release: SkillSpector 2.12.0

[mohgupta-ship-it]

Prepare SkillSpector 2.12.0 from v2.11.2, with the package version, lockfile, changelog, and release notes covering 69 merged PRs (43 categorized as fixes) through 05119f4b868aafc7a6347043d3c3b8f9ac548091.

The release remains 2.12.0 because it adds CLI controls, integrations, LLM provenance, dependency-source analysis, GitHub subdirectory inputs, and other capabilities alongside security and correctness fixes. The latest four merges are #553, #615, #563, and #514; the previously excluded Markdown-reference and runtime-command fixes are now included. Migration requirements and changes to findings, completeness, and installation decisions are detailed below.

Included changes

Capabilities and providers

• Add sanitized JSON metadata.llm_provenance schema 1 with configured/resolved/effective provider identity and requested-versus-observed sampling/reasoning controls; this does not guarantee deterministic provider behavior (feat(report): add LLM analysis provenance #556).
• Detect noncanonical/unresolved npm, Yarn, pip, Poetry, Maven, and Cargo dependency sources with deterministic HIGH SC10 across supported configs, shell scripts, generated heredocs, and actionable SKILL.md/README.md shell fences (Detect dependency source redirection #383).
• Support HTTPS GitHub /tree/ directory selection with longest advertised branch/tag resolution, including slash-containing refs, bounded ingestion, and path-escape rejection (feat(input): support GitHub tree subdirectories #561).
• Add opt-in compact prompt line labels via SKILLSPECTOR_COMPACT_PROMPTS=1|true|yes; defaults remain unchanged (feat(llm): add compact prompt line numbering #542).
• Expand OpenAI/Azure GPT-family model-budget metadata without changing default models or API adapters; Responses-only entries do not establish compatibility with another API (feat(providers): add current GPT budgets to OpenAI and Azure registries #539).
• Add opt-in --fail-on-findings across single-skill, recursive, and MCP registry scans (feat(cli): add fail-on-findings option #469), and a configurable per-artifact static-analysis allowance (feat: make static analysis runtime configurable #522).
• Add the opencode_cli semantic provider, now requiring exactly OpenCode 1.18.31, with authentication and deny-all policy checks (feat(providers): add opencode_cli semantic-scan provider #536, feat(providers): verify OpenCode 1.18.31 for the deny-all policy #575).
• Add the repository-provided OpenCode /skillspector command and skillspector_scan tool with static analysis by default and semantic analysis opt-in (feat(analyzer): add OpenCode-native SkillSpector invocation skill and tool #537).
• Add bounded interactive progress and discovered-file display on stderr, plus gemini-3.5-flash metadata through the existing OpenAI-compatible provider (Feature/gemini support and cli ux #7).
• Extend TP4 semantic implementation checks to recognized executable Markdown/text fences, retaining source line numbers and provider/privacy/resource limits (feat(tp4): analyze fenced code in Markdown as skill implementation #421).
• Retry transient connection, timeout, selected HTTP, and Bedrock service/throttling failures with bounded backoff and Retry-After handling within the workflow deadline; retain sanitized incomplete-analysis diagnostics when recovery fails (fix(llm): retry transient provider failures #555).
• Reuse existing clients when retargeting workflow deadlines (fix(llm): retarget the deadline on the existing client instead of rebuilding it #520), honor CLI-provider model-registry overrides (fix(providers): honor model registry overrides for CLI providers #463), and use the validated provider-eligible cache for multilingual batch analysis (fix(batch-scan): reuse validated cache for multilingual analysis #558).

