From 47d4e890e3bf29a3f7596d7a9a0a25f780b59e8f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 16:16:34 +0900 Subject: [PATCH 01/52] test: define full-text write admission and authority ordering --- .../src/full_text_capture_tests.rs | 3 + .../src/full_text_write_tests.rs | 109 ++++++++++++++++++ .../2026-09-06_full_text_write_admission.md | 45 ++++++++ 3 files changed, 157 insertions(+) create mode 100644 crates/conceptweave-zotero/src/full_text_write_tests.rs create mode 100644 docs/plans/2026-09-06_full_text_write_admission.md diff --git a/crates/conceptweave-zotero/src/full_text_capture_tests.rs b/crates/conceptweave-zotero/src/full_text_capture_tests.rs index b893dcd9..1718ec32 100644 --- a/crates/conceptweave-zotero/src/full_text_capture_tests.rs +++ b/crates/conceptweave-zotero/src/full_text_capture_tests.rs @@ -1,6 +1,9 @@ use super::*; use crate::{StewardReviewWorksheet, ZoteroItem, classify_snapshot}; +#[path = "full_text_write_tests.rs"] +mod full_text_write_tests; + fn completed_full_text_view( report: &ClassificationReport, worksheet: &FullTextReviewWorksheet, diff --git a/crates/conceptweave-zotero/src/full_text_write_tests.rs b/crates/conceptweave-zotero/src/full_text_write_tests.rs new file mode 100644 index 00000000..59a9d828 --- /dev/null +++ b/crates/conceptweave-zotero/src/full_text_write_tests.rs @@ -0,0 +1,109 @@ +use super::*; +use crate::{ + FullTextWriteScope, WriteMode, build_full_text_write_plan, execute_full_text_write_plan, +}; +use std::cell::Cell; + +fn write_scope_fixture(report: &ClassificationReport, capture: &FullTextCapture) -> FullTextWriteScope { + let worksheet = build_full_text_review_worksheet(report, capture).unwrap(); + let completed = completed_full_text_view(report, &worksheet, capture, 2); + let decided = apply_full_text_review_view(report, &worksheet, capture, &completed).unwrap(); + let full_text_review = finalize_full_text_review( + report, &decided, capture, full_text_approval_fixture(report, capture), + ).unwrap(); + let reviewed_writes = crate::ReviewedClassificationWriteSet { + review_id: "synthetic-write-review".into(), + authority_receipt: "synthetic-write-authority".into(), + server_id: report.server_id.clone(), + zotero_version: report.zotero_version.clone(), + library_version: report.library_version, + rule_revision: report.rule_revision.clone(), + snapshot_digest: report.snapshot_digest.clone(), + snapshot_items: report.snapshot_items.clone(), + changes: report.classified_items.iter().map(|item| crate::ReviewedClassificationChange { + item_key: item.item_key.clone(), + item_version: item.item_version, + reviewed_disposition: crate::Disposition::OutOfScope, + before_collection_keys: item.collection_keys.clone(), + after_collection_keys: vec!["EXPLICIT_COLLECTION".into()], + before_tags: item.tags.clone(), + after_tags: item.tags.clone(), + }).collect(), + }; + FullTextWriteScope { full_text_review, reviewed_writes, mode: WriteMode::DryRun } +} + +#[test] +fn full_text_write_validates_both_inputs_before_either_authority() { + for scenario in 0..7 { + let report = report_fixture(); + let capture = capture_with(&report, 4096, &mut |request_path, _| Ok(response_fixture(request_path))).unwrap(); + let mut scope = write_scope_fixture(&report, &capture); + match scenario { + 0 => scope.reviewed_writes.changes[1].after_collection_keys = vec![" ".into()], + 1 => scope.reviewed_writes.changes[1].reviewed_disposition = crate::Disposition::SemanticConsumptionBridge, + 2 => scope.reviewed_writes.snapshot_digest = "changed".into(), + 3 => scope.reviewed_writes.changes[1].item_version += 1, + _ => { + let mut value = serde_json::to_value(&scope.full_text_review).unwrap(); + match scenario { + 4 => { value["full_text_golden_set_v1"]["labels"].as_array_mut().unwrap().pop(); } + 5 => value["capture_digest"] = "changed".into(), + _ => value["full_text_golden_set_v1"]["approval"]["proposal_digest"] = "changed".into(), + } + scope.full_text_review = serde_json::from_value(value).unwrap(); + } + } + let calls = Cell::new(0); + assert!(build_full_text_write_plan(&report, &capture, scope, + |_| { calls.set(calls.get()+1); true }, + |_| { calls.set(calls.get()+1); true }).is_err(), "scenario {scenario}"); + assert_eq!(calls.get(), 0, "scenario {scenario}"); + } +} + +#[test] +fn full_text_write_verifiers_receive_exact_scope_and_mode() { + for mode in [WriteMode::DryRun, WriteMode::Execute] { + for semantic_allowed in [false, true] { + for write_allowed in [false, true] { + let report = report_fixture(); + let capture = capture_with(&report, 4096, &mut |request_path, _| Ok(response_fixture(request_path))).unwrap(); + let mut scope = write_scope_fixture(&report, &capture); + scope.mode = mode; + let expected = serde_json::to_value(&scope).unwrap(); + let semantic_calls = Cell::new(0); + let write_calls = Cell::new(0); + let result = build_full_text_write_plan(&report, &capture, scope, |actual| { + semantic_calls.set(semantic_calls.get()+1); + assert_eq!(serde_json::to_value(actual).unwrap(), expected["full_text_review"]); + semantic_allowed + }, |actual| { + write_calls.set(write_calls.get()+1); + assert_eq!(serde_json::to_value(actual).unwrap(), expected); + write_allowed + }); + assert_eq!(result.is_ok(), semantic_allowed && write_allowed); + assert_eq!(semantic_calls.get(), 1); + assert_eq!(write_calls.get(), usize::from(semantic_allowed)); + } + } + } +} + +#[test] +fn full_text_write_dry_run_preserves_binding_without_reads_or_writes() { + let report = report_fixture(); + let capture = capture_with(&report, 4096, &mut |request_path, _| Ok(response_fixture(request_path))).unwrap(); + let scope = write_scope_fixture(&report, &capture); + let plan = build_full_text_write_plan(&report, &capture, scope, |_| true, |_| true).unwrap(); + let receipt = execute_full_text_write_plan(&plan, + |_| -> Result { panic!("dry-run read") }, + |_| -> Result { panic!("dry-run write") }); + let plan_json = serde_json::to_value(&plan).unwrap(); + let receipt_json = serde_json::to_value(receipt).unwrap(); + assert_eq!(receipt_json["full_text_write_v1"], plan_json["full_text_write_v1"]); + assert_eq!(receipt_json["write_result"]["outcome"], "dry_run"); + assert!(!receipt_json.to_string().contains("fixture text")); + assert!(!receipt_json.to_string().contains("synthetic-write-authority")); +} diff --git a/docs/plans/2026-09-06_full_text_write_admission.md b/docs/plans/2026-09-06_full_text_write_admission.md new file mode 100644 index 00000000..2e45dc4e --- /dev/null +++ b/docs/plans/2026-09-06_full_text_write_admission.md @@ -0,0 +1,45 @@ +# Full-text write admission implementation plan + +> **Execution:** Apply Superpowers test-driven-development and verification-before-completion in this existing dedicated ConceptWeave checkout. The user has authorized autonomous implementation; routine design confirmation is not a gate. + +**Goal:** Make a fully reviewed paper classification eligible for separately authorized, explicit Zotero metadata changes without detaching the captured evidence during execution or recovery. + +**Architecture:** Keep the existing intake owner and Local API executor. Separate the current local validation bodies from authority verification privately, compose both validations, check changed labels against the complete golden set, then verify the complete full-text review and the explicit write scope. Never use an allow-all callback to bridge the old boundaries. Typed inputs are deliberately not deserializable executable authority. + +**Tech stack:** Existing Rust 1.98.0 workspace, serde and SHA-256 dependency; no new dependency, service, transport, credentials or live-write CLI. + +## Baseline and scope + +Parent PR #38 is OPEN Draft at `8e057652ee7784b373beeeec865d80dd3db773be`, base `692cb588b26a9cc878fbaa2b47aa30fd83ea47de`, as reread on 2026-09-06. Preserve both and stack the successor normally. Root is the sole writer for this increment; #6 and central workflow repair stay with their existing owners. The organization master-context and product-directive blobs remain `2ce09ee89ed9b8243684958e616d8ca934a3788e` and `c76c4226e4450f9b1714974fee0a62b60ea59bc9`. + +Run from `/Users/seonghobae/Documents/ChatGPT/ConceptWeave`: + +```sh +/Users/seonghobae/.cargo/bin/cargo +1.98.0 test --workspace --locked +``` + +Baseline expectation: existing 240 tests pass. New admission capability is absent. Actual paper decisions and independently verified approvals remain each 0/3,715. Test doubles are synthetic unit-only inputs, never research labels or approvals. + +## Task 1 — Preserve a failing contract + +Add `/Users/seonghobae/Documents/ChatGPT/ConceptWeave/crates/conceptweave-zotero/src/full_text_write_tests.rs`, reusing the adjacent private capture and completed-view fixture functions. Register it in `full_text_capture_tests.rs`. + +Commit the experiment before running the focused test, as required by autoresearch. The first RED is the absent full-text write API, not a missing dependency. Preserve it in history; do not reset shared history. + +```sh +/Users/seonghobae/.cargo/bin/cargo +1.98.0 test --locked -p conceptweave-zotero --lib full_text_write +``` + +Acceptance matrix: capture/report/proposal mismatch, incomplete or changed labels, invalid later write, destination/mode substitution, either authority denial, unchanged full envelopes delivered once, dry-run zero reads/writes, stale complete preflight, partial write, conditional rollback, retry and delayed rollback reconciliation. Every successful bound output must carry the same versioned scope digest. No public executable legacy-plan or freely mixed rollback-operation projection is allowed. + +## Task 2 — Reuse validation and preserve authority + +Modify private preparation in `/Users/seonghobae/Documents/ChatGPT/ConceptWeave/crates/conceptweave-zotero/src/lib.rs` and `src/full_text_review.rs`; public legacy APIs retain their contracts and error precedence. Implement `src/full_text_write.rs` beneath the existing full-text owner. Use a required typed full-text review, reviewed write set and explicit mode. Bind exact serialized inputs with a versioned SHA-256 domain. Full-text and write authority are different verifiers; local validation precedes both, semantic denial prevents write-authority verification. + +Keep plans and recovery evidence opaque and serialize-only. Receipts retain the scope commitment, not source text or adapter errors. A serialized document is an audit artifact, not restoration or authority issuance. Independently unknown write state must not be reported as successfully restored by an empty rollback. Persisted admission, external issuer integration and live write evidence remain separate requirements. + +## Task 3 — Verify and hand off + +Run the focused test, full workspace, strict all-target Clippy, formatting, warnings-denied rustdoc, existing CI contract check and existing coverage gate. Do not change thresholds, coverage exclusions, locked versions or fixtures to obtain GREEN. Record exact commands, counts and raw versus normalized coverage separately in the Gap baseline and ignored `results.tsv`. + +Update PRD/TRD/Proposed ADR 0007/architecture guidance/UML/CHANGELOG to state implemented behavior and remaining gates. Create a Draft successor against #38, reread its exact head/base/body, inspect current reviews/checks, and retain all protected gates. Update the existing hourly task with exact evidence and next work; do not treat local GREEN as approval or protected publication. From d36dad824f6d78c76cf3b5a009dee15f09e6b02f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 16:18:24 +0900 Subject: [PATCH 02/52] feat: bind full-text write admission to both verified authorities --- .../src/full_text_review.rs | 28 +++- .../src/full_text_write.rs | 143 ++++++++++++++++++ .../src/full_text_write_tests.rs | 137 ++++++++++++----- crates/conceptweave-zotero/src/lib.rs | 34 ++++- 4 files changed, 293 insertions(+), 49 deletions(-) create mode 100644 crates/conceptweave-zotero/src/full_text_write.rs diff --git a/crates/conceptweave-zotero/src/full_text_review.rs b/crates/conceptweave-zotero/src/full_text_review.rs index 185d80be..9d724f1b 100644 --- a/crates/conceptweave-zotero/src/full_text_review.rs +++ b/crates/conceptweave-zotero/src/full_text_review.rs @@ -1,6 +1,10 @@ use super::*; use crate::StewardReviewWorksheet; +#[path = "full_text_write.rs"] +mod full_text_write; +pub use full_text_write::*; + /// Independently issued approval input for one full-text review context. /// The issuer must bind the complete reviewed labels as well as this capture. #[derive(Deserialize, Serialize)] @@ -168,19 +172,29 @@ pub fn evaluate_full_text_review( where F: FnOnce(&FullTextReviewedGoldenSet) -> bool, { - validate_review_capture(report, capture, &reviewed.capture_digest)?; - let review_evaluation = crate::evaluate_complete_reviewed_classification( - report, - &reviewed.reviewed_golden_set, - |_| verify_approval(reviewed), - ) - .map_err(|_| FullTextError("full-text review is invalid or unverified"))?; + let review_evaluation = prepare_full_text_review(report, capture, reviewed)?; + if !verify_approval(reviewed) { + return Err(FullTextError("full-text review is invalid or unverified")); + } Ok(FullTextReviewEvaluation { capture_digest: reviewed.capture_digest.clone(), review_evaluation, }) } +fn prepare_full_text_review( + report: &ClassificationReport, + capture: &FullTextCapture, + reviewed: &FullTextReviewedGoldenSet, +) -> Result { + validate_review_capture(report, capture, &reviewed.capture_digest)?; + if reviewed.reviewed_golden_set.labels.len() != report.classified_items.len() { + return Err(FullTextError("full-text review is invalid or unverified")); + } + crate::prepare_reviewed_golden_set(report, &reviewed.reviewed_golden_set) + .map_err(|_| FullTextError("full-text review is invalid or unverified")) +} + fn validate_review_capture( report: &ClassificationReport, capture: &FullTextCapture, diff --git a/crates/conceptweave-zotero/src/full_text_write.rs b/crates/conceptweave-zotero/src/full_text_write.rs new file mode 100644 index 00000000..1dcbe1b0 --- /dev/null +++ b/crates/conceptweave-zotero/src/full_text_write.rs @@ -0,0 +1,143 @@ +use super::*; +use crate::{ + ClassificationItemState, ClassificationWritePlan, ClassificationWriteReceipt, + ClassificationWriteRequest, ReviewedClassificationWriteSet, WriteMode, +}; + +const INVALID_WRITE_SCOPE: FullTextError = + FullTextError("full-text change request is invalid or unverified"); + +/// Complete typed input for independent meaning and destination authorization. +/// +/// The write verifier must authenticate every field, including mode, against +/// independently issued authority. Receipt strings are opaque references, never +/// API keys or bearer credentials. Persist this only as an owner-only artifact. +/// There is no executable JSON deserializer: legacy nested DTOs are permissive. +#[derive(Serialize)] +pub struct FullTextWriteScope { + /// Every reviewed label and its capture-bound approval input. + pub full_text_review: FullTextReviewedGoldenSet, + /// Explicit complete before/after metadata, separately authorized for writing. + pub reviewed_writes: ReviewedClassificationWriteSet, + /// Behavior authenticated by the write verifier; meaning does not select it. + pub mode: WriteMode, +} + +#[derive(Clone, Serialize)] +struct FullTextWriteBinding { + scope_digest: String, + capture_digest: String, + proposal_digest: String, + snapshot_digest: String, + mode: WriteMode, +} + +/// Verified plan retaining the complete approved input and its versioned identity. +/// +/// The legacy plan stays private; serialized output is audit evidence, not an +/// executable restoration. Retain the owner-only scope to verify receipt hashes. +/// +/// ```compile_fail +/// use conceptweave_zotero::{FullTextWritePlan, execute_classification_write_plan}; +/// fn detach(plan: &FullTextWritePlan) { +/// execute_classification_write_plan(&plan.write_plan, +/// |_| Ok::<_, ()>(unreachable!()), |_| Ok::<_, ()>(unreachable!())); +/// } +/// ``` +#[derive(Serialize)] +pub struct FullTextWritePlan { + full_text_write_v1: FullTextWriteBinding, + approved_scope: FullTextWriteScope, + #[serde(skip)] + write_plan: ClassificationWritePlan, +} + +/// Bound write outcome; no public inverse-operation projection can detach it. +/// Source text, reviewer identity, authority inputs and adapter errors are omitted. +#[derive(Serialize)] +pub struct FullTextWriteReceipt { + full_text_write_v1: FullTextWriteBinding, + #[serde(serialize_with = "serialize_write_result")] + write_result: ClassificationWriteReceipt, +} + +fn serialize_write_result( + receipt: &ClassificationWriteReceipt, + serializer: S, +) -> Result { + let mut audit_value = + serde_json::to_value(receipt).expect("write receipts contain JSON values"); + let audit_fields = audit_value + .as_object_mut() + .expect("write receipts are objects"); + audit_fields.remove("authority_receipt"); + audit_fields.remove("review_id"); + audit_value.serialize(serializer) +} + +/// Validates the complete evidence and change scope before calling either verifier. +/// +/// A denied meaning review never invokes the write verifier. A valid request +/// reaches each exactly once; neither callback is an approval issuer. All changed +/// labels must match the complete review, and destinations are never inferred. +pub fn build_full_text_write_plan( + report: &ClassificationReport, + capture: &FullTextCapture, + scope: FullTextWriteScope, + verify_meaning: impl FnOnce(&FullTextReviewedGoldenSet) -> bool, + verify_writes: impl FnOnce(&FullTextWriteScope) -> bool, +) -> Result { + let evaluation = prepare_full_text_review(report, capture, &scope.full_text_review)?; + let write_plan = + crate::prepare_classification_write_plan(report, &scope.reviewed_writes, scope.mode) + .map_err(|_| INVALID_WRITE_SCOPE)?; + let labels = scope + .full_text_review + .reviewed_golden_set + .labels + .iter() + .map(|label| (label.item_key.as_str(), label.expected_disposition)) + .collect::>(); + if scope + .reviewed_writes + .changes + .iter() + .any(|change| labels.get(change.item_key.as_str()) != Some(&change.reviewed_disposition)) + { + return Err(INVALID_WRITE_SCOPE); + } + let scope_bytes = serde_json::to_vec(&("conceptweave-full-text-write-v1", &scope)) + .expect("typed full-text write scopes contain JSON values"); + let binding = FullTextWriteBinding { + scope_digest: format!("sha256:{:x}", Sha256::digest(scope_bytes)), + capture_digest: scope.full_text_review.capture_digest.clone(), + proposal_digest: evaluation.proposal_digest, + snapshot_digest: evaluation.snapshot_digest, + mode: scope.mode, + }; + if !verify_meaning(&scope.full_text_review) || !verify_writes(&scope) { + return Err(INVALID_WRITE_SCOPE); + } + Ok(FullTextWritePlan { + full_text_write_v1: binding, + approved_scope: scope, + write_plan, + }) +} + +/// Runs the existing complete-preflight executor and attaches the admitted scope. +/// Dry-run performs no reads or writes. Authentication remains caller-owned. +pub fn execute_full_text_write_plan( + plan: &FullTextWritePlan, + preflight: impl FnMut(&str) -> Result, + write_item: impl FnMut(&ClassificationWriteRequest) -> Result, +) -> FullTextWriteReceipt { + FullTextWriteReceipt { + full_text_write_v1: plan.full_text_write_v1.clone(), + write_result: crate::execute_classification_write_plan( + &plan.write_plan, + preflight, + write_item, + ), + } +} diff --git a/crates/conceptweave-zotero/src/full_text_write_tests.rs b/crates/conceptweave-zotero/src/full_text_write_tests.rs index 59a9d828..5bc92ca5 100644 --- a/crates/conceptweave-zotero/src/full_text_write_tests.rs +++ b/crates/conceptweave-zotero/src/full_text_write_tests.rs @@ -4,13 +4,20 @@ use crate::{ }; use std::cell::Cell; -fn write_scope_fixture(report: &ClassificationReport, capture: &FullTextCapture) -> FullTextWriteScope { +fn write_scope_fixture( + report: &ClassificationReport, + capture: &FullTextCapture, +) -> FullTextWriteScope { let worksheet = build_full_text_review_worksheet(report, capture).unwrap(); let completed = completed_full_text_view(report, &worksheet, capture, 2); let decided = apply_full_text_review_view(report, &worksheet, capture, &completed).unwrap(); let full_text_review = finalize_full_text_review( - report, &decided, capture, full_text_approval_fixture(report, capture), - ).unwrap(); + report, + &decided, + capture, + full_text_approval_fixture(report, capture), + ) + .unwrap(); let reviewed_writes = crate::ReviewedClassificationWriteSet { review_id: "synthetic-write-review".into(), authority_receipt: "synthetic-write-authority".into(), @@ -20,44 +27,80 @@ fn write_scope_fixture(report: &ClassificationReport, capture: &FullTextCapture) rule_revision: report.rule_revision.clone(), snapshot_digest: report.snapshot_digest.clone(), snapshot_items: report.snapshot_items.clone(), - changes: report.classified_items.iter().map(|item| crate::ReviewedClassificationChange { - item_key: item.item_key.clone(), - item_version: item.item_version, - reviewed_disposition: crate::Disposition::OutOfScope, - before_collection_keys: item.collection_keys.clone(), - after_collection_keys: vec!["EXPLICIT_COLLECTION".into()], - before_tags: item.tags.clone(), - after_tags: item.tags.clone(), - }).collect(), + changes: report + .classified_items + .iter() + .map(|item| crate::ReviewedClassificationChange { + item_key: item.item_key.clone(), + item_version: item.item_version, + reviewed_disposition: crate::Disposition::OutOfScope, + before_collection_keys: item.collection_keys.clone(), + after_collection_keys: vec!["EXPLICIT_COLLECTION".into()], + before_tags: item.tags.clone(), + after_tags: item.tags.clone(), + }) + .collect(), }; - FullTextWriteScope { full_text_review, reviewed_writes, mode: WriteMode::DryRun } + FullTextWriteScope { + full_text_review, + reviewed_writes, + mode: WriteMode::DryRun, + } } #[test] fn full_text_write_validates_both_inputs_before_either_authority() { for scenario in 0..7 { let report = report_fixture(); - let capture = capture_with(&report, 4096, &mut |request_path, _| Ok(response_fixture(request_path))).unwrap(); + let capture = capture_with(&report, 4096, &mut |request_path, _| { + Ok(response_fixture(request_path)) + }) + .unwrap(); let mut scope = write_scope_fixture(&report, &capture); match scenario { 0 => scope.reviewed_writes.changes[1].after_collection_keys = vec![" ".into()], - 1 => scope.reviewed_writes.changes[1].reviewed_disposition = crate::Disposition::SemanticConsumptionBridge, + 1 => { + scope.reviewed_writes.changes[1].reviewed_disposition = + crate::Disposition::SemanticConsumptionBridge + } 2 => scope.reviewed_writes.snapshot_digest = "changed".into(), 3 => scope.reviewed_writes.changes[1].item_version += 1, _ => { let mut value = serde_json::to_value(&scope.full_text_review).unwrap(); match scenario { - 4 => { value["full_text_golden_set_v1"]["labels"].as_array_mut().unwrap().pop(); } + 4 => { + value["full_text_golden_set_v1"]["labels"] + .as_array_mut() + .unwrap() + .pop(); + } 5 => value["capture_digest"] = "changed".into(), - _ => value["full_text_golden_set_v1"]["approval"]["proposal_digest"] = "changed".into(), + _ => { + value["full_text_golden_set_v1"]["approval"]["proposal_digest"] = + "changed".into() + } } scope.full_text_review = serde_json::from_value(value).unwrap(); } } let calls = Cell::new(0); - assert!(build_full_text_write_plan(&report, &capture, scope, - |_| { calls.set(calls.get()+1); true }, - |_| { calls.set(calls.get()+1); true }).is_err(), "scenario {scenario}"); + assert!( + build_full_text_write_plan( + &report, + &capture, + scope, + |_| { + calls.set(calls.get() + 1); + true + }, + |_| { + calls.set(calls.get() + 1); + true + } + ) + .is_err(), + "scenario {scenario}" + ); assert_eq!(calls.get(), 0, "scenario {scenario}"); } } @@ -68,21 +111,33 @@ fn full_text_write_verifiers_receive_exact_scope_and_mode() { for semantic_allowed in [false, true] { for write_allowed in [false, true] { let report = report_fixture(); - let capture = capture_with(&report, 4096, &mut |request_path, _| Ok(response_fixture(request_path))).unwrap(); + let capture = capture_with(&report, 4096, &mut |request_path, _| { + Ok(response_fixture(request_path)) + }) + .unwrap(); let mut scope = write_scope_fixture(&report, &capture); scope.mode = mode; let expected = serde_json::to_value(&scope).unwrap(); let semantic_calls = Cell::new(0); let write_calls = Cell::new(0); - let result = build_full_text_write_plan(&report, &capture, scope, |actual| { - semantic_calls.set(semantic_calls.get()+1); - assert_eq!(serde_json::to_value(actual).unwrap(), expected["full_text_review"]); - semantic_allowed - }, |actual| { - write_calls.set(write_calls.get()+1); - assert_eq!(serde_json::to_value(actual).unwrap(), expected); - write_allowed - }); + let result = build_full_text_write_plan( + &report, + &capture, + scope, + |actual| { + semantic_calls.set(semantic_calls.get() + 1); + assert_eq!( + serde_json::to_value(actual).unwrap(), + expected["full_text_review"] + ); + semantic_allowed + }, + |actual| { + write_calls.set(write_calls.get() + 1); + assert_eq!(serde_json::to_value(actual).unwrap(), expected); + write_allowed + }, + ); assert_eq!(result.is_ok(), semantic_allowed && write_allowed); assert_eq!(semantic_calls.get(), 1); assert_eq!(write_calls.get(), usize::from(semantic_allowed)); @@ -94,16 +149,28 @@ fn full_text_write_verifiers_receive_exact_scope_and_mode() { #[test] fn full_text_write_dry_run_preserves_binding_without_reads_or_writes() { let report = report_fixture(); - let capture = capture_with(&report, 4096, &mut |request_path, _| Ok(response_fixture(request_path))).unwrap(); + let capture = capture_with(&report, 4096, &mut |request_path, _| { + Ok(response_fixture(request_path)) + }) + .unwrap(); let scope = write_scope_fixture(&report, &capture); let plan = build_full_text_write_plan(&report, &capture, scope, |_| true, |_| true).unwrap(); - let receipt = execute_full_text_write_plan(&plan, + let receipt = execute_full_text_write_plan( + &plan, |_| -> Result { panic!("dry-run read") }, - |_| -> Result { panic!("dry-run write") }); + |_| -> Result { panic!("dry-run write") }, + ); let plan_json = serde_json::to_value(&plan).unwrap(); let receipt_json = serde_json::to_value(receipt).unwrap(); - assert_eq!(receipt_json["full_text_write_v1"], plan_json["full_text_write_v1"]); + assert_eq!( + receipt_json["full_text_write_v1"], + plan_json["full_text_write_v1"] + ); assert_eq!(receipt_json["write_result"]["outcome"], "dry_run"); assert!(!receipt_json.to_string().contains("fixture text")); - assert!(!receipt_json.to_string().contains("synthetic-write-authority")); + assert!( + !receipt_json + .to_string() + .contains("synthetic-write-authority") + ); } diff --git a/crates/conceptweave-zotero/src/lib.rs b/crates/conceptweave-zotero/src/lib.rs index 65d110e2..30018b7e 100644 --- a/crates/conceptweave-zotero/src/lib.rs +++ b/crates/conceptweave-zotero/src/lib.rs @@ -20,6 +20,10 @@ pub use full_text_capture::{ FullTextReviewedGoldenSet, apply_full_text_review_view, build_bound_full_text_review_json, build_full_text_review_worksheet, evaluate_full_text_review, finalize_full_text_review, }; +pub use full_text_capture::{ + FullTextWritePlan, FullTextWriteReceipt, FullTextWriteScope, build_full_text_write_plan, + execute_full_text_write_plan, +}; /// Classification rule revision recorded in every report. pub const RULE_REVISION: &str = "ontology-research-v2"; @@ -1799,6 +1803,17 @@ pub fn evaluate_reviewed_golden_set( where F: FnOnce(&ReviewedGoldenSet) -> bool, { + let evaluation = prepare_reviewed_golden_set(report, golden)?; + if !verify_approval(golden) { + return Err(EvaluationError::UnverifiedApproval); + } + Ok(evaluation) +} + +fn prepare_reviewed_golden_set( + report: &ClassificationReport, + golden: &ReviewedGoldenSet, +) -> Result { if golden.approval.receipt_id.trim().is_empty() || golden.approval.reviewer_subject.trim().is_empty() || golden.labels.is_empty() @@ -1891,10 +1906,6 @@ where } } - if !verify_approval(golden) { - return Err(EvaluationError::UnverifiedApproval); - } - Ok(GoldenSetEvaluation { review_id: golden.approval.receipt_id.clone(), library_version: golden.approval.library_version, @@ -2112,6 +2123,18 @@ pub fn build_classification_write_plan( where F: FnOnce(&ReviewedClassificationWriteSet) -> bool, { + let plan = prepare_classification_write_plan(report, reviewed, mode)?; + if !verify_review(reviewed) { + return Err(WritePlanError::UnverifiedApproval); + } + Ok(plan) +} + +fn prepare_classification_write_plan( + report: &ClassificationReport, + reviewed: &ReviewedClassificationWriteSet, + mode: WriteMode, +) -> Result { if reviewed.review_id.trim().is_empty() || reviewed.authority_receipt.trim().is_empty() || reviewed.rule_revision.trim().is_empty() @@ -2225,9 +2248,6 @@ where }); } operations.sort_by(|left, right| left.item_key.cmp(&right.item_key)); - if !verify_review(reviewed) { - return Err(WritePlanError::UnverifiedApproval); - } Ok(ClassificationWritePlan { mode, review_id: reviewed.review_id.clone(), From 79e1c222267b6b93ce6506110e5e8ac704dc0a75 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 16:22:59 +0900 Subject: [PATCH 03/52] test: require bound full-text rollback and reconciliation --- .../src/full_text_write_tests.rs | 301 ++++++++++++++++++ 1 file changed, 301 insertions(+) diff --git a/crates/conceptweave-zotero/src/full_text_write_tests.rs b/crates/conceptweave-zotero/src/full_text_write_tests.rs index 5bc92ca5..bc7911f6 100644 --- a/crates/conceptweave-zotero/src/full_text_write_tests.rs +++ b/crates/conceptweave-zotero/src/full_text_write_tests.rs @@ -3,6 +3,307 @@ use crate::{ FullTextWriteScope, WriteMode, build_full_text_write_plan, execute_full_text_write_plan, }; use std::cell::Cell; +use std::cell::RefCell; + +struct WriteStore { + items: RefCell>, + library_version: Cell, + read_count: Cell, + write_count: Cell, +} + +impl WriteStore { + fn from_report(report: &ClassificationReport) -> Self { + Self { + items: RefCell::new( + report + .classified_items + .iter() + .map(|item| { + ( + item.item_key.clone(), + crate::ClassificationItemState { + server_id: report.server_id.clone().unwrap(), + library_version: report.library_version, + item_key: item.item_key.clone(), + item_version: item.item_version, + collection_keys: item.collection_keys.clone(), + tags: item.tags.clone(), + }, + ) + }) + .collect(), + ), + library_version: Cell::new(report.library_version), + read_count: Cell::new(0), + write_count: Cell::new(0), + } + } + + fn read_item(&self, item_key: &str) -> Result { + self.read_count.set(self.read_count.get() + 1); + let mut item = self.items.borrow().get(item_key).ok_or(())?.clone(); + item.library_version = self.library_version.get(); + Ok(item) + } + + fn write_item( + &self, + request: &crate::ClassificationWriteRequest, + ) -> Result { + assert_eq!(request.library_version, self.library_version.get()); + assert_eq!( + request.item_version, + self.items.borrow()[&request.item_key].item_version + ); + self.write_count.set(self.write_count.get() + 1); + self.library_version.set(self.library_version.get() + 1); + let state = crate::ClassificationItemState { + server_id: request.server_id.clone(), + library_version: self.library_version.get(), + item_key: request.item_key.clone(), + item_version: self.library_version.get(), + collection_keys: request.collection_keys.clone(), + tags: request.tags.clone(), + }; + self.items + .borrow_mut() + .insert(request.item_key.clone(), state.clone()); + Ok(state) + } +} + +#[test] +fn full_text_write_rejects_substituted_mode_destinations_and_labels_under_old_authority() { + let report = report_fixture(); + let capture = capture_with(&report, 4096, &mut |request_path, _| { + Ok(response_fixture(request_path)) + }) + .unwrap(); + let original = serde_json::to_value(write_scope_fixture(&report, &capture)).unwrap(); + for scenario in 0..3 { + let mut scope = write_scope_fixture(&report, &capture); + match scenario { + 0 => scope.mode = WriteMode::Execute, + 1 => { + scope.reviewed_writes.changes[0].after_collection_keys = + vec!["OTHER_COLLECTION".into()] + } + _ => { + let mut reviewed = serde_json::to_value(&scope.full_text_review).unwrap(); + reviewed["full_text_golden_set_v1"]["labels"][0]["expected_disposition"] = + serde_json::json!(crate::Disposition::SemanticConsumptionBridge); + scope.full_text_review = serde_json::from_value(reviewed).unwrap(); + scope.reviewed_writes.changes[0].reviewed_disposition = + crate::Disposition::SemanticConsumptionBridge; + } + } + assert!( + build_full_text_write_plan( + &report, + &capture, + scope, + |reviewed| serde_json::to_value(reviewed).unwrap() == original["full_text_review"], + |received| serde_json::to_value(received).unwrap() == original + ) + .is_err() + ); + } +} + +#[test] +fn full_text_write_and_rollback_preserve_binding_and_conditional_state() { + let report = report_fixture(); + let capture = capture_with(&report, 4096, &mut |request_path, _| { + Ok(response_fixture(request_path)) + }) + .unwrap(); + let mut scope = write_scope_fixture(&report, &capture); + scope.mode = WriteMode::Execute; + let plan = build_full_text_write_plan(&report, &capture, scope, |_| true, |_| true).unwrap(); + let expected_binding = serde_json::to_value(&plan).unwrap()["full_text_write_v1"].clone(); + let store = WriteStore::from_report(&report); + let receipt = execute_full_text_write_plan( + &plan, + |item_key| store.read_item(item_key), + |request| store.write_item(request), + ); + let result = serde_json::to_value(&receipt).unwrap(); + assert_eq!(result["full_text_write_v1"], expected_binding); + assert_eq!(result["write_result"]["outcome"], "applied"); + assert_eq!(store.read_count.get(), 2); + assert_eq!(store.write_count.get(), 2); + let rollback = crate::execute_full_text_rollback( + &receipt, + |item_key| store.read_item(item_key), + |request| store.write_item(request), + ) + .unwrap(); + let result = serde_json::to_value(&rollback).unwrap(); + assert_eq!(result["full_text_write_v1"], expected_binding); + assert_eq!(result["rollback_result"]["outcome"], "restored"); + assert!( + store + .items + .borrow() + .values() + .all(|item| item.collection_keys.is_empty()) + ); + assert_eq!(store.write_count.get(), 4); + assert!( + crate::retry_full_text_rollback( + &rollback, + |_| -> Result { panic!("nothing to retry") }, + |_| -> Result { panic!("nothing to retry") } + ) + .is_err() + ); + assert!( + crate::reconcile_full_text_rollback( + &rollback, + |_| -> Result { panic!("nothing to reconcile") } + ) + .is_err() + ); +} + +#[test] +fn full_text_write_stale_preflight_and_unknown_writes_never_grant_empty_restoration() { + for unknown_write in [false, true] { + let report = report_fixture(); + let capture = capture_with(&report, 4096, &mut |request_path, _| { + Ok(response_fixture(request_path)) + }) + .unwrap(); + let mut scope = write_scope_fixture(&report, &capture); + scope.mode = WriteMode::Execute; + let plan = + build_full_text_write_plan(&report, &capture, scope, |_| true, |_| true).unwrap(); + let store = WriteStore::from_report(&report); + if !unknown_write { + store.library_version.set(99); + } + let receipt = execute_full_text_write_plan( + &plan, + |item_key| { + if store.read_count.get() >= 2 { + return Err(()); + } + store.read_item(item_key) + }, + |_| -> Result { + assert!(unknown_write); + Err(()) + }, + ); + let result = serde_json::to_value(&receipt).unwrap(); + assert_eq!( + result["full_text_write_v1"], + serde_json::to_value(&plan).unwrap()["full_text_write_v1"] + ); + assert_eq!( + result["write_result"]["outcome"], + if unknown_write { + "partial_failure" + } else { + "preflight_failure" + } + ); + assert!( + crate::execute_full_text_rollback( + &receipt, + |_| -> Result { + panic!("no known restoration") + }, + |_| -> Result { + panic!("no known restoration") + } + ) + .is_err() + ); + } +} + +#[test] +fn full_text_write_bound_rollback_retry_and_delayed_reconciliation() { + for delayed_read in [false, true] { + let report = report_fixture(); + let capture = capture_with(&report, 4096, &mut |request_path, _| { + Ok(response_fixture(request_path)) + }) + .unwrap(); + let mut scope = write_scope_fixture(&report, &capture); + scope.mode = WriteMode::Execute; + let plan = + build_full_text_write_plan(&report, &capture, scope, |_| true, |_| true).unwrap(); + let store = WriteStore::from_report(&report); + let written = execute_full_text_write_plan( + &plan, + |item_key| store.read_item(item_key), + |request| store.write_item(request), + ); + store.read_count.set(0); + let partial = crate::execute_full_text_rollback( + &written, + |item_key| { + if delayed_read && store.read_count.get() >= 2 { + return Err(()); + } + store.read_item(item_key) + }, + |_| -> Result { Err(()) }, + ) + .unwrap(); + let retried = if delayed_read { + assert!( + crate::retry_full_text_rollback( + &partial, + |_| -> Result { + panic!("must reconcile first") + }, + |_| -> Result { + panic!("must reconcile first") + } + ) + .is_err() + ); + let reconciled = + crate::reconcile_full_text_rollback(&partial, |item_key| store.read_item(item_key)) + .unwrap(); + assert_eq!( + serde_json::to_value(&reconciled).unwrap()["reconciliation_result"]["state"], + "unchanged" + ); + crate::retry_full_text_reconciled_rollback( + &reconciled, + |item_key| store.read_item(item_key), + |request| store.write_item(request), + ) + .unwrap() + } else { + crate::retry_full_text_rollback( + &partial, + |item_key| store.read_item(item_key), + |request| store.write_item(request), + ) + .unwrap() + }; + let result = serde_json::to_value(retried).unwrap(); + assert_eq!( + result["full_text_write_v1"], + serde_json::to_value(&plan).unwrap()["full_text_write_v1"] + ); + assert_eq!(result["rollback_result"]["outcome"], "restored"); + assert_eq!( + result["rollback_result"]["restored_item_keys"] + .as_array() + .unwrap() + .len(), + 2 + ); + assert_eq!(store.write_count.get(), 4); + } +} fn write_scope_fixture( report: &ClassificationReport, From 425fb8c46661c3f90646bb562922428b046010a9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 16:24:10 +0900 Subject: [PATCH 04/52] feat: preserve full-text authority through conditional recovery --- .../src/full_text_write.rs | 111 +++++++++++++++++- crates/conceptweave-zotero/src/lib.rs | 4 + 2 files changed, 111 insertions(+), 4 deletions(-) diff --git a/crates/conceptweave-zotero/src/full_text_write.rs b/crates/conceptweave-zotero/src/full_text_write.rs index 1dcbe1b0..1ee2320c 100644 --- a/crates/conceptweave-zotero/src/full_text_write.rs +++ b/crates/conceptweave-zotero/src/full_text_write.rs @@ -38,10 +38,9 @@ struct FullTextWriteBinding { /// executable restoration. Retain the owner-only scope to verify receipt hashes. /// /// ```compile_fail -/// use conceptweave_zotero::{FullTextWritePlan, execute_classification_write_plan}; -/// fn detach(plan: &FullTextWritePlan) { -/// execute_classification_write_plan(&plan.write_plan, -/// |_| Ok::<_, ()>(unreachable!()), |_| Ok::<_, ()>(unreachable!())); +/// use conceptweave_zotero::{FullTextWritePlan, ClassificationWritePlan}; +/// fn detach(plan: &FullTextWritePlan) -> &ClassificationWritePlan { +/// &plan.write_plan /// } /// ``` #[derive(Serialize)] @@ -61,6 +60,23 @@ pub struct FullTextWriteReceipt { write_result: ClassificationWriteReceipt, } +/// One bound rollback attempt, including operations still awaiting resolution. +/// Keep earlier receipts: this outcome reports this attempt, not a new approval. +#[derive(Serialize)] +pub struct FullTextRollbackReceipt { + full_text_write_v1: FullTextWriteBinding, + rollback_result: crate::ClassificationRollbackReceipt, +} + +/// Read-only reconciliation retaining the same scope and untouched recovery work. +/// An indeterminate result cannot be retried until another observation resolves it. +#[derive(Serialize)] +pub struct FullTextRollbackReconciliationReceipt { + full_text_write_v1: FullTextWriteBinding, + reconciliation_result: crate::ClassificationRollbackReconciliationReceipt, + remaining_operations: Vec, +} + fn serialize_write_result( receipt: &ClassificationWriteReceipt, serializer: S, @@ -141,3 +157,90 @@ pub fn execute_full_text_write_plan( ), } } + +/// Restores verified writes without accepting detached or mixed inverse operations. +/// Unknown write state, dry-run and an empty inverse set fail before any I/O. +/// An unknown write requires separate write reconciliation, not an empty rollback. +pub fn execute_full_text_rollback( + receipt: &FullTextWriteReceipt, + preflight: impl FnMut(&str) -> Result, + write_item: impl FnMut(&ClassificationWriteRequest) -> Result, +) -> Result { + if receipt.full_text_write_v1.mode != WriteMode::Execute + || receipt.write_result.indeterminate_item_key.is_some() + || receipt.write_result.rollback_operations.is_empty() + { + return Err(INVALID_WRITE_SCOPE); + } + Ok(FullTextRollbackReceipt { + full_text_write_v1: receipt.full_text_write_v1.clone(), + rollback_result: crate::execute_classification_rollback( + &receipt.write_result.rollback_operations, + preflight, + write_item, + ), + }) +} + +/// Retries only the unchanged or unattempted work retained by one bound receipt. +/// An unresolved operation must be reconciled first; it cannot be silently dropped. +pub fn retry_full_text_rollback( + receipt: &FullTextRollbackReceipt, + preflight: impl FnMut(&str) -> Result, + write_item: impl FnMut(&ClassificationWriteRequest) -> Result, +) -> Result { + if receipt.rollback_result.indeterminate_operation.is_some() + || receipt.rollback_result.remaining_operations.is_empty() + { + return Err(INVALID_WRITE_SCOPE); + } + Ok(FullTextRollbackReceipt { + full_text_write_v1: receipt.full_text_write_v1.clone(), + rollback_result: crate::execute_classification_rollback( + &receipt.rollback_result.remaining_operations, + preflight, + write_item, + ), + }) +} + +/// Observes the unresolved operation in a bound rollback receipt, without writing. +/// The untouched tail stays attached so resolving one item cannot discard it. +pub fn reconcile_full_text_rollback( + receipt: &FullTextRollbackReceipt, + read_item: impl FnOnce(&str) -> Result, +) -> Result { + let operation = receipt + .rollback_result + .indeterminate_operation + .as_ref() + .ok_or(INVALID_WRITE_SCOPE)?; + Ok(FullTextRollbackReconciliationReceipt { + full_text_write_v1: receipt.full_text_write_v1.clone(), + reconciliation_result: crate::reconcile_classification_rollback(operation, read_item), + remaining_operations: receipt.rollback_result.remaining_operations.clone(), + }) +} + +/// Retries a resolved operation and its untouched tail through complete preflight. +/// Already restored work is not written again; unresolved work makes zero I/O. +pub fn retry_full_text_reconciled_rollback( + receipt: &FullTextRollbackReconciliationReceipt, + preflight: impl FnMut(&str) -> Result, + write_item: impl FnMut(&ClassificationWriteRequest) -> Result, +) -> Result { + if receipt.reconciliation_result.state == crate::ClassificationRollbackState::Indeterminate { + return Err(INVALID_WRITE_SCOPE); + } + let operations = receipt + .reconciliation_result + .retry_operation + .iter() + .cloned() + .chain(receipt.remaining_operations.iter().cloned()) + .collect::>(); + Ok(FullTextRollbackReceipt { + full_text_write_v1: receipt.full_text_write_v1.clone(), + rollback_result: crate::execute_classification_rollback(&operations, preflight, write_item), + }) +} diff --git a/crates/conceptweave-zotero/src/lib.rs b/crates/conceptweave-zotero/src/lib.rs index 30018b7e..f2142fba 100644 --- a/crates/conceptweave-zotero/src/lib.rs +++ b/crates/conceptweave-zotero/src/lib.rs @@ -20,6 +20,10 @@ pub use full_text_capture::{ FullTextReviewedGoldenSet, apply_full_text_review_view, build_bound_full_text_review_json, build_full_text_review_worksheet, evaluate_full_text_review, finalize_full_text_review, }; +pub use full_text_capture::{ + FullTextRollbackReceipt, FullTextRollbackReconciliationReceipt, execute_full_text_rollback, + reconcile_full_text_rollback, retry_full_text_reconciled_rollback, retry_full_text_rollback, +}; pub use full_text_capture::{ FullTextWritePlan, FullTextWriteReceipt, FullTextWriteScope, build_full_text_write_plan, execute_full_text_write_plan, From bdf55bfb95b3e688e9ec58eda2785d17ed853b4e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 16:31:53 +0900 Subject: [PATCH 05/52] test: cover unresolved full-text recovery and opaque admission --- .../src/full_text_write.rs | 12 ++ .../src/full_text_write_tests.rs | 145 +++++++++++++++++- 2 files changed, 156 insertions(+), 1 deletion(-) diff --git a/crates/conceptweave-zotero/src/full_text_write.rs b/crates/conceptweave-zotero/src/full_text_write.rs index 1ee2320c..828c16e6 100644 --- a/crates/conceptweave-zotero/src/full_text_write.rs +++ b/crates/conceptweave-zotero/src/full_text_write.rs @@ -38,6 +38,11 @@ struct FullTextWriteBinding { /// executable restoration. Retain the owner-only scope to verify receipt hashes. /// /// ```compile_fail +/// use conceptweave_zotero::FullTextWritePlan; +/// let forged = serde_json::from_str::("{}"); +/// ``` +/// +/// ```compile_fail /// use conceptweave_zotero::{FullTextWritePlan, ClassificationWritePlan}; /// fn detach(plan: &FullTextWritePlan) -> &ClassificationWritePlan { /// &plan.write_plan @@ -62,6 +67,13 @@ pub struct FullTextWriteReceipt { /// One bound rollback attempt, including operations still awaiting resolution. /// Keep earlier receipts: this outcome reports this attempt, not a new approval. +/// +/// ```compile_fail +/// use conceptweave_zotero::FullTextRollbackReceipt; +/// fn mix(left: &mut FullTextRollbackReceipt, right: &FullTextRollbackReceipt) { +/// left.rollback_result.remaining_operations = right.rollback_result.remaining_operations.clone(); +/// } +/// ``` #[derive(Serialize)] pub struct FullTextRollbackReceipt { full_text_write_v1: FullTextWriteBinding, diff --git a/crates/conceptweave-zotero/src/full_text_write_tests.rs b/crates/conceptweave-zotero/src/full_text_write_tests.rs index bc7911f6..c3abe48a 100644 --- a/crates/conceptweave-zotero/src/full_text_write_tests.rs +++ b/crates/conceptweave-zotero/src/full_text_write_tests.rs @@ -5,6 +5,141 @@ use crate::{ use std::cell::Cell; use std::cell::RefCell; +#[test] +fn full_text_write_reconciliation_distinguishes_restored_unknown_and_failed_reads() { + for observation in 0..3 { + let report = report_fixture(); + let capture = capture_with(&report, 4096, &mut |request_path, _| { + Ok(response_fixture(request_path)) + }) + .unwrap(); + let mut scope = write_scope_fixture(&report, &capture); + scope.mode = WriteMode::Execute; + let plan = + build_full_text_write_plan(&report, &capture, scope, |_| true, |_| true).unwrap(); + let store = WriteStore::from_report(&report); + let written = execute_full_text_write_plan( + &plan, + |item_key| store.read_item(item_key), + |request| store.write_item(request), + ); + store.read_count.set(0); + let partial = crate::execute_full_text_rollback( + &written, + |item_key| { + if store.read_count.get() >= 2 { + return Err(()); + } + store.read_item(item_key) + }, + |request| -> Result { + if observation == 0 { + store.write_item(request).unwrap(); + } + Err(()) + }, + ) + .unwrap(); + let reconciled = crate::reconcile_full_text_rollback(&partial, |item_key| { + if observation == 2 { + return Err(()); + } + let mut state = store.read_item(item_key)?; + if observation == 1 { + state.collection_keys = vec!["UNEXPECTED_CHANGE".into()]; + } + Ok(state) + }) + .unwrap(); + let result = serde_json::to_value(&reconciled).unwrap(); + assert_eq!( + result["full_text_write_v1"], + serde_json::to_value(&plan).unwrap()["full_text_write_v1"] + ); + assert_eq!(result["remaining_operations"].as_array().unwrap().len(), 1); + if observation == 0 { + assert_eq!(result["reconciliation_result"]["state"], "restored"); + let restored = crate::retry_full_text_reconciled_rollback( + &reconciled, + |item_key| store.read_item(item_key), + |request| store.write_item(request), + ) + .unwrap(); + let final_result = serde_json::to_value(restored).unwrap(); + assert_eq!(final_result["rollback_result"]["outcome"], "restored"); + assert_eq!( + final_result["rollback_result"]["restored_item_keys"] + .as_array() + .unwrap() + .len(), + 1 + ); + assert_eq!(store.write_count.get(), 4); + } else { + assert_eq!(result["reconciliation_result"]["state"], "indeterminate"); + assert!( + crate::retry_full_text_reconciled_rollback( + &reconciled, + |_| -> Result { + panic!("unresolved retry read") + }, + |_| -> Result { + panic!("unresolved retry write") + } + ) + .is_err() + ); + assert_eq!(store.write_count.get(), 2); + } + } +} + +#[test] +fn full_text_write_known_partial_failure_keeps_only_verified_inverse_work() { + let report = report_fixture(); + let capture = capture_with(&report, 4096, &mut |request_path, _| { + Ok(response_fixture(request_path)) + }) + .unwrap(); + let mut scope = write_scope_fixture(&report, &capture); + scope.mode = WriteMode::Execute; + let plan = build_full_text_write_plan(&report, &capture, scope, |_| true, |_| true).unwrap(); + let store = WriteStore::from_report(&report); + let receipt = execute_full_text_write_plan( + &plan, + |item_key| store.read_item(item_key), + |request| { + if store.write_count.get() == 1 { + return Err(()); + } + store.write_item(request) + }, + ); + let result = serde_json::to_value(&receipt).unwrap(); + assert_eq!(result["write_result"]["outcome"], "partial_failure"); + assert!(result["write_result"]["indeterminate_item_key"].is_null()); + assert_eq!( + result["write_result"]["rollback_operations"] + .as_array() + .unwrap() + .len(), + 1 + ); + let restored = crate::execute_full_text_rollback( + &receipt, + |item_key| store.read_item(item_key), + |request| store.write_item(request), + ) + .unwrap(); + let restored = serde_json::to_value(restored).unwrap(); + assert_eq!( + restored["full_text_write_v1"], + serde_json::to_value(&plan).unwrap()["full_text_write_v1"] + ); + assert_eq!(restored["rollback_result"]["outcome"], "restored"); + assert_eq!(store.write_count.get(), 2); +} + struct WriteStore { items: RefCell>, library_version: Cell, @@ -462,7 +597,15 @@ fn full_text_write_dry_run_preserves_binding_without_reads_or_writes() { |_| -> Result { panic!("dry-run write") }, ); let plan_json = serde_json::to_value(&plan).unwrap(); - let receipt_json = serde_json::to_value(receipt).unwrap(); + let receipt_json = serde_json::to_value(&receipt).unwrap(); + assert!( + crate::execute_full_text_rollback( + &receipt, + |_| -> Result { panic!("dry-run recovery read") }, + |_| -> Result { panic!("dry-run recovery write") } + ) + .is_err() + ); assert_eq!