From c7ec0ae1e61a6540118cca91107ff2c465aa3dc5 Mon Sep 17 00:00:00 2001 From: seonghobae Date: Mon, 31 Aug 2026 20:25:34 +0900 Subject: [PATCH 01/80] =?UTF-8?q?docs(gap):=20refresh=20baseline=20?= =?UTF-8?q?=E2=80=94=20185=20open=20PRs,=20merge-train=20stall,=20fail-clo?= =?UTF-8?q?sed=20review-gate=20RCA?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Base revision moved to develop@749511c3. Open-PR count 130 -> 185 (6 days, +55; only #957 landed). Section 5 adds finding (k2): all sampled PRs pass code gates but the three org-owned required reviews (opencode-review, strix, noema-review) fail closed, blocking every PR. Records observed in-flight central repair (noema call_llm timeout branch) as a do-not-duplicate item, and re-scopes P0 #3 to gate remediation as the single top priority. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01SoJBAAXwv58S8P4hQBQQAw --- docs/product-technical-gap-baseline.md | 327 +++++++++++++++++++++++++ 1 file changed, 327 insertions(+) create mode 100644 docs/product-technical-gap-baseline.md diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md new file mode 100644 index 000000000..86e422b7b --- /dev/null +++ b/docs/product-technical-gap-baseline.md @@ -0,0 +1,327 @@ +# BandScope Product-Technical Gap Baseline + +Last updated: 2026-08-31 +Base revision: `develop@749511c3` (feat(workspace): name tonight's first playable range on the map, #957) + +## 1. 목적과 범위 (Purpose & Scope) + +이 문서는 ADR/설계 문서(`ARCHITECTURE.md`, `docs/plans/*`), 브랜드 소스(`docs/brand-story.md`), 보안 소스(`docs/security/app-security.md`), 그리고 현재 저장소 상태(코드, 열린 PR 약 130건, 열린 이슈)를 대조하여 다음을 한 곳에 모은 baseline이다. + +- 기능 명세(functional spec)와 PRD/TRD로 승격되지 않은 요구사항의 공백 +- 구현된 코드와 문서가 선언하는 제품 범위 사이의 기술 Gap +- 누락된 UML/다이어그램 산출물 +- 구매자가 체감하는 제품 Gap 우선순위 Backlog + +범위에는 현재 열려 있는 PR 세트를 명시적으로 포함한다. 특히 `feat(workspace): name tonight's first X on the map` 시리즈는 아직 merge되지 않았으므로, 이 문서에서는 해당 시리즈가 착지했을 때 남는 Gap까지 함께 기술한다. + +검증 원칙: 본 문서의 코드 관련 주장은 전부 실제 repo에 대해 `grep`/`glob`/파일 read로 확인했다. 확인 방법은 9장에 재실행 가능한 명령으로 남긴다. + +## 2. 현행 제품 명세 스냅샷 (Current Product Specification Snapshot) + +`ARCHITECTURE.md`와 `docs/brand-story.md` 기준, BandScope는 오늘날 다음을 지향한다. + +- 퇴근 후 합주 준비자를 위한 local-first 데스크톱 앱(Tauri + Vite + React) +- 곡 보기(song view): 섹션별·연주 역할별 추정 화성, 폼(form)/그루브(groove) 큐, 스템(stems), 연주 가능 음역(playable ranges), 단순화 가이드(simplification), 전조/카포/튜닝/셋업 큐, 파트 겹침(part-overlap) 경고, 가시적 신뢰도(confidence), 리허설 우선순위 +- 분석 대상 모델은 곡 전체 코드 트랙이 아니라 `song -> section -> role` 계층이며, role은 악기/보컬 기능/손(hand) 단위까지 확장될 수 있다 +- 자동 분석 결과는 편집 가능하고, model-generated vs user-confirmed provenance를 유지해야 한다 + +아키텍처 개요: + +```mermaid +flowchart LR + subgraph Desktop["apps/desktop (Tauri + Vite + React)"] + UI["React UI
features/workspace, player,
ranges, chords, score, settings"] + Shell["src-tauri/src/main.rs
9개 typed Tauri command"] + Core["core/src/lib.rs
URL/경로/프로젝트 페이로드
검증 헬퍼 (분석 연산 없음)"] + end + subgraph Engine["services/analysis-engine (Python)"] + CLI["cli.py / api.py
stdin/stdout JSON IPC"] + Mods["chords / sections / roles /
ranges / temporal / separation /
transcription / exports"] + Sep["separation/audio_separator.py
Demucs htdemucs (CPU)
bandsplit-v1.json 폴백"] + end + Rust["services/analysis-engine/rust
bandscope_numeric (PyO3/maturin)
checkerboard_novelty + viterbi_decode"] + Types["packages/shared-types
song-section-role 계약
confidence/provenance/cue/export"] + + UI -- "typed Tauri IPC" --> Shell + Shell --> Core + Shell -- "allowlisted subprocess
stdin/stdout JSON" --> CLI + CLI --> Mods + Mods --> Sep + Mods -. "Rust 커널 호출,
Python 참조 구현 폴백" .-> Rust + UI --- Types + Mods --- Types +``` + +핵심 구조적 사실(코드 확인 완료): + +- 로컬 오케스트레이션은 loopback HTTP가 아닌 typed Tauri IPC + stdin/stdout JSON 서브프로세스 방식이다 (`ARCHITECTURE.md`, `src-tauri/main.rs`) +- `apps/desktop/core`(Rust)는 분석 연산이 아니라 입력 검증(YouTube URL, project payload, score PDF source, 경로 가드) 담당이다 (`apps/desktop/core/src/lib.rs`) +- 무거운 수치 커널 중 checkerboard novelty와 Viterbi 디코딩만 `bandscope_numeric`(Rust/PyO3)으로 포팅되어 있고, 나머지는 Python/NumPy 참조 구현이며 `tests/test_numeric_parity.py`로 f64 parity를 잠근다 (`_native.py`) +- 스템 분리는 Demucs `htdemucs`를 CPU로 돌리고 플랫폼 게이트(demucs/torch 미설치 플랫폼은 불가)이며, 주파수 컷오프만 정의한 `bandsplit-v1.json` 휴리스틱 밴드스플릿 manifest가 별도로 존재한다 (`separation/audio_separator.py`, `separation/model_weights/bandsplit-v1.json`) +- 협업 타입(assignments/comments/approvals)은 `packages/shared-types`에 정의만 되어 있고 UI 참조가 전혀 없다 (grep 확인) + +## 3. 기능 명세 및 요구사항 도출 (Functional Spec Derivation) + +제품 능력 -> 구현 위치 -> 성숙도 매핑. 성숙도: 구현됨 / 부분구현 / 미구현. + +| 제품 능력 | 구현 위치 | 성숙도 | +|---|---|---| +| 로컬 오디오 임포트(Rust 검증 + app-owned 루트) | `apps/desktop/src-tauri/src/main.rs`, `apps/desktop/core/src/lib.rs` | 구현됨 | +| YouTube 임포트(정책 제약, 실패 폴백) | `services/analysis-engine/src/bandscope_analysis/youtube.py` | 부분구현 (DRM/로그인 우회 없음, 실패 시 안내 카드는 PR 진행 중) | +| 스템 분리 | `separation/audio_separator.py` (htdemucs CPU), `bandsplit-v1.json` | 부분구현 (플랫폼 게이트, x86 macOS 미지원, GPU 없음) | +| 섹션 세그먼테이션(checkerboard novelty) | `sections/segmenter.py` + `bandscope_numeric::checkerboard_novelty` | 구현됨 | +| 섹션별 화성(HMM + Viterbi) | `chords/chord_recognizer.py`, `chords/section_harmony.py` | 구현됨 (hand-tuned prior 수준, 4장 참조) | +| 화성 기능 라벨/설명 | `chords/function_analyzer.py`, `RehearsalRole.harmonicExplanation?` | 부분구현 | +| 역할(role) 추출 및 역할별 조율 | `roles/extractor.py`, `roles/tuning.py` | 부분구현 (주파수 컷오프 휴리스틱 기반) | +| 음역/가압(range pressure) | `ranges/analyzer.py`, `ranges/pressure.py`, `ranges/pitch_tracker.py` | 구현됨 | +| 파트 겹침 경고 | `roles/overlap.py`, `RehearsalRole.overlapWarnings` | 구현됨 | +| 단순화 가이드 | `roles/priority.py` 연계, `RehearsalRole.simplification` 필드 | 구현됨 (문자열 필드 중심) | +| 전조/카포/튜닝 큐 | `chords/transposition.py`, `chords/capo.py`, `roles/tuning.py` | 구현됨 (계산), 워크스페이스 노출은 PR 진행 중 | +| 그루브/타이밍/히트 큐 | `temporal/groove.py`, `temporal/hits.py`, `temporal/stability.py` | 구현됨 | +| 진입/이탈/카운트/가사 큐 앵커 | `sections/anchors.py`, `CueAnchorKind = lyric\|count\|transition` | 부분구현 | +| 신뢰도 표시(section/role 수준) | `ConfidenceMarker(low/medium/high)` + `features/workspace/ConfidenceBadge.tsx` | 구현됨 | +| 리허설 우선순위 | `roles/priority.py`, `RehearsalPriority`, `PracticeProgress.tsx` | 구현됨 (규칙 기반 휴리스틱) | +| 수동 수정 + provenance | `ManualOverride[]`, `ProvenanceSource = model\|user` | 구현됨 | +| 내보내기(cue-sheet CSV, chart JSON) | `exports/chart.py`, `src/lib/export.ts` (filename sanitize, CSV escape) | 구현됨 | +| 악보(score) 보기 | `features/score/ScoreView.tsx`, `ScoreViewer.tsx`, `pdfjs.ts` | 부분구현 (PDF 뷰잉; PDF 바이트 검증은 PR 진행 중, 자동 채보 없음) | +| 루프 재생/역할별 재생 제어 | `features/player/index.tsx` | 미구현 (loop 미탐지, PR #903/#971 진행 중) | +| 협업(assignment/comment/approval) UI | `packages/shared-types` 타입만 존재 | 미구현 (UI 참조 0건; PR 시리즈가 첫 화면 진행 중) | +| pad/solo/riff/hook/fill/voicing/articulation/dynamics/tuning/capo/vamp 등 plan 필드 | 없음 (shared-types에 미존재) | 미구현 (PR 시리즈가 추가 예정) | +| 라이선싱/데모곡 first-run | 없음 | 미구현 (PR #1009, Issue #963/#964) | +| 자동 저장/crash-safe 프로젝트 포맷 | 없음 | 미구현 (Issue #961) | +| 서명/공증 배포+롤백 증적 | `.github/workflows/release.yml` 존재 | 부분구현 (Issue #960) | + +## 4. 현재 열린 PR 기반 Gap 분석 (Open-PR Gap Analysis) + +현재 open PR은 185건이다(`gh pr list --state open`, 2026-08-31 기준; 2026-08-25 130건 → 6일 만에 +55건). 대부분은 동일 패턴의 시리즈이며, `#1056`~`#1115+`의 `feat(workspace): name tonight's first … on the map` 체인이 새로 55건 이상 추가되었다(악상 기호 D.C./D.S./Coda/Segno/Fine, tacet, breath, tutti, leftover 파생 등). 이 기간 develop에 착지한 PR은 `#957`(2026-08-26) 1건뿐이므로 backlog는 순증하고 있다(§5(k) 참조). + +시리즈 패턴: `feat(workspace): name tonight's first X on the map` — 워크스페이스 맵에 "오늘 밤 첫 X" next-action 카피를 올리고, Open 클릭 시 해당 섹션으로 이동. 각 PR은 role-owned plan 필드(예: `padPlan`)를 shared contract에 추가하고, own data-property descriptor 검증(Proxy `get` trap 방어), 한국어 조사 안전 카피(`패드`, `뱀프` 등), reduced-motion 처리, 그리고 강한 merge-gate 조항을 포함한다. + +capability cluster 분류와 착지 후 남는 Gap: + +| Cluster | 해당 PR (예시) | 착지가 의미하는 것 | 착지 후 남는 Gap | +|---|---|---|---| +| A. 역할별 연주 plan 필드 (pad/solo/riff/hook/fill/voicing/articulation/dynamics/tuning/capo/vamp) | #1020, #1013~#1018, #1021, #1024 | RehearsalRole 계약 확장과 첫 plan 노출. 데이터 생성기(engine)가 실제로 이 plan을 산출하는지와는 별개 | plan 값을 만들어내는 엔진 로직, plan 간 충돌/우선순위 정책, plan 편집 UX | +| B. 폼/섹션 네이밍 (intro/verse/pre-chorus/chorus/bridge/outro/tag/pickup/stop/handoff/entrance/dropout/lyric cue/transition/transition-cue/count) | #943, #947, #955, #939, #946, #986, #989, #916, #934, #937, #912, #914, #913, #994, #993, #995 | SECTION_FORM_LABELS와 CueAnchorKind가 이미 계약에 있으므로 주로 UI 노출 완성 | 앵커 정확도(가사/카운트 정렬), 사용자 직접 앵커 편집 | +| C. 화성 설명/확정/귀확인 (harmonic function/explanation/confirmed chord/ear check/setup note/transposition/part handoff/playable range/overlap/groove/simpler take/tempo-starting chord setup) | #1005, #1003, #1002, #1001, #1004, #1006, #1007, #957, #992, #991, #990, #987 | brand-story의 "추정 + 귀로 확인" 프레임을 UI 언어로 구체화 | confidence 산출 근거의 정량화, confirmed override의 재분석 반영(round trip, Issue #739) | +| D. 협업 최소면 (assignment/comment/approval/blocked/pending/open comment/export-priority actions/ready board) | #996, #997, #998, #1000, #900, #901 | shared-types의 collaboration 타입에 처음으로 UI가 붙음 | 동기화(syncMode local_only/planned_cloud), crash-safe 프로젝트 포맷(Issue #961), 권한 모델 | +| E. First-run/activation/실패 복구 (first-run card/license demo song/local intake 실패/import 실패/analysis 실패/save 실패/help) | #974, #1009, #981, #982, #976, #984, #972, #898 | 빈 상태/오류 상태의 next-action 카피 완성 | 라이선싱 백엔드, 데모곡 번들 정책, 오프라인 활성화 | +| F. 보안/신뢰경계 (log redaction x4, quick-xml RustSec, filesystem authority, canonical audio policy, CSV NUL/전각 우회 차단, credential drop, PDF bound reads, npm baseline) | #956, #951, #950, #949, #948, #858, #985/#781, #941, #894, #865, #783 | app-security.md 규칙의 코드 반영 마무리 | Issue #852(경계 재구축), #542(예외 추적), 모델 artifact checksum/signature 파이프라인 | +| G. 성능 (Bolt 시리즈: 관측 확률 벡터화, GrooveMap maxTime O(1), chart dedupe O(N), chord change count O(1), checkerboard/HMM 벡터화) | #999, #859, #849, #834, #746, #732 | 핫패스 최적화. Rust 커널 포팅과 같은 방향의 Python 측 보완 | Demucs GPU/offload, 대용량 파일 스트리밍, UI 가상화 | +| H. 접근성/디자인 시스템 (tooltip aria-disabled, icon tooltip, Storybook tokens, Figma drift check) | #833, #731, #897, #969 | WCAG 대응 시작점 | Issue #965(Figma/Storybook/shipped UI 정합 + WCAG 2.2 AA gate) 전체 | +| I. 테스트 현실성 (decoded WAV acceptance, known-take chord recovery, real YouTube known-stem benchmark, branch coverage) | #892, #891, #828, #861 | synthetic fixture에서 실오디오 기반 acceptance로 이동 시작 | Issue #770(실오디오 MIR accuracy benchmark) 체계화, RMSE/SI-SDR 임계값 정책 | +| J. 의존성/빌드 위생 (react, storybook, base-ui, lucide, sonner, codeql-action, setup-uv, uv group, numba, uuid, time, rust pinning, node floor, orphaned Actions identity) | #920, #942, #922, #921, #926, #927, #924, #931, #936, #919, #918, #754, #944, #896, #895 | 공급망/런타임 최신화 유지 | Dependabot train 정리(Issue #966), jsdom 30 전환 완료 | + +시리즈 전체에 대한 종합 판단: 이 시리즈는 "계약(contract) 필드 추가 + 첫 노출" 단계다. 착지해도 (1) plan 값의 생성 로직, (2) plan들 사이 우선순위/중복 정책, (3) 재분석 시 override 보존 round-trip, (4) 협업 영속화는 여전히 Gap으로 남는다. 또한 130건이 develop 기준으로부터 장기간 분기되어 있어 rebase 비용과 exact-head CI 증적 요구(PR 본문 명시)로 인한 merge train 정체가 자체적으로 기술 위험이다(Issue #966). + +## 5. 기술 Gap 목록 (Technical Gaps) + +문서 vs 코드 대조로 확인한 구체적 Gap. + +(a) **Rust compute layer 활용 범위** — 분석 핫패스 중 checkerboard novelty와 Viterbi decode만 Rust(`bandscope_numeric`)에 있다. 스템 분리(Demucs)는 Python/torch CPU 경로이고 GPU/CUDA/Metal 경로가 없으며, transcription은 에너지 마스크 휴리스틱(`transcription/api.py`)으로 ML 모델이 아니다. 데스크톱 단일 곡 처리 기준 CPU로도 실용적일 수 있으나, 긴 곡/다중 분석에서 병목이며 `docs/plans/2026-04-25-v2-transcription.md`가 v2 계획으로 존재한다. + +(b) **다층/계층·시간 모델링** — `song -> section -> role` 계약과 sections/roles/temporal 모듈은 존재하지만, role-level harmony는 `bandsplit-v1.json`의 고정 주파수 컷오프 휴리스틱에 의존한다. 학습된 multilevel 모델(예: role-conditioned chord/voicing 모델)과 section 경계의 temporal 일관성 학습은 없다. `docs/plans/2026-03-28-ml-engine-integration.md`가 관련 계획 문서다. + +(c)**임의 가중치 vs 문헌 기반 값** — `chord_recognizer._build_transition_matrix()`는 `self_prob=0.8`, `related_prob=0.03`, uniform baseline `0.01/n` 등 hand-set 상수를 쓴다("Encodes musical priors" 주석). 방향성(fifth/fourth/relative/parallel)은 음악 이론에 근거하지만 수치는 문헌 교정(calibration)되어 있지 않다. `roles/priority.py`는 숫자 가중치 없는 if-then 규칙이다. PR #732(relative-key prior correction)처럼 사후 수정이 발생해왔다. 교정 방향: 주석 코퍼스(예: Burgoyne et al., 2011의 McGill Billboard)에서 전이 행렬을 최대우도로 추정하고, HMM prior 민감도(Logan & Chu, 2000; Pauwels & Peeters, 2013; Boulanger-Lewandowski et al., 2013 참조)와 tonal pitch space 거리 기반 스무딩(Harte, 2010)으로 현재 hand-set 값과의 코드 복원 RMSE/accuracy 차이를 정량 비교한 뒤, 우세한 값을 상수가 아닌 데이터 산출물로 고정한다. + +(d) **테스트 현실성** — `test_numeric_parity.py`(Rust-Python parity), `test_api.py` 등은 합성 입력 기반이고, tests 디렉터리에 .wav/.mp3 실오디오 fixture가 없다(find 확인). 실오디오 acceptance는 PR #892(decoded WAV C major), #891(known take verse/chorus recovery)이 열려 있고, 실 YouTube known-stem benchmark는 draft PR #828 + Issue #770 상태다. RMSE/SI-SDR 스타일 정량 임계값 acceptance gate는 아직 없다. + +(e) **커버리지/docstring 100%** — Python은 `--cov-fail-under=100` + Ruff D100-D107 docstring 100%가 gate로 작동한다(AGENTS.md, roadmap-completion 문서). JS workspace는 2026-08-25 실측에서 desktop(469 stmts/357 branches/105 funcs)과 shared-types(717 stmts/643 branches/59 funcs) 모두 statements/branches/functions/lines **실측 100%**를 유지한다. 그러나 gate threshold(`vite.config.ts`, `vitest.config.ts`)는 90으로 Python보다 낮아, 리그레션 시 90~99% 구간이 무단 통과될 수 있다. Gate 상향은 Backlog #10. + +(f) **보안 체크리스트 잔여 항목** — 구현된 것: allowlisted stdin/stdout subprocess, Tauri CSP, path guards(#727 착지), CSV escape/sanitize, shell=False. 열린 것: canonical audio resource budget(#985 draft, Issue #781), filesystem path containment 재구축(Issue #852, #858 진행), native PDF read bounding(#865, #750), quick-xml RustSec 예외(#948, Issue #542), npm/PDF.js/nanoid/undici baseline(#783). 모델 artifact(Demucs checkpoint) checksum/signature 검증 파이프라인은 문서(app-security.md "Models") 요구 대비 미구현. + +(k) **운영 관측(2026-08-25 strix 공급자 장애)** — 중앙 Strix 게이트가 NVIDIA NIM 소진 시 최종 폴백 `openai-direct/gpt-5.4`를 NIM 엣지 API base로 라우팅해 `404 page not found`로 실패 닫기(fail-closed)하여 전 조직 PR 큐가 정체했다. 근본 원인 수정은 ContextualWisdomLab/.github#1324(openai-direct 폴백 전용 API base 라우팅 + 회귀 계약 테스트)로 추적했고, bandscope 의존성 CVE(pdfjs-dist CVE-2026-16633 등)는 canonical owner #783으로 일원화했다. 운영 교훈: required 스캐너의 공급자 장애는 repo 단위 우회가 아니라 중앙 게이트 계약 수정으로만 풀어야 한다. + +(k2) **운영 관측(2026-08-31 merge train 정체 지속) — 현재 최우선 제품-기술 Gap** — 2026-08-31 기준 열린 PR 185건 중 확인한 표본(#1054·#1055·#1057·#1074·#1103·#1104) 전부에서 `ci / build-and-test`, cross-platform build, CodeQL/Semgrep/Bandit/Trivy/OSV, CodeRabbit, Devin 등 코드 게이트는 **통과**하나, 조직 소유 필수 리뷰 3종이 **일괄 실패 닫기**한다. + +| 필수 체크 | 소스 | 실패 양상(표본) | 근본 원인(관측) | +|---|---|---|---| +| `opencode-review` | `ContextualWisdomLab/.github/.github/workflows/opencode-review.yml` | 수 초 내 fail. `opencode-review-target` 잡이 `api.opencode.ai`로 dispatch 후 현재 head SHA에 대한 `opencode-agent` verdict를 최대 90분 폴링하다 없으면 fail-closed | dispatch된 authenticated 리뷰가 exact-head APPROVED/CHANGES_REQUESTED 리뷰를 게시하지 못함(에이전트 미가동 또는 자격 미구성) | +| `strix` | `…/strix.yml` | 5–11분 후 fail | OpenCode app-token 교환/스캐너 실행이 공급자 키에 의존; §5(k) 계열 공급자 라우팅 장애의 연장선 | +| `noema-review` | `…/noema-review.yml` | 2–6분 후 fail | contextual-orchestrator 사이드카 + 공급자 키(BYTEZ/NVIDIA_NIM/OPENROUTER/OPENAI) 필요; `call_llm` HTTP 타임아웃(120s)이 조직 정책보다 짧아 verdict 미제출 | + +관측된 진행 중 조치(중복 금지, 관망 대상): `ContextualWisdomLab/.github`의 `pr-review-merge-scheduler`가 분 단위로 재실행 중이며 `fix(noema): raise call_llm HTTP timeout from 120s to org policy` 브랜치가 활성 상태(원격 에이전트 소유). `bandscope-hourly-review-repair`는 시간별로 대체로 success이나 backlog를 해소하지 못한다. 로컬 git 세션에서 이 필수 체크를 직접 통과시킬 방법은 없다(branch protection + 조직 자격). 로컬 레버리지는 (1) 코드가 원인인 PR의 실질 리뷰·수정 stack, (2) 본 baseline 최신화, (3) `codex/project-format-v1` 같은 stale/이름 충돌 로컬 브랜치 정리에 한정된다. + +조치 상태: +- **미해결 / 상위 에스컬레이션 필요** — 필수 리뷰 3종 fail-closed로 인해 185건 전부 merge 불가. 소유: `ContextualWisdomLab/.github` (원격 에이전트가 noema 타임아웃 수정 중). bandscope 측 액션: 없음(계약 수정은 중앙에서만). §5(k) 교훈 재확인 — repo 단위 우회 금지. +- **부분 조치** — 문서화 및 로컬 브랜치 위생(본 커밋). stale `codex/project-format-v1` 로컬 체크아웃(자기 origin 대비 78 커밋 뒤처짐, PR #1073 이미 merged)에서 baseline 문서를 `develop` 기준 새 브랜치로 재분리했다. 임시 hack(`cli.py`의 "Temporary: Inject temporal analyzer") → `api.py` `_build_local_temporal_features` 정식화 WIP는 stash 보존(다음 Loop에서 별도 PR 예정). + +(g) **i18n/현지화** — `src/i18n` + `locales/en`, `locales/ko` 존재, 하드코딩 한국어 문자열 미탐지(workspace tsx grep 0건), interpolation hardening PR #744 진행. en/ko 2개 언어뿐이며, PR 시리즈가 추가할 다수의 카피 키가 locales에 아직 없다. + +(h) **접근성** — workspace 컴포넌트에 aria-* 속성 52건 존재. 그러나 WCAG 2.2 AA gate는 Issue #965로 열려 있고, Figma/Storybook/shipped UI 정합 점검도 미완이다. tooltip/a11y PR(#833, #731)이 진행 중. + +(i) **Design token/Storybook** — shadcn/ui 프리미티브 중 stories는 button/checkbox/dialog 3개뿐이고, rehearsal 도메인 컴포넌트(GrooveMap, SectionRoadmap, RoleSwitcher 등) stories는 없다. Storybook token PR #897이 진행 중. + +(j) **패키징/릴리스 준비** — `CHANGELOG.md`, `VERSION`, `release.yml`, `build-baseline.yml` 존재. Windows/macOS amd64+arm64 build gate가 protected branch 요건이다(ARCHITECTURE.md). 남는 Gap: 서명/공증/자동 업데이트 롤백 증적(Issue #960), crash-safe project format/autosave/migration(Issue #961), redacted diagnostics/support bundle(Issue #962). + +## 6. UML 보완점 + +현재 docs 전역에서 Mermaid/sequence/class diagram이 하나도 존재하지 않는다(grep 확인). 아래 두 다이어그램이 최소 필수다. + +### 6.1 import -> analyze -> workspace render happy path + +```mermaid +sequenceDiagram + actor U as User + participant UI as React UI + participant T as Tauri shell (main.rs) + participant C as core/lib.rs (validation) + participant P as Python engine (cli/api) + participant N as bandscope_numeric (Rust) + U->>UI: select local audio file + UI->>T: invoke intake command + T->>C: validate path/format/project id + C-->>T: validated reference (no copy) + T->>P: spawn allowlisted subprocess (stdin/stdout JSON) + P->>P: separate stems (Demucs CPU) / segment / chords + P->>N: checkerboard_novelty, viterbi_decode + N-->>P: kernels result (parity-guaranteed) + P-->>T: RehearsalSong JSON (schema-validated) + T-->>UI: jobResult event + UI->>UI: render Workspace/GrooveMap/Roles +``` + +### 6.2 untrusted-input trust boundaries + +```mermaid +flowchart TD + subgraph Untrusted["User Input Boundary (untrusted)"] + F[local audio file] + Y[YouTube URL + metadata] + D[drag-and-drop payload] + PF[imported project file] + MF[model artifacts] + end + subgraph Gates["validation gates"] + VF[path/format/id guard - core/lib.rs] + VY[scheme/host/path/query allowlist - youtube.py] + VP[payload schema validation - IPC] + VM[checksum/signature required - 미구현] + end + subgraph Trusted["Process Boundary"] + S[Tauri shell] + PY[Python engine] + RS[Rust kernels] + end + F --> VF --> S + Y --> VY --> PY + D --> VP --> S + PF --> VP --> S + MF -. "checksum/signature gate 없음" .-> VM + VM -.-> PY + S --> PY --> RS +``` + +### 6.3 완전히 누락된 UML 산출물 + +- 프로젝트 save/load/migration 흐름(crash-safe 포맷 설계 선행 다이어그램) +- manual override <-> 재분석 round-trip(provenance 보존) 시퀀스 +- export(cue-sheet/chart) 파이프라인과 sanitize 지점 다이어그램 +- state machine: analysis job(idle/running/done/failed) 상태 전이 +- class diagram: shared-types 도메인(song/section/role/confidence/provenance) 정식 클래스 뷰 + +## 7. 우선순위가 매겨진 Gap Backlog (Prioritized Gap Backlog) + +구매자 체감 순서 기준. 각 항목에 acceptance criteria를 둔다. + +### P0 + +1. **실오디오 정확도 acceptance gate (Issue #770, PR #828/#891/#892 수렴)** + - Why: brand-story의 Accuracy principle("easy to use does not mean accuracy can be loose")은 정량 근거 없이는 신뢰할 수 없다. + - Acceptance: 실오디오 fixture(최소 3곡, known stems)에 대해 chord recognition 정확도와 stem SI-SDR 임계값이 CI gate로 실행되고, 실패 시 merge가 차단된다. +2. **canonical audio resource budget 착지 (PR #985/#866, Issue #781)** + - Why: 대용량/악성 파일로 인한 메모리 폭주는 첫 사용 경험을 깬다. 보안 gate이자 안정성 gate다. + - Acceptance: 파일 크기/길이 상한이 intake에서 강제되고, 초과 입력은 안전 실패 카피로 거부된다. quickcheck 통과. +3. **필수 리뷰 게이트 fail-closed 해소 → merge train 재가동 (Issue #966, §5(k2)) — 현재 단일 최우선** + - Why: 185개 open PR 전부가 `opencode-review`/`strix`/`noema-review` 일괄 실패로 merge 불가하며, backlog는 6일간 +55건 순증했다. 다른 모든 P0/P1은 이 게이트가 열리기 전엔 착지할 수 없다. + - Acceptance: 세 필수 워크플로가 표본 PR에서 exact-head verdict로 통과하고(중앙 `ContextualWisdomLab/.github` 계약 수정: noema `call_llm` 타임아웃 정렬, opencode/strix 공급자 라우팅), 이후 dependency-aware train으로 open PR이 cluster A-J 단위 수렴하며 중복 PR이 canonical PR로 link된다. repo 단위 우회(필수 체크 완화·삭제)는 금지(§5(k) 교훈). +4. **filesystem path containment 재구축 (Issue #852, PR #858)** + - Why: 로컬 데스크톱 앱의 최상위 신뢰경계. 우회 시 임의 파일 접근으로 이어진다. + - Acceptance: 모든 파일 접근이 authority 객체로 바인딩되고 traversal 테스트가 gate에 포함된다. + +### P1 + +5. **plan 필드 시리즈의 엔진 생성 로직 + 우선순위 정책 (Cluster A/C 착지 후속)** + - Acceptance: 각 plan(padPlan 등)이 engine이 실제 산출하는 값과 UI 노출로 연결되고, 다중 plan 충돌 시 표시 우선순위가 문서화되며, override 시 provenance가 보존된다. +6. **루프 재생/역할별 재생 제어 (Issue #960, PR #903/#971)** + - Acceptance: 임의 섹션을 role 필터와 함께 loop 재생할 수 있고, reduced-motion/키보드 조작이 동작한다. +7. **crash-safe project format + autosave (Issue #961)** + - Acceptance: 버전 필드를 가진 프로젝트 포맷, 저장 실패 시 known-good 보존(PRx #970 방향), migration 테스트. +8. **Demucs 플랫폼 커버리지 + 모델 artifact 검증** + - Acceptance: x86 macOS 폴백 경로가 명시되고(현재 demucs 미설치 시 불가), 모델 checkpoint checksum 검증이 intake pipeline에 있다. +9. **WCAG 2.2 AA gate (Issue #965) + rehearsal 컴포넌트 Storybook tokens (PR #897)** + - Acceptance: axe 기반 자동 점검이 CI에 있고, GrooveMap/SectionRoadmap/RoleSwitcher stories가 token 기반으로 존재한다. +10. **JS coverage 90% -> 100% 상향 또는 Python과 동일한 기준 명문화** + - Acceptance: vite.config/vitest thresholds 상향 또는 "Python 100%, JS 90%" 정책이 acceptance-criteria.md에 명시된다. + +### P2 + +11. **HMM transition prior 문헌 교정 (5장 (c))** + - Acceptance: transition 행렬 상수의 출처(문헌 or 교정 데이터)가 주석/ADR로 기록되고, sensitivity test가 존재한다. +12. **v2 transcription (docs/plans/2026-04-25-v2-transcription.md) 착지** + - Acceptance: 에너지 휴리스틱 대체 모델이 parity/perf gate를 통과한다. +13. **협업 동기화(local_only -> planned_cloud) 설계 문서화** + - Acceptance: syncMode 전환 시 데이터 흐름/권한 모델이 TRD로 문서화된다(네트워크 정책 준수). +14. **i18n 확장 전략(en/ko 외) 및 PR 시리즈 카피 키 일괄 정리** + - Acceptance: 신규 카피가 locales에 key로 존재하고 particle-safe 한국어 규칙이 lint/check로 검증된다. +15. **redacted diagnostics/support bundle (Issue #962, PR #967)** + - Acceptance: 로그에 raw audio/full URL 미포함이 자동 점검으로 확인된다. + +## 8. APA 7th 참고문헌 (References) + +본 문서에서 실제 인용한 개념(MIR novelty kernel, HMM/Viterbi 디코딩, 소스 분리 평가, librosa, 접근성 표준)에 한정한다. + +Boulanger-Lewandowski, N., Bengio, Y., & Vincent, P. (2013). Audio chord recognition with recurrent neural networks. In Proceedings of the 14th International Society for Music Information Retrieval Conference (ISMIR 2013) (pp. 335–340). ISMIR. + +Burgoyne, J. A., Wild, J., & Fujinaga, I. (2011). An expert ground truth set for audio chord recognition and music analysis. In Proceedings of the 12th International Society for Music Information Retrieval Conference (ISMIR 2011) (pp. 633–638). ISMIR. + +Défossez, A., Usunier, N., Bottou, L., & Bach, F. (2019). Music source separation in the waveform domain. arXiv. https://arxiv.org/abs/1911.13254 + +Harte, C. (2010). Towards automatic extraction of harmony information from music signals (Doctoral dissertation, Queen Mary University of London). + +Logan, B., & Chu, S. (2000). Music summary using hidden Markov models. In IEEE International Conference on Acoustics, Speech, and Signal Processing (ICASSP 2000) (Vol. 6, pp. 3673–3676). IEEE. + +Pauwels, J., & Peeters, G. (2013). Combining harmony-based and melody-based chroma features for chord recognition. In Proceedings of the 14th International Society for Music Information Retrieval Conference (ISMIR 2013) (pp. 597–602). ISMIR. + +Foote, J. (1999). Visualizing music and audio using self-similarity. In Proceedings of the Seventh ACM International Conference on Multimedia (Multimedia '99) (pp. 77–80). ACM. + +Le Roux, J., Wisdom, S., Erdogan, H., & Hershey, J. R. (2019). SDR – half-baked or well done? In IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP 2019) (pp. 626–630). IEEE. + +McFee, B., Raffel, C., Liang, D., Ellis, D. P. W., McVicar, M., Battenberg, E., & Nieto, O. (2015). librosa: Audio and music signal analysis in Python. In Proceedings of the 14th Python in Science Conference (SciPy 2015) (pp. 18–24). + +Müller, M. (2015). Fundamentals of music processing: Audio, analysis, algorithms, applications. Springer. + +Viterbi, A. J. (1967). Error bounds for convolutional codes and an asymptotically optimum decoding algorithm. IEEE Transactions on Information Theory, 13(2), 260–269. + +W3C. (2023). Web Content Accessibility Guidelines (WCAG) 2.2. World Wide Web Consortium. https://www.w3.org/TR/WCAG22/ + +참고: 위 항목 중 DOI가 확실치 않은 항목은 DOI 없이 plain APA로 기술했다(조작 금지 원칙). 코드 내 개념 대응: Foote(1999)=checkerboard novelty, Viterbi(1967)/Boulanger-Lewandowski et al.(2013)=HMM 코드 디코딩 prior, Défossez et al.(2019)=Demucs htdemucs, Le Roux et al.(2019)=SI-SDR(audio_separator.py 주석 언급), Müller(2015)/McFee et al.(2015)=섹션/코드/음역 분석 기반 라이브러리. + +## 9. 검증 방법 (Verification Method) + +각 절의 근거와 재실행 명령. + +- Repo root: `git rev-parse --show-toplevel` -> `/Users/seonghobae/bandscope` +- 문서 소스 read: `ARCHITECTURE.md`, `AGENTS.md`, `docs/brand-story.md`, `docs/security/app-security.md`, `docs/workflow/one-day-delivery-plan.md`, `docs/engineering/acceptance-criteria.md`, `docs/plans/2026-03-27-bandscope-roadmap-completion.md` +- Open PR inventory: + ```bash + gh pr list --state open --limit 200 --json number,title,isDraft,headRefName \ + --jq 'sort_by(-.number) | .[] | "\(.number)\t\(.isDraft)\t\(.title)"' > /tmp/opencode/open_prs_full.txt + wc -l /tmp/opencode/open_prs_full.txt # 130 + gh pr view 1021 --json title,body # 시리즈 패턴 샘플 + ``` +- Open issues: `gh issue list --state open --limit 50 --json number,title --jq '.[]|"\(.number)\t\(.title)"'` +- 코드 검증 grep/glob (요지): + - `grep -rn "padPlan\|PadPlan" apps/desktop/src packages/shared-types/src` -> 0건(시리즈 미착지 확인) + - `find services/analysis-engine -name "*.py"` -> 모듈 목록(chords/sections/roles/ranges/temporal/separation/transcription/youtube/exports) + - `sed -n '70,110p' .../chords/chord_recognizer.py` -> hand-set transition prior 확인 + - `sed -n '1,40p' .../_native.py` -> bandscope_numeric 커널/parity 확인 + - `ls services/analysis-engine/rust` + `grep maturin rust/pyproject.toml` -> Rust 커널 위치 확인 + - `head -30 separation/model_weights/bandsplit-v1.json` -> 휴리스틱 manifest 확인 + - `grep -rn "aria-" apps/desktop/src/features/workspace/*.tsx | wc -l` -> 52 + - `grep -rln "RehearsalAssignment\|RehearsalCollaboration" apps/desktop/src` -> 0건(UI 미구현 확인) + - `grep -rn "loop" apps/desktop/src/features/player/index.tsx` -> 0건(loop 미구현 확인) + - `ls CHANGELOG.md VERSION .github/workflows` -> 릴리스 자산 확인 + - `grep -n thresholds apps/desktop/vite.config.ts packages/shared-types/vitest.config.ts` -> JS 90% 확인 + - `grep -n "cov-fail-under" AGENTS.md docs` -> Python 100% gate 확인 + - Mermaid 존재 여부: `grep -rln "sequenceDiagram\|classDiagram\|flowchart" docs ARCHITECTURE.md` -> 0건(6장 전제 확인) From 00019c9ffe18bd630b14c4cd7c4ff4146def340f Mon Sep 17 00:00:00 2001 From: seonghobae Date: Mon, 31 Aug 2026 21:39:56 +0900 Subject: [PATCH 02/80] docs(gap): record temporal-refactor PR #1117 and central Noema repair progress MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Iteration-2 status: gates still fail closed. Central .github landed 8 Noema-reliability fixes (#1477-#1504) plus an active "remove fixed LLM response timeout" branch. Local response: staged merge-ready work behind the closed gates — PR #1116 (this baseline) and PR #1117 (temporal probe promoted from cli hack to api integration, 100% coverage locally). Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01SoJBAAXwv58S8P4hQBQQAw --- docs/product-technical-gap-baseline.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 86e422b7b..0e3789d6c 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -140,11 +140,13 @@ capability cluster 분류와 착지 후 남는 Gap: | `strix` | `…/strix.yml` | 5–11분 후 fail | OpenCode app-token 교환/스캐너 실행이 공급자 키에 의존; §5(k) 계열 공급자 라우팅 장애의 연장선 | | `noema-review` | `…/noema-review.yml` | 2–6분 후 fail | contextual-orchestrator 사이드카 + 공급자 키(BYTEZ/NVIDIA_NIM/OPENROUTER/OPENAI) 필요; `call_llm` HTTP 타임아웃(120s)이 조직 정책보다 짧아 verdict 미제출 | -관측된 진행 중 조치(중복 금지, 관망 대상): `ContextualWisdomLab/.github`의 `pr-review-merge-scheduler`가 분 단위로 재실행 중이며 `fix(noema): raise call_llm HTTP timeout from 120s to org policy` 브랜치가 활성 상태(원격 에이전트 소유). `bandscope-hourly-review-repair`는 시간별로 대체로 success이나 backlog를 해소하지 못한다. 로컬 git 세션에서 이 필수 체크를 직접 통과시킬 방법은 없다(branch protection + 조직 자격). 로컬 레버리지는 (1) 코드가 원인인 PR의 실질 리뷰·수정 stack, (2) 본 baseline 최신화, (3) `codex/project-format-v1` 같은 stale/이름 충돌 로컬 브랜치 정리에 한정된다. +관측된 진행 중 조치(중복 금지, 관망 대상): `ContextualWisdomLab/.github`가 Noema 리뷰 신뢰성을 집중 수정 중 — 2026-08-31 반나절에 #1477·#1480·#1483·#1487·#1490·#1497·#1501·#1504 착지 + `fix(noema): remove fixed LLM response timeout`(#1415/#1511) 활성. `pr-review-merge-scheduler`는 분 단위 재실행, `bandscope-hourly-review-repair`는 시간별 대체로 success이나 backlog 미해소. 로컬 git 세션에서 이 필수 체크를 직접 통과시킬 방법은 없다(branch protection + 조직 자격). 로컬 레버리지는 (1) 코드가 원인인 PR의 실질 리뷰·수정 stack, (2) 본 baseline 최신화, (3) `codex/project-format-v1` 같은 stale/이름 충돌 로컬 브랜치 정리에 한정된다. 조치 상태: - **미해결 / 상위 에스컬레이션 필요** — 필수 리뷰 3종 fail-closed로 인해 185건 전부 merge 불가. 소유: `ContextualWisdomLab/.github` (원격 에이전트가 noema 타임아웃 수정 중). bandscope 측 액션: 없음(계약 수정은 중앙에서만). §5(k) 교훈 재확인 — repo 단위 우회 금지. -- **부분 조치** — 문서화 및 로컬 브랜치 위생(본 커밋). stale `codex/project-format-v1` 로컬 체크아웃(자기 origin 대비 78 커밋 뒤처짐, PR #1073 이미 merged)에서 baseline 문서를 `develop` 기준 새 브랜치로 재분리했다. 임시 hack(`cli.py`의 "Temporary: Inject temporal analyzer") → `api.py` `_build_local_temporal_features` 정식화 WIP는 stash 보존(다음 Loop에서 별도 PR 예정). +- **부분 조치 (merge-ready 대기열 축적)** — 게이트가 열리는 즉시 착지할 수 있도록 코드 원인 PR을 `develop` 기준으로 정비: + - **PR #1116** — 본 baseline. stale `codex/project-format-v1`(자기 origin 대비 78 커밋 뒤처짐, PR #1073 이미 merged) 로컬 체크아웃에서 `develop` 기준 새 브랜치로 재분리. stale 로컬 브랜치는 삭제. + - **PR #1117** — `refactor(engine): promote temporal probe from cli hack to api integration`. `cli.py`의 "Temporary: Inject temporal analyzer … just to prove it works" probe를 `api._build_local_temporal_features()` 정식 통합으로 대체(§5(d)·§6(a) 방향, 임시/데모 코드의 production 반입 금지 원칙). stem 분리 불가 시에도 tempo/제목 큐 보존. `STEM_SEPARATION_TIMEOUT_SECONDS` 20→300s, Rust `ANALYSIS_PROCESS_TIMEOUT` 30→360s(기존 값은 실제 길이 곡에서 무조건 timeout). `ruff`/`ruff format`/`mypy src`/`pytest --cov-fail-under=100`(678 pass, 100%) 로컬 통과. (g) **i18n/현지화** — `src/i18n` + `locales/en`, `locales/ko` 존재, 하드코딩 한국어 문자열 미탐지(workspace tsx grep 0건), interpolation hardening PR #744 진행. en/ko 2개 언어뿐이며, PR 시리즈가 추가할 다수의 카피 키가 locales에 아직 없다. From 904d79d7832a28c61fd98387951555738aaedfda Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 10:46:06 +0900 Subject: [PATCH 03/80] docs(gap): replace stale baseline with current product/technical contract --- docs/product-technical-gap-baseline.md | 516 +++++++++++++------------ 1 file changed, 264 insertions(+), 252 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 0e3789d6c..d14f5202a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,329 +1,341 @@ # BandScope Product-Technical Gap Baseline -Last updated: 2026-08-31 -Base revision: `develop@749511c3` (feat(workspace): name tonight's first playable range on the map, #957) +Last updated: 2026-09-01 +Evidence capture: 2026-09-01 10:31 KST unless a row says otherwise +Protected base: `develop@749511c3ad4000090048718f685c6bee6b3d2c25` -## 1. 목적과 범위 (Purpose & Scope) +## 1. Purpose and product outcome -이 문서는 ADR/설계 문서(`ARCHITECTURE.md`, `docs/plans/*`), 브랜드 소스(`docs/brand-story.md`), 보안 소스(`docs/security/app-security.md`), 그리고 현재 저장소 상태(코드, 열린 PR 약 130건, 열린 이슈)를 대조하여 다음을 한 곳에 모은 baseline이다. +This is the engineering evidence baseline for BandScope. Customer-facing copy must continue to follow `docs/brand-story.md`: practical, rehearsal-first, non-authoritative, and explicit about uncertainty. This document is intentionally denser because its job is to connect product promises, implementation boundaries, tests, research, security controls, and the live PR queue without exposing those internals in the product UI. -- 기능 명세(functional spec)와 PRD/TRD로 승격되지 않은 요구사항의 공백 -- 구현된 코드와 문서가 선언하는 제품 범위 사이의 기술 Gap -- 누락된 UML/다이어그램 산출물 -- 구매자가 체감하는 제품 Gap 우선순위 Backlog +BandScope is a local-first rehearsal companion for people who need to understand a song quickly and spend rehearsal time playing rather than decoding the arrangement. The buyer outcome is: -범위에는 현재 열려 있는 PR 세트를 명시적으로 포함한다. 특히 `feat(workspace): name tonight's first X on the map` 시리즈는 아직 merge되지 않았으므로, 이 문서에서는 해당 시리즈가 착지했을 때 남는 Gap까지 함께 기술한다. +```text +install a trusted build +→ import a real song +→ get evidence-backed section/role analysis +→ see uncertainty and correct it +→ rehearse a passage with precise transport +→ save/recover the project +→ share a bounded handoff +→ update or roll back safely +``` + +The product is not a DAW, notation editor, mandatory cloud service, or authority that claims one analysis is unquestionably correct. + +### Buyer-facing PRD + +Primary users are working musicians and band hobbyists preparing after work. The core jobs are: + +1. identify what each player or vocal role should prepare; +2. understand form, entry/dropout, timing, harmony, range, overlap, and setup cues by section; +3. repeat a difficult passage without rebuilding a loop in another tool; +4. correct uncertain analysis and retain provenance of the correction; +5. return later without losing accepted work; +6. install and update a build whose identity and provenance can be verified. -검증 원칙: 본 문서의 코드 관련 주장은 전부 실제 repo에 대해 `grep`/`glob`/파일 read로 확인했다. 확인 방법은 9장에 재실행 가능한 명령으로 남긴다. +Representative user stories: -## 2. 현행 제품 명세 스냅샷 (Current Product Specification Snapshot) +- As a player, I can open a local song and see the first useful rehearsal action without learning a DAW. +- As a band member, I can distinguish section-level and role-level guidance instead of receiving one flat chord track. +- As a user, I can see when BandScope is uncertain and correct the result without losing the original model provenance. +- As a player, I can select a cue or section, count in, loop it, slow it down when supported, and keep role controls accessible from keyboard and assistive technology. +- As a returning user, I can recover the last known-good project after a crash, interrupted write, schema migration, or failed update. -`ARCHITECTURE.md`와 `docs/brand-story.md` 기준, BandScope는 오늘날 다음을 지향한다. +## 2. Current architecture and responsibility boundaries -- 퇴근 후 합주 준비자를 위한 local-first 데스크톱 앱(Tauri + Vite + React) -- 곡 보기(song view): 섹션별·연주 역할별 추정 화성, 폼(form)/그루브(groove) 큐, 스템(stems), 연주 가능 음역(playable ranges), 단순화 가이드(simplification), 전조/카포/튜닝/셋업 큐, 파트 겹침(part-overlap) 경고, 가시적 신뢰도(confidence), 리허설 우선순위 -- 분석 대상 모델은 곡 전체 코드 트랙이 아니라 `song -> section -> role` 계층이며, role은 악기/보컬 기능/손(hand) 단위까지 확장될 수 있다 -- 자동 분석 결과는 편집 가능하고, model-generated vs user-confirmed provenance를 유지해야 한다 +`AGENTS.md`, `ARCHITECTURE.md`, and `docs/brand-story.md` define the shipped direction. The current repository is a local desktop system with these major layers: -아키텍처 개요: +- `apps/desktop`: React/Vite UI in a Tauri shell; +- `apps/desktop/src-tauri/src/main.rs`: typed native orchestration boundary; +- `apps/desktop/core`: Rust input and authority validation helpers; +- `packages/shared-types`: cross-layer contracts; +- `services/analysis-engine`: current Python orchestration and music-analysis modules; +- `services/analysis-engine/rust`: `bandscope_numeric` Rust/PyO3 numerical kernels. + +The protected snapshot already uses typed Tauri IPC and stdin/stdout JSON instead of an ordinary loopback web server for local analysis. The security posture treats files, URLs, project data, model artifacts, subprocesses, exports, and logs as trust boundaries. + +### 2.1 DDD context map ```mermaid flowchart LR - subgraph Desktop["apps/desktop (Tauri + Vite + React)"] - UI["React UI
features/workspace, player,
ranges, chords, score, settings"] - Shell["src-tauri/src/main.rs
9개 typed Tauri command"] - Core["core/src/lib.rs
URL/경로/프로젝트 페이로드
검증 헬퍼 (분석 연산 없음)"] - end - subgraph Engine["services/analysis-engine (Python)"] - CLI["cli.py / api.py
stdin/stdout JSON IPC"] - Mods["chords / sections / roles /
ranges / temporal / separation /
transcription / exports"] - Sep["separation/audio_separator.py
Demucs htdemucs (CPU)
bandsplit-v1.json 폴백"] - end - Rust["services/analysis-engine/rust
bandscope_numeric (PyO3/maturin)
checkerboard_novelty + viterbi_decode"] - Types["packages/shared-types
song-section-role 계약
confidence/provenance/cue/export"] - - UI -- "typed Tauri IPC" --> Shell - Shell --> Core - Shell -- "allowlisted subprocess
stdin/stdout JSON" --> CLI - CLI --> Mods - Mods --> Sep - Mods -. "Rust 커널 호출,
Python 참조 구현 폴백" .-> Rust - UI --- Types - Mods --- Types + User[Musician / band member] + UI[Rehearsal Workspace\nUI Context] + RI[Rehearsal Intelligence\nCore Domain] + Intake[Local Intake & Project\nSupporting Context] + Player[Playback & Transport\nSupporting Context] + Release[Distribution & Recovery\nSupporting Context] + Shared[Shared Contract Kernel\nminimal schemas only] + Ext[External codecs/models/tools\nAnti-Corruption Layer] + + User --> UI + UI --> Shared + Shared --> RI + Shared --> Intake + Shared --> Player + Intake --> Ext + RI --> Ext + Release --> UI ``` -핵심 구조적 사실(코드 확인 완료): - -- 로컬 오케스트레이션은 loopback HTTP가 아닌 typed Tauri IPC + stdin/stdout JSON 서브프로세스 방식이다 (`ARCHITECTURE.md`, `src-tauri/main.rs`) -- `apps/desktop/core`(Rust)는 분석 연산이 아니라 입력 검증(YouTube URL, project payload, score PDF source, 경로 가드) 담당이다 (`apps/desktop/core/src/lib.rs`) -- 무거운 수치 커널 중 checkerboard novelty와 Viterbi 디코딩만 `bandscope_numeric`(Rust/PyO3)으로 포팅되어 있고, 나머지는 Python/NumPy 참조 구현이며 `tests/test_numeric_parity.py`로 f64 parity를 잠근다 (`_native.py`) -- 스템 분리는 Demucs `htdemucs`를 CPU로 돌리고 플랫폼 게이트(demucs/torch 미설치 플랫폼은 불가)이며, 주파수 컷오프만 정의한 `bandsplit-v1.json` 휴리스틱 밴드스플릿 manifest가 별도로 존재한다 (`separation/audio_separator.py`, `separation/model_weights/bandsplit-v1.json`) -- 협업 타입(assignments/comments/approvals)은 `packages/shared-types`에 정의만 되어 있고 UI 참조가 전혀 없다 (grep 확인) +Core subdomain: **Rehearsal Intelligence**. Supporting subdomains: Local Intake & Project, Playback & Transport, Distribution & Recovery, and bounded Collaboration/Handoff. Generic concerns include logging, localization, accessibility primitives, and release metadata. -## 3. 기능 명세 및 요구사항 도출 (Functional Spec Derivation) +Shared Kernel must remain small: stable identifiers, section/role/cue/confidence/provenance contracts, and versioned interchange types. External codecs, Demucs/librosa-era dependencies, PDF tooling, and future accelerators stay behind Anti-Corruption Layers rather than leaking their types into product contracts. -제품 능력 -> 구현 위치 -> 성숙도 매핑. 성숙도: 구현됨 / 부분구현 / 미구현. +### 2.2 Ubiquitous language and aggregates -| 제품 능력 | 구현 위치 | 성숙도 | +| Term | Meaning | Transaction / invariant boundary | |---|---|---| -| 로컬 오디오 임포트(Rust 검증 + app-owned 루트) | `apps/desktop/src-tauri/src/main.rs`, `apps/desktop/core/src/lib.rs` | 구현됨 | -| YouTube 임포트(정책 제약, 실패 폴백) | `services/analysis-engine/src/bandscope_analysis/youtube.py` | 부분구현 (DRM/로그인 우회 없음, 실패 시 안내 카드는 PR 진행 중) | -| 스템 분리 | `separation/audio_separator.py` (htdemucs CPU), `bandsplit-v1.json` | 부분구현 (플랫폼 게이트, x86 macOS 미지원, GPU 없음) | -| 섹션 세그먼테이션(checkerboard novelty) | `sections/segmenter.py` + `bandscope_numeric::checkerboard_novelty` | 구현됨 | -| 섹션별 화성(HMM + Viterbi) | `chords/chord_recognizer.py`, `chords/section_harmony.py` | 구현됨 (hand-tuned prior 수준, 4장 참조) | -| 화성 기능 라벨/설명 | `chords/function_analyzer.py`, `RehearsalRole.harmonicExplanation?` | 부분구현 | -| 역할(role) 추출 및 역할별 조율 | `roles/extractor.py`, `roles/tuning.py` | 부분구현 (주파수 컷오프 휴리스틱 기반) | -| 음역/가압(range pressure) | `ranges/analyzer.py`, `ranges/pressure.py`, `ranges/pitch_tracker.py` | 구현됨 | -| 파트 겹침 경고 | `roles/overlap.py`, `RehearsalRole.overlapWarnings` | 구현됨 | -| 단순화 가이드 | `roles/priority.py` 연계, `RehearsalRole.simplification` 필드 | 구현됨 (문자열 필드 중심) | -| 전조/카포/튜닝 큐 | `chords/transposition.py`, `chords/capo.py`, `roles/tuning.py` | 구현됨 (계산), 워크스페이스 노출은 PR 진행 중 | -| 그루브/타이밍/히트 큐 | `temporal/groove.py`, `temporal/hits.py`, `temporal/stability.py` | 구현됨 | -| 진입/이탈/카운트/가사 큐 앵커 | `sections/anchors.py`, `CueAnchorKind = lyric\|count\|transition` | 부분구현 | -| 신뢰도 표시(section/role 수준) | `ConfidenceMarker(low/medium/high)` + `features/workspace/ConfidenceBadge.tsx` | 구현됨 | -| 리허설 우선순위 | `roles/priority.py`, `RehearsalPriority`, `PracticeProgress.tsx` | 구현됨 (규칙 기반 휴리스틱) | -| 수동 수정 + provenance | `ManualOverride[]`, `ProvenanceSource = model\|user` | 구현됨 | -| 내보내기(cue-sheet CSV, chart JSON) | `exports/chart.py`, `src/lib/export.ts` (filename sanitize, CSV escape) | 구현됨 | -| 악보(score) 보기 | `features/score/ScoreView.tsx`, `ScoreViewer.tsx`, `pdfjs.ts` | 부분구현 (PDF 뷰잉; PDF 바이트 검증은 PR 진행 중, 자동 채보 없음) | -| 루프 재생/역할별 재생 제어 | `features/player/index.tsx` | 미구현 (loop 미탐지, PR #903/#971 진행 중) | -| 협업(assignment/comment/approval) UI | `packages/shared-types` 타입만 존재 | 미구현 (UI 참조 0건; PR 시리즈가 첫 화면 진행 중) | -| pad/solo/riff/hook/fill/voicing/articulation/dynamics/tuning/capo/vamp 등 plan 필드 | 없음 (shared-types에 미존재) | 미구현 (PR 시리즈가 추가 예정) | -| 라이선싱/데모곡 first-run | 없음 | 미구현 (PR #1009, Issue #963/#964) | -| 자동 저장/crash-safe 프로젝트 포맷 | 없음 | 미구현 (Issue #961) | -| 서명/공증 배포+롤백 증적 | `.github/workflows/release.yml` 존재 | 부분구현 (Issue #960) | +| RehearsalProject | Durable local work for one rehearsal source | one project version; no partial publication | +| SongSection | Time-bounded structural region | valid ordered range inside admitted media duration | +| RehearsalRole | Instrument, vocal function, or role subdivision | role guidance belongs to a section/project and retains provenance | +| RehearsalCue | Actionable entry, stop, pickup, handoff, range, setup, or timing cue | time/section reference must remain resolvable | +| AnalysisEvidence | Versioned machine-produced estimate plus confidence/provenance | no silent promotion from estimate to user-confirmed truth | +| ManualOverride | User-confirmed correction | preserves original evidence and authoring provenance | +| RehearsalTransport | Playback/count-in/loop state | one authoritative state machine; no competing writers | -## 4. 현재 열린 PR 기반 Gap 분석 (Open-PR Gap Analysis) +Candidate domain events: `AnalysisCompleted`, `CueConfirmed`, `SectionBoundaryCorrected`, `LoopActivated`, `ProjectSnapshotPublished`, `ProjectRecovered`, and `UpdateRollbackCompleted`. -현재 open PR은 185건이다(`gh pr list --state open`, 2026-08-31 기준; 2026-08-25 130건 → 6일 만에 +55건). 대부분은 동일 패턴의 시리즈이며, `#1056`~`#1115+`의 `feat(workspace): name tonight's first … on the map` 체인이 새로 55건 이상 추가되었다(악상 기호 D.C./D.S./Coda/Segno/Fine, tacet, breath, tutti, leftover 파생 등). 이 기간 develop에 착지한 PR은 `#957`(2026-08-26) 1건뿐이므로 backlog는 순증하고 있다(§5(k) 참조). +## 3. Technical design contract (TRD) -시리즈 패턴: `feat(workspace): name tonight's first X on the map` — 워크스페이스 맵에 "오늘 밤 첫 X" next-action 카피를 올리고, Open 클릭 시 해당 섹션으로 이동. 각 PR은 role-owned plan 필드(예: `padPlan`)를 shared contract에 추가하고, own data-property descriptor 검증(Proxy `get` trap 방어), 한국어 조사 안전 카피(`패드`, `뱀프` 등), reduced-motion 처리, 그리고 강한 merge-gate 조항을 포함한다. +### 3.1 Rust ownership of computation -capability cluster 분류와 착지 후 남는 Gap: +Protected `develop` currently has a mixed implementation: `bandscope_numeric` owns checkerboard novelty and Viterbi decoding, while much of music DSP, feature extraction, prioritization, and analysis still executes in Python/NumPy. That is a product-technical gap under the current ecosystem directive. -| Cluster | 해당 PR (예시) | 착지가 의미하는 것 | 착지 후 남는 Gap | -|---|---|---|---| -| A. 역할별 연주 plan 필드 (pad/solo/riff/hook/fill/voicing/articulation/dynamics/tuning/capo/vamp) | #1020, #1013~#1018, #1021, #1024 | RehearsalRole 계약 확장과 첫 plan 노출. 데이터 생성기(engine)가 실제로 이 plan을 산출하는지와는 별개 | plan 값을 만들어내는 엔진 로직, plan 간 충돌/우선순위 정책, plan 편집 UX | -| B. 폼/섹션 네이밍 (intro/verse/pre-chorus/chorus/bridge/outro/tag/pickup/stop/handoff/entrance/dropout/lyric cue/transition/transition-cue/count) | #943, #947, #955, #939, #946, #986, #989, #916, #934, #937, #912, #914, #913, #994, #993, #995 | SECTION_FORM_LABELS와 CueAnchorKind가 이미 계약에 있으므로 주로 UI 노출 완성 | 앵커 정확도(가사/카운트 정렬), 사용자 직접 앵커 편집 | -| C. 화성 설명/확정/귀확인 (harmonic function/explanation/confirmed chord/ear check/setup note/transposition/part handoff/playable range/overlap/groove/simpler take/tempo-starting chord setup) | #1005, #1003, #1002, #1001, #1004, #1006, #1007, #957, #992, #991, #990, #987 | brand-story의 "추정 + 귀로 확인" 프레임을 UI 언어로 구체화 | confidence 산출 근거의 정량화, confirmed override의 재분석 반영(round trip, Issue #739) | -| D. 협업 최소면 (assignment/comment/approval/blocked/pending/open comment/export-priority actions/ready board) | #996, #997, #998, #1000, #900, #901 | shared-types의 collaboration 타입에 처음으로 UI가 붙음 | 동기화(syncMode local_only/planned_cloud), crash-safe 프로젝트 포맷(Issue #961), 권한 모델 | -| E. First-run/activation/실패 복구 (first-run card/license demo song/local intake 실패/import 실패/analysis 실패/save 실패/help) | #974, #1009, #981, #982, #976, #984, #972, #898 | 빈 상태/오류 상태의 next-action 카피 완성 | 라이선싱 백엔드, 데모곡 번들 정책, 오프라인 활성화 | -| F. 보안/신뢰경계 (log redaction x4, quick-xml RustSec, filesystem authority, canonical audio policy, CSV NUL/전각 우회 차단, credential drop, PDF bound reads, npm baseline) | #956, #951, #950, #949, #948, #858, #985/#781, #941, #894, #865, #783 | app-security.md 규칙의 코드 반영 마무리 | Issue #852(경계 재구축), #542(예외 추적), 모델 artifact checksum/signature 파이프라인 | -| G. 성능 (Bolt 시리즈: 관측 확률 벡터화, GrooveMap maxTime O(1), chart dedupe O(N), chord change count O(1), checkerboard/HMM 벡터화) | #999, #859, #849, #834, #746, #732 | 핫패스 최적화. Rust 커널 포팅과 같은 방향의 Python 측 보완 | Demucs GPU/offload, 대용량 파일 스트리밍, UI 가상화 | -| H. 접근성/디자인 시스템 (tooltip aria-disabled, icon tooltip, Storybook tokens, Figma drift check) | #833, #731, #897, #969 | WCAG 대응 시작점 | Issue #965(Figma/Storybook/shipped UI 정합 + WCAG 2.2 AA gate) 전체 | -| I. 테스트 현실성 (decoded WAV acceptance, known-take chord recovery, real YouTube known-stem benchmark, branch coverage) | #892, #891, #828, #861 | synthetic fixture에서 실오디오 기반 acceptance로 이동 시작 | Issue #770(실오디오 MIR accuracy benchmark) 체계화, RMSE/SI-SDR 임계값 정책 | -| J. 의존성/빌드 위생 (react, storybook, base-ui, lucide, sonner, codeql-action, setup-uv, uv group, numba, uuid, time, rust pinning, node floor, orphaned Actions identity) | #920, #942, #922, #921, #926, #927, #924, #931, #936, #919, #918, #754, #944, #896, #895 | 공급망/런타임 최신화 유지 | Dependabot train 정리(Issue #966), jsdom 30 전환 완료 | +Target contract: -시리즈 전체에 대한 종합 판단: 이 시리즈는 "계약(contract) 필드 추가 + 첫 노출" 단계다. 착지해도 (1) plan 값의 생성 로직, (2) plan들 사이 우선순위/중복 정책, (3) 재분석 시 override 보존 round-trip, (4) 협업 영속화는 여전히 Gap으로 남는다. 또한 130건이 develop 기준으로부터 장기간 분기되어 있어 rebase 비용과 exact-head CI 증적 요구(PR 본문 명시)로 인한 merge train 정체가 자체적으로 기술 위험이다(Issue #966). +- all repository-owned mathematical, vector, matrix, signal-processing, exploratory/data-science, ranking/weighting, and other core analysis computation is implemented in Rust; +- Python may remain an orchestration/API compatibility layer only where removal is not yet practical; +- CPU execution uses bounded multithreading without avoidable context switching; +- acceleration capabilities are explicit: CPU baseline first, then validated CUDA/OpenCL/MLX adapters where supported rather than silent fallback claims; +- Rust/Python parity tests are migration evidence, not permission to retain a permanent Python core; +- no heuristic weight or rule-of-thumb threshold is accepted without a documented measurement model, calibration dataset, or research basis. -## 5. 기술 Gap 목록 (Technical Gaps) +The migration order is determined by product impact and dependency edges: temporal/beat and harmony kernels → range/pitch and role features → prioritization/weighting → source-separation integration boundaries → remaining vector/matrix utilities. -문서 vs 코드 대조로 확인한 구체적 Gap. +### 3.2 Real-audio measurement contract -(a) **Rust compute layer 활용 범위** — 분석 핫패스 중 checkerboard novelty와 Viterbi decode만 Rust(`bandscope_numeric`)에 있다. 스템 분리(Demucs)는 Python/torch CPU 경로이고 GPU/CUDA/Metal 경로가 없으며, transcription은 에너지 마스크 휴리스틱(`transcription/api.py`)으로 ML 모델이 아니다. 데스크톱 단일 곡 처리 기준 CPU로도 실용적일 수 있으나, 긴 곡/다중 분석에서 병목이며 `docs/plans/2026-04-25-v2-transcription.md`가 v2 계획으로 존재한다. +Synthetic fixtures remain useful for unit tests but do not prove the rehearsal product. GA accuracy evidence must use licensed or redistribution-safe real audio with human-verified ground truth. -(b) **다층/계층·시간 모델링** — `song -> section -> role` 계약과 sections/roles/temporal 모듈은 존재하지만, role-level harmony는 `bandsplit-v1.json`의 고정 주파수 컷오프 휴리스틱에 의존한다. 학습된 multilevel 모델(예: role-conditioned chord/voicing 모델)과 section 경계의 temporal 일관성 학습은 없다. `docs/plans/2026-03-28-ml-engine-integration.md`가 관련 계획 문서다. +Required metrics are task-appropriate rather than collapsed into one score: -(c)**임의 가중치 vs 문헌 기반 값** — `chord_recognizer._build_transition_matrix()`는 `self_prob=0.8`, `related_prob=0.03`, uniform baseline `0.01/n` 등 hand-set 상수를 쓴다("Encodes musical priors" 주석). 방향성(fifth/fourth/relative/parallel)은 음악 이론에 근거하지만 수치는 문헌 교정(calibration)되어 있지 않다. `roles/priority.py`는 숫자 가중치 없는 if-then 규칙이다. PR #732(relative-key prior correction)처럼 사후 수정이 발생해왔다. 교정 방향: 주석 코퍼스(예: Burgoyne et al., 2011의 McGill Billboard)에서 전이 행렬을 최대우도로 추정하고, HMM prior 민감도(Logan & Chu, 2000; Pauwels & Peeters, 2013; Boulanger-Lewandowski et al., 2013 참조)와 tonal pitch space 거리 기반 스무딩(Harte, 2010)으로 현재 hand-set 값과의 코드 복원 RMSE/accuracy 차이를 정량 비교한 뒤, 우세한 값을 상수가 아닌 데이터 산출물로 고정한다. +- chord/harmony: Weighted Chord Symbol Recall or the benchmark metric defined by the chosen chord corpus; +- beat/timing: listener-annotated beat-location metrics compatible with the MIREX task contract; +- source separation: SI-SDR and task-appropriate perceptual/robustness evidence; +- range/pitch/transcription: reference-note or frame/event metrics declared with the corpus; +- section/cue boundaries: time-tolerant event metrics with the tolerance derived from annotation and rehearsal error cost, not an unexplained constant. -(d) **테스트 현실성** — `test_numeric_parity.py`(Rust-Python parity), `test_api.py` 등은 합성 입력 기반이고, tests 디렉터리에 .wav/.mp3 실오디오 fixture가 없다(find 확인). 실오디오 acceptance는 PR #892(decoded WAV C major), #891(known take verse/chorus recovery)이 열려 있고, 실 YouTube known-stem benchmark는 draft PR #828 + Issue #770 상태다. RMSE/SI-SDR 스타일 정량 임계값 acceptance gate는 아직 없다. +Acceptance is pre-registered per corpus before model tuning. A candidate must meet the declared non-inferiority/superiority criterion against the approved baseline with uncertainty reported (for example, bootstrap confidence intervals across tracks). A threshold must not be invented merely to make CI green. -(e) **커버리지/docstring 100%** — Python은 `--cov-fail-under=100` + Ruff D100-D107 docstring 100%가 gate로 작동한다(AGENTS.md, roadmap-completion 문서). JS workspace는 2026-08-25 실측에서 desktop(469 stmts/357 branches/105 funcs)과 shared-types(717 stmts/643 branches/59 funcs) 모두 statements/branches/functions/lines **실측 100%**를 유지한다. 그러나 gate threshold(`vite.config.ts`, `vitest.config.ts`)는 90으로 Python보다 낮아, 리그레션 시 90~99% 구간이 무단 통과될 수 있다. Gate 상향은 Backlog #10. +### 3.3 Persistence and concurrency contract -(f) **보안 체크리스트 잔여 항목** — 구현된 것: allowlisted stdin/stdout subprocess, Tauri CSP, path guards(#727 착지), CSV escape/sanitize, shell=False. 열린 것: canonical audio resource budget(#985 draft, Issue #781), filesystem path containment 재구축(Issue #852, #858 진행), native PDF read bounding(#865, #750), quick-xml RustSec 예외(#948, Issue #542), npm/PDF.js/nanoid/undici baseline(#783). 모델 artifact(Demucs checkpoint) checksum/signature 검증 파이프라인은 문서(app-security.md "Models") 요구 대비 미구현. +Issue #962 is the canonical owner for the versioned crash-safe project format, autosave, migration, backup, and recovery. Persistence must use one project authority, atomic publication, a known-good backup, bounded inputs, deterministic/idempotent migrations, and explicit locking or single-writer ownership. Any future relational store must use normalized schemas and durable keys; no database is introduced solely to satisfy an architectural fashion requirement. -(k) **운영 관측(2026-08-25 strix 공급자 장애)** — 중앙 Strix 게이트가 NVIDIA NIM 소진 시 최종 폴백 `openai-direct/gpt-5.4`를 NIM 엣지 API base로 라우팅해 `404 page not found`로 실패 닫기(fail-closed)하여 전 조직 PR 큐가 정체했다. 근본 원인 수정은 ContextualWisdomLab/.github#1324(openai-direct 폴백 전용 API base 라우팅 + 회귀 계약 테스트)로 추적했고, bandscope 의존성 CVE(pdfjs-dist CVE-2026-16633 등)는 canonical owner #783으로 일원화했다. 운영 교훈: required 스캐너의 공급자 장애는 repo 단위 우회가 아니라 중앙 게이트 계약 수정으로만 풀어야 한다. +### 3.4 Playback contract -(k2) **운영 관측(2026-08-31 merge train 정체 지속) — 현재 최우선 제품-기술 Gap** — 2026-08-31 기준 열린 PR 185건 중 확인한 표본(#1054·#1055·#1057·#1074·#1103·#1104) 전부에서 `ci / build-and-test`, cross-platform build, CodeQL/Semgrep/Bandit/Trivy/OSV, CodeRabbit, Devin 등 코드 게이트는 **통과**하나, 조직 소유 필수 리뷰 3종이 **일괄 실패 닫기**한다. +Issue #961 is the canonical owner for active rehearsal playback: precise loops, count-in, rate control, cue navigation, role controls, restoration, and accessible interaction. Timing-sensitive transport belongs in Rust. A real-time audio callback must not perform unbounded allocation, blocking I/O, network access, or lock-heavy work. -| 필수 체크 | 소스 | 실패 양상(표본) | 근본 원인(관측) | -|---|---|---|---| -| `opencode-review` | `ContextualWisdomLab/.github/.github/workflows/opencode-review.yml` | 수 초 내 fail. `opencode-review-target` 잡이 `api.opencode.ai`로 dispatch 후 현재 head SHA에 대한 `opencode-agent` verdict를 최대 90분 폴링하다 없으면 fail-closed | dispatch된 authenticated 리뷰가 exact-head APPROVED/CHANGES_REQUESTED 리뷰를 게시하지 못함(에이전트 미가동 또는 자격 미구성) | -| `strix` | `…/strix.yml` | 5–11분 후 fail | OpenCode app-token 교환/스캐너 실행이 공급자 키에 의존; §5(k) 계열 공급자 라우팅 장애의 연장선 | -| `noema-review` | `…/noema-review.yml` | 2–6분 후 fail | contextual-orchestrator 사이드카 + 공급자 키(BYTEZ/NVIDIA_NIM/OPENROUTER/OPENAI) 필요; `call_llm` HTTP 타임아웃(120s)이 조직 정책보다 짧아 verdict 미제출 | +### 3.5 Security and privacy contract -관측된 진행 중 조치(중복 금지, 관망 대상): `ContextualWisdomLab/.github`가 Noema 리뷰 신뢰성을 집중 수정 중 — 2026-08-31 반나절에 #1477·#1480·#1483·#1487·#1490·#1497·#1501·#1504 착지 + `fix(noema): remove fixed LLM response timeout`(#1415/#1511) 활성. `pr-review-merge-scheduler`는 분 단위 재실행, `bandscope-hourly-review-repair`는 시간별 대체로 success이나 backlog 미해소. 로컬 git 세션에서 이 필수 체크를 직접 통과시킬 방법은 없다(branch protection + 조직 자격). 로컬 레버리지는 (1) 코드가 원인인 PR의 실질 리뷰·수정 stack, (2) 본 baseline 최신화, (3) `codex/project-format-v1` 같은 stale/이름 충돌 로컬 브랜치 정리에 한정된다. +- Keep ordinary analysis local and network-independent. +- Treat selected files, metadata, URLs, project files, models, PDFs, subprocess output, and diagnostics as untrusted. +- Prefer narrow allowlisted commands/capabilities; no generic exec/read/write surface. +- Ordinary logs and support artifacts must not retain raw private audio, secrets, full local paths, or dependency-controlled exception payloads. +- Dependency/SBOM/provenance gates remain fail-closed; root-cause repair is preferred over ignore/suppression. +- Signing keys and release credentials never enter repository files or ordinary artifacts. -조치 상태: -- **미해결 / 상위 에스컬레이션 필요** — 필수 리뷰 3종 fail-closed로 인해 185건 전부 merge 불가. 소유: `ContextualWisdomLab/.github` (원격 에이전트가 noema 타임아웃 수정 중). bandscope 측 액션: 없음(계약 수정은 중앙에서만). §5(k) 교훈 재확인 — repo 단위 우회 금지. -- **부분 조치 (merge-ready 대기열 축적)** — 게이트가 열리는 즉시 착지할 수 있도록 코드 원인 PR을 `develop` 기준으로 정비: - - **PR #1116** — 본 baseline. stale `codex/project-format-v1`(자기 origin 대비 78 커밋 뒤처짐, PR #1073 이미 merged) 로컬 체크아웃에서 `develop` 기준 새 브랜치로 재분리. stale 로컬 브랜치는 삭제. - - **PR #1117** — `refactor(engine): promote temporal probe from cli hack to api integration`. `cli.py`의 "Temporary: Inject temporal analyzer … just to prove it works" probe를 `api._build_local_temporal_features()` 정식 통합으로 대체(§5(d)·§6(a) 방향, 임시/데모 코드의 production 반입 금지 원칙). stem 분리 불가 시에도 tempo/제목 큐 보존. `STEM_SEPARATION_TIMEOUT_SECONDS` 20→300s, Rust `ANALYSIS_PROCESS_TIMEOUT` 30→360s(기존 값은 실제 길이 곡에서 무조건 timeout). `ruff`/`ruff format`/`mypy src`/`pytest --cov-fail-under=100`(678 pass, 100%) 로컬 통과. +## 4. Product capability baseline -(g) **i18n/현지화** — `src/i18n` + `locales/en`, `locales/ko` 존재, 하드코딩 한국어 문자열 미탐지(workspace tsx grep 0건), interpolation hardening PR #744 진행. en/ko 2개 언어뿐이며, PR 시리즈가 추가할 다수의 카피 키가 locales에 아직 없다. +| Capability | Protected-snapshot status | Remaining buyer-visible gap | +|---|---|---| +| Local file intake | implemented boundary | finish resource budgets and cross-platform fault evidence | +| YouTube import | policy-constrained / partial | honest failure guidance; no DRM/login bypass | +| Section/role hierarchy | represented | prove real-audio accuracy and editing round trip | +| Harmony and chord guidance | implemented / mixed compute | calibrated evidence; Rust ownership; uncertainty quality | +| Groove/beat/timing cues | implemented / mixed compute | real-audio benchmark; Rust ownership; temporal integration | +| Range/overlap guidance | implemented | reference-audio validation and Rust migration | +| Stems/source separation | partial | platform/accelerator coverage, model artifact provenance, real-audio SI-SDR evidence | +| Confidence/provenance | represented | calibrate confidence and prove user correction round trip | +| Rehearsal action map | many open slices | consolidate repeated micro-PRs into coherent section/role UX | +| Active loop/player | incomplete | canonical Issue #961 | +| Crash-safe project/autosave | incomplete | canonical Issue #962 | +| Signed/notarized updater/rollback | partial | canonical Issue #960 | +| Redacted diagnostics/support bundle | incomplete | canonical Issue #963 | +| Licensed first-run demo | incomplete | canonical Issue #964 | +| WCAG/Figma/Storybook parity | incomplete | canonical Issue #965 | +| Merge-train/succession | incomplete | canonical Issue #966 | -(h) **접근성** — workspace 컴포넌트에 aria-* 속성 52건 존재. 그러나 WCAG 2.2 AA gate는 Issue #965로 열려 있고, Figma/Storybook/shipped UI 정합 점검도 미완이다. tooltip/a11y PR(#833, #731)이 진행 중. +## 5. Live PR queue and merge-loop evidence -(i) **Design token/Storybook** — shadcn/ui 프리미티브 중 stories는 button/checkbox/dialog 3개뿐이고, rehearsal 도메인 컴포넌트(GrooveMap, SectionRoadmap, RoleSwitcher 등) stories는 없다. Storybook token PR #897이 진행 중. +The live queue is volatile and therefore is not treated as a permanent product fact. At the 2026-09-01 10:31 KST capture, GitHub reported **190 open pull requests** for `ContextualWisdomLab/bandscope`. The previous 2026-08-31 snapshot in this branch reported 185. This file records the capture time and the verification command intentionally returns the *current* value on a later rerun. -(j) **패키징/릴리스 준비** — `CHANGELOG.md`, `VERSION`, `release.yml`, `build-baseline.yml` 존재. Windows/macOS amd64+arm64 build gate가 protected branch 요건이다(ARCHITECTURE.md). 남는 Gap: 서명/공증/자동 업데이트 롤백 증적(Issue #960), crash-safe project format/autosave/migration(Issue #961), redacted diagnostics/support bundle(Issue #962). +The queue is dominated by narrow `feat(workspace): name tonight's first … on the map` slices. Those changes can improve next-action copy, but backlog size itself is now a product-delivery risk: overlapping plan fields, copy keys, contracts, and workspace behavior should be consolidated into dependency-aware trains rather than allowed to grow as unbounded parallel micro-PRs. -## 6. UML 보완점 +### 5.1 Current required-check evidence, not inherited evidence -현재 docs 전역에서 Mermaid/sequence/class diagram이 하나도 존재하지 않는다(grep 확인). 아래 두 다이어그램이 최소 필수다. +Do not state that every open PR is blocked by the same cause. Required gates change over time and must be inspected on the exact current head. -### 6.1 import -> analyze -> workspace render happy path +Two current examples show why: -```mermaid -sequenceDiagram - actor U as User - participant UI as React UI - participant T as Tauri shell (main.rs) - participant C as core/lib.rs (validation) - participant P as Python engine (cli/api) - participant N as bandscope_numeric (Rust) - U->>UI: select local audio file - UI->>T: invoke intake command - T->>C: validate path/format/project id - C-->>T: validated reference (no copy) - T->>P: spawn allowlisted subprocess (stdin/stdout JSON) - P->>P: separate stems (Demucs CPU) / segment / chords - P->>N: checkerboard_novelty, viterbi_decode - N-->>P: kernels result (parity-guaranteed) - P-->>T: RehearsalSong JSON (schema-validated) - T-->>UI: jobResult event - UI->>UI: render Workspace/GrooveMap/Roles -``` +- **PR #956** (`fix(security): redact articulation failure logs`) had a predecessor Strix failure caused by central provider/API compatibility, not by its three-file privacy repair. The central fix `ContextualWisdomLab/.github#1350` (`f655a901…`, GPT-5.4 function-tool/reasoning contract) is an ancestor of current `.github/main@1186a9f4…` (245 commits ahead at capture). The PR was advanced normally, without force push, to tree-identical exact head `e46a7aa3121c902ebcf9ea9d256a199659a482df` solely to obtain fresh current-workflow evidence; repository workflows immediately re-queued. It still must not merge without terminal current-head required checks and qualifying independent approval. +- **PR #1117** (`refactor(engine): promote temporal probe from cli hack to api integration`) was open at exact head `b98f266d2356d56be624fb617580b5252e85baaa`. At capture, all nine repository workflow runs returned success (CI, release, Security Scan, security-audit, Semgrep, Bandit, secret scan, build baseline, SBOM), while the central `opencode-review` check was still `in_progress`. Pending evidence is not success and does not transfer to a later head. -### 6.2 untrusted-input trust boundaries +Operational invariant: central-gate faults are repaired in the owning central repository. Member repositories do not weaken required checks, self-approve, transfer predecessor evidence, or use administrative bypass to manufacture merge readiness. -```mermaid -flowchart TD - subgraph Untrusted["User Input Boundary (untrusted)"] - F[local audio file] - Y[YouTube URL + metadata] - D[drag-and-drop payload] - PF[imported project file] - MF[model artifacts] - end - subgraph Gates["validation gates"] - VF[path/format/id guard - core/lib.rs] - VY[scheme/host/path/query allowlist - youtube.py] - VP[payload schema validation - IPC] - VM[checksum/signature required - 미구현] - end - subgraph Trusted["Process Boundary"] - S[Tauri shell] - PY[Python engine] - RS[Rust kernels] - end - F --> VF --> S - Y --> VY --> PY - D --> VP --> S - PF --> VP --> S - MF -. "checksum/signature gate 없음" .-> VM - VM -.-> PY - S --> PY --> RS -``` +### 5.2 Baseline PR ownership -### 6.3 완전히 누락된 UML 산출물 +Two open PRs attempted to own this same file: #1025 (older, larger initial baseline) and #1116 (newer refresh). This branch is the canonical current owner because this replacement incorporates the unique product/TRD/UML/Rust/accuracy/security/accessibility/release requirements from #1025 while correcting the stale live-state and review findings on #1116. #1025 can therefore be closed as superseded only after this head exists and its unique requirements are preserved here; closure is bookkeeping, not deletion of evidence. -- 프로젝트 save/load/migration 흐름(crash-safe 포맷 설계 선행 다이어그램) -- manual override <-> 재분석 round-trip(provenance 보존) 시퀀스 -- export(cue-sheet/chart) 파이프라인과 sanitize 지점 다이어그램 -- state machine: analysis job(idle/running/done/failed) 상태 전이 -- class diagram: shared-types 도메인(song/section/role/confidence/provenance) 정식 클래스 뷰 +## 6. Prioritized gap backlog -## 7. 우선순위가 매겨진 Gap Backlog (Prioritized Gap Backlog) +Priority is buyer impact × dependency leverage × risk, not PR age. -구매자 체감 순서 기준. 각 항목에 acceptance criteria를 둔다. +### P0 — blocks trustworthy product completion -### P0 +1. **Restore sustainable exact-head merge throughput (Issue #966).** + - Acceptance: current-head required checks are terminal-success, independent non-author approval is current, unresolved actionable threads are zero, and duplicate/superseded slices are reconciled before merge. + - No bypass, self-approval, stale check transfer, or force push. +2. **Establish real-audio accuracy gates (Issue #770).** + - Acceptance: licensed real-audio corpora, human ground truth, task-specific metrics, preregistered statistical acceptance criteria, and reproducible exact-head artifacts. +3. **Migrate repository-owned core computation to Rust.** + - Acceptance: inventory of every math/DSP/vector/matrix/data-science call path; Rust ownership for each core operation; CPU multithread baseline; explicit accelerator adapters; parity and real-audio regression tests; Python orchestration contains no hidden numerical fallback accepted as production truth. +4. **Complete local resource admission and filesystem authority.** + - Acceptance: bounded file duration/size/allocation, cancellation, path containment, model/PDF bounds, and platform fault tests across the real production path. -1. **실오디오 정확도 acceptance gate (Issue #770, PR #828/#891/#892 수렴)** - - Why: brand-story의 Accuracy principle("easy to use does not mean accuracy can be loose")은 정량 근거 없이는 신뢰할 수 없다. - - Acceptance: 실오디오 fixture(최소 3곡, known stems)에 대해 chord recognition 정확도와 stem SI-SDR 임계값이 CI gate로 실행되고, 실패 시 merge가 차단된다. -2. **canonical audio resource budget 착지 (PR #985/#866, Issue #781)** - - Why: 대용량/악성 파일로 인한 메모리 폭주는 첫 사용 경험을 깬다. 보안 gate이자 안정성 gate다. - - Acceptance: 파일 크기/길이 상한이 intake에서 강제되고, 초과 입력은 안전 실패 카피로 거부된다. quickcheck 통과. -3. **필수 리뷰 게이트 fail-closed 해소 → merge train 재가동 (Issue #966, §5(k2)) — 현재 단일 최우선** - - Why: 185개 open PR 전부가 `opencode-review`/`strix`/`noema-review` 일괄 실패로 merge 불가하며, backlog는 6일간 +55건 순증했다. 다른 모든 P0/P1은 이 게이트가 열리기 전엔 착지할 수 없다. - - Acceptance: 세 필수 워크플로가 표본 PR에서 exact-head verdict로 통과하고(중앙 `ContextualWisdomLab/.github` 계약 수정: noema `call_llm` 타임아웃 정렬, opencode/strix 공급자 라우팅), 이후 dependency-aware train으로 open PR이 cluster A-J 단위 수렴하며 중복 PR이 canonical PR로 link된다. repo 단위 우회(필수 체크 완화·삭제)는 금지(§5(k) 교훈). -4. **filesystem path containment 재구축 (Issue #852, PR #858)** - - Why: 로컬 데스크톱 앱의 최상위 신뢰경계. 우회 시 임의 파일 접근으로 이어진다. - - Acceptance: 모든 파일 접근이 authority 객체로 바인딩되고 traversal 테스트가 gate에 포함된다. +### P1 — closes the rehearsal loop -### P1 +5. **Active rehearsal player (Issue #961).** Precise loop/count-in/role control with Rust transport and accessibility equivalence. +6. **Crash-safe project source of truth (Issue #962).** Atomic save/autosave, migration, backup, recovery, locking, and versioned fixtures. +7. **Trusted desktop distribution (Issue #960).** Windows signing, macOS signing/notarization, updater signatures, SBOM/provenance, staged rollout, and rollback evidence. +8. **Private supportability (Issue #963).** Typed diagnostics and user-previewable offline support bundle without raw song/path leakage. +9. **Licensed first-run rehearsal (Issue #964).** Demonstrate install → first useful rehearsal without developer setup. +10. **WCAG 2.2 AA + Figma/Storybook/shipped parity (Issue #965).** Keyboard, focus, target-size, alternatives for visual timelines/charts, i18n semantic parity, design-token ownership, and representative edge-case stories. -5. **plan 필드 시리즈의 엔진 생성 로직 + 우선순위 정책 (Cluster A/C 착지 후속)** - - Acceptance: 각 plan(padPlan 등)이 engine이 실제 산출하는 값과 UI 노출로 연결되고, 다중 plan 충돌 시 표시 우선순위가 문서화되며, override 시 provenance가 보존된다. -6. **루프 재생/역할별 재생 제어 (Issue #960, PR #903/#971)** - - Acceptance: 임의 섹션을 role 필터와 함께 loop 재생할 수 있고, reduced-motion/키보드 조작이 동작한다. -7. **crash-safe project format + autosave (Issue #961)** - - Acceptance: 버전 필드를 가진 프로젝트 포맷, 저장 실패 시 known-good 보존(PRx #970 방향), migration 테스트. -8. **Demucs 플랫폼 커버리지 + 모델 artifact 검증** - - Acceptance: x86 macOS 폴백 경로가 명시되고(현재 demucs 미설치 시 불가), 모델 checkpoint checksum 검증이 intake pipeline에 있다. -9. **WCAG 2.2 AA gate (Issue #965) + rehearsal 컴포넌트 Storybook tokens (PR #897)** - - Acceptance: axe 기반 자동 점검이 CI에 있고, GrooveMap/SectionRoadmap/RoleSwitcher stories가 token 기반으로 존재한다. -10. **JS coverage 90% -> 100% 상향 또는 Python과 동일한 기준 명문화** - - Acceptance: vite.config/vitest thresholds 상향 또는 "Python 100%, JS 90%" 정책이 acceptance-criteria.md에 명시된다. +### P2 — improves scale and analytical depth after the core loop is reliable -### P2 +11. Consolidate plan-field micro-PRs into coherent engine-generated role guidance with conflict/priority rules and edit provenance. +12. Replace hand-tuned/untraceable weights and priors with documented literature/calibration evidence and sensitivity tests. +13. Expand section/role/temporal modeling where multilevel or time-dependent evidence materially improves rehearsal decisions; avoid atomistic aggregation that erases section/role structure. +14. Harden model artifact provenance and accelerator reproducibility across CPU/CUDA/OpenCL/MLX-supported paths. +15. Expand collaboration only behind a clear local-first buyer outcome and stable project/handoff contracts. -11. **HMM transition prior 문헌 교정 (5장 (c))** - - Acceptance: transition 행렬 상수의 출처(문헌 or 교정 데이터)가 주석/ADR로 기록되고, sensitivity test가 존재한다. -12. **v2 transcription (docs/plans/2026-04-25-v2-transcription.md) 착지** - - Acceptance: 에너지 휴리스틱 대체 모델이 parity/perf gate를 통과한다. -13. **협업 동기화(local_only -> planned_cloud) 설계 문서화** - - Acceptance: syncMode 전환 시 데이터 흐름/권한 모델이 TRD로 문서화된다(네트워크 정책 준수). -14. **i18n 확장 전략(en/ko 외) 및 PR 시리즈 카피 키 일괄 정리** - - Acceptance: 신규 카피가 locales에 key로 존재하고 particle-safe 한국어 규칙이 lint/check로 검증된다. -15. **redacted diagnostics/support bundle (Issue #962, PR #967)** - - Acceptance: 로그에 raw audio/full URL 미포함이 자동 점검으로 확인된다. +## 7. Quality, test, UX, and operability baseline -## 8. APA 7th 참고문헌 (References) +### Coverage and documentation -본 문서에서 실제 인용한 개념(MIR novelty kernel, HMM/Viterbi 디코딩, 소스 분리 평가, librosa, 접근성 표준)에 한정한다. +- Python production coverage/docstring gates are already described as 100% in repository guidance. +- Protected `develop` still configures JavaScript coverage thresholds at 90% in both `apps/desktop/vite.config.ts` and `packages/shared-types/vitest.config.ts`; this is a gap against the current 100% statement/branch/edge-case target. +- The target is **100% test coverage, 100% branch/edge-case coverage, and 100% public/repository-owned API docstring/documentation coverage** for changed production surfaces. A passing threshold below that target is not equivalent evidence. -Boulanger-Lewandowski, N., Bengio, Y., & Vincent, P. (2013). Audio chord recognition with recurrent neural networks. In Proceedings of the 14th International Society for Music Information Retrieval Conference (ISMIR 2013) (pp. 335–340). ISMIR. +### Realistic test cases -Burgoyne, J. A., Wild, J., & Fujinaga, I. (2011). An expert ground truth set for audio chord recognition and music analysis. In Proceedings of the 12th International Society for Music Information Retrieval Conference (ISMIR 2011) (pp. 633–638). ISMIR. +At minimum, exercise 44.1/48/96 kHz where supported, mono/stereo, short and long recordings, pickup before bar one, odd meter, tempo change, silence near boundaries, unsupported codec, moved/replaced files, device changes, cancellation, disk full, corrupted project state, migration interruption, source-separation unavailable, and uncertainty correction round trips. -Défossez, A., Usunier, N., Bottou, L., & Bach, F. (2019). Music source separation in the waveform domain. arXiv. https://arxiv.org/abs/1911.13254 +### Accessibility and UI validation -Harte, C. (2010). Towards automatic extraction of harmony information from music signals (Doctoral dissertation, Queen Mary University of London). +`docs/doctoring/high-security-pdf-http-baseline.md` and `docs/doctoring/npm-lockfile-generator-provenance.md` already contain Mermaid diagrams, so a repository-wide “no diagrams exist” claim is false. What remains missing is a maintained product-level DDD/context map, core sequence/state views, Storybook inventory for rehearsal-domain components, and screenshot-backed accessibility/responsive audits of shipped UI. -Logan, B., & Chu, S. (2000). Music summary using hidden Markov models. In IEEE International Conference on Acoustics, Speech, and Signal Processing (ICASSP 2000) (Vol. 6, pp. 3673–3676). IEEE. +For visual controls, exact-value and non-drag alternatives are required when a waveform, range, timeline, or chart is interactive. UI copy should tell the musician what to do next and must not expose internal module/repository boundaries. -Pauwels, J., & Peeters, G. (2013). Combining harmony-based and melody-based chroma features for chord recognition. In Proceedings of the 14th International Society for Music Information Retrieval Conference (ISMIR 2013) (pp. 597–602). ISMIR. +### Release/operability -Foote, J. (1999). Visualizing music and audio using self-similarity. In Proceedings of the Seventh ACM International Conference on Multimedia (Multimedia '99) (pp. 77–80). ACM. +A development artifact is not GA evidence. GA requires protected-source identity, reproducible build evidence, checksums, SPDX SBOM/provenance, supported architecture matrix, signatures, macOS notarization, verified update manifest, offline startup, and tested repair/rollback. -Le Roux, J., Wisdom, S., Erdogan, H., & Hershey, J. R. (2019). SDR – half-baked or well done? In IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP 2019) (pp. 626–630). IEEE. +## 8. UML / sequence supplements -McFee, B., Raffel, C., Liang, D., Ellis, D. P. W., McVicar, M., Battenberg, E., & Nieto, O. (2015). librosa: Audio and music signal analysis in Python. In Proceedings of the 14th Python in Science Conference (SciPy 2015) (pp. 18–24). +### 8.1 Import → analyze → rehearsal view -Müller, M. (2015). Fundamentals of music processing: Audio, analysis, algorithms, applications. Springer. +```mermaid +sequenceDiagram + actor U as User + participant UI as React workspace + participant T as Tauri shell + participant V as Rust validation/authority + participant O as Analysis orchestration + participant R as Rust analysis core + + U->>UI: Choose local audio + UI->>T: typed intake command + T->>V: validate path, project and resource authority + V-->>T: admitted source reference + T->>O: start bounded analysis job + O->>R: compute section/role/temporal evidence + R-->>O: versioned evidence + confidence + O-->>T: progress / completed result + T-->>UI: analysis-job-updated + UI-->>U: rehearsal actions + uncertainty + edit path +``` -Viterbi, A. J. (1967). Error bounds for convolutional codes and an asymptotically optimum decoding algorithm. IEEE Transactions on Information Theory, 13(2), 260–269. +### 8.2 Project state machine -W3C. (2023). Web Content Accessibility Guidelines (WCAG) 2.2. World Wide Web Consortium. https://www.w3.org/TR/WCAG22/ +```mermaid +stateDiagram-v2 + [*] --> Clean + Clean --> Dirty: accepted mutation + Dirty --> Staging: autosave/manual save + Staging --> Published: validate + atomic replace + Staging --> Dirty: failure, keep known-good + Published --> Dirty: next mutation + Published --> RecoveryAvailable: unclean shutdown/newer recovery evidence + RecoveryAvailable --> Published: restore validated snapshot + RecoveryAvailable --> Clean: discard recovery evidence +``` + +## 9. Research and standards traceability + +The baseline uses standards as evaluation structures, not as decoration: + +- ISO/IEC 25010:2023 supplies the current product-quality model for specifying and evaluating software quality characteristics. +- NIST SP 800-218 SSDF v1.1 supplies outcome-oriented secure-development practices, including provenance and tracked security requirements/design decisions. +- WCAG 2.2 is the current W3C Recommendation baseline used for the desktop webview UI accessibility contract. +- MIREX task definitions provide domain-relevant evaluation precedent using real audio and human/listener annotation; the 2025 beat-tracking task explicitly evaluates predicted beat locations against listener-annotated recordings. +- MIR literature remains task-specific: Foote for self-similarity novelty, Viterbi for decoding, Le Roux et al. for SI-SDR, and established chord corpora/metrics for harmony evaluation. These references do not justify unrelated hand-tuned transition priors or product weights. + +### References (APA 7th) + +International Organization for Standardization, & International Electrotechnical Commission. (2023). *ISO/IEC 25010:2023 Systems and software engineering—Systems and software Quality Requirements and Evaluation (SQuaRE)—Product quality model* (2nd ed.). ISO. + +Foote, J. (1999). Visualizing music and audio using self-similarity. In *Proceedings of the Seventh ACM International Conference on Multimedia* (pp. 77–80). Association for Computing Machinery. + +Le Roux, J., Wisdom, S., Erdogan, H., & Hershey, J. R. (2019). SDR—Half-baked or well done? In *2019 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)* (pp. 626–630). IEEE. + +Music Information Retrieval Evaluation eXchange. (2025). *Audio beat tracking*. MIREX Wiki. https://music-ir.org/mirex/wiki/2025:Audio_Beat_Tracking + +Souppaya, M., Scarfone, K., & Dodson, D. (2022). *Secure Software Development Framework (SSDF) Version 1.1: Recommendations for mitigating the risk of software vulnerabilities* (NIST Special Publication 800-218). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-218 -참고: 위 항목 중 DOI가 확실치 않은 항목은 DOI 없이 plain APA로 기술했다(조작 금지 원칙). 코드 내 개념 대응: Foote(1999)=checkerboard novelty, Viterbi(1967)/Boulanger-Lewandowski et al.(2013)=HMM 코드 디코딩 prior, Défossez et al.(2019)=Demucs htdemucs, Le Roux et al.(2019)=SI-SDR(audio_separator.py 주석 언급), Müller(2015)/McFee et al.(2015)=섹션/코드/음역 분석 기반 라이브러리. +Viterbi, A. J. (1967). Error bounds for convolutional codes and an asymptotically optimum decoding algorithm. *IEEE Transactions on Information Theory, 13*(2), 260–269. -## 9. 검증 방법 (Verification Method) +World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines (WCAG) 2.2*. https://www.w3.org/TR/WCAG22/ -각 절의 근거와 재실행 명령. +## 10. Re-runnable verification + +Run from repository root. These commands intentionally distinguish immutable protected-source evidence from volatile live GitHub state. + +```bash +# Protected source identity +git rev-parse --show-toplevel +git rev-parse develop + +# Current open-PR count; snapshot in this document was 190 at 2026-09-01 10:31 KST. +gh pr list --state open --limit 500 --json number --jq 'length' + +# Current head and live gate state for a PR; never reuse a predecessor result. +gh pr view 956 --json number,state,isDraft,headRefOid,baseRefOid,reviews,statusCheckRollup +gh pr view 1117 --json number,state,isDraft,headRefOid,baseRefOid,reviews,statusCheckRollup + +# Confirm product-level and doctoring Mermaid inventory. +git grep -n '```mermaid' -- docs ARCHITECTURE.md + +# Verify current JS threshold policy gap. +git grep -n 'lines: 90' -- apps/desktop/vite.config.ts packages/shared-types/vitest.config.ts + +# Verify the two current Rust numerical entry points and locate remaining Python core modules. +git grep -n 'checkerboard_novelty\|viterbi_decode' -- services/analysis-engine/rust services/analysis-engine/src +find services/analysis-engine/src/bandscope_analysis -type f -name '*.py' -print + +# Real-audio fixture inventory; absence/presence is determined by file search, not Python-file grep. +find . -type f \( -path '*/tests/*' -o -path '*/test/*' \) \ + \( -iname '*.wav' -o -iname '*.flac' -o -iname '*.mp3' \) -not -path './.git/*' -print +``` -- Repo root: `git rev-parse --show-toplevel` -> `/Users/seonghobae/bandscope` -- 문서 소스 read: `ARCHITECTURE.md`, `AGENTS.md`, `docs/brand-story.md`, `docs/security/app-security.md`, `docs/workflow/one-day-delivery-plan.md`, `docs/engineering/acceptance-criteria.md`, `docs/plans/2026-03-27-bandscope-roadmap-completion.md` -- Open PR inventory: - ```bash - gh pr list --state open --limit 200 --json number,title,isDraft,headRefName \ - --jq 'sort_by(-.number) | .[] | "\(.number)\t\(.isDraft)\t\(.title)"' > /tmp/opencode/open_prs_full.txt - wc -l /tmp/opencode/open_prs_full.txt # 130 - gh pr view 1021 --json title,body # 시리즈 패턴 샘플 - ``` -- Open issues: `gh issue list --state open --limit 50 --json number,title --jq '.[]|"\(.number)\t\(.title)"'` -- 코드 검증 grep/glob (요지): - - `grep -rn "padPlan\|PadPlan" apps/desktop/src packages/shared-types/src` -> 0건(시리즈 미착지 확인) - - `find services/analysis-engine -name "*.py"` -> 모듈 목록(chords/sections/roles/ranges/temporal/separation/transcription/youtube/exports) - - `sed -n '70,110p' .../chords/chord_recognizer.py` -> hand-set transition prior 확인 - - `sed -n '1,40p' .../_native.py` -> bandscope_numeric 커널/parity 확인 - - `ls services/analysis-engine/rust` + `grep maturin rust/pyproject.toml` -> Rust 커널 위치 확인 - - `head -30 separation/model_weights/bandsplit-v1.json` -> 휴리스틱 manifest 확인 - - `grep -rn "aria-" apps/desktop/src/features/workspace/*.tsx | wc -l` -> 52 - - `grep -rln "RehearsalAssignment\|RehearsalCollaboration" apps/desktop/src` -> 0건(UI 미구현 확인) - - `grep -rn "loop" apps/desktop/src/features/player/index.tsx` -> 0건(loop 미구현 확인) - - `ls CHANGELOG.md VERSION .github/workflows` -> 릴리스 자산 확인 - - `grep -n thresholds apps/desktop/vite.config.ts packages/shared-types/vitest.config.ts` -> JS 90% 확인 - - `grep -n "cov-fail-under" AGENTS.md docs` -> Python 100% gate 확인 - - Mermaid 존재 여부: `grep -rln "sequenceDiagram\|classDiagram\|flowchart" docs ARCHITECTURE.md` -> 0건(6장 전제 확인) +GitHub live-state claims in this document are capture-time evidence. Any merge decision must re-fetch the exact current head, required checks, review decision, unresolved threads, ancestry/dependency order, and writer state immediately before action. From 1f7800b7c73a2ec1bd951df85151f9e43675c64b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 10:46:29 +0900 Subject: [PATCH 04/80] docs(doctoring): record gap-baseline evidence and central gate RCA --- .../product-gap-baseline-2026-09-01.md | 53 +++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 docs/doctoring/product-gap-baseline-2026-09-01.md diff --git a/docs/doctoring/product-gap-baseline-2026-09-01.md b/docs/doctoring/product-gap-baseline-2026-09-01.md new file mode 100644 index 000000000..5277819a2 --- /dev/null +++ b/docs/doctoring/product-gap-baseline-2026-09-01.md @@ -0,0 +1,53 @@ +# Product Gap Baseline Doctoring — 2026-09-01 + +## Purpose + +This note records why `docs/product-technical-gap-baseline.md` was replaced on PR #1116 instead of layering another stale queue snapshot over it. + +## Repository evidence + +Protected source at capture: `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. + +Observed live queue at 2026-09-01 10:31 KST: 190 open pull requests in `ContextualWisdomLab/bandscope`. The older branch text said 185, and its verification block still printed 130; that evidence could not reproduce the document claim. + +Review findings on PR #1116 were validated as real: + +1. the open-PR evidence was stale; +2. the repository-wide Mermaid absence claim was false because protected `develop` already contains Mermaid in `docs/doctoring/high-security-pdf-http-baseline.md` and `docs/doctoring/npm-lockfile-generator-provenance.md`; +3. playback and crash-safe project work were mapped to stale issue numbers — canonical owners are #961 and #962 respectively, while #960 owns signed/notarized release/update/rollback; +4. live Noema/PR claims needed independent GitHub verification rather than prose inheritance. + +The replacement baseline therefore separates protected-source facts from timestamped GitHub observations and uses exact current-head examples instead of asserting one blocker for the entire queue. + +## Current review-gate RCA example + +PR #956 had a predecessor exact-head Strix failure unrelated to its articulation privacy code. The failing central workflow exhausted the NVIDIA primary, encountered an EOL NVIDIA fallback, then used GPT-5.4 through `/v1/chat/completions` with function tools plus non-none reasoning effort; that combination was rejected by the provider contract. `ContextualWisdomLab/.github#1350` fixed the GPT-5.4 tool/reasoning contract in commit `f655a901f7ccdfef0d62694c818ad2896a2f5da1`. + +Current `.github/main@1186a9f4e5eda7683b23ae63d2c806831743432a` is 245 commits ahead of that fix and has it as the merge base. To obtain fresh evidence without altering production content, PR #956 was advanced by a normal non-force commit to `e46a7aa3121c902ebcf9ea9d256a199659a482df` using the identical tree `6d777d7fec8b35de23f8d77f1b22e158828f0288`; repository workflows then re-queued. No stale check was promoted to current evidence. + +PR #1117 independently demonstrates that the queue is not accurately described by “all code checks fail”: exact head `b98f266d2356d56be624fb617580b5252e85baaa` had successful repository CI/release/security/SBOM workflows at capture while `opencode-review` remained in progress. Pending is still non-passing, but its cause and state differ from the older blanket claim. + +## Research / standards review + +The baseline was checked against current authoritative sources on 2026-09-01: + +- ISO/IEC 25010:2023 defines the current SQuaRE product-quality model and explicitly supports requirements, design objectives, testing objectives, acceptance criteria, and product-quality evaluation. +- NIST SP 800-218 SSDF v1.1 remains the current NIST SSDF baseline and emphasizes tracked security requirements/design decisions, provenance, and root-cause-oriented secure development. +- WCAG 2.2 remains a W3C Recommendation and adds criteria including focus visibility, dragging alternatives, target size, consistent help, redundant entry, and accessible authentication. +- MIREX 2025 Audio Beat Tracking evaluates predicted beat locations against listener-annotated real recordings, supporting the decision to require real-audio timing evidence rather than synthetic-only unit fixtures. + +### APA 7th references + +International Organization for Standardization, & International Electrotechnical Commission. (2023). *ISO/IEC 25010:2023 Systems and software engineering—Systems and software Quality Requirements and Evaluation (SQuaRE)—Product quality model* (2nd ed.). ISO. + +Music Information Retrieval Evaluation eXchange. (2025). *Audio beat tracking*. MIREX Wiki. https://music-ir.org/mirex/wiki/2025:Audio_Beat_Tracking + +Souppaya, M., Scarfone, K., & Dodson, D. (2022). *Secure Software Development Framework (SSDF) Version 1.1: Recommendations for mitigating the risk of software vulnerabilities* (NIST Special Publication 800-218). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-218 + +World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines (WCAG) 2.2*. https://www.w3.org/TR/WCAG22/ + +## Decision + +PR #1116 is the canonical current baseline owner. PR #1025 is an older competing owner of the same path; its unique requirements (PRD/TRD/UML, Rust migration, real-audio accuracy, security, accessibility, release evidence, and reproducible verification) were deliberately carried into the #1116 replacement. Once this current head is present, #1025 can be closed as superseded without deleting its discussion history. + +Future hourly loops should refresh live counts/evidence only when they materially change prioritization. They must not rewrite immutable product and architecture sections merely to chase a volatile PR number. From 724bddcc543ab4ddc7960ade75cce967d7d54133 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 13:20:05 +0900 Subject: [PATCH 05/80] docs(gap): refresh 71-repo backlog evidence --- docs/product-technical-gap-baseline.md | 394 +++++++++++++------------ 1 file changed, 201 insertions(+), 193 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index d14f5202a..66aab4c9c 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,269 +1,281 @@ # BandScope Product-Technical Gap Baseline Last updated: 2026-09-01 -Evidence capture: 2026-09-01 10:31 KST unless a row says otherwise +Evidence capture: 2026-09-01 13:00 KST unless a row says otherwise Protected base: `develop@749511c3ad4000090048718f685c6bee6b3d2c25` -## 1. Purpose and product outcome +## 1. Purpose and buyer outcome -This is the engineering evidence baseline for BandScope. Customer-facing copy must continue to follow `docs/brand-story.md`: practical, rehearsal-first, non-authoritative, and explicit about uncertainty. This document is intentionally denser because its job is to connect product promises, implementation boundaries, tests, research, security controls, and the live PR queue without exposing those internals in the product UI. +This document is the current engineering evidence baseline for BandScope. Customer-facing behavior follows `docs/brand-story.md`: practical, rehearsal-first, non-authoritative, and explicit about uncertainty. This file connects buyer promises to implementation boundaries, tests, research, security controls, and live GitHub evidence; those internals must not leak into product copy. -BandScope is a local-first rehearsal companion for people who need to understand a song quickly and spend rehearsal time playing rather than decoding the arrangement. The buyer outcome is: +BandScope is a local-first rehearsal companion for working musicians and band hobbyists who need to understand a song quickly and spend rehearsal time playing rather than decoding an arrangement. ```text -install a trusted build -→ import a real song -→ get evidence-backed section/role analysis -→ see uncertainty and correct it -→ rehearse a passage with precise transport -→ save/recover the project +trusted install +→ admit a real song safely +→ derive evidence-backed section/role guidance +→ expose uncertainty and allow correction +→ rehearse a precise passage +→ save/recover accepted work → share a bounded handoff → update or roll back safely ``` -The product is not a DAW, notation editor, mandatory cloud service, or authority that claims one analysis is unquestionably correct. +BandScope is not a DAW, notation editor, mandatory cloud service, or an authority that claims one analysis is unquestionably correct. -### Buyer-facing PRD +### 1.1 Buyer-facing PRD -Primary users are working musicians and band hobbyists preparing after work. The core jobs are: +Core jobs: -1. identify what each player or vocal role should prepare; -2. understand form, entry/dropout, timing, harmony, range, overlap, and setup cues by section; -3. repeat a difficult passage without rebuilding a loop in another tool; -4. correct uncertain analysis and retain provenance of the correction; +1. identify what each instrument/vocal role should prepare; +2. understand form, entries/dropouts, timing, harmony, range, overlap, handoffs, and setup cues by section; +3. rehearse the highest-value passage without rebuilding transport in another tool; +4. correct uncertain analysis while retaining model/user provenance; 5. return later without losing accepted work; -6. install and update a build whose identity and provenance can be verified. +6. install/update a build whose identity and provenance can be verified. Representative user stories: - As a player, I can open a local song and see the first useful rehearsal action without learning a DAW. -- As a band member, I can distinguish section-level and role-level guidance instead of receiving one flat chord track. -- As a user, I can see when BandScope is uncertain and correct the result without losing the original model provenance. -- As a player, I can select a cue or section, count in, loop it, slow it down when supported, and keep role controls accessible from keyboard and assistive technology. -- As a returning user, I can recover the last known-good project after a crash, interrupted write, schema migration, or failed update. +- As a band member, I can see section×role guidance rather than a single flat song-wide chord track. +- As a user, I can distinguish machine evidence from user-confirmed correction. +- As a player, I can count in, loop, navigate cues, and use the same controls from keyboard and assistive technology. +- As a returning user, I can recover the last known-good project after a crash, interrupted write, migration, or failed update. ## 2. Current architecture and responsibility boundaries -`AGENTS.md`, `ARCHITECTURE.md`, and `docs/brand-story.md` define the shipped direction. The current repository is a local desktop system with these major layers: +Protected `develop` remains a local desktop architecture: -- `apps/desktop`: React/Vite UI in a Tauri shell; -- `apps/desktop/src-tauri/src/main.rs`: typed native orchestration boundary; -- `apps/desktop/core`: Rust input and authority validation helpers; -- `packages/shared-types`: cross-layer contracts; -- `services/analysis-engine`: current Python orchestration and music-analysis modules; +- `apps/desktop`: React/Vite rehearsal workspace in a Tauri shell; +- `apps/desktop/src-tauri`: native command/orchestration boundary; +- `apps/desktop/core`: Rust authority/input validation helpers; +- `packages/shared-types`: versioned cross-layer contracts; +- `services/analysis-engine`: current Python orchestration plus still-mixed music-analysis code; - `services/analysis-engine/rust`: `bandscope_numeric` Rust/PyO3 numerical kernels. -The protected snapshot already uses typed Tauri IPC and stdin/stdout JSON instead of an ordinary loopback web server for local analysis. The security posture treats files, URLs, project data, model artifacts, subprocesses, exports, and logs as trust boundaries. +Typed Tauri IPC and bounded stdin/stdout JSON are the local orchestration path; ordinary local analysis does not require a loopback HTTP server or cloud service. Files, URLs, project data, model artifacts, PDFs, subprocess output, exports, and diagnostics are untrusted at their owning boundaries. ### 2.1 DDD context map ```mermaid flowchart LR - User[Musician / band member] + U[Musician / band member] UI[Rehearsal Workspace\nUI Context] RI[Rehearsal Intelligence\nCore Domain] - Intake[Local Intake & Project\nSupporting Context] - Player[Playback & Transport\nSupporting Context] - Release[Distribution & Recovery\nSupporting Context] - Shared[Shared Contract Kernel\nminimal schemas only] - Ext[External codecs/models/tools\nAnti-Corruption Layer] - - User --> UI - UI --> Shared - Shared --> RI - Shared --> Intake - Shared --> Player - Intake --> Ext - RI --> Ext - Release --> UI + IN[Local Intake & Project\nSupporting Context] + PT[Playback & Transport\nSupporting Context] + RH[Release & Recovery\nSupporting Context] + CO[Collaboration / Handoff\nSupporting Context] + SK[Minimal Shared Contract Kernel] + ACL[External codecs / models / tools\nAnti-Corruption Layer] + + U --> UI + UI --> SK + SK --> RI + SK --> IN + SK --> PT + SK --> CO + IN --> ACL + RI --> ACL + RH --> UI ``` -Core subdomain: **Rehearsal Intelligence**. Supporting subdomains: Local Intake & Project, Playback & Transport, Distribution & Recovery, and bounded Collaboration/Handoff. Generic concerns include logging, localization, accessibility primitives, and release metadata. +Core subdomain: **Rehearsal Intelligence**. Supporting subdomains: Local Intake & Project, Playback & Transport, Release & Recovery, and bounded Collaboration/Handoff. Generic concerns: logging, localization, accessibility primitives, release metadata, and supply-chain evidence. -Shared Kernel must remain small: stable identifiers, section/role/cue/confidence/provenance contracts, and versioned interchange types. External codecs, Demucs/librosa-era dependencies, PDF tooling, and future accelerators stay behind Anti-Corruption Layers rather than leaking their types into product contracts. +Shared Kernel stays intentionally small: stable identifiers plus section/role/cue/confidence/provenance and versioned interchange contracts. Codec, Demucs/librosa-era, PDF, platform, and accelerator types remain behind Anti-Corruption Layers. -### 2.2 Ubiquitous language and aggregates +### 2.2 Ubiquitous language, aggregates, invariants, events -| Term | Meaning | Transaction / invariant boundary | +| Term | Meaning | Invariant / transaction boundary | |---|---|---| -| RehearsalProject | Durable local work for one rehearsal source | one project version; no partial publication | -| SongSection | Time-bounded structural region | valid ordered range inside admitted media duration | -| RehearsalRole | Instrument, vocal function, or role subdivision | role guidance belongs to a section/project and retains provenance | -| RehearsalCue | Actionable entry, stop, pickup, handoff, range, setup, or timing cue | time/section reference must remain resolvable | -| AnalysisEvidence | Versioned machine-produced estimate plus confidence/provenance | no silent promotion from estimate to user-confirmed truth | -| ManualOverride | User-confirmed correction | preserves original evidence and authoring provenance | -| RehearsalTransport | Playback/count-in/loop state | one authoritative state machine; no competing writers | +| `RehearsalProject` | durable work for one admitted rehearsal source | one published project version; no partial publication | +| `SongSection` | time-bounded structural region | ordered, finite range inside admitted media duration | +| `RehearsalRole` | instrument, vocal function, or useful subdivision | guidance belongs to a section/project and retains provenance | +| `RehearsalCue` | actionable entry/stop/pickup/handoff/range/setup/timing instruction | referenced section/time/role remains resolvable | +| `AnalysisEvidence` | versioned machine estimate with confidence/provenance | never silently promoted to user-confirmed truth | +| `ManualOverride` | user-confirmed correction | preserves original evidence and authoring provenance | +| `RehearsalTransport` | count-in/loop/playback/navigation state | one authoritative state machine; no competing writers | Candidate domain events: `AnalysisCompleted`, `CueConfirmed`, `SectionBoundaryCorrected`, `LoopActivated`, `ProjectSnapshotPublished`, `ProjectRecovered`, and `UpdateRollbackCompleted`. ## 3. Technical design contract (TRD) -### 3.1 Rust ownership of computation +### 3.1 Rust owns repository core computation -Protected `develop` currently has a mixed implementation: `bandscope_numeric` owns checkerboard novelty and Viterbi decoding, while much of music DSP, feature extraction, prioritization, and analysis still executes in Python/NumPy. That is a product-technical gap under the current ecosystem directive. +Protected `develop` is still mixed: Rust owns selected numerical kernels, while material DSP/feature/ranking work remains Python/NumPy. That is a product-technical gap, not a permanent target architecture. Target contract: -- all repository-owned mathematical, vector, matrix, signal-processing, exploratory/data-science, ranking/weighting, and other core analysis computation is implemented in Rust; -- Python may remain an orchestration/API compatibility layer only where removal is not yet practical; -- CPU execution uses bounded multithreading without avoidable context switching; -- acceleration capabilities are explicit: CPU baseline first, then validated CUDA/OpenCL/MLX adapters where supported rather than silent fallback claims; -- Rust/Python parity tests are migration evidence, not permission to retain a permanent Python core; +- repository-owned mathematical, DSP, vector, matrix, exploratory/data-science, ranking/weighting, token-size, and other core analysis computation is Rust; +- Python may remain only as bounded orchestration/compatibility while migration is incomplete; +- CPU execution uses bounded multithreading with avoidable context switching removed; +- accelerator support is explicit and measured: CPU baseline, then validated CUDA/OpenCL/MLX adapters where meaningful; +- Rust↔Python parity proves migration correctness but does not justify a hidden permanent Python numerical fallback; - no heuristic weight or rule-of-thumb threshold is accepted without a documented measurement model, calibration dataset, or research basis. -The migration order is determined by product impact and dependency edges: temporal/beat and harmony kernels → range/pitch and role features → prioritization/weighting → source-separation integration boundaries → remaining vector/matrix utilities. +Migration order follows buyer impact and dependency leverage: temporal/beat and harmony → range/pitch/role features → prioritization/weighting → source-separation integration → remaining vector/matrix utilities. ### 3.2 Real-audio measurement contract -Synthetic fixtures remain useful for unit tests but do not prove the rehearsal product. GA accuracy evidence must use licensed or redistribution-safe real audio with human-verified ground truth. +Synthetic fixtures are acceptable for unit tests but are not product-accuracy evidence. GA evidence requires licensed or redistribution-safe real audio and human-verified ground truth. -Required metrics are task-appropriate rather than collapsed into one score: +Task-specific metrics remain separate: -- chord/harmony: Weighted Chord Symbol Recall or the benchmark metric defined by the chosen chord corpus; -- beat/timing: listener-annotated beat-location metrics compatible with the MIREX task contract; -- source separation: SI-SDR and task-appropriate perceptual/robustness evidence; -- range/pitch/transcription: reference-note or frame/event metrics declared with the corpus; -- section/cue boundaries: time-tolerant event metrics with the tolerance derived from annotation and rehearsal error cost, not an unexplained constant. +- harmony/chords: benchmark-defined chord metric such as Weighted Chord Symbol Recall; +- beat/timing: listener-annotated event metrics compatible with the chosen MIREX task contract; +- source separation: SI-SDR plus task-appropriate robustness/perceptual evidence; +- range/pitch/transcription: reference-note/frame/event metrics declared with the corpus; +- section/cue boundaries: time-tolerant event metrics whose tolerance comes from annotation uncertainty and rehearsal error cost, not an unexplained constant. -Acceptance is pre-registered per corpus before model tuning. A candidate must meet the declared non-inferiority/superiority criterion against the approved baseline with uncertainty reported (for example, bootstrap confidence intervals across tracks). A threshold must not be invented merely to make CI green. +Acceptance criteria are preregistered before tuning. Candidate-vs-baseline inference reports uncertainty across tracks; CI thresholds are never invented merely to obtain green status. -### 3.3 Persistence and concurrency contract +### 3.3 Persistence, playback, release, privacy -Issue #962 is the canonical owner for the versioned crash-safe project format, autosave, migration, backup, and recovery. Persistence must use one project authority, atomic publication, a known-good backup, bounded inputs, deterministic/idempotent migrations, and explicit locking or single-writer ownership. Any future relational store must use normalized schemas and durable keys; no database is introduced solely to satisfy an architectural fashion requirement. +- **Project source of truth — Issue #962:** atomic publication, known-good backup, deterministic/idempotent migration, bounded inputs, explicit single-writer/locking ownership, tested crash recovery. +- **Active rehearsal player — Issue #961:** precise loop/count-in/rate/cue/role interaction; timing-sensitive transport belongs in Rust; real-time callbacks do no unbounded allocation, blocking I/O, network access, or lock-heavy work. +- **Trusted distribution — Issue #960:** signed/notarized artifacts, verifiable updater metadata, SPDX SBOM/provenance, staged rollout and rollback evidence. +- **Private diagnostics — Issue #963:** ordinary logs/support bundles exclude raw private audio, secrets, full local paths, and dependency-controlled exception payloads. -### 3.4 Playback contract +## 4. Capability and gap matrix -Issue #961 is the canonical owner for active rehearsal playback: precise loops, count-in, rate control, cue navigation, role controls, restoration, and accessible interaction. Timing-sensitive transport belongs in Rust. A real-time audio callback must not perform unbounded allocation, blocking I/O, network access, or lock-heavy work. - -### 3.5 Security and privacy contract - -- Keep ordinary analysis local and network-independent. -- Treat selected files, metadata, URLs, project files, models, PDFs, subprocess output, and diagnostics as untrusted. -- Prefer narrow allowlisted commands/capabilities; no generic exec/read/write surface. -- Ordinary logs and support artifacts must not retain raw private audio, secrets, full local paths, or dependency-controlled exception payloads. -- Dependency/SBOM/provenance gates remain fail-closed; root-cause repair is preferred over ignore/suppression. -- Signing keys and release credentials never enter repository files or ordinary artifacts. - -## 4. Product capability baseline - -| Capability | Protected-snapshot status | Remaining buyer-visible gap | +| Capability | Current direction | Remaining buyer-visible gap | |---|---|---| -| Local file intake | implemented boundary | finish resource budgets and cross-platform fault evidence | -| YouTube import | policy-constrained / partial | honest failure guidance; no DRM/login bypass | -| Section/role hierarchy | represented | prove real-audio accuracy and editing round trip | -| Harmony and chord guidance | implemented / mixed compute | calibrated evidence; Rust ownership; uncertainty quality | -| Groove/beat/timing cues | implemented / mixed compute | real-audio benchmark; Rust ownership; temporal integration | -| Range/overlap guidance | implemented | reference-audio validation and Rust migration | -| Stems/source separation | partial | platform/accelerator coverage, model artifact provenance, real-audio SI-SDR evidence | -| Confidence/provenance | represented | calibrate confidence and prove user correction round trip | -| Rehearsal action map | many open slices | consolidate repeated micro-PRs into coherent section/role UX | -| Active loop/player | incomplete | canonical Issue #961 | -| Crash-safe project/autosave | incomplete | canonical Issue #962 | -| Signed/notarized updater/rollback | partial | canonical Issue #960 | -| Redacted diagnostics/support bundle | incomplete | canonical Issue #963 | -| Licensed first-run demo | incomplete | canonical Issue #964 | -| WCAG/Figma/Storybook parity | incomplete | canonical Issue #965 | -| Merge-train/succession | incomplete | canonical Issue #966 | - -## 5. Live PR queue and merge-loop evidence - -The live queue is volatile and therefore is not treated as a permanent product fact. At the 2026-09-01 10:31 KST capture, GitHub reported **190 open pull requests** for `ContextualWisdomLab/bandscope`. The previous 2026-08-31 snapshot in this branch reported 185. This file records the capture time and the verification command intentionally returns the *current* value on a later rerun. - -The queue is dominated by narrow `feat(workspace): name tonight's first … on the map` slices. Those changes can improve next-action copy, but backlog size itself is now a product-delivery risk: overlapping plan fields, copy keys, contracts, and workspace behavior should be consolidated into dependency-aware trains rather than allowed to grow as unbounded parallel micro-PRs. - -### 5.1 Current required-check evidence, not inherited evidence - -Do not state that every open PR is blocked by the same cause. Required gates change over time and must be inspected on the exact current head. - -Two current examples show why: +| Local file intake | implemented authority boundary | complete resource budgets and cross-platform fault evidence | +| YouTube import | policy-constrained/partial | honest failure guidance; no DRM/login bypass | +| Section×role hierarchy | represented | real-audio accuracy + correction round trip | +| Harmony guidance | implemented/mixed compute | calibrated evidence, Rust ownership, uncertainty quality | +| Groove/beat/timing | implemented/mixed compute | real-audio benchmark, Rust ownership, full production integration | +| Range/overlap | implemented | reference-audio validation + Rust migration | +| Stems/source separation | partial | platform/accelerator coverage, artifact provenance, real-audio SI-SDR | +| Confidence/provenance | represented | calibration + user correction persistence | +| Rehearsal action map | many open slices | consolidate micro-PRs into coherent section/role UX | +| Active player | incomplete | #961 | +| Crash-safe project/autosave | incomplete | #962 | +| Signed/notarized update/rollback | partial | #960 | +| Private support bundle | incomplete | #963 | +| Licensed first-run demo | incomplete | #964 | +| WCAG/Figma/Storybook parity | incomplete | #965 | +| Sustainable merge train | incomplete | #966 | + +## 5. Organization-wide live backlog evidence + +This capture recounts **every 71 repository currently accessible through the connected ContextualWisdomLab GitHub account**, not only previously known high-backlog repositories. The 71 repositories contain **2,686 open pull requests** in total at this capture. Counts are volatile evidence, not product constants. + +Highest backlogs: + +| Rank | Repository | Open PRs | +|---:|---|---:| +| 1 | `ContextualWisdomLab/bandscope` | **188** | +| 2 | `ContextualWisdomLab/newsdom-api` | 144 | +| 3 | `ContextualWisdomLab/TEPP` | 141 | +| 4 | `ContextualWisdomLab/OriginWeave` | 138 | +| 5 | `ContextualWisdomLab/naruon` | 128 | +| 6 | `ContextualWisdomLab/html4tree` | 117 | +| 7 | `ContextualWisdomLab/Orgmetra` | 113 | +| 8 | `ContextualWisdomLab/pg-erd-cloud` | 112 | +| 9 | `ContextualWisdomLab/.github` | 110 | +| 10 | `ContextualWisdomLab/appguardrail` | 102 | +| 11 | `ContextualWisdomLab/argos` | 100 | +| 12 | `ContextualWisdomLab/LineageWeave` | 98 | +| 13 | `ContextualWisdomLab/clearfolio` | 97 | + +BandScope remains the selected delivery lane because it has the largest live backlog **and** the repository owns the end-user rehearsal product whose duplicated workspace slices are contributing directly to buyer-delivery fragmentation. Selection is therefore based on both count and product responsibility, not repository name. + +### 5.1 Current merge-loop evidence + +Protected `develop` currently requires these status contexts, among others: `ci / build-and-test`, `dependency-review`, `security-audit`, `sbom`, `release-preflight`, Windows/macOS build gates, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, and CodeQL JavaScript/TypeScript + Python analysis. Required contexts are read from live branch protection before merge; this list is evidence from this capture, not permission to infer future policy. + +Current examples: + +- **#1103 CSV NUL hardening is the canonical desktop export owner.** New duplicate #1121 touched the same three files and added one useful NUL-only assertion. That unique edge was transferred into #1103 in normal non-force history before #1121 was closed unmerged as superseded. No check/review evidence transfers between the PRs; #1103 needs fresh exact-head evidence after the consolidation commit. +- **#1119 Trivy PR-head evidence** correctly identifies a stale local policy-test conflict: CodeQL/Scorecard remain push-only local signals, while Trivy needs ordinary `pull_request` SARIF coverage. A failed temporary source-fix workflow was removed; the permanent policy-test repair belongs in normal source history, not in a dormant self-modifying workflow. +- **#1007/#1094 first-part-handoff** are not yet safe to collapse blindly. #1007 has absorbed the selected-role semantics at resolver/callout level, but mounted `Workspace` must pass its selected `activeRole` through and pin that integration before #1094 can be closed without losing unique production behavior. +- **#1116 is the canonical baseline owner.** Older #1025 was closed only after its unique PRD/TRD/UML/Rust/accuracy/security/accessibility/release requirements were preserved here. + +Operational invariant: queued/pending/neutral/skipped/cancelled/failed, predecessor-head, protected-base, self/author, status-only, and model-only evidence is non-passing. Central-gate defects are repaired in the owning central repository; member branches do not weaken gates or use administrative bypass. + +## 6. Prioritized product-technical backlog -- **PR #956** (`fix(security): redact articulation failure logs`) had a predecessor Strix failure caused by central provider/API compatibility, not by its three-file privacy repair. The central fix `ContextualWisdomLab/.github#1350` (`f655a901…`, GPT-5.4 function-tool/reasoning contract) is an ancestor of current `.github/main@1186a9f4…` (245 commits ahead at capture). The PR was advanced normally, without force push, to tree-identical exact head `e46a7aa3121c902ebcf9ea9d256a199659a482df` solely to obtain fresh current-workflow evidence; repository workflows immediately re-queued. It still must not merge without terminal current-head required checks and qualifying independent approval. -- **PR #1117** (`refactor(engine): promote temporal probe from cli hack to api integration`) was open at exact head `b98f266d2356d56be624fb617580b5252e85baaa`. At capture, all nine repository workflow runs returned success (CI, release, Security Scan, security-audit, Semgrep, Bandit, secret scan, build baseline, SBOM), while the central `opencode-review` check was still `in_progress`. Pending evidence is not success and does not transfer to a later head. - -Operational invariant: central-gate faults are repaired in the owning central repository. Member repositories do not weaken required checks, self-approve, transfer predecessor evidence, or use administrative bypass to manufacture merge readiness. - -### 5.2 Baseline PR ownership - -Two open PRs attempted to own this same file: #1025 (older, larger initial baseline) and #1116 (newer refresh). This branch is the canonical current owner because this replacement incorporates the unique product/TRD/UML/Rust/accuracy/security/accessibility/release requirements from #1025 while correcting the stale live-state and review findings on #1116. #1025 can therefore be closed as superseded only after this head exists and its unique requirements are preserved here; closure is bookkeeping, not deletion of evidence. +Priority is buyer impact × dependency leverage × risk, not PR age. -## 6. Prioritized gap backlog +### P0 — trustworthy product completion -Priority is buyer impact × dependency leverage × risk, not PR age. +1. **Sustainable exact-head merge throughput — #966.** Consolidate duplicate/superseded writers, require current-head terminal gates, zero actionable threads, and current qualifying independent non-author approval. +2. **Real-audio accuracy — #770.** Licensed corpora, human truth, task-specific metrics, preregistered statistical acceptance, reproducible artifacts. +3. **Rust core-computation migration.** Inventory every DSP/math/vector/matrix/data-science call path and move production ownership to Rust with CPU multithread + explicit accelerator boundaries. +4. **Resource/filesystem authority completion.** Bounded duration/size/allocation, cancellation, path containment, model/PDF bounds, and cross-platform production-path fault tests. -### P0 — blocks trustworthy product completion +### P1 — close the rehearsal loop -1. **Restore sustainable exact-head merge throughput (Issue #966).** - - Acceptance: current-head required checks are terminal-success, independent non-author approval is current, unresolved actionable threads are zero, and duplicate/superseded slices are reconciled before merge. - - No bypass, self-approval, stale check transfer, or force push. -2. **Establish real-audio accuracy gates (Issue #770).** - - Acceptance: licensed real-audio corpora, human ground truth, task-specific metrics, preregistered statistical acceptance criteria, and reproducible exact-head artifacts. -3. **Migrate repository-owned core computation to Rust.** - - Acceptance: inventory of every math/DSP/vector/matrix/data-science call path; Rust ownership for each core operation; CPU multithread baseline; explicit accelerator adapters; parity and real-audio regression tests; Python orchestration contains no hidden numerical fallback accepted as production truth. -4. **Complete local resource admission and filesystem authority.** - - Acceptance: bounded file duration/size/allocation, cancellation, path containment, model/PDF bounds, and platform fault tests across the real production path. +5. **Active rehearsal player — #961.** +6. **Crash-safe project/autosave — #962.** +7. **Trusted distribution/update/rollback — #960.** +8. **Private diagnostics/supportability — #963.** +9. **Licensed first-run rehearsal — #964.** +10. **WCAG 2.2 AA + Figma/Storybook/shipped parity — #965.** -### P1 — closes the rehearsal loop +### P2 — analytical depth after the core loop is reliable -5. **Active rehearsal player (Issue #961).** Precise loop/count-in/role control with Rust transport and accessibility equivalence. -6. **Crash-safe project source of truth (Issue #962).** Atomic save/autosave, migration, backup, recovery, locking, and versioned fixtures. -7. **Trusted desktop distribution (Issue #960).** Windows signing, macOS signing/notarization, updater signatures, SBOM/provenance, staged rollout, and rollback evidence. -8. **Private supportability (Issue #963).** Typed diagnostics and user-previewable offline support bundle without raw song/path leakage. -9. **Licensed first-run rehearsal (Issue #964).** Demonstrate install → first useful rehearsal without developer setup. -10. **WCAG 2.2 AA + Figma/Storybook/shipped parity (Issue #965).** Keyboard, focus, target-size, alternatives for visual timelines/charts, i18n semantic parity, design-token ownership, and representative edge-case stories. +11. Replace unbounded “first-X” plan-field micro-PR growth with coherent engine-generated role guidance, conflict rules, priority, and edit provenance. +12. Replace untraceable weights/priors with documented literature/calibration evidence and sensitivity tests. +13. Preserve the `song → section → role → time` hierarchy; use multilevel/time-dependent evidence where it materially improves rehearsal decisions instead of atomistic aggregation. +14. Harden model artifact provenance and reproducibility across CPU/CUDA/OpenCL/MLX-supported paths. +15. Expand collaboration only behind a stable local-first project/handoff contract and a clear buyer outcome. -### P2 — improves scale and analytical depth after the core loop is reliable +## 7. Quality, UX, test, security, and operability baseline -11. Consolidate plan-field micro-PRs into coherent engine-generated role guidance with conflict/priority rules and edit provenance. -12. Replace hand-tuned/untraceable weights and priors with documented literature/calibration evidence and sensitivity tests. -13. Expand section/role/temporal modeling where multilevel or time-dependent evidence materially improves rehearsal decisions; avoid atomistic aggregation that erases section/role structure. -14. Harden model artifact provenance and accelerator reproducibility across CPU/CUDA/OpenCL/MLX-supported paths. -15. Expand collaboration only behind a clear local-first buyer outcome and stable project/handoff contracts. +### 7.1 Coverage and documentation -## 7. Quality, test, UX, and operability baseline +- Python production coverage/docstring policy is 100% in repository guidance. +- Protected JavaScript configs still contain 90% thresholds in parts of the repository; this is below the target contract. +- Target: **100% statement coverage, 100% branch/edge-case coverage, and 100% public/repository-owned API documentation coverage** for owned production surfaces. A lower configured threshold is a gap, not equivalent evidence. -### Coverage and documentation +### 7.2 Realistic validation -- Python production coverage/docstring gates are already described as 100% in repository guidance. -- Protected `develop` still configures JavaScript coverage thresholds at 90% in both `apps/desktop/vite.config.ts` and `packages/shared-types/vitest.config.ts`; this is a gap against the current 100% statement/branch/edge-case target. -- The target is **100% test coverage, 100% branch/edge-case coverage, and 100% public/repository-owned API docstring/documentation coverage** for changed production surfaces. A passing threshold below that target is not equivalent evidence. +Minimum scenario inventory includes supported 44.1/48/96 kHz audio, mono/stereo, short/long recordings, pickup before bar one, odd meter, tempo change, silence near boundaries, unsupported codecs, moved/replaced files, device changes, cancellation, disk full, corrupted project state, migration interruption, unavailable source separation, and uncertainty correction round trips. -### Realistic test cases +### 7.3 UI/design acceptance -At minimum, exercise 44.1/48/96 kHz where supported, mono/stereo, short and long recordings, pickup before bar one, odd meter, tempo change, silence near boundaries, unsupported codec, moved/replaced files, device changes, cancellation, disk full, corrupted project state, migration interruption, source-separation unavailable, and uncertainty correction round trips. +Storybook is the executable component/interaction inventory; Figma is reviewed design/handoff evidence, not a second runtime authority. UI changes require screenshot-backed validation of relevant states and edge cases, keyboard/focus behavior, touch target sizing, responsive layout, typography/color contrast, animation/reduced-motion, forms/feedback, navigation, and data visualization alternatives. Repeated visual objects belong behind shared tokens/components, not per-feature drift. -### Accessibility and UI validation +Customer copy names the next action and never exposes repository/module boundaries. English/Korean semantics stay aligned. -`docs/doctoring/high-security-pdf-http-baseline.md` and `docs/doctoring/npm-lockfile-generator-provenance.md` already contain Mermaid diagrams, so a repository-wide “no diagrams exist” claim is false. What remains missing is a maintained product-level DDD/context map, core sequence/state views, Storybook inventory for rehearsal-domain components, and screenshot-backed accessibility/responsive audits of shipped UI. +### 7.4 Security and supply chain -For visual controls, exact-value and non-drag alternatives are required when a waveform, range, timeline, or chart is interactive. UI copy should tell the musician what to do next and must not expose internal module/repository boundaries. +- ordinary analysis stays local and network-independent; +- files/URLs/metadata/models/PDFs/project state/subprocess output are untrusted; +- capabilities are narrow and allowlisted; no generic exec/read/write surface; +- Dependency Review, OSV, Trivy, CodeQL, secret scanning, SBOM, release provenance, and cross-platform build controls remain fail-closed; +- suppressions are not a substitute for root-cause remediation; +- signing/release credentials never enter repository files or ordinary artifacts. -### Release/operability +### 7.5 Release/operability -A development artifact is not GA evidence. GA requires protected-source identity, reproducible build evidence, checksums, SPDX SBOM/provenance, supported architecture matrix, signatures, macOS notarization, verified update manifest, offline startup, and tested repair/rollback. +GA requires protected-source identity, reproducible build evidence, checksums, SPDX SBOM/provenance, supported architecture matrix, signatures, macOS notarization, verified update metadata, offline startup, and tested repair/rollback. A development artifact alone is not GA evidence. -## 8. UML / sequence supplements +## 8. UML / state supplements -### 8.1 Import → analyze → rehearsal view +### 8.1 Import → analyze → rehearse ```mermaid sequenceDiagram actor U as User - participant UI as React workspace - participant T as Tauri shell - participant V as Rust validation/authority - participant O as Analysis orchestration - participant R as Rust analysis core + participant UI as React Workspace + participant T as Tauri Shell + participant V as Rust Authority Boundary + participant O as Analysis Orchestration + participant R as Rust Analysis Core U->>UI: Choose local audio UI->>T: typed intake command - T->>V: validate path, project and resource authority + T->>V: validate path/project/resource authority V-->>T: admitted source reference T->>O: start bounded analysis job O->>R: compute section/role/temporal evidence R-->>O: versioned evidence + confidence O-->>T: progress / completed result T-->>UI: analysis-job-updated - UI-->>U: rehearsal actions + uncertainty + edit path + UI-->>U: rehearsal action + uncertainty + correction path ``` ### 8.2 Project state machine @@ -274,7 +286,7 @@ stateDiagram-v2 Clean --> Dirty: accepted mutation Dirty --> Staging: autosave/manual save Staging --> Published: validate + atomic replace - Staging --> Dirty: failure, keep known-good + Staging --> Dirty: failure; retain known-good Published --> Dirty: next mutation Published --> RecoveryAvailable: unclean shutdown/newer recovery evidence RecoveryAvailable --> Published: restore validated snapshot @@ -283,20 +295,20 @@ stateDiagram-v2 ## 9. Research and standards traceability -The baseline uses standards as evaluation structures, not as decoration: +Standards are evaluation structures, not decoration: -- ISO/IEC 25010:2023 supplies the current product-quality model for specifying and evaluating software quality characteristics. -- NIST SP 800-218 SSDF v1.1 supplies outcome-oriented secure-development practices, including provenance and tracked security requirements/design decisions. -- WCAG 2.2 is the current W3C Recommendation baseline used for the desktop webview UI accessibility contract. -- MIREX task definitions provide domain-relevant evaluation precedent using real audio and human/listener annotation; the 2025 beat-tracking task explicitly evaluates predicted beat locations against listener-annotated recordings. -- MIR literature remains task-specific: Foote for self-similarity novelty, Viterbi for decoding, Le Roux et al. for SI-SDR, and established chord corpora/metrics for harmony evaluation. These references do not justify unrelated hand-tuned transition priors or product weights. +- ISO/IEC 25010:2023 supplies the product-quality model for specifying/evaluating software quality characteristics. +- NIST SP 800-218 SSDF v1.1 supplies outcome-oriented secure-development practices and traceable security requirements/design decisions. +- WCAG 2.2 is the current W3C Recommendation baseline for desktop-webview accessibility. +- MIREX task definitions provide domain-relevant precedent using real audio and human/listener annotation. +- MIR evidence remains task-specific: Foote for self-similarity/novelty, Viterbi for sequence decoding, Le Roux et al. for SI-SDR, and benchmark-specific corpora/metrics for harmony. These references do not justify unrelated hand-tuned product weights. ### References (APA 7th) -International Organization for Standardization, & International Electrotechnical Commission. (2023). *ISO/IEC 25010:2023 Systems and software engineering—Systems and software Quality Requirements and Evaluation (SQuaRE)—Product quality model* (2nd ed.). ISO. - Foote, J. (1999). Visualizing music and audio using self-similarity. In *Proceedings of the Seventh ACM International Conference on Multimedia* (pp. 77–80). Association for Computing Machinery. +International Organization for Standardization, & International Electrotechnical Commission. (2023). *ISO/IEC 25010:2023 Systems and software engineering—Systems and software Quality Requirements and Evaluation (SQuaRE)—Product quality model* (2nd ed.). ISO. + Le Roux, J., Wisdom, S., Erdogan, H., & Hershey, J. R. (2019). SDR—Half-baked or well done? In *2019 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)* (pp. 626–630). IEEE. Music Information Retrieval Evaluation eXchange. (2025). *Audio beat tracking*. MIREX Wiki. https://music-ir.org/mirex/wiki/2025:Audio_Beat_Tracking @@ -309,33 +321,29 @@ World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines (WCAG) ## 10. Re-runnable verification -Run from repository root. These commands intentionally distinguish immutable protected-source evidence from volatile live GitHub state. - ```bash -# Protected source identity -git rev-parse --show-toplevel +# protected source identity git rev-parse develop -# Current open-PR count; snapshot in this document was 190 at 2026-09-01 10:31 KST. +# BandScope current queue gh pr list --state open --limit 500 --json number --jq 'length' -# Current head and live gate state for a PR; never reuse a predecessor result. -gh pr view 956 --json number,state,isDraft,headRefOid,baseRefOid,reviews,statusCheckRollup -gh pr view 1117 --json number,state,isDraft,headRefOid,baseRefOid,reviews,statusCheckRollup +# exact-head merge evidence for a candidate +gh pr view --json number,state,isDraft,headRefOid,baseRefOid,reviews,statusCheckRollup -# Confirm product-level and doctoring Mermaid inventory. +# product/doctoring Mermaid inventory git grep -n '```mermaid' -- docs ARCHITECTURE.md -# Verify current JS threshold policy gap. -git grep -n 'lines: 90' -- apps/desktop/vite.config.ts packages/shared-types/vitest.config.ts +# JS threshold gap +git grep -n '90' -- apps/desktop/vite.config.ts packages/shared-types/vitest.config.ts -# Verify the two current Rust numerical entry points and locate remaining Python core modules. +# Rust numerical ownership and remaining Python production modules git grep -n 'checkerboard_novelty\|viterbi_decode' -- services/analysis-engine/rust services/analysis-engine/src find services/analysis-engine/src/bandscope_analysis -type f -name '*.py' -print -# Real-audio fixture inventory; absence/presence is determined by file search, not Python-file grep. +# real-audio test fixture inventory find . -type f \( -path '*/tests/*' -o -path '*/test/*' \) \ \( -iname '*.wav' -o -iname '*.flac' -o -iname '*.mp3' \) -not -path './.git/*' -print ``` -GitHub live-state claims in this document are capture-time evidence. Any merge decision must re-fetch the exact current head, required checks, review decision, unresolved threads, ancestry/dependency order, and writer state immediately before action. +Every GitHub state in this document is capture-time evidence. Immediately before a merge, re-fetch the unchanged exact head, current branch protection, all required checks, review decision, unresolved threads, dependency/ancestry order, and concurrent writer state. \ No newline at end of file From aa89572842a3fa4a3fd1a46ac069a4e04dffc0c8 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 13:34:27 +0900 Subject: [PATCH 06/80] docs(gap): refresh 72-repository backlog evidence --- docs/product-technical-gap-baseline.md | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 66aab4c9c..17bb16b5e 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,7 +1,7 @@ # BandScope Product-Technical Gap Baseline Last updated: 2026-09-01 -Evidence capture: 2026-09-01 13:00 KST unless a row says otherwise +Evidence capture: 2026-09-01 13:29 KST unless a row says otherwise Protected base: `develop@749511c3ad4000090048718f685c6bee6b3d2c25` ## 1. Purpose and buyer outcome @@ -159,25 +159,21 @@ Acceptance criteria are preregistered before tuning. Candidate-vs-baseline infer ## 5. Organization-wide live backlog evidence -This capture recounts **every 71 repository currently accessible through the connected ContextualWisdomLab GitHub account**, not only previously known high-backlog repositories. The 71 repositories contain **2,686 open pull requests** in total at this capture. Counts are volatile evidence, not product constants. +A fresh organization-wide GitHub search at this capture includes **all 72 repositories currently accessible through the connected ContextualWisdomLab GitHub account** and reports **2,697 open pull requests** in total. Repository enumeration now includes the newly visible `ContextualWisdomLab/litellm-patched-proxy` and `ContextualWisdomLab/pingora-gateway`; the prior 71-repository snapshot is therefore stale. Counts are volatile evidence, not product constants. -Highest backlogs: +The highest-backlog candidates were re-fetched individually after the organization-wide recount: | Rank | Repository | Open PRs | |---:|---|---:| | 1 | `ContextualWisdomLab/bandscope` | **188** | | 2 | `ContextualWisdomLab/newsdom-api` | 144 | | 3 | `ContextualWisdomLab/TEPP` | 141 | -| 4 | `ContextualWisdomLab/OriginWeave` | 138 | +| 4 | `ContextualWisdomLab/OriginWeave` | 140 | | 5 | `ContextualWisdomLab/naruon` | 128 | | 6 | `ContextualWisdomLab/html4tree` | 117 | | 7 | `ContextualWisdomLab/Orgmetra` | 113 | -| 8 | `ContextualWisdomLab/pg-erd-cloud` | 112 | -| 9 | `ContextualWisdomLab/.github` | 110 | -| 10 | `ContextualWisdomLab/appguardrail` | 102 | -| 11 | `ContextualWisdomLab/argos` | 100 | -| 12 | `ContextualWisdomLab/LineageWeave` | 98 | -| 13 | `ContextualWisdomLab/clearfolio` | 97 | +| 8 | `ContextualWisdomLab/pg-erd-cloud` | 113 | +| 9 | `ContextualWisdomLab/.github` | 111 | BandScope remains the selected delivery lane because it has the largest live backlog **and** the repository owns the end-user rehearsal product whose duplicated workspace slices are contributing directly to buyer-delivery fragmentation. Selection is therefore based on both count and product responsibility, not repository name. @@ -325,6 +321,9 @@ World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines (WCAG) # protected source identity git rev-parse develop +# organization-wide open PR count +gh api search/issues -f q='org:ContextualWisdomLab is:pr is:open' --jq '.total_count' + # BandScope current queue gh pr list --state open --limit 500 --json number --jq 'length' @@ -346,4 +345,4 @@ find . -type f \( -path '*/tests/*' -o -path '*/test/*' \) \ \( -iname '*.wav' -o -iname '*.flac' -o -iname '*.mp3' \) -not -path './.git/*' -print ``` -Every GitHub state in this document is capture-time evidence. Immediately before a merge, re-fetch the unchanged exact head, current branch protection, all required checks, review decision, unresolved threads, dependency/ancestry order, and concurrent writer state. \ No newline at end of file +Every GitHub state in this document is capture-time evidence. Immediately before a merge, re-fetch the unchanged exact head, current branch protection, all required checks, review decision, unresolved threads, dependency/ancestry order, and concurrent writer state. From 9eb9009da6f879a03cb2d30ddeed6ec12b9bda1e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 13:34:45 +0900 Subject: [PATCH 07/80] docs(doctoring): record 72-repository recount --- docs/doctoring/product-gap-baseline-2026-09-01.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/doctoring/product-gap-baseline-2026-09-01.md b/docs/doctoring/product-gap-baseline-2026-09-01.md index 5277819a2..7d972747a 100644 --- a/docs/doctoring/product-gap-baseline-2026-09-01.md +++ b/docs/doctoring/product-gap-baseline-2026-09-01.md @@ -10,6 +10,8 @@ Protected source at capture: `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. Observed live queue at 2026-09-01 10:31 KST: 190 open pull requests in `ContextualWisdomLab/bandscope`. The older branch text said 185, and its verification block still printed 130; that evidence could not reproduce the document claim. +A fresh organization-wide recount at 2026-09-01 13:29 KST enumerated 72 repositories accessible through the connected `ContextualWisdomLab` account and 2,697 open pull requests across the organization. The prior 71-repository/2,686-PR snapshot became stale because `ContextualWisdomLab/litellm-patched-proxy` and `ContextualWisdomLab/pingora-gateway` are now visible in the accessible repository set. Individual count checks still put `ContextualWisdomLab/bandscope` first at 188 open PRs, ahead of `ContextualWisdomLab/newsdom-api` 144, `ContextualWisdomLab/TEPP` 141, `ContextualWisdomLab/OriginWeave` 140, and `ContextualWisdomLab/naruon` 128. The selection therefore remains justified by both backlog and BandScope's end-user rehearsal-product responsibility. + Review findings on PR #1116 were validated as real: 1. the open-PR evidence was stale; @@ -50,4 +52,4 @@ World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines (WCAG) PR #1116 is the canonical current baseline owner. PR #1025 is an older competing owner of the same path; its unique requirements (PRD/TRD/UML, Rust migration, real-audio accuracy, security, accessibility, release evidence, and reproducible verification) were deliberately carried into the #1116 replacement. Once this current head is present, #1025 can be closed as superseded without deleting its discussion history. -Future hourly loops should refresh live counts/evidence only when they materially change prioritization. They must not rewrite immutable product and architecture sections merely to chase a volatile PR number. +Future hourly loops should refresh live counts/evidence only when they materially change prioritization. They must not rewrite immutable product and architecture sections merely to chase a volatile PR number. \ No newline at end of file From 825512fed478a1a30c60756bd21fd2599bc98f8b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 14:38:50 +0900 Subject: [PATCH 08/80] docs(gap): refresh live PR recount and central coverage owner --- docs/product-technical-gap-baseline.md | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 17bb16b5e..063b1eb95 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,7 +1,7 @@ # BandScope Product-Technical Gap Baseline Last updated: 2026-09-01 -Evidence capture: 2026-09-01 13:29 KST unless a row says otherwise +Evidence capture: 2026-09-01 14:37 KST unless a row says otherwise Protected base: `develop@749511c3ad4000090048718f685c6bee6b3d2c25` ## 1. Purpose and buyer outcome @@ -159,21 +159,21 @@ Acceptance criteria are preregistered before tuning. Candidate-vs-baseline infer ## 5. Organization-wide live backlog evidence -A fresh organization-wide GitHub search at this capture includes **all 72 repositories currently accessible through the connected ContextualWisdomLab GitHub account** and reports **2,697 open pull requests** in total. Repository enumeration now includes the newly visible `ContextualWisdomLab/litellm-patched-proxy` and `ContextualWisdomLab/pingora-gateway`; the prior 71-repository snapshot is therefore stale. Counts are volatile evidence, not product constants. +A fresh organization-wide GitHub search at this capture includes **all 72 repositories currently accessible through the connected ContextualWisdomLab GitHub account** and reports **2,690 open pull requests** in total. Repository enumeration includes `ContextualWisdomLab/litellm-patched-proxy` and `ContextualWisdomLab/pingora-gateway`; the prior 71-repository and 2,697-PR snapshots are stale. Counts are volatile evidence, not product constants. The highest-backlog candidates were re-fetched individually after the organization-wide recount: | Rank | Repository | Open PRs | |---:|---|---:| | 1 | `ContextualWisdomLab/bandscope` | **188** | -| 2 | `ContextualWisdomLab/newsdom-api` | 144 | -| 3 | `ContextualWisdomLab/TEPP` | 141 | -| 4 | `ContextualWisdomLab/OriginWeave` | 140 | -| 5 | `ContextualWisdomLab/naruon` | 128 | +| 2 | `ContextualWisdomLab/TEPP` | 142 | +| 3 | `ContextualWisdomLab/OriginWeave` | 140 | +| 4 | `ContextualWisdomLab/newsdom-api` | 130 | +| 5 | `ContextualWisdomLab/naruon` | 127 | | 6 | `ContextualWisdomLab/html4tree` | 117 | -| 7 | `ContextualWisdomLab/Orgmetra` | 113 | -| 8 | `ContextualWisdomLab/pg-erd-cloud` | 113 | -| 9 | `ContextualWisdomLab/.github` | 111 | +| 7 | `ContextualWisdomLab/pg-erd-cloud` | 114 | +| 8 | `ContextualWisdomLab/Orgmetra` | 113 | +| 9 | `ContextualWisdomLab/.github` | 110 | BandScope remains the selected delivery lane because it has the largest live backlog **and** the repository owns the end-user rehearsal product whose duplicated workspace slices are contributing directly to buyer-delivery fragmentation. Selection is therefore based on both count and product responsibility, not repository name. @@ -187,6 +187,7 @@ Current examples: - **#1119 Trivy PR-head evidence** correctly identifies a stale local policy-test conflict: CodeQL/Scorecard remain push-only local signals, while Trivy needs ordinary `pull_request` SARIF coverage. A failed temporary source-fix workflow was removed; the permanent policy-test repair belongs in normal source history, not in a dormant self-modifying workflow. - **#1007/#1094 first-part-handoff** are not yet safe to collapse blindly. #1007 has absorbed the selected-role semantics at resolver/callout level, but mounted `Workspace` must pass its selected `activeRole` through and pin that integration before #1094 can be closed without losing unique production behavior. - **#1116 is the canonical baseline owner.** Older #1025 was closed only after its unique PRD/TRD/UML/Rust/accuracy/security/accessibility/release requirements were preserved here. +- **Central required-workflow coverage is repaired at the owner, not in BandScope.** Current `ContextualWisdomLab/.github/main` inherited a 99% `scripts/ci` coverage regression from merged #1541. Competing #1547 was closed unmerged after exact patch comparison established #1551 as the more complete canonical owner. #1548 was then stacked on #1551 and merged normally into that branch as `c858ee4065dbda73b38150c95b635c0db7266a39`, preserving its unique CHANGELOG/G-13 traceability plus direct-RCA regression. The #1551 exact head changed as a result, so predecessor checks do not transfer; current security/review workflows are being regenerated before that central repair can land. Operational invariant: queued/pending/neutral/skipped/cancelled/failed, predecessor-head, protected-base, self/author, status-only, and model-only evidence is non-passing. Central-gate defects are repaired in the owning central repository; member branches do not weaken gates or use administrative bypass. From 39f7702e8b2297d02b2a2a3f9b599f1e229cdce5 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 18:43:16 +0900 Subject: [PATCH 09/80] docs: refresh current product-gap evidence --- .../workflows/repair-pr1116-gap-baseline.yml | 70 +++++++++++++++++++ 1 file changed, 70 insertions(+) create mode 100644 .github/workflows/repair-pr1116-gap-baseline.yml diff --git a/.github/workflows/repair-pr1116-gap-baseline.yml b/.github/workflows/repair-pr1116-gap-baseline.yml new file mode 100644 index 000000000..1899fac30 --- /dev/null +++ b/.github/workflows/repair-pr1116-gap-baseline.yml @@ -0,0 +1,70 @@ +name: Repair PR1116 product-gap baseline + +on: + push: + branches: + - docs/gap-baseline-2026-08-31 + +permissions: + contents: write + +env: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: init.defaultBranch + GIT_CONFIG_VALUE_0: develop + +jobs: + repair_gap_baseline: + name: repair-gap-baseline + if: github.repository == 'ContextualWisdomLab/bandscope' + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + ref: docs/gap-baseline-2026-08-31 + - name: Refresh volatile queue evidence and retire source-fix workflow + shell: bash + run: | + python3 - <<'PY' + from pathlib import Path + + baseline_path = Path("docs/product-technical-gap-baseline.md") + baseline_text = baseline_path.read_text(encoding="utf-8") + replacements = { + "Evidence capture: 2026-09-01 14:37 KST unless a row says otherwise": + "Evidence capture: 2026-09-01 18:41 KST unless a row says otherwise", + "A fresh organization-wide GitHub search at this capture includes **all 72 repositories currently accessible through the connected ContextualWisdomLab GitHub account** and reports **2,690 open pull requests** in total. Repository enumeration includes `ContextualWisdomLab/litellm-patched-proxy` and `ContextualWisdomLab/pingora-gateway`; the prior 71-repository and 2,697-PR snapshots are stale. Counts are volatile evidence, not product constants.": + "A fresh organization-wide GitHub search at this capture includes **all 73 repositories currently accessible through the connected ContextualWisdomLab GitHub account** and reports **2,685 open pull requests** in total. The accessible set now includes `ContextualWisdomLab/ConceptWeave`; earlier 72-repository queue snapshots are stale. Counts are volatile evidence, not product constants.", + "| 1 | `ContextualWisdomLab/bandscope` | **188** |\n| 2 | `ContextualWisdomLab/TEPP` | 142 |\n| 3 | `ContextualWisdomLab/OriginWeave` | 140 |\n| 4 | `ContextualWisdomLab/newsdom-api` | 130 |\n| 5 | `ContextualWisdomLab/naruon` | 127 |\n| 6 | `ContextualWisdomLab/html4tree` | 117 |\n| 7 | `ContextualWisdomLab/pg-erd-cloud` | 114 |\n| 8 | `ContextualWisdomLab/Orgmetra` | 113 |\n| 9 | `ContextualWisdomLab/.github` | 110 |": + "| 1 | `ContextualWisdomLab/bandscope` | **186** |\n| 2 | `ContextualWisdomLab/TEPP` | 150 |\n| 3 | `ContextualWisdomLab/OriginWeave` | 140 |\n| 4 | `ContextualWisdomLab/newsdom-api` | 130 |\n| 5 | `ContextualWisdomLab/naruon` | 125 |", + "- **#1119 Trivy PR-head evidence** correctly identifies a stale local policy-test conflict: CodeQL/Scorecard remain push-only local signals, while Trivy needs ordinary `pull_request` SARIF coverage. A failed temporary source-fix workflow was removed; the permanent policy-test repair belongs in normal source history, not in a dormant self-modifying workflow.": + "- **#1119 Trivy PR-head evidence** has an exact-head hosted failure isolated to the stale generic push-only policy test after 678 passing tests and 100% Python coverage. A bounded direct source repair is now materialized on the canonical branch to split CodeQL/Scorecard push-only assertions from Trivy ordinary-`pull_request` SARIF evidence; the temporary repair workflow deletes itself in the repair commit, and only the resulting exact head may provide completion evidence.", + "- **#1007/#1094 first-part-handoff** are not yet safe to collapse blindly. #1007 has absorbed the selected-role semantics at resolver/callout level, but mounted `Workspace` must pass its selected `activeRole` through and pin that integration before #1094 can be closed without losing unique production behavior.": + "- **#1007/#1094 first-part-handoff** advanced by concurrent normal history. Canonical #1007 now wires the mounted Workspace selected `activeRole` through the handoff callout, rejects stale role identities after song replacement, and removes the heuristic handoff fallback in favor of real stem activity. Its exact head `5261b1cbb15fd6587425c954c3480991394afc74` has freshly queued repository checks, so #1094 remains open until that unchanged canonical head is revalidated and its unique semantics are confirmed preserved." + } + for old_text, new_text in replacements.items(): + if baseline_text.count(old_text) != 1: + raise SystemExit(f"baseline replacement cardinality mismatch: {old_text[:80]!r}") + baseline_text = baseline_text.replace(old_text, new_text, 1) + baseline_path.write_text(baseline_text, encoding="utf-8") + + doctoring_path = Path("docs/doctoring/product-gap-baseline-2026-09-01.md") + doctoring_text = doctoring_path.read_text(encoding="utf-8") + anchor = "The replacement baseline therefore separates protected-source facts from timestamped GitHub observations and uses exact current-head examples instead of asserting one blocker for the entire queue.