Align the market roster jurisdiction-auditor version with the published
team lock. Independent GPT-Reserve review passed; canonical market
validators and tests pass.
Publish contract review team 0.1.2 with runtime Agent IDs in command
authority and update the catalog metadata to the merged team lock
commit. Independent GPT-Reserve review passed; canonical market
validators report 0 errors.
## Why / 背景
The pinned team release `73cd87a9901cc548871927e9d5dbec8e4cc6c2b1`
contains `jurisdiction-auditor` version `1.0.0`, but the merged market
entry advertised `1.2.0`. That metadata mismatch makes a valid pinned
release fail exact roster validation during newcomer installation.
团队发布锁 `73cd87a9901cc548871927e9d5dbec8e4cc6c2b1` 中的
`jurisdiction-auditor` 实际版本为 `1.0.0`，已合并的市场条目却写成
`1.2.0`。该元数据不一致会让新人安装时的精确 roster 校验拒绝有效的 pinned release。
## What changed / 变更
- Set only the market roster version for `jurisdiction-auditor` back to
`1.0.0`.
- Keep the pinned source ref, member commits, content hashes, governance
sidecar, and all other members unchanged.
- 仅将市场 roster 中 `jurisdiction-auditor` 的版本恢复为 `1.0.0`。
- pinned source ref、成员 commit、content hash、治理 sidecar 与其他成员均保持不变。
## Validation / 验证
- `uv run scripts/catalog/validate_catalog_metadata.py --json` — 0
errors, 129 existing warnings
- `uv run scripts/catalog/test_validate_catalog_metadata.py` — 47 passed
- `uv run scripts/catalog/test_collection_generator.py` — 4 passed
- `uv run scripts/i18n/validate-i18n.py` — 0 errors, existing warnings
only
- public-tree sensitive-pattern scan — zero matches
## Why
The team source lock declares `jurisdiction-auditor` at version `1.2.0`,
while the market roster still said `1.0.0`. DesireCore correctly
rejected the install because market member versions must match the
pinned team release.
## What changed
- update the market roster entry for `jurisdiction-auditor` to `1.2.0`;
- leave the pinned team source, commit, governance evidence, and all
other members unchanged.
## Validation
- `uv run scripts/catalog/validate_catalog_metadata.py --json` — 0
errors, 129 existing warnings
- public-tree sensitive-pattern scan — zero matches
## Why
The published pointer advertises client version `10.0.137`, while the
current DesireCore release is `10.0.136`. The newcomer instance
therefore correctly blocks installation even though the team source is
compatible with the current client.
## What changed
- align the team pointer's `requiredClientVersion` with the current
client version;
- align the catalog sidecar's compatibility declaration with the same
version.
No source pointer, team member, capability, privacy, or governance claim
changed.
## Validation
- `uv run scripts/catalog/validate_catalog_metadata.py --json` — 0
errors, 129 existing warnings
- `uv run scripts/catalog/test_validate_catalog_metadata.py` — 47 passed
- `uv run scripts/catalog/test_collection_generator.py` — 4 passed
- public-tree sensitive-pattern scan — zero matches
## Why
The contract review team already has a reproducible public Git source,
but its market pointer is still listing-only and uses the legacy
display-only shape. The current DesireCore client contract requires
explicit members, capabilities, privacy, an immutable source ref, and
installability evidence.
## What changed
- publish the contract review team as an installable,
source-pointer-only team entry;
- add the six-member roster, capability boundaries, privacy notice, and
update date;
- record review and license evidence in the catalog sidecar;
- keep the legacy team-entry schema branch while adding the current
client contract, so existing public pointers remain valid during
migration.
The source remains a public HTTPS Git pointer locked to commit
`73cd87a9901cc548871927e9d5dbec8e4cc6c2b1`. The team output is
supporting review material, not legal advice, and still requires
qualified human review.
## Validation
- `uv run scripts/catalog/validate_catalog_metadata.py --json` — 0
errors, 129 existing warnings
- `uv run scripts/catalog/test_validate_catalog_metadata.py` — 47 passed
- `uv run scripts/catalog/test_collection_generator.py` — 4 passed
- `uv run scripts/i18n/validate-i18n.py` — no errors; existing catalog
freshness warnings remain
- public-tree sensitive-pattern scan — zero matches
