diff --git a/.changeset/remove-step-up-from-session-flow.md b/.changeset/remove-step-up-from-session-flow.md
deleted file mode 100644
index fe4c8b62..00000000
--- a/.changeset/remove-step-up-from-session-flow.md
+++ /dev/null
@@ -1,8 +0,0 @@
----
-"@semantask/auth": patch
-"@semantask/web": patch
-"@semantask/db": patch
-"@semantask/socket": patch
----
-
-Remove automatic step-up OTP challenges from normal session refresh and bootstrap. Access-token refresh rotates tokens without creating challenges; challenge UI/API and StepUpChallenge model are removed as dead code. Docs updated to the MVP session contract (silent refresh; login/register OTP remains account verification only).
diff --git a/.changeset/v2-p0-execution-mode.md b/.changeset/v2-p0-execution-mode.md
deleted file mode 100644
index 13ce00c6..00000000
--- a/.changeset/v2-p0-execution-mode.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-"@semantask/types": minor
-"@semantask/db": minor
-"@semantask/services": minor
-"@semantask/task-worker": minor
-"@semantask/web": patch
----
-
-ADR-005 S0.2 — default workspace `executionMode` (`suggest_only` | `require_approval` | `auto_execute`) with shadow→enforce flags.
-
-### Added
-- `ExecutionMode` type and `OrganizationPolicy.executionMode` (+ updatedAt/By)
-- `getEffectiveExecutionMode` / `EXECUTION_MODE_ENFORCE` / `DEFAULT_EXECUTION_MODE` / `GRANDFATHER_AUTO_TENANTS`
-- Policy GET/PUT surfaces `executionMode`; logs `policy.execution_mode.changed`
-- Worker policy gate: enforce + `suggest_only` blocks tools (`EXECUTION_MODE_DENIED`); `require_approval` caps auto-execute; shadow logs; tool-executor fail-closed
diff --git a/.changeset/v2-p0-language-pass.md b/.changeset/v2-p0-language-pass.md
deleted file mode 100644
index d14143a5..00000000
--- a/.changeset/v2-p0-language-pass.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@semantask/web": patch
----
-
-ADR-005 S0.3 — language pass: Suggested work / Approval queue labels in task panel and admin (copy only).
diff --git a/.changeset/v2-p1-chat-badge-cta.md b/.changeset/v2-p1-chat-badge-cta.md
deleted file mode 100644
index 2a121c19..00000000
--- a/.changeset/v2-p1-chat-badge-cta.md
+++ /dev/null
@@ -1,10 +0,0 @@
----
-"@semantask/web": patch
----
-
-Intent badge “Review suggestion” CTA deep-links to a read-only WorkSuggestion detail stub when a suggestion exists for the message.
-
-### Added
-- Client helpers `listWorkSuggestions` / `getWorkSuggestion`
-- Conversation suggestion index (refresh on `message:semantic_updated`)
-- Intent badge CTA → `/work-suggestions/[id]` (no accept/dismiss)
diff --git a/.changeset/v2-p1-classifier-shadow.md b/.changeset/v2-p1-classifier-shadow.md
deleted file mode 100644
index 4abb0128..00000000
--- a/.changeset/v2-p1-classifier-shadow.md
+++ /dev/null
@@ -1,17 +0,0 @@
----
-"@semantask/services": minor
-"@semantask/observability": minor
-"@semantask/task-worker": patch
----
-
-Harden classifier shadow metrics/isolation, add assignee/due heuristics, and ship a labeled evaluation harness. Production default remains `TASK_CLASSIFIER_MODE=regex`.
-
-### Added
-- `classifier_classifications_total{mode,source}`; disagreement counter labels `{regex_type,llm_type}`
-- Failure-isolated disagreement hooks; shadow LLM failures cannot break classification
-- Deterministic assignee (@mention/email) + due-date heuristics → MessageIntent / WorkSuggestion candidates
-- Extractor version `intelligent-v7-entity-heuristics`
-- Seed gold eval harness (`packages/services/eval/`) with CI gate (≥0.7 type accuracy)
-
-### Compatibility
-- `regex` remains default authority; shadow never alters product path or execution
diff --git a/.changeset/v2-p1-suggest-only-ingress.md b/.changeset/v2-p1-suggest-only-ingress.md
deleted file mode 100644
index 2ebab270..00000000
--- a/.changeset/v2-p1-suggest-only-ingress.md
+++ /dev/null
@@ -1,17 +0,0 @@
----
-"@semantask/services": minor
-"@semantask/observability": minor
-"@semantask/task-worker": patch
----
-
- Classifier ingress creates reviewable WorkSuggestions under `suggest_only` without enqueueing execution.
-
-### Added
-- `SUGGESTION_INGRESS` / `SUGGESTION_BLOCK_EXEC` flags and `shouldBlockExecutionEnqueue`
-- Dual-write: actionable classify → MessageIntent + idempotent WorkSuggestion (`SUGGESTION_INGRESS=1`)
-- Shared enqueue guard: refuse `task.execution.requested` at the worker/enqueue boundary under suggest_only
-- Worker defense-in-depth for leaked execution events; `classifier_disagreement_total` hook
-- Metrics: `suggestions_created_total`, `suggestion_latency_ms`, `execution_enqueue_attempted_while_suggest_only_total` + P0 alert
