From 352c8cef7a8618de3426988709cc419796cb6f7c Mon Sep 17 00:00:00 2001
From: "courtmanr@gmail.com" <courtmanr@gmail.com>
Date: Wed, 29 Jul 2026 19:46:13 +0100
Subject: [PATCH] Fix companion compatibility CI

---
 .github/workflows/canonical-governance.yml   | 23 ++++++++++++++++++++
 .github/workflows/repo-boundary-audit.yml    |  5 +++++
 scripts/repo-boundary-paid-surface.allowlist |  1 -
 3 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/canonical-governance.yml b/.github/workflows/canonical-governance.yml
index 7a3e84830..cb0c5f67f 100644
--- a/.github/workflows/canonical-governance.yml
+++ b/.github/workflows/canonical-governance.yml
@@ -47,10 +47,33 @@ jobs:
           fetch-depth: 1
           path: repos/pulse-enterprise
 
+      - name: Resolve pulse-mobile evidence ref
+        id: pulse-mobile-ref
+        shell: bash
+        env:
+          CANDIDATE_REF: ${{ github.head_ref }}
+          GH_TOKEN: ${{ secrets.WORKFLOW_PAT }}
+        run: |
+          set -euo pipefail
+          resolved_ref="main"
+          if [ -n "${CANDIDATE_REF}" ]; then
+            matching_ref="$(gh api \
+              "repos/rcourtman/pulse-mobile/git/matching-refs/heads/${CANDIDATE_REF}" \
+              --jq '.[].ref' 2>/dev/null \
+              | grep --fixed-strings --line-regexp -- "refs/heads/${CANDIDATE_REF}" \
+              || true)"
+            if [ -n "${matching_ref}" ]; then
+              resolved_ref="${CANDIDATE_REF}"
+            fi
+          fi
+          echo "ref=${resolved_ref}" >> "${GITHUB_OUTPUT}"
+          echo "Using pulse-mobile ref: ${resolved_ref}"
+
       - name: Checkout pulse-mobile evidence repo
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: rcourtman/pulse-mobile
+          ref: ${{ steps.pulse-mobile-ref.outputs.ref }}
           token: ${{ secrets.WORKFLOW_PAT }}
           persist-credentials: false
           fetch-depth: 1
diff --git a/.github/workflows/repo-boundary-audit.yml b/.github/workflows/repo-boundary-audit.yml
index 35215c993..58181658d 100644
--- a/.github/workflows/repo-boundary-audit.yml
+++ b/.github/workflows/repo-boundary-audit.yml
@@ -14,6 +14,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
+      - name: Install boundary audit dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes --no-install-recommends ripgrep
+
       - name: Run Boundary Audit (report mode)
         run: |
           ./scripts/audit-private-boundary.sh | tee repo-boundary-audit.txt
diff --git a/scripts/repo-boundary-paid-surface.allowlist b/scripts/repo-boundary-paid-surface.allowlist
index e7503d344..6b8d35f0c 100644
--- a/scripts/repo-boundary-paid-surface.allowlist
+++ b/scripts/repo-boundary-paid-surface.allowlist
@@ -1,6 +1,5 @@
 internal/api/access_admin_handlers.go
 internal/api/activity_audit_handlers.go
-internal/api/host_ledger.go
 internal/api/identity_sso_handlers.go
 internal/api/licensing_bridge.go
 internal/api/licensing_handlers.go