\n" + current_refresh = ( + "\n### Current volatile-evidence refresh — 2026-09-01 18:41 KST\n\n" + "The connected GitHub account now exposes 73 ContextualWisdomLab repositories and the organization-wide atomic search reports 2,685 open pull requests. Fresh individual high-backlog reads report `ContextualWisdomLab/bandscope` 186, `ContextualWisdomLab/TEPP` 150, `ContextualWisdomLab/OriginWeave` 140, `ContextualWisdomLab/newsdom-api` 130, and `ContextualWisdomLab/naruon` 125. `ContextualWisdomLab/ConceptWeave` is present in the accessible repository set. This refresh supersedes the earlier queue snapshot for prioritization only; the earlier observations above remain historical doctoring evidence. BandScope remains first by live backlog and continues to own the end-user rehearsal product boundary.\n" + ) + if doctoring_text.count(anchor) != 1: + raise SystemExit("doctoring insertion anchor mismatch") + if "### Current volatile-evidence refresh — 2026-09-01 18:41 KST" not in doctoring_text: + doctoring_text = doctoring_text.replace(anchor, anchor + current_refresh, 1) + doctoring_path.write_text(doctoring_text, encoding="utf-8") + PY + git diff --check + git config user.name "cwl-source-repair[bot]" + git config user.email "cwl-source-repair[bot]@users.noreply.github.com" + git add docs/product-technical-gap-baseline.md docs/doctoring/product-gap-baseline-2026-09-01.md + git rm .github/workflows/repair-pr1116-gap-baseline.yml + git commit -m "docs(gap): refresh exact backlog and causal evidence" + git push origin HEAD:docs/gap-baseline-2026-08-31 From 3e6c5d8fd003be889ee8366b33e607971f6c6959 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 18:54:53 +0900 Subject: [PATCH 10/80] chore: remove dormant gap-baseline source-fix workflow --- .../workflows/repair-pr1116-gap-baseline.yml | 70 ------------------- 1 file changed, 70 deletions(-) delete mode 100644 .github/workflows/repair-pr1116-gap-baseline.yml diff --git a/.github/workflows/repair-pr1116-gap-baseline.yml b/.github/workflows/repair-pr1116-gap-baseline.yml deleted file mode 100644 index 1899fac30..000000000 --- a/.github/workflows/repair-pr1116-gap-baseline.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Repair PR1116 product-gap baseline - -on: - push: - branches: - - docs/gap-baseline-2026-08-31 - -permissions: - contents: write - -env: - GIT_CONFIG_COUNT: "1" - GIT_CONFIG_KEY_0: init.defaultBranch - GIT_CONFIG_VALUE_0: develop - -jobs: - repair_gap_baseline: - name: repair-gap-baseline - if: github.repository == 'ContextualWisdomLab/bandscope' - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - with: - ref: docs/gap-baseline-2026-08-31 - - name: Refresh volatile queue evidence and retire source-fix workflow - shell: bash - run: | - python3 - <<'PY' - from pathlib import Path - - baseline_path = Path("docs/product-technical-gap-baseline.md") - baseline_text = baseline_path.read_text(encoding="utf-8") - replacements = { - "Evidence capture: 2026-09-01 14:37 KST unless a row says otherwise": - "Evidence capture: 2026-09-01 18:41 KST unless a row says otherwise", - "A fresh organization-wide GitHub search at this capture includes **all 72 repositories currently accessible through the connected ContextualWisdomLab GitHub account** and reports **2,690 open pull requests** in total. Repository enumeration includes `ContextualWisdomLab/litellm-patched-proxy` and `ContextualWisdomLab/pingora-gateway`; the prior 71-repository and 2,697-PR snapshots are stale. Counts are volatile evidence, not product constants.": - "A fresh organization-wide GitHub search at this capture includes **all 73 repositories currently accessible through the connected ContextualWisdomLab GitHub account** and reports **2,685 open pull requests** in total. The accessible set now includes `ContextualWisdomLab/ConceptWeave`; earlier 72-repository queue snapshots are stale. Counts are volatile evidence, not product constants.", - "| 1 | `ContextualWisdomLab/bandscope` | **188** |\n| 2 | `ContextualWisdomLab/TEPP` | 142 |\n| 3 | `ContextualWisdomLab/OriginWeave` | 140 |\n| 4 | `ContextualWisdomLab/newsdom-api` | 130 |\n| 5 | `ContextualWisdomLab/naruon` | 127 |\n| 6 | `ContextualWisdomLab/html4tree` | 117 |\n| 7 | `ContextualWisdomLab/pg-erd-cloud` | 114 |\n| 8 | `ContextualWisdomLab/Orgmetra` | 113 |\n| 9 | `ContextualWisdomLab/.github` | 110 |": - "| 1 | `ContextualWisdomLab/bandscope` | **186** |\n| 2 | `ContextualWisdomLab/TEPP` | 150 |\n| 3 | `ContextualWisdomLab/OriginWeave` | 140 |\n| 4 | `ContextualWisdomLab/newsdom-api` | 130 |\n| 5 | `ContextualWisdomLab/naruon` | 125 |", - "- **#1119 Trivy PR-head evidence** correctly identifies a stale local policy-test conflict: CodeQL/Scorecard remain push-only local signals, while Trivy needs ordinary `pull_request` SARIF coverage. A failed temporary source-fix workflow was removed; the permanent policy-test repair belongs in normal source history, not in a dormant self-modifying workflow.": - "- **#1119 Trivy PR-head evidence** has an exact-head hosted failure isolated to the stale generic push-only policy test after 678 passing tests and 100% Python coverage. A bounded direct source repair is now materialized on the canonical branch to split CodeQL/Scorecard push-only assertions from Trivy ordinary-`pull_request` SARIF evidence; the temporary repair workflow deletes itself in the repair commit, and only the resulting exact head may provide completion evidence.", - "- **#1007/#1094 first-part-handoff** are not yet safe to collapse blindly. #1007 has absorbed the selected-role semantics at resolver/callout level, but mounted `Workspace` must pass its selected `activeRole` through and pin that integration before #1094 can be closed without losing unique production behavior.": - "- **#1007/#1094 first-part-handoff** advanced by concurrent normal history. Canonical #1007 now wires the mounted Workspace selected `activeRole` through the handoff callout, rejects stale role identities after song replacement, and removes the heuristic handoff fallback in favor of real stem activity. Its exact head `5261b1cbb15fd6587425c954c3480991394afc74` has freshly queued repository checks, so #1094 remains open until that unchanged canonical head is revalidated and its unique semantics are confirmed preserved." - } - for old_text, new_text in replacements.items(): - if baseline_text.count(old_text) != 1: - raise SystemExit(f"baseline replacement cardinality mismatch: {old_text[:80]!r}") - baseline_text = baseline_text.replace(old_text, new_text, 1) - baseline_path.write_text(baseline_text, encoding="utf-8") - - doctoring_path = Path("docs/doctoring/product-gap-baseline-2026-09-01.md") - doctoring_text = doctoring_path.read_text(encoding="utf-8") - anchor = "The replacement baseline therefore separates protected-source facts from timestamped GitHub observations and uses exact current-head examples instead of asserting one blocker for the entire queue.\n" - current_refresh = ( - "\n### Current volatile-evidence refresh — 2026-09-01 18:41 KST\n\n" - "The connected GitHub account now exposes 73 ContextualWisdomLab repositories and the organization-wide atomic search reports 2,685 open pull requests. Fresh individual high-backlog reads report `ContextualWisdomLab/bandscope` 186, `ContextualWisdomLab/TEPP` 150, `ContextualWisdomLab/OriginWeave` 140, `ContextualWisdomLab/newsdom-api` 130, and `ContextualWisdomLab/naruon` 125. `ContextualWisdomLab/ConceptWeave` is present in the accessible repository set. This refresh supersedes the earlier queue snapshot for prioritization only; the earlier observations above remain historical doctoring evidence. BandScope remains first by live backlog and continues to own the end-user rehearsal product boundary.\n" - ) - if doctoring_text.count(anchor) != 1: - raise SystemExit("doctoring insertion anchor mismatch") - if "### Current volatile-evidence refresh — 2026-09-01 18:41 KST" not in doctoring_text: - doctoring_text = doctoring_text.replace(anchor, anchor + current_refresh, 1) - doctoring_path.write_text(doctoring_text, encoding="utf-8") - PY - git diff --check - git config user.name "cwl-source-repair[bot]" - git config user.email "cwl-source-repair[bot]@users.noreply.github.com" - git add docs/product-technical-gap-baseline.md docs/doctoring/product-gap-baseline-2026-09-01.md - git rm .github/workflows/repair-pr1116-gap-baseline.yml - git commit -m "docs(gap): refresh exact backlog and causal evidence" - git push origin HEAD:docs/gap-baseline-2026-08-31 From a9220f544c1395c3d208a0d9d417dfeb2af463cd Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 20:05:50 +0900 Subject: [PATCH 11/80] docs(gap): refresh live queue ownership evidence --- docs/product-technical-gap-baseline.md | 43 ++++++++++---------------- 1 file changed, 17 insertions(+), 26 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 063b1eb95..f19dda100 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,7 +1,7 @@ # BandScope Product-Technical Gap Baseline Last updated: 2026-09-01 -Evidence capture: 2026-09-01 14:37 KST unless a row says otherwise +Evidence capture: 2026-09-01 20:04 KST unless a row says otherwise Protected base: `develop@749511c3ad4000090048718f685c6bee6b3d2c25` ## 1. Purpose and buyer outcome @@ -157,39 +157,27 @@ Acceptance criteria are preregistered before tuning. Candidate-vs-baseline infer | WCAG/Figma/Storybook parity | incomplete | #965 | | Sustainable merge train | incomplete | #966 | -## 5. Organization-wide live backlog evidence +## 5. Live backlog and delivery evidence -A fresh organization-wide GitHub search at this capture includes **all 72 repositories currently accessible through the connected ContextualWisdomLab GitHub account** and reports **2,690 open pull requests** in total. Repository enumeration includes `ContextualWisdomLab/litellm-patched-proxy` and `ContextualWisdomLab/pingora-gateway`; the prior 71-repository and 2,697-PR snapshots are stale. Counts are volatile evidence, not product constants. +Fresh repository searches in this delivery cycle report **185 open BandScope pull requests** and **18 open BandScope issues**, both with `incomplete_results=false`, above protected `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. These counts are volatile operational evidence, not product constants. -The highest-backlog candidates were re-fetched individually after the organization-wide recount: - -| Rank | Repository | Open PRs | -|---:|---|---:| -| 1 | `ContextualWisdomLab/bandscope` | **188** | -| 2 | `ContextualWisdomLab/TEPP` | 142 | -| 3 | `ContextualWisdomLab/OriginWeave` | 140 | -| 4 | `ContextualWisdomLab/newsdom-api` | 130 | -| 5 | `ContextualWisdomLab/naruon` | 127 | -| 6 | `ContextualWisdomLab/html4tree` | 117 | -| 7 | `ContextualWisdomLab/pg-erd-cloud` | 114 | -| 8 | `ContextualWisdomLab/Orgmetra` | 113 | -| 9 | `ContextualWisdomLab/.github` | 110 | - -BandScope remains the selected delivery lane because it has the largest live backlog **and** the repository owns the end-user rehearsal product whose duplicated workspace slices are contributing directly to buyer-delivery fragmentation. Selection is therefore based on both count and product responsibility, not repository name. +The most recent full organization recount recorded by canonical PR #1116 saw **73 accessible ContextualWisdomLab repositories** and an end-of-recount organization-wide search of **2,681 open pull requests**. That organization-wide recount was sequential and is retained only as capture-time prioritization evidence; this file does not represent it as an exact current total without another complete recount. Its last high-backlog capture was BandScope 185, TEPP 144, OriginWeave 140, newsdom-api 130, and naruon 125. BandScope remains the selected delivery lane because it combines the largest captured backlog with direct ownership of the end-user rehearsal product. ### 5.1 Current merge-loop evidence -Protected `develop` currently requires these status contexts, among others: `ci / build-and-test`, `dependency-review`, `security-audit`, `sbom`, `release-preflight`, Windows/macOS build gates, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, and CodeQL JavaScript/TypeScript + Python analysis. Required contexts are read from live branch protection before merge; this list is evidence from this capture, not permission to infer future policy. +Protected `develop` currently requires these status contexts: `ci / build-and-test`, `dependency-review`, `security-audit`, `sbom`, `release-preflight`, Windows/macOS build gates, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, and CodeQL JavaScript/TypeScript + Python analysis. Required contexts are read from live branch protection before merge; this list is evidence from this capture, not permission to infer future policy. -Current examples: +Current canonical ownership and succession evidence: -- **#1103 CSV NUL hardening is the canonical desktop export owner.** New duplicate #1121 touched the same three files and added one useful NUL-only assertion. That unique edge was transferred into #1103 in normal non-force history before #1121 was closed unmerged as superseded. No check/review evidence transfers between the PRs; #1103 needs fresh exact-head evidence after the consolidation commit. -- **#1119 Trivy PR-head evidence** correctly identifies a stale local policy-test conflict: CodeQL/Scorecard remain push-only local signals, while Trivy needs ordinary `pull_request` SARIF coverage. A failed temporary source-fix workflow was removed; the permanent policy-test repair belongs in normal source history, not in a dormant self-modifying workflow. -- **#1007/#1094 first-part-handoff** are not yet safe to collapse blindly. #1007 has absorbed the selected-role semantics at resolver/callout level, but mounted `Workspace` must pass its selected `activeRole` through and pin that integration before #1094 can be closed without losing unique production behavior. -- **#1116 is the canonical baseline owner.** Older #1025 was closed only after its unique PRD/TRD/UML/Rust/accuracy/security/accessibility/release requirements were preserved here. -- **Central required-workflow coverage is repaired at the owner, not in BandScope.** Current `ContextualWisdomLab/.github/main` inherited a 99% `scripts/ci` coverage regression from merged #1541. Competing #1547 was closed unmerged after exact patch comparison established #1551 as the more complete canonical owner. #1548 was then stacked on #1551 and merged normally into that branch as `c858ee4065dbda73b38150c95b635c0db7266a39`, preserving its unique CHANGELOG/G-13 traceability plus direct-RCA regression. The #1551 exact head changed as a result, so predecessor checks do not transfer; current security/review workflows are being regenerated before that central repair can land. +- **#783 is protected dependency-security truth.** It merged normally on 2026-08-25 as `7ad56cf0065d068ec6463d92726de4855a6e201d`; protected `develop@749511c3...` descends from it. Open feature branches must not keep treating the old inherited npm HIGH set as an unmerged external owner or suppress it locally. +- **#1103 remains the canonical desktop CSV NUL-hardening owner.** #1121 was closed only after its unique NUL-only regression transferred into #1103 in normal non-force history. No predecessor checks or reviews transferred. +- **#1007/#1094 first-part-handoff succession is not yet closable.** #1007 exact head `5261b1cbb15fd6587425c954c3480991394afc74` now contains mounted Workspace selected-role wiring, stale-role fail-open behavior, and the #1094 scientific requirement that heuristic fallback cannot manufacture handoffs. Exact-head Windows and macOS build gates remain queued, so #1094 stays open until the unchanged canonical head is revalidated and unique-requirement parity is reconfirmed. +- **#1116 is the canonical `docs/product-technical-gap-baseline.md` owner.** This source update replaces its stale 188-PR/72-repository and pre-transfer paragraphs with the live BandScope counts and current ownership evidence. The resulting commit creates a new exact head, so all predecessor check/review evidence is invalidated. +- **#968 is the canonical executable #966 queue-contract lane, stacked on #1116.** Its exact head at this capture is `ec825fa3226075a2cdf5281e487ccb2992cb11be`. Live GitHub evidence proved that `git/matching-refs/heads/` spans multiple pages in this repository; the prior single-response implementation could falsely declare a stacked base absent. #968 now has regression-first bounded branch-ref pagination, pagination-bound failure, malformed-page rejection, exact current PR heads, independent base-tip resolution, deterministic sorting, and symlink-safe atomic publication. It remains Draft with zero exact-head check runs, which is non-passing rather than green. +- **#1119 owns Trivy PR-head SARIF coverage.** Its PR body is stale relative to the actual branch head: the live head is `162247e2827434fa531c2d12204023c113d63b9c`, a one-file trigger commit for an existing bounded policy-repair writer. The stale `test_supply_chain_policy.py` assertion still needs the actual source repair and marker cleanup. This lane already has an active writer; do not create a duplicate policy-test writer or treat the trigger as product-fix evidence. +- **Central review-control repair #1546 is protected truth** in `ContextualWisdomLab/.github/main@5686de41660d51a7a7f22b8840dfa6ccfe5ff3f1`. The post-#1546 `scripts/ci` coverage regression remains outside BandScope source ownership. Canonical central owner #1567 is still open at exact head `400f2b5a63a5cdaf95a42ee4d49a4e492132738b`; it carries the 100% coverage restoration plus stacked Noema cleanup and needs its own fresh exact-head checks/review before protected-main integration. -Operational invariant: queued/pending/neutral/skipped/cancelled/failed, predecessor-head, protected-base, self/author, status-only, and model-only evidence is non-passing. Central-gate defects are repaired in the owning central repository; member branches do not weaken gates or use administrative bypass. +Operational invariant: queued/pending/neutral/skipped/cancelled/failed, absent, predecessor-head, protected-base, self/author, status-only, and model-only evidence is non-passing. Central-gate defects are repaired in the owning central repository; member branches do not weaken gates or use administrative bypass. ## 6. Prioritized product-technical backlog @@ -328,6 +316,9 @@ gh api search/issues -f q='org:ContextualWisdomLab is:pr is:open' --jq '.total_c # BandScope current queue gh pr list --state open --limit 500 --json number --jq 'length' +# BandScope current issue count +gh issue list --state open --limit 500 --json number --jq 'length' + # exact-head merge evidence for a candidate gh pr view --json number,state,isDraft,headRefOid,baseRefOid,reviews,statusCheckRollup From 6b72f5edc52c4da005ba53cb13b430c115fcc091 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 20:07:58 +0900 Subject: [PATCH 12/80] docs(gap): keep org count verification read-only --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index f19dda100..42e68290b 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -310,8 +310,8 @@ World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines (WCAG) # protected source identity git rev-parse develop -# organization-wide open PR count -gh api search/issues -f q='org:ContextualWisdomLab is:pr is:open' --jq '.total_count' +# organization-wide open PR count; -f remains a GET query because the method is explicit +gh api --method GET search/issues -f q='org:ContextualWisdomLab is:pr is:open' --jq '.total_count' # BandScope current queue gh pr list --state open --limit 500 --json number --jq 'length' From 860148bfb908bf645541cd792d4a918a563f3661 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 20:11:05 +0900 Subject: [PATCH 13/80] docs(gap): make queue completeness reproducible --- docs/product-technical-gap-baseline.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 42e68290b..c06cb7a7c 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -313,11 +313,11 @@ git rev-parse develop # organization-wide open PR count; -f remains a GET query because the method is explicit gh api --method GET search/issues -f q='org:ContextualWisdomLab is:pr is:open' --jq '.total_count' -# BandScope current queue -gh pr list --state open --limit 500 --json number --jq 'length' +# BandScope current PR count plus search completeness +gh api --method GET search/issues -f q='repo:ContextualWisdomLab/bandscope is:pr is:open' --jq '{total_count,incomplete_results}' -# BandScope current issue count -gh issue list --state open --limit 500 --json number --jq 'length' +# BandScope current issue count plus search completeness +gh api --method GET search/issues -f q='repo:ContextualWisdomLab/bandscope is:issue is:open' --jq '{total_count,incomplete_results}' # exact-head merge evidence for a candidate gh pr view --json number,state,isDraft,headRefOid,baseRefOid,reviews,statusCheckRollup From f6d917edb4b8729da397cd3044f3efc813d99e89 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 00:29:44 +0900 Subject: [PATCH 14/80] docs(gap): refresh canonical live product baseline --- docs/product-technical-gap-baseline.md | 365 ++++++------------------- 1 file changed, 78 insertions(+), 287 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index c06cb7a7c..6a5e076d2 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,340 +1,131 @@ # BandScope Product-Technical Gap Baseline Last updated: 2026-09-01 -Evidence capture: 2026-09-01 20:04 KST unless a row says otherwise -Protected base: `develop@749511c3ad4000090048718f685c6bee6b3d2c25` +Evidence capture: fresh live GitHub state from the current delivery run +Protected product truth: `develop@749511c3ad4000090048718f685c6bee6b3d2c25` -## 1. Purpose and buyer outcome +## Purpose -This document is the current engineering evidence baseline for BandScope. Customer-facing behavior follows `docs/brand-story.md`: practical, rehearsal-first, non-authoritative, and explicit about uncertainty. This file connects buyer promises to implementation boundaries, tests, research, security controls, and live GitHub evidence; those internals must not leak into product copy. +This document is the canonical product/technical gap baseline for BandScope. It separates protected shipped truth from active pull-request work, research/acceptance work, superseded work, and external control-plane dependencies. A PR body, predecessor check, model review, screenshot, or remembered SHA is never shipped truth. -BandScope is a local-first rehearsal companion for working musicians and band hobbyists who need to understand a song quickly and spend rehearsal time playing rather than decoding an arrangement. +BandScope is a local-first rehearsal decision product. The commercial loop is complete only when a musician can admit a real local recording, obtain evidence-backed rehearsal guidance, rehearse a precise passage, save and recover the project, share a bounded handoff, diagnose failures without leaking private media, and install/update/roll back a verifiable signed build. -```text -trusted install -→ admit a real song safely -→ derive evidence-backed section/role guidance -→ expose uncertainty and allow correction -→ rehearse a precise passage -→ save/recover accepted work -→ share a bounded handoff -→ update or roll back safely -``` +## 1. Live delivery authority -BandScope is not a DAW, notation editor, mandatory cloud service, or an authority that claims one analysis is unquestionably correct. +Fresh repository enumeration in this run reports **184 open pull requests** and **18 open issues**, with GitHub search `incomplete_results=false`. These counts are operational capture data and will change under concurrent writers. -### 1.1 Buyer-facing PRD +Protected `develop` requires the following contexts before normal integration: `ci / build-and-test`, `dependency-review`, `security-audit`, `sbom`, `release-preflight`, `gate / build / windows`, `gate / build / macos`, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, `Analyze (javascript-typescript)`, and `Analyze (python)`. -Core jobs: +Operational evidence rule: queued, pending, skipped-required, cancelled, neutral, failed, absent, stale, predecessor-head, protected-base, model-only, status-only, self/author, or administrative-bypass evidence is non-passing. A head change invalidates predecessor review/check receipts. Force-push, destructive rebase, self-approval, gate weakening, fabricated evidence, and unrelated rollback are prohibited. -1. identify what each instrument/vocal role should prepare; -2. understand form, entries/dropouts, timing, harmony, range, overlap, handoffs, and setup cues by section; -3. rehearse the highest-value passage without rebuilding transport in another tool; -4. correct uncertain analysis while retaining model/user provenance; -5. return later without losing accepted work; -6. install/update a build whose identity and provenance can be verified. +No open BandScope PR returned a qualifying `review:approved` result in the fresh approval sweep in this run. Therefore no protected merge is claimed by this baseline. -Representative user stories: +## 2. Shipped protected truth -- As a player, I can open a local song and see the first useful rehearsal action without learning a DAW. -- As a band member, I can see section×role guidance rather than a single flat song-wide chord track. -- As a user, I can distinguish machine evidence from user-confirmed correction. -- As a player, I can count in, loop, navigate cues, and use the same controls from keyboard and assistive technology. -- As a returning user, I can recover the last known-good project after a crash, interrupted write, migration, or failed update. +Only behavior reachable from protected `develop@749511c3ad4000090048718f685c6bee6b3d2c25` belongs in this section. -## 2. Current architecture and responsibility boundaries +- BandScope is a React/Vite desktop workspace hosted by Tauri with local orchestration and a Python analysis service plus Rust/PyO3 numerical kernels. +- Typed Tauri IPC and bounded local process boundaries are the intended local execution model; ordinary rehearsal analysis does not require a public cloud service. +- Protected dependency-security repair #783 is already in `develop` ancestry. Open branches must not reframe its historical dependency findings as an unmerged product blocker or suppress them locally. +- The product already renders rehearsal-oriented section/role evidence, but protected truth does **not** yet satisfy the complete active-player, crash-recovery, real-audio acceptance, diagnostics, activation, accessibility-parity, or trusted-distribution contracts below. +- Latest published GitHub Release observed in this run is `v0.1.3` (2026-04-28). It is historical release evidence, not proof that the current protected head satisfies the commercial release gate. -Protected `develop` remains a local desktop architecture: +## 3. Canonical active workstreams -- `apps/desktop`: React/Vite rehearsal workspace in a Tauri shell; -- `apps/desktop/src-tauri`: native command/orchestration boundary; -- `apps/desktop/core`: Rust authority/input validation helpers; -- `packages/shared-types`: versioned cross-layer contracts; -- `services/analysis-engine`: current Python orchestration plus still-mixed music-analysis code; -- `services/analysis-engine/rust`: `bandscope_numeric` Rust/PyO3 numerical kernels. +Active work is not shipped truth until it is normally integrated into protected `develop` with current-head gates and qualifying independent review. -Typed Tauri IPC and bounded stdin/stdout JSON are the local orchestration path; ordinary local analysis does not require a loopback HTTP server or cloud service. Files, URLs, project data, model artifacts, PDFs, subprocess output, exports, and diagnostics are untrusted at their owning boundaries. - -### 2.1 DDD context map - -```mermaid -flowchart LR - U[Musician / band member] - UI[Rehearsal Workspace\nUI Context] - RI[Rehearsal Intelligence\nCore Domain] - IN[Local Intake & Project\nSupporting Context] - PT[Playback & Transport\nSupporting Context] - RH[Release & Recovery\nSupporting Context] - CO[Collaboration / Handoff\nSupporting Context] - SK[Minimal Shared Contract Kernel] - ACL[External codecs / models / tools\nAnti-Corruption Layer] - - U --> UI - UI --> SK - SK --> RI - SK --> IN - SK --> PT - SK --> CO - IN --> ACL - RI --> ACL - RH --> UI -``` - -Core subdomain: **Rehearsal Intelligence**. Supporting subdomains: Local Intake & Project, Playback & Transport, Release & Recovery, and bounded Collaboration/Handoff. Generic concerns: logging, localization, accessibility primitives, release metadata, and supply-chain evidence. - -Shared Kernel stays intentionally small: stable identifiers plus section/role/cue/confidence/provenance and versioned interchange contracts. Codec, Demucs/librosa-era, PDF, platform, and accelerator types remain behind Anti-Corruption Layers. - -### 2.2 Ubiquitous language, aggregates, invariants, events - -| Term | Meaning | Invariant / transaction boundary | +| Boundary | Canonical live owner / evidence | Current status | |---|---|---| -| `RehearsalProject` | durable work for one admitted rehearsal source | one published project version; no partial publication | -| `SongSection` | time-bounded structural region | ordered, finite range inside admitted media duration | -| `RehearsalRole` | instrument, vocal function, or useful subdivision | guidance belongs to a section/project and retains provenance | -| `RehearsalCue` | actionable entry/stop/pickup/handoff/range/setup/timing instruction | referenced section/time/role remains resolvable | -| `AnalysisEvidence` | versioned machine estimate with confidence/provenance | never silently promoted to user-confirmed truth | -| `ManualOverride` | user-confirmed correction | preserves original evidence and authoring provenance | -| `RehearsalTransport` | count-in/loop/playback/navigation state | one authoritative state machine; no competing writers | - -Candidate domain events: `AnalysisCompleted`, `CueConfirmed`, `SectionBoundaryCorrected`, `LoopActivated`, `ProjectSnapshotPublished`, `ProjectRecovered`, and `UpdateRollbackCompleted`. - -## 3. Technical design contract (TRD) - -### 3.1 Rust owns repository core computation - -Protected `develop` is still mixed: Rust owns selected numerical kernels, while material DSP/feature/ranking work remains Python/NumPy. That is a product-technical gap, not a permanent target architecture. - -Target contract: - -- repository-owned mathematical, DSP, vector, matrix, exploratory/data-science, ranking/weighting, token-size, and other core analysis computation is Rust; -- Python may remain only as bounded orchestration/compatibility while migration is incomplete; -- CPU execution uses bounded multithreading with avoidable context switching removed; -- accelerator support is explicit and measured: CPU baseline, then validated CUDA/OpenCL/MLX adapters where meaningful; -- Rust↔Python parity proves migration correctness but does not justify a hidden permanent Python numerical fallback; -- no heuristic weight or rule-of-thumb threshold is accepted without a documented measurement model, calibration dataset, or research basis. - -Migration order follows buyer impact and dependency leverage: temporal/beat and harmony → range/pitch/role features → prioritization/weighting → source-separation integration → remaining vector/matrix utilities. - -### 3.2 Real-audio measurement contract - -Synthetic fixtures are acceptable for unit tests but are not product-accuracy evidence. GA evidence requires licensed or redistribution-safe real audio and human-verified ground truth. - -Task-specific metrics remain separate: - -- harmony/chords: benchmark-defined chord metric such as Weighted Chord Symbol Recall; -- beat/timing: listener-annotated event metrics compatible with the chosen MIREX task contract; -- source separation: SI-SDR plus task-appropriate robustness/perceptual evidence; -- range/pitch/transcription: reference-note/frame/event metrics declared with the corpus; -- section/cue boundaries: time-tolerant event metrics whose tolerance comes from annotation uncertainty and rehearsal error cost, not an unexplained constant. - -Acceptance criteria are preregistered before tuning. Candidate-vs-baseline inference reports uncertainty across tracks; CI thresholds are never invented merely to obtain green status. - -### 3.3 Persistence, playback, release, privacy - -- **Project source of truth — Issue #962:** atomic publication, known-good backup, deterministic/idempotent migration, bounded inputs, explicit single-writer/locking ownership, tested crash recovery. -- **Active rehearsal player — Issue #961:** precise loop/count-in/rate/cue/role interaction; timing-sensitive transport belongs in Rust; real-time callbacks do no unbounded allocation, blocking I/O, network access, or lock-heavy work. -- **Trusted distribution — Issue #960:** signed/notarized artifacts, verifiable updater metadata, SPDX SBOM/provenance, staged rollout and rollback evidence. -- **Private diagnostics — Issue #963:** ordinary logs/support bundles exclude raw private audio, secrets, full local paths, and dependency-controlled exception payloads. - -## 4. Capability and gap matrix - -| Capability | Current direction | Remaining buyer-visible gap | -|---|---|---| -| Local file intake | implemented authority boundary | complete resource budgets and cross-platform fault evidence | -| YouTube import | policy-constrained/partial | honest failure guidance; no DRM/login bypass | -| Section×role hierarchy | represented | real-audio accuracy + correction round trip | -| Harmony guidance | implemented/mixed compute | calibrated evidence, Rust ownership, uncertainty quality | -| Groove/beat/timing | implemented/mixed compute | real-audio benchmark, Rust ownership, full production integration | -| Range/overlap | implemented | reference-audio validation + Rust migration | -| Stems/source separation | partial | platform/accelerator coverage, artifact provenance, real-audio SI-SDR | -| Confidence/provenance | represented | calibration + user correction persistence | -| Rehearsal action map | many open slices | consolidate micro-PRs into coherent section/role UX | -| Active player | incomplete | #961 | -| Crash-safe project/autosave | incomplete | #962 | -| Signed/notarized update/rollback | partial | #960 | -| Private support bundle | incomplete | #963 | -| Licensed first-run demo | incomplete | #964 | -| WCAG/Figma/Storybook parity | incomplete | #965 | -| Sustainable merge train | incomplete | #966 | - -## 5. Live backlog and delivery evidence - -Fresh repository searches in this delivery cycle report **185 open BandScope pull requests** and **18 open BandScope issues**, both with `incomplete_results=false`, above protected `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. These counts are volatile operational evidence, not product constants. - -The most recent full organization recount recorded by canonical PR #1116 saw **73 accessible ContextualWisdomLab repositories** and an end-of-recount organization-wide search of **2,681 open pull requests**. That organization-wide recount was sequential and is retained only as capture-time prioritization evidence; this file does not represent it as an exact current total without another complete recount. Its last high-backlog capture was BandScope 185, TEPP 144, OriginWeave 140, newsdom-api 130, and naruon 125. BandScope remains the selected delivery lane because it combines the largest captured backlog with direct ownership of the end-user rehearsal product. - -### 5.1 Current merge-loop evidence - -Protected `develop` currently requires these status contexts: `ci / build-and-test`, `dependency-review`, `security-audit`, `sbom`, `release-preflight`, Windows/macOS build gates, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, and CodeQL JavaScript/TypeScript + Python analysis. Required contexts are read from live branch protection before merge; this list is evidence from this capture, not permission to infer future policy. - -Current canonical ownership and succession evidence: - -- **#783 is protected dependency-security truth.** It merged normally on 2026-08-25 as `7ad56cf0065d068ec6463d92726de4855a6e201d`; protected `develop@749511c3...` descends from it. Open feature branches must not keep treating the old inherited npm HIGH set as an unmerged external owner or suppress it locally. -- **#1103 remains the canonical desktop CSV NUL-hardening owner.** #1121 was closed only after its unique NUL-only regression transferred into #1103 in normal non-force history. No predecessor checks or reviews transferred. -- **#1007/#1094 first-part-handoff succession is not yet closable.** #1007 exact head `5261b1cbb15fd6587425c954c3480991394afc74` now contains mounted Workspace selected-role wiring, stale-role fail-open behavior, and the #1094 scientific requirement that heuristic fallback cannot manufacture handoffs. Exact-head Windows and macOS build gates remain queued, so #1094 stays open until the unchanged canonical head is revalidated and unique-requirement parity is reconfirmed. -- **#1116 is the canonical `docs/product-technical-gap-baseline.md` owner.** This source update replaces its stale 188-PR/72-repository and pre-transfer paragraphs with the live BandScope counts and current ownership evidence. The resulting commit creates a new exact head, so all predecessor check/review evidence is invalidated. -- **#968 is the canonical executable #966 queue-contract lane, stacked on #1116.** Its exact head at this capture is `ec825fa3226075a2cdf5281e487ccb2992cb11be`. Live GitHub evidence proved that `git/matching-refs/heads/` spans multiple pages in this repository; the prior single-response implementation could falsely declare a stacked base absent. #968 now has regression-first bounded branch-ref pagination, pagination-bound failure, malformed-page rejection, exact current PR heads, independent base-tip resolution, deterministic sorting, and symlink-safe atomic publication. It remains Draft with zero exact-head check runs, which is non-passing rather than green. -- **#1119 owns Trivy PR-head SARIF coverage.** Its PR body is stale relative to the actual branch head: the live head is `162247e2827434fa531c2d12204023c113d63b9c`, a one-file trigger commit for an existing bounded policy-repair writer. The stale `test_supply_chain_policy.py` assertion still needs the actual source repair and marker cleanup. This lane already has an active writer; do not create a duplicate policy-test writer or treat the trigger as product-fix evidence. -- **Central review-control repair #1546 is protected truth** in `ContextualWisdomLab/.github/main@5686de41660d51a7a7f22b8840dfa6ccfe5ff3f1`. The post-#1546 `scripts/ci` coverage regression remains outside BandScope source ownership. Canonical central owner #1567 is still open at exact head `400f2b5a63a5cdaf95a42ee4d49a4e492132738b`; it carries the 100% coverage restoration plus stacked Noema cleanup and needs its own fresh exact-head checks/review before protected-main integration. - -Operational invariant: queued/pending/neutral/skipped/cancelled/failed, absent, predecessor-head, protected-base, self/author, status-only, and model-only evidence is non-passing. Central-gate defects are repaired in the owning central repository; member branches do not weaken gates or use administrative bypass. - -## 6. Prioritized product-technical backlog - -Priority is buyer impact × dependency leverage × risk, not PR age. - -### P0 — trustworthy product completion - -1. **Sustainable exact-head merge throughput — #966.** Consolidate duplicate/superseded writers, require current-head terminal gates, zero actionable threads, and current qualifying independent non-author approval. -2. **Real-audio accuracy — #770.** Licensed corpora, human truth, task-specific metrics, preregistered statistical acceptance, reproducible artifacts. -3. **Rust core-computation migration.** Inventory every DSP/math/vector/matrix/data-science call path and move production ownership to Rust with CPU multithread + explicit accelerator boundaries. -4. **Resource/filesystem authority completion.** Bounded duration/size/allocation, cancellation, path containment, model/PDF bounds, and cross-platform production-path fault tests. - -### P1 — close the rehearsal loop - -5. **Active rehearsal player — #961.** -6. **Crash-safe project/autosave — #962.** -7. **Trusted distribution/update/rollback — #960.** -8. **Private diagnostics/supportability — #963.** -9. **Licensed first-run rehearsal — #964.** -10. **WCAG 2.2 AA + Figma/Storybook/shipped parity — #965.** - -### P2 — analytical depth after the core loop is reliable - -11. Replace unbounded “first-X” plan-field micro-PR growth with coherent engine-generated role guidance, conflict rules, priority, and edit provenance. -12. Replace untraceable weights/priors with documented literature/calibration evidence and sensitivity tests. -13. Preserve the `song → section → role → time` hierarchy; use multilevel/time-dependent evidence where it materially improves rehearsal decisions instead of atomistic aggregation. -14. Harden model artifact provenance and reproducibility across CPU/CUDA/OpenCL/MLX-supported paths. -15. Expand collaboration only behind a stable local-first project/handoff contract and a clear buyer outcome. - -## 7. Quality, UX, test, security, and operability baseline - -### 7.1 Coverage and documentation - -- Python production coverage/docstring policy is 100% in repository guidance. -- Protected JavaScript configs still contain 90% thresholds in parts of the repository; this is below the target contract. -- Target: **100% statement coverage, 100% branch/edge-case coverage, and 100% public/repository-owned API documentation coverage** for owned production surfaces. A lower configured threshold is a gap, not equivalent evidence. - -### 7.2 Realistic validation - -Minimum scenario inventory includes supported 44.1/48/96 kHz audio, mono/stereo, short/long recordings, pickup before bar one, odd meter, tempo change, silence near boundaries, unsupported codecs, moved/replaced files, device changes, cancellation, disk full, corrupted project state, migration interruption, unavailable source separation, and uncertainty correction round trips. +| Merge-train control plane | Issue #966 with executable queue lane PR #968 | #968 is Draft and stacked on this baseline lane; exact current-head hosted checks are absent, therefore non-passing | +| Canonical baseline | PR #1116, this file | Open; this refresh creates a new exact head and invalidates predecessor evidence | +| Trusted distribution | Issue #960 | Windows signing, macOS signing/notarization, checksums, SBOM/provenance, signature-verified updater, staged rollout, rollback/repair, and version identity parity remain incomplete as one integrated protected-head receipt | +| Active rehearsal player | Issue #961; implementation lane #971 | Real authorized local audio playback/seek/stop/loop/rate/cue transport is active work; audible trusted-tempo count-in remains a separate unique behavior in #1070 until integrated into one transport state machine | +| Crash-safe project | Issue #962; implementation lane #970 | Atomic publication, versioned format, recovery, migration, autosave, rollback/export and persisted transport state remain active work, not protected truth | +| Real-audio science | Issue #770; Draft benchmark lane #828 | Rights-safe decoded-audio MIR acceptance, recognized metrics, uncertainty and reproducible evidence remain incomplete | +| Resource admission/decode | Issue #781; overlapping active lanes require semantic reconciliation | No synthetic/mock success may substitute for production-path resource/cancellation evidence | +| Diagnostics/supportability | Issue #963 | Typed redacted crash/hang evidence and user-previewable offline support bundle remain incomplete | +| Activation | Issue #964; licensed-demo work exists in active PRs | A measured production-path first rehearsal remains incomplete | +| Accessibility/design parity | Issue #965; design/Storybook work remains active | WCAG 2.2 AA, keyboard/screen-reader parity, EN/KO expansion, exact-value alternatives and current-head UI evidence remain incomplete | +| Quality floor | PR #1057 and successors | Repository-owned production statement/branch coverage and public API documentation target remain 100%; lower configured thresholds are a gap | -### 7.3 UI/design acceptance +The product boundary, tests, contracts, and unique behavior decide succession—not PR number or title. In this run #1123 and #1074 were closed only after exact semantic comparison proved canonical Score accessibility lane #731 already preserved their production behavior and regressions. Their checks/reviews did not transfer. -Storybook is the executable component/interaction inventory; Figma is reviewed design/handoff evidence, not a second runtime authority. UI changes require screenshot-backed validation of relevant states and edge cases, keyboard/focus behavior, touch target sizing, responsive layout, typography/color contrast, animation/reduced-motion, forms/feedback, navigation, and data visualization alternatives. Repeated visual objects belong behind shared tokens/components, not per-feature drift. +## 4. Merge-train and succession contract -Customer copy names the next action and never exposes repository/module boundaries. English/Korean semantics stay aligned. +Backlog convergence is the primary engineering risk because micro-PR fan-out creates duplicate writers, stale evidence, dependency ambiguity, and review/check churn. -### 7.4 Security and supply chain +PR #968 owns the unique executable queue machinery needed by #966: bounded GitHub pagination, exact active-head capture, independent base-tip resolution, deterministic ordering, malformed/incomplete/duplicate rejection, reviewed dependency/succession metadata, network-independent validation, and symlink-safe atomic publication. It must not be discarded as stale documentation. -- ordinary analysis stays local and network-independent; -- files/URLs/metadata/models/PDFs/project state/subprocess output are untrusted; -- capabilities are narrow and allowlisted; no generic exec/read/write surface; -- Dependency Review, OSV, Trivy, CodeQL, secret scanning, SBOM, release provenance, and cross-platform build controls remain fail-closed; -- suppressions are not a substitute for root-cause remediation; -- signing/release credentials never enter repository files or ordinary artifacts. +During this run #968 was non-destructively restacked on the current #1116 baseline branch with ordinary merge commit `2c44a37eea2b752dab55a01d7e9d11e1654f1810`. Immediately before this baseline refresh that exact queue head was 56 commits ahead and 0 behind the then-current #1116 head, and the semantic delta remained the 15 queue-contract files. Because this file is now being refreshed, #968 must be restacked again on the resulting new #1116 head before either lane can be considered current. No predecessor checks/reviews transfer across that restack. -### 7.5 Release/operability +PR #1007 is the canonical first-part-handoff lane after the unique scientific fallback prohibition from #1094 was transferred; #1094 is now closed. The #1007 branch moved normally during this run, so its PR-body SHA is stale and its independently resolved live head must be used before any action. Normal concurrent branch movement is not a race condition by itself. -GA requires protected-source identity, reproducible build evidence, checksums, SPDX SBOM/provenance, supported architecture matrix, signatures, macOS notarization, verified update metadata, offline startup, and tested repair/rollback. A development artifact alone is not GA evidence. +Duplicate closure requires a technical succession receipt naming the unique behavior/tests preserved in the successor. Draft status is used only for a real unverified/blocking boundary; it is never toggled solely to retrigger CI. -## 8. UML / state supplements +## 5. Domain model and ownership -### 8.1 Import → analyze → rehearse +BandScope keeps these bounded contexts distinct: -```mermaid -sequenceDiagram - actor U as User - participant UI as React Workspace - participant T as Tauri Shell - participant V as Rust Authority Boundary - participant O as Analysis Orchestration - participant R as Rust Analysis Core +1. **Audio Ingestion** — user-selected source authority and intake intent. +2. **Resource Admission & Decode** — codec/MIME/path/resource/cancellation boundaries. +3. **Signal/MIR Analysis** — decoded-audio evidence and uncertainty. +4. **Rehearsal Insight** — section×role decisions, cues, confidence and correction provenance. +5. **Active Player** — one authoritative transport state machine for play/pause/seek/stop/loop/count-in/rate/cue navigation and source-backed stem controls. +6. **Project Persistence** — format version, atomic publication, autosave, migration, backup/recovery and portable export. +7. **Collaboration Handoff** — bounded share/export contracts, never a second project source of truth. +8. **Diagnostics/Support** — typed redacted evidence and support bundle lifecycle. +9. **Distribution/Update** — signed identity, SBOM/provenance, updater verification, rollout and rollback. +10. **UI/Interaction** — accessible, localized rendering of domain state; no duplicated transport/project stores. - U->>UI: Choose local audio - UI->>T: typed intake command - T->>V: validate path/project/resource authority - V-->>T: admitted source reference - T->>O: start bounded analysis job - O->>R: compute section/role/temporal evidence - R-->>O: versioned evidence + confidence - O-->>T: progress / completed result - T-->>UI: analysis-job-updated - UI-->>U: rehearsal action + uncertainty + correction path -``` +Generic `utils`, `helpers`, `common`, `services`, `shared`, `core`, or `models` dumping that erases these responsibilities is a defect. Cross-context persistence and duplicated local transport stores are also defects. -### 8.2 Project state machine +`context-graph-contracts` remains the contract-only shared kernel for canonical refs, authority/truth status, bitemporal/provenance Context Assertions, CloudEvents, schemas and conformance. `enterprise-architecture-core` remains the EA Decision Plane. While their dedicated writer is active they are read-only dependencies here; BandScope projects deployable/runtime/version/risk facts through released contracts and does not copy rehearsal audio/analysis/user truth into EA authoritative storage. -```mermaid -stateDiagram-v2 - [*] --> Clean - Clean --> Dirty: accepted mutation - Dirty --> Staging: autosave/manual save - Staging --> Published: validate + atomic replace - Staging --> Dirty: failure; retain known-good - Published --> Dirty: next mutation - Published --> RecoveryAvailable: unclean shutdown/newer recovery evidence - RecoveryAvailable --> Published: restore validated snapshot - RecoveryAvailable --> Clean: discard recovery evidence -``` +## 6. Real-audio scientific acceptance -## 9. Research and standards traceability +Synthetic arrays, mocked UI journeys, direct feature matrices, source-text assertions, or generated audio may support unit tests but cannot prove product accuracy. -Standards are evaluation structures, not decoration: +Commercial acceptance requires rights-safe real audio to pass the production intake → decode → analysis → UI path with fixture/annotation/license provenance. Metrics remain task-specific: chord/harmony evaluation uses a recognized chord metric such as benchmark-defined weighted chord recall; beat/timing uses recognized event metrics; separation uses SI-SDR plus task-appropriate robustness/perceptual evidence; range/pitch/transcription uses declared note/frame/event metrics; section/cue boundaries use tolerances derived from annotation uncertainty and rehearsal cost rather than an invented constant. -- ISO/IEC 25010:2023 supplies the product-quality model for specifying/evaluating software quality characteristics. -- NIST SP 800-218 SSDF v1.1 supplies outcome-oriented secure-development practices and traceable security requirements/design decisions. -- WCAG 2.2 is the current W3C Recommendation baseline for desktop-webview accessibility. -- MIREX task definitions provide domain-relevant precedent using real audio and human/listener annotation. -- MIR evidence remains task-specific: Foote for self-similarity/novelty, Viterbi for sequence decoding, Le Roux et al. for SI-SDR, and benchmark-specific corpora/metrics for harmony. These references do not justify unrelated hand-tuned product weights. +Acceptance criteria are preregistered before tuning and report uncertainty across tracks. Configured GPU lanes must actually execute and report parity/peak-resource evidence; unsupported hardware is not converted into a passing claim. -### References (APA 7th) +## 7. Rust compute ownership -Foote, J. (1999). Visualizing music and audio using self-similarity. In *Proceedings of the Seventh ACM International Conference on Multimedia* (pp. 77–80). Association for Computing Machinery. +Protected code is still mixed: selected numerical kernels are Rust/PyO3 while material analysis orchestration and some arithmetic remain Python/NumPy. The target architecture is Rust-first for repository-owned DSP, mathematical, vector, linear/matrix, data-science/ranking, and token-size core arithmetic. -International Organization for Standardization, & International Electrotechnical Commission. (2023). *ISO/IEC 25010:2023 Systems and software engineering—Systems and software Quality Requirements and Evaluation (SQuaRE)—Product quality model* (2nd ed.). ISO. +Python is bounded orchestration/compatibility/fixture/reporting during migration. CPU reference behavior should be deterministic `f64` where scientifically appropriate, with bounded multithreading and unnecessary context switching removed. CUDA/OpenCL/MLX paths require real backend execution, parity and resource evidence where configured. A hidden Python numerical fallback is not the target architecture. -Le Roux, J., Wisdom, S., Erdogan, H., & Hershey, J. R. (2019). SDR—Half-baked or well done? In *2019 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)* (pp. 626–630). IEEE. +## 8. Security and privacy baseline -Music Information Retrieval Evaluation eXchange. (2025). *Audio beat tracking*. MIREX Wiki. https://music-ir.org/mirex/wiki/2025:Audio_Beat_Tracking +Local files, URLs, MIME/codec claims, decoder outputs, model artifacts, project files, updater manifests, subprocess output and support exports are untrusted. -Souppaya, M., Scarfone, K., & Dodson, D. (2022). *Secure Software Development Framework (SSDF) Version 1.1: Recommendations for mitigating the risk of software vulnerabilities* (NIST Special Publication 800-218). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-218 +Owning contexts must fail closed on path/symlink/reparse traversal, oversized/decompression/resource exhaustion, unsafe subprocess authority, credential/secret propagation and prompt-injection crossings. Valid source-backed GHAS/CodeQL/Semgrep/Strix/AppGuardrail findings are deduplicated by root cause and repaired in the canonical product lane. Scanner/control-plane defects remain with their owning repository; BandScope does not blanket-mask findings or weaken gates. -Viterbi, A. J. (1967). Error bounds for convolutional codes and an asymptotically optimum decoding algorithm. *IEEE Transactions on Information Theory, 13*(2), 260–269. +Ordinary logs/support bundles must not contain raw audio/project payloads, credentials or absolute local paths. Authorization is purpose-bound and least-privilege with field minimization, retention and access/export audit where relevant. -World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines (WCAG) 2.2*. https://www.w3.org/TR/WCAG22/ +Central `.github` PR #1546 review-control repair is merged protected truth. A previously cited central coverage owner, `.github#1567`, is closed unmerged and must not be presented as a live dependency owner. A fresh central successor must be resolved before attributing that control-plane work. -## 10. Re-runnable verification +## 9. UI/UX evidence gate -```bash -# protected source identity -git rev-parse develop +The live canonical design file referenced by protected BandScope docs in this run is Figma file `zthWmqfNKUgJBECvv002Qk`. A remembered design ID is not authority. -# organization-wide open PR count; -f remains a GET query because the method is explicit -gh api --method GET search/issues -f q='org:ContextualWisdomLab is:pr is:open' --jq '.total_count' +Storybook is the executable component/state inventory, Figma is the reviewed interaction/visual specification, and the shipped Tauri application is the final acceptance target. Material UI work must verify real pointer/touch/keyboard interaction, section/time-axis identity, playback cursor, persistence/reload, stale-response races, loading/partial/error/unsupported-codec/missing-stem states, responsive window sizes, visible focus, reduced motion, non-color-only status, screen-reader names/states, EN/KO expansion and exact-value/list/table alternatives for graph/timeline/waveform content. -# BandScope current PR count plus search completeness -gh api --method GET search/issues -f q='repo:ContextualWisdomLab/bandscope is:pr is:open' --jq '{total_count,incomplete_results}' +A screenshot from a predecessor head, a Storybook-only state, or a Figma-only mock is not shipped UI evidence. -# BandScope current issue count plus search completeness -gh api --method GET search/issues -f q='repo:ContextualWisdomLab/bandscope is:issue is:open' --jq '{total_count,incomplete_results}' +## 10. Release gate -# exact-head merge evidence for a candidate -gh pr view --json number,state,isDraft,headRefOid,baseRefOid,reviews,statusCheckRollup +A release may be created only from one exact integrated protected head where all applicable CI/security/SAST/dependency/coverage/documentation/real-audio/build/package gates, Windows signing, macOS signing/notarization, checksums, SBOM/provenance, reproducibility, independent review, project migration/recovery, accessibility/supportability, updater rollback and operability evidence are terminal-success on that same identity. -# product/doctoring Mermaid inventory -git grep -n '```mermaid' -- docs ARCHITECTURE.md +Unsigned validation artifacts are not releases. Queued evidence, stale Figma versions and mock-only audio journeys cannot establish release readiness. -# JS threshold gap -git grep -n '90' -- apps/desktop/vite.config.ts packages/shared-types/vitest.config.ts +## 11. Traceability -# Rust numerical ownership and remaining Python production modules -git grep -n 'checkerboard_novelty\|viterbi_decode' -- services/analysis-engine/rust services/analysis-engine/src -find services/analysis-engine/src/bandscope_analysis -type f -name '*.py' -print +Primary normative/research anchors for this baseline include: -# real-audio test fixture inventory -find . -type f \( -path '*/tests/*' -o -path '*/test/*' \) \ - \( -iname '*.wav' -o -iname '*.flac' -o -iname '*.mp3' \) -not -path './.git/*' -print -``` +- World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines (WCAG) 2.2*. https://www.w3.org/TR/WCAG22/ +- National Institute of Standards and Technology. (2022). *Secure Software Development Framework (SSDF) Version 1.1 (NIST SP 800-218)*. https://csrc.nist.gov/pubs/sp/800/218/final +- Music Information Retrieval Evaluation eXchange. (n.d.). *MIREX*. https://www.music-ir.org/mirex/ +- Raffel, C., McFee, B., Humphrey, E. J., Salamon, J., Nieto, O., Liang, D., Ellis, D. P. W., & Raffel, C. C. (2014). mir_eval: A transparent implementation of common MIR metrics. *Proceedings of the 15th International Society for Music Information Retrieval Conference*, 367–372. -Every GitHub state in this document is capture-time evidence. Immediately before a merge, re-fetch the unchanged exact head, current branch protection, all required checks, review decision, unresolved threads, dependency/ancestry order, and concurrent writer state. +Repository ADRs, PRD/TRD, architecture/context-map documents, security/threat-model material, test strategy, operability/recovery guidance, UI/Storybook inventory and doctoring traceability must remain code-current. Active PRs, planned work and research results are never promoted into the shipped section before protected integration. From a54127bef83fce7b7f7f926a9c85c655f7a89236 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 00:45:39 +0900 Subject: [PATCH 15/80] docs(gap): refresh live backlog and Trivy ownership --- docs/product-technical-gap-baseline.md | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 6a5e076d2..0262af6e7 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # BandScope Product-Technical Gap Baseline -Last updated: 2026-09-01 +Last updated: 2026-09-02 Evidence capture: fresh live GitHub state from the current delivery run Protected product truth: `develop@749511c3ad4000090048718f685c6bee6b3d2c25` @@ -12,13 +12,13 @@ BandScope is a local-first rehearsal decision product. The commercial loop is co ## 1. Live delivery authority -Fresh repository enumeration in this run reports **184 open pull requests** and **18 open issues**, with GitHub search `incomplete_results=false`. These counts are operational capture data and will change under concurrent writers. +A fresh complete accessible-repository census in this run found **74 accessible ContextualWisdomLab repositories** and **2,722 organization-wide open pull requests** with GitHub search `incomplete_results=false`. At selection time `ContextualWisdomLab/bandscope` had **184 open pull requests**, the highest verified repository backlog and the buyer-visible local-first rehearsal workspace/analysis/export boundary. After the exact-head security-authority consolidation described below closed redundant PR #1119 without merge, a fresh BandScope search reported **183 open pull requests** while the organization-wide total remained **2,722** because a concurrent writer opened work elsewhere. These are capture-time operational data, not immutable totals. Protected `develop` requires the following contexts before normal integration: `ci / build-and-test`, `dependency-review`, `security-audit`, `sbom`, `release-preflight`, `gate / build / windows`, `gate / build / macos`, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, `Analyze (javascript-typescript)`, and `Analyze (python)`. Operational evidence rule: queued, pending, skipped-required, cancelled, neutral, failed, absent, stale, predecessor-head, protected-base, model-only, status-only, self/author, or administrative-bypass evidence is non-passing. A head change invalidates predecessor review/check receipts. Force-push, destructive rebase, self-approval, gate weakening, fabricated evidence, and unrelated rollback are prohibited. -No open BandScope PR returned a qualifying `review:approved` result in the fresh approval sweep in this run. Therefore no protected merge is claimed by this baseline. +Merge readiness is re-evaluated per unchanged exact PR head; an organization-wide approval search is not a substitute for that per-head proof. ## 2. Shipped protected truth @@ -60,6 +60,8 @@ During this run #968 was non-destructively restacked on the current #1116 baseli PR #1007 is the canonical first-part-handoff lane after the unique scientific fallback prohibition from #1094 was transferred; #1094 is now closed. The #1007 branch moved normally during this run, so its PR-body SHA is stale and its independently resolved live head must be used before any action. Normal concurrent branch movement is not a race condition by itself. +PR #1119 is now closed unmerged after semantic consolidation. Its remaining local `pull_request` Trivy trigger duplicated the organization-required `Security Scan` control plane rather than owning a buyer/runtime capability. On #1119 exact head `58fa0a698f4a6238a14e38c0e4cf1f4d8944cc88`, required `Security Scan` run `33526173636` completed success and exact-head job `trivy-fs` (`99917475350`) completed success, including checkout identity verification, filesystem scan, SARIF requirement, finding gate, and upload. No #1119 checks, reviews, or model evidence transfer to another PR. + Duplicate closure requires a technical succession receipt naming the unique behavior/tests preserved in the successor. Draft status is used only for a real unverified/blocking boundary; it is never toggled solely to retrigger CI. ## 5. Domain model and ownership @@ -79,6 +81,8 @@ BandScope keeps these bounded contexts distinct: Generic `utils`, `helpers`, `common`, `services`, `shared`, `core`, or `models` dumping that erases these responsibilities is a defect. Cross-context persistence and duplicated local transport stores are also defects. +Organization-owned identifiers must also preserve bounded-context meaning with at least two lexical words where a specific owner exists. Casing follows the implementation language: `section_id`, `sectionId`, and `SectionId` are all valid; meaningful multiword identifiers such as `firstGrooveChange` and `SectionRoadmap` are not renamed for casing alone. Bare owned names such as `id`, `name`, `status`, `data`, `value`, `type`, `key`, `result`, or `config` are repaired when they erase an otherwise-known semantic owner. Database-owned objects use the stricter two-or-more-word `snake_case` convention when the schema is under ContextualWisdomLab control. External protocol/vendor fields retain their mandated spelling at an anti-corruption boundary. + `context-graph-contracts` remains the contract-only shared kernel for canonical refs, authority/truth status, bitemporal/provenance Context Assertions, CloudEvents, schemas and conformance. `enterprise-architecture-core` remains the EA Decision Plane. While their dedicated writer is active they are read-only dependencies here; BandScope projects deployable/runtime/version/risk facts through released contracts and does not copy rehearsal audio/analysis/user truth into EA authoritative storage. ## 6. Real-audio scientific acceptance @@ -103,7 +107,9 @@ Owning contexts must fail closed on path/symlink/reparse traversal, oversized/de Ordinary logs/support bundles must not contain raw audio/project payloads, credentials or absolute local paths. Authorization is purpose-bound and least-privilege with field minimization, retention and access/export audit where relevant. -Central `.github` PR #1546 review-control repair is merged protected truth. A previously cited central coverage owner, `.github#1567`, is closed unmerged and must not be presented as a live dependency owner. A fresh central successor must be resolved before attributing that control-plane work. +The current central security control-plane truth inspected in this run is `ContextualWisdomLab/.github@176ae54756657f4c18f43fd9ec4dae754f57fc48`. Its required `.github/workflows/security-scan.yml` explicitly owns pull-request security enforcement: it checks out the exact PR head, runs hard `trivy-fs`, `osv-scan`, and `dependency-review` gates, uploads SARIF, and fails independently of GitHub tool-specific code-scanning configuration bookkeeping. The workflow documentation intentionally keeps the code-scanning ruleset CodeQL-only because requiring multiple tool-specific configurations on incompatible PR refs is unsatisfiable; required workflow/job results are the protected enforcement boundary. This is why redundant local Trivy PR-trigger lane #1119 was consolidated closed rather than merged. + +Central `.github` PR #1546 review-control repair is merged historical truth. A previously cited central coverage owner, `.github#1567`, is closed unmerged and must not be presented as a live dependency owner. Any fresh central regression is attributed only after current exact-head ownership is re-established. ## 9. UI/UX evidence gate From 1ebe663cdd9ed4f4c6bd43a3074f22262ee54096 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 01:00:27 +0900 Subject: [PATCH 16/80] docs(gap): restore executable PRD TRD and migration contracts --- docs/product-technical-gap-baseline.md | 250 +++++++++++++++++++++---- 1 file changed, 211 insertions(+), 39 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 0262af6e7..5afa007a7 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,26 +1,60 @@ # BandScope Product-Technical Gap Baseline Last updated: 2026-09-02 -Evidence capture: fresh live GitHub state from the current delivery run +Evidence capture: fresh live GitHub state from the current delivery run unless a paragraph is explicitly marked historical Protected product truth: `develop@749511c3ad4000090048718f685c6bee6b3d2c25` ## Purpose -This document is the canonical product/technical gap baseline for BandScope. It separates protected shipped truth from active pull-request work, research/acceptance work, superseded work, and external control-plane dependencies. A PR body, predecessor check, model review, screenshot, or remembered SHA is never shipped truth. +This document is the canonical product/technical gap baseline for BandScope. It separates protected shipped truth from active pull-request work, research/acceptance work, superseded work, and external control-plane dependencies. A PR body, predecessor check, model review, screenshot, remembered SHA, or generated routing manifest is never shipped truth. -BandScope is a local-first rehearsal decision product. The commercial loop is complete only when a musician can admit a real local recording, obtain evidence-backed rehearsal guidance, rehearse a precise passage, save and recover the project, share a bounded handoff, diagnose failures without leaking private media, and install/update/roll back a verifiable signed build. +BandScope is a local-first rehearsal decision product. The commercial loop is complete only when a musician can admit a real local recording, obtain evidence-backed rehearsal guidance, rehearse a precise passage, save and recover the project, share a bounded handoff, diagnose failures without leaking private media, and install, update, repair, or roll back a verifiable signed build. -## 1. Live delivery authority +BandScope is not a DAW, notation editor, mandatory cloud service, or an