Best possible solution:

Land the branch only after maintainers explicitly accept the full-taxonomy evidence contract; keep or add release-profile artifact compatibility if that operator path is still needed.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a CI workflow/admin contract change, not a runtime bug. Source inspection confirms current main still uses release, and the PR diff switches the workflow path to all.

Is this the best way to solve the issue?

Yes, with maintainer acceptance. The diff keeps caller, validators, generated copy, and guard tests aligned; the safer alternative is to preserve release-profile artifact compatibility if maintainers still need that path.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 3ab8d6aa609a.

Label justifications:

• P3: This is a low-risk maintainer CI/admin workflow change rather than an urgent user-facing runtime regression.
• merge-risk: 🚨 automation: The PR changes GitHub workflow defaults and maturity-scorecard evidence validation in a way green unit checks do not fully prove for live full-taxonomy QA runs.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Not applicable: this is a maintainer-labeled PR, so the external contributor real-behavior proof gate does not apply; the PR body and CI provide supplemental workflow validation.

PR surface:

Tests +3, Config 0. Total +3 across 3 files.

What I checked:

• Protected maintainer PR: Live PR metadata shows the maintainer label and MEMBER author association, so cleanup close is not appropriate even though the branch is focused. (834fe34d7ad8)
• Current manual default is release: Current main still defaults the manual QA Profile Evidence qa_profile input to release; the PR changes this default to all. (.github/workflows/qa-profile-evidence.yml:21, 3ab8d6aa609a)
• Current maturity scorecard uses release evidence: Current main calls QA Profile Evidence with qa_profile: release and rejects downloaded evidence unless the evidence and manifest resolve to release; the PR changes those checks to all. (.github/workflows/maturity-scorecard.yml:137, 3ab8d6aa609a)
• All profile is broader than release: The taxonomy defines all as every active category and describes it as intended for explicit QA evidence dispatches rather than the default release gate, making the default change maintainer-facing automation policy. (taxonomy.yaml:218, 3ab8d6aa609a)
• Renderer already prefers all evidence: The maturity docs renderer checks all evidence before falling back to release, so the PR aligns the workflow-generated evidence with the renderer's preferred coverage source. (scripts/qa/render-maturity-docs.ts:719, 3ab8d6aa609a)
• Guard coverage follows the workflow contract: The adjacent workflow guard test currently asserts the maturity-scorecard handoff and QA evidence paths; the PR updates that guard to pin the new all contract. (test/scripts/ci-workflow-guards.test.ts:629, 3ab8d6aa609a)

Likely related people:

• RomneyDa: Recent merged work by this handle built the generic QA Profile Evidence workflow, maturity-scorecard evidence inputs, the all taxonomy profile, and coverage-score rendering that this PR continues. (role: recent area contributor; confidence: high; commits: f6674da87290, 175f493d48d1, dff07f158f97; files: .github/workflows/qa-profile-evidence.yml, .github/workflows/maturity-scorecard.yml, taxonomy.yaml)
• Shakker: Available local blame for the current workflow default and maturity-scorecard release validation points to the grafted base commit; the shallow/grafted history makes this a routing hint rather than complete ownership proof. (role: introduced behavior in available local history; confidence: low; commits: 8ecbf83c678c; files: .github/workflows/qa-profile-evidence.yml, .github/workflows/maturity-scorecard.yml, test/scripts/ci-workflow-guards.test.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.