From 5c2c8975d75a890d6f84e0e0d424ca7fee9bebb5 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 20 Aug 2026 20:11:57 +0900 Subject: [PATCH 01/26] docs: record product and technical gap baseline --- ARCHITECTURE.md | 1 + CHANGELOG.md | 1 + docs/README.md | 1 + docs/product-technical-gap-baseline.md | 79 ++++++++++++++++++++ tests/test_product_documentation_contract.py | 20 +++++ 5 files changed, 102 insertions(+) create mode 100644 docs/product-technical-gap-baseline.md diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 9b23ef9f0..fe287389b 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -12,6 +12,7 @@ This file is the canonical product-wide topology and bounded-context view. It is - [Requirement, decision, standards, and implementation traceability](docs/traceability/README.md) - [Research and standards doctoring](docs/doctoring.md) - [Product roadmap](docs/product-roadmap.md) +- [Live product and technical gap baseline](docs/product-technical-gap-baseline.md) Protected-main code and executable tests define current implementation truth; deployed build/release artifacts, migrations, and configuration are additional operational evidence when they exist. Accepted ADRs define design authority, not proof that planned behavior has shipped. The PRD/TRD/diagrams may also contain `Planned`, `Proposed`, or `Open` product direction; those labels must remain explicit until corresponding implementation and review evidence reaches protected `main`. diff --git a/CHANGELOG.md b/CHANGELOG.md index d17419927..18de61797 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -33,6 +33,7 @@ All notable changes to OriginWeave are documented in this file. The format follo ### Changed +- Added a dated product and technical gap baseline that separates protected-main implementation truth, active pull-request evidence, live review/check blockers, and the next buyer-visible Phase 1 acceptance work. - Separated logical origin authority from resolved network destination authority; an origin grant no longer implies permission to connect to every resolver result. - Separated resolved-address authorization from direct transport evidence; an approved IP now becomes a usable stream only after the operating system reports the exact requested IP and port. - Separated exact TCP peer proof from authenticated TLS service identity; an observed peer becomes an authenticated HTTPS stream only after explicit-root, fixed-time, SAN-bound WebPKI verification over that same stream. diff --git a/docs/README.md b/docs/README.md index 03b573c54..775dd0de6 100644 --- a/docs/README.md +++ b/docs/README.md @@ -22,6 +22,7 @@ - [OriginWeave API and protocol contract](API_CONTRACT.md) - [Release and rollback contract](RELEASE_AND_ROLLBACK.md) - [Product roadmap](product-roadmap.md) +- [Product and technical gap baseline](product-technical-gap-baseline.md) - [Research and standards](doctoring.md) - [Browser and Agent protocol standards evidence](doctoring/browser-agent-protocols.md) - [Current product-baseline standards addendum](doctoring/product-documentation-baseline.md) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md new file mode 100644 index 000000000..9f40cb459 --- /dev/null +++ b/docs/product-technical-gap-baseline.md @@ -0,0 +1,79 @@ +# Product and Technical Gap Baseline + +This is a dated delivery baseline, not a substitute for the PRD, TRD, roadmap, or architecture decisions. It keeps buyer-visible gaps and volatile repository evidence in one discoverable place. Protected `main` is the implementation boundary: code in an open pull request is not shipped behavior. + +## Observed snapshot: 2026-08-20 + +### Protected-main truth + +- Protected `main` and `origin/main` were both at `0841d2ab3d8b5e60a03c0a8e818cf438e2716829` when this snapshot was prepared. +- Phase 0 is documented as complete as a reusable safety-kernel foundation: typed policy contracts, destination classification, direct TCP peer verification, TLS service identity, evidence bounds, resource mitigation, document-node authority, and their protected-main tests. +- Phase 1 is **in progress**, not shipped. The first real Chromium vertical slice still needs an ephemeral Chromium context, a versioned WebDriver BiDi/browser adapter, semantic observation and typed actions, post-condition evidence, crash recovery, and proof that Chromium consumed the governed resolution, route, TCP, TLS, and HTTP boundaries. +- HTTP/1.1 bounds, download/MIME limits, proxy/PAC execution, full browser-network integration, the sensitive-data broker runtime, durable WARC/PROV capture, and the complete Manifest V3 compatibility program remain planned or open as recorded in the PRD, TRD, and roadmap. + +### Open pull requests + +The live repository contained **100 open pull requests: 21 non-draft and 79 draft**. The non-draft set was: + +| Pull request | Base | Delivery state at snapshot | +|---|---|---| +| #194, #175, #173, #168, #166, #164, #163, #161, #160, #159, #158, #157, #156, #152, #124 | `main` | Ready/non-draft inventory; current review and check state must be re-fetched before merge | +| #149 | `main` | WireGuard/IKEv2 profile authority; exact head `b2be2e7`, Rust contracts and Production coverage successful, remaining required workflows were queued | +| #153, #151, #150, #148, #147 | stacked | Non-draft teardown/crash-recovery work; base-branch ordering applies | + +Draft PR #195 is the current WebDriver BiDi opening-write repair. Its exact head is `29a310c`; Rust contracts are successful and Production coverage was in progress after a coverage-branch repair. It remains draft evidence and cannot be treated as shipped behavior. + +The snapshot also retained an older open failure on #90 (`8721787d`): Rust contracts were successful but Production coverage was failing. That PR is not a protected-main implementation claim. The current exact head and check runs must be re-fetched before any action. + +The 79 draft PRs are intentionally excluded from the merge queue. Several open PRs are stacked, so a green check on a child branch cannot be treated as evidence that its change is mergeable onto protected `main`. + +### Review and merge authority + +The active `CWL Central required workflows` ruleset requires one approving review, approval after the last push, resolved review threads, and the configured required workflows. The live collaborator list contained only `seonghobae` with repository administration and push permissions. This is a **reviewer-provisioning gap**: no eligible independent collaborator was available for a counted non-author approval at snapshot time. + +This gap does not authorize self-approval, administrative bypass, stale-head merge, or weakening checks. Exact current-head checks, security gates, documentation, coverage, rustdoc/Clippy, thread resolution, and branch protection remain mandatory. The solo-maintainer governance condition may place an otherwise impossible independent-review rule on hold only through the documented governance path; it does not turn an unverified PR into shipped behavior. + +### Open issues and operational signals + +| Issue | Current gap or signal | +|---|---| +| #28 | First real Chromium agent vertical slice; highest buyer-visible Phase 1 gap | +| #27 | Complete Manifest V3 compatibility and extension-authority isolation matrix | +| #9 | Bounded HTTP/1.1 semantics over the authenticated TLS stream | +| #10 | Purpose-bound operational PII disclosure and trusted broker/storage lifecycle | +| #123 | Fleet incident: disable orphaned TLS, HTTP, and one-shot workflow identities | +| #187 | Manual-authority review of the coverage-diagnostics workflow delta | + +The hourly product-development loop exists as a bounded, review-separated workflow. Its existence is operational infrastructure, not evidence that the browser product or an hourly run has completed the Phase 1 buyer acceptance. + +## Buyer-visible and technical gap matrix + +| Priority | Buyer-visible outcome | Protected-main status | Next acceptance evidence | +|---|---|---|---| +| P0 | A bounded task can observe a real Chromium page, perform a typed action, verify the post-condition, and emit provenance | **Open / Phase 1**; issue #28 | Repeated real Chromium E2E with ephemeral context, BiDi/session translation, observation, typed action, post-condition, evidence, crash cleanup, and exact current protected checks | +| P1 | Navigation uses the approved destination, route, TCP peer, TLS identity, and bounded HTTP/download policy | **Partial foundation**; HTTP and browser consumption remain planned | Real browser-network adapter proves the governed path is consumed end to end, including redirects, bounds, MIME, and failure evidence | +| P1 | Existing Chromium extensions remain compatible while Agent authority stays separate | **Partial evidence / planned completion**; issue #27 | Pinned-Chromium install/update/service-worker/content/storage/DNR/download/native-messaging/enterprise-isolation matrix with repeatability | +| P1 | Enterprise operators can disclose only necessary sensitive fields through a trusted, auditable path | **Policy foundation implemented; runtime open**; issue #10 | Opaque-handle broker, purpose/field/region policy, atomic reservation/revocation, retention/deletion, audit, and redaction tests | +| P2 | A buyer can receive durable replayable capture and provenance | **Foundations only** | Bounded WARC/PROV persistence, retention, integrity, replay, and benchmark evidence | +| P0 | Changes can pass protected review and merge without authority improvisation | **Blocked by reviewer-provisioning gap** | Provision an eligible independent collaborator or record an explicit current governance decision; then re-fetch exact head, reviews, checks, and merge state | + +## Next executable queue + +1. Re-fetch every active PR's exact head, reviews, threads, required checks, and base before selecting a merge candidate; repair a current failure only after reproducing its root cause. +2. Advance issue #28 with the smallest failing real-browser acceptance test, beginning at ephemeral Chromium launch/session teardown and the BiDi adapter boundary. +3. Keep HTTP/1.1 and browser-network integration separate from the already-proven destination, direct TCP, and TLS kernels; do not claim safe navigation until Chromium consumption is observed. +4. Maintain the #27 extension matrix and #10 broker/runtime boundaries as independent acceptance tracks. +5. Resolve the reviewer-provisioning gap through legitimate repository governance before a non-author approval is required; never manufacture approval or bypass protection. + +## Evidence commands + +The volatile values above were obtained from the repository and GitHub APIs, without exposing credentials: + +```text +gh api repos/ContextualWisdomLab/OriginWeave/pulls?state=open&per_page=100 +gh api repos/ContextualWisdomLab/OriginWeave/commits//check-runs?per_page=100 +gh api repos/ContextualWisdomLab/OriginWeave/rulesets/18156473 +gh api repos/ContextualWisdomLab/OriginWeave/collaborators?affiliation=all&per_page=100 +``` + +For standards and binding architecture, use [`doctoring.md`](doctoring.md), [`PRD.md`](PRD.md), [`TRD.md`](TRD.md), [`product-roadmap.md`](product-roadmap.md), and the linked ADR/UML/ERD/traceability graph. This baseline intentionally records delivery state and does not promote planned adapters or open pull-request code to implemented behavior. diff --git a/tests/test_product_documentation_contract.py b/tests/test_product_documentation_contract.py index 1313189ea..fc6dd4f2d 100644 --- a/tests/test_product_documentation_contract.py +++ b/tests/test_product_documentation_contract.py @@ -25,10 +25,29 @@ def test_authoritative_product_documentation_graph_exists(self) -> None: "docs/OPERABILITY.md", "docs/API_CONTRACT.md", "docs/RELEASE_AND_ROLLBACK.md", + "docs/product-technical-gap-baseline.md", } missing = sorted(path for path in required_paths if not (ROOT / path).is_file()) self.assertEqual(missing, []) + def test_product_technical_gap_baseline_records_live_delivery_state(self) -> None: + """Buyers and maintainers must see implementation gaps and current delivery blockers together.""" + baseline = ROOT / "docs/product-technical-gap-baseline.md" + self.assertTrue(baseline.is_file()) + text = baseline.read_text(encoding="utf-8") + for phrase in ( + "Observed snapshot: 2026-08-20", + "Protected-main truth", + "Open pull requests", + "Open issues", + "#195", + "#149", + "reviewer-provisioning gap", + "Phase 1", + ): + with self.subTest(phrase=phrase): + self.assertIn(phrase, text) + def test_root_architecture_links_the_authoritative_product_graph(self) -> None: """Architecture readers must be able to reach requirements, decisions, diagrams, and data.""" architecture = (ROOT / "ARCHITECTURE.md").read_text(encoding="utf-8") @@ -39,6 +58,7 @@ def test_root_architecture_links_the_authoritative_product_graph(self) -> None: "docs/uml/README.md", "docs/erd/README.md", "docs/traceability/README.md", + "docs/product-technical-gap-baseline.md", ): with self.subTest(link=link): self.assertIn(link, architecture) From de9afd397f786201d54dea9ecae5541083bd5e7b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 20 Aug 2026 20:19:37 +0900 Subject: [PATCH 02/26] docs: refresh live pull request inventory --- docs/product-technical-gap-baseline.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 9f40cb459..1951ae667 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -13,15 +13,16 @@ This is a dated delivery baseline, not a substitute for the PRD, TRD, roadmap, o ### Open pull requests -The live repository contained **100 open pull requests: 21 non-draft and 79 draft**. The non-draft set was: +The live repository contained **100 open pull requests: 22 non-draft and 78 draft**. The non-draft set was: | Pull request | Base | Delivery state at snapshot | |---|---|---| | #194, #175, #173, #168, #166, #164, #163, #161, #160, #159, #158, #157, #156, #152, #124 | `main` | Ready/non-draft inventory; current review and check state must be re-fetched before merge | | #149 | `main` | WireGuard/IKEv2 profile authority; exact head `b2be2e7`, Rust contracts and Production coverage successful, remaining required workflows were queued | +| #196 | `main` | This product/technical gap baseline; checks were queued after publication and merge remains review-gated | | #153, #151, #150, #148, #147 | stacked | Non-draft teardown/crash-recovery work; base-branch ordering applies | -Draft PR #195 is the current WebDriver BiDi opening-write repair. Its exact head is `29a310c`; Rust contracts are successful and Production coverage was in progress after a coverage-branch repair. It remains draft evidence and cannot be treated as shipped behavior. +Draft PR #195 is the current WebDriver BiDi opening-write repair. Its exact head is `4ff33b5`; Rust contracts and Production coverage were re-running after the test-only coverage repair. It remains draft evidence and cannot be treated as shipped behavior. The snapshot also retained an older open failure on #90 (`8721787d`): Rust contracts were successful but Production coverage was failing. That PR is not a protected-main implementation claim. The current exact head and check runs must be re-fetched before any action. From 1a613f2d7fd8b29d265821e69cb0f9d9fc5b71d4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 20 Aug 2026 20:21:19 +0900 Subject: [PATCH 03/26] docs: address baseline review findings --- CHANGELOG.md | 2 +- docs/product-technical-gap-baseline.md | 8 ++++---- tests/test_product_documentation_contract.py | 10 ++++++++++ 3 files changed, 15 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 18de61797..2e950d19b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,7 @@ All notable changes to OriginWeave are documented in this file. The format follo ### Added +- Added a dated product and technical gap baseline that separates protected-main implementation truth, active pull-request evidence, live review/check blockers, and the next buyer-visible Phase 1 acceptance work. - Bound explicit extension-to-Agent grants to exclusive trusted-time expiry in addition to extension identity, session, browsing context, and canonical origin, so a same-origin grant cannot be reused at or after the deadline. - Bound explicit extension-to-Agent grants to the exact canonical origin in addition to extension identity, session, and browsing context, so a same-session navigation or port change cannot reuse the grant. - Rust workspace for independently reusable core, policy, destination, network, TLS, resource, and evidence modules. @@ -33,7 +34,6 @@ All notable changes to OriginWeave are documented in this file. The format follo ### Changed -- Added a dated product and technical gap baseline that separates protected-main implementation truth, active pull-request evidence, live review/check blockers, and the next buyer-visible Phase 1 acceptance work. - Separated logical origin authority from resolved network destination authority; an origin grant no longer implies permission to connect to every resolver result. - Separated resolved-address authorization from direct transport evidence; an approved IP now becomes a usable stream only after the operating system reports the exact requested IP and port. - Separated exact TCP peer proof from authenticated TLS service identity; an observed peer becomes an authenticated HTTPS stream only after explicit-root, fixed-time, SAN-bound WebPKI verification over that same stream. diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 1951ae667..02bef5205 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -71,10 +71,10 @@ The hourly product-development loop exists as a bounded, review-separated workfl The volatile values above were obtained from the repository and GitHub APIs, without exposing credentials: ```text -gh api repos/ContextualWisdomLab/OriginWeave/pulls?state=open&per_page=100 -gh api repos/ContextualWisdomLab/OriginWeave/commits//check-runs?per_page=100 -gh api repos/ContextualWisdomLab/OriginWeave/rulesets/18156473 -gh api repos/ContextualWisdomLab/OriginWeave/collaborators?affiliation=all&per_page=100 +gh api 'repos/ContextualWisdomLab/OriginWeave/pulls?state=open&per_page=100' +gh api 'repos/ContextualWisdomLab/OriginWeave/commits/0841d2ab3d8b5e60a03c0a8e818cf438e2716829/check-runs?per_page=100' +gh api 'repos/ContextualWisdomLab/OriginWeave/rulesets/18156473' +gh api 'repos/ContextualWisdomLab/OriginWeave/collaborators?affiliation=all&per_page=100' ``` For standards and binding architecture, use [`doctoring.md`](doctoring.md), [`PRD.md`](PRD.md), [`TRD.md`](TRD.md), [`product-roadmap.md`](product-roadmap.md), and the linked ADR/UML/ERD/traceability graph. This baseline intentionally records delivery state and does not promote planned adapters or open pull-request code to implemented behavior. diff --git a/tests/test_product_documentation_contract.py b/tests/test_product_documentation_contract.py index fc6dd4f2d..cb4f5a574 100644 --- a/tests/test_product_documentation_contract.py +++ b/tests/test_product_documentation_contract.py @@ -48,6 +48,16 @@ def test_product_technical_gap_baseline_records_live_delivery_state(self) -> Non with self.subTest(phrase=phrase): self.assertIn(phrase, text) + protected_main = text.split("### Open pull requests", 1)[0] + open_pull_requests = text.split("### Open