chore(governance): adopt wellmanifest/new-project 0.20.32 (ticket-170)

[tom-sapletta-com]

Adopt wellmanifest standard 0.20.32 in semcod/goal.

• Regenerate adoption lock and package manifest for 0.20.32 (b6ba9c21)
• Synchronize pyproject.toml [tool.wellmanifest] pin
• Harmonize manifest workstream declarations (clean application, expand governance)
• 100% test suite passes (76 adoption transaction tests, 64 delivery integrity tests, 73 governance delivery tests)
• Governance check passes (0 errors, 0 warnings)

[ifuri-validator-agent]

Validator approval after policy checks for exact head 33bc94c4d3bfed248d4d2bf1277774531c2a4985.

Ticket: ticket-170
Correlation ID: local-semcod-goal-pr-171-ticket-170
Model: zai/glm-5.3
Package advisory authority: ADVISORY (promotion FORBIDDEN)
Package digest: e8b4e4645bd6b2cb381b31f364f1daf55a5992d3d3710f2ecb050057c67f4591
Package evidence digest: 96aff42b31c660646f20aacd1bf145d2893e338c1c6f348f969ed32803def35a
Package files: 36; high-risk samples: .governance/branch_lifecycle_check.py, .governance/decision_record.py, .governance/governance_check.py
Reviewed diff chunks: 20
Advisory LLM verdict: APPROVE
Advisory summary: Reviewed all 20 diff chunk(s). Chunk 1 of a standard upgrade to wellmanifest 0.20.32 covers managed instruction-file updates (aider, Cursor, Copilot) adding source-link blocks and bounded-session guidance, expanded AGENT_DECISIONS.md playbook content, and an updated agent-hosts. contract. All required checks pass per the supplied protected assessment; changes are documentation/declarative with no executable defect visible in this chunk. | Chunk adds a sourceLinks/anomalyChecks declaration to the agent-hosts contract with a matching JSON schema and validator logic in agent_host_check.py. The validator correctly checks duplicate ids, unknown required ids, canonical URL construction, and local path resolution without fetching remote URLs. All required checks (test 3.12/3.13, governance enforce, governance remote lifecycle) pass per the protected assessment. | This chunk adds deterministic agent-host audit logic (source-link verification, bounded instruction-size checks, and a dependency-free workflow job-name parser) to the governance check. Code is offline, defensive against malformed input, and reads only declared files. All required checks (test 3.12/3.13, governance enforce, governance remote lifecycle) pass; the observational onedev/local-verify also passes. | Chunk 4 of the governance standard adoption diff. Changes refine governance error messaging/remediation text (branch lifecycle, approval, architecture), add a read-only classify-action subcommand to decision_record.py with a closed action vocabulary that explicitly grants no authority, and update diagnostics. documentation links. All required checks (test 3.12/3.13, governance enforce, governance remote lifecycle) pass per the structured assessment. No security or code defects observed in this chunk. | All four protected required checks (test 3.12, test 3.13, governance/enforce, governance/remote lifecycle) pass; the observational onedev/local-verify also passes. This chunk adds governance documentation and error-code mappings (snapshot migration docs, GOV-SNAPSHOT-MIGRATION-001..006, GOV-APPROVAL and GOV-AGENT-HOST guidance) with no executable defects visible. The snapshot migration contract documentation appropriately enforces protected authorization inputs, single-use grants, and ancestry preservation. | Chunk 6 of the standard 0.20.32 adoption diff adds governance error runbooks and documentation (GOV-APPROVAL, GOV-ARCHITECTURE-001, GOV-SNAPSHOT-MIGRATION, GOV-WORK-START). Content is documentation-only; no executable code, workflow, or secret handling in this chunk. All required checks passed per protected assessment; observational check also passed. | Documentation-only diff chunk (work-start runbook and Polish error-code docs for workspace/branch lifecycle). Content is consistent with the described 0.20.32 standard adoption: admission routing, snapshot reconciliation, publication observation, and fail-closed semantics are described accurately and without contradictions. All required checks pass. | Chunk 8/20 contains governance documentation updates (Polish prose on branch lifecycle recovery recipes) and governance_check.py changes adding snapshot migration proof handling, typed delivery dataChanges validation, and dynamic loading of the managed snapshot_migration runtime. All required checks (test 3.12, test 3.13, governance/enforce, governance/remote lifecycle) pass per the protected assessment; observational local-verify also passes. Code is conservative: unknown/legacy prose data changes remain non-exempt, component references must resolve to exactly one declared component, and migration proof failures produce explicit GOV errors rather than silently passing. | Chunk 9 of 20 of the 0.20.32 standard adoption shows governance check logic updates (snapshot migration filtering of imported paths, integration data-change classification), intent schema additions (snapshotMigration block, structured dataChanges), manifest version bumps, and lock digest updates. All required checks (test 