docs(gap): integrate visual and owner-handoff evidence - #1602

No actionable comments were generated in the recent review. 🎉

Merge Risk: ⚪ Minimal · up to daabf

The documentation baseline update has no identified merge-blocking risk.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

Visual Inspection receipt (exact head 6c9b133985b19924314eb90fa74e960d8f104552): GitHub rendered preview was inspected in a real browser at the exact commit URL. The v1.3 heading, evidence paragraph, linked PR/inspection receipt, exact SHAs, and Gap/action/acceptance table render without clipping or broken Markdown in the visible desktop viewport. The yellow GitHub billing banner is an account-level operational signal, not document content or a rendering defect.

Independent Visual Inspection completed by main: retrieved artifact10042037726 from Application CI run34189161122, name naruon-full-product-smoke-1600-d30f0b7c403bcf2b06d84b27f2744d5c17177294. Opened every retained PNG directly:10/10 desktop images,1440x1024 (home,mail,calendar,tasks,projects,search,data,security,settings,ai-hub). Confirmed English skip-link on Home/Projects/Security; source-linked Home copy; raw source/thread and sender_context in Search; intent/ETag/If-Match copy in Calendar; verifier command/schema/exit-code copy in Data; signed-session and event-code copy in Security; Settings content behind fixed header; clipped Projects nav and Mail toast covering primary navigation. These are mocked CI screenshots, not live provider/write evidence. This artifact contains10 desktop images, no mobile images; the earlier20-image local observation remains a distinct receipt. AGENTS successor is #15491261c32. Product visual acceptance is not established by artifact availability.

@coderabbitai review

현재 exact head d186427fe52fcee9d62329d56f632369ba7d79ef 기준으로 다시 검토해 주세요. 직전 authority 이후 유효한 추가 delta는 docs/product-technical-gap-baseline.md의 #1603 Search presentation successor 연결 1건이며, merge commit은 AGENTS 단일-writer 복구를 보존합니다. Application CI, Bandit, Docker, Security Scan, Semgrep, CodeQL PR은 이 exact head에서 모두 terminal success입니다. 이전 head의 리뷰/승인은 승계하지 않습니다.

#!/bin/bash
set -euo pipefail

echo '== checked-out commit =='
git rev-parse HEAD
git status --short
echo '== PR metadata =='
gh pr view 1602 --repo ContextualWisdomLab/naruon \
  --json number,state,isDraft,baseRefOid,headRefOid,headRefName,url \
  --jq '.'
echo '== merge-base and changed files =='
base="$(git merge-base HEAD origin/develop)"
printf 'merge-base=%s\n' "$base"
git diff --stat "$base"...HEAD
git diff --name-status "$base"...HEAD
echo '== document diff =='
git diff --find-renames --unified=60 "$base"...HEAD -- docs/product-technical-gap-baseline.md
echo '== document outline and relevant lines =='
rg -n -C 5 '(v1\.3|1603|Search|visual|artifact|acceptance)' docs/product-technical-gap-baseline.md
echo '== referenced PR metadata =='
for pr in 1578 1599 1600 1601 1603; do
  printf '\n#%s\n' "$pr"
  gh pr view "$pr" --repo ContextualWisdomLab/naruon \
    --json number,state,isDraft,headRefOid,baseRefOid,url,title \
    --jq '.'
done

#!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/naruon"

echo '== `#1602` exact-head workflow runs =='
gh api "repos/$repo/commits/d186427fe52fcee9d62329d56f632369ba7d79ef/check-runs?per_page=100" \
  --jq '.check_runs[] | [.name, .status, .conclusion, .details_url] | `@tsv`'

echo '== `#1602` reviews and review comments =='
gh pr view 1602 --repo "$repo" --json reviews,comments \
  --jq '{reviews: [.reviews[] | {author: .author.login, state: .state, commit: .commit.oid}], comments: [.comments[] | {author: .author.login, body: .body}]}'
gh api "repos/$repo/pulls/1602/comments?per_page=100" \
  --jq '.[] | [.user.login, .commit_id, .path, (.line // 0 | tostring), .body] | `@tsv`'

echo '== `#1603` file list and diff =='
gh pr view 1603 --repo "$repo" --json files,commits,comments,reviews \
  --jq '{files: [.files[] | {path, additions, deletions}], commits: [.commits[] | {oid: .oid, messageHeadline: .messageHeadline}], reviews: [.reviews[] | {author: .author.login, state: .state, commit: .commit.oid}], comments: [.comments[] | {author: .author.login, body: .body}]}'
gh pr diff 1603 --repo "$repo" --color=never

echo '== `#1603` exact-head check runs =='
gh api "repos/$repo/commits/2b07c42e99c98d006b60f527576025bf49b91855/check-runs?per_page=100" \
  --jq '.check_runs[] | [.name, .status, .conclusion, .details_url] | `@tsv`'

@seonghobae 검토를 완료했습니다. 확인한 exact head는 d186427fe52fcee9d62329d56f632369ba7d79ef입니다. 변경 파일은 docs/product-technical-gap-baseline.md 하나입니다.

Finding — docs/product-technical-gap-baseline.md, Line 23

#1603가 “visible plumbing”을 대체한다고 현재형으로 서술합니다. 그러나 #1603@2b07c42e의 customerFacingRelationshipText()는 ASCII identifier 형식만 중립 문구로 대체합니다. dotted, slashed, spaced, Unicode, 또는 혼합 기호 next_action 값은 원문을 고객 UI에 표시할 수 있습니다.

이 동작은 해당 PR의 fail-closed customer-copy 목표와 일치하지 않습니다. #1603가 positive allowlist 기반의 localized projection을 적용하기 전에는, 이 행을 미완료 successor로 표현해야 합니다. 또는 허용되지 않은 값을 항상 중립 localized fallback으로 표시하도록 #1603을 수정한 후 현재 서술을 유지해야 합니다.

