chore(governance): own toolchain sync files

.governance/manifest.json

@@ -71,11 +71,11 @@
       "interfaces": {"ownedPaths": ["api/**", "sdk/**", "clients/**"]},
       "infrastructure": {"ownedPaths": ["Dockerfile*", "compose*.yml", "compose*.yaml", "infra/**", ".github/**"]},
       "governance": {"ownedPaths": [".governance/**", "AGENTS.md", "README.md", "TODO.md", "goal.yaml", "project/TICKETS.md", "project/governance-check.*", "project/new-ticket.sh", "project/readme.sh", "project/ticket-*/**", "project.sh", "project.bat"]},
-      "integration": {"ownedPaths": ["package.json", "pyproject.toml", "go.mod", "Cargo.toml", "pom.xml", "docs/**"]}
+      "integration": {"ownedPaths": ["package.json", "pyproject.toml", "app.doql.less", "uv.lock", "go.mod", "Cargo.toml", "pom.xml", "docs/**"]}
     },
     "integration": {
       "workstream": "integration",
-      "requiredForPaths": ["package.json", "pyproject.toml", "go.mod", "Cargo.toml", "pom.xml"]
+      "requiredForPaths": ["package.json", "pyproject.toml", "app.doql.less", "uv.lock", "go.mod", "Cargo.toml", "pom.xml"]
     }
   },
   "delivery": {

.governance/manifest.lock.json

@@ -5,7 +5,7 @@
     ".governance/governance_check.py": "aabd710d8c273faa59e6fd26b6d5d9c04f55b084cb9fd3df3c26c5ba0cbc56ea",
     ".governance/intent.schema.json": "d618a2c7ef4b4a24fbf95d516bf8c8231836e7752b28f0450cc96f02f07b6780",
     ".governance/lock.schema.json": "fc6f1143ef713c993b61270dd2d7545a52cb0b8501aadb188e6d0152a208b207",
-    ".governance/manifest.json": "bc3f1acc828269ab935a78afb22cc96431476ae30b6f1cd35cae158abfcf9b6f",
+    ".governance/manifest.json": "911bb4de37bc02c01a4f5337e3318ff0620419e02b83213c4129841c8c78a14c",
     ".governance/manifest.schema.json": "d48f258e3397ac2d8c5010e5ccdeef9eaf87b0b015d56798d11d5916c5f70a18",
     ".governance/package-manifest.json": "d9d7052c51f0df5d92260b1f97fb0f7e1f77bd9b890a095daea5a1ea625b4ab3",
     ".governance/stack-profiles.json": "6fa3f8f44e50cfd0539413a85092817d3fab4e82fe376405f1e443120724dff2",

TODO.md

@@ -7,6 +7,9 @@
 - [x] [`ticket-003`](project/ticket-003/README.md) — restore Koru's current-main
   Ruff gate without suppressions or behavior changes. State: `DONE`;
   classification: `SERVICE / health`.
+- [ ] [`ticket-005`](project/ticket-005/README.md) — assign Koru's canonical
+  development DSL and uv lockfile to the integration workstream. State:
+  `IN_PROGRESS / EDIT`; classification: `SERVICE / governance`.
 
 <!-- PREFACT:BEGIN — generated block, edits inside will be overwritten -->
 # TODO

project/TICKETS.md

@@ -5,3 +5,4 @@
 | [ticket-001](ticket-001/README.md) | DONE | Harden Koru's todo2code integration against repository governance | [ai-codex.md](ticket-001/ai-codex.md) |
 | [ticket-002](ticket-002/README.md) | DONE | Adopt immutable new-project 0.11.0 governance and work-classification package | [ai-codex.md](ticket-002/ai-codex.md) |
 | [ticket-003](ticket-003/README.md) | DONE | Restore the current-main Ruff baseline before governance adoption | [ai-codex.md](ticket-003/ai-codex.md) |
+| [ticket-005](ticket-005/README.md) | IN_PROGRESS | Assign development DSL and lockfile ownership | [ai-codex.md](ticket-005/ai-codex.md) |

project/ticket-005/README.md

@@ -0,0 +1,37 @@
+# Ticket 005: Assign development toolchain ownership
+
+- **ID**: ticket-005
+- **Owner**: unresolved:human
+- **Status**: IN_PROGRESS
+- **Workflow state**: EDIT
+- **Created**: 2026-08-10
+- **Work classification**: `SERVICE / governance`
+
+## Goal and scope
+
+Assign Koru's canonical development DSL (`app.doql.less`) and deterministic
+Python lockfile (`uv.lock`) to the existing integration workstream. Both files
+are synchronized with `pyproject.toml`, but the adopted repository manifest
+currently leaves them unowned and therefore blocks legitimate dependency
+updates.
+
+## Acceptance criteria
+
+- [x] AC-01: The user authorized autonomous dependency updates without a fresh
+  confirmation for each bounded repository change.
+- [ ] AC-02: Integration owns `app.doql.less` and `uv.lock` in both ownership
+  and integration-routing declarations.
+- [ ] AC-03: The immutable manifest lock records the exact customized manifest
+  digest and the governance gate passes without warnings.
+- [ ] AC-04: No runtime, dependency value, public API, CI or Docker behavior is
+  changed by this governance-only slice.
+
+## Risk boundary
+
+This ticket changes ownership metadata only. The dependent Goal update remains
+isolated in ticket-004 and must be rebased onto this merged governance change.
+
+## Participants
+
+- Human participant: unresolved; no user-* file was created.
+- Agent participant: [ai-codex.md](ai-codex.md)

