From 886e949140687d72e4bdcde10253c6dfcb93d744 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 4 Aug 2026 13:39:56 +0900
Subject: [PATCH 01/21] docs: update renamed repo references in AGENTS.md

---
 AGENTS.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/AGENTS.md b/AGENTS.md
index e83e8e3..329c7b4 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -96,7 +96,7 @@ working on this repo. Keep this block; re-runs replace it in place.
   DOM-decomposes emails and files into a persisted knowledge graph). Each
   component is a standalone program that must ALSO work as a git submodule —
   grown separately and together.
-- Sibling components: **waf-ids-ai-soc** (WAF/IDS/AI SOC/LB/APIM),
+- Sibling components: **wardnet** (WAF/IDS/AI SOC/LB/APIM),
   **clearfolio** (document viewer), **pg-erd-cloud** (ERD tool),
   **contextual-orchestrator** (LLM cost/perf/upstream-LB gateway, beyond
   LiteLLM), **codec-carver** (STT/omni-modal speech-video codec),

From d55a2b5ca02cb44fa363b6d648c3ca4b6503a6b5 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 4 Aug 2026 13:57:40 +0900
Subject: [PATCH 02/21] ci: rebuild stringfish from source on mac/windows
 (RcppParallel oneTBB ABI skew)

---
 .github/workflows/R-CMD-check.yaml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/R-CMD-check.yaml b/.github/workflows/R-CMD-check.yaml
index 4705d5a..0f500b4 100644
--- a/.github/workflows/R-CMD-check.yaml
+++ b/.github/workflows/R-CMD-check.yaml
@@ -49,6 +49,13 @@ jobs:
             any::testthat
           needs: check
 
+      # ponytail: CRAN/RSPM binary skew — stringfish binaries lag RcppParallel's
+      # oneTBB update (Symbol not found: tbb::internal::NFS_Allocate). Rebuild from
+      # source so it links the installed RcppParallel. Drop once upstream binaries sync.
+      - name: Rebuild stringfish from source (RcppParallel ABI skew)
+        if: runner.os != 'Linux'
+        run: Rscript -e 'install.packages("stringfish", type = "source")'
+
       - name: Run Zh formula regression tests
         run: |
           Rscript -e 'install.packages(".", repos = NULL, type = "source")'

From 31d8d8b24e3b76de645fe73feb407c19b4aa9ff0 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 4 Aug 2026 16:29:58 +0900
Subject: [PATCH 03/21] ci: rebuild stringfish on all platforms (Linux hit too)

---
 .github/workflows/R-CMD-check.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/R-CMD-check.yaml b/.github/workflows/R-CMD-check.yaml
index 0f500b4..04cb28e 100644
--- a/.github/workflows/R-CMD-check.yaml
+++ b/.github/workflows/R-CMD-check.yaml
@@ -50,10 +50,9 @@ jobs:
           needs: check
 
       # ponytail: CRAN/RSPM binary skew — stringfish binaries lag RcppParallel's
-      # oneTBB update (Symbol not found: tbb::internal::NFS_Allocate). Rebuild from
+      # oneTBB update (undefined tbb::internal symbols, all platforms). Rebuild from
       # source so it links the installed RcppParallel. Drop once upstream binaries sync.
       - name: Rebuild stringfish from source (RcppParallel ABI skew)
-        if: runner.os != 'Linux'
         run: Rscript -e 'install.packages("stringfish", type = "source")'
 
       - name: Run Zh formula regression tests

From e7b7f3d6e75cf046df53d0be62df98e01872977c Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 4 Aug 2026 16:30:00 +0900
Subject: [PATCH 04/21] ci: rebuild stringfish before install in test-fast

---
 .github/workflows/test-fast.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/test-fast.yaml b/.github/workflows/test-fast.yaml
index fa70edf..c29c2ee 100644
--- a/.github/workflows/test-fast.yaml
+++ b/.github/workflows/test-fast.yaml
@@ -25,6 +25,11 @@ jobs:
           extra-packages: any::testthat
           needs: check
 
+      # ponytail: CRAN/RSPM binary skew — stringfish binaries lag RcppParallel's
+      # oneTBB update. Rebuild from source; drop once upstream binaries sync.
+      - name: Rebuild stringfish from source (RcppParallel ABI skew)
+        run: Rscript -e 'install.packages("stringfish", type = "source")'
+
       - name: Install kaefa package for fast tests
         run: R CMD INSTALL .
 

From 21755e059e7a5ee05aabf18e664aa92d442b67d5 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 4 Aug 2026 16:30:02 +0900
Subject: [PATCH 05/21] ci: rebuild stringfish before install in test-suite

---
 .github/workflows/test-suite.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/test-suite.yaml b/.github/workflows/test-suite.yaml
index d447513..8e22232 100644
--- a/.github/workflows/test-suite.yaml
+++ b/.github/workflows/test-suite.yaml
@@ -41,6 +41,11 @@ jobs:
           extra-packages: any::testthat
           needs: check
 
+      # ponytail: CRAN/RSPM binary skew — stringfish binaries lag RcppParallel's
+      # oneTBB update. Rebuild from source; drop once upstream binaries sync.
+      - name: Rebuild stringfish from source (RcppParallel ABI skew)
+        run: Rscript -e 'install.packages("stringfish", type = "source")'
+
       - name: Install kaefa package
         run: R CMD INSTALL .
 

