fix(ci): make stacked PR validation a develop prerequisite - #1691

Merge Risk: 🟡 Moderate · up to 971f1

Backend CI can pass after regressions in its database setup because the intended contract test is not run. Move the test into backend collection before merging.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

@coderabbitai review

Review exact head 971f1752aa43585f372b1fb300d44bab464b4483 as the clean develop-based successor for #1587's eight repository-CI deltas. Please focus on whether removing only PR base filters, adding PostgreSQL-backed backend CI, and the executable governance contracts preserve existing push/release semantics without weakening gates.

#!/bin/bash
set -euo pipefail

echo '== Checked out HEAD =='
git rev-parse HEAD
git status --short
echo

echo '== Pull request metadata =='
gh pr view 1691 --repo ContextualWisdomLab/naruon --json number,title,state,isDraft,baseRefName,headRefName,headRefOid,mergeStateStatus,url
echo

echo '== Commit and changed files =='
git show --no-ext-diff --format=fuller --stat 971f1752aa43585f372b1fb300d44bab464b4483
echo
git diff-tree --no-commit-id --name-status -r 971f1752aa43585f372b1fb300d44bab464b4483
echo

echo '== Changed workflow and governance file outlines =='
git diff-tree --no-commit-id --name-only -r 971f1752aa43585f372b1fb300d44bab464b4483 |
while IFS= read -r f; do
  case "$f" in
    *.yml|*.yaml)
      echo "--- $f (outline) ---"
      ast-grep outline "$f" --items all || true
      ;;
    *AGENTS*|*agents*)
      echo "--- $f (first 260 lines) ---"
      sed -n '1,260p' "$f"
      ;;
  esac
done
echo

echo '== Exact diff =='
git diff --no-ext-diff --find-renames --find-copies 971f1752aa43585f372b1fb300d44bab464b4483^ 971f1752aa43585f372b1fb300d44bab464b4483 -- .github AGENTS.md 2>/dev/null || \
git diff --no-ext-diff --find-renames --find-copies 971f1752aa43585f372b1fb300d44bab464b4483^ 971f1752aa43585f372b1fb300d44bab464b4483
echo

echo '== Workflow files and relevant trigger/database commands =='
fd -t f -e yml -e yaml . .github 2>/dev/null | sort | while IFS= read -r f; do
  echo "--- $f ---"
  rg -n -C 4 '(^on:|pull_request:|push:|branches:|postgres|pgvector|DATABASE_URL|AUTH_SESSION_HMAC_SECRET|migrate|pytest|bandit|dependency)' "$f" || true
done

#!/bin/bash
set -euo pipefail

echo '== Changed test file outlines =='
for f in backend/tests/test_release_governance.py backend/tests/test_stacked_pr_workflow_triggers.py tests/test_postgres_ci_contract.py; do
  echo "--- $f ---"
  ast-grep outline "$f" --items all || true
done
echo

echo '== Changed tests: complete diff and current content =='
git diff --no-ext-diff 971f1752aa43585f372b1fb300d44bab464b4483^ 971f1752aa43585f372b1fb300d44bab464b4483 -- \
  backend/tests/test_release_governance.py \
  backend/tests/test_stacked_pr_workflow_triggers.py \
  tests/test_postgres_ci_contract.py
for f in backend/tests/test_release_governance.py backend/tests/test_stacked_pr_workflow_triggers.py tests/test_postgres_ci_contract.py; do
  echo "--- CURRENT $f ---"
  cat -n "$f"
done
echo

echo '== Complete changed workflow definitions =='
for f in .github/workflows/app-ci.yml .github/workflows/bandit.yml .github/workflows/dependency-review.yml .github/workflows/docker-publish.yml; do
  echo "--- $f ---"
  cat -n "$f"
done
echo

echo '== CI configuration and migration entry point outlines =='
for f in backend/core/config.py backend/scripts/migrate_db.py; do
  if [ -f "$f" ]; then
    echo "--- $f ---"
    ast-grep outline "$f" --items all || true
    rg -n -C 4 '(DATABASE_URL|AUTH_SESSION_HMAC_SECRET|ENCRYPTION_KEY|Settings|def main|asyncio\.run|migrat)' "$f" || true
  fi
done
echo

echo '== YAML parse summary (preserves the Actions on key) =='
python - <<'PY'
from pathlib import Path
import yaml

class ActionsLoader(yaml.SafeLoader):
    pass

for resolver in list(ActionsLoader.yaml_implicit_resolvers):
    ActionsLoader.yaml_implicit_resolvers[resolver] = [
        (tag, regexp) for tag, regexp in ActionsLoader.yaml_implicit_resolvers[resolver]
        if tag != "tag:yaml.org,2002:bool"
    ]
ActionsLoader.add_constructor(
    "tag:yaml.org,2002:bool",
    lambda loader, node: loader.construct_scalar(node),
)
for raw in sorted(Path(".github/workflows").glob("*.y*ml")):
    data = yaml.load(raw.read_text(), Loader=ActionsLoader)
    if raw.name in {"app-ci.yml", "bandit.yml", "dependency-review.yml", "docker-publish.yml"}:
        events = data.get("on")
        print(f"{raw}: on={events!r}")
PY
echo

echo '== Static checks =='
git diff --check 971f1752aa43585f372b1fb300d44bab464b4483^ 971f1752aa43585f372b1fb300d44bab464b4483
if command -v actionlint >/dev/null 2>&1; then
  actionlint .github/workflows/app-ci.yml .github/workflows/bandit.yml .github/workflows/dependency-review.yml .github/workflows/docker-publish.yml
else
  echo 'actionlint is not installed'
fi

