From a543856e72757bba4a40ed9232ef200f795e0467 Mon Sep 17 00:00:00 2001
From: Corvid Agent <95454608+corvid-agent@users.noreply.github.com>
Date: Wed, 2 Sep 2026 21:09:04 +0000
Subject: [PATCH 1/2] ci: pin CorvidLabs/trust to v1.2.0-rc.4

---
 .github/workflows/trust.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/trust.yml b/.github/workflows/trust.yml
index 5c1dec8..7de002f 100644
--- a/.github/workflows/trust.yml
+++ b/.github/workflows/trust.yml
@@ -27,7 +27,7 @@ jobs:
 
       - name: CorvidLabs Trust gate
         id: trust
-        uses: CorvidLabs/trust@9d32b5786d2e9e4d39fc581c0091c721ee3d4226 # v1.0.0
+        uses: CorvidLabs/trust@e0272543ad5c88ec75cea1e606cc2efa552af25b # v1.2.0-rc.4
 
       - name: Check managed agent rules
         run: |

From a6b858b75a5c7b983c4dbd2e62152f4720e04e84 Mon Sep 17 00:00:00 2001
From: Corvid Agent <95454608+corvid-agent@users.noreply.github.com>
Date: Wed, 2 Sep 2026 23:13:20 +0000
Subject: [PATCH 2/2] fix: dedupe catalog Public API constants for specsync 6

---
 specs/catalog/catalog.spec.md | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/specs/catalog/catalog.spec.md b/specs/catalog/catalog.spec.md
index 95a3ebf..2fbc03a 100644
--- a/specs/catalog/catalog.spec.md
+++ b/specs/catalog/catalog.spec.md
@@ -51,7 +51,6 @@ Context packs never include session paths or bodies.
 |--------|-------------|
 | `HostId` | Host attribution id (claude, grok, codex, cursor, openai, gemini, kimi, git, project, corvid, let, agent3md, unknown). |
 | `FindKind` | Closed catalog kind union for find/show. |
-| `FIND_KINDS` | Runtime list of all FindKind values. |
 | `FindScope` | project \| user \| all. |
 | `CardScope` | project \| user \| global on cards. |
 | `WorktreeStatus` | active \| prunable \| locked \| unknown \| missing. |
@@ -63,7 +62,6 @@ Context packs never include session paths or bodies.
 | `ContextResult` | context pack; sessions never []. |
 | `BuildContextOptions` | Options for buildScanContext. |
 | `ScanPolicy` | Fixed-root shallow scan limits and deny basenames. |
-| `DEFAULT_SCAN_POLICY` | Default ScanPolicy. |
 | `WorktreeBase` | In-repo worktree parent descriptor. |
 | `AssetBody` | showAsset return: card + body/payload. |
 | `OpenResult` | openPath classification + optional preview. |
@@ -117,8 +115,6 @@ Context packs never include session paths or bodies.
 | `externalWorktreeRoots` | Document caller-visible behavior and constraints. |
 | `skillRoots` | Fixed project and user skill catalog roots, including `.openai/skills`; user roots obey `include_user_skills`. |
 | `isDeniedBasename` | Document caller-visible behavior and constraints. |
-| `MAX_BODY_BYTES` | Document caller-visible behavior and constraints. |
-| `MAX_OPEN_PREVIEW_BYTES` | Document caller-visible behavior and constraints. |
 | `normalizeShowKind` | Document caller-visible behavior and constraints. |
 | `findGeminiAgents` | Document caller-visible behavior and constraints. |
 | `findKimiAgents` | Document caller-visible behavior and constraints. |