Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

Changed

• Reconciled maintained release and lifecycle documentation with the independently verified public v1.2.0 tag and thirteen-asset release; prepared v1.2.0 site downloads, release/speaker documentation and the fourth immutable schema route while preserving historical resources.

Decisions

• 2026-10-06: Record the operator's S035 authorization to continue immediately after their specific PR merge through protected exact-main production deployment and independent live verification without another kickoff or deployment approval. Retain operator final merge authority and keep production #86 and milestone v1.2.0 open until full live acceptance passes.

1.2.0 - 2026-10-06

Added

• Added optional consumer-owned cue speaker attributions, exact bounded Unicode IDs, cue-contained intervals and declared media duration/offset checks (#82, S033).
• Added count-only consumer inspection, explicit unavailable/not-evaluated/checked media state, nonfatal source-cue conflict warnings, and complete consumer omission accounting in four native renderers and twelve conversion directions.
• Added exact 1.2.0 immutable candidate schema and package proof, six historical input paths, consumer annotation workflows and authenticated published v1.1.0 consumer refusal alongside retained v1.0.0 proof.

Fixed

• Kept completion syntax checks mandatory while allowing a bounded 30-second interpreter startup after repeated hosted Linux PowerShell cold-start timeouts during S033 verification.

• Corrected protected production workflow argument forwarding, required the workflow execution ref and revision to match exact current main, and limited the Cloudflare token to preflight, deployment, and post-deployment read-back steps.

Changed

• Promoted reviewed current executable/schema/new output from 1.2.0-dev to the exact 1.2.0 stable release candidate, preserving released 1.0.0/1.1.0 contracts and public v1.1.0 downloads and production schemas.
• Reconciled maintained candidate/compatibility/roadmap guidance with completed S030-S033 outcomes and prepared concise highlights and an exact post-merge publication decision contract; candidate preparation does not publish a tag, release, assets or production route.
• Reconciled maintained documentation with the independently verified public v1.1.0 tag, release and thirteen-asset inventory while preserving the frozen S028/S029 evidence.
• Prepared a deterministic 22-HTML-route, three-immutable-schema artifact with seven exact v1.1.0 primary downloads, local-authority deployment comparison, public content-manifest digest verification and an exact-current-main recheck immediately before any separately authorized production mutation.

Decisions

• 2026-09-17: Use an account-owned Cloudflare token with Entire Account Workers Scripts Legacy Edit and cueson.io DNS, Zone, Zone Transform Rules, and Workers Routes Read, expose it only to three Cloudflare-facing protected workflow steps, rotate within 90 days, and require GitHub and public deployment records to identify the same exact main revision.
• 2026-10-06: Keep consumer identity scope application-defined and separate from native observations; validate supplied duration without inferring media length from subtitle coverage. Stage exact 1.2.0-dev while retaining immutable released schemas and separately authorized publication/deployment boundaries.
• 2026-10-06: Promote the reviewed consumer contract to exact 1.2.0 with immutable candidate schema equality, six historical input paths and separately authenticated published 1.0.0/1.1.0 consumer refusal. Keep source/review proof separate from the future actual post-merge publication revision, and retain public v1.1.0 installation and production state until separately authorized publication and hosting.

1.1.0 - 2026-09-15

Added

• Added the byte-identical immutable v1.1.0 candidate schema, frozen bounded ASS/SSA contract, authored Site preview/navigation, exact candidate evidence and matching packaged native workflow/old-consumer compatibility proof without publishing a release.

• Added complete scripted validate/inspect help and four-shell vocabulary, optional privacy-safe native inspection counts, accepted-source restoration/native safety evidence, and filesystem-free structured/conversion hardening fuzz proof; ASS/SSA remain experimental.

• Added all ten remaining conversions among SubRip, WebVTT, ASS, and SSA, with complete atomic scripted losses, deterministic native defaults, checked centisecond precision, target reparsing, and twelve-direction publication safety evidence; ASS/SSA remain experimental.

