chore(release): prepare 0.55.11 security patch

openspec/CHANGE_ORDER.md

@@ -8,7 +8,7 @@ active changes should be implemented.
 
 | Bucket | Count | Location |
 |---|---:|---|
-| **Active-tree entries** | 35 | [`openspec/changes/`](changes/) |
+| **Active-tree entries** | 36 | [`openspec/changes/`](changes/) |
 | **Parking-lot entries** | 21 | [`openspec/parking-lot/`](parking-lot/) |
 | **Archived** | 120 | [`openspec/changes/archive/`](changes/archive/) |
 
@@ -307,3 +307,11 @@ repo root. Do not move folders manually.
 - [`INTEGRATION.md`](INTEGRATION.md) - cross-change ownership contract
 - [`config.yaml`](config.yaml) - repo-wide OpenSpec rules and context
 - [`specfact-cli-modules/openspec/CHANGE_ORDER.md`](https://github.com/nold-ai/specfact-cli-modules/blob/main/openspec/CHANGE_ORDER.md) - module-side companion plan
+
+## Main dependency-only release phase
+
+`isolate-semgrep-security-runtime` prepares issue #780 under parent #747 on
+`hotfix/security-dependencies-0-55-11`, based on main 5262efb0. Its native
+test-first proof precedes production changes. This scope excludes dev-only
+admission and runtime-smoke infrastructure. Future issues #523 and #783 do not
+block this bounded release. No merge, signing, or publication is authorized.

openspec/changes/isolate-semgrep-security-runtime/.openspec.yaml

@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-10-22

openspec/changes/isolate-semgrep-security-runtime/CHANGE_VALIDATION.md

@@ -0,0 +1,61 @@
+# Scope validation
+
+Checked 2026-10-22 Europe/Berlin against main 5262efb0 in the dedicated release
+worktree. This phase implements issue #780 release preparation, with parent #747.
+The coordinating agent verified Todo status, labels, project, and hierarchy.
+The dev change was read as context. Its admission artifacts and dev-only CI
+changes are excluded. Genuine main native RED is required before production edits.
+That initial status is historical. The 23-case correction was subsequently accepted
+and authenticated native RED ran at 8cce44f449e9559d0100064d629c81991784ab41.
+
+The owner explicitly approved the virtualenv correction on 2026-10-22. The
+coordinator rechecked issue #780 as OPEN/Todo with labels, project, and hierarchy
+intact, and updated the internal wiki mirror and rebuilt its graph. The corrected
+release selects nine changed Python packages relative to main. That correction received independent acceptance and native RED.
+
+The owner separately approved GitPython 3.2.1 and the exact opentelemetry-api
+1.37.0 exception on 2026-10-22. Fresh independent mapping acceptance for this new correction is recorded in
+requirements-proof/advisory-mapping-review.md. That advisory acceptance was later superseded by the accepted quality amendment
+and authenticated native RED described below. All twelve saved production paths
+were verified and backed up before restoration to HEAD. The four independently
+reviewed fixture corrections were preserved, then received the bounded test-only
+quality amendment recorded in requirements-proof/quality-mapping-review.md. The coordinating agent owns
+the matching internal wiki update and has reported its graph rebuild complete.
+
+On 2026-10-23 the coordinator refreshed issue metadata and verified OPEN/Todo,
+labels and project assignment. Fresh independent AI technical acceptance covers
+the quality amendment, unchanged canonical 31-case plan, genuine local RED and
+23 passing controls. That historical receipt references quality-mapping-review.md.
+The docs floor hunk is excluded from the test-only commit and held for matching
+production metadata. That requirement was subsequently satisfied for those exact 31-case bytes, as
+recorded below. The new parser correction still requires its own proof.
+
+Native RED was authenticated for commit 4936750186fcb339913a8710f3034cf1d2be901f,
+run 39866724812 attempt 1 and artifact 12463204671. All 31 selected cases fail for
+their intended assertions with no errors or skips. The artifact digest and exact
+source/tree/test/plan identities match. That opened only the then-authorized production
+unit. The parser correction below changes test bytes and closes adoption again.
+Local and native GREEN, independent production review and all final gates remain required.
+
+## Supported parser correction validation on 2026-10-23 Europe/Berlin
+
+The coordinating agent authorized the ordinary supported pycparser 3.12 upgrade
+and factual source review under the current repair grant. This adds one official
+package update to the prior nine. The twelve production paths were restored to
+4936750186fcb339913a8710f3034cf1d2be901f before this specification/test unit.
+The trust register, checker, toolchain, signatures and held docs floor are frozen.
+
+The active receipt references parser-mapping-review.md, which records fresh
+independent AI acceptance of all 33 selected cases and genuine local RED with
+33 passing controls. Native RED for these changed bytes remains pending. The quality acceptance
+and authenticated 31-case native RED remain history under their exact identities.
+The review date is 2026-10-22 UTC, equivalent to the observed review session on
+2026-10-23 Europe/Berlin. Expiry is 2026-11-04 inclusive. Real-clock enforcement
+and the hard-blocked 3.0 family remain unchanged. Root owns the internal wiki
+update, independent acceptance and subsequent production verification.
+
+The internal wiki mirror is pending authorization. Automatic approval review
+rejected the coordinator's sibling-repository write as outside the authorized PR
+and worktree scope. No wiki write or graph rebuild ran for this correction.
+The proposed patch is retained at
+`/private/tmp/specfact-release-20261022/audit/internal-wiki-parser-correction.patch`.