From 6f23f0debcdacb24c93acd20dd2bb018f81302f8 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 19:25:06 +0900 Subject: [PATCH 001/109] docs: bind product gaps to current evidence --- docs/product-technical-gap-baseline.md | 57 ++++++++++++++++++++++---- 1 file changed, 50 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index e65883463..0cc339349 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,19 +1,19 @@ # Product & Technical Gap Baseline ## 1. Known Parsing & Frontend Display Gaps -- **Footnote Parsing**: `post=00505695-3e61-1fd1-83c5-263f88a9e77a` fails to recognize footnotes (li/oi level errors). -- **Table Parsing**: `post=00505695-3e61-1fd1-80c6-86bb61c8ddc5` completely fails at parsing tables. +- **Footnote Parsing**: `post=00505695-3e61-1fd1-83c5-263f88a9e77a` fails to recognize footnotes (li/oi level errors). Partial parser coverage is in LineageWeave PR #367; production/browser evidence is still pending. +- **Table Parsing**: `post=00505695-3e61-1fd1-80c6-86bb61c8ddc5` completely fails at parsing tables. PR #367 covers malformed HTML row boundaries and empty cells; image tables and browser rendering remain open. - **Indentation**: Incorrect indentation rendering in `post=00505695-7571-1fd1-83c3-d521b187ad5b` and `post=00505695-3e61-1fd1-83c0-497b3c1c455e`. - **Image/Table OCR**: `post=00505695-7571-1fd1-83dd-3d22a61a5734` fails text recognition for tables inside images, markdown parsing fails, and image OCR description is too shallow for Ontology & Semantics. -- **Math/Superscripts**: `post=00505695-9612-1fe1-83a7-e30153323f25` fails to parse superscripts like m^3 properly. Needs strict Ontology grammar for math formulas. +- **Math/Superscripts**: `post=00505695-9612-1fe1-83a7-e30153323f25` fails to parse superscripts like m^3 properly. The semantic normalization path merged through PR #344, but the named real-post browser evidence and strict Ontology grammar still require verification. - **Missing UI Elements**: DAG (Directed Acyclic Graph) view is currently missing from the frontend for `post=00505695-7571-1fd1-83c5-895ed333cdbc`. ## 2. LLM Extraction & Knowledge Graph Gaps -- **Multiple Project Extraction**: (Resolved) LLM prompt updated to request key_events as objects with project_name, separating events correctly. -- **5W1H Missing**: (Resolved) LLM prompt updated to explicitly request 5W1H evidence items in the JSON output array. -- **R&R and Keyman Missing**: (Resolved) LLM prompt updated to explicitly instruct using actual stated names rather than collective titles. +- **Multiple Project Extraction**: A structured `key_events.project_name` implementation exists, but separate-event behavior still requires real-post runtime evidence. +- **5W1H Missing**: A structured 5W1H evidence-item implementation exists, but completeness and provenance still require real-post runtime evidence. +- **R&R and Keyman Missing**: Prompt and persistence paths exist, but actual-side/other-side affiliation, requester, assignee, and provenance still require real-post runtime evidence. - **Entity Resolution / Searxng**: Abbreviations like "한전" and "한국전력" are not mapped properly using Searxng and KG corroboration. -- **Meso-level Team Mapping**: (Resolved) Checked extraction logic; `team` mapping logic is present and correct, but LLM needed better explicit instruction which is covered by R&R resolution. +- **Meso-level Team Mapping**: `team` mapping logic is present; affiliation and same-entity resolution still require ontology-backed runtime evidence rather than prompt-only confirmation. - **Base64 Image Omni-modal**: Current text-only embedding fails on images. Omni-modal LLM processing is required for images to capture layout, font size, colors, and spatial meaning. ## 3. General Architecture Gaps @@ -24,3 +24,46 @@ - **LLM Orchestration**: Ensure ALL LLM calls route through `contextual-orchestrator` utilizing API keys (BYTEZ, NVIDIA, OPENROUTER, OPENAI) with auto model discovery and optimal reasoning effort allocation (Fugu/Conductor/TRINITY research). *This document is continuously updated by the hourly automated agent loop.* + +## 4. Current Checkpoint Evidence + +The following states are evidence-bound and must not be changed to `merged` or +`resolved` from intent alone: + +- LineageWeave PR #344: semantic metric normalization merged at `497ac120`; the + frontend and backend focused tests passed before merge. The named real-post + browser result remains an explicit follow-up. +- LineageWeave PR #367: exact head `09500b59`; focused local tests passed (104), + while required GitHub Checks were queued and formal approval was absent at + the checkpoint. +- LineageWeave PR #366: exact head `aef31c3c`; the customer-master authorization + fix derives downstream Keyman and relationship scopes from surviving entity + rows, not observed navigation-only entities. Required Checks and approval + remain external gates. +- LineageWeave PR #345: application and Valkey caller OpenTelemetry spans are + merged. Raw telemetry remains outside the buyer evidence payload. +- contextual-orchestrator PR #802: exact head `b2fe47e`; request session context + is propagated through local batch workers. No formal approval is recorded. +- contextual-orchestrator PR #805: structured Responses and JSON-schema + orchestration remains a separate open merge prerequisite. + +## 5. Organization OpenTelemetry Evidence Boundary + +GRC PR #42 records organization-level OTEL acceptance evidence through the +existing purpose-bound evidence contract. It does not become a raw span store +and must not copy prompts, post bodies, images, provider responses, secrets, or +an ad-hoc `user_account + post_id` session key. W3C trace context and bounded +OpenTelemetry attributes correlate the authorized operation across services; +collector delivery, retention, access review, and no-export rollback are the +GRC evidence subjects. + +## 6. Next Implementation Order + +1. Complete PR #367's protected Checks and verify the named footnote/table + posts in the authenticated browser. +2. Resolve image DOM-region recognition, OCR, semantic table rendering, and + buyer-facing caption separation through contextual-orchestrator VISION. +3. Verify 5W1H, multi-project event separation, Keyman affiliation, and + customer-master ABAC against authorized real PostgreSQL data. +4. Keep the GRC and contextual-orchestrator OTEL evidence contracts aligned + with the exact merged application instrumentation. From f45fcdebfd54bf236b55f5d892aeb6091b51ba5b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 20:18:25 +0900 Subject: [PATCH 002/109] docs: bind checkpoints to protected evidence --- docs/product-technical-gap-baseline.md | 76 ++++++++++++++++---------- 1 file changed, 48 insertions(+), 28 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 0cc339349..37dc22bf0 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,17 +1,22 @@ # Product & Technical Gap Baseline +> Repository artifacts contain synthetic fixtures and derived, non-identifying +> evidence only. Real PostgreSQL rows, source payloads, images, names, and +> identifiers remain in a protected external runtime and are never copied into +> this repository, screenshots, tests, logs, or buyer evidence. + ## 1. Known Parsing & Frontend Display Gaps -- **Footnote Parsing**: `post=00505695-3e61-1fd1-83c5-263f88a9e77a` fails to recognize footnotes (li/oi level errors). Partial parser coverage is in LineageWeave PR #367; production/browser evidence is still pending. -- **Table Parsing**: `post=00505695-3e61-1fd1-80c6-86bb61c8ddc5` completely fails at parsing tables. PR #367 covers malformed HTML row boundaries and empty cells; image tables and browser rendering remain open. -- **Indentation**: Incorrect indentation rendering in `post=00505695-7571-1fd1-83c3-d521b187ad5b` and `post=00505695-3e61-1fd1-83c0-497b3c1c455e`. -- **Image/Table OCR**: `post=00505695-7571-1fd1-83dd-3d22a61a5734` fails text recognition for tables inside images, markdown parsing fails, and image OCR description is too shallow for Ontology & Semantics. -- **Math/Superscripts**: `post=00505695-9612-1fe1-83a7-e30153323f25` fails to parse superscripts like m^3 properly. The semantic normalization path merged through PR #344, but the named real-post browser evidence and strict Ontology grammar still require verification. -- **Missing UI Elements**: DAG (Directed Acyclic Graph) view is currently missing from the frontend for `post=00505695-7571-1fd1-83c5-895ed333cdbc`. +- **Footnote Parsing**: synthetic case `case-footnote-01` exercises numbered footnote recognition; PR #367 adds parser coverage, while authorized production/browser evidence remains pending. +- **Table Parsing**: synthetic case `case-table-01` exercises malformed row boundaries and empty cells; image tables and browser rendering remain open. +- **Indentation**: synthetic cases `case-indent-01` and `case-indent-02` retain incorrect indentation rendering coverage gaps. +- **Image/Table OCR**: synthetic case `case-image-table-01` still needs region-aware table OCR, markdown rendering, and sufficiently detailed buyer-safe image evidence. +- **Math/Superscripts**: synthetic case `case-math-01` covers bounded metric normalization such as m³; arbitrary formula semantics and authorized runtime verification remain open after PR #344. +- **Missing UI Elements**: synthetic case `case-dag-01` tracks the Event Lineage DAG surface; current source includes the DAG, but corpus coverage and browser evidence remain open. ## 2. LLM Extraction & Knowledge Graph Gaps -- **Multiple Project Extraction**: A structured `key_events.project_name` implementation exists, but separate-event behavior still requires real-post runtime evidence. -- **5W1H Missing**: A structured 5W1H evidence-item implementation exists, but completeness and provenance still require real-post runtime evidence. -- **R&R and Keyman Missing**: Prompt and persistence paths exist, but actual-side/other-side affiliation, requester, assignee, and provenance still require real-post runtime evidence. +- **Multiple Project Extraction**: A structured `key_events.project_name` implementation exists, but separate-event behavior still requires protected authorized-corpus evidence. +- **5W1H Missing**: A structured 5W1H evidence-item implementation exists, but completeness and provenance still require protected authorized-corpus evidence. +- **R&R and Keyman Missing**: Prompt and persistence paths exist, but actual-side/other-side affiliation, requester, assignee, and provenance still require protected authorized-corpus evidence. - **Entity Resolution / Searxng**: Abbreviations like "한전" and "한국전력" are not mapped properly using Searxng and KG corroboration. - **Meso-level Team Mapping**: `team` mapping logic is present; affiliation and same-entity resolution still require ontology-backed runtime evidence rather than prompt-only confirmation. - **Base64 Image Omni-modal**: Current text-only embedding fails on images. Omni-modal LLM processing is required for images to capture layout, font size, colors, and spatial meaning. @@ -30,22 +35,34 @@ The following states are evidence-bound and must not be changed to `merged` or `resolved` from intent alone: -- LineageWeave PR #344: semantic metric normalization merged at `497ac120`; the - frontend and backend focused tests passed before merge. The named real-post - browser result remains an explicit follow-up. -- LineageWeave PR #367: exact head `09500b59`; focused local tests passed (104), - while required GitHub Checks were queued and formal approval was absent at - the checkpoint. -- LineageWeave PR #366: exact head `aef31c3c`; the customer-master authorization - fix derives downstream Keyman and relationship scopes from surviving entity - rows, not observed navigation-only entities. Required Checks and approval - remain external gates. -- LineageWeave PR #345: application and Valkey caller OpenTelemetry spans are - merged. Raw telemetry remains outside the buyer evidence payload. -- contextual-orchestrator PR #802: exact head `b2fe47e`; request session context - is propagated through local batch workers. No formal approval is recorded. -- contextual-orchestrator PR #805: structured Responses and JSON-schema - orchestration remains a separate open merge prerequisite. +Observed at `2026-08-21T11:16:36Z` from the GitHub API. A merged commit is +identified as `merge_commit`; an open PR is identified by its exact `head`. + +- LineageWeave PR #344: `merge_commit` + `497ac120c2ea22f97ef2e4a4bcd15fc2a3610046`, merged at + `2026-08-21T10:23:02Z`; focused tests passed before merge, while the + authorized-runtime browser result remains open. +- LineageWeave PR #367: `head` + `5194d267b90430d7a27a9752a49d73617cb5756c`, base + `f66991699506ef14607de5946da1efcfd20ae6da`; focused parser tests passed, + while required Checks and independent approval remain external gates. +- LineageWeave PR #366: `head` + `696f8d46372ef6f5af9eb1b2dbc30fff4e9c9f6c`, base + `8bed77e7e7b91b633bb92d3a82d0187c387206af`; customer-master authorization + scope is implemented, while required Checks and independent approval remain + external gates. +- LineageWeave PR #345: `merge_commit` + `9316d281ae396cc1bc33ac3ba470a9e3afd41a90`, merged at + `2026-08-21T09:08:31Z`; application and Valkey caller OpenTelemetry spans + are merged, while raw telemetry remains outside buyer evidence. +- contextual-orchestrator PR #802: `head` + `b2fe47e78ade89b13aa4c239c71562c65af5f12e`, base + `f1b0cd48271e870571b022463e1ec2c857ae4a8a`; request session context is + propagated through local batch workers and approval is not recorded. +- contextual-orchestrator PR #805: `head` + `1d11e7d40dc52121d440991969be2967adf2136e`, base + `f1b0cd48271e870571b022463e1ec2c857ae4a8a`; structured Responses and + JSON-schema orchestration remain a separate open merge prerequisite. ## 5. Organization OpenTelemetry Evidence Boundary @@ -59,11 +76,14 @@ GRC evidence subjects. ## 6. Next Implementation Order -1. Complete PR #367's protected Checks and verify the named footnote/table - posts in the authenticated browser. +1. Complete PR #367's protected Checks and verify the synthetic footnote/table + cases in the authenticated browser; use the protected external corpus only + for aggregate, non-identifying runtime evidence. 2. Resolve image DOM-region recognition, OCR, semantic table rendering, and buyer-facing caption separation through contextual-orchestrator VISION. 3. Verify 5W1H, multi-project event separation, Keyman affiliation, and - customer-master ABAC against authorized real PostgreSQL data. + customer-master ABAC against authorized real PostgreSQL data in the protected + external runtime, returning only aggregate or derived non-identifying + evidence to repository artifacts. 4. Keep the GRC and contextual-orchestrator OTEL evidence contracts aligned with the exact merged application instrumentation. From af3ecead7231f1d6e795e3ff6bc5d0f0cff1709c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 21:43:46 +0900 Subject: [PATCH 003/109] docs: refresh exact open PR evidence --- docs/product-technical-gap-baseline.md | 55 +++++++++++++++++++++----- 1 file changed, 46 insertions(+), 9 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 37dc22bf0..81c35a94d 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -6,7 +6,7 @@ > this repository, screenshots, tests, logs, or buyer evidence. ## 1. Known Parsing & Frontend Display Gaps -- **Footnote Parsing**: synthetic case `case-footnote-01` exercises numbered footnote recognition; PR #367 adds parser coverage, while authorized production/browser evidence remains pending. +- **Footnote Parsing**: synthetic case `case-footnote-01` exercises numbered footnote recognition; PR #367 merged the parser coverage, while authorized production/browser evidence remains pending. - **Table Parsing**: synthetic case `case-table-01` exercises malformed row boundaries and empty cells; image tables and browser rendering remain open. - **Indentation**: synthetic cases `case-indent-01` and `case-indent-02` retain incorrect indentation rendering coverage gaps. - **Image/Table OCR**: synthetic case `case-image-table-01` still needs region-aware table OCR, markdown rendering, and sufficiently detailed buyer-safe image evidence. @@ -35,22 +35,57 @@ The following states are evidence-bound and must not be changed to `merged` or `resolved` from intent alone: -Observed at `2026-08-21T11:16:36Z` from the GitHub API. A merged commit is +Observed at `2026-08-21T12:42:34Z` from the GitHub API. A merged commit is identified as `merge_commit`; an open PR is identified by its exact `head`. - LineageWeave PR #344: `merge_commit` `497ac120c2ea22f97ef2e4a4bcd15fc2a3610046`, merged at `2026-08-21T10:23:02Z`; focused tests passed before merge, while the authorized-runtime browser result remains open. -- LineageWeave PR #367: `head` - `5194d267b90430d7a27a9752a49d73617cb5756c`, base - `f66991699506ef14607de5946da1efcfd20ae6da`; focused parser tests passed, - while required Checks and independent approval remain external gates. +- LineageWeave PR #367: `merge_commit` + `7a0d025215fbd9f6510727c7139885b561296149`, merged at + `2026-08-21T11:56:07Z`; focused parser tests passed before merge, while + authorized production/browser evidence remains open. +- LineageWeave PR #349: `head` + `539b65287da5ac4635f6965c6dc21d7437dede9c`, base `main`; ontology + provenance explorer remains open and required Checks and independent + approval remain external gates. +- LineageWeave PR #368: `head` + `f45fcdebfd54bf236b55f5d892aeb6091b51ba5b`, base `main`; this baseline + checkpoint is updated by the stacked documentation PR for the newer queue + evidence below. - LineageWeave PR #366: `head` - `696f8d46372ef6f5af9eb1b2dbc30fff4e9c9f6c`, base + `588dc91f5689d77281cd6bbd10a8e922f9eaa159`, base `8bed77e7e7b91b633bb92d3a82d0187c387206af`; customer-master authorization scope is implemented, while required Checks and independent approval remain external gates. +- LineageWeave PR #369: `head` + `eb9e520cbac412b7f85f8ceddd86624515bb29cb`, base + `e88f3862215e76d0702204f29aba75ddc902d19f`; ontology source-window + continuation is open and required Checks and independent approval remain + external gates. +- LineageWeave PR #370: `head` + `74b92eb95360b14c7e4f2bc2679f580f4ce249f8`, base + `8bed77e7e7b91b633bb92d3a82d0187c387206af`; its runtime boundary fixes are + stacked in PR #376. +- LineageWeave PR #374: `head` + `f6ce19f8e10aa7ec2b0a95f3adbbea816bd39594`, base + `0a5a5799b444c44dc2952edc7227b1b96b97457e`; its post-chat atomic + reauthorization fix is stacked in PR #377. +- LineageWeave PR #376: `head` + `21880e937eedff6c314cb7af3d99ddca2792597f`, base `docs/customer-master-scope-adr`; + migration, relation-boundary, image-job transaction, and overflow-test fixes + are locally verified; required Checks and independent approval remain + external gates. +- LineageWeave PR #377: `head` + `16ab01a9ab7d88487a3c984e192709857f6cfd1c`, base + `repair/global-ask-atomic-rollback-v2203`; post-chat rollback and test + cleanup are locally verified; required Checks and independent approval + remain external gates. +- LineageWeave PR #371: `closed_without_merge` + head `4c3e43f9e96ecc2d868657dd9b0ce5524a15c76c`, closed at + `2026-08-21T11:59:57Z`; no merge commit exists, so ontology publication is + not claimed as delivered by this checkpoint. - LineageWeave PR #345: `merge_commit` `9316d281ae396cc1bc33ac3ba470a9e3afd41a90`, merged at `2026-08-21T09:08:31Z`; application and Valkey caller OpenTelemetry spans @@ -76,8 +111,10 @@ GRC evidence subjects. ## 6. Next Implementation Order -1. Complete PR #367's protected Checks and verify the synthetic footnote/table - cases in the authenticated browser; use the protected external corpus only +1. Let the protected Checks and independent approvals complete for stacked PRs + #376 and #377, then revalidate their parent PRs #370 and #374 at the exact + current head; PR #367 is already merged. Verify the synthetic footnote/table + cases in the authenticated browser and use the protected external corpus only for aggregate, non-identifying runtime evidence. 2. Resolve image DOM-region recognition, OCR, semantic table rendering, and buyer-facing caption separation through contextual-orchestrator VISION. From 505302847b1a257d1464460d3c72bf11344e48ae Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 22:06:44 +0900 Subject: [PATCH 004/109] docs: record buyer-surface verification evidence --- docs/product-technical-gap-baseline.md | 30 ++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 81c35a94d..9859aa070 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -99,7 +99,33 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. `f1b0cd48271e870571b022463e1ec2c857ae4a8a`; structured Responses and JSON-schema orchestration remain a separate open merge prerequisite. -## 5. Organization OpenTelemetry Evidence Boundary +## 5. Local Buyer-Surface Verification + +Observed at `2026-08-21T13:06:25Z` in the authorized local stack using a +synthetic browser account and aggregate-only evidence: + +- The first authenticated board load exposed a migration drift: `/api/posts` + returned a server error because the runtime lacked the event evidence + column expected by the current backend. Rebuilding and running the current + migration image applied the pending migrations through `0114`; the same + board then returned HTTP 200 for settings, current-user, lineage, and post + list requests. +- The authenticated browser loaded 50 post-list entries, opened the detail + popup, and rendered Event Lineage, Knowledge Graph, original-content, and + issue sections without a frontend error. An image-heavy summary returned + the explicit processing-state response (HTTP 503), so image evidence is not + claimed as live-ready. +- The exact PR #366 frontend head passed 177 tests and a production build. + Its browser build authenticated successfully and loaded the board; the + disclosure-summary focus path remains covered by the unit test because the + local authorized corpus did not expose a disclosure element in the sampled + popup. + +These observations are runtime evidence, not a claim that the corresponding +PRs are merged. The image-processing state and protected-corpus parsing cases +remain open gaps. + +## 6. Organization OpenTelemetry Evidence Boundary GRC PR #42 records organization-level OTEL acceptance evidence through the existing purpose-bound evidence contract. It does not become a raw span store @@ -109,7 +135,7 @@ OpenTelemetry attributes correlate the authorized operation across services; collector delivery, retention, access review, and no-export rollback are the GRC evidence subjects. -## 6. Next Implementation Order +## 7. Next Implementation Order 1. Let the protected Checks and independent approvals complete for stacked PRs #376 and #377, then revalidate their parent PRs #370 and #374 at the exact From 45e3f4750a251f2d1e4ee1da1bf07e614199e0b6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 22:07:14 +0900 Subject: [PATCH 005/109] docs: pin baseline update head --- docs/product-technical-gap-baseline.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 9859aa070..4fd74dcf1 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -54,6 +54,10 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. `f45fcdebfd54bf236b55f5d892aeb6091b51ba5b`, base `main`; this baseline checkpoint is updated by the stacked documentation PR for the newer queue evidence below. +- LineageWeave PR #378: `head` + `505302847b1a257d1464460d3c72bf11344e48ae`, base + `codex/product-gap-baseline-20260821`; this checkpoint's local + buyer-surface verification is the current documentation delta. - LineageWeave PR #366: `head` `588dc91f5689d77281cd6bbd10a8e922f9eaa159`, base `8bed77e7e7b91b633bb92d3a82d0187c387206af`; customer-master authorization From 333c705294a4faa76869f34d3e08dc09d760487d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 22:13:27 +0900 Subject: [PATCH 006/109] docs: refresh merged PR evidence --- docs/product-technical-gap-baseline.md | 35 ++++++++++++++++++++------ 1 file changed, 27 insertions(+), 8 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 4fd74dcf1..0467192d9 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -35,7 +35,7 @@ The following states are evidence-bound and must not be changed to `merged` or `resolved` from intent alone: -Observed at `2026-08-21T12:42:34Z` from the GitHub API. A merged commit is +Observed at `2026-08-21T13:12:54Z` from the GitHub API. A merged commit is identified as `merge_commit`; an open PR is identified by its exact `head`. - LineageWeave PR #344: `merge_commit` @@ -69,23 +69,42 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. continuation is open and required Checks and independent approval remain external gates. - LineageWeave PR #370: `head` - `74b92eb95360b14c7e4f2bc2679f580f4ce249f8`, base + `9f8f4b742759e15ad34c7ef09c401dbc8b1d1ae5`, base `8bed77e7e7b91b633bb92d3a82d0187c387206af`; its runtime boundary fixes are - stacked in PR #376. + now part of the current Customer Master stack; required Checks and + independent approval remain external gates. - LineageWeave PR #374: `head` `f6ce19f8e10aa7ec2b0a95f3adbbea816bd39594`, base `0a5a5799b444c44dc2952edc7227b1b96b97457e`; its post-chat atomic reauthorization fix is stacked in PR #377. -- LineageWeave PR #376: `head` - `21880e937eedff6c314cb7af3d99ddca2792597f`, base `docs/customer-master-scope-adr`; - migration, relation-boundary, image-job transaction, and overflow-test fixes - are locally verified; required Checks and independent approval remain - external gates. +- LineageWeave PR #376: `merge_commit` + `860545f7bece99359ec7b9840c675ddc14e9acbc`, merged at + `2026-08-21T13:10:45Z`; migration, relation-boundary, image-job transaction, + and overflow-test fixes are delivered in the Customer Master stack. +- LineageWeave PR #380: `merge_commit` + `9f8f4b742759e15ad34c7ef09c401dbc8b1d1ae5`, merged at + `2026-08-21T13:11:02Z`; the workspace-refresh and accessibility changes are + delivered in the current #370 head. - LineageWeave PR #377: `head` `16ab01a9ab7d88487a3c984e192709857f6cfd1c`, base `repair/global-ask-atomic-rollback-v2203`; post-chat rollback and test cleanup are locally verified; required Checks and independent approval remain external gates. +- LineageWeave PR #373: `head` + `bc91481dac7350975de7ec00f11d4e54f676eb2c`, base `main`; ontology + publication has unresolved review work and is not treated as delivered. +- LineageWeave PR #375: `head` + `34967730b4a9e663ff366b7fd8a91c21f98236f1`, base + `repair/global-ask-atomic-rollback-v2203`; one unresolved review thread + remains, so post-chat citation authorization is not treated as delivered. +- LineageWeave PR #379: `head` + `8d688c8b865092e7e52c7ff4cabbc01dcde9c9b0`, base + `feat/naruon-calendar-projection-contract-main`; one unresolved review + thread remains and it is outside the LineageWeave buyer-surface completion + claim. +- Legacy open PRs #258, #262, and #287 remain explicitly unmerged; their + current review/conflict state requires separate triage before any delivery + claim. - LineageWeave PR #371: `closed_without_merge` head `4c3e43f9e96ecc2d868657dd9b0ce5524a15c76c`, closed at `2026-08-21T11:59:57Z`; no merge commit exists, so ontology publication is From 2d49996e062ade5931e751bd3c1bce4db8a12c76 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 22:36:33 +0900 Subject: [PATCH 007/109] docs: refresh product gap checkpoint --- docs/product-technical-gap-baseline.md | 51 ++++++++++++++++---------- 1 file changed, 32 insertions(+), 19 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 0467192d9..ebdd4dec2 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -35,7 +35,7 @@ The following states are evidence-bound and must not be changed to `merged` or `resolved` from intent alone: -Observed at `2026-08-21T13:12:54Z` from the GitHub API. A merged commit is +Observed at `2026-08-21T13:35:16Z` from the GitHub API. A merged commit is identified as `merge_commit`; an open PR is identified by its exact `head`. - LineageWeave PR #344: `merge_commit` @@ -55,7 +55,7 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. checkpoint is updated by the stacked documentation PR for the newer queue evidence below. - LineageWeave PR #378: `head` - `505302847b1a257d1464460d3c72bf11344e48ae`, base + `333c705294a4faa76869f34d3e08dc09d760487d`, base `codex/product-gap-baseline-20260821`; this checkpoint's local buyer-surface verification is the current documentation delta. - LineageWeave PR #366: `head` @@ -90,21 +90,33 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. `repair/global-ask-atomic-rollback-v2203`; post-chat rollback and test cleanup are locally verified; required Checks and independent approval remain external gates. +- LineageWeave PR #385: `head` + `cda7d483717addf6f62b7771a5cdcd244cad8fa9`, base + `feat/analysis-run-name-evidence-lineage`; stacked on PR #258's exact head + `efcc3c615cf4809a7ec265a1074a10e12877dd15`, it hardens the external + lineage contract, removes the self-modifying repair workflow, and fixes the + responsive board CSS. Checks and independent approval remain external gates. - LineageWeave PR #373: `head` `bc91481dac7350975de7ec00f11d4e54f676eb2c`, base `main`; ontology publication has unresolved review work and is not treated as delivered. -- LineageWeave PR #375: `head` - `34967730b4a9e663ff366b7fd8a91c21f98236f1`, base - `repair/global-ask-atomic-rollback-v2203`; one unresolved review thread - remains, so post-chat citation authorization is not treated as delivered. -- LineageWeave PR #379: `head` - `8d688c8b865092e7e52c7ff4cabbc01dcde9c9b0`, base - `feat/naruon-calendar-projection-contract-main`; one unresolved review - thread remains and it is outside the LineageWeave buyer-surface completion - claim. -- Legacy open PRs #258, #262, and #287 remain explicitly unmerged; their - current review/conflict state requires separate triage before any delivery - claim. +- LineageWeave PR #375: `merge_commit` + `fb0d185a2da707e57d2ed10900b06707126d8300`, merged at + `2026-08-21T13:18:01Z`; post-chat citation authorization is delivered in + the merged stack. +- LineageWeave PR #379: `merge_commit` + `b606c2553f877fa85968d90dc46598ce16897fbf`, merged at + `2026-08-21T13:19:00Z`; malformed provider replies and focused regression + coverage are delivered in the current PR #355 head. +- LineageWeave PR #355: `head` + `b606c2553f877fa85968d90dc46598ce16897fbf`, base `main`; it remains + open and is not treated as merged solely because stacked PR #379 merged. +- LineageWeave PR #382: `head` + `d14dc49025886a00251a3f579f4e9d53ed55f0ba`, base + `ci/publish-ontology-pages-clean`; it carries the ontology-site safety + repair stacked on PR #373 and remains gated by Checks and approval. +- Legacy open PRs #258, #262, and #287 remain explicitly unmerged. PR #258 + has the separate hardening stack #385; neither PR is treated as delivered + until GitHub reports a merge commit. - LineageWeave PR #371: `closed_without_merge` head `4c3e43f9e96ecc2d868657dd9b0ce5524a15c76c`, closed at `2026-08-21T11:59:57Z`; no merge commit exists, so ontology publication is @@ -160,11 +172,12 @@ GRC evidence subjects. ## 7. Next Implementation Order -1. Let the protected Checks and independent approvals complete for stacked PRs - #376 and #377, then revalidate their parent PRs #370 and #374 at the exact - current head; PR #367 is already merged. Verify the synthetic footnote/table - cases in the authenticated browser and use the protected external corpus only - for aggregate, non-identifying runtime evidence. +1. Let the protected Checks and independent approvals complete for open stacked + PRs #377, #382, and #385, then revalidate parent PRs #374, #373, and #258 + at their exact current heads; PRs #367, #375, and #379 are already merged. + Verify the synthetic footnote/table cases in the authenticated browser and + use the protected external corpus only for aggregate, non-identifying + runtime evidence. 2. Resolve image DOM-region recognition, OCR, semantic table rendering, and buyer-facing caption separation through contextual-orchestrator VISION. 3. Verify 5W1H, multi-project event separation, Keyman affiliation, and From c6defda2c1122c7c48eab8788eb85c6571d37e4e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 22:39:10 +0900 Subject: [PATCH 008/109] docs: mark baseline checkpoint merged --- docs/product-technical-gap-baseline.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index ebdd4dec2..176264a50 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -54,10 +54,10 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. `f45fcdebfd54bf236b55f5d892aeb6091b51ba5b`, base `main`; this baseline checkpoint is updated by the stacked documentation PR for the newer queue evidence below. -- LineageWeave PR #378: `head` - `333c705294a4faa76869f34d3e08dc09d760487d`, base - `codex/product-gap-baseline-20260821`; this checkpoint's local - buyer-surface verification is the current documentation delta. +- LineageWeave PR #378: `merge_commit` + `333c705294a4faa76869f34d3e08dc09d760487d`, merged at + `2026-08-21T13:36:41Z`; this checkpoint's buyer-surface and exact-head + evidence is delivered in the merged baseline documentation. - LineageWeave PR #366: `head` `588dc91f5689d77281cd6bbd10a8e922f9eaa159`, base `8bed77e7e7b91b633bb92d3a82d0187c387206af`; customer-master authorization From 0c746e9d22e43ef101f76235ee69b7528341b02e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 22:45:26 +0900 Subject: [PATCH 009/109] docs: refresh current PR heads --- docs/product-technical-gap-baseline.md | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 176264a50..22322bbca 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -35,7 +35,7 @@ The following states are evidence-bound and must not be changed to `merged` or `resolved` from intent alone: -Observed at `2026-08-21T13:35:16Z` from the GitHub API. A merged commit is +Observed at `2026-08-21T13:44:58Z` from the GitHub API. A merged commit is identified as `merge_commit`; an open PR is identified by its exact `head`. - LineageWeave PR #344: `merge_commit` @@ -51,7 +51,7 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. provenance explorer remains open and required Checks and independent approval remain external gates. - LineageWeave PR #368: `head` - `f45fcdebfd54bf236b55f5d892aeb6091b51ba5b`, base `main`; this baseline + `c6defda2c1122c7c48eab8788eb85c6571d37e4e`, base `main`; this baseline checkpoint is updated by the stacked documentation PR for the newer queue evidence below. - LineageWeave PR #378: `merge_commit` @@ -69,12 +69,12 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. continuation is open and required Checks and independent approval remain external gates. - LineageWeave PR #370: `head` - `9f8f4b742759e15ad34c7ef09c401dbc8b1d1ae5`, base + `1f12c862beb1d138e4afae6439bf474f86bb4859`, base `8bed77e7e7b91b633bb92d3a82d0187c387206af`; its runtime boundary fixes are now part of the current Customer Master stack; required Checks and independent approval remain external gates. - LineageWeave PR #374: `head` - `f6ce19f8e10aa7ec2b0a95f3adbbea816bd39594`, base + `fb0d185a2da707e57d2ed10900b06707126d8300`, base `0a5a5799b444c44dc2952edc7227b1b96b97457e`; its post-chat atomic reauthorization fix is stacked in PR #377. - LineageWeave PR #376: `merge_commit` @@ -91,9 +91,9 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. cleanup are locally verified; required Checks and independent approval remain external gates. - LineageWeave PR #385: `head` - `cda7d483717addf6f62b7771a5cdcd244cad8fa9`, base + `b1537164e67e622e1b5758f3e0b4e3260af81112`, base `feat/analysis-run-name-evidence-lineage`; stacked on PR #258's exact head - `efcc3c615cf4809a7ec265a1074a10e12877dd15`, it hardens the external + `3f9a0cfadc0164a44bad4bbe0c4af3f5e2e4d3bd`, it hardens the external lineage contract, removes the self-modifying repair workflow, and fixes the responsive board CSS. Checks and independent approval remain external gates. - LineageWeave PR #373: `head` @@ -114,9 +114,17 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. `d14dc49025886a00251a3f579f4e9d53ed55f0ba`, base `ci/publish-ontology-pages-clean`; it carries the ontology-site safety repair stacked on PR #373 and remains gated by Checks and approval. -- Legacy open PRs #258, #262, and #287 remain explicitly unmerged. PR #258 - has the separate hardening stack #385; neither PR is treated as delivered - until GitHub reports a merge commit. +- Legacy open PR #258: `head` + `3f9a0cfadc0164a44bad4bbe0c4af3f5e2e4d3bd`, base `main`; hardening stack + #385 is open and parent delivery remains gated by Checks and review. +- Legacy open PR #262: `head` + `be7255d9cd7f8c890f2ba2de9fc05c6750073293`, base + `feat/calendar-open-focus-event-lineage-v2140`; it remains unmerged and + separately gated. +- Legacy open PR #287: `head` + `b693377ed849a3a15b7bd363e519fa4564503983`, base + `feat/global-ask-public-claim-verification-v2200`; it is conflicting and + remains unmerged. - LineageWeave PR #371: `closed_without_merge` head `4c3e43f9e96ecc2d868657dd9b0ce5524a15c76c`, closed at `2026-08-21T11:59:57Z`; no merge commit exists, so ontology publication is From 7d4ee14210ea2a822dfc12af2d809f9ba6fd5f74 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 22:49:49 +0900 Subject: [PATCH 010/109] docs: pin latest stacked PR heads --- docs/product-technical-gap-baseline.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 22322bbca..87dca4d14 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -35,7 +35,7 @@ The following states are evidence-bound and must not be changed to `merged` or `resolved` from intent alone: -Observed at `2026-08-21T13:44:58Z` from the GitHub API. A merged commit is +Observed at `2026-08-21T13:49:32Z` from the GitHub API. A merged commit is identified as `merge_commit`; an open PR is identified by its exact `head`. - LineageWeave PR #344: `merge_commit` @@ -91,9 +91,9 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. cleanup are locally verified; required Checks and independent approval remain external gates. - LineageWeave PR #385: `head` - `b1537164e67e622e1b5758f3e0b4e3260af81112`, base + `2a3a464e2e3878ad18138cec4c48790ffca7f126`, base `feat/analysis-run-name-evidence-lineage`; stacked on PR #258's exact head - `3f9a0cfadc0164a44bad4bbe0c4af3f5e2e4d3bd`, it hardens the external + `aba828ebcdd74328449498e6f9082e11488b6f5e`, it hardens the external lineage contract, removes the self-modifying repair workflow, and fixes the responsive board CSS. Checks and independent approval remain external gates. - LineageWeave PR #373: `head` @@ -115,7 +115,7 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. `ci/publish-ontology-pages-clean`; it carries the ontology-site safety repair stacked on PR #373 and remains gated by Checks and approval. - Legacy open PR #258: `head` - `3f9a0cfadc0164a44bad4bbe0c4af3f5e2e4d3bd`, base `main`; hardening stack + `aba828ebcdd74328449498e6f9082e11488b6f5e`, base `main`; hardening stack #385 is open and parent delivery remains gated by Checks and review. - Legacy open PR #262: `head` `be7255d9cd7f8c890f2ba2de9fc05c6750073293`, base From 3a924014dbaafa22e74331df642a5fa4e4569f0d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 22:59:08 +0900 Subject: [PATCH 011/109] docs: refresh exact PR baseline heads --- docs/product-technical-gap-baseline.md | 38 +++++++++++++------------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 87dca4d14..6f1d78d81 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -35,7 +35,7 @@ The following states are evidence-bound and must not be changed to `merged` or `resolved` from intent alone: -Observed at `2026-08-21T13:49:32Z` from the GitHub API. A merged commit is +Observed at `2026-08-21T13:58:02Z` from the GitHub API. A merged commit is identified as `merge_commit`; an open PR is identified by its exact `head`. - LineageWeave PR #344: `merge_commit` @@ -47,11 +47,11 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. `2026-08-21T11:56:07Z`; focused parser tests passed before merge, while authorized production/browser evidence remains open. - LineageWeave PR #349: `head` - `539b65287da5ac4635f6965c6dc21d7437dede9c`, base `main`; ontology + `2eb6d13903d8d20b27dfeccd476a149fdd801c1b`, base `main`; ontology provenance explorer remains open and required Checks and independent approval remain external gates. - LineageWeave PR #368: `head` - `c6defda2c1122c7c48eab8788eb85c6571d37e4e`, base `main`; this baseline + `7d4ee14210ea2a822dfc12af2d809f9ba6fd5f74`, base `main`; this baseline checkpoint is updated by the stacked documentation PR for the newer queue evidence below. - LineageWeave PR #378: `merge_commit` @@ -69,7 +69,7 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. continuation is open and required Checks and independent approval remain external gates. - LineageWeave PR #370: `head` - `1f12c862beb1d138e4afae6439bf474f86bb4859`, base + `d5495162fbf4950ca180d43d5c13a636f1889e0c`, base `8bed77e7e7b91b633bb92d3a82d0187c387206af`; its runtime boundary fixes are now part of the current Customer Master stack; required Checks and independent approval remain external gates. @@ -86,18 +86,18 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. `2026-08-21T13:11:02Z`; the workspace-refresh and accessibility changes are delivered in the current #370 head. - LineageWeave PR #377: `head` - `16ab01a9ab7d88487a3c984e192709857f6cfd1c`, base + `a638e28af4345750e3be92f2b0f23012b24598e0`, base `repair/global-ask-atomic-rollback-v2203`; post-chat rollback and test cleanup are locally verified; required Checks and independent approval remain external gates. - LineageWeave PR #385: `head` - `2a3a464e2e3878ad18138cec4c48790ffca7f126`, base + `23a5c139b2b732218b6154ba600ad6c3be970f45`, base `feat/analysis-run-name-evidence-lineage`; stacked on PR #258's exact head - `aba828ebcdd74328449498e6f9082e11488b6f5e`, it hardens the external + `481bdb6eafa1d3f074ca7d9d05275ce36a4708d8`, it hardens the external lineage contract, removes the self-modifying repair workflow, and fixes the responsive board CSS. Checks and independent approval remain external gates. - LineageWeave PR #373: `head` - `bc91481dac7350975de7ec00f11d4e54f676eb2c`, base `main`; ontology + `84fd2993fcec5d3d683c391818f85e27ebd7347f`, base `main`; ontology publication has unresolved review work and is not treated as delivered. - LineageWeave PR #375: `merge_commit` `fb0d185a2da707e57d2ed10900b06707126d8300`, merged at @@ -115,14 +115,14 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. `ci/publish-ontology-pages-clean`; it carries the ontology-site safety repair stacked on PR #373 and remains gated by Checks and approval. - Legacy open PR #258: `head` - `aba828ebcdd74328449498e6f9082e11488b6f5e`, base `main`; hardening stack + `481bdb6eafa1d3f074ca7d9d05275ce36a4708d8`, base `main`; hardening stack #385 is open and parent delivery remains gated by Checks and review. - Legacy open PR #262: `head` - `be7255d9cd7f8c890f2ba2de9fc05c6750073293`, base + `fcb9bd3ad4714380946d29c0889b940aceaa5496`, base `feat/calendar-open-focus-event-lineage-v2140`; it remains unmerged and separately gated. - Legacy open PR #287: `head` - `b693377ed849a3a15b7bd363e519fa4564503983`, base + `9d2a536d7fba14f87a9fe4c9e7e578c16f97aea9`, base `feat/global-ask-public-claim-verification-v2200`; it is conflicting and remains unmerged. - LineageWeave PR #371: `closed_without_merge` @@ -133,14 +133,14 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. `9316d281ae396cc1bc33ac3ba470a9e3afd41a90`, merged at `2026-08-21T09:08:31Z`; application and Valkey caller OpenTelemetry spans are merged, while raw telemetry remains outside buyer evidence. -- contextual-orchestrator PR #802: `head` - `b2fe47e78ade89b13aa4c239c71562c65af5f12e`, base - `f1b0cd48271e870571b022463e1ec2c857ae4a8a`; request session context is - propagated through local batch workers and approval is not recorded. -- contextual-orchestrator PR #805: `head` - `1d11e7d40dc52121d440991969be2967adf2136e`, base - `f1b0cd48271e870571b022463e1ec2c857ae4a8a`; structured Responses and - JSON-schema orchestration remain a separate open merge prerequisite. +- contextual-orchestrator PR #802: `merge_commit` + `407747626598d763a127509f81d23c2ad8aaee23`, merged at + `2026-08-21T11:42:06Z`; request session context is delivered through local + batch workers. +- contextual-orchestrator PR #805: `merge_commit` + `537915715c4b050d4b5fa18ce2b7559080c675ba`, merged at + `2026-08-21T11:45:58Z`; structured Responses and JSON-schema orchestration + are delivered in the merged upstream boundary. ## 5. Local Buyer-Surface Verification From 57b887f791daa821581b76293048547432733368 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 23:00:39 +0900 Subject: [PATCH 012/109] docs: refresh current PR checkpoint evidence --- docs/product-technical-gap-baseline.md | 40 +++++++++++++++++--------- 1 file changed, 26 insertions(+), 14 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 87dca4d14..faf855efa 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -47,11 +47,11 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. `2026-08-21T11:56:07Z`; focused parser tests passed before merge, while authorized production/browser evidence remains open. - LineageWeave PR #349: `head` - `539b65287da5ac4635f6965c6dc21d7437dede9c`, base `main`; ontology + `2eb6d13903d8d20b27dfeccd476a149fdd801c1b`, base `main`; ontology provenance explorer remains open and required Checks and independent approval remain external gates. - LineageWeave PR #368: `head` - `c6defda2c1122c7c48eab8788eb85c6571d37e4e`, base `main`; this baseline + `7d4ee14210ea2a822dfc12af2d809f9ba6fd5f74`, base `main`; this baseline checkpoint is updated by the stacked documentation PR for the newer queue evidence below. - LineageWeave PR #378: `merge_commit` @@ -60,22 +60,22 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. evidence is delivered in the merged baseline documentation. - LineageWeave PR #366: `head` `588dc91f5689d77281cd6bbd10a8e922f9eaa159`, base - `8bed77e7e7b91b633bb92d3a82d0187c387206af`; customer-master authorization + `feat/lineage-dag-regression`; customer-master authorization scope is implemented, while required Checks and independent approval remain external gates. - LineageWeave PR #369: `head` `eb9e520cbac412b7f85f8ceddd86624515bb29cb`, base - `e88f3862215e76d0702204f29aba75ddc902d19f`; ontology source-window + `feat/ontology-provenance-explorer-v2130`; ontology source-window continuation is open and required Checks and independent approval remain external gates. - LineageWeave PR #370: `head` - `1f12c862beb1d138e4afae6439bf474f86bb4859`, base - `8bed77e7e7b91b633bb92d3a82d0187c387206af`; its runtime boundary fixes are + `d5495162fbf4950ca180d43d5c13a636f1889e0c`, base + `feat/lineage-dag-regression`; its runtime boundary fixes are now part of the current Customer Master stack; required Checks and independent approval remain external gates. - LineageWeave PR #374: `head` `fb0d185a2da707e57d2ed10900b06707126d8300`, base - `0a5a5799b444c44dc2952edc7227b1b96b97457e`; its post-chat atomic + `feat/ask-session-storage-key-v2202`; its post-chat atomic reauthorization fix is stacked in PR #377. - LineageWeave PR #376: `merge_commit` `860545f7bece99359ec7b9840c675ddc14e9acbc`, merged at @@ -86,23 +86,24 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. `2026-08-21T13:11:02Z`; the workspace-refresh and accessibility changes are delivered in the current #370 head. - LineageWeave PR #377: `head` - `16ab01a9ab7d88487a3c984e192709857f6cfd1c`, base + `a638e28af4345750e3be92f2b0f23012b24598e0`, base `repair/global-ask-atomic-rollback-v2203`; post-chat rollback and test cleanup are locally verified; required Checks and independent approval remain external gates. - LineageWeave PR #385: `head` - `2a3a464e2e3878ad18138cec4c48790ffca7f126`, base + `d0c7decf4767902642c9805629bb8c7d5440ead8`, base `feat/analysis-run-name-evidence-lineage`; stacked on PR #258's exact head - `aba828ebcdd74328449498e6f9082e11488b6f5e`, it hardens the external + `481bdb6eafa1d3f074ca7d9d05275ce36a4708d8`, it hardens the external lineage contract, removes the self-modifying repair workflow, and fixes the responsive board CSS. Checks and independent approval remain external gates. - LineageWeave PR #373: `head` - `bc91481dac7350975de7ec00f11d4e54f676eb2c`, base `main`; ontology + `84fd2993fcec5d3d683c391818f85e27ebd7347f`, base `main`; ontology publication has unresolved review work and is not treated as delivered. - LineageWeave PR #375: `merge_commit` `fb0d185a2da707e57d2ed10900b06707126d8300`, merged at `2026-08-21T13:18:01Z`; post-chat citation authorization is delivered in - the merged stack. + the merged stack. This equals the open #374 head intentionally because the + stacked merge was fast-forwarded; the two PRs remain separately classified. - LineageWeave PR #379: `merge_commit` `b606c2553f877fa85968d90dc46598ce16897fbf`, merged at `2026-08-21T13:19:00Z`; malformed provider replies and focused regression @@ -114,11 +115,22 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. `d14dc49025886a00251a3f579f4e9d53ed55f0ba`, base `ci/publish-ontology-pages-clean`; it carries the ontology-site safety repair stacked on PR #373 and remains gated by Checks and approval. +- LineageWeave PR #383: `head` + `c9e95e738062936c8d6239989860fc4fd6fabbf3`, base `main`; buyer-safe + worker diagnostics and distinct TEPP telemetry peer labeling remain gated + by Checks and approval. +- LineageWeave PR #384: `head` + `e3476662cf936eff2fde54a673e8c925f13b9f89`, base + `docs/customer-master-scope-adr`; source-detail state copy and filtering + remain gated by Checks and approval. +- LineageWeave PR #386: `head` + `57a013deb88fc0b23ae6448c1d3474c770360a5e`, base `main`; the login + build-type repair remains gated by Checks and approval. - Legacy open PR #258: `head` - `aba828ebcdd74328449498e6f9082e11488b6f5e`, base `main`; hardening stack + `481bdb6eafa1d3f074ca7d9d05275ce36a4708d8`, base `main`; hardening stack #385 is open and parent delivery remains gated by Checks and review. - Legacy open PR #262: `head` - `be7255d9cd7f8c890f2ba2de9fc05c6750073293`, base + `fcb9bd3ad4714380946d29c0889b940aceaa5496`, base `feat/calendar-open-focus-event-lineage-v2140`; it remains unmerged and separately gated. - Legacy open PR #287: `head` From 3e233eeb6ba4e8649006e4c7eb42d74cc48e5a03 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 23:01:35 +0900 Subject: [PATCH 013/109] docs: record latest review stack head --- docs/product-technical-gap-baseline.