Record published Governance CLI 1.15.0 in the registry (Refs FS-GG/FS.GG.Governance#423)

docs/registry/compatibility.md

@@ -111,6 +111,13 @@ The same SDD merge advances the emitted `governance-handoff` contract from 1.1.0
 now agree at 1.2.0; source-coherence run 30186679362 first exposed the inseparable drift,
 and the atomic registry merge `a8aa56f47625016085c30ed1d91bcfc820ae2694` resolved it.
 
+Governance runtime release evidence (2026-10-23): `FS.GG.Governance.Cli` **1.15.0** (tag `v1.15.0`
+→ `282741b1`, Governance PR #472, publish run 39928935417) connects explicit provider-mode
+`fsgg-governance verify` to GateExecution held-cwd execution and Governance-observed
+`governance-handoff@2.x` evidence acceptance. It needs Linux-x64 with glibc 2.40 or later; legacy verbs are
+unchanged. Readback run 39935018723 found both 1.15.0 tool archives entry-identical across GitHub Packages
+and nuget.org apart from the signature, both naming `282741b1`.
+
 | Contract | Version | Owner | Surface | Consumers |
 |---|---|---|---|---|
 | `scaffold-provider` | 1.1.0 | SDD | `.fsgg/providers.yml` + invocation protocol (canonical product-name param `name`, ADR-0005). **1.1.0** (2026-07-05, additive; SDD feature 080, [Rendering#142](https://github.com/FS-GG/FS.GG.Rendering/issues/142)): optional **`identifierParameter`** sink — a descriptor can name the param that receives an SDD-derived valid-F# identifier, so a product whose name is an illegal F# identifier (hyphenated `Roquelike-DungeonCrawler`) compiles; `None` ⇒ identical to 1.0.0. Rendering declares `identifierParameter: rootNamespace`. Released in `FS.GG.UI.Template 0.1.66-preview.1` (2026-07-05) — see coherence `scaffold-provider-identifier`. | Templates, Rendering |

registry/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Registry changelog
 
+## 2026-10-23 — record published Governance CLI 1.15.0 (FS-GG/FS.GG.Governance#423)
+
+Record `FS.GG.Governance.Cli` and `FS.GG.Governance.FSharpSurfaceCommand` **1.15.0**, published from annotated tag
+`v1.15.0` → `282741b1ed9ec555abbde8c7ad8ce472c70786cf` (Governance PR#472, GOV-423-C2 execution join) by publish run
+[39928935417](https://github.com/FS-GG/FS.GG.Governance/actions/runs/39928935417). The unchanged CodeChecks,
+ReferenceGateSet, Kernel and Adapters.Spi packages were skipped as duplicates.
+
+Read-only readback run [39935018723](https://github.com/FS-GG/FS.GG.Governance/actions/runs/39935018723) checked both
+feeds:
+- **Cli:** org feed `0b0ebefd…` and nuget.org `9eb3eed6…` share 257 identical entries; nuget.org adds only `.signature.p7s`.
+- **FSharpSurfaceCommand:** org feed `7cecc0a8…`, equal to the run's recorded producer hash, and nuget.org `4c9147d6…` share 38 identical entries; nuget.org adds only `.signature.p7s`.
+- Both nuspecs name `282741b1`.
+
+Both 1.15.0 tools cold-install from the nuget.org bytes into isolated tool paths. In the fdev container on Home
+(glibc 2.44, `standard` profile), `FS.GG.Governance.Cli` 1.15.0 and `FS.GG.SDD.Cli` 2.4.0, installed from nuget.org
+bytes, passed the provider-mode SDD 2.4.0 journey (FS-GG/FS.GG.SDD#928 C3.1-03 / SDD928-C2.3):
+- the fixture's `run` writes the declared `fsgg.governance-handoff@2.0.0` evidence and Verify exits 0;
+- missing, stale, mismatched and exit-2 runs exit 1;
+- provenance-digest, policy-identity, platform and unrouted-path refusals exit 3.
+
+A separate run of the same journey as `eugen` on Home is admitted on its own and is not recorded here.
+
+Registry text only. No contract version, coherence flag or package pin changes. GOV-423-C2 stays open; its remaining
+assertions live on Governance#423.
+
 ## 2026-10-23 — reconcile published Workspace.Template 0.19.3 (FS-GG/.github#4710)
 