authority that presents uncertain machine analysis as unquestionable musical truth. -A fresh complete accessible-repository census in this run found **74 accessible ContextualWisdomLab repositories** and **2,722 organization-wide open pull requests** with GitHub search `incomplete_results=false`. At selection time `ContextualWisdomLab/bandscope` had **184 open pull requests**, the highest verified repository backlog and the buyer-visible local-first rehearsal workspace/analysis/export boundary. After the exact-head security-authority consolidation described below closed redundant PR #1119 without merge, a fresh BandScope search reported **183 open pull requests** while the organization-wide total remained **2,722** because a concurrent writer opened work elsewhere. These are capture-time operational data, not immutable totals. +## 1. Product requirements baseline (PRD) -Protected `develop` requires the following contexts before normal integration: `ci / build-and-test`, `dependency-review`, `security-audit`, `sbom`, `release-preflight`, `gate / build / windows`, `gate / build / macos`, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, `Analyze (javascript-typescript)`, and `Analyze (python)`. +### 1.1 Buyer jobs and outcomes + +The product must let a working musician or band member: + +1. select an authorized local recording and reach useful rehearsal guidance without first exporting media to a cloud service; +2. understand form, section boundaries, harmony, groove/timing, entries/dropouts, range, overlap, handoffs, setup cues, and role-specific preparation with uncertainty visible where the evidence does not justify certainty; +3. move from an insight to audible rehearsal in the same product through one transport authority supporting play/pause/seek/stop, precise section/range loop, count-in, playback rate, cue navigation, and source-backed stem controls where real stems exist; +4. correct machine evidence without erasing the original estimate, confidence, model identity, source identity, or user-confirmed provenance; +5. close and reopen work, survive interrupted writes and migrations, and recover the last known-good project without a partial write replacing it; +6. export a bounded collaboration handoff without creating a second authoritative project store; +7. inspect redacted diagnostics and a user-previewable offline support bundle without ordinary logs containing raw audio, project payloads, credentials, or absolute paths; +8. install and update a build whose version, signature, checksum, SBOM, provenance, rollout state, and rollback/repair path can be verified. + +Representative user stories are intentionally end-to-end rather than one-card micro-features: + +- As a player, I can open my local song, see the first high-value rehearsal action, start the relevant passage, count it in, and loop it without rebuilding transport in another tool. +- As a band member, I can see section × role guidance and distinguish machine evidence from a user-confirmed correction. +- As a returning user, I can reopen the same project after a crash or interrupted save and recover the last known-good rehearsal state, including transport/loop state where the format supports it. +- As a user of keyboard or assistive technology, I can perform the same primary rehearsal actions and obtain exact-value alternatives to visual-only maps, timelines, or waveforms. +- As a maintainer or support recipient, I can preview exactly what diagnostic evidence will leave the machine and verify that private media and credentials are excluded. +- As an installer, I can distinguish an unsigned validation artifact from a verifiable production release and can roll back a bad staged update. + +### 1.2 Commercial acceptance boundaries + +A buyer-visible capability is complete only when its production path, negative/error states, persistence/recovery behavior where applicable, security boundary, accessibility contract, and release evidence are all integrated on one protected identity. A static card, Storybook-only state, Figma-only mock, generated array, direct feature matrix, synthetic audio fixture, or predecessor-head check cannot substitute for the relevant production acceptance path. + +The near-term product order remains: merge-train convergence; trusted distribution; active rehearsal player; crash-safe project; real-audio science/resource admission; diagnostics; activation; accessibility/design parity; 100% repository-owned production statement/branch coverage and public API documentation. + +## 2. Live delivery authority + +Fresh GitHub search in this run reports **183 open pull requests** and **18 open issues** for `ContextualWisdomLab/bandscope`, with `incomplete_results=false`, above protected `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. These counts are volatile operational evidence, not incentives to merge or close unsafely. + +The latest complete organization census recorded by this canonical branch captured **74 accessible ContextualWisdomLab repositories** and **2,722 organization-wide open pull requests**. That organization-wide number is retained as capture-time prioritization evidence and is not reasserted as exact current truth without another complete census. + +Protected `develop` currently requires these 16 contexts before normal integration: `ci / build-and-test`, `dependency-review`, `security-audit`, `sbom`, `release-preflight`, `gate / build / windows`, `gate / build / macos`, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, `Analyze (javascript-typescript)`, and `Analyze (python)`. Operational evidence rule: queued, pending, skipped-required, cancelled, neutral, failed, absent, stale, predecessor-head, protected-base, model-only, status-only, self/author, or administrative-bypass evidence is non-passing. A head change invalidates predecessor review/check receipts. Force-push, destructive rebase, self-approval, gate weakening, fabricated evidence, and unrelated rollback are prohibited. -Merge readiness is re-evaluated per unchanged exact PR head; an organization-wide approval search is not a substitute for that per-head proof. +Merge readiness is re-evaluated per unchanged exact PR head; an organization-wide approval search is not a substitute for per-head proof. -## 2. Shipped protected truth +## 3. Shipped protected truth Only behavior reachable from protected `develop@749511c3ad4000090048718f685c6bee6b3d2c25` belongs in this section. @@ -28,50 +62,48 @@ Only behavior reachable from protected `develop@749511c3ad4000090048718f685c6bee - Typed Tauri IPC and bounded local process boundaries are the intended local execution model; ordinary rehearsal analysis does not require a public cloud service. - Protected dependency-security repair #783 is already in `develop` ancestry. Open branches must not reframe its historical dependency findings as an unmerged product blocker or suppress them locally. - The product already renders rehearsal-oriented section/role evidence, but protected truth does **not** yet satisfy the complete active-player, crash-recovery, real-audio acceptance, diagnostics, activation, accessibility-parity, or trusted-distribution contracts below. -- Latest published GitHub Release observed in this run is `v0.1.3` (2026-04-28). It is historical release evidence, not proof that the current protected head satisfies the commercial release gate. +- The latest GitHub Release revalidated in this run is immutable `v0.1.3`, published 2026-04-28. It is historical release evidence, not proof that the current protected head satisfies the commercial release gate. -## 3. Canonical active workstreams +## 4. Canonical active workstreams Active work is not shipped truth until it is normally integrated into protected `develop` with current-head gates and qualifying independent review. | Boundary | Canonical live owner / evidence | Current status | |---|---|---| -| Merge-train control plane | Issue #966 with executable queue lane PR #968 | #968 is Draft and stacked on this baseline lane; exact current-head hosted checks are absent, therefore non-passing | -| Canonical baseline | PR #1116, this file | Open; this refresh creates a new exact head and invalidates predecessor evidence | +| Merge-train control plane | Issue #966 with executable queue lane PR #968 | #968 remains Draft; its unique queue machinery must survive every restack and its exact current head is non-passing until hosted/current-head evidence exists | +| Canonical baseline | PR #1116, this file | Open; every source edit creates a new exact head and invalidates predecessor evidence | | Trusted distribution | Issue #960 | Windows signing, macOS signing/notarization, checksums, SBOM/provenance, signature-verified updater, staged rollout, rollback/repair, and version identity parity remain incomplete as one integrated protected-head receipt | -| Active rehearsal player | Issue #961; implementation lane #971 | Real authorized local audio playback/seek/stop/loop/rate/cue transport is active work; audible trusted-tempo count-in remains a separate unique behavior in #1070 until integrated into one transport state machine | +| Active rehearsal player | Issue #961; implementation lane #971 | Real authorized local audio playback/seek/stop/loop/rate/cue transport is active work; count-in and any source-backed stem control must converge into one transport state machine | | Crash-safe project | Issue #962; implementation lane #970 | Atomic publication, versioned format, recovery, migration, autosave, rollback/export and persisted transport state remain active work, not protected truth | -| Real-audio science | Issue #770; Draft benchmark lane #828 | Rights-safe decoded-audio MIR acceptance, recognized metrics, uncertainty and reproducible evidence remain incomplete | +| Real-audio science | Issue #770 and active benchmark lanes | Rights-safe decoded-audio MIR acceptance, recognized metrics, uncertainty and reproducible evidence remain incomplete | | Resource admission/decode | Issue #781; overlapping active lanes require semantic reconciliation | No synthetic/mock success may substitute for production-path resource/cancellation evidence | | Diagnostics/supportability | Issue #963 | Typed redacted crash/hang evidence and user-previewable offline support bundle remain incomplete | | Activation | Issue #964; licensed-demo work exists in active PRs | A measured production-path first rehearsal remains incomplete | | Accessibility/design parity | Issue #965; design/Storybook work remains active | WCAG 2.2 AA, keyboard/screen-reader parity, EN/KO expansion, exact-value alternatives and current-head UI evidence remain incomplete | | Quality floor | PR #1057 and successors | Repository-owned production statement/branch coverage and public API documentation target remain 100%; lower configured thresholds are a gap | -The product boundary, tests, contracts, and unique behavior decide succession—not PR number or title. In this run #1123 and #1074 were closed only after exact semantic comparison proved canonical Score accessibility lane #731 already preserved their production behavior and regressions. Their checks/reviews did not transfer. +The product boundary, tests, contracts, and unique behavior decide succession—not PR number or title. Duplicate closure requires a technical succession receipt naming the unique behavior/tests preserved in the successor. Checks, approvals, and model output never transfer to a changed successor head. -## 4. Merge-train and succession contract +## 5. Merge-train and succession contract -Backlog convergence is the primary engineering risk because micro-PR fan-out creates duplicate writers, stale evidence, dependency ambiguity, and review/check churn. +Backlog convergence is the primary engineering risk because micro-PR fan-out creates duplicate writers, stale evidence, dependency ambiguity, competing local state, and review/check churn. -PR #968 owns the unique executable queue machinery needed by #966: bounded GitHub pagination, exact active-head capture, independent base-tip resolution, deterministic ordering, malformed/incomplete/duplicate rejection, reviewed dependency/succession metadata, network-independent validation, and symlink-safe atomic publication. It must not be discarded as stale documentation. +PR #968 owns the unique executable queue machinery needed by #966: bounded GitHub pagination, exact active-head capture, independent base-tip resolution, deterministic ordering, malformed/incomplete/duplicate rejection, reviewed dependency/succession metadata, network-independent validation, deterministic human projection, and symlink-safe atomic publication. It must not be discarded as stale documentation. -During this run #968 was non-destructively restacked on the current #1116 baseline branch with ordinary merge commit `2c44a37eea2b752dab55a01d7e9d11e1654f1810`. Immediately before this baseline refresh that exact queue head was 56 commits ahead and 0 behind the then-current #1116 head, and the semantic delta remained the 15 queue-contract files. Because this file is now being refreshed, #968 must be restacked again on the resulting new #1116 head before either lane can be considered current. No predecessor checks/reviews transfer across that restack. +The current #968 branch has moved beyond the SHA recorded in its PR body; branch identity must therefore be resolved independently before action. Its target #1116 branch also moved after an earlier non-destructive restack. A new #1116 head requires another ordinary restack/retarget of #968 before current-head review/check evidence can be considered. No predecessor checks/reviews transfer across that restack. -PR #1007 is the canonical first-part-handoff lane after the unique scientific fallback prohibition from #1094 was transferred; #1094 is now closed. The #1007 branch moved normally during this run, so its PR-body SHA is stale and its independently resolved live head must be used before any action. Normal concurrent branch movement is not a race condition by itself. +PR #1007 is the canonical first-part-handoff lane only to the extent that its live semantic diff still preserves mounted selected-role wiring and the scientific prohibition against manufacturing handoffs from heuristic fallback. Any succession decision is rechecked against the independently resolved live head rather than a remembered PR-body SHA. -PR #1119 is now closed unmerged after semantic consolidation. Its remaining local `pull_request` Trivy trigger duplicated the organization-required `Security Scan` control plane rather than owning a buyer/runtime capability. On #1119 exact head `58fa0a698f4a6238a14e38c0e4cf1f4d8944cc88`, required `Security Scan` run `33526173636` completed success and exact-head job `trivy-fs` (`99917475350`) completed success, including checkout identity verification, filesystem scan, SARIF requirement, finding gate, and upload. No #1119 checks, reviews, or model evidence transfer to another PR. +Draft status is used only for a real unverified or blocked boundary and is never toggled solely to manufacture CI. -Duplicate closure requires a technical succession receipt naming the unique behavior/tests preserved in the successor. Draft status is used only for a real unverified/blocking boundary; it is never toggled solely to retrigger CI. - -## 5. Domain model and ownership +## 6. Domain model and ownership BandScope keeps these bounded contexts distinct: 1. **Audio Ingestion** — user-selected source authority and intake intent. 2. **Resource Admission & Decode** — codec/MIME/path/resource/cancellation boundaries. 3. **Signal/MIR Analysis** — decoded-audio evidence and uncertainty. -4. **Rehearsal Insight** — section×role decisions, cues, confidence and correction provenance. +4. **Rehearsal Insight** — section × role decisions, cues, confidence and correction provenance. 5. **Active Player** — one authoritative transport state machine for play/pause/seek/stop/loop/count-in/rate/cue navigation and source-backed stem controls. 6. **Project Persistence** — format version, atomic publication, autosave, migration, backup/recovery and portable export. 7. **Collaboration Handoff** — bounded share/export contracts, never a second project source of truth. @@ -81,25 +113,161 @@ BandScope keeps these bounded contexts distinct: Generic `utils`, `helpers`, `common`, `services`, `shared`, `core`, or `models` dumping that erases these responsibilities is a defect. Cross-context persistence and duplicated local transport stores are also defects. -Organization-owned identifiers must also preserve bounded-context meaning with at least two lexical words where a specific owner exists. Casing follows the implementation language: `section_id`, `sectionId`, and `SectionId` are all valid; meaningful multiword identifiers such as `firstGrooveChange` and `SectionRoadmap` are not renamed for casing alone. Bare owned names such as `id`, `name`, `status`, `data`, `value`, `type`, `key`, `result`, or `config` are repaired when they erase an otherwise-known semantic owner. Database-owned objects use the stricter two-or-more-word `snake_case` convention when the schema is under ContextualWisdomLab control. External protocol/vendor fields retain their mandated spelling at an anti-corruption boundary. +### 6.1 Ubiquitous language, aggregates, invariants, and events + +| Term | Meaning | Invariant / transaction boundary | +|---|---|---| +| `RehearsalProject` | durable work for one admitted rehearsal source | one published format version; a partial write never replaces the last known-good snapshot | +| `AudioSourceRef` | authorized local source identity plus bounded metadata | source authority is explicit; raw media is not copied into ordinary logs or EA truth | +| `SongSection` | stable-ID time-bounded structural region | ordered, finite range inside admitted media duration; display label is not identity | +| `RehearsalRole` | instrument, vocal function, or useful subdivision | guidance belongs to project/section and retains evidence provenance | +| `AnalysisEvidence` | versioned machine estimate | confidence/model/source provenance survives correction | +| `ManualOverride` | user-confirmed correction | original machine evidence remains auditable; confirmation is not silently reclassified as model truth | +| `RehearsalCue` | actionable entry/stop/pickup/handoff/range/setup/timing instruction | referenced section/time/role remains resolvable | +| `RehearsalTransport` | count-in/loop/playback/navigation state | one authoritative state machine; no competing mounted/local stores | +| `SupportBundle` | user-previewable redacted diagnostic export | excludes raw audio/project payloads, credentials and absolute local paths by default | +| `ReleaseIdentity` | version/artifact/signature/checksum/provenance tuple | updater accepts only policy-valid signed identity and preserves rollback target | + +Candidate domain events include `AudioSourceAdmitted`, `AnalysisCompleted`, `CueConfirmed`, `SectionBoundaryCorrected`, `LoopActivated`, `ProjectSnapshotPublished`, `ProjectRecovered`, `SupportBundlePrepared`, `UpdateStaged`, and `UpdateRollbackCompleted`. + +### 6.2 Context map (UML/C4-level logical view) + +```mermaid +flowchart LR + M[Musician / band member] + UI[UI / Interaction] + ING[Audio Ingestion] + DEC[Resource Admission & Decode] + MIR[Signal / MIR Analysis] + RI[Rehearsal Insight] + PLAYER[Active Player] + PROJ[Project Persistence] + HANDOFF[Collaboration Handoff] + DIAG[Diagnostics / Support] + DIST[Distribution / Update] + SK[Released Shared Contracts] + ACL[Codec / model / OS / accelerator ACLs] + + M --> UI + UI --> ING + ING --> DEC + DEC --> MIR + MIR --> RI + RI --> UI + UI --> PLAYER + PLAYER --> PROJ + RI --> PROJ + PROJ --> HANDOFF + UI --> DIAG + DIST --> UI + DEC --> ACL + MIR --> ACL + PROJ --> SK + HANDOFF --> SK +``` + +The diagram is logical responsibility, not a claim that each box is a separate process. Shared contracts stay small and versioned; external codec/model/platform types remain behind anti-corruption layers. `context-graph-contracts` remains the contract-only shared kernel for canonical refs, authority/truth status, bitemporal/provenance Context Assertions, CloudEvents, schemas and conformance. `enterprise-architecture-core` remains the EA Decision Plane. While their dedicated writer is active they are read-only dependencies here; BandScope projects deployable/runtime/version/risk facts through released contracts and does not copy rehearsal audio/analysis/user truth into EA authoritative storage. -## 6. Real-audio scientific acceptance +## 7. Technical design contract (TRD) -Synthetic arrays, mocked UI journeys, direct feature matrices, source-text assertions, or generated audio may support unit tests but cannot prove product accuracy. +### 7.1 Production topology and ports + +Protected `develop` is a local desktop architecture with these principal implementation surfaces: + +- `apps/desktop`: React/Vite UI rendered inside the Tauri desktop shell; +- `apps/desktop/src-tauri`: native command/orchestration boundary and platform integration; +- `apps/desktop/core`: Rust-owned local authority/input-validation helpers where currently implemented; +- `packages/shared-types`: versioned cross-layer request/response/domain contracts; +- `services/analysis-engine`: Python orchestration/compatibility plus still-mixed analysis code during migration; +- `services/analysis-engine/rust`: `bandscope_numeric` Rust/PyO3 numerical kernels. + +Typed Tauri IPC and bounded local process/stdin-stdout boundaries are the intended orchestration ports. Codec libraries, source-separation/model runtimes, filesystem/platform APIs, accelerators, update services, and external handoff contracts are adapters behind owning-context ports. Ordinary rehearsal analysis must not require an unaudited loopback/public HTTP service. + +### 7.2 End-to-end rehearsal sequence + +```mermaid +sequenceDiagram + actor User + participant UI as UI/Interaction + participant Ingest as Audio Ingestion + participant Decode as Admission & Decode + participant MIR as Signal/MIR + participant Insight as Rehearsal Insight + participant Player as Active Player + participant Project as Project Persistence + + User->>UI: choose authorized local audio + UI->>Ingest: admit source intent + Ingest->>Decode: validate path/MIME/codec/resource budget + Decode->>MIR: bounded decoded audio + MIR->>Insight: evidence + uncertainty + provenance + Insight-->>UI: section/role/cue decisions + User->>Player: play/seek/count-in/loop/rate/cue + Player->>Project: persist accepted transport/project state + Project-->>UI: published snapshot or recoverable failure +``` -Commercial acceptance requires rights-safe real audio to pass the production intake → decode → analysis → UI path with fixture/annotation/license provenance. Metrics remain task-specific: chord/harmony evaluation uses a recognized chord metric such as benchmark-defined weighted chord recall; beat/timing uses recognized event metrics; separation uses SI-SDR plus task-appropriate robustness/perceptual evidence; range/pitch/transcription uses declared note/frame/event metrics; section/cue boundaries use tolerances derived from annotation uncertainty and rehearsal cost rather than an invented constant. +If decode, analysis, persistence, or playback fails, the error remains typed and bounded; a synthetic analysis object is not substituted as production success. -Acceptance criteria are preregistered before tuning and report uncertainty across tracks. Configured GPU lanes must actually execute and report parity/peak-resource evidence; unsupported hardware is not converted into a passing claim. +### 7.3 Transport and project state ownership -## 7. Rust compute ownership +```mermaid +stateDiagram-v2 + [*] --> NoSource + NoSource --> Ready: authorized source admitted + Ready --> Playing: play + Playing --> Paused: pause + Paused --> Playing: resume + Playing --> Looping: precise loop active + Looping --> Playing: loop cleared + Playing --> Ready: stop + Paused --> Ready: stop + Ready --> Recovering: project recovery requested + Recovering --> Ready: last-known-good restored + Recovering --> RecoveryFailed: no valid recoverable snapshot +``` + +The production player owns one transport state machine. UI components, cue cards, map cursors, and persisted project data project from that authority; they do not each own independent writable transport state. Project publication is atomic and crash-safe rather than implied by the diagram's UI state. + +### 7.4 Persistence and contract versioning + +Project persistence uses explicit `project_format_version`, deterministic/idempotent migrations, atomic replacement only after a complete durable candidate exists, and a last-known-good backup/recovery path. Fault injection must prove that partial/truncated writes, disk-full conditions, interrupted migration, and failed replacement do not destroy the previous valid project. Portable export is versioned independently from in-memory implementation types. + +Tauri IPC, shared types, project files, handoff schemas, updater manifests, and externally released event/contracts are versioned boundaries. A rename or ownership cleanup is never permission for an in-place breaking wire-format change. + +### 7.5 Identifier-policy migration boundary + +The repository naming policy applies prospectively to new or materially changed **repository-owned internal identifiers**. It does not require blanket renaming of existing persisted fields, IPC keys, public/shared API fields, telemetry/event schemas, or external protocol/vendor fields. + +When an existing bare field such as `id`, `name`, `status`, `data`, `value`, `type`, `key`, `result`, or `config` is already part of a persisted or cross-boundary contract, a semantic rename follows the owning contract's compatibility mechanism: + +- project files: introduce the renamed field only behind an explicit `project_format_version` migration; readers accept the supported prior representation, migration is deterministic/idempotent, and writers emit one canonical current representation after migration; +- Tauri IPC/shared API: use an additive/versioned request or response contract or a bounded compatibility alias; do not remove the previous key until all supported callers have migrated and contract tests prove old/new interoperability; +- database-owned schemas, if introduced under BandScope ownership: use explicit schema migration with backward-compatible read/write sequencing rather than an uncoordinated column rename; +- released handoff/events/context contracts: retain mandated released spelling until the owning contract publishes a new compatible version; anti-corruption layers translate at the boundary; +- external/vendor fields: preserve external spelling exactly and map into semantically owned internal names after admission. + +Every compatibility-changing rename requires fixtures from the previous supported version, round-trip/no-data-loss tests, deterministic repeated migration, rollback/recovery evidence where persistence is involved, and removal criteria for any temporary alias. There is never dual writable truth after migration. This prevents the naming rule from silently breaking existing projects or IPC while still correcting ambiguous new internal ownership. + +### 7.6 Rust compute ownership Protected code is still mixed: selected numerical kernels are Rust/PyO3 while material analysis orchestration and some arithmetic remain Python/NumPy. The target architecture is Rust-first for repository-owned DSP, mathematical, vector, linear/matrix, data-science/ranking, and token-size core arithmetic. Python is bounded orchestration/compatibility/fixture/reporting during migration. CPU reference behavior should be deterministic `f64` where scientifically appropriate, with bounded multithreading and unnecessary context switching removed. CUDA/OpenCL/MLX paths require real backend execution, parity and resource evidence where configured. A hidden Python numerical fallback is not the target architecture. -## 8. Security and privacy baseline +Migration order follows buyer impact and dependency leverage: temporal/beat and harmony; range/pitch/role features; prioritization/weighting; source-separation integration; then remaining repository-owned vector/matrix utilities. Rust↔Python parity is migration evidence, not justification for permanent duplicated production arithmetic. + +## 8. Real-audio scientific acceptance + +Synthetic arrays, mocked UI journeys, direct feature matrices, source-text assertions, or generated audio may support unit tests but cannot prove product accuracy. + +Commercial acceptance requires rights-safe real audio to pass the production intake → decode → analysis → UI path with exact fixture, annotation, integrity and license provenance. Metrics remain task-specific: chord/harmony evaluation uses a recognized chord metric such as benchmark-defined weighted chord recall; beat/timing uses recognized event metrics; separation uses SI-SDR plus task-appropriate robustness/perceptual evidence; range/pitch/transcription uses declared note/frame/event metrics; section/cue boundaries use tolerances derived from annotation uncertainty and rehearsal cost rather than an invented constant. + +Acceptance criteria are preregistered before tuning and report uncertainty across tracks. Candidate-vs-baseline comparisons disclose sample count, aggregation, confidence interval or other justified uncertainty method, exclusions, and missing-data handling. Configured GPU lanes must actually execute and report parity/peak-resource evidence; unsupported hardware is not converted into a passing claim. + +## 9. Security and privacy baseline Local files, URLs, MIME/codec claims, decoder outputs, model artifacts, project files, updater manifests, subprocess output and support exports are untrusted. @@ -107,25 +275,29 @@ Owning contexts must fail closed on path/symlink/reparse traversal, oversized/de Ordinary logs/support bundles must not contain raw audio/project payloads, credentials or absolute local paths. Authorization is purpose-bound and least-privilege with field minimization, retention and access/export audit where relevant. -The current central security control-plane truth inspected in this run is `ContextualWisdomLab/.github@176ae54756657f4c18f43fd9ec4dae754f57fc48`. Its required `.github/workflows/security-scan.yml` explicitly owns pull-request security enforcement: it checks out the exact PR head, runs hard `trivy-fs`, `osv-scan`, and `dependency-review` gates, uploads SARIF, and fails independently of GitHub tool-specific code-scanning configuration bookkeeping. The workflow documentation intentionally keeps the code-scanning ruleset CodeQL-only because requiring multiple tool-specific configurations on incompatible PR refs is unsatisfiable; required workflow/job results are the protected enforcement boundary. This is why redundant local Trivy PR-trigger lane #1119 was consolidated closed rather than merged. - -Central `.github` PR #1546 review-control repair is merged historical truth. A previously cited central coverage owner, `.github#1567`, is closed unmerged and must not be presented as a live dependency owner. Any fresh central regression is attributed only after current exact-head ownership is re-established. +The current central security control-plane truth recorded by this baseline is `ContextualWisdomLab/.github@176ae54756657f4c18f43fd9ec4dae754f57fc48`. Its required security workflow owns pull-request filesystem/dependency/security enforcement; redundant member-repository triggers are not product capability. Central `.github` PR #1546 review-control repair is merged historical truth. A previously cited central coverage owner, `.github#1567`, is closed unmerged and must not be presented as a live dependency owner without a freshly resolved successor. -## 9. UI/UX evidence gate +## 10. UI/UX evidence gate -The live canonical design file referenced by protected BandScope docs in this run is Figma file `zthWmqfNKUgJBECvv002Qk`. A remembered design ID is not authority. +The canonical Figma identity must be rediscovered from current protected BandScope docs/source before a material UI merge; the current baseline records the protected-doc reference `zthWmqfNKUgJBECvv002Qk` only as the latest resolved design authority, not a permanent remembered constant. Storybook is the executable component/state inventory, Figma is the reviewed interaction/visual specification, and the shipped Tauri application is the final acceptance target. Material UI work must verify real pointer/touch/keyboard interaction, section/time-axis identity, playback cursor, persistence/reload, stale-response races, loading/partial/error/unsupported-codec/missing-stem states, responsive window sizes, visible focus, reduced motion, non-color-only status, screen-reader names/states, EN/KO expansion and exact-value/list/table alternatives for graph/timeline/waveform content. A screenshot from a predecessor head, a Storybook-only state, or a Figma-only mock is not shipped UI evidence. -## 10. Release gate +## 11. Quality and operability floor + +Repository-owned production statement coverage, branch/edge-case coverage, and public/repository-owned API documentation target **100%**. A lower configured JavaScript/Python threshold is a gap rather than equivalent evidence; denominator reduction, skip/xfail, generated-code relabeling, or source-text assertions cannot manufacture compliance. + +Production-path tests include supported sample rates/channels, short/long recordings, pickup before bar one, odd meter and tempo changes where supported, silence near boundaries, unsupported codecs, moved/replaced files, cancellation, memory/CPU bounds, disk-full/partial-write recovery, corrupted project state, stale async response, missing stems, device changes, keyboard/screen-reader operation, EN/KO expansion, updater rollback, and redacted support export. Applicable scenarios are proven at the owning boundary rather than all forced into one test layer. + +## 12. Release gate A release may be created only from one exact integrated protected head where all applicable CI/security/SAST/dependency/coverage/documentation/real-audio/build/package gates, Windows signing, macOS signing/notarization, checksums, SBOM/provenance, reproducibility, independent review, project migration/recovery, accessibility/supportability, updater rollback and operability evidence are terminal-success on that same identity. Unsigned validation artifacts are not releases. Queued evidence, stale Figma versions and mock-only audio journeys cannot establish release readiness. -## 11. Traceability +## 13. Traceability Primary normative/research anchors for this baseline include: From 894c32b999e715e148b8cc6c6c076a8767deb1eb Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 07:33:21 +0900 Subject: [PATCH 17/80] docs(gap): refresh live backlog and Trivy owner evidence --- docs/doctoring/product-gap-baseline-2026-09-01.md | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/docs/doctoring/product-gap-baseline-2026-09-01.md b/docs/doctoring/product-gap-baseline-2026-09-01.md index 7d972747a..8ca6a1fe4 100644 --- a/docs/doctoring/product-gap-baseline-2026-09-01.md +++ b/docs/doctoring/product-gap-baseline-2026-09-01.md @@ -2,7 +2,15 @@ ## Purpose -This note records why `docs/product-technical-gap-baseline.md` was replaced on PR #1116 instead of layering another stale queue snapshot over it. +This note records why `docs/product-technical-gap-baseline.md` was replaced on PR #1116 instead of layering another stale queue snapshot over it, and preserves later live-state corrections without rewriting historical observations as if they were current. + +## Current live-state correction — 2026-09-02 + +Protected source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh GitHub organization search reports **2,782 open pull requests** across `ContextualWisdomLab`, and a fresh repository search reports **187 open pull requests** in `ContextualWisdomLab/bandscope`. The accessible repository listing contains 74 repositories. Fresh spot checks of the previously closest backlogs remain materially below BandScope: `ContextualWisdomLab/OriginWeave` 141, `ContextualWisdomLab/naruon` 134, and `ContextualWisdomLab/TEPP` 132. These are volatile operational observations; they do not transfer check/review evidence or justify unsafe closure. + +The previously recorded statement that PR #1119 was closed is also stale. `ContextualWisdomLab/bandscope#1119` is open again on canonical branch `fix/trivy-pr-code-scanning`, currently owning the repository-local Trivy pull-request-head configuration contract. Its exact head at this correction is `8f9c0762c8d336c08028298c276fe0fad745090f`, with fresh repository workflows queued. Downstream PRs with neutral/missing Trivy configuration evidence must therefore continue to treat #1119 as a live causal-owner lane until normal protected integration or a newer verified owner supersedes it. + +The canonical baseline source remains the durable PRD/TRD/DDD contract; volatile queue numbers are evidence, not product truth. When this branch advances, predecessor checks and approvals are invalidated and must be regenerated on the new exact head. ## Repository evidence @@ -52,4 +60,4 @@ World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines (WCAG) PR #1116 is the canonical current baseline owner. PR #1025 is an older competing owner of the same path; its unique requirements (PRD/TRD/UML, Rust migration, real-audio accuracy, security, accessibility, release evidence, and reproducible verification) were deliberately carried into the #1116 replacement. Once this current head is present, #1025 can be closed as superseded without deleting its discussion history. -Future hourly loops should refresh live counts/evidence only when they materially change prioritization. They must not rewrite immutable product and architecture sections merely to chase a volatile PR number. \ No newline at end of file +Future loops should refresh live counts/evidence only when they materially change prioritization. They must not rewrite immutable product and architecture sections merely to chase a volatile PR number. From 2c177569d951dc09f8a0c63b540161bdea812f33 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 07:40:26 +0900 Subject: [PATCH 18/80] docs(gap): finalize complete 74-repository census evidence --- docs/doctoring/product-gap-baseline-2026-09-01.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/doctoring/product-gap-baseline-2026-09-01.md b/docs/doctoring/product-gap-baseline-2026-09-01.md index 8ca6a1fe4..4c4778255 100644 --- a/docs/doctoring/product-gap-baseline-2026-09-01.md +++ b/docs/doctoring/product-gap-baseline-2026-09-01.md @@ -6,10 +6,12 @@ This note records why `docs/product-technical-gap-baseline.md` was replaced on P ## Current live-state correction — 2026-09-02 -Protected source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh GitHub organization search reports **2,782 open pull requests** across `ContextualWisdomLab`, and a fresh repository search reports **187 open pull requests** in `ContextualWisdomLab/bandscope`. The accessible repository listing contains 74 repositories. Fresh spot checks of the previously closest backlogs remain materially below BandScope: `ContextualWisdomLab/OriginWeave` 141, `ContextualWisdomLab/naruon` 134, and `ContextualWisdomLab/TEPP` 132. These are volatile operational observations; they do not transfer check/review evidence or justify unsafe closure. +Protected source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. The complete accessible-repository sweep queried all **74** currently listed `ContextualWisdomLab` repositories individually. That sequential sweep summed to **2,786 open pull requests**; a final fresh organization-wide search immediately afterward reported **2,787**, proving that one additional PR arrived while the census was in progress. This one-PR delta is expected queue churn rather than an incomplete repository set. A final fresh repository search still reports **187 open pull requests** in `ContextualWisdomLab/bandscope`. Fresh high-backlog checks remain materially below BandScope: `ContextualWisdomLab/OriginWeave` 141, `ContextualWisdomLab/newsdom-api` 139, `ContextualWisdomLab/naruon` 134, `ContextualWisdomLab/pg-erd-cloud` 132, and `ContextualWisdomLab/TEPP` 132. These are volatile operational observations; they do not transfer check/review evidence or justify unsafe closure. The previously recorded statement that PR #1119 was closed is also stale. `ContextualWisdomLab/bandscope#1119` is open again on canonical branch `fix/trivy-pr-code-scanning`, currently owning the repository-local Trivy pull-request-head configuration contract. Its exact head at this correction is `8f9c0762c8d336c08028298c276fe0fad745090f`, with fresh repository workflows queued. Downstream PRs with neutral/missing Trivy configuration evidence must therefore continue to treat #1119 as a live causal-owner lane until normal protected integration or a newer verified owner supersedes it. +The central Actions queue-saturation cause has also moved: `ContextualWisdomLab/.github#1645` is merged into protected `main@7d707b8abbb8a3fed95d0efe4121ed9b4f76bb2a`. That control-plane repair coalesces redundant queued current-head workflow runs while preserving exact PR/head/base/workflow identity checks. BandScope heads pushed after that integration should receive fresh evidence normally; unchanged queued heads must not be spam-rerun merely because they are waiting. + The canonical baseline source remains the durable PRD/TRD/DDD contract; volatile queue numbers are evidence, not product truth. When this branch advances, predecessor checks and approvals are invalidated and must be regenerated on the new exact head. ## Repository evidence From afa61e0c21dc2c9796e6449104bca5c71299b40f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 07:42:03 +0900 Subject: [PATCH 19/80] docs(gap): refresh live census and causal owners --- docs/product-technical-gap-baseline.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 5afa007a7..794787691 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -44,9 +44,9 @@ The near-term product order remains: merge-train convergence; trusted distributi ## 2. Live delivery authority -Fresh GitHub search in this run reports **183 open pull requests** and **18 open issues** for `ContextualWisdomLab/bandscope`, with `incomplete_results=false`, above protected `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. These counts are volatile operational evidence, not incentives to merge or close unsafely. +A complete accessible-repository sweep in this run queried all **74** currently listed `ContextualWisdomLab` repositories individually. That sequential sweep summed to **2,786 open pull requests**; a final fresh organization-wide search immediately afterward reported **2,787**, proving one additional PR arrived while the census was in progress rather than indicating a missing repository. A final fresh search reports **187 open pull requests** and **18 open issues** for `ContextualWisdomLab/bandscope`, with `incomplete_results=false`, above protected `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. Fresh high-backlog peers remain lower: `ContextualWisdomLab/OriginWeave` 141, `ContextualWisdomLab/newsdom-api` 139, `ContextualWisdomLab/naruon` 134, `ContextualWisdomLab/pg-erd-cloud` 132, and `ContextualWisdomLab/TEPP` 132. These counts are volatile operational evidence, not incentives to merge or close unsafely. -The latest complete organization census recorded by this canonical branch captured **74 accessible ContextualWisdomLab repositories** and **2,722 organization-wide open pull requests**. That organization-wide number is retained as capture-time prioritization evidence and is not reasserted as exact current truth without another complete census. +Because PR creation and closure can occur during a sequential organization census, the organization-wide search is the final aggregate capture while the per-repository sweep proves repository coverage and relative backlog ordering. A one-PR concurrent delta is recorded explicitly rather than normalized away or misrepresented as a complete simultaneous snapshot. Protected `develop` currently requires these 16 contexts before normal integration: `ci / build-and-test`, `dependency-review`, `security-audit`, `sbom`, `release-preflight`, `gate / build / windows`, `gate / build / macos`, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, `Analyze (javascript-typescript)`, and `Analyze (python)`. @@ -72,7 +72,7 @@ Active work is not shipped truth until it is normally integrated into protected |---|---|---| | Merge-train control plane | Issue #966 with executable queue lane PR #968 | #968 remains Draft; its unique queue machinery must survive every restack and its exact current head is non-passing until hosted/current-head evidence exists | | Canonical baseline | PR #1116, this file | Open; every source edit creates a new exact head and invalidates predecessor evidence | -| Trusted distribution | Issue #960 | Windows signing, macOS signing/notarization, checksums, SBOM/provenance, signature-verified updater, staged rollout, rollback/repair, and version identity parity remain incomplete as one integrated protected-head receipt | +| Trusted distribution | Issue #960; active release-identity lane PR #1126 | Release identity now has an active fail-closed implementation lane, while Windows signing, macOS signing/notarization, checksums, SBOM/provenance, signature-verified updater, staged rollout, rollback/repair, and complete version-identity parity remain incomplete as one integrated protected-head receipt | | Active rehearsal player | Issue #961; implementation lane #971 | Real authorized local audio playback/seek/stop/loop/rate/cue transport is active work; count-in and any source-backed stem control must converge into one transport state machine | | Crash-safe project | Issue #962; implementation lane #970 | Atomic publication, versioned format, recovery, migration, autosave, rollback/export and persisted transport state remain active work, not protected truth | | Real-audio science | Issue #770 and active benchmark lanes | Rights-safe decoded-audio MIR acceptance, recognized metrics, uncertainty and reproducible evidence remain incomplete | @@ -275,7 +275,7 @@ Owning contexts must fail closed on path/symlink/reparse traversal, oversized/de Ordinary logs/support bundles must not contain raw audio/project payloads, credentials or absolute local paths. Authorization is purpose-bound and least-privilege with field minimization, retention and access/export audit where relevant. -The current central security control-plane truth recorded by this baseline is `ContextualWisdomLab/.github@176ae54756657f4c18f43fd9ec4dae754f57fc48`. Its required security workflow owns pull-request filesystem/dependency/security enforcement; redundant member-repository triggers are not product capability. Central `.github` PR #1546 review-control repair is merged historical truth. A previously cited central coverage owner, `.github#1567`, is closed unmerged and must not be presented as a live dependency owner without a freshly resolved successor. +The current central control-plane truth revalidated in this run is `ContextualWisdomLab/.github@7d707b8abbb8a3fed95d0efe4121ed9b4f76bb2a`. Central `.github#1645` is merged on that protected identity and coalesces redundant queued current-head workflow runs using exact PR/head/base/workflow identity and narrow ordinary cancellation authority; it does not make queued evidence passing. Its required security/review workflows remain organization-level admission controls. `ContextualWisdomLab/bandscope#1119` is separately open on exact head `8f9c0762c8d336c08028298c276fe0fad745090f` as the repository-local Trivy pull-request-head configuration owner; no predecessor or neutral downstream evidence transfers from it before normal integration. Central `.github#1546` review-control repair remains historical merged truth, while a previously cited central coverage owner, `.github#1567`, is closed unmerged and must not be presented as a live dependency owner without a freshly resolved successor. ## 10. UI/UX evidence gate From c64155274cc2a84c060fa627eb862a691b1bf831 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 08:07:12 +0900 Subject: [PATCH 20/80] docs(gap): correct non-simultaneous census inference --- docs/product-technical-gap-baseline.md | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 794787691..3768b0d00 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -44,9 +44,9 @@ The near-term product order remains: merge-train convergence; trusted distributi ## 2. Live delivery authority -A complete accessible-repository sweep in this run queried all **74** currently listed `ContextualWisdomLab` repositories individually. That sequential sweep summed to **2,786 open pull requests**; a final fresh organization-wide search immediately afterward reported **2,787**, proving one additional PR arrived while the census was in progress rather than indicating a missing repository. A final fresh search reports **187 open pull requests** and **18 open issues** for `ContextualWisdomLab/bandscope`, with `incomplete_results=false`, above protected `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. Fresh high-backlog peers remain lower: `ContextualWisdomLab/OriginWeave` 141, `ContextualWisdomLab/newsdom-api` 139, `ContextualWisdomLab/naruon` 134, `ContextualWisdomLab/pg-erd-cloud` 132, and `ContextualWisdomLab/TEPP` 132. These counts are volatile operational evidence, not incentives to merge or close unsafely. +A prior complete accessible-repository sweep queried all **74** repositories then visible under `ContextualWisdomLab` individually. That sequential sweep summed to **2,786 open pull requests**; a fresh organization-wide search immediately afterward reported **2,787**, a net +1 difference across two non-simultaneous measurements. The delta demonstrates queue churn during the census but does not prove that exactly one PR was created: concurrent creations and closures can produce the same net result. It therefore is not evidence of a missing repository either. The fresh BandScope search in this delivery run reports **187 open pull requests** and **19 open issues**, both with `incomplete_results=false`, above protected `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. Previously captured high-backlog peers remained lower than BandScope; those peer counts are volatile operational evidence and are not reused as current merge authority. -Because PR creation and closure can occur during a sequential organization census, the organization-wide search is the final aggregate capture while the per-repository sweep proves repository coverage and relative backlog ordering. A one-PR concurrent delta is recorded explicitly rather than normalized away or misrepresented as a complete simultaneous snapshot. +Because PR creation and closure can occur during a sequential organization census, the organization-wide search is an aggregate capture while the per-repository sweep establishes which repositories were enumerated at that time. The net one-PR delta is recorded explicitly rather than normalized away or misrepresented as a complete simultaneous snapshot or a uniquely identified creation event. Protected `develop` currently requires these 16 contexts before normal integration: `ci / build-and-test`, `dependency-review`, `security-audit`, `sbom`, `release-preflight`, `gate / build / windows`, `gate / build / macos`, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, `Analyze (javascript-typescript)`, and `Analyze (python)`. @@ -97,7 +97,6 @@ PR #1007 is the canonical first-part-handoff lane only to the extent that its li Draft status is used only for a real unverified or blocked boundary and is never toggled solely to manufacture CI. ## 6. Domain model and ownership - BandScope keeps these bounded contexts distinct: 1. **Audio Ingestion** — user-selected source authority and intake intent. @@ -197,7 +196,6 @@ sequenceDiagram participant Insight as Rehearsal Insight participant Player as Active Player participant Project as Project Persistence - User->>UI: choose authorized local audio UI->>Ingest: admit source intent Ingest->>Decode: validate path/MIME/codec/resource budget @@ -306,4 +304,4 @@ Primary normative/research anchors for this baseline include: - Music Information Retrieval Evaluation eXchange. (n.d.). *MIREX*. https://www.music-ir.org/mirex/ - Raffel, C., McFee, B., Humphrey, E. J., Salamon, J., Nieto, O., Liang, D., Ellis, D. P. W., & Raffel, C. C. (2014). mir_eval: A transparent implementation of common MIR metrics. *Proceedings of the 15th International Society for Music Information Retrieval Conference*, 367–372. -Repository ADRs, PRD/TRD, architecture/context-map documents, security/threat-model material, test strategy, operability/recovery guidance, UI/Storybook inventory and doctoring traceability must remain code-current. Active PRs, planned work and research results are never promoted into the shipped section before protected integration. +Repository ADRs, PRD/TRD, architecture/context-map documents, security/threat-model material, test strategy, operability/recovery guidance, UI/Storybook inventory and doctoring traceability must remain code-current. Active PRs, planned work and research results are never promoted into the shipped section before protected integration. \ No newline at end of file From b178705be616ab76f1b6d1976d9c901a51e59ed8 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 08:13:44 +0900 Subject: [PATCH 21/80] docs(gap): align doctoring with non-simultaneous census evidence --- docs/doctoring/product-gap-baseline-2026-09-01.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/doctoring/product-gap-baseline-2026-09-01.md b/docs/doctoring/product-gap-baseline-2026-09-01.md index 4c4778255..48e10fea3 100644 --- a/docs/doctoring/product-gap-baseline-2026-09-01.md +++ b/docs/doctoring/product-gap-baseline-2026-09-01.md @@ -6,11 +6,11 @@ This note records why `docs/product-technical-gap-baseline.md` was replaced on P ## Current live-state correction — 2026-09-02 -Protected source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. The complete accessible-repository sweep queried all **74** currently listed `ContextualWisdomLab` repositories individually. That sequential sweep summed to **2,786 open pull requests**; a final fresh organization-wide search immediately afterward reported **2,787**, proving that one additional PR arrived while the census was in progress. This one-PR delta is expected queue churn rather than an incomplete repository set. A final fresh repository search still reports **187 open pull requests** in `ContextualWisdomLab/bandscope`. Fresh high-backlog checks remain materially below BandScope: `ContextualWisdomLab/OriginWeave` 141, `ContextualWisdomLab/newsdom-api` 139, `ContextualWisdomLab/naruon` 134, `ContextualWisdomLab/pg-erd-cloud` 132, and `ContextualWisdomLab/TEPP` 132. These are volatile operational observations; they do not transfer check/review evidence or justify unsafe closure. +Protected source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A prior complete accessible-repository sweep queried all **74** repositories then visible under `ContextualWisdomLab` individually. That sequential sweep summed to **2,786 open pull requests**; a fresh organization-wide search immediately afterward reported **2,787**, a net +1 difference across two non-simultaneous measurements. The delta demonstrates queue churn during the census but does not prove that exactly one PR was created: concurrent creations and closures can produce the same net result. It therefore is not evidence of a missing repository either. A fresh repository search in this delivery run reports **187 open pull requests** and **19 open issues** in `ContextualWisdomLab/bandscope`, both with `incomplete_results=false`. Previously captured peer counts are retained only as historical observations and are not reused as current merge authority. -The previously recorded statement that PR #1119 was closed is also stale. `ContextualWisdomLab/bandscope#1119` is open again on canonical branch `fix/trivy-pr-code-scanning`, currently owning the repository-local Trivy pull-request-head configuration contract. Its exact head at this correction is `8f9c0762c8d336c08028298c276fe0fad745090f`, with fresh repository workflows queued. Downstream PRs with neutral/missing Trivy configuration evidence must therefore continue to treat #1119 as a live causal-owner lane until normal protected integration or a newer verified owner supersedes it. +The previously recorded statement that PR #1119 was closed is also stale. `ContextualWisdomLab/bandscope#1119` is open on canonical branch `fix/trivy-pr-code-scanning`, currently owning the repository-local Trivy pull-request-head configuration contract. Its independently revalidated exact head at this correction remains `8f9c0762c8d336c08028298c276fe0fad745090f`. Downstream PRs with neutral/missing Trivy configuration evidence must therefore continue to treat #1119 as a live causal-owner lane until normal protected integration or a newer verified owner supersedes it. -The central Actions queue-saturation cause has also moved: `ContextualWisdomLab/.github#1645` is merged into protected `main@7d707b8abbb8a3fed95d0efe4121ed9b4f76bb2a`. That control-plane repair coalesces redundant queued current-head workflow runs while preserving exact PR/head/base/workflow identity checks. BandScope heads pushed after that integration should receive fresh evidence normally; unchanged queued heads must not be spam-rerun merely because they are waiting. +The central Actions queue-saturation cause has also moved: `ContextualWisdomLab/.github#1645` was previously verified as merged into protected central truth. That control-plane repair coalesces redundant queued current-head workflow runs while preserving exact PR/head/base/workflow identity checks. BandScope heads pushed after that integration should receive fresh evidence normally; unchanged queued heads must not be spam-rerun merely because they are waiting. The canonical baseline source remains the durable PRD/TRD/DDD contract; volatile queue numbers are evidence, not product truth. When this branch advances, predecessor checks and approvals are invalidated and must be regenerated on the new exact head. @@ -20,7 +20,7 @@ Protected source at capture: `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. Observed live queue at 2026-09-01 10:31 KST: 190 open pull requests in `ContextualWisdomLab/bandscope`. The older branch text said 185, and its verification block still printed 130; that evidence could not reproduce the document claim. -A fresh organization-wide recount at 2026-09-01 13:29 KST enumerated 72 repositories accessible through the connected `ContextualWisdomLab` account and 2,697 open pull requests across the organization. The prior 71-repository/2,686-PR snapshot became stale because `ContextualWisdomLab/litellm-patched-proxy` and `ContextualWisdomLab/pingora-gateway` are now visible in the accessible repository set. Individual count checks still put `ContextualWisdomLab/bandscope` first at 188 open PRs, ahead of `ContextualWisdomLab/newsdom-api` 144, `ContextualWisdomLab/TEPP` 141, `ContextualWisdomLab/OriginWeave` 140, and `ContextualWisdomLab/naruon` 128. The selection therefore remains justified by both backlog and BandScope's end-user rehearsal-product responsibility. +A fresh organization-wide recount at 2026-09-01 13:29 KST enumerated 72 repositories accessible through the connected `ContextualWisdomLab` account and 2,697 open pull requests across the organization. The prior 71-repository/2,686-PR snapshot became stale because `ContextualWisdomLab/litellm-patched-proxy` and `ContextualWisdomLab/pingora-gateway` were then newly visible in the accessible repository set. Individual count checks at that timestamp put `ContextualWisdomLab/bandscope` first at 188 open PRs, ahead of `ContextualWisdomLab/newsdom-api` 144, `ContextualWisdomLab/TEPP` 141, `ContextualWisdomLab/OriginWeave` 140, and `ContextualWisdomLab/naruon` 128. These numbers are historical evidence only and must not be reused as current queue authority. Review findings on PR #1116 were validated as real: @@ -35,9 +35,9 @@ The replacement baseline therefore separates protected-source facts from timesta PR #956 had a predecessor exact-head Strix failure unrelated to its articulation privacy code. The failing central workflow exhausted the NVIDIA primary, encountered an EOL NVIDIA fallback, then used GPT-5.4 through `/v1/chat/completions` with function tools plus non-none reasoning effort; that combination was rejected by the provider contract. `ContextualWisdomLab/.github#1350` fixed the GPT-5.4 tool/reasoning contract in commit `f655a901f7ccdfef0d62694c818ad2896a2f5da1`. -Current `.github/main@1186a9f4e5eda7683b23ae63d2c806831743432a` is 245 commits ahead of that fix and has it as the merge base. To obtain fresh evidence without altering production content, PR #956 was advanced by a normal non-force commit to `e46a7aa3121c902ebcf9ea9d256a199659a482df` using the identical tree `6d777d7fec8b35de23f8d77f1b22e158828f0288`; repository workflows then re-queued. No stale check was promoted to current evidence. +At the historical RCA capture, `.github/main@1186a9f4e5eda7683b23ae63d2c806831743432a` was 245 commits ahead of that fix and had it as the merge base. To obtain fresh evidence without altering production content, PR #956 was advanced by a normal non-force commit to `e46a7aa3121c902ebcf9ea9d256a199659a482df` using the identical tree `6d777d7fec8b35de23f8d77f1b22e158828f0288`; repository workflows then re-queued. No stale check was promoted to current evidence. These identities are historical RCA evidence, not current merge authority. -PR #1117 independently demonstrates that the queue is not accurately described by “all code checks fail”: exact head `b98f266d2356d56be624fb617580b5252e85baaa` had successful repository CI/release/security/SBOM workflows at capture while `opencode-review` remained in progress. Pending is still non-passing, but its cause and state differ from the older blanket claim. +PR #1117 independently demonstrated at its capture that the queue was not accurately described by “all code checks fail”: exact head `b98f266d2356d56be624fb617580b5252e85baaa` had successful repository CI/release/security/SBOM workflows while `opencode-review` remained in progress. Pending is still non-passing, but its cause and state differ from the older blanket claim. This is historical example evidence and must be re-fetched before any action on #1117. ## Research / standards review From 6220927b4d6028fc02d650479aa287b6e95953bc Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 08:46:50 +0900 Subject: [PATCH 22/80] docs(gap): refresh live backlog and runner-admission evidence --- docs/product-technical-gap-baseline.