Update internal packages and verify Python 3.10 support

.github/dependabot.yml

@@ -0,0 +1,31 @@
+version: 2
+updates:
+- package-ecosystem: uv
+  directory: /
+  schedule:
+    interval: cron
+    cronjob: 39 4 * * *
+    timezone: Europe/Warsaw
+  open-pull-requests-limit: 1
+  versioning-strategy: increase-if-necessary
+  allow:
+  - dependency-name: costs
+    dependency-type: all
+  - dependency-name: goal
+    dependency-type: all
+  - dependency-name: pfix
+    dependency-type: all
+  - dependency-name: clickmd
+    dependency-type: all
+  - dependency-name: code2llm
+    dependency-type: all
+  groups:
+    internal-packages:
+      patterns:
+      - costs
+      - goal
+      - pfix
+      - clickmd
+      - code2llm
+  commit-message:
+    prefix: "chore(deps)"

.github/internal-dependencies.json

@@ -0,0 +1,35 @@
+{
+  "schema": "goal.internal-dependencies/v1",
+  "packages": [
+    {
+      "name": "costs",
+      "repository": "semcod/costs",
+      "registry": "pypi",
+      "versioning": "semver"
+    },
+    {
+      "name": "goal",
+      "repository": "semcod/goal",
+      "registry": "pypi",
+      "versioning": "semver"
+    },
+    {
+      "name": "pfix",
+      "repository": "semcod/pfix",
+      "registry": "pypi",
+      "versioning": "semver"
+    },
+    {
+      "name": "clickmd",
+      "repository": "semcod/clickmd",
+      "registry": "pypi",
+      "versioning": "semver"
+    },
+    {
+      "name": "code2llm",
+      "repository": "semcod/code2llm",
+      "registry": "pypi",
+      "versioning": "semver"
+    }
+  ]
+}

.github/workflows/internal-dependency-freshness.yml

@@ -0,0 +1,36 @@
+name: Internal dependency freshness
+
+on:
+  schedule:
+    - cron: "47 5 * * *"
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - pyproject.toml
+      - uv.lock
+      - .github/internal-dependencies.json
+      - .github/workflows/internal-dependency-freshness.yml
+
+permissions:
+  contents: read
+
+jobs:
+  freshness:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+      - name: Install released checker
+        run: python -m pip install "goal==2.2.0"
+      - name: Verify published stable targets
+        run: goal dependencies --catalog .github/internal-dependencies.json --check > dependency-freshness.json
+      - name: Retain freshness evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: dependency-freshness
+          path: dependency-freshness.json
+          if-no-files-found: ignore

.github/workflows/test-locked.yml

@@ -0,0 +1,30 @@
+name: Locked tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.13"]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+      - run: python -m pip install uv
+      - name: Install locked test dependencies
+        run: uv sync --locked --extra dev --python "${{ matrix.python-version }}"
+      - name: Test supported Python versions
+        run: uv run --no-sync python -m pytest -q

README.md

@@ -139,3 +139,7 @@ _Last updated by [taskill](https://github.com/oqlos/taskill) at 2026-04-25 13:41
 > Documentation and tooling were expanded: changelog generation, markdown output and formatting, a configuration management system, and a code analysis/relationship mapping engine were added. Tests and CLI were adjusted and some refactorings performed.
 
 <!-- taskill:status:end -->
+
+## Dependency maintenance
+
+See [internal dependency updates](docs/dependencies.md) for daily updates, locked tests and Python support.

docs/dependencies.md

@@ -0,0 +1,27 @@
+# Internal dependency updates
+
+This repository owns its dependency configuration and this guide, following the repository ownership principle in [wellmanifest/docs](https://github.com/wellmanifest/docs/blob/f64de5806577769672ebc1730d2e144b4c7671ec/README.md). The checker belongs to [semcod/goal](https://github.com/semcod/goal/blob/84f18540d14c24cc8ff5b7f202d2874344779ecc/docs/internal-dependencies.md).
+
+## Python and installation
+
+Application support remains Python >=3.10. Source inspection found no Goal imports or executable invocation in application Python code. Goal's old declarations moved to an `automation` dependency group requiring Python >=3.12, so updating release tooling does not remove Python 3.10 application support.
+
+```sh
+uv sync --locked --extra dev --python 3.10
+uv run --no-sync python -m pytest -q
+UV_PROJECT_ENVIRONMENT=.venv-automation uv sync --locked --group automation --python 3.12
+```
+
+The automation command uses a separate environment. Synchronize the application environment again after merging tested dependency updates.
+
+## Daily checks
+
+[Dependabot](../.github/dependabot.yml) checks the explicit costs, Goal, pfix, clickmd and code2llm catalog daily, including weekends, and groups updates into one PR. It includes transitive packages and may widen constraints when necessary. This is a bounded catalog, not discovery of every internal package. Local/Git sources and other packages need separate review.
+
+[Freshness CI](../.github/workflows/internal-dependency-freshness.yml) uses released Goal 2.2.0 to compare uv.lock with the highest published stable three-part versions of the catalog packages actually used here. It has read-only repository permissions, runs daily/manually/on dependency PRs, and retains JSON evidence. Registry and resolution errors remain visible. An audit does not prove a deployed environment has installed the new versions.
+
+[Locked tests](../.github/workflows/test-locked.yml) install the dev extra from uv.lock and run the full project suite on Python 3.10 and 3.13. A permissive version declaration alone does not refresh the lockfile; update creation, testing, merge and installation are separate steps.
+
+## Delivery
+
+The registry targets observed on 2026-09-05 are costs 0.2.0, Goal 2.2.0, pfix 0.1.79, clickmd 1.1.15 and code2llm 0.5.176. PR and Actions checks hold the test results; the [ecosystem rollout history](https://github.com/semcod/costs/tree/main/docs/dependencies) belongs to costs. Reports and instructions are versioned in repository docs, rather than temporary machine directories.

pyproject.toml

@@ -28,7 +28,6 @@ dev = [
     "pytest-cov>=4.0",
     "ruff>=0.4",
     "mypy>=1.0",
-    "goal>=2.1.218",
     "costs>=0.1.20",
     "pfix>=0.1.60",
 ]
@@ -67,3 +66,9 @@ max_commits = 500
 
 # Cost thresholds for badge colors (USD)
 badge_color_thresholds = { low = 1.0, medium = 5.0, high = 10.0, critical = 50.0 }
+
+[tool.uv.dependency-groups.automation]
+requires-python = ">=3.12"
+
+[dependency-groups]
+automation = ["goal>=2.2.0"]