pull requests", 1)[1].split( + "### Review and merge authority", 1 + )[0] + self.assertIn("Phase 1 is **in progress**, not shipped.", protected_main) + self.assertIn( + "It remains draft evidence and cannot be treated as shipped behavior.", + open_pull_requests, + ) + def test_root_architecture_links_the_authoritative_product_graph(self) -> None: """Architecture readers must be able to reach requirements, decisions, diagrams, and data.""" architecture = (ROOT / "ARCHITECTURE.md").read_text(encoding="utf-8") From d9ba1fa2315b76c83daca956c370ceb4dc2e21ec Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 20 Aug 2026 06:14:30 -0700 Subject: [PATCH 04/26] test(docs): require commercial completion tracks --- tests/test_product_completion_gap_contract.py | 49 +++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 tests/test_product_completion_gap_contract.py diff --git a/tests/test_product_completion_gap_contract.py b/tests/test_product_completion_gap_contract.py new file mode 100644 index 000000000..a3dc6e2ff --- /dev/null +++ b/tests/test_product_completion_gap_contract.py @@ -0,0 +1,49 @@ +"""Regression contract for the dated commercial-completion gap baseline.""" + +from __future__ import annotations + +import pathlib +import unittest + +ROOT = pathlib.Path(__file__).resolve().parents[1] +BASELINE = ROOT / "docs/product-technical-gap-baseline.md" + + +class ProductCompletionGapContractTests(unittest.TestCase): + """Keep the exact repository snapshot and completion tracks reviewable.""" + + def test_baseline_records_current_inventory_and_completion_issues(self) -> None: + """The dated baseline must not retain superseded queue counts or omit buyer tracks.""" + text = BASELINE.read_text(encoding="utf-8") + + for phrase in ( + "145 open pull requests", + "38 non-draft", + "107 draft", + "#198", + "#199", + "#200", + "#201", + "#202", + "#203", + "durable WARC/PROV replay", + "stable BAP/MCP runtime API", + "signed cross-platform Chromium distribution", + "enterprise control and experience plane", + "commercial acceptance gate", + ): + with self.subTest(phrase=phrase): + self.assertIn(phrase, text) + + for stale_phrase in ( + "100 open pull requests", + "22 non-draft", + "78 draft", + "79 draft PRs", + ): + with self.subTest(stale_phrase=stale_phrase): + self.assertNotIn(stale_phrase, text) + + +if __name__ == "__main__": + unittest.main() From a44e28f226cff0a750c25960eca697cb9ce85086 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 20 Aug 2026 06:21:16 -0700 Subject: [PATCH 05/26] docs: map commercial completion gaps --- docs/product-technical-gap-baseline.md | 108 ++++++++++++++++--------- 1 file changed, 72 insertions(+), 36 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 02bef5205..b63c28e09 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,80 +1,116 @@ # Product and Technical Gap Baseline -This is a dated delivery baseline, not a substitute for the PRD, TRD, roadmap, or architecture decisions. It keeps buyer-visible gaps and volatile repository evidence in one discoverable place. Protected `main` is the implementation boundary: code in an open pull request is not shipped behavior. +This is a dated delivery baseline, not a substitute for the PRD, TRD, roadmap, architecture decisions, or live GitHub state. It keeps buyer-visible gaps, current issues, active pull-request evidence, and commercial completion tracks in one discoverable place. Protected `main` is the implementation boundary: code in an open pull request is not shipped behavior. ## Observed snapshot: 2026-08-20 ### Protected-main truth -- Protected `main` and `origin/main` were both at `0841d2ab3d8b5e60a03c0a8e818cf438e2716829` when this snapshot was prepared. -- Phase 0 is documented as complete as a reusable safety-kernel foundation: typed policy contracts, destination classification, direct TCP peer verification, TLS service identity, evidence bounds, resource mitigation, document-node authority, and their protected-main tests. -- Phase 1 is **in progress**, not shipped. The first real Chromium vertical slice still needs an ephemeral Chromium context, a versioned WebDriver BiDi/browser adapter, semantic observation and typed actions, post-condition evidence, crash recovery, and proof that Chromium consumed the governed resolution, route, TCP, TLS, and HTTP boundaries. -- HTTP/1.1 bounds, download/MIME limits, proxy/PAC execution, full browser-network integration, the sensitive-data broker runtime, durable WARC/PROV capture, and the complete Manifest V3 compatibility program remain planned or open as recorded in the PRD, TRD, and roadmap. +- Protected `main` was at `0841d2ab3d8b5e60a03c0a8e818cf438e2716829` when this snapshot was refreshed. +- Phase 0 is documented as complete as a reusable safety-kernel foundation: typed policy contracts, destination classification, direct TCP peer verification, TLS service identity, evidence bounds, resource mitigation, document-node authority, and protected-main tests. +- Phase 1 is **in progress**, not shipped. The first real Chromium vertical slice still needs the active WebDriver BiDi transport stack to reach protected `main`, then compose isolated Chromium launch, session/context identity, semantic observation, typed action authorization, native browser input, post-condition proof, evidence, cancellation, crash recovery, and profile/process teardown. +- HTTP/1.1 bounds, downloads/MIME, proxy/PAC consumption, full browser-network integration, the sensitive-data broker runtime, durable WARC/PROV capture, persistent task/API surfaces, signed cross-platform distribution, enterprise administration, and release-grade buyer acceptance remain open. +- Active pull requests remain evidence, not shipped behavior. Successful checks on a feature or stacked branch do not prove that protected `main` contains the capability or that a child can merge before its prerequisite. ### Open pull requests -The live repository contained **100 open pull requests: 22 non-draft and 78 draft**. The non-draft set was: +The live repository contained **145 open pull requests: 38 non-draft and 107 draft**. The volume and stack depth are themselves a product-delivery risk: review, exact-head checks, dependency order, and integration truth can drift faster than a buyer-visible vertical slice reaches protected `main`. -| Pull request | Base | Delivery state at snapshot | -|---|---|---| -| #194, #175, #173, #168, #166, #164, #163, #161, #160, #159, #158, #157, #156, #152, #124 | `main` | Ready/non-draft inventory; current review and check state must be re-fetched before merge | -| #149 | `main` | WireGuard/IKEv2 profile authority; exact head `b2be2e7`, Rust contracts and Production coverage successful, remaining required workflows were queued | -| #196 | `main` | This product/technical gap baseline; checks were queued after publication and merge remains review-gated | -| #153, #151, #150, #148, #147 | stacked | Non-draft teardown/crash-recovery work; base-branch ordering applies | +Representative active workstreams at this snapshot were: -Draft PR #195 is the current WebDriver BiDi opening-write repair. Its exact head is `4ff33b5`; Rust contracts and Production coverage were re-running after the test-only coverage repair. It remains draft evidence and cannot be treated as shipped behavior. +| Workstream | Representative active PR evidence | Delivery boundary | +|---|---|---| +| Product baseline | #196 | Ready/non-draft documentation PR; this refreshed inventory and the completion issues below remain review-gated | +| WebDriver BiDi transport | #188 through #198 | #198, exact head `924f260cac885a8c66c81de1101c1ba183d00e74`, validates the RFC 6455 opening response on top of #195; the stack still does not by itself complete framed BiDi browser commands, authenticated browser-process provenance, semantic task execution, or protected-main shipment | +| MCP adapter | #168 and #170 | Typed MCP routing and conservative `tools/list` metadata are active-PR foundations; complete authenticated transport, durable task lifecycle, cancellation/resume, and browser execution remain open under #200 | +| Controlled Chromium and recovery | #65, #70-#73, #100, #105, #142-#153 and descendants | Real pinned-browser fixture, semantic location, resource, crash, and teardown evidence exists on active stacks; evidence does not transfer across heads or prerequisites | +| Manifest V3 and native messaging | #27 and its active extension/native-host stack, including #154 and #169 | Compatibility and Agent-authority isolation remain incomplete until exact release artifacts and platform matrices are proven | +| Sensitive-data and model route policy | #10 and its active policy stacks | Deterministic policy values exist, but trusted broker execution, retention/deletion, runtime isolation, and auditable product workflows remain open | +| VPN/profile intent | #149 | Bounded WireGuard/IKEv2 profile authority is active-PR evidence; it does not create a tunnel, route, DNS state, authenticated gateway, or connectivity proof | -The snapshot also retained an older open failure on #90 (`8721787d`): Rust contracts were successful but Production coverage was failing. That PR is not a protected-main implementation claim. The current exact head and check runs must be re-fetched before any action. +Draft PR #198 is the current top WebDriver BiDi opening-response slice; its prerequisite #195 owns the bounded opening-request write. It remains draft evidence and cannot be treated as shipped behavior. -The 79 draft PRs are intentionally excluded from the merge queue. Several open PRs are stacked, so a green check on a child branch cannot be treated as evidence that its change is mergeable onto protected `main`. +The current queue must be processed in dependency order. A green child branch cannot substitute for current checks and review on its prerequisite, synthetic merge, or eventual protected-main commit. PRs that only duplicate, supersede, or preserve stale branch topology should be closed with explicit replacement evidence rather than retained indefinitely. ### Review and merge authority -The active `CWL Central required workflows` ruleset requires one approving review, approval after the last push, resolved review threads, and the configured required workflows. The live collaborator list contained only `seonghobae` with repository administration and push permissions. This is a **reviewer-provisioning gap**: no eligible independent collaborator was available for a counted non-author approval at snapshot time. +The active `CWL Central required workflows` ruleset requires one approving review, approval after the last push, resolved review threads, and configured required workflows. The previously observed collaborator inventory contained only `seonghobae` with administration and push permissions, creating a **reviewer-provisioning gap** for counted non-author approval. -This gap does not authorize self-approval, administrative bypass, stale-head merge, or weakening checks. Exact current-head checks, security gates, documentation, coverage, rustdoc/Clippy, thread resolution, and branch protection remain mandatory. The solo-maintainer governance condition may place an otherwise impossible independent-review rule on hold only through the documented governance path; it does not turn an unverified PR into shipped behavior. +This gap does not authorize self-approval, administrative bypass, stale-head merge, or weaker checks. Exact current-head checks, security gates, complete coverage, rustdoc/Clippy, thread resolution, and branch protection remain mandatory. Before any merge decision, re-fetch the exact ruleset, collaborators, PR head/base, reviews, unresolved threads, and required checks; do not assume this dated observation remains current. ### Open issues and operational signals | Issue | Current gap or signal | |---|---| -| #28 | First real Chromium agent vertical slice; highest buyer-visible Phase 1 gap | +| #28 | First real Chromium Agent Task vertical slice; highest immediate Phase 1 buyer-visible gap | | #27 | Complete Manifest V3 compatibility and extension-authority isolation matrix | | #9 | Bounded HTTP/1.1 semantics over the authenticated TLS stream | | #10 | Purpose-bound operational PII disclosure and trusted broker/storage lifecycle | | #123 | Fleet incident: disable orphaned TLS, HTTP, and one-shot workflow identities | | #187 | Manual-authority review of the coverage-diagnostics workflow delta | +| #199 | Schema-bound extraction with durable WARC/PROV replay, retention, deletion, and offline verification | +| #200 | Stable BAP/MCP runtime API with authenticated, idempotent, cancellable, resumable task lifecycle | +| #201 | Signed cross-platform Chromium distribution, installer/updater, patch SLA, rollback, SBOM, and provenance | +| #202 | Enterprise control and experience plane: operator UI, Keyverse-compatible identity, tenancy, approval, audit, SLO, Figma, and Storybook | +| #203 | Release-grade web-agent benchmark and commercial acceptance gate bound to exact signed artifacts | + +The five newly separated product-completion tracks are **durable WARC/PROV replay**, **stable BAP/MCP runtime API**, **signed cross-platform Chromium distribution**, **enterprise control and experience plane**, and the **commercial acceptance gate**. They are separate issues because each has a distinct authority, data, release, and buyer-acceptance boundary. -The hourly product-development loop exists as a bounded, review-separated workflow. Its existence is operational infrastructure, not evidence that the browser product or an hourly run has completed the Phase 1 buyer acceptance. +The hourly product-development loop is operational infrastructure, not proof that a browser product, issue, pull request, or release meets buyer acceptance. ## Buyer-visible and technical gap matrix -| Priority | Buyer-visible outcome | Protected-main status | Next acceptance evidence | +| Priority | Buyer-visible outcome | Protected-main status | Completion issue and acceptance evidence | |---|---|---|---| -| P0 | A bounded task can observe a real Chromium page, perform a typed action, verify the post-condition, and emit provenance | **Open / Phase 1**; issue #28 | Repeated real Chromium E2E with ephemeral context, BiDi/session translation, observation, typed action, post-condition, evidence, crash cleanup, and exact current protected checks | -| P1 | Navigation uses the approved destination, route, TCP peer, TLS identity, and bounded HTTP/download policy | **Partial foundation**; HTTP and browser consumption remain planned | Real browser-network adapter proves the governed path is consumed end to end, including redirects, bounds, MIME, and failure evidence | -| P1 | Existing Chromium extensions remain compatible while Agent authority stays separate | **Partial evidence / planned completion**; issue #27 | Pinned-Chromium install/update/service-worker/content/storage/DNR/download/native-messaging/enterprise-isolation matrix with repeatability | -| P1 | Enterprise operators can disclose only necessary sensitive fields through a trusted, auditable path | **Policy foundation implemented; runtime open**; issue #10 | Opaque-handle broker, purpose/field/region policy, atomic reservation/revocation, retention/deletion, audit, and redaction tests | -| P2 | A buyer can receive durable replayable capture and provenance | **Foundations only** | Bounded WARC/PROV persistence, retention, integrity, replay, and benchmark evidence | -| P0 | Changes can pass protected review and merge without authority improvisation | **Blocked by reviewer-provisioning gap** | Provision an eligible independent collaborator or record an explicit current governance decision; then re-fetch exact head, reviews, checks, and merge state | +| P0 | A bounded task observes a real Chromium page, performs one typed action, verifies the post-condition, and emits provenance | **Open / Phase 1** | #28; repeated real Chromium E2E with isolated context, exact session/node authority, typed dispatch, post-condition, crash cleanup, and protected-main checks | +| P0 | Navigation consumes approved origin, resolution, route, TCP peer, TLS identity, bounded HTTP, redirect, MIME, and download policy | **Partial foundation** | #9 plus #28; real browser-network adapter proves the governed path is consumed end to end | +| P1 | Existing Chromium extensions remain compatible while Agent authority stays separate | **Partial active-PR evidence** | #27; exact supported-build/platform compatibility matrix, managed allow-list, native-host isolation, repeatability, and release binding | +| P1 | Authorized work can use necessary PII without ambient exposure | **Policy foundation; runtime open** | #10; opaque broker, exact field/purpose/destination/model policy, atomic use/revocation, retention/deletion, and value-free telemetry | +| P1 | Every released structured field is traceable to replayable source evidence | **Foundations only** | #199; durable WARC/PROV replay, integrity, retention, deletion, offline verification, extraction precision/recall, and 100% provenance completeness | +| P1 | External Agents integrate through a stable, authenticated product contract | **Partial active-PR MCP primitives** | #200; BAP 1.0, MCP 2026-07-28 adapter, idempotency, task cancellation/resume, checkpoint/reconciliation, and SDK conformance | +| P1 | Buyers can install, update, verify, and roll back a supported product | **Not shipped** | #201; signed Windows/macOS/Linux/headless artifacts, Chromium revision manifest, updater security, patch SLA, SBOM, SLSA provenance, and recovery | +| P1 | Enterprise teams can provision, approve, audit, operate, and recover the service | **Not shipped** | #202; Keyverse-compatible OIDC/SCIM, tenant isolation, policy/approval/evidence UI, SLO/incident controls, data residency, CSAP/SOC 2 evidence mapping, WCAG 2.2, Figma File ID, and Storybook | +| P0 | A release has reproducible proof of usefulness, safety, evidence completeness, and recovery | **No product-wide release gate** | #203; deterministic, compatibility, adversarial, recovery, and enterprise suites with statistical reporting and an exact-artifact commercial acceptance gate | +| P0 | Valid changes reach protected `main` without authority improvisation or unbounded stack growth | **Blocked / high integration debt** | Shrink the 145-PR queue in dependency order, provision legitimate review authority, require exact-current evidence, and close duplicates/superseded branches | + +## Commercial completion definition + +OriginWeave is not complete merely because every low-level primitive exists in some open branch. A release candidate is commercially complete only when all of the following are true for the declared support profile: + +1. #9, #10, #27, and #28 are integrated on protected `main` as a complete browser/network/action/evidence chain. +2. #199 provides replayable, retention-governed evidence for every released structured result. +3. #200 exposes a stable authenticated runtime API and task lifecycle without raw Chromium authority leakage. +4. #201 produces signed, updateable, rollback-capable release artifacts bound to Chromium, SBOM, and provenance. +5. #202 supplies tenant-safe enterprise administration, approvals, audit, SLOs, incident recovery, accessible Figma/Storybook-backed UX, and control evidence. +6. #203 accepts the exact signed artifacts through a reproducible benchmark; missing or inconclusive evidence cannot be promoted to success. +7. Production function, line, region, and branch coverage and public API documentation remain exactly complete for OriginWeave-owned code. +8. CHANGELOG, version, supported-platform matrix, security policy, runbooks, licensing, release notes, upgrade/rollback guidance, and procurement evidence match the exact release. +9. No required check, browser/platform lane, security case, benchmark case, or independent review is skipped, stale, inherited, or represented by status-only evidence. +10. The open PR queue is reduced to bounded active work rather than being the only place where the product exists. ## Next executable queue -1. Re-fetch every active PR's exact head, reviews, threads, required checks, and base before selecting a merge candidate; repair a current failure only after reproducing its root cause. -2. Advance issue #28 with the smallest failing real-browser acceptance test, beginning at ephemeral Chromium launch/session teardown and the BiDi adapter boundary. -3. Keep HTTP/1.1 and browser-network integration separate from the already-proven destination, direct TCP, and TLS kernels; do not claim safe navigation until Chromium consumption is observed. -4. Maintain the #27 extension matrix and #10 broker/runtime boundaries as independent acceptance tracks. -5. Resolve the reviewer-provisioning gap through legitimate repository governance before a non-author approval is required; never manufacture approval or bypass protection. +1. Re-fetch all 145 PRs and compute the dependency graph, exact heads/bases, reviews, unresolved threads, current required checks, duplicate/supersession relationships, and branch ancestry. +2. Integrate merge-ready root PRs first; restack and independently revalidate only the immediate children. Close obsolete alternatives instead of carrying parallel truth. +3. Finish the #9/#28 browser-network and Chromium vertical slice, including the #195/#198 WebSocket opening path and the remaining framed BiDi command/response, semantic observation, policy, action, post-condition, and recovery boundaries. +4. Finish #27 and #10 as separate security tracks; neither should be hidden inside the first browser PR. +5. Implement #199, then #200, so durable evidence and stable task authority precede broad enterprise integrations. +6. Implement #201 before making release/support claims; exact CI browser evidence must be bound to the actual signed artifact. +7. Design #202 in Figma, record the Figma File ID in the ADR, implement reusable design tokens and Storybook components, then add identity/tenant/approval/audit/operations integration. +8. Make #203 the final release gate across the exact signed distribution, not a source branch or model narrative. +9. Only after the commercial acceptance gate passes, increment the version, finalize CHANGELOG/release notes, publish signed artifacts, and verify upgrade/rollback from the prior supported release. ## Evidence commands -The volatile values above were obtained from the repository and GitHub APIs, without exposing credentials: +The volatile counts above were obtained from GitHub search rather than the first 100 results of the pull-request list endpoint: ```text -gh api 'repos/ContextualWisdomLab/OriginWeave/pulls?state=open&per_page=100' -gh api 'repos/ContextualWisdomLab/OriginWeave/commits/0841d2ab3d8b5e60a03c0a8e818cf438e2716829/check-runs?per_page=100' -gh api 'repos/ContextualWisdomLab/OriginWeave/rulesets/18156473' +gh api search/issues -f q='repo:ContextualWisdomLab/OriginWeave is:pr is:open' +gh api search/issues -f q='repo:ContextualWisdomLab/OriginWeave is:pr is:open draft:true' +gh api search/issues -f q='repo:ContextualWisdomLab/OriginWeave is:pr is:open draft:false' +gh api repos/ContextualWisdomLab/OriginWeave/branches/main +gh api repos/ContextualWisdomLab/OriginWeave/rulesets/18156473 gh api 'repos/ContextualWisdomLab/OriginWeave/collaborators?affiliation=all&per_page=100' ``` -For standards and binding architecture, use [`doctoring.md`](doctoring.md), [`PRD.md`](PRD.md), [`TRD.md`](TRD.md), [`product-roadmap.md`](product-roadmap.md), and the linked ADR/UML/ERD/traceability graph. This baseline intentionally records delivery state and does not promote planned adapters or open pull-request code to implemented behavior. +For standards and binding architecture, use [`doctoring.md`](doctoring.md), [`doctoring/browser-agent-protocols.md`](doctoring/browser-agent-protocols.md), [`PRD.md`](PRD.md), [`TRD.md`](TRD.md), [`product-roadmap.md`](product-roadmap.md), and linked ADR/UML/ERD/traceability records. Issues #199-#203 contain their own APA 7th standards and research traceability. This baseline intentionally records delivery state and never promotes planned adapters or active pull-request code to implemented behavior. From 6251b7043c80ae8df0a39b8423c2f5cac714466c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 20 Aug 2026 06:24:11 -0700 Subject: [PATCH 06/26] test(docs): require reproducible PR inventory evidence --- tests/test_product_completion_gap_contract.py | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/tests/test_product_completion_gap_contract.py b/tests/test_product_completion_gap_contract.py index a3dc6e2ff..141cb790c 100644 --- a/tests/test_product_completion_gap_contract.py +++ b/tests/test_product_completion_gap_contract.py @@ -44,6 +44,23 @@ def test_baseline_records_current_inventory_and_completion_issues(self) -> None: with self.subTest(stale_phrase=stale_phrase): self.assertNotIn(stale_phrase, text) + def test_evidence_commands_reproduce_inventory_checks_and_review_state(self) -> None: + """The evidence procedure must paginate the queue and inspect each exact PR head.""" + text = BASELINE.read_text(encoding="utf-8") + evidence = text.split("## Evidence commands", 1)[1] + + for phrase in ( + "--paginate --slurp 'repos/ContextualWisdomLab/OriginWeave/pulls?state=open&per_page=100'", + "jq '[.[][]]'", + '"repos/ContextualWisdomLab/OriginWeave/pulls/$PR"', + '"repos/ContextualWisdomLab/OriginWeave/commits/$HEAD_SHA/check-runs?per_page=100"', + '"repos/ContextualWisdomLab/OriginWeave/pulls/$PR/reviews?per_page=100"', + "reviewThreads(first: 100, after: $endCursor)", + "rulesets/18156473", + ): + with self.subTest(phrase=phrase): + self.assertIn(phrase, evidence) + if __name__ == "__main__": unittest.main() From 6a17a9041d8ea0a35d430f33bcd74c0b3ab8ba65 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 20 Aug 2026 06:28:10 -0700 Subject: [PATCH 07/26] docs: make PR inventory evidence reproducible --- docs/product-technical-gap-baseline.md | 47 +++++++++++++++++++++++--- 1 file changed, 42 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index b63c28e09..f77c0a091 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -102,15 +102,52 @@ OriginWeave is not complete merely because every low-level primitive exists in s ## Evidence commands -The volatile counts above were obtained from GitHub search rather than the first 100 results of the pull-request list endpoint: +The volatile counts above are reproducible by paginating the complete open-PR inventory, flattening every page, and then inspecting each PR's exact head, checks, reviews, and review threads: + +```bash +gh api --paginate --slurp 'repos/ContextualWisdomLab/OriginWeave/pulls?state=open&per_page=100' \ + > /tmp/originweave-open-pr-pages.json +jq '[.[][]]' /tmp/originweave-open-pr-pages.json \ + > /tmp/originweave-open-prs.json +jq '{ + open_pull_requests: length, + non_draft: (map(select(.draft == false)) | length), + draft: (map(select(.draft == true)) | length) +}' /tmp/originweave-open-prs.json -```text -gh api search/issues -f q='repo:ContextualWisdomLab/OriginWeave is:pr is:open' -gh api search/issues -f q='repo:ContextualWisdomLab/OriginWeave is:pr is:open draft:true' -gh api search/issues -f q='repo:ContextualWisdomLab/OriginWeave is:pr is:open draft:false' gh api repos/ContextualWisdomLab/OriginWeave/branches/main gh api repos/ContextualWisdomLab/OriginWeave/rulesets/18156473 gh api 'repos/ContextualWisdomLab/OriginWeave/collaborators?affiliation=all&per_page=100' + +jq -r '.[].number' /tmp/originweave-open-prs.json | while read -r PR; do + PR_JSON="/tmp/originweave-pr-${PR}.json" + gh api "repos/ContextualWisdomLab/OriginWeave/pulls/$PR" > "$PR_JSON" + HEAD_SHA=$(jq -r '.head.sha' "$PR_JSON") + + gh api --paginate --slurp \ + "repos/ContextualWisdomLab/OriginWeave/commits/$HEAD_SHA/check-runs?per_page=100" \ + > "/tmp/originweave-pr-${PR}-check-runs.json" + gh api --paginate --slurp \ + "repos/ContextualWisdomLab/OriginWeave/pulls/$PR/reviews?per_page=100" \ + > "/tmp/originweave-pr-${PR}-reviews.json" + gh api graphql --paginate --slurp \ + -F owner=ContextualWisdomLab \ + -F name=OriginWeave \ + -F number="$PR" \ + -f query=' +query($owner: String!, $name: String!, $number: Int!, $endCursor: String) { + repository(owner: $owner, name: $name) { + pullRequest(number: $number) { + reviewThreads(first: 100, after: $endCursor) { + nodes { id isResolved isOutdated } + pageInfo { hasNextPage endCursor } + } + } + } +}' > "/tmp/originweave-pr-${PR}-review-threads.json" +done ``` +The ruleset response determines the required workflow names; each PR's exact `HEAD_SHA` then determines which check runs, reviews, and unresolved threads are current. The saved PR JSON also preserves the exact base reference and branch ancestry input for the dependency graph. + For standards and binding architecture, use [`doctoring.md`](doctoring.md), [`doctoring/browser-agent-protocols.md`](doctoring/browser-agent-protocols.md), [`PRD.md`](PRD.md), [`TRD.md`](TRD.md), [`product-roadmap.md`](product-roadmap.md), and linked ADR/UML/ERD/traceability records. Issues #199-#203 contain their own APA 7th standards and research traceability. This baseline intentionally records delivery state and never promotes planned adapters or active pull-request code to implemented behavior. From 8da0e4ddaf2e7523e3966388dbcbd6549fca6226 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 05:49:18 +0900 Subject: [PATCH 08/26] docs: scope baseline delivery status contracts --- CHANGELOG.md | 1 + docs/product-technical-gap-baseline.md | 8 ++++++++ tests/test_product_documentation_contract.py | 19 +++++++++++++++++++ 3 files changed, 28 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2e950d19b..476bb20b0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -44,6 +44,7 @@ All notable changes to OriginWeave are documented in this file. The format follo - Made the agent-development contract work-conserving: completing one bounded slice, RCA, review request, check, merge, or documentation change is an intermediate state; maintenance must return to the live queue, treat waits as item-local, and perform a mandatory exit sweep before terminating while executable OriginWeave work remains. - Moved autonomous-agent Cargo targets and Python bytecode caches outside the proposed source tree and prefetched locked Cargo dependencies for offline verification. - Updated research doctoring to pin Chromium canonicalizer evidence to an immutable revision, add RFC 9293, RFC 5280, RFC 8446, RFC 9525, rustls 0.23.42, and Rust `TcpStream` evidence, distinguish the April 2026 Fugu beta from the June 2026 release, and treat vendor benchmark claims as first-party evidence rather than independent validation. +- Tightened the product-baseline contract so the BiDi opening path and VPN/profile evidence retain their explicit not-shipped status within their own documentation sections. ### Security diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index f77c0a091..cc3e509b0 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -30,6 +30,14 @@ Representative active workstreams at this snapshot were: Draft PR #198 is the current top WebDriver BiDi opening-response slice; its prerequisite #195 owns the bounded opening-request write. It remains draft evidence and cannot be treated as shipped behavior. +#### #195/#198 WebDriver BiDi opening path status + +Phase 1 is **in progress**, not shipped. #195 and #198 provide bounded WebSocket opening-path evidence on active branches; framed BiDi commands, authenticated browser-process provenance, semantic task execution, and protected-main integration remain open. + +#### #149 VPN/profile intent status + +It remains draft evidence and cannot be treated as shipped behavior. #149 describes bounded WireGuard/IKEv2 profile authority, but it does not create a tunnel, route, DNS state, authenticated gateway, or connectivity proof. + The current queue must be processed in dependency order. A green child branch cannot substitute for current checks and review on its prerequisite, synthetic merge, or eventual protected-main commit. PRs that only duplicate, supersede, or preserve stale branch topology should be closed with explicit replacement evidence rather than retained indefinitely. ### Review and merge authority diff --git a/tests/test_product_documentation_contract.py b/tests/test_product_documentation_contract.py index cb4f5a574..fb7c47a05 100644 --- a/tests/test_product_documentation_contract.py +++ b/tests/test_product_documentation_contract.py @@ -11,6 +11,14 @@ class ProductDocumentationContractTests(unittest.TestCase): """Keep product requirements, technical design, diagrams, and traceability discoverable.""" + @staticmethod + def _subsection(text: str, heading: str) -> str: + """Return one fourth-level documentation subsection.""" + start = text.index(heading) + len(heading) + remainder = text[start:] + end = remainder.find("\n#### ") + return remainder if end == -1 else remainder[:end] + def test_authoritative_product_documentation_graph_exists(self) -> None: """Major product decisions must not require reconstructing chat or PR history.""" required_paths = { @@ -57,6 +65,17 @@ def test_product_technical_gap_baseline_records_live_delivery_state(self) -> Non "It remains draft evidence and cannot be treated as shipped behavior.", open_pull_requests, ) + bidi_status = self._subsection( + open_pull_requests, "#### #195/#198 WebDriver BiDi opening path status" + ) + vpn_status = self._subsection( + open_pull_requests, "#### #149 VPN/profile intent status" + ) + self.assertIn("Phase 1 is **in progress**, not shipped.", bidi_status) + self.assertIn( + "It remains draft evidence and cannot be treated as shipped behavior.", + vpn_status, + ) def test_root_architecture_links_the_authoritative_product_graph(self) -> None: """Architecture readers must be able to reach requirements, decisions, diagrams, and data.""" From 735f2499cedb0b56d111f380d7d9f678f0fc606c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 06:12:30 +0900 Subject: [PATCH 09/26] docs: harden baseline evidence collection --- CHANGELOG.md | 1 + docs/product-technical-gap-baseline.md | 77 ++++++++++++------- tests/test_product_completion_gap_contract.py | 18 ++++- 3 files changed, 65 insertions(+), 31 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 476bb20b0..de47e8cb6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -42,6 +42,7 @@ All notable changes to OriginWeave are documented in this file. The format follo - Updated the first Chromium slice to distinguish implemented origin, destination, direct TCP, and TLS identity kernels from the remaining trusted DNS adapter, proxy/PAC, HTTP budget, MIME, download, and Chromium integration required before safe navigation can be claimed. - Separated hourly product PR publication authority from the organization review and merge system, and added live default-branch and release-blocker rechecks immediately before publication. - Made the agent-development contract work-conserving: completing one bounded slice, RCA, review request, check, merge, or documentation change is an intermediate state; maintenance must return to the live queue, treat waits as item-local, and perform a mandatory exit sweep before terminating while executable OriginWeave work remains. +- Hardened the dated baseline evidence collector with fail-fast isolated artifacts, paginated branch and collaborator rules, and post-collection exact-head revalidation. - Moved autonomous-agent Cargo targets and Python bytecode caches outside the proposed source tree and prefetched locked Cargo dependencies for offline verification. - Updated research doctoring to pin Chromium canonicalizer evidence to an immutable revision, add RFC 9293, RFC 5280, RFC 8446, RFC 9525, rustls 0.23.42, and Rust `TcpStream` evidence, distinguish the April 2026 Fugu beta from the June 2026 release, and treat vendor benchmark claims as first-party evidence rather than independent validation. - Tightened the product-baseline contract so the BiDi opening path and VPN/profile evidence retain their explicit not-shipped status within their own documentation sections. diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index cc3e509b0..da771de77 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -113,36 +113,50 @@ OriginWeave is not complete merely because every low-level primitive exists in s The volatile counts above are reproducible by paginating the complete open-PR inventory, flattening every page, and then inspecting each PR's exact head, checks, reviews, and review threads: ```bash +set -euo pipefail +EVIDENCE_DIR="$(mktemp -d /tmp/originweave-evidence.XXXXXX)" +printf 'Evidence directory: %s\n' "$EVIDENCE_DIR" >&2 + gh api --paginate --slurp 'repos/ContextualWisdomLab/OriginWeave/pulls?state=open&per_page=100' \ - > /tmp/originweave-open-pr-pages.json -jq '[.[][]]' /tmp/originweave-open-pr-pages.json \ - > /tmp/originweave-open-prs.json + > "$EVIDENCE_DIR/open-pr-pages.json" +jq '[.[][]]' "$EVIDENCE_DIR/open-pr-pages.json" \ + > "$EVIDENCE_DIR/open-prs.json" jq '{ open_pull_requests: length, non_draft: (map(select(.draft == false)) | length), draft: (map(select(.draft == true)) | length) -}' /tmp/originweave-open-prs.json - -gh api repos/ContextualWisdomLab/OriginWeave/branches/main -gh api repos/ContextualWisdomLab/OriginWeave/rulesets/18156473 -gh api 'repos/ContextualWisdomLab/OriginWeave/collaborators?affiliation=all&per_page=100' - -jq -r '.[].number' /tmp/originweave-open-prs.json | while read -r PR; do - PR_JSON="/tmp/originweave-pr-${PR}.json" - gh api "repos/ContextualWisdomLab/OriginWeave/pulls/$PR" > "$PR_JSON" - HEAD_SHA=$(jq -r '.head.sha' "$PR_JSON") - - gh api --paginate --slurp \ - "repos/ContextualWisdomLab/OriginWeave/commits/$HEAD_SHA/check-runs?per_page=100" \ - > "/tmp/originweave-pr-${PR}-check-runs.json" - gh api --paginate --slurp \ - "repos/ContextualWisdomLab/OriginWeave/pulls/$PR/reviews?per_page=100" \ - > "/tmp/originweave-pr-${PR}-reviews.json" - gh api graphql --paginate --slurp \ - -F owner=ContextualWisdomLab \ - -F name=OriginWeave \ - -F number="$PR" \ - -f query=' +}' "$EVIDENCE_DIR/open-prs.json" + +gh api 'repos/ContextualWisdomLab/OriginWeave/branches/main' \ + > "$EVIDENCE_DIR/main-branch.json" +gh api --paginate --slurp \ + 'repos/ContextualWisdomLab/OriginWeave/rules/branches/main?per_page=100' \ + > "$EVIDENCE_DIR/main-branch-rule-pages.json" +jq '[.[][]]' "$EVIDENCE_DIR/main-branch-rule-pages.json" \ + > "$EVIDENCE_DIR/main-branch-rules.json" +gh api --paginate --slurp \ + 'repos/ContextualWisdomLab/OriginWeave/collaborators?affiliation=all&per_page=100' \ + > "$EVIDENCE_DIR/collaborator-pages.json" +jq '[.