From 50cd9e9bed5736429eb620dd6c78ee8b955874e4 Mon Sep 17 00:00:00 2001
From: randypanding <66171646+randypanding@users.noreply.github.com>
Date: Tue, 18 Aug 2026 10:44:35 +0000
Subject: [PATCH] =?UTF-8?q?fix:=20org=20secret=20=E5=91=BD=E5=90=8D?=
 =?UTF-8?q?=E7=BB=9F=E4=B8=80=E4=B8=BA=20CB=5FAPP=5FID/CB=5FAPP=5FKEY?=
 =?UTF-8?q?=EF=BC=88=E4=B8=8E=20gh-app-token.sh=20=E6=B6=88=E8=B4=B9?=
 =?UTF-8?q?=E4=B8=80=E8=87=B4=EF=BC=89+=20=C2=A75=20jq=20any()=20bug=20+?=
 =?UTF-8?q?=20REPOS.yaml=20=E4=B8=8A=E6=B8=B8=20external=5Fupstreams?=
 =?UTF-8?q?=EF=BC=88ADR-0002=20rev1=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 governance/REPOS.yaml          | 18 ++++++++++++------
 governance/drift-check.sh      |  2 +-
 governance/expected-state.json |  2 +-
 3 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/governance/REPOS.yaml b/governance/REPOS.yaml
index 128bac7..5510577 100644
--- a/governance/REPOS.yaml
+++ b/governance/REPOS.yaml
@@ -46,12 +46,6 @@ repos:
     role: 项目模板仓——新仓由此派生，自动继承 gate/护栏/AGENTS.md 骨架
     key_paths: [AGENTS.md, .github/workflows/ci.yml, docs/ARCHITECTURE.md]
 
-  - name: openjiuwen
-    layer: L2
-    visibility: private
-    status: planned
-    role: 编排框架私有仓（推入/维护）——多智能体运行时 + LLM Gateway 部署配置（deploy/llm-gateway）
-
   - name: agent-tools
     layer: L2
     visibility: private
@@ -63,3 +57,15 @@ repos:
     visibility: public
     status: exempt
     role: 历史产品仓——申报在册但豁免治理基线（repo_baseline.exclude_repos）
+
+# 上游依赖（不属于本组织；不 fork、不 submodule）
+# 治理方式：声明于此 + 部署渲染时 clone 并 pin tag（ADR-0002 rev1）
+external_upstreams:
+  - name: openjiuwen-runtime
+    repo: openJiuwen-ai/jiuwenswarm
+    role: 多智能体编排框架运行时（AgentServer/Gateway/Team/权限引擎/A2A）
+    consumed_by: [agent-registry 的声明渲染]
+  - name: openjiuwen-a2x
+    repo: openJiuwen-ai/agent-protocol
+    role: A2X 注册中心（分布式 Team 控制面）
+    consumed_by: [分布式 team 部署]
diff --git a/governance/drift-check.sh b/governance/drift-check.sh
index 45f4221..cf36f6f 100755
--- a/governance/drift-check.sh
+++ b/governance/drift-check.sh
@@ -93,7 +93,7 @@ done
 # ---------- 5. 必需 org secrets（只查存在性，值不可读）----------
 SECRETS=$(api "https://api.github.com/orgs/$ORG/actions/secrets")
 for s in $(jq -r '.org_secrets_required[]' "$EXPECTED"); do
-  jq -e --arg s "$s" '.secrets[].name == $s' <<<"$SECRETS" >/dev/null \
+  jq -e --arg s "$s" 'any(.secrets[]; .name == $s)' <<<"$SECRETS" >/dev/null \
     && ok "org secret '$s'" || drift "org secret '$s' 缺失"
 done
 
diff --git a/governance/expected-state.json b/governance/expected-state.json
index 7451d0f..01254b5 100644
--- a/governance/expected-state.json
+++ b/governance/expected-state.json
@@ -25,7 +25,7 @@
     "delete_branch_on_merge": true,
     "exclude_repos": ["AI_Web_School"]
   },
-  "org_secrets_required": ["AGENT_APP_SECRET"],
+  "org_secrets_required": ["CB_APP_ID", "CB_APP_KEY"],
   "github_app": {
     "name": "cloudbrid-agent",
     "id": 4632704,