diff --git a/.github/workflows/governance-reusable.yml b/.github/workflows/governance-reusable.yml
index 372b630e..78d482b7 100644
--- a/.github/workflows/governance-reusable.yml
+++ b/.github/workflows/governance-reusable.yml
@@ -884,7 +884,7 @@ jobs:
           ref: ${{ github.sha }}
       - name: Check file permissions
         run: |
-          find . -type f -perm /111 -name "*.sh" | head -10
+          find . -type f -perm /111 -name "*.sh" | head -20
         continue-on-error: true
         # advisory: informational only; repos can opt into blocking locally
       - name: Check TODO/FIXME
@@ -895,7 +895,7 @@ jobs:
         # advisory: informational only; repos can opt into blocking locally
       - name: Check for large files
         run: |
-          find . -type f -size +1M -not -path "./.git/*" | head -10
+          find . -type f -size +1M -not -path "./.git/*" | head -20
         continue-on-error: true
         # advisory: informational only; repos can opt into blocking locally
       - name: EditorConfig check
@@ -958,7 +958,7 @@ jobs:
             echo "::error::Missing Expires field"
             exit 1
           fi
-          EXPIRES=$(grep "^Expires:" "$SECTXT" | cut -d: -f2- | tr -d ' ' | head -1)
+          EXPIRES=$(grep "^Expires:" "$SECTXT" | cut -d: -f2- | tr -d ' ' | head -2)
           if date -d "$EXPIRES" > /dev/null 2>&1; then
             DAYS=$(( ($(date -d "$EXPIRES" +%s) - $(date +%s)) / 86400 ))
             if [ $DAYS -lt 0 ]; then
diff --git a/.governance-allowlist b/.governance-allowlist
new file mode 100644
index 00000000..d01a77aa
--- /dev/null
+++ b/.governance-allowlist
@@ -0,0 +1,7 @@
+# .governance-allowlist — banned-language migration ledger
+# One glob per line; '#' comments; blank lines ignored.
+# Every path listed individually so NEW banned files still fail the gate.
+# Inventory 2026-08-06: 3 python files (governance tooling + fixtures).
+a2ml/actions/validate/validate-manifest-dialect.py
+scripts/check-workflow-duplicate-keys.py
+scripts/relock-sha-keys.py