integration: coordinate canonical version identity

TODO.md

@@ -9,6 +9,10 @@
 
 ## Backlog tickets
 
+- [ ] [`ticket-058`](project/ticket-058/README.md) — synchronize release,
+  runtime, SDK and generated-provenance version identity and add a deterministic
+  drift gate. Plan and owner-ticket creation are approved; current state:
+  `BLOCKED / WAIT_FOR_DEPENDENCIES` while ticket-054 reserves `integration`.
 - [ ] [`ticket-051`](project/ticket-051/README.md) — wire
   `scripts/github-event-log.mjs` into CI with explicit flags only. Current
   state: `PLAN / WAIT_FOR_APPROVAL`; ticket-048 is now merged.

project/TICKETS.md

@@ -50,4 +50,5 @@ of `project/README.md`, which remains a generated technical-analysis artifact.
 | **ticket-054** | [`README.md`](./ticket-054/README.md) | [`preprompt.md`](./ticket-054/preprompt.md) | - |  [`ai-codex.md`](./ticket-054/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-054/ai-codex-logs.txt) | [`changelog.md`](./ticket-054/changelog.md) |
 | **ticket-055** | [`README.md`](./ticket-055/README.md) | [`preprompt.md`](./ticket-055/preprompt.md) | - |  [`ai-codex.md`](./ticket-055/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-055/ai-codex-logs.txt) | [`changelog.md`](./ticket-055/changelog.md) |
 | **ticket-056** | [`README.md`](./ticket-056/README.md) | [`preprompt.md`](./ticket-056/preprompt.md) | - |  [`ai-codex.md`](./ticket-056/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-056/ai-codex-logs.txt) | [`changelog.md`](./ticket-056/changelog.md) |
+| **ticket-058** | [`README.md`](./ticket-058/README.md) | [`preprompt.md`](./ticket-058/preprompt.md) | - |  [`ai-codex.md`](./ticket-058/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-058/ai-codex-logs.txt) | [`changelog.md`](./ticket-058/changelog.md) |
 <!-- AUTO:TICKET_INDEX:END -->