#1602의 현재 head에서 확인한 비-skip check는 모두 성공했습니다. 다만 이 finding은 연결한 successor의 실제 customer-copy 보장을 과장하는 문서 정확성 문제입니다.

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Exact head dec3cecdd2b523a3fd44b5f8e4da193743e7cb39 updates the baseline row for Search:

• Records PR fix(search): hide internal relationship plumbing #1603 head 622dc08d positive-allowlist and neutral-fallback repair.
• Records focused 7-test, production-build, and desktop/mobile Chromium evidence.
• Keeps hosted exact-head Checks, qualifying review, protected merge, and deployed inspection explicitly pending.
• No completion claim is made from local evidence alone.

OpenCode Review Overview

• Head SHA: daabfe2ef832cb0250bf974701519afb5c683127
• Workflow run: 34697227598
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES
• Coverage gate: success
• Model pool: exhausted
• Verdict: REQUEST_CHANGES
• Formal review: docs(gap): integrate visual and owner-handoff evidence #1602 (review)

Canonical gap-ledger handoff, 2026-09-08: please incorporate on the next ordinary source successor rather than allowing parallel edits. (1) NetworkGraph #1593 live branch drift deleted frontend/src/components/NetworkGraph.bounded-options.test.tsx and re-added .jules/bolt.md; canonical repair is now exact b3ef18a8eb5959ff259d3bc9b543908377f05da4, which restores both scoped blobs and is tree-equivalent to previously verified 7c365620.... #1614 has been reconciled non-force to zero-effective-delta Draft 85669e483db751ec7c52936c8da2503e0d991d1f. Fresh #1593 checks were queued and historical approval/checks do not transfer. (2) Generated #1615 mixed a weaker URL extractor, unrestricted hashlib/MD5 surface, JSON formatter, unpinned pytest-cov, and duplicate Unreleased notes. It is now zero-effective-delta Draft 956dbd33ce9cf2043d399a3a1495178dc88d429f; URL authority remains #1418/#1247, checksum authority remains #1247, and JSON formatter is ancestry-only pending an explicit product contract. (3) The current Search #1603 head has moved beyond the 622dc08d recorded in this baseline; refetch it before changing the Search row. Do not copy these observations verbatim without revalidating live heads/checks at the new #1602 source commit.

Canonical ledger refresh handoff — 2026-09-08

docs/product-technical-gap-baseline.md remains single-writer-owned by this PR, but its source is not fully code-current after the latest same-day PR advances. Do not treat this comment as a substitute for the next ordinary source commit.

Fresh deltas that the next canonical ledger commit must reconcile from live authority:

• Search fix(search): hide internal relationship plumbing #1603 is no longer 622dc08d...; its current owner head is 462b134acf858061019d3ffe37b7b3d60e6f7e74. The newer lineage keeps the positive allowlist/neutral fallback, removes DAG from customer error copy, maps the known machine actions to buyer-facing outcomes, and carries responsive/browser-selector repair. UI Delivery Gate is still FAIL until current-head durable browser/deployed evidence and terminal required review gates exist.
• NetworkGraph perf(network): bound NetworkGraph option materialization #1593 is now 419d3d7aad67e7fe6e258a424a54bc0a45e9370b. Concurrent 27a5acf... kept a local finally but removed the explicit first-5/first-8 insertion-order value assertions and suite-level Map.prototype.values restoration fallback. Ordinary child 419d3d7... preserves that ancestry and restores the stronger test tree, proving bounded iteration and insertion-order semantics while retaining both local and suite cleanup. All earlier checks/approvals are stale; fresh exact-head Application CI/Bandit are running and CodeQL/Docker/Security/Semgrep are queued at this handoff, with post-last-push independent approval still required.
• Internal Mail Smoke concurrency fix(ci): serialize queued Internal Mail Smoke dispatches #1595 is c0823f3891d21787417b1a0ddda9c563736c304e. The canonical contract is queue: max + cancel-in-progress: false with the bounded 100-pending semantics documented. Application CI, Bandit, Docker, Security, and Semgrep are terminal-success; CodeQL has the same central sequencing failure. Required Noema Review admits the current head and provisions contextual-orchestrator, then fails at model-verdict preparation, so the current OpenCode CHANGES_REQUESTED is a failed-check rollup rather than a new source finding.
• Governance docs(agents): 증거 기반 작업 절차 정리 #1566 now has canonical owner head 1aa5033e0f3f2f371235cb86ec7f7b79cd7032de. It semantically absorbed test: pin OpenCode redirect token boundary #1613's OpenCode cross-origin redirect credential-boundary regression in a focused canonical test while test: pin OpenCode redirect token boundary #1613 remains Draft provenance pending protected succession.

The current ledger head dec3cec... retains its existing independent approval, but any source refresh will correctly invalidate that evidence and must obtain fresh exact-head checks/review. Do not merge this stale ledger just to preserve the old approval; do not let #1611 or another sibling become a second docs/product-technical-gap-baseline.md writer.

Correction to the previous #1486 handoff after the RED run reached a terminal verdict:

• 073c2000d4eb1193a650cc4916679ce52d96fd5a has a hosted REAL RED, not merely queued evidence. Application CI 34755292657 failed exactly the three newly added 0019 contract regressions; backend summary was 3 failed / 2027 passed / 2 skipped, frontend passed. Two failures proved the old revision had no Alembic offline context branch, and the third proved the .fetchall() / Python UUID row loop remained. Bandit on that RED SHA was GREEN.
• causal repair remains c1b213610f4c42d46d0de1f4e4b02130fe324458. Current-head Application CI 34755442497 and Bandit 34755442574 are GREEN; Docker 34755442666 was still running at the latest read. Keep the 0019 gap as repair-under-validation until unchanged-head terminal evidence plus independent review.
• feat(noema-agent): add calendar conflict-check tool #1486 still has eight other direct verified backlog items after 0019, with Make TicketTask a first-class workspace-scoped aggregate #1673 remaining the separate structural TicketTask workspace owner.