[][]]' "$EVIDENCE_DIR/collaborator-pages.json" \ + > "$EVIDENCE_DIR/collaborators.json" + +jq -r '.[].number' "$EVIDENCE_DIR/open-prs.json" | while read -r PR; do + while :; do + PR_JSON="$EVIDENCE_DIR/pr-${PR}.json" + gh api "repos/ContextualWisdomLab/OriginWeave/pulls/$PR" > "$PR_JSON" + HEAD_SHA=$(jq -r '.head.sha' "$PR_JSON") + + gh api --paginate --slurp \ + "repos/ContextualWisdomLab/OriginWeave/commits/$HEAD_SHA/check-runs?per_page=100" \ + > "$EVIDENCE_DIR/pr-${PR}-check-runs.json" + gh api --paginate --slurp \ + "repos/ContextualWisdomLab/OriginWeave/pulls/$PR/reviews?per_page=100" \ + > "$EVIDENCE_DIR/pr-${PR}-reviews.json" + gh api graphql --paginate --slurp \ + -F owner=ContextualWisdomLab \ + -F name=OriginWeave \ + -F number="$PR" \ + -f query=' query($owner: String!, $name: String!, $number: Int!, $endCursor: String) { repository(owner: $owner, name: $name) { pullRequest(number: $number) { @@ -152,10 +166,19 @@ query($owner: String!, $name: String!, $number: Int!, $endCursor: String) { } } } -}' > "/tmp/originweave-pr-${PR}-review-threads.json" +}' > "$EVIDENCE_DIR/pr-${PR}-review-threads.json" + + RECHECKED_HEAD_SHA=$(gh api "repos/ContextualWisdomLab/OriginWeave/pulls/$PR" \ + | jq -r '.head.sha') + if [[ "$RECHECKED_HEAD_SHA" == "$HEAD_SHA" ]]; then + break + fi + printf 'Discarding moving-head evidence for PR #%s (%s -> %s) and retrying.\n' \ + "$PR" "$HEAD_SHA" "$RECHECKED_HEAD_SHA" >&2 + done done ``` -The ruleset response determines the required workflow names; each PR's exact `HEAD_SHA` then determines which check runs, reviews, and unresolved threads are current. The saved PR JSON also preserves the exact base reference and branch ancestry input for the dependency graph. +The branch-scoped rules response determines the active rules affecting `main`; each PR's exact `HEAD_SHA` then determines which check runs, reviews, and unresolved threads are current. The saved PR JSON also preserves the exact base reference and branch ancestry input for the dependency graph. Evidence is retained only when the post-collection `RECHECKED_HEAD_SHA` equals the collected `HEAD_SHA`. For standards and binding architecture, use [`doctoring.md`](doctoring.md), [`doctoring/browser-agent-protocols.md`](doctoring/browser-agent-protocols.md), [`PRD.md`](PRD.md), [`TRD.md`](TRD.md), [`product-roadmap.md`](product-roadmap.md), and linked ADR/UML/ERD/traceability records. Issues #199-#203 contain their own APA 7th standards and research traceability. This baseline intentionally records delivery state and never promotes planned adapters or active pull-request code to implemented behavior. diff --git a/tests/test_product_completion_gap_contract.py b/tests/test_product_completion_gap_contract.py index 141cb790c..4c69dc3f0 100644 --- a/tests/test_product_completion_gap_contract.py +++ b/tests/test_product_completion_gap_contract.py @@ -47,19 +47,29 @@ def test_baseline_records_current_inventory_and_completion_issues(self) -> None: def test_evidence_commands_reproduce_inventory_checks_and_review_state(self) -> None: """The evidence procedure must paginate the queue and inspect each exact PR head.""" text = BASELINE.read_text(encoding="utf-8") - evidence = text.split("## Evidence commands", 1)[1] + evidence = text.split("## Evidence commands", 1)[1].split("\n## ", 1)[0] + shell = evidence.split("```bash", 1)[1].split("```", 1)[0] for phrase in ( "--paginate --slurp 'repos/ContextualWisdomLab/OriginWeave/pulls?state=open&per_page=100'", - "jq '[.[][]]'", + "set -euo pipefail", + 'EVIDENCE_DIR="$(mktemp -d /tmp/originweave-evidence.XXXXXX)"', + '"$EVIDENCE_DIR/open-pr-pages.json"', + "jq '[.[][]]' \"$EVIDENCE_DIR/open-pr-pages.json\"", '"repos/ContextualWisdomLab/OriginWeave/pulls/$PR"', '"repos/ContextualWisdomLab/OriginWeave/commits/$HEAD_SHA/check-runs?per_page=100"', '"repos/ContextualWisdomLab/OriginWeave/pulls/$PR/reviews?per_page=100"', "reviewThreads(first: 100, after: $endCursor)", - "rulesets/18156473", + "rules/branches/main?per_page=100", + '"$EVIDENCE_DIR/main-branch-rule-pages.json"', + "RECHECKED_HEAD_SHA=", + '[[ "$RECHECKED_HEAD_SHA" == "$HEAD_SHA" ]]', ): with self.subTest(phrase=phrase): - self.assertIn(phrase, evidence) + self.assertIn(phrase, shell) + + self.assertIn("while :; do", shell) + self.assertNotIn("/tmp/originweave-open-pr", shell) if __name__ == "__main__": From 67fccd5a211b448d85d232ed0d06e40df52b4852 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 07:18:45 +0900 Subject: [PATCH 10/26] docs: refresh live product gap baseline --- CHANGELOG.md | 1 + docs/product-technical-gap-baseline.md | 9 +++++---- tests/test_product_completion_gap_contract.py | 4 ++-- tests/test_product_documentation_contract.py | 2 +- 4 files changed, 9 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index de47e8cb6..845aa66bd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -46,6 +46,7 @@ All notable changes to OriginWeave are documented in this file. The format follo - Moved autonomous-agent Cargo targets and Python bytecode caches outside the proposed source tree and prefetched locked Cargo dependencies for offline verification. - Updated research doctoring to pin Chromium canonicalizer evidence to an immutable revision, add RFC 9293, RFC 5280, RFC 8446, RFC 9525, rustls 0.23.42, and Rust `TcpStream` evidence, distinguish the April 2026 Fugu beta from the June 2026 release, and treat vendor benchmark claims as first-party evidence rather than independent validation. - Tightened the product-baseline contract so the BiDi opening path and VPN/profile evidence retain their explicit not-shipped status within their own documentation sections. +- Refreshed the product and technical gap baseline against the 2026-08-21 live inventory: 149 open pull requests, 111 drafts, and the new hardened-runner/MV3 evidence gap issue #206. ### Security diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index da771de77..31131f06a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ This is a dated delivery baseline, not a substitute for the PRD, TRD, roadmap, architecture decisions, or live GitHub state. It keeps buyer-visible gaps, current issues, active pull-request evidence, and commercial completion tracks in one discoverable place. Protected `main` is the implementation boundary: code in an open pull request is not shipped behavior. -## Observed snapshot: 2026-08-20 +## Observed snapshot: 2026-08-21 ### Protected-main truth @@ -14,7 +14,7 @@ This is a dated delivery baseline, not a substitute for the PRD, TRD, roadmap, a ### Open pull requests -The live repository contained **145 open pull requests: 38 non-draft and 107 draft**. The volume and stack depth are themselves a product-delivery risk: review, exact-head checks, dependency order, and integration truth can drift faster than a buyer-visible vertical slice reaches protected `main`. +The live repository contained **149 open pull requests: 38 non-draft and 111 draft**. The volume and stack depth are themselves a product-delivery risk: review, exact-head checks, dependency order, and integration truth can drift faster than a buyer-visible vertical slice reaches protected `main`. Representative active workstreams at this snapshot were: @@ -61,6 +61,7 @@ This gap does not authorize self-approval, administrative bypass, stale-head mer | #201 | Signed cross-platform Chromium distribution, installer/updater, patch SLA, rollback, SBOM, and provenance | | #202 | Enterprise control and experience plane: operator UI, Keyverse-compatible identity, tenancy, approval, audit, SLO, Figma, and Storybook | | #203 | Release-grade web-agent benchmark and commercial acceptance gate bound to exact signed artifacts | +| #206 | Harden-runner custom detection initialization failure while the MV3 gate remains green | The five newly separated product-completion tracks are **durable WARC/PROV replay**, **stable BAP/MCP runtime API**, **signed cross-platform Chromium distribution**, **enterprise control and experience plane**, and the **commercial acceptance gate**. They are separate issues because each has a distinct authority, data, release, and buyer-acceptance boundary. @@ -79,7 +80,7 @@ The hourly product-development loop is operational infrastructure, not proof tha | P1 | Buyers can install, update, verify, and roll back a supported product | **Not shipped** | #201; signed Windows/macOS/Linux/headless artifacts, Chromium revision manifest, updater security, patch SLA, SBOM, SLSA provenance, and recovery | | P1 | Enterprise teams can provision, approve, audit, operate, and recover the service | **Not shipped** | #202; Keyverse-compatible OIDC/SCIM, tenant isolation, policy/approval/evidence UI, SLO/incident controls, data residency, CSAP/SOC 2 evidence mapping, WCAG 2.2, Figma File ID, and Storybook | | P0 | A release has reproducible proof of usefulness, safety, evidence completeness, and recovery | **No product-wide release gate** | #203; deterministic, compatibility, adversarial, recovery, and enterprise suites with statistical reporting and an exact-artifact commercial acceptance gate | -| P0 | Valid changes reach protected `main` without authority improvisation or unbounded stack growth | **Blocked / high integration debt** | Shrink the 145-PR queue in dependency order, provision legitimate review authority, require exact-current evidence, and close duplicates/superseded branches | +| P0 | Valid changes reach protected `main` without authority improvisation or unbounded stack growth | **Blocked / high integration debt** | Shrink the 149-PR queue in dependency order, provision legitimate review authority, require exact-current evidence, and close duplicates/superseded branches | ## Commercial completion definition @@ -98,7 +99,7 @@ OriginWeave is not complete merely because every low-level primitive exists in s ## Next executable queue -1. Re-fetch all 145 PRs and compute the dependency graph, exact heads/bases, reviews, unresolved threads, current required checks, duplicate/supersession relationships, and branch ancestry. +1. Re-fetch all 149 PRs and compute the dependency graph, exact heads/bases, reviews, unresolved threads, current required checks, duplicate/supersession relationships, and branch ancestry. 2. Integrate merge-ready root PRs first; restack and independently revalidate only the immediate children. Close obsolete alternatives instead of carrying parallel truth. 3. Finish the #9/#28 browser-network and Chromium vertical slice, including the #195/#198 WebSocket opening path and the remaining framed BiDi command/response, semantic observation, policy, action, post-condition, and recovery boundaries. 4. Finish #27 and #10 as separate security tracks; neither should be hidden inside the first browser PR. diff --git a/tests/test_product_completion_gap_contract.py b/tests/test_product_completion_gap_contract.py index 4c69dc3f0..34c70e9f6 100644 --- a/tests/test_product_completion_gap_contract.py +++ b/tests/test_product_completion_gap_contract.py @@ -17,9 +17,9 @@ def test_baseline_records_current_inventory_and_completion_issues(self) -> None: text = BASELINE.read_text(encoding="utf-8") for phrase in ( - "145 open pull requests", + "149 open pull requests", "38 non-draft", - "107 draft", + "111 draft", "#198", "#199", "#200", diff --git a/tests/test_product_documentation_contract.py b/tests/test_product_documentation_contract.py index fb7c47a05..211223c8f 100644 --- a/tests/test_product_documentation_contract.py +++ b/tests/test_product_documentation_contract.py @@ -44,7 +44,7 @@ def test_product_technical_gap_baseline_records_live_delivery_state(self) -> Non self.assertTrue(baseline.is_file()) text = baseline.read_text(encoding="utf-8") for phrase in ( - "Observed snapshot: 2026-08-20", + "Observed snapshot: 2026-08-21", "Protected-main truth", "Open pull requests", "Open issues", From 2c721f907c250e0003979b7b25543749b35339e2 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 07:22:51 +0900 Subject: [PATCH 11/26] docs: record current merge authority --- CHANGELOG.md | 1 + docs/product-technical-gap-baseline.md | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 845aa66bd..3ff81084e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -47,6 +47,7 @@ All notable changes to OriginWeave are documented in this file. The format follo - Updated research doctoring to pin Chromium canonicalizer evidence to an immutable revision, add RFC 9293, RFC 5280, RFC 8446, RFC 9525, rustls 0.23.42, and Rust `TcpStream` evidence, distinguish the April 2026 Fugu beta from the June 2026 release, and treat vendor benchmark claims as first-party evidence rather than independent validation. - Tightened the product-baseline contract so the BiDi opening path and VPN/profile evidence retain their explicit not-shipped status within their own documentation sections. - Refreshed the product and technical gap baseline against the 2026-08-21 live inventory: 149 open pull requests, 111 drafts, and the new hardened-runner/MV3 evidence gap issue #206. +- Refreshed the baseline's merge-authority statement to the live ruleset: two approving reviews are required, while the collaborator inventory still contains only the solo maintainer. ### Security diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 31131f06a..794ef601c 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -42,7 +42,7 @@ The current queue must be processed in dependency order. A green child branch ca ### Review and merge authority -The active `CWL Central required workflows` ruleset requires one approving review, approval after the last push, resolved review threads, and configured required workflows. The previously observed collaborator inventory contained only `seonghobae` with administration and push permissions, creating a **reviewer-provisioning gap** for counted non-author approval. +The active `CWL Central required workflows` ruleset requires two approving reviews, approval after the last push, resolved review threads, and configured required workflows. The current collaborator inventory contains only `seonghobae` with administration and push permissions, creating a **reviewer-provisioning gap** for counted non-author approval. This gap does not authorize self-approval, administrative bypass, stale-head merge, or weaker checks. Exact current-head checks, security gates, complete coverage, rustdoc/Clippy, thread resolution, and branch protection remain mandatory. Before any merge decision, re-fetch the exact ruleset, collaborators, PR head/base, reviews, unresolved threads, and required checks; do not assume this dated observation remains current. From 4e6d334ac4deb23d789a875e6545a5f26bbad30b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 20 Aug 2026 15:30:15 -0700 Subject: [PATCH 12/26] test(docs): require exact-head merge verdict evidence --- tests/test_product_completion_gap_contract.py | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/tests/test_product_completion_gap_contract.py b/tests/test_product_completion_gap_contract.py index 34c70e9f6..f0c80b58d 100644 --- a/tests/test_product_completion_gap_contract.py +++ b/tests/test_product_completion_gap_contract.py @@ -58,10 +58,17 @@ def test_evidence_commands_reproduce_inventory_checks_and_review_state(self) -> "jq '[.[][]]' \"$EVIDENCE_DIR/open-pr-pages.json\"", '"repos/ContextualWisdomLab/OriginWeave/pulls/$PR"', '"repos/ContextualWisdomLab/OriginWeave/commits/$HEAD_SHA/check-runs?per_page=100"', + '"repos/ContextualWisdomLab/OriginWeave/commits/$HEAD_SHA/statuses?per_page=100"', '"repos/ContextualWisdomLab/OriginWeave/pulls/$PR/reviews?per_page=100"', "reviewThreads(first: 100, after: $endCursor)", "rules/branches/main?per_page=100", '"$EVIDENCE_DIR/main-branch-rule-pages.json"', + '.state == "APPROVED"', + ".submitted_at != null", + ".commit_id == $head", + "required_workflows", + "required_status_checks", + '"$EVIDENCE_DIR/pr-${PR}-merge-verdict.json"', "RECHECKED_HEAD_SHA=", '[[ "$RECHECKED_HEAD_SHA" == "$HEAD_SHA" ]]', ): From b20a8b71c946b4317c59893d78e8ee935d677b17 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 20 Aug 2026 15:32:45 -0700 Subject: [PATCH 13/26] test(docs): align merge evidence contract with rules API --- tests/test_product_completion_gap_contract.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tests/test_product_completion_gap_contract.py b/tests/test_product_completion_gap_contract.py index f0c80b58d..8be8715ef 100644 --- a/tests/test_product_completion_gap_contract.py +++ b/tests/test_product_completion_gap_contract.py @@ -66,7 +66,8 @@ def test_evidence_commands_reproduce_inventory_checks_and_review_state(self) -> '.state == "APPROVED"', ".submitted_at != null", ".commit_id == $head", - "required_workflows", + '.type == "workflows"', + ".parameters.workflows", "required_status_checks", '"$EVIDENCE_DIR/pr-${PR}-merge-verdict.json"', "RECHECKED_HEAD_SHA=", From 3f6c057a04ffc462759ed5d231da5e1307ad250a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 20 Aug 2026 15:33:37 -0700 Subject: [PATCH 14/26] test(docs): bound merge evidence retries --- tests/test_product_completion_gap_contract.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/tests/test_product_completion_gap_contract.py b/tests/test_product_completion_gap_contract.py index 8be8715ef..dee74a62a 100644 --- a/tests/test_product_completion_gap_contract.py +++ b/tests/test_product_completion_gap_contract.py @@ -60,6 +60,7 @@ def test_evidence_commands_reproduce_inventory_checks_and_review_state(self) -> '"repos/ContextualWisdomLab/OriginWeave/commits/$HEAD_SHA/check-runs?per_page=100"', '"repos/ContextualWisdomLab/OriginWeave/commits/$HEAD_SHA/statuses?per_page=100"', '"repos/ContextualWisdomLab/OriginWeave/pulls/$PR/reviews?per_page=100"', + '"repos/ContextualWisdomLab/OriginWeave/actions/runs?head_sha=$HEAD_SHA&per_page=100"', "reviewThreads(first: 100, after: $endCursor)", "rules/branches/main?per_page=100", '"$EVIDENCE_DIR/main-branch-rule-pages.json"', @@ -70,13 +71,14 @@ def test_evidence_commands_reproduce_inventory_checks_and_review_state(self) -> ".parameters.workflows", "required_status_checks", '"$EVIDENCE_DIR/pr-${PR}-merge-verdict.json"', + "for ATTEMPT in 1 2 3; do", "RECHECKED_HEAD_SHA=", '[[ "$RECHECKED_HEAD_SHA" == "$HEAD_SHA" ]]', ): with self.subTest(phrase=phrase): self.assertIn(phrase, shell) - self.assertIn("while :; do", shell) + self.assertNotIn("while :; do", shell) self.assertNotIn("/tmp/originweave-open-pr", shell) From a29b02995dd1089f487aedafb349ef7b195dd7fa Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 07:50:23 +0900 Subject: [PATCH 15/26] test(docs): harden exact-head evidence collection --- CHANGELOG.md | 1 + docs/product-technical-gap-baseline.md | 50 ++++++++++++++++++++++++-- 2 files changed, 49 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3ff81084e..2a10bc3f0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -43,6 +43,7 @@ All notable changes to OriginWeave are documented in this file. The format follo - Separated hourly product PR publication authority from the organization review and merge system, and added live default-branch and release-blocker rechecks immediately before publication. - Made the agent-development contract work-conserving: completing one bounded slice, RCA, review request, check, merge, or documentation change is an intermediate state; maintenance must return to the live queue, treat waits as item-local, and perform a mandatory exit sweep before terminating while executable OriginWeave work remains. - Hardened the dated baseline evidence collector with fail-fast isolated artifacts, paginated branch and collaborator rules, and post-collection exact-head revalidation. +- Hardened the baseline evidence procedure with exact-head legacy status and workflow-run capture, counted approval binding, required-workflow recording, merge verdict artifacts, and bounded moving-head retries. - Moved autonomous-agent Cargo targets and Python bytecode caches outside the proposed source tree and prefetched locked Cargo dependencies for offline verification. - Updated research doctoring to pin Chromium canonicalizer evidence to an immutable revision, add RFC 9293, RFC 5280, RFC 8446, RFC 9525, rustls 0.23.42, and Rust `TcpStream` evidence, distinguish the April 2026 Fugu beta from the June 2026 release, and treat vendor benchmark claims as first-party evidence rather than independent validation. - Tightened the product-baseline contract so the BiDi opening path and VPN/profile evidence retain their explicit not-shipped status within their own documentation sections. diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 794ef601c..c0515584c 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -142,7 +142,8 @@ jq '[.