#!/bin/bash
set -euo pipefail

echo '== Test configuration candidates =='
fd -HI -t f '^(pyproject\.toml|pytest\.ini|tox\.ini|setup\.cfg)$' . | sort | while IFS= read -r f; do
  echo "--- $f ---"
  cat -n "$f"
done
echo

echo '== Static pytest invocation locations =='
rg -n -C 5 --glob '!**/.git/**' '(python -m pytest|pytest\s)' .github scripts Makefile pyproject.toml pytest.ini tox.ini setup.cfg 2>/dev/null || true
echo

echo '== Root versus backend test directories =='
find tests backend/tests -maxdepth 2 -type f -name 'test_*.py' -print | sort | sed -n '1,240p'
echo

echo '== Exact commit ancestry =='
git show --no-patch --format='commit=%H%nparent=%P%nsubject=%s' 971f1752aa43585f372b1fb300d44bab464b4483
git merge-base --is-ancestor 042b0c70531b229af3acbd0421a2f23098d848b3 971f1752aa43585f372b1fb300d44bab464b4483 && echo 'documented develop base is an ancestor'
echo

echo '== Exact-head check runs =='
gh api "repos/ContextualWisdomLab/naruon/commits/971f1752aa43585f372b1fb300d44bab464b4483/check-runs?per_page=100" \
  --jq '.check_runs[] | [.name, .status, .conclusion, .details_url] | `@tsv`' || true
echo

echo '== Workflow runs associated with the exact head =='
gh run list --repo ContextualWisdomLab/naruon --commit 971f1752aa43585f372b1fb300d44bab464b4483 --limit 100 \
  --json name,status,conclusion,event,workflowName,url,headSha,createdAt,updatedAt

@seonghobae Review of exact head 971f1752aa43585f372b1fb300d44bab464b4483 found one issue.

P2 — Run the PostgreSQL CI contract in Application CI

tests/test_postgres_ci_contract.py is outside the test tree that Application CI runs.

Application CI executes:

cd backend
python -m pytest -q

at .github/workflows/app-ci.yml Line 100 and Line 101. Pytest therefore collects backend/tests, including backend/tests/test_stacked_pr_workflow_triggers.py, but does not collect tests/test_postgres_ci_contract.py.

This leaves the PostgreSQL service, DATABASE_URL, generated AUTH_SESSION_HMAC_SECRET, and migration-before-pytest contract without CI enforcement. A later workflow regression can pass Application CI without executing this contract.

Move the contract to backend/tests/test_postgres_ci_contract.py and update its repository-root calculation. Then verify it through the existing CI command:

cd backend
python -m pytest -q tests/test_postgres_ci_contract.py

The remaining requested semantics are preserved by the reviewed diff:

• All four repository workflows now accept every pull_request base branch.
• Application CI and Bandit retain their existing push branch filters.
• Docker publishing retains its tag-only push trigger and its release-only publish condition.
• PR Docker builds remain non-publishing.
• PostgreSQL uses a pinned pgvector PostgreSQL 16 image.
• The HMAC secret is generated, masked, and exported before migrations.
• Migrations run before backend pytest.
• The stacked-PR trigger contract parses YAML and rejects both include and ignore base filters.

flowchart LR
  A[tests/test_postgres_ci_contract.py] --> B[Not collected after cd backend]
  B --> C[PostgreSQL CI contract can regress undetected]
  D[Move test to backend/tests] --> E[Existing Application CI pytest collects contract]

Static YAML parsing and whitespace checks passed. The exact-head workflow runs are still queued. Terminal required-check evidence is not available yet.

@coderabbitai review

Please review exact head f985a00030028c9989637b3fafffac07d95e2de2. The prior P1 was verified and repaired: the PostgreSQL CI contract moved from uncollected tests/test_postgres_ci_contract.py into backend/tests/test_postgres_ci_contract.py, with REPO_ROOT adjusted to parents[2]; the old root test was removed. Please re-check collection under the actual cd backend && python -m pytest -q path and the unchanged service/secret/migration-order assertions.

#!/bin/bash
set -euo pipefail

head="f985a00030028c9989637b3fafffac07d95e2de2"
repo="ContextualWisdomLab/naruon"

echo '== Exact head =='
git rev-parse HEAD
git show --no-patch --format='commit=%H%nparent=%P%nsubject=%s' "$head"
echo

echo '== Changed paths at exact head =='
git diff-tree --no-commit-id --name-status -r "$head"
echo

echo '== Exact diff for relevant files =='
git diff --no-ext-diff "${head}^" "$head" -- \
  .github/workflows/app-ci.yml \
  backend/tests/test_postgres_ci_contract.py \
  tests/test_postgres_ci_contract.py \
  pyproject.toml pytest.ini tox.ini setup.cfg
echo

echo '== Contract test outline and content =='
ast-grep outline backend/tests/test_postgres_ci_contract.py --items all
cat -n backend/tests/test_postgres_ci_contract.py
echo

echo '== Application CI relevant steps =='
rg -n -C 6 '(postgres|pgvector|DATABASE_URL|AUTH_SESSION_HMAC_SECRET|migrate_db|python -m pytest|working-directory|cd backend)' .github/workflows/app-ci.yml
echo

echo '== Pytest discovery configuration =='
fd -HI -t f '^(pyproject\.toml|pytest\.ini|tox\.ini|setup\.cfg)$' . | sort | while IFS= read -r f; do
  echo "--- $f ---"
  rg -n -C 5 '(pytest|testpaths|python_files|norecursedirs|addopts)' "$f" || true
done
echo

echo '== Test files in relevant locations =='
find backend/tests tests -maxdepth 1 -type f -name 'test_*.py' -print 2>/dev/null | sort
echo

echo '== Exact-head check runs and workflow runs =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
  --jq '.check_runs[] | [.name, .status, .conclusion] | `@tsv`' || true
gh run list --repo "$repo" --commit "$head" --limit 100 \
  --json name,status,conclusion,event,workflowName,url,headSha \
  || true

@seonghobae Review of exact head f985a00030028c9989637b3fafffac07d95e2de2 found no new issues in the requested scope.

The obsolete root-level contract test is deleted.

Application CI runs:

cd backend
python -m pytest -q

backend/tests/test_postgres_ci_contract.py is now below that working directory. backend/pytest.ini does not configure a test path or exclusion that prevents collection. Pytest will collect the contract by its default test_*.py pattern.

REPO_ROOT = Path(__file__).resolve().parents[2] resolves to the repository root from backend/tests/test_postgres_ci_contract.py.

The contract assertions remain intact. They verify:

• The pinned pgvector/pgvector:pg16 image digest.
• The PostgreSQL credentials and readiness command.
• The async PostgreSQL DATABASE_URL.
• No committed AUTH_SESSION_HMAC_SECRET.
• Per-job secret generation, masking, and GITHUB_ENV export.
• Database migrations before backend tests.

The Application CI run for this exact head is still queued. Terminal CI evidence is not available yet.