Please make the next #1602 source update replace the stale hosted-RED wording rather than layering contradictory evidence.

New live PR-state handoff: #1678 (url_extractor) arrived Ready with unrelated frontend dependency/lockfile remediation mixed into the feature lane. I converted it to Draft and repaired ownership non-destructively.

• stale generated head 425189137bb776557f43ec49c018a846f12af8c7 had five changed files; Application CI failed because the unrelated lockfile delta resolved nanoid@3.3.19 while the reviewed repository contract requires 3.3.18.
• current exact head b3d40d916527853cfce46e98234799f66329f8ff restores frontend/package.json and frontend/pnpm-lock.yaml to protected develop exact blobs by an ordinary fast-forward child commit. Effective diff is now only CHANGELOG + backend/api/tools.py + backend/tests/test_tools_api.py.
• dependency/security remediation remains with the canonical dependency/security owner; feat(tools): URL 추출 도구(url_extractor) 기능 추가 #1678 must not absorb it.
• feat(tools): URL 추출 도구(url_extractor) 기능 추가 #1678 remains Draft because CodeRabbit's URL-boundary finding is valid: current regex can retain an unmatched trailing ) in parenthesized prose. Balanced URL parentheses must remain intact; handler and endpoint regressions are still required.
• Bandit is GREEN on b3d40d...; the rest of fresh exact-head workflows were still running at the latest read.

Track this as an owner-boundary repair with a remaining URL extraction contract finding, not as a completed feature or dependency-security fix.

Naruon owner handoff, 2026-09-13: #1486 advanced from c1b213610f4c42d46d0de1f4e4b02130fe324458 to exact ba3f8e0e4594fb6bea0b09daba1af5bd90bc5ef7. Focused RED contract commit 92219e6309c53e0721446a2503f579b150f7c7bc proves the prior 0022 Noema gateway migration had no offline Alembic boundary; its hosted Application run was cancelled by the follow-up and is not claimed terminal RED. Causal fix ba3f8e0... branches on context.is_offline_mode() before bind/inspection, emits deterministic linear add/drop operations, and preserves online idempotency. Current exact-head App/Bandit/Docker were non-terminal at handoff; predecessor c1b213... App/Bandit/Docker were GREEN but are historical. #1486 direct backlog is now 7 items; #1673 remains the separate TicketTask workspace aggregate owner. Please update docs/product-technical-gap-baseline.md only on the canonical #1602 writer branch; no competing ledger write was made.

Gap-ledger handoff (2026-09-13 current run):

• feat(tools): URL 추출 도구(url_extractor) 기능 추가 #1678 generated direct-develop URL lane has been reconciled to canonical URL owner feat: URL 추출기 (url_extractor) 도구 추가 #1496 without force push/rebase. New ordinary two-parent head 23ff5f650c7f3c54248f2b1f9f6c36794a0270db preserves feat(tools): URL 추출 도구(url_extractor) 기능 추가 #1678 lineage and adopts exact feat: URL 추출기 (url_extractor) 도구 추가 #1496 tree 7201537395fbc40dbebb96241ffb905e26f6651f; PR base is now feat: URL 추출기 (url_extractor) 도구 추가 #1496 f1c7f6d2d395cde4e0e227364249b153b4103396. Effective feat(tools): URL 추출 도구(url_extractor) 기능 추가 #1678 delta is 0 files / +0 / -0. Keep it provenance-only until feat: URL 추출기 (url_extractor) 도구 추가 #1496 or a verified successor reaches protected integration. Do not recreate url_count or dependency ownership there.
• feat(noema-agent): add calendar conflict-check tool #1486 remains ba3f8e0e4594fb6bea0b09daba1af5bd90bc5ef7 Draft. Current-head Application CI 34757754617, Bandit 34757754675, Docker 34757754723 are all terminal-success. Its authority body is refreshed accordingly; merge still blocked by no qualifying post-last-source-change independent approval and 7 revalidated direct findings.
• One of those findings is source-current and now evidenced directly rather than inherited from review text: AttachmentReparseWorker._attachment_retry_ids is unbounded, is passed to Attachment.id.in_(retry_ids), and current regression intentionally retains all 60 persistent failures. Repair needs bounded retry metadata/query parameters while preserving periodic full rescan.
• ADR-0005 still has a current/historical contradiction: opening status correction says Email.owner_filters is three-argument/workspace-scoped, while lower Consequences/revision text still describes the two-argument gap as currently open. Mark lower passages historical/superseded.

Please update only canonical docs/product-technical-gap-baseline.md from this owner lane; no competing ledger write was made here.

Gap-ledger handoff (2026-09-13): new generated Sentinel PR #1679 was falsified at the actual archive filesystem sink. Its HIGH claim assumed URL semantics for ZipInfo.filename, but protected services.archive resolves/writes the original percent-encoded name as a literal child under output_dir; no decoder exists before containment/open, and current consumers use filesystem Paths. Ordinary child 03dd59d525e89569fa18961bc7d61904032f6066 restores the exact protected tree while preserving generated ancestry; compare against develop@042b0c70531b229af3acbd0421a2f23098d848b3 is ahead 2 / behind 0 / files=[]. #1679 was therefore closed only after verified no-valid-delta succession, not as cleanup. Fresh recurrence evidence was handed to canonical Sentinel guidance #1667 so sink-backed reproduction can prevent repeated encoded-path false positives. Please fold this topology/evidence into the next canonical docs/product-technical-gap-baseline.md update; no competing ledger write was made.