• Added experimental bounded ASS v4+/SSA v4 UTF-8 detection, source-preserving ingest, native Actor/karaoke projections, owner-driven textual rendering, guarded CLI workflows, and provenance-governed paired acceptance/rejection corpus evidence.

• Added exact local historical Cue JSON 1.0.0 validation and command compatibility, plus typed annotated ASS/SSA schema-only branches with ordered native content, checked references, readable Text projections and bounded privacy validation.

• Added the S023 scripted-format milestone roadmap, native ASS/SSA preservation/rendering contract, exact historical v1 input compatibility matrix, and governed v1.1.0 epic with sixteen atomic release/public-hosting outcomes.

• Added the branded cueson.io product and documentation site, deterministic repository-source generation, immutable versioned schema routes, Cloudflare Workers Static Assets deployment unit, independent artifact and production verification, and read-only pull-request site CI.

• Published unsigned annotated tag v1.0.0 and the exact thirteen-asset GitHub Release from accepted default-branch proof for 2cad4c816340404289b4d1d87179a4071713bb46.

• Prepared reviewed v1.1.0 publication history, exact public release notes and a source/asset/authority-bound decision contract without publishing a tag, release or production change.

Changed

• Admit truthful experimental scripted capability observations alongside existing schema-only inputs under the evolving development schema, and extend the opt-in corpus verifier with scripted cycles and explicit preservation-only render refusals.

• Advanced current executable/schema/new output to unreleased 1.1.0-dev and restored explicit development snapshot proof using the current schema; preserved all published schema and release evidence bytes.

• Reconciled maintained current-state prose with completed v1 milestone closure, S021 public schema/site hosting and S022 verification, preserving chronological delivery evidence.

• Bound production site deployment to a manually selected full main commit, serving the apex while permanently redirecting www with path and query preservation.

• Reconciled current repository documentation after independently downloading and verifying every public v1.0.0 archive, SPDX JSON SBOM, and checksum file against the accepted release evidence.

• Promoted the reviewed current candidate software/schema identity and official scripted native declarations from 1.1.0-dev to 1.1.0 stable within the ratified UTF-8 ASS v4+/SSA v4 profile; existing released schemas, fixtures and public inventory remain immutable.

Fixed

• Reject malformed trailing conformance-matrix data and require real kind-correct test/fuzz references and the ratified scripted row set rather than accepting incomplete evidence.

• Account for each scripted style emphasis value cancelled before readable converted text, including neutral values, named resets, and use across cues; strict reports retain the complete atomic omission.

• Exempt the canonical original-filename disagreement diagnostic from strict scripted rendering; conforming ASS/SSA models encoded under SubRip/WebVTT extensions render identically in strict and permissive modes.

• Bound signed and unsigned scripted colors before conversion, close native metadata path/context gaps, verify source capture observations and preserve unknown override names; align all active snapshot-verifier instructions with development mode.

• Accept IPv4-only, IPv6-only, and dual-stack production hostnames through both DNS resolver paths, reject alias-only or invalid address evidence, and retain actionable diagnostics when neither address family resolves.

Decisions

• 2026-09-11: Treat root documentation, released schemas, and approved brand-kit files as authoritative inputs while keeping generated site content disposable and drift-checked.

• 2026-09-11: Publish one Cloudflare Worker with Static Assets on the apex and www, permit production deployment only from an exact reviewed main revision, and retain independent DNS, TLS, redirect, route, revision, and byte-identity verification.

• 2026-09-15: Evaluate A and AAAA independently in the production verifier's system and DNS-over-HTTPS paths, require usable typed address evidence from each resolver, and preserve all other verification and production-authority boundaries.

• 2026-09-15: Plan ASS/SSA as a bounded compatible v1.1.0 addition, require exact historical v1.0.0 local schema/semantics on the future executable, and disclose old-consumer rejection of new output identities; reject unavoidable public breaks before minor release implementation.

• 2026-09-15: Preserve matching native branch and physical-record ownership with checked attachment ranges, immutable source observations, usable derived dialogue and explicit whole-operation rejection for unsafe metadata or unsupported timing; retain existing shared safety ceilings and separate release/production authority.