[][]]' "$EVIDENCE_DIR/collaborator-pages.json" \ > "$EVIDENCE_DIR/collaborators.json" jq -r '.[].number' "$EVIDENCE_DIR/open-prs.json" | while read -r PR; do - while :; do + STABLE_HEAD=false + for ATTEMPT in 1 2 3; do PR_JSON="$EVIDENCE_DIR/pr-${PR}.json" gh api "repos/ContextualWisdomLab/OriginWeave/pulls/$PR" > "$PR_JSON" HEAD_SHA=$(jq -r '.head.sha' "$PR_JSON") @@ -150,9 +151,15 @@ jq -r '.[].number' "$EVIDENCE_DIR/open-prs.json" | while read -r PR; do gh api --paginate --slurp \ "repos/ContextualWisdomLab/OriginWeave/commits/$HEAD_SHA/check-runs?per_page=100" \ > "$EVIDENCE_DIR/pr-${PR}-check-runs.json" + gh api --paginate --slurp \ + "repos/ContextualWisdomLab/OriginWeave/commits/$HEAD_SHA/statuses?per_page=100" \ + > "$EVIDENCE_DIR/pr-${PR}-statuses.json" gh api --paginate --slurp \ "repos/ContextualWisdomLab/OriginWeave/pulls/$PR/reviews?per_page=100" \ > "$EVIDENCE_DIR/pr-${PR}-reviews.json" + gh api --paginate --slurp \ + "repos/ContextualWisdomLab/OriginWeave/actions/runs?head_sha=$HEAD_SHA&per_page=100" \ + > "$EVIDENCE_DIR/pr-${PR}-workflow-runs.json" gh api graphql --paginate --slurp \ -F owner=ContextualWisdomLab \ -F name=OriginWeave \ @@ -169,17 +176,56 @@ query($owner: String!, $name: String!, $number: Int!, $endCursor: String) { } }' > "$EVIDENCE_DIR/pr-${PR}-review-threads.json" + jq -n \ + --arg head "$HEAD_SHA" \ + --slurpfile pr "$PR_JSON" \ + --slurpfile checks "$EVIDENCE_DIR/pr-${PR}-check-runs.json" \ + --slurpfile statuses "$EVIDENCE_DIR/pr-${PR}-statuses.json" \ + --slurpfile reviews "$EVIDENCE_DIR/pr-${PR}-reviews.json" \ + --slurpfile workflow_runs "$EVIDENCE_DIR/pr-${PR}-workflow-runs.json" \ + --slurpfile rules "$EVIDENCE_DIR/main-branch-rules.json" \ + --slurpfile threads "$EVIDENCE_DIR/pr-${PR}-review-threads.json" \ + '{ + head_sha: $head, + base_sha: $pr[0].base.sha, + required_status_checks: { + check_runs: [$checks[][]?], + legacy_statuses: [$statuses[][]?] + }, + workflow_runs: [$workflow_runs[0].workflow_runs[]?], + counted_approvals: [ + $reviews[][]? + | select(.state == "APPROVED") + | select(.submitted_at != null) + | select(.commit_id == $head) + ], + required_workflows: [ + $rules[][]? + | select(.type == "workflows") + | .parameters.workflows[] + ], + unresolved_threads: [ + $threads[]?.data.repository.pullRequest.reviewThreads.nodes[]? + | select(.isResolved == false and .isOutdated == false) + ] + }' > "$EVIDENCE_DIR/pr-${PR}-merge-verdict.json" + RECHECKED_HEAD_SHA=$(gh api "repos/ContextualWisdomLab/OriginWeave/pulls/$PR" \ | jq -r '.head.sha') if [[ "$RECHECKED_HEAD_SHA" == "$HEAD_SHA" ]]; then + STABLE_HEAD=true break fi printf 'Discarding moving-head evidence for PR #%s (%s -> %s) and retrying.\n' \ "$PR" "$HEAD_SHA" "$RECHECKED_HEAD_SHA" >&2 done + if [[ "$STABLE_HEAD" != true ]]; then + printf 'Unable to collect stable exact-head evidence for PR #%s after 3 attempts.\n' "$PR" >&2 + exit 1 + fi done ``` -The branch-scoped rules response determines the active rules affecting `main`; each PR's exact `HEAD_SHA` then determines which check runs, reviews, and unresolved threads are current. The saved PR JSON also preserves the exact base reference and branch ancestry input for the dependency graph. Evidence is retained only when the post-collection `RECHECKED_HEAD_SHA` equals the collected `HEAD_SHA`. +The branch-scoped rules response determines the active rules affecting `main`; each PR's exact `HEAD_SHA` then determines which check runs, legacy statuses, workflow runs, reviews, and unresolved threads are current. The saved merge verdict binds counted approvals to `APPROVED`, non-null submission times, and the exact head, while preserving required workflow rules. The saved PR JSON also preserves the exact base reference and branch ancestry input for the dependency graph. Evidence is retained only when the post-collection `RECHECKED_HEAD_SHA` equals the collected `HEAD_SHA`; a moving head fails after three bounded attempts. For standards and binding architecture, use [`doctoring.md`](doctoring.md), [`doctoring/browser-agent-protocols.md`](doctoring/browser-agent-protocols.md), [`PRD.md`](PRD.md), [`TRD.md`](TRD.md), [`product-roadmap.md`](product-roadmap.md), and linked ADR/UML/ERD/traceability records. Issues #199-#203 contain their own APA 7th standards and research traceability. This baseline intentionally records delivery state and never promotes planned adapters or active pull-request code to implemented behavior. From 6737ae13f9387598737a37e3b23d8593b8723274 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 07:51:07 +0900 Subject: [PATCH 16/26] fix(docs): preserve exact check-run records --- docs/product-technical-gap-baseline.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index c0515584c..9263c9e63 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -189,16 +189,16 @@ query($owner: String!, $name: String!, $number: Int!, $endCursor: String) { head_sha: $head, base_sha: $pr[0].base.sha, required_status_checks: { - check_runs: [$checks[][]?], + check_runs: [$checks[]?.check_runs[]?], legacy_statuses: [$statuses[][]?] }, workflow_runs: [$workflow_runs[0].workflow_runs[]?], - counted_approvals: [ + counted_approvals: ([ $reviews[][]? | select(.state == "APPROVED") | select(.submitted_at != null) | select(.commit_id == $head) - ], + ] | length), required_workflows: [ $rules[][]? | select(.type == "workflows") From 1a985420c92fbbc0bcd4b4ce9e1931c3f047a988 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 08:49:56 +0900 Subject: [PATCH 17/26] fix(docs): flatten paginated workflow evidence --- CHANGELOG.md | 1 + docs/product-technical-gap-baseline.md | 2 +- tests/test_product_completion_gap_contract.py | 1 + 3 files changed, 3 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2a10bc3f0..a80657218 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -43,6 +43,7 @@ All notable changes to OriginWeave are documented in this file. The format follo - Separated hourly product PR publication authority from the organization review and merge system, and added live default-branch and release-blocker rechecks immediately before publication. - Made the agent-development contract work-conserving: completing one bounded slice, RCA, review request, check, merge, or documentation change is an intermediate state; maintenance must return to the live queue, treat waits as item-local, and perform a mandatory exit sweep before terminating while executable OriginWeave work remains. - Hardened the dated baseline evidence collector with fail-fast isolated artifacts, paginated branch and collaborator rules, and post-collection exact-head revalidation. +- Flattened every paginated workflow-run page in the baseline merge verdict so exact-head evidence cannot silently discard later runs. - Hardened the baseline evidence procedure with exact-head legacy status and workflow-run capture, counted approval binding, required-workflow recording, merge verdict artifacts, and bounded moving-head retries. - Moved autonomous-agent Cargo targets and Python bytecode caches outside the proposed source tree and prefetched locked Cargo dependencies for offline verification. - Updated research doctoring to pin Chromium canonicalizer evidence to an immutable revision, add RFC 9293, RFC 5280, RFC 8446, RFC 9525, rustls 0.23.42, and Rust `TcpStream` evidence, distinguish the April 2026 Fugu beta from the June 2026 release, and treat vendor benchmark claims as first-party evidence rather than independent validation. diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 9263c9e63..233338aa7 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -192,7 +192,7 @@ query($owner: String!, $name: String!, $number: Int!, $endCursor: String) { check_runs: [$checks[]?.check_runs[]?], legacy_statuses: [$statuses[][]?] }, - workflow_runs: [$workflow_runs[0].workflow_runs[]?], + workflow_runs: [$workflow_runs[]?.workflow_runs[]?], counted_approvals: ([ $reviews[][]? | select(.state == "APPROVED") diff --git a/tests/test_product_completion_gap_contract.py b/tests/test_product_completion_gap_contract.py index dee74a62a..310573239 100644 --- a/tests/test_product_completion_gap_contract.py +++ b/tests/test_product_completion_gap_contract.py @@ -61,6 +61,7 @@ def test_evidence_commands_reproduce_inventory_checks_and_review_state(self) -> '"repos/ContextualWisdomLab/OriginWeave/commits/$HEAD_SHA/statuses?per_page=100"', '"repos/ContextualWisdomLab/OriginWeave/pulls/$PR/reviews?per_page=100"', '"repos/ContextualWisdomLab/OriginWeave/actions/runs?head_sha=$HEAD_SHA&per_page=100"', + "workflow_runs: [$workflow_runs[]?.workflow_runs[]?],", "reviewThreads(first: 100, after: $endCursor)", "rules/branches/main?per_page=100", '"$EVIDENCE_DIR/main-branch-rule-pages.json"', From 65d234beb00af328507359c1ba92bb90f55a1097 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 08:53:30 +0900 Subject: [PATCH 18/26] docs: refresh baseline inventory counts --- CHANGELOG.md | 2 +- docs/product-technical-gap-baseline.md | 8 ++++---- tests/test_product_completion_gap_contract.py | 4 ++-- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a80657218..f6bfcc8d0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -48,7 +48,7 @@ All notable changes to OriginWeave are documented in this file. The format follo - Moved autonomous-agent Cargo targets and Python bytecode caches outside the proposed source tree and prefetched locked Cargo dependencies for offline verification. - Updated research doctoring to pin Chromium canonicalizer evidence to an immutable revision, add RFC 9293, RFC 5280, RFC 8446, RFC 9525, rustls 0.23.42, and Rust `TcpStream` evidence, distinguish the April 2026 Fugu beta from the June 2026 release, and treat vendor benchmark claims as first-party evidence rather than independent validation. - Tightened the product-baseline contract so the BiDi opening path and VPN/profile evidence retain their explicit not-shipped status within their own documentation sections. -- Refreshed the product and technical gap baseline against the 2026-08-21 live inventory: 149 open pull requests, 111 drafts, and the new hardened-runner/MV3 evidence gap issue #206. +- Refreshed the product and technical gap baseline against the 2026-08-21 live inventory: 148 open pull requests, 110 drafts, and the new hardened-runner/MV3 evidence gap issue #206. - Refreshed the baseline's merge-authority statement to the live ruleset: two approving reviews are required, while the collaborator inventory still contains only the solo maintainer. ### Security diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 233338aa7..d92baf799 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -14,14 +14,14 @@ This is a dated delivery baseline, not a substitute for the PRD, TRD, roadmap, a ### Open pull requests -The live repository contained **149 open pull requests: 38 non-draft and 111 draft**. The volume and stack depth are themselves a product-delivery risk: review, exact-head checks, dependency order, and integration truth can drift faster than a buyer-visible vertical slice reaches protected `main`. +The live repository contained **148 open pull requests: 38 non-draft and 110 draft**. The volume and stack depth are themselves a product-delivery risk: review, exact-head checks, dependency order, and integration truth can drift faster than a buyer-visible vertical slice reaches protected `main`. Representative active workstreams at this snapshot were: | Workstream | Representative active PR evidence | Delivery boundary | |---|---|---| | Product baseline | #196 | Ready/non-draft documentation PR; this refreshed inventory and the completion issues below remain review-gated | -| WebDriver BiDi transport | #188 through #198 | #198, exact head `924f260cac885a8c66c81de1101c1ba183d00e74`, validates the RFC 6455 opening response on top of #195; the stack still does not by itself complete framed BiDi browser commands, authenticated browser-process provenance, semantic task execution, or protected-main shipment | +| WebDriver BiDi transport | #188 through #198 | #198, exact head `2e01bcd0fb3057b4a78c2f5dd58a5efd86bc26f2`, validates the RFC 6455 opening response on top of #195; the stack still does not by itself complete framed BiDi browser commands, authenticated browser-process provenance, semantic task execution, or protected-main shipment | | MCP adapter | #168 and #170 | Typed MCP routing and conservative `tools/list` metadata are active-PR foundations; complete authenticated transport, durable task lifecycle, cancellation/resume, and browser execution remain open under #200 | | Controlled Chromium and recovery | #65, #70-#73, #100, #105, #142-#153 and descendants | Real pinned-browser fixture, semantic location, resource, crash, and teardown evidence exists on active stacks; evidence does not transfer across heads or prerequisites | | Manifest V3 and native messaging | #27 and its active extension/native-host stack, including #154 and #169 | Compatibility and Agent-authority isolation remain incomplete until exact release artifacts and platform matrices are proven | @@ -80,7 +80,7 @@ The hourly product-development loop is operational infrastructure, not proof tha | P1 | Buyers can install, update, verify, and roll back a supported product | **Not shipped** | #201; signed Windows/macOS/Linux/headless artifacts, Chromium revision manifest, updater security, patch SLA, SBOM, SLSA provenance, and recovery | | P1 | Enterprise teams can provision, approve, audit, operate, and recover the service | **Not shipped** | #202; Keyverse-compatible OIDC/SCIM, tenant isolation, policy/approval/evidence UI, SLO/incident controls, data residency, CSAP/SOC 2 evidence mapping, WCAG 2.2, Figma File ID, and Storybook | | P0 | A release has reproducible proof of usefulness, safety, evidence completeness, and recovery | **No product-wide release gate** | #203; deterministic, compatibility, adversarial, recovery, and enterprise suites with statistical reporting and an exact-artifact commercial acceptance gate | -| P0 | Valid changes reach protected `main` without authority improvisation or unbounded stack growth | **Blocked / high integration debt** | Shrink the 149-PR queue in dependency order, provision legitimate review authority, require exact-current evidence, and close duplicates/superseded branches | +| P0 | Valid changes reach protected `main` without authority improvisation or unbounded stack growth | **Blocked / high integration debt** | Shrink the 148-PR queue in dependency order, provision legitimate review authority, require exact-current evidence, and close duplicates/superseded branches | ## Commercial completion definition @@ -99,7 +99,7 @@ OriginWeave is not complete merely because every low-level primitive exists in s ## Next executable queue -1. Re-fetch all 149 PRs and compute the dependency graph, exact heads/bases, reviews, unresolved threads, current required checks, duplicate/supersession relationships, and branch ancestry. +1. Re-fetch all 148 PRs and compute the dependency graph, exact heads/bases, reviews, unresolved threads, current required checks, duplicate/supersession relationships, and branch ancestry. 2. Integrate merge-ready root PRs first; restack and independently revalidate only the immediate children. Close obsolete alternatives instead of carrying parallel truth. 3. Finish the #9/#28 browser-network and Chromium vertical slice, including the #195/#198 WebSocket opening path and the remaining framed BiDi command/response, semantic observation, policy, action, post-condition, and recovery boundaries. 