[dependabot]

Preserves the internal package upgrades and repairs their CI validation. The immutable public documentation checkout uses the existing read-only GitHub token, and Goal is locked to stable2.2.1.

Validation:160tests pass on Python3.10 and3.13 with the native dev+performance extras. Immutable documentation checker passes with one existing review-date warning. Scope:uv.lock and test-locked workflow. Native ticket PLF-500; independent protected review and merge required.

[ifuri-validator-agent]

Validator approval after policy checks for exact head 81f96ead93cab380766ca191867aa21cb2d79814.

Ticket: ticket-500
Correlation ID: local-semcod-prefact-pr-208-ticket-500
Model: openai/cursor-auto
Reviewed diff chunks: 7
Advisory LLM verdict: APPROVE
Advisory summary: Reviewed all 7 diff chunk(s). The visible chunk replaces a broader organization PAT with the repository-scoped GitHub token for a stated public documentation checkout, reducing secret exposure. The lockfile changes appear consistent with dependency upgrades and pruning. Both protected required checks passed. | The visible lockfile changes consistently upgrade goal from 2.2.0 to 2.2.1, update its artifacts and hashes, normalize dependency markers, and remove packages no longer present in the resolved graph. No code or security defect is evident in this chunk. All protected required checks passed. | The visible lockfile chunk consistently removes Python 3.12+-only dependency entries and simplifies environment markers. No independently evidenced correctness or security defect is present in this chunk. Both protected required checks passed. | The visible lockfile chunk removes packages that appear to be obsolete transitive dependencies and adds an automation group Python requirement for planfile. No unresolved correctness or security defect is evident in this chunk. Both protected required checks passed. | The visible chunk only removes pyzmq 27.1.0 wheel artifact entries from uv.lock. No semantic, security, or integrity concern is evident in this chunk, and all protected required checks passed. | The visible chunk removes obsolete transitive package and wheel entries from uv.lock. No independently evidenced code, dependency-integrity, or security defect is visible, and all protected required checks passed. | The visible chunk removes the locked yarg 0.1.9 source and wheel artifacts. No unresolved code or security defect is evident in this chunk, and all protected required checks passed.
Advisory findings: none
The LLM output above is advisory and was not used as the approval trust root.
Semantic review prerequisite: satisfied; policy 676cb4516bbfed2a000e40b9b1b6e4a430ecc761ec546aeb53d721a1905cfdd7.

Actual PR impact radar

Exact range: 2fc713f3187f6fec60f879f1023ba226ed28e7e6...81f96ead93cab380766ca191867aa21cb2d79814
Change digest: a4c792c88ed862f116a0688a1eff481de23069162c63372ae19fa5b79aa45703
Score: 48/100 (M), estimated 51 min, split recommended: true
Affected services/components: repository-wide/unclassified

Machine-readable radar JSONL and SVG

{"actual_change":{"additions":29,"base_sha":"2fc713f3187f6fec60f879f1023ba226ed28e7e6","binary_files":0,"categories":{"code":1,"tests":1},"change_digest":"a4c792c88ed862f116a0688a1eff481de23069162c63372ae19fa5b79aa45703","comparison":"2fc713f3187f6fec60f879f1023ba226ed28e7e6...81f96ead93cab380766ca191867aa21cb2d79814","deletions":541,"file_count":2,"files":["github/workflows/test-locked.yml","uv.lock"],"head_sha":"81f96ead93cab380766ca191867aa21cb2d79814","service_count":0,"services":[]},"assessment_mode":"observed-pr","axes":{"coupling":3,"delivery":3,"scope":2,"uncertainty":3,"validation":1},"complexity":"M","confidence":0.9,"diagnostics":["RADAR-ACCEPTANCE-MISSING","RADAR-BUDGET-EXCEEDED"],"estimate":{"budget_minutes":30,"minutes":51,"within_budget":false},"impact":{"components":["github","repository-root"],"files":["github/workflows/test-locked.yml","uv.lock"],"public_interfaces":[],"runtime_dependencies":1},"schema":"subactor.ticket-radar/v1","score":48,"split":{"parts":[{"estimated_minutes":21,"name":"Implement github","scope":["github"]},{"estimated_minutes":21,"name":"Implement repository-root","scope":["repository-root"]},{"estimated_minutes":15,"name":"Validate and project to trackers","scope":["tests","planfile","github/gitlab/jira projections"]}],"reason":"estimated_minutes_exceed_budget","recommended":true},"standards":[{"id":"wellmanifest/dsl","revision":"6c60fc4e0dd1f1bb74f46a7745e28019908d1203","version":"0.1.0-dev"},{"id":"wellmanifest/ticket-lifecycle","revision":"5bf581907a87b46a13a73e6c033d3abe4d9a306f","version":"0.1.0-dev"},{"id":"wellmanifest/git-lifecycle","revision":"7d77d4b7af57e69bc75c3a0290b3a4805c5c4438","version":"0.2.0-dev"},{"id":"wellmanifest/logs","revision":"48c284ef7a069055c0bcb6b900147ce5e65f8b43","version":"0.3.0"}],"ticket_ref":"ticket-500"}

<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" viewBox="0 0 128 128" role="img"><title>ticket-500: fix(ci): validate internal package upgrades with locked tests</title><rect width="128" height="128" rx="12" fill="#f8fafc"/><g stroke-width="1"><polygon points="64,55 72,61 69,71 59,71 56,61" fill="none" stroke="#d7dde5"/><polygon points="64,47 80,59 74,78 54,78 48,59" fill="none" stroke="#d7dde5"/><polygon points="64,38 89,56 79,85 49,85 39,56" fill="none" stroke="#d7dde5"/><polygon points="64,30 97,53 84,92 44,92 31,53" fill="none" stroke="#d7dde5"/><polygon points="64,21 105,51 89,99 39,99 23,51" fill="none" stroke="#d7dde5"/><line x1="64" y1="64" x2="64" y2="21" stroke="#aab4c0"/><line x1="64" y1="64" x2="105" y2="51" stroke="#aab4c0"/><line x1="64" y1="64" x2="89" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="39" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="23" y2="51" stroke="#aab4c0"/></g><polygon points="64,47 89,56 79,85 59,71 39,56" fill="#fb923c" fill-opacity="0.45" stroke="#c2410c" stroke-width="2"/><circle cx="64" cy="64" r="3" fill="#c2410c"/><g font-family="sans-serif" font-size="7" fill="#334155"><text x="64" y="11" text-anchor="middle">SCO</text><text x="114" y="48" text-anchor="middle">COU</text><text x="95" y="107" text-anchor="middle">UNC</text><text x="33" y="107" text-anchor="middle">VAL</text><text x="14" y="48" text-anchor="middle">DEL</text></g><text x="64" y="124" text-anchor="middle" font-family="sans-serif" font-size="8" fill="#0f172a">M · 51m</text></svg>

Merge will be attempted after this approval when explicitly authorized. ## Decision record (recomputable)

DECISION D-500-0147
TICKET ticket-500
HEAD_SHA 81f96ead93cab380766ca191867aa21cb2d79814
CORRELATION_ID local-semcod-prefact-pr-208-ticket-500
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT author_login = "dependabot[bot]"
INPUT observed_checks = ["test (3.13)=PASS","freshness=PASS","test (3.10)=PASS"]
INPUT required_checks = ["test (3.10)","test (3.13)"]
INPUT required_checks_source = "protected registry (env/request)"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
INPUT semantic_review_assessment = {"schema":"subactor.validator/semantic-review-assessment/v1","subject":{"repository":"semcod/prefact","pull_request":208,"head_sha":"81f96ead93cab380766ca191867aa21cb2d79814","base_sha":"2fc713f3187f6fec60f879f1023ba226ed28e7e6","diff_sha256":"f298c24acb3b2338502cc760a04571c9543a45d2182acfcc7f3829d6a5d3e205"},"policy":{"policy_schema":"subactor.validator/semantic-review-policy/v1","policy_version":1,"policy_sha256":"676cb4516bbfed2a000e40b9b1b6e4a430ecc761ec546aeb53d721a1905cfdd7","required":true,"critical_paths":[".github/workflows/test-locked.yml"],"observed_paths":[".github/workflows/test-locked.yml","uv.lock"]},"grounding":"full-diff-not-per-finding-proof","execution_authority":false,"status":"satisfied","reason":null,"review_sha256":"574bc04477466139b4f499b88354d88c8f2fd4a6efbdfb999028d0c9916bf9dd","unresolved":[]}
INPUT superseded_checks = []
INPUT ticket_radar_receipt = {"schema":"subactor.ticket-radar/v1","base_sha":"2fc713f3187f6fec60f879f1023ba226ed28e7e6","head_sha":"81f96ead93cab380766ca191867aa21cb2d79814","change_digest":"a4c792c88ed862f116a0688a1eff481de23069162c63372ae19fa5b79aa45703","score":48,"complexity":"M","estimated_minutes":51,"split_recommended":true,"services":[],"authority":"ADVISORY","promotion":"FORBIDDEN"}
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "APPROVE" MODEL "openai/cursor-auto"
ASSERT VERDICT_AUTHORITY != "ADVISORY"