-
-### Compatibility
-- `SUGGESTION_INGRESS=0` (default) preserves legacy classify → Task → enqueue behavior
diff --git a/.changeset/v2-p1-suggestion-service-api-read.md b/.changeset/v2-p1-suggestion-service-api-read.md
deleted file mode 100644
index 190a7325..00000000
--- a/.changeset/v2-p1-suggestion-service-api-read.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-"@semantask/services": minor
-"@semantask/web": patch
----
-
-Expose WorkSuggestion create/get/list service and read-only APIs so proposed work can be fetched under conversation or org authz, without implying Task creation or tool execution.
diff --git a/.changeset/v2-p1-suggestion-types-db.md b/.changeset/v2-p1-suggestion-types-db.md
deleted file mode 100644
index 480e8fef..00000000
--- a/.changeset/v2-p1-suggestion-types-db.md
+++ /dev/null
@@ -1,10 +0,0 @@
----
-"@semantask/types": minor
-"@semantask/db": minor
----
-
-Phase 1 PR1 — WorkSuggestion domain types and Mongoose model (reviewable proposed work, distinct from MessageIntent facts and Task committed work).
-
-### Added
-- `WORK_SUGGESTION_STATUSES` / `WorkSuggestionRecord` under `packages/types/work/`
-- `WorkSuggestion` model with org/conversation indexes and partial-unique `messageId` while `status=proposed`
diff --git a/.changeset/v2-p2-approvals-product-ui.md b/.changeset/v2-p2-approvals-product-ui.md
deleted file mode 100644
index 6288f2bf..00000000
--- a/.changeset/v2-p2-approvals-product-ui.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@semantask/web": patch
----
-
-Feature-flagged `/inbox/approvals` product surface reusing the existing task-approvals API inside Work Inbox IA.
diff --git a/.changeset/v2-p2-execution-approve-separate.md b/.changeset/v2-p2-execution-approve-separate.md
deleted file mode 100644
index 1c7dc759..00000000
--- a/.changeset/v2-p2-execution-approve-separate.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-"@semantask/services": minor
-"@semantask/web": patch
-"@semantask/task-worker": patch
----
-
-Phase 2 PR5 — Explicit manager “Allow AI tools” / request-execution path, distinct from WorkSuggestion accept, reusing TaskAction approvals.
diff --git a/.changeset/v2-p2-hardening.md b/.changeset/v2-p2-hardening.md
deleted file mode 100644
index e5391693..00000000
--- a/.changeset/v2-p2-hardening.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-"@semantask/db": patch
-"@semantask/observability": minor
-"@semantask/services": minor
----
-
-Phase 2 hardening — emit `work.suggestion.accepted|dismissed` outbox events, triage accept/dismiss metrics + latency, and accept→execution-while-disabled safety signal. AuthZ matrix documented as conversation participant OR org owner/admin (no behavior change; no conversation manager role).
diff --git a/.changeset/v2-p2-inbox-ui.md b/.changeset/v2-p2-inbox-ui.md
deleted file mode 100644
index 203fc9e4..00000000
--- a/.changeset/v2-p2-inbox-ui.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-"@semantask/services": minor
-"@semantask/web": patch
----
-
-Feature-flagged read-only `/inbox` Work Inbox (`WORK_INBOX_UI`) listing authorized WorkSuggestions with server-side pagination.
diff --git a/.changeset/v2-p2-suggestion-mutations.md b/.changeset/v2-p2-suggestion-mutations.md
deleted file mode 100644
index f2ae0ef2..00000000
--- a/.changeset/v2-p2-suggestion-mutations.md
+++ /dev/null
@@ -1,8 +0,0 @@
----
-"@semantask/types": minor
-"@semantask/db": minor
-"@semantask/services": minor
-"@semantask/web": patch
----
-
-Phase 2 PR1 — Accept/dismiss/assign WorkSuggestion mutations create coordination Tasks without enqueueing execution (`ACCEPT_CREATES_EXECUTION=0` rail, `Task.suggestionId` linkage).
diff --git a/.changeset/v2-p2-suggestion-triage.md b/.changeset/v2-p2-suggestion-triage.md
deleted file mode 100644
index f1c5a46d..00000000
--- a/.changeset/v2-p2-suggestion-triage.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@semantask/web": patch
----
-
-Phase 2 PR4 — Make Work Inbox suggestions actionable with Accept / Assign / Dismiss triage using existing mutation APIs.
diff --git a/.changeset/web-tanstack-query-inbox.md b/.changeset/web-tanstack-query-inbox.md
deleted file mode 100644
index c3a17dbf..00000000
--- a/.changeset/web-tanstack-query-inbox.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@semantask/web": patch
----
-
-Adopt TanStack Query on web for work inbox, execution approvals, and organizations server state.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d614b652..0eb1c1db 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # semantask
 
