Re-vendor the specification bundle at neutral identifiers

CHANGELOG.md

@@ -10,6 +10,16 @@ All notable changes to tagged releases are documented here.
 - Record the embedded specification bundle in `THIRD_PARTY_NOTICES`. The bundle is Apache-2.0
   material from a separate project and appears in neither `go.mod` nor `go.sum`, so the previous
   Go-modules-only framing omitted it.
+- Re-vendor the embedded specification bundle from `Judgment-Pack/judgment-pack-spec`, replacing the
+  pre-neutralization pin. The two schema `$id` values now carry the permanent
+  `https://judgmentpack.org/schema/` identifiers. Machine-visible: `spec schema` reports a new
+  `schemaId`, `sha256`, and `bytes`, and the bundle digest changes. No validation behavior changes
+  and all 47 conformance cases still pass — the corpus is byte-identical to the previous pin.
+- Pin the bundle to an exact commit rather than a tag. The specification's release tooling requires
+  a tag string to equal `specVersion`, so the permanent identifiers on its `main` branch cannot be
+  republished under a second `0.1.0-draft` tag. The release gate already treats a full-length commit
+  digest as an immutable reference; the pin moves back to a tag once a specification version
+  carrying those identifiers is published.
 
 ## 0.0.1 - 2026-07-23
 
@@ -30,9 +40,11 @@ All notable changes to tagged releases are documented here.
 
 ### Known follow-ups
 
-- The embedded specification bundle is still pinned to the pre-neutralization upstream tag
-  (`protossai/judgment-pack-spec@v0.1.0-draft`). Re-vendoring to a neutral, digest-locked spec tag
-  is pending the specification project publishing one.
+- The embedded specification bundle is pinned to the pre-neutralization upstream tag
+  (`v0.1.0-draft`), whose schema `$id` values use temporary repository-hosted URLs. (Resolved in
+  Unreleased by re-vendoring from `Judgment-Pack/judgment-pack-spec` at an exact commit. The
+  original entry attributed the delay to the specification project not having published a neutral
+  tag; the permanent identifiers were in fact already on its `main` branch.)
 - No `GOVERNANCE`/`MAINTAINERS`/`CODEOWNERS` files exist yet. (The `NOTICE` file is added in
   Unreleased. `LICENSE` is deliberately left byte-identical to the canonical Apache-2.0 text: its
   appendix is a template for marking your own files, not a field to fill, and editing it costs a

README.md

@@ -201,12 +201,14 @@ The lock records the source repository, exact commit/ref and source state, plus
 metadata for all 50 imported files. A development snapshot remains visibly labelled
 `unreleased-local-snapshot` and cannot pass the release gate.
 
-> **Provenance note.** The embedded bundle is currently pinned to the specification's pre-neutral
-> upstream tag (`protossai/judgment-pack-spec@v0.1.0-draft`), whose schema `$id`s still use the
-> pre-neutralization URLs. Re-vendoring to a neutral, digest-locked spec tag is a reviewed
-> follow-up, tracked in [CHANGELOG.md](CHANGELOG.md), pending the specification project publishing
-> one. Because validation is fully offline and never dereferences a `$id`, this affects provenance
-> labelling only, not validation behavior.
+> **Provenance note.** The embedded bundle is pinned to an exact commit of
+> `Judgment-Pack/judgment-pack-spec` rather than to a tag. The specification's only tag,
+> `v0.1.0-draft`, carries schema `$id`s under a temporary repository-hosted URL; the permanent
+> `https://judgmentpack.org/schema/` identifiers exist on `main` but cannot be published under a
+> second tag, because the specification's release tooling requires the tag string to equal
+> `specVersion`. Pinning the commit is an explicitly supported immutable reference here — the
+> release gate accepts a full-length commit digest — and the pin moves to a tag once the
+> specification publishes a version carrying the permanent identifiers.
 
 Artifact bundle and conformance-corpus digests use `sha256-length-prefixed-v1`: each sorted path and
 file body is encoded as an unsigned 64-bit big-endian byte length followed by those exact bytes.

docs/releasing.md

@@ -5,8 +5,9 @@ independent: a CLI release may consume a JPS release, but it never creates or ch
 