4. Finish #27 and #10 as separate security tracks; neither should be hidden inside the first browser PR. diff --git a/tests/test_product_completion_gap_contract.py b/tests/test_product_completion_gap_contract.py index 310573239..156fc7026 100644 --- a/tests/test_product_completion_gap_contract.py +++ b/tests/test_product_completion_gap_contract.py @@ -17,9 +17,9 @@ def test_baseline_records_current_inventory_and_completion_issues(self) -> None: text = BASELINE.read_text(encoding="utf-8") for phrase in ( - "149 open pull requests", + "148 open pull requests", "38 non-draft", - "111 draft", + "110 draft", "#198", "#199", "#200", From b3e738efdefe379750c9916f04261da2524ca94b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 09:40:05 +0900 Subject: [PATCH 19/26] docs: harden baseline evidence collection --- CHANGELOG.md | 3 +- docs/product-technical-gap-baseline.md | 109 +++++++++++++----- tests/test_product_completion_gap_contract.py | 26 ++++- 3 files changed, 101 insertions(+), 37 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f6bfcc8d0..3ac6294cb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -48,8 +48,9 @@ All notable changes to OriginWeave are documented in this file. The format follo - Moved autonomous-agent Cargo targets and Python bytecode caches outside the proposed source tree and prefetched locked Cargo dependencies for offline verification. - Updated research doctoring to pin Chromium canonicalizer evidence to an immutable revision, add RFC 9293, RFC 5280, RFC 8446, RFC 9525, rustls 0.23.42, and Rust `TcpStream` evidence, distinguish the April 2026 Fugu beta from the June 2026 release, and treat vendor benchmark claims as first-party evidence rather than independent validation. - Tightened the product-baseline contract so the BiDi opening path and VPN/profile evidence retain their explicit not-shipped status within their own documentation sections. -- Refreshed the product and technical gap baseline against the 2026-08-21 live inventory: 148 open pull requests, 110 drafts, and the new hardened-runner/MV3 evidence gap issue #206. +- Refreshed the product and technical gap baseline against the 2026-08-21 live inventory: 150 open pull requests, 112 drafts, and the new hardened-runner/MV3 evidence gap issue #206. - Refreshed the baseline's merge-authority statement to the live ruleset: two approving reviews are required, while the collaborator inventory still contains only the solo maintainer. +- Corrected the baseline evidence collector to flatten every paginated input, apply current reviewer and last-push approval semantics, and discard verdicts when either the PR head or base moves. ### Security diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index d92baf799..f1bc22178 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -14,7 +14,7 @@ This is a dated delivery baseline, not a substitute for the PRD, TRD, roadmap, a ### Open pull requests -The live repository contained **148 open pull requests: 38 non-draft and 110 draft**. The volume and stack depth are themselves a product-delivery risk: review, exact-head checks, dependency order, and integration truth can drift faster than a buyer-visible vertical slice reaches protected `main`. +The live repository contained **150 open pull requests: 38 non-draft and 112 draft**. The volume and stack depth are themselves a product-delivery risk: review, exact-head checks, dependency order, and integration truth can drift faster than a buyer-visible vertical slice reaches protected `main`. Representative active workstreams at this snapshot were: @@ -80,7 +80,7 @@ The hourly product-development loop is operational infrastructure, not proof tha | P1 | Buyers can install, update, verify, and roll back a supported product | **Not shipped** | #201; signed Windows/macOS/Linux/headless artifacts, Chromium revision manifest, updater security, patch SLA, SBOM, SLSA provenance, and recovery | | P1 | Enterprise teams can provision, approve, audit, operate, and recover the service | **Not shipped** | #202; Keyverse-compatible OIDC/SCIM, tenant isolation, policy/approval/evidence UI, SLO/incident controls, data residency, CSAP/SOC 2 evidence mapping, WCAG 2.2, Figma File ID, and Storybook | | P0 | A release has reproducible proof of usefulness, safety, evidence completeness, and recovery | **No product-wide release gate** | #203; deterministic, compatibility, adversarial, recovery, and enterprise suites with statistical reporting and an exact-artifact commercial acceptance gate | -| P0 | Valid changes reach protected `main` without authority improvisation or unbounded stack growth | **Blocked / high integration debt** | Shrink the 148-PR queue in dependency order, provision legitimate review authority, require exact-current evidence, and close duplicates/superseded branches | +| P0 | Valid changes reach protected `main` without authority improvisation or unbounded stack growth | **Blocked / high integration debt** | Shrink the 150-PR queue in dependency order, provision legitimate review authority, require exact-current evidence, and close duplicates/superseded branches | ## Commercial completion definition @@ -99,7 +99,7 @@ OriginWeave is not complete merely because every low-level primitive exists in s ## Next executable queue -1. Re-fetch all 148 PRs and compute the dependency graph, exact heads/bases, reviews, unresolved threads, current required checks, duplicate/supersession relationships, and branch ancestry. +1. Re-fetch all 150 PRs and compute the dependency graph, exact heads/bases, reviews, unresolved threads, current required checks, duplicate/supersession relationships, and branch ancestry. 2. Integrate merge-ready root PRs first; restack and independently revalidate only the immediate children. Close obsolete alternatives instead of carrying parallel truth. 3. Finish the #9/#28 browser-network and Chromium vertical slice, including the #195/#198 WebSocket opening path and the remaining framed BiDi command/response, semantic observation, policy, action, post-condition, and recovery boundaries. 4. Finish #27 and #10 as separate security tracks; neither should be hidden inside the first browser PR. @@ -144,9 +144,16 @@ jq '[.[][]]' "$EVIDENCE_DIR/collaborator-pages.json" \ jq -r '.[].number' "$EVIDENCE_DIR/open-prs.json" | while read -r PR; do STABLE_HEAD=false for ATTEMPT in 1 2 3; do + VERDICT_PATH="$EVIDENCE_DIR/pr-${PR}-merge-verdict.json" + VERDICT_TMP="$EVIDENCE_DIR/pr-${PR}-merge-verdict.json.tmp" + rm -f "$VERDICT_PATH" "$VERDICT_TMP" "$EVIDENCE_DIR/pr-${PR}-rechecked.json" PR_JSON="$EVIDENCE_DIR/pr-${PR}.json" gh api "repos/ContextualWisdomLab/OriginWeave/pulls/$PR" > "$PR_JSON" HEAD_SHA=$(jq -r '.head.sha' "$PR_JSON") + BASE_SHA=$(jq -r '.base.sha' "$PR_JSON") + + gh api "repos/ContextualWisdomLab/OriginWeave/commits/$HEAD_SHA" \ + > "$EVIDENCE_DIR/pr-${PR}-head-commit.json" gh api --paginate --slurp \ "repos/ContextualWisdomLab/OriginWeave/commits/$HEAD_SHA/check-runs?per_page=100" \ @@ -184,48 +191,86 @@ query($owner: String!, $name: String!, $number: Int!, $endCursor: String) { --slurpfile reviews "$EVIDENCE_DIR/pr-${PR}-reviews.json" \ --slurpfile workflow_runs "$EVIDENCE_DIR/pr-${PR}-workflow-runs.json" \ --slurpfile rules "$EVIDENCE_DIR/main-branch-rules.json" \ + --slurpfile collaborators "$EVIDENCE_DIR/collaborators.json" \ + --slurpfile head_commit "$EVIDENCE_DIR/pr-${PR}-head-commit.json" \ --slurpfile threads "$EVIDENCE_DIR/pr-${PR}-review-threads.json" \ - '{ - head_sha: $head, - base_sha: $pr[0].base.sha, - required_status_checks: { - check_runs: [$checks[]?.check_runs[]?], - legacy_statuses: [$statuses[][]?] - }, - workflow_runs: [$workflow_runs[]?.workflow_runs[]?], - counted_approvals: ([ - $reviews[][]? - | select(.state == "APPROVED") - | select(.submitted_at != null) - | select(.commit_id == $head) - ] | length), - required_workflows: [ + --arg base "$BASE_SHA" \ + '( + [ $rules[][]? - | select(.type == "workflows") - | .parameters.workflows[] - ], - unresolved_threads: [ - $threads[]?.data.repository.pullRequest.reviewThreads.nodes[]? - | select(.isResolved == false and .isOutdated == false) - ] - }' > "$EVIDENCE_DIR/pr-${PR}-merge-verdict.json" - + | select(.type == "pull_request") + | .parameters + ] | first // {} + ) as $pull_request_parameters + | ($head_commit[0].committer.login // $head_commit[0].author.login // "") as $last_push_actor + | ( + [ + $reviews[][][]? + | {reviewer: .user.login, state, submitted_at, commit_id} + | select(.submitted_at != null) + | select(.reviewer != $pr[0].user.login) + | select(.reviewer as $reviewer | + any($collaborators[][]?; + .login == $reviewer and + (.permissions.push == true or + .permissions.maintain == true or + .permissions.admin == true))) + ] + | group_by(.reviewer) + | map(sort_by(.submitted_at) | last) + | map(select( + ($pull_request_parameters.require_last_push_approval != true) + or .reviewer != $last_push_actor + )) + | map(select(.state == "APPROVED" and .commit_id == $head)) + ) as $current_approvals + | ($pull_request_parameters.required_approving_review_count // 0) as $required_review_count + | { + head_sha: $head, + base_sha: $base, + required_status_checks: { + check_runs: [$checks[][].check_runs[]?], + legacy_statuses: [$statuses[][][]?] + }, + workflow_runs: [$workflow_runs[][].workflow_runs[]?], + counted_approvals: ($current_approvals | length), + required_approving_review_count: $required_review_count, + require_last_push_approval: ($pull_request_parameters.require_last_push_approval // false), + approval_gate_satisfied: (($current_approvals | length) >= $required_review_count), + required_workflows: [ + $rules[][]? + | select(.type == "workflows") + | .parameters.workflows[] + ], + unresolved_threads: [ + $threads[][].data.repository.pullRequest.reviewThreads.nodes[]? + | select(.isResolved == false and .isOutdated == false) + ] + }' > "$VERDICT_TMP" + + RECHECKED_PR_JSON="$EVIDENCE_DIR/pr-${PR}-rechecked.json" RECHECKED_HEAD_SHA=$(gh api "repos/ContextualWisdomLab/OriginWeave/pulls/$PR" \ + | tee "$RECHECKED_PR_JSON" \ | jq -r '.head.sha') - if [[ "$RECHECKED_HEAD_SHA" == "$HEAD_SHA" ]]; then + RECHECKED_BASE_SHA=$(jq -r '.base.sha' "$RECHECKED_PR_JSON") + if [[ "$RECHECKED_HEAD_SHA" == "$HEAD_SHA" && "$RECHECKED_BASE_SHA" == "$BASE_SHA" ]]; then + mv "$VERDICT_TMP" "$VERDICT_PATH" + mv "$RECHECKED_PR_JSON" "$PR_JSON" STABLE_HEAD=true break fi - printf 'Discarding moving-head evidence for PR #%s (%s -> %s) and retrying.\n' \ - "$PR" "$HEAD_SHA" "$RECHECKED_HEAD_SHA" >&2 + rm -f "$VERDICT_TMP" "$RECHECKED_PR_JSON" + printf 'Discarding moving head/base evidence for PR #%s (head %s -> %s, base %s -> %s) and retrying.\n' \ + "$PR" "$HEAD_SHA" "$RECHECKED_HEAD_SHA" "$BASE_SHA" "$RECHECKED_BASE_SHA" >&2 done if [[ "$STABLE_HEAD" != true ]]; then - printf 'Unable to collect stable exact-head evidence for PR #%s after 3 attempts.\n' "$PR" >&2 + rm -f "$EVIDENCE_DIR"/pr-${PR}-*.json + printf 'Unable to collect stable exact-head/base evidence for PR #%s after 3 attempts.\n' "$PR" >&2 exit 1 fi done ``` -The branch-scoped rules response determines the active rules affecting `main`; each PR's exact `HEAD_SHA` then determines which check runs, legacy statuses, workflow runs, reviews, and unresolved threads are current. The saved merge verdict binds counted approvals to `APPROVED`, non-null submission times, and the exact head, while preserving required workflow rules. The saved PR JSON also preserves the exact base reference and branch ancestry input for the dependency graph. Evidence is retained only when the post-collection `RECHECKED_HEAD_SHA` equals the collected `HEAD_SHA`; a moving head fails after three bounded attempts. +The branch-scoped rules response determines the active rules affecting `main`; each PR's exact `HEAD_SHA` then determines which check runs, legacy statuses, workflow runs, reviews, and unresolved threads are current. The saved merge verdict binds counted approvals to the latest review per eligible collaborator, excludes the PR author and (when required) the last-push actor, applies the required approval count and last-push rule, and requires `APPROVED` on the exact head. The saved PR JSON also preserves the exact base reference and branch ancestry input for the dependency graph. Evidence is retained only when both `RECHECKED_HEAD_SHA` and `RECHECKED_BASE_SHA` match the collected values; a moving head or base discards the temporary verdict, and three failed attempts leave no unstable merge verdict. For standards and binding architecture, use [`doctoring.md`](doctoring.md), [`doctoring/browser-agent-protocols.md`](doctoring/browser-agent-protocols.md), [`PRD.md`](PRD.md), [`TRD.md`](TRD.md), [`product-roadmap.md`](product-roadmap.md), and linked ADR/UML/ERD/traceability records. Issues #199-#203 contain their own APA 7th standards and research traceability. This baseline intentionally records delivery state and never promotes planned adapters or active pull-request code to implemented behavior. diff --git a/tests/test_product_completion_gap_contract.py b/tests/test_product_completion_gap_contract.py index 156fc7026..c9584cc4f 100644 --- a/tests/test_product_completion_gap_contract.py +++ b/tests/test_product_completion_gap_contract.py @@ -17,9 +17,9 @@ def test_baseline_records_current_inventory_and_completion_issues(self) -> None: text = BASELINE.read_text(encoding="utf-8") for phrase in ( - "148 open pull requests", + "150 open pull requests", "38 non-draft", - "110 draft", + "112 draft", "#198", "#199", "#200", @@ -39,6 +39,8 @@ def test_baseline_records_current_inventory_and_completion_issues(self) -> None: "100 open pull requests", "22 non-draft", "78 draft", + "148 open pull requests", + "110 draft", "79 draft PRs", ): with self.subTest(stale_phrase=stale_phrase): @@ -61,26 +63,42 @@ def test_evidence_commands_reproduce_inventory_checks_and_review_state(self) -> '"repos/ContextualWisdomLab/OriginWeave/commits/$HEAD_SHA/statuses?per_page=100"', '"repos/ContextualWisdomLab/OriginWeave/pulls/$PR/reviews?per_page=100"', '"repos/ContextualWisdomLab/OriginWeave/actions/runs?head_sha=$HEAD_SHA&per_page=100"', - "workflow_runs: [$workflow_runs[]?.workflow_runs[]?],", + '"$EVIDENCE_DIR/pr-${PR}-head-commit.json"', + "check_runs: [$checks[][].check_runs[]?],", + "legacy_statuses: [$statuses[][][]?]", + "workflow_runs: [$workflow_runs[][].workflow_runs[]?],", "reviewThreads(first: 100, after: $endCursor)", "rules/branches/main?per_page=100", '"$EVIDENCE_DIR/main-branch-rule-pages.json"', + '"$EVIDENCE_DIR/collaborator-pages.json"', + '"$EVIDENCE_DIR/collaborators.json"', + '"$EVIDENCE_DIR/pr-${PR}-merge-verdict.json.tmp"', '.state == "APPROVED"', ".submitted_at != null", ".commit_id == $head", + "group_by(.reviewer)", + "required_approving_review_count", + "require_last_push_approval", + "$head_commit[0].committer.login", + "$pr[0].user.login", '.type == "workflows"', ".parameters.workflows", "required_status_checks", '"$EVIDENCE_DIR/pr-${PR}-merge-verdict.json"', "for ATTEMPT in 1 2 3; do", "RECHECKED_HEAD_SHA=", - '[[ "$RECHECKED_HEAD_SHA" == "$HEAD_SHA" ]]', + "RECHECKED_BASE_SHA=", + 'if [[ "$RECHECKED_HEAD_SHA" == "$HEAD_SHA" && "$RECHECKED_BASE_SHA" == "$BASE_SHA" ]]; then', ): with self.subTest(phrase=phrase): self.assertIn(phrase, shell) self.assertNotIn("while :; do", shell) self.assertNotIn("/tmp/originweave-open-pr", shell) + self.assertNotIn("check_runs: [$checks[]?.check_runs[]?],", shell) + self.assertNotIn("legacy_statuses: [$statuses[][]?]", shell) + self.assertNotIn("workflow_runs: [$workflow_runs[]?.workflow_runs[]?],", shell) + self.assertNotIn("$reviews[][]?\n | select(.state", shell) if __name__ == "__main__": From 1c2770263e0173fef598dca1d0967e2f41355b6d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 10:45:56 +0900 Subject: [PATCH 20/26] docs: refresh pull request queue baseline --- docs/product-technical-gap-baseline.md | 2 +- tests/test_product_completion_gap_contract.py | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index f1bc22178..cf8c50819 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -14,7 +14,7 @@ This is a dated delivery baseline, not a substitute for the PRD, TRD, roadmap, a ### Open pull requests -The live repository contained **150 open pull requests: 38 non-draft and 112 draft**. The volume and stack depth are themselves a product-delivery risk: review, exact-head checks, dependency order, and integration truth can drift faster than a buyer-visible vertical slice reaches protected `main`. +The live repository contained **150 open pull requests: 39 non-draft and 111 draft** after PR #70 moved to Ready for review. The volume and stack depth are themselves a product-delivery risk: review, exact-head checks, dependency order, and integration truth can drift faster than a buyer-visible vertical slice reaches protected `main`. Representative active workstreams at this snapshot were: diff --git a/tests/test_product_completion_gap_contract.py b/tests/test_product_completion_gap_contract.py index c9584cc4f..074707fab 100644 --- a/tests/test_product_completion_gap_contract.py +++ b/tests/test_product_completion_gap_contract.py @@ -18,8 +18,8 @@ def test_baseline_records_current_inventory_and_completion_issues(self) -> None: for phrase in ( "150 open pull requests", - "38 non-draft", - "112 draft", + "39 non-draft", + "111 draft", "#198", "#199", "#200", From c9874011fa7ca788cbbfc8bc8453cd4788f54e4c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 10:54:23 +0900 Subject: [PATCH 21/26] docs: refresh pull request queue baseline --- docs/product-technical-gap-baseline.md | 2 +- tests/test_product_completion_gap_contract.py | 5 ++--- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index cf8c50819..026e09026 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -14,7 +14,7 @@ This is a dated delivery baseline, not a substitute for the PRD, TRD, roadmap, a ### Open pull requests -The live repository contained **150 open pull requests: 39 non-draft and 111 draft** after PR #70 moved to Ready for review. The volume and stack depth are themselves a product-delivery risk: review, exact-head checks, dependency order, and integration truth can drift faster than a buyer-visible vertical slice reaches protected `main`. +The live repository contained **150 open pull requests: 40 non-draft and 110 draft** after PRs #70 and #71 moved to Ready for review. The volume and stack depth are themselves a product-delivery risk: review, exact-head checks, dependency order, and integration truth can drift faster than a buyer-visible vertical slice reaches protected `main`. Representative active workstreams at this snapshot were: diff --git a/tests/test_product_completion_gap_contract.py b/tests/test_product_completion_gap_contract.py index 074707fab..4b7bb1d38 100644 --- a/tests/test_product_completion_gap_contract.py +++ b/tests/test_product_completion_gap_contract.py @@ -18,8 +18,8 @@ def test_baseline_records_current_inventory_and_completion_issues(self) -> None: for phrase in ( "150 open pull requests", - "39 non-draft", - "111 draft", + "40 non-draft", + "110 draft", "#198", "#199", "#200", @@ -40,7 +40,6 @@ def test_baseline_records_current_inventory_and_completion_issues(self) -> None: "22 non-draft", "78 draft", "148 open pull requests", - "110 draft", "79 draft PRs", ): with self.subTest(stale_phrase=stale_phrase): From c433d2711d233ec723edd3d8ad623ec4ce65af6f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 11:42:13 +0900 Subject: [PATCH 22/26] docs: refresh active product gap evidence --- CHANGELOG.md | 1 + docs/product-technical-gap-baseline.md | 21 ++++++++++++++++--- ...cumentation_active_pr_evidence_contract.py | 15 +++++++++++++ 3 files changed, 34 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3ac6294cb..0bfec4954 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -34,6 +34,7 @@ All notable changes to OriginWeave are documented in this file. The format follo ### Changed +- Refreshed the product and technical gap baseline with the current open-PR inventory and exact base/head evidence for the newest Chromium, BAP, extraction, WARC, and idempotency slices. - Separated logical origin authority from resolved network destination authority; an origin grant no longer implies permission to connect to every resolver result. - Separated resolved-address authorization from direct transport evidence; an approved IP now becomes a usable stream only after the operating system reports the exact requested IP and port. - Separated exact TCP peer proof from authenticated TLS service identity; an observed peer becomes an authenticated HTTPS stream only after explicit-root, fixed-time, SAN-bound WebPKI verification over that same stream. diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 026e09026..e76daeaf8 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -14,21 +14,36 @@ This is a dated delivery baseline, not a substitute for the PRD, TRD, roadmap, a ### Open pull requests -The live repository contained **150 open pull requests: 40 non-draft and 110 draft** after PRs #70 and #71 moved to Ready for review. The volume and stack depth are themselves a product-delivery risk: review, exact-head checks, dependency order, and integration truth can drift faster than a buyer-visible vertical slice reaches protected `main`. +The live repository contained **150 open pull requests: 40 non-draft and 110 draft** after PRs #70 and #71 moved to Ready for review. The current snapshot also includes the newer #73 and #208–#211 product slices below. The volume and stack depth are themselves a product-delivery risk: review, exact-head checks, dependency order, and integration truth can drift faster than a buyer-visible