+## 2.0.13
+
+### Patch Changes
+
+- Workspace release: @semantask/auth, @semantask/db, @semantask/observability, @semantask/services, @semantask/socket, @semantask/task-worker, @semantask/types, @semantask/web (see package changelogs for details)
+
 ## 2.0.12
 
 ### Patch Changes
diff --git a/apps/socket/CHANGELOG.md b/apps/socket/CHANGELOG.md
index 5da6d830..a16d519e 100644
--- a/apps/socket/CHANGELOG.md
+++ b/apps/socket/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @semantask/socket
 
+## 4.2.1
+
+### Patch Changes
+
+- 45d3e43: Remove automatic step-up OTP challenges from normal session refresh and bootstrap. Access-token refresh rotates tokens without creating challenges; challenge UI/API and StepUpChallenge model are removed as dead code. Docs updated to the MVP session contract (silent refresh; login/register OTP remains account verification only).
+- Updated dependencies [293f039]
+- Updated dependencies [d63de76]
+- Updated dependencies [5049ff5]
+- Updated dependencies [4de730c]
+- Updated dependencies [eb2ed2b]
+- Updated dependencies [5bcff34]
+  - @semantask/types@2.2.0
+  - @semantask/observability@1.2.0
+
 ## 4.2.0
 
 ### Minor Changes
diff --git a/apps/socket/package.json b/apps/socket/package.json
index b0ad9a71..a9d8c8ec 100644
--- a/apps/socket/package.json
+++ b/apps/socket/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@semantask/socket",
-    "version": "4.2.0",
+    "version": "4.2.1",
     "private": true,
     "type": "module",
     "scripts": {
diff --git a/apps/task-worker/CHANGELOG.md b/apps/task-worker/CHANGELOG.md
index 97bf862e..c30b09c6 100644
--- a/apps/task-worker/CHANGELOG.md
+++ b/apps/task-worker/CHANGELOG.md
@@ -1,5 +1,59 @@
 # @semantask/task-worker
 
+## 3.3.0
+
+### Minor Changes
+
+- 293f039: ADR-005 S0.2 — default workspace `executionMode` (`suggest_only` | `require_approval` | `auto_execute`) with shadow→enforce flags.
+
+  ### Added
+  - `ExecutionMode` type and `OrganizationPolicy.executionMode` (+ updatedAt/By)
+  - `getEffectiveExecutionMode` / `EXECUTION_MODE_ENFORCE` / `DEFAULT_EXECUTION_MODE` / `GRANDFATHER_AUTO_TENANTS`
+  - Policy GET/PUT surfaces `executionMode`; logs `policy.execution_mode.changed`
+  - Worker policy gate: enforce + `suggest_only` blocks tools (`EXECUTION_MODE_DENIED`); `require_approval` caps auto-execute; shadow logs; tool-executor fail-closed
+
+### Patch Changes
+
+- d63de76: Harden classifier shadow metrics/isolation, add assignee/due heuristics, and ship a labeled evaluation harness. Production default remains `TASK_CLASSIFIER_MODE=regex`.
+
+  ### Added
+  - `classifier_classifications_total{mode,source}`; disagreement counter labels `{regex_type,llm_type}`
+  - Failure-isolated disagreement hooks; shadow LLM failures cannot break classification
+  - Deterministic assignee (@mention/email) + due-date heuristics → MessageIntent / WorkSuggestion candidates
+  - Extractor version `intelligent-v7-entity-heuristics`
+  - Seed gold eval harness (`packages/services/eval/`) with CI gate (≥0.7 type accuracy)
+
+  ### Compatibility
+  - `regex` remains default authority; shadow never alters product path or execution
+
+- 5049ff5: Classifier ingress creates reviewable WorkSuggestions under `suggest_only` without enqueueing execution.
+
+  ### Added
+  - `SUGGESTION_INGRESS` / `SUGGESTION_BLOCK_EXEC` flags and `shouldBlockExecutionEnqueue`
+  - Dual-write: actionable classify → MessageIntent + idempotent WorkSuggestion (`SUGGESTION_INGRESS=1`)
+  - Shared enqueue guard: refuse `task.execution.requested` at the worker/enqueue boundary under suggest_only
+  - Worker defense-in-depth for leaked execution events; `classifier_disagreement_total` hook
+  - Metrics: `suggestions_created_total`, `suggestion_latency_ms`, `execution_enqueue_attempted_while_suggest_only_total` + P0 alert
+
+  ### Compatibility
+  - `SUGGESTION_INGRESS=0` (default) preserves legacy classify → Task → enqueue behavior
+
+- 24955f9: Phase 2 PR5 — Explicit manager “Allow AI tools” / request-execution path, distinct from WorkSuggestion accept, reusing TaskAction approvals.
+- Updated dependencies [45d3e43]
+- Updated dependencies [293f039]
+- Updated dependencies [d63de76]
+- Updated dependencies [5049ff5]
+- Updated dependencies [78a9a0a]
+- Updated dependencies [4de730c]
+- Updated dependencies [24955f9]
+- Updated dependencies [eb2ed2b]
+- Updated dependencies [0e84316]
+- Updated dependencies [5bcff34]
+  - @semantask/db@3.3.0
+  - @semantask/types@2.2.0
+  - @semantask/services@3.3.0
+  - @semantask/observability@1.2.0
+
 ## 3.2.0
 
 ### Minor Changes
diff --git a/apps/task-worker/package.json b/apps/task-worker/package.json
index 9c16459d..3be98df2 100644
--- a/apps/task-worker/package.json
+++ b/apps/task-worker/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@semantask/task-worker",
-    "version": "3.2.0",
+    "version": "3.3.0",
     "private": true,
     "type": "module",
     "scripts": {
diff --git a/apps/web/CHANGELOG.md b/apps/web/CHANGELOG.md
index e54620a4..10185678 100644
--- a/apps/web/CHANGELOG.md
+++ b/apps/web/CHANGELOG.md
@@ -1,5 +1,48 @@
 # @semantask/web
 
