eimyroot · eimyroot · Sep 6, 2026 · Sep 6, 2026 · Sep 6, 2026 · Sep 6, 2026
diff --git a/CURRENT_PRODUCT_STATE.md b/CURRENT_PRODUCT_STATE.md
@@ -57,7 +57,7 @@ RELEASED / DEPLOYED       = separately governed states
 | Restart-safe durable resume | **IMPLEMENTED / MERGED via PR #140** |
 | Runtime resume wiring | **IMPLEMENTED / MERGED via PR #140** |
 | G7 post-merge verification | **VERIFIED on `main@60bc9c268...` by CI #1015, D4 #202, E3 #193, E4B #189** |
-| GitHub G0 governance | **UNKNOWN / fresh post-rename exact-main verification required** |
+| Latest retained GitHub G0 evidence | **VERIFIED for exact `main@a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c` via run `34031128405`; current live G0 is query-only** |
 | Default provider runtime pack | **DISABLED / FAIL-CLOSED** |
 | Real canonical HTTP READ E2E using default G8 pack | **BLOCKED / NOT YET VERIFIED** |
 | Provider WRITE activation | **BLOCKED** |
@@ -68,14 +68,44 @@ RELEASED / DEPLOYED       = separately governed states
 | Deployment | **NOT PERFORMED** |
 | CyberCore | **BLOCKED pending product/release-governance hardening** |
 
-## G0 GitHub governance — current vs historical evidence
+## G0 GitHub governance — retained evidence vs live-derived truth
 
-Current canonical repository identity is `eimyroot/Voodoo-One`. No fresh post-rename G0 run is yet
-retained for the exact current `main` SHA, so current G0 state is deliberately `UNKNOWN` and the
-release-candidate governance gate remains fail-closed until fresh live evidence exists.
+Current canonical repository identity is `eimyroot/Voodoo-One`. The latest retained post-rename G0
+evidence independently verified repository identity, required-check provenance and live ruleset controls
+for exactly the SHA that it observed. This versioned document records that immutable evidence scope; it
+does not promote the repository's moving current `main` to PASS by self-reference.
 
-The following retained artifact remains valid historical evidence for the repository identity and
-source SHA that existed when it ran:
+```text
+workflow = g0-governance-verify
+run = 34031128405
+event = workflow_dispatch
+branch = main
+source_sha = a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c
+branch_head_sha = a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c
+verifier_source_sha = a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c
+required_check = verify
+required_workflow = ci
+required_workflow_path = .github/workflows/ci.yml
+artifact = g0-governance-evidence-34031128405-1
+artifact_id = 9988632821
+artifact_digest = sha256:be646405590ac07f6293eaeb94a72c77ecf8ea02c16a31b31ccf93ef4ec92a2c
+checksum_validation = PASS
+retained_verdict = VERIFIED
+verified_at = 2026-09-06T11:45:16.520493Z
+```
+
+The verifier observed PR-only main, required `verify` from GitHub Actions workflow `ci`, latest-head
+strict checks, force-push disabled, branch deletion disabled, conversation resolution, no ordinary
+admin/ruleset bypass, active rulesets and exact verifier-source binding. All required G0 checks were
+true for that exact evidence scope.
+
+Current live G0 is deliberately not stored as a mutable-looking PASS/FAIL field in Git. It is derived
+at decision time by comparing live `main` and live settings with fresh verifier evidence. Release-candidate
+construction must run G0 against its exact checked-out `${GITHUB_SHA}` rather than reuse this retained
+artifact as current authorization.
+
+The earlier retained artifact remains valid historical evidence for the repository identity and source
+SHA that existed when it ran:
 
 ```text
 workflow = g0-governance-verify
@@ -90,27 +120,18 @@ evidence_json_checksum = 11a99765485b63b70186037011d31c105dea8dd75b689e0036a8766
 historical_verdict = VERIFIED
 ```
 
