docs: freeze v1 scope and parity

[JeremyDev87]

What

• Synchronize the five README translations with the frozen v1 CLI/report contract.
• Document 0.3.7 as pre-v1, the v1 command boundary, scan --no-write, retained-quarantine clean --apply, and fail-closed non-Unix apply behavior.
• Mark HTML report, sweep, workspace/cache, and watch as explicit v1.1+ backlog.
• Align CONTRIBUTING, SECURITY, the planning index, roadmap plans, and v1 contract evidence with [v1 readiness][kratos] CLI/report contract freeze and schema evidence #91–[v1 readiness][kratos] Release provenance and workflow evidence bundle #94 and the release evidence gates.

Why

The repository had contradictory documentation: some roadmap text described deferred features as active, one planning snapshot still said 0.3.2, and translated READMEs lacked the current safety and release-evidence boundary. This PR makes the docs describe the same shipped/runtime contract without changing runtime behavior.

Included

• 5 README files
• CONTRIBUTING.md, SECURITY.md
• 5 docs/plans/* files plus docs/plans/README.md

Review remediation

• Added the exact scan --no-write signature and no-file-write option behavior to all five README command sections.
• Added the candidate/package/dist-tag evidence paragraph to Spanish, Japanese, and Simplified Chinese for five-language parity.
• Split pre-v1 0.x unsupported policy from the supported 1.x-after-v1 line in SECURITY.md.
• Focused docs-contract verifier moved from RED (9 mismatches) to PASS; full npm/Rust/clippy/release-evidence/no-write gates passed.

Boundaries

• Documentation-only; no runtime, workflow, package, or command-definition changes.
• TODO.md was not recreated because it is absent and the lane plan explicitly keeps it out of this slice.
• No version bump, tag, npm publish, GitHub Release, workflow dispatch, merge, or auto-merge.

Validation

• npm run verify — PASS; 9 passed, 1 environment-gated native smoke skipped
• cargo test --workspace — PASS
• cargo clippy --workspace --all-targets — PASS; existing warnings only
• cargo run -p kratos-cli -- scan ./fixtures/demo-app --no-write — PASS; no report file written
• README parity / post-v1 plan / stale-version verifier — PASS
• git diff --check and git diff --check origin/master — PASS

Live facts

• Base: master@697e191531d895a0266860cb0edd11fb4bc7a0ba
• Candidate head: 781d04ae56aba37fa7944ff525bc11e6ee8dbc28
• Issue [v1 readiness][kratos] Docs parity and v1 scope freeze #95 remains open and has docs label with JeremyDev87 assigned.

Closes #95

[JeremyDev87]

PR #100 current-head 문서 계약 리뷰에서 확인한 High blocker 3건입니다. 각 finding은 issue #95의 README parity·command example·security support 정합성 완료 기준에 직접 연결됩니다.

[JeremyDev87]

ddalggak review — approve

Verdict: approve
├─ PR: #100 @ 781d04a
├─ Blockers: Critical 0 / High 0 / Evidence gaps 0
├─ 핵심 이유: 13-file docs-only diff가 v1 command·release evidence·security support·post-v1 범위를 같은 SSoT로 정렬합니다.
└─ Next: ready 상태이며 formal human review와 수동 merge를 기다립니다.

검증 근거 / Checks

• full head: 781d04ae56aba37fa7944ff525bc11e6ee8dbc28
• base: master@697e191531d895a0266860cb0edd11fb4bc7a0ba
• current-head CI run 29600140861: 10/10 성공
• 독립 review worktree /tmp/kratos-pr100-review에서 전체 13-file diff 재검토
• focused docs-contract verifier: PASS (초기 RED 9 mismatches → GREEN)
• 5개 README command signature/release marker parity: PASS
• node --test test/release-evidence.test.js: 6/6 PASS
• npm run verify: PASS
• cargo test --workspace: PASS
• cargo clippy --workspace --all-targets: PASS (기존 warning만)
• temp-fixture scan --no-write: PASS, report 파일 미생성
• git diff --check base...head: PASS

Findings 상세

• 기존 High 1: 5개 README scan signature/option의 --no-write 누락 — 781d04a에서 수정, thread resolved.
• 기존 High 2: es/ja/zh release-evidence parity 누락 — candidate/package/dist-tag 계약을 추가해 수정, thread resolved.
• 기존 High 3: SECURITY의 pre-v1 unsupported vs Latest release supported 모순 — 미래 1.x와 현재 0.x를 분리해 수정, thread resolved.
• current-head 전체 재검토 결과 신규 Critical/High 및 Evidence gap 없음.