+## 5.2.1
+
+### Patch Changes
+
+- 45d3e43: Remove automatic step-up OTP challenges from normal session refresh and bootstrap. Access-token refresh rotates tokens without creating challenges; challenge UI/API and StepUpChallenge model are removed as dead code. Docs updated to the MVP session contract (silent refresh; login/register OTP remains account verification only).
+- 293f039: ADR-005 S0.2 — default workspace `executionMode` (`suggest_only` | `require_approval` | `auto_execute`) with shadow→enforce flags.
+
+  ### Added
+  - `ExecutionMode` type and `OrganizationPolicy.executionMode` (+ updatedAt/By)
+  - `getEffectiveExecutionMode` / `EXECUTION_MODE_ENFORCE` / `DEFAULT_EXECUTION_MODE` / `GRANDFATHER_AUTO_TENANTS`
+  - Policy GET/PUT surfaces `executionMode`; logs `policy.execution_mode.changed`
+  - Worker policy gate: enforce + `suggest_only` blocks tools (`EXECUTION_MODE_DENIED`); `require_approval` caps auto-execute; shadow logs; tool-executor fail-closed
+
+- 293f039: ADR-005 S0.3 — language pass: Suggested work / Approval queue labels in task panel and admin (copy only).
+- 2b614f9: Intent badge “Review suggestion” CTA deep-links to a read-only WorkSuggestion detail stub when a suggestion exists for the message.
+
+  ### Added
+  - Client helpers `listWorkSuggestions` / `getWorkSuggestion`
+  - Conversation suggestion index (refresh on `message:semantic_updated`)
+  - Intent badge CTA → `/work-suggestions/[id]` (no accept/dismiss)
+
+- 78a9a0a: Expose WorkSuggestion create/get/list service and read-only APIs so proposed work can be fetched under conversation or org authz, without implying Task creation or tool execution.
+- 7c10441: Feature-flagged `/inbox/approvals` product surface reusing the existing task-approvals API inside Work Inbox IA.
+- 24955f9: Phase 2 PR5 — Explicit manager “Allow AI tools” / request-execution path, distinct from WorkSuggestion accept, reusing TaskAction approvals.
+- 0e84316: Feature-flagged read-only `/inbox` Work Inbox (`WORK_INBOX_UI`) listing authorized WorkSuggestions with server-side pagination.
+- 5bcff34: Phase 2 PR1 — Accept/dismiss/assign WorkSuggestion mutations create coordination Tasks without enqueueing execution (`ACCEPT_CREATES_EXECUTION=0` rail, `Task.suggestionId` linkage).
+- 46ed62c: Phase 2 PR4 — Make Work Inbox suggestions actionable with Accept / Assign / Dismiss triage using existing mutation APIs.
+- 5b18ffa: Adopt TanStack Query on web for work inbox, execution approvals, and organizations server state.
+- Updated dependencies [45d3e43]
+- Updated dependencies [293f039]
+- Updated dependencies [d63de76]
+- Updated dependencies [5049ff5]
+- Updated dependencies [78a9a0a]
+- Updated dependencies [4de730c]
+- Updated dependencies [24955f9]
+- Updated dependencies [eb2ed2b]
+- Updated dependencies [0e84316]
+- Updated dependencies [5bcff34]
+  - @semantask/auth@3.0.2
+  - @semantask/types@2.2.0
+  - @semantask/services@3.3.0
+  - @semantask/observability@1.2.0
+
 ## 5.2.0
 
 ### Minor Changes
diff --git a/apps/web/package.json b/apps/web/package.json
index cb739825..fbb1b723 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@semantask/web",
-    "version": "5.2.0",
+    "version": "5.2.1",
     "private": true,
     "scripts": {
         "dev": "next dev",
diff --git a/package.json b/package.json
index 0bb9c13f..7ab2661f 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "semantask",
-  "version": "2.0.12",
+  "version": "2.0.13",
   "private": true,
   "type": "module",
   "packageManager": "pnpm@11.13.1",
diff --git a/packages/auth/CHANGELOG.md b/packages/auth/CHANGELOG.md
index 60a3d42b..49c9a251 100644
--- a/packages/auth/CHANGELOG.md
+++ b/packages/auth/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @semantask/auth
 
+## 3.0.2
+
+### Patch Changes
+
+- 45d3e43: Remove automatic step-up OTP challenges from normal session refresh and bootstrap. Access-token refresh rotates tokens without creating challenges; challenge UI/API and StepUpChallenge model are removed as dead code. Docs updated to the MVP session contract (silent refresh; login/register OTP remains account verification only).
+
 ## 3.0.1
 
 ### Patch Changes
diff --git a/packages/auth/package.json b/packages/auth/package.json
index 3d9e755f..97a5af5a 100644
--- a/packages/auth/package.json
+++ b/packages/auth/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@semantask/auth",
-  "version": "3.0.1",
+  "version": "3.0.2",
   "private": true,
   "type": "module",
   "main": "./index.ts",
diff --git a/packages/db/CHANGELOG.md b/packages/db/CHANGELOG.md
index 6b00e33f..d2277157 100644
--- a/packages/db/CHANGELOG.md
+++ b/packages/db/CHANGELOG.md
@@ -1,5 +1,30 @@
 # @semantask/db
 
