semcod · tom-sapletta-com · Aug 1, 2026 · Aug 1, 2026 · Aug 1, 2026 · Aug 1, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -477,6 +477,29 @@
   from MIT to Apache License 2.0; README and container/package metadata now use
   the same SPDX identity.
 
+## [0.5.2] - 2026-08-04
+
+### Docs
+- Update README.md
+- Update TODO.md
+- Update project/README.md
+- Update project/context.md
+- Update project/ticket-018/README.md
+- Update project/ticket-018/changelog.md
+
+### Other
+- Update project/analysis.toon.yaml
+- Update project/calls.mmd
+- Update project/calls.png
+- Update project/calls.toon.yaml
+- Update project/calls.yaml
+- Update project/compact_flow.mmd
+- Update project/compact_flow.png
+- Update project/evolution.toon.yaml
+- Update project/flow.mmd
+- Update project/flow.png
+- ... and 38 more files
+
 ## [0.5.1] - 2026-08-01
 
 ### Docs

diff --git a/README.md b/README.md
@@ -3,18 +3,16 @@
 
 ## AI Cost Tracking
 
-![PyPI](https://img.shields.io/badge/pypi-costs-blue) ![Version](https://img.shields.io/badge/version-0.5.1-blue) ![Python](https://img.shields.io/badge/python-3.9+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
-![AI Cost](https://img.shields.io/badge/AI%20Cost-$3.86-orange) ![Human Time](https://img.shields.io/badge/Human%20Time-36.0h-blue) ![Model](https://img.shields.io/badge/Model-openrouter%2Fqwen%2Fqwen3--coder--next-lightgrey)
+![PyPI](https://img.shields.io/badge/pypi-costs-blue) ![Version](https://img.shields.io/badge/version-0.5.2-blue) ![Python](https://img.shields.io/badge/python-3.9+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
+![AI Cost](https://img.shields.io/badge/AI%20Cost-$7.69-orange) ![Human Time](https://img.shields.io/badge/Human%20Time-50.0h-blue) ![Model](https://img.shields.io/badge/Model-openrouter%2Fqwen%2Fqwen3--coder--next-lightgrey)
 
-- 🤖 **LLM usage:** $3.8584 (110 commits)
-- 👤 **Human dev:** ~$3603 (36.0h @ $100/h, 30min dedup)
+- 🤖 **LLM usage:** $7.6898 (128 commits)
+- 👤 **Human dev:** ~$4997 (50.0h @ $100/h, 30min dedup)
 
-Generated on 2026-08-01 using [openrouter/qwen/qwen3-coder-next](https://openrouter.ai/qwen/qwen3-coder-next)
+Generated on 2026-08-04 using [openrouter/qwen/qwen3-coder-next](https://openrouter.ai/qwen/qwen3-coder-next)
 
 ---
 
-
-
 ![License](https://img.shields.io/badge/license-Apache--2.0-green)
 
 `todo2code` buduje wspólny **Intent Evidence DSL** z poleceń, historii Git, aktualnego kodu, list zadań, changelogu i dokumentacji. Następnie łączy rekordy w graf przepływu wiedzy, wykrywa rozbieżności i generuje raport dla zespołu.

diff --git a/TODO.md b/TODO.md
@@ -2,14 +2,6 @@
 
 ## Active tickets
 
-- [ ] [`ticket-020`](project/ticket-020/README.md) — implement a role-bound
-  trusted intake boundary with persistent manager/user/dev assignments,
-  CQRS/event sourcing, strict schemas, Protobuf, Python/TypeScript CLI, MCP and
-  A2A parity. Current state: `BLOCKED / VALIDATION`; implementation, full Node
-  verification and Docker core E2E pass. Policy 0.8.0 accepts tickets 018 and
-  020 in parallel; the global gate now reports only ticket-019's declared
-  dependency, conflict, ownership and overlap violations.
-
 - [ ] [`ticket-019`](project/ticket-019/README.md) — publish the dependency-free
   Python SDK as the root PyPI distribution `todo2code` through `goal -a`, with
   one root `pyproject.toml` and SDK-only artifacts. Current state:
@@ -21,15 +13,26 @@
   validator, trusted approval boundary, reusable governance CI, stack-specific
   gates and pinned adoption in `todo2code`; extend it with safe concurrent
   workstreams, dependency-aware intents and non-overlapping write scopes.
-  Current state: `IN_PROGRESS / EDIT` for the approved AC-18..AC-25: add a
+  Current state: `IN_PROGRESS / WAIT_FOR_APPROVAL` for the approved AC-11..AC-25:
   pinned, read-only and attested `koru / code-review` PR check plus a required
-  ruleset. The workflow and live fail-closed semantic probe are verified;
-  ruleset `20186914` is staged for activation after the bootstrap evidence merge.
+  ruleset. `koru / code-review` and `governance / enforce` now run as required
+  checks on `main`; the ruleset is active with no bypass actors.
   Earlier AC-11..AC-16 pass; AC-17 and the pre-existing publication/external
   governance blockers remain recorded separately.
 
