docs: refresh live product and technical gap baseline

AGENTS.md

@@ -1,7 +1,7 @@
 # AGENTS.md — ContextualWisdomLab .github
 
 <!-- CWL-ENTRY -->
-> **Agents: read the master context FIRST.** Before any work, read [`docs/CWL-MASTER-CONTEXT.md`](docs/CWL-MASTER-CONTEXT.md) (mission · naruon-as-platform + inter-component UML · cross-cutting disciplines · conventions · roadmap · current state), the live **GitHub Project #1** <https://github.com/orgs/ContextualWisdomLab/projects/1> (work/roadmap source of truth), the full spec **ContextualWisdomLab/naruon#974**, and operate the Project per [`docs/agent-github-project-protocol.md`](docs/agent-github-project-protocol.md). The repo/Project — not any private agent memory — is the source of truth.
+> **Agents: read the master context FIRST.** Before any work, read [`docs/CWL-MASTER-CONTEXT.md`](docs/CWL-MASTER-CONTEXT.md) (mission · naruon-as-platform + inter-component UML · cross-cutting disciplines · conventions · roadmap · current state), the live **GitHub Project #1** <https://github.com/orgs/ContextualWisdomLab/projects/1> (work/roadmap source of truth), the full spec **ContextualWisdomLab/naruon#974**, the live gap snapshot [`docs/product-technical-gap-baseline.md`](docs/product-technical-gap-baseline.md) (not merge authorization; Figma File ID for this repo is N/A per [`docs/adr/0002-product-technical-gap-baseline.md`](docs/adr/0002-product-technical-gap-baseline.md)), and operate the Project per [`docs/agent-github-project-protocol.md`](docs/agent-github-project-protocol.md). The repo/Project — not any private agent memory — is the source of truth.
 
 Materialize accepts only exact SHA-256 pins, a bounded relative `-r` include
 (no `.`/`..`), or an organization-owned HTTPS Git source pinned to a full

ARCHITECTURE.md

@@ -3,26 +3,28 @@
 This repository is the organization control plane. It is not naruon and it
 does not own product data. Sibling products remain standalone modules; this
 repo publishes org profile assets, reusable required workflows, and the
-review/merge schedulers those products consume.
+review/merge schedulers those products consume. The live gap snapshot is
+[`docs/product-technical-gap-baseline.md`](docs/product-technical-gap-baseline.md);
+it is not merge authorization. Figma File ID is N/A (no customer UI here).
 
 ## System context
 
 ```mermaid
 flowchart LR
-  Buyer["Commercial buyer / reviewer"]
+  Operator["Operator / reviewer"]
   Agents["Agents on AGENTS.md"]
   Project["GitHub Project #1"]
   Hub["This repo: org .github"]
   Products["Owned products<br/>naruon · orchestrator · engines"]
   Runner["Required workflows in each repo context"]
 
-  Buyer --> Hub
+  Operator --> Hub
   Agents --> Project
   Agents --> Hub
   Project --> Hub
   Hub --> Runner
   Runner --> Products
-  Products -->|"standalone or as module"| Buyer
+  Products -->|"standalone or as module"| Operator
 ```
 
 ## OriginWeave hourly caller

CHANGELOG.md

@@ -19,6 +19,11 @@ Semantic Versioning where the repository publishes a release.
 
 ### Added
 
+- Refresh the live product and technical gap baseline against the current
+  open-PR queue, with SHA-bound snapshot rows, a same-session open/close
+  delta section, ADR Figma File ID N/A, and APA 7th doctoring. The inventory
+  is not merge authorization.
+
 - Classify Strix `ModelBehaviorError` and provider exhaustion as typed
   `STRIX_PROVIDER_UNAVAILABLE` evidence while preserving a nonzero required
   check. Incomplete scans and reported vulnerabilities both fail closed.

CLAUDE.md

@@ -8,7 +8,9 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 [`docs/CWL-MASTER-CONTEXT.md`](docs/CWL-MASTER-CONTEXT.md) (mission, ecosystem UML, cross-cutting
 disciplines CP-1..CP-5/G6/SEAM, binding engineering conventions in §7, roadmap), the live
 [GitHub Project #1](https://github.com/orgs/ContextualWisdomLab/projects/1) (work/roadmap source of
-truth), and operate the Project per [`docs/agent-github-project-protocol.md`](docs/agent-github-project-protocol.md).
+truth), the live gap snapshot [`docs/product-technical-gap-baseline.md`](docs/product-technical-gap-baseline.md)
+(not merge authorization; Figma File ID for this repo is N/A), and operate the Project per
+[`docs/agent-github-project-protocol.md`](docs/agent-github-project-protocol.md).
 The repo/Project — not private agent memory — is the source of truth. This file complements those
 documents; it does not replace them.
 

docs/CWL-MASTER-CONTEXT.md

@@ -124,11 +124,12 @@ A **source-agnostic artifact-analysis service**: `submit(artifact, context) →
 ## 9. How work is tracked (dogfood the traceability)
 GitHub **Project #1** is the shared source of truth. Structure: real **Issues** (roadmap/backlog, in owning repos, custom fields Phase P0–P5/Ops/Decision + Component) and real **PRs** (delivered work, native Repository). Native workflows are ON (item added→Todo, PR merged→Done, item closed→Done). Chain: roadmap **Issue** → agent sets In Progress on pickup → implementing **PR** `Closes #N` → merge → auto Done. Operate the Project per `docs/agent-github-project-protocol.md`. Group by Phase / Component / Repository.
 