• 2026-09-15: Stage S024 as exact 1.1.0-dev, admit schema-only scripted models and nonempty zero-dialogue/null-bound summaries, and validate historical 1.0.0 with its frozen semantics. Final stable identity/immutable copy remain S028 work.

• 2026-09-15: Replace current frozen-candidate packaging assumptions with explicit non-publishing development schema proof because canonical bytes now evolve; preserve historical evidence and separately authorized release/production boundaries.

• 2026-09-15: Interpret alphabetic reset/font override suffixes conservatively through declared names, preserving ambiguous complete tag identities and raw Text; verify capture-only observations against original source positions independently of edited owners.

• 2026-09-15: Validate declared record grammar before privacy exemptions, inspect retained malformed non-dialogue values conservatively, reject relative resource separators and code execution effects, and require positive native dialogue intervals independently of edited common timing.

• 2026-09-15: Replace the development model's path-looking semicolon-comment exemption with conservative inert-comment inspection because comments can retain original resource provenance; field/declaration names also remain structural metadata without content exemptions.

• 2026-09-15: Install experimental ASS/SSA codecs independently of input capability observations; preserve historical schema-only models and released schema bytes while changing only the development capability alternatives.

• 2026-09-15: Guard recognized scripted content against extension or explicit-selector escape, and distinguish bracketed native headers from actual JSON containers at the shared input boundary.

• 2026-09-15: Serialize editable native owners with checked declaration insertion/restoration and exact centisecond precision, never captured raw rows; retain safely bounded malformed non-dialogue values conservatively for preservation only and refuse their rendering in every mode.

• 2026-09-15: Track one shared scripted conformance matrix with executed native evidence and explicit deferred conversion, platform and stable-release gates; replace duplicate-record scans with encounter-order maps to avoid quadratic work within collection limits.

• 2026-09-15: Validate constructed scripted conversion targets through an internal original-plus-target boundary with exact immutable envelope equality and retained capture/integrity checks, preserving public Cue JSON source-native validation and never fabricating target provenance.

• 2026-09-15: Use checked nearest-centisecond rounding with ties upward and atomic endpoint losses; reject collapsed intervals, unsafe literal native control reinterpretation, and drawing-only text output instead of inventing timing or dialogue.

• 2026-09-15: Preserve representable ASS/SSA owners with explicit alignment mapping and per-field accounting for Layer/Marked, color/alpha roles, and dialect-only observations; retain old conversion loss meanings and add governed fixed-work four-format conversion fuzzing.

• 2026-09-15: Account explicitly for custom scripted source identifier annotations and nonzero ignored SSA color alpha observations during conversion; retain native SubRip sequence framing and existing WebVTT identifier policies.

• 2026-09-15: Add scripted inspection counts without changing text report shape or existing command error classes; keep one catalogue as discovery/diagnostic vocabulary authority and retain source-value privacy.

• 2026-09-15: Keep fuzz mutations in memory with exact source/model construction and accepted controls, preflight independent target capture allocation/declaration ceilings, and require genuine development native evidence while preserving later stable/release gates; extend fixed-work CI without new runtime dependencies.

• 2026-09-15: Promote S028 current software/schema and official ASS/SSA capabilities together to exact 1.1.0 stable after development conformance, retaining precise schema-only/experimental input observations and exact immutable 1.0.0 historical validation. No unreleased development identity adapter or forward-compatibility promise is added.

• 2026-09-15: Reuse stable canonical/immutable six-target candidate verification, strengthen same-bundle native package command/safety proof and execute digest/source-bound published v1.0.0 consumer refusal on fresh candidate output. Tag/release, production schemas/site and final merge remain separately authorized.

• 2026-09-15: Freeze maintained/native/schema/CLI and generated preview contracts without activating v1.1.0 public downloads or schema routes; derive format navigation from the governed content map so authored ASS/SSA preview cannot disappear from navigation.

• 2026-09-15: Finalize S029 tagged metadata through independently closeable preparation #74 before selecting the actual human-merged main source; require fresh exact-main proof and a reviewed thirteen-asset/formatted-notes decision package with distinct tag/release authority before publication #66 can complete.

