[cross-repo] Make generated-workspace governance bindings language-neutral

Observed behavior

The generated Governance overlay currently binds organization capabilities to dotnet build, dotnet test, dotnet fsi evidence, .slnx, .fsi, and build.fsx. FS-GG/.github#3008 requires TypeScript, JavaScript, Rust, and Go workspaces to receive the same governance semantics and GitHub/CI structure rather than a weaker language-specific bypass.

Root cause

Capability and enforcement types are substantially generic, but the shipped reference overlay is a composed F# profile. It conflates invariant capability identities with one ecosystem's commands, path map, public-surface representation, toolchain, and evidence adapter.

Acceptance

After FS-GG/.github#3009 accepts the architecture, define a language-neutral generated-workspace governance profile whose stable capability IDs cover build, test, lint, evidence, package, security, public surface, and release while provider bindings supply concrete commands, paths, tools, costs, environments, and evidence formats. Support F#/dotnet, Node/TypeScript, Node/JavaScript, Rust/Cargo, and Go bindings without weakening organization-owned block-on-ship floors. Preserve existing F# overlay compatibility, refuse a declared capability with no executable binding where one is required, keep command-free semantic obligations command-free, and project the selected bindings into the Quint WorkspaceModel and provenance using versioned contracts rather than inferred repository contents.

Verification

Schema, derivation, routing, enforcement, reference-gate-set package, and generated-product fixtures prove that identical capability semantics select the correct ecosystem commands and paths; missing, duplicate, stale, or cross-language bindings fail closed; unrelated changes route selectively; expected JUnit/SARIF/coverage/package evidence is normalized or explicitly typed; and existing F# consumers remain compatible. Publish and independently consume the exact reference-gate-set artifact before FS.GG.Templates adopts it.

Class: hardening
Severity: High
Blocked by: FS-GG/.github#3009
Backlog reason: not-yet-actionable

Paths: src/FS.GG.Governance.Config src/FS.GG.Governance.Gates src/FS.GG.Governance.Inheritance src/FS.GG.Governance.ProductSurfaces src/FS.GG.Governance.Route src/FS.GG.Governance.Scaffold reference-gates tests/FS.GG.Governance.Gates.Tests tests/FS.GG.Governance.ReferenceGateSet.Tests specs

Accepted deterministic orchestration integration — 2026-10-21

The user accepted the comprehensive framework and product workspace orchestration design and requested Coordination-board incorporation. That LEARN issue holds the complete design, source findings, replacement contracts, delivery sequence and integrated acceptance.

Governance integration: provide authoritative semantic capability and acceptance obligations to WorkspaceExecutionContract and the independent deterministic feasibility/acceptance checks for both framework and product work. Agent assessment or learned routing cannot grant authority, remove required evidence or choose a different lifecycle. Maintain command-free semantic floors and actual command/tool/evidence bindings. Coordinate the selected breaking contract with SDD and Coordination; existing promised language-neutral product outcomes remain required.

Source incorporation: the existing accountable owner includes this requirement when preparing the relevant next contract/roadmap delivery and captures its durable ADR/Atlas references. No new implementation owner, worker dispatch, runtime activation, publication, issue closure, project-field change or reservation release is made by this issue amendment. Existing original evidence, operations and remaining acceptance are preserved.

fdev: publication request for Governance 1.15.0. This covers the source half of the GOV-423-C2 execution join. Nothing has been published, and no tag exists. The publication effect is a separate admission and is yours to grant.

Source (accepted)

PR: Connect provider-mode Verify to GateExecution and evidence acceptance; prepare 1.15.0 (Refs #423) #472, merged at 282741b1ed9ec555abbde8c7ad8ce472c70786cf.
Head checks: the merge tree is identical to the reviewed head b49bd2ce, and all 15 required and advisory checks passed on that head.
Review: an independent fsgg-critic-best (opus) review accepted b49bd2ce, after one REQUEST_CHANGES round on 2f7d2558; the relay is in the PR comments.
What changed: provider-mode fsgg-governance verify now runs admitted commands through the GateExecution held-cwd host and accepts or refuses fsgg.governance-handoff@2.x evidence that Governance observes itself. Previously it always exited 1 after planning.
Release notes: docs/reports/2026-10-23-governance-1.15.0-release-preparation.md.

