You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
grid: derive the natural key as UUIDv8 over SHA-256, retiring SHA-1 from the identity layer
Features
boot: adopting a plugin release writes rev + resolved commit as one pair (3588f10)
boot: adopting a plugin release writes rev + resolved commit as one pair (bc628d4)
boot: install git plugins by pinned commit; report tag drift as a security Flaw (916aa1b)
boot: install git plugins by pinned commit; report tag drift as a security Flaw (2ffaef8)
ci: api-fuzz-nightly fails loudly; plugin-ci gains the after-tests hooks the fuzz campaign rides (9c9e189)
cicd: a version tag requires verified attestations, and :latest moves last (45cfc93)
cicd: a version tag requires verified attestations, and :latest moves last (50ccab0)
cicd: Renovate watches the boot-record plugin pins, moving rev and commit together (9d6b4a2)
cicd: Renovate watches the boot-record plugin pins, moving rev and commit together (af8c5cc)
ci: hand the after-tests command both commits so a ledger row can stamp its provenance (e5c45cc)
ci: one reusable nightly reporter — a red or unobserved nightly becomes one owner issue (e0acc55)
fips: plugin conformance derives the boot gate's verdict for the plugin's own ci stack — one classifier, one waiver matching, one answer (a582978)
fips: plugin conformance derives the boot gate's verdict for the plugin's own ci stack (one classifier, one waiver matching) (958c119)
grid,cares,web: the completeness statement — six evidence attributes per surface on the run's Batch (phase 4 slice 1) (b286ad7)
grid,cares,web: the completeness statement — six evidence attributes per surface on the run's Batch, authority off (adc7d15)
grid,plugins: every declared edge type must resolve — a boot-time check and its validate_plugin mirror (8ceb302)
grid,plugins: every declared edge type must resolve — boot-time check tap_grid.E004 and its validate_plugin mirror (d15f04e)
grid: batch playground, second pass — reload and schedule families, five authored datasets, three-truths checker, symbolic ids, metamorphic checks (Issue# 613 - tap) (2052f36)
grid: batch playground, second pass — reload and schedule families, five authored datasets, three-truths checker, symbolic ids, metamorphic checks (Issue# 613 - tap) (637fa2a)
grid: batch-local refs on the GRIFT envelope — entity_id XOR ref, endpoint refs, one resolution pass before preflight, the ref→id map on the result (gate slice 1) (cac1a68)
grid: batch-local refs on the GRIFT envelope — gate slice 1 (entity_id XOR ref, endpoint refs, one resolution pass, ref→id map) (92d0445)
grid: candidate derivation for reconciliation — fan-out minus observed, per-parent prerequisite, withdrawal distinct, authority off (12475f4)
grid: cascade as a declared walk — CONTAINMENT_EDGES on the model, delete_node(cascade="contained"), reason and metadata on delete (b2852b6)
grid: classify all fifteen core entity types, and guard that none stays undeclared (554173e)
grid: derive the natural key as UUIDv8 over SHA-256, retiring SHA-1 from the identity layer (59563ef)
grid: each node declares how it is found, and the search is generated (93288c9)
grid: Entity.natural_key — the column and the spine surface, inert (b9eb217)
grid: Entity.natural_key — the column and the spine surface, inert (phase 1.1) (0e5e54a)
grid: Entity.natural_key becomes a text placeholder; the hashed derivation and its backfill go (5c9be64)
grid: per-type falsifiers, authority off — [falsifiers] manifest table, Falsifier base + registry, five verdicts, pure probe classification, verdicts recorded on the run Batch, coverage ratchet (phase 4 slice 3, Issue# 644 - tap) (deffe1b)
grid: per-type falsifiers, authority off — manifest [falsifiers] table, Falsifier base + registry, five verdicts, pure probe classification, verdicts recorded on the run Batch, coverage ratchet (phase 4 slice 3) (699c3b1)
grid: reconcile contradiction detector — a tombstone never cascades over a node the run observed live (Issue# 656) (0837b4f)
grid: resolve_identity — a ref node finds its existing row or keeps its assigned id, under a declaration-keyed lock inside the batch transaction; ambiguity fails the batch with one Flaw (gate slice 2) (4703a78)
grid: resolve_identity — gate slice 2 (find-or-assign under a declaration-keyed lock inside the batch transaction; ambiguity fails the batch with one Flaw) (3d06470)
