build(deps): bump actions/upload-pages-artifact from 3.0.1 to 5.0.0

.github/dependabot.yml

@@ -0,0 +1,20 @@
+version: 2
+
+updates:
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: pip
+    directory: /python
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -8,16 +8,19 @@ on:
 env:
   CARGO_TERM_COLOR: always
 
+permissions:
+  contents: read
+
 jobs:
   rust:
     name: Rust tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
         with:
           components: rustfmt, clippy
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
       - name: Format
         run: cargo fmt --all -- --check
       - name: Clippy
@@ -45,37 +48,40 @@ jobs:
     name: Comparison adapters
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           # Separate key prefix so this job does not thrash the default-feature
           # rust-job cache with OSQP/Clarabel native build artifacts.
           prefix-key: adapters-v1
       - name: Adapter tests (OSQP + Clarabel)
         run: cargo test -p ledge-bench-adapters --features osqp,clarabel
 
-  # Builds the mdBook docs site and uploads it as an artifact. Public
-  # GitHub Pages deployment is deliberately not wired up: it waits on the
-  # public-release gate (roadmap 1.6) because Pages would expose the site.
+  # Builds the mdBook docs site and uploads it as an artifact. Public Pages
+  # deployment remains an explicit action in docs-deploy.yml.
   docs:
     name: Docs site (build only)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Install mdBook
         run: |
           mkdir -p "$HOME/.local/bin"
-          curl -sSL https://github.com/rust-lang/mdBook/releases/download/v0.4.52/mdbook-v0.4.52-x86_64-unknown-linux-gnu.tar.gz \
-            | tar xz -C "$HOME/.local/bin"
+          archive="$RUNNER_TEMP/mdbook-v0.4.52-x86_64-unknown-linux-gnu.tar.gz"
+          curl --fail --silent --show-error --location --output "$archive" \
+            https://github.com/rust-lang/mdBook/releases/download/v0.4.52/mdbook-v0.4.52-x86_64-unknown-linux-gnu.tar.gz
+          echo "c0b903f01dd8f4edc644372ad2b80b1fdddd12552d37b6a098657cbd8eddd768  $archive" \
+            | sha256sum --check
+          tar xzf "$archive" -C "$HOME/.local/bin"
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
       - name: Build book
         run: |
           ./scripts/check_open_core.sh
           python scripts/generate_demo_assets.py --check
           mdbook build docs/book
       - name: Upload site artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: docs-site
           path: docs/book/book
@@ -85,12 +91,12 @@ jobs:
     name: Python binding
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.12"
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
       - name: Install package
         run: |
           python -m pip install --upgrade pip maturin

.github/workflows/docs-deploy.yml

@@ -1,9 +1,8 @@
 # Deploys the mdBook docs site to GitHub Pages.
 #
-# DELIBERATELY manual-only (workflow_dispatch): GitHub Pages makes the site
-# public. Keep this manual until the clean-root public repository exists
-# (roadmap 1.6); after its first verified deployment, either continue manual
-# releases or add a `push: branches: [main]` trigger.
+# DELIBERATELY manual-only (workflow_dispatch) so documentation deployments
+# remain explicit. Add a `push: branches: [main]` trigger if continuous
+# deployment becomes preferable.
 #
 # Prerequisite: repository Settings -> Pages -> Source = "GitHub Actions".
 name: Deploy docs
@@ -27,19 +26,23 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Install mdBook
         run: |
           mkdir -p "$HOME/.local/bin"
-          curl -sSL https://github.com/rust-lang/mdBook/releases/download/v0.4.52/mdbook-v0.4.52-x86_64-unknown-linux-gnu.tar.gz \
-            | tar xz -C "$HOME/.local/bin"
+          archive="$RUNNER_TEMP/mdbook-v0.4.52-x86_64-unknown-linux-gnu.tar.gz"
+          curl --fail --silent --show-error --location --output "$archive" \
+            https://github.com/rust-lang/mdBook/releases/download/v0.4.52/mdbook-v0.4.52-x86_64-unknown-linux-gnu.tar.gz
+          echo "c0b903f01dd8f4edc644372ad2b80b1fdddd12552d37b6a098657cbd8eddd768  $archive" \
+            | sha256sum --check
+          tar xzf "$archive" -C "$HOME/.local/bin"
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
       - name: Build book
         run: mdbook build docs/book
       - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: docs/book/book
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4

