ops(autofix): enroll ConceptWeave in bounded review-repair target coverage

[seonghobae]

Gap

ContextualWisdomLab/ConceptWeave still lacks an operationally accepted bounded edit-capable review-repair target path in protected central automation. Protected .github/main@e6334e229581a918e2f22de18733b76fa65d7e71 owns the write-capable path:

scripts/ci/pr_review_fix_scheduler.py -> repository_dispatch(pr-review-autofix) -> .github/workflows/pr-review-autofix.yml

Mention-triggered @opencode-agent remains review-only and must not be treated as a source writer.

Current product evidence — 2026-09-22 KST

Active ConceptWeave Source Observation #46 is exact e35de25355cb4aa4bc75d5900a6e09803d80ff41, OPEN / Draft / mergeable. Its PostgreSQL relation/index, first-class relreplident, relreplident × indisreplident, clustered/temporal/NOT NULL, and PRIMARY NULLS NOT DISTINCT findings are source-repaired but intentionally unresolved at review-thread level until one unchanged head obtains Product/Rust/PostgreSQL execution. Repaired semantic defects remain retired as central canaries.

Canonical Product bootstrap #35 is exact 6593dadd4cdbc05864a3967be8f0a0e87528585a, OPEN / Draft / mergeable. Owner-local Product repairs now include deterministic Draft/lockfile validation, exact Node 24.21.0, exact normal Rust 1.98.1, locked release-profile build, and the owned coverage-helper P1: review 5279675828 -> contract RED a4011c1e12013da32914f0eca5f2b4311654f457 -> owned locked 100% coverage helper 5e3a1d622aef9a52feb78b990330f767ca89acc4 -> portable workflow/current 6593dadd.... Exact compare from 7b1b20f... is three ordinary-forward commits touching only Product CI/checker/helper files.

Fresh #35 central generation is CodeQL 35742556865, Security Scan 35742556910, and SAST Semgrep 35742557183; all are queued. Product cannot self-execute on bootstrap #35 while protected ConceptWeave main lacks the Product workflow. No predecessor evidence transfers and no queued lane is GREEN.

Foundation #1 still carries a weaker Product copy and stale Rust 1.98.0 wording. Required product path is #35 terminal acceptance -> normal protected-main landing -> Foundation ordinary/non-force reconciliation against the canonical Product workflow -> #5/#6/#45/#46 ordinary propagation -> fresh #46 Product/native semantic execution. Product/semantic defects already repaired in those owners must never be recreated merely to exercise the central worker.

Current source successor

Draft PR #2298 exact 309a59daa4413c593b93ce625901471a0ca701dc remains the canonical central source successor. Runtime Quality 35514875940, Security Scan 35514875971, and SAST 35514875958 are terminal success. Python Security 35514875944 remains terminal shared-dependency failure; CodeQL 35514875933 remains terminal queue/current-head-verdict lifecycle failure. Queue/lifecycle ownership remains #712.

The reusable pr-review-fix-scheduler.yml remains product-neutral. ConceptWeave uses base_branch=main, retry_hours=2, static max_dispatches=1, and its own conceptweave-hourly-review-repair concurrency group. The source-controlled dispatch-target mirror is deployment evidence only; the live repository variable must be updated and re-read after protected integration.

Canonical central prerequisites

• chore(deps): bump anyio from 4.14.0 to 4.14.2 #2278 exact 8a5251bf409fe84b3dd0cba1e48992f5b8d9eda5: canonical AnyIO 4.14.0 -> 4.14.2 owner; SAST 35649352729, Python Security 35649352757, Security Scan 35649352800 success; CodeQL 35649352653 terminal lifecycle/current-head-verdict failure through ops: diagnose and bound organization GitHub Actions queue starvation #712; qualifying exact-head approval missing.
• fix(strix): resolve evidence binder from trusted source #2291 exact 1794626af3473ef23b9c2e678c3f06fd6c11636f: Runtime Quality 35661200424, SAST 35672611347, Security Scan 35672611396 success; Python Security 35672611349 pip-audit failure on protected AnyIO 4.14.0; CodeQL 35672611353 lifecycle/current-head-verdict failure. Dependency repair belongs only to chore(deps): bump anyio from 4.14.0 to 4.14.2 #2278.
• fix(opencode): skip duplicate same-head review dispatch while in flight #2283 remains the duplicate-dispatch owner; dependency and CodeQL lifecycle repair continue through their canonical owners rather than being copied here.
• fix(review): point OpenCode at the gateway's /v1 routes and split failure classes #2333 remains non-accepted central routing authority. ops: diagnose and bound organization GitHub Actions queue starvation #712 remains queue/admission/current-head-verdict owner.

