From 8b0aac55557dbaee26c50ac110b576fc2c17d57f Mon Sep 17 00:00:00 2001
From: Tom Softreck <tom@sapletta.com>
Date: Wed, 7 Oct 2026 00:16:18 +0200
Subject: [PATCH] ci(api): run 10 policy and protocol tests on 2 Python
 versions

---
 .github/workflows/api-tests.yml | 36 +++++++++++++++
 project/TICKETS.md              |  2 +
 project/ticket-003/README.md    | 14 ++++++
 project/ticket-003/intent.json  | 78 +++++++++++++++++++++++++++++++++
 4 files changed, 130 insertions(+)
 create mode 100644 .github/workflows/api-tests.yml
 create mode 100644 project/ticket-003/README.md
 create mode 100644 project/ticket-003/intent.json

diff --git a/.github/workflows/api-tests.yml b/.github/workflows/api-tests.yml
new file mode 100644
index 0000000..fe380e2
--- /dev/null
+++ b/.github/workflows/api-tests.yml
@@ -0,0 +1,36 @@
+name: API tests
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: API tests (${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.12"]
+    steps:
+      - name: Check out the exact candidate
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: api/requirements.txt
+      - name: Install candidate API requirements
+        run: python -m pip install --disable-pip-version-check -r api/requirements.txt "pytest>=8,<9"
+      - name: Run API policy and protocol tests
+        run: python -m pytest -q -p no:cacheprovider tests/test_policy.py tests/test_protocols.py
diff --git a/project/TICKETS.md b/project/TICKETS.md
index 21044fb..d7dc418 100644
--- a/project/TICKETS.md
+++ b/project/TICKETS.md
@@ -4,4 +4,6 @@
 | Ticket ID | Spec | Preprompt | Human input | Agent plans | Agent logs | Changelog |
 | :--- | :--- | :--- | :--- | :--- | :--- | :--- |
 | **ticket-001** | [`README.md`](./ticket-001/README.md) | - | - | - | - | - |
+| **ticket-002** | [`README.md`](./ticket-002/README.md) | - | - | - | - | - |
+| **ticket-003** | [`README.md`](./ticket-003/README.md) | - | - | - | - | - |
 <!-- AUTO:TICKET_INDEX:END -->
diff --git a/project/ticket-003/README.md b/project/ticket-003/README.md
new file mode 100644
index 0000000..42fa1d5
--- /dev/null
+++ b/project/ticket-003/README.md
@@ -0,0 +1,14 @@
+# Ticket 003: Verify API dependency candidates in hosted CI
+
+- **ID**: ticket-003
+- **Owner**: agent:codex
+- **Status**: IN_PROGRESS
+- **Workflow state**: PUBLICATION
+- **Created**: 2026-10-07
+
+SESSION_EXECUTION_AUTHORIZATION: User requested continuing repairs, tests and protected publication of overdue PRs. This ticket adds actual API test coverage needed for Codot dependency publication.
+
+## Acceptance criteria
+
+- [x] AC-01: Existing API tests run against candidate requirements on Python 3.10 and 3.12 for every PR and main push, with read-only GitHub permissions.
+- [ ] AC-02: Native governance and independent exact-head CI verification pass before protected publication.
diff --git a/project/ticket-003/intent.json b/project/ticket-003/intent.json
new file mode 100644
index 0000000..18e879f
--- /dev/null
+++ b/project/ticket-003/intent.json
@@ -0,0 +1,78 @@
+{
+  "schema": "new-project.intent/v3",
+  "ticket": "ticket-003",
+  "summary": "Run Codot API tests against exact candidate dependency requirements in CI",
+  "workstream": "governance",
+  "classification": {
+    "kind": "BUG",
+    "priority": "P1",
+    "origin": "requested"
+  },
+  "allowedPaths": [
+    ".github/workflows/api-tests.yml"
+  ],
+  "forbiddenPaths": [
+    ".env",
+    ".env.*",
+    "project/ticket-*/user-*.md"
+  ],
+  "stacks": [],
+  "dependsOn": [],
+  "conflictsWith": [],
+  "integrationTicket": null,
+  "delivery": {
+    "acceptedBaseSha": "a4b40feb4863148fe10324b062493cb64b15fd0e",
+    "targetBranch": "main",
+    "outcome": "Publish actual API unit tests on Python 3.10 and 3.12 for every PR and main push.",
+    "nonGoals": [
+      "Change API dependencies or application behavior",
+      "Admit a Validator profile or retire any existing check"
+    ],
+    "complexity": "S",
+    "estimatedMinutes": 45,
+    "budgets": {
+      "maxImplementationFiles": 2,
+      "maxAffectedComponents": 1,
+      "maxPublicInterfaceChanges": 0,
+      "maxRuntimeDependencies": 0
+    },
+    "architecture": {
+      "status": "accepted",
+      "decision": "Reuse existing API requirements and both existing test modules in an explicit read-only hosted CI workflow.",
+      "components": [
+        {
+          "name": "api-ci",
+          "paths": [
+            ".github/workflows/api-tests.yml"
+          ]
+        }
+      ],
+      "responsibilityChanges": false,
+      "interfaceChanges": [],
+      "dataChanges": [],
+      "ui": {
+        "impact": "none",
+        "states": [],
+        "evidence": []
+      },
+      "rollback": "Revert the workflow implementation commit."
+    },
+    "runtimeDependencies": [],
+    "validation": [
+      {
+        "criterion": "AC-01",
+        "commands": [
+          "python -m pytest -q tests/test_policy.py tests/test_protocols.py"
+        ],
+        "evidence": "Ten existing API tests pass with current requirements and with the proposed combined dependency updates."
+      },
+      {
+        "criterion": "AC-02",
+        "commands": [
+          "bash project/governance-check.sh --base origin/main --head HEAD"
+        ],
+        "evidence": "Managed scope, immutable adoption, hooks and canonical worktree checks pass."
+      }
+    ]
+  }
+}