From 0446de9d61ae3fdfa96c88a0715509ba642cb5a1 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 4 Aug 2026 16:35:53 +0900
Subject: [PATCH 06/21] ci: rebuild all RcppParallel-linked packages (qs2 hit
 the same oneTBB skew)

---
 .github/workflows/R-CMD-check.yaml | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/R-CMD-check.yaml b/.github/workflows/R-CMD-check.yaml
index 04cb28e..4a1f7ed 100644
--- a/.github/workflows/R-CMD-check.yaml
+++ b/.github/workflows/R-CMD-check.yaml
@@ -49,11 +49,12 @@ jobs:
             any::testthat
           needs: check
 
-      # ponytail: CRAN/RSPM binary skew — stringfish binaries lag RcppParallel's
-      # oneTBB update (undefined tbb::internal symbols, all platforms). Rebuild from
-      # source so it links the installed RcppParallel. Drop once upstream binaries sync.
-      - name: Rebuild stringfish from source (RcppParallel ABI skew)
-        run: Rscript -e 'install.packages("stringfish", type = "source")'
+      # ponytail: CRAN/RSPM binary skew — prebuilt binaries (stringfish, qs2, ...) lag
+      # RcppParallel's oneTBB update (undefined tbb::internal / tbb::task symbols).
+      # Rebuild everything LinkingTo RcppParallel from source so it links the installed
+      # copy. Drop once upstream binaries re-sync.
+      - name: Rebuild RcppParallel-linked packages from source (oneTBB ABI skew)
+        run: Rscript -e 'bad <- tools::dependsOnPkgs("RcppParallel", dependencies = "LinkingTo"); if (length(bad)) install.packages(bad, type = "source")'
 
       - name: Run Zh formula regression tests
         run: |

From 648e948057a4fb0dc574804c5f24f941f827f1af Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 4 Aug 2026 16:35:55 +0900
Subject: [PATCH 07/21] ci: rebuild all RcppParallel-linked packages (qs2 hit
 the same oneTBB skew)

---
 .github/workflows/test-fast.yaml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/test-fast.yaml b/.github/workflows/test-fast.yaml
index c29c2ee..46be129 100644
--- a/.github/workflows/test-fast.yaml
+++ b/.github/workflows/test-fast.yaml
@@ -25,10 +25,12 @@ jobs:
           extra-packages: any::testthat
           needs: check
 
-      # ponytail: CRAN/RSPM binary skew — stringfish binaries lag RcppParallel's
-      # oneTBB update. Rebuild from source; drop once upstream binaries sync.
-      - name: Rebuild stringfish from source (RcppParallel ABI skew)
-        run: Rscript -e 'install.packages("stringfish", type = "source")'
+      # ponytail: CRAN/RSPM binary skew — prebuilt binaries (stringfish, qs2, ...) lag
+      # RcppParallel's oneTBB update (undefined tbb::internal / tbb::task symbols).
+      # Rebuild everything LinkingTo RcppParallel from source so it links the installed
+      # copy. Drop once upstream binaries re-sync.
+      - name: Rebuild RcppParallel-linked packages from source (oneTBB ABI skew)
+        run: Rscript -e 'bad <- tools::dependsOnPkgs("RcppParallel", dependencies = "LinkingTo"); if (length(bad)) install.packages(bad, type = "source")'
 
       - name: Install kaefa package for fast tests
         run: R CMD INSTALL .

From 34ef00f16b1aa68ece4a58ee88230efb850c0bbd Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 4 Aug 2026 16:35:57 +0900
Subject: [PATCH 08/21] ci: rebuild all RcppParallel-linked packages (qs2 hit
 the same oneTBB skew)

---
 .github/workflows/test-suite.yaml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/test-suite.yaml b/.github/workflows/test-suite.yaml
index 8e22232..9ae6174 100644
--- a/.github/workflows/test-suite.yaml
+++ b/.github/workflows/test-suite.yaml
@@ -41,10 +41,12 @@ jobs:
           extra-packages: any::testthat
           needs: check
 
-      # ponytail: CRAN/RSPM binary skew — stringfish binaries lag RcppParallel's
-      # oneTBB update. Rebuild from source; drop once upstream binaries sync.
-      - name: Rebuild stringfish from source (RcppParallel ABI skew)
-        run: Rscript -e 'install.packages("stringfish", type = "source")'
+      # ponytail: CRAN/RSPM binary skew — prebuilt binaries (stringfish, qs2, ...) lag
+      # RcppParallel's oneTBB update (undefined tbb::internal / tbb::task symbols).
+      # Rebuild everything LinkingTo RcppParallel from source so it links the installed
+      # copy. Drop once upstream binaries re-sync.
+      - name: Rebuild RcppParallel-linked packages from source (oneTBB ABI skew)
+        run: Rscript -e 'bad <- tools::dependsOnPkgs("RcppParallel", dependencies = "LinkingTo"); if (length(bad)) install.packages(bad, type = "source")'
 
       - name: Install kaefa package
         run: R CMD INSTALL .

