From 2761555298877807ed34c01c7d820d332ed4ac08 Mon Sep 17 00:00:00 2001 From: Tom Softreck Date: Sat, 8 Aug 2026 23:51:24 +0200 Subject: [PATCH 01/11] docs(ticket-058): plan version identity repair --- TODO.md | 4 + project/TICKETS.md | 1 + project/ticket-058/README.md | 91 +++++++++++++++++++++++ project/ticket-058/ai-codex-logs.txt | 33 +++++++++ project/ticket-058/ai-codex.md | 50 +++++++++++++ project/ticket-058/changelog.md | 11 +++ project/ticket-058/intent.json | 105 +++++++++++++++++++++++++++ project/ticket-058/preprompt.md | 10 +++ 8 files changed, 305 insertions(+) create mode 100644 project/ticket-058/README.md create mode 100644 project/ticket-058/ai-codex-logs.txt create mode 100644 project/ticket-058/ai-codex.md create mode 100644 project/ticket-058/changelog.md create mode 100644 project/ticket-058/intent.json create mode 100644 project/ticket-058/preprompt.md diff --git a/TODO.md b/TODO.md index 43c00f7..a805d8c 100644 --- a/TODO.md +++ b/TODO.md @@ -9,6 +9,10 @@ ## Backlog tickets +- [ ] [`ticket-058`](project/ticket-058/README.md) — synchronize release, + runtime, SDK and generated-provenance version identity and add a deterministic + drift gate. Creation with `--force-new` was explicitly authorized; current + state: `PLAN / WAIT_FOR_APPROVAL`. - [ ] [`ticket-051`](project/ticket-051/README.md) — wire `scripts/github-event-log.mjs` into CI with explicit flags only. Current state: `PLAN / WAIT_FOR_APPROVAL`; ticket-048 is now merged. diff --git a/project/TICKETS.md b/project/TICKETS.md index f5e2b87..3de27f7 100644 --- a/project/TICKETS.md +++ b/project/TICKETS.md @@ -50,4 +50,5 @@ of `project/README.md`, which remains a generated technical-analysis artifact. | **ticket-054** | [`README.md`](./ticket-054/README.md) | [`preprompt.md`](./ticket-054/preprompt.md) | - | [`ai-codex.md`](./ticket-054/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-054/ai-codex-logs.txt) | [`changelog.md`](./ticket-054/changelog.md) | | **ticket-055** | [`README.md`](./ticket-055/README.md) | [`preprompt.md`](./ticket-055/preprompt.md) | - | [`ai-codex.md`](./ticket-055/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-055/ai-codex-logs.txt) | [`changelog.md`](./ticket-055/changelog.md) | | **ticket-056** | [`README.md`](./ticket-056/README.md) | [`preprompt.md`](./ticket-056/preprompt.md) | - | [`ai-codex.md`](./ticket-056/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-056/ai-codex-logs.txt) | [`changelog.md`](./ticket-056/changelog.md) | +| **ticket-058** | [`README.md`](./ticket-058/README.md) | [`preprompt.md`](./ticket-058/preprompt.md) | - | [`ai-codex.md`](./ticket-058/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-058/ai-codex-logs.txt) | [`changelog.md`](./ticket-058/changelog.md) | diff --git a/project/ticket-058/README.md b/project/ticket-058/README.md new file mode 100644 index 0000000..f76a143 --- /dev/null +++ b/project/ticket-058/README.md @@ -0,0 +1,91 @@ +# Ticket 058: Synchronize todo2code release and runtime version identity + +- **ID**: ticket-058 +- **Owner**: unresolved:human +- **Status**: PLAN +- **Workflow state**: WAIT_FOR_APPROVAL +- **Created**: 2026-08-08 + +## Goal and scope + +Restore one auditable todo2code release identity across the root release +metadata, SDK manifests, CLI output and every generated DSL provenance +envelope. Add a dependency-free integration gate that fails closed when a +future release updates only part of that identity. + +This ticket is the integration coordinator. Paths owned by `core-dsl`, +`extractors` and `runtime` must be corrected through separate governed tickets +that point back to ticket-058; this ticket does not transfer their ownership. + +## Verified regression + +At `main@738d7be93168fe73cccf14d3d589e545919c9a6f`: + +```text +package.json 0.5.1 +VERSION 0.5.1 +pyproject.toml 0.5.1 +Python/Rust/TypeScript SDKs 0.5.1 +src/core/version.ts 0.5.0 +t2c --version todo2code 0.5.0 +doDSL DevelopmentEvidenceDSL producerVersion 0.5.0 +``` + +Commit `99286994cc604e80b401fc16f4230e33e90df253` raised the release and +SDK metadata to `0.5.1` without changing the runtime constant. Several tests +then encoded `0.5.0` directly, so the normal suite preserved rather than +detected the drift. + +## Proposed delivery + +1. Add an integration-owned, dependency-free version-contract verifier and + focused tests under `scripts/`, then make it part of `npm run verify`. +2. Through a `core-dsl` ticket, align `T2C_VERSION` with the accepted release + identity. +3. Through `extractors` and `runtime` tickets, replace current-version literals + with the exported runtime identity where they assert current behavior. + Historical fixtures remain pinned when their old version is evidence. +4. Re-run the complete host, governance and Docker validation. +5. Rebuild the pinned todo2code runtime used by doDSL and prove that a new + DevelopmentEvidenceDSL bundle reports `producerVersion "0.5.1"` while + retaining its exact Git commit/tree and no authority or mutation effect. + +Ticket creation with `--force-new` was explicitly authorized by the human on +2026-08-08. That authorization permits this concurrent planning ticket; it is +not approval to edit implementation paths or weaken the active ticket limits. + +## Acceptance criteria + +- [ ] AC-01: A human approves this scope and the multi-workstream split. +- [ ] AC-02: Root release metadata, SDK manifests, `T2C_VERSION`, CLI output + and newly generated provenance all report the same accepted version. +- [ ] AC-03: A dependency-free verifier emits a stable diagnostic and non-zero + status for every supported version-identity mismatch. +- [ ] AC-04: Tests asserting the current runtime use the canonical exported + identity; deliberately historical fixtures remain visibly pinned. +- [ ] AC-05: `npm run verify`, governance, Docker smoke and both Docker E2E + profiles pass without skipped checks being counted as passes. +- [ ] AC-06: A fresh doDSL compile records todo2code `0.5.1`, an exact source + revision/tree and `AUTHORITY_EFFECT none` / `MUTATION_EFFECT none`. + +## Participants + +- Human participant: unresolved; no `user-*` file was created. +- Agent participant: [ai-codex.md](ai-codex.md). + +## Approval gate + +The ticket is in `PLAN / WAIT_FOR_APPROVAL`. No runtime, test, package, +dependency, Docker or external consumer file may be changed until explicit +approval of this plan. Because ticket-054 still reserves `integration`, this +ticket's integration implementation also waits for that reservation to be +released; distinct child workstreams may proceed only through their own +approved tickets. + +## Non-goals + +- No new release number, Git tag or package publication. +- No dependency, secret, AQL, Docker runtime or model configuration change. +- No reinterpretation of historical `0.5.0` fixtures as current evidence. +- No command execution or mutation authority derived from LLM output. +- No direct edit of paths owned by another workstream under ticket-058. diff --git a/project/ticket-058/ai-codex-logs.txt b/project/ticket-058/ai-codex-logs.txt new file mode 100644 index 0000000..f238180 --- /dev/null +++ b/project/ticket-058/ai-codex-logs.txt @@ -0,0 +1,33 @@ +2026-08-08 pre-implementation audit + +PASS repository state + main@738d7be93168fe73cccf14d3d589e545919c9a6f + original worktree clean before ticket allocation + +FAIL release identity consistency + package.json=0.5.1 + VERSION=0.5.1 + pyproject.toml=0.5.1 + sdk/python=0.5.1 + sdk/rust=0.5.1 + sdk/typescript=0.5.1 + src/core/version.ts=0.5.0 + dist CLI output=todo2code 0.5.0 + +EVIDENCE root cause + commit 99286994cc604e80b401fc16f4230e33e90df253 updated release and SDK + metadata from 0.5.0 to 0.5.1 but did not update src/core/version.ts + +EVIDENCE downstream observation + doDSL project dodsl-smoke reports producer=todo2code, producerVersion=0.5.0 + evidence URI=urn:onlydsl:development-evidence:sha256:7c65453adebf716a4e08aab09ed8f107e551f93232c011a61dfe5b47a55491ac + authorityEffect=none, mutationEffect=none + +AUTHORIZATION + Human explicitly approved creation of a concurrent integration ticket with + --force-new. Implementation approval has not been granted. + +No implementation path changed. State: WAIT_FOR_APPROVAL. + +PASS ./project/governance-check.sh + GOV-PASS: passed (0 errors, 0 warnings) diff --git a/project/ticket-058/ai-codex.md b/project/ticket-058/ai-codex.md new file mode 100644 index 0000000..b4087b8 --- /dev/null +++ b/project/ticket-058/ai-codex.md @@ -0,0 +1,50 @@ +--- +participant-id: agent:codex +participant: codex +role: agent +ticket: ticket-058 +--- +# Participant: codex (AI agent) + +## Understanding + +Todo2code currently has two simultaneously true but incompatible identities. +Release and SDK metadata say `0.5.1`, while the runtime constant, CLI and every +new provenance envelope say `0.5.0`. doDSL is not inventing the older value; +it reads it from the pinned todo2code CLI and binds it to the exact analysed Git +commit and tree. + +Changing one string would make the immediate output look correct but would not +prevent the next partial release. The repair therefore needs a deterministic +version contract plus removal of current-version literals from behavioral +tests. Historical artifacts must not be rewritten. + +## Execution plan after approval + +1. Create separate `core-dsl`, `extractors` and `runtime` tickets with + ticket-058 as their integration coordinator. +2. Align the core runtime version and replace only current-behavior literals in + the owning test workstreams. +3. Once the active integration reservation permits it, add the no-dependency + version verifier, focused negative fixtures and the root verify hook. +4. Run focused tests, `npm run verify`, governance, Docker smoke and both E2E + profiles. +5. Rebuild the todo2code image consumed by doDSL, compile a fresh candidate and + verify the resulting DevelopmentEvidenceDSL identity and safety fields. + +## Actual changes + +- Audited all release/runtime declarations at exact main HEAD. +- Identified the release commit that introduced the mismatch. +- Confirmed the live CLI emits `todo2code 0.5.0` while package and VERSION are + `0.5.1`. +- Confirmed doDSL faithfully persists that emitted producer version. +- Created planning evidence only; no implementation file changed. + +## Blockers + +- Explicit approval of this delivery plan is required. +- Ticket-054 currently reserves the `integration` workstream. The approved + `--force-new` exception created this PLAN ticket but does not silently + override active-scope enforcement. +- Each non-integration path requires its owning workstream ticket. diff --git a/project/ticket-058/changelog.md b/project/ticket-058/changelog.md new file mode 100644 index 0000000..29d62fe --- /dev/null +++ b/project/ticket-058/changelog.md @@ -0,0 +1,11 @@ +# Ticket Changelog (ticket-058) + +## [0.1.0] - 2026-08-08 + +- Created the explicitly authorized concurrent integration planning ticket. +- Recorded the exact `0.5.1` release metadata versus `0.5.0` runtime mismatch. +- Defined a multi-workstream repair with a dependency-free drift gate. +- Preserved the distinction between current-version assertions and historical + fixtures. +- Made no executable, runtime, dependency, Docker or consumer changes. +- Passed the repository governance check with zero errors and zero warnings. diff --git a/project/ticket-058/intent.json b/project/ticket-058/intent.json new file mode 100644 index 0000000..0b83bd7 --- /dev/null +++ b/project/ticket-058/intent.json @@ -0,0 +1,105 @@ +{ + "schema": "new-project.intent/v3", + "ticket": "ticket-058", + "summary": "Synchronize todo2code release and runtime version