[ticket-057] docs(governance): close Goal 2.1.299 release

TODO.md

@@ -2,6 +2,14 @@
 
 ## Governed architecture roadmap
 
+- [x] Deliver [ticket-057](project/ticket-057/README.md): publish the merged
+  mutation-free PR-resume repair as Goal 2.1.299. State: `DONE / DONE`; PR #94
+  passed 607 tests (2 skips), Python 3.12/3.13, Ruff, governance, build, Docker
+  and exact-head Validator approval, then merged as `4db0b042...`. PyPI,
+  annotated `v2.1.299` and the final GitHub Release are bound to that merge;
+  a fresh public-index install proved Git-common audit storage; classification:
+  `SERVICE / P0 / requested`; depends on ticket-056.
+
 - [x] Deliver [ticket-056](project/ticket-056/README.md): make canonical bare
   `goal -a` infer exactly one active governed ticket before bootstrap and keep
   committed PR resume plus delivery audit mutation-free. State: `DONE / DONE`;

project/TICKETS.md

@@ -59,4 +59,5 @@ This file indexes governance tickets without taking ownership of
 | **ticket-054** | [`README.md`](./ticket-054/README.md) | [`preprompt.md`](./ticket-054/preprompt.md) | - |  [`ai-codex.md`](./ticket-054/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-054/ai-codex-logs.txt) | [`changelog.md`](./ticket-054/changelog.md) |
 | **ticket-055** | [`README.md`](./ticket-055/README.md) | [`preprompt.md`](./ticket-055/preprompt.md) | - |  [`ai-codex.md`](./ticket-055/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-055/ai-codex-logs.txt) | [`changelog.md`](./ticket-055/changelog.md) |
 | **ticket-056** | [`README.md`](./ticket-056/README.md) | [`preprompt.md`](./ticket-056/preprompt.md) | - |  [`ai-codex.md`](./ticket-056/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-056/ai-codex-logs.txt) | [`changelog.md`](./ticket-056/changelog.md) |
+| **ticket-057** | [`README.md`](./ticket-057/README.md) | [`preprompt.md`](./ticket-057/preprompt.md) | - |  [`ai-codex.md`](./ticket-057/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-057/ai-codex-logs.txt) | [`changelog.md`](./ticket-057/changelog.md) |
 <!-- AUTO:TICKET_INDEX:END -->

project/ticket-057/README.md

@@ -2,8 +2,8 @@
 
 - **ID**: ticket-057
 - **Owner**: unresolved:human
-- **Status**: IN_PROGRESS
-- **Workflow state**: PUBLICATION
+- **Status**: DONE
+- **Workflow state**: DONE
 - **Created**: 2026-08-12
 
 ## Goal and scope
@@ -16,16 +16,16 @@ retested merge SHA. Prove the public package by resuming the already committed
 
 ## Acceptance criteria
 
-- [ ] AC-01: The governed PR synchronizes exactly VERSION, `pyproject.toml`,
+- [x] AC-01: The governed PR synchronizes exactly VERSION, `pyproject.toml`,
       `goal/__init__.py`, README version badges and `uv.lock` to 2.1.299, plus
       this ticket's governance evidence.
-- [ ] AC-02: Full tests, scoped Ruff, governance, wheel/sdist and Docker pass;
+- [x] AC-02: Full tests, scoped Ruff, governance, wheel/sdist and Docker pass;
       protected CI and Validator Agent approve the exact final PR head.
-- [ ] AC-03: The clean merged `main` is retested before registry, tag or
+- [x] AC-03: The clean merged `main` is retested before registry, tag or
       Release effects and produces exactly one wheel and one sdist for 2.1.299.
-- [ ] AC-04: Annotated `v2.1.299`, final GitHub Release and PyPI artifacts all
+- [x] AC-04: Annotated `v2.1.299`, final GitHub Release and PyPI artifacts all
       bind to the exact clean merge and immutable hashes are recorded.
-- [ ] AC-05: A fresh public-index install reports 2.1.299 and resumes the real
+- [x] AC-05: A fresh public-index install reports 2.1.299 and resumes the real
       new-project ticket-072 pull-request candidate while its tree stays clean.
 
 ## Boundary
@@ -54,6 +54,35 @@ retested merge SHA. Prove the public package by resuming the already committed
   the exact candidate must write events below the Git common directory and
   leave no checkout file, including when no ignore masks that path.
 
