[luismarinoc]

Description

Publish the previously prepared expense-access-scoping archive and canonical specification synchronization, with an append-only delivery addendum. The implementation is already delivered through #144 and #146; this PR changes no application code or permission rules.

Review first: delivery-addendum.md for delivery boundaries, then the 76-line canonical insertion. The four relocated files are byte-identical; historical reports retain their original bytes, outcomes and captured hashes/counts.

Logical scope	Change
proposal.md, design.md, tasks.md, delta spec.md	Four 100% identical relocations from the active change into openspec/changes/archive/2026-09-10-expense-access-scoping/.
openspec/specs/expense-allocation/spec.md	76 existing delta lines inserted before Acceptance Criteria; no removals.
verify-report.md, sync-report.md, archive-report.md	Publish three preserved historical reports, 213 lines total.
delivery-addendum.md	50 lines: original 38 preserved, with 12 appended lines recording the final maintenance delivery.

Nine logical files; rename-aware +339/−0 authored lines. This is not a deletion-plus-copy rewrite.

Historical and delivery boundaries

• Historical expense verification remains pass_with_warnings; archive-time statements are not rewritten as current execution results.
• The separate gppro-codebase-analysis report still records its historical FAIL. Publishing this archive does not close that failure.
• The addendum distinguishes delivered commits, fresh CI, version-only [skip ci] descendants and sampled live observations. It does not claim exact deployed backend identity or exhaustive authorization coverage.
• Later toolchain/test maintenance is recorded separately: main merge 067e5958c5279ae84f59b2af8f4ed6668400d67d passed seven workflows and ten checks; version-only descendant 93acb75a7ce5b3adef3a319dd0850f52a6ec1deb has no independent CI run.
• Known maintenance warnings remain. Historical PDF-failure causality is not retroactively asserted.

This publishes existing OpenSpec artifacts through Git; no new OpenSpec archive/recovery/lifecycle operation was run.

Validation

• Independent read-only review of all nine candidate documents.
• Four relocated files equal their HEAD originals byte-for-byte; all historical/canonical/baseline hashes preserved.
• Original 38-line addendum prefix preserved byte-for-byte; exactly 12 lines appended.
• Local Markdown destinations resolve; active LSP confirmed the edited addendum clean.
• Referenced final PHP, lint and frontend runs independently confirmed successful on the exact delivered merge.
• git diff --check and staged git diff --cached --check, including newly tracked reports.
• ./php-cs-fixer.sh core '--dry-run --using-cache=no'.
• No source, test, asset, workflow, dependency or unrelated documentation changes included.
• CI for this documentation candidate: nine successful PR checks; seven workflows and ten successful checks after merging to main.

Native review did not produce a closed approval; its START result was unknown after reconciliation and assessment returned an incompatible schema. No native approval is claimed and no reset/recovery or START replay was performed. Independent document verification is the recorded review evidence; CI for this draft remains pending.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Documentation-only publication; none of the application-change categories above applies.

Checklist

• I verified that my code applies to the guidelines (composer code-check)
• I updated the documentation (see here)
• I agree that this code is used in Kimai (see license)

Local OpenSpec documentation is updated; no external website documentation was changed. Full composer code-check was not run locally; the maintainer agreement remains for the maintainer. This PR was created as a draft. Main publication was subsequently authorized explicitly; no manual deployment was executed.

Final publication evidence

This documentation-only PR merged normally into main as 8bfe100175aaa64dabfc28aecc0b17bc5c9522f2 on 2026-09-13 at 15:01:47 UTC. Fresh CI for that exact merge completed successfully: seven workflows and ten checks.

• PHP integration: 4,805 full-suite tests on each PHP 8.2–8.5, migration round trips, and PHP 8.5 coverage generation.
• PHP lint: application/test PHPStan, style, validation and security checks succeeded. Database synchronization was explicitly skipped.
• Frontend: pnpm 10.34.4, frozen installation and build succeeded; bootstrap audit reported zero vulnerabilities and the separate project audit reported no known vulnerabilities.

The bot created direct version-only descendant c0ede81a6f0e24740b1ddfe9c407a41ecdcd06d1, changing only src/Constants.php to version 2.62.167 / ID 26367. Its [skip ci] commit has no independent CI run. No production deployment identity is established by this evidence.

Existing warnings, deliberate skips and the trusted-author lock-guard exemption remain distinct from successful workflow conclusions. The workflow scan also reported a note-level template-injection finding at .github/workflows/version-bump.yaml:48, pending separate evaluation; no zero-findings security claim is made.

This completes the authorized Git publication and its post-merge verification. Historical reports, the separate baseline analysis FAIL and the native-review limitation documented above remain unchanged. No additional source changes or OpenSpec lifecycle operations were performed.