3.12/3.13, governance enforce, remote lifecycle) pass per the protected assessment. | Chunk 10 of the standard 0.20.32 adoption diff contains manifest/package-manifest hash updates and new managed file mappings (work_start_check, snapshot_migration, related error docs). All required checks pass. No code or security defects visible in this chunk. | Chunk 11 covers manifest managed-file entries, a refactor of precommit_standard_update.py, a new snapshot-migration JSON schema, and the start of snapshot_migration.py. The precommit change removes the staleness-only bypass (and its staged-blob drift machinery), which strictly tightens the gate rather than relaxing it; every Goal refusal now blocks as before. The new schema is closed (additionalProperties: false) with strict SHA/digest/repository patterns and maxUses pinned to 1. snapshot_migration.py enforces closed field sets, path sanitization (no traversal, no control chars, no .git), and a 2MB authorization size cap. All four required checks (test 3.12/3.13, governance enforce, governance remote lifecycle) pass per the protected check assessment; no failed or missing required checks. | All four required checks (test 3.12/3.13, governance enforce, governance remote lifecycle) pass and match the protected required-checks list. The reviewed chunk shows careful snapshot-migration validation: pinned external authorization with digest and scope checks, symlink-resistant file hashing via O_NOFOLLOW and dir_fd, exact merge-boundary verification, and full-history enforcement. No independently evidenced code or security defects were found in the visible chunk. | Chunk 13/20 adds a context-local ActivityReadBatch for read-fenced git/file observation with revalidation on exit, refines ticket branch enumeration to use object names and include non-suffixed ticket refs, and enforces workstream-owned scoped paths in ticket_storage before widening allowedPaths. All required checks (test 3.12/3.13, governance enforce, remote lifecycle) pass per the protected assessment. | Chunk adds a scope command and --path option to the governance allocation CLI plus a new JSON Schema for work-start reports. Error handling avoids echoing untrusted input and emits bounded diagnostic codes. All required checks (tests on 3.12/3.13, governance enforce, remote lifecycle) pass; observational check passes as well. | Chunk 15/20 adds a read-only work-start governance check. All required protected checks (test 3.12/3.13, governance enforce, remote lifecycle) pass; observational onedev/local-verify also passes. Code is defensive: untrusted git output validated against strict patterns, observation failures treated as unavailable evidence rather than negative proof, no content or credential data leaked into reports, and subprocess calls are timeout-bounded with a sanitized environment. | Assessed diff chunk 16 of 20: worktree overlap inspection logic in .governance/worktree_overlap_check.py. Code is defensive (validates target branch names, rejects symlinks, refuses to guess missing refs, never fetches) and raises ObservationError rather than guessing. All four required checks (test 3.12/3.13, governance enforce, governance remote lifecycle) pass; observational local-verify also passes. PR body claims full test suite and governance check pass, consistent with reported outcomes. | Standard upgrade to wellmanifest 0.20.32. All four required checks pass and the observational local-verify passes. The visible chunk covers worktree overlap logic refinements and managed-source documentation. The changes_against_shared_default fix (intersecting committed paths with pair-relative changes to exclude shared feature commits) is logically coherent and documented. Ticket scope scanning is now batched via ActivityReadBatch with errors preserved. No defects independently evidenced in this chunk. | Documentation/manifest chunk of the wellmanifest 0.20.32 adoption: host projection docs (CLAUDE.md, GEMINI.md), ticket index updates, and new-ticket.sh argument handling. Content is consistent with the managed standard, remote links are documented as navigation-only (no runtime fetch), and no code defects are visible in this chunk. | Chunk 19 of the 0.20.32 standard adoption is consistent with the PR's stated scope. The new-ticket.sh changes (scope validation, work-start allocation check, sqlite scope recording) and the install-agent-hosts.sh pointer-rewrite via atomic temp-file replace are coherent governance tooling updates. Ticket-170 metadata and pyproject.toml pin update match the declared standard revision. All required checks pass; observational local-verify passes. No code defects or security issues visible in this chunk. | Chunk 20/20 shows the tail of scripts/install-agent-hosts.sh that installs user-level agent host pointer files; no defects visible. All four required checks (test 3.12/3.13, governance enforce, governance remote lifecycle) pass, and the observational onedev/local-verify check also passes.
Advisory findings: none
The LLM output above is advisory and was not used as the approval trust root.
Semantic review prerequisite: satisfied; policy 676cb4516bbfed2a000e40b9b1b6e4a430ecc761ec546aeb53d721a1905cfdd7.

