fix: align governance receipt freshness with commit lifecycle

.decapod/config.toml

@@ -28,7 +28,7 @@ detected_surfaces = [
 ]
 external_tracker = false
 container_workspaces = true
-backend = "cloud"
+backend = "local"
 declared_capabilities = [
     "agent-helper",
     "authentication",

.decapod/governance/claims.json

@@ -11,7 +11,7 @@
     "status": "active",
     "created_at": "2026-07-22",
     "updated_at": "2026-07-28",
-    "change_policy": "Claims are changed only through an issue-scoped review that preserves the baseline, Decapod condition, failure modes, measurements, proof gate, open questions, and evidence status. Governance artifact generation and publication inventory are tracked under issue #1025; the v0.85.0 cloud auto-login work for #1077 remains bounded to Decapod-owned backend composition, machine-local session reuse/refresh, repository identity, and CI surfaces while Propodus retains hosted authorization and persistence policy. One-time human GitHub approval, live protected todo behavior, and cross-system acceptance remain explicitly unproven follow-ups. The #1100/#1101/#1102 session lifecycle proof now covers local-session-first custody, machine-session reuse/refresh, pending-flow deduplication, one-time exchange persistence, and secret-free failure handling; deployment-provided live proof remains a protected follow-up."
+    "change_policy": "Claims are changed only through an issue-scoped review that preserves the baseline, Decapod condition, failure modes, measurements, proof gate, open questions, and evidence status. Governance artifact generation and publication inventory are tracked under issue #1025; the v0.85.0 cloud auto-login work for #1077 remains bounded to Decapod-owned backend composition, machine-local session reuse/refresh, repository identity, and CI surfaces while Propodus retains hosted authorization and persistence policy. One-time human GitHub approval, live protected todo behavior, and cross-system acceptance remain explicitly unproven follow-ups. The #1100/#1101/#1102 session lifecycle proof now covers local-session-first custody, machine-session reuse/refresh, pending-flow deduplication, one-time exchange persistence, and secret-free failure handling; deployment-provided live proof remains a protected follow-up. Hermes governance integrity and readiness substrate: issues #1094, #1096, #1059, #1055, and #1072."
   },
   "scope": {
     "product": "decapod",

.decapod/governance/plan.json

@@ -1,31 +1,29 @@
 {
   "schema_version": "1.0.0",
-  "title": "Finish backend=cloud session lifecycle (#1100/#1101/#1102)",
-  "intent": "Make decapod session acquire establish local custody first, then reuse or refresh the machine-local Propodus session and complete one-time onboarding without repository credentials or local SQLite fallback.",
-  "state": "DONE",
+  "title": "Hermes governance integrity and readiness substrate (#1094 #1096 #1059 #1065 #1055 #1072)",
+  "intent": "Provide authoritative, deterministic governance artifact integrity, semantic freshness, workspace-versus-target delta state, and dirty-file classification for Hermes readiness and later effective-state diagnostics.",
+  "state": "APPROVED",
   "todo_ids": [
-    "bend_01kyktj9m6ftb44j"
+    "feat_01kym05w1mxdpyhw"
   ],
   "proof_hooks": [
-    "cargo test --lib propodus",
-    "cargo test --test cloud_backend_storage",
+    "cargo test --test governance_artifacts",
+    "cargo test --test hermes_governance_substrate",
     "cargo fmt --all -- --check",
-    "CLIPPY_CONF_DIR=.config cargo clippy --all-targets --all-features -- -D warnings",
-    "decapod validate --refresh-specs --projections"
+    "cargo clippy --all-targets --all-features -- -D warnings",
+    "decapod validate --projections"
   ],
   "unknowns": [],
   "human_questions": [],
   "stop_conditions": [],
   "unresolved_contradictions": [],
-  "deferred_questions": [
-    "Run the existing ignored propodus_live proof through the protected GitHub environment with deployment-provided secrets; local implementation and redaction proof are complete."
-  ],
+  "deferred_questions": [],
   "constraints": {
     "forbidden_paths": [
       ".decapod/data"
     ],
     "file_touch_budget": 40
   },
   "phases": [],
-  "updated_at": "1785227881Z"
+  "updated_at": "1785231514Z"
 }