[ticket-060] fix(config): make Goal publisher retry-safe

TODO.md

@@ -2,6 +2,12 @@
 
 ## Governed architecture roadmap
 
+- [ ] Deliver [ticket-060](project/ticket-060/README.md): align Goal's own
+  tracked Python strategy with the retry-safe Twine contract while preserving
+  Node and Rust publishers. State: `IN_PROGRESS / PUBLICATION`; 618 tests
+  (2 skips), structural checks and governance pass; classification:
+  `BUG / P1 / regression`; depends on ticket-059.
+
 - [x] Deliver [ticket-059](project/ticket-059/README.md): align the default
   Python strategy and pip/pipenv descriptors with ticket-058's retry-safe
   Twine contract. State: `DONE / DONE`; 618 tests (2 skips), scoped Ruff,

goal.yaml

@@ -208,7 +208,7 @@ strategies:
   python:
     test: pytest tests/ -v
     build: python -m build
-    publish: twine upload dist/goal-{version}*
+    publish: twine upload --skip-existing dist/goal-{version}*
     publish_enabled: true
     dependencies:
       file: requirements.txt

project/TICKETS.md

@@ -62,4 +62,5 @@ This file indexes governance tickets without taking ownership of
 | **ticket-057** | [`README.md`](./ticket-057/README.md) | [`preprompt.md`](./ticket-057/preprompt.md) | - |  [`ai-codex.md`](./ticket-057/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-057/ai-codex-logs.txt) | [`changelog.md`](./ticket-057/changelog.md) |
 | **ticket-058** | [`README.md`](./ticket-058/README.md) | [`preprompt.md`](./ticket-058/preprompt.md) | - |  [`ai-codex.md`](./ticket-058/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-058/ai-codex-logs.txt) | [`changelog.md`](./ticket-058/changelog.md) |
 | **ticket-059** | [`README.md`](./ticket-059/README.md) | [`preprompt.md`](./ticket-059/preprompt.md) | - |  [`ai-codex.md`](./ticket-059/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-059/ai-codex-logs.txt) | [`changelog.md`](./ticket-059/changelog.md) |
+| **ticket-060** | [`README.md`](./ticket-060/README.md) | [`preprompt.md`](./ticket-060/preprompt.md) | - |  [`ai-codex.md`](./ticket-060/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-060/ai-codex-logs.txt) | [`changelog.md`](./ticket-060/changelog.md) |
 <!-- AUTO:TICKET_INDEX:END -->

project/ticket-060/README.md

@@ -0,0 +1,45 @@
+# Ticket 060: Repair Goal publish strategy configuration
+
+- **ID**: ticket-060
+- **Owner**: unresolved:human
+- **Status**: IN_PROGRESS
+- **Workflow state**: PUBLICATION
+- **Created**: 2026-08-12
+
+## Goal and scope
+
+Repair Goal's own tracked Python publish strategy so it matches the retry-safe
+runtime, doctor and producer contract delivered by tickets 058 and 059. The
+change is limited to one scalar in `goal.yaml`; the existing Node and Rust
+strategies must remain byte-for-byte unchanged.
+
+## Acceptance criteria
+
+- [x] AC-01: The user's instruction to repair and continue records
+  `SESSION_EXECUTION_AUTHORIZATION` for this bounded configuration fix.
+- [x] AC-02: `strategies.python.publish` is the canonical retry-safe Goal
+  artifact command.
+- [x] AC-03: The Node and Rust publish commands remain `npm publish` and
+  `cargo publish` respectively.
+- [x] AC-04: Structural parsing, full tests and governance pass before
+  protected exact-head delivery.
+
+## Non-goals
+
+- Do not change Goal runtime, doctor or configuration producers.
+- Do not change versions, dependencies, Node/Rust behavior or CI.
+
+## Participants
+
+- Human participant: unresolved; no user-* file was created by this script.
+- Agent participant: [ai-codex.md](ai-codex.md)
+
+## Validation evidence
+
+- Structural YAML parsing proves the Python command equals
+  `twine upload --skip-existing dist/goal-{version}*`, while Node and Rust
+  remain `npm publish` and `cargo publish`.
+- The implementation diff is exactly one insertion and one deletion in
+  `goal.yaml`.
+- The full suite passes 618 tests with 2 existing skips; governance reports
+  0 errors/0 warnings and whitespace validation passes.

project/ticket-060/ai-codex-logs.txt

@@ -0,0 +1,5 @@
+2026-08-12T18:22:00Z ticket-060 allocated on clean accepted base 506551111e1deae82d5fad2801a88930081118d5 after ticket-059 closure and workspace cleanup.
+2026-08-12T18:22:00Z SESSION_EXECUTION_AUTHORIZATION recorded from the user's repeated instruction to repair and continue.
+2026-08-12T18:22:00Z scope: one governance-owned goal.yaml scalar; current Python command is stale, while Node npm publish and Rust cargo publish are already correct and must remain unchanged.
+2026-08-12T18:23:00Z implementation: changed exactly strategies.python.publish to twine upload --skip-existing dist/goal-{version}*; git numstat is 1 insertion/1 deletion.
+2026-08-12T18:23:00Z validation: structural YAML assertions PASS for Python, Node and Rust publishers; 618 full PASS/2 SKIP; governance GOV-PASS 0 errors/0 warnings; git diff --check PASS.

