docs: 2026-10-09 landing record — PRs #76–#85, Dependabot supersessions, blocked v0.1.1 tag

CHANGELOG.md

@@ -4,7 +4,14 @@ All notable changes to TeaAgent are tracked here.
 
 ## Unreleased
 
-- Nothing yet.
+- **Dependency bumps** (one PR per bump, each reproduced on current `main`
+  with `uv lock --upgrade-package`; supersedes the stalled Dependabot PRs):
+  `actions/setup-python` 7, `github/codeql-action` 4.37.3, `pytest` 9.1.1,
+  `ruff` 0.15.20, `redis` 8.0.1, `hypothesis` 6.155.7, `google-adk` 2.3.0,
+  `pip` 26.1.2 (lock only). The lock now records the project version 0.1.1.
+- **Test robustness**: `test_heartbeat_writes_liveness_file` waits for the
+  first heartbeat tick with a 5 s deadline instead of a fixed 0.08 s sleep
+  (one red CI run on a loaded coverage runner; both assertions kept).
 
 ## 0.1.1 - 2026-10-09
 

docs/generated/docs-inventory.md

@@ -246,7 +246,7 @@ Do not edit this file manually — regenerate instead.
 | `gateway-oauth-tenants.md` | working | 1818 | `0ff9c7df4652` |
 | `generated/command-snippet-inventory.md` | working | 8128 | `bf21da5dfe66` |
 | `generated/docs-aging-dashboard.md` | working | 4492 | `dcd84c84257d` |
-| `generated/release-docs-evidence.md` | working | 3942 | `0ae625474bd0` |
+| `generated/release-docs-evidence.md` | working | 3943 | `6b807acddeb4` |
 | `governance-compliance.md` | constitution | 1645 | `d7665f2f7864` |
 | `governance/code-review-checklist.md` | working | 4379 | `f580da208c75` |
 | `governance/command-snippet-registry.md` | working | 3023 | `2e6c2b337773` |
@@ -561,7 +561,7 @@ Do not edit this file manually — regenerate instead.
 | `reviews/project-state-critical-questioning-2026-06-04.md` | archive | 7340 | `78b9b54c3a9c` |
 | `reviews/roadmap-intent-socratic-2026-09-09.md` | archive | 11911 | `57b215adbe19` |
 | `reviews/roadmap-rethink-2026-09-16.md` | archive | 28570 | `96e151b6ba06` |
-| `reviews/roadmap-review-and-improvement-plan-2026-10-09.md` | archive | 35521 | `cba239b80f2b` |
+| `reviews/roadmap-review-and-improvement-plan-2026-10-09.md` | archive | 40607 | `1bbcdaf3735a` |
 | `reviews/roadmaps-socratic-panel-2026-09-15-r10.md` | archive | 3861 | `e11b0872d78d` |
 | `reviews/roadmaps-socratic-panel-2026-09-15-r11.md` | archive | 1823 | `0a831c7afadf` |
 | `reviews/roadmaps-socratic-panel-2026-09-15-r12.md` | archive | 2308 | `790625d98890` |
@@ -582,7 +582,7 @@ Do not edit this file manually — regenerate instead.
 | `reviews/sec09-sec15-multisig-hardening-risk.md` | working | 11076 | `ae895567bb02` |
 | `reviews/security-risk-assessment-2026-06-02.md` | archive | 24112 | `4c9e2e00d001` |
 | `reviews/seven-control-loops-critical-questioning-2026-06-05.md` | archive | 7531 | `ae1e34b8369d` |
-| `roadmap-status.md` | constitution | 108327 | `8f43c60208b5` |
+| `roadmap-status.md` | constitution | 109091 | `14e3ef82f651` |
 | `run-evidence-and-audit-guide.md` | working | 2494 | `5ef9c11997d7` |
 | `security-whitepaper.md` | working | 9690 | `87fc3c31c4a3` |
 | `security/approval-abuse-cases-2026-06-02.md` | archive | 1281 | `4c43296d1c66` |

docs/generated/release-docs-evidence.json

@@ -1,11 +1,11 @@
 {
   "ok": true,
-  "created_at": "2026-10-09T12:20:05+00:00",
+  "created_at": "2026-10-09T19:20:56+00:00",
   "repo_root": "/home/user/teaAgent",
   "git": {
     "branch": "claude/gracious-wright-p34vu8",
-    "commit": "4bd6b5679fabdb3aae31506a219b737cdd1e0890",
-    "dirty": false
+    "commit": "b0cb4ef520341ddd7a3cb6befc159a8f962dd6a4",
+    "dirty": true
   },
   "commands": [
     {

docs/generated/release-docs-evidence.md

@@ -1,8 +1,8 @@
 # Release Documentation Evidence Bundle (Generated)
 
