[100%][META] Bao 1.0 readiness — domain closure board and non-negotiable completion gates

[putao520]

目标

这是 Bao 从当前 feature-complete alpha 向 100% 目标面 / production-ready stable runtime 收口的总控 Issue。

本 Issue 不重复实施细节。所有实际工作必须落在对应 Domain Issue；这里仅定义统一口径、依赖关系和最终放行门槛。

统一的“100%”定义

Bao 的 100% 不是：

• 所有上游源码一字不差复制；
• 所有 Node/Bun/Chrome/V8 能力强行伪实现；
• README 功能表全部打勾；
• 测试很多或当前全绿。

Bao 的 100% 是：

1. 目标能力面 100% inventory；
2. inventory 中每项必须分类为 Supported / Explicitly Unsupported / N/A，零未知、零静默漏项；
3. 所有 Supported 项有真实行为测试，覆盖成功、错误、生命周期、资源/并发边界；
4. 所有 Supported 测试 100% pass，skip/flaky/expected-failure 必须显式计数和裁决；
5. Unsupported/N/A 有稳定技术理由和用户可见行为，禁止 fake success / no-op / stub 伪装支持；
6. 测量结果绑定 Bao commit + upstream ref + 环境 + 日期，可自动重建；
7. production gate 不只看功能测试，还必须通过长期运行、资源回收、消费者构建和安全边界。

Domain Issues

• [100%][CDP] Close CDP compatibility to a measured, behavior-complete target #11 — CDP：协议 inventory、行为/事件/生命周期、Playwright/Puppeteer、bao compat cdp
• [100%][Node] Close Node.js compatibility with full inventory, conformance and error parity #12 — Node.js：完整 API inventory、逐模块 conformance、错误/异步 parity、bao compat node
• [100%][Bun] Close Bun API compatibility with full public-surface inventory and upstream behavior parity #13 — Bun：Bun public API inventory、Bun.* / bun:* conformance、bao compat bun
• [100%][Web] Close Bao↔Servo Web Platform integration with WPT-backed behavior and render parity #14 — Web / Servo integration：Bao 自身 WPT、WebSocket、navigation、render regression、bao compat web
• [100%][Runtime] Production-close Bao browser runtime lifecycle, realms, multi-page and embedding semantics #15 — Runtime：JSEngine/JSContext owner、Realm、multi-page、churn、shutdown、embedding lifecycle
• [100%][Stealth] Close browser-identity consistency across TLS, HTTP, JS-visible surfaces and page isolation #16 — Stealth / Identity：TLS/HTTP/JS-visible identity consistency、profile isolation、fingerprint snapshots
• [100%][API/CLI] Stabilize the public Rust embedding API and CLI behavior as a versioned contract #17 — Public API / CLI：Rust facade、配置/错误合同、CLI contract、SemVer/API stability gate
• [100%][Platform/Build] Close supported-target, native-dependency, consumer-build and release reproducibility #18 — Platform / Build / Release：supported targets、native deps、registry/git consumer、reproducible publish closure
• [100%][Performance/Soak] Establish reproducible performance baselines and production-grade long-running stability gates #19 — Performance / Soak：benchmark、100+ page、resource budgets、72h+ mixed soak、regression gates
• [100%][Security/Capability] Close realm isolation, host-capability boundaries and untrusted-code safety contracts #20 — Security / Capability：Realm isolation、host permissions、resource controls、audit/fail-closed boundaries

Cross-domain dependencies

Compatibility layer

#12 Node + #13 Bun + #14 Web + #11 CDP

四者回答“Bao 对外承诺的语言/浏览器/自动化协议到底完整到什么程度”。

Runtime layer

#15 Runtime + #20 Security + #16 Stealth

三者回答“这些能力放进同一个进程以后，生命周期、权限和身份是否仍然一致”。

Productization layer

#17 API/CLI + #18 Platform/Build + #19 Performance/Soak

三者回答“第三方是否能稳定依赖、构建、部署并长期运行”。

Stage gates

Gate A — Feature/compatibility complete

必须满足：

• [100%][CDP] Close CDP compatibility to a measured, behavior-complete target #11 [100%][Node] Close Node.js compatibility with full inventory, conformance and error parity #12 [100%][Bun] Close Bun API compatibility with full public-surface inventory and upstream behavior parity #13 [100%][Web] Close Bao↔Servo Web Platform integration with WPT-backed behavior and render parity #14 的目标 inventory 100% classified。
• 所有 Supported 项测试全绿。
• bao compat node|bun|web|cdp 均可自动生成版本绑定报告。
• 无未经解释的 TBD / “待确认” / Partial / Experimental 进入 stable promise。

Gate B — Runtime beta

必须满足：

• [100%][Runtime] Production-close Bao browser runtime lifecycle, realms, multi-page and embedding semantics #15 lifecycle/multi-page/resource gates 全绿。
• [100%][Security/Capability] Close realm isolation, host-capability boundaries and untrusted-code safety contracts #20 security boundary negative/stress tests 全绿。
• [100%][Stealth] Close browser-identity consistency across TLS, HTTP, JS-visible surfaces and page isolation #16 shipped identity profiles consistency matrix 全绿。
• 100+ page churn 无 crash/hang/stale realm/unexplained leak。

Gate C — Product beta

必须满足：

• [100%][API/CLI] Stabilize the public Rust embedding API and CLI behavior as a versioned contract #17 stable API set 已冻结并有 break-detection gate。
• [100%][Platform/Build] Close supported-target, native-dependency, consumer-build and release reproducibility #18 所有 Supported target 通过 clean consumer build/link/run。
• crates.io/git/source 消费路径可复现。
• [100%][Performance/Soak] Establish reproducible performance baselines and production-grade long-running stability gates #19 benchmark/report 已建立，24h soak 稳定。

Gate D — 1.0 candidate

必须满足：

• [100%][CDP] Close CDP compatibility to a measured, behavior-complete target #11–[100%][Security/Capability] Close realm isolation, host-capability boundaries and untrusted-code safety contracts #20 全部完成或所有残余项有明确 v1 scope exclusion 裁决。
• 72h+ production mixed soak 全绿。
• 已知 crash/hang/UAF/security-boundary violation = 0。
• public compatibility / performance / platform matrix 已发布且可重建。
• README / roadmap / changelog / docs 与实际能力一致。
• release candidate 从 clean consumer 环境完成独立验收。

Completion accounting

建议总控只使用两种数字，避免“85% 看起来差不多”的主观完成度：

1. Classification completeness

classified inventory items / total target inventory items

必须最终达到 100%。

2. Supported conformance

passed behavior checks / total behavior checks for Supported items

stable release 必须达到 100%；任何 skip/flaky 必须先转成明确裁决。

Unsupported/N/A 不能消失，单独作为数量和原因公开。

Global hard rules

• 不允许 stub/no-op/fixed return/fake success 计 Supported。
• 不允许为了通过率删测试、静默 skip 或把失败项移出分母。
• 不允许 Servo/Bun/Node upstream 测试结果直接冒充 Bao 自己结果。
• 不允许 cargo check 冒充 consumer build/link/run。
• 不允许短时测试冒充长期 soak。
• 不允许 Realm isolation 冒充完整 OS sandbox。
• 不允许单个 JA3/UA 命中冒充 Stealth 完整性。
• 不允许每日 upstream absorb 改变本 Issue 的完成定义；upstream 前移后应更新绑定 ref 并重新计算矩阵。

当前建议状态

在 #11–#20 收口前，Bao 保持 0.x alpha 是合理的。达到 Gate A + Gate B 后可考虑进入 compatibility/runtime Beta；达到 Gate C 后再进入 production Beta；只有 Gate D 通过才建议冻结并发布 v1.0 stable。

[putao520]

Add engine-leverage dependency: #22 SpiderMonkey-native evolution

Bao 1.0 Runtime layer should now treat #22 as an enabling program for #15/#16/#11/#19/#20, rather than as a separate compatibility domain.

#22 owns the SpiderMonkey-native evolution backlog and .plans/spidermonkey-evolution.md execution ledger. Child issues are #23–#30 (Realm topology, Interrupt/cancel, JobQueue, Stencil/XDR, Debugger/Memory, Realm policy, GC/Zone, upstream capability audit).

Recommended gate wiring:

• Gate B Runtime Beta: [SM-EVOLUTION][META] SpiderMonkey-native evolution program — plan ledger + scheduled-agent execution contract #22 P0 correctness/lifecycle slices ([SM-EVOLUTION][Realm] Map Realm/Compartment/Zone topology onto Bao page, host and worker lifecycles #23/[SM-EVOLUTION][Interrupt] Add engine-native timeout, cancellation and runaway-script interruption #24/[SM-EVOLUTION][JobQueue] Unify SpiderMonkey jobs, Bao event loop, Servo tasks and Node/Bun microtask semantics #25/[SM-EVOLUTION][GC] Close rooting, GC lifecycle, Zone reclamation and long-running memory ownership #29) must be closed or explicitly accepted by [100%][Runtime] Production-close Bao browser runtime lifecycle, realms, multi-page and embedding semantics #15/[100%][Security/Capability] Close realm isolation, host-capability boundaries and untrusted-code safety contracts #20 before Runtime Beta.
• Gate C Product Beta: retained [SM-EVOLUTION][Stencil] Build Stencil/XDR/off-thread compile script cache with multi-Realm instantiation #26/[SM-EVOLUTION][RealmPolicy] Use Realm-native locale/timezone/JIT/shared-memory policy for Stealth and runtime consistency #28 optimizations must have benchmark evidence accepted by [100%][Performance/Soak] Establish reproducible performance baselines and production-grade long-running stability gates #19; no theoretical-only optimization claims.
• Gate D 1.0: [SM-EVOLUTION][META] SpiderMonkey-native evolution program — plan ledger + scheduled-agent execution contract #22 must be closed or every remaining SM capability explicitly classified deliberately-unused/blocked with no hidden runtime/security dependency.

This does not change the existing 100% definition: SM-specific capabilities are an engine leverage layer used to make the existing domains more correct/complete, not a way to inflate compatibility percentages.

[putao520]

Added permanent engine/runtime evolution inputs

Bao 1.0 closure now also consumes two long-running upstream-evolution programs:

• [SM-EVOLUTION][META] SpiderMonkey-native evolution program — plan ledger + scheduled-agent execution contract #22 — SM-EVOLUTION: exploit SpiderMonkey-native Realm/GC/Interrupt/Stencil/Debugger capabilities instead of treating SM only as a JSC/V8 substitute.
• [BUN-EVOLUTION][META] Transpose Bun runtime engineering into an embeddable Bao library architecture #31 — BUN-EVOLUTION: transpose Bun runtime engineering into Bao's embeddable-library architecture.
  • [BUN-EVOLUTION][Threading] Eliminate inherited internal process architecture by transposing it to thread/runtime/channel ownership #32 is the first hard execution gate: eliminate inherited internal process/IPC/process-local assumptions by mapping them to BaoRuntime / thread / task / typed channel / TLS, while preserving true OS-process semantics for public Bun.spawn* / Node child_process APIs.

These programs feed #15 Runtime, #20 Security, #19 Performance/Soak, and related compatibility domains. Gate B/D should not be considered complete if unresolved internal executable/process assumptions remain undocumented or untransposed.