docs: add Marketplace status and release verification

MANIFEST.md

@@ -1,6 +1,6 @@
 # Published files declaration — transitrix.github.io
 
-**Last updated:** 2026-09-17
+**Last updated:** 2026-10-14
 
 This file declares the published artefacts served by transitrix.github.io (the transitrix.com website). A file served to a reader is listed below. Internal machinery, source files, and build artifacts are not published and are not listed.
 
@@ -30,6 +30,7 @@ This file declares the published artefacts served by transitrix.github.io (the t
 - `learn/index.html` — Learning hub
 - `library/index.html` — Library page
 - `library/archimate-cheat-sheet/index.html` — ArchiMate cheat sheet HTML
+- `marketplace-status/index.html` — Marketplace status and release verification
 - `methodology/index.html` — Methodology page
 - `quickstart/index.html` — Quickstart page
 - `recipes/index.html` — Recipes page

install/index.html

@@ -68,6 +68,7 @@ <h2 id="install-heading">1. Install Studio</h2>
       <p>In Cursor, VSCodium and Windsurf you can also just search <em>Transitrix Studio</em> in the Extensions panel — they read Open VSX.</p>
       <p><strong>On stock VS Code, take the file instead.</strong> Microsoft's build reads only its own marketplace, so an Extensions search will not find Studio there. Download the <code>.vsix</code> from <a href="/install/go/openvsx/">the Open VSX listing</a>, then use <em>Extensions &rarr; &hellip; &rarr; Install from VSIX&hellip;</em>, or run <code>code --install-extension transitrix-studio-*.vsix</code>. Same build, same version.</p>
       <p>Sequence, state and ER/class diagrams render natively via PlantUML — no extra extension needed. For lighter, quicker views, add <a href="https://marketplace.visualstudio.com/items?itemName=bierner.markdown-mermaid">Markdown Preview Mermaid Support</a> alongside it — same plain-text model, no lock-in.</p>
+      <p><a href="../marketplace-status/">Marketplace status and release verification</a> — review the evidence and its scope before installing.</p>
       <h3 id="obsidian-install">Obsidian Desktop — manual installation</h3>
       <p>Transitrix Studio 0.1.0 previews self-contained diagram YAML in your notes. Requires Obsidian Desktop 1.0.0 or newer.</p>
       <ol class="qs-steps">

