diff --git a/governance/REPOS.yaml b/governance/REPOS.yaml
index 128bac7..5510577 100644
--- a/governance/REPOS.yaml
+++ b/governance/REPOS.yaml
@@ -46,12 +46,6 @@ repos:
     role: 项目模板仓——新仓由此派生，自动继承 gate/护栏/AGENTS.md 骨架
     key_paths: [AGENTS.md, .github/workflows/ci.yml, docs/ARCHITECTURE.md]
 
-  - name: openjiuwen
-    layer: L2
-    visibility: private
-    status: planned
-    role: 编排框架私有仓（推入/维护）——多智能体运行时 + LLM Gateway 部署配置（deploy/llm-gateway）
-
   - name: agent-tools
     layer: L2
     visibility: private
@@ -63,3 +57,15 @@ repos:
     visibility: public
     status: exempt
     role: 历史产品仓——申报在册但豁免治理基线（repo_baseline.exclude_repos）
+
+# 上游依赖（不属于本组织；不 fork、不 submodule）
+# 治理方式：声明于此 + 部署渲染时 clone 并 pin tag（ADR-0002 rev1）
+external_upstreams:
+  - name: openjiuwen-runtime
+    repo: openJiuwen-ai/jiuwenswarm
+    role: 多智能体编排框架运行时（AgentServer/Gateway/Team/权限引擎/A2A）
+    consumed_by: [agent-registry 的声明渲染]
+  - name: openjiuwen-a2x
+    repo: openJiuwen-ai/agent-protocol
+    role: A2X 注册中心（分布式 Team 控制面）
+    consumed_by: [分布式 team 部署]
diff --git a/governance/drift-check.sh b/governance/drift-check.sh
index 45f4221..cf36f6f 100755
--- a/governance/drift-check.sh
+++ b/governance/drift-check.sh
@@ -93,7 +93,7 @@ done
 # ---------- 5. 必需 org secrets（只查存在性，值不可读）----------
 SECRETS=$(api "https://api.github.com/orgs/$ORG/actions/secrets")
 for s in $(jq -r '.org_secrets_required[]' "$EXPECTED"); do
-  jq -e --arg s "$s" '.secrets[].name == $s' <<<"$SECRETS" >/dev/null \
+  jq -e --arg s "$s" 'any(.secrets[]; .name == $s)' <<<"$SECRETS" >/dev/null \
     && ok "org secret '$s'" || drift "org secret '$s' 缺失"
 done
 
diff --git a/governance/expected-state.json b/governance/expected-state.json
index 7451d0f..01254b5 100644
--- a/governance/expected-state.json
+++ b/governance/expected-state.json
@@ -25,7 +25,7 @@
     "delete_branch_on_merge": true,
     "exclude_repos": ["AI_Web_School"]
   },
-  "org_secrets_required": ["AGENT_APP_SECRET"],
+  "org_secrets_required": ["CB_APP_ID", "CB_APP_KEY"],
   "github_app": {
     "name": "cloudbrid-agent",
     "id": 4632704,