diff --git a/docs/CWL-MASTER-CONTEXT.md b/docs/CWL-MASTER-CONTEXT.md
index 2ce09ee89e..a6ef0622e7 100644
--- a/docs/CWL-MASTER-CONTEXT.md
+++ b/docs/CWL-MASTER-CONTEXT.md
@@ -17,7 +17,7 @@ Turn scattered enterprise context into **judgment-ready structure, then action**
 naruon is fundamentally an **email workspace** that connects scattered context → judgment → action. It is **NOT groupware / HRIS / an approval-workflow (전자결재) / ERP engine.** It **OBSERVES, SYNTHESIZES, and SURFACES** judgment-ready structure to the human — it does **NOT own or execute** org processes (approval routing, recusal, escalation, HR actions, evaluations). The whole relationship / org-hierarchy / authority / norm-group / COI model (§4, §5, §5b) exists for **CONTEXT UNDERSTANDING + SURFACING**, NOT for enforcement. Example: for an in-company couple on a direct reporting line, naruon may NOTICE the multiplex tie and, when relevant, SURFACE a judgment-support flag ("this touches your partner / a possible conflict of interest") — it does NOT auto-recuse or route the approval; the actual approval/recusal lives in the external 전자결재 system, which naruon integrates with / observes but does not replace. When drilling the model, do not drift into groupware/workflow-owning features. Judgment (and org action) stays with the human + their existing systems.
 
 ## 2. naruon = the PLATFORM (one platform, many à-la-carte plugins)
-`naruon` is an email-first workspace (FastAPI backend + Next.js frontend + a thin WebSocket connector proxying IMAP/SMTP/CalDAV/WebDAV from customer premises) whose core is a **dense two-tier knowledge graph** over Postgres + pgvector. It is a **TRUE plugin platform** ("진정한 plugin처럼 계속 붙일 수 있는"): plugin manifest/contract, extension points (ingest sources, DOM/analysis processors, KG enrichers, work-item types, UI panels, agents, scheduling), plugin registry, versioned API, isolated execution for untrusted plugins (noema quarantine sandbox). **À-la-carte / opt-in**: each capability is a plugin a user enables by need; nothing mandatory; different users run different combos. Every imported component is **standalone AND submodule** ("따로, 또 같이").
+`naruon` is an email-first workspace (FastAPI backend + Next.js frontend + a thin WebSocket connector proxying IMAP/SMTP/CalDAV/WebDAV from customer premises) whose core is a **dense two-tier knowledge graph** over Postgres + pgvector. It is a **TRUE plugin platform** ("진정한 plugin처럼 계속 붙일 수 있는"): plugin manifest/contract, extension points (ingest sources, DOM/analysis processors, KG enrichers, work-item types, UI panels, agents, scheduling), plugin registry, versioned API, isolated execution for untrusted plugins through **quarantine-sandbox-runtime** (see §6). **À-la-carte / opt-in**: each capability is a plugin a user enables by need; nothing mandatory; different users run different combos. Every imported component is **standalone AND submodule** ("따로, 또 같이").
 
 ## 3. Ecosystem components (product names + roles)
 Product renames (repo slug → product name; domains purchased): `cwl-idp`→**keyverse** (keyverse.io), `waf-ids-ai-soc`→**wardnet** (wardnet.io), `cwl-editor`→**inkspan** (inkspan.io). Other domains: cloud-erd.app (pg-erd-cloud), naruon.net / naruon.io (naruon).
@@ -33,7 +33,7 @@ Product renames (repo slug → product name; domains purchased): `cwl-idp`→**k
 - **codec-carver** — STT / omni-modal speech+video codec (audio/video conversion for LLM input); speaker diarization + consented voiceprint; feeds auto meeting minutes.
 - **fast-mlsirm** — LLM-as-a-Judge output **calibration** + measurement/evaluation-item quality; incorporate `aFIPC` Fixed-Item Parameter Calibration + `kaefa`-style item-fit optimal-model search (R IRT/psychometrics). GPU = GPGPU in the Rust core (wgpu, single numpy|rust backend axis).
 - **semantic-data-portal (SDP)** — the higher **ontology / catalog / governance plane** ABOVE the doc KG (Apache AGE + pgvector). naruon owns the doc KG (content_graph + project_graph in Postgres); SDP is not that store.
-- **noema** — agent runtime (Pydantic-AI / Codex-Python): a GitHub Review Agent in CI + a do-anything agent inside naruon + the **lightweight quarantine sandbox**.
+- **noema** — GitHub Actions OIDC short-lived repository capability and exact-revision evidence / credential-maintenance control plane. It does **not** own untrusted artifact/code execution; that responsibility belongs to **quarantine-sandbox-runtime** (see §6).
 - **newsdom-api** — PDF → DOM recognition sidecar (generalized beyond JP newspapers). naruon parses non-PDF formats (html/md/plaintext) into its content_graph.
 - **scopeweave** — issue/WBS **management** + ITSM Service Request (two-layer: requester ticket ↔ team issues). Consumes issues naruon extracts from email/conversation/ITSR. (Dev-CODE issues stay in GitHub/GitLab — integrate, don't rebuild GitHub.)
 - **appguardrail** — app security guardrails; collects org security/CI failures + Strix findings as issues.
@@ -97,7 +97,18 @@ Literature-grounded (see papers below). A dyad can hold MULTIPLE relationship ty
 **SCOPE — the SOCIAL GRAPH belongs IN the KG (core); only ENFORCEMENT is out (per §1b).** Do NOT confuse "naruon doesn't run org workflows" with "drop the social network" — the relationship / social-network graph is CORE and lives fully in the KG (it already does: naruon `project_graph_objects` has a `participant` type + the DAG Sender Ontology + domain-model-realignment). The social graph is the FOUNDATION for the origin jobs AND the real pains: it powers FIND + PRIORITIZE (DAG sender ontology — "what this sender means to me"), schedule TRACKING (who a changing meeting is with + priority), and — critically — the project pains the user named: **too many projects, schedule management that doesn't work, WBS that can't be estimated, Job/Work/Task/Duty that is a mystery.** The person↔person + person↔event + dependency graph is exactly what makes schedule management, **WBS / inter-event dependency ESTIMATION**, and work decomposition (Job/Work/Task/Duty) possible (with scopeweave). The ONLY out-of-scope part is naruon EXECUTING org actions (auto-recuse, route approvals, run 전자결재/HR): naruon **models + reasons + surfaces**, the external systems ACT. So: full social-graph modeling + inference + estimation-support + surfacing = IN; workflow enforcement = OUT.
 **Attachable papers (CC BY 4.0, redistributable):** Higgins, Crepalde & Fernandes (2021) PLOS ONE 16(9):e0257527 (segmented multiplexity); Frontiers in Psychology (2021) 12:690074 (ambivalent leader-follower). Green-OA (link, don't redistribute): Levin et al. 2011 Organization Science (dormant ties); Pierce/Byrne/Aguinis 1996 JOB (workplace-romance power differential). Cite-only (copyright): Verbrugge 1979, Merton 1957, Kahn 1964, Kram 1983, Jaskiewicz 2013.
 
-## 6. AI SOC = wardnet + noema quarantine sandbox (see wardnet#38)
+## 6. AI SOC = wardnet + quarantine-sandbox-runtime (see wardnet#38)
+
+**Note (2026-09-02):** this section's spec previously said "noema quarantine sandbox." Verified against
+both repos' current READMEs: `quarantine-sandbox-runtime` describes itself, near-verbatim, as this
+section's own spec ("Source-agnostic, credential-free artifact analysis runtime for the
+ContextualWisdomLab security ecosystem"), while `noema`'s current README describes an unrelated
+product — an "evidence-producing credential and maintenance control plane" for GitHub OIDC/App-token
+exchange and review evidence — with no artifact-analysis or sandbox responsibility, and
+`noema/docs/noema-agent-sandbox-plan.md` explicitly states the review agent "runs in a separate
+quarantined execution plane" that "must not run untrusted repository code in the Noema Worker process."
+The sandbox responsibility this section describes belongs to `quarantine-sandbox-runtime`, not `noema`.
+
 A **source-agnostic artifact-analysis service**: `submit(artifact, context) → {verdict, confidence, evidence, IOCs}`. Consumers: naruon email/file attachments (quarantine BEFORE store), platform uploads, connector inputs, API, GitHub issue/PR comments (one trigger). WITHOUT VirusTotal (self-contained): static (YARA(BSD) + capa(Apache) capability→ATT&CK + LIEF/pefile + unzip/macro extract + entropy + context heuristics) + dynamic detonation in a gVisor/Firecracker (Apache) microVM with eBPF behavioral monitoring (Falco/Tetragon, Apache) + network sinkhole + **LLM reasoning (via contextual-orchestrator) over the evidence** + KG/IOC correlation (self-hosted growing reputation). Auto-response per consumer (GitHub → delete comment + block user; email → quarantine + flag; upload → reject + notify). Validated by a real incident 2026-07-08 (user mapasevo21 posted a `sarif_bypass_patch.zip` malware lure on .github#365 + naruon#977 — deleted + blocked manually; this is what the SOC would automate).
 
 ## 7. Engineering conventions (BINDING, all agents)
@@ -114,7 +125,7 @@ A **source-agnostic artifact-analysis service**: `submit(artifact, context) →
 
 ## 8. Roadmap (full detail: naruon#974 §9; live status: Project #1)
 - **P0 MVP** — make the dense KG real (behind a stable extractor seam; do NOT productionize the deterministic stopgap; reconcile multi-account model; extend hybrid search to content_segments + project_graph_objects; wire DecisionPointCard).
-- **P1 Platform/Plugin SDK** — registry, versioned API, hook bus, manifest/license/signature gate, noema quarantine sandbox, /plugins UI.
+- **P1 Platform/Plugin SDK** — registry, versioned API, hook bus, manifest/license/signature gate, quarantine-sandbox-runtime (see §6), /plugins UI.
 - **P2 Dense-KG inference** — LLM-based language-agnostic extraction (orchestrator-routed) + batch embeddings; typed entities (graph_persons/events/commitments, norm_groups + memberships); prior×likelihood posterior; no-ask auto-resolve + correct-by-exception.
 - **P3 Scheduling & conflict avoidance** — status-weighted conflict engine; iTIP/iMIP RSVP (organizer vs attendee); free-busy find-time; room booking; anticipatory 전자결재→travel; connector CardDAV + POP3-over-WS.
 - **P4 Privacy bridge** — context isolation + content-based classification; consent minimal-disclosure bridge.