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 3768b0d00..7e82d2792 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -44,9 +44,9 @@ The near-term product order remains: merge-train convergence; trusted distributi ## 2. Live delivery authority -A prior complete accessible-repository sweep queried all **74** repositories then visible under `ContextualWisdomLab` individually. That sequential sweep summed to **2,786 open pull requests**; a fresh organization-wide search immediately afterward reported **2,787**, a net +1 difference across two non-simultaneous measurements. The delta demonstrates queue churn during the census but does not prove that exactly one PR was created: concurrent creations and closures can produce the same net result. It therefore is not evidence of a missing repository either. The fresh BandScope search in this delivery run reports **187 open pull requests** and **19 open issues**, both with `incomplete_results=false`, above protected `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. Previously captured high-backlog peers remained lower than BandScope; those peer counts are volatile operational evidence and are not reused as current merge authority. +A fresh accessible-repository sweep queried all **74** repositories currently visible under `ContextualWisdomLab` individually. That sequential sweep summed to **2,789 open pull requests**; a later organization-wide search reported **2,790**, a net +1 difference across two non-simultaneous measurements. The delta demonstrates queue churn during the census but does not prove that exactly one PR was created: concurrent creations and closures can produce the same net result. It therefore is not evidence of a missing repository either. `ContextualWisdomLab/bandscope` remains the highest-backlog repository at **187 open pull requests** and **19 open issues**, both complete (`incomplete_results=false`), ahead of freshly counted high-backlog peers `ContextualWisdomLab/OriginWeave` (141), `ContextualWisdomLab/newsdom-api` (138), `ContextualWisdomLab/naruon` (134), `ContextualWisdomLab/pg-erd-cloud` (132), and `ContextualWisdomLab/TEPP` (131). -Because PR creation and closure can occur during a sequential organization census, the organization-wide search is an aggregate capture while the per-repository sweep establishes which repositories were enumerated at that time. The net one-PR delta is recorded explicitly rather than normalized away or misrepresented as a complete simultaneous snapshot or a uniquely identified creation event. +Because PR creation and closure can occur during a sequential organization census, the organization-wide search is an aggregate capture while the per-repository sweep establishes which repositories were enumerated at that time. The net one-PR delta is recorded explicitly rather than normalized away or misrepresented as a complete simultaneous snapshot or a uniquely identified creation event. BandScope remains the selected delivery boundary not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. Protected `develop` currently requires these 16 contexts before normal integration: `ci / build-and-test`, `dependency-review`, `security-audit`, `sbom`, `release-preflight`, `gate / build / windows`, `gate / build / macos`, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, `Analyze (javascript-typescript)`, and `Analyze (python)`. @@ -72,7 +72,7 @@ Active work is not shipped truth until it is normally integrated into protected |---|---|---| | Merge-train control plane | Issue #966 with executable queue lane PR #968 | #968 remains Draft; its unique queue machinery must survive every restack and its exact current head is non-passing until hosted/current-head evidence exists | | Canonical baseline | PR #1116, this file | Open; every source edit creates a new exact head and invalidates predecessor evidence | -| Trusted distribution | Issue #960; active release-identity lane PR #1126 | Release identity now has an active fail-closed implementation lane, while Windows signing, macOS signing/notarization, checksums, SBOM/provenance, signature-verified updater, staged rollout, rollback/repair, and complete version-identity parity remain incomplete as one integrated protected-head receipt | +| Trusted distribution | Issue #960; active release-identity lane PR #1126 | #1126 now applies semantic multiword naming across its new release-identity production and test surfaces on exact head `b0d5ecbf18f20842b88879c74fdadd7208476ad7`; Windows signing, macOS signing/notarization, checksums, SBOM/provenance, signature-verified updater, staged rollout, rollback/repair, and complete version-identity parity remain incomplete as one integrated protected-head receipt | | Active rehearsal player | Issue #961; implementation lane #971 | Real authorized local audio playback/seek/stop/loop/rate/cue transport is active work; count-in and any source-backed stem control must converge into one transport state machine | | Crash-safe project | Issue #962; implementation lane #970 | Atomic publication, versioned format, recovery, migration, autosave, rollback/export and persisted transport state remain active work, not protected truth | | Real-audio science | Issue #770 and active benchmark lanes | Rights-safe decoded-audio MIR acceptance, recognized metrics, uncertainty and reproducible evidence remain incomplete | @@ -273,7 +273,9 @@ Owning contexts must fail closed on path/symlink/reparse traversal, oversized/de Ordinary logs/support bundles must not contain raw audio/project payloads, credentials or absolute local paths. Authorization is purpose-bound and least-privilege with field minimization, retention and access/export audit where relevant. -The current central control-plane truth revalidated in this run is `ContextualWisdomLab/.github@7d707b8abbb8a3fed95d0efe4121ed9b4f76bb2a`. Central `.github#1645` is merged on that protected identity and coalesces redundant queued current-head workflow runs using exact PR/head/base/workflow identity and narrow ordinary cancellation authority; it does not make queued evidence passing. Its required security/review workflows remain organization-level admission controls. `ContextualWisdomLab/bandscope#1119` is separately open on exact head `8f9c0762c8d336c08028298c276fe0fad745090f` as the repository-local Trivy pull-request-head configuration owner; no predecessor or neutral downstream evidence transfers from it before normal integration. Central `.github#1546` review-control repair remains historical merged truth, while a previously cited central coverage owner, `.github#1567`, is closed unmerged and must not be presented as a live dependency owner without a freshly resolved successor. +The current central control-plane truth revalidated in this run is protected `ContextualWisdomLab/.github@cfcde258dc2836838d00982ed812dd3b9d6072ca`. Central issue `.github#712` is the current causal owner for organization-wide GitHub Actions queue starvation. A bounded diagnostic `.github#1652` used a one-step `ubuntu-latest` canary with no checkout, action, matrix, dependency, environment, credentials, or repository-code execution; its exact job remained queued with `runner_id=0` and zero steps and the diagnostic PR was then closed unmerged rather than leaving permanent no-op load. Independent current jobs requesting explicit `ubuntu-24.04` show the same pre-step runner-admission failure. This evidence places the current first failing boundary at hosted-runner admission under repository/organization Actions capacity, scheduler, quota, billing, or policy/control-plane state rather than a BandScope source defect. The connected repository write surface does not expose the organization runner pool, Actions quota/billing, or equivalent settings mutation, so no leaf rerun or source-label churn is justified until that external control-plane condition changes. Queued evidence remains non-passing. + +Central `.github#1645` remains merged historical queue-coalescing truth, but it does not resolve the later runner-admission incident and must not be presented as the current sole causal owner. `ContextualWisdomLab/bandscope#1119` remains separately open as the repository-local Trivy pull-request-head configuration owner until normally integrated or superseded by a freshly verified successor; no predecessor or neutral downstream evidence transfers from it before normal integration. ## 10. UI/UX evidence gate From fd8a0e2569beafd7a703648a1771a07b4e1b9ecc Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 08:48:33 +0900 Subject: [PATCH 23/80] docs(doctoring): record runner-admission causal boundary --- .../product-gap-baseline-2026-09-01.md | 22 +++++++++++-------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/docs/doctoring/product-gap-baseline-2026-09-01.md b/docs/doctoring/product-gap-baseline-2026-09-01.md index 48e10fea3..84afd7686 100644 --- a/docs/doctoring/product-gap-baseline-2026-09-01.md +++ b/docs/doctoring/product-gap-baseline-2026-09-01.md @@ -6,23 +6,27 @@ This note records why `docs/product-technical-gap-baseline.md` was replaced on P ## Current live-state correction — 2026-09-02 -Protected source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A prior complete accessible-repository sweep queried all **74** repositories then visible under `ContextualWisdomLab` individually. That sequential sweep summed to **2,786 open pull requests**; a fresh organization-wide search immediately afterward reported **2,787**, a net +1 difference across two non-simultaneous measurements. The delta demonstrates queue churn during the census but does not prove that exactly one PR was created: concurrent creations and closures can produce the same net result. It therefore is not evidence of a missing repository either. A fresh repository search in this delivery run reports **187 open pull requests** and **19 open issues** in `ContextualWisdomLab/bandscope`, both with `incomplete_results=false`. Previously captured peer counts are retained only as historical observations and are not reused as current merge authority. +Protected source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,789 open pull requests**. A later organization-wide search returned **2,790**, a net +1 across non-simultaneous measurements. The delta is queue churn evidence, not proof of one specific creation and not evidence of a missing repository. `ContextualWisdomLab/bandscope` remains the highest-backlog repository at **187 open pull requests** and **19 open issues**, both complete (`incomplete_results=false`), ahead of `ContextualWisdomLab/OriginWeave` 141, `ContextualWisdomLab/newsdom-api` 138, `ContextualWisdomLab/naruon` 134, `ContextualWisdomLab/pg-erd-cloud` 132, and `ContextualWisdomLab/TEPP` 131. -The previously recorded statement that PR #1119 was closed is also stale. `ContextualWisdomLab/bandscope#1119` is open on canonical branch `fix/trivy-pr-code-scanning`, currently owning the repository-local Trivy pull-request-head configuration contract. Its independently revalidated exact head at this correction remains `8f9c0762c8d336c08028298c276fe0fad745090f`. Downstream PRs with neutral/missing Trivy configuration evidence must therefore continue to treat #1119 as a live causal-owner lane until normal protected integration or a newer verified owner supersedes it. +The previously recorded statement that PR #1119 was closed is stale. `ContextualWisdomLab/bandscope#1119` is open on canonical branch `fix/trivy-pr-code-scanning`, owning the repository-local Trivy pull-request-head configuration contract until normal protected integration or a freshly verified successor supersedes it. -The central Actions queue-saturation cause has also moved: `ContextualWisdomLab/.github#1645` was previously verified as merged into protected central truth. That control-plane repair coalesces redundant queued current-head workflow runs while preserving exact PR/head/base/workflow identity checks. BandScope heads pushed after that integration should receive fresh evidence normally; unchanged queued heads must not be spam-rerun merely because they are waiting. +The central Actions causal boundary has advanced beyond the earlier `.github#1645` queue-coalescing repair. Protected central truth at this capture is `ContextualWisdomLab/.github@cfcde258dc2836838d00982ed812dd3b9d6072ca`, and issue `.github#712` is the current organization-wide runner-starvation owner. Diagnostic `.github#1652` used a deliberately minimal one-step `ubuntu-latest` job with no checkout, third-party action, matrix, `needs`, environment, credentials, repository code, or job environment. Its exact job remained queued with zero executed steps and `runner_id=0`; the draft diagnostic PR was then closed unmerged so the canary would not become permanent no-op load. Independent exact-head jobs using explicit `ubuntu-24.04` exhibit the same no-runner/no-step state. This falsifies a BandScope source checkout or runner-label-only fix as the current first boundary and places the incident at hosted-runner admission under repository/organization Actions capacity, scheduler, quota, billing, or policy/control-plane state. -The canonical baseline source remains the durable PRD/TRD/DDD contract; volatile queue numbers are evidence, not product truth. When this branch advances, predecessor checks and approvals are invalidated and must be regenerated on the new exact head. +The connected repository write surface permits ordinary source/workflow/PR changes but does not expose organization runner-pool, Actions quota/billing, or equivalent settings mutation. Until that external condition changes, repeated unchanged-head reruns or label churn would generate noise rather than evidence. Queued jobs remain non-passing; fresh exact-head workflows should be allowed to remain queued while independent source work proceeds. + +The canonical baseline source remains the durable PRD/TRD/DDD contract; volatile queue numbers are evidence, not product truth. Every branch advance invalidates predecessor checks and approvals. ## Repository evidence Protected source at capture: `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. -Observed live queue at 2026-09-01 10:31 KST: 190 open pull requests in `ContextualWisdomLab/bandscope`. The older branch text said 185, and its verification block still printed 130; that evidence could not reproduce the document claim. +Current direct naming repair evidence: `ContextualWisdomLab/bandscope#1126` was re-fetched before modification and advanced by ordinary history to exact head `b0d5ecbf18f20842b88879c74fdadd7208476ad7`. Its new release-identity production helper already used bounded-context names; the owning test surface still had generic repository-owned locals/parameters (`spec`, `module`, `root`, `version`, `workflow`, `marker`, `lines`, `start`, `end`, `guard`, `expected`, `package`, `publisher`). Those are now `guard_module_spec`, `guard_module`, `repository_root`, `release_version`, `workflow_text`, `job_marker`, `workflow_lines`, `job_start_index`, `job_end_index`, `release_guard`, `expected_version`, `package_document`, and `publication_job`. Pytest's external `tmp_path` fixture and externally mandated package/Tauri JSON keys remain unchanged. The change is internal naming only and needs no persistence/API migration. + +Fresh workflows created for `#1126@b0d5ecbf18f20842b88879c74fdadd7208476ad7` are queued. Its `ci` job `100068301102` requests `ubuntu-latest`, has `steps=[]`, `runner_id=0`, and no runner/group identity, reproducing the central #712 admission boundary on the new exact head rather than a predecessor. Both existing substantive #1126 review threads are source-resolved; there is still no qualifying independent approval on the last push, so the PR is not mergeable by policy even aside from the queued required evidence. -A fresh organization-wide recount at 2026-09-01 13:29 KST enumerated 72 repositories accessible through the connected `ContextualWisdomLab` account and 2,697 open pull requests across the organization. The prior 71-repository/2,686-PR snapshot became stale because `ContextualWisdomLab/litellm-patched-proxy` and `ContextualWisdomLab/pingora-gateway` were then newly visible in the accessible repository set. Individual count checks at that timestamp put `ContextualWisdomLab/bandscope` first at 188 open PRs, ahead of `ContextualWisdomLab/newsdom-api` 144, `ContextualWisdomLab/TEPP` 141, `ContextualWisdomLab/OriginWeave` 140, and `ContextualWisdomLab/naruon` 128. These numbers are historical evidence only and must not be reused as current queue authority. +Historical queue observations remain useful only as dated RCA. On 2026-09-01 10:31 KST BandScope had 190 open pull requests. At 2026-09-01 13:29 KST, 72 repositories were visible and an organization recount reported 2,697 open pull requests, with BandScope at 188. Those captures must not be reused as current queue authority. -Review findings on PR #1116 were validated as real: +Review findings on PR #1116 previously validated as real: 1. the open-PR evidence was stale; 2. the repository-wide Mermaid absence claim was false because protected `develop` already contains Mermaid in `docs/doctoring/high-security-pdf-http-baseline.md` and `docs/doctoring/npm-lockfile-generator-provenance.md`; @@ -31,7 +35,7 @@ Review findings on PR #1116 were validated as real: The replacement baseline therefore separates protected-source facts from timestamped GitHub observations and uses exact current-head examples instead of asserting one blocker for the entire queue. -## Current review-gate RCA example +## Historical review-gate RCA example PR #956 had a predecessor exact-head Strix failure unrelated to its articulation privacy code. The failing central workflow exhausted the NVIDIA primary, encountered an EOL NVIDIA fallback, then used GPT-5.4 through `/v1/chat/completions` with function tools plus non-none reasoning effort; that combination was rejected by the provider contract. `ContextualWisdomLab/.github#1350` fixed the GPT-5.4 tool/reasoning contract in commit `f655a901f7ccdfef0d62694c818ad2896a2f5da1`. @@ -62,4 +66,4 @@ World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines (WCAG) PR #1116 is the canonical current baseline owner. PR #1025 is an older competing owner of the same path; its unique requirements (PRD/TRD/UML, Rust migration, real-audio accuracy, security, accessibility, release evidence, and reproducible verification) were deliberately carried into the #1116 replacement. Once this current head is present, #1025 can be closed as superseded without deleting its discussion history. -Future loops should refresh live counts/evidence only when they materially change prioritization. They must not rewrite immutable product and architecture sections merely to chase a volatile PR number. +Future loops should refresh live counts/evidence only when they materially change prioritization or causal ownership. They must not rewrite immutable product and architecture sections merely to chase a volatile PR number. From 22f0549adde055347d3575c3428957f0806759f5 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 09:54:58 +0900 Subject: [PATCH 24/80] docs(gap): refresh 74-repo census and current causal owners --- .../product-gap-baseline-2026-09-01.md | 12 ++++++++---- docs/product-technical-gap-baseline.md | 18 +++++++++++++----- 2 files changed, 21 insertions(+), 9 deletions(-) diff --git a/docs/doctoring/product-gap-baseline-2026-09-01.md b/docs/doctoring/product-gap-baseline-2026-09-01.md index 84afd7686..f5a172efc 100644 --- a/docs/doctoring/product-gap-baseline-2026-09-01.md +++ b/docs/doctoring/product-gap-baseline-2026-09-01.md @@ -6,11 +6,13 @@ This note records why `docs/product-technical-gap-baseline.md` was replaced on P ## Current live-state correction — 2026-09-02 -Protected source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,789 open pull requests**. A later organization-wide search returned **2,790**, a net +1 across non-simultaneous measurements. The delta is queue churn evidence, not proof of one specific creation and not evidence of a missing repository. `ContextualWisdomLab/bandscope` remains the highest-backlog repository at **187 open pull requests** and **19 open issues**, both complete (`incomplete_results=false`), ahead of `ContextualWisdomLab/OriginWeave` 141, `ContextualWisdomLab/newsdom-api` 138, `ContextualWisdomLab/naruon` 134, `ContextualWisdomLab/pg-erd-cloud` 132, and `ContextualWisdomLab/TEPP` 131. +Protected source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,785 open pull requests**. The organization-wide aggregate immediately after that sequential sweep was **2,783**, a net -2 across non-simultaneous measurements. After the naming repair PR described below was opened and other organization activity continued, a later aggregate returned **2,785**. These deltas are queue-churn evidence, not proof of particular creations/closures and not evidence of a missing repository. At selection time `ContextualWisdomLab/bandscope` was the highest-backlog repository at **184 open pull requests** and **19 open issues**; after opening #1130 it was **185 open pull requests**. Freshly counted peers remained `ContextualWisdomLab/OriginWeave` 141, `ContextualWisdomLab/newsdom-api` 138, `ContextualWisdomLab/naruon` 135, `ContextualWisdomLab/pg-erd-cloud` 132, and `ContextualWisdomLab/TEPP` 131. The previously recorded statement that PR #1119 was closed is stale. `ContextualWisdomLab/bandscope#1119` is open on canonical branch `fix/trivy-pr-code-scanning`, owning the repository-local Trivy pull-request-head configuration contract until normal protected integration or a freshly verified successor supersedes it. -The central Actions causal boundary has advanced beyond the earlier `.github#1645` queue-coalescing repair. Protected central truth at this capture is `ContextualWisdomLab/.github@cfcde258dc2836838d00982ed812dd3b9d6072ca`, and issue `.github#712` is the current organization-wide runner-starvation owner. Diagnostic `.github#1652` used a deliberately minimal one-step `ubuntu-latest` job with no checkout, third-party action, matrix, `needs`, environment, credentials, repository code, or job environment. Its exact job remained queued with zero executed steps and `runner_id=0`; the draft diagnostic PR was then closed unmerged so the canary would not become permanent no-op load. Independent exact-head jobs using explicit `ubuntu-24.04` exhibit the same no-runner/no-step state. This falsifies a BandScope source checkout or runner-label-only fix as the current first boundary and places the incident at hosted-runner admission under repository/organization Actions capacity, scheduler, quota, billing, or policy/control-plane state. +The central Actions causal boundary has advanced beyond the earlier `.github#1645` queue-coalescing repair. Protected central truth at this capture is `ContextualWisdomLab/.github@fb021296afbe7c27e30363627971fc9d36d12979`, and issue `.github#712` remains the organization-wide runner-starvation owner. Exact-head jobs on both BandScope and the central `.github` repository continue to stop before their first step with `runner_id=null`/no runner identity, including `ContextualWisdomLab/bandscope#1130@f06521e126c3af9bc2e56a7f53a3884636414822` and `ContextualWisdomLab/.github#1656@4593ff1158e3efb6b13815fe4e08758f512e67b3`. This preserves the first failing boundary at hosted-runner admission under repository/organization Actions capacity, scheduler, quota, billing, or policy/control-plane state rather than a BandScope product-source defect. + +The central causal repair itself is still advancing rather than merely being observed. `.github#1656` removes runner-backed `closed`-event no-op jobs from Close Empty PR, OSV-Scanner PR, and Scorecard PR while retaining the actual evidence jobs and PR-number concurrency contract. Its temporary source-fix workflow and one-shot repair driver were removed after their reconciliation purpose completed, leaving only the permanent workflows and regression. Separately, `.github#1658@3196edde85ed7f4a909c3a627af75b47593c7f5e` owns a pre-existing Strix quick-gate contract mismatch in which `LLM_TIMEOUT=300` contradicted the repository's already-existing unlimited-inference regression; that one-line repair is distinct from runner admission and also awaits fresh exact-head evidence. The connected repository write surface permits ordinary source/workflow/PR changes but does not expose organization runner-pool, Actions quota/billing, or equivalent settings mutation. Until that external condition changes, repeated unchanged-head reruns or label churn would generate noise rather than evidence. Queued jobs remain non-passing; fresh exact-head workflows should be allowed to remain queued while independent source work proceeds. @@ -20,9 +22,11 @@ The canonical baseline source remains the durable PRD/TRD/DDD contract; volatile Protected source at capture: `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. -Current direct naming repair evidence: `ContextualWisdomLab/bandscope#1126` was re-fetched before modification and advanced by ordinary history to exact head `b0d5ecbf18f20842b88879c74fdadd7208476ad7`. Its new release-identity production helper already used bounded-context names; the owning test surface still had generic repository-owned locals/parameters (`spec`, `module`, `root`, `version`, `workflow`, `marker`, `lines`, `start`, `end`, `guard`, `expected`, `package`, `publisher`). Those are now `guard_module_spec`, `guard_module`, `repository_root`, `release_version`, `workflow_text`, `job_marker`, `workflow_lines`, `job_start_index`, `job_end_index`, `release_guard`, `expected_version`, `package_document`, and `publication_job`. Pytest's external `tmp_path` fixture and externally mandated package/Tauri JSON keys remain unchanged. The change is internal naming only and needs no persistence/API migration. +Current direct naming repair evidence: `ContextualWisdomLab/bandscope#1130` was created from that exact protected head after the repository-wide naming sweep found the exported workspace-owned `RehearsalRoleOption` projection using bare `id` and `name`, with public component prop `roles`. The branch first advanced focused tests to `roleId`, `roleName`, and `roleOptions`, then changed the authoritative switcher-owned vocabulary to those semantic names. The previous `{ id, name }[]` component shape is retained only inside the explicitly deprecated `LegacyRehearsalRoleOption` compatibility input and is immediately translated by `normalizeLegacyRoleOptions`; switcher-owned logic uses the semantic projection thereafter. Current exact head is `f06521e126c3af9bc2e56a7f53a3884636414822`, with explicit compatibility coverage. No persisted project, IPC, database, vendor, or shared-types wire contract changed in this slice. + +Fresh workflows created for `#1130@f06521e126c3af9bc2e56a7f53a3884636414822` are queued. Its exact-head CI admission job `100082549805` requests `ubuntu-latest`, has `steps=[]`, and has no assigned runner/group identity, reproducing the central #712 admission boundary rather than a product-test failure. The PR therefore remains non-merge-ready until all current required checks and qualifying review evidence exist on the unchanged head. -Fresh workflows created for `#1126@b0d5ecbf18f20842b88879c74fdadd7208476ad7` are queued. Its `ci` job `100068301102` requests `ubuntu-latest`, has `steps=[]`, `runner_id=0`, and no runner/group identity, reproducing the central #712 admission boundary on the new exact head rather than a predecessor. Both existing substantive #1126 review threads are source-resolved; there is still no qualifying independent approval on the last push, so the PR is not mergeable by policy even aside from the queued required evidence. +`ContextualWisdomLab/bandscope#1126` remains a separate release-identity naming repair lane. Its release-identity production helper/test surface uses bounded-context names such as `repository_root`, `release_version`, `workflow_text`, `job_marker`, `workflow_lines`, `job_start_index`, `job_end_index`, `release_guard`, `expected_version`, `package_document`, and `publication_job`; Pytest's external `tmp_path` fixture and externally mandated package/Tauri JSON keys remain unchanged. The change is internal naming only and needs no persistence/API migration. Historical queue observations remain useful only as dated RCA. On 2026-09-01 10:31 KST BandScope had 190 open pull requests. At 2026-09-01 13:29 KST, 72 repositories were visible and an organization recount reported 2,697 open pull requests, with BandScope at 188. Those captures must not be reused as current queue authority. diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 7e82d2792..baa5a1dd3 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -44,9 +44,11 @@ The near-term product order remains: merge-train convergence; trusted distributi ## 2. Live delivery authority -A fresh accessible-repository sweep queried all **74** repositories currently visible under `ContextualWisdomLab` individually. That sequential sweep summed to **2,789 open pull requests**; a later organization-wide search reported **2,790**, a net +1 difference across two non-simultaneous measurements. The delta demonstrates queue churn during the census but does not prove that exactly one PR was created: concurrent creations and closures can produce the same net result. It therefore is not evidence of a missing repository either. `ContextualWisdomLab/bandscope` remains the highest-backlog repository at **187 open pull requests** and **19 open issues**, both complete (`incomplete_results=false`), ahead of freshly counted high-backlog peers `ContextualWisdomLab/OriginWeave` (141), `ContextualWisdomLab/newsdom-api` (138), `ContextualWisdomLab/naruon` (134), `ContextualWisdomLab/pg-erd-cloud` (132), and `ContextualWisdomLab/TEPP` (131). +A fresh accessible-repository sweep queried all **74** repositories currently visible under `ContextualWisdomLab` individually. That sequential sweep summed to **2,785 open pull requests**; an organization-wide aggregate immediately after the sweep reported **2,783**, a net -2 across two non-simultaneous measurements. After this run opened naming-repair PR #1130 and concurrent organization activity continued, a later aggregate reported **2,785**. These changes demonstrate queue churn during the census but do not prove particular creations or closures, and they are not evidence of a missing repository. -Because PR creation and closure can occur during a sequential organization census, the organization-wide search is an aggregate capture while the per-repository sweep establishes which repositories were enumerated at that time. The net one-PR delta is recorded explicitly rather than normalized away or misrepresented as a complete simultaneous snapshot or a uniquely identified creation event. BandScope remains the selected delivery boundary not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. +At selection time `ContextualWisdomLab/bandscope` remained the highest-backlog repository at **184 open pull requests** and **19 open issues**, both complete (`incomplete_results=false`). After opening #1130 it held **185 open pull requests**. Freshly counted high-backlog peers were `ContextualWisdomLab/OriginWeave` (141), `ContextualWisdomLab/newsdom-api` (138), `ContextualWisdomLab/naruon` (135), `ContextualWisdomLab/pg-erd-cloud` (132), and `ContextualWisdomLab/TEPP` (131). BandScope remains the selected delivery boundary not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. + +Because PR creation and closure can occur during a sequential organization census, the organization-wide search is an aggregate capture while the per-repository sweep establishes which repositories were enumerated at that time. Volatile deltas are recorded explicitly rather than normalized away or misrepresented as a simultaneous snapshot. Protected `develop` currently requires these 16 contexts before normal integration: `ci / build-and-test`, `dependency-review`, `security-audit`, `sbom`, `release-preflight`, `gate / build / windows`, `gate / build / macos`, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, `Analyze (javascript-typescript)`, and `Analyze (python)`. @@ -72,7 +74,8 @@ Active work is not shipped truth until it is normally integrated into protected |---|---|---| | Merge-train control plane | Issue #966 with executable queue lane PR #968 | #968 remains Draft; its unique queue machinery must survive every restack and its exact current head is non-passing until hosted/current-head evidence exists | | Canonical baseline | PR #1116, this file | Open; every source edit creates a new exact head and invalidates predecessor evidence | -| Trusted distribution | Issue #960; active release-identity lane PR #1126 | #1126 now applies semantic multiword naming across its new release-identity production and test surfaces on exact head `b0d5ecbf18f20842b88879c74fdadd7208476ad7`; Windows signing, macOS signing/notarization, checksums, SBOM/provenance, signature-verified updater, staged rollout, rollback/repair, and complete version-identity parity remain incomplete as one integrated protected-head receipt | +| Naming-contract repair | PR #1130 | Workspace-owned `RehearsalRoleOption` now uses `roleId`/`roleName` with primary `roleOptions`; previous `roles: { id, name }[]` exists only as a deprecated compatibility input translated immediately at the component boundary; no persisted/shared wire contract changed | +| Trusted distribution | Issue #960; active release-identity lane PR #1126 | #1126 applies semantic multiword naming across its new release-identity production and test surfaces; Windows signing, macOS signing/notarization, checksums, SBOM/provenance, signature-verified updater, staged rollout, rollback/repair, and complete version-identity parity remain incomplete as one integrated protected-head receipt | | Active rehearsal player | Issue #961; implementation lane #971 | Real authorized local audio playback/seek/stop/loop/rate/cue transport is active work; count-in and any source-backed stem control must converge into one transport state machine | | Crash-safe project | Issue #962; implementation lane #970 | Atomic publication, versioned format, recovery, migration, autosave, rollback/export and persisted transport state remain active work, not protected truth | | Real-audio science | Issue #770 and active benchmark lanes | Rights-safe decoded-audio MIR acceptance, recognized metrics, uncertainty and reproducible evidence remain incomplete | @@ -97,6 +100,7 @@ PR #1007 is the canonical first-part-handoff lane only to the extent that its li Draft status is used only for a real unverified or blocked boundary and is never toggled solely to manufacture CI. ## 6. Domain model and ownership + BandScope keeps these bounded contexts distinct: 1. **Audio Ingestion** — user-selected source authority and intake intent. @@ -249,6 +253,8 @@ When an existing bare field such as `id`, `name`, `status`, `data`, `value`, `ty Every compatibility-changing rename requires fixtures from the previous supported version, round-trip/no-data-loss tests, deterministic repeated migration, rollback/recovery evidence where persistence is involved, and removal criteria for any temporary alias. There is never dual writable truth after migration. This prevents the naming rule from silently breaking existing projects or IPC while still correcting ambiguous new internal ownership. +A component-local compatibility projection follows the same direction of travel: PR #1130 makes `roleId`, `roleName`, and `roleOptions` the switcher-owned vocabulary while accepting the old `roles: { id, name }[]` only at one deprecated adapter input. The old fields are translated immediately and are not used as a second writable internal truth. + ### 7.6 Rust compute ownership Protected code is still mixed: selected numerical kernels are Rust/PyO3 while material analysis orchestration and some arithmetic remain Python/NumPy. The target architecture is Rust-first for repository-owned DSP, mathematical, vector, linear/matrix, data-science/ranking, and token-size core arithmetic. @@ -273,7 +279,9 @@ Owning contexts must fail closed on path/symlink/reparse traversal, oversized/de Ordinary logs/support bundles must not contain raw audio/project payloads, credentials or absolute local paths. Authorization is purpose-bound and least-privilege with field minimization, retention and access/export audit where relevant. -The current central control-plane truth revalidated in this run is protected `ContextualWisdomLab/.github@cfcde258dc2836838d00982ed812dd3b9d6072ca`. Central issue `.github#712` is the current causal owner for organization-wide GitHub Actions queue starvation. A bounded diagnostic `.github#1652` used a one-step `ubuntu-latest` canary with no checkout, action, matrix, dependency, environment, credentials, or repository-code execution; its exact job remained queued with `runner_id=0` and zero steps and the diagnostic PR was then closed unmerged rather than leaving permanent no-op load. Independent current jobs requesting explicit `ubuntu-24.04` show the same pre-step runner-admission failure. This evidence places the current first failing boundary at hosted-runner admission under repository/organization Actions capacity, scheduler, quota, billing, or policy/control-plane state rather than a BandScope source defect. The connected repository write surface does not expose the organization runner pool, Actions quota/billing, or equivalent settings mutation, so no leaf rerun or source-label churn is justified until that external control-plane condition changes. Queued evidence remains non-passing. +The current central control-plane truth revalidated in this run is protected `ContextualWisdomLab/.github@fb021296afbe7c27e30363627971fc9d36d12979`. Central issue `.github#712` remains the causal owner for organization-wide GitHub Actions runner-admission starvation. Fresh exact-head jobs in both repositories continue to remain queued before their first executable step with no assigned runner: BandScope #1130's `gate / ci / npm-lock-validation` job on `f06521e126c3af9bc2e56a7f53a3884636414822` has `steps=[]` and no runner/group identity, while central #1656's `osv-scan / osv-scan` job on `4593ff1158e3efb6b13815fe4e08758f512e67b3` has the same state. This keeps the first failing boundary at hosted-runner admission under repository/organization Actions capacity, scheduler, quota, billing, or policy/control-plane state rather than a BandScope source defect. The connected repository write surface does not expose the organization runner pool, Actions quota/billing, or equivalent settings mutation, so no leaf rerun or runner-label churn is justified until that external control-plane condition changes. Queued evidence remains non-passing. + +Central `.github#1656` is an active load-reduction owner: it removes redundant runner-backed `closed`-event cleanup jobs from three required PR workflows while preserving their real evidence jobs and concurrency semantics. Its temporary source-fix workflow and one-shot repair script were deleted from exact head `4593ff1158e3efb6b13815fe4e08758f512e67b3` once their reconciliation purpose completed. Central `.github#1658@3196edde85ed7f4a909c3a627af75b47593c7f5e` separately repairs a pre-existing Strix `LLM_TIMEOUT=300` mismatch against the repository's unlimited-inference contract; that is a reviewer-execution defect, not evidence that runner admission is fixed. Central `.github#1645` remains merged historical queue-coalescing truth, but it does not resolve the later runner-admission incident and must not be presented as the current sole causal owner. `ContextualWisdomLab/bandscope#1119` remains separately open as the repository-local Trivy pull-request-head configuration owner until normally integrated or superseded by a freshly verified successor; no predecessor or neutral downstream evidence transfers from it before normal integration. @@ -306,4 +314,4 @@ Primary normative/research anchors for this baseline include: - Music Information Retrieval Evaluation eXchange. (n.d.). *MIREX*. https://www.music-ir.org/mirex/ - Raffel, C., McFee, B., Humphrey, E. J., Salamon, J., Nieto, O., Liang, D., Ellis, D. P. W., & Raffel, C. C. (2014). mir_eval: A transparent implementation of common MIR metrics. *Proceedings of the 15th International Society for Music Information Retrieval Conference*, 367–372. -Repository ADRs, PRD/TRD, architecture/context-map documents, security/threat-model material, test strategy, operability/recovery guidance, UI/Storybook inventory and doctoring traceability must remain code-current. Active PRs, planned work and research results are never promoted into the shipped section before protected integration. \ No newline at end of file +Repository ADRs, PRD/TRD, architecture/context-map documents, security/threat-model material, test strategy, operability/recovery guidance, UI/Storybook inventory and doctoring traceability must remain code-current. Active PRs, planned work and research results are never promoted into the shipped section before protected integration. From 7dcadf00fad310f4772e2f870ac3508e1a05da68 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 10:13:21 +0900 Subject: [PATCH 25/80] docs(gap): refresh live queue and control-plane evidence --- docs/doctoring/product-gap-baseline-2026-09-01.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/doctoring/product-gap-baseline-2026-09-01.md b/docs/doctoring/product-gap-baseline-2026-09-01.md index f5a172efc..df7a68ff9 100644 --- a/docs/doctoring/product-gap-baseline-2026-09-01.md +++ b/docs/doctoring/product-gap-baseline-2026-09-01.md @@ -6,15 +6,15 @@ This note records why `docs/product-technical-gap-baseline.md` was replaced on P ## Current live-state correction — 2026-09-02 -Protected source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,785 open pull requests**. The organization-wide aggregate immediately after that sequential sweep was **2,783**, a net -2 across non-simultaneous measurements. After the naming repair PR described below was opened and other organization activity continued, a later aggregate returned **2,785**. These deltas are queue-churn evidence, not proof of particular creations/closures and not evidence of a missing repository. At selection time `ContextualWisdomLab/bandscope` was the highest-backlog repository at **184 open pull requests** and **19 open issues**; after opening #1130 it was **185 open pull requests**. Freshly counted peers remained `ContextualWisdomLab/OriginWeave` 141, `ContextualWisdomLab/newsdom-api` 138, `ContextualWisdomLab/naruon` 135, `ContextualWisdomLab/pg-erd-cloud` 132, and `ContextualWisdomLab/TEPP` 131. +Protected source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,784 open pull requests**. The organization-wide aggregate immediately after that sequential sweep also returned **2,784 open pull requests** (`incomplete_results=false`), so the final census and aggregate agreed at this capture. `ContextualWisdomLab/bandscope` remained the highest-backlog repository at **185 open pull requests** and **19 open issues**. Freshly counted peers were `ContextualWisdomLab/OriginWeave` 141, `ContextualWisdomLab/newsdom-api` 138, `ContextualWisdomLab/naruon` 135, `ContextualWisdomLab/pg-erd-cloud` 131, and `ContextualWisdomLab/TEPP` 131. BandScope remains selected by both backlog and product responsibility: it owns the buyer-facing local-first rehearsal/audio path and several high-leverage release/security/workflow boundaries. The previously recorded statement that PR #1119 was closed is stale. `ContextualWisdomLab/bandscope#1119` is open on canonical branch `fix/trivy-pr-code-scanning`, owning the repository-local Trivy pull-request-head configuration contract until normal protected integration or a freshly verified successor supersedes it. -The central Actions causal boundary has advanced beyond the earlier `.github#1645` queue-coalescing repair. Protected central truth at this capture is `ContextualWisdomLab/.github@fb021296afbe7c27e30363627971fc9d36d12979`, and issue `.github#712` remains the organization-wide runner-starvation owner. Exact-head jobs on both BandScope and the central `.github` repository continue to stop before their first step with `runner_id=null`/no runner identity, including `ContextualWisdomLab/bandscope#1130@f06521e126c3af9bc2e56a7f53a3884636414822` and `ContextualWisdomLab/.github#1656@4593ff1158e3efb6b13815fe4e08758f512e67b3`. This preserves the first failing boundary at hosted-runner admission under repository/organization Actions capacity, scheduler, quota, billing, or policy/control-plane state rather than a BandScope product-source defect. +The central Actions causal boundary has advanced beyond the earlier `.github#1645` queue-coalescing repair. Protected central truth at this capture is `ContextualWisdomLab/.github@2792b964b321d096ed292979e175510cf94aa03c`, and issue `.github#712` remains the organization-wide runner-admission/queue-health owner. The exact current `ContextualWisdomLab/bandscope#1130@724dd0445039b6e99863b46535a8497c784699ab` CI admission job `100084171595` remains queued before execution (`steps=null` in the Actions jobs API), while the same head's Windows/macOS build matrix has already acquired hosted runners and completed multiple jobs successfully. That split is important: the current blocker is not a BandScope source failure and no longer supports the broader claim that every hosted runner is unavailable. It remains a current-head Actions admission/control-plane problem for specific required lanes, which #712 must classify by the first causal boundary rather than by a misleading run-level status. -The central causal repair itself is still advancing rather than merely being observed. `.github#1656` removes runner-backed `closed`-event no-op jobs from Close Empty PR, OSV-Scanner PR, and Scorecard PR while retaining the actual evidence jobs and PR-number concurrency contract. Its temporary source-fix workflow and one-shot repair driver were removed after their reconciliation purpose completed, leaving only the permanent workflows and regression. Separately, `.github#1658@3196edde85ed7f4a909c3a627af75b47593c7f5e` owns a pre-existing Strix quick-gate contract mismatch in which `LLM_TIMEOUT=300` contradicted the repository's already-existing unlimited-inference regression; that one-line repair is distinct from runner admission and also awaits fresh exact-head evidence. +Two central source repairs previously described as active are now protected history. `.github#1658` merged the one-line Strix `LLM_TIMEOUT=300` → `0` contract repair as commit `69e80bdf37bfbae813851c1b0e6b8a0cfb4a704c`. `.github#1656` then merged the removal of redundant runner-backed `closed`-event no-op jobs as commit `6a25bc11d58a2e36da9ccea390ade6ccee57ec4d`, preserving real Noema/Strix cancellation behavior and permanent queue-contract regressions. Current central `main` has advanced beyond both repairs. They reduce avoidable queue pressure but do not by themselves close #712 while exact current required jobs can still remain unassigned before execution. -The connected repository write surface permits ordinary source/workflow/PR changes but does not expose organization runner-pool, Actions quota/billing, or equivalent settings mutation. Until that external condition changes, repeated unchanged-head reruns or label churn would generate noise rather than evidence. Queued jobs remain non-passing; fresh exact-head workflows should be allowed to remain queued while independent source work proceeds. +The connected repository write surface permits ordinary source/workflow/PR changes but does not expose organization runner-pool, Actions quota/billing, or equivalent settings mutation. Until the remaining admission condition changes or #712 produces another source-owned causal repair, repeated unchanged-head reruns or label churn would generate noise rather than evidence. Queued jobs remain non-passing; fresh exact-head workflows should be allowed to remain queued while independent source work proceeds. The canonical baseline source remains the durable PRD/TRD/DDD contract; volatile queue numbers are evidence, not product truth. Every branch advance invalidates predecessor checks and approvals. @@ -22,9 +22,9 @@ The canonical baseline source remains the durable PRD/TRD/DDD contract; volatile Protected source at capture: `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. -Current direct naming repair evidence: `ContextualWisdomLab/bandscope#1130` was created from that exact protected head after the repository-wide naming sweep found the exported workspace-owned `RehearsalRoleOption` projection using bare `id` and `name`, with public component prop `roles`. The branch first advanced focused tests to `roleId`, `roleName`, and `roleOptions`, then changed the authoritative switcher-owned vocabulary to those semantic names. The previous `{ id, name }[]` component shape is retained only inside the explicitly deprecated `LegacyRehearsalRoleOption` compatibility input and is immediately translated by `normalizeLegacyRoleOptions`; switcher-owned logic uses the semantic projection thereafter. Current exact head is `f06521e126c3af9bc2e56a7f53a3884636414822`, with explicit compatibility coverage. No persisted project, IPC, database, vendor, or shared-types wire contract changed in this slice. +Current direct naming repair evidence: `ContextualWisdomLab/bandscope#1130` was created from that exact protected head after the repository-wide naming sweep found the exported workspace-owned `RehearsalRoleOption` projection using bare `id` and `name`, with public component prop `roles`. The branch first advanced focused tests to `roleId`, `roleName`, and `roleOptions`, then changed the authoritative switcher-owned vocabulary to those semantic names. The previous `{ id, name }[]` component shape is retained only inside the explicitly deprecated `LegacyRehearsalRoleOption` compatibility input and is immediately translated by `normalizeLegacyRoleOptions`; switcher-owned logic uses the semantic projection thereafter. Current exact head is `724dd0445039b6e99863b46535a8497c784699ab`; it also addresses the current-head CodeRabbit public-API documentation finding by documenting `RehearsalRoleOption` and both semantic fields. No persisted project, IPC, database, vendor, or shared-types wire contract changed in this slice. -Fresh workflows created for `#1130@f06521e126c3af9bc2e56a7f53a3884636414822` are queued. Its exact-head CI admission job `100082549805` requests `ubuntu-latest`, has `steps=[]`, and has no assigned runner/group identity, reproducing the central #712 admission boundary rather than a product-test failure. The PR therefore remains non-merge-ready until all current required checks and qualifying review evidence exist on the unchanged head. +Fresh workflows created for `#1130@724dd0445039b6e99863b46535a8497c784699ab` are mixed current-head evidence rather than a blanket failure: Windows/macOS build jobs have acquired runners and several completed successfully, while exact-head CI job `100084171595` (`gate / ci / npm-lock-validation`) is still queued with no steps. The PR therefore remains non-merge-ready until every live required check is terminal-success and qualifying independent review evidence applies to the unchanged head. `ContextualWisdomLab/bandscope#1126` remains a separate release-identity naming repair lane. Its release-identity production helper/test surface uses bounded-context names such as `repository_root`, `release_version`, `workflow_text`, `job_marker`, `workflow_lines`, `job_start_index`, `job_end_index`, `release_guard`, `expected_version`, `package_document`, and `publication_job`; Pytest's external `tmp_path` fixture and externally mandated package/Tauri JSON keys remain unchanged. The change is internal naming only and needs no persistence/API migration. From c20125aa9416cb39ac3a8065fd4e41127f071ef6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 10:14:42 +0900 Subject: [PATCH 26/80] docs(gap): refresh census and exact-head causal state --- docs/product-technical-gap-baseline.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index baa5a1dd3..636df91a2 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -44,11 +44,11 @@ The near-term product order remains: merge-train convergence; trusted distributi ## 2. Live delivery authority -A fresh accessible-repository sweep queried all **74** repositories currently visible under `ContextualWisdomLab` individually. That sequential sweep summed to **2,785 open pull requests**; an organization-wide aggregate immediately after the sweep reported **2,783**, a net -2 across two non-simultaneous measurements. After this run opened naming-repair PR #1130 and concurrent organization activity continued, a later aggregate reported **2,785**. These changes demonstrate queue churn during the census but do not prove particular creations or closures, and they are not evidence of a missing repository. +A fresh accessible-repository sweep queried all **74** repositories currently visible under `ContextualWisdomLab` individually. The sequential per-repository counts summed to **2,784 open pull requests**, and an organization-wide aggregate immediately after the sweep also returned **2,784 open pull requests** with `incomplete_results=false`. The agreement is a useful capture but remains time-sensitive rather than a permanent queue constant. -At selection time `ContextualWisdomLab/bandscope` remained the highest-backlog repository at **184 open pull requests** and **19 open issues**, both complete (`incomplete_results=false`). After opening #1130 it held **185 open pull requests**. Freshly counted high-backlog peers were `ContextualWisdomLab/OriginWeave` (141), `ContextualWisdomLab/newsdom-api` (138), `ContextualWisdomLab/naruon` (135), `ContextualWisdomLab/pg-erd-cloud` (132), and `ContextualWisdomLab/TEPP` (131). BandScope remains the selected delivery boundary not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. +`ContextualWisdomLab/bandscope` remained the highest-backlog repository at **185 open pull requests** and **19 open issues**. Freshly counted high-backlog peers were `ContextualWisdomLab/OriginWeave` (141), `ContextualWisdomLab/newsdom-api` (138), `ContextualWisdomLab/naruon` (135), `ContextualWisdomLab/pg-erd-cloud` (131), and `ContextualWisdomLab/TEPP` (131). BandScope remains the selected delivery boundary not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. -Because PR creation and closure can occur during a sequential organization census, the organization-wide search is an aggregate capture while the per-repository sweep establishes which repositories were enumerated at that time. Volatile deltas are recorded explicitly rather than normalized away or misrepresented as a simultaneous snapshot. +Because PR creation and closure can occur during a sequential organization census, the organization-wide search is an aggregate capture while the per-repository sweep establishes which repositories were enumerated at that time. Volatile deltas are recorded explicitly rather than normalized away or misrepresented as a simultaneous permanent truth. Protected `develop` currently requires these 16 contexts before normal integration: `ci / build-and-test`, `dependency-review`, `security-audit`, `sbom`, `release-preflight`, `gate / build / windows`, `gate / build / macos`, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, `Analyze (javascript-typescript)`, and `Analyze (python)`. @@ -74,12 +74,12 @@ Active work is not shipped truth until it is normally integrated into protected |---|---|---| | Merge-train control plane | Issue #966 with executable queue lane PR #968 | #968 remains Draft; its unique queue machinery must survive every restack and its exact current head is non-passing until hosted/current-head evidence exists | | Canonical baseline | PR #1116, this file | Open; every source edit creates a new exact head and invalidates predecessor evidence | -| Naming-contract repair | PR #1130 | Workspace-owned `RehearsalRoleOption` now uses `roleId`/`roleName` with primary `roleOptions`; previous `roles: { id, name }[]` exists only as a deprecated compatibility input translated immediately at the component boundary; no persisted/shared wire contract changed | +| Naming-contract repair | PR #1130 | Workspace-owned `RehearsalRoleOption` now uses `roleId`/`roleName` with primary `roleOptions`; previous `roles: { id, name }[]` exists only as a deprecated compatibility input translated immediately at the component boundary; no persisted/shared wire contract changed; exact current head at this capture is `724dd0445039b6e99863b46535a8497c784699ab` | | Trusted distribution | Issue #960; active release-identity lane PR #1126 | #1126 applies semantic multiword naming across its new release-identity production and test surfaces; Windows signing, macOS signing/notarization, checksums, SBOM/provenance, signature-verified updater, staged rollout, rollback/repair, and complete version-identity parity remain incomplete as one integrated protected-head receipt | | Active rehearsal player | Issue #961; implementation lane #971 | Real authorized local audio playback/seek/stop/loop/rate/cue transport is active work; count-in and any source-backed stem control must converge into one transport state machine | | Crash-safe project | Issue #962; implementation lane #970 | Atomic publication, versioned format, recovery, migration, autosave, rollback/export and persisted transport state remain active work, not protected truth | | Real-audio science | Issue #770 and active benchmark lanes | Rights-safe decoded-audio MIR acceptance, recognized metrics, uncertainty and reproducible evidence remain incomplete | -| Resource admission/decode | Issue #781; overlapping active lanes require semantic reconciliation | No synthetic/mock success may substitute for production-path resource/cancellation evidence | +| Resource admission/decode | Issue #781 plus commercial dependency defect #1129 | No synthetic/mock success may substitute for production-path resource/cancellation evidence; the commercially supported decode path must also remove the libsndfile-backed LGPL runtime boundary with equivalent real-audio behavior and cross-platform/SBOM proof | | Diagnostics/supportability | Issue #963 | Typed redacted crash/hang evidence and user-previewable offline support bundle remain incomplete | | Activation | Issue #964; licensed-demo work exists in active PRs | A measured production-path first rehearsal remains incomplete | | Accessibility/design parity | Issue #965; design/Storybook work remains active | WCAG 2.2 AA, keyboard/screen-reader parity, EN/KO expansion, exact-value alternatives and current-head UI evidence remain incomplete | @@ -279,11 +279,11 @@ Owning contexts must fail closed on path/symlink/reparse traversal, oversized/de Ordinary logs/support bundles must not contain raw audio/project payloads, credentials or absolute local paths. Authorization is purpose-bound and least-privilege with field minimization, retention and access/export audit where relevant. -The current central control-plane truth revalidated in this run is protected `ContextualWisdomLab/.github@fb021296afbe7c27e30363627971fc9d36d12979`. Central issue `.github#712` remains the causal owner for organization-wide GitHub Actions runner-admission starvation. Fresh exact-head jobs in both repositories continue to remain queued before their first executable step with no assigned runner: BandScope #1130's `gate / ci / npm-lock-validation` job on `f06521e126c3af9bc2e56a7f53a3884636414822` has `steps=[]` and no runner/group identity, while central #1656's `osv-scan / osv-scan` job on `4593ff1158e3efb6b13815fe4e08758f512e67b3` has the same state. This keeps the first failing boundary at hosted-runner admission under repository/organization Actions capacity, scheduler, quota, billing, or policy/control-plane state rather than a BandScope source defect. The connected repository write surface does not expose the organization runner pool, Actions quota/billing, or equivalent settings mutation, so no leaf rerun or runner-label churn is justified until that external control-plane condition changes. Queued evidence remains non-passing. +The current central control-plane truth revalidated in this run is protected `ContextualWisdomLab/.github@2792b964b321d096ed292979e175510cf94aa03c`. Central issue `.github#712` remains the organization-wide Actions queue-health/runner-admission owner. On exact current `ContextualWisdomLab/bandscope#1130@724dd0445039b6e99863b46535a8497c784699ab`, Windows/macOS matrix jobs have acquired hosted runners and completed successfully while the exact-head CI admission job `100084171595` (`gate / ci / npm-lock-validation`) remains queued with no steps. The evidence therefore does not justify a blanket “all runners unavailable” diagnosis; it localizes the remaining first failing boundary to specific required-lane runner acquisition/control-plane state rather than BandScope product source. #712's current acceptance explicitly treats current-head jobs that are cancelled before runner assignment/checkout as control-plane incomplete evidence rather than source failure. -Central `.github#1656` is an active load-reduction owner: it removes redundant runner-backed `closed`-event cleanup jobs from three required PR workflows while preserving their real evidence jobs and concurrency semantics. Its temporary source-fix workflow and one-shot repair script were deleted from exact head `4593ff1158e3efb6b13815fe4e08758f512e67b3` once their reconciliation purpose completed. Central `.github#1658@3196edde85ed7f4a909c3a627af75b47593c7f5e` separately repairs a pre-existing Strix `LLM_TIMEOUT=300` mismatch against the repository's unlimited-inference contract; that is a reviewer-execution defect, not evidence that runner admission is fixed. +Central `.github#1658` and `.github#1656` are now merged protected history, not active owners. #1658 integrated the Strix unlimited-inference contract correction (`LLM_TIMEOUT=0`) in `69e80bdf37bfbae813851c1b0e6b8a0cfb4a704c`; #1656 integrated the removal of redundant runner-backed `closed`-event no-op jobs in `6a25bc11d58a2e36da9ccea390ade6ccee57ec4d`, while preserving real Noema/Strix cancellation paths and permanent queue-contract tests. Those repairs reduce avoidable load, but exact current required lanes can still remain queued before execution, so `.github#712` remains open. The connected repository write surface does not expose organization runner-pool, Actions quota/billing, or equivalent settings mutation; unchanged-head reruns and runner-label churn are therefore not a substitute for causal evidence. -Central `.github#1645` remains merged historical queue-coalescing truth, but it does not resolve the later runner-admission incident and must not be presented as the current sole causal owner. `ContextualWisdomLab/bandscope#1119` remains separately open as the repository-local Trivy pull-request-head configuration owner until normally integrated or superseded by a freshly verified successor; no predecessor or neutral downstream evidence transfers from it before normal integration. +Central `.github#1645` remains merged historical queue-coalescing truth. `ContextualWisdomLab/bandscope#1119` remains separately open as the repository-local Trivy pull-request-head configuration owner until normally integrated or superseded by a freshly verified successor; no predecessor or neutral downstream evidence transfers from it before normal integration. ## 10. UI/UX evidence gate From 0d8bed2e5095eb69952fabde983abc28a188a7c4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 10:46:16 +0900 Subject: [PATCH 27/80] docs(gap): refresh live backlog and queue evidence --- docs/product-technical-gap-baseline.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 636df91a2..448351afe 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -44,9 +44,9 @@ The near-term product order remains: merge-train convergence; trusted distributi ## 2. Live delivery authority -A fresh accessible-repository sweep queried all **74** repositories currently visible under `ContextualWisdomLab` individually. The sequential per-repository counts summed to **2,784 open pull requests**, and an organization-wide aggregate immediately after the sweep also returned **2,784 open pull requests** with `incomplete_results=false`. The agreement is a useful capture but remains time-sensitive rather than a permanent queue constant. +A fresh accessible-repository sweep queried all **74** repositories currently visible under `ContextualWisdomLab` individually. The sequential per-repository counts summed to **2,790 open pull requests**, and an organization-wide aggregate immediately after the sweep also returned **2,790 open pull requests** with `incomplete_results=false`. The agreement is a useful capture but remains time-sensitive rather than a permanent queue constant. -`ContextualWisdomLab/bandscope` remained the highest-backlog repository at **185 open pull requests** and **19 open issues**. Freshly counted high-backlog peers were `ContextualWisdomLab/OriginWeave` (141), `ContextualWisdomLab/newsdom-api` (138), `ContextualWisdomLab/naruon` (135), `ContextualWisdomLab/pg-erd-cloud` (131), and `ContextualWisdomLab/TEPP` (131). BandScope remains the selected delivery boundary not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. +`ContextualWisdomLab/bandscope` remained the highest-backlog repository at **185 open pull requests** and **19 open issues**. Freshly counted high-backlog peers were `ContextualWisdomLab/OriginWeave` (141), `ContextualWisdomLab/newsdom-api` (137), `ContextualWisdomLab/naruon` (135), `ContextualWisdomLab/pg-erd-cloud` (131), and `ContextualWisdomLab/TEPP` (131). BandScope remains the selected delivery boundary not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. Because PR creation and closure can occur during a sequential organization census, the organization-wide search is an aggregate capture while the per-repository sweep establishes which repositories were enumerated at that time. Volatile deltas are recorded explicitly rather than normalized away or misrepresented as a simultaneous permanent truth. @@ -279,7 +279,7 @@ Owning contexts must fail closed on path/symlink/reparse traversal, oversized/de Ordinary logs/support bundles must not contain raw audio/project payloads, credentials or absolute local paths. Authorization is purpose-bound and least-privilege with field minimization, retention and access/export audit where relevant. -The current central control-plane truth revalidated in this run is protected `ContextualWisdomLab/.github@2792b964b321d096ed292979e175510cf94aa03c`. Central issue `.github#712` remains the organization-wide Actions queue-health/runner-admission owner. On exact current `ContextualWisdomLab/bandscope#1130@724dd0445039b6e99863b46535a8497c784699ab`, Windows/macOS matrix jobs have acquired hosted runners and completed successfully while the exact-head CI admission job `100084171595` (`gate / ci / npm-lock-validation`) remains queued with no steps. The evidence therefore does not justify a blanket “all runners unavailable” diagnosis; it localizes the remaining first failing boundary to specific required-lane runner acquisition/control-plane state rather than BandScope product source. #712's current acceptance explicitly treats current-head jobs that are cancelled before runner assignment/checkout as control-plane incomplete evidence rather than source failure. +The current central control-plane truth revalidated in this run is protected `ContextualWisdomLab/.github@2792b964b321d096ed292979e175510cf94aa03c`. Central issue `.github#712` remains the organization-wide Actions queue-health/runner-admission owner. On exact current `ContextualWisdomLab/bandscope#1119@b005ae91cb0e41753554c2cea7627c7063207656`, Trivy run `33572883842` remains pre-execution queued; job `100070431720` has no executed steps, `runner_id=0`, and no runner/group assignment. On exact current #1130, fresh repository-local workflows are likewise queued. Independent current canaries recorded on `.github#712` use explicit supported `ubuntu-24.04` labels and still show pre-execution `runner_id=0`, so the first observed failing boundary remains hosted-runner acquisition/control-plane state rather than BandScope source or a floating `ubuntu-latest` alias. Central `.github#1658` and `.github#1656` are now merged protected history, not active owners. #1658 integrated the Strix unlimited-inference contract correction (`LLM_TIMEOUT=0`) in `69e80bdf37bfbae813851c1b0e6b8a0cfb4a704c`; #1656 integrated the removal of redundant runner-backed `closed`-event no-op jobs in `6a25bc11d58a2e36da9ccea390ade6ccee57ec4d`, while preserving real Noema/Strix cancellation paths and permanent queue-contract tests. Those repairs reduce avoidable load, but exact current required lanes can still remain queued before execution, so `.github#712` remains open. The connected repository write surface does not expose organization runner-pool, Actions quota/billing, or equivalent settings mutation; unchanged-head reruns and runner-label churn are therefore not a substitute for causal evidence. @@ -314,4 +314,4 @@ Primary normative/research anchors for this baseline include: - Music Information Retrieval Evaluation eXchange. (n.d.). *MIREX*. https://www.music-ir.org/mirex/ - Raffel, C., McFee, B., Humphrey, E. J., Salamon, J., Nieto, O., Liang, D., Ellis, D. P. W., & Raffel, C. C. (2014). mir_eval: A transparent implementation of common MIR metrics. *Proceedings of the 15th International Society for Music Information Retrieval Conference*, 367–372. -Repository ADRs, PRD/TRD, architecture/context-map documents, security/threat-model material, test strategy, operability/recovery guidance, UI/Storybook inventory and doctoring traceability must remain code-current. Active PRs, planned work and research results are never promoted into the shipped section before protected integration. +Repository ADRs, PRD/TRD, architecture/context-map documents, security/threat-model material, test strategy, operability/recovery guidance, UI/Storybook inventory and doctoring traceability must remain code-current. Active PRs, planned work and research results are never promoted into the shipped section before protected integration. \ No newline at end of file From 241cde1d20e7875482e34b0caf1c01fd429d92ab Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 10:48:13 +0900 Subject: [PATCH 28/80] docs(doctoring): record current census and runner admission --- docs/doctoring/product-gap-baseline-2026-09-01.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/doctoring/product-gap-baseline-2026-09-01.md b/docs/doctoring/product-gap-baseline-2026-09-01.md index df7a68ff9..09c0aefc8 100644 --- a/docs/doctoring/product-gap-baseline-2026-09-01.md +++ b/docs/doctoring/product-gap-baseline-2026-09-01.md @@ -6,11 +6,11 @@ This note records why `docs/product-technical-gap-baseline.md` was replaced on P ## Current live-state correction — 2026-09-02 -Protected source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,784 open pull requests**. The organization-wide aggregate immediately after that sequential sweep also returned **2,784 open pull requests** (`incomplete_results=false`), so the final census and aggregate agreed at this capture. `ContextualWisdomLab/bandscope` remained the highest-backlog repository at **185 open pull requests** and **19 open issues**. Freshly counted peers were `ContextualWisdomLab/OriginWeave` 141, `ContextualWisdomLab/newsdom-api` 138, `ContextualWisdomLab/naruon` 135, `ContextualWisdomLab/pg-erd-cloud` 131, and `ContextualWisdomLab/TEPP` 131. BandScope remains selected by both backlog and product responsibility: it owns the buyer-facing local-first rehearsal/audio path and several high-leverage release/security/workflow boundaries. +Protected source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,790 open pull requests**. The organization-wide aggregate immediately after that sequential sweep also returned **2,790 open pull requests** (`incomplete_results=false`), so the final census and aggregate agreed at this capture. `ContextualWisdomLab/bandscope` remained the highest-backlog repository at **185 open pull requests** and **19 open issues**. Freshly counted peers were `ContextualWisdomLab/OriginWeave` 141, `ContextualWisdomLab/newsdom-api` 137, `ContextualWisdomLab/naruon` 135, `ContextualWisdomLab/pg-erd-cloud` 131, and `ContextualWisdomLab/TEPP` 131. BandScope remains selected by both backlog and product responsibility: it owns the buyer-facing local-first rehearsal/audio path and several high-leverage release/security/workflow boundaries. The previously recorded statement that PR #1119 was closed is stale. `ContextualWisdomLab/bandscope#1119` is open on canonical branch `fix/trivy-pr-code-scanning`, owning the repository-local Trivy pull-request-head configuration contract until normal protected integration or a freshly verified successor supersedes it. -The central Actions causal boundary has advanced beyond the earlier `.github#1645` queue-coalescing repair. Protected central truth at this capture is `ContextualWisdomLab/.github@2792b964b321d096ed292979e175510cf94aa03c`, and issue `.github#712` remains the organization-wide runner-admission/queue-health owner. The exact current `ContextualWisdomLab/bandscope#1130@724dd0445039b6e99863b46535a8497c784699ab` CI admission job `100084171595` remains queued before execution (`steps=null` in the Actions jobs API), while the same head's Windows/macOS build matrix has already acquired hosted runners and completed multiple jobs successfully. That split is important: the current blocker is not a BandScope source failure and no longer supports the broader claim that every hosted runner is unavailable. It remains a current-head Actions admission/control-plane problem for specific required lanes, which #712 must classify by the first causal boundary rather than by a misleading run-level status. +The central Actions causal boundary has advanced beyond the earlier `.github#1645` queue-coalescing repair. Protected central truth at this capture is `ContextualWisdomLab/.github@2792b964b321d096ed292979e175510cf94aa03c`, and issue `.github#712` remains the organization-wide runner-admission/queue-health owner. Exact current `ContextualWisdomLab/bandscope#1119@b005ae91cb0e41753554c2cea7627c7063207656` has Trivy run `33572883842` queued before execution; job `100070431720` has no executed steps, `runner_id=0`, and no runner/group assignment. Exact current #1130 also has fresh repository-local workflows queued. Independent current canaries recorded on `.github#712` use explicit supported `ubuntu-24.04` labels and still remain pre-execution with `runner_id=0`, which rules out a leaf-source failure and weakens the floating-runner-alias hypothesis. The first observed failing boundary remains organization/hosted-runner acquisition, capacity, billing, policy, or provider control-plane state rather than a BandScope product defect. Two central source repairs previously described as active are now protected history. `.github#1658` merged the one-line Strix `LLM_TIMEOUT=300` → `0` contract repair as commit `69e80bdf37bfbae813851c1b0e6b8a0cfb4a704c`. `.github#1656` then merged the removal of redundant runner-backed `closed`-event no-op jobs as commit `6a25bc11d58a2e36da9ccea390ade6ccee57ec4d`, preserving real Noema/Strix cancellation behavior and permanent queue-contract regressions. Current central `main` has advanced beyond both repairs. They reduce avoidable queue pressure but do not by themselves close #712 while exact current required jobs can still remain unassigned before execution. @@ -24,7 +24,7 @@ Protected source at capture: `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. Current direct naming repair evidence: `ContextualWisdomLab/bandscope#1130` was created from that exact protected head after the repository-wide naming sweep found the exported workspace-owned `RehearsalRoleOption` projection using bare `id` and `name`, with public component prop `roles`. The branch first advanced focused tests to `roleId`, `roleName`, and `roleOptions`, then changed the authoritative switcher-owned vocabulary to those semantic names. The previous `{ id, name }[]` component shape is retained only inside the explicitly deprecated `LegacyRehearsalRoleOption` compatibility input and is immediately translated by `normalizeLegacyRoleOptions`; switcher-owned logic uses the semantic projection thereafter. Current exact head is `724dd0445039b6e99863b46535a8497c784699ab`; it also addresses the current-head CodeRabbit public-API documentation finding by documenting `RehearsalRoleOption` and both semantic fields. No persisted project, IPC, database, vendor, or shared-types wire contract changed in this slice. -Fresh workflows created for `#1130@724dd0445039b6e99863b46535a8497c784699ab` are mixed current-head evidence rather than a blanket failure: Windows/macOS build jobs have acquired runners and several completed successfully, while exact-head CI job `100084171595` (`gate / ci / npm-lock-validation`) is still queued with no steps. The PR therefore remains non-merge-ready until every live required check is terminal-success and qualifying independent review evidence applies to the unchanged head. +Fresh repository-local workflows on `#1130@724dd0445039b6e99863b46535a8497c784699ab` are currently queued, so no predecessor or earlier same-head completion is promoted to current merge evidence. The PR therefore remains non-merge-ready until every live required check is terminal-success and qualifying independent review evidence applies to the unchanged head. `ContextualWisdomLab/bandscope#1126` remains a separate release-identity naming repair lane. Its release-identity production helper/test surface uses bounded-context names such as `repository_root`, `release_version`, `workflow_text`, `job_marker`, `workflow_lines`, `job_start_index`, `job_end_index`, `release_guard`, `expected_version`, `package_document`, and `publication_job`; Pytest's external `tmp_path` fixture and externally mandated package/Tauri JSON keys remain unchanged. The change is internal naming only and needs no persistence/API migration. From 26f40a05b3b0ee7890243905ed242d3f792705f2 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 11:41:58 +0900 Subject: [PATCH 29/80] docs(gap): refresh live repository census evidence --- docs/doctoring/product-gap-baseline-2026-09-01.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/doctoring/product-gap-baseline-2026-09-01.md b/docs/doctoring/product-gap-baseline-2026-09-01.md index 09c0aefc8..3f3bdeb1e 100644 --- a/docs/doctoring/product-gap-baseline-2026-09-01.md +++ b/docs/doctoring/product-gap-baseline-2026-09-01.md @@ -6,7 +6,7 @@ This note records why `docs/product-technical-gap-baseline.md` was replaced on P ## Current live-state correction — 2026-09-02 -Protected source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,790 open pull requests**. The organization-wide aggregate immediately after that sequential sweep also returned **2,790 open pull requests** (`incomplete_results=false`), so the final census and aggregate agreed at this capture. `ContextualWisdomLab/bandscope` remained the highest-backlog repository at **185 open pull requests** and **19 open issues**. Freshly counted peers were `ContextualWisdomLab/OriginWeave` 141, `ContextualWisdomLab/newsdom-api` 137, `ContextualWisdomLab/naruon` 135, `ContextualWisdomLab/pg-erd-cloud` 131, and `ContextualWisdomLab/TEPP` 131. BandScope remains selected by both backlog and product responsibility: it owns the buyer-facing local-first rehearsal/audio path and several high-leverage release/security/workflow boundaries. +Protected source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,811 open pull requests**. The organization-wide aggregate immediately after that sequential sweep returned **2,813 open pull requests** (`incomplete_results=false`). The two-request delta is recorded as live queue movement during a non-simultaneous census, not normalized away or treated as evidence of an omitted repository. `ContextualWisdomLab/bandscope` remained the highest-backlog repository at **186 open pull requests** and **19 open issues**. Freshly counted peers were `ContextualWisdomLab/OriginWeave` 141, `ContextualWisdomLab/naruon` 138, `ContextualWisdomLab/newsdom-api` 137, `ContextualWisdomLab/pg-erd-cloud` 135, and `ContextualWisdomLab/TEPP` 131. BandScope remains selected by both backlog and product responsibility: it owns the buyer-facing local-first rehearsal/audio path and several high-leverage release/security/workflow boundaries. The previously recorded statement that PR #1119 was closed is stale. `ContextualWisdomLab/bandscope#1119` is open on canonical branch `fix/trivy-pr-code-scanning`, owning the repository-local Trivy pull-request-head configuration contract until normal protected integration or a freshly verified successor supersedes it. From 211f572e374c68aed7a4c51cf2ef205ffef85e1b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 11:43:13 +0900 Subject: [PATCH 30/80] docs(gap): align canonical baseline with live census --- docs/product-technical-gap-baseline.