From b944368140c6e85e0378da52c8c1471b37ad05bf Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 4 Aug 2026 17:02:15 +0900
Subject: [PATCH 09/21] ci: source-build stringfish before dep setup (SimDesign
 source builds load it); fold long line

---
 .github/workflows/R-CMD-check.yaml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/R-CMD-check.yaml b/.github/workflows/R-CMD-check.yaml
index 4a1f7ed..0a8a5aa 100644
--- a/.github/workflows/R-CMD-check.yaml
+++ b/.github/workflows/R-CMD-check.yaml
@@ -42,6 +42,12 @@ jobs:
           http-user-agent: ${{ matrix.config.http-user-agent }}
           use-public-rspm: true
 
+      # ponytail: source-build stringfish BEFORE dependency setup — packages built
+      # from source during install (e.g. SimDesign) load it at build time and die
+      # on the broken prebuilt binary (oneTBB ABI skew). Drop with the step below.
+      - name: Source-build stringfish (RcppParallel oneTBB ABI skew)
+        run: Rscript -e 'install.packages("stringfish", type = "source")'
+
       - uses: r-lib/actions/setup-r-dependencies@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590 # v2
         with:
           extra-packages: |
@@ -54,7 +60,9 @@ jobs:
       # Rebuild everything LinkingTo RcppParallel from source so it links the installed
       # copy. Drop once upstream binaries re-sync.
       - name: Rebuild RcppParallel-linked packages from source (oneTBB ABI skew)
-        run: Rscript -e 'bad <- tools::dependsOnPkgs("RcppParallel", dependencies = "LinkingTo"); if (length(bad)) install.packages(bad, type = "source")'
+        run: >-
+          Rscript -e 'bad <- tools::dependsOnPkgs("RcppParallel", dependencies = "LinkingTo");
+          if (length(bad)) install.packages(bad, type = "source")'
 
       - name: Run Zh formula regression tests
         run: |

From 46012b7622473a4a626e68e678ec9ebaf081caa9 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 4 Aug 2026 17:02:21 +0900
Subject: [PATCH 10/21] ci: source-build stringfish before dep setup (SimDesign
 source builds load it); fold long line

---
 .github/workflows/test-fast.yaml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test-fast.yaml b/.github/workflows/test-fast.yaml
index 46be129..1d70c5e 100644
--- a/.github/workflows/test-fast.yaml
+++ b/.github/workflows/test-fast.yaml
@@ -20,6 +20,12 @@ jobs:
         with:
           use-public-rspm: true
 
+      # ponytail: source-build stringfish BEFORE dependency setup — packages built
+      # from source during install (e.g. SimDesign) load it at build time and die
+      # on the broken prebuilt binary (oneTBB ABI skew). Drop with the step below.
+      - name: Source-build stringfish (RcppParallel oneTBB ABI skew)
+        run: Rscript -e 'install.packages("stringfish", type = "source")'
+
       - uses: r-lib/actions/setup-r-dependencies@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590 # v2
         with:
           extra-packages: any::testthat
@@ -30,7 +36,9 @@ jobs:
       # Rebuild everything LinkingTo RcppParallel from source so it links the installed
       # copy. Drop once upstream binaries re-sync.
       - name: Rebuild RcppParallel-linked packages from source (oneTBB ABI skew)
-        run: Rscript -e 'bad <- tools::dependsOnPkgs("RcppParallel", dependencies = "LinkingTo"); if (length(bad)) install.packages(bad, type = "source")'
+        run: >-
+          Rscript -e 'bad <- tools::dependsOnPkgs("RcppParallel", dependencies = "LinkingTo");
+          if (length(bad)) install.packages(bad, type = "source")'
 
       - name: Install kaefa package for fast tests
         run: R CMD INSTALL .

From 4acfcf08552d26f429a4d49ef92ad6bb49abe73e Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 4 Aug 2026 17:02:26 +0900
Subject: [PATCH 11/21] ci: source-build stringfish before dep setup (SimDesign
 source builds load it); fold long line

---
 .github/workflows/test-suite.yaml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test-suite.yaml b/.github/workflows/test-suite.yaml
index 9ae6174..896da6b 100644
--- a/.github/workflows/test-suite.yaml
+++ b/.github/workflows/test-suite.yaml
@@ -36,6 +36,12 @@ jobs:
         with:
           use-public-rspm: true
 
+      # ponytail: source-build stringfish BEFORE dependency setup — packages built
+      # from source during install (e.g. SimDesign) load it at build time and die
+      # on the broken prebuilt binary (oneTBB ABI skew). Drop with the step below.
+      - name: Source-build stringfish (RcppParallel oneTBB ABI skew)
+        run: Rscript -e 'install.packages("stringfish", type = "source")'
+
       - uses: r-lib/actions/setup-r-dependencies@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590 # v2
         with:
           extra-packages: any::testthat
@@ -46,7 +52,9 @@ jobs:
       # Rebuild everything LinkingTo RcppParallel from source so it links the installed
       # copy. Drop once upstream binaries re-sync.
       - name: Rebuild RcppParallel-linked packages from source (oneTBB ABI skew)
-        run: Rscript -e 'bad <- tools::dependsOnPkgs("RcppParallel", dependencies = "LinkingTo"); if (length(bad)) install.packages(bad, type = "source")'
+        run: >-
+          Rscript -e 'bad <- tools::dependsOnPkgs("RcppParallel", dependencies = "LinkingTo");
+          if (length(bad)) install.packages(bad, type = "source")'
 
       - name: Install kaefa package
         run: R CMD INSTALL .

