CorvidLabs · 0xLeif · Sep 20, 2026 · Sep 26, 2026 · Sep 26, 2026 · Sep 26, 2026
@@ -48,7 +48,7 @@ jobs:
       # exercising the pull-request binary as the immutable contract gate.
       - name: CorvidLabs Trust gate
         id: trust
-        uses: CorvidLabs/trust@fcc889f54d8b4892a81af463c5a0250e2be66fc5 # v1.2.0
+        uses: CorvidLabs/trust@dd52a7a90ffbc1d2b1030e37007c18274f3d96bc # v1.2.1
         with:
           specsync-version: "6.0.0"
           specsync-download-base-url: file://${{ runner.temp }}/specsync-trust-mirror
@@ -0,0 +1,34 @@
+{
+  "schema_version": 1,
+  "workflow_version": 2,
+  "workflow_origin_version": 2,
+  "id": "pin-the-trust-gate-to-1-2-1",
+  "slug": "pin-the-trust-gate-to-1-2-1",
+  "title": "Pin the Trust gate to 1.2.1",
+  "description": "Pin the Trust gate to 1.2.1",
+  "kind": "operations",
+  "state": "accepted",
+  "canonical_applied": true,
+  "base_commit": "cddc39e478dcc1f111940a3cfb02134bba9804cc",
+  "created_at": 1790437668,
+  "updated_at": 1790443749,
+  "affected_specs": [],
+  "affected_paths": [
+    ".github/workflows/trust.yml"
+  ],
+  "no_spec_change": true,
+  "no_spec_change_rationale": "This changes only the pinned ref of the Trust action in CI. No canonical spec text changes because no module contract, public API, or behavior is affected.",
+  "acceptance_criteria": [
+    "The Trust gate step in .github/workflows/trust.yml resolves CorvidLabs/trust@dd52a7a90ffbc1d2b1030e37007c18274f3d96bc (v1.2.1, the peeled commit of the annotated v1.2.1 tag) instead of fcc889f54d8b4892a81af463c5a0250e2be66fc5 (v1.2.0). The runner-local file:// SpecSync mirror still works unchanged: Trust downloads specsync-linux-x86_64.tar.gz and its .sha256 from specsync-download-base-url, revalidates the checksum, and gates on the pull request's own freshly built binary. specsync-version stays 6.0.0. Nested Augur and Attest install their prebuilt Linux binaries (augur-linux-x86_64, attest-linux-x86_64) instead of building Swift from source, and the hosted trust check passes."
+  ],
+  "selected_artifacts": [
+    "context",
+    "plan",
+    "testing"
+  ],
+  "dependencies": [],
+  "answers": {
+    "architecture_risk": "no",
+    "public_contract": "no"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "approvals": [
+    {
+      "gate": "definition",
+      "actor": "user:0xLeif",
+      "timestamp": 1790443064,
+      "digest": "58eb157bde5b96fa2e91e96f2e1550de8b5c1b63f6bd10a399179b13875c4107",
+      "note": "Approved by Leif in the orc session, 2026-09-26: spec-sync #792",
+      "approved_scope": {
+        "schema_version": 1,
+        "change_id": "pin-the-trust-gate-to-1-2-1",
+        "title": "Pin the Trust gate to 1.2.1",
+        "description": "Pin the Trust gate to 1.2.1",
+        "kind": "operations",
+        "affected_specs": [],
+        "affected_paths": [
+          ".github/workflows/trust.yml"
+        ],
+        "no_spec_change": true,
+        "no_spec_change_rationale": "This changes only the pinned ref of the Trust action in CI. No canonical spec text changes because no module contract, public API, or behavior is affected.",
+        "acceptance_criteria": [
+          "The Trust gate step in .github/workflows/trust.yml resolves CorvidLabs/trust@dd52a7a90ffbc1d2b1030e37007c18274f3d96bc (v1.2.1, the peeled commit of the annotated v1.2.1 tag) instead of fcc889f54d8b4892a81af463c5a0250e2be66fc5 (v1.2.0). The runner-local file:// SpecSync mirror still works unchanged: Trust downloads specsync-linux-x86_64.tar.gz and its .sha256 from specsync-download-base-url, revalidates the checksum, and gates on the pull request's own freshly built binary. specsync-version stays 6.0.0. Nested Augur and Attest install their prebuilt Linux binaries (augur-linux-x86_64, attest-linux-x86_64) instead of building Swift from source, and the hosted trust check passes."
