From f7b0fd3253747efeef590859df150fd759aaf306 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Sun, 23 Aug 2026 09:44:49 +0000 Subject: [PATCH 01/13] docs: refresh live product and technical gap baseline for 2026-08-23 - Rebind baseline to current protected main HEAD. - Capture 30 open .github PRs with exact head SHAs and merge metadata. - Add ADR-0002 and regression test for baseline contract. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- .../0002-product-technical-gap-baseline.md | 9 + docs/product-technical-gap-baseline.md | 168 ++++++++++++++++++ tests/test_product_technical_gap_baseline.py | 58 ++++++ 3 files changed, 235 insertions(+) create mode 100644 docs/adr/0002-product-technical-gap-baseline.md create mode 100644 docs/product-technical-gap-baseline.md create mode 100644 tests/test_product_technical_gap_baseline.py diff --git a/docs/adr/0002-product-technical-gap-baseline.md b/docs/adr/0002-product-technical-gap-baseline.md new file mode 100644 index 000000000..2385d2760 --- /dev/null +++ b/docs/adr/0002-product-technical-gap-baseline.md @@ -0,0 +1,9 @@ +# ADR-0002: Product and technical gap baseline + +- Status: accepted +- Date: 2026-08-23 +- Scope: ContextualWisdomLab/.github control plane +- Decision: Keep the buyer-facing product gap register and live PR metadata inventory in the baseline. Revalidate exact SHAs, reviews, threads, Checks, and rulesets before every merge. +- Ownership: .github owns control-plane evidence; naruon and product repositories own product behavior and consumer smoke. +- Figma File ID: N/A. This repository has no customer UI. A UI-owning repository must replace N/A with its real Figma File ID before a UI PR is accepted and must provide Storybook and design-token evidence. +- Consequence: The document is an operational snapshot, not a merge authorization or substitute for protected GitHub review. diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md new file mode 100644 index 000000000..dcb67d979 --- /dev/null +++ b/docs/product-technical-gap-baseline.md @@ -0,0 +1,168 @@ +# Product and Technical Gap Baseline + +검토 기준일: **2026-08-23 (Asia/Seoul)** +대상: **ContextualWisdomLab/.github** 중앙 거버넌스·자동화 레포지터리와 이를 소비하는 naruon 생태계 +현재 보호된 `main`: `885f2cd251999f21cf562cab3e2d9cc3cc3ec737` +현재 열린 PR 수: **30** (아래 표에 이 스냅샷의 전체 목록 포함) + +이 문서는 제품·기술·운영 Gap을 현재 문서와 현재 GitHub 상태에 묶어 두는 기준선이다. 새 작업은 먼저 이 문서의 Gap ID를 PR 설명과 테스트 증거에 연결하고, PR의 정확한 exact HEAD·Checks·리뷰를 다시 수집한 뒤 구현한다. 표의 상태는 작성 시점의 관측값이므로, 병합 판단에는 재사용하지 않는다. + +## 1. 근거와 범위 + +### 1.1 우선순위가 높은 근거 + +1. [CWL Master Context](CWL-MASTER-CONTEXT.md): naruon의 이메일 우선 플랫폼 경계, DIKW, no-ask 자동 해결, 다층·다중소속·시간·프라이버시 원칙. +2. [naruon #974](https://github.com/ContextualWisdomLab/naruon/issues/974): `docs/planning/naruon-platform-plan.md`를 추가한 병합된 제품/IA/User Story/Use Case/Architecture 기준. +3. [GitHub Project #1](https://github.com/orgs/ContextualWisdomLab/projects/1): 로드맵의 live source of truth. 이 문서는 live project board의 상태를 반영하며, 세부 항목 수는 project에서 직접 확인한다. +4. 중앙 ADR·doctoring·계약 문서: 보호된 main에 존재하는 [organization readiness doctoring](doctoring/organization-commercial-readiness-loop.md)와 현재 열린 PR 기록. + +### 1.2 제품 경계 + +구매자가 사는 핵심 결과는 “흩어진 enterprise context를 판단 가능한 구조로 만들고, 사람이 다음 행동을 승인할 수 있게 하는 것”이다. naruon은 이메일 호스트나 전자결재 시스템이 아니라 고객 소유 데이터에 연결되는 이메일 workspace/platform이다. 중앙 `.github`은 제품 기능을 대신 소유하지 않고, 정확한 HEAD·리뷰·Checks·증거·변경권한을 보장하는 control plane이다. + +핵심 구매 여정은 다음과 같다. + +1. 여러 계정·언어의 이메일에서 한 사건의 thread와 sender 의미를 찾는다. +2. 변경된 일정의 최신 truth, 변경 이력, commitment status와 충돌을 계산한다. +3. work/personal/project/band 등 겹치는 norm group을 선택하고, 관계·권한·유효기간을 고려한다. +4. 다른 context에는 필요한 결과(예: unavailable)만 consent·audit 기반으로 공개한다. +5. 사람은 근거·confidence·다음 행동을 보고 예외만 수정하며, 외부 writeback은 승인한다. + +## 2. PRD / TRD / UML 기준 + +### 2.1 PRD acceptance + +| ID | 구매자가 확인할 결과 | 수용 증거 | +|---|---|---|---| +| PRD-01 | “이 메일/보낸 사람이 왜 중요한가”를 찾는다 | hybrid retrieval, sender ontology, source segment provenance | +| PRD-02 | 일정 이동과 RSVP/commitment 충돌을 놓치지 않는다 | temporal event history, confirmed > tentative > desired weighting, conflict test | +| PRD-03 | 같은 사람이 여러 조직·팀·밴드에 소속되어도 권한을 뒤섞지 않는다 | reified relationship, multi-membership/norm-group resolution, ecological-fallacy test | +| PRD-04 | private reason을 노출하지 않고 필요한 consequence만 공유한다 | consented minimal-disclosure bridge, audit trail, revocation test | +| PRD-05 | 사용자가 모델 선택을 관리하지 않아도 품질을 우선해 자동 라우팅한다 | contextual-orchestrator `auto`, capability-before-cost, unpriced-is-not-free evidence | +| PRD-06 | 결과를 독립 제품 또는 naruon plugin으로 동일하게 쓴다 | versioned manifest/API, connector contract, standalone/submodule integration test | + +### 2.2 TRD target + +- **Platform plane:** naruon web/API, customer-VPC connector, Postgres/pgvector document KG, plugin registry, versioned extension points. +- **Evidence/control plane:** central `.github`, OpenCode/Noema/Strix, exact-source and exact-head binding, bounded hourly loops, no credential fallback, protected merge. +- **AI plane:** contextual-orchestrator adaptive routing; role별 reasoning effort, workflow depth, recursion, decomposition, verifier/synthesis를 quality evidence에 따라 배분. +- **Compute plane:** 수리과학·psychometrics의 계산 레이어와 속도·안정성·보안이 핵심인 hot path는 Rust 경계를 우선 검토하며, GPU/CPU multithreading과 낮은 context switching을 benchmark로 입증한다. Python/JS는 orchestration/API adapter로 제한한다. +- **Data plane:** 모든 영속 객체는 두 단어 이상 `snake_case`를 기본으로 하고 3NF를 지키며, 관계·evidence·confidence·validity·disclosure를 별도 정규화한다. +- **UX plane:** UI 제품만 Figma/Storybook/design token을 사용한다. 중앙 `.github`는 UI 없는 인프라 레포지터리이므로 Figma File ID는 **N/A (UI scope 없음)**이며, UI PR은 별도 ADR에 실제 File ID를 기록한다. + +### 2.3 UML-level dependency + +```mermaid +flowchart LR + User[Buyer / human judgment] --> Naruon[naruon email workspace] + Naruon --> Connector[Customer-VPC connector] + Naruon --> DocKG[Document KG / Postgres + pgvector] + Naruon --> Plugins[Versioned plugin boundary] + Plugins --> Verticals[BandScope / Wardnet / Inkspan / ScopeWeave] + Naruon --> Orch[contextual-orchestrator auto] + Orch --> Models[Embedding / response / audio / image / multimodal] + Orch --> Batch[pg-llm-batch] + Control[central .github] --> Review[OpenCode / Noema / Strix] + Control --> Checks[Checks + SBOM + provenance] + Review --> Merge[Protected exact-head merge] + Merge --> Control +``` + +## 3. Gap register + +우선순위는 구매자 체감, 보안/증거 위험, 선행 의존성 순서다. + +| Gap ID | 현재 관측 | 구매자 영향 | 우선 구현/검증 | +|---|---|---|---| +| G-01 | 열린 PR은 30개이고 metadata상 mergeable인 PR도 independent exact-head approval과 terminal required Checks를 자동으로 의미하지 않는다 | 안전하게 출시할 변경과 대기 중인 변경을 구별할 수 없다 | PR마다 current head, reviews, threads, required Checks를 재수집하고 보호 조건 미충족이면 merge하지 않는다 | +| G-02 | #1162는 review credential route를 고치지만 current Checks가 queued/cancelled로 반복되며 router의 403 경로가 선행 main에 남아 있다 | 리뷰가 호출돼도 승인 증거가 생성되지 않아 자동화가 멈춘다 | #1162 current-head quality와 OpenCode/Noema/Strix를 재실행하고, 병합 뒤 router comment/dispatch의 403을 실제 PR에서 검증한다 | +| G-03 | #1153의 Strix run은 `loginAsGuest`/Caido `127.0.0.1:48080` bootstrap 실패를 provider signal로 분류하지 않았다 | 취약점 0건이더라도 CI 인프라 결함이 보안 결과처럼 보이고 큐가 막힌다 | exact runtime signature를 불완전 evidence로 fail-closed 분류하고, vulnerability marker가 있으면 절대 neutralize하지 않는 regression을 유지한다 | +| G-04 | 30개 live PR 중 많은 항목이 BEHIND/DIRTY/UNSTABLE 또는 CHANGES_REQUESTED이며, 자동 caller PR이 제품 기능보다 앞서 쌓였다 | 제품 개발 속도가 queue hygiene에 소모되고, stacking 순서가 불명확하다 | product/ownership boundary별로 stack을 재정렬하고, 오래된 PR은 current main으로 normal merge/rebase 후 변경 범위를 검증한다 | +| G-05 | ecosystem contract/catalog PR은 존재하지만 naruon의 실제 plugin 소비·standalone 실행·connector round-trip 증거가 제한적이다 | 구매자는 “연결 가능” 문서와 실제 설치 가능한 제품을 구별할 수 없다 | manifest/version compatibility, command/event envelope, consumer smoke, rollback/upgrade contract를 조직 유관 레포에서 증명한다 | +| G-06 | naruon #974와 Project #1은 제품 목표를 정의하지만 E1/E2/E3의 live implementation evidence가 이 중앙 레포에 없다 | 이메일 검색·일정 충돌이라는 killer workflow가 문서에만 머문다 | naruon에서 thread/sender ontology → temporal commitment/conflict → human correction slice를 독립 PR로 delivery한다 | +| G-07 | multi-level/multi-membership/temporal 관계 원칙은 master context에 있으나 모든 소비 저장소의 schema/API가 동일한 reified relationship contract를 보장하는지는 미확인이다 | 개인 단위로 집계하거나 전역 권한을 적용하는 atomistic/ecological fallacy 위험이 남는다 | relationship, membership, norm_group, validity window, evidence, confidence, disclosure를 정규화하고 cross-context golden tests를 만든다 | +| G-08 | embedding·DOM·sender/receiver 의미 단위 chunking과 base64 image의 OCR/object/tag/position-index 설계가 ecosystem contract에 부분적으로만 반영됐다 | 검색은 되지만 실제 그림 위치와 의미를 회수하지 못해 편집·문서·메일 업무가 끊긴다 | semantic unit chunk schema와 image asset/region/ocr/tag embeddings를 별도 entity로 설계하고 source offset/DOM path를 보존한다 | +| G-09 | 100% coverage/docstring은 중앙 PR별로 증거가 있으나 조직 소비 레포의 frontend interaction/i18n/design-token/real-data accuracy 증거가 동일한지 미확인이다 | “green CI”가 실제 고객 시나리오 정확성을 보장하지 않는다 | domain-specific RMSE/reproducibility/audio/visual/browser acceptance와 edge matrix를 required evidence로 만든다 | +| G-10 | math/psychometrics의 Rust+GPU/CPU path와 시간·다층·다중소속 모델은 fast-mlsirm/psychometrics-commons 등 제품 레포의 책임이다 | 계산 정확도·성능·모델 해석 가능성을 Python glue만으로 보장할 수 없다 | Rust core, GPU/CPU benchmark, temporal/multilevel/multiple-membership fixtures, RMSE/recovery/ablation을 제품 PR에 묶는다 | +| G-11 | UI가 있는 제품의 Figma/Storybook inventory와 token/interaction/i18n 테스트는 중앙 control plane에서 소유할 수 없다 | 제품 간 UI가 달라지고 buyer onboarding이 일관되지 않는다 | 각 UI repo가 실제 Figma File ID ADR, Storybook inventory, shared token package, keyboard/edge/i18n tests를 소유한다 | +| G-12 | CSAP/SOC 2 통제 목표와 PII masking 대안은 doctoring에 흩어져 있으며 evidence-to-control mapping의 live completeness가 미확인이다 | PII를 마스킹하면 업무가 멈추고, 원문 접근을 허용하면 감사·유출 위험이 커진다 | consent/purpose/access lease, field-level encryption/tokenization, redaction-at-egress, audit/revocation와 CSAP/SOC 2 evidence map을 구현한다 | +| G-13 | hourly scheduler는 존재하지만 no-op/credential unavailable/queued Checks의 customer next action을 모든 caller가 동일한 receipt로 내는지 미확인이다. Main run `32359911521`은 `PR_REVIEW_MERGE_TOKEN` 미설정 시 즉시 실패하고 receipt artifact도 만들지 못했다 | 자동화가 실패해도 운영자가 무엇을 고쳐야 하는지 알 수 없다 | #1161의 `skipped_credential_unavailable` receipt와 다음 행동 문구를 exact-head Checks로 검증한 뒤 병합하고, bounded receipt schema, retry floor, single-flight, no secret fallback을 모든 caller contract test로 고정한다 | +| G-14 | release/changelog/version 증거가 각 PR에 분산되고 현재 central repo 보호 main의 release candidate가 명확하지 않다 | 구매자는 어떤 기능이 supportable release인지 확인할 수 없다 | merge 후 release readiness ledger, CHANGELOG, semantic version/tag, rollback/operability evidence를 함께 갱신한다 | + +## 4. 열린 PR live inventory + +아래는 GitHub PR search가 2026-08-23 09:xx UTC에 반환한 30개 열린 PR의 number/title/head/base metadata다. MERGEABLE은 GitHub metadata일 뿐 protected merge 승인이나 required Checks PASS를 뜻하지 않는다. 다음 루프에서 모든 행의 live review, thread, Checks를 다시 확인한다. + +| PR | title | head SHA | base | metadata | mode | +|---|---|---|---|---|---|---| +| #1152 | fix(opencode): retry OpenCode after coverage blockers clear | `e19066db8797a334f8bb2d9bd2d202564ff1bc20` | main | DIRTY | ready | +| #1154 | ⚡ Bolt: 민감한 데이터 스크러버(Redaction) 루프 O(N) 성능 최적화 | `2e2239b7c7f364665fdec9f686b7040ba1b95e09` | main | DIRTY | ready | +| #1157 | fix(coverage): discover hash-pinned requirements lock files | `c4121f92b2cfea3c0096622222d2aa06fe76c8b3` | main | DIRTY | ready | +| #1158 | fix(osv): preserve immutable direct-source provenance | `4e1102ba720ab5ef43296d17ca49b2a227fa58c0` | main | DIRTY | ready | +| #1161 | fix: make hourly coordinator credential absence auditable | `49bc5e4a59cd30550f87070b48b61e966ac480e1` | main | DIRTY | ready | +| #1162 | fix: use review credentials for agent dispatch | `444ac8bf99a95d98a60b305ccc1509283c3f671c` | main | DIRTY | ready | +| #1163 | docs: establish live product and technical gap baseline | `495ec011d5736a5619da89b715db1aae1f92e960` | main | DIRTY | ready | +| #1166 | fix(ci): recognize replacement tests in existing files | `62ef26d731ddbec59bd4203279219d79b6fdd0de` | main | BEHIND | ready | +| #1170 | feat: route OpenCode reviews through contextual gateway | `cbf937bc7216bf34883032a040aa3850136b9e81` | main | DIRTY | ready | +| #1172 | fix(autofix): resolve live NVIDIA NIM models instead of a retired pin | `edab578feca63c223368aef17c175bb52ce22e5a` | main | DIRTY | ready | +| #1176 | fix(governance): preserve proposal branch create transition | `5b2a2163eead22ffe0a65708cd4136e51afe291a` | main | DIRTY | ready | +| #1179 | ⚡ Bolt: [성능 개선] 레이블 스캔 시 O(N) 서브스트링 검증 선행 | `ade38c0193d5ae97c1c9f7adcfe6c603ed7cf201` | main | DIRTY | ready | +| #1187 | fix(coverage): scope Rust evidence to changed packages | `0a88e24d9a1c92420f412d241f850aab8e72106e` | main | DIRTY | ready | +| #1188 | fix: grant hourly callers reusable workflow OIDC scope | `1a0cc1f875db29492861006747ded2b6d9e93d09` | main | DIRTY | ready | +| #1198 | fix(security): repair pip audit and schedule orchestrator review | `e5a7ac882559fe6d1ae1f91e27d79bc8e0aa1e77` | main | DIRTY | ready | +| #1213 | fix: preserve Strix PR scope on provider exhaustion | `94db1b8431bdf9e7ba1555a5f44fd90f8f84de63` | fix/organization-loop-oidc-fallback | CLEAN | ready | +| #1215 | fix(security): redact agent-mention credential diagnostics | `6e17c3fb3f247c73dd55afcbf4f92a127549f345` | main | DIRTY | ready | +| #1218 | fix(coverage): admit protected-base test retirement | `a3e2dfca20cc76c1b8615df0f490fc5a1fc11e81` | main | DIRTY | ready | +| #1227 | fix(opencode): use same-repo status credential | `05b52e7617e87d2fd6892d8d387ff9d6707a110c` | main | DIRTY | ready | +| #1231 | fix(scheduler): isolate central Actions inventory quota | `e594f8ca2367aa226d98fcda4c2d17b248eea76b` | main | DIRTY | ready | +| #1233 | fix(automation): restore hourly fleet coordination | `70d9eb049f2946d269bb4ee1f8b7d72a31c84c81` | main | DIRTY | ready | +| #1237 | ⚡ Bolt: JSON 추출 최적화 및 버그 수정 (`raw_decode` 적용) | `59b910d3a6efc15484a2ad63c4c2c2dfbad4f34b` | main | BEHIND | ready | +| #1238 | fix(scheduler): stop repository_dispatch defaulting review/merge/branch flags off | `23a014eb89448c74cdd5d440d601de79a8d7665f` | main | DIRTY | ready | +| #1242 | ⚡ Bolt: 정규표현식 평가 병합 최적화 | `b27b834c60870f1b46cd719b0bcb4322a542946a` | main | BEHIND | ready | +| #1243 | ⚡ Bolt: [병렬 처리를 통한 스냅샷 수집 성능 개선] | `68dcc64803f89665bfc161a3ee7eb018e2612f1f` | main | BEHIND | ready | +| #1244 | 🛡️ Sentinel: [CRITICAL/HIGH] Fix SSRF in sandboxed_web_e2e wait_for_url | `4b4ad37da919a2f9c1c18aa1fba8cbb1da79cd56` | main | BEHIND | ready | +| #1245 | fix(scheduler): retry and gracefully defer shared installation rate limits | `c895eec54b50119496cc9c962682d1fafc18c405` | main | BEHIND | ready | +| #1246 | fix(opencode-review): accept int-typed run_id/run_attempt in control JSON | `c82036c33bb64c3a81b765531d1f90704d8252da` | main | BEHIND | ready | +| #1247 | fix(ci): lint modern Actions schemas safely | `46f3e72110aadda14d77ae6fd56db756350c3fcc` | fix/scheduler-actions-read-token | UNSTABLE | ready | +| #1251 | fix(strix): classify ModelBehaviorError as backend-unavailable | `1cdc02b6479c9c9487674c54692fc301a37604db` | main | DIRTY | ready | + +## 5. 실행 루프와 고객의 다음 행동 + +각 hourly pass는 아래 순서를 유지한다. + +1. 조직·repo 책임 경계를 확인하고, current default branch SHA와 PR head SHA를 새로 읽는다. +2. 열린 PR 하나를 선택해 review threads, formal review commit SHA, required Checks와 failure logs를 확인한다. +3. 실패가 코드 결함이면 root cause를 해당 PR의 최소 범위에서 수정하고, 원격 agent의 concurrent commit은 normal forward history로 보존한다. +4. 현실적인 domain test, edge test, docstring/branch coverage, security/SBOM, actionlint/browser evidence를 실행한다. +5. 새 head에서 Checks를 재실행하고 independent current-head approval을 다시 요청한다. +6. protected ruleset의 approval·resolved thread·terminal Checks·exact head를 모두 충족할 때만 normal merge한다. 조건이 안 되면 merge하지 않고 다음 PR로 진행한다. +7. PR이 소진되면 Project #1과 소비 repo에서 가장 큰 buyer gap을 선택해 새 PR을 만들고, 이 문서의 Gap ID를 연결한다. + +운영자는 receipt의 `next_action`만 실행하면 된다. 예를 들어 `PR_REVIEW_MERGE_TOKEN` 부재는 토큰 값을 로그에 남기지 말고 secret을 provision한 후 다음 hourly pass를 기다리며, Strix Caido bootstrap failure는 runner/container readiness를 복구한 후 같은 exact head를 재검증한다. + +## 6. Compliance and data boundary + +- PII 원문을 무조건 masking하여 업무를 끊지 않는다. 대신 purpose-bound access lease, field-level encryption/tokenization, consented minimal-disclosure consequence, audited access, revocation, retention/deletion을 사용한다. `COPILOT_GITHUB_TOKEN`은 사용하지 않는다. +- 모델·리뷰·sandbox·Checks·merge·release는 서로 다른 authority다. 하나의 PASS를 approval이나 release로 승격하지 않는다. +- 모든 untrusted input, repository patch, image/base64 payload, model output은 data로 취급하고 command/credential로 해석하지 않는다. +- demo/synthetic fixture는 unit test에만 두며 production seed/fixture에는 포함하지 않는다. + +## 7. APA 7th references + +American Institute of Certified Public Accountants. (2017). *2017 trust services criteria for security, availability, processing integrity, confidentiality, and privacy*. AICPA. + +International Organization for Standardization. (2022). *ISO/IEC 27001:2022 information security, cybersecurity and privacy protection—Information security management systems—Requirements*. ISO. + +International Organization for Standardization. (2023). *ISO/IEC 42001:2023 information technology—Artificial intelligence—Management system*. ISO. + +National Institute of Standards and Technology. (2023). *Artificial intelligence risk management framework (AI RMF 1.0)* (NIST AI 100-1). U.S. Department of Commerce. https://doi.org/10.6028/NIST.AI.100-1 + +World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines (WCAG) 2.2*. https://www.w3.org/TR/WCAG22/ + +Lewis, P., Perez, E., Piktus, A., Petroni, F., Karpukhin, V., Goyal, N., Küttler, H., Lewis, M., Yih, W.-t., Rocktäschel, T., Riedel, S., & Kiela, D. (2020). Retrieval-augmented generation for knowledge-intensive NLP tasks. *Advances in Neural Information Processing Systems, 33*, 9459–9474. + +Tang, Y., Cetin, E., Xu, J., Sun, Q., Nielsen, S., Richard, V., Goda, H., Tymchenko, I., Nguyen, N., Lee, H., Ashiga, M., Kotyan, S., Kuroki, S., & Clanuwat, T. (2026). *Sakana Fugu technical report* [Technical report]. arXiv. https://doi.org/10.48550/arXiv.2606.21228 + +Zhang, S., Yu, Y., Li, Y., Zhao, W., Yang, Y., Zhang, Y., & Liu, T. (2025). *Conductor: Learning to route multi-agent workflows* [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2512.04388 + +Xu, J., Sun, Q., Schwendeman, P., Nielsen, S., Cetin, E., & Tang, Y. (2026). *TRINITY: An evolved LLM coordinator* [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2512.04695 diff --git a/tests/test_product_technical_gap_baseline.py b/tests/test_product_technical_gap_baseline.py new file mode 100644 index 000000000..70e7e7bcd --- /dev/null +++ b/tests/test_product_technical_gap_baseline.py @@ -0,0 +1,58 @@ +"""Regression checks for the central product and technical gap baseline.""" + +import re +from pathlib import Path + + +BASELINE = Path("docs/product-technical-gap-baseline.md") +ADR = Path("docs/adr/0002-product-technical-gap-baseline.md") + + +def test_baseline_binds_current_governance_sources_and_buyer_contract() -> None: + """The baseline must point agents to product, governance, and buyer evidence.""" + source = BASELINE.read_text(encoding="utf-8") + + for marker in ( + "CWL Master Context", + "naruon #974", + "GitHub Project #1", + "PRD acceptance", + "TRD target", + "UML-level dependency", + "Figma File ID", + "APA 7th references", + "G-01", + "G-14", + "exact HEAD", + "independent current-head approval", + "COPILOT_GITHUB_TOKEN", + ): + assert marker in source + + +def test_baseline_inventory_contains_sha_bound_open_pr_rows() -> None: + """The captured inventory must include SHA and merge metadata for every row.""" + source = BASELINE.read_text(encoding="utf-8") + rows = [line for line in source.splitlines() if line.startswith("| #")] + + declared_count = int(re.search(r"현재 열린 PR 수:\s*\*\*(\d+)\*\*", source).group(1)) + assert len(rows) == declared_count + allowed_merge_states = { + "MERGEABLE", + "CONFLICTING", + "BLOCKED", + "BEHIND", + "DIRTY", + "UNSTABLE", + "CLEAN", + } + for row in rows: + assert re.search(r"[0-9a-f]{40}", row), row + assert any(state in row for state in allowed_merge_states), row + + +def test_baseline_records_the_ui_adr_boundary() -> None: + """The ADR states why a central UI file is not applicable.""" + adr = ADR.read_text(encoding="utf-8") + assert "Figma File ID: N/A" in adr + assert "Storybook" in adr From 3f5c47a0315a1ba3346c88b87f2d5a24095a16c8 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 23 Aug 2026 21:54:39 +0900 Subject: [PATCH 02/13] docs: bind live 107-PR gap baseline without merge authorization Refresh the product/technical gap snapshot against the current open queue, keep SHA rows as operational metadata, and record Figma File ID N/A plus APA 7th doctoring so hourly loops re-collect reviews and Checks. --- AGENTS.md | 2 +- ARCHITECTURE.md | 10 +- CHANGELOG.md | 5 + docs/CWL-MASTER-CONTEXT.md | 5 +- .../0002-product-technical-gap-baseline.md | 2 +- .../product-technical-gap-baseline.md | 78 +++++++ docs/product-technical-gap-baseline.md | 201 +++++++++++++----- tests/test_product_technical_gap_baseline.py | 26 ++- 8 files changed, 264 insertions(+), 65 deletions(-) create mode 100644 docs/doctoring/product-technical-gap-baseline.md diff --git a/AGENTS.md b/AGENTS.md index 4e906c47c..26daccda0 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -1,7 +1,7 @@ # AGENTS.md — ContextualWisdomLab .github -> **Agents: read the master context FIRST.** Before any work, read [`docs/CWL-MASTER-CONTEXT.md`](docs/CWL-MASTER-CONTEXT.md) (mission · naruon-as-platform + inter-component UML · cross-cutting disciplines · conventions · roadmap · current state), the live **GitHub Project #1** (work/roadmap source of truth), the full spec **ContextualWisdomLab/naruon#974**, and operate the Project per [`docs/agent-github-project-protocol.md`](docs/agent-github-project-protocol.md). The repo/Project — not any private agent memory — is the source of truth. +> **Agents: read the master context FIRST.** Before any work, read [`docs/CWL-MASTER-CONTEXT.md`](docs/CWL-MASTER-CONTEXT.md) (mission · naruon-as-platform + inter-component UML · cross-cutting disciplines · conventions · roadmap · current state), the live **GitHub Project #1** (work/roadmap source of truth), the full spec **ContextualWisdomLab/naruon#974**, the live gap snapshot [`docs/product-technical-gap-baseline.md`](docs/product-technical-gap-baseline.md) (not merge authorization; Figma File ID for this repo is N/A per [`docs/adr/0002-product-technical-gap-baseline.md`](docs/adr/0002-product-technical-gap-baseline.md)), and operate the Project per [`docs/agent-github-project-protocol.md`](docs/agent-github-project-protocol.md). The repo/Project — not any private agent memory — is the source of truth. Materialize accepts only exact SHA-256 pins, a bounded relative `-r` include (no `.`/`..`), or an organization-owned HTTPS Git source pinned to a full diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index fe33f5d4f..6310abcfe 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -3,26 +3,28 @@ This repository is the organization control plane. It is not naruon and it does not own product data. Sibling products remain standalone modules; this repo publishes org profile assets, reusable required workflows, and the -review/merge schedulers those products consume. +review/merge schedulers those products consume. The live gap snapshot is +[`docs/product-technical-gap-baseline.md`](docs/product-technical-gap-baseline.md); +it is not merge authorization. Figma File ID is N/A (no customer UI here). ## System context ```mermaid flowchart LR - Buyer["Commercial buyer / reviewer"] + Operator["Operator / reviewer"] Agents["Agents on AGENTS.md"] Project["GitHub Project #1"] Hub["This repo: org .github"] Products["Owned products
