feat(ticket-065): orchestrate local OneDev and Validator publication

[tom-sapletta-com]

Ticket: ticket-065
Correlation ID: koru-pr-ticket-065-local-publication

Material scope: local publication orchestration and operator documentation.

Draft safety hold:

• ticket intent and required governance scaffold are incomplete;
• current --dry-run still invokes OneDev and is therefore not mutation-free;
• coordinator/executor one-shot calls are not yet proven exact-target-only;
• no Validator dispatch or merge is authorized until these findings and the current-main rebase are resolved.

This Draft binds the already-pushed branch to its owner so branch-lifecycle observation is no longer orphaned; it does not attest readiness.

[ifuri-validator-agent]

Deterministic Validator approval for exact head fa98f3f83cb19a6baeff4084029e95235a26de61.

Ticket: ticket-065
Correlation ID: koru-pr-101-ticket-065
Model: zai/glm-5.3
Reviewed diff chunks: 3
Advisory LLM verdict: REQUEST_CHANGES
Advisory summary: Reviewed all 3 diff chunk(s). Chunk 1 of 3 adds the ticket-065 governance scaffold, a bilingual publication doc, and the start of a local publication shell script. The manifest, intent., and ticket files are internally consistent (allowedPaths cover changed files; acceptedBaseSha pinned). The main script body is in later chunks, so runtime security of the script cannot be fully assessed here. No test failures in test_results_data. | All visible checks pass, but the PR body itself declares a draft safety hold: intent/governance scaffold incomplete, --dry-run is not mutation-free (it still publishes statuses? actually skipped, but still invokes OneDev), and coordinator/executor one-shot exact-target behavior is unproven. The publication script also contains fragile TOML generation via string interpolation into an unquoted Python heredoc. | This chunk adds a publish orchestration script tail (status posting, local profile tests, onedev/local-verify gate, validator-agent dispatch). All visible checks pass, and the PR itself is a draft with an explicit safety hold. However, the dry-run path is not mutation-free: it posts a success commit status to the frozen head and exports GITHUB_TOKEN, contradicting the dry-run contract; and in non-dry-run mode a non-success onedev/local-verify still falls through (the die is skipped only in dry run, but the fallback echo uses 'success' when state is empty, and DRY_RUN=true bypasses gating entirely while mutations have already occurred earlier in the script).
Advisory findings: PR body explicitly declares a draft safety hold: ticket intent and governance scaffold incomplete, --dry-run not mutation-free (it invokes OneDev), and coordinator/executor one-shot calls not proven exact-target-only. These must be resolved before approval.; PR body explicitly states no Validator dispatch or merge is authorized until draft safety hold findings and current-main rebase are resolved; approving would contradict the author's own attestation.; write_local_onedev_config interpolates WORK_ROOT, REPO_SLUG, and config-derived strings directly into an unquoted python3 heredoc via f-strings; paths or repo values containing quotes/backslashes/newlines could inject Python code or produce malformed TOML. Use a proper TOML writer or pass values via argv/env.; Generated TOML omits pull_request_verification.repositories entries other than the matched profile and hardcodes several defaults; any repository.toml field not explicitly copied (e.g. new service keys, include_drafts=false vs absent) silently diverges from production config semantics.; TOML string escaping function q() only handles backslash and double-quote; control characters (tabs, newlines) in test_commands or dependency paths would produce invalid TOML.; run_local_onedev_profile_tests references $WT and $FROZEN_HEAD before they are visibly set in this chunk's control flow (set later in main body); if invocation order differs the subshell fails with unset-variable under set -u.; Dry run performs mutations: it posts a 'success' commit status (standard packs / conformance) to the frozen head before the DRY_RUN check, so --dry-run is not read-only, contradicting the PR's own stated intent.; commit_status_context_state fallback: 'echo "onedev/local-verify=${ONEDEV_STATE:-success}"' masks an empty state as success in logging, and the gate allows empty state to pass implicitly only via the die ordering; empty non-dry-run state where the API call failed silently (|| true) is treated as pass.; Token handling: GITHUB_TOKEN is read from environment and exported inside the script with a redacted line; ensure the token is never echoed or leaked in logs (redaction present here, but export broadens exposure to all child processes including dispatch).; Local TOML config embeds absolute paths to token/password/secret files (github_token_file, git_askpass_file, onedev_password_file, bootstrap validation secrets) into a file under ~/.cache; WORK_ROOT is removed on exit but ensure permissions (umask/mkdir mode 700) prevent transient exposure.
The LLM output above is advisory and was not used as the approval trust root.

