@@ -10,6 +10,35 @@ All notable changes to this project will be documented in this file.
 
 ---
 
+## [0.55.10] - 2026-10-13
+
+### Security
+
+- Reject malformed alternate project manifests during authenticated admission without aborting CLI startup.
+
+- Require authenticated project authority for indirect category mounts and shared member loaders, including bundle aliases and cross-category claims.
+
+- Bind privileged project registration metadata and executable inventory to authenticated artifact bytes; reproduce source caches before the final file check and recheck authority before registration effects.
+
+- Reject category-less grouped workspace root commands, external claims to permanent core commands and
+  unauthenticated workspace claims to official category roots before registry, bridge or import-source activation.
+- Preserve resolved built-in authority, reject forged source labels and escaping symlinks, and prevent
+  rejected workspace sources from shadowing eligible package dependencies.
+- Reject unsigned executable caches and omitted Python/native artifacts; authenticate captured signed source
+  bytes before reproducing compatible interpreter caches without executing candidate code.
+
+### Fixed
+
+- Select the first fully eligible copy of each module, reconsider dependency fallbacks against selected versions
+  and each candidate's own version, and refuse contradictory priority cycles before registration effects.
+- Preserve categorized routing and supported unreserved legacy registration, including operator-configured
+  built-in discovery, while retaining the completed removal of flat bundle shims.
+- Preserve all six official project-scoped bundle roots only after full artifact checksum and signature
+  verification against the core-bundled key; reject unsigned, tampered and workspace-key replacements.
+- Preserve genuine installed bundles when a rejected project copy claims the same name, retain authenticated
+  project priority, and skip artifact payload verification for disabled module names.
+- Synchronize bugfix version declarations, frozen project metadata and the promotion fixture.
+
 ## [0.55.9] - 2026-10-13
 
 ### Security
 
@@ -5,7 +5,7 @@ nav_order: 35
 permalink: /reference/module-categories/
 doc_owner: specfact-cli
 tracks: [src/specfact_cli/registry/**, ../specfact-cli-modules/packages/**]
-last_reviewed: 2026-07-10
+last_reviewed: 2026-10-11
 exempt: false
 exempt_reason: ""
 ---
@@ -91,6 +91,15 @@ Namespace mapping:
 Compatibility note:
 
 - Flat top-level command shims were removed. Use category groups (`project`, `backlog`, `code`, `spec`, `govern`, `requirements`).
+- Category-less workspace modules are skipped in default grouped mode. Add category/bundle metadata to
+  use the supported grouped surface. Explicitly disabling grouping preserves unreserved legacy workspace
+  commands; category-less user, marketplace and custom sources retain their compatibility path.
+- Permanent core commands (`init`, `module`, `upgrade`) are reserved for resolved built-in package paths.
+  Operator-selected built-in discovery remains supported. External packages cannot extend these roots
+  by declaring a core category, name or source label. Workspace packages also cannot supply official
+  category root command apps in either mode. Rejected packages contribute no active import roots,
+  schema extensions, service bridges or category mounts. Eligible categorized execution remains
+  intentional extension behavior; this guard is not a sandbox.
 - `specfact backlog auth ...` is provided by the backlog bundle, not by the permanent core command surface.
 - Prerelease `specfact-requirements` manifests that still declare category
   `project` with `bundle_group_command: requirements` are normalized to the
 
@@ -19,6 +19,34 @@ Module packages carry **publisher** and **integrity** metadata so installation,
 - **Publisher trust gate**: Non-official publishers require one-time explicit trust (interactive confirmation or `--trust-non-official` / `SPECFACT_TRUST_NON_OFFICIAL`).
 - **Denylist gate**: Modules listed in denylist are blocked before install/bootstrap regardless of source.
 
