chore(release): prepare dev promotion to main

.github/actions/setup-runtime-smoke-fixture/action.yml

@@ -0,0 +1,36 @@
+name: Reviewed portable runtime smoke fixture
+description: Authenticate the signed portable module snapshot without changing Requirements authority.
+runs:
+  using: composite
+  steps:
+    - name: Read portable fixture identity
+      shell: bash
+      run: |
+        set -euo pipefail
+        python - <<'PYCODE'
+        import json
+        from pathlib import Path
+        expected = {
+            "repository": "nold-ai/specfact-cli-modules",
+            "commit": "046d366c190af7a188d6f48953a96edb65e766db",
+            "tree": "c5b44db3477d1c9ea8dae1dceab2af276d265353",
+        }
+        actual = json.loads(Path("ci/runtime-smoke-fixture.lock.json").read_text())
+        if actual != expected:
+            raise SystemExit("Unreviewed portable runtime fixture identity")
+        PYCODE
+    - name: Checkout portable runtime modules
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      with:
+        repository: nold-ai/specfact-cli-modules
+        ref: 046d366c190af7a188d6f48953a96edb65e766db
+        path: runtime-smoke-modules
+        persist-credentials: false
+    - name: Verify and export portable runtime fixture
+      shell: bash
+      run: |
+        set -euo pipefail
+        test "$(git -C runtime-smoke-modules rev-parse HEAD)" = "046d366c190af7a188d6f48953a96edb65e766db"
+        test "$(git -C runtime-smoke-modules rev-parse 'HEAD^{tree}')" = "c5b44db3477d1c9ea8dae1dceab2af276d265353"
+        test -z "$(git -C runtime-smoke-modules status --porcelain)"
+        printf 'SPECFACT_SMOKE_MODULES_REPO=%s/runtime-smoke-modules\n' "$GITHUB_WORKSPACE" >> "$GITHUB_ENV"

.github/review-notes/dependency-hotfix-admission.md

@@ -0,0 +1,34 @@
+# Scoped dependency hotfix admission follow-up
+
+This follow-up implements the Requirements admission requested after
+[nold-ai/specfact-cli#782](https://github.com/nold-ai/specfact-cli/pull/782)
+merged into dev. Its merge commit is
+`3cf72e848a2b5a233d3f599898d6983319d375de`. The original three Requirements
+checks remain failed. Security Audit passed with the exact temporary MCP
+advisory exception. A merge does not convert the failed provenance into proof.
+
+The companion protected-policy proposal is
+[nold-ai/.github#4](https://github.com/nold-ai/.github/pull/4).
+The implementation evaluates a separately approved HumanApprovedLateCycle
+state at all three core CI boundaries. The original native report remains
+failed and unchanged. Every boundary independently checks the exact source,
+head/tree, policy revision, evidence, live human permission and expiry.
+A previous decision sidecar grants no authority to another run.
+
+The original eleven dependency cases remain required. Three new workflow
+control cases cover native report preservation, enforced policy failures,
+scoped routing and an isolated CI-only native evidence attester. Their real
+pre-code workflow refusal is retained in the change's TDD evidence. The
+admission implementation has independent technical review and local verification.
+Protected deployment and live CI attestation verification remain pending.
+
+This follow-up changes CI controls and their specification and tests. It does
+not change application runtime, dependency pins, core version or signed module
+assets. It does not supply historical native RED, suppress other findings or
+authorize a protected deployment or merge. Signing is CI/CD-only. The owner
+will review the exact deployment and grant payloads after implementation.
+
+A later dependency-only package hotfix still starts from published v0.55.4
+commit `d579970565530c3fd7b98bad4de90cf874c2a99d`, with a release payload check
+that excludes unrelated unreleased dev runtime changes. This CI follow-up is
+not a package release or a promotion of all dev commits.

