[tom-sapletta-com]

Restores dependency freshness and CI verification for the dependency update tracked in PR #27 through native governed delivery.

• Updates costs to 0.2.1, clickmd to 1.1.16 and Goal to 2.2.1 in the lock.
• Uses github.token for both immutable public standard checkouts under existing contents: read permissions. Action and standard pins, persist-credentials: false, managed-copy verification and all governance/test gates remain intact.
• Includes native ticket-020 intent atomically with material changes. Original bot PR27 and its branch remain preserved until coverage reconciliation.

Validation: Python 3.10 and 3.13 each pass 251 tests with 15 skips. Pinned docs verification, published dependency freshness and managed governance pass. Scoped governance against origin/main passes with zero errors or warnings.

Native ticket: ticket-020. Parent backlog: PLF-17346. No scanner, Rust or public API changes.

[ifuri-validator-agent]

Validator approval after policy checks for exact head 3debd5b20eb8937b24ca3445d433b0f6f8b82978.

Ticket: ticket-020
Correlation ID: local-semcod-redup-pr-28-ticket-020
Model: openai/cursor-auto
Reviewed diff chunks: 6
Advisory LLM verdict: APPROVE
Advisory summary: Reviewed all 6 diff chunk(s). The visible changes are consistent with the stated repair: immutable public repositories are checked out using the scoped github.token while preserving pinned refs and persist-credentials:false; ticket metadata describes a bounded change; and the lockfile changes shown are dependency-resolution cleanup. No unresolved code or security defect is evident in this chunk. | The visible lockfile changes consistently upgrade clickmd, costs, and goal with updated hashes and remove dependencies no longer referenced by the resolved graph. No code or security defects are evident in this chunk. All protected required checks passed. | The visible lockfile chunk consistently removes a set of packages and their transitive dependencies. No independently evidenced correctness or security defect is apparent in this chunk, and all protected required checks passed. | The visible chunk removes transitive lockfile entries consistent with dependency graph pruning. No independently evidenced code or security defect is present in this chunk. Both protected required checks passed. | The visible lockfile chunk reflects a project version update to 0.4.49, an automation-group Python requirement of >=3.12, and removal of dependency artifacts consistent with lockfile regeneration. No unresolved code or security defect is evident in this chunk. Both protected required checks passed. | The visible lockfile chunk consistently removes transitive package entries. No independently evidenced code or security defect is present, and all protected required checks passed.
Advisory findings: none
The LLM output above is advisory and was not used as the approval trust root.
Semantic review prerequisite: satisfied; policy 676cb4516bbfed2a000e40b9b1b6e4a430ecc761ec546aeb53d721a1905cfdd7.

Actual PR impact radar

Exact range: 38613b21bf972e139a368516ce6eb1277941282a...3debd5b20eb8937b24ca3445d433b0f6f8b82978
Change digest: e35023ac3ec676439b32ada81588048b5a0cd2b2e47834c37b51a87435acc0a5
Score: 68/100 (L), estimated 80 min, split recommended: true
Affected services/components: repository-wide/unclassified

Machine-readable radar JSONL and SVG

{"actual_change":{"additions":125,"base_sha":"38613b21bf972e139a368516ce6eb1277941282a","binary_files":0,"categories":{"code":1,"configuration":1,"docs":2,"tests":1},"change_digest":"e35023ac3ec676439b32ada81588048b5a0cd2b2e47834c37b51a87435acc0a5","comparison":"38613b21bf972e139a368516ce6eb1277941282a...3debd5b20eb8937b24ca3445d433b0f6f8b82978","deletions":527,"file_count":5,"files":["github/workflows/test-locked.yml","project/TICKETS.md","project/ticket-020/README.md","project/ticket-020/intent.json","uv.lock"],"head_sha":"3debd5b20eb8937b24ca3445d433b0f6f8b82978","service_count":0,"services":[]},"assessment_mode":"observed-pr","axes":{"coupling":5,"delivery":4,"scope":4,"uncertainty":3,"validation":1},"complexity":"L","confidence":0.9,"diagnostics":["RADAR-ACCEPTANCE-MISSING","RADAR-BUDGET-EXCEEDED"],"estimate":{"budget_minutes":30,"minutes":80,"within_budget":false},"impact":{"components":["github","governance","origin","project","repository-root"],"files":["github/workflows/test-locked.yml","governance/test","origin/main","project/TICKETS.md","project/ticket-020/README.md","project/ticket-020/intent.json","uv.lock"],"public_interfaces":[],"runtime_dependencies":1},"schema":"subactor.ticket-radar/v1","score":68,"split":{"parts":[{"estimated_minutes":14,"name":"Implement github","scope":["github"]},{"estimated_minutes":14,"name":"Implement governance","scope":["governance"]},{"estimated_minutes":14,"name":"Implement origin","scope":["origin"]},{"estimated_minutes":14,"name":"Implement project","scope":["project"]},{"estimated_minutes":14,"name":"Implement repository-root","scope":["repository-root"]},{"estimated_minutes":15,"name":"Validate and project to trackers","scope":["tests","planfile","github/gitlab/jira projections"]}],"reason":"estimated_minutes_exceed_budget","recommended":true},"standards":[{"id":"wellmanifest/dsl","revision":"6c60fc4e0dd1f1bb74f46a7745e28019908d1203","version":"0.1.0-dev"},{"id":"wellmanifest/ticket-lifecycle","revision":"5bf581907a87b46a13a73e6c033d3abe4d9a306f","version":"0.1.0-dev"},{"id":"wellmanifest/git-lifecycle","revision":"7d77d4b7af57e69bc75c3a0290b3a4805c5c4438","version":"0.2.0-dev"},{"id":"wellmanifest/logs","revision":"48c284ef7a069055c0bcb6b900147ce5e65f8b43","version":"0.3.0"}],"ticket_ref":"ticket-020"}