grid: the batch playground — a known-answer corpus for the GRIFT import path (Issue# 603 - tap) (53cb4fd)
grid: the batch playground — a known-answer corpus for the GRIFT import path with a reference oracle, a checker proven against corrupted runs, and a two-writer timing family (6cfc3d9)
grid: the cascade confirmation corpus — 63 known-answer scenarios, a reference oracle, and a timing family (a3c223c)
grid: the cascade confirmation corpus — 76 known-answer scenarios, a set-based reference oracle, and a timing family (46305db)
grid: the natural-key backfill — report, apply, check (b1d1baa)
grid: the natural-key derivation and the declaration contract (f1af769)
grid: the natural-key derivation, the fifteen classifications, and the backfill (phase 1.2-1.4) (54ab567)
grid: the reconcile contradiction detector — a candidate whose contained closure holds a node the same run observed live is recorded contradiction on the candidate record, refused unprobed by the dispatch whatever the authority, and never applied; a tombstone whose closure holds a node observed by any committed batch since derivation is contradicted at apply with the closure locked first; the closure is read through a new service gateway that is the cascade's own discovery (phase 4, Issue# 656 - tap) (e71a393)
grid: the reconcile verb — grid.reconcile capability, per-collector authority (off by default) and budget, verdicts applied behind a freshness fence, collectors never retire (phase 4 slice 4, Issue# 652 - tap) (8e5ec61)
grid: the reconcile verb — grid.reconcile capability, per-collector authority (off by default) and budget, verdicts applied through the write pipeline behind a freshness fence, collectors never retire (phase 4 slice 4) (369cf5e)
gryphon: rule multi-MATCH as union and refuse a variable bound in two clauses (496993c)
gryphon: rule multi-MATCH as union and refuse a variable bound in two clauses (d71112e)
guards: workflow jobs run repo Python on the interpreter requires-python names, never the runner's (e08f5b0)
guards: workflow jobs run repo Python on the interpreter requires-python names, never the runner's (dc19751)
localexec: the pre-commit hook catches a host-syntax violation before the push (6531fdb)
release: the manifest carries the version, written beside the tag (f990f86)
release: the manifest carries the version, written beside the tag (github_core declares 0.1.0, ships v0.7.0) (634b6ad)
serving: DEBUG defaults false; SECRET_KEY and DB credentials fail closed (9d4335e)
serving: DEBUG defaults false; SECRET_KEY and DB credentials fail closed (61f4f6f)
serving: decide the twenty-six gunicorn 26 settings, and ratchet defaults by value (826449e)
serving: enumerate every gunicorn setting, and pin the parsing/proxy knobs (c0957f0)
serving: state every gunicorn knob, and heartbeat into RAM (000aecb)
serving: state every gunicorn knob, make the four time budgets one policy (85a4222)
serving: the image declares a health check, and it cannot be a lie (a6581ad)
serving: the image declares a health check, and it cannot be a lie (5f131c0)
viz: a graph panel's nav_rules can route a node to a parameterized page — url_template takes {data.<field>} placeholders, and one with no value voids the link (b789e2d)
viz: nav_rules can route a node to a parameterized page (e1d4402)
deps: update dependency tabulator-tables to v6.5.3 (6b94ba8)
deps: update dependency tabulator-tables to v6.5.3 (9a13aa9)
docker: detect architecture with uname, not dpkg — the tailwind installer could not run on the Wolfi web image (626fc1d)
docker: the tailwind installer detects arch with uname, not dpkg (2146d1d)
grid,cares: a 255-character schedule name must not make a schedule unfireable (15ca611)
grid,cares: a batch nobody named still gets a true name — and one fire stops opening three (bf7e530)
grid,cares: a batch nobody named still gets a true name — and one fire stops opening three (a94262a)
grid,cares: applied_batches is bound to the run's own produced batches, and a run can say it read no surfaces — Codex on #577 (b85d304)
grid,tap: the corpus JSON files carry the cascade role and its schema stem; a stale unaccounted baseline entry goes — two guards on #582 (92e4f67)
