[ShubhaKC123]

What & why

Adds a go-service registry policy for Go services using a cmd/, internal/, and pkg/ layout. It defines allowed and forbidden paths, explains why generated code, migrations, CI, and deployment files are excluded, and requires go build ./..., go vet ./..., and go test ./....

The policy documents the go.sum rationale and includes a caution about dependency changes. Adds the policy to the registry guide. Addresses #112.

Checklist

• Tests added/updated and uv run pytest passes — not run; Python and uv are unavailable in my environment.
• uv run ruff check . passes — not run; Python and uv are unavailable in my environment.
• No model/network calls added to the deterministic pipeline (agent/LLM work stays behind the Executor protocol or the optional classifier hook)
• Core invariants preserved (auto_merge always false; authority earned from evidence; verifier never fabricates a pass; receipts verify against a pinned key)
• Output/docs stay honest (enforcement tiers, model provenance, detection scope not overstated)
• If security-relevant, I've noted the impact and threat-model implications

Notes for reviewers

The policy registry tests validate the declared blocked and allowed paths against the real contract evaluator. git diff --check passed. The focused policy test could not be run because Python and uv are unavailable in my environment.

[ShubhaKC123]

I have read the CLA Document and I hereby sign the CLA

[github-actions]

Signetry Reviewer — 🟡 Needs human review

A human should decide — the required check is pending.

Deterministic gates (the authority)

Gate	Status
Required status check	⏳ pending
Secret scan	✅ clean
CI permission / OIDC	✅ no forbidden change
Dependency skew	✅ ok
All green	❌

Findings

No issues found by the deterministic scanners.

Merge

A human should review and merge.

This review is advisory. It never merges on its own judgement — the deterministic gates + a human are the authority. Findings can have false negatives; a green bot verdict is not a guarantee.