diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 35b09ac..b103761 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,9 +28,9 @@ jobs:
     permissions:
       contents: read
       pull-requests: read
-    uses: wellmanifest/new-project/.github/workflows/governance.yml@85631ea24d127f1f4797d2a67f3524a63cbbc95a
+    uses: wellmanifest/new-project/.github/workflows/governance.yml@a22eb47ca0e7c06ac927d1c0d843eabb798bfadd
     with:
-      standard-ref: 85631ea24d127f1f4797d2a67f3524a63cbbc95a
+      standard-ref: a22eb47ca0e7c06ac927d1c0d843eabb798bfadd
       trusted-reviewers: ${{ vars.TRUSTED_REVIEWERS }}
       trusted-validator-apps: ${{ vars.TRUSTED_VALIDATOR_APPS }}
 
diff --git a/.governance/governance_check.py b/.governance/governance_check.py
index 6bf369c..256382e 100644
--- a/.governance/governance_check.py
+++ b/.governance/governance_check.py
@@ -913,6 +913,29 @@ def check_managed_file(root: Path, raw_path: str, expected: str, report: Report)
         )
 
 
+def extension_error(required: Any, candidate: Any, path: str = "$") -> str | None:
+    if isinstance(required, dict):
+        if not isinstance(candidate, dict):
+            return f"{path} must remain an object"
+        for key, value in required.items():
+            if key not in candidate:
+                return f"{path}/{key} is required by the managed base"
+            error = extension_error(value, candidate[key], f"{path}/{key}")
+            if error:
+                return error
+        return None
+    if isinstance(required, list):
+        if not isinstance(candidate, list):
+            return f"{path} must remain an array"
+        for value in required:
+            if value not in candidate:
+                return f"{path} removed a value required by the managed base"
+        return None
+    if candidate != required:
+        return f"{path} differs from the managed base"
+    return None
+
+
 def check_lock(
     root: Path,
     lock_path: Path | None,
@@ -935,6 +958,40 @@ def check_lock(
         return
     for raw_path, expected in sorted(managed.items()):
         check_managed_file(root, raw_path, expected, report)
+    package_path = root / ".governance/package-manifest.json"
+    if not package_path.is_file():
+        return
+    try:
+        strategies = package_strategies(package_path.read_bytes())
+    except (OSError, ValueError, json.JSONDecodeError) as error:
+        report.add(
+            "GOV-SYNC-001", f"Governance package manifest is invalid: {error}",
+            "Restore the pinned package manifest through an explicit standard upgrade.",
+            [rel(root, package_path)],
+        )
+        return
+    manifest_target = ".governance/manifest.json"
+    base_target = ".governance/manifest.base.json"
+    if strategies.get(manifest_target) != "extendable":
+        return
+    if strategies.get(base_target) != "managed" or base_target not in managed:
+        report.add(
+            "GOV-SYNC-001", "Extendable governance manifest has no hash-bound managed base.",
+            "Adopt the complete published package including manifest.base.json.",
+            [base_target, manifest_target],
+        )
+        return
+    try:
+        base = load_json(safe_repo_path(root, base_target))
+        error = extension_error(base, manifest)
+    except (OSError, ValueError, json.JSONDecodeError) as load_error:
+        error = f"managed manifest base is invalid: {load_error}"
+    if error:
+        report.add(
+            "GOV-SYNC-001", f"Target governance manifest violates its managed base: {error}",
+            "Restore standard-owned values; keep target changes inside the declared extension fields.",
+            [base_target, manifest_target],
+        )
 
 
 def parse_ticket_state(readme: Path) -> tuple[str | None, str | None]:
@@ -2248,10 +2305,16 @@ def package_entry(item: Any) -> tuple[str, str, str]:
         raise ValueError("package manifest entry is invalid")
     if not relative_pattern(source) or not relative_pattern(target):
         raise ValueError("package manifest entry is invalid")
-    if item.get("strategy") not in {"managed", "seed"}:
+    if item.get("strategy") not in {"managed", "seed", "extendable"}:
         raise ValueError("package manifest entry is invalid")
     if not isinstance(item.get("executable"), bool):
         raise ValueError("package manifest entry is invalid")
+    if item.get("strategy") == "extendable" and (
+        source != "governance/manifest.default.json"
+        or target != ".governance/manifest.json"
+        or item.get("executable")
+    ):
+        raise ValueError("package manifest extendable target is invalid")
     return source, target, item["strategy"]
 
 
@@ -2262,12 +2325,10 @@ def package_strategies(content: bytes) -> dict[str, str]:
     if document.get("schema") != "new-project.package-manifest/v1" or not isinstance(document.get("files"), list):
         raise ValueError("package manifest schema is invalid")
     strategies: dict[str, str] = {}
-    sources: set[str] = set()
     for item in document["files"]:
         source, target, strategy = package_entry(item)
-        if source in sources or target in strategies:
-            raise ValueError("package manifest paths must be unique")
-        sources.add(source)
+        if target in strategies:
+            raise ValueError("package manifest targets must be unique")
         strategies[target] = strategy
     if not strategies:
         raise ValueError("package manifest is empty")
@@ -2341,7 +2402,11 @@ def load_standard_adoption_evidence(
     head_strategies = package_strategies(head_package_path.read_bytes())
     base_hashes = adoption_lock(base_lock_content, adoption["fromRevision"])
     head_hashes = adoption_lock(head_lock_path.read_bytes(), adoption["toRevision"])
-    if set(base_hashes) != set(base_strategies) or set(head_hashes) != set(head_strategies):
+    base_managed = {path for path, strategy in base_strategies.items() if strategy == "managed"}
+    head_managed = {path for path, strategy in head_strategies.items() if strategy == "managed"}
+    if frozenset(base_hashes) not in {frozenset(base_strategies), frozenset(base_managed)}:
+        raise ValueError("base package targets and lock targets differ")
+    if set(head_hashes) != head_managed:
         raise ValueError("package targets and lock targets differ")
     return base_strategies, head_strategies, base_hashes, head_hashes
 
diff --git a/.governance/manifest.base.json b/.governance/manifest.base.json
new file mode 100644
index 0000000..647b9b6
--- /dev/null
+++ b/.governance/manifest.base.json
@@ -0,0 +1,117 @@
+{
+  "approvalEvidence": {
+    "requiredBindings": [
+      "repository",
+      "pullRequest",
+      "headSha",
+      "ticket",
+      "actor"
+    ],
+    "reviewVerificationMethod": "github-api-allowlist",
+    "schema": "new-project.approval-evidence/v1",
+    "signedAttestationPredicateType": "https://wellmanifest.dev/attestations/validator/v1"
+  },
+  "coordination": {