identity", + "workstream": "integration", + "classification": { + "kind": "BUG", + "priority": "P1", + "origin": "regression" + }, + "allowedPaths": [ + "project/ticket-058/**", + "TODO.md", + "project/TICKETS.md", + "package.json", + "scripts/verify-version-contract.mjs", + "scripts/verify-version-contract.test.mjs" + ], + "forbiddenPaths": [ + "project/ticket-*/user-*.md", + "src/**", + "test/**", + "sdk/**", + "Dockerfile*", + "compose*.yml", + ".env*" + ], + "stacks": ["node", "docker"], + "dependsOn": [], + "conflictsWith": ["ticket-054"], + "integrationTicket": null, + "delivery": { + "acceptedBaseSha": "738d7be93168fe73cccf14d3d589e545919c9a6f", + "targetBranch": "main", + "outcome": "Every current todo2code artifact exposes one release identity and a deterministic integration gate prevents partial future bumps", + "nonGoals": [ + "No new version, tag or publication", + "No dependency or runtime toolchain change", + "No rewrite of historical versioned evidence", + "No authority or command execution from model output" + ], + "complexity": "S", + "estimatedMinutes": 25, + "budgets": { + "maxImplementationFiles": 3, + "maxAffectedComponents": 2, + "maxPublicInterfaceChanges": 0, + "maxRuntimeDependencies": 0 + }, + "architecture": { + "status": "proposed", + "decision": "Treat release version as an integration contract, verify every declaration deterministically and let each workstream update only its owned current-version assertions", + "components": [ + { + "name": "version-contract-verifier", + "paths": [ + "scripts/verify-version-contract.mjs", + "scripts/verify-version-contract.test.mjs" + ] + }, + { + "name": "root-verification-orchestration", + "paths": ["package.json"] + } + ], + "responsibilityChanges": false, + "interfaceChanges": [], + "dataChanges": [ + "Current generated provenance changes from the stale runtime identity 0.5.0 to the accepted release identity 0.5.1" + ], + "ui": {"impact": "none", "states": [], "evidence": []}, + "rollback": "Remove the verifier hook and scripts; workstream-owned version corrections retain their own rollback and evidence" + }, + "runtimeDependencies": [], + "validation": [ + { + "criterion": "AC-03", + "commands": [ + "node --test scripts/verify-version-contract.test.mjs", + "node scripts/verify-version-contract.mjs" + ], + "evidence": "The verifier accepts one identity and fails each isolated mismatch with a stable diagnostic" + }, + { + "criterion": "AC-05", + "commands": [ + "npm run verify", + "./project/governance-check.sh", + "make docker-smoke", + "make e2e-core", + "make e2e-full" + ], + "evidence": "Host, policy and both Docker profiles pass without hidden fallback" + }, + { + "criterion": "AC-06", + "commands": [ + "doDSL compile with requireTodo2code=true", + "onlyDSL DevelopmentEvidenceDSL verification" + ], + "evidence": "A fresh immutable evidence bundle reports todo2code 0.5.1 and no authority or mutation effect" + } + ] + } +} diff --git a/project/ticket-058/preprompt.md b/project/ticket-058/preprompt.md new file mode 100644 index 0000000..78e20a4 --- /dev/null +++ b/project/ticket-058/preprompt.md @@ -0,0 +1,10 @@ +# Ticket preprompt + +- **Task ID**: ticket-058 +- **Task title**: Synchronize todo2code release and runtime version identity +- **Created**: 2026-08-08T21:46:52Z + +The human explicitly authorized creating this concurrent `integration` ticket +with `--force-new`. The approval applies to ticket creation, not implementation. +Keep executable implementation outside this governance/evidence directory and +respect every workstream's owned paths. From 132f87963921cd49dafa19b643b0528a3a434dd0 Mon Sep 17 00:00:00 2001 From: Tom Softreck Date: Sat, 8 Aug 2026 23:55:27 +0200 Subject: [PATCH 02/11] docs(ticket-058): record approved version repair plan --- TODO.md | 4 ++-- project/ticket-058/README.md | 17 ++++++++--------- project/ticket-058/ai-codex-logs.txt | 6 ++++++ project/ticket-058/ai-codex.md | 5 +++-- project/ticket-058/changelog.md | 3 +++ project/ticket-058/intent.json | 2 +- 6 files changed, 23 insertions(+), 14 deletions(-) diff --git a/TODO.md b/TODO.md index a805d8c..5b9284a 100644 --- a/TODO.md +++ b/TODO.md @@ -11,8 +11,8 @@ - [ ] [`ticket-058`](project/ticket-058/README.md) — synchronize release, runtime, SDK and generated-provenance version identity and add a deterministic - drift gate. Creation with `--force-new` was explicitly authorized; current - state: `PLAN / WAIT_FOR_APPROVAL`. + drift gate. Plan and owner-ticket creation are approved; current state: + `BLOCKED / WAIT_FOR_DEPENDENCIES` while ticket-054 reserves `integration`. - [ ] [`ticket-051`](project/ticket-051/README.md) — wire `scripts/github-event-log.mjs` into CI with explicit flags only. Current state: `PLAN / WAIT_FOR_APPROVAL`; ticket-048 is now merged. diff --git a/project/ticket-058/README.md b/project/ticket-058/README.md index f76a143..517bf6e 100644 --- a/project/ticket-058/README.md +++ b/project/ticket-058/README.md @@ -2,8 +2,8 @@ - **ID**: ticket-058 - **Owner**: unresolved:human -- **Status**: PLAN -- **Workflow state**: WAIT_FOR_APPROVAL +- **Status**: BLOCKED +- **Workflow state**: WAIT_FOR_DEPENDENCIES - **Created**: 2026-08-08 ## Goal and scope @@ -56,7 +56,7 @@ not approval to edit implementation paths or weaken the active ticket limits. ## Acceptance criteria -- [ ] AC-01: A human approves this scope and the multi-workstream split. +- [x] AC-01: A human approves this scope and the multi-workstream split. - [ ] AC-02: Root release metadata, SDK manifests, `T2C_VERSION`, CLI output and newly generated provenance all report the same accepted version. - [ ] AC-03: A dependency-free verifier emits a stable diagnostic and non-zero @@ -75,12 +75,11 @@ not approval to edit implementation paths or weaken the active ticket limits. ## Approval gate -The ticket is in `PLAN / WAIT_FOR_APPROVAL`. No runtime, test, package, -dependency, Docker or external consumer file may be changed until explicit -approval of this plan. Because ticket-054 still reserves `integration`, this -ticket's integration implementation also waits for that reservation to be -released; distinct child workstreams may proceed only through their own -approved tickets. +The human approved this plan and creation of the owner-workstream tickets on +2026-08-08. This ticket is now `BLOCKED / WAIT_FOR_DEPENDENCIES`: ticket-054 +still reserves `integration`, so the verifier and root verify-hook cannot enter +`EDIT`. Distinct child workstreams may proceed only through their own approved +tickets. Conversation approval is an audit note, not trusted merge authority. ## Non-goals diff --git a/project/ticket-058/ai-codex-logs.txt b/project/ticket-058/ai-codex-logs.txt index f238180..c2c075f 100644 --- a/project/ticket-058/ai-codex-logs.txt +++ b/project/ticket-058/ai-codex-logs.txt @@ -31,3 +31,9 @@ No implementation path changed. State: WAIT_FOR_APPROVAL. PASS ./project/governance-check.sh GOV-PASS: passed (0 errors, 0 warnings) + +2026-08-08 human plan decision + APPROVED ticket-058 plan + APPROVED creation of owner-workstream tickets + NOT trusted merge authorization + ticket-058 remains non-active while ticket-054 reserves integration diff --git a/project/ticket-058/ai-codex.md b/project/ticket-058/ai-codex.md index b4087b8..b54431d 100644 --- a/project/ticket-058/ai-codex.md +++ b/project/ticket-058/ai-codex.md @@ -40,11 +40,12 @@ tests. Historical artifacts must not be rewritten. `0.5.1`. - Confirmed doDSL faithfully persists that emitted producer version. - Created planning evidence only; no implementation file changed. +- Recorded the human approval of this plan and authorization to create the + three owner-workstream tickets. ## Blockers -- Explicit approval of this delivery plan is required. - Ticket-054 currently reserves the `integration` workstream. The approved - `--force-new` exception created this PLAN ticket but does not silently + `--force-new` exception created this ticket but does not silently override active-scope enforcement. - Each non-integration path requires its owning workstream ticket. diff --git a/project/ticket-058/changelog.md b/project/ticket-058/changelog.md index 29d62fe..b880580 100644 --- a/project/ticket-058/changelog.md +++ b/project/ticket-058/changelog.md @@ -9,3 +9,6 @@ fixtures. - Made no executable, runtime, dependency, Docker or consumer changes. - Passed the repository governance check with zero errors and zero warnings. +- Recorded human approval of the plan and owner-ticket creation. +- Moved to `BLOCKED / WAIT_FOR_DEPENDENCIES` until ticket-054 releases the + integration workstream. diff --git a/project/ticket-058/intent.json b/project/ticket-058/intent.json index 0b83bd7..eed31bf 100644 --- a/project/ticket-058/intent.json +++ b/project/ticket-058/intent.json @@ -48,7 +48,7 @@ "maxRuntimeDependencies": 0 }, "architecture": { - "status": "proposed", + "status": "accepted", "decision": "Treat release version as an integration contract, verify every declaration deterministically and let each workstream update only its owned current-version assertions", "components": [ { From 66b97a060fbef2a4bdbbfded23d137b32964463d Mon Sep 17 00:00:00 2001 From: Tom Softreck Date: Sun, 9 Aug 2026 00:02:26 +0200 Subject: [PATCH 03/11] docs(ticket-062): route Python test ownership safely --- TODO.md | 3 ++ project/TICKETS.md | 1 + project/ticket-062/README.md | 44 +++++++++++++++++++++++ project/ticket-062/ai-codex-logs.txt | 16 +++++++++ project/ticket-062/ai-codex.md | 35 +++++++++++++++++++ project/ticket-062/changelog.md | 10 ++++++ project/ticket-062/intent.json | 52 ++++++++++++++++++++++++++++ project/ticket-062/preprompt.md | 8 +++++ 8 files changed, 169 insertions(+) create mode 100644 project/ticket-062/README.md create mode 100644 project/ticket-062/ai-codex-logs.txt create mode 100644 project/ticket-062/ai-codex.md create mode 100644 project/ticket-062/changelog.md create mode 100644 project/ticket-062/intent.json create mode 100644 project/ticket-062/preprompt.md diff --git a/TODO.md b/TODO.md index 5b9284a..52c3e13 100644 --- a/TODO.md +++ b/TODO.md @@ -9,6 +9,9 @@ ## Backlog tickets +- [ ] [`ticket-062`](project/ticket-062/README.md) — route the unowned Python + SDK bridge test through protected governance evolution. Current state: + `PLAN / WAIT_FOR_APPROVAL`; coordinated by ticket-058. - [ ] [`ticket-058`](project/ticket-058/README.md) — synchronize release, runtime, SDK and generated-provenance version identity and add a deterministic drift gate. Plan and owner-ticket creation are approved; current state: diff --git a/project/TICKETS.md b/project/TICKETS.md index 3de27f7..8dd18f6 100644 --- a/project/TICKETS.md +++ b/project/TICKETS.md @@ -51,4 +51,5 @@ of `project/README.md`, which remains a generated technical-analysis artifact. | **ticket-055** | [`README.md`](./ticket-055/README.md) | [`preprompt.md`](./ticket-055/preprompt.md) | - | [`ai-codex.md`](./ticket-055/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-055/ai-codex-logs.txt) | [`changelog.md`](./ticket-055/changelog.md) | | **ticket-056** | [`README.md`](./ticket-056/README.md) | [`preprompt.md`](./ticket-056/preprompt.md) | - | [`ai-codex.md`](./ticket-056/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-056/ai-codex-logs.txt) | [`changelog.md`](./ticket-056/changelog.md) | | **ticket-058** | [`README.md`](./ticket-058/README.md) | [`preprompt.md`](./ticket-058/preprompt.md) | - | [`ai-codex.md`](./ticket-058/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-058/ai-codex-logs.txt) | [`changelog.md`](./ticket-058/changelog.md) | +| **ticket-062** | [`README.md`](./ticket-062/README.md) | [`preprompt.md`](./ticket-062/preprompt.md) | - | [`ai-codex.md`](./ticket-062/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-062/ai-codex-logs.txt) | [`changelog.md`](./ticket-062/changelog.md) | diff --git a/project/ticket-062/README.md b/project/ticket-062/README.md new file mode 100644 index 0000000..7a90f8a --- /dev/null +++ b/project/ticket-062/README.md @@ -0,0 +1,44 @@ +# Ticket 062: Assign Python runtime bridge test to SDK workstream + +- **ID**: ticket-062 +- **Owner**: unresolved:human +- **Status**: PLAN +- **Workflow state**: WAIT_FOR_APPROVAL +- **Created**: 2026-08-08 + +## Goal and scope + +Resolve the missing workstream ownership for `test/python-runtime.test.ts` +without directly editing a lock-protected governance manifest. The path tests +the Python SDK bridge and should belong to `sdk`, but no current ownership glob +matches it. + +`.governance/manifest.json` is bound by the immutable standard lock. A local +hash edit would weaken the trust boundary, so this ticket records and routes +the required upstream extension/adoption instead of modifying authority. + +## Acceptance criteria + +- [ ] AC-01: A human approves routing this ownership gap through the protected + governance adoption path. +- [ ] AC-02: A published governance mechanism assigns the Python runtime bridge + test to `sdk` without hand-editing managed hashes. +- [ ] AC-03: The complete managed set is adopted atomically and governance + passes before ticket-063 enters `EDIT`. +- [ ] AC-04: No application or test behavior changes in this ticket. + +## Participants + +- Human participant: unresolved; no `user-*` file was created. +- Agent participant: [ai-codex.md](ai-codex.md). + +## Approval gate + +Ticket-058 approval authorized discovery and ticket creation. It did not +authorize modification of governance authority or its lock. + +## Non-goals + +- No direct `.governance/manifest.json` or lock hash edit. +- No test, runtime, SDK, dependency or Docker change. +- No authority change proposed or generated by an LLM. diff --git a/project/ticket-062/ai-codex-logs.txt b/project/ticket-062/ai-codex-logs.txt new file mode 100644 index 0000000..635a14c --- /dev/null +++ b/project/ticket-062/ai-codex-logs.txt @@ -0,0 +1,16 @@ +2026-08-08 pre-implementation evidence + +FAIL ownership resolution + test/python-runtime.test.ts matches no declared workstream path + +PROTECTED BOUNDARY + .governance/manifest.json digest is pinned by manifest.lock.json + direct local edit would fail GOV-SYNC-001 + +DECISION + route through published governance extension/adoption; do not edit hashes + +No governance or implementation file changed. State: WAIT_FOR_APPROVAL. + +PASS ./project/governance-check.sh + GOV-PASS: passed (0 errors, 0 warnings) diff --git a/project/ticket-062/ai-codex.md b/project/ticket-062/ai-codex.md new file mode 100644 index 0000000..8130431 --- /dev/null +++ b/project/ticket-062/ai-codex.md @@ -0,0 +1,35 @@ +--- +participant-id: agent:codex +participant: codex +role: agent +ticket: ticket-062 +--- +# Participant: codex (AI agent) + +## Understanding + +The Python bridge test has no matching owner in the current manifest. Directly +adding a glob is not safe because the manifest is checked against an immutable +managed-file digest. Ownership must come through a protected upstream contract +or a supported project-extension mechanism. + +## Execution plan + +1. Wait for explicit approval of the escalation route. +2. Open or reuse an upstream governance ticket for a project-specific ownership + extension that does not weaken managed-file verification. +3. Adopt the published revision atomically through the existing protected + standard-adoption flow. +4. Re-run governance and unblock ticket-063 only after `sdk` ownership is + deterministic. + +## Actual changes + +- Proved the path is unowned by the current workstream globs. +- Proved the manifest is protected by the immutable standard lock. +- Made no governance, implementation or test change. + +## Blockers + +- Human approval of the protected escalation route is required. +- A published upstream governance revision or supported extension is required. diff --git a/project/ticket-062/changelog.md b/project/ticket-062/changelog.md new file mode 100644 index 0000000..e9ac8a4 --- /dev/null +++ b/project/ticket-062/changelog.md @@ -0,0 +1,10 @@ +# Ticket Changelog (ticket-062) + +## [0.1.0] - 2026-08-08 + +- Initial governance scaffold created. +- No human participant identity or content was generated. +- Recorded the unowned Python SDK bridge test and immutable-lock constraint. +- Selected protected upstream extension/adoption instead of a local authority + edit. +- Passed governance with zero errors and zero warnings. diff --git a/project/ticket-062/intent.json b/project/ticket-062/intent.json new file mode 100644 index 0000000..1056ab7 --- /dev/null +++ b/project/ticket-062/intent.json @@ -0,0 +1,52 @@ +{ + "schema": "new-project.intent/v3", + "ticket": "ticket-062", + "summary": "Assign Python runtime bridge test to SDK workstream", + "workstream": "governance", + "classification": { + "kind": "BUG", + "priority": "P1", + "origin": "regression" + }, + "allowedPaths": ["project/ticket-062/**", "TODO.md", "project/TICKETS.md"], + "forbiddenPaths": [ + "project/ticket-*/user-*.md", + ".governance/**", + "AGENTS.md", + "src/**", + "test/**", + "sdk/**", + "package.json", + "package-lock.json", + "Dockerfile*", + "compose*.yml", + ".env*" + ], + "stacks": [], + "dependsOn": ["ticket-058"], + "conflictsWith": [], + "integrationTicket": "ticket-058", + "delivery": { + "acceptedBaseSha": "132f87963921cd49dafa19b643b0528a3a434dd0", + "targetBranch": "main", + "outcome": "The Python SDK bridge test receives deterministic SDK ownership through a protected published governance contract", + "nonGoals": ["No local managed-hash edit", "No application or test change", "No dependency, Docker or authority weakening"], + "complexity": "XS", + "estimatedMinutes": 15, + "budgets": {"maxImplementationFiles": 0, "maxAffectedComponents": 1, "maxPublicInterfaceChanges": 0, "maxRuntimeDependencies": 0}, + "architecture": { + "status": "proposed", + "decision": "Route the ownership gap through protected standard evolution rather than editing the locked target manifest", + "components": [{"name": "workstream-ownership-routing", "paths": ["project/ticket-062/**"]}], + "responsibilityChanges": true, + "interfaceChanges": [], + "dataChanges": [], + "ui": {"impact": "none", "states": [], "evidence": []}, + "rollback": "Close this routing ticket if an existing published extension already assigns the path safely" + }, + "runtimeDependencies": [], + "validation": [ + {"criterion": "AC-03", "commands": ["./project/governance-check.sh"], "evidence": "The adopted managed set passes immutable lock and workstream ownership checks"} + ] + } +} diff --git a/project/ticket-062/preprompt.md b/project/ticket-062/preprompt.md new file mode 100644 index 0000000..ef2feca --- /dev/null +++ b/project/ticket-062/preprompt.md @@ -0,0 +1,8 @@ +# Ticket preprompt + +- **Task ID**: ticket-062 +- **Task title**: Assign Python runtime bridge test to SDK workstream +- **Created**: 2026-08-08T21:56:33Z + +Keep executable implementation outside this governance/evidence directory. +Read a human-owned user-*.md file only when one exists. From bcc252d336b371809097e534323bf4de2cede76a Mon Sep 17 00:00:00 2001 From: Tom Softreck Date: Sun, 9 Aug 2026 00:09:49 +0200 Subject: [PATCH 04/11] docs(ticket-062): record approved blocked route --- TODO.md | 2 +- project/ticket-062/README.md | 11 ++++++----- project/ticket-062/ai-codex-logs.txt | 5 +++++ project/ticket-062/ai-codex.md | 3 ++- project/ticket-062/changelog.md | 2 ++ project/ticket-062/intent.json | 4 ++-- 6 files changed, 18 insertions(+), 9 deletions(-) diff --git a/TODO.md b/TODO.md index 52c3e13..215a1fe 100644 --- a/TODO.md +++ b/TODO.md @@ -11,7 +11,7 @@ - [ ] [`ticket-062`](project/ticket-062/README.md) — route the unowned Python SDK bridge test through protected governance evolution. Current state: - `PLAN / WAIT_FOR_APPROVAL`; coordinated by ticket-058. + `BLOCKED / WAIT_FOR_EXTERNAL`; coordinated by ticket-058. - [ ] [`ticket-058`](project/ticket-058/README.md) — synchronize release, runtime, SDK and generated-provenance version identity and add a deterministic drift gate. Plan and owner-ticket creation are approved; current state: diff --git a/project/ticket-062/README.md b/project/ticket-062/README.md index 7a90f8a..8a6cd2e 100644 --- a/project/ticket-062/README.md +++ b/project/ticket-062/README.md @@ -2,8 +2,8 @@ - **ID**: ticket-062 - **Owner**: unresolved:human -- **Status**: PLAN -- **Workflow state**: WAIT_FOR_APPROVAL +- **Status**: BLOCKED +- **Workflow state**: WAIT_FOR_EXTERNAL - **Created**: 2026-08-08 ## Goal and scope @@ -19,7 +19,7 @@ the required upstream extension/adoption instead of modifying authority. ## Acceptance criteria -- [ ] AC-01: A human approves routing this ownership gap through the protected +- [x] AC-01: A human approves routing this ownership gap through the protected governance adoption path. - [ ] AC-02: A published governance mechanism assigns the Python runtime bridge test to `sdk` without hand-editing managed hashes. @@ -34,8 +34,9 @@ the required upstream extension/adoption instead of modifying authority. ## Approval gate -Ticket-058 approval authorized discovery and ticket creation. It did not -authorize modification of governance authority or its lock. +The human approved the protected routing plan on 2026-08-09. The ticket remains +non-active and makes no authority change while it waits for a published +upstream mechanism or existing supported extension. ## Non-goals diff --git a/project/ticket-062/ai-codex-logs.txt b/project/ticket-062/ai-codex-logs.txt index 635a14c..9f9cb0a 100644 --- a/project/ticket-062/ai-codex-logs.txt +++ b/project/ticket-062/ai-codex-logs.txt @@ -14,3 +14,8 @@ No governance or implementation file changed. State: WAIT_FOR_APPROVAL. PASS ./project/governance-check.sh GOV-PASS: passed (0 errors, 0 warnings) + +2026-08-09 approval + APPROVED protected ownership-routing plan + NO authority or managed-lock edit authorized + state BLOCKED / WAIT_FOR_EXTERNAL diff --git a/project/ticket-062/ai-codex.md b/project/ticket-062/ai-codex.md index 8130431..394ade3 100644 --- a/project/ticket-062/ai-codex.md +++ b/project/ticket-062/ai-codex.md @@ -28,8 +28,9 @@ or a supported project-extension mechanism. - Proved the path is unowned by the current workstream globs. - Proved the manifest is protected by the immutable standard lock. - Made no governance, implementation or test change. +- Human approved the routing plan on 2026-08-09; status is + `BLOCKED / WAIT_FOR_EXTERNAL`. ## Blockers -- Human approval of the protected escalation route is required. - A published upstream governance revision or supported extension is required. diff --git a/project/ticket-062/changelog.md b/project/ticket-062/changelog.md index e9ac8a4..7cc76cf 100644 --- a/project/ticket-062/changelog.md +++ b/project/ticket-062/changelog.md @@ -8,3 +8,5 @@ - Selected protected upstream extension/adoption instead of a local authority edit. - Passed governance with zero errors and zero warnings. +- Recorded human approval and moved to `BLOCKED / WAIT_FOR_EXTERNAL` without + changing governance authority. diff --git a/project/ticket-062/intent.json b/project/ticket-062/intent.json index 1056ab7..480a8ee 100644 --- a/project/ticket-062/intent.json +++ b/project/ticket-062/intent.json @@ -23,7 +23,7 @@ ".env*" ], "stacks": [], - "dependsOn": ["ticket-058"], + "dependsOn": [], "conflictsWith": [], "integrationTicket": "ticket-058", "delivery": { @@ -35,7 +35,7 @@ "estimatedMinutes": 15, "budgets": {"maxImplementationFiles": 