Required rollout and acceptance

1. Obtain terminal exact-head acceptance for fix(autofix): enroll ConceptWeave in bounded review repair #2298, canonical dependency/lifecycle owners, and protected central OpenCode routing.
2. Integrate normally into protected .github/main without bypass.
3. Update and re-read live OPENCODE_REPOSITORY_DISPATCH_TARGETS with ContextualWisdomLab/ConceptWeave.
4. Preserve one-dispatch budget, head-scoped retry/lease behavior, exact live-head/base revalidation, sealed-file allowlist, hook/remote hardening and fail-closed publication; model routing remains contextual-orchestrator orchestrator/free.
5. After protected integration/live-target admission, freshly discover or revalidate a genuinely current unresolved file-scoped finding on the exact product head. If no valid finding exists, wait; repaired defects must not be recreated.
6. Require a real protected-source PR Review Autofix ContextualWisdomLab/ConceptWeave#<pr>@<sha> execution and a stale-head case that fails closed before publication.
7. The worker may edit only sealed reviewed paths and cannot approve, merge, release, mutate protection, expose provider credentials, or synthesize queued/failed checks as success. No duplicate ConceptWeave caller/workflow may remain.

Keep this issue OPEN until source integration, live-variable verification, accepted model routing, and real unchanged-head/stale-head canaries establish the operational path.

[seonghobae]

Source repair is now carried by Draft #2298 at exact head 309a59daa4413c593b93ce625901471a0ca701dc.

The branch adds a test-first ConceptWeave target contract, enrolls ContextualWisdomLab/ConceptWeave in the consolidated central recovery caller, adds the exact repository to the source-controlled dispatch-target mirror, and records rollout/rollback boundaries. It does not add a product-local writer or widen review-agent permissions.

Runtime acceptance remains open: the live OPENCODE_REPOSITORY_DISPATCH_TARGETS repository variable must be updated/re-read with the exact target, and post-protection unchanged-head + stale-head canaries must prove bounded publication behavior. Current exact-head hosted workflows are queued, so #2298 remains Draft and no GREEN/merge claim is made.

[seonghobae]

Rollout coordination update: ConceptWeave now has a fresh real bounded repair target after the earlier relation-kind defect was repaired. #46 exact cc66dfc8fdea6b8f1cff298187eea7668c9b6fe5 contains review 5261275111, structural RED cd785e46e7cd06313381004f54441d040d849616, and PostgreSQL 18 doctoring for primary-index / primary-constraint reciprocity (pg_index.indisprimary must resolve to the same bounded relation's PRIMARY KEY constraint).

This strengthens, not relaxes, #2295 acceptance: #2298 must first achieve exact-head source acceptance, the live OPENCODE_REPOSITORY_DISPATCH_TARGETS value must then be verified to contain ContextualWisdomLab/ConceptWeave, and unchanged-head plus stale-head fail-closed canaries must prove the protected central worker path. Until then #46 remains its own single writer and this finding must not be used to justify a duplicate product-local writer or an unverified direct dispatch.

[seonghobae]

Fresh ConceptWeave canary candidate: #46 advanced to de1895e1c12d3a567adccb328a4f6f056f7248bf with exact-current review 5261567427. The unresolved production finding is still bounded: observed pg_index.indisprimary=true must resolve to the same relation's same-name, exact ordered-key PRIMARY KEY constraint, while base reciprocity must not require timing/PERIOD lifecycle evidence. This gives #2295 a current real finding for the post-integration unchanged-head canary; it does not change acceptance. #2298 must first reach terminal exact-head acceptance, the live OPENCODE_REPOSITORY_DISPATCH_TARGETS value must be re-read with ConceptWeave present, and stale-head fail-closed behavior must still be proven.

[seonghobae]

2026-09-21 KST currentization: ConceptWeave now has a genuinely live bounded-write canary candidate on #46. Current product head is 020a957e721092d33fd456432888bf360eaa477e; focused RED a4e4eb57e83462ef4258c77af443a7c34ca5991c requires relation-level pg_index.indisreplident cardinality <= 1 at the snapshot-final aggregate seam. Exact-current audit is review 5263411417.

