diff --git a/TODO.md b/TODO.md index 43c00f7..22db230 100644 --- a/TODO.md +++ b/TODO.md @@ -9,6 +9,13 @@ ## Backlog tickets +- [ ] [`ticket-063`](project/ticket-063/README.md) — replace the stale current + version literal in the Python SDK bridge test after ownership is established. + Current state: `BLOCKED / WAIT_FOR_DEPENDENCIES`; depends on ticket-062. +- [ ] [`ticket-058`](project/ticket-058/README.md) — synchronize release, + runtime, SDK and generated-provenance version identity and add a deterministic + drift gate. Plan and owner-ticket creation are approved; current state: + `BLOCKED / WAIT_FOR_DEPENDENCIES` while ticket-054 reserves `integration`. - [ ] [`ticket-051`](project/ticket-051/README.md) — wire `scripts/github-event-log.mjs` into CI with explicit flags only. Current state: `PLAN / WAIT_FOR_APPROVAL`; ticket-048 is now merged. diff --git a/project/TICKETS.md b/project/TICKETS.md index f5e2b87..39f736e 100644 --- a/project/TICKETS.md +++ b/project/TICKETS.md @@ -50,4 +50,6 @@ of `project/README.md`, which remains a generated technical-analysis artifact. | **ticket-054** | [`README.md`](./ticket-054/README.md) | [`preprompt.md`](./ticket-054/preprompt.md) | - | [`ai-codex.md`](./ticket-054/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-054/ai-codex-logs.txt) | [`changelog.md`](./ticket-054/changelog.md) | | **ticket-055** | [`README.md`](./ticket-055/README.md) | [`preprompt.md`](./ticket-055/preprompt.md) | - | [`ai-codex.md`](./ticket-055/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-055/ai-codex-logs.txt) | [`changelog.md`](./ticket-055/changelog.md) | | **ticket-056** | [`README.md`](./ticket-056/README.md) | [`preprompt.md`](./ticket-056/preprompt.md) | - | [`ai-codex.md`](./ticket-056/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-056/ai-codex-logs.txt) | [`changelog.md`](./ticket-056/changelog.md) | +| **ticket-058** | [`README.md`](./ticket-058/README.md) | [`preprompt.md`](./ticket-058/preprompt.md) | - | [`ai-codex.md`](./ticket-058/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-058/ai-codex-logs.txt) | [`changelog.md`](./ticket-058/changelog.md) | +| **ticket-063** | [`README.md`](./ticket-063/README.md) | [`preprompt.md`](./ticket-063/preprompt.md) | - | [`ai-codex.md`](./ticket-063/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-063/ai-codex-logs.txt) | [`changelog.md`](./ticket-063/changelog.md) | diff --git a/project/ticket-058/README.md b/project/ticket-058/README.md new file mode 100644 index 0000000..517bf6e --- /dev/null +++ b/project/ticket-058/README.md @@ -0,0 +1,90 @@ +# Ticket 058: Synchronize todo2code release and runtime version identity + +- **ID**: ticket-058 +- **Owner**: unresolved:human +- **Status**: BLOCKED +- **Workflow state**: WAIT_FOR_DEPENDENCIES +- **Created**: 2026-08-08 + +## Goal and scope + +Restore one auditable todo2code release identity across the root release +metadata, SDK manifests, CLI output and every generated DSL provenance +envelope. Add a dependency-free integration gate that fails closed when a +future release updates only part of that identity. + +This ticket is the integration coordinator. Paths owned by `core-dsl`, +`extractors` and `runtime` must be corrected through separate governed tickets +that point back to ticket-058; this ticket does not transfer their ownership. + +## Verified regression + +At `main@738d7be93168fe73cccf14d3d589e545919c9a6f`: + +```text +package.json 0.5.1 +VERSION 0.5.1 +pyproject.toml 0.5.1 +Python/Rust/TypeScript SDKs 0.5.1 +src/core/version.ts 0.5.0 +t2c --version todo2code 0.5.0 +doDSL DevelopmentEvidenceDSL producerVersion 0.5.0 +``` + +Commit `99286994cc604e80b401fc16f4230e33e90df253` raised the release and +SDK metadata to `0.5.1` without changing the runtime constant. Several tests +then encoded `0.5.0` directly, so the normal suite preserved rather than +detected the drift. + +## Proposed delivery + +1. Add an integration-owned, dependency-free version-contract verifier and + focused tests under `scripts/`, then make it part of `npm run verify`. +2. Through a `core-dsl` ticket, align `T2C_VERSION` with the accepted release + identity. +3. Through `extractors` and `runtime` tickets, replace current-version literals + with the exported runtime identity where they assert current behavior. + Historical fixtures remain pinned when their old version is evidence. +4. Re-run the complete host, governance