From 7c50ef9914bbf6c72f0811c66c0d87e9e36c18fb16922d8e640f097786fdf0fd Mon Sep 17 00:00:00 2001
From: Tyler J King <tking727@gmail.com>
Date: Sun, 12 Apr 2026 15:53:05 -0400
Subject: [PATCH] feat(workspace): add GovernanceEnvelope to gRPC responses

Add GovernanceEnvelope proto message and embed it in
GetCanonicalHeadResponse, CommitResponse, and
MergeToCanonicalResponse. The envelope carries the git ref,
actor DID, accord hash, and ceremony ID so consumers can
forward governance context to Chronicle and Quartermaster
without reconstructing it.

Wire-compatible: the envelope field is optional (proto3 default),
so existing consumers that don't read it are unaffected.

Signed-off-by: Tyler King <tking@guildhouse.dev>
---
 workspace/v1/workspace.proto | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/workspace/v1/workspace.proto b/workspace/v1/workspace.proto
index 62290f9..566b4cf 100644
--- a/workspace/v1/workspace.proto
+++ b/workspace/v1/workspace.proto
@@ -62,6 +62,30 @@ service WorkspaceController {
     rpc LsRemote(LsRemoteRequest) returns (LsRemoteResponse);
 }
 
+// --- Governance Envelope ---
+// Binds a git ref to governance metadata (actor, accord, ceremony).
+// Propagated in responses so consumers can forward to Chronicle
+// and Quartermaster without reconstructing context.
+
+message GovernanceEnvelope {
+    // Git object hash (20 bytes SHA-1, hex-encoded = 40 chars)
+    string git_ref = 1;
+    // "commit", "tree", or "blob"
+    string git_ref_type = 2;
+    // Branch or tag ref name (e.g. "refs/heads/main")
+    string git_ref_name = 3;
+    // Repository identifier (e.g. "guildhouse/substrate")
+    string repository = 4;
+    // SHA-256 of the governing accord (hex-encoded = 64 chars)
+    string accord_hash = 5;
+    // Actor DID (e.g. "did:web:guildhouse.dev:user:tking")
+    string actor_did = 6;
+    // Nanoseconds since Unix epoch
+    uint64 timestamp_ns = 7;
+    // Ceremony ID if approval was required
+    string ceremony_id = 8;
+}
+
 // --- Canonical ---
 
 message InitCanonicalRequest {
@@ -85,6 +109,8 @@ message GetCanonicalHeadResponse {
     string author = 3;
     google.protobuf.Timestamp timestamp = 4;
     uint32 total_files = 5;
+    // Governance envelope for the HEAD commit
+    GovernanceEnvelope envelope = 6;
 }
 
 // --- Session workspace lifecycle ---
@@ -187,6 +213,8 @@ message CommitResponse {
     string commit_hash = 1;
     uint32 files_committed = 2;
     string message = 3;
+    // Governance envelope for the new commit
+    GovernanceEnvelope envelope = 4;
 }
 
 message GetLogRequest {
@@ -375,6 +403,8 @@ message MergeToCanonicalResponse {
     string error = 4;
     // Number of files changed in the merge
     uint32 files_changed = 5;
+    // Governance envelope for the merge commit
+    GovernanceEnvelope envelope = 6;
 }
 
 message CleanupInboundBranchRequest {