docs: reconcile protected runtime and commercial gap authority - #547
Draft
seonghobae wants to merge 130 commits into
Draft
docs: reconcile protected runtime and commercial gap authority#547seonghobae wants to merge 130 commits into
seonghobae wants to merge 130 commits into
Conversation
…image Org-wide CI audit found these workflows lack paths-ignore, triggering full CI on every docs-only push/PR and contributing to org Actions queue backlog. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueThanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
test(ci): forbid docs-only required-gate suppression
23 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Keep
docs/product-technical-gap-baseline.mdand its executable authority contract code-current while separating protected truth, active candidate, transient workflow evidence and foreign-owner authority. This remains the sole cross-lane baseline writer.Current exact authority — 2026-09-07 KST
Protected Noema remains GitHub-verified
main@5cd6341866a53351ff412415f677ec2fef23ea33; protected central.github/mainremains GitHub-verifiedc9052e607e5f3cc76e73207e7786b21500721b79. Merged #543 exactb14b37ca12b3b6ae1999d250a393997ffff04decand merged #554 exact01c0a0061a360ea1e3a9586e67744466f7544672are protected truth.Reviewer foundation #536 remains current-main exact
4fe6fe84611dfa1d69d8e0712b72b278429524d0; #553 exact4c92578c7b4cd41f74513cee1b2b2e470d09a20c, #542 exact6cb43c1b45747f000ee176212cbd00f5ee518396, and #550 exact289fbb002c8e8fb0fcb3ee947901574fc7c3fd88remain independently converged current-main lanes. Their CI/reviewer lanes have executed successfully, while Security and/or image lanes remain non-terminal; predecessor GREEN does not transfer.#556 is intentionally a moving stacked lane. The baseline stores an observation and explicitly requires a live re-fetch before integration/release. Live #556 has since advanced to
fecb03d9c632f90f290f921c1d6e90ce86ca5305, adding a versioned fail-closedsandboxed_verifyexecution-receipt adapter while preserving foreign-owner execution semantics. That later moving-stack head is not silently promoted into this baseline revision's merge authority.Hosted RED → causal repair
The ordinary current-main convergence head
02b003de9ac66eb6edc6b5f2a45d604324f05ef5received real hosted CI34083799198, job101623920460. Exact checkout, live-base ancestry verification, lockfile control, install, and typecheck all succeeded. The run failed only inrelease tests: 4 test files failed / 562 passed; 4 tests failed / 3981 passed.The failures were stale executable documentation assertions, not a runtime/product regression. The tests still required superseded protected/main and candidate identities after the baseline had already moved to current truth. In particular they required pre-#543 protected ancestry, old #542/#553/#550 heads, and a frozen #556 head despite the baseline's moving-stack observation rule.
Minimal repairs preserve the baseline instead of rolling current documentation backward:
513c5864d37747725da44d48570760488dfebb80aligns post-trust integration assertions with protectedmain@5cd6341..., merged test(ci): forbid docs-only required-gate suppression #543/fix(trust): roll audited central workflow source to c9052e6 #554, current feat(workflow): add atomic durable task claim and checkpoint CAS #542/fix(toolchain): replace Wrangler/Miniflare GPL-family path #540/docs: fix stale "active PR #80" references in automation-threat-model.md #553 and predecessor-GREEN discipline.3b3df88c1e2ca2bcb6983fb16d1fc3d8d36e1c7amoves the workflow-concurrency contract from stale ci(actions): isolate pull request concurrency #550aeb9c46...to current ci(actions): isolate pull request concurrency #550289fbb0...and current protected-base convergence.eafc06fba79b00fda418931ac85eae57f5897638removes a brittle frozen feat(reviewer): bind evidence receipts to exact claims #556 SHA from the live-open-PR test and instead verifies the baseline's explicit observation-scoped re-fetch contract, while retaining current fix: pin NOEMA_LLM_MODEL routing alias to orchestrator/free #535 authority and fix: pin NOEMA_LLM_MODEL routing alias to orchestrator/free #535→feat(reviewer): bind evidence receipts to exact claims #556 stack ownership.08c84a1f68934274c3e409199e190964d71c17c7removes the obsolete predecessor-central/fix(trust): roll audited central workflow source to c9052e6 #554 assertion from the current-trust test and binds it to current protected central authority plus the integrated consumer.No required gate, coverage threshold, source baseline, DDD owner boundary, or foreign-owner implementation was weakened to make the hosted RED disappear.
Verification
Current exact head is
08c84a1f68934274c3e409199e190964d71c17c7, open / Draft / mergeable. Fresh exact-head workflows areci 34090553680queued,reviewer-ci 34090553779pending, requiredSecurity Scan 34090553756queued, andpatch-validator-image 34090553840queued. The failed predecessor run is diagnostic evidence only; no GREEN transfers to this head.Keep Draft until all four unchanged-head gates are terminal success, review-thread authority remains clean, and protected/central identities remain unchanged.