diff --git a/TODO.md b/TODO.md index 43c00f7..f34820d 100644 --- a/TODO.md +++ b/TODO.md @@ -9,6 +9,13 @@ ## Backlog tickets +- [ ] [`ticket-059`](project/ticket-059/README.md) — align the core runtime + version with accepted release `0.5.1`. Current state: + `IN_PROGRESS / VALIDATION`; coordinated by ticket-058. +- [ ] [`ticket-058`](project/ticket-058/README.md) — synchronize release, + runtime, SDK and generated-provenance version identity and add a deterministic + drift gate. Plan and owner-ticket creation are approved; current state: + `BLOCKED / WAIT_FOR_DEPENDENCIES` while ticket-054 reserves `integration`. - [ ] [`ticket-051`](project/ticket-051/README.md) — wire `scripts/github-event-log.mjs` into CI with explicit flags only. Current state: `PLAN / WAIT_FOR_APPROVAL`; ticket-048 is now merged. diff --git a/project/TICKETS.md b/project/TICKETS.md index f5e2b87..63cd36f 100644 --- a/project/TICKETS.md +++ b/project/TICKETS.md @@ -50,4 +50,6 @@ of `project/README.md`, which remains a generated technical-analysis artifact. | **ticket-054** | [`README.md`](./ticket-054/README.md) | [`preprompt.md`](./ticket-054/preprompt.md) | - | [`ai-codex.md`](./ticket-054/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-054/ai-codex-logs.txt) | [`changelog.md`](./ticket-054/changelog.md) | | **ticket-055** | [`README.md`](./ticket-055/README.md) | [`preprompt.md`](./ticket-055/preprompt.md) | - | [`ai-codex.md`](./ticket-055/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-055/ai-codex-logs.txt) | [`changelog.md`](./ticket-055/changelog.md) | | **ticket-056** | [`README.md`](./ticket-056/README.md) | [`preprompt.md`](./ticket-056/preprompt.md) | - | [`ai-codex.md`](./ticket-056/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-056/ai-codex-logs.txt) | [`changelog.md`](./ticket-056/changelog.md) | +| **ticket-058** | [`README.md`](./ticket-058/README.md) | [`preprompt.md`](./ticket-058/preprompt.md) | - | [`ai-codex.md`](./ticket-058/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-058/ai-codex-logs.txt) | [`changelog.md`](./ticket-058/changelog.md) | +| **ticket-059** | [`README.md`](./ticket-059/README.md) | [`preprompt.md`](./ticket-059/preprompt.md) | - | [`ai-codex.md`](./ticket-059/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-059/ai-codex-logs.txt) | [`changelog.md`](./ticket-059/changelog.md) | diff --git a/project/ticket-058/README.md b/project/ticket-058/README.md new file mode 100644 index 0000000..517bf6e --- /dev/null +++ b/project/ticket-058/README.md @@ -0,0 +1,90 @@ +# Ticket 058: Synchronize todo2code release and runtime version identity + +- **ID**: ticket-058 +- **Owner**: unresolved:human +- **Status**: BLOCKED +- **Workflow state**: WAIT_FOR_DEPENDENCIES +- **Created**: 2026-08-08 + +## Goal and scope + +Restore one auditable todo2code release identity across the root release +metadata, SDK manifests, CLI output and every generated DSL provenance +envelope. Add a dependency-free integration gate that fails closed when a +future release updates only part of that identity. + +This ticket is the integration coordinator. Paths owned by `core-dsl`, +`extractors` and `runtime` must be corrected through separate governed tickets +that point back to ticket-058; this ticket does not transfer their ownership. + +## Verified regression + +At `main@738d7be93168fe73cccf14d3d589e545919c9a6f`: + +```text +package.json 0.5.1 +VERSION 0.5.1 +pyproject.toml 0.5.1 +Python/Rust/TypeScript SDKs 0.5.1 +src/core/version.ts 0.5.0 +t2c --version todo2code 0.5.0 +doDSL DevelopmentEvidenceDSL producerVersion 0.5.0 +``` + +Commit `99286994cc604e80b401fc16f4230e33e90df253` raised the release and +SDK metadata to `0.5.1` without changing the runtime constant. Several tests +then encoded `0.5.0` directly, so the normal suite preserved rather than +detected the drift. + +## Proposed