If you found this review helpful, would you consider giving us a shout-out on X?

Thank you for using CodeRabbit!

You are interacting with an AI system.

@coderabbitai review

Review exact head f985a00030028c9989637b3fafffac07d95e2de2 only. The predecessor finding on 971f1752... was repaired by moving the PostgreSQL CI contract into backend/tests/test_postgres_ci_contract.py and correcting REPO_ROOT for the new depth. Please verify that the current eight-file CI/governance delta still removes only PR base filters, preserves push/release semantics and required gates, provisions pinned PostgreSQL plus generated/masked HMAC bootstrap for backend CI, runs migration before the backend pytest collection, and that the contract test is now actually collected. Do not transfer predecessor approval or workflow receipts to this head.

#!/bin/bash
set -euo pipefail

head="f985a00030028c9989637b3fafffac07d95e2de2"
repo="ContextualWisdomLab/naruon"

echo '== Exact head and ancestry =='
git rev-parse HEAD
git show --no-patch --format='commit=%H%nparent=%P%nsubject=%s' "$head"
git merge-base --is-ancestor "$head" HEAD && echo 'requested head is an ancestor of checkout' || true
echo

echo '== Files changed by the reviewed CI/governance delta =='
git diff-tree --no-commit-id --name-status -r "${head}^"
echo
git diff --no-ext-diff --find-renames "${head}^" "$head" -- \
  .github/workflows/app-ci.yml \
  .github/workflows/bandit.yml \
  .github/workflows/dependency-review.yml \
  .github/workflows/docker-publish.yml \
  AGENTS.md \
  backend/tests/test_release_governance.py \
  backend/tests/test_stacked_pr_workflow_triggers.py \
  backend/tests/test_postgres_ci_contract.py \
  tests/test_postgres_ci_contract.py
echo

echo '== Workflow trigger and backend CI configuration at requested head =='
git show "${head}:.github/workflows/app-ci.yml" | cat -n
for file in .github/workflows/bandit.yml .github/workflows/dependency-review.yml .github/workflows/docker-publish.yml; do
  echo "--- $file ---"
  git show "${head}:${file}" | cat -n
done
echo

echo '== Contract and governance tests at requested head =='
for file in backend/tests/test_postgres_ci_contract.py backend/tests/test_stacked_pr_workflow_triggers.py backend/tests/test_release_governance.py; do
  echo "--- $file ---"
  git show "${head}:${file}" | cat -n
done
echo
echo '== Confirm removed root test =='
git cat-file -e "${head}:tests/test_postgres_ci_contract.py" 2>/dev/null && echo 'root test EXISTS' || echo 'root test is absent'
echo

echo '== Pytest discovery configuration at requested head =='
git ls-tree -r --name-only "$head" | rg '(^|/)(pyproject\.toml|pytest\.ini|tox\.ini|setup\.cfg)$' | while IFS= read -r file; do
  echo "--- $file ---"
  git show "${head}:${file}" | rg -n -C 4 '(pytest|testpaths|python_files|norecursedirs|addopts)' || true
done
echo

echo '== Exact-head remote check evidence =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
  --jq '.check_runs[] | [.name, .status, (.conclusion // "null"), .details_url] | `@tsv`' || true
gh run list --repo "$repo" --commit "$head" --limit 100 \
  --json name,status,conclusion,event,workflowName,url,headSha,createdAt,updatedAt \
  || true

#!/bin/bash
set -euo pipefail

head="f985a00030028c9989637b3fafffac07d95e2de2"
repo="ContextualWisdomLab/naruon"

echo '== PR metadata and comparison base =='
gh pr view 1691 --repo "$repo" --json baseRefName,baseRefOid,headRefName,headRefOid,isDraft,url
base="$(gh pr view 1691 --repo "$repo" --json baseRefOid --jq .baseRefOid)"
merge_base="$(git merge-base "$base" "$head")"
printf 'base=%s\nmerge_base=%s\nhead=%s\n' "$base" "$merge_base" "$head"
echo

echo '== Cumulative changed files from PR base to requested head =='
git diff --name-status "$merge_base" "$head"
echo

echo '== Cumulative trigger and gate comparison =='
for file in .github/workflows/app-ci.yml .github/workflows/bandit.yml .github/workflows/dependency-review.yml .github/workflows/docker-publish.yml; do
  echo "--- $file: base ---"
  git show "${merge_base}:${file}" | rg -n -C 3 '^(on:|  pull_request:|  push:|    branches:|    tags:|    if:|      push:|      branches:|      tags:)' || true
  echo "--- $file: requested head ---"
  git show "${head}:${file}" | rg -n -C 3 '^(on:|  pull_request:|  push:|    branches:|    tags:|    if:|      push:|      branches:|      tags:)' || true
done
echo

echo '== Focused cumulative diff for CI and governance delta =='
git diff --no-ext-diff --unified=20 "$merge_base" "$head" -- \
  .github/workflows/app-ci.yml \
  .github/workflows/bandit.yml \
  .github/workflows/dependency-review.yml \
  .github/workflows/docker-publish.yml \
  AGENTS.md \
  backend/tests/test_release_governance.py \
  backend/tests/test_stacked_pr_workflow_triggers.py \
  backend/tests/test_postgres_ci_contract.py \
  tests/test_postgres_ci_contract.py
echo

echo '== YAML event structures at requested head =='
python - "$head" <<'PY'
import subprocess
import sys
from pathlib import PurePosixPath
import yaml

head = sys.argv[1]
files = (
    ".github/workflows/app-ci.yml",
    ".github/workflows/bandit.yml",
    ".github/workflows/dependency-review.yml",
    ".github/workflows/docker-publish.yml",
)
for name in files:
    text = subprocess.check_output(["git", "show", f"{head}:{name}"], text=True)
    value = yaml.load(text, Loader=yaml.BaseLoader)
    print(f"{PurePosixPath(name)}: {value['on']!r}")
PY

@seonghobae Review of exact head f985a00030028c9989637b3fafffac07d95e2de2 found no issues in the requested scope.

The cumulative delta from develop changes only the intended eight files.

• All four repository workflows now have an unfiltered pull_request event.
• Application CI and Bandit keep their existing push branch filters for develop and master.
• Docker publishing keeps its push.tags: ["v*"] trigger.
• Docker PR validation still uses push: false.
• Docker publication and deployment still require a tag push.