-That historical evidence verified PR-only main, required `verify` from workflow `ci`, latest-head
-strict checks, force-push disabled, branch deletion disabled, conversation resolution, no ordinary
-admin/ruleset bypass, active rulesets, and verifier source binding for its exact evidence scope. It
-must not be reused as proof for the renamed current repository identity.
+Historical evidence stays historical. Neither retained run is silently promoted to proof for a later
+`main` SHA.
 
 ```text
 REPO_ENFORCEMENT_CONTRACT       = IMPLEMENTED
-GITHUB_SETTINGS_ENFORCED        = UNKNOWN
-MAIN_PR_ONLY                    = UNKNOWN_CURRENT_G0
-REQUIRED_CI                     = UNKNOWN_CURRENT_G0
-FORCE_PUSH_DISABLED             = UNKNOWN_CURRENT_G0
-BRANCH_DELETE_DISABLED          = UNKNOWN_CURRENT_G0
-CONVERSATION_RESOLUTION         = UNKNOWN_CURRENT_G0
-ORDINARY_ADMIN_BYPASS_DISABLED  = UNKNOWN_CURRENT_G0
-P0_GITHUB_GOVERNANCE            = BLOCKED_PENDING_FRESH_G0
-G0                              = UNKNOWN
+LATEST_RETAINED_G0_VERDICT      = VERIFIED
+LATEST_RETAINED_G0_SOURCE_SHA   = a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c
+CURRENT_LIVE_G0                 = DERIVED_QUERY_ONLY
+P0_GITHUB_GOVERNANCE            = QUERY_LIVE_FOR_DECISION
 ```
 
-A fresh G0 PASS on the exact post-repair `main` SHA may promote these current governance fields back to
-`VERIFIED`; documentation, CI success, or the historical artifact cannot do so by inference. G0 PASS
-does not authorize release or deployment.
+G0 evidence does not authorize provider runtime, release, deployment or production effects.
 
 ## Canonical shared authority/execution prefix
 
@@ -328,13 +349,17 @@ This historical evidence does not authorize or prove any new provider mutation.
 - Historical PR #125 technical merge/post-state is VERIFIED; separate pre-merge merge-authorization provenance remains **NOT VERIFIED** and is not rewritten.
 - ADR-0018 records the R2 terminal-profile correction instead of silently rewriting older history.
 - PR #128 reconciliation remains historical provenance; later G7 evidence does not rewrite it.
-- Historical G0 run `32553113424` remains retained evidence for its original repository identity and exact source SHA; it is not current post-rename proof.
+- Historical G0 run `32553113424` remains retained evidence for its original repository identity and exact source SHA.
+- Latest retained G0 run `34031128405` VERIFIED the renamed canonical repository at exact `main@a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c`; current live G0 remains derived/query-only.
 
 ## Current release truth
 
 ```text
 VOODOO_ALLOW_PRODUCTION_EFFECTS=false
-G0_GITHUB_GOVERNANCE=UNKNOWN
+LATEST_RETAINED_G0_VERDICT=VERIFIED
+LATEST_RETAINED_G0_SOURCE_SHA=a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c
+CURRENT_LIVE_G0=DERIVED_QUERY_ONLY
+RELEASE_CANDIDATE_G0=FRESH_EXACT_CHECKOUT_REQUIRED
 G7_CANONICAL_READ_API=MERGED
 G7_RESTART_SAFE_RESUME=MERGED
 G8_DEFAULT_READ_RUNTIME=OFF

diff --git a/README.md b/README.md
@@ -70,7 +70,7 @@ OperationProof != OperationCell
 | Canonical public READ operation API | IMPLEMENTED / MERGED via PR #137; reconciled with resume/runtime via PR #140 |
 | Read-only `/api/v1/control-room` dashboard projection | IMPLEMENTED / targeted tested |
 | Restart-safe durable READ resume | IMPLEMENTED / MERGED via PR #140 |
-| GitHub main governance enforcement | UNKNOWN / fresh post-rename G0 required; historical VERIFIED evidence retained |
+| GitHub governance evidence | latest retained G0 evidence VERIFIED for exact `main@a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c`; current live G0 is derived/query-only |
 | Default provider runtime pack | BLOCKED / disabled until G8 |
 | Real canonical HTTP READ E2E through default G8 pack | BLOCKED / not yet verified |
 | Provider WRITE activation | BLOCKED pending repeated READ E2E + restart-safe verification gate |
@@ -164,23 +164,48 @@ runtime activation.
 
 ## G0 governance evidence
 
-The repository retains historical live G0 evidence for the repository identity that was current when
-the run executed:
+The repository records immutable G0 evidence scopes, not a self-updating `current main = PASS` claim.
+The latest retained G0 evidence is:
+
+```text
+workflow = g0-governance-verify
+run = 34031128405
+source_sha = a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c
+artifact = g0-governance-evidence-34031128405-1
+artifact_id = 9988632821
+artifact_digest = sha256:be646405590ac07f6293eaeb94a72c77ecf8ea02c16a31b31ccf93ef4ec92a2c
+checksum_validation = PASS
+retained_verdict = VERIFIED
+```
+
+That run independently verified the renamed `eimyroot/Voodoo-One` repository, exact source binding,
+PR-only main, required `verify` from workflow `ci`, latest-head strict checks, force-push and deletion
+disabled, conversation resolution, active rulesets and no ordinary bypass for that exact SHA.
+
+```text
+LATEST_RETAINED_G0_VERDICT=VERIFIED
+LATEST_RETAINED_G0_SOURCE_SHA=a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c
+CURRENT_LIVE_G0=DERIVED_QUERY_ONLY
+RELEASE_CANDIDATE_G0=FRESH_EXACT_CHECKOUT_REQUIRED
+```
+
+`CURRENT_LIVE_G0` must be derived from live GitHub state at decision time. A later commit changes
+`main`, so this retained artifact cannot be reused as exact-current proof. The release-candidate
+workflow therefore performs fresh G0 verification against its exact checked-out `${GITHUB_SHA}`.
+
+The repository also retains the earlier G0 artifact for its original evidence scope:
 
