diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 04779995..6969ddf6 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.3.2"
+  ".": "0.3.3"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 467d6705..4a9b6b53 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,153 @@ this file by hand on `dev`: write a clear commit subject instead. How it works:
 Paths in entries before v0.3.0 use the old layout. The v0.3.0 entry has a "Moved" table from each old path to its new
 one.
 
+## [0.3.3](https://github.com/Nistapp/codebase-agentic-readiness-framework/compare/v0.3.2...v0.3.3) (2026-11-10)
+
+### Features
+
+- **audit:** open the rendered report with a bottom line ([52768e2](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/52768e21a7a32e417571e46dcac0df3ba5362534))
+- **audit:** record a check newer than the engine's ruleset as UNKNOWN ([4c9c82d](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/4c9c82daf1c5f1a28cfc1e9d0a294268428e8648))
+- **audit:** record the framework release and install in each report ([61d0e2d](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/61d0e2de4a150e1d18fa83f676145d19e59c2d90))
+- **dev:** agent tools for this repository: one .mcp.json, a first-run offer, language servers ([109e7ad](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/109e7add3e87de625db99e6f62b830d1be5ba5d0))
+- **dev:** assert the pull request body layout in the implement eval ([51bddf9](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/51bddf9ed07400423430f6f475828dc016476a2a))
+- **dev:** check that each recipe SKILL.md links the user prompt ([1a569d0](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/1a569d0acd0552329599ef2af2d9bb66f4a13749))
+- **dev:** document language servers beside the code index ([07d42bb](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/07d42bbf282b38b7e757c44219ca172e8eb4183f))
+- **dev:** give prose-check issues a severity and always exit 0 ([d36a954](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/d36a954e19b4c2ee4e8c93aeb7712e5c8cb4e319))
+- **dev:** offer each contributor a one-time agent tool setup ([6dce4b1](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/6dce4b176ab53064d88e4a7eb237fe2947cc2f63))
+- **dev:** register codebase-memory-mcp in one project .mcp.json ([683ddb3](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/683ddb3b40af71788e7d09f02632eb055f4e5646))
+- **dev:** translate .mcp.json into each harness's MCP config ([b0b2085](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/b0b2085997260dfbc9972e05bb9611b9149576d6))
+- **engine:** add AGT-12 and DOC-05, the v0.3.4 Track T checks ([1703aa2](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/1703aa261e6e20f286f9c3bab365c64db3547c3c))
+- **engine:** add AGT-12, communication rules stated ([5d16098](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/5d160986083feca76c83e17c15e8215d99584bfc))
+- **engine:** add CI-05, workflow files are linted ([a86ddab](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/a86ddab29fcfa308597ab2c2ff46759ea6582343))
+- **engine:** add DOC-05, docs are readable ([fc80971](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/fc80971d8fe92c6e7c28e82fface7abd7ecd4a08))
+- **engine:** add EXEC-08, tool versions visible to dependency automation ([7172596](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/7172596bef8ea5df8674b3105e0cdf03bc2d4a14))
+- **engine:** add TOOL-07, a local guard against commits to a protected branch ([17bd680](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/17bd6802b7378ca3a221191f234dfe4c710497f0))
+- **engine:** add TOOL-07, a local guard against commits to a protected branch (v0.3.3 C5.2) ([2fc92ec](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/2fc92ec8b8e119890a0d8bd8dc6e9ee2d29c7e5d))
+- **engine:** AGT-09 names every branch the declared rules protect ([910b718](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/910b71804aaede0352da047dd59f53b9e4ac5923))
+- **engine:** AGT-09 names every branch the declared rules protect ([1dc8bab](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/1dc8bab562c69a3813d7f144302fb3fa44c37167))
+- **engine:** HYG-09 reads ecosystem coverage and the target-branch trap ([c035331](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/c03533162ec10b77f544b96245a22fe31e2092d8))
+- **engine:** HYG-11 reads ruleset files and the source-branch check ([23f7146](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/23f71460c5bc2d834a69920739ffe0aff46848c6))
+- **engine:** HYG-11 reads ruleset files and the source-branch check (v0.3.3 C5.1) ([4b93763](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/4b93763398c3f7e06f8d786145252bfc972e2133))
+- **engine:** open the Markdown report with a bottom line ([6afaba3](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/6afaba37d4fa1e34ebf2cd466aff5c6e25705a94))