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 6f1d78d81..997c18de4 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -35,7 +35,7 @@ The following states are evidence-bound and must not be changed to `merged` or `resolved` from intent alone: -Observed at `2026-08-21T13:58:02Z` from the GitHub API. A merged commit is +Observed at `2026-08-21T14:01:24Z` from the GitHub API. A merged commit is identified as `merge_commit`; an open PR is identified by its exact `head`. - LineageWeave PR #344: `merge_commit` @@ -51,7 +51,7 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. provenance explorer remains open and required Checks and independent approval remain external gates. - LineageWeave PR #368: `head` - `7d4ee14210ea2a822dfc12af2d809f9ba6fd5f74`, base `main`; this baseline + `3a924014dbaafa22e74331df642a5fa4e4569f0d`, base `main`; this baseline checkpoint is updated by the stacked documentation PR for the newer queue evidence below. - LineageWeave PR #378: `merge_commit` @@ -91,7 +91,7 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. cleanup are locally verified; required Checks and independent approval remain external gates. - LineageWeave PR #385: `head` - `23a5c139b2b732218b6154ba600ad6c3be970f45`, base + `d0c7decf4767902642c9805629bb8c7d5440ead8`, base `feat/analysis-run-name-evidence-lineage`; stacked on PR #258's exact head `481bdb6eafa1d3f074ca7d9d05275ce36a4708d8`, it hardens the external lineage contract, removes the self-modifying repair workflow, and fixes the From 7257a621dcbc11eff6e157e3dc08c855981a3c42 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 23:08:00 +0900 Subject: [PATCH 014/109] docs: record authenticated buyer-surface e2e --- docs/product-technical-gap-baseline.md | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 997c18de4..a97d858d0 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -35,7 +35,7 @@ The following states are evidence-bound and must not be changed to `merged` or `resolved` from intent alone: -Observed at `2026-08-21T14:01:24Z` from the GitHub API. A merged commit is +Observed at `2026-08-21T14:07:36Z` from the GitHub API. A merged commit is identified as `merge_commit`; an open PR is identified by its exact `head`. - LineageWeave PR #344: `merge_commit` @@ -51,7 +51,7 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. provenance explorer remains open and required Checks and independent approval remain external gates. - LineageWeave PR #368: `head` - `3a924014dbaafa22e74331df642a5fa4e4569f0d`, base `main`; this baseline + `3e233eeb6ba4e8649006e4c7eb42d74cc48e5a03`, base `main`; this baseline checkpoint is updated by the stacked documentation PR for the newer queue evidence below. - LineageWeave PR #378: `merge_commit` @@ -164,6 +164,19 @@ synthetic browser account and aggregate-only evidence: local authorized corpus did not expose a disclosure element in the sampled popup. +Observed at `2026-08-21T14:07:36Z` through the local browser runtime with a +synthetic Keycloak account and aggregate-only assertions: + +- The real OIDC redirect completed and returned to the board with the signed-in + state, authorized-scope disclosure, and logout control visible. +- The board exposed 50 post controls. Clicking one opened the detail surface; + the popup exposed Event Lineage and Knowledge Graph sections, and its close + control removed the detail surface. +- The site-map control changed the visible navigation state. No post title, + person, organization, source identifier, or image payload was persisted in + this repository. Image-heavy processing remains an explicit processing-state + gap, not a live-success claim. + These observations are runtime evidence, not a claim that the corresponding PRs are merged. The image-processing state and protected-corpus parsing cases remain open gaps. From 01a548dff849c3128bdb23017b8dfd1377ca9502 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 23:21:58 +0900 Subject: [PATCH 015/109] docs: pin current PR384 exact head --- docs/product-technical-gap-baseline.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 8d97c974e..36181bb82 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -35,7 +35,7 @@ The following states are evidence-bound and must not be changed to `merged` or `resolved` from intent alone: -Observed at `2026-08-21T14:07:36Z` from the GitHub API. A merged commit is +Observed at `2026-08-21T14:21:29Z` from the GitHub API. A merged commit is identified as `merge_commit`; an open PR is identified by its exact `head`. - LineageWeave PR #344: `merge_commit` @@ -51,7 +51,7 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. provenance explorer remains open and required Checks and independent approval remain external gates. - LineageWeave PR #368: `head` - `3e233eeb6ba4e8649006e4c7eb42d74cc48e5a03`, base `main`; this baseline + `d739d7ae195ca272e4bbdbcf26c4c8e1a374dacd`, base `main`; this baseline checkpoint is updated by the stacked documentation PR for the newer queue evidence below. - LineageWeave PR #378: `merge_commit` @@ -96,6 +96,12 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. `481bdb6eafa1d3f074ca7d9d05275ce36a4708d8`, it hardens the external lineage contract, removes the self-modifying repair workflow, and fixes the responsive board CSS. Checks and independent approval remain external gates. +- LineageWeave PR #384: `head` + `a9dcd343c651726ee35d0ff49f1618b5a383bc17`, base + `docs/customer-master-scope-adr`; it normalizes padded source-detail-state + codes across filtering, ABAC, analysis eligibility, and content-worker + boundaries, with transaction-test-double coverage. Checks and independent + approval remain external gates. - LineageWeave PR #373: `head` `84fd2993fcec5d3d683c391818f85e27ebd7347f`, base `main`; ontology publication has unresolved review work and is not treated as delivered. From a3781119625e50213f64cbe1d04d045accf4e979 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 23:23:31 +0900 Subject: [PATCH 016/109] docs: retain UIUX standard audit in baseline --- docs/product-technical-gap-baseline.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 36181bb82..f18c0305e 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -13,6 +13,22 @@ - **Math/Superscripts**: synthetic case `case-math-01` covers bounded metric normalization such as m³; arbitrary formula semantics and authorized runtime verification remain open after PR #344. - **Missing UI Elements**: synthetic case `case-dag-01` tracks the Event Lineage DAG surface; current source includes the DAG, but corpus coverage and browser evidence remain open. +## 1.1 UI/UX Standard Guide v3.0 audit + +- **Present in source and unit coverage:** the React shell has a sticky header, + top-right account/logout/language/search utilities, GNB and phone drawer, + footer/copyright, Noto Sans and tokenized palette, 1024/1280/1920 layout + bounds, three responsive tiers, table/form alignment rules, required-field + markers, focus states, and a 50% modal mask. The Event Lineage DAG has + keyboard activation, branch/root/current states, evidence context, and + Storybook scenes. +- **Figma reference:** ADR 0118 records File ID `1Su3lDRmiZdcUs47t1QwIX`; + Event Lineage desktop/mobile frames remain the normative visual reference. +- **Open buyer or governance gaps:** approved tenant CI/BI assets and usage + permission are not present; no-JavaScript fallback is not proven; phone and + site-map behavior need protected runtime evidence; and Figma parity does not + prove complete authorized-corpus image/table evidence. + ## 2. LLM Extraction & Knowledge Graph Gaps - **Multiple Project Extraction**: A structured `key_events.project_name` implementation exists, but separate-event behavior still requires protected authorized-corpus evidence. - **5W1H Missing**: A structured 5W1H evidence-item implementation exists, but completeness and provenance still require protected authorized-corpus evidence. From 76630661963e79a68c23cd58948953cc7b36bcad Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 23:39:59 +0900 Subject: [PATCH 017/109] docs: refresh current PR exact-head evidence --- docs/product-technical-gap-baseline.md | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index f18c0305e..009b4d5fc 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -51,7 +51,7 @@ The following states are evidence-bound and must not be changed to `merged` or `resolved` from intent alone: -Observed at `2026-08-21T14:21:29Z` from the GitHub API. A merged commit is +Observed at `2026-08-21T14:39:29Z` from the GitHub API. A merged commit is identified as `merge_commit`; an open PR is identified by its exact `head`. - LineageWeave PR #344: `merge_commit` @@ -67,7 +67,7 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. provenance explorer remains open and required Checks and independent approval remain external gates. - LineageWeave PR #368: `head` - `d739d7ae195ca272e4bbdbcf26c4c8e1a374dacd`, base `main`; this baseline + `a3781119625e50213f64cbe1d04d045accf4e979`, base `main`; this baseline checkpoint is updated by the stacked documentation PR for the newer queue evidence below. - LineageWeave PR #378: `merge_commit` @@ -113,10 +113,11 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. lineage contract, removes the self-modifying repair workflow, and fixes the responsive board CSS. Checks and independent approval remain external gates. - LineageWeave PR #384: `head` - `a9dcd343c651726ee35d0ff49f1618b5a383bc17`, base + `caf3872ea48e565ba444d7b4b4042a9f3b7e61c5`, base `docs/customer-master-scope-adr`; it normalizes padded source-detail-state codes across filtering, ABAC, analysis eligibility, and content-worker - boundaries, with transaction-test-double coverage. Checks and independent + boundaries, removes authorization-only fields at report/calendar response + boundaries, and hides unavailable state filters. Checks and independent approval remain external gates. - LineageWeave PR #373: `head` `84fd2993fcec5d3d683c391818f85e27ebd7347f`, base `main`; ontology @@ -134,17 +135,18 @@ identified as `merge_commit`; an open PR is identified by its exact `head`. `b606c2553f877fa85968d90dc46598ce16897fbf`, base `main`; it remains open and is not treated as merged solely because stacked PR #379 merged. - LineageWeave PR #382: `head` - `d14dc49025886a00251a3f579f4e9d53ed55f0ba`, base + `aab1e60c2c2ec4b57ca34585e5539d5ce1a7f9dd`, base `ci/publish-ontology-pages-clean`; it carries the ontology-site safety repair stacked on PR #373 and remains gated by Checks and approval. - LineageWeave PR #383: `head` - `c9e95e738062936c8d6239989860fc4fd6fabbf3`, base `main`; buyer-safe + `b0c9bc6466c77b9b53f5e0e17224c868bfe08be6`, base `main`; buyer-safe worker diagnostics and distinct TEPP telemetry peer labeling remain gated by Checks and approval. - LineageWeave PR #384: `head` - `e3476662cf936eff2fde54a673e8c925f13b9f89`, base - `docs/customer-master-scope-adr`; source-detail state copy and filtering - remain gated by Checks and approval. + `caf3872ea48e565ba444d7b4b4042a9f3b7e61c5`, base + `docs/customer-master-scope-adr`; source-detail state normalization, + buyer-safe report/calendar serialization, and empty-filter UX remain gated by + Checks and approval. - LineageWeave PR #386: `head` `57a013deb88fc0b23ae6448c1d3474c770360a5e`, base `main`; the login build-type repair remains gated by Checks and approval. From 34103b5b23503524cef6a6cf97b0e7b364b0f852 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 00:13:21 +0900 Subject: [PATCH 018/109] docs: refresh open PR checkpoint evidence --- docs/product-technical-gap-baseline.md | 161 +++++-------------------- 1 file changed, 33 insertions(+), 128 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 009b4d5fc..c4b3c27b2 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -49,134 +49,39 @@ ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or -`resolved` from intent alone: - -Observed at `2026-08-21T14:39:29Z` from the GitHub API. A merged commit is -identified as `merge_commit`; an open PR is identified by its exact `head`. - -- LineageWeave PR #344: `merge_commit` - `497ac120c2ea22f97ef2e4a4bcd15fc2a3610046`, merged at - `2026-08-21T10:23:02Z`; focused tests passed before merge, while the - authorized-runtime browser result remains open. -- LineageWeave PR #367: `merge_commit` - `7a0d025215fbd9f6510727c7139885b561296149`, merged at - `2026-08-21T11:56:07Z`; focused parser tests passed before merge, while - authorized production/browser evidence remains open. -- LineageWeave PR #349: `head` - `2eb6d13903d8d20b27dfeccd476a149fdd801c1b`, base `main`; ontology - provenance explorer remains open and required Checks and independent - approval remain external gates. -- LineageWeave PR #368: `head` - `a3781119625e50213f64cbe1d04d045accf4e979`, base `main`; this baseline - checkpoint is updated by the stacked documentation PR for the newer queue - evidence below. -- LineageWeave PR #378: `merge_commit` - `333c705294a4faa76869f34d3e08dc09d760487d`, merged at - `2026-08-21T13:36:41Z`; this checkpoint's buyer-surface and exact-head - evidence is delivered in the merged baseline documentation. -- LineageWeave PR #366: `head` - `588dc91f5689d77281cd6bbd10a8e922f9eaa159`, base - `feat/lineage-dag-regression`; customer-master authorization - scope is implemented, while required Checks and independent approval remain - external gates. -- LineageWeave PR #369: `head` - `eb9e520cbac412b7f85f8ceddd86624515bb29cb`, base - `feat/ontology-provenance-explorer-v2130`; ontology source-window - continuation is open and required Checks and independent approval remain - external gates. -- LineageWeave PR #370: `head` - `d5495162fbf4950ca180d43d5c13a636f1889e0c`, base - `feat/lineage-dag-regression`; its runtime boundary fixes are - now part of the current Customer Master stack; required Checks and - independent approval remain external gates. -- LineageWeave PR #374: `head` - `fb0d185a2da707e57d2ed10900b06707126d8300`, base - `feat/ask-session-storage-key-v2202`; its post-chat atomic - reauthorization fix is stacked in PR #377. -- LineageWeave PR #376: `merge_commit` - `860545f7bece99359ec7b9840c675ddc14e9acbc`, merged at - `2026-08-21T13:10:45Z`; migration, relation-boundary, image-job transaction, - and overflow-test fixes are delivered in the Customer Master stack. -- LineageWeave PR #380: `merge_commit` - `9f8f4b742759e15ad34c7ef09c401dbc8b1d1ae5`, merged at - `2026-08-21T13:11:02Z`; the workspace-refresh and accessibility changes are - delivered in the current #370 head. -- LineageWeave PR #377: `head` - `a638e28af4345750e3be92f2b0f23012b24598e0`, base - `repair/global-ask-atomic-rollback-v2203`; post-chat rollback and test - cleanup are locally verified; required Checks and independent approval - remain external gates. -- LineageWeave PR #385: `head` - `d0c7decf4767902642c9805629bb8c7d5440ead8`, base - `feat/analysis-run-name-evidence-lineage`; stacked on PR #258's exact head - `481bdb6eafa1d3f074ca7d9d05275ce36a4708d8`, it hardens the external - lineage contract, removes the self-modifying repair workflow, and fixes the - responsive board CSS. Checks and independent approval remain external gates. -- LineageWeave PR #384: `head` - `caf3872ea48e565ba444d7b4b4042a9f3b7e61c5`, base - `docs/customer-master-scope-adr`; it normalizes padded source-detail-state - codes across filtering, ABAC, analysis eligibility, and content-worker - boundaries, removes authorization-only fields at report/calendar response - boundaries, and hides unavailable state filters. Checks and independent - approval remain external gates. -- LineageWeave PR #373: `head` - `84fd2993fcec5d3d683c391818f85e27ebd7347f`, base `main`; ontology - publication has unresolved review work and is not treated as delivered. -- LineageWeave PR #375: `merge_commit` - `fb0d185a2da707e57d2ed10900b06707126d8300`, merged at - `2026-08-21T13:18:01Z`; post-chat citation authorization is delivered in - the merged stack. This equals the open #374 head intentionally because the - stacked merge was fast-forwarded; the two PRs remain separately classified. -- LineageWeave PR #379: `merge_commit` - `b606c2553f877fa85968d90dc46598ce16897fbf`, merged at - `2026-08-21T13:19:00Z`; malformed provider replies and focused regression - coverage are delivered in the current PR #355 head. -- LineageWeave PR #355: `head` - `b606c2553f877fa85968d90dc46598ce16897fbf`, base `main`; it remains - open and is not treated as merged solely because stacked PR #379 merged. -- LineageWeave PR #382: `head` - `aab1e60c2c2ec4b57ca34585e5539d5ce1a7f9dd`, base - `ci/publish-ontology-pages-clean`; it carries the ontology-site safety - repair stacked on PR #373 and remains gated by Checks and approval. -- LineageWeave PR #383: `head` - `b0c9bc6466c77b9b53f5e0e17224c868bfe08be6`, base `main`; buyer-safe - worker diagnostics and distinct TEPP telemetry peer labeling remain gated - by Checks and approval. -- LineageWeave PR #384: `head` - `caf3872ea48e565ba444d7b4b4042a9f3b7e61c5`, base - `docs/customer-master-scope-adr`; source-detail state normalization, - buyer-safe report/calendar serialization, and empty-filter UX remain gated by - Checks and approval. -- LineageWeave PR #386: `head` - `57a013deb88fc0b23ae6448c1d3474c770360a5e`, base `main`; the login - build-type repair remains gated by Checks and approval. -- Legacy open PR #258: `head` - `481bdb6eafa1d3f074ca7d9d05275ce36a4708d8`, base `main`; hardening stack - #385 is open and parent delivery remains gated by Checks and review. -- Legacy open PR #262: `head` - `fcb9bd3ad4714380946d29c0889b940aceaa5496`, base - `feat/calendar-open-focus-event-lineage-v2140`; it remains unmerged and - separately gated. -- Legacy open PR #287: `head` - `9d2a536d7fba14f87a9fe4c9e7e578c16f97aea9`, base - `feat/global-ask-public-claim-verification-v2200`; it is conflicting and - remains unmerged. -- LineageWeave PR #371: `closed_without_merge` - head `4c3e43f9e96ecc2d868657dd9b0ce5524a15c76c`, closed at - `2026-08-21T11:59:57Z`; no merge commit exists, so ontology publication is - not claimed as delivered by this checkpoint. -- LineageWeave PR #345: `merge_commit` - `9316d281ae396cc1bc33ac3ba470a9e3afd41a90`, merged at - `2026-08-21T09:08:31Z`; application and Valkey caller OpenTelemetry spans - are merged, while raw telemetry remains outside buyer evidence. -- contextual-orchestrator PR #802: `merge_commit` - `407747626598d763a127509f81d23c2ad8aaee23`, merged at - `2026-08-21T11:42:06Z`; request session context is delivered through local - batch workers. -- contextual-orchestrator PR #805: `merge_commit` - `537915715c4b050d4b5fa18ce2b7559080c675ba`, merged at - `2026-08-21T11:45:58Z`; structured Responses and JSON-schema orchestration - are delivered in the merged upstream boundary. +`resolved` from intent alone. Observed at `2026-08-21T15:11:36Z` from the +GitHub API. A merged commit is identified as `merge_commit`; an open PR is +identified by its exact `head` and `base`. + +Recently merged into the protected repository: + +- PR #385: `merge_commit` `8b356a8399d40bcecc68a07bcfacab78eef303a0`. +- PR #366: `merge_commit` `ec6a829c88f9d2fdb6c34d2d089945aefb59c7a4`. +- PR #374: `merge_commit` `79c40bc8c25050084e5bbed62b8f145f6fa47775`. +- PR #262: `merge_commit` `6bf75991b04601483d48384045e314db2a928e30`. + +Open PRs at the same observation: + +- PR #258: `head` `8b356a8399d40bcecc68a07bcfacab78eef303a0`, base `main`. +- PR #287: `head` `0aedf64e2feac4feb33cf2f6c39f967e8eeb3c12`, base + `feat/global-ask-public-claim-verification-v2200`. +- PR #349: `head` `feb55d029eb9d17c2b4f01cf8c86366fb603206a`, base `main`. +- PR #355: `head` `b606c2553f877fa85968d90dc46598ce16897fbf`, base `main`. +- PR #368: `head` `76630661963e79a68c23cd58948953cc7b36bcad`, base `main`. +- PR #370: `head` `d5495162fbf4950ca180d43d5c13a636f1889e0c`, base + `feat/lineage-dag-regression`. +- PR #373: `head` `6b84bea10881e2f82fb676d5b01cf56f7d8f4adb`, base `main`. +- PR #382: `head` `91bf532b4a30a050f6431ae3a29fcab5ccfa99ed`, base + `ci/publish-ontology-pages-clean`. +- PR #383: `head` `720004942dd155a85020af32da402d320038f46a`, base `main`. +- PR #384: `head` `fb4bad5cb79d70b1a890f37cb651d0801fb61c16`, base + `docs/customer-master-scope-adr`. +- PR #386: `head` `57a013deb88fc0b23ae6448c1d3474c770360a5e`, base `main`. + +The open queue remains subject to exact-current-head Checks, formal independent +approval, and protected mergeability. Green Checks alone do not prove that a +merge is authorized. PR #385's merge is the current parent of PR #258; the +other open entries remain separate until their own merge commits are observed. ## 5. Local Buyer-Surface Verification From 79aa5739c4622079ea7011d2656676be09157c80 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 00:44:24 +0900 Subject: [PATCH 019/109] docs: define checkpoint closure and refresh queue --- docs/product-technical-gap-baseline.md | 29 +++++++++++++------------- 1 file changed, 14 insertions(+), 15 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index c4b3c27b2..42f257e1c 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -49,9 +49,12 @@ ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or -`resolved` from intent alone. Observed at `2026-08-21T15:11:36Z` from the -GitHub API. A merged commit is identified as `merge_commit`; an open PR is -identified by its exact `head` and `base`. +`resolved` from intent alone. Observed at `2026-08-21T15:43:49Z` from the +GitHub API. Checkpoint types are `merge_commit`, `head`, and +`closed_without_merge`; the latter records a closed PR's exact `head` when +`merged_at` and `merge_commit_sha` are both absent. A merged commit is +identified by `merge_commit`; an open PR is identified by its exact `head` and +`base`. Recently merged into the protected repository: @@ -63,20 +66,15 @@ Recently merged into the protected repository: Open PRs at the same observation: - PR #258: `head` `8b356a8399d40bcecc68a07bcfacab78eef303a0`, base `main`. -- PR #287: `head` `0aedf64e2feac4feb33cf2f6c39f967e8eeb3c12`, base - `feat/global-ask-public-claim-verification-v2200`. - PR #349: `head` `feb55d029eb9d17c2b4f01cf8c86366fb603206a`, base `main`. - PR #355: `head` `b606c2553f877fa85968d90dc46598ce16897fbf`, base `main`. -- PR #368: `head` `76630661963e79a68c23cd58948953cc7b36bcad`, base `main`. -- PR #370: `head` `d5495162fbf4950ca180d43d5c13a636f1889e0c`, base - `feat/lineage-dag-regression`. +- PR #368: `head` `34103b5b23503524cef6a6cf97b0e7b364b0f852`, base `main`. - PR #373: `head` `6b84bea10881e2f82fb676d5b01cf56f7d8f4adb`, base `main`. -- PR #382: `head` `91bf532b4a30a050f6431ae3a29fcab5ccfa99ed`, base +- PR #382: `head` `5eb707f02209a46d4d046480cec960ac40f59375`, base `ci/publish-ontology-pages-clean`. -- PR #383: `head` `720004942dd155a85020af32da402d320038f46a`, base `main`. -- PR #384: `head` `fb4bad5cb79d70b1a890f37cb651d0801fb61c16`, base +- PR #383: `head` `745113829469a7c09e03fe783ea942ca884f2ea6`, base `main`. +- PR #384: `head` `e8637fb82cb3abe216eaba64761d2a86011267e0`, base `docs/customer-master-scope-adr`. -- PR #386: `head` `57a013deb88fc0b23ae6448c1d3474c770360a5e`, base `main`. The open queue remains subject to exact-current-head Checks, formal independent approval, and protected mergeability. Green Checks alone do not prove that a @@ -134,9 +132,10 @@ GRC evidence subjects. ## 7. Next Implementation Order -1. Let the protected Checks and independent approvals complete for open stacked - PRs #377, #382, and #385, then revalidate parent PRs #374, #373, and #258 - at their exact current heads; PRs #367, #375, and #379 are already merged. +1. Let the protected Checks and independent approvals complete for open PRs + #258, #349, #355, #368, #373, #382, #383, and #384, then revalidate each + exact current head before merge; PRs #367, #375, #379, and #385 are already + merged. Verify the synthetic footnote/table cases in the authenticated browser and use the protected external corpus only for aggregate, non-identifying runtime evidence. From 8494d7f700b6afba10059d41f19165343c38676e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 00:46:35 +0900 Subject: [PATCH 020/109] docs: refresh current PR checkpoint evidence --- docs/product-technical-gap-baseline.md | 50 +++++++++++++++----------- 1 file changed, 29 insertions(+), 21 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index c4b3c27b2..c004343a5 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -49,7 +49,7 @@ ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or -`resolved` from intent alone. Observed at `2026-08-21T15:11:36Z` from the +`resolved` from intent alone. Observed at `2026-08-21T15:42:24Z` from the GitHub API. A merged commit is identified as `merge_commit`; an open PR is identified by its exact `head` and `base`. @@ -58,30 +58,38 @@ Recently merged into the protected repository: - PR #385: `merge_commit` `8b356a8399d40bcecc68a07bcfacab78eef303a0`. - PR #366: `merge_commit` `ec6a829c88f9d2fdb6c34d2d089945aefb59c7a4`. - PR #374: `merge_commit` `79c40bc8c25050084e5bbed62b8f145f6fa47775`. +- PR #375: `merge_commit` `fb0d185a2da707e57d2ed10900b06707126d8300`. +- PR #379: `merge_commit` `b606c2553f877fa85968d90dc46598ce16897fbf`. +- PR #370: `merge_commit` `aa38b29a95eed24de8073753552befc2e8cfaaae`. +- PR #369: `merge_commit` `6e591f4b7ec4da6acf768298d8d06f841e3a2372`. +- PR #287: `merge_commit` `bc8bcbee45c050cbd6775ca4f8455c00c25cc77d`. +- PR #367: `merge_commit` `7a0d025215fbd9f6510727c7139885b561296149`. - PR #262: `merge_commit` `6bf75991b04601483d48384045e314db2a928e30`. Open PRs at the same observation: -- PR #258: `head` `8b356a8399d40bcecc68a07bcfacab78eef303a0`, base `main`. -- PR #287: `head` `0aedf64e2feac4feb33cf2f6c39f967e8eeb3c12`, base - `feat/global-ask-public-claim-verification-v2200`. -- PR #349: `head` `feb55d029eb9d17c2b4f01cf8c86366fb603206a`, base `main`. -- PR #355: `head` `b606c2553f877fa85968d90dc46598ce16897fbf`, base `main`. -- PR #368: `head` `76630661963e79a68c23cd58948953cc7b36bcad`, base `main`. -- PR #370: `head` `d5495162fbf4950ca180d43d5c13a636f1889e0c`, base - `feat/lineage-dag-regression`. -- PR #373: `head` `6b84bea10881e2f82fb676d5b01cf56f7d8f4adb`, base `main`. -- PR #382: `head` `91bf532b4a30a050f6431ae3a29fcab5ccfa99ed`, base - `ci/publish-ontology-pages-clean`. -- PR #383: `head` `720004942dd155a85020af32da402d320038f46a`, base `main`. -- PR #384: `head` `fb4bad5cb79d70b1a890f37cb651d0801fb61c16`, base - `docs/customer-master-scope-adr`. -- PR #386: `head` `57a013deb88fc0b23ae6448c1d3474c770360a5e`, base `main`. +- PR #258: `head` `8b356a8399d40bcecc68a07bcfacab78eef303a0`, base `main` + (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). +- PR #349: `head` `feb55d029eb9d17c2b4f01cf8c86366fb603206a`, base `main` + (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). +- PR #355: `head` `b606c2553f877fa85968d90dc46598ce16897fbf`, base `main` + (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). +- PR #368: `head` `34103b5b23503524cef6a6cf97b0e7b364b0f852`, base `main` + (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). +- PR #373: `head` `6b84bea10881e2f82fb676d5b01cf56f7d8f4adb`, base `main` + (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). +- PR #382: `head` `5eb707f02209a46d4d046480cec960ac40f59375`, base + `ci/publish-ontology-pages-clean` (`6b84bea10881e2f82fb676d5b01cf56f7d8f4adb`). +- PR #383: `head` `745113829469a7c09e03fe783ea942ca884f2ea6`, base `main` + (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). +- PR #384: `head` `e8637fb82cb3abe216eaba64761d2a86011267e0`, base + `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). The open queue remains subject to exact-current-head Checks, formal independent approval, and protected mergeability. Green Checks alone do not prove that a -merge is authorized. PR #385's merge is the current parent of PR #258; the -other open entries remain separate until their own merge commits are observed. +merge is authorized. PR #385's merge is the current parent of PR #258; PR #386 +is closed as a duplicate of the safer #373 login fix. The other open entries +remain separate until their own merge commits are observed. ## 5. Local Buyer-Surface Verification @@ -134,9 +142,9 @@ GRC evidence subjects. ## 7. Next Implementation Order -1. Let the protected Checks and independent approvals complete for open stacked - PRs #377, #382, and #385, then revalidate parent PRs #374, #373, and #258 - at their exact current heads; PRs #367, #375, and #379 are already merged. +1. Revalidate open PRs #258, #349, #355, #368, #373, #382, #383, and #384 at + their exact current heads as Checks and formal independent approvals arrive; + process stacked parents only after their child merge commits are observed. Verify the synthetic footnote/table cases in the authenticated browser and use the protected external corpus only for aggregate, non-identifying runtime evidence. From f6dd05809352057bf4cb6f27db76bf097ddbf58a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 00:50:27 +0900 Subject: [PATCH 021/109] docs: refresh latest PR heads --- docs/product-technical-gap-baseline.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 830bcb23b..338000e82 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -49,7 +49,7 @@ ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or -`resolved` from intent alone. Observed at `2026-08-21T15:47:03Z` from the +`resolved` from intent alone. Observed at `2026-08-21T15:50:14Z` from the GitHub API. Checkpoint types are `merge_commit`, `head`, and `closed_without_merge`; the latter records a closed PR's exact `head` when `merged_at` and `merge_commit_sha` are both absent. A merged commit is @@ -73,7 +73,7 @@ Open PRs at the same observation: - PR #258: `head` `8b356a8399d40bcecc68a07bcfacab78eef303a0`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #349: `head` `feb55d029eb9d17c2b4f01cf8c86366fb603206a`, base `main` +- PR #349: `head` `df125094b93454cc61679a16b4b1c122c3f355ae`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #355: `head` `b606c2553f877fa85968d90dc46598ce16897fbf`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). @@ -85,7 +85,7 @@ Open PRs at the same observation: `ci/publish-ontology-pages-clean` (`6b84bea10881e2f82fb676d5b01cf56f7d8f4adb`). - PR #383: `head` `745113829469a7c09e03fe783ea942ca884f2ea6`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #384: `head` `e8637fb82cb3abe216eaba64761d2a86011267e0`, base +- PR #384: `head` `341a8527771ce3703eab57db6bf9f6ee02174fd5`, base `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). The open queue remains subject to exact-current-head Checks, formal independent From dbe40c2ae174419b65b12777018869b8e1f3bcd8 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 01:02:43 +0900 Subject: [PATCH 022/109] docs: record latest runtime readiness gap --- docs/product-technical-gap-baseline.md | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 338000e82..16edd1376 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -49,7 +49,7 @@ ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or -`resolved` from intent alone. Observed at `2026-08-21T15:50:14Z` from the +`resolved` from intent alone. Observed at `2026-08-21T16:01:40Z` from the GitHub API. Checkpoint types are `merge_commit`, `head`, and `closed_without_merge`; the latter records a closed PR's exact `head` when `merged_at` and `merge_commit_sha` are both absent. A merged commit is @@ -71,13 +71,13 @@ Recently merged into the protected repository: Open PRs at the same observation: -- PR #258: `head` `8b356a8399d40bcecc68a07bcfacab78eef303a0`, base `main` +- PR #258: `head` `53ce1a53612c190f77bf584bb526e884d590dc60`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #349: `head` `df125094b93454cc61679a16b4b1c122c3f355ae`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #355: `head` `b606c2553f877fa85968d90dc46598ce16897fbf`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #368: `head` `79aa5739c4622079ea7011d2656676be09157c80`, base `main` +- PR #368: `head` `f6dd05809352057bf4cb6f27db76bf097ddbf58a`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #373: `head` `6b84bea10881e2f82fb676d5b01cf56f7d8f4adb`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). @@ -134,6 +134,17 @@ synthetic Keycloak account and aggregate-only assertions: this repository. Image-heavy processing remains an explicit processing-state gap, not a live-success claim. +Observed at `2026-08-21T16:01:40Z` in a fresh local Compose browser session: + +- OIDC login, an authorized post click, popup close, and the phone-width menu + trigger all completed. The popup opened, but the summary request returned + HTTP 503; no generated summary, 5W1H, VISION evidence, or graph rendering is + claimed from this run. +- The local orchestrator returned HTTP 200 for its authenticated model + inventory with nine registered models. A synthetic `mode=auto` completion did + not complete within 30 seconds, so provider/model readiness remains open even + though the Compose services are running. + These observations are runtime evidence, not a claim that the corresponding PRs are merged. The image-processing state and protected-corpus parsing cases remain open gaps. From 0056e9c3406dc554489ab7d040f19779fa2daacd Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 01:04:02 +0900 Subject: [PATCH 023/109] docs: refresh concurrent PR checkpoint --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 16edd1376..a0e3da094 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -49,7 +49,7 @@ ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or -`resolved` from intent alone. Observed at `2026-08-21T16:01:40Z` from the +`resolved` from intent alone. Observed at `2026-08-21T16:03:49Z` from the GitHub API. Checkpoint types are `merge_commit`, `head`, and `closed_without_merge`; the latter records a closed PR's exact `head` when `merged_at` and `merge_commit_sha` are both absent. A merged commit is @@ -85,7 +85,7 @@ Open PRs at the same observation: `ci/publish-ontology-pages-clean` (`6b84bea10881e2f82fb676d5b01cf56f7d8f4adb`). - PR #383: `head` `745113829469a7c09e03fe783ea942ca884f2ea6`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #384: `head` `341a8527771ce3703eab57db6bf9f6ee02174fd5`, base +- PR #384: `head` `86e2f4dbadaf0c31d93fd38dfc1684ab7f19ef01`, base `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). The open queue remains subject to exact-current-head Checks, formal independent From 25e37fbb88737f5eb37f8fa107530491ab99793e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 01:12:21 +0900 Subject: [PATCH 024/109] docs: explain stacked checkpoint identity --- docs/product-technical-gap-baseline.md | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index a0e3da094..1181f89c8 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -49,7 +49,7 @@ ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or -`resolved` from intent alone. Observed at `2026-08-21T16:03:49Z` from the +`resolved` from intent alone. Observed at `2026-08-21T16:10:57Z` from the GitHub API. Checkpoint types are `merge_commit`, `head`, and `closed_without_merge`; the latter records a closed PR's exact `head` when `merged_at` and `merge_commit_sha` are both absent. A merged commit is @@ -76,16 +76,19 @@ Open PRs at the same observation: - PR #349: `head` `df125094b93454cc61679a16b4b1c122c3f355ae`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #355: `head` `b606c2553f877fa85968d90dc46598ce16897fbf`, base `main` - (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #368: `head` `f6dd05809352057bf4cb6f27db76bf097ddbf58a`, base `main` + (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). The overlap with PR #379's + merge commit is intentional: #355 is the open successor from the same + feature branch, now pointing at that merged branch tip, and is not itself + merged. +- PR #368: `head` `0056e9c3406dc554489ab7d040f19779fa2daacd`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #373: `head` `6b84bea10881e2f82fb676d5b01cf56f7d8f4adb`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #382: `head` `5eb707f02209a46d4d046480cec960ac40f59375`, base `ci/publish-ontology-pages-clean` (`6b84bea10881e2f82fb676d5b01cf56f7d8f4adb`). -- PR #383: `head` `745113829469a7c09e03fe783ea942ca884f2ea6`, base `main` +- PR #383: `head` `46e4d6d69c1964f0cbeb761281071db7861e31dd`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #384: `head` `86e2f4dbadaf0c31d93fd38dfc1684ab7f19ef01`, base +- PR #384: `head` `140f91ee246b4723a70da004258f4a14fcca4b5b`, base `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). The open queue remains subject to exact-current-head Checks, formal independent From 6763df96037a625aa83adaac73e9908b036a91f7 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 01:16:42 +0900 Subject: [PATCH 025/109] docs: record current UI and summary readiness evidence --- docs/product-technical-gap-baseline.md | 28 ++++++++++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 1181f89c8..44635dd49 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -49,7 +49,7 @@ ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or -`resolved` from intent alone. Observed at `2026-08-21T16:10:57Z` from the +`resolved` from intent alone. Observed at `2026-08-21T16:16:02Z` from the GitHub API. Checkpoint types are `merge_commit`, `head`, and `closed_without_merge`; the latter records a closed PR's exact `head` when `merged_at` and `merge_commit_sha` are both absent. A merged commit is @@ -88,7 +88,7 @@ Open PRs at the same observation: `ci/publish-ontology-pages-clean` (`6b84bea10881e2f82fb676d5b01cf56f7d8f4adb`). - PR #383: `head` `46e4d6d69c1964f0cbeb761281071db7861e31dd`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #384: `head` `140f91ee246b4723a70da004258f4a14fcca4b5b`, base +- PR #384: `head` `0cbcededefad6d916947c74c073a2e010866139b`, base `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). The open queue remains subject to exact-current-head Checks, formal independent @@ -152,6 +152,30 @@ These observations are runtime evidence, not a claim that the corresponding PRs are merged. The image-processing state and protected-corpus parsing cases remain open gaps. +Observed at `2026-08-21T16:16:02Z` in a fresh local Compose browser session +against the authenticated React surface: + +- The UI/UX Guide v3.0 viewport checks passed at 1920×1080, 1280×1024, + 1024×768, 768×1024, and 375×667: each rendered document had no horizontal + overflow, the authenticated header was sticky, the footer was present, and + the phone drawer became visible only below the phone tier. +- The post popup opened and closed. Its DOM exposed Summary, Key events, and + Event Lineage/graph sections; no R&R rows were rendered because the summary + request returned HTTP 503 before an evidence object existed. This is not + evidence that the R&R component is absent: `App.tsx` still renders it when + persisted