Gate / Wiki / Scope 상세

• issue [v1 readiness][kratos] Docs parity and v1 scope freeze #95 acceptance: README 5개, CONTRIBUTING, SECURITY, planning docs의 v1 freeze/post-v1 분리를 충족합니다.
• runtime scan.rs::SPEC의 [--no-write] 및 no-file-write 분기와 문서 signature가 일치합니다.
• 변경은 Markdown 13개뿐이며 runtime/workflow/package/version/release scope expansion이 없습니다.
• Security posture workflow sub-gates: workflow 변경이 없어 N/A; SECURITY 지원 정책 consistency는 PASS.
• Wiki: SSoT·Consistency·No Silent Fallback lens 적용. [wiki: domains/principles/alex-core-invariants.md]
• frontend/React/Vercel gates: CLI docs-only 변경이라 N/A.
• GitHub self-review는 formal approval로 인정되지 않으며 merge/auto-merge는 수행하지 않습니다.

[JeremyDev87]

ddalggak review — approve

Verdict: approve
├─ PR: #100 @ 781d04a
├─ Blockers: Critical 0 / High 0 / Evidence gaps 0
├─ 핵심 이유: docs-only #95 범위에서 v1 동결·5-README parity·SECURITY 모순 해소가 current head에서 재확인됨
└─ Next: 주인님 수동 formal review/merge. merge/auto-merge·version/tag/publish는 수행하지 않음

검증 근거 / Checks

• PR: docs: freeze v1 scope and parity #100
• Exact head: 781d04ae56aba37fa7944ff525bc11e6ee8dbc28
• Base: master@697e191531d895a0266860cb0edd11fb4bc7a0ba (merge-base == origin/master, textual merge conflict markers none)
• Draft: false (Ready for review)
• GitHub formal: reviewDecision=REVIEW_REQUIRED, mergeStateStatus=BLOCKED (self-review/branch-protection 한계; 이 코멘트는 agent independent review 증거)
• Current-head checks: 10/10 SUCCESS
  • Verify Node 18/20/22/24
  • Rust Workspace (stable)
  • Native Packaging ×5 (incl. Windows)
• Prior review threads: 3/3 resolved (scan signature, es/ja/zh release-evidence parity, SECURITY pre-v1 contradiction)
• Local independent verification on exact head:
  • npm run verify exit 0 (9 passed / 1 env-gated native smoke skipped)
  • node --test test/release-evidence.test.js 6/6 PASS
  • cargo test --workspace exit 0
  • cargo clippy --workspace --all-targets exit 0 (pre-existing dead_code warnings only)
  • git diff --check origin/master...HEAD exit 0
  • CLI smoke: cargo run -p kratos-cli -- scan ./fixtures/demo-app --no-write exit 0, stdout contains “리포트 저장: --no-write 때문에 파일을 생성하지 않았습니다.”, no .kratos/ created
  • Docs parity verifier: 5 README signatures include [--no-write], ≥2 --no-write mentions, 0.3.7 + post-v1 deferral + release-evidence tokens; SECURITY no longer has Latest release | Yes; Pre-v1 0.x = No; 1.x after v1.0 ships = Yes
  • Diff scope: 13 files, all .md, no runtime/workflow/package mutation; TODO.md not recreated; no stale 0.3.2 in changed files; package.json remains 0.3.7 (inspect-only)

Findings 상세

Critical / High / Evidence gaps

• none

Substantive non-CI observations (current head)

1. Issue [v1 readiness][kratos] Docs parity and v1 scope freeze #95 acceptance coverage

   • Owned surfaces only: README×5, CONTRIBUTING, SECURITY, docs/plans/** — matches issue owned files.
   • Inspect-only respected: no package.json / workflow / crates/** edits in the PR diff.
   • v1 freeze is explicit: scan/report/diff/clean, schema v3, scan --no-write, retained quarantine apply; HTML/sweep/workspace/cache/watch marked v1.1+ in README and plan docs.
   • Deferred WOW plans (03/04/05) get Post-v1 banners; docs/plans/README.md baseline version corrected 0.3.2 → 0.3.7; v1-cli-report-contract.md links [v1 readiness][kratos] CLI/report contract freeze and schema evidence #91–[v1 readiness][kratos] Release provenance and workflow evidence bundle #94.

