fix(install): preserve local declaring sources and audit current intent read-only

.apm/architecture/owners/contracts-tooling.json

@@ -1,6 +1,13 @@
 {
   "version": 1,
   "owners": [
+    {
+      "id": "spec-assessment-selection",
+      "decision": "One active specification artifact, informative manifest, exact assessment identity, and fresh static binding inventory",
+      "owner": "tests/spec_conformance/_manifest.py",
+      "selectors": ["tests/spec_conformance/_manifest.py"],
+      "guards": ["contracts-tooling-spec-assessment"]
+    },
     {
       "id": "dependency-identity-materialization",
       "decision": "Dependency comparison identity and policy casing vs display-cased materialization path; embedded git URL subpath validation",

.apm/architecture/owners/core-runtime.json

@@ -10,9 +10,12 @@
     },
     {
       "id": "effective-install-target-selection",
-      "decision": "Effective install target selection",
+      "decision": "Effective install and audit target selection",
       "owner": "core/target_detection.py (EffectiveTargetDecision)",
-      "selectors": ["src/apm_cli/core/target_detection.py"],
+      "selectors": [
+        "src/apm_cli/core/target_detection.py",
+        "src/apm_cli/install/audit_target_roots.py"
+      ],
       "guards": ["registry-delegation-install-target-selection"]
     },
     {

.apm/architecture/owners/install-deployment.json

@@ -95,6 +95,16 @@
       "selectors": ["src/apm_cli/commands/install.py"],
       "guards": ["install-deployment-install-scope-selection"]
     },
+    {
+      "id": "local-dependency-scope-admission",
+      "decision": "Declaring-source provenance and local dependency scope admission",
+      "owner": "deps/apm_resolver.py (_source_kind_for_dependency) projects acquisition provenance onto APMPackage; install/package_resolution.py (user_scope_rejection_reason) owns admission",
+      "selectors": [
+        "src/apm_cli/install/package_resolution.py",
+        "src/apm_cli/deps/apm_resolver.py"
+      ],
+      "guards": ["install-deployment-local-scope-admission"]
+    },
     {
       "id": "mcp-registry-url-resolution",
       "decision": "MCP registry URL resolution precedence",

.github/workflows/spec-conformance.yml

@@ -1,6 +1,6 @@
 name: Spec conformance
 
-# Enforces the OpenAPM v0.1 spec-vs-implementation 4-way bind:
+# Enforces the selected OpenAPM revision's spec-vs-implementation 4-way bind:
 #   spec body anchors == requirements manifest == Appendix C rows == pytest req markers
 # Then runs the conformance suite, regenerates CONFORMANCE.{json,md},
 # and gates on a clean git diff so contributors must commit any
@@ -11,6 +11,7 @@ on:
     branches: [ main ]
     paths:
       - 'docs/src/content/docs/specs/**'
+      - 'docs/public/specs/**'
       - 'tests/fixtures/spec-conformance/**'
       - 'tests/spec_conformance/**'
       - 'src/apm_cli/**'
@@ -46,7 +47,7 @@ jobs:
         env:
           BASE_REF: origin/${{ github.event.pull_request.base.ref || 'main' }}
           GH_PR_BODY: ${{ github.event.pull_request.body }}
-        run: bash tests/spec_conformance/mode_b_detector.sh
+        run: uv run --frozen --extra dev bash tests/spec_conformance/mode_b_detector.sh
 
       - name: Conformance test suite
         run: |

.gitignore

@@ -16,6 +16,7 @@ __pycache__/
 build/build/
 build/apm/
 build/conformance-coverage.json
+build/conformance-coverage-*.json
 *.bak
 develop-eggs/
 dist/

CHANGELOG.md

@@ -23,6 +23,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - The shared gh-aw APM pack job now declares `contents: read` (previously `permissions: {}`), the minimum the explicit built-in-token path needs. No write scope is added, and the token is not forwarded to restore or agent jobs. (#2706)
 - Dependency policy `allow`, `deny`, and exact `require` matching now follows canonical owner/repository casing, fixing mixed-case blocks and deny fail-open behavior while retaining lazy shared required-package lookup. APM 0.30.0 and earlier match patterns byte-exactly against the lowercased identity; lowercase patterns keep matching in every release, so drop workaround duplicates only after every runner uses a release carrying this fix. (#2706)
 
