From eb25408e9c4bdc0667452d08411d5082627350e2 Mon Sep 17 00:00:00 2001 From: Tom Softreck Date: Tue, 4 Aug 2026 17:56:28 +0200 Subject: [PATCH] docs(governance): record AC-40 validator evidence --- project/ticket-018/README.md | 2 +- project/ticket-018/ai-codex-logs.txt | 12 ++++++++++++ project/ticket-018/ai-codex.md | 7 +++++++ 3 files changed, 20 insertions(+), 1 deletion(-) diff --git a/project/ticket-018/README.md b/project/ticket-018/README.md index 7f7249e..1ea22b2 100644 --- a/project/ticket-018/README.md +++ b/project/ticket-018/README.md @@ -247,7 +247,7 @@ existing README/runbook/permissions documentation. No application source in and mutable/unpinned heads are rejected. - [x] AC-39: Focused negative/positive tests, both complete repository suites, governance, Java, gold, SDK examples and Docker smoke pass. -- [ ] AC-40: After a separately trusted bootstrap review merges the policy, +- [x] AC-40: After a separately trusted bootstrap review merges the policy, the real Validator App reviews PR #13 at its exact SHA and the rerun proves `governance / enforce` accepts that independent agent evidence. diff --git a/project/ticket-018/ai-codex-logs.txt b/project/ticket-018/ai-codex-logs.txt index 7bcd4f8..c129dbc 100644 --- a/project/ticket-018/ai-codex-logs.txt +++ b/project/ticket-018/ai-codex-logs.txt @@ -356,3 +356,15 @@ repository selection: all transition: BLOCKED -> IN_PROGRESS / VALIDATION next boundary: publish a fresh ticket-only head, pass deterministic hosted checks, then request an exact-head direct-pr review from the installed App +2026-08-04 AC-40 LIVE VALIDATION COMPLETE +bootstrap PR #14 merge: 944feda7b3914f747cc67d3682ce8427a7305ff4 +reviewed PR #13 head: 68b0c0985f0aa95f8a41e252399491fe7aea29ca +Validator App review run: 30925171580; actor ifuri-validator-agent[bot] +review bindings: ticket-034; correlation todo2code-pr-13-ticket-034-68b0c098 +model: openrouter/z-ai/glm-5.2 +post-review governance run: 30925337717; governance PASS; verify PASS; Java PASS +PR #13 merge: 4387943e4095926fe2466628b767c3dd83034281 +full-diff historical audit run: 30926415029; dry-run/no mutations +diff coverage: 29170 characters, 12 files, 3 complete non-overlapping chunks +aggregated semantic verdict: APPROVE; checks verify/Java/Koru PASS +state: AC-40 complete diff --git a/project/ticket-018/ai-codex.md b/project/ticket-018/ai-codex.md index de1241d..917f757 100644 --- a/project/ticket-018/ai-codex.md +++ b/project/ticket-018/ai-codex.md @@ -205,6 +205,13 @@ Current verified baseline: Approval evidence is generated in `runner.temp` and bound to repository, PR, current head, ticket and actor. The earlier checkout-owned resolver is detached from CI and retained only until the tracked generated-analysis index is refreshed. +- Completed AC-40 after App installation. Validator run `30925171580` approved + PR #13 at exact head `68b0c0985f0aa95f8a41e252399491fe7aea29ca`, and + post-review run `30925337717` proved the protected governance resolver accepted + the App evidence. A later read-only historical audit fixed the previously + truncated semantic input and reviewed all 29,170 diff characters across 12 + files in three non-overlapping chunks; run `30926415029` returned `APPROVE` + without creating a review, comment, commit or merge. ## Blockers