@@ -177,12 +188,13 @@ flowchart TB
     SCOPE["scopeweave — issues / WBS / ITSM"]
     CODEC["codec-carver — STT / audio→minutes (+voiceprint)"]
     BAND["bandscope — musicians' rehearsal vertical"]
-    NOEMA["noema — agent runtime + quarantine sandbox"]
+    QUAR["quarantine-sandbox-runtime — isolated artifact/code analysis (§6)"]
   end
 
   subgraph INFRA["Infra / governance"]
     CF[("Cloudflare — Pages/Workers/DNS")]
     GH[(".github — governance + Project #1")]
+    NOEMA["noema — GitHub OIDC capability + exact-revision evidence"]
   end
 
   P1 --> WARD
@@ -212,8 +224,9 @@ flowchart TB
   NAR --> ERD
   NAR -->|"extracted issues → manage"| SCOPE
   CODEC -->|"diarize + minutes"| NAR
-  NAR --> NOEMA
-  WARD -->|"quarantine detonation"| NOEMA
+  GH -->|"repository capability / exact-revision evidence"| NOEMA
+  WARD -->|"quarantine detonation"| QUAR
+  NAR -->|"untrusted plugin/artifact analysis"| QUAR
   BAND -->|"musicians also use email"| NAR
   BAND -. "rehearsal app" .-> P2
 
@@ -227,4 +240,4 @@ flowchart TB
   class ORCH,KEY,WARD plane;
 ```
 
-**Reading it:** users hit `wardnet` (edge/SOC) → `naruon` (platform); everything authenticates via `keyverse` (which federates external ADFS/LDAP). `naruon` ingests via the `connector` + `newsdom-api`, builds the KG in Postgres, uses `semantic-data-portal` for the ontology plane, and routes ALL LLM work through `contextual-orchestrator` (which load-balances upstreams and routes batch to `pg-llm-batch`). `noema` is the shared agent runtime + quarantine sandbox (used by naruon, the GitHub review agent, and wardnet's AI SOC). Plugins/verticals (`inkspan`, `clearfolio`, `pg-erd-cloud`, `scopeweave`, `codec-carver`, `bandscope`) attach à-la-carte; `fast-mlsirm` calibrates LLM-as-Judge quality. Hosting = Cloudflare; governance + Project #1 live in `.github`.
+**Reading it:** users hit `wardnet` (edge/SOC) → `naruon` (platform); everything authenticates via `keyverse` (which federates external ADFS/LDAP). `naruon` ingests via the `connector` + `newsdom-api`, builds the KG in Postgres, uses `semantic-data-portal` for the ontology plane, and routes ALL LLM work through `contextual-orchestrator` (which load-balances upstreams and routes batch to `pg-llm-batch`). `noema` is the GitHub OIDC/exact-revision evidence control plane and uses `contextual-orchestrator` for model-backed work; `quarantine-sandbox-runtime` owns isolated untrusted artifact/code analysis for wardnet and product/plugin consumers. Plugins/verticals (`inkspan`, `clearfolio`, `pg-erd-cloud`, `scopeweave`, `codec-carver`, `bandscope`) attach à-la-carte; `fast-mlsirm` calibrates LLM-as-Judge quality. Hosting = Cloudflare; governance + Project #1 live in `.github`.
diff --git a/docs/doctoring/product-goal-directive.md b/docs/doctoring/product-goal-directive.md
index d752033602..443f666e5e 100644
--- a/docs/doctoring/product-goal-directive.md
+++ b/docs/doctoring/product-goal-directive.md
@@ -86,3 +86,341 @@ fixed:
   conventions this record reconciles against.
 - ContextualWisdomLab/.github#1429 — the PR carrying this change and Devin
   Review's findings.
+
+## 2026-09-02 revision
+
+- **Subject:** the owner reissued the full nine-section directive with
+  substantially expanded text in every section (delivered directly in an
+  agent session, not via a PR comment). Per this file's own conflict policy
+  ("edit this file in place... do not fork a second copy elsewhere"),
+  `docs/product-goal-directive.md` was rewritten in place to hold the new
+  text verbatim, superseding the 2026-08-30 wording of all nine sections.
+
+### What changed in the directive text
+
+- §2 gained an explicit "build the immature core, don't bypass it" policy:
+  a consumer repo must not duplicate, work around, or exclude functionality
+  that belongs to an immature core/owner repo — it must develop the missing
+  piece at the owner (RED test → contract → feature → docs → release) and
+  only then consume the new versioned release. Exclusion is only valid when
+  the boundary itself is wrong or there is no real shared demand, and must
+  be recorded as an ADR.
+- §2 also added a new Korean-copyediting tool reference,
+  `https://github.com/epoko77-ai/im-not-ai`, for preserving meaning/facts/
+  figures/proper nouns while polishing Korean prose. This repo is under a
+  different GitHub account (`epoko77-ai`), not `ContextualWisdomLab` — noted
+  inline in the directive so a future agent doesn't mistake it for an org
+  core repo or try to add it via the org's repo-scope tooling as if it were
+  one.
+- §4 (renamed from "UX/UI and customer-facing expression" to "UX/UI, i18n,
+  and customer-facing expression") added: UI-as-composed-reusable-objects,
+  `shadcn/ui` as a component source (not a Storybook substitute), an
+  explicit unpinned frontend stack (React/Vite/shadcn/ui/jQuery 4 chosen on
+  merit, not mandated), Keyverse's role narrowed to an auth backend only
+  (Direct Grant/ROPC or the Keycloak REST API) with product-owned
+  login/signup/recovery forms, and a detailed i18n policy: 8 supported
+  languages (ko/en/ja/zh/vi/es/de/fr), CJK/width/line-break/font-fallback/
+  locale-format testing per language in Storybook and E2E, and — the
+  highest-signal addition — translation strings must live as a DB-backed
+  **versioned resource**, not a file or JS bundle; server/native code
+  fetches only the screen keys it needs and caches them; the browser never
+  loads a full catalog or heavy i18n JavaScript, and an SPA is not assumed.
+  If no shared translation-management product exists yet, a new repo should
+  provide per-product translation CRUD, review/approval, deploy, rollback
+  API, and an admin UI.
+- §5 (renamed to "Architecture, ontology, naming, and database conventions")
+  added an ontology-ownership split across four named repos —
+  **ConceptWeave** (observe→discover→propose→align→validate→review→publish
+  and semantic release), **semantic-data-portal** (catalog/governance/
+  consumption), **context-graph-contracts** (interoperability contracts),
+  **enterprise-architecture-core** (Context Map and cross-org decisions) —
+  with domain truth and Ubiquitous Language staying with each product
+  owner, and every concept/relation/dimension/measure/mapping published as
+  an immutable release carrying evidence/provenance/validity/confidence/
+  status/deprecation/locale-label metadata; consumers may only use released
+  API/contracts through an ACL, never copy files, run cross-service SQL, or
+  publish without authorization. UI-translation and ontology-label ledgers
+  are explicitly kept separate (the two i18n-shaped systems in §4 and §5
+  are not the same system). §5's identifier-naming rule also broadened from
+  "DB object names" to essentially every code identifier (variables,
+  constants, parameters, fields, functions, methods, classes, types,
+  modules, packages, APIs, DB objects, files, directories) — see
+  Reconciliation below.
+- §8 folded the pool pin directly into the quoted text ("`orchestrator/free`
+  고정"), removing the prior section's ambiguity outright rather than
+  needing an out-of-band note to resolve it.
+- §9 (renamed from "Reference libraries and tool invocations" to "Core
+  foundation and development/consumption boundaries") replaced the general
+  reference-library bullet list with an explicit table of 23 named
+  core-owner repos grouped by responsibility (workflow/review/security/
+  release; enterprise architecture/context contracts; ontology generation
+  vs. catalog/governance; model orchestration/OIDC/evidence; identity;
+  outbound/browser/edge/sandbox isolation; batch/embedding; psychometrics
+  measurement kernels; retrieval/threading; editor/diagram tooling; MHTML
+  ETL; SAST/gateway), plus an explicit classification of seven repos
+  (`naruon`, `LineageWeave`, `psychometrics-commons`, `disksage`,
+  `PolicyWeave`, `CalendarWeave`, `supply-chain-control-plane`) as domain
+  product/composition **consumers**, not core, with the instruction that
+  genuinely shared functionality found duplicated across consumers should
+  be extracted to a core owner and developed through integrated CI.
+
+### Verification performed this revision
+
+1. **Repo-existence check.** Every one of the 30 repositories named across
+   §5 and §9 (the §5 ontology-ownership discussion names four of these —
+   `ConceptWeave`, `semantic-data-portal`, `context-graph-contracts`,
+   `enterprise-architecture-core` — as a named subset of, not additional to,
+   the 23 §9 core repos; plus the seven §9 domain-consumer repos) was
+   checked against a live listing of every `ContextualWisdomLab` repository
+   the operating account can reach. All 30 matched exactly, including case
+   (e.g. `ConceptWeave`, `EgressWeave`,
+   `OriginWeave`, `DiagramWeave`, `PolicyWeave`, `CalendarWeave` — all
+   PascalCase, confirmed correct as given, not "corrected" to another
+   case). None needed a spelling or case fix. This check is recorded
+   verbatim in the directive file itself (§9 "Verification" note) so a
+   future agent doesn't have to re-derive it from this doctoring record.
+2. **Conflict check against `docs/CWL-MASTER-CONTEXT.md`.** Two real
+   tensions were found and handled per this file's stated conflict policy
+   ("resolve the conflict and update whichever document is wrong — do not
+   silently pick one"):
+   - **§5 naming scope vs. §7's DB-object grandfather clause (resolved).**
+     `docs/CWL-MASTER-CONTEXT.md` §7 is narrow and binding: *"DB object
+     names = 2+ word snake_case (don't rename existing Camel/Pascal)."*
+     The revised §5 is broader (every code identifier, not just DB
+     objects) and says a violating name "gets replaced" — read alone and
+     literally, combined with this org's full-autonomy convention, an
+     agent could take that as a mandate to sweep every repo and
+     force-rename every existing identifier that doesn't fit, which would
+     be a large, high-risk, potentially breaking action with no ADR and no
+     migration plan, and would directly contradict §7's explicit
+     grandfather clause for the DB-object case it already covers. Added a
+     reconciliation note directly under §5 in the directive (not inside
+     the quoted text) stating: the broader rule applies going forward, on
+     code an agent is already touching or creating, not as license to
+     force-rename existing identifiers ecosystem-wide; §7's DB-object
+     grandfather clause remains binding and unambiguous; a genuinely
+     warranted repo-wide rename needs its own ADR and migration plan, not
+     a blanket action under this directive.