project/ticket-058/README.md

@@ -0,0 +1,124 @@
+# Ticket 058: Synchronize todo2code release and runtime version identity
+
+- **ID**: ticket-058
+- **Owner**: unresolved:human
+- **Status**: BLOCKED
+- **Workflow state**: WAIT_FOR_DEPENDENCIES
+- **Created**: 2026-08-08
+
+## Goal and scope
+
+Restore one auditable todo2code release identity across the root release
+metadata, SDK manifests, CLI output and every generated DSL provenance
+envelope. Add a dependency-free integration gate that fails closed when a
+future release updates only part of that identity.
+
+This ticket is the integration coordinator. Paths owned by `core-dsl`,
+`extractors`, `runtime` and `sdk` must be corrected through separate governed
+tickets that point back to ticket-058; this ticket does not transfer their
+ownership. A governance routing ticket protects the currently unowned Python
+bridge test instead of assigning it ad hoc.
+
+## Verified regression
+
+At `main@738d7be93168fe73cccf14d3d589e545919c9a6f`:
+
+```text
+package.json                    0.5.1
+VERSION                         0.5.1
+pyproject.toml                  0.5.1
+Python/Rust/TypeScript SDKs     0.5.1
+src/core/version.ts             0.5.0
+t2c --version                   todo2code 0.5.0
+doDSL DevelopmentEvidenceDSL    producerVersion 0.5.0
+```
+
+Commit `99286994cc604e80b401fc16f4230e33e90df253` raised the release and
+SDK metadata to `0.5.1` without changing the runtime constant. Several tests
+then encoded `0.5.0` directly, so the normal suite preserved rather than
+detected the drift.
+
+## Proposed delivery
+
+1. Add an integration-owned, dependency-free version-contract verifier and
+   focused tests under `scripts/`, then make it part of `npm run verify`.
+2. Through a `core-dsl` ticket, align `T2C_VERSION` with the accepted release
+   identity.
+3. Through `extractors` and `runtime` tickets, replace current-version literals
+   with the exported runtime identity where they assert current behavior.
+   Historical fixtures remain pinned when their old version is evidence.
+4. Route the unowned Python SDK bridge test through protected governance
+   evolution, then update it in a separate `sdk` ticket.
+5. Re-run the complete host, governance and Docker validation.
+6. Rebuild the pinned todo2code runtime used by doDSL and prove that a new
+   DevelopmentEvidenceDSL bundle reports `producerVersion "0.5.1"` while
+   retaining its exact Git commit/tree and no authority or mutation effect.
+
+Ticket creation with `--force-new` was explicitly authorized by the human on
+2026-08-08. That authorization permits this concurrent planning ticket; it is
+not approval to edit implementation paths or weaken the active ticket limits.
+
+## Acceptance criteria
+
+- [x] AC-01: A human approves this scope and the multi-workstream split.
+- [ ] AC-02: Root release metadata, SDK manifests, `T2C_VERSION`, CLI output
+      and newly generated provenance all report the same accepted version.
+- [ ] AC-03: A dependency-free verifier emits a stable diagnostic and non-zero
+      status for every supported version-identity mismatch.
+- [ ] AC-04: Tests asserting the current runtime use the canonical exported
+      identity; deliberately historical fixtures remain visibly pinned.
+- [ ] AC-04a: The Python SDK bridge test receives deterministic ownership
+      through protected governance before it is edited.
+- [ ] AC-05: `npm run verify`, governance, Docker smoke and both Docker E2E
+      profiles pass without skipped checks being counted as passes.
+- [ ] AC-06: A fresh doDSL compile records todo2code `0.5.1`, an exact source
+      revision/tree and `AUTHORITY_EFFECT none` / `MUTATION_EFFECT none`.
+
+## Participants
+
+- Human participant: unresolved; no `user-*` file was created.
+- Agent participant: [ai-codex.md](ai-codex.md).
+
+## Approval gate
+
+The human approved this plan and creation of the owner-workstream tickets on
+2026-08-08. This ticket is now `BLOCKED / WAIT_FOR_DEPENDENCIES`: ticket-054
+still reserves `integration`, so the verifier and root verify-hook cannot enter
+`EDIT`. Distinct child workstreams may proceed only through their own approved
+tickets. Conversation approval is an audit note, not trusted merge authority.
+
+Prepared owner tickets:
+
+```text
+ticket-059  core-dsl   runtime constant
+ticket-060  extractors documentation assertion
+ticket-061  runtime    pipeline/code-change assertions
+ticket-062  governance protected Python-test ownership route
+ticket-063  sdk        Python bridge assertion (depends on 062)
+```
+
+Current delivery state:
+
+```text
+ticket-059  EDIT/VALIDATION  72e70e7  core runtime now 0.5.1
+ticket-060  EDIT/VALIDATION  ff63bfd  docs test follows T2C_VERSION
+ticket-061  EDIT/VALIDATION  21820a0  runtime tests follow T2C_VERSION
+ticket-062  WAIT_FOR_EXTERNAL cd33f03 protected ownership routing
+ticket-063  WAIT_FOR_DEPENDENCIES 482d854 no source edit before 062
+```
+
+The temporary 059+060+061 integration passed all `npm run verify` pre-test
+gates. Its only observed test failure is the intentionally untouched
+`test/python-runtime.test.ts` assertion, which still expects `0.5.0` while the
+corrected CLI emits `todo2code 0.5.1`. Upstream owner
+`wellmanifest/new-project:ticket-024` now has a published planning branch at
+`ticket/024-extendable-target-manifest@e538ec0`; implementation still requires
+its own explicit approval and immutable release/adoption path.
+
+## Non-goals
+
+- No new release number, Git tag or package publication.
+- No dependency, secret, AQL, Docker runtime or model configuration change.
+- No reinterpretation of historical `0.5.0` fixtures as current evidence.
+- No command execution or mutation authority derived from LLM output.
+- No direct edit of paths owned by another workstream under ticket-058.

