From 462346f0ce20491a8d36b2d5fc2a6ef944c7172f Mon Sep 17 00:00:00 2001
From: Ramesh Padmanabhaiah <22363102+codeforester@users.noreply.github.com>
Date: Mon, 5 Oct 2026 21:35:46 +0530
Subject: [PATCH 1/3] ci: include uv lock freshness in full validation

---
 CHANGELOG.md           | 1 +
 tests/full_validate.sh | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9bb80c4..c29c333 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,6 +20,7 @@ and versions are tracked in the repo-root `VERSION` file.
 
 ### Changed
 
+- Include `uv.lock` freshness in the authoritative local validation aggregate (#424).
 - Bound convenience-profile discovery and validate implicit project configuration trust; cap YAML input size (#385).
 - Skip contended retention passes instead of blocking CLI invocations on housekeeping locks (#386).
 - Reuse secure log lock descriptors and cache source paths per invocation; logging I/O failures stay inside logging (#381).
diff --git a/tests/full_validate.sh b/tests/full_validate.sh
index 6138c9f..9dec3d8 100755
--- a/tests/full_validate.sh
+++ b/tests/full_validate.sh
@@ -25,7 +25,9 @@ require_commands() {
 }
 
 run_baseline() {
+  require_commands uv
   bash ./tests/validate.sh
+  uv lock --check
 }
 
 run_runtime() {

From 66c9e0f5bfd63c34542724b0a145f66e1453b0ed Mon Sep 17 00:00:00 2001
From: Ramesh Padmanabhaiah <22363102+codeforester@users.noreply.github.com>
Date: Mon, 5 Oct 2026 21:43:17 +0530
Subject: [PATCH 2/3] ci: set up uv for quality baseline

---
 .github/workflows/tests.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index f59e494..98f4b37 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -72,6 +72,10 @@ jobs:
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
+      - name: Set up uv
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+        with:
+          version: "0.12.8"
       - name: Install quality dependencies
         run: python -m pip install ".[dev,typer,quality]"
       - name: Validate repository baseline

From 972b635842b2fdc32428e372067bef8f84447eb2 Mon Sep 17 00:00:00 2001
From: Ramesh Padmanabhaiah <22363102+codeforester@users.noreply.github.com>
Date: Mon, 5 Oct 2026 23:13:23 +0530
Subject: [PATCH 3/3] docs: keep uv lock entry unreleased

---
 CHANGELOG.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c29c333..c3716ff 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,10 @@ and versions are tracked in the repo-root `VERSION` file.
 
 - Continue compatibility hardening and adoption work for the next release.
 
+### Changed
+
+- Include `uv.lock` freshness in the authoritative local validation aggregate (#424).
+
 ## [0.5.0] - 2026-10-03
 
 ### Added
@@ -20,7 +24,6 @@ and versions are tracked in the repo-root `VERSION` file.
 
 ### Changed
 
-- Include `uv.lock` freshness in the authoritative local validation aggregate (#424).
 - Bound convenience-profile discovery and validate implicit project configuration trust; cap YAML input size (#385).
 - Skip contended retention passes instead of blocking CLI invocations on housekeeping locks (#386).
 - Reuse secure log lock descriptors and cache source paths per invocation; logging I/O failures stay inside logging (#381).