Skip to content

[ticket-121] Constrain published package contents and verify Goal source observation - #154

Merged
ifuri-validator-agent[bot] merged 1 commit into
mainfrom
ticket/121-package-source-manifest
Nov 1, 2026
Merged

ifuri-validator-agent[bot] merged 1 commit into
mainfrom
ticket/121-package-source-manifest

Conversation

@tom-sapletta-com

@tom-sapletta-com tom-sapletta-com commented Nov 1, 2026 •

Copy link
Copy Markdown
Contributor

Ticket: ticket-121

Implicit setuptools namespace discovery currently adds docs/examples/advanced_usage.py, docs/examples/quickstart.py and scripts/pyqual-calibrate.py to the public wheel. It also leaves the source manifest unsupported by the release observer.

Constrain discovery to fixos and fixos.* while retaining existing exclusions and every Fixos package asset. Join 2.2.59 VERSION/project/lock projections to this material packaging correction. Require the independently merged, publicly verified Goal[publish]>=2.2.8 delegated-failure fix under the existing Python >=3.12 dev marker. Python >=3.10 runtime support and mandatory requirements are unchanged; all 150 unrelated complete lock records are byte-equivalent in structured comparison.

Validation: isolated build removes exactly the three unintended wheel entries, preserves all 140 Fixos package entries and all 132 Python files byte-for-byte against Git. Three affected version/adoption tests pass under Testless and actual Goal -a 2.2.8 source delivery; native governance passes. Required Python 3.10/3.11/3.12, distro and OneDev coverage remain enforced. Publication through Goal and canonical matched-source observer readback follow independent merge.

@ifuri-validator-agent ifuri-validator-agent Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Validator approval after policy checks for exact head 5533d23e04c2177040cafdcc5b653ecefad59575.

Ticket: ticket-121
Correlation ID: local-semcod-fixos-pr-154-ticket-121
Model: openai/cursor-auto
Reviewed diff chunks: 1
Advisory LLM verdict: APPROVE
Advisory summary: Reviewed all 1 diff chunk(s). The change correctly constrains setuptools package discovery to fixos and its subpackages, synchronizes the 2.2.59 version projections, and updates the Python 3.12+ development dependency and lock data to Goal 2.2.8. No visible code or security defects were identified.
Advisory findings: none
The LLM output above is advisory and was not used as the approval trust root.
Semantic review prerequisite: not_required; policy 676cb4516bbfed2a000e40b9b1b6e4a430ecc761ec546aeb53d721a1905cfdd7.

Actual PR impact radar

Exact range: 1eb76c6fa66949e8ead941db9581e235449ca769...5533d23e04c2177040cafdcc5b653ecefad59575
Change digest: 9ba84059729cb8313a1c1845699cfffaf08917c695a5602008d6980f3fd76e42
Score: 76/100 (L), estimated 100 min, split recommended: true
Affected services/components: repository-wide/unclassified

