diff --git a/.github/workflows/code-validation.yml b/.github/workflows/code-validation.yml
index 1cd0b51..efa7417 100644
--- a/.github/workflows/code-validation.yml
+++ b/.github/workflows/code-validation.yml
@@ -10,8 +10,8 @@ permissions:
   contents: read
 jobs:
   composition:
-    uses: libre-ai/project-governance/.github/workflows/validate-composition.yml@2024a4884b314df99be457618be9c3b48a0287f7
+    uses: libre-ai/project-governance/.github/workflows/validate-composition.yml@7c2238d6185e59d446586688ca7db32e6a17d3e0
     with:
       target: collaborative-data-sync
       target_ref: ${{ github.sha }}
-      tooling_ref: 2024a4884b314df99be457618be9c3b48a0287f7
+      tooling_ref: 7c2238d6185e59d446586688ca7db32e6a17d3e0
diff --git a/docs/development.md b/docs/development.md
index 5ff1a04..8ff70a9 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -6,7 +6,7 @@
 
 The recovery origin and exact incoming file hashes are recorded in `code-recovery-provenance.json`. Original documentation is retained separately from the public project introduction. No historical deployment workflow is activated.
 
-Use the [shared local composition guide](https://github.com/libre-ai/project-governance/blob/main/docs/LOCAL-COMPOSITION.md) with target `collaborative-data-sync` and the full commit ID to verify. It prepares all pinned sibling sources before ordered installation and builds UI before consumers. Run this component’s commands from its root inside that composition. Packages retain independent names, imports and versions; no registry release is implied.
+Use the [shared local composition guide](https://github.com/libre-ai/project-governance/blob/HEAD/docs/LOCAL-COMPOSITION.md) with target `collaborative-data-sync` and the full commit ID to verify. It prepares all pinned sibling sources before ordered installation and builds UI before consumers. Run this component’s commands from its root inside that composition. Packages retain independent names, imports and versions; no registry release is implied.
 
 Use the exact Bun toolchain declared in package manifests. Rust crates additionally declare Rust 1.97.0. Review dependency manifests and scripts before installation. `bun run check` runs the available source checks; `cargo test --locked --all-features` runs each Rust crate's tests. Multi-package roots dispatch checks and tests to their packages. SQL integration tests use the testing package's PGlite fixture, not a production database. WebSocket tests require local socket permission.
 
diff --git a/project.v1.yaml b/project.v1.yaml
index 3dc3faa..22fb171 100644
--- a/project.v1.yaml
+++ b/project.v1.yaml
@@ -30,7 +30,7 @@ non_goals:
 dependencies:
   - on: libre-ai/project-governance
     why: "Current fleet doctrine and reusable verification workflows."
-    pinned: "github:libre-ai/project-governance#2024a4884b314df99be457618be9c3b48a0287f7"
+    pinned: "github:libre-ai/project-governance#7c2238d6185e59d446586688ca7db32e6a17d3e0"
 maturity: idea
 confidence: medium
 exposure: idea