grid: a batch-level write failure fails the import batch — BatchWriteResult.errors was never read, so spine sync and close ran on top of the rollback (Codex, Issue# 605) (f43048c)
grid: a batch-level write failure fails the import batch — spine sync and close no longer run on top of a rollback (Codex, Issue# 605) (1ca41f9)
grid: a candidate is one (entity, surface) and a verdict names its surface — ownership is judged per parent's listing; the scrubber reads JSON-shaped and quoted secrets; the malformed-evidence log is scrubbed (round 7, PR# 646 - tap) (b5e37e4)
grid: a creation time that is not an ISO 8601 string is malformed evidence, never "no creation time"; each falsifier is handed its own deep copy of the context (round 8, PR# 646 - tap) (b353377)
grid: a delete locks its target row so the replay no-op holds under concurrency, and the no-op warning carries no retirement time (34e985e)
grid: a parent the grid holds no owner for is present, not a transfer (Option A) — warnings at the directed-graph corner cases, the reading documented, the ownership family in the cascade corpus (Issue# 650 - tap) (17a0e99)
grid: a parent the grid holds no owner for is present, not a transfer (Option A); the falsifier and the cascade warn at the directed-graph corner cases; the reading is documented in both specs and pinned as the cascade corpus's ownership family (a2aff08)
grid: a ref that misses beside an explicitly addressed new node with the same declared values is refused too — the batch's identity keys are seeded with the explicit nodes' keys (Grok on #604) (b4ec4a8)
grid: a ref that resolves to a row this batch also addresses by id, or names as a removal target, is refused — preflight's checks saw the provisional id, so they are re-applied to the resolved one (Codex, Issue# 606) (df8aa90)
grid: a rejected probe with no status at all is dropped like one with an unknown status; a manifest falsifier class is type-checked before it is instantiated (round 11, PR# 646 - tap) (b75be4a)
grid: a repeat delete is a silent no-op, and an explicit blank reason is refused — Issue# 575 / 576 - tap (67e73e3)
grid: a repeat delete is a silent no-op, and an explicit blank reason is refused (Issue# 575 / 576 - tap) (287cba6)
grid: a verdict carries both sides it compared and the dispatch re-derives the classification from them; duplicate and stray answers fail closed (Codex round 2, PR# 646 - tap) (00622e0)
grid: a verdict its own probe contradicts is refused, probe and exception text is scrubbed before it is recorded, and the verdict write re-reads the batch under a lock (Codex round 1, PR# 646 - tap); the harness raises instead of asserting and the coverage check drops its try/except/continue (Codacy) (82f3cc6)
grid: an incomplete found probe is a refusal, never a destructive classification; the present-at-probe cause is derived per surface for an entity recorded on two (round 5, PR# 646 - tap) (67f7b0c)
grid: annotate the natural-key backfill's bulk_update as a sanctioned below-service write (d2a5f35)
grid: clear leftover hashed keys in a data migration and stop exempting the sentinel module from the inertness ratchet — Codex on #564 (eb07162)
grid: collision-safe search-index names, an AST caller scan, and the unused Path import — Codex and Codacy on #566 (bce3aba)
grid: delete two try/except/continue blocks that guarded an impossible state and hid real ones (2db27ae)
grid: deletes lock in one global order and recompute the closure under locks; conditional endpoint tombstone; deadlock → write_conflict (#590) (1ac108d)
grid: deletes take their row locks in one global order and recompute the closure under them; the endpoint tombstone is conditional; a deadlock is a typed write_conflict (bd2c6b5)
grid: discovered nodes are excluded before the slice, and a scanned app dir that is missing fails loud — Codex and Grok on #569, round 2 (6e21b2d)
grid: hand-built expected terms are normalised at the record boundary, so an extra key fails one entry's evidence, never the whole record (round 6, PR# 646 - tap) (1ad6668)
grid: loader ref universe typed as a set — mypy (5b36100)
grid: malformed plugin evidence is rejected inside the fail-closed boundary; one entity under two parents is judged once and recorded on both surfaces; a containment edge the validator cannot read makes every owned model a coverage target (round 4, PR# 646 - tap) (793a364)
