[ticket-008] build(deps): require Goal 2.1.293

TODO.md

@@ -22,6 +22,9 @@
 - [x] [`ticket-007`](project/ticket-007/README.md) — execute the freshly built
   wheel CLI with published dependencies in an isolated environment. State:
   `DONE`; classification: `SERVICE / health`.
+- [ ] [`ticket-008`](project/ticket-008/README.md) — require published Goal
+  2.1.293 across canonical development metadata and the uv lockfile. State:
+  `IN_PROGRESS`; classification: `SERVICE / integration`.
 
 <!-- PREFACT:BEGIN — generated block, edits inside will be overwritten -->
 # TODO

app.doql.less

@@ -19,15 +19,15 @@ dependencies {
   curllm: curllm[mcp]>=1.0.0;
   browser: "nlp2uri[envmap]>=0.4.7, env2llm[mqtt]>=0.1.14, testql>=1.2.64, curllm[mcp]>=1.0.0, playwright>=1.40,<2.0";
   vdisplay: vdisplay>=0.1.58;
-  dev: "gillm>=0.1.24, pytest>=8.0,<10.0, pytest-cov>=5.0,<8.0, pytest-rerunfailures>=14.0,<17.0, pytest-timeout>=2.3,<3.0, pytest-xdist>=3.0,<4.0, ruff>=0.11,<0.16, mypy>=1.11,<3.0, pyright>=1.1.390,<2.0, hypothesis>=6.112,<7.0, pre-commit>=3.8,<5.0, types-PyYAML>=6.0,<7.0, vdisplay>=0.1.58, cryptography>=42.0,<50.0, planfile>=0.1.117, goal>=2.1.292, costs>=0.1.53, pfix>=0.1.60, tagi>=0.49.0";
+  dev: "gillm>=0.1.24, pytest>=8.0,<10.0, pytest-cov>=5.0,<8.0, pytest-rerunfailures>=14.0,<17.0, pytest-timeout>=2.3,<3.0, pytest-xdist>=3.0,<4.0, ruff>=0.11,<0.16, mypy>=1.11,<3.0, pyright>=1.1.390,<2.0, hypothesis>=6.112,<7.0, pre-commit>=3.8,<5.0, types-PyYAML>=6.0,<7.0, vdisplay>=0.1.58, cryptography>=42.0,<50.0, planfile>=0.1.117, goal>=2.1.293, costs>=0.1.53, pfix>=0.1.60, tagi>=0.49.0";
   api: "fastapi>=0.115,<1.0, uvicorn[standard]>=0.30,<1.0, httpx>=0.27,<1.0, prometheus-client>=0.21,<1.0";
   agent: "instructor>=1.6,<2.0, litellm>=1.51,<2.0, openai>=1.54,<3.0, tiktoken>=0.8,<1.0";
   fullm: fullm>=0.1.22;
   tillm: tillm>=0.1.35;
   obs: "nfo>=0.2.22,<1.0, opentelemetry-exporter-otlp>=1.28,<2.0, opentelemetry-instrumentation-fastapi>=0.49b0,<1.0, opentelemetry-instrumentation-httpx>=0.49b0,<1.0, opentelemetry-sdk>=1.28,<2.0, sentry-sdk>=2.18,<3.0, structlog>=24.4,<26.0";
   queue: "apscheduler>=3.10,<4.0, arq>=0.26,<1.0, cryptography>=42.0,<50.0, redis>=5.1,<8.0";
   quality: "import-linter>=2.0,<3.0, mutmut>=3.2,<4.0, pyupgrade>=3.17,<4.0, refurb>=2.0,<3.0";