Naruon owner handoff (2026-09-14): #1486 advanced by ordinary source-order RED→causal fix from ba3f8e0... through RED 9369588b... to exact f70f90f067288910684089b6e618fc40987329ef. Attachment reparse retry metadata and the SQL IN retry predicate are now both hard-bounded at 64; periodic full rescan remains starvation recovery for evicted pending rows. Existing 60-persistent-failure behavior stays inside the hot window. RED hosted App CI was cancelled by the immediate fix push, so classify it as source-order RED only. Fresh exact-head App/Bandit/Docker are admitted but currently non-terminal; current-head independent review is pending. #1486 direct backlog is now 6 items. Please update docs/product-technical-gap-baseline.md only from this canonical #1602 writer; no competing ledger source write was made.

#1486 authority handoff — exact head c1d4d27c0114c7e6c6bc02683f92db4762cd20b8.

The predecessor f70f90f... reached repository-owned Application CI/Bandit/Docker terminal-success before this head change. Current head adds ADR-0006 (Proposed) and routes legacy migration 0011_email_read_state's fixed DO $$ / op.execute() exception through explicit Naruon decision authority without changing runtime SQL or weakening the repository-wide structured-Alembic rule. ADR-0006 forbids generalizing the exception to new migrations, application SQL, dynamic identifiers, or reusable raw-SQL helpers. #1486 direct repair backlog is now 5 items; ADR-0006 still needs current-head review/normal integration before it becomes protected authority. Please update docs/product-technical-gap-baseline.md only from this canonical #1602 writer; this comment is handoff evidence, not a claim that the ledger source is updated.

#1486 handoff, exact 8647d3241b5b8ca675f3375a65daaff7f5c70766: 0020 historical Email.workspace_id migration no longer derives workspace-<organization_id>. Added contract-first 0f5e45fc33795d418fccd57cf0c7a217fbc89a3b (source-order RED; no hosted run appeared before causal push), then causal fix requiring operator-authoritative per-email JSON mapping and/or explicit operator-validated fallback, online zero-NULL verification before NOT NULL, fail-closed offline upgrade unless fallback or complete-map attestation is supplied, and fail-closed offline downgrade unless owner-only identity restoration is explicitly verified. #1486 direct backlog is now 4: isolated disposable-schema PostgreSQL migration smoke, IMAP first-run authoritative workspace bootstrap, stale CHANGELOG auth history, stale ADR-0005 owner_filters history. Please update docs/product-technical-gap-baseline.md only from #1602's canonical writer lane; no competing ledger write was made here.

#1486 handoff — exact source owner advanced after fresh tenant-boundary audit.

Canonical Reply-SLA/Noema owner #1486 now has exact head 75bd1d7df356cb5a34fab0f59ca29ef1584ccd71 on prerequisite #1587 ca8c8b708104060ba28a8f0f7bf1213afb0d3cc0.

New verified sequence:

• 87358099254034c06086c5a34d39ef5711236525 — source-order RED contract only (its hosted Application CI was cancelled by immediate descendants): require first runner registration to preserve the authenticated opaque workspace, reject same-org cross-workspace token rotation, and bind runner WebSocket registration tokens to the registered workspace.
• 898caf0810a4a4cde3c0a0cdca86d8d4341b4d37 — runner-config stops synthesizing workspace-<organization_id>; first registration persists signed AuthContext.workspace_id, and an existing registration bound to another workspace fails closed with HTTP 409 before rotation.
• 1298809de7da40936501ea32d2440c5cdb7c693c — runner WebSocket registration lookup reads token + workspace and rejects either mismatch with WS policy violation.
• 75bd1d7df356cb5a34fab0f59ca29ef1584ccd71 — existing runner WebSocket test doubles updated to the workspace-bound row contract. The earlier IMAP stale workspace-synthesis comment repair is also in ancestry at 5ada6aea17fb5362176cdb03fcdfdfd4ae1b9101.

This closes a deeper gap behind first-run mailbox bootstrap: WorkspaceRunnerConfig can now serve as persisted bootstrap evidence without itself collapsing the independently signed workspace boundary. #1673 remains the separate structural owner for TicketTask.workspace_id; no route-local substitute was added.

#1486 direct repair backlog is now 3: (1) isolate the real-PostgreSQL 0020 smoke in a disposable schema/search_path and prove pre-existing public.email_records unchanged; (2) mark the old CHANGELOG workspace-derivation narrative historical/superseded; (3) make ADR-0005's lower two-argument Email.owner_filters passages explicitly historical/superseded. Current exact-head App/Bandit/Docker receipts were non-terminal at the last read and a fresh CodeRabbit review has been requested; no predecessor evidence transfers.

This is a handoff only. docs/product-technical-gap-baseline.md is still owned exclusively by #1602 and is not code-current for this sequence until this canonical writer commits the ledger update; no competing baseline write was made on #1486.

Naruon owner handoff for the canonical Gap ledger; no competing docs/product-technical-gap-baseline.md write was made from #1486.

Fresh #1486 exact head is 80d5395cb1f36a29d1f99b655c838ee9cfe4fb75 (base #1587 ca8c8b708104060ba28a8f0f7bf1213afb0d3cc0). A fresh audit found the shared backend/tests/conftest.py::dev_auth_dependency_overrides ignored X-Workspace-Id even though API tests already send it, silently reconstructing workspace-<organization_id> / workspace-<user_id>. That could make same-user/same-org cross-workspace HTTP regressions pass without exercising distinct opaque workspace claims. Contract commit 62a8e5bdc696d191ae98268bc893b3ae7c6265a2 requires explicit opaque workspaces to survive and remain distinct; causal fix 80d5395... adds the workspace header to both test auth overrides and preserves it, keeping the legacy derived fallback only for older tests that omit the header. Production auth source is unchanged. CodeRabbit's focused exact-head review reports no new actionable findings in this range, but there is still no qualifying formal current-head approval.