Requested publication

Package	Version	Note
`FS.GG.Governance.Cli` (tool `fsgg-governance`)	1.15.0	carries the bundled Verify host with the execution join
`FS.GG.Governance.FSharpSurfaceCommand`	1.15.0	lockstep with the CLI
CodeChecks 1.0.1, ReferenceGateSet 1.8.0, Kernel/Adapters.Spi 0.1.1	unchanged	skipped as duplicates by an `all` run
Config 0.3.0	unchanged	not selected by `all`

Route and expected run

Route: push the v1.15.0 tag at 282741b1. This is the maintained v* route used for 1.13.0 and 1.14.0.
Expected run: publish.yml push, scope=all, packing from the CLI <Version> 1.15.0. The 1.14.0 equivalent was run 39829604024.
Before the push:
- Observe on both feeds that FS.GG.Governance.Cli 1.15.0 and FS.GG.Governance.FSharpSurfaceCommand 1.15.0 are absent.
- Enumerate the remote tags and confirm v1.15.0 is absent.

Acceptance after publication (not done by a green run)

Both feeds. Read back from nuget.org and GitHub Packages, and byte-compare the packages across the two feeds.
Cold install. Install the tool from the feed into an isolated tool path, then run fsgg-governance verify in legacy mode and in provider mode.
SDD#928 C3.1-03 / SDD928-C2.3 re-run. This belongs to the SDD owner. Run it against the published tool with a fixture whose run writes the declared fsgg.governance-handoff@2.0.0 evidence, plus missing, stale and mismatched variants. The workspace still needs its own Governance .fsgg catalog; this is a documented requirement, see the plan. The runner must be Linux-x64 with glibc 2.40 or later. With an older glibc, held-cwd preparation refuses and every provider run blocks.

GOV-423-C2 stays unchecked. Still open after publication:

the installed SDD journey re-run above;
the physical blocked-read and uncertain-close cases;
whole-worker teardown with a named supplier;
stronger execution profiles;
C3 and C4.

Plan section: docs/roadmaps/governance-423-neutral-capability-bindings.md § "GOV423-C2 provider execution and evidence acceptance join (2026-10-23)", at 282741b1.

fdev: the Atlas capture for the GOV-423-C2 execution join is delivered in FS-GG/.github#4830 (merge eefb7fe2). It records three findings: governance/neutral-binding-producer-caller-frontier (the new version supersedes 9cf90b3a; 1.14.0 stops after planning, and source 282741b1 connects execution and evidence acceptance), governance/provider-verify-sdd-codec-skew, and governance/provider-verify-workspace-catalog. The publication request above is unchanged, and GOV-423-C2 stays open.

fdev 2026-10-23: GO-WITH-CONDITIONS; the tag is pushed. Annotated v1.15.0 → 282741b1 (read back as main). Publish run 39928935417.

Independent GO review:

Only Cli and FSharpSurfaceCommand change, both to 1.15.0.
1.15.0 is absent on nuget.org.
The required checks are green.
publish.yml is unchanged since the successful 1.14.0 run.
The glibc ≥ 2.40 requirement isn't a regression: provider-mode verify couldn't pass before, and legacy verify is unaffected.

Conditions in force:

No blind re-run of a partially failed job. It would re-pack, giving different bytes. Recover by pushing the org-feed bytes to nuget.org.
Watch the lockstep. FSharpSurfaceCommand can publish even if the CLI gate fails.
Tag only; no GitHub Release created by hand.
Acceptance after publish: a cold install from both feeds, byte comparison (signature excepted), the SDD#928 C3.1-03 re-run (on a glibc ≥ 2.40 host: Home, not Ubuntu 24.04 hosted), and the registry reconcile.

fdev 2026-10-23: Governance 1.15.0 post-publication acceptance, against the conditions in comment 6361365085.

Publication.

Annotated tag v1.15.0 → 282741b1ed9ec555abbde8c7ad8ce472c70786cf.
Publish run 39928935417 succeeded:
- Cli and FSharpSurfaceCommand were packed once and pushed to the org feed, then to nuget.org;
- CodeChecks, ReferenceGateSet, Kernel and Spi were skipped as duplicates; Config was not selected.
No job was re-run (condition 1).
Lockstep held: both tools are at 1.15.0 and the CLI gate passed (condition 2).
No GitHub Release was created by hand (condition 3).

Byte comparison, both feeds (condition 4).

My PAT cannot read GitHub Packages, so I used a read-only workflow that runs on its own token: PR Add read-only feed-readback workflow for published Governance tool versions (Refs #423) #473, reviewed independently, merged at bac0b7f0.
That workflow was dispatched once as run 39935018723, with contents and packages read only.

Package	org feed SHA-256	nuget.org SHA-256	Entries compared	Result
FS.GG.Governance.Cli 1.15.0	`0b0ebefd7224b70c39388512d8cc5288797213b10b7ebc418bf38823a58a1a33`	`9eb3eed64cacdd84ba3d82439d8e3b6ffb3c9e035c6e5de00a1520094227879b`	257/257	identical apart from nuget.org's `.signature.p7s`
FS.GG.Governance.FSharpSurfaceCommand 1.15.0	`7cecc0a89c13e89eb0de364e19e70a2c35cedaad872793a8310290c713a5378e`	`4c9147d66ac9410f7e95d25118243a40359462c2cd181489a991c1d66b5a28c5`	38/38	identical apart from nuget.org's `.signature.p7s`

The FSharpSurfaceCommand org hash equals the producer hash recorded in the publish run.
The publish run uploaded no Cli artifact; for the Cli, the org-feed bytes are the run's pushed bytes.
Both nuspecs name repository commit 282741b1.
No entry differs, is duplicated, or is missing on either side.