Application CI provisions the pinned image:

pgvector/pgvector:pg16@sha256:ccc6e83d6e35e931dc7c5def2022729d5a6c370318d099181995567ff1fb4d6b

The backend job sets the expected async DATABASE_URL. It generates AUTH_SESSION_HMAC_SECRET per job, masks the value before writing it to GITHUB_ENV, then runs python scripts/migrate_db.py before backend pytest.

The relocated contract is now collected by the Application CI command:

cd backend
python -m pytest -q

backend/tests/test_postgres_ci_contract.py matches the default test_*.py discovery pattern. backend/pytest.ini does not exclude the file or override test paths. Its REPO_ROOT value uses parents[2], which resolves to the repository root. The obsolete tests/test_postgres_ci_contract.py file is absent.

The stacked-PR contract parses the workflow YAML with yaml.BaseLoader and rejects both branches and branches-ignore filters.

Exact-head workflow runs remain queued. No terminal required-check evidence is available for this commit. I did not use workflow receipts from the predecessor head.

@coderabbitai review

현재 exact head f985a00030028c9989637b3fafffac07d95e2de2만 다시 검토해 주세요. backend/tests/test_postgres_ci_contract.py가 Application CI의 실제 backend pytest collection 안에 있는지, PR base-filter 제거가 push/release semantics나 required gate를 약화하지 않는지, pgvector PostgreSQL/HMAC runtime secret/migration-before-pytest 계약이 그대로인지 확인해 주세요. predecessor 971f1752... review는 현재-head 근거로 승계하지 않습니다.

#!/bin/bash
set -euo pipefail

repo="ContextualWisdomLab/naruon"
head="f985a00030028c9989637b3fafffac07d95e2de2"

echo '== Requested head =='
git show --no-patch --format='commit=%H%nparent=%P%nsubject=%s' "$head"
echo

echo '== PR base and cumulative changed paths =='
pr_json="$(gh pr view 1691 --repo "$repo" --json baseRefOid,headRefOid,isDraft,url)"
printf '%s\n' "$pr_json"
base="$(jq -r '.baseRefOid' <<<"$pr_json")"
merge_base="$(git merge-base "$base" "$head")"
printf 'merge_base=%s\nhead=%s\n' "$merge_base" "$head"
git diff --name-status "$merge_base" "$head"
echo

echo '== Cumulative workflow and contract diff =='
git diff --no-ext-diff --unified=12 "$merge_base" "$head" -- \
  .github/workflows/app-ci.yml \
  .github/workflows/bandit.yml \
  .github/workflows/dependency-review.yml \
  .github/workflows/docker-publish.yml \
  AGENTS.md \
  backend/tests/test_release_governance.py \
  backend/tests/test_stacked_pr_workflow_triggers.py \
  backend/tests/test_postgres_ci_contract.py \
  tests/test_postgres_ci_contract.py
echo

echo '== Current workflow definitions at requested head =='
for file in .github/workflows/app-ci.yml .github/workflows/bandit.yml .github/workflows/dependency-review.yml .github/workflows/docker-publish.yml; do
  echo "--- $file ---"
  git show "${head}:${file}" | cat -n
done
echo

echo '== Current contract tests at requested head =='
for file in backend/tests/test_postgres_ci_contract.py backend/tests/test_stacked_pr_workflow_triggers.py backend/tests/test_release_governance.py; do
  echo "--- $file ---"
  git show "${head}:${file}" | cat -n
done
echo

echo '== Pytest configuration at requested head =='
git ls-tree -r --name-only "$head" | rg '(^|/)(pyproject\.toml|pytest\.ini|tox\.ini|setup\.cfg)$' | while IFS= read -r file; do
  echo "--- $file ---"
  git show "${head}:${file}" | cat -n
done
echo

echo '== Contract test path status =='
git cat-file -e "${head}:backend/tests/test_postgres_ci_contract.py"
if git cat-file -e "${head}:tests/test_postgres_ci_contract.py" 2>/dev/null; then
  echo 'obsolete root test exists'
else
  echo 'obsolete root test absent'
fi
echo

echo '== YAML event structures at requested head =='
python - "$head" <<'PY'
import subprocess, sys, yaml
head = sys.argv[1]
for file in (
    ".github/workflows/app-ci.yml",
    ".github/workflows/bandit.yml",
    ".github/workflows/dependency-review.yml",
    ".github/workflows/docker-publish.yml",
):
    text = subprocess.check_output(["git", "show", f"{head}:{file}"], text=True)
    data = yaml.load(text, Loader=yaml.BaseLoader)
    print(f"{file}: {data.get('on')!r}")
PY
echo

echo '== Exact-head checks and runs =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
  --jq '.check_runs[] | [.name, .status, (.conclusion // "null"), .details_url] | `@tsv`' || true
gh run list --repo "$repo" --commit "$head" --limit 100 \
  --json name,status,conclusion,event,workflowName,url,headSha,createdAt,updatedAt || true

@seonghobae 현재 exact head f985a00030028c9989637b3fafffac07d95e2de2만 기준으로 검토했습니다. 요청 범위에서 새 문제는 찾지 못했습니다.

• Application CI는 .github/workflows/app-ci.yml에서 cd backend 후 python -m pytest -q를 실행합니다.
• backend/tests/test_postgres_ci_contract.py는 이 작업 디렉터리 아래에 있습니다.
• backend/pytest.ini에는 testpaths, python_files, 또는 해당 파일을 제외하는 설정이 없습니다.
• 따라서 pytest 기본 test_*.py 수집 규칙이 이 계약 테스트를 수집합니다.
• 기존 root 경로 tests/test_postgres_ci_contract.py는 현재 head에 없습니다.
• REPO_ROOT = Path(__file__).resolve().parents[2]는 backend/tests/test_postgres_ci_contract.py에서 저장소 루트를 가리킵니다.

PR 트리거와 release 동작도 현재 head에서 유지됩니다.

• app-ci.yml, bandit.yml, dependency-review.yml, docker-publish.yml의 pull_request에는 base branch 필터가 없습니다.
• Application CI와 Bandit의 push.branches는 계속 develop, master입니다.
• Docker workflow의 push.tags는 계속 v*입니다.
• PR image validation job은 github.event_name == 'pull_request'와 push: false를 유지합니다.
• 이미지 publish 및 AKS deployment job은 계속 tag push 조건을 요구합니다.
• Dependency Review는 fail-on-severity: moderate 및 warn-only: false를 유지합니다.
• 현재 변경 범위에는 중앙 required workflow 또는 PR governance gate를 제거하거나 완화하는 변경이 없습니다.

