spec: sync the specs with the 57 commits since the last sync

[potiuk]

Summary

• tools/spec-loop/.last-sync was 57 commits behind main. This brings the specs in line with what landed between 21fe6304 and 18071993 (Fix jq pre-flight projection; setup --pmc fetches all entitled Vulnogram tokens #1554 to setup: read-only vetted ops must never prompt (install applies, verify checks, update reports drift) #1640), and moves .last-sync to 18071993.
• Sixteen specs are updated:
  • pr-management family: code paths, mention policy, stats, quick-merge, code-review;
  • reviewer routing;
  • vetted ops (--save, the new reads);
  • adapters (Subversion details);
  • CVE tooling and the security lifecycle;
  • contributor growth (candidate-screen pre-filter and data-only report);
  • release (calendar-date versions);
  • adoption and setup (session-start drift mod, sha512 in svn-zip locks, the Grok guard);
  • marketplace, sandbox and diagnostics (fixed adversarial-review path, new release hosts, the Copilot guard);
  • meta tooling (the Claude Code mods CI, the multi-vendor neutrality score).
• Three specs stated the opposite of the code. They now match it:
  • candidate-screen does pre-filter (feat(contributor-growth): recent-activity check and stricter pre-filter options for candidate-screen #1592);
  • stats has one confirmed write, the secret gist (perf(pr-management-stats): build the whole dashboard as code #1572);
  • reviewer routing treats every member as eligible when no roster area matches (perf(pr-management): run mentor, reviewer-routing and pre-first-pr-check rules as code #1583).
• The non-ASF reviewer-routing smoke eval still expected NO ELIGIBLE REVIEWER for that last case. It now expects the lowest-load member, as the code chooses.

Type of change

• Documentation (docs/, README.md, CONTRIBUTING.md)
• Other: spec-loop specs and one eval fixture

Test plan

• prek run --all-files passes, including spec-validate and lychee
• non-asf-profile-smoke/step-reviewer-routing 2/2 (case 2 failed before this change)
• Claims spot-checked against the code: Subversion 1.9+, MIN_SUMMARY_CHARS = 40, the CODEOWNERS signal, screen_recent_activity_months (default 4), and the calendar-date block

Linked issues

None.

Notes for reviewers (optional)

• The sync was done commit by commit against the specs that cover each area, not with loop.sh update. That mode starts an unattended agent with auto-approval, which needs the sandbox harness.
• feat(mail): draft to Gmail or a local Maildir, set per project; setup proposes mail backends #1636 also adds an acceptance criterion 32 to adoption-and-setup.md. Whichever of the two merges second renumbers its entries.
• Commits judged to need no spec change: version bumps, test-hermeticity and CI-tuning commits no spec describes (Make two tests hermetic on macOS and under agent harnesses #1557, ci(tests): cap the pytest matrix at 15 concurrent jobs #1567, ci(prek): enforce LF line endings, not just consistent ones #1568, test: isolate container-gateway and symlink-lint fixtures from the host #1608, ci: cancel superseded pull request runs #1616), CodeQL cleanup (chore: address open CodeQL notes #1611), and PRs that already updated their own spec (Bitbucket, Discord, the typed-decision provider, the Grok spec-loop profile).

---

Generative AI disclosure: drafted with Claude Code (Opus 5.5) and reviewed by the author.

🤖 Generated with Claude Code