Security and completeness

• Preserve incomplete coverage for runtime-selected printf/executable wrappers, bounded eval and shell -c, PowerShell-embedded shell commands, unsupported brace expansion, cross-window commands, and parser/deadline uncertainty. Successful semantic analysis cannot override these coverage gaps (fix: keep runtime-selected printf reconstruction incomplete #514).
• Reject recognized unsupported selected inputs and in-profile SKILL.md/skill.md, including nested or renamed ZIP members, with fatal unsupported_primary_content, failed execution, CLI exit 2, and MCP installation blocking. Preserve raw bytes and remove rejected primary text from provider input; supported ZIP and incidental-asset policies remain (fix: preserve incomplete scans for unsupported input and multiline prompts #563).
• Preserve fatal input outcomes and excluded-content evidence through ledger truncation and later manifest limitations. A valid trailing UTF-8 code point cut by a byte limit remains partial size-limit evidence rather than an unsupported-encoding failure (fix: preserve incomplete scans for unsupported input and multiline prompts #563).
• Record covered pure/mixed singleton multiline prompt spacing as AE6 plus obfuscated_instruction_text partial evidence at original source lines, with interruptible workflow-bounded matching rather than a confirmed semantic P3/P4 claim (fix: preserve incomplete scans for unsupported input and multiline prompts #563).
• Preserve recursive/transitive child failures, aggregate risk/completeness, and omission evidence under reporting limits; actual execution failures exit 2. Bound static path postprocessing under existing analysis budgets (fix(cli): make recursive scans fail closed #576).
• Report analyzer registry/import failures as SYSTEM/PARTIAL analyzer_load_error coverage gaps rather than silently complete scans; execution success remains distinct from completeness (fix(analyzers): surface analyzer modules dropped at registry load time #591).
• Narrowly omit AE1 for verified passive rendered Markdown-image references to minimal non-interlaced PNG bytes when only unsupported-format limitations remain. Coverage stays incomplete/CAUTION and MCP installation stays blocked; other uses of resolved targets, malformed/non-PNG content, and mixed/unknown limitations retain AE1. Recognize DEX/Lua bytecode as binary/executable (fix(analyzer): distinguish format-only opaque references in AE1 #597).
• Preserve authoritative SC9/SC10 findings through optional LLM filtering and redact URL credentials/sensitive query fields throughout nested report evidence and dependency-source meta-analysis inputs (Detect dependency source redirection #383).
• Analyze bounded description activation intent only when legacy triggers are absent/empty; report excess signal-bearing clauses as incomplete coverage (fix(static): analyze description activation intent #541).
• Detect literal subprocess shell flags with scope/reassignment checks (fix(static): detect literal shell flag assignments #560), bounded literal XOR script-fetch patterns (fix(patterns): detect literal XOR decoded commands #546), and bounded joined reflective names with AST7/AST9 provenance (fix(ast): detect joined reflective execution sinks #544).
• Bound local registry JSON and baseline YAML/JSON input sizes, nesting, records, and expansion; harden Pi extension executable discovery and staged report writes, and remove additional credentials from agent CLI subprocess environments (fix(security): address remaining AVIO local-input findings #562).
• Distinguish missing references (reference_missing) from ambiguous references (reference_unresolved). MCP safe_to_install can allow missing-reference-only caveats if every discovered file was inspected and all other gates pass; ambiguous references and other coverage failures still block (fix(mcp): stop an unresolved reference from blocking safe_to_install #526).
• Detect reflective imported-module access through __dict__/vars(module) subscripts and get/setdefault/pop, emitting AST7 for dynamic keys and AST9 for dangerous literal names ( fix: flag module __dict__ subscript as reflective attribute access #517).
• Detect shipped bytecode inside .venv, venv, and .tox under existing traversal limits (fix(sc8): inspect bytecode in virtual environments #571).
• Retain BH1 and incomplete opaque_content coverage for unmodeled active-hook payloads (fix(hooks): fail closed on unmodeled payload analysis #573).
• Inventory excluded executable/loadable content and retain SC9 and incomplete coverage when inspection is insufficient (fix(security): account for excluded executables #548).
• Preserve Markdown ownership during JSON command recovery (fix: preserve Markdown context during JSON command recovery #559); report oversized-file coverage gaps as HIGH AE7 with bounded semantic input ( fix: oversized files must not produce a zero-finding report (LLM-stage inclusion + AE7 coverage finding) #509).
• Preserve full-evidence identity and distinct source occurrences (fix(security): preserve exact finding identity #409), add bounded letter-spacing reconstruction with AE6 fallback (fix(security): detect letter-spaced P3 and P4 prompts #470), and correct line-break-induced P3/P4 false positives (fix(security): keep line breaks out of letter-spacing runs #564).
• Discover hidden child skills, retain local-only restrictions, and preserve requested-analysis failures as incomplete (fix(security): enforce discovery and analysis completeness #410).

