diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f70baa4..c8f983b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -28,9 +28,9 @@ jobs: permissions: contents: read pull-requests: read - uses: wellmanifest/new-project/.github/workflows/governance.yml@d31beca68b9964c6af493a44974b247626294b65 + uses: wellmanifest/new-project/.github/workflows/governance.yml@d1f35ed1b8be60f50a6739984c947a30379ead5b with: - standard-ref: d31beca68b9964c6af493a44974b247626294b65 + standard-ref: d1f35ed1b8be60f50a6739984c947a30379ead5b trusted-reviewers: ${{ vars.TRUSTED_REVIEWERS }} trusted-validator-apps: ${{ vars.TRUSTED_VALIDATOR_APPS }} diff --git a/.governance/governance_check.py b/.governance/governance_check.py index a91946c..416f45c 100755 --- a/.governance/governance_check.py +++ b/.governance/governance_check.py @@ -4030,11 +4030,33 @@ def resolve_changed_paths( return [] +def published_adoption_validation_base(root: Path, delivery: dict[str, Any], head: str) -> str | None: + """Bound implicit adoption validation without changing ticket authority. + + A historical IN_PROGRESS adoption may remain in a fresh published checkout + without its external terminal receipt. Validate the latest integration's + diff there, not every delivery since that adoption. Require origin evidence; + a local target branch alone does not establish published state. + """ + try: + target_ref = f"refs/remotes/origin/{delivery['targetBranch']}" + target = git_output(root, ["rev-parse", "--verify", f"{target_ref}^{{commit}}"]).decode().strip() + if git_output(root, ["rev-parse", "--verify", f"{head}^{{commit}}"]).decode().strip() != target: + return None + parent = git_output(root, ["rev-parse", "--verify", f"{target}^1"]).decode().strip() + if is_published_integration(root, target, parent): + return parent + except (subprocess.CalledProcessError, FileNotFoundError): + pass + return None + + def resolve_validation_base( supplied_base: str | None, root: Path, records: list[TicketRecord], config: dict[str, Any], + head: str = "HEAD", ) -> str | None: if supplied_base is not None: return supplied_base @@ -4044,7 +4066,8 @@ def resolve_validation_base( return None record = adoption_records[0] assert record.intent is not None - return record.intent["delivery"]["acceptedBaseSha"] + delivery = record.intent["delivery"] + return published_adoption_validation_base(root, delivery, head) or delivery["acceptedBaseSha"] def check_change_lease(root: Path, report: Report) -> None: @@ -4099,7 +4122,7 @@ def run_governance_checks( records = load_ticket_records(directories, manifest["ticket"]) else: directories = [record.directory for record in records] - base = resolve_validation_base(args.base, root, records, manifest["ticket"]) + base = resolve_validation_base(args.base, root, records, manifest["ticket"], args.head) changed = resolve_changed_paths(args, root, base, report) active = active_ticket_records(root, manifest["ticket"], records, report) changed_active = [ diff --git a/.governance/manifest.base.json b/.governance/manifest.base.json index 932de63..e27bbc4 100644 --- a/.governance/manifest.base.json +++ b/.governance/manifest.base.json @@ -110,7 +110,7 @@ "stacks": [], "standard": { "id": "wellmanifest/new-project", - "version": "0.20.20" + "version": "0.20.21" }, "ticket": { "activeStatuses": [ diff --git a/.governance/manifest.json b/.governance/manifest.json index a52c185..c88bff5 100644 --- a/.governance/manifest.json +++ b/.governance/manifest.json @@ -274,7 +274,7 @@ ], "standard": { "id": "wellmanifest/new-project", - "version": "0.20.20" + "version": "0.20.21" }, "ticket": { "activeStatuses": [ diff --git a/.governance/manifest.lock.json b/.governance/manifest.lock.json index eb9ec05..04053d4 100644 --- a/.governance/manifest.lock.json +++ b/.governance/manifest.lock.json @@ -39,10 +39,10 @@ ".governance/error/GOV-WORKTREE-OVERLAP.md": "65a2533f13e63d6ebeeb63c07adc0794ea9e04075a91e873eff2d79910239b0e", ".governance/error/README.md": "e8486dd29f52ca3fee96ed6881a62c38141864cde5aa1adea2b16d22b2feefaa", ".governance/generate_required_checks.py": "a017f06203e3c186dd97bc3c3a183e0352f5f11b2f49701e61cac98e86c00cba", - ".governance/governance_check.py": "8a12285fbb806678784725fe52d6f4bc52f4d5899ddb1af8078063e098d86acc", + ".governance/governance_check.py": "5336377d54ab8239cf1b1c7ee576523cc6e134d3f817be940c4248d88bbff01d", ".governance/intent.schema.json": "7baa32440e3ae5bf1ada32359154b35038134ba2dee4dbf25d9435a12f62ab0c", ".governance/lock.schema.json": "ad80c98f800a4a3310870336dcdaf0aa689cc4988f71084d25d76bea2df1242f", - ".governance/manifest.base.json": "616a4acd56d70e6dbac70f8eed6e8efd469560efbc7af043fce58d9d7bb5341b", + ".governance/manifest.base.json": "986b581a686cd526eca602fcc0ec25042e0c21f907f24e60cce415490481461b", ".governance/manifest.schema.json": "5aa2ccd3f6898834d4e39a78342448145490be56aa132e16ac7c9d64acef8f73", ".governance/package-manifest.json": "a06a0b84d9b4f9f9c30b5523e40db50f33de3490b1006c29cd03cd1e2b58b1b2", ".governance/precommit_standard_update.py": "c91e2bf9ae9d6ccc77bce0e61450c818a5961edee5bfde3b60426da88e296b0f", @@ -94,7 +94,7 @@ "id": "wellmanifest/new-project", "publicationStatus": "published", "sourceRepository": "wellmanifest/new-project", - "sourceRevision": "d31beca68b9964c6af493a44974b247626294b65", - "version": "0.20.20" + "sourceRevision": "d1f35ed1b8be60f50a6739984c947a30379ead5b", + "version": "0.20.21" } } diff --git a/package.json b/package.json index 4d00b1c..3173132 100644 --- a/package.json +++ b/package.json @@ -51,8 +51,8 @@ "email": "tom@sapletta.com" }, "wellmanifest": { - "standard": "0.20.20", - "revision": "d31beca68b9964c6af493a44974b247626294b65", + "standard": "0.20.21", + "revision": "d1f35ed1b8be60f50a6739984c947a30379ead5b", "gate": "project/governance-check.sh" } } diff --git a/project/ticket-102/README.md b/project/ticket-102/README.md new file mode 100644 index 0000000..683680b --- /dev/null +++ b/project/ticket-102/README.md @@ -0,0 +1,36 @@ +# Ticket 102: Adopt published integration validation base fix + +- **ID**: ticket-102 +- **Owner**: agent:openai +- **Status**: IN_PROGRESS +- **Workflow state**: PUBLICATION +- **Created**: 2026-09-10 + +## Goal and scope + +Adopt the independently merged fix from wellmanifest/new-project ticket-210 +using its immutable published revision. Preserve target ownership, packaging +bindings, Docker requirements, protected tests and independent review. + +SESSION_EXECUTION_AUTHORIZATION: user continuation on 2026-09-10 authorizes +this bounded adoption, tests and protected publication, not self-approval. +The upstream fix was independently merged as PR 319, source revision +`d1f35ed1b8be60f50a6739984c947a30379ead5b`, and is bound in intent.json. + +## Acceptance criteria + +- AC-01: Adopt the exact published source through the managed generator; no + hand-edited managed checksums, unrelated code or generated reports. +- AC-02: Governance, verification and Docker smoke tests pass; independently + merge the exact PR head and observe the post-merge main CI result. + +## Risk + +The original default-branch gate falsely combined historical merged tickets. +Preserve all required checks and observe a fresh main run after merge. +Primary-checkout dirty work remains outside this publication. + +## Tracking boundary + +This directory contains the minimal reviewed intent. Optional participant prose +and raw command logs are not required delivery output. diff --git a/project/ticket-102/intent.json