-  all: "apscheduler>=3.10,<4.0, arq>=0.26,<1.0, fastapi>=0.115,<1.0, gillm>=0.1.24, hypothesis>=6.112,<7.0, httpx>=0.27,<1.0, import-linter>=2.0,<3.0, instructor>=1.6,<2.0, litellm>=1.51,<2.0, mss>=9.0,<11.0, mutmut>=3.2,<4.0, mypy>=1.11,<3.0, mss>=9.0,<11.0, nfo>=0.2.22,<1.0, openai>=1.54,<3.0, opentelemetry-exporter-otlp>=1.28,<2.0, opentelemetry-instrumentation-fastapi>=0.49b0,<1.0, opentelemetry-instrumentation-httpx>=0.49b0,<1.0, opentelemetry-sdk>=1.28,<2.0, pre-commit>=3.8,<5.0, prometheus-client>=0.21,<1.0, pyright>=1.1.390,<2.0, pytest>=8.0,<10.0, pytest-cov>=5.0,<8.0, pytest-rerunfailures>=14.0,<17.0, pytest-timeout>=2.3,<3.0, pytest-xdist>=3.0,<4.0, pyupgrade>=3.17,<4.0, redis>=5.1,<8.0, refurb>=2.0,<3.0, ruff>=0.11,<0.16, tillm>=0.1.35, sentry-sdk>=2.18,<3.0, structlog>=24.4,<26.0, tiktoken>=0.8,<1.0, types-PyYAML>=6.0,<7.0, uvicorn[standard]>=0.30,<1.0, websockets>=12.0,<17.0, goal>=2.1.292, costs>=0.1.53, pfix>=0.1.60, tagi>=0.49.0, curllm[mcp]>=1.0.0, cryptography>=42.0,<50.0, env2llm[mqtt]>=0.1.14, fullm>=0.1.22, nlp2uri[envmap]>=0.4.7, planfile>=0.1.117, playwright>=1.40,<2.0, testql>=1.2.64, vdisplay>=0.1.58";
+  all: "apscheduler>=3.10,<4.0, arq>=0.26,<1.0, fastapi>=0.115,<1.0, gillm>=0.1.24, hypothesis>=6.112,<7.0, httpx>=0.27,<1.0, import-linter>=2.0,<3.0, instructor>=1.6,<2.0, litellm>=1.51,<2.0, mss>=9.0,<11.0, mutmut>=3.2,<4.0, mypy>=1.11,<3.0, mss>=9.0,<11.0, nfo>=0.2.22,<1.0, openai>=1.54,<3.0, opentelemetry-exporter-otlp>=1.28,<2.0, opentelemetry-instrumentation-fastapi>=0.49b0,<1.0, opentelemetry-instrumentation-httpx>=0.49b0,<1.0, opentelemetry-sdk>=1.28,<2.0, pre-commit>=3.8,<5.0, prometheus-client>=0.21,<1.0, pyright>=1.1.390,<2.0, pytest>=8.0,<10.0, pytest-cov>=5.0,<8.0, pytest-rerunfailures>=14.0,<17.0, pytest-timeout>=2.3,<3.0, pytest-xdist>=3.0,<4.0, pyupgrade>=3.17,<4.0, redis>=5.1,<8.0, refurb>=2.0,<3.0, ruff>=0.11,<0.16, tillm>=0.1.35, sentry-sdk>=2.18,<3.0, structlog>=24.4,<26.0, tiktoken>=0.8,<1.0, types-PyYAML>=6.0,<7.0, uvicorn[standard]>=0.30,<1.0, websockets>=12.0,<17.0, goal>=2.1.293, costs>=0.1.53, pfix>=0.1.60, tagi>=0.49.0, curllm[mcp]>=1.0.0, cryptography>=42.0,<50.0, env2llm[mqtt]>=0.1.14, fullm>=0.1.22, nlp2uri[envmap]>=0.4.7, planfile>=0.1.117, playwright>=1.40,<2.0, testql>=1.2.64, vdisplay>=0.1.58";
 }
 