Cold install.

Both tools installed from the nuget.org bytes into isolated --tool-path and HOME/DOTNET_CLI_HOME/NUGET_PACKAGES, with a local-folder-only NuGet config:
- fsgg-governance verify outside a repository exits 3 (legacy);
- provider mode with admitted ends reaches capture;
- fsgg-fsharp-surface answers with its usage.
I did not install from the org feed: this credential cannot reach it. The org archives are entry-identical to the installed ones, so they would install the same files.

SDD#928 C3.1-03 / SDD928-C2.3 installed journey (condition 4).

Where: in the fdev container on Home, home-fdev-1 (glibc 2.44, SDK 10.0.401, runtime 10.0.12). This is the local profile.
Inputs:
- SDD.Cli 2.4.0 (1df2e74f…) and Governance.Cli 1.15.0 (9eb3eed6…), cold-installed from nuget.org bytes;
- the SDD sample at 46ca7ff7, built package-only against nuget.org;
- the maintained SDD driver, run with --case positive (passed; source identity stable);
- an independently authored Governance .fsgg catalog;
- a fixture whose run writes the declared fsgg.governance-handoff@2.0.0 evidence.

Case	Expected	Exit	Diagnostic
positive	0	0	gate `test:test` executed with exit 0 and accepted; verify.json `pass`
missing evidence	1	1	"evidence 'fixture-handoff' was not produced by the run"
stale evidence	1	1	never launched; the stale file is left untouched
mismatched evidence	1	1	"sources do not match the workspace … cited source digest does not match"
fixture exit 2	1	1	"exited 2"
provenance digest	3	3	`RawDigestMismatch "provenance"`
policy identity	3	3	"Provenance admission differs from the independently selected policy"
platform `linux-arm64`	3	3	`UnsupportedPlatform`
unrouted `--paths AGENTS.md`	3	3	names the workspace `.fsgg` catalog

Separate run on Home: the same script is with you for admission on Home as eugen. It is gov423-c2-installed-journey.sh, sha256 6281b65397e799e9950a151fb3865a79f36851847ec9b0ed9dc2c10df8a8c2b8; no root, isolated homes and tool path, nuget.org bytes only. That run is the one the SDD owner can cite for C3.1-03 and C2.3.

Registry reconcile.

PR Record published Governance CLI 1.15.0 in the registry (Refs FS-GG/FS.GG.Governance#423) .github#4837 is open and under independent review.
It is held behind the current .github merge hold and will merge only after the hold is released.

Still open on GOV-423-C2:

the Home (eugen) journey run and its citation by the SDD owner;
the merge of the registry PR;
the physical blocked-read and uncertain-close cases;
whole-worker teardown with a named supplier;
stronger profiles;
C3 and C4.

C2 stays unchecked.

fdev 2026-10-23: GOV-423-C2: installed journey on Home, verified. The published Governance 1.15.0 provider mode executes the plan and accepts evidence on a glibc ≥ 2.40 host.

What ran

Script: gov423-c2-installed-journey.sh, sha256 caa49283…8565, independently reviewed and admitted.
Account: eugen on Home (Main), without root.
Host: glibc 2.44, kernel 7.2.11-arch1-1.
.NET: the pinned SDK 10.0.401 was downloaded into the work dir (Home's system SDK is 10.0.113), runtime 10.0.12.
Packages, installed from nuget.org: FS.GG.Governance.Cli 1.15.0 and FS.GG.SDD.Cli 2.4.0.
Coordinator report: [cross-repo] V3-ENV-01: name the host provisioner and independent cleanup owner .github#4516 (comment)

Evidence I checked myself

MANIFEST.sha256 is 47833cbf…, and all 9 files in it verify.
summary.json is 0d46aff8…. The copy inside results.tar (a2b54fa7…) is byte-identical.
The case names and expected exits match the script.
In the positive case, verify.json is pass: gate test:test was executed with exit 0 and passed under the standard profile.
The SDD driver's positive acceptance reports passed, sourceIdentityStable and productEnvironmentQualified as true.
The scaffold's schema-2 provenance is ccee2c67….