project/ticket-005/ai-codex-logs.txt

@@ -0,0 +1,3 @@
+2026-08-10 user authorization: autonomous bounded dependency maintenance
+2026-08-10 manifest ownership: app.doql.less and uv.lock -> integration
+2026-08-10 manifest sha256: 911bb4de37bc02c01a4f5337e3318ff0620419e02b83213c4129841c8c78a14c

project/ticket-005/ai-codex.md

@@ -0,0 +1,29 @@
+---
+participant-id: agent:codex
+participant: codex
+role: agent
+ticket: ticket-005
+---
+# Participant: codex (AI agent)
+
+## Understanding
+
+Koru synchronizes the Goal development-tool floor through `pyproject.toml`,
+`app.doql.less` and `uv.lock`. The adopted manifest owns only the first file,
+so deterministic dependency maintenance fails closed on the other two.
+
+## Execution plan
+
+1. Add the existing DSL and lockfile to integration ownership and routing.
+2. Update the immutable manifest digest.
+3. Run governance and exact diff validation.
+4. Deliver an exact-head validated governance-only PR.
+
+## Actual changes
+
+- Added `app.doql.less` and `uv.lock` to integration ownership and routing.
+- Updated the manifest lock to the exact customized manifest digest.
+
+## Blockers
+
+- None.

project/ticket-005/changelog.md

@@ -0,0 +1,6 @@
+# Ticket Changelog (ticket-005)
+
+## [0.1.0] - 2026-08-10
+
+- Assigned the canonical development DSL and uv lockfile to integration.
+- Synchronized the immutable manifest lock digest.

project/ticket-005/intent.json

@@ -0,0 +1,60 @@
+{
+  "schema": "new-project.intent/v2",
+  "ticket": "ticket-005",
+  "summary": "Assign development DSL and lockfile ownership",
+  "workstream": "governance",
+  "allowedPaths": [
+    ".governance/manifest.json",
+    ".governance/manifest.lock.json",
+    "project/ticket-005/**",
+    "TODO.md",
+    "project/TICKETS.md"
+  ],
+  "forbiddenPaths": [
+    "project/ticket-*/user-*.md",
+    "src/**",
+    "tests/**",
+    ".github/**",
+    "pyproject.toml",
+    "app.doql.less",
+    "uv.lock"
+  ],
+  "stacks": [],
+  "dependsOn": [],
+  "conflictsWith": [],
+  "integrationTicket": null,
+  "delivery": {
+    "acceptedBaseSha": "e3bcacc1cf636441249493d663c4281979b5493d",
+    "targetBranch": "main",
+    "outcome": "Koru integration owns its canonical development DSL and deterministic lockfile",
+    "nonGoals": [
+      "No dependency value or runtime change",
+      "No source, test, CI, Docker or public interface change"
+    ],
+    "complexity": "XS",
+    "estimatedMinutes": 10,
+    "budgets": {
+      "maxImplementationFiles": 2,
+      "maxAffectedComponents": 1,
+      "maxPublicInterfaceChanges": 0,
+      "maxRuntimeDependencies": 0
+    },
+    "architecture": {
+      "status": "accepted",
+      "decision": "Extend the integration workstream with the two existing synchronized toolchain files",
+      "components": [
+        {"name": "repository-governance", "paths": [".governance/manifest.json", ".governance/manifest.lock.json"]}
+      ],
+      "responsibilityChanges": false,
+      "interfaceChanges": [],
+      "dataChanges": [],
+      "ui": {"impact": "none", "states": [], "evidence": []},
+      "rollback": "Revert the manifest ownership entries and restore the prior locked digest"
+    },
+    "runtimeDependencies": [],
+    "validation": [
+      {"criterion": "AC-03", "commands": ["sha256sum .governance/manifest.json", "./project/governance-check.sh"], "evidence": "Locked digest matches and governance passes"},
+      {"criterion": "AC-04", "commands": ["git diff --check"], "evidence": "Only governance and ticket metadata change"}
+    ]
+  }
+}

project/ticket-005/preprompt.md

@@ -0,0 +1,8 @@
+# Ticket preprompt
+
+- **Task ID**: ticket-005
+- **Task title**: Assign development toolchain ownership
+- **Created**: 2026-08-10T12:20:00Z
+
+Keep the change limited to repository governance ownership and its immutable
+digest. Do not modify dependency values or executable code in this slice.