+## Workspace command authority
+
+Default grouped registration rejects category-less project modules before registration or import effects.
+Permanent `init`, `module` and `upgrade` commands require resolved built-in package paths in both modes.
+Unverified workspace packages cannot supply the official `project`, `backlog`, `code`, `spec`, `govern` or
+`requirements` roots. Supported official bundles installed with `--scope project` retain their canonical roots
+only after complete filesystem checksum and signature verification, including untracked module source files,
+against the public key bundled with the CLI and matching
+signed official bundle metadata. Payload symlink members, standalone bytecode, uncovered executable source and missing keys fail closed.
+Current-interpreter source caches remain compatible only when their compiled bytes match the signed source.
+Verification compares those bytes without executing or deserializing candidate caches. Unsigned/test flags, installation receipts and
+`SPECFACT_MODULE_PUBLIC_KEY_PEM` overrides cannot grant these project root commands.
+
+Categorized project packages can populate shared category-member loaders even when their commands do not name a
+root. They therefore require authenticated official bundle authority before candidate selection and registration.
+The same gate covers category mounts induced by explicit bundle metadata or namespaced bundle aliases.
+Explicit legacy registration retains unreserved category-less project commands without an official mount claim;
+non-project categorized routing retains its existing policy. These controls protect command admission and import activation, and do not sandbox intentionally
+invoked module code.
+
+## Preparing project-scoped release artifacts
+
+Publish regular payload files rather than symlinks. Replace links with their intended files before signing;
+remove standalone bytecode and executable files under directories excluded from signing. Regenerate ordinary
+source caches with the target interpreter, or remove stale or transformed caches before project installation.
+The strict project-root admission check independently verifies these conditions. Passing a companion repository
+signing or release-verification command alone does not establish eligibility for privileged project roots.
+
 ## Integrity flow
 
 1. Discovery reads `module-package.yaml` and parses `integrity.checksum`.
@@ -104,3 +132,9 @@ Module packages carry **publisher** and **integrity** metadata so installation,
 ## Versioned dependencies
 
 Manifest may declare versioned module and pip dependencies via `module_dependencies_versioned` and `pip_dependencies_versioned` (each entry: `name`, `version_specifier`). These are parsed and stored for installation-time resolution while keeping legacy `module_dependencies` / `pip_dependencies` lists backward compatible.
+
+Privileged project-root admission binds discovery fields to the same normalized manifest captured in the signed
+payload. It also completes reproduction of any permitted source caches before checking a fresh executable inventory.
+The final check compares membership, source/native digests and raw cache bodies without executing candidate code or
+invoking compilation. Admission and its recheck precede schema, bridge, protocol and import-root registration effects.
+These checks authenticate the admission snapshot; they do not make a mutable workspace immutable after admission.
@@ -4,6 +4,15 @@ This document is the living ownership contract for active SpecFact OpenSpec
 changes. It exists to keep parallel roadmap work aligned without creating a
 separate product feature for integration governance.
 
+## Ordinary workflow ownership
+
+- Paired `workflow-01-turn-orchestration` assigns reusable `specfact workflow` execution, bundled workflow skills, producer adapters and disposable local receipts to modules #483; core #742 owns repository settings, check-only gate adapters, thin wrapper projection and signed adoption/pilot.
+- This unsealed ordinary path does not replace optional preflight/checkpoint/conformance. Seal-bound behavior stays with its existing owners and applies only on explicit assurance selection.
+- R09 owns current-run Requirements claims; its module reconciler remains free of Git/test/network execution. Governance owns durable evidence envelopes, traceability owns artifact semantics, and C15 owns calibrated review policy. A workflow findings projection preserves original producer identities/outcomes and cannot fuse verdicts or silently extend ReviewReport.
+- Standalone verify and ordinary CI require no prior local receipts. Local progress cannot authenticate itself for protected CI. Generic #251/#253 still owns customer installation/export and general generated references; repository wrapper projection is a separate development convenience.
+- Release direction is modules #481 -> workflow modules #483 -> core #742 runtime adoption. Independent projection has no signed-runtime prerequisite. Related optional assurance/graph/findings work is not a blanket blocker.
+- Runtime integration/adoption validates exact signed #481 schema-v3 current_execution and actual core/#483 compatibility before selecting the workflow combination; a signed workflow alone is insufficient. Projection remains independent.
+
 ## Positioning
 
 SpecFact is the local validation and AI-bloat defense CLI. Active changes SHALL