release: v15.0.126

[hq-audit-bot]

Summary

• Promotes hq-core-staging@71b5bb8 → hq-core for v15.0.126
• 7 file(s) changed in this promotion
• 🤖 Auto-promote: this PR tracks staging main and is force-updated on every push.
• ✅ Auto-merge on green is armed (gh pr merge --auto --squash). Required checks must pass; red checks hold the PR indefinitely.
• 🛑 Hold a release: gh pr edit <N> --add-label hold-release (or apply the hold-release label in the UI). That disables auto-merge and skips re-arming on subsequent staging pushes.

Lineage note

Opened automatically by promote-to-hq-core.yml from
indigoai-us/hq-core-staging@71b5bb874af8e8ace09466fc477f6213254cc043.

Diff stat

 .claude/skills/hq-access/SKILL.md                  | 119 +++++++++++++++++++++
 .claude/skills/hq-files/SKILL.md                   |   3 +
 .claude/skills/hq-heal/SKILL.md                    |  13 +++
 .claude/skills/hq-sync/SKILL.md                    |   2 +
 core/core.yaml                                     |   4 +-
 core/docs/hq/MIGRATION.md                          |  16 +++
 .../hq-failed-file-open-runs-access-ladder.md      |  46 ++++++++
 7 files changed, 201 insertions(+), 2 deletions(-)

Test plan

• denylist-scan / provenance-stripped / public-frontmatter-revalidate pass on this PR
• core-yaml-locked CI passes (label: version-bump)
• special-case-files CI passes (label: special-case-confirmed)
• After merge, tag v15.0.126 on the squash commit
• release.yml workflow runs and creates the GitHub release

[hq-audit-bot]

Audit Passed

All scanners completed with zero findings. This PR is clear.

• Scanners run: pii, denylist (skipped — 1Password unavailable), domains (skipped), slugs (skipped), repo/hq-internal-code
• PII findings: 0
• Iteration: initial scan
• Diff scope: 7 files (added/modified lines only, .audit-settings excluded)

Note: denylist, domain, and slug scanners were skipped because the 1Password secret op://Personal/hq-audit-denylist/terms could not be loaded in this runner environment. PII and repo-specific code pattern scanners ran fully and found nothing.

[hq-audit-bot]

Audit Passed

All scanners completed with zero findings. This PR is clear.

• Scanners run: pii (clean), denylist/domains/slugs (skipped — 1Password unavailable in this environment)
• Iteration: initial scan
• Files audited: 8 changed files

Note: The denylist, domain, and slug scanners require a SLACK_BOT_TOKEN / op CLI with access to op://Personal/hq-audit-denylist/terms. They were skipped this run. The PII scanner (static regex patterns) ran fully and found nothing.

[hq-audit-bot]

Audit Passed

All scanners completed with zero findings. This PR is clear.

• Scanners run: pii, repo/hq-internal-code
• Scanners skipped: denylist, domains, slugs (1Password CLI unavailable in this environment — terms could not be loaded)
• Iteration: initial scan
• Files scanned: 11 (496 added/modified lines)

[hq-audit-bot]

Audit Passed

All scanners completed with zero findings. This PR is clear.

• Scanners run: pii, denylist (skipped — 1Password unavailable in this environment), domains (skipped), slugs (skipped)
• PII scanner: clean — 0 findings across 11 changed files
• Repo-specific scanner (hq-internal-code): clean
• Iteration: initial scan
• Mode: report-only