A direct whole-file candidate (75c7d1d93cc693c2afa86408043dd1ca1258d6f0) was rejected after exact patch inspection found unrelated rustdoc deletion plus an invalid relation-sort edit; ordinary-forward 020a957e... restored the exact predecessor lib.rs blob fab8bf00c135f267d739d2b07461bc8190aa2eb5. No semantic delta from that candidate survives. This is concrete evidence for the rollout requirement that the central writer remain bounded to sealed reviewed paths rather than reconstructing large owner files.

If #2298 is protected-integrated and the live OPENCODE_REPOSITORY_DISPATCH_TARGETS admission is verified while this #46 finding is still live on the exact canary head, it is the preferred unchanged-head canary. If the product writer repairs it first, select the next genuinely live actionable file-scoped finding; do not recreate a repaired defect. #2295 remains OPEN until #2298 acceptance, live-variable verification, unchanged-head repair canary, and stale-head fail-closed canary all complete.

[seonghobae]

Hosted-state correction for rollout authority: #2298 exact 309a59daa4413c593b93ce625901471a0ca701dc now has a real Python Security terminal RED. Run 35514875944, job 106163338404 completed setup and failed at Audit dependencies (hard gate). Runtime Quality 35514875940 and SAST 35514875958 remain success; Security Scan 35514875971 and CodeQL PR 35514875933 are still queued.

#2298 changes no requirements/lock file. Its exact shared lock still contains requirements-strix-ci-hashes.txt with AnyIO 4.14.0. Fresh owner discovery found canonical dependency owner #2278 exact 8a5251bf409fe84b3dd0cba1e48992f5b8d9eda5, one-file lock delta AnyIO 4.14.0 -> 4.14.2; duplicate issue #2321 records the same current Python Security class on #2291 and CVE-2026-63374 / CVE-2026-64847 / CVE-2026-63349. Review 5263457520 preserves the evidence limit: the connector does not expose #2298's uploaded pip-audit payload, so this run's individual finding is not independently decoded to AnyIO. Do not create a duplicate dependency fix or blind-rerun #2298; #2278 is the canonical likely prerequisite and #2298 remains fail-closed.

The ConceptWeave #46 cardinality canary remains live at 020a957e721092d33fd456432888bf360eaa477e, but rollout cannot proceed to live-variable/canary acceptance while #2298 has this terminal security RED.

[seonghobae]

Fresh hosted movement: #2298 Security Scan 35514875971 has now completed success on unchanged exact 309a59daa4413c593b93ce625901471a0ca701dc. Runtime Quality 35514875940 and SAST 35514875958 are also success. Python Security 35514875944 remains terminal failure and CodeQL 35514875933 remains queued. This narrows the hosted blocker but does not change rollout admission: canonical #2278 dependency repair / fresh Python Security proof, CodeQL completion, live target verification, unchanged-head canary and stale-head fail-closed canary are still required.

[seonghobae]

2026-09-22 KST authority update: retain the issue OPEN and keep the ConceptWeave relation-mode thread (PRRT_kwDOUKg5E86kiCn2) conditional only. Two central prerequisite facts in the issue body are now stale. .github#2291@1794626af3473ef23b9c2e678c3f06fd6c11636f is OPEN / Ready; its prior CodeQL/SAST/Python/Security generation (35661200465 / 35661200532 / 35661200368 / 35661200566) is terminal cancelled audit history, while a newer same-head Security 35672611396, Python 35672611349, SAST 35672611347 generation is queued and CodeQL 35672611353 pending; Runtime Quality 35661200424 remains queued. .github#2283@928fc276891b185943a2a93ac003e227e4e47f6a no longer has CodeQL queued: required CodeQL 35552210898 is terminal failure after the fail-closed pending-verdict handshake. Both compatibility shards intentionally failed pending; coordinator 106483754900 was admitted ~4h44m later and successfully POSTed the exact dispatch, but no authenticated terminal codeql-dispatch/actions|python verdict is visible. That lifecycle evidence is recorded on queue owner #712 comment 5769689179; do not blind-rerun. #2278 remains four lanes queued, #2333 remains Python/CodeQL/SAST/Security queued + Runtime Quality pending. None of these states establishes protected/live #2298 authority, so rollout acceptance and no-defect-recreation rules are unchanged.

[seonghobae]

Authority update, 2026-09-22 KST: ConceptWeave #46 ordinary-forward advanced to exact 1b5881c573e32661caf1416b99ccfd2ffeebcc7c, still OPEN / Draft / mergeable and source RED. The same pg_class.relreplident P1 now has a third focused contract: relation_replica_identity_mode_projection_contract.rs (+39/-0), because both public compatibility projections rebuild RelationObservation and would otherwise drop an observed mode. Exact-current review is 5273492054; thread PRRT_kwDOUKg5E86kiCn2 remains the same unresolved owner finding.

