[ticket-102] Adopt the published validation base fix

[tom-sapletta-com]

Ticket: ticket-102

Adopt wellmanifest/new-project v0.20.21 at the independently merged and released
revision d1f35ed1b8be60f50a6739984c947a30379ead5b (upstream PR #319).

The managed fix bounds implicit adoption validation on a clean published
integration to its first parent. Explicit bases and uncertain or dirty states
retain conservative handling. Update the exact reusable CI and package bindings;
preserve all workflow conditions, Docker requirements, Koru review and the
independent Validator boundary. No runtime feature or historical ticket changes.

Validation:

• Immutable adoption check: up-to-date; exact working-tree governance: PASS.
• make verify: 450 passed, 1 skipped, 0 failed.
• make smoke: 227 records and 227 relations.
• Docker build, healthz and doctor smoke: PASS.
• Protected head checks and independent review/merge remain required.
• Final acceptance includes observing a fresh main CI run after merge.

Raw logs remain in private receipt storage outside Git (todo2code/ticket-102).

[ifuri-validator-agent]

Validator approval after policy checks for exact head f37adfccc23be994fad4ae2ee20c375a36f1a670.

Ticket: ticket-102
Correlation ID: todo2code-pr123-ticket102-f37adfc
Model: openrouter/z-ai/glm-5.3-flash
Package advisory authority: ADVISORY (promotion FORBIDDEN)
Package digest: 92d2d47a65f085a5991d8e1e1de6bad8ddb4e029f6d4a2a873cc56a683d30101
Package evidence digest: d67ab951234eebbc94eb1517dacbd7c0f2b5e3c896ed355ae4cf72d9ed287fbd
Package files: 4; high-risk samples: .governance/governance_check.py, .governance/manifest.json
Reviewed diff chunks: 2
Advisory LLM verdict: APPROVE
Advisory summary: Reviewed all 2 diff chunk(s). Bounded standard adoption from wellmanifest/new-project v0.20.21 at pinned revision d1f35ed1b8be60f50a6739984c947a30379ead5b. Changes are consistent: reusable workflow ref, standard-ref, manifest versions, lock digests, and package bindings (package.json, pyproject.toml) all updated to the same revision. The governance_check.py change adds a conservative fallback that only bounds validation base for published adoptions when HEAD exactly matches the origin target branch and the integration is verified published; explicit bases and uncertain states keep prior behavior. New ticket-102 intent and README document scope, allowed paths match the actual diff, and rollback path is defined. | This chunk contains only the pyproject.toml [tool.wellmanifest] binding bump from standard 0.20.20/revision d31beca6 to 0.20.21/revision d1f35ed1, consistent with the PR's stated adoption of the independently released standard revision. All protected required checks (verify, Java adapter (JDK 17 required), koru / code-review) show PASS. The SKIPPING entries (governance, Live OpenRouter contract) are on nonrequired checks and are observations only.
Advisory findings: none
The LLM output above is advisory and was not used as the approval trust root.
Semantic review prerequisite: satisfied; policy 676cb4516bbfed2a000e40b9b1b6e4a430ecc761ec546aeb53d721a1905cfdd7.

Actual PR impact radar

Exact range: cdf29f2c19a0edbab65f76269240502de04c568d...f37adfccc23be994fad4ae2ee20c375a36f1a670
Change digest: 425b5bda8c494b4272df69f17061b6b119d6b8200b69a38730dcea62c0fc4ee6
Score: 72/100 (L), estimated 93 min, split recommended: true
Affected services/components: repository-wide/unclassified

