[Production readiness] Close the evidence-backed Wardnet production gate

[seonghobae]

Current verdict — 2026-09-05

Wardnet is not production-ready on protected main@5829a0f08d78de464dd24393ce5d0f25fba9d126. GitHub Releases remains empty. Protected #159 is current workflow-control truth; candidate PRs, Draft heads, predecessor checks, readiness endpoints and mutable sibling repositories are evidence only until one exact protected release identity satisfies the complete gate below.

Immediate P0/P1 convergence graph

• [P0] Fail closed when management credentials are absent #78 / PR fix(auth): fail closed without write-capable admin on public bind #155 management authentication — exact f74ff25a321dfb1d7109719e2a1fc77e47dc4898, aligned with protected main. It fails closed before readiness when a non-loopback listener lacks a write-capable administrator credential. Re-read all current checks/reviews before integration; no predecessor evidence transfers after a head move.
• Make persistence failure tests deterministic across root and constrained filesystems #74 / PR test(persistence): replace permission-based fault injection with a deterministic seam #93 deterministic persistence failure injection — exact 4775abc66e5350bdbf07ccefca74c10ddb03701a, aligned with protected main. The deterministic write-temp/rename fault seam remains the owner-correct replacement for permission-dependent test behavior. Re-read exact security/code-analysis/governance evidence before merge.
• [Security] Gate AI-agent package installs from untrusted llms.txt and web instructions #128 / PR feat(security): gate AI-agent artifact installation #129 Agent Artifact Admission — exact f6889079ce49b6f08865180dd6a1ffd8145a8192, mergeable but intentionally Draft. Exact CI 33904242427, job 101230630469, acquired a real Ubuntu 24.04 runner and failed deterministically at cargo fmt --check; tests and Clippy were skipped after the formatting failure. Exact Fuzz 33904242501 is terminal success; Security 33904242429, Semgrep 33904242491, and CodeQL 33904242556 remain non-passing while queued. GREEN requires formatting the source and reacquiring all exact-head gates; rerunning the unchanged failing head is not useful.
• security(misp): require affirmative to_ids evidence #168 / PR fix(security): require affirmative MISP to_ids evidence #167 MISP admission — exact ba5dd624e50eec63efc453a54beb57cbe28295a9, intentionally Draft. The MISP to_ids plus attribute/Object lifecycle repair is retained. A later valid shared-feed finding is now tracked separately as security(feeds): reconcile DNSBL snapshot ownership on refresh #172: DNSBL snapshot material can survive a feed refresh because the shared reconciler reaps ThreatIndicators but only upserts DNSBL rows. The corrected RED keeps the refresh snapshot non-empty while withdrawing the target key; shared production GREEN and the valid review thread remain pending.
• fix(misp): preserve MISP threat-level severity semantics #169 / PR fix(misp): preserve source threat-level severity #170 MISP severity translation — Draft child exact 034815040bca40af2732cd0222c3799c1abcd503, non-force restacked on current fix(security): require affirmative MISP to_ids evidence #167 ba5dd624.... It preserves MISP 1/2/3 -> High/Medium/Low source semantics without duplicating security(feeds): reconcile DNSBL snapshot ownership on refresh #172's shared DNSBL lifecycle.
• build(rust): pin and track Rust 1.98.0 #77 Rust/toolchain foundation — Ready/mergeable exact d386d6f57e0c8de3e4839d6c61b593e41f9d7e20. Exact CI 33907688502 is terminal success; central security/code-analysis lanes remain non-passing while queued. Release-evidence child build(release): bind reviewed source to SBOM and provenance evidence #164 stays Draft until this prerequisite or a verified successor is protected truth.
• [DDD] Replace direct runtime env reads with a bounded configuration registry #139 / PR refactor(config): centralize runtime bootstrap snapshot #140 Runtime Configuration — exact 054c11aafe835e497d6149efb09f1ccdee9d03bd, canonical supporting-boundary owner. Consumer feature lanes must adopt it rather than create a competing environment/bootstrap authority.
• [P1] Add bounded distributed admission control, trusted client attribution, and overload behavior #83 local/distributed admission — feat(gateway): bound local limiter cardinality #135 owns bounded local limiter behavior with repository CI/Fuzz GREEN and central lanes still queued; feat(gateway): trust forwarded client IPs only from trusted proxies #165 owns trusted attribution but remains Draft behind protected refactor(config): centralize runtime bootstrap snapshot #140 and complete feat(gateway): trust forwarded IPs only from trusted proxies #157 fuzz/corpus evidence transfer. Do not create a second distributed quota authority in Wardnet.
• [P0] Enforce a fail-closed destination policy for all outbound traffic #79 / PR draft(architecture): preserve outbound-policy RED pending EgressWeave release #136 outbound policy — preservation only. EgressWeave remains canonical reusable egress-policy owner and still has no immutable GitHub Release; reconstruct through a released Rust-consumable ACL rather than merging Wardnet-local destination/DNS/redirect/proxy/TLS authority.
• Preserve fail-closed LLM gateway admission evidence behind contextual-orchestrator #89 / PR draft(architecture): preserve credential-guard evidence pending CO release #88 LLM gateway security evidence — preservation only until contextual-orchestrator publishes a compatible immutable API/client/schema Agent release. Current CO release inventory is empty.
• AI SOC: quarantine-sandbox malware analysis for attachment/link lures (validated by a real incident) #38 quarantine artifact analysis — production integration waits for an immutable quarantine-sandbox-runtime release. Mutable Draft heads are development evidence only.
• [P0] Add an authoritative PostgreSQL control plane with tenant isolation and recoverable migrations #80 PostgreSQL authority, [P0] Add a transactional outbox and idempotent leased workers for external effects #81 transactional outbox, [P1] Integrate Keyverse identity, tenant authorization, consent, and human approval evidence #82 Keyverse identity/human approval, [P0] Put proven WAF/IDS engines in the enforcement path and publish detection-quality evidence #86 Coraza/CRS + Suricata enforcement, [P1] Build an immutable signed release, promotion, and rollback pipeline #84 immutable release/promotion/rollback, [P1] Establish production telemetry, SLOs, incident response, and disaster-recovery evidence #85 telemetry/SLO/incident/restore, and 서버를 켜고 Strix가 포트를 향해 각종 공격을 할 때 감지해내야 함 (CI) #11 deployed Strix attack path remain mandatory product gaps.