+        ],
+        "dependencies": [],
+        "supersedes": [],
+        "answers": {
+          "architecture_risk": "no",
+          "public_contract": "no"
+        }
+      },
+      "approved_delta_digests": {}
+    },
+    {
+      "gate": "finalization",
+      "actor": "specsync:finalization",
+      "timestamp": 1790443748,
+      "digest": "bd1be37cd849d4b4911800ccd13fe57adae33d4d2212200c37f5c2f8ae5b3bf3",
+      "note": "Same-PR finalization closing digest"
+    }
+  ],
+  "reopenings": []
+}
@@ -0,0 +1,24 @@
+---
+id: pin-the-trust-gate-to-1-2-1
+state: archived
+type: operations
+base_commit: cddc39e478dcc1f111940a3cfb02134bba9804cc
+---
+
+# Pin the Trust gate to 1.2.1
+
+## Intent
+
+Pin the Trust gate to 1.2.1
+
+## Affected Canonical Specs
+
+- None
+
+## Acceptance Criteria
+
+- The Trust gate step in .github/workflows/trust.yml resolves CorvidLabs/trust@dd52a7a90ffbc1d2b1030e37007c18274f3d96bc (v1.2.1, the peeled commit of the annotated v1.2.1 tag) instead of fcc889f54d8b4892a81af463c5a0250e2be66fc5 (v1.2.0). The runner-local file:// SpecSync mirror still works unchanged: Trust downloads specsync-linux-x86_64.tar.gz and its .sha256 from specsync-download-base-url, revalidates the checksum, and gates on the pull request's own freshly built binary. specsync-version stays 6.0.0. Nested Augur and Attest install their prebuilt Linux binaries (augur-linux-x86_64, attest-linux-x86_64) instead of building Swift from source, and the hosted trust check passes.
+
+## No-spec Rationale
+
+This changes only the pinned ref of the Trust action in CI. No canonical spec text changes because no module contract, public API, or behavior is affected.
@@ -0,0 +1,46 @@
+---
+change: pin-the-trust-gate-to-1-2-1
+artifact: context
+---
+
+# Context
+
+## What led here
+
+This repository's own Trust gate was pinned to
+`CorvidLabs/trust@fcc889f54d8b4892a81af463c5a0250e2be66fc5` (`v1.2.0`). Trust
+1.2.0 nests Augur and Attest at tips that, when run inside Trust, looked for
+their release assets in the calling action's repository rather than in
+`CorvidLabs/augur` and `CorvidLabs/attest`. `gh release download` then missed
+`augur-linux-x86_64` and `attest-linux-x86_64`, and both tools fell back to
+compiling Swift from source on every hosted `trust` run.
+
+Trust `v1.2.1` (`dd52a7a90ffbc1d2b1030e37007c18274f3d96bc`, the peeled commit of
+the annotated tag object `25f18128`) re-pins the nested actions to
+`CorvidLabs/augur@108a2ff4` and `CorvidLabs/attest@2182cae4`, which set
+`RELEASE_REPO` to their own repository and download the prebuilt Linux
+binaries. That is the only runtime change between `v1.2.0` and `v1.2.1`
+(`action.yml`: two `uses:` lines).
+
+PR #792 carried the one-line pin but failed `trust` and `Lifecycle gate`
+because `.github/workflows/trust.yml` is a meaningful path and no active change
+covered it. This change record covers it.
+
+## Constraints a session picking this up needs to know
+
+The Trust step here is not a normal consumer pin. The workflow builds the pull
+request's own SpecSync binary, packages it as a checksum-protected runner-local
+mirror under `${RUNNER_TEMP}`, and passes
+`specsync-download-base-url: file://${{ runner.temp }}/specsync-trust-mirror`,
+so Trust gates on the pull request's binary rather than on a published release.
+`scripts/trust_cli.py`, which resolves and downloads that mirror, is the same
+blob (`a82229c5`) at `v1.2.0` and `v1.2.1`, so the mirror path is unchanged.
