docs(release): record Goal 2.1.291 publication

CHANGELOG.md

@@ -173,6 +173,16 @@
   sync with the real `[project]` table (e.g. version `2.1.221` vs the actual `2.1.266`)
   and could mislead anyone editing dependencies there, believing it had any effect.
 
+## [2.1.291] - 2026-08-10
+
+### Fixed
+- Prevent a publish-only release with a stale Git tag from causing a duplicate
+  patch bump; committed-source analysis now starts at the synchronized current
+  version transition and still detects source added after that boundary.
+
+### Docs
+- Update README.md
+
 ## [2.1.290] - 2026-08-10
 
 ### Docs

README.md

@@ -24,10 +24,10 @@
 ## AI Cost Tracking
 
 ![PyPI](https://img.shields.io/badge/pypi-costs-blue) ![Version](https://img.shields.io/badge/version-2.1.291-blue) ![Python](https://img.shields.io/badge/python-3.9+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
-![AI Cost](https://img.shields.io/badge/AI%20Cost-$1.26-orange) ![Human Time](https://img.shields.io/badge/Human%20Time-142.9h-blue) ![Model](https://img.shields.io/badge/Model-openrouter%2Fx--ai%2Fgrok--code--fast--1-lightgrey)
+![AI Cost](https://img.shields.io/badge/AI%20Cost-$1.15-orange) ![Human Time](https://img.shields.io/badge/Human%20Time-143.1h-blue) ![Model](https://img.shields.io/badge/Model-openrouter%2Fx--ai%2Fgrok--code--fast--1-lightgrey)
 
-- 🤖 **LLM usage:** $1.2644 (406 commits)
-- 👤 **Human dev:** ~$14287 (142.9h @ $100/h, 30min dedup)
+- 🤖 **LLM usage:** $1.1471 (408 commits)
+- 👤 **Human dev:** ~$14309 (143.1h @ $100/h, 30min dedup)
 
 Generated on 2026-08-10 using [openrouter/x-ai/grok-code-fast-1](https://openrouter.ai/x-ai/grok-code-fast-1)
 

TODO.md

@@ -55,8 +55,11 @@
   version transition after a stale tag so post-publication metadata delivery
   does not select a duplicate patch. State: `DONE / PUBLICATION`;
   classification: `BUG / application`.
-- [ ] Deliver [ticket-019](project/ticket-019/README.md): publish the merged
+- [x] Deliver [ticket-019](project/ticket-019/README.md): publish the merged
   boundary repair as Goal 2.1.291 and verify a fresh public-index install.
+  State: `DONE / PUBLICATION`; classification: `SERVICE / integration`.
+- [ ] Deliver [ticket-020](project/ticket-020/README.md): record Goal 2.1.291
+  release notes and publication evidence without another version change.
   State: `IN_PROGRESS / EDIT`; classification: `SERVICE / integration`.
 - [ ] After governance bootstrap, execute the sequential phases defined in
   [the refactoring plan](docs/GOAL_KORU_SUBACTOR_REFACTORING_PLAN.md), with one
@@ -68,7 +71,7 @@
 > `ticket-010 DONE`; `ticket-011 DONE`; `ticket-012 DONE`;
 > `ticket-013 DONE`; `ticket-014 CANCELLED`; `ticket-015 DONE`;
 > `ticket-016 DONE`; `ticket-017 DONE`; `ticket-018 DONE`;
-> `ticket-019 IN_PROGRESS`.
+> `ticket-019 DONE`; `ticket-020 IN_PROGRESS`.
 
