Update repository-governance bundled extension

extensions/catalog.community.json

@@ -2890,10 +2890,10 @@
     "repository-governance": {
       "name": "Repository Governance",
       "id": "repository-governance",
-      "description": "Generate or update the active Repository Governance Framework file with vertical SSOT routing and evidence.",
+      "description": "Generate project-governance projections from Spec Kit metadata",
       "author": "bigben",
-      "version": "2.0.6",
-      "download_url": "https://github.com/bigsmartben/spec-kit-agent-governance/archive/refs/tags/v2.0.6.zip",
+      "version": "3.0.2",
+      "download_url": "https://github.com/bigsmartben/spec-kit-agent-governance/archive/refs/tags/v3.0.2.zip",
       "repository": "https://github.com/bigsmartben/spec-kit-agent-governance",
       "homepage": "https://github.com/bigsmartben/spec-kit-agent-governance",
       "documentation": "https://github.com/bigsmartben/spec-kit-agent-governance/blob/main/README.md",
@@ -2923,7 +2923,7 @@
       "downloads": 0,
       "stars": 0,
       "created_at": "2026-05-14T00:00:00Z",
-      "updated_at": "2026-06-24T00:00:00Z"
+      "updated_at": "2026-07-03T00:00:00Z"
     },
     "reqnroll-bdd": {
       "name": "Reqnroll BDD",

extensions/repository-governance/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## Unreleased
+
+### Changed
+
+- Replace abstract vertical SSOT domains with fixed directory-tree SSOT entries: `agent-runtime/`, `engineering-runtime/`, `poc/`, `source-code/`, `test-code/`, and `other-tools/`.
+- Treat matched directories and fixed directory-tree files as SSOT index source refs, including agent runtime paths, CI/CD and Docker/runtime files, source paths, test paths, and auxiliary tool configs.
+- Rename the generated fallback and agent harness wording to Directory Tree and `agent-runtime/` wording.
+- Add `poc/` as the pre-iteration exploration SSOT for technical spikes, architecture drafts, UC designs, prototypes, research notes, validation reports, and validation conclusions.
+- Require POC promotion to cite a formal design or task before `source-code/` edits, and require validation record source refs or `NEEDS_CLARIFICATION:poc-validation-record`.
+
 ## [3.0.2] - 2026-07-03
 
 ### Changed

extensions/repository-governance/README.md

@@ -14,18 +14,18 @@ Generate project-governance projections for the active Spec Kit agent platform t
 - Update existing active target project-governance projections.
 - Scan repository areas as bounded evidence for missing-SSOT fallback.
 - Capture repository facts as bounded evidence for gap handling and CLI reporting.
-- Structure generated instructions as repository-wide, path-scope, and agent-harness guidance.
+- Structure generated instructions as repository-wide, directory-tree scope, and `agent-runtime/` guidance.
 - Project agent platform adapter rules from Spec Kit integration metadata.
-- Index only explicit SSOT content entrypoints in the generated SSOT index.
-- Report repository-local skills and MCP config files as evidence candidates only unless an explicit Agent Harness SSOT source names them.
+- Index explicit fixed directory-tree SSOT entrypoints in the generated SSOT index.
+- Report repository-local skills and MCP config files as evidence candidates only unless an explicit `agent-runtime/` SSOT source names them.
 - Analyze repository areas to depth 2 only for evidence and CLI summaries.
-- Use Directory Structure fallback only when the Directory Structure SSOT is missing and task scope is explicit.
+- Use Directory Tree fallback only when no fixed directory-tree SSOT matches, or the matched tree has no source_refs and task scope is explicit.
 - Overwrite the active agent platform target on generation.
 - Do not generate Copilot `.github/instructions/*.instructions.md` companion files.
 - Generate repository evidence from the current repository state on every run.
 - Review only the active agent platform target.
 - Remove legacy managed sections only from non-active context files enumerated by `CONTEXT_FILES`.
-- Missing vertical SSOT is reported as a clarification need for governed changes; generated output must not invent repository policy from descriptive repository evidence.
+- Missing fixed directory-tree SSOT is reported as a clarification need for governed changes; generated output must not invent repository policy from descriptive repository evidence.
 - Do not project full repository fact inventories, repository area lists, skill capability lists, or development command lists into the active target.
 