0, "maxAffectedComponents": 1, "maxPublicInterfaceChanges": 0, "maxRuntimeDependencies": 0}, "architecture": { - "status": "proposed", + "status": "accepted", "decision": "Route the ownership gap through protected standard evolution rather than editing the locked target manifest", "components": [{"name": "workstream-ownership-routing", "paths": ["project/ticket-062/**"]}], "responsibilityChanges": true, From cd33f03ee1fae9c1d372a939f3b147d52814661b Mon Sep 17 00:00:00 2001 From: Tom Softreck Date: Sun, 9 Aug 2026 00:20:56 +0200 Subject: [PATCH 05/11] docs(ticket-062): link governed upstream extension --- project/ticket-062/README.md | 17 +++++++++++++++++ project/ticket-062/ai-codex-logs.txt | 13 +++++++++++++ project/ticket-062/ai-codex.md | 9 ++++++++- 3 files changed, 38 insertions(+), 1 deletion(-) diff --git a/project/ticket-062/README.md b/project/ticket-062/README.md index 8a6cd2e..939eccf 100644 --- a/project/ticket-062/README.md +++ b/project/ticket-062/README.md @@ -38,6 +38,23 @@ The human approved the protected routing plan on 2026-08-09. The ticket remains non-active and makes no authority change while it waits for a published upstream mechanism or existing supported extension. +The matching upstream owner is the existing +`wellmanifest/new-project:ticket-024`; no competing governance ticket was +created. Its expanded plan is published on +`ticket/024-extendable-target-manifest@e538ec0` and remains +`PLAN / WAIT_FOR_APPROVAL`. The proposed contract separates a hash-bound +`.governance/manifest.base.json` from the target-extendable +`.governance/manifest.json` and validates the extension fail-closed. + +## Integration evidence + +A temporary combination of tickets 059, 060 and 061 passed every pre-test gate +of `npm run verify`. The only observed test failure was the still-literal +Python bridge assertion in `test/python-runtime.test.ts`: corrected runtime +output is `todo2code 0.5.1`, while the unowned test still expects `0.5.0`. +Ticket 063 owns that assertion but cannot enter `EDIT` until this ticket has +adopted a published upstream mechanism and governance passes. + ## Non-goals - No direct `.governance/manifest.json` or lock hash edit. diff --git a/project/ticket-062/ai-codex-logs.txt b/project/ticket-062/ai-codex-logs.txt index 9f9cb0a..2604b4e 100644 --- a/project/ticket-062/ai-codex-logs.txt +++ b/project/ticket-062/ai-codex-logs.txt @@ -19,3 +19,16 @@ PASS ./project/governance-check.sh APPROVED protected ownership-routing plan NO authority or managed-lock edit authorized state BLOCKED / WAIT_FOR_EXTERNAL + +2026-08-09 upstream routing + REUSED wellmanifest/new-project:ticket-024 + PLAN ticket/024-extendable-target-manifest@e538ec0 + STATUS PLAN / WAIT_FOR_APPROVAL + DESIGN managed manifest.base.json + target-extendable manifest.json + NO upstream implementation or release mutation performed + +2026-08-09 combined validation + npm run verify pre-test gates PASS for temporary 059+060+061 combination + ONLY OBSERVED FAILURE test/python-runtime.test.ts expects todo2code 0.5.0 + ACTUAL corrected CLI identity todo2code 0.5.1 + OWNER ticket-063, blocked by ticket-062 governance ownership diff --git a/project/ticket-062/ai-codex.md b/project/ticket-062/ai-codex.md index 394ade3..68275c4 100644 --- a/project/ticket-062/ai-codex.md +++ b/project/ticket-062/ai-codex.md @@ -27,10 +27,17 @@ or a supported project-extension mechanism. - Proved the path is unowned by the current workstream globs. - Proved the manifest is protected by the immutable standard lock. +- Reused upstream `wellmanifest/new-project:ticket-024` and published its + expanded planning branch at + `ticket/024-extendable-target-manifest@e538ec0`; no duplicate ticket exists. +- Recorded the combined 059+060+061 validation: every pre-test gate passed and + the only observed test failure is the ticket-063 assertion blocked by this + ownership gap. - Made no governance, implementation or test change. - Human approved the routing plan on 2026-08-09; status is `BLOCKED / WAIT_FOR_EXTERNAL`. ## Blockers -- A published upstream governance revision or supported extension is required. +- Explicit approval and implementation of upstream ticket-024, followed by a + published immutable revision and protected downstream adoption, are required. From 6db96799c93aadb55c274dbb0fb7ce46e06bf466 Mon Sep 17 00:00:00 2001 From: Tom Softreck Date: Sun, 9 Aug 2026 00:39:33 +0200 Subject: [PATCH 06/11] docs(ticket-062): track upstream validation PR --- project/ticket-062/README.md | 10 +++++++--- project/ticket-062/ai-codex-logs.txt | 7 +++++++ project/ticket-062/ai-codex.md | 7 +++++-- 3 files changed, 19 insertions(+), 5 deletions(-) diff --git a/project/ticket-062/README.md b/project/ticket-062/README.md index 939eccf..b06fba5 100644 --- a/project/ticket-062/README.md +++ b/project/ticket-062/README.md @@ -40,9 +40,13 @@ upstream mechanism or existing supported extension. The matching upstream owner is the existing `wellmanifest/new-project:ticket-024`; no competing governance ticket was -created. Its expanded plan is published on -`ticket/024-extendable-target-manifest@e538ec0` and remains -`PLAN / WAIT_FOR_APPROVAL`. The proposed contract separates a hash-bound +created. Its expanded plan was published as +`ticket/024-extendable-target-manifest@e538ec0`, approved independently and +implemented. The implementation is now published as +`wellmanifest/new-project#67` at exact head +`3d7ac45bb4359db96dba2825c3654fdb47c5b483`. Linux `test` and +`windows-governance` both pass; the PR correctly remains blocked on an +independent exact-head review. The contract separates a hash-bound `.governance/manifest.base.json` from the target-extendable `.governance/manifest.json` and validates the extension fail-closed. diff --git a/project/ticket-062/ai-codex-logs.txt b/project/ticket-062/ai-codex-logs.txt index 2604b4e..46eb8fb 100644 --- a/project/ticket-062/ai-codex-logs.txt +++ b/project/ticket-062/ai-codex-logs.txt @@ -32,3 +32,10 @@ PASS ./project/governance-check.sh ONLY OBSERVED FAILURE test/python-runtime.test.ts expects todo2code 0.5.0 ACTUAL corrected CLI identity todo2code 0.5.1 OWNER ticket-063, blocked by ticket-062 governance ownership + +2026-08-09 upstream implementation + PR https://github.com/wellmanifest/new-project/pull/67 + HEAD 3d7ac45bb4359db96dba2825c3654fdb47c5b483 + PASS Linux test + PASS windows-governance + WAIT independent exact-head review, merge, immutable release and adoption diff --git a/project/ticket-062/ai-codex.md b/project/ticket-062/ai-codex.md index 68275c4..768bb6b 100644 --- a/project/ticket-062/ai-codex.md +++ b/project/ticket-062/ai-codex.md @@ -30,6 +30,8 @@ or a supported project-extension mechanism. - Reused upstream `wellmanifest/new-project:ticket-024` and published its expanded planning branch at `ticket/024-extendable-target-manifest@e538ec0`; no duplicate ticket exists. +- Upstream implementation PR #67 is open at exact head `3d7ac45`; Linux and + Windows checks pass, and independent review is still required before merge. - Recorded the combined 059+060+061 validation: every pre-test gate passed and the only observed test failure is the ticket-063 assertion blocked by this ownership gap. @@ -39,5 +41,6 @@ or a supported project-extension mechanism. ## Blockers -- Explicit approval and implementation of upstream ticket-024, followed by a - published immutable revision and protected downstream adoption, are required. +- Independent exact-head approval and merge of upstream ticket-024, followed + by a published immutable revision and protected downstream adoption, are + required. From bb15d82b4d1db13cea4690b22abf4e2362058f29 Mon Sep 17 00:00:00 2001 From: Tom Softreck Date: Sun, 9 Aug 2026 00:49:48 +0200 Subject: [PATCH 07/11] docs(ticket-062): await immutable upstream release --- project/ticket-062/README.md | 11 +++++++++-- project/ticket-062/ai-codex-logs.txt | 12 ++++++++++++ project/ticket-062/ai-codex.md | 12 +++++++----- 3 files changed, 28 insertions(+), 7 deletions(-) diff --git a/project/ticket-062/README.md b/project/ticket-062/README.md index b06fba5..7323269 100644 --- a/project/ticket-062/README.md +++ b/project/ticket-062/README.md @@ -45,11 +45,18 @@ created. Its expanded plan was published as implemented. The implementation is now published as `wellmanifest/new-project#67` at exact head `3d7ac45bb4359db96dba2825c3654fdb47c5b483`. Linux `test` and -`windows-governance` both pass; the PR correctly remains blocked on an -independent exact-head review. The contract separates a hash-bound +`windows-governance` passed, the independent Validator approved the exact +head, and the implementation merged as `main@2fbf23f`. Closure PR #68 passed +the same protected gates and merged as `main@a70b5b8`; upstream ticket-024 is +`DONE / DONE`. The contract separates a hash-bound `.governance/manifest.base.json` from the target-extendable `.governance/manifest.json` and validates the extension fail-closed. +The remaining publication owner is upstream `ticket-044`, planned on +`ticket/044-publish-extendable-manifest@cac0ddb` as immutable minor `v0.14.0`. +It remains `PLAN / WAIT_FOR_APPROVAL`; no tag, release or downstream adoption +has been performed. + ## Integration evidence A temporary combination of tickets 059, 060 and 061 passed every pre-test gate diff --git a/project/ticket-062/ai-codex-logs.txt b/project/ticket-062/ai-codex-logs.txt index 46eb8fb..6367989 100644 --- a/project/ticket-062/ai-codex-logs.txt +++ b/project/ticket-062/ai-codex-logs.txt @@ -39,3 +39,15 @@ PASS ./project/governance-check.sh PASS Linux test PASS windows-governance WAIT independent exact-head review, merge, immutable release and adoption + +2026-08-09 upstream completion + APPROVED exact head 3d7ac45bb4359db96dba2825c3654fdb47c5b483 + MERGED implementation PR #67 as main@2fbf23fb3abc6c62f04b22b012f6138922fd05a4 + MERGED closure PR #68 as main@a70b5b84f6005353426cd4ddb80d7086c671c364 + STATUS upstream ticket-024 DONE / DONE + +2026-08-09 release dependency + PLAN wellmanifest/new-project:ticket-044@cac0ddb + TARGET immutable v0.14.0 + STATUS PLAN / WAIT_FOR_APPROVAL + NO tag, GitHub Release or downstream adoption performed diff --git a/project/ticket-062/ai-codex.md b/project/ticket-062/ai-codex.md index 768bb6b..386442c 100644 --- a/project/ticket-062/ai-codex.md +++ b/project/ticket-062/ai-codex.md @@ -30,8 +30,11 @@ or a supported project-extension mechanism. - Reused upstream `wellmanifest/new-project:ticket-024` and published its expanded planning branch at `ticket/024-extendable-target-manifest@e538ec0`; no duplicate ticket exists. -- Upstream implementation PR #67 is open at exact head `3d7ac45`; Linux and - Windows checks pass, and independent review is still required before merge. +- Upstream implementation PR #67 at exact head `3d7ac45` passed Linux, + Windows and independent review; it merged as `main@2fbf23f`, and closure PR + #68 merged as `main@a70b5b8`. +- Created upstream publication plan ticket-044 at `cac0ddb`; it requires + separate approval before immutable v0.14.0 publication. - Recorded the combined 059+060+061 validation: every pre-test gate passed and the only observed test failure is the ticket-063 assertion blocked by this ownership gap. @@ -41,6 +44,5 @@ or a supported project-extension mechanism. ## Blockers -- Independent exact-head approval and merge of upstream ticket-024, followed - by a published immutable revision and protected downstream adoption, are - required. +- Approval and execution of upstream release ticket-044, followed by protected + exact-SHA downstream adoption, are required. From 81ff1656ea95103186964b46289d702aed4a73eb Mon Sep 17 00:00:00 2001 From: Tom Softreck Date: Sun, 9 Aug 