feat(uuid-v8): stage 1 of the v8 rename — add the "UUID v8 conformance" gate

.github/workflows/actions.lock

@@ -167,7 +167,7 @@ workflows:
         - 'step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25'
     '.github/workflows/tailscale-connect-reusable.yml':
         - 'tailscale/github-action@d1b6cd204f8dceda5b3eaad7f1f767be390056cd'
-    '.github/workflows/uuid-v7.yml':
+    '.github/workflows/uuid-v8.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
 dependencies:
     'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9':

.github/workflows/governance-reusable.yml

@@ -77,6 +77,14 @@ jobs:
         run: |
           bash .standards-history/scripts/check-workflow-staleness.sh .
 
+  # ⚠ DEPRECATED NAME, kept for one migration (owner ruling 2026-10-14, the
+  # two-stage v8 rename). This job runs the same strict v8 check as
+  # uuid-v8-conformance below. It exists only because live rulesets still
+  # require "<caller> / UUID v7 conformance"; removing it before they are
+  # re-derived would leave that context waiting forever on every consumer.
+  # Stage 2: re-derive rulesets (scripts/apply-branch-gates.sh). Stage 3:
+  # delete this job once scripts/check-required-contexts.sh shows no
+  # consumer still requires it, and drop it from the frozen list.
   uuid-v7-conformance:
     name: UUID v7 conformance
     runs-on: ${{ inputs.runs-on }}
@@ -88,9 +96,6 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
 
-      # ADR-008 P2 dual-accept (v8 and v7 pass). The job id and name stay
-      # "UUID v7 conformance" so no caller's required context moves; v7
-      # acceptance retires at P4.
       - name: Checkout UUID validator (ESTATE-UUID-V8)
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -109,6 +114,36 @@ jobs:
           chmod +x .standards-uuid/scripts/check-uuid-v8.sh
           .standards-uuid/scripts/check-uuid-v8.sh --strict .
 
+  # The UUID gate under its true name (ADR-008: version 8 only). Added beside
+  # the deprecated uuid-v7-conformance job above; rulesets move to this
+  # context in stage 2, and the old job goes in stage 3.
+  uuid-v8-conformance:
+    name: UUID v8 conformance
+    runs-on: ${{ inputs.runs-on }}
+    timeout-minutes: 10
+    steps:
+      - name: Checkout caller repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Checkout UUID validator (ESTATE-UUID-V8)
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: hyperpolymath/standards
+          ref: ${{ job.workflow_sha }}
+          path: .standards-uuid
+          sparse-checkout: scripts/check-uuid-v8.sh
+          sparse-checkout-cone-mode: false
+          persist-credentials: false
+
+      # ADR-008 strict (owner ruling D320, 2026-10-07): v8 only.
+      - name: Reject UUID literals that are not v8
+        run: |
+          chmod +x .standards-uuid/scripts/check-uuid-v8.sh
+          .standards-uuid/scripts/check-uuid-v8.sh --strict .
+
   allowlist-preflight:
     name: Allowlist Preflight
     runs-on: ${{ inputs.runs-on }}

.github/workflows/uuid-v7.yml → .github/workflows/uuid-v8.yml

@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # Local dogfood gate for the estate UUID standard.
-name: UUID v7 conformance
+name: UUID v8 conformance
 
 on:
   push:
@@ -15,16 +15,17 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  uuid-v7:
-    name: Reject non-v7 UUID literals
+  uuid-v8:
+    name: Reject non-v8 UUID literals
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      # ADR-008 strict (owner ruling D320, 2026-10-07): v8 only. The workflow and
-      # job names are kept so no required context moves. Rollback is dropping
-      # --strict, which restores P2 dual-accept.
+      # ADR-008 strict (owner ruling D320, 2026-10-07): v8 only. Rollback is
+      # dropping --strict, which restores P2 dual-accept. Renamed from
+      # uuid-v7.yml on 2026-10-14 (owner ruling: two-stage v8 rename). This
+      # workflow is not in gates.json, so no derived required context moves.
       - run: scripts/check-uuid-v8.sh --strict .
       - run: bash scripts/tests/uuid-v8-test.sh

