[ticket-001] adopt published native governance 0.20.129

Author: tom-sapletta-com

.githooks/pre-commit

@@ -21,9 +21,11 @@ fi
 if [[ "$branch" =~ ^ticket[-/][0-9]{3,} ]]; then
   writer_runner="$root/.governance/change_lease_check.py"
   [[ -f "$writer_runner" ]] || writer_runner="$root/scripts/change_lease_check.py"
-  if [[ -f "$writer_runner" ]]; then
-    python3 -B "$writer_runner" writer-check --root "$root" --operation commit --ref "refs/heads/$branch"
+  if [[ ! -f "$writer_runner" ]]; then
+    echo "GOV-CHANGE-LEASE-001: writer-lease checker is missing; restore the managed installation." >&2
+    exit 1
   fi
+  python3 -B "$writer_runner" writer-check --root "$root" --operation commit --ref "refs/heads/$branch"
 fi
 
 run_worktree_guard() {

.githooks/pre-push

@@ -38,10 +38,11 @@ while read -r local_ref local_sha remote_ref remote_sha; do
     if [[ "$ref" =~ ^refs/heads/ticket[-/][0-9]{3,} ]]; then
       writer_runner="$root/.governance/change_lease_check.py"
       [[ -f "$writer_runner" ]] || writer_runner="$root/scripts/change_lease_check.py"
-      if [[ -f "$writer_runner" ]]; then
-        if ! python3 -B "$writer_runner" writer-check --root "$root" --operation push --ref "$ref"; then
-          refused=1
-        fi
+      if [[ ! -f "$writer_runner" ]]; then
+        echo "GOV-CHANGE-LEASE-001: writer-lease checker is missing; restore the managed installation." >&2
+        refused=1
+      elif ! python3 -B "$writer_runner" writer-check --root "$root" --operation push --ref "$ref"; then
+        refused=1
       fi
     fi
   done

.github/workflows/new-project-branch-hygiene.yml

@@ -1,16 +1,8 @@
 name: new-project-branch-hygiene
 
-# `delete_branch_on_merge` covers the merge exit. This workflow covers the
-# other one: a branch whose pull request was closed without merging. Nothing
-# in the toolchain removes those, and `GOV-BRANCH-LIFECYCLE-002` validates the
-# repository as a whole rather than the diff under review, so a single left
-# behind branch fails `governance / remote lifecycle` on *every* later pull
-# request, indefinitely and through no fault of its own.
-#
-# Closing a pull request without merging is the explicit owner decision to
-# discard the branch that the check's own remediation asks for, and GitHub
-# keeps the branch restorable from the pull request page afterwards.
-
+# GitHub's delete_branch_on_merge setting handles successfully merged branches.
+# Closing an unmerged pull request does not authorize discarding its work.
+# Explicit discard requires a separate owner decision and intent reconciliation.
 on:
   pull_request:
     types: [closed]
@@ -19,54 +11,17 @@ permissions:
   contents: read
 
 jobs:
-  discard-unmerged-head:
-    # Forks cannot be written to, and the default branch is never a head to
-    # discard. Both guards are cheap and keep the job from ever running where
-    # deleting would be wrong.
-    if: >-
-      github.event.pull_request.merged == false &&
-      github.event.pull_request.head.repo.full_name == github.repository &&
-      github.event.pull_request.head.ref != github.event.repository.default_branch
+  preserve-unmerged-head:
+    if: github.event.pull_request.merged == false
     runs-on: ${{ vars.NEW_PROJECT_RUNNER_LABEL || 'ubuntu-latest' }}
-    permissions:
-      contents: write
     steps:
-      - name: Delete the closed pull request's head branch
+      - name: Report preserved pull request branch
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const ref = context.payload.pull_request.head.ref;
-
-            // Several pull requests may share one head branch. Deleting it
-            // while another is still open would break that one instead.
-            const owners = await github.paginate(github.rest.pulls.list, {
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              state: 'open',
-              head: `${context.repo.owner}:${ref}`,
-              per_page: 100,
-            });
-            if (owners.length > 0) {
-              const numbers = owners.map(pull => `#${pull.number}`).join(', ');
-              core.info(`Kept ${ref}: still owned by ${numbers}.`);
-              return;
-            }
-
-            try {
-              await github.rest.git.deleteRef({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                ref: `heads/${ref}`,
-              });
-              core.info(
-                `Deleted ${ref}. GitHub keeps it restorable from the pull request page.`,
-              );
-            } catch (error) {
-              // The branch is commonly gone already, because the person
-              // closing the pull request ticked "delete branch".
-              if (error.status === 404 || error.status === 422) {
-                core.info(`${ref} was already deleted.`);
-                return;
-              }
-              throw error;
-            }
+            core.notice(
+              `Preserved ${JSON.stringify(ref)}. Closing a pull request does not ` +
+              'authorize branch deletion. Reconcile remaining intent and obtain ' +
+              'an explicit owner discard decision before a separate deletion.',
+            );