( receipt_json["full_text_write_v1"], plan_json["full_text_write_v1"] From 06b2771e9cd38200d18e9d9087ee5482a026d802 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 16:37:11 +0900 Subject: [PATCH 06/52] docs: record full-text write and recovery evidence and remaining gates --- AGENTS.md | 1 + ARCHITECTURE.md | 2 ++ CHANGELOG.md | 2 ++ CLAUDE.md | 2 ++ docs/PRD.md | 2 +- docs/TRD.md | 8 +++++++- docs/UML.md | 18 +++++++++++++++++- docs/adr/0007-reviewed-zotero-write-plan.md | 18 +++++++++++++++++- .../zotero_fulltext_contract_audit.md | 4 ++++ .../2026-09-06_full_text_write_admission.md | 14 ++++++++++++++ docs/product-technical-gap-baseline.md | 16 +++++++++++++++- 11 files changed, 82 insertions(+), 5 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 6bc51ac3..742a0be5 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -20,6 +20,7 @@ ConceptWeave owns automatic, evidence-bound **Semantic Model Engineering**. Do n - Full-text review views are read-only evidence; never strip their outer binding into a metadata-only patch and claim full-text decision or approval provenance. - Full-text decisions use the separate blank-start worksheet and atomic exact-view application; reverify the capture/report relation through finalization and whole-envelope governance. No reviewed-set downcast grants Zotero write authority. - Offline full-text commands reuse the private-file boundary and pass completed-view bytes unchanged into atomic validation. Finalized files await external approval verification; no CLI command issues approval or writes Zotero. +- Full-text writes require a complete typed review, explicit destinations and mode; finish both local validation paths before real authority verification. Keep scope bindings through opaque execution/recovery receipts. Unknown original writes cannot become empty successful rollbacks, and serialized audit files are not executable authority. - Published semantic truth is immutable; correction uses supersession/new release. - Public Rust APIs require beginner-readable documentation. - Owned production coverage target is 100% line/function/region/branch where tooling exposes it. diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 5f120796..11c33b39 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -38,6 +38,8 @@ The separate Full-Text Review Worksheet starts blank and retains one capture ide ## Aggregate boundaries +Full-Text Write Scope belongs to Research Intake and combines a complete capture-bound semantic review with independently authorized explicit metadata replacements and mode. Existing local validation is composed before either authority verifier. The admitted plan is opaque; bound execution and recovery wrappers reuse the existing conditional Local API cores, with no legacy-plan or free inverse-operation projection. Versioned scope commitments preserve the complete input identity without copying source text into receipts. The scope is not published semantic truth or an approval issuer. Audit serialization cannot restore executable authority; durable recovery and independently unknown original-write reconciliation remain explicit gaps. + ### SemanticCandidate Smallest consistency boundary for a single proposed semantic artifact and its evidence-bound publication state. It cannot jump directly from Draft to Published. diff --git a/CHANGELOG.md b/CHANGELOG.md index f3abf4cf..40ba2a95 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,8 @@ All notable changes to ConceptWeave are documented here. ### Added +- Full-text-reviewed changes can now carry separately verified destination and execution approval through the local write and recovery workflow. Unknown writes remain unresolved until their state is proven; no command issues approval or changes the live library. + - Private review commands now show saved text, accept completed decisions without replacing earlier work, and prepare a complete review for independent approval verification. They do not supply decisions or approve a review. - Private inspection of pending papers alongside their saved text, preserving missing material and leaving previous reports and decisions unchanged. diff --git a/CLAUDE.md b/CLAUDE.md index 3259b7f3..17f9330b 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -11,3 +11,5 @@ Zotero source capture must not alter the metadata report or renew its approval. The separate full-text review view does not authorize decisions or writes. Keep its evidence binding intact; existing metadata-only apply/finalization cannot establish full-text-reviewed approval. Use the capture-bound blank-start worksheet for full-text decision work. Only the dedicated atomic view path may apply completed slots; finalization/evaluation reverify capture/report bindings and require whole-envelope external approval. Offline CLI view/application/finalization preserve that envelope and earlier files. They do not supply a reviewer, authenticate approval, or admit Zotero writes. + +The separate typed full-text write boundary additionally requires explicit destinations and mode verified against independent write authority, after all local checks. Keep the complete approved scope on the opaque plan and the same versioned commitment on every execution and recovery outcome. Do not extract legacy plans or mix inverse operations, restore authority from audit JSON, or call an unknown original write restored through empty rollback. No live-write CLI or approval issuer is introduced. diff --git a/docs/PRD.md b/docs/PRD.md index 321cc59a..0891c6a4 100644 --- a/docs/PRD.md +++ b/docs/PRD.md @@ -68,7 +68,7 @@ For every connected duplicate component, accept externally verified steward deci Reviewed collection and tag changes default to a local dry-run plan. Each operation binds the authority receipt, server/library/item revisions, raw-snapshot digest, and complete before/after/rollback metadata. Execution-critical plan state is immutable outside the owner crate, so callers cannot turn a dry run into execution or alter validated operations. Zotero 9 execute requests fail closed. No plan contains credentials or permits `NeedsStewardReview`, source-record deletion, or attachment deletion. -An invalid or stale change request must be rejected before approval is redeemed, including when an earlier item in the same request is valid. A locally valid request reaches approval verification exactly once. For future writes based on full-text review, approval must cover the captured evidence, every reviewed label, the explicitly chosen collections and tags, and whether execution was requested. Reviewing meaning does not choose a destination or grant permission to change it. The same approval and evidence identity must remain attached to partial outcomes and recovery. Full-text-aware write admission remains a gap, distinct from the implemented metadata-planning safeguards. +An invalid or stale change request must be rejected before approval is redeemed, including when an earlier item in the same request is valid. A locally valid request reaches approval verification exactly once. For writes based on full-text review, approval must cover the captured evidence, every reviewed label, the explicitly chosen collections and tags, and whether execution was requested. Reviewing meaning does not choose a destination or grant permission to change it. The same approval and evidence identity must remain attached to partial outcomes and recovery. The local library now admits a complete full-text review only with separately verified explicit changes and execution mode. It preserves that binding through writes, rollback, retries and delayed rollback reconciliation. An unknown original write cannot be called restored without evidence. Independent governance integration, durable recovery after process restart, delayed original-write reconciliation and approved live use remain gaps. For execute-mode plans, the runtime must preflight every item before the first write, stop at the first failed or unverifiable response, reconcile that item through the same server before declaring its state, and emit a secret-free receipt bound to the exact reviewed plan coordinates. Dry-run receipts enumerate every planned item as untouched. Execution receipts identify verified writes, the failed item, any indeterminate item, untouched items, and reverse-ordered rollback operations bound to the server identity, proven post-write item revision, and complete expected post-write metadata, including an identity- and version-confirmed unexpected mutation. Rollback must reject mixed-server evidence before reading, preflight every receipt item at one current library version before its first inverse write, consume the existing receipt order, advance the library precondition only from a verified response, and reconcile a failed response as restored, unchanged, or indeterminate. Only proven unchanged and untouched operations remain eligible for automatic retry; an indeterminate operation is retained separately with complete reconciliation evidence for an operator. Delayed reconciliation performs one read and no write, preserves the observed state, ignores unrelated library-version advancement, and emits retry evidence only when the exact item revision and expected metadata remain unchanged. A second use of consumed evidence must fail before writing. Cross-item atomicity is not claimed. diff --git a/docs/TRD.md b/docs/TRD.md index 8c832b71..45b50f78 100644 --- a/docs/TRD.md +++ b/docs/TRD.md @@ -96,7 +96,13 @@ Private JSON syntax/type failures return one static invalid-input error rather t There is no CLI approval issuer or evaluator. Finalization accepts an independently supplied approval input but cannot authenticate it. Whole-envelope external verification remains a library boundary, not deployed governance. Write planning still has its separate `ReviewedClassificationWriteSet` and approval verifier; there is no conversion or authority transfer from a full-text evaluation to a Zotero write plan. The shared planner now finishes all existing local identity, mode, membership, revision and metadata checks before invoking its caller-owned verifier exactly once on valid input. Invalid input makes zero verifier calls, preserving a potentially one-use approval; local validation errors intentionally precede approval denial. -Future full-text write admission must require the complete reviewed golden set, an explicit independently approved write set and the requested mode. Changed dispositions must equal the corresponding golden labels; destinations are supplied and authorized, never inferred from those labels. Both local validation paths must finish before either real verifier. Reuse the current evaluator and planner without a permissive verification bridge. An opaque plan and every execution, rollback, retry and reconciliation outcome must retain the same versioned capture/proposal/label/authority/write-scope binding, with no executable legacy-plan downcast. Legacy nested write DTOs are permissive JSON; the first increment must remain typed-only unless an explicit compatibility change supplies recursive strict admission. This full-text-aware write contract remains unimplemented; [Proposed ADR 0007](adr/0007-reviewed-zotero-write-plan.md) records its acceptance cases and limits. +Typed full-text write admission requires `FullTextWriteScope`: the complete reviewed golden set, an explicit independently approved write set and requested mode. Changed dispositions must equal the corresponding golden labels; destinations are supplied and authorized, never inferred. Private preparation functions reuse the existing evaluator and planner validation bodies without a permissive verification callback. Both preparation paths and cross-label validation finish before either real verifier. Semantic denial prevents write verification; valid accepted scope reaches each once. The legacy public evaluator and planner retain their existing contracts. + +`FullTextWritePlan` retains the complete approved typed scope and a `full_text_write_v1` commitment. Its scope digest hashes the compact serde JSON tuple of the domain string `conceptweave-full-text-write-v1` and complete scope. This is an exact typed-representation identity, not RFC 8785 canonical JSON: reordering input arrays requires fresh authorization even if normalized operations would agree. Receipts retain this digest, capture/proposal/snapshot coordinates and mode. They omit original review/authority inputs and source text; transport errors remain reduced to the existing closed outcomes. The private inner legacy plan and rollback operations are not public executable projections. + +`execute_full_text_write_plan` reuses complete preflight and conditional replacement. `execute_full_text_rollback` accepts only one bound write receipt, rejects dry-run, unknown write state and empty inverse work before I/O, and preserves the binding. Rollback retry accepts only the original receipt's known pending work. An indeterminate rollback must first pass read-only reconciliation; its untouched tail stays attached and is retried only after an unchanged/restored observation, with fresh complete preflight. Each receipt describes its own attempt; retain earlier receipts for the full history. No operation-slice argument lets callers combine receipt scopes. + +These types are serialize-only and owner-only audit artifacts. They cannot restore executable authority after a restart. Legacy nested write DTOs remain permissive JSON; no strict persisted JSON admission is claimed. There is no new transport, CLI write/approval issuer or cross-service SQL. Whole-scope external authority verification, revocation policy, durable recovery admission, delayed reconciliation of an unknown original write and approved live execution remain incomplete. [Proposed ADR 0007](adr/0007-reviewed-zotero-write-plan.md) records the trade-offs. `conceptweave-zotero` reads only the loopback Local API with at most 100 records per page, an 8 MiB page-body limit, a 50,000-item whole-snapshot limit, a 256 MiB cumulative body limit, redirects disabled, and finite connect/response/body/global timeouts. Every request pins `Zotero-API-Version: 3`; every response must report API version 3, while its schema version is recorded and must remain stable across the snapshot. Before another request is issued, exhausted whole-snapshot budgets fail closed. Before a parsed page is accumulated, checked item-count and byte arithmetic must remain within both the advertised total and the configured whole-snapshot budgets. `Total-Results`, `Last-Modified-Version`, Zotero version, and server identity must remain identical across all pages; contract drift, malformed JSON, an empty intermediate page, duplicate keys, or an oversized response fails the run. diff --git a/docs/UML.md b/docs/UML.md index 58954917..37163488 100644 --- a/docs/UML.md +++ b/docs/UML.md @@ -93,7 +93,23 @@ sequenceDiagram Intake->>Governance: entire capture-bound reviewed set after local validation Governance-->>Intake: authenticated receipt decision or rejection Intake-->>Steward: capture-bound aggregate result or failure - Note over Intake,Governance: no transfer to the independent Zotero write authority + Note over Intake,Governance: meaning review alone never grants destination authority + opt separate full-text metadata change requested + Steward->>Intake: full review, explicit replacements and requested mode + Intake->>Intake: validate capture/report/labels and every write precondition + alt invalid local scope + Intake-->>Steward: reject before either approval verifier + else valid local scope + Intake->>Governance: verify entire full-text review exactly once + opt meaning authority accepted + Intake->>Governance: verify complete write scope including mode + opt destination authority accepted + Intake->>Report: opaque plan and versioned scope commitment + Note over Intake,Report: execution, rollback, retry and delayed rollback reconciliation retain this commitment + end + end + end + end end Report->>Steward: review dispositions and merge candidates Steward->>Intake: save partially completed worksheet diff --git a/docs/adr/0007-reviewed-zotero-write-plan.md b/docs/adr/0007-reviewed-zotero-write-plan.md index 8f7032c0..086832d3 100644 --- a/docs/adr/0007-reviewed-zotero-write-plan.md +++ b/docs/adr/0007-reviewed-zotero-write-plan.md @@ -26,7 +26,7 @@ The exact repaired #13 head passed 72 tests across 18 unfiltered suites, includi Rejected alternatives were per-caller guards, which duplicate validation and miss sibling callers, and accepting invalid input before approval as harmless, which ignores caller-owned receipt consumption. The remaining limit is explicit: this planner validates its existing metadata-write contract, not the complete full-text review envelope, authority revocation, or live execution. -## Required full-text write admission (not implemented) +## Full-text write admission contract A full-text-reviewed golden set and its aggregate evaluation are not authority to replace Zotero collections or tags. The next increment must combine the complete capture-bound golden set, a separately approved explicit write set, and the requested mode in a required, non-flattened input. Every changed item's disposition must match its approved golden label. All local capture/report/proposal/full-denominator and write-state checks must finish before either external authority verifier runs. Reuse the existing full-text evaluator and repaired planner; do not insert a permissive verifier bridge, derive destinations from disposition names, backfill receipts or convert aggregate evaluation into approval. @@ -34,6 +34,22 @@ The returned opaque, serialize-only plan must retain a versioned binding for the The failure analysis must cover relabeling, destination/mode substitution under old authority, denial by either verifier, missing full-denominator labels, stale preflight, mixed receipts and indeterminate outcomes. Dry-run must make no reads or writes. Paper text and authority secrets must stay out of errors and receipts. This is a bounded extension of ConceptWeave's existing intake context, not a new Utility Repository, transport, approval issuer or live-write CLI. Published owner contracts, authentic decisions, independently verified authority and approved live write/rollback evidence remain separate prerequisites. +## Local typed implementation (2026-09-06; still Proposed) + +In the context of applying complete full-text-reviewed research classifications, facing loss of capture provenance and destination authority at the legacy planner boundary, we decided for private validation preparation followed by two real whole-scope verifiers and opaque bound recovery, and against allow-all verifier bridges, metadata downcasts and a second executor, to achieve exact approved-input continuity across local write attempts, accepting typed-only admission and unresolved durable-recovery and original-write-reconciliation gaps. + +The owning Research Intake library now requires `FullTextWriteScope`. It includes every full-text golden label, capture-bound approval input, complete reviewed metadata changes and mode. The existing golden and write validators were moved into private preparation functions; their public legacy entry points still invoke their original verifiers after local validation. New admission runs both preparation paths and checks each changed disposition against its golden label before invoking either callback. An invalid later write cannot redeem a valid earlier approval. A meaning denial stops before write verification; an accepted meaning review does not itself authorize a destination. The two external verifiers are not a distributed atomic redemption protocol: a locally valid request may consume meaning verification before the independent write verifier denies it. Revocation, expiration and issuer policy belong to external governance. + +The admitted plan retains the complete typed scope. The versioned binding hashes the compact serde JSON tuple `("conceptweave-full-text-write-v1", scope)` with SHA-256 and separately retains capture/proposal/snapshot coordinates and mode. Exact array order and receipt inputs are part of this identity; this is not a cross-language canonical-JSON claim. Every bound outcome carries the same commitment. Write receipt serialization omits the legacy review ID and authority input rather than exposing them; original owner-only scope must be retained to verify the commitment. The plan has no public legacy-plan projection; recovery accepts an opaque receipt, never caller-assembled operation slices. + +Execution delegates to the existing complete-preflight and conditional replacement core. Known applied work can be rolled back from its one bound receipt. Unknown original-write state, dry-run or empty inverse work is rejected before reads or writes, avoiding a false restored outcome. A rollback failure retains known pending work; its retry refuses to ignore an indeterminate operation. Delayed rollback reconciliation observes that operation once and keeps the untouched tail. An unchanged observation retries that operation plus the tail; a restored observation skips its already restored operation; an indeterminate observation cannot write. Subsequent attempts still run complete preflight. Each receipt is per-attempt evidence and earlier receipts remain necessary for the full history. + +The first committed RED `47d4e89` names the absent admission APIs; local GREEN `d36dad8` passed seven invalid-input scenarios and all eight mode/authority combinations across three test functions. Recovery RED `79e1c22` names the missing bound recovery APIs; initial local GREEN `425fb8c` passed seven combined admission/recovery test functions. Final full-suite and coverage measurements belong in the current Gap checkpoint, not this intermediate evidence. All inputs are synthetic unit fixtures; no actual review, authority issuance, capture read, authorization prompt or Zotero mutation occurred. + +Positive consequences are one validation source per contract, explicit destination authorization and retained recovery scope. Costs are retained full-scope audit storage, per-attempt receipt history and exact-representation digest ordering. Rejected alternatives include copying the validation or transport loops, which would drift, and deserializing the new scope around permissive legacy nested DTOs, which would silently ignore input. Executable persistence after restart, delayed reconciliation of an unknown original write, independent deployed issuers and approved live write/rollback remain unfinished. Local success does not make this ADR Accepted. + +Implementation references: Serde Project. (n.d.). *Field attributes*. Retrieved September 6, 2026, from https://serde.rs/field-attrs.html; Serde Project. (n.d.). *Implementing Serialize*. Retrieved September 6, 2026, from https://serde.rs/impl-serialize.html. Existing dependency APIs only; Context7 returned its monthly quota limit, so these official references were checked directly. DeepWiki has no indexed ConceptWeave repository. The owner source and tests are the implementation evidence. + ## Consequences - Review and rollback semantics can be tested on Zotero 9 without changing the library. diff --git a/docs/doctoring/zotero_fulltext_contract_audit.md b/docs/doctoring/zotero_fulltext_contract_audit.md index d45d9c6b..d9c97cd7 100644 --- a/docs/doctoring/zotero_fulltext_contract_audit.md +++ b/docs/doctoring/zotero_fulltext_contract_audit.md @@ -138,6 +138,10 @@ Bray, T. (Ed.). (2017). *The JavaScript Object Notation (JSON) data interchange Serde contributors. (n.d.). *Container attributes*. Serde. Retrieved September 5, 2026, from https://serde.rs/container-attrs.html +Serde contributors. (n.d.). *Field attributes*. Serde. Retrieved September 6, 2026, from https://serde.rs/field-attrs.html + +Serde contributors. (n.d.). *Implementing Serialize*. Serde. Retrieved September 6, 2026, from https://serde.rs/impl-serialize.html + Zotero. (2026a, July 29). *Zotero local API*. https://www.zotero.org/support/dev/web_api/v3/local_api Zotero. (2026b, July 29). *Zotero Web API full-text content requests*. https://www.zotero.org/support/dev/web_api/v3/fulltext_content diff --git a/docs/plans/2026-09-06_full_text_write_admission.md b/docs/plans/2026-09-06_full_text_write_admission.md index 2e45dc4e..0cc0ea09 100644 --- a/docs/plans/2026-09-06_full_text_write_admission.md +++ b/docs/plans/2026-09-06_full_text_write_admission.md @@ -20,6 +20,14 @@ Run from `/Users/seonghobae/Documents/ChatGPT/ConceptWeave`: Baseline expectation: existing 240 tests pass. New admission capability is absent. Actual paper decisions and independently verified approvals remain each 0/3,715. Test doubles are synthetic unit-only inputs, never research labels or approvals. +Extract the unfiltered result count without accidentally matching nested `90 filtered out` summaries: + +```sh +awk '/^test result: ok\./ && /; 0 filtered out;/ {total += $4; suites += 1} END {print "passed=" total, "unfiltered_suites=" suites}' /tmp/conceptweave-fulltext-write-final-tests-20260906.log +``` + +Final verified result: `passed=252 unfiltered_suites=41`, including six doctests. Focused filtered results are not a substitute for this full count. + ## Task 1 — Preserve a failing contract Add `/Users/seonghobae/Documents/ChatGPT/ConceptWeave/crates/conceptweave-zotero/src/full_text_write_tests.rs`, reusing the adjacent private capture and completed-view fixture functions. Register it in `full_text_capture_tests.rs`. @@ -43,3 +51,9 @@ Keep plans and recovery evidence opaque and serialize-only. Receipts retain the Run the focused test, full workspace, strict all-target Clippy, formatting, warnings-denied rustdoc, existing CI contract check and existing coverage gate. Do not change thresholds, coverage exclusions, locked versions or fixtures to obtain GREEN. Record exact commands, counts and raw versus normalized coverage separately in the Gap baseline and ignored `results.tsv`. Update PRD/TRD/Proposed ADR 0007/architecture guidance/UML/CHANGELOG to state implemented behavior and remaining gates. Create a Draft successor against #38, reread its exact head/base/body, inspect current reviews/checks, and retain all protected gates. Update the existing hourly task with exact evidence and next work; do not treat local GREEN as approval or protected publication. + +## Tooling and experiment evidence + +CodeGraph was healthy and synchronized before exploration and after edits; its large-file queries trimmed the desired planner bodies, so their specific missing ranges were read directly. No code-review-graph MCP tool or executable is available in this environment; do not claim its indexing. DeepWiki returned repository-not-found for structure/content/question requests. Context7 returned its monthly quota limit; no alternate credentials or paid route were used. Existing serde APIs were checked against the official field-attribute and Serialize documentation, with APA entries in the full-text contract audit. The ADR skill's referenced identity instructions are absent, so the existing Proposed ADR was extended with a Y-Statement and no allocator, Accepted transition or new ADR number. + +Admission RED `47d4e89` and recovery RED `79e1c22` preserve absent-API failures. Initial admission GREEN `d36dad8` passed 3 focused tests; recovery GREEN `425fb8c` passed 7. The first full coverage run found two missing branch outcomes (dry-run recovery refusal and indeterminate reconciliation retry refusal), despite passing workspace/static checks. Added cases in `bdf55bf` also cover already restored delayed observations, failed reads, known partial writes and compile-time opaque/persistence boundaries. Nine focused tests pass at this candidate; final unfiltered measurements are recorded in the Gap baseline after fresh full verification. No coverage threshold, exclusion or dependency changed. diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 896c25be..604d6cc0 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,21 @@ This file records code-current product and technical gaps. Exact PR/check/run coordinates are evidence snapshots, not mutable-head dependencies. Live protected-branch, PR, issue and workflow state wins whenever it advances after this snapshot. Refresh the changed PR's metadata after each documentation commit; evidence from another PR or an earlier head does not transfer. -## Latest local repair checkpoint +## Latest full-text write checkpoint + +Runtime `bdf55bfb95b3e688e9ec58eda2785d17ed853b4e` on `codex/zotero-fulltext-write-admission` adds complete typed full-text/write-scope admission, opaque execution and bound conditional recovery after #38's `8e057652ee7784b373beeeec865d80dd3db773be`. It does not extract a metadata-only review or legacy executable plan. Existing golden/write validation bodies are reused privately before either actual verifier; explicit destination/mode verification is separate from semantic approval. A later invalid item or changed capture/proposal/label makes zero authority calls. A locally valid accepted request reaches both exactly once, and semantic denial prevents write verification. + +Fresh locked Rust 1.98.0 baseline was 240 tests / 41 unfiltered suites. The final source passed **252 tests / 41 unfiltered suites**, including six doctests. Nine new unit tests cover the admission/recovery matrix; three additional compile-fail examples reject plan restoration, legacy-plan projection and mixed inverse work. Strict all-target Clippy, formatting, warnings-denied rustdoc, CI contract, release build and diff checks passed. Count only summary lines containing the exact `; 0 filtered out;` suffix: an unanchored `0 filtered out` search also matches nested `90 filtered out` and incorrectly reports 253/42. + +The unchanged coverage gate passes **402/402 functions, 4,448/4,448 source-normalized regions and 750/750 normalized branch outcomes**. Its initial run at `425fb8c` missed two branch outcomes (dry-run rollback rejection and indeterminate reconciliation retry rejection). Tests added at `bdf55bf` cover both, plus restored/failed delayed reads and known partial writes. Raw LLVM remains **4,924/5,023 lines, 7,113/7,298 regions and 693/750 branches**; no raw-100% claim, threshold change, exclusion or dependency change is made. + +Preserved RED/GREEN sequence: admission `47d4e890e3bf29a3f7596d7a9a0a25f780b59e8f` → `d36dad824f6d78c76cf3b5a009dee15f09e6b02f`; bound recovery `79e1c222267b6b93ce6506110e5e8ac704dc0a75` → `425fb8c46661c3f90646bb562922428b046010a9`; final coverage cases `bdf55bfb95b3e688e9ec58eda2785d17ed853b4e`. The [implementation plan](plans/2026-09-06_full_text_write_admission.md), [TRD](TRD.md) and still-Proposed [ADR 0007](adr/0007-reviewed-zotero-write-plan.md) describe the exact scope commitment and per-attempt history. Write receipts omit authority inputs and text. Unknown original writes fail closed instead of granting empty restoration; delayed rollback reconciliation retains untouched work. + +This is local source evidence only. The parent was last reread OPEN Draft with the exact head above and base `692cb588b26a9cc878fbaa2b47aa30fd83ea47de` before GitHub REST exhausted the shared core bucket. Ordinary PR #38 requests at 07:34:08 and 07:35:01 UTC returned 403; the latter reports remaining 0/5,000 and reset **2026-09-06 07:38:47 UTC**. A contradictory `/rate_limit` summary reporting unused quota did not override the actual rejected request. No alternate credentials/API route, readiness transition, protected merge or closure was used. Recheck normal PR state after reset before creating/updating the successor or claiming hosted evidence. + +Actual decisions and independently verified approvals remain each **0/3,715**, source audits **27/76**, release-bearing candidates **7/27**, adoption unproven. No actual capture was opened, paper classified, approval issued, model called or Zotero record changed in this increment. Remaining acceptance: released owner contracts, independent issuer/revocation policy, durable restart/recovery admission, delayed unknown-original-write reconciliation, approved live write/rollback, required checks and protected merge. #6 and central repairs remain separate owner lanes; their newer task reports are not this child's runtime evidence. + +## Previous approval-order repair checkpoint Runtime `61bb211f798e9b91e921e65bc12d988e4b080dee` integrates the earliest-owner approval-order repair through the full dependent stack. Original planner `53b1d4dd046727d345fa2032d9426b2ba697b9df` in #13 could invoke an external approval verifier before rejecting locally invalid item, metadata or execute input. A one-use approval could therefore be consumed without a plan. Committed RED `505e111c993d8269e5b7b9e17a25a5ce20f8606e` demonstrated four failing negative test groups and a passing valid control. Minimal repair `8a684882005085d8b3cb47812e185975084e0475` moves the unchanged verifier block after all existing local checks. [Proposed ADR 0007](adr/0007-reviewed-zotero-write-plan.md) records 22 invalid-input scenarios with zero verifier calls, four valid controls with exactly one call, the intentional local-error precedence, alternatives and remaining authority limits. From f4866e9b321f4119292b3d009815fafdc5067d05 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 16:42:47 +0900 Subject: [PATCH 07/52] docs: record normal successor publication after API reset --- docs/adr/0007-reviewed-zotero-write-plan.md | 4 ++-- docs/product-technical-gap-baseline.md | 2 ++ 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/adr/0007-reviewed-zotero-write-plan.md b/docs/adr/0007-reviewed-zotero-write-plan.md index 086832d3..97934272 100644 --- a/docs/adr/0007-reviewed-zotero-write-plan.md +++ b/docs/adr/0007-reviewed-zotero-write-plan.md @@ -6,7 +6,7 @@ ## Context -Issue #8 requires classification changes to default to dry-run, preserve complete collection and tag state, reject stale review input, and make rollback reconstructable. The installed Zotero 9.0.6 Local API cannot write. Zotero 10+ writes additionally require a runtime-granted key, the same server identity, and fresh library/item versions. A planner can establish the review and recovery contract now without inventing authority or adding an unsafe Zotero 9 mutation path. +Issue #8 requires classification changes to default to dry-run, preserve complete collection and tag state, reject stale review input, and make rollback reconstructable. At initial planning the installed Zotero 9.0.6 Local API could not write; the later Zotero 10.0.1 audit is recorded separately in the current Gap baseline. Zotero 10+ writes additionally require a runtime-granted key, the same server identity, and fresh library/item versions. A planner establishes the review and recovery contract without inventing authority or adding an unsafe Zotero 9 mutation path. ## Decision @@ -28,7 +28,7 @@ Rejected alternatives were per-caller guards, which duplicate validation and mis ## Full-text write admission contract -A full-text-reviewed golden set and its aggregate evaluation are not authority to replace Zotero collections or tags. The next increment must combine the complete capture-bound golden set, a separately approved explicit write set, and the requested mode in a required, non-flattened input. Every changed item's disposition must match its approved golden label. All local capture/report/proposal/full-denominator and write-state checks must finish before either external authority verifier runs. Reuse the existing full-text evaluator and repaired planner; do not insert a permissive verifier bridge, derive destinations from disposition names, backfill receipts or convert aggregate evaluation into approval. +A full-text-reviewed golden set and its aggregate evaluation are not authority to replace Zotero collections or tags. Admission must combine the complete capture-bound golden set, a separately approved explicit write set, and the requested mode in a required, non-flattened input. Every changed item's disposition must match its approved golden label. All local capture/report/proposal/full-denominator and write-state checks must finish before either external authority verifier runs. Reuse the existing full-text evaluator and repaired planner; do not insert a permissive verifier bridge, derive destinations from disposition names, backfill receipts or convert aggregate evaluation into approval. The returned opaque, serialize-only plan must retain a versioned binding for the complete labels, capture/proposal coordinates, approvals, destinations and mode. Write execution, partial failure, rollback, retry and delayed reconciliation must preserve that same binding. No executable legacy-plan downcast or freely mixed rollback operations may detach it. Existing legacy write DTOs accept unknown nested JSON fields, so strict outer deserialization alone is insufficient. Begin with typed-only admission, or separately document and test an intentional owned-DTO compatibility change before claiming strict persisted JSON admission. diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 604d6cc0..7c4b7c8a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -16,6 +16,8 @@ Preserved RED/GREEN sequence: admission `47d4e890e3bf29a3f7596d7a9a0a25f780b59e8 This is local source evidence only. The parent was last reread OPEN Draft with the exact head above and base `692cb588b26a9cc878fbaa2b47aa30fd83ea47de` before GitHub REST exhausted the shared core bucket. Ordinary PR #38 requests at 07:34:08 and 07:35:01 UTC returned 403; the latter reports remaining 0/5,000 and reset **2026-09-06 07:38:47 UTC**. A contradictory `/rate_limit` summary reporting unused quota did not override the actual rejected request. No alternate credentials/API route, readiness transition, protected merge or closure was used. Recheck normal PR state after reset before creating/updating the successor or claiming hosted evidence. +After the advertised reset, ordinary API reads succeeded at 07:39 UTC. Parent #38 and active ruleset 18156473 still matched; no existing PR used this new branch. A normal push created [Draft PR #39](https://github.com/ContextualWisdomLab/ConceptWeave/pull/39), initial documentation head `06b2771e9cd38200d18e9d9087ee5482a026d802`, exact base `8e057652ee7784b373beeeec865d80dd3db773be`. Its complete body matched the submitted file including its final newline. Readback at 07:40 UTC found zero reviews, zero unresolved threads with complete pagination, zero exact-head Actions runs and only CodeRabbit's “Review skipped: draft pull request” success. This is not hosted Product GREEN or independent approval. Documentation-only follow-up commits leave tested runtime `bdf55bf` unchanged; reread the final PR head before any lifecycle claim. + Actual decisions and independently verified approvals remain each **0/3,715**, source audits **27/76**, release-bearing candidates **7/27**, adoption unproven. No actual capture was opened, paper classified, approval issued, model called or Zotero record changed in this increment. Remaining acceptance: released owner contracts, independent issuer/revocation policy, durable restart/recovery admission, delayed unknown-original-write reconciliation, approved live write/rollback, required checks and protected merge. #6 and central repairs remain separate owner lanes; their newer task reports are not this child's runtime evidence. ## Previous approval-order repair checkpoint From 6cefb4f15e7072448e32414418f5d99460d72075 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 16:46:02 +0900 Subject: [PATCH 08/52] docs: reconcile capability baseline and canonical owner issue kinds --- docs/product-technical-gap-baseline.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 7c4b7c8a..10ae6caa 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -20,6 +20,8 @@ After the advertised reset, ordinary API reads succeeded at 07:39 UTC. Parent #3 Actual decisions and independently verified approvals remain each **0/3,715**, source audits **27/76**, release-bearing candidates **7/27**, adoption unproven. No actual capture was opened, paper classified, approval issued, model called or Zotero record changed in this increment. Remaining acceptance: released owner contracts, independent issuer/revocation policy, durable restart/recovery admission, delayed unknown-original-write reconciliation, approved live write/rollback, required checks and protected merge. #6 and central repairs remain separate owner lanes; their newer task reports are not this child's runtime evidence. +The final owner metadata refresh distinguishes issue kinds: `.github` **Issue #1929** is OPEN and concerns OpenCode dispatcher identity admission (it is not a CodeQL PR); CO **Issue #1045** is OPEN and its **PR #1049** is OPEN, non-Draft at `87612a68b3af1f305bb7b09bd0be860bad1b7fd6`, not merged or released. Source Observation #6 is OPEN Draft at `e3c415600300b6c2d5b852c457ea6ab2e5222e08`. These are metadata observations only, not tests or source audits performed in this increment. Continue the existing owner lanes without duplicate implementation. + ## Previous approval-order repair checkpoint Runtime `61bb211f798e9b91e921e65bc12d988e4b080dee` integrates the earliest-owner approval-order repair through the full dependent stack. Original planner `53b1d4dd046727d345fa2032d9426b2ba697b9df` in #13 could invoke an external approval verifier before rejecting locally invalid item, metadata or execute input. A one-use approval could therefore be consumed without a plan. Committed RED `505e111c993d8269e5b7b9e17a25a5ce20f8606e` demonstrated four failing negative test groups and a passing valid control. Minimal repair `8a684882005085d8b3cb47812e185975084e0475` moves the unchanged verifier block after all existing local checks. [Proposed ADR 0007](adr/0007-reviewed-zotero-write-plan.md) records 22 invalid-input scenarios with zero verifier calls, four valid controls with exactly one call, the intentional local-error precedence, alternatives and remaining authority limits. @@ -63,7 +65,7 @@ Protected ConceptWeave main remains bootstrap `f4f440dd58c77d7cd90dff8a1eb2eeb9a No real private campaign artifact, Zotero endpoint or model was read/called during this repair continuation. The last real campaign measurement remains 3,715 blank capture-bound slots and a 25-row pending view with 21 nonempty-text and four missing-text rows. Authentic decisions and independently approved labels remain separately 0/3,715; no real write or rollback occurred. Lifecycle capability metric 27 does not increase for regression hardening or repository discovery. -Next: preserve current-head review/check evidence, obtain prerequisite protected integration, continue the 49 remaining source audits and the authentic decision/independent-approval campaign, and implement full-text-aware write admission under the required contract in ADR 0007. A complete reviewed set, explicit destinations and requested mode need separate authority verification, and the sealed binding must survive execution and every recovery outcome. That contract is documented, not implemented. Released CO consumption, upstream full-text version semantics and approved live write/rollback proof remain independent gaps. +At this approval-order checkpoint, full-text-aware write admission was still a documented next step. The latest checkpoint above implements its typed local admission and bound recovery while preserving separate meaning/destination authority. Current next work is prerequisite protected integration, 49 remaining source audits, authentic decisions and independent approval, durable recovery admission and delayed unknown-original-write reconciliation. Released CO consumption, upstream full-text version semantics and approved live write/rollback proof remain independent gaps. ## Historical private-artifact owner repair checkpoint @@ -190,7 +192,7 @@ Replayable retained-text coverage has progressed from 0 to 3,203/3,715 parents. Committed regressions repaired inherited environment proxies, exact-byte-limit rejection and replay checks occurring after digest allocation; clock fault injection verifies late/invalid-clock failures without changing the deadline. Final source verification at `733425df01511d894277fb8682e070f3dde03689` passed 173 tests across 37 suites including documentation tests, strict Clippy, formatting, rustdoc with warnings denied, the CI contract and the existing coverage gate. Coverage is 347/347 functions, 3,710/3,710 source-normalized regions and 674/674 source-normalized branch outcomes. Raw LLVM totals remain 4,159/4,255 lines, 6,129/6,274 regions and 603/674 branch outcomes; those are not 100%. The only source delta after the live run is a writer type alias resolving strict Clippy's complexity finding without changing runtime behavior. Hosted checks and independent protected approval remain separate gates. -At this earlier capture checkpoint, the next gap was the context-bound review chain implemented below, with 56 repository sources then unaudited. The latest checkpoint above reduces that remaining inventory to 49 while retaining authentic decisions, independent approval, full-text-aware write admission and the upstream version-contract repair as gaps. Unchanged predictions do not require a new proposal run merely to display retained evidence. A released contextual-orchestrator integration artifact remains unverified at the audited protected owner head, so source documentation alone does not authorize model-provider bypass. No new utility repository is justified by this one intake seam. +At this earlier capture checkpoint, the next gap was the context-bound review chain implemented below, with 56 repository sources then unaudited. The latest checkpoint above reduces that remaining inventory to 49 and adds typed full-text write admission. Authentic decisions, independent approval, durable recovery, unknown-original-write reconciliation and the upstream version-contract repair remain gaps. Unchanged predictions do not require a new proposal run merely to display retained evidence. A released contextual-orchestrator integration artifact remains unverified at the audited protected owner head, so source documentation alone does not authorize model-provider bypass. No new utility repository is justified by this one intake seam. ### Canonical transport repair and released-owner audit @@ -248,7 +250,7 @@ At `2fadbdab`, the workspace test run completed successfully and its exact test The [real private-command receipt](doctoring/zotero_bound_review_commands_evidence.json) records a new 1,590,742-byte single-link `0600` pending view, generated offline in 2.22 seconds with maximum resident memory 288,505,856 bytes. The separate audit at 12:21:47.264 UTC checked unchanged input hashes, capture identity, 25 blank pending rows, 21 parents with nonempty text and four without, and byte equality with the earlier read-only view. All 3,715 worksheet slots remain blank. No Zotero/model request, new prediction, authentic decision, external approval or write occurred. Byte equality is reuse evidence, not increased full-text coverage. -At this private-command checkpoint the lifecycle capability metric advanced from 26 to 27 for callable review through finalization. This is local verified functionality, not protected-main shipment. The latest checkpoint above completes the then-pending minimal predecessor repairs and advances repository audits to 27 of 76. Authentic full-denominator decisions and governance, full-text-aware write admission, upstream full-text version semantics and released CO integration remain gaps. Current protected checks/approval and a real immutable release remain independently necessary; no Utility Repository is justified by the current single-consumer seam. +At this private-command checkpoint the lifecycle capability metric advanced from 26 to 27 for callable review through finalization. This is local verified functionality, not protected-main shipment. The latest checkpoint completes the then-pending predecessor repairs and adds capability **28**, callable typed full-text write admission and bound recovery, verified by the nine focused tests and full workspace/coverage gates. Repository source audits remain a separate **27 of 76** metric. Authentic full-denominator decisions and governance, durable recovery, unknown-original-write reconciliation, upstream full-text version semantics and released CO integration remain gaps. Current protected checks/approval and a real immutable release remain independently necessary; no Utility Repository is justified by the current single-consumer seam. ### Historical pre-repair Zotero 10 transition From 3acd93f512e7e9e3e66c22dfef02f18c4df1ff6a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 17:08:32 +0900 Subject: [PATCH 09/52] docs: trace statistical owners and unresolved orchestration release --- CHANGELOG.md | 2 + docs/PRD.md | 2 + docs/TRD.md | 2 + docs/adr/0006-zotero-research-intake.md | 6 +++ .../RESEARCH_CAPABILITY_TRACEABILITY.md | 2 + .../cwl_ontology_capability_inventory.md | 40 ++++++++++++++++--- .../zotero_fulltext_contract_audit.md | 6 +++ docs/product-technical-gap-baseline.md | 10 +++++ 8 files changed, 65 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 40ba2a95..9fc3cc63 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,8 @@ All notable changes to ConceptWeave are documented here. ### Added +- Research inventory now distinguishes three additional statistical-library candidates from adopted integrations and reviewed papers, with source-bound limitations and follow-up requirements. + - Full-text-reviewed changes can now carry separately verified destination and execution approval through the local write and recovery workflow. Unknown writes remain unresolved until their state is proven; no command issues approval or changes the live library. - Private review commands now show saved text, accept completed decisions without replacing earlier work, and prepare a complete review for independent approval verification. They do not supply decisions or approve a review. diff --git a/docs/PRD.md b/docs/PRD.md index 0891c6a4..9577be68 100644 --- a/docs/PRD.md +++ b/docs/PRD.md @@ -56,6 +56,8 @@ All LLM-backed induction uses released `contextual-orchestrator` contracts. Mode ### FR-9 Research evidence intake +Repository capability discovery and paper classification are separate measures. A statistical library's model fit, factor structure or linked score is not an ontology label or approval. Before such evidence can inform a candidate, reviewers need its population/design, applicable item or observation versions, unavailable results and complete failure denominator. The [statistical-library audit](doctoring/cwl_ontology_capability_inventory.md#statistical-library-contract-audits-2026-09-06) records cultivation requirements, not adopted scoring rules or completed paper reviews. + Read one immutable Zotero Local API library-version snapshot and propose exactly one research disposition for every top-level bibliographic item. Each proposal retains the item key/version, exact matched metadata values, rule revision, linked child records, and any model receipt. Weak evidence and evidence that matches multiple specific disposition families must abstain into steward review. A local abstention retains its nonempty abstract exactly once, as matched evidence when applicable or otherwise as review context; decided items omit the review-only copy. Duplicate DOI/title identities are review candidates only: intake never merges, deletes, or silently mutates Zotero records. Full-text enrichment must distinguish listed attachments, returned nonempty text, complete or partial indexing, and reviewed meaning. Missing abstracts or unavailable text never remove papers from the campaign denominator or prove irrelevance. Newly retrieved text requires its own immutable evidence capture and renewed review of any changed proposal; it cannot silently replace evidence beneath an earlier approval. The [full-text audit](doctoring/zotero_fulltext_contract_audit.md) establishes availability only. A separate proposed local capture now preserves the observed text for later review, with missing material still visible. Retained text is neither completed classification nor approved meaning. diff --git a/docs/TRD.md b/docs/TRD.md index 45b50f78..f586e3b1 100644 --- a/docs/TRD.md +++ b/docs/TRD.md @@ -57,6 +57,8 @@ Source artifacts are untrusted input. Adapters must enforce source size/type bou ## 10. Evaluation +Future statistical-evidence admission must bind response population/design, modeled-variable identity, paired observation order and missingness, estimator/criterion revision, applicable anchor/item/category versions, and attempted/failed/unavailable counts. Preserve declared versus applied/skipped anchors and distinguish model distinguishability from relative fit. A fit statistic is not calibrated semantic confidence. The [kaefa/aFIPC/nonnest2 source audit](doctoring/cwl_ontology_capability_inventory.md#statistical-library-contract-audits-2026-09-06) identifies owner conformance work, not implemented consumer contracts. Existing measurement owners retain computation; no legacy R code, new Python/R hot path or heuristic scoring fallback is adopted. A future owner release must meet the Rust-first production policy and exact-consumer verification before use. + Evaluation must separate extraction recall, semantic correctness, structural correctness, ontology consistency, mapping accuracy, measure correctness, and governance outcomes. Model-judge scores may supplement but never replace deterministic golden fixtures and human-reviewed expert cases. ## 11. Zotero research intake diff --git a/docs/adr/0006-zotero-research-intake.md b/docs/adr/0006-zotero-research-intake.md index 9fb5e6ce..dfb79d87 100644 --- a/docs/adr/0006-zotero-research-intake.md +++ b/docs/adr/0006-zotero-research-intake.md @@ -47,6 +47,12 @@ No dedicated utility repository or Zotero mutation path is created. A future Zot ## Consequences +### 2026-09-06 statistical-owner discovery amendment (Proposed) + +In the context of identifying reusable evidence from CWL statistical libraries, facing source-level implementations without verified consumer releases and methods with different population/anchor/observation assumptions, we decided to record exact-source cultivation requirements within the existing Research Intake inventory, and against importing their numerical code, inventing relevance weights or creating another utility owner, to keep research evidence distinct from semantic decisions, accepting that release, design-conformance and runtime validation remain prerequisites. + +The [three-owner audit](../doctoring/cwl_ontology_capability_inventory.md#statistical-library-contract-audits-2026-09-06) records kaefa's heuristic search and unavailable criteria, aFIPC's eligible versus skipped anchors, and nonnest2's unchecked observation-alignment precondition. The positive consequence is an inspectable path from source and primary literature to future acceptance tests. The negative consequence is no immediate scoring adoption or paper-decision increase. Reusing existing measurement owners is preferred; a new repository has no demonstrated independent deployment/consumer need. Next evidence is a released owner contract, population/design and full failure-denominator checks, applicable recovery/error measurements, and exact-consumer conformance. This amendment does not approve a license, change any equation or promote this ADR to Accepted. + ### 2026-09-05 earliest-owner private artifact repair amendment (Proposed) In the context of independently reviewed stacked pull requests, facing a shared private JSON defect fixed only in a later child, we decided for a minimal repair at the original reader boundary and ordinary parent-to-child merges and against accepting vulnerable predecessors, reverse-merging later full-text features or discarding predecessor deltas, to make each proposed slice independently verifiable, accepting repeated checks at every changed head. diff --git a/docs/doctoring/RESEARCH_CAPABILITY_TRACEABILITY.md b/docs/doctoring/RESEARCH_CAPABILITY_TRACEABILITY.md index 4d8930c8..4ad02b85 100644 --- a/docs/doctoring/RESEARCH_CAPABILITY_TRACEABILITY.md +++ b/docs/doctoring/RESEARCH_CAPABILITY_TRACEABILITY.md @@ -61,6 +61,8 @@ Acceptance must prove that ConceptWeave never becomes the GRC system of record, ## Adjacent evidence and edit contracts +The [September 6 statistical-library audit](cwl_ontology_capability_inventory.md#statistical-library-contract-audits-2026-09-06) adds kaefa, aFIPC and nonnest2 as research/measurement candidates only. Kim (2006), whose publisher record confirms the fixed-calibration comparison, motivates preserving population and calibration-method assumptions; Vuong (1989) and Merkle et al. (2016) motivate separate distinguishability and fit outcomes. The corresponding future tests must expose unavailable criteria, failed candidates, declared/applied/skipped anchors, paired observation identity/order and missingness. Source-level test definitions are not executed recovery/RMSE evidence. A greedy model search, a successful anchor assignment or a fit probability cannot supply a relevance weight or semantic approval. APA references and exact source paths are in that audit; no new Zotero decision is added to this register. + The [learning/measurement audit](cwl_ontology_capability_inventory.md#further-learning-and-measurement-contracts-2026-09-05) adds Psychometrics Commons as an unreleased product-domain evidence candidate. Future conformance must preserve construct/instrument/item versions, locale, consent, evidence validity and distinct observation clocks. Caller-supplied membership shares are not estimated weights, and reference checks cannot authenticate a reviewer or scientifically validate an instrument. README-only supply-chain and learning-record-store owners remain prerequisites rather than implementations to copy. The [document-contract audit](cwl_ontology_capability_inventory.md#adjacent-document-contract-audits-2026-09-05) identifies two additional cultivation hypotheses. Future DiagramWeave conformance should reject stale source revisions, a mismatched caller document and unapproved scope expansion while keeping diagram source and semantic approval separate. Future NewsDOM observation conformance should bind original bytes and parser version, retain missing coordinates/warnings, and reject an incompatible or unauthenticated parser before private upload. Neither an editable diagram nor parsed section text establishes an ontology relation. These are unimplemented consumer evaluation families, not authentic paper labels or tested integrations; no source or service is copied into ConceptWeave. diff --git a/docs/doctoring/cwl_ontology_capability_inventory.md