fix(ticket-020): restore dependency freshness and public CI checkout

.github/workflows/test-locked.yml

@@ -31,15 +31,15 @@ jobs:
           repository: wellmanifest/docs
           ref: 0714f71462202788e6b775ed145e9e61a7d5c366 # merged docs checker 0.6.0
           path: .docs-standard
-          token: ${{ secrets.ORG_SYNC_PAT }}
+          token: ${{ github.token }}
           persist-credentials: false
       - name: Check out immutable governance standard for copy digests
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: wellmanifest/new-project
           ref: fa7972da8f6a28a0afe2914aacf46bee4a846943 # v0.20.54
           path: .new-project-standard
-          token: ${{ secrets.ORG_SYNC_PAT }}
+          token: ${{ github.token }}
           persist-credentials: false
       - name: Derive documentation copy inventory from pinned standard
         shell: bash

project/TICKETS.md

@@ -22,4 +22,6 @@ New identities are reserved exclusively by project/new-ticket.sh.
 | **ticket-016** | [`README.md`](./ticket-016/README.md) | - | - | - | - | - |
 | **ticket-017** | [`README.md`](./ticket-017/README.md) | - | - | - | - | - |
 | **ticket-018** | [`README.md`](./ticket-018/README.md) | - | - | - | - | - |
+| **ticket-019** | [`README.md`](./ticket-019/README.md) | - | - | - | - | - |
+| **ticket-020** | [`README.md`](./ticket-020/README.md) | - | - | - | - | - |
 <!-- AUTO:TICKET_INDEX:END -->

project/ticket-020/README.md

@@ -0,0 +1,23 @@
+# Ticket 020: Repair dependency freshness and public docs verification
+
+- **ID**: ticket-020
+- **Owner**: agent:codex
+- **Status**: IN_PROGRESS
+- **Workflow state**: PUBLICATION
+
+SESSION_EXECUTION_AUTHORIZATION: user requested continued backlog repair, tests and merges. Parent Planfile PLF-17346. Complete the dependency intent of existing PR27 through governed delivery.
+
+## Scope and acceptance
+
+- [x] AC-01: Published stable dependency lock targets are current; only uv.lock and the locked test workflow change materially.
+- [x] AC-02: Both immutable public standard checkouts work with contents-read github.token, while action/standard pins, credential persistence controls and every check remain intact.
+- [x] AC-03: Required Python3.10/3.13 tests, pinned docs verification and managed governance pass.
+- [ ] AC-04: Independent exact-head Validator and protected merge deliver this repair; reconcile PR27 only after coverage proof, preserving its unmerged branch.
+
+Native allocator owns the relative linked worktree and exact scoped lease. No human-owned files, algorithm, runtime installation or protected policy changes are included.
+
+Session bound: maxActiveMinutes=90, within the manifest120-minute ceiling.
+
+## Validation evidence
+
+Python3.10 and3.13 each:251passed,15skipped. Managed worktree governance:0errors,0warnings. Pinned docs0714f71 with managed-copy digests derived from pinned new-projectfa7972d:PASS. Dependency freshness:PASS. Operational receipts remain private; trusted review and merge are still pending.

project/ticket-020/intent.json

@@ -0,0 +1,84 @@
+{
+  "schema": "new-project.intent/v3",
+  "ticket": "ticket-020",
+  "summary": "Repair dependency freshness and public docs verification",
+  "workstream": "integration",
+  "classification": {
+    "kind": "BUG",
+    "priority": "P1",
+    "origin": "requested"
+  },
+  "allowedPaths": [
+    "project/ticket-020/**",
+    "TODO.md",
+    "project/TICKETS.md",
+    ".github/workflows/test-locked.yml",
+    "uv.lock"
+  ],
+  "forbiddenPaths": [
+    "project/ticket-*/user-*.md"
+  ],
+  "stacks": [],
+  "dependsOn": [],
+  "conflictsWith": [],
+  "integrationTicket": null,
+  "delivery": {
+    "acceptedBaseSha": "38613b21bf972e139a368516ce6eb1277941282a",
+    "targetBranch": "main",
+    "outcome": "Refresh published stable internal dependency targets from original PR27 and fix read-only public standard checkout without reducing native tests, governance or independent review.",
+    "nonGoals": [
+      "No scanner/Rust/API changes",
+      "No standards, pins, verification or permission widening",
+      "No direct author merge or unmerged bot-branch deletion"
+    ],
+    "complexity": "S",
+    "estimatedMinutes": 45,
+    "budgets": {
+      "maxImplementationFiles": 2,
+      "maxAffectedComponents": 2,
+      "maxPublicInterfaceChanges": 0,
+      "maxRuntimeDependencies": 0
+    },
+    "architecture": {
+      "status": "accepted",
+      "decision": "Retain declared dependency graph and update only published stable internal lock targets; built-in contents-read github.token checks out both immutable public standards with persist-credentials:false. Deliver on native ticket branch.",
+      "components": [
+        {
+          "name": "dependency-lock",
+          "paths": [
+            "uv.lock"
+          ]
+        },
+        {
+          "name": "locked-ci",
+          "paths": [
+            ".github/workflows/test-locked.yml"
+          ]
+        }
+      ],
+      "responsibilityChanges": false,
+      "interfaceChanges": [],
+      "dataChanges": [],
+      "ui": {
+        "impact": "none",
+        "states": [],
+        "evidence": []
+      },
+      "rollback": "Revert this bounded change through protected review; no runtime state migration."
+    },
+    "runtimeDependencies": [],
+    "validation": [
+      {
+        "criterion": "AC-01",
+        "commands": [
+          "goal dependencies --catalog .github/internal-dependencies.json --check",
+          "uv sync --locked --extra dev --python 3.10",
+          "uv sync --locked --extra dev --python 3.13",
+          "python -m pytest -q",
+          "./project/governance-check.sh"
+        ],
+        "evidence": "Private exact-head matrix, pinned docs and governance receipts; protected CI and Validator review."
+      }
+    ]
+  }
+}