v1.5.2 — Canonical ring system + Claude exemption + governed Antigravity connector

Bridge-layer release. No new MCP tools (still 82); the work lands in clients/.

Canonical ring system + Claude exemption

• bridge_core.rings is now the single source of truth: CANONICAL_RING_1 (33 reads), CANONICAL_RING_2 (10 governed writes), CANONICAL_COMMIT_TARGETS. The ring scope is identical for every external substrate reaching in (Grok, ChatGPT, Gemini, future).
• is_full_trust() — the Claude exemption. Claude-family substrates bypass ring governance entirely; every other substrate is ringed. Trust is the infrastructure: Claude operates the Stack natively, not through an airlock.

Governed Antigravity/Gemini connector

• clients/antigravity_connector is now ring-governed over stdio: Ring 1 proxied to the spawned sovereign, Ring 2 → pending proposal under ~/.sovereign/antigravity_connector/, Ring 3 refused, Claude full-trust bypass. Governed surface = 41 tools (down from raw 82), zero Ring 3 exposure.

Unification

• grok_bridge and openai_bridge now source their base ring scope from bridge_core.rings, ending the prior 33/31 (Ring 1) and 11/10 (Ring 2) drift. Grok keeps its extensions; openai equals canonical.
• Follow-up gate: wire openai verify_proposal/list_bridge_proposals local handlers before the next openai bridge restart (excluded from openai advertising until then).

Verified

Governed list 41 / zero Ring 3 leak; Ring 1 proxied; Ring 2 proposal does not reach the chronicle; Ring 3 refused; Claude full-trust bypass on list + call paths; grok smoke 62/62; openai 25/28 (== pre-existing baseline). Heartbeat reports 1.5.2 / 82.