.github/workflows/new-project-governance.yml

@@ -176,8 +176,41 @@ jobs:
           runtime_venv="$(mktemp -d "${RUNNER_TEMP:-${TMPDIR:-/tmp}}/wellman-governance.XXXXXX")"
           python3 -I -m venv "$runtime_venv"
           "$runtime_venv/bin/python" -I -m pip install --disable-pip-version-check "git+https://github.com/wellmanifest/new-project.git@${runtime_ref}#subdirectory=packages/wellman"
+          # Accept only a recognized console entrypoint from this isolated runtime.
+          runtime_command="$("$runtime_venv/bin/python" -I - <<'PY_RUNTIME_COMMAND'
+          import os
+          import sys
+          from importlib.metadata import distributions
+          from pathlib import Path
+
+          if sys.prefix == sys.base_prefix:
+              raise SystemExit("Governance runtime requires its isolated environment")
+          found = []
+          for name, command, module in (
+              ("wellmanifest-governance", "wellman-governance", "wellmanifest_governance_runtime"),
+              ("wellman", "wellman", "wellman"),
+          ):
+              matches = list(distributions(name=name))
+              if not matches:
+                  continue
+              if len(matches) != 1:
+                  raise SystemExit("Ambiguous governance runtime distribution: " + name)
+              installed = matches[0]
+              entries = [entry.value for entry in installed.entry_points
+                         if entry.group == "console_scripts" and entry.name == command]
+              launcher = Path(sys.executable).parent / command
+              if (entries != [module + ".check:main"]
+                      or not Path(installed.locate_file("")).resolve().is_relative_to(Path(sys.prefix).resolve())
+                      or launcher.is_symlink() or not launcher.is_file() or not os.access(launcher, os.X_OK)):
+                  raise SystemExit("Unsupported governance runtime identity: " + name)
+              found.append(command)
+          if len(found) != 1:
+              raise SystemExit("Expected exactly one supported governance runtime")
+          print(found[0])
+          PY_RUNTIME_COMMAND
+          )"
+          "$runtime_venv/bin/$runtime_command" --version
           printf '%s\n' "$runtime_venv/bin" >> "$GITHUB_PATH"
-          "$runtime_venv/bin/wellman" --version
       - name: Run the managed governance gate
         shell: bash
         env:

.gitignore

@@ -5,6 +5,7 @@ __pycache__/
 dist/
 build/
 .pytest_cache/
+/.venv/
 
 # Repository-local worktrees and operational state
 /.worktrees/

.governance/AGENT_DECISIONS.md

@@ -48,6 +48,15 @@ both HEADs is inherited context. Two actual dirty writers remain contested;
 unresolved ancestry retains conservative checking. Intent ownership remains a
 separate check even when Git can merge file contents.
 
+For a non-primary detached checkout with no commits ahead of the observed
+target, a staged path already identical to that target is not an outstanding
+contribution. The query verifies exact target blob and mode, stage-zero index
+entry, and raw filesystem blob and mode. Different or unknown evidence remains
+pending. Named branches and active intent retain their reservations. All dirty
+paths remain visible, and the observation digest binds index entries as well
+as filesystem content. This does not classify the checkout as disposable or
+authorize its cleanup, lease transfer, source writes or publication.
+
 `wellmanifest/git-lifecycle` still owns cleanup effects; `ticket-lifecycle`
 owns reservations, and protected merge/publication controllers own external
 effects. Fix an incorrect checker at its HOME with a failing regression and

.governance/agent_host_check.py

@@ -342,7 +342,8 @@ def python_declaration(marker: Path) -> tuple[dict[str, Any] | None, dict[str, A
         document = tomllib.loads(marker.read_text(encoding="utf-8"))
     except (OSError, tomllib.TOMLDecodeError):
         return None, {}
-    declaration = document.get("tool", {}).get("wellmanifest")
+    tool = document.get("tool")
+    declaration = tool.get("wellmanifest") if isinstance(tool, dict) else None
     return (declaration if isinstance(declaration, dict) else None), document
 
