Update: adopt Trust v1.2.0-rc.4

[0xLeif]

Summary

• Adopt Trust 1.0.0 and prepare the GitHub plugin for SpecSync extensionless-source coverage without changing product behavior.
• Keep all six existing bin/fledge-github* executables in the active canonical GitHub spec with five stable requirements and no placeholder data.
• Lint and syntax-check every executable and smoke-test every offline --help surface.
• Install Claude, Cursor, Codex, and Gemini integrations and protect the repository's real runtime, spec, workflow, agent, and governance paths.
• Record the rollout files omitted from the earlier lifecycle scope and refresh portable verification and closing approvals.

Local verification

• released SpecSync 5.0.2 (a9422ae): 1/1 spec, 6/6 files, 1,411/1,411 LOC, 100%, zero warnings
• fledge lanes run verify: ShellCheck, Bash syntax, and all-executable offline help
• Claude, Cursor, Codex, and Gemini integrations installed
• fledge trust doctor
• local fledge trust verify: complete gate passed with expected progressive provenance because no remote ledger exists
• all review threads resolved and no merge conflict
• definition, native verification, and closing approvals recorded as user:0xLeif

Hosted verification

• pinned SpecSync contract / Trust
• CodeQL

Blocker

Trust 1.0.0 intentionally bundles immutable SpecSync 5.0.1. That release does not recognize include_extensionless, cannot measure the six extensionless Bash executables, and rejects the refreshed accepted evidence. Released SpecSync 5.0.2 validates this exact committed tree at truthful 100% file and LOC coverage, but Trust has no released patch that can consume it yet. This PR remains draft until a coordinated immutable Trust patch pin is available and exact-head hosted Trust passes.

Authenticated GitHub reads and mutations remain independently authorized and are intentionally excluded from the offline migration lane.

Exact head: 285789391a06a610e22a0cdc4e68da9c70d10004.

[gemini-code-assist]

Code Review

This pull request adopts SpecSync 5.0.1 and Trust 1.0.0 governance for the GitHub Fledge plugin, introducing canonical specs, companion files, migration change records, task definitions, and IDE skill commands. The review feedback suggests removing redundant empty headings in the skill markdown files, correcting split acceptance criteria in the migration change files, and expanding the smoke test and verification commands to cover all fledge-github sub-executables instead of only the main dispatcher.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:f5ee59c46f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[0xLeif]

Rollout update:

• This repository is public; its existing Ubuntu-hosted runner remains appropriate.
• Local SpecSync 5.0.2 validation is complete, but the pinned Trust 1.0.0 action composes SpecSync 5.0.1 and cannot consume the refreshed extensionless-source evidence.
• The PR remains blocked pending a compatible immutable Trust pin and exact-head hosted Trust success.

This PR remains draft until the release compatibility blocker is resolved.

[0xGaspar]

Reviewing as a comment rather than an approval, since this is a draft and self-blocked.

You've documented the blocker clearly:

Trust 1.0.0 intentionally bundles immutable SpecSync 5.0.1. That release does not recognize include_extensionless, cannot measure the six extensionless Bash executables, and rejects the refreshed accepted evidence.

That's a real coordination deadlock rather than anything wrong with this changeset, and I don't think there's a useful code review to give until the Trust patch pin exists. A few observations for when it does:

1. The dependency is worth recording somewhere durable. "Trust needs a released patch that can consume SpecSync 5.0.2" is the actual blocking work, and it currently lives only in this PR description. If there isn't a tracking issue on the Trust side, it'd be worth opening one and linking it here — otherwise this PR is the only record of a cross-repo dependency.

2. include_extensionless is the crux. Six extensionless Bash executables that the pinned SpecSync literally cannot measure means coverage is structurally unreportable, not merely low. Worth confirming that the eventual Trust patch fixes measurement rather than just relaxing the gate — the second would make the green check meaningless for this repo.

3. The diff is +1582/−0 across 63 files and almost entirely governance scaffolding (.specsync/, .claude/, .cursor/, .codex/, .gemini/, .trust.toml, .augur.toml), with no change to the bin/fledge-github* executables. If that's accurate — no product behaviour change at all — saying so as a one-liner at the top would let a reviewer calibrate quickly. Your summary says it, but it's below the fold.

4. trust is red in CI here, which is expected given the blocker. It's also red on all thirteen open PRs in CorvidLabs/spec-sync, including ones that merge and test clean. If those share a root cause it may be worth chasing centrally rather than per-repo.

No action needed from me until the Trust pin lands — ping me then and I'll do a proper pass.

[corvid-agent]

Request changes.

This draft is honest about why it cannot land, and hosted Trust is still red on 2857893.

1. .github/workflows/trust.yml pins CorvidLabs/trust@9d32b578 (v1.0.0) and never runs a SpecSync action. Trust 1.0.0 bundles SpecSync 5.0.1, which this PR's own body says cannot measure the six extensionless bin/fledge-github* binaries or accept the refreshed evidence. That blocker is still true on this head.

2. SpecSync 6 / Trust 1.2.0-rc.2 is the current product cut (spec-sync #748, corvid-verify #46). Landing a SpecSync 5 / Trust 1.0 adoption now is the wrong target. Retarget to a Trust pin that can consume SpecSync 6 (and truthful extensionless coverage), then re-verify hosted Trust.

3. The installed agent skills still teach the 5.0 SDD recipe and specsync check --strict as the PR gate. That is the same overtaken gate spec-sync #748 asked consumers to stop using.