naruon · orchestrator · engines"] Runner["Required workflows in each repo context"] - Buyer --> Hub + Operator --> Hub Agents --> Project Agents --> Hub Project --> Hub Hub --> Runner Runner --> Products - Products -->|"standalone or as module"| Buyer + Products -->|"standalone or as module"| Operator ``` ## OriginWeave hourly caller diff --git a/CHANGELOG.md b/CHANGELOG.md index 6b0ef8d44..c93c4f466 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -19,6 +19,11 @@ Semantic Versioning where the repository publishes a release. ### Added +- Refresh the live product and technical gap baseline against the current + open-PR queue, with SHA-bound snapshot rows, a same-session open/close + delta section, ADR Figma File ID N/A, and APA 7th doctoring. The inventory + is not merge authorization. + - Classify Strix `ModelBehaviorError` and provider exhaustion as typed `STRIX_PROVIDER_UNAVAILABLE` evidence while preserving a nonzero required check. Incomplete scans and reported vulnerabilities both fail closed. diff --git a/docs/CWL-MASTER-CONTEXT.md b/docs/CWL-MASTER-CONTEXT.md index bd5e6c0c4..ee5935247 100644 --- a/docs/CWL-MASTER-CONTEXT.md +++ b/docs/CWL-MASTER-CONTEXT.md @@ -124,8 +124,9 @@ A **source-agnostic artifact-analysis service**: `submit(artifact, context) → ## 9. How work is tracked (dogfood the traceability) GitHub **Project #1** is the shared source of truth. Structure: real **Issues** (roadmap/backlog, in owning repos, custom fields Phase P0–P5/Ops/Decision + Component) and real **PRs** (delivered work, native Repository). Native workflows are ON (item added→Todo, PR merged→Done, item closed→Done). Chain: roadmap **Issue** → agent sets In Progress on pickup → implementing **PR** `Closes #N` → merge → auto Done. Operate the Project per `docs/agent-github-project-protocol.md`. Group by Phase / Component / Repository. -## 10. Current state (2026-07-08) -- Renames done (keyverse/wardnet/inkspan). Planning spec = naruon#974. Project #1 populated (68 issues + 60 PRs). Protocol = .github#363. +## 10. Current state (2026-08-23) +- Live product/technical gap snapshot: [`docs/product-technical-gap-baseline.md`](product-technical-gap-baseline.md) (SHA-bound open-PR inventory; not merge authorization). Figma File ID for this control-plane repo is N/A (`docs/adr/0002-product-technical-gap-baseline.md`). +- Renames done (keyverse/wardnet/inkspan). Planning spec = naruon#974. Protocol = .github#363. Project #1 remains the live tracker; naruon Phase 0 issue ContextualWisdomLab/naruon#975 is In Progress. - **BLOCKER B1**: org GitHub Actions effectively HALTED (~86 queued, ~0 in_progress org-wide) — likely the Actions monthly SPENDING CAP. Blocks ALL PR checks/merges + the Cloudflare DNS run (nameservers). Fix (org-admin): raise the Actions spending limit OR add a self-hosted runner. Nothing merges until then. - **Decisions pending**: (D1) Code Security enablement vs the CodeQL-only code_scanning ruleset (osv/trivy/scorecard SARIF upload) — a private repo needs GHAS seats; reconcile or make those checks non-required. (D2) trivy `limit-severities-for-sarif: true` (gate only CRITICAL/HIGH) — held pending the user's strict-security preference. - **Built this session, PR-open, awaiting merge (B1)**: see Project #1 PRs (contextual-orchestrator cost/routing #46 + naruon#973; pg-llm-batch; keyverse Keycloak; inkspan; SBOM #361; opencode auto-retry #360; Strix neutral #349 + emit #358; appguardrail collector #254; auto-rebase #357; noema #359/naruon#970; PDF-DOM naruon#965/newsdom#300; SDP #11; fast-mlsirm GPGPU #109; scopeweave #284/naruon#971; fuzzing 10 PRs (found+fixed 2 real naruon bugs); Cloudflare DNS/Pages #362; this protocol #363; planning #974). Human step: report the mapasevo21 malware file (github user-attachments) to GitHub Abuse; rotate the xtrmLLMBatchPython-leaked keys; the org-admin runner/decisions above. diff --git a/docs/adr/0002-product-technical-gap-baseline.md b/docs/adr/0002-product-technical-gap-baseline.md index 2385d2760..30f966c0c 100644 --- a/docs/adr/0002-product-technical-gap-baseline.md +++ b/docs/adr/0002-product-technical-gap-baseline.md @@ -6,4 +6,4 @@ - Decision: Keep the buyer-facing product gap register and live PR metadata inventory in the baseline. Revalidate exact SHAs, reviews, threads, Checks, and rulesets before every merge. - Ownership: .github owns control-plane evidence; naruon and product repositories own product behavior and consumer smoke. - Figma File ID: N/A. This repository has no customer UI. A UI-owning repository must replace N/A with its real Figma File ID before a UI PR is accepted and must provide Storybook and design-token evidence. -- Consequence: The document is an operational snapshot, not a merge authorization or substitute for protected GitHub review. +- Consequence: The document is an operational snapshot, not a merge authorization or substitute for protected GitHub review. Hourly agents must re-collect exact head SHAs, reviews, threads, and required Checks before merge. Papers/standards live in `docs/doctoring/product-technical-gap-baseline.md` and must remain consistent with this ADR. diff --git a/docs/doctoring/product-technical-gap-baseline.md b/docs/doctoring/product-technical-gap-baseline.md new file mode 100644 index 000000000..8ca7002c0 --- /dev/null +++ b/docs/doctoring/product-technical-gap-baseline.md @@ -0,0 +1,78 @@ +# Product and technical gap baseline — doctoring + +Status: accepted. Scope: ContextualWisdomLab/.github control plane. +Companion ADR: [`docs/adr/0002-product-technical-gap-baseline.md`](../adr/0002-product-technical-gap-baseline.md). +Live snapshot: [`docs/product-technical-gap-baseline.md`](../product-technical-gap-baseline.md). + +## Decision + +Keep a SHA-bound open-PR inventory and a 구매자-체감 Gap register in-repo so +hourly agents refresh current heads instead of private memory. The inventory is +an operational snapshot. It is not merge authorization, not a substitute for +current-head OpenCode/Noema approval, and not a reason to skip required Checks. + +Figma File ID: N/A. This repository has no customer UI. A UI-owning repository +must record its real Figma File ID in its own ADR before a UI PR is accepted +and must provide Storybook scene/edge-case events plus design-token evidence. + +PII masking is not the privacy strategy. Use purpose-bound access lease, +field-level encryption or tokenization, consented minimal-disclosure +consequence, audit, and revocation (CSAP / SOC 2 / ISO 27001 alignment). + +`COPILOT_GITHUB_TOKEN` is unused. Review-agent credentials stay independent of +repair/orchestrator credentials. + +## Exact-head papers and standards (APA 7th) + +These sources bind the Gap register and AI-plane TRD. They must not contradict +the protected `main` control-plane contracts. + +American Institute of Certified Public Accountants. (2017). *2017 trust +services criteria for security, availability, processing integrity, +confidentiality, and privacy*. AICPA. + +International Organization for Standardization. (2022). *ISO/IEC 27001:2022 +information security, cybersecurity and privacy protection—Information +security management systems—Requirements*. ISO. + +International Organization for Standardization. (2023). *ISO/IEC 42001:2023 +information technology—Artificial intelligence—Management system*. ISO. + +National Institute of Standards and Technology. (2023). *Artificial +intelligence risk management framework (AI RMF 1.0)* (NIST AI 100-1). U.S. +Department of Commerce. https://doi.org/10.6028/NIST.AI.100-1 + +World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines +(WCAG) 2.2*. https://www.w3.org/TR/WCAG22/ + +Lewis, P., Perez, E., Piktus, A., Petroni, F., Karpukhin, V., Goyal, N., +Küttler, H., Lewis, M., Yih, W.-t., Rocktäschel, T., Riedel, S., & Kiela, D. +(2020). Retrieval-augmented generation for knowledge-intensive NLP tasks. +*Advances in Neural Information Processing Systems, 33*, 9459–9474. + +Tang, Y., Cetin, E., Xu, J., Sun, Q., Nielsen, S., Richard, V., Goda, H., +Tymchenko, I., Nguyen, N., Lee, H., Ashiga, M., Kotyan, S., Kuroki, S., & +Clanuwat, T. (2026). *Sakana Fugu technical report* [Technical report]. arXiv. +https://doi.org/10.48550/arXiv.2606.21228 + +Zhang, S., Yu, Y., Li, Y., Zhao, W., Yang, Y., Zhang, Y., & Liu, T. (2025). +*Conductor: Learning to route multi-agent workflows* [Preprint]. arXiv. +https://doi.org/10.48550/arXiv.2512.04388 + +Xu, J., Sun, Q., Schwendeman, P., Nielsen, S., Cetin, E., & Tang, Y. (2026). +*TRINITY: An evolved LLM coordinator* [Preprint]. arXiv. +https://doi.org/10.48550/arXiv.2512.04695 + +Higgins, S. S., Crepalde, N., & Fernandes, L. (2021). Segmented multiplexity: +A research agenda for multiplexity beyond the average. *PLOS ONE, 16*(9), +e0257527. https://doi.org/10.1371/journal.pone.0257527 + +Local Zotero was not reachable from this session. Citations use the OA/DOI +records above; add the PDFs to the local Zotero library when the API is up. + +## Next action + +Refresh [`docs/product-technical-gap-baseline.md`](../product-technical-gap-baseline.md) +from live `gh pr list` before acting on any row. Then: 리뷰 확인 → 수정 → +Checks 재검증 → 병합 → 다음 개발. Wait for OpenCode/Strix/Noema without +stopping other PRs or Gap work. diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index dcb67d979..c6a62d299 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,20 +1,20 @@ # Product and Technical Gap Baseline -검토 기준일: **2026-08-23 (Asia/Seoul)** +작성 기준일: **2026-08-23 21:51 KST** 대상: **ContextualWisdomLab/.github** 중앙 거버넌스·자동화 레포지터리와 이를 소비하는 naruon 생태계 현재 보호된 `main`: `885f2cd251999f21cf562cab3e2d9cc3cc3ec737` -현재 열린 PR 수: **30** (아래 표에 이 스냅샷의 전체 목록 포함) +현재 열린 PR 수: **107** (아래 표에 이 스냅샷의 전체 목록 포함) -이 문서는 제품·기술·운영 Gap을 현재 문서와 현재 GitHub 상태에 묶어 두는 기준선이다. 새 작업은 먼저 이 문서의 Gap ID를 PR 설명과 테스트 증거에 연결하고, PR의 정확한 exact HEAD·Checks·리뷰를 다시 수집한 뒤 구현한다. 표의 상태는 작성 시점의 관측값이므로, 병합 판단에는 재사용하지 않는다. +이 문서는 제품·기술·운영 Gap을 현재 문서와 현재 GitHub 상태에 묶어 두는 기준선이다. 새 작업은 먼저 이 문서의 Gap ID를 PR 설명과 테스트 증거에 연결하고, PR의 정확한 exact HEAD·Checks·리뷰를 다시 수집한 뒤 구현한다. 표의 상태는 작성 시점의 관측값이므로, 병합 판단에는 재사용하지 않는다. 이 인벤토리는 스냅샷이며 merge authorization이 아니다. ## 1. 근거와 범위 ### 1.1 우선순위가 높은 근거 1. [CWL Master Context](CWL-MASTER-CONTEXT.md): naruon의 이메일 우선 플랫폼 경계, DIKW, no-ask 자동 해결, 다층·다중소속·시간·프라이버시 원칙. -2. [naruon #974](https://github.com/ContextualWisdomLab/naruon/issues/974): `docs/planning/naruon-platform-plan.md`를 추가한 병합된 제품/IA/User Story/Use Case/Architecture 기준. +2. [naruon #974](https://github.com/ContextualWisdomLab/naruon/pull/974): `docs/planning/naruon-platform-plan.md`를 추가한 병합된 제품/IA/User Story/Use Case/Architecture 기준. 이슈 트래커의 Phase 항목은 ContextualWisdomLab/naruon#975–#980. 3. [GitHub Project #1](https://github.com/orgs/ContextualWisdomLab/projects/1): 로드맵의 live source of truth. 이 문서는 live project board의 상태를 반영하며, 세부 항목 수는 project에서 직접 확인한다. -4. 중앙 ADR·doctoring·계약 문서: 보호된 main에 존재하는 [organization readiness doctoring](doctoring/organization-commercial-readiness-loop.md)와 현재 열린 PR 기록. +4. 중앙 ADR·doctoring·계약 문서: [ADR-0002](adr/0002-product-technical-gap-baseline.md), [hourly NVIDIA NIM autofix](doctoring/hourly-nvidia-nim-autofix.md), [Strix cryptography override](doctoring/strix-agent-cryptography-override.md), [trusted uv lock materialization](doctoring/trusted-uv-lock-materialization.md), [product-technical gap doctoring](doctoring/product-technical-gap-baseline.md). ### 1.2 제품 경계 @@ -33,7 +33,7 @@ ### 2.1 PRD acceptance | ID | 구매자가 확인할 결과 | 수용 증거 | -|---|---|---|---| +|---|---|---| | PRD-01 | “이 메일/보낸 사람이 왜 중요한가”를 찾는다 | hybrid retrieval, sender ontology, source segment provenance | | PRD-02 | 일정 이동과 RSVP/commitment 충돌을 놓치지 않는다 | temporal event history, confirmed > tentative > desired weighting, conflict test | | PRD-03 | 같은 사람이 여러 조직·팀·밴드에 소속되어도 권한을 뒤섞지 않는다 | reified relationship, multi-membership/norm-group resolution, ecological-fallacy test | @@ -45,16 +45,16 @@ - **Platform plane:** naruon web/API, customer-VPC connector, Postgres/pgvector document KG, plugin registry, versioned extension points. - **Evidence/control plane:** central `.github`, OpenCode/Noema/Strix, exact-source and exact-head binding, bounded hourly loops, no credential fallback, protected merge. -- **AI plane:** contextual-orchestrator adaptive routing; role별 reasoning effort, workflow depth, recursion, decomposition, verifier/synthesis를 quality evidence에 따라 배분. +- **AI plane:** contextual-orchestrator adaptive routing; role별 reasoning effort, workflow depth, recursion, decomposition, verifier/synthesis를 quality evidence에 따라 배분. Fugu, Conductor, TRINITY를 근거로 단일 모델 라우팅과 심층 다중 에이전트 오케스트레이션 사이에서 계산량을 배분한다. 속도는 최적화 목표가 아니다. - **Compute plane:** 수리과학·psychometrics의 계산 레이어와 속도·안정성·보안이 핵심인 hot path는 Rust 경계를 우선 검토하며, GPU/CPU multithreading과 낮은 context switching을 benchmark로 입증한다. Python/JS는 orchestration/API adapter로 제한한다. -- **Data plane:** 모든 영속 객체는 두 단어 이상 `snake_case`를 기본으로 하고 3NF를 지키며, 관계·evidence·confidence·validity·disclosure를 별도 정규화한다. -- **UX plane:** UI 제품만 Figma/Storybook/design token을 사용한다. 중앙 `.github`는 UI 없는 인프라 레포지터리이므로 Figma File ID는 **N/A (UI scope 없음)**이며, UI PR은 별도 ADR에 실제 File ID를 기록한다. +- **Data plane:** 모든 영속 객체는 두 단어 이상 `snake_case`를 기본으로 하고 3NF를 지키며, 관계·evidence·confidence·validity·disclosure를 별도 정규화한다. Hot partition 대비를 스키마에 둔다. +- **UX plane:** UI 제품만 Figma/Storybook/design token을 사용한다. 중앙 `.github`는 UI 없는 인프라 레포지터리이므로 Figma File ID는 **N/A (UI scope 없음)**이며, UI PR은 별도 ADR에 실제 File ID를 기록한다. UI-owning 저장소는 Storybook scene/edge-case event, Accessibility, Touch & Interaction, Performance, Style Selection, Layout & Responsive, Typography & Color, Animation, Forms & Feedback, Navigation Patterns, Charts & Data를 정의·검토·반영·적용·감사한다. ### 2.3 UML-level dependency ```mermaid flowchart LR - User[Buyer / human judgment] --> Naruon[naruon email workspace] + User[Human judgment] --> Naruon[naruon email workspace] Naruon --> Connector[Customer-VPC connector] Naruon --> DocKG[Document KG / Postgres + pgvector] Naruon --> Plugins[Versioned plugin boundary] @@ -74,57 +74,140 @@ flowchart LR | Gap ID | 현재 관측 | 구매자 영향 | 우선 구현/검증 | |---|---|---|---| -| G-01 | 열린 PR은 30개이고 metadata상 mergeable인 PR도 independent exact-head approval과 terminal required Checks를 자동으로 의미하지 않는다 | 안전하게 출시할 변경과 대기 중인 변경을 구별할 수 없다 | PR마다 current head, reviews, threads, required Checks를 재수집하고 보호 조건 미충족이면 merge하지 않는다 | -| G-02 | #1162는 review credential route를 고치지만 current Checks가 queued/cancelled로 반복되며 router의 403 경로가 선행 main에 남아 있다 | 리뷰가 호출돼도 승인 증거가 생성되지 않아 자동화가 멈춘다 | #1162 current-head quality와 OpenCode/Noema/Strix를 재실행하고, 병합 뒤 router comment/dispatch의 403을 실제 PR에서 검증한다 | -| G-03 | #1153의 Strix run은 `loginAsGuest`/Caido `127.0.0.1:48080` bootstrap 실패를 provider signal로 분류하지 않았다 | 취약점 0건이더라도 CI 인프라 결함이 보안 결과처럼 보이고 큐가 막힌다 | exact runtime signature를 불완전 evidence로 fail-closed 분류하고, vulnerability marker가 있으면 절대 neutralize하지 않는 regression을 유지한다 | -| G-04 | 30개 live PR 중 많은 항목이 BEHIND/DIRTY/UNSTABLE 또는 CHANGES_REQUESTED이며, 자동 caller PR이 제품 기능보다 앞서 쌓였다 | 제품 개발 속도가 queue hygiene에 소모되고, stacking 순서가 불명확하다 | product/ownership boundary별로 stack을 재정렬하고, 오래된 PR은 current main으로 normal merge/rebase 후 변경 범위를 검증한다 | +| G-01 | 열린 PR은 107개다. metadata상 CLEAN은 #1252 하나뿐이고 DIRTY 77 / BLOCKED 14 / BEHIND 14 / UNSTABLE 1 / draft 17이다. MERGEABLE/CLEAN은 independent exact-head approval과 terminal required Checks를 자동으로 의미하지 않는다 | 안전하게 출시할 변경과 대기 중인 변경을 구별할 수 없다 | PR마다 current head, reviews, threads, required Checks를 재수집하고 보호 조건 미충족이면 merge하지 않는다 | +| G-02 | 리뷰 credential / same-repo status / agent dispatch PR(#1162, #1227, #1215)이 DIRTY로 남아 선행 main 경로와 어긋난다 | 리뷰가 호출돼도 승인 증거가 생성되지 않아 자동화가 멈춘다 | current-head quality와 OpenCode/Noema/Strix를 재실행하고, 병합 뒤 router comment/dispatch의 403을 실제 PR에서 검증한다 | +| G-03 | Strix provider/fallback 스택이 #1254/#1255/#1256에 동시에 열려 있고, #1213은 UNSTABLE이며 #1153의 incomplete-scan fail-closed는 이미 main에 있다 | 취약점 0건이더라도 CI 인프라 결함이 보안 결과처럼 보이고 큐가 막힌다 | exact runtime signature를 불완전 evidence로 fail-closed 분류하고, vulnerability marker가 있으면 절대 neutralize하지 않는 regression을 유지한다. 중복 Strix PR은 stack/supersede한다 | +| G-04 | 107개 live PR 중 대부분이 BEHIND/DIRTY/UNSTABLE이며, 자동 caller PR이 제품 기능보다 앞서 쌓였다 | 제품 개발 속도가 queue hygiene에 소모되고, stacking 순서가 불명확하다 | product/ownership boundary별로 stack을 재정렬하고, 오래된 PR은 current main으로 normal merge/rebase 후 변경 범위를 검증한다 | | G-05 | ecosystem contract/catalog PR은 존재하지만 naruon의 실제 plugin 소비·standalone 실행·connector round-trip 증거가 제한적이다 | 구매자는 “연결 가능” 문서와 실제 설치 가능한 제품을 구별할 수 없다 | manifest/version compatibility, command/event envelope, consumer smoke, rollback/upgrade contract를 조직 유관 레포에서 증명한다 | -| G-06 | naruon #974와 Project #1은 제품 목표를 정의하지만 E1/E2/E3의 live implementation evidence가 이 중앙 레포에 없다 | 이메일 검색·일정 충돌이라는 killer workflow가 문서에만 머문다 | naruon에서 thread/sender ontology → temporal commitment/conflict → human correction slice를 독립 PR로 delivery한다 | +| G-06 | naruon #974와 Project #1은 제품 목표를 정의하지만 E1/E2/E3의 live implementation evidence가 이 중앙 레포에 없다. Phase 0 Issue ContextualWisdomLab/naruon#975는 In Progress다 | 이메일 검색·일정 충돌이라는 killer workflow가 문서에만 머문다 | naruon에서 thread/sender ontology → temporal commitment/conflict → human correction slice를 독립 PR로 delivery한다. 소유 저장소는 naruon이다 | | G-07 | multi-level/multi-membership/temporal 관계 원칙은 master context에 있으나 모든 소비 저장소의 schema/API가 동일한 reified relationship contract를 보장하는지는 미확인이다 | 개인 단위로 집계하거나 전역 권한을 적용하는 atomistic/ecological fallacy 위험이 남는다 | relationship, membership, norm_group, validity window, evidence, confidence, disclosure를 정규화하고 cross-context golden tests를 만든다 | | G-08 | embedding·DOM·sender/receiver 의미 단위 chunking과 base64 image의 OCR/object/tag/position-index 설계가 ecosystem contract에 부분적으로만 반영됐다 | 검색은 되지만 실제 그림 위치와 의미를 회수하지 못해 편집·문서·메일 업무가 끊긴다 | semantic unit chunk schema와 image asset/region/ocr/tag embeddings를 별도 entity로 설계하고 source offset/DOM path를 보존한다 | | G-09 | 100% coverage/docstring은 중앙 PR별로 증거가 있으나 조직 소비 레포의 frontend interaction/i18n/design-token/real-data accuracy 증거가 동일한지 미확인이다 | “green CI”가 실제 고객 시나리오 정확성을 보장하지 않는다 | domain-specific RMSE/reproducibility/audio/visual/browser acceptance와 edge matrix를 required evidence로 만든다 | | G-10 | math/psychometrics의 Rust+GPU/CPU path와 시간·다층·다중소속 모델은 fast-mlsirm/psychometrics-commons 등 제품 레포의 책임이다 | 계산 정확도·성능·모델 해석 가능성을 Python glue만으로 보장할 수 없다 | Rust core, GPU/CPU benchmark, temporal/multilevel/multiple-membership fixtures, RMSE/recovery/ablation을 제품 PR에 묶는다 | -| G-11 | UI가 있는 제품의 Figma/Storybook inventory와 token/interaction/i18n 테스트는 중앙 control plane에서 소유할 수 없다 | 제품 간 UI가 달라지고 buyer onboarding이 일관되지 않는다 | 각 UI repo가 실제 Figma File ID ADR, Storybook inventory, shared token package, keyboard/edge/i18n tests를 소유한다 | +| G-11 | UI가 있는 제품의 Figma/Storybook inventory와 token/interaction/i18n 테스트는 중앙 control plane에서 소유할 수 없다. Figma File ID는 이 저장소 ADR에서 N/A다 | 제품 간 UI가 달라지고 운영자 onboarding이 일관되지 않는다 | 각 UI repo가 실제 Figma File ID ADR, Storybook inventory, shared token package, keyboard/edge/i18n tests를 소유한다 | | G-12 | CSAP/SOC 2 통제 목표와 PII masking 대안은 doctoring에 흩어져 있으며 evidence-to-control mapping의 live completeness가 미확인이다 | PII를 마스킹하면 업무가 멈추고, 원문 접근을 허용하면 감사·유출 위험이 커진다 | consent/purpose/access lease, field-level encryption/tokenization, redaction-at-egress, audit/revocation와 CSAP/SOC 2 evidence map을 구현한다 | -| G-13 | hourly scheduler는 존재하지만 no-op/credential unavailable/queued Checks의 customer next action을 모든 caller가 동일한 receipt로 내는지 미확인이다. Main run `32359911521`은 `PR_REVIEW_MERGE_TOKEN` 미설정 시 즉시 실패하고 receipt artifact도 만들지 못했다 | 자동화가 실패해도 운영자가 무엇을 고쳐야 하는지 알 수 없다 | #1161의 `skipped_credential_unavailable` receipt와 다음 행동 문구를 exact-head Checks로 검증한 뒤 병합하고, bounded receipt schema, retry floor, single-flight, no secret fallback을 모든 caller contract test로 고정한다 | -| G-14 | release/changelog/version 증거가 각 PR에 분산되고 현재 central repo 보호 main의 release candidate가 명확하지 않다 | 구매자는 어떤 기능이 supportable release인지 확인할 수 없다 | merge 후 release readiness ledger, CHANGELOG, semantic version/tag, rollback/operability evidence를 함께 갱신한다 | +| G-13 | hourly scheduler는 존재하지만 no-op/credential unavailable/queued Checks의 customer next action을 모든 caller가 동일한 receipt로 내는지 미확인이다 | 자동화가 실패해도 운영자가 무엇을 고쳐야 하는지 알 수 없다 | `skipped_credential_unavailable` receipt와 다음 행동 문구를 exact-head Checks로 검증한 뒤 병합하고, bounded receipt schema, retry floor, single-flight, no secret fallback을 모든 caller contract test로 고정한다 | +| G-14 | release/changelog/version 증거가 각 PR에 분산되고 현재 central repo 보호 main의 release candidate가 명확하지 않다 | 운영자는 어떤 기능이 supportable release인지 확인할 수 없다 | merge 후 release readiness ledger, CHANGELOG, semantic version/tag, rollback/operability evidence를 함께 갱신한다 | ## 4. 열린 PR live inventory -아래는 GitHub PR search가 2026-08-23 09:xx UTC에 반환한 30개 열린 PR의 number/title/head/base metadata다. MERGEABLE은 GitHub metadata일 뿐 protected merge 승인이나 required Checks PASS를 뜻하지 않는다. 다음 루프에서 모든 행의 live review, thread, Checks를 다시 확인한다. +아래는 GitHub PR list가 2026-08-23 21:51 KST에 반환한 107개 열린 PR의 number/title/head/base metadata다. CLEAN/BLOCKED/DIRTY/BEHIND/UNSTABLE은 GitHub metadata일 뿐 protected merge 승인이나 required Checks PASS를 뜻하지 않는다. 다음 루프에서 모든 행의 live review, thread, Checks를 다시 확인한다. + +스냅샷 요약: CLEAN [1252]; BLOCKED [1256, 1255, 1254, 1253, 1238, 1233, 1231, 1176, 1158, 1107, 1086, 1052, 941, 897]; UNSTABLE [1213]; DIRTY 77; BEHIND 14; draft 17. | PR | title | head SHA | base | metadata | mode | -|---|---|---|---|---|---|---| -| #1152 | fix(opencode): retry OpenCode after coverage blockers clear | `e19066db8797a334f8bb2d9bd2d202564ff1bc20` | main | DIRTY | ready | -| #1154 | ⚡ Bolt: 민감한 데이터 스크러버(Redaction) 루프 O(N) 성능 최적화 | `2e2239b7c7f364665fdec9f686b7040ba1b95e09` | main | DIRTY | ready | -| #1157 | fix(coverage): discover hash-pinned requirements lock files | `c4121f92b2cfea3c0096622222d2aa06fe76c8b3` | main | DIRTY | ready | -| #1158 | fix(osv): preserve immutable direct-source provenance | `4e1102ba720ab5ef43296d17ca49b2a227fa58c0` | main | DIRTY | ready | -| #1161 | fix: make hourly coordinator credential absence auditable | `49bc5e4a59cd30550f87070b48b61e966ac480e1` | main | DIRTY | ready | -| #1162 | fix: use review credentials for agent dispatch | `444ac8bf99a95d98a60b305ccc1509283c3f671c` | main | DIRTY | ready | -| #1163 | docs: establish live product and technical gap baseline | `495ec011d5736a5619da89b715db1aae1f92e960` | main | DIRTY | ready | -| #1166 | fix(ci): recognize replacement tests in existing files | `62ef26d731ddbec59bd4203279219d79b6fdd0de` | main | BEHIND | ready | -| #1170 | feat: route OpenCode reviews through contextual gateway | `cbf937bc7216bf34883032a040aa3850136b9e81` | main | DIRTY | ready | -| #1172 | fix(autofix): resolve live NVIDIA NIM models instead of a retired pin | `edab578feca63c223368aef17c175bb52ce22e5a` | main | DIRTY | ready | -| #1176 | fix(governance): preserve proposal branch create transition | `5b2a2163eead22ffe0a65708cd4136e51afe291a` | main | DIRTY | ready | -| #1179 | ⚡ Bolt: [성능 개선] 레이블 스캔 시 O(N) 서브스트링 검증 선행 | `ade38c0193d5ae97c1c9f7adcfe6c603ed7cf201` | main | DIRTY | ready | -| #1187 | fix(coverage): scope Rust evidence to changed packages | `0a88e24d9a1c92420f412d241f850aab8e72106e` | main | DIRTY | ready | -| #1188 | fix: grant hourly callers reusable workflow OIDC scope | `1a0cc1f875db29492861006747ded2b6d9e93d09` | main | DIRTY | ready | -| #1198 | fix(security): repair pip audit and schedule orchestrator review | `e5a7ac882559fe6d1ae1f91e27d79bc8e0aa1e77` | main | DIRTY | ready | -| #1213 | fix: preserve Strix PR scope on provider exhaustion | `94db1b8431bdf9e7ba1555a5f44fd90f8f84de63` | fix/organization-loop-oidc-fallback | CLEAN | ready | -| #1215 | fix(security): redact agent-mention credential diagnostics | `6e17c3fb3f247c73dd55afcbf4f92a127549f345` | main | DIRTY | ready | -| #1218 | fix(coverage): admit protected-base test retirement | `a3e2dfca20cc76c1b8615df0f490fc5a1fc11e81` | main | DIRTY | ready | -| #1227 | fix(opencode): use same-repo status credential | `05b52e7617e87d2fd6892d8d387ff9d6707a110c` | main | DIRTY | ready | -| #1231 | fix(scheduler): isolate central Actions inventory quota | `e594f8ca2367aa226d98fcda4c2d17b248eea76b` | main | DIRTY | ready | -| #1233 | fix(automation): restore hourly fleet coordination | `70d9eb049f2946d269bb4ee1f8b7d72a31c84c81` | main | DIRTY | ready | -| #1237 | ⚡ Bolt: JSON 추출 최적화 및 버그 수정 (`raw_decode` 적용) | `59b910d3a6efc15484a2ad63c4c2c2dfbad4f34b` | main | BEHIND | ready | -| #1238 | fix(scheduler): stop repository_dispatch defaulting review/merge/branch flags off | `23a014eb89448c74cdd5d440d601de79a8d7665f` | main | DIRTY | ready | -| #1242 | ⚡ Bolt: 정규표현식 평가 병합 최적화 | `b27b834c60870f1b46cd719b0bcb4322a542946a` | main | BEHIND | ready | -| #1243 | ⚡ Bolt: [병렬 처리를 통한 스냅샷 수집 성능 개선] | `68dcc64803f89665bfc161a3ee7eb018e2612f1f` | main | BEHIND | ready | -| #1244 | 🛡️ Sentinel: [CRITICAL/HIGH] Fix SSRF in sandboxed_web_e2e wait_for_url | `4b4ad37da919a2f9c1c18aa1fba8cbb1da79cd56` | main | BEHIND | ready | -| #1245 | fix(scheduler): retry and gracefully defer shared installation rate limits | `c895eec54b50119496cc9c962682d1fafc18c405` | main | BEHIND | ready | +|---|---|---|---|---|---| +| #1256 | fix(strix): recognize the hyphenated openai-direct fallback alias | `f2a6aab1fa7297c801b9aa324f52d8e979671ca0` | main | BLOCKED | ready | +| #1255 | fix(strix): accept complete scans with benign model-quality advisory | `a1fc43a13085b4dbe9367a871e33461c4eea9ae0` | main | BLOCKED | ready | +| #1254 | fix(strix): preserve NIM fallback evidence | `e21c149af5549fd63d9c8d53a342e0a8018273f3` | main | BLOCKED | ready | +| #1253 | feat(opencode): audit ScopeWeave calendar stack after #506 merge | `1e4caae4528b62fa6d2fd557f73b251bba89680f` | main | BLOCKED | ready | +| #1252 | docs: refresh live product and technical gap baseline | `f7b0fd3253747efeef590859df150fd759aaf306` | main | CLEAN | ready | | #1246 | fix(opencode-review): accept int-typed run_id/run_attempt in control JSON | `c82036c33bb64c3a81b765531d1f90704d8252da` | main | BEHIND | ready | -| #1247 | fix(ci): lint modern Actions schemas safely | `46f3e72110aadda14d77ae6fd56db756350c3fcc` | fix/scheduler-actions-read-token | UNSTABLE | ready | -| #1251 | fix(strix): classify ModelBehaviorError as backend-unavailable | `1cdc02b6479c9c9487674c54692fc301a37604db` | main | DIRTY | ready | +| #1245 | fix(scheduler): retry and gracefully defer shared installation rate limits | `c895eec54b50119496cc9c962682d1fafc18c405` | main | BEHIND | ready | +| #1244 | 🛡️ Sentinel: [CRITICAL/HIGH] Fix SSRF in sandboxed_web_e2e wait_for_url | `4b4ad37da919a2f9c1c18aa1fba8cbb1da79cd56` | main | BEHIND | ready | +| #1243 | ⚡ Bolt: [병렬 처리를 통한 스냅샷 수집 성능 개선] | `68dcc64803f89665bfc161a3ee7eb018e2612f1f` | main | BEHIND | ready | +| #1242 | ⚡ Bolt: 정규표현식 평가 병합 최적화 | `b27b834c60870f1b46cd719b0bcb4322a542946a` | main | BEHIND | ready | +| #1238 | fix(scheduler): stop repository_dispatch defaulting review/merge/branch flags off | `21b4c58577d54aed299cf0d2dc30a0ee80ff0902` | main | BLOCKED | ready | +| #1237 | ⚡ Bolt: JSON 추출 최적화 및 버그 수정 (`raw_decode` 적용) | `59b910d3a6efc15484a2ad63c4c2c2dfbad4f34b` | main | BEHIND | ready | +| #1233 | fix(automation): restore hourly fleet coordination | `dfb8e261c81705841111dd4ad1712a9fb6c767d1` | main | BLOCKED | ready | +| #1231 | fix(scheduler): isolate central Actions inventory quota | `e9001ce4c05467096728d70fcb89de70060d3395` | main | BLOCKED | ready | +| #1227 | fix(opencode): use same-repo status credential | `05b52e7617e87d2fd6892d8d387ff9d6707a110c` | main | DIRTY | ready | +| #1218 | fix(coverage): admit protected-base test retirement | `a3e2dfca20cc76c1b8615df0f490fc5a1fc11e81` | main | DIRTY | ready | +| #1215 | fix(security): redact agent-mention credential diagnostics | `6e17c3fb3f247c73dd55afcbf4f92a127549f345` | main | DIRTY | ready | +| #1213 | fix(strix): route unsupported Azure sampling failures to a valid fallback | `9dcd1d6c4c11602163cb89edaad9540e9d6f461a` | fix/organization-loop-oidc-fallback | UNSTABLE | ready | +| #1198 | fix(security): repair pip audit and schedule orchestrator review | `e5a7ac882559fe6d1ae1f91e27d79bc8e0aa1e77` | main | DIRTY | ready | +| #1188 | fix: grant hourly callers reusable workflow OIDC scope | `1a0cc1f875db29492861006747ded2b6d9e93d09` | main | DIRTY | ready | +| #1187 | fix(coverage): scope Rust evidence to changed packages | `0a88e24d9a1c92420f412d241f850aab8e72106e` | main | DIRTY | ready | +| #1179 | ⚡ Bolt: [성능 개선] 레이블 스캔 시 O(N) 서브스트링 검증 선행 | `ade38c0193d5ae97c1c9f7adcfe6c603ed7cf201` | main | DIRTY | ready | +| #1176 | fix(governance): preserve proposal branch create transition | `49f6988795262194e4eda8b3ea7319b7b39c4e77` | main | BLOCKED | ready | +| #1172 | fix(autofix): resolve live NVIDIA NIM models instead of a retired pin | `edab578feca63c223368aef17c175bb52ce22e5a` | main | DIRTY | ready | +| #1170 | feat: route OpenCode reviews through contextual gateway | `cbf937bc7216bf34883032a040aa3850136b9e81` | main | DIRTY | ready | +| #1166 | fix(ci): recognize replacement tests in existing files | `62ef26d731ddbec59bd4203279219d79b6fdd0de` | main | BEHIND | ready | +| #1162 | fix: use review credentials for agent dispatch | `444ac8bf99a95d98a60b305ccc1509283c3f671c` | main | DIRTY | ready | +| #1161 | fix: make hourly coordinator credential absence auditable | `49bc5e4a59cd30550f87070b48b61e966ac480e1` | main | DIRTY | ready | +| #1158 | fix(osv): preserve immutable direct-source provenance | `e61fb11fbd5c7464d34cc8bedc3a7177fbdcade2` | main | BLOCKED | ready | +| #1157 | fix(coverage): discover hash-pinned requirements lock files | `c4121f92b2cfea3c0096622222d2aa06fe76c8b3` | main | DIRTY | ready | +| #1154 | ⚡ Bolt: 민감한 데이터 스크러버(Redaction) 루프 O(N) 성능 최적화 | `2e2239b7c7f364665fdec9f686b7040ba1b95e09` | main | DIRTY | ready | +| #1152 | fix(opencode): retry OpenCode after coverage blockers clear | `e19066db8797a334f8bb2d9bd2d202564ff1bc20` | main | DIRTY | ready | +| #1150 | feat: add read-only Actions queue health evidence | `efa7788bd14e3513221577566a768fc36f03ccff` | main | DIRTY | ready | +| #1147 | feat(integration): add ecosystem capability catalogue | `113de5eb71ff9e06c00f4c272266662dcbd97392` | main | DIRTY | ready | +| #1146 | fix(figma): retain style references and component sets | `8ffdf4d8150091957a79b5fc63c984e927d323b3` | main | DIRTY | ready | +| #1145 | feat: enforce adaptive orchestration defaults | `2451889cc80afa9101275e1356f8757fabc69b44` | main | DIRTY | ready | +| #1143 | ci: schedule naruon hourly review repair | `9c2842ab1d49bb1ed74683bc52c0e213eb5d5bc7` | main | DIRTY | ready | +| #1123 | feat(edge): standardize organization runtimes on Cloudflare Pingora | `251b16836164cfcfc0914a568d514cc7b6a9dd6d` | main | DIRTY | ready | +| #1120 | Wire Noema to a same-job contextual-orchestrator sidecar | `101e6906cc3568beb99c19c28eaffb526bac335b` | main | DIRTY | draft | +| #1114 | fix(strix): retry transient visibility API failures | `5690b45e2b7caf08644515ca879a091a9bb51a6e` | main | DIRTY | ready | +| #1112 | fix(storage): reject embedded IPv4 rebinding hosts | `dc7e39cf7dff80c2e2ed8d348090394ddc643142` | main | DIRTY | draft | +| #1108 | feat(automation): run free-router hourly NVIDIA NIM review repair | `df5ae0b1fff42205627b4af556c7e95e87138b7a` | main | DIRTY | ready | +| #1107 | chore(deps): bump github/codeql-action/init from 4.37.0 to 4.37.7 | `cf87c5389ad776c5f03b92226a3307bd7e759fe7` | main | BLOCKED | ready | +| #1104 | chore(deps): bump charset-normalizer from 3.4.7 to 3.5.1 | `d90c8320bcce63269f1ab6368f1073841c157363` | main | BEHIND | ready | +| #1103 | chore(deps): bump google-cloud-resource-manager from 1.17.0 to 1.18.0 | `3b58d8e8d5db29c623bf90ee42ba1b54a7a58749` | main | BEHIND | ready | +| #1101 | feat(automation): run EmbedRelay hourly NVIDIA NIM review repair | `77557a9e35d6467a9b8fcbc25e7e73f90683383c` | main | DIRTY | ready | +| #1100 | feat(automation): run RankWeave hourly NVIDIA NIM review repair | `e9ccfd21f1efd13da03e72664d0585dffc1dac00` | main | DIRTY | ready | +| #1097 | feat(automation): run html4tree hourly NVIDIA NIM review repair | `627b7ade1a4875addb7e38c0726bd6fd82f01511` | main | DIRTY | ready | +| #1095 | feat(automation): run mhtml-etl-gateway hourly NVIDIA NIM review repair | `715935b45cf2688235e40be6b44c595af45d27e1` | main | DIRTY | ready | +| #1094 | feat(automation): run DiagramWeave hourly NVIDIA NIM review repair | `455f2e76f15c5d0e7040777fc22ea4994d850925` | main | DIRTY | ready | +| #1092 | feat(automation): run psychometrics-commons hourly NVIDIA NIM review repair | `6c330dbfbede45acb41972f1d384ef586b83c2b8` | main | DIRTY | ready | +| #1088 | feat(automation): run mightyETL hourly NVIDIA NIM review repair | `d955cb949329f3bc3726c440542f549fe2978209` | main | DIRTY | ready | +| #1087 | feat(automation): run life-os hourly NVIDIA NIM review repair | `37377d0a19dfae9739ae2e0a845b8270303b38be` | main | DIRTY | ready | +| #1086 | feat(automation): repair the LineageWeave buyer-surface stack hourly | `aeb096a52c5f4c2647f05f54f0aa6b17200a350f` | main | BLOCKED | ready | +| #1085 | feat(automation): run kaefa hourly NVIDIA NIM review repair | `3e6c94603a6332b066e0be962aab23991987e094` | main | DIRTY | ready | +| #1083 | feat(automation): run pg-llm-batch hourly NVIDIA NIM review repair | `584141341346b7882fded053b459a7d4c16477a2` | main | DIRTY | ready | +| #1082 | feat(automation): run semantic-data-portal hourly NVIDIA NIM review repair | `dbfdbbf3547b4c84bb5c2a1760ecfda080751546` | main | DIRTY | ready | +| #1080 | feat(automation): run newsdom-api hourly NVIDIA NIM review repair | `54f53fcad5a241de28aa272d5775e98bf0b9ca00` | main | DIRTY | ready | +| #1079 | feat(automation): run Appguardrail hourly NVIDIA NIM review repair | `d13ff905cd0d4d814cc2e5f2b5e54dd3d1522f0c` | main | DIRTY | ready | +| #1078 | feat(automation): run Scopeweave hourly NVIDIA NIM review repair | `26b684bc231bff24c19b71ddc8302e551f843ebf` | main | DIRTY | ready | +| #1077 | feat(automation): run noema hourly NVIDIA NIM review repair | `a91c94f1c9d92430241e2cf1302286a83310fe37` | main | DIRTY | ready | +| #1076 | feat(automation): run pg-erd-cloud hourly NVIDIA NIM review repair | `e280e2402e9d4fcd7a17e951e944c85bacd5bd61` | main | DIRTY | ready | +| #1075 | feat(automation): run codec-carver hourly NVIDIA NIM review repair | `618813098dfd8e8186bc7e3277004d76e9ae5d56` | main | DIRTY | ready | +| #1074 | feat(automation): run Keyverse hourly NVIDIA NIM review repair | `c70ff9369f9b49b3e961fe1f63d0204e713400f5` | main | DIRTY | ready | +| #1070 | feat(automation): run Wardnet hourly NVIDIA NIM review repair | `9c752db19fa91b320a74da6c8bd0fbe6d03bce1e` | main | DIRTY | ready | +| #1065 | fix(scheduler): fall back to REST when auto-rebase GraphQL transport fails | `ff661f115ae0c6f41e7a2fab304ace3e648b3988` | main | DIRTY | ready | +| #1062 | fix(strix): map official modes without branch-selected dispatch | `74079e5bddd69bf7eac6d3b2492f25d598517905` | main | DIRTY | draft | +| #1061 | fix(scheduler): ignore manual Strix dispatch as merge evidence | `03c087804eec7f4b520ffc3f61b49edba2dc8378` | main | DIRTY | draft | +| #1060 | fix(opencode): prove asyncio coverage plugin without colliding #896 | `a27ae0ac907c04c300ed978e35538e26c094a682` | main | DIRTY | draft | +| #1058 | fix(operability): reject impossible control-plane SLI counts | `0fd148a8fa2b7acc098eb9741b8d8cea92058ef1` | main | DIRTY | draft | +| #1053 | fix(redaction): skip gh run view job/step prefixes | `15fa991d8a99743a640a26665d278bc159653065` | main | DIRTY | draft | +| #1052 | fix(opencode): split review surfaces, give NIM two hours, and remove GitHub Models | `9147dcffe65047291148e34c178a6a2881d187c1` | main | BLOCKED | ready | +| #1051 | fix(pip-audit): keep index-url locks hashed and reject symlink parents | `82629751751b82bee88d000ded32b6f141125849` | main | DIRTY | ready | +| #1050 | fix(security): reject dot path components before dependency-review compare | `ee5c15711f0b0a346bb19a634288a49fcd981fab` | main | DIRTY | draft | +| #1046 | fix(opencode): pass trusted visibility into the private free-model hook | `f053ba84ff7dc92c5dbdef2ca1597cd04372dd6b` | main | DIRTY | draft | +| #1036 | fix(ci): bind stub-scan evidence and cap hourly fleet work at 12 | `d8205b139f8396c0452ecd4cc9b95caa45a56f42` | main | BEHIND | draft | +| #1035 | docs(automation): retarget closed-unmerged #840 and #906 lineage | `cb5e2ee03b9f75857e2ce31690fc76de76ad9cc1` | main | DIRTY | draft | +| #1027 | fix(automation): stop mention sweep on already-exceeded rate limits | `d046637834d6d9720852423c3cdb5ef79faa1fe3` | main | DIRTY | draft | +| #1026 | feat(actions): inventory orphaned workflow identities | `1be76989887ab772e3ce0d2e0c7f22d3ca98dd94` | main | DIRTY | ready | +| #1024 | docs(ai): standardize adaptive contextual-orchestrator consumers | `8414552f7d2d0d899904caf4d9efda0c785c90ee` | main | BEHIND | ready | +| #1015 | fix(coverage): defer interpreter-specific wheel gaps | `ce28ffba511cb7e2a5135e6f862164834c0f874b` | main | BEHIND | ready | +| #1009 | fix(strix): bind evidence to exact workflow artifacts | `99fee8b1b4ff4fc2219b98561cc4fea851c2f03a` | main | DIRTY | ready | +| #991 | fix(automation): reuse review node_id for mention eyes | `b6303e081756b9598316cdf07f84c038924f0427` | main | DIRTY | draft | +| #949 | fix(opencode-review): discover multi-line run: blocks in safe_pytest_command | `75c6dbdfde34ac7e729e83f44aa0261e76f475d4` | main | BEHIND | ready | +| #941 | fix(semgrep): make the pinned image digest authoritative | `5b07547a01137989ae1324cd472bb15229d5e0d2` | main | BLOCKED | ready | +| #939 | fix: keep cross-repo OpenCode evidence healthy | `2d267d48ab78b0cf8621604ff49839b6f795e610` | main | DIRTY | ready | +| #933 | fix: retry Strix provider tool protocol failures | `b260fd3e17a0c6363d2584110314e44eaf1dfd11` | main | DIRTY | ready | +| #932 | fix(sbom): preserve Markdown report integrity | `f8b94d0dfb02c64761df07ebdf658eb4e1d8abc5` | main | DIRTY | ready | +| #931 | fix(security): contain sandbox paths and output | `c5ee882d9e6f265d4962821336b51789e40ed8fb` | main | DIRTY | ready | +| #930 | fix(noema): fail closed on unsafe model endpoints | `3ae457fbd1527a9b11e0066d4ccffd98fd9d1897` | main | DIRTY | ready | +| #928 | fix(opencode): bind coverage artifacts to workflow attempts | `20c74a264b31a529850389a8f657d42aa98faca2` | main | DIRTY | ready | +| #921 | chore(deps): bump google/osv-scanner-action/osv-scanner-action from a82132c0bd6c7261ffcb78e754c46c70ab57ad9a to f4cfcc01edc9c8b756a9b873b7a623ca674da51e | `60c708cc084d738ced9747792b3243e926663304` | main | DIRTY | draft | +| #920 | chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 | `b9a0cc349d022c894548eb4ca7d94ebe0da99ae8` | main | DIRTY | ready | +| #918 | chore(security): align all CodeQL actions to v4.37.6 | `e94ce637242a391520e2a52e0f5a9592fc64f58e` | main | DIRTY | ready | +| #904 | fix(opencode): include adversarial gate in fallback scope | `7659f000d70348dc9d5f0870a933062fe431bd0f` | main | DIRTY | ready | +| #901 | security(deploy-pages): declare minimal secret contract | `e1c99776a1c1c04b6b941799912b0e5c39dd8a0e` | main | DIRTY | ready | +| #899 | fix(scheduler): fail after summarized action errors | `56ffdd1cc1bc235a39b0373a58430fb8c7b00afb` | main | DIRTY | ready | +| #897 | fix(security): fail closed on unavailable dependency review | `d9b395cd01999a6ec946d3c7a013f22225143782` | main | BLOCKED | ready | +| #834 | fix(noema): replay OIDC envelope repair on current main | `7b64d26c157df3b0da13d8ed0e1cd8365ae47d1e` | main | DIRTY | ready | +| #831 | feat(opencode): add head-matched gold corpus tooling | `fec33cf22a3085e3261eb51a399ccbf7db722e4f` | main | DIRTY | ready | +| #828 | fix(scheduler): require independent exact-head approval | `cbc5f91349fbf0083270caded8512f2022ca9abf` | main | BEHIND | ready | +| #821 | fix(ci): replace conflicted fatal OpenCode process-group prerequisite | `180bc31ae92595d46c8cbc0c4f629739f1e0354a` | main | DIRTY | ready | +| #807 | fix(coverage): validate nested npm metadata through canonical pins | `46cc52f7e05b559ce3442542b28fc133d9b2e2e4` | main | DIRTY | ready | +| #796 | feat(automation): run Inkspan hourly NVIDIA NIM review repair | `0254a9a2c32aa1f321b6dcfd071c53029dfe5fe0` | main | DIRTY | ready | +| #790 | fix(coverage): retry transient trusted uv downloads | `afad81361377f1fe2e651018f1008a590f5344a5` | main | DIRTY | draft | +| #789 | feat(coverage): add bounded PyO3 peer-evidence gate | `6146bb991ed041985233eefa33985b2e40a00721` | main | DIRTY | draft | +| #785 | fix(coverage): materialize requirements-directory locks | `efd2ae85538bdb389da99f0fed6d1799ead5b343` | main | DIRTY | draft | + +### 4.1 Same-session open/close delta + +None at snapshot time. If a later `gh pr list` capture in the same session differs, record the closed or newly opened numbers here instead of treating the table as merge authorization. ## 5. 실행 루프와 고객의 다음 행동 @@ -132,20 +215,30 @@ flowchart LR 1. 조직·repo 책임 경계를 확인하고, current default branch SHA와 PR head SHA를 새로 읽는다. 2. 열린 PR 하나를 선택해 review threads, formal review commit SHA, required Checks와 failure logs를 확인한다. -3. 실패가 코드 결함이면 root cause를 해당 PR의 최소 범위에서 수정하고, 원격 agent의 concurrent commit은 normal forward history로 보존한다. +3. 실패가 코드 결함이면 root cause를 해당 PR의 최소 범위에서 수정하고, 원격 agent의 concurrent commit은 normal forward history로 보존한다. Force-push하지 않는다. 4. 현실적인 domain test, edge test, docstring/branch coverage, security/SBOM, actionlint/browser evidence를 실행한다. -5. 새 head에서 Checks를 재실행하고 independent current-head approval을 다시 요청한다. -6. protected ruleset의 approval·resolved thread·terminal Checks·exact head를 모두 충족할 때만 normal merge한다. 조건이 안 되면 merge하지 않고 다음 PR로 진행한다. -7. PR이 소진되면 Project #1과 소비 repo에서 가장 큰 buyer gap을 선택해 새 PR을 만들고, 이 문서의 Gap ID를 연결한다. +5. 새 head에서 Checks를 재실행하고 independent current-head approval을 다시 요청한다. OpenCode/Strix/Noema 지연은 blocker가 아니다. 기다리는 동안 다음 PR 또는 Gap을 진행한다. +6. protected ruleset의 approval·resolved thread·terminal Checks·exact head를 모두 충족할 때만 `--match-head-commit` normal merge한다. 조건이 안 되면 merge하지 않고 다음 PR로 진행한다. +7. PR이 소진되면 Project #1과 소비 repo에서 가장 큰 운영자/제품 Gap을 선택해 새 PR을 만들고, 이 문서의 Gap ID를 연결한다. 다음 제품 increment의 소유 저장소는 naruon(G-06)이다. 운영자는 receipt의 `next_action`만 실행하면 된다. 예를 들어 `PR_REVIEW_MERGE_TOKEN` 부재는 토큰 값을 로그에 남기지 말고 secret을 provision한 후 다음 hourly pass를 기다리며, Strix Caido bootstrap failure는 runner/container readiness를 복구한 후 같은 exact head를 재검증한다. +`COPILOT_GITHUB_TOKEN`은 사용하지 않는다. 리뷰용 Agent 키 체계를 뒤흔들지 않는다. + +### 5.1 이번 루프의 다음 개발 increment + +1. ContextualWisdomLab/.github#1252 — 이 베이스라인. current-head OpenCode/Noema 승인 후 병합. +2. Strix fallback/quality 스택 #1254/#1255/#1256 — BLOCKED. current-head 실패 Checks를 고치고 중복을 stack한다. +3. Hourly fleet/OIDC/scheduler #1233/#1231/#1238/#1176 — BLOCKED. 자격 증명 분리를 유지한 채 exact-head 수리. +4. G-06는 naruon 소유. 큐가 비면 ContextualWisdomLab/naruon#975 (Phase 0 dense KG)로 제품 Gap을 구현한다. + ## 6. Compliance and data boundary - PII 원문을 무조건 masking하여 업무를 끊지 않는다. 대신 purpose-bound access lease, field-level encryption/tokenization, consented minimal-disclosure consequence, audited access, revocation, retention/deletion을 사용한다. `COPILOT_GITHUB_TOKEN`은 사용하지 않는다. - 모델·리뷰·sandbox·Checks·merge·release는 서로 다른 authority다. 하나의 PASS를 approval이나 release로 승격하지 않는다. - 모든 untrusted input, repository patch, image/base64 payload, model output은 data로 취급하고 command/credential로 해석하지 않는다. - demo/synthetic fixture는 unit test에만 두며 production seed/fixture에는 포함하지 않는다. +- CSAP and SOC 2 evidence maps belong with consent/lease/tokenization, not blanket PII masking. ## 7. APA 7th references @@ -166,3 +259,5 @@ Tang, Y., Cetin, E., Xu, J., Sun, Q., Nielsen, S., Richard, V., Goda, H., Tymche Zhang, S., Yu, Y., Li, Y., Zhao, W., Yang, Y., Zhang, Y., & Liu, T. (2025). *Conductor: Learning to route multi-agent workflows* [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2512.04388 Xu, J., Sun, Q., Schwendeman, P., Nielsen, S., Cetin, E., & Tang, Y. (2026). *TRINITY: An evolved LLM coordinator* [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2512.04695 + +Higgins, S. S., Crepalde, N., & Fernandes, L. (2021). Segmented multiplexity: A research agenda for multiplexity beyond the average. *PLOS ONE, 16*(9), e0257527. https://doi.org/10.1371/journal.pone.0257527 diff --git a/tests/test_product_technical_gap_baseline.py b/tests/test_product_technical_gap_baseline.py index 70e7e7bcd..38ccfa039 100644 --- a/tests/test_product_technical_gap_baseline.py +++ b/tests/test_product_technical_gap_baseline.py @@ -6,10 +6,11 @@ BASELINE = Path("docs/product-technical-gap-baseline.md") ADR = Path("docs/adr/0002-product-technical-gap-baseline.md") +DOCTORING = Path("docs/doctoring/product-technical-gap-baseline.md") def test_baseline_binds_current_governance_sources_and_buyer_contract() -> None: - """The baseline must point agents to product, governance, and buyer evidence.""" + """The shipped baseline must point agents to product, governance, and evidence.""" source = BASELINE.read_text(encoding="utf-8") for marker in ( @@ -19,6 +20,7 @@ def test_baseline_binds_current_governance_sources_and_buyer_contract() -> None: "PRD acceptance", "TRD target", "UML-level dependency", + "Gap register", "Figma File ID", "APA 7th references", "G-01", @@ -26,16 +28,26 @@ def test_baseline_binds_current_governance_sources_and_buyer_contract() -> None: "exact HEAD", "independent current-head approval", "COPILOT_GITHUB_TOKEN", + "Same-session open/close delta", + "merge authorization", + "병합 판단에는 재사용하지 않는다", ): - assert marker in source + assert marker in source, marker def test_baseline_inventory_contains_sha_bound_open_pr_rows() -> None: - """The captured inventory must include SHA and merge metadata for every row.""" + """The captured inventory must include SHA and merge metadata for every row. + + This is snapshot completeness, not merge authorization. The test does not + freeze specific SHAs and does not treat CLEAN/MERGEABLE as approval. + """ source = BASELINE.read_text(encoding="utf-8") rows = [line for line in source.splitlines() if line.startswith("| #")] - declared_count = int(re.search(r"현재 열린 PR 수:\s*\*\*(\d+)\*\*", source).group(1)) + declared_count = int( + re.search(r"현재 열린 PR 수:\s*\*\*(\d+)\*\*", source).group(1) + ) + assert declared_count > 0 assert len(rows) == declared_count allowed_merge_states = { "MERGEABLE", @@ -47,12 +59,18 @@ def test_baseline_inventory_contains_sha_bound_open_pr_rows() -> None: "CLEAN", } for row in rows: + assert re.search(r"\| #[0-9]+ \|", row), row assert re.search(r"[0-9a-f]{40}", row), row assert any(state in row for state in allowed_merge_states), row + assert "merge authorization" not in row.lower() def test_baseline_records_the_ui_adr_boundary() -> None: """The ADR states why a central UI file is not applicable.""" adr = ADR.read_text(encoding="utf-8") + doctoring = DOCTORING.read_text(encoding="utf-8") assert "Figma File ID: N/A" in adr assert "Storybook" in adr + assert "Figma File ID" in doctoring + assert "APA 7th" in doctoring + assert "ISO/IEC 27001:2022" in doctoring From 42a0821827af9825d31c08e6b6e211721b551ce1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 23 Aug 2026 21:55:49 +0900 Subject: [PATCH 03/13] docs: record #1252 same-session head delta and agent entry pointers Keep the gap inventory honest after the refresh push and point CLAUDE.md at the snapshot so hourly loops re-read exact heads before merge. --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index c6a62d299..b7df9f277 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -207,7 +207,7 @@ flowchart LR ### 4.1 Same-session open/close delta -None at snapshot time. If a later `gh pr list` capture in the same session differs, record the closed or newly opened numbers here instead of treating the table as merge authorization. +- ContextualWisdomLab/.github#1252 head advanced in this session from `f7b0fd3253747efeef590859df150fd759aaf306` to the commit that lands this refresh. Re-read `gh pr view 1252 --json headRefOid` before merge. No other open/close delta at write time. ## 5. 실행 루프와 고객의 다음 행동 From ceeaf192f689b456a05abd5537d4ae9b63350c1f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 23 Aug 2026 22:05:51 +0900 Subject: [PATCH 04/13] docs: bind live 108-PR inventory and drop quality whitespace Refresh the gap baseline with #1257, the current #1252 head, and BLOCKED metadata. Remove the trailing whitespace that failed quality git diff --check and retarget the missing Strix cryptography doctoring link to the override file. The inventory remains a snapshot, not merge authorization. --- CLAUDE.md | 4 +++- docs/product-technical-gap-baseline.md | 32 +++++++++++++++----------- 2 files changed, 21 insertions(+), 15 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index 7823c50ec..4b32c05c1 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -8,7 +8,9 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co [`docs/CWL-MASTER-CONTEXT.md`](docs/CWL-MASTER-CONTEXT.md) (mission, ecosystem UML, cross-cutting disciplines CP-1..CP-5/G6/SEAM, binding engineering conventions in §7, roadmap), the live [GitHub Project #1](https://github.com/orgs/ContextualWisdomLab/projects/1) (work/roadmap source of -truth), and operate the Project per [`docs/agent-github-project-protocol.md`](docs/agent-github-project-protocol.md). +truth), the live gap snapshot [`docs/product-technical-gap-baseline.md`](docs/product-technical-gap-baseline.md) +(not merge authorization; Figma File ID for this repo is N/A), and operate the Project per +[`docs/agent-github-project-protocol.md`](docs/agent-github-project-protocol.md). The repo/Project — not private agent memory — is the source of truth. This file complements those documents; it does not replace them. diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index b7df9f277..343575e55 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,9 +1,9 @@ # Product and Technical Gap Baseline -작성 기준일: **2026-08-23 21:51 KST** -대상: **ContextualWisdomLab/.github** 중앙 거버넌스·자동화 레포지터리와 이를 소비하는 naruon 생태계 +작성 기준일: **2026-08-23 22:01 KST** +대상: **ContextualWisdomLab/.github** 중앙 거버넌스·자동화 레포지터리와 이를 소비하는 naruon 생태계 현재 보호된 `main`: `885f2cd251999f21cf562cab3e2d9cc3cc3ec737` -현재 열린 PR 수: **107** (아래 표에 이 스냅샷의 전체 목록 포함) +현재 열린 PR 수: **108** (아래 표에 이 스냅샷의 전체 목록 포함) 이 문서는 제품·기술·운영 Gap을 현재 문서와 현재 GitHub 상태에 묶어 두는 기준선이다. 