diff --git a/workspace/v1/workspace.proto b/workspace/v1/workspace.proto
index 62290f9..566b4cf 100644
--- a/workspace/v1/workspace.proto
+++ b/workspace/v1/workspace.proto
@@ -62,6 +62,30 @@ service WorkspaceController {
     rpc LsRemote(LsRemoteRequest) returns (LsRemoteResponse);
 }
 
+// --- Governance Envelope ---
+// Binds a git ref to governance metadata (actor, accord, ceremony).
+// Propagated in responses so consumers can forward to Chronicle
+// and Quartermaster without reconstructing context.
+
+message GovernanceEnvelope {
+    // Git object hash (20 bytes SHA-1, hex-encoded = 40 chars)
+    string git_ref = 1;
+    // "commit", "tree", or "blob"
+    string git_ref_type = 2;
+    // Branch or tag ref name (e.g. "refs/heads/main")
+    string git_ref_name = 3;
+    // Repository identifier (e.g. "guildhouse/substrate")
+    string repository = 4;
+    // SHA-256 of the governing accord (hex-encoded = 64 chars)
+    string accord_hash = 5;
+    // Actor DID (e.g. "did:web:guildhouse.dev:user:tking")
+    string actor_did = 6;
+    // Nanoseconds since Unix epoch
+    uint64 timestamp_ns = 7;
+    // Ceremony ID if approval was required
+    string ceremony_id = 8;
+}
+
 // --- Canonical ---
 
 message InitCanonicalRequest {
@@ -85,6 +109,8 @@ message GetCanonicalHeadResponse {
     string author = 3;
     google.protobuf.Timestamp timestamp = 4;
     uint32 total_files = 5;
+    // Governance envelope for the HEAD commit
+    GovernanceEnvelope envelope = 6;
 }
 
 // --- Session workspace lifecycle ---
@@ -187,6 +213,8 @@ message CommitResponse {
     string commit_hash = 1;
     uint32 files_committed = 2;
     string message = 3;
+    // Governance envelope for the new commit
+    GovernanceEnvelope envelope = 4;
 }
 
 message GetLogRequest {
@@ -375,6 +403,8 @@ message MergeToCanonicalResponse {
     string error = 4;
     // Number of files changed in the merge
     uint32 files_changed = 5;
+    // Governance envelope for the merge commit
+    GovernanceEnvelope envelope = 6;
 }
 
 message CleanupInboundBranchRequest {