# Backlog Label Enforcement And Codex Ticket Compliance Hardening V01

Issue: #352

Parent reference: #271

Motivating incident: #350

## Purpose

This note records the governance hardening response to the #350 label-metadata defect. Issue #350 was initially created without required labels even though the backlog triage workflow already said issue creation is incomplete without correct labels from the existing repo taxonomy.

Labels were repaired after creation. That repair fixed the issue metadata, but it exposed a process gap: Codex-ready child issue creation, draft PR creation, and closeout reporting must make missing labels visible without relying on Tony to notice the omission manually.

## Operating Boundary

This is repo operating-model guidance. It does not create runtime behavior, source retrieval behavior, source activation, Source Registry Admin live apply, package authority, provider/model configuration, Cloudflare configuration, UI behavior, or production approval.

## Required Control

Child issue creation is incomplete unless labels are present at creation or immediately repaired before implementation starts and before PR creation.

Codex-ready tickets must include a `## Required Labels` section with exact labels from the existing repo taxonomy. Placeholder label families are not enough for an executable ticket.

Draft PR creation must not be treated as complete if the linked child issue has no labels.

Closeout must verify:

- linked child issue exists
- linked child issue has required labels
- issue labels at closeout
- whether labels were present at creation
- whether any label repair was needed
- who or what performed the repair
- PR has no `codex-automerge` label unless explicitly authorized
- parent issue state is preserved
- issue close semantics are correct

## No-New-Label Rule

Use existing repository labels first. Do not invent new labels unless explicitly approved.

If a proposed issue label is absent from the repo taxonomy, stop and request owner approval or choose an existing label supported by the issue evidence. Invented labels are a taxonomy defect, not a harmless placeholder.

## Deterministic Validation

The focused validator is:

```bash
python3 -B validation/scripts/check_backlog_label_enforcement_ticket_compliance.py
```

The validator uses deterministic fixtures instead of live GitHub API calls. The fixture coverage includes:

- valid issue metadata with required labels
- invalid issue metadata missing labels
- invalid issue metadata with invented labels
- valid PR closeout where issue labels are present
- invalid PR closeout where issue labels are absent

## Expected Artifact Behavior

The backlog work item template must make required labels difficult to miss.

The PR template must require label-state reporting before closeout.

The Codex ceremony helper must support required issue-label verification for closeout and must report issue label state in the generated PR body.

The validation receipt must record issue labels at closeout, whether labels were present at creation, whether repair was needed, and the repair actor.

## Boundary Confirmations

- No source registry is mutated.
- No Preview source set is mutated.
- No Production source set is mutated.
- No source is enabled, disabled, retired, promoted, or applied.
- No Cloudflare CLI or API is used.
- No Cloudflare Access/WAF change is made.
- No provider/model configuration is changed.
- No runtime retrieval behavior is changed.
- No browser-side provider call is added.
- No browser-side current-source retrieval is added.
- No package authority is changed.
- No Source Registry Admin UI is implemented.
- No Source Registry Admin live apply is started.
- No Production apply is started.
- No OKF implementation is started.
- No Google SDLC implementation is started.
- No multi-agent orchestration implementation is started.
- `codex-automerge` is not applied.
- #271 remains open.
- #269 remains closed.