새 작업은 먼저 이 문서의 Gap ID를 PR 설명과 테스트 증거에 연결하고, PR의 정확한 exact HEAD·Checks·리뷰를 다시 수집한 뒤 구현한다. 표의 상태는 작성 시점의 관측값이므로, 병합 판단에는 재사용하지 않는다. 이 인벤토리는 스냅샷이며 merge authorization이 아니다. @@ -14,7 +14,7 @@ 1. [CWL Master Context](CWL-MASTER-CONTEXT.md): naruon의 이메일 우선 플랫폼 경계, DIKW, no-ask 자동 해결, 다층·다중소속·시간·프라이버시 원칙. 2. [naruon #974](https://github.com/ContextualWisdomLab/naruon/pull/974): `docs/planning/naruon-platform-plan.md`를 추가한 병합된 제품/IA/User Story/Use Case/Architecture 기준. 이슈 트래커의 Phase 항목은 ContextualWisdomLab/naruon#975–#980. 3. [GitHub Project #1](https://github.com/orgs/ContextualWisdomLab/projects/1): 로드맵의 live source of truth. 이 문서는 live project board의 상태를 반영하며, 세부 항목 수는 project에서 직접 확인한다. -4. 중앙 ADR·doctoring·계약 문서: [ADR-0002](adr/0002-product-technical-gap-baseline.md), [hourly NVIDIA NIM autofix](doctoring/hourly-nvidia-nim-autofix.md), [Strix cryptography override](doctoring/strix-agent-cryptography-override.md), [trusted uv lock materialization](doctoring/trusted-uv-lock-materialization.md), [product-technical gap doctoring](doctoring/product-technical-gap-baseline.md). +4. 중앙 ADR·doctoring·계약 문서: [ADR-0002](adr/0002-product-technical-gap-baseline.md), [hourly NVIDIA NIM autofix](doctoring/hourly-nvidia-nim-autofix.md), [Strix cryptography override](../requirements-strix-ci-overrides.txt), [trusted uv lock materialization](doctoring/trusted-uv-lock-materialization.md), [product-technical gap doctoring](doctoring/product-technical-gap-baseline.md). ### 1.2 제품 경계 @@ -74,10 +74,10 @@ flowchart LR | Gap ID | 현재 관측 | 구매자 영향 | 우선 구현/검증 | |---|---|---|---| -| G-01 | 열린 PR은 107개다. metadata상 CLEAN은 #1252 하나뿐이고 DIRTY 77 / BLOCKED 14 / BEHIND 14 / UNSTABLE 1 / draft 17이다. MERGEABLE/CLEAN은 independent exact-head approval과 terminal required Checks를 자동으로 의미하지 않는다 | 안전하게 출시할 변경과 대기 중인 변경을 구별할 수 없다 | PR마다 current head, reviews, threads, required Checks를 재수집하고 보호 조건 미충족이면 merge하지 않는다 | +| G-01 | 열린 PR은 108개다. metadata상 CLEAN은 없고 DIRTY 77 / BLOCKED 16 / BEHIND 14 / UNSTABLE 1 / draft 17이다. MERGEABLE/CLEAN은 independent exact-head approval과 terminal required Checks를 자동으로 의미하지 않는다 | 안전하게 출시할 변경과 대기 중인 변경을 구별할 수 없다 | PR마다 current head, reviews, threads, required Checks를 재수집하고 보호 조건 미충족이면 merge하지 않는다 | | G-02 | 리뷰 credential / same-repo status / agent dispatch PR(#1162, #1227, #1215)이 DIRTY로 남아 선행 main 경로와 어긋난다 | 리뷰가 호출돼도 승인 증거가 생성되지 않아 자동화가 멈춘다 | current-head quality와 OpenCode/Noema/Strix를 재실행하고, 병합 뒤 router comment/dispatch의 403을 실제 PR에서 검증한다 | | G-03 | Strix provider/fallback 스택이 #1254/#1255/#1256에 동시에 열려 있고, #1213은 UNSTABLE이며 #1153의 incomplete-scan fail-closed는 이미 main에 있다 | 취약점 0건이더라도 CI 인프라 결함이 보안 결과처럼 보이고 큐가 막힌다 | exact runtime signature를 불완전 evidence로 fail-closed 분류하고, vulnerability marker가 있으면 절대 neutralize하지 않는 regression을 유지한다. 중복 Strix PR은 stack/supersede한다 | -| G-04 | 107개 live PR 중 대부분이 BEHIND/DIRTY/UNSTABLE이며, 자동 caller PR이 제품 기능보다 앞서 쌓였다 | 제품 개발 속도가 queue hygiene에 소모되고, stacking 순서가 불명확하다 | product/ownership boundary별로 stack을 재정렬하고, 오래된 PR은 current main으로 normal merge/rebase 후 변경 범위를 검증한다 | +| G-04 | 108개 live PR 중 대부분이 BEHIND/DIRTY/UNSTABLE/BLOCKED이며, 자동 caller PR이 제품 기능보다 앞서 쌓였다 | 제품 개발 속도가 queue hygiene에 소모되고, stacking 순서가 불명확하다 | product/ownership boundary별로 stack을 재정렬하고, 오래된 PR은 current main으로 normal merge/rebase 후 변경 범위를 검증한다 | | G-05 | ecosystem contract/catalog PR은 존재하지만 naruon의 실제 plugin 소비·standalone 실행·connector round-trip 증거가 제한적이다 | 구매자는 “연결 가능” 문서와 실제 설치 가능한 제품을 구별할 수 없다 | manifest/version compatibility, command/event envelope, consumer smoke, rollback/upgrade contract를 조직 유관 레포에서 증명한다 | | G-06 | naruon #974와 Project #1은 제품 목표를 정의하지만 E1/E2/E3의 live implementation evidence가 이 중앙 레포에 없다. Phase 0 Issue ContextualWisdomLab/naruon#975는 In Progress다 | 이메일 검색·일정 충돌이라는 killer workflow가 문서에만 머문다 | naruon에서 thread/sender ontology → temporal commitment/conflict → human correction slice를 독립 PR로 delivery한다. 소유 저장소는 naruon이다 | | G-07 | multi-level/multi-membership/temporal 관계 원칙은 master context에 있으나 모든 소비 저장소의 schema/API가 동일한 reified relationship contract를 보장하는지는 미확인이다 | 개인 단위로 집계하거나 전역 권한을 적용하는 atomistic/ecological fallacy 위험이 남는다 | relationship, membership, norm_group, validity window, evidence, confidence, disclosure를 정규화하고 cross-context golden tests를 만든다 | @@ -91,17 +91,18 @@ flowchart LR ## 4. 열린 PR live inventory -아래는 GitHub PR list가 2026-08-23 21:51 KST에 반환한 107개 열린 PR의 number/title/head/base metadata다. CLEAN/BLOCKED/DIRTY/BEHIND/UNSTABLE은 GitHub metadata일 뿐 protected merge 승인이나 required Checks PASS를 뜻하지 않는다. 다음 루프에서 모든 행의 live review, thread, Checks를 다시 확인한다. +아래는 GitHub PR list가 2026-08-23 22:01 KST에 반환한 108개 열린 PR의 number/title/head/base metadata다. CLEAN/BLOCKED/DIRTY/BEHIND/UNSTABLE은 GitHub metadata일 뿐 protected merge 승인이나 required Checks PASS를 뜻하지 않는다. 다음 루프에서 모든 행의 live review, thread, Checks를 다시 확인한다. -스냅샷 요약: CLEAN [1252]; BLOCKED [1256, 1255, 1254, 1253, 1238, 1233, 1231, 1176, 1158, 1107, 1086, 1052, 941, 897]; UNSTABLE [1213]; DIRTY 77; BEHIND 14; draft 17. +스냅샷 요약: CLEAN []; BLOCKED [1257, 1256, 1255, 1254, 1253, 1252, 1238, 1233, 1231, 1176, 1158, 1107, 1086, 1052, 941, 897]; UNSTABLE [1213]; DIRTY 77; BEHIND 14; draft 17. | PR | title | head SHA | base | metadata | mode | |---|---|---|---|---|---| +| #1257 | fix(osv): keep base scan results across fork checkout | `2c82c366c668123ca63f27c29350213c2c047354` | main | BLOCKED | ready | | #1256 | fix(strix): recognize the hyphenated openai-direct fallback alias | `f2a6aab1fa7297c801b9aa324f52d8e979671ca0` | main | BLOCKED | ready | | #1255 | fix(strix): accept complete scans with benign model-quality advisory | `a1fc43a13085b4dbe9367a871e33461c4eea9ae0` | main | BLOCKED | ready | | #1254 | fix(strix): preserve NIM fallback evidence | `e21c149af5549fd63d9c8d53a342e0a8018273f3` | main | BLOCKED | ready | | #1253 | feat(opencode): audit ScopeWeave calendar stack after #506 merge | `1e4caae4528b62fa6d2fd557f73b251bba89680f` | main | BLOCKED | ready | -| #1252 | docs: refresh live product and technical gap baseline | `f7b0fd3253747efeef590859df150fd759aaf306` | main | CLEAN | ready | +| #1252 | docs: refresh live product and technical gap baseline | `42a0821827af9825d31c08e6b6e211721b551ce1` | main | BLOCKED | ready | | #1246 | fix(opencode-review): accept int-typed run_id/run_attempt in control JSON | `c82036c33bb64c3a81b765531d1f90704d8252da` | main | BEHIND | ready | | #1245 | fix(scheduler): retry and gracefully defer shared installation rate limits | `c895eec54b50119496cc9c962682d1fafc18c405` | main | BEHIND | ready | | #1244 | 🛡️ Sentinel: [CRITICAL/HIGH] Fix SSRF in sandboxed_web_e2e wait_for_url | `4b4ad37da919a2f9c1c18aa1fba8cbb1da79cd56` | main | BEHIND | ready | @@ -207,7 +208,9 @@ flowchart LR ### 4.1 Same-session open/close delta -- ContextualWisdomLab/.github#1252 head advanced in this session from `f7b0fd3253747efeef590859df150fd759aaf306` to the commit that lands this refresh. Re-read `gh pr view 1252 --json headRefOid` before merge. No other open/close delta at write time. +- ContextualWisdomLab/.github#1257 opened after the 107-row snapshot (`2c82c366c668123ca63f27c29350213c2c047354`, BLOCKED). The row is now in the inventory; it is not merge authorization. +- ContextualWisdomLab/.github#1252 head advanced from `f7b0fd3253747efeef590859df150fd759aaf306` to `42a0821827af9825d31c08e6b6e211721b551ce1`, then to the commit that lands this refresh. The previous `quality` failure on `42a08218` was trailing whitespace on the baseline title line (`git diff --check`). Re-read `gh pr view 1252 --json headRefOid` before merge. +- #1257 `osv-scan` failed on `cp` permission denied while overwriting a root-owned workspace `old-results.json`; that fix belongs on #1257, not this docs PR. ## 5. 실행 루프와 고객의 다음 행동 @@ -227,10 +230,11 @@ flowchart LR ### 5.1 이번 루프의 다음 개발 increment -1. ContextualWisdomLab/.github#1252 — 이 베이스라인. current-head OpenCode/Noema 승인 후 병합. -2. Strix fallback/quality 스택 #1254/#1255/#1256 — BLOCKED. current-head 실패 Checks를 고치고 중복을 stack한다. -3. Hourly fleet/OIDC/scheduler #1233/#1231/#1238/#1176 — BLOCKED. 자격 증명 분리를 유지한 채 exact-head 수리. -4. G-06는 naruon 소유. 큐가 비면 ContextualWisdomLab/naruon#975 (Phase 0 dense KG)로 제품 Gap을 구현한다. +1. ContextualWisdomLab/.github#1252 — 이 베이스라인. current-head OpenCode/Noema 승인 후 병합. `quality` trailing-whitespace는 이 refresh에서 제거한다. +2. ContextualWisdomLab/.github#1257 — OSV base 결과를 fork checkout 밖으로 보존. workspace `old-results.json`을 덮어쓰지 말고 `RUNNER_TEMP`만 사용한다. +3. Strix fallback/quality 스택 #1254/#1255/#1256 — BLOCKED. current-head 실패 Checks를 고치고 중복을 stack한다. #1256 Strix는 `pull_request_target`가 base `strix_quick_gate.sh`를 쓰므로 이 PR만으로는 self-verify할 수 없다. +4. Hourly fleet/OIDC/scheduler #1233/#1231/#1238/#1176 — BLOCKED. 자격 증명 분리를 유지한 채 exact-head 수리. +5. G-06는 naruon 소유. 큐가 비면 ContextualWisdomLab/naruon#975 (Phase 0 dense KG)로 제품 Gap을 구현한다. ## 6. Compliance and data boundary From b0100b3bfe3d5b3bea52e137522f8ff7b497f0fe Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 23 Aug 2026 23:00:23 +0900 Subject: [PATCH 05/13] docs: bind live 104-PR inventory and Phase 0 Done status Refresh the gap baseline against the current open queue after #1253-#1256 closed unmerged, record #1257/#1213 head motion, and correct CWL-MASTER-CONTEXT so naruon#975 is Done rather than In Progress. The SHA table remains a snapshot, not merge authorization. --- docs/CWL-MASTER-CONTEXT.md | 6 +-- docs/product-technical-gap-baseline.md | 56 ++++++++++---------- tests/test_product_technical_gap_baseline.py | 15 ++++++ 3 files changed, 46 insertions(+), 31 deletions(-) diff --git a/docs/CWL-MASTER-CONTEXT.md b/docs/CWL-MASTER-CONTEXT.md index ee5935247..86a944369 100644 --- a/docs/CWL-MASTER-CONTEXT.md +++ b/docs/CWL-MASTER-CONTEXT.md @@ -126,10 +126,10 @@ GitHub **Project #1** is the shared source of truth. Structure: real **Issues** ## 10. Current state (2026-08-23) - Live product/technical gap snapshot: [`docs/product-technical-gap-baseline.md`](product-technical-gap-baseline.md) (SHA-bound open-PR inventory; not merge authorization). Figma File ID for this control-plane repo is N/A (`docs/adr/0002-product-technical-gap-baseline.md`). -- Renames done (keyverse/wardnet/inkspan). Planning spec = naruon#974. Protocol = .github#363. Project #1 remains the live tracker; naruon Phase 0 issue ContextualWisdomLab/naruon#975 is In Progress. -- **BLOCKER B1**: org GitHub Actions effectively HALTED (~86 queued, ~0 in_progress org-wide) — likely the Actions monthly SPENDING CAP. Blocks ALL PR checks/merges + the Cloudflare DNS run (nameservers). Fix (org-admin): raise the Actions spending limit OR add a self-hosted runner. Nothing merges until then. +- Renames done (keyverse/wardnet/inkspan). Planning spec = ContextualWisdomLab/naruon#974. Protocol = ContextualWisdomLab/.github#363. Project #1 remains the live tracker; naruon Phase 0 issue ContextualWisdomLab/naruon#975 is Done (closed completed 2026-07-13). Next ordered phase is ContextualWisdomLab/naruon#976 (P1 Plugin SDK); execute one phase at a time. +- GitHub Actions hosted Checks are running on current ContextualWisdomLab/.github PRs. Remaining merge blockers are missing current-head OpenCode approvals, Strix provider fail-closed, unresolved threads, and DIRTY/CONFLICTING stacks — not a total runner outage. Do not treat the earlier spending-cap halt as live unless Project #1 still shows it. - **Decisions pending**: (D1) Code Security enablement vs the CodeQL-only code_scanning ruleset (osv/trivy/scorecard SARIF upload) — a private repo needs GHAS seats; reconcile or make those checks non-required. (D2) trivy `limit-severities-for-sarif: true` (gate only CRITICAL/HIGH) — held pending the user's strict-security preference. -- **Built this session, PR-open, awaiting merge (B1)**: see Project #1 PRs (contextual-orchestrator cost/routing #46 + naruon#973; pg-llm-batch; keyverse Keycloak; inkspan; SBOM #361; opencode auto-retry #360; Strix neutral #349 + emit #358; appguardrail collector #254; auto-rebase #357; noema #359/naruon#970; PDF-DOM naruon#965/newsdom#300; SDP #11; fast-mlsirm GPGPU #109; scopeweave #284/naruon#971; fuzzing 10 PRs (found+fixed 2 real naruon bugs); Cloudflare DNS/Pages #362; this protocol #363; planning #974). Human step: report the mapasevo21 malware file (github user-attachments) to GitHub Abuse; rotate the xtrmLLMBatchPython-leaked keys; the org-admin runner/decisions above. +- Historical July 2026 delivery that is already merged lives on Project #1 as Done (ContextualWisdomLab/.github#363/#362/#361, ContextualWisdomLab/naruon#974/#973/#965, and sibling fuzz/SBOM PRs). Human leftovers remain: report the mapasevo21 malware file (github user-attachments) to GitHub Abuse; rotate the xtrmLLMBatchPython-leaked keys; D1/D2 above. --- *Keep this current. Update Project #1 as the live tracker; this file is the narrative brief a fresh agent reads to reconstruct the whole picture.* diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 343575e55..86f4c8183 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,9 +1,9 @@ # Product and Technical Gap Baseline -작성 기준일: **2026-08-23 22:01 KST** +작성 기준일: **2026-08-23 22:59 KST** 대상: **ContextualWisdomLab/.github** 중앙 거버넌스·자동화 레포지터리와 이를 소비하는 naruon 생태계 현재 보호된 `main`: `885f2cd251999f21cf562cab3e2d9cc3cc3ec737` -현재 열린 PR 수: **108** (아래 표에 이 스냅샷의 전체 목록 포함) +현재 열린 PR 수: **104** (아래 표에 이 스냅샷의 전체 목록 포함) 이 문서는 제품·기술·운영 Gap을 현재 문서와 현재 GitHub 상태에 묶어 두는 기준선이다. 새 작업은 먼저 이 문서의 Gap ID를 PR 설명과 테스트 증거에 연결하고, PR의 정확한 exact HEAD·Checks·리뷰를 다시 수집한 뒤 구현한다. 표의 상태는 작성 시점의 관측값이므로, 병합 판단에는 재사용하지 않는다. 이 인벤토리는 스냅샷이며 merge authorization이 아니다. @@ -74,12 +74,12 @@ flowchart LR | Gap ID | 현재 관측 | 구매자 영향 | 우선 구현/검증 | |---|---|---|---| -| G-01 | 열린 PR은 108개다. metadata상 CLEAN은 없고 DIRTY 77 / BLOCKED 16 / BEHIND 14 / UNSTABLE 1 / draft 17이다. MERGEABLE/CLEAN은 independent exact-head approval과 terminal required Checks를 자동으로 의미하지 않는다 | 안전하게 출시할 변경과 대기 중인 변경을 구별할 수 없다 | PR마다 current head, reviews, threads, required Checks를 재수집하고 보호 조건 미충족이면 merge하지 않는다 | +| G-01 | 열린 PR은 104개다. metadata상 CLEAN은 없고 DIRTY 77 / BLOCKED 15 / BEHIND 11 / UNSTABLE 1 / draft 17이다. MERGEABLE/CLEAN은 independent exact-head approval과 terminal required Checks를 자동으로 의미하지 않는다 | 안전하게 출시할 변경과 대기 중인 변경을 구별할 수 없다 | PR마다 current head, reviews, threads, required Checks를 재수집하고 보호 조건 미충족이면 merge하지 않는다 | | G-02 | 리뷰 credential / same-repo status / agent dispatch PR(#1162, #1227, #1215)이 DIRTY로 남아 선행 main 경로와 어긋난다 | 리뷰가 호출돼도 승인 증거가 생성되지 않아 자동화가 멈춘다 | current-head quality와 OpenCode/Noema/Strix를 재실행하고, 병합 뒤 router comment/dispatch의 403을 실제 PR에서 검증한다 | -| G-03 | Strix provider/fallback 스택이 #1254/#1255/#1256에 동시에 열려 있고, #1213은 UNSTABLE이며 #1153의 incomplete-scan fail-closed는 이미 main에 있다 | 취약점 0건이더라도 CI 인프라 결함이 보안 결과처럼 보이고 큐가 막힌다 | exact runtime signature를 불완전 evidence로 fail-closed 분류하고, vulnerability marker가 있으면 절대 neutralize하지 않는 regression을 유지한다. 중복 Strix PR은 stack/supersede한다 | -| G-04 | 108개 live PR 중 대부분이 BEHIND/DIRTY/UNSTABLE/BLOCKED이며, 자동 caller PR이 제품 기능보다 앞서 쌓였다 | 제품 개발 속도가 queue hygiene에 소모되고, stacking 순서가 불명확하다 | product/ownership boundary별로 stack을 재정렬하고, 오래된 PR은 current main으로 normal merge/rebase 후 변경 범위를 검증한다 | +| G-03 | Strix provider/fallback 중복 PR #1254/#1255/#1256은 병합 없이 닫혔고 #1213이 stacked successor다. #1213은 UNSTABLE이며 #1153의 incomplete-scan fail-closed는 이미 main에 있다. 0-vuln complete scans도 MODEL QUALITY WARNING 같은 비취약 권고를 provider failure-signal로 오분류하면 fail-closed 된다 | 취약점 0건이더라도 CI 인프라 결함이 보안 결과처럼 보이고 큐가 막힌다 | exact runtime signature를 불완전 evidence로 fail-closed 분류하고, vulnerability marker가 있으면 절대 neutralize하지 않는 regression을 유지한다. 중복 Strix PR은 stack/supersede한다 | +| G-04 | 104개 live PR 중 대부분이 BEHIND/DIRTY/UNSTABLE/BLOCKED이며, 자동 caller PR이 제품 기능보다 앞서 쌓였다 | 제품 개발 속도가 queue hygiene에 소모되고, stacking 순서가 불명확하다 | product/ownership boundary별로 stack을 재정렬하고, 오래된 PR은 current main으로 normal merge/rebase 후 변경 범위를 검증한다 | | G-05 | ecosystem contract/catalog PR은 존재하지만 naruon의 실제 plugin 소비·standalone 실행·connector round-trip 증거가 제한적이다 | 구매자는 “연결 가능” 문서와 실제 설치 가능한 제품을 구별할 수 없다 | manifest/version compatibility, command/event envelope, consumer smoke, rollback/upgrade contract를 조직 유관 레포에서 증명한다 | -| G-06 | naruon #974와 Project #1은 제품 목표를 정의하지만 E1/E2/E3의 live implementation evidence가 이 중앙 레포에 없다. Phase 0 Issue ContextualWisdomLab/naruon#975는 In Progress다 | 이메일 검색·일정 충돌이라는 killer workflow가 문서에만 머문다 | naruon에서 thread/sender ontology → temporal commitment/conflict → human correction slice를 독립 PR로 delivery한다. 소유 저장소는 naruon이다 | +| G-06 | naruon #974와 Project #1은 제품 목표를 정의하지만 E1/E2/E3의 live implementation evidence가 이 중앙 레포에 없다. Phase 0 Issue ContextualWisdomLab/naruon#975는 Done(closed completed 2026-07-13)이다. 다음 순서 단계는 ContextualWisdomLab/naruon#976 (P1 Plugin SDK)이며 한 번에 한 phase만 진행한다 | 이메일 검색·일정 충돌이라는 killer workflow가 문서에만 머문다 | naruon에서 thread/sender ontology → temporal commitment/conflict → human correction slice를 독립 PR로 delivery한다. 소유 저장소는 naruon이다 | | G-07 | multi-level/multi-membership/temporal 관계 원칙은 master context에 있으나 모든 소비 저장소의 schema/API가 동일한 reified relationship contract를 보장하는지는 미확인이다 | 개인 단위로 집계하거나 전역 권한을 적용하는 atomistic/ecological fallacy 위험이 남는다 | relationship, membership, norm_group, validity window, evidence, confidence, disclosure를 정규화하고 cross-context golden tests를 만든다 | | G-08 | embedding·DOM·sender/receiver 의미 단위 chunking과 base64 image의 OCR/object/tag/position-index 설계가 ecosystem contract에 부분적으로만 반영됐다 | 검색은 되지만 실제 그림 위치와 의미를 회수하지 못해 편집·문서·메일 업무가 끊긴다 | semantic unit chunk schema와 image asset/region/ocr/tag embeddings를 별도 entity로 설계하고 source offset/DOM path를 보존한다 | | G-09 | 100% coverage/docstring은 중앙 PR별로 증거가 있으나 조직 소비 레포의 frontend interaction/i18n/design-token/real-data accuracy 증거가 동일한지 미확인이다 | “green CI”가 실제 고객 시나리오 정확성을 보장하지 않는다 | domain-specific RMSE/reproducibility/audio/visual/browser acceptance와 edge matrix를 required evidence로 만든다 | @@ -91,31 +91,27 @@ flowchart LR ## 4. 열린 PR live inventory -아래는 GitHub PR list가 2026-08-23 22:01 KST에 반환한 108개 열린 PR의 number/title/head/base metadata다. CLEAN/BLOCKED/DIRTY/BEHIND/UNSTABLE은 GitHub metadata일 뿐 protected merge 승인이나 required Checks PASS를 뜻하지 않는다. 다음 루프에서 모든 행의 live review, thread, Checks를 다시 확인한다. +아래는 GitHub PR list가 2026-08-23 22:59 KST에 반환한 104개 열린 PR의 number/title/head/base metadata다. CLEAN/BLOCKED/DIRTY/BEHIND/UNSTABLE은 GitHub metadata일 뿐 protected merge 승인이나 required Checks PASS를 뜻하지 않는다. 다음 루프에서 모든 행의 live review, thread, Checks를 다시 확인한다. -스냅샷 요약: CLEAN []; BLOCKED [1257, 1256, 1255, 1254, 1253, 1252, 1238, 1233, 1231, 1176, 1158, 1107, 1086, 1052, 941, 897]; UNSTABLE [1213]; DIRTY 77; BEHIND 14; draft 17. +스냅샷 요약: CLEAN []; BLOCKED [1257, 1252, 1246, 1245, 1244, 1238, 1233, 1231, 1176, 1158, 1107, 1086, 1052, 941, 897]; UNSTABLE [1213]; DIRTY 77; BEHIND 11; draft 17. | PR | title | head SHA | base | metadata | mode | |---|---|---|---|---|---| -| #1257 | fix(osv): keep base scan results across fork checkout | `2c82c366c668123ca63f27c29350213c2c047354` | main | BLOCKED | ready | -| #1256 | fix(strix): recognize the hyphenated openai-direct fallback alias | `f2a6aab1fa7297c801b9aa324f52d8e979671ca0` | main | BLOCKED | ready | -| #1255 | fix(strix): accept complete scans with benign model-quality advisory | `a1fc43a13085b4dbe9367a871e33461c4eea9ae0` | main | BLOCKED | ready | -| #1254 | fix(strix): preserve NIM fallback evidence | `e21c149af5549fd63d9c8d53a342e0a8018273f3` | main | BLOCKED | ready | -| #1253 | feat(opencode): audit ScopeWeave calendar stack after #506 merge | `1e4caae4528b62fa6d2fd557f73b251bba89680f` | main | BLOCKED | ready | -| #1252 | docs: refresh live product and technical gap baseline | `42a0821827af9825d31c08e6b6e211721b551ce1` | main | BLOCKED | ready | -| #1246 | fix(opencode-review): accept int-typed run_id/run_attempt in control JSON | `c82036c33bb64c3a81b765531d1f90704d8252da` | main | BEHIND | ready | -| #1245 | fix(scheduler): retry and gracefully defer shared installation rate limits | `c895eec54b50119496cc9c962682d1fafc18c405` | main | BEHIND | ready | -| #1244 | 🛡️ Sentinel: [CRITICAL/HIGH] Fix SSRF in sandboxed_web_e2e wait_for_url | `4b4ad37da919a2f9c1c18aa1fba8cbb1da79cd56` | main | BEHIND | ready | +| #1257 | fix(osv): keep base scan results across fork checkout | `7b8fc201ed7d86f415568d0e8df5a9211e1c8ab0` | main | BLOCKED | ready | +| #1252 | docs: refresh live product and technical gap baseline | `ceeaf192f689b456a05abd5537d4ae9b63350c1f` | main | BLOCKED | ready | +| #1246 | fix(opencode-review): accept int-typed run_id/run_attempt in control JSON | `f88499b708a90edb6a538aeb2c397e14304681ad` | main | BLOCKED | ready | +| #1245 | fix(scheduler): retry and gracefully defer shared installation rate limits | `d007bcec35f2057eda375c54e653a152f90881ec` | main | BLOCKED | ready | +| #1244 | fix(e2e): restrict readiness polling to loopback destinations | `cadd69536062f400e98405fbab6e3e558080741e` | main | BLOCKED | ready | | #1243 | ⚡ Bolt: [병렬 처리를 통한 스냅샷 수집 성능 개선] | `68dcc64803f89665bfc161a3ee7eb018e2612f1f` | main | BEHIND | ready | | #1242 | ⚡ Bolt: 정규표현식 평가 병합 최적화 | `b27b834c60870f1b46cd719b0bcb4322a542946a` | main | BEHIND | ready | | #1238 | fix(scheduler): stop repository_dispatch defaulting review/merge/branch flags off | `21b4c58577d54aed299cf0d2dc30a0ee80ff0902` | main | BLOCKED | ready | | #1237 | ⚡ Bolt: JSON 추출 최적화 및 버그 수정 (`raw_decode` 적용) | `59b910d3a6efc15484a2ad63c4c2c2dfbad4f34b` | main | BEHIND | ready | | #1233 | fix(automation): restore hourly fleet coordination | `dfb8e261c81705841111dd4ad1712a9fb6c767d1` | main | BLOCKED | ready | -| #1231 | fix(scheduler): isolate central Actions inventory quota | `e9001ce4c05467096728d70fcb89de70060d3395` | main | BLOCKED | ready | +| #1231 | fix(scheduler): isolate central Actions inventory quota | `7b16617af04431a43f8f7528b8ac7db345e404a7` | main | BLOCKED | ready | | #1227 | fix(opencode): use same-repo status credential | `05b52e7617e87d2fd6892d8d387ff9d6707a110c` | main | DIRTY | ready | | #1218 | fix(coverage): admit protected-base test retirement | `a3e2dfca20cc76c1b8615df0f490fc5a1fc11e81` | main | DIRTY | ready | | #1215 | fix(security): redact agent-mention credential diagnostics | `6e17c3fb3f247c73dd55afcbf4f92a127549f345` | main | DIRTY | ready | -| #1213 | fix(strix): route unsupported Azure sampling failures to a valid fallback | `9dcd1d6c4c11602163cb89edaad9540e9d6f461a` | fix/organization-loop-oidc-fallback | UNSTABLE | ready | +| #1213 | fix(strix): make Azure and cross-provider fallbacks executable | `5ab583417053a122bd568e8295d3c25172dbac52` | fix/organization-loop-oidc-fallback | UNSTABLE | ready | | #1198 | fix(security): repair pip audit and schedule orchestrator review | `e5a7ac882559fe6d1ae1f91e27d79bc8e0aa1e77` | main | DIRTY | ready | | #1188 | fix: grant hourly callers reusable workflow OIDC scope | `1a0cc1f875db29492861006747ded2b6d9e93d09` | main | DIRTY | ready | | #1187 | fix(coverage): scope Rust evidence to changed packages | `0a88e24d9a1c92420f412d241f850aab8e72106e` | main | DIRTY | ready | @@ -169,7 +165,7 @@ flowchart LR | #1060 | fix(opencode): prove asyncio coverage plugin without colliding #896 | `a27ae0ac907c04c300ed978e35538e26c094a682` | main | DIRTY | draft | | #1058 | fix(operability): reject impossible control-plane SLI counts | `0fd148a8fa2b7acc098eb9741b8d8cea92058ef1` | main | DIRTY | draft | | #1053 | fix(redaction): skip gh run view job/step prefixes | `15fa991d8a99743a640a26665d278bc159653065` | main | DIRTY | draft | -| #1052 | fix(opencode): split review surfaces, give NIM two hours, and remove GitHub Models | `9147dcffe65047291148e34c178a6a2881d187c1` | main | BLOCKED | ready | +| #1052 | fix(opencode): split review surfaces, give NIM two hours, and remove GitHub Models | `766080a6b76dadb9fb861c5519f2ea82c14de34e` | main | BLOCKED | ready | | #1051 | fix(pip-audit): keep index-url locks hashed and reject symlink parents | `82629751751b82bee88d000ded32b6f141125849` | main | DIRTY | ready | | #1050 | fix(security): reject dot path components before dependency-review compare | `ee5c15711f0b0a346bb19a634288a49fcd981fab` | main | DIRTY | draft | | #1046 | fix(opencode): pass trusted visibility into the private free-model hook | `f053ba84ff7dc92c5dbdef2ca1597cd04372dd6b` | main | DIRTY | draft | @@ -208,9 +204,12 @@ flowchart LR ### 4.1 Same-session open/close delta -- ContextualWisdomLab/.github#1257 opened after the 107-row snapshot (`2c82c366c668123ca63f27c29350213c2c047354`, BLOCKED). The row is now in the inventory; it is not merge authorization. -- ContextualWisdomLab/.github#1252 head advanced from `f7b0fd3253747efeef590859df150fd759aaf306` to `42a0821827af9825d31c08e6b6e211721b551ce1`, then to the commit that lands this refresh. The previous `quality` failure on `42a08218` was trailing whitespace on the baseline title line (`git diff --check`). Re-read `gh pr view 1252 --json headRefOid` before merge. -- #1257 `osv-scan` failed on `cp` permission denied while overwriting a root-owned workspace `old-results.json`; that fix belongs on #1257, not this docs PR. +- ContextualWisdomLab/.github#1256, #1255, #1254 closed unmerged at 2026-08-23T13:17Z as duplicates of stacked successor #1213 (`5ab583417053a122bd568e8295d3c25172dbac52`, UNSTABLE, base `fix/organization-loop-oidc-fallback`). +- ContextualWisdomLab/.github#1253 closed unmerged at 2026-08-23T13:54Z after exact-scope audit (ScopeWeave calendar job was one-shot control-plane code for a still-open product PR). +- ContextualWisdomLab/.github#1257 head advanced from `2c82c366c668123ca63f27c29350213c2c047354` through `8800253e0339a4dc434f6b5cb7d789ec2dc69d4e` to `7b8fc201ed7d86f415568d0e8df5a9211e1c8ab0` (preserve base OSV results in `RUNNER_TEMP`). Concurrent remote commits are kept; this docs PR does not repair #1257. Not merge authorization. +- ContextualWisdomLab/.github#1252 head remains the commit that lands this 104-row refresh. Re-read `gh pr view 1252 --json headRefOid` before merge. +- Open count moved 108 → 104. No `.github` PR merged this session. + ## 5. 