delivery + +1. Add an integration-owned, dependency-free version-contract verifier and + focused tests under `scripts/`, then make it part of `npm run verify`. +2. Through a `core-dsl` ticket, align `T2C_VERSION` with the accepted release + identity. +3. Through `extractors` and `runtime` tickets, replace current-version literals + with the exported runtime identity where they assert current behavior. + Historical fixtures remain pinned when their old version is evidence. +4. Re-run the complete host, governance and Docker validation. +5. Rebuild the pinned todo2code runtime used by doDSL and prove that a new + DevelopmentEvidenceDSL bundle reports `producerVersion "0.5.1"` while + retaining its exact Git commit/tree and no authority or mutation effect. + +Ticket creation with `--force-new` was explicitly authorized by the human on +2026-08-08. That authorization permits this concurrent planning ticket; it is +not approval to edit implementation paths or weaken the active ticket limits. + +## Acceptance criteria + +- [x] AC-01: A human approves this scope and the multi-workstream split. +- [ ] AC-02: Root release metadata, SDK manifests, `T2C_VERSION`, CLI output + and newly generated provenance all report the same accepted version. +- [ ] AC-03: A dependency-free verifier emits a stable diagnostic and non-zero + status for every supported version-identity mismatch. +- [ ] AC-04: Tests asserting the current runtime use the canonical exported + identity; deliberately historical fixtures remain visibly pinned. +- [ ] AC-05: `npm run verify`, governance, Docker smoke and both Docker E2E + profiles pass without skipped checks being counted as passes. +- [ ] AC-06: A fresh doDSL compile records todo2code `0.5.1`, an exact source + revision/tree and `AUTHORITY_EFFECT none` / `MUTATION_EFFECT none`. + +## Participants + +- Human participant: unresolved; no `user-*` file was created. +- Agent participant: [ai-codex.md](ai-codex.md). + +## Approval gate + +The human approved this plan and creation of the owner-workstream tickets on +2026-08-08. This ticket is now `BLOCKED / WAIT_FOR_DEPENDENCIES`: ticket-054 +still reserves `integration`, so the verifier and root verify-hook cannot enter +`EDIT`. Distinct child workstreams may proceed only through their own approved +tickets. Conversation approval is an audit note, not trusted merge authority. + +## Non-goals + +- No new release number, Git tag or package publication. +- No dependency, secret, AQL, Docker runtime or model configuration change. +- No reinterpretation of historical `0.5.0` fixtures as current evidence. +- No command execution or mutation authority derived from LLM output. +- No direct edit of paths owned by another workstream under ticket-058. diff --git a/project/ticket-058/ai-codex-logs.txt b/project/ticket-058/ai-codex-logs.txt new file mode 100644 index 0000000..c2c075f --- /dev/null +++ b/project/ticket-058/ai-codex-logs.txt @@ -0,0 +1,39 @@ +2026-08-08 pre-implementation audit + +PASS repository state + main@738d7be93168fe73cccf14d3d589e545919c9a6f + original worktree clean before ticket allocation + +FAIL release identity consistency + package.json=0.5.1 + VERSION=0.5.1 + pyproject.toml=0.5.1 + sdk/python=0.5.1 + sdk/rust=0.5.1 + sdk/typescript=0.5.1 + src/core/version.ts=0.5.0 + dist CLI output=todo2code 0.5.0 + +EVIDENCE root cause + commit 99286994cc604e80b401fc16f4230e33e90df253 updated release and SDK + metadata from 0.5.0 to 0.5.1 but did not update src/core/version.ts + +EVIDENCE downstream observation + doDSL project dodsl-smoke reports producer=todo2code, producerVersion=0.5.0 + evidence URI=urn:onlydsl:development-evidence:sha256:7c65453adebf716a4e08aab09ed8f107e551f93232c011a61dfe5b47a55491ac + authorityEffect=none, mutationEffect=none + +AUTHORIZATION + Human explicitly approved creation of a concurrent