[ticket-121] Constrain published package contents and verify Goal source observation

VERSION

@@ -1 +1 @@
-2.2.58
+2.2.59

project/TICKETS.md

@@ -111,4 +111,5 @@ This file indexes governance tickets without taking ownership of
 | **ticket-118** | [`README.md`](./ticket-118/README.md) | - | - | - | - | - |
 | **ticket-119** | [`README.md`](./ticket-119/README.md) | - | - | - | - | - |
 | **ticket-120** | [`README.md`](./ticket-120/README.md) | - | - | - | - | - |
+| **ticket-121** | [`README.md`](./ticket-121/README.md) | - | - | - | - | - |
 <!-- AUTO:TICKET_INDEX:END -->

project/ticket-121/README.md

@@ -0,0 +1,14 @@
+# Ticket 121: Constrain published package contents and verify Goal source observation
+
+- **ID**: ticket-121
+- **Owner**: agent:codex
+- **Status**: IN_PROGRESS
+- **Workflow state**: EDIT
+- **Created**: 2026-11-01
+- **maxActiveMinutes**: 45
+
+SESSION_EXECUTION_AUTHORIZATION: execute, test and request protected merge/publication for the existing Goal migration and cyclic release observation. The public Fixos 2.2.58 wheel contains three developer Python files outside fixos/; its implicit namespace discovery also makes source verification unsupported. Constrain package discovery explicitly, retain every Fixos asset, and join 2.2.59 version projections to this material implementation. Consume Goal[publish]>=2.2.8 only after its independent public artifact verification, keeping Python markers and unrelated lock records unchanged. No separate release-only ticket or source/CI bypass.
+
+- [x] AC-01: Exactly the unintended developer entries leave the wheel; all Fixos package assets and 132 Python sources are preserved and match Git.
+- [ ] AC-02: Version/lock projections, supported interpreters, affected regressions and governed local delivery pass.
+- [ ] AC-03: Required checks and independent merge pass; Goal publishes the package and the canonical public source observer reports matched.

project/ticket-121/intent.json

@@ -0,0 +1,100 @@
+{
+  "schema": "new-project.intent/v3",
+  "ticket": "ticket-121",
+  "summary": "Constrain published package contents and verify Goal source observation",
+  "workstream": "integration",
+  "classification": {
+    "kind": "BUG",
+    "priority": "P1",
+    "origin": "requested"
+  },
+  "allowedPaths": [
+    "project/ticket-121/**",
+    "TODO.md",
+    "project/TICKETS.md",
+    "VERSION",
+    "pyproject.toml",
+    "uv.lock"
+  ],
+  "forbiddenPaths": [
+    "project/ticket-*/user-*.md"
+  ],
+  "stacks": [],
+  "dependsOn": [
+    "ticket-120"
+  ],
+  "conflictsWith": [],
+  "integrationTicket": null,
+  "delivery": {
+    "acceptedBaseSha": "1eb76c6fa66949e8ead941db9581e235449ca769",
+    "targetBranch": "main",
+    "outcome": "Restrict distributed library contents to the declared Fixos package, make its public source manifest verifiable, and consume the independently published Goal delegated-failure fix.",
+    "nonGoals": [
+      "No Fixos runtime source, API or dependency changes",
+      "No broad lock upgrade or managed adoption changes",
+      "No inferred source verification or registry overwrite",
+      "No publication before Goal 2.2.8 and independent acceptance"
+    ],
+    "complexity": "M",
+    "estimatedMinutes": 30,
+    "budgets": {
+      "maxImplementationFiles": 3,
+      "maxAffectedComponents": 1,
+      "maxPublicInterfaceChanges": 0,
+      "maxRuntimeDependencies": 0
+    },
+    "architecture": {
+      "status": "accepted",
+      "decision": "The public 2.2.58 wheel accidentally includes two docs/examples Python modules and scripts/pyqual-calibrate.py through implicit namespace discovery. Constrain discovery to fixos and fixos.* while retaining all package assets and existing exclusions. The observer supports this explicit manifest and can compare the complete Python package against Git. Join 2.2.59 projections to this material packaging fix and require Goal[publish]>=2.2.8 after its verified public release; preserve interpreter markers and unrelated lock records.",
+      "components": [
+        {
+          "name": "verified-publication-package",
+          "paths": [
+            "pyproject.toml",
+            "VERSION",
+            "uv.lock"
+          ]
+        }
+      ],
+      "responsibilityChanges": false,
+      "interfaceChanges": [],
+      "dataChanges": [],
+      "ui": {
+        "impact": "none",
+        "states": [],
+        "evidence": []
+      },
+      "rollback": "Independent protected revert; do not overwrite immutable registry releases."
+    },
+    "runtimeDependencies": [],
+    "validation": [
+      {
+        "criterion": "AC-01",
+        "commands": [
+          "Build wheel and compare package assets against 2.2.58",
+          "Only three unintended non-package Python entries are removed",
+          "All 132 Fixos Python files match Git"
+        ],
+        "evidence": "receipt:fixos121/package-contract"
+      },
+      {
+        "criterion": "AC-02",
+        "commands": [
+          "Preserved lock records and Python support",
+          "Affected version/adoption regressions",
+          "Native governance and actual Goal -a delivery"
+        ],
+        "evidence": "receipt:fixos121/local-validation"
+      },
+      {
+        "criterion": "AC-03",
+        "commands": [
+          "Required platform/OneDev and independent exact-head/current-base merge",
+          "Goal publication and public artifact hash/source verification",
+          "Canonical observer reports matched published Python content"
+        ],
+        "evidence": "receipt:fixos121/protected-publication"
+      }
+    ]
+  }
+}

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "fixos"
-version = "2.2.58"
+version = "2.2.59"
 description = "AI-powered Linux/Windows diagnostics and repair – audio, hardware, system issues"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -43,7 +43,7 @@ dev = [
     "pytest-xdist>=3.5.0",
     "pytest-timeout>=2.2.0",
     "pytest-sugar>=0.9.7",
-    "goal[publish]>=2.2.7; python_version >= '3.12'",
+    "goal[publish]>=2.2.8; python_version >= '3.12'",
     "costs>=0.1.20",
 ]
 
@@ -55,6 +55,7 @@ Homepage = "https://github.com/wronai/fixos"
 "Bug Tracker" = "https://github.com/wronai/fixos/issues"
 
 [tool.setuptools.packages.find]
+include = ["fixos", "fixos.*"]
 exclude = ["tests*", "docker*"]
 
 [tool.setuptools.package-data]