An off-ref production reconstruction fb839500f3f3dea2dd31229b9138b883428f369f was verified and rejected before branch movement: exact compare exposed unrelated removal of the existing #[must_use] on IndexObservation::access_method(). Do not treat it as product source or canary repair evidence. The live branch remains on the RED-contract head.

#2298 has been currentized to this head. Its canary remains conditional on protected integration, live ConceptWeave target admission, accepted central model routing, and fresh revalidation of the then-current thread. If the product writer repairs this P1 first, retire it rather than recreate it.

Central delta: #2278 exact 8a5251bf... now has current SAST 35649352729 terminal success; CodeQL 35649352653, Python Security 35649352757, and Security Scan 35649352800 remain queued. #2291 and #2333 remain queued/pending on their current heads; #2283 retains Runtime Quality/Security Scan/SAST GREEN, Python dependency RED, and CodeQL lifecycle RED owned by #712. Keep this rollout issue OPEN.

[seonghobae]

2026-09-22 KST authority update

ConceptWeave #46 advanced ordinary-forward from 6331d11b8a91985925575adac7686af76c4046ae to 4309fb0b6476ebf158f03533101e7a8e62b7ea52 with no production-source delta for the new finding.

New product-owned P1: PostgreSQL 18 PRIMARY KEY backing indexes cannot use NULLS NOT DISTINCT. Exact-source review 5276003307 found that ConceptWeave's current base primary-index reciprocity can still admit indisprimary=true + nulls_not_distinct=Some(true) when the same-name/same-key PRIMARY KEY constraint is present. Focused RED 4962672ad64dbaba35088f87b15ca305200b1c1b requires that primary case to fail while preserving standalone non-primary UNIQUE NULLS NOT DISTINCT; doctoring ed72d74889499f53fbd0edaef11e8139f2888680 records PostgreSQL 18 authority. Current 4309fb0... corrects the earlier reciprocity doctoring as well.

Exact 4309fb0... has no native PR workflow run, so this is RED-recorded / execution-unverified, not GREEN. #2298 must not race the active ConceptWeave product single-writer. Treat this only as a conditional future canary after protected integration, live target admission, accepted central routing, writer-lane availability, and fresh exact-source revalidation. If the product writer repairs it first, retire the canary; do not recreate the defect.

[seonghobae]

Authority update — ConceptWeave product head advanced ordinary-forward to 50fe776363ea21124cd1d2ae251a389ebc942121 while the PRIMARY KEY × NULLS NOT DISTINCT finding remains product-owned/source RED. The product writer strengthened index_primary_nulls_not_distinct_contract.rs from the initial two-state RED into a four-state boundary: PRIMARY + Some(true) must fail constraint_backing_index; PRIMARY + Some(false) remains valid; unobserved null treatment (None) remains valid; standalone non-primary UNIQUE + Some(true) remains valid. Exact-current product review 5276257356 pins the minimal causal repair to aggregate PRIMARY backing-index reciprocity only. Do not move the rule into generic unique-index construction/catalog flags, normalize None, or recreate this finding as a central canary while the product lane is active. Exact 50fe776... still has zero native PR workflow runs, so there is no execution acceptance to transfer. #2298 has been currentized to this exact product authority; rollout acceptance and existing central dependency/CodeQL lifecycle gates remain unchanged.

[seonghobae]

2026-09-22 KST authority update: current ConceptWeave Source Observation owner is #46 exact e35de25355cb4aa4bc75d5900a6e09803d80ff41, not the older 7ee8aeb... snapshot in the issue body. All tracked PostgreSQL semantic findings remain source-repaired but execution-unverified and therefore retired as central canaries.

A new Product-CI ownership finding was repaired in the canonical product bootstrap owner, not in #2298: review 5277233448 found #35 invoked a missing scripts/check_ci_contract.py, while the Foundation-derived workflow currently inherited by #46 used dynamic npx --yes validation and had no tracked package-lock.json. #35 now has contract-first RED b8729ab62fb59d20bf7b6ea2af48fdb438e8eb48 and source repair 7e4dc30c4d46a39b6133e5c23e908d00d7722839, preserving lockfile-pinned npm ci / npm run check:json-contracts while adopting Draft/converted-to-draft/closed admission semantics. Exact compare from predecessor 9bb82f... is two commits, only .github/workflows/product.yml (+2/-1) and new scripts/check_ci_contract.py (+55).