project/ticket-060/ai-codex.md

@@ -0,0 +1,39 @@
+---
+participant-id: agent:codex
+participant: codex
+role: agent
+ticket: ticket-060
+---
+# Participant: codex (AI agent)
+
+## Understanding
+
+Tickets 058 and 059 made execution and every built-in producer retry-safe, but
+Goal's own tracked configuration still carries the pre-fix command. This final
+configuration slice removes that drift without touching application-owned
+code or the already-correct Node/Rust publishers.
+
+## Execution plan
+
+1. Bind the ticket to the single governance-owned configuration scalar.
+2. Change only the Python publisher and structurally assert all three strategy
+   commands.
+3. Run full validation and deliver the exact candidate through protected CI
+   and Validator Agent review.
+
+## Actual changes
+
+- Initialized the bounded ticket and recorded SESSION_EXECUTION_AUTHORIZATION
+  from the request to execute this work.
+- Preserved the existing Node and Rust strategy values as explicit acceptance
+  evidence rather than widening the change.
+- Changed only the Python publish scalar and structurally verified all three
+  strategy values.
+- Passed 618 full tests (2 existing skips), governance and whitespace
+  validation; moved to PUBLICATION for protected exact-head review.
+
+## Blockers
+
+- None inside the recorded intent; proceed without a second confirmation.
+- New authority remains required for destructive action, secret access, new
+  external coordination, material objective expansion and trusted merge.

project/ticket-060/changelog.md

@@ -0,0 +1,10 @@
+# Ticket Changelog (ticket-060)
+
+## [0.1.0] - 2026-08-12
+
+- Initial governance scaffold created.
+- No human participant identity or content was generated.
+- Bounded the configuration repair to Goal's tracked Python publish scalar and
+  declared sibling publisher preservation as acceptance evidence.
+- Made the Python publisher retry-safe, preserved Node/Rust values, and passed
+  structural, full-suite and governance validation.

project/ticket-060/intent.json

@@ -0,0 +1,78 @@
+{
+  "schema": "new-project.intent/v3",
+  "ticket": "ticket-060",
+  "summary": "Repair Goal publish strategy configuration",
+  "workstream": "governance",
+  "classification": {
+    "kind": "BUG",
+    "priority": "P1",
+    "origin": "regression"
+  },
+  "allowedPaths": [
+    "goal.yaml",
+    "project/ticket-060/**",
+    "TODO.md",
+    "project/TICKETS.md"
+  ],
+  "forbiddenPaths": [
+    "project/ticket-*/user-*.md",
+    "goal/**",
+    "tests/**",
+    "VERSION",
+    "pyproject.toml",
+    "uv.lock",
+    ".github/**"
+  ],
+  "stacks": ["python"],
+  "dependsOn": ["ticket-059"],
+  "conflictsWith": [],
+  "integrationTicket": null,
+  "delivery": {
+    "acceptedBaseSha": "506551111e1deae82d5fad2801a88930081118d5",
+    "targetBranch": "main",
+    "outcome": "Goal's tracked Python strategy is retry-safe without altering sibling publishers",
+    "nonGoals": [
+      "Do not change application source or tests",
+      "Do not change Node or Rust strategies",
+      "Do not change package versions or dependencies"
+    ],
+    "complexity": "XS",
+    "estimatedMinutes": 10,
+    "budgets": {
+      "maxImplementationFiles": 1,
+      "maxAffectedComponents": 1,
+      "maxPublicInterfaceChanges": 0,
+      "maxRuntimeDependencies": 0
+    },
+    "architecture": {
+      "status": "accepted",
+      "decision": "Change only the Python publish scalar and verify all three parsed strategy values",
+      "components": [
+        {"name": "goal-configuration", "paths": ["goal.yaml"]}
+      ],
+      "responsibilityChanges": false,
+      "interfaceChanges": [],
+      "dataChanges": [],
+      "ui": {"impact": "none", "states": [], "evidence": []},
+      "rollback": "Revert the one-line configuration PR; runtime normalization still protects Twine execution"
+    },
+    "runtimeDependencies": [],
+    "validation": [
+      {
+        "criterion": "AC-02",
+        "commands": ["python -c structural goal.yaml strategy assertion"],
+        "evidence": "project/ticket-060/ai-codex-logs.txt"
+      },
+      {
+        "criterion": "AC-03",
+        "commands": ["git diff --word-diff=porcelain -- goal.yaml"],
+        "evidence": "project/ticket-060/ai-codex-logs.txt"
+      },
+      {
+        "criterion": "AC-04",
+        "commands": ["pytest -q", "./project/governance-check.sh"],
+        "evidence": "project/ticket-060/ai-codex-logs.txt"
+      }
+    ]
+  }
+}

project/ticket-060/preprompt.md

@@ -0,0 +1,12 @@
+# Ticket preprompt
+
+- **Task ID**: ticket-060
+- **Task title**: Repair Goal publish strategy configuration
+- **Created**: 2026-08-12T18:22:33Z
+
+Keep executable implementation outside this governance/evidence directory.
+Read a human-owned user-*.md file only when one exists.
+The request to execute this work creates SESSION_EXECUTION_AUTHORIZATION;
+proceed within the recorded intent without a redundant confirmation prompt.
+Require new authority for destructive action, secrets, external coordination,
+material objective expansion and trusted merge approval.