-## 10. Current state (2026-07-08)
-- Renames done (keyverse/wardnet/inkspan). Planning spec = naruon#974. Project #1 populated (68 issues + 60 PRs). Protocol = .github#363.
-- **BLOCKER B1**: org GitHub Actions effectively HALTED (~86 queued, ~0 in_progress org-wide) — likely the Actions monthly SPENDING CAP. Blocks ALL PR checks/merges + the Cloudflare DNS run (nameservers). Fix (org-admin): raise the Actions spending limit OR add a self-hosted runner. Nothing merges until then.
+## 10. Current state (2026-08-23)
+- Live product/technical gap snapshot: [`docs/product-technical-gap-baseline.md`](product-technical-gap-baseline.md) (SHA-bound open-PR inventory; not merge authorization). Figma File ID for this control-plane repo is N/A (`docs/adr/0002-product-technical-gap-baseline.md`).
+- Renames done (keyverse/wardnet/inkspan). Planning spec = ContextualWisdomLab/naruon#974. Protocol = ContextualWisdomLab/.github#363. Project #1 remains the live tracker; naruon Phase 0 issue ContextualWisdomLab/naruon#975 is Done (closed completed 2026-07-13). Next ordered phase is ContextualWisdomLab/naruon#976 (P1 Plugin SDK); execute one phase at a time.
+- GitHub Actions hosted Checks are running on current ContextualWisdomLab/.github PRs. Remaining merge blockers are missing current-head OpenCode approvals, Strix provider fail-closed, unresolved threads, and DIRTY/CONFLICTING stacks — not a total runner outage. Do not treat the earlier spending-cap halt as live unless Project #1 still shows it.
 - **Decisions pending**: (D1) Code Security enablement vs the CodeQL-only code_scanning ruleset (osv/trivy/scorecard SARIF upload) — a private repo needs GHAS seats; reconcile or make those checks non-required. (D2) trivy `limit-severities-for-sarif: true` (gate only CRITICAL/HIGH) — held pending the user's strict-security preference.
-- **Built this session, PR-open, awaiting merge (B1)**: see Project #1 PRs (contextual-orchestrator cost/routing #46 + naruon#973; pg-llm-batch; keyverse Keycloak; inkspan; SBOM #361; opencode auto-retry #360; Strix neutral #349 + emit #358; appguardrail collector #254; auto-rebase #357; noema #359/naruon#970; PDF-DOM naruon#965/newsdom#300; SDP #11; fast-mlsirm GPGPU #109; scopeweave #284/naruon#971; fuzzing 10 PRs (found+fixed 2 real naruon bugs); Cloudflare DNS/Pages #362; this protocol #363; planning #974). Human step: report the mapasevo21 malware file (github user-attachments) to GitHub Abuse; rotate the xtrmLLMBatchPython-leaked keys; the org-admin runner/decisions above.
+- Historical July 2026 delivery that is already merged lives on Project #1 as Done (ContextualWisdomLab/.github#363/#362/#361, ContextualWisdomLab/naruon#974/#973/#965, and sibling fuzz/SBOM PRs). Human leftovers remain: report the mapasevo21 malware file (github user-attachments) to GitHub Abuse; rotate the xtrmLLMBatchPython-leaked keys; D1/D2 above.
 
 ---
 *Keep this current. Update Project #1 as the live tracker; this file is the narrative brief a fresh agent reads to reconstruct the whole picture.*

docs/adr/0002-product-technical-gap-baseline.md

@@ -0,0 +1,9 @@
+# ADR-0002: Product and technical gap baseline
+
+- Status: accepted
+- Date: 2026-08-23
+- Scope: ContextualWisdomLab/.github control plane
+- Decision: Keep the buyer-facing product gap register and live PR metadata inventory in the baseline. Revalidate exact SHAs, reviews, threads, Checks, and rulesets before every merge.
+- Ownership: .github owns control-plane evidence; naruon and product repositories own product behavior and consumer smoke.
+- Figma File ID: N/A. This repository has no customer UI. A UI-owning repository must replace N/A with its real Figma File ID before a UI PR is accepted and must provide Storybook and design-token evidence.
+- Consequence: The document is an operational snapshot, not a merge authorization or substitute for protected GitHub review. Hourly agents must re-collect exact head SHAs, reviews, threads, and required Checks before merge. Papers/standards live in `docs/doctoring/product-technical-gap-baseline.md` and must remain consistent with this ADR.