b/docs/doctoring/cwl_ontology_capability_inventory.md index a63d15aa..5703c13d 100644 --- a/docs/doctoring/cwl_ontology_capability_inventory.md +++ b/docs/doctoring/cwl_ontology_capability_inventory.md @@ -1,14 +1,14 @@ # CWL ontology capability inventory -Evidence snapshot: 2026-09-05. Status: research inventory, not dependency-adoption approval. +Evidence snapshot: 2026-09-06. Status: research inventory, not dependency-adoption approval. ## Scope and evidence limits -The paginated organization metadata census returned 76 repositories, including one archived repository and 11 forks; the 12:52:47 UTC refresh confirmed the same counts. Name/description screening for ontology, semantic, knowledge graph, schema, RDF, SHACL, provenance and lineage was combined with the existing Context Map; metadata matches alone miss owners whose descriptions do not use those words. This expanded the original eight-candidate audit to 12 selected candidates. The organization product-goal directive then identified DiskSage's actual OWL use, expanding the audit to 13. naruon and pg-erd-cloud brought the count to 15. Five domain/interoperability audits brought coverage to 20; three further domain and two document-contract audits brought it to 25/76, with 51 repositories then unaudited at that depth. The subsequent keyverse and inkspan audits below advance the current count to 27/76, leaving 49. This does not prove that all relevant implementations have been found. +The paginated organization metadata census returned 76 repositories, including one archived repository and 11 forks; the September 6 08:00 UTC refresh confirmed the same counts. Name/description screening for ontology, semantic, knowledge graph, schema, RDF, SHACL, provenance and lineage was combined with the existing Context Map; metadata matches alone miss owners whose descriptions do not use those words. This expanded the original eight-candidate audit to 12 selected candidates. The organization product-goal directive then identified DiskSage's actual OWL use, expanding the audit to 13. naruon and pg-erd-cloud brought the count to 15. Five domain/interoperability audits brought coverage to 20; three further domain and two document-contract audits brought it to 25/76. Keyverse and inkspan brought it to 27/76; the three statistical-library audits below bring the current count to **30/76**, leaving **46**. This does not prove that all relevant implementations have been found. Each row separates responsibility, exact default-head documentation or tree evidence, and published GitHub release evidence. A name, open PR or protected branch alone does not prove a usable released API. This is not a complete package-registry, deployment, attestation or consumer-conformance audit; bounded follow-up attempts and their limitations are recorded below. CalendarWeave and four-pillars were initially screened from metadata only; their subsequent source audits now distinguish a bootstrap owner from an implemented product-domain model without excluding either by description alone. -GitHub repository, branch, README-at-SHA, complete-tree and release endpoints supplied these observations. All 27 selected default branches reported protected at their recorded observations. Several use `develop`; do not substitute a branch named `main` for the actual default shown in each row. For the original 13 candidates, GitHub detected MIT for semantic-data-portal, TEPP, LineageWeave, fast-mlsirm and disksage; Apache-2.0 for RankWeave, graphify, Veilpick and mhtml-etl-gateway; and no SPDX identifier for the other four. An undetected license is unresolved evidence, not permission to adopt. The naruon audit read an explicitly proprietary license despite public visibility and NOASSERTION metadata; pg-erd-cloud's exact license contains Apache-2.0 without an appended noncommercial restriction. DeepWiki had no indexed evidence for graphify, Veilpick, disksage, pg-erd-cloud or the twelve further candidates below, so exact GitHub source/tree was used instead. +GitHub repository, branch, README-at-SHA, complete-tree and release endpoints supplied these observations. All 30 selected default branches reported protected at their recorded observations. Several use `develop` or `master`; do not substitute a branch named `main` for the actual default shown in each row. For the original 13 candidates, GitHub detected MIT for semantic-data-portal, TEPP, LineageWeave, fast-mlsirm and disksage; Apache-2.0 for RankWeave, graphify, Veilpick and mhtml-etl-gateway; and no SPDX identifier for the other four. An undetected license is unresolved evidence, not permission to adopt. The naruon audit read an explicitly proprietary license despite public visibility and NOASSERTION metadata; pg-erd-cloud's exact license contains Apache-2.0 without an appended noncommercial restriction. DeepWiki had no indexed evidence for graphify, Veilpick, disksage, pg-erd-cloud or the fifteen further candidates below, so exact GitHub source/tree was used instead. ## Owner and maturity evidence @@ -106,12 +106,28 @@ No externally approved paper-to-owner link has been demonstrated by this audit. The PR #10 findings for [provider metadata lost before hashing](https://github.com/ContextualWisdomLab/ConceptWeave/pull/10#discussion_r3934854209) and [mutable predictions evaluated under an unchanged receipt](https://github.com/ContextualWisdomLab/ConceptWeave/pull/10#discussion_r3934854221) are source-repaired at `e7d4e59f1b55b5954c5f8436527bc96e7ef2fb13` and propagated through all 23 dependent PRs to #34. Finalization at #27 additionally recomputes the complete proposal digest; #28 proves serialized title/evidence mutation fails before the external verifier. An unchanged source digest, rebuilt worksheet or replacement locally calculated proposal digest cannot renew independent approval. Missing proposal bindings in old receipts fail closed and must not be backfilled. The [campaign baseline](../product-technical-gap-baseline.md) records the new private artifact hashes and exact local verification. No labels, approval, authorization prompt, write or rollback were performed; source repair is not a protected merge. +## Statistical-library contract audits (2026-09-06) + +The 07:54–08:00 UTC audit added three source-level observations. All three actual default branches reported protected, and complete trees were not truncated: kaefa 131 entries, aFIPC 2,225 and nonnest2 33. All three paginated GitHub release and tag queries returned zero entries. Package version declarations and installation examples are not publication evidence. CRAN page retrieval failed in the browsing tool; this audit neither establishes absence from CRAN nor binds a CRAN distribution to these CWL commits. No R package was installed, source imported, estimation run, test executed or private response data read. + +| Candidate | Exact default source and demonstrated boundary | Cultivation requirement before consumption | +| --- | --- | --- | +| kaefa | `develop@5128d4867e24b5db73e6e3c8652a8dbeabd70aa0`; [core contract](https://github.com/ContextualWisdomLab/kaefa/blob/5128d4867e24b5db73e6e3c8652a8dbeabd70aa0/docs/product/kaefa-core-api-contract.md) explicitly describes a greedy, heuristic search and an internal R boundary, not a separately released core package. The [criterion implementation](https://github.com/ContextualWisdomLab/kaefa/blob/5128d4867e24b5db73e6e3c8652a8dbeabd70aa0/R/kaefa.R#L440-L543) rejects absent DIC instead of substituting AIC and checks the AICc denominator. [DESCRIPTION](https://github.com/ContextualWisdomLab/kaefa/blob/5128d4867e24b5db73e6e3c8652a8dbeabd70aa0/DESCRIPTION) declares 0.1.428, R/mirt dependencies and GPL-3. | Retain the actual search scope, failed candidates, criterion identity and unavailable diagnostics. A selected factor structure is not an ontology relation or estimated relevance weight. Owner source includes [criterion/index-preservation regression definitions](https://github.com/ContextualWisdomLab/kaefa/blob/5128d4867e24b5db73e6e3c8652a8dbeabd70aa0/tests/testthat/test-model-selection-criteria.R); their presence is not a test result from this audit. Its own split rule requires stable contracts and at least two consumers, so do not create another core repository for this unproved use. | +| aFIPC | `master@f87c2324f1686135e57d8730c1b0b9420874f300`; [anchor assignment](https://github.com/ContextualWisdomLab/aFIPC/blob/f87c2324f1686135e57d8730c1b0b9420874f300/R/aFIPC.R#L752-L807) copies matching old-form item parameters into the new form and disables their estimation when response-category counts match. Ineligible pairs are logged and skipped. The [source return](https://github.com/ContextualWisdomLab/aFIPC/blob/f87c2324f1686135e57d8730c1b0b9420874f300/R/aFIPC.R#L1035-L1053) is a list of models, expected scores, theta and optional IPD data, not a versioned evidence receipt. [DESCRIPTION](https://github.com/ContextualWisdomLab/aFIPC/blob/f87c2324f1686135e57d8730c1b0b9420874f300/DESCRIPTION) declares 0.1.0 and `GPL-3 \| file LICENSE`; the license file is a copyright stub, despite GitHub's NOASSERTION metadata. | Owner conformance must distinguish declared, eligible, applied and skipped anchors; a printed skip cannot count as successful full-anchor linking. Bind population, response design, item/category versions, estimator/options and failure denominators. [Existing generated-data regression source](https://github.com/ContextualWisdomLab/aFIPC/blob/f87c2324f1686135e57d8730c1b0b9420874f300/tests/testthat/test-fixed-parameter-calibration.R) checks fixed anchors, free non-anchors, covariance and a mean-absolute-error threshold; it does not report this audit's runtime, RMSE or production calibration. Explicit common-item confirmation is not semantic approval. | +| nonnest2 | `master@b62bf9ac928988a4b988fc3efb0adfb88549fef2`; CWL fork of `qpsy/nonnest2`. [Vuong API source](https://github.com/ContextualWisdomLab/nonnest2/blob/b62bf9ac928988a4b988fc3efb0adfb88549fef2/R/vuongtest.R#L1-L42) separates distinguishability from relative fit and explicitly requires identical modeled variables and observation ordering without checking those preconditions. [The computation](https://github.com/ContextualWisdomLab/nonnest2/blob/b62bf9ac928988a4b988fc3efb0adfb88549fef2/R/vuongtest.R#L99-L199) returns statistics, probabilities, model classes/calls and the nesting flag. [DESCRIPTION](https://github.com/ContextualWisdomLab/nonnest2/blob/b62bf9ac928988a4b988fc3efb0adfb88549fef2/DESCRIPTION) declares 0.5-9 and `GPL-2 \| GPL-3`; an absent GitHub license classification does not erase that declaration. | Before model-comparison evidence is consumed, the owner must prove paired observation identity/order, equal outcome support and missingness handling. [Object checking](https://github.com/ContextualWisdomLab/nonnest2/blob/b62bf9ac928988a4b988fc3efb0adfb88549fef2/R/vuongtest.R#L367-L415) does not establish those conditions and rejects lavaan sampling weights. Do not infer multi-membership/time-design support or relevance confidence from a fit p-value. Upstream publication, if found, still needs exact compatibility evidence for the CWL fork. | + +These are measurement/research candidates adjacent to the existing fast-mlsirm and TEPP responsibilities, not three new shared ontology generators. The owner contracts must determine whether reusable computation belongs there; ConceptWeave does not copy legacy R arithmetic or introduce a new Python/R production scoring path. Legal packaging and redistribution review remains separate from reading the license declaration. + +Existing [kaefa issue #48](https://github.com/ContextualWisdomLab/kaefa/issues/48#issuecomment-5557928779) now carries the consumer's paired-observation, missingness and explicit-unavailable acceptance requirements. Its older graceful-fallback wording must not become a passing result or invented confidence. At the 08:07 UTC metadata read, kaefa RMSE [PR #79](https://github.com/ContextualWisdomLab/kaefa/pull/79) was OPEN at `1c5d9f0491fc178be3f7f307dac521fbcbba6978`; aFIPC RMSE [PR #264](https://github.com/ContextualWisdomLab/aFIPC/pull/264) was OPEN at `af61177e0039a689c64d09c7f63275641ce7d537`; nonnest2 input-validation [PR #126](https://github.com/ContextualWisdomLab/nonnest2/pull/126) was OPEN Draft at `efca0b8534abc0ebc7211c8c2025bfaf36a67fec`. These are existing owner work, not accepted recovery evidence or this audit's tests. No duplicate issue, branch, numerical repair or release writer was created. Source-audit rows were checked for 30 unique candidates, excluding table headers and separators; repository census and release/adoption denominators remain separate. + +Kim (2006) and the official mirt fixed-calibration documentation motivate retaining calibration design and distribution assumptions; the mirt documentation's restrictions do not automatically prove that every aFIPC path has identical behavior. Vuong (1989) and Merkle et al. (2016) motivate separating distinguishability, relative fit and semantic correctness. These research implications are future conformance requirements, not new approved Zotero labels. DeepWiki's three tools returned no repository index for each candidate. Context7's previously observed monthly quota remained a documentation limitation; no alternate credentials, package installation or source-copy workaround was used. + ## KPI and next actions | Measure | Observation | Required next evidence | | --- | --- | --- | -| Metadata census / bounded capability audit | 76 metadata records; 27/27 selected candidates have exact default-head documentation/source/tree and release-query evidence | Audit actual contracts/consumers; metadata coverage is not full source-level discovery, and 49 repositories remain unaudited at that depth. | -| GitHub release with resolved source commit | 7/27 selected candidates, including proprietary naruon, product-domain four-pillars, release-diverged newsdom-api and inkspan's historical release without the relevant current contracts | License, artifact/provenance and consumer conformance; a release count is not permissive-library or adoption evidence. | +| Metadata census / bounded capability audit | 76 metadata records; 30/30 selected candidates have exact default-head documentation/source/tree and release-query evidence | Audit actual contracts/consumers; metadata coverage is not full source-level discovery, and 46 repositories remain unaudited at that depth. | +| GitHub release with resolved source commit | 7/30 selected candidates, including proprietary naruon, product-domain four-pillars, release-diverged newsdom-api and inkspan's historical release without the relevant current contracts | License, artifact/provenance and consumer conformance; a release count is not permissive-library or adoption evidence. | | Verified ConceptWeave adoption | 0 demonstrated in this audit | Released owner contract, exact consumer revision and passing contract/runtime evidence. | | Privately retained nonempty full text | 3,203/3,715 parents in the separate [capture evidence](zotero_fulltext_capture_evidence.json); 512 remain without demonstrated nonempty text | New content-bound proposals and authentic review with partial/unknown indexing. The earlier sweep's 800/1,000 abstract-missing subgroup is availability evidence, not a remeasured retained-capture subgroup. | | Unverified steward decisions | 0/3,715 on the repaired snapshot; first pending batch has 0/25 decisions | Authentic snapshot-bound decisions; batch generation is not review progress. | @@ -121,6 +137,20 @@ Review the repaired current snapshot, including missing-abstract and unsupported ## References +ContextualWisdomLab. (2026). *kaefa* (Commit 5128d4867e24b5db73e6e3c8652a8dbeabd70aa0) [Computer software]. GitHub. https://github.com/ContextualWisdomLab/kaefa/tree/5128d4867e24b5db73e6e3c8652a8dbeabd70aa0 + +ContextualWisdomLab. (2026). *aFIPC* (Commit f87c2324f1686135e57d8730c1b0b9420874f300) [Computer software]. GitHub. https://github.com/ContextualWisdomLab/aFIPC/tree/f87c2324f1686135e57d8730c1b0b9420874f300 + +ContextualWisdomLab. (2026). *nonnest2* (Commit b62bf9ac928988a4b988fc3efb0adfb88549fef2) [Computer software]. GitHub. https://github.com/ContextualWisdomLab/nonnest2/tree/b62bf9ac928988a4b988fc3efb0adfb88549fef2 + +Kim, S. (2006). A comparative study of IRT fixed parameter calibration methods. *Journal of Educational Measurement, 43*(4), 355–381. https://doi.org/10.1111/j.1745-3984.2006.00021.x + +Merkle, E. C., You, D., & Preacher, K. J. (2016). Testing non-nested structural equation models. *Psychological Methods, 21*, 151–163. https://doi.org/10.1037/met0000038 + +Vuong, Q. H. (1989). Likelihood ratio tests for model selection and non-nested hypotheses. *Econometrica, 57*(2), 307–333. https://doi.org/10.2307/1912557 + +Chalmers, R. P. (n.d.). *Fixed-item calibration method*. mirt documentation. Retrieved September 6, 2026, from https://philchalmers.github.io/mirt/reference/fixedCalib.html + ContextualWisdomLab. (2026). *Keyverse* (Commit 7d9151cd2da260e118020c938c7358e2ee75d541) [Computer software]. GitHub. https://github.com/ContextualWisdomLab/keyverse/tree/7d9151cd2da260e118020c938c7358e2ee75d541 ContextualWisdomLab. (2026). *inkspan* (Commit 0b88c16f14f51b54a87eb7164f0edfb06dd60902) [Computer software]. GitHub. https://github.com/ContextualWisdomLab/inkspan/tree/0b88c16f14f51b54a87eb7164f0edfb06dd60902 diff --git a/docs/doctoring/zotero_fulltext_contract_audit.md b/docs/doctoring/zotero_fulltext_contract_audit.md index d9c97cd7..3eb9713f 100644 --- a/docs/doctoring/zotero_fulltext_contract_audit.md +++ b/docs/doctoring/zotero_fulltext_contract_audit.md @@ -89,6 +89,12 @@ The 12:05:30–12:07:20 UTC refresh confirmed the same protected default SHA, ze Admission requires an immutable owner artifact and schema digest, protected-source provenance, an identified deployed gateway version and exact-consumer contract evidence. Until then, no model-assisted proposal is generated through copied source, a temporary branch or a direct provider. Catalog-sync success, source documentation and a Draft release PR cannot satisfy this gate. Review labels must not be invented to compensate for unavailable model assistance. +#### September 6 release recheck + +The 07:50–07:54 UTC recheck found protected `main@414f22973658c4ddc3d4320fcf7acd9b4e8ba991`. Its [package declaration](https://github.com/ContextualWisdomLab/contextual-orchestrator/blob/414f22973658c4ddc3d4320fcf7acd9b4e8ba991/pyproject.toml) names `contextual-orchestrator` 0.2.0; the [changelog](https://github.com/ContextualWisdomLab/contextual-orchestrator/blob/414f22973658c4ddc3d4320fcf7acd9b4e8ba991/CHANGELOG.md#L1-L11) still marks it Unreleased. Paginated GitHub release/tag endpoints returned zero entries. The exact PyPI JSON/project pages and organization container-package endpoint returned 404. This bounded result does not exclude other registry names or private deployments; deployments and historical Actions artifacts were not recounted in this recheck. + +Existing [release PR #1030](https://github.com/ContextualWisdomLab/contextual-orchestrator/pull/1030) is OPEN Draft at `6c25848728a3333365454a2c74a607d576abe4c9`, base `a080297d2546bb61e89520d637cabc202db331ec`, unmerged. The CO integration task again confirmed that it owns #1067/#1074, not #1030. Central coordination did not identify the actual release writer; the integration task placed the artifact/schema/protected-provenance/deployed-version request in the [existing release PR](https://github.com/ContextualWisdomLab/contextual-orchestrator/pull/1030#issuecomment-5557913414), whose comment was independently reread at 08:05 UTC. A comment is not confirmed writer identity or publication. The dirty local CO checkout was used only to locate contracts and was not edited or substituted for this protected source. DeepWiki returned documentation but its proposed answer about NIM benchmark artifact publication does not prove a released research-proposal interface. No model request, credential inspection, new writer or private-paper transfer occurred. + ## Follow-up: privately retained content, not reclassification The [capture evidence](zotero_fulltext_capture_evidence.json) records a separate live run of the proposed Rust command at `2c2226f1d583c3091cc126c96d27d55d1084c0d1`. Unlike the earlier availability audit, this run preserves exact source-response JSON privately. It performed 6,950 sequential requests: two library bookends, two complete manifests and metadata/content reads for all 3,473 manifest entries. The source-read interval was 28,898 ms; total command elapsed time was 33.12 seconds. Maximum resident memory was 283,426,816 bytes and measured peak memory footprint was 332,956,272 bytes. These are one observed local run, not a latency SLO or a production load benchmark. diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 10ae6caa..c2d121e4 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,6 +4,16 @@ This file records code-current product and technical gaps. Exact PR/check/run coordinates are evidence snapshots, not mutable-head dependencies. Live protected-branch, PR, issue and workflow state wins whenever it advances after this snapshot. Refresh the changed PR's metadata after each documentation commit; evidence from another PR or an earlier head does not transfer. +## Latest owner-discovery checkpoint + +The September 6 07:54–08:00 UTC [statistical-library source audit](doctoring/cwl_ontology_capability_inventory.md#statistical-library-contract-audits-2026-09-06) advances source coverage **27/76 → 30/76**, leaving **46** repositories. The organization census still has 76 repositories, one archived and 11 forks. kaefa, aFIPC and nonnest2 provide adjacent model-search, calibration and comparison evidence, not ontology publication authority. Their protected default heads, complete trees, package declarations, selected implementation and regression definitions are recorded. Their GitHub release/tag queries are empty; CRAN publication remains unverified after retrieval errors. Release-bearing candidates remain seven, now **7/30**. No R test or estimation run, dependency adoption or source copy occurred. + +This checkpoint preserves the separate lifecycle capability **28** and the last authentic-decision/independent-approval measurements, each **0/3,715**. It does not reread private paper artifacts or turn repository maturity into paper labels. [PRD FR-9](PRD.md#fr-9-research-evidence-intake), [TRD evaluation](TRD.md#10-evaluation), Proposed ADR 0006 and the research register now require comparison population/order, explicit applied/skipped anchor evidence and unavailable-diagnostic/failure denominators before statistical observations can inform a candidate. Rust-first production arithmetic and existing owner boundaries remain unchanged. + +The [CO release recheck](doctoring/zotero_fulltext_contract_audit.md#september-6-release-recheck) verifies protected `main@414f22973658c4ddc3d4320fcf7acd9b4e8ba991`, zero GitHub releases/tags and no result for the inspected exact PyPI/container package names. Existing release PR #1030 advanced to `6c25848728a3333365454a2c74a607d576abe4c9` but remains OPEN Draft. Other registries and a serving gateway remain unverified, not proven absent. The existing integration task and central coordination did not identify the release writer; the four evidence requirements were placed in [existing PR #1030](https://github.com/ContextualWisdomLab/contextual-orchestrator/pull/1030#issuecomment-5557913414) and independently reread. Statistical consumer requirements likewise attach to [existing kaefa issue #48](https://github.com/ContextualWisdomLab/kaefa/issues/48#issuecomment-5557928779). No duplicate issue, release writer or consumer workaround was created. + +Before this documentation increment, #39 remained OPEN Draft at `6cefb4f15e7072448e32414418f5d99460d72075`, exact #38 base `8e057652ee7784b373beeeec865d80dd3db773be`, with zero reviews and CodeRabbit draft-skip only. The new documentation requires a fresh head read; prior runtime evidence below remains scoped to `bdf55bf`. Remaining work includes protected prerequisite integration, authentic full-denominator review and independent governance, released CO consumption, durable recovery admission, delayed unknown-original-write reconciliation and approved live write/rollback. The goal remains active. + ## Latest full-text write checkpoint Runtime `bdf55bfb95b3e688e9ec58eda2785d17ed853b4e` on `codex/zotero-fulltext-write-admission` adds complete typed full-text/write-scope admission, opaque execution and bound conditional recovery after #38's `8e057652ee7784b373beeeec865d80dd3db773be`. It does not extract a metadata-only review or legacy executable plan. Existing golden/write validation bodies are reused privately before either actual verifier; explicit destination/mode verification is separate from semantic approval. A later invalid item or changed capture/proposal/label makes zero authority calls. A locally valid accepted request reaches both exactly once, and semantic denial prevents write verification. From 789637f6a54373c3176e42dda78b1075937fd273 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 17:11:26 +0900 Subject: [PATCH 10/52] docs: record statistical audit verification without runtime promotion --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index c2d121e4..a0b50d2d 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -12,7 +12,7 @@ This checkpoint preserves the separate lifecycle capability **28** and the last The [CO release recheck](doctoring/zotero_fulltext_contract_audit.md#september-6-release-recheck) verifies protected `main@414f22973658c4ddc3d4320fcf7acd9b4e8ba991`, zero GitHub releases/tags and no result for the inspected exact PyPI/container package names. Existing release PR #1030 advanced to `6c25848728a3333365454a2c74a607d576abe4c9` but remains OPEN Draft. Other registries and a serving gateway remain unverified, not proven absent. The existing integration task and central coordination did not identify the release writer; the four evidence requirements were placed in [existing PR #1030](https://github.com/ContextualWisdomLab/contextual-orchestrator/pull/1030#issuecomment-5557913414) and independently reread. Statistical consumer requirements likewise attach to [existing kaefa issue #48](https://github.com/ContextualWisdomLab/kaefa/issues/48#issuecomment-5557928779). No duplicate issue, release writer or consumer workaround was created. -Before this documentation increment, #39 remained OPEN Draft at `6cefb4f15e7072448e32414418f5d99460d72075`, exact #38 base `8e057652ee7784b373beeeec865d80dd3db773be`, with zero reviews and CodeRabbit draft-skip only. The new documentation requires a fresh head read; prior runtime evidence below remains scoped to `bdf55bf`. Remaining work includes protected prerequisite integration, authentic full-denominator review and independent governance, released CO consumption, durable recovery admission, delayed unknown-original-write reconciliation and approved live write/rollback. The goal remains active. +Before this documentation increment, #39 remained OPEN Draft at `6cefb4f15e7072448e32414418f5d99460d72075`, exact #38 base `8e057652ee7784b373beeeec865d80dd3db773be`, with zero reviews and CodeRabbit draft-skip only. Documentation commit `3acd93f512e7e9e3e66c22dfef02f18c4df1ff6a` passed a fresh locked Rust 1.98.0 workspace run: **252 tests / 41 unfiltered suites**, including six doctests. The CI contract, formatting, diff checks and unique 30-row inventory assertion passed. `git diff bdf55bfb95b3e688e9ec58eda2785d17ed853b4e HEAD -- crates Cargo.toml Cargo.lock scripts` is empty, so no R implementation or new Rust behavior was tested; the earlier coverage result is not a fresh coverage run. The test log is `/tmp/conceptweave-statistical-owner-tests-20260906.log`. Final documentation requires a fresh PR-head read. Remaining work includes protected prerequisite integration, authentic full-denominator review and independent governance, released CO consumption, durable recovery admission, delayed unknown-original-write reconciliation and approved live write/rollback. The goal remains active. ## Latest full-text write checkpoint From e300eb8aad2818a7a65cc7c84ed264c3a204e155 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 17:24:40 +0900 Subject: [PATCH 11/52] test: preserve unresolved original write observation contract --- .../src/full_text_write_tests.rs | 161 ++++++++++++++++++ .../2026-09-06_full_text_write_admission.md | 10 ++ 2 files changed, 171 insertions(+) diff --git a/crates/conceptweave-zotero/src/full_text_write_tests.rs b/crates/conceptweave-zotero/src/full_text_write_tests.rs index c3abe48a..27599074 100644 --- a/crates/conceptweave-zotero/src/full_text_write_tests.rs +++ b/crates/conceptweave-zotero/src/full_text_write_tests.rs @@ -5,6 +5,167 @@ use crate::{ use std::cell::Cell; use std::cell::RefCell; +#[test] +fn full_text_write_observation_preserves_original_attempt_without_granting_recovery() { + for failed_index in 0..2 { + for observation in 0..5 { + let report = report_fixture(); + let capture = capture_with(&report, 4096, &mut |request_path, _| { + Ok(response_fixture(request_path)) + }) + .unwrap(); + let mut scope = write_scope_fixture(&report, &capture); + scope.mode = WriteMode::Execute; + let plan = + build_full_text_write_plan(&report, &capture, scope, |_| true, |_| true).unwrap(); + let store = WriteStore::from_report(&report); + let attempted_request = RefCell::new(None); + let receipt = execute_full_text_write_plan( + &plan, + |item_key| { + if store.read_count.get() >= 2 { + return Err(()); + } + store.read_item(item_key) + }, + |request| { + if store.write_count.get() == failed_index { + *attempted_request.borrow_mut() = Some(request.clone()); + if observation == 1 { + store.write_item(request).unwrap(); + } + return Err(()); + } + store.write_item(request) + }, + ); + let original = serde_json::to_value(&receipt).unwrap(); + let request = attempted_request.borrow().clone().unwrap(); + assert_eq!( + request.library_version, + report.library_version + failed_index as u64 + ); + assert_eq!( + original["indeterminate_request"], + serde_json::to_value(&request).unwrap() + ); + assert_eq!( + original["write_result"]["indeterminate_item_key"], + request.item_key + ); + assert_eq!( + original["write_result"]["rollback_operations"] + .as_array() + .unwrap() + .len(), + failed_index + ); + assert_eq!( + original["write_result"]["not_attempted_item_keys"] + .as_array() + .unwrap() + .len(), + 1 - failed_index + ); + let reads_before = store.read_count.get(); + let writes_before = store.write_count.get(); + let observed = crate::observe_full_text_write(&receipt, |item_key| { + assert_eq!(item_key, request.item_key); + let mut state = store.read_item(item_key)?; + match observation { + 2 => { + state.server_id = "OTHER_SERVER".into(); + state.item_key = "OTHER_ITEM".into(); + } + 3 => state.collection_keys = vec![" ".into()], + 4 => return Err(()), + _ => {} + } + Ok(state) + }) + .unwrap(); + let result = serde_json::to_value(observed).unwrap(); + assert_eq!(result["write_receipt"], original); + assert_eq!(store.read_count.get(), reads_before + 1); + assert_eq!(store.write_count.get(), writes_before); + if observation == 4 { + assert!(result["observed_state"].is_null()); + } else { + let state = &result["observed_state"]; + match observation { + 0 => assert_eq!(state["item_version"], request.item_version), + 1 => assert_eq!( + state["collection_keys"], + serde_json::json!(request.collection_keys) + ), + 2 => assert_eq!(state["server_id"], "OTHER_SERVER"), + _ => assert_eq!(state["collection_keys"], serde_json::json!([" "])), + } + } + assert_eq!(serde_json::to_value(&receipt).unwrap(), original); + assert!(!result.to_string().contains("synthetic-write-authority")); + assert!(!result.to_string().contains("synthetic-write-review")); + assert!( + crate::execute_full_text_rollback( + &receipt, + |_| -> Result { + panic!("unknown write read") + }, + |_| -> Result { + panic!("unknown write mutation") + }, + ) + .is_err() + ); + } + } +} + +#[test] +fn full_text_write_observation_refuses_non_unknown_receipts_without_reading() { + for scenario in 0..4 { + let report = report_fixture(); + let capture = capture_with(&report, 4096, &mut |request_path, _| { + Ok(response_fixture(request_path)) + }) + .unwrap(); + let mut scope = write_scope_fixture(&report, &capture); + if scenario != 0 { + scope.mode = WriteMode::Execute; + } + let plan = + build_full_text_write_plan(&report, &capture, scope, |_| true, |_| true).unwrap(); + let store = WriteStore::from_report(&report); + if scenario == 1 { + store.library_version.set(99); + } + let receipt = execute_full_text_write_plan( + &plan, + |item_key| store.read_item(item_key), + |request| { + if scenario == 3 { + Err(()) + } else { + store.write_item(request) + } + }, + ); + assert!( + serde_json::to_value(&receipt) + .unwrap() + .get("indeterminate_request") + .is_none() + ); + assert!( + crate::observe_full_text_write( + &receipt, + |_| -> Result { panic!("no unknown request") }, + ) + .is_err() + ); + } +} + #[test] fn full_text_write_reconciliation_distinguishes_restored_unknown_and_failed_reads() { for observation in 0..3 { diff --git a/docs/plans/2026-09-06_full_text_write_admission.md b/docs/plans/2026-09-06_full_text_write_admission.md index 0cc0ea09..c1b41399 100644 --- a/docs/plans/2026-09-06_full_text_write_admission.md +++ b/docs/plans/2026-09-06_full_text_write_admission.md @@ -57,3 +57,13 @@ Update PRD/TRD/Proposed ADR 0007/architecture guidance/UML/CHANGELOG to state im CodeGraph was healthy and synchronized before exploration and after edits; its large-file queries trimmed the desired planner bodies, so their specific missing ranges were read directly. No code-review-graph MCP tool or executable is available in this environment; do not claim its indexing. DeepWiki returned repository-not-found for structure/content/question requests. Context7 returned its monthly quota limit; no alternate credentials or paid route were used. Existing serde APIs were checked against the official field-attribute and Serialize documentation, with APA entries in the full-text contract audit. The ADR skill's referenced identity instructions are absent, so the existing Proposed ADR was extended with a Y-Statement and no allocator, Accepted transition or new ADR number. Admission RED `47d4e89` and recovery RED `79e1c22` preserve absent-API failures. Initial admission GREEN `d36dad8` passed 3 focused tests; recovery GREEN `425fb8c` passed 7. The first full coverage run found two missing branch outcomes (dry-run recovery refusal and indeterminate reconciliation retry refusal), despite passing workspace/static checks. Added cases in `bdf55bf` also cover already restored delayed observations, failed reads, known partial writes and compile-time opaque/persistence boundaries. Nine focused tests pass at this candidate; final unfiltered measurements are recorded in the Gap baseline after fresh full verification. No coverage threshold, exclusion or dependency changed. + +## Task 4 — Observe an indeterminate original request without clearing it + +Baseline `789637f6a54373c3176e42dda78b1075937fd273` passes 252 tests in 41 unfiltered suites on Rust 1.98.0. The existing receipt loses the actual failed request's library precondition after earlier successful operations. Its plan-level library version is not a substitute. Preserve that exact request inside the opaque receipt using the existing executor callback, without another executor or mutation path. + +Add a read-only `observe_full_text_write` function in `crates/conceptweave-zotero/src/full_text_write.rs` and export it with its serialize-only observation type from `src/lib.rs`. The output borrows the complete original receipt and contains the later, explicitly unverified response or a missing observation. Read once only for an indeterminate attempt; refuse dry-run, failed preflight, successful and known-failure receipts before I/O. Preserve earlier inverses, untouched items, original failure and scope commitment. Never infer causal success, quiescence, peer authentication, retry permission or restoration authority from matching metadata. Keep original rollback refusal unchanged. No separate state classifier is needed for this audit-only API. + +In `src/full_text_write_tests.rs`, commit RED tests before implementation. Test unknown first/second writes, actual advanced request preconditions, delayed before/after/foreign/malformed responses, failed reads, preserved receipt bytes and authority redaction, zero-I/O refusal of non-unknown receipts and continued rollback refusal. Synthetic unit fixtures are not campaign decisions. Run the focused command from Task 1, then all Task 3 gates unchanged. Keep failed experiments in history and append their evidence to ignored `results.tsv`. + +Zotero's official write documentation says write tokens are redundant for versioned requests; local tokens are memory-only and disappear on restart. Do not add token replay or assume a delayed read proves the outcome of an earlier request. Durable restoration and governed resolution remain separate gaps. Record these primary references and this ceiling in ADR 0007, the audit and Gap baseline; update the existing PR and hourly continuation, not another writer or task. From dcc36310394c68fca74251ae85fe72d942be32ba Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 17:25:35 +0900 Subject: [PATCH 12/52] feat: retain read-only evidence for indeterminate full-text writes --- .../src/full_text_write.rs | 59 +++++++++++++++++-- crates/conceptweave-zotero/src/lib.rs | 4 +- 2 files changed, 55 insertions(+), 8 deletions(-) diff --git a/crates/conceptweave-zotero/src/full_text_write.rs b/crates/conceptweave-zotero/src/full_text_write.rs index 828c16e6..ac064bf1 100644 --- a/crates/conceptweave-zotero/src/full_text_write.rs +++ b/crates/conceptweave-zotero/src/full_text_write.rs @@ -63,6 +63,24 @@ pub struct FullTextWriteReceipt { full_text_write_v1: FullTextWriteBinding, #[serde(serialize_with = "serialize_write_result")] write_result: ClassificationWriteReceipt, + #[serde(skip_serializing_if = "Option::is_none")] + indeterminate_request: Option, +} + +/// A later, unverified observation attached to the complete original write receipt. +/// +/// Matching metadata does not establish who changed it or whether an earlier +/// request has finished. This evidence neither clears uncertainty nor authorizes +/// retry or rollback. Save it only as an owner-only artifact; keep earlier views. +/// +/// ```compile_fail +/// use conceptweave_zotero::FullTextWriteObservation; +/// let forged = serde_json::from_str::>("{}"); +/// ``` +#[derive(Serialize)] +pub struct FullTextWriteObservation<'receipt> { + write_receipt: &'receipt FullTextWriteReceipt, + observed_state: Option, } /// One bound rollback attempt, including operations still awaiting resolution. @@ -158,18 +176,47 @@ pub fn build_full_text_write_plan( pub fn execute_full_text_write_plan( plan: &FullTextWritePlan, preflight: impl FnMut(&str) -> Result, - write_item: impl FnMut(&ClassificationWriteRequest) -> Result, + mut write_item: impl FnMut( + &ClassificationWriteRequest, + ) -> Result, ) -> FullTextWriteReceipt { + let mut last_request = None; + let write_result = + crate::execute_classification_write_plan(&plan.write_plan, preflight, |request| { + last_request = Some(request.clone()); + write_item(request) + }); + let indeterminate_request = if write_result.indeterminate_item_key.is_some() { + last_request + } else { + None + }; FullTextWriteReceipt { full_text_write_v1: plan.full_text_write_v1.clone(), - write_result: crate::execute_classification_write_plan( - &plan.write_plan, - preflight, - write_item, - ), + write_result, + indeterminate_request, } } +/// Reads an indeterminate original request's item once, without sending a write. +/// +/// Other receipts fail before I/O. A failed read records no observation and omits +/// the adapter error. Even foreign or malformed returned state remains unverified +/// evidence: the original outcome, inverse work and untouched items never change. +pub fn observe_full_text_write( + receipt: &FullTextWriteReceipt, + read_item: impl FnOnce(&str) -> Result, +) -> Result, FullTextError> { + let request = receipt + .indeterminate_request + .as_ref() + .ok_or(INVALID_WRITE_SCOPE)?; + Ok(FullTextWriteObservation { + write_receipt: receipt, + observed_state: read_item(&request.item_key).ok(), + }) +} + /// Restores verified writes without accepting detached or mixed inverse operations. /// Unknown write state, dry-run and an empty inverse set fail before any I/O. /// An unknown write requires separate write reconciliation, not an empty rollback. diff --git a/crates/conceptweave-zotero/src/lib.rs b/crates/conceptweave-zotero/src/lib.rs index f2142fba..85f0f55b 100644 --- a/crates/conceptweave-zotero/src/lib.rs +++ b/crates/conceptweave-zotero/src/lib.rs @@ -25,8 +25,8 @@ pub use full_text_capture::{ reconcile_full_text_rollback, retry_full_text_reconciled_rollback, retry_full_text_rollback, }; pub use full_text_capture::{ - FullTextWritePlan, FullTextWriteReceipt, FullTextWriteScope, build_full_text_write_plan, - execute_full_text_write_plan, + FullTextWriteObservation, FullTextWritePlan, FullTextWriteReceipt, FullTextWriteScope, + build_full_text_write_plan, execute_full_text_write_plan, observe_full_text_write, }; /// Classification rule revision recorded in every report. From 77e8dce8126d1824f192ccc992c117b177e1bd12 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 17:29:58 +0900 Subject: [PATCH 13/52] docs: distinguish original-write inspection from recovery authority --- AGENTS.md | 1 + ARCHITECTURE.md | 2 ++ CHANGELOG.md | 2 ++ CLAUDE.md | 2 ++ docs/CONTEXT_MAP.md | 1 + docs/PRD.md | 2 ++ docs/TRD.md | 2 ++ docs/UBIQUITOUS_LANGUAGE.md | 1 + docs/UML.md | 8 ++++++++ docs/adr/0007-reviewed-zotero-write-plan.md | 10 ++++++++++ docs/doctoring/zotero_fulltext_contract_audit.md | 8 ++++++++ docs/product-technical-gap-baseline.md | 12 ++++++++++-- 12 files changed, 49 insertions(+), 2 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 742a0be5..78297062 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -21,6 +21,7 @@ ConceptWeave owns automatic, evidence-bound **Semantic Model Engineering**. Do n - Full-text decisions use the separate blank-start worksheet and atomic exact-view application; reverify the capture/report relation through finalization and whole-envelope governance. No reviewed-set downcast grants Zotero write authority. - Offline full-text commands reuse the private-file boundary and pass completed-view bytes unchanged into atomic validation. Finalized files await external approval verification; no CLI command issues approval or writes Zotero. - Full-text writes require a complete typed review, explicit destinations and mode; finish both local validation paths before real authority verification. Keep scope bindings through opaque execution/recovery receipts. Unknown original writes cannot become empty successful rollbacks, and serialized audit files are not executable authority. +- Delayed original-write observations retain the exact submitted request and complete earlier receipt; matching metadata does not prove causal completion or authorize retry/rollback. - Published semantic truth is immutable; correction uses supersession/new release. - Public Rust APIs require beginner-readable documentation. - Owned production coverage target is 100% line/function/region/branch where tooling exposes it. diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 11c33b39..1e0e0c8e 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -40,6 +40,8 @@ The separate Full-Text Review Worksheet starts blank and retains one capture ide Full-Text Write Scope belongs to Research Intake and combines a complete capture-bound semantic review with independently authorized explicit metadata replacements and mode. Existing local validation is composed before either authority verifier. The admitted plan is opaque; bound execution and recovery wrappers reuse the existing conditional Local API cores, with no legacy-plan or free inverse-operation projection. Versioned scope commitments preserve the complete input identity without copying source text into receipts. The scope is not published semantic truth or an approval issuer. Audit serialization cannot restore executable authority; durable recovery and independently unknown original-write reconciliation remain explicit gaps. +An Original Write Observation is a read-only audit projection inside this same context. It retains the opaque original receipt and exact submitted preconditions beside one later unverified response. It cannot clear uncertainty, prove request completion or enter execution/recovery as authority. The existing executor remains the sole mutation path. + ### SemanticCandidate Smallest consistency boundary for a single proposed semantic artifact and its evidence-bound publication state. It cannot jump directly from Draft to Published. diff --git a/CHANGELOG.md b/CHANGELOG.md index 9fc3cc63..38667640 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,8 @@ All notable changes to ConceptWeave are documented here. ### Added +- Unresolved changes can be inspected again without resending them or losing the original outcome. Later observations do not authorize retry or recovery. + - Research inventory now distinguishes three additional statistical-library candidates from adopted integrations and reviewed papers, with source-bound limitations and follow-up requirements. - Full-text-reviewed changes can now carry separately verified destination and execution approval through the local write and recovery workflow. Unknown writes remain unresolved until their state is proven; no command issues approval or changes the live library. diff --git a/CLAUDE.md b/CLAUDE.md index 17f9330b..27601364 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -13,3 +13,5 @@ The separate full-text review view does not authorize decisions or writes. Keep Use the capture-bound blank-start worksheet for full-text decision work. Only the dedicated atomic view path may apply completed slots; finalization/evaluation reverify capture/report bindings and require whole-envelope external approval. Offline CLI view/application/finalization preserve that envelope and earlier files. They do not supply a reviewer, authenticate approval, or admit Zotero writes. The separate typed full-text write boundary additionally requires explicit destinations and mode verified against independent write authority, after all local checks. Keep the complete approved scope on the opaque plan and the same versioned commitment on every execution and recovery outcome. Do not extract legacy plans or mix inverse operations, restore authority from audit JSON, or call an unknown original write restored through empty rollback. No live-write CLI or approval issuer is introduced. + +Delayed original-write inspection preserves the actual submitted request and complete earlier receipt. Its later response is unverified evidence, even when metadata matches; it never clears uncertainty or grants retry/rollback authority. diff --git a/docs/CONTEXT_MAP.md b/docs/CONTEXT_MAP.md index 24ee95fb..e7af942a 100644 --- a/docs/CONTEXT_MAP.md +++ b/docs/CONTEXT_MAP.md @@ -15,6 +15,7 @@ The Full-Text Review View is an in-context read projection over that verified ca ## External relationships - Zotero Local API -> research evidence intake: **Anti-Corruption Layer into Semantic Discovery**. Zotero remains the bibliographic system of record; ConceptWeave consumes a version-pinned snapshot and emits proposal evidence. Execute-mode metadata changes cross only a caller-owned authenticated adapter after complete preflight; ConceptWeave retains no API key and records verified item-level outcomes and rollback coordinates. Item metadata, attachments, collection/tag truth, and write authority remain in Zotero. No Zotero record becomes semantic authority without ConceptWeave validation/review/publication. + Delayed original-write inspection remains a read-only projection of this boundary, retaining the original unknown outcome and exact attempt rather than issuing recovery authority. - contextual-orchestrator -> Semantic Discovery: **Anti-Corruption Layer**. Model/provider envelopes never enter the domain model directly. - LineageWeave -> Source Observation: **Anti-Corruption Layer**. Inferred/proposed lineage remains explicitly non-authoritative until ConceptWeave governance evaluates it. - context-graph-contracts <-> Interoperability: **Shared Kernel only for versioned public contracts**, kept minimal. diff --git a/docs/PRD.md b/docs/PRD.md index 9577be68..6df9bcb7 100644 --- a/docs/PRD.md +++ b/docs/PRD.md @@ -72,6 +72,8 @@ Reviewed collection and tag changes default to a local dry-run plan. Each operat An invalid or stale change request must be rejected before approval is redeemed, including when an earlier item in the same request is valid. A locally valid request reaches approval verification exactly once. For writes based on full-text review, approval must cover the captured evidence, every reviewed label, the explicitly chosen collections and tags, and whether execution was requested. Reviewing meaning does not choose a destination or grant permission to change it. The same approval and evidence identity must remain attached to partial outcomes and recovery. The local library now admits a complete full-text review only with separately verified explicit changes and execution mode. It preserves that binding through writes, rollback, retries and delayed rollback reconciliation. An unknown original write cannot be called restored without evidence. Independent governance integration, durable recovery after process restart, delayed original-write reconciliation and approved live use remain gaps. +An unresolved original change can now be inspected again without resending it. The private result retains the exact attempted change and the complete earlier outcome, including changes already made and papers not attempted. A matching later value is not proof that the earlier request succeeded or finished; failed, foreign and malformed observations cannot grant recovery permission. Resolution and safe recovery remain separate from inspection. + For execute-mode plans, the runtime must preflight every item before the first write, stop at the first failed or unverifiable response, reconcile that item through the same server before declaring its state, and emit a secret-free receipt bound to the exact reviewed plan coordinates. Dry-run receipts enumerate every planned item as untouched. Execution receipts identify verified writes, the failed item, any indeterminate item, untouched items, and reverse-ordered rollback operations bound to the server identity, proven post-write item revision, and complete expected post-write metadata, including an identity- and version-confirmed unexpected mutation. Rollback must reject mixed-server evidence before reading, preflight every receipt item at one current library version before its first inverse write, consume the existing receipt order, advance the library precondition only from a verified response, and reconcile a failed response as restored, unchanged, or indeterminate. Only proven unchanged and untouched operations remain eligible for automatic retry; an indeterminate operation is retained separately with complete reconciliation evidence for an operator. Delayed reconciliation performs one read and no write, preserves the observed state, ignores unrelated library-version advancement, and emits retry evidence only when the exact item revision and expected metadata remain unchanged. A second use of consumed evidence must fail before writing. Cross-item atomicity is not claimed. The Zotero 10+ adapter can accept a caller-owned API key and server identity at runtime or consume one successful, user-approved Local API authorization. Authorization sends one bounded application name and the expected server identity to the fixed loopback endpoint; only a same-server bounded response that explicitly reports denial is classified as the user's decision. Denial and rate limiting return immediately without another prompt or automatic retry. The private 32-character key is neither serializable nor printable. Authorization, read, and write responses bind to the expected server before status classification; writes name expired authorization and matching-server stale preconditions separately. Thin public execution boundaries connect the adapter to the reviewed write and rollback cores without duplicating mutation logic. Synthetic transport evidence does not satisfy AC6's approved live Zotero 10 authorization, write, and rollback requirement. diff --git a/docs/TRD.md b/docs/TRD.md index f586e3b1..7f90c64a 100644 --- a/docs/TRD.md +++ b/docs/TRD.md @@ -106,6 +106,8 @@ Typed full-text write admission requires `FullTextWriteScope`: the complete revi These types are serialize-only and owner-only audit artifacts. They cannot restore executable authority after a restart. Legacy nested write DTOs remain permissive JSON; no strict persisted JSON admission is claimed. There is no new transport, CLI write/approval issuer or cross-service SQL. Whole-scope external authority verification, revocation policy, durable recovery admission, delayed reconciliation of an unknown original write and approved live execution remain incomplete. [Proposed ADR 0007](adr/0007-reviewed-zotero-write-plan.md) records the trade-offs. +For an indeterminate original write, the bound receipt additionally retains the exact request sent through the existing executor callback, including the library precondition advanced by earlier successful writes. `observe_full_text_write` accepts only that opaque receipt and calls the supplied reader once for its retained item key. Its serialize-only result borrows the complete original receipt and records the later unverified state, or no state on read failure, without adapter errors. Non-indeterminate receipts fail before I/O. No state classifier, mutation callback, automatic retry or executable restoration is introduced. Even matching after-state cannot establish causal attribution or request quiescence; unknown original-write rollback remains refused. Zotero write tokens are redundant for versioned requests and local token caches do not survive restart (Zotero, 2026c; see the full-text audit references). + `conceptweave-zotero` reads only the loopback Local API with at most 100 records per page, an 8 MiB page-body limit, a 50,000-item whole-snapshot limit, a 256 MiB cumulative body limit, redirects disabled, and finite connect/response/body/global