roles are available. +- The summary response explained the current buyer-visible gap: `Post summary + is unavailable: image evidence is still being processed`. Aggregate + PostgreSQL evidence was 43,839 source posts, 401 empty-body posts, 97 + persisted summaries, and zero summaries at current contract version 13. + The content-ingestion job registry had 18 failed and zero queued/running + jobs; no live image-summary completion is claimed. +- PR #384's popup CSS was then reduced to the standard three responsive tiers + by removing its extra 1280px media query; the focused CSS contract, full + frontend test suite (199 tests), lint, TypeScript, and production build all + passed locally. The change is pushed at the exact PR head recorded above; + hosted Checks and independent approval remain open. + ## 6. Organization OpenTelemetry Evidence Boundary GRC PR #42 records organization-level OTEL acceptance evidence through the From 5ec4d5adf1162666afa3df0a4dfd27f9706100b4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 01:26:55 +0900 Subject: [PATCH 026/109] docs: refresh current PR head evidence --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 44635dd49..cea70e8c8 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -88,7 +88,7 @@ Open PRs at the same observation: `ci/publish-ontology-pages-clean` (`6b84bea10881e2f82fb676d5b01cf56f7d8f4adb`). - PR #383: `head` `46e4d6d69c1964f0cbeb761281071db7861e31dd`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #384: `head` `0cbcededefad6d916947c74c073a2e010866139b`, base +- PR #384: `head` `c8f7c4a4096a671178e659edeec01468e9ad2a9d`, base `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). The open queue remains subject to exact-current-head Checks, formal independent From a79213baf478482a26a19d36ce189cd91a2b5369 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 01:28:32 +0900 Subject: [PATCH 027/109] docs: record bounded multimodal retry evidence --- docs/product-technical-gap-baseline.md | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index cea70e8c8..41ae68a57 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -49,7 +49,7 @@ ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or -`resolved` from intent alone. Observed at `2026-08-21T16:16:02Z` from the +`resolved` from intent alone. Observed at `2026-08-21T16:28:12Z` from the GitHub API. Checkpoint types are `merge_commit`, `head`, and `closed_without_merge`; the latter records a closed PR's exact `head` when `merged_at` and `merge_commit_sha` are both absent. A merged commit is @@ -152,6 +152,20 @@ These observations are runtime evidence, not a claim that the corresponding PRs are merged. The image-processing state and protected-corpus parsing cases remain open gaps. +Observed at `2026-08-21T16:28:12Z` after one bounded operator retry through +the real Compose backend, Valkey, and orchestrator boundary: + +- One terminal image-ingestion job completed with `succeeded` after roughly + eight minutes. Its content endpoint reported `ready` with nine semantic + units and one image; aggregate described images increased from 24 to 25. +- The same post's summary request was still pending after a 15-second browser + observation window, and PostgreSQL still contained zero summaries at current + contract version 13. This proves one bounded multimodal persistence path, + not end-to-end Korean summary readiness or corpus completion. +- The remaining aggregate image state was 421 `failed` and 12,377 + `unavailable` images. Do not bulk retry until provider throughput, bounded + retry policy, and buyer-visible failure/retry UX are separately accepted. + Observed at `2026-08-21T16:16:02Z` in a fresh local Compose browser session against the authenticated React surface: From a1550c96abbb1d545c632980be00ac60bb589cc5 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 01:29:16 +0900 Subject: [PATCH 028/109] docs: record final summary-status head --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 41ae68a57..cedf1c13e 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -88,7 +88,7 @@ Open PRs at the same observation: `ci/publish-ontology-pages-clean` (`6b84bea10881e2f82fb676d5b01cf56f7d8f4adb`). - PR #383: `head` `46e4d6d69c1964f0cbeb761281071db7861e31dd`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #384: `head` `c8f7c4a4096a671178e659edeec01468e9ad2a9d`, base +- PR #384: `head` `cc0b50aa0838701582b373e1310279d6014c17db`, base `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). The open queue remains subject to exact-current-head Checks, formal independent From 3e564513beae35f222630f944c17859355439127 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 01:38:47 +0900 Subject: [PATCH 029/109] docs: refresh exact PR evidence checkpoint --- docs/product-technical-gap-baseline.md | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index cedf1c13e..ee4015c7e 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -49,7 +49,7 @@ ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or -`resolved` from intent alone. Observed at `2026-08-21T16:28:12Z` from the +`resolved` from intent alone. Observed at `2026-08-21T16:37:48Z` from the GitHub API. Checkpoint types are `merge_commit`, `head`, and `closed_without_merge`; the latter records a closed PR's exact `head` when `merged_at` and `merge_commit_sha` are both absent. A merged commit is @@ -71,16 +71,16 @@ Recently merged into the protected repository: Open PRs at the same observation: -- PR #258: `head` `53ce1a53612c190f77bf584bb526e884d590dc60`, base `main` +- PR #258: `head` `a3cf51e9fe34097fab41c2d160bf93c4ad48ddb0`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #349: `head` `df125094b93454cc61679a16b4b1c122c3f355ae`, base `main` +- PR #349: `head` `129d505bfde6cd3a1d74581e6d7870cca62f5a3b`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #355: `head` `b606c2553f877fa85968d90dc46598ce16897fbf`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). The overlap with PR #379's merge commit is intentional: #355 is the open successor from the same feature branch, now pointing at that merged branch tip, and is not itself merged. -- PR #368: `head` `0056e9c3406dc554489ab7d040f19779fa2daacd`, base `main` +- PR #368: `head` `a1550c96abbb1d545c632980be00ac60bb589cc5`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #373: `head` `6b84bea10881e2f82fb676d5b01cf56f7d8f4adb`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). @@ -152,7 +152,7 @@ These observations are runtime evidence, not a claim that the corresponding PRs are merged. The image-processing state and protected-corpus parsing cases remain open gaps. -Observed at `2026-08-21T16:28:12Z` after one bounded operator retry through +Observed at `2026-08-21T16:37:48Z` after one bounded operator retry through the real Compose backend, Valkey, and orchestrator boundary: - One terminal image-ingestion job completed with `succeeded` after roughly @@ -165,6 +165,12 @@ the real Compose backend, Valkey, and orchestrator boundary: - The remaining aggregate image state was 421 `failed` and 12,377 `unavailable` images. Do not bulk retry until provider throughput, bounded retry policy, and buyer-visible failure/retry UX are separately accepted. +- PR #258's exact head `a3cf51e9fe34097fab41c2d160bf93c4ad48ddb0` now + restarts a whole lineage group when an optional LLM adjudication channel + fails mid-group, preventing mixed LLM and deterministic edge scores. Local + verification at that head passed 976 backend tests (17 environment skips), + 221 frontend tests, lint, and production build; hosted Checks remain queued + and no independent approval or merge commit is present. Observed at `2026-08-21T16:16:02Z` in a fresh local Compose browser session against the authenticated React surface: @@ -185,10 +191,11 @@ against the authenticated React surface: The content-ingestion job registry had 18 failed and zero queued/running jobs; no live image-summary completion is claimed. - PR #384's popup CSS was then reduced to the standard three responsive tiers - by removing its extra 1280px media query; the focused CSS contract, full - frontend test suite (199 tests), lint, TypeScript, and production build all - passed locally. The change is pushed at the exact PR head recorded above; - hosted Checks and independent approval remain open. + by removing its extra 1280px media query. The focused CSS contract, lint, + TypeScript, and production build passed locally after the final concurrent + head was reconciled; the earlier 199-test full-suite result preceded that + concurrent commit and is not claimed as final-head evidence. Hosted Checks + and independent approval remain open. ## 6. Organization OpenTelemetry Evidence Boundary From b6ffe3b8d303088da761bcd80b13c3308964b42e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 01:42:08 +0900 Subject: [PATCH 030/109] docs: bind baseline to checkpoint parent --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index ee4015c7e..d50f44ff5 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -80,7 +80,7 @@ Open PRs at the same observation: merge commit is intentional: #355 is the open successor from the same feature branch, now pointing at that merged branch tip, and is not itself merged. -- PR #368: `head` `a1550c96abbb1d545c632980be00ac60bb589cc5`, base `main` +- PR #368: `head` `3e564513beae35f222630f944c17859355439127`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #373: `head` `6b84bea10881e2f82fb676d5b01cf56f7d8f4adb`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). From 2863a08946ce5f7ecc40d7960dfdb6b70522155a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 01:43:21 +0900 Subject: [PATCH 031/109] docs: refresh exact current PR checkpoint --- docs/product-technical-gap-baseline.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index d50f44ff5..5f60a0631 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -49,7 +49,7 @@ ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or -`resolved` from intent alone. Observed at `2026-08-21T16:37:48Z` from the +`resolved` from intent alone. Observed at `2026-08-21T16:42:30Z` from the GitHub API. Checkpoint types are `merge_commit`, `head`, and `closed_without_merge`; the latter records a closed PR's exact `head` when `merged_at` and `merge_commit_sha` are both absent. A merged commit is @@ -73,14 +73,14 @@ Open PRs at the same observation: - PR #258: `head` `a3cf51e9fe34097fab41c2d160bf93c4ad48ddb0`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #349: `head` `129d505bfde6cd3a1d74581e6d7870cca62f5a3b`, base `main` +- PR #349: `head` `2d18879e8a7f93b08e32aa4261610e34700e1892`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #355: `head` `b606c2553f877fa85968d90dc46598ce16897fbf`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). The overlap with PR #379's merge commit is intentional: #355 is the open successor from the same feature branch, now pointing at that merged branch tip, and is not itself merged. -- PR #368: `head` `3e564513beae35f222630f944c17859355439127`, base `main` +- PR #368: `head` `b6ffe3b8d303088da761bcd80b13c3308964b42e`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #373: `head` `6b84bea10881e2f82fb676d5b01cf56f7d8f4adb`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). From c00e35c55a26fb3caba592c42e322aa1f289315b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 01:45:32 +0900 Subject: [PATCH 032/109] docs: record latest PR258 verification --- docs/product-technical-gap-baseline.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 5f60a0631..e28061162 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -49,7 +49,7 @@ ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or -`resolved` from intent alone. Observed at `2026-08-21T16:42:30Z` from the +`resolved` from intent alone. Observed at `2026-08-21T16:45:06Z` from the GitHub API. Checkpoint types are `merge_commit`, `head`, and `closed_without_merge`; the latter records a closed PR's exact `head` when `merged_at` and `merge_commit_sha` are both absent. A merged commit is @@ -71,7 +71,7 @@ Recently merged into the protected repository: Open PRs at the same observation: -- PR #258: `head` `a3cf51e9fe34097fab41c2d160bf93c4ad48ddb0`, base `main` +- PR #258: `head` `6621eb116a4e92eb33eeae989c70fbc602450c51`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #349: `head` `2d18879e8a7f93b08e32aa4261610e34700e1892`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). @@ -80,7 +80,7 @@ Open PRs at the same observation: merge commit is intentional: #355 is the open successor from the same feature branch, now pointing at that merged branch tip, and is not itself merged. -- PR #368: `head` `b6ffe3b8d303088da761bcd80b13c3308964b42e`, base `main` +- PR #368: `head` `2863a08946ce5f7ecc40d7960dfdb6b70522155a`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #373: `head` `6b84bea10881e2f82fb676d5b01cf56f7d8f4adb`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). @@ -165,12 +165,15 @@ the real Compose backend, Valkey, and orchestrator boundary: - The remaining aggregate image state was 421 `failed` and 12,377 `unavailable` images. Do not bulk retry until provider throughput, bounded retry policy, and buyer-visible failure/retry UX are separately accepted. -- PR #258's exact head `a3cf51e9fe34097fab41c2d160bf93c4ad48ddb0` now +- PR #258's exact head `6621eb116a4e92eb33eeae989c70fbc602450c51` now restarts a whole lineage group when an optional LLM adjudication channel fails mid-group, preventing mixed LLM and deterministic edge scores. Local verification at that head passed 976 backend tests (17 environment skips), 221 frontend tests, lint, and production build; hosted Checks remain queued and no independent approval or merge commit is present. +- PR #258 then corrected the Unreleased changelog's Buyer-terminology ADR + reference from 0119 to the governing ADR 0131; the focused reconstruction + and adjudication tests still passed at the pushed documentation head. Observed at `2026-08-21T16:16:02Z` in a fresh local Compose browser session against the authenticated React surface: From 416d0f5d839decf666f8b4bd6c4d7c2d4264ba39 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 01:49:52 +0900 Subject: [PATCH 033/109] docs: record stacked ontology merge --- docs/product-technical-gap-baseline.md | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index e28061162..709748c9f 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -49,7 +49,7 @@ ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or -`resolved` from intent alone. Observed at `2026-08-21T16:45:06Z` from the +`resolved` from intent alone. Observed at `2026-08-21T16:49:31Z` from the GitHub API. Checkpoint types are `merge_commit`, `head`, and `closed_without_merge`; the latter records a closed PR's exact `head` when `merged_at` and `merge_commit_sha` are both absent. A merged commit is @@ -69,6 +69,11 @@ Recently merged into the protected repository: - PR #367: `merge_commit` `7a0d025215fbd9f6510727c7139885b561296149`. - PR #262: `merge_commit` `6bf75991b04601483d48384045e314db2a928e30`. +Recently merged into an open stack base (not main): + +- PR #382: `merge_commit` `43e24783ae38d65d03df7cb901f93b8ac8731b9b`, merged + into PR #373's `ci/publish-ontology-pages-clean` base. + Open PRs at the same observation: - PR #258: `head` `6621eb116a4e92eb33eeae989c70fbc602450c51`, base `main` @@ -82,10 +87,8 @@ Open PRs at the same observation: merged. - PR #368: `head` `2863a08946ce5f7ecc40d7960dfdb6b70522155a`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #373: `head` `6b84bea10881e2f82fb676d5b01cf56f7d8f4adb`, base `main` +- PR #373: `head` `43e24783ae38d65d03df7cb901f93b8ac8731b9b`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #382: `head` `5eb707f02209a46d4d046480cec960ac40f59375`, base - `ci/publish-ontology-pages-clean` (`6b84bea10881e2f82fb676d5b01cf56f7d8f4adb`). - PR #383: `head` `46e4d6d69c1964f0cbeb761281071db7861e31dd`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #384: `head` `cc0b50aa0838701582b373e1310279d6014c17db`, base @@ -94,8 +97,8 @@ Open PRs at the same observation: The open queue remains subject to exact-current-head Checks, formal independent approval, and protected mergeability. Green Checks alone do not prove that a merge is authorized. PR #385's merge is the current parent of PR #258; PR #386 -is closed as a duplicate of the safer #373 login fix. The other open entries -remain separate until their own merge commits are observed. +is closed as a duplicate of the safer #373 login fix. PR #382's stack merge is +not a main merge; #373 must still pass its own current-head gates. Closed without merge at the same observation: From 69f245b0b1bcfd795c01aa26fd009cd8760ef5f5 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 02:03:49 +0900 Subject: [PATCH 034/109] docs: record event lineage evidence review baseline --- docs/product-technical-gap-baseline.md | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 709748c9f..95c1c5e6e 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -49,7 +49,7 @@ ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or -`resolved` from intent alone. Observed at `2026-08-21T16:49:31Z` from the +`resolved` from intent alone. Observed at `2026-08-21T17:02:57Z` from the GitHub API. Checkpoint types are `merge_commit`, `head`, and `closed_without_merge`; the latter records a closed PR's exact `head` when `merged_at` and `merge_commit_sha` are both absent. A merged commit is @@ -85,7 +85,8 @@ Open PRs at the same observation: merge commit is intentional: #355 is the open successor from the same feature branch, now pointing at that merged branch tip, and is not itself merged. -- PR #368: `head` `2863a08946ce5f7ecc40d7960dfdb6b70522155a`, base `main` +- PR #368: `head` `416d0f5d839decf666f8b4bd6c4d7c2d4264ba39` (the checkpoint + parent before this baseline update), base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #373: `head` `43e24783ae38d65d03df7cb901f93b8ac8731b9b`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). @@ -93,6 +94,8 @@ Open PRs at the same observation: (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #384: `head` `cc0b50aa0838701582b373e1310279d6014c17db`, base `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). +- PR #387: `head` `10cf59eef692d16a8e828b799f7e859251c09c00`, base `main` + (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). The open queue remains subject to exact-current-head Checks, formal independent approval, and protected mergeability. Green Checks alone do not prove that a @@ -203,6 +206,21 @@ against the authenticated React surface: concurrent commit and is not claimed as final-head evidence. Hosted Checks and independent approval remain open. +Observed at `2026-08-21T17:02:57Z` on PR #387's exact head +`10cf59eef692d16a8e828b799f7e859251c09c00`: + +- A real PostgreSQL schema fixture initially raised `NameError` because the + 0102 project-event migration path was missing. The fixture now applies 0102 + before 0105; the focused schema and lineage tests passed. +- The API fixture now applies the 0105 channel-evidence migration, and the + rebuild endpoint passes the configured contextual-orchestrator adjudication + client. Local backend regression passed 768 tests with 17 environment skips; + frontend lint, 143 Vitest tests, and production build passed. +- Devin's remaining observations about uniform channel sets and LLM + availability are documented as invariants/optional-channel behavior in ADR + 0124; active weight ordering was made deterministic. Hosted Checks are + queued and no independent approval or merge commit is claimed. + ## 6. Organization OpenTelemetry Evidence Boundary GRC PR #42 records organization-level OTEL acceptance evidence through the @@ -215,7 +233,7 @@ GRC evidence subjects. ## 7. Next Implementation Order -1. Revalidate open PRs #258, #349, #355, #368, #373, #382, #383, and #384 at +1. Revalidate open PRs #258, #349, #355, #368, #373, #383, #384, and #387 at their exact current heads as Checks and formal independent approvals arrive; process stacked parents only after their child merge commits are observed. Verify the synthetic footnote/table cases in the authenticated browser and From 66a66a91e9c0a75087ae09c2edf1b04876fbd864 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 02:08:12 +0900 Subject: [PATCH 035/109] docs: track latest event lineage review head --- docs/product-technical-gap-baseline.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 95c1c5e6e..bcf894626 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -49,7 +49,7 @@ ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or -`resolved` from intent alone. Observed at `2026-08-21T17:02:57Z` from the +`resolved` from intent alone. Observed at `2026-08-21T17:07:44Z` from the GitHub API. Checkpoint types are `merge_commit`, `head`, and `closed_without_merge`; the latter records a closed PR's exact `head` when `merged_at` and `merge_commit_sha` are both absent. A merged commit is @@ -85,7 +85,7 @@ Open PRs at the same observation: merge commit is intentional: #355 is the open successor from the same feature branch, now pointing at that merged branch tip, and is not itself merged. -- PR #368: `head` `416d0f5d839decf666f8b4bd6c4d7c2d4264ba39` (the checkpoint +- PR #368: `head` `69f245b0b1bcfd795c01aa26fd009cd8760ef5f5` (the checkpoint parent before this baseline update), base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #373: `head` `43e24783ae38d65d03df7cb901f93b8ac8731b9b`, base `main` @@ -94,7 +94,7 @@ Open PRs at the same observation: (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #384: `head` `cc0b50aa0838701582b373e1310279d6014c17db`, base `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). -- PR #387: `head` `10cf59eef692d16a8e828b799f7e859251c09c00`, base `main` +- PR #387: `head` `2c47b353bd71dba78b720edf14bf5708c314f4a0`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). The open queue remains subject to exact-current-head Checks, formal independent @@ -206,16 +206,17 @@ against the authenticated React surface: concurrent commit and is not claimed as final-head evidence. Hosted Checks and independent approval remain open. -Observed at `2026-08-21T17:02:57Z` on PR #387's exact head -`10cf59eef692d16a8e828b799f7e859251c09c00`: +Observed at `2026-08-21T17:07:44Z` on PR #387's exact head +`2c47b353bd71dba78b720edf14bf5708c314f4a0`: - A real PostgreSQL schema fixture initially raised `NameError` because the 0102 project-event migration path was missing. The fixture now applies 0102 before 0105; the focused schema and lineage tests passed. - The API fixture now applies the 0105 channel-evidence migration, and the rebuild endpoint passes the configured contextual-orchestrator adjudication - client. Local backend regression passed 768 tests with 17 environment skips; - frontend lint, 143 Vitest tests, and production build passed. + client; the PostgreSQL import path preserves the same client. Local backend + regression passed 768 tests with 17 environment skips; frontend lint, 143 + Vitest tests, and production build passed. - Devin's remaining observations about uniform channel sets and LLM availability are documented as invariants/optional-channel behavior in ADR 0124; active weight ordering was made deterministic. Hosted Checks are From 22cf9d8b6463fc46c7927d8fef6e2b12a25cd776 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 02:10:37 +0900 Subject: [PATCH 036/109] docs: record orchestrator boundary ADR update --- docs/product-technical-gap-baseline.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index bcf894626..f4ab8a9f9 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -49,7 +49,7 @@ ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or -`resolved` from intent alone. Observed at `2026-08-21T17:07:44Z` from the +`resolved` from intent alone. Observed at `2026-08-21T17:10:21Z` from the GitHub API. Checkpoint types are `merge_commit`, `head`, and `closed_without_merge`; the latter records a closed PR's exact `head` when `merged_at` and `merge_commit_sha` are both absent. A merged commit is @@ -85,7 +85,7 @@ Open PRs at the same observation: merge commit is intentional: #355 is the open successor from the same feature branch, now pointing at that merged branch tip, and is not itself merged. -- PR #368: `head` `69f245b0b1bcfd795c01aa26fd009cd8760ef5f5` (the checkpoint +- PR #368: `head` `66a66a91c4f8ec3cfb2fc47e6ef5390b38c9b62f` (the checkpoint parent before this baseline update), base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #373: `head` `43e24783ae38d65d03df7cb901f93b8ac8731b9b`, base `main` @@ -94,7 +94,7 @@ Open PRs at the same observation: (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #384: `head` `cc0b50aa0838701582b373e1310279d6014c17db`, base `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). -- PR #387: `head` `2c47b353bd71dba78b720edf14bf5708c314f4a0`, base `main` +- PR #387: `head` `4faf9a31c295205b8fdbb4e43736fdbdc9aa1f6c`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). The open queue remains subject to exact-current-head Checks, formal independent @@ -206,8 +206,8 @@ against the authenticated React surface: concurrent commit and is not claimed as final-head evidence. Hosted Checks and independent approval remain open. -Observed at `2026-08-21T17:07:44Z` on PR #387's exact head -`2c47b353bd71dba78b720edf14bf5708c314f4a0`: +Observed at `2026-08-21T17:10:21Z` on PR #387's exact head +`4faf9a31c295205b8fdbb4e43736fdbdc9aa1f6c`: - A real PostgreSQL schema fixture initially raised `NameError` because the 0102 project-event migration path was missing. The fixture now applies 0102 @@ -219,8 +219,9 @@ Observed at `2026-08-21T17:07:44Z` on PR #387's exact head Vitest tests, and production build passed. - Devin's remaining observations about uniform channel sets and LLM availability are documented as invariants/optional-channel behavior in ADR - 0124; active weight ordering was made deterministic. Hosted Checks are - queued and no independent approval or merge commit is claimed. + 0124; active weight ordering was made deterministic, and the ADR now records + the orchestrated rebuild/import boundary. Hosted Checks are queued and no + independent approval or merge commit is claimed. ## 6. Organization OpenTelemetry Evidence Boundary From aa9feaa24dd605f7aec6a46ab38e661e45d31044 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 02:11:08 +0900 Subject: [PATCH 037/109] docs: correct lineage review exact head --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index f4ab8a9f9..63f83edf4 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -94,7 +94,7 @@ Open PRs at the same observation: (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #384: `head` `cc0b50aa0838701582b373e1310279d6014c17db`, base `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). -- PR #387: `head` `4faf9a31c295205b8fdbb4e43736fdbdc9aa1f6c`, base `main` +- PR #387: `head` `4faf9a31371195c5ec63fca42a5afbb93a95369b`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). The open queue remains subject to exact-current-head Checks, formal independent @@ -207,7 +207,7 @@ against the authenticated React surface: and independent approval remain open. Observed at `2026-08-21T17:10:21Z` on PR #387's exact head -`4faf9a31c295205b8fdbb4e43736fdbdc9aa1f6c`: +`4faf9a31371195c5ec63fca42a5afbb93a95369b`: - A real PostgreSQL schema fixture initially raised `NameError` because the 0102 project-event migration path was missing. The fixture now applies 0102 From dcc916cd68d8ae3c495563332658fd0cbf8d760e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 02:11:37 +0900 Subject: [PATCH 038/109] docs: keep baseline self-head checkpoint exact --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 63f83edf4..238723a7a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -85,7 +85,7 @@ Open PRs at the same observation: merge commit is intentional: #355 is the open successor from the same feature branch, now pointing at that merged branch tip, and is not itself merged. -- PR #368: `head` `66a66a91c4f8ec3cfb2fc47e6ef5390b38c9b62f` (the checkpoint +- PR #368: `head` `22cf9d8b6463fc46c7927d8fef6e2b12a25cd776` (the checkpoint parent before this baseline update), base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #373: `head` `43e24783ae38d65d03df7cb901f93b8ac8731b9b`, base `main` From a7782ec05198e137399e1543cefa6a732693b0f6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 02:18:44 +0900 Subject: [PATCH 039/109] docs: align evidence baseline with current PR state --- docs/product-technical-gap-baseline.md | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 238723a7a..86822efbc 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -85,8 +85,8 @@ Open PRs at the same observation: merge commit is intentional: #355 is the open successor from the same feature branch, now pointing at that merged branch tip, and is not itself merged. -- PR #368: `head` `22cf9d8b6463fc46c7927d8fef6e2b12a25cd776` (the checkpoint - parent before this baseline update), base `main` +- PR #368: `head` `dcc916cd68d8ae3c495563332658fd0cbf8d760e` (the exact head + observed for this baseline update), base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #373: `head` `43e24783ae38d65d03df7cb901f93b8ac8731b9b`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). @@ -99,9 +99,12 @@ Open PRs at the same observation: The open queue remains subject to exact-current-head Checks, formal independent approval, and protected mergeability. Green Checks alone do not prove that a -merge is authorized. PR #385's merge is the current parent of PR #258; PR #386 -is closed as a duplicate of the safer #373 login fix. PR #382's stack merge is -not a main merge; #373 must still pass its own current-head gates. +merge is authorized. PR #258 still targets `main` at base +`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7` and remains open; PR #385's merge +commit is later repository history, not PR #258's original base or a merge of +#258. PR #386 is closed as a duplicate of the safer #373 login fix. PR #382's +stack merge is not a main merge; #373 must still pass its own current-head +gates. Closed without merge at the same observation: @@ -225,7 +228,7 @@ Observed at `2026-08-21T17:10:21Z` on PR #387's exact head ## 6. Organization OpenTelemetry Evidence Boundary -GRC PR #42 records organization-level OTEL acceptance evidence through the +GRC PR #51 records organization-level OTEL acceptance evidence through the existing purpose-bound evidence contract. It does not become a raw span store and must not copy prompts, post bodies, images, provider responses, secrets, or an ad-hoc `user_account + post_id` session key. W3C trace context and bounded From d867bb3f9b23e2ede5858415707e1f75a8781a87 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 02:21:06 +0900 Subject: [PATCH 040/109] docs: record stacked footnote parser gap --- docs/product-technical-gap-baseline.md | 27 ++++++++++++++++++++------ 1 file changed, 21 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 86822efbc..93a9ef5cc 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -6,7 +6,7 @@ > this repository, screenshots, tests, logs, or buyer evidence. ## 1. Known Parsing & Frontend Display Gaps -- **Footnote Parsing**: synthetic case `case-footnote-01` exercises numbered footnote recognition; PR #367 merged the parser coverage, while authorized production/browser evidence remains pending. +- **Footnote Parsing**: synthetic case `case-footnote-01` exercises numbered footnote recognition; PR #367 merged semantic-chunker coverage, and stacked PR #388 adds browser fallback recognition for HTML, Word, and OOXML footnotes. Authorized production/browser corpus evidence remains pending. - **Table Parsing**: synthetic case `case-table-01` exercises malformed row boundaries and empty cells; image tables and browser rendering remain open. - **Indentation**: synthetic cases `case-indent-01` and `case-indent-02` retain incorrect indentation rendering coverage gaps. - **Image/Table OCR**: synthetic case `case-image-table-01` still needs region-aware table OCR, markdown rendering, and sufficiently detailed buyer-safe image evidence. @@ -78,28 +78,32 @@ Open PRs at the same observation: - PR #258: `head` `6621eb116a4e92eb33eeae989c70fbc602450c51`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #349: `head` `2d18879e8a7f93b08e32aa4261610e34700e1892`, base `main` +- PR #349: `head` `dc4bd020d459e90461231b8d900d074eb3a46595`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #355: `head` `b606c2553f877fa85968d90dc46598ce16897fbf`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). The overlap with PR #379's merge commit is intentional: #355 is the open successor from the same feature branch, now pointing at that merged branch tip, and is not itself merged. -- PR #368: `head` `dcc916cd68d8ae3c495563332658fd0cbf8d760e` (the exact head +- PR #368: `head` `a7782ec05198e137399e1543cefa6a732693b0f6` (the exact parent observed for this baseline update), base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #373: `head` `43e24783ae38d65d03df7cb901f93b8ac8731b9b`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #383: `head` `46e4d6d69c1964f0cbeb761281071db7861e31dd`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #384: `head` `cc0b50aa0838701582b373e1310279d6014c17db`, base +- PR #384: `head` `e4c4a3c8709a4e57654c08a838f568a1582abee3`, base `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). - PR #387: `head` `4faf9a31371195c5ec63fca42a5afbb93a95369b`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). +- PR #388: `head` `f145b83f68731d6f31c3e1b1de59fd7be8f62001`, base + `feat/event-lineage-channel-evidence` + (`4faf9a31371195c5ec63fca42a5afbb93a95369b`). The open queue remains subject to exact-current-head Checks, formal independent approval, and protected mergeability. Green Checks alone do not prove that a -merge is authorized. PR #258 still targets `main` at base +merge is authorized. PR #388 is stacked on PR #387 and must follow its +observed merge commit before rebasing onto `main`. PR #258 still targets `main` at base `ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7` and remains open; PR #385's merge commit is later repository history, not PR #258's original base or a merge of #258. PR #386 is closed as a duplicate of the safer #373 login fix. PR #382's @@ -226,6 +230,16 @@ Observed at `2026-08-21T17:10:21Z` on PR #387's exact head the orchestrated rebuild/import boundary. Hosted Checks are queued and no independent approval or merge commit is claimed. +Observed at `2026-08-21T17:20:10Z` on PR #388's exact head +`f145b83f68731d6f31c3e1b1de59fd7be8f62001`: + +- The browser fallback preserves footnote roles for synthetic HTML footnote + lists, Word `MsoFootnoteText`, and OOXML footnote containers. Anchor tags no + longer become false leading indentation in this path. +- Local frontend verification passed lint, 144 Vitest tests, and the + production build. Hosted Checks were queued and no independent approval or + merge commit was present. + ## 6. Organization OpenTelemetry Evidence Boundary GRC PR #51 records organization-level OTEL acceptance evidence through the @@ -238,7 +252,8 @@ GRC evidence subjects. ## 7. Next Implementation Order -1. Revalidate open PRs #258, #349, #355, #368, #373, #383, #384, and #387 at +1. Revalidate open PRs #258, #349, #355, #368, #373, #383, #384, #387, and + #388 at their exact current heads as Checks and formal independent approvals arrive; process stacked parents only after their child merge commits are observed. Verify the synthetic footnote/table cases in the authenticated browser and From 2e1de2383865c548959d067f9a70a0dc008d1afd Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 02:26:26 +0900 Subject: [PATCH 041/109] docs: record lineage rounding repair --- docs/product-technical-gap-baseline.md | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 93a9ef5cc..b9ac751dd 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -85,7 +85,7 @@ Open PRs at the same observation: merge commit is intentional: #355 is the open successor from the same feature branch, now pointing at that merged branch tip, and is not itself merged. -- PR #368: `head` `a7782ec05198e137399e1543cefa6a732693b0f6` (the exact parent +- PR #368: `head` `d867bb3f9b23e2ede5858415707e1f75a8781a87` (the exact parent observed for this baseline update), base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #373: `head` `43e24783ae38d65d03df7cb901f93b8ac8731b9b`, base `main` @@ -94,7 +94,7 @@ Open PRs at the same observation: (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #384: `head` `e4c4a3c8709a4e57654c08a838f568a1582abee3`, base `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). -- PR #387: `head` `4faf9a31371195c5ec63fca42a5afbb93a95369b`, base `main` +- PR #387: `head` `df2519c09b224f05ac84e6997abd3b4f1bb94cb6`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #388: `head` `f145b83f68731d6f31c3e1b1de59fd7be8f62001`, base `feat/event-lineage-channel-evidence` @@ -240,6 +240,18 @@ Observed at `2026-08-21T17:20:10Z` on PR #388's exact head production build. Hosted Checks were queued and no independent approval or merge commit was present. +Observed at `2026-08-21T17:25:46Z` on PR #387's exact head +`df2519c09b224f05ac84e6997abd3b4f1bb94cb6`: + +- The Event Lineage channel-evidence persistence check now budgets one + half-quantum per six-decimal contribution plus a small floating-point guard, + so normal three- and four-channel edges cannot abort rebuild/import solely + because of storage rounding. +- A four-channel regression covers the former failure boundary. Local + verification passed 769 backend tests with 17 environment skips, 20 focused + lineage tests, and `git diff --check`; hosted Checks were queued and no + independent approval or merge commit was present. + ## 6. Organization OpenTelemetry Evidence Boundary GRC PR #51 records organization-level OTEL acceptance evidence through the From 295cfabdc33e0fefc5a70db388449ddaaafdf744 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 02:32:46 +0900 Subject: [PATCH 042/109] docs: record ontology cursor security repair --- docs/product-technical-gap-baseline.md | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index b9ac751dd..76784711e 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -78,14 +78,14 @@ Open PRs at the same observation: - PR #258: `head` `6621eb116a4e92eb33eeae989c70fbc602450c51`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #349: `head` `dc4bd020d459e90461231b8d900d074eb3a46595`, base `main` +- PR #349: `head` `979b4290bc62ab83668aab99cc09c2a297db8464`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #355: `head` `b606c2553f877fa85968d90dc46598ce16897fbf`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). The overlap with PR #379's merge commit is intentional: #355 is the open successor from the same feature branch, now pointing at that merged branch tip, and is not itself merged. -- PR #368: `head` `d867bb3f9b23e2ede5858415707e1f75a8781a87` (the exact parent +- PR #368: `head` `2e1de2383865c548959d067f9a70a0dc008d1afd` (the exact parent observed for this baseline update), base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #373: `head` `43e24783ae38d65d03df7cb901f93b8ac8731b9b`, base `main` @@ -252,6 +252,17 @@ Observed at `2026-08-21T17:25:46Z` on PR #387's exact head lineage tests, and `git diff --check`; hosted Checks were queued and no independent approval or merge commit was present. +Observed at `2026-08-21T17:32:25Z` on PR #349's exact head +`979b4290bc62ab83668aab99cc09c2a297db8464`: + +- The ontology source cursor now uses `src.v2.` AES-GCM with a fresh 96-bit + nonce and prefix/version associated data; the custom v1 keystream format is + rejected. The concurrent ontology page retry repair remains included. +- ADR 0125 records the decision and NIST SP 800-38D APA 7 reference. Local + verification passed 830 backend tests with 17 environment skips, 172 + frontend tests, lint, TypeScript, and production build; hosted Checks and + independent approval remained open. + ## 6. Organization OpenTelemetry Evidence Boundary GRC PR #51 records organization-level OTEL acceptance evidence through the From 608c200383ba612f9bba3ffd47d88e8ef9f7c339 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 02:34:55 +0900 Subject: [PATCH 043/109] docs: trace central osv workflow gap --- docs/product-technical-gap-baseline.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 76784711e..cfc5cd220 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -85,7 +85,7 @@ Open PRs at the same observation: merge commit is intentional: #355 is the open successor from the same feature branch, now pointing at that merged branch tip, and is not itself merged. -- PR #368: `head` `2e1de2383865c548959d067f9a70a0dc008d1afd` (the exact parent +- PR #368: `head` `295cfabdc33e0fefc5a70db388449ddaaafdf744` (the exact parent observed for this baseline update), base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #373: `head` `43e24783ae38d65d03df7cb901f93b8ac8731b9b`, base `main` @@ -273,6 +273,12 @@ OpenTelemetry attributes correlate the authorized operation across services; collector delivery, retention, access review, and no-export rollback are the GRC evidence subjects. +The remaining PR #383 `osv-scan` failure is a central workflow defect: the scan +exited successfully, but the follow-up treated a missing empty baseline result +file as failure. Central `.github` PR #1158 is the repair at exact head +`a7fb51283e200c81fc30dd942fda2ba941518bdf`; its own Checks are still queued and +it has no independent approval, so PR #383 is not reported green or mergeable. + ## 7. Next Implementation Order 1. Revalidate open PRs #258, #349, #355, #368, #373, #383, #384, #387, and From 426b125033ffb827f9218d15ec3db35788d96450 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 02:42:17 +0900 Subject: [PATCH 044/109] docs: record latest footnote stack evidence --- docs/product-technical-gap-baseline.md | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index cfc5cd220..0ab7316b7 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -96,7 +96,7 @@ Open PRs at the same observation: `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). - PR #387: `head` `df2519c09b224f05ac84e6997abd3b4f1bb94cb6`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #388: `head` `f145b83f68731d6f31c3e1b1de59fd7be8f62001`, base +- PR #388: `head` `146cc56e07db9479ab8dba93aedb0ffd06d2e795`, base `feat/event-lineage-channel-evidence` (`4faf9a31371195c5ec63fca42a5afbb93a95369b`). @@ -230,15 +230,17 @@ Observed at `2026-08-21T17:10:21Z` on PR #387's exact head the orchestrated rebuild/import boundary. Hosted Checks are queued and no independent approval or merge commit is claimed. -Observed at `2026-08-21T17:20:10Z` on PR #388's exact head -`f145b83f68731d6f31c3e1b1de59fd7be8f62001`: +Observed at `2026-08-21T17:41:55Z` on PR #388's exact head +`146cc56e07db9479ab8dba93aedb0ffd06d2e795`: - The browser fallback preserves footnote roles for synthetic HTML footnote lists, Word `MsoFootnoteText`, and OOXML footnote containers. Anchor tags no - longer become false leading indentation in this path. -- Local frontend verification passed lint, 144 Vitest tests, and the - production build. Hosted Checks were queued and no independent approval or - merge commit was present. + longer become false leading indentation in this path. The stacked follow-up + also closes HTML footnote containers reliably and suppresses an empty + container's internal control marker. +- Local frontend verification passed the targeted footnote suite (13 tests), + all 144 Vitest tests, lint, and the production build. Hosted Checks were + queued and no independent approval or merge commit was present. Observed at `2026-08-21T17:25:46Z` on PR #387's exact head `df2519c09b224f05ac84e6997abd3b4f1bb94cb6`: From bcaa2efc47b180558fe32209b18fbf0ed3feeab1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 02:48:17 +0900 Subject: [PATCH 045/109] docs: record markdown table display gap --- docs/product-technical-gap-baseline.md | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 0ab7316b7..781aabcb4 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -99,6 +99,9 @@ Open PRs at the same observation: - PR #388: `head` `146cc56e07db9479ab8dba93aedb0ffd06d2e795`, base `feat/event-lineage-channel-evidence` (`4faf9a31371195c5ec63fca42a5afbb93a95369b`). +- PR #389: `head` `1ebacdf534a2cbc639020a964ac2c7a760e1a774`, base + `feat/post-body-footnote-display` + (`146cc56e07db9479ab8dba93aedb0ffd06d2e795`). The open queue remains subject to exact-current-head Checks, formal independent approval, and protected mergeability. Green Checks alone do not prove that a @@ -242,6 +245,17 @@ Observed at `2026-08-21T17:41:55Z` on PR #388's exact head all 144 Vitest tests, lint, and the production build. Hosted Checks were queued and no independent approval or merge commit was present. +Observed at `2026-08-21T17:47:52Z` on PR #389's exact head +`1ebacdf534a2cbc639020a964ac2c7a760e1a774`: + +- The buyer-facing fallback now renders a pipe-delimited Markdown table in a + normal source body, including an empty cell, while retaining the existing + image-OCR table renderer. +- Local frontend verification passed 147 Vitest tests, lint, and the + production build. Hosted Checks were queued and no independent approval or + merge commit was present. This remains an open stacked fix, not a resolved + production gap. + Observed at `2026-08-21T17:25:46Z` on PR #387's exact head `df2519c09b224f05ac84e6997abd3b4f1bb94cb6`: @@ -283,8 +297,8 @@ it has no independent approval, so PR #383 is not reported green or mergeable. ## 7. Next Implementation Order -1. Revalidate open PRs #258, #349, #355, #368, #373, #383, #384, #387, and - #388 at +1. Revalidate open PRs #258, #349, #355, #368, #373, #383, #384, #387, #388, + and #389 at their exact current heads as Checks and formal independent approvals arrive; process stacked parents only after their child merge commits are observed. Verify the synthetic footnote/table cases in the authenticated browser and From 8941b0307777d56d190a6fa939b4237206f7f81b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 02:52:52 +0900 Subject: [PATCH 046/109] docs: record authenticated defect-route audit --- docs/product-technical-gap-baseline.