2026 01:09:32 +0200 Subject: [PATCH 08/11] governance: adopt extendable manifest contract --- .governance/governance_check.py | 77 ++++++- .governance/manifest.base.json | 117 ++++++++++ .governance/manifest.json | 328 +++++++++++++++++++-------- .governance/manifest.lock.json | 10 +- .governance/package-manifest.json | 3 +- TODO.md | 3 +- project/ticket-062/README.md | 26 ++- project/ticket-062/ai-codex-logs.txt | 9 + project/ticket-062/ai-codex.md | 16 +- project/ticket-062/changelog.md | 7 + project/ticket-062/intent.json | 25 +- 11 files changed, 496 insertions(+), 125 deletions(-) create mode 100644 .governance/manifest.base.json diff --git a/.governance/governance_check.py b/.governance/governance_check.py index 6bf369c..256382e 100644 --- a/.governance/governance_check.py +++ b/.governance/governance_check.py @@ -913,6 +913,29 @@ def check_managed_file(root: Path, raw_path: str, expected: str, report: Report) ) +def extension_error(required: Any, candidate: Any, path: str = "$") -> str | None: + if isinstance(required, dict): + if not isinstance(candidate, dict): + return f"{path} must remain an object" + for key, value in required.items(): + if key not in candidate: + return f"{path}/{key} is required by the managed base" + error = extension_error(value, candidate[key], f"{path}/{key}") + if error: + return error + return None + if isinstance(required, list): + if not isinstance(candidate, list): + return f"{path} must remain an array" + for value in required: + if value not in candidate: + return f"{path} removed a value required by the managed base" + return None + if candidate != required: + return f"{path} differs from the managed base" + return None + + def check_lock( root: Path, lock_path: Path | None, @@ -935,6 +958,40 @@ def check_lock( return for raw_path, expected in sorted(managed.items()): check_managed_file(root, raw_path, expected, report) + package_path = root / ".governance/package-manifest.json" + if not package_path.is_file(): + return + try: + strategies = package_strategies(package_path.read_bytes()) + except (OSError, ValueError, json.JSONDecodeError) as error: + report.add( + "GOV-SYNC-001", f"Governance package manifest is invalid: {error}", + "Restore the pinned package manifest through an explicit standard upgrade.", + [rel(root, package_path)], + ) + return + manifest_target = ".governance/manifest.json" + base_target = ".governance/manifest.base.json" + if strategies.get(manifest_target) != "extendable": + return + if strategies.get(base_target) != "managed" or base_target not in managed: + report.add( + "GOV-SYNC-001", "Extendable governance manifest has no hash-bound managed base.", + "Adopt the complete published package including manifest.base.json.", + [base_target, manifest_target], + ) + return + try: + base = load_json(safe_repo_path(root, base_target)) + error = extension_error(base, manifest) + except (OSError, ValueError, json.JSONDecodeError) as load_error: + error = f"managed manifest base is invalid: {load_error}" + if error: + report.add( + "GOV-SYNC-001", f"Target governance manifest violates its managed base: {error}", + "Restore standard-owned values; keep target changes inside the declared extension fields.", + [base_target, manifest_target], + ) def parse_ticket_state(readme: Path) -> tuple[str | None, str | None]: @@ -2248,10 +2305,16 @@ def package_entry(item: Any) -> tuple[str, str, str]: raise ValueError("package manifest entry is invalid") if not relative_pattern(source) or not relative_pattern(target): raise ValueError("package manifest entry is invalid") - if item.get("strategy") not in {"managed", "seed"}: + if item.get("strategy") not in {"managed", "seed", "extendable"}: raise ValueError("package manifest entry is invalid") if not isinstance(item.get("executable"), bool): raise ValueError("package manifest entry is invalid") + if item.get("strategy") == "extendable" and ( + source != "governance/manifest.default.json" + or target != ".governance/manifest.json" + or item.get("executable") + ): + raise ValueError("package manifest extendable target is invalid") return source, target, item["strategy"] @@ -2262,12 +2325,10 @@ def package_strategies(content: bytes) -> dict[str, str]: if document.get("schema") != "new-project.package-manifest/v1" or not isinstance(document.get("files"), list): raise ValueError("package manifest schema is invalid") strategies: dict[str, str] = {} - sources: set[str] = set() for item in document["files"]: source, target, strategy = package_entry(item) - if source in sources or target in strategies: - raise ValueError("package manifest paths must be unique") - sources.add(source) + if target in strategies: + raise ValueError("package manifest targets must be unique") strategies[target] = strategy if not strategies: raise ValueError("package manifest is empty") @@ -2341,7 +2402,11 @@ def load_standard_adoption_evidence( head_strategies = package_strategies(head_package_path.read_bytes()) base_hashes = adoption_lock(base_lock_content, adoption["fromRevision"]) head_hashes = adoption_lock(head_lock_path.read_bytes(), adoption["toRevision"]) - if set(base_hashes) != set(base_strategies) or set(head_hashes) != set(head_strategies): + base_managed = {path for path, strategy in base_strategies.items() if strategy == "managed"} + head_managed = {path for path, strategy in head_strategies.items() if strategy == "managed"} + if frozenset(base_hashes) not in {frozenset(base_strategies), frozenset(base_managed)}: + raise ValueError("base package targets and lock targets differ") + if set(head_hashes) != head_managed: raise ValueError("package targets and lock targets differ") return base_strategies, head_strategies, base_hashes, head_hashes diff --git a/.governance/manifest.base.json b/.governance/manifest.base.json new file mode 100644 index 0000000..647b9b6 --- /dev/null +++ b/.governance/manifest.base.json @@ -0,0 +1,117 @@ +{ + "approvalEvidence": { + "requiredBindings": [ + "repository", + "pullRequest", + "headSha", + "ticket", + "actor" + ], + "reviewVerificationMethod": "github-api-allowlist", + "schema": "new-project.approval-evidence/v1", + "signedAttestationPredicateType": "https://wellmanifest.dev/attestations/validator/v1" + }, + "coordination": { + "integration": { + "workstream": "integration" + }, + "maxActiveTicketsPerWorkstream": 1, + "mode": "workstreams", + "rejectActiveScopeOverlap": true + }, + "delivery": { + "allowedComplexityClasses": [ + "XS", + "S" + ], + "checkpointMinutes": 25, + "dependencyManifestPaths": [ + "package.json", + "pyproject.toml", + "go.mod", + "Cargo.toml", + "pom.xml" + ], + "maxActiveMinutes": 30, + "maxAffectedComponents": 2, + "maxImplementationFiles": 5, + "maxPublicInterfaceChanges": 0, + "maxRuntimeDependencies": 0, + "targetBranches": [ + "main" + ] + }, + "docker": { + "composeFiles": [ + "compose.yml", + "docker-compose.yml", + "compose.e2e.yml" + ], + "dockerfiles": [ + "Dockerfile", + "Dockerfile.e2e" + ], + "required": true + }, + "governancePaths": [ + "TODO.md", + "project/TICKETS.md", + "project/ticket-*/**" + ], + "requiredFiles": [ + "README.md", + "VERSION", + "CHANGELOG.md", + "TODO.md", + "AGENTS.md", + "Dockerfile", + "project/TICKETS.md", + "project/new-ticket.sh", + "project/readme.sh" + ], + "schema": "new-project.governance/v2", + "stacks": [ + "docker" + ], + "standard": { + "id": "wellmanifest/new-project", + "version": "0.14.0" + }, + "ticket": { + "activeStatuses": [ + "IN_PROGRESS" + ], + "closedStatuses": [ + "DONE", + "CANCELLED" + ], + "directoryPattern": "^ticket-[0-9]{3}$", + "implementationStates": [ + "EDIT", + "VALIDATION", + "PUBLICATION" + ], + "intentFile": "intent.json", + "nonActiveStatuses": [ + "BACKLOG", + "PLAN", + "BLOCKED" + ], + "requiredAgentFiles": [ + "ai-*.md", + "ai-*-logs.txt" + ], + "requiredFiles": [ + "README.md", + "preprompt.md", + "changelog.md", + "intent.json" + ], + "root": "project" + }, + "trustedApprovalSources": [ + "github-review", + "github-app-review", + "signed-attestation" + ] +} diff --git a/.governance/manifest.json b/.governance/manifest.json index fa0e2cb..11d90b5 100644 --- a/.governance/manifest.json +++ b/.governance/manifest.json @@ -1,66 +1,6 @@ { "$schema": "manifest.schema.json", - "schema": "new-project.governance/v2", - "standard": { - "id": "wellmanifest/new-project", - "version": "0.13.2" - }, - "requiredFiles": [ - "README.md", - "VERSION", - "CHANGELOG.md", - "TODO.md", - "AGENTS.md", - "Dockerfile", - "project/TICKETS.md", - "project/new-ticket.sh", - "project/readme.sh", - "project/governance-check.sh" - ], - "governancePaths": [ - "TODO.md", - "project/TICKETS.md", - "project/ticket-*/**" - ], - "trustedApprovalSources": [ - "github-review", - "github-app-review", - "signed-attestation" - ], - "ticket": { - "root": "project", - "directoryPattern": "^ticket-[0-9]{3}$", - "requiredFiles": [ - "README.md", - "preprompt.md", - "changelog.md", - "intent.json" - ], - "requiredAgentFiles": [ - "ai-*.md", - "ai-*-logs.txt" - ], - "activeStatuses": [ - "IN_PROGRESS" - ], - "nonActiveStatuses": [ - "BACKLOG", - "PLAN", - "BLOCKED" - ], - "closedStatuses": [ - "DONE", - "CANCELLED" - ], - "implementationStates": [ - "EDIT", - "VALIDATION", - "PUBLICATION" - ], - "intentFile": "intent.json" - }, "approvalEvidence": { - "schema": "new-project.approval-evidence/v1", "requiredBindings": [ "repository", "pullRequest", @@ -69,60 +9,266 @@ "actor" ], "reviewVerificationMethod": "github-api-allowlist", + "schema": "new-project.approval-evidence/v1", "signedAttestationPredicateType": "https://wellmanifest.dev/attestations/validator/v1" }, - "docker": { - "required": true, - "dockerfiles": ["Dockerfile", "Dockerfile.e2e"], - "composeFiles": ["docker-compose.yml", "compose.yml", "compose.e2e.yml"] - }, "coordination": { - "mode": "workstreams", + "integration": { + "requiredForPaths": [ + "package.json", + "package-lock.json", + "pyproject.toml", + "goal.yaml", + "Makefile", + "sdk/python/pyproject.toml", + "sdk/python/README.md", + "tsconfig.json", + "src/core/types.ts" + ], + "workstream": "integration" + }, "maxActiveTicketsPerWorkstream": 1, + "mode": "workstreams", "rejectActiveScopeOverlap": true, "workstreams": { "core-dsl": { - "ownedPaths": ["src/core/**", "src/graph/**", "src/semantic/**", "src/comparison/**", "src/evaluation/**", "test/graph*", "test/schema*", "test/structured*", "test/linker*", "test/proposal*", "test/gold*", "test/semantic*", "test/workspace*", "test/target*"] + "ownedPaths": [ + "src/core/**", + "src/graph/**", + "src/semantic/**", + "src/comparison/**", + "src/evaluation/**", + "test/graph*", + "test/schema*", + "test/structured*", + "test/linker*", + "test/proposal*", + "test/gold*", + "test/semantic*", + "test/workspace*", + "test/target*" + ] }, "extractors": { - "ownedPaths": ["src/extractors/**", "src/diff/**", "test/ast*", "test/diff*", "test/docs*", "test/markdown*", "test/configuration*", "test/ignore*", "test/extraction-cache*", "test/generated*"] + "ownedPaths": [ + "src/extractors/**", + "src/diff/**", + "test/ast*", + "test/diff*", + "test/docs*", + "test/markdown*", + "test/configuration*", + "test/ignore*", + "test/extraction-cache*", + "test/generated*" + ] }, - "llm": { - "ownedPaths": ["src/llm/**", "src/live/**", "src/synthesis/**", "src/summary/**", "test/*llm*", "test/openrouter*", "test/task-synthesis*", "test/live-*", "test/grounded-contracts*"] + "governance": { + "ownedPaths": [ + ".governance/**", + ".github/workflows/**", + "AGENTS.md", + "Makefile", + "README.md", + "TODO.md", + "CHANGELOG.md", + ".env.example", + "project.sh", + "project.bat", + "project/governance-check.