The documentation sweep also found ARCHITECTURE.md on #1486 exact head is stale against the same branch: its Data and tenancy section still describes Email ownership/message identity as (user_id, organization_id) and historical tenant backfill as future work, while the branch now has non-null Email.workspace_id, three-part owner filtering, 0020 operator-authoritative backfill/fail-closed contracts, and same-org cross-workspace denial tests. Treat this as a repair finding; do not weaken the code contract to match the stale document.

Current direct #1486 repair backlog is 4: (1) isolate the 0020 real-PostgreSQL smoke in a unique disposable schema/search_path and prove public.email_records is untouched, (2) mark stale workspace-derivation CHANGELOG history superseded, (3) mark ADR-0005 lower two-argument Email.owner_filters passages historical/superseded, and (4) update ARCHITECTURE.md Data/tenancy to the actual three-part workspace owner contract while keeping #1673 as the separate structural TicketTask.workspace_id owner. Current-head repository workflows are still non-terminal; predecessor evidence is not transferable.

Owner handoff — 2026-09-14: new UI lane #1681 is now narrowed from generated title-only changes to a focused Calendar accessibility contract at exact 177d838f3ac61f07a0a8073c3def437a90c5c44e. Effective delta is only CalendarSidebarRight.tsx + focused regression. RED contract fa09503... requires a visible disabled-action reason associated by aria-describedby; causal fix 47cd698... implements it; 177d838... restores Search/Settings to protected-base blobs because their generated loading titles were pointer-only/redundant. #1681 remains Draft/UI Delivery Gate FAIL pending exact-head hosted checks, independent review, and rendered browser/AT/responsive evidence. Please adopt this only in the canonical docs/product-technical-gap-baseline.md writer if it materially changes the buyer-visible gap ledger; no competing ledger write was made.

Owner handoff correction — #1681 advanced to exact 512548e66ed78c468462a4c762e5b1ed741eefe5 through concurrent commit docs(tools): obsolete task acknowledged. Fresh compare 177d838f3ac61f07a0a8073c3def437a90c5c44e..512548e... is ahead 1 with files=[]; preserve it as intervening ancestry but do not count it as a product fix/test or valid evidence-generation action. The causal product tree remains 177d838..., and #1681 effective diff remains only CalendarSidebarRight.tsx + its focused regression. Current-head repository checks were re-created for 512548e...; predecessor 177d838... runs were cancelled and must not be transferred. CodeRabbit status has carried forward SUCCESS to the no-op head, but UI Delivery Gate remains FAIL until current-head required checks and rendered xl browser/responsive evidence complete. No competing Gap-ledger source write was made.

Owner handoff — #1681 advanced to exact fd00657fa7d914dd4ef7621d24ba4406f95052a4. The effective buyer-visible lane is now four files: Calendar right-sidebar source, its focused jsdom regression, frontend/tests/e2e/calendar-disabled-actions.spec.ts, and frontend/package.json wiring that runs the exact desktop Playwright spec after the existing full:smoke. The browser contract reaches the real no-event state by hiding all six calendars at 1440px; verifies the visible unavailable-action explanation plus aria-describedby, native disabled focus behavior, empty-location association, and horizontal overflow; captures a desktop screenshot; then switches to 1024px and verifies the xl-only rail hides without overflow. Search/Settings generated title changes remain restored to protected-base blobs. Concurrent 512548e... was a no-file Jules descendant and is preserved only as intervening ancestry, not counted as a fix/test. #1681 remains Ready-for-review but UI Delivery Gate FAIL until current fd00657... hosted checks and qualifying current-head review evidence are terminal; screenshot capture is specified but no durable visual-inspection claim is made. Please adopt only through the canonical docs/product-technical-gap-baseline.md writer if this changes the buyer-visible gap ledger; no competing ledger source write was made.

Owner handoff correction — the Calendar accessibility lane has moved to clean successor #1682. Exact successor head cefe20bb598c9fa6449cf8dcd5550a739e469c75 is a one-commit child of protected develop@042b0c70531b229af3acbd0421a2f23098d848b3 and points to tree 483fdd562afd0bd9f97688e5e2ae9235e9ddaf1f, byte-identical to superseded #1681's effective source/test tree at fd00657.... #1681 was closed only under the full-successor exception because its Jules-owned branch repeatedly appended no-file docs(tools): obsolete task acknowledged descendants that cancelled exact-head CI. #1682 carries all four effective files, predecessor contract-first provenance, visible Calendar disabled-action semantics, focused jsdom regression, Playwright desktop/1024px acceptance, and full:smoke CI wiring. UI Delivery Gate remains FAIL until #1682 current-head required checks and current-head independent review/browser evidence are terminal. Please treat #1682 as canonical for this gap; no competing docs/product-technical-gap-baseline.md source write was made.

Naruon single-writer handoff — 2026-09-14

#1682 is now at exact 51796c117adf44460b098e662e361be758e9377b / tree a6a507ae749adad21a2b5f8b73702cd3e45fba58. Fresh audit found the Calendar no-selection sidebar still rendered hard-coded event facts (2026.05.23 (목), 참석자 6명, two named attachments) despite selectedDetailEvent === null. Source-order RED 7490b0f35dc66f9d3c7de000a3870874f0a0c3a5 adds the no-fabricated-detail contract; causal fix c3710a7bc5b4461159a6ddeac34b0fa7f510bdc6 hides date/attendee/attachment blocks unless an event is selected; 51796c117adf44460b098e662e361be758e9377b adds real desktop Playwright assertions for the same empty-state integrity boundary. No terminal hosted RED is claimed because the RED head was immediately superseded.

