fix: secret 命名统一 + drift §5 bug + 上游 external 声明

governance/REPOS.yaml

@@ -46,12 +46,6 @@ repos:
     role: 项目模板仓——新仓由此派生，自动继承 gate/护栏/AGENTS.md 骨架
     key_paths: [AGENTS.md, .github/workflows/ci.yml, docs/ARCHITECTURE.md]
 
-  - name: openjiuwen
-    layer: L2
-    visibility: private
-    status: planned
-    role: 编排框架私有仓（推入/维护）——多智能体运行时 + LLM Gateway 部署配置（deploy/llm-gateway）
-
   - name: agent-tools
     layer: L2
     visibility: private
@@ -63,3 +57,15 @@ repos:
     visibility: public
     status: exempt
     role: 历史产品仓——申报在册但豁免治理基线（repo_baseline.exclude_repos）
+
+# 上游依赖（不属于本组织；不 fork、不 submodule）
+# 治理方式：声明于此 + 部署渲染时 clone 并 pin tag（ADR-0002 rev1）
+external_upstreams:
+  - name: openjiuwen-runtime
+    repo: openJiuwen-ai/jiuwenswarm
+    role: 多智能体编排框架运行时（AgentServer/Gateway/Team/权限引擎/A2A）
+    consumed_by: [agent-registry 的声明渲染]
+  - name: openjiuwen-a2x
+    repo: openJiuwen-ai/agent-protocol
+    role: A2X 注册中心（分布式 Team 控制面）
+    consumed_by: [分布式 team 部署]

governance/drift-check.sh

@@ -93,7 +93,7 @@ done
 # ---------- 5. 必需 org secrets（只查存在性，值不可读）----------
 SECRETS=$(api "https://api.github.com/orgs/$ORG/actions/secrets")
 for s in $(jq -r '.org_secrets_required[]' "$EXPECTED"); do
-  jq -e --arg s "$s" '.secrets[].name == $s' <<<"$SECRETS" >/dev/null \
+  jq -e --arg s "$s" 'any(.secrets[]; .name == $s)' <<<"$SECRETS" >/dev/null \
     && ok "org secret '$s'" || drift "org secret '$s' 缺失"
 done
 

governance/expected-state.json

@@ -25,7 +25,7 @@
     "delete_branch_on_merge": true,
     "exclude_repos": ["AI_Web_School"]
   },
-  "org_secrets_required": ["AGENT_APP_SECRET"],
+  "org_secrets_required": ["CB_APP_ID", "CB_APP_KEY"],
   "github_app": {
     "name": "cloudbrid-agent",
     "id": 4632704,