Actual PR impact radar

Exact range: d94f17963d74fd4b587c60cca756fada88a58e3c...fa98f3f83cb19a6baeff4084029e95235a26de61
Change digest: dc8c568f68b1ff198ec062eb04f4e9f90b38b779d28bcde10041da7075422aa4
Score: 64/100 (L), estimated 82 min, split recommended: true
Affected services/components: repository-wide/unclassified

Machine-readable radar JSONL and SVG

{"actual_change":{"additions":578,"base_sha":"d94f17963d74fd4b587c60cca756fada88a58e3c","binary_files":0,"categories":{"code":2,"configuration":2,"docs":6},"change_digest":"dc8c568f68b1ff198ec062eb04f4e9f90b38b779d28bcde10041da7075422aa4","comparison":"d94f17963d74fd4b587c60cca756fada88a58e3c...fa98f3f83cb19a6baeff4084029e95235a26de61","deletions":1,"file_count":10,"files":["governance/manifest.json","docs/publication-local-onedev-validator.md","project/TICKETS.md","project/ticket-065/README.md","project/ticket-065/ai-codex-logs.txt","project/ticket-065/ai-codex.md","project/ticket-065/changelog.md","project/ticket-065/intent.json","project/ticket-065/preprompt.md","scripts/publish-local-onedev-validator.sh"],"head_sha":"fa98f3f83cb19a6baeff4084029e95235a26de61","service_count":0,"services":[]},"assessment_mode":"observed-pr","axes":{"coupling":5,"delivery":2,"scope":5,"uncertainty":3,"validation":1},"complexity":"L","confidence":0.9,"diagnostics":["RADAR-ACCEPTANCE-MISSING","RADAR-BUDGET-EXCEEDED"],"estimate":{"budget_minutes":30,"minutes":82,"within_budget":false},"impact":{"components":["coordinator","docs","governance","project","scripts"],"files":["coordinator/executor","docs/publication-local-onedev-validator.md","governance/manifest.json","project/TICKETS.md","project/ticket-065/README.md","project/ticket-065/ai-codex-logs.txt","project/ticket-065/ai-codex.md","project/ticket-065/changelog.md","project/ticket-065/intent.json","project/ticket-065/preprompt.md","scripts/publish-local-onedev-validator.sh"],"public_interfaces":[],"runtime_dependencies":0},"schema":"subactor.ticket-radar/v1","score":64,"split":{"parts":[{"estimated_minutes":15,"name":"Implement coordinator","scope":["coordinator"]},{"estimated_minutes":15,"name":"Implement docs","scope":["docs"]},{"estimated_minutes":15,"name":"Implement governance","scope":["governance"]},{"estimated_minutes":15,"name":"Implement project","scope":["project"]},{"estimated_minutes":15,"name":"Implement scripts","scope":["scripts"]},{"estimated_minutes":15,"name":"Validate and project to trackers","scope":["tests","planfile","github/gitlab/jira projections"]}],"reason":"estimated_minutes_exceed_budget","recommended":true},"standards":[{"id":"wellmanifest/dsl","revision":"6c60fc4e0dd1f1bb74f46a7745e28019908d1203","version":"0.1.0-dev"},{"id":"wellmanifest/ticket-lifecycle","revision":"5bf581907a87b46a13a73e6c033d3abe4d9a306f","version":"0.1.0-dev"},{"id":"wellmanifest/git-lifecycle","revision":"7d77d4b7af57e69bc75c3a0290b3a4805c5c4438","version":"0.2.0-dev"},{"id":"wellmanifest/logs","revision":"48c284ef7a069055c0bcb6b900147ce5e65f8b43","version":"0.3.0"}],"ticket_ref":"ticket-065"}

