- Replace SPDX with full ASF v2 license header (jbonofre)
- Clarify binding audience: contributors, committers, PMC, unmodified adopters (jbonofre)
- Extend #5 with deterministic-first execution to save tokens (potiuk)
- Extend #6 with explicit human sign-off for outbound human communication (RussellSpitzer)
- Rework #9 around capability floor instead of "same code on all backends", add justified-and-minimized clause, add end-to-end single-machine config requirement (RussellSpitzer)
- Standardize on US English (analyze, artifact, behavior, catalog, license, specialized)

- Replace SPDX with full ASF v2 license header (jbonofre)
- Clarify binding audience: contributors, committers, PMC, unmodified adopters (jbonofre)
- Extend #5 with deterministic-first execution to save tokens (potiuk)
- Extend #6 with explicit human sign-off for outbound human communication (RussellSpitzer)
- Rework #9 around capability floor instead of "same code on all backends", add justified-and-minimized clause, add end-to-end single-machine config requirement (RussellSpitzer)
- Standardize on US English (analyze, artifact, behavior, catalog, license, specialized)

#273)

Generalise the leading bracketed-tag regex in the template (and the
matching example cascade in security-cve-allocate/SKILL.md) so it
catches any square- or round-bracketed leading tag whose body
contains the word "security" or "important", case-insensitive —
e.g. (Security Issue), [ Security Vulnerability ], [IMPORTANT],
(Important - please read), in addition to the existing four
[Security X] forms.

Add a new pattern #9 to strip trailing IDs from known external
bug-bounty / disclosure trackers — (ZDRES-NNN), [HUNTR-NNN],
(GHSL-YYYY-NNN) — in either bracket style. Extend the alternation
per project as new reporter brands surface (SNYK-, BDSA-, etc.).

Real motivating example: an airflow-s tracker whose subject was
"[ Security Report ] LDAP Filter Injection in FAB Auth Manager
_search_ldap reachable via /auth/token (ZDRES-223)" — the leading
prefix matched the old pattern but no pattern covered the trailing
(ZDRES-223). Verified the new cascade collapses this to "LDAP Filter
Injection in FAB Auth Manager _search_ldap reachable via /auth/token".

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

- Replace SPDX with full ASF v2 license header (jbonofre)
- Clarify binding audience: contributors, committers, PMC, unmodified adopters (jbonofre)
- Extend #5 with deterministic-first execution to save tokens (potiuk)
- Extend #6 with explicit human sign-off for outbound human communication (RussellSpitzer)
- Rework #9 around capability floor instead of "same code on all backends", add justified-and-minimized clause, add end-to-end single-machine config requirement (RussellSpitzer)
- Standardize on US English (analyze, artifact, behavior, catalog, license, specialized)

* docs(principles): add operational principles document

PRINCIPLES.md restates RFC-AI-0004's six baseline principles in their
operational shape and adds the project-internal commitments the RFC
deliberately defers: eval as release blocker, contributor-sentiment
gating, no default telemetry, reproducibility from signed source,
maintainer education shipped with the platform.

19 ordered principles. Earlier outranks later when they collide.
Amendment process matches the release-vote process (>=3 binding +1,
no binding -1, 72h window, no lazy consensus).

Positioned as project-internal operating contract, not a competing RFC.

* docs(principles): address review feedback on PRINCIPLES.md

- Replace SPDX with full ASF v2 license header (jbonofre)
- Clarify binding audience: contributors, committers, PMC, unmodified adopters (jbonofre)
- Extend #5 with deterministic-first execution to save tokens (potiuk)
- Extend #6 with explicit human sign-off for outbound human communication (RussellSpitzer)
- Rework #9 around capability floor instead of "same code on all backends", add justified-and-minimized clause, add end-to-end single-machine config requirement (RussellSpitzer)
- Standardize on US English (analyze, artifact, behavior, catalog, license, specialized)

* docs(principles): disambiguate 'language-independent' as 'programming-language independent' (RussellSpitzer)

* docs(principles): qualify P6 merge rule as 'unilaterally' to resolve auto-merge tension (justinmclean)