project/ticket-058/ai-codex-logs.txt

@@ -0,0 +1,72 @@
+2026-08-08 pre-implementation audit
+
+PASS repository state
+  main@738d7be93168fe73cccf14d3d589e545919c9a6f
+  original worktree clean before ticket allocation
+
+FAIL release identity consistency
+  package.json=0.5.1
+  VERSION=0.5.1
+  pyproject.toml=0.5.1
+  sdk/python=0.5.1
+  sdk/rust=0.5.1
+  sdk/typescript=0.5.1
+  src/core/version.ts=0.5.0
+  dist CLI output=todo2code 0.5.0
+
+EVIDENCE root cause
+  commit 99286994cc604e80b401fc16f4230e33e90df253 updated release and SDK
+  metadata from 0.5.0 to 0.5.1 but did not update src/core/version.ts
+
+EVIDENCE downstream observation
+  doDSL project dodsl-smoke reports producer=todo2code, producerVersion=0.5.0
+  evidence URI=urn:onlydsl:development-evidence:sha256:7c65453adebf716a4e08aab09ed8f107e551f93232c011a61dfe5b47a55491ac
+  authorityEffect=none, mutationEffect=none
+
+AUTHORIZATION
+  Human explicitly approved creation of a concurrent integration ticket with
+  --force-new. Implementation approval has not been granted.
+
+No implementation path changed. State: WAIT_FOR_APPROVAL.
+
+PASS ./project/governance-check.sh
+  GOV-PASS: passed (0 errors, 0 warnings)
+
+2026-08-08 human plan decision
+  APPROVED ticket-058 plan
+  APPROVED creation of owner-workstream tickets
+  NOT trusted merge authorization
+  ticket-058 remains non-active while ticket-054 reserves integration
+
+2026-08-09 owner-ticket planning
+  PASS ticket-059 core-dsl plan, governance 0 errors / 0 warnings
+  PASS ticket-060 extractors plan, governance 0 errors / 0 warnings
+  PASS ticket-061 runtime plan, governance 0 errors / 0 warnings
+  PASS ticket-062 governance route, governance 0 errors / 0 warnings
+  PASS ticket-063 sdk plan, governance 0 errors / 0 warnings
+
+DISCOVERY
+  test/python-runtime.test.ts matches no current workstream ownership glob
+  .governance/manifest.json is immutable-lock protected
+  no manifest or lock hash was changed
+
+2026-08-09 approved owner implementation
+  ticket-059 72e70e7 focused validation PASS
+  ticket-060 ff63bfd focused validation PASS
+  ticket-061 21820a0 focused validation PASS
+  ticket-062 cd33f03 BLOCKED / WAIT_FOR_EXTERNAL
+  ticket-063 482d854 BLOCKED / WAIT_FOR_DEPENDENCIES
+
+2026-08-09 combined verification
+  npm run verify pre-test gates PASS
+  only observed failure: test/python-runtime.test.ts current-version literal
+  expected todo2code 0.5.0, actual corrected todo2code 0.5.1
+
+2026-08-09 upstream dependency
+  reused wellmanifest/new-project:ticket-024
+  plan ticket/024-extendable-target-manifest@e538ec0
+  no duplicate ticket, implementation, authority change or release
+
+2026-08-09 integration reservation refresh
+  origin/main ticket-054 remains IN_PROGRESS / PUBLICATION
+  its remote branch is deleted but the integration workstream is not released

