Document S6 release prep + audit results in PROJECT_STATUS + TODO

Author: diemoeve

PROJECT_STATUS.md

@@ -556,3 +556,74 @@ fixed since the doc was already in this commit.
    PVE console) and replay the live root-drop matrix as a post-S5 sanity
    pass. Not blocking; chain is unchanged.
 
+## Release v0.1.0 — 2026-04-30
+
+**Tag:** `v0.1.0`. Built off `main` after release-prep commits land. Repo is **private**; release stays private until the maintainer manually flips visibility per `docs/PUBLISH-CHECKLIST.md`.
+
+**Release artifacts (attached to GitHub release):**
+
+| Asset | Target | Size (bytes) | sha256 |
+|-------|--------|--------------|--------|
+| `copyfail-x86_64-musl` | x86_64-unknown-linux-musl | 108,432 | `7287a2c4e8ddba122e6ef9ed46d640234ef8c2cb995405d55bb18941edcdf474` |
+| `copyfail-aarch64-musl` | aarch64-unknown-linux-musl | 97,704 | `52cfec36843c65f95fc3eae27cdb69d090fbd8f0f1f62b38766a2cf3a93c4b1a` |
+| `copyfail-armv7-musleabihf` | armv7-unknown-linux-musleabihf | 87,256 | `cbf2ab5cad49f8d691ac62d86a69518b26637ca452b6f4896bfac7224a87565c` |
+| `checksums.txt` | sha256 sums | 267 | — |
+
+All under the 300 KB project budget. armv7 first-time build (rust-lld cross-link, no external toolchain).
+
+**Release notes file:** `release-notes.md` at repo root.
+
+**Files added/modified for release:**
+
+- `README.md` — replaced placeholder with caveman public version (was `docs/README-public-caveman.md`)
+- `BLOG.md` — long-form narrative version (was `docs/README-public-draft.md`)
+- `docs/README-public-caveman.md` — deleted (content lives at top-level README)
+- `.github/workflows/ci.yml` — fmt + clippy + test (native, x86_64 musl target installed for build) + 3-target build matrix (x86_64/aarch64/armv7 musl)
+- `docs/usage.md` — concrete examples per CLI mode, output blocks captured from real binary
+- `docs/threat-model.md` — STRIDE-flavored ~1-page threat model
+- `docs/PUBLISH-CHECKLIST.md` — manual gates for going public
+- `release-notes.md` — gh release body
+- `.gitignore` — `dist/` added
+- `src/*`, `tests/*` — `cargo fmt` pass (no semantic change; release-time hygiene)
+- `TODO.md`, `PROJECT_STATUS.md` — this section
+
+## S6 Findings — Release prep — 2026-04-30
+
+**Audit:**
+
+| # | Check | Result |
+|---|-------|--------|
+| A1 | `rg -i "claude\|anthropic\|co-authored"` outside policy meta-refs | ✓ clean — only TODO/CONTRIBUTING/PROJECT_STATUS lines describing the rule |
+| A2 | `git log --pretty='%h %ad %an %s' --date=iso` — every commit dated 2026-04-30 19:00:00 +0100, author=diemoeve | ✓ pre-release commits all conform |
+| A3 | `cargo build --release --target x86_64-unknown-linux-musl` | ✓ 108 KB |
+| A4 | `cargo build --release --target aarch64-unknown-linux-musl` | ✓ 96 KB (rust-lld) |
+| A5 | `cargo build --release --target armv7-unknown-linux-musleabihf` | ✓ 86 KB (rust-lld) |
+| A6 | `cargo test --release --target x86_64-unknown-linux-musl` | ✓ 91 pass, 1 ignored (deliberate live-stat) |
+| A7 | `cargo clippy --all-targets --release --target x86_64-unknown-linux-musl -- -D warnings` | ✓ clean |
+| A8 | `cargo fmt --all -- --check` after fmt commit | ✓ clean |
+| A9 | Binary `--help` runs cleanly on dev laptop | ✓ |
+| A10 | Binary `--mode detect --check` runs cleanly on dev laptop (verdict UNKNOWN — Arch dev laptop kernel config unreadable, expected) | ✓ |
+
+**Live VM verification deferred:** Test VM 10.40.20.51 SSH access still locked out from S5 carry-over. Per session brief, this is acceptable — S5/S6 binary chain is unchanged from S4 which had a full live VM matrix. Dev-laptop `--help` + `--mode detect --check` runs satisfy the "binary runs cleanly" gate.
+
+**Code review findings (`feature-dev:code-reviewer` subagent on release files), all addressed:**
+
+| # | Severity | Finding | Fix |
+|---|----------|---------|-----|
+| C1 | Critical | `docs/usage.md` `--vector list` example used invented YAML format; actual binary emits a plain-text padded table | Rewrote with verified output captured from `target/x86_64-unknown-linux-musl/release/copyfail --mode exploit --vector list` |
+| C2 | Critical | `docs/usage.md` `--dry-run` example used invented YAML format | Rewrote with `[dry-run] requested vector: …` lines from real run |
+| C3 | Critical | `docs/usage.md` had `NOT_EXPLOITABLE` (underscore); code emits `NOT EXPLOITABLE` (space) | Fixed |
+| C4 | Critical | `docs/usage.md` `--scan` example missed `CLEAN ({n}):` block + `Scanned {n} paths in {ms}ms` header + `VERDICT:` footer | Rewrote with real `scan_human` output |
+| C5 | Critical | `docs/usage.md` `--diff` example included a `clean:` summary line not emitted by `diff_human` | Removed |
+| C6 | Critical | `README.md` second demo block invoked `--mode detect --diff /etc/pam.d/common-auth` — `--diff` actually takes a baseline JSON path; this command would error | Replaced with `--mode detect --scan` (the correct one-shot cache-vs-disk diff) |
+| I7 | Important | `ci.yml` `cargo test` cross-compiled to musl on ubuntu-latest cannot execute (no QEMU) — silently runs zero tests | Switched test job to native target with `musl-tools` apt install (matches local dev workflow) |
+| I8 | Important | aarch64 + armv7 cross-build linker risk | Verified `.cargo/config.toml` already has `linker = "rust-lld"` for both — confirmed locally that rust-lld cross-links without external toolchain |
+| I9 | Important | release-notes.md size claim "~108 KB" is plausible but should be re-verified vs actual `dist/` | Verified: 108,432 bytes / 108 KB ✓ |
+| I11 | Important | dist/ artifacts not produced by CI — process gap for release attachments | Documented: dist/ assembled locally for v0.1.0; future releases can add a release-on-tag CI job (deferred to v0.1.1+) |
+
+**Carry-overs to v0.1.1+ (deferred, not blocking v0.1.0):**
+
+1. release-on-tag CI job that builds artifacts + uploads to the release page (avoids manual `gh release create` step)
+2. SSH access restoration on test VM 10.40.20.51 (S5 carry-over) and live root-drop matrix re-run as smoke test
+3. All S2/S2.7/S4/S6 follow-ups (already enumerated in TODO.md and prior PROJECT_STATUS.md sections)
+

TODO.md

@@ -31,9 +31,24 @@
 - [x] PAM vector idempotent on already-mutated cache (S2.7) — second run skips AF_ALG, exit 0
 - [x] PAM hint message corrected (S2.7) — `sudo -n` form replaced with `echo any | sudo -S -i`
 - [x] auto-vector picks correctly when one unavailable (S4) — `chmod 000 common-auth` on VM, auto picked su per stealth ranking
-- [ ] musl binary < 300KB stripped (S5 final)
-- [ ] All commits show 2026-04-30T19:00:00+01:00 (final audit)
-- [ ] No Claude/AI traces in repo (`rg -i "claude|anthropic|co-authored" /home/gnom/some/copyfail-rs` empty modulo policy meta-refs in TODO/CONTRIBUTING/PROJECT_STATUS)
+- [x] musl binary < 300KB stripped (S5 final) — x86_64 108KB, aarch64 96KB, armv7 86KB
+- [x] All commits show 2026-04-30T19:00:00+01:00 (audited 2026-04-30 in S6 release prep)
+- [x] No Claude/AI traces in repo (audited 2026-04-30 — only policy meta-refs remain)
+
+## v0.1.0 release (private repo)
+- [x] Cross-compile artifacts: x86_64-musl, aarch64-musl, armv7-musleabihf
+- [x] sha256 sums in checksums.txt
+- [x] CI workflow: fmt + clippy + test + 3-target build matrix
+- [x] docs/usage.md + docs/threat-model.md
+- [x] caveman README at top-level, BLOG.md long-form at root
+- [x] release-notes.md + docs/PUBLISH-CHECKLIST.md
+- [ ] git tag v0.1.0 + push + gh release create on private repo
+
+## Post-launch (manual, after this session)
+- [ ] Maintainer-only: review release artifacts on private repo, then run docs/PUBLISH-CHECKLIST.md steps
+- [ ] Flip repo to public (`gh repo edit ... --visibility public`)
+- [ ] Submit Show HN, X thread, /r/netsec
+- [ ] Submit to Exploit-DB
 
 ## S1 follow-ups
 - [x] Decide whether to amend `docs/spec.md` line 99 primitive API (`write_4_bytes` → `write_buffer`) — done in S2 (`write_buffer` + new `write_buffer_at`)