실행 루프와 고객의 다음 행동 @@ -230,11 +229,12 @@ flowchart LR ### 5.1 이번 루프의 다음 개발 increment -1. ContextualWisdomLab/.github#1252 — 이 베이스라인. current-head OpenCode/Noema 승인 후 병합. `quality` trailing-whitespace는 이 refresh에서 제거한다. -2. ContextualWisdomLab/.github#1257 — OSV base 결과를 fork checkout 밖으로 보존. workspace `old-results.json`을 덮어쓰지 말고 `RUNNER_TEMP`만 사용한다. -3. Strix fallback/quality 스택 #1254/#1255/#1256 — BLOCKED. current-head 실패 Checks를 고치고 중복을 stack한다. #1256 Strix는 `pull_request_target`가 base `strix_quick_gate.sh`를 쓰므로 이 PR만으로는 self-verify할 수 없다. -4. Hourly fleet/OIDC/scheduler #1233/#1231/#1238/#1176 — BLOCKED. 자격 증명 분리를 유지한 채 exact-head 수리. -5. G-06는 naruon 소유. 큐가 비면 ContextualWisdomLab/naruon#975 (Phase 0 dense KG)로 제품 Gap을 구현한다. +1. ContextualWisdomLab/.github#1252 — 이 베이스라인. current-head OpenCode 승인과 unresolved `docs/CWL-MASTER-CONTEXT.md` thread 해소 후 병합. 인벤토리는 merge authorization이 아니다. +2. ContextualWisdomLab/.github#1257 — OSV base 결과를 fork checkout 밖 `RUNNER_TEMP`에 보존. current-head Strix가 terminal이 되면 exact-head 승인 후 병합한다. +3. Strix successor #1213 (stacked on #1233) — UNSTABLE. provider exhaustion/model-quality false fail-closed를 고치고, 취약점 marker는 neutralize하지 않는다. 닫힌 #1254/#1255/#1256을 되살리지 않는다. +4. Hourly fleet/OIDC/scheduler #1233/#1231/#1238/#1176 — BLOCKED. 자격 증명 분리를 유지한 채 exact-head 수리. OpenCode/Strix 지연은 다음 PR을 막지 않는다. +5. G-06는 naruon 소유. Phase 0 ContextualWisdomLab/naruon#975는 Done이다. 큐가 비면 한 phase씩 ContextualWisdomLab/naruon#976 (P1 Plugin SDK) 또는 남은 E1/E3 제품 slice를 naruon에서 구현한다. + ## 6. Compliance and data boundary diff --git a/tests/test_product_technical_gap_baseline.py b/tests/test_product_technical_gap_baseline.py index 38ccfa039..faa161482 100644 --- a/tests/test_product_technical_gap_baseline.py +++ b/tests/test_product_technical_gap_baseline.py @@ -74,3 +74,18 @@ def test_baseline_records_the_ui_adr_boundary() -> None: assert "Figma File ID" in doctoring assert "APA 7th" in doctoring assert "ISO/IEC 27001:2022" in doctoring + + +def test_master_context_points_at_live_baseline_without_freezing_shas() -> None: + """Section 10 must send agents to the live snapshot and UI-scope ADR. + + This pins narrative pointers, not inventory SHAs or merge authorization. + """ + source = Path("docs/CWL-MASTER-CONTEXT.md").read_text(encoding="utf-8") + assert "product-technical-gap-baseline.md" in source + assert "Figma File ID" in source + assert "N/A" in source + assert "ContextualWisdomLab/naruon#974" in source + assert "ContextualWisdomLab/naruon#975" in source + assert "Done" in source + assert "merge authorization" in source From b5f5ee025f025e5ba9341fa195cac6888c789162 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 23 Aug 2026 23:05:55 +0900 Subject: [PATCH 06/13] test: fail closed with a readable message when the PR-count header is missing The inventory contract now asserts the declared-count regex matched before calling group(1), so a reworded header raises AssertionError instead of AttributeError. --- tests/test_product_technical_gap_baseline.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/test_product_technical_gap_baseline.py b/tests/test_product_technical_gap_baseline.py index faa161482..15673e25e 100644 --- a/tests/test_product_technical_gap_baseline.py +++ b/tests/test_product_technical_gap_baseline.py @@ -44,9 +44,9 @@ def test_baseline_inventory_contains_sha_bound_open_pr_rows() -> None: source = BASELINE.read_text(encoding="utf-8") rows = [line for line in source.splitlines() if line.startswith("| #")] - declared_count = int( - re.search(r"현재 열린 PR 수:\s*\*\*(\d+)\*\*", source).group(1) - ) + declared = re.search(r"현재 열린 PR 수:\s*\*\*(\d+)\*\*", source) + assert declared is not None, "baseline header must declare the open PR count" + declared_count = int(declared.group(1)) assert declared_count > 0 assert len(rows) == declared_count allowed_merge_states = { From 4088aa3e3721515698f653f205031dde768149d1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 23 Aug 2026 23:09:58 +0900 Subject: [PATCH 07/13] docs: bind live 108-PR inventory including #1258-#1261 Refresh the SHA-bound snapshot after #1258-#1261 opened and #1257/#1227 heads advanced. The inventory remains a snapshot, not merge authorization. --- docs/product-technical-gap-baseline.md | 43 ++++++++++++++------------ 1 file changed, 23 insertions(+), 20 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 86f4c8183..09b23bfb8 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,9 +1,9 @@ # Product and Technical Gap Baseline -작성 기준일: **2026-08-23 22:59 KST** +작성 기준일: **2026-08-23 23:09 KST** 대상: **ContextualWisdomLab/.github** 중앙 거버넌스·자동화 레포지터리와 이를 소비하는 naruon 생태계 현재 보호된 `main`: `885f2cd251999f21cf562cab3e2d9cc3cc3ec737` -현재 열린 PR 수: **104** (아래 표에 이 스냅샷의 전체 목록 포함) +현재 열린 PR 수: **108** (아래 표에 이 스냅샷의 전체 목록 포함) 이 문서는 제품·기술·운영 Gap을 현재 문서와 현재 GitHub 상태에 묶어 두는 기준선이다. 새 작업은 먼저 이 문서의 Gap ID를 PR 설명과 테스트 증거에 연결하고, PR의 정확한 exact HEAD·Checks·리뷰를 다시 수집한 뒤 구현한다. 표의 상태는 작성 시점의 관측값이므로, 병합 판단에는 재사용하지 않는다. 이 인벤토리는 스냅샷이며 merge authorization이 아니다. @@ -74,10 +74,10 @@ flowchart LR | Gap ID | 현재 관측 | 구매자 영향 | 우선 구현/검증 | |---|---|---|---| -| G-01 | 열린 PR은 104개다. metadata상 CLEAN은 없고 DIRTY 77 / BLOCKED 15 / BEHIND 11 / UNSTABLE 1 / draft 17이다. MERGEABLE/CLEAN은 independent exact-head approval과 terminal required Checks를 자동으로 의미하지 않는다 | 안전하게 출시할 변경과 대기 중인 변경을 구별할 수 없다 | PR마다 current head, reviews, threads, required Checks를 재수집하고 보호 조건 미충족이면 merge하지 않는다 | +| G-01 | 열린 PR은 108개다. metadata상 CLEAN은 없고 DIRTY 76 / BLOCKED 20 / BEHIND 11 / UNSTABLE 1 / draft 17이다. MERGEABLE/CLEAN은 independent exact-head approval과 terminal required Checks를 자동으로 의미하지 않는다 | 안전하게 출시할 변경과 대기 중인 변경을 구별할 수 없다 | PR마다 current head, reviews, threads, required Checks를 재수집하고 보호 조건 미충족이면 merge하지 않는다 | | G-02 | 리뷰 credential / same-repo status / agent dispatch PR(#1162, #1227, #1215)이 DIRTY로 남아 선행 main 경로와 어긋난다 | 리뷰가 호출돼도 승인 증거가 생성되지 않아 자동화가 멈춘다 | current-head quality와 OpenCode/Noema/Strix를 재실행하고, 병합 뒤 router comment/dispatch의 403을 실제 PR에서 검증한다 | | G-03 | Strix provider/fallback 중복 PR #1254/#1255/#1256은 병합 없이 닫혔고 #1213이 stacked successor다. #1213은 UNSTABLE이며 #1153의 incomplete-scan fail-closed는 이미 main에 있다. 0-vuln complete scans도 MODEL QUALITY WARNING 같은 비취약 권고를 provider failure-signal로 오분류하면 fail-closed 된다 | 취약점 0건이더라도 CI 인프라 결함이 보안 결과처럼 보이고 큐가 막힌다 | exact runtime signature를 불완전 evidence로 fail-closed 분류하고, vulnerability marker가 있으면 절대 neutralize하지 않는 regression을 유지한다. 중복 Strix PR은 stack/supersede한다 | -| G-04 | 104개 live PR 중 대부분이 BEHIND/DIRTY/UNSTABLE/BLOCKED이며, 자동 caller PR이 제품 기능보다 앞서 쌓였다 | 제품 개발 속도가 queue hygiene에 소모되고, stacking 순서가 불명확하다 | product/ownership boundary별로 stack을 재정렬하고, 오래된 PR은 current main으로 normal merge/rebase 후 변경 범위를 검증한다 | +| G-04 | 108개 live PR 중 대부분이 BEHIND/DIRTY/UNSTABLE/BLOCKED이며, 자동 caller PR이 제품 기능보다 앞서 쌓였다 | 제품 개발 속도가 queue hygiene에 소모되고, stacking 순서가 불명확하다 | product/ownership boundary별로 stack을 재정렬하고, 오래된 PR은 current main으로 normal merge/rebase 후 변경 범위를 검증한다 | | G-05 | ecosystem contract/catalog PR은 존재하지만 naruon의 실제 plugin 소비·standalone 실행·connector round-trip 증거가 제한적이다 | 구매자는 “연결 가능” 문서와 실제 설치 가능한 제품을 구별할 수 없다 | manifest/version compatibility, command/event envelope, consumer smoke, rollback/upgrade contract를 조직 유관 레포에서 증명한다 | | G-06 | naruon #974와 Project #1은 제품 목표를 정의하지만 E1/E2/E3의 live implementation evidence가 이 중앙 레포에 없다. Phase 0 Issue ContextualWisdomLab/naruon#975는 Done(closed completed 2026-07-13)이다. 다음 순서 단계는 ContextualWisdomLab/naruon#976 (P1 Plugin SDK)이며 한 번에 한 phase만 진행한다 | 이메일 검색·일정 충돌이라는 killer workflow가 문서에만 머문다 | naruon에서 thread/sender ontology → temporal commitment/conflict → human correction slice를 독립 PR로 delivery한다. 소유 저장소는 naruon이다 | | G-07 | multi-level/multi-membership/temporal 관계 원칙은 master context에 있으나 모든 소비 저장소의 schema/API가 동일한 reified relationship contract를 보장하는지는 미확인이다 | 개인 단위로 집계하거나 전역 권한을 적용하는 atomistic/ecological fallacy 위험이 남는다 | relationship, membership, norm_group, validity window, evidence, confidence, disclosure를 정규화하고 cross-context golden tests를 만든다 | @@ -91,14 +91,18 @@ flowchart LR ## 4. 열린 PR live inventory -아래는 GitHub PR list가 2026-08-23 22:59 KST에 반환한 104개 열린 PR의 number/title/head/base metadata다. CLEAN/BLOCKED/DIRTY/BEHIND/UNSTABLE은 GitHub metadata일 뿐 protected merge 승인이나 required Checks PASS를 뜻하지 않는다. 다음 루프에서 모든 행의 live review, thread, Checks를 다시 확인한다. +아래는 GitHub PR list가 2026-08-23 23:09 KST에 반환한 108개 열린 PR의 number/title/head/base metadata다. CLEAN/BLOCKED/DIRTY/BEHIND/UNSTABLE은 GitHub metadata일 뿐 protected merge 승인이나 required Checks PASS를 뜻하지 않는다. 다음 루프에서 모든 행의 live review, thread, Checks를 다시 확인한다. -스냅샷 요약: CLEAN []; BLOCKED [1257, 1252, 1246, 1245, 1244, 1238, 1233, 1231, 1176, 1158, 1107, 1086, 1052, 941, 897]; UNSTABLE [1213]; DIRTY 77; BEHIND 11; draft 17. +스냅샷 요약: CLEAN []; BLOCKED [1261, 1260, 1259, 1258, 1257, 1252, 1246, 1245, 1244, 1238, 1233, 1231, 1227, 1176, 1158, 1107, 1086, 1052, 941, 897]; UNSTABLE [1213]; DIRTY 76; BEHIND 11; draft 17. | PR | title | head SHA | base | metadata | mode | |---|---|---|---|---|---| -| #1257 | fix(osv): keep base scan results across fork checkout | `7b8fc201ed7d86f415568d0e8df5a9211e1c8ab0` | main | BLOCKED | ready | -| #1252 | docs: refresh live product and technical gap baseline | `ceeaf192f689b456a05abd5537d4ae9b63350c1f` | main | BLOCKED | ready | +| #1261 | ⚡ Bolt: [성능 개선] rest_pr_node 병렬 API 호출 최적화 | `c3406765a2bd928a761118f09f7a7f475b673975` | main | BLOCKED | ready | +| #1260 | 🛡️ Sentinel: [MEDIUM] Fix missing shell=False in sandboxed_web_e2e.py | `f65e9ecfda4e22d4a0242a404455bd0a4e4831de` | main | BLOCKED | ready | +| #1259 | feat(automation): add a thin LineageWeave hourly review-repair caller | `6041f2aa9e23af5850cd83fa838a3eb6c45d84b9` | main | BLOCKED | ready | +| #1258 | fix(coverage): run pnpm 9 evidence without --trust-lockfile | `a6ea72ce2736d7058755775c7e131067fb40e902` | main | BLOCKED | ready | +| #1257 | fix(osv): keep base scan results across fork checkout | `20d72bc838d7f91b74ce01bb4de16d07144fa270` | main | BLOCKED | ready | +| #1252 | docs: refresh live product and technical gap baseline | `b5f5ee025f025e5ba9341fa195cac6888c789162` | main | BLOCKED | ready | | #1246 | fix(opencode-review): accept int-typed run_id/run_attempt in control JSON | `f88499b708a90edb6a538aeb2c397e14304681ad` | main | BLOCKED | ready | | #1245 | fix(scheduler): retry and gracefully defer shared installation rate limits | `d007bcec35f2057eda375c54e653a152f90881ec` | main | BLOCKED | ready | | #1244 | fix(e2e): restrict readiness polling to loopback destinations | `cadd69536062f400e98405fbab6e3e558080741e` | main | BLOCKED | ready | @@ -108,7 +112,7 @@ flowchart LR | #1237 | ⚡ Bolt: JSON 추출 최적화 및 버그 수정 (`raw_decode` 적용) | `59b910d3a6efc15484a2ad63c4c2c2dfbad4f34b` | main | BEHIND | ready | | #1233 | fix(automation): restore hourly fleet coordination | `dfb8e261c81705841111dd4ad1712a9fb6c767d1` | main | BLOCKED | ready | | #1231 | fix(scheduler): isolate central Actions inventory quota | `7b16617af04431a43f8f7528b8ac7db345e404a7` | main | BLOCKED | ready | -| #1227 | fix(opencode): use same-repo status credential | `05b52e7617e87d2fd6892d8d387ff9d6707a110c` | main | DIRTY | ready | +| #1227 | fix(opencode): use same-repo status credential | `5974bee1dbc2f28b33f69f1aab08066bdedaab70` | main | BLOCKED | ready | | #1218 | fix(coverage): admit protected-base test retirement | `a3e2dfca20cc76c1b8615df0f490fc5a1fc11e81` | main | DIRTY | ready | | #1215 | fix(security): redact agent-mention credential diagnostics | `6e17c3fb3f247c73dd55afcbf4f92a127549f345` | main | DIRTY | ready | | #1213 | fix(strix): make Azure and cross-provider fallbacks executable | `5ab583417053a122bd568e8295d3c25172dbac52` | fix/organization-loop-oidc-fallback | UNSTABLE | ready | @@ -204,12 +208,11 @@ flowchart LR ### 4.1 Same-session open/close delta -- ContextualWisdomLab/.github#1256, #1255, #1254 closed unmerged at 2026-08-23T13:17Z as duplicates of stacked successor #1213 (`5ab583417053a122bd568e8295d3c25172dbac52`, UNSTABLE, base `fix/organization-loop-oidc-fallback`). -- ContextualWisdomLab/.github#1253 closed unmerged at 2026-08-23T13:54Z after exact-scope audit (ScopeWeave calendar job was one-shot control-plane code for a still-open product PR). -- ContextualWisdomLab/.github#1257 head advanced from `2c82c366c668123ca63f27c29350213c2c047354` through `8800253e0339a4dc434f6b5cb7d789ec2dc69d4e` to `7b8fc201ed7d86f415568d0e8df5a9211e1c8ab0` (preserve base OSV results in `RUNNER_TEMP`). Concurrent remote commits are kept; this docs PR does not repair #1257. Not merge authorization. -- ContextualWisdomLab/.github#1252 head remains the commit that lands this 104-row refresh. Re-read `gh pr view 1252 --json headRefOid` before merge. -- Open count moved 108 → 104. No `.github` PR merged this session. - +- After the 104-row snapshot, ContextualWisdomLab/.github#1258, #1259, #1260, and #1261 opened. They are in this 108-row inventory; that is not merge authorization. +- ContextualWisdomLab/.github#1257 head advanced from `7b8fc201ed7d86f415568d0e8df5a9211e1c8ab0` to `20d72bc838d7f91b74ce01bb4de16d07144fa270`. Concurrent remote commits are kept. +- ContextualWisdomLab/.github#1227 head is `5974bee1dbc2f28b33f69f1aab08066bdedaab70` (BLOCKED after merging `main`; was DIRTY). No current-head OpenCode APPROVE. +- ContextualWisdomLab/.github#1252 head remains the commit that lands this 108-row refresh. Re-read `gh pr view 1252 --json headRefOid` before merge. Prior `docs/CWL-MASTER-CONTEXT.md` review threads are resolved. +- Open count moved 104 → 108. No `.github` PR merged this pass. ## 5. 실행 루프와 고객의 다음 행동 @@ -229,11 +232,11 @@ flowchart LR ### 5.1 이번 루프의 다음 개발 increment -1. ContextualWisdomLab/.github#1252 — 이 베이스라인. current-head OpenCode 승인과 unresolved `docs/CWL-MASTER-CONTEXT.md` thread 해소 후 병합. 인벤토리는 merge authorization이 아니다. -2. ContextualWisdomLab/.github#1257 — OSV base 결과를 fork checkout 밖 `RUNNER_TEMP`에 보존. current-head Strix가 terminal이 되면 exact-head 승인 후 병합한다. -3. Strix successor #1213 (stacked on #1233) — UNSTABLE. provider exhaustion/model-quality false fail-closed를 고치고, 취약점 marker는 neutralize하지 않는다. 닫힌 #1254/#1255/#1256을 되살리지 않는다. -4. Hourly fleet/OIDC/scheduler #1233/#1231/#1238/#1176 — BLOCKED. 자격 증명 분리를 유지한 채 exact-head 수리. OpenCode/Strix 지연은 다음 PR을 막지 않는다. -5. G-06는 naruon 소유. Phase 0 ContextualWisdomLab/naruon#975는 Done이다. 큐가 비면 한 phase씩 ContextualWisdomLab/naruon#976 (P1 Plugin SDK) 또는 남은 E1/E3 제품 slice를 naruon에서 구현한다. +1. ContextualWisdomLab/.github#1252 — 이 베이스라인. current-head OpenCode/Noema 승인 후 병합. 인벤토리는 merge authorization이 아니다. +2. ContextualWisdomLab/.github#1257 — OSV `RUNNER_TEMP` capture on `20d72bc838d7f91b74ce01bb4de16d07144fa270`. current-head Checks와 independent approval 후 병합한다. +3. New control-plane PRs #1258 (pnpm 9 coverage), #1259 (LineageWeave hourly caller), #1260 (`shell=False` Sentinel), #1261 (Bolt rest_pr_node). Review exact heads; do not merge from this table. +4. Strix successor #1213 (stacked on #1233) — UNSTABLE, OpenCode `CHANGES_REQUESTED` on an older SHA. Re-review current head `5ab583417053a122bd568e8295d3c25172dbac52`. 닫힌 #1254/#1255/#1256을 되살리지 않는다. +5. G-06는 naruon 소유. Phase 0 ContextualWisdomLab/naruon#975는 Done이다. 큐가 비면 ContextualWisdomLab/naruon#976 (P1 Plugin SDK)부터 한 phase씩 구현한다. ## 6. Compliance and data boundary From d912aa19d2ee2716d8b593da2362ecc6c3f308b3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 24 Aug 2026 00:02:04 +0900 Subject: [PATCH 08/13] docs: bind live inventory including #1262 and GitHub CLEAN #1252 Record the main-line Strix LiteLLM openai-direct rewrite as G-03 successor, keep CLEAN as snapshot metadata rather than merge authorization, and refresh exact 40-character heads after concurrent remote commits. --- docs/product-technical-gap-baseline.md | 52 +++++++++++++------------- 1 file changed, 26 insertions(+), 26 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 09b23bfb8..de5e9fbf1 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # Product and Technical Gap Baseline -작성 기준일: **2026-08-23 23:09 KST** +작성 기준일: **2026-08-23 23:59 KST** 대상: **ContextualWisdomLab/.github** 중앙 거버넌스·자동화 레포지터리와 이를 소비하는 naruon 생태계 현재 보호된 `main`: `885f2cd251999f21cf562cab3e2d9cc3cc3ec737` 현재 열린 PR 수: **108** (아래 표에 이 스냅샷의 전체 목록 포함) @@ -74,9 +74,9 @@ flowchart LR | Gap ID | 현재 관측 | 구매자 영향 | 우선 구현/검증 | |---|---|---|---| -| G-01 | 열린 PR은 108개다. metadata상 CLEAN은 없고 DIRTY 76 / BLOCKED 20 / BEHIND 11 / UNSTABLE 1 / draft 17이다. MERGEABLE/CLEAN은 independent exact-head approval과 terminal required Checks를 자동으로 의미하지 않는다 | 안전하게 출시할 변경과 대기 중인 변경을 구별할 수 없다 | PR마다 current head, reviews, threads, required Checks를 재수집하고 보호 조건 미충족이면 merge하지 않는다 | -| G-02 | 리뷰 credential / same-repo status / agent dispatch PR(#1162, #1227, #1215)이 DIRTY로 남아 선행 main 경로와 어긋난다 | 리뷰가 호출돼도 승인 증거가 생성되지 않아 자동화가 멈춘다 | current-head quality와 OpenCode/Noema/Strix를 재실행하고, 병합 뒤 router comment/dispatch의 403을 실제 PR에서 검증한다 | -| G-03 | Strix provider/fallback 중복 PR #1254/#1255/#1256은 병합 없이 닫혔고 #1213이 stacked successor다. #1213은 UNSTABLE이며 #1153의 incomplete-scan fail-closed는 이미 main에 있다. 0-vuln complete scans도 MODEL QUALITY WARNING 같은 비취약 권고를 provider failure-signal로 오분류하면 fail-closed 된다 | 취약점 0건이더라도 CI 인프라 결함이 보안 결과처럼 보이고 큐가 막힌다 | exact runtime signature를 불완전 evidence로 fail-closed 분류하고, vulnerability marker가 있으면 절대 neutralize하지 않는 regression을 유지한다. 중복 Strix PR은 stack/supersede한다 | +| G-01 | 열린 PR은 108개다. metadata상 CLEAN은 1개(#1252) / DIRTY 75 / BLOCKED 23 / BEHIND 8 / UNSTABLE 1 / draft 17이다. MERGEABLE/CLEAN은 independent exact-head approval과 terminal required Checks를 자동으로 의미하지 않는다 | 안전하게 출시할 변경과 대기 중인 변경을 구별할 수 없다 | PR마다 current head, reviews, threads, required Checks를 재수집하고 보호 조건 미충족이면 merge하지 않는다 | +| G-02 | 리뷰 credential / same-repo status / agent dispatch 중 #1162는 DIRTY이고 #1227/#1215는 main 위로 올라와 BLOCKED다. 어느 쪽도 current-head OpenCode APPROVE가 없다 | 리뷰가 호출돼도 승인 증거가 생성되지 않아 자동화가 멈춘다 | current-head quality와 OpenCode/Noema/Strix를 재실행하고, 병합 뒤 router comment/dispatch의 403을 실제 PR에서 검증한다 | +| G-03 | Strix provider/fallback 중복 PR #1254/#1255/#1256은 병합 없이 닫혔다. main-line successor는 #1262(LiteLLM `openai-direct` → `openai_direct` rewrite)이고 stacked successor는 #1213(base #1233, UNSTABLE)이다. #1153 incomplete-scan fail-closed는 main에 있다. 0-vuln complete scans도 MODEL QUALITY WARNING을 provider failure-signal로 오분류하면 fail-closed 된다 | 취약점 0건이더라도 CI 인프라 결함이 보안 결과처럼 보이고 큐가 막힌다 | exact runtime signature를 불완전 evidence로 fail-closed 분류하고, vulnerability marker가 있으면 절대 neutralize하지 않는 regression을 유지한다. 중복 Strix PR은 stack/supersede한다 | | G-04 | 108개 live PR 중 대부분이 BEHIND/DIRTY/UNSTABLE/BLOCKED이며, 자동 caller PR이 제품 기능보다 앞서 쌓였다 | 제품 개발 속도가 queue hygiene에 소모되고, stacking 순서가 불명확하다 | product/ownership boundary별로 stack을 재정렬하고, 오래된 PR은 current main으로 normal merge/rebase 후 변경 범위를 검증한다 | | G-05 | ecosystem contract/catalog PR은 존재하지만 naruon의 실제 plugin 소비·standalone 실행·connector round-trip 증거가 제한적이다 | 구매자는 “연결 가능” 문서와 실제 설치 가능한 제품을 구별할 수 없다 | manifest/version compatibility, command/event envelope, consumer smoke, rollback/upgrade contract를 조직 유관 레포에서 증명한다 | | G-06 | naruon #974와 Project #1은 제품 목표를 정의하지만 E1/E2/E3의 live implementation evidence가 이 중앙 레포에 없다. Phase 0 Issue ContextualWisdomLab/naruon#975는 Done(closed completed 2026-07-13)이다. 다음 순서 단계는 ContextualWisdomLab/naruon#976 (P1 Plugin SDK)이며 한 번에 한 phase만 진행한다 | 이메일 검색·일정 충돌이라는 killer workflow가 문서에만 머문다 | naruon에서 thread/sender ontology → temporal commitment/conflict → human correction slice를 독립 PR로 delivery한다. 소유 저장소는 naruon이다 | @@ -91,31 +91,31 @@ flowchart LR ## 4. 열린 PR live inventory -아래는 GitHub PR list가 2026-08-23 23:09 KST에 반환한 108개 열린 PR의 number/title/head/base metadata다. CLEAN/BLOCKED/DIRTY/BEHIND/UNSTABLE은 GitHub metadata일 뿐 protected merge 승인이나 required Checks PASS를 뜻하지 않는다. 다음 루프에서 모든 행의 live review, thread, Checks를 다시 확인한다. +아래는 GitHub PR list가 2026-08-23 23:59 KST에 반환한 108개 열린 PR의 number/title/head/base metadata다. CLEAN/BLOCKED/DIRTY/BEHIND/UNSTABLE은 GitHub metadata일 뿐 protected merge 승인이나 required Checks PASS를 뜻하지 않는다. 