+- **engine:** TOOL-04 reads CI as well as the local verbs ([36aa387](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/36aa3872484eb1afbfce4ee40cac3b1b2748a7a9))
+- **engine:** TOOL-04 reads CI as well as the local verbs ([9dfc3ae](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/9dfc3ae4e9f0be4c5cdb8eaf6b1933b313ce6114))
+- **engine:** TOOL-06 also reads the commit rule in CI ([d7ad429](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/d7ad4290cfcf525468f62da994ec118744c61530))
+- fix the layout of the recipes' questions and reports ([3993263](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/3993263c38518063a2b07170fd68d5ad3db30e6b))
+- give both recipes one prompt on how to talk to the user ([cf7a101](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/cf7a101c66a80c31f1ff28e4cf6c5171d7387630))
+- **greenfield:** check commit messages in CI as well as in the hook ([9f693fe](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/9f693fea3e68bcf00e6fb7136ded9e577f060084))
+- **implement:** record in the state which framework created and last wrote it ([23b354c](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/23b354cd7d24e8fc7bdd9f19c9a494cbe5612473))
+- **implement:** stop on a report from another schema or a newer release ([2309763](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/2309763f2efd9a462a03998334ee035f1e4322e4))
+- plain communication in the recipes and a report bottom line (v0.3.4 R, H) ([b990687](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/b9906874b1310765800c576427ebc1f7dc704575))
+- stack-adaptive hook guidance and CI-05 workflow lint (v0.3.3 Track C: C0, C1) ([66479e7](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/66479e75b0a0596be6aafdb297cf566dc082a22d))
+- stamp the framework release in reports and states, and refuse files the tools cannot read ([2047b4f](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/2047b4fdfd1cd801a1105fddc86fd7901814b112))
+- stamp the release version in reports, state and skill bundles ([5d4ff90](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/5d4ff904ea9893fe98e97e80c7d4daae6634a3e7))
+- TOOL-06 reads the commit rule in CI as well as in the hook (v0.3.3 C4) ([5232740](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/52327407b023f09a578cd1fa34f39264f732d326))
+- v0.3.3 Track C2 and C3 (HYG-09 reads the update policy, new check EXEC-08) ([a701a04](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/a701a04b7b848ce59276bcf3124ef449b8c2ca26))
+
+### Bug fixes
+
+- **audit:** list what the scan could not settle as sub-bullets ([80e7bbc](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/80e7bbca65f1a1108e3af5ffe8fc1a27c19660fe))
+- **dev:** ignore .env files at any depth ([f807d63](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/f807d6346bdf8972e7182d79751f044f54f4799a))
+- **dev:** keep each osv-scanner ignore file next to the lockfiles it covers ([8b64cc1](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/8b64cc18e65e980a7737f2078c44eb386a2049eb))
+- **dev:** name more harnesses and move the first-run trigger to the top ([22ba4a6](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/22ba4a6283cea03fd2a1bbff57eea75737e21235))
+- **engine:** EXEC-01 and TOOL-04 read nested pins and Makefile chains ([4f1f1bf](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/4f1f1bf4e8244ed6d530ad2040e3ed8b1fea96e3))
+- **engine:** EXEC-01 reads the toolchain pin in a nested manifest ([f2ff3bd](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/f2ff3bda8424f74ac9010b26d7757855a65b081d))
+- **engine:** EXEC-07 counts types per language and reads a pyright mirror ([26fd6f5](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/26fd6f5a1b83f8a15c17e6aecc0f2c9e63abe028))
+- **engine:** EXEC-07 counts types per language and reads a pyright mirror ([73fa46b](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/73fa46b328828bed4b2904b2280c80b69a793228))
+- **engine:** TOOL-04 follows Makefile variables and prerequisites ([2e00e34](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/2e00e34d639b5196e1a353af57d257f902dd9765))
+
+### Documentation
+
+- add a diagram to each explanation page and tutorial ([d965909](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/d9659096a716aff44834c180390fca5e8a832a5b))
+- add a purpose line and a diagram to the page templates ([9506b0c](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/9506b0c043b956aec2fa59aa20d6c96b647ad5cd))
+- add generated audit and implement master lists ([b3a9377](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/b3a9377bfa9b19917d89396f47be8198976b7047))
+- add generated audit and implement master lists ([01be98d](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/01be98d19cbc6a214f6b0b9fcf68d07ba206bab4))