 
@@ -362,7 +363,9 @@ def lifecycle_value(kind: str, document: dict[str, Any]) -> str:
         scripts = document.get("scripts")
         value = scripts.get("prepare") if isinstance(scripts, dict) else None
     else:
-        options = document.get("tool", {}).get("pytest", {}).get("ini_options", {})
+        tool = document.get("tool")
+        pytest = tool.get("pytest") if isinstance(tool, dict) else None
+        options = pytest.get("ini_options") if isinstance(pytest, dict) else None
         value = options.get("addopts") if isinstance(options, dict) else None
     if isinstance(value, list):
         return " ".join(str(item) for item in value)

.governance/change_lease_check.py

@@ -24,6 +24,10 @@
 PHASES = {"claimed", "editing", "validating", "publication_frozen", "dispatching", "approved", "merged", "closed", "cancelled", "expired", "released"}
 FROZEN_PHASES = {"publication_frozen", "dispatching", "approved"}
 TERMINAL_REPLACEMENT_PHASES = {"merged", "closed", "cancelled", "released"}
+# wellmanifest/worktrees v5 layout: the single source for every lease and worktree reader.
+WORKTREES_ROOT = ".worktrees"
+LEASE_ROOT = ".subactor/leases"
+MAX_LEASE_BYTES = 65536
 TRANSITIONS = {
     "heartbeat": {phase: phase for phase in PHASES - {"released"}},
     "begin-edit": {"claimed": "editing"},
@@ -358,7 +362,7 @@ def read_writer_lease(path: Path) -> dict[str, Any]:
         if not path.is_file():
             raise ValueError("Lease must be a regular file")
         raw = path.read_bytes()
-        if len(raw) > 65536:
+        if len(raw) > MAX_LEASE_BYTES:
             raise ValueError("Lease exceeds bounded size")
         value = json.loads(raw.decode("utf-8"))
         if not isinstance(value, dict):
@@ -375,8 +379,8 @@ def read_writer_lease(path: Path) -> dict[str, Any]:
         with os.fdopen(leaf, "rb") as stream:
             if not stat.S_ISREG(os.fstat(stream.fileno()).st_mode):
                 raise ValueError("Lease must be a regular file")
-            raw = stream.read(65537)
-            if len(raw) > 65536:
+            raw = stream.read(MAX_LEASE_BYTES + 1)
+            if len(raw) > MAX_LEASE_BYTES:
                 raise ValueError("Lease exceeds bounded size")
             value = json.loads(raw)
             if not isinstance(value, dict):
@@ -418,7 +422,7 @@ def git(*args: str) -> str:
         ticket = "ticket-" + match[1]
         slug = ref.split(match[1] + "-", 1)[1]
         worktree_id = ticket + "--" + slug
-        expected = primary / ".worktrees" / worktree_id
+        expected = primary / WORKTREES_ROOT / worktree_id
         owner_worktree = Path(owners[0]["worktree"])
         if os.name == "nt":
             if owner_worktree.resolve() != expected.resolve() or expected.is_symlink():
@@ -430,7 +434,7 @@ def git(*args: str) -> str:
                 raise ValueError("Ticket worktree is not canonical")
             if operation == "commit" and root.resolve() != expected:
                 raise ValueError("Commit must run in the owned worktree")
-        lease = read_writer_lease(primary / ".subactor/leases" / (worktree_id + ".json"))
+        lease = read_writer_lease(primary / LEASE_ROOT / (worktree_id + ".json"))
         errors = validate_lease(lease)
         if errors:
             return errors

.governance/decision_record.py

@@ -59,7 +59,8 @@ def classify_action(action: str) -> dict[str, Any]:
 )
 REJECTED_LINE = re.compile(r"^REJECTED\s+(\S+)\s+BECAUSE\s+(.+)$")
 ADVISORY_LINE = re.compile(
-    r'^ADVISORY\s+llm_verdict\s*=\s*"([^"]*)"\s+MODEL\s+"([^"]*)"\s*$'
+    r'^ADVISORY\s+llm_verdict\s*=\s*("(?:[^"\\]|\\.)*")\s+'
+    r'MODEL\s+("(?:[^"\\]|\\.)*")\s*$'
 )
 ASSERT_LINE = re.compile(r"^ASSERT\s+(.+)$")
 
