chore(deps): require Goal 2.1.292

TODO.md

@@ -10,6 +10,9 @@
 - [ ] [`ticket-005`](project/ticket-005/README.md) — assign Koru's canonical
   development DSL and uv lockfile to the integration workstream. State:
   `IN_PROGRESS / EDIT`; classification: `SERVICE / governance`.
+- [ ] [`ticket-004`](project/ticket-004/README.md) — require published Goal
+  2.1.292 across the development-tool declarations and lockfile. State:
+  `IN_PROGRESS / EDIT`; classification: `SERVICE / integration`.
 
 <!-- PREFACT:BEGIN — generated block, edits inside will be overwritten -->
 # TODO

app.doql.less

@@ -19,15 +19,15 @@ dependencies {
   curllm: curllm[mcp]>=1.0.0;
   browser: "nlp2uri[envmap]>=0.4.7, env2llm[mqtt]>=0.1.14, testql>=1.2.64, curllm[mcp]>=1.0.0, playwright>=1.40,<2.0";
   vdisplay: vdisplay>=0.1.58;
-  dev: "gillm>=0.1.24, pytest>=8.0,<10.0, pytest-cov>=5.0,<8.0, pytest-rerunfailures>=14.0,<17.0, pytest-timeout>=2.3,<3.0, pytest-xdist>=3.0,<4.0, ruff>=0.11,<0.16, mypy>=1.11,<3.0, pyright>=1.1.390,<2.0, hypothesis>=6.112,<7.0, pre-commit>=3.8,<5.0, types-PyYAML>=6.0,<7.0, vdisplay>=0.1.58, cryptography>=42.0,<50.0, planfile>=0.1.117, goal>=2.1.264, costs>=0.1.53, pfix>=0.1.60, tagi>=0.49.0";
+  dev: "gillm>=0.1.24, pytest>=8.0,<10.0, pytest-cov>=5.0,<8.0, pytest-rerunfailures>=14.0,<17.0, pytest-timeout>=2.3,<3.0, pytest-xdist>=3.0,<4.0, ruff>=0.11,<0.16, mypy>=1.11,<3.0, pyright>=1.1.390,<2.0, hypothesis>=6.112,<7.0, pre-commit>=3.8,<5.0, types-PyYAML>=6.0,<7.0, vdisplay>=0.1.58, cryptography>=42.0,<50.0, planfile>=0.1.117, goal>=2.1.292, costs>=0.1.53, pfix>=0.1.60, tagi>=0.49.0";
   api: "fastapi>=0.115,<1.0, uvicorn[standard]>=0.30,<1.0, httpx>=0.27,<1.0, prometheus-client>=0.21,<1.0";
   agent: "instructor>=1.6,<2.0, litellm>=1.51,<2.0, openai>=1.54,<3.0, tiktoken>=0.8,<1.0";
   fullm: fullm>=0.1.22;
   tillm: tillm>=0.1.35;
   obs: "nfo>=0.2.22,<1.0, opentelemetry-exporter-otlp>=1.28,<2.0, opentelemetry-instrumentation-fastapi>=0.49b0,<1.0, opentelemetry-instrumentation-httpx>=0.49b0,<1.0, opentelemetry-sdk>=1.28,<2.0, sentry-sdk>=2.18,<3.0, structlog>=24.4,<26.0";
   queue: "apscheduler>=3.10,<4.0, arq>=0.26,<1.0, cryptography>=42.0,<50.0, redis>=5.1,<8.0";
   quality: "import-linter>=2.0,<3.0, mutmut>=3.2,<4.0, pyupgrade>=3.17,<4.0, refurb>=2.0,<3.0";
