The policy bundle listed the 8 governed policy files under .specify/... (pre-restructure). After the move they live in packages/casan-harness/. Repoint all 8 paths and re-sign the manifest. This MUST be committed as its own step: phase-sec09/sec29 cleanup runs `git checkout -- .specify/level5/central-governance/`, which restored the bundle to HEAD on every gate run — so the fix only sticks once HEAD itself carries the corrected, re-signed bundle. sign-policy-bundle verify → POLICY_SIGNATURE_VALID. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>