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 781aabcb4..3064d33cf 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -164,6 +164,21 @@ Observed at `2026-08-21T16:01:40Z` in a fresh local Compose browser session: not complete within 30 seconds, so provider/model readiness remains open even though the Compose services are running. +Observed at `2026-08-21T17:52:18Z` in an authenticated Playwright browser run +against the local runtime, using the eleven supplied defect routes and +aggregate-only assertions: + +- OIDC login completed with the local development account. Each of the eleven + post routes opened a detail dialog, its close control was clicked, and the + dialog closed again; no route produced horizontal overflow at 1280x1024. +- Event Lineage was present in all eleven dialogs. A footnote evidence marker + was visible in one route and a rendered table in one route; the Keyman label + was not visible in any of the eleven dialogs. This keeps Keyman/entity + generation as an open runtime capability gap rather than treating a generic + R&R panel as Keyman evidence. +- The run intentionally did not persist or print post titles, people, + organizations, source identifiers, credentials, tokens, or body text. + These observations are runtime evidence, not a claim that the corresponding PRs are merged. The image-processing state and protected-corpus parsing cases remain open gaps. From 3384964268e86c6896fe83d49991533632603f7e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 02:58:13 +0900 Subject: [PATCH 047/109] docs: refresh current stacked evidence --- docs/product-technical-gap-baseline.md | 78 ++++++++++++++------------ 1 file changed, 43 insertions(+), 35 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 3064d33cf..a6fc88263 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -49,7 +49,7 @@ ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or -`resolved` from intent alone. Observed at `2026-08-21T17:10:21Z` from the +`resolved` from intent alone. Observed at `2026-08-21T17:56:20Z` from the GitHub API. Checkpoint types are `merge_commit`, `head`, and `closed_without_merge`; the latter records a closed PR's exact `head` when `merged_at` and `merge_commit_sha` are both absent. A merged commit is @@ -85,28 +85,30 @@ Open PRs at the same observation: merge commit is intentional: #355 is the open successor from the same feature branch, now pointing at that merged branch tip, and is not itself merged. -- PR #368: `head` `295cfabdc33e0fefc5a70db388449ddaaafdf744` (the exact parent - observed for this baseline update), base `main` +- PR #368: `head` `8941b0307777d56d190a6fa939b4237206f7f81b` (the exact current + documentation checkpoint), base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #373: `head` `43e24783ae38d65d03df7cb901f93b8ac8731b9b`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #383: `head` `46e4d6d69c1964f0cbeb761281071db7861e31dd`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #384: `head` `e4c4a3c8709a4e57654c08a838f568a1582abee3`, base +- PR #384: `head` `1bffa5adafa6f015cea355de1b82a370d5791f4b`, base `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). -- PR #387: `head` `df2519c09b224f05ac84e6997abd3b4f1bb94cb6`, base `main` +- PR #387: `head` `4bf061314516a6d824dcc41b24a021ca69661aa4`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #388: `head` `146cc56e07db9479ab8dba93aedb0ffd06d2e795`, base +- PR #388: `head` `ee5882a7d9bcd933ce6b36a61a2176c1be1caded`, base `feat/event-lineage-channel-evidence` - (`4faf9a31371195c5ec63fca42a5afbb93a95369b`). -- PR #389: `head` `1ebacdf534a2cbc639020a964ac2c7a760e1a774`, base + (`4bf061314516a6d824dcc41b24a021ca69661aa4`). +- PR #389: `head` `388037648ca125ccd569035b520ed8d2eea87fbc`, base `feat/post-body-footnote-display` - (`146cc56e07db9479ab8dba93aedb0ffd06d2e795`). + (`ee5882a7d9bcd933ce6b36a61a2176c1be1caded`). The open queue remains subject to exact-current-head Checks, formal independent approval, and protected mergeability. Green Checks alone do not prove that a -merge is authorized. PR #388 is stacked on PR #387 and must follow its -observed merge commit before rebasing onto `main`. PR #258 still targets `main` at base +merge is authorized. PR #388 is stacked on PR #387 and now follows its current +branch head through a normal branch merge; neither has a protected merge +commit. PR #389 is stacked on #388 and follows #388 through a normal branch +merge. PR #258 still targets `main` at base `ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7` and remains open; PR #385's merge commit is later repository history, not PR #258's original base or a merge of #258. PR #386 is closed as a duplicate of the safer #373 login fix. PR #382's @@ -248,40 +250,42 @@ Observed at `2026-08-21T17:10:21Z` on PR #387's exact head the orchestrated rebuild/import boundary. Hosted Checks are queued and no independent approval or merge commit is claimed. -Observed at `2026-08-21T17:41:55Z` on PR #388's exact head -`146cc56e07db9479ab8dba93aedb0ffd06d2e795`: +Observed at `2026-08-21T17:50:01Z` on PR #388's exact head +`ee5882a7d9bcd933ce6b36a61a2176c1be1caded`: - The browser fallback preserves footnote roles for synthetic HTML footnote lists, Word `MsoFootnoteText`, and OOXML footnote containers. Anchor tags no longer become false leading indentation in this path. The stacked follow-up also closes HTML footnote containers reliably and suppresses an empty container's internal control marker. -- Local frontend verification passed the targeted footnote suite (13 tests), - all 144 Vitest tests, lint, and the production build. Hosted Checks were - queued and no independent approval or merge commit was present. - -Observed at `2026-08-21T17:47:52Z` on PR #389's exact head -`1ebacdf534a2cbc639020a964ac2c7a760e1a774`: - -- The buyer-facing fallback now renders a pipe-delimited Markdown table in a - normal source body, including an empty cell, while retaining the existing - image-OCR table renderer. -- Local frontend verification passed 147 Vitest tests, lint, and the - production build. Hosted Checks were queued and no independent approval or - merge commit was present. This remains an open stacked fix, not a resolved +- The branch now includes the current #387 parent through a regular merge + commit. Local verification passed 146 frontend tests, lint, build, and 20 + focused lineage tests. Hosted Checks and independent approval remain open. + +Observed at `2026-08-21T17:56:20Z` on PR #389's exact head +`388037648ca125ccd569035b520ed8d2eea87fbc`: + +- The buyer-facing fallback renders a Markdown table in a normal source body, + including an empty cell, without converting ordinary pipe-delimited prose. + Persisted text units use the same renderer, while separator-free OCR rows + remain supported only in the image-evidence path. +- Local frontend verification passed 150 Vitest tests, lint, and the + production build. Hosted Checks, independent approval, and a protected merge + commit remain absent. This remains an open stacked fix, not a resolved production gap. -Observed at `2026-08-21T17:25:46Z` on PR #387's exact head -`df2519c09b224f05ac84e6997abd3b4f1bb94cb6`: +Observed at `2026-08-21T17:49:48Z` on PR #387's exact head +`4bf061314516a6d824dcc41b24a021ca69661aa4`: - The Event Lineage channel-evidence persistence check now budgets one half-quantum per six-decimal contribution plus a small floating-point guard, so normal three- and four-channel edges cannot abort rebuild/import solely because of storage rounding. - A four-channel regression covers the former failure boundary. Local - verification passed 769 backend tests with 17 environment skips, 20 focused - lineage tests, and `git diff --check`; hosted Checks were queued and no - independent approval or merge commit was present. + verification passed 14 focused ingestion/evidence tests and `git diff --check`; + the async rebuild now offloads synchronous reconstruction and the visible + graph bounds evidence reads to visible endpoint IDs. Hosted Checks were + queued and no independent approval or merge commit was present. Observed at `2026-08-21T17:32:25Z` on PR #349's exact head `979b4290bc62ab83668aab99cc09c2a297db8464`: @@ -305,10 +309,14 @@ collector delivery, retention, access review, and no-export rollback are the GRC evidence subjects. The remaining PR #383 `osv-scan` failure is a central workflow defect: the scan -exited successfully, but the follow-up treated a missing empty baseline result -file as failure. Central `.github` PR #1158 is the repair at exact head -`a7fb51283e200c81fc30dd942fda2ba941518bdf`; its own Checks are still queued and -it has no independent approval, so PR #383 is not reported green or mergeable. +exited successfully, but the follow-up treated a missing baseline result file +as failure after the head checkout. Central `.github` PR #1158 is the broader +source-provenance repair at exact head +`acbd253df81e06d18ed758de1ce748ad6729faa0`; central PR #1002 independently +adds the minimal result-preservation repair at exact head +`e94974e5e6551a884bed8e68456984fe925a14c0`. Both remain open with non-terminal +Checks and no independent approval, so PR #383 is not reported green or +mergeable from this historical failure alone. ## 7. Next Implementation Order From e112071a5ee7473abda20a1a5e74f773fc71cdd6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 02:59:50 +0900 Subject: [PATCH 048/109] docs: correct translated keyman audit evidence --- docs/product-technical-gap-baseline.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index a6fc88263..924727ef6 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -173,11 +173,12 @@ aggregate-only assertions: - OIDC login completed with the local development account. Each of the eleven post routes opened a detail dialog, its close control was clicked, and the dialog closed again; no route produced horizontal overflow at 1280x1024. -- Event Lineage was present in all eleven dialogs. A footnote evidence marker - was visible in one route and a rendered table in one route; the Keyman label - was not visible in any of the eleven dialogs. This keeps Keyman/entity - generation as an open runtime capability gap rather than treating a generic - R&R panel as Keyman evidence. +- Event Lineage and the translated Keyman section were present in all eleven + dialogs. A footnote evidence marker was visible in one route and a rendered + table in one route. Five Keyman list items appeared across two routes; the + remaining nine showed the explicit no-Keyman state. This distinguishes a + real empty extraction signal from a missing panel, while Keyman/entity + quality and coverage remain open product gaps. - The run intentionally did not persist or print post titles, people, organizations, source identifiers, credentials, tokens, or body text. From a5058283654441200024f1ae384f8bc030df6667 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 03:04:47 +0900 Subject: [PATCH 049/109] docs: refresh latest stack heads --- docs/product-technical-gap-baseline.md | 28 ++++++++++++++------------ 1 file changed, 15 insertions(+), 13 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 924727ef6..7612a3a94 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -49,7 +49,7 @@ ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or -`resolved` from intent alone. Observed at `2026-08-21T17:56:20Z` from the +`resolved` from intent alone. Observed at `2026-08-21T18:04:14Z` from the GitHub API. Checkpoint types are `merge_commit`, `head`, and `closed_without_merge`; the latter records a closed PR's exact `head` when `merged_at` and `merge_commit_sha` are both absent. A merged commit is @@ -85,7 +85,7 @@ Open PRs at the same observation: merge commit is intentional: #355 is the open successor from the same feature branch, now pointing at that merged branch tip, and is not itself merged. -- PR #368: `head` `8941b0307777d56d190a6fa939b4237206f7f81b` (the exact current +- PR #368: `head` `e112071a5ee7473abda20a1a5e74f773fc71cdd6` (the exact current documentation checkpoint), base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #373: `head` `43e24783ae38d65d03df7cb901f93b8ac8731b9b`, base `main` @@ -96,12 +96,12 @@ Open PRs at the same observation: `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). - PR #387: `head` `4bf061314516a6d824dcc41b24a021ca69661aa4`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #388: `head` `ee5882a7d9bcd933ce6b36a61a2176c1be1caded`, base +- PR #388: `head` `1b680a27e6eaca544f1d99512e31220278c43110`, base `feat/event-lineage-channel-evidence` (`4bf061314516a6d824dcc41b24a021ca69661aa4`). -- PR #389: `head` `388037648ca125ccd569035b520ed8d2eea87fbc`, base +- PR #389: `head` `0c2f706008f9888f3ed24ee981029c2b83f3b796`, base `feat/post-body-footnote-display` - (`ee5882a7d9bcd933ce6b36a61a2176c1be1caded`). + (`1b680a27e6eaca544f1d99512e31220278c43110`). The open queue remains subject to exact-current-head Checks, formal independent approval, and protected mergeability. Green Checks alone do not prove that a @@ -251,8 +251,8 @@ Observed at `2026-08-21T17:10:21Z` on PR #387's exact head the orchestrated rebuild/import boundary. Hosted Checks are queued and no independent approval or merge commit is claimed. -Observed at `2026-08-21T17:50:01Z` on PR #388's exact head -`ee5882a7d9bcd933ce6b36a61a2176c1be1caded`: +Observed at `2026-08-21T18:02:27Z` on PR #388's exact head +`1b680a27e6eaca544f1d99512e31220278c43110`: - The browser fallback preserves footnote roles for synthetic HTML footnote lists, Word `MsoFootnoteText`, and OOXML footnote containers. Anchor tags no @@ -260,17 +260,19 @@ Observed at `2026-08-21T17:50:01Z` on PR #388's exact head also closes HTML footnote containers reliably and suppresses an empty container's internal control marker. - The branch now includes the current #387 parent through a regular merge - commit. Local verification passed 146 frontend tests, lint, build, and 20 - focused lineage tests. Hosted Checks and independent approval remain open. + commit. Footnote detection is bound to class/role attributes and anchor-tag + matching no longer strips tag names that merely start with `a`. Local + verification passed 148 frontend tests, lint, and build. Hosted Checks and + independent approval remain open. -Observed at `2026-08-21T17:56:20Z` on PR #389's exact head -`388037648ca125ccd569035b520ed8d2eea87fbc`: +Observed at `2026-08-21T18:03:09Z` on PR #389's exact head +`0c2f706008f9888f3ed24ee981029c2b83f3b796`: - The buyer-facing fallback renders a Markdown table in a normal source body, including an empty cell, without converting ordinary pipe-delimited prose. Persisted text units use the same renderer, while separator-free OCR rows remain supported only in the image-evidence path. -- Local frontend verification passed 150 Vitest tests, lint, and the +- Local frontend verification passed 152 Vitest tests, lint, and the production build. Hosted Checks, independent approval, and a protected merge commit remain absent. This remains an open stacked fix, not a resolved production gap. @@ -315,7 +317,7 @@ as failure after the head checkout. Central `.github` PR #1158 is the broader source-provenance repair at exact head `acbd253df81e06d18ed758de1ce748ad6729faa0`; central PR #1002 independently adds the minimal result-preservation repair at exact head -`e94974e5e6551a884bed8e68456984fe925a14c0`. Both remain open with non-terminal +`33db8cbccfe8b52ebfb979bdcb3a08b5914340fb`. Both remain open with non-terminal Checks and no independent approval, so PR #383 is not reported green or mergeable from this historical failure alone. From 2ef3470a121cdf9fc8654c0773b697826222821e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 03:07:32 +0900 Subject: [PATCH 050/109] docs: refresh current markdown table evidence --- docs/product-technical-gap-baseline.md | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 7612a3a94..095622cba 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -49,7 +49,7 @@ ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or -`resolved` from intent alone. Observed at `2026-08-21T18:04:14Z` from the +`resolved` from intent alone. Observed at `2026-08-21T18:06:44Z` from the GitHub API. Checkpoint types are `merge_commit`, `head`, and `closed_without_merge`; the latter records a closed PR's exact `head` when `merged_at` and `merge_commit_sha` are both absent. A merged commit is @@ -85,7 +85,7 @@ Open PRs at the same observation: merge commit is intentional: #355 is the open successor from the same feature branch, now pointing at that merged branch tip, and is not itself merged. -- PR #368: `head` `e112071a5ee7473abda20a1a5e74f773fc71cdd6` (the exact current +- PR #368: `head` `a5058283654441200024f1ae384f8bc030df6667` (the exact current documentation checkpoint), base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #373: `head` `43e24783ae38d65d03df7cb901f93b8ac8731b9b`, base `main` @@ -99,7 +99,7 @@ Open PRs at the same observation: - PR #388: `head` `1b680a27e6eaca544f1d99512e31220278c43110`, base `feat/event-lineage-channel-evidence` (`4bf061314516a6d824dcc41b24a021ca69661aa4`). -- PR #389: `head` `0c2f706008f9888f3ed24ee981029c2b83f3b796`, base +- PR #389: `head` `5118500c8e1adf05e37da498558ef516ac9f6959`, base `feat/post-body-footnote-display` (`1b680a27e6eaca544f1d99512e31220278c43110`). @@ -115,6 +115,12 @@ commit is later repository history, not PR #258's original base or a merge of stack merge is not a main merge; #373 must still pass its own current-head gates. +Queue refresh at the same observation: PRs #387, #388, #389, #349, and #368 +had no independent `APPROVED` review. Each still had at least one non-terminal +required check (in-progress or queued), so none was merge-authorized. The +current exact HEAD, review, and terminal-check gates must be re-read before any +future merge action. + Closed without merge at the same observation: - PR #386: `closed_without_merge` head `57a013deb88fc0b23ae6448c1d3474c770360a5e`. @@ -265,16 +271,18 @@ Observed at `2026-08-21T18:02:27Z` on PR #388's exact head verification passed 148 frontend tests, lint, and build. Hosted Checks and independent approval remain open. -Observed at `2026-08-21T18:03:09Z` on PR #389's exact head -`0c2f706008f9888f3ed24ee981029c2b83f3b796`: +Observed at `2026-08-21T18:06:44Z` on PR #389's exact head +`5118500c8e1adf05e37da498558ef516ac9f6959`: - The buyer-facing fallback renders a Markdown table in a normal source body, including an empty cell, without converting ordinary pipe-delimited prose. Persisted text units use the same renderer, while separator-free OCR rows - remain supported only in the image-evidence path. -- Local frontend verification passed 152 Vitest tests, lint, and the - production build. Hosted Checks, independent approval, and a protected merge - commit remain absent. This remains an open stacked fix, not a resolved + remain supported only in the image-evidence path. Candidate pipe rows are + buffered until a valid Markdown separator and data rows confirm a table, so + a lone pipe line cannot split the surrounding paragraph. +- Local frontend verification passed 154 Vitest tests, lint, production build, + and `git diff --check`. Hosted Checks, independent approval, and a protected + merge commit remain absent. This remains an open stacked fix, not a resolved production gap. Observed at `2026-08-21T17:49:48Z` on PR #387's exact head From 9dcfc4417cf22bd95604d8aabbf786346eaa60de Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 03:09:37 +0900 Subject: [PATCH 051/109] docs: record exact-head backend verification --- docs/product-technical-gap-baseline.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 095622cba..ba47781d9 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -49,7 +49,7 @@ ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or -`resolved` from intent alone. Observed at `2026-08-21T18:06:44Z` from the +`resolved` from intent alone. Observed at `2026-08-21T18:09:21Z` from the GitHub API. Checkpoint types are `merge_commit`, `head`, and `closed_without_merge`; the latter records a closed PR's exact `head` when `merged_at` and `merge_commit_sha` are both absent. A merged commit is @@ -285,18 +285,19 @@ Observed at `2026-08-21T18:06:44Z` on PR #389's exact head merge commit remain absent. This remains an open stacked fix, not a resolved production gap. -Observed at `2026-08-21T17:49:48Z` on PR #387's exact head +Observed at `2026-08-21T18:09:21Z` on PR #387's exact head `4bf061314516a6d824dcc41b24a021ca69661aa4`: - The Event Lineage channel-evidence persistence check now budgets one half-quantum per six-decimal contribution plus a small floating-point guard, so normal three- and four-channel edges cannot abort rebuild/import solely because of storage rounding. -- A four-channel regression covers the former failure boundary. Local - verification passed 14 focused ingestion/evidence tests and `git diff --check`; - the async rebuild now offloads synchronous reconstruction and the visible - graph bounds evidence reads to visible endpoint IDs. Hosted Checks were - queued and no independent approval or merge commit was present. +- A four-channel regression covers the former failure boundary. The async + rebuild now offloads synchronous reconstruction and the visible graph bounds + evidence reads to visible endpoint IDs. Local verification on this exact + head passed 769 backend tests with 17 environment skips; hosted Checks still + had non-terminal work and no independent approval or merge commit was + present. Observed at `2026-08-21T17:32:25Z` on PR #349's exact head `979b4290bc62ab83668aab99cc09c2a297db8464`: From e347e0342c75a3a8eaa5bee69731da12edba3c29 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 03:12:51 +0900 Subject: [PATCH 052/109] docs: refresh current PR evidence --- docs/product-technical-gap-baseline.md | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index ba47781d9..083d9d795 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -7,7 +7,7 @@ ## 1. Known Parsing & Frontend Display Gaps - **Footnote Parsing**: synthetic case `case-footnote-01` exercises numbered footnote recognition; PR #367 merged semantic-chunker coverage, and stacked PR #388 adds browser fallback recognition for HTML, Word, and OOXML footnotes. Authorized production/browser corpus evidence remains pending. -- **Table Parsing**: synthetic case `case-table-01` exercises malformed row boundaries and empty cells; image tables and browser rendering remain open. +- **Table Parsing**: synthetic case `case-table-01` exercises malformed row boundaries and empty cells; PR #389 now covers ordinary Markdown rendering, while region-aware image tables and protected-corpus evidence remain open. - **Indentation**: synthetic cases `case-indent-01` and `case-indent-02` retain incorrect indentation rendering coverage gaps. - **Image/Table OCR**: synthetic case `case-image-table-01` still needs region-aware table OCR, markdown rendering, and sufficiently detailed buyer-safe image evidence. - **Math/Superscripts**: synthetic case `case-math-01` covers bounded metric normalization such as m³; arbitrary formula semantics and authorized runtime verification remain open after PR #344. @@ -85,12 +85,12 @@ Open PRs at the same observation: merge commit is intentional: #355 is the open successor from the same feature branch, now pointing at that merged branch tip, and is not itself merged. -- PR #368: `head` `a5058283654441200024f1ae384f8bc030df6667` (the exact current +- PR #368: `head` `9dcfc4417cf22bd95604d8aabbf786346eaa60de` (the exact current documentation checkpoint), base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #373: `head` `43e24783ae38d65d03df7cb901f93b8ac8731b9b`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #383: `head` `46e4d6d69c1964f0cbeb761281071db7861e31dd`, base `main` +- PR #383: `head` `6525127008b3ba74526e8ffb8d8bf25630cf58db`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #384: `head` `1bffa5adafa6f015cea355de1b82a370d5791f4b`, base `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). @@ -299,6 +299,15 @@ Observed at `2026-08-21T18:09:21Z` on PR #387's exact head had non-terminal work and no independent approval or merge commit was present. +Observed at `2026-08-21T18:11:51Z` on PR #383's current head +`6525127008b3ba74526e8ffb8d8bf25630cf58db`: + +- `TypeError` from post-chat/global-agent and post-content-worker paths is now + classified as an internal failure, while provider transport/configuration + errors retain `provider_unavailable`. Focused worker and diagnostics tests + passed; hosted Checks, independent approval, and a protected merge commit + remain absent. + Observed at `2026-08-21T17:32:25Z` on PR #349's exact head `979b4290bc62ab83668aab99cc09c2a297db8464`: @@ -325,8 +334,8 @@ exited successfully, but the follow-up treated a missing baseline result file as failure after the head checkout. Central `.github` PR #1158 is the broader source-provenance repair at exact head `acbd253df81e06d18ed758de1ce748ad6729faa0`; central PR #1002 independently -adds the minimal result-preservation repair at exact head -`33db8cbccfe8b52ebfb979bdcb3a08b5914340fb`. Both remain open with non-terminal +adds the minimal result-preservation and review-placeholder repair at exact +head `e46777fc541d4e0aa1484348928a2847a81c6952`. Both remain open with non-terminal Checks and no independent approval, so PR #383 is not reported green or mergeable from this historical failure alone. From 3bdc04d337a90e51f01a9ed16a58978acf0cc283 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 03:14:20 +0900 Subject: [PATCH 053/109] docs: bind rebuild fix to current head --- docs/product-technical-gap-baseline.md | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 083d9d795..adf9eb18a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -49,7 +49,7 @@ ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or -`resolved` from intent alone. Observed at `2026-08-21T18:09:21Z` from the +`resolved` from intent alone. Observed at `2026-08-21T18:14:02Z` from the GitHub API. Checkpoint types are `merge_commit`, `head`, and `closed_without_merge`; the latter records a closed PR's exact `head` when `merged_at` and `merge_commit_sha` are both absent. A merged commit is @@ -85,7 +85,7 @@ Open PRs at the same observation: merge commit is intentional: #355 is the open successor from the same feature branch, now pointing at that merged branch tip, and is not itself merged. -- PR #368: `head` `9dcfc4417cf22bd95604d8aabbf786346eaa60de` (the exact current +- PR #368: `head` `e347e0342c75a3a8eaa5bee69731da12edba3c29` (the exact current documentation checkpoint), base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #373: `head` `43e24783ae38d65d03df7cb901f93b8ac8731b9b`, base `main` @@ -94,7 +94,7 @@ Open PRs at the same observation: (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #384: `head` `1bffa5adafa6f015cea355de1b82a370d5791f4b`, base `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). -- PR #387: `head` `4bf061314516a6d824dcc41b24a021ca69661aa4`, base `main` +- PR #387: `head` `cb79302831c0889007699ba7dca2aafa02c01e50`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #388: `head` `1b680a27e6eaca544f1d99512e31220278c43110`, base `feat/event-lineage-channel-evidence` @@ -285,8 +285,8 @@ Observed at `2026-08-21T18:06:44Z` on PR #389's exact head merge commit remain absent. This remains an open stacked fix, not a resolved production gap. -Observed at `2026-08-21T18:09:21Z` on PR #387's exact head -`4bf061314516a6d824dcc41b24a021ca69661aa4`: +Observed at `2026-08-21T18:14:02Z` on PR #387's exact head +`cb79302831c0889007699ba7dca2aafa02c01e50`: - The Event Lineage channel-evidence persistence check now budgets one half-quantum per six-decimal contribution plus a small floating-point guard, @@ -294,10 +294,11 @@ Observed at `2026-08-21T18:09:21Z` on PR #387's exact head because of storage rounding. - A four-channel regression covers the former failure boundary. The async rebuild now offloads synchronous reconstruction and the visible graph bounds - evidence reads to visible endpoint IDs. Local verification on this exact - head passed 769 backend tests with 17 environment skips; hosted Checks still - had non-terminal work and no independent approval or merge commit was - present. + evidence reads to visible endpoint IDs. The rebuild transaction now starts + only after reconstruction, so slow orchestrator work cannot hold a pooled + connection idle in transaction. Local verification on this exact head passed + 769 backend tests with 17 environment skips; hosted Checks were queued and + no independent approval or merge commit was present. Observed at `2026-08-21T18:11:51Z` on PR #383's current head `6525127008b3ba74526e8ffb8d8bf25630cf58db`: From 0201b9c2ac7a21b388d9bda2d7514d6cd605049b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 03:18:08 +0900 Subject: [PATCH 054/109] docs: refresh stacked footnote evidence --- docs/product-technical-gap-baseline.md | 29 ++++++++++++++------------ 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index adf9eb18a..66d64d04c 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -49,7 +49,7 @@ ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or -`resolved` from intent alone. Observed at `2026-08-21T18:14:02Z` from the +`resolved` from intent alone. Observed at `2026-08-21T18:17:06Z` from the GitHub API. Checkpoint types are `merge_commit`, `head`, and `closed_without_merge`; the latter records a closed PR's exact `head` when `merged_at` and `merge_commit_sha` are both absent. A merged commit is @@ -96,12 +96,12 @@ Open PRs at the same observation: `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). - PR #387: `head` `cb79302831c0889007699ba7dca2aafa02c01e50`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #388: `head` `1b680a27e6eaca544f1d99512e31220278c43110`, base +- PR #388: `head` `caea21be9e3485086ae3967fe5e6d23199b5459`, base `feat/event-lineage-channel-evidence` - (`4bf061314516a6d824dcc41b24a021ca69661aa4`). -- PR #389: `head` `5118500c8e1adf05e37da498558ef516ac9f6959`, base + (`cb79302831c0889007699ba7dca2aafa02c01e50`). +- PR #389: `head` `d4a486b15412340734541efca7a6e5050a7cd02c`, base `feat/post-body-footnote-display` - (`1b680a27e6eaca544f1d99512e31220278c43110`). + (`caea21be9e3485086ae3967fe5e6d23199b5459`). The open queue remains subject to exact-current-head Checks, formal independent approval, and protected mergeability. Green Checks alone do not prove that a @@ -257,8 +257,8 @@ Observed at `2026-08-21T17:10:21Z` on PR #387's exact head the orchestrated rebuild/import boundary. Hosted Checks are queued and no independent approval or merge commit is claimed. -Observed at `2026-08-21T18:02:27Z` on PR #388's exact head -`1b680a27e6eaca544f1d99512e31220278c43110`: +Observed at `2026-08-21T18:17:06Z` on PR #388's exact head +`caea21be9e3485086ae3967fe5e6d23199b5459`: - The browser fallback preserves footnote roles for synthetic HTML footnote lists, Word `MsoFootnoteText`, and OOXML footnote containers. Anchor tags no @@ -267,20 +267,23 @@ Observed at `2026-08-21T18:02:27Z` on PR #388's exact head container's internal control marker. - The branch now includes the current #387 parent through a regular merge commit. Footnote detection is bound to class/role attributes and anchor-tag - matching no longer strips tag names that merely start with `a`. Local - verification passed 148 frontend tests, lint, and build. Hosted Checks and + matching no longer strips tag names that merely start with `a`. A labeled + `div` wrapper around an unlabeled HTML list now marks the nested footnotes, + while closing the wrapper returns to ordinary content. Local verification + passed 149 frontend tests, lint, build, and diff check. Hosted Checks and independent approval remain open. -Observed at `2026-08-21T18:06:44Z` on PR #389's exact head -`5118500c8e1adf05e37da498558ef516ac9f6959`: +Observed at `2026-08-21T18:17:06Z` on PR #389's exact head +`d4a486b15412340734541efca7a6e5050a7cd02c`: - The buyer-facing fallback renders a Markdown table in a normal source body, including an empty cell, without converting ordinary pipe-delimited prose. Persisted text units use the same renderer, while separator-free OCR rows remain supported only in the image-evidence path. Candidate pipe rows are buffered until a valid Markdown separator and data rows confirm a table, so - a lone pipe line cannot split the surrounding paragraph. -- Local frontend verification passed 154 Vitest tests, lint, production build, + a lone pipe line cannot split the surrounding paragraph. The #388 wrapped + footnote fix is included through a regular stack merge. +- Local frontend verification passed 155 Vitest tests, lint, production build, and `git diff --check`. Hosted Checks, independent approval, and a protected merge commit remain absent. This remains an open stacked fix, not a resolved production gap. From 6fac2680b9b73c78f1b3e3fb8860b5289fe50be2 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 03:28:23 +0900 Subject: [PATCH 055/109] docs: record stacked PR merges and follow-up --- docs/product-technical-gap-baseline.md | 49 ++++++++++++++++---------- 1 file changed, 31 insertions(+), 18 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 66d64d04c..4e3e0571a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -49,7 +49,7 @@ ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or -`resolved` from intent alone. Observed at `2026-08-21T18:17:06Z` from the +`resolved` from intent alone. Observed at `2026-08-21T18:27:23Z` from the GitHub API. Checkpoint types are `merge_commit`, `head`, and `closed_without_merge`; the latter records a closed PR's exact `head` when `merged_at` and `merge_commit_sha` are both absent. A merged commit is @@ -73,6 +73,10 @@ Recently merged into an open stack base (not main): - PR #382: `merge_commit` `43e24783ae38d65d03df7cb901f93b8ac8731b9b`, merged into PR #373's `ci/publish-ontology-pages-clean` base. +- PR #388: `merge_commit` `068ed6a44a7235e2f996450f0d6a7948bdd8732a`, merged + into PR #387's `feat/event-lineage-channel-evidence` base. +- PR #389: `merge_commit` `778c5df1223ed60a6494e8896079b3ece97669f4`, merged + into PR #388's `feat/post-body-footnote-display` base. Open PRs at the same observation: @@ -94,14 +98,11 @@ Open PRs at the same observation: (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #384: `head` `1bffa5adafa6f015cea355de1b82a370d5791f4b`, base `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). -- PR #387: `head` `cb79302831c0889007699ba7dca2aafa02c01e50`, base `main` +- PR #387: `head` `13c102532f4485c732a83c7741e0844c77f082e5`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #388: `head` `caea21be9e3485086ae3967fe5e6d23199b5459`, base - `feat/event-lineage-channel-evidence` - (`cb79302831c0889007699ba7dca2aafa02c01e50`). -- PR #389: `head` `d4a486b15412340734541efca7a6e5050a7cd02c`, base +- PR #390: `head` `e2f0894b03036ea0881c00ec33c44da28e4a1dbd`, base `feat/post-body-footnote-display` - (`caea21be9e3485086ae3967fe5e6d23199b5459`). + (`778c5df1223ed60a6494e8896079b3ece97669f4`). The open queue remains subject to exact-current-head Checks, formal independent approval, and protected mergeability. Green Checks alone do not prove that a @@ -115,11 +116,11 @@ commit is later repository history, not PR #258's original base or a merge of stack merge is not a main merge; #373 must still pass its own current-head gates. -Queue refresh at the same observation: PRs #387, #388, #389, #349, and #368 -had no independent `APPROVED` review. Each still had at least one non-terminal -required check (in-progress or queued), so none was merge-authorized. The -current exact HEAD, review, and terminal-check gates must be re-read before any -future merge action. +Queue refresh at the same observation: PRs #387, #390, #349, and #368 remained +open without an independent `APPROVED` review and with non-terminal Checks. +PRs #388 and #389 were merged into stack bases only; their merge commits are +not protected-main merges. The current exact HEAD, review, and terminal-check +gates must be re-read before any future merge action. Closed without merge at the same observation: @@ -288,8 +289,8 @@ Observed at `2026-08-21T18:17:06Z` on PR #389's exact head merge commit remain absent. This remains an open stacked fix, not a resolved production gap. -Observed at `2026-08-21T18:14:02Z` on PR #387's exact head -`cb79302831c0889007699ba7dca2aafa02c01e50`: +Observed at `2026-08-21T18:27:23Z` on PR #387's exact head +`13c102532f4485c732a83c7741e0844c77f082e5`: - The Event Lineage channel-evidence persistence check now budgets one half-quantum per six-decimal contribution plus a small floating-point guard, @@ -298,10 +299,22 @@ Observed at `2026-08-21T18:14:02Z` on PR #387's exact head - A four-channel regression covers the former failure boundary. The async rebuild now offloads synchronous reconstruction and the visible graph bounds evidence reads to visible endpoint IDs. The rebuild transaction now starts - only after reconstruction, so slow orchestrator work cannot hold a pooled - connection idle in transaction. Local verification on this exact head passed - 769 backend tests with 17 environment skips; hosted Checks were queued and - no independent approval or merge commit was present. + only after reconstruction, and the pooled connection is released until the + atomic replacement write, so slow orchestrator work cannot hold a pooled + connection idle in transaction. The current branch also includes the + merged Markdown-table and structured-footnote stack through regular merges. + Local verification on this exact head passed 770 backend tests with 17 + environment skips; hosted Checks were non-terminal and no independent + approval or protected-main merge was present. + +Observed at `2026-08-21T18:27:23Z` on PR #390's exact head +`e2f0894b03036ea0881c00ec33c44da28e4a1dbd`: + +- The follow-up keeps pipe-bearing list items as separate semantic segments, + then merges the current stacked base `778c5df1` normally to restore PR + ancestry. Local verification passed 156 frontend tests, lint, production + build, and `git diff --check`. Checks were queued and no independent + approval or protected-main merge was present. Observed at `2026-08-21T18:11:51Z` on PR #383's current head `6525127008b3ba74526e8ffb8d8bf25630cf58db`: From 6b443f73aff19f770405c2397d883a28e7241773 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 03:29:03 +0900 Subject: [PATCH 056/109] docs: refresh exact stack checkpoint --- docs/product-technical-gap-baseline.md | 42 ++++++++++++++------------ 1 file changed, 22 insertions(+), 20 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 66d64d04c..9a2164889 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -49,7 +49,7 @@ ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or -`resolved` from intent alone. Observed at `2026-08-21T18:17:06Z` from the +`resolved` from intent alone. Observed at `2026-08-21T18:28:15Z` from the GitHub API. Checkpoint types are `merge_commit`, `head`, and `closed_without_merge`; the latter records a closed PR's exact `head` when `merged_at` and `merge_commit_sha` are both absent. A merged commit is @@ -85,7 +85,7 @@ Open PRs at the same observation: merge commit is intentional: #355 is the open successor from the same feature branch, now pointing at that merged branch tip, and is not itself merged. -- PR #368: `head` `e347e0342c75a3a8eaa5bee69731da12edba3c29` (the exact current +- PR #368: `head` `0201b9c2ac7a21b388d9bda2d7514d6cd605049b` (the exact current documentation checkpoint), base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #373: `head` `43e24783ae38d65d03df7cb901f93b8ac8731b9b`, base `main` @@ -94,14 +94,14 @@ Open PRs at the same observation: (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #384: `head` `1bffa5adafa6f015cea355de1b82a370d5791f4b`, base `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). -- PR #387: `head` `cb79302831c0889007699ba7dca2aafa02c01e50`, base `main` +- PR #387: `head` `068ed6a44a7235e2f996450f0d6a7948bdd8732a`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #388: `head` `caea21be9e3485086ae3967fe5e6d23199b5459`, base +- PR #388: `head` `86ac1d41d0e1acb9f29588adbdc8138ba822cef5`, base `feat/event-lineage-channel-evidence` - (`cb79302831c0889007699ba7dca2aafa02c01e50`). -- PR #389: `head` `d4a486b15412340734541efca7a6e5050a7cd02c`, base + (`6e32ecac3677b220adf42ea7e7d5157d5dd80b8a`). +- PR #389: `head` `788bacd998634f09ca7debc1745fe279d788122f`, base `feat/post-body-footnote-display` - (`caea21be9e3485086ae3967fe5e6d23199b5459`). + (`86ac1d41d0e1acb9f29588adbdc8138ba822cef5`). The open queue remains subject to exact-current-head Checks, formal independent approval, and protected mergeability. Green Checks alone do not prove that a @@ -257,8 +257,8 @@ Observed at `2026-08-21T17:10:21Z` on PR #387's exact head the orchestrated rebuild/import boundary. Hosted Checks are queued and no independent approval or merge commit is claimed. -Observed at `2026-08-21T18:17:06Z` on PR #388's exact head -`caea21be9e3485086ae3967fe5e6d23199b5459`: +Observed at `2026-08-21T18:28:15Z` on PR #388's exact head +`86ac1d41d0e1acb9f29588adbdc8138ba822cef5`: - The browser fallback preserves footnote roles for synthetic HTML footnote lists, Word `MsoFootnoteText`, and OOXML footnote containers. Anchor tags no @@ -273,8 +273,8 @@ Observed at `2026-08-21T18:17:06Z` on PR #388's exact head passed 149 frontend tests, lint, build, and diff check. Hosted Checks and independent approval remain open. -Observed at `2026-08-21T18:17:06Z` on PR #389's exact head -`d4a486b15412340734541efca7a6e5050a7cd02c`: +Observed at `2026-08-21T18:28:15Z` on PR #389's exact head +`788bacd998634f09ca7debc1745fe279d788122f`: - The buyer-facing fallback renders a Markdown table in a normal source body, including an empty cell, without converting ordinary pipe-delimited prose. @@ -282,14 +282,15 @@ Observed at `2026-08-21T18:17:06Z` on PR #389's exact head remain supported only in the image-evidence path. Candidate pipe rows are buffered until a valid Markdown separator and data rows confirm a table, so a lone pipe line cannot split the surrounding paragraph. The #388 wrapped - footnote fix is included through a regular stack merge. -- Local frontend verification passed 155 Vitest tests, lint, production build, + footnote fix is included through a regular stack merge. The PR ref also + contains the current backend lineage parent, so exact-head verification + passed 21 focused backend tests and 155 Vitest tests, lint, production build, and `git diff --check`. Hosted Checks, independent approval, and a protected merge commit remain absent. This remains an open stacked fix, not a resolved production gap. -Observed at `2026-08-21T18:14:02Z` on PR #387's exact head -`cb79302831c0889007699ba7dca2aafa02c01e50`: +Observed at `2026-08-21T18:28:15Z` on PR #387's exact head +`068ed6a44a7235e2f996450f0d6a7948bdd8732a`: - The Event Lineage channel-evidence persistence check now budgets one half-quantum per six-decimal contribution plus a small floating-point guard, @@ -299,9 +300,10 @@ Observed at `2026-08-21T18:14:02Z` on PR #387's exact head rebuild now offloads synchronous reconstruction and the visible graph bounds evidence reads to visible endpoint IDs. The rebuild transaction now starts only after reconstruction, so slow orchestrator work cannot hold a pooled - connection idle in transaction. Local verification on this exact head passed - 769 backend tests with 17 environment skips; hosted Checks were queued and - no independent approval or merge commit was present. + connection idle in transaction. The current branch also carries the + structured-footnote frontend change. Local verification passed 21 focused + backend tests and 149 frontend tests, lint, build, and diff check; hosted + Checks and no independent approval or merge commit were present. Observed at `2026-08-21T18:11:51Z` on PR #383's current head `6525127008b3ba74526e8ffb8d8bf25630cf58db`: @@ -337,9 +339,9 @@ The remaining PR #383 `osv-scan` failure is a central workflow defect: the scan exited successfully, but the follow-up treated a missing baseline result file as failure after the head checkout. Central `.github` PR #1158 is the broader source-provenance repair at exact head -`acbd253df81e06d18ed758de1ce748ad6729faa0`; central PR #1002 independently +`9b44801730a05c21e82095e3fede3efbfaeadd13`; central PR #1002 independently adds the minimal result-preservation and review-placeholder repair at exact -head `e46777fc541d4e0aa1484348928a2847a81c6952`. Both remain open with non-terminal +head `8a1e12960d6b91ebe6b1f857e67fe69a8cd2e539`. Both remain open with non-terminal Checks and no independent approval, so PR #383 is not reported green or mergeable from this historical failure alone. From 57adc6216c71d899e5251f83e4f455e75ab1a782 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 03:38:01 +0900 Subject: [PATCH 057/109] docs: record completed stack merges --- docs/product-technical-gap-baseline.md | 42 ++++++++++++++------------ 1 file changed, 22 insertions(+), 20 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 874cf08e2..df8f380dd 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -107,10 +107,9 @@ Open PRs at the same observation: The open queue remains subject to exact-current-head Checks, formal independent approval, and protected mergeability. Green Checks alone do not prove that a -merge is authorized. PR #388 is stacked on PR #387 and now follows its current -branch head through a normal branch merge; neither has a protected merge -commit. PR #389 is stacked on #388 and follows #388 through a normal branch -merge. PR #258 still targets `main` at base +merge is authorized. PRs #388, #389, and #390 were merged into non-main stack +bases through normal merge commits; PR #387 remains the open main-targeting +parent carrying those changes. PR #258 still targets `main` at base `ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7` and remains open; PR #385's merge commit is later repository history, not PR #258's original base or a merge of #258. PR #386 is closed as a duplicate of the safer #373 login fix. PR #382's @@ -272,8 +271,10 @@ Observed at `2026-08-21T18:28:15Z` on PR #388's exact head matching no longer strips tag names that merely start with `a`. A labeled `div` wrapper around an unlabeled HTML list now marks the nested footnotes, while closing the wrapper returns to ordinary content. Local verification - passed 149 frontend tests, lint, build, and diff check. Hosted Checks and - independent approval remain open. + passed 149 frontend tests, lint, build, and diff check. The PR was merged into + the non-main #387 stack base with merge commit + `068ed6a44a7235e2f996450f0d6a7948bdd8732a`; this is not a protected-main + merge. Observed at `2026-08-21T18:28:15Z` on PR #389's exact head `788bacd998634f09ca7debc1745fe279d788122f`: @@ -287,9 +288,9 @@ Observed at `2026-08-21T18:28:15Z` on PR #389's exact head footnote fix is included through a regular stack merge. The PR ref also contains the current backend lineage parent, so exact-head verification passed 21 focused backend tests and 155 Vitest tests, lint, production build, - and `git diff --check`. Hosted Checks, independent approval, and a protected - merge commit remain absent. This remains an open stacked fix, not a resolved - production gap. + and `git diff --check`. The PR was merged into the non-main #388 stack base + with merge commit `778c5df1223ed60a6494e8896079b3ece97669f4`; this is not a + protected-main merge. Observed at `2026-08-21T18:29:27Z` on PR #387's exact head `13c102532f4485c732a83c7741e0844c77f082e5`: @@ -315,8 +316,9 @@ Observed at `2026-08-21T18:27:23Z` on PR #390's exact head - The follow-up keeps pipe-bearing list items as separate semantic segments, then merges the current stacked base `778c5df1` normally to restore PR ancestry. Local verification passed 156 frontend tests, lint, production - build, and `git diff --check`. Checks were queued and no independent - approval or protected-main merge was present. + build, and `git diff --check`. The PR was merged into the non-main #389 stack + base with merge commit `b020378710a0e405974538d80f7ef68ae3badd7c`; this is + not a protected-main merge. Observed at `2026-08-21T18:11:51Z` on PR #383's current head `6525127008b3ba74526e8ffb8d8bf25630cf58db`: @@ -327,15 +329,15 @@ Observed at `2026-08-21T18:11:51Z` on PR #383's current head passed; hosted Checks, independent approval, and a protected merge commit remain absent. -Observed at `2026-08-21T17:32:25Z` on PR #349's exact head -`979b4290bc62ab83668aab99cc09c2a297db8464`: +Observed at `2026-08-21T18:33:15Z` on PR #349's exact head +`13e576ec00e73f90bf1d8d7f572ce69ead33ce0b`: - The ontology source cursor now uses `src.v2.