PostgreSQL backend CI 계약도 현재 head에서 유지됩니다.

• PostgreSQL 서비스는 pinned pgvector/pgvector:pg16 digest를 사용합니다.
• 서비스는 test 사용자, test 비밀번호, test_db 데이터베이스와 pg_isready -U test -d test_db readiness check를 설정합니다.
• DATABASE_URL은 asyncpg PostgreSQL URL을 설정합니다.
• AUTH_SESSION_HMAC_SECRET는 workflow에 고정 값으로 저장되지 않습니다.
• CI는 secret을 생성하고, ::add-mask::를 먼저 실행한 후 GITHUB_ENV에 secret을 기록합니다.
• migration step은 backend pytest step보다 먼저 실행됩니다.
• backend/tests/test_postgres_ci_contract.py는 위 설정과 순서를 명시적으로 검증합니다.
• backend/tests/test_stacked_pr_workflow_triggers.py는 YAML을 yaml.BaseLoader로 읽고 branches 및 branches-ignore를 모두 거부합니다.

현재 exact-head GitHub Actions는 모두 queued 상태입니다. 따라서 terminal required-check 결과와 실제 pytest 실행 결과는 아직 확인할 수 없습니다.

You are interacting with an AI system.

Fresh PostgreSQL execution has converted the former queue/wait state into a real migration RED. Exact f985a00030028c9989637b3fafffac07d95e2de2 Application CI run 34918251940 reaches a healthy pgvector PostgreSQL 16 service, installs dependencies, passes Ruff and HMAC bootstrap, then fails in 0001_initial_control_plane because compatibility SQL attempts CREATE INDEX ... ix_emails_owner_date ON emails (...) although the current fresh schema intentionally has email_records and no emails table.

I opened direct-develop prerequisite #1694 at exact 10f046ee5ea004ec9236d59d3ccfeab3e1a417be. It preserves the legacy index only when an actual historical emails table exists and adds focused fresh/legacy branch tests. #1691 should remain Draft and unchanged until #1694 has exact-head hosted GREEN + qualifying independent review and lands normally; do not rerun #1691 blindly or weaken migration-before-pytest.

Fresh stacked-admission evidence: #1700 advanced non-force to exact 2d6800aea110ac04eeedcd5faa91479f62877408 after a real source/test/doctoring repair, remains based on #1612, and fetch_commit_workflow_runs still returns 0 PR-triggered repository runs for that exact SHA. This is not a no-op wake commit; it changed the telemetry fingerprint contract and regression coverage. Treat it as current product evidence that repository-local pull_request base filters still leave valid stacked source heads without Application CI/security receipts. Do not manufacture leaf checks; repair remains owned by #1691 after its prerequisite chain.

Additional concrete consumer evidence for the PostgreSQL CI foundation: #1699 exact 0b83e7062d0829f4b8b6771242b5b6ed0cd57ac7 now contains @pytest.mark.postgres acceptance for attachment-source persistence when derived embedding fails, including Attachment.embedding=None reload and Email→Attachment cascade cleanup. Current protected app-ci.yml has no PostgreSQL service/migration step, so this test cannot become hosted acceptance on the direct-develop lane today; skip/non-execution is explicitly not counted. Once #1691's PostgreSQL-backed migration-before-pytest path normally lands, this is another real consumer that must execute rather than merely collect.

Stacked-admission evidence now includes canonical #1697 successor #1701. Exact 23ab3653543240c9c194e98530bb793d037489bc is a real 4-file data-integrity/security-stack delta based on #1612, including a @pytest.mark.postgres acceptance test, yet fetch_commit_workflow_runs returns 0 repository runs. This supersedes using direct-develop #1699 as the canonical writer and gives another concrete stacked source head that cannot produce the PostgreSQL/security receipt it needs until #1691 fixes PR admission. No temporary retarget or synthetic status should be used.

Fresh stacked-PR evidence (2026-09-16): #1696 was repaired onto real non-force ancestry with live parent #1695. Exact child head edc23f9fc2a839a50d8bc897358b645fd6768539 now compares ahead, behind_by=0, merge-base exactly e3a93f9157a1505d52c02c8c4a9ad3b1a5fabca3, with only four effective child files. Despite that valid stacked topology, fetch_commit_workflow_runs(edc23f9...) returns zero repository-local PR workflow runs. This is a current independent reproduction of the stacked-base trigger defect owned by #1691; do not manufacture leaf receipts or retarget the child to develop as a workaround.

Fresh admission evidence update — 2026-09-16.

The direct-vs-stacked distinction is now reproduced on newly repaired owner boundaries:

• stacked checksum owner feat(tools): add bounded content checksum generator #1361 exact b98dbf984b7128aa0412e318c7590a7eea5d9717 is a normal child of fix(deps): patch frontend audit security floors #1623 509be4c..., behind_by=0, with a real 9-file checksum delta after CSRF extraction, yet its repository-local PR workflow inventory is 0;
• direct protected-base CSRF owner security(csrf): separate browser provenance verification from checksum lane #1706 exact b283f3bd33541cb1f7b2b8110a169c1f87636b3c immediately admitted six repository-local workflows (Application CI 35086721149, Bandit 35086721095, Semgrep 35086721148, Security Scan 35086721109, CodeQL PR 35086721196, Docker 35086721413), currently queued.

This further isolates the repository defect to stacked-PR admission rather than generic workflow dispatch. No temporary retarget, dummy commit, copied workflow, or synthetic status was used.

Also update the prerequisite evidence boundary: #1623 exact 509be4c... now has Application CI, Bandit, Semgrep, and Docker terminal SUCCESS; only CodeQL PR and Security Scan remain queued. Keep the existing protected-integration order and Draft state.

Additional fresh stacked-admission evidence after generated-writer reconciliation:

A new Jules PR #1707 appeared directly on develop with a duplicate SHA-256 hash_generator. Its one distinct valid edge case (empty text) was adopted into canonical checksum owner #1361 at exact 5c42f5270d9424039d58f0a30ef1766b4ed22ab0; #1707 was then ordinary/non-force reconciled onto that exact canonical tree and converted to Draft zero-effective-delta provenance (c7993687f04fc8078987f89260b39747a10dd171).

