[IanFrelinger]

Summary

Makes master honest about the three 2026-10-06 owner decisions and related records drift after #720/#722/#721/#723. No behaviour change except tightening the readiness-push shell gate. Code follow-ups stay in 4.10b / 4.3b / 4.5b. This records PR does not settle the separate owner questions in the review.

Changes

• SPEC-007: status date 2026-10-08; three dated 2026-10-06 decisions-log rows (open-read → SystemHigh / Scenario B → SystemHighData; Q8 clarified/O1; O2); intro amended; 4.3/4.5/4.10 bullets carry merge SHAs; reverse "the owner can reverse it"; Known limits for O2 / ASPNETCORE_HTTP_PORTS / multi-frame on AG; [::1] wording
• docs/EgressInventory.md + CHANGELOG.md: same decision wording; ci: speed multi-PR merges — no readiness double-fire on cursor/** #723 CHANGELOG entry; past-tense 4.4 "no production frame" sentence; stale Program.cs / EgressGuard citations; TSV notes for SNS/telemetry lines
• Process docs: remove false stacking/fast-forward claim from CLAUDE.md, CONTRIBUTING.md, .github/workflows/README.md; drop post-hoc merge-commit exception; reconcile ~30–40 min timing
• tests/scripts/readiness-push-no-cursor-branches.test.sh: pin push.branches to exactly [master, main] and prevent reading another event's branch filter
• AshlarInboundListenerPolicy doc comment: bare ::1 refused; [::1] succeeds
• Cert count paragraph: 136 .cs / 139 entries as of 2026-10-08

Testing

• All five required checks passed on ef5920bdfd7857ba7eeda71dcf94d08b407aa546: cert-gate, build-core, shell-lint, lychee, and Readiness summary.
• bash tests/scripts/readiness-push-no-cursor-branches.test.sh passes on ef5920bd.
• The extractor is bounded to on.push: a valid fixture with no push branch filter and a later pull_request.branches: [master, main] falsely passed at 1d376c04, and is rejected at ef5920bd. Four fixture cases pass: baseline, added agent glob, missing push filter, and later PR filter.
• Two workflow mutations were run against the committed shipping tree; each failed for the expected reason, then the original bytes were restored, the whole checkout was clean, and the real gate passed again. Verbatim shell verdicts (exit codes, not .NET test counts):

shell-mutation extra-agent-branch: KILLED red=exit:1 green=exit:0 clean=yes ref=ef5920bdfd7857ba7eeda71dcf94d08b407aa546
shell-mutation missing-push-branches: KILLED red=exit:1 green=exit:0 clean=yes ref=ef5920bdfd7857ba7eeda71dcf94d08b407aa546

• Knowledge graph regenerated after staging; byte-equivalent to the tracked result (no generated-content change).
• Required Linux shell-lint on ef5920bd: repo-gates: all 28 gate(s) passed. The exploratory Windows suite is not acceptance evidence: Linux-specific fixture checks failed, and its branch-gate invocation overlapped the intentional workflow mutation. The branch gate passed separately after restoration; CI checked the clean committed tree.
• No local container/cert-gate run for this records and shell-gate change. The C# change is an XML comment only.

Testing strategy (blast radius)

Change type	Minimum proof
Docs / decisions log / process text	Review + KG regen
Shell gate (readiness-push-…)	Green + claude/** mutation red

• make kernel-coverage-gate (if touching src/Ashlar.Core.* or src/Ashlar.Infrastructure) — N/A (XML doc comment only)
• make kernel-gate — N/A
• make test-prod-style — N/A

Checklist

• Documentation updated
• No unresolved TODO / NotImplementedException
• Breaking changes: none (records honesty; code PRs follow)

Records touched (for Grok drift audit)

docs/specs/SPEC-007-security-labels-and-reference-monitor.md, docs/EgressInventory.md, CHANGELOG.md, docs/Configuration.md, docs/Federation.md, ci/cert-gate-assertions.md, ci/egress-inventory.tsv, CLAUDE.md, CONTRIBUTING.md, .github/workflows/README.md, AshlarInboundListenerPolicy.cs (doc), readiness-push test

Release

• Not a versioned release — skip