Reduce supported platform matrix

docs/development.md

@@ -58,7 +58,7 @@ in the [Release Procedure](release.md).
 
 Woodpecker also runs `go test -race -shuffle=on -count=3 ./...` on its scheduled
 job to expose ordering and repeatability defects. Current runners cross-compile
-for macOS and Windows, but do not provide native macOS or Windows execution.
-Those cross-builds establish compilation only, not platform-equivalent runtime
-evidence. Add native checks only when official runner labels and successful
+the supported Linux amd64 and arm64 targets and the best-effort macOS arm64
+target. The macOS cross-build establishes compilation only, not native runtime
+evidence. Add a native check only when an official runner label and successful
 native-run evidence are available.

docs/internal/adapters.md

@@ -78,11 +78,10 @@ in-memory backend without changing package state.
 - Subprocess adapters persist stage logs/generated configs through stage-managed paths.
 - Shared subprocess execution keeps private lifecycle mechanics separate from
   Narratio's environment, diagnostics, redaction, and error policy. It starts
-  an owned process group on Linux/macOS or a
-  kill-on-close job object on Windows. Every terminal path disposes of that
-  owned tree before returning. After a natural leader exit, Unix checks for
-  remaining group members and uses bounded graceful then forceful termination;
-  Windows closes the job so kill-on-close applies. Cancellation, deadlines, and
+  an owned process group on Linux and macOS. Every terminal path disposes of
+  that owned tree before returning. After a natural leader exit, the runner checks
+  for remaining group members and uses bounded graceful then forceful termination.
+  Cancellation, deadlines, and
   diagnostic limits use the same terminal disposal path without losing their
   original result classification. Child environments contain only the execution
   baseline and adapter-specified values; configured credentials are explicit

docs/operations.md

@@ -550,18 +550,11 @@ converge on `0664`. Narratio explicitly applies these modes so a restrictive
 caller umask does not remove group write or setgid. It does not change file or
 directory ownership: the configured workspace's existing group is inherited.
 
-Windows does not implement POSIX mode bits or setgid semantics. Configure the
-workspace, spool, and cache locations with an ACL that grants the collaborating
-group read/write access, and configure credential locations with an ACL limited
-to the intended credential owner. Do not use POSIX mode displays as evidence of
-Windows access control.
-
 API keys are credentials, not ordinary workspace data. Store them outside the
 shared workspace or in a separately restricted credential location; ordinary
 workspace group access must never be treated as authorization to read keys.
-On POSIX, provision a credential directory as `0700` and credential files as
-`0600`; Narratio rejects group- or other-readable configured credential paths.
-On Windows, restrict the directory and files with ACLs to the credential owner.
+Provision a credential directory as `0700` and credential files as `0600`;
+Narratio rejects group- or other-readable configured credential paths.
 
 External adapter results are individually bounded before Narratio validates or
 materializes them. These per-file limits do not reserve disk space: prevent hard

docs/policy/architecture.md

@@ -234,13 +234,16 @@ configuration, logs, reports, diagnostics, and Notarius artifacts—is
 intentionally shareable with the configured workspace group. API-key material
 is sensitive and is not covered by the ordinary workspace-sharing policy.
 
-On POSIX systems, Narratio-created ordinary workspace directories converge on
+Narratio supports Linux on amd64 and arm64. macOS arm64 is best effort: it has
+a cross-build gate and release asset, but no native runtime release gate.
+Windows and macOS amd64 are unsupported and have no compatibility promise or
+release asset.
+
+On supported systems, Narratio-created ordinary workspace directories converge on
 setgid `02775` and ordinary workspace files on `0664`, even when the caller's
 umask is restrictive. This preserves the existing workspace group for nested
 creation and atomic replacements without changing ownership. API-key storage
-uses a separate restrictive contract. On Windows, POSIX mode bits and setgid
-are not authoritative; operators must provide the equivalent shared-group and
-credential-restricted ACLs described in [Operations](../operations.md#workspace-permissions).
+uses a separate restrictive contract.
 
 Raw secrets must not be stored in pipeline, campaign, or session YAML or written
 to manifests, logs, generated configuration, reports, publish metadata,

docs/release.md

@@ -58,14 +58,14 @@ scripts/check-release-candidate.sh vMAJOR.MINOR.PATCH
 
 It validates the version and matching note, module hygiene, formatting,
 whitespace, uncached tests, race tests, static checks, documentation, examples,
-and six official cross-build assets. It uses `GOWORK=off`, does not contact
+and three official cross-build assets. It uses `GOWORK=off`, does not contact
 application services, CI, or Gitea, and does not create tags or modify tracked
 source. Fix any failure on `main`, commit it, push it normally, and rerun the
 checker.
 
-The checker builds Linux, macOS, and Windows assets for `amd64` and `arm64`.
-Cross-builds prove compilation; they are not native macOS or Windows runtime
-evidence.
+The checker builds Linux assets for `amd64` and `arm64` and a macOS asset for
+`arm64`. The macOS cross-build proves compilation; it is not native macOS
+runtime evidence.
 
 ## Publish the tag
 

docs/roadmap/implementation.md

@@ -89,7 +89,10 @@ make that scope concrete:
 
 ## Stage 1 — Reduce the platform and release matrix
 
-Status: Pending
+Status: Complete — Reduced CI and release output to Linux amd64/arm64 and macOS
+arm64, removed Windows-only runtime implementations and accommodations, and
+verified focused tests, all three cross-builds, exact asset names, and embedded
+version reporting.
 
 Read: roadmap “Platform Contract”; `scripts/build-release-assets.sh`,
 `scripts/check-release-candidate.sh`, `.woodpecker/`, `internal/releasecheck`,