marketplace-status/index.html

@@ -0,0 +1,90 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Marketplace status and release verification | Transitrix</title>
+  <meta name="description" content="Marketplace status, the scope of historical scans, and evidence for verifying Transitrix Studio releases.">
+  <link rel="canonical" href="https://transitrix.com/marketplace-status/">
+  <meta property="og:type" content="website">
+  <meta property="og:url" content="https://transitrix.com/marketplace-status/">
+  <meta property="og:title" content="Marketplace status and release verification | Transitrix">
+  <meta property="og:description" content="Marketplace status, the scope of historical scans, and evidence for verifying Transitrix Studio releases.">
+  <meta property="og:image" content="https://transitrix.com/assets/og/transitrix-og.png">
+  <meta property="og:image:width" content="1200">
+  <meta property="og:image:height" content="630">
+  <meta property="og:locale" content="en_US">
+  <meta property="og:locale:alternate" content="de_DE">
+  <meta name="twitter:card" content="summary_large_image">
+  <meta name="twitter:image" content="https://transitrix.com/assets/og/transitrix-og.png">
+  <link rel="preconnect" href="https://fonts.googleapis.com">
+  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+  <link href="https://fonts.googleapis.com/css2?family=IBM+Plex+Sans:ital,wght@0,400;0,600;1,400&family=IBM+Plex+Mono:wght@400&display=swap" rel="stylesheet">
+  <link rel="stylesheet" href="../assets/css/style.css">
+  <link rel="icon" type="image/svg+xml" href="/assets/img/transitrix-icon.svg">
+  <link rel="icon" type="image/png" sizes="16x16" href="/assets/img/favicon-16.png">
+  <link rel="icon" type="image/png" sizes="32x32" href="/assets/img/favicon-32.png">
+  <link rel="icon" type="image/png" sizes="128x128" href="/assets/img/favicon-128.png">
+  <link rel="apple-touch-icon" sizes="256x256" href="/assets/img/apple-touch-icon.png">
+  <script>if(localStorage.getItem('theme')==='light')document.documentElement.setAttribute('data-theme','light');</script>
+  <!-- Cloudflare Web Analytics -->
+  <script defer src="https://static.cloudflareinsights.com/beacon.min.js" data-cf-beacon='{"token": "1d2971bbe7964ede92ee02e5c78da48c"}'></script>
+  <!-- End Cloudflare Web Analytics -->
+</head>
+<body>
+  <a class="skip-link" href="#main">Skip to main content</a>
+  <header class="site-header">
+    <div class="wrap">
+      <a class="logo" href="../">Transitrix</a>
+      <div class="header-right">
+        <button class="theme-toggle" id="theme-toggle" aria-label="Toggle theme">
+          <svg class="icon-moon" width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/></svg>
+          <svg class="icon-sun" width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="12" cy="12" r="5"/><line x1="12" y1="1" x2="12" y2="3"/><line x1="12" y1="21" x2="12" y2="23"/><line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/><line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/><line x1="1" y1="12" x2="3" y2="12"/><line x1="21" y1="12" x2="23" y2="12"/><line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/><line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/></svg>
+        </button>
+      </div>
+    </div>
+  </header>
+  <main id="main" class="wrap">
+    <div class="hero">
+      <h1>Marketplace status and release verification</h1>
+      <p class="lede">Last checked: <time datetime="2026-10-14">14 October 2026</time>.</p>
+    </div>
+    <section aria-labelledby="status-heading">
+      <h2 id="status-heading">Marketplace status</h2>
+      <p>Transitrix Studio 3.2.0 was removed from Visual Studio Marketplace on 10 August 2026 under a Malware classification. We dispute this classification and have requested technical review. Microsoft has replied several times; its 5 October response maintained the block. We are still seeking the technical findings and a review path for an improved version.</p>
+      <p><a href="https://github.com/microsoft/vsmarketplace/issues/2204#issuecomment-5993191393">Public status update and review request</a>.</p>
+    </section>
+    <section aria-labelledby="historical-heading">
+      <h2 id="historical-heading">What the 3.2.0 evidence covers</h2>
+      <p>We audited all four 3.2.0 packages distributed through Open VSX. Microsoft Defender reported no threats; VirusTotal recorded zero malicious and zero suspicious results, with some engines unable to complete analysis. These point-in-time results do not guarantee safety.</p>
+      <p>The Microsoft and Open VSX builds used the same source commit and build commands. The original Microsoft-served files are unavailable, so we cannot independently verify byte-for-byte identity. A Windows x64 rebuild matched all 519 extracted files by content hash.</p>
+      <ul>
+        <li><a href="https://github.com/transitrix/transitrix-studio/blob/main/docs/internal/vsix-audit-v3.2.0/FINDING.md">Audit finding and scope</a></li>
+        <li><a href="https://github.com/transitrix/transitrix-studio/blob/main/docs/internal/vsix-audit-v3.2.0/scans.md">Recorded scan results</a></li>
+        <li><a href="https://github.com/transitrix/transitrix-studio/blob/main/docs/internal/vsix-audit-v3.2.0/reproducibility.md">Rebuild and content-hash comparison</a></li>
+      </ul>
+    </section>
+    <section aria-labelledby="release-heading">
+      <h2 id="release-heading">Release verification</h2>
+      <p>Since then, we have removed the platform-specific PNG rendering dependency. Release 3.8.1 provides the VSIX, checksums, a software bill of materials and build-provenance verification instructions. The 3.2.0 scan results should not be read as scan results for 3.8.1.</p>
+      <p>Please review the published evidence against your organisation’s requirements and keep security protections enabled.</p>
+      <ul>
+        <li><a href="https://github.com/transitrix/transitrix-studio/releases/tag/v3.8.1">Release 3.8.1 and verification instructions</a></li>
+        <li><a href="https://transitrix.com/install/">Installation guide</a></li>
+      </ul>
+    </section>
+  </main>
+  <footer class="site-footer">
+    <div class="wrap">
+      <div class="footer-inner">
+        <p>
+          <a href="https://github.com/transitrix">github.com/transitrix</a> ·
+          <a href="https://x.com/transitrix">@transitrix</a>
+        </p>
+      </div>
+      <p class="footer-attribution">Created and maintained by Valerii Korobeinikov — enterprise-architecture advisory at <a href="https://korobeinikov.consulting">korobeinikov.consulting</a></p>
+    </div>
+  </footer>
+  <script src="../assets/js/theme.js"></script>
+</body>
+</html>

sitemap.xml

@@ -58,6 +58,10 @@
     <loc>https://transitrix.com/library/archimate-cheat-sheet/</loc>
     <xhtml:link rel="alternate" hreflang="en" href="https://transitrix.com/library/archimate-cheat-sheet/"/>
   </url>
+  <url>
+    <loc>https://transitrix.com/marketplace-status/</loc>
+    <xhtml:link rel="alternate" hreflang="en" href="https://transitrix.com/marketplace-status/"/>
+  </url>
   <url>
     <loc>https://transitrix.com/methodology/</loc>
     <xhtml:link rel="alternate" hreflang="en" href="https://transitrix.com/methodology/"/>