다음 루프에서 모든 행의 live review, thread, Checks를 다시 확인한다. -스냅샷 요약: CLEAN []; BLOCKED [1261, 1260, 1259, 1258, 1257, 1252, 1246, 1245, 1244, 1238, 1233, 1231, 1227, 1176, 1158, 1107, 1086, 1052, 941, 897]; UNSTABLE [1213]; DIRTY 76; BEHIND 11; draft 17. +스냅샷 요약: CLEAN [1252]; BLOCKED [1262, 1261, 1260, 1259, 1258, 1257, 1246, 1245, 1244, 1242, 1238, 1237, 1233, 1231, 1227, 1215, 1176, 1158, 1107, 1086, 1052, 941, 897]; UNSTABLE [1213]; DIRTY 75; BEHIND 8; draft 17. | PR | title | head SHA | base | metadata | mode | |---|---|---|---|---|---| -| #1261 | ⚡ Bolt: [성능 개선] rest_pr_node 병렬 API 호출 최적화 | `c3406765a2bd928a761118f09f7a7f475b673975` | main | BLOCKED | ready | -| #1260 | 🛡️ Sentinel: [MEDIUM] Fix missing shell=False in sandboxed_web_e2e.py | `f65e9ecfda4e22d4a0242a404455bd0a4e4831de` | main | BLOCKED | ready | +| #1262 | fix(strix): rewrite openai-direct fallback for LiteLLM | `101d80eac37e792a6270becbb45fdd06f564ed65` | main | BLOCKED | ready | +| #1261 | ⚡ Bolt: [성능 개선] rest_pr_node 병렬 API 호출 최적화 | `922dcd04000102df2f21cd3209f7bb1aa9e10f25` | main | BLOCKED | ready | +| #1260 | 🛡️ Sentinel: [MEDIUM] Fix missing shell=False in sandboxed_web_e2e.py | `881a5a94123469097fa56f3d74638b9f9fb4a7fe` | main | BLOCKED | ready | | #1259 | feat(automation): add a thin LineageWeave hourly review-repair caller | `6041f2aa9e23af5850cd83fa838a3eb6c45d84b9` | main | BLOCKED | ready | -| #1258 | fix(coverage): run pnpm 9 evidence without --trust-lockfile | `a6ea72ce2736d7058755775c7e131067fb40e902` | main | BLOCKED | ready | +| #1258 | fix(coverage): run pnpm 9 evidence without --trust-lockfile | `1b6f4d79caa551d20aafe86b301ba53bfb66d390` | main | BLOCKED | ready | | #1257 | fix(osv): keep base scan results across fork checkout | `20d72bc838d7f91b74ce01bb4de16d07144fa270` | main | BLOCKED | ready | -| #1252 | docs: refresh live product and technical gap baseline | `b5f5ee025f025e5ba9341fa195cac6888c789162` | main | BLOCKED | ready | +| #1252 | docs: refresh live product and technical gap baseline | `4088aa3e3721515698f653f205031dde768149d1` | main | CLEAN | ready | | #1246 | fix(opencode-review): accept int-typed run_id/run_attempt in control JSON | `f88499b708a90edb6a538aeb2c397e14304681ad` | main | BLOCKED | ready | | #1245 | fix(scheduler): retry and gracefully defer shared installation rate limits | `d007bcec35f2057eda375c54e653a152f90881ec` | main | BLOCKED | ready | -| #1244 | fix(e2e): restrict readiness polling to loopback destinations | `cadd69536062f400e98405fbab6e3e558080741e` | main | BLOCKED | ready | -| #1243 | ⚡ Bolt: [병렬 처리를 통한 스냅샷 수집 성능 개선] | `68dcc64803f89665bfc161a3ee7eb018e2612f1f` | main | BEHIND | ready | -| #1242 | ⚡ Bolt: 정규표현식 평가 병합 최적화 | `b27b834c60870f1b46cd719b0bcb4322a542946a` | main | BEHIND | ready | +| #1244 | fix(e2e): restrict readiness polling to loopback destinations | `1d0ba2e90c8274e8fd1af81f8f4939bb7ac6602b` | main | BLOCKED | ready | +| #1242 | fix(security): preserve exact CI evidence while redacting provider secrets | `9bdfcbdaf4d079de3b346e1584dd505c5043afd3` | main | BLOCKED | ready | | #1238 | fix(scheduler): stop repository_dispatch defaulting review/merge/branch flags off | `21b4c58577d54aed299cf0d2dc30a0ee80ff0902` | main | BLOCKED | ready | -| #1237 | ⚡ Bolt: JSON 추출 최적화 및 버그 수정 (`raw_decode` 적용) | `59b910d3a6efc15484a2ad63c4c2c2dfbad4f34b` | main | BEHIND | ready | +| #1237 | ⚡ Bolt: JSON 추출 최적화 및 버그 수정 (`raw_decode` 적용) | `8f1b2c6b218054e34ad224636dbb16dfa478b2d0` | main | BLOCKED | ready | | #1233 | fix(automation): restore hourly fleet coordination | `dfb8e261c81705841111dd4ad1712a9fb6c767d1` | main | BLOCKED | ready | | #1231 | fix(scheduler): isolate central Actions inventory quota | `7b16617af04431a43f8f7528b8ac7db345e404a7` | main | BLOCKED | ready | | #1227 | fix(opencode): use same-repo status credential | `5974bee1dbc2f28b33f69f1aab08066bdedaab70` | main | BLOCKED | ready | | #1218 | fix(coverage): admit protected-base test retirement | `a3e2dfca20cc76c1b8615df0f490fc5a1fc11e81` | main | DIRTY | ready | -| #1215 | fix(security): redact agent-mention credential diagnostics | `6e17c3fb3f247c73dd55afcbf4f92a127549f345` | main | DIRTY | ready | -| #1213 | fix(strix): make Azure and cross-provider fallbacks executable | `5ab583417053a122bd568e8295d3c25172dbac52` | fix/organization-loop-oidc-fallback | UNSTABLE | ready | +| #1215 | fix(security): redact agent-mention credential diagnostics | `785401dc911e0a53ef301d1900c1825147f9524a` | main | BLOCKED | ready | +| #1213 | fix(strix): make Azure and cross-provider fallbacks executable | `8d0f7ca88f6e0c9db8e2363721fbeaa59acebd6a` | fix/organization-loop-oidc-fallback | UNSTABLE | ready | | #1198 | fix(security): repair pip audit and schedule orchestrator review | `e5a7ac882559fe6d1ae1f91e27d79bc8e0aa1e77` | main | DIRTY | ready | | #1188 | fix: grant hourly callers reusable workflow OIDC scope | `1a0cc1f875db29492861006747ded2b6d9e93d09` | main | DIRTY | ready | | #1187 | fix(coverage): scope Rust evidence to changed packages | `0a88e24d9a1c92420f412d241f850aab8e72106e` | main | DIRTY | ready | @@ -208,11 +208,11 @@ flowchart LR ### 4.1 Same-session open/close delta -- After the 104-row snapshot, ContextualWisdomLab/.github#1258, #1259, #1260, and #1261 opened. They are in this 108-row inventory; that is not merge authorization. -- ContextualWisdomLab/.github#1257 head advanced from `7b8fc201ed7d86f415568d0e8df5a9211e1c8ab0` to `20d72bc838d7f91b74ce01bb4de16d07144fa270`. Concurrent remote commits are kept. -- ContextualWisdomLab/.github#1227 head is `5974bee1dbc2f28b33f69f1aab08066bdedaab70` (BLOCKED after merging `main`; was DIRTY). No current-head OpenCode APPROVE. -- ContextualWisdomLab/.github#1252 head remains the commit that lands this 108-row refresh. Re-read `gh pr view 1252 --json headRefOid` before merge. Prior `docs/CWL-MASTER-CONTEXT.md` review threads are resolved. -- Open count moved 104 → 108. No `.github` PR merged this pass. +- ContextualWisdomLab/.github#1262 opened (`101d80eac37e792a6270becbb45fdd06f564ed65`, BLOCKED): main-line LiteLLM `openai-direct` rewrite extracted from stacked #1213. Not merge authorization. +- ContextualWisdomLab/.github#1252 GitHub `mergeable_state=clean` on `4088aa3e3721515698f653f205031dde768149d1` with hosted Checks green, but no current-head OpenCode APPROVE. CLEAN is not merge authorization. This refresh advances that head. +- Head motion since the 23:09 snapshot: #1261 `922dcd04000102df2f21cd3209f7bb1aa9e10f25`, #1260 `881a5a94123469097fa56f3d74638b9f9fb4a7fe`, #1258 `1b6f4d79caa551d20aafe86b301ba53bfb66d390`, #1244 `1d0ba2e90c8274e8fd1af81f8f4939bb7ac6602b`, #1215 `785401dc911e0a53ef301d1900c1825147f9524a`, #1213 `8d0f7ca88f6e0c9db8e2363721fbeaa59acebd6a`, #1237 `8f1b2c6b218054e34ad224636dbb16dfa478b2d0`. Concurrent remote commits are kept. +- Open count stayed 108 (added #1262, previous snapshot already counted 108 including #1258-#1261). No `.github` PR merged this pass. + ## 5. 실행 루프와 고객의 다음 행동 @@ -232,11 +232,11 @@ flowchart LR ### 5.1 이번 루프의 다음 개발 increment -1. ContextualWisdomLab/.github#1252 — 이 베이스라인. current-head OpenCode/Noema 승인 후 병합. 인벤토리는 merge authorization이 아니다. -2. ContextualWisdomLab/.github#1257 — OSV `RUNNER_TEMP` capture on `20d72bc838d7f91b74ce01bb4de16d07144fa270`. current-head Checks와 independent approval 후 병합한다. -3. New control-plane PRs #1258 (pnpm 9 coverage), #1259 (LineageWeave hourly caller), #1260 (`shell=False` Sentinel), #1261 (Bolt rest_pr_node). Review exact heads; do not merge from this table. -4. Strix successor #1213 (stacked on #1233) — UNSTABLE, OpenCode `CHANGES_REQUESTED` on an older SHA. Re-review current head `5ab583417053a122bd568e8295d3c25172dbac52`. 닫힌 #1254/#1255/#1256을 되살리지 않는다. -5. G-06는 naruon 소유. Phase 0 ContextualWisdomLab/naruon#975는 Done이다. 큐가 비면 ContextualWisdomLab/naruon#976 (P1 Plugin SDK)부터 한 phase씩 구현한다. +1. ContextualWisdomLab/.github#1262 — G-03 main-line LiteLLM `openai-direct` fallback rewrite. Independent current-head OpenCode 승인과 required Checks 후 병합. stacked #1213을 되살리지 않는다. +2. ContextualWisdomLab/.github#1252 — 이 베이스라인. GitHub CLEAN이어도 current-head OpenCode APPROVE 없이 병합하지 않는다. +3. ContextualWisdomLab/.github#1227 — `5974bee1dbc2f28b33f69f1aab08066bdedaab70` MERGEABLE/BLOCKED, Strix pending. 같은 레포 `github.token` status 경로 유지. +4. ContextualWisdomLab/.github#1257/#1244/#1258 — BLOCKED. current-head Checks와 승인을 재수집한다. Strix 0-vuln MODEL QUALITY false fail-closed는 #1262/#1213 책임이다. +5. G-06는 naruon 소유. Phase 0 ContextualWisdomLab/naruon#975는 Done이다. 큐가 비면 ContextualWisdomLab/naruon#976부터 한 phase씩 구현한다. ## 6. Compliance and data boundary From 11e84587b3b1abc3239e03ffdeaa529f91bc69d4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 24 Aug 2026 00:18:17 +0900 Subject: [PATCH 09/13] docs: bind live 107-PR inventory with G-03 successor #1263 Snapshot the current open-PR inventory after #1262/#1213 closed unmerged as superseded. Record #1263 as the G-03 main-line successor. This is not merge authorization. --- docs/product-technical-gap-baseline.md | 44 +++++++++++++------------- 1 file changed, 22 insertions(+), 22 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index de5e9fbf1..18585ac42 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,9 +1,9 @@ # Product and Technical Gap Baseline -작성 기준일: **2026-08-23 23:59 KST** +작성 기준일: **2026-08-24 00:15 KST** 대상: **ContextualWisdomLab/.github** 중앙 거버넌스·자동화 레포지터리와 이를 소비하는 naruon 생태계 현재 보호된 `main`: `885f2cd251999f21cf562cab3e2d9cc3cc3ec737` -현재 열린 PR 수: **108** (아래 표에 이 스냅샷의 전체 목록 포함) +현재 열린 PR 수: **107** (아래 표에 이 스냅샷의 전체 목록 포함) 이 문서는 제품·기술·운영 Gap을 현재 문서와 현재 GitHub 상태에 묶어 두는 기준선이다. 새 작업은 먼저 이 문서의 Gap ID를 PR 설명과 테스트 증거에 연결하고, PR의 정확한 exact HEAD·Checks·리뷰를 다시 수집한 뒤 구현한다. 표의 상태는 작성 시점의 관측값이므로, 병합 판단에는 재사용하지 않는다. 이 인벤토리는 스냅샷이며 merge authorization이 아니다. @@ -74,10 +74,10 @@ flowchart LR | Gap ID | 현재 관측 | 구매자 영향 | 우선 구현/검증 | |---|---|---|---| -| G-01 | 열린 PR은 108개다. metadata상 CLEAN은 1개(#1252) / DIRTY 75 / BLOCKED 23 / BEHIND 8 / UNSTABLE 1 / draft 17이다. MERGEABLE/CLEAN은 independent exact-head approval과 terminal required Checks를 자동으로 의미하지 않는다 | 안전하게 출시할 변경과 대기 중인 변경을 구별할 수 없다 | PR마다 current head, reviews, threads, required Checks를 재수집하고 보호 조건 미충족이면 merge하지 않는다 | -| G-02 | 리뷰 credential / same-repo status / agent dispatch 중 #1162는 DIRTY이고 #1227/#1215는 main 위로 올라와 BLOCKED다. 어느 쪽도 current-head OpenCode APPROVE가 없다 | 리뷰가 호출돼도 승인 증거가 생성되지 않아 자동화가 멈춘다 | current-head quality와 OpenCode/Noema/Strix를 재실행하고, 병합 뒤 router comment/dispatch의 403을 실제 PR에서 검증한다 | -| G-03 | Strix provider/fallback 중복 PR #1254/#1255/#1256은 병합 없이 닫혔다. main-line successor는 #1262(LiteLLM `openai-direct` → `openai_direct` rewrite)이고 stacked successor는 #1213(base #1233, UNSTABLE)이다. #1153 incomplete-scan fail-closed는 main에 있다. 0-vuln complete scans도 MODEL QUALITY WARNING을 provider failure-signal로 오분류하면 fail-closed 된다 | 취약점 0건이더라도 CI 인프라 결함이 보안 결과처럼 보이고 큐가 막힌다 | exact runtime signature를 불완전 evidence로 fail-closed 분류하고, vulnerability marker가 있으면 절대 neutralize하지 않는 regression을 유지한다. 중복 Strix PR은 stack/supersede한다 | -| G-04 | 108개 live PR 중 대부분이 BEHIND/DIRTY/UNSTABLE/BLOCKED이며, 자동 caller PR이 제품 기능보다 앞서 쌓였다 | 제품 개발 속도가 queue hygiene에 소모되고, stacking 순서가 불명확하다 | product/ownership boundary별로 stack을 재정렬하고, 오래된 PR은 current main으로 normal merge/rebase 후 변경 범위를 검증한다 | +| G-01 | 열린 PR은 107개다. metadata상 CLEAN은 0개 / DIRTY 74 / BLOCKED 25 / BEHIND 8 / UNSTABLE 0 / draft 17이다. MERGEABLE/CLEAN은 independent exact-head approval과 terminal required Checks를 자동으로 의미하지 않는다 | 안전하게 출시할 변경과 대기 중인 변경을 구별할 수 없다 | PR마다 current head, reviews, threads, required Checks를 재수집하고 보호 조건 미충족이면 merge하지 않는다 | +| G-02 | 리뷰 credential / same-repo status / agent dispatch 중 #1162/#1227/#1215는 main 위로 올라와 BLOCKED다. 어느 쪽도 current-head OpenCode APPROVE가 없다 | 리뷰가 호출돼도 승인 증거가 생성되지 않아 자동화가 멈춘다 | current-head quality와 OpenCode/Noema/Strix를 재실행하고, 병합 뒤 router comment/dispatch의 403을 실제 PR에서 검증한다 | +| G-03 | Strix provider/fallback 중복 PR #1254/#1255/#1256/#1213/#1262는 병합 없이 닫혔다. main-line successor는 #1263(LiteLLM `openai-direct` rewrite + Azure unsupported-temperature fallback + exact `MODEL QUALITY WARNING` / HF Hub advisory sanitization)이다. #1153 incomplete-scan fail-closed는 main에 있다. 0-vuln complete scans도 MODEL QUALITY WARNING을 provider failure-signal로 오분류하면 fail-closed 된다 | 취약점 0건이더라도 CI 인프라 결함이 보안 결과처럼 보이고 큐가 막힌다 | exact runtime signature를 불완전 evidence로 fail-closed 분류하고, vulnerability marker가 있으면 절대 neutralize하지 않는 regression을 유지한다. 중복 Strix PR은 stack/supersede한다 | +| G-04 | 107개 live PR 중 대부분이 BEHIND/DIRTY/BLOCKED이며, 자동 caller PR이 제품 기능보다 앞서 쌓였다 | 제품 개발 속도가 queue hygiene에 소모되고, stacking 순서가 불명확하다 | product/ownership boundary별로 stack을 재정렬하고, 오래된 PR은 current main으로 normal merge/rebase 후 변경 범위를 검증한다 | | G-05 | ecosystem contract/catalog PR은 존재하지만 naruon의 실제 plugin 소비·standalone 실행·connector round-trip 증거가 제한적이다 | 구매자는 “연결 가능” 문서와 실제 설치 가능한 제품을 구별할 수 없다 | manifest/version compatibility, command/event envelope, consumer smoke, rollback/upgrade contract를 조직 유관 레포에서 증명한다 | | G-06 | naruon #974와 Project #1은 제품 목표를 정의하지만 E1/E2/E3의 live implementation evidence가 이 중앙 레포에 없다. Phase 0 Issue ContextualWisdomLab/naruon#975는 Done(closed completed 2026-07-13)이다. 다음 순서 단계는 ContextualWisdomLab/naruon#976 (P1 Plugin SDK)이며 한 번에 한 phase만 진행한다 | 이메일 검색·일정 충돌이라는 killer workflow가 문서에만 머문다 | naruon에서 thread/sender ontology → temporal commitment/conflict → human correction slice를 독립 PR로 delivery한다. 소유 저장소는 naruon이다 | | G-07 | multi-level/multi-membership/temporal 관계 원칙은 master context에 있으나 모든 소비 저장소의 schema/API가 동일한 reified relationship contract를 보장하는지는 미확인이다 | 개인 단위로 집계하거나 전역 권한을 적용하는 atomistic/ecological fallacy 위험이 남는다 | relationship, membership, norm_group, validity window, evidence, confidence, disclosure를 정규화하고 cross-context golden tests를 만든다 | @@ -91,31 +91,30 @@ flowchart LR ## 4. 열린 PR live inventory -아래는 GitHub PR list가 2026-08-23 23:59 KST에 반환한 108개 열린 PR의 number/title/head/base metadata다. CLEAN/BLOCKED/DIRTY/BEHIND/UNSTABLE은 GitHub metadata일 뿐 protected merge 승인이나 required Checks PASS를 뜻하지 않는다. 다음 루프에서 모든 행의 live review, thread, Checks를 다시 확인한다. +아래는 GitHub PR list가 2026-08-24 00:15 KST에 반환한 107개 열린 PR의 number/title/head/base metadata다. CLEAN/BLOCKED/DIRTY/BEHIND/UNSTABLE은 GitHub metadata일 뿐 protected merge 승인이나 required Checks PASS를 뜻하지 않는다. 다음 루프에서 모든 행의 live review, thread, Checks를 다시 확인한다. -스냅샷 요약: CLEAN [1252]; BLOCKED [1262, 1261, 1260, 1259, 1258, 1257, 1246, 1245, 1244, 1242, 1238, 1237, 1233, 1231, 1227, 1215, 1176, 1158, 1107, 1086, 1052, 941, 897]; UNSTABLE [1213]; DIRTY 75; BEHIND 8; draft 17. +스냅샷 요약: CLEAN []; BLOCKED [1263, 1261, 1260, 1259, 1258, 1257, 1252, 1246, 1245, 1244, 1242, 1238, 1237, 1233, 1231, 1227, 1215, 1176, 1162, 1158, 1107, 1086, 1052, 941, 897]; UNSTABLE []; DIRTY 74; BEHIND 8; draft 17. | PR | title | head SHA | base | metadata | mode | |---|---|---|---|---|---| -| #1262 | fix(strix): rewrite openai-direct fallback for LiteLLM | `101d80eac37e792a6270becbb45fdd06f564ed65` | main | BLOCKED | ready | +| #1263 | fix(strix): make Azure and cross-provider fallbacks executable | `b05edc069cba461ad1d641ce8809027ad909c14b` | main | BLOCKED | ready | | #1261 | ⚡ Bolt: [성능 개선] rest_pr_node 병렬 API 호출 최적화 | `922dcd04000102df2f21cd3209f7bb1aa9e10f25` | main | BLOCKED | ready | | #1260 | 🛡️ Sentinel: [MEDIUM] Fix missing shell=False in sandboxed_web_e2e.py | `881a5a94123469097fa56f3d74638b9f9fb4a7fe` | main | BLOCKED | ready | | #1259 | feat(automation): add a thin LineageWeave hourly review-repair caller | `6041f2aa9e23af5850cd83fa838a3eb6c45d84b9` | main | BLOCKED | ready | | #1258 | fix(coverage): run pnpm 9 evidence without --trust-lockfile | `1b6f4d79caa551d20aafe86b301ba53bfb66d390` | main | BLOCKED | ready | | #1257 | fix(osv): keep base scan results across fork checkout | `20d72bc838d7f91b74ce01bb4de16d07144fa270` | main | BLOCKED | ready | -| #1252 | docs: refresh live product and technical gap baseline | `4088aa3e3721515698f653f205031dde768149d1` | main | CLEAN | ready | +| #1252 | docs: refresh live product and technical gap baseline | `d912aa19d2ee2716d8b593da2362ecc6c3f308b3` | main | BLOCKED | ready | | #1246 | fix(opencode-review): accept int-typed run_id/run_attempt in control JSON | `f88499b708a90edb6a538aeb2c397e14304681ad` | main | BLOCKED | ready | | #1245 | fix(scheduler): retry and gracefully defer shared installation rate limits | `d007bcec35f2057eda375c54e653a152f90881ec` | main | BLOCKED | ready | | #1244 | fix(e2e): restrict readiness polling to loopback destinations | `1d0ba2e90c8274e8fd1af81f8f4939bb7ac6602b` | main | BLOCKED | ready | | #1242 | fix(security): preserve exact CI evidence while redacting provider secrets | `9bdfcbdaf4d079de3b346e1584dd505c5043afd3` | main | BLOCKED | ready | | #1238 | fix(scheduler): stop repository_dispatch defaulting review/merge/branch flags off | `21b4c58577d54aed299cf0d2dc30a0ee80ff0902` | main | BLOCKED | ready | -| #1237 | ⚡ Bolt: JSON 추출 최적화 및 버그 수정 (`raw_decode` 적용) | `8f1b2c6b218054e34ad224636dbb16dfa478b2d0` | main | BLOCKED | ready | -| #1233 | fix(automation): restore hourly fleet coordination | `dfb8e261c81705841111dd4ad1712a9fb6c767d1` | main | BLOCKED | ready | +| #1237 | ⚡ Bolt: JSON 추출 최적화 및 버그 수정 (`raw_decode` 적용) | `a534bed026e30306febce813d88cda69681b1c96` | main | BLOCKED | ready | +| #1233 | fix(automation): restore hourly fleet coordination | `9cda8fa219a2dbfa172cc05edb20ff7d6f08eb75` | main | BLOCKED | ready | | #1231 | fix(scheduler): isolate central Actions inventory quota | `7b16617af04431a43f8f7528b8ac7db345e404a7` | main | BLOCKED | ready | | #1227 | fix(opencode): use same-repo status credential | `5974bee1dbc2f28b33f69f1aab08066bdedaab70` | main | BLOCKED | ready | | #1218 | fix(coverage): admit protected-base test retirement | `a3e2dfca20cc76c1b8615df0f490fc5a1fc11e81` | main | DIRTY | ready | | #1215 | fix(security): redact agent-mention credential diagnostics | `785401dc911e0a53ef301d1900c1825147f9524a` | main | BLOCKED | ready | -| #1213 | fix(strix): make Azure and cross-provider fallbacks executable | `8d0f7ca88f6e0c9db8e2363721fbeaa59acebd6a` | fix/organization-loop-oidc-fallback | UNSTABLE | ready | | #1198 | fix(security): repair pip audit and schedule orchestrator review | `e5a7ac882559fe6d1ae1f91e27d79bc8e0aa1e77` | main | DIRTY | ready | | #1188 | fix: grant hourly callers reusable workflow OIDC scope | `1a0cc1f875db29492861006747ded2b6d9e93d09` | main | DIRTY | ready | | #1187 | fix(coverage): scope Rust evidence to changed packages | `0a88e24d9a1c92420f412d241f850aab8e72106e` | main | DIRTY | ready | @@ -124,7 +123,7 @@ flowchart LR | #1172 | fix(autofix): resolve live NVIDIA NIM models instead of a retired pin | `edab578feca63c223368aef17c175bb52ce22e5a` | main | DIRTY | ready | | #1170 | feat: route OpenCode reviews through contextual gateway | `cbf937bc7216bf34883032a040aa3850136b9e81` | main | DIRTY | ready | | #1166 | fix(ci): recognize replacement tests in existing files | `62ef26d731ddbec59bd4203279219d79b6fdd0de` | main | BEHIND | ready | -| #1162 | fix: use review credentials for agent dispatch | `444ac8bf99a95d98a60b305ccc1509283c3f671c` | main | DIRTY | ready | +| #1162 | fix: use review credentials for agent dispatch | `4a7031d7adbba759742605deb1c78d10aef16e7d` | main | BLOCKED | ready | | #1161 | fix: make hourly coordinator credential absence auditable | `49bc5e4a59cd30550f87070b48b61e966ac480e1` | main | DIRTY | ready | | #1158 | fix(osv): preserve immutable direct-source provenance | `e61fb11fbd5c7464d34cc8bedc3a7177fbdcade2` | main | BLOCKED | ready | | #1157 | fix(coverage): discover hash-pinned requirements lock files | `c4121f92b2cfea3c0096622222d2aa06fe76c8b3` | main | DIRTY | ready | @@ -208,10 +207,11 @@ flowchart LR ### 4.1 Same-session open/close delta -- ContextualWisdomLab/.github#1262 opened (`101d80eac37e792a6270becbb45fdd06f564ed65`, BLOCKED): main-line LiteLLM `openai-direct` rewrite extracted from stacked #1213. Not merge authorization. -- ContextualWisdomLab/.github#1252 GitHub `mergeable_state=clean` on `4088aa3e3721515698f653f205031dde768149d1` with hosted Checks green, but no current-head OpenCode APPROVE. CLEAN is not merge authorization. This refresh advances that head. -- Head motion since the 23:09 snapshot: #1261 `922dcd04000102df2f21cd3209f7bb1aa9e10f25`, #1260 `881a5a94123469097fa56f3d74638b9f9fb4a7fe`, #1258 `1b6f4d79caa551d20aafe86b301ba53bfb66d390`, #1244 `1d0ba2e90c8274e8fd1af81f8f4939bb7ac6602b`, #1215 `785401dc911e0a53ef301d1900c1825147f9524a`, #1213 `8d0f7ca88f6e0c9db8e2363721fbeaa59acebd6a`, #1237 `8f1b2c6b218054e34ad224636dbb16dfa478b2d0`. Concurrent remote commits are kept. -- Open count stayed 108 (added #1262, previous snapshot already counted 108 including #1258-#1261). No `.github` PR merged this pass. +- ContextualWisdomLab/.github#1263 is the live G-03 main-line successor (`b05edc069cba461ad1d641ce8809027ad909c14b`, BLOCKED): LiteLLM `openai-direct` rewrite, Azure unsupported-temperature fallback, and exact `MODEL QUALITY WARNING` / HF Hub advisory sanitization. Local focused gate cases and 25 Python tests passed. Not merge authorization. +- ContextualWisdomLab/.github#1262 and ContextualWisdomLab/.github#1213 were closed unmerged as superseded by #1263. This loop did not close them. Do not revive them. +- Required Strix jobs on #1257/`20d72bc838d7` and #1227/`5974bee1dbc2` still fail closed on a 0-vuln `MODEL QUALITY WARNING` plus `openai-direct/gpt-5.6-luna` `LLM Provider NOT provided`. That is G-03, not a #1257/#1227 code defect; `pull_request_target` still executes protected main `885f2cd251999f21cf562cab3e2d9cc3cc3ec737`. +- ContextualWisdomLab/.github#1252 live head before this refresh was `d912aa19d2ee2716d8b593da2362ecc6c3f308b3` (BLOCKED). GitHub CLEAN/BLOCKED is not merge authorization. +- Open count is 107 (removed closed #1262/#1213, added #1263). No `.github` PR merged this pass. ## 5. 실행 루프와 고객의 다음 행동 @@ -232,10 +232,10 @@ flowchart LR ### 5.1 이번 루프의 다음 개발 increment -1. ContextualWisdomLab/.github#1262 — G-03 main-line LiteLLM `openai-direct` fallback rewrite. Independent current-head OpenCode 승인과 required Checks 후 병합. stacked #1213을 되살리지 않는다. -2. ContextualWisdomLab/.github#1252 — 이 베이스라인. GitHub CLEAN이어도 current-head OpenCode APPROVE 없이 병합하지 않는다. -3. ContextualWisdomLab/.github#1227 — `5974bee1dbc2f28b33f69f1aab08066bdedaab70` MERGEABLE/BLOCKED, Strix pending. 같은 레포 `github.token` status 경로 유지. -4. ContextualWisdomLab/.github#1257/#1244/#1258 — BLOCKED. current-head Checks와 승인을 재수집한다. Strix 0-vuln MODEL QUALITY false fail-closed는 #1262/#1213 책임이다. +1. ContextualWisdomLab/.github#1263 — G-03 main-line successor. Independent current-head OpenCode 승인과 required Checks 후 병합. 닫힌 #1213/#1262를 되살리지 않는다. +2. ContextualWisdomLab/.github#1252 — 이 베이스라인. GitHub CLEAN/BLOCKED이어도 current-head OpenCode APPROVE 없이 병합하지 않는다. +3. ContextualWisdomLab/.github#1227 — `5974bee1dbc2f28b33f69f1aab08066bdedaab70` MERGEABLE/BLOCKED. 같은 레포 `github.token` status 경로 유지. Strix 0-vuln MODEL QUALITY false fail-closed는 #1263 책임이다. +4. ContextualWisdomLab/.github#1257/#1244/#1258 — BLOCKED. current-head Checks와 승인을 재수집한다. Strix 0-vuln MODEL QUALITY false fail-closed는 #1263 책임이다. 5. G-06는 naruon 소유. Phase 0 ContextualWisdomLab/naruon#975는 Done이다. 큐가 비면 ContextualWisdomLab/naruon#976부터 한 phase씩 구현한다. From 81b7fa453cdfa27493380565f64817c71a6ba58f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 24 Aug 2026 00:57:58 +0900 Subject: [PATCH 10/13] docs: bind live 103-PR inventory after #1260/#1261 close Record #1263 as the G-03 main-line Strix successor, add #1264, and keep GitHub BLOCKED/CLEAN as snapshot metadata rather than merge authorization. No `.github` PR merged this pass. --- docs/product-technical-gap-baseline.md | 52 ++++++++++++-------------- 1 file changed, 24 insertions(+), 28 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 18585ac42..478640dac 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,9 +1,9 @@ # Product and Technical Gap Baseline -작성 기준일: **2026-08-24 00:15 KST** +작성 기준일: **2026-08-24 00:57 KST** 대상: **ContextualWisdomLab/.github** 중앙 거버넌스·자동화 레포지터리와 이를 소비하는 naruon 생태계 현재 보호된 `main`: `885f2cd251999f21cf562cab3e2d9cc3cc3ec737` -현재 열린 PR 수: **107** (아래 표에 이 스냅샷의 전체 목록 포함) +현재 열린 PR 수: **103** (아래 표에 이 스냅샷의 전체 목록 포함) 이 문서는 제품·기술·운영 Gap을 현재 문서와 현재 GitHub 상태에 묶어 두는 기준선이다. 새 작업은 먼저 이 문서의 Gap ID를 PR 설명과 테스트 증거에 연결하고, PR의 정확한 exact HEAD·Checks·리뷰를 다시 수집한 뒤 구현한다. 표의 상태는 작성 시점의 관측값이므로, 병합 판단에는 재사용하지 않는다. 이 인벤토리는 스냅샷이며 merge authorization이 아니다. @@ -74,10 +74,10 @@ flowchart LR | Gap ID | 현재 관측 | 구매자 영향 | 우선 구현/검증 | |---|---|---|---| -| G-01 | 열린 PR은 107개다. metadata상 CLEAN은 0개 / DIRTY 74 / BLOCKED 25 / BEHIND 8 / UNSTABLE 0 / draft 17이다. MERGEABLE/CLEAN은 independent exact-head approval과 terminal required Checks를 자동으로 의미하지 않는다 | 안전하게 출시할 변경과 대기 중인 변경을 구별할 수 없다 | PR마다 current head, reviews, threads, required Checks를 재수집하고 보호 조건 미충족이면 merge하지 않는다 | +| G-01 | 열린 PR은 103개다. metadata상 CLEAN은 0개 / DIRTY 71 / BLOCKED 24 / BEHIND 8 / UNSTABLE 0 / draft 16이다. MERGEABLE/CLEAN은 independent exact-head approval과 terminal required Checks를 자동으로 의미하지 않는다 | 안전하게 출시할 변경과 대기 중인 변경을 구별할 수 없다 | PR마다 current head, reviews, threads, required Checks를 재수집하고 보호 조건 미충족이면 merge하지 않는다 | | G-02 | 리뷰 credential / same-repo status / agent dispatch 중 #1162/#1227/#1215는 main 위로 올라와 BLOCKED다. 어느 쪽도 current-head OpenCode APPROVE가 없다 | 리뷰가 호출돼도 승인 증거가 생성되지 않아 자동화가 멈춘다 | current-head quality와 OpenCode/Noema/Strix를 재실행하고, 병합 뒤 router comment/dispatch의 403을 실제 PR에서 검증한다 | -| G-03 | Strix provider/fallback 중복 PR #1254/#1255/#1256/#1213/#1262는 병합 없이 닫혔다. main-line successor는 #1263(LiteLLM `openai-direct` rewrite + Azure unsupported-temperature fallback + exact `MODEL QUALITY WARNING` / HF Hub advisory sanitization)이다. #1153 incomplete-scan fail-closed는 main에 있다. 0-vuln complete scans도 MODEL QUALITY WARNING을 provider failure-signal로 오분류하면 fail-closed 된다 | 취약점 0건이더라도 CI 인프라 결함이 보안 결과처럼 보이고 큐가 막힌다 | exact runtime signature를 불완전 evidence로 fail-closed 분류하고, vulnerability marker가 있으면 절대 neutralize하지 않는 regression을 유지한다. 중복 Strix PR은 stack/supersede한다 | -| G-04 | 107개 live PR 중 대부분이 BEHIND/DIRTY/BLOCKED이며, 자동 caller PR이 제품 기능보다 앞서 쌓였다 | 제품 개발 속도가 queue hygiene에 소모되고, stacking 순서가 불명확하다 | product/ownership boundary별로 stack을 재정렬하고, 오래된 PR은 current main으로 normal merge/rebase 후 변경 범위를 검증한다 | +| G-03 | Strix provider/fallback 중복 PR #1254/#1255/#1256/#1213/#1262는 병합 없이 닫혔다. main-line successor는 #1263(LiteLLM `openai-direct` rewrite + Azure unsupported-temperature fallback + exact `MODEL QUALITY WARNING` / HF Hub advisory sanitization, head `1fd718f3177d3e8ffe908aed38b50dc94e926f8d`)이다. #1153 incomplete-scan fail-closed는 main에 있다. `pull_request_target`는 보호 main의 `strix_quick_gate.sh`를 쓰므로 #1263은 자기 게이트를 self-verify할 수 없다 | 취약점 0건이더라도 CI 인프라 결함이 보안 결과처럼 보이고 큐가 막힌다 | exact runtime signature를 불완전 evidence로 fail-closed 분류하고, vulnerability marker가 있으면 절대 neutralize하지 않는 regression을 유지한다. 