diff --git a/docs/public-release-readiness.md b/docs/public-release-readiness.md new file mode 100644 index 0000000..b6fca2c --- /dev/null +++ b/docs/public-release-readiness.md @@ -0,0 +1,49 @@ +# Relay public release readiness + +This document defines how Relay can become easier to use, more measurable, and more discoverable while preserving its conservative scope. + +## Positioning + +Relay should be described as an offline source-review assistant for timing, retry, blocking, loop, and network-risk patterns in control-oriented code. It should not imply compiler-grade semantic understanding across every supported language. + +## Release blockers + +- Publish a labelled real-world evaluation corpus with per-rule true positives, false positives, false negatives, abstentions, precision, and recall. +- Separate consequence severity, detection confidence, reachability confidence, and parser capability in every finding. +- Replace recursive cycle discovery with a strongly connected components algorithm. +- Narrow stable support claims to languages with measured quality; label other parsers experimental. +- Add optional Clang-enriched C/C++ resolution and preserve a safe no-tool fallback. + +## Usability improvements + +- Add `relay init` to generate a reviewed configuration with language and risk presets. +- Add `relay doctor` to detect project languages, ignored paths, parser capability, compile metadata, and unsupported constructs. +- Add `relay explain ` and `relay explain ` with evidence, assumptions, uncertainty, remediation, and examples. +- Add auditable inline suppression directives requiring reasons. +- Add SARIF output for GitHub code scanning and standard editor integrations. +- Add baseline mode so teams can fail only on new findings. +- Add `--changed-since`, staged-file, and pull-request diff analysis. +- Add confidence thresholds and explicit abstention summaries. + +## Documentation site + +Publish versioned pages for quickstart, supported languages, parser capability matrix, rules, evidence and confidence model, configuration, suppression, CI integration, SARIF, security model, limitations, evaluation methodology, and worked Arduino, ESP32, MicroPython, and backend examples. + +## Discoverability + +Expand accurate search terms to include `embedded static analysis`, `arduino lint`, `esp32 code review`, `timing risk`, `blocking call detection`, `retry analysis`, `micropython lint`, and `control software review`. Add repository topics, Open Graph artwork, rule pages that answer common search queries, and reciprocal links among GitHub, docs, PyPI, and releases. + +## Publication targets + +- PyPI for `relay-lint` using trusted publishing. +- GitHub Releases with wheel, sdist, checksums, SBOM, signatures, schemas, and evaluation reports. +- GitHub Marketplace only after SARIF output and measured detector quality are stable. +- Read the Docs or GitHub Pages for versioned documentation. + +## Release automation + +A tag release should run all Python versions, corpus evaluation, precision/recall thresholds, schema validation, clean-wheel tests, reproducible builds, SARIF fixtures, security tests for hostile source trees, checksums, SBOM generation, signatures, and documentation validation. + +## Success criteria + +A new user should be able to install Relay, scan a project, understand which languages were parsed semantically or structurally, inspect confidence and exact evidence, suppress intentional findings with reasons, establish a baseline, and integrate results into CI without treating heuristic output as compiler truth. \ No newline at end of file