Pre-release fixes: restore FIPS 140 disclaimer, add WASM patch failure warning, sync threat tables

Restored the FIPS 140-2/3 validation disclaimer in README and SECURITY-MODEL.md
(lost during earlier README rewrite). Added build-time warning to patch-wasm.cjs
when the WASM integrity pattern isn't matched. Updated SECURITY.md threat table
to include the Runtime WASM check column, matching SECURITY-MODEL.md. Added
quantum-safe-wallet example to CHANGELOG 1.0.0 entry.

Author: fzhengbd

.gitignore

@@ -157,6 +157,7 @@ temp/
 # Documentation build
 # -----------------------------------------------------------------------------
 docs/_build/
+docs/superpowers/
 site/
 
 # -----------------------------------------------------------------------------

CHANGELOG.md

@@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Runtime WASM integrity check: SHA-256 hash of the WASM binary is embedded in the Node.js loader at build time and verified before instantiation, blocking tampered binaries from executing
 - Tests for the runtime integrity check (embedded hash correctness and tamper detection)
+- `examples/quantum-safe-wallet.mjs`: end-to-end cryptocurrency wallet simulation demonstrating ML-DSA signature replacement with address-to-key binding validation
 
 ### Changed
 

README.md

@@ -12,6 +12,8 @@ High-performance post-quantum cryptography for JavaScript and TypeScript, powere
 [![FIPS 205](https://img.shields.io/badge/FIPS%20205-SLH--DSA-blue)](https://csrc.nist.gov/pubs/fips/205/final)
 [![provenance](https://img.shields.io/badge/provenance-sigstore-green)](https://www.npmjs.com/package/fips-crypto)
 
+> **Note:** This package implements the algorithm specifications in FIPS 203, FIPS 204, and FIPS 205. It is **not** a FIPS 140-2 or FIPS 140-3 validated cryptographic module. If your compliance framework requires CMVP-validated modules, this library does not satisfy that requirement.
+
 ## Why post-quantum cryptography matters
 
 Quantum computers running Shor's algorithm will break the classical cryptography that secures today's systems:

SECURITY.md

@@ -78,10 +78,11 @@ A successful result confirms the package was built and published by the GitHub A
 
 ### What each verification layer protects against
 
-| Threat | Checksums | Provenance |
-|--------|-----------|------------|
-| CDN/mirror corruption | Yes | No |
-| Stolen npm token | No | Yes |
-| Compromised CI environment | No | No |
+| Threat | Runtime WASM check | Checksums | Provenance |
+|--------|--------------------|-----------|------------|
+| WASM binary tampered post-install | Yes | Yes | No |
+| CDN/mirror corruption | Yes | Yes | No |
+| Stolen npm token | No | No | Yes |
+| Compromised CI environment | No | No | No |
 
 For a detailed security model, see [docs/SECURITY-MODEL.md](docs/SECURITY-MODEL.md#checksums-vs-provenance-threat-boundaries).

docs/SECURITY-MODEL.md

@@ -1,5 +1,7 @@
 # Security Model
 
+> **Compliance scope:** fips-crypto implements the cryptographic algorithms specified in FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA). It has not undergone FIPS 140-2 or FIPS 140-3 CMVP validation. The "FIPS" in the package name refers to the algorithm standards implemented, not to module-level validation status.
+
 This document describes what fips-crypto protects against, how, and what it does not guarantee.
 
 ## Quantum Threat Context

scripts/patch-wasm.cjs

@@ -84,6 +84,7 @@ if (fs.existsSync(wasmBinaryPath)) {
     .map(f => path.join(NODE_WASM_DIR, f))
     .filter(f => fs.readFileSync(f, 'utf8').includes('readFileSync(wasmPath)'));
 
+  let patchedCount = 0;
   for (const loaderPath of loaderFiles) {
     let content = fs.readFileSync(loaderPath, 'utf8');
 
@@ -107,6 +108,15 @@ if (fs.existsSync(wasmBinaryPath)) {
       content = content.replace(original, patched);
       fs.writeFileSync(loaderPath, content);
       console.log(`Embedded WASM integrity check in ${loaderPath} (sha256:${wasmHash.slice(0, 16)}...)`);
+      patchedCount++;
     }
   }
+
+  if (loaderFiles.length > 0 && patchedCount === 0) {
+    console.warn(
+      'WARNING: WASM integrity patch (Patch 2) did not match any loader files. ' +
+      'wasm-bindgen output may have changed. The published package will NOT ' +
+      'include runtime WASM integrity verification.'
+    );
+  }
 }