From 8b6d67061280af151012e8916401d9f2343765ea Mon Sep 17 00:00:00 2001 From: Tom Softreck Date: Fri, 23 Oct 2026 16:36:45 +0200 Subject: [PATCH 1/2] governance(ticket-019): declare llm-agent/mcp-git-proxy/mcp-skills ownership, docs, ticket-021 - application workstream owns llm-agent/**, mcp-git-proxy/**, mcp-skills/** - re-pin standard-adoption manifest artifact digests after the ownership change - docs/dependency-ownership.md documents the subproject requirement ownership map - ticket-021 (application) owns llm-agent and mcp-skills dependency manifests for automated dependency PRs (ticket-020 was terminally receipted by the validated merges of #32/#34) --- .governance/manifest.json | 5 ++++- .governance/standard-adoption.json | 16 ++++++++-------- docs/dependency-ownership.md | 19 +++++++++++++++++++ project/TICKETS.md | 1 + project/ticket-019/intent.json | 3 ++- project/ticket-021/README.md | 22 ++++++++++++++++++++++ project/ticket-021/intent.json | 25 +++++++++++++++++++++++++ 7 files changed, 81 insertions(+), 10 deletions(-) create mode 100644 docs/dependency-ownership.md create mode 100644 project/ticket-021/README.md create mode 100644 project/ticket-021/intent.json diff --git a/.governance/manifest.json b/.governance/manifest.json index 1ccc983..1c6d599 100644 --- a/.governance/manifest.json +++ b/.governance/manifest.json @@ -53,7 +53,10 @@ "git2mcp/**", "mcp-gateway/**", "mcp-docs/**", - "mcp-webui/**" + "mcp-webui/**", + "llm-agent/**", + "mcp-git-proxy/**", + "mcp-skills/**" ] }, "governance": { diff --git a/.governance/standard-adoption.json b/.governance/standard-adoption.json index 28722c0..8d4c062 100644 --- a/.governance/standard-adoption.json +++ b/.governance/standard-adoption.json @@ -19,7 +19,7 @@ "artifacts": [ { "target": ".governance/manifest.json", - "sha256": "2254f0b710fbe784c7e331ceabe37f1371b169b75fddef01e72691a627e2266f" + "sha256": "1e1f98ea4ec6d2926a2d9c4d219a1f487238c0ceec39abbf89c77a75e116570c" } ], "evidence": [ @@ -54,7 +54,7 @@ "artifacts": [ { "target": ".governance/manifest.json", - "sha256": "2254f0b710fbe784c7e331ceabe37f1371b169b75fddef01e72691a627e2266f" + "sha256": "1e1f98ea4ec6d2926a2d9c4d219a1f487238c0ceec39abbf89c77a75e116570c" } ], "evidence": [ @@ -94,7 +94,7 @@ "artifacts": [ { "target": ".governance/manifest.json", - "sha256": "2254f0b710fbe784c7e331ceabe37f1371b169b75fddef01e72691a627e2266f" + "sha256": "1e1f98ea4ec6d2926a2d9c4d219a1f487238c0ceec39abbf89c77a75e116570c" } ], "evidence": [ @@ -129,7 +129,7 @@ "artifacts": [ { "target": ".governance/manifest.json", - "sha256": "2254f0b710fbe784c7e331ceabe37f1371b169b75fddef01e72691a627e2266f" + "sha256": "1e1f98ea4ec6d2926a2d9c4d219a1f487238c0ceec39abbf89c77a75e116570c" } ], "evidence": [ @@ -169,7 +169,7 @@ "artifacts": [ { "target": ".governance/manifest.json", - "sha256": "2254f0b710fbe784c7e331ceabe37f1371b169b75fddef01e72691a627e2266f" + "sha256": "1e1f98ea4ec6d2926a2d9c4d219a1f487238c0ceec39abbf89c77a75e116570c" } ], "evidence": [ @@ -209,7 +209,7 @@ "artifacts": [ { "target": ".governance/manifest.json", - "sha256": "2254f0b710fbe784c7e331ceabe37f1371b169b75fddef01e72691a627e2266f" + "sha256": "1e1f98ea4ec6d2926a2d9c4d219a1f487238c0ceec39abbf89c77a75e116570c" } ], "evidence": [ @@ -244,7 +244,7 @@ "artifacts": [ { "target": ".governance/manifest.json", - "sha256": "2254f0b710fbe784c7e331ceabe37f1371b169b75fddef01e72691a627e2266f" + "sha256": "1e1f98ea4ec6d2926a2d9c4d219a1f487238c0ceec39abbf89c77a75e116570c" } ], "evidence": [ @@ -284,7 +284,7 @@ "artifacts": [ { "target": ".governance/manifest.json", - "sha256": "2254f0b710fbe784c7e331ceabe37f1371b169b75fddef01e72691a627e2266f" + "sha256": "1e1f98ea4ec6d2926a2d9c4d219a1f487238c0ceec39abbf89c77a75e116570c" } ], "evidence": [ diff --git a/docs/dependency-ownership.md b/docs/dependency-ownership.md new file mode 100644 index 0000000..a76c4b4 --- /dev/null +++ b/docs/dependency-ownership.md @@ -0,0 +1,19 @@ +# Subproject