Control-plane and governance

Live organization ruleset 18156473 still targets ~DEFAULT_BRANCH, requires one generic approving review with no named required reviewer/team, requires current-thread resolution and central OpenCode/merge-scheduler/Security/Strix/Semgrep/Noema/CodeQL workflows, blocks deletion/non-fast-forward, and exposes OrganizationAdmin/always bypass. Self-approval and bot/model-as-human approval remain forbidden.

.github#772 owns the solo-maintainer policy repair. The central owner plane must reconcile its live policy assertions without weakening deterministic workflow/security/coverage/SBOM/provenance/thread/branch-integrity gates. Ordinary approval deadlock, queued scanners, OpenCode/provider wait, failed tests or release dependency wait are not guarded-bypass authority.

Runner/workflow acquisition remains .github#712 owner work. runner_id=0, steps=[], pre-checkout queueing, coverage materialization failure and model-review current-head timeout are non-passing control-plane evidence, not permission for rerun storms, selector churn, no-op source commits or false GREEN.

Context Fabric / EA release boundary

context-graph-contracts remains a contract-only Shared Kernel and enterprise-architecture-core remains the EA Decision Plane. Both still use develop as live default at the current read, have open owner stacks and no immutable GitHub Release. Branch topology/default/protection repair stays with Context Fabric/central governance. Wardnet does not modify their source or PR state.

External capability artifact/admission/activation grammar remains context-graph-contracts#27 owner work; EA external-capability adoption/risk/provenance remains enterprise-architecture-core#45. Wardnet findings/verdicts stay Wardnet authority. EA may retain verified evidence references but must not promote malware_verdict, artifact_risk_score or individual incident findings to authoritative architecture facts.