timeouts. Every request pins `Zotero-API-Version: 3`; every response must report API version 3, while its schema version is recorded and must remain stable across the snapshot. Before another request is issued, exhausted whole-snapshot budgets fail closed. Before a parsed page is accumulated, checked item-count and byte arithmetic must remain within both the advertised total and the configured whole-snapshot budgets. `Total-Results`, `Last-Modified-Version`, Zotero version, and server identity must remain identical across all pages; contract drift, malformed JSON, an empty intermediate page, duplicate keys, or an oversized response fails the run. Every top-level bibliographic record receives exactly one proposed disposition. `NeedsStewardReview` also records a deterministic abstention reason so missing classification metadata, vocabulary unsupported by the current deterministic rules, and present-but-unmatched metadata are distinguishable. Its nonempty abstract is retained exactly once in the local report: an abstract that triggered conflicting rules remains in matched evidence, while other abstention abstracts use the review-only field. Non-abstained items omit that field. DOI duplicate identity normalization treats bare DOI values, `doi:`, `doi.org`, and legacy `dx.doi.org` resolver forms as the same identity when their normalized DOI is equal. diff --git a/docs/UBIQUITOUS_LANGUAGE.md b/docs/UBIQUITOUS_LANGUAGE.md index 28a21741..e34a6ed6 100644 --- a/docs/UBIQUITOUS_LANGUAGE.md +++ b/docs/UBIQUITOUS_LANGUAGE.md @@ -23,6 +23,7 @@ | Reviewed Classification Change | Authorized complete replacement of one paper's collection and tag state, bound to its observed revision. | | Classification Write Plan | Local deterministic dry-run artifact containing exact preconditions and before/after/rollback metadata; not proof of execution. | | Classification Write Receipt | Secret-free, reviewed-plan-bound result that distinguishes dry-run, verified completion, preflight failure, and partial failure while retaining applied, failed, untouched, and safely reversible coordinates. | +| Original Write Observation | Later unverified item state attached to the complete unresolved write receipt and exact submitted request; not proof of causal completion or recovery authority. | | Classification Rollback Operation | Reverse-ordered complete-state restoration bound to the post-write item revision returned by the Local API. | | Reviewed Duplicate Merge Set | Complete steward decisions selecting one consistent canonical item across every overlapping duplicate group in a snapshot. | | Authority Receipt | Opaque proof checked by the Governance & Publication boundary; it contains no reviewer identity or credential. | diff --git a/docs/UML.md b/docs/UML.md index 37163488..6f682048 100644 --- a/docs/UML.md +++ b/docs/UML.md @@ -106,6 +106,14 @@ sequenceDiagram opt destination authority accepted Intake->>Report: opaque plan and versioned scope commitment Note over Intake,Report: execution, rollback, retry and delayed rollback reconciliation retain this commitment + opt original write remains indeterminate + Intake->>Report: retain exact submitted request and complete unknown outcome + Steward->>Intake: request read-only inspection using opaque receipt + Intake->>Zotero: read retained item once; never resend change + Zotero-->>Intake: later unverified state or read failure + Intake->>Report: observation attached to unchanged original receipt + Note over Intake,Report: matching values grant no completion, retry or rollback claim + end end end end diff --git a/docs/adr/0007-reviewed-zotero-write-plan.md b/docs/adr/0007-reviewed-zotero-write-plan.md index 97934272..a65015e2 100644 --- a/docs/adr/0007-reviewed-zotero-write-plan.md +++ b/docs/adr/0007-reviewed-zotero-write-plan.md @@ -50,6 +50,16 @@ Positive consequences are one validation source per contract, explicit destinati Implementation references: Serde Project. (n.d.). *Field attributes*. Retrieved September 6, 2026, from https://serde.rs/field-attrs.html; Serde Project. (n.d.). *Implementing Serialize*. Retrieved September 6, 2026, from https://serde.rs/impl-serialize.html. Existing dependency APIs only; Context7 returned its monthly quota limit, so these official references were checked directly. DeepWiki has no indexed ConceptWeave repository. The owner source and tests are the implementation evidence. +## Original-write observation follow-up (2026-09-06; still Proposed) + +In the context of inspecting an original write after its immediate verification failed, facing loss of the actual submitted precondition and the risk of treating later matching values as completion, we decided for one read-only observation attached to the unchanged opaque attempt and against automatic replay or equality-based recovery admission, to achieve auditable inspection without expanding authority, accepting that durable resolution and approved recovery remain unfinished. + +For example, the first item can advance the library revision before the second write loses its response. The plan's initial library revision cannot identify that second request's precondition. Runtime `dcc36310394c68fca74251ae85fe72d942be32ba` retains the exact last submitted request only when the existing executor reports it indeterminate. It neither reconstructs that version from inverse work nor creates a second executor. The later observation borrows the complete original receipt, preserving earlier inverse operations, the failed item, untouched items and the same scope commitment. Failed reads omit adapter errors; foreign or malformed returned state remains explicitly unverified evidence. Dry-run, preflight failure, successful and known-failure receipts cannot invoke this read path. The unknown outcome is never cleared and the existing rollback guard still refuses it. + +Rejected alternatives include a before/after classifier that would suggest causal completion without proving the earlier request has stopped, and a write-token retry engine. Official Zotero documentation makes tokens redundant for versioned requests; local token caches are memory-only and forgotten on restart. Neither a cached token nor matching metadata supplies governance, durable history or peer authentication. This additive inspection improves operator evidence while leaving the resolution gate closed; it does not complete original-write recovery. Retain the owner-only original scope to verify its commitment and earlier observation files to reconstruct history. + +RED `e300eb8` failed with the absent observation API. The candidate passed eleven focused functions and 255 workspace tests in 41 unfiltered suites, including seven compile-fail doctests, plus the unchanged static and coverage gates recorded in the Gap baseline. Tests exercise unknown first/second writes, before/after/foreign/malformed/failed observations, exact advanced preconditions, preserved original receipt serialization, redacted authority inputs and continued zero-I/O recovery refusal. These are synthetic unit cases, not live request or approval evidence. Research references and the scope limits are recorded in the full-text audit. No ADR number, Accepted status or protected branch rule changes. + ## Consequences - Review and rollback semantics can be tested on Zotero 9 without changing the library. diff --git a/docs/doctoring/zotero_fulltext_contract_audit.md b/docs/doctoring/zotero_fulltext_contract_audit.md index 3eb9713f..cdeca6e4 100644 --- a/docs/doctoring/zotero_fulltext_contract_audit.md +++ b/docs/doctoring/zotero_fulltext_contract_audit.md @@ -138,6 +138,12 @@ The subsequent [private command evidence](zotero_bound_review_commands_evidence. For restored owned review artifacts, unknown fields must fail instead of disappearing during deserialization. Serde documents that distinction and disallows combining its strict container attribute with flattening (Serde contributors, n.d.). JSON object-name duplication has inconsistent receiver behavior under RFC 8259; ConceptWeave rejects duplicate decoded keys recursively before comparing completed evidence views, rather than accepting last-key-wins projection (Bray, 2017, Section 4). These primary references support the input-contract choice, not semantic-label correctness. Context7's monthly quota was exhausted and DeepWiki did not index this repository during this follow-up; direct official documentation and current source/tests supplied the evidence. +## Indeterminate original-write inspection (2026-09-06) + +The official Local API and write-request documentation, reread September 6, distinguish version preconditions from duplicate-prevention tokens. Tokens are optional for unversioned writes, duplicate successful tokens return a precondition failure, and versioned requests should omit the redundant token. Zotero 10's local cache is held in memory for up to 12 hours and disappears on restart (Zotero, 2026a, 2026c). These are documented semantics, not a live write/restart experiment. No authorization prompt or source mutation ran here. + +ConceptWeave therefore adds inspection rather than token replay. At `dcc36310394c68fca74251ae85fe72d942be32ba`, an indeterminate full-text write receipt retains the actual submitted request, including any library revision advanced by earlier successful writes. One later read returns unverified evidence attached to the unchanged original receipt. Matching metadata alone is insufficient evidence of causal completion or quiescence; this is a conservative design conclusion, not a claim that Zotero documents a durable reconciliation endpoint. Prior inverse work and untouched items stay attached, read failures omit errors, and unknown-write rollback remains denied. The [Proposed ADR](../adr/0007-reviewed-zotero-write-plan.md#original-write-observation-follow-up-2026-09-06-still-proposed) records alternatives, examples, costs and remaining durable/governance gaps. No private capture was read, paper decision added or approval verified. + ## References Bray, T. (Ed.). (2017). *The JavaScript Object Notation (JSON) data interchange format* (RFC 8259, Section 4). Internet Engineering Task Force. https://www.rfc-editor.org/rfc/rfc8259#section-4 @@ -152,4 +158,6 @@ Zotero. (2026a, July 29). *Zotero local API*. https://www.zotero.org/support/dev Zotero. (2026b, July 29). *Zotero Web API full-text content requests*. https://www.zotero.org/support/dev/web_api/v3/fulltext_content +Zotero. (2026c, July 29). *Zotero Web API write requests*. https://www.zotero.org/support/dev/web_api/v3/write_requests + Zotero. (n.d.). *Zotero* (Version 10.0.1, commit 36749bd0bd4fdac9ee46c16f7aa7bed094a0851f) [Computer software]. GitHub. https://github.com/zotero/zotero/tree/36749bd0bd4fdac9ee46c16f7aa7bed094a0851f diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index a0b50d2d..85e9d7d2 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,15 @@ This file records code-current product and technical gaps. Exact PR/check/run coordinates are evidence snapshots, not mutable-head dependencies. Live protected-branch, PR, issue and workflow state wins whenever it advances after this snapshot. Refresh the changed PR's metadata after each documentation commit; evidence from another PR or an earlier head does not transfer. -## Latest owner-discovery checkpoint +## Latest original-write inspection checkpoint + +Runtime `dcc36310394c68fca74251ae85fe72d942be32ba` extends the existing #39 owner lane with read-only inspection of indeterminate original writes. The committed RED `e300eb8` failed at both absent observation API calls. The implementation retains the actual submitted request, including the current library precondition after earlier writes, and attaches one later unverified response to the unchanged opaque receipt. Previous inverses, failed and untouched items, authority redaction and scope commitment remain intact. Non-indeterminate receipts cannot read; no observation clears uncertainty or grants retry/rollback authority. This closes the missing-attempt-evidence/inspection portion only, not causal resolution or durable recovery. See [Proposed ADR 0007](adr/0007-reviewed-zotero-write-plan.md#original-write-observation-follow-up-2026-09-06-still-proposed), [TRD](TRD.md), [plan Task 4](plans/2026-09-06_full_text_write_admission.md#task-4-observe-an-indeterminate-original-request-without-clearing-it) and [official-source audit](doctoring/zotero_fulltext_contract_audit.md#indeterminate-original-write-inspection-2026-09-06). + +Fresh locked Rust 1.98.0 baseline at `789637f6a54373c3176e42dda78b1075937fd273` was **252 tests / 41 unfiltered suites**. The candidate passes **255 / 41**, including seven doctests; eleven focused admission/recovery test functions pass. Strict all-target Clippy, formatting, warnings-denied rustdoc, CI contract, release build and diff checks pass. The unchanged coverage gate passes **404/404 functions, 4,448/4,448 source-normalized regions and 752/752 normalized branch outcomes**. Raw LLVM remains **4,971/5,045 lines, 7,164/7,321 regions and 697/752 branches**. Normalized regions are unchanged under the existing normalizer; this does not mean the source delta is empty or raw coverage is 100%. No threshold, exclusion, dependency or test denominator was changed. Logs: `/tmp/conceptweave-original-write-{baseline,red,focused,final-tests,coverage,clippy,rustdoc,release}-20260906.log`. + +This is local source evidence, not approved live execution, independent review, hosted GREEN, merge or release. Before this push, PR #39 was reread OPEN Draft at `789637f6a54373c3176e42dda78b1075937fd273`, base `8e057652ee7784b373beeeec865d80dd3db773be`, with no reviews and CodeRabbit draft-skip only. Refresh the final head after documentation/push. Source audits remain **30/76**, release-bearing sources **7/30**, lifecycle capability **28**, and last actual decisions/independent approvals each **0/3,715**. Observation hardening does not increase those metrics. No private paper, Zotero request, model request, credential or authority issuer was used. Continue protected prerequisite work with existing owners, authentic review/governance, released CO consumption, durable admission, governed original-write resolution and approved live write/rollback; the goal remains active. + +## Previous owner-discovery checkpoint The September 6 07:54–08:00 UTC [statistical-library source audit](doctoring/cwl_ontology_capability_inventory.md#statistical-library-contract-audits-2026-09-06) advances source coverage **27/76 → 30/76**, leaving **46** repositories. The organization census still has 76 repositories, one archived and 11 forks. kaefa, aFIPC and nonnest2 provide adjacent model-search, calibration and comparison evidence, not ontology publication authority. Their protected default heads, complete trees, package declarations, selected implementation and regression definitions are recorded. Their GitHub release/tag queries are empty; CRAN publication remains unverified after retrieval errors. Release-bearing candidates remain seven, now **7/30**. No R test or estimation run, dependency adoption or source copy occurred. @@ -14,7 +22,7 @@ The [CO release recheck](doctoring/zotero_fulltext_contract_audit.md#september-6 Before this documentation increment, #39 remained OPEN Draft at `6cefb4f15e7072448e32414418f5d99460d72075`, exact #38 base `8e057652ee7784b373beeeec865d80dd3db773be`, with zero reviews and CodeRabbit draft-skip only. Documentation commit `3acd93f512e7e9e3e66c22dfef02f18c4df1ff6a` passed a fresh locked Rust 1.98.0 workspace run: **252 tests / 41 unfiltered suites**, including six doctests. The CI contract, formatting, diff checks and unique 30-row inventory assertion passed. `git diff bdf55bfb95b3e688e9ec58eda2785d17ed853b4e HEAD -- crates Cargo.toml Cargo.lock scripts` is empty, so no R implementation or new Rust behavior was tested; the earlier coverage result is not a fresh coverage run. The test log is `/tmp/conceptweave-statistical-owner-tests-20260906.log`. Final documentation requires a fresh PR-head read. Remaining work includes protected prerequisite integration, authentic full-denominator review and independent governance, released CO consumption, durable recovery admission, delayed unknown-original-write reconciliation and approved live write/rollback. The goal remains active. -## Latest full-text write checkpoint +## Previous full-text write checkpoint Runtime `bdf55bfb95b3e688e9ec58eda2785d17ed853b4e` on `codex/zotero-fulltext-write-admission` adds complete typed full-text/write-scope admission, opaque execution and bound conditional recovery after #38's `8e057652ee7784b373beeeec865d80dd3db773be`. It does not extract a metadata-only review or legacy executable plan. Existing golden/write validation bodies are reused privately before either actual verifier; explicit destination/mode verification is separate from semantic approval. A later invalid item or changed capture/proposal/label makes zero authority calls. A locally valid accepted request reaches both exactly once, and semantic denial prevents write verification. From b645d6acc9396aabe05294dc617fce5b70bd3223 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 18:03:39 +0900 Subject: [PATCH 14/52] docs: record canonical source observation repair evidence --- docs/product-technical-gap-baseline.md | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 85e9d7d2..7b2abde6 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,19 @@ This file records code-current product and technical gaps. Exact PR/check/run coordinates are evidence snapshots, not mutable-head dependencies. Live protected-branch, PR, issue and workflow state wins whenever it advances after this snapshot. Refresh the changed PR's metadata after each documentation commit; evidence from another PR or an earlier head does not transfer. -## Latest original-write inspection checkpoint +## Latest Source Observation prerequisite checkpoint + +The canonical Source Observation owner explicitly handed off PR #6's UNIQUE null-comparison finding, with no overlapping writer. An isolated worktree retained `e3c415600300b6c2d5b852c457ea6ab2e5222e08` and unchanged Client #5 base `fcf36c8a99f015b963c9f812787df127ac2e2f9e`, then normally pushed exact successor `331f8edcd7cebb1719e5cea3187f3848ce7b9e71`. [PR #6](https://github.com/ContextualWisdomLab/ConceptWeave/pull/6) remains OPEN Draft. This research lane records its evidence without copying or adopting the unprotected supplier source. + +The executed regression reproduced equal digests for different observed UNIQUE null behavior at `bab6984`; the explicit v2 framing test added a second failure at `8b5b738`. The repair reuses the optional-boolean encoder to preserve unknown, observed distinct and observed not-distinct in typed facts, snapshot identity and receipts. Historical v1 evidence remains immutable. The [exact-head owner report](https://github.com/ContextualWisdomLab/ConceptWeave/blob/331f8edcd7cebb1719e5cea3187f3848ce7b9e71/docs/doctoring/source-observation-unique-null-semantics.md) records full hashes, PostgreSQL primary sources, APA references and Proposed ADR 0004's alternatives and compatibility cost. No PostgreSQL adapter, business-key inference or semantic approval is introduced. + +Actual baseline execution also exposed Client documentation, formatting, strict Clippy and coverage failures. Ordinary commits retain the failures and fix the missing explanation, test-only async/waker wrappers, untested policy/expiry rejections and a redundant overflow guard. The shared byte guard checks the remaining admitted capacity before addition; exact cumulative UTF-8 limits and typed denials are unchanged. No test threshold, dependency, production port signature or source-policy ceiling was weakened. + +Final owner head passes **132 tests / 42 suites including two doctests**, strict fmt/Clippy/rustdoc, release build and the unchanged coverage gate: **228/228 functions, 2026/2026 source-normalized regions, 194/194 normalized branches**. Raw LLVM is **1807/1825 lines, 2192/2206 regions, 188/194 branches**, not 100%. Product contract, actionlint, three JSON schemas/twelve fixtures, supersession controls and unchanged lockfile pass. Installed cargo-deny reports advisories OK under its default configuration; that is not hosted security acceptance. An independent exact-head review was requested from the existing owner task, without issuing approval or starting another source writer. + +Fresh protected `main` remains `f4f440dd58c77d7cd90dff8a1eb2eeb9a9940425`. Ruleset `18156473` still requires independent approval, stale-review dismissal, resolved review threads and seven central workflows, with deletion/non-fast-forward protection. Local success does not satisfy those gates. Keep both Source Observation ADRs Proposed and retain prerequisite PRs. Repository audits **30/76**, release-bearing sources **7/30**, lifecycle capability **28**, and last actual decisions/independent approvals **0/3,715** are unchanged. No private paper, Zotero/model request, credential or authority issuer was used in this repair. The next safe work remains current-head review/root repair, protected prerequisite integration, released owner consumption and genuine full-denominator research governance. + +## Previous original-write inspection checkpoint Runtime `dcc36310394c68fca74251ae85fe72d942be32ba` extends the existing #39 owner lane with read-only inspection of indeterminate original writes. The committed RED `e300eb8` failed at both absent observation API calls. The implementation retains the actual submitted request, including the current library precondition after earlier writes, and attaches one later unverified response to the unchanged opaque receipt. Previous inverses, failed and untouched items, authority redaction and scope commitment remain intact. Non-indeterminate receipts cannot read; no observation clears uncertainty or grants retry/rollback authority. This closes the missing-attempt-evidence/inspection portion only, not causal resolution or durable recovery. See [Proposed ADR 0007](adr/0007-reviewed-zotero-write-plan.md#original-write-observation-follow-up-2026-09-06-still-proposed), [TRD](TRD.md), [plan Task 4](plans/2026-09-06_full_text_write_admission.md#task-4-observe-an-indeterminate-original-request-without-clearing-it) and [official-source audit](doctoring/zotero_fulltext_contract_audit.md#indeterminate-original-write-inspection-2026-09-06). From 1444c44135fb822590516156e6570fd9e17eca8f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 18:26:01 +0900 Subject: [PATCH 15/52] docs(research): audit relationship evidence owners --- CHANGELOG.md | 2 + docs/CONTEXT_MAP.md | 3 ++ docs/PRD.md | 2 + docs/TRD.md | 2 + docs/UBIQUITOUS_LANGUAGE.md | 1 + docs/adr/0006-zotero-research-intake.md | 8 ++++ .../cwl_ontology_capability_inventory.md | 39 +++++++++++++++++-- docs/product-technical-gap-baseline.md | 10 ++++- 8 files changed, 62 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 38667640..46148bb3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,8 @@ All notable changes to ConceptWeave are documented here. ### Added +- Research inventory now separates message ancestry, data changes and work dependencies from reviewed semantic relationships, with release limits and owner follow-up evidence. + - Unresolved changes can be inspected again without resending them or losing the original outcome. Later observations do not authorize retry or recovery. - Research inventory now distinguishes three additional statistical-library candidates from adopted integrations and reviewed papers, with source-bound limitations and follow-up requirements. diff --git a/docs/CONTEXT_MAP.md b/docs/CONTEXT_MAP.md index e7af942a..b851da14 100644 --- a/docs/CONTEXT_MAP.md +++ b/docs/CONTEXT_MAP.md @@ -14,6 +14,9 @@ The Full-Text Review View is an in-context read projection over that verified ca ## External relationships +- ThreadWeave -> Source Observation: **Proposed Anti-Corruption Layer**, pending released-contract/source binding and consumer conformance. Header ancestry and subject grouping retain their method and missing-reference limitations; message/thread identity is not semantic equivalence. +- mightyETL -> Source Observation: **Proposed Anti-Corruption Layer**, pending a licensed, released observation contract. Actual row-change producer/payload capability remains distinct from a value-free catalog snapshot and from DDL coverage; no replica-write or application-table authority transfers. +- scopeweave -> Source Observation: **Proposed Anti-Corruption Layer**, pending a released work-dependency contract. WBS meaning, link types/lags, cycle/dangling diagnostics and heuristic readiness remain owner evidence, not semantic confidence or ConceptWeave production arithmetic. - Zotero Local API -> research evidence intake: **Anti-Corruption Layer into Semantic Discovery**. Zotero remains the bibliographic system of record; ConceptWeave consumes a version-pinned snapshot and emits proposal evidence. Execute-mode metadata changes cross only a caller-owned authenticated adapter after complete preflight; ConceptWeave retains no API key and records verified item-level outcomes and rollback coordinates. Item metadata, attachments, collection/tag truth, and write authority remain in Zotero. No Zotero record becomes semantic authority without ConceptWeave validation/review/publication. Delayed original-write inspection remains a read-only projection of this boundary, retaining the original unknown outcome and exact attempt rather than issuing recovery authority. - contextual-orchestrator -> Semantic Discovery: **Anti-Corruption Layer**. Model/provider envelopes never enter the domain model directly. diff --git a/docs/PRD.md b/docs/PRD.md index 6df9bcb7..302b26db 100644 --- a/docs/PRD.md +++ b/docs/PRD.md @@ -56,6 +56,8 @@ All LLM-backed induction uses released `contextual-orchestrator` contracts. Mode ### FR-9 Research evidence intake +Message ancestry, source-data changes and work dependencies may supply different kinds of research evidence, but none automatically establishes a semantic relationship. Reviewers must see missing references, cycles, heuristic grouping and producer limitations. A registry entry or package version does not establish the exact API available for adoption. The [threading/CDC/work-dependency audit](doctoring/cwl_ontology_capability_inventory.md#threading-cdc-and-work-dependency-contracts-2026-09-06) assigns follow-up to existing owners; it neither classifies papers nor creates another utility service. + Repository capability discovery and paper classification are separate measures. A statistical library's model fit, factor structure or linked score is not an ontology label or approval. Before such evidence can inform a candidate, reviewers need its population/design, applicable item or observation versions, unavailable results and complete failure denominator. The [statistical-library audit](doctoring/cwl_ontology_capability_inventory.md#statistical-library-contract-audits-2026-09-06) records cultivation requirements, not adopted scoring rules or completed paper reviews. Read one immutable Zotero Local API library-version snapshot and propose exactly one research disposition for every top-level bibliographic item. Each proposal retains the item key/version, exact matched metadata values, rule revision, linked child records, and any model receipt. Weak evidence and evidence that matches multiple specific disposition families must abstain into steward review. A local abstention retains its nonempty abstract exactly once, as matched evidence when applicable or otherwise as review context; decided items omit the review-only copy. Duplicate DOI/title identities are review candidates only: intake never merges, deletes, or silently mutates Zotero records. diff --git a/docs/TRD.md b/docs/TRD.md index 7f90c64a..70269cec 100644 --- a/docs/TRD.md +++ b/docs/TRD.md @@ -57,6 +57,8 @@ Source artifacts are untrusted input. Adapters must enforce source size/type bou ## 10. Evaluation +Future relationship-evidence admission must preserve owner/source revision, method and original relation kind. Thread-derived edges need header/fallback versus optional subject-grouping provenance, duplicate identities and missing-parent state. CDC observations need real producer/payload capability, source position and coverage; row events do not prove complete catalog or DDL history. Work dependencies need task revision, FS/SS/FF/SF type, lag units, cycle state and rejected/dangling-link diagnostics. Fixed readiness weights cannot become estimated semantic confidence. These are proposed conformance requirements from the [three-owner audit](doctoring/cwl_ontology_capability_inventory.md#threading-cdc-and-work-dependency-contracts-2026-09-06), not implemented ports, adopted source or permission to read another application's tables. + Future statistical-evidence admission must bind response population/design, modeled-variable identity, paired observation order and missingness, estimator/criterion revision, applicable anchor/item/category versions, and attempted/failed/unavailable counts. Preserve declared versus applied/skipped anchors and distinguish model distinguishability from relative fit. A fit statistic is not calibrated semantic confidence. The [kaefa/aFIPC/nonnest2 source audit](doctoring/cwl_ontology_capability_inventory.md#statistical-library-contract-audits-2026-09-06) identifies owner conformance work, not implemented consumer contracts. Existing measurement owners retain computation; no legacy R code, new Python/R hot path or heuristic scoring fallback is adopted. A future owner release must meet the Rust-first production policy and exact-consumer verification before use. Evaluation must separate extraction recall, semantic correctness, structural correctness, ontology consistency, mapping accuracy, measure correctness, and governance outcomes. Model-judge scores may supplement but never replace deterministic golden fixtures and human-reviewed expert cases. diff --git a/docs/UBIQUITOUS_LANGUAGE.md b/docs/UBIQUITOUS_LANGUAGE.md index e34a6ed6..e5ae4eee 100644 --- a/docs/UBIQUITOUS_LANGUAGE.md +++ b/docs/UBIQUITOUS_LANGUAGE.md @@ -8,6 +8,7 @@ | Full-Text Review Worksheet | Separate private work that starts with blank decisions for every bibliographic item and retains one verified capture identity through decision application; not authenticated history or approval. | | Capture-Bound Reviewed Set | Complete non-abstention labels and a capture-bound approval input, all presented together for independent governance verification; never a classification-write authorization. | | Observation | Deterministically extracted fact from a Source Snapshot. | +| Relationship Evidence | Source-bound support retaining its original kind, extraction method and limitations; message ancestry, row changes and work dependencies are not interchangeable semantic assertions. | | Evidence Reference | Stable source identity, digest, and location supporting a candidate. | | Semantic Candidate | Evidence-bound proposal for a concept, relation, constraint, dimension, measure, or physical mapping. | | Semantic Model Proposal | Versioned collection of candidates presented for validation/review. | diff --git a/docs/adr/0006-zotero-research-intake.md b/docs/adr/0006-zotero-research-intake.md index dfb79d87..8734bfe4 100644 --- a/docs/adr/0006-zotero-research-intake.md +++ b/docs/adr/0006-zotero-research-intake.md @@ -47,6 +47,14 @@ No dedicated utility repository or Zotero mutation path is created. A future Zot ## Consequences +### 2026-09-06 relationship-owner discovery amendment (Proposed) + +In the context of identifying CWL relationship evidence for research intake, facing different meanings of message ancestry, database changes and project dependencies plus incomplete source-to-release bindings, we decided for exact-source audits and proposed owner-specific admission requirements, and against copying implementations, accepting every edge as semantic truth or creating a new utility repository, to preserve observable provenance and existing domain ownership, accepting that integration and paper-decision counts do not advance yet. + +The [ThreadWeave/mightyETL/scopeweave audit](../doctoring/cwl_ontology_capability_inventory.md#threading-cdc-and-work-dependency-contracts-2026-09-06) links protected source, selected regression definitions, three executed work-dependency unit scripts and primary references. ThreadWeave's PyPI 0.1.0 metadata is not current 0.2.0 source provenance. mightyETL's PostgreSQL DDL description contradicts version-matched provider documentation and was routed to its existing documentation owner, not repaired in the consumer. scopeweave's cycle/missing-link behavior and fixed readiness weights must remain visible. For example, a missing mail ancestor cannot become a fabricated organization relation, and a quiet CDC topic cannot certify that no schema change occurred. + +The benefit is a testable consumer boundary before adoption; the cost is delayed reuse while licensing, real producer capability, owner releases and exact-consumer verification remain unresolved. Direct source reuse was rejected because it would duplicate owners and import their runtime/meaning assumptions. A separate utility was rejected because no independent consumer/deployment need was demonstrated. Follow-up belongs first in those canonical owners, including a failing DDL-capability documentation check, followed by protected review and release; ConceptWeave then needs source-bound conformance with missing, cyclic, unsupported and heuristic observations. This amendment adds no runtime, approved dependency or publication authority and does not change the ADR's Proposed status. + ### 2026-09-06 statistical-owner discovery amendment (Proposed) In the context of identifying reusable evidence from CWL statistical libraries, facing source-level implementations without verified consumer releases and methods with different population/anchor/observation assumptions, we decided to record exact-source cultivation requirements within the existing Research Intake inventory, and against importing their numerical code, inventing relevance weights or creating another utility owner, to keep research evidence distinct from semantic decisions, accepting that release, design-conformance and runtime validation remain prerequisites. diff --git a/docs/doctoring/cwl_ontology_capability_inventory.md b/docs/doctoring/cwl_ontology_capability_inventory.md index 5703c13d..ceeca4e7 100644 --- a/docs/doctoring/cwl_ontology_capability_inventory.md +++ b/docs/doctoring/cwl_ontology_capability_inventory.md @@ -4,11 +4,11 @@ Evidence snapshot: 2026-09-06. Status: research inventory, not dependency-adopti ## Scope and evidence limits -The paginated organization metadata census returned 76 repositories, including one archived repository and 11 forks; the September 6 08:00 UTC refresh confirmed the same counts. Name/description screening for ontology, semantic, knowledge graph, schema, RDF, SHACL, provenance and lineage was combined with the existing Context Map; metadata matches alone miss owners whose descriptions do not use those words. This expanded the original eight-candidate audit to 12 selected candidates. The organization product-goal directive then identified DiskSage's actual OWL use, expanding the audit to 13. naruon and pg-erd-cloud brought the count to 15. Five domain/interoperability audits brought coverage to 20; three further domain and two document-contract audits brought it to 25/76. Keyverse and inkspan brought it to 27/76; the three statistical-library audits below bring the current count to **30/76**, leaving **46**. This does not prove that all relevant implementations have been found. +The paginated organization metadata census returned 76 repositories, including one archived repository and 11 forks; the September 6 follow-up refresh confirmed the same counts. Name/description screening for ontology, semantic, knowledge graph, schema, RDF, SHACL, provenance and lineage was combined with the existing Context Map; metadata matches alone miss owners whose descriptions do not use those words. This expanded the original eight-candidate audit to 12 selected candidates. The organization product-goal directive then identified DiskSage's actual OWL use, expanding the audit to 13. naruon and pg-erd-cloud brought the count to 15. Five domain/interoperability audits brought coverage to 20; three further domain and two document-contract audits brought it to 25/76. Keyverse and inkspan brought it to 27/76; three statistical-library audits brought it to 30/76. The threading, CDC and work-dependency audits below bring the current count to **33/76**, leaving **43**. This does not prove that all relevant implementations have been found. Each row separates responsibility, exact default-head documentation or tree evidence, and published GitHub release evidence. A name, open PR or protected branch alone does not prove a usable released API. This is not a complete package-registry, deployment, attestation or consumer-conformance audit; bounded follow-up attempts and their limitations are recorded below. CalendarWeave and four-pillars were initially screened from metadata only; their subsequent source audits now distinguish a bootstrap owner from an implemented product-domain model without excluding either by description alone. -GitHub repository, branch, README-at-SHA, complete-tree and release endpoints supplied these observations. All 30 selected default branches reported protected at their recorded observations. Several use `develop` or `master`; do not substitute a branch named `main` for the actual default shown in each row. For the original 13 candidates, GitHub detected MIT for semantic-data-portal, TEPP, LineageWeave, fast-mlsirm and disksage; Apache-2.0 for RankWeave, graphify, Veilpick and mhtml-etl-gateway; and no SPDX identifier for the other four. An undetected license is unresolved evidence, not permission to adopt. The naruon audit read an explicitly proprietary license despite public visibility and NOASSERTION metadata; pg-erd-cloud's exact license contains Apache-2.0 without an appended noncommercial restriction. DeepWiki had no indexed evidence for graphify, Veilpick, disksage, pg-erd-cloud or the fifteen further candidates below, so exact GitHub source/tree was used instead. +GitHub repository, branch, README-at-SHA, complete-tree and release endpoints supplied these observations. All 33 selected default branches reported protected at their recorded observations. Several use `develop` or `master`; do not substitute a branch named `main` for the actual default shown in each row. For the original 13 candidates, GitHub detected MIT for semantic-data-portal, TEPP, LineageWeave, fast-mlsirm and disksage; Apache-2.0 for RankWeave, graphify, Veilpick and mhtml-etl-gateway; and no SPDX identifier for the other four. An undetected license is unresolved evidence, not permission to adopt. The naruon audit read an explicitly proprietary license despite public visibility and NOASSERTION metadata; pg-erd-cloud's exact license contains Apache-2.0 without an appended noncommercial restriction. DeepWiki had no indexed evidence for graphify, Veilpick, disksage, pg-erd-cloud or the further candidates below, so exact GitHub source/tree was used instead. ## Owner and maturity evidence @@ -122,12 +122,31 @@ Existing [kaefa issue #48](https://github.com/ContextualWisdomLab/kaefa/issues/4 Kim (2006) and the official mirt fixed-calibration documentation motivate retaining calibration design and distribution assumptions; the mirt documentation's restrictions do not automatically prove that every aFIPC path has identical behavior. Vuong (1989) and Merkle et al. (2016) motivate separating distinguishability, relative fit and semantic correctness. These research implications are future conformance requirements, not new approved Zotero labels. DeepWiki's three tools returned no repository index for each candidate. Context7's previously observed monthly quota remained a documentation limitation; no alternate credentials, package installation or source-copy workaround was used. +## Threading, CDC and work-dependency contracts (2026-09-06) + +The follow-up audit completed three exact-default source inspections and a fresh 76-repository paginated census. All three defaults reported protected. Fresh clones matched the observed heads; complete tracked-file trees contain 107 files for ThreadWeave, 239 for mightyETL and 135 for scopeweave. These are file counts, not the earlier recursive API tree-entry metric. CodeGraph was initialized and consulted before symbol exploration: 58/1,149/2,695, 170/3,376/5,581 and 71/861/3,329 files/nodes/edges respectively. DeepWiki supplied no indexed repository evidence. Context7 remained unavailable under the previously observed monthly quota; version-specific primary documentation was used without bypass. No supplier source or dependency was copied into ConceptWeave. + +| Candidate | Exact default source and demonstrated boundary | Release evidence / cultivation before consumption | +| --- | --- | --- | +| ThreadWeave | `main@0fda6e60c2c80ec7b2aa2d58dac6b944dec6a6d0`; the [canonical threader](https://github.com/ContextualWisdomLab/ThreadWeave/blob/0fda6e60c2c80ec7b2aa2d58dac6b944dec6a6d0/src/threadweave/threading.py#L342-L435) retains duplicate-ID messages, creates missing-reference containers and makes subject grouping caller-selected and disabled by default. [Email conversion](https://github.com/ContextualWisdomLab/ThreadWeave/blob/0fda6e60c2c80ec7b2aa2d58dac6b944dec6a6d0/src/threadweave/adapters.py) preserves payload and supplied mailbox metadata without inventing identity. [pyproject.toml](https://github.com/ContextualWisdomLab/ThreadWeave/blob/0fda6e60c2c80ec7b2aa2d58dac6b944dec6a6d0/pyproject.toml) declares 0.2.0, Python >=3.10 and no runtime dependencies; the root license is Apache-2.0. | Complete GitHub release/tag queries returned zero entries. The [PyPI JSON API](https://pypi.org/pypi/threadweave/json) separately reports only 0.1.0, uploaded July 12, 2026, with non-yanked wheel and source archive. Registry metadata is not an exact source-to-artifact binding for current 0.2.0. Release and verify the needed contract before consumption; keep header-derived ancestry, missing parents, duplicate identity and subject heuristics distinct from semantic or organizational relationships. | +| mightyETL | `develop@e550688c80f0dcf4677c0fbe50bd3341429106fb`; the [publisher](https://github.com/ContextualWisdomLab/mightyETL/blob/e550688c80f0dcf4677c0fbe50bd3341429106fb/cdc-service/src/main/java/com/xtrmetl/cdc/service/CdcService.java#L244-L280) sends raw Debezium key/value JSON. Optional canonical mapping records diagnostics and fails open without blocking publication. The [CDC DTO](https://github.com/ContextualWisdomLab/mightyETL/blob/e550688c80f0dcf4677c0fbe50bd3341429106fb/cdc-service/src/main/java/com/xtrmetl/cdc/spi/CanonicalChangeRecord.java) explicitly documents shallow map snapshots and an unwired live contract, while the [ETL DTO](https://github.com/ContextualWisdomLab/mightyETL/blob/e550688c80f0dcf4677c0fbe50bd3341429106fb/etl-service/src/main/java/com/xtrmetl/etl/connector/ChangeRecord.java) recursively copies Map/List containers. These are distinct paths, not interchangeable immutable evidence envelopes. | No GitHub releases/tags; root Maven version is 1.0-SNAPSHOT with Java 25, and CDC pins Debezium 3.4.0.Final. GitHub license metadata is null and the complete tracked tree has no license/copying/notice-named file; licensing remains unresolved. Establish a licensed, released, bounded observation contract with source position, scope, extraction revision and actual payload semantics. Row values and optional mapping are neither value-free catalog snapshots nor approval of ontology changes. | +| scopeweave | `develop@2c328875e00e86537df3e965170be80532571cad`; [CPM](https://github.com/ContextualWisdomLab/scopeweave/blob/2c328875e00e86537df3e965170be80532571cad/analytics.js#L73-L196) handles FS/SS/FF/SF dependencies and integer lags, returns a cycle flag and best-effort values under cycles, and skips unknown/self links. The separate [PM analysis](https://github.com/ContextualWisdomLab/scopeweave/blob/2c328875e00e86537df3e965170be80532571cad/analytics.js#L366-L531) retains dangling predecessors but computes readiness from keyword signals and fixed 20/25/15/15/15/10 weights. [package.json](https://github.com/ContextualWisdomLab/scopeweave/blob/2c328875e00e86537df3e965170be80532571cad/package.json) declares private 1.0.0, an ESM application and optional Node/Hono server dependencies; root license is MIT. | No GitHub releases/tags. Version/private-package declarations and server files do not prove deployment or a released reusable library. Keep WBS identity, typed links, lag units, discarded-link diagnostics and cycles with the owner. Readiness is an explicit heuristic, not estimated semantic confidence. Future production computation and conformance belong in this owner under the Rust-first policy, not a copied JavaScript hot path. | + +ThreadWeave's [duplicate/cycle cases](https://github.com/ContextualWisdomLab/ThreadWeave/blob/0fda6e60c2c80ec7b2aa2d58dac6b944dec6a6d0/tests/test_threading.py#L103-L133) and [reference-fallback cases](https://github.com/ContextualWisdomLab/ThreadWeave/blob/0fda6e60c2c80ec7b2aa2d58dac6b944dec6a6d0/tests/test_threading.py#L196-L259) were read, not executed. RFC 5256 defines message threading rather than semantic equivalence (Crispin & Murchison, 2008). Current owner documentation identifies incremental identity/snapshot work as an active PR; that is not protected batch behavior. PyPI reports wheel SHA-256 `03c31fa21873a9493687d81eab4ec067bf169dade7cff077b80df46fd0db3aaf` and archive SHA-256 `8ee7c01bf3855fa12ed0d28cbec4f4ba31c405801b535d2931c5870dfe467f98`; neither artifact was downloaded, authenticated, installed or linked to a CWL source commit here. + +mightyETL has a concrete provider/documentation mismatch: [README lines 117–120](https://github.com/ContextualWisdomLab/mightyETL/blob/e550688c80f0dcf4677c0fbe50bd3341429106fb/README.md#L117-L120) describe an option as causing schema-change topics, while [configuration](https://github.com/ContextualWisdomLab/mightyETL/blob/e550688c80f0dcf4677c0fbe50bd3341429106fb/cdc-service/src/main/java/com/xtrmetl/cdc/service/CdcService.java#L293-L321) selects the PostgreSQL connector and defaults to pgoutput. Version-matched Debezium 3.4 documentation states that PostgreSQL logical decoding cannot report DDL change events (Debezium Authors, n.d.). A configured property and an optional DDL consumer do not demonstrate a DDL producer. The finding was handed to [existing documentation issue #159](https://github.com/ContextualWisdomLab/mightyETL/issues/159#issuecomment-5558302366), preserving #202's raw-versus-canonical capability ownership and the old #29 requirement without treating closure as proof. Next action is an owner regression and truthful source/producer inventory, followed by protected verification; no competing branch, new DDL service or runtime test was started. [Raw publisher tests](https://github.com/ContextualWisdomLab/mightyETL/blob/e550688c80f0dcf4677c0fbe50bd3341429106fb/cdc-service/src/test/java/com/xtrmetl/cdc/service/CdcServiceTest.java#L166-L198) and the malformed-key fallback regression were read, not run. + +For scopeweave, three existing scripts ran successfully at the exact cloned head with installed Node v24.19.0: `node tests/unit/cpm.test.mjs`, `node tests/unit/dep-types.test.mjs` and `node tests/unit/pm-analysis.test.mjs`. They cover a 13-day reference network, dependency types/lags, mutual cycles and dangling-link reporting. This is three local unit scripts, not whole-project coverage, real project-data accuracy, browser/E2E or deployment proof. README's develop-only/static-only note lags the present server files; retain the distinction between implementation and deployed service. All three clones have no tracked-source changes; mightyETL alone shows the new untracked `.codegraph/` index, which was retained and not committed. No Java/Python tests, external service, private data or model were exercised. + +Research Intake remains the existing owner. A new utility repository has no demonstrated independent deployment or consumer need. Future consumer admission must retain observation method, owner revision, limitations and review state instead of projecting these different relationship sources into one authority-bearing edge. This audit increases source coverage only; authentic paper decisions, independent approvals and verified adoption do not increase. + ## KPI and next actions | Measure | Observation | Required next evidence | | --- | --- | --- | -| Metadata census / bounded capability audit | 76 metadata records; 30/30 selected candidates have exact default-head documentation/source/tree and release-query evidence | Audit actual contracts/consumers; metadata coverage is not full source-level discovery, and 46 repositories remain unaudited at that depth. | -| GitHub release with resolved source commit | 7/30 selected candidates, including proprietary naruon, product-domain four-pillars, release-diverged newsdom-api and inkspan's historical release without the relevant current contracts | License, artifact/provenance and consumer conformance; a release count is not permissive-library or adoption evidence. | +| Metadata census / bounded capability audit | 76 metadata records; 33/33 selected candidates have exact default-head documentation/source/tree and release-query evidence | Audit actual contracts/consumers; metadata coverage is not full source-level discovery, and 43 repositories remain unaudited at that depth. | +| GitHub release with resolved source commit | 7/33 selected candidates, including proprietary naruon, product-domain four-pillars, release-diverged newsdom-api and inkspan's historical release without the relevant current contracts | License, artifact/provenance and consumer conformance; a release count is not permissive-library or adoption evidence. | +| Additional registry-only publication observation | ThreadWeave 0.1.0 on PyPI; not counted in the seven resolved GitHub releases | Bind the needed API and distribution to reviewed source and attestations; no package-registry completeness claim. | | Verified ConceptWeave adoption | 0 demonstrated in this audit | Released owner contract, exact consumer revision and passing contract/runtime evidence. | | Privately retained nonempty full text | 3,203/3,715 parents in the separate [capture evidence](zotero_fulltext_capture_evidence.json); 512 remain without demonstrated nonempty text | New content-bound proposals and authentic review with partial/unknown indexing. The earlier sweep's 800/1,000 abstract-missing subgroup is availability evidence, not a remeasured retained-capture subgroup. | | Unverified steward decisions | 0/3,715 on the repaired snapshot; first pending batch has 0/25 decisions | Authentic snapshot-bound decisions; batch generation is not review progress. | @@ -137,6 +156,18 @@ Review the repaired current snapshot, including missing-abstract and unsupported ## References +ContextualWisdomLab. (2026). *ThreadWeave* (Commit 0fda6e60c2c80ec7b2aa2d58dac6b944dec6a6d0) [Computer software]. GitHub. https://github.com/ContextualWisdomLab/ThreadWeave/tree/0fda6e60c2c80ec7b2aa2d58dac6b944dec6a6d0 + +ContextualWisdomLab. (2026). *mightyETL* (Commit e550688c80f0dcf4677c0fbe50bd3341429106fb) [Computer software]. GitHub. https://github.com/ContextualWisdomLab/mightyETL/tree/e550688c80f0dcf4677c0fbe50bd3341429106fb + +ContextualWisdomLab. (2026). *scopeweave* (Commit 2c328875e00e86537df3e965170be80532571cad) [Computer software]. GitHub. https://github.com/ContextualWisdomLab/scopeweave/tree/2c328875e00e86537df3e965170be80532571cad + +Crispin, M., & Murchison, K. (2008, June). *Internet message access protocol—SORT and THREAD extensions* (RFC 5256). RFC Editor. https://www.rfc-editor.org/rfc/rfc5256 + +Debezium Authors. (n.d.). *Debezium connector for PostgreSQL* (Version 3.4). Retrieved September 6, 2026, from https://debezium.io/documentation/reference/3.4/connectors/postgresql.html + +Python Package Index. (n.d.). *threadweave 0.1.0* [Package metadata]. Retrieved September 6, 2026, from https://pypi.org/pypi/threadweave/json + ContextualWisdomLab. (2026). *kaefa* (Commit 5128d4867e24b5db73e6e3c8652a8dbeabd70aa0) [Computer software]. GitHub. https://github.com/ContextualWisdomLab/kaefa/tree/5128d4867e24b5db73e6e3c8652a8dbeabd70aa0 ContextualWisdomLab. (2026). *aFIPC* (Commit f87c2324f1686135e57d8730c1b0b9420874f300) [Computer software]. GitHub. https://github.com/ContextualWisdomLab/aFIPC/tree/f87c2324f1686135e57d8730c1b0b9420874f300 diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 7b2abde6..3cfb5c50 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,15 @@ This file records code-current product and technical gaps. Exact PR/check/run coordinates are evidence snapshots, not mutable-head dependencies. Live protected-branch, PR, issue and workflow state wins whenever it advances after this snapshot. Refresh the changed PR's metadata after each documentation commit; evidence from another PR or an earlier head does not transfer. -## Latest Source Observation prerequisite checkpoint +## Latest relationship-owner discovery checkpoint + +The September 6 follow-up [ThreadWeave/mightyETL/scopeweave audit](doctoring/cwl_ontology_capability_inventory.md#threading-cdc-and-work-dependency-contracts-2026-09-06) advances bounded source coverage **30/76 → 33/76**, leaving **43** repositories. The paginated census remains 76 repositories, one archived and 11 forks. Each new observation binds the actual protected default, complete tracked-file tree, package declaration, selected implementation/tests and complete GitHub release/tag queries. GitHub releases with resolved source remain **7/33**. Separately, PyPI reports ThreadWeave 0.1.0; no artifact was downloaded or bound to current 0.2.0 source. Do not silently count registry metadata as an eighth resolved GitHub release or verified consumer adoption. + +Three existing scopeweave unit scripts passed at `2c328875e00e86537df3e965170be80532571cad` with Node v24.19.0; Java/Python tests, live services, browser/E2E and private source data were not exercised. The audit distinguishes header/fallback/subject-grouping ancestry, raw CDC versus optional canonical mapping, and typed work dependencies with cycles/dangling links and fixed heuristic readiness weights. mightyETL's PostgreSQL DDL claim conflicts with the pinned Debezium 3.4 provider documentation. Its [existing owner issue #159](https://github.com/ContextualWisdomLab/mightyETL/issues/159#issuecomment-5558302366) now receives the exact-source finding and regression requirements; no competing owner writer or DDL service was created. + +PRD FR-9, TRD evaluation, Context Map, Ubiquitous Language and Proposed ADR 0006 now retain these distinct evidence kinds and pre-adoption requirements. This is source discovery and owner cultivation, not completed reclassification. Lifecycle capability **28**, last authentic decisions **0/3,715**, independent approvals **0/3,715**, and verified adoption **0** are unchanged. No Zotero/model request, paper artifact read or authority issuer was used. The next loop keeps protected prerequisite review/root repair, real full-denominator review/governance and released owner consumption open. The checkpoints below retain their historical denominators. + +## Previous Source Observation prerequisite checkpoint The canonical Source Observation owner explicitly handed off PR #6's UNIQUE null-comparison finding, with no overlapping writer. An isolated worktree retained `e3c415600300b6c2d5b852c457ea6ab2e5222e08` and unchanged Client #5 base `fcf36c8a99f015b963c9f812787df127ac2e2f9e`, then normally pushed exact successor `331f8edcd7cebb1719e5cea3187f3848ce7b9e71`. [PR #6](https://github.com/ContextualWisdomLab/ConceptWeave/pull/6) remains OPEN Draft. This research lane records its evidence without copying or adopting the unprotected supplier source. From ec1435379e5fb29fbd7842137a2003d8f3363655 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 18:28:03 +0900 Subject: [PATCH 16/52] docs(research): record exact audit verification --- docs/product-technical-gap-baseline.