v1.75.0 — the three review-convergence rules become fleet-binding

The three review-convergence rules become fleet-binding

docs/port-canon.md gains entries 7-9 — review-round-cap, cosmetic-finding-class and dispatch-count-telemetry — registering the rules 1.74.0 shipped as ones every port is expected to carry. Each is check: "anchor" and provenance: "quoted", and each carries its governed text verbatim in Provenance rather than a paraphrase.

Until now a green drift check meant only that nothing was watching these three: a port that never received the round cap was indistinguishable from one that had it.

The matching v1 anchors sit beside the governed text at skills/stride-workflow/SKILL.md:452 (the cap), agents/task-reviewer.md:124 (the cosmetic class) and skills/stride-workflow/SKILL.md:863 (dispatch_count). The six pre-existing entries are byte-unchanged — the canon change is 263 insertions and 0 deletions.

The checker now exits 1, and that is the entries working

bash scripts/check-port-canon.sh reports ok 62, missing 36. The pre-entry baseline was ok 59, missing 5 and already exited 1 — those five were the pre-existing stop-hook-capability gap, stride's own included.

The three entries opened 31 further cells: 8 ports owe the cap and the cosmetic class (16), 6 ports owe dispatch_count (6), and 3 vendored catalog copies owe all three (9). 31 plus the pre-existing 5 reconciles exactly with the reported 36. --self-test stays at 141 passed, 0 failed, exit 0.

Expect exit 1 until the port goals land. The red is the worklist.

Cannot-carry is kept distinct from has-not-yet

stride-lite and stride-opencode-lite are not_applicable for dispatch-count-telemetry only: neither emits a workflow_steps object nor has a completion endpoint, so there is no entry for the key to sit on. That ground was read from those ports rather than assumed from the canon. Those two cells will never close — and both ports still owe the other two rules.

Fixed during review

review-round-cap first registered the security carve-out at less than full strength: its Substance carried the prohibition (a category: "security" finding is never merely recorded) but dropped the disposition the source mandates — that such a finding is fixed or escalated instead — and that clause appeared in no blockquote, under a heading reading "The governed text, verbatim". A port implementing from the entry alone could have satisfied "not merely recorded" by filing a security finding as a deferred defect, which is weaker than what this plugin enforces.

Caught by review round one and, independently, by a specialist security pass that returned the consideration partial. Both halves are fixed and round two approved.

Known, not fixed here

An exploratory session against the checker's own output found four report-quality defects in scripts/check-port-canon.sh, all pre-dating this release. The sharpest: check_hint is parsed and schema-validated but never printed, so every MISSING work item names no file and no location; and the work-item template tells a maintainer to add the anchor "beside this port's own statement of the rule" even for ports that have no such statement. Both are worst exactly when a new rule lands. A fix belongs to the checker, on its own terms.

Migration

None. No skill contract, payload field, or schema changed — schema_version stays "1.7". The only behavioural change is that the drift check reports more cells.