<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" viewBox="0 0 128 128" role="img"><title>ticket-065: feat(ticket-065): orchestrate local OneDev and Validator publication</title><rect width="128" height="128" rx="12" fill="#f8fafc"/><g stroke-width="1"><polygon points="64,55 72,61 69,71 59,71 56,61" fill="none" stroke="#d7dde5"/><polygon points="64,47 80,59 74,78 54,78 48,59" fill="none" stroke="#d7dde5"/><polygon points="64,38 89,56 79,85 49,85 39,56" fill="none" stroke="#d7dde5"/><polygon points="64,30 97,53 84,92 44,92 31,53" fill="none" stroke="#d7dde5"/><polygon points="64,21 105,51 89,99 39,99 23,51" fill="none" stroke="#d7dde5"/><line x1="64" y1="64" x2="64" y2="21" stroke="#aab4c0"/><line x1="64" y1="64" x2="105" y2="51" stroke="#aab4c0"/><line x1="64" y1="64" x2="89" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="39" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="23" y2="51" stroke="#aab4c0"/></g><polygon points="64,21 105,51 79,85 59,71 48,59" fill="#fb923c" fill-opacity="0.45" stroke="#c2410c" stroke-width="2"/><circle cx="64" cy="64" r="3" fill="#c2410c"/><g font-family="sans-serif" font-size="7" fill="#334155"><text x="64" y="11" text-anchor="middle">SCO</text><text x="114" y="48" text-anchor="middle">COU</text><text x="95" y="107" text-anchor="middle">UNC</text><text x="33" y="107" text-anchor="middle">VAL</text><text x="14" y="48" text-anchor="middle">DEL</text></g><text x="64" y="124" text-anchor="middle" font-family="sans-serif" font-size="8" fill="#0f172a">L · 82m</text></svg>

Merge will be attempted after this approval when explicitly authorized. ## Decision record (recomputable)

DECISION D-065-5964
TICKET ticket-065
HEAD_SHA fa98f3f83cb19a6baeff4084029e95235a26de61
CORRELATION_ID koru-pr-101-ticket-065
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT author_login = "tom-sapletta-com"
INPUT observed_checks = ["standard packs / conformance=PASS","governance / remote lifecycle=PASS","governance / enforce=PASS","standard packs / conformance=PASS","onedev/local-verify=PASS"]
INPUT required_checks = ["onedev/local-verify","standard packs / conformance"]
INPUT required_checks_source = "protected registry + GitHub applied rules (env/request)"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
INPUT superseded_checks = ["smoke"]
INPUT ticket_radar_receipt = {"schema":"subactor.ticket-radar/v1","base_sha":"d94f17963d74fd4b587c60cca756fada88a58e3c","head_sha":"fa98f3f83cb19a6baeff4084029e95235a26de61","change_digest":"dc8c568f68b1ff198ec062eb04f4e9f90b38b779d28bcde10041da7075422aa4","score":64,"complexity":"L","estimated_minutes":82,"split_recommended":true,"services":[],"authority":"ADVISORY","promotion":"FORBIDDEN"}
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "REQUEST_CHANGES" MODEL "zai/glm-5.3"
ASSERT VERDICT_AUTHORITY != "ADVISORY"

[ifuri-validator-agent]

Deterministic Validator approval for exact head 919972aa711f67a2060d8190ff42ba4f7b00a795.

