What's Changed

• Advance the Action default and current guidance to published SpecSync 6.2.0 by @0xLeif in #867
• fix: stop waiting on a descendant pipe after a Git child exits (#854, #855) by @0xLeif in #864
• fix(change): anchor history pathspecs with :(top) so subdirectory projects see archived history (#851) by @0xLeif in #868
• Merge parallel edits of one module spec without a conflict by @0xLeif in #865
• Fix: stop tests from exec'ing a script they just wrote (ETXTBSY) by @0xLeif in #888
• Ask git each repository fact once per command and qualify under cargo-nextest (#861) by @0xLeif in #869
• Fix: let change check --commit run in a project rooted in a repository subdirectory by @0xLeif in #890
• Fix: nested same-root scopes share one cat-file --batch reader (#891 item 1) by @0xLeif in #894
• Fix: a refused PR comment no longer fails a passing Action check (#886) by @0xLeif in #896
• Teach archive-first closeout in the README and run its workflow example as a test (#881, D5) by @0xLeif in #898
• Fix: name a change already archived on the remote default instead of wedging it by @0xLeif in #889
• Retire the contract clauses that promise change check runs configured verification commands (#848) by @0xLeif in #899
• Retire the merge empty-list and init strict-default contract clauses (#884) by @0xLeif in #913
• Fix: start the Linux release downloads on glibc 2.35 and add an ARM64 musl fallback (#882) by @0xLeif in #910
• Show the steps between change new and approve on the landing page; approve refusals name the change answer command (#883, D11) by @0xLeif in #912
• Fix: ship-status stage advertises only a command its state accepts by @0xLeif in #916
• Refuse open tasks at check, review, finalize and ship, and name the command that recovers (#892) by @0xLeif in #903
• Describe the CLI recursion guard as refusing an inherited verification context (#911) by @0xLeif in #935
• Fix: let a change reviewed before its send-back be reviewed again after re-approval (#914) by @0xLeif in #944
• Fix: approve refusal hints are draft-only, cover the scope answers and show single choices; the Quick Start commits what it made (#917) by @0xLeif in #936
• Fix: start CI on every pull request and let classify pick the lane (CI-6) by @0xLeif in #951
• Fix: the documented workflow tests run the local verify step before the review; the landing page shows it and says to fill in the scaffold (#906) by @0xLeif in #952
• Update: close the finished Chough sessions so a fresh worktree can enter Chough by @0xLeif in #941
• perf(change): archived status stops walking history per archive and per workflow-v1 change; read commands take --timeout (S9) by @0xLeif in #918
• Fix: report a corrupt archive's handoff as not yet and name the restore that recovers it (#880) by @0xLeif in #901
• Fix: never tell a copy already archived upstream to run ship (#902) by @0xLeif in #963
• Fix: a send-back cancels the review recorded before it, even after an identical re-approval (#960) by @0xLeif in #969
• Reuse a cached validation snapshot or read-cache verdict only in the build that wrote it (#878) by @0xLeif in #920
• perf(change): one history walk answers every archive's workflow-version history; cold archived status no longer grows with archives (#915) by @0xLeif in #979
• Fix: find an upstream archive by the id in its state record (#907) by @0xLeif in #943
• Record relayed human decisions on approvals and reviews as claims, not authentication (#633) by @0xLeif in #900
• Fix: reopen hashes clean delivery blobs one at a time instead of overflowing one Git read (#976) by @0xLeif in #984
• Fix: assert on the review ledger, not record inequality, in the same-second review test (#977) by @0xLeif in #980
• fix(change): an unreadable cutoff archive tree is a read failure, not an absent change (#939) by @0xLeif in #988
• Update: close the finished Chough sessions from #901, #963, #969, #980 and three siblings with chough doctor by @0xLeif in #993
• fix: SpecSync's Git ignores history-rewriting environment, cleared once at startup (#983) by @0xLeif in #996
• perf(change): a warm archived status no longer digests the working tree for its review currency (REQ-change-147) by @0xLeif in #989
• Repair a damaged relayed decision with one command, whether or not it is committed (#904) by @0xLeif in #995
• Fix: a clean merge-driver result keeps what both sides wrote (#870 #872 #875 #876) by @0xLeif in #1006
• Fix: stop review and finalize when the upstream archive cannot be read (#946, #962) by @0xLeif in #967
• Add: specsync doctor reports every change problem with its fix and closes merged changes late where older SpecSync never reads (#833) by @0xLeif in #994
• Fix: report production source no declared module owns before approval, and never call such a change ready to finalize (#986, #956) by @0xLeif in #999
• Fix: approval refusals and status name the same runnable answer command; a single choice prints literally (#958) by @0xLeif in #1015
• Disclose verification commands change check/audit configured but did not run (#893) by @0xLeif in #1016
• Fix: merge driver installation matches contracts when specs_dir is the repository root (#871) by @0xLeif in #1017
• fix(change): the timeout resume command runs exactly as printed and clears SPECSYNC_TIMEOUT (#923, #953) by @0xLeif in #1004
• Leave relayed decisions out of approval succession, the definition digest and the trusted correction history (#926, #927, #971) by @0xLeif in #1014
• Fix: record the attestation on every green main push; keep the PR summary red over a failed or blocked gate (CI-9, CI-10, #798, #799) by @0xLeif in #1010
• Add: retire obsolete reopened changes without acceptance by @0xLeif in #1018
• Fix: the corrupt-archive recovery step names summary.terminal_evidence.reason, where change status --json prints it (#966) by @corvid-agent in #1019
• Fix: lint the test code too: clippy --all-targets in CI and the verify lane (CI-8, #608) by @0xLeif in #1007
• fix(change): read deadlines never panic and stop at every long read phase (#924, #925, #954) by @0xLeif in #1005
• fix(change): the workflow-v1 cutoff check also considers the change's own archive directory (#940) by @0xLeif in #987
• Fix: a sequence-ledger freeze outranks the upstream-archive guidance (#908) by @0xLeif in #934
• Fix: keep retired custody valid across audited custodian drift so reopen stays reachable (#1021) by @0xLeif in #1023
• fix(import): --from-dir preserves source frontmatter, sections and files by @0xLeif in #1022
• fix(report): state the --require-coverage verdict when staleness decides the exit by @0xLeif in #1029
• fix(change): approve accepts a sent-back change's revised body for a requirement it added by @0xLeif in #1030
• fix(deps): one missing dependency is one error by @0xLeif in #1032
• fix(coverage): report unspecced modules in a stable sorted order by @0xLeif in #1033
• test: race guards run under --release in the release-candidate lane (CI-11) by @0xLeif in #1031
• fix(change): review refuses to pass a change finalize would refuse on ownership by @0xLeif in #1034
• fix(change): re-approval accepts an unchanged delta body that already carries the moved canonical text by @0xLeif in #1035
• fix(...