 entity[name="TextContent"] {

project/TICKETS.md

@@ -1,11 +1,17 @@
-# Project tickets
+# Ticket index (`project/`)
 
-| Ticket | Status | Scope | Agent |
-| --- | --- | --- | --- |
-| [ticket-001](ticket-001/README.md) | DONE | Harden Koru's todo2code integration against repository governance | [ai-codex.md](ticket-001/ai-codex.md) |
-| [ticket-002](ticket-002/README.md) | DONE | Adopt immutable new-project 0.11.0 governance and work-classification package | [ai-codex.md](ticket-002/ai-codex.md) |
-| [ticket-003](ticket-003/README.md) | DONE | Restore the current-main Ruff baseline before governance adoption | [ai-codex.md](ticket-003/ai-codex.md) |
-| [ticket-005](ticket-005/README.md) | DONE | Assign development DSL and lockfile ownership | [ai-codex.md](ticket-005/ai-codex.md) |
-| [ticket-004](ticket-004/README.md) | DONE | Require Goal 2.1.292 and publish verified Koru 0.1.460 | [ai-codex.md](ticket-004/ai-codex.md) |
-| [ticket-006](ticket-006/README.md) | DONE | Align Goal with Koru's literal version carriers | [ai-codex.md](ticket-006/ai-codex.md) |
-| [ticket-007](ticket-007/README.md) | DONE | Verify the installed wheel CLI in isolation | [ai-codex.md](ticket-007/ai-codex.md) |
+This file indexes governance tickets without taking ownership of generated
+project analysis or human-owned ticket inputs.
+
+<!-- AUTO:TICKET_INDEX:START -->
+| Ticket ID | Spec | Preprompt | Human input | Agent plans | Agent logs | Changelog |
+| :--- | :--- | :--- | :--- | :--- | :--- | :--- |
+| **ticket-001** | [`README.md`](./ticket-001/README.md) | [`preprompt.md`](./ticket-001/preprompt.md) | - |  [`ai-codex.md`](./ticket-001/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-001/ai-codex-logs.txt) | [`changelog.md`](./ticket-001/changelog.md) |
+| **ticket-002** | [`README.md`](./ticket-002/README.md) | [`preprompt.md`](./ticket-002/preprompt.md) | - |  [`ai-codex.md`](./ticket-002/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-002/ai-codex-logs.txt) | [`changelog.md`](./ticket-002/changelog.md) |
+| **ticket-003** | [`README.md`](./ticket-003/README.md) | [`preprompt.md`](./ticket-003/preprompt.md) | - |  [`ai-codex.md`](./ticket-003/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-003/ai-codex-logs.txt) | [`changelog.md`](./ticket-003/changelog.md) |
+| **ticket-004** | [`README.md`](./ticket-004/README.md) | [`preprompt.md`](./ticket-004/preprompt.md) | - |  [`ai-codex.md`](./ticket-004/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-004/ai-codex-logs.txt) | [`changelog.md`](./ticket-004/changelog.md) |
+| **ticket-005** | [`README.md`](./ticket-005/README.md) | [`preprompt.md`](./ticket-005/preprompt.md) | - |  [`ai-codex.md`](./ticket-005/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-005/ai-codex-logs.txt) | [`changelog.md`](./ticket-005/changelog.md) |
+| **ticket-006** | [`README.md`](./ticket-006/README.md) | [`preprompt.md`](./ticket-006/preprompt.md) | - |  [`ai-codex.md`](./ticket-006/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-006/ai-codex-logs.txt) | [`changelog.md`](./ticket-006/changelog.md) |
+| **ticket-007** | [`README.md`](./ticket-007/README.md) | [`preprompt.md`](./ticket-007/preprompt.md) | - |  [`ai-codex.md`](./ticket-007/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-007/ai-codex-logs.txt) | [`changelog.md`](./ticket-007/changelog.md) |
+| **ticket-008** | [`README.md`](./ticket-008/README.md) | [`preprompt.md`](./ticket-008/preprompt.md) | - |  [`ai-codex.md`](./ticket-008/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-008/ai-codex-logs.txt) | [`changelog.md`](./ticket-008/changelog.md) |
+<!-- AUTO:TICKET_INDEX:END -->

project/ticket-008/README.md

@@ -0,0 +1,61 @@
+# Ticket 008: Require Goal 2.1.293 across Koru development metadata
+
+- **ID**: ticket-008
+- **Owner**: unresolved:human
+- **Status**: IN_PROGRESS
+- **Workflow state**: VALIDATION
+- **Created**: 2026-08-10
+- **Work classification**: `SERVICE / integration`
+
+## Goal and scope
+
+Raise Koru's Goal development-tool floor from 2.1.292 to the published
+2.1.293 release in every existing canonical dependency slot and refresh the
+uv lockfile. Keep Koru's application version unchanged unless Goal's
+registry-aware version state proves that a new release is required.
+
+## Acceptance criteria
+
+- [x] AC-01: The user explicitly requested autonomous dependency updates,
+  testing, publication and continuation without repeated confirmation.
+- [x] AC-02: All Goal dependency slots in `pyproject.toml` and `app.doql.less`
+  require at least 2.1.293.
+- [x] AC-03: `uv.lock` resolves the public Goal 2.1.293 artifact and remains
+  frozen/current.
+- [x] AC-04: Dependency-focused tests and repository governance pass.
+- [ ] AC-05: Goal makes a registry-aware Koru version decision and creates a
+  pull request whose exact head passes hosted and validator gates before
+  merge.
+
+## Risk boundary
+
+This ticket changes development-tool metadata and its lockfile only. It does
+not change runtime dependencies, runtime source, public interfaces, Docker,
+CI or generated analysis snapshots. Governance evidence and the canonical
+ticket index are updated only for this ticket.
+
+## Local validation evidence
+
+- `uv lock --check` and `uv tree --locked --package goal`: PASS; Goal resolves
+  to public version 2.1.293.
+- Dependency synchronization tests: 12 passed, including 735 inventory
+  subtests.
+- Koru critical suite: 253 passed with two pre-existing deprecation warnings.
+- `doql -f app.doql.less validate`: 0 errors and two pre-existing
+  compatibility warnings.
+- Production Docker image builds successfully; an offline (`--network none`)
+  container reports `koru 0.1.460` and installed `goal 2.1.293`.
+- Repository governance and `git diff --check`: PASS.
+- Goal registry comparison preserves Koru 0.1.460 with a `no-release`
+  decision; no artificial application-version bump is required.
+
+## Session authorization
+
+The user authorized autonomous execution and publication in this session on
+2026-08-10. This bounded dependency-only intent therefore proceeds directly
+to `EDIT`; no human-owned `user-*.md` file is synthesized.
+
+## Participants
+
+- Human participant: unresolved; no user-* file was created by this script.
+- Agent participant: [ai-codex.md](ai-codex.md)