Accuracy, output, and performance

• Resolve bounded complete Markdown destinations, reference definitions, balanced/escaped parentheses, angle-wrapped spaces, and titles. Split URI components before single decoding, retain containment and source ownership, and mark destination/title limit exhaustion incomplete (fix: preserve complete Markdown reference destinations #553).
• Preserve Perl source ownership for narrowly proven non-interpolated standalone print literals without suppressing dangerous payloads or ambiguous syntax. AE1 referenced-artifact diagnostics gain bounded sanitized target/reason evidence and remediation that retains required references (fix: preserve Perl print literal boundaries in static analysis #615).
• Tolerate disappearing .git entries only during active clones, followed by strict final ingestion measurement; permission, checkout, and resource-limit failures remain failures (fix: keep runtime-selected printf reconstruction incomplete #514).
• Preserve occurrence-specific JSON columns and one-based Unicode-codepoint SARIF columns for active and suppressed findings (fix(report): preserve occurrence columns in JSON and SARIF #584); recursive Markdown stdout now includes child reports without --output (fix(cli): make recursive scans fail closed #576).
• Normalize GHSA/OSV MODERATE severity to MEDIUM (fix(supply-chain): normalize GHSA "MODERATE" severity to MEDIUM #588), and avoid Rust drop(&mut self) false positives while preserving YARA ROP(elf) controls (fix(yara): require word boundary on exploit_framework $rop_chain #607).
• Add reference acceptance regressions without new runtime behavior (test(references): cover nvcarps 154 acceptance cases #551), and make the Basic-auth fixture explicitly synthetic (test: make Basic auth fixture explicitly synthetic #600).
• Keep prose-oriented pattern matches within paragraphs while preserving multiline executable/structured-code rules (fix(static): prevent patterns crossing paragraph boundaries #491).
• Emit merged recursive JSON and SARIF to stdout with status text routed to stderr (fix(cli): emit recursive JSON reports to stdout #467, fix(cli): print recursive SARIF to stdout and keep status text off it #565).
• Download raw content for GitHub/GitLab /blob/ URLs (fix(input): download the raw file for GitHub and GitLab /blob/ URLs #566).
• Reduce repeated security-view work through ASCII token-gap fast paths and bounded memoization (perf(security): resolve token-gap classification from ASCII tables #569, perf(security): memoize the pure text predicates behind security views #570).
• Handle Windows 8.3 aliases without relaxing opened-handle checks (fix(input): expand 8.3 short DOS names before the opened-handle check #484), avoid false AE1 documentation limits (fix: avoid false analysis limits in documentation #516), and make JSON quote scanning linear (fix: make JSON quote candidate scanning linear #521).
• Improve companion CLI classification, subject to the known PE3/RA1 gaps (fix: classify companion CLI documentation by context #547), and suppress literal current-skill AS3 references only with trusted selected-source identity preserved through input materialization; manifest names only corroborate it, while ambiguous sources, peer-skill paths, and obfuscated access remain reportable (fix(as3): ignore current-skill self references #506, fix(as3): preserve skill identity across input materialization #580).
• Use manifest versions for RP3 (fix(analyzer): project manifest version for RP3 #474), prefer exact known-package matches in SC6 (fix(supply-chain): prefer exact known-package matches in SC6 #530), and avoid false local references from slash-separated prose (Fix false local references from slash-separated prose #451).
• Improve platform-sensitive fixtures (test(build-context): skip symlink cases where the platform refuses symlinks #501, test(build-context): guard the second FIFO case on mkfifo availability #502, test(input): inject secure-open failures on the primitive the platform uses #503, test(yara): write the non-ASCII malformed-rule fixture as UTF-8 #504, test(build-context): write fixture content with the newlines the assertions pin #505, test(build-context): read the nested OMS fixture without newline translation #518), align provider guidance (docs(providers): align setup guidance #434), and update README research counts (docs(readme): clarify research background counts #543). The badge added by docs(readme): add HVTrust badge #428 was removed alongside the Scorecard badge in readme cleanup #582.