` AES-GCM with a fresh 96-bit nonce and prefix/version associated data; the custom v1 keystream format is rejected. The concurrent ontology page retry repair remains included. - ADR 0125 records the decision and NIST SP 800-38D APA 7 reference. Local - verification passed 830 backend tests with 17 environment skips, 172 - frontend tests, lint, TypeScript, and production build; hosted Checks and + verification passed 7 focused backend tests, 172 frontend tests, lint, + TypeScript, and production build; hosted Checks and independent approval remained open. ## 6. Organization OpenTelemetry Evidence Boundary @@ -352,18 +354,18 @@ The remaining PR #383 `osv-scan` failure is a central workflow defect: the scan exited successfully, but the follow-up treated a missing baseline result file as failure after the head checkout. Central `.github` PR #1158 is the broader source-provenance repair at exact head -`9b44801730a05c21e82095e3fede3efbfaeadd13`; central PR #1002 independently +`c24ce16ab72c5b372d2c397f0af8f84dc1b63d2f`; central PR #1002 independently adds the minimal result-preservation and review-placeholder repair at exact -head `8a1e12960d6b91ebe6b1f857e67fe69a8cd2e539`. Both remain open with non-terminal +head `a5163b4db0f25c0f2463fdeb075a74c8c0f2f6bf`. Both remain open with non-terminal Checks and no independent approval, so PR #383 is not reported green or mergeable from this historical failure alone. ## 7. Next Implementation Order -1. Revalidate open PRs #258, #349, #355, #368, #373, #383, #384, #387, #388, - and #389 at +1. Revalidate open PRs #258, #349, #355, #368, #373, #383, #384, and #387 at their exact current heads as Checks and formal independent approvals arrive; - process stacked parents only after their child merge commits are observed. + the #388/#389/#390 stack merges are already recorded above, so process the + open #387 parent only after its current-head gates pass. Verify the synthetic footnote/table cases in the authenticated browser and use the protected external corpus only for aggregate, non-identifying runtime evidence. From d5416641fea7388c520452746f34275274c32fbf Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 03:37:53 +0900 Subject: [PATCH 058/109] docs: refresh central workflow exact heads --- docs/product-technical-gap-baseline.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index df8f380dd..935f3575b 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -352,13 +352,14 @@ GRC evidence subjects. The remaining PR #383 `osv-scan` failure is a central workflow defect: the scan exited successfully, but the follow-up treated a missing baseline result file -as failure after the head checkout. Central `.github` PR #1158 is the broader -source-provenance repair at exact head -`c24ce16ab72c5b372d2c397f0af8f84dc1b63d2f`; central PR #1002 independently -adds the minimal result-preservation and review-placeholder repair at exact -head `a5163b4db0f25c0f2463fdeb075a74c8c0f2f6bf`. Both remain open with non-terminal -Checks and no independent approval, so PR #383 is not reported green or -mergeable from this historical failure alone. +as failure after the head checkout. Central `.github` PR #1158 now contains the +direct-source result-file repair (`--output-file`) at observed exact head +`c24ce16ab72c5b372d2c397f0af8f84dc1b63d2f`; its provenance, Python contracts, +and exact-head policy checks pass while the remaining security/queue checks are +still non-terminal. Central PR #1002 independently remains open at observed +exact head `a5163b4db0f25c0f2463fdeb075a74c8c0f2f6bf` with the required checks +still running. Neither PR has independent approval, so PR #383 is not reported +green or mergeable from this historical failure alone. ## 7. Next Implementation Order From 27fc6caa6e49f7c261252ab9561bd31d59d0a14c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 03:39:39 +0900 Subject: [PATCH 059/109] docs: refresh baseline PR head --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 935f3575b..81ed10c3f 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -91,7 +91,7 @@ Open PRs at the same observation: merge commit is intentional: #355 is the open successor from the same feature branch, now pointing at that merged branch tip, and is not itself merged. -- PR #368: `head` `6fac2680b9b73c78f1b3e3fb8860b5289fe50be2` (the exact current +- PR #368: `head` `d5416641fea7388c520452746f34275274c32fbf` (the exact current documentation checkpoint), base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #373: `head` `43e24783ae38d65d03df7cb901f93b8ac8731b9b`, base `main` From 3231568c6f3cf1b3598d1960e09a8d501a0bbb4f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 03:42:55 +0900 Subject: [PATCH 060/109] docs: refresh current product gap evidence --- docs/product-technical-gap-baseline.md | 53 +++++++++++++------------- 1 file changed, 27 insertions(+), 26 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 81ed10c3f..00d0f4b23 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -49,7 +49,7 @@ ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or -`resolved` from intent alone. Observed at `2026-08-21T18:29:27Z` from the +`resolved` from intent alone. Observed at `2026-08-21T18:39:50Z` from the GitHub API. Checkpoint types are `merge_commit`, `head`, and `closed_without_merge`; the latter records a closed PR's exact `head` when `merged_at` and `merge_commit_sha` are both absent. A merged commit is @@ -84,19 +84,19 @@ Open PRs at the same observation: - PR #258: `head` `6621eb116a4e92eb33eeae989c70fbc602450c51`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #349: `head` `13e576ec00e73f90bf1d8d7f572ce69ead33ce0b`, base `main` +- PR #349: `head` `202194a2d9ba6da49a011ca6127a00f6bf5394ba`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #355: `head` `b606c2553f877fa85968d90dc46598ce16897fbf`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). The overlap with PR #379's merge commit is intentional: #355 is the open successor from the same feature branch, now pointing at that merged branch tip, and is not itself merged. -- PR #368: `head` `d5416641fea7388c520452746f34275274c32fbf` (the exact current +- PR #368: `head` `27fc6caa6e49f7c261252ab9561bd31d59d0a14c` (the exact current documentation checkpoint), base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #373: `head` `43e24783ae38d65d03df7cb901f93b8ac8731b9b`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #383: `head` `6525127008b3ba74526e8ffb8d8bf25630cf58db`, base `main` +- PR #383: `head` `3584c31c22a432399c694588a4786c445f943848`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #384: `head` `13bf132f06f52adb01997c6a805d440fea6f40f7`, base `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). @@ -112,15 +112,17 @@ bases through normal merge commits; PR #387 remains the open main-targeting parent carrying those changes. PR #258 still targets `main` at base `ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7` and remains open; PR #385's merge commit is later repository history, not PR #258's original base or a merge of -#258. PR #386 is closed as a duplicate of the safer #373 login fix. PR #382's +PR #258. PR #386 is closed as a duplicate of the safer #373 login fix. PR #382's stack merge is not a main merge; #373 must still pass its own current-head gates. -Queue refresh at the same observation: PRs #387, #390, #349, and #368 remained -open without an independent `APPROVED` review and with non-terminal Checks. -PRs #388 and #389 were merged into stack bases only; their merge commits are -not protected-main merges. The current exact HEAD, review, and terminal-check -gates must be re-read before any future merge action. +Queue refresh at `2026-08-21T18:39:50Z`: PRs #258, #355, #373, and #384 had +terminal successful Checks but no independent `APPROVED` review, so none was +authorized to merge. PRs #349, #368, #383, and #387 had no failed Checks +observed at their exact heads but retained non-terminal Checks and no +independent approval. PRs #388, #389, and #390 were merged into stack bases +only; their merge commits are not protected-main merges. Re-read the exact +current HEAD, review, and terminal-check gates before every future merge. Closed without merge at the same observation: @@ -329,16 +331,15 @@ Observed at `2026-08-21T18:11:51Z` on PR #383's current head passed; hosted Checks, independent approval, and a protected merge commit remain absent. -Observed at `2026-08-21T18:33:15Z` on PR #349's exact head -`13e576ec00e73f90bf1d8d7f572ce69ead33ce0b`: +Observed at `2026-08-21T18:39:50Z` on PR #349's exact head +`202194a2d9ba6da49a011ca6127a00f6bf5394ba`: - The ontology source cursor now uses `src.v2.` AES-GCM with a fresh 96-bit nonce and prefix/version associated data; the custom v1 keystream format is rejected. The concurrent ontology page retry repair remains included. -- ADR 0125 records the decision and NIST SP 800-38D APA 7 reference. Local - verification passed 7 focused backend tests, 172 frontend tests, lint, - TypeScript, and production build; hosted Checks and - independent approval remained open. +- ADR 0125 records the decision and NIST SP 800-38D APA 7 reference. The + static SQL review contract repair passed 17 focused tests and compilation; + hosted Checks remained non-terminal and no independent approval was present. ## 6. Organization OpenTelemetry Evidence Boundary @@ -350,16 +351,16 @@ OpenTelemetry attributes correlate the authorized operation across services; collector delivery, retention, access review, and no-export rollback are the GRC evidence subjects. -The remaining PR #383 `osv-scan` failure is a central workflow defect: the scan -exited successfully, but the follow-up treated a missing baseline result file -as failure after the head checkout. Central `.github` PR #1158 now contains the -direct-source result-file repair (`--output-file`) at observed exact head -`c24ce16ab72c5b372d2c397f0af8f84dc1b63d2f`; its provenance, Python contracts, -and exact-head policy checks pass while the remaining security/queue checks are -still non-terminal. Central PR #1002 independently remains open at observed -exact head `a5163b4db0f25c0f2463fdeb075a74c8c0f2f6bf` with the required checks -still running. Neither PR has independent approval, so PR #383 is not reported -green or mergeable from this historical failure alone. +The historical PR #383 `osv-scan` failure was a central workflow defect: the +scan exited successfully, but the follow-up treated a missing baseline result +file as failure after the head checkout. Central `.github` PR #1158 now +contains the direct-source result-file repair (`--output-file`) at observed +exact head `c24ce16ab72c5b372d2c397f0af8f84dc1b63d2f`; its provenance, Python +contracts, and exact-head policy checks pass. The current #383 head has no +failed Checks observed but still has non-terminal Checks and no independent +approval, so it is not authorized to merge. Central PR #1002 independently +remains open at observed exact head +`a5163b4db0f25c0f2463fdeb075a74c8c0f2f6bf` with required checks still running. ## 7. Next Implementation Order From 4efd5e73abfb88fa53dca66cbcfc337cd7c715ea Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 03:44:55 +0900 Subject: [PATCH 061/109] docs: record nested list indentation follow-up --- docs/product-technical-gap-baseline.md | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 00d0f4b23..ec416e2d5 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -8,7 +8,9 @@ ## 1. Known Parsing & Frontend Display Gaps - **Footnote Parsing**: synthetic case `case-footnote-01` exercises numbered footnote recognition; PR #367 merged semantic-chunker coverage, and stacked PR #388 adds browser fallback recognition for HTML, Word, and OOXML footnotes. Authorized production/browser corpus evidence remains pending. - **Table Parsing**: synthetic case `case-table-01` exercises malformed row boundaries and empty cells; PR #389 now covers ordinary Markdown rendering, while region-aware image tables and protected-corpus evidence remain open. -- **Indentation**: synthetic cases `case-indent-01` and `case-indent-02` retain incorrect indentation rendering coverage gaps. +- **Indentation**: synthetic cases `case-indent-01` and `case-indent-02` retain + corpus coverage gaps; PR #391 adds the common nested HTML-list depth fix and + regression coverage, while authorized production/browser evidence remains open. - **Image/Table OCR**: synthetic case `case-image-table-01` still needs region-aware table OCR, markdown rendering, and sufficiently detailed buyer-safe image evidence. - **Math/Superscripts**: synthetic case `case-math-01` covers bounded metric normalization such as m³; arbitrary formula semantics and authorized runtime verification remain open after PR #344. - **Missing UI Elements**: synthetic case `case-dag-01` tracks the Event Lineage DAG surface; current source includes the DAG, but corpus coverage and browser evidence remain open. @@ -102,6 +104,8 @@ Open PRs at the same observation: `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). - PR #387: `head` `13c102532f4485c732a83c7741e0844c77f082e5`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). +- PR #391: `head` `d2216ce7ee866d24cab9933eb2fd871a1b4da140`, base PR #387 + (`13c102532f4485c732a83c7741e0844c77f082e5`). - PR #388, #389, and #390 are closed after the stack merges recorded above; they are not open PRs at this checkpoint. @@ -322,6 +326,15 @@ Observed at `2026-08-21T18:27:23Z` on PR #390's exact head base with merge commit `b020378710a0e405974538d80f7ef68ae3badd7c`; this is not a protected-main merge. +Observed at `2026-08-22T03:43:10Z` on PR #391's exact head +`d2216ce7ee866d24cab9933eb2fd871a1b4da140`: + +- The shared fallback parser now carries nested ordered/unordered-list depth + into semantic text-unit indentation and keeps sibling items at their parent + level. Local verification passed 157 frontend tests, lint, production build, + and `git diff --check`. Hosted Checks were one pass and three pending at the + observation; no independent approval or merge was claimed. + Observed at `2026-08-21T18:11:51Z` on PR #383's current head `6525127008b3ba74526e8ffb8d8bf25630cf58db`: @@ -364,7 +377,7 @@ remains open at observed exact head ## 7. Next Implementation Order -1. Revalidate open PRs #258, #349, #355, #368, #373, #383, #384, and #387 at +1. Revalidate open PRs #258, #349, #355, #368, #373, #383, #384, #387, and #391 at their exact current heads as Checks and formal independent approvals arrive; the #388/#389/#390 stack merges are already recorded above, so process the open #387 parent only after its current-head gates pass. From 2ea8e3d8d25414429f3bacc9b1e97ae589ce352c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 03:46:19 +0900 Subject: [PATCH 062/109] docs: record baseline checkpoint head --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index ec416e2d5..4ebebdc71 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -93,7 +93,7 @@ Open PRs at the same observation: merge commit is intentional: #355 is the open successor from the same feature branch, now pointing at that merged branch tip, and is not itself merged. -- PR #368: `head` `27fc6caa6e49f7c261252ab9561bd31d59d0a14c` (the exact current +- PR #368: `head` `4efd5e73abfb88fa53dca66cbcfc337cd7c715ea` (the exact current documentation checkpoint), base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #373: `head` `43e24783ae38d65d03df7cb901f93b8ac8731b9b`, base `main` From 320be1af542343a8991b3da172bfd747d98e3c01 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 03:49:31 +0900 Subject: [PATCH 063/109] docs: capture current open PR checks --- docs/product-technical-gap-baseline.md | 33 +++++++++++++++++++------- 1 file changed, 24 insertions(+), 9 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 4ebebdc71..ab35acf23 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -93,7 +93,7 @@ Open PRs at the same observation: merge commit is intentional: #355 is the open successor from the same feature branch, now pointing at that merged branch tip, and is not itself merged. -- PR #368: `head` `4efd5e73abfb88fa53dca66cbcfc337cd7c715ea` (the exact current +- PR #368: `head` `2ea8e3d8d25414429f3bacc9b1e97ae589ce352c` (the exact current documentation checkpoint), base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #373: `head` `43e24783ae38d65d03df7cb901f93b8ac8731b9b`, base `main` @@ -102,7 +102,7 @@ Open PRs at the same observation: (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #384: `head` `13bf132f06f52adb01997c6a805d440fea6f40f7`, base `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). -- PR #387: `head` `13c102532f4485c732a83c7741e0844c77f082e5`, base `main` +- PR #387: `head` `7a0a5f649c766d967d73265ae7833aa7c070f542`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #391: `head` `d2216ce7ee866d24cab9933eb2fd871a1b4da140`, base PR #387 (`13c102532f4485c732a83c7741e0844c77f082e5`). @@ -335,8 +335,16 @@ Observed at `2026-08-22T03:43:10Z` on PR #391's exact head and `git diff --check`. Hosted Checks were one pass and three pending at the observation; no independent approval or merge was claimed. -Observed at `2026-08-21T18:11:51Z` on PR #383's current head -`6525127008b3ba74526e8ffb8d8bf25630cf58db`: +Observed at `2026-08-22T03:44:00Z` on PR #387's exact head +`7a0a5f649c766d967d73265ae7833aa7c070f542`: + +- The remote branch advanced after the earlier local 770-test checkpoint. + Current hosted checks were still queued (15 pending, no failure observed) and + no independent approval was present; the earlier local result is not claimed + as evidence for this newer head. + +Observed at `2026-08-22T03:44:00Z` on PR #383's current head +`3584c31c22a432399c694588a4786c445f943848`: - `TypeError` from post-chat/global-agent and post-content-worker paths is now classified as an internal failure, while provider transport/configuration @@ -344,6 +352,13 @@ Observed at `2026-08-21T18:11:51Z` on PR #383's current head passed; hosted Checks, independent approval, and a protected merge commit remain absent. +- The hosted `osv-scan` job `96871880120` still fails after both scans exit 0: + the central workflow passes deprecated `--output=old-results.json` and + `--output=new-results.json`, then `test -s` cannot find those files. This is + the same central defect addressed, but not yet merged, by `.github` PR #1158; + the application PR remains unmergeable until its current Checks and approval + gates pass. + Observed at `2026-08-21T18:39:50Z` on PR #349's exact head `202194a2d9ba6da49a011ca6127a00f6bf5394ba`: @@ -364,15 +379,15 @@ OpenTelemetry attributes correlate the authorized operation across services; collector delivery, retention, access review, and no-export rollback are the GRC evidence subjects. -The historical PR #383 `osv-scan` failure was a central workflow defect: the +The current PR #383 `osv-scan` failure is a central workflow defect: the scan exited successfully, but the follow-up treated a missing baseline result file as failure after the head checkout. Central `.github` PR #1158 now contains the direct-source result-file repair (`--output-file`) at observed exact head `c24ce16ab72c5b372d2c397f0af8f84dc1b63d2f`; its provenance, Python -contracts, and exact-head policy checks pass. The current #383 head has no -failed Checks observed but still has non-terminal Checks and no independent -approval, so it is not authorized to merge. Central PR #1002 independently -remains open at observed exact head +contracts, and exact-head policy checks pass. The current #383 head still has +the `osv-scan` failure above, while other Checks are non-terminal and no +independent approval is present, so it is not authorized to merge. Central PR +#1002 independently remains open at observed exact head `a5163b4db0f25c0f2463fdeb075a74c8c0f2f6bf` with required checks still running. ## 7. Next Implementation Order From fb0f46e76e5a316cf51dca52f40971dcc0bc593a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 03:51:08 +0900 Subject: [PATCH 064/109] docs: refresh current PR gate evidence --- docs/product-technical-gap-baseline.md | 48 ++++++++++++++------------ 1 file changed, 26 insertions(+), 22 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index ab35acf23..dc54f1681 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -51,7 +51,7 @@ ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or -`resolved` from intent alone. Observed at `2026-08-21T18:39:50Z` from the +`resolved` from intent alone. Observed at `2026-08-21T18:50:17Z` from the GitHub API. Checkpoint types are `merge_commit`, `head`, and `closed_without_merge`; the latter records a closed PR's exact `head` when `merged_at` and `merge_commit_sha` are both absent. A merged commit is @@ -93,14 +93,14 @@ Open PRs at the same observation: merge commit is intentional: #355 is the open successor from the same feature branch, now pointing at that merged branch tip, and is not itself merged. -- PR #368: `head` `2ea8e3d8d25414429f3bacc9b1e97ae589ce352c` (the exact current +- PR #368: `head` `320be1af542343a8991b3da172bfd747d98e3c01` (the exact current documentation checkpoint), base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #373: `head` `43e24783ae38d65d03df7cb901f93b8ac8731b9b`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #383: `head` `3584c31c22a432399c694588a4786c445f943848`, base `main` +- PR #383: `head` `6af3adc3e08fd1b0b11182d8cf3714b847c71ea8`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #384: `head` `13bf132f06f52adb01997c6a805d440fea6f40f7`, base +- PR #384: `head` `a32bbda48e1ed873362e6e7bd6e47766d9998bb5`, base `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). - PR #387: `head` `7a0a5f649c766d967d73265ae7833aa7c070f542`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). @@ -120,13 +120,16 @@ PR #258. PR #386 is closed as a duplicate of the safer #373 login fix. PR #382's stack merge is not a main merge; #373 must still pass its own current-head gates. -Queue refresh at `2026-08-21T18:39:50Z`: PRs #258, #355, #373, and #384 had +Queue refresh at `2026-08-21T18:50:17Z`: PRs #258, #355, and #373 had terminal successful Checks but no independent `APPROVED` review, so none was -authorized to merge. PRs #349, #368, #383, and #387 had no failed Checks -observed at their exact heads but retained non-terminal Checks and no -independent approval. PRs #388, #389, and #390 were merged into stack bases -only; their merge commits are not protected-main merges. Re-read the exact -current HEAD, review, and terminal-check gates before every future merge. +authorized to merge. PRs #349, #368, #383, #384, #387, and #391 had no failed +Checks observed at their exact heads but retained non-terminal Checks and no +independent approval. PR #355 also retained a `CHANGES_REQUESTED` review +decision from the earlier stale coverage verdict; it remains unmergeable until +the current-head review is refreshed. PRs #388, #389, and #390 were merged +into stack bases only; their merge commits are not protected-main merges. +Re-read the exact current HEAD, review, and terminal-check gates before every +future merge. Closed without merge at the same observation: @@ -343,16 +346,16 @@ Observed at `2026-08-22T03:44:00Z` on PR #387's exact head no independent approval was present; the earlier local result is not claimed as evidence for this newer head. -Observed at `2026-08-22T03:44:00Z` on PR #383's current head -`3584c31c22a432399c694588a4786c445f943848`: +Observed at `2026-08-21T18:50:17Z` on PR #383's current head +`6af3adc3e08fd1b0b11182d8cf3714b847c71ea8`: -- `TypeError` from post-chat/global-agent and post-content-worker paths is now +- `TypeError` from post-chat/global-agent and post-content-worker paths remains classified as an internal failure, while provider transport/configuration - errors retain `provider_unavailable`. Focused worker and diagnostics tests - passed; hosted Checks, independent approval, and a protected merge commit - remain absent. + errors retain `provider_unavailable`. The current head has no failed Checks + observed, but hosted Checks remain non-terminal and no independent approval + or protected merge commit is present. -- The hosted `osv-scan` job `96871880120` still fails after both scans exit 0: +- The former hosted `osv-scan` job `96871880120` failed after both scans exit 0: the central workflow passes deprecated `--output=old-results.json` and `--output=new-results.json`, then `test -s` cannot find those files. This is the same central defect addressed, but not yet merged, by `.github` PR #1158; @@ -379,15 +382,16 @@ OpenTelemetry attributes correlate the authorized operation across services; collector delivery, retention, access review, and no-export rollback are the GRC evidence subjects. -The current PR #383 `osv-scan` failure is a central workflow defect: the +The former PR #383 `osv-scan` failure at head +`3584c31c22a432399c694588a4786c445f943848` was a central workflow defect: the scan exited successfully, but the follow-up treated a missing baseline result file as failure after the head checkout. Central `.github` PR #1158 now contains the direct-source result-file repair (`--output-file`) at observed exact head `c24ce16ab72c5b372d2c397f0af8f84dc1b63d2f`; its provenance, Python -contracts, and exact-head policy checks pass. The current #383 head still has -the `osv-scan` failure above, while other Checks are non-terminal and no -independent approval is present, so it is not authorized to merge. Central PR -#1002 independently remains open at observed exact head +contracts, and exact-head policy checks pass. The current #383 head +`6af3adc3e08fd1b0b11182d8cf3714b847c71ea8` has no failed Checks observed but +remains non-terminal and unauthorized to merge. Central PR #1002 independently +remains open at observed exact head `a5163b4db0f25c0f2463fdeb075a74c8c0f2f6bf` with required checks still running. ## 7. Next Implementation Order From 468258dba1abc420b56c43acc0acab7e29606022 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 03:51:32 +0900 Subject: [PATCH 065/109] docs: correct final indentation verification --- docs/product-technical-gap-baseline.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index dc54f1681..0a4c083d2 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -104,8 +104,8 @@ Open PRs at the same observation: `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). - PR #387: `head` `7a0a5f649c766d967d73265ae7833aa7c070f542`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #391: `head` `d2216ce7ee866d24cab9933eb2fd871a1b4da140`, base PR #387 - (`13c102532f4485c732a83c7741e0844c77f082e5`). +- PR #391: `head` `5a8dbc6229ec700da73e4d1f9e51147e186e44ab`, base PR #387 + (`7a0a5f649c766d967d73265ae7833aa7c070f542`). - PR #388, #389, and #390 are closed after the stack merges recorded above; they are not open PRs at this checkpoint. @@ -329,12 +329,13 @@ Observed at `2026-08-21T18:27:23Z` on PR #390's exact head base with merge commit `b020378710a0e405974538d80f7ef68ae3badd7c`; this is not a protected-main merge. -Observed at `2026-08-22T03:43:10Z` on PR #391's exact head -`d2216ce7ee866d24cab9933eb2fd871a1b4da140`: +Observed at `2026-08-22T03:50:18Z` on PR #391's exact head +`5a8dbc6229ec700da73e4d1f9e51147e186e44ab`: - The shared fallback parser now carries nested ordered/unordered-list depth into semantic text-unit indentation and keeps sibling items at their parent - level. Local verification passed 157 frontend tests, lint, production build, + level. After a normal merge of the latest #387 parent, local verification + passed 156 frontend tests, lint, production build, and `git diff --check`. Hosted Checks were one pass and three pending at the observation; no independent approval or merge was claimed. From 5e63e3118e0987b452edf3f7f3ff15c59e42419a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 03:58:26 +0900 Subject: [PATCH 066/109] docs: record latest stacked PR evidence --- docs/product-technical-gap-baseline.md | 38 ++++++++++++-------------- 1 file changed, 18 insertions(+), 20 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 0a4c083d2..05e514744 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -51,7 +51,7 @@ ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or -`resolved` from intent alone. Observed at `2026-08-21T18:50:17Z` from the +`resolved` from intent alone. Observed at `2026-08-21T18:56:50Z` from the GitHub API. Checkpoint types are `merge_commit`, `head`, and `closed_without_merge`; the latter records a closed PR's exact `head` when `merged_at` and `merge_commit_sha` are both absent. A merged commit is @@ -93,7 +93,7 @@ Open PRs at the same observation: merge commit is intentional: #355 is the open successor from the same feature branch, now pointing at that merged branch tip, and is not itself merged. -- PR #368: `head` `320be1af542343a8991b3da172bfd747d98e3c01` (the exact current +- PR #368: `head` `468258dba1abc420b56c43acc0acab7e29606022` (the exact current documentation checkpoint), base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #373: `head` `43e24783ae38d65d03df7cb901f93b8ac8731b9b`, base `main` @@ -102,9 +102,9 @@ Open PRs at the same observation: (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #384: `head` `a32bbda48e1ed873362e6e7bd6e47766d9998bb5`, base `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). -- PR #387: `head` `7a0a5f649c766d967d73265ae7833aa7c070f542`, base `main` +- PR #387: `head` `16f2b13caad10f4d999293d623405aefadeda52e`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #391: `head` `5a8dbc6229ec700da73e4d1f9e51147e186e44ab`, base PR #387 +- PR #391: `head` `e099a916cec6f06b86f335d31c89e01aae248dfd`, base PR #387 (`7a0a5f649c766d967d73265ae7833aa7c070f542`). - PR #388, #389, and #390 are closed after the stack merges recorded above; they are not open PRs at this checkpoint. @@ -120,7 +120,7 @@ PR #258. PR #386 is closed as a duplicate of the safer #373 login fix. PR #382's stack merge is not a main merge; #373 must still pass its own current-head gates. -Queue refresh at `2026-08-21T18:50:17Z`: PRs #258, #355, and #373 had +Queue refresh at `2026-08-21T18:56:50Z`: PRs #258, #355, and #373 had terminal successful Checks but no independent `APPROVED` review, so none was authorized to merge. PRs #349, #368, #383, #384, #387, and #391 had no failed Checks observed at their exact heads but retained non-terminal Checks and no @@ -329,25 +329,23 @@ Observed at `2026-08-21T18:27:23Z` on PR #390's exact head base with merge commit `b020378710a0e405974538d80f7ef68ae3badd7c`; this is not a protected-main merge. -Observed at `2026-08-22T03:50:18Z` on PR #391's exact head -`5a8dbc6229ec700da73e4d1f9e51147e186e44ab`: +Observed at `2026-08-21T18:56:50Z` on PR #391's exact head +`e099a916cec6f06b86f335d31c89e01aae248dfd`: -- The shared fallback parser now carries nested ordered/unordered-list depth - into semantic text-unit indentation and keeps sibling items at their parent - level. After a normal merge of the latest #387 parent, local verification - passed 156 frontend tests, lint, production build, - and `git diff --check`. Hosted Checks were one pass and three pending at the - observation; no independent approval or merge was claimed. +- Nested-list indentation now survives a block child such as + `

  • Child

    • `; the regression is covered by the wrapped-child + fixture. Local verification passed 157 frontend tests, lint, production + build, Storybook build, and `git diff --check`. Two hosted Checks remained + pending and no independent approval or merge was claimed. -Observed at `2026-08-22T03:44:00Z` on PR #387's exact head -`7a0a5f649c766d967d73265ae7833aa7c070f542`: +Observed at `2026-08-21T18:56:50Z` on PR #387's exact head +`16f2b13caad10f4d999293d623405aefadeda52e`: -- The remote branch advanced after the earlier local 770-test checkpoint. - Current hosted checks were still queued (15 pending, no failure observed) and - no independent approval was present; the earlier local result is not claimed - as evidence for this newer head. +- The remote branch advanced again after the interaction and migration-test + repairs. No failed Checks were observed; 14 hosted Checks remained pending + and no independent approval was present. -Observed at `2026-08-21T18:50:17Z` on PR #383's current head +Observed at `2026-08-21T18:56:50Z` on PR #383's current head `6af3adc3e08fd1b0b11182d8cf3714b847c71ea8`: - `TypeError` from post-chat/global-agent and post-content-worker paths remains From 0f73d3ee1cac3da4d8dbcd159802e0d97689d72e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 04:00:26 +0900 Subject: [PATCH 067/109] docs: order buyer evidence chronologically --- docs/product-technical-gap-baseline.md | 87 ++++++++++++++------------ 1 file changed, 46 insertions(+), 41 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 05e514744..240695d8a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -182,25 +182,30 @@ Observed at `2026-08-21T16:01:40Z` in a fresh local Compose browser session: not complete within 30 seconds, so provider/model readiness remains open even though the Compose services are running. -Observed at `2026-08-21T17:52:18Z` in an authenticated Playwright browser run -against the local runtime, using the eleven supplied defect routes and -aggregate-only assertions: - -- OIDC login completed with the local development account. Each of the eleven - post routes opened a detail dialog, its close control was clicked, and the - dialog closed again; no route produced horizontal overflow at 1280x1024. -- Event Lineage and the translated Keyman section were present in all eleven - dialogs. A footnote evidence marker was visible in one route and a rendered - table in one route. Five Keyman list items appeared across two routes; the - remaining nine showed the explicit no-Keyman state. This distinguishes a - real empty extraction signal from a missing panel, while Keyman/entity - quality and coverage remain open product gaps. -- The run intentionally did not persist or print post titles, people, - organizations, source identifiers, credentials, tokens, or body text. +Observed at `2026-08-21T16:16:02Z` in a fresh local Compose browser session +against the authenticated React surface: -These observations are runtime evidence, not a claim that the corresponding -PRs are merged. The image-processing state and protected-corpus parsing cases -remain open gaps. +- The UI/UX Guide v3.0 viewport checks passed at 1920×1080, 1280×1024, + 1024×768, 768×1024, and 375×667: each rendered document had no horizontal + overflow, the authenticated header was sticky, the footer was present, and + the phone drawer became visible only below the phone tier. +- The post popup opened and closed. Its DOM exposed Summary, Key events, and + Event Lineage/graph sections; no R&R rows were rendered because the summary + request returned HTTP 503 before an evidence object existed. This is not + evidence that the R&R component is absent: `App.tsx` still renders it when + persisted roles are available. +- The summary response explained the current buyer-visible gap: `Post summary + is unavailable: image evidence is still being processed`. Aggregate + PostgreSQL evidence was 43,839 source posts, 401 empty-body posts, 97 + persisted summaries, and zero summaries at current contract version 13. + The content-ingestion job registry had 18 failed and zero queued/running + jobs; no live image-summary completion is claimed. +- PR #384's popup CSS was then reduced to the standard three responsive tiers + by removing its extra 1280px media query. The focused CSS contract, lint, + TypeScript, and production build passed locally after the final concurrent + head was reconciled; the earlier 199-test full-suite result preceded that + concurrent commit and is not claimed as final-head evidence. Hosted Checks + and independent approval remain open. Observed at `2026-08-21T16:37:48Z` after one bounded operator retry through the real Compose backend, Valkey, and orchestrator boundary: @@ -225,30 +230,30 @@ the real Compose backend, Valkey, and orchestrator boundary: reference from 0119 to the governing ADR 0131; the focused reconstruction and adjudication tests still passed at the pushed documentation head. -Observed at `2026-08-21T16:16:02Z` in a fresh local Compose browser session -against the authenticated React surface: +Observed at `2026-08-21T17:52:18Z` in an authenticated Playwright browser run +against the local runtime, using the eleven supplied defect routes and +aggregate-only assertions: -- The UI/UX Guide v3.0 viewport checks passed at 1920×1080, 1280×1024, - 1024×768, 768×1024, and 375×667: each rendered document had no horizontal - overflow, the authenticated header was sticky, the footer was present, and - the phone drawer became visible only below the phone tier. -- The post popup opened and closed. Its DOM exposed Summary, Key events, and - Event Lineage/graph sections; no R&R rows were rendered because the summary - request returned HTTP 503 before an evidence object existed. This is not - evidence that the R&R component is absent: `App.tsx` still renders it when - persisted roles are available. -- The summary response explained the current buyer-visible gap: `Post summary - is unavailable: image evidence is still being processed`. Aggregate - PostgreSQL evidence was 43,839 source posts, 401 empty-body posts, 97 - persisted summaries, and zero summaries at current contract version 13. - The content-ingestion job registry had 18 failed and zero queued/running - jobs; no live image-summary completion is claimed. -- PR #384's popup CSS was then reduced to the standard three responsive tiers - by removing its extra 1280px media query. The focused CSS contract, lint, - TypeScript, and production build passed locally after the final concurrent - head was reconciled; the earlier 199-test full-suite result preceded that - concurrent commit and is not claimed as final-head evidence. Hosted Checks - and independent approval remain open. +- OIDC login completed with the local development account. Each of the eleven + post routes opened a detail dialog, its close control was clicked, and the + dialog closed again; no route produced horizontal overflow at 1280x1024. +- Event Lineage and the translated Keyman section were present in all eleven + dialogs. A footnote evidence marker was visible in one route and a rendered + table in one route. Five Keyman list items appeared across two routes; the + remaining nine showed the explicit no-Keyman state. This distinguishes a + real empty extraction signal from a missing panel, while Keyman/entity + quality and coverage remain open product gaps. +- The run intentionally did not persist or print post titles, people, + organizations, source identifiers, credentials, tokens, or body text. + +These observations are runtime evidence, not a claim that the corresponding +PRs are merged. The image-processing state and protected-corpus parsing cases +remain open gaps. + +### Pull-request verification checkpoints + +The dependency-stack order below is intentional; its UTC timestamps, rather +than entry position, define the observation sequence. Observed at `2026-08-21T17:10:21Z` on PR #387's exact head `4faf9a31371195c5ec63fca42a5afbb93a95369b`: From 7d7c200715ac4c26733b3a0b57f932f24eec780f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 04:02:53 +0900 Subject: [PATCH 068/109] docs: refresh central PR gate observation --- docs/product-technical-gap-baseline.