-**Generated:** 2026-10-09T12:20:05+00:00
-**Git commit:** `4bd6b5679fabdb3aae31506a219b737cdd1e0890` on `claude/gracious-wright-p34vu8`
-**Working tree dirty:** no
+**Generated:** 2026-10-09T19:20:56+00:00
+**Git commit:** `b0cb4ef520341ddd7a3cb6befc159a8f962dd6a4` on `claude/gracious-wright-p34vu8`
+**Working tree dirty:** yes
 
 Regenerate: `python3 scripts/build_release_docs_evidence_bundle.py`
 

docs/reviews/roadmap-review-and-improvement-plan-2026-10-09.md

@@ -1,7 +1,7 @@
 # Roadmap Review and Improvement Plan — 2026-10-09
 
 > **Claim class:** Dated whole-project review and **proposed** roadmap; not current truth and not a scheduling authority.
-> **Status:** Review recorded 2026-10-09. Every implementation row below is `Proposed` until the owner admits it through the DR-006 gate or it qualifies as a `fix:` on an existing contract.
+> **Status:** Review recorded 2026-10-09; Phase 0 and the owner decisions landed on `main` the same day (landing record in §7.4). Every implementation row below is `Proposed` until the owner admits it through the DR-006 gate or it qualifies as a `fix:` on an existing contract.
 > **Owner:** docs
 > **Last reviewed:** 2026-10-09
 > **Review trigger:** Owner disposition of §6 asks; `main` returns to green; ADR-0031 or ADR-0043 is decided; a new owner-use evidence entry lands.
@@ -236,6 +236,39 @@ The owner answered the §6 asks in session. Records and the commits that carry t
 
 **Corrections from the ADR-0043 packet.** The packet re-measured this review's Phase 3 numbers: the seven default-delete rows are 4,920 module lines (matches §4) but the exclusive test lines are **3,429 across 128 tests** (the 11,622 figure in §4 counted every file that mentions a quarantined module and does not reproduce; the strict file union is 10,926). More important, the packet found **import-time reachability from `teaagent.cli`** for `federated_sync`, the `consensus` package, and `jit_approval_server` (loaded on every CLI invocation; executed only behind opt-in flags), `RiskLevel` imported from `consensus/` by `skill_executor.py`, `skill_router.py`, and `governance/review_gate.py`, and five coupled modules missing from the ADR-0043 register (`vote_relay.py`, `control_plane_api.py`, `cli/_handlers/_sync.py`, `cli/_handlers/_control_plane.py`, parser modules). The register's "daily-path reachable: No" therefore needs re-scoring at the 2026-12-09 review, and any deletion must relocate `RiskLevel` first. §4 Phase 3 is superseded by the packet where they differ.
 
