governance: close ticket 004 publication

project/ticket-004/README.md

@@ -2,7 +2,7 @@
 
 - **ID**: ticket-004
 - **Owner**: unresolved:human
-- **Status**: IN_PROGRESS
+- **Status**: DONE
 - **Workflow state**: PUBLICATION
 - **Created**: 2026-09-01
 
@@ -25,7 +25,7 @@ This ticket changes no dependency declaration, executable source or Dockerfile.
 - [x] AC-03: Repeated `uv lock --check --no-sources` validation is stable.
 - [x] AC-04: Managed governance, Compose configuration, Docker build check and
   whitespace validation pass.
-- [ ] AC-05: Protected exact-head publication succeeds.
+- [x] AC-05: Protected exact-head publication succeeds.
 
 ## Authorization
 
@@ -46,6 +46,15 @@ self-approval, direct merge or unrelated changes.
 - Managed governance, all declared Compose configs, Docker build check and
   `git diff --check`: passed.
 
+## Publication evidence
+
+Required CI passed and Validator run `33565378018` approved exact HEAD
+`0c8faed91ee8210a1759926a61fcee28f67c025e`. PR #13 merged as
+`8e759086b8e4ac4aeb4bb547d1f342430762170c` on 2026-09-01, and its remote
+ticket branch was deleted. The advisory model was unavailable because the
+generated lock required 50 chunks; deterministic checks remained the approval
+authority.
+
 ## Participants
 
 - Human participant: unresolved; no user-* file was created by this script.

project/ticket-004/ai-codex-logs.txt

@@ -3,3 +3,5 @@
 2026-09-01T22:08:00Z LOCK uv=0.11.28 packages=188 sha256=efe18353c7fc9edb6ab1963f11a92b54000a13afbd59229542bfa1d38185f1a7 external_sources=registry-only.
 2026-09-01T22:09:00Z VALIDATION locked_sync=pass extra=nlp2env cli=1.2.67 governance=pass compose=pass docker_check=pass diff_check=pass.
 2026-09-01T22:09:00Z PUBLICATION ready=true.
+2026-09-01T22:16:48Z PUBLICATION validator_run=33565378018 exact_head=0c8faed91ee8210a1759926a61fcee28f67c025e merge=8e759086b8e4ac4aeb4bb547d1f342430762170c required_check=test branch_deleted=true advisory=budget_exceeded.
+2026-09-01T22:18:00Z DONE ticket=ticket-004.

project/ticket-004/ai-codex.md

@@ -31,7 +31,15 @@ lock must therefore be resolved with `--no-sources` from publishable metadata.
   1.2.67.
 - Governance, Compose and Docker build checks passed; moved to protected
   publication.
+- Required CI passed; Validator run `33565378018` approved exact HEAD
+  `0c8faed91ee8` and merged PR #13 as `8e759086b8e4`. The remote branch and
+  verified disposable worktree were removed.
 
 ## Blockers
 
 - None.
+
+## Publication
+
+Complete. The deterministic approval remained authoritative when advisory LLM
+review exceeded its chunk budget.

project/ticket-004/changelog.md

@@ -4,3 +4,4 @@
 
 - Created the bounded integration ticket for the portable Docker lockfile.
 - Generated and validated the portable, registry-resolved `uv.lock`.
+- Recorded trusted exact-head publication and closed the ticket.