chore: mark v1.2.0 TODOs complete, expand version-bump agent workflow with full did:web architecture docs

Author: Corey B

TODO.md

@@ -6,7 +6,8 @@ This list outlines the remaining steps to transition the OpenFDD project from a
 - [x] **Zero-Trust Embed Scrubbing**: `<script>`, `<iframe>`, `<object>` blocked in both parsers.
 - [x] **Compiler Security Rejection**: `fdd-pack` fatally rejects templates containing hostile embedding vectors.
 - [x] **v1.2.0 did:web Identity**: `identity.js`, `signFdd()`, `parse()`, `verify()`, client `resolveIssuer()` + `verifySignature()`.
-- [ ] **Publish v1.2.0**: Run `npm publish --access=public` in `lib/node-fdd/`, then `git tag v1.2.0 && git push origin v1.2.0`.
+- [x] **Published v1.2.0**: `@coreyburns/node-fdd@1.2.0` live on NPM. Git tag `v1.2.0` pushed.
+- [x] **Docs Updated**: `README.md`, `site/index.html`, and `spec/SPEC.md` all reflect v1.2.0 did:web workflow and CDN tag.
 - [ ] **Security Audit**: Test Zero-Trust regex against obfuscated `<scr+ipt>` payloads.
 
 ## 📦 Distribution & Tooling
@@ -18,8 +19,8 @@ This list outlines the remaining steps to transition the OpenFDD project from a
 - [x] **Medical Example**: `examples/medical_lab_result.fdd` — signed lab results with editable physician notes.
 - [x] **Legal Example**: `examples/legal_contract.fdd` — consulting agreement with client signature binding.
 - [x] **Finance Example**: `examples/bank_statement_v2.fdd` — bank statement with transaction table.
+- [x] **Update SPEC.md**: Complete rewrite to v1.2 covering did:web lifecycle, trust badge, Zero-Trust policy.
 - [ ] **Developer Sandbox**: Live Builder on GitHub Pages for in-browser `.fdd` generation.
-- [ ] **Update SPEC.md**: Document the `did:web` workflow, `signFdd()` API, and trust badge behavior.
 
 ## 📣 Community & Growth
 - [ ] **Social Launch**: Execute sharing block in README (X, LinkedIn, Reddit, YouTube).

_agents/workflows/version-bump.md

@@ -4,21 +4,102 @@ description: OpenFDD System Version Bumping Workflow
 
 # Updating OpenFDD Versions
 
-As an Agent maintaining the pristine layout of the OpenFDD project, any time we deploy a major logic upgrade that necessitates an `npm publish` or a native `git tag` push affecting CDN endpoints, you MUST execute the following cascade in order to prevent fractured dependency versions:
+When deploying a new version of the OpenFDD ecosystem, follow this full cascade in order. Do NOT skip steps — fractured versions between CDN, npm, and git tags will break users pinning to specific releases.
 
-1. **Update `lib/node-fdd/package.json`**:
-   Ensure `version` is properly bumped matching SEMVER standards (e.g. `"1.2.0"`).
+## Required Files to Update per Release
 
-2. **Update the Global `jsDelivr` CDN Maps**:
-   Cross-reference `site/index.html` and `README.md`. You must parse for `cdn.jsdelivr.net/gh/Spuds0588/open-fdd@v[VERSION]` and rigidly adjust that embedded marker in the code so all public instructions route to your brand new release.
+| File | What to change |
+|---|---|
+| `lib/node-fdd/package.json` | Bump `version` field |
+| `lib/node-fdd/README.md` | Update any CLI usage or API examples if commands changed |
+| `README.md` | Update CDN `@v[VERSION]` tag in the `<script>` snippet |
+| `site/index.html` | Update CDN `@v[VERSION]` tag in the tooling section |
+| `spec/SPEC.md` | Update version number in the title (e.g. `Specification v1.2`) |
+| `TODO.md` | Mark completed items; add new items for work in progress |
+| `_agents/workflows/version-bump.md` | Update if new CLi commands or modules were added |
 
-3. **Verify the NPM Scoped Install Commands**:
-   Ensure all install code blocks accurately suggest `npm install -g @coreyburns/node-fdd` globally.
+## Step-by-Step Release Cascade
 
-4. **Verify The Executables**:
-   If CLI logic logic shifts, ensure `package.json` > `bin` explicitly maps `fdd-pack` and `fdd-sign` pipelines accurately. 
+### 1. Bump `lib/node-fdd/package.json`
+Set `version` to the new SEMVER (e.g. `"1.3.0"`). Verify `engines.node` is still `">=18.0.0"`.
 
