Chore(hygiene): Four v0.11 H6 deferrals — #18 advisory diff, SI schema gate, demo hash-pin, cflite cap

[allenfbyrd]

What

v0.11 hygiene H6 — four small deferred-queue items from the v0.10.17 close-out, each independently verified:

1. #18 — changelog-vs-commits ADVISORY diff

scripts/check_changelog_vs_commits.py, wired into verify-changelog.yml (whose checkout gains fetch-depth: 0 for the tag baseline). At release-prep time (version bumped, not yet tagged) it lists commits since the last release tag whose (#NNN) PR ref the new CHANGELOG block never mentions — the shape of a shipped-but-undocumented change. Always exits 0: a curated block folds/omits deliberately, so entry-COMPLETE cannot be a hard gate without lying; the value is the visible checklist in the release-prep PR's CI log. Self-skips outside release-prep (verified live: v0.10.17 tagged → skip) and fail-softs on shallow clones. 13 unit tests.

2. security-insights.yml CI-validate gate

The spec publishes CUE (not JSON Schema) and si-tooling v2 is a Go library, so the gate is cue vet -d '#SecurityInsights' with cue v0.17.0 (sha256-pinned install) against a vendored, byte-identical copy of spec/schema.cue @ ossf/security-insights-spec v2.2.0 (.github/schemas/, upstream sha256 in the workflow comment). Wired into verify-osps-conformance.yml. Observed firing first (lesson 9): the real manifest failed vet — security.tools[].rulesets is a required field — fixed honestly (the osv-scanner.toml allowlist / dependabot.yml named as the customized rulesets) + last-updated bumped; now vets clean.

3. Demo-image pyyaml hash-pin (alert #180)

Committed docker/demo/requirements.txt with PyPI-sourced sha256 hashes (cp313 manylinux x86_64 + aarch64 + sdist); Dockerfile.demo installs with --require-hashes (same mechanism as the main Dockerfile's pip-compile closure and the verify-osps requirements file). Smoke-built locally against python:3.13-slim: build green; sh and collect okta refusals still exit 2 per the run contract.

4. cflite-batch runtime cap

timeout-minutes: 60 (PR #172 rationale): the 1800s fuzz budget + build time fits well under 60 — a wedged daily run must not burn the 6-hour default ceiling.

Verification

13 + existing unit tests green · ruff clean · zizmor across all touched workflows: no findings · audit_workflow_permissions.py --strict PASS · full local gate suite green.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
evidentia	Ready	Preview, Comment	Jul 14, 2026 9:28pm

[codspeed-hq]

Merging this PR will not alter performance

✅ 6 untouched benchmarks

---

_{Comparing chore/h6-small-deferrals (90c7266) with main (2c0180f)}