*", + "project/new-ticket.sh", + "project/readme.sh", + "project/TICKETS.md", + "project/ticket-*/**" + ] }, - "runtime": { - "ownedPaths": ["src/pipeline/**", "src/operations/**", "src/services/**", "src/config/**", "src/watch/**", "src/tf/**", "test/pipeline*", "test/runtime*", "test/watch*", "test/operation*", "test/io*", "test/config*", "test/tensorflow*", "test/security*", "test/git*", "test/code-change*"] + "integration": { + "ownedPaths": [ + "package.json", + "package-lock.json", + "pyproject.toml", + "goal.yaml", + "Makefile", + "sdk/python/pyproject.toml", + "sdk/python/README.md", + "tsconfig.json", + "Dockerfile*", + "compose*.yml", + "scripts/**", + "examples/**", + "docs/**", + "project/*.export", + "project/*.html", + "project/*.md", + "project/*.mmd", + "project/*.png", + "project/*.toon", + "project/*.txt", + "project/*.yaml", + "project/*.yml", + "test/fixtures/**", + "test/workflow-validation.test.ts", + "src/core/types.ts" + ] }, "interfaces": { - "ownedPaths": ["src/interfaces/**", "src/communication/**", "src/web/**", "src/cli.ts", "test/cli*", "test/mcp*", "test/a2a*", "test/communication*"] + "ownedPaths": [ + "src/interfaces/**", + "src/communication/**", + "src/web/**", + "src/cli.ts", + "test/cli*", + "test/mcp*", + "test/a2a*", + "test/communication*" + ] }, - "sdk": { - "ownedPaths": ["src/sdk/**", "sdk/**", "examples/sdk/**", "test/sdk*"] + "llm": { + "ownedPaths": [ + "src/llm/**", + "src/live/**", + "src/synthesis/**", + "src/summary/**", + "test/*llm*", + "test/openrouter*", + "test/task-synthesis*", + "test/live-*", + "test/grounded-contracts*" + ] }, - "governance": { - "ownedPaths": [".governance/**", ".github/workflows/**", "AGENTS.md", "Makefile", "README.md", "TODO.md", "CHANGELOG.md", ".env.example", "project.sh", "project.bat", "project/governance-check.*", "project/new-ticket.sh", "project/readme.sh", "project/TICKETS.md", "project/ticket-*/**"] + "runtime": { + "ownedPaths": [ + "src/pipeline/**", + "src/operations/**", + "src/services/**", + "src/config/**", + "src/watch/**", + "src/tf/**", + "test/pipeline*", + "test/runtime*", + "test/watch*", + "test/operation*", + "test/io*", + "test/config*", + "test/tensorflow*", + "test/security*", + "test/git*", + "test/code-change*" + ] }, - "integration": { - "ownedPaths": ["package.json", "package-lock.json", "pyproject.toml", "goal.yaml", "Makefile", "sdk/python/pyproject.toml", "sdk/python/README.md", "tsconfig.json", "Dockerfile*", "compose*.yml", "scripts/**", "examples/**", "docs/**", "project/*.export", "project/*.html", "project/*.md", "project/*.mmd", "project/*.png", "project/*.toon", "project/*.txt", "project/*.yaml", "project/*.yml", "test/fixtures/**", "test/workflow-validation.test.ts", "src/core/types.ts"] + "sdk": { + "ownedPaths": [ + "src/sdk/**", + "sdk/**", + "examples/sdk/**", + "test/sdk*", + "test/python-runtime.test.ts" + ] } - }, - "integration": { - "workstream": "integration", - "requiredForPaths": ["package.json", "package-lock.json", "pyproject.toml", "goal.yaml", "Makefile", "sdk/python/pyproject.toml", "sdk/python/README.md", "tsconfig.json", "src/core/types.ts"] } }, "delivery": { - "requiredForImplementation": false, - "maxActiveMinutes": 30, + "allowedComplexityClasses": [ + "XS", + "S" + ], "checkpointMinutes": 25, - "allowedComplexityClasses": ["XS", "S"], - "maxImplementationFiles": 5, + "dependencyManifestPaths": [ + "package.json", + "package-lock.json", + "pyproject.toml", + "go.mod", + "Cargo.toml", + "pom.xml" + ], + "maxActiveMinutes": 30, "maxAffectedComponents": 2, + "maxImplementationFiles": 5, "maxPublicInterfaceChanges": 0, "maxRuntimeDependencies": 0, - "targetBranches": ["main"], - "publicInterfacePaths": ["src/interfaces/**", "src/core/types.ts", "sdk/**"], - "dependencyManifestPaths": ["package.json", "package-lock.json", "pyproject.toml", "go.mod", "Cargo.toml", "pom.xml"] + "publicInterfacePaths": [ + "src/interfaces/**", + "src/core/types.ts", + "sdk/**" + ], + "requiredForImplementation": false, + "targetBranches": [ + "main" + ] + }, + "docker": { + "composeFiles": [ + "docker-compose.yml", + "compose.yml", + "compose.e2e.yml" + ], + "dockerfiles": [ + "Dockerfile", + "Dockerfile.e2e" + ], + "required": true + }, + "governancePaths": [ + "TODO.md", + "project/TICKETS.md", + "project/ticket-*/**" + ], + "requiredFiles": [ + "README.md", + "VERSION", + "CHANGELOG.md", + "TODO.md", + "AGENTS.md", + "Dockerfile", + "project/TICKETS.md", + "project/new-ticket.sh", + "project/readme.sh", + "project/governance-check.sh" + ], + "schema": "new-project.governance/v2", + "stacks": [ + "node", + "docker" + ], + "standard": { + "id": "wellmanifest/new-project", + "version": "0.14.0" + }, + "ticket": { + "activeStatuses": [ + "IN_PROGRESS" + ], + "closedStatuses": [ + "DONE", + "CANCELLED" + ], + "directoryPattern": "^ticket-[0-9]{3}$", + "implementationStates": [ + "EDIT", + "VALIDATION", + "PUBLICATION" + ], + "intentFile": "intent.json", + "nonActiveStatuses": [ + "BACKLOG", + "PLAN", + "BLOCKED" + ], + "requiredAgentFiles": [ + "ai-*.md", + "ai-*-logs.txt" + ], + "requiredFiles": [ + "README.md", + "preprompt.md", + "changelog.md", + "intent.json" + ], + "root": "project" }, - "stacks": ["node", "docker"] + "trustedApprovalSources": [ + "github-review", + "github-app-review", + "signed-attestation" + ] } diff --git a/.governance/manifest.lock.json b/.governance/manifest.lock.json index 43ddbd3..e69fd18 100644 --- a/.governance/manifest.lock.json +++ b/.governance/manifest.lock.json @@ -6,12 +6,12 @@ ".governance/decision-record.schema.json": "08278322846b6da5e8306c0661c23fd1bcdf4a003f8ef75aac0d33299a4cd357", ".governance/decision_record.py": "c284285339b0b61b2f68b337301580ee8b35a1687cbbe47f4c268ff5723a466c", ".governance/diagnostics.json": "1640311176394612e462b595f143e32be1d52bd768f109c199d25bae9673881b", - ".governance/governance_check.py": "2a3e50801f9174b102db4f79780f4949ffd97303f35f966e8a56ab2cd6f53e8e", + ".governance/governance_check.py": "8c94129c52f9dbb8e2ece60bc916bace03b8078d750dbe0ac40218a212c73ac4", ".governance/intent.schema.json": "c5cee010aabcc09dce13e12583848371a7b3eacc898b253cd9bb455d4eba6801", ".governance/lock.schema.json": "fc6f1143ef713c993b61270dd2d7545a52cb0b8501aadb188e6d0152a208b207", - ".governance/manifest.json": "e7ac42e440a1b24f93f60738f54a078a8582e447e693d37a29f219104e11d877", + ".governance/manifest.base.json": "dfccc0af1b6e27f6bd29f6f97c1778c5f66932dd9da7c33fa63a2c4ce071910c", ".governance/manifest.schema.json": "d48f258e3397ac2d8c5010e5ccdeef9eaf87b0b015d56798d11d5916c5f70a18", - ".governance/package-manifest.json": "8bf10862f2b30eb57652b130f7aa1231907e2bb6affd9b68fcb232747658ddde", + ".governance/package-manifest.json": "7d356f590f312b4983519e21de840387e8c561f11a53e2db13f012098dd27b07", ".governance/required-checks.json": "579e008e2dba9110ce45d34fdd96768fa28c003a339cf338378d28fe00fb83a2", ".governance/stack-profiles.json": "6fa3f8f44e50cfd0539413a85092817d3fab4e82fe376405f1e443120724dff2", ".governance/work-classification.dsl.json": "3a947c41938c0b8ef1717957f313ff9248764252735182de30b1f2d6878748b6", @@ -30,7 +30,7 @@ "id": "wellmanifest/new-project", "publicationStatus": "published", "sourceRepository": "wellmanifest/new-project", - "sourceRevision": "85631ea24d127f1f4797d2a67f3524a63cbbc95a", - "version": "0.13.2" + "sourceRevision": "a22eb47ca0e7c06ac927d1c0d843eabb798bfadd", + "version": "0.14.0" } } diff --git a/.governance/package-manifest.json b/.governance/package-manifest.json index 3d78aff..0e0cf65 100644 --- a/.governance/package-manifest.json +++ b/.governance/package-manifest.json @@ -24,6 +24,7 @@ { "source": "project/governance-check.bat", "target": "project/governance-check.bat", "strategy": "managed", "executable": false }, { "source": "project/new-ticket.sh", "target": "project/new-ticket.sh", "strategy": "managed", "executable": true }, { "source": "project/readme.sh", "target": "project/readme.sh", "strategy": "managed", "executable": true }, - { "source": "governance/manifest.default.json", "target": ".governance/manifest.json", "strategy": "seed", "executable": false } + { "source": "governance/manifest.default.json", "target": ".governance/manifest.base.json", "strategy": "managed", "executable": false }, + { "source": "governance/manifest.default.json", "target": ".governance/manifest.json", "strategy": "extendable", "executable": false } ] } diff --git a/TODO.md b/TODO.md index 215a1fe..ffba26c 100644 --- a/TODO.md +++ b/TODO.md @@ -11,7 +11,8 @@ - [ ] [`ticket-062`](project/ticket-062/README.md) — route the unowned Python SDK bridge test through protected governance evolution. Current state: - `BLOCKED / WAIT_FOR_EXTERNAL`; coordinated by ticket-058. + `IN_PROGRESS / EDIT`; immutable upstream v0.14.0 dependency satisfied and + exact-SHA atomic adoption in progress; coordinated by ticket-058. - [ ] [`ticket-058`](project/ticket-058/README.md) — synchronize release, runtime, SDK and generated-provenance version identity and add a deterministic drift gate. Plan and owner-ticket creation are approved; current state: diff --git a/project/ticket-062/README.md b/project/ticket-062/README.md index 7323269..27bceff 100644 --- a/project/ticket-062/README.md +++ b/project/ticket-062/README.md @@ -1,9 +1,9 @@ # Ticket 062: Assign Python runtime bridge test to SDK workstream - **ID**: ticket-062 -- **Owner**: unresolved:human -- **Status**: BLOCKED -- **Workflow state**: WAIT_FOR_EXTERNAL +- **Owner**: agent:codex +- **Status**: IN_PROGRESS +- **Workflow state**: EDIT - **Created**: 2026-08-08 ## Goal and scope @@ -52,10 +52,18 @@ the same protected gates and merged as `main@a70b5b8`; upstream ticket-024 is `.governance/manifest.base.json` from the target-extendable `.governance/manifest.json` and validates the extension fail-closed. -The remaining publication owner is upstream `ticket-044`, planned on -`ticket/044-publish-extendable-manifest@cac0ddb` as immutable minor `v0.14.0`. -It remains `PLAN / WAIT_FOR_APPROVAL`; no tag, release or downstream adoption -has been performed. +Upstream `ticket-044` is complete. Release PR #69 passed protected Linux, +Windows and deterministic exact-head review, then merged as exact release SHA +`a22eb47ca0e7c06ac927d1c0d843eabb798bfadd`. Annotated tag and published, +non-prerelease GitHub Release `v0.14.0` point to that commit; closure PR #70 +also passed protected validation. + +The previously approved dependency is therefore satisfied. Before any target +mutation, this ticket entered `IN_PROGRESS / EDIT` and bound +`delivery.standardAdoption` from installed v0.13.2 SHA `85631ea...` to exact +v0.14.0 SHA `a22eb47...`. Ordinary delivery remains limited to the target +manifest and lock; the complete managed payload is admitted only through the +hash-bound atomic adoption contract. ## Integration evidence @@ -68,6 +76,8 @@ adopted a published upstream mechanism and governance passes. ## Non-goals -- No direct `.governance/manifest.json` or lock hash edit. +- No edit of the manifest while it is lock-protected and no hand-authored lock + hash. The published tool performs the atomic upgrade first; only then may + the now target-owned manifest receive the reviewed SDK path extension. - No test, runtime, SDK, dependency or Docker change. - No authority change proposed or generated by an LLM. diff --git a/project/ticket-062/ai-codex-logs.txt b/project/ticket-062/ai-codex-logs.txt index 6367989..eab63a1 100644 --- a/project/ticket-062/ai-codex-logs.txt +++ b/project/ticket-062/ai-codex-logs.txt @@ -51,3 +51,12 @@ PASS ./project/governance-check.sh TARGET immutable v0.14.0 STATUS PLAN / WAIT_FOR_APPROVAL NO tag, GitHub Release or downstream adoption performed + +2026-08-09 immutable release satisfied + PASS upstream PR 69 Linux, Windows and deterministic exact-head review + RELEASE v0.14.0 exact SHA a22eb47ca0e7c06ac927d1c0d843eabb798bfadd + PASS upstream clean detached merge-SHA contract + PASS upstream closure PR 70 protected validation + STATE ticket-062 IN_PROGRESS / EDIT before target mutation + ADOPTION from 85631ea24d127f1f4797d2a67f3524a63cbbc95a + ADOPTION to a22eb47ca0e7c06ac927d1c0d843eabb798bfadd diff --git a/project/ticket-062/ai-codex.md b/project/ticket-062/ai-codex.md index 386442c..1af70bc 100644 --- a/project/ticket-062/ai-codex.md +++ b/project/ticket-062/ai-codex.md @@ -15,7 +15,7 @@ or a supported project-extension mechanism. ## Execution plan -1. Wait for explicit approval of the escalation route. +1. Record the approved escalation route and wait for its immutable release. 