@@ -126,10 +127,14 @@ def apply_decision_line(record: dict[str, Any], line: str) -> bool:
         return True
     match = ADVISORY_LINE.match(line)
     if match:
-        record["advisory"] = {
-            "llmVerdict": match.group(1),
-            "model": match.group(2),
-        }
+        try:
+            advisory = {
+                "llmVerdict": json.loads(match.group(1)),
+                "model": json.loads(match.group(2)),
+            }
+        except json.JSONDecodeError:
+            return False
+        record["advisory"] = advisory
         return True
     match = ASSERT_LINE.match(line)
     if match:
@@ -199,8 +204,8 @@ def to_dsl(record: dict[str, Any]) -> str:
     adv = record.get("advisory")
     if adv:
         lines.append(
-            f'ADVISORY llm_verdict = "{adv.get("llmVerdict", "")}" '
-            f'MODEL "{adv.get("model", "")}"'
+            f'ADVISORY llm_verdict = {format_value(adv.get("llmVerdict", ""))} '
+            f'MODEL {format_value(adv.get("model", ""))}'
         )
     for assertion in record.get("assertions") or []:
         lines.append(f"ASSERT {assertion}")
@@ -313,21 +318,24 @@ def validate_record(record: dict[str, Any]) -> list[str]:
 
 
 def split_decision_blocks(markdown: str) -> list[str]:
-    """Extract fenced ```dsl DECISION ... blocks or bare DECISION sequences."""
+    """Extract bare and fenced DSL decisions once, in document order."""
+    def decisions(text: str) -> list[str]:
+        parts = re.split(r"(?=^DECISION\s+D-)", text.strip(), flags=re.MULTILINE)
+        return [part.strip() for part in parts if part.strip().startswith("DECISION ")]
+
     blocks: list[str] = []
-    fence = re.findall(r"```dsl\n(.*?)```", markdown, flags=re.DOTALL)
-    for body in fence:
-        if "DECISION " in body:
-            # may contain multiple DECISION records
-            parts = re.split(r"(?=^DECISION\s+D-)", body.strip(), flags=re.MULTILINE)
-            for part in parts:
-                part = part.strip()
-                if part.startswith("DECISION "):
-                    blocks.append(part)
-    if blocks:
-        return blocks
-    parts = re.split(r"(?=^DECISION\s+D-)", markdown.strip(), flags=re.MULTILINE)
-    return [p.strip() for p in parts if p.strip().startswith("DECISION ")]
+    cursor = 0
+    fences = re.finditer(
+        r"^[ \t]{0,3}```([^\n]*)\n(.*?)^[ \t]{0,3}```[ \t]*(?:\n|$)",
+        markdown, flags=re.MULTILINE | re.DOTALL,
+    )
+    for fence in fences:
+        blocks.extend(decisions(markdown[cursor:fence.start()]))
+        if fence.group(1).strip() == "dsl":
+            blocks.extend(decisions(fence.group(2)))
+        cursor = fence.end()
+    blocks.extend(decisions(markdown[cursor:]))
+    return blocks
 
 
 def check_append_only(previous_markdown: str, current_markdown: str) -> list[str]:

.governance/diagnostics.json

@@ -106,6 +106,16 @@
       "remediation": "Reduce the slice or obtain fresh authorization for a larger bounded intent.",
       "documentation": null
     },
+    "GOV-IDLE-TAKEOVER-001": {
+      "message": "Idle takeover was refused: the ticket is active, frozen, integrated, noncanonical, disabled by policy or its lease changed concurrently.",
+      "remediation": "Read the reported state on .subactor/cache/autonomy-board.md; continue only an IDLE_TAKEOVER_ELIGIBLE ticket, otherwise assist, reconcile or request an accepted handoff.",
+      "documentation": "error/GOV-IDLE-TAKEOVER.md"
+    },
+    "GOV-IDLE-TAKEOVER-002": {
+      "message": "Idle takeover could not observe the repository or write its snapshot, receipt, lease or board.",
+      "remediation": "Preserve the worktree, fix the reported read or write failure and re-run observe before any takeover.",
+      "documentation": "error/GOV-IDLE-TAKEOVER.md"
+    },
     "GOV-CHANGE-LEASE-001": {
       "message": "A change lease, transition request or receipt is malformed or not closed.",
       "remediation": "Rebuild the document from the managed change-lease schema without undeclared fields.",