SECURITY.md cites sections of SPEC, http-delivery, integer-payloads and
jwp-receipts, and nothing checked them: the checker read only SPEC.md and
extensions/*.md, and the workflow's paths left SECURITY.md out. It reads
SECURITY.md now, and the workflow runs when it changes. Every reference in
it resolves; a reference to http-delivery §66 put in by hand fails the
check. CHANGELOG.md stays out: it is a dated record whose older references
are kept as written.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
ddd49ee03d