Define stable-v1 release controls

.github/workflows/ci.yml

@@ -29,6 +29,8 @@ jobs:
         run: cargo fmt --all --check
       - name: release version alignment
         run: python3 scripts/check-release-version.py
+      - name: documentation controls
+        run: python3 scripts/check-docs.py
       - name: clippy
         run: cargo clippy --workspace --all-targets --all-features
       - name: tests

CONTRIBUTING.md

@@ -9,10 +9,9 @@ Testers can start with the [Alpha testing guide](docs/27-alpha-testing.md);
 current priorities and evidence language are in the
 [stabilization program](docs/29-stabilization-program.md).
 
-Komms is currently founder-directed, including intentional use of automated
-implementation assistance. Contributions provide ideas, implementation,
-testing, and evidence; product and release authority remains with the founder
-unless explicitly delegated.
+Komms is currently founder-directed. Contributions provide ideas,
+implementation, testing, and evidence; product and release authority remains
+with the founder unless explicitly delegated.
 
 ## Where contributions help
 
@@ -56,11 +55,10 @@ fix does not require advance permission.
   release gate changes. Documentation claims must distinguish automated build
   evidence from hands-on device or hardware qualification.
 - Keep PRs scoped to one concern; cite the spec section your change implements.
-- Automated assistance is permitted. The human submitter must understand and
-  take responsibility for the diff, verify that they have the right to submit
-  it, check license and provenance concerns, run the applicable tests, and be
-  able to explain and revise the result. Automated output is not independent
-  review.
+- The human submitter must understand and take responsibility for the diff,
+  verify that they have the right to submit it, check license and provenance
+  concerns, run the applicable tests, and be able to explain and revise the
+  result.
 
 ## Process
 

GOVERNANCE.md

@@ -50,11 +50,10 @@ migration plan, and evidence required for acceptance. Rough consensus is
 preferred; the lead maintainer makes the final decision and records the
 reason when consensus is not possible.
 
-Founder-directed automated assistance is an intentional implementation method.
-Automated systems are tools, not maintainers, reviewers, or decision-makers.
-The human maintainer remains accountable for provenance, scope, review, testing,
-acceptance, and public claims. Tool-assisted output is not independent review or
-release evidence by itself.
+Implementation method does not change accountability. The human maintainer who
+approves a change remains accountable for provenance, scope, review, testing,
+acceptance, and public claims. Only evidence meeting the published independence
+criteria counts as independent review.
 
 ## Review and release
 
@@ -79,7 +78,9 @@ and cannot be represented as closed, audited, or independently approved.
 The lead maintainer currently authorizes releases. A stable release also
 requires all applicable P0 gates in the
 [stabilization program](docs/29-stabilization-program.md) to be closed with
-published evidence.
+published evidence. The current owners, unassigned independent roles, claim
+register, gaps, and review dates are recorded in the
+[release evidence ledger](docs/31-release-evidence-ledger.md).
 
 ## Conflicts, conduct, and appeals
 
@@ -111,6 +112,12 @@ before a stable release. A temporary steward may maintain security and release
 continuity when the lead maintainer cannot act; permanent authority changes
 must be publicly recorded.
 
+No backup steward currently exists. The role remains visibly unassigned in
+[MAINTAINERS.md](MAINTAINERS.md), and stable release authority remains blocked
+until a real person accepts the scope and the credential-recovery procedure is
+rehearsed. Repository access or a platform role alone does not confer project
+or release authority.
+
 Governance evolution is not automatic. When sustained adoption has produced a
 real community of users, contributors, reviewers, and operators, the founder may
 publish a proposal for additional delegated maintainers, a foundation, a

MAINTAINERS.md

@@ -15,6 +15,29 @@ The lead maintainer is accountable for final decisions under
 [GOVERNANCE.md](GOVERNANCE.md). Being listed as code owner or maintainer does
 not make self-review independent.
 