integration ticket with + --force-new. Implementation approval has not been granted. + +No implementation path changed. State: WAIT_FOR_APPROVAL. + +PASS ./project/governance-check.sh + GOV-PASS: passed (0 errors, 0 warnings) + +2026-08-08 human plan decision + APPROVED ticket-058 plan + APPROVED creation of owner-workstream tickets + NOT trusted merge authorization + ticket-058 remains non-active while ticket-054 reserves integration diff --git a/project/ticket-058/ai-codex.md b/project/ticket-058/ai-codex.md new file mode 100644 index 0000000..b54431d --- /dev/null +++ b/project/ticket-058/ai-codex.md @@ -0,0 +1,51 @@ +--- +participant-id: agent:codex +participant: codex +role: agent +ticket: ticket-058 +--- +# Participant: codex (AI agent) + +## Understanding + +Todo2code currently has two simultaneously true but incompatible identities. +Release and SDK metadata say `0.5.1`, while the runtime constant, CLI and every +new provenance envelope say `0.5.0`. doDSL is not inventing the older value; +it reads it from the pinned todo2code CLI and binds it to the exact analysed Git +commit and tree. + +Changing one string would make the immediate output look correct but would not +prevent the next partial release. The repair therefore needs a deterministic +version contract plus removal of current-version literals from behavioral +tests. Historical artifacts must not be rewritten. + +## Execution plan after approval + +1. Create separate `core-dsl`, `extractors` and `runtime` tickets with + ticket-058 as their integration coordinator. +2. Align the core runtime version and replace only current-behavior literals in + the owning test workstreams. +3. Once the active integration reservation permits it, add the no-dependency + version verifier, focused negative fixtures and the root verify hook. +4. Run focused tests, `npm run verify`, governance, Docker smoke and both E2E + profiles. +5. Rebuild the todo2code image consumed by doDSL, compile a fresh candidate and + verify the resulting DevelopmentEvidenceDSL identity and safety fields. + +## Actual changes + +- Audited all release/runtime declarations at exact main HEAD. +- Identified the release commit that introduced the mismatch. +- Confirmed the live CLI emits `todo2code 0.5.0` while package and VERSION are + `0.5.1`. +- Confirmed doDSL faithfully persists that emitted producer version. +- Created planning evidence only; no implementation file changed. +- Recorded the human approval of this plan and authorization to create the + three owner-workstream tickets. + +## Blockers + +- Ticket-054 currently reserves the `integration` workstream. The approved + `--force-new` exception created this ticket but does not silently + override active-scope enforcement. +- Each non-integration path requires its owning workstream ticket. diff --git a/project/ticket-058/changelog.md b/project/ticket-058/changelog.md new file mode 100644 index 0000000..b880580 --- /dev/null +++ b/project/ticket-058/changelog.md @@ -0,0 +1,14 @@ +# Ticket Changelog (ticket-058) + +## [0.1.0] - 2026-08-08 + +- Created the explicitly authorized concurrent integration planning ticket. +- Recorded the exact `0.5.1` release metadata versus `0.5.0` runtime mismatch. +- Defined a multi-workstream repair with a dependency-free drift gate. +- Preserved the distinction between current-version assertions and historical + fixtures. +- Made no executable, runtime, dependency, Docker or consumer changes. +- Passed the repository governance check with zero errors and zero warnings. +- Recorded human approval of the plan and owner-ticket creation. +- Moved to `BLOCKED / WAIT_FOR_DEPENDENCIES` until ticket-054 releases the + integration workstream. diff --git a/project/ticket-058/intent.json b/project/ticket-058/intent.json new file mode 100644 index 0000000..eed31bf --- /dev/null +++ b/project/ticket-058/intent.json @@ -0,0 +1,105 @@ +{ + "schema": "new-project.intent/v3", + "ticket": "ticket-058", + "summary": "Synchronize todo2code release and runtime version identity", + "workstream": "integration", + "classification": { + "kind": "BUG", + "priority": "P1", + "origin": "regression" + }, + "allowedPaths": [ + "project/ticket-058/**", + "TODO.md", + "project/TICKETS.md", + "package.json", + "scripts/verify-version-contract.mjs", + "scripts/verify-version-contract.test.mjs" + ], + "forbiddenPaths": [ + "project/ticket-*/user-*.md", + "src/**", + "test/**", + "sdk/**", + "Dockerfile*", + "compose*.yml", + ".env*" + ], + "stacks": ["node", "docker"], + "dependsOn": [], + "conflictsWith": ["ticket-054"], + "integrationTicket": null, + "delivery": { + "acceptedBaseSha": "738d7be93168fe73cccf14d3d589e545919c9a6f", + "targetBranch": "main", + "outcome": "Every current todo2code artifact exposes one release identity and a deterministic integration gate prevents partial future bumps", + "nonGoals": [ + "No new version, tag or publication", + "No dependency or runtime toolchain change", + "No rewrite of historical versioned evidence", + "No authority or command execution from model output" + ], + "complexity": "S", + "estimatedMinutes": 25, + "budgets": { + "maxImplementationFiles": 3, + "maxAffectedComponents": 2, + "maxPublicInterfaceChanges": 0, + "maxRuntimeDependencies": 0 + }, + "architecture": { + "status": "accepted", + "decision": "Treat release version as an integration contract, verify every declaration deterministically and let each workstream update only its owned current-version assertions", + "components": [ + { + "name": "version-contract-verifier", + "paths": [ + "scripts/verify-version-contract.mjs", + "scripts/verify-version-contract.test.mjs" + ] + }, + { + "name": "root-verification-orchestration", + "paths": ["package.json"] + } + ], + "responsibilityChanges": false, + "interfaceChanges": [], + "dataChanges": [ + "Current generated provenance changes from the stale runtime identity 0.5.0 to the accepted release identity 0.5.1" + ], + "ui": {"impact": "none", "states": [], "evidence": []}, + "rollback": "Remove the verifier hook and scripts; workstream-owned version corrections retain their own rollback and evidence" + }, + "runtimeDependencies": [], + "validation": [ + { + "criterion": "AC-03", + "commands": [ + "node --test scripts/verify-version-contract.test.mjs", + "node scripts/verify-version-contract.mjs" + ], + "evidence": "The verifier accepts one identity and fails each isolated mismatch with a stable diagnostic" + }, + { + "criterion": "AC-05", + "commands": [ + "npm run verify", + "./project/governance-check.sh", + "make docker-smoke", + "make e2e-core", + "make e2e-full" + ], + "evidence": "Host, policy and both Docker profiles pass without hidden fallback" + }, + { + "criterion": "AC-06", + "commands": [ + "doDSL compile with requireTodo2code=true", + "onlyDSL DevelopmentEvidenceDSL verification" + ], + "evidence": "A fresh immutable evidence bundle reports todo2code 0.5.1 and no authority or mutation effect" + } + ] + } +} diff --git a/project/ticket-058/preprompt.md b/project/ticket-058/preprompt.md new file mode 100644 index 0000000..78e20a4 --- /dev/null +++ b/project/ticket-058/preprompt.md @@ -0,0 +1,10 @@ +# Ticket preprompt + +- **Task ID**: ticket-058 +- **Task title**: Synchronize todo2code release and runtime version identity +- **Created**: 2026-08-08T21:46:52Z + +The human explicitly authorized creating this concurrent `integration` ticket +with `--force-new`. The approval applies to ticket creation, not implementation. +Keep executable implementation outside this governance/evidence directory and +respect every workstream's owned paths. diff --git a/project/ticket-059/README.md b/project/ticket-059/README.md new file mode 