This defect is also not a valid #2298 canary. Required product path is unchanged-head #35 acceptance -> normal ConceptWeave protected-main landing -> ordinary/non-force Foundation/Source-stack reconciliation -> fresh #46 Product/native semantic execution. #2298 body has been currentized to the same owner boundary. Keep rollout issue OPEN; no live-target or central-worker action should recreate either the repaired semantic findings or this canonical Product-bootstrap repair.

[seonghobae]

ConceptWeave Product authority update: canonical #35 is now exact a19b6c79773883c6eea2ea635a85a994c69c1506 after review 5277595437 -> deterministic Node-runtime RED 1134aec60a2e0cee059ae895e62c3a15b38fe193 -> production a19b6c.... The Product contract now requires immutable actions/setup-node@820762786026740c76f36085b0efc47a31fe5020, Node 24.21.0 LTS, package-manager-cache: false, and explicit runtime verification before the tracked-lockfile npm path. Fresh #35 Security/CodeQL/SAST generations remain nonterminal, so rollout acceptance/live ConceptWeave target admission does not advance. This repaired Product defect is not a bounded-worker canary and must not be recreated by #2298.

[seonghobae]

ConceptWeave Product-owner currentization: canonical bootstrap #35 is now exact c22a7d8407d6d1fe5569a3b83050242a479a5a26, OPEN/Draft/mergeable. New review 5278183160 found that normal Product Rust quality steps still inherited the mutable ubuntu-24.04 compiler despite ConceptWeave's Rust 1.98.0 production baseline. Contract-first 78d393c9f2dc58131a0e0c11932d8f86a9391edd requires exact Rust 1.98.0 install/selection/verification and rejects floating stable defaults; production c22a7d... applies the pin while preserving nightly-2026-08-20 only for coverage. Isolated contract evidence is predecessor RED -> current GREEN; hosted Security 35729104498, SAST 35729104442, CodeQL 35729104477 are still queued. This Product defect is repaired in its canonical owner and must not be recreated as a #2298 canary. Required sequence remains #35 terminal acceptance/normal protected-main landing -> Foundation/source-stack ordinary reconciliation -> fresh #46 Product/native semantic execution; only a newly revalidated actionable finding after #2298/live-target admission may be dispatched.

[seonghobae]

Supersedes rollout comment 5776827028: ConceptWeave canonical Product bootstrap #35 is now exact ea5647d8a55989fa3d6cd52cbcd49f904c761f20. Authoritative review 5278274496 found the interim Rust 1.98.0 exact pin unacceptable because the Rust Release Team published 1.98.1 on 2026-09-03 to fix a 1.98.0 vtable-generation miscompilation that can produce undefined behavior. Contract-first abd154efc0f0beb591e46d2e3ba766a68cf7a4bb requires exact 1.98.1 and rejects 1.98.0/floating stable; production ea5647d... applies it while preserving the independent coverage nightly. Fresh #35 Security 35729876495, SAST 35729876343, and CodeQL 35729876224 are queued; this is source repair, not hosted acceptance. Foundation review 5278325909 records its stale literal 1.98.0 baseline for post-#35 ordinary reconciliation. This defect is retired as a #2298 canary; do not regenerate it centrally.

[seonghobae]

ConceptWeave Product authority advanced ordinary-forward to #35 exact 7b1b20f6f55e94dc6612df43e2fe2eb23702b9b6. Exact predecessor review 5279004139 identified a release-blocking Product-contract omission: the canonical workflow had pinned Rust 1.98.1 fmt/Clippy/test/rustdoc/coverage but no release-profile build even though ConceptWeave's Product/Technical Gap Baseline requires one. Contract-first 7c6fdc2ab6030187766b2d69aecf4b0a12da6479 requires cargo build --workspace --release --locked; production 7b1b20f... adds only that gate. Compare ea5647... -> 7b1b20f... is 2 commits / 2 files: .github/workflows/product.yml +3/-0 and scripts/check_ci_contract.py +1/-0. Fresh central runs SAST 35736576617, Security 35736576500, CodeQL 35736576535 are queued, not GREEN. This defect is repaired in the canonical ConceptWeave Product owner and must not be recreated by #2298 as a canary. Required order remains central prerequisite settlement -> unchanged-head #35 acceptance/normal protected landing -> Foundation/Source-stack ordinary reconciliation -> fresh #46 Product/native semantic execution.