+## Delivery and publication evidence
+
+- Release PR #94 passed Python 3.12/3.13 and remote lifecycle checks on exact
+  HEAD `61695d9ce9ea65081ca7c3753d29687033ca6cae`; Validator review
+  `4919198753` approved that SHA without findings.
+- PR #94 merged as `4db0b042688385684dcd8d536c0b4128d1905e0a`; the merge's second
+  parent and tree equal the approved candidate. Post-merge run `31621738849`
+  passed on that exact merge.
+- Clean merged `main` passed 607 tests with 2 existing skips before any
+  publication effect. The candidate also passed scoped Ruff, governance,
+  wheel/sdist build and Docker CLI smoke; temporary build output and image
+  `sha256:ffd9adc8765af4bdd590006d949b6ec392005cf4f9a048809ad7accec5912b2b`
+  were removed.
+- PyPI contains exactly `goal-2.1.299-py3-none-any.whl` (338730 bytes,
+  SHA-256 `836b75f04a656772736fd18072c2a7f495c18a124e47c07b47bc948be44658d4`)
+  and `goal-2.1.299.tar.gz` (384097 bytes, SHA-256
+  `de60a91480afc4cfd20f1f7ff1719a61d2f39b7d35eaafaf47766832f00d284f`).
+- Annotated tag object `525741c32e0f707aafd3292d015f2ae0be8f8e34` peels to exact merge
+  `4db0b042...`. The final, non-draft GitHub Release at
+  `https://github.com/semcod/goal/releases/tag/v2.1.299` carries byte-identical
+  copies of both PyPI artifacts.
+- A fresh public-index 2.1.299 install imported only from isolated
+  site-packages and resumed the real historical new-project ticket-072 commit
+  `d212d9d9...` against its exact authoritative base `3a997d6b...`. The
+  bounded replay used a local bare remote and local `gh` contract double:
+  it pushed exact `goal/ticket-072`, recorded both events below
+  `.git/goal-delivery`, and left the checkout byte-clean. The already completed
+  GitHub ticket was not reopened; the real repository retained zero open PRs.
+
 ## Participants
 
 - Human participant: unresolved; no user-* file was created by this script.

project/ticket-057/ai-codex-logs.txt

@@ -5,3 +5,12 @@ passed tests and 2 skips, but reproduced its known checkout-local audit path.
 The exact two-event file and the temporary .git/info/exclude workaround were
 removed. The CLI was then installed editable from merged main so the release
 candidate can prove ticket-056 before 2.1.299 is published.
+2026-08-12T17:10:00Z candidate: PR #94 exact HEAD 61695d9ce9ea65081ca7c3753d29687033ca6cae; 607 tests PASS/2 SKIP twice; scoped Ruff, governance, wheel/sdist build and Docker smoke PASS; Docker image sha256:ffd9adc8765af4bdd590006d949b6ec392005cf4f9a048809ad7accec5912b2b removed.
+2026-08-12T17:12:00Z protected validation: Python 3.12/3.13 and remote lifecycle PASS; trusted Validator review 4919198753 approved exact PR HEAD without findings.
+2026-08-12T17:13:00Z merge: PR #94 merged as 4db0b042688385684dcd8d536c0b4128d1905e0a; merge parent2 and tree equal approved candidate; remote branch deleted; post-merge run 31621738849 PASS.
+2026-08-12T17:18:00Z publication: clean merged main retested 607 PASS/2 SKIP; PyPI 2.1.299 wheel sha256 836b75f04a656772736fd18072c2a7f495c18a124e47c07b47bc948be44658d4 size 338730; sdist sha256 de60a91480afc4cfd20f1f7ff1719a61d2f39b7d35eaafaf47766832f00d284f size 384097.
+2026-08-12T17:23:40Z immutable tag: annotated object 525741c32e0f707aafd3292d015f2ae0be8f8e34 peels to exact merge 4db0b042688385684dcd8d536c0b4128d1905e0a.
+2026-08-12T17:24:39Z final Release: https://github.com/semcod/goal/releases/tag/v2.1.299; downloaded GitHub assets are byte-identical to the two public PyPI files.
+2026-08-12T17:30:00Z public probe: isolated public-index install reports 2.1.299, imports from its temporary site-packages and resolves delivery audit to .git/goal-delivery/delivery-events.jsonl; temporary environment removed.
+2026-08-12T17:33:20Z AC-05 public replay: isolated public Goal 2.1.299 resumed exact real ticket-072 candidate d212d9d9ed7a1a708faadff2b6ce990d0f7949be against local authoritative base 3a997d6b022faab5f6f6915eacad3cc02ac76c57, pushed exact goal/ticket-072 to a local bare remote, completed through a local gh contract double, wrote started/pull-request events only below .git/goal-delivery and left the checkout clean; actual wellmanifest/new-project retained zero open PRs.
+2026-08-12T17:32:00Z cleanup: temporary release config, public verification environments, downloaded assets, build, dist and Docker image absent; Goal main remains exact and clean.

project/ticket-057/ai-codex.md

@@ -26,6 +26,14 @@ release carriers and proves the public package on the failing real candidate.
 - Initialized the bounded ticket and recorded SESSION_EXECUTION_AUTHORIZATION
   from the request to execute this work.
 - Declared a metadata-only release boundary; ticket-056 owns all source code.
+- Synchronized the five release carriers, ran the complete local/build/Docker
+  validation and delivered PR #94 through exact-head Validator approval.
+- Published immutable PyPI artifacts, an annotated tag and a final GitHub
+  Release exclusively from clean merge `4db0b042...`.
+- Installed 2.1.299 from the public index and replayed the exact historical
+  new-project ticket-072 candidate against a bounded local remote/PR contract.
+  Full resume completed with Git-common audit storage and a clean checkout,
+  without reopening the already completed GitHub ticket.
 
 ## Blockers
 

project/ticket-057/changelog.md

@@ -5,3 +5,9 @@
 - Initial governance scaffold created.
 - No human participant identity or content was generated.
 - Declared the metadata-only Goal 2.1.299 release and public-package proof.
+- Delivered the exact release candidate through protected CI and Validator
+  approval, then published only from its clean, retested merge.
+- Recorded immutable PyPI hashes, the exact annotated tag target and a final
+  GitHub Release with byte-identical assets.
+- Proved the fresh public wheel stores delivery audit data below Git common
+  metadata and closed the lifecycle without recreating completed ticket-072.