 ## Prerequisites
 
-- The intended JPS artifacts have already been committed and published under an immutable tag in
-  `protossai/judgment-pack-spec`.
+- The intended JPS artifacts have already been committed to `Judgment-Pack/judgment-pack-spec` and
+  are reachable by an immutable reference: either a published tag or a full-length commit digest.
+  Prefer a tag when one carries the intended artifacts.
 - GitHub Release Immutability is enabled for this repository.
 - `main` is clean, pushed, and passing CI.
 - The GitHub CLI is authenticated with permission to push and manage releases.
@@ -30,8 +31,8 @@ env GO111MODULE=on go run ./tools/sync-spec-artifacts \
 ```
 
 Review every imported file and `lock.json`. The lock must contain the official repository URL,
-`immutable-git-ref`, the tag, its exact commit, `worktreeDirty: false`, and the expected bundle
-digest. Update the embedded registry only when adding a new specification version.
+`immutable-git-ref`, the immutable reference used, its exact commit, `worktreeDirty: false`, and the
+expected bundle digest. Update the embedded registry only when adding a new specification version.
 
 ## Validate locally
 

internal/artifacts/artifacts_test.go

@@ -8,10 +8,10 @@ func TestEmbeddedReleaseArtifactIntegrityAndProvenance(t *testing.T) {
 		t.Fatal(err)
 	}
 	lock := set.Lock()
-	if lock.Source.Repository != "https://github.com/protossai/judgment-pack-spec" ||
+	if lock.Source.Repository != "https://github.com/Judgment-Pack/judgment-pack-spec" ||
 		lock.Source.Kind != "immutable-git-ref" ||
-		lock.Source.BaseCommit != "80958f50c851e9809cb8036a23622391cf437c99" ||
-		lock.Source.Ref != "v0.1.0-draft" ||
+		lock.Source.BaseCommit != "5df1f5502a61eed2ce7509d03b00e3d387558183" ||
+		lock.Source.Ref != "5df1f5502a61eed2ce7509d03b00e3d387558183" ||
 		lock.Source.WorktreeDirty {
 		t.Fatalf("embedded artifacts must remain pinned to the approved JPS release: %#v", lock.Source)
 	}

internal/artifacts/jps/0.1.0-draft/lock.json

@@ -2,15 +2,15 @@
   "formatVersion": 1,
   "specVersion": "0.1.0-draft",
   "source": {
-    "repository": "https://github.com/protossai/judgment-pack-spec",
+    "repository": "https://github.com/Judgment-Pack/judgment-pack-spec",
     "kind": "immutable-git-ref",
-    "baseCommit": "80958f50c851e9809cb8036a23622391cf437c99",
-    "ref": "v0.1.0-draft",
+    "baseCommit": "5df1f5502a61eed2ce7509d03b00e3d387558183",
+    "ref": "5df1f5502a61eed2ce7509d03b00e3d387558183",
     "worktreeDirty": false
   },
   "bundleDigest": {
     "algorithm": "sha256-length-prefixed-v1",
-    "value": "507cba8dbe43b70481ae22d48d083423ef08aee22366055ef6ea1dc7dce213c7"
+    "value": "abc3d3371db5be6c0b63639d399fbe42e3f3e136a162d8d6c2b50503634bbe70"
   },
   "files": [
     {
@@ -255,13 +255,13 @@
     },
     {
       "path": "manifest.schema.json",
-      "bytes": 3611,
-      "sha256": "fa3f55f53712253551d6374ff3f06621e936b56c04dabd399703bbb05285c740"
+      "bytes": 3579,
+      "sha256": "f073bde8f6f2189edd0334c81c03fecfacf8fae2bd49305a788c75550dcbc2c5"
     },
     {
       "path": "schema.json",
-      "bytes": 14307,
-      "sha256": "81f6986edc8d2bbf6f49c28a9bbec4f9054f7c72cab5a5028130e01d2e7274d8"
+      "bytes": 14268,
+      "sha256": "c65c559db33d19d2f327858635266fca7fcc049fb75083a7a8d47517e27224fc"
     }
   ]
 }

internal/artifacts/jps/0.1.0-draft/manifest.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://raw.githubusercontent.com/protossai/judgment-pack-spec/v0.1.0-draft/conformance/manifest.schema.json",
+  "$id": "https://judgmentpack.org/schema/0.1.0-draft/conformance/manifest.schema.json",
   "title": "Judgment Pack conformance manifest",
   "type": "object",
   "additionalProperties": false,

internal/artifacts/jps/0.1.0-draft/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://raw.githubusercontent.com/protossai/judgment-pack-spec/v0.1.0-draft/schema/judgment-pack-core.schema.json",
+  "$id": "https://judgmentpack.org/schema/0.1.0-draft/judgment-pack-core.schema.json",
   "title": "Judgment Pack Core",
   "description": "Research-preview structural schema. Conformance does not establish truth, authority, safety, or operational fitness.",
   "$comment": "JPS structural conformance requires uri, date, and date-time format assertions even when a general-purpose validator treats format as annotation-only.",

internal/releasecheck/check.go

@@ -9,7 +9,7 @@ import (
 	"github.com/Judgment-Pack/judgment-pack-runtime/internal/artifacts"
 )
 
-const specificationRepository = "https://github.com/protossai/judgment-pack-spec"
+const specificationRepository = "https://github.com/Judgment-Pack/judgment-pack-spec"
 
 var (
 	versionTagPattern = regexp.MustCompile(`^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$`)

tools/sync-spec-artifacts/main.go

@@ -20,7 +20,7 @@ import (
 	"strings"
 )
 
-const sourceRepository = "https://github.com/protossai/judgment-pack-spec"
+const sourceRepository = "https://github.com/Judgment-Pack/judgment-pack-spec"
 
 var fullCommitPattern = regexp.MustCompile(`^(?:[0-9a-f]{40}|[0-9a-f]{64})$`)