Actual PR impact radar

Exact range: 969357f9d84402c6fd34c422571a7992886e08bb...33bc94c4d3bfed248d4d2bf1277774531c2a4985
Change digest: ad8497665d4928cfa50c7d647fce68dd6f55c4083212633fc10d2b438829caea
Score: 72/100 (L), estimated 227 min, split recommended: true
Affected services/components: repository-wide/unclassified

Machine-readable radar JSONL and SVG

{"actual_change":{"additions":3400,"base_sha":"969357f9d84402c6fd34c422571a7992886e08bb","binary_files":0,"categories":{"code":12,"configuration":12,"docs":14,"migrations":2},"change_digest":"ad8497665d4928cfa50c7d647fce68dd6f55c4083212633fc10d2b438829caea","comparison":"969357f9d84402c6fd34c422571a7992886e08bb...33bc94c4d3bfed248d4d2bf1277774531c2a4985","deletions":234,"file_count":40,"files":["aider.conf.yml","cursor/rules/new-project-standard.mdc","github/copilot-instructions.md","governance/AGENT_DECISIONS.md","governance/agent-hosts.json","governance/agent-hosts.schema.json","governance/agent_host_check.py","governance/branch_lifecycle_check.py","governance/decision_record.py","governance/diagnostics.json","governance/docs/SNAPSHOT_MIGRATION.md","governance/error/GOV-AGENT-HOST.md","governance/error/GOV-APPROVAL.md","governance/error/GOV-ARCHITECTURE-001.md","governance/error/GOV-SNAPSHOT-MIGRATION.md","governance/error/GOV-WORK-START.md","governance/error/GOV-WORKSPACE-LIFECYCLE.md","governance/governance_check.py","governance/intent.schema.json","governance/manifest.base.json","governance/manifest.json","governance/manifest.lock.json","governance/package-manifest.json","governance/precommit_standard_update.py","governance/snapshot-migration.schema.json","governance/snapshot_migration.py","governance/ticket_activity.py","governance/ticket_storage.py","governance/work-start-report.schema.json","governance/work_start_check.py","governance/worktree_overlap_check.py","AGENTS.md","CLAUDE.md","GEMINI.md","project/TICKETS.md","project/new-ticket.sh","project/ticket-170/README.md","project/ticket-170/intent.json","pyproject.toml","scripts/install-agent-hosts.sh"],"head_sha":"33bc94c4d3bfed248d4d2bf1277774531c2a4985","service_count":0,"services":[]},"assessment_mode":"observed-pr","axes":{"coupling":5,"delivery":3,"scope":5,"uncertainty":3,"validation":2},"complexity":"L","confidence":0.9,"diagnostics":["RADAR-ACCEPTANCE-MISSING","RADAR-BUDGET-EXCEEDED"],"estimate":{"budget_minutes":30,"minutes":227,"within_budget":false},"impact":{"components":["cursor","github","governance","project","repository-root","scripts"],"files":["AGENTS.md","CLAUDE.md","GEMINI.md","aider.conf.yml","cursor/rules/new-project-standard.mdc","github/copilot-instructions.md","governance/AGENT_DECISIONS.md","governance/agent-hosts.json","governance/agent-hosts.schema.json","governance/agent_host_check.py","governance/branch_lifecycle_check.py","governance/decision_record.py","governance/diagnostics.json","governance/docs/SNAPSHOT_MIGRATION.md","governance/error/GOV-AGENT-HOST.md","governance/error/GOV-APPROVAL.md","governance/error/GOV-ARCHITECTURE-001.md","governance/error/GOV-SNAPSHOT-MIGRATION.md","governance/error/GOV-WORK-START.md","governance/error/GOV-WORKSPACE-LIFECYCLE.md","governance/governance_check.py","governance/intent.schema.json","governance/manifest.base.json","governance/manifest.json","governance/manifest.lock.json","governance/package-manifest.json","governance/precommit_standard_update.py","governance/snapshot-migration.schema.json","governance/snapshot_migration.py","governance/ticket_activity.py","governance/ticket_storage.py","governance/work-start-report.schema.json","governance/work_start_check.py","governance/worktree_overlap_check.py","project/TICKETS.md","project/new-ticket.sh","project/ticket-170/README.md","project/ticket-170/intent.json","pyproject.toml","scripts/install-agent-hosts.sh"],"public_interfaces":["governance/agent-hosts.schema.json","governance/intent.schema.json","governance/snapshot-migration.schema.json","governance/work-start-report.schema.json"],"runtime_dependencies":1},"schema":"subactor.ticket-radar/v1","score":72,"split":{"parts":[{"estimated_minutes":20,"name":"Define contract and acceptance boundary","scope":["governance/agent-hosts.schema.json","governance/intent.schema.json","governance/snapshot-migration.schema.json","governance/work-start-report.schema.json"]},{"estimated_minutes":30,"name":"Implement cursor","scope":["cursor"]},{"estimated_minutes":30,"name":"Implement github","scope":["github"]},{"estimated_minutes":30,"name":"Implement governance","scope":["governance"]},{"estimated_minutes":30,"name":"Implement project","scope":["project"]},{"estimated_minutes":30,"name":"Implement repository-root","scope":["repository-root"]},{"estimated_minutes":15,"name":"Validate and project to trackers","scope":["tests","planfile","github/gitlab/jira projections"]}],"reason":"estimated_minutes_exceed_budget","recommended":true},"standards":[{"id":"wellmanifest/dsl","revision":"6c60fc4e0dd1f1bb74f46a7745e28019908d1203","version":"0.1.0-dev"},{"id":"wellmanifest/ticket-lifecycle","revision":"5bf581907a87b46a13a73e6c033d3abe4d9a306f","version":"0.1.0-dev"},{"id":"wellmanifest/git-lifecycle","revision":"7d77d4b7af57e69bc75c3a0290b3a4805c5c4438","version":"0.2.0-dev"},{"id":"wellmanifest/logs","revision":"48c284ef7a069055c0bcb6b900147ce5e65f8b43","version":"0.3.0"}],"ticket_ref":"ticket-170"}

