The sidecar’s scheduled-agent wrapper restores .git/config and .git/hooks/ on every exit. The copy here predated the EXIT trap, so an agent that poisoned core.hooksPath and then failed, or a cancelled job, left it for the workflow’s later steps to read.
The registrar gate reads a confirmation whole, not its by: line. Re-dating an existing human: event, moving its revision or writing it in flow style added no by: human: line and so passed the old gate unseen. The gate also refuses a human: id it cannot look up, resolves a commit-shaped revision against the tree, and now runs under a top-level permissions: {} with no checkout credential on disk.
Fixed
Two bundle concepts named a resource git ignores. They pointed at the curator skill’s installed copy under .agents/, which exists only on a machine that has it, so the new conventions gate failed on a clean checkout. Both now name the published file at the release the workflow installs.
Added
The sidecar gains the preflight, the forge-free provenance gate and the conventions parser - knowledge-preflight.sh, knowledge-provenance.sh and knowledge-conventions.py - plus .lokf/.gitattributes, keeping the bundle on LF so a Windows checkout gives CI’s verdict.
A pull request that would release is held to its release notes and its title. The plan job refuses an empty ## [Unreleased], which semantic-release itself skips on a pull-request event, and refuses a title with no releasing type, since a squash merge takes its commit subject from the title.
Changed
The pinned toolkit is lokf 0.8.0, and src/lokf-vocab.json is rebuilt from it. npm run build-vocab reads the schema from the sidecar’s pinned toolkit, not a sibling ../lokf checkout; LOKF_SCHEMA still overrides it. No plugin behaviour change.