Production definition

Close this issue only after every mandatory gap above is protected truth and one exact immutable protected release candidate simultaneously proves fail-closed auth/tenant/security boundaries; shared DNSBL/threat-feed lifecycle correctness; proven WAF/IDS and deployed attack behavior; PostgreSQL authority/RLS/transaction/recovery; bounded multi-replica admission/effects; Keyverse-backed identity and human approval; owned production statement/branch/edge coverage and public docs; dependency/SAST/container/attack gates; immutable package/image/SBOM/signature/provenance/reproducibility; deployment and measured rollback/roll-forward; OTel/SLO/incident/restore evidence; released/versioned external-owner contracts; exact-current review/thread/governance evidence; and zero valid unresolved findings.

Do not close because a document, active PR, feature-branch artifact, predecessor check or mutable foreign head reports readiness. Guarded bypass is limited to a fully proven gate-repair chicken-and-egg with all runnable deterministic evidence terminal GREEN; ordinary queued scanners, review/provider timeout, failed tests, approval wait and release dependency wait never qualify.

[seonghobae]

Fresh readiness override — 2026-09-03: protected truth is still main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128 with no GitHub Release. Current owners are #155 e6f05d77858e91c176cff25c4b11e790bc5dcdd1, #136 3cb1047416c3aa7fa8eb352b842cc55ad8c21b19, #129 85f0f6542a13bfdcc05024b51423851b33ae2ed8, and #140 9389a2d63f0875f688de5ef3adff1ce6b54e1ab1. #155 coverage-source-tree is now successful; downstream coverage-evidence remains queued. These corrections do not change the NOT production-ready verdict and do not authorize predecessor-evidence reuse or routine bypass.

[seonghobae]

Production-gate evidence refresh (2026-09-04 KST), superseding only the stale #155 queue sentence in the issue body: #155@e6f05d77858e91c176cff25c4b11e790bc5dcdd1 is still the unchanged mergeable P0 auth candidate on protected main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128. Repository CI/Fuzz/Security/SAST are terminal GREEN and current inline threads are resolved. In Required OpenCode run 33590351182, bootstrap, coverage-source-tree 100272722468, and coverage-evidence 100479589911 are now terminal success; only opencode-review 100659819151 remains queued before checkout with runner_id=0 and no steps. .github#712 owns that narrowed selective runner-acquisition defect. The central solo-maintainer approval-count defect remains independently live under .github#772 / its owner-plane successor. Neither condition changes the production verdict, permits a routine bypass, or transfers predecessor #138 evidence.

[seonghobae]

Fresh production-gate delta, 2026-09-04: protected main is still cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128 and Wardnet still has zero GitHub Releases. #78/#155 remains the nearest protected-main merge candidate at unchanged e6f05d77858e91c176cff25c4b11e790bc5dcdd1: repository CI/Fuzz/Security/SAST are GREEN, Required OpenCode bootstrap + source-tree + coverage-evidence are now GREEN, and only current-PR opencode-review job 100659819151 remains queued/pre-checkout; .github#712 has the exact owner-plane specimen. Live organization ruleset 18156473 still requires one approving review with no declared required reviewer/code-owner/last-push reviewer and exposes routine OrganizationAdmin bypass, so normal solo-maintainer merge remains structurally unsatisfied; .github#772 now carries a fresh handoff showing reconciler PR #1644 is 19 protected-main commits behind and must be non-force reconciled before live-policy apply/canary verification. #79/#136 has independently advanced from queued evidence to a truthful terminal RED: exact 3cb1047416c3aa7fa8eb352b842cc55ad8c21b19 CI 33698726857 completed failure at the Test step, while Fuzz/Security/SAST/Scorecard/OSV are terminal success and CodeQL remains startup_failure. The valid DNS-resolution deadline source finding therefore remains the next causal Network-Egress repair; no control-plane wait may be misclassified as its cause.