Harden specification release controls

[TonisOrmisson]

What changed

• pins the two CI actions to verified full upstream commit SHAs
• gives CI an explicit read-only token scope and prevents checkout credential persistence
• adds a specification-only maintainer release checklist
• records the published immutable v0.2.1 maintenance release in the main changelog and roadmap
• links the release process from the README

Scope boundary

This change adds no executable validator, parser, compiler, adapter logic, package, or publish workflow. Adapter conformance and service-matrix gates remain external and incomplete for v0.3.0.

Validation

• python3 tools/validate_repository.py
• git diff --check
• independent strong review of exact head 1872e0e5b0ebee6a2d63b50111c3841bcbee866d: CLEAN

Remaining server controls

main protection and a release-tag ruleset remain GitHub repository settings to apply after this PR. Immutable releases and automatic merged-branch deletion are already enabled.

[TonisOrmisson]

@codex review

Please review exact head 1872e0e5b0ebee6a2d63b50111c3841bcbee866d. Focus on action SHA provenance, least-privilege CI settings, the immutable release sequence, v0.2.1 history, and the specification-versus-implementation boundary.

[chatgpt-codex-connector]

💡 Codex Review

specification/README.md

Line 79 in 1872e0e

This specification repository publishes only normative Transformation Plan and SPSS syntax frontend schemas, documentation, and declarative fixtures. Executable validation or behavioral conformance code, including parser, SQL-engine, transaction, and adapter behavior, belongs in each implementation or adapter repository.

Exempt repository validation from the implementation boundary

Narrow this statement to executable implementation or behavioral conformance code. The same exact tree publishes tools/validate_repository.py, and CI executes it; it even runs SQL workflow cases and a SQLite fixture. Claiming that the repository publishes only schemas, documentation, and declarative fixtures—and that all executable validation belongs elsewhere—therefore misstates the repository boundary and conflicts with the release checklist's required repository validation.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[TonisOrmisson]

Addressed all three Codex findings in exact head 5f004a23bb5b6889716544f168e1ca85ae7c31e0. In addition to the two resolved release-sequence threads, README now explicitly permits the repository's structural/hash/fixture validation while keeping executable implementation and behavioral conformance in adapter repositories. Both exact-head CI runs and an independent strong review are clean.

@codex review

Please re-review exact head 5f004a23bb5b6889716544f168e1ca85ae7c31e0.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 5f004a23bb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".