Ticket: ticket-065
Correlation ID: koru-pr-101-ticket-065
Model: zai/glm-5.3
Reviewed diff chunks: 3
Advisory LLM verdict: REQUEST_CHANGES
Advisory summary: Reviewed all 3 diff chunk(s). Governance scaffold, docs, and ticket metadata for ticket-065 are coherent and manifest ownership is updated, but the PR body itself records unresolved draft safety holds (incomplete intent, non-mutation-free --dry-run, unproven exact-target-only coordinator calls) that contradict the README's checked acceptance criteria and authorization of dispatch/merge. | Chunk 2 adds the core of scripts/publish-local-onedev-validator.sh: argument parsing with validation, worktree/cleanup handling, commit-status polling, local OneDev config generation, and local profile test execution. All listed test results pass. However, the PR body itself declares a draft safety hold (intent incomplete, --dry-run not mutation-free, one-shot calls not proven exact-target-only, no merge authorized), so this cannot be approved on this chunk's evidence alone. | All visible checks pass, but the PR body itself declares a draft safety hold: ticket intent/governance scaffold incomplete, --dry-run is not mutation-free (still invokes OneDev), coordinator/executor one-shot calls are not proven exact-target-only, and a current-main rebase is outstanding. The publish script dispatches validator-agent with optional --merge, which must not be authorized until these are resolved.
Advisory findings: PR body explicitly states 'no Validator dispatch or merge is authorized' until draft safety holds are resolved, yet the script documents a --merge path and AC-02 is marked complete; authorization and implementation state conflict.; README marks AC-01 and AC-02 as checked while PR body says intent and governance scaffold are incomplete — acceptance evidence is inconsistent.; Script body (argument parsing onward) is not assessable in this chunk; bash -n and dry-run validation claims in intent. cannot be verified from visible content.; PR body explicitly withholds authorization: '--dry-run still invokes OneDev and is therefore not mutation-free' and 'no Validator dispatch or merge is authorized until these findings and the current-main rebase are resolved'. The script's DRY_RUN flag only skips status publishes, not the OneDev/pip-install side effects, confirming the stated defect.; FROZEN_HEAD is fetched from the GitHub API and interpolated directly into gh api paths without validating it matches a SHA format (e.g. ^[0-9a-f]{40}$); defensive validation is missing before use in 'repos/.../statuses/${FROZEN_HEAD}'.; PR body explicitly withholds authorization for Validator dispatch and merge until draft findings are resolved.; --dry-run is documented as not mutation-free (still invokes OneDev), violating dry-run safety expectations.; Ticket intent and required governance scaffold are incomplete per the PR body.; Script exports GITHUB_TOKEN from environment and calls gh api to set commit statuses; token handling appears environment-scoped with a redacted line, but exact-target-only behavior of coordinator/executor calls is unproven per PR body — verify before enabling dispatch.
The LLM output above is advisory and was not used as the approval trust root.

Actual PR impact radar

Exact range: 0008ea9d221865f588626720f46937f5de5c6659...919972aa711f67a2060d8190ff42ba4f7b00a795
Change digest: 491b8de3d1eb51320894b2aba562e7d7cceaad10c5c54c794e292b2b579ecc06
Score: 64/100 (L), estimated 82 min, split recommended: true
Affected services/components: repository-wide/unclassified

Machine-readable radar JSONL and SVG

{"actual_change":{"additions":578,"base_sha":"0008ea9d221865f588626720f46937f5de5c6659","binary_files":0,"categories":{"code":2,"configuration":2,"docs":6},"change_digest":"491b8de3d1eb51320894b2aba562e7d7cceaad10c5c54c794e292b2b579ecc06","comparison":"0008ea9d221865f588626720f46937f5de5c6659...919972aa711f67a2060d8190ff42ba4f7b00a795","deletions":1,"file_count":10,"files":["governance/manifest.json","docs/publication-local-onedev-validator.md","project/TICKETS.md","project/ticket-065/README.md","project/ticket-065/ai-codex-logs.txt","project/ticket-065/ai-codex.md","project/ticket-065/changelog.md","project/ticket-065/intent.json","project/ticket-065/preprompt.md","scripts/publish-local-onedev-validator.sh"],"head_sha":"919972aa711f67a2060d8190ff42ba4f7b00a795","service_count":0,"services":[]},"assessment_mode":"observed-pr","axes":{"coupling":5,"delivery":2,"scope":5,"uncertainty":3,"validation":1},"complexity":"L","confidence":0.9,"diagnostics":["RADAR-ACCEPTANCE-MISSING","RADAR-BUDGET-EXCEEDED"],"estimate":{"budget_minutes":30,"minutes":82,"within_budget":false},"impact":{"components":["coordinator","docs","governance","project","scripts"],"files":["coordinator/executor","docs/publication-local-onedev-validator.md","governance/manifest.json","project/TICKETS.md","project/ticket-065/README.md","project/ticket-065/ai-codex-logs.txt","project/ticket-065/ai-codex.md","project/ticket-065/changelog.md","project/ticket-065/intent.json","project/ticket-065/preprompt.md","scripts/publish-local-onedev-validator.sh"],"public_interfaces":[],"runtime_dependencies":0},"schema":"subactor.ticket-radar/v1","score":64,"split":{"parts":[{"estimated_minutes":15,"name":"Implement coordinator","scope":["coordinator"]},{"estimated_minutes":15,"name":"Implement docs","scope":["docs"]},{"estimated_minutes":15,"name":"Implement governance","scope":["governance"]},{"estimated_minutes":15,"name":"Implement project","scope":["project"]},{"estimated_minutes":15,"name":"Implement scripts","scope":["scripts"]},{"estimated_minutes":15,"name":"Validate and project to trackers","scope":["tests","planfile","github/gitlab/jira projections"]}],"reason":"estimated_minutes_exceed_budget","recommended":true},"standards":[{"id":"wellmanifest/dsl","revision":"6c60fc4e0dd1f1bb74f46a7745e28019908d1203","version":"0.1.0-dev"},{"id":"wellmanifest/ticket-lifecycle","revision":"5bf581907a87b46a13a73e6c033d3abe4d9a306f","version":"0.1.0-dev"},{"id":"wellmanifest/git-lifecycle","revision":"7d77d4b7af57e69bc75c3a0290b3a4805c5c4438","version":"0.2.0-dev"},{"id":"wellmanifest/logs","revision":"48c284ef7a069055c0bcb6b900147ce5e65f8b43","version":"0.3.0"}],"ticket_ref":"ticket-065"}

