback keep the flat one-page form. (#30)
  • THIRD_PARTY_NOTICES.md now records provenance and complete license text for every copied script, generated icon, and bundled font, pinned by SHA-256 in quality/vendored-assets.json; the license gate fails closed on unreviewed changes.
  • The issue chooser routes documentation corrections through a structured form and security vulnerabilities to GitHub's private advisory form; setup (browser, terminal, and issue-driven) regenerates the same chooser so fresh copies cannot retain upstream reporting links.
  • The modified Adobe font subsets use the distinct family names PHCT Sans and PHCT Serif with upstream license metadata retained, satisfying the Reserved Font Name condition without changing deployed typography.
  • Shared mobile actions meet the 44 × 44 px touch-target contract across all surfaces, measured on rendered boxes by the real-Chrome assistive-flow gate.
  • Downstream update check dispatches have a 45-second bound and three-attempt backoff, with safe failure and nontechnical recovery steps; the downstream generator rebuilds the complete issue chooser from protected repository identity after an update.

Security and compatibility

  • Exact npm and Bundler advisory audits, CodeQL, dependency-license review, security-exception validation, CycloneDX generation, browser/accessibility checks, and performance/scale gates passed on this exact commit (links below).
  • The tested support ceiling is 100 entries. The 500- and 1,000-entry fixtures remain characterization evidence, not a support claim.
  • The downstream updater protects BCHC identity, governance, schema, content, media, naming, and demo configuration with before/after checksums, and requires the repository-scoped PHCT_UPDATE_TOKEN for releases that change .github/workflows (this release does not).

BCHC candidate procedure

  1. In BCHC, run Actions → Update from PHCT with exact release v1.9.0-rc.3.
  2. Confirm the generated pull request records this parent commit, the verified downstream commit, the publication bundle digest, and the previous v1.9.0-rc.2 lock.
  3. Review the protected-path checksum report, generated-file changes, preview artifact, migrations, and every downstream check before merging.

Rollback

Before the downstream candidate merges, close its pull request and delete the machine branch; the published BCHC site remains at its v1.9.0-rc.2 lock. If the update is later merged, revert that merge through a normal reviewed pull request. Never rewrite main or move this tag.

Evidence

Assets 4
Loading