+- **audit:** an opt-in live read of the branch rules for HYG-11 and CI-04 ([d83d55b](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/d83d55bac812f649760c2273f93fcab27aff429f))
+- **audit:** rewrap the EXEC-07 engine paragraph to the line limit ([f69e70c](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/f69e70c0b337251de2f36a6352019e7e5e07c54c))
+- count the 102 engine fixtures after the dev merge ([d749568](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/d7495681cf914378e9638a867bc6e5cd1c5b688b))
+- count the 103 engine fixtures after AGT-09's ([34c358b](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/34c358b080f9aeb7b03335501dcc13107243cf7a))
+- count the 105 engine fixtures after EXEC-01's and TOOL-04's ([4306699](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/430669958d345024692ca7abfa982b0fb45c142a))
+- describe the coverage parts and the audit tools' shards ([00fdf59](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/00fdf5957afe6ed2e4649dd6ebc68179a1ef7983))
+- describe the engine shards and the nightly run ([04c1df0](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/04c1df0fca394b413047fa9c2bae98e176c71cbc))
+- describe the prose check as advisory ([b736b0d](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/b736b0ddf2e4a03aab07ecdac74d77281c7f683d))
+- **implement:** adapt-agents-md names the branches the rulesets protect ([8299e32](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/8299e32bb522d77df93b9500e699a1350d0484ae))
+- **implement:** add the workflow-lint step for CI-05 ([24a5675](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/24a56755133bec151f580234be174b60f042a0aa))
+- **implement:** add-hooks-and-commit-rules adds the branch guard by stack ([6526ec0](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/6526ec05c4956f3df966cb5acbf0fccc88cd81d6))
+- **implement:** add-repo-hygiene declares branch rules as code ([5f7ce86](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/5f7ce86a5313a5212fea67d77c925f9a59104b3a))
+- **implement:** add-repo-hygiene writes a routing-only CODEOWNERS by default ([9002f22](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/9002f22c34ce9148c487d340f4e8796989f55634))
+- **implement:** choose the hook manager by the target's stack ([304420e](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/304420e69970da6ec0a7fb6a3ad592616a6cdcad))
+- **implement:** configure-quality-tools runs the security verb in CI ([3650dad](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/3650dad105cb9a060cd60947b268d11f616774f6))
+- **implement:** move inline tool versions into a manifest for EXEC-08 ([c93011b](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/c93011b617981b14a4eb4688c6973ebc49387eeb))
+- **implement:** register-index names the language-server inputs ([c76f357](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/c76f357008c06ea4499d62251c2a623376b7512f))
+- **implement:** register-index writes one .mcp.json and offers the setup ([35feab4](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/35feab4486dbb67d859c586d0cc0ee6251d8f30c))
+- **implement:** release provenance and language-server inputs ([5143e1e](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/5143e1ee02d6bc169b0f12b75e7f9b5829b7c0e6))
+- **implement:** routing-only CODEOWNERS and the index setup offer ([cf065b8](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/cf065b80e907ed4216f227cf68c1ccefeb4a4052))
+- **implement:** run the commit rule in a local stage and in CI ([f429ae7](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/f429ae740b41d912bd3b9c5050259ceb4bd8758a))
+- **implement:** split the ruleset sentence in adapt-agents-md step 6 ([7e1289a](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/7e1289a9af291fc4c180b2fae2ff8cf87f2c2e38))
+- **implement:** the release page may state the release provenance ([5dd2d21](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/5dd2d212ac6982a1ebab4d5af11132a4d6d6d017))
+- **implement:** write or fix the dependency-update file for HYG-09 ([81b0002](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/81b00021a9d3697bfd0bc0845723c1db86375761))
+- link the agent tool setup from the contributor entry points ([98a13e1](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/98a13e1b84271c38f8b41c79d67eefa5e0f1f45d))
+- list the two security jobs ([3fa15e5](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/3fa15e5a4dfc07d6e1976aaaf82907377f97e3e6))
+- name the prose check in the pull request checklist ([1e9ed7e](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/1e9ed7e2aa6321dc9c74c531045d2119a3f71f37))
+- queue a dev pull request with Merge when ready, not gh pr merge ([63434f4](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/63434f40702f59013b25edac38b3387a226eff16))
+- queue a dev pull request with Merge when ready, not gh pr merge ([1a1bd92](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/1a1bd9204d029dd55eb74e1545476d186d80b153))
