[ticket-008] build(deps): require Goal 2.1.293

[tom-sapletta-com]

Zakres

Aktualizacja wszystkich kanonicznych deklaracji narzędzia Goal do publicznego wydania 2.1.293, wraz z odświeżeniem uv.lock. Koru pozostaje w wersji 0.1.460 zgodnie z decyzją rejestrową Goal no-release.

Dowody lokalne

• uv lock --check oraz zamrożone drzewo Goal: PASS (2.1.293)
• testy synchronizacji zależności: 12 PASS, w tym 735 subtestów
• krytyczna bramka Koru: 253 PASS
• wszystkie 5 workspace’ów Node: PASS
• DoQL: 0 błędów
• governance: 0 błędów, 0 ostrzeżeń
• produkcyjny Docker bez sieci: Koru 0.1.460 / Goal 2.1.293

Granica dostawy

Ticket: ticket-008. Exact head: ef673a4a0df23aafb542d904ca98acbe07f7cace. Merge dopiero po hosted smoke i niezależnej walidacji tego SHA.

[ifuri-validator-agent]

Deterministic Validator approval for exact head ef673a4a0df23aafb542d904ca98acbe07f7cace.

Ticket: ticket-008
Correlation ID: koru-pr-28-ticket-008
Model: openrouter/z-ai/glm-5.2
Reviewed diff chunks: 2
Advisory LLM verdict: REQUEST_CHANGES
Advisory summary: Reviewed all 2 diff chunk(s). The PR bumps Goal from 2.1.292 to 2.1.293 in app.doql.less and ticket-008 governance docs. The visible code changes are consistent and low-risk (dev-tool dependency floor bump). However, the diff chunk does not contain the pyproject.toml or uv.lock actual content changes, and the ticket claims AC-02 and AC-03 as checked ([x]) despite acceptance criteria including pyproject.toml; the visible chunk only shows app.doql.less updates. Since AC-05 is intentionally unchecked pending hosted validation, and the PR body states merge only after independent SHA validation, this chunk cannot be approved solely on the smoke PASS result. | Dependency-only PR updating Goal floor from 2.1.292 to 2.1.293 across pyproject.toml (three slots), uv.lock, and DoQL metadata. Changes are consistent and scope-limited per intent.json. Lock file hashes/sdist/wheels updated coherently. No source, test, or CI workflow modifications. No security concerns.
Advisory findings: Acceptance criteria AC-02 and AC-03 are marked complete ([x]) in ticket-008/README.md, but the visible diff chunk only shows the app.doql.less Goal bump. The pyproject.toml and uv.lock changes are in the changed_files list but not present in this chunk, so the claimed completion cannot be semantically verified here without the actual content. This is a request-changes level verification gap for the ticket's own acceptance evidence.; PR body and ticket AC-05 require hosted smoke and independent validator gates on exact head ef673a4 before merge. The provided test_results_data only shows 'smoke: PASS', which is insufficient to confirm the hosted gate passed on that exact SHA.
The LLM output above is advisory and was not used as the approval trust root.
Merge was not requested or performed.

Decision record (recomputable)

DECISION D-008-1553
TICKET ticket-008
HEAD_SHA ef673a4a0df23aafb542d904ca98acbe07f7cace
CORRELATION_ID koru-pr-28-ticket-008
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT author_login = "tom-sapletta-com"
INPUT observed_checks = ["smoke=PASS"]
INPUT required_checks = ["smoke"]
INPUT required_checks_source = "env/request"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "REQUEST_CHANGES" MODEL "openrouter/z-ai/glm-5.2"
ASSERT VERDICT_AUTHORITY != "ADVISORY"