ci(api): test dependency candidates on Python 3.10 and 3.12

[tom-sapletta-com]

Codot dependency PRs currently run governance checks without testing the API. Run the 10 existing policy and protocol tests against the exact candidate API requirements on Python 3.10 and 3.12. The workflow uses read-only permissions and immutable Action revisions.

Validation: all 10 API tests passed on both Python versions; managed governance and commit hooks passed. The combined proposed uvicorn/PyJWT/jsonschema updates also passed the same 10 tests on Python 3.12.

The full Goal bootstrap exposed separate baseline Go/Node and project-packaging failures; no unrelated generated changes are included. Required governance checks remain unchanged. Ticket-003 remains IN_PROGRESS / PUBLICATION until independent exact-head CI and protected merge.

[ifuri-validator-agent]

Validator approval after policy checks for exact head 8b0aac55557dbaee26c50ac110b576fc2c17d57f.

Ticket: ticket-003
Correlation ID: local-autogrammar-codot-pr-16-ticket-003
Model: openai/cursor-auto
Reviewed diff chunks: 1
Advisory LLM verdict: APPROVE
Advisory summary: Reviewed all 1 diff chunk(s). The PR correctly adds an automated GitHub Actions workflow to run API tests on Python 3.10 and 3.12. The workflow follows excellent security practices by explicitly limiting permissions to read-only, using 'persist-credentials: false', and securely pinning third-party Actions to specific commit SHAs. All required status checks have successfully passed.
Advisory findings: none
The LLM output above is advisory and was not used as the approval trust root.
Semantic review prerequisite: satisfied; policy 676cb4516bbfed2a000e40b9b1b6e4a430ecc761ec546aeb53d721a1905cfdd7.

Actual PR impact radar

Exact range: a4b40feb4863148fe10324b062493cb64b15fd0e...8b0aac55557dbaee26c50ac110b576fc2c17d57f
Change digest: 6cc32b3bf13a2172bf8438cdb443435a1639fff32318da5a25ea991a2befab65
Score: 64/100 (L), estimated 69 min, split recommended: true
Affected services/components: repository-wide/unclassified

Machine-readable radar JSONL and SVG

{"actual_change":{"additions":130,"base_sha":"a4b40feb4863148fe10324b062493cb64b15fd0e","binary_files":0,"categories":{"configuration":2,"docs":2},"change_digest":"6cc32b3bf13a2172bf8438cdb443435a1639fff32318da5a25ea991a2befab65","comparison":"a4b40feb4863148fe10324b062493cb64b15fd0e...8b0aac55557dbaee26c50ac110b576fc2c17d57f","deletions":0,"file_count":4,"files":["github/workflows/api-tests.yml","project/TICKETS.md","project/ticket-003/README.md","project/ticket-003/intent.json"],"head_sha":"8b0aac55557dbaee26c50ac110b576fc2c17d57f","service_count":0,"services":[]},"assessment_mode":"observed-pr","axes":{"coupling":5,"delivery":4,"scope":2,"uncertainty":3,"validation":2},"complexity":"L","confidence":0.9,"diagnostics":["RADAR-ACCEPTANCE-MISSING","RADAR-BUDGET-EXCEEDED"],"estimate":{"budget_minutes":30,"minutes":69,"within_budget":false},"impact":{"components":["Go","github","project","uvicorn"],"files":["Go/Node","github/workflows/api-tests.yml","project/TICKETS.md","project/ticket-003/README.md","project/ticket-003/intent.json","uvicorn/PyJWT/jsonschema"],"public_interfaces":["uvicorn/PyJWT/jsonschema"],"runtime_dependencies":1},"schema":"subactor.ticket-radar/v1","score":64,"split":{"parts":[{"estimated_minutes":20,"name":"Define contract and acceptance boundary","scope":["uvicorn/PyJWT/jsonschema"]},{"estimated_minutes":10,"name":"Implement Go","scope":["Go"]},{"estimated_minutes":10,"name":"Implement github","scope":["github"]},{"estimated_minutes":10,"name":"Implement project","scope":["project"]},{"estimated_minutes":10,"name":"Implement uvicorn","scope":["uvicorn"]},{"estimated_minutes":15,"name":"Validate and project to trackers","scope":["tests","planfile","github/gitlab/jira projections"]}],"reason":"estimated_minutes_exceed_budget","recommended":true},"standards":[{"id":"wellmanifest/dsl","revision":"6c60fc4e0dd1f1bb74f46a7745e28019908d1203","version":"0.1.0-dev"},{"id":"wellmanifest/ticket-lifecycle","revision":"5bf581907a87b46a13a73e6c033d3abe4d9a306f","version":"0.1.0-dev"},{"id":"wellmanifest/git-lifecycle","revision":"7d77d4b7af57e69bc75c3a0290b3a4805c5c4438","version":"0.2.0-dev"},{"id":"wellmanifest/logs","revision":"48c284ef7a069055c0bcb6b900147ce5e65f8b43","version":"0.3.0"}],"ticket_ref":"ticket-003"}

