v2.0.9

Sprint-end audit: graded findings, full PO adjudication, suppression that persists

• Findings are now rated on a canonical 3-level scale — critical (a bug that prevents the spec from being met), high (spec met, but future harm), low (need-not-fix) — stored in a machine-readable audit_severity field on backlog items instead of only the PBI title. Migration 006 back-fills existing audit PBIs (legacy Medium maps to high, which can newly block Integration-Sprint entry).
• Every finding goes before the Product Owner with a plain-language, decision-ready brief; nothing is filed behind the PO's back and nothing mandatory-tiers past them. defer/reject verdicts are persisted per finding; a reject suppresses re-filing across Sprints and lapses only when a later audit rates the class strictly higher. Suppressed criticals are named out loud at the Integration gate.
• In human-PO mode the Scrum Master records the human's verdicts on their behalf, so suppression works identically in both modes.

Specs describe the present

• New catalog Governance Rule 8: spec bodies are current-state-only; history lives in frontmatter revision_history, D-001 ADRs, and the decision log. Live backward-compat paths and migration version ranges are explicitly not history.
• The audit detects history contamination repo-wide (new Axis A class 5) and routes it through spec adjudication → change-process; the docs-consistency reviewer blocks new contamination at merge time.
• New audit Step 4c backfills every answered spec clarification into the clause at Sprint end, so an ambiguous spec is fixed once instead of re-asked every Sprint.

Retrospectives can improve the framework itself

• New draft-framework-issue.sh drafts a sanitized GitHub issue for this repo when a retrospective finds a framework-attributable bug or improvement: postable body and local metadata are separate files, four mechanical sanitizer checks reject target-project identifiers/paths/tokens (no --force), and repeat findings bump an occurrence count instead of drafting twice.
• Posting always requires an explicit human "yes" after reading the full draft; autonomous runs queue drafts in the attention file and never post.
• The deploy stamp now records framework_origin so target projects can address this repo without network access.

Fixes

• Every documented bats invocation is now recursive (bats -r); the non-recursive form silently skipped 658 of 930 tests locally. The CI ShellCheck glob and the schema-pairing gate were missing the same class of subdirectory coverage and are aligned.
• Cross-Sprint audit dedup keys on the audit_identity field instead of description text; PBI worktrees can fork from an explicit base; the changelog page's v2.0.8 "Fixed" badge class now matches the CSS.

🤖 Generated with Claude Code