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 240695d8a..281a6c847 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -391,12 +391,13 @@ The former PR #383 `osv-scan` failure at head scan exited successfully, but the follow-up treated a missing baseline result file as failure after the head checkout. Central `.github` PR #1158 now contains the direct-source result-file repair (`--output-file`) at observed -exact head `c24ce16ab72c5b372d2c397f0af8f84dc1b63d2f`; its provenance, Python -contracts, and exact-head policy checks pass. The current #383 head +exact head `fca5cd1e3d14418b8a5fc5cd3636815582228457`; its provenance, Python +contracts, and exact-head policy checks are non-terminal on this new head, with +no failure presently observed. The current #383 head `6af3adc3e08fd1b0b11182d8cf3714b847c71ea8` has no failed Checks observed but remains non-terminal and unauthorized to merge. Central PR #1002 independently remains open at observed exact head -`a5163b4db0f25c0f2463fdeb075a74c8c0f2f6bf` with required checks still running. +`a9880aeb86d424967b94417ac15c38fb94950aab` with required checks still running. ## 7. Next Implementation Order From 7855f2af0c516a0a4f6228e0b9230e6062d326be Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 04:04:56 +0900 Subject: [PATCH 069/109] docs: record latest stack and product PR --- docs/product-technical-gap-baseline.md | 27 +++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 281a6c847..67cf692b8 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -81,6 +81,8 @@ Recently merged into an open stack base (not main): into PR #388's `feat/post-body-footnote-display` base. - PR #390: `merge_commit` `b020378710a0e405974538d80f7ef68ae3badd7c`, merged into PR #389's `feat/markdown-table-display` base. +- PR #391: `merge_commit` `16f2b13caad10f4d999293d623405aefadeda52e`, merged + into PR #387's `feat/event-lineage-channel-evidence` base. Open PRs at the same observation: @@ -93,20 +95,20 @@ Open PRs at the same observation: merge commit is intentional: #355 is the open successor from the same feature branch, now pointing at that merged branch tip, and is not itself merged. -- PR #368: `head` `468258dba1abc420b56c43acc0acab7e29606022` (the exact current +- PR #368: `head` `7d7c200715ac4c26733b3a0b57f932f24eec780f` (the exact current documentation checkpoint), base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #373: `head` `43e24783ae38d65d03df7cb901f93b8ac8731b9b`, base `main` +- PR #373: `head` `151fe6e177416a5d83b5539a73d97737c12d1ce4`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #383: `head` `6af3adc3e08fd1b0b11182d8cf3714b847c71ea8`, base `main` +- PR #383: `head` `b1d32a93632164cf1379f24fc9aca71c5d29b746`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #384: `head` `a32bbda48e1ed873362e6e7bd6e47766d9998bb5`, base `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). - PR #387: `head` `16f2b13caad10f4d999293d623405aefadeda52e`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #391: `head` `e099a916cec6f06b86f335d31c89e01aae248dfd`, base PR #387 - (`7a0a5f649c766d967d73265ae7833aa7c070f542`). -- PR #388, #389, and #390 are closed after the stack merges recorded above; +- PR #392: `head` `a046da4e52c484807fc28111bd813d1acbc00816`, base `main` + (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). +- PR #388, #389, #390, and #391 are closed after the stack merges recorded above; they are not open PRs at this checkpoint. The open queue remains subject to exact-current-head Checks, formal independent @@ -131,6 +133,15 @@ into stack bases only; their merge commits are not protected-main merges. Re-read the exact current HEAD, review, and terminal-check gates before every future merge. +Queue refresh at `2026-08-22T04:00:00Z`: PR #391 is now merged into the open +#387 stack parent with merge commit +`16f2b13caad10f4d999293d623405aefadeda52e`; this is not a protected-main +merge. New PR #392 is open at exact head +`a046da4e52c484807fc28111bd813d1acbc00816` with one passing and twelve pending +non-skipped Checks and no independent approval. The remaining open PRs were +not authorized to merge from this observation because approval and/or terminal +Checks were still absent. + Closed without merge at the same observation: - PR #386: `closed_without_merge` head `57a013deb88fc0b23ae6448c1d3474c770360a5e`. @@ -404,7 +415,9 @@ remains open at observed exact head 1. Revalidate open PRs #258, #349, #355, #368, #373, #383, #384, #387, and #391 at their exact current heads as Checks and formal independent approvals arrive; the #388/#389/#390 stack merges are already recorded above, so process the - open #387 parent only after its current-head gates pass. + open #387 parent only after its current-head gates pass. PR #392 is a + separate main-targeting product follow-up and remains subject to the same + gates. Verify the synthetic footnote/table cases in the authenticated browser and use the protected external corpus only for aggregate, non-identifying runtime evidence. From c71735768a8489c28d9083a10e8f1df4053eb569 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 04:08:51 +0900 Subject: [PATCH 070/109] docs: refresh exact-head audit evidence --- docs/product-technical-gap-baseline.md | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 67cf692b8..e0c7bbad2 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -95,7 +95,7 @@ Open PRs at the same observation: merge commit is intentional: #355 is the open successor from the same feature branch, now pointing at that merged branch tip, and is not itself merged. -- PR #368: `head` `7d7c200715ac4c26733b3a0b57f932f24eec780f` (the exact current +- PR #368: `head` `7855f2af0c516a0a4f6228e0b9230e6062d326be` (the exact current documentation checkpoint), base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #373: `head` `151fe6e177416a5d83b5539a73d97737c12d1ce4`, base `main` @@ -104,7 +104,7 @@ Open PRs at the same observation: (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #384: `head` `a32bbda48e1ed873362e6e7bd6e47766d9998bb5`, base `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). -- PR #387: `head` `16f2b13caad10f4d999293d623405aefadeda52e`, base `main` +- PR #387: `head` `eaea56d3b2f07f89a5dfcc7d81b032148048982d`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #392: `head` `a046da4e52c484807fc28111bd813d1acbc00816`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). @@ -142,6 +142,13 @@ non-skipped Checks and no independent approval. The remaining open PRs were not authorized to merge from this observation because approval and/or terminal Checks were still absent. +Queue refresh at `2026-08-21T19:07:01Z`: exact-current inspection found no +failed Checks on the eight open LineageWeave PRs. PR #387 advanced to +`eaea56d3b2f07f89a5dfcc7d81b032148048982d`; PR #392 remains at +`a046da4e52c484807fc28111bd813d1acbc00816`; the baseline PR itself is at +`7855f2af0c516a0a4f6228e0b9230e6062d326be`. All had no independent approval; +the green-only PRs remain unmerged under the protected-main policy. + Closed without merge at the same observation: - PR #386: `closed_without_merge` head `57a013deb88fc0b23ae6448c1d3474c770360a5e`. @@ -402,13 +409,12 @@ The former PR #383 `osv-scan` failure at head scan exited successfully, but the follow-up treated a missing baseline result file as failure after the head checkout. Central `.github` PR #1158 now contains the direct-source result-file repair (`--output-file`) at observed -exact head `fca5cd1e3d14418b8a5fc5cd3636815582228457`; its provenance, Python -contracts, and exact-head policy checks are non-terminal on this new head, with -no failure presently observed. The current #383 head -`6af3adc3e08fd1b0b11182d8cf3714b847c71ea8` has no failed Checks observed but +exact head `eb7efe560fe697b54f174a2295dd0950a6984e37`; its current Checks have +no failure presently observed but remain non-terminal. The current #383 head +`b1d32a93632164cf1379f24fc9aca71c5d29b746` has no failed Checks observed but remains non-terminal and unauthorized to merge. Central PR #1002 independently remains open at observed exact head -`a9880aeb86d424967b94417ac15c38fb94950aab` with required checks still running. +`1c09f8db1876af8388d21fe14c9993ec6c1d8688` with required checks still running. ## 7. Next Implementation Order From 9d6b7af2ca123d39f6f8b4c299ceff8cd17a86b3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 04:10:35 +0900 Subject: [PATCH 071/109] docs: record organization OpenTelemetry boundary --- docs/product-technical-gap-baseline.md | 46 ++++++++++++++------------ 1 file changed, 25 insertions(+), 21 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index e0c7bbad2..699e036c5 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -396,29 +396,32 @@ Observed at `2026-08-21T18:39:50Z` on PR #349's exact head ## 6. Organization OpenTelemetry Evidence Boundary -GRC PR #51 records organization-level OTEL acceptance evidence through the -existing purpose-bound evidence contract. It does not become a raw span store -and must not copy prompts, post bodies, images, provider responses, secrets, or -an ad-hoc `user_account + post_id` session key. W3C trace context and bounded -OpenTelemetry attributes correlate the authorized operation across services; -collector delivery, retention, access review, and no-export rollback are the -GRC evidence subjects. - -The former PR #383 `osv-scan` failure at head -`3584c31c22a432399c694588a4786c445f943848` was a central workflow defect: the -scan exited successfully, but the follow-up treated a missing baseline result -file as failure after the head checkout. Central `.github` PR #1158 now -contains the direct-source result-file repair (`--output-file`) at observed -exact head `eb7efe560fe697b54f174a2295dd0950a6984e37`; its current Checks have -no failure presently observed but remain non-terminal. The current #383 head -`b1d32a93632164cf1379f24fc9aca71c5d29b746` has no failed Checks observed but -remains non-terminal and unauthorized to merge. Central PR #1002 independently -remains open at observed exact head -`1c09f8db1876af8388d21fe14c9993ec6c1d8688` with required checks still running. +The organization GRC boundary is governance-risk-compliance PR #51 at exact +head `1a8f90dd15f37ffc86b8a0efd217a8b2812e5f99`. It emits W3C-parented server +spans, low-cardinality request and authorization metrics, and redaction-safe +structured request logs through the opt-in `OTEL_EXPORTER_OTLP_ENDPOINT`. +GRC is the organization control and evidence boundary, not a raw span store: +it must not copy prompts, post bodies, images, provider responses, secrets, or +an ad-hoc `user_account + post_id` session key. + +LineageWeave PR #383 at exact head +`b1d32a93632164cf1379f24fc9aca71c5d29b746` emits bounded API/Valkey/session +telemetry, and contextual-orchestrator PR #818 at exact head +`51531d0c1144427c67649da3233bcbe1c5d53858` preserves the same post-scoped +session correlation across provider, Responses, structured-output, VISION, and +embedding work. These are separate open, protected PRs; their current Checks +are not terminal and no independent approval or merge is claimed. + +This establishes the organization integration contract, not production +collector acceptance. Collector delivery, retention, access review, dashboard +SLOs, and no-export rollback remain deployment evidence to be recorded by GRC. +The current GRC `osv-scan` failure is the shared workflow's deprecated OSV +output-file contract, not a source vulnerability verdict; no protected merge +or bypass is authorized until the central repair and exact-head Checks pass. ## 7. Next Implementation Order -1. Revalidate open PRs #258, #349, #355, #368, #373, #383, #384, #387, and #391 at +1. Revalidate open PRs #258, #349, #355, #368, #373, #383, #384, #387, and #392 at their exact current heads as Checks and formal independent approvals arrive; the #388/#389/#390 stack merges are already recorded above, so process the open #387 parent only after its current-head gates pass. PR #392 is a @@ -434,4 +437,5 @@ remains open at observed exact head external runtime, returning only aggregate or derived non-identifying evidence to repository artifacts. 4. Keep the GRC and contextual-orchestrator OTEL evidence contracts aligned - with the exact merged application instrumentation. + with the exact merged application instrumentation; validate live collector + delivery separately from source and PR evidence. From 0e807d0b95fb3658c512793090de8828a43849fa Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 04:17:38 +0900 Subject: [PATCH 072/109] docs: record latest exact-head UI and CI audit --- docs/product-technical-gap-baseline.md | 38 ++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 699e036c5..09d4fc190 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -30,6 +30,14 @@ permission are not present; no-JavaScript fallback is not proven; phone and site-map behavior need protected runtime evidence; and Figma parity does not prove complete authorized-corpus image/table evidence. +- **Exact-source UI audit at PR #392 head `a046da4e`:** the header and footer + currently render the configured `brandName` as text only. The settings + contract exposes no approved CI/BI asset, copyright-holder, or system + opening-year field; the footer therefore uses the browser's current year and + remains short of the guide's immutable CI/BI and opening-year requirement. + This is intentionally left open rather than inventing a brand asset or + historical year. The React-only entry point also has no proven no-JavaScript + fallback. ## 2. LLM Extraction & Knowledge Graph Gaps - **Multiple Project Extraction**: A structured `key_events.project_name` implementation exists, but separate-event behavior still requires protected authorized-corpus evidence. @@ -149,6 +157,36 @@ failed Checks on the eight open LineageWeave PRs. PR #387 advanced to `7855f2af0c516a0a4f6228e0b9230e6062d326be`. All had no independent approval; the green-only PRs remain unmerged under the protected-main policy. +Queue refresh at `2026-08-21T19:16:15Z`: the open queue changed after the +previous checkpoint. PR #393 is open at exact head +`859e03674cd65f790594cffe8cd19f4de443ba0c`; #392 remains at +`a046da4e52c484807fc28111bd813d1acbc00816`; #387 at +`eaea56d3b2f07f89a5dfcc7d81b032148048982d`; #383 at +`b1d32a93632164cf1379f24fc9aca71c5d29b746`; #373 at +`151fe6e177416a5d83b5539a73d97737c12d1ce4`; #368 at +`9d6b7af2ca123d39f6f8b4c299ceff8cd17a86b3`; #355 at +`b606c2553f877fa85968d90dc46598ce16897fbf`; #349 at +`bfb3760403f6d6af22db3950f3d4d472a97edd4e`; and #258 at +`6621eb116a4e92eb33eeae989c70fbc602450c51`. All target `main` and are +blocked by the protected merge gates. Checks had no failures for #393, #392, +#387, #373, #368, #355, #349, or #258; #383 had one failed `osv-scan`, with +15 passing, 2 pending, and 8 skipped checks. The failed job ran the central +OSV workflow with deprecated `--output=new-results.json` and then asserted +that `new-results.json` and `old-results.json` existed, although the scanner +exited zero without creating those files. This is a shared-workflow defect, +not a dependency-vulnerability verdict. Central `.github` PR #1158 is now at +exact head `c45a776f9ec3be8b35ee105e966100c80b95c2cc`, with no failed checks +but 16 pending checks and no independent approval; it remains the upstream +repair path. No PR was merged from this observation. + +Exact-head local verification at `2026-08-21T19:16:46Z` on the working +checkout at PR #392 head `a046da4e52c484807fc28111bd813d1acbc00816` passed +846 backend tests with 17 environment skips, 200 frontend tests, frontend +lint, TypeScript/production build, and Storybook build. Build output emitted +only the existing chunk-size warning. This validates the current checkout; +it does not turn the open PR into a protected-main merge or prove the +authorized-corpus UI and image evidence gaps above. + Closed without merge at the same observation: - PR #386: `closed_without_merge` head `57a013deb88fc0b23ae6448c1d3474c770360a5e`. From e9efe1c50a860ea897fda6b7cc6c12e50ea6a204 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 04:22:54 +0900 Subject: [PATCH 073/109] docs: correct baseline PR exact head --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 09d4fc190..ebd7754d7 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -164,7 +164,7 @@ previous checkpoint. PR #393 is open at exact head `eaea56d3b2f07f89a5dfcc7d81b032148048982d`; #383 at `b1d32a93632164cf1379f24fc9aca71c5d29b746`; #373 at `151fe6e177416a5d83b5539a73d97737c12d1ce4`; #368 at -`9d6b7af2ca123d39f6f8b4c299ceff8cd17a86b3`; #355 at +`0e807d0b95fb3658c512793090de8828a43849fa`; #355 at `b606c2553f877fa85968d90dc46598ce16897fbf`; #349 at `bfb3760403f6d6af22db3950f3d4d472a97edd4e`; and #258 at `6621eb116a4e92eb33eeae989c70fbc602450c51`. All target `main` and are From 457fab8cbdc5a407fc8f1373481314f2dec3f6fb Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 04:30:40 +0900 Subject: [PATCH 074/109] docs: reconcile historical PR queue checkpoints --- docs/product-technical-gap-baseline.md | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index ebd7754d7..b943dd5e1 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -110,8 +110,6 @@ Open PRs at the same observation: (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #383: `head` `b1d32a93632164cf1379f24fc9aca71c5d29b746`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). -- PR #384: `head` `a32bbda48e1ed873362e6e7bd6e47766d9998bb5`, base - `docs/customer-master-scope-adr` (`83ace331edc982208c290763cb0d389c1884e21b`). - PR #387: `head` `eaea56d3b2f07f89a5dfcc7d81b032148048982d`, base `main` (`ef6f5a5ffcb467bd935dc1e53acc0029669b0bd7`). - PR #392: `head` `a046da4e52c484807fc28111bd813d1acbc00816`, base `main` @@ -132,16 +130,16 @@ gates. Queue refresh at `2026-08-21T18:56:50Z`: PRs #258, #355, and #373 had terminal successful Checks but no independent `APPROVED` review, so none was -authorized to merge. PRs #349, #368, #383, #384, #387, and #391 had no failed +authorized to merge. PRs #349, #368, #383, #387, and #392 had no failed Checks observed at their exact heads but retained non-terminal Checks and no independent approval. PR #355 also retained a `CHANGES_REQUESTED` review decision from the earlier stale coverage verdict; it remains unmergeable until -the current-head review is refreshed. PRs #388, #389, and #390 were merged -into stack bases only; their merge commits are not protected-main merges. +the current-head review is refreshed. PRs #388, #389, #390, and #391 were +merged into stack bases only; their merge commits are not protected-main merges. Re-read the exact current HEAD, review, and terminal-check gates before every future merge. -Queue refresh at `2026-08-22T04:00:00Z`: PR #391 is now merged into the open +Queue refresh at `2026-08-21T19:00:00Z`: PR #391 is now merged into the open #387 stack parent with merge commit `16f2b13caad10f4d999293d623405aefadeda52e`; this is not a protected-main merge. New PR #392 is open at exact head @@ -390,14 +388,15 @@ Observed at `2026-08-21T18:27:23Z` on PR #390's exact head base with merge commit `b020378710a0e405974538d80f7ef68ae3badd7c`; this is not a protected-main merge. -Observed at `2026-08-21T18:56:50Z` on PR #391's exact head +Merged at `2026-08-21T18:54:35Z` from PR #391's exact head `e099a916cec6f06b86f335d31c89e01aae248dfd`: - Nested-list indentation now survives a block child such as `

  • Child

    • `; the regression is covered by the wrapped-child fixture. Local verification passed 157 frontend tests, lint, production - build, Storybook build, and `git diff --check`. Two hosted Checks remained - pending and no independent approval or merge was claimed. + build, Storybook build, and `git diff --check`. The normal stack merge into + #387 produced `16f2b13caad10f4d999293d623405aefadeda52e`; this is not a + protected-main merge. Observed at `2026-08-21T18:56:50Z` on PR #387's exact head `16f2b13caad10f4d999293d623405aefadeda52e`: @@ -459,7 +458,7 @@ or bypass is authorized until the central repair and exact-head Checks pass. ## 7. Next Implementation Order -1. Revalidate open PRs #258, #349, #355, #368, #373, #383, #384, #387, and #392 at +1. Revalidate open PRs #258, #349, #355, #368, #373, #383, #387, and #392 at their exact current heads as Checks and formal independent approvals arrive; the #388/#389/#390 stack merges are already recorded above, so process the open #387 parent only after its current-head gates pass. PR #392 is a From dcda74e1c7aa15a22bf3295d8900021bf9319270 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 04:31:49 +0900 Subject: [PATCH 075/109] docs: record latest PR queue and SAST verification --- docs/product-technical-gap-baseline.md | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index b943dd5e1..51beddf18 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -185,6 +185,30 @@ only the existing chunk-size warning. This validates the current checkout; it does not turn the open PR into a protected-main merge or prove the authorized-corpus UI and image evidence gaps above. +Queue refresh at `2026-08-21T19:30:47Z`: the latest open queue contains PR +#394 at `5602096b61272a2ccb0c9997cbaddd261fa165af`, #393 at +`97baed032533a71c6a04b51d7c70df6df535e53b`, #392 at +`1412313d421445c1246a6970c5ab71a6304a483d`, #387 at +`eaea56d3b2f07f89a5dfcc7d81b032148048982d`, #383 at +`4eaa07172fde827f4ad89580326a0d2db5ceb0e4`, #373 at +`151fe6e177416a5d83b5539a73d97737c12d1ce4`, #368 at +`457fab8cbdc5a407fc8f1373481314f2dec3f6fb`, #355 at +`b606c2553f877fa85968d90dc46598ce16897fbf`, #349 at +`a6af452568ee907835689829d0a871b208053382`, and #258 at +`6dc040c6b3ea0bfc4424bb7afb11b8afd7205d77`. Every open PR targeted +`main` and remained `BLOCKED`; #373 and #349 required a fresh independent +approval, #355 retained `CHANGES_REQUESTED`, and #258 had an approval-related +review gate but no terminal Checks. The exact-head Checks snapshot had no +failed bucket on any of these ten PRs; #392 had one passing, twelve pending, +and eight skipped Checks after the static-SQL suppression push. No protected +merge was authorized. The active no-force-push ruleset had no bypass actors. + +The #392 security repair at exact head `1412313d` passed Semgrep with zero +findings, its two focused Global Ask history tests, and the backend suite with +848 passed and 17 environment skips. The existing central OSV repair remains +`.github` PR #1158; the earlier #383 failure is retained as historical +evidence and is not treated as a current failure after its head advanced. + Closed without merge at the same observation: - PR #386: `closed_without_merge` head `57a013deb88fc0b23ae6448c1d3474c770360a5e`. From 4a4a95e46d99a5fa11f869c570eedbf2806c446a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 04:34:18 +0900 Subject: [PATCH 076/109] docs: refresh buyer gap checkpoint --- docs/product-technical-gap-baseline.md | 30 +++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 51beddf18..49b29f89f 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -11,7 +11,7 @@ - **Indentation**: synthetic cases `case-indent-01` and `case-indent-02` retain corpus coverage gaps; PR #391 adds the common nested HTML-list depth fix and regression coverage, while authorized production/browser evidence remains open. -- **Image/Table OCR**: synthetic case `case-image-table-01` still needs region-aware table OCR, markdown rendering, and sufficiently detailed buyer-safe image evidence. +- **Image/Table OCR**: synthetic case `case-image-table-01` now has region-aware table OCR, markdown rendering, and buyer-visible normalized region locations through stacked PR #395; authorized production/browser evidence and complete image-region coverage remain open. - **Math/Superscripts**: synthetic case `case-math-01` covers bounded metric normalization such as m³; arbitrary formula semantics and authorized runtime verification remain open after PR #344. - **Missing UI Elements**: synthetic case `case-dag-01` tracks the Event Lineage DAG surface; current source includes the DAG, but corpus coverage and browser evidence remain open. @@ -455,6 +455,29 @@ Observed at `2026-08-21T18:39:50Z` on PR #349's exact head static SQL review contract repair passed 17 focused tests and compilation; hosted Checks remained non-terminal and no independent approval was present. +Observed at `2026-08-21T19:33:40Z` from the GitHub API: + +- PR #392 is open at exact head `1412313d421445c1246a6970c5ab71a6304a483d`, + targeting protected `main`; its required Checks are queued and no formal + independent approval is present. Stacked PR #395 added buyer-visible image + region locations and merged normally into the feature branch with merge + commit `8502f261931b4a06ba19a33da470a47c53ed02b3`; this is not a protected + `main` merge. +- PR #393 is open at exact head + `97baed032533a71c6a04b51d7c70df6df535e53b`, with auto-merge armed and all + current hosted Checks queued. PR #394 is open at exact head + `5602096b61272a2ccb0c9997cbaddd261fa165af`, also with its required Checks + queued; its source-indentation evidence change has local focused verification + but no protected merge claim. +- LineageWeave PR #383 is open at exact head + `4eaa07172fde827f4ad89580326a0d2db5ceb0e4`, with its OTel/API/Valkey/session + Checks queued and normal auto-merge armed. Governance-risk-compliance PR #51 + remains open at exact head `1a8f90dd15f37ffc86b8a0efd217a8b2812e5f99`; + product checks are successful while its shared OSV output check remains + queued, and the GRC repository does not permit auto-merge. +- These observations are current queue evidence only. They do not convert + queued Checks into success or authorize a protected merge. + ## 6. Organization OpenTelemetry Evidence Boundary The organization GRC boundary is governance-risk-compliance PR #51 at exact @@ -466,7 +489,7 @@ it must not copy prompts, post bodies, images, provider responses, secrets, or an ad-hoc `user_account + post_id` session key. LineageWeave PR #383 at exact head -`b1d32a93632164cf1379f24fc9aca71c5d29b746` emits bounded API/Valkey/session +`4eaa07172fde827f4ad89580326a0d2db5ceb0e4` emits bounded API/Valkey/session telemetry, and contextual-orchestrator PR #818 at exact head `51531d0c1144427c67649da3233bcbe1c5d53858` preserves the same post-scoped session correlation across provider, Responses, structured-output, VISION, and @@ -482,7 +505,8 @@ or bypass is authorized until the central repair and exact-head Checks pass. ## 7. Next Implementation Order -1. Revalidate open PRs #258, #349, #355, #368, #373, #383, #387, and #392 at +1. Revalidate open PRs #258, #349, #355, #368, #373, #383, #387, #392, #393, + and #394 at their exact current heads as Checks and formal independent approvals arrive; the #388/#389/#390 stack merges are already recorded above, so process the open #387 parent only after its current-head gates pass. PR #392 is a From 68eeda36c444849b2e2d2fe4c6b44a23511e212c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 04:36:57 +0900 Subject: [PATCH 077/109] docs: record central OSV RCA --- docs/product-technical-gap-baseline.md | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 49b29f89f..5a6e8eed9 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -491,7 +491,7 @@ an ad-hoc `user_account + post_id` session key. LineageWeave PR #383 at exact head `4eaa07172fde827f4ad89580326a0d2db5ceb0e4` emits bounded API/Valkey/session telemetry, and contextual-orchestrator PR #818 at exact head -`51531d0c1144427c67649da3233bcbe1c5d53858` preserves the same post-scoped +`f5e8107df065fe83ff616f92f070feeb3b153288` preserves the same post-scoped session correlation across provider, Responses, structured-output, VISION, and embedding work. These are separate open, protected PRs; their current Checks are not terminal and no independent approval or merge is claimed. @@ -503,6 +503,21 @@ The current GRC `osv-scan` failure is the shared workflow's deprecated OSV output-file contract, not a source vulnerability verdict; no protected merge or bypass is authorized until the central repair and exact-head Checks pass. +Observed at `2026-08-21T19:36:33Z` from the current hosted Checks: + +- contextual-orchestrator PR #820 remains open at exact head + `4959e805c5724e7d1620639ab0151a992d717a0c`. Its unit, property, fuzz, + supply-chain, Semgrep, and Strix checks passed; only `osv-scan` failed after + the scanner exited 0 and the shared workflow asserted files that the + deprecated `--output` option did not produce. +- The central repair is ContextualWisdomLab/.github PR #1158 at exact head + `c45a776f9ec3be8b35ee105e966100c80b95c2cc`. Its direct-source, provenance, + path-policy, and bootstrap checks are successful while coverage and protected + approval remain pending. Downstream OSV checks must be rerun after its + protected merge; no local suppression is valid. +- This is operational evidence for the organization boundary, not a claim that + a collector accepted telemetry or that any protected PR merged. + ## 7. Next Implementation Order 1. Revalidate open PRs #258, #349, #355, #368, #373, #383, #387, #392, #393, @@ -522,5 +537,6 @@ or bypass is authorized until the central repair and exact-head Checks pass. external runtime, returning only aggregate or derived non-identifying evidence to repository artifacts. 4. Keep the GRC and contextual-orchestrator OTEL evidence contracts aligned - with the exact merged application instrumentation; validate live collector - delivery separately from source and PR evidence. + with the exact application instrumentation; validate live collector delivery + separately from source and PR evidence, then rerun downstream OSV checks + after central `.github` PR #1158 is protected. From 7ac93c8528b072d2609a72ed4542742cb67bb07a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 04:52:13 +0900 Subject: [PATCH 078/109] docs: record tenant identity metadata gap repair --- docs/product-technical-gap-baseline.md | 42 +++++++++++++++++++++----- 1 file changed, 34 insertions(+), 8 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 5a6e8eed9..a7b87414a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -30,14 +30,40 @@ permission are not present; no-JavaScript fallback is not proven; phone and site-map behavior need protected runtime evidence; and Figma parity does not prove complete authorized-corpus image/table evidence. -- **Exact-source UI audit at PR #392 head `a046da4e`:** the header and footer - currently render the configured `brandName` as text only. The settings - contract exposes no approved CI/BI asset, copyright-holder, or system - opening-year field; the footer therefore uses the browser's current year and - remains short of the guide's immutable CI/BI and opening-year requirement. - This is intentionally left open rather than inventing a brand asset or - historical year. The React-only entry point also has no proven no-JavaScript - fallback. +- **Historical exact-source UI audit at PR #392 ancestor `a046da4e`:** the + header and footer rendered one configured `brandName` and the footer used + the browser's current year. This observation remains historical and is not + a claim about the current stacked head. +- **Current exact-source mitigation at stacked PR #397 head `48fe6e36`:** + `tenant_settings` now persists separate `brandName`, `systemName`, + `copyrightYear`, and `copyrightHolder` values. The header renders brand and + system name separately, the footer uses the persisted year and rights + holder, and the admin form validates the four-field contract through the + `post_admin` boundary. The migration is replayable through Compose and the + old brand-only PATCH shape remains compatible. This is an open, unmerged PR; + the exact upstream stack base is `4fdd3032`. +- **Remaining UI governance gap:** no approved CI/BI image asset or usage + permission was supplied, so the implementation deliberately remains text + based. Production release still requires the approved asset and legal + metadata; no asset or real organization identity is invented in this repo. + The React-only entry point also has no proven no-JavaScript fallback. + +### 1.1.1 Exact implementation evidence for tenant identity metadata + +Observed at `2026-08-21T19:50:57Z` from the GitHub API and local worktree +`/private/tmp/lineageweave-identity-metadata.8NPveY`: + +- PR [#397](https://github.com/ContextualWisdomLab/LineageWeave/pull/397) is + open and draft at head `48fe6e36bd150c28a6372233a17435b95cbd20d0`, based on + exact stack branch head `4fdd3032de21d490767cf9aa24b25191ad8a814a`; it is + `CLEAN` but has no formal review decision yet. +- Local verification at that head passed backend `850 passed, 17 skipped`, + frontend `201 passed`, frontend lint, production build, and Storybook build. + The focused API tests cover authentication, full metadata, legacy + brand-only PATCH compatibility, blank values, and copyright-year bounds. +- PR #392 remains open at head `4fdd3032de21d490767cf9aa24b25191ad8a814a`, + targets `main`, and is `BLOCKED` with `REVIEW_REQUIRED`; #397 is a stacked + follow-up and must not be described as a protected-main merge. ## 2. LLM Extraction & Knowledge Graph Gaps - **Multiple Project Extraction**: A structured `key_events.project_name` implementation exists, but separate-event behavior still requires protected authorized-corpus evidence. From 1cffe3920be72710fd88370bd9b2bae63c1f914a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 04:54:44 +0900 Subject: [PATCH 079/109] docs: record current PR checks and central OSV gap --- docs/product-technical-gap-baseline.md | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index a7b87414a..3f066d5f3 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -65,6 +65,28 @@ Observed at `2026-08-21T19:50:57Z` from the GitHub API and local worktree targets `main`, and is `BLOCKED` with `REVIEW_REQUIRED`; #397 is a stacked follow-up and must not be described as a protected-main merge. +## 4.1 Latest open-PR and Checks refresh + +Observed at `2026-08-21T19:50:57Z` from the GitHub API. The exact open +application heads were: #258 `6dc040c6`, #349 `a6af4525`, #355 `b606c255`, +#368 `7ac93c85`, #373 `151fe6e1`, #383 `4eaa0717`, #387 `16f6341a`, #392 +`4fdd3032`, #393 `1ac3a17a`, #394 `5219ed8b`, and #397 `48fe6e36`. No PR in +this set was reported as merged into protected `main`. + +- #397 had no failed Checks at observation; its Devin Review was pending and + CodeRabbit reported success while explicitly skipping review because the + non-default stack base disables automatic review. There is no independent + approval, so merge is not authorized. +- #383 had a failed `osv-scan`. The failure remains the shared workflow's + deprecated `--output=old-results.json` / `--output=new-results.json` contract, + not a source vulnerability verdict. Central `.github` PR #1158 is open at + exact head `f61a8795`, adds the `--output-file` contract and provenance + classifier, and remains unmerged with hosted Checks pending. Do not duplicate + the central repair in LineageWeave. +- The active protected ruleset `LineageWeave: no force pushes` has no bypass + actors and only the `non_fast_forward` rule. All stack pushes above were + normal fast-forward/new-branch pushes. + ## 2. LLM Extraction & Knowledge Graph Gaps - **Multiple Project Extraction**: A structured `key_events.project_name` implementation exists, but separate-event behavior still requires protected authorized-corpus evidence. - **5W1H Missing**: A structured 5W1H evidence-item implementation exists, but completeness and provenance still require protected authorized-corpus evidence. From f3a487adb403bf3a98f870c1cee89900e15bedc6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 04:57:00 +0900 Subject: [PATCH 080/109] docs: refresh tenant identity PR exact head --- docs/product-technical-gap-baseline.md | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 3f066d5f3..58d144c0b 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -34,7 +34,7 @@ header and footer rendered one configured `brandName` and the footer used the browser's current year. This observation remains historical and is not a claim about the current stacked head. -- **Current exact-source mitigation at stacked PR #397 head `48fe6e36`:** +- **Current exact-source mitigation at stacked PR #397 head `0f4ecee6`:** `tenant_settings` now persists separate `brandName`, `systemName`, `copyrightYear`, and `copyrightHolder` values. The header renders brand and system name separately, the footer uses the persisted year and rights @@ -54,11 +54,11 @@ Observed at `2026-08-21T19:50:57Z` from the GitHub API and local worktree `/private/tmp/lineageweave-identity-metadata.8NPveY`: - PR [#397](https://github.com/ContextualWisdomLab/LineageWeave/pull/397) is - open and draft at head `48fe6e36bd150c28a6372233a17435b95cbd20d0`, based on + open and ready at head `0f4ecee6651f75949f516838e45fd2e72d8b640b`, based on exact stack branch head `4fdd3032de21d490767cf9aa24b25191ad8a814a`; it is - `CLEAN` but has no formal review decision yet. + `UNSTABLE` while hosted Checks run and has no formal review decision yet. - Local verification at that head passed backend `850 passed, 17 skipped`, - frontend `201 passed`, frontend lint, production build, and Storybook build. + frontend `202 passed`, frontend lint, production build, and Storybook build. The focused API tests cover authentication, full metadata, legacy brand-only PATCH compatibility, blank values, and copyright-year bounds. - PR #392 remains open at head `4fdd3032de21d490767cf9aa24b25191ad8a814a`, @@ -67,16 +67,17 @@ Observed at `2026-08-21T19:50:57Z` from the GitHub API and local worktree ## 4.1 Latest open-PR and Checks refresh -Observed at `2026-08-21T19:50:57Z` from the GitHub API. The exact open +Observed at `2026-08-21T19:56:34Z` from the GitHub API. The exact open application heads were: #258 `6dc040c6`, #349 `a6af4525`, #355 `b606c255`, #368 `7ac93c85`, #373 `151fe6e1`, #383 `4eaa0717`, #387 `16f6341a`, #392 -`4fdd3032`, #393 `1ac3a17a`, #394 `5219ed8b`, and #397 `48fe6e36`. No PR in +`4fdd3032`, #393 `1ac3a17a`, #394 `5219ed8b`, and #397 `0f4ecee6`. No PR in this set was reported as merged into protected `main`. -- #397 had no failed Checks at observation; its Devin Review was pending and - CodeRabbit reported success while explicitly skipping review because the - non-default stack base disables automatic review. There is no independent - approval, so merge is not authorized. +- #397 had no failed Checks at observation; `Full test suite`, `Frontend lint, + test, build`, and Devin Review were pending. An earlier CodeRabbit status + explicitly skipped review because the non-default stack base disables + automatic review. There is no independent approval, so merge is not + authorized. - #383 had a failed `osv-scan`. The failure remains the shared workflow's deprecated `--output=old-results.json` / `--output=new-results.json` contract, not a source vulnerability verdict. Central `.github` PR #1158 is open at From e7596bee6e027876e73f8dd645ef47915ac6b6bd Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 05:04:40 +0900 Subject: [PATCH 081/109] docs: refresh gap baseline after tenant review --- docs/product-technical-gap-baseline.md | 34 ++++++++++++++------------ 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 58d144c0b..12e7cc2ae 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -34,14 +34,16 @@ header and footer rendered one configured `brandName` and the footer used the browser's current year. This observation remains historical and is not a claim about the current stacked head. -- **Current exact-source mitigation at stacked PR #397 head `0f4ecee6`:** +- **Current exact-source mitigation at stacked PR #397 head `07f8d55f`:** `tenant_settings` now persists separate `brandName`, `systemName`, `copyrightYear`, and `copyrightHolder` values. The header renders brand and system name separately, the footer uses the persisted year and rights holder, and the admin form validates the four-field contract through the `post_admin` boundary. The migration is replayable through Compose and the - old brand-only PATCH shape remains compatible. This is an open, unmerged PR; - the exact upstream stack base is `4fdd3032`. + old brand-only PATCH shape remains compatible. The latest review also fixed + the asynchronous draft synchronization race and the Korean operation-note + translation key. This is an open, unmerged PR; the exact upstream stack base + is `4fdd3032`. - **Remaining UI governance gap:** no approved CI/BI image asset or usage permission was supplied, so the implementation deliberately remains text based. Production release still requires the approved asset and legal @@ -50,15 +52,17 @@ ### 1.1.1 Exact implementation evidence for tenant identity metadata -Observed at `2026-08-21T19:50:57Z` from the GitHub API and local worktree +Observed at `2026-08-21T20:04:07Z` from the GitHub API and local worktree `/private/tmp/lineageweave-identity-metadata.8NPveY`: - PR [#397](https://github.com/ContextualWisdomLab/LineageWeave/pull/397) is - open and ready at head `0f4ecee6651f75949f516838e45fd2e72d8b640b`, based on + open and ready at head `07f8d55fe3a966784302e92037c8b5028560e74a`, based on exact stack branch head `4fdd3032de21d490767cf9aa24b25191ad8a814a`; it is - `UNSTABLE` while hosted Checks run and has no formal review decision yet. -- Local verification at that head passed backend `850 passed, 17 skipped`, - frontend `202 passed`, frontend lint, production build, and Storybook build. + `UNSTABLE` while hosted Checks and automated reviews run and has no formal + review decision yet. +- Local verification at the prior source-compatible head passed backend + `850 passed, 17 skipped`; the latest frontend-only review fix passed frontend + `203 passed`, lint, production build, and Storybook build. The focused API tests cover authentication, full metadata, legacy brand-only PATCH compatibility, blank values, and copyright-year bounds. - PR #392 remains open at head `4fdd3032de21d490767cf9aa24b25191ad8a814a`, @@ -67,16 +71,16 @@ Observed at `2026-08-21T19:50:57Z` from the GitHub API and local worktree ## 4.1 Latest open-PR and Checks refresh -Observed at `2026-08-21T19:56:34Z` from the GitHub API. The exact open +Observed at `2026-08-21T20:04:07Z` from the GitHub API. The exact open application heads were: #258 `6dc040c6`, #349 `a6af4525`, #355 `b606c255`, -#368 `7ac93c85`, #373 `151fe6e1`, #383 `4eaa0717`, #387 `16f6341a`, #392 -`4fdd3032`, #393 `1ac3a17a`, #394 `5219ed8b`, and #397 `0f4ecee6`. No PR in +#368 `f3a487ad`, #373 `151fe6e1`, #383 `4eaa0717`, #387 `16f6341a`, #392 +`4fdd3032`, #393 `1ac3a17a`, #394 `5219ed8b`, and #397 `07f8d55f`. No PR in this set was reported as merged into protected `main`. -- #397 had no failed Checks at observation; `Full test suite`, `Frontend lint, - test, build`, and Devin Review were pending. An earlier CodeRabbit status - explicitly skipped review because the non-default stack base disables - automatic review. There is no independent approval, so merge is not +- #397's latest head had only CodeRabbit and Devin Review queued at observation; + the full required Checks had not yet been published. The prior review found + and the latest push fixed the stale Korean translation key and the fetched + tenant-config draft race. There is no independent approval, so merge is not authorized. - #383 had a failed `osv-scan`. The failure remains the shared workflow's deprecated `--output=old-results.json` / `--output=new-results.json` contract, From 349f56ad88bff7b50430672896d21f298e809250 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 05:05:29 +0900 Subject: [PATCH 082/109] docs: record central hourly scheduler boundary --- docs/product-technical-gap-baseline.