grid: narrow the undeclared case before iterating a natural-key declaration (73f5793)
grid: no live edge may point at a tombstone — edge creation locks its endpoints and refuses a tombstoned one, the importer treats it as dangling, and every mutating verb locks its target row before deciding on deleted_at (fcc131b)
grid: no live edge may point at a tombstone — locked endpoints on edge creation, live-only dangling check, every mutating verb locks its target (Issues# 609, 611) (6fdde52)
grid: no production writer of the run's reconcile configuration exists (test arming moved into the test harness); the delete backstop accepts grid.reconcile only inside the verb's apply scope — the real collector actor, which holds reconcile and not delete, now applies a tombstone, and still cannot delete elsewhere; reconcile and the terminal SUCCESSFUL write are one transaction; INTERNAL_ONLY on the arming switch is pinned (review round 3, PR# 653 - tap) (677522b)
grid: provenance is attributed event by event, and a tombstone's ending is its first recording event (Codex, PR# 637 - tap) (69c0e14)
grid: reconcile apply scope bound to the verdict's row; transfers fenced on their edge; collectors walk forbids the write-guard scopes (PR# 653 round 4) (b0cadd3)
grid: refuse two refs in one batch that describe one source object, by the derived identity key (gate, Issue# 602) (4a77e13)
grid: rejected evidence with a status outside the closed set is dropped from the entry rather than failing the record; quoted multi-word secret values are one value; Probe.detail names its contract — never a response body (round 10, PR# 646 - tap) (c10adcb)
grid: the ambiguous-surface warning gets its own log site (log-site uniqueness guard, PR# 646 - tap) (72843f9)
grid: the apply fence re-asserts the derivation invariant under the locks — a node this run observed that sits in the closure now (re-parented with only a link event) contradicts the tombstone; the collectors-never-retire walk forbids the lock-taking closure read (review round 4, PR# 663 - tap) (c3206ee)
grid: the apply-time contradiction fence reads the closure the way the cascade does before writing — snapshot, lock, re-discover under the locks until stable — so a descendant attached after the first look is checked and cannot be cascaded over; proven by a late attach landing between the two looks (review round 1, PR# 663 - tap) (304c2ad)
grid: the batch stamp is checked on edges and on tombstones too (Codex, PR# 637 - tap) (aee844e)
grid: the batch-name clamp covers authored names too — say so, log it, test it (3a586a5)
grid: the candidate record's clock is taken before derivation reads anything, so an observation that lands while derivation is still running is after the clock and the apply fence refuses the tombstone (review round 3, PR# 663 - tap) (5d52e5a)
grid: the cap bounds discovery, an unknown cascade value is refused, and the walk's edges record provenance — Codex on #569 (f38d7d6)
grid: the closure read takes no caller-supplied cap; the locked form is its own gateway gated by grid.reconcile (taking row locks is not a read); the apply fence counts an observation in a still-open batch — only a failed batch is known to have rolled back (review round 2, PR# 663 - tap) (4c341dc)
grid: the completeness statement is fenced like the candidate record; probe and expected identity fields are scrubbed, including URL userinfo (round 9, PR# 646 - tap) (38c752d)
grid: the corpus checks every retirement bumps its version once and edge events carry the root and inherited metadata; an undeclared family — Codex on #582, George (4fb170e)
grid: the corpus runner raises BuildError instead of asserting — Codacy (Bandit B101) on #582 (4796331)
grid: the datasets requirement carries a disposition and the Validation Map is regenerated (PR# 637 - tap core_ci) (2b3f5af)
grid: the issue-shape ratchet enforces #610 too, and the delete/delete schedule pins its observed two events (Codex round 3, PR# 637 - tap) (32ef435)
grid: the natural_key help_text says uuid8 over SHA-256, which is what the code does (acb91fc)
grid: the oracle is a set-based fixed point with depth-derived discoverers, pending is verified by shape, and the checker is proven against corrupted runs — Codex #586, #587, #588 (061bdcb)