The selected-event detail model still does not carry all displayed attendee/attachment/date fields, so provider/source-authoritative selected-event detail remains a separate buyer-visible data-contract gap; #1682 does not claim it solved that broader issue. Please absorb this evidence/gap on the next canonical docs/product-technical-gap-baseline.md source update. No second ledger writer was created.

Naruon single-writer handoff — 2026-09-14

#1486 moved from 80d5395cb1f36a29d1f99b655c838ee9cfe4fb75 to exact 307014ada15f4c6c7407e064948cb171c6bb1170 after a real hosted RED. Application CI 34781909054 completed backend 2 failed, 2044 passed, 2 skipped; both failures were test_email_workspace_migration_real_postgres_smoke parameterizations. The direct Operations.context(MigrationContext(...)) harness installs op but no module-level Alembic EnvironmentContext, so revision 0020 raised at context.is_offline_mode() before DDL. 307014a... adds the minimal _is_offline_mode() seam: normal Alembic offline execution still uses the EnvironmentContext/fail-closed x-arg path; only direct proxy-absent MigrationContext execution is treated as online. Current-head App/Bandit/Docker were newly queued at handoff time.

The direct #1486 repair backlog remains four items: disposable-schema/search_path isolation for the 0020 real-PG smoke with proof public.email_records is unchanged; supersede stale workspace derivation in CHANGELOG; mark lower ADR-0005 two-argument owner-filter passages historical; update ARCHITECTURE Data/tenancy to the current three-part Email workspace contract while keeping #1673 as the separate TicketTask structural owner. Please absorb this exact RED→fix evidence on the next canonical docs/product-technical-gap-baseline.md source update. No competing ledger writer was created.

#1486 handoff — exact product head d5ccede669867a2a47edba179e71f552f15674a6.

This run removed three verified code-current gaps on the canonical #1486 lane: ARCHITECTURE.md now reflects three-part Email workspace ownership and separates #1673's TicketTask structural gap (4dcb45f...); ADR-0005 now marks the old two-argument Email.owner_filters limitation historical (6f082de...); and the real-PostgreSQL 0020 smoke now runs in a unique disposable schema/search_path and proves public.email_records is unchanged (d5ccede...). One direct #1486 source repair remains: CHANGELOG's old workspace-<organization_id> rejection narrative must be marked superseded because current auth accepts an independently signed opaque workspace claim.

Do not treat this comment as a baseline source update. #1602 remains the sole writer for docs/product-technical-gap-baseline.md; its source head is still daabfe2ef832cb0250bf974701519afb5c683127 until this handoff is adopted by an ordinary source commit. #1486 stays Draft; exact-head checks/review, #1587 prerequisite integration, #1670 successor completeness, and #1673 structural workspace ownership remain separate gates.

Canonical ledger handoff from #1486 (do not treat this comment as a baseline source update): live #1486 exact head is 4e5d4f9c9aa2542e72058f0f0275a2b2368daa45, still Draft on prerequisite #1587. Current ancestry now includes the code-current ARCHITECTURE/ADR workspace contract, disposable-schema PostgreSQL 0020 smoke, and the Docker E2E cleanup repair that scopes same-Message-ID deletion by (user_id, organization_id, workspace_id, message_id). One verified direct source backlog remains in #1486: CHANGELOG's intermediate statement that auth rejects non-workspace-<organization_id> workspace IDs must be retained as history but explicitly marked superseded by the current independently signed opaque workspace contract. Fresh PR-triggered Application CI/Bandit/Docker runs on unchanged 4e5d4f9... are currently queued, and no qualifying current-head independent approval has been established. Please absorb this evidence only through #1602's single-writer docs/product-technical-gap-baseline.md lane.

#1486 owner handoff — 2026-09-14

Exact #1486 head is now 278af18e4e1e596625c31385cefaf54e6d99128e. CodeRabbit's review of predecessor 4e5d4f9... correctly found that the live Docker E2E cleanup regression asserted user/org/workspace but did not prove the message_id predicate or its expanding bind. The new child hardens backend/tests/test_live_seed_scope.py to require email_records.message_id in the compiled DELETE and the exact MESSAGE_IDS fixture values in the expanding parameter. Production cleanup code is unchanged; no hosted RED is claimed for this evidence-only repair.

Direct #1486 source backlog remains one item: mark the historical CHANGELOG claim that auth rejects non-workspace-<organization_id> workspace values as superseded by the current independently signed opaque workspace contract. #1673 remains the separate canonical structural owner for first-class TicketTask.workspace_id. Please reflect these states in the Gap ledger only from #1602's own single-writer source lane; this comment is handoff, not a claim that docs/product-technical-gap-baseline.md is already updated.

Naruon UI-gap handoff — #1682 advanced to exact 9b6c13c304bd100fd1c95bc57b713c2e445b6e4b after a fresh functional-integrity finding. The selected Calendar detail rail had enabled delete/copy/edit/location and close affordances without any execution callbacks/API contract. Contract-first d11c22a (source-order RED) → causal source fix 56baccb → browser acceptance 9b6c13c now keeps unsupported actions native-disabled with visible reasons, removes the inert close button, and verifies selected+empty desktop plus 1024px behavior. #1682 remains Draft; current-head gates/review are not yet terminal. This is a handoff only—please update docs/product-technical-gap-baseline.md from #1602's single-writer source lane rather than treating this comment as ledger source.

Naruon owner handoff: #1486 advanced from 278af18... to exact 8b3b8ecd53e6be1c7014735dba15f56e4625488c while reconciling #1670 successor completeness. Fresh comparison showed #1486 already carried #1670's valid production algorithm, but lacked its dedicated transaction-budget evidence. 399809a22c860b02d150f0793db66645a28bd8ef adds the suite adapted to #1486's workspace-aware source contract (including workspace-move fail-closed and one-query workspace reload); 8b3b8ecd... adds combined doctoring and #1673 limitation. #1486 remains Draft; current-head workflows/review are not terminal and the historical CHANGELOG workspace-auth correction remains. This is a handoff only—please update docs/product-technical-gap-baseline.md from #1602's single-writer source lane rather than treating this comment as ledger source.