From d75e72c037e78886603029797f4ff98654f81980 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 4 Aug 2026 17:24:20 +0900
Subject: [PATCH 12/21] ci: real source rebuilds via CRAN cloud (RSPM serves
 linux binaries for source URLs); rebuild RcppParallel first

---
 .github/workflows/R-CMD-check.yaml | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/R-CMD-check.yaml b/.github/workflows/R-CMD-check.yaml
index 0a8a5aa..ca02cfe 100644
--- a/.github/workflows/R-CMD-check.yaml
+++ b/.github/workflows/R-CMD-check.yaml
@@ -45,8 +45,12 @@ jobs:
       # ponytail: source-build stringfish BEFORE dependency setup — packages built
       # from source during install (e.g. SimDesign) load it at build time and die
       # on the broken prebuilt binary (oneTBB ABI skew). Drop with the step below.
+      # repos= must be a real source repo: RSPM serves prebuilt Linux binaries via
+      # source-style URLs, so type="source" against RSPM does NOT recompile.
       - name: Source-build stringfish (RcppParallel oneTBB ABI skew)
-        run: Rscript -e 'install.packages("stringfish", type = "source")'
+        run: >-
+          Rscript -e 'install.packages(c("RcppParallel", "stringfish"), type = "source",
+          repos = "https://cloud.r-project.org")'
 
       - uses: r-lib/actions/setup-r-dependencies@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590 # v2
         with:
@@ -61,8 +65,9 @@ jobs:
       # copy. Drop once upstream binaries re-sync.
       - name: Rebuild RcppParallel-linked packages from source (oneTBB ABI skew)
         run: >-
-          Rscript -e 'bad <- tools::dependsOnPkgs("RcppParallel", dependencies = "LinkingTo");
-          if (length(bad)) install.packages(bad, type = "source")'
+          Rscript -e 'r <- "https://cloud.r-project.org"; install.packages("RcppParallel", type = "source", repos = r);
+          bad <- tools::dependsOnPkgs("RcppParallel", dependencies = "LinkingTo");
+          if (length(bad)) install.packages(bad, type = "source", repos = r)'
 
       - name: Run Zh formula regression tests
         run: |

From 28e844259468d9cd4f462d59072f0fb9d606bedf Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 4 Aug 2026 17:24:25 +0900
Subject: [PATCH 13/21] ci: real source rebuilds via CRAN cloud (RSPM serves
 linux binaries for source URLs); rebuild RcppParallel first

---
 .github/workflows/test-fast.yaml | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/test-fast.yaml b/.github/workflows/test-fast.yaml
index 1d70c5e..ee046af 100644
--- a/.github/workflows/test-fast.yaml
+++ b/.github/workflows/test-fast.yaml
@@ -23,8 +23,12 @@ jobs:
       # ponytail: source-build stringfish BEFORE dependency setup — packages built
       # from source during install (e.g. SimDesign) load it at build time and die
       # on the broken prebuilt binary (oneTBB ABI skew). Drop with the step below.
+      # repos= must be a real source repo: RSPM serves prebuilt Linux binaries via
+      # source-style URLs, so type="source" against RSPM does NOT recompile.
       - name: Source-build stringfish (RcppParallel oneTBB ABI skew)
-        run: Rscript -e 'install.packages("stringfish", type = "source")'
+        run: >-
+          Rscript -e 'install.packages(c("RcppParallel", "stringfish"), type = "source",
+          repos = "https://cloud.r-project.org")'
 
       - uses: r-lib/actions/setup-r-dependencies@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590 # v2
         with:
@@ -37,8 +41,9 @@ jobs:
       # copy. Drop once upstream binaries re-sync.
       - name: Rebuild RcppParallel-linked packages from source (oneTBB ABI skew)
         run: >-
-          Rscript -e 'bad <- tools::dependsOnPkgs("RcppParallel", dependencies = "LinkingTo");
-          if (length(bad)) install.packages(bad, type = "source")'
+          Rscript -e 'r <- "https://cloud.r-project.org"; install.packages("RcppParallel", type = "source", repos = r);
+          bad <- tools::dependsOnPkgs("RcppParallel", dependencies = "LinkingTo");
+          if (length(bad)) install.packages(bad, type = "source", repos = r)'
 
       - name: Install kaefa package for fast tests
         run: R CMD INSTALL .

From fbba747eaf1399613c7faf5b9332d3f5a1b557a3 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 4 Aug 2026 17:24:30 +0900
Subject: [PATCH 14/21] ci: real source rebuilds via CRAN cloud (RSPM serves
 linux binaries for source URLs); rebuild RcppParallel first

---
 .github/workflows/test-suite.yaml | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/test-suite.yaml b/.github/workflows/test-suite.yaml
index 896da6b..407a8fa 100644
--- a/.github/workflows/test-suite.yaml
+++ b/.github/workflows/test-suite.yaml
@@ -39,8 +39,12 @@ jobs:
       # ponytail: source-build stringfish BEFORE dependency setup — packages built
       # from source during install (e.g. SimDesign) load it at build time and die
       # on the broken prebuilt binary (oneTBB ABI skew). Drop with the step below.
+      # repos= must be a real source repo: RSPM serves prebuilt Linux binaries via
+      # source-style URLs, so type="source" against RSPM does NOT recompile.
       - name: Source-build stringfish (RcppParallel oneTBB ABI skew)
-        run: Rscript -e 'install.packages("stringfish", type = "source")'
+        run: >-
+          Rscript -e 'install.packages(c("RcppParallel", "stringfish"), type = "source",
+          repos = "https://cloud.r-project.org")'
 
       - uses: r-lib/actions/setup-r-dependencies@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590 # v2
         with:
@@ -53,8 +57,9 @@ jobs:
       # copy. Drop once upstream binaries re-sync.
       - name: Rebuild RcppParallel-linked packages from source (oneTBB ABI skew)
         run: >-
-          Rscript -e 'bad <- tools::dependsOnPkgs("RcppParallel", dependencies = "LinkingTo");
-          if (length(bad)) install.packages(bad, type = "source")'
+          Rscript -e 'r <- "https://cloud.r-project.org"; install.packages("RcppParallel", type = "source", repos = r);
+          bad <- tools::dependsOnPkgs("RcppParallel", dependencies = "LinkingTo");
+          if (length(bad)) install.packages(bad, type = "source", repos = r)'
 
       - name: Install kaefa package
         run: R CMD INSTALL .