 > **Recently shipped (manual note):** `goal all [PATHS...]` monorepo sweep —
 > runs `goal -a` in every git repo with uncommitted changes under the given

project/TICKETS.md

@@ -25,4 +25,5 @@ This file indexes governance tickets without taking ownership of
 | **ticket-017** | [`README.md`](./ticket-017/README.md) | [`preprompt.md`](./ticket-017/preprompt.md) | - |  [`ai-codex.md`](./ticket-017/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-017/ai-codex-logs.txt) | [`changelog.md`](./ticket-017/changelog.md) |
 | **ticket-018** | [`README.md`](./ticket-018/README.md) | [`preprompt.md`](./ticket-018/preprompt.md) | - |  [`ai-codex.md`](./ticket-018/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-018/ai-codex-logs.txt) | [`changelog.md`](./ticket-018/changelog.md) |
 | **ticket-019** | [`README.md`](./ticket-019/README.md) | [`preprompt.md`](./ticket-019/preprompt.md) | - |  [`ai-codex.md`](./ticket-019/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-019/ai-codex-logs.txt) | [`changelog.md`](./ticket-019/changelog.md) |
+| **ticket-020** | [`README.md`](./ticket-020/README.md) | [`preprompt.md`](./ticket-020/preprompt.md) | - |  [`ai-codex.md`](./ticket-020/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-020/ai-codex-logs.txt) | [`changelog.md`](./ticket-020/changelog.md) |
 <!-- AUTO:TICKET_INDEX:END -->

project/ticket-019/README.md

@@ -2,8 +2,8 @@
 
 - **ID**: ticket-019
 - **Owner**: unresolved:human
-- **Status**: IN_PROGRESS
-- **Workflow state**: EDIT
+- **Status**: DONE
+- **Workflow state**: PUBLICATION
 - **Created**: 2026-08-10
 - **Work classification**: `SERVICE / integration`
 
@@ -23,9 +23,9 @@ from the public PyPI index before it is considered complete.
   `README.md` consistently describe 2.1.291.
 - [x] AC-03: The full Python suite and package build pass from the synchronized
   release tree.
-- [ ] AC-04: The release PR passes Python 3.12/3.13 CI and exact-head validator
+- [x] AC-04: The release PR passes Python 3.12/3.13 CI and exact-head validator
   approval before merge.
-- [ ] AC-05: Goal 2.1.291 is visible on PyPI and imports as 2.1.291 in a fresh
+- [x] AC-05: Goal 2.1.291 is visible on PyPI and imports as 2.1.291 in a fresh
   environment installed only from the public index.
 
 ## Session authorization
@@ -58,3 +58,17 @@ policy, GitHub workflow or downstream dirty repository is modified here.
 
 - Human participant: unresolved; no user-* file was created.
 - Agent participant: [ai-codex.md](ai-codex.md)
+
+## Publication
+
+- Release [PR #36](https://github.com/semcod/goal/pull/36) passed Python 3.12
+  and 3.13 CI.
+- `ifuri-validator-agent` approved exact head
+  `f65c52d7c6a8d88e4d276dcc50eb20fb9b084dc1`.
+- The protected PR merged as
+  `6c31d88fe59134a2a1fe6f51b33329489536b6f0`.
+- Governed publish-only selected `already-bumped -> 2.1.291`, uploaded wheel
+  and sdist, skipped remote push/tag, and did not propose 2.1.292.
+- PyPI exposes two 2.1.291 artifacts. A fresh Python 3.13 environment installed
+  from `https://pypi.org/simple`; both CLI and import reported 2.1.291 from its
+  isolated `site-packages`.

project/ticket-019/ai-codex-logs.txt

@@ -8,3 +8,11 @@
 - 2026-08-10: Governance rejected six implementation files under S and the
   schema disallowed M. Removed only generated top-level release notes from this
   slice; a dependent post-publication evidence slice will own that metadata.
+- 2026-08-10: PR #36 CI passed on Python 3.12/3.13; validator run 31382609376
+  approved exact head f65c52d7c6a8d88e4d276dcc50eb20fb9b084dc1.
+- 2026-08-10: Protected merge completed as
+  6c31d88fe59134a2a1fe6f51b33329489536b6f0.
+- 2026-08-10: Governed publish-only uploaded Goal 2.1.291 wheel/sdist; PyPI
+  JSON and Simple API expose two artifacts.
+- 2026-08-10: Fresh public-index Python 3.13 install reported CLI/import
+  version 2.1.291 from isolated site-packages.