+## Stabilization ownership
+
+Andri temporarily carries every internal category in the stabilization program.
+This records accountability; it does not claim equal expertise or independent
+review in every category.
+
+| Category | Current accountable person | Independence / limit |
+|---|---|---|
+| FND — founder and release accountability | Andri | Founder authority |
+| SEC — core security | Andri (interim) | Self-review is not independent security evidence |
+| NET — network and services | Andri (interim) | External operator/field evidence remains unassigned |
+| PROD — product and clients | Andri (interim) | External accessibility/field evidence remains unassigned |
+| REL — release engineering | Andri (interim) | External reproducibility/release evaluation remains unassigned |
+| COM — community and governance | Andri (interim) | No unconflicted backup steward currently exists |
+| LEG — legal and brand | Andri (project risk owner only) | Qualified trademark and licensing counsel is unassigned |
+| EXT — independent evidence | **Unassigned** | A named external person must accept each scoped assignment |
+
+The exact P0 assignments, evidence gaps, and next review dates are in the
+[release evidence ledger](docs/31-release-evidence-ledger.md). Independent
+cryptography review, interoperability implementation, field/accessibility
+evaluation, operator review, release verification, trademark advice, and backup
+stewardship remain unassigned until a real person accepts the documented scope.
+
 ## Contribution and review needs
 
 The project welcomes implementation help and qualified evidence in these areas.
@@ -35,13 +58,6 @@ An interested contributor should open a public issue describing the area,
 relevant experience, and work they would like to contribute. Security-sensitive
 background details may be sent privately using [SECURITY.md](SECURITY.md).
 
-## Implementation assistance
-
-The founder intentionally uses automated analysis and implementation tools.
-Those tools are not maintainers, reviewers, or independent evidence providers.
-Every accepted change remains attributable to and the responsibility of the
-human maintainer who approves it.
-
 ## Appointment and expectations
 
 Maintainers are appointed by the lead maintainer after a record of constructive

README.md

@@ -20,8 +20,8 @@ private keys belonging to Komms users.*
 
 Komms has a nonprofit public-benefit mission: private, resilient communication
 should be useful to ordinary people without surveillance or exclusive-provider
-lock-in. The project is founder-directed and intentionally uses automated
-implementation assistance; accountability remains with the human maintainer.
+lock-in. The project is founder-directed, and accountability remains with the
+human maintainer.
 
 **New here?** Read [Start Here](docs/00-start-here.md): the whole idea in plain
 words, with no cryptography knowledge required.
@@ -72,9 +72,10 @@ required. iOS currently remains source/Simulator-only.
 - **Clearer identity and discovery.** Safety numbers are 30 readable digits
   while QR verification retains the full 256-bit comparison. Desktop sharing,
   contact rename, DHT/mDNS status, and conversation rendering are hardened.
-- **Four-platform release evidence.** Android and iOS simulators plus local
-  macOS and Linux desktop previews now require explicit human visual approval.
-  Linux desktop launch smoke also runs in CI and in the release workflow.
+- **Four-platform preview evidence.** Android and iOS simulators plus local
+  macOS and Linux desktop previews now require explicit visual approval. Linux
+  desktop launch smoke also runs in CI and in the release workflow. This is not
+  physical-device or stable-platform qualification.
 - **A release-shaped self-hosted node.** The public `kultd` image is prepared
   for Linux amd64 and arm64 with provenance, an SBOM, and immutable `0.3.0`
   tagging.
@@ -95,7 +96,7 @@ independent interoperability.
 | **Applications and messaging** | Desktop, Android, and iOS shells expose pairwise/group text and a broad Alpha feature set, including attachments, local organization, linked devices, ephemeral content, polls, roles, and direct audio-call paths. CI and simulator evidence exist; hands-on device, background lifecycle, NAT, accessibility, and localization qualification remain. |
 | **Distribution** | Unsigned desktop packages and a debug-signed Android APK are published for Alpha testing; iOS is source/Simulator-only. Production signing, authenticated updates, reproducibility measurements, store distribution, upgrade/rollback qualification, and stable support are not configured. |
 | **Optional mobile convenience** | ADR-0017 through ADR-0019 propose reversible post-pairing rendezvous and content-free native wake. The layer is design-only: no optional service is implemented or required by the sovereign core. |
-| **Trust and governance** | The project is founder-directed by design during construction and stabilization under a nonprofit public-benefit mission. The founder retains product and release authority. Independent security and interoperability evidence is still missing; automated assistance is not presented as independent review. The [stabilization program](docs/29-stabilization-program.md) defines the evidence required before stable claims. |
+| **Trust and governance** | The project is founder-directed by design during construction and stabilization under a nonprofit public-benefit mission. The founder retains product and release authority. Independent security and interoperability evidence is still missing. The [stabilization program](docs/29-stabilization-program.md) defines the evidence required before stable claims. |
 
