v0.93.0

Added

• synapse fleet-init — empty machine to working fleet in one command,
  bundling the existing first-run pieces in their right order: the real
  doctor (optionally --fix; a failing report is a printed remedy,
  never an abort), a persistent coding-fleet workspace scaffold
  (./synapse-fleet by default, --force to refresh), a probe of every
  registered provider CLI without taking a turn (--seat PROVIDER
  declares intended seats; an unavailable declared seat is warned about
  and kept in the plan), the packaged no-collision demo smoke
  (--no-smoke to skip), and a printed next-steps plan — waiter arming,
  per-provider worker-session seat commands, git-init, dashboard —
  with the workspace's project name filled in. No new dependency and no
  new daemon: everything it starts is what the bundled commands start.

• The hub can feed its own partition detection: synapse hub --multihub-watch PEER=URI (repeatable) runs a standing follower that
  polls each named peer's event log on a bounded interval and folds the
  observed claims into the asserting-owners view the namespace-ownership
  gate consumes, so a namespace a watched peer is seen contesting
  resolves as partitioned and refuses to grant until the contest clears.
  Companion flags wire the ownership map from the CLI: --hub-id (the
  hub's stable id) and --namespace-owner NS=HUB_ID (repeatable,
  deny-by-default claim routing; requires --hub-id, and the watch
  requires the map). Naming a peer is the operator confirmation for the
  always-on outbound connection; a failed poll keeps the last successful
  observation, so an outage errs on the refusing side; the watch task
  lives exactly as long as the server. Validated live on two hubs: a
  claim held on the watched peer flips the namespace to partitioned
  refusals and the peer's release clears it on the next poll.

• synapse benchmark --ascii — renders the --trend block in printable
  ASCII for consoles and CI log viewers without UTF-8: the sparkline ramp
  becomes ._-=+*#%@ and the arrow and dash punctuation degrade to ->
  and --. Requires --trend; the stored history and the --json
  document are byte-identical either way.

• synapse cross-repo --suggest-resolution can now name a concrete pin:
  when a version inside an odd-one-out's remainder range is already
  declared by one of the remaining consumers in an inclusive bound
  (==, >=, <=), the advice appends "X.Y would satisfy them all (a version REPO already declares)" and the JSON gains suggested_pin
  and pin_source. Evidence-based only: the version is lifted from a
  manifest, never invented — the scanner has no package index, so
  exclusive fence-post bounds are never candidates and whether an index
  publishes the version is not claimed.

• Federation peering age is now visible and enforceable: synapse federation list shows each peering's age since its confirmed import
  and renders a peering whose bundle expiry has passed as [expired];
  --max-age DAYS flags active peerings imported longer ago than the
  threshold as stale and exits 1, so a scheduled job can hold the
  fleet to a re-ceremony cadence. federation import --max-age DAYS
  applies the same policy at import time, warning (the import still
  succeeds) when the incoming bundle never expires or expires further
  out than the threshold.

• Added the end-to-end exchange-ceremony walkthrough to the federated
  trust model design doc: two operators, both fingerprint blocks
  captured from a real two-hub run of federation offer, hub --federation-offer, federation fetch, and the confirmed
  federation import — including the --max-age expiry grading at
  import time.

• synapse causality health --watch — the lifecycle-anomaly assessment
  becomes a standing coordination-health monitor: the store is reread
  and re-assessed every --interval seconds, the first tick prints the
  full report as the baseline, and every later tick prints only the
  anomaly transitions (+ fact new, - fact cleared, identity facts
  that deliberately omit the ever-growing ages), so a steady fleet
  stays quiet and the scrollback reads as a timeline. --json streams
  one full report per tick as NDJSON; a failing tick stops the watch
  with exit 2; a bounded watch exits with the last tick's anomaly
  signal.

• synapse benchmark --alert — a deterministic statistical drift gate
  over the --trend history: every probe metric's latest value is
  measured in sigma distances from the sample mean of its same-context
  predecessors (same package version, CPU model, and governor as the
  latest run — the fields the context breaks annotate), and a value
  beyond --alert-sigma (default 3) exits 1. A series with fewer
  than --alert-min-samples same-context samples (default 5, floor 3)
  is reported as insufficient and never silently gated; a flat
  baseline has no sigma, so any deviation from it is flagged as such.
  --json gains a drift object; composes with --compare.

• The SYNAPSE-protected badge — a repository whose CI gates on the
  anulum/synapse-channel policy-check action (or synapse policy-check --enforce directly) may declare it with a static badge; the policy
  engine page documents exactly what the badge claims, the three
  eligibility conditions (enforcement on, gating the protected path,
  committed policy file), and how a reader verifies the claim in the
  repository itself — an honest self-declaration with no hosting, the
  first slice of the managed GitHub App build order.

• synapse dashboard --reliability-db HUB.DB — the dashboard serves
  /reliability.json, the same audit-signal report as synapse reliability ("audit signals, not scores"), read from the durable
  event store rather than the live hub so it stays available when the
  hub is down. Without the flag the endpoint answers 404 (the cockpit
  reliability panel treats that as the feed being honestly absent); an
  unreadable store answers 503 rather than an empty report. Behind the
  same dashboard bearer token as every other path.

• A read-only web cockpit under clients/cockpit/ (React + TypeScript +
  Vite single-page app over the dashboard's /snapshot.json): a live
  activity spine plotting real coordination transitions, fleet roster
  with per-path claims and presence honesty, worst-first risk rail,
  claims board, shared-plan deck, federation row, signal log, and a
  reliability panel fed by /reliability.json that renders audit
  signals — never a score.

Security

• The last four unpinned tool installs in CI are now hash-locked: the
  pre-commit, release, publish, and reuse workflow jobs install
  pre-commit, build, twine, and reuse from a new
  .github/requirements/requirements-tools.txt (uv pip compile --universal --generate-hashes, installed with --require-hashes),
  closing the remaining supply-chain gap the dev and audit lockfiles
  already closed for every other job.