The 2026-08-16 fleet audit found seven repos carrying unmanaged copies of .claude/cloud-bootstrap.sh that will drift from the canonical component (dotfiles was fixed via #398's row). The remaining six — claude-code-proxy, claude-lane-sandbox, codex-plugins, cursor-plugins, knowledge-corpus, songwriting — were blocked on the org owner extending the melodic-standards-sync App's selected-repo grant.
That grant landed 2026-08-19 (installation 144867070, now 14 selected repos). Attest derives its expected set from the manifest's targets and requires the installation's selected set to EQUAL it — so with the grant in and no rows, every target's sync fails until the manifest reaches 14 targets.
Scope: cloud-bootstrap component only for all six (no other component audited against them), plus their fail-closed TARGET_VISIBILITY entries and the spawn-shim catalog-size assertion bump.
Out of scope, recorded deliberately: the fleet handoff's "+ agent-orientation targets" follow-on is dead — that component was retired by the standards sync audit and sync-manifest.test.sh enforces its absence.
The 2026-08-16 fleet audit found seven repos carrying unmanaged copies of
.claude/cloud-bootstrap.shthat will drift from the canonical component (dotfiles was fixed via #398's row). The remaining six — claude-code-proxy, claude-lane-sandbox, codex-plugins, cursor-plugins, knowledge-corpus, songwriting — were blocked on the org owner extending the melodic-standards-sync App's selected-repo grant.That grant landed 2026-08-19 (installation 144867070, now 14 selected repos). Attest derives its expected set from the manifest's targets and requires the installation's selected set to EQUAL it — so with the grant in and no rows, every target's sync fails until the manifest reaches 14 targets.
Scope:
cloud-bootstrapcomponent only for all six (no other component audited against them), plus their fail-closedTARGET_VISIBILITYentries and the spawn-shim catalog-size assertion bump.Out of scope, recorded deliberately: the fleet handoff's "+ agent-orientation targets" follow-on is dead — that component was retired by the standards sync audit and
sync-manifest.test.shenforces its absence.