project/ticket-019/changelog.md

@@ -11,3 +11,7 @@
 - Kept the release at the accepted S limit by moving generated release notes
   to a dependent publication-evidence slice; the five synchronized
   version/manifest/lock/badge files remain atomic.
+- PR #36 passed Python 3.12/3.13 CI, received exact-head validator approval and
+  merged as `6c31d88fe59134a2a1fe6f51b33329489536b6f0`.
+- Published Goal 2.1.291 through governed publish-only mode and verified both
+  artifacts plus a clean public-index Python 3.13 installation.

project/ticket-020/README.md

@@ -0,0 +1,46 @@
+# Ticket 020: Record Goal 2.1.291 publication evidence
+
+- **ID**: ticket-020
+- **Owner**: unresolved:human
+- **Status**: IN_PROGRESS
+- **Workflow state**: EDIT
+- **Created**: 2026-08-10
+- **Work classification**: `SERVICE / integration`
+
+## Goal and scope
+
+Deliver the metadata intentionally split from ticket-019: public registry
+evidence, exact-head release provenance, user-facing 2.1.291 release notes and
+the cost badge refreshed by the governed publish-only run. This slice proves
+that the repaired version boundary yields `no-release -> 2.1.291` after the
+registry catches up.
+
+## Acceptance criteria
+
+- [x] AC-01: Publish-only selected `already-bumped -> 2.1.291`, published two
+  artifacts and never proposed 2.1.292.
+- [x] AC-02: PyPI JSON/Simple APIs expose 2.1.291 wheel and sdist.
+- [x] AC-03: A fresh Python 3.13 public-index install reports 2.1.291 for CLI
+  and import from isolated site-packages.
+- [x] AC-04: Changelog and ticket-019 record the release fix and protected
+  delivery chain; README retains the publish-run cost refresh.
+- [ ] AC-05: This metadata-only PR passes governance, target CI and exact-head
+  validator approval before merge.
+
+## Session authorization
+
+The user explicitly requested autonomous testing and publication. This is the
+bounded evidence/closure phase of that already authorized release; no repeated
+confirmation is required. Exact-head merge approval remains external.
+
+## Boundary
+
+Only publication documentation, cost evidence, ticket closure metadata and
+the ticket/TODO indexes may change. No version carrier, package source,
+dependency, lockfile, governance policy, CI workflow or registry artifact is
+modified here.
+
+## Participants
+
+- Human participant: unresolved; no user-* file was created.
+- Agent participant: [ai-codex.md](ai-codex.md)

project/ticket-020/ai-codex-logs.txt

@@ -0,0 +1,8 @@
+- 2026-08-10: Started the dependent publication-evidence slice on release
+  merge `6c31d88fe59134a2a1fe6f51b33329489536b6f0`.
+- 2026-08-10: PyPI exposes Goal 2.1.291 wheel/sdist; clean Python 3.13
+  installation reports CLI/import 2.1.291 from isolated site-packages.
+- 2026-08-10: Added 2.1.291 fix notes and restored the exact README cost badge
+  produced by the successful publish-only run.
+- 2026-08-10: Post-publication Goal decision is no-release -> 2.1.291;
+  governance passed with zero errors and warnings.

project/ticket-020/ai-codex.md

@@ -0,0 +1,23 @@
+---
+participant-id: agent:codex
+participant: codex
+role: agent
+ticket: ticket-020
+---
+# Participant: codex (AI agent)
+
+## Understanding
+
+Goal 2.1.291 is public and independently installable. The remaining local
+commit contains only generated release notes and the publish-run cost badge,
+which must be delivered by PR rather than pushed directly to main.
+
+## Execution plan
+
+1. Record immutable registry and exact-head release evidence.
+2. Confirm the post-publication version decision is no-release 2.1.291.
+3. Pass governance, CI and exact-head validation for the metadata PR.
+
+## Blockers
+
+- None inside the recorded intent; proceed autonomously.