+### 7.4 Landing record — pull requests, release tag, Dependabot (2026-10-09, same day)
+
+Everything above landed on `main` through pull requests, one CI cycle each; `main` has been green on every run since run 862 (the first green run since 2026-09-29). Merge commits are listed so the record can be checked against `git log origin/main`.
+
+| PR | Content | Head | Merge commit | `main` CI run |
+| --- | --- | --- | --- | --- |
+| #76 | Phase 0 repairs, this review, owner decisions (27 commits from `claude/gracious-wright-p34vu8`) | `41dd2ce7` | `27e5e273` | 862 green |
+| #77 | release `v0.1.1`: version bump, dated changelog, tag build without PyPI publish | `ed2b9a6b` | `609657eb` | 866 green |
+| #78 | `actions/setup-python` 6 → 7 (supersedes Dependabot #74) | `d2e07a7a` | `5a83bc80` | 867 green |
+| #79 | `github/codeql-action` 4 → 4.37.3 (supersedes #75) | `b3985195` | `20353be9` | 868 green |
+| #80 | `pytest` 9.0.3 → 9.1.1 (supersedes #71) | `7bf05308` | `12035023` | 870 green |
+| #81 | `ruff` 0.15.17 → 0.15.20 (supersedes #72) + deadline-based heartbeat liveness test | `401d875d` | `fcb6408a` | 873 green |
+| #82 | `redis` 8.0.0 → 8.0.1 (supersedes #70) | `701d8868` | `701ac84a` | 875 green |
+| #83 | `hypothesis` 6.155.2 → 6.155.7 (supersedes #69) | `151362b3` | `6d7eedeb` | 877 green |
+| #84 | `google-adk` 2.2.0 → 2.3.0 (supersedes #68) | `b4ac83a5` | `b4769e3a` | 879 green |
+| #85 | `pip` 26.1.1 → 26.1.2, uv group, lock-only (supersedes #73) | `aee8f0ae` | `5ab3bb9d` | 881 (in progress when this record was written; the PR run 37977279127 was green) |
+
+**Dependabot method (owner decision 7, refined in session to one branch and one PR per bump).** None of the eight Dependabot PRs could be merged as opened: their commits carry no Lore trailers, so the `review-institution` gate rejects them, and the uv-group `uv.lock` hunks no longer applied on `main` after #76 and #77 moved the lock. Each bump was therefore reproduced on current `main` with the repo's own tooling: the `pyproject.toml` floor change was copied from the Dependabot diff and checked to be byte-identical before each push (`redis` and `google-adk` raise two extras each; `hypothesis` one; `pytest`/`ruff` one; `pip` has no floor and is lock-only), and the lock was regenerated with `uv lock --upgrade-package <pkg>==<ver>`, never edited by hand. The regenerated lock also records the project version 0.1.1, which the #77 version bump had left at 0.1.0. The Dependabot PRs #74, #75, #71, #72, #70, #69, #68 were closed with a one-line pointer to the superseding PR; #73 was closed when #85 merged.
+
+**One red run and its root cause.** The first CI run on #81 (37965565659) failed a single test, `tests/test_run_liveness.py::test_heartbeat_writes_liveness_file`, with `assert None is not None`: the test slept a fixed 0.08 s for a heartbeat thread on a 0.02 s interval, and on the loaded coverage runner the thread was never scheduled before `stop()` set the stop event, so no liveness file existed. The same base commit was green on `main` (run 870), the one permitted re-run passed, and the test was then made deadline-based (polls `liveness_snapshot()` for up to 5 s, both assertions kept, A1 gate clean) in `401d875d`. This is the fixed-sleep timing class that §7.1 flagged; it is now closed for this test and remains the first suspect for any future single-test red run.
+
+**Release tag — blocked, owner action required.** `v0.1.1` is annotated locally at `609657eb` (the #77 merge, `main` run 866 green) but could not be pushed from the recording environment: `git push origin refs/tags/v0.1.1` returns HTTP 403 through the session's GitHub proxy, and the refs API (`POST /repos/.../git/refs`) is refused with "Write access to this GitHub API path is not permitted through this proxy". Remote tags are unchanged (`v0.1.0-p4-remediation`, `tui-chat-not-merged-yet`, `python3.9`). The owner creates the tag with:
+
+```bash
+git fetch origin main
+git tag -a v0.1.1 609657eb5ec3e02e2440ec92a22757867ed7546c -m "v0.1.1 — 2026-10-09"
+git push origin v0.1.1
+```
+
+Per owner decision 2026-10-09 ("tag only, no PyPI"), `release.yml` builds and attaches artifacts on the tag and its `publish` job runs only on `workflow_dispatch`. Because the tag points at `609657eb`, the dependency bumps in #78–#85 are post-0.1.1 and are listed under `Unreleased` in `CHANGELOG.md`.
+
+**Left for the owner, not fixable from here.** (1) The tag above. (2) The destructive test described in §7.2 left an 8.4 GB zero-filled regular file at `/dev/sda` inside the recording container; deleting it was refused by the session's permission classifier, so it is reported rather than removed (it does not exist on CI or on the owner's machine). (3) Three older friction-log hypotheses that were promoted to F2/F3/F7 remain `open` pending owner confirmation; only the four the owner named were closed. (4) Nothing else: after #76 no production code changed, only dependency floors, the lockfile, and the one test.
+
 ## 8. Verification of this record
 
