build(deps): bump CorvidLabs/spec-sync from ef3678c2587f446e8f154f722765791ba0a8eaea to 342bd053d410211c16fcd041a9eb94ed53012fe2

[dependabot]

Bumps CorvidLabs/spec-sync from ef3678c2587f446e8f154f722765791ba0a8eaea to 342bd053d410211c16fcd041a9eb94ed53012fe2.

Changelog

Sourced from CorvidLabs/spec-sync's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

Changed

• Mandatory local pre-push gate (fast) — fledge lanes run pre-push / ./scripts/pre-push-gate.sh runs fmt + cargo check + strict path/spec coverage with timing (target: ~seconds–2 min warm; no full test/clippy). Full suite remains fledge lanes run verify / CI.

Fixed

• SpecSync 6.0 reopen/finalize paths address stranded accepted-record deadlocks reported via CorvidLabs/spec-sync#481 (fledge PR CorvidLabs/fledge#506 worked around the 5.x strand by manual archive).

• Draft next_action no longer recommends approve while artifacts are incomplete — when the interview is done but selected artifacts still contain <!-- TODO --> stubs (or are empty), status/show guidance prefers completing those artifacts first (sandbox #16).

• Approve rejects ## ADDED of living requirement IDs — definition approval and delta validation fail closed with a ## MODIFIED remediation hint when the requirement already exists in the living tree (sandbox #14).

Notes

• Private CorvidLabs/spec-sync-sandbox dogfood for workflow-v2 adopt is recorded in sandbox scenario 019; tagging 6.0.0 remains gated on this PR.

[6.0.0] - 2026-07-29

Added

• One guided change workflow for SpecSync 6.0 — change status always names one next action, change check applies approved deltas and runs affected-component verification, one independent scoped PR review binds the implementation, and change finalize creates the dated archive in the same PR without merging externally.
• Additive strict validation — global --strict, project policy, and deterministic release/security classification add validators to the same workflow/evidence instead of selecting another lifecycle, approval count, or artifact layout.
• Positive archive-only CI and merge binding — a lightweight child lane proves parent checks, exact archive shape, unchanged delivery tree, ownership, review, and finalization digest; a post-merge job records a compact check/comment bound to the actual merge commit before release.

Changed

• Low-churn lifecycle evidence — ordinary work uses one human scope approval and one scoped review. Historical two-approval evidence and repair commands remain readable without re-signing.
• Targeted lifecycle reads — invocation-scoped snapshots, bounded Git/evidence memoization, stable graph ordering, and one-pass owner batches remove the modest-scale performance cliffs.
• Safer installation and parsing UX — Git hook installation honors effective Git hook paths and project-keyed managed blocks; generated agent artifacts preserve customizations; ignore and schema diagnostics fail visibly; TypeScript Unicode export identity is canonicalized.
• MCP now starts read-only and fails closed at its trust boundary (#414) — mutating tools require the explicit mcp --allow-write opt-in; read paths are confined beneath the canonical server

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)