ticket-227: sync release metadata with 0.1.127

planfile/release-metadata.json

@@ -1,8 +1,8 @@
 {
   "schema": "planfile.release-metadata/v1",
   "package": "planfile",
-  "source": {"version": "0.1.126", "build_mode": "local-source", "reason": "The protected image installs checked-out source from the locked repository."},
-  "runtime": {"version": "0.1.126", "source": "Dockerfile local-source build", "python_requires": ">=3.10"},
-  "published": {"index": "https://pypi.org/pypi/planfile/json", "version": "0.1.126", "python_requires": ">=3.10"},
+  "source": {"version": "0.1.127", "build_mode": "local-source", "reason": "The protected image installs checked-out source from the locked repository."},
+  "runtime": {"version": "0.1.127", "source": "Dockerfile local-source build", "python_requires": ">=3.10"},
+  "published": {"index": "https://pypi.org/pypi/planfile/json", "version": "0.1.127", "python_requires": ">=3.10"},
   "release": {"owner": "planfile maintainers", "sequence": ["publish for every declared Python target", "verify published metadata and lockfile", "update runtime pins or source metadata", "run the supported matrix before protected publication"]}
 }

project/TICKETS.md

@@ -128,4 +128,5 @@ This file indexes governance tickets without taking ownership of
 | **ticket-216** | [`README.md`](./ticket-216/README.md) | - | - | - | - | - |
 | **ticket-217** | [`README.md`](./ticket-217/README.md) | - | - | - | - | - |
 | **ticket-218** | [`README.md`](./ticket-218/README.md) | - | - | - | - | - |
+| **ticket-220** | [`README.md`](./ticket-220/README.md) | - | - | - | - | - |
 <!-- AUTO:TICKET_INDEX:END -->

project/ticket-227/README.md

@@ -0,0 +1,35 @@
+# Ticket 227: Sync release metadata with the 0.1.127 release and stop hardcoding the version in its test
+
+- **ID**: ticket-227
+- **Owner**: agent:antigravity (requested by the repository owner)
+- **Status**: IN_PROGRESS
+- **Workflow state**: EDIT
+- **Created**: 2026-10-19
+
+## Goal and scope
+
+The ticket-220 release moved `pyproject.toml` and `uv.lock` to 0.1.127 but left
+`planfile/release-metadata.json` at 0.1.126, so `tests/test_release_availability.py::
+test_release_metadata_matches_published_offline_snapshot` fails on `main` and on every pull
+request. PyPI already serves 0.1.127 with `requires_python >=3.10`, so the metadata is brought to
+that observed state. The test also repeated the release number as a literal; it now reads it from
+`pyproject.toml`, so the next bump cannot break it again.
+
+## Acceptance criteria
+
+- [x] AC-01: `release-metadata.json` source, runtime and published versions equal the version in
+  `pyproject.toml` (0.1.127); `check(root, offline=True)` is `ok`.
+- [x] AC-02: The test derives the expected version from `pyproject.toml` (no literal).
+- [x] AC-03: `tests/test_release_availability.py` passes (2 passed).
+- [x] AC-04: Governance gates pass; full suite 1280 passed, 6 skipped.
+
+## Not in scope
+
+`onedev/local-verify` fails with `PLANFILE_DEPENDENCY_PIN_MISMATCH` because the protected
+`subactor/onedev-agent` check pins the digests of `pyproject.toml` and `uv.lock` from 2026-09-19.
+That control lives in another repository and is not changed here.
+
+## Tracking boundary
+
+This directory contains the minimal reviewed intent. Optional participant prose and raw command
+logs are not required delivery output.

project/ticket-227/intent.json

@@ -0,0 +1,25 @@
+{
+  "schema": "new-project.intent/v3",
+  "ticket": "ticket-227",
+  "summary": "Sync release metadata with the 0.1.127 release and stop hardcoding the version in its test",
+  "workstream": "application",
+  "classification": {
+    "kind": "BUG",
+    "priority": "P1",
+    "origin": "health"
+  },
+  "allowedPaths": [
+    "project/ticket-227/**",
+    "TODO.md",
+    "project/TICKETS.md",
+    "planfile/release-metadata.json",
+    "tests/test_release_availability.py"
+  ],
+  "forbiddenPaths": [
+    "project/ticket-*/user-*.md"
+  ],
+  "stacks": [],
+  "dependsOn": [],
+  "conflictsWith": [],
+  "integrationTicket": null
+}

tests/test_release_availability.py

@@ -4,16 +4,24 @@
 import json
 from pathlib import Path
 
+try:
+    import tomllib
+except ModuleNotFoundError:  # Python 3.10 uses the locked tomli dependency.
+    import tomli as tomllib
+
 SPEC = importlib.util.spec_from_file_location("release_availability", Path(__file__).parents[1] / "planfile/release_availability.py")
 CHECKER = importlib.util.module_from_spec(SPEC)
 assert SPEC.loader is not None
 SPEC.loader.exec_module(CHECKER)
 
 
 def test_release_metadata_matches_published_offline_snapshot():
-    result = CHECKER.check(Path(__file__).parents[1], offline=True)
-    assert result["ok"] is True
-    assert result["source_version"] == "0.1.126"
+    root = Path(__file__).parents[1]
+    result = CHECKER.check(root, offline=True)
+    assert result["ok"] is True, result["errors"]
+    # The release number belongs to pyproject.toml; a test that repeats it breaks on every bump.
+    declared = tomllib.loads((root / "pyproject.toml").read_text())["project"]["version"]
+    assert result["source_version"] == declared
 
 
 def test_newer_source_version_is_rejected(tmp_path):