Fresh #1361 current-head workflow lookup after the real test delta still returns 0 repository-local PR workflow runs, while direct protected-base #1706 continues to admit the six repository workflows. This preserves the same admission diagnosis on the newest checksum owner head; no source-neutral wake commit or temporary base retarget was used.

Correction to the earlier #1710 admission note: a fresh ownership sweep found that #1486 22c173bb93ef15c3244477fe32540aeb2bcf1199 already owns the broad Reply-SLA/Noema source and modifies the same scheduler path. #1710 has therefore been retargeted to #1486 and is now an ancestry-repair successor, not a clean controlled stacked-admission reproduction.

Do not use #1710 as evidence for this PR until it has ordinary/non-force adopted the canonical #1486 owner lineage and the #1700 telemetry prerequisite without dropping either parent’s valid deltas. The clean material reproductions already recorded here (#1709, #1696 source-changing head, #1361, #1593, #1635, #1700/#1701 as applicable) remain sufficient.

The initial #1710 exact head still has zero workflow runs, but after the ownership correction that observation is not isolated from its wrong-ancestry state and should not be counted as additional acceptance evidence.

Fresh stacked-admission reproduction: #1712 a085240288baac27d4bb1373a62ed8ab73aa2abf is a material three-file child of #1700 exact 2d6800aea110ac04eeedcd5faa91479f62877408 (ahead 4 / behind 0). It contains two test-first commits, production telemetry hardening, and doctoring; it is not a no-op/provenance-only descendant. Immediately after PR creation, exact-head repository PR workflow inventory is still 0.

Do not work around with temporary develop retarget, dummy commit, copied workflow, synthetic status, or predecessor receipt. Please retain this exact parent/head pair as another acceptance case for the stacked-PR admission repair.

#1712 reproduction authority advanced after an immediate test-isolation repair. Use current exact child c57b2d110c079fa862c97251aa835215f014365d over exact #1700 parent 2d6800aea110ac04eeedcd5faa91479f62877408; compare is ahead 5 / behind 0 with the same three effective files. This is still material source/test/doctoring work, not a no-op. Fresh exact-head workflow lookup on c57b2d1... is 0 runs. Prior a085240... is predecessor evidence only.

Central CodeQL prerequisite freshness update: .github#2106 has advanced from the body-stated be80eb... to exact 1336eae994859203b08ec40c174b55a0f435ef92, protected/base .github/main@346b46d0025672b727242cec702ec2246b4c844d, ahead 39 / behind 0. Its current five owner workflows are all newly queued (35126885485, 35126885419, 35126885536, 35126885436, 35126885483), so no predecessor hosted evidence transfers. The central PR also still has a real owner-qualified baseline-identity source finding. Keep the required order unchanged: central owner terminal settlement → #1623 terminal CodeQL evidence/integration → #1694 → #1691 → stacked product lanes.

Fresh stacked-admission reproduction — #1713

Draft #1713 is a material 3-file child directly on canonical #1700 2d6800aea110ac04eeedcd5faa91479f62877408. Exact head 76d54e20a020fb96e31554fd43fa3de2bf5053af is ahead 3 / behind 0 with merge base exactly #1700 and contains a real test-first OTEL exception-telemetry repair (backend/core/telemetry.py + focused regression + doctoring). Fresh exact-head workflow lookup returns zero repository-local runs.

This is another controlled #1691 RED: valid stacked ancestry + material production/test delta + zero workflow receipt. No temporary develop retarget, dummy/no-op commit, workflow copy, synthetic status, or predecessor receipt transfer was used.

Separate fresh owner update: central CodeQL bootstrap .github#2106 is now exact 84297876feb1fe08b4ed12552d937258af375210 on protected .github/main@346b46d0025672b727242cec702ec2246b4c844d; its current RED is the two owner-qualified durable-evidence identities in the central Gap baseline. Naruon should continue consuming that owner path rather than copying the handler.

Fresh authority correction:

• stacked material reproduction fix(logging): redact OpenTelemetry setup exception telemetry #1713 remains exact 76d54e20a020fb96e31554fd43fa3de2bf5053af on exact fix(security): bound exception telemetry without raw traceback #1700 2d6800aea110ac04eeedcd5faa91479f62877408 with a real 3-file source/test/doctoring delta;
• CodeRabbit has now submitted formal current-head APPROVED review PRR_kwDOSNjZ2s8AAAABN4zxWA at 2026-09-16T18:48:02Z; fresh review-thread inventory is empty;
• exact-head repository workflow lookup is still 0 runs, so the independent-review lane is GREEN while stacked workflow admission remains RED. Do not transfer fix(security): bound exception telemetry without raw traceback #1700 hosted evidence or push a wake/no-op commit.

Central CodeQL owner also advanced. ContextualWisdomLab/.github#2106 is now exact ff72f8b936ce773b11133b09d9f423469b346ade on protected .github/main@89b225dbecc1c71e3f876fa9d376080093af37e4, open/Draft/mergeable and 41 ahead / 0 behind. Its current intentional RED remains the two owner-unqualified durable-evidence identities in the central Gap baseline; current exact-head Agent Review Runtime Quality and Security Scan are queued, while CodeQL/Semgrep/Python Security are pending.

Naruon #1623 remains the same clean downstream reproduction: five repository workflows GREEN; CodeQL compatibility actions/javascript-typescript/python failed at Release runner or enforce current-head CodeQL verdict, with the dispatch job queued afterwards. Keep this PR Draft until the central owner settles and this foundation can reacquire exact-head evidence without bypass.

2026-09-17 authority delta — #1706 review gate closed

Fresh current-base read changes one item in the stacked-admission evidence set:

• #1706@4788be4ba8f2a5adef287d164bd9181c714d9796 remains based on #1623@509be4c1d9b6c7ba239a108656e2382681a85341 with exactly three effective browser-provenance files.
• CodeRabbit formal review PRR_kwDOSNjZ2s8AAAABN6kH6Q is now APPROVED at 2026-09-16T21:59:23Z; review-thread inventory is empty. That closes security(csrf): separate browser provenance verification from checksum lane #1706's current-head independent-review lane while the head remains unchanged.
• The six workflow runs on the same head remain non-authoritative for the current stacked context: they were created at 2026-09-16T21:50:12Z while the PR still targeted develop, one second before retarget to fix(deps): patch frontend audit security floors #1623. Fresh lookup still shows those same receipts queued/pending; later completion cannot retroactively bind them to the fix(deps): patch frontend audit security floors #1623 integration context.