docs/decisions/ADR-008-uuid-v8-estate-standard.adoc

@@ -207,7 +207,8 @@ the pull request that carries this section.
 * The dogfood workflow (`uuid-v7.yml`) and the `uuid-v7-conformance` job of
   `governance-reusable.yml` both run the new checker. Their workflow, job ids
   and job names are left unchanged, so no required status context moves.
-  They are renamed at P4.
+  They are renamed in stages; see the two-stage rename amendment of
+  2026-10-14 below.
 
 *Superseded material and its retirement.*
 
@@ -338,6 +339,29 @@ from their current code:
 echidna has no content-id call site yet, so it registers none.
 `berrywiki-import` is left for berrywiki to register with its own name form.
 
+== Amendment: the gate takes its v8 name in two stages (owner answer, 2026-10-14)
+
+The gate has checked version 8 only since D320, but it still ran under the v7
+names, so a red read "UUID v7 conformance" for a v8 rule. The owner chose to
+rename it now, in stages, rather than wait for P4. A one-step rename would
+break consumers: live rulesets name `<caller> / UUID v7 conformance`, and a
+renamed job would leave that context waiting forever on each repository once
+its pin moved past the rename.
+
+. *Stage 1 (this change).* `governance-reusable.yml` gains job
+  `uuid-v8-conformance` ("UUID v8 conformance"), the same strict check beside
+  the old job, which stays as a deprecated alias. Both names are on the frozen
+  list in `tests/test_governance_reusable_shape.sh`. The dogfood workflow
+  becomes `uuid-v8.yml` ("UUID v8 conformance" / "Reject non-v8 UUID
+  literals"). It is not a gate workflow in `config/rulesets/gates.json`, so no
+  derived context moves.
+. *Stage 2.* As consumers move their pin past stage 1, re-derive their
+  rulesets with `scripts/apply-branch-gates.sh`, so that they require the new
+  context.
+. *Stage 3.* Once `scripts/check-required-contexts.sh` shows that no consumer
+  still requires "UUID v7 conformance", delete `uuid-v7-conformance` and take
+  it off the frozen list.
+
 == What this record does not do
 
 It does not migrate any repository (P3), change the deed grammar, or update

scripts/tests/uuid-v7-test.sh

@@ -3,7 +3,7 @@
 #
 # Proves check-uuid-v7.sh CAN FAIL, and fails for the right reasons.
 #
-# The checker runs over this very repository (uuid-v7.yml), so every UUID in
+# The checker runs over this very repository (uuid-v8.yml), so every UUID in
 # this file is ASSEMBLED AT RUNTIME from fragments. A literal non-v7 UUID here
 # would turn the real gate red on its own test.
 set -euo pipefail

scripts/tests/uuid-v8-test.sh

@@ -4,7 +4,7 @@
 # Proves check-uuid-v8.sh CAN FAIL, and fails for the right reasons, in both
 # its default (dual-accept, ADR-008 P2) and --strict (v8 only) modes.
 #
-# The checker runs over this very repository (uuid-v7.yml), so every UUID in
+# The checker runs over this very repository (uuid-v8.yml), so every UUID in
 # this file is ASSEMBLED AT RUNTIME from fragments. A literal non-conforming
 # UUID here would turn the real gate red on its own test.
 set -euo pipefail

tests/test_governance_reusable_shape.sh

@@ -51,6 +51,7 @@ Licence consistency
 Exemption ratchet
 Debt ratchet
 UUID v7 conformance
+UUID v8 conformance
 JS runtimes — environment provisions Bun first
 JS runtimes — \${{ matrix.runtime }}"
 ACTUAL=$(grep -P '^    name: ' "$F" | sed 's/^    name: //')