Gap-ledger handoff from #1486: current combined owner head is 9eb75d19cd5d917ad11adddfb6422cdf14ec6149. Added backend/tests/test_reply_sla_batch_conflict_postgres.py so #1670 successor evidence no longer relies only on the SQLite unit-of-work bridge for retry exhaustion: migrated PostgreSQL now supplies the actual unique-constraint/SAVEPOINT path through the full batch-attempt budget and verifies no partial worker write survives the outer rollback. This is a handoff only; #1602 remains the single writer for docs/product-technical-gap-baseline.md. #1486 still has one direct source backlog item: correct the historical CHANGELOG claim that workspace must equal workspace-<organization_id>; current auth accepts independently signed opaque workspace claims.

Gap-ledger handoff (dependency topology, 2026-09-14): backend dependency #1685 is now Draft-stacked on canonical TestClient foundation #1565 (52dfc863d1a5d6e4e80b6366f719dd09f2aa6172) instead of develop; retargeting correctly exposes a merge conflict. Exact #1685 head d096a5c235d2c1d8b5a5751cdd4e2c8cbba17c21 upgrades Starlette to 1.6.0 but omits #1565's direct httpx2 requirement and does not update backend/uv.lock, so taking its dependency files wholesale would regress warnings-as-errors TestClient execution. CI dependency #1686 (4ad0c7abab650a6e2b9bb9e108df10001f8f1f20) also rewrites backend manifests, so it is now stacked on #1685 rather than independently writing the same backend dependency surface. Preserve the canonical order #1565 → repaired #1685 → reconciled CI/connector-only #1686 in docs/product-technical-gap-baseline.md; comments are handoff only, not a substitute for #1602's source update.

Gap-ledger handoff: the CI/migration prerequisite topology changed materially and should be reflected by the single ledger writer when it next updates docs/product-technical-gap-baseline.md.

Current canonical path is #1565 → #1503@19d5860bc27e860acba940390f5792721cd99e5e → #1587@1bc14b398aa9e240ef8c5e8191bcec494dad027a → #1486.

#1587 has ordinary-inherited #1503 as a two-parent non-force merge and is now directly retargeted to #1503; the previous #1587 fresh-schema emails Application-CI RED is historical on the integrated lane and must be re-evaluated on exact 1bc14b398.... #1486 is currently non-mergeable against the advanced #1587 base and has a verified migration-contract overlap in 0011_email_read_state.py, so it requires explicit non-force reconciliation rather than a wholesale side choice.

This comment is handoff evidence only; no competing baseline source write is made from #1587/#1486.

#1486 code-current handoff — 2026-09-14

Please keep the Gap ledger source aligned with this owner state when #1602 next writes docs/product-technical-gap-baseline.md:

• feat(noema-agent): add calendar conflict-check tool #1486 exact head is now 3070f7895ab9d86c3f1c07cbe5bde8a252e28e82 (Draft, dirty/non-mergeable).
• This head repairs 0016_document_org_scope: historical DBs without workspace_documents are a no-op, and downgrade does not delete later organization assignments. backend/tests/test_document_org_scope_migration_contract.py locks both properties.
• This is source evidence only: exact 3070f789... currently has no PR workflow runs, so no predecessor GREEN is transferable.
• Live prerequisite fix(ci): run repo-local validation on stacked PR bases #1587 is 1bc14b398aa9e240ef8c5e8191bcec494dad027a on fix: create workspace_entities/workspace_documents registry and provision Workspace rows #1503, but feat(noema-agent): add calendar conflict-check tool #1486 PR metadata still reports the older fix(ci): run repo-local validation on stacked PR bases #1587 base SHA ca8c8b708104060ba28a8f0f7bf1213afb0d3cc0. Treat the ancestry mismatch as an active repair finding.
• Alembic must be reconciled as one linear descendant history: fix: create workspace_entities/workspace_documents registry and provision Workspace rows #1503 0018_workspace_registry → 0019_email_read_state_repair first, then rechain/renumber feat(noema-agent): add calendar conflict-check tool #1486-owned calendar-conflict / attachment-UID / email-workspace / correction-rationale / Noema revisions after it. Do not record a parallel-head or ancestry-only merge as complete.
• The stale CHANGELOG.md statement that auth rejects non-workspace-<organization_id> IDs remains direct source debt; current contract accepts an independently signed opaque workspace claim.
• Make TicketTask a first-class workspace-scoped aggregate #1673 remains the canonical owner for first-class TicketTask.workspace_id.

This comment is a handoff only, not a substitute for #1602's baseline source update and not a merge/release receipt.

Naruon owner-path handoff (2026-09-14): fresh stack verification found a new canonical workspace-contract finding that the Gap ledger should not flatten into descendant work.