dependency ownership + +Every subproject requirement manifest is owned by the `application` +workstream and resolves to ticket-020 (cross-subproject dependency +maintenance). Automated dependency PRs that touch exactly these files +resolve to that single active ticket: + +| Manifest | Owner | +| --- | --- | +| `llm-agent/requirements.txt` | application / ticket-020 | +| `mcp-docs/requirements.txt` | application / ticket-020 | +| `mcp-gateway/requirements.txt` | application / ticket-020 | +| `mcp-git-proxy/requirements.txt` | application / ticket-020 | +| `mcp-skills/requirements.txt` | application / ticket-020 | +| `mcp-webui/requirements.txt` | application / ticket-020 | + +The managed standard contracts are pinned by `.governance/standard-adoption.json`; +its manifest artifact digest is re-pinned whenever the coordination +declaration changes through an adopted `goal governance` transaction. diff --git a/project/TICKETS.md b/project/TICKETS.md index 4196b16..80b6e29 100644 --- a/project/TICKETS.md +++ b/project/TICKETS.md @@ -15,4 +15,5 @@ This file indexes governance tickets without taking ownership of | **ticket-016** | [`README.md`](./ticket-016/README.md) | - | - | - | - | - | | **ticket-019** | [`README.md`](./ticket-019/README.md) | - | - | - | - | - | | **ticket-020** | [`README.md`](./ticket-020/README.md) | - | - | - | - | - | +| **ticket-021** | [`README.md`](./ticket-021/README.md) | - | - | - | - | - | diff --git a/project/ticket-019/intent.json b/project/ticket-019/intent.json index 686577b..e065ca4 100644 --- a/project/ticket-019/intent.json +++ b/project/ticket-019/intent.json @@ -14,7 +14,8 @@ "project/TICKETS.md", ".gitattributes", "project.bat", - ".governance/manifest.json" + ".governance/manifest.json", + "docs/dependency-ownership.md" ], "forbiddenPaths": [ "project/ticket-*/user-*.md" diff --git a/project/ticket-021/README.md b/project/ticket-021/README.md new file mode 100644 index 0000000..7f6a6f9 --- /dev/null +++ b/project/ticket-021/README.md @@ -0,0 +1,22 @@ +# Ticket 021: Dependency maintenance: llm-agent and mcp-skills requirement manifests + +- **ID**: ticket-021 +- **Owner**: agent:claude +- **Status**: IN_PROGRESS +- **Workflow state**: EDIT +- **Created**: 2026-10-23 + +## Goal and scope + +Own the automated dependency updates for `llm-agent/requirements.txt` and +`mcp-skills/requirements.txt` (requires the `llm-agent/**` and +`mcp-skills/**` application ownership declared by ticket-019). + +## Acceptance criteria + +- [ ] AC-01: the mcp requirement bump resolves to this ticket and passes + the governance gate on a current base. + +## Tracking boundary + +Requirement manifests only; no runtime code changes. diff --git a/project/ticket-021/intent.json b/project/ticket-021/intent.json new file mode 100644 index 0000000..1bf7d49 --- /dev/null +++ b/project/ticket-021/intent.json @@ -0,0 +1,25 @@ +{ + "schema": "new-project.intent/v3", + "ticket": "ticket-021", + "summary": "Dependency maintenance: llm-agent and mcp-skills requirement manifests", + "workstream": "application", + "classification": { + "kind": "SERVICE", + "priority": "P2", + "origin": "health" + }, + "allowedPaths": [ + "project/ticket-021/**", + "TODO.md", + "project/TICKETS.md", + "llm-agent/requirements.txt", + "mcp-skills/requirements.txt" + ], + "forbiddenPaths": [ + "project/ticket-*/user-*.md" + ], + "stacks": [], + "dependsOn": [], + "conflictsWith": [], + "integrationTicket": null +} From 368eefa58a672a00c3310cb73fffc07b042f5602 Mon Sep 17 00:00:00 2001 From: Tom Softreck Date: Fri, 23 Oct 2026 16:43:18 +0200 Subject: [PATCH 2/2] governance(ticket-019): subproject ownership, governance contract test, ticket-021 - application workstream owns llm-agent/**, mcp-git-proxy/**, mcp-skills/** - re-pin standard-adoption manifest artifact digests after the ownership change - integration-owned regression test locks the contract: application must own every subproject requirement