build: add portable TestQL dependency lock

TODO.md

@@ -51,7 +51,7 @@ Last updated: 2026-09-01 (1.2.67 source — Docker and binary HTTP evidence)
 ## 📋 Technical Debt & Code Quality
 
 - [ ] Deliver the portable lockfile and immutable Docker build chain tracked by
-  `ticket-003` and TestQL issue #10 for external consumers such as Koru.
+  tickets `003`-`005` and TestQL issue #10 for external consumers such as Koru.
 - [x] Repair Docker build inputs after the package moved from `src/` to
   `testql/`, and make the E2E image install the extracted local plugins.
 - [x] Preserve deterministic MIME, byte length, SHA-256 and magic evidence for

project/TICKETS.md

@@ -9,4 +9,5 @@ This file indexes governance tickets without taking ownership of
 | **ticket-001** | [`README.md`](./ticket-001/README.md) | [`preprompt.md`](./ticket-001/preprompt.md) | - |  [`ai-codex.md`](./ticket-001/ai-codex.md) [`ai-devin.md`](./ticket-001/ai-devin.md) |  [`ai-codex-logs.txt`](./ticket-001/ai-codex-logs.txt) [`ai-devin-logs.txt`](./ticket-001/ai-devin-logs.txt) | [`changelog.md`](./ticket-001/changelog.md) |
 | **ticket-002** | [`README.md`](./ticket-002/README.md) | [`preprompt.md`](./ticket-002/preprompt.md) | - |  [`ai-codex.md`](./ticket-002/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-002/ai-codex-logs.txt) | [`changelog.md`](./ticket-002/changelog.md) |
 | **ticket-003** | [`README.md`](./ticket-003/README.md) | [`preprompt.md`](./ticket-003/preprompt.md) | - |  [`ai-codex.md`](./ticket-003/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-003/ai-codex-logs.txt) | [`changelog.md`](./ticket-003/changelog.md) |
+| **ticket-004** | [`README.md`](./ticket-004/README.md) | [`preprompt.md`](./ticket-004/preprompt.md) | - |  [`ai-codex.md`](./ticket-004/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-004/ai-codex-logs.txt) | [`changelog.md`](./ticket-004/changelog.md) |
 <!-- AUTO:TICKET_INDEX:END -->

project/ticket-004/README.md

@@ -0,0 +1,52 @@
+# Ticket 004: Generate portable Docker lockfile
+
+- **ID**: ticket-004
+- **Owner**: unresolved:human
+- **Status**: IN_PROGRESS
+- **Workflow state**: PUBLICATION
+- **Created**: 2026-09-01
+
+## Goal and scope
+
+Generate a portable `uv.lock` from TestQL's published package metadata while
+ignoring the developer-only relative `tool.uv.sources` override. This is the
+integration-owned dependency contract required by TestQL issue #10 and the
+external Koru Docker build.
+
+This ticket changes no dependency declaration, executable source or Dockerfile.
+
+## Acceptance criteria
+
+- [x] AC-01: The user's autonomous sequential-completion request is recorded as
+  `SESSION_EXECUTION_AUTHORIZATION`.
+- [x] AC-02: `uv lock --no-sources` produces a lockfile with no external
+  relative-path or editable dependency; only the root project remains
+  represented as editable `.` in uv's standard lock format.
+- [x] AC-03: Repeated `uv lock --check --no-sources` validation is stable.
+- [x] AC-04: Managed governance, Compose configuration, Docker build check and
+  whitespace validation pass.
+- [ ] AC-05: Protected exact-head publication succeeds.
+
+## Authorization
+
+The user's request to continue and close all tasks sequentially authorizes this
+bounded issue #10 dependency-contract step. It does not authorize secrets,
+self-approval, direct merge or unrelated changes.
+
+## Validation evidence
+
+- uv 0.11.28 resolved 188 packages using `--no-sources`.
+- Only the root TestQL project has uv's standard `editable = "."` record;
+  external dependencies, including `vdisplay 0.1.58` and `nlp2env 0.1.6`,
+  resolve from PyPI with artifact hashes.
+- Two consecutive locked checks retained SHA-256
+  `efe18353c7fc9edb6ab1963f11a92b54000a13afbd59229542bfa1d38185f1a7`.
+- A clean `--locked --no-dev --extra nlp2env --no-sources --no-editable`
+  sync installed the project and `testql --version` reported `1.2.67`.
+- Managed governance, all declared Compose configs, Docker build check and
+  `git diff --check`: passed.
+
+## Participants
+
+- Human participant: unresolved; no user-* file was created by this script.
+- Agent participant: [ai-codex.md](ai-codex.md)

project/ticket-004/ai-codex-logs.txt

@@ -0,0 +1,5 @@
+2026-09-01T22:02:11Z SESSION_EXECUTION_AUTHORIZATION recorded for TestQL issue #10 and semcod/koru#64.
+2026-09-01T22:05:00Z EDIT base=3fcd119a658f9f7dcce81cdddb05ae8fd7e9a64e workstream=integration.
+2026-09-01T22:08:00Z LOCK uv=0.11.28 packages=188 sha256=efe18353c7fc9edb6ab1963f11a92b54000a13afbd59229542bfa1d38185f1a7 external_sources=registry-only.
+2026-09-01T22:09:00Z VALIDATION locked_sync=pass extra=nlp2env cli=1.2.67 governance=pass compose=pass docker_check=pass diff_check=pass.
+2026-09-01T22:09:00Z PUBLICATION ready=true.

