chore(spec-loop): sync specs to main and advance .last-sync

[potiuk]

Summary

tools/spec-loop/.last-sync sat at a1cff444, 17 commits behind main.
Advancing the marker on its own would assert that the specs describe those
commits, so the drift is closed first and the marker moved to de7d7054 last.

Each of the 17 was checked against the specs individually.

Specs updated — shipped behaviour no spec described

Commit	Spec	What it now records
#1161	meta-and-quality-tooling	skill-evals reports ERROR, rather than PASS, when a case's CLI produced nothing gradeable
#1158	security-reporting	the dashboard projects the current partial bucket to its end-of-bucket value; RATE series (accumulate from zero) and LEVEL series (carry over) project differently, and mean-based signals are deliberately not projected
#1154	project-agnosticism	<PROJECT> and <project> are two placeholders holding different values; the lint carries both spellings and matches spaced variants
#1135	adapters	the forwarder relay's contact_handle defaults to an org-level shared inbox rather than a named individual; the multi-hop coordinator case is designed in RFC-AI-0008 and unimplemented
#1145	issue-management-family	the family's eval suites, plus the note that --cli runs belong outside a credential-denying sandbox

Commits needing no spec change

• fix(pairing-self-review): require dependency evidence #1152, fix(symlink-lint): enforce relay completeness and sync missing self-adoption symlinks #1143, feat(security): add security-model prepare / verify / update skills #1156 — each updated its own spec in-commit.
• fix(sandbox-lint): normalise every trailing slash, not just one #1149, fix(validator): tokenize gh-list-no-limit's flag check instead of substring match #1147, fix(agent-guard): scope Segment.raw to its own tokens, not the whole command #1151 — behaviour-preserving bug fixes; no contract moved.
• ci(asf.yaml): stop blocking merge on unresolved review threads #1155, chore(deps): bump the github-actions group with 3 updates #1141 — CI gating and a dependency bump.
• fix(docs): reconcile documentation with the state of the tree #1159 — its spec edits (adapters, organization-adapters,
  project-agnosticism) landed with it.
• fix(skills): derive the two remaining Airflow literals from project config #1144 — removes hardcoded literals that no spec asserted.

One gap recorded rather than papered over

No spec covers marketplace distribution, including the
0.2.0.dev<YYYYMMDDHHMM> stamping rule from #1160. That rule is load-bearing:
the marketplace is served from main, so adopters do install dev versions, and
claude plugin update compares version strings rather than commit SHAs — a
frozen suffix leaves an adopter told they are "already at the latest version"
indefinitely, recoverable only by a full uninstall and reinstall. Logged as a
Known gap in adoption-and-setup.md, wanting its own spec rather than a bullet.

Test plan

• prek run --all-files passes (exit 0)
• spec-validate tools/spec-loop/specs/ — no violations
• check-placeholders clean
• Every claim written into a spec was verified against the implementation,
  not inferred from the commit subject

Notes for reviewers

The #1158 bullet is worth a second look. My first draft claimed the dashboard
keeps the raw count alongside the projection and marks the bucket incomplete in
the rendered series. Neither is true — I had inferred it from what a reasonable
implementation would do. Reading core.py and render.py gave the actual
design: the RATE/LEVEL split, a projection floored at the observed count so it
can never un-count what already happened, and means excluded because a mean over
items seen so far is already an estimate rather than a partial accumulation.
The bullet now matches the code.

.last-sync is deliberately the last thing in the diff to move.

🤖 Generated with Claude Code

https://claude.ai/code/session_01So3JRGXrbqSGrohtZuHWKg