diff --git a/tools/spec-loop/.last-sync b/tools/spec-loop/.last-sync
index 90f78dfde..b5d2b7317 100644
--- a/tools/spec-loop/.last-sync
+++ b/tools/spec-loop/.last-sync
@@ -1 +1 @@
-ccb53a38843646e1d02f97b1a27253b82aa2675d
+03c15a6d1c9f51c58e492ecff87036af05388d06
diff --git a/tools/spec-loop/specs/security-issue-lifecycle.md b/tools/spec-loop/specs/security-issue-lifecycle.md
index 3aabed7d8..c2f817971 100644
--- a/tools/spec-loop/specs/security-issue-lifecycle.md
+++ b/tools/spec-loop/specs/security-issue-lifecycle.md
@@ -63,8 +63,14 @@ publication, with a human gate and an audit-log entry at every step.
 - `tools/security-management` (stdlib, runs nothing) holds the
   deterministic rules of the security skills, one CLI family per skill
   over a shared library (`body`, `rollup`, `refs`, `titles`, `grammar`,
-  `keyword`, and `fields` / `threads` / `dispositions` / `selectors` for
-  reading existing trackers, #1672). For `security-issue-import` it decides the Step 0
+  `keyword`, `fields` / `threads` / `dispositions` / `selectors` for
+  reading existing trackers, and `drafting` / `recipients` / `numbered`
+  for reporter drafts, the security CC and the numbered-proposal reply,
+  #1672). It reuses, never copies, three stdlib workspace members:
+  github-body-field (the field parser), generate-cve-json (the bot-credit
+  policy) and magpie-vcs (the embargo scrub of public text). Every skill
+  of the family — the five importers, triage, invalidate, cve-allocate,
+  deduplicate, sync and fix — now has its family. For `security-issue-import` it decides the Step 0
   disclosure-governance defaults, the Step 1 pre-filter, the Step 2
   `threadId` batches and their attribution, the Step 3 forwarder
   pre-screen, the Step 6 reply grammar and the Step 7 receipt-draft
@@ -507,6 +513,7 @@ publication, with a human gate and an audit-log entry at every step.
 
 ```bash
 uv run --project tools/skill-and-tool-validator --group dev skill-and-tool-validate
+uv run --project tools/security-management --group dev pytest
 uv run --project tools/cve-tool-vulnogram/generate-cve-json --group dev pytest
 uv run --project tools/gmail/oauth-draft pytest
 ```