## Why / 背景
The market entry still pointed at team v0.1.5. Its pinned member lock
used stale agent manifests whose `command_authority.allowed_targets` did
not match the installed runtime IDs, so a fresh newcomer install could
pass catalog discovery but block the first delegation. The upstream team
main is now v0.1.6 with the corrected lock and member versions.
市场条目仍指向 v0.1.5。其成员锁引用了旧 Agent
manifest，`command_authority.allowed_targets` 与安装后的 runtime ID
不一致，导致新人实例虽然能发现团队，却会在首次委派时被阻断。上游团队 main 已更新到 v0.1.6，成员锁和版本已修正。
## What changed / 变更
- bump `latestVersion` and `release.version` to `0.1.6`;
- point entry source, catalog provenance, and compliance `reviewedRef`
to upstream team commit `3a4736e31ff5bf4299fde17fdde682a179d898b2`;
- align all six listed member versions with the upstream
`members.lock.json` (lead 1.0.4, intake 1.0.1, clause 1.0.2, risk 1.0.2,
jurisdiction 1.2.1, reporter 1.0.1);
- update release and upstream observation timestamps.
- 将 `latestVersion` 与 `release.version` 更新为 `0.1.6`；
- 将 entry source、catalog provenance 和 compliance `reviewedRef` 对齐上游团队
commit `3a4736e31ff5bf4299fde17fdde682a179d898b2`；
- 六名成员版本与上游 `members.lock.json` 对齐（统筹 1.0.4、输入 1.0.1、条款 1.0.2、风险
1.0.2、法域 1.2.1、报告 1.0.1）；
- 更新发布时间与上游观察时间。
## Validation / 验证
- `uv run scripts/catalog/validate_catalog_metadata.py --json` — exit 0,
0 errors, 129 existing warnings;
- `uv run scripts/i18n/validate-i18n.py` — exit 0;
- `uv run scripts/catalog/test_validate_catalog_metadata.py` — 47
passed;
- `uv run scripts/i18n/test_validate_i18n.py` — 19 passed;
- `uv run scripts/catalog/test_collection_generator.py` — 4 passed;
- independent GPT-Reserve reviews — PASS, P0/P1/P2/P3=0;
- `git diff --check` — passed.
- `uv run scripts/catalog/validate_catalog_metadata.py --json`：exit 0，0
errors，129 个既有 warnings；
- `uv run scripts/i18n/validate-i18n.py`：exit 0；
- `uv run scripts/catalog/test_validate_catalog_metadata.py`：47 passed；
- `uv run scripts/i18n/test_validate_i18n.py`：19 passed；
- `uv run scripts/catalog/test_collection_generator.py`：4 passed；
- 两次独立 GPT-Reserve 复审：PASS，P0/P1/P2/P3=0；
- `git diff --check`：通过。
## Changes\n- publish contract-review-team v0.1.5\n- point entry and
catalog metadata at merged team main commit
2a45d9fc031ba7d63d3ec15552ef0bc4c3a2b46e\n- align clause-extractor
roster version to 1.0.2\n- advance release timestamps to
2026-09-06T10:02:16Z, after team lock resolvedAt
2026-09-06T09:56:11.162Z\n- preserve Work Context description and all
unrelated metadata\n\n## Validation\n- team entry schema: PASS\n-
catalog metadata validator: PASS (existing repository warnings only)\n-
i18n validator: PASS (0 errors, 129 existing warnings)\n- collection
generator tests: 4 passed\n- git diff --check: PASS\n\nPlease review
independently; do not merge automatically.
Publish team 0.1.4 with the merged lead manifest version/hash lock. Independent GPT-Reserve review PASS; Copilot approval recommended; market validators/tests PASS.
Publish contract review team 0.1.3 with Work Context orchestration compatibility and aligned publication provenance timestamps. Independent GPT-Reserve review PASS; market validators and tests PASS; Copilot concern resolved with timestamp fix.
Align the market roster jurisdiction-auditor version with the published
team lock. Independent GPT-Reserve review passed; canonical market
validators and tests pass.
