treeport v0.1.3

Treeport 0.1.3 fixes missing third-party distribution materials. Scanning behavior, profile revisions, and report schema are unchanged.

All six archives now include upstream Go 1.27.1 and golang.org/x/text v0.28.0 LICENSE/PATENTS, additional Go source attributions, and Unicode notices. The inventory and manifest record exact sources and hashes. No upstream x/text NOTICE file was invented.

Packaging rejects missing or changed disclosures, module replacements/version drift, a different toolchain, or executable build metadata that disagrees with the clean commit and target.

Verified commit: d7209a4f71d8f7c812b29eab4ce534c2700182d2.

• CI: Windows/Linux/macOS × Go 1.25.0/1.27.1 — 6/6 passed.
• Release validation and packaging — native OS tests, race, vet, then six-target packaging.
• Downloaded all six archives and checked SHA256SUMS, every disclosure byte, manifest digest, and executable commit/version/dependency/target metadata. Ran native macOS archive and public go install version/compatible/incompatible smoke checks. See license-evidence.json.
• Original v0.1.0–v0.1.2 binaries and tags are preserved. Their release pages now provide an additional license supplement and checksum.

Use SHA256SUMS for the binary archives; supplementary evidence files are separate assets. Filesystem semantics remain model-scoped as documented in the README.

treeport v0.1.2

Distribution materials added — 2026-10-08

The original binary archives did not include third-party license texts. Their bytes and this tag remain unchanged. Keep the following supplemental materials with the original distribution:

• Third-party license supplement
• Supplement SHA-256

The supplement includes the pinned Go 1.27.1 and golang.org/x/text v0.28.0 LICENSE/PATENTS, additional Go attribution excerpts, and Unicode notices. APPLIES-TO.json records the six original archive hashes and verified build identities. Exact text sources and hashes are in third_party/manifest.json.

Treeport v0.1.3 embeds these materials inside every binary archive. Source inventory.

---

Fixes a destination-root boundary error reported by independent review: POSIX/macOS roots ending in a literal backslash were undercounted because it was incorrectly treated as a separator. For example, root /a\ plus entry x is five bytes; a budget of four must fail.

POSIX/macOS now trim only trailing / separators and advance to profile revision 2. Windows/export-fold retain their existing root semantics and profile revision 2. The JSON schema remains 1. Existing tags and published artifacts are preserved.

Validated commit: adc634d54e11e8a953407a2463e8c19726de3278.

• Exact-commit CI: all six Ubuntu/macOS/Windows × Go 1.25.0/1.27.1 jobs passed, including tests, race detector, vet, installed CLI checks, and native filesystem observations.
• Release validation: repeats tests on all three OSs before publishing six target archives plus SHA256SUMS.
• The old behavior was reproduced using an actual macOS directory whose name ends in a backslash. Independent boundary checks exposed eight old failures; all 41 boundary checks pass after the fix.
• Real macOS and Linux fixtures verify literal-backslash path bytes and source preservation. The native Windows test explicitly skips this Unix filename fixture; portable profile boundary tests still execute on Windows.
• All six downloaded archive checksums and embedded commit IDs were verified. The downloaded macOS arm64 binary passed the original four-byte/five-byte reproduction and actual-directory CLI boundary checks, including trailing-slash variants.
• Public go install github.com/rad1092/treeport/cmd/treeport@v0.1.2 passed the same actual macOS CLI fixture checks.
• Generated million-entry analysis still passes: one local macOS observation was 1.082 seconds, peak RSS 538,640,384 bytes. No large fixture is retained; these are observations, not hard resource guarantees.

Compact before/after, native CI, public-install, artifact, and checksum evidence is attached as root-budget-evidence.json and release-evidence.json.