+    "integration": {
+      "workstream": "integration"
+    },
+    "maxActiveTicketsPerWorkstream": 1,
+    "mode": "workstreams",
+    "rejectActiveScopeOverlap": true
+  },
+  "delivery": {
+    "allowedComplexityClasses": [
+      "XS",
+      "S"
+    ],
+    "checkpointMinutes": 25,
+    "dependencyManifestPaths": [
+      "package.json",
+      "pyproject.toml",
+      "go.mod",
+      "Cargo.toml",
+      "pom.xml"
+    ],
+    "maxActiveMinutes": 30,
+    "maxAffectedComponents": 2,
+    "maxImplementationFiles": 5,
+    "maxPublicInterfaceChanges": 0,
+    "maxRuntimeDependencies": 0,
+    "targetBranches": [
+      "main"
+    ]
+  },
+  "docker": {
+    "composeFiles": [
+      "compose.yml",
+      "docker-compose.yml",
+      "compose.e2e.yml"
+    ],
+    "dockerfiles": [
+      "Dockerfile",
+      "Dockerfile.e2e"
+    ],
+    "required": true
+  },
+  "governancePaths": [
+    "TODO.md",
+    "project/TICKETS.md",
+    "project/ticket-*/**"
+  ],
+  "requiredFiles": [
+    "README.md",
+    "VERSION",
+    "CHANGELOG.md",
+    "TODO.md",
+    "AGENTS.md",
+    "Dockerfile",
+    "project/TICKETS.md",
+    "project/new-ticket.sh",
+    "project/readme.sh"
+  ],
+  "schema": "new-project.governance/v2",
+  "stacks": [
+    "docker"
+  ],
+  "standard": {
+    "id": "wellmanifest/new-project",
+    "version": "0.14.0"
+  },
+  "ticket": {
+    "activeStatuses": [
+      "IN_PROGRESS"
+    ],
+    "closedStatuses": [
+      "DONE",
+      "CANCELLED"
+    ],
+    "directoryPattern": "^ticket-[0-9]{3}$",
+    "implementationStates": [
+      "EDIT",
+      "VALIDATION",
+      "PUBLICATION"
+    ],
+    "intentFile": "intent.json",
+    "nonActiveStatuses": [
+      "BACKLOG",
+      "PLAN",
+      "BLOCKED"
+    ],
+    "requiredAgentFiles": [
+      "ai-*.md",
+      "ai-*-logs.txt"
+    ],
+    "requiredFiles": [
+      "README.md",
+      "preprompt.md",
+      "changelog.md",
+      "intent.json"
+    ],
+    "root": "project"
+  },
+  "trustedApprovalSources": [
+    "github-review",
+    "github-app-review",
+    "signed-attestation"
+  ]
+}
diff --git a/.governance/manifest.json b/.governance/manifest.json
index fa0e2cb..11d90b5 100644
--- a/.governance/manifest.json
+++ b/.governance/manifest.json
@@ -1,66 +1,6 @@
 {
   "$schema": "manifest.schema.json",
-  "schema": "new-project.governance/v2",
-  "standard": {
-    "id": "wellmanifest/new-project",
-    "version": "0.13.2"
-  },
-  "requiredFiles": [
-    "README.md",
-    "VERSION",
-    "CHANGELOG.md",
-    "TODO.md",
-    "AGENTS.md",
-    "Dockerfile",
-    "project/TICKETS.md",
-    "project/new-ticket.sh",
-    "project/readme.sh",
-    "project/governance-check.sh"
-  ],
-  "governancePaths": [
-    "TODO.md",
-    "project/TICKETS.md",
-    "project/ticket-*/**"
-  ],
-  "trustedApprovalSources": [
-    "github-review",
-    "github-app-review",
-    "signed-attestation"
-  ],
-  "ticket": {
-    "root": "project",
-    "directoryPattern": "^ticket-[0-9]{3}$",
-    "requiredFiles": [
-      "README.md",
-      "preprompt.md",
-      "changelog.md",
-      "intent.json"
-    ],
-    "requiredAgentFiles": [
-      "ai-*.md",
-      "ai-*-logs.txt"
-    ],
-    "activeStatuses": [
-      "IN_PROGRESS"
-    ],
-    "nonActiveStatuses": [
-      "BACKLOG",
-      "PLAN",
-      "BLOCKED"
-    ],
-    "closedStatuses": [
-      "DONE",
-      "CANCELLED"
-    ],
-    "implementationStates": [
-      "EDIT",
-      "VALIDATION",
-      "PUBLICATION"
-    ],
-    "intentFile": "intent.json"
-  },
   "approvalEvidence": {
-    "schema": "new-project.approval-evidence/v1",
     "requiredBindings": [
       "repository",
       "pullRequest",
@@ -69,60 +9,266 @@
       "actor"
     ],
     "reviewVerificationMethod": "github-api-allowlist",
+    "schema": "new-project.approval-evidence/v1",
     "signedAttestationPredicateType": "https://wellmanifest.dev/attestations/validator/v1"
   },
-  "docker": {
-    "required": true,
-    "dockerfiles": ["Dockerfile", "Dockerfile.e2e"],
-    "composeFiles": ["docker-compose.yml", "compose.yml", "compose.e2e.yml"]
-  },
   "coordination": {
-    "mode": "workstreams",
+    "integration": {
+      "requiredForPaths": [
+        "package.json",
+        "package-lock.json",
+        "pyproject.toml",
+        "goal.yaml",
+        "Makefile",
+        "sdk/python/pyproject.toml",
+        "sdk/python/README.md",
+        "tsconfig.json",
+        "src/core/types.ts"
+      ],
+      "workstream": "integration"
+    },
     "maxActiveTicketsPerWorkstream": 1,
+    "mode": "workstreams",
     "rejectActiveScopeOverlap": true,
     "workstreams": {
       "core-dsl": {
-        "ownedPaths": ["src/core/**", "src/graph/**", "src/semantic/**", "src/comparison/**", "src/evaluation/**", "test/graph*", "test/schema*", "test/structured*", "test/linker*", "test/proposal*", "test/gold*", "test/semantic*", "test/workspace*", "test/target*"]
+        "ownedPaths": [
+          "src/core/**",
+          "src/graph/**",
+          "src/semantic/**",
+          "src/comparison/**",
+          "src/evaluation/**",
+          "test/graph*",
+          "test/schema*",
+          "test/structured*",
+          "test/linker*",
+          "test/proposal*",
+          "test/gold*",
+          "test/semantic*",
+          "test/workspace*",
+          "test/target*"
+        ]
       },
       "extractors": {
-        "ownedPaths": ["src/extractors/**", "src/diff/**", "test/ast*", "test/diff*", "test/docs*", "test/markdown*", "test/configuration*", "test/ignore*", "test/extraction-cache*", "test/generated*"]
+        "ownedPaths": [
+          "src/extractors/**",
+          "src/diff/**",
+          "test/ast*",
+          "test/diff*",
+          "test/docs*",
+          "test/markdown*",
+          "test/configuration*",
+          "test/ignore*",
+          "test/extraction-cache*",
+          "test/generated*"
+        ]
       },
-      "llm": {
-        "ownedPaths": ["src/llm/**", "src/live/**", "src/synthesis/**", "src/summary/**", "test/*llm*", "test/openrouter*", "test/task-synthesis*", "test/live-*", "test/grounded-contracts*"]
+      "governance": {
+        "ownedPaths": [
+          ".governance/**",
+          ".github/workflows/**",
+          "AGENTS.md",
+          "Makefile",
+          "README.md",
+          "TODO.md",
+          "CHANGELOG.md",
+          ".env.example",
+          "project.sh",
+          "project.bat",
+          "project/governance-check.*",
+          "project/new-ticket.sh",
+          "project/readme.sh",
+          "project/TICKETS.md",
+          "project/ticket-*/**"
+        ]
       },
-      "runtime": {
-        "ownedPaths": ["src/pipeline/**", "src/operations/**", "src/services/**", "src/config/**", "src/watch/**", "src/tf/**", "test/pipeline*", "test/runtime*", "test/watch*", "test/operation*", "test/io*", "test/config*", "test/tensorflow*", "test/security*", "test/git*", "test/code-change*"]
+      "integration": {
+        "ownedPaths": [
+          "package.json",