+   - **§9 quarantine-sandbox ownership vs. `docs/CWL-MASTER-CONTEXT.md` §3
+     (flagged, not resolved).** §3 currently states `noema` owns "the
+     lightweight quarantine sandbox." The revised §9 lists
+     `quarantine-sandbox-runtime` as its own dedicated repo, grouped with
+     `EgressWeave`/`OriginWeave`/`pingora-gateway` under "outbound·browser·
+     edge·격리 core." Whether sandbox ownership moved to the new dedicated
+     repo, is now shared between the two repos, or `quarantine-sandbox-runtime`
+     covers a different scope than "the lightweight quarantine sandbox" in
+     §3, was **not** verified against either repo's actual README/
+     ARCHITECTURE content — doing so honestly requires reading both repos,
+     which this pass did not do, rather than guessing. Recorded as an open
+     item directly in the directive file (§9 "Open reconciliation item")
+     instead of silently picking an answer. A future pass should read both
+     repos and either update §3, update §9, or record an ADR if the split
+     is a genuinely new architectural decision.
+   - `docs/CWL-MASTER-CONTEXT.md` §3 was **not** otherwise updated this
+     pass to add the ~13 §9 core repos it doesn't yet mention
+     (`ConceptWeave`, `enterprise-architecture-core`,
+     `context-graph-contracts`, `EgressWeave`, `OriginWeave`,
+     `pingora-gateway`, `quarantine-sandbox-runtime`, `EmbedRelay`,
+     `DiagramWeave`, `mhtml-etl-gateway`, `PolicyWeave`, `CalendarWeave`,
+     `supply-chain-control-plane`, `psychometrics-commons`,
+     `LineageWeave`) — that is a larger, separate reconciliation (each
+     repo's actual role description in §3 should be written from that
+     repo's own README/ARCHITECTURE, not paraphrased from this directive's
+     one-line-per-repo summary) and is intentionally left as future work
+     rather than rushed.
+3. **§8 pool-pin state, re-verified against the actual workflow files**
+   (not just ADR-0003's prose): `opencode-review-dispatch.yml`,
+   `noema-review.yml`, `strix.yml`, and `pr-review-autofix.yml` in
+   `ContextualWisdomLab/.github` all hardcode
+   `contextual-orchestrator/orchestrator/free` (or `orchestrator/free` for
+   the Noema sidecar), each with fail-closed validation rejecting any other
+   value. §8's new explicit "`orchestrator/free` 고정" wording matches this
+   confirmed reality exactly — no further action needed for this section.
+
+### Audit trail (2026-09-02 revision)
+
+- `docs/product-goal-directive.md` — the rewritten directive (all nine
+  sections) and its inline 2026-09-02 reconciliation/verification notes
+  under §2, §5, §8, and §9.
+- `docs/CWL-MASTER-CONTEXT.md` §3, §7 — the documents this revision's
+  reconciliation checks were run against; §3 still needs the larger,
+  separate follow-up noted above.
+- `.github/workflows/opencode-review-dispatch.yml`,
+  `.github/workflows/noema-review.yml`, `.github/workflows/strix.yml`,
+  `.github/workflows/pr-review-autofix.yml` — the live workflow files
+  checked for the §8 pool-pin verification.
+- `docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md` — the
+  authoritative ADR for *why* the pool pin is `orchestrator/free`; this
+  revision's §8 note points here rather than restating the reasoning.
+
+## 2026-09-02 revision (third, same-day refinement)
+
+- **Subject:** the owner issued a third, further-refined version of the
+  directive the same day as the second revision above, delivered directly in
+  an agent session (again not via a PR comment). Per this file's own conflict
+  policy, `docs/product-goal-directive.md` was updated in place again — on
+  the same branch/PR as the second revision (`docs/product-goal-directive-2026-09-02-revision`,
+  ContextualWisdomLab/.github#1692), not a new PR, since that PR was still
+  open/draft and unmerged when this third revision arrived. The prior
+  agent-session identity that authored the second revision's PR body could
+  not be directly confirmed as the same session continuing (concurrent
+  sessions under the same account are normal per §2's "don't assume
+  concurrent commits are a race" instruction), so this revision's notes are
+  additive to, not a rewrite of, the second revision's verification record
+  above — both are kept so the reconciliation trail stays intact regardless
+  of which session's account of events is read first.
+
+### What changed in the directive text (second revision → third revision)
+
+- §1: added an explicit constraint on what "0 open PRs" may mean — reaching
+  it via merge or via a successor PR's full absorption of a predecessor's
+  valid delta only, never via a bare close. This is a forward reference to
+  §2's new repair-vs-close policy below.
+- §2: gained a substantial, entirely new PR-lifecycle policy not present in
+  the second revision at all — a `single-writer`/DDD violation, wrong
+  base/merge conflict, ADR-number collision, premature `Accepted` status, an
+  unprotected dependency, or a missing test/fixture/contract is a **repair
+  finding**, not grounds for closing a PR. Required response: downgrade to
+  Draft/Proposed and non-force restack/retarget onto the correct owner
+  stack (never force-push over someone else's branch); resolve a
+  `single-writer` conflict by integrating both deltas, never discarding
+  either; when an agent can't fix a PR directly, a successor must fully
+  absorb its valid delta and continue the predecessor's intent; a PR
+  blocked on an unlanded prerequisite stays open while the prerequisite is
+  completed; a mistakenly closed PR is recovered via reopen or successor,
+  not left closed. Closing a PR at all is permitted only for an explicit
+  user request, no valid delta remaining, a malicious change, or full
+  successor absorption — and even then, "closed" is a label, not
+  confirmation the underlying work landed anywhere.
+- §4: dropped the second revision's named-framework shortlist
+  ("React·Vite·shadcn/ui·jQuery 4"); the stack-choice criteria are now
+  stated framework-agnostically (security, maintainability, standards,
+  accessibility, measured performance), while still naming `shadcn/ui`
+  explicitly as the owned component source.
+- §5: moved the second revision's detailed per-repo ontology-owner
+  breakdown (which repo does discover/propose/align/validate/publish, etc.)
+  out of §5 and into §9, where the full core-repo table now lives; §5 itself
+  now just states the responsibilities are split across separate owners and
+  points to §9.
+- §8: spelled out, in the quoted text itself, exactly how the
+  `orchestrator/free` pin must be implemented at the GitHub Actions layer —
+  workflows select only the pool id and a gateway token, never a concrete
+  provider/model/group name or a paid-fallback flag; all free-candidate
+  discovery/routing/fallback happens inside contextual-orchestrator itself;
+  a workflow fails closed (not to a paid model) when no free capability is
+  available. This is strictly more specific than the second revision's bare
+  "`orchestrator/free` 고정," not a change in intent.
+- §9: added an explicit definition of what "core foundation" means (not a
+  common install for every product; a selective control-plane/service/
+  library one repo canonically owns because a responsibility repeats across
+  products, with role/maturity verified from protected-branch evidence, and
+  an open PR proposing core status is `Proposed`, not authoritative yet);
+  reorganized the same 23-repo list into five named categories (조직·계약 /
+  의미·데이터 / AI·운영 / Identity·보안·runtime / 재사용 기능) instead of the
+  second revision's flat bullet list; and added concrete interim-boundary
+  mechanisms for the §2 build-the-core policy — while an owner is still
+  building a needed capability, a consumer holds the boundary with a port,
+  an ACL, a feature flag, or a test double, and must not read the owner's
+  source, database, or a temporary branch directly.
+
+### Verification performed this revision
+
+1. **Repo list unchanged, re-confirmed.** The third revision's §9 names the
+   same 23 core repos as the second revision (reorganized into categories,
+   not expanded or reduced), plus the same second-revision consumer set is
+   implied by §9's new opening definition even though the third revision's
+   quoted text doesn't restate the seven-repo consumer list verbatim. No new
+   repo-existence check was needed beyond the second revision's — recorded
+   inline in the directive (§9 "Verification" note) rather than re-running
+   the same live-listing check for an unchanged set.
+2. **§2 repair-vs-close policy — no conflict found against
+   `docs/CWL-MASTER-CONTEXT.md` or `docs/agent-github-project-protocol.md`.**
+   This is new operational policy (how to handle a defective PR) rather than
+   a restatement of an existing binding convention, so there was nothing to
+   reconcile it against; it does not contradict anything already binding.
+3. **§8's newly-explicit workflow-implementation language — re-verified
+   against the same four workflow files as the second revision**
+   (`opencode-review-dispatch.yml`, `noema-review.yml`, `strix.yml`,
+   `pr-review-autofix.yml`): all four already set only the pool id plus a
+   gateway token, never a provider/model/group name or paid-fallback flag,
+   and `strix.yml` fails closed on any other requested value — the third
+   revision's more detailed wording matches confirmed reality exactly, same
+   conclusion as the second revision's check, now more specifically stated.
+
+### Audit trail (2026-09-02, third revision)
+
+- `docs/product-goal-directive.md` — updated again in place; each section
+  with third-revision changes carries its own dated note distinguishing
+  second-revision text from third-revision text, and the "Revision history"
+  section at the end of the file now has three dated entries.
+- ContextualWisdomLab/.github#1692 (branch
+  `docs/product-goal-directive-2026-09-02-revision`) — the same open PR
+  carrying both the second and third revision's commits; not superseded by
+  a new PR, per this directive's own "edit this file in place... do not
+  fork a second copy elsewhere" policy applied to the PR-branch level too.
+
+## 2026-09-02 Devin Review findings on PR #1692 — three confirmed, fixed
+
+Devin Review's automated pass on #1692 raised six findings; three were confirmed real and fixed in
+place (not by editing the verbatim quoted directive text), one required cross-repo verification beyond
+this directive's own file, and two were informational/no-action. Following the same pattern as the
+2026-08-30 Devin Review findings on the original PR #1429 (see above): confirm before fixing, fix in the
+notes rather than the quoted blockquotes, and record the reasoning here.
+
+1. **Confirmed — §5's "pause and confirm" rename language contradicted
+   `docs/CWL-MASTER-CONTEXT.md` §7's binding "Do NOT ask the user to decide — make the call and proceed"
+   (full autonomy) convention.** The reconciliation note added by the third revision (on breaking a
+   published contract) said such a rename was "exactly the kind of consequential, hard-to-reverse action
+   this org's own engineering conventions ask an agent to pause and confirm before taking" — that framing
+   is simply wrong; §7 forbids asking the user to decide, full stop. Fixed by replacing "pause and
+   confirm" with an autonomous, contract-safe process: preserve the existing published boundary (alias/
+   deprecation shim/versioned API), prepare a versioned migration and compatibility plan, and record the
+   rename as an ADR — proceeding without waiting on a human, with explicit approval required only where
+   some *other* already-existing policy demands it for a specific irreversible action (this repo's own
+   "never force-push over someone else's branch," for example), not as a new exception this note invents.