+## 3.3.0
+
+### Minor Changes
+
+- 293f039: ADR-005 S0.2 — default workspace `executionMode` (`suggest_only` | `require_approval` | `auto_execute`) with shadow→enforce flags.
+
+  ### Added
+  - `ExecutionMode` type and `OrganizationPolicy.executionMode` (+ updatedAt/By)
+  - `getEffectiveExecutionMode` / `EXECUTION_MODE_ENFORCE` / `DEFAULT_EXECUTION_MODE` / `GRANDFATHER_AUTO_TENANTS`
+  - Policy GET/PUT surfaces `executionMode`; logs `policy.execution_mode.changed`
+  - Worker policy gate: enforce + `suggest_only` blocks tools (`EXECUTION_MODE_DENIED`); `require_approval` caps auto-execute; shadow logs; tool-executor fail-closed
+
+- 4de730c: Phase 1 PR1 — WorkSuggestion domain types and Mongoose model (reviewable proposed work, distinct from MessageIntent facts and Task committed work).
+
+  ### Added
+  - `WORK_SUGGESTION_STATUSES` / `WorkSuggestionRecord` under `packages/types/work/`
+  - `WorkSuggestion` model with org/conversation indexes and partial-unique `messageId` while `status=proposed`
+
+- 5bcff34: Phase 2 PR1 — Accept/dismiss/assign WorkSuggestion mutations create coordination Tasks without enqueueing execution (`ACCEPT_CREATES_EXECUTION=0` rail, `Task.suggestionId` linkage).
+
+### Patch Changes
+
+- 45d3e43: Remove automatic step-up OTP challenges from normal session refresh and bootstrap. Access-token refresh rotates tokens without creating challenges; challenge UI/API and StepUpChallenge model are removed as dead code. Docs updated to the MVP session contract (silent refresh; login/register OTP remains account verification only).
+- eb2ed2b: Phase 2 hardening — emit `work.suggestion.accepted|dismissed` outbox events, triage accept/dismiss metrics + latency, and accept→execution-while-disabled safety signal. AuthZ matrix documented as conversation participant OR org owner/admin (no behavior change; no conversation manager role).
+
 ## 3.2.0
 
 ### Minor Changes
diff --git a/packages/db/package.json b/packages/db/package.json
index b51e4d9b..b9f3b5ba 100644
--- a/packages/db/package.json
+++ b/packages/db/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@semantask/db",
-    "version": "3.2.0",
+    "version": "3.3.0",
     "type": "module",
     "main": "./dist/db.js",
     "types": "./dist/db.d.ts",
diff --git a/packages/observability/CHANGELOG.md b/packages/observability/CHANGELOG.md
index 1db3bd33..fa5f785a 100644
--- a/packages/observability/CHANGELOG.md
+++ b/packages/observability/CHANGELOG.md
@@ -1,5 +1,35 @@
 # @semantask/observability
 
