chore(api): verify and upgrade 3 runtime dependency pins

[tom-sapletta-com]

Consolidate Codot dependency PRs #12, #13 and #14 under native ticket-004: uvicorn[standard] 0.52.4 → 0.53.0, PyJWT 2.13.0 → 2.15.0 and jsonschema 4.23.0 → 4.26.0. The only implementation changes are these three requirements pins.

Validation on Python 3.10 and 3.12: all 10 existing API policy/protocol tests passed; six actual dependency binding smoke checks passed (valid JWT, expired-token denial, wrong-signature denial, valid and invalid inline JSON Schema, Uvicorn ASGI loading without a listener). Managed governance and native commit hooks passed.

The newly merged read-only API workflow executes the 10 existing tests against these candidate requirements. Independent publication must retain both API matrix and both governance gates using the already approved Codot profile. No application behavior or publication policy is changed. Original bot PR history is preserved until criterion reconciliation after trusted merge.

[ifuri-validator-agent]

Validator approval after policy checks for exact head 6708bf8ae7e83dc4dceaa2a7960d975455704a47.

Ticket: ticket-004
Correlation ID: local-autogrammar-codot-pr-17-ticket-004
Model: openai/cursor-auto
Reviewed diff chunks: 1
Advisory LLM verdict: APPROVE
Advisory summary: Reviewed all 1 diff chunk(s). The PR correctly updates the versions for uvicorn, pyjwt, and jsonschema in api/requirements.txt, and correctly adds the associated ticket-004 documentation. The changes precisely match the stated intent and PR body.
Advisory findings: none
The LLM output above is advisory and was not used as the approval trust root.
Semantic review prerequisite: not_required; policy 676cb4516bbfed2a000e40b9b1b6e4a430ecc761ec546aeb53d721a1905cfdd7.

Actual PR impact radar

Exact range: 963b706b69341192968d0039066ea78eb14e7a76...6708bf8ae7e83dc4dceaa2a7960d975455704a47
Change digest: 08681d8c71d74723fd9c79ba8fdf7b49017a9d628bd886a35902505b53f6504f
Score: 68/100 (L), estimated 70 min, split recommended: true
Affected services/components: repository-wide/unclassified

Machine-readable radar JSONL and SVG

{"actual_change":{"additions":99,"base_sha":"963b706b69341192968d0039066ea78eb14e7a76","binary_files":0,"categories":{"code":1,"configuration":1,"docs":2},"change_digest":"08681d8c71d74723fd9c79ba8fdf7b49017a9d628bd886a35902505b53f6504f","comparison":"963b706b69341192968d0039066ea78eb14e7a76...6708bf8ae7e83dc4dceaa2a7960d975455704a47","deletions":3,"file_count":4,"files":["api/requirements.txt","project/TICKETS.md","project/ticket-004/README.md","project/ticket-004/intent.json"],"head_sha":"6708bf8ae7e83dc4dceaa2a7960d975455704a47","service_count":0,"services":[]},"assessment_mode":"observed-pr","axes":{"coupling":4,"delivery":5,"scope":2,"uncertainty":3,"validation":3},"complexity":"L","confidence":0.9,"diagnostics":["RADAR-ACCEPTANCE-MISSING","RADAR-BUDGET-EXCEEDED"],"estimate":{"budget_minutes":30,"minutes":70,"within_budget":false},"impact":{"components":["api","policy","project"],"files":["api/requirements.txt","policy/protocol","project/TICKETS.md","project/ticket-004/README.md","project/ticket-004/intent.json"],"public_interfaces":["api/requirements.txt"],"runtime_dependencies":1},"schema":"subactor.ticket-radar/v1","score":68,"split":{"parts":[{"estimated_minutes":20,"name":"Define contract and acceptance boundary","scope":["api/requirements.txt"]},{"estimated_minutes":14,"name":"Implement api","scope":["api"]},{"estimated_minutes":14,"name":"Implement policy","scope":["policy"]},{"estimated_minutes":14,"name":"Implement project","scope":["project"]},{"estimated_minutes":15,"name":"Validate and project to trackers","scope":["tests","planfile","github/gitlab/jira projections"]}],"reason":"estimated_minutes_exceed_budget","recommended":true},"standards":[{"id":"wellmanifest/dsl","revision":"6c60fc4e0dd1f1bb74f46a7745e28019908d1203","version":"0.1.0-dev"},{"id":"wellmanifest/ticket-lifecycle","revision":"5bf581907a87b46a13a73e6c033d3abe4d9a306f","version":"0.1.0-dev"},{"id":"wellmanifest/git-lifecycle","revision":"7d77d4b7af57e69bc75c3a0290b3a4805c5c4438","version":"0.2.0-dev"},{"id":"wellmanifest/logs","revision":"48c284ef7a069055c0bcb6b900147ce5e65f8b43","version":"0.3.0"}],"ticket_ref":"ticket-004"}