.github/workflows/release.yml

@@ -24,17 +24,19 @@ jobs:
     name: Strict release preflight
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Check version and open-core gate
         shell: bash
+        env:
+          RELEASE_TAG: ${{ inputs.tag }}
         run: |
           version="$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | sed -n '1p')"
-          test "${{ inputs.tag }}" = "v${version}" || {
-            echo "::error::input tag ${{ inputs.tag }} does not match Cargo version v${version}"
+          test "$RELEASE_TAG" = "v${version}" || {
+            echo "::error::input tag $RELEASE_TAG does not match Cargo version v${version}"
             exit 1
           }
-          test "$GITHUB_REF" = "refs/tags/${{ inputs.tag }}" || {
-            echo "::error::select tag ${{ inputs.tag }} as the workflow ref (got $GITHUB_REF)"
+          test "$GITHUB_REF" = "refs/tags/$RELEASE_TAG" || {
+            echo "::error::select tag $RELEASE_TAG as the workflow ref (got $GITHUB_REF)"
             exit 1
           }
           test "$(sed -n 's/^version = "\(.*\)"/\1/p' python/pyproject.toml | sed -n '1p')" = "$version"
@@ -65,20 +67,20 @@ jobs:
             manylinux: "off"
     runs-on: ${{ matrix.runner }}
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           # pyo3 abi3-py39: one wheel supports CPython 3.9 and newer.
           python-version: "3.9"
       - name: Build wheel
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1
         with:
           working-directory: python
           target: ${{ matrix.target }}
           manylinux: ${{ matrix.manylinux }}
           args: --release --locked --out dist
       - name: Upload wheel
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: python-wheel-${{ matrix.platform }}
           path: python/dist/*.whl
@@ -89,17 +91,17 @@ jobs:
     needs: preflight
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Build sdist
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1
         with:
           working-directory: python
           command: sdist
           # `maturin sdist` does not accept Cargo's `--locked` flag. The
           # workspace Cargo.lock is included and wheel builds are locked.
           args: --out dist
       - name: Upload sdist
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: python-sdist
           path: python/dist/*.tar.gz
@@ -117,10 +119,10 @@ jobs:
       id-token: write
     steps:
       - name: Download distributions
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           pattern: python-*
           path: dist
           merge-multiple: true
       - name: Publish with PyPI Trusted Publishing
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # release/v1

.gitleaks.toml

@@ -0,0 +1,8 @@
+[extend]
+useDefault = true
+
+[[allowlists]]
+description = "Historical roadmap wording is not an API credential"
+regexTarget = "match"
+paths = ['''docs/PLAN\.md''']
+regexes = ['''API review, semver/MSRV/deprecation policy''']

CHANGELOG.md

@@ -4,11 +4,30 @@ All notable changes to Ledge are documented here. The project follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and intends to use
 [Semantic Versioning](https://semver.org/) once the public API stabilizes.
 
-Tagged GitHub releases will be created when publishing artifacts; until then,
-version links below point at the repository history.
+Version links below point to the corresponding GitHub tags or comparisons.
 
 ## [Unreleased]
 
+### Fixed
+
+- Replaced unsupported operator-name math macros with GitHub/KaTeX-compatible
+  roman notation across the README and mathematical documentation.
+- Updated package, documentation-site, and roadmap copy to reflect the
+  published `0.2.0` artifacts.
+
+### Security
+
+- Pinned third-party GitHub Actions to immutable commits, restricted default
+  workflow permissions to read-only, verified the downloaded mdBook archive,
+  and moved workflow-dispatch input handling out of interpolated shell source.
+- Added Dependabot coverage for Cargo, Python, and GitHub Actions plus a
+  repository security-audit report.
+
+### Documentation
+
+- Reworked the README quick start, navigation, feature overview, documentation
+  map, Rust example, platform guidance, and current roadmap.
+
 ## [0.2.0] - 2026-07-22
 
 ### Fixed
@@ -335,19 +354,14 @@ version links below point at the repository history.
   `max(primal_tolerance, dual_tolerance)`.
 - Convergence hints for badly scaled data now point at the
   `scaling_iterations` setting instead of announcing planned equilibration.
-- Made the GitHub repository private and switched from Apache-2.0 to a
-  proprietary license (`LicenseRef-Proprietary`). Crates are marked
-  `publish = false`.
-
 ### Documentation
 
 - Recorded the measured vector-ρ re-evaluation in `docs/DECISIONS.md`
   (2026-07-22): no static per-block penalty factor wins across the smoke
   matrix, so vector ρ stays deferred with an explicit reopening condition;
   roadmap 1.5 is closed for M2.
 - Added `docs/PLAN.md` — vertical product plan (niche, expectations, stack,
-  open-core vs paid boundary, commercialization gates). Notes current
-  proprietary status and the M1 public-release gate.
+  open-core boundary, and technical acceptance gates).
 - Rewrote `docs/ROADMAP.md` as executable milestones M0–M4 with exit criteria
   and technical notes (scaling, certificates, L1 prox, workspace).
 - Added `docs/DECISIONS.md` ADR log for plan adoption.
@@ -360,7 +374,6 @@ version links below point at the repository history.
 - Removed pre-publish checklist docs; kept product roadmap and algorithm notes.
 - Clarified scope and non-goals without historical repository-name framing.
 - Added `SECURITY.md`, `docs/SMOKE_TIMINGS.md`, README diagrams, and CI.
-- Renamed GitHub repository from `mip-solver-lab` to `ledge`; updated URLs.
 
 ## [0.1.0] - 2026-07-14