+          "package-lock.json",
+          "pyproject.toml",
+          "goal.yaml",
+          "Makefile",
+          "sdk/python/pyproject.toml",
+          "sdk/python/README.md",
+          "tsconfig.json",
+          "Dockerfile*",
+          "compose*.yml",
+          "scripts/**",
+          "examples/**",
+          "docs/**",
+          "project/*.export",
+          "project/*.html",
+          "project/*.md",
+          "project/*.mmd",
+          "project/*.png",
+          "project/*.toon",
+          "project/*.txt",
+          "project/*.yaml",
+          "project/*.yml",
+          "test/fixtures/**",
+          "test/workflow-validation.test.ts",
+          "src/core/types.ts"
+        ]
       },
       "interfaces": {
-        "ownedPaths": ["src/interfaces/**", "src/communication/**", "src/web/**", "src/cli.ts", "test/cli*", "test/mcp*", "test/a2a*", "test/communication*"]
+        "ownedPaths": [
+          "src/interfaces/**",
+          "src/communication/**",
+          "src/web/**",
+          "src/cli.ts",
+          "test/cli*",
+          "test/mcp*",
+          "test/a2a*",
+          "test/communication*"
+        ]
       },
-      "sdk": {
-        "ownedPaths": ["src/sdk/**", "sdk/**", "examples/sdk/**", "test/sdk*"]
+      "llm": {
+        "ownedPaths": [
+          "src/llm/**",
+          "src/live/**",
+          "src/synthesis/**",
+          "src/summary/**",
+          "test/*llm*",
+          "test/openrouter*",
+          "test/task-synthesis*",
+          "test/live-*",
+          "test/grounded-contracts*"
+        ]
       },
-      "governance": {
-        "ownedPaths": [".governance/**", ".github/workflows/**", "AGENTS.md", "Makefile", "README.md", "TODO.md", "CHANGELOG.md", ".env.example", "project.sh", "project.bat", "project/governance-check.*", "project/new-ticket.sh", "project/readme.sh", "project/TICKETS.md", "project/ticket-*/**"]
+      "runtime": {
+        "ownedPaths": [
+          "src/pipeline/**",
+          "src/operations/**",
+          "src/services/**",
+          "src/config/**",
+          "src/watch/**",
+          "src/tf/**",
+          "test/pipeline*",
+          "test/runtime*",
+          "test/watch*",
+          "test/operation*",
+          "test/io*",
+          "test/config*",
+          "test/tensorflow*",
+          "test/security*",
+          "test/git*",
+          "test/code-change*"
+        ]
       },
-      "integration": {
-        "ownedPaths": ["package.json", "package-lock.json", "pyproject.toml", "goal.yaml", "Makefile", "sdk/python/pyproject.toml", "sdk/python/README.md", "tsconfig.json", "Dockerfile*", "compose*.yml", "scripts/**", "examples/**", "docs/**", "project/*.export", "project/*.html", "project/*.md", "project/*.mmd", "project/*.png", "project/*.toon", "project/*.txt", "project/*.yaml", "project/*.yml", "test/fixtures/**", "test/workflow-validation.test.ts", "src/core/types.ts"]
+      "sdk": {
+        "ownedPaths": [
+          "src/sdk/**",
+          "sdk/**",
+          "examples/sdk/**",
+          "test/sdk*",
+          "test/python-runtime.test.ts"
+        ]
       }
-    },
-    "integration": {
-      "workstream": "integration",
-      "requiredForPaths": ["package.json", "package-lock.json", "pyproject.toml", "goal.yaml", "Makefile", "sdk/python/pyproject.toml", "sdk/python/README.md", "tsconfig.json", "src/core/types.ts"]
     }
   },
   "delivery": {
-    "requiredForImplementation": false,
-    "maxActiveMinutes": 30,
+    "allowedComplexityClasses": [
+      "XS",
+      "S"
+    ],
     "checkpointMinutes": 25,
-    "allowedComplexityClasses": ["XS", "S"],
-    "maxImplementationFiles": 5,
+    "dependencyManifestPaths": [
+      "package.json",
+      "package-lock.json",
+      "pyproject.toml",
+      "go.mod",
+      "Cargo.toml",
+      "pom.xml"
+    ],
+    "maxActiveMinutes": 30,
     "maxAffectedComponents": 2,
+    "maxImplementationFiles": 5,
     "maxPublicInterfaceChanges": 0,
     "maxRuntimeDependencies": 0,
-    "targetBranches": ["main"],
-    "publicInterfacePaths": ["src/interfaces/**", "src/core/types.ts", "sdk/**"],
-    "dependencyManifestPaths": ["package.json", "package-lock.json", "pyproject.toml", "go.mod", "Cargo.toml", "pom.xml"]
+    "publicInterfacePaths": [
+      "src/interfaces/**",
+      "src/core/types.ts",
+      "sdk/**"
+    ],
+    "requiredForImplementation": false,
+    "targetBranches": [
+      "main"
+    ]
+  },
+  "docker": {
+    "composeFiles": [
+      "docker-compose.yml",
+      "compose.yml",
+      "compose.e2e.yml"
+    ],
+    "dockerfiles": [
+      "Dockerfile",
+      "Dockerfile.e2e"
+    ],
+    "required": true
+  },
+  "governancePaths": [
+    "TODO.md",
+    "project/TICKETS.md",
+    "project/ticket-*/**"
+  ],
+  "requiredFiles": [
+    "README.md",
+    "VERSION",
+    "CHANGELOG.md",
+    "TODO.md",
+    "AGENTS.md",
+    "Dockerfile",
+    "project/TICKETS.md",
+    "project/new-ticket.sh",
+    "project/readme.sh",
+    "project/governance-check.sh"
+  ],
+  "schema": "new-project.governance/v2",
+  "stacks": [
+    "node",
+    "docker"
+  ],
+  "standard": {
+    "id": "wellmanifest/new-project",
+    "version": "0.14.0"
+  },
+  "ticket": {
+    "activeStatuses": [
+      "IN_PROGRESS"
+    ],
+    "closedStatuses": [
+      "DONE",
+      "CANCELLED"
+    ],
+    "directoryPattern": "^ticket-[0-9]{3}$",
+    "implementationStates": [
+      "EDIT",
+      "VALIDATION",
+      "PUBLICATION"
+    ],
+    "intentFile": "intent.json",
+    "nonActiveStatuses": [
+      "BACKLOG",
+      "PLAN",
+      "BLOCKED"
+    ],
+    "requiredAgentFiles": [
+      "ai-*.md",
+      "ai-*-logs.txt"
+    ],
+    "requiredFiles": [
+      "README.md",
+      "preprompt.md",
+      "changelog.md",
+      "intent.json"
+    ],
+    "root": "project"
   },
-  "stacks": ["node", "docker"]
+  "trustedApprovalSources": [
+    "github-review",
+    "github-app-review",
+    "signed-attestation"
+  ]
 }
diff --git a/.governance/manifest.lock.json b/.governance/manifest.lock.json
index 43ddbd3..e69fd18 100644
--- a/.governance/manifest.lock.json
+++ b/.governance/manifest.lock.json
@@ -6,12 +6,12 @@
     ".governance/decision-record.schema.json": "08278322846b6da5e8306c0661c23fd1bcdf4a003f8ef75aac0d33299a4cd357",
     ".governance/decision_record.py": "c284285339b0b61b2f68b337301580ee8b35a1687cbbe47f4c268ff5723a466c",
     ".governance/diagnostics.json": "1640311176394612e462b595f143e32be1d52bd768f109c199d25bae9673881b",
-    ".governance/governance_check.py": "2a3e50801f9174b102db4f79780f4949ffd97303f35f966e8a56ab2cd6f53e8e",
+    ".governance/governance_check.py": "8c94129c52f9dbb8e2ece60bc916bace03b8078d750dbe0ac40218a212c73ac4",
     ".governance/intent.schema.json": "c5cee010aabcc09dce13e12583848371a7b3eacc898b253cd9bb455d4eba6801",
     ".governance/lock.schema.json": "fc6f1143ef713c993b61270dd2d7545a52cb0b8501aadb188e6d0152a208b207",
-    ".governance/manifest.json": "e7ac42e440a1b24f93f60738f54a078a8582e447e693d37a29f219104e11d877",