project/ticket-008/ai-codex-logs.txt

@@ -0,0 +1,11 @@
+2026-08-10 authorization: autonomous dependency updates, testing and publication requested by user
+2026-08-10 accepted base: 418c6e9f411654f358fa542977feb67f29e904f2
+2026-08-10 scope: Goal development metadata only; no runtime dependency or source change
+2026-08-10 scaffolder repair: canonical ticket-index markers restored after legacy index rejection
+2026-08-10 delivery classification: S because the 20-minute estimate exceeds the governance XS limit of 10 minutes
+2026-08-10 dependency sync: all TOML/DoQL Goal floors and uv.lock resolve 2.1.293
+2026-08-10 focused tests: 12 passed, including 735 dependency inventory subtests
+2026-08-10 critical tests: 253 passed, 2 pre-existing deprecation warnings
+2026-08-10 DoQL validation: 0 errors, 2 pre-existing compatibility warnings
+2026-08-10 Docker smoke: production image PASS; offline koru 0.1.460 / goal 2.1.293
+2026-08-10 version decision: Goal preserves public Koru 0.1.460 (no-release)

project/ticket-008/ai-codex.md

@@ -0,0 +1,38 @@
+---
+participant-id: agent:codex
+participant: codex
+role: agent
+ticket: ticket-008
+---
+# Participant: codex (AI agent)
+
+## Understanding
+
+Goal 2.1.293 is already public and must replace 2.1.292 in Koru's three
+Python dependency slots, two generated DSL dependency views and uv lockfile.
+The change is a development-tool update; Koru's runtime contract remains
+unchanged.
+
+## Execution plan
+
+1. Synchronize the canonical TOML and DoQL dependency floors.
+2. Resolve only Goal in the existing uv lockfile and prove the public version.
+3. Run the focused dependency tests and repository governance.
+4. Use Goal in governed pull-request mode, validate the exact head and merge
+   only after the repository's approval boundary succeeds.
+
+## Actual changes
+
+- Raised all three TOML and two DoQL Goal dependency floors to 2.1.293.
+- Refreshed only the Goal resolution in `uv.lock` and verified the public
+  artifact with frozen lock commands.
+- Passed focused dependency tests, the 253-test critical suite, DoQL
+  validation, an offline production-container smoke and repository
+  governance.
+- Confirmed through Goal's registry comparison that Koru 0.1.460 remains the
+  correct version and no release bump is needed for this toolchain-only
+  change.
+
+## Blockers
+
+- None; the user explicitly authorized autonomous continuation.

project/ticket-008/changelog.md

@@ -0,0 +1,16 @@
+# Ticket Changelog (ticket-008)
+
+## [0.1.0] - 2026-08-10
+
+- Initial governance scaffold created.
+- No human participant identity or content was generated.
+- Scoped the Goal 2.1.293 development-tool update to canonical TOML, DoQL and
+  uv lock metadata.
+- Recorded the user's standing autonomous authorization and entered `EDIT`.
+- Synchronized every canonical Goal floor and the frozen uv resolution to
+  public Goal 2.1.293.
+- Passed focused dependency checks, the Koru critical suite, DoQL validation
+  an offline production-container smoke and repository governance, then
+  entered `VALIDATION` for exact-head hosted delivery.
+- Preserved Koru 0.1.460 after Goal selected `no-release` for this
+  development-tool-only change.