From b89be697719e7e8ce4b8a8b03f9113c8ccc5ba19 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 4 Aug 2026 23:05:38 +0900
Subject: [PATCH 15/21] docs(AGENTS.md): passwordless SSO is keyverse, not
 feelanet-adfs

Folds the remaining ecosystem-name correction into this sweep so a single
PR owns AGENTS.md per repo. keyverse (was cwl-idp) is the central
passwordless IdP; feelanet-adfs is the employer ADFS SSO integration
library it federates, per .github/docs/CWL-MASTER-CONTEXT.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 AGENTS.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/AGENTS.md b/AGENTS.md
index 329c7b4..f93dc10 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -101,7 +101,7 @@ working on this repo. Keep this block; re-runs replace it in place.
   **contextual-orchestrator** (LLM cost/perf/upstream-LB gateway, beyond
   LiteLLM), **codec-carver** (STT/omni-modal speech-video codec),
   **fast-mlsirm** (LLM-as-a-Judge calibration + evaluation-item quality; uses
-  aFIPC FIPC + kaefa item-fit), **feelanet-adfs** (passwordless SSO —
+  aFIPC FIPC + kaefa item-fit), **keyverse** (passwordless SSO —
   OIDC/SCIM/ADFS/LDAP/FIDO2/OAuth2.1), **newsdom-api** (PDF->DOM sidecar), and
   **semantic-data-portal** (upper-ontology/catalog/governance plane with its
   own graph engine).

From 46c76d0d4d1e2882f60703b9630677e830bfffb4 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Fri, 14 Aug 2026 23:12:35 +0900
Subject: [PATCH 16/21] chore(ci): consolidate r-lib actions v2.12.1

---
 .github/workflows/R-CMD-check.yaml         |  6 ++---
 .github/workflows/test-fast.yaml           |  4 +--
 .github/workflows/test-suite.yaml          |  4 +--
 docs/traceability/r-lib-actions-v2.12.1.md | 29 ++++++++++++++++++++++
 tests/testthat/test-ci-action-pins.R       | 24 ++++++++++++++++++
 5 files changed, 60 insertions(+), 7 deletions(-)
 create mode 100644 docs/traceability/r-lib-actions-v2.12.1.md
 create mode 100644 tests/testthat/test-ci-action-pins.R

diff --git a/.github/workflows/R-CMD-check.yaml b/.github/workflows/R-CMD-check.yaml
index 2fd552b..4d3e02f 100644
--- a/.github/workflows/R-CMD-check.yaml
+++ b/.github/workflows/R-CMD-check.yaml
@@ -36,13 +36,13 @@ jobs:
 
       - uses: r-lib/actions/setup-pandoc@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2
 
-      - uses: r-lib/actions/setup-r@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590 # v2
+      - uses: r-lib/actions/setup-r@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2
         with:
           r-version: ${{ matrix.config.r }}
           http-user-agent: ${{ matrix.config.http-user-agent }}
           use-public-rspm: true
 
-      - uses: r-lib/actions/setup-r-dependencies@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590 # v2
+      - uses: r-lib/actions/setup-r-dependencies@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2
         with:
           extra-packages: |
             any::rcmdcheck
@@ -54,7 +54,7 @@ jobs:
           Rscript -e 'install.packages(".", repos = NULL, type = "source")'
           Rscript -e 'library(kaefa); testthat::test_file("tests/testthat/test-zh-misfit-decision-rule.R")'
 
-      - uses: r-lib/actions/check-r-package@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590 # v2
+      - uses: r-lib/actions/check-r-package@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2
         with:
           error-on: '"error"'
           upload-snapshots: true
diff --git a/.github/workflows/test-fast.yaml b/.github/workflows/test-fast.yaml
index ea1cf69..51c82c3 100644
--- a/.github/workflows/test-fast.yaml
+++ b/.github/workflows/test-fast.yaml
@@ -16,11 +16,11 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: r-lib/actions/setup-r@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590 # v2
+      - uses: r-lib/actions/setup-r@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2
         with:
           use-public-rspm: true
 
-      - uses: r-lib/actions/setup-r-dependencies@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590 # v2
+      - uses: r-lib/actions/setup-r-dependencies@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2
         with:
           extra-packages: any::testthat
           needs: check
diff --git a/.github/workflows/test-suite.yaml b/.github/workflows/test-suite.yaml
index 439b9b7..fc1b872 100644
--- a/.github/workflows/test-suite.yaml
+++ b/.github/workflows/test-suite.yaml
@@ -32,11 +32,11 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: r-lib/actions/setup-r@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590 # v2
+      - uses: r-lib/actions/setup-r@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2
         with:
           use-public-rspm: true
 