docs/doctoring/product-technical-gap-baseline.md

@@ -0,0 +1,78 @@
+# Product and technical gap baseline — doctoring
+
+Status: accepted. Scope: ContextualWisdomLab/.github control plane.
+Companion ADR: [`docs/adr/0002-product-technical-gap-baseline.md`](../adr/0002-product-technical-gap-baseline.md).
+Live snapshot: [`docs/product-technical-gap-baseline.md`](../product-technical-gap-baseline.md).
+
+## Decision
+
+Keep a SHA-bound open-PR inventory and a 구매자-체감 Gap register in-repo so
+hourly agents refresh current heads instead of private memory. The inventory is
+an operational snapshot. It is not merge authorization, not a substitute for
+current-head OpenCode/Noema approval, and not a reason to skip required Checks.
+
+Figma File ID: N/A. This repository has no customer UI. A UI-owning repository
+must record its real Figma File ID in its own ADR before a UI PR is accepted
+and must provide Storybook scene/edge-case events plus design-token evidence.
+
+PII masking is not the privacy strategy. Use purpose-bound access lease,
+field-level encryption or tokenization, consented minimal-disclosure
+consequence, audit, and revocation (CSAP / SOC 2 / ISO 27001 alignment).
+
+`COPILOT_GITHUB_TOKEN` is unused. Review-agent credentials stay independent of
+repair/orchestrator credentials.
+
+## Exact-head papers and standards (APA 7th)
+
+These sources bind the Gap register and AI-plane TRD. They must not contradict
+the protected `main` control-plane contracts.
+
+American Institute of Certified Public Accountants. (2017). *2017 trust
+services criteria for security, availability, processing integrity,
+confidentiality, and privacy*. AICPA.
+
+International Organization for Standardization. (2022). *ISO/IEC 27001:2022
+information security, cybersecurity and privacy protection—Information
+security management systems—Requirements*. ISO.
+
+International Organization for Standardization. (2023). *ISO/IEC 42001:2023
+information technology—Artificial intelligence—Management system*. ISO.
+
+National Institute of Standards and Technology. (2023). *Artificial
+intelligence risk management framework (AI RMF 1.0)* (NIST AI 100-1). U.S.
+Department of Commerce. https://doi.org/10.6028/NIST.AI.100-1
+
+World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines
+(WCAG) 2.2*. https://www.w3.org/TR/WCAG22/
+
+Lewis, P., Perez, E., Piktus, A., Petroni, F., Karpukhin, V., Goyal, N.,
+Küttler, H., Lewis, M., Yih, W.-t., Rocktäschel, T., Riedel, S., & Kiela, D.
+(2020). Retrieval-augmented generation for knowledge-intensive NLP tasks.
+*Advances in Neural Information Processing Systems, 33*, 9459–9474.
+
+Tang, Y., Cetin, E., Xu, J., Sun, Q., Nielsen, S., Richard, V., Goda, H.,
+Tymchenko, I., Nguyen, N., Lee, H., Ashiga, M., Kotyan, S., Kuroki, S., &
+Clanuwat, T. (2026). *Sakana Fugu technical report* [Technical report]. arXiv.
+https://doi.org/10.48550/arXiv.2606.21228
+
+Zhang, S., Yu, Y., Li, Y., Zhao, W., Yang, Y., Zhang, Y., & Liu, T. (2025).
+*Conductor: Learning to route multi-agent workflows* [Preprint]. arXiv.
+https://doi.org/10.48550/arXiv.2512.04388
+
+Xu, J., Sun, Q., Schwendeman, P., Nielsen, S., Cetin, E., & Tang, Y. (2026).
+*TRINITY: An evolved LLM coordinator* [Preprint]. arXiv.
+https://doi.org/10.48550/arXiv.2512.04695
+
+Higgins, S. S., Crepalde, N., & Fernandes, L. (2021). Segmented multiplexity:
+A research agenda for multiplexity beyond the average. *PLOS ONE, 16*(9),
+e0257527. https://doi.org/10.1371/journal.pone.0257527
+
+Local Zotero was not reachable from this session. Citations use the OA/DOI
+records above; add the PDFs to the local Zotero library when the API is up.
+
+## Next action
+
+Refresh [`docs/product-technical-gap-baseline.md`](../product-technical-gap-baseline.md)
+from live `gh pr list` before acting on any row. Then: 리뷰 확인 → 수정 →
+Checks 재검증 → 병합 → 다음 개발. Wait for OpenCode/Strix/Noema without
+stopping other PRs or Gap work.