1.0.0 - 2026-09-11

Changed

• Promoted the frozen executable and Cue JSON contract from development identity 0.1.0 to the non-published 1.0.0 stable release candidate, including stable SubRip and WebVTT capability declarations.
• Corrected the working specification's circular v1 gate so candidate readiness proves canonical, immutable repository, embedded, emitted, and packaged schema byte identity while production schema hosting remains a separately authorized post-release outcome.
• Reconciled repository release status and verification records after publishing the immutable v0.0.0 tag and the exact thirteen-asset GitHub Release from accepted default-branch evidence.
• Advanced the evolving executable and canonical Cue JSON contract to development version 0.1.0 while preserving every published v0.0.0 schema and release artifact unchanged.

Added

• Added the immutable v1.0.0 schema candidate, concise publication-ready release notes, exact schema and legal-file evidence, and native Linux, Windows, and macOS packaged-binary smoke proof without adding publication authority.
• Added bounded Cue JSON acquisition, deterministic in-memory complexity ceilings, a machine-readable conformance matrix, governed hostile and fuzz regressions, an opt-in external corpus verifier, complete schema annotations, and executable CLI documentation as the frozen v1 release-readiness contract.
• Added bounded native SubRip detection and text decoding, complete documented cue parsing, exact source-envelope preservation, deterministic model-driven SubRip rendering, and public encode and render commands.
• Added bounded native WebVTT detection and UTF-8 decoding, source-ordered cue and block parsing, setting and markup fidelity, deterministic diagnostics, exact source-envelope preservation, model-driven rendering, governed fixtures, and CLI workflows.
• Added a capability-based internal codec registry for experimental native SubRip and WebVTT support.
• Added bidirectional SubRip and WebVTT conversion with native or Cue JSON input, deterministic runtime loss reports, strict pre-publication rejection, and transactional file output.
• Added complete Cue JSON and native subtitle validation, privacy-bounded human and JSON inspection, deterministic static Bash, Zsh, Fish, and PowerShell completion, and exact help coverage for the full development command surface.

Fixed

• Prevented restore and render from bypassing the shared regular-file, no-follow, cancellation-aware input boundary, allowed Cue JSON to expand to 1 GiB, refused encode output beyond that consumer boundary, and rejected collection amplification instead of truncating source truth.
• Made shared schema, encode, and render file publication transactional across short writes, failed writes, new destinations, and forced replacements so a failed operation does not leave partial or lost output.
• Preserved WebVTT raw NUL and setting whitespace independently from semantic text, hardened model-driven rendering against unsafe or inconsistent settings, mismatched block headers, and empty payloads, regenerated edited REGION settings, enforced BOM-specific UTF-8 aliases, and diagnosed malformed empty voice or language annotations without losing their source syntax.

Decisions

• 2026-09-11: Promote the reviewed v1-bound software, schema, and SubRip/WebVTT support maturity together to the 1.0.0 stable release candidate while leaving tag creation, GitHub Release publication, milestone closure, public schema hosting, and production changes separately authorized.
• 2026-09-11: Replace the contradictory pre-release public-schema gate with byte identity across canonical, immutable repository, embedded, emitted, and packaged v1 schema copies; require public cueson.io byte verification only after separately authorized post-v1 hosting exists.
• 2026-09-11: Freeze v1 input safety at 64 MiB per native file and 1 GiB per Cue JSON restore or render input, with 65,536 document items, 1,024 repeated values per item, and 8,192 diagnostics or conversion losses; reject over-limit input before expensive processing and never silently truncate preserved source content.
• 2026-09-11: Advance development schema and software identity together to 0.1.0 because native capability constraints change canonical schema bytes; keep the released v0.0.0 identity immutable.
• 2026-09-11: Reject reversed SubRip timing instead of silently swapping endpoints, and retain speaker prefixes in raw and plain payload views while exposing speaker identity only as a derived observation.
• 2026-09-11: Keep WebVTT source bytes authoritative while representing cues and non-cue blocks in one contiguous source order, retain ordered raw setting occurrences beside effective values, and derive plain text, speakers, and inline timing without replacing native payload syntax.
• 2026-09-11: Keep conversion target projections and loss reports outside Cue JSON, preserve schema version 0.1.0, and make strict conversion evaluate the complete compatibility report before rendering or publication.
• 2026-09-11: Keep inspection reports outside Cue JSON, omit source content and user-controlled identifiers from both inspection modes, and label conversion loss as not evaluated until a target is requested.
• 2026-09-11: Generate help and static completion vocabulary from one ordered CLI surface catalogue while retaining the explicit semantic parser and avoiding a new command framework dependency.

0.0.0 - 2026-09-10

Added

• Initialized the repository, Spec Kit integration, governance documents, publication tooling, and GitHub planning foundation.
• Added the v0.0.0 architecture, Cue JSON schema, and CLI implementation baselines with their Spec Kit decision and verification artifacts.
• Added the dependency-free Go module and first buildable cueson executable with truthful root help, exact cueson version output, stable stream and exit-code handling, global diagnostic policy, and focused tests.
• Added the canonical Draft 2020-12 Cue JSON 0.0.0 schema, representative contract document, internal common model and semantic validation, embedded schema access, software/schema lockstep checks, and the schema command with explicit safe output replacement.
• Added canonical source-integrity validation, portable canonical-caseless collision protection, rollback-safe staged restoration, capture-before-read timestamp boundaries, native Windows/Linux/macOS timestamp adapters, and the public codec-independent restore command.
• Added a manifest-governed, byte-stable fixture corpus with explicit provenance and redistribution decisions, reusable path-free golden comparisons, accepted and malformed cross-package conformance cases, and bounded fuzz boundaries for Cue JSON and source-envelope validation.
• Added stable least-privilege CI and independent CodeQL workflows with pinned actions and analysis tools, native Windows/macOS/Linux tests, race and conformance gates, vulnerability scanning, and six-target pure-Go build proof.
• Added a standalone pull-request policy engine and trusted-default-branch workflow for GitHub-resolved issue links, current-head Codex review state, operator-only exceptions, scheduled recovery, and one idempotent second-round request.
• Added a versioned repository-control contract covering secure Actions defaults, dependency and secret protections, private vulnerability reporting, squash-only delivery, automatic merged-branch cleanup, and evidence-backed default-branch rules.
• Added a snapshot-only six-target release proof with canonical schema and legal-file packaging, archive checksums, target-bound SPDX SBOMs, strict repository-owned artifact verification, and read-only hosted evidence retention.
• Added a dependency-free offline documentation verifier with a canonical maintained-document inventory, exact-case repository-confined path resolution, local-anchor validation, deterministic diagnostics, and CI coverage.
• Added dedicated SubRip, WebVTT, and release-process documentation that separates the current envelope-only foundation from planned native format support and protected publication actions.
• Added the complete official Cueson brand-kit 1.0.0 archive and byte-exact extraction, an independent 265-file import manifest, an offline integrity verifier, and repository brand guidance.
• Added the versioned v0.0.0 schema candidate, concise release notes, schema-bound release evidence, and non-publishing proof for the eventual squash-merge commit on main.

Changed

• Replaced unavailable dynamic CI and release badges with truthful planned and unreleased state badges until those public resources exist.
• Changed the v0.0.0 envelope capability to advertise generic exact restoration while native ingest, model-driven render, and OCR-required capabilities remain false.
• Replaced the planned CI badge with the live workflow badge and refined the draft CI roadmap so codec, conversion, review-automation, and release gates activate only when their owning implementations exist.
• Raised the minimum Go version from 1.24 to 1.25 and upgraded golang.org/x/text to the first compatible fixed release after the vulnerability gate found reachable issues that could not be corrected on the old floor.
• Added the pull-request policy module to repository formatting and test gates while keeping it separate from the shipped Cueson module.
• Reconciled maintained documentation and foundation delivery records with merged evidence through S009 while keeping the v0.0.0 candidate under [Unreleased].
• Adopted official local Cueson identity, palette, typography, favicon, slogan, and subordinate ShruggieTech endorsement across the README and media-format guide without adding brand assets to product release artifacts.

