0.4.0-beta.12

What's Changed

• fix: simplify classic root migration and remove Native cryptographic review by @benym in #255

Changed

• Classic root migration: comet classic root move docs --dry-run now reports the current state without exposing a plan ID, prints each conflict or blocker on its own line, and --apply migrates the complete openspec/ tree—including active and incompletely archived changes—without requiring a plan ID. Migration output and errors follow classic.language, projects already using docs/openspec/ receive a clear no-op result, and completed migrations keep the final result at the end of the detailed report.
• Native workflow guidance: Native now identifies the current change and phase before loading a phase-specific reference, always performs Shape classification, silent-assumption checks, and shared-understanding confirmation before implementation, treats blocked as a recoverable branch instead of task completion, reconfirms new user decisions discovered during Build with the Runtime-provided --confirmed transition, and explains project and change commands as a task-oriented runbook instead of an undifferentiated command list.
• Native verification and repair: Passing Verify now runs and binds the built-in required check automatically. Acceptance evidence can come from manual observations or Runtime-executed project commands, with Windows command-shim support and credential-like output redaction. Runtime derives repair gaps from failed evidence; a repeated gap with one remaining override stays Agent-owned and requires a concrete new hypothesis, while an exhausted override or verification budget returns one explicit user decision.

Fixed

• Classic Dashboard discovery: Dashboard now discovers the repository root when launched from a nested directory, reads Classic changes from the configured legacy or docs layout through the built CLI, and shows collection errors instead of presenting them as an empty workspace.
• Explicit Comet Skill routing: The root Skill now triggers only for an explicit /comet invocation or a Comet request that does not choose Native or Classic. Once loaded, it treats the entry as selected, immediately resolves the project-configured workflow, loads exactly the returned Native or Classic entry Skill, and passes the original request through instead of re-evaluating task relevance or selecting a workflow by task size.
• Stale current-change routing: A selection whose target is missing or archived now reuses the same zero, one, or multiple active-change resolution as a missing selection: ordinary work continues with zero candidates, one candidate is inferred read-only, and multiple candidates still require an explicit selection.
• Native baseline recovery guidance: Incomplete baseline diagnostics now include native.snapshot.max_files alongside the byte and duration budgets, so file-count truncation points users to the configuration that can resolve it.

Removed

• Native cryptographic review: Removed controller trust, signing identities, implementation attestations, independent-review and waiver receipts, and their CLI and Eval handoff paths. Native verification now depends on complete, current acceptance evidence and the built-in required check, bound to the active revision, contract, scope, snapshot, and artifacts.
• Redundant Native CLI inputs: Removed the comet native list alias; manual-receipt --responsible and --confirmed options; and caller-supplied next --receipt, --evidence-receipt, --failure-category, and --failed-check options. Use unnamed status for discovery, record acceptance receipt references in verification.md, and record fresh schema-v3 evidence for active changes that still hold v2 receipts.

Full Changelog: 0.4.0-beta.11...0.4.0-beta.12