+    ".governance/manifest.base.json": "dfccc0af1b6e27f6bd29f6f97c1778c5f66932dd9da7c33fa63a2c4ce071910c",
     ".governance/manifest.schema.json": "d48f258e3397ac2d8c5010e5ccdeef9eaf87b0b015d56798d11d5916c5f70a18",
-    ".governance/package-manifest.json": "8bf10862f2b30eb57652b130f7aa1231907e2bb6affd9b68fcb232747658ddde",
+    ".governance/package-manifest.json": "7d356f590f312b4983519e21de840387e8c561f11a53e2db13f012098dd27b07",
     ".governance/required-checks.json": "579e008e2dba9110ce45d34fdd96768fa28c003a339cf338378d28fe00fb83a2",
     ".governance/stack-profiles.json": "6fa3f8f44e50cfd0539413a85092817d3fab4e82fe376405f1e443120724dff2",
     ".governance/work-classification.dsl.json": "3a947c41938c0b8ef1717957f313ff9248764252735182de30b1f2d6878748b6",
@@ -30,7 +30,7 @@
     "id": "wellmanifest/new-project",
     "publicationStatus": "published",
     "sourceRepository": "wellmanifest/new-project",
-    "sourceRevision": "85631ea24d127f1f4797d2a67f3524a63cbbc95a",
-    "version": "0.13.2"
+    "sourceRevision": "a22eb47ca0e7c06ac927d1c0d843eabb798bfadd",
+    "version": "0.14.0"
   }
 }
diff --git a/.governance/package-manifest.json b/.governance/package-manifest.json
index 3d78aff..0e0cf65 100644
--- a/.governance/package-manifest.json
+++ b/.governance/package-manifest.json
@@ -24,6 +24,7 @@
     { "source": "project/governance-check.bat", "target": "project/governance-check.bat", "strategy": "managed", "executable": false },
     { "source": "project/new-ticket.sh", "target": "project/new-ticket.sh", "strategy": "managed", "executable": true },
     { "source": "project/readme.sh", "target": "project/readme.sh", "strategy": "managed", "executable": true },
-    { "source": "governance/manifest.default.json", "target": ".governance/manifest.json", "strategy": "seed", "executable": false }
+    { "source": "governance/manifest.default.json", "target": ".governance/manifest.base.json", "strategy": "managed", "executable": false },
+    { "source": "governance/manifest.default.json", "target": ".governance/manifest.json", "strategy": "extendable", "executable": false }
   ]
 }
diff --git a/TODO.md b/TODO.md
index 43c00f7..1729725 100644
--- a/TODO.md
+++ b/TODO.md
@@ -9,6 +9,15 @@
 
 ## Backlog tickets
 
+- [ ] [`ticket-062`](project/ticket-062/README.md) — route the unowned Python
+  SDK bridge test through protected governance evolution. Current state:
+  `IN_PROGRESS / EDIT`; protected review exposed and is repairing stale
+  reusable-workflow caller pins after exact-SHA adoption; coordinated by
+  ticket-058.
+- [ ] [`ticket-058`](project/ticket-058/README.md) — synchronize release,
+  runtime, SDK and generated-provenance version identity and add a deterministic
+  drift gate. Plan and owner-ticket creation are approved; current state:
+  `BLOCKED / WAIT_FOR_DEPENDENCIES` while ticket-054 reserves `integration`.
 - [ ] [`ticket-051`](project/ticket-051/README.md) — wire
   `scripts/github-event-log.mjs` into CI with explicit flags only. Current
   state: `PLAN / WAIT_FOR_APPROVAL`; ticket-048 is now merged.
diff --git a/project/TICKETS.md b/project/TICKETS.md
index f5e2b87..8dd18f6 100644
--- a/project/TICKETS.md
+++ b/project/TICKETS.md
@@ -50,4 +50,6 @@ of `project/README.md`, which remains a generated technical-analysis artifact.
 | **ticket-054** | [`README.md`](./ticket-054/README.md) | [`preprompt.md`](./ticket-054/preprompt.md) | - |  [`ai-codex.md`](./ticket-054/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-054/ai-codex-logs.txt) | [`changelog.md`](./ticket-054/changelog.md) |
 | **ticket-055** | [`README.md`](./ticket-055/README.md) | [`preprompt.md`](./ticket-055/preprompt.md) | - |  [`ai-codex.md`](./ticket-055/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-055/ai-codex-logs.txt) | [`changelog.md`](./ticket-055/changelog.md) |
 | **ticket-056** | [`README.md`](./ticket-056/README.md) | [`preprompt.md`](./ticket-056/preprompt.md) | - |  [`ai-codex.md`](./ticket-056/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-056/ai-codex-logs.txt) | [`changelog.md`](./ticket-056/changelog.md) |
+| **ticket-058** | [`README.md`](./ticket-058/README.md) | [`preprompt.md`](./ticket-058/preprompt.md) | - |  [`ai-codex.md`](./ticket-058/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-058/ai-codex-logs.txt) | [`changelog.md`](./ticket-058/changelog.md) |
+| **ticket-062** | [`README.md`](./ticket-062/README.md) | [`preprompt.md`](./ticket-062/preprompt.md) | - |  [`ai-codex.md`](./ticket-062/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-062/ai-codex-logs.txt) | [`changelog.md`](./ticket-062/changelog.md) |
 <!-- AUTO:TICKET_INDEX:END -->
diff --git a/project/ticket-058/README.md b/project/ticket-058/README.md
new file mode 100644
index 0000000..517bf6e
--- /dev/null
+++ b/project/ticket-058/README.md
@@ -0,0 +1,90 @@
+# Ticket 058: Synchronize todo2code release and runtime version identity
+
+- **ID**: ticket-058
+- **Owner**: unresolved:human
+- **Status**: BLOCKED
+- **Workflow state**: WAIT_FOR_DEPENDENCIES
+- **Created**: 2026-08-08
+
+## Goal and scope
+
+Restore one auditable todo2code release identity across the root release
+metadata, SDK manifests, CLI output and every generated DSL provenance
+envelope. Add a dependency-free integration gate that fails closed when a
+future release updates only part of that identity.
+
+This ticket is the integration coordinator. Paths owned by `core-dsl`,
+`extractors` and `runtime` must be corrected through separate governed tickets
+that point back to ticket-058; this ticket does not transfer their ownership.
+
+## Verified regression
+
+At `main@738d7be93168fe73cccf14d3d589e545919c9a6f`:
+
+```text
+package.json                    0.5.1
+VERSION                         0.5.1
+pyproject.toml                  0.5.1
+Python/Rust/TypeScript SDKs     0.5.1
+src/core/version.ts             0.5.0
+t2c --version                   todo2code 0.5.0
+doDSL DevelopmentEvidenceDSL    producerVersion 0.5.0
+```
+
+Commit `99286994cc604e80b401fc16f4230e33e90df253` raised the release and
+SDK metadata to `0.5.1` without changing the runtime constant. Several tests
+then encoded `0.5.0` directly, so the normal suite preserved rather than
+detected the drift.
+
+## Proposed delivery
+
+1. Add an integration-owned, dependency-free version-contract verifier and
+   focused tests under `scripts/`, then make it part of `npm run verify`.
+2. Through a `core-dsl` ticket, align `T2C_VERSION` with the accepted release
+   identity.
+3. Through `extractors` and `runtime` tickets, replace current-version literals
+   with the exported runtime identity where they assert current behavior.
+   Historical fixtures remain pinned when their old version is evidence.
+4. Re-run the complete host, governance and Docker validation.
+5. Rebuild the pinned todo2code runtime used by doDSL and prove that a new
+   DevelopmentEvidenceDSL bundle reports `producerVersion "0.5.1"` while
+   retaining its exact Git commit/tree and no authority or mutation effect.