+- record that dev no longer requires an up-to-date branch ([32f9374](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/32f937414dfcdfc1c35288e89ed61ea4b78b2182))
+- record the dev merge queue in Current state ([651c004](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/651c004350c9f935f8922ef32d40ac465e865748))
+- record the dev merge queue in Current state ([3de9d91](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/3de9d91aa4bf38bea507637237cbd97a233ecf0a))
+- record the version rule in ADR 0008 and a versions reference ([5f0a8db](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/5f0a8db381afebb7a40d815edfd9762fdc2f2c00))
+- record why make check does not run the prose check ([621c600](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/621c6007fd56e9c40b8e324a22f936a8ce6a7ef6))
+- regenerate the master lists for EXEC-08 ([85a2a94](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/85a2a949fe63ea59d3bc159a35fec1f076d72fcf))
+- rewrite the three worst docs pages in plain language ([5a577a5](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/5a577a540147b3c2957ce7510e9755954d41d112))
+- say that CI tests Linux only for now ([b0b3742](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/b0b37421bfe8c002bab930e6f65e63ccadb5d09a))
+- **self-audit:** refresh the self-audit page and neutralise the baseline ([65024fb](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/65024fb26b6cdc04d071ee448257a38c8b2bda10))
+- shorten the long sentences in AGENTS.md and lint it ([3adc114](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/3adc1145f6c9f9da9388d65de803207d3fecd28a))
+- split the long sentences in REQ-SH-060 and the DOC-05 rubric ([2cdddb6](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/2cdddb6abc8657b7c1c33c1923a1ca3d39ca9c18))
+- **stacks:** recommend each stack's own hook and commit tools ([110f2f7](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/110f2f7789d9f0402d362a98511399de5383f63f))
+
+### Refactoring
+
+- **engine:** move the Makefile walk into _common as follow_makefile ([6296b3e](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/6296b3efc70612d01a569694f749045d91a1c412))
+- **engine:** split the engine tests into one package per check pack ([c44aa26](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/c44aa26ffc615f74a5fa5579e2aed0b7f37876d5))
+- **engine:** split the engine tests into one package per check pack ([a06eab4](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/a06eab492557d6ef3ae4a16537c771785ddfd65c))
+
+### Build and dev tools
+
+- add engine shard targets and a sharded coverage combine ([55f9832](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/55f9832e07c66bffc291d655715416c6d13e4426))
+- **dev:** add a shard runner for the engine's test suite ([29ca367](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/29ca367673208b60b11ab2f7d44f38d6d1f82fd6))
+- **dev:** add a typos spell check to make check ([4ee9b51](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/4ee9b51057b53fac6ad161ebeeacafc92b110e09))
+- **dev:** audit the dev tools' dependencies with osv-scanner in make security ([345890b](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/345890bcbf2d89401a238dbbdb8e8a37b0917ff0))
+- **dev:** build actionlint from a Go tool module, not from actionlint-py ([095994f](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/095994f2b719bd75e855bfc2fcf28516e0fd0ed6))
+- **dev:** let the shard runner split the audit tools' suite ([c9cd5aa](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/c9cd5aa45f85933c7192fa0ef0868fad504aca25))
+- **dev:** make the prose check advisory, with severities ([320fad8](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/320fad8969a38d09331ece11634cc36e124db725))
+- **dev:** run make coverage as CI does, so a local pass means a CI pass ([9101437](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/910143723090bd0b03dad4e16e89149852917faa))
+- **dev:** run make coverage as CI does, so a local pass means a CI pass ([0f4a6e0](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/0f4a6e063036280f2fefa82b31b2fa3d7fba639b))
+- **dev:** stop gating on the prose check ([9308f0d](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/9308f0d3b102ea8f639a368c6a26b02cddf6fe89))
+- **dev:** update mermaid-cli to 12.2.0 for a katex advisory ([a432659](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/a43265966ad5ed76032c00fecd906c19c87e5120))
+- **dev:** update uv to 0.13.5 for two security advisories ([d21d061](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/d21d06140a952898527db0e1e1089c44f293a48e))
+- run the test suites at once on Linux and split coverage per suite ([010b358](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/010b3586b98bac66174d8d9fcf7d9c60247ca23a))
