docs(ci): verify shared protected Python runner

[tom-sapletta-com]

Exercise the deployed shared trusted Python runner through the existing protected local gate and both hosted Python checks. Document preserved locked dependencies, isolated imports and mandatory publication requirements.

Executor refactor subactor/onedev-agent#210 was independently merged as 5f4490cf28b519471b5460489f8a65532bd54999 and deployed in image sha256:ec2785213f7095f565ef951443a20eb981907ae222ba89d20133c6c063ab59a8 with unchanged profiles and dependency environments.

Validation: pinned Docs checker and both hosted Python checks passed. The deployed local gate will verify this exact candidate and current merge base before independent publication.

Closes #6.

[ifuri-validator-agent]

Deterministic Validator approval for exact head 3a322cd07c6fb1dd48a05d74b0e1be8f02166b0e.

Ticket: ticket-006
Correlation ID: local-semcod-fixop-pr-7-ticket-006
Model: zai/glm-5.3
Reviewed diff chunks: 1
Advisory LLM verdict: APPROVE
Advisory summary: Reviewed all 1 diff chunk(s). Documentation-only change adding a section describing the shared protected Python boundary, plus new project ticket metadata. Changed files all fall within the declared allowedPaths in intent.; no forbidden paths (pyproject.toml, uv.lock, workflows) are touched. All checks pass.
Advisory findings: none
The LLM output above is advisory and was not used as the approval trust root.

Actual PR impact radar

Exact range: 8e2274641346859dace82ed50201cd4d45ce5e37...3a322cd07c6fb1dd48a05d74b0e1be8f02166b0e
Change digest: d9bef08f1391b572d42ec3e962a9fd38f37fbb69d75120d975e276f64031606e
Score: 48/100 (M), estimated 51 min, split recommended: true
Affected services/components: repository-wide/unclassified

Machine-readable radar JSONL and SVG

{"actual_change":{"additions":52,"base_sha":"8e2274641346859dace82ed50201cd4d45ce5e37","binary_files":0,"categories":{"configuration":1,"docs":2},"change_digest":"d9bef08f1391b572d42ec3e962a9fd38f37fbb69d75120d975e276f64031606e","comparison":"8e2274641346859dace82ed50201cd4d45ce5e37...3a322cd07c6fb1dd48a05d74b0e1be8f02166b0e","deletions":3,"file_count":3,"files":["docs/information/local-verification.md","project/ticket-006/README.md","project/ticket-006/intent.json"],"head_sha":"3a322cd07c6fb1dd48a05d74b0e1be8f02166b0e","service_count":0,"services":[]},"assessment_mode":"observed-pr","axes":{"coupling":3,"delivery":3,"scope":2,"uncertainty":3,"validation":1},"complexity":"M","confidence":0.9,"diagnostics":["RADAR-ACCEPTANCE-MISSING","RADAR-BUDGET-EXCEEDED"],"estimate":{"budget_minutes":30,"minutes":51,"within_budget":false},"impact":{"components":["docs","project","subactor"],"files":["docs/information/local-verification.md","project/ticket-006/README.md","project/ticket-006/intent.json","subactor/onedev-agent"],"public_interfaces":[],"runtime_dependencies":1},"schema":"subactor.ticket-radar/v1","score":48,"split":{"parts":[{"estimated_minutes":14,"name":"Implement docs","scope":["docs"]},{"estimated_minutes":14,"name":"Implement project","scope":["project"]},{"estimated_minutes":14,"name":"Implement subactor","scope":["subactor"]},{"estimated_minutes":15,"name":"Validate and project to trackers","scope":["tests","planfile","github/gitlab/jira projections"]}],"reason":"estimated_minutes_exceed_budget","recommended":true},"standards":[{"id":"wellmanifest/dsl","revision":"6c60fc4e0dd1f1bb74f46a7745e28019908d1203","version":"0.1.0-dev"},{"id":"wellmanifest/ticket-lifecycle","revision":"5bf581907a87b46a13a73e6c033d3abe4d9a306f","version":"0.1.0-dev"},{"id":"wellmanifest/git-lifecycle","revision":"7d77d4b7af57e69bc75c3a0290b3a4805c5c4438","version":"0.2.0-dev"},{"id":"wellmanifest/logs","revision":"48c284ef7a069055c0bcb6b900147ce5e65f8b43","version":"0.3.0"}],"ticket_ref":"ticket-006"}

<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" viewBox="0 0 128 128" role="img"><title>ticket-006: docs(ci): verify shared protected Python runner</title><rect width="128" height="128" rx="12" fill="#f8fafc"/><g stroke-width="1"><polygon points="64,55 72,61 69,71 59,71 56,61" fill="none" stroke="#d7dde5"/><polygon points="64,47 80,59 74,78 54,78 48,59" fill="none" stroke="#d7dde5"/><polygon points="64,38 89,56 79,85 49,85 39,56" fill="none" stroke="#d7dde5"/><polygon points="64,30 97,53 84,92 44,92 31,53" fill="none" stroke="#d7dde5"/><polygon points="64,21 105,51 89,99 39,99 23,51" fill="none" stroke="#d7dde5"/><line x1="64" y1="64" x2="64" y2="21" stroke="#aab4c0"/><line x1="64" y1="64" x2="105" y2="51" stroke="#aab4c0"/><line x1="64" y1="64" x2="89" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="39" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="23" y2="51" stroke="#aab4c0"/></g><polygon points="64,47 89,56 79,85 59,71 39,56" fill="#fb923c" fill-opacity="0.45" stroke="#c2410c" stroke-width="2"/><circle cx="64" cy="64" r="3" fill="#c2410c"/><g font-family="sans-serif" font-size="7" fill="#334155"><text x="64" y="11" text-anchor="middle">SCO</text><text x="114" y="48" text-anchor="middle">COU</text><text x="95" y="107" text-anchor="middle">UNC</text><text x="33" y="107" text-anchor="middle">VAL</text><text x="14" y="48" text-anchor="middle">DEL</text></g><text x="64" y="124" text-anchor="middle" font-family="sans-serif" font-size="8" fill="#0f172a">M · 51m</text></svg>

Merge will be attempted after this approval when explicitly authorized. ## Decision record (recomputable)

DECISION D-006-6446
TICKET ticket-006
HEAD_SHA 3a322cd07c6fb1dd48a05d74b0e1be8f02166b0e
CORRELATION_ID local-semcod-fixop-pr-7-ticket-006
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT author_login = "tom-sapletta-com"
INPUT observed_checks = ["test (3.10)=PASS","test (3.13)=PASS","onedev/local-verify=PASS"]
INPUT required_checks = ["test (3.10)","test (3.13)","onedev/local-verify"]
INPUT required_checks_source = "protected registry (env/request)"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
INPUT superseded_checks = []
INPUT ticket_radar_receipt = {"schema":"subactor.ticket-radar/v1","base_sha":"8e2274641346859dace82ed50201cd4d45ce5e37","head_sha":"3a322cd07c6fb1dd48a05d74b0e1be8f02166b0e","change_digest":"d9bef08f1391b572d42ec3e962a9fd38f37fbb69d75120d975e276f64031606e","score":48,"complexity":"M","estimated_minutes":51,"split_recommended":true,"services":[],"authority":"ADVISORY","promotion":"FORBIDDEN"}
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "APPROVE" MODEL "zai/glm-5.3"
ASSERT VERDICT_AUTHORITY != "ADVISORY"