ci: isolate Wellman from runner site-packages [ticket-019]

.github/workflows/wellman.yml

@@ -31,4 +31,4 @@ jobs:
       - name: Validate adopted requirements and Docs metadata
         env:
           PYTHONPATH: ${{ github.workspace }}/.wellman-runtime/src
-        run: python scripts/check-wellman.py
+        run: python -S scripts/check-wellman.py

project/TICKETS.md

@@ -23,4 +23,6 @@ This file indexes governance tickets without taking ownership of
 | **ticket-015** | [`README.md`](./ticket-015/README.md) | - | - | - | - | - |
 | **ticket-016** | [`README.md`](./ticket-016/README.md) | - | - |  [`ai-codex.md`](./ticket-016/ai-codex.md) | - | - |
 | **ticket-017** | [`README.md`](./ticket-017/README.md) | - | - |  [`ai-codex.md`](./ticket-017/ai-codex.md) | - | - |
+| **ticket-018** | [`README.md`](./ticket-018/README.md) | - | - | - | - | - |
+| **ticket-019** | [`README.md`](./ticket-019/README.md) | - | - | - | - | - |
 <!-- AUTO:TICKET_INDEX:END -->

project/ticket-019/README.md

@@ -0,0 +1,28 @@
+# Ticket 019: Run Wellman CI without site-packages
+
+- **ID**: ticket-019
+- **Owner**: agent:codex
+- **Status**: IN_PROGRESS
+- **Workflow state**: PUBLICATION
+- **Created**: 2026-10-01
+
+## Goal and scope
+
+Run the existing metadata checker with Python -S so runner-installed packages
+cannot mask missing dependencies. Preserve the pinned source and existing gates.
+
+## Acceptance criteria
+
+- [ ] AC-01: Local and hosted metadata validation runs without site-packages.
+- [ ] AC-02: Managed governance validates this scope.
+- [ ] AC-03: Independent Validator merges the tested head.
+
+## Authorization
+
+SESSION_EXECUTION_AUTHORIZATION: the owner requested completion, testing, push
+and protected merge of Wellmanifest adoption across Autogrammar repositories.
+This authorizes process invocation, not trusted merge approval.
+
+## Evidence boundary
+
+Raw output and receipts remain private external operational state.

project/ticket-019/intent.json

@@ -0,0 +1,81 @@
+{
+  "schema": "new-project.intent/v3",
+  "ticket": "ticket-019",
+  "summary": "Run Wellman CI without site-packages",
+  "workstream": "infrastructure",
+  "classification": {
+    "kind": "BUG",
+    "priority": "P1",
+    "origin": "regression"
+  },
+  "allowedPaths": [
+    "project/ticket-019/**",
+    "TODO.md",
+    "project/TICKETS.md",
+    ".github/workflows/wellman.yml"
+  ],
+  "forbiddenPaths": [
+    "project/ticket-*/user-*.md"
+  ],
+  "stacks": [],
+  "dependsOn": [
+    "ticket-018"
+  ],
+  "conflictsWith": [],
+  "integrationTicket": null,
+  "delivery": {
+    "acceptedBaseSha": "5263963a8de57388ed2e65c48a22c5e58d958130",
+    "targetBranch": "main",
+    "outcome": "Prevent runner-installed packages from masking undeclared Wellman dependencies during metadata validation.",
+    "nonGoals": [
+      "No changes to application or adopted metadata",
+      "No change to independent publication requirements"
+    ],
+    "complexity": "XS",
+    "estimatedMinutes": 5,
+    "budgets": {
+      "maxImplementationFiles": 1,
+      "maxAffectedComponents": 1,
+      "maxPublicInterfaceChanges": 0,
+      "maxRuntimeDependencies": 0
+    },
+    "architecture": {
+      "status": "accepted",
+      "decision": "Run the existing dependency-free pinned Wellman source checker with Python -S; preserve PYTHONPATH and immutable source/action pins.",
+      "components": [
+        {
+          "name": "ci",
+          "paths": [
+            ".github/workflows/wellman.yml"
+          ]
+        }
+      ],
+      "responsibilityChanges": false,
+      "interfaceChanges": [],
+      "dataChanges": [],
+      "ui": {
+        "impact": "none",
+        "states": [],
+        "evidence": []
+      },
+      "rollback": "Revert the isolated interpreter invocation."
+    },
+    "runtimeDependencies": [],
+    "validation": [
+      {
+        "criterion": "AC-01",
+        "commands": [
+          "python -S scripts/check-wellman.py"
+        ],
+        "evidence": "Local and hosted metadata checks run without site-packages."
+      },
+      {
+        "criterion": "AC-02",
+        "commands": [
+          "bash project/governance-check.sh --actor agent"
+        ],
+        "evidence": "Managed gate validates the exact committed range."
+      }
+    ]
+  }
+}