Compatibility and migration

• Recognized unsupported primary bytes or invalid required instruction encodings now produce CLI exit 2 regardless of strict flags; use supported UTF-8 instructions or supported ZIP inputs. Required identity persists inside nested archives.
• Affected runtime commands, multiline prompt ambiguity, and over-limit Markdown references can move from complete/SAFE to partial/CAUTION, strict CLI exit 1, and MCP safe_to_install=false. Default CLI exit 0 is not a completeness guarantee; AE6 reports unresolved interpretation.
• AE1 consumers should tolerate the additive Incomplete referenced artifact analysis pattern and target_path, target_disposition, bounded reasons, and reasons_truncated evidence. Proven Perl print literals can lose false AE1 findings without exempting their payloads from security checks.
• Report consumers should tolerate additive provenance fields and new ledger reasons analyzer_load_error and transitive_child_scan_failed, preserve aggregate failure/omission evidence, and distinguish JSON zero-based columns from SARIF one-based Unicode-codepoint columns.
• LLM seeds must fit signed 64-bit integers. Source revision can be supplied using SKILLSPECTOR_BUILD_REVISION; unavailable revision data stays unknown, and provenance is not a reproducibility guarantee.
• SC10 may flag intentional private registries as HIGH; review and use the existing baseline workflow for accepted cases. There is no registry-reputation or organization-allowlist check. GHSA normalization and added detection can increase scores/findings.
• Description activation analysis falls back only when explicit legacy triggers are absent/empty. Compact prompt numbering is opt-in. GitHub tree inputs require an advertised branch/tag rather than an arbitrary commit SHA.
• The passive-PNG AE1 exception removes a false evasion finding, not the underlying incomplete coverage or strict installation block. Resolved occurrence-column and recursive Markdown-output limitations are no longer listed as open.
• OpenCode users must install authenticated 1.18.31; the earlier candidate's 1.18.30 pin is no longer accepted. The native OpenCode tool is copied from .opencode/ in a checkout and is not installed by the wheel.
• Pi extension users must install SkillSpector in the extension's .venv or set SKILLSPECTOR_BIN to an existing absolute executable path. Ambient PATH lookup is removed, and reports must be written within the current workspace. These restrictions do not change the standalone CLI or OpenCode tool's output-path contract.
• Local registry files are capped at 16 MiB, 64 nesting levels, and 10,000 combined server/package/remote records. Baselines are capped at 2 MiB, 64 nesting levels, and 10,000 rules/fingerprints, with additional YAML node/scalar/alias bounds.
• Consumers should recognize reference_missing separately from reference_unresolved. MCP safe_to_install can be true for a missing-reference-only caveat even though the report remains incomplete/CAUTION; partially inspected files, ambiguity, and requested semantic failures still block.
• TP4 fences, reflective Python access, and environment bytecode can add findings or semantic work. Paragraph-boundary and letter-spacing corrections can remove false findings. Unmodeled hook payloads remain incomplete/non-SAFE.
• Transient provider failures can incur bounded additional requests and backoff within the workflow deadline; live-provider cost and latency depend on the configured service.
• Interactive progress uses stderr; JSON and SARIF stay parseable on stdout. Forge /blob/ scans now analyze raw file bytes.
• --fail-on-findings is opt-in. Valid model-registry overrides now affect CLI-provider token budgets. The static allowance defaults to 300 seconds per artifact within the existing workflow deadline; set SKILLSPECTOR_MAX_STATIC_ANALYSIS_SECONDS_PER_ARTIFACT=30 to retain the earlier allowance.
• Third-party dependency versions are unchanged from v2.11.2. Use --no-llm for intentional static-only scans; unavailable or incomplete requested semantic work remains incomplete.

Validation

• Main baseline: 05119f4b868aafc7a6347043d3c3b8f9ac548091 (fix: keep runtime-selected printf reconstruction incomplete #514); all 69 merged PRs since v2.11.2 are cataloged.
• Release commit: 29f7acb52866a634c5ad84b1c37d5023e64b47c9.
• Python 3.12.13 suite with coverage, excluding integration and live-provider tests: 7,859 passed, 14 skipped, 134 deselected, 4 expected failures; 90% coverage (46m 34s). Four warnings were reported: three unregistered timeout markers and the intentional duplicate-ZIP-member fixture.
• OpenCode and Pi extension tests: 65 passed.
• Selected static integration tests for opaque-reference reporting and dependency-source behavior: 95 passed, 8 deselected, without live providers.
• Installed-wheel smoke validation: 8 fixtures / 16 static-only CLI and MCP-core scans passed, covering benign input, unsupported selected bytes, UTF-16 required input (including renamed ZIP members), multiline AE6, runtime-command uncertainty, full Markdown destinations, and Perl print literals. The package import path and version were verified; this does not claim MCP stdio-transport or live-provider qualification.
• Locked dependency installation, Ruff lint/format, CLI version, release-helper dry run, wheel/source builds, Twine validation, and whitespace checks: passed.
• Hosted validation for the refreshed release commit: all 6 checks passed in CI run 35919725480: changes, lint, Python tests, OpenCode/Pi tests, DCO, and Docker smoke. Earlier run 35820158876 and approval of the 65-PR candidate do not certify these four additional merges.
• Hosted Python suite: 7,859 passed, 14 skipped, 134 deselected, 4 expected failures; 90% coverage (1h 22m 54s), matching the local counts.
• GitHub's CI test-merge tree e2c5b5d610cd203a2cbb67437ef644f26dfae499 is identical to the release head's tree, with the recorded main baseline and release head as parents.