-      - uses: r-lib/actions/setup-r-dependencies@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590 # v2
+      - uses: r-lib/actions/setup-r-dependencies@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2
         with:
           extra-packages: any::testthat
           needs: check
diff --git a/docs/traceability/r-lib-actions-v2.12.1.md b/docs/traceability/r-lib-actions-v2.12.1.md
new file mode 100644
index 0000000..78f6a14
--- /dev/null
+++ b/docs/traceability/r-lib-actions-v2.12.1.md
@@ -0,0 +1,29 @@
+# r-lib/actions v2.12.1 공급망 추적
+
+## 결정
+
+세 개의 R 검증 workflow에서 사용하는 setup-pandoc, setup-r,
+setup-r-dependencies, check-r-package를 v2.12.1 release commit
+d3c5be51b12e724e68f33216ca3c148b66d5f0b6으로 통일한다. 전체 commit SHA 외의 태그·브랜치·짧은 SHA는
+회귀 계약이 거부한다.
+
+## 호환성 범위
+
+공식 NEWS에 따르면 v2.12는 Node.js 24 전환, public RSPM 기본값 조정,
+아키텍처별 cache key와 Pandoc 3.8.3을 포함하고, v2.12.1은 setup-r URL parser
+경고와 Quarto action을 갱신한다. 현재 workflow의 R matrix, 권한, testthat 실행,
+--no-tests 분리와 scheduled full-suite 계약은 변경하지 않는다.
+
+## 되돌리기
+
+runner 또는 package 호환성 회귀가 확인되면 네 action을 함께 마지막 검증 SHA로
+되돌리고 R-CMD-check, fast/full test suite와 중앙 보안 검사를 같은 헤드에서 다시
+수행한다. 일부 action만 되돌리거나 이동 태그로 우회하지 않는다.
+
+## 참고문헌
+
+R-lib. (2026, June 23). *r-lib/actions v2.12.1* [Software release notes].
+https://github.com/r-lib/actions/blob/v2-branch/NEWS.md
+
+R-lib. (2026). *Update NEWS for v2.12.1* [Source code commit].
+https://github.com/r-lib/actions/commit/d3c5be51b12e724e68f33216ca3c148b66d5f0b6
diff --git a/tests/testthat/test-ci-action-pins.R b/tests/testthat/test-ci-action-pins.R
new file mode 100644
index 0000000..1e9a553
--- /dev/null
+++ b/tests/testthat/test-ci-action-pins.R
@@ -0,0 +1,24 @@
+testthat::test_that("CI r-lib actions use the reviewed v2.12.1 commit", {
+  workflow_paths <- c(
+    testthat::test_path("..", "..", ".github", "workflows", "R-CMD-check.yaml"),
+    testthat::test_path("..", "..", ".github", "workflows", "test-fast.yaml"),
+    testthat::test_path("..", "..", ".github", "workflows", "test-suite.yaml")
+  )
+  workflow_text <- paste(
+    unlist(lapply(workflow_paths, readLines, warn = FALSE)),
+    collapse = "\n"
+  )
+  action_refs <- regmatches(
+    workflow_text,
+    gregexpr(
+      "r-lib/actions/(setup-pandoc|setup-r-dependencies|setup-r|check-r-package)@[^[:space:]#]+",
+      workflow_text,
+      perl = TRUE
+    )
+  )[[1]]
+
+  testthat::expect_gt(length(action_refs), 0)
+  testthat::expect_true(all(
+    sub("^.*@", "", action_refs) == "d3c5be51b12e724e68f33216ca3c148b66d5f0b6"
+  ))
+})

From bbda0c14cbdc26ec34637e1e791bf5e657d069f8 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Fri, 14 Aug 2026 23:30:45 +0900
Subject: [PATCH 17/21] test(ci): reject substituted r-lib actions

---
 .../2026-07-02-kaefa-2b-krw-sale-readiness.md |  4 +-
 docs/traceability/r-lib-actions-v2.12.1.md    |  2 +-
 tests/testthat/test-ci-action-pins.R          | 47 +++++++++++++------
 3 files changed, 36 insertions(+), 17 deletions(-)

diff --git a/docs/superpowers/plans/2026-07-02-kaefa-2b-krw-sale-readiness.md b/docs/superpowers/plans/2026-07-02-kaefa-2b-krw-sale-readiness.md
index d5192fe..4be08d6 100644
--- a/docs/superpowers/plans/2026-07-02-kaefa-2b-krw-sale-readiness.md
+++ b/docs/superpowers/plans/2026-07-02-kaefa-2b-krw-sale-readiness.md
@@ -251,11 +251,11 @@ Guardrails:
       steps:
         - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-        - uses: r-lib/actions/setup-r@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590 # v2
+        - uses: r-lib/actions/setup-r@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2
           with:
             use-public-rspm: true
 
-        - uses: r-lib/actions/setup-r-dependencies@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590 # v2
+        - uses: r-lib/actions/setup-r-dependencies@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2
           with:
             extra-packages: any::testthat
             needs: check
diff --git a/docs/traceability/r-lib-actions-v2.12.1.md b/docs/traceability/r-lib-actions-v2.12.1.md
index 78f6a14..fa52bd6 100644
--- a/docs/traceability/r-lib-actions-v2.12.1.md
+++ b/docs/traceability/r-lib-actions-v2.12.1.md
@@ -23,7 +23,7 @@ runner 또는 package 호환성 회귀가 확인되면 네 action을 함께 마
 ## 참고문헌
 
 R-lib. (2026, June 23). *r-lib/actions v2.12.1* [Software release notes].
-https://github.com/r-lib/actions/blob/v2-branch/NEWS.md
+https://github.com/r-lib/actions/blob/d3c5be51b12e724e68f33216ca3c148b66d5f0b6/NEWS.md
 
 R-lib. (2026). *Update NEWS for v2.12.1* [Source code commit].
 https://github.com/r-lib/actions/commit/d3c5be51b12e724e68f33216ca3c148b66d5f0b6
diff --git a/tests/testthat/test-ci-action-pins.R b/tests/testthat/test-ci-action-pins.R
index 1e9a553..36cf087 100644
--- a/tests/testthat/test-ci-action-pins.R
+++ b/tests/testthat/test-ci-action-pins.R
@@ -1,24 +1,43 @@
-testthat::test_that("CI r-lib actions use the reviewed v2.12.1 commit", {
+testthat::test_that("CI uses exactly the reviewed r-lib action references", {
+  reviewed_sha <- "d3c5be51b12e724e68f33216ca3c148b66d5f0b6"
   workflow_paths <- c(
     testthat::test_path("..", "..", ".github", "workflows", "R-CMD-check.yaml"),
     testthat::test_path("..", "..", ".github", "workflows", "test-fast.yaml"),
     testthat::test_path("..", "..", ".github", "workflows", "test-suite.yaml")
   )
-  workflow_text <- paste(
-    unlist(lapply(workflow_paths, readLines, warn = FALSE)),
-    collapse = "\n"
+  expected_actions <- list(
+    "R-CMD-check.yaml" = c(
+      "setup-pandoc",
+      "setup-r",
+      "setup-r-dependencies",
+      "check-r-package"
+    ),
+    "test-fast.yaml" = c("setup-r", "setup-r-dependencies"),
+    "test-suite.yaml" = c("setup-r", "setup-r-dependencies")
   )
-  action_refs <- regmatches(
-    workflow_text,
-    gregexpr(
-      "r-lib/actions/(setup-pandoc|setup-r-dependencies|setup-r|check-r-package)@[^[:space:]#]+",
+  action_pattern <- paste0(
+    "r-lib/actions/",
+    "(setup-pandoc|setup-r-dependencies|setup-r|check-r-package)",
+    "@[^[:space:]#]+"
+  )
+
+  for (workflow_path in workflow_paths) {
+    workflow_text <- paste(readLines(workflow_path, warn = FALSE), collapse = "\n")
+    action_refs <- regmatches(
       workflow_text,
-      perl = TRUE
+      gregexpr(action_pattern, workflow_text, perl = TRUE)
+    )[[1]]
+    expected_refs <- paste0(
+      "r-lib/actions/",
+      expected_actions[[basename(workflow_path)]],
+      "@",
+      reviewed_sha
     )
-  )[[1]]
 
-  testthat::expect_gt(length(action_refs), 0)
-  testthat::expect_true(all(
-    sub("^.*@", "", action_refs) == "d3c5be51b12e724e68f33216ca3c148b66d5f0b6"
-  ))
+    testthat::expect_identical(
+      action_refs,
+      expected_refs,
+      info = paste("Unexpected r-lib action set in", basename(workflow_path))
+    )
+  }
 })

From 6abb5565aa80d481d05891590982a136d41fb58b Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 15 Aug 2026 01:24:38 +0900
Subject: [PATCH 18/21] fix(ci): refresh macOS dependency ABI cache

---
 .github/workflows/R-CMD-check.yaml   |  2 ++
 tests/testthat/test-ci-action-pins.R | 21 +++++++++++++++++++++
 2 files changed, 23 insertions(+)

diff --git a/.github/workflows/R-CMD-check.yaml b/.github/workflows/R-CMD-check.yaml
index 4d3e02f..511eac9 100644
--- a/.github/workflows/R-CMD-check.yaml
+++ b/.github/workflows/R-CMD-check.yaml
@@ -44,6 +44,8 @@ jobs:
 
       - uses: r-lib/actions/setup-r-dependencies@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2
         with:
+          # Refresh the dependency cache after the macOS qs2/RcppParallel TBB ABI mismatch.
+          cache-version: '2'
           extra-packages: |
             any::rcmdcheck
             any::testthat
diff --git a/tests/testthat/test-ci-action-pins.R b/tests/testthat/test-ci-action-pins.R
index 36cf087..41706ab 100644
--- a/tests/testthat/test-ci-action-pins.R
+++ b/tests/testthat/test-ci-action-pins.R
@@ -41,3 +41,24 @@ testthat::test_that("CI uses exactly the reviewed r-lib action references", {
     )
   }
 })
+
+testthat::test_that("R CMD check refreshes the reviewed dependency cache ABI", {
+  workflow_path <- testthat::test_path(
+    "..", "..", ".github", "workflows", "R-CMD-check.yaml"
+  )
+  workflow_lines <- readLines(workflow_path, warn = FALSE)
+  dependency_step <- grep(
+    "r-lib/actions/setup-r-dependencies@",
+    workflow_lines,
+    fixed = TRUE
+  )
+  testthat::expect_length(dependency_step, 1L)
+  dependency_block <- workflow_lines[
+    dependency_step:min(dependency_step + 8L, length(workflow_lines))
+  ]
+
+  testthat::expect_true(
+    any(grepl("cache-version: '2'", dependency_block, fixed = TRUE)),
+    info = "The reviewed macOS TBB ABI cache refresh must remain explicit"
+  )
+})

From 5a2a54126c742996aca663cae1bc7eea0b9db2bd Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 15 Aug 2026 01:34:55 +0900
Subject: [PATCH 19/21] test(ci): require active cache version configuration