project/ticket-008/intent.json

@@ -0,0 +1,92 @@
+{
+  "schema": "new-project.intent/v2",
+  "ticket": "ticket-008",
+  "summary": "Require published Goal 2.1.293 across Koru development metadata",
+  "workstream": "integration",
+  "allowedPaths": [
+    "pyproject.toml",
+    "app.doql.less",
+    "uv.lock",
+    "project/ticket-008/**",
+    "TODO.md",
+    "project/TICKETS.md"
+  ],
+  "forbiddenPaths": [
+    ".governance/**",
+    ".github/**",
+    "project/ticket-*/user-*.md",
+    "src/**",
+    "tests/**",
+    "docs/**",
+    "VERSION",
+    "CHANGELOG.md",
+    "package.json",
+    "package-lock.json",
+    "goal.yaml",
+    "SUMD.md",
+    "project/*.toon.yaml"
+  ],
+  "stacks": ["python"],
+  "dependsOn": ["ticket-004", "ticket-005"],
+  "conflictsWith": [],
+  "integrationTicket": null,
+  "delivery": {
+    "acceptedBaseSha": "418c6e9f411654f358fa542977feb67f29e904f2",
+    "targetBranch": "main",
+    "outcome": "Koru consistently requires and locks the published Goal 2.1.293 development tool",
+    "nonGoals": [
+      "No Koru runtime, public interface, Docker or CI change",
+      "No runtime dependency or generated analysis change",
+      "No Koru version bump unless Goal proves it is required"
+    ],
+    "complexity": "S",
+    "estimatedMinutes": 20,
+    "budgets": {
+      "maxImplementationFiles": 3,
+      "maxAffectedComponents": 1,
+      "maxPublicInterfaceChanges": 0,
+      "maxRuntimeDependencies": 0
+    },
+    "architecture": {
+      "status": "accepted",
+      "decision": "Keep the Goal floor synchronized in TOML, DoQL and the uv lock while preserving Koru runtime behavior",
+      "components": [
+        {
+          "name": "development-toolchain",
+          "paths": ["pyproject.toml", "app.doql.less", "uv.lock"]
+        }
+      ],
+      "responsibilityChanges": false,
+      "interfaceChanges": [],
+      "dataChanges": [],
+      "ui": {"impact": "none", "states": [], "evidence": []},
+      "rollback": "Revert the dependency-only commit before merge"
+    },
+    "runtimeDependencies": [],
+    "validation": [
+      {
+        "criterion": "AC-03",
+        "commands": ["uv lock --check", "uv tree --locked --package goal"],
+        "evidence": "The frozen lock resolves public Goal 2.1.293"
+      },
+      {
+        "criterion": "AC-04",
+        "commands": [
+          "python -m pytest tests/test_dev_sync.py -q",
+          "python -m pytest tests/test_dependency_boundary_inventory.py -q",
+          "./project/governance-check.sh",
+          "git diff --check"
+        ],
+        "evidence": "Dependency synchronization and governance are green"
+      },
+      {
+        "criterion": "AC-05",
+        "commands": [
+          "goal --config goal.yaml check-versions",
+          "goal -a --config goal.yaml --delivery-mode pull-request --no-publish"
+        ],
+        "evidence": "Goal preserves a valid existing bump and exact-head gates precede merge"
+      }
+    ]
+  }
+}

project/ticket-008/preprompt.md

@@ -0,0 +1,8 @@
+# Ticket preprompt
+
+- **Task ID**: ticket-008
+- **Task title**: Require Goal 2.1.293 across Koru development metadata
+- **Created**: 2026-08-10T21:46:03Z
+
+Keep executable implementation outside this governance/evidence directory.
+Read a human-owned user-*.md file only when one exists.

pyproject.toml

@@ -102,7 +102,7 @@ dev = [
     "vdisplay>=0.1.58",
     "cryptography>=42.0,<50.0",
     "planfile>=0.1.117",
-    "goal>=2.1.292",
+    "goal>=2.1.293",
     "costs>=0.1.53",
     "pfix>=0.1.60",
     "tagi>=0.49.0",
@@ -187,7 +187,7 @@ all = [
     "types-PyYAML>=6.0,<7.0",
     "uvicorn[standard]>=0.30,<1.0",
     "websockets>=12.0,<17.0",
-    "goal>=2.1.292",
+    "goal>=2.1.293",
     "costs>=0.1.53",
     "pfix>=0.1.60",
     "tagi>=0.49.0",
@@ -222,7 +222,7 @@ dev = [
     "hypothesis>=6.112,<7.0",
     "pre-commit>=3.8,<5.0",
     "types-PyYAML>=6.0,<7.0",
-    "goal>=2.1.292",
+    "goal>=2.1.293",
     "costs>=0.1.53",
     "pfix>=0.1.60",
     "tagi>=0.49.0",