Validation applies to the commit recorded here. Previous candidate test counts and workflow runs do not certify subsequent main merges.

Known limitations and release status

• Instrumented AST fallback can raise TypeError when an optional end column is absent, although normal parsed files pass.
• Reconstruction is bounded, not a universal obfuscation decoder or full shell/Perl interpreter. The previously quoted alternating-spacing SAFE example is detected by existing code; covered multiline cases now retain AE6 and partial evidence. Companion-context PE3/RA1 variants can still be incorrectly downgraded or missed.
• Recursive root exclusions lack public scope-exclusion metadata.
• Consumer summary grouping can merge distinct fingerprints or same-line occurrences. Raw and normalized views can duplicate a P9 finding, and consumer archive-path handling can replace original finding detail with an execution failure; existing gates still block those cases.
• OpenCode model availability, authentication, and rate limits remain external; token-usage accounting is unavailable. Multilingual batch gap-fill qualification with live providers remains pending.
• Required-input format recognition is conservative; unrecognized representations that appear to be UTF-8 can remain text. Supported/empty ZIP completeness does not establish a usable or harmless skill. fix: keep runtime-selected printf reconstruction incomplete #514, fix: preserve complete Markdown reference destinations #553, and fix: preserve incomplete scans for unsupported input and multiline prompts #563 are included without implying broader language/format coverage.
• Deployment/provider, Windows, published-artifact, downstream adoption, and independent release sign-off remain separate release gates. Existing requested changes still require review.

No 2.12.0 release has been published.

[mohgupta-ship-it]

Codex on behalf of Mohit Gupta — independent qualification update, 16 September 2026.

The freshly built 2.12.0 wheel from 65ca9bdd289e70ae6e413c205c7530c86e6b39aa has SHA256 bcb03b0aae2266aff57bac6e3fd0a5c51e83b64f866c79193c7862912aed877d. All 98 installed Python modules and 111 package files match that immutable source. The later 5134f62458fa235b487e823d1c0472be54678295 revision changes only the changelog/release notes: all package files, dependencies and build inputs match, so the runtime evidence applies by source equivalence. Artifact hashes remain tied to the actual built bytes.

Fresh results after the AS3 update:

Check	Result
Focused scanner/release-helper tests	283 passed
Exact installed CLI/MCP and AS3 controls	9 passed
Wheel/sdist build and Twine	Passed
Frozen 54-case edge corpus	39 passed / 15 failed
Frozen 32-case golden corpus	27 passed / 5 failed
Expanded downstream consumer	1,156 passed / 1 failed: existing PE3 read-only Docker identity-mount expectation
Real renderer	29 passed
Network-disabled downstream CI sanity	29/29 commands passed; 281 Python passes, 3 existing runtime-dependent skips

Both frozen corpora retain exactly the previous failure sets. Their behavioral expectations and fixture bytes were unchanged; only candidate identity/version provenance was refreshed. The consumer policy/limit assertions were retained. An initial provider-enabled consumer harness attempt was terminated and excluded; the reported counts come from the subsequent run with the established sanitized environment.

Draft #563 separately fixes unsupported-primary and pure/mixed newline completeness gaps. At c6aa326, it passes 5,292 required tests, 90% coverage, lint/format, packaging and local Docker smoke; the installed edge corpus improves to 43/54, with no new failures, and 18/18 CLI/MCP coexistence controls pass. Scratch integration with #514 at 63658bc and #553 at 18c897a passed 1,257 focused tests after resolving one small adjacency conflict. None of these open fixes is included in this release PR.