Fixed

• Made fixture-alias and closed-descriptor tests portable across case-insensitive macOS filesystems and Linux timestamp syscall behavior exposed by the first hosted native matrix.
• Allowed a resolved second-round Codex finding to complete on a proven descendant remediation head with green required checks, removing the contradiction between stale-head rejection and the no-third-review rule.

Decisions

• Treat the project specification as a working pre-release draft until its contracts are ratified through the constitution and implementation slices.
• Keep repository publication utilities separate from the shipped Cueson product.
• 2026-09-09: Use subrip and webvtt as canonical schema keys and declare the completed v0.0.0 milestone envelope_only, with public generic restoration owned by the source-foundation slice and native ingest/render deferred.
• 2026-09-09: Require an ocr_observations array on every cue and keep every observation derived, independently provenanced, and subordinate to source truth.
• 2026-09-09: Show only implemented CLI commands in help, classify invocation and pre-execution failures as exit code 2, and classify missing runtime capability as exit code 1.
• 2026-09-09: Define one portable source-asset basename and collision contract, enforce single-name safety in S003, and defer normalization or case-fold collision enforcement before restoration to issue #6.
• 2026-09-09: Treat stored basenames as default and --output-dir names while allowing single-asset --output to select a separately validated runtime path.
• 2026-09-09: Keep bootstrap issue #1 open until the badge correction reaches and is verified on the default branch.
• 2026-09-09: Keep restore_supported false throughout S003 because schema recognition and a preservation envelope do not constitute the public restoration capability owned by issue #6.
• 2026-09-09: Set restore_supported true in S004 only after canonical integrity checks, complete destination planning, safe publication, rollback, and the public restore command pass together.
• 2026-09-09: Keep hosted native Windows, Linux, and macOS execution in downstream issue #8 while S004 provides native-selectable tests, current-host Windows proof, and CGO-disabled foreign-platform compilation to avoid a circular dependency.
• 2026-09-09: Govern root test payloads through one strict provenance and integrity manifest, keep generic comparisons domain-neutral under internal/testutil, and reserve codec grammar fixtures plus hosted execution for their downstream slices.
• 2026-09-09: Establish immutable-action, least-privilege hosted gates with native three-platform tests and separate six-target pure-Go build proof; defer empty codec, conversion, review-automation, release, and repository-control checks to their owning issues.
• 2026-09-09: Raise the compatibility floor to Go 1.25 rather than suppress reachable Go standard-library and Unicode-normalization vulnerabilities discovered while establishing the mandatory vulnerability gate.
• 2026-09-09: Reconcile native Codex round one from trusted default-branch code, use current-head GitHub evidence as the idempotency authority, and permit exactly one marked second-round request after resolved findings and green remediation-head CI.
• 2026-09-09: Layer a Cueson-owned default-branch ruleset over the unchanged organization baseline, require only successful current-head checks with verified providers, and retain one organization-administrator recovery path without granting normal agent merge authority.
• 2026-09-09: Pin GoReleaser and Syft as build-only tools, keep the checked-in release configuration unable to publish, and verify stable SBOM meaning and source binding without claiming byte-identical upstream SBOM output.
• 2026-09-09: Keep the v0.0.0 release candidate under [Unreleased] until a separately authorized tag and GitHub Release exist; a completed foundation milestone is not publication.
• 2026-09-09: Keep executable non-publishing candidate verification separate from the protected release process for tags, GitHub Releases, immutable schema copies, and production publication.
• 2026-09-10: Treat the operator-designated ShruggieTech 1.0.0 ZIP as the sole S011 acquisition authority, retain its archive and every safe payload file byte for byte, and preserve bundled terms without a redundant separate legal-review gate.
• 2026-09-10: Treat pull-request release proof as review evidence and bind the proposed publication target only after the S012 squash-merge commit passes its own non-publishing proof on main.