* docs(principles): scope P3 'first-class' as adopter, clarify amendment proposal path (justinmclean)

* docs(principles): add PMC adjudication path for disputed committer blocks (justinmclean)

* docs(principles): scope P6 impersonation claim to messages read as maintainer-authored (justinmclean)

* docs(principles): replace dangling 'same family' clause with single-principle interpretation rule (justinmclean)

* docs(principles): add generated TOC

* docs(principles): align P14 with upstream Skills contract

A skill is always a directory with SKILL.md as entrypoint, even
for one-file workflows. SKILL.md stays under 500 lines; longer
reference material moves into sibling markdown linked one level
deep. Matches the runtime contract documented at
https://code.claude.com/docs/en/skills and
https://platform.claude.com/docs/en/agents-and-tools/agent-skills/best-practices,
and reflects how skills in this repo (contributor-nomination,
pr-management-code-review, pr-management-mentor) are already
authored.

* docs(principles): make P6 merge clause explicit on subject and close auto-merge gap (justinmclean)

* docs(principles): resolve disputed blocks via PMC consensus first, vote as last resort (justinmclean)

* docs(principles): soften P11 reproducibility requirement

Addresses review feedback that 'bytes are identical' is too strong
for a project-agnostic framework. Toolchains vary in their ability
to produce byte-identical output; some have known divergence sources
(timestamps, file ordering, path embedding).

P11 now requires byte-identical builds where achievable, and where
the toolchain makes that impractical, the release process must
document the divergence and provide an alternative local verification
mechanism. The 'no code without reviewed PR' guard stays absolute.

Refs: PR #147 review

* docs(principles): move ASF license header to top of file

The doctoc-generated TOC was placed above the Apache license header,
which breaks tooling that expects the license notice in the first
few lines of the file. Move the license block to line 1, followed
by the TOC.

Refs: PR #147 review

* docs(principles): align amendment process and blocking rules with ASF policy

Three fixes from PR #147 review by @justinmclean:

1. Amendment vote model: 'release vote' -> 'code-modification vote'
   The encoded rule (>=3 binding +1, any binding -1 vetoes) matches
   ASF consensus approval for code modifications, not majority
   approval for releases.

2. Veto-justification requirement: A binding -1 must now include a
   technical justification. Without one the veto is invalid and has
   no weight, matching ASF voting policy.

3. Generative tooling disclosure: P17 now requires a
   'Generated-by: <tool>' token in commit messages for AI-authored
   contributions, per ASF Generative Tooling Guidance.

…on blocks

Adds validate_validation_paths() which extracts filesystem paths from
shell patterns in ## Validation code blocks (--project, --directory,
bash -n, shellcheck, test -f) and checks each exists under the repo
root. Shell variables ($) and placeholder tokens (<) are silently
skipped. Catches stale paths after renames before they accumulate.

Also fixes a stale path in mentoring-mode.md (Validation block
referenced .claude/skills/good-first-issue-author/SKILL.md; the
installed name is magpie-good-first-issue-author).

Generated-by: Claude (Opus 4.7)

…cks (#513)

Adds validate_validation_paths() which extracts filesystem paths from
shell patterns in ## Validation code blocks (--project, --directory,
bash -n, shellcheck, test -f) and checks each exists under the repo
root. Shell variables ($) and placeholder tokens (<) are silently
skipped. Catches stale paths after renames before they accumulate.

Also fixes a stale path in mentoring-mode.md (Validation block
referenced .claude/skills/good-first-issue-author/SKILL.md; the
installed name is magpie-good-first-issue-author).

Generated-by: Claude (Opus 4.7)

#560)

Add [dependency-groups] dev = [pytest, ruff] to
tools/spec-validator/pyproject.toml so that the standard
monorepo invocation
  uv run --project tools/spec-validator --group dev pytest tools/spec-validator/tests/
works from the repo root, matching the pattern established by
tools/skill-and-tool-validator (asf-coupling-lint) and documented in
the module docstring.

Also fix a copy-paste comment mislabelling check #9 (validation-path
existence as check #8 — SPDX header validation is check #8.

Generated-by: Claude (Opus 4.7)
EOF
)