중복 Strix PR은 stack/supersede한다 | +| G-04 | 103개 live PR 중 대부분이 BEHIND/DIRTY/BLOCKED이며, 자동 caller PR이 제품 기능보다 앞서 쌓였다 | 제품 개발 속도가 queue hygiene에 소모되고, stacking 순서가 불명확하다 | product/ownership boundary별로 stack을 재정렬하고, 오래된 PR은 current main으로 normal merge/rebase 후 변경 범위를 검증한다 | | G-05 | ecosystem contract/catalog PR은 존재하지만 naruon의 실제 plugin 소비·standalone 실행·connector round-trip 증거가 제한적이다 | 구매자는 “연결 가능” 문서와 실제 설치 가능한 제품을 구별할 수 없다 | manifest/version compatibility, command/event envelope, consumer smoke, rollback/upgrade contract를 조직 유관 레포에서 증명한다 | | G-06 | naruon #974와 Project #1은 제품 목표를 정의하지만 E1/E2/E3의 live implementation evidence가 이 중앙 레포에 없다. Phase 0 Issue ContextualWisdomLab/naruon#975는 Done(closed completed 2026-07-13)이다. 다음 순서 단계는 ContextualWisdomLab/naruon#976 (P1 Plugin SDK)이며 한 번에 한 phase만 진행한다 | 이메일 검색·일정 충돌이라는 killer workflow가 문서에만 머문다 | naruon에서 thread/sender ontology → temporal commitment/conflict → human correction slice를 독립 PR로 delivery한다. 소유 저장소는 naruon이다 | | G-07 | multi-level/multi-membership/temporal 관계 원칙은 master context에 있으나 모든 소비 저장소의 schema/API가 동일한 reified relationship contract를 보장하는지는 미확인이다 | 개인 단위로 집계하거나 전역 권한을 적용하는 atomistic/ecological fallacy 위험이 남는다 | relationship, membership, norm_group, validity window, evidence, confidence, disclosure를 정규화하고 cross-context golden tests를 만든다 | @@ -91,34 +91,32 @@ flowchart LR ## 4. 열린 PR live inventory -아래는 GitHub PR list가 2026-08-24 00:15 KST에 반환한 107개 열린 PR의 number/title/head/base metadata다. CLEAN/BLOCKED/DIRTY/BEHIND/UNSTABLE은 GitHub metadata일 뿐 protected merge 승인이나 required Checks PASS를 뜻하지 않는다. 다음 루프에서 모든 행의 live review, thread, Checks를 다시 확인한다. +아래는 GitHub PR list가 2026-08-24 00:57 KST에 반환한 103개 열린 PR의 number/title/head/base metadata다. CLEAN/BLOCKED/DIRTY/BEHIND/UNSTABLE은 GitHub metadata일 뿐 protected merge 승인이나 required Checks PASS를 뜻하지 않는다. 다음 루프에서 모든 행의 live review, thread, Checks를 다시 확인한다. -스냅샷 요약: CLEAN []; BLOCKED [1263, 1261, 1260, 1259, 1258, 1257, 1252, 1246, 1245, 1244, 1242, 1238, 1237, 1233, 1231, 1227, 1215, 1176, 1162, 1158, 1107, 1086, 1052, 941, 897]; UNSTABLE []; DIRTY 74; BEHIND 8; draft 17. +스냅샷 요약: CLEAN []; BLOCKED [1264, 1263, 1259, 1258, 1257, 1252, 1246, 1245, 1244, 1242, 1238, 1237, 1233, 1231, 1227, 1215, 1176, 1162, 1158, 1107, 1086, 1052, 941, 897]; UNSTABLE []; DIRTY 71; BEHIND 8; draft 16. | PR | title | head SHA | base | metadata | mode | |---|---|---|---|---|---| -| #1263 | fix(strix): make Azure and cross-provider fallbacks executable | `b05edc069cba461ad1d641ce8809027ad909c14b` | main | BLOCKED | ready | -| #1261 | ⚡ Bolt: [성능 개선] rest_pr_node 병렬 API 호출 최적화 | `922dcd04000102df2f21cd3209f7bb1aa9e10f25` | main | BLOCKED | ready | -| #1260 | 🛡️ Sentinel: [MEDIUM] Fix missing shell=False in sandboxed_web_e2e.py | `881a5a94123469097fa56f3d74638b9f9fb4a7fe` | main | BLOCKED | ready | +| #1264 | perf(redaction): skip invalid key rescans without masking diagnostics | `8f20ac3600d289e0bffb0a58cb6931cadf76e717` | main | BLOCKED | ready | +| #1263 | fix(strix): make Azure and cross-provider fallbacks executable | `1fd718f3177d3e8ffe908aed38b50dc94e926f8d` | main | BLOCKED | ready | | #1259 | feat(automation): add a thin LineageWeave hourly review-repair caller | `6041f2aa9e23af5850cd83fa838a3eb6c45d84b9` | main | BLOCKED | ready | -| #1258 | fix(coverage): run pnpm 9 evidence without --trust-lockfile | `1b6f4d79caa551d20aafe86b301ba53bfb66d390` | main | BLOCKED | ready | +| #1258 | fix(coverage): run pnpm 9 evidence without --trust-lockfile | `9b5dba9f558d20dbb651b409ea9fa54a865e3405` | main | BLOCKED | ready | | #1257 | fix(osv): keep base scan results across fork checkout | `20d72bc838d7f91b74ce01bb4de16d07144fa270` | main | BLOCKED | ready | -| #1252 | docs: refresh live product and technical gap baseline | `d912aa19d2ee2716d8b593da2362ecc6c3f308b3` | main | BLOCKED | ready | +| #1252 | docs: refresh live product and technical gap baseline | `11e84587b3b1abc3239e03ffdeaa529f91bc69d4` | main | BLOCKED | ready | | #1246 | fix(opencode-review): accept int-typed run_id/run_attempt in control JSON | `f88499b708a90edb6a538aeb2c397e14304681ad` | main | BLOCKED | ready | -| #1245 | fix(scheduler): retry and gracefully defer shared installation rate limits | `d007bcec35f2057eda375c54e653a152f90881ec` | main | BLOCKED | ready | -| #1244 | fix(e2e): restrict readiness polling to loopback destinations | `1d0ba2e90c8274e8fd1af81f8f4939bb7ac6602b` | main | BLOCKED | ready | +| #1245 | fix(scheduler): retry and gracefully defer shared installation rate limits | `92624300414b19dbed0f96a0295b1ac516181b4b` | main | BLOCKED | ready | +| #1244 | fix(e2e): restrict readiness polling to loopback destinations | `a5fcafedd78e2fa2a27821aefb2bba6cc6b68cde` | main | BLOCKED | ready | | #1242 | fix(security): preserve exact CI evidence while redacting provider secrets | `9bdfcbdaf4d079de3b346e1584dd505c5043afd3` | main | BLOCKED | ready | | #1238 | fix(scheduler): stop repository_dispatch defaulting review/merge/branch flags off | `21b4c58577d54aed299cf0d2dc30a0ee80ff0902` | main | BLOCKED | ready | -| #1237 | ⚡ Bolt: JSON 추출 최적화 및 버그 수정 (`raw_decode` 적용) | `a534bed026e30306febce813d88cda69681b1c96` | main | BLOCKED | ready | +| #1237 | ⚡ Bolt: JSON 추출 최적화 및 버그 수정 (`raw_decode` 적용) | `466641151ae3dc32b91d2677d644893d23d68705` | main | BLOCKED | ready | | #1233 | fix(automation): restore hourly fleet coordination | `9cda8fa219a2dbfa172cc05edb20ff7d6f08eb75` | main | BLOCKED | ready | | #1231 | fix(scheduler): isolate central Actions inventory quota | `7b16617af04431a43f8f7528b8ac7db345e404a7` | main | BLOCKED | ready | | #1227 | fix(opencode): use same-repo status credential | `5974bee1dbc2f28b33f69f1aab08066bdedaab70` | main | BLOCKED | ready | | #1218 | fix(coverage): admit protected-base test retirement | `a3e2dfca20cc76c1b8615df0f490fc5a1fc11e81` | main | DIRTY | ready | | #1215 | fix(security): redact agent-mention credential diagnostics | `785401dc911e0a53ef301d1900c1825147f9524a` | main | BLOCKED | ready | -| #1198 | fix(security): repair pip audit and schedule orchestrator review | `e5a7ac882559fe6d1ae1f91e27d79bc8e0aa1e77` | main | DIRTY | ready | +| #1198 | fix(security): repair pip audit and schedule orchestrator review | `1ff33c9c7fb209f99b860f98a986f26e168dc8a2` | main | DIRTY | ready | | #1188 | fix: grant hourly callers reusable workflow OIDC scope | `1a0cc1f875db29492861006747ded2b6d9e93d09` | main | DIRTY | ready | | #1187 | fix(coverage): scope Rust evidence to changed packages | `0a88e24d9a1c92420f412d241f850aab8e72106e` | main | DIRTY | ready | -| #1179 | ⚡ Bolt: [성능 개선] 레이블 스캔 시 O(N) 서브스트링 검증 선행 | `ade38c0193d5ae97c1c9f7adcfe6c603ed7cf201` | main | DIRTY | ready | | #1176 | fix(governance): preserve proposal branch create transition | `49f6988795262194e4eda8b3ea7319b7b39c4e77` | main | BLOCKED | ready | | #1172 | fix(autofix): resolve live NVIDIA NIM models instead of a retired pin | `edab578feca63c223368aef17c175bb52ce22e5a` | main | DIRTY | ready | | #1170 | feat: route OpenCode reviews through contextual gateway | `cbf937bc7216bf34883032a040aa3850136b9e81` | main | DIRTY | ready | @@ -127,7 +125,6 @@ flowchart LR | #1161 | fix: make hourly coordinator credential absence auditable | `49bc5e4a59cd30550f87070b48b61e966ac480e1` | main | DIRTY | ready | | #1158 | fix(osv): preserve immutable direct-source provenance | `e61fb11fbd5c7464d34cc8bedc3a7177fbdcade2` | main | BLOCKED | ready | | #1157 | fix(coverage): discover hash-pinned requirements lock files | `c4121f92b2cfea3c0096622222d2aa06fe76c8b3` | main | DIRTY | ready | -| #1154 | ⚡ Bolt: 민감한 데이터 스크러버(Redaction) 루프 O(N) 성능 최적화 | `2e2239b7c7f364665fdec9f686b7040ba1b95e09` | main | DIRTY | ready | | #1152 | fix(opencode): retry OpenCode after coverage blockers clear | `e19066db8797a334f8bb2d9bd2d202564ff1bc20` | main | DIRTY | ready | | #1150 | feat: add read-only Actions queue health evidence | `efa7788bd14e3513221577566a768fc36f03ccff` | main | DIRTY | ready | | #1147 | feat(integration): add ecosystem capability catalogue | `113de5eb71ff9e06c00f4c272266662dcbd97392` | main | DIRTY | ready | @@ -203,15 +200,14 @@ flowchart LR | #796 | feat(automation): run Inkspan hourly NVIDIA NIM review repair | `0254a9a2c32aa1f321b6dcfd071c53029dfe5fe0` | main | DIRTY | ready | | #790 | fix(coverage): retry transient trusted uv downloads | `afad81361377f1fe2e651018f1008a590f5344a5` | main | DIRTY | draft | | #789 | feat(coverage): add bounded PyO3 peer-evidence gate | `6146bb991ed041985233eefa33985b2e40a00721` | main | DIRTY | draft | -| #785 | fix(coverage): materialize requirements-directory locks | `efd2ae85538bdb389da99f0fed6d1799ead5b343` | main | DIRTY | draft | ### 4.1 Same-session open/close delta -- ContextualWisdomLab/.github#1263 is the live G-03 main-line successor (`b05edc069cba461ad1d641ce8809027ad909c14b`, BLOCKED): LiteLLM `openai-direct` rewrite, Azure unsupported-temperature fallback, and exact `MODEL QUALITY WARNING` / HF Hub advisory sanitization. Local focused gate cases and 25 Python tests passed. Not merge authorization. -- ContextualWisdomLab/.github#1262 and ContextualWisdomLab/.github#1213 were closed unmerged as superseded by #1263. This loop did not close them. Do not revive them. -- Required Strix jobs on #1257/`20d72bc838d7` and #1227/`5974bee1dbc2` still fail closed on a 0-vuln `MODEL QUALITY WARNING` plus `openai-direct/gpt-5.6-luna` `LLM Provider NOT provided`. That is G-03, not a #1257/#1227 code defect; `pull_request_target` still executes protected main `885f2cd251999f21cf562cab3e2d9cc3cc3ec737`. -- ContextualWisdomLab/.github#1252 live head before this refresh was `d912aa19d2ee2716d8b593da2362ecc6c3f308b3` (BLOCKED). GitHub CLEAN/BLOCKED is not merge authorization. -- Open count is 107 (removed closed #1262/#1213, added #1263). No `.github` PR merged this pass. +- ContextualWisdomLab/.github#1264 opened (`8f20ac3600d289e0bffb0a58cb6931cadf76e717`, BLOCKED): redaction invalid-key rescan skip, replacing conflicted #1154 scope. Not merge authorization. +- ContextualWisdomLab/.github#1260 and #1261 closed unmerged (2026-08-23T15:30Z / 15:26Z). +- ContextualWisdomLab/.github#1263 head advanced from `b05edc069cba461ad1d641ce8809027ad909c14b` to `1fd718f3177d3e8ffe908aed38b50dc94e926f8d`. Threads resolved; OpenCode APPROVE is still missing. Required Strix still runs protected main `885f2cd251999f21cf562cab3e2d9cc3cc3ec737`. +- ContextualWisdomLab/.github#1162 Strix on `4a7031d7adbba759742605deb1c78d10aef16e7d` is 0-vuln `MODEL QUALITY WARNING` fail-closed (G-03), not a router-credential defect. +- Open count moved 107 → 103. No `.github` PR merged this pass. ## 5. 실행 루프와 고객의 다음 행동 @@ -232,10 +228,10 @@ flowchart LR ### 5.1 이번 루프의 다음 개발 increment -1. ContextualWisdomLab/.github#1263 — G-03 main-line successor. Independent current-head OpenCode 승인과 required Checks 후 병합. 닫힌 #1213/#1262를 되살리지 않는다. -2. ContextualWisdomLab/.github#1252 — 이 베이스라인. GitHub CLEAN/BLOCKED이어도 current-head OpenCode APPROVE 없이 병합하지 않는다. -3. ContextualWisdomLab/.github#1227 — `5974bee1dbc2f28b33f69f1aab08066bdedaab70` MERGEABLE/BLOCKED. 같은 레포 `github.token` status 경로 유지. Strix 0-vuln MODEL QUALITY false fail-closed는 #1263 책임이다. -4. ContextualWisdomLab/.github#1257/#1244/#1258 — BLOCKED. current-head Checks와 승인을 재수집한다. Strix 0-vuln MODEL QUALITY false fail-closed는 #1263 책임이다. +1. ContextualWisdomLab/.github#1263 — G-03 main-line successor. Independent current-head OpenCode 승인과 mechanical Checks 후 병합. self-Strix는 보호 main 게이트를 쓰므로 이 PR만으로 통과를 기대하지 않는다. 닫힌 #1213/#1262를 되살리지 않는다. +2. ContextualWisdomLab/.github#1252 — 이 베이스라인. current-head OpenCode APPROVE 없이 병합하지 않는다. +3. ContextualWisdomLab/.github#1162/#1227 — MERGEABLE/BLOCKED. 자격 증명 분리를 유지한다. Strix 0-vuln MODEL QUALITY는 #1263 책임이다. +4. ContextualWisdomLab/.github#1264 — 작은 redaction 성능 PR. current-head 리뷰 후 병합. 충돌난 #1154를 되살리지 않는다. 5. G-06는 naruon 소유. Phase 0 ContextualWisdomLab/naruon#975는 Done이다. 큐가 비면 ContextualWisdomLab/naruon#976부터 한 phase씩 구현한다. From 7356a0ac49441aeb7d2794d50b9d492812bee48d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 24 Aug 2026 01:58:28 +0900 Subject: [PATCH 11/13] docs: bind live 99-PR inventory and G-03 self-verify limit Record GitHub CLEAN #1252 as snapshot metadata, not merge authorization, and that required Strix on #1263 still executes protected main's gate. No `.github` PR merged this pass. --- docs/product-technical-gap-baseline.md | 57 ++++++++++++-------------- 1 file changed, 26 insertions(+), 31 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 478640dac..2dee53a65 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,9 +1,9 @@ # Product and Technical Gap Baseline -작성 기준일: **2026-08-24 00:57 KST** +작성 기준일: **2026-08-24 01:57 KST** 대상: **ContextualWisdomLab/.github** 중앙 거버넌스·자동화 레포지터리와 이를 소비하는 naruon 생태계 현재 보호된 `main`: `885f2cd251999f21cf562cab3e2d9cc3cc3ec737` -현재 열린 PR 수: **103** (아래 표에 이 스냅샷의 전체 목록 포함) +현재 열린 PR 수: **99** (아래 표에 이 스냅샷의 전체 목록 포함) 이 문서는 제품·기술·운영 Gap을 현재 문서와 현재 GitHub 상태에 묶어 두는 기준선이다. 새 작업은 먼저 이 문서의 Gap ID를 PR 설명과 테스트 증거에 연결하고, PR의 정확한 exact HEAD·Checks·리뷰를 다시 수집한 뒤 구현한다. 표의 상태는 작성 시점의 관측값이므로, 병합 판단에는 재사용하지 않는다. 이 인벤토리는 스냅샷이며 merge authorization이 아니다. @@ -74,10 +74,10 @@ flowchart LR | Gap ID | 현재 관측 | 구매자 영향 | 우선 구현/검증 | |---|---|---|---| -| G-01 | 열린 PR은 103개다. metadata상 CLEAN은 0개 / DIRTY 71 / BLOCKED 24 / BEHIND 8 / UNSTABLE 0 / draft 16이다. MERGEABLE/CLEAN은 independent exact-head approval과 terminal required Checks를 자동으로 의미하지 않는다 | 안전하게 출시할 변경과 대기 중인 변경을 구별할 수 없다 | PR마다 current head, reviews, threads, required Checks를 재수집하고 보호 조건 미충족이면 merge하지 않는다 | +| G-01 | 열린 PR은 99개다. metadata상 CLEAN은 1개(#1252) / DIRTY 64 / BLOCKED 28 / BEHIND 6 / UNSTABLE 0 / draft 14이다. MERGEABLE/CLEAN은 independent exact-head approval과 terminal required Checks를 자동으로 의미하지 않는다 | 안전하게 출시할 변경과 대기 중인 변경을 구별할 수 없다 | PR마다 current head, reviews, threads, required Checks를 재수집하고 보호 조건 미충족이면 merge하지 않는다 | | G-02 | 리뷰 credential / same-repo status / agent dispatch 중 #1162/#1227/#1215는 main 위로 올라와 BLOCKED다. 어느 쪽도 current-head OpenCode APPROVE가 없다 | 리뷰가 호출돼도 승인 증거가 생성되지 않아 자동화가 멈춘다 | current-head quality와 OpenCode/Noema/Strix를 재실행하고, 병합 뒤 router comment/dispatch의 403을 실제 PR에서 검증한다 | -| G-03 | Strix provider/fallback 중복 PR #1254/#1255/#1256/#1213/#1262는 병합 없이 닫혔다. main-line successor는 #1263(LiteLLM `openai-direct` rewrite + Azure unsupported-temperature fallback + exact `MODEL QUALITY WARNING` / HF Hub advisory sanitization, head `1fd718f3177d3e8ffe908aed38b50dc94e926f8d`)이다. #1153 incomplete-scan fail-closed는 main에 있다. `pull_request_target`는 보호 main의 `strix_quick_gate.sh`를 쓰므로 #1263은 자기 게이트를 self-verify할 수 없다 | 취약점 0건이더라도 CI 인프라 결함이 보안 결과처럼 보이고 큐가 막힌다 | exact runtime signature를 불완전 evidence로 fail-closed 분류하고, vulnerability marker가 있으면 절대 neutralize하지 않는 regression을 유지한다. 중복 Strix PR은 stack/supersede한다 | -| G-04 | 103개 live PR 중 대부분이 BEHIND/DIRTY/BLOCKED이며, 자동 caller PR이 제품 기능보다 앞서 쌓였다 | 제품 개발 속도가 queue hygiene에 소모되고, stacking 순서가 불명확하다 | product/ownership boundary별로 stack을 재정렬하고, 오래된 PR은 current main으로 normal merge/rebase 후 변경 범위를 검증한다 | +| G-03 | main-line G-03 successor는 #1263(`1fd718f3177d3e8ffe908aed38b50dc94e926f8d`)이다. Required `strix`는 `pull_request_target`로 보호 main `885f2cd251999f21cf562cab3e2d9cc3cc3ec737`의 `strix_quick_gate.sh`를 실행하므로 이 PR은 MODEL QUALITY WARNING + hyphenated `openai-direct/` LiteLLM `LLM Provider NOT provided`를 자기 고친 게이트로 self-verify할 수 없다. 닫힌 #1213/#1262를 되살리지 않는다. #1153 incomplete-scan fail-closed는 main에 있다 | 취약점 0건이더라도 CI 인프라 결함이 보안 결과처럼 보이고 큐가 막힌다 | exact runtime signature를 불완전 evidence로 fail-closed 분류하고, vulnerability marker가 있으면 절대 neutralize하지 않는 regression을 유지한다. 중복 Strix PR은 stack/supersede한다 | +| G-04 | 99개 live PR 중 대부분이 BEHIND/DIRTY/BLOCKED이며, 자동 caller PR이 제품 기능보다 앞서 쌓였다 | 제품 개발 속도가 queue hygiene에 소모되고, stacking 순서가 불명확하다 | product/ownership boundary별로 stack을 재정렬하고, 오래된 PR은 current main으로 normal merge/rebase 후 변경 범위를 검증한다 | | G-05 | ecosystem contract/catalog PR은 존재하지만 naruon의 실제 plugin 소비·standalone 실행·connector round-trip 증거가 제한적이다 | 구매자는 “연결 가능” 문서와 실제 설치 가능한 제품을 구별할 수 없다 | manifest/version compatibility, command/event envelope, consumer smoke, rollback/upgrade contract를 조직 유관 레포에서 증명한다 | | G-06 | naruon #974와 Project #1은 제품 목표를 정의하지만 E1/E2/E3의 live implementation evidence가 이 중앙 레포에 없다. Phase 0 Issue ContextualWisdomLab/naruon#975는 Done(closed completed 2026-07-13)이다. 다음 순서 단계는 ContextualWisdomLab/naruon#976 (P1 Plugin SDK)이며 한 번에 한 phase만 진행한다 | 이메일 검색·일정 충돌이라는 killer workflow가 문서에만 머문다 | naruon에서 thread/sender ontology → temporal commitment/conflict → human correction slice를 독립 PR로 delivery한다. 소유 저장소는 naruon이다 | | G-07 | multi-level/multi-membership/temporal 관계 원칙은 master context에 있으나 모든 소비 저장소의 schema/API가 동일한 reified relationship contract를 보장하는지는 미확인이다 | 개인 단위로 집계하거나 전역 권한을 적용하는 atomistic/ecological fallacy 위험이 남는다 | relationship, membership, norm_group, validity window, evidence, confidence, disclosure를 정규화하고 cross-context golden tests를 만든다 | @@ -91,45 +91,42 @@ flowchart LR ## 4. 열린 PR live inventory -아래는 GitHub PR list가 2026-08-24 00:57 KST에 반환한 103개 열린 PR의 number/title/head/base metadata다. CLEAN/BLOCKED/DIRTY/BEHIND/UNSTABLE은 GitHub metadata일 뿐 protected merge 승인이나 required Checks PASS를 뜻하지 않는다. 다음 루프에서 모든 행의 live review, thread, Checks를 다시 확인한다. +아래는 GitHub PR list가 2026-08-24 01:57 KST에 반환한 99개 열린 PR의 number/title/head/base metadata다. CLEAN/BLOCKED/DIRTY/BEHIND/UNSTABLE은 GitHub metadata일 뿐 protected merge 승인이나 required Checks PASS를 뜻하지 않는다. 다음 루프에서 모든 행의 live review, thread, Checks를 다시 확인한다. -스냅샷 요약: CLEAN []; BLOCKED [1264, 1263, 1259, 1258, 1257, 1252, 1246, 1245, 1244, 1242, 1238, 1237, 1233, 1231, 1227, 1215, 1176, 1162, 1158, 1107, 1086, 1052, 941, 897]; UNSTABLE []; DIRTY 71; BEHIND 8; draft 16. +스냅샷 요약: CLEAN [1252]; BLOCKED [1266, 1265, 1264, 1263, 1259, 1258, 1257, 1246, 1245, 1244, 1242, 1238, 1233, 1231, 1227, 1215, 1198, 1176, 1166, 1162, 1158, 1107, 1086, 1052, 941, 897, 790, 789]; UNSTABLE []; DIRTY 64; BEHIND 6; draft 14. | PR | title | head SHA | base | metadata | mode | |---|---|---|---|---|---| -| #1264 | perf(redaction): skip invalid key rescans without masking diagnostics | `8f20ac3600d289e0bffb0a58cb6931cadf76e717` | main | BLOCKED | ready | -| #1263 | fix(strix): make Azure and cross-provider fallbacks executable | `1fd718f3177d3e8ffe908aed38b50dc94e926f8d` | main | BLOCKED | ready | +| #1266 | fix(scheduler): retry OpenCode after coverage blockers clear | `9f2ab9ae2f97be49fc4ab4dbcd13123057005b97` | main | BLOCKED | ready | +| #1265 | test: provision pip in fresh uv environments | `73b674b31f80473d49c067ec339a9c561bbbb844` | main | BLOCKED | ready | +| #1264 | perf(redaction): skip invalid key rescans without masking diagnostics | `cbc5852b25634cb333a32da1a89de9825cb24802` | main | BLOCKED | ready | +| #1263 | fix(strix): make Azure and cross-provider fallbacks executable | `de3abcd1206e97ce758742775823e0e94f317d82` | main | BLOCKED | ready | | #1259 | feat(automation): add a thin LineageWeave hourly review-repair caller | `6041f2aa9e23af5850cd83fa838a3eb6c45d84b9` | main | BLOCKED | ready | | #1258 | fix(coverage): run pnpm 9 evidence without --trust-lockfile | `9b5dba9f558d20dbb651b409ea9fa54a865e3405` | main | BLOCKED | ready | | #1257 | fix(osv): keep base scan results across fork checkout | `20d72bc838d7f91b74ce01bb4de16d07144fa270` | main | BLOCKED | ready | -| #1252 | docs: refresh live product and technical gap baseline | `11e84587b3b1abc3239e03ffdeaa529f91bc69d4` | main | BLOCKED | ready | +| #1252 | docs: refresh live product and technical gap baseline | `81b7fa453cdfa27493380565f64817c71a6ba58f` | main | CLEAN | ready | | #1246 | fix(opencode-review): accept int-typed run_id/run_attempt in control JSON | `f88499b708a90edb6a538aeb2c397e14304681ad` | main | BLOCKED | ready | | #1245 | fix(scheduler): retry and gracefully defer shared installation rate limits | `92624300414b19dbed0f96a0295b1ac516181b4b` | main | BLOCKED | ready | -| #1244 | fix(e2e): restrict readiness polling to loopback destinations | `a5fcafedd78e2fa2a27821aefb2bba6cc6b68cde` | main | BLOCKED | ready | +| #1244 | fix(e2e): restrict readiness polling to loopback destinations | `a0c82c87dfc01b49698fd84db378a71942714b57` | main | BLOCKED | ready | | #1242 | fix(security): preserve exact CI evidence while redacting provider secrets | `9bdfcbdaf4d079de3b346e1584dd505c5043afd3` | main | BLOCKED | ready | | #1238 | fix(scheduler): stop repository_dispatch defaulting review/merge/branch flags off | `21b4c58577d54aed299cf0d2dc30a0ee80ff0902` | main | BLOCKED | ready | -| #1237 | ⚡ Bolt: JSON 추출 최적화 및 버그 수정 (`raw_decode` 적용) | `466641151ae3dc32b91d2677d644893d23d68705` | main | BLOCKED | ready | | #1233 | fix(automation): restore hourly fleet coordination | `9cda8fa219a2dbfa172cc05edb20ff7d6f08eb75` | main | BLOCKED | ready | | #1231 | fix(scheduler): isolate central Actions inventory quota | `7b16617af04431a43f8f7528b8ac7db345e404a7` | main | BLOCKED | ready | | #1227 | fix(opencode): use same-repo status credential | `5974bee1dbc2f28b33f69f1aab08066bdedaab70` | main | BLOCKED | ready | -| #1218 | fix(coverage): admit protected-base test retirement | `a3e2dfca20cc76c1b8615df0f490fc5a1fc11e81` | main | DIRTY | ready | | #1215 | fix(security): redact agent-mention credential diagnostics | `785401dc911e0a53ef301d1900c1825147f9524a` | main | BLOCKED | ready | -| #1198 | fix(security): repair pip audit and schedule orchestrator review | `1ff33c9c7fb209f99b860f98a986f26e168dc8a2` | main | DIRTY | ready | +| #1198 | fix(security): repair pip audit and schedule orchestrator review | `997e4f19e63c5962ddd168579301e080bd1553ff` | main | BLOCKED | ready | | #1188 | fix: grant hourly callers reusable workflow OIDC scope | `1a0cc1f875db29492861006747ded2b6d9e93d09` | main | DIRTY | ready | | #1187 | fix(coverage): scope Rust evidence to changed packages | `0a88e24d9a1c92420f412d241f850aab8e72106e` | main | DIRTY | ready | | #1176 | fix(governance): preserve proposal branch create transition | `49f6988795262194e4eda8b3ea7319b7b39c4e77` | main | BLOCKED | ready | | #1172 | fix(autofix): resolve live NVIDIA NIM models instead of a retired pin | `edab578feca63c223368aef17c175bb52ce22e5a` | main | DIRTY | ready | | #1170 | feat: route OpenCode reviews through contextual gateway | `cbf937bc7216bf34883032a040aa3850136b9e81` | main | DIRTY | ready | -| #1166 | fix(ci): recognize replacement tests in existing files | `62ef26d731ddbec59bd4203279219d79b6fdd0de` | main | BEHIND | ready | +| #1166 | fix(ci): recognize replacement tests in existing files | `2cdfbe3ba56ed8a63287e3a757fd858d9f8a72f4` | main | BLOCKED | ready | | #1162 | fix: use review credentials for agent dispatch | `4a7031d7adbba759742605deb1c78d10aef16e7d` | main | BLOCKED | ready | | #1161 | fix: make hourly coordinator credential absence auditable | `49bc5e4a59cd30550f87070b48b61e966ac480e1` | main | DIRTY | ready | | #1158 | fix(osv): preserve immutable direct-source provenance | `e61fb11fbd5c7464d34cc8bedc3a7177fbdcade2` | main | BLOCKED | ready | -| #1157 | fix(coverage): discover hash-pinned requirements lock files | `c4121f92b2cfea3c0096622222d2aa06fe76c8b3` | main | DIRTY | ready | -| #1152 | fix(opencode): retry OpenCode after coverage blockers clear | `e19066db8797a334f8bb2d9bd2d202564ff1bc20` | main | DIRTY | ready | | #1150 | feat: add read-only Actions queue health evidence | `efa7788bd14e3513221577566a768fc36f03ccff` | main | DIRTY | ready | | #1147 | feat(integration): add ecosystem capability catalogue | `113de5eb71ff9e06c00f4c272266662dcbd97392` | main | DIRTY | ready | | #1146 | fix(figma): retain style references and component sets | `8ffdf4d8150091957a79b5fc63c984e927d323b3` | main | DIRTY | ready | -| #1145 | feat: enforce adaptive orchestration defaults | `2451889cc80afa9101275e1356f8757fabc69b44` | main | DIRTY | ready | | #1143 | ci: schedule naruon hourly review repair | `9c2842ab1d49bb1ed74683bc52c0e213eb5d5bc7` | main | DIRTY | ready | | #1123 | feat(edge): standardize organization runtimes on Cloudflare Pingora | `251b16836164cfcfc0914a568d514cc7b6a9dd6d` | main | DIRTY | ready | | #1120 | Wire Noema to a same-job contextual-orchestrator sidecar | `101e6906cc3568beb99c19c28eaffb526bac335b` | main | DIRTY | draft | @@ -173,7 +170,6 @@ flowchart LR | #1035 | docs(automation): retarget closed-unmerged #840 and #906 lineage | `cb5e2ee03b9f75857e2ce31690fc76de76ad9cc1` | main | DIRTY | draft | | #1027 | fix(automation): stop mention sweep on already-exceeded rate limits | `d046637834d6d9720852423c3cdb5ef79faa1fe3` | main | DIRTY | draft | | #1026 | feat(actions): inventory orphaned workflow identities | `1be76989887ab772e3ce0d2e0c7f22d3ca98dd94` | main | DIRTY | ready | -| #1024 | docs(ai): standardize adaptive contextual-orchestrator consumers | `8414552f7d2d0d899904caf4d9efda0c785c90ee` | main | BEHIND | ready | | #1015 | fix(coverage): defer interpreter-specific wheel gaps | `ce28ffba511cb7e2a5135e6f862164834c0f874b` | main | BEHIND | ready | | #1009 | fix(strix): bind evidence to exact workflow artifacts | `99fee8b1b4ff4fc2219b98561cc4fea851c2f03a` | main | DIRTY | ready | | #991 | fix(automation): reuse review node_id for mention eyes | `b6303e081756b9598316cdf07f84c038924f0427` | main | DIRTY | draft | @@ -198,16 +194,15 @@ flowchart LR | #821 | fix(ci): replace conflicted fatal OpenCode process-group prerequisite | `180bc31ae92595d46c8cbc0c4f629739f1e0354a` | main | DIRTY | ready | | #807 | fix(coverage): validate nested npm metadata through canonical pins | `46cc52f7e05b559ce3442542b28fc133d9b2e2e4` | main | DIRTY | ready | | #796 | feat(automation): run Inkspan hourly NVIDIA NIM review repair | `0254a9a2c32aa1f321b6dcfd071c53029dfe5fe0` | main | DIRTY | ready | -| #790 | fix(coverage): retry transient trusted uv downloads | `afad81361377f1fe2e651018f1008a590f5344a5` | main | DIRTY | draft | -| #789 | feat(coverage): add bounded PyO3 peer-evidence gate | `6146bb991ed041985233eefa33985b2e40a00721` | main | DIRTY | draft | +| #790 | fix(coverage): retry transient trusted uv downloads | `05e284a17e7e692ad5e58dc39045ef42de84d9af` | main | BLOCKED | ready | +| #789 | feat(coverage): add bounded PyO3 peer-evidence gate | `861478bb11ba89f71b97dbbdd874b3d872372125` | main | BLOCKED | ready | ### 4.1 Same-session open/close delta -- ContextualWisdomLab/.github#1264 opened (`8f20ac3600d289e0bffb0a58cb6931cadf76e717`, BLOCKED): redaction invalid-key rescan skip, replacing conflicted #1154 scope. Not merge authorization. -- ContextualWisdomLab/.github#1260 and #1261 closed unmerged (2026-08-23T15:30Z / 15:26Z). -- ContextualWisdomLab/.github#1263 head advanced from `b05edc069cba461ad1d641ce8809027ad909c14b` to `1fd718f3177d3e8ffe908aed38b50dc94e926f8d`. Threads resolved; OpenCode APPROVE is still missing. Required Strix still runs protected main `885f2cd251999f21cf562cab3e2d9cc3cc3ec737`. -- ContextualWisdomLab/.github#1162 Strix on `4a7031d7adbba759742605deb1c78d10aef16e7d` is 0-vuln `MODEL QUALITY WARNING` fail-closed (G-03), not a router-credential defect. -- Open count moved 107 → 103. No `.github` PR merged this pass. +- ContextualWisdomLab/.github#1252 is GitHub `CLEAN` on `81b7fa453cdfa27493380565f64817c71a6ba58f` with hosted Checks green and threads resolved, but latestOpinionatedReviews is empty (no current-head OpenCode APPROVE). CLEAN is not merge authorization. +- ContextualWisdomLab/.github#1263 required Strix on this head still fail-closes on 0-vuln `MODEL QUALITY WARNING` then `openai-direct/gpt-5.6-luna` `LLM Provider NOT provided`, because `pull_request_target` uses protected main's gate. Manual `repository_dispatch` Strix also ran against `main@885f2cd2` and is not merge evidence. +- ContextualWisdomLab/.github#1265 (`73b674b31f80473d49c067ec339a9c561bbbb844`) and #1266 (`9f2ab9ae2f97be49fc4ab4dbcd13123057005b97`) opened. #1264 head advanced to `cbc5852b25634cb333a32da1a89de9825cb24802`. #1237 and #1218 closed unmerged. +- Open count moved 103 → 99. No `.github` PR merged this pass. Main remains `885f2cd251999f21cf562cab3e2d9cc3cc3ec737`. ## 5. 실행 루프와 고객의 다음 행동 @@ -228,11 +223,11 @@ flowchart LR ### 5.1 이번 루프의 다음 개발 increment -1. ContextualWisdomLab/.github#1263 — G-03 main-line successor. Independent current-head OpenCode 승인과 mechanical Checks 후 병합. self-Strix는 보호 main 게이트를 쓰므로 이 PR만으로 통과를 기대하지 않는다. 닫힌 #1213/#1262를 되살리지 않는다. -2. ContextualWisdomLab/.github#1252 — 이 베이스라인. current-head OpenCode APPROVE 없이 병합하지 않는다. -3. ContextualWisdomLab/.github#1162/#1227 — MERGEABLE/BLOCKED. 자격 증명 분리를 유지한다. Strix 0-vuln MODEL QUALITY는 #1263 책임이다. -4. ContextualWisdomLab/.github#1264 — 작은 redaction 성능 PR. current-head 리뷰 후 병합. 충돌난 #1154를 되살리지 않는다. -5. G-06는 naruon 소유. Phase 0 ContextualWisdomLab/naruon#975는 Done이다. 큐가 비면 ContextualWisdomLab/naruon#976부터 한 phase씩 구현한다. +1. ContextualWisdomLab/.github#1263 — G-03. Required Strix는 보호 main 게이트라 self-green이 아니다. OpenCode가 이 한계를 인정한 current-head 승인과, Strix 외 required Checks green일 때만 병합을 재평가한다. 닫힌 #1213/#1262를 되살리지 않는다. +2. ContextualWisdomLab/.github#1252 — GitHub CLEAN이지만 current-head OpenCode APPROVE가 없다. 승인 후 `--match-head-commit` 병합. +3. ContextualWisdomLab/.github#1265 — pip pin in fresh uv env. Strix already PASS. current-head OpenCode 승인 후 병합. +4. ContextualWisdomLab/.github#1162/#1227/#1257 — Strix 0-vuln MODEL QUALITY CR은 G-03이지 해당 PR 코드 결함이 아니다. #1263 병합 전에 코드로 고치지 않는다. +5. G-06는 naruon 소유. 큐가 비면 ContextualWisdomLab/naruon#976부터 한 phase씩 구현한다. ## 6. Compliance and data boundary From de2d5c3605df1c05eed3efd91a2512517bc1f7fe Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 24 Aug 2026 02:14:45 +0900 Subject: [PATCH 12/13] docs: bind naruon gap reference to repository --- docs/product-technical-gap-baseline.md | 2 +- tests/test_product_technical_gap_baseline.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 2dee53a65..a7ebbba69 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -79,7 +79,7 @@ flowchart LR | G-03 | main-line G-03 successor는 #1263(`1fd718f3177d3e8ffe908aed38b50dc94e926f8d`)이다. Required `strix`는 `pull_request_target`로 보호 main `885f2cd251999f21cf562cab3e2d9cc3cc3ec737`의 `strix_quick_gate.sh`를 실행하므로 이 PR은 MODEL QUALITY WARNING + hyphenated `openai-direct/` LiteLLM `LLM Provider NOT provided`를 자기 고친 게이트로 self-verify할 수 없다. 닫힌 #1213/#1262를 되살리지 않는다. #1153 incomplete-scan fail-closed는 main에 있다 | 취약점 0건이더라도 CI 인프라 결함이 보안 결과처럼 보이고 큐가 막힌다 | exact runtime signature를 불완전 evidence로 fail-closed 분류하고, vulnerability marker가 있으면 절대 neutralize하지 않는 regression을 유지한다. 중복 Strix PR은 stack/supersede한다 | | G-04 | 99개 live PR 중 대부분이 BEHIND/DIRTY/BLOCKED이며, 자동 caller PR이 제품 기능보다 앞서 쌓였다 | 제품 개발 속도가 queue hygiene에 소모되고, stacking 순서가 불명확하다 | product/ownership boundary별로 stack을 재정렬하고, 오래된 PR은 current main으로 normal merge/rebase 후 변경 범위를 검증한다 | | G-05 | ecosystem contract/catalog PR은 존재하지만 naruon의 실제 plugin 소비·standalone 실행·connector round-trip 증거가 제한적이다 | 구매자는 “연결 가능” 문서와 실제 설치 가능한 제품을 구별할 수 없다 | manifest/version compatibility, command/event envelope, consumer smoke, rollback/upgrade contract를 조직 유관 레포에서 증명한다 | -| G-06 | naruon #974와 Project #1은 제품 목표를 정의하지만 E1/E2/E3의 live implementation evidence가 이 중앙 레포에 없다. Phase 0 Issue ContextualWisdomLab/naruon#975는 Done(closed completed 2026-07-13)이다. 다음 순서 단계는 ContextualWisdomLab/naruon#976 (P1 Plugin SDK)이며 한 번에 한 phase만 진행한다 | 이메일 검색·일정 충돌이라는 killer workflow가 문서에만 머문다 | naruon에서 thread/sender ontology → temporal commitment/conflict → human correction slice를 독립 PR로 delivery한다. 소유 저장소는 naruon이다 | +| G-06 | ContextualWisdomLab/naruon#974와 Project #1은 제품 목표를 정의하지만 E1/E2/E3의 live implementation evidence가 이 중앙 레포에 없다. Phase 0 Issue ContextualWisdomLab/naruon#975는 Done(closed completed 2026-07-13)이다. 다음 순서 단계는 ContextualWisdomLab/naruon#976 (P1 Plugin SDK)이며 한 번에 한 phase만 진행한다 | 이메일 검색·일정 충돌이라는 killer workflow가 문서에만 머문다 | naruon에서 thread/sender ontology → temporal commitment/conflict → human correction slice를 독립 PR로 delivery한다. 소유 저장소는 naruon이다 | | G-07 | multi-level/multi-membership/temporal 관계 원칙은 master context에 있으나 모든 소비 저장소의 schema/API가 동일한 reified relationship contract를 보장하는지는 미확인이다 | 개인 단위로 집계하거나 전역 권한을 적용하는 atomistic/ecological fallacy 위험이 남는다 | relationship, membership, norm_group, validity window, evidence, confidence, disclosure를 정규화하고 cross-context golden tests를 만든다 | | G-08 | embedding·DOM·sender/receiver 의미 단위 chunking과 base64 image의 OCR/object/tag/position-index 설계가 ecosystem contract에 부분적으로만 반영됐다 | 검색은 되지만 실제 그림 위치와 의미를 회수하지 못해 편집·문서·메일 업무가 끊긴다 | semantic unit chunk schema와 image asset/region/ocr/tag embeddings를 별도 entity로 설계하고 source offset/DOM path를 보존한다 | | G-09 | 100% coverage/docstring은 중앙 PR별로 증거가 있으나 조직 소비 레포의 frontend interaction/i18n/design-token/real-data accuracy 증거가 동일한지 미확인이다 | “green CI”가 실제 고객 시나리오 정확성을 보장하지 않는다 | domain-specific RMSE/reproducibility/audio/visual/browser acceptance와 edge matrix를 required evidence로 만든다 | diff --git a/tests/test_product_technical_gap_baseline.py b/tests/test_product_technical_gap_baseline.py index 15673e25e..a6bdb357e 100644 --- a/tests/test_product_technical_gap_baseline.py +++ b/tests/test_product_technical_gap_baseline.py @@ -15,7 +15,7 @@ def test_baseline_binds_current_governance_sources_and_buyer_contract() -> None: for marker in ( "CWL Master Context", - "naruon #974", + "ContextualWisdomLab/naruon#974", "GitHub Project #1", "PRD acceptance", "TRD target", From 295214894284330d5837ee92fadfdce18049e6f3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 24 Aug 2026 02:57:16 +0900 Subject: [PATCH 13/13] docs: bind live 97-PR inventory including #1267/#1269 Record concurrent #1252/#1263 head motion and that #1265 still lacks current-head OpenCode APPROVE. The SHA table is not merge authorization. --- docs/product-technical-gap-baseline.md | 49 +++++++++++++------------- 1 file changed, 24 insertions(+), 25 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index a7ebbba69..418ddb284 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,9 +1,9 @@ # Product and Technical Gap Baseline -작성 기준일: **2026-08-24 01:57 KST** +작성 기준일: **2026-08-24 02:57 KST** 대상: **ContextualWisdomLab/.github** 중앙 거버넌스·자동화 레포지터리와 이를 소비하는 naruon 생태계 현재 보호된 `main`: `885f2cd251999f21cf562cab3e2d9cc3cc3ec737` -현재 열린 PR 수: **99** (아래 표에 이 스냅샷의 전체 목록 포함) +현재 열린 PR 수: **97** (아래 표에 이 스냅샷의 전체 목록 포함) 이 문서는 제품·기술·운영 Gap을 현재 문서와 현재 GitHub 상태에 묶어 두는 기준선이다. 새 작업은 먼저 이 문서의 Gap ID를 PR 설명과 테스트 증거에 연결하고, PR의 정확한 exact HEAD·Checks·리뷰를 다시 수집한 뒤 구현한다. 표의 상태는 작성 시점의 관측값이므로, 병합 판단에는 재사용하지 않는다. 이 인벤토리는 스냅샷이며 merge authorization이 아니다. @@ -74,10 +74,10 @@ flowchart LR | Gap ID | 현재 관측 | 구매자 영향 | 우선 구현/검증 | |---|---|---|---| -| G-01 | 열린 PR은 99개다. metadata상 CLEAN은 1개(#1252) / DIRTY 64 / BLOCKED 28 / BEHIND 6 / UNSTABLE 0 / draft 14이다. MERGEABLE/CLEAN은 independent exact-head approval과 terminal required Checks를 자동으로 의미하지 않는다 | 안전하게 출시할 변경과 대기 중인 변경을 구별할 수 없다 | PR마다 current head, reviews, threads, required Checks를 재수집하고 보호 조건 미충족이면 merge하지 않는다 | +| G-01 | 열린 PR은 97개다. metadata상 CLEAN은 0개 / DIRTY 60 / BLOCKED 31 / BEHIND 6 / UNSTABLE 0 / draft 14이다. MERGEABLE/CLEAN은 independent exact-head approval과 terminal required Checks를 자동으로 의미하지 않는다 | 안전하게 출시할 변경과 대기 중인 변경을 구별할 수 없다 | PR마다 current head, reviews, threads, required Checks를 재수집하고 보호 조건 미충족이면 merge하지 않는다 | | G-02 | 리뷰 credential / same-repo status / agent dispatch 중 #1162/#1227/#1215는 main 위로 올라와 BLOCKED다. 어느 쪽도 current-head OpenCode APPROVE가 없다 | 리뷰가 호출돼도 승인 증거가 생성되지 않아 자동화가 멈춘다 | current-head quality와 OpenCode/Noema/Strix를 재실행하고, 병합 뒤 router comment/dispatch의 403을 실제 PR에서 검증한다 | -| G-03 | main-line G-03 successor는 #1263(`1fd718f3177d3e8ffe908aed38b50dc94e926f8d`)이다. Required `strix`는 `pull_request_target`로 보호 main `885f2cd251999f21cf562cab3e2d9cc3cc3ec737`의 `strix_quick_gate.sh`를 실행하므로 이 PR은 MODEL QUALITY WARNING + hyphenated `openai-direct/` LiteLLM `LLM Provider NOT provided`를 자기 고친 게이트로 self-verify할 수 없다. 닫힌 #1213/#1262를 되살리지 않는다. #1153 incomplete-scan fail-closed는 main에 있다 | 취약점 0건이더라도 CI 인프라 결함이 보안 결과처럼 보이고 큐가 막힌다 | exact runtime signature를 불완전 evidence로 fail-closed 분류하고, vulnerability marker가 있으면 절대 neutralize하지 않는 regression을 유지한다. 중복 Strix PR은 stack/supersede한다 | -| G-04 | 99개 live PR 중 대부분이 BEHIND/DIRTY/BLOCKED이며, 자동 caller PR이 제품 기능보다 앞서 쌓였다 | 제품 개발 속도가 queue hygiene에 소모되고, stacking 순서가 불명확하다 | product/ownership boundary별로 stack을 재정렬하고, 오래된 PR은 current main으로 normal merge/rebase 후 변경 범위를 검증한다 | +| G-03 | main-line G-03 successor는 #1263(`71afa06c116159f757092677fa605405097a9e05`)이다. Required `strix`는 `pull_request_target`로 보호 main `885f2cd251999f21cf562cab3e2d9cc3cc3ec737`의 `strix_quick_gate.sh`를 실행하므로 이 PR은 MODEL QUALITY WARNING + hyphenated `openai-direct/` LiteLLM `LLM Provider NOT provided`를 자기 고친 게이트로 self-verify할 수 없다. 닫힌 #1213/#1262를 되살리지 않는다 | 취약점 0건이더라도 CI 인프라 결함이 보안 결과처럼 보이고 큐가 막힌다 | exact runtime signature를 불완전 evidence로 fail-closed 분류하고, vulnerability marker가 있으면 절대 neutralize하지 않는 regression을 유지한다. 중복 Strix PR은 stack/supersede한다 | +| G-04 | 97개 live PR 중 대부분이 BEHIND/DIRTY/BLOCKED이며, 자동 caller PR이 제품 기능보다 앞서 쌓였다 | 제품 개발 속도가 queue hygiene에 소모되고, stacking 순서가 불명확하다 | product/ownership boundary별로 stack을 재정렬하고, 오래된 PR은 current main으로 normal merge/rebase 후 변경 범위를 검증한다 | | G-05 | ecosystem contract/catalog PR은 존재하지만 naruon의 실제 plugin 소비·standalone 실행·connector round-trip 증거가 제한적이다 | 구매자는 “연결 가능” 문서와 실제 설치 가능한 제품을 구별할 수 없다 | manifest/version compatibility, command/event envelope, consumer smoke, rollback/upgrade contract를 조직 유관 레포에서 증명한다 | | G-06 | ContextualWisdomLab/naruon#974와 Project #1은 제품 목표를 정의하지만 E1/E2/E3의 live implementation evidence가 이 중앙 레포에 없다. Phase 0 Issue ContextualWisdomLab/naruon#975는 Done(closed completed 2026-07-13)이다. 다음 순서 단계는 ContextualWisdomLab/naruon#976 (P1 Plugin SDK)이며 한 번에 한 phase만 진행한다 | 이메일 검색·일정 충돌이라는 killer workflow가 문서에만 머문다 | naruon에서 thread/sender ontology → temporal commitment/conflict → human correction slice를 독립 PR로 delivery한다. 소유 저장소는 naruon이다 | | G-07 | multi-level/multi-membership/temporal 관계 원칙은 master context에 있으나 모든 소비 저장소의 schema/API가 동일한 reified relationship contract를 보장하는지는 미확인이다 | 개인 단위로 집계하거나 전역 권한을 적용하는 atomistic/ecological fallacy 위험이 남는다 | relationship, membership, norm_group, validity window, evidence, confidence, disclosure를 정규화하고 cross-context golden tests를 만든다 | @@ -91,20 +91,22 @@ flowchart LR ## 4. 열린 PR live inventory -아래는 GitHub PR list가 2026-08-24 01:57 KST에 반환한 99개 열린 PR의 number/title/head/base metadata다. CLEAN/BLOCKED/DIRTY/BEHIND/UNSTABLE은 GitHub metadata일 뿐 protected merge 승인이나 required Checks PASS를 뜻하지 않는다. 다음 루프에서 모든 행의 live review, thread, Checks를 다시 확인한다. +아래는 GitHub PR list가 2026-08-24 02:57 KST에 반환한 97개 열린 PR의 number/title/head/base metadata다. CLEAN/BLOCKED/DIRTY/BEHIND/UNSTABLE은 GitHub metadata일 뿐 protected merge 승인이나 required Checks PASS를 뜻하지 않는다. 다음 루프에서 모든 행의 live review, thread, Checks를 다시 확인한다. -스냅샷 요약: CLEAN [1252]; BLOCKED [1266, 1265, 1264, 1263, 1259, 1258, 1257, 1246, 1245, 1244, 1242, 1238, 1233, 1231, 1227, 1215, 1198, 1176, 1166, 1162, 1158, 1107, 1086, 1052, 941, 897, 790, 789]; UNSTABLE []; DIRTY 64; BEHIND 6; draft 14. +스냅샷 요약: CLEAN []; BLOCKED [1269, 1267, 1266, 1265, 1264, 1263, 1259, 1258, 1257, 1252, 1246, 1245, 1244, 1242, 1238, 1233, 1231, 1227, 1215, 1198, 1176, 1166, 1162, 1158, 1107, 1052, 941, 897, 821, 790, 789]; UNSTABLE []; DIRTY 60; BEHIND 6; draft 14. | PR | title | head SHA | base | metadata | mode | |---|---|---|---|---|---| -| #1266 | fix(scheduler): retry OpenCode after coverage blockers clear | `9f2ab9ae2f97be49fc4ab4dbcd13123057005b97` | main | BLOCKED | ready | +| #1269 | ⚡ Bolt: Combine provider token regexes for log redaction optimization | `fbca7adac3e899a7c5e496f677df35f368a86e07` | main | BLOCKED | ready | +| #1267 | feat(automation): repair Inkspan reviews hourly | `34efa03ecec7d815d8e6a4f7354767208fb1ce4a` | main | BLOCKED | ready | +| #1266 | fix(scheduler): retry OpenCode after coverage blockers clear | `855b1837cc0f277043f6e34509b09245a44a28b3` | main | BLOCKED | ready | | #1265 | test: provision pip in fresh uv environments | `73b674b31f80473d49c067ec339a9c561bbbb844` | main | BLOCKED | ready | | #1264 | perf(redaction): skip invalid key rescans without masking diagnostics | `cbc5852b25634cb333a32da1a89de9825cb24802` | main | BLOCKED | ready | -| #1263 | fix(strix): make Azure and cross-provider fallbacks executable | `de3abcd1206e97ce758742775823e0e94f317d82` | main | BLOCKED | ready | +| #1263 | fix(strix): make Azure and cross-provider fallbacks executable | `71afa06c116159f757092677fa605405097a9e05` | main | BLOCKED | ready | | #1259 | feat(automation): add a thin LineageWeave hourly review-repair caller | `6041f2aa9e23af5850cd83fa838a3eb6c45d84b9` | main | BLOCKED | ready | -| #1258 | fix(coverage): run pnpm 9 evidence without --trust-lockfile | `9b5dba9f558d20dbb651b409ea9fa54a865e3405` | main | BLOCKED | ready | +| #1258 | fix(coverage): run pnpm 9 evidence without --trust-lockfile | `897819c48279b0c0d5e2372eb39dce6120784685` | main | BLOCKED | ready | | #1257 | fix(osv): keep base scan results across fork checkout | `20d72bc838d7f91b74ce01bb4de16d07144fa270` | main | BLOCKED | ready | -| #1252 | docs: refresh live product and technical gap baseline | `81b7fa453cdfa27493380565f64817c71a6ba58f` | main | CLEAN | ready | +| #1252 | docs: refresh live product and technical gap baseline | `de2d5c3605df1c05eed3efd91a2512517bc1f7fe` | main | BLOCKED | ready | | #1246 | fix(opencode-review): accept int-typed run_id/run_attempt in control JSON | `f88499b708a90edb6a538aeb2c397e14304681ad` | main | BLOCKED | ready | | #1245 | fix(scheduler): retry and gracefully defer shared installation rate limits | `92624300414b19dbed0f96a0295b1ac516181b4b` | main | BLOCKED | ready | | #1244 | fix(e2e): restrict readiness polling to loopback destinations | `a0c82c87dfc01b49698fd84db378a71942714b57` | main | BLOCKED | ready | @@ -120,7 +122,7 @@ flowchart LR | #1176 | fix(governance): preserve proposal branch create transition | `49f6988795262194e4eda8b3ea7319b7b39c4e77` | main | BLOCKED | ready | | #1172 | fix(autofix): resolve live NVIDIA NIM models instead of a retired pin | `edab578feca63c223368aef17c175bb52ce22e5a` | main | DIRTY | ready | | #1170 | feat: route OpenCode reviews through contextual gateway | `cbf937bc7216bf34883032a040aa3850136b9e81` | main | DIRTY | ready | -| #1166 | fix(ci): recognize replacement tests in existing files | `2cdfbe3ba56ed8a63287e3a757fd858d9f8a72f4` | main | BLOCKED | ready | +| #1166 | fix(ci): recognize replacement tests in existing files | `7986334aacb2bc8e5d794d581202f47c91e4875e` | main | BLOCKED | ready | | #1162 | fix: use review credentials for agent dispatch | `4a7031d7adbba759742605deb1c78d10aef16e7d` | main | BLOCKED | ready | | #1161 | fix: make hourly coordinator credential absence auditable | `49bc5e4a59cd30550f87070b48b61e966ac480e1` | main | DIRTY | ready | | #1158 | fix(osv): preserve immutable direct-source provenance | `e61fb11fbd5c7464d34cc8bedc3a7177fbdcade2` | main | BLOCKED | ready | @@ -144,7 +146,6 @@ flowchart LR | #1092 | feat(automation): run psychometrics-commons hourly NVIDIA NIM review repair | `6c330dbfbede45acb41972f1d384ef586b83c2b8` | main | DIRTY | ready | | #1088 | feat(automation): run mightyETL hourly NVIDIA NIM review repair | `d955cb949329f3bc3726c440542f549fe2978209` | main | DIRTY | ready | | #1087 | feat(automation): run life-os hourly NVIDIA NIM review repair | `37377d0a19dfae9739ae2e0a845b8270303b38be` | main | DIRTY | ready | -| #1086 | feat(automation): repair the LineageWeave buyer-surface stack hourly | `aeb096a52c5f4c2647f05f54f0aa6b17200a350f` | main | BLOCKED | ready | | #1085 | feat(automation): run kaefa hourly NVIDIA NIM review repair | `3e6c94603a6332b066e0be962aab23991987e094` | main | DIRTY | ready | | #1083 | feat(automation): run pg-llm-batch hourly NVIDIA NIM review repair | `584141341346b7882fded053b459a7d4c16477a2` | main | DIRTY | ready | | #1082 | feat(automation): run semantic-data-portal hourly NVIDIA NIM review repair | `dbfdbbf3547b4c84bb5c2a1760ecfda080751546` | main | DIRTY | ready | @@ -189,20 +190,18 @@ flowchart LR | #899 | fix(scheduler): fail after summarized action errors | `56ffdd1cc1bc235a39b0373a58430fb8c7b00afb` | main | DIRTY | ready | | #897 | fix(security): fail closed on unavailable dependency review | `d9b395cd01999a6ec946d3c7a013f22225143782` | main | BLOCKED | ready | | #834 | fix(noema): replay OIDC envelope repair on current main | `7b64d26c157df3b0da13d8ed0e1cd8365ae47d1e` | main | DIRTY | ready | -| #831 | feat(opencode): add head-matched gold corpus tooling | `fec33cf22a3085e3261eb51a399ccbf7db722e4f` | main | DIRTY | ready | | #828 | fix(scheduler): require independent exact-head approval | `cbc5f91349fbf0083270caded8512f2022ca9abf` | main | BEHIND | ready | -| #821 | fix(ci): replace conflicted fatal OpenCode process-group prerequisite | `180bc31ae92595d46c8cbc0c4f629739f1e0354a` | main | DIRTY | ready | -| #807 | fix(coverage): validate nested npm metadata through canonical pins | `46cc52f7e05b559ce3442542b28fc133d9b2e2e4` | main | DIRTY | ready | -| #796 | feat(automation): run Inkspan hourly NVIDIA NIM review repair | `0254a9a2c32aa1f321b6dcfd071c53029dfe5fe0` | main | DIRTY | ready | +| #821 | fix(opencode): reap fatal provider process groups | `7c6070135c3a5797ab99ceb20d82462cbb28b73b` | main | BLOCKED | ready | | #790 | fix(coverage): retry transient trusted uv downloads | `05e284a17e7e692ad5e58dc39045ef42de84d9af` | main | BLOCKED | ready | | #789 | feat(coverage): add bounded PyO3 peer-evidence gate | `861478bb11ba89f71b97dbbdd874b3d872372125` | main | BLOCKED | ready | ### 4.1 Same-session open/close delta -- ContextualWisdomLab/.github#1252 is GitHub `CLEAN` on `81b7fa453cdfa27493380565f64817c71a6ba58f` with hosted Checks green and threads resolved, but latestOpinionatedReviews is empty (no current-head OpenCode APPROVE). CLEAN is not merge authorization. -- ContextualWisdomLab/.github#1263 required Strix on this head still fail-closes on 0-vuln `MODEL QUALITY WARNING` then `openai-direct/gpt-5.6-luna` `LLM Provider NOT provided`, because `pull_request_target` uses protected main's gate. Manual `repository_dispatch` Strix also ran against `main@885f2cd2` and is not merge evidence. -- ContextualWisdomLab/.github#1265 (`73b674b31f80473d49c067ec339a9c561bbbb844`) and #1266 (`9f2ab9ae2f97be49fc4ab4dbcd13123057005b97`) opened. #1264 head advanced to `cbc5852b25634cb333a32da1a89de9825cb24802`. #1237 and #1218 closed unmerged. -- Open count moved 103 → 99. No `.github` PR merged this pass. Main remains `885f2cd251999f21cf562cab3e2d9cc3cc3ec737`. +- ContextualWisdomLab/.github#1252 head advanced concurrently to `de2d5c3605df1c05eed3efd91a2512517bc1f7fe` then to the commit that lands this 97-row refresh. Hosted Checks were green on `de2d5c36` except cancelled `scan-pr-queue`; latestOpinionatedReviews remain empty. CLEAN/BLOCKED is not merge authorization. +- ContextualWisdomLab/.github#1263 head advanced to `71afa06c116159f757092677fa605405097a9e05` (trusted-lock install + retrigger). Required Strix still uses protected main. +- ContextualWisdomLab/.github#1265 remains `73b674b31f80473d49c067ec339a9c561bbbb844` with Strix PASS and no current-head OpenCode APPROVE. +- ContextualWisdomLab/.github#1267 (Inkspan hourly caller) and #1269 (Bolt redaction regex) opened. #1268 closed unmerged. #1266 head `855b1837cc0f277043f6e34509b09245a44a28b3`. +- Open count moved 99 → 97. No `.github` PR merged this pass. Main remains `885f2cd251999f21cf562cab3e2d9cc3cc3ec737`. ## 5. 실행 루프와 고객의 다음 행동 @@ -223,10 +222,10 @@ flowchart LR ### 5.1 이번 루프의 다음 개발 increment -1. ContextualWisdomLab/.github#1263 — G-03. Required Strix는 보호 main 게이트라 self-green이 아니다. OpenCode가 이 한계를 인정한 current-head 승인과, Strix 외 required Checks green일 때만 병합을 재평가한다. 닫힌 #1213/#1262를 되살리지 않는다. -2. ContextualWisdomLab/.github#1252 — GitHub CLEAN이지만 current-head OpenCode APPROVE가 없다. 승인 후 `--match-head-commit` 병합. -3. ContextualWisdomLab/.github#1265 — pip pin in fresh uv env. Strix already PASS. current-head OpenCode 승인 후 병합. -4. ContextualWisdomLab/.github#1162/#1227/#1257 — Strix 0-vuln MODEL QUALITY CR은 G-03이지 해당 PR 코드 결함이 아니다. #1263 병합 전에 코드로 고치지 않는다. +1. ContextualWisdomLab/.github#1265 — Strix PASS, mechanical Checks green aside from cancelled `scan-pr-queue`. Independent current-head OpenCode APPROVE 후 `--match-head-commit`. +2. ContextualWisdomLab/.github#1252 — 이 베이스라인. current-head OpenCode APPROVE 없이 병합하지 않는다. +3. ContextualWisdomLab/.github#1263 — G-03. Required Strix는 보호 main 게이트라 self-green이 아니다. 닫힌 #1213/#1262를 되살리지 않는다. +4. ContextualWisdomLab/.github#1259/#1227/#1257 OpenCode CR은 Strix G-03이지 해당 PR 코드 결함이 아니다. 5. G-06는 naruon 소유. 큐가 비면 ContextualWisdomLab/naruon#976부터 한 phase씩 구현한다.