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 3cfb5c50..ea3583de 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -12,6 +12,8 @@ Three existing scopeweave unit scripts passed at `2c328875e00e86537df3e965170be8 PRD FR-9, TRD evaluation, Context Map, Ubiquitous Language and Proposed ADR 0006 now retain these distinct evidence kinds and pre-adoption requirements. This is source discovery and owner cultivation, not completed reclassification. Lifecycle capability **28**, last authentic decisions **0/3,715**, independent approvals **0/3,715**, and verified adoption **0** are unchanged. No Zotero/model request, paper artifact read or authority issuer was used. The next loop keeps protected prerequisite review/root repair, real full-denominator review/governance and released owner consumption open. The checkpoints below retain their historical denominators. +Documentation commit `1444c44135fb822590516156e6570fd9e17eca8f` passed **255 tests / 41 unfiltered suites, including seven doctests**, explicit Rust 1.98.0 formatting, the existing CI contract, diff checks and a unique 33-row inventory assertion. Initial unqualified Cargo execution failed before tests because inherited `RUSTUP_TOOLCHAIN=stable` selected installed 1.97.1 despite the project pin; `rustup show active-toolchain` identified the override. The reproducible command is `cargo +1.98.0 test --workspace --locked`, without changing the shared environment or lowering the declared baseline. Failed and successful logs remain `/tmp/conceptweave-relationship-owner-tests-20260906.log` and `/tmp/conceptweave-relationship-owner-tests-rust198-20260906.log`. Crates, Cargo files and scripts are unchanged from `b645d6acc9396aabe05294dc617fce5b70bd3223`; no fresh coverage run or supplier test result is implied. PR #39 was normally pushed at `1444c44`, remained OPEN Draft over `8e057652ee7784b373beeeec865d80dd3db773be`, with zero reviews/Actions and CodeRabbit status only. The owner-issue comment matched an independent API readback. Final documentation requires its own verification and fresh PR-head read; ruleset 18156473 still requires one independent approval, resolved threads and seven central workflows. + ## Previous Source Observation prerequisite checkpoint The canonical Source Observation owner explicitly handed off PR #6's UNIQUE null-comparison finding, with no overlapping writer. An isolated worktree retained `e3c415600300b6c2d5b852c457ea6ab2e5222e08` and unchanged Client #5 base `fcf36c8a99f015b963c9f812787df127ac2e2f9e`, then normally pushed exact successor `331f8edcd7cebb1719e5cea3187f3848ce7b9e71`. [PR #6](https://github.com/ContextualWisdomLab/ConceptWeave/pull/6) remains OPEN Draft. This research lane records its evidence without copying or adopting the unprotected supplier source. From cbc91219e8bc6b8e34d0144c78f5c170006ee7af Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 19:11:23 +0900 Subject: [PATCH 17/52] docs(research): record deadline cascade and pending remote gate --- docs/doctoring/zotero_metadata_deadline.md | 53 +++++++++++++++++++++- docs/product-technical-gap-baseline.md | 14 +++++- 2 files changed, 65 insertions(+), 2 deletions(-) diff --git a/docs/doctoring/zotero_metadata_deadline.md b/docs/doctoring/zotero_metadata_deadline.md index afa9d5a6..8719980a 100644 --- a/docs/doctoring/zotero_metadata_deadline.md +++ b/docs/doctoring/zotero_metadata_deadline.md @@ -1,6 +1,6 @@ # Zotero metadata read deadline -Status: locally verified source repair; protected integration and forward-stack verification remain required. No actual library or paper artifact was read in this experiment. +Status: owner repair and the complete forward chain locally verified; #9 through #38 normally pushed, #39 local only pending a fresh remote gate. Protected integration remains required. No actual library or paper artifact was read in this experiment. ## Finding and cause @@ -23,6 +23,57 @@ Reproduce with `cargo +1.98.0 test --workspace --locked` and `bash scripts/check Next: revalidate the final documentation head, normal-push #9 after a fresh writer/head/base check, merge its delta forward through every dependent research PR without reversing later features, and rerun each changed head's checks. Local success does not resolve protected approval, provider transport security or the other open findings. No predecessor may be closed to hide missing propagation. +## Forward integration checkpoint — September 6, 2026 + +Every integration below passed explicit Rust 1.98.0 locked workspace tests, strict all-target Clippy, warnings-denied rustdoc, formatting, the unchanged CI contract and diff checks. Test counts include doctests and only terminal summaries containing the exact `; 0 filtered out;` suffix. Each merge has the preserved child as its first parent and the verified predecessor as its second parent. A separate ancestry/diff audit confirmed both parents and exactly the six intended source/document files; no Cargo, workflow or script delta was introduced. + +#9 was normally pushed at `bb2faccfda9efed55b6759f1bbf7907bf6ec0c3b`. Its 27 descendants through #38 were normally pushed and named remote heads matched the verification ledger. #39's final integration is local only. Conflicts in #10/#34/#37 TRD, #17 adjacent constants, and #22/#39 PRD were resolved by retaining both intended changes: the later schema, abstract retention, source-discovery and full-text contracts were not discarded. No later capability was reverse-merged into #9, no branch was force-pushed, and no predecessor was closed. + +| PR | Preserved child | Verified parent | Integration head | Tests / suites | +| --- | --- | --- | --- | ---: | +| #10 | `d4f39b45901ea741baa893a3d6117c5322b7dcdf` | `bb2faccfda9efed55b6759f1bbf7907bf6ec0c3b` | `4bb633305b04a1dd4c4ce526806c9469bcb79fd3` | 58 / 14 | +| #11 | `11d158b105cbd03edc34452358ebb3ff445e388e` | `4bb633305b04a1dd4c4ce526806c9469bcb79fd3` | `1dc032598b41a35d52c09d8690c871e07365d7e3` | 60 / 15 | +| #12 | `ee2c494a3136a4bfa520c29f1c938b621e1ecb9c` | `1dc032598b41a35d52c09d8690c871e07365d7e3` | `a4a7c2d56fc592ef1c7abf64ca6875b0fe10c5ee` | 68 / 17 | +| #13 | `8a684882005085d8b3cb47812e185975084e0475` | `a4a7c2d56fc592ef1c7abf64ca6875b0fe10c5ee` | `b41217b1d38ec8d30e365aac04e68684c09dca7f` | 75 / 18 | +| #15 | `a07dd9a433c7211c2f95065031622d51dadf2cb6` | `b41217b1d38ec8d30e365aac04e68684c09dca7f` | `45e9c4933eae4482b0361473e9f083967182e6cc` | 87 / 19 | +| #16 | `873c46b7dcf2930a98cf7ef7ff8bdcbcf04f17d5` | `45e9c4933eae4482b0361473e9f083967182e6cc` | `044018cef4e5d3e919b278a1cfebe56857863601` | 87 / 19 | +| #17 | `cf93f5323d97e718c8ff986c8e780bfaa26fb765` | `044018cef4e5d3e919b278a1cfebe56857863601` | `c88f9a34c1fc4e72e38cf66b1d2f3fcb305e560a` | 100 / 19 | +| #18 | `5e33981ccb0691e0a24260652c44fe8e28afb8d9` | `c88f9a34c1fc4e72e38cf66b1d2f3fcb305e560a` | `fe2cff4f9fc40496bbb4339ba4242543beacea9b` | 108 / 20 | +| #19 | `de9df48d727fe22a3f1efb881d7d17ef0566b620` | `fe2cff4f9fc40496bbb4339ba4242543beacea9b` | `62c19ee23e3c827bc7db15c79f4755ff040489e9` | 109 / 20 | +| #20 | `4fb1ad073cfbe25d269d063c90914636f27619da` | `62c19ee23e3c827bc7db15c79f4755ff040489e9` | `a03a7248c894a1e0765968ddf58514d98c517da3` | 116 / 21 | +| #21 | `9302f8525aa3b3aba2f68576a97b6d2c853f2819` | `a03a7248c894a1e0765968ddf58514d98c517da3` | `09c84e4cdb1393a5e450f5200b87f292eeea956f` | 119 / 22 | +| #22 | `0b0691ee264264a7c50f894ef0190d12d97dea0d` | `09c84e4cdb1393a5e450f5200b87f292eeea956f` | `7179d13b45d160682e4cce1473c145d465fe657b` | 120 / 23 | +| #23 | `1912c21d9fbe895db62cd9735b44f36fc2b19221` | `7179d13b45d160682e4cce1473c145d465fe657b` | `2a3619f52e1d3e4f699c91be1fc2d0e9a6e234c8` | 121 / 23 | +| #24 | `ba3a691bb246258d2a27bc83c308be21031e310e` | `2a3619f52e1d3e4f699c91be1fc2d0e9a6e234c8` | `1e73e1545de32ae9a349c469a7794c5c3fc2ae9b` | 123 / 23 | +| #25 | `6af51119f434035c9e8fc2743e8327c0199a8c92` | `1e73e1545de32ae9a349c469a7794c5c3fc2ae9b` | `c6b4c17e931951a2e1d4ea79ac79363f6306a5bf` | 126 / 24 | +| #26 | `f60c07ff0dc0b6933bbf5fa097b5bb72b0b24fea` | `c6b4c17e931951a2e1d4ea79ac79363f6306a5bf` | `e2dc6006ed3e56d8388e82912826cf37efed0541` | 128 / 24 | +| #27 | `9c4ecf5fc8bc3e16c3aaffc10ba0498e59128f9d` | `e2dc6006ed3e56d8388e82912826cf37efed0541` | `3df0c124f390797bacaba8ffdf229f502b0e9bf3` | 133 / 25 | +| #28 | `b411b66c2ec34c39bb0cceb27f96221a1fda4416` | `3df0c124f390797bacaba8ffdf229f502b0e9bf3` | `ba6b3dfc71cf89ed4c57b85da0dd9ca5f983efee` | 138 / 26 | +| #29 | `7af6881fc567fbec671f91d3590b4d4d47cf9f50` | `ba6b3dfc71cf89ed4c57b85da0dd9ca5f983efee` | `f73705e15f1236fa8bd34fec032bc78d9b57760c` | 149 / 28 | +| #30 | `a43ddceaf5dfaa4daba5270b954bda9f42a59cdb` | `f73705e15f1236fa8bd34fec032bc78d9b57760c` | `a11e889d1680ab4d91f3565e3debf7ed0f10ba23` | 156 / 32 | +| #31 | `0dad7ca52bd2932e82bbf34eb4b7f4aec6b4f3f2` | `a11e889d1680ab4d91f3565e3debf7ed0f10ba23` | `61072a70f7ec5a1fbd0b477430aacb8e770aa109` | 158 / 33 | +| #32 | `f0bf02a8a600924d254adfa7b4796aa2ef868165` | `61072a70f7ec5a1fbd0b477430aacb8e770aa109` | `1e711728d83efc1e60fc3d43ba0c67c467dd6a43` | 161 / 34 | +| #33 | `18932783aeb336a6d58e8a19f6d7dd6ecfb9ab3a` | `1e711728d83efc1e60fc3d43ba0c67c467dd6a43` | `d82b2f2896bc4cfef5d34ac6f6f83f7cee1072f6` | 166 / 36 | +| #34 | `853517c1c43fdaeea0cef57b2f0e63a34b0fe2db` | `d82b2f2896bc4cfef5d34ac6f6f83f7cee1072f6` | `b9060df2cb1ea02314be429932031fc07de1de30` | 171 / 37 | +| #36 | `87f02a91a9b5ea83ae842ef6b7eb83141aebfd66` | `b9060df2cb1ea02314be429932031fc07de1de30` | `d3f991dcc1b746afed7c36f315e8937c39390c5e` | 201 / 38 | +| #37 | `692cb588b26a9cc878fbaa2b47aa30fd83ea47de` | `d3f991dcc1b746afed7c36f315e8937c39390c5e` | `2688b508e36ac1be15c15717566a0bc165ab962d` | 216 / 39 | +| #38 | `8e057652ee7784b373beeeec865d80dd3db773be` | `2688b508e36ac1be15c15717566a0bc165ab962d` | `e2c3a9fbbe36f44525833d4a94e164c6891a0f94` | 243 / 41 | +| #39 (local only) | `ec1435379e5fb29fbd7842137a2003d8f3363655` | `e2c3a9fbbe36f44525833d4a94e164c6891a0f94` | `e1407d64e67be3556088c36d334427b7de103378` | 258 / 41 | + +The final integrated source `e1407d64e67be3556088c36d334427b7de103378` passes **258 tests / 41 unfiltered suites, including seven doctests**, the release build and the unchanged coverage gate: **415/415 functions, 4,465/4,465 source-normalized regions and 762/762 normalized branch outcomes**. Raw LLVM is **5,041/5,115 lines, 7,281/7,438 regions and 707/762 branches**, not 100%. Intermediate-head coverage is not inferred from the owner and final endpoints. Logs: `/private/tmp/conceptweave-deadline-pr{10..38}-20260906.log` for the listed PRs, `/tmp/conceptweave-deadline-root-{tests,clippy,rustdoc,release,coverage}-20260906.log`, and `/private/tmp/conceptweave-deadline-cascade-results-20260906.tsv`. The local guarded runner is `/private/tmp/conceptweave-deadline-cascade-20260906.sh`; it verifies current branch identity, stops on conflicts/failures and supports resumption from the ledger. These temporary paths are execution evidence, not shipped product dependencies. + +## Remote acceptance and quota boundary + +The #9 deadline review received an [exact-source response](https://github.com/ContextualWisdomLab/ConceptWeave/pull/9#discussion_r3943584189), independently reread. #9 and #10–#37 bodies were updated and reread at their corresponding heads; #38's body refresh and #39's final push/body remain pending. No discussion was resolved as a substitute for independent acceptance. + +During the final #39 state read, ordinary GraphQL returned an API-rate-limit failure, confirmed at **10:05:51 UTC on September 6**. The separate quota-status endpoint then reported zero usage/full remaining quota and an 11:06:12 UTC reset; that contradictory summary does not override the actual rejected PR read. It was used only to choose a conservative next check time, not to obtain PR facts through another endpoint. No replacement token, alternate PR endpoint or push after the failed gate was used. Cached PR head/base fields also lagged earlier successful pushes; actual named refs were verified while normal access was available. + +Last confirmed #39 remote head remains `ec1435379e5fb29fbd7842137a2003d8f3363655`, OPEN Draft. Its newly pushed named parent is #38 `e2c3a9fbbe36f44525833d4a94e164c6891a0f94`. After the conservative cooldown, obtain one normal fresh head/base/writer read before any push; integrate concurrent deltas normally if present. Then push the local successor, refresh #38/#39 bodies, verify exact heads and all changed-head hosted checks/reviews, and continue canonical root repair. Do not rerun the completed 27 integrations solely to consume a wait. + +The last complete audit in this increment found 33 open PRs, 32 Draft and 36 unresolved threads, with no current-head approval among each PR's latest 30 returned reviews; #6 had older review history outside that window. Protected main remains the last verified `f4f440dd58c77d7cd90dff8a1eb2eeb9a9940425`. Fresh ruleset 18156473 requires one independent approval, stale-review dismissal, resolved threads, seven central workflows and deletion/non-fast-forward protection. #9's exact pushed head had zero check-runs/Actions and only CodeRabbit's Draft-skip status, not hosted Product GREEN. No final all-PR snapshot is claimed after quota exhaustion. + +Lifecycle capability remains 28, bounded source audits 33/76, source-resolved GitHub releases 7/33, verified adoption zero, and last authentic decisions and independent approvals each 0/3,715. The regression metric improves from one passing/two failing deadline tests to three passing tests; it is not paper reclassification or publication. No actual Zotero/model request, private artifact read, semantic decision, approval issuer, write or rollback occurred. The full goal remains active. + ## References Rust Project Developers. (n.d.). *Instant in std::time* [Rust standard-library documentation]. Retrieved September 6, 2026, from https://doc.rust-lang.org/stable/std/time/struct.Instant.html diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index ea3583de..96f21019 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,19 @@ This file records code-current product and technical gaps. Exact PR/check/run coordinates are evidence snapshots, not mutable-head dependencies. Live protected-branch, PR, issue and workflow state wins whenever it advances after this snapshot. Refresh the changed PR's metadata after each documentation commit; evidence from another PR or an earlier head does not transfer. -## Latest relationship-owner discovery checkpoint +## Latest metadata deadline repair checkpoint + +The earliest-owner #9 review identified that individually timely one-item pages could keep a complete metadata read running indefinitely. Committed RED `aff539fe8595a240d2da85da1a7a235dd55455e0` reproduces two late-report acceptance failures; the valid short-page control passes. GREEN `e6b2a2214b39106ddacc753595b72a699d53d04f` reuses the shared reader, standard-library monotonic clock and existing budget error. Five-minute guards precede each fetch, follow each successful page and precede complete-report acceptance. Requests and classification are not forcibly interrupted. No partial report or reduced paper denominator is accepted. PRD, TRD, Proposed ADR 0006, CHANGELOG and the [deadline doctoring report](doctoring/zotero_metadata_deadline.md) record the decision, alternatives and platform/authority limits. The separately reviewed stale schema-42 TRD claim is corrected without changing the parser. + +#9 was normally pushed at `bb2faccfda9efed55b6759f1bbf7907bf6ec0c3b`; all 27 dependent branches through #38 received normal parent merges and their own full tests, strict Clippy, rustdoc, formatting, CI contract and diff checks. The doctoring table binds each preserved child, verified parent, new head and unfiltered test count. Every merge retains both parents and changes only the intended six files. Documentation conflicts retain later source discovery, abstract and full-text requirements; no later feature was reverse-merged into the owner. No Cargo, workflow, threshold, exclusion or dependency changed. #9 and #10–#37 PR-body readbacks matched; #38 body refresh remains pending. + +The final local #39 integration `e1407d64e67be3556088c36d334427b7de103378` preserves prior `ec1435379e5fb29fbd7842137a2003d8f3363655` and parent #38 `e2c3a9fbbe36f44525833d4a94e164c6891a0f94`. It passes **258 tests / 41 unfiltered suites, including seven doctests**, strict checks and the release build. The unchanged coverage gate passes **415/415 functions, 4,465/4,465 source-normalized regions and 762/762 normalized branches**. Raw LLVM is **5,041/5,115 lines, 7,281/7,438 regions and 707/762 branches**, not 100%. Intermediate coverage is not inferred from endpoint runs. Source and normalized coverage increase; lifecycle capability remains **28**, bounded source audits **33/76**, source-resolved releases **7/33**, verified adoption **0**, and last actual decisions/independent approvals each **0/3,715**. No real paper, Zotero/model request, credential or authority issuer was used. + +**Remote work is incomplete:** the final #39 GraphQL read failed with exhausted API quota, confirmed September 6 at **10:05:51 UTC**. A contradictory quota summary reported full remaining allowance and reset **11:06:12 UTC**; rejected reads remain authoritative. The latter time is only a conservative retry boundary. No alternate PR API, token or push bypassed the failed gate. #39's last confirmed remote remains OPEN Draft at `ec14353`; its local successor is not pushed. After cooldown, re-read normal remote head/base/writer state once, preserve any concurrent delta, then normal-push #39, finish #38/#39 body updates and verify exact-head hosted checks/reviews. Keep the goal active; do not repeat completed integrations or close predecessors to hide pending work. + +The last complete all-PR audit in this increment was 33 open / 32 Draft / 36 unresolved, with no current-head approval among the latest 30 reviews returned per PR; #6's older history was outside that window. It is not a post-quota final audit. Last verified protected main is `f4f440dd58c77d7cd90dff8a1eb2eeb9a9940425`; freshly reread ruleset 18156473 still requires one independent approval, stale dismissal, resolved threads and seven central workflows. #9 has no exact-head check-run/Actions evidence, only CodeRabbit Draft skip. Local success, source response and normal branch push do not satisfy protected integration, genuine review/governance or released-owner adoption. Final documentation requires its own local verification. + +## Previous relationship-owner discovery checkpoint The September 6 follow-up [ThreadWeave/mightyETL/scopeweave audit](doctoring/cwl_ontology_capability_inventory.md#threading-cdc-and-work-dependency-contracts-2026-09-06) advances bounded source coverage **30/76 → 33/76**, leaving **43** repositories. The paginated census remains 76 repositories, one archived and 11 forks. Each new observation binds the actual protected default, complete tracked-file tree, package declaration, selected implementation/tests and complete GitHub release/tag queries. GitHub releases with resolved source remain **7/33**. Separately, PyPI reports ThreadWeave 0.1.0; no artifact was downloaded or bound to current 0.2.0 source. Do not silently count registry metadata as an eighth resolved GitHub release or verified consumer adoption. From ffccc067b403835706c778d012925e24c5f7c825 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 19:13:09 +0900 Subject: [PATCH 18/52] docs(research): distinguish completed propagation from remaining gates --- docs/doctoring/zotero_metadata_deadline.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/doctoring/zotero_metadata_deadline.md b/docs/doctoring/zotero_metadata_deadline.md index 8719980a..46aa3784 100644 --- a/docs/doctoring/zotero_metadata_deadline.md +++ b/docs/doctoring/zotero_metadata_deadline.md @@ -1,10 +1,10 @@ # Zotero metadata read deadline -Status: owner repair and the complete forward chain locally verified; #9 through #38 normally pushed, #39 local only pending a fresh remote gate. Protected integration remains required. No actual library or paper artifact was read in this experiment. +Status: owner repair and the complete forward chain locally verified; #9 and its 27 descendants through #38 normally pushed, #39 local only pending a fresh remote gate. Protected integration remains required. No actual library or paper artifact was read in this experiment. ## Finding and cause -[PR #9's unresolved review](https://github.com/ContextualWisdomLab/ConceptWeave/pull/9#discussion_r3935157013) identified that one item per page can trigger up to 50,000 requests, each with a fresh timeout. Exact baseline `a2a84884f67dcac6f6892c958d55450aea6d6c88` has item/byte bounds but no total elapsed-time bound. The same body remains in later research descendants. The real call path is `read_local_snapshot` → `read_snapshot_with` → page transport → complete `classify_snapshot`; the CLI receives a report only after that function returns. +[PR #9's unresolved review](https://github.com/ContextualWisdomLab/ConceptWeave/pull/9#discussion_r3935157013) identified that one item per page can trigger up to 50,000 requests, each with a fresh timeout. Exact baseline `a2a84884f67dcac6f6892c958d55450aea6d6c88` had item/byte bounds but no total elapsed-time bound. The later research descendants retained the same unbounded body before this repair. The real call path is `read_local_snapshot` → `read_snapshot_with` → page transport → complete `classify_snapshot`; the CLI receives a report only after that function returns. ## Decision and limits @@ -21,7 +21,7 @@ The accepted report still includes the full observed denominator. No late/partia Reproduce with `cargo +1.98.0 test --workspace --locked` and `bash scripts/check_coverage.sh`. Logs are `/tmp/conceptweave-pr9-deadline-{baseline,red,green,coverage}-20260906.log`. The initial provider review references API pagination, which permits bounded pages; that does not supply an application-wide read deadline (Zotero, n.d.). The same TRD amendment removes the separately reviewed stale schema-42 requirement and states the implemented API-v3/present-stable-schema contract; no parser behavior changes for that documentation correction. -Next: revalidate the final documentation head, normal-push #9 after a fresh writer/head/base check, merge its delta forward through every dependent research PR without reversing later features, and rerun each changed head's checks. Local success does not resolve protected approval, provider transport security or the other open findings. No predecessor may be closed to hide missing propagation. +At this owner-only checkpoint, the required follow-up was final-head verification, a fresh writer/head/base check, normal #9 push and full forward propagation with per-head checks. The checkpoint below records the executed work and remaining remote gate. Local success does not resolve protected approval, provider transport security or other open findings. No predecessor may be closed to hide missing propagation. ## Forward integration checkpoint — September 6, 2026 From 15d755d29bf5aa9f3698a54f07945b8c25ad0821 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 19:31:28 +0900 Subject: [PATCH 19/52] docs(zotero): record local revision repair and pending propagation --- docs/product-technical-gap-baseline.md | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 96f21019..e98891af 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,17 @@ This file records code-current product and technical gaps. Exact PR/check/run coordinates are evidence snapshots, not mutable-head dependencies. Live protected-branch, PR, issue and workflow state wins whenever it advances after this snapshot. Refresh the changed PR's metadata after each documentation commit; evidence from another PR or an earlier head does not transfer. -## Latest metadata deadline repair checkpoint +## Latest metadata item revision repair checkpoint + +The earliest-owner #9 [revision review](https://github.com/ContextualWisdomLab/ConceptWeave/pull/9#discussion_r3934542708) is now locally reproduced and repaired, but this root has not yet received that source delta. Owner baseline `bb2faccfda9efed55b6759f1bbf7907bf6ec0c3b` passed 41 tests / 10 unfiltered suites. Committed RED `1cf3472499ad49716a70603be2e15dc857819231` fails the new rejection assertion while its valid-version control passes. Source GREEN `8effa6a9b15ac1a09b7e80dab4cf2885fad02211` adds one shared-reader predicate before page accumulation: every returned metadata object's revision must be at most its page's library revision. Existing snapshot-consistency failure rejects the whole read before another page; no record is dropped and no revision is clamped. The pure offline classifier and full-text version contracts are unchanged. + +Owner documentation head `f8566408e6a3017cf775fadf2a2f7e50b2d20dc6` passes a fresh **43 tests / 10 unfiltered suites, including two doctests**; crates, Cargo files and scripts are unchanged from the tested source GREEN. The source also passed strict Clippy, rustdoc, release build, formatting, existing CI contract, diff checks and the unchanged coverage gate: **113/113 functions, 709/709 normalized source regions, 106/106 normalized branches**. Raw LLVM remains **1,097/1,098 lines, 1,690/1,697 regions, 105/106 branches**, not 100%. Unit scenarios cover first/later pages, a valid member before the bad member, bibliographic and child item types, and exact preservation of zero/lower/equal/maximum versions. No actual Zotero or paper artifact was read. Owner PRD/TRD/UML/CHANGELOG, still-Proposed ADR 0006 and owner-only `docs/doctoring/zotero_item_revision.md` retain APA provider references, alternatives, retry cost and the distinction between version consistency and atomicity. + +**Not remotely accepted or propagated:** the owner successor is local-only in `/private/tmp/conceptweave-pr9-transport-owner-repair-20260905`; its last verified remote remains `bb2facc`. Root runtime remains `e1407d64e67be3556088c36d334427b7de103378`, with the deadline repair and previously verified 258 tests, not the new item-revision guard. The earlier 27 deadline integrations are complete and must not be repeated as though they included this new repair. After the existing **11:06:12 UTC** cooldown, perform one normal fresh PR head/base/state/writer audit, preserve concurrent changes, then normal-push #9 and propagate this distinct revision delta through all dependent research PRs with exact-head tests. Incorporate the pending local #39 history during that forward merge; do not replace or discard it. No quota-bypass endpoint, token, push, review resolution, approval, readiness transition, merge or closure occurred during this local experiment. + +Lifecycle capability **28**, bounded source audits **33/76**, source-resolved releases **7/33**, verified adoption **0**, and last actual decisions/independent approvals each **0/3,715** remain unchanged. These are prior measurements, not a current library census. Protected prerequisites, genuine full-denominator research review, independent governance and released-owner consumption remain the goal; source-only regression success does not fulfill them. The checkpoints below retain their own historical heads and counts. + +## Previous metadata deadline repair checkpoint The earliest-owner #9 review identified that individually timely one-item pages could keep a complete metadata read running indefinitely. Committed RED `aff539fe8595a240d2da85da1a7a235dd55455e0` reproduces two late-report acceptance failures; the valid short-page control passes. GREEN `e6b2a2214b39106ddacc753595b72a699d53d04f` reuses the shared reader, standard-library monotonic clock and existing budget error. Five-minute guards precede each fetch, follow each successful page and precede complete-report acceptance. Requests and classification are not forcibly interrupted. No partial report or reduced paper denominator is accepted. PRD, TRD, Proposed ADR 0006, CHANGELOG and the [deadline doctoring report](doctoring/zotero_metadata_deadline.md) record the decision, alternatives and platform/authority limits. The separately reviewed stale schema-42 TRD claim is corrected without changing the parser. From 55b1d91dcd299145239a62062ed504fcb6e7bfd1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 20:01:23 +0900 Subject: [PATCH 20/52] docs(zotero): reconcile live and visual library scope --- docs/PRD.md | 2 +- docs/TRD.md | 2 + .../zotero_metadata_visual_audit.json | 50 +++++++++++++++++++ .../doctoring/zotero_metadata_visual_audit.md | 35 +++++++++++++ docs/product-technical-gap-baseline.md | 12 ++++- 5 files changed, 99 insertions(+), 2 deletions(-) create mode 100644 docs/doctoring/zotero_metadata_visual_audit.json create mode 100644 docs/doctoring/zotero_metadata_visual_audit.md diff --git a/docs/PRD.md b/docs/PRD.md index d62e9a34..de1bb937 100644 --- a/docs/PRD.md +++ b/docs/PRD.md @@ -94,7 +94,7 @@ Applying a completed review batch must rederive the same pending view from the o Evaluate classifier quality only against a steward-reviewed local golden set whose governance receipt is externally verified and binds both the complete source/classifier-input snapshot and every current proposal field, in addition to the item-key/item-version coordinates. Same-version changes to unmodeled provider metadata, absent/default fields, classifier inputs, predictions or supporting evidence must invalidate the corresponding binding. Evaluation recomputes proposal identity before contacting governance; a locally changed digest cannot renew an approval. Legacy unbound approvals require reissuance, never automatic backfill. Abstention is a prediction outcome, never an approved truth label. Evaluation emits the verified library revision, rule revision, opaque snapshot and proposal digests, and aggregate counts for exact matches, abstentions, and per-disposition true-positive/predicted/expected totals; it must not copy Zotero keys, reviewer identity, or bibliographic text into the result. -A full-reclassification completion result additionally requires exactly one non-abstention steward label for every top-level bibliographic item; a sampled golden set remains valid for quality measurement but cannot prove completion. +A full-reclassification completion result additionally requires exactly one non-abstention steward label for every top-level bibliographic item and evidence-bound reconciliation of every other top-level source record. Standalone PDFs and notes remain visibly pending until their identity, relationship to existing papers and treatment are justified; they must not disappear merely because the classifier excludes their item type. Retraction/correction evidence must remain distinct from topical classification and must be considered before authoritative use. A sampled golden set or a completed bibliographic-only worksheet cannot prove full-library completion. The [live/visual audit](doctoring/zotero_metadata_visual_audit.md) found three standalone PDFs and one standalone note outside the current worksheet; the pending-scope inventory and complete-library gate remain unimplemented. Every successful classification report includes aggregate evidence for snapshot coverage, proposal coverage, provenance completeness, abstentions, duplicate candidates, disposition totals, and zero unreported failures. ## 6. First vertical slice diff --git a/docs/TRD.md b/docs/TRD.md index 77fedd1a..afae47d2 100644 --- a/docs/TRD.md +++ b/docs/TRD.md @@ -65,6 +65,8 @@ Evaluation must separate extraction recall, semantic correctness, structural cor ## 11. Zotero research intake +Pending source-scope requirement: reconcile all observed top-level records with the bibliographic review denominator before claiming full-library completion. The [live/visual audit](doctoring/zotero_metadata_visual_audit.md) establishes 3,715 bibliographic records plus three standalone PDFs and one standalone note. The current classifier filters those item types; a zero-remaining worksheet therefore proves only its scoped completion. The earliest research owner must retain source-bound unresolved records and verify complete identity/parent coverage without counting attachments as distinct papers or inventing labels. `/items/top` with an item-type filter returned child records in the observed provider, so endpoint names and total headers alone are not top-level proof. Retraction/correction observations require a separate evidence binding, not an automatic topical label or deletion. No such new runtime gate is claimed by this documentation increment. + Full-text classification is not implemented in the metadata classifier. The [Zotero 10.0.1 audit](doctoring/zotero_fulltext_contract_audit.md) confirms a provider-contract mismatch: full-text list responses omit the documented library-version header and expose versions written by sync, local indexing and local API paths in different version spaces. Treat them as opaque observations, not metadata revisions or reliable incremental cursors. Stable bookend versions/digests do not prove atomicity; no full-text capture may overwrite the earlier report digest or reuse its approval. The proposed capture implementation uses `--capture-full-text /tmp/REPORT.json /tmp/CAPTURE.json` and the existing private file boundary. It admits a nonempty validated Zotero 10+/API 3 metadata report with schema and server coordinates before requesting anything. It enumerates `fulltext?since=0`, rejects duplicate or foreign manifest keys, and reads each attachment's current metadata before its full text. Attachment key, item revision and parent must match the report; successful content requires a version matching that manifest entry. Every response pins server/API/schema/application version. Full-text HTTP 404 remains an explicit record; other non-success statuses, malformed content or drift fail the whole command before output creation. diff --git a/docs/doctoring/zotero_metadata_visual_audit.json b/docs/doctoring/zotero_metadata_visual_audit.json new file mode 100644 index 00000000..752e0ea6 --- /dev/null +++ b/docs/doctoring/zotero_metadata_visual_audit.json @@ -0,0 +1,50 @@ +{ + "observation_kind": "live_metadata_admission_and_visual_scope_audit", + "observation_date": "2026-09-06", + "owner_source_head": "8effa6a9b15ac1a09b7e80dab4cf2885fad02211", + "owner_documentation_head": "f8566408e6a3017cf775fadf2a2f7e50b2d20dc6", + "binary_sha256": "a2840a829530c271cbfa750d32afeed1dc7d27b58f8da3bc84f51083cb533b65", + "command_elapsed_seconds": 26.29, + "report_created_at_epoch": 1788691161, + "report_file_bytes": 2488762, + "report_file_mode": "0600", + "report_file_links": 1, + "report_file_sha256": "f9a041d4c1a90b1e2268a253d7cf82b61a47fd185d69a4b0d85df88a96066481", + "zotero_version": "10.0.1", + "api_version": 3, + "schema_version": 44, + "library_version": 2, + "server_identity_present": true, + "observed_item_count": 8326, + "bibliographic_count": 3715, + "bibliographic_version_min": 0, + "bibliographic_version_max": 0, + "proposal_counts": {"adjacent_evidence": 56, "semantic_consumption_bridge": 1, "needs_steward_review": 3658}, + "abstention_counts": {"no_deterministic_rule_match": 3505, "unsupported_rule_vocabulary": 153}, + "duplicate_candidate_groups": 49, + "child_attachment_count": 3922, + "child_note_count": 88, + "annotation_count": 597, + "standalone_pdf_count": 3, + "standalone_note_count": 1, + "unresolved_top_level_scope_count": 4, + "complete_attachment_sweep_count": 3925, + "attachment_sweep_request_count": 40, + "standalone_attachment_artifact_sha256": "9614163fbf71e774b872f5c7c857727d63227daa8697e12418c0c09942ce009c", + "standalone_note_artifact_sha256": "9530bd40258ce9cba044def74e04f690501a987a31cd4dcc0a5f5826d25e1862", + "visual_observations": { + "real_native_screenshots_inspected": true, + "whole_library_selected_count": 3719, + "retraction_banner_visible": true, + "retracted_view_accessibility_count": 1, + "retracted_view_rendering_verified": false, + "later_capture_accessibility_mismatch": true, + "screenshots_committed": false, + "original_view_accessibility_restored": true + }, + "model_calls": 0, + "new_steward_decisions": 0, + "new_independent_approvals": 0, + "source_mutations": 0, + "full_library_completion": false +} diff --git a/docs/doctoring/zotero_metadata_visual_audit.md b/docs/doctoring/zotero_metadata_visual_audit.md new file mode 100644 index 00000000..7db729f6 --- /dev/null +++ b/docs/doctoring/zotero_metadata_visual_audit.md @@ -0,0 +1,35 @@ +# Live metadata admission and visual scope audit + +Observation: September 6, 2026, 10:39–10:58 UTC. This is read-only runtime and source-scope evidence, not completed classification, approved meaning or a protected release. Aggregate coordinates are in [the audit record](zotero_metadata_visual_audit.json). + +## Verified live admission + +The existing PR #9 owner executable was freshly built from local documentation head `f8566408e6a3017cf775fadf2a2f7e50b2d20dc6`, with runtime source `8effa6a9b15ac1a09b7e80dab4cf2885fad02211`. Binary SHA-256 was unchanged before and after execution: `a2840a829530c271cbfa750d32afeed1dc7d27b58f8da3bc84f51083cb533b65`. The complete read took 26.29 seconds and accepted Zotero 10.0.1, API 3, schema 44 and library revision 2. Every retained bibliographic revision was zero; the new item-revision guard accepted the actual input without assigning invented positive revisions. + +The 2,488,762-byte proposal report is a new, single-link, owner-only regular file created under process-local `umask 077`. Its SHA-256 is `f9a041d4c1a90b1e2268a253d7cf82b61a47fd185d69a4b0d85df88a96066481`. Independent aggregate checks verified API/schema presence, unique bibliographic identities, revisions within the library revision and absent model receipts. No bibliography, item key, raw note, server identity, credential or screenshot is committed. No source record, collection, tag, decision or approval was changed. These local permissions do not establish loopback peer authentication or provider atomicity. + +## Scope reconciliation + +| Observed category | Records | Treatment | +| --- | ---: | --- | +| Bibliographic records | 3,715 | Existing proposal denominator; 3,658 abstentions and 57 other deterministic proposals | +| Child attachments | 3,922 | Linked evidence, not additional paper decisions | +| Child notes | 88 | Linked evidence, not additional paper decisions | +| Annotations | 597 | Separate source-record count | +| Standalone PDF attachments | 3 | Not present in the bibliographic proposals; identification/reconciliation remains open | +| Standalone note | 1 | Not present in the bibliographic proposals; evidence disposition remains open | +| Total metadata records | 8,326 | No category is silently dropped from the scope audit | + +The complete 3,925-attachment sweep used 40 sequential bounded GETs and validated each page's count, item type, revision, API/schema/provider/server continuity and final unique-identity total. The complete note response contains 89 records, one without a parent. Child attachments plus child notes equal the report's 4,010 direct child references. The native application's 3,719 selected top-level records reconcile as 3,715 bibliographic records plus these four standalone records. This does not prove that each standalone PDF is a distinct paper: determine identity and provenance before linking, admitting or excluding it, and retain its original evidence. The note must not be assigned a paper label by type alone. + +The attempted `/items/top` queries with `itemType=attachment` or `note` returned child records too. Their `Total-Results` values were 3,925 and 89, not standalone counts. This observation invalidated the initial header-only counting approach. Counts above come from returned parent coordinates and a full attachment traversal, not the route's name or the first 100 records. Provider cause and a portable top-level filtering contract remain unverified. + +## Visual inspection + +CUA screenshots of the real Zotero window showed the duplicate-items view, then the whole-library selection with **3,719 items selected** and a visible retraction warning. No merge, deletion, metadata edit or synchronization action was taken. The retracted-items accessibility view subsequently reported one record and an explicit retraction description. That one-record count is accessibility evidence, not a newly verified retraction diagnosis. Later screenshots retained the previous selection frame despite the accessibility view changing; those stale images do not prove that the retracted-items view rendered. The original duplicate-items view was restored in the accessibility state. This capture/render mismatch remains a visual-verification limitation, not a proven Zotero rendering defect. + +## Required next delta + +The classifier deliberately excludes attachments and notes, but its current completion denominator does not reconcile these four standalone sources. Add a source-bound pending-scope inventory and completion gate in the earliest research owner, with zero-scope/standalone/child/dangling-parent tests and complete identity coverage. Keep unresolved evidence visible; do not relabel attachments as papers, auto-merge them, shrink the denominator or invent steward labels. Preserve retraction/correction evidence separately from topical disposition and publication authority. This is a newly evidenced gap, not an implemented capability. + +The existing full-text capture and approved-review requirements remain intact; this metadata report cannot replace or renew an older capture or approval. A released contextual-orchestrator contract remains required before model-assisted proposals. Last independently verified decisions/approvals remain zero for the existing 3,715-item worksheet, and the additional scope reconciliation is unfinished. GitHub push, forward propagation, exact-head hosted checks and independent review remain pending behind the recorded API cooldown. diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index e98891af..fc3e0e19 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,17 @@ This file records code-current product and technical gaps. Exact PR/check/run coordinates are evidence snapshots, not mutable-head dependencies. Live protected-branch, PR, issue and workflow state wins whenever it advances after this snapshot. Refresh the changed PR's metadata after each documentation commit; evidence from another PR or an earlier head does not transfer. -## Latest metadata item revision repair checkpoint +## Latest live and visual source-scope checkpoint + +The [September 6 live/visual audit](doctoring/zotero_metadata_visual_audit.md) ran the freshly built #9 owner executable at local `f8566408e6a3017cf775fadf2a2f7e50b2d20dc6` against the actual Zotero Local API. It completed in **26.29 seconds**, retained a private `0600` report, and verified **8,326 metadata records / 3,715 bibliographic proposals**, API 3, schema 44, Zotero 10.0.1 and library revision 2. All retained bibliographic revisions are zero and the new guard admits them unchanged. There are **3,658 abstentions**, 57 other deterministic proposals and 49 duplicate-candidate groups; no proposal is an approved label. No full text or model was invoked and no source was changed. + +Actual native screenshots showed **3,719 selected top-level records** and a retraction warning. Complete attachment and note response audits reconcile the extra four as **three standalone PDFs and one standalone note** outside the existing bibliographic proposals. The remaining partition is 3,922 child attachments, 88 child notes and 597 annotations. `/items/top` with item-type filters included children, so its header-only count was rejected as scope evidence. The separate retracted-items accessibility view reports one record; stale later screenshot frames do not verify that view's rendering. Screenshots and raw records remain private, and the original duplicate-items accessibility view was restored. + +**New P0 scope gap:** the current 3,715-item worksheet does not settle those four standalone sources. PRD and TRD now require evidence-bound pending-scope reconciliation and separate retraction/correction evidence before full-library completion. The runtime inventory/gate is not implemented. Preserve the PDFs' identities and the note; do not assume three new distinct papers, silently exclude them, auto-merge/delete them or fabricate reviewed labels. The historical 0/3,715 decision/approval measurements remain valid only for the existing worksheet, not a complete statement of unresolved library scope. + +The prior local item-revision repair still awaits push and forward propagation. This root keeps runtime `e1407d64e67be3556088c36d334427b7de103378`; the live run used the isolated owner, not this unmodified root executable. GitHub cooldown remains **11:06:12 UTC** before one normal remote audit; no alternate GitHub endpoint, token, protected merge, review resolution or closure occurred. Source audits **33/76**, resolved releases **7/33**, adoption **0** and lifecycle capability **28** are unchanged. Continue prerequisite repair/integration and the newly measured scope gap without substituting tests or metadata observations for actual paper review. + +## Previous metadata item revision repair checkpoint The earliest-owner #9 [revision review](https://github.com/ContextualWisdomLab/ConceptWeave/pull/9#discussion_r3934542708) is now locally reproduced and repaired, but this root has not yet received that source delta. Owner baseline `bb2faccfda9efed55b6759f1bbf7907bf6ec0c3b` passed 41 tests / 10 unfiltered suites. Committed RED `1cf3472499ad49716a70603be2e15dc857819231` fails the new rejection assertion while its valid-version control passes. Source GREEN `8effa6a9b15ac1a09b7e80dab4cf2885fad02211` adds one shared-reader predicate before page accumulation: every returned metadata object's revision must be at most its page's library revision. Existing snapshot-consistency failure rejects the whole read before another page; no record is dropped and no revision is clamped. The pure offline classifier and full-text version contracts are unchanged. From 22a29c1cfc0918fa34287f3bffe7f400e97f4a0f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 20:27:09 +0900 Subject: [PATCH 21/52] docs(research): reconcile visual audit and pushed PR evidence --- docs/product-technical-gap-baseline.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index fc3e0e19..92ed2180 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,15 @@ This file records code-current product and technical gaps. Exact PR/check/run coordinates are evidence snapshots, not mutable-head dependencies. Live protected-branch, PR, issue and workflow state wins whenever it advances after this snapshot. Refresh the changed PR's metadata after each documentation commit; evidence from another PR or an earlier head does not transfer. -## Latest live and visual source-scope checkpoint +## Latest post-cooldown integration checkpoint + +The ordinary GraphQL audit succeeded at **2026-09-06 11:07:24 UTC**, after the conservative 11:06:12 retry boundary. Its paginated snapshot retained **33 open PRs, 32 Drafts and 36 unresolved threads**; the latest 30 reviews per PR contained no current-head approval (#6 has older reviews outside that window). Protected main remained `f4f440dd58c77d7cd90dff8a1eb2eeb9a9940425`. A fresh ruleset 18156473 read retained one independent approval, stale dismissal, resolved threads, seven central workflows and deletion/non-fast-forward protections. #35 now reports `REVIEW_REQUIRED`; the prior `CHANGES_REQUESTED` snapshot is historical. + +Normal pushes preserved both histories: #9 is `f8566408e6a3017cf775fadf2a2f7e50b2d20dc6`, and #39 is `55b1d91dcd299145239a62062ed504fcb6e7bfd1` over exact named parent #38 `e2c3a9fbbe36f44525833d4a94e164c6891a0f94`. Fresh pre-push tests passed **43 / 10 unfiltered suites / 2 doctests** for #9 and **258 / 41 / 7** for #39. Formatting, CI contract and diff checks passed. Root crates/Cargo/scripts remain unchanged from `e1407d64e67be3556088c36d334427b7de103378`; no fresh coverage run is implied. #9 and #39 remain OPEN Draft with zero exact-head Actions runs and only CodeRabbit's draft-review skip, not hosted GREEN. + +Updated #9/#38/#39 bodies matched independent exact-head readbacks; the previously pending #38 body refresh is complete. The [#9 source-repair reply](https://github.com/ContextualWisdomLab/ConceptWeave/pull/9#discussion_r3943775918) also matched its readback and leaves the review thread open. The new item-revision guard still requires forward propagation, and the newly measured standalone-source inventory/completion gate below is still unimplemented. Keep the four unresolved sources visible, repair their earliest owner coherently before repeating a full cascade, and retain mandatory actual Visual Inspection. No approval, readiness transition, protected merge, review resolution, closure or Zotero source write occurred. Earlier cooldown/local-only paragraphs below describe their own historical checkpoints, not the current pushed state. + +## Live and visual source-scope checkpoint The [September 6 live/visual audit](doctoring/zotero_metadata_visual_audit.md) ran the freshly built #9 owner executable at local `f8566408e6a3017cf775fadf2a2f7e50b2d20dc6` against the actual Zotero Local API. It completed in **26.29 seconds**, retained a private `0600` report, and verified **8,326 metadata records / 3,715 bibliographic proposals**, API 3, schema 44, Zotero 10.0.1 and library revision 2. All retained bibliographic revisions are zero and the new guard admits them unchanged. There are **3,658 abstentions**, 57 other deterministic proposals and 49 duplicate-candidate groups; no proposal is an approved label. No full text or model was invoked and no source was changed. From 6779fc40c71eccb03b0784cee6c3b5c14fb6e25a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 20:46:43 +0900 Subject: [PATCH 22/52] docs(research): track complete source inventory and admission gaps --- docs/product-technical-gap-baseline.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 92ed2180..df912ff2 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,7 +4,15 @@ This file records code-current product and technical gaps. Exact PR/check/run coordinates are evidence snapshots, not mutable-head dependencies. Live protected-branch, PR, issue and workflow state wins whenever it advances after this snapshot. Refresh the changed PR's metadata after each documentation commit; evidence from another PR or an earlier head does not transfer. -## Latest post-cooldown integration checkpoint +## Latest source-inventory owner repair checkpoint + +The existing #9 producer was normally pushed at `51c7df6d03f072449422fd58ca24b2f9d6026f07`, preserving `f856640` and Foundation `b538470`. [Its source-scope evidence](https://github.com/ContextualWisdomLab/ConceptWeave/blob/51c7df6d03f072449422fd58ca24b2f9d6026f07/docs/doctoring/zotero_source_scope.md) binds inventory RED `48dcd0d`, adjacency source `48c3525`, isolated blank-key RED `3a57f3b` and final shared-reader source `1e95d6eb979e66ecb7dae4f81f18a6b0a91b7624`. Fresh owner-head **47 tests / 10 unfiltered suites** pass; source strict Clippy/rustdoc/release and unchanged normalized coverage **123/123 functions, 751/751 regions, 114/114 branches** pass. Raw LLVM **1231/1232 lines, 1985/1993 regions, 113/114 branches** is not 100%. + +A genuine read of the `48c3525` executable completed in **17.61 seconds**, preserving **8,326 = 3,715 bibliographic proposals + 4,611 other metadata records** and exactly the four previously observed pending source identities. Bibliographic proposals compare equal to the prior private report; standalone descendants, orphan trees and cycles have unit regression coverage, not fabricated real-world examples. The live run precedes the later blank-key guard. Independent producer review reran three focused tests at `48c3525`; it is not GitHub approval of the newer final head. A new native Visual Inspection attempt failed because the Mac is locked; no new screenshot is verified. + +**This root runtime is unchanged and has not adopted the new owner delta.