2. Open or reuse an upstream governance ticket for a project-specific ownership extension that does not weaken managed-file verification. 3. Adopt the published revision atomically through the existing protected @@ -35,14 +35,20 @@ or a supported project-extension mechanism. #68 merged as `main@a70b5b8`. - Created upstream publication plan ticket-044 at `cac0ddb`; it requires separate approval before immutable v0.14.0 publication. +- Verified upstream v0.14.0 was published at exact release SHA + `a22eb47ca0e7c06ac927d1c0d843eabb798bfadd` after protected and clean + detached validation. +- Bound the approved downstream adoption from exact installed v0.13.2 SHA to + that immutable v0.14.0 SHA and entered `IN_PROGRESS / EDIT` before target + mutation. - Recorded the combined 059+060+061 validation: every pre-test gate passed and the only observed test failure is the ticket-063 assertion blocked by this ownership gap. - Made no governance, implementation or test change. -- Human approved the routing plan on 2026-08-09; status is - `BLOCKED / WAIT_FOR_EXTERNAL`. +- Human approved the routing plan on 2026-08-09; its external release + dependency is now satisfied. ## Blockers -- Approval and execution of upstream release ticket-044, followed by protected - exact-SHA downstream adoption, are required. +- None before deterministic exact-SHA adoption. Ticket-063 remains blocked + until the adopted project passes governance. diff --git a/project/ticket-062/changelog.md b/project/ticket-062/changelog.md index 7cc76cf..82bda05 100644 --- a/project/ticket-062/changelog.md +++ b/project/ticket-062/changelog.md @@ -10,3 +10,10 @@ - Passed governance with zero errors and zero warnings. - Recorded human approval and moved to `BLOCKED / WAIT_FOR_EXTERNAL` without changing governance authority. + +## [0.2.0] - 2026-08-09 + +- Verified immutable upstream v0.14.0 release SHA `a22eb47` after its + protected and clean detached validation. +- Bound the approved atomic adoption from installed v0.13.2 SHA `85631ea` to + exact v0.14.0 SHA and entered `IN_PROGRESS / EDIT` before mutation. diff --git a/project/ticket-062/intent.json b/project/ticket-062/intent.json index 480a8ee..6a13072 100644 --- a/project/ticket-062/intent.json +++ b/project/ticket-062/intent.json @@ -8,11 +8,15 @@ "priority": "P1", "origin": "regression" }, - "allowedPaths": ["project/ticket-062/**", "TODO.md", "project/TICKETS.md"], + "allowedPaths": [ + ".governance/manifest.json", + ".governance/manifest.lock.json", + "project/ticket-062/**", + "TODO.md", + "project/TICKETS.md" + ], "forbiddenPaths": [ "project/ticket-*/user-*.md", - ".governance/**", - "AGENTS.md", "src/**", "test/**", "sdk/**", @@ -29,20 +33,25 @@ "delivery": { "acceptedBaseSha": "132f87963921cd49dafa19b643b0528a3a434dd0", "targetBranch": "main", + "standardAdoption": { + "sourceRepository": "wellmanifest/new-project", + "fromRevision": "85631ea24d127f1f4797d2a67f3524a63cbbc95a", + "toRevision": "a22eb47ca0e7c06ac927d1c0d843eabb798bfadd" + }, "outcome": "The Python SDK bridge test receives deterministic SDK ownership through a protected published governance contract", "nonGoals": ["No local managed-hash edit", "No application or test change", "No dependency, Docker or authority weakening"], "complexity": "XS", "estimatedMinutes": 15, - "budgets": {"maxImplementationFiles": 0, "maxAffectedComponents": 1, "maxPublicInterfaceChanges": 0, "maxRuntimeDependencies": 0}, + "budgets": {"maxImplementationFiles": 2, "maxAffectedComponents": 1, "maxPublicInterfaceChanges": 0, "maxRuntimeDependencies": 0}, "architecture": { "status": "accepted", - "decision": "Route the ownership gap through protected standard evolution rather than editing the locked target manifest", - "components": [{"name": "workstream-ownership-routing", "paths": ["project/ticket-062/**"]}], + "decision": "Atomically adopt immutable new-project v0.14.0, preserving target workstreams while extending the sdk owner with the Python runtime bridge test", + "components": [{"name": "target-adoption", "paths": [".governance/manifest.json", ".governance/manifest.lock.json"]}], "responsibilityChanges": true, "interfaceChanges": [], - "dataChanges": [], + "dataChanges": ["The sdk workstream owns test/python-runtime.test.ts and the installed standard advances to exact v0.14.0 release SHA"], "ui": {"impact": "none", "states": [], "evidence": []}, - "rollback": "Close this routing ticket if an existing published extension already assigns the path safely" + "rollback": "Re-adopt the prior immutable revision through the same reviewed flow; never hand-edit a managed hash or move a release tag" }, "runtimeDependencies": [], "validation": [ From e42a1064977434d587bc6764665a09187ad9a302 Mon Sep 17 00:00:00 2001 From: Tom Softreck Date: Sun, 9 Aug 2026 01:11:27 +0200 Subject: [PATCH 09/11] docs(ticket-062): record adoption validation --- TODO.md | 4 ++-- project/ticket-062/README.md | 26 ++++++++++++++++++++++---- project/ticket-062/ai-codex-logs.txt | 10 ++++++++++ project/ticket-062/ai-codex.md | 9 +++++++-- project/ticket-062/changelog.md | 8 ++++++++ 5 files changed, 49 insertions(+), 8 deletions(-) diff --git a/TODO.md b/TODO.md index ffba26c..344cbba 100644 --- a/TODO.md +++ b/TODO.md @@ -11,8 +11,8 @@ - [ ] [`ticket-062`](project/ticket-062/README.md) — route the unowned Python SDK bridge test through protected governance evolution. Current state: - `IN_PROGRESS / EDIT`; immutable upstream v0.14.0 dependency satisfied and - exact-SHA atomic adoption in progress; coordinated by ticket-058. + `IN_PROGRESS / VALIDATION`; exact-SHA v0.14.0 adoption and SDK ownership pass + local governance and full project verification; coordinated by ticket-058. - [ ] [`ticket-058`](project/ticket-058/README.md) — synchronize release, runtime, SDK and generated-provenance version identity and add a deterministic drift gate. Plan and owner-ticket creation are approved; current state: diff --git a/project/ticket-062/README.md b/project/ticket-062/README.md index 27bceff..dee5f30 100644 --- a/project/ticket-062/README.md +++ b/project/ticket-062/README.md @@ -3,7 +3,7 @@ - **ID**: ticket-062 - **Owner**: agent:codex - **Status**: IN_PROGRESS -- **Workflow state**: EDIT +- **Workflow state**: VALIDATION - **Created**: 2026-08-08 ## Goal and scope @@ -21,11 +21,11 @@ the required upstream extension/adoption instead of modifying authority. - [x] AC-01: A human approves routing this ownership gap through the protected governance adoption path. -- [ ] AC-02: A published governance mechanism assigns the Python runtime bridge +- [x] AC-02: A published governance mechanism assigns the Python runtime bridge test to `sdk` without hand-editing managed hashes. -- [ ] AC-03: The complete managed set is adopted atomically and governance +- [x] AC-03: The complete managed set is adopted atomically and governance passes before ticket-063 enters `EDIT`. -- [ ] AC-04: No application or test behavior changes in this ticket. +- [x] AC-04: No application or test behavior changes in this ticket. ## Participants @@ -74,6 +74,24 @@ output is `todo2code 0.5.1`, while the unowned test still expects `0.5.0`. Ticket 063 owns that assertion but cannot enter `EDIT` until this ticket has adopted a published upstream mechanism and governance passes. +## Adoption validation + +- The published v0.14.0 adoption tool installed exact SHA + `a22eb47ca0e7c06ac927d1c0d843eabb798bfadd`; a repeated `--check` reports + `up-to-date`. +- The complete managed set is hash-valid, `.governance/manifest.base.json` is + locked, and the target `.governance/manifest.json` is intentionally absent + from `managedFiles`. +- All eight todo2code workstreams were preserved. The `sdk` workstream now + owns exact path `test/python-runtime.test.ts`. +- `./project/governance-check.sh --base 132f879...` passes with zero errors and + warnings under the atomic standard-adoption contract. +- `npm run verify` passes 405 tests (404 PASS, one explicit JDK-unavailable + SKIP), including TypeScript, module/LLM boundaries, env, workflows, schemas, + generated analysis and build checks. +- No file below `src/`, `test/`, `sdk/`, dependency metadata, Docker or runtime + behavior changed in this ticket. + ## Non-goals - No edit of the manifest while it is lock-protected and no hand-authored lock diff --git a/project/ticket-062/ai-codex-logs.txt b/project/ticket-062/ai-codex-logs.txt index eab63a1..2c75876 100644 --- a/project/ticket-062/ai-codex-logs.txt +++ b/project/ticket-062/ai-codex-logs.txt @@ -60,3 +60,13 @@ PASS ./project/governance-check.sh STATE ticket-062 IN_PROGRESS / EDIT before target mutation ADOPTION from 85631ea24d127f1f4797d2a67f3524a63cbbc95a ADOPTION to a22eb47ca0e7c06ac927d1c0d843eabb798bfadd + +2026-08-09 downstream adoption validation + PASS package check up-to-date wellmanifest/new-project 0.14.0 at a22eb47 + PASS managed base locked and target manifest excluded from managedFiles + PASS 8/8 local workstreams preserved + PASS sdk owns test/python-runtime.test.ts + PASS exact-base governance 0 errors 0 warnings + PASS npm run verify 405 tests, 404 pass, 1 JDK-unavailable skip + BOUNDARY no src, test, sdk, dependency, Docker or runtime behavior change + STATE ticket-062 IN_PROGRESS / VALIDATION; ticket-063 still blocked pending merge diff --git a/project/ticket-062/ai-codex.md b/project/ticket-062/ai-codex.md index 1af70bc..2cf7ee3 100644 --- a/project/ticket-062/ai-codex.md +++ b/project/ticket-062/ai-codex.md @@ -41,6 +41,11 @@ or a supported project-extension mechanism. - Bound the approved downstream adoption from exact installed v0.13.2 SHA to that immutable v0.14.0 SHA and entered `IN_PROGRESS / EDIT` before target mutation. +- Adopted the complete managed payload with the published tool, then added the + exact Python bridge path to the now target-owned SDK workstream. +- Passed idempotent package check, hash/base invariants, exact-base governance + with zero findings, and full `npm run verify` (405 tests; one explicit + JDK-unavailable skip). The ticket is now in `VALIDATION`. - Recorded the combined 059+060+061 validation: every pre-test gate passed and the only observed test failure is the ticket-063 assertion blocked by this ownership gap. @@ -50,5 +55,5 @@ or a supported project-extension mechanism. ## Blockers -- None before deterministic exact-SHA adoption. Ticket-063 remains blocked - until the adopted project passes governance. +- Protected PR checks and exact-head review remain before merge. Ticket-063 + stays blocked until this adoption reaches protected `main`. diff --git a/project/ticket-062/changelog.md b/project/ticket-062/changelog.md index 82bda05..1adb9d6 100644 --- a/project/ticket-062/changelog.md +++ b/project/ticket-062/changelog.md @@ -17,3 +17,11 @@ protected and clean detached validation. - Bound the approved atomic adoption from installed v0.13.2 SHA `85631ea` to exact v0.14.0 SHA and entered `IN_PROGRESS / EDIT` before mutation. + +## [0.3.0] - 2026-08-09 + +- Atomically adopted the full v0.14.0 managed payload and added the exact + Python bridge test path to the now target-owned SDK workstream. +- Passed idempotent adoption, exact-base governance, managed hash/base + invariants and all 405 project tests (one explicit JDK-unavailable skip). +- Completed all local acceptance criteria and advanced to `VALIDATION`. From 049e51855cd8bcd8312af2b05eb939059d638995 Mon Sep 17 00:00:00 2001 From: Tom Softreck Date: Sun, 9 Aug 2026 01:12:05 +0200 Subject: [PATCH 10/11] docs(ticket-062): bind current review base --- project/ticket-062/README.md | 2 +- project/ticket-062/ai-codex-logs.txt | 1 + project/ticket-062/changelog.md | 2 ++ project/ticket-062/intent.json | 2 +- 4 files changed, 5 insertions(+), 2 deletions(-) diff --git a/project/ticket-062/README.md b/project/ticket-062/README.md index dee5f30..9e101f8 100644 --- a/project/ticket-062/README.md +++ b/project/ticket-062/README.md @@ -84,7 +84,7 @@ adopted a published upstream mechanism and governance passes. from `managedFiles`. - All eight todo2code workstreams were preserved. The `sdk` workstream now owns exact path `test/python-runtime.test.ts`. -- `./project/governance-check.sh --base 132f879...