 ```text
 workflow = g0-governance-verify
 run = 32553113424
 source_sha = 76d74d2ed62b6e78f027728c456c22da0b4a95bd
 artifact = g0-governance-evidence-32553113424-1
 artifact_digest = sha256:6e63caee23a57613471df66ef0279c0261ed8d375e4c929accdf50eff7dc4f5f
-verdict = VERIFIED
+historical_verdict = VERIFIED
 ```
 
-That artifact remains valid historical evidence only. The canonical repository is now
-`eimyroot/Voodoo-One`; current G0 governance is therefore `UNKNOWN` until a fresh
-`g0-governance-verify` run executes on the exact post-repair `main` SHA and independently verifies the
-current repository identity and live ruleset. Historical G0 PASS never authorizes provider runtime,
-release, or deployment.
+Historical evidence stays historical. G0 evidence never authorizes provider runtime, release or
+deployment by itself.
 
 ## READ before WRITE
 
@@ -228,7 +253,7 @@ a new provider mutation is authorized.
 - default G8 provider runtime and real product HTTP READ E2E remain blocked/unverified;
 - provider WRITE remains blocked behind READ-before-WRITE evidence and separate effect authorization;
 - no release/deployment inferred from CI, merge, Proof or Cell;
-- historical G0 VERIFIED evidence is retained, while current post-rename GitHub governance remains UNKNOWN until fresh exact-main verification.
+- latest retained G0 evidence is exact-SHA scoped; current live GitHub governance is queried/derived rather than versioned as PASS.
 
 ## Documentation
 

diff --git a/docs/governance/GITHUB_MAIN_GOVERNANCE_BASELINE_V1.md b/docs/governance/GITHUB_MAIN_GOVERNANCE_BASELINE_V1.md
@@ -1,12 +1,12 @@
 # GitHub Main Governance Baseline v1
 
-Status: PREPARED — repository-side contract repaired for `eimyroot/Voodoo-One`; fresh live G0 verification required
+Status: ACTIVE CONTRACT — latest retained exact-main G0 evidence is recorded separately from current live truth
 
 ## Purpose
 
 Define the minimum GitHub repository enforcement required before higher-impact V-One authority, Grant Issuer, Runner, release, or production-capable work may rely on GitHub as a governance boundary.
 
-This document does not claim that GitHub Settings are already enforced. Remote enforcement must be verified independently against the live repository configuration.
+This document defines the contract and records immutable evidence scopes. It does not store a self-updating claim that the moving current `main` is VERIFIED. Current live G0 is derived by querying live GitHub state at decision time.
 
 ## Canonical protected branch
 
@@ -47,7 +47,7 @@ Product/runtime rule `no requester self-approval` remains a separate V-One autho
 
 ## Required verification evidence
 
-P0 is complete only when live GitHub configuration evidence proves the desired state. Acceptable evidence must include:
+P0 is complete for a decision scope only when live GitHub configuration evidence proves the desired state on the exact SHA being evaluated. Acceptable evidence must include:
 