What's Changed

• Draft scope: advance the Action default and archive-gate examples to published SpecSync 6.1.2 by @0xLeif in #836
• fix: bound historical receipt reads and audit anchored review recovery by @0xLeif in #837
• feat(change): reconcile anchored receipts with explicitly unproven history by @0xLeif in #838
• fix(change): name the spec to edit when approve refuses an unowned affected path by @corvid-agent in #841
• perf(change): answer archived change status from a digest-keyed read cache by @corvid-agent in #840
• fix(change): deterministic ownership hint with a depth-0 fallback (#841 review nits) by @corvid-agent in #853
• perf(change): finalize an archive in seconds on Raven (REQ-change-121) by @corvid-agent in #842
• fix(change): refuse a stale MODIFIED delta instead of overwriting newer text (#843) by @corvid-agent in #845
• feat(change): send an approved change back to draft for re-scoping (#844, option A) by @corvid-agent in #846
• Fix: share one read cache across worktrees when the checkout path runs through a symlink by @0xLeif in #857
• perf(change): finalize validates only the change it archives; full archive-history walk is change audit --archives (#856) by @0xLeif in #858
• Prepare SpecSync 6.2.0 release candidate by @0xLeif in #859
• ci(release): give the macOS release candidate qualification 75 minutes by @0xLeif in #860

