[rocklambros]

19 commit(s) ahead. Merging publishes the site and every schema $id URI. Merge with a merge commit, not a squash: squashing flattens the specification history that makes a schema change reviewable later.

What this ships

This is not a release. version.txt stays 0.1.4, so no tag is created.

• Site: one navigation pane on the landing page and the docs (PR Show one navigation pane on the landing page and the docs #366).
• Trace: an OCSF class entry for the allow decision (PR Give the OCSF allow decision its own class entry #278), and a skill component trigger in the AgBOM update-trigger list (PR docs(inspect): add skill component trigger to AgBOM update-trigger list #338).
• Governance: a DCO check on pull requests (PR Fail a pull request that has a commit with no sign-off #407), a scope check (PR Flag a pull request no lead asked for with one small check #406), sign-off guidance (PR Show contributors how to sign their commits #417), SECURITY.md response wording (PR State a first-response aim and say triage happens as issues come in #409, PR Replace SECURITY.md's fixed response times with an aim until 1.0 #413, PR Say advisories start at version 1.0 in SECURITY.md #418), and CODEOWNERS cleanup (PR Remove three inert owners from CODEOWNERS #414).
• Tooling: PR Give the AGT reference implementation Dependabot coverage #126, PR fix(conformance): fall back to tmpdir-scoped rmSync in test cleanup when trash is absent #345, PR Complete the priority scope review and point security timing at SECURITY.md #372, PR Link a closed milestone with nothing done to the milestone in the health issue #408, PR Read GH-N as an issue reference in closing_choice #410, PR Read the workstream table through one parser, so the landing page drops a commented-out row #411, PR Report an admin merge in the health issue unless a reviewer with write access approved it #412, PR Catch the five HTML and CSS forms the third-party guard missed #415, and PR deps: bump certifi from 2026.7.22 to 2026.10.19 #327.

This goes ahead of the owaspacs.org cutover so that the later promotion carries only PR #416.

[rocklambros]

Admin merge at Rock's direction on 2026-10-31. This clears integration ahead of the owaspacs.org cutover, so that the next promotion carries only PR #416. Required checks pass.