test(autonomy): grade the security-binding golden suite — 109 fixtures, zero orphans

plugins/autonomy/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "autonomy",
-  "version": "0.7.2",
+  "version": "0.7.3",
   "description": "Governed autonomous agent operation: role-topology, binding-seam, wiring-vs-advisor, telemetry, return-accounting, trigger-dispatch, per-work-class guardrail-matrix, standing-routine-catalog, and design-only runner-charter contracts for climbing the AI-adoption ladder, plus a guided-setup skill that discovers an adopting org's state, writes its schema-versioned binding, wires standards-pinned OTLP emission with a zero-cost file-artifact default, wires human-attested return capture at the task boundary, wires signal adapters with one governed dispatch entrypoint, binds the five-class guardrail matrix to an org's isolation substrates with an in-boundary live-validation probe before recording each fail-closed binding, and stands up standing-routine-catalog classes as scheduled temporal signal adapters behind the one governed queue with free scheduling defaults wired as reviewable changes and each routine's work-class mapping homed on the security surface.",
   "author": {
     "name": "Melodic Software",

plugins/autonomy/CHANGELOG.md

@@ -6,6 +6,19 @@ All notable changes to the `autonomy` plugin are documented here. Format follows
 Versions 0.1.0–0.7.0 predate this file (introduced with 0.7.1); their history lives in the
 merged work-package PRs (#333, #343, #356, #372, #377, #600, #676).
 
+## [0.7.3]
+
+### Added
+
+- **Security-binding golden suite is graded (`#662`).** A table-driven runner
+  (`check-security-binding.fixtures.test.mjs` + its co-located expectations manifest) runs
+  every fixture under `evals/fixtures/security-binding/` through
+  `check-security-binding.mjs` and asserts exit code + defect-naming findings: 109 fixtures
+  (14 pass-expected, 95 reject-expected), zero quarantined, with the fixtures' 67 probe
+  transcripts enumerated as suite inputs. Self-policing in both directions — an ungraded
+  new fixture, an unlisted transcript, or a manifest entry whose file vanished all fail the
+  suite, and the repo's orphaned-fixture gate no longer grandfathers the set.
+
 ## [0.7.2]
 
 ### Changed