docs(ci): verify shared protected Python runner

[tom-sapletta-com]

Exercise the deployed shared trusted Python runner through the existing protected local gate and both hosted Python checks. Document preserved locked dependencies, isolated imports and mandatory publication requirements.

Executor refactor subactor/onedev-agent#210 was independently merged as 5f4490cf28b519471b5460489f8a65532bd54999 and deployed in image sha256:ec2785213f7095f565ef951443a20eb981907ae222ba89d20133c6c063ab59a8 with unchanged profiles and dependency environments.

Validation: pinned Docs checker and both hosted Python checks passed. The deployed local gate will verify this exact candidate and current merge base before independent publication.

Closes #6.

[ifuri-validator-agent]

Deterministic Validator approval for exact head 0f0672930cbab9d9d42a5e9bce266190a68622f7.

Ticket: ticket-006
Correlation ID: local-semcod-clickmd-pr-7-ticket-006
Model: zai/glm-5.3
Reviewed diff chunks: 1
Advisory LLM verdict: APPROVE
Advisory summary: Reviewed all 1 diff chunk(s). Documentation-only chunk: updates local-verification.md metadata (version bump, new source revision, added evidence links, new section describing the shared protected Python boundary) and adds a ticket-006 README and intent.. No code, workflow, or dependency changes. Changes stay within allowedPaths declared in intent.. All listed checks pass.
Advisory findings: none
The LLM output above is advisory and was not used as the approval trust root.

Actual PR impact radar

Exact range: 97156f9d33ca8e36a617651ede1b464c4622b0a1...0f0672930cbab9d9d42a5e9bce266190a68622f7
Change digest: b413ffa0d76047cb7724a101c553f11f3a2496fa8594fc6ea6ac6c7499aa7d8d
Score: 48/100 (M), estimated 51 min, split recommended: true
Affected services/components: repository-wide/unclassified

Machine-readable radar JSONL and SVG

{"actual_change":{"additions":52,"base_sha":"97156f9d33ca8e36a617651ede1b464c4622b0a1","binary_files":0,"categories":{"configuration":1,"docs":2},"change_digest":"b413ffa0d76047cb7724a101c553f11f3a2496fa8594fc6ea6ac6c7499aa7d8d","comparison":"97156f9d33ca8e36a617651ede1b464c4622b0a1...0f0672930cbab9d9d42a5e9bce266190a68622f7","deletions":3,"file_count":3,"files":["docs/information/local-verification.md","project/ticket-006/README.md","project/ticket-006/intent.json"],"head_sha":"0f0672930cbab9d9d42a5e9bce266190a68622f7","service_count":0,"services":[]},"assessment_mode":"observed-pr","axes":{"coupling":3,"delivery":3,"scope":2,"uncertainty":3,"validation":1},"complexity":"M","confidence":0.9,"diagnostics":["RADAR-ACCEPTANCE-MISSING","RADAR-BUDGET-EXCEEDED"],"estimate":{"budget_minutes":30,"minutes":51,"within_budget":false},"impact":{"components":["docs","project","subactor"],"files":["docs/information/local-verification.md","project/ticket-006/README.md","project/ticket-006/intent.json","subactor/onedev-agent"],"public_interfaces":[],"runtime_dependencies":1},"schema":"subactor.ticket-radar/v1","score":48,"split":{"parts":[{"estimated_minutes":14,"name":"Implement docs","scope":["docs"]},{"estimated_minutes":14,"name":"Implement project","scope":["project"]},{"estimated_minutes":14,"name":"Implement subactor","scope":["subactor"]},{"estimated_minutes":15,"name":"Validate and project to trackers","scope":["tests","planfile","github/gitlab/jira projections"]}],"reason":"estimated_minutes_exceed_budget","recommended":true},"standards":[{"id":"wellmanifest/dsl","revision":"6c60fc4e0dd1f1bb74f46a7745e28019908d1203","version":"0.1.0-dev"},{"id":"wellmanifest/ticket-lifecycle","revision":"5bf581907a87b46a13a73e6c033d3abe4d9a306f","version":"0.1.0-dev"},{"id":"wellmanifest/git-lifecycle","revision":"7d77d4b7af57e69bc75c3a0290b3a4805c5c4438","version":"0.2.0-dev"},{"id":"wellmanifest/logs","revision":"48c284ef7a069055c0bcb6b900147ce5e65f8b43","version":"0.3.0"}],"ticket_ref":"ticket-006"}

<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" viewBox="0 0 128 128" role="img"><title>ticket-006: docs(ci): verify shared protected Python runner</title><rect width="128" height="128" rx="12" fill="#f8fafc"/><g stroke-width="1"><polygon points="64,55 72,61 69,71 59,71 56,61" fill="none" stroke="#d7dde5"/><polygon points="64,47 80,59 74,78 54,78 48,59" fill="none" stroke="#d7dde5"/><polygon points="64,38 89,56 79,85 49,85 39,56" fill="none" stroke="#d7dde5"/><polygon points="64,30 97,53 84,92 44,92 31,53" fill="none" stroke="#d7dde5"/><polygon points="64,21 105,51 89,99 39,99 23,51" fill="none" stroke="#d7dde5"/><line x1="64" y1="64" x2="64" y2="21" stroke="#aab4c0"/><line x1="64" y1="64" x2="105" y2="51" stroke="#aab4c0"/><line x1="64" y1="64" x2="89" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="39" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="23" y2="51" stroke="#aab4c0"/></g><polygon points="64,47 89,56 79,85 59,71 39,56" fill="#fb923c" fill-opacity="0.45" stroke="#c2410c" stroke-width="2"/><circle cx="64" cy="64" r="3" fill="#c2410c"/><g font-family="sans-serif" font-size="7" fill="#334155"><text x="64" y="11" text-anchor="middle">SCO</text><text x="114" y="48" text-anchor="middle">COU</text><text x="95" y="107" text-anchor="middle">UNC</text><text x="33" y="107" text-anchor="middle">VAL</text><text x="14" y="48" text-anchor="middle">DEL</text></g><text x="64" y="124" text-anchor="middle" font-family="sans-serif" font-size="8" fill="#0f172a">M · 51m</text></svg>

Merge will be attempted after this approval when explicitly authorized. ## Decision record (recomputable)

DECISION D-006-3225
TICKET ticket-006
HEAD_SHA 0f0672930cbab9d9d42a5e9bce266190a68622f7
CORRELATION_ID local-semcod-clickmd-pr-7-ticket-006
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT author_login = "tom-sapletta-com"
INPUT observed_checks = ["test (3.10)=PASS","test (3.13)=PASS","onedev/local-verify=PASS"]
INPUT required_checks = ["test (3.10)","test (3.13)","onedev/local-verify"]
INPUT required_checks_source = "protected registry (env/request)"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
INPUT superseded_checks = []
INPUT ticket_radar_receipt = {"schema":"subactor.ticket-radar/v1","base_sha":"97156f9d33ca8e36a617651ede1b464c4622b0a1","head_sha":"0f0672930cbab9d9d42a5e9bce266190a68622f7","change_digest":"b413ffa0d76047cb7724a101c553f11f3a2496fa8594fc6ea6ac6c7499aa7d8d","score":48,"complexity":"M","estimated_minutes":51,"split_recommended":true,"services":[],"authority":"ADVISORY","promotion":"FORBIDDEN"}
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "APPROVE" MODEL "zai/glm-5.3"
ASSERT VERDICT_AUTHORITY != "ADVISORY"