Full Changelog: v6.1.2...v6.2.0

What's Changed

• fix(hooks): prevent shell evaluation in scoped failure diagnostics by @0xLeif in #818
• refactor(mcp): extract cohesive private modules by @0xLeif in #819
• Split issues command integration tests into a real module by @0xLeif in #820
• Fix active audit coverage for finalized policy migrations by @0xGaspar in #821
• Draft scope: report an edited approved semantic delta as an invalid approval in change status by @0xLeif in #823
• Draft scope: run the effective-contract gate on the first change check and record its refusal by @0xLeif in #824
• Archive-first CI: nothing runs or merges until every change is archived by @corvid-agent in #832
• Draft scope: write generated Markdown and hook files without em or en dashes (#827) by @0xLeif in #829
• Draft scope: report approved delta requirement IDs per module in change status and show JSON (#826) by @0xLeif in #828
• Draft scope (#825): opt-in verification_ignored_paths for another tool's records by @0xLeif in #830
• Prepare SpecSync 6.1.2 patch release candidate by @0xLeif in #822
• Draft scope (#768): keep check --fix export rows in the table that holds exports by @0xLeif in #834
• Draft scope: qualify the 6.1.2 candidate on macos-15 and ship #834 in 6.1.2 by @0xLeif in #835

Full Changelog: v6...v6.1.2

What's Changed

• Fix Cargo crate source binding during generation by @0xLeif in #814
• Fix discovery regressions and prepare SpecSync 6.1.1 by @0xLeif in #816

Full Changelog: v6.1.0...v6.1.1

What's Changed

• Make it obvious when a pull request is archived by @0xLeif in #804
• Refuse a fenced plan and keep a damaged change directory open by @0xLeif in #805
• Show lessons from an optional module 3md file by @0xLeif in #806
• Add a 3md context and lesson file beside each module spec by @0xLeif in #808
• Refuse a broken policy and commit the archive move by @0xLeif in #807
• Split source files so none is longer than 5,000 lines by @0xLeif in #810
• The handoff must not claim a commit it did not check by @0xLeif in #811
• Release SpecSync 6.1.0 by @0xLeif in #812

Full Changelog: v6.0.1...v6.1.0

What's Changed

• chore(lifecycle): finalize floating v6 change after squash orphaned evidence by @0xLeif in #784
• chore(lifecycle): archive floating v6 change (empty active workspace) by @0xLeif in #785
• docs: clarify v6 lifecycle recovery by @0xLeif in #786
• Adopt hi: record what spec-sync should be, as 159 criteria by @0xLeif in #787
• Add: the hi habit, so intent gets written before the work by @0xLeif in #788
• chore(lifecycle): re-anchor add-a-hi-check-gate-to-ci after #787 squash by @0xLeif in #790
• chore(lifecycle): archive add-a-hi-check-gate-to-ci (do not merge until archive tip) by @0xLeif in #791
• Docs: put Install first on the README by @corvid-agent in #793
• Add: high-level design doc with Mermaid diagrams by @0xLeif in #794
• Fix: lifecycle commits stage only what the change owns, never git add -A by @0xLeif in #795
• Fix: Required CI gate fails when the lifecycle gate fails (#796) by @0xLeif in #797
• Name clean Git files by object id so change check accepts an LFS pointer by @0xLeif in #801
• Chore: pin Trust 1.2.1 by @0xLeif in #792
• Chore: release SpecSync 6.0.1 by @0xLeif in #802
• Chore: archive the SpecSync 6.0.1 release change by @0xLeif in #803