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 12e7cc2ae..a520dcb83 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -91,6 +91,13 @@ this set was reported as merged into protected `main`. - The active protected ruleset `LineageWeave: no force pushes` has no bypass actors and only the `non_fast_forward` rule. All stack pushes above were normal fast-forward/new-branch pushes. +- **Hourly automation boundary:** the central + [`ContextualWisdomLab/.github` merge scheduler](https://github.com/ContextualWisdomLab/.github/blob/main/.github/workflows/pr-review-merge-scheduler.yml) + runs its organization sweep at `0 * * * *`; the central target allowlist + includes `ContextualWisdomLab/LineageWeave`. Its reusable review-repair + workflow is product-neutral, so LineageWeave does not add a duplicate local + timer. The same exact-head, review, Checks, and protected-merge gates remain + authoritative; a scheduled run is not evidence of a merge. ## 2. LLM Extraction & Knowledge Graph Gaps - **Multiple Project Extraction**: A structured `key_events.project_name` implementation exists, but separate-event behavior still requires protected authorized-corpus evidence. From 392a9dd59d340579d5803097a8e9a9502146d83a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 05:07:27 +0900 Subject: [PATCH 083/109] docs: record latest tenant metadata head --- docs/product-technical-gap-baseline.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index a520dcb83..34f92ee5a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -34,7 +34,7 @@ header and footer rendered one configured `brandName` and the footer used the browser's current year. This observation remains historical and is not a claim about the current stacked head. -- **Current exact-source mitigation at stacked PR #397 head `07f8d55f`:** +- **Current exact-source mitigation at stacked PR #397 head `22b4660a`:** `tenant_settings` now persists separate `brandName`, `systemName`, `copyrightYear`, and `copyrightHolder` values. The header renders brand and system name separately, the footer uses the persisted year and rights @@ -42,7 +42,8 @@ `post_admin` boundary. The migration is replayable through Compose and the old brand-only PATCH shape remains compatible. The latest review also fixed the asynchronous draft synchronization race and the Korean operation-note - translation key. This is an open, unmerged PR; the exact upstream stack base + translation key, with the same operation note covered across all five + product locales. This is an open, unmerged PR; the exact upstream stack base is `4fdd3032`. - **Remaining UI governance gap:** no approved CI/BI image asset or usage permission was supplied, so the implementation deliberately remains text @@ -52,11 +53,11 @@ ### 1.1.1 Exact implementation evidence for tenant identity metadata -Observed at `2026-08-21T20:04:07Z` from the GitHub API and local worktree +Observed at `2026-08-21T20:07:10Z` from the GitHub API and local worktree `/private/tmp/lineageweave-identity-metadata.8NPveY`: - PR [#397](https://github.com/ContextualWisdomLab/LineageWeave/pull/397) is - open and ready at head `07f8d55fe3a966784302e92037c8b5028560e74a`, based on + open and ready at head `22b4660a99e3de182efc7a4baadf6b22fa19175f`, based on exact stack branch head `4fdd3032de21d490767cf9aa24b25191ad8a814a`; it is `UNSTABLE` while hosted Checks and automated reviews run and has no formal review decision yet. @@ -71,10 +72,10 @@ Observed at `2026-08-21T20:04:07Z` from the GitHub API and local worktree ## 4.1 Latest open-PR and Checks refresh -Observed at `2026-08-21T20:04:07Z` from the GitHub API. The exact open +Observed at `2026-08-21T20:07:10Z` from the GitHub API. The exact open application heads were: #258 `6dc040c6`, #349 `a6af4525`, #355 `b606c255`, #368 `f3a487ad`, #373 `151fe6e1`, #383 `4eaa0717`, #387 `16f6341a`, #392 -`4fdd3032`, #393 `1ac3a17a`, #394 `5219ed8b`, and #397 `07f8d55f`. No PR in +`4fdd3032`, #393 `1ac3a17a`, #394 `5219ed8b`, and #397 `22b4660a`. No PR in this set was reported as merged into protected `main`. - #397's latest head had only CodeRabbit and Devin Review queued at observation; From cc052a4dc44f2d12f40fb5090880ba5ff8b80fd3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 05:14:23 +0900 Subject: [PATCH 084/109] docs: record restacked tenant PR and merged stack failure --- docs/product-technical-gap-baseline.md | 44 +++++++++++++++----------- 1 file changed, 25 insertions(+), 19 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 34f92ee5a..0d130c7fc 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -34,7 +34,7 @@ header and footer rendered one configured `brandName` and the footer used the browser's current year. This observation remains historical and is not a claim about the current stacked head. -- **Current exact-source mitigation at stacked PR #397 head `22b4660a`:** +- **Current exact-source mitigation at stacked PR #397 head `4bfa642c`:** `tenant_settings` now persists separate `brandName`, `systemName`, `copyrightYear`, and `copyrightHolder` values. The header renders brand and system name separately, the footer uses the persisted year and rights @@ -43,8 +43,9 @@ old brand-only PATCH shape remains compatible. The latest review also fixed the asynchronous draft synchronization race and the Korean operation-note translation key, with the same operation note covered across all five - product locales. This is an open, unmerged PR; the exact upstream stack base - is `4fdd3032`. + product locales. The latest parent stack was fast-forwarded to #392 head + `fc040997`, and #397 was restacked with a normal merge commit. This is an + open, unmerged PR; the exact upstream stack base is `fc040997`. - **Remaining UI governance gap:** no approved CI/BI image asset or usage permission was supplied, so the implementation deliberately remains text based. Production release still requires the approved asset and legal @@ -53,35 +54,36 @@ ### 1.1.1 Exact implementation evidence for tenant identity metadata -Observed at `2026-08-21T20:07:10Z` from the GitHub API and local worktree -`/private/tmp/lineageweave-identity-metadata.8NPveY`: +Observed at `2026-08-21T20:13:22Z` from the GitHub API and local worktree +`/private/tmp/lineageweave-identity-restack`: - PR [#397](https://github.com/ContextualWisdomLab/LineageWeave/pull/397) is - open and ready at head `22b4660a99e3de182efc7a4baadf6b22fa19175f`, based on - exact stack branch head `4fdd3032de21d490767cf9aa24b25191ad8a814a`; it is + open and ready at head `4bfa642c0326035e67638eaf12c0dbd143ed8934`, based on + exact stack branch head `fc0409979c67d0c8af5c5cbf3f9f7d4f3f75c885`; it is `UNSTABLE` while hosted Checks and automated reviews run and has no formal review decision yet. -- Local verification at the prior source-compatible head passed backend - `850 passed, 17 skipped`; the latest frontend-only review fix passed frontend - `203 passed`, lint, production build, and Storybook build. +- Local verification at the latest restacked head passed the focused settings + API suite (`4 passed`), migration replay (`8 passed`), frontend `203 passed`, + lint, and production build. The earlier source-compatible head also passed + the full backend suite (`850 passed, 17 skipped`) and Storybook build. The focused API tests cover authentication, full metadata, legacy brand-only PATCH compatibility, blank values, and copyright-year bounds. -- PR #392 remains open at head `4fdd3032de21d490767cf9aa24b25191ad8a814a`, +- PR #392 remains open at head `fc0409979c67d0c8af5c5cbf3f9f7d4f3f75c885`, targets `main`, and is `BLOCKED` with `REVIEW_REQUIRED`; #397 is a stacked follow-up and must not be described as a protected-main merge. ## 4.1 Latest open-PR and Checks refresh -Observed at `2026-08-21T20:07:10Z` from the GitHub API. The exact open +Observed at `2026-08-21T20:13:22Z` from the GitHub API. The exact open application heads were: #258 `6dc040c6`, #349 `a6af4525`, #355 `b606c255`, -#368 `f3a487ad`, #373 `151fe6e1`, #383 `4eaa0717`, #387 `16f6341a`, #392 -`4fdd3032`, #393 `1ac3a17a`, #394 `5219ed8b`, and #397 `22b4660a`. No PR in +#368 `392a9dd5`, #373 `151fe6e1`, #383 `4eaa0717`, #387 `16f6341a`, #392 +`fc040997`, #393 `1ac3a17a`, #394 `5219ed8b`, and #397 `4bfa642c`. No PR in this set was reported as merged into protected `main`. -- #397's latest head had only CodeRabbit and Devin Review queued at observation; - the full required Checks had not yet been published. The prior review found - and the latest push fixed the stale Korean translation key and the fetched - tenant-config draft race. There is no independent approval, so merge is not +- #397's latest restacked head had Full test, frontend, CodeRabbit, and Devin + Review pending at observation. The prior review found and the latest pushes + fixed the stale Korean translation key, fetched tenant-config draft race, and + non-atomic settings update. There is no independent approval, so merge is not authorized. - #383 had a failed `osv-scan`. The failure remains the shared workflow's deprecated `--output=old-results.json` / `--output=new-results.json` contract, @@ -137,7 +139,6 @@ Recently merged into the protected repository: - PR #370: `merge_commit` `aa38b29a95eed24de8073753552befc2e8cfaaae`. - PR #369: `merge_commit` `6e591f4b7ec4da6acf768298d8d06f841e3a2372`. - PR #287: `merge_commit` `bc8bcbee45c050cbd6775ca4f8455c00c25cc77d`. -- PR #367: `merge_commit` `7a0d025215fbd9f6510727c7139885b561296149`. - PR #262: `merge_commit` `6bf75991b04601483d48384045e314db2a928e30`. Recently merged into an open stack base (not main): @@ -152,6 +153,11 @@ Recently merged into an open stack base (not main): into PR #389's `feat/markdown-table-display` base. - PR #391: `merge_commit` `16f2b13caad10f4d999293d623405aefadeda52e`, merged into PR #387's `feat/event-lineage-channel-evidence` base. +- PR #367: `merge_commit` `7a0d025215fbd9f6510727c7139885b561296149`, merged + into `docs/customer-master-scope-adr`, not protected `main`. Its historical + Full test run failed because that temporary base lacked migration `0105` and + had one stale SQL-suppression count; the current #392/#397 stack contains the + migration and must be judged by its own exact-head Checks. Open PRs at the same observation: From 81488a9ebe4f9a8d0a589de003de6643260dcd88 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 05:16:29 +0900 Subject: [PATCH 085/109] docs: restore gap baseline structure and OSV evidence --- docs/product-technical-gap-baseline.md | 113 ++++++++++++------------- 1 file changed, 54 insertions(+), 59 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 0d130c7fc..54221dfd9 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -72,36 +72,6 @@ Observed at `2026-08-21T20:13:22Z` from the GitHub API and local worktree targets `main`, and is `BLOCKED` with `REVIEW_REQUIRED`; #397 is a stacked follow-up and must not be described as a protected-main merge. -## 4.1 Latest open-PR and Checks refresh - -Observed at `2026-08-21T20:13:22Z` from the GitHub API. The exact open -application heads were: #258 `6dc040c6`, #349 `a6af4525`, #355 `b606c255`, -#368 `392a9dd5`, #373 `151fe6e1`, #383 `4eaa0717`, #387 `16f6341a`, #392 -`fc040997`, #393 `1ac3a17a`, #394 `5219ed8b`, and #397 `4bfa642c`. No PR in -this set was reported as merged into protected `main`. - -- #397's latest restacked head had Full test, frontend, CodeRabbit, and Devin - Review pending at observation. The prior review found and the latest pushes - fixed the stale Korean translation key, fetched tenant-config draft race, and - non-atomic settings update. There is no independent approval, so merge is not - authorized. -- #383 had a failed `osv-scan`. The failure remains the shared workflow's - deprecated `--output=old-results.json` / `--output=new-results.json` contract, - not a source vulnerability verdict. Central `.github` PR #1158 is open at - exact head `f61a8795`, adds the `--output-file` contract and provenance - classifier, and remains unmerged with hosted Checks pending. Do not duplicate - the central repair in LineageWeave. -- The active protected ruleset `LineageWeave: no force pushes` has no bypass - actors and only the `non_fast_forward` rule. All stack pushes above were - normal fast-forward/new-branch pushes. -- **Hourly automation boundary:** the central - [`ContextualWisdomLab/.github` merge scheduler](https://github.com/ContextualWisdomLab/.github/blob/main/.github/workflows/pr-review-merge-scheduler.yml) - runs its organization sweep at `0 * * * *`; the central target allowlist - includes `ContextualWisdomLab/LineageWeave`. Its reusable review-repair - workflow is product-neutral, so LineageWeave does not add a duplicate local - timer. The same exact-head, review, Checks, and protected-merge gates remain - authoritative; a scheduled run is not evidence of a merge. - ## 2. LLM Extraction & Knowledge Graph Gaps - **Multiple Project Extraction**: A structured `key_events.project_name` implementation exists, but separate-event behavior still requires protected authorized-corpus evidence. - **5W1H Missing**: A structured 5W1H evidence-item implementation exists, but completeness and provenance still require protected authorized-corpus evidence. @@ -117,8 +87,6 @@ this set was reported as merged into protected `main`. - **Security & Compliance**: PII masking cannot break the system. Need SOC 2 and CSAP compliance alternatives to blind PII masking. - **LLM Orchestration**: Ensure ALL LLM calls route through `contextual-orchestrator` utilizing API keys (BYTEZ, NVIDIA, OPENROUTER, OPENAI) with auto model discovery and optimal reasoning effort allocation (Fugu/Conductor/TRINITY research). -*This document is continuously updated by the hourly automated agent loop.* - ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or @@ -235,14 +203,12 @@ previous checkpoint. PR #393 is open at exact head `6621eb116a4e92eb33eeae989c70fbc602450c51`. All target `main` and are blocked by the protected merge gates. Checks had no failures for #393, #392, #387, #373, #368, #355, #349, or #258; #383 had one failed `osv-scan`, with -15 passing, 2 pending, and 8 skipped checks. The failed job ran the central -OSV workflow with deprecated `--output=new-results.json` and then asserted -that `new-results.json` and `old-results.json` existed, although the scanner -exited zero without creating those files. This is a shared-workflow defect, -not a dependency-vulnerability verdict. Central `.github` PR #1158 is now at -exact head `c45a776f9ec3be8b35ee105e966100c80b95c2cc`, with no failed checks -but 16 pending checks and no independent approval; it remains the upstream -repair path. No PR was merged from this observation. + 15 passing, 2 pending, and 8 skipped checks. Later artifact inspection showed + both scanner invocations exited zero and the head result survived, while the + cross-fork head checkout had deleted the untracked base result. This is a + shared-workflow defect, not a dependency-vulnerability verdict. Central + `.github` PR #1209 is the upstream repair path. No PR was merged from this + observation. Exact-head local verification at `2026-08-21T19:16:46Z` on the working checkout at PR #392 head `a046da4e52c484807fc28111bd813d1acbc00816` passed @@ -272,8 +238,8 @@ merge was authorized. The active no-force-push ruleset had no bypass actors. The #392 security repair at exact head `1412313d` passed Semgrep with zero findings, its two focused Global Ask history tests, and the backend suite with -848 passed and 17 environment skips. The existing central OSV repair remains -`.github` PR #1158; the earlier #383 failure is retained as historical +848 passed and 17 environment skips. The existing central OSV repair is +`.github` PR #1209; the earlier #383 failure is retained as historical evidence and is not treated as a current failure after its head advanced. Closed without merge at the same observation: @@ -281,6 +247,37 @@ Closed without merge at the same observation: - PR #386: `closed_without_merge` head `57a013deb88fc0b23ae6448c1d3474c770360a5e`. - PR #377: `closed_without_merge` head `a638e28af4345750e3be92f2b0f23012b24598e0`. +### 4.1 Latest open-PR and Checks refresh + +Observed at `2026-08-21T20:13:22Z` from the GitHub API. The exact open +application heads were: #258 `6dc040c6`, #349 `a6af4525`, #355 `b606c255`, +#368 `392a9dd5`, #373 `151fe6e1`, #383 `4eaa0717`, #387 `16f6341a`, #392 +`fc040997`, #393 `1ac3a17a`, #394 `5219ed8b`, and #397 `4bfa642c`. No PR in +this set was reported as merged into protected `main`. + +- #397's latest restacked head had Full test, frontend, CodeRabbit, and Devin + Review pending at observation. The prior review found and the latest pushes + fixed the stale Korean translation key, fetched tenant-config draft race, and + non-atomic settings update. There is no independent approval, so merge is not + authorized. +- #383 had a failed `osv-scan`; both scanner invocations completed and wrote + results before a cross-fork head checkout replaced the workspace repository + and deleted the untracked base result. This is not a vulnerability verdict. + Central `.github` PR #1209 at exact head + `225c415179180606f9a935304f61b09dc3e5c084` confines both exact checkouts to + `source/` while retaining the proven scanner output flags. It remains + unmerged, so downstream checks still require a rerun after protected merge. +- The active protected ruleset `LineageWeave: no force pushes` has no bypass + actors and only the `non_fast_forward` rule. All stack pushes above were + normal fast-forward/new-branch pushes. +- **Hourly automation boundary:** the central + [`ContextualWisdomLab/.github` merge scheduler](https://github.com/ContextualWisdomLab/.github/blob/main/.github/workflows/pr-review-merge-scheduler.yml) + runs its organization sweep at `0 * * * *`; the central target allowlist + includes `ContextualWisdomLab/LineageWeave`. Its reusable review-repair + workflow is product-neutral, so LineageWeave does not add a duplicate local + timer. The same exact-head, review, Checks, and protected-merge gates remain + authoritative; a scheduled run is not evidence of a merge. + ## 5. Local Buyer-Surface Verification Observed at `2026-08-21T13:06:25Z` in the authorized local stack using a @@ -505,12 +502,11 @@ Observed at `2026-08-21T18:56:50Z` on PR #383's current head observed, but hosted Checks remain non-terminal and no independent approval or protected merge commit is present. -- The former hosted `osv-scan` job `96871880120` failed after both scans exit 0: - the central workflow passes deprecated `--output=old-results.json` and - `--output=new-results.json`, then `test -s` cannot find those files. This is - the same central defect addressed, but not yet merged, by `.github` PR #1158; - the application PR remains unmergeable until its current Checks and approval - gates pass. +- The former hosted `osv-scan` job `96871880120` failed after both scans exited + zero because the cross-fork head checkout replaced the repository workspace + and removed the untracked base result. This is the same central defect + addressed, but not yet merged, by `.github` PR #1209; the application PR + remains unmergeable until its current Checks and approval gates pass. Observed at `2026-08-21T18:39:50Z` on PR #349's exact head `202194a2d9ba6da49a011ca6127a00f6bf5394ba`: @@ -566,22 +562,19 @@ are not terminal and no independent approval or merge is claimed. This establishes the organization integration contract, not production collector acceptance. Collector delivery, retention, access review, dashboard SLOs, and no-export rollback remain deployment evidence to be recorded by GRC. -The current GRC `osv-scan` failure is the shared workflow's deprecated OSV -output-file contract, not a source vulnerability verdict; no protected merge -or bypass is authorized until the central repair and exact-head Checks pass. +The current GRC `osv-scan` failure is the shared workflow's cross-fork checkout +isolation defect, not a source vulnerability verdict; no protected merge or +bypass is authorized until the central repair and exact-head Checks pass. Observed at `2026-08-21T19:36:33Z` from the current hosted Checks: - contextual-orchestrator PR #820 remains open at exact head `4959e805c5724e7d1620639ab0151a992d717a0c`. Its unit, property, fuzz, supply-chain, Semgrep, and Strix checks passed; only `osv-scan` failed after - the scanner exited 0 and the shared workflow asserted files that the - deprecated `--output` option did not produce. -- The central repair is ContextualWisdomLab/.github PR #1158 at exact head - `c45a776f9ec3be8b35ee105e966100c80b95c2cc`. Its direct-source, provenance, - path-policy, and bootstrap checks are successful while coverage and protected - approval remain pending. Downstream OSV checks must be rerun after its - protected merge; no local suppression is valid. + the cross-fork head checkout deleted the base result produced by the scanner. +- The central repair is ContextualWisdomLab/.github PR #1209 at exact head + `225c415179180606f9a935304f61b09dc3e5c084`. Downstream OSV checks must be + rerun after its protected merge; no local suppression is valid. - This is operational evidence for the organization boundary, not a claim that a collector accepted telemetry or that any protected PR merged. @@ -606,4 +599,6 @@ Observed at `2026-08-21T19:36:33Z` from the current hosted Checks: 4. Keep the GRC and contextual-orchestrator OTEL evidence contracts aligned with the exact application instrumentation; validate live collector delivery separately from source and PR evidence, then rerun downstream OSV checks - after central `.github` PR #1158 is protected. + after central `.github` PR #1209 is protected. + +*This document is continuously updated by the hourly automated agent loop.* From b658d41178ac600e6578c74ddb3ebba70214fa63 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 05:17:34 +0900 Subject: [PATCH 086/109] docs: refresh exact heads after parent restack --- docs/product-technical-gap-baseline.md | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 0d130c7fc..919775b74 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -34,7 +34,7 @@ header and footer rendered one configured `brandName` and the footer used the browser's current year. This observation remains historical and is not a claim about the current stacked head. -- **Current exact-source mitigation at stacked PR #397 head `4bfa642c`:** +- **Current exact-source mitigation at stacked PR #397 head `8988fe71`:** `tenant_settings` now persists separate `brandName`, `systemName`, `copyrightYear`, and `copyrightHolder` values. The header renders brand and system name separately, the footer uses the persisted year and rights @@ -44,8 +44,9 @@ the asynchronous draft synchronization race and the Korean operation-note translation key, with the same operation note covered across all five product locales. The latest parent stack was fast-forwarded to #392 head - `fc040997`, and #397 was restacked with a normal merge commit. This is an - open, unmerged PR; the exact upstream stack base is `fc040997`. + `fc040997`, then `51aab854`, and #397 was restacked with normal merge + commits as the parent advanced. The current exact upstream stack base is + `259ce60a`. This is an open, unmerged PR. - **Remaining UI governance gap:** no approved CI/BI image asset or usage permission was supplied, so the implementation deliberately remains text based. Production release still requires the approved asset and legal @@ -54,12 +55,12 @@ ### 1.1.1 Exact implementation evidence for tenant identity metadata -Observed at `2026-08-21T20:13:22Z` from the GitHub API and local worktree +Observed at `2026-08-21T20:17:13Z` from the GitHub API and local worktree `/private/tmp/lineageweave-identity-restack`: - PR [#397](https://github.com/ContextualWisdomLab/LineageWeave/pull/397) is - open and ready at head `4bfa642c0326035e67638eaf12c0dbd143ed8934`, based on - exact stack branch head `fc0409979c67d0c8af5c5cbf3f9f7d4f3f75c885`; it is + open and ready at head `8988fe7175c8b03e27c9ea6fe3a554955eb350a4`, based on + exact stack branch head `259ce60abdb8e0d0993635facd8c987a2999cd58`; it is `UNSTABLE` while hosted Checks and automated reviews run and has no formal review decision yet. - Local verification at the latest restacked head passed the focused settings @@ -68,16 +69,16 @@ Observed at `2026-08-21T20:13:22Z` from the GitHub API and local worktree the full backend suite (`850 passed, 17 skipped`) and Storybook build. The focused API tests cover authentication, full metadata, legacy brand-only PATCH compatibility, blank values, and copyright-year bounds. -- PR #392 remains open at head `fc0409979c67d0c8af5c5cbf3f9f7d4f3f75c885`, +- PR #392 remains open at head `259ce60abdb8e0d0993635facd8c987a2999cd58`, targets `main`, and is `BLOCKED` with `REVIEW_REQUIRED`; #397 is a stacked follow-up and must not be described as a protected-main merge. ## 4.1 Latest open-PR and Checks refresh -Observed at `2026-08-21T20:13:22Z` from the GitHub API. The exact open +Observed at `2026-08-21T20:17:13Z` from the GitHub API. The exact open application heads were: #258 `6dc040c6`, #349 `a6af4525`, #355 `b606c255`, -#368 `392a9dd5`, #373 `151fe6e1`, #383 `4eaa0717`, #387 `16f6341a`, #392 -`fc040997`, #393 `1ac3a17a`, #394 `5219ed8b`, and #397 `4bfa642c`. No PR in +#368 `cc052a4d`, #373 `151fe6e1`, #383 `4eaa0717`, #387 `16f6341a`, #392 +`259ce60a`, #393 `1ac3a17a`, #394 `2aee6ace`, and #397 `8988fe71`. No PR in this set was reported as merged into protected `main`. - #397's latest restacked head had Full test, frontend, CodeRabbit, and Devin From 1a99ce83fbe78c85b4a6dcdb0e8add102893d9d7 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 05:24:07 +0900 Subject: [PATCH 087/109] docs: refresh protected merge gate evidence --- docs/product-technical-gap-baseline.md | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index ede68fa88..aab662fe8 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -103,6 +103,31 @@ this set was reported as merged into protected `main`. timer. The same exact-head, review, Checks, and protected-merge gates remain authoritative; a scheduled run is not evidence of a merge. +## 4.2 Current protected-merge gate refresh + +Observed at `2026-08-21T20:23:51Z` from the GitHub API. PR #397 remains open +at head `8988fe7175c8b03e27c9ea6fe3a554955eb350a4`, based on stack head +`259ce60abdb8e0d0993635facd8c987a2999cd58`; Devin Review passed, while the +frontend and full-test Checks remain pending and no independent approval is +present. PR #368 is open at documentation head +`cee63d91c74515f5faf80d1aa8c07e345f1719df`, with its required Checks pending +and `REVIEW_REQUIRED`. Neither PR is authorized to merge. + +- PR #383's only failed current-head Check is `osv-scan`. The scan itself + exited zero; the shared workflow then tested the obsolete + `old-results.json`/`new-results.json` paths after the scanner wrote only its + deprecated `--output=new-results.json` result. This is a shared workflow + contract failure, not a dependency-vulnerability verdict. Central + `.github` PR #1158 is the repair path; no duplicate product workaround is + added here. +- PR #387's earlier migration replay concern is already fixed at its current + head by commit `eaea56d3`: the gated `0103_tenant_settings.sql` uses + `CREATE TABLE IF NOT EXISTS` and `ON CONFLICT DO NOTHING`. No duplicate + patch is required. +- Active ruleset `LineageWeave: no force pushes` (ID `21065108`) has zero + bypass actors and only `non_fast_forward`; all pushes above used normal + non-force updates. + ## 2. LLM Extraction & Knowledge Graph Gaps - **Multiple Project Extraction**: A structured `key_events.project_name` implementation exists, but separate-event behavior still requires protected authorized-corpus evidence. - **5W1H Missing**: A structured 5W1H evidence-item implementation exists, but completeness and provenance still require protected authorized-corpus evidence. From 38dc94fc071093767fad12e30b1cdc938fec4b72 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 05:27:15 +0900 Subject: [PATCH 088/109] docs: record restacked tenant validation checkpoint --- docs/product-technical-gap-baseline.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index aab662fe8..08cd4bc17 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -128,6 +128,16 @@ and `REVIEW_REQUIRED`. Neither PR is authorized to merge. bypass actors and only `non_fast_forward`; all pushes above used normal non-force updates. +## 4.3 Restacked tenant validation checkpoint + +Observed at `2026-08-21T20:27:03Z` from the GitHub REST API. Parent PR #392 +advanced normally to head `658edd0932b413420e1361c34f31adb5e14d4d04`. PR #397 +was then restacked and pushed normally at head +`3aa77fc848bbcb33f5d329a21eb2822653f3b7f0`, based on that parent. The focused +backend regression set passed (`28 passed, 135 deselected`), and the frontend +suite/lint/build passed (`204 passed`). Hosted Checks for the new #397 head +were pending at observation, so approval and merge remain unauthorized. + ## 2. LLM Extraction & Knowledge Graph Gaps - **Multiple Project Extraction**: A structured `key_events.project_name` implementation exists, but separate-event behavior still requires protected authorized-corpus evidence. - **5W1H Missing**: A structured 5W1H evidence-item implementation exists, but completeness and provenance still require protected authorized-corpus evidence. From d7cc484f727029631d6b4da9c3c080c312227b8b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 05:29:01 +0900 Subject: [PATCH 089/109] docs: record full backend validation --- docs/product-technical-gap-baseline.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 08cd4bc17..8487162a8 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -137,6 +137,8 @@ was then restacked and pushed normally at head backend regression set passed (`28 passed, 135 deselected`), and the frontend suite/lint/build passed (`204 passed`). Hosted Checks for the new #397 head were pending at observation, so approval and merge remain unauthorized. +The subsequent full backend run on the same restacked checkout passed +(`862 passed, 17 skipped`, 14 deprecation/security warnings only). ## 2. LLM Extraction & Knowledge Graph Gaps - **Multiple Project Extraction**: A structured `key_events.project_name` implementation exists, but separate-event behavior still requires protected authorized-corpus evidence. From 08f93e37336cd7efc59251e03295977f3e9f2308 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 05:30:10 +0900 Subject: [PATCH 090/109] docs: record final parent restack checkpoint --- docs/product-technical-gap-baseline.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 8487162a8..13286d51a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -140,6 +140,15 @@ were pending at observation, so approval and merge remain unauthorized. The subsequent full backend run on the same restacked checkout passed (`862 passed, 17 skipped`, 14 deprecation/security warnings only). +## 4.4 Parent restack follow-up + +Observed at `2026-08-21T20:29:48Z` from the GitHub REST API. Parent PR #392 +advanced normally to `943f011a6b9e7ff74ce9e8353ecf8d9c83f6b14f`; the change is +documentation-only. PR #397 was restacked again and pushed normally at +`367f76258b8437c65fb031ccbf3e352785327c06`, based on that parent. Its hosted +Checks restarted and remain pending, with no independent approval; merge is +not authorized. + ## 2. LLM Extraction & Knowledge Graph Gaps - **Multiple Project Extraction**: A structured `key_events.project_name` implementation exists, but separate-event behavior still requires protected authorized-corpus evidence. - **5W1H Missing**: A structured 5W1H evidence-item implementation exists, but completeness and provenance still require protected authorized-corpus evidence. From 3412035127771950ecb6a9b2f932eb47c3b7c7a1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 05:35:37 +0900 Subject: [PATCH 091/109] docs: restore evidence baseline section order --- docs/product-technical-gap-baseline.md | 157 ++++++++++++------------- 1 file changed, 72 insertions(+), 85 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 13286d51a..1d70e797d 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -73,82 +73,6 @@ Observed at `2026-08-21T20:17:13Z` from the GitHub API and local worktree targets `main`, and is `BLOCKED` with `REVIEW_REQUIRED`; #397 is a stacked follow-up and must not be described as a protected-main merge. -## 4.1 Latest open-PR and Checks refresh - -Observed at `2026-08-21T20:17:13Z` from the GitHub API. The exact open -application heads were: #258 `6dc040c6`, #349 `a6af4525`, #355 `b606c255`, -#368 `cc052a4d`, #373 `151fe6e1`, #383 `4eaa0717`, #387 `16f6341a`, #392 -`259ce60a`, #393 `1ac3a17a`, #394 `2aee6ace`, and #397 `8988fe71`. No PR in -this set was reported as merged into protected `main`. - -- #397's latest restacked head had Full test, frontend, CodeRabbit, and Devin - Review pending at observation. The prior review found and the latest pushes - fixed the stale Korean translation key, fetched tenant-config draft race, and - non-atomic settings update. There is no independent approval, so merge is not - authorized. -- #383 had a failed `osv-scan`. The failure remains the shared workflow's - deprecated `--output=old-results.json` / `--output=new-results.json` contract, - not a source vulnerability verdict. Central `.github` PR #1158 is open at - exact head `f61a8795`, adds the `--output-file` contract and provenance - classifier, and remains unmerged with hosted Checks pending. Do not duplicate - the central repair in LineageWeave. -- The active protected ruleset `LineageWeave: no force pushes` has no bypass - actors and only the `non_fast_forward` rule. All stack pushes above were - normal fast-forward/new-branch pushes. -- **Hourly automation boundary:** the central - [`ContextualWisdomLab/.github` merge scheduler](https://github.com/ContextualWisdomLab/.github/blob/main/.github/workflows/pr-review-merge-scheduler.yml) - runs its organization sweep at `0 * * * *`; the central target allowlist - includes `ContextualWisdomLab/LineageWeave`. Its reusable review-repair - workflow is product-neutral, so LineageWeave does not add a duplicate local - timer. The same exact-head, review, Checks, and protected-merge gates remain - authoritative; a scheduled run is not evidence of a merge. - -## 4.2 Current protected-merge gate refresh - -Observed at `2026-08-21T20:23:51Z` from the GitHub API. PR #397 remains open -at head `8988fe7175c8b03e27c9ea6fe3a554955eb350a4`, based on stack head -`259ce60abdb8e0d0993635facd8c987a2999cd58`; Devin Review passed, while the -frontend and full-test Checks remain pending and no independent approval is -present. PR #368 is open at documentation head -`cee63d91c74515f5faf80d1aa8c07e345f1719df`, with its required Checks pending -and `REVIEW_REQUIRED`. Neither PR is authorized to merge. - -- PR #383's only failed current-head Check is `osv-scan`. The scan itself - exited zero; the shared workflow then tested the obsolete - `old-results.json`/`new-results.json` paths after the scanner wrote only its - deprecated `--output=new-results.json` result. This is a shared workflow - contract failure, not a dependency-vulnerability verdict. Central - `.github` PR #1158 is the repair path; no duplicate product workaround is - added here. -- PR #387's earlier migration replay concern is already fixed at its current - head by commit `eaea56d3`: the gated `0103_tenant_settings.sql` uses - `CREATE TABLE IF NOT EXISTS` and `ON CONFLICT DO NOTHING`. No duplicate - patch is required. -- Active ruleset `LineageWeave: no force pushes` (ID `21065108`) has zero - bypass actors and only `non_fast_forward`; all pushes above used normal - non-force updates. - -## 4.3 Restacked tenant validation checkpoint - -Observed at `2026-08-21T20:27:03Z` from the GitHub REST API. Parent PR #392 -advanced normally to head `658edd0932b413420e1361c34f31adb5e14d4d04`. PR #397 -was then restacked and pushed normally at head -`3aa77fc848bbcb33f5d329a21eb2822653f3b7f0`, based on that parent. The focused -backend regression set passed (`28 passed, 135 deselected`), and the frontend -suite/lint/build passed (`204 passed`). Hosted Checks for the new #397 head -were pending at observation, so approval and merge remain unauthorized. -The subsequent full backend run on the same restacked checkout passed -(`862 passed, 17 skipped`, 14 deprecation/security warnings only). - -## 4.4 Parent restack follow-up - -Observed at `2026-08-21T20:29:48Z` from the GitHub REST API. Parent PR #392 -advanced normally to `943f011a6b9e7ff74ce9e8353ecf8d9c83f6b14f`; the change is -documentation-only. PR #397 was restacked again and pushed normally at -`367f76258b8437c65fb031ccbf3e352785327c06`, based on that parent. Its hosted -Checks restarted and remain pending, with no independent approval; merge is -not authorized. - ## 2. LLM Extraction & Knowledge Graph Gaps - **Multiple Project Extraction**: A structured `key_events.project_name` implementation exists, but separate-event behavior still requires protected authorized-corpus evidence. - **5W1H Missing**: A structured 5W1H evidence-item implementation exists, but completeness and provenance still require protected authorized-corpus evidence. @@ -251,17 +175,17 @@ merged into stack bases only; their merge commits are not protected-main merges. Re-read the exact current HEAD, review, and terminal-check gates before every future merge. -Queue refresh at `2026-08-21T19:00:00Z`: PR #391 is now merged into the open +Queue refresh at `2026-08-21T19:00:00Z`: PR #391 is recorded as merged into the open #387 stack parent with merge commit `16f2b13caad10f4d999293d623405aefadeda52e`; this is not a protected-main -merge. New PR #392 is open at exact head +merge. PR #392 is open at exact head `a046da4e52c484807fc28111bd813d1acbc00816` with one passing and twelve pending non-skipped Checks and no independent approval. The remaining open PRs were not authorized to merge from this observation because approval and/or terminal Checks were still absent. Queue refresh at `2026-08-21T19:07:01Z`: exact-current inspection found no -failed Checks on the eight open LineageWeave PRs. PR #387 advanced to +failed Checks on the listed main-targeting open LineageWeave PRs. PR #387 advanced to `eaea56d3b2f07f89a5dfcc7d81b032148048982d`; PR #392 remains at `a046da4e52c484807fc28111bd813d1acbc00816`; the baseline PR itself is at `7855f2af0c516a0a4f6228e0b9230e6062d326be`. All had no independent approval; @@ -355,6 +279,65 @@ this set was reported as merged into protected `main`. timer. The same exact-head, review, Checks, and protected-merge gates remain authoritative; a scheduled run is not evidence of a merge. +### 4.2 Latest open-PR and Checks refresh + +Observed at `2026-08-21T20:17:13Z` from the GitHub API. These are timestamped +historical observations, not current merge claims. The exact open application +heads were: #258 `6dc040c6`, #349 `a6af4525`, #355 `b606c255`, #368 `cc052a4d`, +#373 `151fe6e1`, #383 `4eaa0717`, #387 `16f6341a`, #392 `259ce60a`, #393 +`1ac3a17a`, #394 `2aee6ace`, and #397 `8988fe71`. No PR in this set was +reported as merged into protected `main`. + +- #397's latest restacked head had Full test, frontend, CodeRabbit, and Devin + Review pending at observation. The prior review found and the latest pushes + fixed the stale Korean translation key, fetched tenant-config draft race, and + non-atomic settings update. There was no independent approval. +- #383 had a failed `osv-scan`. The failure was the shared workflow's + deprecated output-file contract, not a source vulnerability verdict. Central + `.github` PR #1158 was the repair path at that observation; no duplicate + product workaround was added in LineageWeave. +- The active protected ruleset had no bypass actors and only the + `non_fast_forward` rule. All stack pushes above were normal updates. + +### 4.3 Protected-merge gate refresh + +Observed at `2026-08-21T20:23:51Z` from the GitHub API. PR #397 was open at +head `8988fe7175c8b03e27c9ea6fe3a554955eb350a4`, based on stack head +`259ce60abdb8e0d0993635facd8c987a2999cd58`; its frontend and full-test Checks +were pending and no independent approval was present. PR #368 was open at +documentation head `cee63d91c74515f5faf80d1aa8c07e345f1719df`, with required +Checks pending and `REVIEW_REQUIRED`. Neither PR was authorized to merge. + +- PR #383's only failed current-head Check was `osv-scan`. The scanner exited + zero, but the shared workflow tested obsolete `old-results.json` and + `new-results.json` paths after the scanner wrote its deprecated output. This + was a shared workflow contract failure, not a dependency-vulnerability + verdict. +- PR #387's migration replay concern was already fixed at its current head by + `eaea56d3`: `0103_tenant_settings.sql` uses `CREATE TABLE IF NOT EXISTS` + and `ON CONFLICT DO NOTHING`. + +### 4.4 Restacked tenant validation checkpoint + +Observed at `2026-08-21T20:27:03Z` from the GitHub REST API. Parent PR #392 +advanced normally to `658edd0932b413420e1361c34f31adb5e14d4d04`. PR #397 was +then restacked and pushed normally at +`3aa77fc848bbcb33f5d329a21eb2822653f3b7f0`, based on that parent. The focused +backend regression set passed (`28 passed, 135 deselected`), and the frontend +suite/lint/build passed (`204 passed`). Hosted Checks for the new #397 head +were pending, so approval and merge remained unauthorized. The subsequent full +backend run on the same restacked checkout passed (`862 passed, 17 skipped`, +with deprecation/security warnings only). + +### 4.5 Parent restack follow-up + +Observed at `2026-08-21T20:29:48Z` from the GitHub REST API. Parent PR #392 +advanced normally to `943f011a6b9e7ff74ce9e8353ecf8d9c83f6b14f`; the change was +documentation-only. PR #397 was restacked again and pushed normally at +`367f76258b8437c65fb031ccbf3e352785327c06`, based on that parent. Its hosted +Checks restarted and remained pending, with no independent approval; merge was +not authorized. + ## 5. Local Buyer-Surface Verification Observed at `2026-08-21T13:06:25Z` in the authorized local stack using a @@ -446,8 +429,10 @@ the real Compose backend, Valkey, and orchestrator boundary: 221 frontend tests, lint, and production build; hosted Checks remain queued and no independent approval or merge commit is present. - PR #258 then corrected the Unreleased changelog's Buyer-terminology ADR - reference from 0119 to the governing ADR 0131; the focused reconstruction - and adjudication tests still passed at the pushed documentation head. + reference from 0119 to the proposed ADR 0131 on that PR branch; the focused + reconstruction and adjudication tests still passed at the pushed + documentation head. ADR 0131 is not present in the protected repository + until its PR merges. Observed at `2026-08-21T17:52:18Z` in an authenticated Playwright browser run against the local runtime, using the eleven supplied defect routes and @@ -486,9 +471,10 @@ Observed at `2026-08-21T17:10:21Z` on PR #387's exact head regression passed 768 tests with 17 environment skips; frontend lint, 143 Vitest tests, and production build passed. - Devin's remaining observations about uniform channel sets and LLM - availability are documented as invariants/optional-channel behavior in ADR - 0124; active weight ordering was made deterministic, and the ADR now records - the orchestrated rebuild/import boundary. Hosted Checks are queued and no + availability are documented in the proposed ADR 0124 on the PR branch; + active weight ordering was made deterministic, and that branch ADR records + the orchestrated rebuild/import boundary. The ADR is not present in the + protected repository until its PR merges. Hosted Checks are queued and no independent approval or merge commit is claimed. Observed at `2026-08-21T18:28:15Z` on PR #388's exact head @@ -591,7 +577,8 @@ Observed at `2026-08-21T18:39:50Z` on PR #349's exact head - The ontology source cursor now uses `src.v2.