v0.3.29

• fix vm-fleet-status.yml's round-4 fix, which was itself incomplete: emitting an empty matrix ({"include":[]}) stopped the jq crash, but GitHub Actions marks the entire workflow run failure whenever a dependent job's strategy.matrix resolves to zero combinations -- a platform behavior the round-4 fix didn't account for (confirmed via real run history: 12 total runs since this workflow existed, 0 successes ever, including runs after the round-4 fix landed). Added an explicit has-vms output so check-vm is skipped entirely via if: when there are no VMs, instead of being handed an empty matrix
• fix .github/workflows/release.yml's "Tag already exists" duplicate-tag check: actions/checkout's default fetch-tags: false meant git rev-parse "$VERSION" could never see a real remote tag, making this safety check dead code since the very first version of this workflow. Replaced with git ls-remote --exit-code --tags origin, verified against both a real existing tag and a nonexistent one
• fix .github/workflows/standards-assurance-scan.yml: it cloned repo-standards-review at floating HEAD instead of the exact SHA this repo's compliance stamp is assessed against (silent drift risk), and its failure condition only checked the req/arch gates, silently ignoring a cm/coverage/doc regression. Pinned the clone to the stamped SHA and widened the failure check to all 5 required gates
• fix the wiki Architecture Packet's Deployment View: round 4's own fix (restoring .github/scripts/validate-vm-provisioning-dispatch.py) was never reflected here -- this section still said the script "does not exist" and every phase fails, directly contradicting round 4's own code change. Corrected to reflect the restoration, cited a real, first-ever successful validate-phase dispatch (VITechnologies/projectbuddy run 42335965127) as positive evidence, and noted package-build remains blocked by design (consumer-vendored script), not by a missing file
• fix 2 new dangling docs/projectbuddy-consumption.md references introduced by round 4's own fix (a file already known-missing and tracked in #63) -- repointed both to README.md's real "Consumption model" section instead of making the same gap worse
• fix .github/skills/projectbuddy-identity/ (SKILL.md and agents/openai.yaml): both still described Run-Pipeline.sh as a native SBOM pipeline entry point, claimed nonexistent teardown/enable-vrde phases for provision-windows-labview-vm.yml (the real phases are validate/create-vm/install-vipm/install-labview/register-runner, exactly 5), and showed the reusable-workflow consumption pattern as @<tag> instead of @<commit-sha> # <tag> -- the same class of defect fixed elsewhere in rounds 1-4, never caught in this agent-orientation file specifically until now
• fix docs/architecture/standards-compliance.md: it conflated two separate workflows, attributing standards-compliance-recheck.yml's "Compare Stamped Version Against Latest" step to standards-assurance-scan.yml (which doesn't have that step); and claimed public upstream VITechnologies/projectbuddy "carries zero private infrastructure state" when it in fact has a real, online vm-provisioner-labeled self-hosted runner registered directly against it (the zero-state claim was about pre-committed configuration, not every runner ever registered)
• fix REQ-002 (wiki): still listed "ISO paths" as a required-with-no-default identity value after round 4 corrected this same overclaim in README.md/the Architecture Packet; fix REQ-001 (wiki): stopped asserting "Verified (manual)" against a Fit Criterion now known false (#68); fix REQ-010 (wiki RTM): reflects the one disclosed v0.3.28 GitFlow exception rather than an unqualified "Verified"; fix REQ-013 (wiki): its cited evidence script (vm/windows-labview/build-virtualbox.ps1) is never actually called by any real workflow (confirmed via a repo-wide reference search) -- provision-windows-labview-vm.yml calls the sibling .sh script instead, which independently implements the same ISO SHA-256 guard the requirement describes
• fix provision-windows-labview-vm.yml's guest_full_name/guest_hostname inputs: their own description text read "...no built-in default); required for create-vm" directly beside required: false and a real default value -- a literal self-contradiction in the same file. Also noted the cross-workflow inconsistency with provision-ubuntu-vm.yml, which marks the same conceptual fields required: true
• fix docs/vm-provisioning/procedure.md's opening paragraph: claimed both VM families "share one discipline" requiring every identity value as workflow_dispatch-required, which is false (the two families disagree on guest_full_name/guest_hostname required-ness) and incorrectly grouped the ISO path in with identity values despite it having a legitimate generic default
• fix docs/cm/cm-plan.md: added v0.3.0 to the tag/CHANGELOG mismatch disclosure (round 4 only caught v0.2.2); disclosed the v0.3.28 GitFlow release-flow exception (a non-release PR landed directly on main after its release branch's own promotion, discovered mid-round while testing this round's own release.yml fix); noted the Hotfix Flow has never actually been exercised in this repo's real history; added a cross-reference for ISO/IEC/IEEE 12207 configuration-audit outcome (e) to this repo's own semantic-audit pipeline
• fix docs/release/release-procedure.md and docs/architecture/adr/ADR-0001-adopt-gitflow-for-release-governance.md: added the same v0.3.28 exception disclosure and an explicit tagging-order rule to reduce recurrence; clarified ADR-0001's "every document carries a stamp" condition means coverage by the one canonical stamp, not N independent copies, and added real cross-references from cm-plan.md/release-procedure.md to that canonical stamp
• live-verified this round's provision-ubuntu-vm.yml/release.yml/standards-assurance-scan.yml fixes via real dispatches, not just local simulation (first-ever successful provision-ubuntu-vm.yml dispatch; a real draft-then-published release created end-to-end by the fixed release.yml; a fresh, successful standards-assurance-scan.yml run against current content)
• filed #76 (round-4's v0.3.24 CHANGELOG entry falsely claimed Install-VerifiedNugetPackage.ps1 had "zero consumers anywhere in the pipeline" -- SandboxSBOMReporting's batch-pipeline.yml calls it directly for a legitimate, unrelated purpose; added a protective warning at that repo's PROJECTBUDDY_REF pin site) and #77 (remaining lower-severity findings: formal ISO 29119-3/15289 document-template completeness, further Architecture Packet component gaps, and 4 smaller REQ-level precision gaps)
• cleaned up 10 already-merged, undeleted sync branches on the fork
• all findings from this round's --mode semantic-audit pass (same 3-model delegation, explicitly asked to verify whether v0.3.28's fixes held up and hunt for anything neither prior round caught): both GPT and Gemini independently found the same critical vm-fleet-status.yml empty-matrix regression and the same wiki self-contradiction; Claude independently confirmed both via real run-history queries and found 2 additional previously-uncaught defects (release.yml's dead tag-check, REQ-013's orphaned evidence citation)