From 0eac061ed4b15e1e45070918d5555985e7253265 Mon Sep 17 00:00:00 2001
From: Constantin Jais <74049135+constantin-jais@users.noreply.github.com>
Date: Fri, 9 Oct 2026 02:43:11 +0200
Subject: [PATCH] chore(pins): move governance pins to generation 7c2238d6 (M)

Generation 7c2238d6 of libre-ai/project-governance is declared in
ecosystem/fleet-pins.v1.yaml (project-governance#42). It puts 2024a488 at
the two-generation grace limit, so the reusable composition workflow, its
tooling_ref and the card's pinned dependency move together to the same sha.

The local composition guide link now resolves the served branch (HEAD)
instead of a hardcoded main.

Claude-Session: https://claude.ai/code/session_01YGo2fqxeSVRfXjQErze6hP
Signed-off-by: Constantin Jais <74049135+constantin-jais@users.noreply.github.com>
---
 .github/workflows/code-validation.yml | 4 ++--
 docs/development.md                   | 2 +-
 project.v1.yaml                       | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/code-validation.yml b/.github/workflows/code-validation.yml
index 1cd0b51..efa7417 100644
--- a/.github/workflows/code-validation.yml
+++ b/.github/workflows/code-validation.yml
@@ -10,8 +10,8 @@ permissions:
   contents: read
 jobs:
   composition:
-    uses: libre-ai/project-governance/.github/workflows/validate-composition.yml@2024a4884b314df99be457618be9c3b48a0287f7
+    uses: libre-ai/project-governance/.github/workflows/validate-composition.yml@7c2238d6185e59d446586688ca7db32e6a17d3e0
     with:
       target: collaborative-data-sync
       target_ref: ${{ github.sha }}
-      tooling_ref: 2024a4884b314df99be457618be9c3b48a0287f7
+      tooling_ref: 7c2238d6185e59d446586688ca7db32e6a17d3e0
diff --git a/docs/development.md b/docs/development.md
index 5ff1a04..8ff70a9 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -6,7 +6,7 @@
 
 The recovery origin and exact incoming file hashes are recorded in `code-recovery-provenance.json`. Original documentation is retained separately from the public project introduction. No historical deployment workflow is activated.
 
-Use the [shared local composition guide](https://github.com/libre-ai/project-governance/blob/main/docs/LOCAL-COMPOSITION.md) with target `collaborative-data-sync` and the full commit ID to verify. It prepares all pinned sibling sources before ordered installation and builds UI before consumers. Run this component’s commands from its root inside that composition. Packages retain independent names, imports and versions; no registry release is implied.
+Use the [shared local composition guide](https://github.com/libre-ai/project-governance/blob/HEAD/docs/LOCAL-COMPOSITION.md) with target `collaborative-data-sync` and the full commit ID to verify. It prepares all pinned sibling sources before ordered installation and builds UI before consumers. Run this component’s commands from its root inside that composition. Packages retain independent names, imports and versions; no registry release is implied.
 
 Use the exact Bun toolchain declared in package manifests. Rust crates additionally declare Rust 1.97.0. Review dependency manifests and scripts before installation. `bun run check` runs the available source checks; `cargo test --locked --all-features` runs each Rust crate's tests. Multi-package roots dispatch checks and tests to their packages. SQL integration tests use the testing package's PGlite fixture, not a production database. WebSocket tests require local socket permission.
 
diff --git a/project.v1.yaml b/project.v1.yaml
index 3dc3faa..22fb171 100644
--- a/project.v1.yaml
+++ b/project.v1.yaml
@@ -30,7 +30,7 @@ non_goals:
 dependencies:
   - on: libre-ai/project-governance
     why: "Current fleet doctrine and reusable verification workflows."
-    pinned: "github:libre-ai/project-governance#2024a4884b314df99be457618be9c3b48a0287f7"
+    pinned: "github:libre-ai/project-governance#7c2238d6185e59d446586688ca7db32e6a17d3e0"
 maturity: idea
 confidence: medium
 exposure: idea