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 448351afe..4d13aa528 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -44,9 +44,9 @@ The near-term product order remains: merge-train convergence; trusted distributi ## 2. Live delivery authority -A fresh accessible-repository sweep queried all **74** repositories currently visible under `ContextualWisdomLab` individually. The sequential per-repository counts summed to **2,790 open pull requests**, and an organization-wide aggregate immediately after the sweep also returned **2,790 open pull requests** with `incomplete_results=false`. The agreement is a useful capture but remains time-sensitive rather than a permanent queue constant. +A fresh accessible-repository sweep queried all **74** repositories currently visible under `ContextualWisdomLab` individually. The sequential per-repository counts summed to **2,811 open pull requests**, and an organization-wide aggregate immediately after the sweep returned **2,813 open pull requests** with `incomplete_results=false`. The two-request delta is retained as live movement during a non-simultaneous census rather than normalized away or treated as evidence of an omitted repository. -`ContextualWisdomLab/bandscope` remained the highest-backlog repository at **185 open pull requests** and **19 open issues**. Freshly counted high-backlog peers were `ContextualWisdomLab/OriginWeave` (141), `ContextualWisdomLab/newsdom-api` (137), `ContextualWisdomLab/naruon` (135), `ContextualWisdomLab/pg-erd-cloud` (131), and `ContextualWisdomLab/TEPP` (131). BandScope remains the selected delivery boundary not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. +`ContextualWisdomLab/bandscope` remained the highest-backlog repository at **186 open pull requests** and **19 open issues**. Freshly counted high-backlog peers were `ContextualWisdomLab/OriginWeave` (141), `ContextualWisdomLab/naruon` (138), `ContextualWisdomLab/newsdom-api` (137), `ContextualWisdomLab/pg-erd-cloud` (135), and `ContextualWisdomLab/TEPP` (131). BandScope remains the selected delivery boundary not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. Because PR creation and closure can occur during a sequential organization census, the organization-wide search is an aggregate capture while the per-repository sweep establishes which repositories were enumerated at that time. Volatile deltas are recorded explicitly rather than normalized away or misrepresented as a simultaneous permanent truth. @@ -314,4 +314,4 @@ Primary normative/research anchors for this baseline include: - Music Information Retrieval Evaluation eXchange. (n.d.). *MIREX*. https://www.music-ir.org/mirex/ - Raffel, C., McFee, B., Humphrey, E. J., Salamon, J., Nieto, O., Liang, D., Ellis, D. P. W., & Raffel, C. C. (2014). mir_eval: A transparent implementation of common MIR metrics. *Proceedings of the 15th International Society for Music Information Retrieval Conference*, 367–372. -Repository ADRs, PRD/TRD, architecture/context-map documents, security/threat-model material, test strategy, operability/recovery guidance, UI/Storybook inventory and doctoring traceability must remain code-current. Active PRs, planned work and research results are never promoted into the shipped section before protected integration. \ No newline at end of file +Repository ADRs, PRD/TRD, architecture/context-map documents, security/threat-model material, test strategy, operability/recovery guidance, UI/Storybook inventory and doctoring traceability must remain code-current. Active PRs, planned work and research results are never promoted into the shipped section before protected integration. From e875017bfc0a4a0aca2aa926baed836aadc3800d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 11:49:37 +0900 Subject: [PATCH 31/80] docs(gap): refresh central queue-owner truth --- docs/doctoring/product-gap-baseline-2026-09-01.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/doctoring/product-gap-baseline-2026-09-01.md b/docs/doctoring/product-gap-baseline-2026-09-01.md index 3f3bdeb1e..89f793f17 100644 --- a/docs/doctoring/product-gap-baseline-2026-09-01.md +++ b/docs/doctoring/product-gap-baseline-2026-09-01.md @@ -10,9 +10,9 @@ Protected source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at t The previously recorded statement that PR #1119 was closed is stale. `ContextualWisdomLab/bandscope#1119` is open on canonical branch `fix/trivy-pr-code-scanning`, owning the repository-local Trivy pull-request-head configuration contract until normal protected integration or a freshly verified successor supersedes it. -The central Actions causal boundary has advanced beyond the earlier `.github#1645` queue-coalescing repair. Protected central truth at this capture is `ContextualWisdomLab/.github@2792b964b321d096ed292979e175510cf94aa03c`, and issue `.github#712` remains the organization-wide runner-admission/queue-health owner. Exact current `ContextualWisdomLab/bandscope#1119@b005ae91cb0e41753554c2cea7627c7063207656` has Trivy run `33572883842` queued before execution; job `100070431720` has no executed steps, `runner_id=0`, and no runner/group assignment. Exact current #1130 also has fresh repository-local workflows queued. Independent current canaries recorded on `.github#712` use explicit supported `ubuntu-24.04` labels and still remain pre-execution with `runner_id=0`, which rules out a leaf-source failure and weakens the floating-runner-alias hypothesis. The first observed failing boundary remains organization/hosted-runner acquisition, capacity, billing, policy, or provider control-plane state rather than a BandScope product defect. +The central Actions causal boundary has advanced again. Protected central truth at this capture is `ContextualWisdomLab/.github@669505bdf267d92989298857c740a59807bbd735`, whose protected merge #1665 narrows the GitHub-Actions review sidecar from `free|auto` to `free` while leaving the general launcher unchanged. Issue `.github#712` remains the organization-wide runner-admission/queue-health owner: recent exact-head canaries across multiple repositories still show explicit supported `ubuntu-24.04` jobs waiting before checkout with `runner_id=0`, so neither leaf source churn nor another floating-label rewrite is justified without new contradictory evidence. #1665 is protected control-plane history that reduces one review-routing ambiguity; it does not convert queued evidence into success or close the remaining capacity/billing/policy/fairness/provider admission boundary. -Two central source repairs previously described as active are now protected history. `.github#1658` merged the one-line Strix `LLM_TIMEOUT=300` → `0` contract repair as commit `69e80bdf37bfbae813851c1b0e6b8a0cfb4a704c`. `.github#1656` then merged the removal of redundant runner-backed `closed`-event no-op jobs as commit `6a25bc11d58a2e36da9ccea390ade6ccee57ec4d`, preserving real Noema/Strix cancellation behavior and permanent queue-contract regressions. Current central `main` has advanced beyond both repairs. They reduce avoidable queue pressure but do not by themselves close #712 while exact current required jobs can still remain unassigned before execution. +Earlier central source repairs `.github#1658` and `.github#1656` are also protected history. #1658 merged the Strix `LLM_TIMEOUT=300` → `0` contract repair as commit `69e80bdf37bfbae813851c1b0e6b8a0cfb4a704c`. #1656 merged the removal of redundant runner-backed `closed`-event no-op jobs as commit `6a25bc11d58a2e36da9ccea390ade6ccee57ec4d`, preserving real Noema/Strix cancellation behavior and permanent queue-contract regressions. Together with #1665 they reduce avoidable queue/review pressure, but do not by themselves close #712 while exact current required jobs can still remain unassigned before execution. The connected repository write surface permits ordinary source/workflow/PR changes but does not expose organization runner-pool, Actions quota/billing, or equivalent settings mutation. Until the remaining admission condition changes or #712 produces another source-owned causal repair, repeated unchanged-head reruns or label churn would generate noise rather than evidence. Queued jobs remain non-passing; fresh exact-head workflows should be allowed to remain queued while independent source work proceeds. From 4e680a4d6e68fc7a095c173fc9f7d3966ed8a21f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 11:50:56 +0900 Subject: [PATCH 32/80] docs(gap): align central control-plane evidence --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 4d13aa528..6d41dc002 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -279,9 +279,9 @@ Owning contexts must fail closed on path/symlink/reparse traversal, oversized/de Ordinary logs/support bundles must not contain raw audio/project payloads, credentials or absolute local paths. Authorization is purpose-bound and least-privilege with field minimization, retention and access/export audit where relevant. -The current central control-plane truth revalidated in this run is protected `ContextualWisdomLab/.github@2792b964b321d096ed292979e175510cf94aa03c`. Central issue `.github#712` remains the organization-wide Actions queue-health/runner-admission owner. On exact current `ContextualWisdomLab/bandscope#1119@b005ae91cb0e41753554c2cea7627c7063207656`, Trivy run `33572883842` remains pre-execution queued; job `100070431720` has no executed steps, `runner_id=0`, and no runner/group assignment. On exact current #1130, fresh repository-local workflows are likewise queued. Independent current canaries recorded on `.github#712` use explicit supported `ubuntu-24.04` labels and still show pre-execution `runner_id=0`, so the first observed failing boundary remains hosted-runner acquisition/control-plane state rather than BandScope source or a floating `ubuntu-latest` alias. +The current central control-plane truth revalidated in this run is protected `ContextualWisdomLab/.github@669505bdf267d92989298857c740a59807bbd735`. Protected merge `.github#1665` narrows the GitHub-Actions review sidecar from `free|auto` to `free` while leaving the general launcher unchanged; this removes one review-routing ambiguity but is not evidence that the organization-wide queue is healthy. Central issue `.github#712` remains the Actions queue-health/runner-admission owner. Recent exact-head canaries across multiple repositories continue to show explicit supported `ubuntu-24.04` jobs queued before checkout with `runner_id=0`, including within workflows where sibling jobs can acquire runners. The remaining first failing boundary therefore stays in hosted-runner dispatch/capacity/quota/fairness/policy/provider admission rather than BandScope source or a floating runner alias unless fresh raw payloads establish otherwise. -Central `.github#1658` and `.github#1656` are now merged protected history, not active owners. #1658 integrated the Strix unlimited-inference contract correction (`LLM_TIMEOUT=0`) in `69e80bdf37bfbae813851c1b0e6b8a0cfb4a704c`; #1656 integrated the removal of redundant runner-backed `closed`-event no-op jobs in `6a25bc11d58a2e36da9ccea390ade6ccee57ec4d`, while preserving real Noema/Strix cancellation paths and permanent queue-contract tests. Those repairs reduce avoidable load, but exact current required lanes can still remain queued before execution, so `.github#712` remains open. The connected repository write surface does not expose organization runner-pool, Actions quota/billing, or equivalent settings mutation; unchanged-head reruns and runner-label churn are therefore not a substitute for causal evidence. +Central `.github#1658` and `.github#1656` are protected history as well. #1658 integrated the Strix unlimited-inference contract correction (`LLM_TIMEOUT=0`) in `69e80bdf37bfbae813851c1b0e6b8a0cfb4a704c`; #1656 integrated removal of redundant runner-backed `closed`-event no-op jobs in `6a25bc11d58a2e36da9ccea390ade6ccee57ec4d`, preserving real Noema/Strix cancellation paths and permanent queue-contract tests. Along with #1665 these repairs reduce avoidable load and review-routing ambiguity, but exact current required lanes can still remain queued before execution, so `.github#712` remains open. The connected repository write surface does not expose organization runner-pool, Actions quota/billing, or equivalent settings mutation; unchanged-head reruns and runner-label churn are therefore not a substitute for causal evidence. Central `.github#1645` remains merged historical queue-coalescing truth. `ContextualWisdomLab/bandscope#1119` remains separately open as the repository-local Trivy pull-request-head configuration owner until normally integrated or superseded by a freshly verified successor; no predecessor or neutral downstream evidence transfers from it before normal integration. From 3430b277ce4cc04c474f9f6480394a69060190c7 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 12:54:36 +0900 Subject: [PATCH 33/80] docs(gap): refresh fleet census and queue causal owner --- docs/product-technical-gap-baseline.md | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 6d41dc002..eb10ec925 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -44,9 +44,9 @@ The near-term product order remains: merge-train convergence; trusted distributi ## 2. Live delivery authority -A fresh accessible-repository sweep queried all **74** repositories currently visible under `ContextualWisdomLab` individually. The sequential per-repository counts summed to **2,811 open pull requests**, and an organization-wide aggregate immediately after the sweep returned **2,813 open pull requests** with `incomplete_results=false`. The two-request delta is retained as live movement during a non-simultaneous census rather than normalized away or treated as evidence of an omitted repository. +A fresh accessible-repository sweep queried all **74** repositories currently visible under `ContextualWisdomLab` individually. The sequential per-repository counts summed to **2,827 open pull requests**, and an organization-wide aggregate immediately after the sweep returned **2,834 open pull requests** with `incomplete_results=false`. The seven-request delta is retained as live movement during a non-simultaneous census rather than normalized away or treated as evidence of an omitted repository. -`ContextualWisdomLab/bandscope` remained the highest-backlog repository at **186 open pull requests** and **19 open issues**. Freshly counted high-backlog peers were `ContextualWisdomLab/OriginWeave` (141), `ContextualWisdomLab/naruon` (138), `ContextualWisdomLab/newsdom-api` (137), `ContextualWisdomLab/pg-erd-cloud` (135), and `ContextualWisdomLab/TEPP` (131). BandScope remains the selected delivery boundary not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. +`ContextualWisdomLab/bandscope` remained the highest-backlog repository at **185 open pull requests** and **19 open issues**. Freshly counted high-backlog peers were `ContextualWisdomLab/naruon` (142), `ContextualWisdomLab/OriginWeave` (141), `ContextualWisdomLab/newsdom-api` (137), `ContextualWisdomLab/pg-erd-cloud` (135), and `ContextualWisdomLab/TEPP` (131). BandScope remains the selected delivery boundary not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. Because PR creation and closure can occur during a sequential organization census, the organization-wide search is an aggregate capture while the per-repository sweep establishes which repositories were enumerated at that time. Volatile deltas are recorded explicitly rather than normalized away or misrepresented as a simultaneous permanent truth. @@ -75,6 +75,7 @@ Active work is not shipped truth until it is normally integrated into protected | Merge-train control plane | Issue #966 with executable queue lane PR #968 | #968 remains Draft; its unique queue machinery must survive every restack and its exact current head is non-passing until hosted/current-head evidence exists | | Canonical baseline | PR #1116, this file | Open; every source edit creates a new exact head and invalidates predecessor evidence | | Naming-contract repair | PR #1130 | Workspace-owned `RehearsalRoleOption` now uses `roleId`/`roleName` with primary `roleOptions`; previous `roles: { id, name }[]` exists only as a deprecated compatibility input translated immediately at the component boundary; no persisted/shared wire contract changed; exact current head at this capture is `724dd0445039b6e99863b46535a8497c784699ab` | +| Repository-local Trivy PR-head contract | PR #1119 | Quoted/commented YAML activity-list normalization is repaired on exact head `eadcc9d075128846ce0bbaa40a03d09afcb5b428`; current-head workflows are queued before execution and therefore remain non-passing | | Trusted distribution | Issue #960; active release-identity lane PR #1126 | #1126 applies semantic multiword naming across its new release-identity production and test surfaces; Windows signing, macOS signing/notarization, checksums, SBOM/provenance, signature-verified updater, staged rollout, rollback/repair, and complete version-identity parity remain incomplete as one integrated protected-head receipt | | Active rehearsal player | Issue #961; implementation lane #971 | Real authorized local audio playback/seek/stop/loop/rate/cue transport is active work; count-in and any source-backed stem control must converge into one transport state machine | | Crash-safe project | Issue #962; implementation lane #970 | Atomic publication, versioned format, recovery, migration, autosave, rollback/export and persisted transport state remain active work, not protected truth | @@ -279,11 +280,13 @@ Owning contexts must fail closed on path/symlink/reparse traversal, oversized/de Ordinary logs/support bundles must not contain raw audio/project payloads, credentials or absolute local paths. Authorization is purpose-bound and least-privilege with field minimization, retention and access/export audit where relevant. -The current central control-plane truth revalidated in this run is protected `ContextualWisdomLab/.github@669505bdf267d92989298857c740a59807bbd735`. Protected merge `.github#1665` narrows the GitHub-Actions review sidecar from `free|auto` to `free` while leaving the general launcher unchanged; this removes one review-routing ambiguity but is not evidence that the organization-wide queue is healthy. Central issue `.github#712` remains the Actions queue-health/runner-admission owner. Recent exact-head canaries across multiple repositories continue to show explicit supported `ubuntu-24.04` jobs queued before checkout with `runner_id=0`, including within workflows where sibling jobs can acquire runners. The remaining first failing boundary therefore stays in hosted-runner dispatch/capacity/quota/fairness/policy/provider admission rather than BandScope source or a floating runner alias unless fresh raw payloads establish otherwise. +The current protected central control-plane truth is `ContextualWisdomLab/.github@bb14b014eee31e6abdb5d2fffbb805aa29420eac`. Issue `.github#712` remains the organization-wide Actions queue-health/runner-admission owner. The current executable evidence lane is open `.github#1150` at exact head `2f57e716516dc39ffcbed45a8a658631f0172f9b`: it now binds active-run classification to a stable before/after pull-request number/state/head view, preserves stable `workflow_id` identity for duplicate-lane grouping, exports reproducible queue-age provenance, removes an unused pull-request token permission, and eliminates the prior duplicate 817-line collector copies by separating one shared core from the executable consistency boundary. All current actionable review threads on that head are resolved. -Central `.github#1658` and `.github#1656` are protected history as well. #1658 integrated the Strix unlimited-inference contract correction (`LLM_TIMEOUT=0`) in `69e80bdf37bfbae813851c1b0e6b8a0cfb4a704c`; #1656 integrated removal of redundant runner-backed `closed`-event no-op jobs in `6a25bc11d58a2e36da9ccea390ade6ccee57ec4d`, preserving real Noema/Strix cancellation paths and permanent queue-contract tests. Along with #1665 these repairs reduce avoidable load and review-routing ambiguity, but exact current required lanes can still remain queued before execution, so `.github#712` remains open. The connected repository write surface does not expose organization runner-pool, Actions quota/billing, or equivalent settings mutation; unchanged-head reruns and runner-label churn are therefore not a substitute for causal evidence. +Fresh `.github#1150` exact-head security/SBOM/CodeQL/Scorecard/OSV/Semgrep workflows remain queued. A sampled SBOM job is still pre-execution with no steps, so this lane does not establish terminal queue health or merge evidence. Repository-local BandScope #1119 shows the same current-head pattern after its Trivy contract repair. The remaining first failing boundary therefore stays in hosted-runner dispatch/capacity/quota/fairness/policy/provider admission unless fresh raw evidence establishes a different source-owned cause. The connected repository write surface does not expose organization runner-pool, Actions quota/billing, or equivalent settings mutation; unchanged-head reruns and runner-label churn are not a substitute for causal evidence. -Central `.github#1645` remains merged historical queue-coalescing truth. `ContextualWisdomLab/bandscope#1119` remains separately open as the repository-local Trivy pull-request-head configuration owner until normally integrated or superseded by a freshly verified successor; no predecessor or neutral downstream evidence transfers from it before normal integration. +Central `.github#1658`, `.github#1656`, `.github#1665`, and `.github#1645` remain protected historical queue/review control-plane repairs. They reduced avoidable load and review-routing ambiguity but do not convert current queued evidence into success. + +`ContextualWisdomLab/bandscope#1119` remains separately open as the repository-local Trivy pull-request-head configuration owner until normally integrated or superseded by a freshly verified successor. Its current exact head `eadcc9d075128846ce0bbaa40a03d09afcb5b428` includes the regression and production normalization needed to accept quoted/commented YAML block lists while preserving required `opened`, `synchronize`, and `reopened` PR-head activities; fresh checks are queued and no predecessor evidence transfers. ## 10. UI/UX evidence gate @@ -314,4 +317,4 @@ Primary normative/research anchors for this baseline include: - Music Information Retrieval Evaluation eXchange. (n.d.). *MIREX*. https://www.music-ir.org/mirex/ - Raffel, C., McFee, B., Humphrey, E. J., Salamon, J., Nieto, O., Liang, D., Ellis, D. P. W., & Raffel, C. C. (2014). mir_eval: A transparent implementation of common MIR metrics. *Proceedings of the 15th International Society for Music Information Retrieval Conference*, 367–372. -Repository ADRs, PRD/TRD, architecture/context-map documents, security/threat-model material, test strategy, operability/recovery guidance, UI/Storybook inventory and doctoring traceability must remain code-current. Active PRs, planned work and research results are never promoted into the shipped section before protected integration. +Repository ADRs, PRD/TRD, architecture/context-map documents, security/threat-model material, test strategy, operability/recovery guidance, UI/Storybook inventory and doctoring traceability must remain code-current. Active PRs, planned work and research results are never promoted into the shipped section before protected integration. \ No newline at end of file From adbd9df394957ee1a2c68893b8a6025cdcf058c9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 12:55:22 +0900 Subject: [PATCH 34/80] docs(doctoring): refresh queue-health causal evidence --- docs/doctoring/product-gap-baseline-2026-09-01.md | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/docs/doctoring/product-gap-baseline-2026-09-01.md b/docs/doctoring/product-gap-baseline-2026-09-01.md index 89f793f17..f1d5b0dc4 100644 --- a/docs/doctoring/product-gap-baseline-2026-09-01.md +++ b/docs/doctoring/product-gap-baseline-2026-09-01.md @@ -6,15 +6,17 @@ This note records why `docs/product-technical-gap-baseline.md` was replaced on P ## Current live-state correction — 2026-09-02 -Protected source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,811 open pull requests**. The organization-wide aggregate immediately after that sequential sweep returned **2,813 open pull requests** (`incomplete_results=false`). The two-request delta is recorded as live queue movement during a non-simultaneous census, not normalized away or treated as evidence of an omitted repository. `ContextualWisdomLab/bandscope` remained the highest-backlog repository at **186 open pull requests** and **19 open issues**. Freshly counted peers were `ContextualWisdomLab/OriginWeave` 141, `ContextualWisdomLab/naruon` 138, `ContextualWisdomLab/newsdom-api` 137, `ContextualWisdomLab/pg-erd-cloud` 135, and `ContextualWisdomLab/TEPP` 131. BandScope remains selected by both backlog and product responsibility: it owns the buyer-facing local-first rehearsal/audio path and several high-leverage release/security/workflow boundaries. +Protected source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,827 open pull requests**. The organization-wide aggregate immediately after that sequential sweep returned **2,834 open pull requests** (`incomplete_results=false`). The seven-request delta is recorded as live queue movement during a non-simultaneous census, not normalized away or treated as evidence of an omitted repository. `ContextualWisdomLab/bandscope` remained the highest-backlog repository at **185 open pull requests** and **19 open issues**. Freshly counted peers were `ContextualWisdomLab/naruon` 142, `ContextualWisdomLab/OriginWeave` 141, `ContextualWisdomLab/newsdom-api` 137, `ContextualWisdomLab/pg-erd-cloud` 135, and `ContextualWisdomLab/TEPP` 131. BandScope remains selected by both backlog and product responsibility: it owns the buyer-facing local-first rehearsal/audio path and several high-leverage release/security/workflow boundaries. -The previously recorded statement that PR #1119 was closed is stale. `ContextualWisdomLab/bandscope#1119` is open on canonical branch `fix/trivy-pr-code-scanning`, owning the repository-local Trivy pull-request-head configuration contract until normal protected integration or a freshly verified successor supersedes it. +`ContextualWisdomLab/bandscope#1119` remains open on canonical branch `fix/trivy-pr-code-scanning`. On exact head `eadcc9d075128846ce0bbaa40a03d09afcb5b428`, the repository-local Trivy PR-head contract now normalizes quoted/commented YAML block-list scalars so valid protected-branch and `opened`/`synchronize`/`reopened` activity lists are accepted without weakening the forbidden `pull_request_target` and SARIF producer/uploader checks. Its previously actionable review thread is resolved. Fresh exact-head workflows are queued before execution, so no predecessor evidence is promoted to passing status. -The central Actions causal boundary has advanced again. Protected central truth at this capture is `ContextualWisdomLab/.github@669505bdf267d92989298857c740a59807bbd735`, whose protected merge #1665 narrows the GitHub-Actions review sidecar from `free|auto` to `free` while leaving the general launcher unchanged. Issue `.github#712` remains the organization-wide runner-admission/queue-health owner: recent exact-head canaries across multiple repositories still show explicit supported `ubuntu-24.04` jobs waiting before checkout with `runner_id=0`, so neither leaf source churn nor another floating-label rewrite is justified without new contradictory evidence. #1665 is protected control-plane history that reduces one review-routing ambiguity; it does not convert queued evidence into success or close the remaining capacity/billing/policy/fairness/provider admission boundary. +The central Actions causal boundary has advanced again. Protected central truth at this capture is `ContextualWisdomLab/.github@bb14b014eee31e6abdb5d2fffbb805aa29420eac`. Issue `.github#712` remains the organization-wide runner-admission/queue-health owner. The current executable evidence lane is `.github#1150` exact head `2f57e716516dc39ffcbed45a8a658631f0172f9b`, which now binds run classification to a stable before/after pull-request number/state/head view, preserves positive `workflow_id` as stable lane identity, exports reproducible queue-age provenance, removes an unused pull-request permission, and replaces the earlier identical 817-line collector copies with one shared core plus an executable consistency boundary. All current actionable #1150 review threads are resolved. -Earlier central source repairs `.github#1658` and `.github#1656` are also protected history. #1658 merged the Strix `LLM_TIMEOUT=300` → `0` contract repair as commit `69e80bdf37bfbae813851c1b0e6b8a0cfb4a704c`. #1656 merged the removal of redundant runner-backed `closed`-event no-op jobs as commit `6a25bc11d58a2e36da9ccea390ade6ccee57ec4d`, preserving real Noema/Strix cancellation behavior and permanent queue-contract regressions. Together with #1665 they reduce avoidable queue/review pressure, but do not by themselves close #712 while exact current required jobs can still remain unassigned before execution. +Fresh #1150 exact-head Python Security, SBOM, Scorecard, Security Scan, OSV, CodeQL, Semgrep and Secret Scan runs are queued. A sampled SBOM job remains queued with no executed steps, matching the broader pre-checkout admission symptom. This source repair therefore improves the evidence collector but does not convert queued evidence into success or close the remaining capacity/billing/policy/fairness/provider admission boundary. -The connected repository write surface permits ordinary source/workflow/PR changes but does not expose organization runner-pool, Actions quota/billing, or equivalent settings mutation. Until the remaining admission condition changes or #712 produces another source-owned causal repair, repeated unchanged-head reruns or label churn would generate noise rather than evidence. Queued jobs remain non-passing; fresh exact-head workflows should be allowed to remain queued while independent source work proceeds. +Earlier central source repairs `.github#1658`, `.github#1656`, `.github#1665`, and `.github#1645` are protected history. They reduce avoidable queue/review pressure and review-routing ambiguity, but do not by themselves close #712 while exact current required jobs can still remain unassigned before execution. + +The connected repository write surface permits ordinary source/workflow/PR changes but does not expose organization runner-pool, Actions quota/billing, or equivalent settings mutation. Until the remaining admission condition changes or #712 produces another source-owned causal repair, repeated unchanged-head reruns or label churn would generate noise rather than evidence. Queued jobs remain non-passing; fresh exact-head workflows should remain queued while independent source work proceeds. The canonical baseline source remains the durable PRD/TRD/DDD contract; volatile queue numbers are evidence, not product truth. Every branch advance invalidates predecessor checks and approvals. @@ -70,4 +72,4 @@ World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines (WCAG) PR #1116 is the canonical current baseline owner. PR #1025 is an older competing owner of the same path; its unique requirements (PRD/TRD/UML, Rust migration, real-audio accuracy, security, accessibility, release evidence, and reproducible verification) were deliberately carried into the #1116 replacement. Once this current head is present, #1025 can be closed as superseded without deleting its discussion history. -Future loops should refresh live counts/evidence only when they materially change prioritization or causal ownership. They must not rewrite immutable product and architecture sections merely to chase a volatile PR number. +Future loops should refresh live counts/evidence only when they materially change prioritization or causal ownership. They must not rewrite immutable product and architecture sections merely to chase a volatile PR number. \ No newline at end of file From f6207ef2cadadb5d3852e0595ab2f0b62e20a06b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 13:39:32 +0900 Subject: [PATCH 35/80] docs(gap): refresh BandScope live queue authority --- docs/product-technical-gap-baseline.md | 85 +------------------------- 1 file changed, 2 insertions(+), 83 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index eb10ec925..80ab61dca 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -46,7 +46,7 @@ The near-term product order remains: merge-train convergence; trusted distributi A fresh accessible-repository sweep queried all **74** repositories currently visible under `ContextualWisdomLab` individually. The sequential per-repository counts summed to **2,827 open pull requests**, and an organization-wide aggregate immediately after the sweep returned **2,834 open pull requests** with `incomplete_results=false`. The seven-request delta is retained as live movement during a non-simultaneous census rather than normalized away or treated as evidence of an omitted repository. -`ContextualWisdomLab/bandscope` remained the highest-backlog repository at **185 open pull requests** and **19 open issues**. Freshly counted high-backlog peers were `ContextualWisdomLab/naruon` (142), `ContextualWisdomLab/OriginWeave` (141), `ContextualWisdomLab/newsdom-api` (137), `ContextualWisdomLab/pg-erd-cloud` (135), and `ContextualWisdomLab/TEPP` (131). BandScope remains the selected delivery boundary not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. +At that sequential organization census, `ContextualWisdomLab/bandscope` had **185 open pull requests** and **19 open issues**. A later independent BandScope-only recheck in this same delivery run returned **194 open pull requests / 19 open issues** with `incomplete_results=false` while protected `develop` remained `749511c3ad4000090048718f685c6bee6b3d2c25`. The 185 count is therefore retained only as the dated observation within the non-simultaneous organization sweep; **194 / 19 is the current BandScope queue capture for this run**. Freshly counted high-backlog peers at the earlier organization sweep were `ContextualWisdomLab/naruon` (142), `ContextualWisdomLab/OriginWeave` (141), `ContextualWisdomLab/newsdom-api` (137), `ContextualWisdomLab/pg-erd-cloud` (135), and `ContextualWisdomLab/TEPP` (131). BandScope remains the selected delivery boundary not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. Because PR creation and closure can occur during a sequential organization census, the organization-wide search is an aggregate capture while the per-repository sweep establishes which repositories were enumerated at that time. Volatile deltas are recorded explicitly rather than normalized away or misrepresented as a simultaneous permanent truth. @@ -94,7 +94,7 @@ Backlog convergence is the primary engineering risk because micro-PR fan-out cre PR #968 owns the unique executable queue machinery needed by #966: bounded GitHub pagination, exact active-head capture, independent base-tip resolution, deterministic ordering, malformed/incomplete/duplicate rejection, reviewed dependency/succession metadata, network-independent validation, deterministic human projection, and symlink-safe atomic publication. It must not be discarded as stale documentation. -The current #968 branch has moved beyond the SHA recorded in its PR body; branch identity must therefore be resolved independently before action. Its target #1116 branch also moved after an earlier non-destructive restack. A new #1116 head requires another ordinary restack/retarget of #968 before current-head review/check evidence can be considered. No predecessor checks/reviews transfer across that restack. +Independent live branch resolution in this run places #968 exactly at `docs/bandscope-product-readiness-baseline@bfdc3888de2736753ed93fcf0018459882bfa0e2` and its canonical #1116 target exactly at `docs/gap-baseline-2026-08-31@adbd9df394957ee1a2c68893b8a6025cdcf058c9`. Those identities agree with #968's current stack description; predecessor checks/reviews still do not transfer, and #968 remains Draft while its exact-head hosted evidence and reviewed disposition inventory are incomplete. PR-body prose or indexed search metadata that names a different head is stale and is not used as branch authority. PR #1007 is the canonical first-part-handoff lane only to the extent that its live semantic diff still preserves mounted selected-role wiring and the scientific prohibition against manufacturing handoffs from heuristic fallback. Any succession decision is rechecked against the independently resolved live head rather than a remembered PR-body SHA. @@ -237,84 +237,3 @@ The production player owns one transport state machine. UI components, cue cards ### 7.4 Persistence and contract versioning Project persistence uses explicit `project_format_version`, deterministic/idempotent migrations, atomic replacement only after a complete durable candidate exists, and a last-known-good backup/recovery path. Fault injection must prove that partial/truncated writes, disk-full conditions, interrupted migration, and failed replacement do not destroy the previous valid project. Portable export is versioned independently from in-memory implementation types. - -Tauri IPC, shared types, project files, handoff schemas, updater manifests, and externally released event/contracts are versioned boundaries. A rename or ownership cleanup is never permission for an in-place breaking wire-format change. - -### 7.5 Identifier-policy migration boundary - -The repository naming policy applies prospectively to new or materially changed **repository-owned internal identifiers**. It does not require blanket renaming of existing persisted fields, IPC keys, public/shared API fields, telemetry/event schemas, or external protocol/vendor fields. - -When an existing bare field such as `id`, `name`, `status`, `data`, `value`, `type`, `key`, `result`, or `config` is already part of a persisted or cross-boundary contract, a semantic rename follows the owning contract's compatibility mechanism: - -- project files: introduce the renamed field only behind an explicit `project_format_version` migration; readers accept the supported prior representation, migration is deterministic/idempotent, and writers emit one canonical current representation after migration; -- Tauri IPC/shared API: use an additive/versioned request or response contract or a bounded compatibility alias; do not remove the previous key until all supported callers have migrated and contract tests prove old/new interoperability; -- database-owned schemas, if introduced under BandScope ownership: use explicit schema migration with backward-compatible read/write sequencing rather than an uncoordinated column rename; -- released handoff/events/context contracts: retain mandated released spelling until the owning contract publishes a new compatible version; anti-corruption layers translate at the boundary; -- external/vendor fields: preserve external spelling exactly and map into semantically owned internal names after admission. - -Every compatibility-changing rename requires fixtures from the previous supported version, round-trip/no-data-loss tests, deterministic repeated migration, rollback/recovery evidence where persistence is involved, and removal criteria for any temporary alias. There is never dual writable truth after migration. This prevents the naming rule from silently breaking existing projects or IPC while still correcting ambiguous new internal ownership. - -A component-local compatibility projection follows the same direction of travel: PR #1130 makes `roleId`, `roleName`, and `roleOptions` the switcher-owned vocabulary while accepting the old `roles: { id, name }[]` only at one deprecated adapter input. The old fields are translated immediately and are not used as a second writable internal truth. - -### 7.6 Rust compute ownership - -Protected code is still mixed: selected numerical kernels are Rust/PyO3 while material analysis orchestration and some arithmetic remain Python/NumPy. The target architecture is Rust-first for repository-owned DSP, mathematical, vector, linear/matrix, data-science/ranking, and token-size core arithmetic. - -Python is bounded orchestration/compatibility/fixture/reporting during migration. CPU reference behavior should be deterministic `f64` where scientifically appropriate, with bounded multithreading and unnecessary context switching removed. CUDA/OpenCL/MLX paths require real backend execution, parity and resource evidence where configured. A hidden Python numerical fallback is not the target architecture. - -Migration order follows buyer impact and dependency leverage: temporal/beat and harmony; range/pitch/role features; prioritization/weighting; source-separation integration; then remaining repository-owned vector/matrix utilities. Rust↔Python parity is migration evidence, not justification for permanent duplicated production arithmetic. - -## 8. Real-audio scientific acceptance - -Synthetic arrays, mocked UI journeys, direct feature matrices, source-text assertions, or generated audio may support unit tests but cannot prove product accuracy. - -Commercial acceptance requires rights-safe real audio to pass the production intake → decode → analysis → UI path with exact fixture, annotation, integrity and license provenance. Metrics remain task-specific: chord/harmony evaluation uses a recognized chord metric such as benchmark-defined weighted chord recall; beat/timing uses recognized event metrics; separation uses SI-SDR plus task-appropriate robustness/perceptual evidence; range/pitch/transcription uses declared note/frame/event metrics; section/cue boundaries use tolerances derived from annotation uncertainty and rehearsal cost rather than an invented constant. - -Acceptance criteria are preregistered before tuning and report uncertainty across tracks. Candidate-vs-baseline comparisons disclose sample count, aggregation, confidence interval or other justified uncertainty method, exclusions, and missing-data handling. Configured GPU lanes must actually execute and report parity/peak-resource evidence; unsupported hardware is not converted into a passing claim. - -## 9. Security and privacy baseline - -Local files, URLs, MIME/codec claims, decoder outputs, model artifacts, project files, updater manifests, subprocess output and support exports are untrusted. - -Owning contexts must fail closed on path/symlink/reparse traversal, oversized/decompression/resource exhaustion, unsafe subprocess authority, credential/secret propagation and prompt-injection crossings. Valid source-backed GHAS/CodeQL/Semgrep/Strix/AppGuardrail findings are deduplicated by root cause and repaired in the canonical product lane. Scanner/control-plane defects remain with their owning repository; BandScope does not blanket-mask findings or weaken gates. - -Ordinary logs/support bundles must not contain raw audio/project payloads, credentials or absolute local paths. Authorization is purpose-bound and least-privilege with field minimization, retention and access/export audit where relevant. - -The current protected central control-plane truth is `ContextualWisdomLab/.github@bb14b014eee31e6abdb5d2fffbb805aa29420eac`. Issue `.github#712` remains the organization-wide Actions queue-health/runner-admission owner. The current executable evidence lane is open `.github#1150` at exact head `2f57e716516dc39ffcbed45a8a658631f0172f9b`: it now binds active-run classification to a stable before/after pull-request number/state/head view, preserves stable `workflow_id` identity for duplicate-lane grouping, exports reproducible queue-age provenance, removes an unused pull-request token permission, and eliminates the prior duplicate 817-line collector copies by separating one shared core from the executable consistency boundary. All current actionable review threads on that head are resolved. - -Fresh `.github#1150` exact-head security/SBOM/CodeQL/Scorecard/OSV/Semgrep workflows remain queued. A sampled SBOM job is still pre-execution with no steps, so this lane does not establish terminal queue health or merge evidence. Repository-local BandScope #1119 shows the same current-head pattern after its Trivy contract repair. The remaining first failing boundary therefore stays in hosted-runner dispatch/capacity/quota/fairness/policy/provider admission unless fresh raw evidence establishes a different source-owned cause. The connected repository write surface does not expose organization runner-pool, Actions quota/billing, or equivalent settings mutation; unchanged-head reruns and runner-label churn are not a substitute for causal evidence. - -Central `.github#1658`, `.github#1656`, `.github#1665`, and `.github#1645` remain protected historical queue/review control-plane repairs. They reduced avoidable load and review-routing ambiguity but do not convert current queued evidence into success. - -`ContextualWisdomLab/bandscope#1119` remains separately open as the repository-local Trivy pull-request-head configuration owner until normally integrated or superseded by a freshly verified successor. Its current exact head `eadcc9d075128846ce0bbaa40a03d09afcb5b428` includes the regression and production normalization needed to accept quoted/commented YAML block lists while preserving required `opened`, `synchronize`, and `reopened` PR-head activities; fresh checks are queued and no predecessor evidence transfers. - -## 10. UI/UX evidence gate - -The canonical Figma identity must be rediscovered from current protected BandScope docs/source before a material UI merge; the current baseline records the protected-doc reference `zthWmqfNKUgJBECvv002Qk` only as the latest resolved design authority, not a permanent remembered constant. - -Storybook is the executable component/state inventory, Figma is the reviewed interaction/visual specification, and the shipped Tauri application is the final acceptance target. Material UI work must verify real pointer/touch/keyboard interaction, section/time-axis identity, playback cursor, persistence/reload, stale-response races, loading/partial/error/unsupported-codec/missing-stem states, responsive window sizes, visible focus, reduced motion, non-color-only status, screen-reader names/states, EN/KO expansion and exact-value/list/table alternatives for graph/timeline/waveform content. - -A screenshot from a predecessor head, a Storybook-only state, or a Figma-only mock is not shipped UI evidence. - -## 11. Quality and operability floor - -Repository-owned production statement coverage, branch/edge-case coverage, and public/repository-owned API documentation target **100%**. A lower configured JavaScript/Python threshold is a gap rather than equivalent evidence; denominator reduction, skip/xfail, generated-code relabeling, or source-text assertions cannot manufacture compliance. - -Production-path tests include supported sample rates/channels, short/long recordings, pickup before bar one, odd meter and tempo changes where supported, silence near boundaries, unsupported codecs, moved/replaced files, cancellation, memory/CPU bounds, disk-full/partial-write recovery, corrupted project state, stale async response, missing stems, device changes, keyboard/screen-reader operation, EN/KO expansion, updater rollback, and redacted support export. Applicable scenarios are proven at the owning boundary rather than all forced into one test layer. - -## 12. Release gate - -A release may be created only from one exact integrated protected head where all applicable CI/security/SAST/dependency/coverage/documentation/real-audio/build/package gates, Windows signing, macOS signing/notarization, checksums, SBOM/provenance, reproducibility, independent review, project migration/recovery, accessibility/supportability, updater rollback and operability evidence are terminal-success on that same identity. - -Unsigned validation artifacts are not releases. Queued evidence, stale Figma versions and mock-only audio journeys cannot establish release readiness. - -## 13. Traceability - -Primary normative/research anchors for this baseline include: - -- World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines (WCAG) 2.2*. https://www.w3.org/TR/WCAG22/ -- National Institute of Standards and Technology. (2022). *Secure Software Development Framework (SSDF) Version 1.1 (NIST SP 800-218)*. https://csrc.nist.gov/pubs/sp/800/218/final -- Music Information Retrieval Evaluation eXchange. (n.d.). *MIREX*. https://www.music-ir.org/mirex/ -- Raffel, C., McFee, B., Humphrey, E. J., Salamon, J., Nieto, O., Liang, D., Ellis, D. P. W., & Raffel, C. C. (2014). mir_eval: A transparent implementation of common MIR metrics. *Proceedings of the 15th International Society for Music Information Retrieval Conference*, 367–372. - -Repository ADRs, PRD/TRD, architecture/context-map documents, security/threat-model material, test strategy, operability/recovery guidance, UI/Storybook inventory and doctoring traceability must remain code-current. Active PRs, planned work and research results are never promoted into the shipped section before protected integration. \ No newline at end of file From ec67371791c653eed21705600775c06ecd531cc7 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 14:20:33 +0900 Subject: [PATCH 36/80] docs(gap): restore baseline tail and refresh live naming evidence --- docs/product-technical-gap-baseline.md | 124 ++++++++++++++++++++++--- 1 file changed, 110 insertions(+), 14 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 80ab61dca..30f226632 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -44,11 +44,11 @@ The near-term product order remains: merge-train convergence; trusted distributi ## 2. Live delivery authority -A fresh accessible-repository sweep queried all **74** repositories currently visible under `ContextualWisdomLab` individually. The sequential per-repository counts summed to **2,827 open pull requests**, and an organization-wide aggregate immediately after the sweep returned **2,834 open pull requests** with `incomplete_results=false`. The seven-request delta is retained as live movement during a non-simultaneous census rather than normalized away or treated as evidence of an omitted repository. +A fresh accessible-repository sweep queried all **74** repositories currently visible under `ContextualWisdomLab` individually. The sequential per-repository counts summed to **2,856 open pull requests**. An organization-wide aggregate captured immediately around that sweep returned **2,855 open pull requests** with `incomplete_results=false`. The one-request delta is retained as non-simultaneous live queue movement rather than normalized away or treated as an omitted repository. -At that sequential organization census, `ContextualWisdomLab/bandscope` had **185 open pull requests** and **19 open issues**. A later independent BandScope-only recheck in this same delivery run returned **194 open pull requests / 19 open issues** with `incomplete_results=false` while protected `develop` remained `749511c3ad4000090048718f685c6bee6b3d2c25`. The 185 count is therefore retained only as the dated observation within the non-simultaneous organization sweep; **194 / 19 is the current BandScope queue capture for this run**. Freshly counted high-backlog peers at the earlier organization sweep were `ContextualWisdomLab/naruon` (142), `ContextualWisdomLab/OriginWeave` (141), `ContextualWisdomLab/newsdom-api` (137), `ContextualWisdomLab/pg-erd-cloud` (135), and `ContextualWisdomLab/TEPP` (131). BandScope remains the selected delivery boundary not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. +At this census `ContextualWisdomLab/bandscope` had **194 open pull requests** and remains the selected delivery boundary. Fresh high-backlog peers were `ContextualWisdomLab/naruon` (143), `ContextualWisdomLab/OriginWeave` (141), `ContextualWisdomLab/newsdom-api` (137), `ContextualWisdomLab/pg-erd-cloud` (135), and `ContextualWisdomLab/TEPP` (131). BandScope is selected not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. -Because PR creation and closure can occur during a sequential organization census, the organization-wide search is an aggregate capture while the per-repository sweep establishes which repositories were enumerated at that time. Volatile deltas are recorded explicitly rather than normalized away or misrepresented as a simultaneous permanent truth. +Because PR creation and closure can occur during a sequential organization census, the organization-wide search is an aggregate capture while the per-repository sweep establishes which repositories were enumerated at that time. Volatile deltas are recorded explicitly rather than normalized away or misrepresented as simultaneous permanent truth. Protected `develop` currently requires these 16 contexts before normal integration: `ci / build-and-test`, `dependency-review`, `security-audit`, `sbom`, `release-preflight`, `gate / build / windows`, `gate / build / macos`, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, `Analyze (javascript-typescript)`, and `Analyze (python)`. @@ -64,7 +64,7 @@ Only behavior reachable from protected `develop@749511c3ad4000090048718f685c6bee - Typed Tauri IPC and bounded local process boundaries are the intended local execution model; ordinary rehearsal analysis does not require a public cloud service. - Protected dependency-security repair #783 is already in `develop` ancestry. Open branches must not reframe its historical dependency findings as an unmerged product blocker or suppress them locally. - The product already renders rehearsal-oriented section/role evidence, but protected truth does **not** yet satisfy the complete active-player, crash-recovery, real-audio acceptance, diagnostics, activation, accessibility-parity, or trusted-distribution contracts below. -- The latest GitHub Release revalidated in this run is immutable `v0.1.3`, published 2026-04-28. It is historical release evidence, not proof that the current protected head satisfies the commercial release gate. +- The latest immutable GitHub Release revalidated in recent delivery evidence is `v0.1.3`, published 2026-04-28. It is historical release evidence, not proof that the current protected head satisfies the commercial release gate. ## 4. Canonical active workstreams @@ -73,17 +73,18 @@ Active work is not shipped truth until it is normally integrated into protected | Boundary | Canonical live owner / evidence | Current status | |---|---|---| | Merge-train control plane | Issue #966 with executable queue lane PR #968 | #968 remains Draft; its unique queue machinery must survive every restack and its exact current head is non-passing until hosted/current-head evidence exists | -| Canonical baseline | PR #1116, this file | Open; every source edit creates a new exact head and invalidates predecessor evidence | -| Naming-contract repair | PR #1130 | Workspace-owned `RehearsalRoleOption` now uses `roleId`/`roleName` with primary `roleOptions`; previous `roles: { id, name }[]` exists only as a deprecated compatibility input translated immediately at the component boundary; no persisted/shared wire contract changed; exact current head at this capture is `724dd0445039b6e99863b46535a8497c784699ab` | -| Repository-local Trivy PR-head contract | PR #1119 | Quoted/commented YAML activity-list normalization is repaired on exact head `eadcc9d075128846ce0bbaa40a03d09afcb5b428`; current-head workflows are queued before execution and therefore remain non-passing | -| Trusted distribution | Issue #960; active release-identity lane PR #1126 | #1126 applies semantic multiword naming across its new release-identity production and test surfaces; Windows signing, macOS signing/notarization, checksums, SBOM/provenance, signature-verified updater, staged rollout, rollback/repair, and complete version-identity parity remain incomplete as one integrated protected-head receipt | +| Canonical baseline | PR #1116, this file | Open; a prior census-only edit accidentally truncated sections 7.5–13, and this exact branch now restores that lost source while refreshing current evidence | +| Workspace role naming | PR #1130 | `RehearsalRoleOption` uses `roleId`/`roleName` with primary `roleOptions`; the previous `roles: { id, name }[]` projection exists only as a deprecated component compatibility input translated immediately at the boundary | +| Score attachment naming | PR #1092 | Persisted project-format `scoreAttachments` retains compatibility keys `id`/`fileName`, while `trustedScoreAttachment` translates them immediately to workspace-owned `scoreId`/`scoreFileName`; current exact head at this capture is `8099e3b2525723474aca09db4d669167035263b3`; no database or persisted-wire migration is introduced | +| Repository-local Trivy PR-head contract | PR #1119 | Quoted/commented YAML activity-list normalization is repaired on its canonical branch; current-head workflows remain non-passing until fresh terminal evidence exists | +| Trusted distribution | Issue #960; active release-identity lane PR #1126 | Semantic release-identity naming is active work; Windows signing, macOS signing/notarization, checksums, SBOM/provenance, signature-verified updater, staged rollout, rollback/repair, and complete version-identity parity remain incomplete as one integrated protected-head receipt | | Active rehearsal player | Issue #961; implementation lane #971 | Real authorized local audio playback/seek/stop/loop/rate/cue transport is active work; count-in and any source-backed stem control must converge into one transport state machine | | Crash-safe project | Issue #962; implementation lane #970 | Atomic publication, versioned format, recovery, migration, autosave, rollback/export and persisted transport state remain active work, not protected truth | | Real-audio science | Issue #770 and active benchmark lanes | Rights-safe decoded-audio MIR acceptance, recognized metrics, uncertainty and reproducible evidence remain incomplete | -| Resource admission/decode | Issue #781 plus commercial dependency defect #1129 | No synthetic/mock success may substitute for production-path resource/cancellation evidence; the commercially supported decode path must also remove the libsndfile-backed LGPL runtime boundary with equivalent real-audio behavior and cross-platform/SBOM proof | +| Resource admission/decode | Issue #781 plus commercial dependency defect #1129 | No synthetic/mock success may substitute for production-path resource/cancellation evidence; the commercially supported decode path must remove the libsndfile-backed LGPL runtime boundary with equivalent real-audio behavior and cross-platform/SBOM proof | | Diagnostics/supportability | Issue #963 | Typed redacted crash/hang evidence and user-previewable offline support bundle remain incomplete | -| Activation | Issue #964; licensed-demo work exists in active PRs | A measured production-path first rehearsal remains incomplete | -| Accessibility/design parity | Issue #965; design/Storybook work remains active | WCAG 2.2 AA, keyboard/screen-reader parity, EN/KO expansion, exact-value alternatives and current-head UI evidence remain incomplete | +| Activation | Issue #964 | A measured production-path first rehearsal remains incomplete | +| Accessibility/design parity | Issue #965 | WCAG 2.2 AA, keyboard/screen-reader parity, EN/KO expansion, exact-value alternatives and current-head UI evidence remain incomplete | | Quality floor | PR #1057 and successors | Repository-owned production statement/branch coverage and public API documentation target remain 100%; lower configured thresholds are a gap | The product boundary, tests, contracts, and unique behavior decide succession—not PR number or title. Duplicate closure requires a technical succession receipt naming the unique behavior/tests preserved in the successor. Checks, approvals, and model output never transfer to a changed successor head. @@ -94,7 +95,7 @@ Backlog convergence is the primary engineering risk because micro-PR fan-out cre PR #968 owns the unique executable queue machinery needed by #966: bounded GitHub pagination, exact active-head capture, independent base-tip resolution, deterministic ordering, malformed/incomplete/duplicate rejection, reviewed dependency/succession metadata, network-independent validation, deterministic human projection, and symlink-safe atomic publication. It must not be discarded as stale documentation. -Independent live branch resolution in this run places #968 exactly at `docs/bandscope-product-readiness-baseline@bfdc3888de2736753ed93fcf0018459882bfa0e2` and its canonical #1116 target exactly at `docs/gap-baseline-2026-08-31@adbd9df394957ee1a2c68893b8a6025cdcf058c9`. Those identities agree with #968's current stack description; predecessor checks/reviews still do not transfer, and #968 remains Draft while its exact-head hosted evidence and reviewed disposition inventory are incomplete. PR-body prose or indexed search metadata that names a different head is stale and is not used as branch authority. +The latest independently resolved evidence before this baseline repair placed #968 at `docs/bandscope-product-readiness-baseline@bfdc3888de2736753ed93fcf0018459882bfa0e2` and its then-current #1116 target at `docs/gap-baseline-2026-08-31@adbd9df394957ee1a2c68893b8a6025cdcf058c9`. #1116 has advanced again in ordinary history, so that predecessor target identity and all checks/reviews attached to it do not transfer. #968 must be re-resolved/restacked normally against the new canonical baseline head before integration. PR #1007 is the canonical first-part-handoff lane only to the extent that its live semantic diff still preserves mounted selected-role wiring and the scientific prohibition against manufacturing handoffs from heuristic fallback. Any succession decision is rechecked against the independently resolved live head rather than a remembered PR-body SHA. @@ -134,7 +135,7 @@ Generic `utils`, `helpers`, `common`, `services`, `shared`, `core`, or `models` Candidate domain events include `AudioSourceAdmitted`, `AnalysisCompleted`, `CueConfirmed`, `SectionBoundaryCorrected`, `LoopActivated`, `ProjectSnapshotPublished`, `ProjectRecovered`, `SupportBundlePrepared`, `UpdateStaged`, and `UpdateRollbackCompleted`. -### 6.2 Context map (UML/C4-level logical view) +### 6.2 Context map ```mermaid flowchart LR @@ -172,7 +173,7 @@ flowchart LR The diagram is logical responsibility, not a claim that each box is a separate process. Shared contracts stay small and versioned; external codec/model/platform types remain behind anti-corruption layers. -`context-graph-contracts` remains the contract-only shared kernel for canonical refs, authority/truth status, bitemporal/provenance Context Assertions, CloudEvents, schemas and conformance. `enterprise-architecture-core` remains the EA Decision Plane. While their dedicated writer is active they are read-only dependencies here; BandScope projects deployable/runtime/version/risk facts through released contracts and does not copy rehearsal audio/analysis/user truth into EA authoritative storage. +`context-graph-contracts` remains the contract-only shared kernel for canonical refs, authority/truth status, bitemporal/provenance Context Assertions, CloudEvents, schemas and conformance. `enterprise-architecture-core` remains the EA Decision Plane. BandScope projects deployable/runtime/version/risk facts through released contracts and does not copy rehearsal audio/analysis/user truth into EA authoritative storage. ## 7. Technical design contract (TRD) @@ -237,3 +238,98 @@ The production player owns one transport state machine. UI components, cue cards ### 7.4 Persistence and contract versioning Project persistence uses explicit `project_format_version`, deterministic/idempotent migrations, atomic replacement only after a complete durable candidate exists, and a last-known-good backup/recovery path. Fault injection must prove that partial/truncated writes, disk-full conditions, interrupted migration, and failed replacement do not destroy the previous valid project. Portable export is versioned independently from in-memory implementation types. + +Tauri IPC, shared types, project files, handoff schemas, updater manifests, and externally released event/contracts are versioned boundaries. A rename or ownership cleanup is never permission for an in-place breaking wire-format change. + +### 7.5 Identifier-policy migration boundary + +The organization naming policy applies prospectively to new or materially changed **organization-owned internal identifiers**. Casing follows the host language/framework. Semantic multiword names such as `section_id`, `sectionId`, `SectionId`, `firstGrooveChange`, and `SectionRoadmap` are valid. Generic single-word organization-owned names such as bare `id`, `name`, `status`, `data`, `value`, `type`, `key`, `item`, `record`, `result`, `config`, `event`, `user`, or `role` are defects when a bounded-context name is available. + +When an existing bare field is already part of a persisted or cross-boundary contract, a semantic rename follows the owning contract's compatibility mechanism: + +- project files: introduce a renamed persisted field only behind an explicit `project_format_version` migration; readers accept supported prior representations, migration is deterministic/idempotent, and writers emit one canonical current representation after migration; +- Tauri IPC/shared API: use an additive/versioned request or response contract or a bounded compatibility alias; do not remove the previous key until supported callers have migrated and contract tests prove interoperability; +- database-owned schemas: use explicit schema migration with backward-compatible read/write sequencing, foreign-key/index/constraint/ORM/query updates, rollback evidence, normalized ownership, UPSERT-path validation, and locking/hot-partition review rather than an uncoordinated column rename; +- released handoff/events/context contracts: retain mandated released spelling until the owning contract publishes a compatible version; anti-corruption layers translate at the boundary; +- external/vendor fields: preserve external spelling exactly and map into semantically owned internal names after admission. + +Every compatibility-changing rename requires fixtures from the previous supported version, round-trip/no-data-loss tests, deterministic repeated migration, rollback/recovery evidence where persistence is involved, and removal criteria for any temporary alias. There is never dual writable truth after migration. + +Current examples demonstrate the intended direction without breaking compatibility. PR #1130 makes `roleId`, `roleName`, and `roleOptions` the switcher-owned vocabulary while accepting the old component projection only at one deprecated adapter input. PR #1092 keeps the established persisted score attachment keys `id` and `fileName` unchanged but makes `trustedScoreAttachment` an explicit anti-corruption boundary that validates those keys and returns `scoreId` and `scoreFileName` for workspace logic. Its focused RED contract was commit `35dc521f03711d749771751ecf39b904f193057d`; the production semantic translation was commit `8cd6756ef242d99fc323181b21b58f96fe24c731`; subsequent documentation commits aligned `ARCHITECTURE.md`, `AGENTS.md`, `CHANGELOG.md`, and `CLAUDE.md` with the same live-workspace/fallback invariant. No database object or persisted project wire key changed in that repair. + +### 7.6 Rust compute ownership + +Protected code is still mixed: selected numerical kernels are Rust/PyO3 while material analysis orchestration and some arithmetic remain Python/NumPy. The target architecture is Rust-first for repository-owned DSP, mathematical, vector, linear/matrix, data-science/ranking, and token-size core arithmetic. + +Python is bounded orchestration/compatibility/fixture/reporting during migration. CPU reference behavior should be deterministic `f64` where scientifically appropriate, with bounded multithreading and unnecessary context switching removed. CUDA/OpenCL/MLX paths require real backend execution, parity and resource evidence where configured. A hidden Python numerical fallback is not the target architecture. + +Migration order follows buyer impact and dependency leverage: temporal/beat and harmony; range/pitch/role features; prioritization/weighting; source-separation integration; then remaining repository-owned vector/matrix utilities. Rust↔Python parity is migration evidence, not justification for permanent duplicated production arithmetic. + +## 8. Persistence ERD and database discipline + +BandScope's current durable project authority is file/project-format based rather than an organization-owned relational production schema. No database DDL changed in the #1092 naming repair. If relational persistence is introduced, database objects must use specific multiword snake_case names, be normalized to at least 3NF where relevant, and preserve one authoritative write path. + +```mermaid +erDiagram + REHEARSAL_PROJECT ||--o{ SONG_SECTION : contains + SONG_SECTION ||--o{ REHEARSAL_ROLE : guides + REHEARSAL_PROJECT ||--o{ SCORE_ATTACHMENT : references + REHEARSAL_PROJECT ||--o{ ANALYSIS_EVIDENCE : records + ANALYSIS_EVIDENCE ||--o{ MANUAL_OVERRIDE : corrected_by + REHEARSAL_PROJECT ||--|| REHEARSAL_TRANSPORT : persists +``` + +Any future SQL migration must verify foreign keys, indexes, constraints, sequences, ORM/query mappings, UPSERT semantics, hot-partition risk, lock duration, read/write separation, backward compatibility, rollback and recovery before it is considered complete. + +## 9. Real-audio scientific acceptance + +Synthetic arrays, mocked UI journeys, direct feature matrices, source-text assertions, or generated audio may support unit tests but cannot prove product accuracy. + +Commercial acceptance requires rights-safe real audio to pass the production intake → decode → analysis → UI path with exact fixture, annotation, integrity and license provenance. Metrics remain task-specific: chord/harmony evaluation uses a recognized chord metric such as benchmark-defined weighted chord recall; beat/timing uses recognized event metrics; separation uses SI-SDR plus task-appropriate robustness/perceptual evidence; range/pitch/transcription uses declared note/frame/event metrics; section/cue boundaries use tolerances derived from annotation uncertainty and rehearsal cost rather than an invented constant. + +Acceptance criteria are preregistered before tuning and report uncertainty across tracks. Candidate-vs-baseline comparisons disclose sample count, aggregation, confidence interval or other justified uncertainty method, exclusions, and missing-data handling. Configured GPU lanes must actually execute and report parity/peak-resource evidence; unsupported hardware is not converted into a passing claim. + +## 10. Security and privacy baseline + +Local files, URLs, MIME/codec claims, decoder outputs, model artifacts, project files, updater manifests, subprocess output and support exports are untrusted. + +Owning contexts must fail closed on path/symlink/reparse traversal, oversized/decompression/resource exhaustion, unsafe subprocess authority, credential/secret propagation and prompt-injection crossings. Valid source-backed GHAS/CodeQL/Semgrep/Strix/AppGuardrail findings are deduplicated by root cause and repaired in the canonical product lane. Scanner/control-plane defects remain with their owning repository; BandScope does not blanket-mask findings or weaken gates. + +Ordinary logs/support bundles must not contain raw audio/project payloads, credentials or absolute local paths. Authorization is purpose-bound and least-privilege with field minimization, retention and access/export audit where relevant. + +The latest protected central control-plane evidence recorded by this baseline is `ContextualWisdomLab/.github@669505bdf267d92989298857c740a59807bbd735`. Issue `.github#712` remains the organization-wide Actions queue-health/runner-admission causal owner. Earlier protected `.github#1658`, `.github#1656`, `.github#1665`, and `.github#1645` reduce avoidable load/review-routing ambiguity but do not convert a queued current-head check into success. Repository-local BandScope #1119 remains the Trivy PR-head contract owner until normally integrated or superseded. + +Fresh #1092 exact-head verification exists on `8099e3b2525723474aca09db4d669167035263b3`: 27 check runs were observed, with required/security lanes such as `dependency-review`, `scorecard`, and `trivy-fs` still queued at capture. A skipped manual-evidence helper is not a substitute for required evidence. No predecessor-head success is transferred. + +## 11. UI/UX evidence gate + +The canonical Figma identity must be rediscovered from current protected BandScope docs/source before a material UI merge; the latest baseline reference is `zthWmqfNKUgJBECvv002Qk`, treated as a resolved design authority rather than a permanent remembered constant. + +Storybook is the executable component/state inventory, Figma is the reviewed interaction/visual specification, and the shipped Tauri application is the final acceptance target. Material UI work must verify real pointer/touch/keyboard interaction, section/time-axis identity, playback cursor, persistence/reload, stale-response races, loading/partial/error/unsupported-codec/missing-stem states, responsive window sizes, visible focus, reduced motion, non-color-only status, screen-reader names/states, EN/KO expansion and exact-value/list/table alternatives for graph/timeline/waveform content. + +For the #1092 ready-workspace slice, product guidance now states the actual accessibility/authority condition consistently: the map names a score to open only when attachment metadata is validated and a live Score workspace is available; reopened metadata-only projects or untrusted score metadata fall back to adding a score or checking the range by ear. A screenshot from a predecessor head, a Storybook-only state, or a Figma-only mock is not shipped UI evidence. + +## 12. Quality and operability floor + +Repository-owned production statement coverage, branch/edge-case coverage, and public/repository-owned API documentation target **100%**. A lower configured JavaScript/Python threshold is a gap rather than equivalent evidence; denominator reduction, skip/xfail, generated-code relabeling, or source-text assertions cannot manufacture compliance. + +Production-path tests include supported sample rates/channels, short/long recordings, pickup before bar one, odd meter and tempo changes where supported, silence near boundaries, unsupported codecs, moved/replaced files, cancellation, memory/CPU bounds, disk-full/partial-write recovery, corrupted project state, stale async response, missing stems, device changes, keyboard/screen-reader operation, EN/KO expansion, updater rollback, and redacted support export. Applicable scenarios are proven at the owning boundary rather than all forced into one test layer. + +For behavior- or contract-affecting renames, focused regressions must fail on old/new mismatches before production repair whenever practical, then prove serialization/deserialization, adapter compatibility, persistence behavior, migrations and rollback where applicable. Valid tests are never weakened, skipped, xfailed, suppressed, or quote-obfuscated to obtain green. + +## 13. Release gate + +A release may be created only from one exact integrated protected head where all applicable CI/security/SAST/dependency/coverage/documentation/real-audio/build/package gates, Windows signing, macOS signing/notarization, checksums, SBOM/provenance, reproducibility, independent review, project migration/recovery, accessibility/supportability, updater rollback and operability evidence are terminal-success on that same identity. + +Unsigned validation artifacts are not releases. Queued evidence, stale Figma versions and mock-only audio journeys cannot establish release readiness. Merge requires all live required checks terminal-success, zero valid unresolved review findings/threads, a qualifying independent non-author approval current for the last push, and ordinary branch protection without bypass. + +## 14. Traceability + +Primary normative/research anchors for this baseline include: + +- World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines (WCAG) 2.2*. https://www.w3.org/TR/WCAG22/ +- National Institute of Standards and Technology. (2022). *Secure Software Development Framework (SSDF) Version 1.1 (NIST SP 800-218)*. https://csrc.nist.gov/pubs/sp/800/218/final +- Music Information Retrieval Evaluation eXchange. (n.d.). *MIREX*. https://www.music-ir.org/mirex/ +- Raffel, C., McFee, B., Humphrey, E. J., Salamon, J., Nieto, O., Liang, D., Ellis, D. P. W., & Raffel, C. C. (2014). mir_eval: A transparent implementation of common MIR metrics. *Proceedings of the 15th International Society for Music Information Retrieval Conference*, 367–372. + +Repository ADRs, PRD/TRD, architecture/context-map documents, security/threat-model material, test strategy, operability/recovery guidance, UI/Storybook inventory and doctoring traceability must remain code-current. Active PRs, planned work and research results are never promoted into the shipped section before protected integration. From 58bdfb5e1819abe621a2e2ccd0d730926398b6ff Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 14:22:56 +0900 Subject: [PATCH 37/80] docs(doctoring): record baseline recovery and naming evidence --- .../product-gap-baseline-2026-09-01.md | 77 +++++++++++-------- 1 file changed, 46 insertions(+), 31 deletions(-) diff --git a/docs/doctoring/product-gap-baseline-2026-09-01.md b/docs/doctoring/product-gap-baseline-2026-09-01.md index f1d5b0dc4..4f78ba6a5 100644 --- a/docs/doctoring/product-gap-baseline-2026-09-01.md +++ b/docs/doctoring/product-gap-baseline-2026-09-01.md @@ -2,61 +2,76 @@ ## Purpose -This note records why `docs/product-technical-gap-baseline.md` was replaced on PR #1116 instead of layering another stale queue snapshot over it, and preserves later live-state corrections without rewriting historical observations as if they were current. +This note records why `docs/product-technical-gap-baseline.md` is maintained on canonical PR #1116 instead of layering stale queue snapshots over product truth. It preserves exact-head corrections, causal repairs, naming-contract evidence, and research traceability without rewriting historical observations as current facts. ## Current live-state correction — 2026-09-02 -Protected source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,827 open pull requests**. The organization-wide aggregate immediately after that sequential sweep returned **2,834 open pull requests** (`incomplete_results=false`). The seven-request delta is recorded as live queue movement during a non-simultaneous census, not normalized away or treated as evidence of an omitted repository. `ContextualWisdomLab/bandscope` remained the highest-backlog repository at **185 open pull requests** and **19 open issues**. Freshly counted peers were `ContextualWisdomLab/naruon` 142, `ContextualWisdomLab/OriginWeave` 141, `ContextualWisdomLab/newsdom-api` 137, `ContextualWisdomLab/pg-erd-cloud` 135, and `ContextualWisdomLab/TEPP` 131. BandScope remains selected by both backlog and product responsibility: it owns the buyer-facing local-first rehearsal/audio path and several high-leverage release/security/workflow boundaries. +Protected BandScope source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,856 open pull requests**. An organization-wide aggregate captured around the same sweep returned **2,855 open pull requests** with `incomplete_results=false`. The one-request difference is retained as non-simultaneous live queue movement rather than normalized away or treated as evidence of an omitted repository. -`ContextualWisdomLab/bandscope#1119` remains open on canonical branch `fix/trivy-pr-code-scanning`. On exact head `eadcc9d075128846ce0bbaa40a03d09afcb5b428`, the repository-local Trivy PR-head contract now normalizes quoted/commented YAML block-list scalars so valid protected-branch and `opened`/`synchronize`/`reopened` activity lists are accepted without weakening the forbidden `pull_request_target` and SARIF producer/uploader checks. Its previously actionable review thread is resolved. Fresh exact-head workflows are queued before execution, so no predecessor evidence is promoted to passing status. +`ContextualWisdomLab/bandscope` was the highest observed backlog at **194 open pull requests**. Fresh high-backlog peers were `ContextualWisdomLab/naruon` 143, `ContextualWisdomLab/OriginWeave` 141, `ContextualWisdomLab/newsdom-api` 137, `ContextualWisdomLab/pg-erd-cloud` 135, and `ContextualWisdomLab/TEPP` 131. BandScope remains selected by both backlog and product responsibility: it owns the buyer-facing local-first rehearsal/audio path plus high-leverage release, security, persistence, workflow, and shared-contract boundaries. -The central Actions causal boundary has advanced again. Protected central truth at this capture is `ContextualWisdomLab/.github@bb14b014eee31e6abdb5d2fffbb805aa29420eac`. Issue `.github#712` remains the organization-wide runner-admission/queue-health owner. The current executable evidence lane is `.github#1150` exact head `2f57e716516dc39ffcbed45a8a658631f0172f9b`, which now binds run classification to a stable before/after pull-request number/state/head view, preserves positive `workflow_id` as stable lane identity, exports reproducible queue-age provenance, removes an unused pull-request permission, and replaces the earlier identical 817-line collector copies with one shared core plus an executable consistency boundary. All current actionable #1150 review threads are resolved. +Volatile queue counts are dated evidence, not product truth. Every branch advance invalidates predecessor checks and approvals, and every later census must preserve non-simultaneous movement rather than manufacture a false simultaneous total. -Fresh #1150 exact-head Python Security, SBOM, Scorecard, Security Scan, OSV, CodeQL, Semgrep and Secret Scan runs are queued. A sampled SBOM job remains queued with no executed steps, matching the broader pre-checkout admission symptom. This source repair therefore improves the evidence collector but does not convert queued evidence into success or close the remaining capacity/billing/policy/fairness/provider admission boundary. +## Canonical baseline recovery -Earlier central source repairs `.github#1658`, `.github#1656`, `.github#1665`, and `.github#1645` are protected history. They reduce avoidable queue/review pressure and review-routing ambiguity, but do not by themselves close #712 while exact current required jobs can still remain unassigned before execution. +A source-integrity defect was verified on predecessor #1116 head `f6207ef2cadadb5d3852e0595ab2f0b62e20a06b`. That census-only commit unintentionally removed 83 lines from `docs/product-technical-gap-baseline.md` and left the canonical product/technical contract ending immediately after §7.4. The deleted material included the identifier-policy migration boundary, Rust compute ownership, real-audio scientific acceptance, security/privacy, UI/UX evidence, quality/operability, release-gate, and traceability sections. -The connected repository write surface permits ordinary source/workflow/PR changes but does not expose organization runner-pool, Actions quota/billing, or equivalent settings mutation. Until the remaining admission condition changes or #712 produces another source-owned causal repair, repeated unchanged-head reruns or label churn would generate noise rather than evidence. Queued jobs remain non-passing; fresh exact-head workflows should remain queued while independent source work proceeds. +The parent `adbd9df394957ee1a2c68893b8a6025cdcf058c9` was inspected as recovery evidence before editing. The current canonical branch then advanced through ordinary non-force history to `ec67371791c653eed21705600775c06ecd531cc7`, restoring the lost contract while incorporating the fresh 74-repository census and current naming evidence. This was a direct source repair, not an issue/comment/delegation-only response. -The canonical baseline source remains the durable PRD/TRD/DDD contract; volatile queue numbers are evidence, not product truth. Every branch advance invalidates predecessor checks and approvals. +The restored baseline now again carries the buyer PRD, end-to-end stories, DDD bounded contexts/context map/ubiquitous language/domain events, TRD topology and transport diagrams, persistence/versioning rules, organization naming and database migration rules, Rust-first compute ownership, persistence ERD discipline, rights-safe real-audio scientific acceptance, security/privacy, Storybook/Figma/shipped accessibility evidence, the 100% quality floor, release acceptance, and APA traceability. -## Repository evidence +## Organization naming-contract evidence -Protected source at capture: `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. +The organization-owned naming rule is semantic, not casing-based. Multiword names such as `section_id`, `sectionId`, `SectionId`, `firstGrooveChange`, and `SectionRoadmap` are valid. Generic single-word organization-owned names are repaired where bounded-context meaning is available. Persisted, released, IPC, vendor, or protocol spellings do not change in place merely to satisfy style; they cross explicit migration/version/anti-corruption boundaries. -Current direct naming repair evidence: `ContextualWisdomLab/bandscope#1130` was created from that exact protected head after the repository-wide naming sweep found the exported workspace-owned `RehearsalRoleOption` projection using bare `id` and `name`, with public component prop `roles`. The branch first advanced focused tests to `roleId`, `roleName`, and `roleOptions`, then changed the authoritative switcher-owned vocabulary to those semantic names. The previous `{ id, name }[]` component shape is retained only inside the explicitly deprecated `LegacyRehearsalRoleOption` compatibility input and is immediately translated by `normalizeLegacyRoleOptions`; switcher-owned logic uses the semantic projection thereafter. Current exact head is `724dd0445039b6e99863b46535a8497c784699ab`; it also addresses the current-head CodeRabbit public-API documentation finding by documenting `RehearsalRoleOption` and both semantic fields. No persisted project, IPC, database, vendor, or shared-types wire contract changed in this slice. +### Workspace role vocabulary — #1130 -Fresh repository-local workflows on `#1130@724dd0445039b6e99863b46535a8497c784699ab` are currently queued, so no predecessor or earlier same-head completion is promoted to current merge evidence. The PR therefore remains non-merge-ready until every live required check is terminal-success and qualifying independent review evidence applies to the unchanged head. +`ContextualWisdomLab/bandscope#1130` owns the exported workspace role projection. Its semantic vocabulary is `RehearsalRoleOption.roleId`, `roleName`, and primary `roleOptions`. The previous component projection `{ id, name }[]` remains only inside the explicitly deprecated `LegacyRehearsalRoleOption` adapter input and is translated immediately by `normalizeLegacyRoleOptions`. No persisted project, IPC, database, vendor, or shared-types wire contract changed in that slice. The latest exact head recorded for that workstream is `724dd0445039b6e99863b46535a8497c784699ab`; predecessor verification never transfers after a later push. -`ContextualWisdomLab/bandscope#1126` remains a separate release-identity naming repair lane. Its release-identity production helper/test surface uses bounded-context names such as `repository_root`, `release_version`, `workflow_text`, `job_marker`, `workflow_lines`, `job_start_index`, `job_end_index`, `release_guard`, `expected_version`, `package_document`, and `publication_job`; Pytest's external `tmp_path` fixture and externally mandated package/Tauri JSON keys remain unchanged. The change is internal naming only and needs no persistence/API migration. +### Score attachment compatibility boundary — #1092 -Historical queue observations remain useful only as dated RCA. On 2026-09-01 10:31 KST BandScope had 190 open pull requests. At 2026-09-01 13:29 KST, 72 repositories were visible and an organization recount reported 2,697 open pull requests, with BandScope at 188. Those captures must not be reused as current queue authority. +`ContextualWisdomLab/bandscope#1092` exposed another material naming defect in a buyer-visible workspace path. The persisted project format already uses `scoreAttachments` entries with compatibility keys `id` and `fileName`; changing those keys in place would silently break stored projects. The safe repair therefore keeps the wire shape and moves semantic naming immediately behind an anti-corruption boundary. -Review findings on PR #1116 previously validated as real: +The focused RED commit `35dc521f03711d749771751ecf39b904f193057d` changed the regression to require `{ scoreId, scoreFileName }` while production still returned `{ id, fileName }`. The GREEN production commit `8cd6756ef242d99fc323181b21b58f96fe24c731` introduced `TrustedScoreAttachment`, validates only the compatibility wire keys at `trustedScoreAttachment`, returns semantic `scoreId`/`scoreFileName`, and renamed touched workspace-owned locals to bounded score/range vocabulary. No database table, column, index, constraint, sequence, migration, foreign key, ORM/query mapping, UPSERT path, lock topology, or persisted project wire key changed. -1. the open-PR evidence was stale; -2. the repository-wide Mermaid absence claim was false because protected `develop` already contains Mermaid in `docs/doctoring/high-security-pdf-http-baseline.md` and `docs/doctoring/npm-lockfile-generator-provenance.md`; -3. playback and crash-safe project work were mapped to stale issue numbers — canonical owners are #961 and #962 respectively, while #960 owns signed/notarized release/update/rollback; -4. live Noema/PR claims needed independent GitHub verification rather than prose inheritance. +A current CodeRabbit review also identified a truthful-documentation defect: `ARCHITECTURE.md`, `AGENTS.md`, `CHANGELOG.md`, and `CLAUDE.md` could be read as promising that any persisted score attachment is openable. Production actually requires both validated attachment metadata and a live Score workspace; reopened metadata-only projects or untrusted metadata fall back to adding a score or checking the range by ear. The same canonical branch was directly repaired in commits `5af64f5c3ddc85b237a4426678de0233ee4f5fdf`, `5a2abb1aa404eb0df133cbaeade44439621e56d6`, `893b87a53faaa08f3f972a4dc264c47ff9c83511`, and `8099e3b2525723474aca09db4d669167035263b3` so product guidance and production now express one invariant. -The replacement baseline therefore separates protected-source facts from timestamped GitHub observations and uses exact current-head examples instead of asserting one blocker for the entire queue. +At the latest #1092 capture, exact head `8099e3b2525723474aca09db4d669167035263b3` had **27** fresh check runs. Required/security lanes including `dependency-review`, `scorecard`, and `trivy-fs` were still queued, while a skipped manual-evidence helper was not treated as passing required evidence. No predecessor success was promoted. The connected GraphQL review-thread endpoint also hit a GitHub rate limit during this run; that transient platform read/mutation limitation does not convert an unresolved thread into resolved evidence and does not justify merge. -## Historical review-gate RCA example +### Release identity — #1126 -PR #956 had a predecessor exact-head Strix failure unrelated to its articulation privacy code. The failing central workflow exhausted the NVIDIA primary, encountered an EOL NVIDIA fallback, then used GPT-5.4 through `/v1/chat/completions` with function tools plus non-none reasoning effort; that combination was rejected by the provider contract. `ContextualWisdomLab/.github#1350` fixed the GPT-5.4 tool/reasoning contract in commit `f655a901f7ccdfef0d62694c818ad2896a2f5da1`. +`ContextualWisdomLab/bandscope#1126` remains a separate release-identity naming lane. Its repository-owned helper/test vocabulary uses names such as `repository_root`, `release_version`, `workflow_text`, `job_marker`, `workflow_lines`, `job_start_index`, `job_end_index`, `release_guard`, `expected_version`, `package_document`, and `publication_job`. External Pytest fixture names and package/Tauri JSON keys remain unchanged where their contracts own those spellings. This is an internal naming boundary and does not itself require a persistence migration. -At the historical RCA capture, `.github/main@1186a9f4e5eda7683b23ae63d2c806831743432a` was 245 commits ahead of that fix and had it as the merge base. To obtain fresh evidence without altering production content, PR #956 was advanced by a normal non-force commit to `e46a7aa3121c902ebcf9ea9d256a199659a482df` using the identical tree `6d777d7fec8b35de23f8d77f1b22e158828f0288`; repository workflows then re-queued. No stale check was promoted to current evidence. These identities are historical RCA evidence, not current merge authority. +## Database discipline -PR #1117 independently demonstrated at its capture that the queue was not accurately described by “all code checks fail”: exact head `b98f266d2356d56be624fb617580b5252e85baaa` had successful repository CI/release/security/SBOM workflows while `opencode-review` remained in progress. Pending is still non-passing, but its cause and state differ from the older blanket claim. This is historical example evidence and must be re-fetched before any action on #1117. +BandScope's current project authority is file/project-format based rather than an organization-owned relational production schema, so the #1092 repair required no DDL. The canonical baseline nevertheless records the database rule for future owned schemas: use semantic multiword snake_case for tables, columns, indexes, constraints, sequences, views, materialized views, functions, and related objects; normalize to 3NF where relevant; and verify migration ordering, foreign keys, indexes, constraints, ORM/query mappings, UPSERT semantics, hot-partition risk, locking/read-write separation, compatibility, rollback, and recovery before integration. + +## Queue and causal-owner evidence + +Issue #966 remains the dependency-aware merge-train control plane, while PR #968 retains unique executable queue machinery: bounded pagination, exact active-head capture, independently resolved target tips, deterministic ordering, malformed/incomplete/duplicate rejection, network-independent validation, and symlink-safe atomic publication. Because #1116 advanced again during this repair, every predecessor #968 target/check/review receipt is stale until #968 is normally re-resolved/restacked against the new canonical baseline head. + +The latest protected central control-plane evidence recorded by the baseline is `ContextualWisdomLab/.github@669505bdf267d92989298857c740a59807bbd735`. Issue `.github#712` remains the organization-wide runner-admission/queue-health owner. Earlier protected `.github#1658`, `.github#1656`, `.github#1665`, and `.github#1645` reduce avoidable queue/review pressure and review-routing ambiguity but do not turn a queued exact-head job into terminal success. Repository-local Trivy PR-head configuration remains owned by open BandScope #1119 until normally integrated or superseded. + +The connected repository write surface permits ordinary source/workflow/PR changes but does not expose organization runner-pool, Actions quota/billing, or equivalent admission-setting mutation. Unchanged-head reruns and runner-label churn are therefore not substitutes for causal evidence. Queued jobs remain non-passing while independent source work proceeds. + +## Historical observations and RCA + +Historical queue observations remain useful only as dated evidence. On 2026-09-01 10:31 KST BandScope had 190 open pull requests. At 2026-09-01 13:29 KST, 72 repositories were visible and an organization recount reported 2,697 open pull requests, with BandScope at 188. Later 2026-09-02 sweeps observed 2,827/2,834 and 185 BandScope before the current 2,856/2,855 and 194 BandScope capture. None may be reused as an undated permanent count. + +Review findings previously validated on #1116 included stale PR evidence, a false repository-wide Mermaid-absence claim, stale product-owner issue numbers, and prose-inherited live Noema/PR claims. The replacement baseline separates protected-source facts from timestamped GitHub observations and uses exact current-head examples instead of assigning one cause to the whole queue. + +A historical review-gate example remains instructive. PR #956 once had a predecessor exact-head Strix failure unrelated to its articulation privacy code. The central workflow exhausted the NVIDIA primary, encountered an EOL NVIDIA fallback, then used GPT-5.4 through `/v1/chat/completions` with function tools plus non-none reasoning effort; the provider rejected that contract. `ContextualWisdomLab/.github#1350` repaired the GPT-5.4 tool/reasoning contract in commit `f655a901f7ccdfef0d62694c818ad2896a2f5da1`. At that historical capture, `.github/main@1186a9f4e5eda7683b23ae63d2c806831743432a` contained that fix. PR #956 was then advanced through ordinary history to `e46a7aa3121c902ebcf9ea9d256a199659a482df` using the identical tree so fresh workflows could be created. This evidence remains historical and must be re-fetched before any current action. + +PR #1117 similarly demonstrated that the queue cannot be truthfully summarized as “all code checks fail”: at its historical capture, exact head `b98f266d2356d56be624fb617580b5252e85baaa` had successful repository CI/release/security/SBOM workflows while `opencode-review` remained in progress. Pending was still non-passing, but it had a different cause from older blanket claims. ## Research / standards review -The baseline was checked against current authoritative sources on 2026-09-01: +The baseline uses current authoritative standards/research as acceptance anchors rather than decorative citations: -- ISO/IEC 25010:2023 defines the current SQuaRE product-quality model and explicitly supports requirements, design objectives, testing objectives, acceptance criteria, and product-quality evaluation. -- NIST SP 800-218 SSDF v1.1 remains the current NIST SSDF baseline and emphasizes tracked security requirements/design decisions, provenance, and root-cause-oriented secure development. -- WCAG 2.2 remains a W3C Recommendation and adds criteria including focus visibility, dragging alternatives, target size, consistent help, redundant entry, and accessible authentication. -- MIREX 2025 Audio Beat Tracking evaluates predicted beat locations against listener-annotated real recordings, supporting the decision to require real-audio timing evidence rather than synthetic-only unit fixtures. +- ISO/IEC 25010:2023 defines the current SQuaRE product-quality model and supports requirements, design objectives, testing objectives, acceptance criteria, and product-quality evaluation. +- NIST SP 800-218 SSDF v1.1 emphasizes tracked security requirements/design decisions, provenance, and root-cause-oriented secure development. +- WCAG 2.2 is a W3C Recommendation covering focus visibility, dragging alternatives, target size, consistent help, redundant entry, accessible authentication, and the broader accessibility baseline required by the product. +- MIREX real-recording evaluation practice supports rights-safe production-path MIR evidence rather than synthetic-only accuracy claims. ### APA 7th references @@ -70,6 +85,6 @@ World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines (WCAG) ## Decision -PR #1116 is the canonical current baseline owner. PR #1025 is an older competing owner of the same path; its unique requirements (PRD/TRD/UML, Rust migration, real-audio accuracy, security, accessibility, release evidence, and reproducible verification) were deliberately carried into the #1116 replacement. Once this current head is present, #1025 can be closed as superseded without deleting its discussion history. +PR #1116 remains the canonical baseline owner. Its source now contains the complete recovered PRD/TRD/DDD/naming/Rust/science/security/UI/quality/release/traceability contract plus current delivery evidence. PR #1025 is an older competing owner of the same path; it may only be closed as superseded when every unique semantic requirement remains executable or represented in the canonical source and its discussion history is preserved. -Future loops should refresh live counts/evidence only when they materially change prioritization or causal ownership. They must not rewrite immutable product and architecture sections merely to chase a volatile PR number. \ No newline at end of file +Future loops should refresh live counts and exact-head evidence when they materially change prioritization or causal ownership. They must not rewrite stable product/architecture sections merely to chase a volatile PR number, and they must never repeat the predecessor truncation failure by replacing a complete canonical document with a partial census fragment. \ No newline at end of file From e8d7f148bc5f0aa5c77e286e06fd73e5c174073a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 14:38:26 +0900 Subject: [PATCH 38/80] docs(gap): refresh live fleet census evidence --- docs/doctoring/product-gap-baseline-2026-09-01.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/doctoring/product-gap-baseline-2026-09-01.md b/docs/doctoring/product-gap-baseline-2026-09-01.md index 4f78ba6a5..d85e80e6e 100644 --- a/docs/doctoring/product-gap-baseline-2026-09-01.md +++ b/docs/doctoring/product-gap-baseline-2026-09-01.md @@ -6,9 +6,9 @@ This note records why `docs/product-technical-gap-baseline.md` is maintained on ## Current live-state correction — 2026-09-02 -Protected BandScope source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,856 open pull requests**. An organization-wide aggregate captured around the same sweep returned **2,855 open pull requests** with `incomplete_results=false`. The one-request difference is retained as non-simultaneous live queue movement rather than normalized away or treated as evidence of an omitted repository. +Protected BandScope source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,865 open pull requests**. An organization-wide aggregate captured immediately after the sweep returned **2,866 open pull requests** with `incomplete_results=false`. The one-request difference is retained as non-simultaneous live queue movement rather than normalized away or treated as evidence of an omitted repository. -`ContextualWisdomLab/bandscope` was the highest observed backlog at **194 open pull requests**. Fresh high-backlog peers were `ContextualWisdomLab/naruon` 143, `ContextualWisdomLab/OriginWeave` 141, `ContextualWisdomLab/newsdom-api` 137, `ContextualWisdomLab/pg-erd-cloud` 135, and `ContextualWisdomLab/TEPP` 131. BandScope remains selected by both backlog and product responsibility: it owns the buyer-facing local-first rehearsal/audio path plus high-leverage release, security, persistence, workflow, and shared-contract boundaries. +`ContextualWisdomLab/bandscope` was the highest observed backlog at **196 open pull requests**. Fresh high-backlog peers were `ContextualWisdomLab/naruon` 143, `ContextualWisdomLab/OriginWeave` 141, `ContextualWisdomLab/newsdom-api` 137, `ContextualWisdomLab/pg-erd-cloud` 135, `ContextualWisdomLab/html4tree` 127, and `ContextualWisdomLab/TEPP` 127. BandScope remains selected by both backlog and product responsibility: it owns the buyer-facing local-first rehearsal/audio path plus high-leverage release, security, persistence, workflow, and shared-contract boundaries. Volatile queue counts are dated evidence, not product truth. Every branch advance invalidates predecessor checks and approvals, and every later census must preserve non-simultaneous movement rather than manufacture a false simultaneous total. @@ -56,7 +56,7 @@ The connected repository write surface permits ordinary source/workflow/PR chang ## Historical observations and RCA -Historical queue observations remain useful only as dated evidence. On 2026-09-01 10:31 KST BandScope had 190 open pull requests. At 2026-09-01 13:29 KST, 72 repositories were visible and an organization recount reported 2,697 open pull requests, with BandScope at 188. Later 2026-09-02 sweeps observed 2,827/2,834 and 185 BandScope before the current 2,856/2,855 and 194 BandScope capture. None may be reused as an undated permanent count. +Historical queue observations remain useful only as dated evidence. On 2026-09-01 10:31 KST BandScope had 190 open pull requests. At 2026-09-01 13:29 KST, 72 repositories were visible and an organization recount reported 2,697 open pull requests, with BandScope at 188. Later 2026-09-02 sweeps observed 2,827/2,834 and 185 BandScope, then 2,856/2,855 and 194 BandScope, before the current 2,865/2,866 and 196 BandScope capture. None may be reused as an undated permanent count. Review findings previously validated on #1116 included stale PR evidence, a false repository-wide Mermaid-absence claim, stale product-owner issue numbers, and prose-inherited live Noema/PR claims. The replacement baseline separates protected-source facts from timestamped GitHub observations and uses exact current-head examples instead of assigning one cause to the whole queue. From 39232f8bfecc2e0ea950cca597fd89354cee710a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 14:41:08 +0900 Subject: [PATCH 39/80] docs(gap): refresh live backlog authority --- docs/product-technical-gap-baseline.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 30f226632..cd4729d55 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -44,9 +44,9 @@ The near-term product order remains: merge-train convergence; trusted distributi ## 2. Live delivery authority -A fresh accessible-repository sweep queried all **74** repositories currently visible under `ContextualWisdomLab` individually. The sequential per-repository counts summed to **2,856 open pull requests**. An organization-wide aggregate captured immediately around that sweep returned **2,855 open pull requests** with `incomplete_results=false`. The one-request delta is retained as non-simultaneous live queue movement rather than normalized away or treated as an omitted repository. +A fresh accessible-repository sweep queried all **74** repositories currently visible under `ContextualWisdomLab` individually. The sequential per-repository counts summed to **2,865 open pull requests**. An organization-wide aggregate captured immediately after that sweep returned **2,866 open pull requests** with `incomplete_results=false`. The one-request delta is retained as non-simultaneous live queue movement rather than normalized away or treated as an omitted repository. -At this census `ContextualWisdomLab/bandscope` had **194 open pull requests** and remains the selected delivery boundary. Fresh high-backlog peers were `ContextualWisdomLab/naruon` (143), `ContextualWisdomLab/OriginWeave` (141), `ContextualWisdomLab/newsdom-api` (137), `ContextualWisdomLab/pg-erd-cloud` (135), and `ContextualWisdomLab/TEPP` (131). BandScope is selected not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. +At this census `ContextualWisdomLab/bandscope` had **196 open pull requests** and remains the selected delivery boundary. Fresh high-backlog peers were `ContextualWisdomLab/naruon` (143), `ContextualWisdomLab/OriginWeave` (141), `ContextualWisdomLab/newsdom-api` (137), `ContextualWisdomLab/pg-erd-cloud` (135), `ContextualWisdomLab/html4tree` (127), and `ContextualWisdomLab/TEPP` (127). BandScope is selected not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. Because PR creation and closure can occur during a sequential organization census, the organization-wide search is an aggregate capture while the per-repository sweep establishes which repositories were enumerated at that time. Volatile deltas are recorded explicitly rather than normalized away or misrepresented as simultaneous permanent truth. @@ -332,4 +332,4 @@ Primary normative/research anchors for this baseline include: - Music Information Retrieval Evaluation eXchange. (n.d.). *MIREX*. https://www.music-ir.org/mirex/ - Raffel, C., McFee, B., Humphrey, E. J., Salamon, J., Nieto, O., Liang, D., Ellis, D. P. W., & Raffel, C. C. (2014). mir_eval: A transparent implementation of common MIR metrics. *Proceedings of the 15th International Society for Music Information Retrieval Conference*, 367–372. -Repository ADRs, PRD/TRD, architecture/context-map documents, security/threat-model material, test strategy, operability/recovery guidance, UI/Storybook inventory and doctoring traceability must remain code-current. Active PRs, planned work and research results are never promoted into the shipped section before protected integration. +Repository ADRs, PRD/TRD, architecture/context-map documents, security/threat-model material, test strategy, operability/recovery guidance, UI/Storybook inventory and doctoring traceability must remain code-current. Active PRs, planned work and research results are never promoted into the shipped section before protected integration. \ No newline at end of file From 99b490db2ab7e083497d53c566fc9eec99246d00 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 15:44:33 +0900 Subject: [PATCH 40/80] docs(doctoring): refresh live census and contract truth --- .../product-gap-baseline-2026-09-01.md | 32 +++++++++++++------ 1 file changed, 22 insertions(+), 10 deletions(-) diff --git a/docs/doctoring/product-gap-baseline-2026-09-01.md b/docs/doctoring/product-gap-baseline-2026-09-01.md index d85e80e6e..98a2d22e9 100644 --- a/docs/doctoring/product-gap-baseline-2026-09-01.md +++ b/docs/doctoring/product-gap-baseline-2026-09-01.md @@ -6,9 +6,11 @@ This note records why `docs/product-technical-gap-baseline.md` is maintained on ## Current live-state correction — 2026-09-02 -Protected BandScope source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,865 open pull requests**. An organization-wide aggregate captured immediately after the sweep returned **2,866 open pull requests** with `incomplete_results=false`. The one-request difference is retained as non-simultaneous live queue movement rather than normalized away or treated as evidence of an omitted repository. +Protected BandScope source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep begun at **2026-09-02 15:31 KST** queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,889 open pull requests**. An organization-wide aggregate captured immediately after the sweep also returned **2,889 open pull requests** with `incomplete_results=false`. Equality between the sequential sum and later aggregate is capture-time evidence only; concurrent PR creation/closure can still occur during a non-atomic census. -`ContextualWisdomLab/bandscope` was the highest observed backlog at **196 open pull requests**. Fresh high-backlog peers were `ContextualWisdomLab/naruon` 143, `ContextualWisdomLab/OriginWeave` 141, `ContextualWisdomLab/newsdom-api` 137, `ContextualWisdomLab/pg-erd-cloud` 135, `ContextualWisdomLab/html4tree` 127, and `ContextualWisdomLab/TEPP` 127. BandScope remains selected by both backlog and product responsibility: it owns the buyer-facing local-first rehearsal/audio path plus high-leverage release, security, persistence, workflow, and shared-contract boundaries. +`ContextualWisdomLab/bandscope` was the highest observed backlog at **196 open pull requests**. Fresh high-backlog peers were `ContextualWisdomLab/naruon` 145, `ContextualWisdomLab/OriginWeave` 141, `ContextualWisdomLab/newsdom-api` 137, `ContextualWisdomLab/pg-erd-cloud` 135, `ContextualWisdomLab/TEPP` 128, `ContextualWisdomLab/html4tree` 127, `ContextualWisdomLab/Orgmetra` 117, and `ContextualWisdomLab/.github` 117. BandScope remains selected by both backlog and product responsibility: it owns the buyer-facing local-first rehearsal/audio path plus high-leverage release, security, persistence, workflow, and shared-contract boundaries. + +The accessible repository set for this capture was: `ContextualWisdomLab/kaefa`, `ContextualWisdomLab/naruon`, `ContextualWisdomLab/EgressWeave`, `ContextualWisdomLab/pg-erd-cloud`, `ContextualWisdomLab/nonnest2`, `ContextualWisdomLab/argos`, `ContextualWisdomLab/g7`, `ContextualWisdomLab/learning-record-store`, `ContextualWisdomLab/learning-management-platform`, `ContextualWisdomLab/ConceptWeave`, `ContextualWisdomLab/clearfolio`, `ContextualWisdomLab/CalendarWeave`, `ContextualWisdomLab/newsdom-api`, `ContextualWisdomLab/Orgmetra`, `ContextualWisdomLab/OmniRoute`, `ContextualWisdomLab/RankWeave`, `ContextualWisdomLab/ThreadWeave`, `ContextualWisdomLab/learning-interoperability-contracts`, `ContextualWisdomLab/psychometrics-commons`, `ContextualWisdomLab/PolicyWeave`, `ContextualWisdomLab/scopeweave`, `ContextualWisdomLab/enterprise-architecture-core`, `ContextualWisdomLab/inkspan`, `ContextualWisdomLab/wardnet`, `ContextualWisdomLab/four-pillars`, `ContextualWisdomLab/ELUNVERA`, `ContextualWisdomLab/accounting-information-platform`, `ContextualWisdomLab/disksage`, `ContextualWisdomLab/OriginWeave`, `ContextualWisdomLab/quarantine-sandbox-runtime`, `ContextualWisdomLab/linux-cluster-ops`, `ContextualWisdomLab/html4tree`, `ContextualWisdomLab/ContextualWisdomLab.github.io`, `ContextualWisdomLab/noema`, `ContextualWisdomLab/litellm-patched-proxy`, `ContextualWisdomLab/gyeot`, `ContextualWisdomLab/9drive`, `ContextualWisdomLab/IRT-bibliography-set`, `ContextualWisdomLab/metering-billing-platform`, `ContextualWisdomLab/mightyETL`, `ContextualWisdomLab/learning-content-studio`, `ContextualWisdomLab/aFIPC`, `ContextualWisdomLab/contextual-orchestrator`, `ContextualWisdomLab/fast-mlsirm`, `ContextualWisdomLab/mhtml-etl-gateway`, `ContextualWisdomLab/semantic-data-portal`, `ContextualWisdomLab/EmbedRelay`, `ContextualWisdomLab/xtrmLLMBatchPython`, `ContextualWisdomLab/trivy-sarif-repro`, `ContextualWisdomLab/pg-llm-batch`, `ContextualWisdomLab/codec-carver`, `ContextualWisdomLab/LineageWeave`, `ContextualWisdomLab/macos_utility_packs`, `ContextualWisdomLab/free-router`, `ContextualWisdomLab/TEPP`, `ContextualWisdomLab/keyverse`, `ContextualWisdomLab/.github`, `ContextualWisdomLab/hyosung-itx-slogan-brief`, `ContextualWisdomLab/vooster`, `ContextualWisdomLab/supply-chain-control-plane`, `ContextualWisdomLab/ccube-jco-potential-customer`, `ContextualWisdomLab/j-planner`, `ContextualWisdomLab/pingora-gateway`, `ContextualWisdomLab/governance-risk-compliance`, `ContextualWisdomLab/seedream_evasepic`, `ContextualWisdomLab/appguardrail`, `ContextualWisdomLab/context-graph-contracts`, `ContextualWisdomLab/bandscope`, `ContextualWisdomLab/life-os`, `ContextualWisdomLab/graphify`, `ContextualWisdomLab/xtrm-lead-pi-outbound`, `ContextualWisdomLab/feelanet-adfs`, `ContextualWisdomLab/saju-caldav`, and `ContextualWisdomLab/DiagramWeave`. Volatile queue counts are dated evidence, not product truth. Every branch advance invalidates predecessor checks and approvals, and every later census must preserve non-simultaneous movement rather than manufacture a false simultaneous total. @@ -16,9 +18,9 @@ Volatile queue counts are dated evidence, not product truth. Every branch advanc A source-integrity defect was verified on predecessor #1116 head `f6207ef2cadadb5d3852e0595ab2f0b62e20a06b`. That census-only commit unintentionally removed 83 lines from `docs/product-technical-gap-baseline.md` and left the canonical product/technical contract ending immediately after §7.4. The deleted material included the identifier-policy migration boundary, Rust compute ownership, real-audio scientific acceptance, security/privacy, UI/UX evidence, quality/operability, release-gate, and traceability sections. -The parent `adbd9df394957ee1a2c68893b8a6025cdcf058c9` was inspected as recovery evidence before editing. The current canonical branch then advanced through ordinary non-force history to `ec67371791c653eed21705600775c06ecd531cc7`, restoring the lost contract while incorporating the fresh 74-repository census and current naming evidence. This was a direct source repair, not an issue/comment/delegation-only response. +The parent `adbd9df394957ee1a2c68893b8a6025cdcf058c9` was inspected as recovery evidence before editing. The canonical branch then advanced through ordinary non-force history to `ec67371791c653eed21705600775c06ecd531cc7`, restoring the lost contract. At the start of this capture #1116 was independently re-fetched at `docs/gap-baseline-2026-08-31@39232f8bfecc2e0ea950cca597fd89354cee710a`, base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`; the canonical baseline blob at that audited pre-write head was `cd4729d5580286783c9604e8e36bbd91bab610f2`. A document cannot truthfully self-embed the SHA of the commit that contains that self-reference, so successor head identity is always fetched from GitHub immediately after each write rather than inferred from prose. -The restored baseline now again carries the buyer PRD, end-to-end stories, DDD bounded contexts/context map/ubiquitous language/domain events, TRD topology and transport diagrams, persistence/versioning rules, organization naming and database migration rules, Rust-first compute ownership, persistence ERD discipline, rights-safe real-audio scientific acceptance, security/privacy, Storybook/Figma/shipped accessibility evidence, the 100% quality floor, release acceptance, and APA traceability. +The restored baseline carries the buyer PRD, end-to-end stories, DDD bounded contexts/context map/ubiquitous language/domain events, TRD topology and transport diagrams, persistence/versioning rules, organization naming and database migration rules, Rust-first compute ownership, persistence ERD discipline, rights-safe real-audio scientific acceptance, security/privacy, Storybook/Figma/shipped accessibility evidence, the 100% quality floor, release acceptance, and APA traceability. ## Organization naming-contract evidence @@ -26,7 +28,7 @@ The organization-owned naming rule is semantic, not casing-based. Multiword name ### Workspace role vocabulary — #1130 -`ContextualWisdomLab/bandscope#1130` owns the exported workspace role projection. Its semantic vocabulary is `RehearsalRoleOption.roleId`, `roleName`, and primary `roleOptions`. The previous component projection `{ id, name }[]` remains only inside the explicitly deprecated `LegacyRehearsalRoleOption` adapter input and is translated immediately by `normalizeLegacyRoleOptions`. No persisted project, IPC, database, vendor, or shared-types wire contract changed in that slice. The latest exact head recorded for that workstream is `724dd0445039b6e99863b46535a8497c784699ab`; predecessor verification never transfers after a later push. +`ContextualWisdomLab/bandscope#1130` owns the **active-PR** workspace role projection; it is not protected shipped truth until normally integrated. On that owner branch the semantic vocabulary is `RehearsalRoleOption.roleId`, `roleName`, and primary `roleOptions`, while the previous component projection `{ id, name }[]` is retained only as an explicitly deprecated `LegacyRehearsalRoleOption` adapter input translated by `normalizeLegacyRoleOptions`. Protected `develop` must not be described as already containing that projection until #1130 or its semantic successor lands. No persisted project, IPC, database, vendor, or shared-types wire contract is intended to change in that slice. ### Score attachment compatibility boundary — #1092 @@ -36,7 +38,7 @@ The focused RED commit `35dc521f03711d749771751ecf39b904f193057d` changed the re A current CodeRabbit review also identified a truthful-documentation defect: `ARCHITECTURE.md`, `AGENTS.md`, `CHANGELOG.md`, and `CLAUDE.md` could be read as promising that any persisted score attachment is openable. Production actually requires both validated attachment metadata and a live Score workspace; reopened metadata-only projects or untrusted metadata fall back to adding a score or checking the range by ear. The same canonical branch was directly repaired in commits `5af64f5c3ddc85b237a4426678de0233ee4f5fdf`, `5a2abb1aa404eb0df133cbaeade44439621e56d6`, `893b87a53faaa08f3f972a4dc264c47ff9c83511`, and `8099e3b2525723474aca09db4d669167035263b3` so product guidance and production now express one invariant. -At the latest #1092 capture, exact head `8099e3b2525723474aca09db4d669167035263b3` had **27** fresh check runs. Required/security lanes including `dependency-review`, `scorecard`, and `trivy-fs` were still queued, while a skipped manual-evidence helper was not treated as passing required evidence. No predecessor success was promoted. The connected GraphQL review-thread endpoint also hit a GitHub rate limit during this run; that transient platform read/mutation limitation does not convert an unresolved thread into resolved evidence and does not justify merge. +At the latest #1092 capture, exact head `8099e3b2525723474aca09db4d669167035263b3` had **27** fresh check runs. Required/security lanes including `dependency-review`, `scorecard`, and `trivy-fs` were still queued, while a skipped manual-evidence helper was not treated as passing required evidence. No predecessor success was promoted. ### Release identity — #1126 @@ -46,17 +48,27 @@ At the latest #1092 capture, exact head `8099e3b2525723474aca09db4d669167035263b BandScope's current project authority is file/project-format based rather than an organization-owned relational production schema, so the #1092 repair required no DDL. The canonical baseline nevertheless records the database rule for future owned schemas: use semantic multiword snake_case for tables, columns, indexes, constraints, sequences, views, materialized views, functions, and related objects; normalize to 3NF where relevant; and verify migration ordering, foreign keys, indexes, constraints, ORM/query mappings, UPSERT semantics, hot-partition risk, locking/read-write separation, compatibility, rollback, and recovery before integration. +The protected `.bscope` documentation currently describes structural schema validation but only proposes introducing a format-version field if future structural changes require one. Therefore `project_format_version` is a **target migration contract**, not current protected persisted behavior. Any future rename of a persisted generic field must first introduce a compatible versioned reader/migration/writer path with previous-version fixtures, deterministic repeated migration, rollback/recovery, and no dual writable truth. + ## Queue and causal-owner evidence -Issue #966 remains the dependency-aware merge-train control plane, while PR #968 retains unique executable queue machinery: bounded pagination, exact active-head capture, independently resolved target tips, deterministic ordering, malformed/incomplete/duplicate rejection, network-independent validation, and symlink-safe atomic publication. Because #1116 advanced again during this repair, every predecessor #968 target/check/review receipt is stale until #968 is normally re-resolved/restacked against the new canonical baseline head. +Issue #966 remains the dependency-aware merge-train control plane, while PR #968 retains unique executable queue machinery: bounded pagination, exact active-head capture, independently resolved target tips, deterministic ordering, malformed/incomplete/duplicate rejection, network-independent validation, and symlink-safe atomic publication. Fresh metadata now shows #968 as `docs/bandscope-product-readiness-baseline@ab89d16a9fbd6f47ca4747147f60d130a1ed8588` with base branch `docs/gap-baseline-2026-08-31` and base SHA `39232f8bfecc2e0ea950cca597fd89354cee710a`. Its PR-body prose still contains older stack SHAs and is navigation-only until corrected; checks/reviews from those predecessor identities do not transfer. + +The baseline owner #1116 and temporal-analysis PR #1117 are separate evidence lanes. The audited pre-write #1116 source identity was `docs/gap-baseline-2026-08-31@39232f8bfecc2e0ea950cca597fd89354cee710a`, base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`, document blob `cd4729d5580286783c9604e8e36bbd91bab610f2`. PR #1117 is `refactor/temporal-features-api@b98f266d2356d56be624fb617580b5252e85baaa`, also based on `develop@749511c3ad4000090048718f685c6bee6b3d2c25`; its visible review threads are independently resolved and do not constitute #1116 review evidence. The latest protected central control-plane evidence recorded by the baseline is `ContextualWisdomLab/.github@669505bdf267d92989298857c740a59807bbd735`. Issue `.github#712` remains the organization-wide runner-admission/queue-health owner. Earlier protected `.github#1658`, `.github#1656`, `.github#1665`, and `.github#1645` reduce avoidable queue/review pressure and review-routing ambiguity but do not turn a queued exact-head job into terminal success. Repository-local Trivy PR-head configuration remains owned by open BandScope #1119 until normally integrated or superseded. -The connected repository write surface permits ordinary source/workflow/PR changes but does not expose organization runner-pool, Actions quota/billing, or equivalent admission-setting mutation. Unchanged-head reruns and runner-label churn are therefore not substitutes for causal evidence. Queued jobs remain non-passing while independent source work proceeds. +The connected repository write surface permits ordinary source/workflow/PR changes but does not expose organization runner-pool, Actions quota/billing, or equivalent admission-setting mutation. A fresh attempt to read the protected `develop` branch-protection endpoint in this run returned GitHub **403 `Resource not accessible by integration`**; therefore the previously recorded 16-context inventory is not promoted as newly revalidated branch-protection truth in this capture. Unchanged-head reruns and runner-label churn are not substitutes for causal evidence. + +Canonical product ownership remains explicit: #961 owns active rehearsal player/transport, #962 owns crash-safe project persistence, **#963 owns diagnostics/support bundles**, and #960 owns trusted release/distribution. These scopes are distinct even when one leaf PR exercises more than one acceptance gate. + +## Security Notes + +This documentation change introduces no new runtime authority. The durable security contract remains: untrusted file/project/codec/model/update/subprocess inputs cross typed validation boundaries; ordinary local analysis uses allowlisted Tauri IPC, bounded stdin/stdout, or loopback strictly limited to `127.0.0.1` where a loopback adapter is explicitly required, and does not depend on public HTTP or another network path. Structured inputs are schema-validated before domain use. Subprocess execution uses argument arrays and `shell=False`-equivalent non-shell authority. Logs and support bundles redact credentials, raw audio/project payloads, and absolute local paths. Release artifacts require signature/checksum/SBOM/provenance verification at the owning distribution boundary. Queued, pending, neutral, skipped-required, stale, or predecessor evidence is non-passing. ## Historical observations and RCA -Historical queue observations remain useful only as dated evidence. On 2026-09-01 10:31 KST BandScope had 190 open pull requests. At 2026-09-01 13:29 KST, 72 repositories were visible and an organization recount reported 2,697 open pull requests, with BandScope at 188. Later 2026-09-02 sweeps observed 2,827/2,834 and 185 BandScope, then 2,856/2,855 and 194 BandScope, before the current 2,865/2,866 and 196 BandScope capture. None may be reused as an undated permanent count. +Historical queue observations remain useful only as dated evidence. On 2026-09-01 10:31 KST BandScope had 190 open pull requests. At 2026-09-01 13:29 KST, 72 repositories were visible and an organization recount reported 2,697 open pull requests, with BandScope at 188. Later 2026-09-02 sweeps observed 2,827/2,834 and 185 BandScope, 2,856/2,855 and 194 BandScope, then 2,865/2,866 and 196 BandScope before the current 2,889/2,889 and 196 BandScope capture. None may be reused as an undated permanent count. Review findings previously validated on #1116 included stale PR evidence, a false repository-wide Mermaid-absence claim, stale product-owner issue numbers, and prose-inherited live Noema/PR claims. The replacement baseline separates protected-source facts from timestamped GitHub observations and uses exact current-head examples instead of assigning one cause to the whole queue. @@ -85,6 +97,6 @@ World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines (WCAG) ## Decision -PR #1116 remains the canonical baseline owner. Its source now contains the complete recovered PRD/TRD/DDD/naming/Rust/science/security/UI/quality/release/traceability contract plus current delivery evidence. PR #1025 is an older competing owner of the same path; it may only be closed as superseded when every unique semantic requirement remains executable or represented in the canonical source and its discussion history is preserved. +PR #1116 remains the canonical baseline owner. Its source contains the complete recovered PRD/TRD/DDD/naming/Rust/science/security/UI/quality/release/traceability contract plus current delivery evidence. PR #1025 is an older competing owner of the same path; it may only be closed as superseded when every unique semantic requirement remains executable or represented in the canonical source and its discussion history is preserved. Future loops should refresh live counts and exact-head evidence when they materially change prioritization or causal ownership. They must not rewrite stable product/architecture sections merely to chase a volatile PR number, and they must never repeat the predecessor truncation failure by replacing a complete canonical document with a partial census fragment. \ No newline at end of file From 9e88ba2cf4dc0fdaf64f80b1f540c37bb4d9ce49 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 15:49:56 +0900 Subject: [PATCH 41/80] docs(gap): repair live evidence and transport contract --- docs/product-technical-gap-baseline.md | 46 +++++++++++++++++--------- 1 file changed, 31 insertions(+), 15 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index cd4729d55..f9166c506 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -44,13 +44,13 @@ The near-term product order remains: merge-train convergence; trusted distributi ## 2. Live delivery authority -A fresh accessible-repository sweep queried all **74** repositories currently visible under `ContextualWisdomLab` individually. The sequential per-repository counts summed to **2,865 open pull requests**. An organization-wide aggregate captured immediately after that sweep returned **2,866 open pull requests** with `incomplete_results=false`. The one-request delta is retained as non-simultaneous live queue movement rather than normalized away or treated as an omitted repository. +A fresh accessible-repository sweep begun at **2026-09-02 15:31 KST** queried all **74** repositories currently visible under `ContextualWisdomLab` individually. The sequential per-repository counts summed to **2,889 open pull requests**. An organization-wide aggregate captured immediately after that sweep also returned **2,889 open pull requests** with `incomplete_results=false`. Equality between these non-atomic captures is evidence for this capture only; concurrent creations and closures can still occur while a sequential census is running. -At this census `ContextualWisdomLab/bandscope` had **196 open pull requests** and remains the selected delivery boundary. Fresh high-backlog peers were `ContextualWisdomLab/naruon` (143), `ContextualWisdomLab/OriginWeave` (141), `ContextualWisdomLab/newsdom-api` (137), `ContextualWisdomLab/pg-erd-cloud` (135), `ContextualWisdomLab/html4tree` (127), and `ContextualWisdomLab/TEPP` (127). BandScope is selected not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. +At this census `ContextualWisdomLab/bandscope` had **196 open pull requests** and remains the selected delivery boundary. Fresh high-backlog peers were `ContextualWisdomLab/naruon` (145), `ContextualWisdomLab/OriginWeave` (141), `ContextualWisdomLab/newsdom-api` (137), `ContextualWisdomLab/pg-erd-cloud` (135), `ContextualWisdomLab/TEPP` (128), `ContextualWisdomLab/html4tree` (127), `ContextualWisdomLab/Orgmetra` (117), and `ContextualWisdomLab/.github` (117). BandScope is selected not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. -Because PR creation and closure can occur during a sequential organization census, the organization-wide search is an aggregate capture while the per-repository sweep establishes which repositories were enumerated at that time. Volatile deltas are recorded explicitly rather than normalized away or misrepresented as simultaneous permanent truth. +The exact 74-repository set for this same capture is enumerated verbatim in `docs/doctoring/product-gap-baseline-2026-09-01.md`; capitalization there is the GitHub repository identity and is not normalized. Because PR creation and closure can occur during a sequential organization census, later counts are historical observations unless a new complete sweep is performed. -Protected `develop` currently requires these 16 contexts before normal integration: `ci / build-and-test`, `dependency-review`, `security-audit`, `sbom`, `release-preflight`, `gate / build / windows`, `gate / build / macos`, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, `Analyze (javascript-typescript)`, and `Analyze (python)`. +Protected `develop` was previously recorded with these 16 required contexts: `ci / build-and-test`, `dependency-review`, `security-audit`, `sbom`, `release-preflight`, `gate / build / windows`, `gate / build / macos`, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, `Analyze (javascript-typescript)`, and `Analyze (python)`. A fresh branch-protection read in this run returned GitHub 403 `Resource not accessible by integration`, so this inventory is not represented as newly revalidated protection truth; merge decisions must refetch through an authorized surface. Operational evidence rule: queued, pending, skipped-required, cancelled, neutral, failed, absent, stale, predecessor-head, protected-base, model-only, status-only, self/author, or administrative-bypass evidence is non-passing. A head change invalidates predecessor review/check receipts. Force-push, destructive rebase, self-approval, gate weakening, fabricated evidence, and unrelated rollback are prohibited. @@ -73,13 +73,13 @@ Active work is not shipped truth until it is normally integrated into protected | Boundary | Canonical live owner / evidence | Current status | |---|---|---| | Merge-train control plane | Issue #966 with executable queue lane PR #968 | #968 remains Draft; its unique queue machinery must survive every restack and its exact current head is non-passing until hosted/current-head evidence exists | -| Canonical baseline | PR #1116, this file | Open; a prior census-only edit accidentally truncated sections 7.5–13, and this exact branch now restores that lost source while refreshing current evidence | -| Workspace role naming | PR #1130 | `RehearsalRoleOption` uses `roleId`/`roleName` with primary `roleOptions`; the previous `roles: { id, name }[]` projection exists only as a deprecated component compatibility input translated immediately at the boundary | -| Score attachment naming | PR #1092 | Persisted project-format `scoreAttachments` retains compatibility keys `id`/`fileName`, while `trustedScoreAttachment` translates them immediately to workspace-owned `scoreId`/`scoreFileName`; current exact head at this capture is `8099e3b2525723474aca09db4d669167035263b3`; no database or persisted-wire migration is introduced | +| Canonical baseline | PR #1116, this file | Open; prior truncation is repaired and current census/contract corrections remain active until this branch normally integrates | +| Workspace role naming | PR #1130 | The **active owner branch** uses `RehearsalRoleOption.roleId`/`roleName` with primary `roleOptions`; the previous `{ id, name }[]` projection exists only as a deprecated component compatibility input there. Protected `develop` is not claimed to contain this projection before integration | +| Score attachment naming | PR #1092 | Persisted project-format `scoreAttachments` retains compatibility keys `id`/`fileName`, while `trustedScoreAttachment` translates them immediately to workspace-owned `scoreId`/`scoreFileName`; current exact head at the recorded capture is `8099e3b2525723474aca09db4d669167035263b3`; no database or persisted-wire migration is introduced | | Repository-local Trivy PR-head contract | PR #1119 | Quoted/commented YAML activity-list normalization is repaired on its canonical branch; current-head workflows remain non-passing until fresh terminal evidence exists | | Trusted distribution | Issue #960; active release-identity lane PR #1126 | Semantic release-identity naming is active work; Windows signing, macOS signing/notarization, checksums, SBOM/provenance, signature-verified updater, staged rollout, rollback/repair, and complete version-identity parity remain incomplete as one integrated protected-head receipt | | Active rehearsal player | Issue #961; implementation lane #971 | Real authorized local audio playback/seek/stop/loop/rate/cue transport is active work; count-in and any source-backed stem control must converge into one transport state machine | -| Crash-safe project | Issue #962; implementation lane #970 | Atomic publication, versioned format, recovery, migration, autosave, rollback/export and persisted transport state remain active work, not protected truth | +| Crash-safe project | Issue #962; implementation lane #970 | Atomic publication, explicit format versioning, recovery, migration, autosave, rollback/export and persisted transport state remain active work, not protected truth | | Real-audio science | Issue #770 and active benchmark lanes | Rights-safe decoded-audio MIR acceptance, recognized metrics, uncertainty and reproducible evidence remain incomplete | | Resource admission/decode | Issue #781 plus commercial dependency defect #1129 | No synthetic/mock success may substitute for production-path resource/cancellation evidence; the commercially supported decode path must remove the libsndfile-backed LGPL runtime boundary with equivalent real-audio behavior and cross-platform/SBOM proof | | Diagnostics/supportability | Issue #963 | Typed redacted crash/hang evidence and user-previewable offline support bundle remain incomplete | @@ -93,9 +93,11 @@ The product boundary, tests, contracts, and unique behavior decide succession— Backlog convergence is the primary engineering risk because micro-PR fan-out creates duplicate writers, stale evidence, dependency ambiguity, competing local state, and review/check churn. -PR #968 owns the unique executable queue machinery needed by #966: bounded GitHub pagination, exact active-head capture, independent base-tip resolution, deterministic ordering, malformed/incomplete/duplicate rejection, reviewed dependency/succession metadata, network-independent validation, deterministic human projection, and symlink-safe atomic publication. It must not be discarded as stale documentation. +PR #968 owns the unique executable queue machinery needed by #966: bounded GitHub pagination, exact active-head capture, independent base-tip resolution, deterministic ordering, malformed/incomplete/duplicate rejection, reviewed dependency/succession metadata, network-independent validation, deterministic human projection/parity, and symlink-safe atomic publication. It must not be discarded as stale documentation. -The latest independently resolved evidence before this baseline repair placed #968 at `docs/bandscope-product-readiness-baseline@bfdc3888de2736753ed93fcf0018459882bfa0e2` and its then-current #1116 target at `docs/gap-baseline-2026-08-31@adbd9df394957ee1a2c68893b8a6025cdcf058c9`. #1116 has advanced again in ordinary history, so that predecessor target identity and all checks/reviews attached to it do not transfer. #968 must be re-resolved/restacked normally against the new canonical baseline head before integration. +Current identities are deliberately separated rather than conflated. At the pre-write #1116 audit, canonical baseline PR #1116 was `docs/gap-baseline-2026-08-31@99b490db2ab7e083497d53c566fc9eec99246d00`, base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`; the baseline blob inherited from its immediately preceding source commit was `cd4729d5580286783c9604e8e36bbd91bab610f2`. A later GitHub read of PR #968 reported queue head `docs/bandscope-product-readiness-baseline@ab89d16a9fbd6f47ca4747147f60d130a1ed8588` but still recorded base SHA `39232f8bfecc2e0ea950cca597fd89354cee710a` for base branch `docs/gap-baseline-2026-08-31`. That is predecessor stack evidence, not #1116's current head. Because #1116 advanced, #968 must reconcile/restack against the new baseline identity through ordinary history before its checks/reviews can qualify. + +PR #1117 is a separate lane: `refactor/temporal-features-api@b98f266d2356d56be624fb617580b5252e85baaa`, base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. Its visible review threads are independently resolved; that review evidence belongs to #1117 and never substitutes for #1116 or #968 evidence. #1117 does not own `docs/product-technical-gap-baseline.md`, so no canonical baseline document blob is attributed to its exact ref. PR #1007 is the canonical first-part-handoff lane only to the extent that its live semantic diff still preserves mounted selected-role wiring and the scientific prohibition against manufacturing handoffs from heuristic fallback. Any succession decision is rechecked against the independently resolved live head rather than a remembered PR-body SHA. @@ -188,7 +190,7 @@ Protected `develop` is a local desktop architecture with these principal impleme - `services/analysis-engine`: Python orchestration/compatibility plus still-mixed analysis code during migration; - `services/analysis-engine/rust`: `bandscope_numeric` Rust/PyO3 numerical kernels. -Typed Tauri IPC and bounded local process/stdin-stdout boundaries are the intended orchestration ports. Codec libraries, source-separation/model runtimes, filesystem/platform APIs, accelerators, update services, and external handoff contracts are adapters behind owning-context ports. Ordinary rehearsal analysis must not require an unaudited loopback/public HTTP service. +Typed allowlisted Tauri IPC and bounded local process/stdin-stdout boundaries are the intended orchestration ports. If an owning adapter requires loopback transport it is limited to `127.0.0.1`; public HTTP and other network-dependent paths are not ordinary local-analysis authority. Codec libraries, source-separation/model runtimes, filesystem/platform APIs, accelerators, update services, and external handoff contracts are adapters behind owning-context ports. ### 7.2 End-to-end rehearsal sequence @@ -225,19 +227,24 @@ stateDiagram-v2 Playing --> Paused: pause Paused --> Playing: resume Playing --> Looping: precise loop active + Looping --> LoopPaused: pause (loop retained) + LoopPaused --> Looping: resume Looping --> Playing: loop cleared + LoopPaused --> Paused: loop cleared Playing --> Ready: stop Paused --> Ready: stop + Looping --> Ready: stop + LoopPaused --> Ready: stop Ready --> Recovering: project recovery requested Recovering --> Ready: last-known-good restored Recovering --> RecoveryFailed: no valid recoverable snapshot ``` -The production player owns one transport state machine. UI components, cue cards, map cursors, and persisted project data project from that authority; they do not each own independent writable transport state. Project publication is atomic and crash-safe rather than implied by the diagram's UI state. +The production player owns one transport state machine. Loop activation never removes pause or stop authority: active-loop playback may pause with the loop retained, resume into that loop, clear the loop into ordinary playback/paused state, or stop directly. UI components, cue cards, map cursors, and persisted project data project from that authority; they do not each own independent writable transport state. Project publication is atomic and crash-safe rather than implied by the diagram's UI state. ### 7.4 Persistence and contract versioning -Project persistence uses explicit `project_format_version`, deterministic/idempotent migrations, atomic replacement only after a complete durable candidate exists, and a last-known-good backup/recovery path. Fault injection must prove that partial/truncated writes, disk-full conditions, interrupted migration, and failed replacement do not destroy the previous valid project. Portable export is versioned independently from in-memory implementation types. +Protected `.bscope` documentation currently validates loaded JSON against the `RehearsalSong` contract and states that a format-version field **may be introduced** when future structural changes require one; it does not yet establish `project_format_version` as shipped persisted behavior. The target persistence contract therefore requires introducing explicit `project_format_version` before a breaking structural migration, plus deterministic/idempotent migration, atomic replacement only after a complete durable candidate exists, and a last-known-good backup/recovery path. Fault injection must prove that partial/truncated writes, disk-full conditions, interrupted migration, and failed replacement do not destroy the previous valid project. Portable export is versioned independently from in-memory implementation types. Tauri IPC, shared types, project files, handoff schemas, updater manifests, and externally released event/contracts are versioned boundaries. A rename or ownership cleanup is never permission for an in-place breaking wire-format change. @@ -247,7 +254,7 @@ The organization naming policy applies prospectively to new or materially change When an existing bare field is already part of a persisted or cross-boundary contract, a semantic rename follows the owning contract's compatibility mechanism: -- project files: introduce a renamed persisted field only behind an explicit `project_format_version` migration; readers accept supported prior representations, migration is deterministic/idempotent, and writers emit one canonical current representation after migration; +- project files: first introduce an explicit format-version field (target name `project_format_version`) through the canonical persistence evolution path, then introduce any renamed persisted field behind that versioned migration; readers accept supported prior representations, migration is deterministic/idempotent, and writers emit one canonical current representation after migration; - Tauri IPC/shared API: use an additive/versioned request or response contract or a bounded compatibility alias; do not remove the previous key until supported callers have migrated and contract tests prove interoperability; - database-owned schemas: use explicit schema migration with backward-compatible read/write sequencing, foreign-key/index/constraint/ORM/query updates, rollback evidence, normalized ownership, UPSERT-path validation, and locking/hot-partition review rather than an uncoordinated column rename; - released handoff/events/context contracts: retain mandated released spelling until the owning contract publishes a compatible version; anti-corruption layers translate at the boundary; @@ -255,7 +262,7 @@ When an existing bare field is already part of a persisted or cross-boundary con Every compatibility-changing rename requires fixtures from the previous supported version, round-trip/no-data-loss tests, deterministic repeated migration, rollback/recovery evidence where persistence is involved, and removal criteria for any temporary alias. There is never dual writable truth after migration. -Current examples demonstrate the intended direction without breaking compatibility. PR #1130 makes `roleId`, `roleName`, and `roleOptions` the switcher-owned vocabulary while accepting the old component projection only at one deprecated adapter input. PR #1092 keeps the established persisted score attachment keys `id` and `fileName` unchanged but makes `trustedScoreAttachment` an explicit anti-corruption boundary that validates those keys and returns `scoreId` and `scoreFileName` for workspace logic. Its focused RED contract was commit `35dc521f03711d749771751ecf39b904f193057d`; the production semantic translation was commit `8cd6756ef242d99fc323181b21b58f96fe24c731`; subsequent documentation commits aligned `ARCHITECTURE.md`, `AGENTS.md`, `CHANGELOG.md`, and `CLAUDE.md` with the same live-workspace/fallback invariant. No database object or persisted project wire key changed in that repair. +Current examples demonstrate the intended direction without breaking compatibility. PR #1130's active owner branch makes `roleId`, `roleName`, and `roleOptions` the switcher-owned vocabulary while accepting the old component projection only at one deprecated adapter input; protected `develop` is not claimed to contain that projection before normal integration. PR #1092 keeps the established persisted score attachment keys `id` and `fileName` unchanged but makes `trustedScoreAttachment` an explicit anti-corruption boundary that validates those keys and returns `scoreId` and `scoreFileName` for workspace logic. Its focused RED contract was commit `35dc521f03711d749771751ecf39b904f193057d`; the production semantic translation was commit `8cd6756ef242d99fc323181b21b58f96fe24c731`; subsequent documentation commits aligned `ARCHITECTURE.md`, `AGENTS.md`, `CHANGELOG.md`, and `CLAUDE.md` with the same live-workspace/fallback invariant. No database object or persisted project wire key changed in that repair. ### 7.6 Rust compute ownership @@ -297,6 +304,15 @@ Owning contexts must fail closed on path/symlink/reparse traversal, oversized/de Ordinary logs/support bundles must not contain raw audio/project payloads, credentials or absolute local paths. Authorization is purpose-bound and least-privilege with field minimization, retention and access/export audit where relevant. +### Security Notes + +- **IPC/network boundary:** ordinary local analysis uses allowlisted Tauri IPC, bounded stdin/stdout, or an explicitly required loopback adapter limited to `127.0.0.1`. Public HTTP and other network-dependent paths are not local-analysis authority. +- **Input admission:** project/media/codec/model/update/subprocess inputs are untrusted and require strict schema/type/size/path validation before domain use. +- **Subprocess authority:** use argument arrays with non-shell execution (`shell=False`-equivalent); do not interpolate untrusted input into shell commands. +- **Privacy:** diagnostics and support exports redact credentials, raw audio/project payloads and absolute local paths by default, with user-previewable bounded export. +- **Artifact trust:** installers/updaters require owning-boundary signature, checksum, SBOM and provenance verification; staged rollout and rollback evidence remain part of release acceptance. +- **Verification status:** queued, pending, neutral, skipped-required, cancelled, stale, predecessor or inaccessible-protection evidence is non-passing and cannot be promoted into security assurance. + The latest protected central control-plane evidence recorded by this baseline is `ContextualWisdomLab/.github@669505bdf267d92989298857c740a59807bbd735`. Issue `.github#712` remains the organization-wide Actions queue-health/runner-admission causal owner. Earlier protected `.github#1658`, `.github#1656`, `.github#1665`, and `.github#1645` reduce avoidable load/review-routing ambiguity but do not convert a queued current-head check into success. Repository-local BandScope #1119 remains the Trivy PR-head contract owner until normally integrated or superseded. Fresh #1092 exact-head verification exists on `8099e3b2525723474aca09db4d669167035263b3`: 27 check runs were observed, with required/security lanes such as `dependency-review`, `scorecard`, and `trivy-fs` still queued at capture. A skipped manual-evidence helper is not a substitute for required evidence. No predecessor-head success is transferred. From ab1a428a61b7b30199c5f2d6bbbc64a8c02f88cb Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 16:14:56 +0900 Subject: [PATCH 42/80] docs(gap): refresh organization PR census --- docs/product-technical-gap-baseline.