diff --git a/CHANGELOG.md b/CHANGELOG.md
index 91ce609..ac04644 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -90,6 +90,11 @@ repository still gets a decision, never by following the link; no release carrie
 - build(deps): bump github.com/google/cel-go from 0.30.0 to 0.31.0
 - build(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.2.3
 - :fire: chore(deps): drop dormant Renovate; Dependabot is the updater
+- build(deps): bump github/codeql-action/upload-sarif
+- build(deps): bump golang.org/x/text from 0.40.0 to 0.41.0
+- build(deps): bump github/codeql-action/init from 4.37.6 to 4.37.7
+- build(deps): bump github/codeql-action/analyze from 4.37.6 to 4.37.7
+- build(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.1
 
 ### Documentation
 - :memo: docs(decisions): record D-126 (D-031 domain deferred) and D-127 (SEC-05 PAT rotation scheduled)
@@ -136,6 +141,8 @@ repository still gets a decision, never by following the link; no release carrie
 - :memo: docs(changelog): regenerate CHANGELOG.md for the AUD-S18 CHECK_STAGES fix
 - :memo: docs(changelog): regenerate CHANGELOG.md for the check_coverage_bar narrowing fix
 - :memo: docs(changelog): regenerate CHANGELOG.md for the stale-'15' cosmetic fix
+- :memo: docs(backlog): track the D-145 writes-gate lane as WG-S01
+- :memo: docs(changelog): regenerate CHANGELOG.md for the dependabot bumps and audit fixes
 
 ### Features
 - :sparkles: feat(docs): gate example pack and format claims against dogfood
@@ -162,6 +169,9 @@ repository still gets a decision, never by following the link; no release carrie
 - :recycle: refactor(examples): discover dogfood packs instead of a hardcoded 3-name loop
 - :art: style(audit): de-stale hardcoded '15 stages' literals in AUD-S18 gate
 
+### Security
+- :lock: build(go): pin toolchain go1.26.6 so builds ship a patched stdlib
+
 ### Testing
 - :white_check_mark: test(release): anchor the D-120 note check on its header sentence, not the bare token
 - :white_check_mark: test(release): key the merge-skip proof on commit shape, not subject prefix
diff --git a/go.mod b/go.mod
index 4ff9ee3..02e79ee 100644
--- a/go.mod
+++ b/go.mod
@@ -3,6 +3,8 @@ module github.com/PlatformRelay/assent
 
 go 1.25.0
 
+toolchain go1.26.6
+
 require (
 	github.com/google/cel-go v0.31.0
 	github.com/hashicorp/hcl/v2 v2.24.0
diff --git a/openspec/specs/backlog.md b/openspec/specs/backlog.md
index d076d9b..d4f0008 100644
--- a/openspec/specs/backlog.md
+++ b/openspec/specs/backlog.md
@@ -681,6 +681,21 @@ S02 cannot start until the operator creates the bestpractices.dev project (INBOX
 | SEC-SC-S01 | Native Go fuzz targets on YAML/JSON/HCL differ (+ CI smoke) | **[autonomous]** | none | **do first** — Scorecard Fuzzing (#3); untrusted-byte crash/fail-open fence |
 | SEC-SC-S02 | OpenSSF Best Practices passing badge + honest evidence page | **[operator-gated]** | operator creates the bestpractices.dev project | Scorecard CII-Best-Practices (#6); no fake README badge |
 
+## Phase 5 — WG `writes: false` runtime gate (D-145)
+
+No spec yet — decompose spec-first (`openspec/` change proposal) before implementation, per
+AGENTS.md rule 4. D-145 resolved OQ-29 as option (a): `PolicyProfile.spec.writes: false` becomes
+runtime-enforced on `assent run`, as a third zero-write arm of the existing write switch
+(`cmd/assent/run.go`), refusing `forge.Reconcile` when `aggregate.CoverWithProfile` yields
+`Result.WriteAllowed == false`. The published stopgap annotation on
+`docs/architecture/policy-profiles.md` is removed by this lane and no earlier. Tracked here per
+PROJECT-AUDIT-2026-08-18 ARCH-01/DOC-01: the D-145 commitment previously existed in no backlog
+row. **Escalates back to P1 if unlanded at the next tag after v0.2.0's successor.**
+
+| ID | Story | Execution | Depends on | Gate contribution |
+| --- | --- | --- | --- | --- |
+| WG-S01 | ⚠️ D-145: load covering profile on the run path; refuse `forge.Reconcile` when `WriteAllowed=false`; remove the docs stopgap annotation | **[autonomous · engine-grade · LGTM]** | spec-first proposal | published safety guarantee becomes true; verification target = zero forge writes against the fake under a `writes: false` profile (shape: `run_self_vouch_test.go`) |
+
 ## Phases 3–5
 
 Epic paragraphs (goal, ADR constraints, exit gate, story seeds) in