+2. **Confirmed — repository-count arithmetic did not reconcile.** The doctoring text for the second
+   revision (above) said §9 listed "21 named core-owner repos" and that "29" total names were verified
+   across "the four ontology repos, all 21 §9 core repos, and the seven §9 domain-consumer repos" — but
+   §9's actual list (verified by recounting it directly) has 23 entries, not 21, and the four ontology
+   repos named in §5 (`ConceptWeave`, `semantic-data-portal`, `context-graph-contracts`,
+   `enterprise-architecture-core`) are a **named subset of**, not additional to, those 23 — so treating
+   them as a fifth, separate group of "4" was double-counting on top of an already-wrong base count. The
+   correct total is 23 §9 core repos + 7 §9 domain-consumer repos = 30 unique names, not 29. Fixed both
+   this doctoring file's second-revision section (above) and `docs/product-goal-directive.md`'s own §9
+   "Verification" note to say 23 and 30, and to state the four-ontology-repos-are-a-subset relationship
+   explicitly instead of implying a fifth additive group. **Follow-up (same day):** the first pass of this
+   fix missed that the third-revision section further below ("What changed in the directive text" and its
+   own "Verification performed this revision") repeated the same stale "21" figure twice, independently of
+   the second-revision section already fixed — Devin Review caught this residual inconsistency on the next
+   push. Fixed both remaining occurrences to say 23, matching the corrected count everywhere in this file.
+3. **Confirmed — sandbox ownership tension was left "open, not yet resolved" when it was directly
+   resolvable.** The prior revision's §9 note flagged, but deliberately did not resolve, the tension
+   between `docs/CWL-MASTER-CONTEXT.md` (`noema` owns "the lightweight quarantine sandbox") and this
+   directive's §9 (`quarantine-sandbox-runtime` as its own dedicated repo) — correctly declining to guess,
+   but Devin's finding was right that this PR could resolve it with the reading it had asked for the last
+   time, rather than deferring again. Resolved this revision by cloning both repos read-only and reading
+   `noema/README.md`, `quarantine-sandbox-runtime/README.md`, and `noema/docs/noema-agent-sandbox-plan.md`
+   directly: `quarantine-sandbox-runtime`'s README ("Source-agnostic, credential-free artifact analysis
+   runtime for the ContextualWisdomLab security ecosystem") is a near-verbatim match for
+   `CWL-MASTER-CONTEXT.md` §6's own AI-SOC sandbox spec; `noema`'s current README is an unrelated product
+   (GitHub OIDC/App-token credential exchange and review evidence, explicitly disclaiming model/provider
+   ownership) with no artifact-analysis responsibility; and `noema`'s own sandbox-planning doc states the
+   review agent "runs in a separate quarantined execution plane" that "must not run untrusted repository
+   code in the Noema Worker process" — i.e. noema's own architecture decision already separates sandbox
+   execution out of its own process. Fixed by updating `docs/CWL-MASTER-CONTEXT.md` at all four locations
+   that said "noema quarantine sandbox" (§3's noema bullet, §6's header, the P1 roadmap bullet, and the
+   ecosystem UML diagram's node label plus the `WARD -->|"quarantine detonation"|` edge target) to name
+   `quarantine-sandbox-runtime` instead, and updating this directive's §9 note from "open, not yet
+   resolved" to "resolved," while explicitly leaving open (as a coverage gap, not a contradiction) that
+   §3 still doesn't mention most of §9's other newer repos at all.
+4. **Informational, no action — empty-PR cleanup remains permitted.** Devin correctly read §2's closing
+   conditions as still permitting closure of a non-draft, zero-changed-file PR; this is consistent with
+   "no valid delta remains" and needed no change.
+5. **Informational, no action — §9's quoted blockquote doesn't restate the seven-repo consumer
+   classification verbatim.** True, but by design: the blockquote is the owner's verbatim wording (never
+   paraphrased, per this file's own established pattern above) and the classification is preserved in the
+   "Verification" note immediately below it, which is exactly what that note is for. No fix applied; the
+   quoted text is not editable for this reason without violating the file's own verbatim-preservation
+   rule.
+6. **Informational, no action — pool pin matches deployed workflows.** Devin's own check confirmed §8's
+   text already matches the four live workflow files. No action needed.
diff --git a/docs/product-goal-directive.md b/docs/product-goal-directive.md
index c76c4226e4..493c5fb3a8 100644
--- a/docs/product-goal-directive.md
+++ b/docs/product-goal-directive.md
@@ -1,8 +1,10 @@
 # Product goal directive — autonomous PR/merge/development loop
 
-**Status:** active standing directive · **Owner intent recorded:** 2026-08-30 · **Scope:** the full
-ContextualWisdomLab ecosystem (every repo an agent can reach from this org, leveraged in order of
-product responsibility / reuse boundary / docs / implementation / consumption — not by name).
+**Status:** active standing directive · **Owner intent recorded:** 2026-08-30, revised 2026-09-02
+(three successive refinements in one day; this file holds the final, most-refined text of each
+section) · **Scope:** the full ContextualWisdomLab ecosystem (every repo an agent can reach from this
+org, leveraged in order of product responsibility / reuse boundary / docs / implementation /
+consumption — not by name).
 
 ## Why this file exists
 
@@ -23,64 +25,205 @@ is wrong — do not silently pick one.
 
 The directive is recorded verbatim (Korean, as authored) in the nine sections below, each given a short
 English heading for navigability. Do not paraphrase or shorten these sections when copying them
-elsewhere; link to this file instead.
+elsewhere; link to this file instead. The owner issued three successive revisions on 2026-09-02; each
+section below holds the text of the **third and final** revision. See "Revision history" at the end of
+this file and `docs/doctoring/product-goal-directive.md` for the reconciliation notes across all
+revisions.
 
 ## 1. Execution goal and continuous loop
 
-> 실행 목표와 지속 Loop 열린 PR마다 별도 중간 보고 없이 리뷰 확인→수정→GitHub Checks 재검증→병합→다음 개발을 반복하라. PRD를 읽고 Loop·Goal을 자율 생성·수정·제거해 PR을 병합 또는 0개로 만들며 상용화하라. 200억 달러에 판매할 자신이 있을 품질과 구매자가 체감할 제품 Gap 해소가 목표다. ADR·리서치·현행 데이터·PR로 기능 명세·PRD·TRD·UML·Gap·조치 상태를 도출해 docs/product-technical-gap-baseline.md에 갱신하라. 한 시간 간격으로 예약하고 메시지도 개선·갱신하라. PR·Issues 소진 후에도 제품 Gap 개발과 병합 Loop를 계속한다. 내가 온전히 소유한 ContextualWisdomLab 저장소를 레버리지 순으로 연계해 PR 병합·추가와 Connector 추가·수정 등 Ecosystem을 구축하라. Ecosystem 전 라이브러리 PRD를 숙지하고 조직·저장소명 대소문자를 지킨다. 리뷰·Checks 대기는 Blocker가 아니며, 실패 원인·수정·재실행 필요에 즉시 대응하며 안전한 작업을 계속한다. 결과 보고에 멈추지 말고 다음 Loop로 이동하라. 저장소는 이름이 아니라 제품 책임·재사용 경계·문서·구현·소비 저장소를 대조해 선택한다. ADR·Goal을 수시로 갱신하고 Goal 수정 불가 시 Loop를 갱신한다.
+> 실행 목표와 지속 Loop
+> 열린 PR마다 리뷰→수정→Checks 재검증→병합→다음 개발을 반복하라. PRD로 Loop·Goal을 조정하되 PR 0개는 병합이나 검증된 successor의 유효 delta 완전 승계로만 만들고 단순 Close하지 않는다. 목표는 200억 달러 판매 품질과 고객 체감 Gap 해소다. ADR·현행 근거·PR에서 PRD·TRD·UML·Gap·조치를 도출해 docs/product-technical-gap-baseline.md를 갱신하라.
+> 매시간 예약 메시지를 개선한다. PR·Issues 소진 뒤에도 Gap 개발·병합과 ContextualWisdomLab 저장소·Connector 연계를 계속하며 PRD와 명칭 대소문자를 지킨다. 리뷰·Checks 대기는 Blocker가 아니다. 실패를 즉시 고쳐 재실행하며 안전한 일을 계속한다. 저장소는 책임·재사용·구현·소비 경계로 고르고 ADR·Goal·Loop를 갱신한다.
+
+**Note (2026-09-02, third revision):** this section now explicitly forbids reaching "0 open PRs" by
+simply closing them — a PR only leaves the open set via merge, or via a successor PR that fully absorbs
+its valid delta (see §2's repair-vs-close policy below, which this section's "0개" language now
+defers to). Earlier automation or agents that treated "reduce open PR count" as license to close
+stalled PRs should stop; §2 is now the controlling text for what "resolved" means.
 
 ## 2. Concurrent operation, PR handling, and root-cause fixes
 
-> 동시 작업·PR 운영·근본 수정 원격 Agent의 동시 Commit·Push를 경합으로 단정해 Force Push·중단하지 말고 변경 취지·이유를 확인해 이어간다. Commit·Push 전 병합 여부를 확인하고 삭제 근거를 남긴다. Self-modifying/Source-fix Workflow는 목적 달성 후 삭제하고 잔존 시 관찰·제거한다. 가능한 PR은 Stack하고 not-merge-ready를 merge-ready로 전환한다. 유관 프로젝트 원인이 엮이면 함께 처리하고 Stacked PR을 중앙 OpenCode Agent가 리뷰하지 않으면 ContextualWisdomLab/.github를 수정한다. Agent 간 대화·Spawn을 활용한다. 수동 해법은 모두 코드·설정에 반영한다. PYTHONPATH=. 누락은 설정하고 GitHub Actions·런타임 오류는 로그·Root Cause Analysis로 제거한다. 전체 GitHub Checks 실패를 확인·수정한다. ContextualWisdomLab 내부 라이브러리 문제라면 원시 공급자 오류까지 고쳐 PR한다. 개발 프로세스에 https://github.com/DietrichGebert/ponytail 및 https://github.com/obra/superpowers 를 사용하되 superpowers의 "무조건 질문" 규칙은 무시한다. https://github.com/tirth8205/code-review-graph 와 https://github.com/colbymchenry/codegraph 도 사용하고 인덱싱은 스스로 수행한다. 이는 명시적으로 허가됐다.
+> 동시 작업·PR 운영·근본 수정
+> 동시 Commit·Push를 경합으로 단정하거나 Force Push하지 말고 취지를 잇는다. Commit 전 병합·삭제 근거를 남기고 목적을 마친 Self-modifying/Source-fix Workflow는 제거한다. PR을 Stack해 merge-ready로 만들고 유관 원인도 고친다. Stacked PR 리뷰가 빠지면 .github를 수리하고 Agent 대화·Spawn을 쓴다.