Keep this draft until hosted Trust is green on a 6.x pin. This review does not merge.

[0xLeif]

Summary

• Adopt Trust 1.0.0 and prepare the GitHub plugin for SpecSync extensionless-source coverage without changing product behavior.
• Keep all six existing bin/fledge-github* executables in the active canonical GitHub spec with five stable requirements and no placeholder data.
• Lint and syntax-check every executable and smoke-test every offline --help surface.
• Install Claude, Cursor, Codex, and Gemini integrations and protect the repository's real runtime, spec, workflow, agent, and governance paths.
• Record the rollout files omitted from the earlier lifecycle scope and refresh portable verification and closing approvals.

Local verification

• released SpecSync 5.0.2 (a9422ae): 1/1 spec, 6/6 files, 1,411/1,411 LOC, 100%, zero warnings
• fledge lanes run verify: ShellCheck, Bash syntax, and all-executable offline help
• Claude, Cursor, Codex, and Gemini integrations installed
• fledge trust doctor
• local fledge trust verify: complete gate passed with expected progressive provenance because no remote ledger exists
• all review threads resolved and no merge conflict
• definition, native verification, and closing approvals recorded as user:0xLeif

Hosted verification

• pinned SpecSync contract / Trust
• CodeQL

Blocker

Trust 1.0.0 intentionally bundles immutable SpecSync 5.0.1. That release does not recognize include_extensionless, cannot measure the six extensionless Bash executables, and rejects the refreshed accepted evidence. Released SpecSync 5.0.2 validates this exact committed tree at truthful 100% file and LOC coverage, but Trust has no released patch that can consume it yet. This PR remains draft until a coordinated immutable Trust patch pin is available and exact-head hosted Trust passes.

Authenticated GitHub reads and mutations remain independently authorized and are intentionally excluded from the offline migration lane.

Exact head: 285789391a06a610e22a0cdc4e68da9c70d10004.

[gemini-code-assist]

Code Review

This pull request adopts SpecSync 5.0.1 and Trust 1.0.0 governance for the GitHub Fledge plugin, introducing canonical specs, companion files, migration change records, task definitions, and IDE skill commands. The review feedback suggests removing redundant empty headings in the skill markdown files, correcting split acceptance criteria in the migration change files, and expanding the smoke test and verification commands to cover all fledge-github sub-executables instead of only the main dispatcher.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:f5ee59c46f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[0xLeif]

Rollout update:

• This repository is public; its existing Ubuntu-hosted runner remains appropriate.
• Local SpecSync 5.0.2 validation is complete, but the pinned Trust 1.0.0 action composes SpecSync 5.0.1 and cannot consume the refreshed extensionless-source evidence.
• The PR remains blocked pending a compatible immutable Trust pin and exact-head hosted Trust success.

This PR remains draft until the release compatibility blocker is resolved.

[0xGaspar]

Reviewing as a comment rather than an approval, since this is a draft and self-blocked.

You've documented the blocker clearly:

Trust 1.0.0 intentionally bundles immutable SpecSync 5.0.1. That release does not recognize include_extensionless, cannot measure the six extensionless Bash executables, and rejects the refreshed accepted evidence.

That's a real coordination deadlock rather than anything wrong with this changeset, and I don't think there's a useful code review to give until the Trust patch pin exists. A few observations for when it does:

1. The dependency is worth recording somewhere durable. "Trust needs a released patch that can consume SpecSync 5.0.2" is the actual blocking work, and it currently lives only in this PR description. If there isn't a tracking issue on the Trust side, it'd be worth opening one and linking it here — otherwise this PR is the only record of a cross-repo dependency.

2. include_extensionless is the crux. Six extensionless Bash executables that the pinned SpecSync literally cannot measure means coverage is structurally unreportable, not merely low. Worth confirming that the eventual Trust patch fixes measurement rather than just relaxing the gate — the second would make the green check meaningless for this repo.

3. The diff is +1582/−0 across 63 files and almost entirely governance scaffolding (.specsync/, .claude/, .cursor/, .codex/, .gemini/, .trust.toml, .augur.toml), with no change to the bin/fledge-github* executables. If that's accurate — no product behaviour change at all — saying so as a one-liner at the top would let a reviewer calibrate quickly. Your summary says it, but it's below the fold.

4. trust is red in CI here, which is expected given the blocker. It's also red on all thirteen open PRs in CorvidLabs/spec-sync, including ones that merge and test clean. If those share a root cause it may be worth chasing centrally rather than per-repo.

No action needed from me until the Trust pin lands — ping me then and I'll do a proper pass.

[corvid-agent]

Request changes.

This draft is honest about why it cannot land, and hosted Trust is still red on 2857893.

1. .github/workflows/trust.yml pins CorvidLabs/trust@9d32b578 (v1.0.0) and never runs a SpecSync action. Trust 1.0.0 bundles SpecSync 5.0.1, which this PR's own body says cannot measure the six extensionless bin/fledge-github* binaries or accept the refreshed evidence. That blocker is still true on this head.

2. SpecSync 6 / Trust 1.2.0-rc.2 is the current product cut (spec-sync #748, corvid-verify #46). Landing a SpecSync 5 / Trust 1.0 adoption now is the wrong target. Retarget to a Trust pin that can consume SpecSync 6 (and truthful extensionless coverage), then re-verify hosted Trust.

3. The installed agent skills still teach the 5.0 SDD recipe and specsync check --strict as the PR gate. That is the same overtaken gate spec-sync #748 asked consumers to stop using.