 ## Completed tickets
 
+- [x] [`ticket-020`](project/ticket-020/README.md) — add deterministic
+  trusted intake boundary with CQRS/event sourcing, strict schemas, Protobuf,
+  Python/TypeScript CLI, MCP and A2A parity. Current state: `DONE`;
+  implementation and verification passes, and the implementation is complete.
+
+- [x] [`ticket-022`](project/ticket-022/README.md) — add bounded, read-only Git
+  evidence extraction for umbrella workspaces such as Subactor. Current state:
+  `DONE`; 337 tests and Docker smoke pass. The Subactor run now extracts 326
+  commits from 39 member repositories, adds 41,792 net relations and reduces
+  same-snapshot diagnostics by 275.
+
 - [x] [`ticket-017`](project/ticket-017/README.md) — repaired mutating command
   help, Polish prohibition polarity and repository-bound path resolution;
   independently audited the concurrent path/action-planning baseline and added

diff --git a/VERSION b/VERSION
@@ -1 +1 @@
-0.5.1
+0.5.2
diff --git a/adapters/tensorflow/package.json b/adapters/tensorflow/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@todo2code/tensorflow-adapter-runtime",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "private": true,
   "description": "Isolated optional TensorFlow runtime for todo2code action classification.",
   "license": "Apache-2.0",

diff --git a/examples/backend/src/request-handlers.ts b/examples/backend/src/request-handlers.ts
@@ -0,0 +1,88 @@
+import { type IncomingMessage, type ServerResponse } from 'node:http';
+import { EventStore } from './store.js';
+import { validateEventPayload } from './validation.js';
+
+const MAX_BODY_BYTES = 64 * 1024;
+
+export async function handleRequest(
+  request: IncomingMessage,
+  response: ServerResponse,
+  store: EventStore,
+): Promise<void> {
+  const url = new URL(request.url ?? '/', `http://${request.headers.host ?? 'localhost'}`);
+  if (url.pathname === '/health' && request.method === 'GET') {
+    return handleHealth(response, store);
+  }
+  if (url.pathname === '/events' && request.method === 'POST') {
+    return handleEventPublish(request, response, store);
+  }
+  if (url.pathname === '/events' && request.method === 'GET') {
+    return handleEventList(response, url.searchParams, store);
+  }
+  sendJson(response, 404, { error: 'not found' });
+}
+
+async function handleHealth(response: ServerResponse, store: EventStore): Promise<void> {
+  sendJson(response, 200, { status: 'ok', events: store.size() });
+}
+
+async function handleEventPublish(request: IncomingMessage, response: ServerResponse, store: EventStore): Promise<void> {
+  const body = await readBody(request);
+  let payload: unknown;
+  try {
+    payload = JSON.parse(body || '{}');
+  } catch {
+    sendJson(response, 400, { error: 'invalid JSON body' });
+    return;
+  }
+
+  const validation = validateEventPayload(payload);
+  if (!validation.valid) {
+    process.stderr.write(`rejected event: ${validation.reason}\n`);
+    sendJson(response, 400, { error: validation.reason });
+    return;
+  }
+
+  const event = store.enqueueEvent(validation.agent, validation.action, validation.object);
+  sendJson(response, 202, { id: event.id });
+}
+
+async function handleEventList(response: ServerResponse, params: URLSearchParams, store: EventStore): Promise<void> {
+  const offset = parseOffset(params.get('offset'));
+  const limit = parseLimit(params.get('limit'));
+  sendJson(response, 200, store.listEvents(
+    offset,
+    limit,
+  ));
+}
+
+function parseOffset(value: string | null): number {
+  const parsed = Number(value);
+  return Number.isFinite(parsed) ? parsed : 0;
+}
+
+function parseLimit(value: string | null): number {
+  const parsed = Number(value);
+  return Number.isFinite(parsed) ? parsed : 50;
+}
+
+async function readBody(request: IncomingMessage): Promise<string> {
+  const chunks: Buffer[] = [];
+  let size = 0;
+  for await (const chunk of request) {
+    const buffer = Buffer.from(chunk as Buffer);
+    size += buffer.byteLength;
+    if (size > MAX_BODY_BYTES) throw new Error('request body too large');
+    chunks.push(buffer);
+  }
+  return Buffer.concat(chunks).toString('utf8');
+}
+
+function sendJson(response: ServerResponse, status: number, payload: unknown): void {
+  const body = JSON.stringify(payload);
+  response.writeHead(status, {
+    'content-type': 'application/json; charset=utf-8',
+    'content-length': Buffer.byteLength(body),
+  });
+  response.end(body);
+}
diff --git a/examples/backend/src/server.ts b/examples/backend/src/server.ts
@@ -3,11 +3,9 @@
 // Mirrors the todo2code house style: node: builtins only, explicit body limits
 // and no framework, so `t2c extract ast` sees plain TypeScript declarations.
 