Full Changelog: v6...v6.0.1

What's Changed

• docs: document the 5.2.0 lifecycle surfaces and refresh the AGENTS.md quick reference (CHG-0061) by @0xLeif in #409
• Update: archive accepted CHG-0061 documentation change by @0xLeif in #410
• Fix: harden MCP security and GitHub issue boundaries by @0xLeif in #446
• chore(lifecycle): archive merged MCP security changes by @0xLeif in #464
• fix: compact idempotent summary rows, trailing newline, well-formed rows, counts/pluralization (closes #417) by @0xLeif in #447
• chore(lifecycle): archive CHG-0065 after #447 by @0xLeif in #465
• fix(merge): resolve spec conflicts losslessly and truthfully by @0xLeif in #448
• chore(lifecycle): archive CHG-0066 by @0xLeif in #468
• fix(change): deduplicate overlapping Git index entries by @0xLeif in #469
• chore(lifecycle): archive CHG-0067 evidence by @0xLeif in #470
• feat: stabilize the SpecSync 6.0 workflow by @0xLeif in #480
• chore(lifecycle): re-verify CHG-0068/0069 on main tip by @0xLeif in #484
• Docs: refresh workflow and agent pack for SpecSync 6.0 by @0xLeif in #482
• fix: combine open pre-6.0 fix PRs onto SpecSync 6.0 by @0xLeif in #483
• fix(change): heal reopen closing-approval recovery (#445/#481) by @0xLeif in #485
• fix(change): living ADDED REQ gate + draft next_action completeness by @0xLeif in #486
• chore(ci): remove duplicate Trust test suite by @0xLeif in #491
• feat(release): bind publication to immutable RC by @0xLeif in #492
• fix(ci): reuse product CI provenance across metadata descendants by @0xLeif in #494
• refactor(ci): delete the CI reimplementation of the SDD lifecycle by @0xLeif in #499
• fix(change): stop the lifecycle from wasting a verification cycle by @0xLeif in #500
• chore(lifecycle): re-verify and review CHG-0079/0080 on main tip by @0xLeif in #501
• chore(lifecycle): archive CHG-0079 and CHG-0080 by @0xLeif in #502
• fix(change): three lifecycle usability fixes found by sandbox drills by @0xLeif in #503
• fix(ci): let documentation-only PRs reach the required gate by @0xLeif in #505
• fix(change): make the lifecycle's terminal step reachable by @0xLeif in #507
• chore(lifecycle): finalize CHG-0085 and CHG-0086 by @0xLeif in #509
• fix(ci): decide pull requests in seconds instead of minutes by @0xLeif in #510
• fix(ci): catch evidence a squash merge orphaned, and finalize CHG-0087 by @0xLeif in #512
• fix(ci): catch verification evidence a squash merge discarded by @0xLeif in #513
• chore(lifecycle): finalize CHG-0088 after squash merge by @0xLeif in #516
• docs: 6.0 findings, decisions, and the archival design by @0xLeif in #504
• feat(change): add change check --commit to perform the sequence it requires by @0xLeif in #506
• feat(change): add change ship-status for local ship readiness by @0xLeif in #514
• fix(change): harden approve ownership skips and correct-owner comments by @0xLeif in #515
• chore(lifecycle): finalize CHG-0090 on main by @0xLeif in #517
• feat(change): buttery ship-status tip class and ship preflight by @0xLeif in #518
• feat(change): multi-active ship ordering + finalize CHG-0092 by @0xLeif in #520
• fix(change): same-PR archived packages cover path delivery by @0xLeif in #521
• fix(change): reject hash TODO artifact headings at approve by @0xLeif in #522
• fix(change): floor CHG sequences on remote ledger + multi-clone BASE docs by @0xLeif in #523
• fix(change): stop text-mode guidance loading correction digests (CodeQL #58) by @0xLeif in #524
• fix(site): upgrade Astro to 7.2.0 for Dependabot XSS #12–#14 by @0xLeif in #525
• fix(change): keep legacy reconstruction when worktree cleanup fails (#511) by @0xLeif in #526
• feat(change): live GitHub check-run trust in ship-status (#487) by @0xLeif in #527
• feat(change): ship --push/--wait multi-tip archive orchestration (#487) by @0xLeif in #528
• Fix: fail closed correction-ledger lifecycle views by @0xLeif in #531
• refactor(6.0): sever check from the trust layer, gate drift by default, and make verification currency content-only (steps 1, 1.5, 2) by @0xLeif in #543
• fix(6.0): make the first five minutes work — init, scaffold, and directory mappings (#472) by @0xLeif in #544
• fix(6.0): stop reporting success for checks that did not happen (#545, #547, #548) by @0xLeif in #552
• fix(6.0): a symlink under a source dir is skipped and disclosed, never an abort (#546) by @0xLeif in #555
• fix(6.0): report the specs dependency analysis dropped instead of calling a malformed graph valid (#550) by @0xLeif in #557
• fix(6.0): report all four checks that frontmatter parse failure prevented (#553) by @0xLeif in #559
• fix(6.0): a tree with source and no specs must show its coverage and fail --strict (#560) by @0xLeif in #563
• fix(6.0): staleness detection must refuse a repository with no commits (#558) by @0xLeif in #565
• fix(6.0): a delta section body may contain subheadings, so scaffolded specs can be changed (#564) by @0xLeif in #566
• fix(6.0): a fix request that could not be applied must be reported, not reported as success (#549) by @0xLeif in #567
• fix(6.0): viewing a module that does not exist must fail, not print nothing and succeed (#551) by @0xLeif in #568
• fix(6.0): coverage over zero source files must report nothing measured, not 100% (#562) by @0xLeif in #575
• fix(6.0): an unloadable config file must refuse to run, not silently use defaults (#570) by @0xLeif in #580
• fix(6.0): comment must exit with the verdict it prints (#571) by @0xLeif in #584
• fix(6.0): coverage over zero source files must report nothing measured everywhere (#582) by @0xLeif in #588
• fix(6.0): staleness that cannot be measured must be refused, not reported as zero drift (#572) by @0xLeif in #590
• fix(6.0): a tree with unresolved merge conflicts must be refused, not unioned (#578) by @0xLeif in #591
• fix(6.0): every output format must report the same set of findings (#576) by @0xLeif in #594
• fix(6.0): the config refusal must guard both loaders (#583) by @0xLeif in #593
• fix(6.0): an unmeasured staleness count must be unknown, and a malformed config header must be reported by @0xLeif in #595
• fix(6.0): every command deriving a module's API must honour the configured export level (#474) by @0xLeif in #596
• fix(6.0): a Ruby method below private must never be extracted as an export (#479) by @0xLeif in #597
• fix(6.0): Gradle module identity must come from the project name, not a path segment (#473) by @0xLeif in #598
• fix(6.0): deps must not report a clean graph built from imports it could not resolve (#477) by @0xLeif in #599
• fix(6.0): a warm hash cache must not drop findings (#429) by @0xLeif in #600
• refactor(6.0): extract the change module's tests into their own file (#589) by @0xLeif in #601
• fix(6.0): a refused reopen must restore the archive it un-archived (#539) by @0xLeif in http...