Current-head hosted CI/review and the remaining production/provider, Windows, published-artifact and adoption gates are still required. These results do not constitute release sign-off; no release or production pin was changed.

[rng1995]

[SkillSpector Review]

Reviewed current head e6bcf1044b781d9a28ae537cd8a56147edc9afa4, including the complete version/changelog/release-note diff, candidate history, existing review thread, version/lock consistency, component source identity, exact-head checks, and the stated release gates. The package and lock versions agree and all five hosted checks pass.

Changes are requested because two security guarantees in the release notes are not true of this exact candidate. Its letter-spacing implementation is byte-identical to the currently reviewed #470 implementation and still permits alternating-width spacing to evade P3/P4 and AE6. Its companion-classification analyzer blobs are identical to the unresolved #547 implementation, where four contextual fail-open paths remain. Either correct and requalify those implementations before publication or describe the precise limitations without claiming the risky cases remain covered. Deployment/provider, Windows, published-artifact, downstream-adoption, and independent release sign-off also remain merge gates.

[rng1995]

[SkillSpector Review]

Re-reviewed current head ff10467cd93832bc5a9a0ee8c07a2bcd3b91e01f after the automatic synchronization with main. This merge has the previously reviewed head e6bcf1044b781d9a28ae537cd8a56147edc9afa4 and current main e19ec01cc85b9891b2976a1157fce492504cfc13 as its exact parents. The only intervening tree changes are #558's three batch-scan files; none overlaps the four release files, whose reviewed contents are unchanged.

The two existing non-outdated release-note findings therefore remain current and unresolved. The candidate still claims irregular letter spacing fails closed although alternating-width short runs can evade P3/P4 and AE6, and it still makes an unconditional companion-context guarantee despite #547's unresolved PE3 and RA1 paths. Correct and requalify those implementations or accurately document the limitations. I have not duplicated the inline findings.

Exact-head CI run 35136927518 concluded action_required without starting jobs, leaving no check results. The security-release corrections, unresolved threads, active change request, missing exact-head checks, GitHub BLOCKED state, and previously identified release qualification/sign-off gates prevent merge.

[rng1995]

[SkillSpector Review]

Re-reviewed the complete four-file release diff, version/lockfile consistency, prior review, and commit ancestry through the current head. The formerly missing #562/#526/#421/#491/#517/#571/#575 entries are now documented.

The same release-baseline requirement is not yet satisfied for this newer candidate. docs/release/skillspector-2.12.0.md still says the catalog covers 47 PRs through a345778, while the actual head includes #576, #556, #551, #580, #383, #584, #600, #560, #561, #542, #546, #541, and now #544 beyond that baseline. In particular, Known Limitations still says SARIF lacks occurrence columns although #584 is included. Update CHANGELOG.md, the release catalog/migration notes, and stale limitations to reflect the actual shipping commit; record validation against the refreshed candidate instead of referring to older counts/runs as current. Existing candidate/pending language should remain until owner release gates are satisfied. No duplicate inline thread added for this continuing baseline issue.

The version bump itself is consistent between pyproject.toml and uv.lock. Exact-head checks are currently unavailable; that separately blocks merging, not the reason for the documentation change request. Contributor code/tests were not executed locally.

Reviewed head: 9319c497cbed529cd0c12bd0e24c3c2a177c305a.
Priority: P0 — Release owners need an accurate shipping inventory and candidate-specific validation.

[rng1995]

[SkillSpector Review]

Incremental re-review after the latest automatic main synchronization. The delta only imports the already-reviewed #539/#588/#591/#607/#597; none of this PR's four release files changed. Therefore the outstanding release-inventory/validation request in review #550 (review) remains open; the newly included PRs also belong in the final shipping inventory. I have not repeated the finding inline. No exact-head checks are attached. The candidate remains unmerged.

Static review only; no contributor code/tests executed.
Reviewed head: 4a282fff4b3d9d3feaabbf9e65c742fd9dbd54a7.
Priority: P0 — Release sign-off requires an accurate candidate inventory and validation record.

[rng1995]

Release-candidate sign-off — SkillSpector 2.12.0

Approved at commit 41fca42e980d955d355b717a93a30831c26b284c against main baseline 224ba292d91b9e5fc59398fc38ab8971f9ab01ec.

