docs(openspec): plan upstream source readiness

[djm81]

Summary

Creates the modules-side OpenSpec follow-up for upstream source readiness before
native OpenSpec or Spec Kit artifacts are persisted as Requirements evidence.

Why

The published import-first runtime accepted the pristine official Spec Kit
0.12.15 scaffold and generated six placeholder requirement records. The new
change defines fail-closed handling for incomplete Spec Kit sources and
policy-required invalid OpenSpec sources.

Scope

• Adds requirements-04-upstream-source-readiness and registers it in the
  active change order.
• Records modules issue Validate upstream readiness before requirement evidence import #346 under parent feature Context Adapters For Validation Evidence #161.
• Keeps parsing, source readiness, and upstream-validator policy core-owned.
• Blocks module implementation on a paired specfact-cli follow-up to #350.

Validation

• openspec validate requirements-04-upstream-source-readiness --strict
• Repository pre-commit gates: signatures, format, YAML validation, bundle
  import boundaries, generated command validation, command contract, core-doc
  accountability, and docs command validation.

Relates to #346.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 99a09b1f-a365-458a-b327-9f1884980db3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/requirements-04-upstream-source-readiness

---

_{Comment @coderabbitai help to get the list of available commands.}

[strix-security]

Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 27d65f4ffd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Correct the active change count

This snapshot is now one too high: after this commit, openspec list/the openspec/changes tree contains 13 active changes including requirements-04-upstream-source-readiness, not 14. Since this file states it is the modules-side source of truth for active OpenSpec work, the inflated count immediately misreports the backlog and can mislead planning or follow-up cleanup; this line should remain 13 unless another active change is added.

Useful? React with 👍 / 👎.