Keep this draft until hosted Trust is green on a 6.x pin. This review does not merge.

[0xLeif]

Summary

• Adopt Trust 1.0.0 and prepare the GitHub plugin for SpecSync extensionless-source coverage without changing product behavior.
• Keep all six existing bin/fledge-github* executables in the active canonical GitHub spec with five stable requirements and no placeholder data.
• Lint and syntax-check every executable and smoke-test every offline --help surface.
• Install Claude, Cursor, Codex, and Gemini integrations and protect the repository's real runtime, spec, workflow, agent, and governance paths.
• Record the rollout files omitted from the earlier lifecycle scope and refresh portable verification and closing approvals.

Local verification

• released SpecSync 5.0.2 (a9422ae): 1/1 spec, 6/6 files, 1,411/1,411 LOC, 100%, zero warnings
• fledge lanes run verify: ShellCheck, Bash syntax, and all-executable offline help
• Claude, Cursor, Codex, and Gemini integrations installed
• fledge trust doctor
• local fledge trust verify: complete gate passed with expected progressive provenance because no remote ledger exists
• all review threads resolved and no merge conflict
• definition, native verification, and closing approvals recorded as user:0xLeif

Hosted verification

• pinned SpecSync contract / Trust
• CodeQL

Blocker

Trust 1.0.0 intentionally bundles immutable SpecSync 5.0.1. That release does not recognize include_extensionless, cannot measure the six extensionless Bash executables, and rejects the refreshed accepted evidence. Released SpecSync 5.0.2 validates this exact committed tree at truthful 100% file and LOC coverage, but Trust has no released patch that can consume it yet. This PR remains draft until a coordinated immutable Trust patch pin is available and exact-head hosted Trust passes.

Authenticated GitHub reads and mutations remain independently authorized and are intentionally excluded from the offline migration lane.

Exact head: 285789391a06a610e22a0cdc4e68da9c70d10004.

[gemini-code-assist]

Code Review

This pull request adopts SpecSync 5.0.1 and Trust 1.0.0 governance for the GitHub Fledge plugin, introducing canonical specs, companion files, migration change records, task definitions, and IDE skill commands. The review feedback suggests removing redundant empty headings in the skill markdown files, correcting split acceptance criteria in the migration change files, and expanding the smoke test and verification commands to cover all fledge-github sub-executables instead of only the main dispatcher.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:f5ee59c46f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[0xLeif]

Rollout update:

• This repository is public; its existing Ubuntu-hosted runner remains appropriate.
• Local SpecSync 5.0.2 validation is complete, but the pinned Trust 1.0.0 action composes SpecSync 5.0.1 and cannot consume the refreshed extensionless-source evidence.
• The PR remains blocked pending a compatible immutable Trust pin and exact-head hosted Trust success.

This PR remains draft until the release compatibility blocker is resolved.

[0xGaspar]

Reviewing as a comment rather than an approval, since this is a draft and self-blocked.

You've documented the blocker clearly:

Trust 1.0.0 intentionally bundles immutable SpecSync 5.0.1. That release does not recognize include_extensionless, cannot measure the six extensionless Bash executables, and rejects the refreshed accepted evidence.

That's a real coordination deadlock rather than anything wrong with this changeset, and I don't think there's a useful code review to give until the Trust patch pin exists. A few observations for when it does:

1. The dependency is worth recording somewhere durable. "Trust needs a released patch that can consume SpecSync 5.0.2" is the actual blocking work, and it currently lives only in this PR description. If there isn't a tracking issue on the Trust side, it'd be worth opening one and linking it here — otherwise this PR is the only record of a cross-repo dependency.

2. include_extensionless is the crux. Six extensionless Bash executables that the pinned SpecSync literally cannot measure means coverage is structurally unreportable, not merely low. Worth confirming that the eventual Trust patch fixes measurement rather than just relaxing the gate — the second would make the green check meaningless for this repo.

3. The diff is +1582/−0 across 63 files and almost entirely governance scaffolding (.specsync/, .claude/, .cursor/, .codex/, .gemini/, .trust.toml, .augur.toml), with no change to the bin/fledge-github* executables. If that's accurate — no product behaviour change at all — saying so as a one-liner at the top would let a reviewer calibrate quickly. Your summary says it, but it's below the fold.

4. trust is red in CI here, which is expected given the blocker. It's also red on all thirteen open PRs in CorvidLabs/spec-sync, including ones that merge and test clean. If those share a root cause it may be worth chasing centrally rather than per-repo.

No action needed from me until the Trust pin lands — ping me then and I'll do a proper pass.

[corvid-agent]

Request changes.

This draft is honest about why it cannot land, and hosted Trust is still red on 2857893.

1. .github/workflows/trust.yml pins CorvidLabs/trust@9d32b578 (v1.0.0) and never runs a SpecSync action. Trust 1.0.0 bundles SpecSync 5.0.1, which this PR's own body says cannot measure the six extensionless bin/fledge-github* binaries or accept the refreshed evidence. That blocker is still true on this head.

2. SpecSync 6 / Trust 1.2.0-rc.2 is the current product cut (spec-sync #748, corvid-verify #46). Landing a SpecSync 5 / Trust 1.0 adoption now is the wrong target. Retarget to a Trust pin that can consume SpecSync 6 (and truthful extensionless coverage), then re-verify hosted Trust.

3. The installed agent skills still teach the 5.0 SDD recipe and specsync check --strict as the PR gate. That is the same overtaken gate spec-sync #748 asked consumers to stop using.

Keep this draft until hosted Trust is green on a 6.x pin. This review does not merge.