Fourteenth release candidate. Quiet-candidate count RESET — this is a product change, not quiet-candidate 1 of rc.13.

rc.13 reset the count with #752/#753. This candidate ships module owns / succession (#755), so the count starts again from this tag.

Tagged on main tip e1cff1f30d12621b660da482e0c032b543abe683 (merge of #755). Product binaries already include owns; archive/hygiene for the three active .specsync/changes/ packages (orphaned verification after the squash merge) is a follow-up PR and does not change product code.

Ubuntu/macOS release-candidate lane and Trust were green on the #755 PR head before merge. Post-merge main CI/Trust are currently red solely because squash-merge orphaned active-change verification commits — re-check + finalize/archive clears that; it is not a product regression.

Windows is neither built nor qualified as of 6.0.

Since rc.13

• A module can own paths beyond its spec's files:, and succession judges exact-only predecessor inputs by who owns the path now (#755). Acceptance manifests only gave module ownership to paths listed in a spec's files: frontmatter; everything else under a change's declared paths was signed @exact:test or @exact:delivery, and exact-only inputs could not be superseded — so a whole-tree bootstrap froze every non-spec file for every later change. [modules."<name>"] owns in .specsync/config.toml grants a declared module additional paths (file or directory; not globs). Owned paths are signed under the module instead of a reserved exact class; specsync check still demands no spec coverage for them; nothing under .specsync/ can be owned. change supersede --spec <module> accepts a predecessor entry whose signed owners are all reserved exact labels when the module owns the path under the current configuration, refuses otherwise naming the frozen label and the owns remedy, and still refuses a module that is not among an entry's historically signed owners. The succession tuple is unchanged; the walk covers changed exact-only entries through authenticated successors that declared them. Found and field-verified on CorvidLabs/swift-algorand's four-change stack.

• docs(changelog): record #752 and #753 under Unreleased (#754). Not a product change.

Known and unfixed

Named here because a candidate that hides open defects found by its own process is not one worth trusting.

• #745 — ship_stages judges the product tip by ancestry while ready_to_finalize judges it by content, so after a squash they disagree inside a single payload.
• #694 — the scoped-review descendant walk is unavailable after a squash, not violated. What a review should prove is still open.
• #688 — predecessor and successor archive refusals cite the same invariant and name each other, and neither says the counterpart is blocked too.
• #685 — status offers verbs that are not reachable from the current state, and the escapes are undiscoverable.
• #647 — tagging v6.0.0 will move releases/latest and silently upgrade consumer repositories that pin no version (uses:@v4.5.0 wrapper, version: default latest). Must be handled before the stable tag.
• #633 — no commit in the 6.0 train carries an attestation; refs/notes/attest has not advanced since 2026-07-28.

Still unproven

promote has never executed and cannot be rehearsed — final_tag derives from the candidate's own Cargo.toml, so any real run mints the real tag. Its git mechanics were transcribed verbatim against a local bare repository and all three branches exercised, and both tag rulesets carry update and deletion only, so creation is unrestricted. The credential-helper path first runs at the actual release.

Thirteenth release candidate. Quiet-candidate count RESET — this is a product change, not quiet-candidate 1 of rc.12.

rc.12 reset the count with #748. This candidate ships two change fixes found by a consumer on the normal path, so the count starts again from this tag.

Qualified on the exact candidate SHA b5169cfeead484cd113557c5f941a6e3b305c4a1: Ubuntu and macOS passed the release-candidate lane (https://github.com/CorvidLabs/spec-sync/actions/runs/34000981881), and SpecSync release candidate is green on the commit. Windows is neither built nor qualified as of 6.0.

Since rc.12

• finalize can close a workflow-v2 change that supersedes a legacy accepted change (#753). Every attempt failed with archive post-move preflight would invalidate CHG-0001-…: delivery input … changed after acceptance and no accepted or archived successor change covers it — one command after change audit rated the successor's evidence exact. The preflight handed a working-tree label to git merge-base and never let the package being closed cover the change it supersedes. The pending close is now threaded through the preflight; each refused successor is named with its reason (successor `<id>` was rejected: <reason>) instead of being skipped silently; change audit loads archives as successor candidates; and a v1 predecessor is no longer advised to reopen. Found and re-checked in the field on CorvidLabs/swift-algorand's four-change stack.