 Older `KKR1` through `KKR6` backups remain restorable; current backups are
 `KKR7`. KKR6 added signed group authority state and consumed admin-request ids.
@@ -111,7 +112,12 @@ gates, and the first 90 days. The [roadmap](docs/08-roadmap.md) remains the
 engineering inventory, the [feature delivery plan](docs/12-feature-delivery-plan.md)
 remains the product backlog, and the
 [local release gate](docs/24-local-release-gate.md) describes existing build
-checks.
+checks. The [stable-v1 product profile](docs/30-stable-v1-product-profile.md)
+freezes the release target, the
+[release evidence ledger](docs/31-release-evidence-ledger.md) records every P0
+gate and stable claim, and the
+[name-risk decision](docs/32-name-risk-decision.md) records the founder's
+keep-and-monitor decision without claiming legal clearance.
 
 Komms is built on four principles:
 
@@ -171,6 +177,9 @@ status of any particular proposal.
 | [27: Alpha Testing](docs/27-alpha-testing.md) | Download verification, installation, smoke testing, issue reporting, and self-hosted image quick start |
 | [28: Brand System](docs/28-brand-system.md) | Cross-shell product character, tokens, hierarchy, and pragmatic name-risk monitoring |
 | [29: Stabilization Program](docs/29-stabilization-program.md) | Canonical evidence vocabulary, trust gates, owners, and 90-day sequence |
+| [30: Stable-v1 Product Profile](docs/30-stable-v1-product-profile.md) | Frozen install, messaging, bounds, recovery, delivery, platform, service, and exclusion contract |
+| [31: Release Evidence Ledger](docs/31-release-evidence-ledger.md) | P0 and stable-claim owners, evidence, revisions, gaps, and review dates |
+| [32: Name-risk Decision](docs/32-name-risk-decision.md) | Dated keep-and-monitor decision, observed overlap, migration cost, cadence, and advice triggers |
 | [ADRs](docs/adr/README.md) | Decision index, status, and the alternatives each decision beat |
 
 ## Stack
@@ -179,8 +188,9 @@ Rust workspace (`kult-crypto` / `kult-protocol` / `kult-transport` / `kult-store
 `kult-node` / `kultd` / `kult-ffi`), UniFFI bindings, Tauri desktop app, native
 mobile shells.
 Layout in [Architecture §7](docs/03-architecture.md). Implemented so far:
-`kult-crypto` (hybrid PQXDH, Double Ratchet with encrypted headers, anonymous sealed
-boxes, sealed state, sender-key group chains), `kult-protocol` (envelopes, padding
+`kult-crypto` (hybrid PQXDH, Double Ratchet with encrypted headers,
+sender-anonymous sealed envelopes, sealed state, sender-key group chains),
+`kult-protocol` (envelopes, padding
 buckets, fragmentation + NACKs, delivery tokens, sealed group headers, `.kkb`
 bundles), and `kult-store` (encrypted SQLite, key
 hierarchy, persistent queue), `kult-transport` (the `Transport` contract, the

SECURITY.md

@@ -23,6 +23,40 @@ These are targets rather than a 24/7 support guarantee. If you receive no
 acknowledgment, resend with `[Komms security]` in the subject. There is currently
 no bounty program; do not incur expense in expectation of payment.
 