+
+## Ruled out
+
+Trust `v1.2.2`. Its only runtime change re-pins Augur to a tip that reports a
+failed prebuilt download on Darwin/arm64 accurately; it does not affect the
+Linux runner this workflow uses. Moving to it is a separate change.
+
+Changing `specsync-version`, the mirror packaging steps, or the
+`specsync change audit --strict` preflight. None is stale.
@@ -0,0 +1,12 @@
+{
+  "schema_version": 2,
+  "change_id": "pin-the-trust-gate-to-1-2-1",
+  "implementation_commit": "c656982771a869edc29ff8f8e95d2d7aff95d6ca",
+  "implementation_tree": "1812691b2c90bee15ccd9d87cc2260905cf26d4c",
+  "contract_digest": "58eb157bde5b96fa2e91e96f2e1550de8b5c1b63f6bd10a399179b13875c4107",
+  "workspace_digest": "69577a876f5631724fc5fe7504066663ea8ae65afac8163cbf1e79770b7716c7",
+  "closing_digest": "bd1be37cd849d4b4911800ccd13fe57adae33d4d2212200c37f5c2f8ae5b3bf3",
+  "review_digest": "424a5d19c89fd6d767a7c8619b81caacabff6085ed431d636c9e1acf88df48a7",
+  "finalization_digest": "305e09ae9021efef99a33e580fa73c15217694ba647df49ca333079133f72911",
+  "timestamp": 1790443749
+}
@@ -0,0 +1,108 @@
+# Lesson bundle — pin-the-trust-gate-to-1-2-1
+
+Material for folding this change's lessons into the affected specs' `context.md`.
+Synthesise from what actually happened below; do not restate the change description.
+
+## What this change was
+
+- **Title**: Pin the Trust gate to 1.2.1
+- **Kind**: Operations
+- **Paths**: .github/workflows/trust.yml
+- **Acceptance**: The Trust gate step in .github/workflows/trust.yml resolves CorvidLabs/trust@dd52a7a90ffbc1d2b1030e37007c18274f3d96bc (v1.2.1, the peeled commit of the annotated v1.2.1 tag) instead of fcc889f54d8b4892a81af463c5a0250e2be66fc5 (v1.2.0). The runner-local file:// SpecSync mirror still works unchanged: Trust downloads specsync-linux-x86_64.tar.gz and its .sha256 from specsync-download-base-url, revalidates the checksum, and gates on the pull request's own freshly built binary. specsync-version stays 6.0.0. Nested Augur and Attest install their prebuilt Linux binaries (augur-linux-x86_64, attest-linux-x86_64) instead of building Swift from source, and the hosted trust check passes.
+
+## Evidence
+
+- Verification commit: `c656982771a869edc29ff8f8e95d2d7aff95d6ca`
+- Base commit: `cddc39e478dcc1f111940a3cfb02134bba9804cc`
+- Verified by: `specsync check (no spec in scope)`
+
+## From the change's context.md
+
+# Context
+
+## What led here
+
+This repository's own Trust gate was pinned to
+`CorvidLabs/trust@fcc889f54d8b4892a81af463c5a0250e2be66fc5` (`v1.2.0`). Trust
+1.2.0 nests Augur and Attest at tips that, when run inside Trust, looked for
+their release assets in the calling action's repository rather than in
+`CorvidLabs/augur` and `CorvidLabs/attest`. `gh release download` then missed
+`augur-linux-x86_64` and `attest-linux-x86_64`, and both tools fell back to
+compiling Swift from source on every hosted `trust` run.
+
+Trust `v1.2.1` (`dd52a7a90ffbc1d2b1030e37007c18274f3d96bc`, the peeled commit of
+the annotated tag object `25f18128`) re-pins the nested actions to
+`CorvidLabs/augur@108a2ff4` and `CorvidLabs/attest@2182cae4`, which set
+`RELEASE_REPO` to their own repository and download the prebuilt Linux
+binaries. That is the only runtime change between `v1.2.0` and `v1.2.1`
+(`action.yml`: two `uses:` lines).
+
+PR #792 carried the one-line pin but failed `trust` and `Lifecycle gate`
+because `.github/workflows/trust.yml` is a meaningful path and no active change
+covered it. This change record covers it.