• reopen admits an audited refresh of a legacy acceptance that cannot be reconstructed (#752, closes #751). Matching input digests and an anchored verification commit did not prove a manifest-less acceptance could be rebuilt, so such a change was impossible to archive while reopen insisted its evidence was current. The refusal is kept for reconstructible and manifest-backed records; the unreconstructible case records legacy_acceptance_unreconstructible in the append-only audit, and fresh verification plus acceptance produce a modern manifest that archives.

• ci: the Trust gate is pinned to v1.2.0-rc.4 (#750). Not a product change.

CHANGELOG.md [Unreleased] does not yet carry #752 or #753; a docs-only follow-up adds them.

Known and unfixed

Named here because a candidate that hides open defects found by its own process is not one worth trusting.

• #745 — ship_stages judges the product tip by ancestry while ready_to_finalize judges it by content, so after a squash they disagree inside a single payload.
• #694 — the scoped-review descendant walk is unavailable after a squash, not violated. What a review should prove is still open.
• #688 — predecessor and successor archive refusals cite the same invariant and name each other, and neither says the counterpart is blocked too.
• #685 — status offers verbs that are not reachable from the current state, and the escapes are undiscoverable.
• #647 — tagging v6.0.0 will move releases/latest and silently upgrade consumer repositories that pin no version (uses:@v4.5.0 wrapper, version: default latest). Must be handled before the stable tag.
• #633 — no commit in the 6.0 train carries an attestation; refs/notes/attest has not advanced since 2026-07-28.

Still unproven

promote has never executed and cannot be rehearsed — final_tag derives from the candidate's own Cargo.toml, so any real run mints the real tag. Its git mechanics were transcribed verbatim against a local bare repository and all three branches exercised, and both tag rulesets carry update and deletion only, so creation is unrestricted. The credential-helper path first runs at the actual release.

Twelfth release candidate. Quiet-candidate count RESET — this is a product change, not quiet-candidate 2 of rc.11.

rc.11 was quiet candidate 1 of 2. This candidate ships #748 (check is the product; SDD is opt-in), so the quiet-candidate count starts again from this tag.

Since rc.11

• check is the product; SDD is opt-in (#748). Fresh init writes .specsync/sdd.json with enabled: false and require_change_for_meaningful_files: false. It no longer starts a first-change interview. specsync check no longer calls audit_project, prints an active-change count, or surfaces workspace/archive findings. Lessons are not a merge gate; finalize still writes lesson-bundle.md. Enable the change workflow with specsync change adopt. SddPolicy::default() still fail-closes omitted enabled / require_change fields.

• the scope approver may record scoped review (#749). SpecSync no longer invents a two-person gate GitHub did not require. Solo projects can change review --reviewer with the human who approved the definition. Distinct reviewers remain allowed. GitHub required reviews remain the merge authority when a repository wants two humans.

Known and unfixed

Named here because a candidate that hides open defects found by its own process is not one worth trusting.

• #745 — ship_stages judges the product tip by ancestry while ready_to_finalize judges it by content, so after a squash they disagree inside a single payload. A #689 leftover one lane over.
• #694 — the scoped-review descendant walk is unavailable after a squash, not violated. What a review should prove is still open.
• #647 — tagging v6.0.0 will move releases/latest and silently upgrade consumer repositories that pin no version (uses:@v4.5.0 wrapper, version: default latest). Must be handled before the stable tag.
• #633 — no commit in the 6.0 train carries an attestation; refs/notes/attest has not advanced since 2026-07-28.

Still unproven

promote has never executed and cannot be rehearsed — final_tag derives from the candidate's own Cargo.toml, so any real run mints the real tag. Its git mechanics were transcribed verbatim against a local bare repository and all three branches exercised, and both tag rulesets carry update and deletion only, so creation is unrestricted. The credential-helper path first runs at the actual release.