Machine-readable radar JSONL and SVG

{"actual_change":{"additions":180,"base_sha":"cdf29f2c19a0edbab65f76269240502de04c568d","binary_files":0,"categories":{"code":1,"configuration":7,"docs":1},"change_digest":"425b5bda8c494b4272df69f17061b6b119d6b8200b69a38730dcea62c0fc4ee6","comparison":"cdf29f2c19a0edbab65f76269240502de04c568d...f37adfccc23be994fad4ae2ee20c375a36f1a670","deletions":14,"file_count":9,"files":["github/workflows/ci.yml","governance/governance_check.py","governance/manifest.base.json","governance/manifest.json","governance/manifest.lock.json","package.json","project/ticket-102/README.md","project/ticket-102/intent.json","pyproject.toml"],"head_sha":"f37adfccc23be994fad4ae2ee20c375a36f1a670","service_count":0,"services":[]},"assessment_mode":"observed-pr","axes":{"coupling":5,"delivery":4,"scope":5,"uncertainty":3,"validation":1},"complexity":"L","confidence":0.9,"diagnostics":["RADAR-ACCEPTANCE-MISSING","RADAR-BUDGET-EXCEEDED"],"estimate":{"budget_minutes":30,"minutes":93,"within_budget":false},"impact":{"components":["github","governance","project","repository-root","review","todo2code","wellmanifest"],"files":["github/workflows/ci.yml","governance/governance_check.py","governance/manifest.base.json","governance/manifest.json","governance/manifest.lock.json","package.json","project/ticket-102/README.md","project/ticket-102/intent.json","pyproject.toml","review/merge","todo2code/ticket-102","wellmanifest/new-project"],"public_interfaces":[],"runtime_dependencies":1},"schema":"subactor.ticket-radar/v1","score":72,"split":{"parts":[{"estimated_minutes":12,"name":"Implement github","scope":["github"]},{"estimated_minutes":12,"name":"Implement governance","scope":["governance"]},{"estimated_minutes":12,"name":"Implement project","scope":["project"]},{"estimated_minutes":12,"name":"Implement repository-root","scope":["repository-root"]},{"estimated_minutes":12,"name":"Implement review","scope":["review"]},{"estimated_minutes":15,"name":"Validate and project to trackers","scope":["tests","planfile","github/gitlab/jira projections"]}],"reason":"estimated_minutes_exceed_budget","recommended":true},"standards":[{"id":"wellmanifest/dsl","revision":"6c60fc4e0dd1f1bb74f46a7745e28019908d1203","version":"0.1.0-dev"},{"id":"wellmanifest/ticket-lifecycle","revision":"5bf581907a87b46a13a73e6c033d3abe4d9a306f","version":"0.1.0-dev"},{"id":"wellmanifest/git-lifecycle","revision":"7d77d4b7af57e69bc75c3a0290b3a4805c5c4438","version":"0.2.0-dev"},{"id":"wellmanifest/logs","revision":"48c284ef7a069055c0bcb6b900147ce5e65f8b43","version":"0.3.0"}],"ticket_ref":"ticket-102"}

<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" viewBox="0 0 128 128" role="img"><title>ticket-102: [ticket-102] Adopt the published validation base fix</title><rect width="128" height="128" rx="12" fill="#f8fafc"/><g stroke-width="1"><polygon points="64,55 72,61 69,71 59,71 56,61" fill="none" stroke="#d7dde5"/><polygon points="64,47 80,59 74,78 54,78 48,59" fill="none" stroke="#d7dde5"/><polygon points="64,38 89,56 79,85 49,85 39,56" fill="none" stroke="#d7dde5"/><polygon points="64,30 97,53 84,92 44,92 31,53" fill="none" stroke="#d7dde5"/><polygon points="64,21 105,51 89,99 39,99 23,51" fill="none" stroke="#d7dde5"/><line x1="64" y1="64" x2="64" y2="21" stroke="#aab4c0"/><line x1="64" y1="64" x2="105" y2="51" stroke="#aab4c0"/><line x1="64" y1="64" x2="89" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="39" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="23" y2="51" stroke="#aab4c0"/></g><polygon points="64,21 105,51 79,85 59,71 31,53" fill="#fb923c" fill-opacity="0.45" stroke="#c2410c" stroke-width="2"/><circle cx="64" cy="64" r="3" fill="#c2410c"/><g font-family="sans-serif" font-size="7" fill="#334155"><text x="64" y="11" text-anchor="middle">SCO</text><text x="114" y="48" text-anchor="middle">COU</text><text x="95" y="107" text-anchor="middle">UNC</text><text x="33" y="107" text-anchor="middle">VAL</text><text x="14" y="48" text-anchor="middle">DEL</text></g><text x="64" y="124" text-anchor="middle" font-family="sans-serif" font-size="8" fill="#0f172a">L · 93m</text></svg>

Merge will be attempted after this approval when explicitly authorized. ## Decision record (recomputable)