 Documentation-only. Validation for the recording commit: `bash scripts/verify_docs.sh` (inventory, aging, snippet inventory, release docs bundle, OKF bundles, docs consistency) must pass; `docs/INDEX.md` lists this file under Evidence And Review; `docs/roadmap-status.md` carries a one-line dated review note stating that no horizon, milestone, or gate status moved; the action register carries G-P2-21.

docs/roadmap-status.md

@@ -89,6 +89,8 @@
 
 **Owner decisions 2026-10-09 (recorded in session; record [work-log/adr-0031-2026-10-09-extension-decision.md](work-log/adr-0031-2026-10-09-extension-decision.md)):** (1) ADR-0031: extend once to ≤ 2026-11-15 bound to a booked B1 owner-observed coding session (date to be booked), revert if it does not occur — H4 Next Gate restated accordingly, no mode flip; (2) ADR-0043: prepare the disposition packet only — [plans/adr-0043-disposition-packet-2026-10-09.md](plans/adr-0043-disposition-packet-2026-10-09.md) landed (seven default-delete rows = 4,920 module lines + 3,429 exclusive test lines; import-time reachability from `teaagent.cli` found for `federated_sync`, `consensus`, `jit_approval_server`, so the register's "daily-path reachable: No" needs re-scoring at the 2026-12-09 review); deletion deferred to 2026-12-09; (3) Phase 0 repairs go to `main` via pull request; `v0.1.1` is tagged from the first green `main`; (4) the eight stalled Dependabot PRs are rebased and merged one per CI cycle after `main` is green; (5) DR-006 three-month falsifier review recorded (F1 green, F2–F4 unexercised) and the Q3 T5 survey recorded as attempted-blocked-deferred (vendor docs unreachable from the recording environment; due ≤ 2026-12-31); (6) the four open friction-log hypotheses were owner-validated and closed. No horizon, milestone, goal, or gate status moved by these records.
 
+**Landing 2026-10-09 (record [reviews/roadmap-review-and-improvement-plan-2026-10-09.md §7.4](reviews/roadmap-review-and-improvement-plan-2026-10-09.md)):** PRs #76–#85 merged to `main`, each on a green CI run (`main` green on every run since 862); the eight Dependabot PRs were superseded by trailer-carrying, `uv`-regenerated bumps and closed; one fixed-sleep timing test (`test_heartbeat_writes_liveness_file`) was made deadline-based after a single red run. `v0.1.1` is annotated locally at `609657eb` but the tag push and the refs API are refused by the recording environment's GitHub proxy (HTTP 403), so the tag is **pending owner action**; `release.yml` publishes to PyPI only on `workflow_dispatch`. No horizon, milestone, goal, or gate status moved.
+
 **Update 2026-09-17 (advisor note internalized):** the 2026-08-31 external-advisor hypothesis was cited from three committed docs by a path under `.omx/artifacts/` that is excluded from git (`.git/info/exclude`) — evidence readable on one machine only. Internalized verbatim, with the prompt snapshot and an agent-prepared disposition table (extension taken bound to the booked session; revert not triggered; EFX live proof, ADR-0031 sign-off, DR-006 owner falsifier note, B1 owner session and the Horizon C fork all still open), at `reviews/external-advisor-roadmap-hypothesis-2026-08-31.md`; `backlog-priority.md`, this file's H4 row and `plans/current-roadmap-execution-plan-2026-08-26.md` §6.3 now cite it. No horizon or milestone status moved.
 
 

knowledge/teaagent-current/concepts/roadmap-status.md

@@ -6,7 +6,7 @@ resource: "urn:teaagent:doc:docs/roadmap-status.md"
 tags: ["teaagent", "roadmap", "status", "constitution"]
 teaagent:
   source_path: "docs/roadmap-status.md"
-  source_sha256: "8f43c60208b5a3881d42ed0edadb50a701fac1d921495040bfdb52fbb7dbdacd"
+  source_sha256: "14e3ef82f65199dd805865a7b92fb133b08e9c9043e023016f4ceb7659594d9b"
   docs_tier: "constitution"
   authority: "canonical"
   lifecycle: "current"