` passes with zero errors and +- `./project/governance-check.sh --base 738d7be...` passes with zero errors and warnings under the atomic standard-adoption contract. - `npm run verify` passes 405 tests (404 PASS, one explicit JDK-unavailable SKIP), including TypeScript, module/LLM boundaries, env, workflows, schemas, diff --git a/project/ticket-062/ai-codex-logs.txt b/project/ticket-062/ai-codex-logs.txt index 2c75876..f7efdfa 100644 --- a/project/ticket-062/ai-codex-logs.txt +++ b/project/ticket-062/ai-codex-logs.txt @@ -70,3 +70,4 @@ PASS ./project/governance-check.sh PASS npm run verify 405 tests, 404 pass, 1 JDK-unavailable skip BOUNDARY no src, test, sdk, dependency, Docker or runtime behavior change STATE ticket-062 IN_PROGRESS / VALIDATION; ticket-063 still blocked pending merge + BASE refreshed to actual branch merge-base 738d7be93168fe73cccf14d3d589e545919c9a6f before PR diff --git a/project/ticket-062/changelog.md b/project/ticket-062/changelog.md index 1adb9d6..dc62827 100644 --- a/project/ticket-062/changelog.md +++ b/project/ticket-062/changelog.md @@ -25,3 +25,5 @@ - Passed idempotent adoption, exact-base governance, managed hash/base invariants and all 405 project tests (one explicit JDK-unavailable skip). - Completed all local acceptance criteria and advanced to `VALIDATION`. +- Refreshed `acceptedBaseSha` from the historical routing point to the actual + branch/main merge-base `738d7be` before protected review. diff --git a/project/ticket-062/intent.json b/project/ticket-062/intent.json index 6a13072..a9bd588 100644 --- a/project/ticket-062/intent.json +++ b/project/ticket-062/intent.json @@ -31,7 +31,7 @@ "conflictsWith": [], "integrationTicket": "ticket-058", "delivery": { - "acceptedBaseSha": "132f87963921cd49dafa19b643b0528a3a434dd0", + "acceptedBaseSha": "738d7be93168fe73cccf14d3d589e545919c9a6f", "targetBranch": "main", "standardAdoption": { "sourceRepository": "wellmanifest/new-project", From b33e49ce2d90bd13dc98961dbaf467172cd4a7c4 Mon Sep 17 00:00:00 2001 From: Tom Softreck Date: Sun, 9 Aug 2026 01:20:55 +0200 Subject: [PATCH 11/11] ci: align governance caller with adopted standard --- .github/workflows/ci.yml | 4 ++-- TODO.md | 5 +++-- project/ticket-062/README.md | 10 ++++++++-- project/ticket-062/ai-codex-logs.txt | 10 ++++++++++ project/ticket-062/ai-codex.md | 8 ++++++-- project/ticket-062/changelog.md | 9 +++++++++ project/ticket-062/intent.json | 7 ++++--- 7 files changed, 42 insertions(+), 11 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 35b09ac..b103761 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -28,9 +28,9 @@ jobs: permissions: contents: read pull-requests: read - uses: wellmanifest/new-project/.github/workflows/governance.yml@85631ea24d127f1f4797d2a67f3524a63cbbc95a + uses: wellmanifest/new-project/.github/workflows/governance.yml@a22eb47ca0e7c06ac927d1c0d843eabb798bfadd with: - standard-ref: 85631ea24d127f1f4797d2a67f3524a63cbbc95a + standard-ref: a22eb47ca0e7c06ac927d1c0d843eabb798bfadd trusted-reviewers: ${{ vars.TRUSTED_REVIEWERS }} trusted-validator-apps: ${{ vars.TRUSTED_VALIDATOR_APPS }} diff --git a/TODO.md b/TODO.md index 344cbba..1729725 100644 --- a/TODO.md +++ b/TODO.md @@ -11,8 +11,9 @@ - [ ] [`ticket-062`](project/ticket-062/README.md) — route the unowned Python SDK bridge test through protected governance evolution. Current state: - `IN_PROGRESS / VALIDATION`; exact-SHA v0.14.0 adoption and SDK ownership pass - local governance and full project verification; coordinated by ticket-058. + `IN_PROGRESS / EDIT`; protected review exposed and is repairing stale + reusable-workflow caller pins after exact-SHA adoption; coordinated by + ticket-058. - [ ] [`ticket-058`](project/ticket-058/README.md) — synchronize release, runtime, SDK and generated-provenance version identity and add a deterministic drift gate. Plan and owner-ticket creation are approved; current state: diff --git a/project/ticket-062/README.md b/project/ticket-062/README.md index 9e101f8..ec51f02 100644 --- a/project/ticket-062/README.md +++ b/project/ticket-062/README.md @@ -3,7 +3,7 @@ - **ID**: ticket-062 - **Owner**: agent:codex - **Status**: IN_PROGRESS -- **Workflow state**: VALIDATION +- **Workflow state**: EDIT - **Created**: 2026-08-08 ## Goal and scope @@ -23,7 +23,7 @@ the required upstream extension/adoption instead of modifying authority. governance adoption path. - [x] AC-02: A published governance mechanism assigns the Python runtime bridge test to `sdk` without hand-editing managed hashes. -- [x] AC-03: The complete managed set is adopted atomically and governance +- [ ] AC-03: The complete managed set is adopted atomically and governance passes before ticket-063 enters `EDIT`. - [x] AC-04: No application or test behavior changes in this ticket. @@ -91,6 +91,12 @@ adopted a published upstream mechanism and governance passes. generated analysis and build checks. - No file below `src/`, `test/`, `sdk/`, dependency metadata, Docker or runtime behavior changed in this ticket. +- First protected review resolved branch lifecycle after draft owner PRs + #78-#82 were opened, then failed closed with `GOV-SYNC-001`: the target + reusable workflow still selected v0.13.2 SHA `85631ea`, whose older parser + cannot validate the new `extendable` strategy. The ticket returned to + `EDIT` and now binds both the reusable workflow and its `standard-ref` input + to the adopted exact v0.14.0 SHA `a22eb47`. ## Non-goals diff --git a/project/ticket-062/ai-codex-logs.txt b/project/ticket-062/ai-codex-logs.txt index f7efdfa..dee688b 100644 --- a/project/ticket-062/ai-codex-logs.txt +++ b/project/ticket-062/ai-codex-logs.txt @@ -71,3 +71,13 @@ PASS ./project/governance-check.sh BOUNDARY no src, test, sdk, dependency, Docker or runtime behavior change STATE ticket-062 IN_PROGRESS / VALIDATION; ticket-063 still blocked pending merge BASE refreshed to actual branch merge-base 738d7be93168fe73cccf14d3d589e545919c9a6f before PR + +2026-08-09 protected review diagnostics + PASS exact-head deterministic Validator D-062-6612 + ADVISORY LLM REQUEST_CHANGES not used as authority + FAIL GOV-BRANCH-LIFECYCLE-002 orphan owner branches 058-061,063 + REPAIR draft owner PRs 78-82 opened; lifecycle rerun PASS + FAIL GOV-SYNC-001 v0.13.2 caller parser rejects v0.14.0 extendable package entry + ROOT .github/workflows/ci.yml still pinned uses and standard-ref to 85631ea + STATE returned to IN_PROGRESS / EDIT + REPAIR both caller references aligned to exact a22eb47 diff --git a/project/ticket-062/ai-codex.md b/project/ticket-062/ai-codex.md index 2cf7ee3..b51e335 100644 --- a/project/ticket-062/ai-codex.md +++ b/project/ticket-062/ai-codex.md @@ -46,6 +46,10 @@ or a supported project-extension mechanism. - Passed idempotent package check, hash/base invariants, exact-base governance with zero findings, and full `npm run verify` (405 tests; one explicit JDK-unavailable skip). The ticket is now in `VALIDATION`. +- Protected review exposed target caller drift: the reusable workflow and its + `standard-ref` still selected v0.13.2, so that old parser rejected the + adopted package strategy with `GOV-SYNC-001`. Returned to `EDIT` and aligned + both immutable references with exact v0.14.0 SHA `a22eb47`. - Recorded the combined 059+060+061 validation: every pre-test gate passed and the only observed test failure is the ticket-063 assertion blocked by this ownership gap. @@ -55,5 +59,5 @@ or a supported project-extension mechanism. ## Blockers -- Protected PR checks and exact-head review remain before merge. Ticket-063 - stays blocked until this adoption reaches protected `main`. +- Fresh protected checks and exact-head review remain after caller alignment. + Ticket-063 stays blocked until this adoption reaches protected `main`. diff --git a/project/ticket-062/changelog.md b/project/ticket-062/changelog.md index dc62827..338d3f6 100644 --- a/project/ticket-062/changelog.md +++ b/project/ticket-062/changelog.md @@ -27,3 +27,12 @@ - Completed all local acceptance criteria and advanced to `VALIDATION`. - Refreshed `acceptedBaseSha` from the historical routing point to the actual branch/main merge-base `738d7be` before protected review. + +## [0.4.0] - 2026-08-09 + +- Opened draft owner PRs #78-#82 for the approved remote ticket branches, + resolving deterministic branch lifecycle ownership. +- Recorded protected `GOV-SYNC-001`: the target workflow still ran the v0.13.2 + parser against the adopted v0.14.0 package contract. +- Returned to `EDIT`, expanded the ordinary adoption budget from two to three + files, and aligned both workflow references to exact SHA `a22eb47`. diff --git a/project/ticket-062/intent.json b/project/ticket-062/intent.json index a9bd588..cd878bd 100644 --- a/project/ticket-062/intent.json +++ b/project/ticket-062/intent.json @@ -11,6 +11,7 @@ "allowedPaths": [ ".governance/manifest.json", ".governance/manifest.lock.json", + ".github/workflows/ci.yml", "project/ticket-062/**", "TODO.md", "project/TICKETS.md" @@ -42,14 +43,14 @@ "nonGoals": ["No local managed-hash edit", "No application or test change", "No dependency, Docker or authority weakening"], "complexity": "XS", "estimatedMinutes": 15, - "budgets": {"maxImplementationFiles": 2, "maxAffectedComponents": 1, "maxPublicInterfaceChanges": 0, "maxRuntimeDependencies": 0}, + "budgets": {"maxImplementationFiles": 3, "maxAffectedComponents": 1, "maxPublicInterfaceChanges": 0, "maxRuntimeDependencies": 0}, "architecture": { "status": "accepted", "decision": "Atomically adopt immutable new-project v0.14.0, preserving target workstreams while extending the sdk owner with the Python runtime bridge test", - "components": [{"name": "target-adoption", "paths": [".governance/manifest.json", ".governance/manifest.lock.json"]}], + "components": [{"name": "target-adoption", "paths": [".governance/manifest.json", ".governance/manifest.lock.json", ".github/workflows/ci.yml"]}], "responsibilityChanges": true, "interfaceChanges": [], - "dataChanges": ["The sdk workstream owns test/python-runtime.test.ts and the installed standard advances to exact v0.14.0 release SHA"], + "dataChanges": ["The sdk workstream owns test/python-runtime.test.ts; the installed standard, reusable governance workflow and standard-ref advance to exact v0.14.0 release SHA"], "ui": {"impact": "none", "states": [], "evidence": []}, "rollback": "Re-adopt the prior immutable revision through the same reviewed flow; never hand-edit a managed hash or move a release tag" },