• fix: create workspace_entities/workspace_documents registry and provision Workspace rows #1503 exact 201656a5b004e427fb2f95580990e9047a8bd7e9 correctly documents workspace_id as an independently signed opaque membership claim, but backend/api/data.py::_auth_context_owns_its_workspace still reconstructs workspace-<organization_id> / workspace-<user_id> and _document_organization_filter gates historical organization_id IS NULL documents on that derived equality.
• The document query already requires exact Document.workspace_id == auth_context.workspace_id; the causal repair belongs to fix: create workspace_entities/workspace_documents registry and provision Workspace rows #1503: remove derived workspace reconstruction, keep exact workspace as primary tenant boundary, keep organization equality for non-NULL rows, and allow the historical NULL organization case only inside the already-matched workspace. Add an opaque-ID regression there.
• fix(ci): run repo-local validation on stacked PR bases #1587 exact a62b94537c1707c046337a1daa4798792b1fc138 inherits fix: create workspace_entities/workspace_documents registry and provision Workspace rows #1503 and therefore inherits this unresolved finding. Its PR authority now records the block rather than claiming the prerequisite contract is fully clean.
• feat(noema-agent): add calendar conflict-check tool #1486 live exact head has advanced to 22c173bb93ef15c3244477fe32540aeb2bcf1199. Intervening commits add a topology regression and set 0018_calendar_conflict_judgments.down_revision = 0019_email_read_state_repair, but feat(noema-agent): add calendar conflict-check tool #1486 still diverges from fix(ci): run repo-local validation on stacked PR bases #1587/fix: create workspace_entities/workspace_documents registry and provision Workspace rows #1503 ancestry. A textual down_revision is not actual prerequisite integration, and exact 22c173bb... currently has no PR workflow runs.

Ledger topology should therefore remain: repair #1503 owner source + exact-head evidence → non-force inherit repaired owner into #1587 → non-force reconcile #1486 ancestry/Alembic line while preserving valid deltas. Do not record #1486 as migration-reconciled merely because the revision string was changed. This comment is a handoff only; docs/product-technical-gap-baseline.md remains #1602's single-writer source.

Canonical ledger handoff — 2026-09-14

#1503 workspace-registry owner advanced normally to exact 2ec2134761789d9b084718e26440ff87fbe1ffd6. This is intentionally source-order RED only: new backend/tests/test_document_organization_scope_opaque_workspace.py pins the verified defect where an opaque signed workspace (e.g. tenant-space-7f3c) loses its own historical organization_id IS NULL document because production reconstructs workspace-<organization_id> / workspace-<user_id>. Both production call sites already include exact Document.workspace_id == auth_context.workspace_id, so the owner fix is to remove that reconstruction and use current-organization OR legacy-NULL as the second predicate.

No PR-triggered workflow run exists yet on 2ec213...; no hosted RED/GREEN or predecessor receipt transfer is claimed. #1587 remains at a62b945... and must not restack onto the RED-only owner head. Required topology is repaired #1503 → ordinary non-force #1587 adoption → ordinary #1486 adoption → descendant Alembic reconciliation. #1486 remains 22c173bb... and Draft/non-mergeable.

Please record this in the next docs/product-technical-gap-baseline.md source update on this single-writer lane; this comment is handoff evidence only, not a baseline source mutation.

Superseding canonical ledger handoff — 2026-09-14

#1503 advanced again to exact eb0bfd5be077b40670795c45c3f7f34726f10065 after CodeRabbit's exact-2ec213... review found a valid P1 in the first RED contract. The earlier suggestion “exact workspace + current-org OR NULL” is withdrawn: a signed AuthContext does not itself prove a trusted organization↔workspace pair, and workspace_entities currently has no organization binding, so that rule could expose a historical NULL-organization document to a second organization presenting the same opaque workspace ID.

The corrected RED now requires server-side workspace_entities.workspace_id + workspace_entities.organization_id binding evidence (including an EXISTS guard) and a same-opaque-workspace/different-organization negative case. Production remains intentionally unchanged; this is still source-order RED, not hosted RED/GREEN.

Canonical sequence for the ledger is now: #1503 trusted workspace↔organization aggregate/provisioning + non-guessing historical binding + guarded legacy document scope → fresh PostgreSQL/current-head evidence → ordinary #1587 adoption → fresh #1587 evidence → ordinary #1486 adoption → descendant Alembic reconciliation. If #1503 adds a forward binding revision after 0019, #1486 must rechain after that new owner head.

This comment supersedes my prior 2ec213... handoff. It is handoff evidence only; docs/product-technical-gap-baseline.md remains single-writer owned here.

Superseding ledger handoff — 2026-09-14

#1503 is now exact fea4d5c39448671c7a1a519930f4ef6bbfbe9fad. CodeRabbit's review of predecessor RED eb0bfd5... found a valid P2: merely asserting that SQL mentions Workspace.workspace_id, Workspace.organization_id, an EXISTS, and both bind values does not prove those claims are correlated on the same workspace row.

The RED was tightened again. It now structurally requires the exact compatibility predicate Document.organization_id == current_org OR (Document.organization_id IS NULL AND EXISTS Workspace WHERE Workspace.workspace_id == current_workspace AND Workspace.organization_id == current_org) and compares same opaque workspace / different organization sessions against distinct correlated predicates. Production is still intentionally unchanged, so this remains source-order RED rather than hosted RED/GREEN.

Canonical sequence remains #1503 aggregate/provisioning/migration/filter repair → real PostgreSQL/current-head evidence → ordinary #1587 adoption → fresh #1587 evidence → ordinary #1486 adoption → descendant Alembic reconciliation. #1587 has become non-mergeable as the owner branch advanced; treat that as expected repair state, not a close condition.

This supersedes the prior eb0bfd5... handoff. Comment only; the Gap baseline source remains single-writer owned by #1602.

Canonical ledger handoff — 2026-09-14

Record #1503 owner progress only on this single-writer ledger: exact 909dacce1366101bc76a19b3cc329725323cc244 now adds 0020_workspace_organization_binding, auditable/unambiguous historical binding/backfill, a fail-closed binding service, and real-PostgreSQL binding/concurrency acceptance source. Do not mark #1503 complete or GREEN: Workspace.organization_id ORM mapping and the backend/api/data.py correlated legacy-document/upload path remain RED, and this exact head currently has no PR-triggered workflow receipt.

Succession remains #1503 repaired+GREEN → ordinary non-force #1587 adoption+fresh evidence → #1486 adoption/rechain after owner 0020. This comment is a handoff only; docs/product-technical-gap-baseline.md remains exclusively owned by this PR.