This strengthens the gate model already recorded here: exact-head review can be valid after retarget, but hosted evidence must bind the current base + head + pull_request event context. No no-op commit, temporary retarget, copied workflow, synthetic status, or blind rerun is introduced.

2026-09-17 exact-head handoff — Settings accessibility duplicate/stack evidence

• canonical fix(a11y): remove redundant aria-disabled from native disabled buttons #1676 was ordinary/non-force restacked from predecessor 7117c781fa035d756e6a47fcb40bc5e82e5f1e6e onto prerequisite fix(deps): patch frontend audit security floors #1623 509be4c1d9b6c7ba239a108656e2382681a85341 as exact head bebc2ed8708977fa662c1b60b42c3415adae4bf2, tree 51eba17546861e17bedf74a790d51a044f029237.
• compare fix(deps): patch frontend audit security floors #1623→fix(a11y): remove redundant aria-disabled from native disabled buttons #1676 has behind_by=0 and exactly two effective files: SettingsLayout.tsx (-2 redundant aria-disabled) and SettingsLayout.native-disabled.test.tsx (+35 contract test).
• six workflow runs were created for bebc2ed... at 2026-09-17T02:47:53Z, before the PR retarget/update completed at 02:47:59Z. GitHub now displays mutable current base fix(deps): patch frontend audit security floors #1623 on the run object, but by event timing these receipts were admitted under the previous direct-develop context and are not current stacked-base evidence. Do not transfer them.
• predecessor CodeRabbit approvals are dismissed; current exact-base/head review was freshly requested and is not yet formally approved.
• new generated duplicate 🎨 Palette: aria-disabled 중복 속성 제거 #1716 was not closed: its direct-develop predecessor 61cdd39f... had all six GREEN workflow receipts, then it was reconciled to fix(a11y): remove redundant aria-disabled from native disabled buttons #1676 and, after fix(a11y): remove redundant aria-disabled from native disabled buttons #1676 moved, ordinary/non-force restacked again as b989004e24825f55a884084f12314c26ea0e4670. Compare current fix(a11y): remove redundant aria-disabled from native disabled buttons #1676→🎨 Palette: aria-disabled 중복 속성 제거 #1716 is zero files, so 🎨 Palette: aria-disabled 중복 속성 제거 #1716 is Draft provenance only.

This is another concrete base-sensitive control for the #1691 defect: acceptance must bind event-time base + exact head + run creation context, not current mutable PR association or head SHA alone.

Fresh stacked-admission evidence (2026-09-17): #1195 now has ordinary exact head 449a6cc7e93bff9db5fb2556ff1cef50ba55fdc7, whose second parent is current #1623 509be4c1d9b6c7ba239a108656e2382681a85341 and whose effective delta is 14 email provenance/dedupe files. Six PR workflow runs exist for that head, but Application CI run 35183290800 was created at 2026-09-17T04:48:09Z; the PR metadata/base retarget to #1623 was recorded later (updated_at=2026-09-17T04:48:24Z). GitHub now renders that old run's pull_requests[].base as current #1623, proving again that mutable run/PR association cannot establish event-time integration identity. Do not count these six receipts as current stacked-base evidence.

Also, #1675 unchanged exact 8addfa1c0f8176528caf974035ab3099548e67a2 now has formal CodeRabbit APPROVED at 2026-09-17T04:39:54Z, with zero review threads and still zero exact-head workflow receipts. This strengthens the material-stacked class: independent review can be GREEN while repository-local hosted admission remains absent.

New current-base review-context reproduction from #1195: after ordinary retarget/restack to #1623@509be4c1…, exact head 449a6cc7… received CodeRabbit CHANGES_REQUESTED whose review range was historical (d9485287… → 449a6cc7…). One Major finding asked to split upload-limit / embedding-batch work, but the current #1623-base email_import_service.py diff contains none of those changes; they are inherited base/history. The other inline timezone allowlist finding was standards-invalid under RFC 5322 §4.3 and has been evidence-rejected/resolved.

Validation implication: independent-review evidence needs the same context binding as hosted execution—at minimum event-time base + exact head + reviewed diff/merge-base generation. A review attached to the current head is not sufficient if its selected commit range includes deltas that the current base already owns. Do not promote such a review to current-integration GREEN. #1195 remains Draft and has requested a fresh unchanged-head review against its current base.

Follow-up: the unchanged #1195 exact head 449a6cc7e93bff9db5fb2556ff1cef50ba55fdc7 received formal CodeRabbit APPROVED at 2026-09-17T05:43:26Z after the RFC 5322 evidence rejection and current-base diff validation. This closes #1195's current-head independent-review gate, but the review-context reproduction remains valid: the preceding CHANGES_REQUESTED on the same head selected a historical commit range and produced an outside-current-base false blocker. Keep the admission/review contract bound to event-time base + exact head + actual reviewed diff/merge-base generation; head SHA alone is insufficient.

Fresh stacked-admission handoff: canonical email owner #1195 advanced causally from 7ef016b0... to 908a254dd3ce8dc3fccc894b26393705838b38fd (tree 14ca64f356805af4e3bd20e2d9c1da91db67b07b) through IMAP/POP3 duplicate sync-count REDs and a shared persistence-disposition repair. Exact current 908a254d... still has zero repository-local pull_request workflow receipts, so it remains a material stacked-admission reproduction. #1656 was ordinary/non-force restacked as 153d14d9c200d3130a4859801da3d6216139f689 and is again zero-effective-delta provenance on that parent. Do not transfer any predecessor workflow/review evidence; current-head review has been re-requested.