---
 tests/testthat/test-ci-action-pins.R | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/tests/testthat/test-ci-action-pins.R b/tests/testthat/test-ci-action-pins.R
index 41706ab..fae6a3e 100644
--- a/tests/testthat/test-ci-action-pins.R
+++ b/tests/testthat/test-ci-action-pins.R
@@ -57,8 +57,16 @@ testthat::test_that("R CMD check refreshes the reviewed dependency cache ABI", {
     dependency_step:min(dependency_step + 8L, length(workflow_lines))
   ]
 
+  active_cache_version_pattern <- paste0(
+    "^[[:space:]]*cache-version:[[:space:]]*",
+    "['\\\"]2['\\\"][[:space:]]*(#.*)?$"
+  )
+  testthat::expect_false(
+    grepl(active_cache_version_pattern, "# cache-version: '2'", perl = TRUE),
+    info = "A commented cache-version example must not satisfy the contract"
+  )
   testthat::expect_true(
-    any(grepl("cache-version: '2'", dependency_block, fixed = TRUE)),
+    any(grepl(active_cache_version_pattern, dependency_block, perl = TRUE)),
     info = "The reviewed macOS TBB ABI cache refresh must remain explicit"
   )
 })

From ce826e9e7188efe0652f3e368eef726a9ac65166 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 15 Aug 2026 02:49:23 +0900
Subject: [PATCH 20/21] ci: rebuild macOS TBB dependents from source

---
 .github/workflows/R-CMD-check.yaml   |  4 ++++
 tests/testthat/test-ci-action-pins.R | 33 ++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+)

diff --git a/.github/workflows/R-CMD-check.yaml b/.github/workflows/R-CMD-check.yaml
index 511eac9..dbc4de2 100644
--- a/.github/workflows/R-CMD-check.yaml
+++ b/.github/workflows/R-CMD-check.yaml
@@ -51,6 +51,10 @@ jobs:
             any::testthat
           needs: check
 
+      - name: Rebuild macOS TBB dependents from source
+        if: runner.os == 'macOS'
+        run: Rscript -e 'install.packages(c("RcppParallel", "qs2"), repos = "https://cloud.r-project.org", type = "source")'
+
       - name: Run Zh formula regression tests
         run: |
           Rscript -e 'install.packages(".", repos = NULL, type = "source")'
diff --git a/tests/testthat/test-ci-action-pins.R b/tests/testthat/test-ci-action-pins.R
index fae6a3e..415fa6f 100644
--- a/tests/testthat/test-ci-action-pins.R
+++ b/tests/testthat/test-ci-action-pins.R
@@ -70,3 +70,36 @@ testthat::test_that("R CMD check refreshes the reviewed dependency cache ABI", {
     info = "The reviewed macOS TBB ABI cache refresh must remain explicit"
   )
 })
+
+testthat::test_that("macOS rebuilds TBB-linked packages from source", {
+  workflow_path <- testthat::test_path(
+    "..", "..", ".github", "workflows", "R-CMD-check.yaml"
+  )
+  workflow_lines <- readLines(workflow_path, warn = FALSE)
+  rebuild_step <- grep(
+    "name: Rebuild macOS TBB dependents from source",
+    workflow_lines,
+    fixed = TRUE
+  )
+  testthat::expect_length(rebuild_step, 1L)
+  rebuild_block <- workflow_lines[
+    rebuild_step:min(rebuild_step + 3L, length(workflow_lines))
+  ]
+
+  testthat::expect_true(
+    any(trimws(rebuild_block) == "if: runner.os == 'macOS'"),
+    info = "Native package rebuild must remain scoped to macOS"
+  )
+  testthat::expect_true(
+    any(grepl(
+      'install.packages(c("RcppParallel", "qs2")',
+      rebuild_block,
+      fixed = TRUE
+    )),
+    info = "Both sides of the observed qs2/RcppParallel ABI boundary must rebuild"
+  )
+  testthat::expect_true(
+    any(grepl('type = "source"', rebuild_block, fixed = TRUE)),
+    info = "macOS native packages must compile against the same local TBB ABI"
+  )
+})

From 5092a70c9737221d6367e74643d06980609fe0b1 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 15 Aug 2026 03:11:57 +0900
Subject: [PATCH 21/21] test(ci): pin every oneTBB source rebuild argument

---
 tests/testthat/test-ci-action-pins.R | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/tests/testthat/test-ci-action-pins.R b/tests/testthat/test-ci-action-pins.R
index 5ab2737..4203052 100644
--- a/tests/testthat/test-ci-action-pins.R
+++ b/tests/testthat/test-ci-action-pins.R
@@ -118,13 +118,23 @@ testthat::test_that("CI rebuilds oneTBB dependents around dependency setup", {
       pre_block,
       fixed = TRUE
     )))
+    testthat::expect_true(any(grepl(
+      'type = "source"',
+      pre_block,
+      fixed = TRUE
+    )))
     testthat::expect_true(any(grepl(
       'dependsOnPkgs("RcppParallel", dependencies = "LinkingTo")',
       post_block,
       fixed = TRUE
     )))
     testthat::expect_true(any(grepl(
-      'type = "source"',
+      'install.packages("RcppParallel", type = "source"',
+      post_block,
+      fixed = TRUE
+    )))
+    testthat::expect_true(any(grepl(
+      'install.packages(linked, type = "source"',
       post_block,
       fixed = TRUE
     )))