<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" viewBox="0 0 128 128" role="img"><title>ticket-170: chore(governance): adopt wellmanifest/new-project 0.20.32 (ticket-170)</title><rect width="128" height="128" rx="12" fill="#f8fafc"/><g stroke-width="1"><polygon points="64,55 72,61 69,71 59,71 56,61" fill="none" stroke="#d7dde5"/><polygon points="64,47 80,59 74,78 54,78 48,59" fill="none" stroke="#d7dde5"/><polygon points="64,38 89,56 79,85 49,85 39,56" fill="none" stroke="#d7dde5"/><polygon points="64,30 97,53 84,92 44,92 31,53" fill="none" stroke="#d7dde5"/><polygon points="64,21 105,51 89,99 39,99 23,51" fill="none" stroke="#d7dde5"/><line x1="64" y1="64" x2="64" y2="21" stroke="#aab4c0"/><line x1="64" y1="64" x2="105" y2="51" stroke="#aab4c0"/><line x1="64" y1="64" x2="89" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="39" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="23" y2="51" stroke="#aab4c0"/></g><polygon points="64,21 105,51 79,85 54,78 39,56" fill="#fb923c" fill-opacity="0.45" stroke="#c2410c" stroke-width="2"/><circle cx="64" cy="64" r="3" fill="#c2410c"/><g font-family="sans-serif" font-size="7" fill="#334155"><text x="64" y="11" text-anchor="middle">SCO</text><text x="114" y="48" text-anchor="middle">COU</text><text x="95" y="107" text-anchor="middle">UNC</text><text x="33" y="107" text-anchor="middle">VAL</text><text x="14" y="48" text-anchor="middle">DEL</text></g><text x="64" y="124" text-anchor="middle" font-family="sans-serif" font-size="8" fill="#0f172a">L · 227m</text></svg>

Merge will be attempted after this approval when explicitly authorized. ## Decision record (recomputable)