Fresh stacked-admission reproduction after canonical #1195 source movement:

• feat(email): deterministic dedupe provenance — gate strong fingerprints on genuine Date (naruon#1086) #1195 is now exact 630d5461d1eb8b59b392e4170dec66ce1edf034c on base fix(deps): patch frontend audit security floors #1623 509be4c1d9b6c7ba239a108656e2382681a85341 with 26 effective files.
• It contains material source/test/schema/doctoring delta: RED 5d40f83f..., causal POP3 retry-progress fix 7406cb63..., doctoring 630d5461....
• Exact current head still has zero repository-local pull_request workflow receipts. No predecessor receipt should transfer.
• fix(email): persist import provenance evidence for dedupe review #1656 current 61920344e987f3405d4963168726be1274215e82 is a zero-effective-delta provenance descendant on exact feat(email): deterministic dedupe provenance — gate strong fingerprints on genuine Date (naruon#1086) #1195 current tree and remains a negative control, not acceptance evidence.

This keeps #1195 as another material stacked case for the event-time-base + exact-head + run-creation-context admission contract.

Live prerequisite update — 2026-09-18

The central prerequisite section in the body is superseded by current protected owner state:

• .github#2106 merged normally as 8fc54eb9b5db285574a1a22943856e27189643fc at 2026-09-17T14:55:18Z.
• Protected .github/main is now a1d00341a5d559d99e36e1c0d575c1597a9f88ba after merged #2239 adds GHAS base/head configuration-identity proof.
• .github#2040@cab6cdad2683ce7887b62ad089f93e0317f70602 is the current Draft producer/scheduler successor. Its exact RED pins the remaining protocol cutover: the inherited producer still sends legacy codeql-scan with v2-only identity/rerun fields; minimum GREEN is codeql-scan-v2 plus pr_head:{schema:"1",ref,sha}, followed by ordinary semantic reconciliation onto protected main.

On upstream Naruon #1623, central root-cause repair is now protected, so I triggered only the failed jobs of historical CodeQL run 35057412233 on the unchanged exact head 509be4c1d9b6c7ba239a108656e2382681a85341. The new detect-languages attempt is GREEN and the three compatibility jobs are queued. This is a causal post-owner-fix re-execution, not a no-op/source wake; it is not yet terminal acceptance.

#1691 remains Draft. Its integration order now depends on the exact #1623 rerun outcome and the still-live #2040 producer cutover/canary boundary. No stacked-child receipt or predecessor success is promoted.

Central producer follow-up — 2026-09-18

The canonical .github#2040 successor advanced to exact 5edd9cc8033bd9c4327a67ffa6769e397f875f84. Its focused source cutover now emits codeql-scan-v2 and the nested schema-1 pr_head envelope required by the protected receiver. This removes the deterministic source RED at the producer boundary, but #2040 remains Draft/non-mergeable and 145 protected commits behind; current-base semantic reconciliation and exact-head hosted/review evidence are still outstanding.

Upstream Naruon #1623 remains unchanged at 509be4c1d9b6c7ba239a108656e2382681a85341. Its causal failed-jobs-only CodeQL rerun 35057412233 has a GREEN language-detection attempt while the three compatibility jobs are still queued. #1691 remains Draft; no predecessor receipt or focused source repair is promoted to stacked-admission GREEN.

Protected-central advancement — 2026-09-18

Protected .github/main advanced during the fresh sweep to 31cce5fbc09fce86dc5ac0563e22db2feb6d0f2a through merged #2240. Current .github#2040@5edd9cc8033bd9c4327a67ffa6769e397f875f84 is now 154 ahead / 147 behind with merge base fb17ef556f94f673234aa557254ae52779e9a7b0; its focused v2 producer repair remains source-valid but not current-base acceptance.

Naruon #1623 stays on exact 509be4c1d9b6c7ba239a108656e2382681a85341 with causal CodeQL rerun 35057412233 still nonterminal. #1691 remains Draft; ordinary central reconciliation and the exact upstream rerun outcome remain prerequisites.

Central-prerequisite refresh; local stacked-trigger delta/head f985a00030028c9989637b3fafffac07d95e2de2 is unchanged.

Protected .github/main remains 64aa08d7fa487deacd41c761c36277ca68cab6c9. Canonical #2040 is now exact 91e9515a4c5360c800b605862484d6644dbe4c87, 161 ahead / 244 behind, merge base fb17ef556f94f673234aa557254ae52779e9a7b0, Draft/open/non-mergeable.

The traversal contract added at d4cfbcc... is still intentional RED. A whole-file source-mutation attempt accidentally truncated the scheduler core in ordinary commit 4c6a0e29...; ordinary child 91e9515a... restored the exact predecessor core blob. d4cfbcc... → 91e9515a... has zero changed files, so no traversal production fix exists yet and no branch-owned scheduler semantics were lost. Exact current #2040 has zero PR-triggered workflow receipts and no qualifying exact-head approval.

Required order therefore remains: #2040 bounded/path-wise traversal fix + current-main reconciliation + exact-head settlement → fresh unchanged external repository_dispatch canary → #1623 new CodeQL GREEN/protected integration → #1694 → this #1691 → downstream material restacks/current-context receipts. Parent #1695 versus stacked child #1696 remains the local admission control; no temporary retarget/source-neutral wake/synthetic status.

Central owner-path correction — 2026-09-18 KST

Fresh .github#2175 authority changes one part of this PR body's repair-plane description. The source-fix lane has repaired its self-modification P1 at exact 40bbd0ae11a2e51decc30ee6b4bc3510dadaf1b0: RED 49dbe2cd7c78e2e08cef3e944bdf8a6a43a7db55 locks hostile PR-files coverage and the worker now excludes .github/, scripts/ci/, and .git/ from allowed model-authored paths.

That repair makes #2175 safer, but deliberately makes it incapable of editing .github#2040's scripts/ci/pr_review_merge_scheduler_core.py. Its exact-head Source Fix Quality/SAST/Python Security/Security runs remain queued and CodeQL pending, and the exact-head review is COMMENT-only. It is therefore neither a source fix nor terminal acceptance for #2040.

Canonical central scheduler owner #2040 remains exact 609be40b7be3a53ac5a8baf2b48b3af5ad7da237, source-level RED on repository identity, with zero PR workflow receipts. Preserve the existing order: genuine hunk-safe/direct ordinary #2040 repair -> protected-main reconciliation -> exact-head central checks + independent approval -> fresh external dispatch canary -> #1623 new CodeQL GREEN -> #1694 -> this eight-file stacked-trigger owner. No local workflow rerun or central-source copy substitutes for that path.