+- shard the audit tools' suite and add coverage-part ([bb7ad4e](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/bb7ad4e50566cc5008bcbba59e6b8a76f52bb461))
+- split make security into security-secrets and security-deps ([e9f6caf](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/e9f6cafd8ff5bb7e7ba8d7946bac0cba669a3082))
+
+### CI and release
+
+- add a nightly run of the unsharded verbs ([55b3d61](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/55b3d617efdb21889af1e3856a833f0f9a1f9c23))
+- add an advisory CodeQL workflow for Python and Actions ([1a32a51](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/1a32a514fdf70b19c3586df91a2c88610e92d388))
+- add an advisory OpenSSF Scorecard workflow ([c0cc4a7](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/c0cc4a7623d57350b3c0eafd424902322fb9a76e))
+- faster CI per pull request and a merge queue for dev ([bf3b533](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/bf3b533403f4c9744e29a47ef4dc137cf89d55c7))
+- fix zizmor's pedantic findings and gate on the pedantic persona ([5c26847](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/5c26847aef164f1787a3133978fdab5d204ff74a))
+- publish the Scorecard results and fix its Vulnerabilities alert ([fcd5c7f](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/fcd5c7fcbff173b989b13e8f018518b39723fa1b))
+- publish the Scorecard results and record how each alert is handled ([818676d](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/818676d17fb7819e21b68adc1e22a61a7884ee69))
+- run CI on merge groups of the dev merge queue ([8df5231](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/8df5231f739d4d7dc1e6530a06642910b38c22c5))
+- run the audit tools' suite in shards and drop the test-tools job ([e8c598a](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/e8c598ae0aa666f915fbb8e6e2fcfac9f7e525cb))
+- run the check matrix on Linux only ([5e50513](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/5e50513fca567104e1b71aabefbc4feab5c2efba))
+- run the coverage suites in two parts and drop the test-tools job ([9fb632a](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/9fb632a5ba939418e875b33dfdf049aa4c640de0))
+- run the engine's suite in two shards on both Python versions ([b59be30](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/b59be30f1591da9e8d23e938a6524fcd6ff694af))
+- run the engine's test suite in shards on both Python versions ([6b22dd1](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/6b22dd1b8749f14b75306577a24725d4bede5324))
+- run the secrets scan and the dependency audit as two jobs ([0ea219d](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/0ea219d29b913e94e41e51d7e78f91c021d59c7f))
+- run the secrets scan and the dependency audit as two jobs ([ae30d59](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/ae30d59416fe2f6f196f78707d48139e3259959b))
+- run the steps of make check as parallel jobs ([0dfe7eb](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/0dfe7eb302e867030ef93db6b966550ed5e6aca0))
+- sign build provenance for the release files ([7c7cfa7](https://github.com/Nistapp/codebase-agentic-readiness-framework/commit/7c7cfa78d27f34ede3b6eb799fd5104a7041ce4b))
+
 ## [0.3.2](https://github.com/Nistapp/codebase-agentic-readiness-framework/compare/v0.3.1...v0.3.2) (2026-11-09)
 
 ### Features
diff --git a/audit/engine/audit/__init__.py b/audit/engine/audit/__init__.py
index 58a19fdf..1d54cb9a 100644
--- a/audit/engine/audit/__init__.py
+++ b/audit/engine/audit/__init__.py
@@ -19,7 +19,7 @@
 
 from __future__ import annotations
 
-__version__ = "0.3.2"  # x-release-please-version
+__version__ = "0.3.3"  # x-release-please-version
 
 #: Bumped whenever a rule pack, a check, or the instruction-variant table changes.
 #: Recorded in every report's provenance block so a report can be attributed to an
diff --git a/audit/tools/report.py b/audit/tools/report.py
index f0041c0f..d8c5ccab 100644
--- a/audit/tools/report.py
+++ b/audit/tools/report.py
@@ -84,7 +84,7 @@
 )
 
 #: The framework release these tools belong to: `provenance.framework.release`. release-please rewrites the line.
-FRAMEWORK_RELEASE = "0.3.2"  # x-release-please-version
+FRAMEWORK_RELEASE = "0.3.3"  # x-release-please-version
 SCHEMA_VERSION = "0.2"
 DRAFT_KIND = "audit-draft"
 DEFAULT_PROBE_TIMEOUT_S = 120
diff --git a/implement/tools/progress.py b/implement/tools/progress.py
index 476a2b05..0a2e899b 100644
--- a/implement/tools/progress.py
+++ b/implement/tools/progress.py
@@ -47,7 +47,7 @@
 import validate_report
 
 #: The framework release these tools belong to: the state's `framework.release`. release-please rewrites the line.
-FRAMEWORK_RELEASE = "0.3.2"  # x-release-please-version
+FRAMEWORK_RELEASE = "0.3.3"  # x-release-please-version
 SCHEMA_VERSION = "0.3"
 
 RECIPES = Path(__file__).resolve().parent.parent