The P0 inventory/validation request in review 5286455426, continuing review 5286353393, is addressed:

• All 65 merged PRs since v2.11.2 are cataloged, including the latest 18 merges. The changelog, release notes, migration guidance, and PR description match the current candidate. Fixed occurrence-column and recursive Markdown-output limitations are no longer described as open.
• The complete diff against main contains only the changelog, versioned release notes, and matching 2.12.0 package/lockfile versions. Third-party dependency versions are unchanged. The minor version remains appropriate for the added capabilities.
• CI run 35820158876 completed successfully for this head: all six checks passed. Its test-merge 340f81bc9ff36cde656893de3941edd5d2436334 has the documented main/head parents and the identical release source tree fc50629557ef61b9821b941576202796d3857a24.
• Hosted and local Python validation each recorded 6,843 passed, 14 skipped, 134 deselected, 4 expected failures, and 90% coverage. The integration/live-provider exclusions remain explicit. The recorded candidate validation also includes 95 selected static integration tests, 65 extension tests, locked installation, lint/format, version/release-helper checks, wheel/sdist builds, Twine validation, and whitespace checks.
• Prior inline threads are resolved. Letter-spacing, companion-classifier, and other documented product limitations remain accurately qualified; unmerged #514/#553 are not included.

This is sign-off and approval of the current release-preparation PR, based on the candidate-specific evidence above. It is not a claim that documented scanner limitations have been fixed or that live-provider/deployment, Windows, published-artifact, or downstream-adoption qualification has passed. Those separate owner release gates remain recorded and are not waived by this review. Approval applies only to this commit; later merges require refreshed inventory and validation. No merge, tag, publication, or deployment is performed by this approval.

[mohgupta-ship-it]

514 and 563 are pending for merge. 553 is merged.

[rng1995]

Release-preparation sign-off for SkillSpector 2.12.0 at 29f7acb52866a634c5ad84b1c37d5023e64b47c9, synchronized through main 05119f4b868aafc7a6347043d3c3b8f9ac548091.

The stale-inventory/validation P0 is addressed for this candidate. The changelog, versioned release notes, and PR description now account for all 69 merged PRs since v2.11.2, including the latest #553, #615, #563, and #514. The Markdown-reference and runtime-command fixes are no longer described as excluded. The inventory was independently checked against git history, and the new behavior, migration effects, bounded-analysis caveats, and remaining limitations were reviewed against the implementation.

Version 2.12.0 remains appropriate: this unpublished release includes new user-facing capabilities and integrations in addition to fixes. The diff from main contains only the changelog, versioned release notes, and matching project-version changes in pyproject.toml and uv.lock; third-party dependency versions are unchanged.

Validation for this exact candidate:

• Local Python 3.12.13 suite with coverage: 7,859 passed, 14 skipped, 134 deselected, 4 expected failures; 90% coverage in 46m 34s. Integration and live-provider tests were excluded from this run. The four warnings were three unregistered timeout markers and the intentional duplicate-ZIP-member fixture.
• 65 OpenCode/Pi extension tests passed.
• 95 selected static integration tests passed (8 deselected), with no live providers.
• Installed-wheel smoke: 8 fixtures / 16 CLI and MCP-core scans passed, with the installed package path and version verified. This does not claim MCP stdio-transport coverage.
• Locked dependency installation, Ruff lint/format, CLI version, release-helper dry run, wheel/sdist builds, Twine checks, and whitespace checks passed.
• All six hosted checks passed in CI run 35919725480: changes, lint, Python tests, OpenCode/Pi tests, DCO, and Docker smoke.
• Hosted Python results matched the local counts: 7,859 passed, 14 skipped, 134 deselected, 4 expected failures; 90% coverage in 1h 22m 54s.
• The hosted test-merge tree e2c5b5d610cd203a2cbb67437ef644f26dfae499 matches the reviewed release head exactly and has the recorded main baseline and release head as parents.

This approves the release-preparation PR at the recorded commit. It does not certify that disclosed scanner limitations are fixed or that live-provider, Windows, deployment, published-artifact, downstream-adoption, or separate release gates have passed. Other reviewers' outstanding requests remain theirs to resolve. No merge, tag, release publication, or deployment is included in this sign-off.

Signed-off-by: Narendran Raghavan nraghavan@nvidia.com