Lock plugin build tools for frozen E2E installs

project/TICKETS.md

@@ -10,4 +10,5 @@ This file indexes governance tickets without taking ownership of
 | **ticket-002** | [`README.md`](./ticket-002/README.md) | [`preprompt.md`](./ticket-002/preprompt.md) | - |  [`ai-codex.md`](./ticket-002/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-002/ai-codex-logs.txt) | [`changelog.md`](./ticket-002/changelog.md) |
 | **ticket-003** | [`README.md`](./ticket-003/README.md) | [`preprompt.md`](./ticket-003/preprompt.md) | - |  [`ai-codex.md`](./ticket-003/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-003/ai-codex-logs.txt) | [`changelog.md`](./ticket-003/changelog.md) |
 | **ticket-004** | [`README.md`](./ticket-004/README.md) | [`preprompt.md`](./ticket-004/preprompt.md) | - |  [`ai-codex.md`](./ticket-004/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-004/ai-codex-logs.txt) | [`changelog.md`](./ticket-004/changelog.md) |
+| **ticket-006** | [`README.md`](./ticket-006/README.md) | [`preprompt.md`](./ticket-006/preprompt.md) | - |  [`ai-codex.md`](./ticket-006/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-006/ai-codex-logs.txt) | [`changelog.md`](./ticket-006/changelog.md) |
 <!-- AUTO:TICKET_INDEX:END -->

project/ticket-006/README.md

@@ -0,0 +1,52 @@
+# Ticket 006: Lock E2E plugin build tools
+
+- **ID**: ticket-006
+- **Owner**: unresolved:human
+- **Status**: IN_PROGRESS
+- **Workflow state**: PUBLICATION
+- **Created**: 2026-09-01
+
+## Goal and scope
+
+Add the existing setuptools build backend and wheel helper to TestQL's dev
+extra, then regenerate the portable lock with `--no-sources`. This lets the E2E
+image create distribution metadata for four local plugins with
+`--no-build-isolation --no-deps`, without invoking an external resolver.
+
+This ticket adds no production runtime dependency and changes no Dockerfile or
+plugin package declaration.
+
+## Acceptance criteria
+
+- [x] AC-01: The user's autonomous sequential-completion request is recorded as
+  `SESSION_EXECUTION_AUTHORIZATION`.
+- [x] AC-02: `setuptools` and `wheel` are dev-only and resolved with hashes in
+  the portable lock.
+- [x] AC-03: A locked/no-sources dev sync can install all four local plugin
+  distributions with no build isolation and no dependency resolution.
+- [x] AC-04: GraphQL, Proto and SQL entry points are discoverable and the
+  focused registration tests pass.
+- [x] AC-05: Governance, Compose and Docker build checks pass before protected
+  exact-head publication.
+
+## Validation evidence
+
+- `uv lock --check --no-sources`: 190 packages; `setuptools==84.0.0` and
+  `wheel==0.48.0` have registry artifacts and SHA-256 hashes.
+- Locked dev plus `nlp2env` sync and resolver-free editable installation of
+  all four plugins completed successfully.
+- The `graphql`, `proto` and `sql` `testql.plugins` entry points resolve to
+  their local distributions; focused regression suite: `77 passed`.
+- `./project/governance-check.sh`: `GOV-PASS`.
+- All three root Compose configurations and both Docker build checks pass.
+
+## Authorization
+
+The user's request to continue and close all tasks sequentially authorizes this
+bounded prerequisite discovered while validating TestQL issue #10. It does not
+authorize secrets, self-approval, direct merge or unrelated dependency changes.
+
+## Participants
+
+- Human participant: unresolved; no user-* file was created by this script.
+- Agent participant: [ai-codex.md](ai-codex.md)

project/ticket-006/ai-codex-logs.txt

@@ -0,0 +1,4 @@
+2026-09-01T22:36:01Z SESSION_EXECUTION_AUTHORIZATION recorded for TestQL issue #10 and semcod/koru#64.
+2026-09-01T22:37:00Z EDIT base=ab9e899b916a1933c6219fc05cf39949d557141c workstream=integration prerequisite_for=ticket-005.
+2026-09-01T22:38:00Z VALIDATION uv_lock=190_packages build_tools=setuptools-84.0.0,wheel-0.48.0 plugin_install=no-build-isolation,no-deps entrypoints=graphql,proto,sql focused_tests=77_passed.
+2026-09-01T22:39:00Z VALIDATION governance=GOV-PASS compose=3_passed docker_build_checks=2_passed workflow=PUBLICATION.

project/ticket-006/ai-codex.md

@@ -0,0 +1,38 @@
+---
+participant-id: agent:codex
+participant: codex
+role: agent
+ticket: ticket-006
+---
+# Participant: codex (AI agent)
+
+## Understanding
+
+The frozen E2E environment has plugin runtime libraries, but not the build
+backend needed to create local distribution metadata without build isolation.
+Locking the already-declared setuptools backend plus wheel in the dev extra
+keeps that metadata installation resolver-free and out of production runtime.
+
+## Execution plan
+
+1. Add setuptools and wheel only to the dev extra.
+2. Regenerate and check the portable lock with `--no-sources`.
+3. Sync the dev environment from the lock and install four local plugins with
+   no build isolation and no dependency installation.
+4. Validate entry points, focused tests, governance and Docker configuration.
+5. Publish through exact-head Validator review.
+
+## Actual changes
+
+- Recorded the user's session execution authorization and implemented the
+  narrow integration prerequisite on the exact merged ticket-004 base.
+- Added `setuptools` and `wheel` only to the dev extra and regenerated the
+  portable registry-backed lock.
+- Demonstrated that all four local plugins install without build isolation or
+  dependency resolution and expose the required entry points.
+- Ran 77 focused tests, the managed governance gate, three Compose checks and
+  both Dockerfile build checks successfully.
+
+## Blockers
+
+- None.