manifest and ticket-021 must resolve automated dependency updates for all six of them - ticket-021 (application) owns the six requirement manifests for automated dependency PRs (ticket-020 was terminally receipted by the validated merges of #32/#34) --- docs/dependency-ownership.md | 19 ------------------- project/ticket-019/intent.json | 2 +- project/ticket-021/intent.json | 6 +++++- tests/test_openwebui_configurator.py | 19 +++++++++++++++++++ 4 files changed, 25 insertions(+), 21 deletions(-) delete mode 100644 docs/dependency-ownership.md diff --git a/docs/dependency-ownership.md b/docs/dependency-ownership.md deleted file mode 100644 index a76c4b4..0000000 --- a/docs/dependency-ownership.md +++ /dev/null @@ -1,19 +0,0 @@ -# Subproject dependency ownership - -Every subproject requirement manifest is owned by the `application` -workstream and resolves to ticket-020 (cross-subproject dependency -maintenance). Automated dependency PRs that touch exactly these files -resolve to that single active ticket: - -| Manifest | Owner | -| --- | --- | -| `llm-agent/requirements.txt` | application / ticket-020 | -| `mcp-docs/requirements.txt` | application / ticket-020 | -| `mcp-gateway/requirements.txt` | application / ticket-020 | -| `mcp-git-proxy/requirements.txt` | application / ticket-020 | -| `mcp-skills/requirements.txt` | application / ticket-020 | -| `mcp-webui/requirements.txt` | application / ticket-020 | - -The managed standard contracts are pinned by `.governance/standard-adoption.json`; -its manifest artifact digest is re-pinned whenever the coordination -declaration changes through an adopted `goal governance` transaction. diff --git a/project/ticket-019/intent.json b/project/ticket-019/intent.json index e065ca4..474caf5 100644 --- a/project/ticket-019/intent.json +++ b/project/ticket-019/intent.json @@ -15,7 +15,7 @@ ".gitattributes", "project.bat", ".governance/manifest.json", - "docs/dependency-ownership.md" + "tests/test_openwebui_configurator.py" ], "forbiddenPaths": [ "project/ticket-*/user-*.md" diff --git a/project/ticket-021/intent.json b/project/ticket-021/intent.json index 1bf7d49..93df22d 100644 --- a/project/ticket-021/intent.json +++ b/project/ticket-021/intent.json @@ -13,7 +13,11 @@ "TODO.md", "project/TICKETS.md", "llm-agent/requirements.txt", - "mcp-skills/requirements.txt" + "mcp-skills/requirements.txt", + "mcp-docs/requirements.txt", + "mcp-gateway/requirements.txt", + "mcp-git-proxy/requirements.txt", + "mcp-webui/requirements.txt" ], "forbiddenPaths": [ "project/ticket-*/user-*.md" diff --git a/tests/test_openwebui_configurator.py b/tests/test_openwebui_configurator.py index 6f46ddf..dd383fc 100644 --- a/tests/test_openwebui_configurator.py +++ b/tests/test_openwebui_configurator.py @@ -130,3 +130,22 @@ def test_image_override_preserves_authenticated_boundary(override: str) -> None: for volume in webui["volumes"] ) assert "@sha256:" in services["redis"]["image"] + + +def test_application_workstream_owns_every_subproject_requirement_manifest(): + """Governance contract (ticket-019/ticket-021): the application workstream + owns all subproject requirement manifests, and ticket-021 resolves + automated dependency updates for them to exactly one active ticket.""" + import json + + manifest = json.loads((ROOT / ".governance" / "manifest.json").read_text(encoding="utf-8")) + owned = manifest["coordination"]["workstreams"]["application"]["ownedPaths"] + subprojects = ("llm-agent", "mcp-docs", "mcp-gateway", "mcp-git-proxy", "mcp-skills", "mcp-webui") + for name in subprojects: + assert f"{name}/**" in owned, f"application workstream must own {name}/**" + + intent = json.loads((ROOT / "project" / "ticket-021" / "intent.json").read_text(encoding="utf-8")) + allowed = set(intent["allowedPaths"]) + assert intent["workstream"] == "application" + for name in subprojects: + assert f"{name}/requirements.txt" in allowed, f"ticket-021 must own {name}/requirements.txt"