** Next integration must require both inventory fields on restoration, validate the exact observed identity partition and recompute pending ancestry before worksheet, direct golden/duplicate evaluation and write verifiers. Preserve bibliography-only progress separately from whole-library reconciliation; proposal-only approval digests do not implicitly bind inventory, and incompatible full-text captures must fail rather than be rewritten. Scope completion and independent governance remain open. Actual decisions/approvals remain 0/3,715 plus four unresolved sources; source audit33/76, releases7/33, adoption0 and lifecycle capability28 are unchanged. No protected merge, source mutation or new model call is claimed. + +## Previous post-cooldown integration checkpoint The ordinary GraphQL audit succeeded at **2026-09-06 11:07:24 UTC**, after the conservative 11:06:12 retry boundary. Its paginated snapshot retained **33 open PRs, 32 Drafts and 36 unresolved threads**; the latest 30 reviews per PR contained no current-head approval (#6 has older reviews outside that window). Protected main remained `f4f440dd58c77d7cd90dff8a1eb2eeb9a9940425`. A fresh ruleset 18156473 read retained one independent approval, stale dismissal, resolved threads, seven central workflows and deletion/non-fast-forward protections. #35 now reports `REVIEW_REQUIRED`; the prior `CHANGES_REQUESTED` snapshot is historical. From e9ff78ee7057b754aa844cb1ced538228ab6156e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 08:35:59 +0900 Subject: [PATCH 23/52] test: bind full-text write fixture to complete proposal scope --- crates/conceptweave-zotero/src/full_text_write_tests.rs | 1 + 1 file changed, 1 insertion(+) diff --git a/crates/conceptweave-zotero/src/full_text_write_tests.rs b/crates/conceptweave-zotero/src/full_text_write_tests.rs index 27599074..e332ad03 100644 --- a/crates/conceptweave-zotero/src/full_text_write_tests.rs +++ b/crates/conceptweave-zotero/src/full_text_write_tests.rs @@ -623,6 +623,7 @@ fn write_scope_fixture( library_version: report.library_version, rule_revision: report.rule_revision.clone(), snapshot_digest: report.snapshot_digest.clone(), + proposal_digest: crate::classification_proposal_digest(report), snapshot_items: report.snapshot_items.clone(), changes: report .classified_items From 75b9de7ff3bbc29388edc9944febba1e50978377 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 08:37:30 +0900 Subject: [PATCH 24/52] test: require complete source admission and prior rollback envelope --- .../src/full_text_capture_tests.rs | 19 ++++++ .../src/full_text_write_tests.rs | 68 ++++++++----------- 2 files changed, 46 insertions(+), 41 deletions(-) diff --git a/crates/conceptweave-zotero/src/full_text_capture_tests.rs b/crates/conceptweave-zotero/src/full_text_capture_tests.rs index 4abf0c75..a862f826 100644 --- a/crates/conceptweave-zotero/src/full_text_capture_tests.rs +++ b/crates/conceptweave-zotero/src/full_text_capture_tests.rs @@ -725,6 +725,25 @@ fn review_view_separates_two_text_parents_and_excludes_standalone_attachments() .is_err() ); assert_eq!(approval_calls, 0); + let scope = full_text_write_tests::write_scope_fixture(&report, &capture); + let write_calls = std::cell::Cell::new(0); + assert!( + crate::build_full_text_write_plan( + &report, + &capture, + scope, + |_| { + write_calls.set(write_calls.get() + 1); + true + }, + |_| { + write_calls.set(write_calls.get() + 1); + true + }, + ) + .is_err() + ); + assert_eq!(write_calls.get(), 0); assert_eq!(report.pending_source_item_keys, ["FGHI789A"]); } diff --git a/crates/conceptweave-zotero/src/full_text_write_tests.rs b/crates/conceptweave-zotero/src/full_text_write_tests.rs index e332ad03..ee4c56cd 100644 --- a/crates/conceptweave-zotero/src/full_text_write_tests.rs +++ b/crates/conceptweave-zotero/src/full_text_write_tests.rs @@ -550,58 +550,44 @@ fn full_text_write_bound_rollback_retry_and_delayed_reconciliation() { |_| -> Result { Err(()) }, ) .unwrap(); - let retried = if delayed_read { - assert!( - crate::retry_full_text_rollback( - &partial, - |_| -> Result { - panic!("must reconcile first") - }, - |_| -> Result { - panic!("must reconcile first") - } - ) - .is_err() - ); - let reconciled = - crate::reconcile_full_text_rollback(&partial, |item_key| store.read_item(item_key)) - .unwrap(); - assert_eq!( - serde_json::to_value(&reconciled).unwrap()["reconciliation_result"]["state"], - "unchanged" - ); - crate::retry_full_text_reconciled_rollback( - &reconciled, - |item_key| store.read_item(item_key), - |request| store.write_item(request), - ) - .unwrap() - } else { + assert!( crate::retry_full_text_rollback( &partial, - |item_key| store.read_item(item_key), - |request| store.write_item(request), + |_| -> Result { panic!("unknown inverse") }, + |_| -> Result { panic!("unknown inverse") }, ) - .unwrap() - }; - let result = serde_json::to_value(retried).unwrap(); + .is_err() + ); + let reconciled = + crate::reconcile_full_text_rollback(&partial, |item_key| store.read_item(item_key)) + .unwrap(); + let result = serde_json::to_value(&reconciled).unwrap(); + assert_eq!( + result["rollback_receipt"], + serde_json::to_value(&partial).unwrap() + ); assert_eq!( result["full_text_write_v1"], serde_json::to_value(&plan).unwrap()["full_text_write_v1"] ); - assert_eq!(result["rollback_result"]["outcome"], "restored"); - assert_eq!( - result["rollback_result"]["restored_item_keys"] - .as_array() - .unwrap() - .len(), - 2 + assert_eq!(result["reconciliation_result"]["state"], "indeterminate"); + assert!( + crate::retry_full_text_reconciled_rollback( + &reconciled, + |_| -> Result { + panic!("observation is not authority") + }, + |_| -> Result { + panic!("observation is not authority") + }, + ) + .is_err() ); - assert_eq!(store.write_count.get(), 4); + assert_eq!(store.write_count.get(), 2); } } -fn write_scope_fixture( +pub(super) fn write_scope_fixture( report: &ClassificationReport, capture: &FullTextCapture, ) -> FullTextWriteScope { From 9fcc8bbe3587e28e048893dcada25e9b981c9c4e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 08:38:49 +0900 Subject: [PATCH 25/52] fix: retain complete source and rollback scope before authority --- .../src/full_text_review.rs | 4 ++- .../src/full_text_write.rs | 26 +++++++------------ 2 files changed, 12 insertions(+), 18 deletions(-) diff --git a/crates/conceptweave-zotero/src/full_text_review.rs b/crates/conceptweave-zotero/src/full_text_review.rs index 9d724f1b..6ac44e88 100644 --- a/crates/conceptweave-zotero/src/full_text_review.rs +++ b/crates/conceptweave-zotero/src/full_text_review.rs @@ -188,7 +188,9 @@ fn prepare_full_text_review( reviewed: &FullTextReviewedGoldenSet, ) -> Result { validate_review_capture(report, capture, &reviewed.capture_digest)?; - if reviewed.reviewed_golden_set.labels.len() != report.classified_items.len() { + if reviewed.reviewed_golden_set.labels.len() != report.classified_items.len() + || !report.pending_source_item_keys.is_empty() + { return Err(FullTextError("full-text review is invalid or unverified")); } crate::prepare_reviewed_golden_set(report, &reviewed.reviewed_golden_set) diff --git a/crates/conceptweave-zotero/src/full_text_write.rs b/crates/conceptweave-zotero/src/full_text_write.rs index ac064bf1..53565189 100644 --- a/crates/conceptweave-zotero/src/full_text_write.rs +++ b/crates/conceptweave-zotero/src/full_text_write.rs @@ -99,9 +99,10 @@ pub struct FullTextRollbackReceipt { } /// Read-only reconciliation retaining the same scope and untouched recovery work. -/// An indeterminate result cannot be retried until another observation resolves it. +/// The complete preceding receipt stays attached; observation never resolves causality. #[derive(Serialize)] -pub struct FullTextRollbackReconciliationReceipt { +pub struct FullTextRollbackReconciliationReceipt<'receipt> { + rollback_receipt: &'receipt FullTextRollbackReceipt, full_text_write_v1: FullTextWriteBinding, reconciliation_result: crate::ClassificationRollbackReconciliationReceipt, remaining_operations: Vec, @@ -176,21 +177,11 @@ pub fn build_full_text_write_plan( pub fn execute_full_text_write_plan( plan: &FullTextWritePlan, preflight: impl FnMut(&str) -> Result, - mut write_item: impl FnMut( - &ClassificationWriteRequest, - ) -> Result, + write_item: impl FnMut(&ClassificationWriteRequest) -> Result, ) -> FullTextWriteReceipt { - let mut last_request = None; let write_result = - crate::execute_classification_write_plan(&plan.write_plan, preflight, |request| { - last_request = Some(request.clone()); - write_item(request) - }); - let indeterminate_request = if write_result.indeterminate_item_key.is_some() { - last_request - } else { - None - }; + crate::execute_classification_write_plan(&plan.write_plan, preflight, write_item); + let indeterminate_request = write_result.indeterminate_request.clone(); FullTextWriteReceipt { full_text_write_v1: plan.full_text_write_v1.clone(), write_result, @@ -268,13 +259,14 @@ pub fn retry_full_text_rollback( pub fn reconcile_full_text_rollback( receipt: &FullTextRollbackReceipt, read_item: impl FnOnce(&str) -> Result, -) -> Result { +) -> Result, FullTextError> { let operation = receipt .rollback_result .indeterminate_operation .as_ref() .ok_or(INVALID_WRITE_SCOPE)?; Ok(FullTextRollbackReconciliationReceipt { + rollback_receipt: receipt, full_text_write_v1: receipt.full_text_write_v1.clone(), reconciliation_result: crate::reconcile_classification_rollback(operation, read_item), remaining_operations: receipt.rollback_result.remaining_operations.clone(), @@ -284,7 +276,7 @@ pub fn reconcile_full_text_rollback( /// Retries a resolved operation and its untouched tail through complete preflight. /// Already restored work is not written again; unresolved work makes zero I/O. pub fn retry_full_text_reconciled_rollback( - receipt: &FullTextRollbackReconciliationReceipt, + receipt: &FullTextRollbackReconciliationReceipt<'_>, preflight: impl FnMut(&str) -> Result, write_item: impl FnMut(&ClassificationWriteRequest) -> Result, ) -> Result { From 3547111da2c1c84844b5465b91d199ea81658a12 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 08:40:10 +0900 Subject: [PATCH 26/52] test: preserve uncertain attempts and earlier inverse outcomes --- .../src/full_text_write_tests.rs | 224 ++++++++++-------- 1 file changed, 119 insertions(+), 105 deletions(-) diff --git a/crates/conceptweave-zotero/src/full_text_write_tests.rs b/crates/conceptweave-zotero/src/full_text_write_tests.rs index ee4c56cd..fb3dab26 100644 --- a/crates/conceptweave-zotero/src/full_text_write_tests.rs +++ b/crates/conceptweave-zotero/src/full_text_write_tests.rs @@ -150,6 +150,18 @@ fn full_text_write_observation_refuses_non_unknown_receipts_without_reading() { } }, ); + if scenario == 3 { + let observed = + crate::observe_full_text_write(&receipt, |item_key| store.read_item(item_key)) + .unwrap(); + let result = serde_json::to_value(observed).unwrap(); + assert_eq!( + result["write_receipt"], + serde_json::to_value(&receipt).unwrap() + ); + assert_eq!(store.write_count.get(), 0); + continue; + } assert!( serde_json::to_value(&receipt) .unwrap() @@ -167,7 +179,7 @@ fn full_text_write_observation_refuses_non_unknown_receipts_without_reading() { } #[test] -fn full_text_write_reconciliation_distinguishes_restored_unknown_and_failed_reads() { +fn full_text_write_reconciliation_retains_matching_changed_and_failed_observations() { for observation in 0..3 { let report = report_fixture(); let capture = capture_with(&report, 4096, &mut |request_path, _| { @@ -218,45 +230,32 @@ fn full_text_write_reconciliation_distinguishes_restored_unknown_and_failed_read serde_json::to_value(&plan).unwrap()["full_text_write_v1"] ); assert_eq!(result["remaining_operations"].as_array().unwrap().len(), 1); - if observation == 0 { - assert_eq!(result["reconciliation_result"]["state"], "restored"); - let restored = crate::retry_full_text_reconciled_rollback( + assert_eq!( + result["rollback_receipt"], + serde_json::to_value(&partial).unwrap() + ); + assert_eq!(result["reconciliation_result"]["state"], "indeterminate"); + assert!( + crate::retry_full_text_reconciled_rollback( &reconciled, - |item_key| store.read_item(item_key), - |request| store.write_item(request), + |_| -> Result { + panic!("unresolved retry read") + }, + |_| -> Result { + panic!("unresolved retry write") + } ) - .unwrap(); - let final_result = serde_json::to_value(restored).unwrap(); - assert_eq!(final_result["rollback_result"]["outcome"], "restored"); - assert_eq!( - final_result["rollback_result"]["restored_item_keys"] - .as_array() - .unwrap() - .len(), - 1 - ); - assert_eq!(store.write_count.get(), 4); - } else { - assert_eq!(result["reconciliation_result"]["state"], "indeterminate"); - assert!( - crate::retry_full_text_reconciled_rollback( - &reconciled, - |_| -> Result { - panic!("unresolved retry read") - }, - |_| -> Result { - panic!("unresolved retry write") - } - ) - .is_err() - ); - assert_eq!(store.write_count.get(), 2); - } + .is_err() + ); + assert_eq!( + store.write_count.get(), + if observation == 0 { 3 } else { 2 } + ); } } #[test] -fn full_text_write_known_partial_failure_keeps_only_verified_inverse_work() { +fn full_text_write_unknown_partial_failure_retains_verified_work_without_recovery_authority() { let report = report_fixture(); let capture = capture_with(&report, 4096, &mut |request_path, _| { Ok(response_fixture(request_path)) @@ -278,7 +277,11 @@ fn full_text_write_known_partial_failure_keeps_only_verified_inverse_work() { ); let result = serde_json::to_value(&receipt).unwrap(); assert_eq!(result["write_result"]["outcome"], "partial_failure"); - assert!(result["write_result"]["indeterminate_item_key"].is_null()); + assert_eq!(result["write_result"]["indeterminate_item_key"], "DEFG5678"); + assert_eq!( + result["indeterminate_request"], + result["write_result"]["indeterminate_request"] + ); assert_eq!( result["write_result"]["rollback_operations"] .as_array() @@ -286,19 +289,15 @@ fn full_text_write_known_partial_failure_keeps_only_verified_inverse_work() { .len(), 1 ); - let restored = crate::execute_full_text_rollback( - &receipt, - |item_key| store.read_item(item_key), - |request| store.write_item(request), - ) - .unwrap(); - let restored = serde_json::to_value(restored).unwrap(); - assert_eq!( - restored["full_text_write_v1"], - serde_json::to_value(&plan).unwrap()["full_text_write_v1"] + assert!( + crate::execute_full_text_rollback( + &receipt, + |_| -> Result { panic!("unknown original read") }, + |_| -> Result { panic!("unknown original write") }, + ) + .is_err() ); - assert_eq!(restored["rollback_result"]["outcome"], "restored"); - assert_eq!(store.write_count.get(), 2); + assert_eq!(store.write_count.get(), 1); } struct WriteStore { @@ -523,67 +522,82 @@ fn full_text_write_stale_preflight_and_unknown_writes_never_grant_empty_restorat #[test] fn full_text_write_bound_rollback_retry_and_delayed_reconciliation() { for delayed_read in [false, true] { - let report = report_fixture(); - let capture = capture_with(&report, 4096, &mut |request_path, _| { - Ok(response_fixture(request_path)) - }) - .unwrap(); - let mut scope = write_scope_fixture(&report, &capture); - scope.mode = WriteMode::Execute; - let plan = - build_full_text_write_plan(&report, &capture, scope, |_| true, |_| true).unwrap(); - let store = WriteStore::from_report(&report); - let written = execute_full_text_write_plan( - &plan, - |item_key| store.read_item(item_key), - |request| store.write_item(request), - ); - store.read_count.set(0); - let partial = crate::execute_full_text_rollback( - &written, - |item_key| { - if delayed_read && store.read_count.get() >= 2 { - return Err(()); - } - store.read_item(item_key) - }, - |_| -> Result { Err(()) }, - ) - .unwrap(); - assert!( - crate::retry_full_text_rollback( - &partial, - |_| -> Result { panic!("unknown inverse") }, - |_| -> Result { panic!("unknown inverse") }, - ) - .is_err() - ); - let reconciled = - crate::reconcile_full_text_rollback(&partial, |item_key| store.read_item(item_key)) - .unwrap(); - let result = serde_json::to_value(&reconciled).unwrap(); - assert_eq!( - result["rollback_receipt"], - serde_json::to_value(&partial).unwrap() - ); - assert_eq!( - result["full_text_write_v1"], - serde_json::to_value(&plan).unwrap()["full_text_write_v1"] - ); - assert_eq!(result["reconciliation_result"]["state"], "indeterminate"); - assert!( - crate::retry_full_text_reconciled_rollback( - &reconciled, - |_| -> Result { - panic!("observation is not authority") + for failed_index in 0..2 { + let report = report_fixture(); + let capture = capture_with(&report, 4096, &mut |request_path, _| { + Ok(response_fixture(request_path)) + }) + .unwrap(); + let mut scope = write_scope_fixture(&report, &capture); + scope.mode = WriteMode::Execute; + let plan = + build_full_text_write_plan(&report, &capture, scope, |_| true, |_| true).unwrap(); + let store = WriteStore::from_report(&report); + let written = execute_full_text_write_plan( + &plan, + |item_key| store.read_item(item_key), + |request| store.write_item(request), + ); + store.read_count.set(0); + let partial = crate::execute_full_text_rollback( + &written, + |item_key| { + if delayed_read && store.read_count.get() >= 2 { + return Err(()); + } + store.read_item(item_key) }, - |_| -> Result { - panic!("observation is not authority") + |request| { + if store.write_count.get() == 2 + failed_index { + Err(()) + } else { + store.write_item(request) + } }, ) - .is_err() - ); - assert_eq!(store.write_count.get(), 2); + .unwrap(); + assert!( + crate::retry_full_text_rollback( + &partial, + |_| -> Result { panic!("unknown inverse") }, + |_| -> Result { panic!("unknown inverse") }, + ) + .is_err() + ); + let reconciled = + crate::reconcile_full_text_rollback(&partial, |item_key| store.read_item(item_key)) + .unwrap(); + let result = serde_json::to_value(&reconciled).unwrap(); + assert_eq!( + result["rollback_receipt"], + serde_json::to_value(&partial).unwrap() + ); + assert_eq!( + result["full_text_write_v1"], + serde_json::to_value(&plan).unwrap()["full_text_write_v1"] + ); + assert_eq!(result["reconciliation_result"]["state"], "indeterminate"); + assert!( + crate::retry_full_text_reconciled_rollback( + &reconciled, + |_| -> Result { + panic!("observation is not authority") + }, + |_| -> Result { + panic!("observation is not authority") + }, + ) + .is_err() + ); + assert_eq!( + result["rollback_receipt"]["rollback_result"]["restored_item_keys"] + .as_array() + .unwrap() + .len(), + failed_index + ); + assert_eq!(store.write_count.get(), 2 + failed_index); + } } } From cf831d62b2a64c56cd41bdc65d13030967e095d7 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 08:41:05 +0900 Subject: [PATCH 27/52] docs: record source and recovery scope repair evidence --- docs/adr/0007-reviewed-zotero-write-plan.md | 29 +++++++++++++++++++++ docs/product-technical-gap-baseline.md | 10 ++++++- 2 files changed, 38 insertions(+), 1 deletion(-) diff --git a/docs/adr/0007-reviewed-zotero-write-plan.md b/docs/adr/0007-reviewed-zotero-write-plan.md index c227dcb4..09933cb9 100644 --- a/docs/adr/0007-reviewed-zotero-write-plan.md +++ b/docs/adr/0007-reviewed-zotero-write-plan.md @@ -12,6 +12,35 @@ The installed-version and runtime-availability statements in the original altern ## Decision +### Complete-source and recovery-envelope integration (2026-09-07, Proposed) + +PR39 normal merge `4e856c5` retains its typed full-text write scope and PR38's +complete inventory validation. An extracted preparation helper had bypassed the +pending-source completion gate: a completed paper worksheet could reach meaning +approval while standalone evidence remained unresolved. The inherited mixed-source +test fails at that boundary. The guard belongs in shared full-text preparation, +which both evaluation and write admission call, not only in the public evaluator. +Write preparation also retains the parent's proposal binding and inventory checks +before either real authority callback. Starting and locally finalizing review +remain distinct from complete admission; no paper or pending source is dropped. + +The delayed rollback wrapper had copied an operation tail and binding but omitted +the preceding receipt's verified outcomes, exact failed request and observation. +Committed test `75b9de7` fails because that preceding envelope is absent. Repair +`9fcc8bb` borrows the opaque prior receipt using the existing original-observation +pattern, while preserving existing serialized binding, observation and tail fields. +An observation cannot outlive its source receipt or deserialize into executable +authority. The executor reuses the core's exact failed request instead of tracking +the last request a second time. Follow-up tests include an earlier verified inverse +before a later failure, as well as matching, changed and unavailable observations. + +An operation-only reconstruction was rejected because it loses prior evidence; +duplicating the whole receipt into a new owned authority type was unnecessary for +this in-process read-only view. The borrowed lifetime requires callers to retain +the earlier receipt; durable restart admission remains separate unfinished work. +Matching metadata never proves causal completion or permits a retry. These local +changes supply neither independent governance approval nor live-write permission. + ConceptWeave builds a local-only `ClassificationWritePlan` from an externally verified complete review set. Dry-run is the default. The review must match the exact Zotero version, server identity, library version, classifier revision, raw-snapshot digest, complete item-key/item-version coordinates, and observed collection/tag state. The plan retains the reviewed Zotero version used for execute eligibility, while private fields and read-only accessors prevent external callers from mutating validated execution state. Write-execution receipts copy the plan's review and snapshot coordinates. Legacy rollback receipts retain conditional restoration evidence but do not carry those review/authority coordinates; they must not be advertised as full-text-bound approval evidence. It rejects unknown or duplicate items, detached item revisions, blank or duplicate metadata, unsupported tag types, no-op changes, and `NeedsStewardReview` as a write decision. Operations are deterministic and retain complete before, after, and rollback states. Manual tag markers `None` and `0` are canonicalized to `None`; automatic tag type `1` is preserved. Execute planning fails closed for Zotero versions below 10. The plan contains no API key and performs no network call. Dry-run enumerates every operation as not attempted. The execution core accepts caller-owned preflight and write functions, preflights the complete plan before the first mutation, and verifies server, library, item revision, collection, and typed-tag responses. After a failed or invalid response, a follow-up read is observation only: matching before-state cannot prove a delayed request terminated, and matching after-state or a newer revision cannot prove which writer caused it. The receipt keeps the exact submitted request and optional observation, always names that item as indeterminate, and creates no inverse for that unconfirmed write. Earlier directly verified applied items and their inverse coordinates remain intact. The API key remains adapter-owned. Cross-item transactionality is not claimed, and source records and attachments are never deleted. diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index a752beef..2ffe9b40 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,9 +1,17 @@ # Product / Technical Gap Baseline -**Snapshot:** 2026-09-06 +**Snapshot:** 2026-09-07 This file records code-current product and technical gaps. Exact PR/check/run coordinates are evidence snapshots, not mutable-head dependencies. Live protected-branch, PR, issue and workflow state wins whenever it advances after this snapshot. Refresh the changed PR's metadata after each documentation commit; evidence from another PR or an earlier head does not transfer. +## September 7 PR39 source-scope integration in verification + +Baseline at `6779fc40c71eccb03b0784cee6c3b5c14fb6e25a` passes 258 tests/41 unfiltered suites. Normal merge `4e856c5` preserves PR39 and PR38 `76d3df5733c37761b6778e24d89f22c01f367bb3`; no predecessor was closed or force-pushed. Fixture `e9ff78e` adds the required proposal digest after an integration compile failure, not a production RED. The focused integrated run then fails five tests: the inherited complete-source regression and four obsolete recovery expectations. Committed regression `75b9de7` separately fails on the missing whole prior rollback receipt. Logs are `/tmp/conceptweave-pr39-{baseline,focused-red,behavior-red,envelope-red}.log`. + +Repair `9fcc8bb` restores pending-source admission in shared full-text preparation, retains the whole preceding rollback receipt by reference and reuses the core exact failed request. Independent bounded review requested coverage of earlier successfully restored work; the follow-up includes both inverse failure positions. Existing matching-value scenarios remain tested but no longer infer completion or permit recovery. Proposed ADR0007 records the boundary, alternatives and lifetime trade-off. Final workspace, strict checks and coverage are not yet claimed. + +Actual paper decisions and independently approved labels remain separately 0/3,715 with four pending sources. The native Zotero visual inspection succeeded at the PR37 checkpoint; older locked-screen observations below are historical. No real Zotero write, hosted GREEN, protected merge, release or immutable CO adoption is claimed. + ## Historical source-inventory owner repair checkpoint The existing #9 producer was normally pushed at `51c7df6d03f072449422fd58ca24b2f9d6026f07`, preserving `f856640` and Foundation `b538470`. [Its source-scope evidence](https://github.com/ContextualWisdomLab/ConceptWeave/blob/51c7df6d03f072449422fd58ca24b2f9d6026f07/docs/doctoring/zotero_source_scope.md) binds inventory RED `48dcd0d`, adjacency source `48c3525`, isolated blank-key RED `3a57f3b` and final shared-reader source `1e95d6eb979e66ecb7dae4f81f18a6b0a91b7624`. Fresh owner-head **47 tests / 10 unfiltered suites** pass; source strict Clippy/rustdoc/release and unchanged normalized coverage **123/123 functions, 751/751 regions, 114/114 branches** pass. Raw LLVM **1231/1232 lines, 1985/1993 regions, 113/114 branches** is not 100%. From 1821eb6db70897662f52b3bb106a11f1f385e420 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 08:48:56 +0900 Subject: [PATCH 28/52] docs: align full-text recovery contract with retained uncertainty --- docs/TRD.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/TRD.md b/docs/TRD.md index 3c8b3f6e..df5beaa3 100644 --- a/docs/TRD.md +++ b/docs/TRD.md @@ -134,7 +134,9 @@ Typed full-text write admission requires `FullTextWriteScope`: the complete revi `FullTextWritePlan` retains the complete approved typed scope and a `full_text_write_v1` commitment. Its scope digest hashes the compact serde JSON tuple of the domain string `conceptweave-full-text-write-v1` and complete scope. This is an exact typed-representation identity, not RFC 8785 canonical JSON: reordering input arrays requires fresh authorization even if normalized operations would agree. Receipts retain this digest, capture/proposal/snapshot coordinates and mode. They omit original review/authority inputs and source text; transport errors remain reduced to the existing closed outcomes. The private inner legacy plan and rollback operations are not public executable projections. -`execute_full_text_write_plan` reuses complete preflight and conditional replacement. `execute_full_text_rollback` accepts only one bound write receipt, rejects dry-run, unknown write state and empty inverse work before I/O, and preserves the binding. Rollback retry accepts only the original receipt's known pending work. An indeterminate rollback must first pass read-only reconciliation; its untouched tail stays attached and is retried only after an unchanged/restored observation, with fresh complete preflight. Each receipt describes its own attempt; retain earlier receipts for the full history. No operation-slice argument lets callers combine receipt scopes. +`execute_full_text_write_plan` reuses complete preflight, conditional replacement and the core's exact indeterminate request. `execute_full_text_rollback` accepts only one bound write receipt, rejects dry-run, unknown write state and empty inverse work before I/O, and preserves the binding. Rollback retry accepts only the original receipt's known pending work. Delayed reconciliation borrows the complete preceding rollback receipt, preserving earlier verified restorations, the exact failed request, its earlier observation and untouched work. Matching restored or unchanged metadata remains indeterminate and grants no retry authority. The borrowed view cannot outlive its receipt. No operation-slice argument lets callers combine receipt scopes. + +Shared full-text preparation rejects unresolved source records before either meaning or write verification, even when every bibliographic decision is filled. Shared report validation and the required proposal digest remain part of write preparation. Local finalization does not bypass complete-source admission or supply independent approval. These types are serialize-only and owner-only audit artifacts. They cannot restore executable authority after a restart. Legacy nested write DTOs remain permissive JSON; no strict persisted JSON admission is claimed. There is no new transport, CLI write/approval issuer or cross-service SQL. Whole-scope external authority verification, revocation policy, durable recovery admission, delayed reconciliation of an unknown original write and approved live execution remain incomplete. [Proposed ADR 0007](adr/0007-reviewed-zotero-write-plan.md) records the trade-offs. From c216e47b5f8de58f5275865b4f616b54cf759881 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 08:53:27 +0900 Subject: [PATCH 29/52] fix: reject observation-only retry without dead execution path --- .../src/full_text_write.rs | 25 +++++-------------- docs/adr/0007-reviewed-zotero-write-plan.md | 7 ++++++ 2 files changed, 13 insertions(+), 19 deletions(-) diff --git a/crates/conceptweave-zotero/src/full_text_write.rs b/crates/conceptweave-zotero/src/full_text_write.rs index 53565189..e0a17224 100644 --- a/crates/conceptweave-zotero/src/full_text_write.rs +++ b/crates/conceptweave-zotero/src/full_text_write.rs @@ -273,25 +273,12 @@ pub fn reconcile_full_text_rollback( }) } -/// Retries a resolved operation and its untouched tail through complete preflight. -/// Already restored work is not written again; unresolved work makes zero I/O. +/// Rejects retries from read-only observations without calling either adapter. +/// Metadata cannot resolve causal uncertainty; independent resolution is required. pub fn retry_full_text_reconciled_rollback( - receipt: &FullTextRollbackReconciliationReceipt<'_>, - preflight: impl FnMut(&str) -> Result, - write_item: impl FnMut(&ClassificationWriteRequest) -> Result, + _receipt: &FullTextRollbackReconciliationReceipt<'_>, + _preflight: impl FnMut(&str) -> Result, + _write_item: impl FnMut(&ClassificationWriteRequest) -> Result, ) -> Result { - if receipt.reconciliation_result.state == crate::ClassificationRollbackState::Indeterminate { - return Err(INVALID_WRITE_SCOPE); - } - let operations = receipt - .reconciliation_result - .retry_operation - .iter() - .cloned() - .chain(receipt.remaining_operations.iter().cloned()) - .collect::>(); - Ok(FullTextRollbackReceipt { - full_text_write_v1: receipt.full_text_write_v1.clone(), - rollback_result: crate::execute_classification_rollback(&operations, preflight, write_item), - }) + Err(INVALID_WRITE_SCOPE) } diff --git a/docs/adr/0007-reviewed-zotero-write-plan.md b/docs/adr/0007-reviewed-zotero-write-plan.md index 09933cb9..c66c861c 100644 --- a/docs/adr/0007-reviewed-zotero-write-plan.md +++ b/docs/adr/0007-reviewed-zotero-write-plan.md @@ -41,6 +41,13 @@ the earlier receipt; durable restart admission remains separate unfinished work. Matching metadata never proves causal completion or permits a retry. These local changes supply neither independent governance approval nor live-write permission. +Independent follow-up traced every public reconciliation constructor: each emits +indeterminate status, so the wrapper's success branch was unreachable. Preserve +the public function signature but reject every observation-only retry before I/O; +remove dead execution code instead of fabricating resolved private receipts in +tests. A future successful retry requires a separately designed and independently +verified causal-resolution contract, not another metadata observation. + ConceptWeave builds a local-only `ClassificationWritePlan` from an externally verified complete review set. Dry-run is the default. The review must match the exact Zotero version, server identity, library version, classifier revision, raw-snapshot digest, complete item-key/item-version coordinates, and observed collection/tag state. The plan retains the reviewed Zotero version used for execute eligibility, while private fields and read-only accessors prevent external callers from mutating validated execution state. Write-execution receipts copy the plan's review and snapshot coordinates. Legacy rollback receipts retain conditional restoration evidence but do not carry those review/authority coordinates; they must not be advertised as full-text-bound approval evidence. It rejects unknown or duplicate items, detached item revisions, blank or duplicate metadata, unsupported tag types, no-op changes, and `NeedsStewardReview` as a write decision. Operations are deterministic and retain complete before, after, and rollback states. Manual tag markers `None` and `0` are canonicalized to `None`; automatic tag type `1` is preserved. Execute planning fails closed for Zotero versions below 10. The plan contains no API key and performs no network call. Dry-run enumerates every operation as not attempted. The execution core accepts caller-owned preflight and write functions, preflights the complete plan before the first mutation, and verifies server, library, item revision, collection, and typed-tag responses. After a failed or invalid response, a follow-up read is observation only: matching before-state cannot prove a delayed request terminated, and matching after-state or a newer revision cannot prove which writer caused it. The receipt keeps the exact submitted request and optional observation, always names that item as indeterminate, and creates no inverse for that unconfirmed write. Earlier directly verified applied items and their inverse coordinates remain intact. The API key remains adapter-owned. Cross-item transactionality is not claimed, and source records and attachments are never deleted. From 70127f3d321bc88c5495dfa23084fa3003c14b01 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 08:54:16 +0900 Subject: [PATCH 30/52] docs: track final retry rejection verification --- docs/product-technical-gap-baseline.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 2ffe9b40..48e5cea6 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -6,6 +6,8 @@ This file records code-current product and technical gaps. Exact PR/check/run co ## September 7 PR39 source-scope integration in verification +Follow-up source `c216e47b5f8de58f5275865b4f616b54cf759881` removes the unreachable observation-only retry success path while preserving its public signature and zero-I/O rejection. Independent review traced every constructor; none can issue causal-resolution authority. No resolved private receipt was fabricated for coverage. TRD `1821eb6` removes the obsolete matching-value recovery claim. The earlier verification session53234 was intentionally stopped with exit130 after compilation and during tests because source changed; it is neither a product failure nor a completed gate. Final-source session1369 is running against `/tmp/conceptweave-pr39-final-{tests,clippy,rustdoc,coverage}.log`. Source3547111's focused11/11 pass predates this final simplification; full final success remains unverified. CodeGraph sync completed, and its exploration session94183 is terminal. + Baseline at `6779fc40c71eccb03b0784cee6c3b5c14fb6e25a` passes 258 tests/41 unfiltered suites. Normal merge `4e856c5` preserves PR39 and PR38 `76d3df5733c37761b6778e24d89f22c01f367bb3`; no predecessor was closed or force-pushed. Fixture `e9ff78e` adds the required proposal digest after an integration compile failure, not a production RED. The focused integrated run then fails five tests: the inherited complete-source regression and four obsolete recovery expectations. Committed regression `75b9de7` separately fails on the missing whole prior rollback receipt. Logs are `/tmp/conceptweave-pr39-{baseline,focused-red,behavior-red,envelope-red}.log`. Repair `9fcc8bb` restores pending-source admission in shared full-text preparation, retains the whole preceding rollback receipt by reference and reuses the core exact failed request. Independent bounded review requested coverage of earlier successfully restored work; the follow-up includes both inverse failure positions. Existing matching-value scenarios remain tested but no longer infer completion or permit recovery. Proposed ADR0007 records the boundary, alternatives and lifetime trade-off. Final workspace, strict checks and coverage are not yet claimed. From 25743e5b8f5e70ef517de5eaa13818e36f33b30f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 08:59:03 +0900 Subject: [PATCH 31/52] docs: audit noema release evidence ownership at exact source --- .../cwl_ontology_capability_inventory.md | 22 ++++++++++++++++--- docs/product-technical-gap-baseline.md | 2 ++ 2 files changed, 21 insertions(+), 3 deletions(-) diff --git a/docs/doctoring/cwl_ontology_capability_inventory.md b/docs/doctoring/cwl_ontology_capability_inventory.md index ceeca4e7..713c4823 100644 --- a/docs/doctoring/cwl_ontology_capability_inventory.md +++ b/docs/doctoring/cwl_ontology_capability_inventory.md @@ -1,6 +1,8 @@ # CWL ontology capability inventory -Evidence snapshot: 2026-09-06. Status: research inventory, not dependency-adoption approval. +Evidence snapshot: 2026-09-07. Status: research inventory, not dependency-adoption approval. + +September 7 adds noema's bounded release-admission audit: **34/76** of the September 6 census are now audited, leaving **42** in that historical denominator. Release-bearing candidates remain **7/34**; verified adoption remains zero. The earlier 33-candidate checkpoints below retain their observation dates. This increment does not recensus the organization or classify papers. ## Scope and evidence limits @@ -142,10 +144,22 @@ Research Intake remains the existing owner. A new utility repository has no demo ## KPI and next actions +### Noema release-admission boundary (2026-09-07) + +| Candidate | Responsibility and exact source | Release and cultivation gate | +| --- | --- | --- | +| noema | Repository capability and review-evidence owner; not ontology generation or semantic approval. Protected `main@0dec8d84b1e4744e7a9c6a77e2e2631a183ee2ab`, complete tree returned with `truncated=false`, Apache-2.0 metadata. [Context-contract admission](https://github.com/ContextualWisdomLab/noema/blob/0dec8d84b1e4744e7a9c6a77e2e2631a183ee2ab/src/context-fabric/context-contract-release-admission.ts) separates structural validation from independently populated release pins. [Regression definitions](https://github.com/ContextualWisdomLab/noema/blob/0dec8d84b1e4744e7a9c6a77e2e2631a183ee2ab/test/context-contract-release-admission.test.ts) reject self-asserted releases, forged artifact identity, missing envelope semantics and unknown pins. | No GitHub releases returned. [Package declaration](https://github.com/ContextualWisdomLab/noema/blob/0dec8d84b1e4744e7a9c6a77e2e2631a183ee2ab/package.json) is private version0.1.0; it is not a published SDK. Registry and deployed service were not verified. Do not copy its TypeScript implementation or treat token access as meaning approval. | + +The source requires immutable version/tag agreement, source/provenance commit agreement, package/SBOM/provenance/source-manifest digests, protected source workflow identity, exact schema/event profiles and complete capabilities. Validation returns detached frozen data but no trust authority. Admission compares every bound field and the capability set against a separately populated trusted lookup. A plausible receipt supplied by the same candidate is not an independent trust anchor. These are inspected source and test definitions, not tests executed here or proof of a deployed verifier. + +[Accepted ADR0001](https://github.com/ContextualWisdomLab/noema/blob/0dec8d84b1e4744e7a9c6a77e2e2631a183ee2ab/docs/adr/0001-evidence-authority-separation.md) separates model verdict, formal review, merge, release and deployment evidence. [ADR0003](https://github.com/ContextualWisdomLab/noema/blob/0dec8d84b1e4744e7a9c6a77e2e2631a183ee2ab/docs/adr/0003-exact-revision-and-live-base.md) remains Proposed, so its intended revision rules are not an accepted or released consumer guarantee. For example, a repository-scoped reviewer token can permit posting a diagnostic but cannot authenticate Zotero labels or publish semantic truth. + +Cultivation stays with existing owners: noema must expose a released, independently authenticated exact-revision evidence contract; context-graph-contracts owns the assertion envelope; ConceptWeave owns semantic review and publication. Consumer conformance must reject stale revisions and preserve authority/evidence distinctions before adoption. The [library boundary decision](https://github.com/ContextualWisdomLab/noema/blob/0dec8d84b1e4744e7a9c6a77e2e2631a183ee2ab/docs/library-boundary-decision.md) defers a separate package until a real independent consumer contract warrants it. Existing internal module separation does not itself establish a second distribution. No utility repository is justified by this audit. DeepWiki structure/question lookup reported the repository unavailable; the exact GitHub sources above supply the audit evidence. + | Measure | Observation | Required next evidence | | --- | --- | --- | -| Metadata census / bounded capability audit | 76 metadata records; 33/33 selected candidates have exact default-head documentation/source/tree and release-query evidence | Audit actual contracts/consumers; metadata coverage is not full source-level discovery, and 43 repositories remain unaudited at that depth. | -| GitHub release with resolved source commit | 7/33 selected candidates, including proprietary naruon, product-domain four-pillars, release-diverged newsdom-api and inkspan's historical release without the relevant current contracts | License, artifact/provenance and consumer conformance; a release count is not permissive-library or adoption evidence. | +| Metadata census / bounded capability audit | September 6 census76; 34/34 selected candidates have exact default-head documentation/source/tree and release-query evidence | Audit actual contracts/consumers; 42 repositories in the historical census remain unaudited at that depth. | +| GitHub release with resolved source commit | 7/34 selected candidates, including proprietary naruon, product-domain four-pillars, release-diverged newsdom-api and inkspan's historical release without the relevant current contracts | License, artifact/provenance and consumer conformance; a release count is not permissive-library or adoption evidence. | | Additional registry-only publication observation | ThreadWeave 0.1.0 on PyPI; not counted in the seven resolved GitHub releases | Bind the needed API and distribution to reviewed source and attestations; no package-registry completeness claim. | | Verified ConceptWeave adoption | 0 demonstrated in this audit | Released owner contract, exact consumer revision and passing contract/runtime evidence. | | Privately retained nonempty full text | 3,203/3,715 parents in the separate [capture evidence](zotero_fulltext_capture_evidence.json); 512 remain without demonstrated nonempty text | New content-bound proposals and authentic review with partial/unknown indexing. The earlier sweep's 800/1,000 abstract-missing subgroup is availability evidence, not a remeasured retained-capture subgroup. | @@ -156,6 +170,8 @@ Review the repaired current snapshot, including missing-abstract and unsupported ## References +ContextualWisdomLab. (2026). *noema* (Commit 0dec8d84b1e4744e7a9c6a77e2e2631a183ee2ab) [Computer software]. GitHub. https://github.com/ContextualWisdomLab/noema/tree/0dec8d84b1e4744e7a9c6a77e2e2631a183ee2ab + ContextualWisdomLab. (2026). *ThreadWeave* (Commit 0fda6e60c2c80ec7b2aa2d58dac6b944dec6a6d0) [Computer software]. GitHub. https://github.com/ContextualWisdomLab/ThreadWeave/tree/0fda6e60c2c80ec7b2aa2d58dac6b944dec6a6d0 ContextualWisdomLab. (2026). *mightyETL* (Commit e550688c80f0dcf4677c0fbe50bd3341429106fb) [Computer software]. GitHub. https://github.com/ContextualWisdomLab/mightyETL/tree/e550688c80f0dcf4677c0fbe50bd3341429106fb diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 48e5cea6..5bda0275 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -6,6 +6,8 @@ This file records code-current product and technical gaps. Exact PR/check/run co ## September 7 PR39 source-scope integration in verification +Final source `c216e47` now passes 310 tests/41 unfiltered suites and strict Clippy. Session1369 continues through the remaining gates; final coverage is not yet claimed. The [noema source audit](doctoring/cwl_ontology_capability_inventory.md#noema-release-admission-boundary-2026-09-07) raises bounded source coverage to34/76 of the September 6 census, leaving42; release-bearing candidates remain7/34 and verified adoption0. Protected noema head `0dec8d84b1e4744e7a9c6a77e2e2631a183ee2ab` separates structural release metadata from independently pinned admission and formal review from model evidence. Its package is private, no GitHub release was returned, and registry/deployed availability is unverified. This is inspected source, not executed noema tests, paper classification, semantic approval or a reason to create another utility repository. + Follow-up source `c216e47b5f8de58f5275865b4f616b54cf759881` removes the unreachable observation-only retry success path while preserving its public signature and zero-I/O rejection. Independent review traced every constructor; none can issue causal-resolution authority. No resolved private receipt was fabricated for coverage. TRD `1821eb6` removes the obsolete matching-value recovery claim. The earlier verification session53234 was intentionally stopped with exit130 after compilation and during tests because source changed; it is neither a product failure nor a completed gate. Final-source session1369 is running against `/tmp/conceptweave-pr39-final-{tests,clippy,rustdoc,coverage}.log`. Source3547111's focused11/11 pass predates this final simplification; full final success remains unverified. CodeGraph sync completed, and its exploration session94183 is terminal. Baseline at `6779fc40c71eccb03b0784cee6c3b5c14fb6e25a` passes 258 tests/41 unfiltered suites. Normal merge `4e856c5` preserves PR39 and PR38 `76d3df5733c37761b6778e24d89f22c01f367bb3`; no predecessor was closed or force-pushed. Fixture `e9ff78e` adds the required proposal digest after an integration compile failure, not a production RED. The focused integrated run then fails five tests: the inherited complete-source regression and four obsolete recovery expectations. Committed regression `75b9de7` separately fails on the missing whole prior rollback receipt. Logs are `/tmp/conceptweave-pr39-{baseline,focused-red,behavior-red,envelope-red}.log`. From f5190a7f2efc8d698ccd16435522fac30deae984 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 09:06:24 +0900 Subject: [PATCH 32/52] test: cover bound rollback retry after preflight-only failure --- .../src/full_text_write_tests.rs | 57 +++++++++++++++++++ 1 file changed, 57 insertions(+) diff --git a/crates/conceptweave-zotero/src/full_text_write_tests.rs b/crates/conceptweave-zotero/src/full_text_write_tests.rs index fb3dab26..e2a1b152 100644 --- a/crates/conceptweave-zotero/src/full_text_write_tests.rs +++ b/crates/conceptweave-zotero/src/full_text_write_tests.rs @@ -462,6 +462,63 @@ fn full_text_write_and_rollback_preserve_binding_and_conditional_state() { ); } +#[test] +fn full_text_write_retries_only_unattempted_rollback_after_failed_preflight() { + let report = report_fixture(); + let capture = capture_with(&report, 4096, &mut |request_path, _| { + Ok(response_fixture(request_path)) + }) + .unwrap(); + let mut scope = write_scope_fixture(&report, &capture); + scope.mode = WriteMode::Execute; + let plan = build_full_text_write_plan(&report, &capture, scope, |_| true, |_| true).unwrap(); + let store = WriteStore::from_report(&report); + let written = execute_full_text_write_plan( + &plan, + |item_key| store.read_item(item_key), + |request| store.write_item(request), + ); + let failed = crate::execute_full_text_rollback( + &written, + |_| -> Result { Err(()) }, + |_| -> Result { + panic!("failed preflight cannot write") + }, + ) + .unwrap(); + let prior = serde_json::to_value(&failed).unwrap(); + assert_eq!(prior["rollback_result"]["outcome"], "preflight_failure"); + assert!(prior["rollback_result"]["indeterminate_request"].is_null()); + assert_eq!( + prior["rollback_result"]["not_attempted_item_keys"] + .as_array() + .unwrap() + .len(), + 2 + ); + assert_eq!(store.write_count.get(), 2); + store.read_count.set(0); + let restored = crate::retry_full_text_rollback( + &failed, + |item_key| store.read_item(item_key), + |request| store.write_item(request), + ) + .unwrap(); + let result = serde_json::to_value(&restored).unwrap(); + assert_eq!(result["full_text_write_v1"], prior["full_text_write_v1"]); + assert_eq!(result["rollback_result"]["outcome"], "restored"); + assert_eq!( + result["rollback_result"]["restored_item_keys"] + .as_array() + .unwrap() + .len(), + 2 + ); + assert_eq!(store.read_count.get(), 2); + assert_eq!(store.write_count.get(), 4); + assert_eq!(serde_json::to_value(&failed).unwrap(), prior); +} + #[test] fn full_text_write_stale_preflight_and_unknown_writes_never_grant_empty_restoration() { for unknown_write in [false, true] { From 7d074f8abc1fcd211bd483b73e3a88fe4de3af49 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 09:07:18 +0900 Subject: [PATCH 33/52] docs: record coverage gap and public retry regression --- docs/product-technical-gap-baseline.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 5bda0275..f8c93543 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -6,6 +6,8 @@ This file records code-current product and technical gaps. Exact PR/check/run co ## September 7 PR39 source-scope integration in verification +Coverage session1369 is now terminal exit1: 426/426 functions and4,425/4,425 normalized regions pass, but normalized branches are729/730. The sole gap is `full_text_write.rs:243`'s nonempty remaining-work branch after a rollback preflight failure. Raw totals are5,352/5,412 lines,7,954/8,086 regions and684/730 branches; these are not raw100%. Test `f5190a7f2efc8d698ccd16435522fac30deae984` obtains the receipt through public execution with a failed preflight and zero inverse writes, then retries the unchanged unattempted work with complete fresh preflight. It preserves the earlier receipt and scope and verifies both restored items. No private resolved receipt or metadata-inferred authority is fabricated. Focused test and unchanged coverage rerun session42218 are in progress at `/tmp/conceptweave-pr39-preflight-retry.log` and `/tmp/conceptweave-pr39-retry-coverage.log`. Do not poll completed1369 or claim final coverage yet; production source remains `c216e47`. + Final source `c216e47` now passes 310 tests/41 unfiltered suites and strict Clippy. Session1369 continues through the remaining gates; final coverage is not yet claimed. The [noema source audit](doctoring/cwl_ontology_capability_inventory.md#noema-release-admission-boundary-2026-09-07) raises bounded source coverage to34/76 of the September 6 census, leaving42; release-bearing candidates remain7/34 and verified adoption0. Protected noema head `0dec8d84b1e4744e7a9c6a77e2e2631a183ee2ab` separates structural release metadata from independently pinned admission and formal review from model evidence. Its package is private, no GitHub release was returned, and registry/deployed availability is unverified. This is inspected source, not executed noema tests, paper classification, semantic approval or a reason to create another utility repository. Follow-up source `c216e47b5f8de58f5275865b4f616b54cf759881` removes the unreachable observation-only retry success path while preserving its public signature and zero-I/O rejection. Independent review traced every constructor; none can issue causal-resolution authority. No resolved private receipt was fabricated for coverage. TRD `1821eb6` removes the obsolete matching-value recovery claim. The earlier verification session53234 was intentionally stopped with exit130 after compilation and during tests because source changed; it is neither a product failure nor a completed gate. Final-source session1369 is running against `/tmp/conceptweave-pr39-final-{tests,clippy,rustdoc,coverage}.log`. Source3547111's focused11/11 pass predates this final simplification; full final success remains unverified. CodeGraph sync completed, and its exploration session94183 is terminal. From 9c84cc1bc06b2de83d88e28f422eda788353aa93 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 09:16:25 +0900 Subject: [PATCH 34/52] docs: record verified full-text source and recovery coverage --- docs/product-technical-gap-baseline.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index f8c93543..32e4696e 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -6,6 +6,8 @@ This file records code-current product and technical gaps. Exact PR/check/run co ## September 7 PR39 source-scope integration in verification +Final coverage repair is verified: session42218 terminal exit0 at test source `f5190a7`. The focused public preflight-retry test passes; unchanged nightly coverage runs304 tests/39 unfiltered suites and passes426/426 functions,4,425/4,425 normalized regions and730/730 normalized branches. Raw LLVM remains5,360/5,412 lines,7,959/8,086 regions and684/730 branches, not100%. Production source `c216e47` previously passed locked Rust1.98.0 workspace310 tests/41 unfiltered suites including seven doctests; the later delta adds one test only. Do not mislabel the nightly run as a fresh311-test stable workspace run. Independent review confirms public receipt construction and unchanged prior evidence, not independent approval. Final all-target Clippy refresh is tracked separately at `/tmp/conceptweave-pr39-retry-clippy.log`. + Coverage session1369 is now terminal exit1: 426/426 functions and4,425/4,425 normalized regions pass, but normalized branches are729/730. The sole gap is `full_text_write.rs:243`'s nonempty remaining-work branch after a rollback preflight failure. Raw totals are5,352/5,412 lines,7,954/8,086 regions and684/730 branches; these are not raw100%. Test `f5190a7f2efc8d698ccd16435522fac30deae984` obtains the receipt through public execution with a failed preflight and zero inverse writes, then retries the unchanged unattempted work with complete fresh preflight. It preserves the earlier receipt and scope and verifies both restored items. No private resolved receipt or metadata-inferred authority is fabricated. Focused test and unchanged coverage rerun session42218 are in progress at `/tmp/conceptweave-pr39-preflight-retry.log` and `/tmp/conceptweave-pr39-retry-coverage.log`. Do not poll completed1369 or claim final coverage yet; production source remains `c216e47`. Final source `c216e47` now passes 310 tests/41 unfiltered suites and strict Clippy. Session1369 continues through the remaining gates; final coverage is not yet claimed. The [noema source audit](doctoring/cwl_ontology_capability_inventory.md#noema-release-admission-boundary-2026-09-07) raises bounded source coverage to34/76 of the September 6 census, leaving42; release-bearing candidates remain7/34 and verified adoption0. Protected noema head `0dec8d84b1e4744e7a9c6a77e2e2631a183ee2ab` separates structural release metadata from independently pinned admission and formal review from model evidence. Its package is private, no GitHub release was returned, and registry/deployed availability is unverified. This is inspected source, not executed noema tests, paper classification, semantic approval or a reason to create another utility repository. From c797e03e51d6ae1e4a2a92a9870b855373616c85 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 10:44:12 +0900 Subject: [PATCH 35/52] docs(research): audit EgressWeave source and publication boundary --- .../cwl_ontology_capability_inventory.md | 22 +++++++++++++++---- docs/product-technical-gap-baseline.md | 2 ++ 2 files changed, 20 insertions(+), 4 deletions(-) diff --git a/docs/doctoring/cwl_ontology_capability_inventory.md b/docs/doctoring/cwl_ontology_capability_inventory.md index 713c4823..8f68c0da 100644 --- a/docs/doctoring/cwl_ontology_capability_inventory.md +++ b/docs/doctoring/cwl_ontology_capability_inventory.md @@ -2,7 +2,7 @@ Evidence snapshot: 2026-09-07. Status: research inventory, not dependency-adoption approval. -September 7 adds noema's bounded release-admission audit: **34/76** of the September 6 census are now audited, leaving **42** in that historical denominator. Release-bearing candidates remain **7/34**; verified adoption remains zero. The earlier 33-candidate checkpoints below retain their observation dates. This increment does not recensus the organization or classify papers. +September 7 adds noema's bounded release-admission audit and EgressWeave's outbound-policy audit: **35/76** of the September 6 census are now audited, leaving **41** in that historical denominator. Candidates with resolved GitHub releases remain **7/35**; registry-only observations are separate and verified adoption remains zero. Earlier checkpoints below retain their observation dates. This increment does not recensus the organization or classify papers. ## Scope and evidence limits @@ -156,11 +156,21 @@ The source requires immutable version/tag agreement, source/provenance commit ag Cultivation stays with existing owners: noema must expose a released, independently authenticated exact-revision evidence contract; context-graph-contracts owns the assertion envelope; ConceptWeave owns semantic review and publication. Consumer conformance must reject stale revisions and preserve authority/evidence distinctions before adoption. The [library boundary decision](https://github.com/ContextualWisdomLab/noema/blob/0dec8d84b1e4744e7a9c6a77e2e2631a183ee2ab/docs/library-boundary-decision.md) defers a separate package until a real independent consumer contract warrants it. Existing internal module separation does not itself establish a second distribution. No utility repository is justified by this audit. DeepWiki structure/question lookup reported the repository unavailable; the exact GitHub sources above supply the audit evidence. +### EgressWeave acquisition boundary (2026-09-07) + +EgressWeave owns outbound HTTP safety infrastructure, not ontology generation, bibliographic classification or semantic approval. Protected `main@bd0339bf43cf5041e861bac86a84cb6e7e32637e` returned a complete tree (`truncated=false`), Apache-2.0 metadata and nonfork/nonarchived status. The complete [Accepted ADR0001](https://github.com/ContextualWisdomLab/EgressWeave/blob/bd0339bf43cf5041e861bac86a84cb6e7e32637e/docs/adr/0001-security-boundaries-and-modular-integration.md), [package declaration](https://github.com/ContextualWisdomLab/EgressWeave/blob/bd0339bf43cf5041e861bac86a84cb6e7e32637e/pyproject.toml), [public exports](https://github.com/ContextualWisdomLab/EgressWeave/blob/bd0339bf43cf5041e861bac86a84cb6e7e32637e/src/egressweave/__init__.py), [pool policy](https://github.com/ContextualWisdomLab/EgressWeave/blob/bd0339bf43cf5041e861bac86a84cb6e7e32637e/src/egressweave/connection_pool_policy.py) and [regression definitions](https://github.com/ContextualWisdomLab/EgressWeave/blob/bd0339bf43cf5041e861bac86a84cb6e7e32637e/tests/test_connection_pool_policy.py) were inspected. The boundary separates DNS/TLS/resource enforcement from caller credentials, tenants, provider discovery, persistence and domain truth. Source version0.3.0 pins HTTPX0.28.1 and HTTPCore1.0.9; no dependencies were installed and no tests executed here. + +The frozen pool policy rejects boolean/noninteger/non-ASCII counts, nonpositive total capacity, contradictory idle capacity and nonfinite/negative idle expiry. Tests define both sync/async pool injection, zero idle retention, immutability and policy-fingerprint drift rejection using substituted pools and a synthetic validated URL. These definitions do not establish live transport safety. A research fetch, for example, must not infer provider or semantic authority from a successful connection-policy check. + +No GitHub releases were returned. [PyPI metadata](https://pypi.org/pypi/egressweave/json) instead reports nonyanked0.1.0: wheel SHA-256 `6bcb07109bdee25a6d49e5516f4c99ecd172ffe8536455d2cac860c44a4492f6` uploaded2026-07-12T03:57:40.989592Z and sdist `e1e3a6dbabd4084fb03f19a95931ab96e4beeef96bc8fc7cf0d8e5b91e266057` uploaded2026-07-12T03:57:42.218039Z. This registry-only observation is not one of the seven resolved GitHub releases. Artifacts were not downloaded; source0.3.0 versus distribution0.1.0 equivalence, attestations, installed behavior and consumer conformance remain unverified. + +Cultivation remains at EgressWeave: publish an immutable needed contract with source/artifact provenance and validate ConceptWeave's released ACL before adoption. Do not copy the Python implementation into the Rust domain or create another transport utility. Historical direct-NIM automation wording in the ADR must be reconciled with current CO/free organization policy; no live workflow audit here establishes an active bypass. The initial test-source request hit the ordinary GitHub5000-request quota; after its2026-09-07T00:39:43Z reset, the same API successfully returned the full test file. No alternate credentials/routes were used. DeepWiki was unavailable; exact primary sources supply this bounded audit. + | Measure | Observation | Required next evidence | | --- | --- | --- | -| Metadata census / bounded capability audit | September 6 census76; 34/34 selected candidates have exact default-head documentation/source/tree and release-query evidence | Audit actual contracts/consumers; 42 repositories in the historical census remain unaudited at that depth. | -| GitHub release with resolved source commit | 7/34 selected candidates, including proprietary naruon, product-domain four-pillars, release-diverged newsdom-api and inkspan's historical release without the relevant current contracts | License, artifact/provenance and consumer conformance; a release count is not permissive-library or adoption evidence. | -| Additional registry-only publication observation | ThreadWeave 0.1.0 on PyPI; not counted in the seven resolved GitHub releases | Bind the needed API and distribution to reviewed source and attestations; no package-registry completeness claim. | +| Metadata census / bounded capability audit | September 6 census76; 35/35 selected candidates have exact default-head documentation/source/tree and release-query evidence | Audit actual contracts/consumers; 41 repositories in the historical census remain unaudited at that depth. | +| GitHub release with resolved source commit | 7/35 selected candidates, including proprietary naruon, product-domain four-pillars, release-diverged newsdom-api and inkspan's historical release without the relevant current contracts | License, artifact/provenance and consumer conformance; a release count is not permissive-library or adoption evidence. | +| Additional registry-only publication observation | ThreadWeave0.1.0 and EgressWeave0.1.0 on PyPI; not counted in the seven resolved GitHub releases | Bind the needed API and distribution to reviewed source and attestations; no package-registry completeness claim. | | Verified ConceptWeave adoption | 0 demonstrated in this audit | Released owner contract, exact consumer revision and passing contract/runtime evidence. | | Privately retained nonempty full text | 3,203/3,715 parents in the separate [capture evidence](zotero_fulltext_capture_evidence.json); 512 remain without demonstrated nonempty text | New content-bound proposals and authentic review with partial/unknown indexing. The earlier sweep's 800/1,000 abstract-missing subgroup is availability evidence, not a remeasured retained-capture subgroup. | | Unverified steward decisions | 0/3,715 on the repaired snapshot; first pending batch has 0/25 decisions | Authentic snapshot-bound decisions; batch generation is not review progress. | @@ -170,6 +180,10 @@ Review the repaired current snapshot, including missing-abstract and unsupported ## References +ContextualWisdomLab. (2026). *EgressWeave* (Commit bd0339bf43cf5041e861bac86a84cb6e7e32637e) [Computer software]. GitHub. https://github.com/ContextualWisdomLab/EgressWeave/tree/bd0339bf43cf5041e861bac86a84cb6e7e32637e + +Python Package Index. (n.d.). *egressweave 0.1.0* [Package metadata]. Retrieved September 7, 2026, from https://pypi.org/pypi/egressweave/json + ContextualWisdomLab. (2026). *noema* (Commit 0dec8d84b1e4744e7a9c6a77e2e2631a183ee2ab) [Computer software]. GitHub. https://github.com/ContextualWisdomLab/noema/tree/0dec8d84b1e4744e7a9c6a77e2e2631a183ee2ab ContextualWisdomLab. (2026). *ThreadWeave* (Commit 0fda6e60c2c80ec7b2aa2d58dac6b944dec6a6d0) [Computer software]. GitHub. https://github.com/ContextualWisdomLab/ThreadWeave/tree/0fda6e60c2c80ec7b2aa2d58dac6b944dec6a6d0 diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 32e4696e..9d1fe34f 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -6,6 +6,8 @@ This file records code-current product and technical gaps. Exact PR/check/run co ## September 7 PR39 source-scope integration in verification +The [EgressWeave acquisition audit](doctoring/cwl_ontology_capability_inventory.md#egressweave-acquisition-boundary-2026-09-07) raises bounded source coverage to35/76 of the September6 census, leaving41. Resolved GitHub releases remain7/35, with a separate PyPI0.1.0 observation against inspected protected source0.3.0. Artifact equivalence, provenance, installed behavior and consumer conformance are unverified; no adoption or paper decision follows. Existing EgressWeave remains the outbound-safety owner, so this audit adds no utility repository or copied runtime. Earlier34/76 noema checkpoints below are historical. Actual decisions and independent approvals remain0/3715 plus4pending sources. + Final coverage repair is verified: session42218 terminal exit0 at test source `f5190a7`. The focused public preflight-retry test passes; unchanged nightly coverage runs304 tests/39 unfiltered suites and passes426/426 functions,4,425/4,425 normalized regions and730/730 normalized branches. Raw LLVM remains5,360/5,412 lines,7,959/8,086 regions and684/730 branches, not100%. Production source `c216e47` previously passed locked Rust1.98.0 workspace310 tests/41 unfiltered suites including seven doctests; the later delta adds one test only. Do not mislabel the nightly run as a fresh311-test stable workspace run. Independent review confirms public receipt construction and unchanged prior evidence, not independent approval. Final all-target Clippy refresh is tracked separately at `/tmp/conceptweave-pr39-retry-clippy.log`. Coverage session1369 is now terminal exit1: 426/426 functions and4,425/4,425 normalized regions pass, but normalized branches are729/730. The sole gap is `full_text_write.rs:243`'s nonempty remaining-work branch after a rollback preflight failure. Raw totals are5,352/5,412 lines,7,954/8,086 regions and684/730 branches; these are not raw100%. Test `f5190a7f2efc8d698ccd16435522fac30deae984` obtains the receipt through public execution with a failed preflight and zero inverse writes, then retries the unchanged unattempted work with complete fresh preflight. It preserves the earlier receipt and scope and verifies both restored items. No private resolved receipt or metadata-inferred authority is fabricated. Focused test and unchanged coverage rerun session42218 are in progress at `/tmp/conceptweave-pr39-preflight-retry.log` and `/tmp/conceptweave-pr39-retry-coverage.log`. Do not poll completed1369 or claim final coverage yet; production source remains `c216e47`. From a19bcba39c1edc9e16a41f6f7fe3f641857a7345 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 10:56:42 +0900 Subject: [PATCH 36/52] docs(gap): verify complete full-text capture integration --- docs/product-technical-gap-baseline.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index d385bc9c..02259192 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,6 +2,12 @@ **Snapshot:** 2026-09-07 +## September 7 PR39 verified capture-limit integration + +Normal merge `37d2892` preserves PR39 `c797e03e51d6ae1e4a2a92a9870b855373616c85` (including EgressWeave's35/76 audit and the original write/recovery changes) and verified PR38 `7678236ed3ec467e93b97bb2ad7ad26b3dc0e5b9`. The sole document conflict retained both evidence sections and the current snapshot date; no source delta was discarded. Independent read-only review confirms the fixed persisted-capture limit, complete pending-source admission, whole prior rollback receipt and zero-I/O observation-retry rejection remain intact. Stable313 tests/41 unfiltered suites including seven doctests, strict Clippy, warnings-denied rustdoc, formatting, CI contract and diff checks pass. Session53301 completed successfully: unchanged pinned coverage runs306 tests/39 suites and reports433/433 functions,4,525/4,525 normalized regions and732/732 normalized branches. Raw LLVM remains5,475/5,527 lines,8,059/8,186 regions and686/732 branches, not100%. Logs `/tmp/conceptweave-pr39-verifier-{tests,clippy,rustdoc,coverage}.log` are terminal success. This checkpoint supersedes historical pending runs below; normal push still does not prove hosted checks, independent approval, protected merge or release. + +A separate read-only Local API header check returned HTTP200 from Zotero10.0.1/API3/schema44, library version2,8,326 total records and3,719 top-level records. Only one item per request was fetched and response bodies were discarded, not published. These counts are consistent with earlier aggregate observations but do not prove unchanged contents, an atomic snapshot, authenticated peer identity or a fresh classification. Actual decisions and independently approved labels remain0/3,715 plus four pending sources; no Zotero write occurred. + ## September 7 persisted-capture prerequisite follow-up Latest checkpoint supersedes the historical pending statements below. Normal merge `d19b13c3b102c859fa6cf605697bfa382ed22bd9` preserves local `24b3c9c` and verified PR37 `3bf0b319029ee225ef809f4c30275aaf29fcf374`, including PR36's shared persisted-limit verifier repair. Independent read-only review found no loss of capture/report validation, pending-source scope or proposal identity across decision, finalization and evaluation paths. Stable297 tests/41 unfiltered suites and strict Clippy, warnings-denied rustdoc, formatting, CI contract and diff checks pass. Session6842 completed successfully: unchanged nightly coverage runs294 tests/39 suites and reports421/421 functions,4,470/4,470 normalized regions and710/710 normalized branches. Raw LLVM remains5,272/5,356 lines,7,848/8,020 regions and648/710 branches, not100%. Logs `/tmp/conceptweave-pr38-verifier-{tests,clippy,rustdoc,coverage}.log` are terminal success. No production limit, fixture size or coverage exclusion was changed to pass this integration. Fresh remote has no commits absent locally; normal push retains the existing PR38. PR39 still needs this parent, while its separate docs-only `c797e03` already records EgressWeave and35/76 audited sources. No actual paper decision, Zotero write, protected merge or release follows from these gates. From b90cb8d27a1884d9ddd0eb0d1ada5c03ad4cf0a8 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 11:01:50 +0900 Subject: [PATCH 37/52] docs(research): audit OriginWeave provenance authority boundary --- .../cwl_ontology_capability_inventory.md | 18 +++++++++++++++--- docs/product-technical-gap-baseline.md | 6 ++++++ 2 files changed, 21 insertions(+), 3 deletions(-) diff --git a/docs/doctoring/cwl_ontology_capability_inventory.md b/docs/doctoring/cwl_ontology_capability_inventory.md index 8f68c0da..8dd46e05 100644 --- a/docs/doctoring/cwl_ontology_capability_inventory.md +++ b/docs/doctoring/cwl_ontology_capability_inventory.md @@ -2,7 +2,7 @@ Evidence snapshot: 2026-09-07. Status: research inventory, not dependency-adoption approval. -September 7 adds noema's bounded release-admission audit and EgressWeave's outbound-policy audit: **35/76** of the September 6 census are now audited, leaving **41** in that historical denominator. Candidates with resolved GitHub releases remain **7/35**; registry-only observations are separate and verified adoption remains zero. Earlier checkpoints below retain their observation dates. This increment does not recensus the organization or classify papers. +September 7 adds bounded audits of noema's release admission, EgressWeave's outbound policy and OriginWeave's provenance records: **36/76** of the September 6 census are now audited, leaving **40** in that historical denominator. Candidates with resolved GitHub releases remain **7/36**; registry-only observations are separate and verified adoption remains zero. Earlier checkpoints below retain their observation dates. This increment does not recensus the organization or classify papers. ## Scope and evidence limits @@ -166,10 +166,20 @@ No GitHub releases were returned. [PyPI metadata](https://pypi.org/pypi/egresswe Cultivation remains at EgressWeave: publish an immutable needed contract with source/artifact provenance and validate ConceptWeave's released ACL before adoption. Do not copy the Python implementation into the Rust domain or create another transport utility. Historical direct-NIM automation wording in the ADR must be reconciled with current CO/free organization policy; no live workflow audit here establishes an active bypass. The initial test-source request hit the ordinary GitHub5000-request quota; after its2026-09-07T00:39:43Z reset, the same API successfully returned the full test file. No alternate credentials/routes were used. DeepWiki was unavailable; exact primary sources supply this bounded audit. +### OriginWeave provenance boundary (2026-09-07) + +OriginWeave is the governed browser-acquisition owner, not an ontology publisher. The observed protected `main@87c4daa1830bac5a5228b6036752ad5633232085` is nonfork/nonarchived, Apache-2.0, with a complete tree (`truncated=false`). Its [Accepted ADR0003](https://github.com/ContextualWisdomLab/OriginWeave/blob/87c4daa1830bac5a5228b6036752ad5633232085/docs/adr/0003-provenance-native-observation.md) prefers typed tools and structured metadata, then network/accessibility/DOM/layout observations, with visual fallback. WARC persistence and PROV-compatible storage are described as future work, not verified adapters. + +The fully inspected [evidence module](https://github.com/ContextualWisdomLab/OriginWeave/blob/87c4daa1830bac5a5228b6036752ad5633232085/crates/originweave-evidence/src/lib.rs) retains bounded method/origin/path and metadata field names while replacing every header/query value with a redaction marker. It rejects ambiguous paths, malformed escapes, encoded separators and dot segments. Provenance construction validates bounded source URL/locator and lowercase SHA-256 syntax, and retains network, DOM, accessibility, visual or structured-data channel identity. The [test definitions](https://github.com/ContextualWisdomLab/OriginWeave/blob/87c4daa1830bac5a5228b6036752ad5633232085/crates/originweave-evidence/tests/evidence.rs) cover value redaction regardless of field-name case, unsafe paths/URLs, missing locator and invalid hashes. They were read completely, not executed here; other modules and end-to-end browser behavior were not audited. + +The constructor accepts the verification enum from its caller. A caller-supplied `Verified` record validates representation, not the referenced bytes, independent verifier identity or semantic truth. For example, a DOM locator and well-formed digest cannot approve a paper label without separately authenticated source and review evidence. This is a consumer trust-boundary requirement, not a demonstrated end-to-end authorization bypass. Generic network evidence also deliberately excludes response bodies; full text requires the ADR's separate schema-specific authorization, MIME, size and retention contract. + +The [workspace](https://github.com/ContextualWisdomLab/OriginWeave/blob/87c4daa1830bac5a5228b6036752ad5633232085/Cargo.toml) declares version 0.1.0, Rust edition 2024 and minimum Rust 1.97. The [evidence package](https://github.com/ContextualWisdomLab/OriginWeave/blob/87c4daa1830bac5a5228b6036752ad5633232085/crates/originweave-evidence/Cargo.toml) has `publish = false` and a workspace-local core dependency. No GitHub releases were returned; package registries, artifacts, attestations and deployed browser were not verified. Existing OriginWeave must release the needed observation contract and prove consumer conformance before adoption; do not copy workspace code or create another browser utility. DeepWiki structure/question lookup was unavailable, so the exact primary sources above supply this bounded audit. + | Measure | Observation | Required next evidence | | --- | --- | --- | -| Metadata census / bounded capability audit | September 6 census76; 35/35 selected candidates have exact default-head documentation/source/tree and release-query evidence | Audit actual contracts/consumers; 41 repositories in the historical census remain unaudited at that depth. | -| GitHub release with resolved source commit | 7/35 selected candidates, including proprietary naruon, product-domain four-pillars, release-diverged newsdom-api and inkspan's historical release without the relevant current contracts | License, artifact/provenance and consumer conformance; a release count is not permissive-library or adoption evidence. | +| Metadata census / bounded capability audit | September 6 census76; 36/36 selected candidates have exact default-head documentation/source/tree and release-query evidence | Audit actual contracts/consumers; 40 repositories in the historical census remain unaudited at that depth. | +| GitHub release with resolved source commit | 7/36 selected candidates, including proprietary naruon, product-domain four-pillars, release-diverged newsdom-api and inkspan's historical release without the relevant current contracts | License, artifact/provenance and consumer conformance; a release count is not permissive-library or adoption evidence. | | Additional registry-only publication observation | ThreadWeave0.1.0 and EgressWeave0.1.0 on PyPI; not counted in the seven resolved GitHub releases | Bind the needed API and distribution to reviewed source and attestations; no package-registry completeness claim. | | Verified ConceptWeave adoption | 0 demonstrated in this audit | Released owner contract, exact consumer revision and passing contract/runtime evidence. | | Privately retained nonempty full text | 3,203/3,715 parents in the separate [capture evidence](zotero_fulltext_capture_evidence.json); 512 remain without demonstrated nonempty text | New content-bound proposals and authentic review with partial/unknown indexing. The earlier sweep's 800/1,000 abstract-missing subgroup is availability evidence, not a remeasured retained-capture subgroup. | @@ -180,6 +190,8 @@ Review the repaired current snapshot, including missing-abstract and unsupported ## References +ContextualWisdomLab. (2026). *OriginWeave* (Commit 87c4daa1830bac5a5228b6036752ad5633232085) [Computer software]. GitHub. https://github.com/ContextualWisdomLab/OriginWeave/tree/87c4daa1830bac5a5228b6036752ad5633232085 + ContextualWisdomLab. (2026). *EgressWeave* (Commit bd0339bf43cf5041e861bac86a84cb6e7e32637e) [Computer software]. GitHub. https://github.com/ContextualWisdomLab/EgressWeave/tree/bd0339bf43cf5041e861bac86a84cb6e7e32637e Python Package Index. (n.d.). *egressweave 0.1.0* [Package metadata]. Retrieved September 7, 2026, from https://pypi.org/pypi/egressweave/json diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 02259192..2812cba4 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,6 +2,12 @@ **Snapshot:** 2026-09-07 +## September 7 remaining execution and acquisition gates + +The [OriginWeave provenance audit](doctoring/cwl_ontology_capability_inventory.md#originweave-provenance-boundary-2026-09-07) raises bounded inventory coverage to 36/76, leaving 40 in the historical September 6 census. Resolved GitHub releases remain 7/36 and verified adoption remains zero. Protected source `87c4daa1830bac5a5228b6036752ad5633232085` has a nonpublished Rust evidence package; caller-supplied verification state is not independently authenticated semantic authority. No browser runtime or registry artifact was verified and no utility repository was created. + +Fresh PR inventory still leaves Foundation PR1 at `b538470c963e6524ddc0c3f652a46a4fc8265150`, Draft with review required and failed CodeQL/Strix checks; its older approval at `bba351b77bf5f1ab5cfd55979fbb2bd158f78b81` does not approve the current head. CO release PR1030 remains OPEN Draft at `6c25848728a3333365454a2c74a607d576abe4c9` with base `a080297d2546bb61e89520d637cabc202db331ec`; the GitHub release query returned no entries. The existing CO integration task was asked to identify the actual release owner and immutable client/schema/serving evidence without reassignment, duplicate machinery or direct-provider fallback. That request is not delivered release evidence. Complete classification still requires authentic decisions for all 3,715 papers and disposition of four pending sources; no decisions or approvals were added. + ## September 7 PR39 verified capture-limit integration Normal merge `37d2892` preserves PR39 `c797e03e51d6ae1e4a2a92a9870b855373616c85` (including EgressWeave's35/76 audit and the original write/recovery changes) and verified PR38 `7678236ed3ec467e93b97bb2ad7ad26b3dc0e5b9`. The sole document conflict retained both evidence sections and the current snapshot date; no source delta was discarded. Independent read-only review confirms the fixed persisted-capture limit, complete pending-source admission, whole prior rollback receipt and zero-I/O observation-retry rejection remain intact. Stable313 tests/41 unfiltered suites including seven doctests, strict Clippy, warnings-denied rustdoc, formatting, CI contract and diff checks pass. Session53301 completed successfully: unchanged pinned coverage runs306 tests/39 suites and reports433/433 functions,4,525/4,525 normalized regions and732/732 normalized branches. Raw LLVM remains5,475/5,527 lines,8,059/8,186 regions and686/732 branches, not100%. Logs `/tmp/conceptweave-pr39-verifier-{tests,clippy,rustdoc,coverage}.log` are terminal success. This checkpoint supersedes historical pending runs below; normal push still does not prove hosted checks, independent approval, protected merge or release. From 1e82c527125d79e8b7a89ee2c105d8c610c11e75 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 11:06:49 +0900 Subject: [PATCH 38/52] docs(research): audit learning authoring bootstrap boundary --- .../cwl_ontology_capability_inventory.md | 18 +++++++++++++++--- docs/product-technical-gap-baseline.md | 2 ++ 2 files changed, 17 insertions(+), 3 deletions(-) diff --git a/docs/doctoring/cwl_ontology_capability_inventory.md b/docs/doctoring/cwl_ontology_capability_inventory.md index 8dd46e05..1cee7874 100644 --- a/docs/doctoring/cwl_ontology_capability_inventory.md +++ b/docs/doctoring/cwl_ontology_capability_inventory.md @@ -2,10 +2,12 @@ Evidence snapshot: 2026-09-07. Status: research inventory, not dependency-adoption approval. -September 7 adds bounded audits of noema's release admission, EgressWeave's outbound policy and OriginWeave's provenance records: **36/76** of the September 6 census are now audited, leaving **40** in that historical denominator. Candidates with resolved GitHub releases remain **7/36**; registry-only observations are separate and verified adoption remains zero. Earlier checkpoints below retain their observation dates. This increment does not recensus the organization or classify papers. +September 7 adds bounded audits of noema's release admission, EgressWeave's outbound policy, OriginWeave's provenance records and Learning Content Studio's protected-source availability: **37/76** of the September 6 census are now audited, leaving **39** in that historical denominator. Candidates with resolved GitHub releases remain **7/37**; registry-only observations are separate and verified adoption remains zero. Earlier checkpoints below retain their observation dates. A bootstrap-only finding is not an implemented library or a classified paper. ## Scope and evidence limits +The September 7 metadata refresh again returned 76 repositories, one archived repository and 11 forks. Matching counts do not prove unchanged repository contents; every capability observation retains its own exact source revision. + The paginated organization metadata census returned 76 repositories, including one archived repository and 11 forks; the September 6 follow-up refresh confirmed the same counts. Name/description screening for ontology, semantic, knowledge graph, schema, RDF, SHACL, provenance and lineage was combined with the existing Context Map; metadata matches alone miss owners whose descriptions do not use those words. This expanded the original eight-candidate audit to 12 selected candidates. The organization product-goal directive then identified DiskSage's actual OWL use, expanding the audit to 13. naruon and pg-erd-cloud brought the count to 15. Five domain/interoperability audits brought coverage to 20; three further domain and two document-contract audits brought it to 25/76. Keyverse and inkspan brought it to 27/76; three statistical-library audits brought it to 30/76. The threading, CDC and work-dependency audits below bring the current count to **33/76**, leaving **43**. This does not prove that all relevant implementations have been found. Each row separates responsibility, exact default-head documentation or tree evidence, and published GitHub release evidence. A name, open PR or protected branch alone does not prove a usable released API. This is not a complete package-registry, deployment, attestation or consumer-conformance audit; bounded follow-up attempts and their limitations are recorded below. CalendarWeave and four-pillars were initially screened from metadata only; their subsequent source audits now distinguish a bootstrap owner from an implemented product-domain model without excluding either by description alone. @@ -176,10 +178,18 @@ The constructor accepts the verification enum from its caller. A caller-supplied The [workspace](https://github.com/ContextualWisdomLab/OriginWeave/blob/87c4daa1830bac5a5228b6036752ad5633232085/Cargo.toml) declares version 0.1.0, Rust edition 2024 and minimum Rust 1.97. The [evidence package](https://github.com/ContextualWisdomLab/OriginWeave/blob/87c4daa1830bac5a5228b6036752ad5633232085/crates/originweave-evidence/Cargo.toml) has `publish = false` and a workspace-local core dependency. No GitHub releases were returned; package registries, artifacts, attestations and deployed browser were not verified. Existing OriginWeave must release the needed observation contract and prove consumer conformance before adoption; do not copy workspace code or create another browser utility. DeepWiki structure/question lookup was unavailable, so the exact primary sources above supply this bounded audit. +### Learning Content Studio authoring boundary (2026-09-07) + +The public repository describes itself as the CWL Learning Platform's authoring authority. Its actual default is protected `develop@b796e049409e14deb3939985721ff07b5ef62623`, not `main`; the nonfork/nonarchived complete tree (`truncated=false`) contains only [README.md](https://github.com/ContextualWisdomLab/learning-content-studio/blob/b796e049409e14deb3939985721ff07b5ef62623/README.md), which was read completely and identifies a bootstrap anchor. There is no code, schema, test, accepted ADR, package declaration or license file in that exact tree. GitHub license metadata is null and the release query returned no entries. Public visibility does not grant an adoption license. + +Existing [PR1](https://github.com/ContextualWisdomLab/learning-content-studio/pull/1) at `e7977e5736b425e6221481934b25811ab27d7557` targets develop; [PR6](https://github.com/ContextualWisdomLab/learning-content-studio/pull/6) at `c51d1838f50fe758e63c1838f3cb1f8377a75fe7` targets the bootstrap branch; [PR7](https://github.com/ContextualWisdomLab/learning-content-studio/pull/7) at `07c4128adfb939132e66e1de0a493b372ee1045a` targets the publication-admission branch. Their titles propose documentation, deterministic admission and exact-byte publication receipts. They were open and not marked Draft, but no proposed diff, check suite or deployed contract was audited here; UI readiness does not make their changes accepted or released. + +Cultivation belongs in that existing owner stack: establish licensed, protected authoring/publication contracts and tests, then immutable release and consumer conformance. Learning content meaning remains product-owned; shared ontology generation and catalog consumption must not acquire authoring truth. For example, a future extracted learning-object concept may reference a released content revision, but a bootstrap README or proposed receipt does not authorize publication of that content. No implementation is copied, no generic ontology utility is justified by this source absence, and no runtime or package-registry claim follows. DeepWiki was unavailable; the exact protected tree and GitHub PR/release metadata supply this availability audit. + | Measure | Observation | Required next evidence | | --- | --- | --- | -| Metadata census / bounded capability audit | September 6 census76; 36/36 selected candidates have exact default-head documentation/source/tree and release-query evidence | Audit actual contracts/consumers; 40 repositories in the historical census remain unaudited at that depth. | -| GitHub release with resolved source commit | 7/36 selected candidates, including proprietary naruon, product-domain four-pillars, release-diverged newsdom-api and inkspan's historical release without the relevant current contracts | License, artifact/provenance and consumer conformance; a release count is not permissive-library or adoption evidence. | +| Metadata census / bounded capability audit | September 6 census76; 37/37 selected candidates have exact default-head documentation, available source, tree and release-query evidence | Audit actual contracts/consumers; 39 repositories in the historical census remain unaudited at that depth. | +| GitHub release with resolved source commit | 7/37 selected candidates, including proprietary naruon, product-domain four-pillars, release-diverged newsdom-api and inkspan's historical release without the relevant current contracts | License, artifact/provenance and consumer conformance; a release count is not permissive-library or adoption evidence. | | Additional registry-only publication observation | ThreadWeave0.1.0 and EgressWeave0.1.0 on PyPI; not counted in the seven resolved GitHub releases | Bind the needed API and distribution to reviewed source and attestations; no package-registry completeness claim. | | Verified ConceptWeave adoption | 0 demonstrated in this audit | Released owner contract, exact consumer revision and passing contract/runtime evidence. | | Privately retained nonempty full text | 3,203/3,715 parents in the separate [capture evidence](zotero_fulltext_capture_evidence.json); 512 remain without demonstrated nonempty text | New content-bound proposals and authentic review with partial/unknown indexing. The earlier sweep's 800/1,000 abstract-missing subgroup is availability evidence, not a remeasured retained-capture subgroup. | @@ -190,6 +200,8 @@ Review the repaired current snapshot, including missing-abstract and unsupported ## References +ContextualWisdomLab. (2026). *Learning Content Studio* (Commit b796e049409e14deb3939985721ff07b5ef62623) [Source repository]. GitHub. https://github.com/ContextualWisdomLab/learning-content-studio/tree/b796e049409e14deb3939985721ff07b5ef62623 + ContextualWisdomLab. (2026). *OriginWeave* (Commit 87c4daa1830bac5a5228b6036752ad5633232085) [Computer software]. GitHub. https://github.com/ContextualWisdomLab/OriginWeave/tree/87c4daa1830bac5a5228b6036752ad5633232085 ContextualWisdomLab. (2026). *EgressWeave* (Commit bd0339bf43cf5041e861bac86a84cb6e7e32637e) [Computer software]. GitHub. https://github.com/ContextualWisdomLab/EgressWeave/tree/bd0339bf43cf5041e861bac86a84cb6e7e32637e diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 2812cba4..1da7dc03 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,6 +4,8 @@ ## September 7 remaining execution and acquisition gates +The [Learning Content Studio availability audit](doctoring/cwl_ontology_capability_inventory.md#learning-content-studio-authoring-boundary-2026-09-07) raises inspected candidates to 37/76, leaving 39; resolved GitHub release candidates remain 7/37 and adoption zero. Protected develop `b796e049409e14deb3939985721ff07b5ef62623` contains only the bootstrap README, with no license/code/schema/test/release evidence. Existing open PR1/6/7 remain proposed work, not a released authoring contract. The CO integration task separately confirmed it still has no identified release-owner task or immutable client/schema/serving/free-consumer evidence and will retain central coordination; its own PR1074 research contract is not a release. No duplicate owner was created and actual decisions/approvals remain 0/3,715 plus four pending sources. + The [OriginWeave provenance audit](doctoring/cwl_ontology_capability_inventory.md#originweave-provenance-boundary-2026-09-07) raises bounded inventory coverage to 36/76, leaving 40 in the historical September 6 census. Resolved GitHub releases remain 7/36 and verified adoption remains zero. Protected source `87c4daa1830bac5a5228b6036752ad5633232085` has a nonpublished Rust evidence package; caller-supplied verification state is not independently authenticated semantic authority. No browser runtime or registry artifact was verified and no utility repository was created. Fresh PR inventory still leaves Foundation PR1 at `b538470c963e6524ddc0c3f652a46a4fc8265150`, Draft with review required and failed CodeQL/Strix checks; its older approval at `bba351b77bf5f1ab5cfd55979fbb2bd158f78b81` does not approve the current head. CO release PR1030 remains OPEN Draft at `6c25848728a3333365454a2c74a607d576abe4c9` with base `a080297d2546bb61e89520d637cabc202db331ec`; the GitHub release query returned no entries. The existing CO integration task was asked to identify the actual release owner and immutable client/schema/serving evidence without reassignment, duplicate machinery or direct-provider fallback. That request is not delivered release evidence. Complete classification still requires authentic decisions for all 3,715 papers and disposition of four pending sources; no decisions or approvals were added. From c0ffd86a3e28b9c1d5bfc76e541d4604d657d55c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 11:27:14 +0900 Subject: [PATCH 39/52] docs(research): distinguish proposed ontology planning from release --- .../doctoring/cwl_ontology_capability_inventory.md | 14 ++++++++++++++ docs/product-technical-gap-baseline.md | 2 ++ 2 files changed, 16 insertions(+) diff --git a/docs/doctoring/cwl_ontology_capability_inventory.md b/docs/doctoring/cwl_ontology_capability_inventory.md index 1cee7874..859afd1a 100644 --- a/docs/doctoring/cwl_ontology_capability_inventory.md +++ b/docs/doctoring/cwl_ontology_capability_inventory.md @@ -146,6 +146,16 @@ Research Intake remains the existing owner. A new utility repository has no demo ## KPI and next actions +### Veilpick ontology-planning depth audit (2026-09-07) + +This deepens an existing candidate; audited coverage remains 37/76. Fresh protected `develop@8fd6931092ccc2076b10e9eb23ac99b404a9880e` still contains only LICENSE in a complete tree, and no GitHub release was returned. Open [PR1](https://github.com/ContextualWisdomLab/Veilpick/pull/1) at `24ee7474f02457418b120018f4c6ba6c99de66b9` contains proposed architecture, not protected implementation. Its fully read [ADR0002](https://github.com/ContextualWisdomLab/Veilpick/blob/24ee7474f02457418b120018f4c6ba6c99de66b9/docs/adr/0002-ontology-based-autonomous-rust-engine.md) and [ADR0003](https://github.com/ContextualWisdomLab/Veilpick/blob/24ee7474f02457418b120018f4c6ba6c99de66b9/docs/adr/0003-stealth-and-ecosystem-composition.md) label product decisions Accepted while explicitly withholding implementation acceptance. This inventory treats those open-PR documents as proposed dependency evidence, not an accepted protected or released contract. + +The proposal separates task-local inferred working models from ConceptWeave's reviewed/published semantic truth, delegates browser authority to OriginWeave and provider routing to CO, and retains shared assertion semantics. It distinguishes observed occurrence, normalization, inference and validation; a chosen OWL/SHACL profile, serialization, reasoner and Rust library are still subsequent decisions. No standards conformance or live adapter was verified here. + +Draft [PR2](https://github.com/ContextualWisdomLab/Veilpick/pull/2) at `30bb16417c42f0478200b9ce2dade2bcd0d53c64` targets PR1's branch. Its complete [frontier module](https://github.com/ContextualWisdomLab/Veilpick/blob/30bb16417c42f0478200b9ce2dade2bcd0d53c64/src/frontier.rs) and [contract tests](https://github.com/ContextualWisdomLab/Veilpick/blob/30bb16417c42f0478200b9ce2dade2bcd0d53c64/tests/frontier_contract.rs) were inspected, not executed. The bounded queue treats identifiers as opaque, validates declared concept membership, deduplicates lifetime target identities, orders by distinct supplied hint count then admission order, and preserves exhausted work. `Drained` is explicitly not collection success. No URL authorization, network I/O, ontology induction, reasoner or empirical ranking model is implemented by this module. A candidate with more caller-provided hints is scheduled sooner; that is not observed relevance, calibrated confidence or a justified weight for Zotero classification. + +Cultivation should stay in Veilpick's existing stack: establish the supported semantic profile and evidence-bound extraction contract, prove goal-to-result correctness with fixed failures/unsupported cases, and consume released owner adapters before claiming usable ontology-guided acquisition. Do not import mutable frontier source or reinterpret queue completion as an approved semantic release. This inspection performs no website acquisition or challenge-resolution operation and does not evaluate those product claims. DeepWiki had no repository index; exact GitHub sources supplied the bounded findings. + ### Noema release-admission boundary (2026-09-07) | Candidate | Responsibility and exact source | Release and cultivation gate | @@ -200,6 +210,10 @@ Review the repaired current snapshot, including missing-abstract and unsupported ## References +ContextualWisdomLab. (2026). *Veilpick proposed ecosystem architecture* (Commit 24ee7474f02457418b120018f4c6ba6c99de66b9) [Unmerged source proposal]. GitHub. https://github.com/ContextualWisdomLab/Veilpick/tree/24ee7474f02457418b120018f4c6ba6c99de66b9 + +ContextualWisdomLab. (2026). *Veilpick bounded frontier proposal* (Commit 30bb16417c42f0478200b9ce2dade2bcd0d53c64) [Unmerged source proposal]. GitHub. https://github.com/ContextualWisdomLab/Veilpick/tree/30bb16417c42f0478200b9ce2dade2bcd0d53c64 + ContextualWisdomLab. (2026). *Learning Content Studio* (Commit b796e049409e14deb3939985721ff07b5ef62623) [Source repository]. GitHub. https://github.com/ContextualWisdomLab/learning-content-studio/tree/b796e049409e14deb3939985721ff07b5ef62623 ContextualWisdomLab. (2026). *OriginWeave* (Commit 87c4daa1830bac5a5228b6036752ad5633232085) [Computer software]. GitHub. https://github.com/ContextualWisdomLab/OriginWeave/tree/87c4daa1830bac5a5228b6036752ad5633232085 diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 1da7dc03..42711b49 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,6 +4,8 @@ ## September 7 remaining execution and acquisition gates +The [Veilpick depth audit](doctoring/cwl_ontology_capability_inventory.md#veilpick-ontology-planning-depth-audit-2026-09-07) does not increase the 37/76 candidate count. Protected develop remains LICENSE-only; proposed PR1 architecture preserves task ontology versus governed publication, while Draft PR2's inspected Rust frontier only schedules explicit concept hints with bounded deduplication and attempts. No reasoner, source-confirmed semantic relevance, standards conformance, live acquisition or released adapter is established. Required cultivation remains supported ontology-profile selection and independently checked extraction/consumer contracts at the existing owner, not a copied queue or heuristic paper labels. Actual decisions/approvals remain 0/3,715 plus four pending sources. + The [Learning Content Studio availability audit](doctoring/cwl_ontology_capability_inventory.md#learning-content-studio-authoring-boundary-2026-09-07) raises inspected candidates to 37/76, leaving 39; resolved GitHub release candidates remain 7/37 and adoption zero. Protected develop `b796e049409e14deb3939985721ff07b5ef62623` contains only the bootstrap README, with no license/code/schema/test/release evidence. Existing open PR1/6/7 remain proposed work, not a released authoring contract. The CO integration task separately confirmed it still has no identified release-owner task or immutable client/schema/serving/free-consumer evidence and will retain central coordination; its own PR1074 research contract is not a release. No duplicate owner was created and actual decisions/approvals remain 0/3,715 plus four pending sources. The [OriginWeave provenance audit](doctoring/cwl_ontology_capability_inventory.md#originweave-provenance-boundary-2026-09-07) raises bounded inventory coverage to 36/76, leaving 40 in the historical September 6 census. Resolved GitHub releases remain 7/36 and verified adoption remains zero. Protected source `87c4daa1830bac5a5228b6036752ad5633232085` has a nonpublished Rust evidence package; caller-supplied verification state is not independently authenticated semantic authority. No browser runtime or registry artifact was verified and no utility repository was created. From 27f78ec1052cae4ed730cba3dd31b82413f41de0 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 11:39:28 +0900 Subject: [PATCH 40/52] docs: audit accounting proposal and reporting boundaries --- .../cwl_ontology_capability_inventory.md | 20 ++++++++++++++++--- docs/product-technical-gap-baseline.md | 2 ++ 2 files changed, 19 insertions(+), 3 deletions(-) diff --git a/docs/doctoring/cwl_ontology_capability_inventory.md b/docs/doctoring/cwl_ontology_capability_inventory.md index 859afd1a..99f391d4 100644 --- a/docs/doctoring/cwl_ontology_capability_inventory.md +++ b/docs/doctoring/cwl_ontology_capability_inventory.md @@ -2,7 +2,7 @@ Evidence snapshot: 2026-09-07. Status: research inventory, not dependency-adoption approval. -September 7 adds bounded audits of noema's release admission, EgressWeave's outbound policy, OriginWeave's provenance records and Learning Content Studio's protected-source availability: **37/76** of the September 6 census are now audited, leaving **39** in that historical denominator. Candidates with resolved GitHub releases remain **7/37**; registry-only observations are separate and verified adoption remains zero. Earlier checkpoints below retain their observation dates. A bootstrap-only finding is not an implemented library or a classified paper. +September 7 adds bounded audits of noema's release admission, EgressWeave's outbound policy, OriginWeave's provenance records, Learning Content Studio's protected-source availability and accounting-information-platform's proposal/reporting boundaries: **38/76** of the September 6 census are now audited, leaving **38** in that historical denominator. Candidates with resolved GitHub releases remain **7/38**; registry-only observations are separate and verified adoption remains zero. Earlier checkpoints below retain their observation dates. A bootstrap-only finding is not an implemented library or a classified paper. ## Scope and evidence limits @@ -146,6 +146,18 @@ Research Intake remains the existing owner. A new utility repository has no demo ## KPI and next actions +### Accounting proposal and reporting boundaries (2026-09-07) + +The public, nonfork/nonarchived accounting-information-platform repository reports Apache-2.0 and protected default `develop@239008c4edc7d305c97704c5102b593c6622b36f`, with a complete tree (`truncated=false`). Its fully inspected [Accepted ADR0002](https://github.com/ContextualWisdomLab/accounting-information-platform/blob/239008c4edc7d305c97704c5102b593c6622b36f/docs/adr/0002-proposal-receipt-boundary.md) separates Billing-owned journal proposals from AIS-owned posting receipts. Commercial account roles are not chart-of-accounts authority; retained earnings belongs to AIS period close. This is product-owned meaning, not a generic ontology service to relocate into ConceptWeave. + +The complete [ingest module](https://github.com/ContextualWisdomLab/accounting-information-platform/blob/239008c4edc7d305c97704c5102b593c6622b36f/src/accounting_information_platform/ingest.py) admits validated/exported proposal states, rejects draft/rejected/posted/unknown states and operational reject rows, and rejects Billing's retained-earnings role. It constructs a status-free posting proposal rather than issuing a posting receipt. Selected complete [test methods and their fixtures](https://github.com/ContextualWisdomLab/accounting-information-platform/blob/239008c4edc7d305c97704c5102b593c6622b36f/tests/test_journal_proposal_ingest.py) define accepted/rejected states, nonboolean integer versions and close-role rejection; they were inspected, not executed. The entire posting/core/persistence call graph was not audited, so this does not establish complete schema validation, arithmetic correctness, durable posting or production authorization. + +The fully read [receipt schema](https://github.com/ContextualWisdomLab/accounting-information-platform/blob/239008c4edc7d305c97704c5102b593c6622b36f/schemas/accounting-posting-receipt.schema.json) binds proposal/hash, tenant/entity/book, contract/policy/rule versions and posting status, with additional properties disallowed. Schema shape and an authority annotation do not authenticate a receipt issuer. For example, an ingested validated proposal cannot be labeled a posted journal merely because a downstream semantic model recognizes its account role. + +[Accepted ADR0053](https://github.com/ContextualWisdomLab/accounting-information-platform/blob/239008c4edc7d305c97704c5102b593c6622b36f/docs/adr/0053-reporting-taxonomy-projection.md), read completely at the same protected head, makes external reporting taxonomies a versioned projection with a knowledge cutoff and referenced accounting population. The design preserves posted journals, reversal lineage and posting receipts during regeneration; chart-of-accounts mapping remains separate from external presentation policy. It explicitly does not establish filing-ready XBRL, full IFRS coverage or jurisdiction certification. No serializer implementation, standards conformance or regulatory claim was verified here. + +The inspected [package declaration](https://github.com/ContextualWisdomLab/accounting-information-platform/blob/239008c4edc7d305c97704c5102b593c6622b36f/pyproject.toml) is Python version0.1.0, requires Python3.13 or later and declares no runtime dependencies; it is not evidence of Rust production implementation. The GitHub release query returned no entries. Registry artifacts, provenance, live services and database behavior remain unverified; no accounting data was accessed. Cultivation stays with the existing owner: prove projection immutability and issuer-bound consumer conformance, resolve the Rust-first production requirement there, then release the needed versioned contract. Do not copy its source, query its application tables or create another accounting utility. DeepWiki structure/question lookup was unavailable; exact GitHub primary sources support this bounded audit. Actual Zotero decisions and independent approvals remain 0/3,715 plus four pending sources. + ### Veilpick ontology-planning depth audit (2026-09-07) This deepens an existing candidate; audited coverage remains 37/76. Fresh protected `develop@8fd6931092ccc2076b10e9eb23ac99b404a9880e` still contains only LICENSE in a complete tree, and no GitHub release was returned. Open [PR1](https://github.com/ContextualWisdomLab/Veilpick/pull/1) at `24ee7474f02457418b120018f4c6ba6c99de66b9` contains proposed architecture, not protected implementation. Its fully read [ADR0002](https://github.com/ContextualWisdomLab/Veilpick/blob/24ee7474f02457418b120018f4c6ba6c99de66b9/docs/adr/0002-ontology-based-autonomous-rust-engine.md) and [ADR0003](https://github.com/ContextualWisdomLab/Veilpick/blob/24ee7474f02457418b120018f4c6ba6c99de66b9/docs/adr/0003-stealth-and-ecosystem-composition.md) label product decisions Accepted while explicitly withholding implementation acceptance. This inventory treats those open-PR documents as proposed dependency evidence, not an accepted protected or released contract. @@ -198,8 +210,8 @@ Cultivation belongs in that existing owner stack: establish licensed, protected | Measure | Observation | Required next evidence | | --- | --- | --- | -| Metadata census / bounded capability audit | September 6 census76; 37/37 selected candidates have exact default-head documentation, available source, tree and release-query evidence | Audit actual contracts/consumers; 39 repositories in the historical census remain unaudited at that depth. | -| GitHub release with resolved source commit | 7/37 selected candidates, including proprietary naruon, product-domain four-pillars, release-diverged newsdom-api and inkspan's historical release without the relevant current contracts | License, artifact/provenance and consumer conformance; a release count is not permissive-library or adoption evidence. | +| Metadata census / bounded capability audit | September 6 census76; 38/38 selected candidates have exact default-head documentation, available source, tree and release-query evidence | Audit actual contracts/consumers; 38 repositories in the historical census remain unaudited at that depth. | +| GitHub release with resolved source commit | 7/38 selected candidates, including proprietary naruon, product-domain four-pillars, release-diverged newsdom-api and inkspan's historical release without the relevant current contracts | License, artifact/provenance and consumer conformance; a release count is not permissive-library or adoption evidence. | | Additional registry-only publication observation | ThreadWeave0.1.0 and EgressWeave0.1.0 on PyPI; not counted in the seven resolved GitHub releases | Bind the needed API and distribution to reviewed source and attestations; no package-registry completeness claim. | | Verified ConceptWeave adoption | 0 demonstrated in this audit | Released owner contract, exact consumer revision and passing contract/runtime evidence. | | Privately retained nonempty full text | 3,203/3,715 parents in the separate [capture evidence](zotero_fulltext_capture_evidence.json); 512 remain without demonstrated nonempty text | New content-bound proposals and authentic review with partial/unknown indexing. The earlier sweep's 800/1,000 abstract-missing subgroup is availability evidence, not a remeasured retained-capture subgroup. | @@ -210,6 +222,8 @@ Review the repaired current snapshot, including missing-abstract and unsupported ## References +ContextualWisdomLab. (2026). *Accounting information platform* (Commit 239008c4edc7d305c97704c5102b593c6622b36f) [Computer software]. GitHub. https://github.com/ContextualWisdomLab/accounting-information-platform/tree/239008c4edc7d305c97704c5102b593c6622b36f + ContextualWisdomLab. (2026). *Veilpick proposed ecosystem architecture* (Commit 24ee7474f02457418b120018f4c6ba6c99de66b9) [Unmerged source proposal]. GitHub. https://github.com/ContextualWisdomLab/Veilpick/tree/24ee7474f02457418b120018f4c6ba6c99de66b9 ContextualWisdomLab. (2026). *Veilpick bounded frontier proposal* (Commit 30bb16417c42f0478200b9ce2dade2bcd0d53c64) [Unmerged source proposal]. GitHub. https://github.com/ContextualWisdomLab/Veilpick/tree/30bb16417c42f0478200b9ce2dade2bcd0d53c64 diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 42711b49..743ae9b3 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,6 +4,8 @@ ## September 7 remaining execution and acquisition gates +The [accounting proposal/reporting audit](doctoring/cwl_ontology_capability_inventory.md#accounting-proposal-and-reporting-boundaries-2026-09-07) raises bounded candidate coverage to 38/76, leaving 38; resolved GitHub release candidates remain 7/38 and adoption zero. Protected develop `239008c4edc7d305c97704c5102b593c6622b36f` separates Billing proposal admission from accounting posting authority and accepts versioned reporting projections as design. Inspected Python ingress, receipt schema and selected test definitions are not executed posting/conformance evidence or a released Rust library. Cultivation must preserve the existing accounting owner, demonstrate projection immutability and independently bound receipts, and release the required contract before consumption. No accounting database access, utility repository, Zotero write or paper decision occurred; actual decisions/approvals remain 0/3,715 plus four pending sources. Earlier candidate counts below are historical checkpoints. + The [Veilpick depth audit](doctoring/cwl_ontology_capability_inventory.md#veilpick-ontology-planning-depth-audit-2026-09-07) does not increase the 37/76 candidate count. Protected develop remains LICENSE-only; proposed PR1 architecture preserves task ontology versus governed publication, while Draft PR2's inspected Rust frontier only schedules explicit concept hints with bounded deduplication and attempts. No reasoner, source-confirmed semantic relevance, standards conformance, live acquisition or released adapter is established. Required cultivation remains supported ontology-profile selection and independently checked extraction/consumer contracts at the existing owner, not a copied queue or heuristic paper labels. Actual decisions/approvals remain 0/3,715 plus four pending sources. The [Learning Content Studio availability audit](doctoring/cwl_ontology_capability_inventory.md#learning-content-studio-authoring-boundary-2026-09-07) raises inspected candidates to 37/76, leaving 39; resolved GitHub release candidates remain 7/37 and adoption zero. Protected develop `b796e049409e14deb3939985721ff07b5ef62623` contains only the bootstrap README, with no license/code/schema/test/release evidence. Existing open PR1/6/7 remain proposed work, not a released authoring contract. The CO integration task separately confirmed it still has no identified release-owner task or immutable client/schema/serving/free-consumer evidence and will retain central coordination; its own PR1074 research contract is not a release. No duplicate owner was created and actual decisions/approvals remain 0/3,715 plus four pending sources. From 1174d0d704a2853bd50f6b06d3a3a5d4e5920869 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 11:44:41 +0900 Subject: [PATCH 41/52] docs: bind review provenance gap to hosted regression --- docs/product-technical-gap-baseline.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 743ae9b3..8cc4ff45 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,6 +4,8 @@ ## September 7 remaining execution and acquisition gates +The canonical review repair now has independently inspected hosted RED evidence. Central PR1641 advanced by one regression-only commit to `b8c986e2406beb37d254acd4c5df6389038b55f2`. [Run34073137078](https://github.com/ContextualWisdomLab/.github/actions/runs/34073137078), at that exact head, completed with failure: the original ConceptWeave35 external-behavior claim and its synonym both reached provenance validation after substantive/source binding passed, then failed the expected rejection with `DID NOT RAISE NoemaModelOutputError`. The terminal log reports two failed, 2,974 passed, one skipped and 21 subtests passed; reported coverage100% does not establish correct rejection. This supersedes the earlier owner-reported-only diagnosis, not the missing fix or independent approval. The existing central coordinator received the exact run/job evidence; no duplicate validator or review dismissal was created. Fresh CO1030 remains OPEN Draft `6c25848728a3333365454a2c74a607d576abe4c9`, with no GitHub releases returned. No classification, protected merge or release follows from these observations. + The [accounting proposal/reporting audit](doctoring/cwl_ontology_capability_inventory.md#accounting-proposal-and-reporting-boundaries-2026-09-07) raises bounded candidate coverage to 38/76, leaving 38; resolved GitHub release candidates remain 7/38 and adoption zero. Protected develop `239008c4edc7d305c97704c5102b593c6622b36f` separates Billing proposal admission from accounting posting authority and accepts versioned reporting projections as design. Inspected Python ingress, receipt schema and selected test definitions are not executed posting/conformance evidence or a released Rust library. Cultivation must preserve the existing accounting owner, demonstrate projection immutability and independently bound receipts, and release the required contract before consumption. No accounting database access, utility repository, Zotero write or paper decision occurred; actual decisions/approvals remain 0/3,715 plus four pending sources. Earlier candidate counts below are historical checkpoints. The [Veilpick depth audit](doctoring/cwl_ontology_capability_inventory.md#veilpick-ontology-planning-depth-audit-2026-09-07) does not increase the 37/76 candidate count. Protected develop remains LICENSE-only; proposed PR1 architecture preserves task ontology versus governed publication, while Draft PR2's inspected Rust frontier only schedules explicit concept hints with bounded deduplication and attempts. No reasoner, source-confirmed semantic relevance, standards conformance, live acquisition or released adapter is established. Required cultivation remains supported ontology-profile selection and independently checked extraction/consumer contracts at the existing owner, not a copied queue or heuristic paper labels. Actual decisions/approvals remain 0/3,715 plus four pending sources. From 4c394d3fa462f55107fe70d251250e7b94f82c42 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 11:52:14 +0900 Subject: [PATCH 42/52] docs: record pending source text availability limits --- docs/product-technical-gap-baseline.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 8cc4ff45..2e360c0e 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,6 +4,8 @@ ## September 7 remaining execution and acquisition gates +Read-only pending-source availability diagnostic: the existing private report remains a single-link regular0600 file with four pending identities (three attachments and one note). Three bounded, redirect-rejecting Local API full-text GETs returned HTTP200/API3. Two responses contained nonempty text: reported page counters were59/59 and100/208. The third reported17/17 but had empty text. Counter equality therefore does not establish usable content, and the100/208 response is incomplete by its reported counters. Only aggregate results were emitted; identities and bodies were not published or retained. This diagnostic did not check server-identity continuity, current item revisions or snapshot bookends and is not authenticated acquisition, an atomic capture or a content-bound review. The note was not fetched. Next evidence must retain and bind the original sources, resolve the empty/partial cases and establish their bibliographic relationships before any scope reconciliation; do not infer three additional papers or remove pending identities. Actual decisions/approvals remain0/3,715 plus four pending sources, with no Zotero mutation. + The canonical review repair now has independently inspected hosted RED evidence. Central PR1641 advanced by one regression-only commit to `b8c986e2406beb37d254acd4c5df6389038b55f2`. [Run34073137078](https://github.com/ContextualWisdomLab/.github/actions/runs/34073137078), at that exact head, completed with failure: the original ConceptWeave35 external-behavior claim and its synonym both reached provenance validation after substantive/source binding passed, then failed the expected rejection with `DID NOT RAISE NoemaModelOutputError`. The terminal log reports two failed, 2,974 passed, one skipped and 21 subtests passed; reported coverage100% does not establish correct rejection. This supersedes the earlier owner-reported-only diagnosis, not the missing fix or independent approval. The existing central coordinator received the exact run/job evidence; no duplicate validator or review dismissal was created. Fresh CO1030 remains OPEN Draft `6c25848728a3333365454a2c74a607d576abe4c9`, with no GitHub releases returned. No classification, protected merge or release follows from these observations. The [accounting proposal/reporting audit](doctoring/cwl_ontology_capability_inventory.md#accounting-proposal-and-reporting-boundaries-2026-09-07) raises bounded candidate coverage to 38/76, leaving 38; resolved GitHub release candidates remain 7/38 and adoption zero. Protected develop `239008c4edc7d305c97704c5102b593c6622b36f` separates Billing proposal admission from accounting posting authority and accepts versioned reporting projections as design. Inspected Python ingress, receipt schema and selected test definitions are not executed posting/conformance evidence or a released Rust library. Cultivation must preserve the existing accounting owner, demonstrate projection immutability and independently bound receipts, and release the required contract before consumption. No accounting database access, utility repository, Zotero write or paper decision occurred; actual decisions/approvals remain 0/3,715 plus four pending sources. Earlier candidate counts below are historical checkpoints. From 21b8f00a6fdcddb7cb0b92b745c189c15c53eb59 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 12:05:59 +0900 Subject: [PATCH 43/52] docs: retain bounded billing contract audit evidence --- docs/doctoring/cwl_ontology_capability_inventory.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/docs/doctoring/cwl_ontology_capability_inventory.md b/docs/doctoring/cwl_ontology_capability_inventory.md index 99f391d4..718b0d84 100644 --- a/docs/doctoring/cwl_ontology_capability_inventory.md +++ b/docs/doctoring/cwl_ontology_capability_inventory.md @@ -146,6 +146,14 @@ Research Intake remains the existing owner. A new utility repository has no demo ## KPI and next actions +### Billing contract follow-up: incomplete audit (2026-09-07) + +This follow-up is not added to the38/76 completed candidate count. Metering-billing-platform reports nonfork/nonarchived status, Apache-2.0 and protected default `develop@ebeed33f98b34afc232eed980f41d6af9a7a445c`. Both inspected recursive trees were complete. Its [v0.2.0 release](https://github.com/ContextualWisdomLab/metering-billing-platform/releases/tag/v0.2.0), published2026-08-26, resolves to `c90a0d40fe222ed236fe17c8d49ccdc435ecebee` and lists no uploaded assets. This does not exclude GitHub-generated source archives or prove absence from other registries. The two revisions share the journal-proposal schema blob `ced9197ad631e2d7b784399971df53fbbe7854d0` and consumed posting-receipt schema blob `b330b15e76144fcb01dc66840705cc9585b53c5b`; matching source blobs do not establish installed artifact provenance or consumer conformance. + +Fully read [ADR0002](https://github.com/ContextualWisdomLab/metering-billing-platform/blob/ebeed33f98b34afc232eed980f41d6af9a7a445c/docs/adr/0002-accounting-boundary.md) and [ADR0006](https://github.com/ContextualWisdomLab/metering-billing-platform/blob/ebeed33f98b34afc232eed980f41d6af9a7a445c/docs/adr/0006-journal-proposal-from-invoice-draft.md) are Accepted and retain commercial meaning in Billing while reserving posted journals, book/chart authority and accounting correction rules for AIS. The inspected [proposal schema](https://github.com/ContextualWisdomLab/metering-billing-platform/blob/ebeed33f98b34afc232eed980f41d6af9a7a445c/schemas/accounting-journal-proposal.schema.json) excludes posted from its lifecycle and defines decimal-string, debit-XOR-credit lines; its balanced-proposal description is not proof of cross-line arithmetic enforcement. Implementation and test execution remain unaudited. + +The [consumed-contract README](https://github.com/ContextualWisdomLab/metering-billing-platform/blob/ebeed33f98b34afc232eed980f41d6af9a7a445c/schemas/consumed/README.md) explicitly describes an AIS consumer copy retaining the original authority annotation. This source-copy approach requires repair against the user's released-owner-contract/no-copy requirement; retaining an authority field alone is not release authentication. The fully read [project declaration](https://github.com/ContextualWisdomLab/metering-billing-platform/blob/ebeed33f98b34afc232eed980f41d6af9a7a445c/pyproject.toml) declares0.2.0, Python>=3.13, psycopg and `tool.uv.package=false`. It does not establish a packaged contract or Rust production implementation. Inspect the actual validation/packaging path and its tests before completing the audit; obtain owner-released contract provenance and consumer verification rather than copying more schema files into ConceptWeave. No billing data, provider call or runtime mutation was performed. + ### Accounting proposal and reporting boundaries (2026-09-07) The public, nonfork/nonarchived accounting-information-platform repository reports Apache-2.0 and protected default `develop@239008c4edc7d305c97704c5102b593c6622b36f`, with a complete tree (`truncated=false`). Its fully inspected [Accepted ADR0002](https://github.com/ContextualWisdomLab/accounting-information-platform/blob/239008c4edc7d305c97704c5102b593c6622b36f/docs/adr/0002-proposal-receipt-boundary.md) separates Billing-owned journal proposals from AIS-owned posting receipts. Commercial account roles are not chart-of-accounts authority; retained earnings belongs to AIS period close. This is product-owned meaning, not a generic ontology service to relocate into ConceptWeave. @@ -222,6 +230,8 @@ Review the repaired current snapshot, including missing-abstract and unsupported ## References +ContextualWisdomLab. (2026). *Metering billing platform* (Commit ebeed33f98b34afc232eed980f41d6af9a7a445c) [Computer software]. GitHub. https://github.com/ContextualWisdomLab/metering-billing-platform/tree/ebeed33f98b34afc232eed980f41d6af9a7a445c + ContextualWisdomLab. (2026). *Accounting information platform* (Commit 239008c4edc7d305c97704c5102b593c6622b36f) [Computer software]. GitHub. https://github.com/ContextualWisdomLab/accounting-information-platform/tree/239008c4edc7d305c97704c5102b593c6622b36f ContextualWisdomLab. (2026). *Veilpick proposed ecosystem architecture* (Commit 24ee7474f02457418b120018f4c6ba6c99de66b9) [Unmerged source proposal]. GitHub. https://github.com/ContextualWisdomLab/Veilpick/tree/24ee7474f02457418b120018f4c6ba6c99de66b9 From ff5bed7528cbf55af0ca68cf4227e30fcea75ac1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 12:28:02 +0900 Subject: [PATCH 44/52] docs: trace billing consumed contract validation boundary --- docs/doctoring/cwl_ontology_capability_inventory.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/doctoring/cwl_ontology_capability_inventory.md b/docs/doctoring/cwl_ontology_capability_inventory.md index 718b0d84..71e9e858 100644 --- a/docs/doctoring/cwl_ontology_capability_inventory.md +++ b/docs/doctoring/cwl_ontology_capability_inventory.md @@ -148,6 +148,8 @@ Research Intake remains the existing owner. A new utility repository has no demo ### Billing contract follow-up: incomplete audit (2026-09-07) +Follow-up implementation inspection narrows the finding: [contracts.py:266](https://github.com/ContextualWisdomLab/metering-billing-platform/blob/ebeed33f98b34afc232eed980f41d6af9a7a445c/metering_billing/contracts.py#L266) defines the repository-relative consumed-schema directory; the complete receipt-validation and JSON-loader functions read that local file and validate shape without owner-release authentication in those functions. The complete [ownership test](https://github.com/ContextualWisdomLab/metering-billing-platform/blob/ebeed33f98b34afc232eed980f41d6af9a7a445c/tests/test_posting_receipt_observation.py#L170) checks file existence, authority annotation, identifier, status enum and separation from Billing-owned schemas. It does not verify release provenance. These functions and this test were read, not executed; the full transport, publication, persistence and packaging paths remain outside this inspection. The existing central coordinator received the exact references for routing to the existing Billing/AIS owners, not a duplicate implementation. This is a concrete no-copy/released-contract consumption gap, not a demonstrated end-to-end authentication bypass. + This follow-up is not added to the38/76 completed candidate count. Metering-billing-platform reports nonfork/nonarchived status, Apache-2.0 and protected default `develop@ebeed33f98b34afc232eed980f41d6af9a7a445c`. Both inspected recursive trees were complete. Its [v0.2.0 release](https://github.com/ContextualWisdomLab/metering-billing-platform/releases/tag/v0.2.0), published2026-08-26, resolves to `c90a0d40fe222ed236fe17c8d49ccdc435ecebee` and lists no uploaded assets. This does not exclude GitHub-generated source archives or prove absence from other registries. The two revisions share the journal-proposal schema blob `ced9197ad631e2d7b784399971df53fbbe7854d0` and consumed posting-receipt schema blob `b330b15e76144fcb01dc66840705cc9585b53c5b`; matching source blobs do not establish installed artifact provenance or consumer conformance. Fully read [ADR0002](https://github.com/ContextualWisdomLab/metering-billing-platform/blob/ebeed33f98b34afc232eed980f41d6af9a7a445c/docs/adr/0002-accounting-boundary.md) and [ADR0006](https://github.com/ContextualWisdomLab/metering-billing-platform/blob/ebeed33f98b34afc232eed980f41d6af9a7a445c/docs/adr/0006-journal-proposal-from-invoice-draft.md) are Accepted and retain commercial meaning in Billing while reserving posted journals, book/chart authority and accounting correction rules for AIS. The inspected [proposal schema](https://github.com/ContextualWisdomLab/metering-billing-platform/blob/ebeed33f98b34afc232eed980f41d6af9a7a445c/schemas/accounting-journal-proposal.schema.json) excludes posted from its lifecycle and defines decimal-string, debit-XOR-credit lines; its balanced-proposal description is not proof of cross-line arithmetic enforcement. Implementation and test execution remain unaudited. From 784168bf8324ab55116d17813b316036c310b2fe Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 12:59:25 +0900 Subject: [PATCH 45/52] docs(agents): retain verified publication and inspection lessons Signed-off-by: Seongho Bae --- AGENTS.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/AGENTS.md b/AGENTS.md index 78297062..472b5b22 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -27,3 +27,13 @@ ConceptWeave owns automatic, evidence-bound **Semantic Model Engineering**. Do n - Owned production coverage target is 100% line/function/region/branch where tooling exposes it. - Never suppress deprecation warnings; fix causes. - Never force-push shared branches, self-approve, fabricate checks, or weaken branch protection. + +## Operational lessons to maintain + +- Update this section when work establishes a reusable, verified lesson. Keep transient run IDs, counts and incidents in the Gap baseline or doctoring evidence; never record credentials or private research content here. +- Automate publication when the protected release path permits it. Reuse the organization's canonical release workflow through a thin caller; verify its contract before wiring credentials. A configured registry secret is not evidence of package readiness, registry ownership, successful publication or deployment. +- Publish only the verified, protected source revision with an immutable version and artifact provenance. Do not release a draft stack to bypass its missing foundation, checks or independent review. Serialize release/deploy operations without cancelling an in-flight publication, and verify the registry artifact after publication before claiming delivery. +- Query secret names/access metadata only when needed; never retrieve or print values. An empty repository secret listing does not establish whether organization or environment secrets are available. Do not introduce a Python package merely because a PyPI credential exists. +- Perform actual screenshot-based Visual Inspection alongside accessibility inspection for affected user journeys. Record the inspected revision, view and state, distinguish untested states, and keep private library screenshots out of public evidence. Accessibility text alone does not establish layout correctness. +- A Zotero full-text response can report equal indexed/total page counters while containing no text. Check content availability and completeness separately, preserve unresolved sources, and require the bound capture/review path before counting a classification as reviewed. +- Re-query the same CI run after an interrupted or truncated observation. A queued run is neither a failure nor proof of execution; a superseded cancelled run must not be presented as current evidence. Unit fixtures that manufacture a receipt and its expected digest do not prove independent producer authentication or live publication integration. From f821841321feb60b9555c21bf7b32d2b2642325b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 13:13:08 +0900 Subject: [PATCH 46/52] docs(research): trace billing receipt observation boundary Signed-off-by: Seongho Bae --- docs/doctoring/cwl_ontology_capability_inventory.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/doctoring/cwl_ontology_capability_inventory.md b/docs/doctoring/cwl_ontology_capability_inventory.md index 71e9e858..a35f609d 100644 --- a/docs/doctoring/cwl_ontology_capability_inventory.md +++ b/docs/doctoring/cwl_ontology_capability_inventory.md @@ -148,6 +148,8 @@ Research Intake remains the existing owner. A new utility repository has no demo ### Billing contract follow-up: incomplete audit (2026-09-07) +Subsequent bounded inspection read the complete [posting receipt module](https://github.com/ContextualWisdomLab/metering-billing-platform/blob/ebeed33f98b34afc232eed980f41d6af9a7a445c/metering_billing/posting_receipt.py), not just its validation helper. The pull path resolves the tenant, requests the receipt, checks the consumed schema and exact tenant/idempotency key, and inserts an observation without assigning journal proposal status. Its replay branch compares receipt identity and source payload hash before returning the stored observation; this does not independently demonstrate whole-receipt immutability or atomic concurrent insertion. The default transport validates the initial endpoint and uses standard-library HTTP with unbounded `response.read()` calls in receipt, outbox-list and outbox-publish paths. This module alone establishes neither redirect-hop policy nor released EgressWeave adoption. The outbox decoder coerces supplied fields to strings; downstream event validation and persistence invariants remain to be traced before judging acceptance. No transport request, database access, publication or test execution was performed. Keep the audit incomplete until ledger implementation, relevant tests and installed-contract provenance are checked; do not turn these source observations into claims of a reproduced security failure or completed reclassification. + Follow-up implementation inspection narrows the finding: [contracts.py:266](https://github.com/ContextualWisdomLab/metering-billing-platform/blob/ebeed33f98b34afc232eed980f41d6af9a7a445c/metering_billing/contracts.py#L266) defines the repository-relative consumed-schema directory; the complete receipt-validation and JSON-loader functions read that local file and validate shape without owner-release authentication in those functions. The complete [ownership test](https://github.com/ContextualWisdomLab/metering-billing-platform/blob/ebeed33f98b34afc232eed980f41d6af9a7a445c/tests/test_posting_receipt_observation.py#L170) checks file existence, authority annotation, identifier, status enum and separation from Billing-owned schemas. It does not verify release provenance. These functions and this test were read, not executed; the full transport, publication, persistence and packaging paths remain outside this inspection. The existing central coordinator received the exact references for routing to the existing Billing/AIS owners, not a duplicate implementation. This is a concrete no-copy/released-contract consumption gap, not a demonstrated end-to-end authentication bypass. This follow-up is not added to the38/76 completed candidate count. Metering-billing-platform reports nonfork/nonarchived status, Apache-2.0 and protected default `develop@ebeed33f98b34afc232eed980f41d6af9a7a445c`. Both inspected recursive trees were complete. Its [v0.2.0 release](https://github.com/ContextualWisdomLab/metering-billing-platform/releases/tag/v0.2.0), published2026-08-26, resolves to `c90a0d40fe222ed236fe17c8d49ccdc435ecebee` and lists no uploaded assets. This does not exclude GitHub-generated source archives or prove absence from other registries. The two revisions share the journal-proposal schema blob `ced9197ad631e2d7b784399971df53fbbe7854d0` and consumed posting-receipt schema blob `b330b15e76144fcb01dc66840705cc9585b53c5b`; matching source blobs do not establish installed artifact provenance or consumer conformance. From 4829aabb5caea10c187b758e53016ef8e1895e49 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 13:31:49 +0900 Subject: [PATCH 47/52] docs(research): retain billing receipt port reproduction Signed-off-by: Seongho Bae --- docs/doctoring/cwl_ontology_capability_inventory.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/docs/doctoring/cwl_ontology_capability_inventory.md b/docs/doctoring/cwl_ontology_capability_inventory.md index a35f609d..1e95a872 100644 --- a/docs/doctoring/cwl_ontology_capability_inventory.md +++ b/docs/doctoring/cwl_ontology_capability_inventory.md @@ -148,6 +148,16 @@ Research Intake remains the existing owner. A new utility repository has no demo ### Billing contract follow-up: incomplete audit (2026-09-07) +#### Executed repository-surface regression + +At exact revision `ebeed33f98b34afc232eed980f41d6af9a7a445c`, the following diagnostic imported the real PostgreSQL class and failed with all three method names missing (`AssertionError`, exit 1). Run from a checkout of that revision. The injected inert object is not a database connection; this proves a missing runtime method surface, not a live HTTP failure, transaction behavior or persistence correctness. + +```sh +uv run --no-project --python 3.13 python -c 'from metering_billing.postgres_usage_ledger import PostgresUsageLedger; ledger = PostgresUsageLedger(object()); names = ("find_posting_receipt_observation", "find_posting_receipt_observation_by_receipt", "insert_posting_receipt_observation"); missing = [name for name in names if not callable(getattr(ledger, name, None))]; print("missing_methods=" + ",".join(missing)); assert not missing, "PostgreSQL receipt observation port is incomplete"' +``` + +[ADR 0123](https://github.com/ContextualWisdomLab/metering-billing-platform/blob/ebeed33f98b34afc232eed980f41d6af9a7a445c/docs/adr/0123-postgres-ledger-backend-selection.md) asserts the two ledgers provide the same duck-typed surface, but [HTTP wiring](https://github.com/ContextualWisdomLab/metering-billing-platform/blob/ebeed33f98b34afc232eed980f41d6af9a7a445c/metering_billing/http_app.py#L790) passes the selected ledger into the receipt service. The memory adapter has the methods; the PostgreSQL class has no corresponding declarations or dynamic attribute fallback in this revision. Migration 0010 defines tenant-scoped uniqueness constraints, but does not implement these methods. Repair belongs in the Billing owner: retain this RED, reproduce the PostgreSQL-selected HTTP path, implement the missing persistence contract and verify concurrency/replay behavior without falling back to memory. Owner routing was requested from the central coordinator; delivery of a request is not confirmed ownership or completed repair. No database, external HTTP request or production write was made. Earlier source-only inspection statements below describe their respective stages; this diagnostic is the additional executed evidence, and the overall candidate audit remains incomplete. + Subsequent bounded inspection read the complete [posting receipt module](https://github.com/ContextualWisdomLab/metering-billing-platform/blob/ebeed33f98b34afc232eed980f41d6af9a7a445c/metering_billing/posting_receipt.py), not just its validation helper. The pull path resolves the tenant, requests the receipt, checks the consumed schema and exact tenant/idempotency key, and inserts an observation without assigning journal proposal status. Its replay branch compares receipt identity and source payload hash before returning the stored observation; this does not independently demonstrate whole-receipt immutability or atomic concurrent insertion. The default transport validates the initial endpoint and uses standard-library HTTP with unbounded `response.read()` calls in receipt, outbox-list and outbox-publish paths. This module alone establishes neither redirect-hop policy nor released EgressWeave adoption. The outbox decoder coerces supplied fields to strings; downstream event validation and persistence invariants remain to be traced before judging acceptance. No transport request, database access, publication or test execution was performed. Keep the audit incomplete until ledger implementation, relevant tests and installed-contract provenance are checked; do not turn these source observations into claims of a reproduced security failure or completed reclassification. Follow-up implementation inspection narrows the finding: [contracts.py:266](https://github.com/ContextualWisdomLab/metering-billing-platform/blob/ebeed33f98b34afc232eed980f41d6af9a7a445c/metering_billing/contracts.py#L266) defines the repository-relative consumed-schema directory; the complete receipt-validation and JSON-loader functions read that local file and validate shape without owner-release authentication in those functions. The complete [ownership test](https://github.com/ContextualWisdomLab/metering-billing-platform/blob/ebeed33f98b34afc232eed980f41d6af9a7a445c/tests/test_posting_receipt_observation.py#L170) checks file existence, authority annotation, identifier, status enum and separation from Billing-owned schemas. It does not verify release provenance. These functions and this test were read, not executed; the full transport, publication, persistence and packaging paths remain outside this inspection. The existing central coordinator received the exact references for routing to the existing Billing/AIS owners, not a duplicate implementation. This is a concrete no-copy/released-contract consumption gap, not a demonstrated end-to-end authentication bypass. From 1eefe6c29f9058b7f9f7b996ded37ea046305cb4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 14:14:22 +0900 Subject: [PATCH 48/52] docs: preserve billing HTTP regression evidence Signed-off-by: Seongho Bae --- docs/doctoring/cwl_ontology_capability_inventory.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/docs/doctoring/cwl_ontology_capability_inventory.md b/docs/doctoring/cwl_ontology_capability_inventory.md index 1e95a872..035e184c 100644 --- a/docs/doctoring/cwl_ontology_capability_inventory.md +++ b/docs/doctoring/cwl_ontology_capability_inventory.md @@ -148,6 +148,18 @@ Research Intake remains the existing owner. A new utility repository has no demo ### Billing contract follow-up: incomplete audit (2026-09-07) +#### Executed in-process HTTP regression + +Checkout `ebeed33f98b34afc232eed980f41d6af9a7a445c` reproduced the missing method through its existing `tests/test_http_app.py` WSGI harness. Only tenant resolution and active-credential lookup were mocked to avoid database access; the real HTTP application, receipt service and PostgreSQL adapter were retained: + +```sh +uv run --no-project --python 3.13 python -c 'import sys; sys.path.insert(0, "tests"); from types import SimpleNamespace; from uuid import UUID; from unittest.mock import patch; from test_http_app import invoke_http; from metering_billing.http_app import create_http_app; from metering_billing.postgres_usage_ledger import PostgresUsageLedger; ledger = PostgresUsageLedger(object()); tenant = SimpleNamespace(tenant_account_id=UUID(int=1)); app = create_http_app(ledger); patch.object(ledger, "resolve_tenant", return_value=(tenant, None)).start(); patch.object(ledger, "list_active_tenant_api_credentials", return_value=()).start(); invoke_http(app, "GET", "/v1/posting-receipt-observations/test-key", query={"tenant_reference":"urn:cwl:test_tenant"})' +``` + +Observed exit 1: `invoke_http` → HTTP application → receipt service → `AttributeError` for `PostgresUsageLedger.find_posting_receipt_observation`. This is in-process route evidence, not a deployed HTTP request, authentication test, real PostgreSQL transaction or persistence test. An earlier attempt without the credential-lookup mock failed on the inert connection's missing transaction method; that harness limitation is not the reported product defect. + +The reproduction was recorded on existing [issue 84](https://github.com/ContextualWisdomLab/metering-billing-platform/issues/84#issuecomment-5565087952) and [PR 145](https://github.com/ContextualWisdomLab/metering-billing-platform/pull/145#issuecomment-5565086345). These records establish handoff, not writer acceptance or a completed repair. Preserve the existing owner stack and require actual PostgreSQL-backed route, replay and concurrency verification before adoption. The candidate audit and reclassification KPIs remain unchanged. + #### Executed repository-surface regression At exact revision `ebeed33f98b34afc232eed980f41d6af9a7a445c`, the following diagnostic imported the real PostgreSQL class and failed with all three method names missing (`AssertionError`, exit 1). Run from a checkout of that revision. The injected inert object is not a database connection; this proves a missing runtime method surface, not a live HTTP failure, transaction behavior or persistence correctness. From 73ac19f6d437cb3df6e8b9641544ecd7c51a219d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 14:24:11 +0900 Subject: [PATCH 49/52] docs: clarify endpoint-specific rate limit evidence Signed-off-by: Seongho Bae --- AGENTS.md | 1 + 1 file changed, 1 insertion(+) diff --git a/AGENTS.md b/AGENTS.md index 472b5b22..110fd980 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -37,3 +37,4 @@ ConceptWeave owns automatic, evidence-bound **Semantic Model Engineering**. Do n - Perform actual screenshot-based Visual Inspection alongside accessibility inspection for affected user journeys. Record the inspected revision, view and state, distinguish untested states, and keep private library screenshots out of public evidence. Accessibility text alone does not establish layout correctness. - A Zotero full-text response can report equal indexed/total page counters while containing no text. Check content availability and completeness separately, preserve unresolved sources, and require the bound capture/review path before counting a classification as reviewed. - Re-query the same CI run after an interrupted or truncated observation. A queued run is neither a failure nor proof of execution; a superseded cancelled run must not be presented as current evidence. Unit fixtures that manufacture a receipt and its expected digest do not prove independent producer authentication or live publication integration. +- If a rate-limit summary conflicts with a failed request, inspect that request's rate-limit resource, remaining count and reset headers. A successful summary or GraphQL query does not prove a REST run lookup is available; retain the same run handle and avoid repeated requests until its reset. From 61d6bc46fcac1d394fc07738cc2ef686626a89be Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 14:36:32 +0900 Subject: [PATCH 50/52] docs: distinguish pending source content availability Signed-off-by: Seongho Bae --- docs/product-technical-gap-baseline.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 2e360c0e..becf3508 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,6 +4,8 @@ ## September 7 remaining execution and acquisition gates +Follow-up pending-source diagnostic queried metadata for all four existing pending identities and full text for the three attachments. The independent note returned an explicit note field containing 1,430 characters; its absence from the serialized typed report must not be treated as empty original content. All three attachments reported parentless PDF metadata. In private report order, full text contained 192,876 characters with page counters 59/59, zero characters with 17/17, and 173 characters with 100/208. These are availability observations, not extraction fidelity or semantic-review results. The empty and sparse/partially indexed attachments require acquisition assessment; retain all four pending identities and establish bibliographic relationships before changing scope. Requests were read-only and bounded to 1 MiB for metadata, 16 MiB for full text and 15 seconds each. Only aggregate results were emitted. No original bytes were retained, authenticated peer identity established, atomic snapshot bookends checked or classification approved. The private diagnostic note is kept outside the repository; no source titles, identities or bodies are published. The earlier paragraph below describes the preceding observation, before the note was fetched. Decisions and independent approvals remain 0/3,715 plus four pending sources. + Read-only pending-source availability diagnostic: the existing private report remains a single-link regular0600 file with four pending identities (three attachments and one note). Three bounded, redirect-rejecting Local API full-text GETs returned HTTP200/API3. Two responses contained nonempty text: reported page counters were59/59 and100/208. The third reported17/17 but had empty text. Counter equality therefore does not establish usable content, and the100/208 response is incomplete by its reported counters. Only aggregate results were emitted; identities and bodies were not published or retained. This diagnostic did not check server-identity continuity, current item revisions or snapshot bookends and is not authenticated acquisition, an atomic capture or a content-bound review. The note was not fetched. Next evidence must retain and bind the original sources, resolve the empty/partial cases and establish their bibliographic relationships before any scope reconciliation; do not infer three additional papers or remove pending identities. Actual decisions/approvals remain0/3,715 plus four pending sources, with no Zotero mutation. The canonical review repair now has independently inspected hosted RED evidence. Central PR1641 advanced by one regression-only commit to `b8c986e2406beb37d254acd4c5df6389038b55f2`. [Run34073137078](https://github.com/ContextualWisdomLab/.github/actions/runs/34073137078), at that exact head, completed with failure: the original ConceptWeave35 external-behavior claim and its synonym both reached provenance validation after substantive/source binding passed, then failed the expected rejection with `DID NOT RAISE NoemaModelOutputError`. The terminal log reports two failed, 2,974 passed, one skipped and 21 subtests passed; reported coverage100% does not establish correct rejection. This supersedes the earlier owner-reported-only diagnosis, not the missing fix or independent approval. The existing central coordinator received the exact run/job evidence; no duplicate validator or review dismissal was created. Fresh CO1030 remains OPEN Draft `6c25848728a3333365454a2c74a607d576abe4c9`, with no GitHub releases returned. No classification, protected merge or release follows from these observations. From 5e7333308503b439323bc43b20582f54e755cf87 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 14:46:51 +0900 Subject: [PATCH 51/52] docs: audit learning management availability boundary Signed-off-by: Seongho Bae --- docs/doctoring/cwl_ontology_capability_inventory.md | 12 ++++++++++-- docs/product-technical-gap-baseline.md | 2 ++ 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/docs/doctoring/cwl_ontology_capability_inventory.md b/docs/doctoring/cwl_ontology_capability_inventory.md index 035e184c..c0257b98 100644 --- a/docs/doctoring/cwl_ontology_capability_inventory.md +++ b/docs/doctoring/cwl_ontology_capability_inventory.md @@ -242,10 +242,16 @@ Existing [PR1](https://github.com/ContextualWisdomLab/learning-content-studio/pu Cultivation belongs in that existing owner stack: establish licensed, protected authoring/publication contracts and tests, then immutable release and consumer conformance. Learning content meaning remains product-owned; shared ontology generation and catalog consumption must not acquire authoring truth. For example, a future extracted learning-object concept may reference a released content revision, but a bootstrap README or proposed receipt does not authorize publication of that content. No implementation is copied, no generic ontology utility is justified by this source absence, and no runtime or package-registry claim follows. DeepWiki was unavailable; the exact protected tree and GitHub PR/release metadata supply this availability audit. +### Learning Management Platform availability audit (2026-09-07) + +The public, nonfork, nonarchived repository has protected default `develop@1b89a16bbbd6c4b7c6ee4e8b81e2c8c651d1ce2c`. Its complete recursive tree (`truncated=false`) contains only [README.md](https://github.com/ContextualWisdomLab/learning-management-platform/blob/1b89a16bbbd6c4b7c6ee4e8b81e2c8c651d1ce2c/README.md), read in full: it identifies a bootstrap anchor and proposed development through develop. No implementation, contract, tests, package declaration, accepted ADR or license file exists in that exact tree; repository license metadata is null. The paginated GitHub release query returned no entries. No package registry, proposed PR, runtime or private learning records were inspected. + +Do not infer implemented learning-domain or ontology authority from the repository name. Cultivation starts with explicit product responsibilities, licensing, versioned domain contracts and conformance in the existing owner. Any later ConceptWeave observation must preserve product meaning and consume a released contract rather than copy source or invent an ontology utility. This availability audit adds one candidate to the historical census coverage: 39/76 audited, 37 remaining; seven resolved GitHub-release candidates and zero verified adoptions. It creates no paper decisions or approvals. + | Measure | Observation | Required next evidence | | --- | --- | --- | -| Metadata census / bounded capability audit | September 6 census76; 38/38 selected candidates have exact default-head documentation, available source, tree and release-query evidence | Audit actual contracts/consumers; 38 repositories in the historical census remain unaudited at that depth. | -| GitHub release with resolved source commit | 7/38 selected candidates, including proprietary naruon, product-domain four-pillars, release-diverged newsdom-api and inkspan's historical release without the relevant current contracts | License, artifact/provenance and consumer conformance; a release count is not permissive-library or adoption evidence. | +| Metadata census / bounded capability audit | September 6 census76; 39/39 selected candidates have exact default-head documentation, available source, tree and release-query evidence | Audit actual contracts/consumers; 37 repositories in the historical census remain unaudited at that depth. | +| GitHub release with resolved source commit | 7/39 selected candidates, including proprietary naruon, product-domain four-pillars, release-diverged newsdom-api and inkspan's historical release without the relevant current contracts | License, artifact/provenance and consumer conformance; a release count is not permissive-library or adoption evidence. | | Additional registry-only publication observation | ThreadWeave0.1.0 and EgressWeave0.1.0 on PyPI; not counted in the seven resolved GitHub releases | Bind the needed API and distribution to reviewed source and attestations; no package-registry completeness claim. | | Verified ConceptWeave adoption | 0 demonstrated in this audit | Released owner contract, exact consumer revision and passing contract/runtime evidence. | | Privately retained nonempty full text | 3,203/3,715 parents in the separate [capture evidence](zotero_fulltext_capture_evidence.json); 512 remain without demonstrated nonempty text | New content-bound proposals and authentic review with partial/unknown indexing. The earlier sweep's 800/1,000 abstract-missing subgroup is availability evidence, not a remeasured retained-capture subgroup. | @@ -256,6 +262,8 @@ Review the repaired current snapshot, including missing-abstract and unsupported ## References +ContextualWisdomLab. (2026). *Learning Management Platform* (Commit 1b89a16bbbd6c4b7c6ee4e8b81e2c8c651d1ce2c) [Source repository]. GitHub. https://github.com/ContextualWisdomLab/learning-management-platform/tree/1b89a16bbbd6c4b7c6ee4e8b81e2c8c651d1ce2c + ContextualWisdomLab. (2026). *Metering billing platform* (Commit ebeed33f98b34afc232eed980f41d6af9a7a445c) [Computer software]. GitHub. https://github.com/ContextualWisdomLab/metering-billing-platform/tree/ebeed33f98b34afc232eed980f41d6af9a7a445c ContextualWisdomLab. (2026). *Accounting information platform* (Commit 239008c4edc7d305c97704c5102b593c6622b36f) [Computer software]. GitHub. https://github.com/ContextualWisdomLab/accounting-information-platform/tree/239008c4edc7d305c97704c5102b593c6622b36f diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index becf3508..bec34a03 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,6 +4,8 @@ ## September 7 remaining execution and acquisition gates +The [Learning Management Platform availability audit](doctoring/cwl_ontology_capability_inventory.md#learning-management-platform-availability-audit-2026-09-07) advances bounded candidate coverage to 39/76, leaving 37. Protected develop `1b89a16bbbd6c4b7c6ee4e8b81e2c8c651d1ce2c` contains only a bootstrap README; implementation, license and release evidence are absent from the inspected tree/GitHub queries. Establish product responsibilities and released contracts in the existing owner before adoption. Resolved GitHub-release candidates remain seven (7/39), verified adoption zero, and actual decisions/approvals 0/3,715 plus four pending sources. Earlier counts below retain their historical scope. + Follow-up pending-source diagnostic queried metadata for all four existing pending identities and full text for the three attachments. The independent note returned an explicit note field containing 1,430 characters; its absence from the serialized typed report must not be treated as empty original content. All three attachments reported parentless PDF metadata. In private report order, full text contained 192,876 characters with page counters 59/59, zero characters with 17/17, and 173 characters with 100/208. These are availability observations, not extraction fidelity or semantic-review results. The empty and sparse/partially indexed attachments require acquisition assessment; retain all four pending identities and establish bibliographic relationships before changing scope. Requests were read-only and bounded to 1 MiB for metadata, 16 MiB for full text and 15 seconds each. Only aggregate results were emitted. No original bytes were retained, authenticated peer identity established, atomic snapshot bookends checked or classification approved. The private diagnostic note is kept outside the repository; no source titles, identities or bodies are published. The earlier paragraph below describes the preceding observation, before the note was fetched. Decisions and independent approvals remain 0/3,715 plus four pending sources. Read-only pending-source availability diagnostic: the existing private report remains a single-link regular0600 file with four pending identities (three attachments and one note). Three bounded, redirect-rejecting Local API full-text GETs returned HTTP200/API3. Two responses contained nonempty text: reported page counters were59/59 and100/208. The third reported17/17 but had empty text. Counter equality therefore does not establish usable content, and the100/208 response is incomplete by its reported counters. Only aggregate results were emitted; identities and bodies were not published or retained. This diagnostic did not check server-identity continuity, current item revisions or snapshot bookends and is not authenticated acquisition, an atomic capture or a content-bound review. The note was not fetched. Next evidence must retain and bind the original sources, resolve the empty/partial cases and establish their bibliographic relationships before any scope reconciliation; do not infer three additional papers or remove pending identities. Actual decisions/approvals remain0/3,715 plus four pending sources, with no Zotero mutation. From 46d1423c749aa66db62b405c2c6e3f1698faf421 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 14:47:28 +0900 Subject: [PATCH 52/52] docs: align current inventory summary counts Signed-off-by: Seongho Bae --- docs/doctoring/cwl_ontology_capability_inventory.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/doctoring/cwl_ontology_capability_inventory.md b/docs/doctoring/cwl_ontology_capability_inventory.md index c0257b98..6e66d085 100644 --- a/docs/doctoring/cwl_ontology_capability_inventory.md +++ b/docs/doctoring/cwl_ontology_capability_inventory.md @@ -2,7 +2,7 @@ Evidence snapshot: 2026-09-07. Status: research inventory, not dependency-adoption approval. -September 7 adds bounded audits of noema's release admission, EgressWeave's outbound policy, OriginWeave's provenance records, Learning Content Studio's protected-source availability and accounting-information-platform's proposal/reporting boundaries: **38/76** of the September 6 census are now audited, leaving **38** in that historical denominator. Candidates with resolved GitHub releases remain **7/38**; registry-only observations are separate and verified adoption remains zero. Earlier checkpoints below retain their observation dates. A bootstrap-only finding is not an implemented library or a classified paper. +September 7 adds bounded audits of noema's release admission, EgressWeave's outbound policy, OriginWeave's provenance records, Learning Content Studio's protected-source availability, accounting-information-platform's proposal/reporting boundaries and Learning Management Platform's bootstrap availability: **39/76** of the September 6 census are now audited, leaving **37** in that historical denominator. Candidates with resolved GitHub releases remain **7/39**; registry-only observations are separate and verified adoption remains zero. Earlier checkpoints below retain their observation dates. A bootstrap-only finding is not an implemented library or a classified paper. ## Scope and evidence limits