project/ticket-058/ai-codex.md

@@ -0,0 +1,65 @@
+---
+participant-id: agent:codex
+participant: codex
+role: agent
+ticket: ticket-058
+---
+# Participant: codex (AI agent)
+
+## Understanding
+
+Todo2code currently has two simultaneously true but incompatible identities.
+Release and SDK metadata say `0.5.1`, while the runtime constant, CLI and every
+new provenance envelope say `0.5.0`. doDSL is not inventing the older value;
+it reads it from the pinned todo2code CLI and binds it to the exact analysed Git
+commit and tree.
+
+Changing one string would make the immediate output look correct but would not
+prevent the next partial release. The repair therefore needs a deterministic
+version contract plus removal of current-version literals from behavioral
+tests. Historical artifacts must not be rewritten.
+
+## Execution plan after approval
+
+1. Create separate `core-dsl`, `extractors`, `runtime`, governance-routing and
+   `sdk` tickets with ticket-058 as their integration coordinator.
+2. Align the core runtime version and replace only current-behavior literals in
+   the owning test workstreams.
+3. Once the active integration reservation permits it, add the no-dependency
+   version verifier, focused negative fixtures and the root verify hook.
+4. Run focused tests, `npm run verify`, governance, Docker smoke and both E2E
+   profiles.
+5. Rebuild the todo2code image consumed by doDSL, compile a fresh candidate and
+   verify the resulting DevelopmentEvidenceDSL identity and safety fields.
+
+## Actual changes
+
+- Audited all release/runtime declarations at exact main HEAD.
+- Identified the release commit that introduced the mismatch.
+- Confirmed the live CLI emits `todo2code 0.5.0` while package and VERSION are
+  `0.5.1`.
+- Confirmed doDSL faithfully persists that emitted producer version.
+- Created planning evidence only; no implementation file changed.
+- Recorded the human approval of this plan and authorization to create the
+  owner-workstream tickets.
+- Created tickets 059–063 on isolated branches. Each plan passes governance;
+  the human subsequently approved all five plans.
+- Implemented and focused-validated tickets 059, 060 and 061 on their owning
+  workstreams; tickets 062 and 063 correctly remain blocked.
+- Detected that `test/python-runtime.test.ts` is unowned and selected the
+  protected governance route instead of claiming the path ad hoc.
+- Combined 059+060+061 and ran the complete verifier: every pre-test gate
+  passed and the only observed failure is the untouched Python assertion owned
+  by blocked ticket-063.
+- Reused upstream governance ticket-024 and published a plan for an
+  extendable target manifest; no upstream implementation was performed.
+
+## Blockers
+
+- Ticket-054 currently reserves the `integration` workstream. The approved
+  `--force-new` exception created this ticket but does not silently
+  override active-scope enforcement. Its remote branch is deleted, but
+  `origin/main` still records it as `IN_PROGRESS / PUBLICATION`.
+- Ticket-063 additionally depends on the protected ownership resolution in
+  ticket-062, which depends on approval, implementation, release and adoption
+  of upstream `wellmanifest/new-project:ticket-024`.

project/ticket-058/changelog.md

@@ -0,0 +1,17 @@
+# Ticket Changelog (ticket-058)
+
+## [0.1.0] - 2026-08-08
+
+- Created the explicitly authorized concurrent integration planning ticket.
+- Recorded the exact `0.5.1` release metadata versus `0.5.0` runtime mismatch.
+- Defined a multi-workstream repair with a dependency-free drift gate.
+- Preserved the distinction between current-version assertions and historical
+  fixtures.
+- Made no executable, runtime, dependency, Docker or consumer changes.
+- Passed the repository governance check with zero errors and zero warnings.
+- Recorded human approval of the plan and owner-ticket creation.
+- Moved to `BLOCKED / WAIT_FOR_DEPENDENCIES` until ticket-054 releases the
+  integration workstream.
+- Prepared governance-clean owner tickets 059–063 on isolated branches.
+- Added a protected ownership route for the unowned Python bridge test instead
+  of editing the locked governance manifest locally.