100644 index 0000000..f41be33 --- /dev/null +++ b/project/ticket-059/README.md @@ -0,0 +1,43 @@ +# Ticket 059: Align core runtime version with release identity + +- **ID**: ticket-059 +- **Owner**: unresolved:human +- **Status**: IN_PROGRESS +- **Workflow state**: VALIDATION +- **Created**: 2026-08-08 + +## Goal and scope + +Correct the single core runtime constant from `0.5.0` to the accepted release +identity `0.5.1`. This makes CLI output and newly generated provenance truthful +without changing schemas, dependencies, historical artifacts or authority. + +The one implementation path is `src/core/version.ts`, owned by `core-dsl`. +Tests with stale current-version literals are owned by sibling tickets under +the ticket-058 integration plan. + +## Acceptance criteria + +- [x] AC-01: A human approves this exact one-file implementation scope. +- [x] AC-02: `T2C_VERSION` and `t2c --version` report `0.5.1`. +- [ ] AC-03: New runtime provenance reports `0.5.1`; historical fixtures are + unchanged. +- [ ] AC-04: TypeScript check/build pass locally and the combined ticket-058 + branch passes the complete verification suite. + +## Participants + +- Human participant: unresolved; no `user-*` file was created. +- Agent participant: [ai-codex.md](ai-codex.md). + +## Approval gate + +The human approved tickets 059–063 and transition to `EDIT` after dependencies +on 2026-08-09. Ticket-059 has no unfinished implementation dependency; +ticket-058 is its coordinator, not a prerequisite. + +## Non-goals + +- No release bump, package manifest, test, SDK or Docker change. +- No rewriting of already materialized evidence. +- No model command execution or mutation/authority change. diff --git a/project/ticket-059/ai-codex-logs.txt b/project/ticket-059/ai-codex-logs.txt new file mode 100644 index 0000000..d193f8b --- /dev/null +++ b/project/ticket-059/ai-codex-logs.txt @@ -0,0 +1,29 @@ +2026-08-08 pre-implementation evidence + +FAIL src/core/version.ts + T2C_VERSION=0.5.0 while release identity=0.5.1 + +IMPACT + CLI, pipeline manifests and generated provenance expose the stale value + +SCOPE + src/core/version.ts only + +No implementation changed. State: WAIT_FOR_APPROVAL. + +PASS ./project/governance-check.sh + GOV-PASS: passed (0 errors, 0 warnings) + +2026-08-09 approval + APPROVED ticket-059 plan and transition to EDIT + ticket-058 retained as integrationTicket, not dependsOn + +2026-08-09 implementation validation + PASS npm ci (3 packages, 0 vulnerabilities) + PASS npm run check + PASS npm run build + PASS node dist/src/cli.js --version -> todo2code 0.5.1 + PASS ./project/governance-check.sh (0 errors, 0 warnings) + +Implementation scope + src/core/version.ts: T2C_VERSION 0.5.0 -> 0.5.1 diff --git a/project/ticket-059/ai-codex.md b/project/ticket-059/ai-codex.md new file mode 100644 index 0000000..e9d1f58 --- /dev/null +++ b/project/ticket-059/ai-codex.md @@ -0,0 +1,31 @@ +--- +participant-id: agent:codex +participant: codex +role: agent +ticket: ticket-059 +--- +# Participant: codex (AI agent) + +## Understanding + +The runtime constant is read by the CLI, pipeline manifests and DSL provenance. +It remained `0.5.0` when release metadata moved to `0.5.1`. + +## Execution plan + +1. Wait for explicit approval and transition to `IN_PROGRESS / EDIT`. +2. Change only `src/core/version.ts` from `0.5.0` to `0.5.1`. +3. Run type checking, build and direct CLI/provenance probes. +4. Hand the exact commit to ticket-058 for combined validation. + +## Actual changes + +- Audited the runtime version data flow and prepared a one-file correction. +- Human approved the exact scope and transition to `EDIT` on 2026-08-09. +- Changed only `src/core/version.ts` from `0.5.0` to `0.5.1`. +- Type checking, build, direct CLI probe and governance pass. + +## Blockers + +- Full test validation depends on sibling assertion