.github/workflows/docs-dependency-checks.yml

@@ -0,0 +1,66 @@
+name: Documentation Dependency Compatibility
+
+on:
+  pull_request:
+    paths:
+      - "docs/**"
+      - "scripts/check_jekyll_dependencies.rb"
+      - ".github/workflows/docs-dependency-checks.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  documentation-dependencies:
+    runs-on: ubuntu-latest
+    env:
+      BUNDLE_FROZEN: "true"
+      JEKYLL_ENV: production
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - name: Setup frozen Ruby bundle
+        uses: ruby/setup-ruby@e81a8fa391b11a595c1b7ed84177cc0fe02faf83
+        with:
+          ruby-version: "3.2"
+          bundler: "2.3.5"
+          bundler-cache: false
+      - name: Download hash-reviewed plugin artifacts
+        working-directory: docs
+        run: |
+          mkdir -p "${{ runner.temp }}/docs-bundle/ruby/3.2.0/cache"
+          cd "${{ runner.temp }}/docs-bundle/ruby/3.2.0/cache"
+          curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' \
+            'https://rubygems.org/gems/jekyll-redirect-from-0.17.0.gem' -o jekyll-redirect-from-0.17.0.gem
+          curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' \
+            'https://rubygems.org/gems/jekyll-feed-0.18.0.gem' -o jekyll-feed-0.18.0.gem
+          curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' \
+            'https://rubygems.org/gems/jekyll-relative-links-0.9.1.gem' -o jekyll-relative-links-0.9.1.gem
+          printf '%s\n' \
+            '703dab0428b20bb5d550ab83d3c28b65bb5ecc0f734c5e61ee680de391b3e897  jekyll-redirect-from-0.17.0.gem' \
+            '8e6829f455b8764a8fa1bbb198d0ebb3525128dacc6ffe9d15f4df7388bc3647  jekyll-feed-0.18.0.gem' \
+            '6d5d70578c669ef9ee4c67f617d91497e0506fe5c1a059e484a900e18efb202e  jekyll-relative-links-0.9.1.gem' \
+            | sha256sum --check
+      - name: Install locked documentation dependencies
+        working-directory: docs
+        run: |
+          bundle config set --local path '${{ runner.temp }}/docs-bundle'
+          bundle install --jobs 1 --retry 3
+      - name: Verify dependency security and compatibility
+        working-directory: docs
+        run: bundle exec ruby ../scripts/check_jekyll_dependencies.rb redirect feed_language feed_cdata relative
+      - name: Build root and prefixed documentation
+        working-directory: docs
+        run: |
+          bundle exec jekyll build --baseurl '' --destination '${{ runner.temp }}/docs-root'
+          bundle exec jekyll build --baseurl '/preview' --destination '${{ runner.temp }}/docs-preview'
+      - name: Retain built documentation and frozen inputs
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: documentation-dependency-evidence
+          path: |
+            docs/Gemfile
+            docs/Gemfile.lock
+            ${{ runner.temp }}/docs-root
+            ${{ runner.temp }}/docs-preview

.github/workflows/pr-orchestrator.yml

@@ -55,6 +55,7 @@
               - 'requirements/ci/locked.txt'
               - 'requirements/code-review/requirements.in'
               - 'requirements/code-review/locked.txt'
+              - 'requirements/runtime-smoke/**'
               - 'modules/**/module-package.yaml'
               - 'src/specfact_cli/modules/**/module-package.yaml'
               - 'scripts/check_license_compliance.py'
@@ -287,6 +288,10 @@
         if: needs.changes.outputs.skip_expensive_tests_dev_to_main != 'true'
         uses: ./.github/actions/setup-frozen-python
 