<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" viewBox="0 0 128 128" role="img"><title>ticket-065: feat(ticket-065): orchestrate local OneDev and Validator publication</title><rect width="128" height="128" rx="12" fill="#f8fafc"/><g stroke-width="1"><polygon points="64,55 72,61 69,71 59,71 56,61" fill="none" stroke="#d7dde5"/><polygon points="64,47 80,59 74,78 54,78 48,59" fill="none" stroke="#d7dde5"/><polygon points="64,38 89,56 79,85 49,85 39,56" fill="none" stroke="#d7dde5"/><polygon points="64,30 97,53 84,92 44,92 31,53" fill="none" stroke="#d7dde5"/><polygon points="64,21 105,51 89,99 39,99 23,51" fill="none" stroke="#d7dde5"/><line x1="64" y1="64" x2="64" y2="21" stroke="#aab4c0"/><line x1="64" y1="64" x2="105" y2="51" stroke="#aab4c0"/><line x1="64" y1="64" x2="89" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="39" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="23" y2="51" stroke="#aab4c0"/></g><polygon points="64,21 105,51 79,85 59,71 48,59" fill="#fb923c" fill-opacity="0.45" stroke="#c2410c" stroke-width="2"/><circle cx="64" cy="64" r="3" fill="#c2410c"/><g font-family="sans-serif" font-size="7" fill="#334155"><text x="64" y="11" text-anchor="middle">SCO</text><text x="114" y="48" text-anchor="middle">COU</text><text x="95" y="107" text-anchor="middle">UNC</text><text x="33" y="107" text-anchor="middle">VAL</text><text x="14" y="48" text-anchor="middle">DEL</text></g><text x="64" y="124" text-anchor="middle" font-family="sans-serif" font-size="8" fill="#0f172a">L · 82m</text></svg>

Merge will be attempted after this approval when explicitly authorized. ## Decision record (recomputable)

DECISION D-065-7297
TICKET ticket-065
HEAD_SHA 919972aa711f67a2060d8190ff42ba4f7b00a795
CORRELATION_ID koru-pr-101-ticket-065
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT author_login = "tom-sapletta-com"
INPUT observed_checks = ["standard packs / conformance=PASS","governance / enforce=PASS","governance / remote lifecycle=PASS","standard packs / conformance=PASS","onedev/local-verify=PASS"]
INPUT required_checks = ["onedev/local-verify","standard packs / conformance"]
INPUT required_checks_source = "protected registry + GitHub applied rules (env/request)"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
INPUT superseded_checks = ["smoke"]
INPUT ticket_radar_receipt = {"schema":"subactor.ticket-radar/v1","base_sha":"0008ea9d221865f588626720f46937f5de5c6659","head_sha":"919972aa711f67a2060d8190ff42ba4f7b00a795","change_digest":"491b8de3d1eb51320894b2aba562e7d7cceaad10c5c54c794e292b2b579ecc06","score":64,"complexity":"L","estimated_minutes":82,"split_recommended":true,"services":[],"authority":"ADVISORY","promotion":"FORBIDDEN"}
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "REQUEST_CHANGES" MODEL "zai/glm-5.3"
ASSERT VERDICT_AUTHORITY != "ADVISORY"