docs(ticket-018): complete governance publication

TODO.md

@@ -2,28 +2,24 @@
 
 ## Active tickets
 
-- [ ] [`ticket-018`](project/ticket-018/README.md) — enforce the
-  `wellmanifest/new-project` manifest as policy-as-code through a deterministic
-  validator, trusted approval boundary, reusable governance CI, stack-specific
-  gates and pinned adoption in `todo2code`; extend it with safe concurrent
-  workstreams, dependency-aware intents and non-overlapping write scopes.
-  Current state: `BLOCKED / PUBLICATION`; AC-01..AC-40, governance and Docker
-  core/full pass, including exact-head Validator App reviews accepted by the
-  reusable gate. Central `wellmanifest/new-project` PR #2 is green and
-  mergeable but still needs an independent review; `wellmanifest` currently
-  has no Validator App installation. The governance workstream reservation is
-  released while waiting.
+No active tickets.
 
 ## Backlog tickets
 
 - [ ] [`ticket-019`](project/ticket-019/README.md) — publish the dependency-free
   Python SDK as the root PyPI distribution `todo2code` through `goal -a`, with
   one root `pyproject.toml` and SDK-only artifacts. Current state:
-  `BACKLOG / WAIT_FOR_APPROVAL`; implementation also waits for ticket-018 to
-  release the overlapping `Makefile` path.
+  `BACKLOG / WAIT_FOR_APPROVAL`; ticket-018 has released the overlapping
+  `Makefile` path, so the remaining boundary is approval of ticket-019 itself.
 
 ## Completed tickets
 
+- [x] [`ticket-018`](project/ticket-018/README.md) — enforced the central
+  governance manifest as policy-as-code with concurrent workstreams, pinned
+  reusable CI, Koru evidence and exact-head Validator App approvals. Current
+  state: `DONE`; todo2code and central Governance Hub publication reviews,
+  deterministic checks and human-controlled merges are complete.
+
 - [x] [`ticket-034`](project/ticket-034/README.md) — scaled each OpenRouter chat
   deadline deterministically from input size, output budget and structural
   complexity. Current state: `DONE`; exact-head Validator App approval,

project/ticket-018/README.md

@@ -2,8 +2,8 @@
 
 - **ID**: ticket-018
 - **Owner**: unresolved:human
-- **Status**: BLOCKED
-- **Workflow state**: PUBLICATION
+- **Status**: DONE
+- **Workflow state**: DONE
 - **Created**: 2026-08-01
 
 ## Goal and scope
@@ -343,8 +343,8 @@ remain historical evidence, not evidence for AC-11..AC-17.
   `68b0c0985f0aa95f8a41e252399491fe7aea29ca` for `ticket-034`; the rerun proved
   `governance / enforce` accepts the independent App evidence. Validator did
   not merge either pull request.
-- The remaining blocker is central `wellmanifest/new-project` PR #2 at exact
-  head `d082373f314191dba794aba58aca2d4475ea497a`. It is green and mergeable but
-  has no independent review, and the `wellmanifest` organization currently has
-  no Validator App installation. Ticket-018 therefore remains
-  `BLOCKED / PUBLICATION` and does not reserve its write scope while waiting.
+- Installation `151239784` made the Validator App available to
+  `wellmanifest/new-project`. Validator run `30929133625` approved central PR
+  #2 at exact head `d082373f314191dba794aba58aca2d4475ea497a` after its required
+  `test` check passed. The human maintainer merged it as
+  `c54694a568fe074c93a586e4de75e8903b13a2ca`; ticket-018 is complete.

project/ticket-018/ai-codex-logs.txt

@@ -367,3 +367,11 @@ wellmanifest/new-project PR #2 head: d082373f314191dba794aba58aca2d4475ea497a
 PR state: OPEN, CLEAN, tests PASS, no reviews
 wellmanifest organization App installations: 0
 transition: IN_PROGRESS / VALIDATION -> BLOCKED / PUBLICATION; reservation released
+2026-08-04 WELLMANIFEST APP INSTALLATION CONFIRMED
+organization installation: 151239784
+Validator profile: wellmanifest/new-project -> required check test
+direct-pr token policy: repository App token only; no queue PAT fallback
+Validator tests: 106 PASS
+central Validator run 30929133625: APPROVED exact head d082373f314191dba794aba58aca2d4475ea497a, ticket-003
+wellmanifest/new-project PR #2 merged by tom-sapletta-com as c54694a568fe074c93a586e4de75e8903b13a2ca
+transition: BLOCKED / PUBLICATION -> DONE

project/ticket-018/ai-codex.md

@@ -206,24 +206,20 @@ Current verified baseline:
   current head, ticket and actor. The earlier checkout-owned resolver is detached
   from CI and retained only until the tracked generated-analysis index is refreshed.
 
-## Publication blocker
+## Publication status
 
 - Central standard 0.9.0 is published at immutable commit
-  `d082373f314191dba794aba58aca2d4475ea497a`; its PR #2 is green and still
-  awaits an independent merge review. The `wellmanifest` organization reports
-  zero App installations, so the existing Validator identity cannot yet
-  provide that review.
+  `d082373f314191dba794aba58aca2d4475ea497a`. Installation `151239784` enabled
+  the exact-head Validator App review, and central PR #2 was merged by the
+  human maintainer as `c54694a568fe074c93a586e4de75e8903b13a2ca`.
 
 ## Approval boundary
 
-- Current state: `BLOCKED / PUBLICATION`. GitHub now reports installation
+- Current state: `DONE`. GitHub reports installation
   `151227156` for App `ifuri-validator-agent` in organization `semcod`, with
-  repository selection `all`; todo2code publication evidence is complete.
-  Central PR #2 still requires an independent reviewer or installation of the
-  Validator App in `wellmanifest`.
-- Required response from: `unresolved:human`.
+  repository selection `all`; todo2code and central publication evidence are
+  complete. No response is required.
 - The user explicitly approved AC-18..AC-25 in chat. This authorizes the
   implementation workflow but is not itself merge-time review evidence.
-- The user explicitly approved AC-26..AC-40 on 2026-08-04. Those criteria are
-  complete; current `BLOCKED / PUBLICATION` state concerns only the independent
-  review of central PR #2.
+- The user explicitly approved AC-26..AC-40 on 2026-08-04. Those criteria and
+  the independent central publication review are complete.

project/ticket-018/changelog.md

@@ -53,6 +53,11 @@
   and mergeable, but `wellmanifest` has no Validator App installation and the
   author cannot supply an independent self-review. Released the workstream at
   `BLOCKED / PUBLICATION`.
+- Installed the Validator App in `wellmanifest`, added a closed
+  repository/check profile in Validator without a direct-PR PAT fallback, and
+  passed 106 Validator tests.
+- Validator run `30929133625` approved central PR #2 at exact head `d082373`;
+  the human maintainer merged it as `c54694a5` and ticket-018 moved to `DONE`.
 
 ## [0.5.0] - 2026-08-04