+## 1.2.0
+
+### Minor Changes
+
+- d63de76: Harden classifier shadow metrics/isolation, add assignee/due heuristics, and ship a labeled evaluation harness. Production default remains `TASK_CLASSIFIER_MODE=regex`.
+
+  ### Added
+  - `classifier_classifications_total{mode,source}`; disagreement counter labels `{regex_type,llm_type}`
+  - Failure-isolated disagreement hooks; shadow LLM failures cannot break classification
+  - Deterministic assignee (@mention/email) + due-date heuristics → MessageIntent / WorkSuggestion candidates
+  - Extractor version `intelligent-v7-entity-heuristics`
+  - Seed gold eval harness (`packages/services/eval/`) with CI gate (≥0.7 type accuracy)
+
+  ### Compatibility
+  - `regex` remains default authority; shadow never alters product path or execution
+
+- 5049ff5: Classifier ingress creates reviewable WorkSuggestions under `suggest_only` without enqueueing execution.
+
+  ### Added
+  - `SUGGESTION_INGRESS` / `SUGGESTION_BLOCK_EXEC` flags and `shouldBlockExecutionEnqueue`
+  - Dual-write: actionable classify → MessageIntent + idempotent WorkSuggestion (`SUGGESTION_INGRESS=1`)
+  - Shared enqueue guard: refuse `task.execution.requested` at the worker/enqueue boundary under suggest_only
+  - Worker defense-in-depth for leaked execution events; `classifier_disagreement_total` hook
+  - Metrics: `suggestions_created_total`, `suggestion_latency_ms`, `execution_enqueue_attempted_while_suggest_only_total` + P0 alert
+
+  ### Compatibility
+  - `SUGGESTION_INGRESS=0` (default) preserves legacy classify → Task → enqueue behavior
+
+- eb2ed2b: Phase 2 hardening — emit `work.suggestion.accepted|dismissed` outbox events, triage accept/dismiss metrics + latency, and accept→execution-while-disabled safety signal. AuthZ matrix documented as conversation participant OR org owner/admin (no behavior change; no conversation manager role).
+
 ## 1.1.0
 
 ### Minor Changes
diff --git a/packages/observability/package.json b/packages/observability/package.json
index ad4f1b10..8a804f6c 100644
--- a/packages/observability/package.json
+++ b/packages/observability/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@semantask/observability",
-    "version": "1.1.0",
+    "version": "1.2.0",
     "private": true,
     "type": "module",
     "main": "./dist/index.js",
diff --git a/packages/services/CHANGELOG.md b/packages/services/CHANGELOG.md
index 5f289c9c..7e10646a 100644
--- a/packages/services/CHANGELOG.md
+++ b/packages/services/CHANGELOG.md
@@ -1,5 +1,60 @@
 # @semantask/services
 
+## 3.3.0
+
+### Minor Changes
+
+- 293f039: ADR-005 S0.2 — default workspace `executionMode` (`suggest_only` | `require_approval` | `auto_execute`) with shadow→enforce flags.
+
+  ### Added
+  - `ExecutionMode` type and `OrganizationPolicy.executionMode` (+ updatedAt/By)
+  - `getEffectiveExecutionMode` / `EXECUTION_MODE_ENFORCE` / `DEFAULT_EXECUTION_MODE` / `GRANDFATHER_AUTO_TENANTS`
+  - Policy GET/PUT surfaces `executionMode`; logs `policy.execution_mode.changed`
+  - Worker policy gate: enforce + `suggest_only` blocks tools (`EXECUTION_MODE_DENIED`); `require_approval` caps auto-execute; shadow logs; tool-executor fail-closed
+
+- d63de76: Harden classifier shadow metrics/isolation, add assignee/due heuristics, and ship a labeled evaluation harness. Production default remains `TASK_CLASSIFIER_MODE=regex`.
+
+  ### Added
+  - `classifier_classifications_total{mode,source}`; disagreement counter labels `{regex_type,llm_type}`
+  - Failure-isolated disagreement hooks; shadow LLM failures cannot break classification
+  - Deterministic assignee (@mention/email) + due-date heuristics → MessageIntent / WorkSuggestion candidates
+  - Extractor version `intelligent-v7-entity-heuristics`
+  - Seed gold eval harness (`packages/services/eval/`) with CI gate (≥0.7 type accuracy)
+
+  ### Compatibility
+  - `regex` remains default authority; shadow never alters product path or execution
+
+- 5049ff5: Classifier ingress creates reviewable WorkSuggestions under `suggest_only` without enqueueing execution.
+
+  ### Added
+  - `SUGGESTION_INGRESS` / `SUGGESTION_BLOCK_EXEC` flags and `shouldBlockExecutionEnqueue`
+  - Dual-write: actionable classify → MessageIntent + idempotent WorkSuggestion (`SUGGESTION_INGRESS=1`)
+  - Shared enqueue guard: refuse `task.execution.requested` at the worker/enqueue boundary under suggest_only
+  - Worker defense-in-depth for leaked execution events; `classifier_disagreement_total` hook
+  - Metrics: `suggestions_created_total`, `suggestion_latency_ms`, `execution_enqueue_attempted_while_suggest_only_total` + P0 alert
+
+  ### Compatibility
+  - `SUGGESTION_INGRESS=0` (default) preserves legacy classify → Task → enqueue behavior
+
+- 78a9a0a: Expose WorkSuggestion create/get/list service and read-only APIs so proposed work can be fetched under conversation or org authz, without implying Task creation or tool execution.
+- 24955f9: Phase 2 PR5 — Explicit manager “Allow AI tools” / request-execution path, distinct from WorkSuggestion accept, reusing TaskAction approvals.
+- eb2ed2b: Phase 2 hardening — emit `work.suggestion.accepted|dismissed` outbox events, triage accept/dismiss metrics + latency, and accept→execution-while-disabled safety signal. AuthZ matrix documented as conversation participant OR org owner/admin (no behavior change; no conversation manager role).
+- 0e84316: Feature-flagged read-only `/inbox` Work Inbox (`WORK_INBOX_UI`) listing authorized WorkSuggestions with server-side pagination.
+- 5bcff34: Phase 2 PR1 — Accept/dismiss/assign WorkSuggestion mutations create coordination Tasks without enqueueing execution (`ACCEPT_CREATES_EXECUTION=0` rail, `Task.suggestionId` linkage).
+
+### Patch Changes
+
+- Updated dependencies [45d3e43]
+- Updated dependencies [293f039]
+- Updated dependencies [d63de76]
+- Updated dependencies [5049ff5]
+- Updated dependencies [4de730c]
+- Updated dependencies [eb2ed2b]
+- Updated dependencies [5bcff34]
+  - @semantask/db@3.3.0
+  - @semantask/types@2.2.0
+  - @semantask/observability@1.2.0
+
 ## 3.2.0
 
 ### Minor Changes
diff --git a/packages/services/package.json b/packages/services/package.json
index 761a1ab2..65543aba 100644
--- a/packages/services/package.json
+++ b/packages/services/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@semantask/services",
-    "version": "3.2.0",
+    "version": "3.3.0",
     "type": "module",
     "main": "./dist/index.js",
     "types": "./dist/index.d.ts",
diff --git a/packages/types/CHANGELOG.md b/packages/types/CHANGELOG.md
index 08e542db..63f104fd 100644
--- a/packages/types/CHANGELOG.md
+++ b/packages/types/CHANGELOG.md
@@ -1,5 +1,25 @@
 # @semantask/types
 
+## 2.2.0
+
+### Minor Changes
+
+- 293f039: ADR-005 S0.2 — default workspace `executionMode` (`suggest_only` | `require_approval` | `auto_execute`) with shadow→enforce flags.
+
+  ### Added
+  - `ExecutionMode` type and `OrganizationPolicy.executionMode` (+ updatedAt/By)
+  - `getEffectiveExecutionMode` / `EXECUTION_MODE_ENFORCE` / `DEFAULT_EXECUTION_MODE` / `GRANDFATHER_AUTO_TENANTS`
+  - Policy GET/PUT surfaces `executionMode`; logs `policy.execution_mode.changed`
+  - Worker policy gate: enforce + `suggest_only` blocks tools (`EXECUTION_MODE_DENIED`); `require_approval` caps auto-execute; shadow logs; tool-executor fail-closed
+
+- 4de730c: Phase 1 PR1 — WorkSuggestion domain types and Mongoose model (reviewable proposed work, distinct from MessageIntent facts and Task committed work).
+
+  ### Added
+  - `WORK_SUGGESTION_STATUSES` / `WorkSuggestionRecord` under `packages/types/work/`
+  - `WorkSuggestion` model with org/conversation indexes and partial-unique `messageId` while `status=proposed`
+
+- 5bcff34: Phase 2 PR1 — Accept/dismiss/assign WorkSuggestion mutations create coordination Tasks without enqueueing execution (`ACCEPT_CREATES_EXECUTION=0` rail, `Task.suggestionId` linkage).
+
 ## 2.1.0
 
 ### Minor Changes
diff --git a/packages/types/package.json b/packages/types/package.json
index 89d0d56d..b0d1ddf1 100644
--- a/packages/types/package.json
+++ b/packages/types/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@semantask/types",
-    "version": "2.1.0",
+    "version": "2.2.0",
     "private": true,
     "type": "module",
     "main": "./dist/index.js",