+> single-writer·DDD 위반, 잘못된 base·충돌, ADR 번호 충돌, 성급한 Accepted, 미보호 dependency, 누락된 test·fixture·contract는 Close가 아닌 repair finding이다. Draft·Proposed로 낮추고 owner stack에 non-force restack·retarget해 수리한다. single-writer는 delta 폐기가 아닌 통합이다. 직접 못 고치면 successor가 delta를 완전 승계하고 predecessor를 잇는다. foundation 미착지 시 prerequisite를 완성하며 PR은 유지한다. 오폐쇄는 reopen·successor로 복구한다. Close는 사용자 명시, 유효 delta 없음, 악성 변경, 완전 승계에만 허용하며 표시는 종결이 아니다.
+> 수동 해법은 코드·설정화하고 PYTHONPATH=.·Actions·runtime 오류는 로그 RCA로 없앤다. 내부 결함은 canonical owner·원시 공급자에서 고쳐 통합 CI와 release까지 잇는다. 경계나 공통 수요가 없을 때만 ADR로 제외한다.
+> ponytail·superpowers를 쓰되 "무조건 질문"은 무시하고 code-review-graph·codegraph를 인덱싱한다. 한국어 문구·문서·번역에는 https://github.com/epoko77-ai/im-not-ai를 적용하되 의미·사실·수치·고유명사를 보존한다.
+
+**Note (2026-09-02, third revision — new content, not in the second revision):** this revision adds a
+substantial, previously-unstated PR-lifecycle policy: a `single-writer`/DDD violation, wrong base or
+merge conflict, ADR-number collision, premature `Accepted` status, an unprotected dependency, or a
+missing test/fixture/contract is a **repair finding**, never grounds for closing a PR outright. The
+required response is to downgrade the PR to Draft/Proposed and non-force restack/retarget it onto the
+correct owner stack — never force-push over someone else's branch to "fix" it. Where a `single-writer`
+conflict exists, the resolution is **integration of both deltas**, not discarding either one. When an
+agent cannot fix a PR directly, a successor PR must fully absorb its valid delta and continue the
+predecessor's intent, not start over and drop what the predecessor already proved. If a PR is blocked on
+an unmerged prerequisite (a foundation/core repo change hasn't landed yet), the correct action is to
+complete that prerequisite — the blocked PR stays open meanwhile. A PR closed by mistake is recovered
+via reopen or a successor, not left closed. Closing a PR at all is permitted only for: an explicit user
+request, no valid delta remains, the change is malicious, or a successor has fully absorbed it — and
+even then, marking a PR "closed" is not itself the goal; the underlying work still needs to land
+somewhere. `epoko77-ai/im-not-ai` is a repository under a different GitHub account (`epoko77-ai`), not
+`ContextualWisdomLab` — an external Korean-copyediting tool referenced by URL, not an org-owned core
+repo, and not part of the §9 core-repo list below.
 
 ## 3. Research, standards, and documentation traceability
 
-> 연구·표준·문서 추적성 모든 개발은 최신 권위 국제 표준·논문을 조사해 APA 7th로 인용하고 doctoring에 기록하며 누락 근거를 보충한다. Local Zotero API가 되면 기존 자료를 읽거나 OA 논문을 추가한다. 논문·표준은 exact-head·전체 PR·내부 모듈·API에 모순 없이 결합하고 충돌을 수정한다. AGENTS.md, CLAUDE.md, ARCHITECTURE.md, CHANGELOG.md 등 ADR 문서를 상시 갱신하고 Core ERD, UML, PRD, TRD, user stories, storyboard, wireframes, Storybook inventory, security·test·operability baseline 및 필요한 그림을 포함한다. 릴리즈 가능하면 버전을 올려 배포하고 CHANGELOG.md를 갱신한다. GitHub.io를 언급하려면 페이지를 실제 출판한다.
-
-## 4. UX/UI and customer-facing expression
-
-> UX·UI와 고객 표현 필요하면 Figma와 Storybook(https://github.com/storybookjs/storybook), https://github.com/nextlevelbuilder/ui-ux-pro-max-skill, https://github.com/local-over/Anti-Slop-UI 를 함께 쓴다. 반복 웹 객체는 디자인 토큰화·모듈화하고 Figma File ID를 ADR에 기록한다. Storybook 장면별·Edge case별 Event를 조사·구현한다. UX·UI는 반드시 스크린샷으로 검수하고 ui-ux-pro-max로 Accessibility, Touch & Interaction, Performance, Style Selection, Layout & Responsive, Typography & Color, Animation, Forms & Feedback, Navigation Patterns, Charts & Data를 정의·검토·반영·적용·감사한다. 내부 구현 경계를 고객 화면에 노출하지 않고 문구로 고객의 다음 행동을 돕는다. Frontend는 디자인 토큰 CSS, 버튼 Action Edge, Interaction UX, i18n 번역 일관성까지 테스트한다.
-
-## 5. Architecture, naming, and database conventions
-
-> 아키텍처·명명·데이터베이스 소프트웨어는 중앙 .github, naruon, 다른 저장소와 연결 가능하게 만든다. DDD를 적용해 핵심·지원·일반 Subdomain, Bounded Context, Context Map, Ubiquitous Language를 ADR에 정의하고 Aggregate·Entity·Value Object·Domain Service·Repository·Domain Event·Invariant를 코드·API·DB·테스트에 일치시킨다. Aggregate는 최소 트랜잭션 경계로 두며 외부·레거시는 Anti-Corruption Layer로 격리하고 Shared Kernel은 최소화한다. 단독·반입 모듈 모두 우수한 모듈러 MSA를 지향하고 단일 소프트웨어가 Monolithic Architecture처럼 비대해지면 책임 경계에 따라 저장소를 분리한다. 소프트웨어명과 내부 호출자·클래스명이 다르거나 옛 이름(예: wardnet)을 쓰면 정식 이름으로 바꾼다. DB 객체명은 두 단어 이상의 snake case, Carmel case 또는 pascal case여야 하고 snake case를 우선한다. 위반명은 전부 치환한다. DB는 제3정규화와 Hot Partition 대비를 준수한다. Lock을 관리하고 불가하면 Read/Write DB를 분리한다. 영속화 경로의 항목별 UPSERT를 추적하고 없으면 계약을 보강한다. 명시적 구매자가 없는 제품은 코드 안팎의 Buyer를 정상 객체명으로 바꾼다. CSAP·SOC 2 인증을 고려한다. PII Masking이 업무를 마비시키므로 규정 준수형 비Masking 보호 대안을 설계한다. 실데이터 테스트·개발의 인명·기관명은 코드·ADR에서 익명화한다. GitHub Secrets의 PYPI API Key와 대부분 Public 배포라는 전제를 반영한다.
-
-**Reconciliation (flagged by Devin Review on this PR, 2026-08-30 — see `docs/doctoring/product-goal-directive.md`):** taken verbatim and cross-referenced against the rest of the ecosystem's own naming history, this section's quoted text reads backwards in two places:
-
-- It names "wardnet" as an example of an "old name" (옛 이름) to rename *away from*. But per `docs/CWL-MASTER-CONTEXT.md` §3/§10, `waf-ids-ai-soc` → **wardnet** is an already-completed rename — wardnet is the current canonical product name, not a legacy one. Read this section's "old name" example as applying to whatever pre-rename name a component still uses internally (stray `waf-ids-ai-soc` references, say), never as license to rename wardnet itself away from its current name.
-- "위반명은 전부 치환한다" ("replace all violating [DB object] names") would, read literally, force-rename existing CamelCase/PascalCase database objects. That contradicts the binding convention in `docs/CWL-MASTER-CONTEXT.md` §7: *"DB object names = 2+ word snake_case (don't rename existing Camel/Pascal)."* The §7 rule governs: 2+-word snake_case is required for **new** DB objects; existing CamelCase/PascalCase objects are grandfathered and must not be force-renamed.
-
-Per this file's own conflict policy above: this note is the resolution, and `docs/CWL-MASTER-CONTEXT.md` §7 is the document that was right — do not force-rename wardnet or existing Camel/Pascal DB objects on the strength of this section's verbatim wording alone.
+> 연구·표준·문서 추적성
+> 권위 표준·논문을 조사해 APA 7th로 인용하고 doctoring에 남긴다. Local Zotero API가 되면 자료·OA 논문을 보강한다. 근거는 exact-head·PR·모듈·API에 연결하고 모순을 고친다.
+> AGENTS.md·CLAUDE.md·ARCHITECTURE.md·CHANGELOG.md·ADR와 ERD·UML·PRD·TRD·UX·security/test/operability를 갱신한다. 가능하면 버전·CHANGELOG를 올려 배포하고 GitHub.io를 언급하면 실제 출판한다.
+> 의사결정은 처음 보는 사람도 문제·제약·대안·선택/기각 이유·근거·위험·효과·후속 조치를 재구성하게 구체적이고 자세히 기록한다. 결론·전제를 생략하지 말고 사용자·운영·장애 장면이 보이는 사례와 증거를 exact-head·로그·이슈·PR·ADR·실험에 연결해 다른 Agent가 검증·계속하게 한다.
+
+## 4. UX/UI, i18n, and customer-facing expression
+
+> UX·UI·i18n과 고객 표현
+> Figma·Storybook·ui-ux-pro-max·Anti-Slop-UI를 쓴다. 모든 UI는 재사용 객체이며 페이지는 그 조합이다. token·Figma ID를 ADR에 남긴다. Storybook에서 정상·로딩·빈·오류·권한·반응형·상호작용 상태를 문서화하고 스크린샷·E2E로 ui-ux-pro-max 전 범주를 감사한다. shadcn/ui는 제품 소유 component source, Storybook은 검증 환경이다. Frontend stack은 보안·유지보수·표준·접근성·측정 성능으로 고른다.
+> 내부 경계를 숨기고 다음 행동을 안내한다. Keyverse는 인증 backend로 유지하되(Direct Grant/ROPC 또는 Keycloak REST API), 로그인·가입·복구는 제품 자체 form으로 만든다. token CSS·Action Edge·Interaction UX를 검증한다.
+> i18n은 한국어·영어·일본어·중국어·베트남어·스페인어·독일어·프랑스어를 지원한다. UI 크기·줄바꿈·CJK·텍스트 팽창·font fallback·locale을 고려하고 언어별 Storybook·E2E로 잘림·겹침을 막는다. 번역 원장은 파일·JS bundle이 아닌 DB versioned resource다. server/native는 화면 key만 조회·cache하며 전체 catalog·무거운 i18n JavaScript·SPA를 전제하지 않는다. 공통 관리 제품이 없으면 새 저장소에서 제품별 번역·검토·승인·배포·rollback API·관리 UI를 제공한다.