Case	Expected	Exit	Diagnostic
positive (the fixture's `run` writes `fsgg.governance-handoff@2.0.0`)	0	0	accepted
missing evidence	1	1	evidence 'fixture-handoff' was not produced by the run
stale evidence	1	1	not launched; the stale output is left as it was
mismatched evidence	1	1	sources do not match the workspace
fixture exit 2	1	1	exited 2
provenance digest	3	3	`RawDigestMismatch "provenance"`
policy identity	3	3	provenance admission differs from the independently selected policy
platform `linux-arm64`	3	3	`UnsupportedPlatform`
unrouted `--paths AGENTS.md`	3	3	empty selection; names the workspace `.fsgg` catalog

Correction to 6362372586: that comment called the fdev-container run "the local profile", which was wrong. Both runs used the standard enforcement profile, as enforcement.profile in verify.json shows. "Local" was only the cooperative execution setting: environment class local, with descendants neither contained nor observed.

GOV-423-C2: what is now met.

The provider route resolves the whole declaration before invocation.
A real executable runs through GateExecution with literal argv, the declared cwd and the declared timeout.
Missing, stale or mismatched evidence and a non-zero exit are refused. Required capabilities block.
The existing refusals are preserved.
This holds for the published 1.15.0, on Home.

What remains on #423, and who owns it. C2 stays unchecked until the physical items close.

Registry record: Record published Governance CLI 1.15.0 in the registry (Refs FS-GG/FS.GG.Governance#423) .github#4837 is accepted and waits for the .github hold to be released (me, after release).
Physical capture cases: the 20 physical blocked-read and uncertain-close cases, plus whole-worker teardown with a named supplier (prerequisites (b) and (c), carrier owner).
Stronger execution profiles: the current profile is cooperative, Linux-x64 only, and needs glibc ≥ 2.40.
requiredPaths coverage: of evidence sources[].
C3 and C4.

fdev: registry reconcile delivered. FS-GG/.github#4837 is merged at d3795ad9, and its tree is identical to the reviewed and rebased head 47f93ed0. The 1.15.0 record now appears in registry/dependencies.yml, registry/CHANGELOG.md and docs/registry/compatibility.md. Every acceptance condition from the 1.15.0 GO comment is now met. GOV-423-C2 stays unchecked: the physical blocked-read and uncertain-close cases, whole-worker teardown with a named supplier, and stronger profiles remain, along with C3 and C4.

fdev (SDD owner role), 2026-10-24: request for Governance review of the SDD-side Verify capture-lifetime join. No Governance change is proposed or required.

Per Programme/root's decision on SDD#928, FS.GG.SDD owns the join and Governance reviews the GateExecution contract use. SDD PR FS-GG/FS.GG.SDD#1132 (Delivery SDD#1131) makes the maintained runner the outer admitted runtime for one fsgg-governance verify provider invocation:

it alone supplies FSGG_VERIFY_WORK_SECONDS and FSGG_VERIFY_CLEANUP_SECONDS (whole seconds from host start; cleanup absolute and not before work), and refuses a declaration unless startup allowance + cleanup end fits inside its own work window, so it never signals a host inside the capture window;
it ends the whole pid-namespace worker after the host exits (or at its own work end if the host stays resident) and witnesses that detached descendants are gone;
it classifies host-exited-after-settlement as the only settlement; exit 4 with the host's retained report, and a worker ended by the outer runtime, are non-passing.

Evidence against published Governance 1.15.0 and SDD 2.5.1 (27/27, 12 Verify cases incl. evidence refusals, a declared deadline and a detached TERM-ignoring descendant) is in the PR. Not exercised and still yours (#423 prerequisite b): an authentic blocked regular-file read and an independently observed uncertain close; the resident-host branch is tested with a stand-in host only. Please say on the PR or here if the host-timing assumptions above (ends measured from host start, absolute cleanup end, exit mapping) differ from your contract.

Navigation Menu

Repository navigation

[cross-repo] Make generated-workspace governance bindings language-neutral #423

Observed behavior

Root cause

Acceptance

Verification

Accepted deterministic orchestration integration — 2026-10-21

Source (accepted)

Requested publication

Route and expected run

Acceptance after publication (not done by a green run)

GOV-423-C2 stays unchecked. Still open after publication:

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[cross-repo] Make generated-workspace governance bindings language-neutral #423

Description

Observed behavior

Root cause

Acceptance

Verification

Accepted deterministic orchestration integration — 2026-10-21

Activity

EHotwagner commented on Oct 23, 2026

Source (accepted)

Requested publication

Route and expected run

Acceptance after publication (not done by a green run)

GOV-423-C2 stays unchecked. Still open after publication:

EHotwagner commented on Oct 23, 2026

EHotwagner commented on Oct 23, 2026

EHotwagner commented on Oct 23, 2026

EHotwagner commented on Oct 23, 2026

EHotwagner commented on Oct 23, 2026

EHotwagner commented on Oct 24, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions