From 21b8a5411b550e44970175f59499695a2dd044c6 Mon Sep 17 00:00:00 2001 From: Tom Softreck Date: Fri, 28 Aug 2026 11:07:15 +0200 Subject: [PATCH 1/3] chore(governance): plan reproducible estimation CI --- project/TICKETS.md | 1 + project/ticket-009/README.md | 27 +++++++++++ project/ticket-009/ai-codex-logs.txt | 0 project/ticket-009/ai-codex.md | 35 ++++++++++++++ project/ticket-009/changelog.md | 6 +++ project/ticket-009/intent.json | 71 ++++++++++++++++++++++++++++ project/ticket-009/preprompt.md | 15 ++++++ 7 files changed, 155 insertions(+) create mode 100644 project/ticket-009/README.md create mode 100644 project/ticket-009/ai-codex-logs.txt create mode 100644 project/ticket-009/ai-codex.md create mode 100644 project/ticket-009/changelog.md create mode 100644 project/ticket-009/intent.json create mode 100644 project/ticket-009/preprompt.md diff --git a/project/TICKETS.md b/project/TICKETS.md index cdfadd3..af12e23 100644 --- a/project/TICKETS.md +++ b/project/TICKETS.md @@ -13,4 +13,5 @@ analysis artifacts. | **ticket-005** | [`README.md`](./ticket-005/README.md) | [`preprompt.md`](./ticket-005/preprompt.md) | - | [`ai-codex.md`](./ticket-005/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-005/ai-codex-logs.txt) | [`changelog.md`](./ticket-005/changelog.md) | | **ticket-006** | [`README.md`](./ticket-006/README.md) | [`preprompt.md`](./ticket-006/preprompt.md) | - | [`ai-codex.md`](./ticket-006/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-006/ai-codex-logs.txt) | [`changelog.md`](./ticket-006/changelog.md) | | **ticket-007** | [`README.md`](./ticket-007/README.md) | [`preprompt.md`](./ticket-007/preprompt.md) | - | [`ai-codex.md`](./ticket-007/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-007/ai-codex-logs.txt) | [`changelog.md`](./ticket-007/changelog.md) | +| **ticket-009** | [`README.md`](./ticket-009/README.md) | [`preprompt.md`](./ticket-009/preprompt.md) | - | [`ai-codex.md`](./ticket-009/ai-codex.md) | [`ai-codex-logs.txt`](./ticket-009/ai-codex-logs.txt) | [`changelog.md`](./ticket-009/changelog.md) | diff --git a/project/ticket-009/README.md b/project/ticket-009/README.md new file mode 100644 index 0000000..4372896 --- /dev/null +++ b/project/ticket-009/README.md @@ -0,0 +1,27 @@ +# Ticket 009: Make governed estimation CI reproducible + +- **ID**: ticket-009 +- **Owner**: unresolved:human +- **Status**: IN_PROGRESS +- **Workflow state**: EDIT +- **Created**: 2026-08-25 + +## Goal and scope + +Make governed CI reproduce the repository contract on Linux and Windows: +activate the managed Git hook before invoking pytest/governance and normalize +the Windows worktree to LF before validating hash-bound standard files. + +## Acceptance criteria + +- [x] AC-01: Scope is approved by the user's request to test and repair + autonomy and publish all changes. +- [ ] AC-02: Linux functional CI activates the managed hook. +- [ ] AC-03: Windows governance preserves LF and activates the managed hook. +- [ ] AC-04: Local pytest and governance pass. + +## Participants + +- Human participant: user:tom; authorization is recorded by the originating + request and no synthesized user file was created. +- Agent participant: [ai-codex.md](ai-codex.md) diff --git a/project/ticket-009/ai-codex-logs.txt b/project/ticket-009/ai-codex-logs.txt new file mode 100644 index 0000000..e69de29 diff --git a/project/ticket-009/ai-codex.md b/project/ticket-009/ai-codex.md new file mode 100644 index 0000000..f63edcb --- /dev/null +++ b/project/ticket-009/ai-codex.md @@ -0,0 +1,35 @@ +--- +participant-id: agent:codex +participant: codex +role: agent +ticket: ticket-009 +--- +# Participant: codex (AI agent) + +## Understanding + +CI failed before testing the estimation change: fresh runners did not set +core.hooksPath, Windows converted managed files to CRLF, and the repository +setting did not delete merged head branches as required. + +## Execution plan + +1. Preserve LF before the Windows checkout materializes managed files. +2. Configure the managed hook before functional and Windows governance jobs. +3. Enable automatic head-branch deletion in repository settings. +4. Validate locally and publish the CI repair before rebasing ticket-008. + +## Actual changes + +- Initialized the bounded ticket and recorded SESSION_EXECUTION_AUTHORIZATION + from the request to execute this work. +- Selected immutable action revisions and a pre-checkout LF configuration so + the repair needs no destructive reset in the ephemeral runner. + +## Blockers + +- None inside the recorded intent; proceed without a second confirmation. +- New authority remains required for destructive action, secret access, new + external coordination or material objective expansion. Protected delivery + may be invoked without another prompt when publication is in scope; its + exact-head trusted approval remains independent evidence. diff --git a/project/ticket-009/changelog.md b/project/ticket-009/changelog.md new file mode 100644 index 0000000..8c684ff --- /dev/null +++ b/project/ticket-009/changelog.md @@ -0,0 +1,6 @@ +# Ticket Changelog (ticket-009) + +## [0.1.0] - 2026-08-25 + +- Initial governance scaffold created. +- No human participant identity or content was generated. diff --git a/project/ticket-009/intent.json b/project/ticket-009/intent.json new file mode 100644 index 0000000..adebdf9 --- /dev/null +++ b/project/ticket-009/intent.json @@ -0,0 +1,71 @@ +{ + "schema": "new-project.intent/v3", + "ticket": "ticket-009", + "summary": "Make governed estimation CI reproducible", + "workstream": "infrastructure", + "classification": { + "kind": "BUG", + "priority": "P1", + "origin": "regression" + }, + "allowedPaths": ["project/ticket-009/**", "TODO.md", "project/TICKETS.md", ".github/workflows/ci.yml"], + "delivery": { + "acceptedBaseSha": "8dd7bc814b0fa987e968524745913771910560c7", + "targetBranch": "main", + "outcome": "Linux and Windows CI satisfy the same managed-hook and content-digest preconditions as local governance.", + "nonGoals": [ + "Change governance policy or weaken any gate.", + "Change estimation runtime behavior." + ], + "complexity": "XS", + "estimatedMinutes": 10, + "budgets": { + "maxImplementationFiles": 1, + "maxAffectedComponents": 1, + "maxPublicInterfaceChanges": 0, + "maxRuntimeDependencies": 0 + }, + "architecture": { + "status": "accepted", + "decision": "Configure Windows LF handling before checkout, pin external actions immutably and activate repository-managed hooks explicitly in each CI runner.", + "components": [ + { + "name": "continuous-integration", + "paths": [".github/workflows/ci.yml"] + } + ], + "responsibilityChanges": false, + "interfaceChanges": [], + "dataChanges": [], + "ui": { + "impact": "none", + "states": [], + "evidence": [] + }, + "rollback": "Remove the CI setup steps; no runtime or persisted data changes are involved." + }, + "runtimeDependencies": [], + "validation": [ + { + "criterion": "AC-02", + "commands": ["python -m pytest -q"], + "evidence": "Linux CI executes pytest after configuring core.hooksPath." + }, + { + "criterion": "AC-03", + "commands": ["project\\governance-check.bat"], + "evidence": "Windows checkout uses LF and governance sees the managed hook." + }, + { + "criterion": "AC-04", + "commands": ["PYTHONPATH=src python -m pytest", "PYTHONPATH=src ./project/governance-check.sh"], + "evidence": "Local functional and governance suites pass." + } + ] + }, + "forbiddenPaths": ["project/ticket-*/user-*.md"], + "stacks": [], + "dependsOn": [], + "conflictsWith": [], + "integrationTicket": null +} diff --git a/project/ticket-009/preprompt.md b/project/ticket-009/preprompt.md new file mode 100644 index 0000000..5c26ff6 --- /dev/null +++ b/project/ticket-009/preprompt.md @@ -0,0 +1,15 @@ +# Ticket preprompt + +- **Task ID**: ticket-009 +- **Task title**: Make governed estimation CI reproducible +- **Created**: 2026-08-25T17:22:05Z + +Keep executable implementation outside this governance/evidence directory. +Read a human-owned user-*.md file only when one exists. +The request to execute this work creates SESSION_EXECUTION_AUTHORIZATION; +proceed within the recorded intent without a redundant confirmation prompt. +Require new authority for destructive action, secrets, external coordination, +or material objective expansion. When publication is in scope, session +authorization permits the declared protected delivery process and its merge +after exact-head trusted approval without another prompt. Session prose is +never approval evidence and the agent must not merge directly. From da1b91c7f259c8cfb415e90e106391f9fe30e24c Mon Sep 17 00:00:00 2001 From: Tom Softreck Date: Fri, 28 Aug 2026 11:07:21 +0200 Subject: [PATCH 2/3] ci: make governed estimation checks reproducible --- .github/workflows/ci.yml | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fc3e14b..be821d5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,8 +13,10 @@ jobs: name: test runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - name: Activate managed Git hooks + run: git config core.hooksPath .githooks + - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0 with: python-version: "3.12" cache: pip @@ -27,7 +29,13 @@ jobs: name: windows-governance runs-on: windows-latest steps: - - uses: actions/checkout@v4 + - name: Preserve managed LF line endings + shell: pwsh + run: git config --global core.autocrlf false + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - name: Activate managed Git hooks + shell: cmd + run: git config core.hooksPath .githooks - name: Run governance gate shell: cmd run: project\governance-check.bat From e5c0eb612908780c9dd2b4a102e885d945a797c3 Mon Sep 17 00:00:00 2001 From: Tom Softreck Date: Fri, 28 Aug 2026 11:07:47 +0200 Subject: [PATCH 3/3] chore(governance): record estimation CI validation --- project/ticket-009/README.md | 8 ++++---- project/ticket-009/ai-codex-logs.txt | 9 +++++++++ project/ticket-009/ai-codex.md | 3 +++ project/ticket-009/changelog.md | 3 +++ 4 files changed, 19 insertions(+), 4 deletions(-) diff --git a/project/ticket-009/README.md b/project/ticket-009/README.md index 4372896..0b3afbf 100644 --- a/project/ticket-009/README.md +++ b/project/ticket-009/README.md @@ -3,7 +3,7 @@ - **ID**: ticket-009 - **Owner**: unresolved:human - **Status**: IN_PROGRESS -- **Workflow state**: EDIT +- **Workflow state**: PUBLICATION - **Created**: 2026-08-25 ## Goal and scope @@ -16,9 +16,9 @@ the Windows worktree to LF before validating hash-bound standard files. - [x] AC-01: Scope is approved by the user's request to test and repair autonomy and publish all changes. -- [ ] AC-02: Linux functional CI activates the managed hook. -- [ ] AC-03: Windows governance preserves LF and activates the managed hook. -- [ ] AC-04: Local pytest and governance pass. +- [x] AC-02: Linux functional CI activates the managed hook. +- [x] AC-03: Windows governance preserves LF and activates the managed hook. +- [x] AC-04: Local pytest and governance pass. ## Participants diff --git a/project/ticket-009/ai-codex-logs.txt b/project/ticket-009/ai-codex-logs.txt index e69de29..7946d6f 100644 --- a/project/ticket-009/ai-codex-logs.txt +++ b/project/ticket-009/ai-codex-logs.txt @@ -0,0 +1,9 @@ +2026-08-28 validation + +- `PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=src python -m pytest -q`: PASS + (8 passed). +- `PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=src ./project/governance-check.sh`: + PASS (0 errors, 0 warnings). +- Workflow actions are pinned by full commit SHA; Windows configures LF before + checkout and both runners activate `.githooks` before their governed gates. +- GitHub repository setting `delete_branch_on_merge=true` was already correct. diff --git a/project/ticket-009/ai-codex.md b/project/ticket-009/ai-codex.md index f63edcb..f504040 100644 --- a/project/ticket-009/ai-codex.md +++ b/project/ticket-009/ai-codex.md @@ -25,6 +25,9 @@ setting did not delete merged head branches as required. from the request to execute this work. - Selected immutable action revisions and a pre-checkout LF configuration so the repair needs no destructive reset in the ephemeral runner. +- Activated the managed hook in both jobs and verified that repository branch + deletion after merge is already enabled. +- Passed the complete package suite and governance locally. ## Blockers diff --git a/project/ticket-009/changelog.md b/project/ticket-009/changelog.md index 8c684ff..4efbc21 100644 --- a/project/ticket-009/changelog.md +++ b/project/ticket-009/changelog.md @@ -1,5 +1,8 @@ # Ticket Changelog (ticket-009) +- Pin checkout/setup actions, preserve LF before Windows checkout and activate + managed hooks in both CI jobs. + ## [0.1.0] - 2026-08-25 - Initial governance scaffold created.