+
+**Note (2026-09-02, third revision):** this revision no longer names specific frontend frameworks
+(the earlier revision listed "React·Vite·shadcn/ui·jQuery 4"); the stack-choice criteria (security,
+maintainability, standards, accessibility, measured performance) are now framework-agnostic. Read this
+as loosening the earlier revision's implicit framework shortlist, not as silence on the question —
+`shadcn/ui` is still named explicitly as the owned component source.
+
+## 5. Architecture, ontology, naming, and database conventions
+
+> 아키텍처·온톨로지·명명·데이터베이스
+> DDD의 Subdomain·Bounded Context·Context Map·Ubiquitous Language(UL)와 Aggregate·Entity·Value Object·Domain Service·Repository·Event·Invariant를 ADR·코드·API·DB·test에 맞춘다. Aggregate는 최소 transaction 경계, 외부·legacy는 ACL로 격리하고 Shared Kernel은 최소화한다. 비대한 Monolith는 책임별 저장소로 나누고 옛 이름을 고친다.
+> 통합 온톨로지의 생성·publish, catalog·소비, 상호운용 계약, EA 결정은 owner를 분리한다. 제품의 domain truth·UL은 옮기지 않는다. release는 evidence·provenance·유효기간·confidence·status·locale label을 가진다. consumer는 released contract·ACL만 사용하며 파일 복사·cross-service SQL·미승인 publication을 금지한다. UI 번역과 ontology label 원장은 분리한다.
+> 변수·상수·인자·필드·함수·메서드·클래스·타입·모듈·패키지·API·DB 객체·파일·디렉터리는 두 단어 이상 snake_case·camelCase·PascalCase로 명명하고 snake_case를 우선한다. 언어·framework·외부 계약 관례는 경계에서 변환하며 위반명은 치환한다. DB는 3NF·Hot Partition 대비·Lock·필요시 Read/Write 분리·항목별 UPSERT를 지킨다. placeholder Buyer는 실제 도메인명으로 바꾼다.
+> CSAP·SOC 2를 고려한다. PII Masking이 업무를 마비시키면 준수형 비Masking 대안을 설계한다. 실데이터 인명·기관명은 익명화하고 PYPI API Key·Public 배포 전제를 반영한다.
+
+**Note (2026-09-02, third revision):** the detailed per-repo ontology-owner breakdown that the second
+revision carried in this section (which repo does discover/propose/align/validate/publish, etc.) has
+moved to §9 below, where the full core-repo table now lives — this section states only that the
+responsibilities are split across separate owners, and points there for who owns what.
+
+**Reconciliation (naming scope, 2026-09-02, still applicable):** this section's identifier-naming rule
+spans every code identifier (variables through directories), not just DB objects, and says a violating
+name "gets substituted" (위반명은 치환한다) with no carve-out in the quoted text — unchanged across all
+three revisions of this section. `docs/CWL-MASTER-CONTEXT.md` §7's binding convention — *"DB object
+names = 2+ word snake_case (don't rename existing Camel/Pascal)"* — still governs DB objects
+specifically and still grandfathers existing Camel/Pascal DB objects; nothing in any revision repeals
+that clause. Read this section's broader identifier rule as prospective and opportunistic: apply it to
+new code, and fix existing violations incrementally when touching that code for another reason — not as
+a mandate to sweep every existing repo renaming public APIs, exported classes, or shipped DB objects in
+one pass. A rename that breaks a published contract (a public API signature, a released client, an external
+integration) is not something "위반명은 치환한다" authorizes as an unversioned, unrecorded rewrite at
+scale — but `docs/CWL-MASTER-CONTEXT.md` §7's binding convention ("Do NOT ask the user to decide — make
+the call and proceed," full autonomy) still governs: an agent does not pause and wait for a human to
+confirm this. The autonomous, contract-safe process is instead: preserve the existing published
+boundary (keep the old name/signature working — an alias, a deprecation shim, a versioned API), prepare
+a versioned migration and compatibility plan for consumers, and record the rename as an ADR so the
+decision and its rationale are durable. Explicit human approval is required only where some other
+already-existing policy demands it for a specific irreversible external action (e.g. this repo's own
+"never force-push over someone else's branch," or an operation with no compensating rollback) — this
+rename note does not itself create a new ask-first exception to §7.
+
+**Note (2026-08-30, on the original wording, retained for history):** the original (2026-08-30)
+version of this section named "wardnet" as an example of an "old name" (옛 이름) to rename *away
+from*. Per `docs/CWL-MASTER-CONTEXT.md` §3/§10, `waf-ids-ai-soc` → **wardnet** is an already-completed
+rename — wardnet is the current canonical product name. Neither the second nor the third revision
+contains that specific wording, and §9 below lists wardnet as a current core-repo owner, consistent
+with treating it as the canonical name. If a future revision of this directive reintroduces "wardnet"
+as an old-name example, treat that as the same error this note originally corrected, not as new intent
+to rename the product.
 
 ## 6. Implementation language, computation, and measurement principles
 
-> 구현 언어·연산·측정 원칙 Docstring Coverage, Test Coverage, Edge Case Test Coverage를 각각 100%로 만든다. 초보자가 별도 코드 분석 없이 이해할 수 있을 만큼 충분한 docstring을 제공한다. 수리과학, Psychometrics, Exploratory Data Analysis, 데이터과학의 모든 core 연산 레이어는 Python으로 구현하지 말고 무조건 Rust로 작성한다. Vector 연산, Linear Algebra, Matrix Algebra, LLM token size 연산도 포함한다. GPU와 CPU multithreaded 실행을 지원하고 context switching을 최소화한다. 속도·안정성·보안이 중요한 일반 소프트웨어도 Rust를 사용하며, 기존 타 언어 구현은 전환·리팩터링하거나 명확한 Rust API Call 경계로 분리한다. 확률표집 계약에는 표본 설계, 오차 목표, 실패 분모를 명시해 ADR과 감사 코드에 반영한다. Atomistic fallacy를 막도록 다층구조·다중소속 모델링을 고려·구현하고 시간 흐름을 반영하는 모델도 포함한다. 가중치는 임의로 정하지 말고 수리과학·Psychometrics에서 추정된 값, 특히 fast-mlsirm이나 TEPP처럼 논문 근거가 있는 모형을 사용한다. 어떠한 휴리스틱과 Rule of thumbs도 금지하며, 근거 미확정 상태로 방치하지 말고 ContextualWisdomLab의 추론 엔진을 최대한 활용하고 SOLID 원칙을 지킨다. Deprecation Warning은 Suppression하지 말고 근본 문제를 해결한다. 합성 데모 데이터는 Unit test에는 쓸 수 있으나 Production에 반영하지 않는다. Python 웹 서버는 Multithreading을 지원하고 GIL이 문제면 Python 3.14를 사용한다.
+> 구현 언어·연산·측정 원칙
+> Docstring·Test·Edge Case Coverage는 각 100%다. 수리과학·Psychometrics·EDA·데이터과학 core와 성능·보안 runtime은 Rust로 만들며 Vector·Linear/Matrix Algebra·token size·GPU·CPU multithreading을 포함한다. Python은 비선호며 LLM 편의로 고르지 않는다. Python 전용 ML runtime에 실용적 Rust 대안이 없을 때만 그 부분에 쓰며 범위·근거·제거 조건을 ADR에 남기고 hot path는 Rust로 둔다.
+> 확률표집은 설계·오차 목표·실패 분모를 명시하고 다층·다중소속·시간 모델로 Atomistic fallacy를 막는다. 가중치는 fast-mlsirm·TEPP 등 논문 근거로 추정하며 휴리스틱을 금지한다. 미확정 근거는 추론 엔진·SOLID로 해결한다. Deprecation Warning은 근본 해결하고 합성 data는 Unit test에만 쓴다. Python web server는 multithread이며 GIL 병목은 3.14나 Rust로 푼다.
 
 ## 7. Realistic verification, load, and container testing
 
-> 현실성 있는 검증과 부하·컨테이너 테스트는 제품 특성에 맞는 현실 사례와 정확성 기준을 포함한다. Psychometrics는 true parameter 대비 estimation RMSE와 true parameter 추정 재현성을 검증하고, 음악 분석은 실제 음원이 기대 분석값을 내는지 확인한다. 웹을 지원하면 Asynchronous 처리를 구현해 무응답을 방지하고 k6 end-to-end load test로 동시 접속 능력과 병목을 측정·개선한다. close_connection을 인스턴스 속성으로만 가정하는 잠재 버그를 점검한다. Docker는 Podman 또는 colima로 대체할 수 있다. 컨테이너 병목이면 shm_size와 PostgreSQL 등 응용 설정을 하드웨어에 맞게 자동 튜닝한다. 주로 compose로 운영해 k8s 전환성을 확보한다. Docker container 프로젝트명은 고정하되 테스트 격리 때만 override하고 달성 후 격리 컨테이너를 제거한다. MLX·CPU·CUDA·OpenCL의 Docker/Podman/Colima 처리법을 ADR에 기록·반영하고 Native Module 분리가 필요하면 독립 서비스로 개발한다.
+> 현실성 있는 검증과 부하·컨테이너
+> 테스트는 현실 사례와 제품별 정확성 기준을 쓴다. Psychometrics는 true parameter 대비 RMSE·재현성을, 음악은 실제 음원의 기대값을 검증한다.
+> 웹은 비동기 처리·k6 E2E를 적용해 모든 페이지 p95≤20ms를 맞춘다. 초과하면 profile하고 runtime·언어·framework가 원인이면 계약·정확성을 보존해 Rust 우선 기술·hot path·언어로 바꾼다. 표본 축소·측정 제외·비현실적 cache warm-up은 금지한다. JavaScript bundle·heap·DOM·hydration·main thread·GC가 메모리·지연을 키우면 dependency·rendering·Frontend stack을 교체한다. close_connection도 점검한다.
+> Docker는 Podman·colima로 대체 가능하다. 병목이면 shm_size·PostgreSQL을 장비에 맞춰 튜닝한다. compose로 k8s 전환성을 지키고 프로젝트명은 test 격리 때만 바꾼다. MLX·CPU·CUDA·OpenCL 처리법을 ADR에 남기고 Native Module은 필요시 독립 service로 분리한다.