 Reconcile `fs-gg-workspace-template` source/package **0.19.3** and `fs-gg-templates/v0.19.3` after

registry/dependencies.yml

@@ -1646,8 +1646,9 @@ coherence:
       Consumer-side verification of governance-handoff@1.0.0 (CONTRACT entry unchanged — this is a
       coherence assertion, not a contract surface bump). FS.GG.Governance.Cli was FIRST published at
       @1.1.0 to the org GitHub Packages feed (it had been 404; that publish made it resolve at
-      https://nuget.pkg.github.com/FS-GG) — the CLI feed has since ADVANCED and now serves 1.11.0 as
-      its newest (2026-07-26 interactive-performance release, Governance#306). At 1.1.0 its
+      https://nuget.pkg.github.com/FS-GG) — the CLI feed has since ADVANCED and now serves 1.15.0 as
+      its newest (2026-10-23 GOV-423-C2 provider-execution release, Governance#423; 1.11.0 was the
+      2026-07-26 interactive-performance release, Governance#306). At 1.1.0 its
       PackAsTool closure bundled
       FS.GG.Governance.Adapters.SddHandoff.dll, so a fresh
       `dotnet tool install FS.GG.Governance.Cli --version 1.1.0` yielded an `fsgg-governance` whose
@@ -1659,7 +1660,12 @@ coherence:
       Version 1.11.0 consumes governance-handoff@2.0.0 / FS.GG.Contracts 7.0.0 and independently
       recomputes interactive/render-loop p95, p99, and sustained-catch-up verdicts from bound raw
       samples; it rejects stale, cross-host, malformed, self-attested-only, and environment-overclaim
-      evidence rather than trusting a producer-authored pass flag.
+      evidence rather than trusting a producer-authored pass flag. Version 1.15.0 (tag v1.15.0 at
+      282741b1, Governance PR#472) bundles the Verify host whose explicit provider mode now runs each
+      admitted command through the GateExecution held-cwd host and accepts it only on
+      Governance-observed governance-handoff@2.x evidence (absent before launch, source-bound); a
+      required capability that is not accepted blocks. Held-cwd execution needs Linux-x64 with
+      glibc >= 2.40. Legacy `route`/`verify` behaviour is unchanged.
     note: >
       089 closed a code gap (the CLI `route` previously never read the handoff → exited 0 on a failing
       one); 1.1.0 folds the SddHandoff consumer into the route verdict, and 1.2.0 makes it PROFILE-AWARE
@@ -1673,8 +1679,8 @@ coherence:
       the SDD-owned `.fsgg/project.yml`, so the CLI never read `defaultProfile` and fell back to the Strict
       fail-safe, over-blocking every profile — see the governance-descriptor contract entry). The stage keeps
       independent SKIP probes (consumer-absent / older profile-unaware CLI) so it never green-by-omits.
-    resolved_by: "FS-GG/FS.GG.Governance#29 (route-exit wiring) + #33 (publish gate) + tag v1.1.0 (publish) + FS.GG.Governance#34 (profile-aware, 1.2.0) + FS.GG.Templates#29 (descriptor slot, closes #28/#25) + FS.GG.Governance#306 / PRs #318 and #320 + tag v1.11.0 / release run 30190043566"
-    impact: "FS.GG.Templates#25 composition stage asserts the strict/light handoff matrix; FS.GG.Governance.Cli 1.11.0 additionally enforces typed governance-handoff@2 performance intent/evidence with independent percentile and catch-up recomputation. Both feed artifacts were independently verified byte-identical after excluding only nuget.org signing."
+    resolved_by: "FS-GG/FS.GG.Governance#29 (route-exit wiring) + #33 (publish gate) + tag v1.1.0 (publish) + FS.GG.Governance#34 (profile-aware, 1.2.0) + FS.GG.Templates#29 (descriptor slot, closes #28/#25) + FS.GG.Governance#306 / PRs #318 and #320 + tag v1.11.0 / release run 30190043566 + FS.GG.Governance#423 / PR #472 + tag v1.15.0 / publish run 39928935417"
+    impact: "FS.GG.Templates#25 composition stage asserts the strict/light handoff matrix; FS.GG.Governance.Cli 1.11.0 additionally enforces typed governance-handoff@2 performance intent/evidence with independent percentile and catch-up recomputation. Both feed artifacts were independently verified byte-identical after excluding only nuget.org signing. 1.15.0: org-feed readback run 39935018723 found Cli 257/257 and FSharpSurfaceCommand 38/38 entries identical to nuget.org apart from .signature.p7s, both nuspecs at 282741b1; the installed nuget.org tool passed the provider-mode SDD 2.4.0 journey (positive 0; missing/stale/mismatched/exit-2 evidence 1; preserved refusals 3) in the fdev container on Home (glibc 2.44)."
     tracking: "https://github.com/FS-GG/FS.GG.Governance/issues/306"
   - id: governance-handoff-emitted-version
     coherent: true