-  all: "apscheduler>=3.10,<4.0, arq>=0.26,<1.0, fastapi>=0.115,<1.0, gillm>=0.1.24, hypothesis>=6.112,<7.0, httpx>=0.27,<1.0, import-linter>=2.0,<3.0, instructor>=1.6,<2.0, litellm>=1.51,<2.0, mss>=9.0,<11.0, mutmut>=3.2,<4.0, mypy>=1.11,<3.0, mss>=9.0,<11.0, nfo>=0.2.22,<1.0, openai>=1.54,<3.0, opentelemetry-exporter-otlp>=1.28,<2.0, opentelemetry-instrumentation-fastapi>=0.49b0,<1.0, opentelemetry-instrumentation-httpx>=0.49b0,<1.0, opentelemetry-sdk>=1.28,<2.0, pre-commit>=3.8,<5.0, prometheus-client>=0.21,<1.0, pyright>=1.1.390,<2.0, pytest>=8.0,<10.0, pytest-cov>=5.0,<8.0, pytest-rerunfailures>=14.0,<17.0, pytest-timeout>=2.3,<3.0, pytest-xdist>=3.0,<4.0, pyupgrade>=3.17,<4.0, redis>=5.1,<8.0, refurb>=2.0,<3.0, ruff>=0.11,<0.16, tillm>=0.1.35, sentry-sdk>=2.18,<3.0, structlog>=24.4,<26.0, tiktoken>=0.8,<1.0, types-PyYAML>=6.0,<7.0, uvicorn[standard]>=0.30,<1.0, websockets>=12.0,<17.0, goal>=2.1.264, costs>=0.1.53, pfix>=0.1.60, tagi>=0.49.0, curllm[mcp]>=1.0.0, cryptography>=42.0,<50.0, env2llm[mqtt]>=0.1.14, fullm>=0.1.22, nlp2uri[envmap]>=0.4.7, planfile>=0.1.117, playwright>=1.40,<2.0, testql>=1.2.64, vdisplay>=0.1.58";
+  all: "apscheduler>=3.10,<4.0, arq>=0.26,<1.0, fastapi>=0.115,<1.0, gillm>=0.1.24, hypothesis>=6.112,<7.0, httpx>=0.27,<1.0, import-linter>=2.0,<3.0, instructor>=1.6,<2.0, litellm>=1.51,<2.0, mss>=9.0,<11.0, mutmut>=3.2,<4.0, mypy>=1.11,<3.0, mss>=9.0,<11.0, nfo>=0.2.22,<1.0, openai>=1.54,<3.0, opentelemetry-exporter-otlp>=1.28,<2.0, opentelemetry-instrumentation-fastapi>=0.49b0,<1.0, opentelemetry-instrumentation-httpx>=0.49b0,<1.0, opentelemetry-sdk>=1.28,<2.0, pre-commit>=3.8,<5.0, prometheus-client>=0.21,<1.0, pyright>=1.1.390,<2.0, pytest>=8.0,<10.0, pytest-cov>=5.0,<8.0, pytest-rerunfailures>=14.0,<17.0, pytest-timeout>=2.3,<3.0, pytest-xdist>=3.0,<4.0, pyupgrade>=3.17,<4.0, redis>=5.1,<8.0, refurb>=2.0,<3.0, ruff>=0.11,<0.16, tillm>=0.1.35, sentry-sdk>=2.18,<3.0, structlog>=24.4,<26.0, tiktoken>=0.8,<1.0, types-PyYAML>=6.0,<7.0, uvicorn[standard]>=0.30,<1.0, websockets>=12.0,<17.0, goal>=2.1.292, costs>=0.1.53, pfix>=0.1.60, tagi>=0.49.0, curllm[mcp]>=1.0.0, cryptography>=42.0,<50.0, env2llm[mqtt]>=0.1.14, fullm>=0.1.22, nlp2uri[envmap]>=0.4.7, planfile>=0.1.117, playwright>=1.40,<2.0, testql>=1.2.64, vdisplay>=0.1.58";
 }
 