 
 ## 8. LLM, orchestration, and embedding
 
-> LLM·오케스트레이션·Embedding LLM이 필요한 테스트는 contextual-orchestrator 기반 OpenCode Agent로 만든다. contextual-orchestrator는 GitHub Secrets의 BYTEZ_API_KEY, NVIDIA_NIM_API_KEY, NVIDIA_NIM_API_KEY_SUB, OPENROUTER_API_KEY, OPENAI_API_KEY를 모두 써 auto model discovery로 최적 모형을 제공한다. embedding·responses·completions, audio, video, image, ommi-modal 등 가용 모델을 폭넓게 지원한다. 가능하면 반입해 쓰고 발견한 해당 저장소 문제도 함께 수정한다. LLM 사용 소프트웨어와 contextual-orchestrator는 Fugu·Conductor·TRINITY 연구를 근거로 단일 모델 라우팅과 심층 다중 Agent 오케스트레이션 사이의 계산량을 배분한다. 워크플로 단계, 재귀 깊이, 작업 분해, 접근 목록으로 test-time compute를 조절하고 역할별 reasoning effort를 다르게 하며 추론 수준 ablation을 수행한다. 속도는 핵심 고려사항이 아니며 정확성을 우선한다. 중앙 OpenCode, Strix, Noema는 모델당 두 시간 이상 걸릴 수 있음을 수용한다. LLM Chat model은 chat completion API와 responses API를 모두 지원하고 json_object와 json_schema를 모두 처리한다. Embedding은 문단·구문·DOM·송수신자 등 의미 단위를 식별해 chunking한다. 본문에 base64 이미지가 있으면 텍스트 인식, 객체 인식, 태그 설명, 이미지 별도 검색 방법을 연구 근거와 함께 DB 설계에 넣고 원래 삽입 위치를 보존해 그림 맥락까지 검색·표현한다. GitHub Actions scheduler는 contextual-orchestrator 기반 OpenCode Agent로 전환한다. COPILOT_GITHUB_TOKEN은 쓰지 않고 기존 리뷰 Agent 키 체계를 유지한다.
-
-**Note (flagged by CodeRabbit on this PR, 2026-08-30):** section 8's quoted text describes `contextual-orchestrator`'s general product capability — broad model/modality support and all-five-secret auto model discovery as a *design principle for the orchestrator itself*. It does not specify, and must not be read as overriding, which pool each CI consumer routes through: that is governed exclusively by `docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md` and its doctoring records — `OpenCode` and `Noema` use the fail-closed, ZDR-prioritized `orchestrator/free` pool; only `Strix` security analysis uses the provider-diverse `orchestrator/auto` pool; private/internal review targets require an attested ZDR-only catalog and never fall back to a non-ZDR provider. Do not loosen any CI consumer's pool or credential scope on the strength of this section's general wording alone.
-
-**Note (2026-08-30, superseded by the merged pin flip — see the correction below):** an earlier draft of this note said Strix stayed on `orchestrator/auto` pending `free_family_diversity` reaching `>= 2`. That is no longer true and must not be read as current: `.github/workflows/strix.yml` now hardcodes `STRIX_MODEL`/`CONTEXTUAL_ORCHESTRATOR_POOL` to `orchestrator/free` and fails closed on any other value. This note originally went on to say that ADR-0003's 2026-08-30 amendment "records the owner's decision to accept the residual single-outage-domain risk immediately rather than wait for the evidence-gated threshold this note originally described" — that framing was false, as ADR-0003's own 2026-08-31 correction now records: no owner reviewed or accepted this switch or its risk. `free_account_diversity` (`scripts/ci/contextual_orchestrator_review_policy.py`; renamed from `free_family_diversity` once every KV credential became an independent discovery account rather than being grouped into a vendor "family", see #1468) remains useful as ongoing monitoring evidence for that open, unreviewed risk, not as a gate blocking the pin.
-
-## 9. Reference libraries, tool invocations, and ecosystem repositories
-
-> 참고 라이브러리와 호출 @Superpowers @GitHub @Figma @Visualize @Context7 @Product Design @Consensus를 활용한다.
-
-- **TEPP** — https://github.com/ContextualWisdomLab/TEPP — 다국어·시간·관계 측정용 Temporal Event Psychometrics Platform이며 통계·심리측정 산술은 Rust로 구현한다.
-- **contextual-orchestrator** — https://github.com/ContextualWisdomLab/contextual-orchestrator — 논문 근거의 contextual model orchestration lab·enterprise admin design.
-- **fast-mlsirm** — https://github.com/ContextualWisdomLab/fast-mlsirm — simple-structure MLSIRM/MLS2PLM은 Jeon, Jin, Schweinberger, and Baugh(2021), Kang and Jeon(2025), Molenaar and Jeon(2026)을 따른다. 인접 화면: Angoff delta-plot DIF(docs/delta_plot_dif.md), Bradley–Terry MM ranking(docs/bradley_terry_mm.md). 주요 인용·결정: docs/traceability/research-basis.md, docs/adr/README.md. 점수 해석·공정성은 AERA·APA·NCME(2014)를 따르며 이는 CWE/OWASP/NIST 통제가 아니다.
-- **keyverse** — https://github.com/ContextualWisdomLab/keyverse — Keycloak 기반 독립 컴포넌트(Apache-2.0)이자 ContextualWisdom ecosystem 중앙 Identity Provider.
-- **RankWeave** — https://github.com/ContextualWisdomLab/RankWeave — Python 3.10+용 무의존성·저장소 비종속 retrieval fusion/evaluation/statistical comparison/tuning/TREC benchmarking/auditable CLI workflow.
-- **ThreadWeave** — https://github.com/ContextualWisdomLab/ThreadWeave — runtime dependency 없는 Python용 표준 기반 JWZ/RFC 5256 이메일 reference threading.
-- **disksage** — https://github.com/ContextualWisdomLab/disksage — Windows/Linux/macOS 디스크 공간 관리자. 드라이브를 스캔하고 완전 오프라인 온디바이스 LLM이 삭제 안전성을 조언하며 OWL ontology로 파일을 정리한다.
-- **wardnet** — https://github.com/ContextualWisdomLab/wardnet — ContextualWisdomLab Rust-first gateway·SOC control-plane baseline.
-- **LineageWeave** — https://github.com/ContextualWisdomLab/LineageWeave — 명시적 선후행 링크 없는 짧은 timestamped record에서 git-branch식 lineage DAG를 재구성해 평면 자료를 탐색 가능한 branching thread로 바꾼다. 수리 연산은 소관이 아니므로 다른 라이브러리로 이관한다.
+> LLM·오케스트레이션·Embedding
+> LLM 작업은 contextual-orchestrator(CO) Agent로 만든다. BYTEZ_API_KEY·NVIDIA_NIM_API_KEY·NVIDIA_NIM_API_KEY_SUB·OPENROUTER_API_KEY·OPENAI_API_KEY로 auto discovery해 embedding·responses·completions·audio·video·image·omni-modal을 지원하고 released API·client·schema로 연결한다.
+> 통합 CI는 .github reusable workflow와 thin caller로 구성한다. owner PR·release·consumer 변경마다 exact SHA로 build·API/schema contract·E2E·model behavior·security·SBOM·provenance를 검증한다. 결함은 owner에서 RED→fix→GREEN→release하고 consumer version을 올린다. mutable head·branch URL·cross-repo source·workflow 복제를 금지하며 bridge에는 owner issue·만료·삭제 조건을 둔다.
+> GitHub Actions의 model-backed workflow는 `orchestrator/free`로 고정한다. 무료 후보 discovery·routing·fallback은 CO 내부에서만 한다. workflow는 provider·model·group명·유료 fallback을 지정하지 않고 gateway token만 쓴다. capability가 없으면 유료 우회 없이 fail closed해 free pool·contract·CI를 보완한다.
+> Provider group명은 하드코딩하지 않는다. group은 별칭이며 modality·context·reasoning·tool·structured output·streaming·가격·지연·가용성·정확도 등 검증된 특성으로 선택·fallback한다.
+> Model timeout은 application·Agent·Gateway 공통 상한 없이 기본 null이다. 통신 장애는 upstream provider가 끝낸다. 관리자 Web은 모델별 조회·설정·해제·복원, 단위·우선순위·상속·검증·감사·API를 제공하고 설정된 모델만 제한한다. reasoning·streaming·tool call은 시간만으로 끊지 않으며 사용자 취소·provider 종료·관리자 timeout을 구분한다.
+> Fugu·Conductor·TRINITY 근거로 단일·다중 Agent의 test-time compute를 단계·재귀·분해·접근·역할별 effort로 배분·ablation한다. 정확성을 우선하고 OpenCode·Strix·Noema의 모델당 2시간 이상을 수용한다. Chat은 completions·responses와 json_object·json_schema를 지원한다. Embedding은 의미 단위로 나누고 base64 이미지의 인식·검색·삽입 위치·맥락을 보존한다.
+
+**Note (2026-09-02, confirmed consistent with current implementation across all three revisions):**
+this section now spells out, in the quoted text itself, exactly how the `orchestrator/free` pin must be
+implemented: GitHub Actions workflows select only the `orchestrator/free` virtual pool id and a gateway
+token — never a concrete provider/model/group name, never a paid-fallback flag — and all free-candidate
+discovery, routing, and fallback happen inside contextual-orchestrator itself; when no free capability
+is available, the workflow fails closed rather than routing to a paid model. Verified directly against
+`.github/workflows/strix.yml`, `noema-review.yml`, `opencode-review-dispatch.yml`, and
+`pr-review-autofix.yml`: all four already match this exactly (only the virtual pool id plus a bearer
+token, fail-closed on any other requested value). `docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md`'s
+2026-08-30 amendment already recorded the same free-only pin for Strix (superseding that ADR's original
+`orchestrator/auto` decision). No further code or workflow change is required by this section; the
+directive's wording and the implemented state already agree, across all three revisions.
+
+## 9. What "core foundation" means, and the develop/consume boundary
+
+> Core foundation의 의미와 개발·사용 경계
+> @Superpowers·@GitHub·@Figma·@Visualize·@Context7·@Product Design·@Consensus를 쓴다. Core foundation은 전 제품의 공통 설치물이 아니다. 여러 제품에서 반복되는 책임을 한 저장소가 canonical owner로서 독립 배포·versioned contract를 제공하는 선택형 control plane·service·library다. 보호 브랜치의 문서·API/schema·release evidence로 역할·성숙도를 확인하며 open PR은 Proposed 상태다.
+>
+> - 조직·계약 — .github: 공통 CI·review·security·release; enterprise-architecture-core: 전사 Context Map·architecture decision; context-graph-contracts: assertion·event·schema·fixture·conformance. domain truth는 제품에 남긴다.
+> - 의미·데이터 — ConceptWeave: ontology·semantic-layer 생성·검증·release. semantic-data-portal: catalog·governance·검색·제공. EmbedRelay: embedding identity·migration. mhtml-etl-gateway: MHTML 검사·schema proposal·load lineage.