project/ticket-020/changelog.md

@@ -0,0 +1,12 @@
+# Ticket Changelog (ticket-020)
+
+## [0.1.0] - 2026-08-10
+
+- Initialized the metadata-only publication evidence split required by the
+  five-implementation-file S budget of ticket-019.
+- Recorded PyPI and fresh public-index installation evidence.
+- Added the 2.1.291 fix notes and preserved the README cost evidence generated
+  by the successful governed publish-only run.
+- Confirmed no-release -> 2.1.291 after registry catch-up and fresh-base
+  governance with zero findings.
+- No human participant identity or content was generated.

project/ticket-020/intent.json

@@ -0,0 +1,89 @@
+{
+  "schema": "new-project.intent/v3",
+  "ticket": "ticket-020",
+  "summary": "Record Goal 2.1.291 publication evidence",
+  "workstream": "integration",
+  "classification": {
+    "kind": "SERVICE",
+    "priority": "P1",
+    "origin": "requested"
+  },
+  "allowedPaths": [
+    "CHANGELOG.md",
+    "README.md",
+    "project/ticket-019/README.md",
+    "project/ticket-019/ai-codex-logs.txt",
+    "project/ticket-019/changelog.md",
+    "project/ticket-020/**",
+    "project/TICKETS.md",
+    "TODO.md"
+  ],
+  "forbiddenPaths": ["project/ticket-*/user-*.md"],
+  "stacks": ["python"],
+  "dependsOn": ["ticket-019"],
+  "conflictsWith": [],
+  "integrationTicket": null,
+  "delivery": {
+    "acceptedBaseSha": "6c31d88fe59134a2a1fe6f51b33329489536b6f0",
+    "targetBranch": "main",
+    "outcome": "Goal 2.1.291 publication and protected delivery evidence are recorded without another version change",
+    "nonGoals": [
+      "No version carrier or package source change",
+      "No dependency, lockfile, governance or CI change",
+      "No registry mutation",
+      "No downstream repository write"
+    ],
+    "complexity": "S",
+    "estimatedMinutes": 20,
+    "budgets": {
+      "maxImplementationFiles": 2,
+      "maxAffectedComponents": 1,
+      "maxPublicInterfaceChanges": 0,
+      "maxRuntimeDependencies": 0
+    },
+    "architecture": {
+      "status": "accepted",
+      "decision": "Deliver post-publication notes and evidence as a metadata-only dependent slice after the five-file atomic release merge",
+      "components": [
+        {
+          "name": "publication-evidence",
+          "paths": ["CHANGELOG.md", "README.md"]
+        }
+      ],
+      "responsibilityChanges": false,
+      "interfaceChanges": [],
+      "dataChanges": [],
+      "ui": {
+        "impact": "none",
+        "states": [],
+        "evidence": []
+      },
+      "rollback": "Remove only the evidence commit; published immutable artifacts remain unchanged"
+    },
+    "runtimeDependencies": [],
+    "validation": [
+      {
+        "criterion": "AC-01",
+        "commands": [".venv/bin/goal check-versions"],
+        "evidence": "Registry catch-up yields no-release -> 2.1.291"
+      },
+      {
+        "criterion": "AC-02",
+        "commands": ["curl -fsSL https://pypi.org/pypi/goal/2.1.291/json"],
+        "evidence": "PyPI reports version 2.1.291 and two immutable artifacts"
+      },
+      {
+        "criterion": "AC-03",
+        "commands": ["goal --version"],
+        "evidence": "Fresh public-index install reports 2.1.291"
+      },
+      {
+        "criterion": "AC-05",
+        "commands": [
+          "./project/governance-check.sh --base 6c31d88fe59134a2a1fe6f51b33329489536b6f0"
+        ],
+        "evidence": "Governance, target CI and exact-head external validation pass"
+      }
+    ]
+  }
+}

project/ticket-020/preprompt.md

@@ -0,0 +1,8 @@
+# Preprompt: ticket-020
+
+Record Goal 2.1.291 publication evidence and the release notes intentionally
+split from ticket-019. Preserve the README cost refresh produced by the
+governed publish-only run. Verify that registry catch-up yields no new release.
+
+Do not modify version carriers, package source, dependencies, lockfiles,
+governance, CI, or registry state. Do not infer a human identity.