2. Changed-code correctness (docs ↔ runtime contract)

   • Runtime already implements --no-write (crates/kratos-cli/src/commands/scan.rs, option parse in mod.rs, conflict with --output, cli_smoke tests). Docs now match the real CLI usage string and option semantics across all five languages after remediation commit 781d04a.
   • Live smoke on this head proves no report file creation under default path.
   • SECURITY now consistently treats published 0.3.7 as pre-v1 unsupported while keeping master + future 1.x support; the prior Latest release | Yes contradiction is gone.
   • CONTRIBUTING adds fail-closed release evidence expectations (candidate SHA/manifest, packed consumer smoke, post-publish dist-tag/Release) without inventing green registry fallbacks.

3. Regression / edge risk

   • Docs-only PR: residual risk is translation drift or policy wording, not runtime regression. Five-language parity scan + no-write smoke mitigate the previous High gaps.
   • TODO.md listed as owned in the issue but absent on master; correctly not recreated (avoids inventing a second SSoT).

4. Scope expansion

   • Zero non-doc files. No version bump/tag/publish/dispatch. No deferred feature implementation.

5. Test/evidence adequacy

   • Issue required git diff --check, verify when examples are test-backed, and feasible command smoke: all present for this head.
   • Missing formal human approval is a branch-protection/process gap, not a code/docs evidence gap.

Low / nit (non-blocking)

• none material enough for inline threads.

Gate / Wiki / Scope 상세

Quality Lens Router Output

• Applicable:
  • evidence-contract: v1 readiness/docs claims need CLI/docs/CI proof
  • simplicity-deletability: docs-only freeze; no new abstraction/runtime
  • security-posture (docs-only lens): SECURITY support-matrix consistency only; no workflow mutation
• Skipped:
  • frontend-design / react-* / vercel-* / web-design-a11y: docs/CLI only
  • deploy-token-safety: no token/deploy mutation
  • tdd-systematic-debugging: no bugfix code path in this PR
  • regression-library: no new repeated Medium/High class beyond already-fixed docs parity issues

Evidence Contract

• Required: current-head CI green; docs↔runtime --no-write parity; version/support matrix consistency; docs-only scope — present
• Not applicable: browser/DOM screenshots; production URL; package publish proof (explicit out of scope)
• Blocking gaps: none

Wiki Context Manifest

• Queries attempted: alex core invariants SSoT No Silent Fallback; docs parity v1 scope freeze evidence
• Wiki sources read: [wiki: domains/principles/alex-core-invariants.md] (canonical, active)
• Relevant facts: SSoT, Consistency, No Silent Fallback, Doc-first — support multi-README parity and explicit unsupported/deferred boundaries without silent “latest release is supported” fallbacks
• Constraints: repo-specific kratos docs authority remains live issue [v1 readiness][kratos] Docs parity and v1 scope freeze #95 + source/runtime, not wiki
• Unknowns not found in wiki: no repo-specific kratos v1 docs-parity canonical page
• Non-wiki inference: issue body + exact PR diff + local CLI smoke + GitHub checks
• Brain v0 authority sources read: alex-core-invariants domain page
• Raw/imported/alias seen but not used as authority: raw/2026-05-20-alex-core-invariants*.md, index/log hits
• Redirect aliases followed: none required
• Split index: unavailable/not required for this docs review
• Authority conflicts/evidence gaps: none material for approve

Manual merge boundary

• Do not merge/auto-merge from agent
• Do not version bump / tag / npm publish / release dispatch
• Formal GitHub approval still requires non-author human reviewer under branch protection