+
+## Constraints a session picking this up needs to know
+
+The Trust step here is not a normal consumer pin. The workflow builds the pull
+request's own SpecSync binary, packages it as a checksum-protected runner-local
+mirror under `${RUNNER_TEMP}`, and passes
+`specsync-download-base-url: file://${{ runner.temp }}/specsync-trust-mirror`,
+so Trust gates on the pull request's binary rather than on a published release.
+`scripts/trust_cli.py`, which resolves and downloads that mirror, is the same
+blob (`a82229c5`) at `v1.2.0` and `v1.2.1`, so the mirror path is unchanged.
+
+## Ruled out
+
+Trust `v1.2.2`. Its only runtime change re-pins Augur to a tip that reports a
+failed prebuilt download on Darwin/arm64 accurately; it does not affect the
+Linux runner this workflow uses. Moving to it is a separate change.
+
+Changing `specsync-version`, the mirror packaging steps, or the
+`specsync change audit --strict` preflight. None is stale.
+
+## From the change's testing.md
+
+# Testing
+
+There is no unit test for a CI pin. Verification is a source comparison of the
+two Trust revisions plus the hosted run itself.
+
+## Verified before the ref was changed
+
+- `gh api repos/CorvidLabs/trust/commits/v1.2.1` resolves to
+  `dd52a7a90ffbc1d2b1030e37007c18274f3d96bc`; the `v1.2.1` ref points at tag
+  object `25f18128`, which peels to that commit.
+- `gh api repos/CorvidLabs/trust/compare/fcc889f5...dd52a7a9`: the only
+  `action.yml` change is the nested Augur pin (`25ef9339` to `108a2ff4`) and
+  the nested Attest pin (`e8a2d928` to `2182cae4`).
+- `scripts/trust_cli.py` has the same blob SHA (`a82229c5`) at both
+  revisions, so the `file://` SpecSync mirror resolution, checksum
+  revalidation, and `specsync-download-base-url` input are unchanged.
+- `action.yml` at `CorvidLabs/augur@108a2ff4` and
+  `CorvidLabs/attest@2182cae4` sets `RELEASE_REPO` to its own repository and
+  selects `augur-linux-x86_64` / `attest-linux-x86_64` on x86_64 Linux,
+  falling back to `swift build` only when that download fails.
+
+## Verified locally on the committed tree
+
+- `.github/workflows/trust.yml` still parses as YAML.
+- The product diff against `main` is one changed line in one file.
+- `fledge lanes run pre-push` passes.
+
+## Verified on the hosted run
+
+The pull request's own `trust` check is the real test. A passing run proves
+that Trust 1.2.1 resolved, installed SpecSync 6.0.0 from the `file://` mirror,
+accepted the locally built archive's checksum, and ran the contract, risk, and
+provenance stages. Its log should show `Installed augur (augur-linux-x86_64,
+1.0.0)` and `Installed attest (attest-linux-x86_64, 1.0.0)` with no Swift
+source build.
+
+Both `trust` and `Lifecycle gate` run `specsync change audit --strict` before
+the gate itself, which is why this change record exists:
+`.github/workflows/trust.yml` is a meaningful path and the audit fails closed
+when no active change covers it.
+
+## Where these lessons go
+
+This change declared no affected specs, so there is no module context to fold into.
@@ -0,0 +1,29 @@
+---
+change: pin-the-trust-gate-to-1-2-1
+artifact: plan
+---
+
+# Plan
+
+Single edit, one file, one line.
+
+1. In `.github/workflows/trust.yml`, change the `uses:` ref on the
+   `CorvidLabs Trust gate` step from
+   `CorvidLabs/trust@fcc889f54d8b4892a81af463c5a0250e2be66fc5 # v1.2.0`
+   to
+   `CorvidLabs/trust@dd52a7a90ffbc1d2b1030e37007c18274f3d96bc # v1.2.1`.
+
+   The SHA is the peeled commit of the annotated `v1.2.1` tag, not the tag
+   object. The SHA-plus-comment pin style is kept, and the pin stays immutable
+   rather than moving to the `@v1` major channel.
+
+2. Leave every other line of the step untouched, specifically
+   `specsync-version: "6.0.0"` and
+   `specsync-download-base-url: file://${{ runner.temp }}/specsync-trust-mirror`.
