[rocklambros]

What changed

Completes the Current Priority Scope review that was due October 9, and stops CONTRIBUTING.md and SECURITY.md disagreeing about how fast we answer a security report.

Scope, checked against live state on 2026-10-30:

• Removes the PR Set the ACS-Core floor: MODIFY and system/ping to SHOULD, Wrapped MCP and subagentStart as conditional MUSTs #21 floor decision, merged on 2026-10-05.
• Replaces the claim template line, since PR docs: one-page ACS conformance claim template (#93) #168 merged it, with the two issues left in that milestone, issue A second ACS v0.1.0 implementation, its profile-by-profile claim, and what it can feed back #106 and issue [Proposal] Say that ACS conformance does not establish human authorization #136.
• Drops issue [Bug] §6.4's mandatory fail-open audit event has no conformant shape, so the decision-failure rate is unmeasurable #37 from the fail-open line, since it closed on 2026-10-22. Issue [Bug] §6.4 conflates Guardian refusal with decision failure; refusals are attacker-reachable and should fail closed #32 stays.
• Corrects "milestone [Proposal] Milestone: full ACS-Core conformance (requirement ledger + behavioral tests, beyond adapter emission) #33" to issue [Proposal] Milestone: full ACS-Core conformance (requirement ledger + behavioral tests, beyond adapter emission) #33, and names issue Forward Cursor's file-read hooks so a Guardian can govern file reads #212 for the Cursor file-read gap.
• Adds the public site to the in-focus list, scoped to changes that help an evaluator find, install, or run the Guardian. An evaluator can't take a Guardian they can't find, so issue Site navigation: one left pane for the landing page and the docs #361 keeps its scope:in-focus label. This answers the question on issue Review the Current Priority Scope (was due October 9, 2026) #265.
• Sets the next review to December 9, 2026, the day the ninety-day window from the September 10 kick-off ends.

Security: CONTRIBUTING.md promised acknowledgement within 72 hours, and SECURITY.md promises 3 business days. SECURITY.md is the policy, so CONTRIBUTING.md now links to it rather than restating a number.

Which issue does this implement

Closes #265

• This is an editorial correction (typo, grammar, link, formatting) with no change in
  meaning, so it needs no issue

Base branch

• integration, because this touches the specification, schemas, a reference
  implementation, an adapter, tests, or CI
• main, because every changed path is on the documentation lane allowlist in
  CONTRIBUTING.md

CONTRIBUTING.md is on the lane, but a closing keyword only works on the default branch, so this targets integration to close issue #265.

Type of change

• Specification change (schema, hooks, events, AgBOM)
• Reference implementation or adapter
• Documentation
• Tooling or CI
• Governance (licensing, security policy, contributor docs)

I tested this

• I synced my branch with the base branch before opening this
• uv run pytest -v passes on my machine
• uv run mkdocs build --strict passes on my machine

922 passed, 1 skipped. The strict build exited 0. The Next review line still matches the pattern scope-review.yml reads.

Checklist

• Commits are signed off with git commit -s (required by the DCO)
• Prose follows STYLE.md
• No secrets, tokens, or internal URLs in the diff

Security

• This change has no security impact