tickets coordinated by + ticket-058. diff --git a/project/ticket-059/changelog.md b/project/ticket-059/changelog.md new file mode 100644 index 0000000..6b02bc5 --- /dev/null +++ b/project/ticket-059/changelog.md @@ -0,0 +1,12 @@ +# Ticket Changelog (ticket-059) + +## [0.1.0] - 2026-08-08 + +- Created the core-owned child ticket coordinated by ticket-058. +- Defined the one-file runtime version correction. +- Made no executable change before approval. +- Passed governance with zero errors and zero warnings. +- Recorded human approval and transition to `IN_PROGRESS / EDIT`. +- Corrected ticket-058 from an implementation dependency to the dedicated + `integrationTicket` relationship. +- Corrected the core runtime identity to `0.5.1` and passed focused validation. diff --git a/project/ticket-059/intent.json b/project/ticket-059/intent.json new file mode 100644 index 0000000..3f660ff --- /dev/null +++ b/project/ticket-059/intent.json @@ -0,0 +1,55 @@ +{ + "schema": "new-project.intent/v3", + "ticket": "ticket-059", + "summary": "Align core runtime version with release identity", + "workstream": "core-dsl", + "classification": {"kind": "BUG", "priority": "P1", "origin": "regression"}, + "allowedPaths": [ + "project/ticket-059/**", + "TODO.md", + "project/TICKETS.md", + "src/core/version.ts" + ], + "forbiddenPaths": [ + "project/ticket-*/user-*.md", + "package.json", + "package-lock.json", + "test/**", + "sdk/**", + "Dockerfile*", + "compose*.yml", + ".env*" + ], + "stacks": ["node", "docker"], + "dependsOn": [], + "conflictsWith": [], + "integrationTicket": "ticket-058", + "delivery": { + "acceptedBaseSha": "132f87963921cd49dafa19b643b0528a3a434dd0", + "targetBranch": "main", + "outcome": "CLI and newly generated todo2code provenance report the accepted 0.5.1 release identity", + "nonGoals": [ + "No package or SDK metadata change", + "No historical fixture rewrite", + "No dependency, Docker or authority change" + ], + "complexity": "XS", + "estimatedMinutes": 10, + "budgets": {"maxImplementationFiles": 1, "maxAffectedComponents": 1, "maxPublicInterfaceChanges": 0, "maxRuntimeDependencies": 0}, + "architecture": { + "status": "accepted", + "decision": "Correct the existing core constant and leave release orchestration to ticket-058", + "components": [{"name": "runtime-version", "paths": ["src/core/version.ts"]}], + "responsibilityChanges": false, + "interfaceChanges": [], + "dataChanges": ["New runtime provenance changes from 0.5.0 to 0.5.1"], + "ui": {"impact": "none", "states": [], "evidence": []}, + "rollback": "Restore the previous constant only if accepted release metadata is also rolled back through governance" + }, + "runtimeDependencies": [], + "validation": [ + {"criterion": "AC-02", "commands": ["npm run check", "npm run build", "node dist/src/cli.js --version"], "evidence": "Build succeeds and CLI prints todo2code 0.5.1"}, + {"criterion": "AC-04", "commands": ["ticket-058 combined npm run verify and Docker gates"], "evidence": "The integrated version repair passes all required checks"} + ] + } +} diff --git a/project/ticket-059/preprompt.md b/project/ticket-059/preprompt.md new file mode 100644 index 0000000..ac546c4 --- /dev/null +++ b/project/ticket-059/preprompt.md @@ -0,0 +1,8 @@ +# Ticket preprompt + +- **Task ID**: ticket-059 +- **Task title**: Align core runtime version with release identity +- **Created**: 2026-08-08 + +Ticket-058 coordinates the cross-workstream repair. Keep this ticket limited to +the core-owned runtime version constant and wait for explicit approval. diff --git a/src/core/version.ts b/src/core/version.ts index 123e2b7..a8d5e3c 100644 --- a/src/core/version.ts +++ b/src/core/version.ts @@ -1,2 +1,2 @@ /** Runtime version embedded in every generated DSL provenance envelope. */ -export const T2C_VERSION = '0.5.0'; +export const T2C_VERSION = '0.5.1';