+
+Ticket creation with `--force-new` was explicitly authorized by the human on
+2026-08-08. That authorization permits this concurrent planning ticket; it is
+not approval to edit implementation paths or weaken the active ticket limits.
+
+## Acceptance criteria
+
+- [x] AC-01: A human approves this scope and the multi-workstream split.
+- [ ] AC-02: Root release metadata, SDK manifests, `T2C_VERSION`, CLI output
+      and newly generated provenance all report the same accepted version.
+- [ ] AC-03: A dependency-free verifier emits a stable diagnostic and non-zero
+      status for every supported version-identity mismatch.
+- [ ] AC-04: Tests asserting the current runtime use the canonical exported
+      identity; deliberately historical fixtures remain visibly pinned.
+- [ ] AC-05: `npm run verify`, governance, Docker smoke and both Docker E2E
+      profiles pass without skipped checks being counted as passes.
+- [ ] AC-06: A fresh doDSL compile records todo2code `0.5.1`, an exact source
+      revision/tree and `AUTHORITY_EFFECT none` / `MUTATION_EFFECT none`.
+
+## Participants
+
+- Human participant: unresolved; no `user-*` file was created.
+- Agent participant: [ai-codex.md](ai-codex.md).
+
+## Approval gate
+
+The human approved this plan and creation of the owner-workstream tickets on
+2026-08-08. This ticket is now `BLOCKED / WAIT_FOR_DEPENDENCIES`: ticket-054
+still reserves `integration`, so the verifier and root verify-hook cannot enter
+`EDIT`. Distinct child workstreams may proceed only through their own approved
+tickets. Conversation approval is an audit note, not trusted merge authority.
+
+## Non-goals
+
+- No new release number, Git tag or package publication.
+- No dependency, secret, AQL, Docker runtime or model configuration change.
+- No reinterpretation of historical `0.5.0` fixtures as current evidence.
+- No command execution or mutation authority derived from LLM output.
+- No direct edit of paths owned by another workstream under ticket-058.
diff --git a/project/ticket-058/ai-codex-logs.txt b/project/ticket-058/ai-codex-logs.txt
new file mode 100644
index 0000000..c2c075f
--- /dev/null
+++ b/project/ticket-058/ai-codex-logs.txt
@@ -0,0 +1,39 @@
+2026-08-08 pre-implementation audit
+
+PASS repository state
+  main@738d7be93168fe73cccf14d3d589e545919c9a6f
+  original worktree clean before ticket allocation
+
+FAIL release identity consistency
+  package.json=0.5.1
+  VERSION=0.5.1
+  pyproject.toml=0.5.1
+  sdk/python=0.5.1
+  sdk/rust=0.5.1
+  sdk/typescript=0.5.1
+  src/core/version.ts=0.5.0
+  dist CLI output=todo2code 0.5.0
+
+EVIDENCE root cause
+  commit 99286994cc604e80b401fc16f4230e33e90df253 updated release and SDK
+  metadata from 0.5.0 to 0.5.1 but did not update src/core/version.ts
+
+EVIDENCE downstream observation
+  doDSL project dodsl-smoke reports producer=todo2code, producerVersion=0.5.0
+  evidence URI=urn:onlydsl:development-evidence:sha256:7c65453adebf716a4e08aab09ed8f107e551f93232c011a61dfe5b47a55491ac
+  authorityEffect=none, mutationEffect=none
+
+AUTHORIZATION
+  Human explicitly approved creation of a concurrent integration ticket with
+  --force-new. Implementation approval has not been granted.
+
+No implementation path changed. State: WAIT_FOR_APPROVAL.
+
+PASS ./project/governance-check.sh
+  GOV-PASS: passed (0 errors, 0 warnings)
+
+2026-08-08 human plan decision
+  APPROVED ticket-058 plan
+  APPROVED creation of owner-workstream tickets
+  NOT trusted merge authorization
+  ticket-058 remains non-active while ticket-054 reserves integration
diff --git a/project/ticket-058/ai-codex.md b/project/ticket-058/ai-codex.md
new file mode 100644
index 0000000..b54431d
--- /dev/null
+++ b/project/ticket-058/ai-codex.md
@@ -0,0 +1,51 @@
+---
+participant-id: agent:codex
+participant: codex
+role: agent
+ticket: ticket-058
+---
+# Participant: codex (AI agent)
+
+## Understanding
+
+Todo2code currently has two simultaneously true but incompatible identities.
+Release and SDK metadata say `0.5.1`, while the runtime constant, CLI and every
+new provenance envelope say `0.5.0`. doDSL is not inventing the older value;
+it reads it from the pinned todo2code CLI and binds it to the exact analysed Git
+commit and tree.
+
+Changing one string would make the immediate output look correct but would not
+prevent the next partial release. The repair therefore needs a deterministic
+version contract plus removal of current-version literals from behavioral
+tests. Historical artifacts must not be rewritten.
+
+## Execution plan after approval
+
+1. Create separate `core-dsl`, `extractors` and `runtime` tickets with
+   ticket-058 as their integration coordinator.
+2. Align the core runtime version and replace only current-behavior literals in
+   the owning test workstreams.
+3. Once the active integration reservation permits it, add the no-dependency
+   version verifier, focused negative fixtures and the root verify hook.
+4. Run focused tests, `npm run verify`, governance, Docker smoke and both E2E
+   profiles.
+5. Rebuild the todo2code image consumed by doDSL, compile a fresh candidate and
+   verify the resulting DevelopmentEvidenceDSL identity and safety fields.
+
+## Actual changes
+
+- Audited all release/runtime declarations at exact main HEAD.
+- Identified the release commit that introduced the mismatch.
+- Confirmed the live CLI emits `todo2code 0.5.0` while package and VERSION are
+  `0.5.1`.
+- Confirmed doDSL faithfully persists that emitted producer version.
+- Created planning evidence only; no implementation file changed.
+- Recorded the human approval of this plan and authorization to create the
+  three owner-workstream tickets.
+
+## Blockers
+
+- Ticket-054 currently reserves the `integration` workstream. The approved
+  `--force-new` exception created this ticket but does not silently
+  override active-scope enforcement.
+- Each non-integration path requires its owning workstream ticket.
diff --git a/project/ticket-058/changelog.md b/project/ticket-058/changelog.md
new file mode 100644
index 0000000..b880580
--- /dev/null
+++ b/project/ticket-058/changelog.md
@@ -0,0 +1,14 @@
+# Ticket Changelog (ticket-058)
+
+## [0.1.0] - 2026-08-08
+
+- Created the explicitly authorized concurrent integration planning ticket.
+- Recorded the exact `0.5.1` release metadata versus `0.5.0` runtime mismatch.
+- Defined a multi-workstream repair with a dependency-free drift gate.
+- Preserved the distinction between current-version assertions and historical
+  fixtures.
+- Made no executable, runtime, dependency, Docker or consumer changes.
+- Passed the repository governance check with zero errors and zero warnings.
+- Recorded human approval of the plan and owner-ticket creation.