and Docker validation. +5. Rebuild the pinned todo2code runtime used by doDSL and prove that a new + DevelopmentEvidenceDSL bundle reports `producerVersion "0.5.1"` while + retaining its exact Git commit/tree and no authority or mutation effect. + +Ticket creation with `--force-new` was explicitly authorized by the human on +2026-08-08. That authorization permits this concurrent planning ticket; it is +not approval to edit implementation paths or weaken the active ticket limits. + +## Acceptance criteria + +- [x] AC-01: A human approves this scope and the multi-workstream split. +- [ ] AC-02: Root release metadata, SDK manifests, `T2C_VERSION`, CLI output + and newly generated provenance all report the same accepted version. +- [ ] AC-03: A dependency-free verifier emits a stable diagnostic and non-zero + status for every supported version-identity mismatch. +- [ ] AC-04: Tests asserting the current runtime use the canonical exported + identity; deliberately historical fixtures remain visibly pinned. +- [ ] AC-05: `npm run verify`, governance, Docker smoke and both Docker E2E + profiles pass without skipped checks being counted as passes. +- [ ] AC-06: A fresh doDSL compile records todo2code `0.5.1`, an exact source + revision/tree and `AUTHORITY_EFFECT none` / `MUTATION_EFFECT none`. + +## Participants + +- Human participant: unresolved; no `user-*` file was created. +- Agent participant: [ai-codex.md](ai-codex.md). + +## Approval gate + +The human approved this plan and creation of the owner-workstream tickets on +2026-08-08. This ticket is now `BLOCKED / WAIT_FOR_DEPENDENCIES`: ticket-054 +still reserves `integration`, so the verifier and root verify-hook cannot enter +`EDIT`. Distinct child workstreams may proceed only through their own approved +tickets. Conversation approval is an audit note, not trusted merge authority. + +## Non-goals + +- No new release number, Git tag or package publication. +- No dependency, secret, AQL, Docker runtime or model configuration change. +- No reinterpretation of historical `0.5.0` fixtures as current evidence. +- No command execution or mutation authority derived from LLM output. +- No direct edit of paths owned by another workstream under ticket-058. diff --git a/project/ticket-058/ai-codex-logs.txt b/project/ticket-058/ai-codex-logs.txt new file mode 100644 index 0000000..c2c075f --- /dev/null +++ b/project/ticket-058/ai-codex-logs.txt @@ -0,0 +1,39 @@ +2026-08-08 pre-implementation audit + +PASS repository state + main@738d7be93168fe73cccf14d3d589e545919c9a6f + original worktree clean before ticket allocation + +FAIL release identity consistency + package.json=0.5.1 + VERSION=0.5.1 + pyproject.toml=0.5.1 + sdk/python=0.5.1 + sdk/rust=0.5.1 + sdk/typescript=0.5.1 + src/core/version.ts=0.5.0 + dist CLI output=todo2code 0.5.0 + +EVIDENCE root cause + commit 99286994cc604e80b401fc16f4230e33e90df253 updated release and SDK + metadata from 0.5.0 to 0.5.1 but did not update src/core/version.ts + +EVIDENCE downstream observation + doDSL project dodsl-smoke reports producer=todo2code, producerVersion=0.5.0 + evidence URI=urn:onlydsl:development-evidence:sha256:7c65453adebf716a4e08aab09ed8f107e551f93232c011a61dfe5b47a55491ac + authorityEffect=none, mutationEffect=none + +AUTHORIZATION + Human explicitly approved creation of a concurrent integration ticket with + --force-new. Implementation approval has not been granted. + +No implementation path changed. State: WAIT_FOR_APPROVAL. + +PASS ./project/governance-check.sh + GOV-PASS: passed (0 errors, 0 warnings) + +2026-08-08 human plan decision + APPROVED ticket-058 plan + APPROVED creation of owner-workstream tickets + NOT trusted merge authorization + ticket-058 remains non-active while ticket-054 reserves integration diff --git a/project/ticket-058/ai-codex.md b/project/ticket-058/ai-codex.md new file mode 100644 index 0000000..b54431d --- /dev/null +++ b/project/ticket-058/ai-codex.md @@ -0,0 +1,51 @@ +--- +participant-id: agent:codex +participant: codex +role: agent +ticket: ticket-058 +--- +# Participant: codex (AI agent) + +## Understanding + +Todo2code currently has two simultaneously true but incompatible identities. +Release and SDK metadata say `0.5.1`, while the runtime constant, CLI and every +new provenance envelope say `0.5.0`. doDSL is not inventing the older value; +it reads it from the pinned todo2code CLI and binds it to the exact analysed Git +commit and tree. + +Changing one string would make the immediate output look correct but would not +prevent the next partial release. The repair therefore needs a deterministic +version contract plus removal of current-version literals from behavioral +tests. Historical artifacts must not be rewritten. + +## Execution plan after approval + +1. Create separate `core-dsl`, `extractors` and `runtime` tickets with + ticket-058 as their integration coordinator. +2. Align the core runtime version and replace only current-behavior literals in + the owning test workstreams. +3. Once the active integration reservation permits it, add the no-dependency + version verifier, focused negative fixtures and the root verify hook. +4. Run focused tests, `npm run verify`, governance, Docker smoke and both E2E + profiles. +5. Rebuild the todo2code image consumed by doDSL, compile a fresh candidate and + verify the resulting DevelopmentEvidenceDSL identity and safety fields. + +## Actual changes + +- Audited all release/runtime declarations at exact main HEAD. +- Identified the release commit that introduced the mismatch. +- Confirmed the live CLI emits `todo2code 0.5.0` while package and VERSION are + `0.5.1`. +- Confirmed doDSL faithfully persists that emitted producer version. +- Created planning evidence only; no implementation file changed. +- Recorded the human approval of this plan and authorization to create the + three owner-workstream tickets. + +## Blockers + +- Ticket-054 currently reserves the `integration` workstream. The approved + `--force-new` exception created this ticket but does not silently + override active-scope enforcement. +- Each non-integration path requires its owning workstream ticket. diff --git a/project/ticket-058/changelog.md b/project/ticket-058/changelog.md new file mode 100644 index 0000000..b880580 --- /dev/null +++ b/project/ticket-058/changelog.md @@ -0,0 +1,14 @@ +# Ticket Changelog (ticket-058) + +## [0.1.0] - 2026-08-08 + +- Created the explicitly authorized concurrent integration planning ticket. +- Recorded the exact `0.5.1` release metadata versus `0.5.0` runtime mismatch. +- Defined a multi-workstream repair with a dependency-free drift gate. +- Preserved the distinction between current-version assertions and historical + fixtures. +- Made no executable, runtime, dependency, Docker or consumer changes. +- Passed the repository governance check with zero errors and zero warnings. +- Recorded human approval of the plan and owner-ticket creation. +- Moved to `BLOCKED / WAIT_FOR_DEPENDENCIES` until ticket-054 releases the + integration workstream. diff --git a/project/ticket-058/intent.json b/project/ticket-058/intent.json new file mode 100644 index 0000000..eed31bf --- /dev/null +++ b/project/ticket-058/intent.json @@ -0,0 +1,105 @@ +{ + "schema": "new-project.intent/v3", + "ticket": "ticket-058", + "summary": "Synchronize todo2code release and runtime version identity", + "workstream": "integration", + "classification": { + "kind": "BUG", + "priority": "P1", + "origin": "regression" + }, + "allowedPaths": [ + "project/ticket-058/**", + "TODO.md", + "project/TICKETS.md", + "package.json", + "scripts/verify-version-contract.mjs", + "scripts/verify-version-contract.test.mjs" + ], + "forbiddenPaths": [ + "project/ticket-*/user-*.md", + "src/**", + "test/**", + "sdk/**", + "Dockerfile*", + "compose*.yml", + ".env*" + ], + "stacks": ["node", "docker"], + "dependsOn": [], + "conflictsWith": ["ticket-054"], + "integrationTicket": null, + "delivery": { + "acceptedBaseSha": "738d7be93168fe73cccf14d3d589e545919c9a6f", + "targetBranch": "main", + "outcome": "Every current todo2code artifact exposes one release identity and a deterministic integration gate prevents partial future bumps", + "nonGoals": [ + "No new version, tag or publication", + "No dependency or runtime toolchain change", + "No rewrite of historical versioned evidence", + "No authority or command execution from model output" + ], + "complexity": "S", + "estimatedMinutes": 25, + "budgets": { + "maxImplementationFiles": 3, + "maxAffectedComponents": 2, + "maxPublicInterfaceChanges": 0, + "maxRuntimeDependencies": 0 + }, + "architecture": { + "status": "accepted", + "decision": "Treat release version as an integration contract, verify every declaration deterministically and let each workstream update only its owned current-version assertions", + "components": [ + { + "name": "version-contract-verifier", + "paths": [ + "scripts/verify-version-contract.mjs", + "scripts/verify-version-contract.test.mjs" + ] + }, + { + "name": "root-verification-orchestration", + "paths": ["package.json"] + } + ], + "responsibilityChanges": false, + "interfaceChanges": [], + "dataChanges": [ + "Current generated provenance changes from the stale runtime identity 0.5.0 to the accepted release identity 0.5.1" + ], + "ui": {"impact": "none", "states": [], "evidence": []}, + "rollback": "Remove the verifier hook and scripts; workstream-owned version corrections retain their own rollback and evidence" + }, + "runtimeDependencies": [], + "validation": [ + { + "criterion": "AC-03", + "commands": [ + "node --test scripts/verify-version-contract.test.mjs", + "node scripts/verify-version-contract.mjs" + ], + "evidence": "The verifier accepts one identity and fails each isolated mismatch with a stable diagnostic" + }, + { + "criterion": "AC-05", + "commands": [ + "npm run verify", + "./project/governance-check.sh", + "make docker-smoke", + "make e2e-core", + "make e2e-full" + ], + "evidence": "Host, policy and both Docker profiles pass without hidden fallback" + }, + { + "criterion": "AC-06", + "commands": [ + "doDSL compile with requireTodo2code=true", + "onlyDSL DevelopmentEvidenceDSL verification" + ], + "evidence": "A fresh immutable evidence bundle reports todo2code 0.5.1 and no authority or mutation effect" + } + ] + } +} diff --git a/project/ticket-058/preprompt.md b/project/ticket-058/preprompt.md new file mode 100644 index 0000000..78e20a4 --- /dev/null +++ b/project/ticket-058/preprompt.md @@ -0,0 +1,10 @@ +# Ticket preprompt + +- **Task ID**: ticket-058 +- **Task title**: Synchronize todo2code release and runtime version identity +- **Created**: 2026-08-08T21:46:52Z + +The human explicitly authorized creating this concurrent `integration` ticket +with `--force-new`. The approval applies to ticket creation, not implementation. +Keep executable implementation outside this governance/evidence directory and +respect every workstream's owned paths. diff --git a/project/ticket-063/README.md b/project/ticket-063/README.md new file mode 100644 index 0000000..101d05a --- /dev/null +++ b/project/ticket-063/README.md @@ -0,0 +1,37 @@ +# Ticket 063: Use canonical version in Python SDK runtime assertion + +- **ID**: ticket-063 +- **Owner**: unresolved:human +- **Status**: BLOCKED +- **Workflow state**: WAIT_FOR_DEPENDENCIES +- **Created**: 2026-08-08 + +## Goal and scope + +Replace the current CLI version literal inside the Python SDK bridge test with +the canonical `T2C_VERSION`. The edit may start only after ticket-062 assigns +this currently unowned test path to the `sdk` workstream through protected +governance evolution. + +## Acceptance criteria + +- [x] AC-01: A human approves the one-test-file SDK scope. +- [ ] AC-02: Ticket-062 proves deterministic SDK ownership before `EDIT`. +- [ ] AC-03: The Python bridge compares CLI output with `T2C_VERSION`, not a + copied `0.5.0` literal. +- [ ] AC-04: The focused Python runtime test passes with ticket-059. + +## Participants + +- Human participant: unresolved; no `user-*` file was created. +- Agent participant: [ai-codex.md](ai-codex.md). + +## Approval gate + +The human approved ticket-063 on 2026-08-09. It remains non-active and no test +edit is permitted until the ownership contract from ticket-062 is adopted. + +## Non-goals + +- No Python SDK behavior, runtime source, dependency or Docker change. +- No governance manifest or lock edit in this ticket. diff --git a/project/ticket-063/ai-codex-logs.txt b/project/ticket-063/ai-codex-logs.txt new file mode 100644 index 0000000..c308fa2 --- /dev/null +++ b/project/ticket-063/ai-codex-logs.txt @@ -0,0 +1,17 @@ +2026-08-09 pre-implementation evidence + +FAIL test/python-runtime.test.ts + embedded Python script expects todo2code 0.5.0 as current CLI output + +BLOCKED OWNERSHIP + path matches no current workstream glob + ticket-062 owns the protected governance route + +No implementation changed. State: WAIT_FOR_APPROVAL. + +PASS ./project/governance-check.sh + GOV-PASS: passed (0 errors, 0 warnings) + +2026-08-09 approval + APPROVED ticket-063 scope + NOT ACTIVE: ticket-062 ownership dependency unfinished diff --git a/project/ticket-063/ai-codex.md b/project/ticket-063/ai-codex.md new file mode 100644 index 0000000..30ac3bf --- /dev/null +++ b/project/ticket-063/ai-codex.md @@ -0,0 +1,34 @@ +--- +participant-id: agent:codex +participant: codex +role: agent +ticket: ticket-063 +--- +# Participant: codex (AI agent) + +## Understanding + +The Python SDK bridge invokes the TypeScript CLI and asserts the current version +with a copied string. It should use the exported identity, but the test path has +no declared owner yet and cannot be edited until ticket-062 resolves that gap. + +## Execution plan + +1. Wait for human approval and successful ticket-062 governance adoption. +2. Transition to `IN_PROGRESS / EDIT` only after SDK ownership is verified. +3. Import/use `T2C_VERSION` in the embedded Python assertion without changing + SDK behavior. +4. Build and run the focused Python runtime bridge test. +5. Hand the exact commit to ticket-058 for combined validation. + +## Actual changes + +- Classified the literal as a current CLI assertion. +- Recorded the ownership dependency on ticket-062. +- No test or SDK file changed. +- Human approved the scope on 2026-08-09; status is + `BLOCKED / WAIT_FOR_DEPENDENCIES`. + +## Blockers + +- Ticket-062 must first establish deterministic SDK ownership. diff --git a/project/ticket-063/changelog.md b/project/ticket-063/changelog.md new file mode 100644 index 0000000..bffe63a --- /dev/null +++ b/project/ticket-063/changelog.md @@ -0,0 +1,11 @@ +# Ticket Changelog (ticket-063) + +## [0.1.0] - 2026-08-08 + +- Initial governance scaffold created. +- No human participant identity or content was generated. +- Recorded the one-file SDK assertion repair and its ownership dependency. +- Made no test, SDK or governance change. +- Passed governance with zero errors and zero warnings. +- Recorded human approval and moved to + `BLOCKED / WAIT_FOR_DEPENDENCIES` on ticket-062. diff --git a/project/ticket-063/intent.json b/project/ticket-063/intent.json new file mode 100644 index 0000000..7357a06 --- /dev/null +++ b/project/ticket-063/intent.json @@ -0,0 +1,55 @@ +{ + "schema": "new-project.intent/v3", + "ticket": "ticket-063", + "summary": "Use canonical version in Python SDK runtime assertion", + "workstream": "sdk", + "classification": { + "kind": "BUG", + "priority": "P1", + "origin": "regression" + }, + "allowedPaths": [ + "project/ticket-063/**", + "TODO.md", + "project/TICKETS.md", + "test/python-runtime.test.ts" + ], + "forbiddenPaths": [ + "project/ticket-*/user-*.md", + ".governance/**", + "src/**", + "package.json", + "package-lock.json", + "sdk/**", + "Dockerfile*", + "compose*.yml", + ".env*" + ], + "stacks": ["node", "python", "docker"], + "dependsOn": ["ticket-062"], + "conflictsWith": [], + "integrationTicket": "ticket-058", + "delivery": { + "acceptedBaseSha": "132f87963921cd49dafa19b643b0528a3a434dd0", + "targetBranch": "main", + "outcome": "The Python SDK bridge verifies current CLI identity through the canonical exported version", + "nonGoals": ["No SDK behavior change", "No governance edit", "No dependency or Docker change"], + "complexity": "XS", + "estimatedMinutes": 10, + "budgets": {"maxImplementationFiles": 1, "maxAffectedComponents": 1, "maxPublicInterfaceChanges": 0, "maxRuntimeDependencies": 0}, + "architecture": { + "status": "accepted", + "decision": "Reference the canonical TypeScript runtime identity from the current Python bridge assertion after SDK ownership is established", + "components": [{"name": "python-runtime-bridge-test", "paths": ["test/python-runtime.test.ts"]}], + "responsibilityChanges": false, + "interfaceChanges": [], + "dataChanges": [], + "ui": {"impact": "none", "states": [], "evidence": []}, + "rollback": "Restore a literal only if the test becomes a deliberately versioned historical fixture" + }, + "runtimeDependencies": [], + "validation": [ + {"criterion": "AC-04", "commands": ["npm run build", "node --test dist/test/python-runtime.test.js"], "evidence": "The Python SDK bridge accepts the corrected current CLI identity"} + ] + } +} diff --git a/project/ticket-063/preprompt.md b/project/ticket-063/preprompt.md new file mode 100644 index 0000000..0c68ea7 --- /dev/null +++ b/project/ticket-063/preprompt.md @@ -0,0 +1,8 @@ +# Ticket preprompt + +- **Task ID**: ticket-063 +- **Task title**: Use canonical version in Python SDK runtime assertion +- **Created**: 2026-08-08T21:56:42Z + +Keep executable implementation outside this governance/evidence directory. +Read a human-owned user-*.md file only when one exists.