[0xLeif]

Summary

Adds the CorvidLabs Trust gate to this repository at an immutable pin, with SpecSync 6.0.0 supplying the contract gate.

Class: adopt

Pins: old -> new

Item	Old	New
Trust CI action	none (no .github/workflows/trust.yml)	CorvidLabs/trust@fcc889f54d8b4892a81af463c5a0250e2be66fc5 # v1.2.0
SpecSync	none	6.0.0 (Trust 1.2.0 default; nested spec-sync@3c2ed497 is not re-pinned here)
actions/checkout in trust.yml	none	@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0, fetch-depth: 0

The trust action is SHA-pinned with a # v1.2.0 comment to match the SHA-pinning style already used for actions/checkout in the same file. No floating tag is referenced.

SpecSync: adopted

Adopted, not skipped. .specsync/config.toml points source_dirs at bin, the repository's only executable source directory, and specs/corvid-skills/corvid-skills.spec.md is a real status: active spec for bin/corvid-skills and bin/fledge-skills covering purpose, the CLI surface, invariants, behavioral examples, the full error table, and dependencies. No TODO stubs and no fabricated coverage table.

One honest limitation is recorded in the spec itself: SpecSync cannot parse extensionless shell executables, so the Public API is written as prose rather than as an export table, and file/LOC coverage reports 0/0 (no source files to measure). [contract] require_coverage = 0 in .trust.toml reflects that rather than claiming a coverage number the tooling cannot produce.

SDD not required. No specsync change workspace was created and require_change_for_meaningful_files was not set.

Atlas, Augur, Attest

• Atlas: not added. fledge trust adopt was run with --no-atlas, and the Atlas render/upload steps, the deploy-atlas job, and the job-level outputs: atlas_enabled block that adopt still emits were removed from .github/workflows/trust.yml. .trust.toml records [atlas] enabled = false with the reason. This repository has no .github/workflows/atlas.yml.
• Augur: left as adopt generated it. Thresholds review = 35, block = 65 are untouched; no verdicts were chased on unrelated history.
• Attest: left soft. [provenance] mode = "soft" is unchanged and was not promoted to enforce. --no-attest was not needed.

Commands run, with exit codes

All run from the committed tree at 94a4df6, working tree clean.

Command	Exit
fledge trust adopt --no-atlas "Repo has no Atlas workflow; not adding one in this change"	0
fledge trust doctor	0 (CorvidLabs Trust: healthy)
specsync --version	0 (specsync 6.0.0)
specsync check --strict	0 (1 spec checked, 1 passed, 0 warnings, 0 failed)
fledge lanes run verify	0 (4 steps: plugin-validate, lint, test, diff-check, 43.4s)
python3 -c "import yaml,sys;yaml.safe_load(open('.github/workflows/trust.yml'))"	0

fledge trust verify was also run locally and exited 1, but that is a local-invocation artifact, not a repository defect: running Trust through the local Fledge plugin host exports FLEDGE_PLUGIN_DIR pointing at the trust plugin directory, and bin/corvid-skills resolves its catalog root from that variable, so tests/installer.sh looked for skills/ under the plugin directory. The pinned action does not reproduce this. At fcc889f5 the action installs its own Fledge 1.7.0 and runs the lifecycle command through scripts/trust_cli.py action-lifecycle, whose step environment sets only TRUST_CONFIG and SPECSYNC_PINNED_BIN. Running fledge lanes run verify directly, as CI does, exits 0.

Leftover drift

• Coverage cannot be measured for extensionless shell sources, so the contract gate validates the spec but not a coverage percentage. Renaming the executables to carry a .sh extension would fix that and is deliberately out of scope for this change.
• The pre-existing .github/workflows/ci.yml still pins actions by tag (actions/checkout@v5) and pins Fledge to v1.7.2 and CorvidLabs/let@v0.2.0. Not touched here.
• .specsync/hashes.json is committed as the SpecSync content cache; it is regenerated deterministically by specsync check.

Hosted checks

• Trust workflow green on this PR
• CI workflow green on this PR

Neither hosted check has been observed yet; the boxes stay unchecked until the runs report.

Do not merge until reviewed.

Test Plan

• fledge lanes run verify passes locally on the committed tree
• specsync check --strict passes locally on the committed tree
• Hosted Trust and CI checks pass

🤖 Generated with Claude Code

https://claude.ai/code/session_01JNdwGkbfU1o5jk6LiPhcF2

[corvid-agent]

COMMENT exact tip 5b8ee3fc73b9 — Add Trust gate CI-green. Standing policy: adopt only where a real gate already existed unless you confirm. No CoS APPROVE without that confirm.

CoS mention-triage 2026-09-09 22:24 MDT.

[corvid-agent]

CoS: Trust green — approve for squash-merge.