 ```text
 repository = eimyroot/Voodoo-One
@@ -73,7 +73,44 @@ verified_at = <timestamp>
 source = GitHub live repository settings/API
 ```
 
-A repository document, CI pass, issue, PR description or previous observation is not sufficient evidence of GitHub-side enforcement. A repository rename or transfer changes the identity being verified: a historical G0 PASS for a different repository identity remains historical evidence and is not reusable as current G0 proof.
+A repository document, CI pass, issue, PR description or previous observation is not sufficient evidence of GitHub-side enforcement. A repository rename, transfer, new commit, ruleset change or required-check change can make older evidence non-current without invalidating its historical scope.
+
+## Latest retained G0 evidence
+
+The latest retained G0 evidence is immutable evidence for exactly the SHA it observed:
+
+```text
+workflow = g0-governance-verify
+run = 34031128405
+repository = eimyroot/Voodoo-One
+branch = main
+branch_head_sha = a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c
+verifier_source_sha = a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c
+required_status_check = verify
+observed_required_workflow = ci
+observed_required_workflow_path = .github/workflows/ci.yml
+artifact = g0-governance-evidence-34031128405-1
+artifact_id = 9988632821
+artifact_digest = sha256:be646405590ac07f6293eaeb94a72c77ecf8ea02c16a31b31ccf93ef4ec92a2c
+checksum_validation = PASS
+retained_verdict = VERIFIED
+verified_at = 2026-09-06T11:45:16.520493Z
+```
+
+The evidence reported every required G0 check as true, including PR-only main, strict/latest-head
+required checks, GitHub Actions provider/workflow identity, force-push and branch deletion disabled,
+conversation resolution, complete bypass evidence with no ordinary bypass actor, active rulesets and
+exact verifier-source binding for that exact SHA.
+
+This is intentionally **not** serialized as `current main = PASS` because committing such a statement
+would change `main` and immediately make its own exact-SHA proof stale.
+
+```text
+LATEST_RETAINED_G0_VERDICT = VERIFIED
+LATEST_RETAINED_G0_SOURCE_SHA = a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c
+CURRENT_LIVE_G0 = DERIVED / QUERY_ONLY
+RELEASE_CANDIDATE_G0 = FRESH_EXACT_CHECKOUT_REQUIRED
+```
 
 ## Machine verification
 
@@ -152,7 +189,7 @@ Examples that are `BLOCKED` when evidence is otherwise complete:
 - PR-only flow, force-push blocking, deletion blocking or thread resolution is absent;
 - any bypass actor is configured.
 
-Only `VERIFIED` exits successfully. `BLOCKED` and `UNKNOWN` fail closed. A historical PASS is not reusable proof after GitHub ruleset/settings configuration changes or repository-identity changes.
+Only `VERIFIED` exits successfully. `BLOCKED` and `UNKNOWN` fail closed. A retained or historical PASS is not reusable proof for a different exact SHA or changed governance state.
 
 ## Credential boundary
 
@@ -164,7 +201,7 @@ The dedicated token exists only because GitHub may omit sensitive `bypass_actors
 
 A release-candidate workflow is not allowed to produce an RC artifact unless the exact checked-out `main` SHA first produces G0 `VERIFIED`. The resulting `g0-governance-evidence.json` is included in the RC artifact and covered by `SHA256SUMS.txt` alongside the source archive and SBOM.
 
-This gate does not itself authorize release or deployment. It only prevents release-candidate artifact construction from bypassing repository-governance evidence.
+This gate does not reuse `LATEST_RETAINED_G0_VERDICT` as current authorization. It performs fresh exact-checkout verification. The gate does not itself authorize release or deployment.
 
 ## Failure semantics
 
@@ -182,14 +219,16 @@ GITHUB_SETTINGS_ENFORCED = BLOCKED
 P0 = BLOCKED
 ```
 
-Never convert `UNKNOWN` or `BLOCKED` into `PASS` from documentation intent, CI success or branch metadata alone.
+Never convert `UNKNOWN` or `BLOCKED` into `PASS` from documentation intent, CI success, retained evidence or branch metadata alone.
 
 ## Change path
 
 Changes to this baseline use a PR and must not reduce the controls above without explicit owner authorization, documented rationale, risk analysis and replacement controls.
 
 ## Exit gate
 
+For any specific evaluated SHA, a fresh G0 `VERIFIED` result requires:
+
 ```text
 REPO_ENFORCEMENT_CONTRACT = VERIFIED
 GITHUB_SETTINGS_ENFORCED = VERIFIED
@@ -207,4 +246,4 @@ ORDINARY_ADMIN_BYPASS_DISABLED = VERIFIED
 P0_GITHUB_GOVERNANCE = PASS
 ```
 
-Until all fields are proven, authority/Runner work may be designed or prepared but must not treat GitHub enforcement as a trusted completed boundary.
+The latest retained evidence satisfies that exit gate for exact `main@a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c`. Whether a later current `main` satisfies it is a live-derived question and requires fresh exact-SHA evidence.