docs: publish current BearBoot project state

.github/workflows/release.yml

@@ -310,6 +310,7 @@ jobs:
       - name: Create GitHub release
         env:
           GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
           RELEASE_TAG: ${{ github.ref_name }}
           VERSION: ${{ needs.validate.outputs.version }}
         run: |

STATUS.md

@@ -1,11 +1,17 @@
 # BBP — Maturity & Honesty Matrix
 
 This file states plainly what is **exercised**, what is **structure-only**, and
-what is **roadmap**. No claim here is made that a `make` target does not back up.
-Trust is the product — read this before you rely on anything.
+what is **roadmap**. Each claim names its reproducible gate or the checked-in
+evidence and replay limit that backs it. Trust is the product — read this before
+you rely on anything.
 
 Legend:
 - 🟢 **LIVE** — exercised end-to-end with a reproducible proof in this repo.
+- 🟢 **MACHINE PROOF** — executes in the named target ISA, firmware context, or
+  machine emulator; it does not imply a complete OS integration.
+- 🟢 **HOST-TESTED / HOST PROOF** — executes on the host; it never implies boot.
+- 🟢 **RECORDED** — checked-in evidence from an external boot or integration that
+  the root CI does not currently replay.
 - 🟡 **SKELETON / STRUCTURE** — the ABI/code path exists and compiles, but it is
   a reference base or a definition, not a finished, exercised implementation.
 - 🔴 **ROADMAP** — designed for in the ABI, not yet built.
@@ -37,16 +43,16 @@ Legend:
 | Integration | State | Proof / note |
 |-------------|:-----:|--------------|
 | `ports/tinalinux/` — native Linux OSIF | 🟢 LIVE | boots under QEMU+KVM; `bbp: tinalinux adapter ok, 5 tags, hhdm=0x…` in `ports/tinalinux/test/serial.log`; 5 CRC-sealed tags from real e820+ACPI+cmdline at `late_initcall` |
-| `ports/minix/` — Limine adapter OSIF | 🟢 RECORDED | real MINIX boot evidence in `ports/minix/test/serial.log`; current root CI scaffold-checks but does not reproduce the external OS boot |
-| `ports/linux01/` — native identity-mapped OSIF | 🟢 RECORDED | in-kernel QEMU boot evidence in `ports/linux01/test/serial.log`; current root CI does not reproduce it |
-| `ports/josh/` — Limine + PMM OSIF | 🟢 RECORDED | real QEMU boot and verified entropy evidence in `ports/josh/test/serial.log`; current root CI does not reproduce it |
+| `ports/minix/` — Limine adapter OSIF | 🟢 RECORDED | six-tag real MINIX boot evidence in `ports/minix/test/serial-all6-consumers.log`; current root CI scaffold-checks but does not reproduce the external OS boot |
+| `ports/linux01/` — native identity-mapped OSIF | 🟢 HOST-TESTED | `ports/linux01/test/serial.log` is the hosted three-tag adapter proof; the conformance report records a separate in-kernel boot, but no raw in-kernel serial artifact is checked in |
+| `ports/josh/` — Limine + PMM OSIF | 🟢 RECORDED | real QEMU boot evidence plus a six-tag hosted gate with a verified 48-byte entropy blob; current root CI does not reproduce the external OS boot |
 | OSIF contract (`bbp_osif.h`) + weak/strong hook seam | 🟢 LIVE | four ports compile against the same frozen interface; TinaLinux exercises its hosted adapter in current CI |
 
 ## Producers / bootloader side
 
 | Capability | State | Proof / note |
 |------------|:-----:|--------------|
-| Tag builder API (firmware-agnostic) | 🟢 LIVE | used by both ports + the QEMU rig |
+| Tag builder API (firmware-agnostic) | 🟢 LIVE | used by all four OSIF adapters and the QEMU machine rigs |
 | Limine, Multiboot2, and UEFI importers | 🟢 HOST-TESTED | `make importers-test` proves bounded, failure-atomic translation and parser roundtrips; platform collection remains external |
 | `bootloader/efi_main.c` UEFI producer | 🟡 SKELETON | **explicitly a reference skeleton**: its ELF-load, collectors, final memory-map/EBS, paging, and transfer path remain incomplete. The separate OVMF harness does not execute or validate this loader path. |
 | `tools/bbp_stamp.py` post-link header stamp | 🟢 LIVE | cross-verified against the C runtime CRC |
@@ -75,8 +81,8 @@ Legend:
 ## One-line summary
 
 **The protocol, defensive parser, builder, and hosted TinaLinux adapter are
-reproducible on x86_64; AArch64 also has a reproducible machine handoff proof,
-and four ports carry checked-in boot records.** The root CI does not reproduce
+reproducible on x86_64; AArch64 and RV64 have reproducible machine handoff
+proofs, and four ports carry distinct hosted or checked-in evidence.** The root CI does not reproduce
 every external OS boot. The UEFI producer is a reference skeleton, LoongArch
 is roadmap, and the security tags await a measuring producer. If you find a gap
 between a claim and its proof, that is a bug — please open an issue.

scripts/verify_site.py

@@ -43,6 +43,12 @@ def main():
         "bbp_init_bounded()",
         "make qemu-aarch64",
         "make qemu-riscv64",
+        "make importers-test",
+        "make bbpctl-test",
+        "make sdk-check release-metadata-test",
+        "make tpm2-measure-test",
+        "global rollback floor",
+        "signed-tag release workflow emits and verifies",
         "requires serial PASS",
         "hero-proof-geometry.svg",
     ):
@@ -58,18 +64,37 @@ def main():
         "BBP v2 Draft / offline",
         "AArch64 boot proof",
         "Release checkpoint",
+        "INTEGRAÇÕES OSIF",
+        "Linux 0.01 tem harness host",
         "integridade com confiança",
     ):
         require(token in state_page, f"current-state page missing: {token}")
     require("http://" not in state_page, "current-state page contains an insecure URL")
     require("<script src=" not in state_page, "current-state page must be standalone")
     require(page.count('class="tag-node"') == len(tags), "site tag constellation drifted from ABI")
     require(page.count('class="port-card"') == 4, "site integration inventory must list four ports")
+    require(page.count('class="product-row"') == 4, "site must list four distributable/host surfaces")
+    require(page.count('class="machine"') == 4, "site must list four machine contexts")
+    require(page.count('class="proof-card"') == 10, "site proof ledger is incomplete")
+    require(page.count('class="ingest-node') == 6, "site ingestion rail is incomplete")
     require("does not yet launch QEMU" not in page, "site carries stale QEMU claim")
     require("MULTI-ISA LIVE / UNRELEASED" not in page,
             "site carries stale architecture release claim")
     require("+ WORKTREE" not in state_page,
             "current-state page carries stale worktree claim")
+    require("PROVAS DE SO" not in state_page,
+            "current-state page conflates OSIF integrations with boot proofs")
+    for document, name in ((page, "site"), (state_page, "current-state page")):
+        ids = set(re.findall(r'\bid="([^"]+)"', document))
+        fragments = set(re.findall(r'href="#([^"]+)"', document))
+        require(fragments <= ids, f"{name} links missing fragments: {sorted(fragments - ids)}")
+    for stale in (
+        "LIVE CONTRACT MODEL",
+        "never forged data",
+        "IN-KERNEL QEMU RECORD",
+        "INFO / RDI",
+    ):
+        require(stale not in page, f"site carries stale or overstated claim: {stale}")
     require((ROOT / "readme/hero-proof-geometry.svg").exists(), "desktop geometry missing")
     require((ROOT / "readme/hero-proof-geometry-mobile.svg").exists(), "mobile geometry missing")
     print(f"BearBoot site: PASS (ABI {major}.{minor}, {len(tags)} tags, 4 integration records)")

website/estado.html

@@ -1,6 +1,6 @@
 <!DOCTYPE html>
 <!-- SPDX-License-Identifier: BSD-3-Clause -->
-<!-- Snapshot editorial do projeto em 2026-08-23. -->
+<!-- Snapshot editorial do release SDK 1.3.0 em 2026-08-24. -->
 <html lang="pt-BR">
 <head>
 <meta charset="utf-8">
@@ -160,8 +160,8 @@ <h1>Onde <span>paramos.</span></h1>
         <div class="signal"><small>LINHA ESTÁVEL</small><strong class="good">SDK 1.3.0 / wire 1.1</strong></div>
         <div class="signal"><small>RELEASE</small><strong>Waves 11–15</strong></div>
         <div class="signal"><small>FRONTEIRA EXPERIMENTAL</small><strong>BBP v2 Draft / offline</strong></div>
-        <div class="signal"><small>WORKTREE</small><strong class="good">gates de release validados</strong></div>
-        <div class="signal"><small>PUBLICAÇÃO</small><strong class="good">sdk-v1.3.0</strong></div>
+        <div class="signal"><small>REVISÃO PROVADA</small><strong class="good">ebc0573 / gates verdes</strong></div>
+        <div class="signal"><small>TAG ASSINADA</small><strong class="good">sdk-v1.3.0</strong></div>
       </aside>
     </div>
     <div class="scroll" aria-hidden="true">LEIA / COMPARE / DECIDA</div>
@@ -176,7 +176,7 @@ <h1>Onde <span>paramos.</span></h1>
       <div class="verdict">
         <article><small>WAVES CONCLUÍDAS</small><b>15</b><p>A campanha fecha com multi-ISA, Profile 0, TPM2 e envelope autenticado.</p></article>
         <article><small>DELTA PRÉ-WAVE 11</small><b>+10.4k</b><p>10.413 linhas adicionadas e 187 removidas em 83 arquivos até <code>327d209</code>.</p></article>
-        <article><small>PROVAS DE SO</small><b>4</b><p>TinaLinux, MINIX, Linux 0.01 e Josh-Bear na mesma seam OSIF.</p></article>
+        <article><small>INTEGRAÇÕES OSIF</small><b>4</b><p>TinaLinux, MINIX, Linux 0.01 e Josh-Bear na mesma seam, com níveis de prova distintos.</p></article>
         <article><small>VERSÕES ATIVAS</small><b>2</b><p>v1.1 congelada e utilizável; v2.0 Draft isolada e offline.</p></article>
       </div>
       <div class="truth"><b>Leitura honesta:</b> SDK 1.3.0 continua usando a ABI v1.1 congelada. AArch64 e RV64 são provas de máquina, enquanto Profile 0, TPM2 e o envelope autenticado permanecem experimentais e não fazem do Draft v2 um wire implantado.</div>
@@ -213,7 +213,7 @@ <h3>Uma superfície consumível e auditável.</h3>
             <li><b><code>bbpctl</code> + BBPC v1</b> permitem capturar, verificar e reproduzir evidência no host.</li>
             <li><b>Importadores atômicos</b> normalizam Limine, Multiboot2 e snapshots UEFI.</li>
             <li><b>SDK C, host tools e Rust <code>no_std</code></b> são empacotados de forma reproduzível.</li>
-            <li><b>Release supply chain</b> ganhou manifests, SBOM, Sigstore, tag assinada e gates isolados.</li>
+            <li><b>Release supply chain</b> ganhou manifests, SPDX no nível dos artefatos, Sigstore, tag assinada e gates isolados.</li>
             <li><b>BBP v2 Draft</b> prova cápsula contígua, offsets relativos, digest canônico e bridge v1.1.</li>
           </ul>
           <p class="era-note">A mudança central não é “mais features”. É uma geometria de confiança melhor: cada afirmação relevante ganhou um gate, um artefato ou um limite explícito.</p>
@@ -226,7 +226,7 @@ <h3>Uma superfície consumível e auditável.</h3>
     <div class="wrap">
       <div class="section-head">
         <div class="section-no">03 / ÚLTIMAS WAVES</div>
-        <div><h2>O caminho que percorremos.</h2><p class="section-copy">A sequência abaixo vem dos dez commits depois de <code>main</code>. Os nomes Wave 8 e Wave 9 estão gravados nos testes; o Draft v2 funciona como a décima wave prática desta campanha.</p></div>
+        <div><h2>O caminho que percorremos.</h2><p class="section-copy">A sequência parte do baseline histórico <code>6006356</code> e termina no corte SDK 1.3.0. Os nomes de wave registram entregas, não maturidade automática.</p></div>
       </div>
       <div class="timeline">
         <article class="step"><div class="step-id">01 / 7a8fab7</div><h3>Bounded handoff</h3><p>Endurecimento do core, inicialização fail-closed e framing canônico de evidência.</p></article>
@@ -235,7 +235,7 @@ <h3>Uma superfície consumível e auditável.</h3>
         <article class="step"><div class="step-id">04 / 994f867</div><h3>Importadores</h3><p>Limine, Multiboot2 e UEFI entram por uma tradução bounded e failure-atomic.</p></article>
         <article class="step"><div class="step-id">05 / 026dc94</div><h3>Geometria de prova</h3><p>Identidade visual e site passaram a derivar fatos do ABI em vez de decorar claims.</p></article>
         <article class="step"><div class="step-id">WAVE 8 / c00d78d</div><h3>SDK consumível</h3><p>Pacotes C e host reproduzíveis, onboarding e crate Rust sempre <code>no_std</code>.</p></article>
-        <article class="step"><div class="step-id">WAVE 9 / 2160520</div><h3>Release verificável</h3><p>Metadata determinística, SBOM, assinatura keyless e isolamento de permissões no workflow.</p></article>
+        <article class="step"><div class="step-id">WAVE 9 / 2160520</div><h3>Release verificável</h3><p>Metadata determinística, SPDX de artefatos, assinatura keyless e isolamento de permissões no workflow.</p></article>
         <article class="step"><div class="step-id">FECHAMENTO / e854 + 4df</div><h3>Release 1.2.0</h3><p>Provas visuais atualizadas, inventário Josh corrigido e tag local assinada no commit estável.</p></article>
         <article class="step exp"><div class="step-id">WAVE 10 PRÁTICA / 327d209</div><h3>Cápsula v2 offline</h3><p>Um extent contíguo, diretório bounded, payloads relativos, digest independente de layout e bridge v1.1.</p></article>
         <article class="step exp"><div class="step-id">LIMITE INTENCIONAL</div><h3>Ainda não é wire de boot</h3><p>O layout v2 não está congelado, não foi implantado e não cruza uma fronteira online sem transporte autenticado.</p></article>
@@ -258,11 +258,11 @@ <h3>Uma superfície consumível e auditável.</h3>
         <article class="status"><header><h3>WIRE v1.1</h3><span class="pill">LIVE</span></header><p>ABI congelada, CRC por estrutura, parser bounded, builder e evidência canônica. É a linha compatível do SDK 1.3.0.</p></article>
         <article class="status"><header><h3>SDK 1.3.0</h3><span class="pill">RELEASE CUT</span></header><p>Pacotes C, host e Rust compartilham a versão, metadata e gates reproduzíveis.</p></article>
         <article class="status"><header><h3>x86 / UEFI</h3><span class="pill">LIVE</span></header><p><code>make qemu</code> e <code>make qemu-uefi</code> exercitam round-trips reais sob TCG. O segundo não transforma o loader-esqueleto em loader completo.</p></article>
-        <article class="status"><header><h3>QUATRO PORTS</h3><span class="pill host">MIXED PROOF</span></header><p>TinaLinux é reproduzida no CI atual; MINIX, Linux 0.01 e Josh-Bear mantêm registros reais, mas nem todos os boots externos rodam no root CI.</p></article>
+        <article class="status"><header><h3>QUATRO PORTS</h3><span class="pill host">MIXED PROOF</span></header><p>TinaLinux e MINIX têm registros de boot; Josh-Bear combina registro real e gate host; Linux 0.01 tem harness host e apenas um relato separado do boot in-kernel.</p></article>
         <article class="status"><header><h3>V2 CAPSULE</h3><span class="pill host">HOST-TESTED</span></header><p>Parser, builder, digest e bridge passam em <code>make v2-test</code>. O Draft é experimental, offline e fora da ABI v1.1.</p></article>
         <article class="status"><header><h3>ARQUITETURAS</h3><span class="pill host">MULTI-ISA / SDK 1.3</span></header><p>AArch64/X0 e RV64/A0 têm provas de máquina, parser bounded e Device Trees gerados pelo QEMU. LoongArch continua roadmap.</p></article>
         <article class="status"><header><h3>MEDIÇÃO</h3><span class="pill host">MACHINE PROOF</span></header><p><code>make tpm2-measure-test</code> estende o digest em um TPM2 emulado; ainda não existe produtor de firmware distribuído.</p></article>
-        <article class="status"><header><h3>AUTENTICIDADE</h3><span class="pill host">HOST PROOF</span></header><p>Envelope HMAC host-only cobre identidade, freshness e anti-rollback; assinatura pública e provisionamento de firmware continuam fora do escopo.</p></article>
+        <article class="status"><header><h3>AUTENTICIDADE</h3><span class="pill host">HOST PROOF</span></header><p>Envelope HMAC host-only liga um identificador de chave compartilhada a um índice monotônico global; não prova identidade pública, timestamp ou challenge-response.</p></article>
         <article class="status"><header><h3>LOADER UEFI</h3><span class="pill gap">SKELETON</span></header><p>Coleta final, ELF load, paging, <code>ExitBootServices</code> e transferência do produtor de referência ainda são incompletos.</p></article>
       </div>
     </div>