+### Fixed
+
+- Global installs anchor local children to established declaring sources without treating disguised remote names as local, and audit replays current target intent without modifying live configuration or native state. The corrective OpenAPM draft is assessed explicitly as `v0.2.0`; previous exact-version assessments remain available, and human ratification and activation are pending. (#2820)
+
 ## [0.30.0] - 2026-09-07
 
 ### Security

CONTRIBUTING.md

@@ -423,9 +423,10 @@ Avoid these anti-patterns:
 - Do not read `is_enabled()` at module import time.
 - Do not persist flag state anywhere other than `~/.apm/config.json` via `update_config`.
 
-## Adding or changing a normative requirement (OpenAPM v0.1)
+## Adding or changing a normative requirement (OpenAPM)
 
-The OpenAPM v0.1 spec (`docs/src/content/docs/specs/openapm-v0.1.md`)
+The selected OpenAPM spec (`tests/spec_conformance/_manifest.py` owns
+the assessment artifact and exact revision)
 and APM the implementation are co-evolved in this repo. APM is the
 sole implementation of the spec. To prevent the spec from rotting
 into a document of lies, every normative change MUST land as three
@@ -438,8 +439,8 @@ Three-step ritual:
 1. **Spec edit.** Add or change a `<a id="req-XXX"></a>` anchor with
    prose in the spec body. Add or change the matching Appendix C row.
 2. **Manifest edit.** Add or change the entry in
-   `docs/src/content/docs/specs/manifests/openapm-v0.1.requirements.yml`
-   so it stays a byte-equivalent projection of the canonical anchors.
+   the selected informative manifest under `docs/public/specs/manifests/`
+   so its IDs, keywords, sections, and classes match the canonical anchors.
 3. **Test edit.** Add or extend a `@pytest.mark.req("req-XXX")` test
    under `tests/spec_conformance/`. If a real assertion is not yet
    possible, call `waive("...")` from `_helpers.py` with a one-line
@@ -453,7 +454,12 @@ uv run --extra dev python -m tests.spec_conformance.gen_statement
 ```
 
 and commit the resulting `CONFORMANCE.{md,json}` at repo root. CI
-gates a clean diff.
+gates a clean diff. Generation collects the full selected suite afresh and
+records static bindings, not runtime pass results. Run the suite separately
+and retain execution evidence. Normative reconciliation is complete for the
+current corrective-draft candidate; preserve the previous minor.
+[Qualified-human review, ratification, and activation remain unsatisfied](docs/src/content/docs/specs/conformance.md).
+Assessment selection and green CI do not satisfy those gates.
 
 Common modes the ritual catches:
 

docs/astro.config.mjs

@@ -73,6 +73,10 @@ export default defineConfig({
 		'/spec': '/apm/specs/openapm-v01/',
 		'/spec/latest': '/apm/specs/openapm-v01/',
 		'/spec/v0.1': '/apm/specs/openapm-v01/',
+		// Exact revision slug is pinned; a later patch needs a distinct artifact.
+		// Keep /spec and /spec/latest unchanged until actual ratification.
+		'/spec/v0.2': '/apm/specs/openapm-v020/',
+		'/spec/v0.2.0': '/apm/specs/openapm-v020/',
 	},
 	integrations: [
 		sitemap(),
@@ -295,6 +299,7 @@ export default defineConfig({
 						// (/spec, /spec/v0.1, /spec/latest) bridge this in the
 						// redirects block above for external citers.
 						{ label: 'OpenAPM v0.1', slug: 'specs/openapm-v01' },
+						{ label: 'OpenAPM v0.2.0 (draft)', slug: 'specs/openapm-v020' },
 						{ label: 'Conformance', slug: 'specs/conformance' },
 					],
 				},