Machine-readable radar JSONL and SVG
{"actual_change":{"additions":124,"base_sha":"1eb76c6fa66949e8ead941db9581e235449ca769","binary_files":0,"categories":{"code":2,"configuration":2,"docs":2},"change_digest":"9ba84059729cb8313a1c1845699cfffaf08917c695a5602008d6980f3fd76e42","comparison":"1eb76c6fa66949e8ead941db9581e235449ca769...5533d23e04c2177040cafdcc5b653ecefad59575","deletions":8,"file_count":6,"files":["VERSION","project/TICKETS.md","project/ticket-121/README.md","project/ticket-121/intent.json","pyproject.toml","uv.lock"],"head_sha":"5533d23e04c2177040cafdcc5b653ecefad59575","service_count":0,"services":[]},"assessment_mode":"observed-pr","axes":{"coupling":5,"delivery":4,"scope":5,"uncertainty":3,"validation":2},"complexity":"L","confidence":0.9,"diagnostics":["RADAR-ACCEPTANCE-MISSING","RADAR-BUDGET-EXCEEDED"],"estimate":{"budget_minutes":30,"minutes":100,"within_budget":false},"impact":{"components":["3.10","VERSION","docs","project","repository-root","scripts","version"],"files":["3.10/3.11/3.12","VERSION","VERSION/project/lock","docs/examples/advanced_usage.py","docs/examples/quickstart.py","project/TICKETS.md","project/ticket-121/README.md","project/ticket-121/intent.json","pyproject.toml","scripts/pyqual-calibrate.py","uv.lock","version/adoption"],"public_interfaces":[],"runtime_dependencies":1},"schema":"subactor.ticket-radar/v1","score":76,"split":{"parts":[{"estimated_minutes":13,"name":"Implement 3.10","scope":["3.10"]},{"estimated_minutes":13,"name":"Implement VERSION","scope":["VERSION"]},{"estimated_minutes":13,"name":"Implement docs","scope":["docs"]},{"estimated_minutes":13,"name":"Implement project","scope":["project"]},{"estimated_minutes":13,"name":"Implement repository-root","scope":["repository-root"]},{"estimated_minutes":15,"name":"Validate and project to trackers","scope":["tests","planfile","github/gitlab/jira projections"]}],"reason":"estimated_minutes_exceed_budget","recommended":true},"standards":[{"id":"wellmanifest/dsl","revision":"6c60fc4e0dd1f1bb74f46a7745e28019908d1203","version":"0.1.0-dev"},{"id":"wellmanifest/ticket-lifecycle","revision":"5bf581907a87b46a13a73e6c033d3abe4d9a306f","version":"0.1.0-dev"},{"id":"wellmanifest/git-lifecycle","revision":"7d77d4b7af57e69bc75c3a0290b3a4805c5c4438","version":"0.2.0-dev"},{"id":"wellmanifest/logs","revision":"48c284ef7a069055c0bcb6b900147ce5e65f8b43","version":"0.3.0"}],"ticket_ref":"ticket-121"}
<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" viewBox="0 0 128 128" role="img"><title>ticket-121: [ticket-121] Constrain published package contents and verify Goal source observation</title><rect width="128" height="128" rx="12" fill="#f8fafc"/><g stroke-width="1"><polygon points="64,55 72,61 69,71 59,71 56,61" fill="none" stroke="#d7dde5"/><polygon points="64,47 80,59 74,78 54,78 48,59" fill="none" stroke="#d7dde5"/><polygon points="64,38 89,56 79,85 49,85 39,56" fill="none" stroke="#d7dde5"/><polygon points="64,30 97,53 84,92 44,92 31,53" fill="none" stroke="#d7dde5"/><polygon points="64,21 105,51 89,99 39,99 23,51" fill="none" stroke="#d7dde5"/><line x1="64" y1="64" x2="64" y2="21" stroke="#aab4c0"/><line x1="64" y1="64" x2="105" y2="51" stroke="#aab4c0"/><line x1="64" y1="64" x2="89" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="39" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="23" y2="51" stroke="#aab4c0"/></g><polygon points="64,21 105,51 79,85 54,78 31,53" fill="#fb923c" fill-opacity="0.45" stroke="#c2410c" stroke-width="2"/><circle cx="64" cy="64" r="3" fill="#c2410c"/><g font-family="sans-serif" font-size="7" fill="#334155"><text x="64" y="11" text-anchor="middle">SCO</text><text x="114" y="48" text-anchor="middle">COU</text><text x="95" y="107" text-anchor="middle">UNC</text><text x="33" y="107" text-anchor="middle">VAL</text><text x="14" y="48" text-anchor="middle">DEL</text></g><text x="64" y="124" text-anchor="middle" font-family="sans-serif" font-size="8" fill="#0f172a">L · 100m</text></svg>
Merge will be attempted after this approval when explicitly authorized. ## Decision record (recomputable)
DECISION D-121-7015
TICKET ticket-121
HEAD_SHA 5533d23e04c2177040cafdcc5b653ecefad59575
CORRELATION_ID local-semcod-fixos-pr-154-ticket-121
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT author_login = "tom-sapletta-com"
INPUT observed_checks = ["test-summary=PASS","test-alpine=PASS","test (3.10)=PASS","test (3.12)=PASS","governance / remote lifecycle=PASS","test-debian=PASS","test-ubuntu=PASS","test-fedora=PASS","test (3.11)=PASS","governance / enforce=PASS","test-arch=PASS","onedev/local-verify=PASS"]
INPUT required_checks = ["onedev/local-verify","test (3.10)","test (3.11)","test (3.12)","test-summary"]
INPUT required_checks_source = "protected registry (env/request)"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
INPUT semantic_review_assessment = {"schema":"subactor.validator/semantic-review-assessment/v1","subject":{"repository":"semcod/fixos","pull_request":154,"head_sha":"5533d23e04c2177040cafdcc5b653ecefad59575","base_sha":"1eb76c6fa66949e8ead941db9581e235449ca769","diff_sha256":"729a9018e8d49b416a1e2b8eb0f44ba09e334c04a35d6402f64f7cf6fac21445"},"policy":{"policy_schema":"subactor.validator/semantic-review-policy/v1","policy_version":1,"policy_sha256":"676cb4516bbfed2a000e40b9b1b6e4a430ecc761ec546aeb53d721a1905cfdd7","required":false,"critical_paths":[],"observed_paths":["VERSION","project/TICKETS.md","project/ticket-121/README.md","project/ticket-121/intent.json","pyproject.toml","uv.lock"]},"grounding":"full-diff-not-per-finding-proof","execution_authority":false,"status":"not_required","reason":null,"review_sha256":null,"unresolved":[]}
INPUT superseded_checks = []
INPUT ticket_radar_receipt = {"schema":"subactor.ticket-radar/v1","base_sha":"1eb76c6fa66949e8ead941db9581e235449ca769","head_sha":"5533d23e04c2177040cafdcc5b653ecefad59575","change_digest":"9ba84059729cb8313a1c1845699cfffaf08917c695a5602008d6980f3fd76e42","score":76,"complexity":"L","estimated_minutes":100,"split_recommended":true,"services":[],"authority":"ADVISORY","promotion":"FORBIDDEN"}
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "APPROVE" MODEL "openai/cursor-auto"
ASSERT VERDICT_AUTHORITY != "ADVISORY"

@ifuri-validator-agent
ifuri-validator-agent Bot merged commit 6cf7994 into main Nov 1, 2026
12 checks passed
@ifuri-validator-agent
ifuri-validator-agent Bot deleted the ticket/121-package-source-manifest branch November 1, 2026 02:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant