From 8905e8f47007cc0e70c80bdf71be04a8e900385f Mon Sep 17 00:00:00 2001
From: 0xLeif <claude.condone765@passmail.net>
Date: Wed, 9 Sep 2026 20:27:28 -0600
Subject: [PATCH] Add: Trust 1.2.0 gate with SpecSync 6.0.0

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JNdwGkbfU1o5jk6LiPhcF2
---
 .attest.json                |  4 ++++
 .augur.toml                 |  3 +++
 .github/workflows/trust.yml | 20 ++++++++++++++++++++
 .specsync/config.toml       |  8 ++++++++
 .trust.toml                 | 22 ++++++++++++++++++++++
 AGENTS.md                   | 12 ++++++++++++
 fledge.toml                 | 10 ++++++++++
 7 files changed, 79 insertions(+)
 create mode 100644 .attest.json
 create mode 100644 .augur.toml
 create mode 100644 .github/workflows/trust.yml
 create mode 100644 .specsync/config.toml
 create mode 100644 .trust.toml
 create mode 100644 AGENTS.md
 create mode 100644 fledge.toml

diff --git a/.attest.json b/.attest.json
new file mode 100644
index 0000000..ba4a063
--- /dev/null
+++ b/.attest.json
@@ -0,0 +1,4 @@
+{
+  "requireAttestation": true,
+  "requireTestsPassed": true
+}
diff --git a/.augur.toml b/.augur.toml
new file mode 100644
index 0000000..031b459
--- /dev/null
+++ b/.augur.toml
@@ -0,0 +1,3 @@
+[thresholds]
+review = 35
+block = 65
diff --git a/.github/workflows/trust.yml b/.github/workflows/trust.yml
new file mode 100644
index 0000000..bd55597
--- /dev/null
+++ b/.github/workflows/trust.yml
@@ -0,0 +1,20 @@
+name: trust
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  trust:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+
+      - uses: CorvidLabs/trust@v1.2.0
+        id: trust
diff --git a/.specsync/config.toml b/.specsync/config.toml
new file mode 100644
index 0000000..c0f66ac
--- /dev/null
+++ b/.specsync/config.toml
@@ -0,0 +1,8 @@
+specs_dir = "specs"
+source_dirs = ["bin"]
+exclude_dirs = []
+required_sections = ["Purpose", "Public API", "Invariants", "Behavioral Examples", "Error Cases", "Dependencies", "Change Log"]
+enforcement = "strict"
+
+[lifecycle]
+track_history = false
diff --git a/.trust.toml b/.trust.toml
new file mode 100644
index 0000000..eabab42
--- /dev/null
+++ b/.trust.toml
@@ -0,0 +1,22 @@
+schema_version = 1
+profile = "standard"
+
+[lifecycle]
+command = ["fledge", "lanes", "run", "verify"]
+
+[contract]
+enabled = false
+require_coverage = 0
+skip_reason = "SpecSync cannot measure the extensionless Bash executables in bin/, so a contract layer would gate nothing; ShellCheck, bash -n, and --help smoke are the blocking checks"
+
+[risk]
+threshold = "block"
+
+[provenance]
+mode = "soft"
+policy = ".attest.json"
+skip_reason = ""
+
+[atlas]
+enabled = false
+skip_reason = "Atlas publication was not enabled during adoption"
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..3da08a2
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,12 @@
+<!-- CorvidLabs trust toolchain: BEGIN (managed, do not edit inside) -->
+## CorvidLabs trust toolchain
+
+This repository uses one trust gate. Every session must use it and must not bypass or weaken it.
+
+- Run `fledge trust verify` before calling a change complete.
+- Keep module specs synchronized with implementation changes.
+- Treat an Augur block verdict as a hard stop that must be surfaced and de-risked.
+- Record and verify provenance with Attest after the repository's verification lane passes.
+- Keep generated trust configuration and this managed block in place.
+
+<!-- CorvidLabs trust toolchain: END -->
diff --git a/fledge.toml b/fledge.toml
new file mode 100644
index 0000000..d527500
--- /dev/null
+++ b/fledge.toml
@@ -0,0 +1,10 @@
+# fledge.toml: project task definitions
+# Mirrors the three CI jobs in .github/workflows/ci.yml (ShellCheck, bash -n, --help smoke).
+[tasks]
+lint = "shellcheck --severity=warning bin/fledge-github bin/fledge-github-checks bin/fledge-github-issues bin/fledge-github-poll bin/fledge-github-prs bin/fledge-github-repo"
+syntax = "bash -n bin/fledge-github && bash -n bin/fledge-github-checks && bash -n bin/fledge-github-issues && bash -n bin/fledge-github-poll && bash -n bin/fledge-github-prs && bash -n bin/fledge-github-repo"
+smoke = "bin/fledge-github --help && bin/fledge-github-checks --help && bin/fledge-github-issues --help && bin/fledge-github-poll --help && bin/fledge-github-prs --help && bin/fledge-github-repo --help"
+
+[lanes.verify]
+description = "ShellCheck, bash syntax check, and --help smoke test every GitHub plugin executable"
+steps = ["lint", "syntax", "smoke"]