ticket-228: refresh stale internal dependencies in uv.lock

project/TICKETS.md

@@ -128,4 +128,5 @@ This file indexes governance tickets without taking ownership of
 | **ticket-216** | [`README.md`](./ticket-216/README.md) | - | - | - | - | - |
 | **ticket-217** | [`README.md`](./ticket-217/README.md) | - | - | - | - | - |
 | **ticket-218** | [`README.md`](./ticket-218/README.md) | - | - | - | - | - |
+| **ticket-220** | [`README.md`](./ticket-220/README.md) | - | - | - | - | - |
 <!-- AUTO:TICKET_INDEX:END -->

project/ticket-228/README.md

@@ -0,0 +1,39 @@
+# Ticket 228: Refresh stale internal dependencies in uv.lock (clickmd, costs, goal) and drop orphaned lock entries
+
+- **ID**: ticket-228
+- **Owner**: agent:antigravity (requested by the repository owner)
+- **Status**: IN_PROGRESS
+- **Workflow state**: EDIT
+- **Created**: 2026-10-19
+
+## Goal and scope
+
+`Internal dependency freshness` fails on `main` and on every pull request:
+`goal dependencies --catalog .github/internal-dependencies.json --check` reports `clickmd 1.1.15`,
+`costs 0.2.0` and `goal 2.2.0` as outdated. The check prints its own repair, `uv lock
+--upgrade-package clickmd==1.1.16 --upgrade-package costs==0.2.1 --upgrade-package goal==2.2.1`.
+Re-resolving also drops the stale `pfix` entry (the dependency was removed from `pyproject.toml`
+earlier) together with the packages only it required (ipython, pipreqs, bleach and similar).
+Only `uv.lock` changes.
+
+## Acceptance criteria
+
+- [x] AC-01: `goal dependencies --check` on the new lock reports `fresh: true`
+  (clickmd 1.1.16, costs 0.2.1, goal 2.2.1 current).
+- [x] AC-02: The locked CI recipe (`uv sync --locked --extra dev`, pytest) on the new lock: Python 3.13
+  1279 passed, 6 skipped, 1 failed (`test_release_availability`, fixed by ticket-227, unrelated
+  to the lock). Python 3.10 locally: the five `tests/test_serve_restart.py` cases time out
+  identically on the old lock (verified on a clean copy of `main`), so they are an environment
+  property here and not a regression; hosted `test (3.10)` passes on PR #271.
+- [x] AC-03: Governance gates pass.
+
+## Notes
+
+The digest of `uv.lock` is pinned by the protected local verifier in `subactor/onedev-agent`
+(`PLANFILE_DEPENDENCY_PIN_MISMATCH`). That pin is stale since the 0.1.127 release already and must
+be refreshed once, against the final `pyproject.toml` and `uv.lock` on `main`.
+
+## Tracking boundary
+
+This directory contains the minimal reviewed intent. Optional participant prose and raw command
+logs are not required delivery output.

project/ticket-228/intent.json

@@ -0,0 +1,89 @@
+{
+  "schema": "new-project.intent/v3",
+  "ticket": "ticket-228",
+  "summary": "Refresh stale internal dependencies in uv.lock (clickmd, costs, goal) and drop orphaned lock entries",
+  "workstream": "integration",
+  "classification": {
+    "kind": "SERVICE",
+    "priority": "P2",
+    "origin": "health"
+  },
+  "allowedPaths": [
+    "project/ticket-228/**",
+    "TODO.md",
+    "project/TICKETS.md",
+    "uv.lock"
+  ],
+  "forbiddenPaths": [
+    "project/ticket-*/user-*.md"
+  ],
+  "stacks": [
+    "python"
+  ],
+  "dependsOn": [],
+  "conflictsWith": [],
+  "integrationTicket": null,
+  "delivery": {
+    "acceptedBaseSha": "7354b47dcb60a8f040c1811d3ec9e981fe0c61f5",
+    "targetBranch": "main",
+    "outcome": "uv.lock pins the published stable targets of the internal dependencies (clickmd 1.1.16, costs 0.2.1, goal 2.2.1), so the scheduled and pull-request dependency-freshness check passes, and no longer carries entries for the removed pfix dependency and its transitive packages.",
+    "nonGoals": [
+      "Do not change pyproject.toml or any declared dependency range.",
+      "Do not change the protected local verifier pins; that control lives in another repository."
+    ],
+    "complexity": "S",
+    "estimatedMinutes": 30,
+    "budgets": {
+      "maxImplementationFiles": 2,
+      "maxAffectedComponents": 1,
+      "maxPublicInterfaceChanges": 0,
+      "maxRuntimeDependencies": 0
+    },
+    "architecture": {
+      "status": "accepted",
+      "decision": "Run the command reported by `goal dependencies --check` (`uv lock --upgrade-package ...`) and commit only the resulting uv.lock after the locked CI recipe passes.",
+      "components": [
+        {
+          "name": "dependency-lock",
+          "paths": [
+            "uv.lock"
+          ]
+        }
+      ],
+      "responsibilityChanges": false,
+      "interfaceChanges": [],
+      "dataChanges": [],
+      "ui": {
+        "impact": "none",
+        "states": [],
+        "evidence": []
+      },
+      "rollback": "Revert the ticket-228 commit; uv.lock returns to the previous resolution."
+    },
+    "runtimeDependencies": [],
+    "validation": [
+      {
+        "criterion": "AC-01",
+        "commands": [
+          "goal dependencies --catalog .github/internal-dependencies.json --check"
+        ],
+        "evidence": "project/ticket-228/README.md"
+      },
+      {
+        "criterion": "AC-02",
+        "commands": [
+          "uv sync --locked --extra dev --python 3.13",
+          "uv run --no-sync python -m pytest -q"
+        ],
+        "evidence": "project/ticket-228/README.md"
+      },
+      {
+        "criterion": "AC-03",
+        "commands": [
+          "./project/governance-check.sh"
+        ],
+        "evidence": "project/ticket-228/README.md"
+      }
+    ]
+  }
+}