+- Moved to `BLOCKED / WAIT_FOR_DEPENDENCIES` until ticket-054 releases the
+  integration workstream.
diff --git a/project/ticket-058/intent.json b/project/ticket-058/intent.json
new file mode 100644
index 0000000..eed31bf
--- /dev/null
+++ b/project/ticket-058/intent.json
@@ -0,0 +1,105 @@
+{
+  "schema": "new-project.intent/v3",
+  "ticket": "ticket-058",
+  "summary": "Synchronize todo2code release and runtime version identity",
+  "workstream": "integration",
+  "classification": {
+    "kind": "BUG",
+    "priority": "P1",
+    "origin": "regression"
+  },
+  "allowedPaths": [
+    "project/ticket-058/**",
+    "TODO.md",
+    "project/TICKETS.md",
+    "package.json",
+    "scripts/verify-version-contract.mjs",
+    "scripts/verify-version-contract.test.mjs"
+  ],
+  "forbiddenPaths": [
+    "project/ticket-*/user-*.md",
+    "src/**",
+    "test/**",
+    "sdk/**",
+    "Dockerfile*",
+    "compose*.yml",
+    ".env*"
+  ],
+  "stacks": ["node", "docker"],
+  "dependsOn": [],
+  "conflictsWith": ["ticket-054"],
+  "integrationTicket": null,
+  "delivery": {
+    "acceptedBaseSha": "738d7be93168fe73cccf14d3d589e545919c9a6f",
+    "targetBranch": "main",
+    "outcome": "Every current todo2code artifact exposes one release identity and a deterministic integration gate prevents partial future bumps",
+    "nonGoals": [
+      "No new version, tag or publication",
+      "No dependency or runtime toolchain change",
+      "No rewrite of historical versioned evidence",
+      "No authority or command execution from model output"
+    ],
+    "complexity": "S",
+    "estimatedMinutes": 25,
+    "budgets": {
+      "maxImplementationFiles": 3,
+      "maxAffectedComponents": 2,
+      "maxPublicInterfaceChanges": 0,
+      "maxRuntimeDependencies": 0
+    },
+    "architecture": {
+      "status": "accepted",
+      "decision": "Treat release version as an integration contract, verify every declaration deterministically and let each workstream update only its owned current-version assertions",
+      "components": [
+        {
+          "name": "version-contract-verifier",
+          "paths": [
+            "scripts/verify-version-contract.mjs",
+            "scripts/verify-version-contract.test.mjs"
+          ]
+        },
+        {
+          "name": "root-verification-orchestration",
+          "paths": ["package.json"]
+        }
+      ],
+      "responsibilityChanges": false,
+      "interfaceChanges": [],
+      "dataChanges": [
+        "Current generated provenance changes from the stale runtime identity 0.5.0 to the accepted release identity 0.5.1"
+      ],
+      "ui": {"impact": "none", "states": [], "evidence": []},
+      "rollback": "Remove the verifier hook and scripts; workstream-owned version corrections retain their own rollback and evidence"
+    },
+    "runtimeDependencies": [],
+    "validation": [
+      {
+        "criterion": "AC-03",
+        "commands": [
+          "node --test scripts/verify-version-contract.test.mjs",
+          "node scripts/verify-version-contract.mjs"
+        ],
+        "evidence": "The verifier accepts one identity and fails each isolated mismatch with a stable diagnostic"
+      },
+      {
+        "criterion": "AC-05",
+        "commands": [
+          "npm run verify",
+          "./project/governance-check.sh",
+          "make docker-smoke",
+          "make e2e-core",
+          "make e2e-full"
+        ],
+        "evidence": "Host, policy and both Docker profiles pass without hidden fallback"
+      },
+      {
+        "criterion": "AC-06",
+        "commands": [
+          "doDSL compile with requireTodo2code=true",
+          "onlyDSL DevelopmentEvidenceDSL verification"
+        ],
+        "evidence": "A fresh immutable evidence bundle reports todo2code 0.5.1 and no authority or mutation effect"
+      }
+    ]
+  }
+}
diff --git a/project/ticket-058/preprompt.md b/project/ticket-058/preprompt.md
new file mode 100644
index 0000000..78e20a4
--- /dev/null
+++ b/project/ticket-058/preprompt.md
@@ -0,0 +1,10 @@
+# Ticket preprompt
+
+- **Task ID**: ticket-058
+- **Task title**: Synchronize todo2code release and runtime version identity
+- **Created**: 2026-08-08T21:46:52Z
+
+The human explicitly authorized creating this concurrent `integration` ticket
+with `--force-new`. The approval applies to ticket creation, not implementation.
+Keep executable implementation outside this governance/evidence directory and
+respect every workstream's owned paths.
diff --git a/project/ticket-062/README.md b/project/ticket-062/README.md
new file mode 100644
index 0000000..ec51f02
--- /dev/null
+++ b/project/ticket-062/README.md
@@ -0,0 +1,107 @@
+# Ticket 062: Assign Python runtime bridge test to SDK workstream
+
+- **ID**: ticket-062
+- **Owner**: agent:codex
+- **Status**: IN_PROGRESS
+- **Workflow state**: EDIT
+- **Created**: 2026-08-08
+
+## Goal and scope
+
+Resolve the missing workstream ownership for `test/python-runtime.test.ts`
+without directly editing a lock-protected governance manifest. The path tests
+the Python SDK bridge and should belong to `sdk`, but no current ownership glob
+matches it.
+
+`.governance/manifest.json` is bound by the immutable standard lock. A local
+hash edit would weaken the trust boundary, so this ticket records and routes
+the required upstream extension/adoption instead of modifying authority.
+
+## Acceptance criteria
+
+- [x] AC-01: A human approves routing this ownership gap through the protected
+      governance adoption path.
+- [x] AC-02: A published governance mechanism assigns the Python runtime bridge
+      test to `sdk` without hand-editing managed hashes.
+- [ ] AC-03: The complete managed set is adopted atomically and governance
+      passes before ticket-063 enters `EDIT`.
+- [x] AC-04: No application or test behavior changes in this ticket.
+
+## Participants
+
+- Human participant: unresolved; no `user-*` file was created.
+- Agent participant: [ai-codex.md](ai-codex.md).
+
+## Approval gate
+
+The human approved the protected routing plan on 2026-08-09. The ticket remains
+non-active and makes no authority change while it waits for a published
+upstream mechanism or existing supported extension.
+
+The matching upstream owner is the existing
+`wellmanifest/new-project:ticket-024`; no competing governance ticket was
+created. Its expanded plan was published as
+`ticket/024-extendable-target-manifest@e538ec0`, approved independently and
+implemented. The implementation is now published as
+`wellmanifest/new-project#67` at exact head
+`3d7ac45bb4359db96dba2825c3654fdb47c5b483`. Linux `test` and
+`windows-governance` passed, the independent Validator approved the exact
+head, and the implementation merged as `main@2fbf23f`. Closure PR #68 passed
+the same protected gates and merged as `main@a70b5b8`; upstream ticket-024 is
+`DONE / DONE`. The contract separates a hash-bound
+`.governance/manifest.base.json` from the target-extendable
+`.governance/manifest.json` and validates the extension fail-closed.
+
+Upstream `ticket-044` is complete. Release PR #69 passed protected Linux,
+Windows and deterministic exact-head review, then merged as exact release SHA
+`a22eb47ca0e7c06ac927d1c0d843eabb798bfadd`. Annotated tag and published,
+non-prerelease GitHub Release `v0.14.0` point to that commit; closure PR #70
+also passed protected validation.
+
+The previously approved dependency is therefore satisfied. Before any target
+mutation, this ticket entered `IN_PROGRESS / EDIT` and bound
+`delivery.standardAdoption` from installed v0.13.2 SHA `85631ea...` to exact
+v0.14.0 SHA `a22eb47...`. Ordinary delivery remains limited to the target
+manifest and lock; the complete managed payload is admitted only through the
+hash-bound atomic adoption contract.
+
+## Integration evidence
+
+A temporary combination of tickets 059, 060 and 061 passed every pre-test gate
+of `npm run verify`. The only observed test failure was the still-literal
+Python bridge assertion in `test/python-runtime.test.ts`: corrected runtime
+output is `todo2code 0.5.1`, while the unowned test still expects `0.5.0`.
+Ticket 063 owns that assertion but cannot enter `EDIT` until this ticket has
+adopted a published upstream mechanism and governance passes.