DECISION D-102-9020
TICKET ticket-102
HEAD_SHA f37adfccc23be994fad4ae2ee20c375a36f1a670
CORRELATION_ID todo2code-pr123-ticket102-f37adfc
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT advisory_package_receipt = {"binding":{"repository":"autogrammar/todo2code","pull_request":123,"base_branch":"main","base_sha":"cdf29f2c19a0edbab65f76269240502de04c568d","head_sha":"f37adfccc23be994fad4ae2ee20c375a36f1a670","policy_digest":"99ca0b04bbf9c31da3269b6c8364fd0f131125ecc56b1ca2c51c23f7d25e0859","registry_digest":"4770cd0702160f57ea28918119eb5be314aeedd87f3ae44803fe070de029be82"},"package_digest":"92d2d47a65f085a5991d8e1e1de6bad8ddb4e029f6d4a2a873cc56a683d30101","evidence_digest":"d67ab951234eebbc94eb1517dacbd7c0f2b5e3c896ed355ae4cf72d9ed287fbd","package_file_count":4,"samples":[{"path":".governance/governance_check.py","risk":"executable,code","diff_digest":"9dcbd139ce0d58124667cca25c0d01714038c0082fb4127c2a6c71727012fea7","sample_digest":"e56724adf39604abd75d678b3265fcebbf934f9ba43dba0a5304c045b8307f72"},{"path":".governance/manifest.json","risk":"extendable","diff_digest":"8a2603a5aee74d63eb64288c8bfb7fe43b88103a01ee3515f367b97135013d88","sample_digest":"8a2603a5aee74d63eb64288c8bfb7fe43b88103a01ee3515f367b97135013d88"}],"authority":"ADVISORY","promotion":"FORBIDDEN"}
INPUT author_login = "tom-sapletta-com"
INPUT observed_checks = ["governance=SKIPPING","Live OpenRouter contract (opt-in)=SKIPPING","Java adapter (JDK 17 required)=PASS","verify=PASS","governance / enforce=PASS","koru / code-review=PASS","governance / remote lifecycle=PASS","verify=PASS","Java adapter (JDK 17 required)=PASS"]
INPUT required_checks = ["verify","Java adapter (JDK 17 required)","koru / code-review"]
INPUT required_checks_source = "protected registry + GitHub applied rules (env/request)"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
INPUT semantic_review_assessment = {"schema":"subactor.validator/semantic-review-assessment/v1","subject":{"repository":"autogrammar/todo2code","pull_request":123,"head_sha":"f37adfccc23be994fad4ae2ee20c375a36f1a670","base_sha":"cdf29f2c19a0edbab65f76269240502de04c568d","diff_sha256":"b99480aeca97652b473aa7bbf6681046ff65aa54675a0241ad5e010d8562f89a"},"policy":{"policy_schema":"subactor.validator/semantic-review-policy/v1","policy_version":1,"policy_sha256":"676cb4516bbfed2a000e40b9b1b6e4a430ecc761ec546aeb53d721a1905cfdd7","required":true,"critical_paths":[".github/workflows/ci.yml",".governance/governance_check.py",".governance/manifest.base.json",".governance/manifest.json",".governance/manifest.lock.json"],"observed_paths":[".github/workflows/ci.yml",".governance/governance_check.py",".governance/manifest.base.json",".governance/manifest.json",".governance/manifest.lock.json","package.json","project/ticket-102/README.md","project/ticket-102/intent.json","pyproject.toml"]},"grounding":"full-diff-not-per-finding-proof","execution_authority":false,"status":"satisfied","reason":null,"review_sha256":"6daeeb7209485ebe3572e2c17873e18f006f8722171c8e469e9f1c72003c7f1b","unresolved":[]}
INPUT superseded_checks = []
INPUT ticket_radar_receipt = {"schema":"subactor.ticket-radar/v1","base_sha":"cdf29f2c19a0edbab65f76269240502de04c568d","head_sha":"f37adfccc23be994fad4ae2ee20c375a36f1a670","change_digest":"425b5bda8c494b4272df69f17061b6b119d6b8200b69a38730dcea62c0fc4ee6","score":72,"complexity":"L","estimated_minutes":93,"split_recommended":true,"services":[],"authority":"ADVISORY","promotion":"FORBIDDEN"}
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "APPROVE" MODEL "openrouter/z-ai/glm-5.3-flash"
ASSERT VERDICT_AUTHORITY != "ADVISORY"