Native runtime coverage is Linux amd64, macOS arm64, and Windows amd64. Other packaged architectures are cross-compiled. Case-sensitive APFS, Windows per-directory case-sensitive mode, network filesystems, and exact non-ASCII filesystem comparison tables remain outside verified scope. Results are model-scoped, not a universal portability or security guarantee.

treeport v0.1.1

Distribution materials added — 2026-10-08

The original binary archives did not include third-party license texts. Their bytes and this tag remain unchanged. Keep the following supplemental materials with the original distribution:

• Third-party license supplement
• Supplement SHA-256

The supplement includes the pinned Go 1.27.1 and golang.org/x/text v0.28.0 LICENSE/PATENTS, additional Go attribution excerpts, and Unicode notices. APPLIES-TO.json records the six original archive hashes and verified build identities. Exact text sources and hashes are in third_party/manifest.json.

Treeport v0.1.3 embeds these materials inside every binary archive. Source inventory.

---

Superseded by v0.1.2, which fixes path-budget undercounting for POSIX/macOS destination roots ending in literal backslashes. This historical tag and its binary assets are unchanged.

---

Read-only Go library and CLI for whole-tree destination filename preflight. Scan directories, strict JSONL manifests, or ZIP entry names without renaming or extracting. Includes explained parent/full-path collision groups, exact original bytes, root-inclusive path budgets, and whole-tree pre-commit/CI integration.

This patch adds Windows console aliases (CONIN$, CONOUT$) and space-padded reserved basenames. Windows/export-fold models advance to revision 2; the JSON schema remains 1.

Validated source commit: 52cfa5ac3bd1986e6d273f8fd6c76cadc05af62d.

• Six native CI jobs: Ubuntu, macOS, Windows × Go 1.25.0 and 1.27.1; tests, race detector, vet, installed CLI, native filesystem observations.
• Release workflow: repeats validation on three OSs before publishing six target archives and SHA256SUMS.
• Native runtime coverage: Linux amd64, macOS arm64, Windows amd64. Other archive architectures were cross-compiled, not executed on native hardware.
• Actual remote pre-commit hook at the exact commit passed a normal Git commit and blocked an unchanged CONIN$ file while only README.md was staged; source bytes, HEAD, and index were preserved.
• Generated million-entry analysis on local macOS arm64: 1.158 seconds, peak RSS 518,995,968 bytes. Measurements are observations, not hard memory/time guarantees.

All six archive checksums were verified after downloading. The downloaded macOS arm64 binary passed version, compatible-input, collision, reserved-device, and unknown-symlink checks. Public go install github.com/rad1092/treeport/cmd/treeport@v0.1.1 also passed.

Read English/Korean quickstarts, profile contracts, and the pinned baseline comparison. Compact JSON evidence is attached.

Results apply to explicit models, not arbitrary filesystems. Windows/macOS non-ASCII comparison remains unknown; no universal portability/security guarantee is made. Case-sensitive APFS, Windows per-directory case-sensitive mode, network filesystems, and unexecuted architectures remain unverified. Modern Windows APIs may accept names rejected by the conservative documented shell policy.

treeport v0.1.0

Distribution materials added — 2026-10-08

The original binary archives did not include third-party license texts. Their bytes and this tag remain unchanged. Keep the following supplemental materials with the original distribution:

• Third-party license supplement
• Supplement SHA-256

The supplement includes the pinned Go 1.27.1 and golang.org/x/text v0.28.0 LICENSE/PATENTS, additional Go attribution excerpts, and Unicode notices. APPLIES-TO.json records the six original archive hashes and verified build identities. Exact text sources and hashes are in third_party/manifest.json.

Treeport v0.1.3 embeds these materials inside every binary archive. Source inventory.

---

Superseded by v0.1.1.

The initial release introduced the read-only Go library, standalone CLI, bounded tree/JSONL/ZIP inputs, explained destination collision groups, and whole-tree pre-commit integration. Its exact source is a508062.

Use v0.1.1 for the corrected Windows console-alias policy. The initial Windows/export-fold model version 1 did not diagnose CONIN$, CONOUT$, or device basenames padded with spaces before an extension. Existing tags and artifacts are preserved for reproducibility.