+
+## Adoption validation
+
+- The published v0.14.0 adoption tool installed exact SHA
+  `a22eb47ca0e7c06ac927d1c0d843eabb798bfadd`; a repeated `--check` reports
+  `up-to-date`.
+- The complete managed set is hash-valid, `.governance/manifest.base.json` is
+  locked, and the target `.governance/manifest.json` is intentionally absent
+  from `managedFiles`.
+- All eight todo2code workstreams were preserved. The `sdk` workstream now
+  owns exact path `test/python-runtime.test.ts`.
+- `./project/governance-check.sh --base 738d7be...` passes with zero errors and
+  warnings under the atomic standard-adoption contract.
+- `npm run verify` passes 405 tests (404 PASS, one explicit JDK-unavailable
+  SKIP), including TypeScript, module/LLM boundaries, env, workflows, schemas,
+  generated analysis and build checks.
+- No file below `src/`, `test/`, `sdk/`, dependency metadata, Docker or runtime
+  behavior changed in this ticket.
+- First protected review resolved branch lifecycle after draft owner PRs
+  #78-#82 were opened, then failed closed with `GOV-SYNC-001`: the target
+  reusable workflow still selected v0.13.2 SHA `85631ea`, whose older parser
+  cannot validate the new `extendable` strategy. The ticket returned to
+  `EDIT` and now binds both the reusable workflow and its `standard-ref` input
+  to the adopted exact v0.14.0 SHA `a22eb47`.
+
+## Non-goals
+
+- No edit of the manifest while it is lock-protected and no hand-authored lock
+  hash. The published tool performs the atomic upgrade first; only then may
+  the now target-owned manifest receive the reviewed SDK path extension.
+- No test, runtime, SDK, dependency or Docker change.
+- No authority change proposed or generated by an LLM.
diff --git a/project/ticket-062/ai-codex-logs.txt b/project/ticket-062/ai-codex-logs.txt
new file mode 100644
index 0000000..dee688b
--- /dev/null
+++ b/project/ticket-062/ai-codex-logs.txt
@@ -0,0 +1,83 @@
+2026-08-08 pre-implementation evidence
+
+FAIL ownership resolution
+  test/python-runtime.test.ts matches no declared workstream path
+
+PROTECTED BOUNDARY
+  .governance/manifest.json digest is pinned by manifest.lock.json
+  direct local edit would fail GOV-SYNC-001
+
+DECISION
+  route through published governance extension/adoption; do not edit hashes
+
+No governance or implementation file changed. State: WAIT_FOR_APPROVAL.
+
+PASS ./project/governance-check.sh
+  GOV-PASS: passed (0 errors, 0 warnings)
+
+2026-08-09 approval
+  APPROVED protected ownership-routing plan
+  NO authority or managed-lock edit authorized
+  state BLOCKED / WAIT_FOR_EXTERNAL
+
+2026-08-09 upstream routing
+  REUSED wellmanifest/new-project:ticket-024
+  PLAN ticket/024-extendable-target-manifest@e538ec0
+  STATUS PLAN / WAIT_FOR_APPROVAL
+  DESIGN managed manifest.base.json + target-extendable manifest.json
+  NO upstream implementation or release mutation performed
+
+2026-08-09 combined validation
+  npm run verify pre-test gates PASS for temporary 059+060+061 combination
+  ONLY OBSERVED FAILURE test/python-runtime.test.ts expects todo2code 0.5.0
+  ACTUAL corrected CLI identity todo2code 0.5.1
+  OWNER ticket-063, blocked by ticket-062 governance ownership
+
+2026-08-09 upstream implementation
+  PR https://github.com/wellmanifest/new-project/pull/67
+  HEAD 3d7ac45bb4359db96dba2825c3654fdb47c5b483
+  PASS Linux test
+  PASS windows-governance
+  WAIT independent exact-head review, merge, immutable release and adoption
+
+2026-08-09 upstream completion
+  APPROVED exact head 3d7ac45bb4359db96dba2825c3654fdb47c5b483
+  MERGED implementation PR #67 as main@2fbf23fb3abc6c62f04b22b012f6138922fd05a4
+  MERGED closure PR #68 as main@a70b5b84f6005353426cd4ddb80d7086c671c364
+  STATUS upstream ticket-024 DONE / DONE
+
+2026-08-09 release dependency
+  PLAN wellmanifest/new-project:ticket-044@cac0ddb
+  TARGET immutable v0.14.0
+  STATUS PLAN / WAIT_FOR_APPROVAL
+  NO tag, GitHub Release or downstream adoption performed
+
+2026-08-09 immutable release satisfied
+  PASS upstream PR 69 Linux, Windows and deterministic exact-head review
+  RELEASE v0.14.0 exact SHA a22eb47ca0e7c06ac927d1c0d843eabb798bfadd
+  PASS upstream clean detached merge-SHA contract
+  PASS upstream closure PR 70 protected validation
+  STATE ticket-062 IN_PROGRESS / EDIT before target mutation
+  ADOPTION from 85631ea24d127f1f4797d2a67f3524a63cbbc95a
+  ADOPTION to   a22eb47ca0e7c06ac927d1c0d843eabb798bfadd
+
+2026-08-09 downstream adoption validation
+  PASS package check up-to-date wellmanifest/new-project 0.14.0 at a22eb47
+  PASS managed base locked and target manifest excluded from managedFiles
+  PASS 8/8 local workstreams preserved
+  PASS sdk owns test/python-runtime.test.ts
+  PASS exact-base governance 0 errors 0 warnings
+  PASS npm run verify 405 tests, 404 pass, 1 JDK-unavailable skip
+  BOUNDARY no src, test, sdk, dependency, Docker or runtime behavior change
+  STATE ticket-062 IN_PROGRESS / VALIDATION; ticket-063 still blocked pending merge
+  BASE refreshed to actual branch merge-base 738d7be93168fe73cccf14d3d589e545919c9a6f before PR
+
+2026-08-09 protected review diagnostics
+  PASS exact-head deterministic Validator D-062-6612
+  ADVISORY LLM REQUEST_CHANGES not used as authority
+  FAIL GOV-BRANCH-LIFECYCLE-002 orphan owner branches 058-061,063
+  REPAIR draft owner PRs 78-82 opened; lifecycle rerun PASS
+  FAIL GOV-SYNC-001 v0.13.2 caller parser rejects v0.14.0 extendable package entry
+  ROOT .github/workflows/ci.yml still pinned uses and standard-ref to 85631ea
+  STATE returned to IN_PROGRESS / EDIT
+  REPAIR both caller references aligned to exact a22eb47
diff --git a/project/ticket-062/ai-codex.md b/project/ticket-062/ai-codex.md
new file mode 100644
index 0000000..b51e335
--- /dev/null
+++ b/project/ticket-062/ai-codex.md
@@ -0,0 +1,63 @@
+---
+participant-id: agent:codex
+participant: codex
+role: agent
+ticket: ticket-062
+---
+# Participant: codex (AI agent)
+
+## Understanding
+
+The Python bridge test has no matching owner in the current manifest. Directly
+adding a glob is not safe because the manifest is checked against an immutable
+managed-file digest. Ownership must come through a protected upstream contract
+or a supported project-extension mechanism.
+
+## Execution plan
+
+1. Record the approved escalation route and wait for its immutable release.
+2. Open or reuse an upstream governance ticket for a project-specific ownership
+   extension that does not weaken managed-file verification.
+3. Adopt the published revision atomically through the existing protected
+   standard-adoption flow.
+4. Re-run governance and unblock ticket-063 only after `sdk` ownership is
+   deterministic.
+
+## Actual changes
+
+- Proved the path is unowned by the current workstream globs.
+- Proved the manifest is protected by the immutable standard lock.