vertical slice reaches protected `main`. Representative active workstreams at this snapshot were: | Workstream | Representative active PR evidence | Delivery boundary | |---|---|---| | Product baseline | #196 | Ready/non-draft documentation PR; this refreshed inventory and the completion issues below remain review-gated | -| WebDriver BiDi transport | #188 through #198 | #198, exact head `2e01bcd0fb3057b4a78c2f5dd58a5efd86bc26f2`, validates the RFC 6455 opening response on top of #195; the stack still does not by itself complete framed BiDi browser commands, authenticated browser-process provenance, semantic task execution, or protected-main shipment | +| WebDriver BiDi transport | #188 through #205 | #205, exact head `c5746a61ede9e0214be9c1feeff7f4f1af790016`, exercises a bounded `locateNodes` exchange on top of the opening-path stack; the stack still does not by itself complete authenticated browser-process provenance, semantic task execution, or protected-main shipment | | MCP adapter | #168 and #170 | Typed MCP routing and conservative `tools/list` metadata are active-PR foundations; complete authenticated transport, durable task lifecycle, cancellation/resume, and browser execution remain open under #200 | | Controlled Chromium and recovery | #65, #70-#73, #100, #105, #142-#153 and descendants | Real pinned-browser fixture, semantic location, resource, crash, and teardown evidence exists on active stacks; evidence does not transfer across heads or prerequisites | +| BAP and durable-evidence tracks | #208-#211 | Resumable lifecycle, schema-bound extraction, bounded WARC resources, and exact idempotent receipts are active-PR foundations; authenticated transport, durable ownership, replay, and browser side-effect reconciliation remain open | | Manifest V3 and native messaging | #27 and its active extension/native-host stack, including #154 and #169 | Compatibility and Agent-authority isolation remain incomplete until exact release artifacts and platform matrices are proven | | Sensitive-data and model route policy | #10 and its active policy stacks | Deterministic policy values exist, but trusted broker execution, retention/deletion, runtime isolation, and auditable product workflows remain open | | VPN/profile intent | #149 | Bounded WireGuard/IKEv2 profile authority is active-PR evidence; it does not create a tunnel, route, DNS state, authenticated gateway, or connectivity proof | -Draft PR #198 is the current top WebDriver BiDi opening-response slice; its prerequisite #195 owns the bounded opening-request write. It remains draft evidence and cannot be treated as shipped behavior. +Draft PR #205 is the current top WebDriver BiDi locate-nodes slice; its opening-path prerequisites #195 and #198 remain draft evidence and cannot be treated as shipped behavior. + +#### Current exact-head active PR evidence + +The following newest product slices were re-fetched from GitHub for this snapshot. Their exact base/head pairs are recorded so later checks, reviews, and restacks cannot be confused with predecessor evidence: + +| PR | State | Exact base head | Exact head | +|---|---|---|---| +| #73 | Draft | `da99395b09b419845b4a1222a0725482e9231466` | `7861d88d21ed0f0adaeb467957e809826f835071` | +| #208 | Draft | `0841d2ab3d8b5e60a03c0a8e818cf438e2716829` | `c3b6e1a475dce333f6115e5113cae9c07974835f` | +| #209 | Draft | `0841d2ab3d8b5e60a03c0a8e818cf438e2716829` | `69bc738bd45a1b61a4673b122dc3eec8814baa22` | +| #210 | Draft | `69bc738bd45a1b61a4673b122dc3eec8814baa22` | `999979a511c3a890ba93a1a09da8810858877940` | +| #211 | Draft | `c3b6e1a475dce333f6115e5113cae9c07974835f` | `f6e3a3adcfb9cc7a60ef1d79e2aeee27ba54c084` | + +These rows are delivery evidence only. #73's latest Strix remediation is locally verified but its required policy workflows remain queued; #208–#211 are stacked product-gap foundations with no protected-main promotion. None has counted independent approval in the current collaborator inventory. #### #195/#198 WebDriver BiDi opening path status diff --git a/tests/test_documentation_active_pr_evidence_contract.py b/tests/test_documentation_active_pr_evidence_contract.py index d2a067e50..466f1105c 100644 --- a/tests/test_documentation_active_pr_evidence_contract.py +++ b/tests/test_documentation_active_pr_evidence_contract.py @@ -8,6 +8,7 @@ DOCS = ROOT / "docs" FITNESS = DOCS / "DOCUMENTATION_FITNESS.md" MATURITY = DOCS / "evidence" / "2026-08-10-active-pr-maturity.md" +BASELINE = DOCS / "product-technical-gap-baseline.md" def active_pr_row(text: str, pr_number: int) -> str: @@ -28,6 +29,20 @@ class ActivePullRequestDocumentationContractTests(unittest.TestCase): def setUpClass(cls) -> None: cls.fitness = FITNESS.read_text(encoding="utf-8") cls.maturity = MATURITY.read_text(encoding="utf-8") + cls.baseline = BASELINE.read_text(encoding="utf-8") + + def test_latest_live_pr_snapshot_is_recorded_in_the_product_baseline(self) -> None: + """The baseline must preserve exact heads for the newest active product slices.""" + for marker in ( + "Current exact-head active PR evidence", + "| #73 | Draft | `da99395b09b419845b4a1222a0725482e9231466` | `7861d88d21ed0f0adaeb467957e809826f835071` |", + "| #208 | Draft | `0841d2ab3d8b5e60a03c0a8e818cf438e2716829` | `c3b6e1a475dce333f6115e5113cae9c07974835f` |", + "| #209 | Draft | `0841d2ab3d8b5e60a03c0a8e818cf438e2716829` | `69bc738bd45a1b61a4673b122dc3eec8814baa22` |", + "| #210 | Draft | `69bc738bd45a1b61a4673b122dc3eec8814baa22` | `999979a511c3a890ba93a1a09da8810858877940` |", + "| #211 | Draft | `c3b6e1a475dce333f6115e5113cae9c07974835f` | `f6e3a3adcfb9cc7a60ef1d79e2aeee27ba54c084` |", + ): + with self.subTest(marker=marker): + self.assertIn(marker, self.baseline) def test_dependency_stacks_are_explicit_and_non_shipped(self) -> None: """Current browser, network, sensitive and compatibility stacks stay active-only.""" From bc6292b7cde2023870a6ad9f4154dde3d6d83d9b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 11:44:40 +0900 Subject: [PATCH 23/26] docs: reconcile baseline changelog evidence --- CHANGELOG.md | 4 ++-- ...test_documentation_active_pr_evidence_contract.py | 12 ++++++++++++ 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0bfec4954..f5d30d1f5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,7 @@ All notable changes to OriginWeave are documented in this file. The format follo ### Added - Added a dated product and technical gap baseline that separates protected-main implementation truth, active pull-request evidence, live review/check blockers, and the next buyer-visible Phase 1 acceptance work. +- Refreshed the product and technical gap baseline with the current open-PR inventory and exact base/head evidence for the newest Chromium, BAP, extraction, WARC, and idempotency slices. - Bound explicit extension-to-Agent grants to exclusive trusted-time expiry in addition to extension identity, session, browsing context, and canonical origin, so a same-origin grant cannot be reused at or after the deadline. - Bound explicit extension-to-Agent grants to the exact canonical origin in addition to extension identity, session, and browsing context, so a same-session navigation or port change cannot reuse the grant. - Rust workspace for independently reusable core, policy, destination, network, TLS, resource, and evidence modules. @@ -34,7 +35,6 @@ All notable changes to OriginWeave are documented in this file. The format follo ### Changed -- Refreshed the product and technical gap baseline with the current open-PR inventory and exact base/head evidence for the newest Chromium, BAP, extraction, WARC, and idempotency slices. - Separated logical origin authority from resolved network destination authority; an origin grant no longer implies permission to connect to every resolver result. - Separated resolved-address authorization from direct transport evidence; an approved IP now becomes a usable stream only after the operating system reports the exact requested IP and port. - Separated exact TCP peer proof from authenticated TLS service identity; an observed peer becomes an authenticated HTTPS stream only after explicit-root, fixed-time, SAN-bound WebPKI verification over that same stream. @@ -49,7 +49,7 @@ All notable changes to OriginWeave are documented in this file. The format follo - Moved autonomous-agent Cargo targets and Python bytecode caches outside the proposed source tree and prefetched locked Cargo dependencies for offline verification. - Updated research doctoring to pin Chromium canonicalizer evidence to an immutable revision, add RFC 9293, RFC 5280, RFC 8446, RFC 9525, rustls 0.23.42, and Rust `TcpStream` evidence, distinguish the April 2026 Fugu beta from the June 2026 release, and treat vendor benchmark claims as first-party evidence rather than independent validation. - Tightened the product-baseline contract so the BiDi opening path and VPN/profile evidence retain their explicit not-shipped status within their own documentation sections. -- Refreshed the product and technical gap baseline against the 2026-08-21 live inventory: 150 open pull requests, 112 drafts, and the new hardened-runner/MV3 evidence gap issue #206. +- Refreshed the product and technical gap baseline against the 2026-08-21 live inventory: 150 open pull requests, 110 drafts, and the new hardened-runner/MV3 evidence gap issue #206. - Refreshed the baseline's merge-authority statement to the live ruleset: two approving reviews are required, while the collaborator inventory still contains only the solo maintainer. - Corrected the baseline evidence collector to flatten every paginated input, apply current reviewer and last-push approval semantics, and discard verdicts when either the PR head or base moves. diff --git a/tests/test_documentation_active_pr_evidence_contract.py b/tests/test_documentation_active_pr_evidence_contract.py index 466f1105c..34e8a0238 100644 --- a/tests/test_documentation_active_pr_evidence_contract.py +++ b/tests/test_documentation_active_pr_evidence_contract.py @@ -9,6 +9,7 @@ FITNESS = DOCS / "DOCUMENTATION_FITNESS.md" MATURITY = DOCS / "evidence" / "2026-08-10-active-pr-maturity.md" BASELINE = DOCS / "product-technical-gap-baseline.md" +CHANGELOG = ROOT / "CHANGELOG.md" def active_pr_row(text: str, pr_number: int) -> str: @@ -30,6 +31,7 @@ def setUpClass(cls) -> None: cls.fitness = FITNESS.read_text(encoding="utf-8") cls.maturity = MATURITY.read_text(encoding="utf-8") cls.baseline = BASELINE.read_text(encoding="utf-8") + cls.changelog = CHANGELOG.read_text(encoding="utf-8") def test_latest_live_pr_snapshot_is_recorded_in_the_product_baseline(self) -> None: """The baseline must preserve exact heads for the newest active product slices.""" @@ -44,6 +46,16 @@ def test_latest_live_pr_snapshot_is_recorded_in_the_product_baseline(self) -> No with self.subTest(marker=marker): self.assertIn(marker, self.baseline) + def test_baseline_refresh_changelog_matches_the_live_snapshot(self) -> None: + """The changelog must classify and state the same baseline refresh.""" + refresh = "Refreshed the product and technical gap baseline with the current open-PR inventory" + added = self.changelog.split("### Added", 1)[1].split("### Changed", 1)[0] + changed = self.changelog.split("### Changed", 1)[1].split("### Security", 1)[0] + self.assertIn(refresh, added) + self.assertNotIn(refresh, changed) + self.assertIn("150 open pull requests, 110 drafts", self.changelog) + self.assertNotIn("150 open pull requests, 112 drafts", self.changelog) + def test_dependency_stacks_are_explicit_and_non_shipped(self) -> None: """Current browser, network, sensitive and compatibility stacks stay active-only.""" for pr_number in (52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66): From b7c210bf1f0383d25450d6f66521c1e43dafd36f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 24 Aug 2026 12:19:23 +0900 Subject: [PATCH 24/26] docs: refresh gap baseline onto 2026-08-24 live inventory - Record 158 open PRs (44 ready, 114 draft) with refreshed exact base/head evidence for the #208-#222 release, enterprise-approval, BAP, and WARC/PROV chains while retaining the 2026-08-21 rows as regression anchors. - Add governance issues #212 and #215 to the operational signal table and note issue #206 closure between snapshots. - Record the required-check provider-failure RCA for the fail-closed Strix re-dispatches on #208, #218, and #220 without weakening the gate. - Tighten the completion-gap contract so superseded inventory counts cannot pass as current evidence. --- CHANGELOG.md | 2 + docs/product-technical-gap-baseline.md | 50 +++++++++++++++---- tests/test_product_completion_gap_contract.py | 9 ++-- tests/test_product_documentation_contract.py | 2 +- 4 files changed, 50 insertions(+), 13 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f5d30d1f5..9846f6968 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,7 @@ All notable changes to OriginWeave are documented in this file. The format follo ### Added +- Refreshed the product and technical gap baseline with the 2026-08-24 live inventory: 158 open pull requests (44 ready, 114 draft), refreshed exact base/head evidence for the #208–#222 release, enterprise-approval, BAP, and WARC/PROV chains, the governance issue additions #212 and #215, and a required-check provider-failure record for the fail-closed Strix re-dispatches on #208/#218/#220. - Added a dated product and technical gap baseline that separates protected-main implementation truth, active pull-request evidence, live review/check blockers, and the next buyer-visible Phase 1 acceptance work. - Refreshed the product and technical gap baseline with the current open-PR inventory and exact base/head evidence for the newest Chromium, BAP, extraction, WARC, and idempotency slices. - Bound explicit extension-to-Agent grants to exclusive trusted-time expiry in addition to extension identity, session, browsing context, and canonical origin, so a same-origin grant cannot be reused at or after the deadline. @@ -50,6 +51,7 @@ All notable changes to OriginWeave are documented in this file. The format follo - Updated research doctoring to pin Chromium canonicalizer evidence to an immutable revision, add RFC 9293, RFC 5280, RFC 8446, RFC 9525, rustls 0.23.42, and Rust `TcpStream` evidence, distinguish the April 2026 Fugu beta from the June 2026 release, and treat vendor benchmark claims as first-party evidence rather than independent validation. - Tightened the product-baseline contract so the BiDi opening path and VPN/profile evidence retain their explicit not-shipped status within their own documentation sections. - Refreshed the product and technical gap baseline against the 2026-08-21 live inventory: 150 open pull requests, 110 drafts, and the new hardened-runner/MV3 evidence gap issue #206. +- Tightened the baseline completion-gap contract so superseded inventory counts (including the 2026-08-21 150/40/110 snapshot) can no longer pass as current evidence. - Refreshed the baseline's merge-authority statement to the live ruleset: two approving reviews are required, while the collaborator inventory still contains only the solo maintainer. - Corrected the baseline evidence collector to flatten every paginated input, apply current reviewer and last-push approval semantics, and discard verdicts when either the PR head or base moves. diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index e76daeaf8..e29438545 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,11 +2,11 @@ This is a dated delivery baseline, not a substitute for the PRD, TRD, roadmap, architecture decisions, or live GitHub state. It keeps buyer-visible gaps, current issues, active pull-request evidence, and commercial completion tracks in one discoverable place. Protected `main` is the implementation boundary: code in an open pull request is not shipped behavior. -## Observed snapshot: 2026-08-21 +## Observed snapshot: 2026-08-24 ### Protected-main truth -- Protected `main` was at `0841d2ab3d8b5e60a03c0a8e818cf438e2716829` when this snapshot was refreshed. +- Protected `main` remained at `0841d2ab3d8b5e60a03c0a8e818cf438e2716829` when this snapshot was refreshed. - Phase 0 is documented as complete as a reusable safety-kernel foundation: typed policy contracts, destination classification, direct TCP peer verification, TLS service identity, evidence bounds, resource mitigation, document-node authority, and protected-main tests. - Phase 1 is **in progress**, not shipped. The first real Chromium vertical slice still needs the active WebDriver BiDi transport stack to reach protected `main`, then compose isolated Chromium launch, session/context identity, semantic observation, typed action authorization, native browser input, post-condition proof, evidence, cancellation, crash recovery, and profile/process teardown. - HTTP/1.1 bounds, downloads/MIME, proxy/PAC consumption, full browser-network integration, the sensitive-data broker runtime, durable WARC/PROV capture, persistent task/API surfaces, signed cross-platform distribution, enterprise administration, and release-grade buyer acceptance remain open. @@ -14,17 +14,21 @@ This is a dated delivery baseline, not a substitute for the PRD, TRD, roadmap, a ### Open pull requests -The live repository contained **150 open pull requests: 40 non-draft and 110 draft** after PRs #70 and #71 moved to Ready for review. The current snapshot also includes the newer #73 and #208–#211 product slices below. The volume and stack depth are themselves a product-delivery risk: review, exact-head checks, dependency order, and integration truth can drift faster than a buyer-visible vertical slice reaches protected `main`. +The live repository contained **158 open pull requests: 44 non-draft and 114 draft** when this snapshot re-paginated the complete open inventory. The volume and stack depth are themselves a product-delivery risk: review, exact-head checks, dependency order, and integration truth can drift faster than a buyer-visible vertical slice reaches protected `main`. Representative active workstreams at this snapshot were: | Workstream | Representative active PR evidence | Delivery boundary | |---|---|---| -| Product baseline | #196 | Ready/non-draft documentation PR; this refreshed inventory and the completion issues below remain review-gated | -| WebDriver BiDi transport | #188 through #205 | #205, exact head `c5746a61ede9e0214be9c1feeff7f4f1af790016`, exercises a bounded `locateNodes` exchange on top of the opening-path stack; the stack still does not by itself complete authenticated browser-process provenance, semantic task execution, or protected-main shipment | +| Product baseline | #196 | Ready/non-draft documentation PR; all exact-head checks passed and review threads resolved, blocked only by the reviewer-provisioning gap below | +| Enterprise approval authority | #220 | Ready/non-draft bounded maker-checker approval lifecycle on the exact `ApprovalScope`; Strix re-scan was re-dispatched after a provider-unavailability failure | +| Release artifact identity | #218 and #219 | Ready/non-draft fail-closed benchmark release decision and canonical release manifest binding; #218's Strix re-scan was re-dispatched after provider unavailability | +| Evidence path conformance | #216 | Ready/non-draft RFC 3986 evidence-path syntax enforcement | +| Schema-bound extraction and BAP lifecycle | #209 and #208 | Ready/non-draft schema-bound extraction contract and resumable task-lifecycle kernel; #208's Strix re-scan was re-dispatched after provider unavailability | +| WebDriver BiDi transport | #188 through #205 | Draft stack exercising framed `locateNodes` exchange over a bounded WebSocket opening path; still no authenticated browser-process provenance, semantic task execution, or protected-main shipment | | MCP adapter | #168 and #170 | Typed MCP routing and conservative `tools/list` metadata are active-PR foundations; complete authenticated transport, durable task lifecycle, cancellation/resume, and browser execution remain open under #200 | | Controlled Chromium and recovery | #65, #70-#73, #100, #105, #142-#153 and descendants | Real pinned-browser fixture, semantic location, resource, crash, and teardown evidence exists on active stacks; evidence does not transfer across heads or prerequisites | -| BAP and durable-evidence tracks | #208-#211 | Resumable lifecycle, schema-bound extraction, bounded WARC resources, and exact idempotent receipts are active-PR foundations; authenticated transport, durable ownership, replay, and browser side-effect reconciliation remain open | +| Durable WARC/PROV evidence | #210, #217 | Bounded WARC resource records and PROV JSON-LD binding are draft active-PR foundations; durable ownership, replay, retention/deletion, and browser side-effect reconciliation remain open | | Manifest V3 and native messaging | #27 and its active extension/native-host stack, including #154 and #169 | Compatibility and Agent-authority isolation remain incomplete until exact release artifacts and platform matrices are proven | | Sensitive-data and model route policy | #10 and its active policy stacks | Deterministic policy values exist, but trusted broker execution, retention/deletion, runtime isolation, and auditable product workflows remain open | | VPN/profile intent | #149 | Bounded WireGuard/IKEv2 profile authority is active-PR evidence; it does not create a tunnel, route, DNS state, authenticated gateway, or connectivity proof | @@ -45,6 +49,31 @@ The following newest product slices were re-fetched from GitHub for this snapsho These rows are delivery evidence only. #73's latest Strix remediation is locally verified but its required policy workflows remain queued; #208–#211 are stacked product-gap foundations with no protected-main promotion. None has counted independent approval in the current collaborator inventory. +#### Refreshed exact-head active PR evidence: 2026-08-24 + +The following newest slices were re-fetched from GitHub for this snapshot. Heads have moved since the 2026-08-21 rows above; those predecessor rows are retained as regression anchors and must never be promoted to current-head evidence: + +| PR | State | Exact base head | Exact head | +|---|---|---|---| +| #222 | Draft | `56fcfa56525e4f2e980e0ee05b6776d621bcddc5` | `1e2ce3d4071a1a75ee891bdcd71c506b3b50d4bc` | +| #221 | Draft | `8145d40f1b028a8f4dc7e7da47ac89bb9e5bb2c7` | `6f339df1e5b3ddb265f4ddd7b262d4de1e0b5e1f` | +| #220 | Ready | `0841d2ab3d8b5e60a03c0a8e818cf438e2716829` | `ed4cab16cf88c76ce1c145a22d0a274ef2d57263` | +| #219 | Ready | `0841d2ab3d8b5e60a03c0a8e818cf438e2716829` | `8145d40f1b028a8f4dc7e7da47ac89bb9e5bb2c7` | +| #218 | Ready | `0841d2ab3d8b5e60a03c0a8e818cf438e2716829` | `49e98fba6974219b3bb0336c822b12667f1e1c03` | +| #217 | Draft | `529d11a3571f6b1834b9baa49ef67eb08f043978` | `56fcfa56525e4f2e980e0ee05b6776d621bcddc5` | +| #216 | Ready | `0841d2ab3d8b5e60a03c0a8e818cf438e2716829` | `75130851a0f7ce528a7a36382eb026ac7942a0aa` | +| #214 | Draft | `40d642d5470a7753b8211907c190367f742f2f12` | `f79999681866ecf0e5fe17d895170f3f6cae7361` | +| #211 | Draft | `85cc477688246900697f4cfb91c0c8f1f692934a` | `40d642d5470a7753b8211907c190367f742f2f12` | +| #210 | Draft | `c38b9665774d6b3754e572bed527737b5e179833` | `529d11a3571f6b1834b9baa49ef67eb08f043978` | +| #209 | Ready | `0841d2ab3d8b5e60a03c0a8e818cf438e2716829` | `c38b9665774d6b3754e572bed527737b5e179833` | +| #208 | Ready | `0841d2ab3d8b5e60a03c0a8e818cf438e2716829` | `85cc477688246900697f4cfb91c0c8f1f692934a` | + +The stack topology shows #209 → #210 → #217 → #222 (WARC/PROV chain), #208 → #211 → #214 (BAP chain), #218 → #221 → #220 (release/enterprise chain) at this snapshot. Every row above remains active-PR evidence; none is protected-main behavior. + +### Required-check provider failure record + +On 2026-08-23 the required Strix security scan failed closed on exact heads of #220 (`ed4cab16…`), #218 (`49e98fba…`), and #208 (`85cc4776…`) because its LLM provider/backend was unavailable (rate limit, token cap, connection, warm-up, or model-behavior failure); no vulnerability report artifact was produced, so the workflow correctly refused to convert an incomplete scan into passing security evidence. Failed jobs were re-dispatched on the unchanged exact heads on 2026-08-24. This is a provider-infrastructure failure record, not a weakening of the fail-closed gate or a substitute for a completed authoritative scan. + #### #195/#198 WebDriver BiDi opening path status Phase 1 is **in progress**, not shipped. #195 and #198 provide bounded WebSocket opening-path evidence on active branches; framed BiDi commands, authenticated browser-process provenance, semantic task execution, and protected-main integration remain open. @@ -71,12 +100,15 @@ This gap does not authorize self-approval, administrative bypass, stale-head mer | #10 | Purpose-bound operational PII disclosure and trusted broker/storage lifecycle | | #123 | Fleet incident: disable orphaned TLS, HTTP, and one-shot workflow identities | | #187 | Manual-authority review of the coverage-diagnostics workflow delta | +| #212 | Governance: remove or independently authorize the PR #43 MV3 workflow mutation | +| #215 | Governance: restore an enforceable protected-main policy that does not create a routine admin bypass | | #199 | Schema-bound extraction with durable WARC/PROV replay, retention, deletion, and offline verification | | #200 | Stable BAP/MCP runtime API with authenticated, idempotent, cancellable, resumable task lifecycle | | #201 | Signed cross-platform Chromium distribution, installer/updater, patch SLA, rollback, SBOM, and provenance | | #202 | Enterprise control and experience plane: operator UI, Keyverse-compatible identity, tenancy, approval, audit, SLO, Figma, and Storybook | | #203 | Release-grade web-agent benchmark and commercial acceptance gate bound to exact signed artifacts | -| #206 | Harden-runner custom detection initialization failure while the MV3 gate remains green | + +Issue #206 (harden-runner custom detection initialization failure) was closed after its remediation landed on protected `main` between snapshots. The five newly separated product-completion tracks are **durable WARC/PROV replay**, **stable BAP/MCP runtime API**, **signed cross-platform Chromium distribution**, **enterprise control and experience plane**, and the **commercial acceptance gate**. They are separate issues because each has a distinct authority, data, release, and buyer-acceptance boundary. @@ -95,7 +127,7 @@ The hourly product-development loop is operational infrastructure, not proof tha | P1 | Buyers can install, update, verify, and roll back a supported product | **Not shipped** | #201; signed Windows/macOS/Linux/headless artifacts, Chromium revision manifest, updater security, patch SLA, SBOM, SLSA provenance, and recovery | | P1 | Enterprise teams can provision, approve, audit, operate, and recover the service | **Not shipped** | #202; Keyverse-compatible OIDC/SCIM, tenant isolation, policy/approval/evidence UI, SLO/incident controls, data residency, CSAP/SOC 2 evidence mapping, WCAG 2.2, Figma File ID, and Storybook | | P0 | A release has reproducible proof of usefulness, safety, evidence completeness, and recovery | **No product-wide release gate** | #203; deterministic, compatibility, adversarial, recovery, and enterprise suites with statistical reporting and an exact-artifact commercial acceptance gate | -| P0 | Valid changes reach protected `main` without authority improvisation or unbounded stack growth | **Blocked / high integration debt** | Shrink the 150-PR queue in dependency order, provision legitimate review authority, require exact-current evidence, and close duplicates/superseded branches | +| P0 | Valid changes reach protected `main` without authority improvisation or unbounded stack growth | **Blocked / high integration debt** | Shrink the 158-PR queue in dependency order, provision legitimate review authority, require exact-current evidence, and close duplicates/superseded branches | ## Commercial completion definition @@ -114,7 +146,7 @@ OriginWeave is not complete merely because every low-level primitive exists in s ## Next executable queue -1. Re-fetch all 150 PRs and compute the dependency graph, exact heads/bases, reviews, unresolved threads, current required checks, duplicate/supersession relationships, and branch ancestry. +1. Re-fetch all 158 open PRs and compute the dependency graph, exact heads/bases, reviews, unresolved threads, current required checks, duplicate/supersession relationships, and branch ancestry. Re-dispatch required checks that failed closed on provider infrastructure instead of code defects. 2. Integrate merge-ready root PRs first; restack and independently revalidate only the immediate children. Close obsolete alternatives instead of carrying parallel truth. 3. Finish the #9/#28 browser-network and Chromium vertical slice, including the #195/#198 WebSocket opening path and the remaining framed BiDi command/response, semantic observation, policy, action, post-condition, and recovery boundaries. 4. Finish #27 and #10 as separate security tracks; neither should be hidden inside the first browser PR. diff --git a/tests/test_product_completion_gap_contract.py b/tests/test_product_completion_gap_contract.py index 4b7bb1d38..e5f33067a 100644 --- a/tests/test_product_completion_gap_contract.py +++ b/tests/test_product_completion_gap_contract.py @@ -17,9 +17,9 @@ def test_baseline_records_current_inventory_and_completion_issues(self) -> None: text = BASELINE.read_text(encoding="utf-8") for phrase in ( - "150 open pull requests", - "40 non-draft", - "110 draft", + "158 open pull requests", + "44 non-draft", + "114 draft", "#198", "#199", "#200", @@ -41,6 +41,9 @@ def test_baseline_records_current_inventory_and_completion_issues(self) -> None: "78 draft", "148 open pull requests", "79 draft PRs", + "150 open pull requests", + "40 non-draft", + "110 draft", ): with self.subTest(stale_phrase=stale_phrase): self.assertNotIn(stale_phrase, text) diff --git a/tests/test_product_documentation_contract.py b/tests/test_product_documentation_contract.py index 211223c8f..5a1c1133c 100644 --- a/tests/test_product_documentation_contract.py +++ b/tests/test_product_documentation_contract.py @@ -44,7 +44,7 @@ def test_product_technical_gap_baseline_records_live_delivery_state(self) -> Non self.assertTrue(baseline.is_file()) text = baseline.read_text(encoding="utf-8") for phrase in ( - "Observed snapshot: 2026-08-21", + "Observed snapshot: 2026-08-24", "Protected-main truth", "Open pull requests", "Open issues", From 5c41742a9ad6c3be27d269e84eab1ead1272be13 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 23 Aug 2026 20:39:35 -0700 Subject: [PATCH 25/26] test(docs): fail closed on unknown last-push actor --- tests/test_product_completion_gap_contract.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/tests/test_product_completion_gap_contract.py b/tests/test_product_completion_gap_contract.py index e5f33067a..839393f30 100644 --- a/tests/test_product_completion_gap_contract.py +++ b/tests/test_product_completion_gap_contract.py @@ -65,7 +65,6 @@ def test_evidence_commands_reproduce_inventory_checks_and_review_state(self) -> '"repos/ContextualWisdomLab/OriginWeave/commits/$HEAD_SHA/statuses?per_page=100"', '"repos/ContextualWisdomLab/OriginWeave/pulls/$PR/reviews?per_page=100"', '"repos/ContextualWisdomLab/OriginWeave/actions/runs?head_sha=$HEAD_SHA&per_page=100"', - '"$EVIDENCE_DIR/pr-${PR}-head-commit.json"', "check_runs: [$checks[][].check_runs[]?],", "legacy_statuses: [$statuses[][][]?]", "workflow_runs: [$workflow_runs[][].workflow_runs[]?],", @@ -81,7 +80,9 @@ def test_evidence_commands_reproduce_inventory_checks_and_review_state(self) -> "group_by(.reviewer)", "required_approving_review_count", "require_last_push_approval", - "$head_commit[0].committer.login", + "last_push_approval_authority", + '"github_rule_evaluation_required"', + "if $pull_request_parameters.require_last_push_approval == true then false", "$pr[0].user.login", '.type == "workflows"', ".parameters.workflows", @@ -101,6 +102,9 @@ def test_evidence_commands_reproduce_inventory_checks_and_review_state(self) -> self.assertNotIn("legacy_statuses: [$statuses[][]?]", shell) self.assertNotIn("workflow_runs: [$workflow_runs[]?.workflow_runs[]?],", shell) self.assertNotIn("$reviews[][]?\n | select(.state", shell) + self.assertNotIn("head-commit.json", shell) + self.assertNotIn("$head_commit[0].committer.login", shell) + self.assertNotIn("$head_commit[0].author.login", shell) if __name__ == "__main__": From c990ad60e14848bd7fb9f602c82afc198378f85f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 23 Aug 2026 20:43:28 -0700 Subject: [PATCH 26/26] fix(docs): fail closed on last-push approval authority --- docs/product-technical-gap-baseline.md | 28 ++++++++++++++------------ 1 file changed, 15 insertions(+), 13 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index e29438545..234e6ae5c 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -199,9 +199,6 @@ jq -r '.[].number' "$EVIDENCE_DIR/open-prs.json" | while read -r PR; do HEAD_SHA=$(jq -r '.head.sha' "$PR_JSON") BASE_SHA=$(jq -r '.base.sha' "$PR_JSON") - gh api "repos/ContextualWisdomLab/OriginWeave/commits/$HEAD_SHA" \ - > "$EVIDENCE_DIR/pr-${PR}-head-commit.json" - gh api --paginate --slurp \ "repos/ContextualWisdomLab/OriginWeave/commits/$HEAD_SHA/check-runs?per_page=100" \ > "$EVIDENCE_DIR/pr-${PR}-check-runs.json" @@ -239,7 +236,6 @@ query($owner: String!, $name: String!, $number: Int!, $endCursor: String) { --slurpfile workflow_runs "$EVIDENCE_DIR/pr-${PR}-workflow-runs.json" \ --slurpfile rules "$EVIDENCE_DIR/main-branch-rules.json" \ --slurpfile collaborators "$EVIDENCE_DIR/collaborators.json" \ - --slurpfile head_commit "$EVIDENCE_DIR/pr-${PR}-head-commit.json" \ --slurpfile threads "$EVIDENCE_DIR/pr-${PR}-review-threads.json" \ --arg base "$BASE_SHA" \ '( @@ -249,7 +245,6 @@ query($owner: String!, $name: String!, $number: Int!, $endCursor: String) { | .parameters ] | first // {} ) as $pull_request_parameters - | ($head_commit[0].committer.login // $head_commit[0].author.login // "") as $last_push_actor | ( [ $reviews[][][]? @@ -265,13 +260,10 @@ query($owner: String!, $name: String!, $number: Int!, $endCursor: String) { ] | group_by(.reviewer) | map(sort_by(.submitted_at) | last) - | map(select( - ($pull_request_parameters.require_last_push_approval != true) - or .reviewer != $last_push_actor - )) | map(select(.state == "APPROVED" and .commit_id == $head)) ) as $current_approvals | ($pull_request_parameters.required_approving_review_count // 0) as $required_review_count + | ($pull_request_parameters.require_last_push_approval // false) as $require_last_push_approval | { head_sha: $head, base_sha: $base, @@ -282,8 +274,18 @@ query($owner: String!, $name: String!, $number: Int!, $endCursor: String) { workflow_runs: [$workflow_runs[][].workflow_runs[]?], counted_approvals: ($current_approvals | length), required_approving_review_count: $required_review_count, - require_last_push_approval: ($pull_request_parameters.require_last_push_approval // false), - approval_gate_satisfied: (($current_approvals | length) >= $required_review_count), + require_last_push_approval: $require_last_push_approval, + last_push_approval_authority: ( + if $require_last_push_approval == true + then "github_rule_evaluation_required" + else "not_required" + end + ), + approval_gate_satisfied: ( + if $pull_request_parameters.require_last_push_approval == true then false + else (($current_approvals | length) >= $required_review_count) + end + ), required_workflows: [ $rules[][]? | select(.type == "workflows") @@ -318,6 +320,6 @@ query($owner: String!, $name: String!, $number: Int!, $endCursor: String) { done ``` -The branch-scoped rules response determines the active rules affecting `main`; each PR's exact `HEAD_SHA` then determines which check runs, legacy statuses, workflow runs, reviews, and unresolved threads are current. The saved merge verdict binds counted approvals to the latest review per eligible collaborator, excludes the PR author and (when required) the last-push actor, applies the required approval count and last-push rule, and requires `APPROVED` on the exact head. The saved PR JSON also preserves the exact base reference and branch ancestry input for the dependency graph. Evidence is retained only when both `RECHECKED_HEAD_SHA` and `RECHECKED_BASE_SHA` match the collected values; a moving head or base discards the temporary verdict, and three failed attempts leave no unstable merge verdict. +The branch-scoped rules response determines the active rules affecting `main`; each PR's exact `HEAD_SHA` then determines which check runs, legacy statuses, workflow runs, reviews, and unresolved threads are current. The saved merge verdict binds counted approvals to the latest review per eligible collaborator, excludes the PR author, and requires `APPROVED` on the exact head. It deliberately does **not** infer GitHub's actual last-push actor from commit author or committer metadata: when `require_last_push_approval` is active, this portable evidence procedure records `github_rule_evaluation_required` and keeps `approval_gate_satisfied` false until GitHub's authoritative rule evaluation is consulted. The saved PR JSON also preserves the exact base reference and branch ancestry input for the dependency graph. Evidence is retained only when both `RECHECKED_HEAD_SHA` and `RECHECKED_BASE_SHA` match the collected values; a moving head or base discards the temporary verdict, and three failed attempts leave no unstable merge verdict. -For standards and binding architecture, use [`doctoring.md`](doctoring.md), [`doctoring/browser-agent-protocols.md`](doctoring/browser-agent-protocols.md), [`PRD.md`](PRD.md), [`TRD.md`](TRD.md), [`product-roadmap.md`](product-roadmap.md), and linked ADR/UML/ERD/traceability records. Issues #199-#203 contain their own APA 7th standards and research traceability. This baseline intentionally records delivery state and never promotes planned adapters or active pull-request code to implemented behavior. +For standards and binding architecture, use [`doctoring.md`](doctoring.md), [`doctoring/browser-agent-protocols.md`](doctoring/browser-agent-protocols.md), [`PRD.md`](PRD.md), [`TRD.md`](TRD.md), [`product-roadmap.md`](product-roadmap.md), and linked ADR/UML/ERD/traceability records. Issues #199-#203 contain their own APA 7th standards and research traceability. This baseline intentionally records delivery state and never promotes planned adapters or active pull-request code to implemented behavior. \ No newline at end of file