<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" viewBox="0 0 128 128" role="img"><title>ticket-003: ci(api): test dependency candidates on Python 3.10 and 3.12</title><rect width="128" height="128" rx="12" fill="#f8fafc"/><g stroke-width="1"><polygon points="64,55 72,61 69,71 59,71 56,61" fill="none" stroke="#d7dde5"/><polygon points="64,47 80,59 74,78 54,78 48,59" fill="none" stroke="#d7dde5"/><polygon points="64,38 89,56 79,85 49,85 39,56" fill="none" stroke="#d7dde5"/><polygon points="64,30 97,53 84,92 44,92 31,53" fill="none" stroke="#d7dde5"/><polygon points="64,21 105,51 89,99 39,99 23,51" fill="none" stroke="#d7dde5"/><line x1="64" y1="64" x2="64" y2="21" stroke="#aab4c0"/><line x1="64" y1="64" x2="105" y2="51" stroke="#aab4c0"/><line x1="64" y1="64" x2="89" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="39" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="23" y2="51" stroke="#aab4c0"/></g><polygon points="64,47 105,51 79,85 54,78 31,53" fill="#fb923c" fill-opacity="0.45" stroke="#c2410c" stroke-width="2"/><circle cx="64" cy="64" r="3" fill="#c2410c"/><g font-family="sans-serif" font-size="7" fill="#334155"><text x="64" y="11" text-anchor="middle">SCO</text><text x="114" y="48" text-anchor="middle">COU</text><text x="95" y="107" text-anchor="middle">UNC</text><text x="33" y="107" text-anchor="middle">VAL</text><text x="14" y="48" text-anchor="middle">DEL</text></g><text x="64" y="124" text-anchor="middle" font-family="sans-serif" font-size="8" fill="#0f172a">L · 69m</text></svg>

Merge will be attempted after this approval when explicitly authorized. ## Decision record (recomputable)

DECISION D-003-1562
TICKET ticket-003
HEAD_SHA 8b0aac55557dbaee26c50ac110b576fc2c17d57f
CORRELATION_ID local-autogrammar-codot-pr-16-ticket-003
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT author_login = "tom-sapletta-com"
INPUT observed_checks = ["governance / remote lifecycle=PASS","API tests (3.12)=PASS","governance / enforce=PASS","API tests (3.10)=PASS"]
INPUT required_checks = ["governance / enforce","governance / remote lifecycle","API tests (3.10)","API tests (3.12)"]
INPUT required_checks_source = "protected registry (env/request)"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
INPUT semantic_review_assessment = {"schema":"subactor.validator/semantic-review-assessment/v1","subject":{"repository":"autogrammar/codot","pull_request":16,"head_sha":"8b0aac55557dbaee26c50ac110b576fc2c17d57f","base_sha":"a4b40feb4863148fe10324b062493cb64b15fd0e","diff_sha256":"d493569d1e9f7c229be6d15a2abedf7d6eddf253f77d1eafc52df8ebce24be2b"},"policy":{"policy_schema":"subactor.validator/semantic-review-policy/v1","policy_version":1,"policy_sha256":"676cb4516bbfed2a000e40b9b1b6e4a430ecc761ec546aeb53d721a1905cfdd7","required":true,"critical_paths":[".github/workflows/api-tests.yml"],"observed_paths":[".github/workflows/api-tests.yml","project/TICKETS.md","project/ticket-003/README.md","project/ticket-003/intent.json"]},"grounding":"full-diff-not-per-finding-proof","execution_authority":false,"status":"satisfied","reason":null,"review_sha256":"734eb9899eb5f7e481d8c42dcb83389a5525ad2661535a825a62d666d98963f4","unresolved":[]}
INPUT superseded_checks = []
INPUT ticket_radar_receipt = {"schema":"subactor.ticket-radar/v1","base_sha":"a4b40feb4863148fe10324b062493cb64b15fd0e","head_sha":"8b0aac55557dbaee26c50ac110b576fc2c17d57f","change_digest":"6cc32b3bf13a2172bf8438cdb443435a1639fff32318da5a25ea991a2befab65","score":64,"complexity":"L","estimated_minutes":69,"split_recommended":true,"services":[],"authority":"ADVISORY","promotion":"FORBIDDEN"}
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "APPROVE" MODEL "openai/cursor-auto"
ASSERT VERDICT_AUTHORITY != "ADVISORY"