[0xLeif]

Summary

• Adopt Trust 1.0.0 and prepare the GitHub plugin for SpecSync extensionless-source coverage without changing product behavior.
• Keep all six existing bin/fledge-github* executables in the active canonical GitHub spec with five stable requirements and no placeholder data.
• Lint and syntax-check every executable and smoke-test every offline --help surface.
• Install Claude, Cursor, Codex, and Gemini integrations and protect the repository's real runtime, spec, workflow, agent, and governance paths.
• Record the rollout files omitted from the earlier lifecycle scope and refresh portable verification and closing approvals.

Local verification

• released SpecSync 5.0.2 (a9422ae): 1/1 spec, 6/6 files, 1,411/1,411 LOC, 100%, zero warnings
• fledge lanes run verify: ShellCheck, Bash syntax, and all-executable offline help
• Claude, Cursor, Codex, and Gemini integrations installed
• fledge trust doctor
• local fledge trust verify: complete gate passed with expected progressive provenance because no remote ledger exists
• all review threads resolved and no merge conflict
• definition, native verification, and closing approvals recorded as user:0xLeif

Hosted verification

• pinned SpecSync contract / Trust
• CodeQL

Blocker

Trust 1.0.0 intentionally bundles immutable SpecSync 5.0.1. That release does not recognize include_extensionless, cannot measure the six extensionless Bash executables, and rejects the refreshed accepted evidence. Released SpecSync 5.0.2 validates this exact committed tree at truthful 100% file and LOC coverage, but Trust has no released patch that can consume it yet. This PR remains draft until a coordinated immutable Trust patch pin is available and exact-head hosted Trust passes.

Authenticated GitHub reads and mutations remain independently authorized and are intentionally excluded from the offline migration lane.

Exact head: 285789391a06a610e22a0cdc4e68da9c70d10004.

[gemini-code-assist]

Code Review

This pull request adopts SpecSync 5.0.1 and Trust 1.0.0 governance for the GitHub Fledge plugin, introducing canonical specs, companion files, migration change records, task definitions, and IDE skill commands. The review feedback suggests removing redundant empty headings in the skill markdown files, correcting split acceptance criteria in the migration change files, and expanding the smoke test and verification commands to cover all fledge-github sub-executables instead of only the main dispatcher.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:f5ee59c46f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[0xLeif]

Rollout update:

• This repository is public; its existing Ubuntu-hosted runner remains appropriate.
• Local SpecSync 5.0.2 validation is complete, but the pinned Trust 1.0.0 action composes SpecSync 5.0.1 and cannot consume the refreshed extensionless-source evidence.
• The PR remains blocked pending a compatible immutable Trust pin and exact-head hosted Trust success.

This PR remains draft until the release compatibility blocker is resolved.

[0xGaspar]

Reviewing as a comment rather than an approval, since this is a draft and self-blocked.

You've documented the blocker clearly:

Trust 1.0.0 intentionally bundles immutable SpecSync 5.0.1. That release does not recognize include_extensionless, cannot measure the six extensionless Bash executables, and rejects the refreshed accepted evidence.

That's a real coordination deadlock rather than anything wrong with this changeset, and I don't think there's a useful code review to give until the Trust patch pin exists. A few observations for when it does:

1. The dependency is worth recording somewhere durable. "Trust needs a released patch that can consume SpecSync 5.0.2" is the actual blocking work, and it currently lives only in this PR description. If there isn't a tracking issue on the Trust side, it'd be worth opening one and linking it here — otherwise this PR is the only record of a cross-repo dependency.

2. include_extensionless is the crux. Six extensionless Bash executables that the pinned SpecSync literally cannot measure means coverage is structurally unreportable, not merely low. Worth confirming that the eventual Trust patch fixes measurement rather than just relaxing the gate — the second would make the green check meaningless for this repo.

3. The diff is +1582/−0 across 63 files and almost entirely governance scaffolding (.specsync/, .claude/, .cursor/, .codex/, .gemini/, .trust.toml, .augur.toml), with no change to the bin/fledge-github* executables. If that's accurate — no product behaviour change at all — saying so as a one-liner at the top would let a reviewer calibrate quickly. Your summary says it, but it's below the fold.

4. trust is red in CI here, which is expected given the blocker. It's also red on all thirteen open PRs in CorvidLabs/spec-sync, including ones that merge and test clean. If those share a root cause it may be worth chasing centrally rather than per-repo.

No action needed from me until the Trust pin lands — ping me then and I'll do a proper pass.

[corvid-agent]

Request changes.

This draft is honest about why it cannot land, and hosted Trust is still red on 2857893.

1. .github/workflows/trust.yml pins CorvidLabs/trust@9d32b578 (v1.0.0) and never runs a SpecSync action. Trust 1.0.0 bundles SpecSync 5.0.1, which this PR's own body says cannot measure the six extensionless bin/fledge-github* binaries or accept the refreshed evidence. That blocker is still true on this head.

2. SpecSync 6 / Trust 1.2.0-rc.2 is the current product cut (spec-sync #748, corvid-verify #46). Landing a SpecSync 5 / Trust 1.0 adoption now is the wrong target. Retarget to a Trust pin that can consume SpecSync 6 (and truthful extensionless coverage), then re-verify hosted Trust.

3. The installed agent skills still teach the 5.0 SDD recipe and specsync check --strict as the PR gate. That is the same overtaken gate spec-sync #748 asked consumers to stop using.

Keep this draft until hosted Trust is green on a 6.x pin. This review does not merge.