Publish contract review team 0.1.2 with runtime Agent IDs in command
authority and update the catalog metadata to the merged team lock
commit. Independent GPT-Reserve review passed; canonical market
validators report 0 errors.
## Why / 背景
The pinned team release `73cd87a9901cc548871927e9d5dbec8e4cc6c2b1`
contains `jurisdiction-auditor` version `1.0.0`, but the merged market
entry advertised `1.2.0`. That metadata mismatch makes a valid pinned
release fail exact roster validation during newcomer installation.
团队发布锁 `73cd87a9901cc548871927e9d5dbec8e4cc6c2b1` 中的
`jurisdiction-auditor` 实际版本为 `1.0.0`，已合并的市场条目却写成
`1.2.0`。该元数据不一致会让新人安装时的精确 roster 校验拒绝有效的 pinned release。
## What changed / 变更
- Set only the market roster version for `jurisdiction-auditor` back to
`1.0.0`.
- Keep the pinned source ref, member commits, content hashes, governance
sidecar, and all other members unchanged.
- 仅将市场 roster 中 `jurisdiction-auditor` 的版本恢复为 `1.0.0`。
- pinned source ref、成员 commit、content hash、治理 sidecar 与其他成员均保持不变。
## Validation / 验证
- `uv run scripts/catalog/validate_catalog_metadata.py --json` — 0
errors, 129 existing warnings
- `uv run scripts/catalog/test_validate_catalog_metadata.py` — 47 passed
- `uv run scripts/catalog/test_collection_generator.py` — 4 passed
- `uv run scripts/i18n/validate-i18n.py` — 0 errors, existing warnings
only
- public-tree sensitive-pattern scan — zero matches
## Why
The team source lock declares `jurisdiction-auditor` at version `1.2.0`,
while the market roster still said `1.0.0`. DesireCore correctly
rejected the install because market member versions must match the
pinned team release.
## What changed
- update the market roster entry for `jurisdiction-auditor` to `1.2.0`;
- leave the pinned team source, commit, governance evidence, and all
other members unchanged.
## Validation
- `uv run scripts/catalog/validate_catalog_metadata.py --json` — 0
errors, 129 existing warnings
- public-tree sensitive-pattern scan — zero matches
## Why
The published pointer advertises client version `10.0.137`, while the
current DesireCore release is `10.0.136`. The newcomer instance
therefore correctly blocks installation even though the team source is
compatible with the current client.
## What changed
- align the team pointer's `requiredClientVersion` with the current
client version;
- align the catalog sidecar's compatibility declaration with the same
version.
No source pointer, team member, capability, privacy, or governance claim
changed.
## Validation
- `uv run scripts/catalog/validate_catalog_metadata.py --json` — 0
errors, 129 existing warnings
- `uv run scripts/catalog/test_validate_catalog_metadata.py` — 47 passed
- `uv run scripts/catalog/test_collection_generator.py` — 4 passed
- public-tree sensitive-pattern scan — zero matches
## Why
The contract review team already has a reproducible public Git source,
but its market pointer is still listing-only and uses the legacy
display-only shape. The current DesireCore client contract requires
explicit members, capabilities, privacy, an immutable source ref, and
installability evidence.
## What changed
- publish the contract review team as an installable,
source-pointer-only team entry;
- add the six-member roster, capability boundaries, privacy notice, and
update date;
- record review and license evidence in the catalog sidecar;
- keep the legacy team-entry schema branch while adding the current
client contract, so existing public pointers remain valid during
migration.
The source remains a public HTTPS Git pointer locked to commit
`73cd87a9901cc548871927e9d5dbec8e4cc6c2b1`. The team output is
supporting review material, not legal advice, and still requires
qualified human review.
## Validation
- `uv run scripts/catalog/validate_catalog_metadata.py --json` — 0
errors, 129 existing warnings
- `uv run scripts/catalog/test_validate_catalog_metadata.py` — 47 passed
- `uv run scripts/catalog/test_collection_generator.py` — 4 passed
- `uv run scripts/i18n/validate-i18n.py` — no errors; existing catalog
freshness warnings remain
- public-tree sensitive-pattern scan — zero matches
