[pengfei-threemoonslab]

Summary

Release prep for v1.3.0 (no tracking issue); the 2026-11-05 backlog review found these PRs without entries.

CHANGELOG.md's ## Unreleased section becomes the GitHub Release body, and of the 66 PRs merged since v1.2.0 (7fc61ef4), 16 user- or contributor-visible ones had no line. This adds one line for each: a bold headline sentence, a short clause, and the closing issue's number (or the PR's own number when it closes none), following the existing entries. Outside contributors are not named, as in the existing entries. No existing line is edited. New lines go only at the two agreed anchors, so the five other v1.3.0 prep PRs do not conflict:

• End of ### Security, after the docs/trust-model.md lists every process entry: the redaction gaps from fix(privacy): redact AWS path keys and URL-safe Basic credentials #1106.
• End of ### Changes, after the Move the published-release pins … to v1.2.0 entry, in this order: OpenShell (stack order), application readers, the Action, the host-diff crash fix, and the slow marker.

Line	PR	Cites
Redaction of an AWS key in a path or URL segment and a URL-safe or unpadded Basic credential (Security)	#1106	#1082
audit --host inventories policies registered in .shipgate/openshell.json; host-grants 0.7 → 0.8	#949	#943
A host comparison says whether a selected policy's declared authority widened or narrowed	#950	#944
Verification binds the OpenShell inputs a comparison read	#951	#945
check, preflight, trigger and configured verify route a policy change; TRIGGER-OPENSHELL-BOUNDARY-CHANGED	#952	#946
Version 2 registration composes global, saved, image and provider inputs; host-grants 0.8 → 0.9	#958	#947
verify --openshell-proof-config / --openshell-proof-required; docs/openshell-native-trust-schema.v1.json, docs/openshell-native-evidence-schema.v1.json; SHIP-VERIFY-OPENSHELL-BOUNDARY-EXCEEDED, SHIP-VERIFY-OPENSHELL-PROOF-UNAVAILABLE	#959	#948
diff --application follows a caller-supplied tools list	#963	#963
Keeps readable SDK tools as not_established candidates	#1010	#1010
Identifies an SDK agent with a computed name by its source site	#1016	#1016
Reads if/else builders and an identified agent's capability field	#1017	#1017
Reads an SDK agent.clone(...); optional agent_settings in application comparison 0.4	#1018	#1018
Reads the synchronous Memory Bank client	#1019	#1019
Action inputs application, application_scope, application_fail_on; outputs application_status, application_json, application_markdown	#1015	#1015
diff no longer crashes on an unquoted YAML timestamp in a host file	#1105	#1100
Tests marked slow run nightly and in release verification, not on pull requests	#1006	#1006

Judgment calls:

• feat(openshell): bind selected policy inputs to verifier currency #951 gets its own line. The existing entry citing (#942, #945) ("Configured committed verification reads selected OpenShell file-link chains from the same verified Git object store…") was added by fix(openshell): preserve expansions and bind selected policy links #962 and describes fix(openshell): preserve expansions and bind selected policy links #962's link-chain snapshot. It does not describe feat(openshell): bind selected policy inputs to verifier currency #951's change: each comparison reads the selected policies from its own base and head tree, and the receipt binds their bytes, link targets and missing inputs, Git-ignored files included.
• fix(host-grants): handle YAML timestamps in config hashing #1105 goes under ### Changes, not Security. Host diff crashes on YAML timestamps resolved as datetime #1100 reports a crash (diff exits 1); its impact section says it "does not demonstrate a permissions bypass".
• ci: six shards, a slow marker with a nightly run, and sharded release verification #1006 gets a line, although it is mostly CI. It adds the slow pytest marker in pyproject.toml and a CONTRIBUTING.md paragraph telling contributors when to mark a test and how to reproduce what a pull request runs. That is contributor-visible, like build(deps): group Dependabot version updates per ecosystem (#501) #978's Dependabot line. The sharding itself is not mentioned.
• The two fix(openshell): preserve expansions and bind selected policy links #962 OpenShell entries come before the base OpenShell lines because of the mandated anchors. Reordering them at cut time, when the prose moves to docs/changelog/1.3.0.md, is the owner's call.

Deliberately not added

These merged PRs still have no entry. Each has a one-phrase reason so the owner can decide:

