[ticket-087] fix(publish): preserve virtualenv interpreter isolation

[tom-sapletta-com]

Created by governed goal -a pull-request delivery.

[ifuri-validator-agent]

Validation rejected:

• Patch contains unsafe validation shortcut: @pytest.mark.skip

[ifuri-validator-agent]

Deterministic Validator approval for exact head ca9094d68282363d5ba00cbb5fe19285a3265e98.

Ticket: ticket-087
Correlation ID: redeploy-publish-venv-087-retry
Model: zai/glm-5.3
Reviewed diff chunks: 1
Advisory LLM verdict: APPROVE
Advisory summary: Reviewed all 1 diff chunk(s). Small, well-scoped fix replacing Path.resolve() with absolute() when selecting virtualenv Python, preserving venv isolation. Tests are real subprocess regression tests covering all four selection paths plus fallback. Ticket metadata is consistent. CI checks all pass.
Advisory findings: none
The LLM output above is advisory and was not used as the approval trust root.

Actual PR impact radar

Exact range: 06f70a83b500e5804e6051f46d03aa56f59fd250...ca9094d68282363d5ba00cbb5fe19285a3265e98
Change digest: 7537dc045b76e9e66bf7ecd4f83cd5e68b4c56db063fefea0fc07e10ef4e2ca8
Score: 48/100 (M), estimated 48 min, split recommended: true
Affected services/components: repository-wide/unclassified

Machine-readable radar JSONL and SVG

{"actual_change":{"additions":159,"base_sha":"06f70a83b500e5804e6051f46d03aa56f59fd250","binary_files":0,"categories":{"code":1,"configuration":1,"docs":1,"tests":1},"change_digest":"7537dc045b76e9e66bf7ecd4f83cd5e68b4c56db063fefea0fc07e10ef4e2ca8","comparison":"06f70a83b500e5804e6051f46d03aa56f59fd250...ca9094d68282363d5ba00cbb5fe19285a3265e98","deletions":2,"file_count":4,"files":["goal/cli/publish.py","project/ticket-087/README.md","project/ticket-087/intent.json","tests/test_publish_python.py"],"head_sha":"ca9094d68282363d5ba00cbb5fe19285a3265e98","service_count":0,"services":[]},"assessment_mode":"observed-pr","axes":{"coupling":3,"delivery":2,"scope":2,"uncertainty":4,"validation":1},"complexity":"M","confidence":0.9,"diagnostics":["RADAR-ACCEPTANCE-MISSING","RADAR-BUDGET-EXCEEDED"],"estimate":{"budget_minutes":30,"minutes":48,"within_budget":false},"impact":{"components":["goal","project","tests"],"files":["goal/cli/publish.py","project/ticket-087/README.md","project/ticket-087/intent.json","tests/test_publish_python.py"],"public_interfaces":[],"runtime_dependencies":0},"schema":"subactor.ticket-radar/v1","score":48,"split":{"parts":[{"estimated_minutes":13,"name":"Implement goal","scope":["goal"]},{"estimated_minutes":13,"name":"Implement project","scope":["project"]},{"estimated_minutes":13,"name":"Implement tests","scope":["tests"]},{"estimated_minutes":15,"name":"Validate and project to trackers","scope":["tests","planfile","github/gitlab/jira projections"]}],"reason":"estimated_minutes_exceed_budget","recommended":true},"standards":[{"id":"wellmanifest/dsl","revision":"6c60fc4e0dd1f1bb74f46a7745e28019908d1203","version":"0.1.0-dev"},{"id":"wellmanifest/ticket-lifecycle","revision":"5bf581907a87b46a13a73e6c033d3abe4d9a306f","version":"0.1.0-dev"},{"id":"wellmanifest/git-lifecycle","revision":"7d77d4b7af57e69bc75c3a0290b3a4805c5c4438","version":"0.2.0-dev"},{"id":"wellmanifest/logs","revision":"48c284ef7a069055c0bcb6b900147ce5e65f8b43","version":"0.3.0"}],"ticket_ref":"ticket-087"}

<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" viewBox="0 0 128 128" role="img"><title>ticket-087: [ticket-087] fix(publish): preserve virtualenv interpreter isolation</title><rect width="128" height="128" rx="12" fill="#f8fafc"/><g stroke-width="1"><polygon points="64,55 72,61 69,71 59,71 56,61" fill="none" stroke="#d7dde5"/><polygon points="64,47 80,59 74,78 54,78 48,59" fill="none" stroke="#d7dde5"/><polygon points="64,38 89,56 79,85 49,85 39,56" fill="none" stroke="#d7dde5"/><polygon points="64,30 97,53 84,92 44,92 31,53" fill="none" stroke="#d7dde5"/><polygon points="64,21 105,51 89,99 39,99 23,51" fill="none" stroke="#d7dde5"/><line x1="64" y1="64" x2="64" y2="21" stroke="#aab4c0"/><line x1="64" y1="64" x2="105" y2="51" stroke="#aab4c0"/><line x1="64" y1="64" x2="89" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="39" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="23" y2="51" stroke="#aab4c0"/></g><polygon points="64,47 89,56 84,92 59,71 48,59" fill="#fb923c" fill-opacity="0.45" stroke="#c2410c" stroke-width="2"/><circle cx="64" cy="64" r="3" fill="#c2410c"/><g font-family="sans-serif" font-size="7" fill="#334155"><text x="64" y="11" text-anchor="middle">SCO</text><text x="114" y="48" text-anchor="middle">COU</text><text x="95" y="107" text-anchor="middle">UNC</text><text x="33" y="107" text-anchor="middle">VAL</text><text x="14" y="48" text-anchor="middle">DEL</text></g><text x="64" y="124" text-anchor="middle" font-family="sans-serif" font-size="8" fill="#0f172a">M · 48m</text></svg>

Merge will be attempted after this approval when explicitly authorized. ## Decision record (recomputable)

DECISION D-087-4065
TICKET ticket-087
HEAD_SHA ca9094d68282363d5ba00cbb5fe19285a3265e98
CORRELATION_ID redeploy-publish-venv-087-retry
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT author_login = "tom-sapletta-com"
INPUT observed_checks = ["governance / enforce=PASS","test (3.12)=PASS","test (3.13)=PASS","governance / remote lifecycle=PASS"]
INPUT required_checks = ["test (3.12)","test (3.13)"]
INPUT required_checks_source = "protected registry (env/request)"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
INPUT superseded_checks = []
INPUT ticket_radar_receipt = {"schema":"subactor.ticket-radar/v1","base_sha":"06f70a83b500e5804e6051f46d03aa56f59fd250","head_sha":"ca9094d68282363d5ba00cbb5fe19285a3265e98","change_digest":"7537dc045b76e9e66bf7ecd4f83cd5e68b4c56db063fefea0fc07e10ef4e2ca8","score":48,"complexity":"M","estimated_minutes":48,"split_recommended":true,"services":[],"authority":"ADVISORY","promotion":"FORBIDDEN"}
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "APPROVE" MODEL "zai/glm-5.3"
ASSERT VERDICT_AUTHORITY != "ADVISORY"