Add: Trust 1.2.0 gate with SpecSync 6.0.0

[0xLeif]

Summary

Class: adopt (first Trust adoption for this repo; there was no .github/workflows/trust.yml, no fledge.toml, and no specs).

Adds a Trust 1.2.0 gate that runs the repo's real verification lane (ShellCheck, bash -n, --help smoke) on every PR and push to main.

Pins: old -> new

Thing	Old	New
Trust CI action	none (no trust workflow existed)	CorvidLabs/trust@v1.2.0
SpecSync	none	6.0.0, supplied by Trust 1.2.0's default specsync-version (nested spec-sync@3c2ed497); not re-pinned here
Verification lane	none in-repo (CI only)	fledge lanes run verify via new fledge.toml

Pin style: the repo pins actions by tag (actions/checkout@v5 in ci.yml / pages.yml), so the Trust action is pinned to the immutable release tag v1.2.0 rather than a raw SHA. The actions/checkout line is left exactly as fledge trust adopt generated it (9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0), with fetch-depth: 0.

SpecSync: skipped, with reason

Adopted with --no-specs. Recorded reason in .trust.toml:

SpecSync cannot measure the extensionless Bash executables in bin/, so a contract layer would gate nothing; ShellCheck, bash -n, and --help smoke are the blocking checks

specsync check --strict reports 0/0 (no source files to measure) because every executable in bin/ is extensionless. A spec layer here would produce a coverage table that measures nothing, so the contract stage is off with the reason recorded instead of faked. .specsync/config.toml is committed with source_dirs = ["bin"] (adopt's default ["src"] does not exist in this repo) so the config is accurate whenever SpecSync gains coverage for these files.

SDD not required. No specsync change adopt, no require_change_for_meaningful_files.

Augur and Attest

• Augur: thresholds left exactly as adopt wrote them (review = 35, block = 65). No threshold tuning, no chasing verdicts on unrelated history.
• Attest: provenance stays mode = "soft" with .attest.json as the policy. Not changed to enforce. The local gate reports provenance degraded: remote ledger does not exist yet, which is non-blocking under soft mode.

Atlas

Not added. This repo has no .github/workflows/atlas.yml, so the Atlas job, the three Atlas steps, and the job-level outputs: atlas_enabled block that fledge trust adopt generates were deleted. .trust.toml keeps [atlas] enabled = false. The existing pages.yml (which publishes docs/ to GitHub Pages) is untouched.

New verification lane

fledge.toml was authored from the three jobs that .github/workflows/ci.yml already runs. Nothing invented:

• lint: shellcheck --severity=warning over the six bin/ executables
• syntax: bash -n over the same six
• smoke: --help on each of the six

Commands run, with exit codes

Run from the working clone; the verification block below ran against the committed tree with git status --porcelain empty.

Command	Exit
fledge lanes list	0
fledge trust adopt --dry-run	0
fledge trust adopt (first pass, default)	0
fledge trust adopt --force --no-specs "SpecSync cannot measure the extensionless Bash executables in bin/, ..."	0
fledge trust doctor	0 (CorvidLabs Trust: healthy)
specsync --version	0 (specsync 6.0.0)
specsync check --strict	0 (0/0, no specs, no measurable sources)
fledge lanes run verify	0 (3 steps)
python3 -c "import yaml,sys;yaml.safe_load(open('.github/workflows/trust.yml'))"	0
fledge trust verify --range origin/main..HEAD	0 (trust gate passed (progressive provenance), augur proceed (risk 21))
git push --force-with-lease -u origin leif/pin-trust-1-2-0-specsync-6-0-0	0

Note: bare fledge trust verify exits 1 locally with cannot infer a comparison range before the branch has an upstream; with --range origin/main..HEAD it passes. CI checks out with fetch-depth: 0, so the action resolves its own range.

Leftover drift (not fixed here, on purpose)

• ci.yml still runs ShellCheck, bash -n, and the --help smoke as three separate jobs. The Trust lane now runs the same three checks, so they overlap. Collapsing ci.yml into the Trust gate is a follow-up, not part of this pin.
• ci.yml and pages.yml keep their tag-style action pins and were not touched.
• SpecSync measures 0 source files in this repo. If SpecSync later handles extensionless executables, [contract] can be turned back on and .specsync/config.toml already points at bin.
• No Attest ledger exists on the remote yet, so provenance is degraded-but-soft on the first runs.
• The repo's own version (plugin.toml 0.6.6) and CHANGELOG were deliberately not bumped.

Hosted checks

Unchecked. The trust workflow has never executed on GitHub for this repo. Every exit code above is from a local run. The hosted result of this PR's first trust run has not been observed and is not claimed to pass.

Test Plan

• fledge lanes run verify passes on the committed tree
• fledge trust doctor healthy
• fledge trust verify --range origin/main..HEAD passes
• .github/workflows/trust.yml parses as YAML and declares exactly one job (trust)
• Hosted trust check green on this PR (not yet observed)

Do not merge until reviewed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JNdwGkbfU1o5jk6LiPhcF2

[corvid-agent]

COMMENT exact tip 8905e8f47007 — Add Trust gate CI-green. Standing policy: adopt only where a real gate already existed unless you confirm. No CoS APPROVE without that confirm.

CoS mention-triage 2026-09-09 22:24 MDT.

[corvid-agent]

CoS: Trust green — approve for squash-merge.