project/ticket-004/ai-codex.md

@@ -0,0 +1,37 @@
+---
+participant-id: agent:codex
+participant: codex
+role: agent
+ticket: ticket-004
+---
+# Participant: codex (AI agent)
+
+## Understanding
+
+TestQL declares a developer-local `vdisplay` source, but the Docker build is an
+external Git context where that relative checkout cannot exist. The committed
+lock must therefore be resolved with `--no-sources` from publishable metadata.
+
+## Execution plan
+
+1. Generate `uv.lock` with uv 0.11.28 and `--no-sources`.
+2. Prove only the root project has uv's editable-dot record, with every external
+   dependency registry-resolved, and verify stability under check.
+3. Run governance, Compose and Docker stack checks.
+4. Publish through exact-head Validator review.
+
+## Actual changes
+
+- Recorded the user's session execution authorization and bounded delivery
+  contract on the exact merged `ticket-003` base.
+- Generated a 188-package portable lock with uv 0.11.28. All external sources
+  are registry artifacts; the only editable-dot entry is the root project.
+- Proved two stable locked checks with identical SHA-256, then completed a clean
+  locked production sync with the required `nlp2env` extra and ran TestQL
+  1.2.67.
+- Governance, Compose and Docker build checks passed; moved to protected
+  publication.
+
+## Blockers
+
+- None.

project/ticket-004/changelog.md

@@ -0,0 +1,6 @@
+# Ticket Changelog (ticket-004)
+
+## [0.1.0] - 2026-09-02
+
+- Created the bounded integration ticket for the portable Docker lockfile.
+- Generated and validated the portable, registry-resolved `uv.lock`.

project/ticket-004/intent.json

@@ -0,0 +1,80 @@
+{
+  "schema": "new-project.intent/v3",
+  "ticket": "ticket-004",
+  "summary": "Generate portable Docker lockfile",
+  "workstream": "integration",
+  "classification": {
+    "kind": "SERVICE",
+    "priority": "P2",
+    "origin": "health"
+  },
+  "allowedPaths": [
+    "project/ticket-004/**",
+    "TODO.md",
+    "project/TICKETS.md",
+    "uv.lock"
+  ],
+  "forbiddenPaths": ["project/ticket-*/user-*.md"],
+  "stacks": ["docker"],
+  "dependsOn": ["ticket-003"],
+  "conflictsWith": [],
+  "integrationTicket": null,
+  "delivery": {
+    "acceptedBaseSha": "3fcd119a658f9f7dcce81cdddb05ae8fd7e9a64e",
+    "targetBranch": "main",
+    "outcome": "A portable frozen uv lockfile resolved from published package metadata.",
+    "nonGoals": [
+      "Change declared dependencies or package behavior.",
+      "Modify Docker runtime stages in this ticket."
+    ],
+    "complexity": "XS",
+    "estimatedMinutes": 10,
+    "budgets": {
+      "maxImplementationFiles": 1,
+      "maxAffectedComponents": 1,
+      "maxPublicInterfaceChanges": 0,
+      "maxRuntimeDependencies": 0
+    },
+    "architecture": {
+      "status": "accepted",
+      "decision": "Resolve uv.lock with --no-sources so external builds never depend on a developer-relative checkout.",
+      "components": [
+        {
+          "name": "dependency-lock",
+          "paths": ["uv.lock"]
+        }
+      ],
+      "responsibilityChanges": false,
+      "interfaceChanges": [],
+      "dataChanges": ["Add the resolved dependency graph in uv.lock."],
+      "ui": {
+        "impact": "none",
+        "states": [],
+        "evidence": []
+      },
+      "rollback": "Revert the lockfile commit; no source or declared dependency changes are coupled to it."
+    },
+    "runtimeDependencies": [],
+    "validation": [
+      {
+        "criterion": "AC-02",
+        "commands": [
+          "uv lock --no-sources",
+          "test $(rg -c 'source = \\{ editable = ' uv.lock) -eq 1",
+          "! rg 'source = \\{ directory|\\.\\./\\.\\.|/home/' uv.lock"
+        ],
+        "evidence": "Only the root project uses uv's standard editable-dot record; every external dependency resolves from registry metadata."
+      },
+      {
+        "criterion": "AC-03",
+        "commands": ["uv lock --check --no-sources"],
+        "evidence": "The generated graph is current and reproducible under no-sources resolution."
+      },
+      {
+        "criterion": "AC-04",
+        "commands": ["./project/governance-check.sh", "docker build --check ."],
+        "evidence": "Managed governance and the declared Docker stack pass."
+      }
+    ]
+  }
+}

project/ticket-004/preprompt.md

@@ -0,0 +1,10 @@
+# Ticket preprompt
+
+- **Task ID**: ticket-004
+- **Task title**: Generate portable Docker lockfile
+- **Created**: 2026-09-01T22:02:11Z
+
+Keep executable implementation outside this governance/evidence directory.
+Read a human-owned user-*.md file only when one exists.
+Resolve the lock from published metadata with `--no-sources`; do not modify
+`pyproject.toml` or any Dockerfile in this ticket.