• build(deps): refresh all four locks with uv 0.13.6; hatchling 1.33.0, sigstore 4.5.1 #1107: lock refresh of all four locks with uv 0.13.6; pyproject.toml untouched, no runtime dependency or floor moves.
• build(deps): bump hatchling 1.32.4, rfc3161-client 1.0.9, msgpack 1.2.3, platformdirs 4.12.2 #966: build-backend floor (hatchling>=1.32.4) and dev and release-toolchain locks; no runtime dependency moved. Its rfc3161-client 1.0.9 fix for GHSA-87gx-4x38-2j9q is in the release signing toolchain (sigstore sign/verify), not in the installed package. The owner may want a Packaging line.
• Build(deps): Bump actions/setup-python from 7.0.0 to 7.1.0 in the github-actions group #1095: Dependabot actions/setup-python 7.0.0 → 7.1.0 in the workflows and in action.yml's composite setup step; no Action input or output changes. The owner may want a line, since action.yml is a distribution surface.
• Build(deps): Bump actions/download-artifact from 8.0.1 to 8.0.2 in the github-actions group across 1 directory #1013: Dependabot actions/download-artifact 8.0.1 → 8.0.2, workflows only.
• test(ci): keep fixture scans out of the runner's step summary and outputs #1101: test-only (outside contributor); conftest.py keeps fixture scans out of the runner's step summary and outputs.
• ci: split the suite into five shards #996, test(ci): measure the 13 unmeasured test files so shards balance #979: CI shard count and measured shard timings.
• fix: support PEP 508 extras-qualified pins in dependency lock verification #1007 (closes verify_dependency_lock.py calls an extras-qualified exact pin "neither an exact pin nor a direct URL" #500), fix: preserve distribution identity for extras-qualified lock pins #1009: maintainer lock-verification tooling. scripts/verify_dependency_lock.py now parses extras-qualified pins; no committed lock holds one, and CONTRIBUTING.md still tells maintainers to check for them.
• docs(benchmark): measure current application review usefulness #961: an interim application-benchmark ledger on main at 0e58e6ff, plus a summarize.py answer_id fix. It is superseded by the release-time Q2 measurement the runbook requires (§ Cutting the release, step 1).

Covered without a ref of their own, so not added: #1088 (the verifier 0.21 and agent-boundary-result v3 … capability row closed entry), #987 (Two credential shapes are no longer published), #919 ((#778)) and #962 ((#942), (#942, #945)).

Type

• Check or risk-model change
• Input adapter change
• CLI or GitHub Action behavior
• Report, schema, or SARIF output
• Documentation only

Authorship

• A coding agent wrote some or all of this change. Agent: Claude Code (Claude Opus 5.5)
• A person read the whole diff before opening this pull request.

Acceptance criteria

• Every PR the release-prep request names has a line, citing its closing issue or, when it closes none, the PR.
  • Evidence: the table above. Each line was written from the PR body and diff (gh pr view N --json title,body,files, plus git show of the docs, action.yml, CLI and check-catalog hunks). Every flag, input, output, check ID, trigger ID and schema file named was checked against the merged source: verify --openshell-proof-config/--openshell-proof-required in cli/verify/command.py, the Action inputs and outputs in action.yml, TRIGGER-OPENSHELL-BOUNDARY-CHANGED in docs/triggers.json, and the two SHIP-VERIFY-OPENSHELL-* checks in docs/checks/verify.yaml.
• The two new published OpenShell schemas are named, with the PR that added them.
  • Evidence: feat(openshell): bind optional native containment to trusted inputs #959 added docs/openshell-native-trust-schema.v1.json and docs/openshell-native-evidence-schema.v1.json (and their .well-known keys). Both are linked from the OpenShell: accept optional native containment evidence bound to a trusted boundary #948 line.
• Insert only at the two anchors; edit no existing line.
  • Evidence: git diff origin/main -U0 has exactly two hunks, @@ -11,0 +12 @@ and @@ -54,0 +56,15 @@. git diff --numstat is 16 0 CHANGELOG.md.
• The release-notes tooling still accepts the section, under the size limit.
  • Evidence: scripts/release_notes.py --changelog <temp copy with line 3 renamed to ## 1.3.0> --tag v1.3.0 exits 0 before and after. The section was 65,257 characters before and is 72,069 after (+6,812), against MAX_BODY_CHARACTERS = 125,000.

Verification

Command	Exit
python scripts/release_notes.py --changelog <copy of origin/main's CHANGELOG, ## 1.3.0> --tag v1.3.0	0 (55 lines, 65,257 characters)
python scripts/release_notes.py --changelog <copy of this branch's CHANGELOG, ## 1.3.0> --tag v1.3.0	0 (71 lines, 72,069 characters)
python -m pytest tests/test_distribution_surface_parity.py tests/test_release_advisory_pipeline.py tests/test_release_pipeline.py tests/test_unread_changed_inputs.py -n 4 (every test file that names CHANGELOG)	0 (623 passed, 1 skipped: the parity render check that re-arms at the next version bump)
python -m ruff check .	0

Release-readiness notes

• No user-code import added to default scan paths
• No network access added to default scan paths
• New or changed check IDs are documented in docs/checks.md (none changed; the two SHIP-VERIFY-OPENSHELL-* IDs named here were documented by feat(openshell): bind optional native containment to trusted inputs #959)
• Report/schema changes are additive or documented in STABILITY.md (no schema change)

The Unreleased section is now 72,069 characters. The other v1.3.0 prep PRs add more, and at cut time the long prose moves to docs/changelog/1.3.0.md (runbook § Cutting the release, step 1).

Out of scope

• Editing or re-citing existing entries, including adding (#1088) or (#987) to their unreferenced entries, and reordering the fix(openshell): preserve expansions and bind selected policy links #962 OpenShell entries.
• The release cut itself: highlights, the docs/changelog/1.3.0.md record and the Q2: n/49 development, m/≥30 holdout line.

🤖 Generated with Claude Code