` AES-GCM with a fresh 96-bit nonce and prefix/version associated data; the custom v1 keystream format is rejected. The concurrent ontology page retry repair remains included. -- ADR 0125 records the decision and NIST SP 800-38D APA 7 reference. The +- The PR branch's proposed ADR 0125 records the decision and NIST SP 800-38D + APA 7 reference; it is not yet present in the protected repository. The static SQL review contract repair passed 17 focused tests and compilation; hosted Checks remained non-terminal and no independent approval was present. From 677b214c9f86cff49ce35e71cf408e8ff7cb07bd Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 05:35:54 +0900 Subject: [PATCH 092/109] docs: deduplicate and correct checkpoint evidence --- docs/product-technical-gap-baseline.md | 125 ++++++++++--------------- 1 file changed, 47 insertions(+), 78 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 13286d51a..0ed0e2a55 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -73,82 +73,6 @@ Observed at `2026-08-21T20:17:13Z` from the GitHub API and local worktree targets `main`, and is `BLOCKED` with `REVIEW_REQUIRED`; #397 is a stacked follow-up and must not be described as a protected-main merge. -## 4.1 Latest open-PR and Checks refresh - -Observed at `2026-08-21T20:17:13Z` from the GitHub API. The exact open -application heads were: #258 `6dc040c6`, #349 `a6af4525`, #355 `b606c255`, -#368 `cc052a4d`, #373 `151fe6e1`, #383 `4eaa0717`, #387 `16f6341a`, #392 -`259ce60a`, #393 `1ac3a17a`, #394 `2aee6ace`, and #397 `8988fe71`. No PR in -this set was reported as merged into protected `main`. - -- #397's latest restacked head had Full test, frontend, CodeRabbit, and Devin - Review pending at observation. The prior review found and the latest pushes - fixed the stale Korean translation key, fetched tenant-config draft race, and - non-atomic settings update. There is no independent approval, so merge is not - authorized. -- #383 had a failed `osv-scan`. The failure remains the shared workflow's - deprecated `--output=old-results.json` / `--output=new-results.json` contract, - not a source vulnerability verdict. Central `.github` PR #1158 is open at - exact head `f61a8795`, adds the `--output-file` contract and provenance - classifier, and remains unmerged with hosted Checks pending. Do not duplicate - the central repair in LineageWeave. -- The active protected ruleset `LineageWeave: no force pushes` has no bypass - actors and only the `non_fast_forward` rule. All stack pushes above were - normal fast-forward/new-branch pushes. -- **Hourly automation boundary:** the central - [`ContextualWisdomLab/.github` merge scheduler](https://github.com/ContextualWisdomLab/.github/blob/main/.github/workflows/pr-review-merge-scheduler.yml) - runs its organization sweep at `0 * * * *`; the central target allowlist - includes `ContextualWisdomLab/LineageWeave`. Its reusable review-repair - workflow is product-neutral, so LineageWeave does not add a duplicate local - timer. The same exact-head, review, Checks, and protected-merge gates remain - authoritative; a scheduled run is not evidence of a merge. - -## 4.2 Current protected-merge gate refresh - -Observed at `2026-08-21T20:23:51Z` from the GitHub API. PR #397 remains open -at head `8988fe7175c8b03e27c9ea6fe3a554955eb350a4`, based on stack head -`259ce60abdb8e0d0993635facd8c987a2999cd58`; Devin Review passed, while the -frontend and full-test Checks remain pending and no independent approval is -present. PR #368 is open at documentation head -`cee63d91c74515f5faf80d1aa8c07e345f1719df`, with its required Checks pending -and `REVIEW_REQUIRED`. Neither PR is authorized to merge. - -- PR #383's only failed current-head Check is `osv-scan`. The scan itself - exited zero; the shared workflow then tested the obsolete - `old-results.json`/`new-results.json` paths after the scanner wrote only its - deprecated `--output=new-results.json` result. This is a shared workflow - contract failure, not a dependency-vulnerability verdict. Central - `.github` PR #1158 is the repair path; no duplicate product workaround is - added here. -- PR #387's earlier migration replay concern is already fixed at its current - head by commit `eaea56d3`: the gated `0103_tenant_settings.sql` uses - `CREATE TABLE IF NOT EXISTS` and `ON CONFLICT DO NOTHING`. No duplicate - patch is required. -- Active ruleset `LineageWeave: no force pushes` (ID `21065108`) has zero - bypass actors and only `non_fast_forward`; all pushes above used normal - non-force updates. - -## 4.3 Restacked tenant validation checkpoint - -Observed at `2026-08-21T20:27:03Z` from the GitHub REST API. Parent PR #392 -advanced normally to head `658edd0932b413420e1361c34f31adb5e14d4d04`. PR #397 -was then restacked and pushed normally at head -`3aa77fc848bbcb33f5d329a21eb2822653f3b7f0`, based on that parent. The focused -backend regression set passed (`28 passed, 135 deselected`), and the frontend -suite/lint/build passed (`204 passed`). Hosted Checks for the new #397 head -were pending at observation, so approval and merge remain unauthorized. -The subsequent full backend run on the same restacked checkout passed -(`862 passed, 17 skipped`, 14 deprecation/security warnings only). - -## 4.4 Parent restack follow-up - -Observed at `2026-08-21T20:29:48Z` from the GitHub REST API. Parent PR #392 -advanced normally to `943f011a6b9e7ff74ce9e8353ecf8d9c83f6b14f`; the change is -documentation-only. PR #397 was restacked again and pushed normally at -`367f76258b8437c65fb031ccbf3e352785327c06`, based on that parent. Its hosted -Checks restarted and remain pending, with no independent approval; merge is -not authorized. - ## 2. LLM Extraction & Knowledge Graph Gaps - **Multiple Project Extraction**: A structured `key_events.project_name` implementation exists, but separate-event behavior still requires protected authorized-corpus evidence. - **5W1H Missing**: A structured 5W1H evidence-item implementation exists, but completeness and provenance still require protected authorized-corpus evidence. @@ -349,12 +273,57 @@ this set was reported as merged into protected `main`. normal fast-forward/new-branch pushes. - **Hourly automation boundary:** the central [`ContextualWisdomLab/.github` merge scheduler](https://github.com/ContextualWisdomLab/.github/blob/main/.github/workflows/pr-review-merge-scheduler.yml) - runs its organization sweep at `0 * * * *`; the central target allowlist - includes `ContextualWisdomLab/LineageWeave`. Its reusable review-repair + runs the queue scan every 30 minutes and the organization-wide sweep every + 15 minutes; the central target allowlist includes + `ContextualWisdomLab/LineageWeave`. Its reusable review-repair workflow is product-neutral, so LineageWeave does not add a duplicate local timer. The same exact-head, review, Checks, and protected-merge gates remain authoritative; a scheduled run is not evidence of a merge. +### 4.2 Current protected-merge gate refresh + +Observed at `2026-08-21T20:23:51Z` from the GitHub API. PR #397 remained open +at head `8988fe7175c8b03e27c9ea6fe3a554955eb350a4`, based on stack head +`259ce60abdb8e0d0993635facd8c987a2999cd58`; Devin Review passed, while the +frontend and full-test Checks remained pending and no independent approval was +present. PR #368 was open at documentation head +`cee63d91c74515f5faf80d1aa8c07e345f1719df`, with its required Checks pending +and `REVIEW_REQUIRED`. Neither PR was authorized to merge. + +- PR #383's only failed current-head Check was `osv-scan`. Both scanner runs + completed before the cross-fork head checkout deleted the untracked base + result. This is a shared workflow isolation defect, not a dependency- + vulnerability verdict. Central `.github` PR #1209 confines both exact + checkouts to `source/`; no duplicate product workaround is added here. +- PR #387's earlier migration replay concern was already fixed at its current + head by commit `eaea56d3`: the gated `0103_tenant_settings.sql` uses + `CREATE TABLE IF NOT EXISTS` and `ON CONFLICT DO NOTHING`. No duplicate + patch is required. +- Active ruleset `LineageWeave: no force pushes` (ID `21065108`) had zero + bypass actors and only `non_fast_forward`; all pushes above used normal + non-force updates. + +### 4.3 Restacked tenant validation checkpoint + +Observed at `2026-08-21T20:27:03Z` from the GitHub REST API. Parent PR #392 +advanced normally to head `658edd0932b413420e1361c34f31adb5e14d4d04`. PR #397 +was then restacked and pushed normally at head +`3aa77fc848bbcb33f5d329a21eb2822653f3b7f0`, based on that parent. The focused +backend regression set passed (`28 passed, 135 deselected`), and the frontend +suite/lint/build passed (`204 passed`). Hosted Checks for the new #397 head +were pending at observation, so approval and merge remained unauthorized. +The subsequent full backend run on the same restacked checkout passed +(`862 passed, 17 skipped`, 14 deprecation/security warnings only). + +### 4.4 Parent restack follow-up + +Observed at `2026-08-21T20:29:48Z` from the GitHub REST API. Parent PR #392 +advanced normally to `943f011a6b9e7ff74ce9e8353ecf8d9c83f6b14f`; the change is +documentation-only. PR #397 was restacked again and pushed normally at +`367f76258b8437c65fb031ccbf3e352785327c06`, based on that parent. Its hosted +Checks restarted and remained pending, with no independent approval; merge was +not authorized. + ## 5. Local Buyer-Surface Verification Observed at `2026-08-21T13:06:25Z` in the authorized local stack using a From 34b68581cf893bf1b483db67412654ad9412c023 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 05:38:34 +0900 Subject: [PATCH 093/109] docs: record current exact head audit --- docs/product-technical-gap-baseline.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 49697a1be..2ede41fba 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -340,6 +340,21 @@ documentation-only. PR #397 was restacked again and pushed normally at Checks restarted and remained pending, with no independent approval; merge was not authorized. +### 4.6 Current exact-head audit snapshot + +Observed at `2026-08-21T20:37:43Z` from the GitHub REST API. Parent PR #392 is +open at `877dbf50aa16b65b13b25539ae16dceb84210fb9`, targeting protected `main` +and blocked by its merge gates. PR #397 is open at +`e9a562a41395eacae9d7d04e84a9674397f4dbbf`, based on that parent; its hosted +Checks are pending and it has no independent approval. PR #368 was open at +baseline head `ca4c117ac58231f9ffdb12ab6cb88eb27db02522`, targeting `main` and +blocked by its merge gates. No merge is claimed for any of these PRs. + +- The current tenant branch includes migration replay hardening for legacy + blank or out-of-range identity values, plus worker-supervision changes from + the parent stack. Local verification passed migration/worker tests (`22 + passed`) and the full backend suite (`864 passed, 17 skipped`). + ## 5. Local Buyer-Surface Verification Observed at `2026-08-21T13:06:25Z` in the authorized local stack using a From 3d0adbb9c4bbef938584b1b1e79bf3f34a34df6e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 05:39:37 +0900 Subject: [PATCH 094/109] docs: add requirement traceability matrix --- docs/product-technical-gap-baseline.md | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 2ede41fba..529f00e41 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -88,6 +88,28 @@ Observed at `2026-08-21T20:17:13Z` from the GitHub API and local worktree - **Security & Compliance**: PII masking cannot break the system. Need SOC 2 and CSAP compliance alternatives to blind PII masking. - **LLM Orchestration**: Ensure ALL LLM calls route through `contextual-orchestrator` utilizing API keys (BYTEZ, NVIDIA, OPENROUTER, OPENAI) with auto model discovery and optimal reasoning effort allocation (Fugu/Conductor/TRINITY research). +### 2.1 Requirement traceability matrix + +The status vocabulary is evidence-bound: **verified** means the current source +and a scoped test prove the contract; **partial** means local or synthetic +evidence exists but the requested authorized-corpus or production proof is +absent; **open** means implementation or governance work is still required. +An open PR never counts as a protected-main merge. + +| Requested capability | Current evidence | Status and remaining proof | +| --- | --- | --- | +| UI shell, responsive tiers, Figma and Storybook | React shell, token tests, viewport/browser checks, Storybook scenes, ADR 0118 Figma File ID `1Su3lDRmiZdcUs47t1QwIX` | **Partial** — approved CI/BI asset, legal usage permission, no-JavaScript fallback, and protected runtime parity remain unproven. | +| Corporate-code/PU login, logout, ABAC/RBAC and visibility | OIDC browser run, account affiliations, permission checks, post visibility predicates and API tests | **Partial** — authorized production identity and complete role/policy matrix remain unverified. | +| Event DAG, branching and channel evidence | `LineageDag`, keyboard selection, branch/root/current states, persisted channel evidence and synthetic tests | **Partial** — current protected-corpus rendering and lineage quality remain unproven; PR #387 is open. | +| TEPP import/REST boundary and PostgreSQL source | TEPP client contract, PostgreSQL migrations, import boundary and no-file-DB tests | **Partial** — the requested real `zcrht811_export_rows` analysis cannot be committed or claimed without protected authorized runtime evidence. | +| Keyman, R&R, 5W1H, multi-project events and commitments | Orchestrator clients, persistence schemas, popup routes and synthetic/API coverage | **Partial** — affiliation, requester/assignee, counterparty-side identity, provenance and corpus completeness remain unverified. | +| Ontology, semantic layer, KG depth and customer master | normalized entity/relation/provenance schema, ABAC filters and customer/ontology routes | **Partial** — Searxng corroboration, abbreviation resolution, multi-company/team identity and per-node depth need live evidence. | +| HTML/CSS structure, Base64 image and multimodal analysis | semantic units, region persistence, OCR/caption rendering and bounded VISION boundary | **Partial** — image-heavy summaries still return processing/unavailable states; complete region/OCR/embedding quality is not proven. | +| Weekly/monthly reports and psychometric linking | report routes, TEPP/fast-mlsirm contracts and synthetic measurement tests | **Open** — authorized corpus calibration, RMSE/linking evidence, CAT/Fixed-Item calibration and buyer report acceptance are missing. | +| Valkey event queue, retries, concurrency and operations | queue migrations, worker supervision tests, replay-safe migrations and lock-aware settings update | **Partial** — production throughput, hot-partition behavior, lock contention and recovery SLO evidence remain open. | +| Orchestrator auto-discovery, VISION, embeddings and OTEL | provider-neutral gateway boundary, bounded provenance/session metadata and open upstream PR evidence | **Partial** — live model completion, collector delivery, retention/access review and downstream central workflow repair are not yet accepted. | +| Security, CSAP/SOC 2 and PII-preserving controls | ABAC/authorization tests, redaction-safe telemetry contract and repository no-real-data rule | **Partial** — control-owner evidence, audit artifacts, key management and operational access reviews remain outside this repository. | + ## 4. Current Checkpoint Evidence The following states are evidence-bound and must not be changed to `merged` or From 6d99eab18d02849d94dfdf836a57798de4e65299 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 05:51:00 +0900 Subject: [PATCH 095/109] docs: refresh current PR gap evidence --- docs/product-technical-gap-baseline.md | 47 ++++++++++++++++++++++---- 1 file changed, 41 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 529f00e41..ab74aba2a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -34,19 +34,22 @@ header and footer rendered one configured `brandName` and the footer used the browser's current year. This observation remains historical and is not a claim about the current stacked head. -- **Current exact-source mitigation at stacked PR #397 head `8988fe71`:** +- **Current exact-source mitigation at the merged stack change `2e51a777`:** `tenant_settings` now persists separate `brandName`, `systemName`, `copyrightYear`, and `copyrightHolder` values. The header renders brand and system name separately, the footer uses the persisted year and rights holder, and the admin form validates the four-field contract through the `post_admin` boundary. The migration is replayable through Compose and the - old brand-only PATCH shape remains compatible. The latest review also fixed + old brand-only PATCH shape remains compatible. The merged change also fixed the asynchronous draft synchronization race and the Korean operation-note translation key, with the same operation note covered across all five - product locales. The latest parent stack was fast-forwarded to #392 head - `fc040997`, then `51aab854`, and #397 was restacked with normal merge - commits as the parent advanced. The current exact upstream stack base is - `259ce60a`. This is an open, unmerged PR. + product locales. PR #397 merged into the non-main stack branch; the + protected `main` branch still depends on the separate parent PR #392. +- **Current follow-up at PR #398 head `5822948f`:** the settings upsert now + refreshes `tenant_settings.updated_at`, and clearing the numeric copyright + year stays visibly blank and blocks submission instead of coercing the + draft to a valid-looking value. Local backend and frontend evidence is + recorded below; hosted Checks and independent approval remain required. - **Remaining UI governance gap:** no approved CI/BI image asset or usage permission was supplied, so the implementation deliberately remains text based. Production release still requires the approved asset and legal @@ -58,6 +61,10 @@ Observed at `2026-08-21T20:17:13Z` from the GitHub API and local worktree `/private/tmp/lineageweave-identity-restack`: +This subsection is a historical checkpoint. The current exact-head state is +recorded in Section 4.7; the older PR #397 open-state wording below is not a +current merge claim. + - PR [#397](https://github.com/ContextualWisdomLab/LineageWeave/pull/397) is open and ready at head `8988fe7175c8b03e27c9ea6fe3a554955eb350a4`, based on exact stack branch head `259ce60abdb8e0d0993635facd8c987a2999cd58`; it is @@ -377,6 +384,34 @@ blocked by its merge gates. No merge is claimed for any of these PRs. the parent stack. Local verification passed migration/worker tests (`22 passed`) and the full backend suite (`864 passed, 17 skipped`). +### 4.7 Current exact-head audit snapshot + +Observed at `2026-08-21T20:50:15Z` from the GitHub REST API and the current +follow-up worktree. This supersedes the earlier checkpoint wording above; the +earlier sections remain historical evidence. + +- PR #397 merged into the non-main stack branch at head `77e2edee`; the stack + now contains the resulting commit `2e51a777`. This is not a protected-main + merge. +- PR #398 is open at exact head `5822948fe915542f1f916618d8905c3b4715d676`, + based on stack head `2e51a777`, with `mergeable=true` and + `mergeable_state=unstable`. Devin Review and the frontend/full-test Checks + are pending, and no independent approval is recorded. It is not authorized + to merge. +- PR #392 is open at exact head `7882bfc32ead971d27877558ca216a95cbaeb6e0`, + targets protected `main`, and remains blocked with no formal review + decision. PR #368 is open at `3d0adbb9c4bbef938584b1b1e79bf3f34a34df6e`, + targets `main`, and remains blocked without formal approval. +- PR #383 remains open at `4eaa07172fde827f4ad89580326a0d2db5ceb0e4`; its + current `osv-scan` failure is the previously documented central workflow + result-path defect, while its source/security checks otherwise pass. PR + #387 remains open at `16f6341a0feec262904c1ad9275ed73449444cf5`; its major + checks pass, but it still lacks the required independent approval. +- Follow-up local evidence for #398 is backend `864 passed, 17 skipped, 14 + warnings`, frontend `22 files, 207 passed`, lint, and production build. + The warnings are existing deprecations and a test-only short HMAC warning; + they are not a failed product check. + ## 5. Local Buyer-Surface Verification Observed at `2026-08-21T13:06:25Z` in the authorized local stack using a From a6e3a68138e6818a201dd73d40f3372bdd95ec07 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 05:55:36 +0900 Subject: [PATCH 096/109] docs: record authenticated browser checkpoint --- docs/product-technical-gap-baseline.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index ab74aba2a..890ead6e6 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -447,6 +447,18 @@ synthetic Keycloak account and aggregate-only assertions: this repository. Image-heavy processing remains an explicit processing-state gap, not a live-success claim. +Observed at `2026-08-21T20:55:11Z` in the same local Compose browser runtime +with aggregate-only assertions: + +- The Keycloak login flow completed, 50 authorized list entries were loaded, + and one detail popup opened and closed successfully. +- The rendered popup contained the Event Lineage heading, Knowledge Graph + region, and post-action group without a frontend error element. Aggregate + response statuses were `200×60`, `302×1`, and `503×1`. +- The `503` is generated-evidence unavailability, so this run proves the UX + path and error boundary only; it does not prove complete summary or VISION + readiness. + Observed at `2026-08-21T16:01:40Z` in a fresh local Compose browser session: - OIDC login, an authorized post click, popup close, and the phone-width menu From 677f9524c1143e3ab5acbf54ae4fc5e07bbde170 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 05:57:44 +0900 Subject: [PATCH 097/109] docs: record review repair checkpoint --- docs/product-technical-gap-baseline.md | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 890ead6e6..07b48690b 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -45,7 +45,7 @@ translation key, with the same operation note covered across all five product locales. PR #397 merged into the non-main stack branch; the protected `main` branch still depends on the separate parent PR #392. -- **Current follow-up at PR #398 head `5822948f`:** the settings upsert now +- **Current follow-up at PR #398 head `f101ab93`:** the settings upsert now refreshes `tenant_settings.updated_at`, and clearing the numeric copyright year stays visibly blank and blocks submission instead of coercing the draft to a valid-looking value. Local backend and frontend evidence is @@ -412,6 +412,19 @@ earlier sections remain historical evidence. The warnings are existing deprecations and a test-only short HMAC warning; they are not a failed product check. +### 4.8 Current exact-head follow-up + +Observed at `2026-08-21T20:57:23Z` from the GitHub REST API and the current +follow-up worktree. PR #398 is now at exact head +`f101ab938f844ea12fa78b1cdf4ea1adaf07e962`, based on stack head `2e51a777`. +The follow-up includes the review repair that separates an empty numeric input +from the `0` value and retains the whitespace-only no-op save guard. Its +frontend suite is `208 passed` with lint and production build passing; the +backend evidence remains `864 passed, 17 skipped, 14 warnings`. Hosted Checks +restarted and remain pending, with no independent approval, so merge is not +authorized. Parent PR #392 is currently at `a6d754a7` and baseline PR #368 at +`a6e3a681`; both remain open and blocked by their respective merge gates. + ## 5. Local Buyer-Surface Verification Observed at `2026-08-21T13:06:25Z` in the authorized local stack using a From 331206425fa0acf3538f7c8edff261663f2ad606 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 06:00:01 +0900 Subject: [PATCH 098/109] docs: record responsive shell evidence --- docs/product-technical-gap-baseline.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 07b48690b..45e754a74 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -472,6 +472,17 @@ with aggregate-only assertions: path and error boundary only; it does not prove complete summary or VISION readiness. +Observed at `2026-08-21T20:59:49Z` across the same authenticated browser +session at the three guide breakpoints: + +- At 1280, 800, and 390 CSS pixels, `scrollWidth` equaled `innerWidth` and + the header top offset was zero. The phone viewport exposed the drawer + trigger; its drawer opened and its in-drawer close control closed it. +- The desktop and tablet viewports retained the desktop navigation treatment, + consistent with the guide's adaptive-web rule for tablets. This proves the + observed responsive shell behavior only; protected-corpus content parity + remains a separate partial gap. + Observed at `2026-08-21T16:01:40Z` in a fresh local Compose browser session: - OIDC login, an authorized post click, popup close, and the phone-width menu From 7660b58501db5faf2e45748a977da403d24901ef Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 06:03:05 +0900 Subject: [PATCH 099/109] docs: align baseline PR head --- docs/product-technical-gap-baseline.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 45e754a74..781909927 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -423,7 +423,8 @@ frontend suite is `208 passed` with lint and production build passing; the backend evidence remains `864 passed, 17 skipped, 14 warnings`. Hosted Checks restarted and remain pending, with no independent approval, so merge is not authorized. Parent PR #392 is currently at `a6d754a7` and baseline PR #368 at -`a6e3a681`; both remain open and blocked by their respective merge gates. +`331206425fa0acf3538f7c8edff261663f2ad606`; both remain open while their +respective merge gates recalculate. ## 5. Local Buyer-Surface Verification From 6e2e845ca3b14c0e4c943c59753b9378a1cb8c47 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 06:06:42 +0900 Subject: [PATCH 100/109] docs: record latest live popup check --- docs/product-technical-gap-baseline.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 781909927..90c35b3c1 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -484,6 +484,16 @@ session at the three guide breakpoints: observed responsive shell behavior only; protected-corpus content parity remains a separate partial gap. +Observed at `2026-08-21T21:06:09Z` after rebuilding the frontend from the +follow-up worktree and restoring the existing Compose runtime: + +- Frontend and backend liveness returned HTTP 200. The live OIDC browser run + again loaded 50 authorized entries, opened and closed one popup, and found + Event Lineage, Knowledge Graph, and post-action DOM regions with zero + frontend error elements. +- Response status counts remained `200×60`, `302×1`, and `503×1`; the latter + is still the bounded generated-evidence availability gap documented above. + Observed at `2026-08-21T16:01:40Z` in a fresh local Compose browser session: - OIDC login, an authorized post click, popup close, and the phone-width menu From 829b630a3608d0b800fabf9ea129d011091f7ca3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 06:08:30 +0900 Subject: [PATCH 101/109] docs: record stacked identity merge --- docs/product-technical-gap-baseline.md | 29 +++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 90c35b3c1..db091e120 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -45,11 +45,13 @@ translation key, with the same operation note covered across all five product locales. PR #397 merged into the non-main stack branch; the protected `main` branch still depends on the separate parent PR #392. -- **Current follow-up at PR #398 head `f101ab93`:** the settings upsert now - refreshes `tenant_settings.updated_at`, and clearing the numeric copyright - year stays visibly blank and blocks submission instead of coercing the - draft to a valid-looking value. Local backend and frontend evidence is - recorded below; hosted Checks and independent approval remain required. +- **Current follow-up merged into the non-main stack at `202063bc`:** the + settings upsert refreshes `tenant_settings.updated_at`, clearing the numeric + copyright year stays visibly blank through an explicit invalid sentinel, and + whitespace-only identity edits remain disabled no-ops. The merged review + repair also trims the system-name comparison and closes test connections + explicitly. This changes the stack branch only; protected `main` still + depends on parent PR #392. - **Remaining UI governance gap:** no approved CI/BI image asset or usage permission was supplied, so the implementation deliberately remains text based. Production release still requires the approved asset and legal @@ -426,6 +428,23 @@ authorized. Parent PR #392 is currently at `a6d754a7` and baseline PR #368 at `331206425fa0acf3538f7c8edff261663f2ad606`; both remain open while their respective merge gates recalculate. +### 4.9 Current stack-merge snapshot + +Observed at `2026-08-21T21:07:49Z` from the GitHub REST API. PR #398's final +head was `19c68217ae0c57d4496009b6447fda79007e68ed`; it merged into the +non-main stack branch with merge commit +`202063bca2afa38d100199de3f0520fdd8c15e8c`, based on stack head `2e51a777`. +The commit checks visible at observation were still queued, so this records +the stack merge fact only and does not promote queued Checks to terminal pass +evidence or claim a protected-main merge. + +- Parent PR #392 remains open at + `a6d754a7f7a13c05b81b61e684246de295078463`, targets protected `main`, and is + blocked without a formal independent approval. +- Baseline PR #368 remains open at + `6e2e845ca3b14c0e4c943c59753b9378a1cb8c47`, targets `main`, and is blocked + while its hosted gates run. No protected-main merge is claimed. + ## 5. Local Buyer-Surface Verification Observed at `2026-08-21T13:06:25Z` in the authorized local stack using a From 6cfccfa37a8375c1d3f927db62d71f8a939dcb06 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 06:09:48 +0900 Subject: [PATCH 102/109] docs: record latest queue checkpoint --- docs/product-technical-gap-baseline.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index db091e120..fdf87132b 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -445,6 +445,18 @@ evidence or claim a protected-main merge. `6e2e845ca3b14c0e4c943c59753b9378a1cb8c47`, targets `main`, and is blocked while its hosted gates run. No protected-main merge is claimed. +### 4.10 Latest queue snapshot + +Observed at `2026-08-21T21:09:30Z`. The central queue advanced parent PR #392 +to exact head `5fc943477189640f42dfa8ad2d72678216bd1ea5`; it remains open, +`mergeable=true`, blocked, with all observed required checks pending and no +formal review decision. Documentation PR #368 is at exact head +`829b630a3608d0b800fabf9ea129d011091f7ca3`; it is likewise open, +`mergeable=true`, blocked, and pending its hosted checks without independent +approval. The stack branch still points to merged identity commit +`202063bca2afa38d100199de3f0520fdd8c15e8c`. No protected-main merge is +claimed. + ## 5. Local Buyer-Surface Verification Observed at `2026-08-21T13:06:25Z` in the authorized local stack using a From be661a246ac22016b8ce1b0e0446a620ae33e920 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 06:12:22 +0900 Subject: [PATCH 103/109] docs: align stack pointer --- docs/product-technical-gap-baseline.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index fdf87132b..e7aa3c049 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -454,8 +454,9 @@ formal review decision. Documentation PR #368 is at exact head `829b630a3608d0b800fabf9ea129d011091f7ca3`; it is likewise open, `mergeable=true`, blocked, and pending its hosted checks without independent approval. The stack branch still points to merged identity commit -`202063bca2afa38d100199de3f0520fdd8c15e8c`. No protected-main merge is -claimed. +`139ecaa17b411451c645f12a888f095df3beb3b2`, which retains the identity merge +`202063bca2afa38d100199de3f0520fdd8c15e8c` and the subsequent #399 rollback. +No protected-main merge is claimed. ## 5. Local Buyer-Surface Verification From ad491f16455342f9c4bc9da33b9f0a50d66c94f0 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 06:13:58 +0900 Subject: [PATCH 104/109] docs: remove source identifiers and refresh queue --- docs/product-technical-gap-baseline.md | 32 ++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index e7aa3c049..d9ba93df0 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -97,7 +97,7 @@ current merge claim. - **Security & Compliance**: PII masking cannot break the system. Need SOC 2 and CSAP compliance alternatives to blind PII masking. - **LLM Orchestration**: Ensure ALL LLM calls route through `contextual-orchestrator` utilizing API keys (BYTEZ, NVIDIA, OPENROUTER, OPENAI) with auto model discovery and optimal reasoning effort allocation (Fugu/Conductor/TRINITY research). -### 2.1 Requirement traceability matrix +### 3.1 Requirement traceability matrix The status vocabulary is evidence-bound: **verified** means the current source and a scoped test prove the contract; **partial** means local or synthetic @@ -110,7 +110,7 @@ An open PR never counts as a protected-main merge. | UI shell, responsive tiers, Figma and Storybook | React shell, token tests, viewport/browser checks, Storybook scenes, ADR 0118 Figma File ID `1Su3lDRmiZdcUs47t1QwIX` | **Partial** — approved CI/BI asset, legal usage permission, no-JavaScript fallback, and protected runtime parity remain unproven. | | Corporate-code/PU login, logout, ABAC/RBAC and visibility | OIDC browser run, account affiliations, permission checks, post visibility predicates and API tests | **Partial** — authorized production identity and complete role/policy matrix remain unverified. | | Event DAG, branching and channel evidence | `LineageDag`, keyboard selection, branch/root/current states, persisted channel evidence and synthetic tests | **Partial** — current protected-corpus rendering and lineage quality remain unproven; PR #387 is open. | -| TEPP import/REST boundary and PostgreSQL source | TEPP client contract, PostgreSQL migrations, import boundary and no-file-DB tests | **Partial** — the requested real `zcrht811_export_rows` analysis cannot be committed or claimed without protected authorized runtime evidence. | +| TEPP import/REST boundary and PostgreSQL source | TEPP client contract, PostgreSQL migrations, import boundary and no-file-DB tests | **Partial** — the requested authorized export-row analysis cannot be committed or claimed without protected authorized runtime evidence. | | Keyman, R&R, 5W1H, multi-project events and commitments | Orchestrator clients, persistence schemas, popup routes and synthetic/API coverage | **Partial** — affiliation, requester/assignee, counterparty-side identity, provenance and corpus completeness remain unverified. | | Ontology, semantic layer, KG depth and customer master | normalized entity/relation/provenance schema, ABAC filters and customer/ontology routes | **Partial** — Searxng corroboration, abbreviation resolution, multi-company/team identity and per-node depth need live evidence. | | HTML/CSS structure, Base64 image and multimodal analysis | semantic units, region persistence, OCR/caption rendering and bounded VISION boundary | **Partial** — image-heavy summaries still return processing/unavailable states; complete region/OCR/embedding quality is not proven. | @@ -458,6 +458,34 @@ approval. The stack branch still points to merged identity commit `202063bca2afa38d100199de3f0520fdd8c15e8c` and the subsequent #399 rollback. No protected-main merge is claimed. +### 4.11 Current exact-head refresh + +Observed at `2026-08-21T21:13:07Z` from the GitHub REST API. This subsection +supersedes the earlier queue snapshot without rewriting its historical +evidence: + +- PR #398 merged into the non-main stack at merge commit + `202063bca2afa38d100199de3f0520fdd8c15e8c`; PR #399 then merged the Global + Ask atomic-citation rollback at merge commit + `139ecaa17b411451c645f12a888f095df3beb3b2`. The stack branch now points to + `139ecaa17b411451c645f12a888f095df3beb3b2`; neither event is a protected + `main` merge. +- PR #392 is open against protected `main` at exact head + `5fc943477189640f42dfa8ad2d72678216bd1ea5`, and PR #368 is open against + protected `main` at exact head `be661a246ac22016b8ce1b0e0446a620ae33e920`. + Both remain blocked pending current hosted Checks and independent review + gates. +- PR #383 remains open at `4eaa07172fde827f4ad89580326a0d2db5ceb0e4` and PR + #394 at `2aee6ace0a9b293959bea609192a4e2ef4dc5924`; their `osv-scan` failures + are the shared central result-path defect already tracked by + ContextualWisdomLab/.github PR #1158, not a vulnerability verdict. The + central repair is open at exact head + `4748ced3e09c8c684d34b1b6f763c450f6d4e218`, with hosted checks still + recalculating and no independent approval recorded. +- No protected-main merge is claimed. The next customer action is to obtain + the independent current-head review, finish the required Checks, then let + the protected merge queue promote #392 and #368 in dependency order. + ## 5. Local Buyer-Surface Verification Observed at `2026-08-21T13:06:25Z` in the authorized local stack using a From c77ef760d56ad97d4b78ae7a57ea1847739f3dfe Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 06:15:32 +0900 Subject: [PATCH 105/109] docs: close baseline review gaps --- docs/product-technical-gap-baseline.md | 32 ++++++++++++++++---------- 1 file changed, 20 insertions(+), 12 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index d9ba93df0..6893a27c0 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -34,7 +34,8 @@ header and footer rendered one configured `brandName` and the footer used the browser's current year. This observation remains historical and is not a claim about the current stacked head. -- **Current exact-source mitigation at the merged stack change `2e51a777`:** +- **Current exact-source mitigation at the merged stack change + `2e51a777277f3978d6afc5be8e1e76c71e0eb8e6`:** `tenant_settings` now persists separate `brandName`, `systemName`, `copyrightYear`, and `copyrightHolder` values. The header renders brand and system name separately, the footer uses the persisted year and rights @@ -45,7 +46,8 @@ translation key, with the same operation note covered across all five product locales. PR #397 merged into the non-main stack branch; the protected `main` branch still depends on the separate parent PR #392. -- **Current follow-up merged into the non-main stack at `202063bc`:** the +- **Current follow-up merged into the non-main stack at + `202063bca2afa38d100199de3f0520fdd8c15e8c`:** the settings upsert refreshes `tenant_settings.updated_at`, clearing the numeric copyright year stays visibly blank through an explicit invalid sentinel, and whitespace-only identity edits remain disabled no-ops. The merged review @@ -392,11 +394,12 @@ Observed at `2026-08-21T20:50:15Z` from the GitHub REST API and the current follow-up worktree. This supersedes the earlier checkpoint wording above; the earlier sections remain historical evidence. -- PR #397 merged into the non-main stack branch at head `77e2edee`; the stack - now contains the resulting commit `2e51a777`. This is not a protected-main +- PR #397 merged into the non-main stack branch at head + `77e2edee43de39c758718d0d13ec88c51a8393ea`; the stack now contains the + resulting commit `2e51a777277f3978d6afc5be8e1e76c71e0eb8e6`. This is not a protected-main merge. - PR #398 is open at exact head `5822948fe915542f1f916618d8905c3b4715d676`, - based on stack head `2e51a777`, with `mergeable=true` and + based on stack head `2e51a777277f3978d6afc5be8e1e76c71e0eb8e6`, with `mergeable=true` and `mergeable_state=unstable`. Devin Review and the frontend/full-test Checks are pending, and no independent approval is recorded. It is not authorized to merge. @@ -418,7 +421,8 @@ earlier sections remain historical evidence. Observed at `2026-08-21T20:57:23Z` from the GitHub REST API and the current follow-up worktree. PR #398 is now at exact head -`f101ab938f844ea12fa78b1cdf4ea1adaf07e962`, based on stack head `2e51a777`. +`f101ab938f844ea12fa78b1cdf4ea1adaf07e962`, based on stack head +`2e51a777277f3978d6afc5be8e1e76c71e0eb8e6`. The follow-up includes the review repair that separates an empty numeric input from the `0` value and retains the whitespace-only no-op save guard. Its frontend suite is `208 passed` with lint and production build passing; the @@ -433,7 +437,8 @@ respective merge gates recalculate. Observed at `2026-08-21T21:07:49Z` from the GitHub REST API. PR #398's final head was `19c68217ae0c57d4496009b6447fda79007e68ed`; it merged into the non-main stack branch with merge commit -`202063bca2afa38d100199de3f0520fdd8c15e8c`, based on stack head `2e51a777`. +`202063bca2afa38d100199de3f0520fdd8c15e8c`, based on stack head +`2e51a777277f3978d6afc5be8e1e76c71e0eb8e6`. The commit checks visible at observation were still queued, so this records the stack merge fact only and does not promote queued Checks to terminal pass evidence or claim a protected-main merge. @@ -488,6 +493,9 @@ evidence: ## 5. Local Buyer-Surface Verification +Entries are grouped by validation batch rather than sorted chronologically; +their UTC timestamps define the observation sequence. + Observed at `2026-08-21T13:06:25Z` in the authorized local stack using a synthetic browser account and aggregate-only evidence: @@ -825,13 +833,13 @@ Observed at `2026-08-21T19:36:33Z` from the current hosted Checks: ## 7. Next Implementation Order -1. Revalidate open PRs #258, #349, #355, #368, #373, #383, #387, #392, #393, - and #394 at +1. Revalidate protected-main-targeting open PRs #258, #349, #355, #368, #373, + #383, #387, #392, #393, and #394 at their exact current heads as Checks and formal independent approvals arrive; the #388/#389/#390 stack merges are already recorded above, so process the - open #387 parent only after its current-head gates pass. PR #392 is a - separate main-targeting product follow-up and remains subject to the same - gates. + open #387 parent only after its current-head gates pass. PR #398 is excluded + because it stack-merged and is represented by parent PR #392's current + main-targeting head, which remains subject to the same gates. Verify the synthetic footnote/table cases in the authenticated browser and use the protected external corpus only for aggregate, non-identifying runtime evidence. From cfa7c6bc0876be8a19ca7432016056c58b1902c0 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 06:23:29 +0900 Subject: [PATCH 106/109] docs: refresh stack pointer after ADR merge --- docs/product-technical-gap-baseline.md | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 6893a27c0..87c7b989a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -458,26 +458,28 @@ to exact head `5fc943477189640f42dfa8ad2d72678216bd1ea5`; it remains open, formal review decision. Documentation PR #368 is at exact head `829b630a3608d0b800fabf9ea129d011091f7ca3`; it is likewise open, `mergeable=true`, blocked, and pending its hosted checks without independent -approval. The stack branch still points to merged identity commit -`139ecaa17b411451c645f12a888f095df3beb3b2`, which retains the identity merge -`202063bca2afa38d100199de3f0520fdd8c15e8c` and the subsequent #399 rollback. +approval. The stack branch now points to +`806da65af40f27b24d2c8b77e1f7dd0b8558e67f`, which retains the identity merge +`202063bca2afa38d100199de3f0520fdd8c15e8c`, the #399 rollback, and the #400 +ADR reference. No protected-main merge is claimed. ### 4.11 Current exact-head refresh -Observed at `2026-08-21T21:13:07Z` from the GitHub REST API. This subsection +Observed at `2026-08-21T21:23:18Z` from the GitHub REST API. This subsection supersedes the earlier queue snapshot without rewriting its historical evidence: - PR #398 merged into the non-main stack at merge commit `202063bca2afa38d100199de3f0520fdd8c15e8c`; PR #399 then merged the Global Ask atomic-citation rollback at merge commit - `139ecaa17b411451c645f12a888f095df3beb3b2`. The stack branch now points to - `139ecaa17b411451c645f12a888f095df3beb3b2`; neither event is a protected - `main` merge. + `139ecaa17b411451c645f12a888f095df3beb3b2`. Documentation PR #400 then + added the APA 7th PostgreSQL locking reference at stack commit + `806da65af40f27b24d2c8b77e1f7dd0b8558e67f`. None of these events is a + protected `main` merge. - PR #392 is open against protected `main` at exact head `5fc943477189640f42dfa8ad2d72678216bd1ea5`, and PR #368 is open against - protected `main` at exact head `be661a246ac22016b8ce1b0e0446a620ae33e920`. + protected `main` at exact head `c77ef760d56ad97d4b78ae7a57ea1847739f3dfe`. Both remain blocked pending current hosted Checks and independent review gates. - PR #383 remains open at `4eaa07172fde827f4ad89580326a0d2db5ceb0e4` and PR From e6cacf323962ede129b53d8ed7962d0882f201d8 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 06:39:48 +0900 Subject: [PATCH 107/109] fix: restore safe OIDC login boundary --- CHANGELOG.md | 2 ++ frontend/src/App.tsx | 6 +++--- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c8ed1a099..ea5383ffd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,8 @@ All notable changes to this project are documented here. Format follows ### Fixed +- The unauthenticated shell now preserves a safe OIDC return URL and no longer + renders the authenticated tenant-admin panel without an access token. - `make smoke` and `make seed` now run through the locked project `uv` environment, so local OIDC and synthetic-data workflows resolve the same pinned dependencies as CI. diff --git a/frontend/src/App.tsx b/frontend/src/App.tsx index 6fba0dd41..0d0fdb93e 100644 --- a/frontend/src/App.tsx +++ b/frontend/src/App.tsx @@ -4610,7 +4610,8 @@ export default function App({ showLabPanels = false }: { showLabPanels?: boolean
    - {destination === "admin" ? : null} - +