+- Reused upstream `wellmanifest/new-project:ticket-024` and published its
+  expanded planning branch at
+  `ticket/024-extendable-target-manifest@e538ec0`; no duplicate ticket exists.
+- Upstream implementation PR #67 at exact head `3d7ac45` passed Linux,
+  Windows and independent review; it merged as `main@2fbf23f`, and closure PR
+  #68 merged as `main@a70b5b8`.
+- Created upstream publication plan ticket-044 at `cac0ddb`; it requires
+  separate approval before immutable v0.14.0 publication.
+- Verified upstream v0.14.0 was published at exact release SHA
+  `a22eb47ca0e7c06ac927d1c0d843eabb798bfadd` after protected and clean
+  detached validation.
+- Bound the approved downstream adoption from exact installed v0.13.2 SHA to
+  that immutable v0.14.0 SHA and entered `IN_PROGRESS / EDIT` before target
+  mutation.
+- Adopted the complete managed payload with the published tool, then added the
+  exact Python bridge path to the now target-owned SDK workstream.
+- Passed idempotent package check, hash/base invariants, exact-base governance
+  with zero findings, and full `npm run verify` (405 tests; one explicit
+  JDK-unavailable skip). The ticket is now in `VALIDATION`.
+- Protected review exposed target caller drift: the reusable workflow and its
+  `standard-ref` still selected v0.13.2, so that old parser rejected the
+  adopted package strategy with `GOV-SYNC-001`. Returned to `EDIT` and aligned
+  both immutable references with exact v0.14.0 SHA `a22eb47`.
+- Recorded the combined 059+060+061 validation: every pre-test gate passed and
+  the only observed test failure is the ticket-063 assertion blocked by this
+  ownership gap.
+- Made no governance, implementation or test change.
+- Human approved the routing plan on 2026-08-09; its external release
+  dependency is now satisfied.
+
+## Blockers
+
+- Fresh protected checks and exact-head review remain after caller alignment.
+  Ticket-063 stays blocked until this adoption reaches protected `main`.
diff --git a/project/ticket-062/changelog.md b/project/ticket-062/changelog.md
new file mode 100644
index 0000000..338d3f6
--- /dev/null
+++ b/project/ticket-062/changelog.md
@@ -0,0 +1,38 @@
+# Ticket Changelog (ticket-062)
+
+## [0.1.0] - 2026-08-08
+
+- Initial governance scaffold created.
+- No human participant identity or content was generated.
+- Recorded the unowned Python SDK bridge test and immutable-lock constraint.
+- Selected protected upstream extension/adoption instead of a local authority
+  edit.
+- Passed governance with zero errors and zero warnings.
+- Recorded human approval and moved to `BLOCKED / WAIT_FOR_EXTERNAL` without
+  changing governance authority.
+
+## [0.2.0] - 2026-08-09
+
+- Verified immutable upstream v0.14.0 release SHA `a22eb47` after its
+  protected and clean detached validation.
+- Bound the approved atomic adoption from installed v0.13.2 SHA `85631ea` to
+  exact v0.14.0 SHA and entered `IN_PROGRESS / EDIT` before mutation.
+
+## [0.3.0] - 2026-08-09
+
+- Atomically adopted the full v0.14.0 managed payload and added the exact
+  Python bridge test path to the now target-owned SDK workstream.
+- Passed idempotent adoption, exact-base governance, managed hash/base
+  invariants and all 405 project tests (one explicit JDK-unavailable skip).
+- Completed all local acceptance criteria and advanced to `VALIDATION`.
+- Refreshed `acceptedBaseSha` from the historical routing point to the actual
+  branch/main merge-base `738d7be` before protected review.
+
+## [0.4.0] - 2026-08-09
+
+- Opened draft owner PRs #78-#82 for the approved remote ticket branches,
+  resolving deterministic branch lifecycle ownership.
+- Recorded protected `GOV-SYNC-001`: the target workflow still ran the v0.13.2
+  parser against the adopted v0.14.0 package contract.
+- Returned to `EDIT`, expanded the ordinary adoption budget from two to three
+  files, and aligned both workflow references to exact SHA `a22eb47`.
diff --git a/project/ticket-062/intent.json b/project/ticket-062/intent.json
new file mode 100644
index 0000000..cd878bd
--- /dev/null
+++ b/project/ticket-062/intent.json
@@ -0,0 +1,62 @@
+{
+  "schema": "new-project.intent/v3",
+  "ticket": "ticket-062",
+  "summary": "Assign Python runtime bridge test to SDK workstream",
+  "workstream": "governance",
+  "classification": {
+    "kind": "BUG",
+    "priority": "P1",
+    "origin": "regression"
+  },
+  "allowedPaths": [
+    ".governance/manifest.json",
+    ".governance/manifest.lock.json",
+    ".github/workflows/ci.yml",
+    "project/ticket-062/**",
+    "TODO.md",
+    "project/TICKETS.md"
+  ],
+  "forbiddenPaths": [
+    "project/ticket-*/user-*.md",
+    "src/**",
+    "test/**",
+    "sdk/**",
+    "package.json",
+    "package-lock.json",
+    "Dockerfile*",
+    "compose*.yml",
+    ".env*"
+  ],
+  "stacks": [],
+  "dependsOn": [],
+  "conflictsWith": [],
+  "integrationTicket": "ticket-058",
+  "delivery": {
+    "acceptedBaseSha": "738d7be93168fe73cccf14d3d589e545919c9a6f",
+    "targetBranch": "main",
+    "standardAdoption": {
+      "sourceRepository": "wellmanifest/new-project",
+      "fromRevision": "85631ea24d127f1f4797d2a67f3524a63cbbc95a",
+      "toRevision": "a22eb47ca0e7c06ac927d1c0d843eabb798bfadd"
+    },
+    "outcome": "The Python SDK bridge test receives deterministic SDK ownership through a protected published governance contract",
+    "nonGoals": ["No local managed-hash edit", "No application or test change", "No dependency, Docker or authority weakening"],
+    "complexity": "XS",
+    "estimatedMinutes": 15,
+    "budgets": {"maxImplementationFiles": 3, "maxAffectedComponents": 1, "maxPublicInterfaceChanges": 0, "maxRuntimeDependencies": 0},
+    "architecture": {
+      "status": "accepted",
+      "decision": "Atomically adopt immutable new-project v0.14.0, preserving target workstreams while extending the sdk owner with the Python runtime bridge test",
+      "components": [{"name": "target-adoption", "paths": [".governance/manifest.json", ".governance/manifest.lock.json", ".github/workflows/ci.yml"]}],
+      "responsibilityChanges": true,
+      "interfaceChanges": [],
+      "dataChanges": ["The sdk workstream owns test/python-runtime.test.ts; the installed standard, reusable governance workflow and standard-ref advance to exact v0.14.0 release SHA"],
+      "ui": {"impact": "none", "states": [], "evidence": []},
+      "rollback": "Re-adopt the prior immutable revision through the same reviewed flow; never hand-edit a managed hash or move a release tag"
+    },
+    "runtimeDependencies": [],
+    "validation": [
+      {"criterion": "AC-03", "commands": ["./project/governance-check.sh"], "evidence": "The adopted managed set passes immutable lock and workstream ownership checks"}
+    ]
+  }
+}
diff --git a/project/ticket-062/preprompt.md b/project/ticket-062/preprompt.md
new file mode 100644
index 0000000..ef2feca
--- /dev/null
+++ b/project/ticket-062/preprompt.md
@@ -0,0 +1,8 @@
+# Ticket preprompt
+
+- **Task ID**: ticket-062
+- **Task title**: Assign Python runtime bridge test to SDK workstream
+- **Created**: 2026-08-08T21:56:33Z
+
+Keep executable implementation outside this governance/evidence directory.
+Read a human-owned user-*.md file only when one exists.