[0xLeif]

Summary

• Adopt Trust 1.0.0 and prepare the GitHub plugin for SpecSync extensionless-source coverage without changing product behavior.
• Keep all six existing bin/fledge-github* executables in the active canonical GitHub spec with five stable requirements and no placeholder data.
• Lint and syntax-check every executable and smoke-test every offline --help surface.
• Install Claude, Cursor, Codex, and Gemini integrations and protect the repository's real runtime, spec, workflow, agent, and governance paths.
• Record the rollout files omitted from the earlier lifecycle scope and refresh portable verification and closing approvals.

Local verification

• released SpecSync 5.0.2 (a9422ae): 1/1 spec, 6/6 files, 1,411/1,411 LOC, 100%, zero warnings
• fledge lanes run verify: ShellCheck, Bash syntax, and all-executable offline help
• Claude, Cursor, Codex, and Gemini integrations installed
• fledge trust doctor
• local fledge trust verify: complete gate passed with expected progressive provenance because no remote ledger exists
• all review threads resolved and no merge conflict
• definition, native verification, and closing approvals recorded as user:0xLeif

Hosted verification

• pinned SpecSync contract / Trust
• CodeQL

Blocker

Trust 1.0.0 intentionally bundles immutable SpecSync 5.0.1. That release does not recognize include_extensionless, cannot measure the six extensionless Bash executables, and rejects the refreshed accepted evidence. Released SpecSync 5.0.2 validates this exact committed tree at truthful 100% file and LOC coverage, but Trust has no released patch that can consume it yet. This PR remains draft until a coordinated immutable Trust patch pin is available and exact-head hosted Trust passes.

Authenticated GitHub reads and mutations remain independently authorized and are intentionally excluded from the offline migration lane.

Exact head: 285789391a06a610e22a0cdc4e68da9c70d10004.

[gemini-code-assist]

Code Review

This pull request adopts SpecSync 5.0.1 and Trust 1.0.0 governance for the GitHub Fledge plugin, introducing canonical specs, companion files, migration change records, task definitions, and IDE skill commands. The review feedback suggests removing redundant empty headings in the skill markdown files, correcting split acceptance criteria in the migration change files, and expanding the smoke test and verification commands to cover all fledge-github sub-executables instead of only the main dispatcher.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:f5ee59c46f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[0xLeif]

Rollout update:

• This repository is public; its existing Ubuntu-hosted runner remains appropriate.
• Local SpecSync 5.0.2 validation is complete, but the pinned Trust 1.0.0 action composes SpecSync 5.0.1 and cannot consume the refreshed extensionless-source evidence.
• The PR remains blocked pending a compatible immutable Trust pin and exact-head hosted Trust success.

This PR remains draft until the release compatibility blocker is resolved.

[0xGaspar]

Reviewing as a comment rather than an approval, since this is a draft and self-blocked.

You've documented the blocker clearly:

Trust 1.0.0 intentionally bundles immutable SpecSync 5.0.1. That release does not recognize include_extensionless, cannot measure the six extensionless Bash executables, and rejects the refreshed accepted evidence.

That's a real coordination deadlock rather than anything wrong with this changeset, and I don't think there's a useful code review to give until the Trust patch pin exists. A few observations for when it does:

1. The dependency is worth recording somewhere durable. "Trust needs a released patch that can consume SpecSync 5.0.2" is the actual blocking work, and it currently lives only in this PR description. If there isn't a tracking issue on the Trust side, it'd be worth opening one and linking it here — otherwise this PR is the only record of a cross-repo dependency.

2. include_extensionless is the crux. Six extensionless Bash executables that the pinned SpecSync literally cannot measure means coverage is structurally unreportable, not merely low. Worth confirming that the eventual Trust patch fixes measurement rather than just relaxing the gate — the second would make the green check meaningless for this repo.

3. The diff is +1582/−0 across 63 files and almost entirely governance scaffolding (.specsync/, .claude/, .cursor/, .codex/, .gemini/, .trust.toml, .augur.toml), with no change to the bin/fledge-github* executables. If that's accurate — no product behaviour change at all — saying so as a one-liner at the top would let a reviewer calibrate quickly. Your summary says it, but it's below the fold.

4. trust is red in CI here, which is expected given the blocker. It's also red on all thirteen open PRs in CorvidLabs/spec-sync, including ones that merge and test clean. If those share a root cause it may be worth chasing centrally rather than per-repo.

No action needed from me until the Trust pin lands — ping me then and I'll do a proper pass.

[corvid-agent]

Request changes.

This draft is honest about why it cannot land, and hosted Trust is still red on 2857893.

1. .github/workflows/trust.yml pins CorvidLabs/trust@9d32b578 (v1.0.0) and never runs a SpecSync action. Trust 1.0.0 bundles SpecSync 5.0.1, which this PR's own body says cannot measure the six extensionless bin/fledge-github* binaries or accept the refreshed evidence. That blocker is still true on this head.

2. SpecSync 6 / Trust 1.2.0-rc.2 is the current product cut (spec-sync #748, corvid-verify #46). Landing a SpecSync 5 / Trust 1.0 adoption now is the wrong target. Retarget to a Trust pin that can consume SpecSync 6 (and truthful extensionless coverage), then re-verify hosted Trust.

3. The installed agent skills still teach the 5.0 SDD recipe and specsync check --strict as the PR gate. That is the same overtaken gate spec-sync #748 asked consumers to stop using.

Keep this draft until hosted Trust is green on a 6.x pin. This review does not merge.

[0xLeif]

Summary

• Adopt Trust 1.0.0 and prepare the GitHub plugin for SpecSync extensionless-source coverage without changing product behavior.
• Keep all six existing bin/fledge-github* executables in the active canonical GitHub spec with five stable requirements and no placeholder data.
• Lint and syntax-check every executable and smoke-test every offline --help surface.
• Install Claude, Cursor, Codex, and Gemini integrations and protect the repository's real runtime, spec, workflow, agent, and governance paths.
• Record the rollout files omitted from the earlier lifecycle scope and refresh portable verification and closing approvals.

Local verification

• released SpecSync 5.0.2 (a9422ae): 1/1 spec, 6/6 files, 1,411/1,411 LOC, 100%, zero warnings
• fledge lanes run verify: ShellCheck, Bash syntax, and all-executable offline help
• Claude, Cursor, Codex, and Gemini integrations installed
• fledge trust doctor
• local fledge trust verify: complete gate passed with expected progressive provenance because no remote ledger exists
• all review threads resolved and no merge conflict
• definition, native verification, and closing approvals recorded as user:0xLeif

Hosted verification

• pinned SpecSync contract / Trust
• CodeQL

Blocker

Trust 1.0.0 intentionally bundles immutable SpecSync 5.0.1. That release does not recognize include_extensionless, cannot measure the six extensionless Bash executables, and rejects the refreshed accepted evidence. Released SpecSync 5.0.2 validates this exact committed tree at truthful 100% file and LOC coverage, but Trust has no released patch that can consume it yet. This PR remains draft until a coordinated immutable Trust patch pin is available and exact-head hosted Trust passes.

Authenticated GitHub reads and mutations remain independently authorized and are intentionally excluded from the offline migration lane.

Exact head: 285789391a06a610e22a0cdc4e68da9c70d10004.

[gemini-code-assist]

Code Review

This pull request adopts SpecSync 5.0.1 and Trust 1.0.0 governance for the GitHub Fledge plugin, introducing canonical specs, companion files, migration change records, task definitions, and IDE skill commands. The review feedback suggests removing redundant empty headings in the skill markdown files, correcting split acceptance criteria in the migration change files, and expanding the smoke test and verification commands to cover all fledge-github sub-executables instead of only the main dispatcher.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:f5ee59c46f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[0xLeif]

Rollout update:

• This repository is public; its existing Ubuntu-hosted runner remains appropriate.
• Local SpecSync 5.0.2 validation is complete, but the pinned Trust 1.0.0 action composes SpecSync 5.0.1 and cannot consume the refreshed extensionless-source evidence.
• The PR remains blocked pending a compatible immutable Trust pin and exact-head hosted Trust success.

This PR remains draft until the release compatibility blocker is resolved.

[0xGaspar]

Reviewing as a comment rather than an approval, since this is a draft and self-blocked.

You've documented the blocker clearly:

Trust 1.0.0 intentionally bundles immutable SpecSync 5.0.1. That release does not recognize include_extensionless, cannot measure the six extensionless Bash executables, and rejects the refreshed accepted evidence.

That's a real coordination deadlock rather than anything wrong with this changeset, and I don't think there's a useful code review to give until the Trust patch pin exists. A few observations for when it does:

1. The dependency is worth recording somewhere durable. "Trust needs a released patch that can consume SpecSync 5.0.2" is the actual blocking work, and it currently lives only in this PR description. If there isn't a tracking issue on the Trust side, it'd be worth opening one and linking it here — otherwise this PR is the only record of a cross-repo dependency.

2. include_extensionless is the crux. Six extensionless Bash executables that the pinned SpecSync literally cannot measure means coverage is structurally unreportable, not merely low. Worth confirming that the eventual Trust patch fixes measurement rather than just relaxing the gate — the second would make the green check meaningless for this repo.

3. The diff is +1582/−0 across 63 files and almost entirely governance scaffolding (.specsync/, .claude/, .cursor/, .codex/, .gemini/, .trust.toml, .augur.toml), with no change to the bin/fledge-github* executables. If that's accurate — no product behaviour change at all — saying so as a one-liner at the top would let a reviewer calibrate quickly. Your summary says it, but it's below the fold.

4. trust is red in CI here, which is expected given the blocker. It's also red on all thirteen open PRs in CorvidLabs/spec-sync, including ones that merge and test clean. If those share a root cause it may be worth chasing centrally rather than per-repo.

No action needed from me until the Trust pin lands — ping me then and I'll do a proper pass.

[corvid-agent]

Request changes.

This draft is honest about why it cannot land, and hosted Trust is still red on 2857893.

1. .github/workflows/trust.yml pins CorvidLabs/trust@9d32b578 (v1.0.0) and never runs a SpecSync action. Trust 1.0.0 bundles SpecSync 5.0.1, which this PR's own body says cannot measure the six extensionless bin/fledge-github* binaries or accept the refreshed evidence. That blocker is still true on this head.

2. SpecSync 6 / Trust 1.2.0-rc.2 is the current product cut (spec-sync #748, corvid-verify #46). Landing a SpecSync 5 / Trust 1.0 adoption now is the wrong target. Retarget to a Trust pin that can consume SpecSync 6 (and truthful extensionless coverage), then re-verify hosted Trust.

3. The installed agent skills still teach the 5.0 SDD recipe and specsync check --strict as the PR gate. That is the same overtaken gate spec-sync #748 asked consumers to stop using.

Keep this draft until hosted Trust is green on a 6.x pin. This review does not merge.

[0xLeif]

Summary

• Adopt Trust 1.0.0 and prepare the GitHub plugin for SpecSync extensionless-source coverage without changing product behavior.
• Keep all six existing bin/fledge-github* executables in the active canonical GitHub spec with five stable requirements and no placeholder data.
• Lint and syntax-check every executable and smoke-test every offline --help surface.
• Install Claude, Cursor, Codex, and Gemini integrations and protect the repository's real runtime, spec, workflow, agent, and governance paths.
• Record the rollout files omitted from the earlier lifecycle scope and refresh portable verification and closing approvals.

Local verification

• released SpecSync 5.0.2 (a9422ae): 1/1 spec, 6/6 files, 1,411/1,411 LOC, 100%, zero warnings
• fledge lanes run verify: ShellCheck, Bash syntax, and all-executable offline help
• Claude, Cursor, Codex, and Gemini integrations installed
• fledge trust doctor
• local fledge trust verify: complete gate passed with expected progressive provenance because no remote ledger exists
• all review threads resolved and no merge conflict
• definition, native verification, and closing approvals recorded as user:0xLeif

Hosted verification

• pinned SpecSync contract / Trust
• CodeQL

Blocker

Trust 1.0.0 intentionally bundles immutable SpecSync 5.0.1. That release does not recognize include_extensionless, cannot measure the six extensionless Bash executables, and rejects the refreshed accepted evidence. Released SpecSync 5.0.2 validates this exact committed tree at truthful 100% file and LOC coverage, but Trust has no released patch that can consume it yet. This PR remains draft until a coordinated immutable Trust patch pin is available and exact-head hosted Trust passes.

Authenticated GitHub reads and mutations remain independently authorized and are intentionally excluded from the offline migration lane.

Exact head: 285789391a06a610e22a0cdc4e68da9c70d10004.

[gemini-code-assist]

Code Review

This pull request adopts SpecSync 5.0.1 and Trust 1.0.0 governance for the GitHub Fledge plugin, introducing canonical specs, companion files, migration change records, task definitions, and IDE skill commands. The review feedback suggests removing redundant empty headings in the skill markdown files, correcting split acceptance criteria in the migration change files, and expanding the smoke test and verification commands to cover all fledge-github sub-executables instead of only the main dispatcher.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:f5ee59c46f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[0xLeif]

Rollout update:

• This repository is public; its existing Ubuntu-hosted runner remains appropriate.
• Local SpecSync 5.0.2 validation is complete, but the pinned Trust 1.0.0 action composes SpecSync 5.0.1 and cannot consume the refreshed extensionless-source evidence.
• The PR remains blocked pending a compatible immutable Trust pin and exact-head hosted Trust success.

This PR remains draft until the release compatibility blocker is resolved.

[0xGaspar]

Reviewing as a comment rather than an approval, since this is a draft and self-blocked.

You've documented the blocker clearly:

Trust 1.0.0 intentionally bundles immutable SpecSync 5.0.1. That release does not recognize include_extensionless, cannot measure the six extensionless Bash executables, and rejects the refreshed accepted evidence.

That's a real coordination deadlock rather than anything wrong with this changeset, and I don't think there's a useful code review to give until the Trust patch pin exists. A few observations for when it does:

1. The dependency is worth recording somewhere durable. "Trust needs a released patch that can consume SpecSync 5.0.2" is the actual blocking work, and it currently lives only in this PR description. If there isn't a tracking issue on the Trust side, it'd be worth opening one and linking it here — otherwise this PR is the only record of a cross-repo dependency.

2. include_extensionless is the crux. Six extensionless Bash executables that the pinned SpecSync literally cannot measure means coverage is structurally unreportable, not merely low. Worth confirming that the eventual Trust patch fixes measurement rather than just relaxing the gate — the second would make the green check meaningless for this repo.

3. The diff is +1582/−0 across 63 files and almost entirely governance scaffolding (.specsync/, .claude/, .cursor/, .codex/, .gemini/, .trust.toml, .augur.toml), with no change to the bin/fledge-github* executables. If that's accurate — no product behaviour change at all — saying so as a one-liner at the top would let a reviewer calibrate quickly. Your summary says it, but it's below the fold.

4. trust is red in CI here, which is expected given the blocker. It's also red on all thirteen open PRs in CorvidLabs/spec-sync, including ones that merge and test clean. If those share a root cause it may be worth chasing centrally rather than per-repo.

No action needed from me until the Trust pin lands — ping me then and I'll do a proper pass.

[corvid-agent]

Request changes.

This draft is honest about why it cannot land, and hosted Trust is still red on 2857893.

1. .github/workflows/trust.yml pins CorvidLabs/trust@9d32b578 (v1.0.0) and never runs a SpecSync action. Trust 1.0.0 bundles SpecSync 5.0.1, which this PR's own body says cannot measure the six extensionless bin/fledge-github* binaries or accept the refreshed evidence. That blocker is still true on this head.

2. SpecSync 6 / Trust 1.2.0-rc.2 is the current product cut (spec-sync #748, corvid-verify #46). Landing a SpecSync 5 / Trust 1.0 adoption now is the wrong target. Retarget to a Trust pin that can consume SpecSync 6 (and truthful extensionless coverage), then re-verify hosted Trust.

3. The installed agent skills still teach the 5.0 SDD recipe and specsync check --strict as the PR gate. That is the same overtaken gate spec-sync #748 asked consumers to stop using.

Keep this draft until hosted Trust is green on a 6.x pin. This review does not merge.

