v0.21.2

v0.21.2

Patch release prepared 2026-08-28. 24 commits since v0.21.1: a full
spec-to-code compliance audit of docs/specs/ with every confirmed
divergence fixed (#106–#114), a generated-artifact frontmatter bug fix
(#115), and the first-party advisory rules absorption batch
(#101–#105).

Compliance audit fixes (#106–#114)

A 165-requirement spec-to-code audit across the current docs/specs/
corpus (90% already implemented) surfaced 14 confirmed divergences;
all are fixed in this release:

• Run Console integrity projection — a confirm record whose
  prototype hash mismatches is never projected as confirmed
  anymore: the canonical confirm now carries the owner-computed
  prototype_status, the snapshot builder demotes mismatch to
  invalid, and the first confirm-round fixtures land in the
  run-console suite (#106).
• Static handoff delivery page — deliverable.html is now
  written beside index.html, byte-identical to the ZIP member, so
  the page's relative link and its "sits next to it on disk" copy are
  true; a missing deliverable source fails the build before any
  artifact is written (#107).
• Excerpt hygiene — source excerpts strip C0 (except tab and
  newline), DEL, C1, and complete ANSI CSI sequences server-side,
  matching the snapshot spec's plain-text promise (#108).
• Action error codes — malformed JSON bodies are rejected
  pre-dispatch with their own MALFORMED_JSON code;
  ACTION_PAYLOAD_INVALID now covers only well-formed JSON with an
  invalid payload (#109).
• Adapter generator — renderer dispatch is matrix-driven: tier
  membership, the AGENTS.md floor fallback, and the native skip key
  off matrix rows, with no duplicated agent lists; emitted artifacts
  stay byte-identical (#111). Hygiene batch: the retired CWD capture
  default is gone (run-tree out_dir now required), the output/
  ignore entry retired with it, Cursor/Windsurf MCP guides carry the
  generated-by header, and CI adopts the adapter golden suite (#110).
• Documentation reconciliation — the interactive-review plan
  records its shipped deviations as §0 amendments A9–A12 (#112), five
  prose-contract legs from the vNext shaping/review/rules specs are
  closed in the shipped skills (#113), and a documentProblem sweep
  reconciles the snapshot, parity, handoff, adapter, and vNext spec
  wording with shipped behavior (#114).

Generated frontmatter fix (#115)

Frontmatter-bearing rendered artifacts (Cursor .mdc, GitHub Copilot
.instructions.md) now open with the --- fence on line 1 and carry
the generated-by comment as the first body line. Previously the
leading comment demoted the frontmatter to prose on hosts that require
the fence first, silently dropping alwaysApply / description /
applyTo metadata. A regression test renders every matrix agent and
pins the fence-first layout.

First-party advisory rules (#101–#105)

The rule registry grows to 20 entries across 8 families: COPY-01/02/03
(control labels, user-side naming, error-message tone), DECIDE-01
(anti-default direction check), A11Y-02 (visible keyboard focus), and
CRAFT-09/10 (selector-specificity conflicts, structure encodes
content). ui-picker gains the anti-default check and memorable-element
prose, craft-guard points at the COPY family, G10 gains a
consumability fixture, and the example runs carry honest DECIDE-01
verdicts.

Verification

Full suite green at the release commit (1500+ tests plus subtests,
zero failures), scripts/validate.py / check_doc_links.py /
doctor.py green, adapter drift gate byte-verified, acceptance
two-axis review archived with all findings cleared.