 entity[name="TextContent"] {

project/TICKETS.md

@@ -6,3 +6,4 @@
 | [ticket-002](ticket-002/README.md) | DONE | Adopt immutable new-project 0.11.0 governance and work-classification package | [ai-codex.md](ticket-002/ai-codex.md) |
 | [ticket-003](ticket-003/README.md) | DONE | Restore the current-main Ruff baseline before governance adoption | [ai-codex.md](ticket-003/ai-codex.md) |
 | [ticket-005](ticket-005/README.md) | IN_PROGRESS | Assign development DSL and lockfile ownership | [ai-codex.md](ticket-005/ai-codex.md) |
+| [ticket-004](ticket-004/README.md) | IN_PROGRESS | Require Goal 2.1.292 version-carrier fix | [ai-codex.md](ticket-004/ai-codex.md) |

project/ticket-004/README.md

@@ -0,0 +1,42 @@
+# Ticket 004: Require Goal 2.1.292 version-carrier fix
+
+- **ID**: ticket-004
+- **Owner**: unresolved:human
+- **Status**: IN_PROGRESS
+- **Workflow state**: EDIT
+- **Created**: 2026-08-10
+- **Work classification**: `SERVICE / integration`
+
+## Goal and scope
+
+Raise Koru's Goal development-tool floor from 2.1.264 to 2.1.292 in the
+canonical dependency declarations and refresh the lockfile. Version 2.1.292
+includes the synchronized-version transition boundary fix and detects only
+writable Python version declarations, including conventional version modules.
+
+## Acceptance criteria
+
+- [x] AC-01: The user explicitly requested testing, publication and updating
+  Goal in dependent projects, with autonomous continuation.
+- [ ] AC-02: `pyproject.toml` and its DSL source require `goal>=2.1.292` in
+  every existing Goal dependency slot.
+- [ ] AC-03: `uv.lock` resolves Goal 2.1.292 from the public index and passes
+  `uv lock --check`.
+- [ ] AC-04: Dependency-focused validation and repository governance pass.
+
+## Risk boundary
+
+This is a development-tool floor and lock refresh only. It does not add a new
+runtime dependency, change Koru APIs, alter queue/autonomy behavior or modify
+generated analysis snapshots.
+
+## Session authorization
+
+The user authorized this concrete dependency update and autonomous execution
+on 2026-08-10. No fresh confirmation is required for the bounded paths in the
+accepted intent.
+
+## Participants
+
+- Human participant: unresolved; no user-* file was created by this script.
+- Agent participant: [ai-codex.md](ai-codex.md)

project/ticket-004/ai-codex.md

@@ -0,0 +1,29 @@
+---
+participant-id: agent:codex
+participant: codex
+role: agent
+ticket: ticket-004
+---
+# Participant: codex (AI agent)
+
+## Understanding
+
+The published Goal 2.1.292 fix must become Koru's minimum development-tool
+version without touching runtime behavior or the user's dirty primary
+checkout.
+
+## Execution plan
+
+1. Publish the bounded dependency plan from an isolated worktree.
+2. Synchronize the DSL source, Python metadata and uv lock.
+3. Run lock, focused test and governance checks.
+4. Deliver through Goal and exact-head validation.
+
+## Actual changes
+
+- Governance plan prepared in an isolated worktree from `origin/main`.
+
+## Blockers
+
+- None. The user's explicit dependency-update request is recorded as session
+  authorization; protected delivery validation remains mandatory.

project/ticket-004/changelog.md

@@ -0,0 +1,8 @@
+# Ticket Changelog (ticket-004)
+
+## [0.1.0] - 2026-08-10
+
+- Initial governance scaffold created.
+- No human participant identity or content was generated.
+- Bounded Goal 2.1.292 dependency-floor and lock-refresh intent documented.
+- Existing user changes in the primary checkout are isolated from this work.