project/ticket-006/changelog.md

@@ -0,0 +1,10 @@
+# Ticket Changelog (ticket-006)
+
+## [0.1.0] - 2026-09-01
+
+- Initial governance scaffold created.
+- No human participant identity or content was generated.
+- Planned the dev-only frozen build-tool prerequisite for local plugin metadata.
+- Locked `setuptools==84.0.0` and `wheel==0.48.0` in the dev graph.
+- Validated resolver-free metadata installation for all four local plugins and
+  restored their GraphQL, Proto and SQL entry points.

project/ticket-006/intent.json

@@ -0,0 +1,80 @@
+{
+  "schema": "new-project.intent/v3",
+  "ticket": "ticket-006",
+  "summary": "Lock E2E plugin build tools",
+  "workstream": "integration",
+  "classification": {
+    "kind": "SERVICE",
+    "priority": "P1",
+    "origin": "health"
+  },
+  "allowedPaths": [
+    "project/ticket-006/**",
+    "TODO.md",
+    "project/TICKETS.md",
+    "pyproject.toml",
+    "uv.lock"
+  ],
+  "forbiddenPaths": ["project/ticket-*/user-*.md"],
+  "stacks": ["docker"],
+  "dependsOn": ["ticket-003", "ticket-004"],
+  "conflictsWith": [],
+  "integrationTicket": null,
+  "delivery": {
+    "acceptedBaseSha": "ab9e899b916a1933c6219fc05cf39949d557141c",
+    "targetBranch": "main",
+    "outcome": "Dev-only build tools are hash-locked for resolver-free local E2E plugin metadata installation.",
+    "nonGoals": [
+      "Add a production runtime dependency.",
+      "Change Dockerfiles or local plugin dependency declarations."
+    ],
+    "complexity": "XS",
+    "estimatedMinutes": 10,
+    "budgets": {
+      "maxImplementationFiles": 2,
+      "maxAffectedComponents": 1,
+      "maxPublicInterfaceChanges": 0,
+      "maxRuntimeDependencies": 0
+    },
+    "architecture": {
+      "status": "accepted",
+      "decision": "Reuse the packages' declared setuptools backend from the frozen dev environment and disable build isolation and dependency installation for local plugin metadata.",
+      "components": [
+        {
+          "name": "dev-dependency-contract",
+          "paths": ["pyproject.toml", "uv.lock"]
+        }
+      ],
+      "responsibilityChanges": false,
+      "interfaceChanges": [],
+      "dataChanges": ["Extend the portable dev dependency graph with setuptools and wheel."],
+      "ui": {
+        "impact": "none",
+        "states": [],
+        "evidence": []
+      },
+      "rollback": "Revert the dev-extra entries and regenerate uv.lock with --no-sources."
+    },
+    "runtimeDependencies": [],
+    "validation": [
+      {
+        "criterion": "AC-02",
+        "commands": ["uv lock --no-sources", "uv lock --check --no-sources"],
+        "evidence": "The portable lock contains registry artifacts and hashes for both dev build tools."
+      },
+      {
+        "criterion": "AC-03",
+        "commands": [
+          "uv sync --locked --extra dev --extra nlp2env --no-sources --no-editable",
+          "uv pip install --python .venv/bin/python --no-build-isolation --no-deps --editable packages/graphql2testql --editable packages/proto2testql --editable packages/sql2testql --editable packages/desktop2testql"
+        ],
+        "evidence": "All local plugin metadata installs using only the frozen environment's build backend."
+      },
+      {
+        "criterion": "AC-05",
+        "commands": ["./project/governance-check.sh", "docker build --check -f Dockerfile.e2e ."],
+        "evidence": "Managed governance and the declared Docker stack pass."
+      }
+    ]
+  }
+}

project/ticket-006/preprompt.md

@@ -0,0 +1,10 @@
+# Ticket preprompt
+
+- **Task ID**: ticket-006
+- **Task title**: Lock E2E plugin build tools
+- **Created**: 2026-09-01T22:36:01Z
+
+Keep executable implementation outside this governance/evidence directory.
+Read a human-owned user-*.md file only when one exists.
+Add only dev build tools already required by the local packages; keep production
+runtime dependencies, Dockerfiles and plugin manifests unchanged.

pyproject.toml

@@ -62,6 +62,9 @@ graphql = ["graphql-core>=3.2"]
 nlp2env = ["mcp>=1.0", "nlp2env[mcp]>=0.1.2"]
 mcp = ["mcp>=1.0"]
 dev = ["pytest", "pytest-asyncio", "pytest-cov",
+    # Build local E2E plugin metadata without an isolated dependency resolver.
+    "setuptools>=68",
+    "wheel",
     "mcp>=1.0",
     "fastapi",
     "goal>=2.1.0",