grid: the reconcile apply scope licenses a delete of the verdict's row only — write_batch hands the delete ops' targets to the backstop, which compares them to the licensed set; a transfer is fenced on the edge it ends (a re-created ownership edge carries a link event and no update on the child); the collectors-never-retire walk forbids the write-guard scopes and the run's arming key (PR# 653 - tap round-4 findings) (f76dc75)
grid: the reconcile delete licence is derived from the verdict entry, never from the operation — an operation formed for the wrong row is refused rather than licensed by its own target; proven with a broken-on-purpose operation under the collector actor (review round 1, PR# 658 - tap) (17198b3)
grid: the retirement checks live in the pipeline, the walk is iterative and bounded, and audit is fail-closed — Codex and Grok on #568 (6679832)
grid: the run's reconcile configuration rides into the lifecycle batch at creation (cold-boot: no row saved outside the service); the config parse fails closed on every axis; an unparsable candidate clock refuses the pass; only reconcilable candidates count against the budget; a failed reconcile phase is visible on the job; the never-retire walk sees verbs spelled as strings and the internal bypasses (review round 2, PR# 653 - tap) (20cb403)
grid: the seeding boundary strips a retired-type node named by ref, and drops the edges that name it by ref — Grok on #597 (bdf1b6f)
grid: the shared-parent check is advisory in fact as well as in name — a failure inside it is logged and the cascade proceeds (review round 2, PR# 651 - tap) (9e83529)
grid: the shared-parent warning excludes the cascade root and bulk-loads outside parents (three bounded queries under the locks); the owner-not-compared note attaches to PRESENT verdicts only (review round 1, PR# 651 - tap) (b6e3c96)
grid: the timing family recognises #590's second shape — a double write with no deadlock — and two implementation claims are re-stamped (f41fbad)
grid: the verb takes no policy from its caller — authority and budget are stamped on the lifecycle batch when the run is opened and read from nowhere else; judging, every write and the record are one transaction with each target locked before the fence; collector modules may not name the verb or the stamp either (review round 1, PR# 653 - tap) (f6e2ed8)
grid: two refs in one batch that describe one source object are refused by the derived identity key — resolution precedes the batch's writes, so the search alone cannot see the first of the pair (bd2ff33)
grid: type the natural-key tests so the mypy ratchet holds (fd295bb)
grid: type the registry lookup in the explicit-key helper and the removal policy in its test — the mypy ratchet on #604 (240273b)
grid: verdicts are refused when the candidate record changed under the probes; a hand-built probe dict is scrubbed at the record boundary; a qualifier on the wrong verdict is a contradiction; context extras are one read-only view and never a credential (round 3, PR# 646 - tap) (e7db31e)
grift: every decoder failure is a structured refusal and one UUID has one spelling — the parse boundary catches what the decoder raises, refuses repeated keys and non-finite numbers, pins grift_version to "0", canonicalises every id once, and names the path when the database refuses a string (d769a95)
grift: every decoder failure is a structured refusal, and one UUID has one spelling — the parse-boundary and id-canonicalisation cases from the bad-batch review (Issue# 630 - tap) (ed525a1)
gryphon: mktemp template must end in XXXXXX — the image's BusyBox mktemp refuses a suffix (d2bd727)
gryphon: refuse a non-integer band start, graph count or query count before bash arithmetic (3b1da9e)
gryphon: satisfy the mypy ratchet by typing the union fixture, not by raising the baseline (2013ecf)
gryphon: the dev scripts find the corpus through the installed plugin — and refuse when it is absent (ad779e9)
gryphon: the dev scripts find the corpus through the installed plugin — and refuse when it is absent (df9e15e)
gryphon: the kept campaign summary is installed 0644 — a mktemp'd 0600 copy is unreadable across the bind mount (23bb90c)
guards: runner-interpreter exemptions scope to one command; absolute paths and conditional setup no longer fail open (702943f)