project/ticket-004/intent.json

@@ -0,0 +1,62 @@
+{
+  "schema": "new-project.intent/v2",
+  "ticket": "ticket-004",
+  "summary": "Require Goal 2.1.292 version-carrier fix",
+  "workstream": "integration",
+  "allowedPaths": [
+    "pyproject.toml",
+    "app.doql.less",
+    "uv.lock",
+    "project/ticket-004/**",
+    "TODO.md",
+    "project/TICKETS.md"
+  ],
+  "forbiddenPaths": [
+    ".governance/**",
+    ".github/**",
+    "project/ticket-*/user-*.md",
+    "src/**",
+    "tests/**",
+    "docs/**",
+    "SUMD.md",
+    "project/*.toon.yaml"
+  ],
+  "stacks": ["python"],
+  "dependsOn": [],
+  "conflictsWith": [],
+  "integrationTicket": null,
+  "delivery": {
+    "acceptedBaseSha": "e3bcacc1cf636441249493d663c4281979b5493d",
+    "targetBranch": "main",
+    "outcome": "Koru consistently requires and locks the published Goal 2.1.292 version-carrier fix",
+    "nonGoals": [
+      "No new runtime dependency or public interface change",
+      "No Koru runtime, test, Docker, CI, governance or generated-analysis change"
+    ],
+    "complexity": "XS",
+    "estimatedMinutes": 20,
+    "budgets": {
+      "maxImplementationFiles": 3,
+      "maxAffectedComponents": 1,
+      "maxPublicInterfaceChanges": 0,
+      "maxRuntimeDependencies": 0
+    },
+    "architecture": {
+      "status": "accepted",
+      "decision": "Synchronize the existing Goal development-tool floor and deterministic uv resolution",
+      "components": [
+        {"name": "development-toolchain", "paths": ["pyproject.toml", "app.doql.less", "uv.lock"]}
+      ],
+      "responsibilityChanges": false,
+      "interfaceChanges": [],
+      "dataChanges": [],
+      "ui": {"impact": "none", "states": [], "evidence": []},
+      "rollback": "Revert the dependency-floor and lockfile commit"
+    },
+    "runtimeDependencies": [],
+    "validation": [
+      {"criterion": "AC-03", "commands": ["uv lock --check", "uv tree --locked --package goal"], "evidence": "Lock is current and resolves Goal 2.1.292"},
+      {"criterion": "AC-04", "commands": ["./project/governance-check.sh", "python -m pytest tests/test_dev_sync.py -q"], "evidence": "Governance and dependency-tool tests pass"}
+    ]
+  }
+}

project/ticket-004/preprompt.md

@@ -0,0 +1,8 @@
+# Ticket preprompt
+
+- **Task ID**: ticket-004
+- **Task title**: Require Goal 2.1.292 version-carrier fix
+- **Created**: 2026-08-10T11:38:29Z
+
+Keep executable implementation outside this governance/evidence directory.
+Read a human-owned user-*.md file only when one exists.

pyproject.toml

@@ -101,7 +101,7 @@ dev = [
     "vdisplay>=0.1.58",
     "cryptography>=42.0,<50.0",
     "planfile>=0.1.117",
-    "goal>=2.1.264",
+    "goal>=2.1.292",
     "costs>=0.1.53",
     "pfix>=0.1.60",
     "tagi>=0.49.0",
@@ -186,7 +186,7 @@ all = [
     "types-PyYAML>=6.0,<7.0",
     "uvicorn[standard]>=0.30,<1.0",
     "websockets>=12.0,<17.0",
-    "goal>=2.1.264",
+    "goal>=2.1.292",
     "costs>=0.1.53",
     "pfix>=0.1.60",
     "tagi>=0.49.0",
@@ -221,7 +221,7 @@ dev = [
     "hypothesis>=6.112,<7.0",
     "pre-commit>=3.8,<5.0",
     "types-PyYAML>=6.0,<7.0",
-    "goal>=2.1.264",
+    "goal>=2.1.292",
     "costs>=0.1.53",
     "pfix>=0.1.60",
     "tagi>=0.49.0",