+> - AI·운영 — CO: provider discovery·model capability·routing/delegation/verification/admin. noema: GitHub Actions OIDC 단기 repository capability·exact-revision evidence. pg-llm-batch: DB token count·batch 처리.
+> - Identity·보안·runtime — keyverse: identity·federation·token. EgressWeave: 안전한 outbound HTTP. OriginWeave: governed browser. pingora-gateway: Rust edge. quarantine-sandbox-runtime: 격리. appguardrail: scan·SARIF·remediation. wardnet: gateway·WAF·IDS·SOC.
+> - 재사용 기능 — fast-mlsirm: IRT·MLSIRM. TEPP: 다국어·시간·event·relation 측정. RankWeave: retrieval fusion·evaluation·통계 비교·tuning·TREC. ThreadWeave: JWZ/RFC 5256 threading. inkspan: editor·serialization·문서 변환. DiagramWeave: diagram patch·render·CLI·LSP.
+>
+> owner가 미성숙하거나 API가 없어도 consumer가 복제·우회하지 않는다. owner에서 RED test→기능·문서·release를 개발해 CI GREEN과 immutable version을 낸 뒤 채택한다. 그 전에는 port·ACL·feature flag·test double로 경계를 지키고 owner의 source·DB·임시 branch를 직접 읽지 않는다.
+
+**Note (2026-09-02, third revision):** this revision adds a definition of what "core foundation" means
+that the second revision did not state explicitly: it is *not* a common install for every product, but
+a **selective** control plane/service/library that one repo canonically owns because a responsibility
+repeats across multiple products, providing independent deployment and versioned contracts — role and
+maturity are verified from protected-branch docs/API-schema/release evidence, and an open PR proposing
+core status is `Proposed`, not yet authoritative. This revision also groups the repo list under five
+named categories (조직·계약 / 의미·데이터 / AI·운영 / Identity·보안·runtime / 재사용 기능) instead of the
+second revision's flat bullet list, and adds explicit interim-boundary mechanisms for the "build the
+core, don't bypass it" policy first stated in §2: while an owner repo is still building out a needed
+capability, a consumer holds the boundary with a port, an ACL, a feature flag, or a test double — and
+must not read the owner's source, database, or a temporary branch directly. All repository names below
+were re-checked against this revision's own list and match the second revision's already-verified set
+exactly (no new or renamed repos introduced).
+
+**Verification (2026-09-02):** every repository named above was confirmed to exist under
+`ContextualWisdomLab` with exact-matching case via a direct GitHub repository listing on the date of
+this revision: `.github`, `enterprise-architecture-core`, `context-graph-contracts`, `ConceptWeave`,
+`semantic-data-portal`, `contextual-orchestrator`, `noema`, `keyverse`, `EgressWeave`, `OriginWeave`,
+`pingora-gateway`, `quarantine-sandbox-runtime`, `pg-llm-batch`, `EmbedRelay`, `fast-mlsirm`, `TEPP`,
+`RankWeave`, `ThreadWeave`, `inkspan`, `DiagramWeave`, `mhtml-etl-gateway`, `appguardrail`, `wardnet`.
+The second revision additionally named `naruon`, `LineageWeave`, `psychometrics-commons`, `disksage`,
+`PolicyWeave`, `CalendarWeave`, `supply-chain-control-plane` as domain-product/composition consumers
+(not core); the third revision's §9 text above does not restate that consumer list explicitly, but its
+opening definition ("Core foundation은 전 제품의 공통 설치물이 아니다") implies the same classification.
+All 30 names across both revisions (23 §9 core repos, of which 4 are also named in §5's ontology
+discussion, plus the 7 §9 domain-consumer repos) were verified to exist with matching case; none needed
+a spelling or case correction.
+
+**Reconciliation item — sandbox ownership (resolved 2026-09-02):** an earlier draft of this note flagged
+an unresolved tension between `docs/CWL-MASTER-CONTEXT.md` §3/§6 (which said `noema` owns "the
+lightweight quarantine sandbox") and this section (which lists `quarantine-sandbox-runtime` as its own
+dedicated repo). Resolved by reading both repos' current READMEs/plans directly, not guessing:
+`quarantine-sandbox-runtime`'s README describes itself, almost verbatim, as `CWL-MASTER-CONTEXT.md`
+§6's own AI-SOC sandbox spec ("source-agnostic, credential-free artifact analysis runtime"); `noema`'s
+current README describes an unrelated product (an evidence-producing credential/maintenance control
+plane for GitHub OIDC/App-token exchange and review evidence, with no artifact-analysis responsibility),
+and `noema/docs/noema-agent-sandbox-plan.md` explicitly states the review agent "runs in a separate
+quarantined execution plane" that "must not run untrusted repository code in the Noema Worker process."
+`docs/CWL-MASTER-CONTEXT.md` §3/§6/§8/the ecosystem UML diagram were updated in this same PR to name
+`quarantine-sandbox-runtime`, not `noema`, as the sandbox owner. The remaining gap this note originally
+flagged — §3 not yet mentioning `ConceptWeave`, `enterprise-architecture-core`,
+`context-graph-contracts`, `EgressWeave`, `OriginWeave`, `pingora-gateway`, `EmbedRelay`, `DiagramWeave`,
+or `mhtml-etl-gateway` at all — is still open and left for a future pass; it is a coverage gap, not a
+contradiction, so it does not block this revision.
 
 ## How to point a `/goal` session at this directive
 
@@ -88,9 +231,35 @@ Because `/goal` truncates at 4000 characters, do not paste the sections above in
 short pointer, e.g. (Korean, ~260 chars, well under the cap):
 
 ```text
-/goal ContextualWisdomLab/.github의 docs/product-goal-directive.md 전문을 지침으로 삼아 실행하라. 열린 PR마다 리뷰 확인→수정→Checks 재검증→병합→다음 개발을 중간 보고 없이 반복하고, PR·Issue 소진 후에도 Gap 기반 개발을 계속한다. 이 문서의 9개 절 전체(실행 루프, 동시작업/근본수정, 연구추적성, UX/UI, 아키텍처/DB, 언어/측정, 검증/부하, LLM/오케스트레이션, 참고 라이브러리)를 매 사이클 적용 대상으로 취급하고, 이 문서와 docs/CWL-MASTER-CONTEXT.md §7이 상충하면 상충을 해소하고 두 문서를 함께 갱신하라. 한 시간 간격으로 재예약하라.
+/goal ContextualWisdomLab/.github의 docs/product-goal-directive.md 전문을 지침으로 삼아 실행하라. 열린 PR마다 리뷰 확인→수정→Checks 재검증→병합→다음 개발을 중간 보고 없이 반복하고, PR·Issue 소진 후에도 Gap 기반 개발을 계속한다. 이 문서의 9개 절 전체(실행 루프, 동시작업/근본수정, 연구추적성, UX/UI/i18n, 아키텍처/온톨로지/DB, 언어/측정, 검증/부하, LLM/오케스트레이션, core foundation의 의미와 개발/사용 경계)를 매 사이클 적용 대상으로 취급하고, 이 문서와 docs/CWL-MASTER-CONTEXT.md가 상충하면 상충을 해소하고 두 문서를 함께 갱신하라. 매시간 재예약하라.
 ```
 
 When this directive itself changes (the user revises a section, or an agent finds it conflicts with
 `docs/CWL-MASTER-CONTEXT.md` or a merged PR), edit this file in place and note the change in
 `docs/doctoring/` per the repo's traceability convention — do not fork a second copy elsewhere.
+
+## Revision history
+
+- **2026-08-30** — original nine-section directive recorded verbatim. Two reconciliation notes added
+  against `docs/CWL-MASTER-CONTEXT.md` (the wardnet naming-history conflict in §5, the
+  `orchestrator/auto`-vs-`orchestrator/free` pool-routing ambiguity in §8); see
+  `docs/doctoring/product-goal-directive.md` for the full PR #1429 review-finding trail.
+- **2026-09-02 (second revision)** — the owner reissued the directive with all nine sections
+  substantially expanded: §2 added an explicit "build the immature core, don't bypass it" policy; §4
+  added detailed i18n requirements and clarified Keycloak's role; §5 broadened the naming rule to all
+  code identifiers and added an ontology-ownership split across four named repos; §8 folded the
+  `orchestrator/free` pin directly into the quoted text; §9 replaced the general reference-library list
+  with a full named core-repo table and an explicit core-vs-domain-product classification. Recorded in
+  ContextualWisdomLab/.github#1692.
+- **2026-09-02 (third revision, this file's current text)** — the owner issued one further refinement
+  the same day: §1 clarified that "0 open PRs" must come from merges or full successor-absorption, never
+  a bare close; §2 added the substantial repair-vs-close PR-lifecycle policy (single-writer/DDD
+  violations, wrong base/conflicts, ADR-number collisions, premature `Accepted`, unprotected
+  dependencies, and missing test/fixture/contract are repair findings, not grounds for closing); §4
+  dropped the named-framework shortlist in favor of framework-agnostic selection criteria; §5 moved the
+  detailed per-repo ontology-owner breakdown into §9; §8 spelled out exactly how GitHub Actions
+  workflows must implement the `orchestrator/free` pin (pool id + gateway token only, fail-closed, no
+  provider/model/group name, no paid fallback); §9 added an explicit definition of what "core
+  foundation" means, reorganized the repo table into five named categories, and added concrete
+  interim-boundary mechanisms (port/ACL/feature-flag/test-double) for the build-the-core policy. See
+  `docs/doctoring/product-goal-directive.md` for this revision's reconciliation record.
diff --git a/tests/test_product_technical_gap_baseline.py b/tests/test_product_technical_gap_baseline.py
index d44ffdb8e6..9a9f7f4dbe 100644
--- a/tests/test_product_technical_gap_baseline.py
+++ b/tests/test_product_technical_gap_baseline.py
@@ -98,3 +98,14 @@ def test_master_context_points_at_live_baseline_without_freezing_shas() -> None:
     assert "ContextualWisdomLab/naruon#975" in source
     assert "Done" in source
     assert "merge authorization" in source
+
+
+def test_master_context_has_one_quarantine_isolation_owner() -> None:
+    """Noema must not compete with quarantine-sandbox-runtime for isolation ownership."""
+    source = Path("docs/CWL-MASTER-CONTEXT.md").read_text(encoding="utf-8")
+    assert "isolated execution for untrusted plugins (noema quarantine sandbox)" not in source
+    assert "`noema` is the shared agent runtime + quarantine sandbox" not in source
+    assert "**noema** — GitHub Actions OIDC short-lived repository capability" in source
+    assert "**quarantine-sandbox-runtime**" in source
+    assert "WARD -->|\"quarantine detonation\"| QUAR" in source
+    assert "GH -->|\"repository capability / exact-revision evidence\"| NOEMA" in source