b/project/ticket-102/intent.json new file mode 100644 index 0000000..b0ce04d --- /dev/null +++ b/project/ticket-102/intent.json @@ -0,0 +1,107 @@ +{ + "schema": "new-project.intent/v3", + "ticket": "ticket-102", + "summary": "Adopt the published integration validation base fix without relaxing delivery checks", + "workstream": "governance", + "classification": { + "kind": "BUG", + "priority": "P1", + "origin": "health" + }, + "allowedPaths": [ + "project/ticket-102/**", + ".governance/**", + ".github/workflows/ci.yml", + "package.json", + "pyproject.toml" + ], + "forbiddenPaths": [ + "project/ticket-*/user-*.md" + ], + "stacks": [ + "node", + "docker" + ], + "dependsOn": [], + "conflictsWith": [], + "integrationTicket": null, + "delivery": { + "acceptedBaseSha": "cdf29f2c19a0edbab65f76269240502de04c568d", + "targetBranch": "main", + "outcome": "The default-branch governance gate validates published integration history without falsely combining merged tickets, while package bindings and all existing protected tests remain enforced.", + "nonGoals": [ + "No extractor or runtime feature changes.", + "No edits to historical ticket prose or generated reports.", + "No required-check, Docker, independent approval or merge bypass." + ], + "complexity": "M", + "estimatedMinutes": 25, + "budgets": { + "maxImplementationFiles": 9, + "maxAffectedComponents": 3, + "maxPublicInterfaceChanges": 0, + "maxRuntimeDependencies": 0 + }, + "architecture": { + "status": "accepted", + "decision": "Adopt the complete immutable standard revision merged by the independent Validator in wellmanifest/new-project PR 319. Preserve the target-owned manifest customization and change only exact packaging/workflow revision bindings.", + "components": [ + { + "name": "managed-governance", + "paths": [ + ".governance/**", + ".github/workflows/ci.yml" + ] + }, + { + "name": "package-bindings", + "paths": [ + "package.json", + "pyproject.toml" + ] + } + ], + "responsibilityChanges": false, + "interfaceChanges": [], + "dataChanges": [], + "ui": { + "impact": "none", + "states": [], + "evidence": [] + }, + "rollback": "Adopt the prior immutable d31beca68b9964c6af493a44974b247626294b65 revision through a separately validated material change." + }, + "runtimeDependencies": [], + "validation": [ + { + "criterion": "AC-01", + "commands": [ + "./project/governance-check.sh --base cdf29f2c19a0edbab65f76269240502de04c568d", + "goal governance adopt --check --source-revision d1f35ed1b8be60f50a6739984c947a30379ead5b" + ], + "evidence": "Immutable generator and exact-base governance receipt; preserve target-owned workflow and package bindings." + }, + { + "criterion": "AC-02", + "commands": [ + "make verify", + "make smoke", + "make docker-smoke" + ], + "evidence": "Local verification and protected exact-head review/merge followed by observation of the fresh main CI run." + } + ], + "standardAdoption": { + "sourceRepository": "wellmanifest/new-project", + "fromRevision": "d31beca68b9964c6af493a44974b247626294b65", + "toRevision": "d1f35ed1b8be60f50a6739984c947a30379ead5b", + "targetOwnedTransitions": [ + { + "path": ".github/workflows/ci.yml", + "baseDigest": "6718641b3dc1385830d4ca782de7e578868991a4fa71515a89b7aad48fce03e4", + "headDigest": "d48855bdf01fe75700f207a9912c25549014e1e1b7891ef89884ba85eea37aca" + } + ] + } + } +} diff --git a/pyproject.toml b/pyproject.toml index 3b371d2..8dc0efd 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -18,8 +18,8 @@ packages = ["todo2code"] py-modules = ["todo2code_sdk"] [tool.wellmanifest] -standard = "0.20.20" -revision = "d31beca68b9964c6af493a44974b247626294b65" +standard = "0.20.21" +revision = "d1f35ed1b8be60f50a6739984c947a30379ead5b" gate = "project/governance-check.sh" [tool.pytest.ini_options]