+      - name: Set up reviewed portable runtime fixture
+        if: needs.changes.outputs.skip_expensive_tests_dev_to_main != 'true'
+        uses: ./.github/actions/setup-runtime-smoke-fixture
+
       - name: Verify version strings are synchronized
         if: needs.changes.outputs.skip_expensive_tests_dev_to_main != 'true'
         shell: bash
@@ -442,7 +447,10 @@
           python-version: "3.11"
       - name: Set up frozen compatibility dependencies
         uses: ./.github/actions/setup-frozen-python
+      - name: Set up reviewed portable runtime fixture
+        uses: ./.github/actions/setup-runtime-smoke-fixture
+
       - name: Run Python 3.11 compatibility tests
         shell: bash
         run: |
           echo "🔁 Python 3.11 compatibility checks"
@@ -921,11 +929,14 @@
       - name: Set up frozen smoke dependencies
         uses: ./.github/actions/setup-frozen-python
 
+      - name: Set up reviewed portable runtime fixture
+        uses: ./.github/actions/setup-runtime-smoke-fixture
+
       - name: Run macOS runtime discovery smoke
         shell: bash
         run: |
           mkdir -p logs/runtime-smoke/macos
-          python scripts/runtime_discovery_smoke.py --modules-repo specfact-cli-modules --launcher direct 2>&1 | tee logs/runtime-smoke/macos/runtime-discovery.log
+          python scripts/runtime_discovery_smoke.py --modules-repo "$SPECFACT_SMOKE_MODULES_REPO" --launcher direct 2>&1 | tee logs/runtime-smoke/macos/runtime-discovery.log
 
       - name: Upload macOS runtime-smoke logs
         if: always()
@@ -980,11 +991,14 @@
       - name: Set up frozen smoke dependencies
         uses: ./.github/actions/setup-frozen-python
 
+      - name: Set up reviewed portable runtime fixture
+        uses: ./.github/actions/setup-runtime-smoke-fixture
+
       - name: Run Windows runtime discovery smoke
         shell: bash
         run: |
           mkdir -p logs/runtime-smoke/windows
-          python scripts/runtime_discovery_smoke.py --modules-repo specfact-cli-modules --launcher direct 2>&1 | tee logs/runtime-smoke/windows/runtime-discovery.log
+          python scripts/runtime_discovery_smoke.py --modules-repo "$SPECFACT_SMOKE_MODULES_REPO" --launcher direct 2>&1 | tee logs/runtime-smoke/windows/runtime-discovery.log
 
       - name: Upload Windows runtime-smoke logs
         if: always()
@@ -1163,10 +1177,23 @@
             -r requirements/code-review/locked.txt
           echo "REVIEW_TOOLS_PYTHON=${review_tools}/bin/python" >> "$GITHUB_ENV"
 
+      - name: Install frozen runtime smoke license scope
+        shell: bash
+        run: |
+          set -euo pipefail
+          python scripts/check_reproducible_delivery.py
+          smoke_tools="${RUNNER_TEMP}/specfact-runtime-smoke-license-scope"
+          uv venv --python "${pythonLocation}/bin/python" "$smoke_tools"
+          uv pip install \
+            --python "${smoke_tools}/bin/python" \
+            --require-hashes --no-deps --only-binary :all: \
+            -r requirements/runtime-smoke/locked.txt
+          echo "SMOKE_TOOLS_PYTHON=${smoke_tools}/bin/python" >> "$GITHUB_ENV"
+
       - name: Run license compliance gate
         run: |
           echo "🔍 Running license compliance gate..."
-          python scripts/check_license_compliance.py --code-review-python "$REVIEW_TOOLS_PYTHON"
+          python scripts/check_license_compliance.py --code-review-python "$REVIEW_TOOLS_PYTHON" --additional-python "$SMOKE_TOOLS_PYTHON"
 
   dependency-trust:
     name: Dependency Trust Gate
@@ -1214,6 +1241,7 @@
           echo "🔍 Running CVE security audit..."
           python scripts/security_audit_gate.py
           python scripts/security_audit_gate.py --requirement requirements/code-review/locked.txt
+          python scripts/security_audit_gate.py --requirement requirements/runtime-smoke/locked.txt
 
   reproducible-delivery:
     name: Reproducible Delivery Evidence