+## Incident handling
+
+The founder is the current security coordinator and incident decision owner.
+There is no 24/7 team or accepted backup security steward. That continuity gap
+is tracked in [MAINTAINERS.md](MAINTAINERS.md) and the
+[release evidence ledger](docs/31-release-evidence-ledger.md).
+
+For a confirmed vulnerability or operational incident, the coordinator:
+
+1. opens a private, access-limited incident record with discovery time, affected
+   revisions/services, reporter preference, known impact, and evidence custody;
+2. classifies urgency and decides containment without exposing report details
+   through public issues, logs, or ordinary diagnostics;
+3. identifies affected releases, protocol versions, operators, credentials, and
+   user actions, including whether signing, service, domain, or notification
+   channels remain trustworthy;
+4. prepares and validates the smallest safe correction, key/service rotation,
+   rollback, or disabling action, recording every deferred platform or external
+   dependency;
+5. coordinates disclosure with the reporter and publishes an advisory with
+   affected versions, impact, fixes, workarounds, credits, and residual risk;
+6. notifies known official operators and users through authenticated project
+   release/advisory channels when action is required; and
+7. publishes a post-incident process summary when doing so will not expose
+   reporters, users, credentials, or still-exploitable detail.
+
+The incident owner may make an emergency release or disable an official
+project-operated service within the authority in
+[GOVERNANCE.md](GOVERNANCE.md). Emergency action does not waive release
+evidence: missing checks and independent review remain explicit, and the
+evidence ledger records follow-up and closure. If the founder has a conflict,
+the project seeks an unconflicted external reviewer; none is currently assigned
+in advance.
+
 ## Ground rules
 
 - Coordinated disclosure: please allow the initial assessment window and agree

apps/android/README.md

@@ -12,7 +12,7 @@ own, verbatim.
   before each activity draws. Compliant screenshots, screen recordings, and
   recent-task previews are blocked. Settings show the shared B14 policy and its
   compromised-device, overlay/accessibility-abuse, and external-camera limits.
-- **Request private keyboard behavior on every text editor.** Every audited XML
+- **Request private keyboard behavior on every inventoried text editor.** Every covered XML
   and programmatic field uses `IncognitoEditText`, which sets Android's
   no-personalized-learning and no-suggestions metadata. Passphrases and recovery
   mnemonics are masked. Settings state honestly that third-party IMEs may ignore
@@ -81,13 +81,15 @@ own, verbatim.
   used. Generic files show and recheck F4 before explicit send/discard. JPEG/PNG
   selections use the shared Rust editor for orientation normalization,
   free/preset crop, 90-degree rotation, and user-positioned blur/pixelation, then
-  review and send only the exact metadata-free PNG. Originals, intermediates,
+  review and send only the exact PNG re-encoded without source metadata.
+  Originals, intermediates,
   and protected receiver previews are deleted on send, discard, denial, failure,
   activity stop/lock, low storage, and restart orphan recovery.
 - **Record pairwise or group audio messages** with runtime microphone consent,
   a foreground-only stop/review flow, no autoplay, locally derived
   duration/waveform, and explicit send/discard. Every native capture is rewritten
-  to the shared metadata-free mono 16-bit PCM WAV / 16 kHz / 60-second profile
+  to the shared source-metadata-omitting mono 16-bit PCM WAV / 16 kHz /
+  60-second profile
   and enters the existing F3 pipeline. Audio-focus loss, activity stop, lock,
   failure, discard, and restart remove plaintext cache files; completed clips are
   probed and exported only into short-lived app-private playback files. F4 is
@@ -141,7 +143,8 @@ own, verbatim.
   Native rows and pins render the sealed icon or generated initials; the manager
   offers all eight bundled glyphs, Android SAF JPEG/PNG selection, clear-to-
   fallback, and quota usage. Selected content is copied only into a short-lived
-  app-private file before the shared core emits a metadata-free 256×256 RGBA PNG.
+  app-private file before the shared core emits a 256×256 RGBA PNG re-encoded
+  without source metadata.
   The 512 KiB/1,024-record/64 MiB limits and corrupt fallback are shared with
   every shell; `KKR7` and authenticated own-device C2 sync are the only
   portability paths, and no icon creates network,
@@ -226,7 +229,8 @@ and Swift: exact vocabulary/roles, first-run System, idempotency, restart,
 preference cache carries no identity, message, contact, or network data.
 
 Custom-icon acceptance drives the shared B13 fixture through Rust RPC, UniFFI,
-Kotlin, and Swift: all four exact target types, canonical metadata-free output,
+Kotlin, and Swift: all four exact target types, canonical PNG output that omits
+source metadata,
 quota accounting, restart/`KKR7`, generated-initials fallback, local events, and
 zero delivery work. The Android manager uses SAF access only for the explicit
 selection and deletes its app-private transient after the blocking core call.