From 3a322cd07c6fb1dd48a05d74b0e1be8f02166b0e Mon Sep 17 00:00:00 2001
From: Tom Softreck <tom@sapletta.com>
Date: Tue, 8 Sep 2026 16:45:00 +0200
Subject: [PATCH] docs(ci): exercise shared protected Python runner

---
 docs/information/local-verification.md | 26 +++++++++++++++++++++++---
 project/ticket-006/README.md           | 12 ++++++++++++
 project/ticket-006/intent.json         | 17 +++++++++++++++++
 3 files changed, 52 insertions(+), 3 deletions(-)
 create mode 100644 project/ticket-006/README.md
 create mode 100644 project/ticket-006/intent.json

diff --git a/docs/information/local-verification.md b/docs/information/local-verification.md
index 3983991..ed4ee5f 100644
--- a/docs/information/local-verification.md
+++ b/docs/information/local-verification.md
@@ -3,20 +3,22 @@
   "schema": "wellmanifest.docs/document/v1",
   "id": "local-verification",
   "kind": "information",
-  "version": 1,
+  "version": 2,
   "title": "Fixop local verification",
   "status": "proposed",
   "owner": "semcod/fixop",
   "created": "2026-09-08",
   "updated": "2026-09-08",
   "review_after": "2026-09-15",
-  "source_revision": "9b24f634e9c50b35e9e768562bc7e915d69b5b36",
+  "source_revision": "8e2274641346859dace82ed50201cd4d45ce5e37",
   "affected_repositories": [
     "semcod/fixop"
   ],
   "evidence": [
     "https://github.com/semcod/fixop/issues/4",
-    "https://github.com/subactor/onedev-agent/issues/207"
+    "https://github.com/subactor/onedev-agent/issues/207",
+    "https://github.com/semcod/fixop/issues/6",
+    "https://github.com/subactor/onedev-agent/issues/209"
   ]
 }
 ---
@@ -52,3 +54,21 @@ Passing mocked Linux tests does not prove real infrastructure remediation, Windo
 ## Acceptance
 
 Observe the deployed executor on this unchanged canary head, retain both Python results and the documentation result, then independently require the local gate alongside both hosted checks. Publish through the trusted Validator adapter.
+
+
+## Shared protected Python boundary
+
+The protected repository wrapper delegates input validation and matrix execution
+to `locked-python-matrix.py`, loaded from its absolute sibling path in the
+executor image. Candidate paths cannot select the helper. Repository identity,
+approved dependency hashes and both exact Python versions remain specific to
+this project; a job for the other deployed repository is rejected before any
+candidate subprocess. Dependency environments and hosted requirements are
+unchanged.
+
+The common regression suite exercises both repository contracts, including
+modified/missing/symlinked inputs, failure propagation, cross-repository binding
+and a candidate-directory helper substitution. Runtime publication still
+requires `onedev/local-verify`, `test (3.10)` and `test (3.13)` through the
+independent Validator. This documentation change is the real deployment canary
+for the shared runner; record exact head, base and merge-tree evidence.
diff --git a/project/ticket-006/README.md b/project/ticket-006/README.md
new file mode 100644
index 0000000..3cccf6d
--- /dev/null
+++ b/project/ticket-006/README.md
@@ -0,0 +1,12 @@
+# ticket-006: Shared protected Python verification
+
+Status: IN_PROGRESS / PUBLICATION.
+
+Session authorization: continue, push, test and deploy.
+Allocation: https://github.com/semcod/fixop/issues/6.
+
+AC-01: Document the shared protected boundary with unchanged dependency contract.
+AC-02: Run the deployed canary and preserve both hosted checks.
+AC-03: Publish independently with exact head/base/merge result.
+
+Canonical result: ../../docs/information/local-verification.md.
diff --git a/project/ticket-006/intent.json b/project/ticket-006/intent.json
new file mode 100644
index 0000000..faad67f
--- /dev/null
+++ b/project/ticket-006/intent.json
@@ -0,0 +1,17 @@
+{
+  "schema": "new-project.intent/v3",
+  "ticket": "ticket-006",
+  "summary": "Document and verify shared protected Python execution",
+  "workstream": "integration",
+  "allowedPaths": [
+    "docs/information/local-verification.md",
+    "project/ticket-006/**"
+  ],
+  "forbiddenPaths": [
+    "pyproject.toml",
+    "uv.lock",
+    ".github/workflows/**"
+  ],
+  "dependsOn": [],
+  "conflictsWith": []
+}