-5. **Commit, Tag, and Publish**:
-   - `git add . && git commit -m "chore: bump ecosystem verions"`
-   - Prompt the explicit User to invoke `npm publish --access=public` inside `/lib/node-fdd`.
-   - Prompt the User to issue an official git tag mirroring the release boundary via `git tag v1.x.x` and pushing `git push origin v1.x.x` to force native CDN hydration.
+### 2. Verify All CLI Executables in `package.json > bin`
+Current expected binaries:
+```json
+{
+  "fdd-pack": "./src/pack.js",
+  "fdd-sign": "./src/sign.js",
+  "fdd-identity": "./src/identity.js"
+}
+```
+If new CLI tools were added, register them here.
+
+### 3. Verify `package.json > exports` Subpath Map
+Current expected exports:
+```json
+{
+  ".":          "./src/sign.js",
+  "./identity": "./src/identity.js",
+  "./pack":     "./src/pack.js"
+}
+```
+Add new subpath exports if new modules were introduced.
+
+### 4. Update the Global jsDelivr CDN Tag
+Search `README.md` and `site/index.html` for the string:
+```
+cdn.jsdelivr.net/gh/Spuds0588/open-fdd@v
+```
+Replace the version at the end with the new release tag (e.g. `@v1.3.0`).
+
+### 5. Update SPEC.md Version Number
+Update the `# The Formatted Data Document (.fdd) Specification v[X.Y]` heading.
+
+### 6. Commit & Push
+```bash
+git add -A
+git commit -m "chore: release vX.Y.Z — [short summary of changes]"
+git push
+```
+
+### 7. Prompt User to Publish to NPM
+The user must run this from inside `lib/node-fdd/`:
+```bash
+npm login    # Only needed if session has expired
+npm publish --access=public
+```
+
+### 8. Tag the Git Release
+This is required for jsDelivr to serve the new CDN version:
+```bash
+git tag vX.Y.Z
+git push origin vX.Y.Z
+```
+
+## Architecture Overview (for context)
+
+The OpenFDD ecosystem has three library layers:
+
+| Layer | Path | Purpose |
+|---|---|---|
+| `node-fdd` (server) | `lib/node-fdd/` | Identity gen, pack, sign, parse, verify — for Node 18+ issuers |
+| `fdd-js` (client) | `lib/fdd-js/` | Browser rendering, did:web resolution, trust badge, auto-save |
+| `extension` (viewer) | `extension/` | Chrome extension for local `.fdd` file viewing + Security Shield |
+
+### Key Modules (node-fdd)
+- **`src/identity.js`** — `generateIdentity()`, `createDidDocument()`. CLI: `fdd-identity`
+- **`src/sign.js`** — `signFdd()`, `parse()`, `verify()`. CLI: `fdd-sign`
+- **`src/pack.js`** — Legacy unsigned packing. CLI: `fdd-pack`
+
+### Key Methods (fdd-js `OpenFDDContainer`)
+- **`resolveIssuer(uri)`** — Resolves `did:web:domain` → fetches `/.well-known/did.json` → imports `CryptoKey`
+- **`verifySignature()`** — Web Crypto API Ed25519 verify. Runs non-blocking after render.
+- **`showTrustBadge(state, issuer)`** — States: `checking`, `valid`, `invalid`, `unresolved`
+- All Declarative Action Framework methods (`fdd-push`, `fdd-delete`, `fdd-set`, `fdd-match`, `set-ui`, etc.)
+
+### Signature Payload Convention
+To keep server (`sign.js`) and client (`fdd.js`) in sync, the signed payload MUST always be:
+```
+JSON.stringify(vcWithoutProof) + '\n---template---\n' + templateInnerHTML
+```
+If this convention ever changes, both `src/sign.js` and `lib/fdd-js/src/fdd.js` MUST be updated together.