-import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http';
+import { createServer, type Server, type ServerResponse } from 'node:http';
 import { EventStore } from './store.js';
-import { validateEventPayload } from './validation.js';
-
-const MAX_BODY_BYTES = 64 * 1024;
+import { handleRequest } from './request-handlers.js';
 
 export interface BackendOptions {
   host?: string;
@@ -25,60 +23,6 @@ export function createBackend(options: BackendOptions = {}): { server: Server; s
   return { server, store };
 }
 
-async function handleRequest(request: IncomingMessage, response: ServerResponse, store: EventStore): Promise<void> {
-  const url = new URL(request.url ?? '/', `http://${request.headers.host ?? 'localhost'}`);
-
-  if (request.method === 'GET' && url.pathname === '/health') {
-    sendJson(response, 200, { status: 'ok', events: store.size() });
-    return;
-  }
-
-  if (request.method === 'POST' && url.pathname === '/events') {
-    const body = await readBody(request);
-    let payload: unknown;
-    try {
-      payload = JSON.parse(body || '{}');
-    } catch {
-      sendJson(response, 400, { error: 'invalid JSON body' });
-      return;
-    }
-    const validation = validateEventPayload(payload);
-    if (!validation.valid) {
-      // Every rejection is logged with its reason, per the acceptance criteria.
-      process.stderr.write(`rejected event: ${validation.reason}\n`);
-      sendJson(response, 400, { error: validation.reason });
-      return;
-    }
-    const event = store.enqueueEvent(validation.agent, validation.action, validation.object);
-    sendJson(response, 202, { id: event.id });
-    return;
-  }
-
-  if (request.method === 'GET' && url.pathname === '/events') {
-    const offset = Number(url.searchParams.get('offset') ?? '0');
-    const limit = Number(url.searchParams.get('limit') ?? '50');
-    sendJson(response, 200, store.listEvents(
-      Number.isFinite(offset) ? offset : 0,
-      Number.isFinite(limit) ? limit : 50,
-    ));
-    return;
-  }
-
-  sendJson(response, 404, { error: 'not found' });
-}
-
-async function readBody(request: IncomingMessage): Promise<string> {
-  const chunks: Buffer[] = [];
-  let size = 0;
-  for await (const chunk of request) {
-    const buffer = Buffer.from(chunk as Buffer);
-    size += buffer.byteLength;
-    if (size > MAX_BODY_BYTES) throw new Error('request body too large');
-    chunks.push(buffer);
-  }
-  return Buffer.concat(chunks).toString('utf8');
-}
-
 function sendJson(response: ServerResponse, status: number, payload: unknown): void {
   const body = JSON.stringify(payload);
   response.writeHead(status, {

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "todo2code",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "todo2code (t2c): audited intent and team-communication extraction, evidence graphs, origin-to-workspace comparison and grounded summaries through CLI, MCP and A2A.",
   "type": "module",
   "private": true,

diff --git a/project/README.md b/project/README.md
@@ -331,10 +331,10 @@ code2llm ./ -f yaml --separate-orphans
 
 ---
 
-**Generated by**: `code2llm ./ -f all --readme`
-**Analysis Date**: 2026-08-01
-**Total Functions**: 3285
-**Total Classes**: 348
-**Modules**: 262
+**Generated by**: `code2llm ./ -f all --readme`  
+**Analysis Date**: 2026-08-04  
+**Total Functions**: 4129  
+**Total Classes**: 404  
+**Modules**: 281  
 
 For more information about code2llm, visit: https://github.com/tom-sapletta/code2llm
diff --git a/project/TICKETS.md b/project/TICKETS.md
@@ -26,4 +26,5 @@ of `project/README.md`, which remains a generated technical-analysis artifact.
 | **ticket-018** | [`README.md`](./ticket-018/README.md) | [`preprompt.md`](./ticket-018/preprompt.md) | - |  [`ai-codex.md`](./ticket-018/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-018/ai-codex-logs.txt) | [`changelog.md`](./ticket-018/changelog.md) |
 | **ticket-019** | [`README.md`](./ticket-019/README.md) | [`preprompt.md`](./ticket-019/preprompt.md) | - |  [`ai-codex.md`](./ticket-019/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-019/ai-codex-logs.txt) | [`changelog.md`](./ticket-019/changelog.md) |
 | **ticket-020** | [`README.md`](./ticket-020/README.md) | [`preprompt.md`](./ticket-020/preprompt.md) | - |  [`ai-codex.md`](./ticket-020/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-020/ai-codex-logs.txt) | [`changelog.md`](./ticket-020/changelog.md) |
+| **ticket-022** | [`README.md`](./ticket-022/README.md) | [`preprompt.md`](./ticket-022/preprompt.md) | - |  [`ai-codex.md`](./ticket-022/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-022/ai-codex-logs.txt) | [`changelog.md`](./ticket-022/changelog.md) |
 <!-- AUTO:TICKET_INDEX:END -->