 ## Install
@@ -67,36 +67,43 @@ uv run python tools/build_repository_governance_zip.py
 
 ## SSOT Index
 
-- Architecture SSOT index: status, source_refs, and gap code.
-- Engineering SSOT index: status, source_refs, and gap code.
-- Code Style SSOT index: status, source_refs, and gap code.
-- Directory Structure SSOT index: status, source_refs, and gap code.
-- Agent Harness SSOT index: status, source_refs, and gap code.
-- Repository-level and nested project evidence is scanned through explicit path families with bounded parent depth, but only explicit SSOT content entrypoints become SSOT index source_refs.
-- `extension.yml` and `.extensionignore` are Engineering SSOT refs only in this extension source repository; other projects report them as evidence.
+- `agent-runtime/` SSOT index: status, source_refs, and gap code.
+- `engineering-runtime/` SSOT index: status, source_refs, and gap code.
+- `poc/` SSOT index: status, source_refs, and gap code.
+- `source-code/` SSOT index: status, source_refs, and gap code.
+- `test-code/` SSOT index: status, source_refs, and gap code.
+- `other-tools/` SSOT index: status, source_refs, and gap code.
+- Repository-level and nested project evidence is scanned through fixed directory trees with bounded parent depth, and matched tree entrypoints become SSOT index source_refs.
+- `agent-runtime/` examples include `.codex/`, `.claude/`, `AGENTS.md`, `CLAUDE.md`, and other agent rule files.
+- `engineering-runtime/` examples include `.github/workflows/`, environment files, DevOps, CI/CD, Docker, manifests, lockfiles, permissions, password, key, and secrets surfaces.
+- `poc/` examples include technical spikes, architecture drafts, UC designs, prototypes, research notes, validation reports, and validation conclusions before formal iteration.
+- `source-code/` examples include client, server, API, route, library, script, command, and template code.
+- `test-code/` examples include test code, fixtures, prepared data, resources, reports, and test conclusions.
+- `other-tools/` examples include `.codegraph/`, editor tooling, MCP configs, and `tools/`.
 
 ## Instruction Layers
 
 - Repository-wide instructions summarize authority, active-target scope, write boundaries, validation commands, and handoff expectations.
-- SSOT index maps Architecture, Engineering, Code Style, Directory Structure, and Agent Harness categories to source_refs and gap codes.
-- SSOT routing maps task types and path families to Architecture, Engineering, Code Style, Directory Structure, and Agent Harness SSOT entries.
+- SSOT index maps `agent-runtime/`, `engineering-runtime/`, `poc/`, `source-code/`, `test-code/`, and `other-tools/` to source_refs and gap codes.
+- SSOT routing maps task types and repository paths to fixed directory-tree SSOT entries.
 - Path and task scope rules keep generated guidance deterministic without expanding the write surface.
-- Agent harness instructions cover adapter behavior, repository-local skills, MCP discovery, external tools, permissions, and failure handling.
+- `poc/` routing keeps exploration out of formal implementation: before editing `source-code/` from POC work, create or cite a formal design or task; POC conclusions need validation record source_refs under `poc/validation-reports/` or `NEEDS_CLARIFICATION:poc-validation-record`.
+- Agent runtime instructions cover adapter behavior, repository-local skills, MCP discovery, external tools, permissions, and failure handling.
 - The extension emits one active target file and does not generate platform companion instruction files.
 
 ## Evidence Discovery
 
 - Repository facts are scanned from README files, project docs, repository policy files, feature specs, source/test paths, nested manifests, and runtime/build configuration.
 - Development command sources are scanned from package scripts or Python/uv test conventions.
-- Scanned facts feed missing-SSOT handling and CLI evidence summaries; they are not projected as SSOT source_refs or full content lists into the active target unless they are explicit SSOT content entrypoints.
+- Scanned facts feed missing-SSOT handling and CLI evidence summaries; only matched fixed directory-tree entrypoints are projected as SSOT source_refs.
 
 ## Agent Adapter
 
 - Repository capability layer: source-backed repository-local skills and MCP candidates only.
 - Agent adapter layer: use explicit integration support when available; otherwise use generic fallback rules.
 - Platform projection layer: apply only rules supported by the active target file.
 
-Repository-local `SKILL.md` files are reported as evidence and read when they match the task; they are not Agent Harness SSOT source_refs unless an explicit Agent Harness SSOT source names them. MCP config files are reported as candidates and evidence only; they are not SSOT source_refs, and active servers, resources, and tools must be enumerated from the agent platform runtime before use.
+Repository-local `SKILL.md` files are reported as evidence and read when they match the task; they are not `agent-runtime/` SSOT source_refs unless an explicit `agent-runtime/` SSOT source names them. MCP config files are reported as candidates and evidence only; active servers, resources, and tools must be enumerated from the agent platform runtime before use.
 
 ## Verify
 

extensions/repository-governance/commands/speckit.repository-governance.generate.md

@@ -30,6 +30,6 @@ $ARGUMENTS
 - active agent platform target
 - generated or updated
 - review target
-- SSOT content index summary
+- fixed directory-tree SSOT index summary
 - descriptive evidence scan summary
 - unresolved risks or clarification needs