[nstranquist]

Outcome

Publish the 102 commits on the maintainer's local main that were never pushed. main is protected (pull request plus 6 required checks), so this branch carries local main unchanged for review and CI. It includes #11 as-is, plus revised versions of the release-evidence stack (#5, #8, #9) and the Windows fence work (#7). Those PRs can be closed as superseded once this merges.

Safety review

• The change does not stash, reset, clean, force-update, merge, or push. (This PR only publishes existing commits; nothing was rewritten.)
• Concurrent index, ref, lock, path, hook, and crash behavior was considered. (Per-commit; see the individual commits.)
• New state has a bounded and fail-closed reader. (Per-commit.)
• Tests cover the failure boundary. (Required checks run on this PR.)

Verification

• git rev-list --count origin/main..main → 102; git rev-list --count main..origin/main → 0 (pure fast-forward).
• gitleaks git --log-opts=origin/main..main → no leaks.
• The 6 required status checks run on this PR.

Commits

• fix(engine): materialize verify candidates byte-exact on Windows
• fix(integration): reconcile hook contract and skill digest
• feat(skill): publish hardened capture contract
• docs(readme): explain bounded capture execution
• fix(gitx): isolate inherited pathspec modes
• fix(engine): bound hook and verifier inputs
• feat(contract): advertise hardened capture inputs
• docs(security): record capture boundary review
• fix(init): anchor linked-worktree recovery
• docs(changelog): record capture boundary hardening
• docs(upgrade): document retained binary revisions
• fix(wip): retain rollback binaries before upgrade
• fix(wip): keep released handoffs byte-identical
• docs(safety): explain copied-hook read-only boundary
• fix(engine): force read-only mode for copied hooks
• docs(architecture): define copied-hook read-only mode
• docs(security): define completed migration evidence
• fix(migration): accept post-cutover store advances
• docs(migration): record completed status contract
• docs(changelog): record migration status contract
• fix(wip): report empty handoff as not ready
• docs(readme): explain stale-lane migration safety
• fix(coordmigration): archive stale active lanes
• docs(migration): define stale-lane archive policy
• docs(security): refresh migration source review
• fix(coordmigration): archive empty legacy v2 scaffold
• fix(coordmigration): normalize immutable Windows state
• fix(atomicfile): finalize read-only Windows creates
• fix(coordmigration): publish canonical NDev review domain
• test(filelock): prove Windows replacement fence
• test(wip): retain scale and worktree dogfood
• fix(migrate): declare dynamic outputs explicitly
• refactor(wip): remove obsolete archive helper
• fix(engine): resolve verifier scratch root physically
• fix(engine): capture tracked files below ignored parents
• feat(wip-commit): ship the portable protocol v3 workflow
• build(release): verify source-bound publication evidence
• docs(security): align guidance with capture-only authority
• test(version): bind the release corpus to one version
• test(docs): keep protocol documents synchronized
• test(capture): lock the public capture schema
• feat(store): enforce reader floors and writer fences
• fix(gitx): confine repository discovery and git execution
• feat(engine): harden source-bound capture transactions
• feat(migration): add digest-bound coordination cutover
• feat(contract): publish the protocol v3 capability bundle
• docs(examples): show the protocol v3 agent workflow
• docs(protocol): define canonical capture and migration workflow
• feat(wip): expose reviewed capture and migration commands
• docs(changelog): record protocol v3 consolidation
• fix(doctor): stop routing on legacy marker
• fix(skill): route legacy marker upgrades
• feat(protocol): harden standalone coordination upgrades
• fix(lock): make zero wait fail fast
• docs(integration): normalize decision identifiers
• docs(dogfood): record archive replay closure
• docs(dogfood): record installed workflow proof
• docs(onboarding): complete adopter journey
• docs(community): add conduct reporting
• docs(release): record correction receipt evidence
• docs(release): define correction receipt procedure
• feat(release): add hosted correction verifier
• docs(release): record hosted publication evidence
• test(release): track attest v4.2.2 pin
• build(deps): bump actions/attest from 4.2.1 to 4.2.2
• docs(changelog): record Windows registry fix
• docs(store): explain record registry fence
• fix(store): fence concurrent record reads
• ci(windows): stress concurrent lane capture
• test(wip): expose concurrent capture failures
• docs(docs): guide repeated archive maintenance
• docs(docs): explain repeated archive ownership
• test(wip): prove repeated archive health
• fix(store): validate rearchived receipt history
• test(wip-commit): cover root configuration plans
• fix(wip): guide root configuration groups
• ci(ci): run portable behavior benchmark
• docs(docs): explain portable behavior proof
• test(wip-commit): add portable behavior benchmark
• fix(init): serialize abort with initialization
• fix(init): abort safe pre-lane recovery intents
• docs(skill): require archive lane filter replay
• docs(readme): repeat archive lane filters
• docs(errors): explain scoped archive replay
• fix(archive): make scoped replay explicit
• docs(skill): require source-stamped identity
• build(release): stamp binary source identity
• docs(readme): explain source-stamped binaries
• feat(version): report exact build provenance
• docs(capture): record protected landing handoff
• docs(capture): explain atomic agent handoff workflow
• test(schema): validate published command contracts
• fix(capture): harden agent workflow boundaries
• chore(capture): remove dead plan helper
• feat(skill): teach reviewed capture workflow
• docs(capture): define operational handoff contracts
• feat(capture): add reviewed agent workflow
• docs(skill): enforce lane-bound environment use
• docs(readme): require the lane-bound checkout
• docs(errors): explain worktree mismatch recovery
• fix(env): reject mismatched worktree identity
• feat: add public product passport

Release note

No v0.2.0-beta.1 tag is created by this PR. Per docs/RELEASE.md, tagging still needs explicit owner tag approval and the open public-beta gates (OSS-008, 010, 011, 012, 013, 014, 016, 024, 025, 026).

[nstranquist]

Added ddf9635: candidate materialization pins core.autocrlf=false/core.eol=lf, and .gitattributes keeps the digest-bound skill payload LF on every platform. This fixes both windows-latest failures (TestVerifyMaterializesOnlyDeclaredCandidateScopes CRLF mismatch and TestEmbeddedContractMatchesCommandContract digest drift).