DECISION D-170-5204
TICKET ticket-170
HEAD_SHA 33bc94c4d3bfed248d4d2bf1277774531c2a4985
CORRELATION_ID local-semcod-goal-pr-171-ticket-170
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT advisory_package_receipt = {"binding":{"repository":"semcod/goal","pull_request":171,"base_branch":"main","base_sha":"969357f9d84402c6fd34c422571a7992886e08bb","head_sha":"33bc94c4d3bfed248d4d2bf1277774531c2a4985","policy_digest":"9dd446855325af22db66ceb38f9ef9991bb8d565c09850dcf3bba7d451a207b2","registry_digest":"4b36dd612732400ebe365e4fb6b1ce3f8e3e947d0cdbe1e9faab0eeec9d91ec0"},"package_digest":"e8b4e4645bd6b2cb381b31f364f1daf55a5992d3d3710f2ecb050057c67f4591","evidence_digest":"96aff42b31c660646f20aacd1bf145d2893e338c1c6f348f969ed32803def35a","package_file_count":36,"samples":[{"path":".governance/branch_lifecycle_check.py","risk":"executable,code","diff_digest":"63f49e2c89f661daa53e0adc6f0c40e7a77c1af7404cc56b51c51a343b550cad","sample_digest":"03d7d5540da1caa46beda618b12c076d56b3f72f4ff9066e0e4479ae0c51ad94"},{"path":".governance/decision_record.py","risk":"executable,code","diff_digest":"3c3973b34a7450d3ee0426e58ed5598c83a047535a37941a0104aa3d2e76f73f","sample_digest":"7bfdb7e9ef9b5f78d8a0437d581068143c2810c30b36cbc14a44dcd5fbe0a974"},{"path":".governance/governance_check.py","risk":"executable,code","diff_digest":"0726fd736d781390b82e6a3269cbac3e13badca9534bc3393c264e4b16dc00e8","sample_digest":"2e569da51e44da1a260e97126b68ee7c4c630b31f84ceeed07ce5ff96f3227f1"}],"authority":"ADVISORY","promotion":"FORBIDDEN"}
INPUT author_login = "tom-sapletta-com"
INPUT observed_checks = ["test (3.13)=PASS","governance / enforce=PASS","test (3.12)=PASS","governance / remote lifecycle=PASS","onedev/local-verify=PASS"]
INPUT required_checks = ["test (3.12)","test (3.13)","governance / remote lifecycle","governance / enforce"]
INPUT required_checks_source = "protected registry + GitHub applied rules (env/request)"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
INPUT semantic_review_assessment = {"schema":"subactor.validator/semantic-review-assessment/v1","subject":{"repository":"semcod/goal","pull_request":171,"head_sha":"33bc94c4d3bfed248d4d2bf1277774531c2a4985","base_sha":"969357f9d84402c6fd34c422571a7992886e08bb","diff_sha256":"c3d5bb6ee44fa6e09aa7f0c252c59a9d9541fd84a8ec816693fd600ef7895dbf"},"policy":{"policy_schema":"subactor.validator/semantic-review-policy/v1","policy_version":1,"policy_sha256":"676cb4516bbfed2a000e40b9b1b6e4a430ecc761ec546aeb53d721a1905cfdd7","required":true,"critical_paths":[".governance/AGENT_DECISIONS.md",".governance/agent-hosts.json",".governance/agent-hosts.schema.json",".governance/agent_host_check.py",".governance/branch_lifecycle_check.py",".governance/decision_record.py",".governance/diagnostics.json",".governance/docs/SNAPSHOT_MIGRATION.md",".governance/error/GOV-AGENT-HOST.md",".governance/error/GOV-APPROVAL.md",".governance/error/GOV-ARCHITECTURE-001.md",".governance/error/GOV-SNAPSHOT-MIGRATION.md",".governance/error/GOV-WORK-START.md",".governance/error/GOV-WORKSPACE-LIFECYCLE.md",".governance/governance_check.py",".governance/intent.schema.json",".governance/manifest.base.json",".governance/manifest.json",".governance/manifest.lock.json",".governance/package-manifest.json",".governance/precommit_standard_update.py",".governance/snapshot-migration.schema.json",".governance/snapshot_migration.py",".governance/ticket_activity.py",".governance/ticket_storage.py",".governance/work-start-report.schema.json",".governance/work_start_check.py",".governance/worktree_overlap_check.py"],"observed_paths":[".aider.conf.yml",".cursor/rules/new-project-standard.mdc",".github/copilot-instructions.md",".governance/AGENT_DECISIONS.md",".governance/agent-hosts.json",".governance/agent-hosts.schema.json",".governance/agent_host_check.py",".governance/branch_lifecycle_check.py",".governance/decision_record.py",".governance/diagnostics.json",".governance/docs/SNAPSHOT_MIGRATION.md",".governance/error/GOV-AGENT-HOST.md",".governance/error/GOV-APPROVAL.md",".governance/error/GOV-ARCHITECTURE-001.md",".governance/error/GOV-SNAPSHOT-MIGRATION.md",".governance/error/GOV-WORK-START.md",".governance/error/GOV-WORKSPACE-LIFECYCLE.md",".governance/governance_check.py",".governance/intent.schema.json",".governance/manifest.base.json",".governance/manifest.json",".governance/manifest.lock.json",".governance/package-manifest.json",".governance/precommit_standard_update.py",".governance/snapshot-migration.schema.json",".governance/snapshot_migration.py",".governance/ticket_activity.py",".governance/ticket_storage.py",".governance/work-start-report.schema.json",".governance/work_start_check.py",".governance/worktree_overlap_check.py","AGENTS.md","CLAUDE.md","GEMINI.md","project/TICKETS.md","project/new-ticket.sh","project/ticket-170/README.md","project/ticket-170/intent.json","pyproject.toml","scripts/install-agent-hosts.sh"]},"grounding":"full-diff-not-per-finding-proof","execution_authority":false,"status":"satisfied","reason":null,"review_sha256":"32db67b825d23dcfe05f46d971d17572b74b60a44a046b864bf9b2293fad608a","unresolved":[]}
INPUT superseded_checks = []
INPUT ticket_radar_receipt = {"schema":"subactor.ticket-radar/v1","base_sha":"969357f9d84402c6fd34c422571a7992886e08bb","head_sha":"33bc94c4d3bfed248d4d2bf1277774531c2a4985","change_digest":"ad8497665d4928cfa50c7d647fce68dd6f55c4083212633fc10d2b438829caea","score":72,"complexity":"L","estimated_minutes":227,"split_recommended":true,"services":[],"authority":"ADVISORY","promotion":"FORBIDDEN"}
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "APPROVE" MODEL "zai/glm-5.3"
ASSERT VERDICT_AUTHORITY != "ADVISORY"