<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" viewBox="0 0 128 128" role="img"><title>ticket-020: fix(ticket-020): restore dependency freshness and public CI checkout</title><rect width="128" height="128" rx="12" fill="#f8fafc"/><g stroke-width="1"><polygon points="64,55 72,61 69,71 59,71 56,61" fill="none" stroke="#d7dde5"/><polygon points="64,47 80,59 74,78 54,78 48,59" fill="none" stroke="#d7dde5"/><polygon points="64,38 89,56 79,85 49,85 39,56" fill="none" stroke="#d7dde5"/><polygon points="64,30 97,53 84,92 44,92 31,53" fill="none" stroke="#d7dde5"/><polygon points="64,21 105,51 89,99 39,99 23,51" fill="none" stroke="#d7dde5"/><line x1="64" y1="64" x2="64" y2="21" stroke="#aab4c0"/><line x1="64" y1="64" x2="105" y2="51" stroke="#aab4c0"/><line x1="64" y1="64" x2="89" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="39" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="23" y2="51" stroke="#aab4c0"/></g><polygon points="64,30 105,51 79,85 59,71 31,53" fill="#fb923c" fill-opacity="0.45" stroke="#c2410c" stroke-width="2"/><circle cx="64" cy="64" r="3" fill="#c2410c"/><g font-family="sans-serif" font-size="7" fill="#334155"><text x="64" y="11" text-anchor="middle">SCO</text><text x="114" y="48" text-anchor="middle">COU</text><text x="95" y="107" text-anchor="middle">UNC</text><text x="33" y="107" text-anchor="middle">VAL</text><text x="14" y="48" text-anchor="middle">DEL</text></g><text x="64" y="124" text-anchor="middle" font-family="sans-serif" font-size="8" fill="#0f172a">L · 80m</text></svg>

Merge will be attempted after this approval when explicitly authorized. ## Decision record (recomputable)

DECISION D-020-0368
TICKET ticket-020
HEAD_SHA 3debd5b20eb8937b24ca3445d433b0f6f8b82978
CORRELATION_ID local-semcod-redup-pr-28-ticket-020
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT author_login = "tom-sapletta-com"
INPUT observed_checks = ["test (3.13)=PASS","test (3.10)=PASS","governance / enforce=PASS","freshness=PASS","governance / remote lifecycle=PASS"]
INPUT required_checks = ["test (3.10)","test (3.13)"]
INPUT required_checks_source = "protected registry (env/request)"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
INPUT semantic_review_assessment = {"schema":"subactor.validator/semantic-review-assessment/v1","subject":{"repository":"semcod/redup","pull_request":28,"head_sha":"3debd5b20eb8937b24ca3445d433b0f6f8b82978","base_sha":"38613b21bf972e139a368516ce6eb1277941282a","diff_sha256":"a74bba3875b6576f6789d74602d65388393f934722fe6515a7431f24515933c8"},"policy":{"policy_schema":"subactor.validator/semantic-review-policy/v1","policy_version":1,"policy_sha256":"676cb4516bbfed2a000e40b9b1b6e4a430ecc761ec546aeb53d721a1905cfdd7","required":true,"critical_paths":[".github/workflows/test-locked.yml"],"observed_paths":[".github/workflows/test-locked.yml","project/TICKETS.md","project/ticket-020/README.md","project/ticket-020/intent.json","uv.lock"]},"grounding":"full-diff-not-per-finding-proof","execution_authority":false,"status":"satisfied","reason":null,"review_sha256":"1c0d2f119a720a009fc7e798b229e84e5a6442a7ceaa89f820583b98973fb67b","unresolved":[]}
INPUT superseded_checks = []
INPUT ticket_radar_receipt = {"schema":"subactor.ticket-radar/v1","base_sha":"38613b21bf972e139a368516ce6eb1277941282a","head_sha":"3debd5b20eb8937b24ca3445d433b0f6f8b82978","change_digest":"e35023ac3ec676439b32ada81588048b5a0cd2b2e47834c37b51a87435acc0a5","score":68,"complexity":"L","estimated_minutes":80,"split_recommended":true,"services":[],"authority":"ADVISORY","promotion":"FORBIDDEN"}
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "APPROVE" MODEL "openai/cursor-auto"
ASSERT VERDICT_AUTHORITY != "ADVISORY"