+
+## Explicitly out of scope
+
+No spec text changes, which is why this change was opened with
+`--no-spec-change`. No module contract, public API, or runtime behavior of the
+published `specsync` binary or the published Action is affected. This is the
+configuration of the gate that runs on this repository's own pull requests.
@@ -0,0 +1,21 @@
+{
+  "schema_version": 1,
+  "reviews": [
+    {
+      "schema_version": 2,
+      "change_id": "pin-the-trust-gate-to-1-2-1",
+      "reviewer": "user:0xLeif",
+      "provenance": {
+        "schema_version": 1,
+        "provider": "github_actions_check",
+        "required_check": "SpecSync scoped review"
+      },
+      "verdict": "pass",
+      "implementation_commit": "c656982771a869edc29ff8f8e95d2d7aff95d6ca",
+      "contract_digest": "58eb157bde5b96fa2e91e96f2e1550de8b5c1b63f6bd10a399179b13875c4107",
+      "execution_digest": "968e711a9e59b86a68809e44feeb2703adcbe14ca334de7e2bb9294db30c95d2",
+      "workspace_digest": "69577a876f5631724fc5fe7504066663ea8ae65afac8163cbf1e79770b7716c7",
+      "timestamp": 1790443689
+    }
+  ]
+}
@@ -0,0 +1,16 @@
+{
+  "schema_version": 2,
+  "change_id": "pin-the-trust-gate-to-1-2-1",
+  "reviewer": "user:0xLeif",
+  "provenance": {
+    "schema_version": 1,
+    "provider": "github_actions_check",
+    "required_check": "SpecSync scoped review"
+  },
+  "verdict": "pass",
+  "implementation_commit": "c656982771a869edc29ff8f8e95d2d7aff95d6ca",
+  "contract_digest": "58eb157bde5b96fa2e91e96f2e1550de8b5c1b63f6bd10a399179b13875c4107",
+  "execution_digest": "968e711a9e59b86a68809e44feeb2703adcbe14ca334de7e2bb9294db30c95d2",
+  "workspace_digest": "69577a876f5631724fc5fe7504066663ea8ae65afac8163cbf1e79770b7716c7",
+  "timestamp": 1790443689
+}
@@ -0,0 +1,34 @@
+{
+  "schema_version": 1,
+  "workflow_version": 2,
+  "workflow_origin_version": 2,
+  "id": "pin-the-trust-gate-to-1-2-1",
+  "slug": "pin-the-trust-gate-to-1-2-1",
+  "title": "Pin the Trust gate to 1.2.1",
+  "description": "Pin the Trust gate to 1.2.1",
+  "kind": "operations",
+  "state": "archived",
+  "canonical_applied": true,
+  "base_commit": "cddc39e478dcc1f111940a3cfb02134bba9804cc",
+  "created_at": 1790437668,
+  "updated_at": 1790444458,
+  "affected_specs": [],
+  "affected_paths": [
+    ".github/workflows/trust.yml"
+  ],
+  "no_spec_change": true,
+  "no_spec_change_rationale": "This changes only the pinned ref of the Trust action in CI. No canonical spec text changes because no module contract, public API, or behavior is affected.",
+  "acceptance_criteria": [
+    "The Trust gate step in .github/workflows/trust.yml resolves CorvidLabs/trust@dd52a7a90ffbc1d2b1030e37007c18274f3d96bc (v1.2.1, the peeled commit of the annotated v1.2.1 tag) instead of fcc889f54d8b4892a81af463c5a0250e2be66fc5 (v1.2.0). The runner-local file:// SpecSync mirror still works unchanged: Trust downloads specsync-linux-x86_64.tar.gz and its .sha256 from specsync-download-base-url, revalidates the checksum, and gates on the pull request's own freshly built binary. specsync-version stays 6.0.0. Nested Augur and Attest install their prebuilt Linux binaries (augur-linux-x86_64, attest-linux-x86_64) instead of building Swift from source, and the hosted trust check passes."
+  ],
+  "selected_artifacts": [
+    "context",
+    "plan",
+    "testing"
+  ],
+  "dependencies": [],
+  "answers": {
+    "architecture_risk": "no",
+    "public_contract": "no"
+  }
+}