guards: runner-interpreter guard raises instead of asserting, so python -O cannot switch it off (e83bbb8)
lane: answer all three scanner rules — and restore the marker I deleted (2396759)
lane: answer the partial-path rules at the line, with the reason (727aba0)
lanes: --ignore=<dir> is an option carrying a path, and cold-boot stays on the union (27a5c7f)
lanes: mark the two residual scanner findings at the line, with their rule ids (1d0c42d)
lane: spawn this interpreter, not a name resolved from PATH (0e1c158)
lanes: the house bandit markers for the runner's one subprocess call (ba4fbe1)
lanes: the wheel-install skip guard actually fires, and a count the reporter hid is not a red (9e47fce)
lanes: validate the runner's argv and the record path at the sink (b9772be)
localexec: interpreter options must not hide a host-run call site (d835ca7)
release: re-verify freshness against origin after the gates, not only before (239312a)
release: the gates certify the tree that gets tagged, and the suite proves it is that tree (d84d4c5)
sbom: annotate the test helper and re-render the traceability fragment (c93264e)
sbom: assert the shared parser structurally, not by object identity (8d15267)
sbom: derive copied-image versions from the Dockerfile pin, not the manifest (1a12a33)
sbom: derive copied-image versions from the Dockerfile pin, not the manifest (476bf6d)
sbom: derive from the LAST writer of a path, and ban a versioned purl_base (3fa4c17)
sbom: narrow the components list before iterating it (48fa322)
sbom: parse the version each FIPS identity field asserts, don't search it (514996a)
sbom: refuse an ambiguous producer instead of resolving it (0583e5e)
scan: an all-parse-fail root is a vacuous walk too (62de473)
scan: decide scanner scope below the root, refuse absolute paths, and fail on an empty walk (2a99dbc)
scan: decide scanner scope below the root, refuse absolute paths, fail on an empty walk (e33f84c)
serving: correct three claims the AI review caught in the health check (34982d7)
serving: exec gunicorn directly so the arbiter is PID 1 (f090f37)
serving: exec gunicorn directly so the arbiter is PID 1 and reaps orphans (7c3c8a9)
serving: keep the venv env uv run provided across the direct exec (34e0ac6)
serving: key the Assembled-instance health Map row to the requirement it covers (7ac8243)
serving: make the four time budgets one policy, and correct #495 (6144417)
serving: name Swarm, where this health check stops being informational (90d3bc9)
serving: name the fingerprints for what they are, not for what they hash (a1384a3)
serving: refuse a non-finite statement bound, which defeated the check unordered (e0feb9b)
serving: refuse GUNICORN_CMD_ARGS, which outranks the whole config file (7384ddb)
serving: signal delivery is OBSERVED — reconcile budget 4 with #502's measurements (ab298a3)
serving: stop the GUNICORN_CMD_ARGS refusal from echoing what it refused (5a41198)
serving: the ambient probe must replay every platform family, not one fake one (b631e1c)
serving: verify the heartbeat directory is RAM, not merely present (aec011e)
specs: drop the nested quantifier from the Status: capture (f4fbac3)
specs: the Status: parser is linear, and matches exactly what it matched (28326a1)
specs: the Status: parser is linear, and matches exactly what it matched (54ba0ed)
test: annotate the row helper's local so mypy stops returning Any (ad0a4a3)
test: annotate the spine helper and narrow entity_id — the mypy ratchet caught two real defects (da05318)
test: generate the spoiled dev DB password instead of writing a literal (4e2ed65)
test: keep the credential-shaped example out of the comment prose (4b340ac)
tests: import SEARCH_READONLY from its canonical home, not through settings (a76581a)
viz: a nav target must be a same-origin path or an absolute http(s) URL (e4e5697)
web: an fr row off a full_bleed page keeps its intrinsic height instead of clipping to a share of nothing (41f5af3)
web: an fr row off a full_bleed page keeps its intrinsic height instead of clipping to a share of nothing (b8d28c9)
web: point the Tailwind plugin globs at where plugins actually live (52ab982)
web: point the Tailwind plugin globs at where plugins actually live [BLOCKED: CSS not regenerated] (b1b925f)
web: synthetic page prints panel HTML without |safe; a failing panel no longer renders its exception text (deebf99)