<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" viewBox="0 0 128 128" role="img"><title>ticket-004: chore(api): verify and upgrade 3 runtime dependency pins</title><rect width="128" height="128" rx="12" fill="#f8fafc"/><g stroke-width="1"><polygon points="64,55 72,61 69,71 59,71 56,61" fill="none" stroke="#d7dde5"/><polygon points="64,47 80,59 74,78 54,78 48,59" fill="none" stroke="#d7dde5"/><polygon points="64,38 89,56 79,85 49,85 39,56" fill="none" stroke="#d7dde5"/><polygon points="64,30 97,53 84,92 44,92 31,53" fill="none" stroke="#d7dde5"/><polygon points="64,21 105,51 89,99 39,99 23,51" fill="none" stroke="#d7dde5"/><line x1="64" y1="64" x2="64" y2="21" stroke="#aab4c0"/><line x1="64" y1="64" x2="105" y2="51" stroke="#aab4c0"/><line x1="64" y1="64" x2="89" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="39" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="23" y2="51" stroke="#aab4c0"/></g><polygon points="64,47 97,53 79,85 49,85 23,51" fill="#fb923c" fill-opacity="0.45" stroke="#c2410c" stroke-width="2"/><circle cx="64" cy="64" r="3" fill="#c2410c"/><g font-family="sans-serif" font-size="7" fill="#334155"><text x="64" y="11" text-anchor="middle">SCO</text><text x="114" y="48" text-anchor="middle">COU</text><text x="95" y="107" text-anchor="middle">UNC</text><text x="33" y="107" text-anchor="middle">VAL</text><text x="14" y="48" text-anchor="middle">DEL</text></g><text x="64" y="124" text-anchor="middle" font-family="sans-serif" font-size="8" fill="#0f172a">L · 70m</text></svg>

Merge will be attempted after this approval when explicitly authorized. ## Decision record (recomputable)

DECISION D-004-9271
TICKET ticket-004
HEAD_SHA 6708bf8ae7e83dc4dceaa2a7960d975455704a47
CORRELATION_ID local-autogrammar-codot-pr-17-ticket-004
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT author_login = "tom-sapletta-com"
INPUT observed_checks = ["API tests (3.12)=PASS","API tests (3.10)=PASS","governance / enforce=PASS","governance / remote lifecycle=PASS"]
INPUT required_checks = ["governance / enforce","governance / remote lifecycle","API tests (3.10)","API tests (3.12)"]
INPUT required_checks_source = "protected registry (env/request)"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
INPUT semantic_review_assessment = {"schema":"subactor.validator/semantic-review-assessment/v1","subject":{"repository":"autogrammar/codot","pull_request":17,"head_sha":"6708bf8ae7e83dc4dceaa2a7960d975455704a47","base_sha":"963b706b69341192968d0039066ea78eb14e7a76","diff_sha256":"0cc2cc36688429bb089ce7119c625d4123fb5f2d15d66f7ef36105448b392059"},"policy":{"policy_schema":"subactor.validator/semantic-review-policy/v1","policy_version":1,"policy_sha256":"676cb4516bbfed2a000e40b9b1b6e4a430ecc761ec546aeb53d721a1905cfdd7","required":false,"critical_paths":[],"observed_paths":["api/requirements.txt","project/TICKETS.md","project/ticket-004/README.md","project/ticket-004/intent.json"]},"grounding":"full-diff-not-per-finding-proof","execution_authority":false,"status":"not_required","reason":null,"review_sha256":null,"unresolved":[]}
INPUT superseded_checks = []
INPUT ticket_radar_receipt = {"schema":"subactor.ticket-radar/v1","base_sha":"963b706b69341192968d0039066ea78eb14e7a76","head_sha":"6708bf8ae7e83dc4dceaa2a7960d975455704a47","change_digest":"08681d8c71d74723fd9c79ba8fdf7b49017a9d628bd886a35902505b53f6504f","score":68,"complexity":"L","estimated_minutes":70,"split_recommended":true,"services":[],"authority":"ADVISORY","promotion":"FORBIDDEN"}
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "APPROVE" MODEL "openai/cursor-auto"
ASSERT VERDICT_AUTHORITY != "ADVISORY"