[0xLeif]

Summary

• Adopt Trust 1.0.0 and prepare the GitHub plugin for SpecSync extensionless-source coverage without changing product behavior.
• Keep all six existing bin/fledge-github* executables in the active canonical GitHub spec with five stable requirements and no placeholder data.
• Lint and syntax-check every executable and smoke-test every offline --help surface.
• Install Claude, Cursor, Codex, and Gemini integrations and protect the repository's real runtime, spec, workflow, agent, and governance paths.
• Record the rollout files omitted from the earlier lifecycle scope and refresh portable verification and closing approvals.

Local verification

• released SpecSync 5.0.2 (a9422ae): 1/1 spec, 6/6 files, 1,411/1,411 LOC, 100%, zero warnings
• fledge lanes run verify: ShellCheck, Bash syntax, and all-executable offline help
• Claude, Cursor, Codex, and Gemini integrations installed
• fledge trust doctor
• local fledge trust verify: complete gate passed with expected progressive provenance because no remote ledger exists
• all review threads resolved and no merge conflict
• definition, native verification, and closing approvals recorded as user:0xLeif

Hosted verification

• pinned SpecSync contract / Trust
• CodeQL

Blocker

Trust 1.0.0 intentionally bundles immutable SpecSync 5.0.1. That release does not recognize include_extensionless, cannot measure the six extensionless Bash executables, and rejects the refreshed accepted evidence. Released SpecSync 5.0.2 validates this exact committed tree at truthful 100% file and LOC coverage, but Trust has no released patch that can consume it yet. This PR remains draft until a coordinated immutable Trust patch pin is available and exact-head hosted Trust passes.

Authenticated GitHub reads and mutations remain independently authorized and are intentionally excluded from the offline migration lane.

Exact head: 285789391a06a610e22a0cdc4e68da9c70d10004.

[gemini-code-assist]

Code Review

This pull request adopts SpecSync 5.0.1 and Trust 1.0.0 governance for the GitHub Fledge plugin, introducing canonical specs, companion files, migration change records, task definitions, and IDE skill commands. The review feedback suggests removing redundant empty headings in the skill markdown files, correcting split acceptance criteria in the migration change files, and expanding the smoke test and verification commands to cover all fledge-github sub-executables instead of only the main dispatcher.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:f5ee59c46f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[0xLeif]

Rollout update:

• This repository is public; its existing Ubuntu-hosted runner remains appropriate.
• Local SpecSync 5.0.2 validation is complete, but the pinned Trust 1.0.0 action composes SpecSync 5.0.1 and cannot consume the refreshed extensionless-source evidence.
• The PR remains blocked pending a compatible immutable Trust pin and exact-head hosted Trust success.

This PR remains draft until the release compatibility blocker is resolved.

[0xGaspar]

Reviewing as a comment rather than an approval, since this is a draft and self-blocked.

You've documented the blocker clearly:

Trust 1.0.0 intentionally bundles immutable SpecSync 5.0.1. That release does not recognize include_extensionless, cannot measure the six extensionless Bash executables, and rejects the refreshed accepted evidence.

That's a real coordination deadlock rather than anything wrong with this changeset, and I don't think there's a useful code review to give until the Trust patch pin exists. A few observations for when it does:

1. The dependency is worth recording somewhere durable. "Trust needs a released patch that can consume SpecSync 5.0.2" is the actual blocking work, and it currently lives only in this PR description. If there isn't a tracking issue on the Trust side, it'd be worth opening one and linking it here — otherwise this PR is the only record of a cross-repo dependency.

2. include_extensionless is the crux. Six extensionless Bash executables that the pinned SpecSync literally cannot measure means coverage is structurally unreportable, not merely low. Worth confirming that the eventual Trust patch fixes measurement rather than just relaxing the gate — the second would make the green check meaningless for this repo.

3. The diff is +1582/−0 across 63 files and almost entirely governance scaffolding (.specsync/, .claude/, .cursor/, .codex/, .gemini/, .trust.toml, .augur.toml), with no change to the bin/fledge-github* executables. If that's accurate — no product behaviour change at all — saying so as a one-liner at the top would let a reviewer calibrate quickly. Your summary says it, but it's below the fold.

4. trust is red in CI here, which is expected given the blocker. It's also red on all thirteen open PRs in CorvidLabs/spec-sync, including ones that merge and test clean. If those share a root cause it may be worth chasing centrally rather than per-repo.

No action needed from me until the Trust pin lands — ping me then and I'll do a proper pass.

[corvid-agent]

Request changes.

This draft is honest about why it cannot land, and hosted Trust is still red on 2857893.

1. .github/workflows/trust.yml pins CorvidLabs/trust@9d32b578 (v1.0.0) and never runs a SpecSync action. Trust 1.0.0 bundles SpecSync 5.0.1, which this PR's own body says cannot measure the six extensionless bin/fledge-github* binaries or accept the refreshed evidence. That blocker is still true on this head.

2. SpecSync 6 / Trust 1.2.0-rc.2 is the current product cut (spec-sync #748, corvid-verify #46). Landing a SpecSync 5 / Trust 1.0 adoption now is the wrong target. Retarget to a Trust pin that can consume SpecSync 6 (and truthful extensionless coverage), then re-verify hosted Trust.

3. The installed agent skills still teach the 5.0 SDD recipe and specsync check --strict as the PR gate. That is the same overtaken gate spec-sync #748 asked consumers to stop using.

Keep this draft until hosted Trust is green on a 6.x pin. This review does not merge.