web: synthetic page prints panel HTML without |safe; a failing panel no longer renders its exception text (a0df238)
Documentation
build-collector: say how to prove a collector in tests, and that fixtures never ship (56c54e6)
build-collector: say how to prove a collector in tests, and that fixtures never ship (9a911a9)
cares: the authz-coverage citations name the context the fire writes actually carry (1730ca6)
ci: say what the artifact confinement bounds and what it does not (33efc9c)
ci: state the after-tests hook's trust boundary in the file; drop review-seat attributions from comments (f61d552)
grid: gate slice 3 — the gate recorded as decided and landed (shape A, B struck), the tombstone-reimport probe pinned, rows 2 and 3 flipped (closes #595, #571) (1fa76f3)
grid: re-stamp the edge-schema implements claim after the spec row changed (Part-of: unified-systems-com/tap#660) (2c9f071)
grid: retarget the edge-schema enforce flip from 0.2.0 to 0.3.0 — 0.2.0 is cut on the natural-key breaking change before the schema burn-down, so its contract must say warn, not enforce (ruled 2026-09-19) (2d48a18)
grid: retarget the edge-schema enforce flip from 0.2.0 to 0.3.0 before 0.2.0 is cut (94495b0)
grid: say why the except clause has no parentheses and why both batch dispositions are unioned — Grok on PR# 600 - tap (70aa6b1)
grid: the batch execution rules say a batch-level write failure fails the batch; importer claim re-stamped (ab97c1b)
grid: the gate is recorded as decided and landed — shape A, shape B struck with the prior art; the tombstone-reimport probe pinned as a regression test; -2 and -3 flip on the tests that already pin them (gate slice 3) (6d3b0ec)
grid: the key-document section states v8 over SHA-256 up front, not v5 four paragraphs later (4bc6b96)
grid: the model and edge skills teach the delete tree; warn-at-boot for E004 is a Backlog row; implementation claims re-stamped — George, and the three reds on #589 (9f81300)
gryphon: carry the unbuilt join as shape-7 so the gap stays in the table (Codex on PR# 434) (3583aa5)
gryphon: record multi-MATCH as union-not-composition on every surface a reader lands on (fb812cf)
gryphon: record multi-MATCH as union-not-composition on every surface a reader lands on (5e198e4)
misc: plugin SOP priority catalog — TAP's in-repo practices ranked as a plugin baseline (0ddf1b0)
sbom: name the tag-is-not-the-digest residual beside the derivation (0e81de4)
serving: name the follow-up issue for the remaining dev-credential literals (dafa3c4)
serving: name the two things the knob ratchet does not catch (efda414)
serving: narrow the fail-closed claim to what the gate actually covers (4f1f2d9)
serving: point the two named hazards at the issues that decide them (16d254c)
serving: say what the heartbeat check does NOT cover, and drop the imperative (c830db7)
skill: add-panel gains the graph-panel rules that bit (af06db1)
skill: add-panel gains the graph-panel rules that bit — the scene search is where a graph panel's cost and its silence live (aec0208)
skill: deleting live grid edges is flagged as a destructive operator action, not a build step (30032cb)
skills,misc: cross-plugin endpoint guidance in four skills + the plugin SOP priority catalog (a9974d3)
skills: a closed endpoint list naming another plugin's types is the defect, not the wildcard (c7693fa)
skills: add-edge — a wildcard only for a genuinely open end; a finite foreign set stays a declared closed list (e73bee4)
skill: the agent reads the local gridkin spec; the repo URL is a human pointer (fea4c7f)
spec: point the row-heights requirement at a heading that exists (43f6a7a)
specs: review readiness — structured evidence and a GitHub merge gate (Codex draft, all Proposed) (9b03d0c)
specs: review readiness — structured evidence and a GitHub merge gate (Codex draft, all Proposed) (970cb29)
specs: traceability fragment for the readiness draft, and the ai-review cross-reference it needs (b2f6f67)
trace: sync the fips traceability fragment for the three new conformance ACIDs (9b2e884)
validation: suite ownership per lane; the Map, the claims and the promote script say core_ci is the gate (59175cd)
viz: the ACID row states the refused nav targets alongside the void rule (4aa7dad)
web: anchor the Tailwind globs to the container's /app, not the host (6aa601a)