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index f9166c506..084e4bab3 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -44,9 +44,9 @@ The near-term product order remains: merge-train convergence; trusted distributi ## 2. Live delivery authority -A fresh accessible-repository sweep begun at **2026-09-02 15:31 KST** queried all **74** repositories currently visible under `ContextualWisdomLab` individually. The sequential per-repository counts summed to **2,889 open pull requests**. An organization-wide aggregate captured immediately after that sweep also returned **2,889 open pull requests** with `incomplete_results=false`. Equality between these non-atomic captures is evidence for this capture only; concurrent creations and closures can still occur while a sequential census is running. +A fresh accessible-repository sweep begun at **2026-09-02 15:59 KST** queried all **74** repositories currently visible under `ContextualWisdomLab` individually. The sequential per-repository counts summed to **2,894 open pull requests**. An organization-wide aggregate captured immediately after that sweep also returned **2,894 open pull requests** with `incomplete_results=false`. Equality between these non-atomic captures is evidence for this capture only; concurrent creations and closures can still occur while a sequential census is running. -At this census `ContextualWisdomLab/bandscope` had **196 open pull requests** and remains the selected delivery boundary. Fresh high-backlog peers were `ContextualWisdomLab/naruon` (145), `ContextualWisdomLab/OriginWeave` (141), `ContextualWisdomLab/newsdom-api` (137), `ContextualWisdomLab/pg-erd-cloud` (135), `ContextualWisdomLab/TEPP` (128), `ContextualWisdomLab/html4tree` (127), `ContextualWisdomLab/Orgmetra` (117), and `ContextualWisdomLab/.github` (117). BandScope is selected not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. +At this census `ContextualWisdomLab/bandscope` had **196 open pull requests** and remains the selected delivery boundary. Fresh high-backlog peers were `ContextualWisdomLab/naruon` (145), `ContextualWisdomLab/OriginWeave` (142), `ContextualWisdomLab/newsdom-api` (137), `ContextualWisdomLab/pg-erd-cloud` (136), `ContextualWisdomLab/TEPP` (128), `ContextualWisdomLab/html4tree` (127), `ContextualWisdomLab/.github` (118), and `ContextualWisdomLab/Orgmetra` (117). BandScope is selected not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. The exact 74-repository set for this same capture is enumerated verbatim in `docs/doctoring/product-gap-baseline-2026-09-01.md`; capitalization there is the GitHub repository identity and is not normalized. Because PR creation and closure can occur during a sequential organization census, later counts are historical observations unless a new complete sweep is performed. @@ -95,7 +95,7 @@ Backlog convergence is the primary engineering risk because micro-PR fan-out cre PR #968 owns the unique executable queue machinery needed by #966: bounded GitHub pagination, exact active-head capture, independent base-tip resolution, deterministic ordering, malformed/incomplete/duplicate rejection, reviewed dependency/succession metadata, network-independent validation, deterministic human projection/parity, and symlink-safe atomic publication. It must not be discarded as stale documentation. -Current identities are deliberately separated rather than conflated. At the pre-write #1116 audit, canonical baseline PR #1116 was `docs/gap-baseline-2026-08-31@99b490db2ab7e083497d53c566fc9eec99246d00`, base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`; the baseline blob inherited from its immediately preceding source commit was `cd4729d5580286783c9604e8e36bbd91bab610f2`. A later GitHub read of PR #968 reported queue head `docs/bandscope-product-readiness-baseline@ab89d16a9fbd6f47ca4747147f60d130a1ed8588` but still recorded base SHA `39232f8bfecc2e0ea950cca597fd89354cee710a` for base branch `docs/gap-baseline-2026-08-31`. That is predecessor stack evidence, not #1116's current head. Because #1116 advanced, #968 must reconcile/restack against the new baseline identity through ordinary history before its checks/reviews can qualify. +Current identities are deliberately separated rather than conflated. At this pre-write audit, canonical baseline PR #1116 was `docs/gap-baseline-2026-08-31@9e88ba2cf4dc0fdaf64f80b1f540c37bb4d9ce49`, base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. A fresh GitHub read of PR #968 reported queue head `docs/bandscope-product-readiness-baseline@a1ccf9348343a835c640d0b7e830d9c10b0c0482` and base SHA exactly `9e88ba2cf4dc0fdaf64f80b1f540c37bb4d9ce49` for base branch `docs/gap-baseline-2026-08-31`; that head is the ordinary non-force two-parent restack that preserved #968 queue machinery while taking the then-current #1116 baseline/doctoring blobs. Any later #1116 advance invalidates that base-tip receipt and requires #968 to reconcile again before predecessor checks/reviews can qualify. PR #1117 is a separate lane: `refactor/temporal-features-api@b98f266d2356d56be624fb617580b5252e85baaa`, base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. Its visible review threads are independently resolved; that review evidence belongs to #1117 and never substitutes for #1116 or #968 evidence. #1117 does not own `docs/product-technical-gap-baseline.md`, so no canonical baseline document blob is attributed to its exact ref. From cad80c194fc1019d3e1aa3fedae1f8f1c3d861d4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 16:16:23 +0900 Subject: [PATCH 43/80] docs(doctoring): refresh live queue evidence --- .../product-gap-baseline-2026-09-01.md | 20 ++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/docs/doctoring/product-gap-baseline-2026-09-01.md b/docs/doctoring/product-gap-baseline-2026-09-01.md index 98a2d22e9..4ad9843ee 100644 --- a/docs/doctoring/product-gap-baseline-2026-09-01.md +++ b/docs/doctoring/product-gap-baseline-2026-09-01.md @@ -6,11 +6,11 @@ This note records why `docs/product-technical-gap-baseline.md` is maintained on ## Current live-state correction — 2026-09-02 -Protected BandScope source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep begun at **2026-09-02 15:31 KST** queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,889 open pull requests**. An organization-wide aggregate captured immediately after the sweep also returned **2,889 open pull requests** with `incomplete_results=false`. Equality between the sequential sum and later aggregate is capture-time evidence only; concurrent PR creation/closure can still occur during a non-atomic census. +Protected BandScope source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep begun at **2026-09-02 15:59 KST** queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,894 open pull requests**. An organization-wide aggregate captured immediately after the sweep also returned **2,894 open pull requests** with `incomplete_results=false`. Equality between the sequential sum and later aggregate is capture-time evidence only; concurrent PR creation/closure can still occur during a non-atomic census. -`ContextualWisdomLab/bandscope` was the highest observed backlog at **196 open pull requests**. Fresh high-backlog peers were `ContextualWisdomLab/naruon` 145, `ContextualWisdomLab/OriginWeave` 141, `ContextualWisdomLab/newsdom-api` 137, `ContextualWisdomLab/pg-erd-cloud` 135, `ContextualWisdomLab/TEPP` 128, `ContextualWisdomLab/html4tree` 127, `ContextualWisdomLab/Orgmetra` 117, and `ContextualWisdomLab/.github` 117. BandScope remains selected by both backlog and product responsibility: it owns the buyer-facing local-first rehearsal/audio path plus high-leverage release, security, persistence, workflow, and shared-contract boundaries. +`ContextualWisdomLab/bandscope` was the highest observed backlog at **196 open pull requests**. Fresh high-backlog peers were `ContextualWisdomLab/naruon` 145, `ContextualWisdomLab/OriginWeave` 142, `ContextualWisdomLab/newsdom-api` 137, `ContextualWisdomLab/pg-erd-cloud` 136, `ContextualWisdomLab/TEPP` 128, `ContextualWisdomLab/html4tree` 127, `ContextualWisdomLab/.github` 118, and `ContextualWisdomLab/Orgmetra` 117. BandScope remains selected by both backlog and product responsibility: it owns the buyer-facing local-first rehearsal/audio path plus high-leverage release, security, persistence, workflow, and shared-contract boundaries. -The accessible repository set for this capture was: `ContextualWisdomLab/kaefa`, `ContextualWisdomLab/naruon`, `ContextualWisdomLab/EgressWeave`, `ContextualWisdomLab/pg-erd-cloud`, `ContextualWisdomLab/nonnest2`, `ContextualWisdomLab/argos`, `ContextualWisdomLab/g7`, `ContextualWisdomLab/learning-record-store`, `ContextualWisdomLab/learning-management-platform`, `ContextualWisdomLab/ConceptWeave`, `ContextualWisdomLab/clearfolio`, `ContextualWisdomLab/CalendarWeave`, `ContextualWisdomLab/newsdom-api`, `ContextualWisdomLab/Orgmetra`, `ContextualWisdomLab/OmniRoute`, `ContextualWisdomLab/RankWeave`, `ContextualWisdomLab/ThreadWeave`, `ContextualWisdomLab/learning-interoperability-contracts`, `ContextualWisdomLab/psychometrics-commons`, `ContextualWisdomLab/PolicyWeave`, `ContextualWisdomLab/scopeweave`, `ContextualWisdomLab/enterprise-architecture-core`, `ContextualWisdomLab/inkspan`, `ContextualWisdomLab/wardnet`, `ContextualWisdomLab/four-pillars`, `ContextualWisdomLab/ELUNVERA`, `ContextualWisdomLab/accounting-information-platform`, `ContextualWisdomLab/disksage`, `ContextualWisdomLab/OriginWeave`, `ContextualWisdomLab/quarantine-sandbox-runtime`, `ContextualWisdomLab/linux-cluster-ops`, `ContextualWisdomLab/html4tree`, `ContextualWisdomLab/ContextualWisdomLab.github.io`, `ContextualWisdomLab/noema`, `ContextualWisdomLab/litellm-patched-proxy`, `ContextualWisdomLab/gyeot`, `ContextualWisdomLab/9drive`, `ContextualWisdomLab/IRT-bibliography-set`, `ContextualWisdomLab/metering-billing-platform`, `ContextualWisdomLab/mightyETL`, `ContextualWisdomLab/learning-content-studio`, `ContextualWisdomLab/aFIPC`, `ContextualWisdomLab/contextual-orchestrator`, `ContextualWisdomLab/fast-mlsirm`, `ContextualWisdomLab/mhtml-etl-gateway`, `ContextualWisdomLab/semantic-data-portal`, `ContextualWisdomLab/EmbedRelay`, `ContextualWisdomLab/xtrmLLMBatchPython`, `ContextualWisdomLab/trivy-sarif-repro`, `ContextualWisdomLab/pg-llm-batch`, `ContextualWisdomLab/codec-carver`, `ContextualWisdomLab/LineageWeave`, `ContextualWisdomLab/macos_utility_packs`, `ContextualWisdomLab/free-router`, `ContextualWisdomLab/TEPP`, `ContextualWisdomLab/keyverse`, `ContextualWisdomLab/.github`, `ContextualWisdomLab/hyosung-itx-slogan-brief`, `ContextualWisdomLab/vooster`, `ContextualWisdomLab/supply-chain-control-plane`, `ContextualWisdomLab/ccube-jco-potential-customer`, `ContextualWisdomLab/j-planner`, `ContextualWisdomLab/pingora-gateway`, `ContextualWisdomLab/governance-risk-compliance`, `ContextualWisdomLab/seedream_evasepic`, `ContextualWisdomLab/appguardrail`, `ContextualWisdomLab/context-graph-contracts`, `ContextualWisdomLab/bandscope`, `ContextualWisdomLab/life-os`, `ContextualWisdomLab/graphify`, `ContextualWisdomLab/xtrm-lead-pi-outbound`, `ContextualWisdomLab/feelanet-adfs`, `ContextualWisdomLab/saju-caldav`, and `ContextualWisdomLab/DiagramWeave`. +The accessible repository set for this capture was: `ContextualWisdomLab/kaefa`, `ContextualWisdomLab/aFIPC`, `ContextualWisdomLab/nonnest2`, `ContextualWisdomLab/html4tree`, `ContextualWisdomLab/mightyETL`, `ContextualWisdomLab/xtrmLLMBatchPython`, `ContextualWisdomLab/pg-erd-cloud`, `ContextualWisdomLab/clearfolio`, `ContextualWisdomLab/bandscope`, `ContextualWisdomLab/newsdom-api`, `ContextualWisdomLab/scopeweave`, `ContextualWisdomLab/naruon`, `ContextualWisdomLab/linux-cluster-ops`, `ContextualWisdomLab/argos`, `ContextualWisdomLab/codec-carver`, `ContextualWisdomLab/appguardrail`, `ContextualWisdomLab/vooster`, `ContextualWisdomLab/.github`, `ContextualWisdomLab/ContextualWisdomLab.github.io`, `ContextualWisdomLab/seedream_evasepic`, `ContextualWisdomLab/contextual-orchestrator`, `ContextualWisdomLab/hyosung-itx-slogan-brief`, `ContextualWisdomLab/fast-mlsirm`, `ContextualWisdomLab/semantic-data-portal`, `ContextualWisdomLab/noema`, `ContextualWisdomLab/wardnet`, `ContextualWisdomLab/feelanet-adfs`, `ContextualWisdomLab/gyeot`, `ContextualWisdomLab/pg-llm-batch`, `ContextualWisdomLab/keyverse`, `ContextualWisdomLab/inkspan`, `ContextualWisdomLab/disksage`, `ContextualWisdomLab/free-router`, `ContextualWisdomLab/RankWeave`, `ContextualWisdomLab/ThreadWeave`, `ContextualWisdomLab/EgressWeave`, `ContextualWisdomLab/IRT-bibliography-set`, `ContextualWisdomLab/g7`, `ContextualWisdomLab/saju-caldav`, `ContextualWisdomLab/xtrm-lead-pi-outbound`, `ContextualWisdomLab/ccube-jco-potential-customer`, `ContextualWisdomLab/9drive`, `ContextualWisdomLab/macos_utility_packs`, `ContextualWisdomLab/OmniRoute`, `ContextualWisdomLab/graphify`, `ContextualWisdomLab/life-os`, `ContextualWisdomLab/four-pillars`, `ContextualWisdomLab/DiagramWeave`, `ContextualWisdomLab/trivy-sarif-repro`, `ContextualWisdomLab/TEPP`, `ContextualWisdomLab/OriginWeave`, `ContextualWisdomLab/EmbedRelay`, `ContextualWisdomLab/mhtml-etl-gateway`, `ContextualWisdomLab/psychometrics-commons`, `ContextualWisdomLab/LineageWeave`, `ContextualWisdomLab/Orgmetra`, `ContextualWisdomLab/enterprise-architecture-core`, `ContextualWisdomLab/context-graph-contracts`, `ContextualWisdomLab/metering-billing-platform`, `ContextualWisdomLab/accounting-information-platform`, `ContextualWisdomLab/quarantine-sandbox-runtime`, `ContextualWisdomLab/governance-risk-compliance`, `ContextualWisdomLab/CalendarWeave`, `ContextualWisdomLab/j-planner`, `ContextualWisdomLab/learning-interoperability-contracts`, `ContextualWisdomLab/learning-record-store`, `ContextualWisdomLab/learning-management-platform`, `ContextualWisdomLab/learning-content-studio`, `ContextualWisdomLab/ELUNVERA`, `ContextualWisdomLab/PolicyWeave`, `ContextualWisdomLab/litellm-patched-proxy`, `ContextualWisdomLab/pingora-gateway`, `ContextualWisdomLab/ConceptWeave`, and `ContextualWisdomLab/supply-chain-control-plane`. Volatile queue counts are dated evidence, not product truth. Every branch advance invalidates predecessor checks and approvals, and every later census must preserve non-simultaneous movement rather than manufacture a false simultaneous total. @@ -18,7 +18,7 @@ Volatile queue counts are dated evidence, not product truth. Every branch advanc A source-integrity defect was verified on predecessor #1116 head `f6207ef2cadadb5d3852e0595ab2f0b62e20a06b`. That census-only commit unintentionally removed 83 lines from `docs/product-technical-gap-baseline.md` and left the canonical product/technical contract ending immediately after §7.4. The deleted material included the identifier-policy migration boundary, Rust compute ownership, real-audio scientific acceptance, security/privacy, UI/UX evidence, quality/operability, release-gate, and traceability sections. -The parent `adbd9df394957ee1a2c68893b8a6025cdcf058c9` was inspected as recovery evidence before editing. The canonical branch then advanced through ordinary non-force history to `ec67371791c653eed21705600775c06ecd531cc7`, restoring the lost contract. At the start of this capture #1116 was independently re-fetched at `docs/gap-baseline-2026-08-31@39232f8bfecc2e0ea950cca597fd89354cee710a`, base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`; the canonical baseline blob at that audited pre-write head was `cd4729d5580286783c9604e8e36bbd91bab610f2`. A document cannot truthfully self-embed the SHA of the commit that contains that self-reference, so successor head identity is always fetched from GitHub immediately after each write rather than inferred from prose. +The parent `adbd9df394957ee1a2c68893b8a6025cdcf058c9` was inspected as recovery evidence before editing. The canonical branch then advanced through ordinary non-force history to `ec67371791c653eed21705600775c06ecd531cc7`, restoring the lost contract. At this run's census pre-write capture #1116 was independently re-fetched at `docs/gap-baseline-2026-08-31@9e88ba2cf4dc0fdaf64f80b1f540c37bb4d9ce49`, base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`; the baseline refresh then advanced the branch by ordinary non-force history. A document cannot truthfully self-embed the SHA of the commit that contains that self-reference, so successor head identity is always fetched from GitHub immediately after each write rather than inferred from prose. The restored baseline carries the buyer PRD, end-to-end stories, DDD bounded contexts/context map/ubiquitous language/domain events, TRD topology and transport diagrams, persistence/versioning rules, organization naming and database migration rules, Rust-first compute ownership, persistence ERD discipline, rights-safe real-audio scientific acceptance, security/privacy, Storybook/Figma/shipped accessibility evidence, the 100% quality floor, release acceptance, and APA traceability. @@ -52,13 +52,15 @@ The protected `.bscope` documentation currently describes structural schema vali ## Queue and causal-owner evidence -Issue #966 remains the dependency-aware merge-train control plane, while PR #968 retains unique executable queue machinery: bounded pagination, exact active-head capture, independently resolved target tips, deterministic ordering, malformed/incomplete/duplicate rejection, network-independent validation, and symlink-safe atomic publication. Fresh metadata now shows #968 as `docs/bandscope-product-readiness-baseline@ab89d16a9fbd6f47ca4747147f60d130a1ed8588` with base branch `docs/gap-baseline-2026-08-31` and base SHA `39232f8bfecc2e0ea950cca597fd89354cee710a`. Its PR-body prose still contains older stack SHAs and is navigation-only until corrected; checks/reviews from those predecessor identities do not transfer. +Issue #966 remains the dependency-aware merge-train control plane, while PR #968 retains unique executable queue machinery: bounded pagination, exact active-head capture, independently resolved target tips, deterministic ordering, malformed/incomplete/duplicate rejection, network-independent validation, and symlink-safe atomic publication. At the census pre-write capture #968 was `docs/bandscope-product-readiness-baseline@a1ccf9348343a835c640d0b7e830d9c10b0c0482` with base branch `docs/gap-baseline-2026-08-31` and base SHA `9e88ba2cf4dc0fdaf64f80b1f540c37bb4d9ce49`. That queue head was an ordinary non-force two-parent restack preserving its unique queue tree while taking the then-current baseline/doctoring blobs. Because #1116 has now advanced again, that base-tip receipt is predecessor evidence and #968 must reconcile to the new baseline before its checks/reviews can qualify. -The baseline owner #1116 and temporal-analysis PR #1117 are separate evidence lanes. The audited pre-write #1116 source identity was `docs/gap-baseline-2026-08-31@39232f8bfecc2e0ea950cca597fd89354cee710a`, base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`, document blob `cd4729d5580286783c9604e8e36bbd91bab610f2`. PR #1117 is `refactor/temporal-features-api@b98f266d2356d56be624fb617580b5252e85baaa`, also based on `develop@749511c3ad4000090048718f685c6bee6b3d2c25`; its visible review threads are independently resolved and do not constitute #1116 review evidence. +The baseline owner #1116 and temporal-analysis PR #1117 are separate evidence lanes. The audited census pre-write #1116 source identity was `docs/gap-baseline-2026-08-31@9e88ba2cf4dc0fdaf64f80b1f540c37bb4d9ce49`, base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`; this run then advanced it through ordinary non-force documentation commits. PR #1117 remains a separate temporal-analysis lane; its review evidence does not constitute #1116 review evidence. -The latest protected central control-plane evidence recorded by the baseline is `ContextualWisdomLab/.github@669505bdf267d92989298857c740a59807bbd735`. Issue `.github#712` remains the organization-wide runner-admission/queue-health owner. Earlier protected `.github#1658`, `.github#1656`, `.github#1665`, and `.github#1645` reduce avoidable queue/review pressure and review-routing ambiguity but do not turn a queued exact-head job into terminal success. Repository-local Trivy PR-head configuration remains owned by open BandScope #1119 until normally integrated or superseded. +Repository-local Trivy PR-head configuration remains owned by open BandScope #1119. Its fresh current head was re-fetched as `fix/trivy-pr-code-scanning@bb3a9735a00a64347e8a5d0e3f2d92243bdbc585`. Current source preserves semantic multiword organization-owned checker identifiers while retaining GitHub/YAML vendor keys at the external boundary. Two previously unresolved current-head Devin comments were re-read as informational/fail-closed design notes rather than actionable source defects and were resolved only after source verification. Fresh #1119 checks remain exact-head evidence; queued/non-terminal jobs are non-passing and were not spam-rerun. -The connected repository write surface permits ordinary source/workflow/PR changes but does not expose organization runner-pool, Actions quota/billing, or equivalent admission-setting mutation. A fresh attempt to read the protected `develop` branch-protection endpoint in this run returned GitHub **403 `Resource not accessible by integration`**; therefore the previously recorded 16-context inventory is not promoted as newly revalidated branch-protection truth in this capture. Unchanged-head reruns and runner-label churn are not substitutes for causal evidence. +The latest protected central control-plane evidence recorded by the baseline is `ContextualWisdomLab/.github@669505bdf267d92989298857c740a59807bbd735`. Issue `.github#712` remains the organization-wide runner-admission/queue-health owner. Earlier protected `.github#1658`, `.github#1656`, `.github#1665`, and `.github#1645` reduce avoidable queue/review pressure and review-routing ambiguity but do not turn a queued exact-head job into terminal success. + +The connected repository write surface permits ordinary source/workflow/PR changes but does not expose organization runner-pool, Actions quota/billing, or equivalent admission-setting mutation. A fresh attempt to read the protected `develop` branch-protection endpoint in this run returned GitHub **403 `Resource not accessible by integration`**; therefore the previously recorded 16-context inventory is not promoted as newly revalidated branch-protection truth in this capture. Unchanged-head reruns and runner-label churn are not substitutes for causal evidence. Fresh #1009 workflow evidence also showed that hosted admission is delayed rather than uniformly dead: one exact-head npm gate eventually reached a GitHub-hosted runner and completed successfully while sibling jobs remained queued. That distinction prevents a blanket infrastructure diagnosis from replacing per-job RCA. Canonical product ownership remains explicit: #961 owns active rehearsal player/transport, #962 owns crash-safe project persistence, **#963 owns diagnostics/support bundles**, and #960 owns trusted release/distribution. These scopes are distinct even when one leaf PR exercises more than one acceptance gate. @@ -68,7 +70,7 @@ This documentation change introduces no new runtime authority. The durable secur ## Historical observations and RCA -Historical queue observations remain useful only as dated evidence. On 2026-09-01 10:31 KST BandScope had 190 open pull requests. At 2026-09-01 13:29 KST, 72 repositories were visible and an organization recount reported 2,697 open pull requests, with BandScope at 188. Later 2026-09-02 sweeps observed 2,827/2,834 and 185 BandScope, 2,856/2,855 and 194 BandScope, then 2,865/2,866 and 196 BandScope before the current 2,889/2,889 and 196 BandScope capture. None may be reused as an undated permanent count. +Historical queue observations remain useful only as dated evidence. On 2026-09-01 10:31 KST BandScope had 190 open pull requests. At 2026-09-01 13:29 KST, 72 repositories were visible and an organization recount reported 2,697 open pull requests, with BandScope at 188. Later 2026-09-02 sweeps observed 2,827/2,834 and 185 BandScope, 2,856/2,855 and 194 BandScope, then 2,865/2,866 and 196 BandScope, then 2,889/2,889 and 196 BandScope before the current **2,894/2,894 and 196 BandScope** capture. None may be reused as an undated permanent count. Review findings previously validated on #1116 included stale PR evidence, a false repository-wide Mermaid-absence claim, stale product-owner issue numbers, and prose-inherited live Noema/PR claims. The replacement baseline separates protected-source facts from timestamped GitHub observations and uses exact current-head examples instead of assigning one cause to the whole queue. From 2b6366afbf62562602991877ac360f8d2d0c464f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 16:47:33 +0900 Subject: [PATCH 44/80] docs(baseline): refresh organization PR census --- docs/product-technical-gap-baseline.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 084e4bab3..406d5264f 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -44,9 +44,9 @@ The near-term product order remains: merge-train convergence; trusted distributi ## 2. Live delivery authority -A fresh accessible-repository sweep begun at **2026-09-02 15:59 KST** queried all **74** repositories currently visible under `ContextualWisdomLab` individually. The sequential per-repository counts summed to **2,894 open pull requests**. An organization-wide aggregate captured immediately after that sweep also returned **2,894 open pull requests** with `incomplete_results=false`. Equality between these non-atomic captures is evidence for this capture only; concurrent creations and closures can still occur while a sequential census is running. +A fresh accessible-repository sweep begun at **2026-09-02 16:32 KST** queried all **74** repositories currently visible under `ContextualWisdomLab` individually. The sequential per-repository counts summed to **2,894 open pull requests**. An organization-wide aggregate captured immediately after that sweep also returned **2,894 open pull requests** with `incomplete_results=false`. Equality between these non-atomic captures is evidence for this capture only; concurrent creations and closures can still occur while a sequential census is running. -At this census `ContextualWisdomLab/bandscope` had **196 open pull requests** and remains the selected delivery boundary. Fresh high-backlog peers were `ContextualWisdomLab/naruon` (145), `ContextualWisdomLab/OriginWeave` (142), `ContextualWisdomLab/newsdom-api` (137), `ContextualWisdomLab/pg-erd-cloud` (136), `ContextualWisdomLab/TEPP` (128), `ContextualWisdomLab/html4tree` (127), `ContextualWisdomLab/.github` (118), and `ContextualWisdomLab/Orgmetra` (117). BandScope is selected not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. +At this census `ContextualWisdomLab/bandscope` had **193 open pull requests** and remains the selected delivery boundary. Fresh high-backlog peers were `ContextualWisdomLab/naruon` (145), `ContextualWisdomLab/OriginWeave` (142), `ContextualWisdomLab/newsdom-api` (137), `ContextualWisdomLab/pg-erd-cloud` (136), `ContextualWisdomLab/TEPP` (128), `ContextualWisdomLab/html4tree` (127), `ContextualWisdomLab/.github` (119), and `ContextualWisdomLab/Orgmetra` (117). BandScope is selected not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. The exact 74-repository set for this same capture is enumerated verbatim in `docs/doctoring/product-gap-baseline-2026-09-01.md`; capitalization there is the GitHub repository identity and is not normalized. Because PR creation and closure can occur during a sequential organization census, later counts are historical observations unless a new complete sweep is performed. @@ -348,4 +348,4 @@ Primary normative/research anchors for this baseline include: - Music Information Retrieval Evaluation eXchange. (n.d.). *MIREX*. https://www.music-ir.org/mirex/ - Raffel, C., McFee, B., Humphrey, E. J., Salamon, J., Nieto, O., Liang, D., Ellis, D. P. W., & Raffel, C. C. (2014). mir_eval: A transparent implementation of common MIR metrics. *Proceedings of the 15th International Society for Music Information Retrieval Conference*, 367–372. -Repository ADRs, PRD/TRD, architecture/context-map documents, security/threat-model material, test strategy, operability/recovery guidance, UI/Storybook inventory and doctoring traceability must remain code-current. Active PRs, planned work and research results are never promoted into the shipped section before protected integration. \ No newline at end of file +Repository ADRs, PRD/TRD, architecture/context-map documents, security/threat-model material, test strategy, operability/recovery guidance, UI/Storybook inventory and doctoring traceability must remain code-current. Active PRs, planned work and research results are never promoted into the shipped section before protected integration. From b947afd05fd4fa1e1e0489cdccab34f9cef714b4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 16:48:58 +0900 Subject: [PATCH 45/80] docs(doctoring): refresh live backlog census --- docs/doctoring/product-gap-baseline-2026-09-01.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/doctoring/product-gap-baseline-2026-09-01.md b/docs/doctoring/product-gap-baseline-2026-09-01.md index 4ad9843ee..92e5bddb5 100644 --- a/docs/doctoring/product-gap-baseline-2026-09-01.md +++ b/docs/doctoring/product-gap-baseline-2026-09-01.md @@ -6,9 +6,9 @@ This note records why `docs/product-technical-gap-baseline.md` is maintained on ## Current live-state correction — 2026-09-02 -Protected BandScope source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep begun at **2026-09-02 15:59 KST** queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,894 open pull requests**. An organization-wide aggregate captured immediately after the sweep also returned **2,894 open pull requests** with `incomplete_results=false`. Equality between the sequential sum and later aggregate is capture-time evidence only; concurrent PR creation/closure can still occur during a non-atomic census. +Protected BandScope source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep begun at **2026-09-02 16:32 KST** queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,894 open pull requests**. An organization-wide aggregate captured immediately after the sweep also returned **2,894 open pull requests** with `incomplete_results=false`. Equality between the sequential sum and later aggregate is capture-time evidence only; concurrent PR creation/closure can still occur during a non-atomic census. -`ContextualWisdomLab/bandscope` was the highest observed backlog at **196 open pull requests**. Fresh high-backlog peers were `ContextualWisdomLab/naruon` 145, `ContextualWisdomLab/OriginWeave` 142, `ContextualWisdomLab/newsdom-api` 137, `ContextualWisdomLab/pg-erd-cloud` 136, `ContextualWisdomLab/TEPP` 128, `ContextualWisdomLab/html4tree` 127, `ContextualWisdomLab/.github` 118, and `ContextualWisdomLab/Orgmetra` 117. BandScope remains selected by both backlog and product responsibility: it owns the buyer-facing local-first rehearsal/audio path plus high-leverage release, security, persistence, workflow, and shared-contract boundaries. +`ContextualWisdomLab/bandscope` was the highest observed backlog at **193 open pull requests**. Fresh high-backlog peers were `ContextualWisdomLab/naruon` 145, `ContextualWisdomLab/OriginWeave` 142, `ContextualWisdomLab/newsdom-api` 137, `ContextualWisdomLab/pg-erd-cloud` 136, `ContextualWisdomLab/TEPP` 128, `ContextualWisdomLab/html4tree` 127, `ContextualWisdomLab/.github` 119, and `ContextualWisdomLab/Orgmetra` 117. BandScope remains selected by both backlog and product responsibility: it owns the buyer-facing local-first rehearsal/audio path plus high-leverage release, security, persistence, workflow, and shared-contract boundaries. The accessible repository set for this capture was: `ContextualWisdomLab/kaefa`, `ContextualWisdomLab/aFIPC`, `ContextualWisdomLab/nonnest2`, `ContextualWisdomLab/html4tree`, `ContextualWisdomLab/mightyETL`, `ContextualWisdomLab/xtrmLLMBatchPython`, `ContextualWisdomLab/pg-erd-cloud`, `ContextualWisdomLab/clearfolio`, `ContextualWisdomLab/bandscope`, `ContextualWisdomLab/newsdom-api`, `ContextualWisdomLab/scopeweave`, `ContextualWisdomLab/naruon`, `ContextualWisdomLab/linux-cluster-ops`, `ContextualWisdomLab/argos`, `ContextualWisdomLab/codec-carver`, `ContextualWisdomLab/appguardrail`, `ContextualWisdomLab/vooster`, `ContextualWisdomLab/.github`, `ContextualWisdomLab/ContextualWisdomLab.github.io`, `ContextualWisdomLab/seedream_evasepic`, `ContextualWisdomLab/contextual-orchestrator`, `ContextualWisdomLab/hyosung-itx-slogan-brief`, `ContextualWisdomLab/fast-mlsirm`, `ContextualWisdomLab/semantic-data-portal`, `ContextualWisdomLab/noema`, `ContextualWisdomLab/wardnet`, `ContextualWisdomLab/feelanet-adfs`, `ContextualWisdomLab/gyeot`, `ContextualWisdomLab/pg-llm-batch`, `ContextualWisdomLab/keyverse`, `ContextualWisdomLab/inkspan`, `ContextualWisdomLab/disksage`, `ContextualWisdomLab/free-router`, `ContextualWisdomLab/RankWeave`, `ContextualWisdomLab/ThreadWeave`, `ContextualWisdomLab/EgressWeave`, `ContextualWisdomLab/IRT-bibliography-set`, `ContextualWisdomLab/g7`, `ContextualWisdomLab/saju-caldav`, `ContextualWisdomLab/xtrm-lead-pi-outbound`, `ContextualWisdomLab/ccube-jco-potential-customer`, `ContextualWisdomLab/9drive`, `ContextualWisdomLab/macos_utility_packs`, `ContextualWisdomLab/OmniRoute`, `ContextualWisdomLab/graphify`, `ContextualWisdomLab/life-os`, `ContextualWisdomLab/four-pillars`, `ContextualWisdomLab/DiagramWeave`, `ContextualWisdomLab/trivy-sarif-repro`, `ContextualWisdomLab/TEPP`, `ContextualWisdomLab/OriginWeave`, `ContextualWisdomLab/EmbedRelay`, `ContextualWisdomLab/mhtml-etl-gateway`, `ContextualWisdomLab/psychometrics-commons`, `ContextualWisdomLab/LineageWeave`, `ContextualWisdomLab/Orgmetra`, `ContextualWisdomLab/enterprise-architecture-core`, `ContextualWisdomLab/context-graph-contracts`, `ContextualWisdomLab/metering-billing-platform`, `ContextualWisdomLab/accounting-information-platform`, `ContextualWisdomLab/quarantine-sandbox-runtime`, `ContextualWisdomLab/governance-risk-compliance`, `ContextualWisdomLab/CalendarWeave`, `ContextualWisdomLab/j-planner`, `ContextualWisdomLab/learning-interoperability-contracts`, `ContextualWisdomLab/learning-record-store`, `ContextualWisdomLab/learning-management-platform`, `ContextualWisdomLab/learning-content-studio`, `ContextualWisdomLab/ELUNVERA`, `ContextualWisdomLab/PolicyWeave`, `ContextualWisdomLab/litellm-patched-proxy`, `ContextualWisdomLab/pingora-gateway`, `ContextualWisdomLab/ConceptWeave`, and `ContextualWisdomLab/supply-chain-control-plane`. @@ -70,7 +70,7 @@ This documentation change introduces no new runtime authority. The durable secur ## Historical observations and RCA -Historical queue observations remain useful only as dated evidence. On 2026-09-01 10:31 KST BandScope had 190 open pull requests. At 2026-09-01 13:29 KST, 72 repositories were visible and an organization recount reported 2,697 open pull requests, with BandScope at 188. Later 2026-09-02 sweeps observed 2,827/2,834 and 185 BandScope, 2,856/2,855 and 194 BandScope, then 2,865/2,866 and 196 BandScope, then 2,889/2,889 and 196 BandScope before the current **2,894/2,894 and 196 BandScope** capture. None may be reused as an undated permanent count. +Historical queue observations remain useful only as dated evidence. On 2026-09-01 10:31 KST BandScope had 190 open pull requests. At 2026-09-01 13:29 KST, 72 repositories were visible and an organization recount reported 2,697 open pull requests, with BandScope at 188. Later 2026-09-02 sweeps observed 2,827/2,834 and 185 BandScope, 2,856/2,855 and 194 BandScope, then 2,865/2,866 and 196 BandScope, then 2,889/2,889 and 196 BandScope, then 2,894/2,894 and 196 BandScope before the current **2,894/2,894 and 193 BandScope** capture. None may be reused as an undated permanent count. Review findings previously validated on #1116 included stale PR evidence, a false repository-wide Mermaid-absence claim, stale product-owner issue numbers, and prose-inherited live Noema/PR claims. The replacement baseline separates protected-source facts from timestamped GitHub observations and uses exact current-head examples instead of assigning one cause to the whole queue. @@ -101,4 +101,4 @@ World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines (WCAG) PR #1116 remains the canonical baseline owner. Its source contains the complete recovered PRD/TRD/DDD/naming/Rust/science/security/UI/quality/release/traceability contract plus current delivery evidence. PR #1025 is an older competing owner of the same path; it may only be closed as superseded when every unique semantic requirement remains executable or represented in the canonical source and its discussion history is preserved. -Future loops should refresh live counts and exact-head evidence when they materially change prioritization or causal ownership. They must not rewrite stable product/architecture sections merely to chase a volatile PR number, and they must never repeat the predecessor truncation failure by replacing a complete canonical document with a partial census fragment. \ No newline at end of file +Future loops should refresh live counts and exact-head evidence when they materially change prioritization or causal ownership. They must not rewrite stable product/architecture sections merely to chase a volatile PR number, and they must never repeat the predecessor truncation failure by replacing a complete canonical document with a partial census fragment. From cafb0907e5cdf1c9ed479a6bd50a8d80fde38ca0 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 17:47:59 +0900 Subject: [PATCH 46/80] docs(gap): refresh fleet evidence and recovery contract --- docs/product-technical-gap-baseline.md | 34 +++++++++++++++++++------- 1 file changed, 25 insertions(+), 9 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 406d5264f..beb934490 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -6,7 +6,9 @@ Protected product truth: `develop@749511c3ad4000090048718f685c6bee6b3d2c25` ## Purpose -This document is the canonical product/technical gap baseline for BandScope. It separates protected shipped truth from active pull-request work, research/acceptance work, superseded work, and external control-plane dependencies. A PR body, predecessor check, model review, screenshot, remembered SHA, or generated routing manifest is never shipped truth. +This document is the canonical live product/technical gap synthesis for BandScope. It is governed by `AGENTS.md`, `ARCHITECTURE.md`, the security/repository/engineering sources they reference, and `docs/brand-story.md`; if this synthesis conflicts with those owning sources, the owning source wins and this baseline must be repaired. Mechanical enforcement remains in the repository's tests, root verification scripts, workflows, and protected-branch rules rather than in prose alone. + +It separates protected shipped truth from active pull-request work, research/acceptance work, superseded work, and external control-plane dependencies. A PR body, predecessor check, model review, screenshot, remembered SHA, or generated routing manifest is never shipped truth. BandScope is a local-first rehearsal decision product. The commercial loop is complete only when a musician can admit a real local recording, obtain evidence-backed rehearsal guidance, rehearse a precise passage, save and recover the project, share a bounded handoff, diagnose failures without leaking private media, and install, update, repair, or roll back a verifiable signed build. @@ -44,15 +46,15 @@ The near-term product order remains: merge-train convergence; trusted distributi ## 2. Live delivery authority -A fresh accessible-repository sweep begun at **2026-09-02 16:32 KST** queried all **74** repositories currently visible under `ContextualWisdomLab` individually. The sequential per-repository counts summed to **2,894 open pull requests**. An organization-wide aggregate captured immediately after that sweep also returned **2,894 open pull requests** with `incomplete_results=false`. Equality between these non-atomic captures is evidence for this capture only; concurrent creations and closures can still occur while a sequential census is running. +A fresh accessible-repository sweep begun at **2026-09-02 17:33 KST** queried all **74** repositories currently visible under `ContextualWisdomLab` individually. The sequential per-repository counts summed to **2,907 open pull requests**. An organization-wide aggregate captured immediately after that sweep returned **2,908 open pull requests** with `incomplete_results=false`. The one-PR difference proves only non-simultaneous queue movement during the census; it is not attributed to a particular repository without a separate exact observation. -At this census `ContextualWisdomLab/bandscope` had **193 open pull requests** and remains the selected delivery boundary. Fresh high-backlog peers were `ContextualWisdomLab/naruon` (145), `ContextualWisdomLab/OriginWeave` (142), `ContextualWisdomLab/newsdom-api` (137), `ContextualWisdomLab/pg-erd-cloud` (136), `ContextualWisdomLab/TEPP` (128), `ContextualWisdomLab/html4tree` (127), `ContextualWisdomLab/.github` (119), and `ContextualWisdomLab/Orgmetra` (117). BandScope is selected not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. +At this census `ContextualWisdomLab/bandscope` had **193 open pull requests** and **19 open issues**, and remains the selected delivery boundary. Fresh high-backlog peers were `ContextualWisdomLab/naruon` (146), `ContextualWisdomLab/OriginWeave` (142), `ContextualWisdomLab/newsdom-api` (137), `ContextualWisdomLab/pg-erd-cloud` (136), `ContextualWisdomLab/TEPP` (130), `ContextualWisdomLab/html4tree` (127), `ContextualWisdomLab/.github` (121), `ContextualWisdomLab/Orgmetra` (117), and `ContextualWisdomLab/LineageWeave` (112). BandScope is selected not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. The exact 74-repository set for this same capture is enumerated verbatim in `docs/doctoring/product-gap-baseline-2026-09-01.md`; capitalization there is the GitHub repository identity and is not normalized. Because PR creation and closure can occur during a sequential organization census, later counts are historical observations unless a new complete sweep is performed. Protected `develop` was previously recorded with these 16 required contexts: `ci / build-and-test`, `dependency-review`, `security-audit`, `sbom`, `release-preflight`, `gate / build / windows`, `gate / build / macos`, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, `Analyze (javascript-typescript)`, and `Analyze (python)`. A fresh branch-protection read in this run returned GitHub 403 `Resource not accessible by integration`, so this inventory is not represented as newly revalidated protection truth; merge decisions must refetch through an authorized surface. -Operational evidence rule: queued, pending, skipped-required, cancelled, neutral, failed, absent, stale, predecessor-head, protected-base, model-only, status-only, self/author, or administrative-bypass evidence is non-passing. A head change invalidates predecessor review/check receipts. Force-push, destructive rebase, self-approval, gate weakening, fabricated evidence, and unrelated rollback are prohibited. +Operational evidence rule: queued, pending, skipped-required, cancelled, neutral, failed, absent, stale, predecessor-head, protected-base, model-only, status-only, self/author, or administrative-bypass evidence is non-passing. A head change prevents predecessor review/check receipts from transferring to the successor head; the original historical evidence remains preserved. Force-push, destructive rebase, self-approval, gate weakening, fabricated evidence, and unrelated rollback are prohibited. Merge readiness is re-evaluated per unchanged exact PR head; an organization-wide approval search is not a substitute for per-head proof. @@ -95,7 +97,7 @@ Backlog convergence is the primary engineering risk because micro-PR fan-out cre PR #968 owns the unique executable queue machinery needed by #966: bounded GitHub pagination, exact active-head capture, independent base-tip resolution, deterministic ordering, malformed/incomplete/duplicate rejection, reviewed dependency/succession metadata, network-independent validation, deterministic human projection/parity, and symlink-safe atomic publication. It must not be discarded as stale documentation. -Current identities are deliberately separated rather than conflated. At this pre-write audit, canonical baseline PR #1116 was `docs/gap-baseline-2026-08-31@9e88ba2cf4dc0fdaf64f80b1f540c37bb4d9ce49`, base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. A fresh GitHub read of PR #968 reported queue head `docs/bandscope-product-readiness-baseline@a1ccf9348343a835c640d0b7e830d9c10b0c0482` and base SHA exactly `9e88ba2cf4dc0fdaf64f80b1f540c37bb4d9ce49` for base branch `docs/gap-baseline-2026-08-31`; that head is the ordinary non-force two-parent restack that preserved #968 queue machinery while taking the then-current #1116 baseline/doctoring blobs. Any later #1116 advance invalidates that base-tip receipt and requires #968 to reconcile again before predecessor checks/reviews can qualify. +Current identities are deliberately separated rather than conflated. At this pre-write audit, canonical baseline PR #1116 was `docs/gap-baseline-2026-08-31@b947afd05fd4fa1e1e0489cdccab34f9cef714b4`, base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. A fresh GitHub read of PR #968 reported queue head `docs/bandscope-product-readiness-baseline@45ef3da0e40980bb9b532dd754d14f9e309536bf` and base SHA exactly `b947afd05fd4fa1e1e0489cdccab34f9cef714b4` for base branch `docs/gap-baseline-2026-08-31`; that head is the ordinary non-force two-parent restack that preserved #968 queue machinery while taking the then-current #1116 baseline/doctoring blobs. This #1116 advance makes that base-tip receipt predecessor evidence; #968 must reconcile again before its checks/reviews can qualify. PR #1117 is a separate lane: `refactor/temporal-features-api@b98f266d2356d56be624fb617580b5252e85baaa`, base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. Its visible review threads are independently resolved; that review evidence belongs to #1117 and never substitutes for #1116 or #968 evidence. #1117 does not own `docs/product-technical-gap-baseline.md`, so no canonical baseline document blob is attributed to its exact ref. @@ -105,6 +107,8 @@ Draft status is used only for a real unverified or blocked boundary and is never ## 6. Domain model and ownership +For a musician, these boundaries serve one simple flow: pick a song, understand what matters tonight, rehearse it, save it safely, and share only what was intended. The technical split below exists so those actions do not fight over authority or expose private media. + BandScope keeps these bounded contexts distinct: 1. **Audio Ingestion** — user-selected source authority and intake intent. @@ -179,6 +183,8 @@ The diagram is logical responsibility, not a claim that each box is a separate p ## 7. Technical design contract (TRD) +The technical design has one rehearsal-facing goal: every click should keep the musician on the same trusted song and project while the app does the complicated validation and analysis out of sight. + ### 7.1 Production topology and ports Protected `develop` is a local desktop architecture with these principal implementation surfaces: @@ -217,12 +223,17 @@ sequenceDiagram If decode, analysis, persistence, or playback fails, the error remains typed and bounded; a synthetic analysis object is not substituted as production success. -### 7.3 Transport and project state ownership +### 7.3 Transport, source replacement, and project state ownership ```mermaid stateDiagram-v2 [*] --> NoSource - NoSource --> Ready: authorized source admitted + NoSource --> SourceSelecting: choose source + NoSource --> Recovering: project recovery requested + SourceSelecting --> Ready: source admitted + SourceSelecting --> NoSource: cancelled/failed with no prior source + Ready --> SourceSelecting: replace source + Ready --> Ready: cancelled/failed replacement keeps prior source Ready --> Playing: play Playing --> Paused: pause Paused --> Playing: resume @@ -235,12 +246,17 @@ stateDiagram-v2 Paused --> Ready: stop Looping --> Ready: stop LoopPaused --> Ready: stop + Playing --> SourceSelecting: replace source requested / stop transport + Paused --> SourceSelecting: replace source requested + Looping --> SourceSelecting: replace source requested / stop transport + LoopPaused --> SourceSelecting: replace source requested + Ready --> NoSource: clear source Ready --> Recovering: project recovery requested Recovering --> Ready: last-known-good restored Recovering --> RecoveryFailed: no valid recoverable snapshot ``` -The production player owns one transport state machine. Loop activation never removes pause or stop authority: active-loop playback may pause with the loop retained, resume into that loop, clear the loop into ordinary playback/paused state, or stop directly. UI components, cue cards, map cursors, and persisted project data project from that authority; they do not each own independent writable transport state. Project publication is atomic and crash-safe rather than implied by the diagram's UI state. +The production player owns one transport state machine. Loop activation never removes pause or stop authority: active-loop playback may pause with the loop retained, resume into that loop, clear the loop into ordinary playback/paused state, or stop directly. Source replacement is transactional: a pending replacement must not erase the prior admitted source; conflicting source/import/analysis actions remain unavailable until selection resolves, and a cancelled or failed replacement returns to the prior source authority. UI components, cue cards, map cursors, and persisted project data project from the owning authority rather than creating competing writable state. Project publication **must become** atomic and crash-safe; that is a target persistence contract, not a shipped guarantee, and this state diagram does not prove it. ### 7.4 Persistence and contract versioning @@ -348,4 +364,4 @@ Primary normative/research anchors for this baseline include: - Music Information Retrieval Evaluation eXchange. (n.d.). *MIREX*. https://www.music-ir.org/mirex/ - Raffel, C., McFee, B., Humphrey, E. J., Salamon, J., Nieto, O., Liang, D., Ellis, D. P. W., & Raffel, C. C. (2014). mir_eval: A transparent implementation of common MIR metrics. *Proceedings of the 15th International Society for Music Information Retrieval Conference*, 367–372. -Repository ADRs, PRD/TRD, architecture/context-map documents, security/threat-model material, test strategy, operability/recovery guidance, UI/Storybook inventory and doctoring traceability must remain code-current. Active PRs, planned work and research results are never promoted into the shipped section before protected integration. +Repository ADRs, PRD/TRD, architecture/context-map documents, security/threat-model material, test strategy, operability/recovery guidance, UI/Storybook inventory and doctoring traceability must remain code-current. Active PRs, planned work and research results are never promoted into the shipped section before protected integration. \ No newline at end of file From 4a8579bfa90caa0e254ffdec14359261e42295cd Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 17:49:46 +0900 Subject: [PATCH 47/80] docs(doctoring): reconcile live census and evidence transfer --- .../product-gap-baseline-2026-09-01.md | 30 ++++++++++--------- 1 file changed, 16 insertions(+), 14 deletions(-) diff --git a/docs/doctoring/product-gap-baseline-2026-09-01.md b/docs/doctoring/product-gap-baseline-2026-09-01.md index 92e5bddb5..102753309 100644 --- a/docs/doctoring/product-gap-baseline-2026-09-01.md +++ b/docs/doctoring/product-gap-baseline-2026-09-01.md @@ -2,25 +2,25 @@ ## Purpose -This note records why `docs/product-technical-gap-baseline.md` is maintained on canonical PR #1116 instead of layering stale queue snapshots over product truth. It preserves exact-head corrections, causal repairs, naming-contract evidence, and research traceability without rewriting historical observations as current facts. +This note records why `docs/product-technical-gap-baseline.md` is maintained on canonical PR #1116 instead of layering stale queue snapshots over product truth. It preserves exact-head corrections, causal repairs, naming-contract evidence, and research traceability without rewriting historical observations as current facts. The baseline is a live synthesis governed by `AGENTS.md`, `ARCHITECTURE.md`, the owning security/repository/engineering guidance, and `docs/brand-story.md`; prose does not replace executable repository gates. ## Current live-state correction — 2026-09-02 -Protected BandScope source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep begun at **2026-09-02 16:32 KST** queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,894 open pull requests**. An organization-wide aggregate captured immediately after the sweep also returned **2,894 open pull requests** with `incomplete_results=false`. Equality between the sequential sum and later aggregate is capture-time evidence only; concurrent PR creation/closure can still occur during a non-atomic census. +Protected BandScope source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep begun at **2026-09-02 17:33 KST** queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,907 open pull requests**. An organization-wide aggregate captured immediately after the sweep returned **2,908 open pull requests** with `incomplete_results=false`. The one-PR difference establishes only non-simultaneous queue movement during the census and is not attributed to a particular repository without a separate exact observation. -`ContextualWisdomLab/bandscope` was the highest observed backlog at **193 open pull requests**. Fresh high-backlog peers were `ContextualWisdomLab/naruon` 145, `ContextualWisdomLab/OriginWeave` 142, `ContextualWisdomLab/newsdom-api` 137, `ContextualWisdomLab/pg-erd-cloud` 136, `ContextualWisdomLab/TEPP` 128, `ContextualWisdomLab/html4tree` 127, `ContextualWisdomLab/.github` 119, and `ContextualWisdomLab/Orgmetra` 117. BandScope remains selected by both backlog and product responsibility: it owns the buyer-facing local-first rehearsal/audio path plus high-leverage release, security, persistence, workflow, and shared-contract boundaries. +`ContextualWisdomLab/bandscope` was the highest observed backlog at **193 open pull requests** and **19 open issues**. Fresh high-backlog peers were `ContextualWisdomLab/naruon` 146, `ContextualWisdomLab/OriginWeave` 142, `ContextualWisdomLab/newsdom-api` 137, `ContextualWisdomLab/pg-erd-cloud` 136, `ContextualWisdomLab/TEPP` 130, `ContextualWisdomLab/html4tree` 127, `ContextualWisdomLab/.github` 121, `ContextualWisdomLab/Orgmetra` 117, and `ContextualWisdomLab/LineageWeave` 112. BandScope remains selected by both backlog and product responsibility: it owns the buyer-facing local-first rehearsal/audio path plus high-leverage release, security, persistence, workflow, and shared-contract boundaries. The accessible repository set for this capture was: `ContextualWisdomLab/kaefa`, `ContextualWisdomLab/aFIPC`, `ContextualWisdomLab/nonnest2`, `ContextualWisdomLab/html4tree`, `ContextualWisdomLab/mightyETL`, `ContextualWisdomLab/xtrmLLMBatchPython`, `ContextualWisdomLab/pg-erd-cloud`, `ContextualWisdomLab/clearfolio`, `ContextualWisdomLab/bandscope`, `ContextualWisdomLab/newsdom-api`, `ContextualWisdomLab/scopeweave`, `ContextualWisdomLab/naruon`, `ContextualWisdomLab/linux-cluster-ops`, `ContextualWisdomLab/argos`, `ContextualWisdomLab/codec-carver`, `ContextualWisdomLab/appguardrail`, `ContextualWisdomLab/vooster`, `ContextualWisdomLab/.github`, `ContextualWisdomLab/ContextualWisdomLab.github.io`, `ContextualWisdomLab/seedream_evasepic`, `ContextualWisdomLab/contextual-orchestrator`, `ContextualWisdomLab/hyosung-itx-slogan-brief`, `ContextualWisdomLab/fast-mlsirm`, `ContextualWisdomLab/semantic-data-portal`, `ContextualWisdomLab/noema`, `ContextualWisdomLab/wardnet`, `ContextualWisdomLab/feelanet-adfs`, `ContextualWisdomLab/gyeot`, `ContextualWisdomLab/pg-llm-batch`, `ContextualWisdomLab/keyverse`, `ContextualWisdomLab/inkspan`, `ContextualWisdomLab/disksage`, `ContextualWisdomLab/free-router`, `ContextualWisdomLab/RankWeave`, `ContextualWisdomLab/ThreadWeave`, `ContextualWisdomLab/EgressWeave`, `ContextualWisdomLab/IRT-bibliography-set`, `ContextualWisdomLab/g7`, `ContextualWisdomLab/saju-caldav`, `ContextualWisdomLab/xtrm-lead-pi-outbound`, `ContextualWisdomLab/ccube-jco-potential-customer`, `ContextualWisdomLab/9drive`, `ContextualWisdomLab/macos_utility_packs`, `ContextualWisdomLab/OmniRoute`, `ContextualWisdomLab/graphify`, `ContextualWisdomLab/life-os`, `ContextualWisdomLab/four-pillars`, `ContextualWisdomLab/DiagramWeave`, `ContextualWisdomLab/trivy-sarif-repro`, `ContextualWisdomLab/TEPP`, `ContextualWisdomLab/OriginWeave`, `ContextualWisdomLab/EmbedRelay`, `ContextualWisdomLab/mhtml-etl-gateway`, `ContextualWisdomLab/psychometrics-commons`, `ContextualWisdomLab/LineageWeave`, `ContextualWisdomLab/Orgmetra`, `ContextualWisdomLab/enterprise-architecture-core`, `ContextualWisdomLab/context-graph-contracts`, `ContextualWisdomLab/metering-billing-platform`, `ContextualWisdomLab/accounting-information-platform`, `ContextualWisdomLab/quarantine-sandbox-runtime`, `ContextualWisdomLab/governance-risk-compliance`, `ContextualWisdomLab/CalendarWeave`, `ContextualWisdomLab/j-planner`, `ContextualWisdomLab/learning-interoperability-contracts`, `ContextualWisdomLab/learning-record-store`, `ContextualWisdomLab/learning-management-platform`, `ContextualWisdomLab/learning-content-studio`, `ContextualWisdomLab/ELUNVERA`, `ContextualWisdomLab/PolicyWeave`, `ContextualWisdomLab/litellm-patched-proxy`, `ContextualWisdomLab/pingora-gateway`, `ContextualWisdomLab/ConceptWeave`, and `ContextualWisdomLab/supply-chain-control-plane`. -Volatile queue counts are dated evidence, not product truth. Every branch advance invalidates predecessor checks and approvals, and every later census must preserve non-simultaneous movement rather than manufacture a false simultaneous total. +Volatile queue counts are dated evidence, not product truth. Every branch advance prevents predecessor checks and approvals from transferring to the successor head while preserving the original results as historical evidence, and every later census must preserve non-simultaneous movement rather than manufacture a false simultaneous total. ## Canonical baseline recovery A source-integrity defect was verified on predecessor #1116 head `f6207ef2cadadb5d3852e0595ab2f0b62e20a06b`. That census-only commit unintentionally removed 83 lines from `docs/product-technical-gap-baseline.md` and left the canonical product/technical contract ending immediately after §7.4. The deleted material included the identifier-policy migration boundary, Rust compute ownership, real-audio scientific acceptance, security/privacy, UI/UX evidence, quality/operability, release-gate, and traceability sections. -The parent `adbd9df394957ee1a2c68893b8a6025cdcf058c9` was inspected as recovery evidence before editing. The canonical branch then advanced through ordinary non-force history to `ec67371791c653eed21705600775c06ecd531cc7`, restoring the lost contract. At this run's census pre-write capture #1116 was independently re-fetched at `docs/gap-baseline-2026-08-31@9e88ba2cf4dc0fdaf64f80b1f540c37bb4d9ce49`, base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`; the baseline refresh then advanced the branch by ordinary non-force history. A document cannot truthfully self-embed the SHA of the commit that contains that self-reference, so successor head identity is always fetched from GitHub immediately after each write rather than inferred from prose. +The parent `adbd9df394957ee1a2c68893b8a6025cdcf058c9` was inspected as recovery evidence before editing. The canonical branch then advanced through ordinary non-force history to `ec67371791c653eed21705600775c06ecd531cc7`, restoring the lost contract. In the current 17:33 KST cycle, #1116 was re-fetched at `docs/gap-baseline-2026-08-31@b947afd05fd4fa1e1e0489cdccab34f9cef714b4`, base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`, before the baseline repair advanced it to `cafb0907e5cdf1c9ed479a6bd50a8d80fde38ca0`. A document cannot truthfully self-embed the SHA of the commit that contains that self-reference, so successor head identity is always fetched from GitHub immediately after each write rather than inferred from prose. -The restored baseline carries the buyer PRD, end-to-end stories, DDD bounded contexts/context map/ubiquitous language/domain events, TRD topology and transport diagrams, persistence/versioning rules, organization naming and database migration rules, Rust-first compute ownership, persistence ERD discipline, rights-safe real-audio scientific acceptance, security/privacy, Storybook/Figma/shipped accessibility evidence, the 100% quality floor, release acceptance, and APA traceability. +The restored baseline carries the buyer PRD, end-to-end stories, DDD bounded contexts/context map/ubiquitous language/domain events, TRD topology and transport diagrams, persistence/versioning rules, organization naming and database migration rules, Rust-first compute ownership, persistence ERD discipline, rights-safe real-audio scientific acceptance, security/privacy, Storybook/Figma/shipped accessibility evidence, the 100% quality floor, release acceptance, and APA traceability. The current repair also makes project recovery reachable before source admission, makes source replacement/clearing explicit, preserves the prior valid source across cancelled or failed replacement, and distinguishes the target atomic/crash-safe project contract from shipped behavior. ## Organization naming-contract evidence @@ -36,9 +36,9 @@ The organization-owned naming rule is semantic, not casing-based. Multiword name The focused RED commit `35dc521f03711d749771751ecf39b904f193057d` changed the regression to require `{ scoreId, scoreFileName }` while production still returned `{ id, fileName }`. The GREEN production commit `8cd6756ef242d99fc323181b21b58f96fe24c731` introduced `TrustedScoreAttachment`, validates only the compatibility wire keys at `trustedScoreAttachment`, returns semantic `scoreId`/`scoreFileName`, and renamed touched workspace-owned locals to bounded score/range vocabulary. No database table, column, index, constraint, sequence, migration, foreign key, ORM/query mapping, UPSERT path, lock topology, or persisted project wire key changed. -A current CodeRabbit review also identified a truthful-documentation defect: `ARCHITECTURE.md`, `AGENTS.md`, `CHANGELOG.md`, and `CLAUDE.md` could be read as promising that any persisted score attachment is openable. Production actually requires both validated attachment metadata and a live Score workspace; reopened metadata-only projects or untrusted metadata fall back to adding a score or checking the range by ear. The same canonical branch was directly repaired in commits `5af64f5c3ddc85b237a4426678de0233ee4f5fdf`, `5a2abb1aa404eb0df133cbaeade44439621e56d6`, `893b87a53faaa08f3f972a4dc264c47ff9c83511`, and `8099e3b2525723474aca09db4d669167035263b3` so product guidance and production now express one invariant. +A CodeRabbit review also identified a truthful-documentation defect: `ARCHITECTURE.md`, `AGENTS.md`, `CHANGELOG.md`, and `CLAUDE.md` could be read as promising that any persisted score attachment is openable. Production actually requires both validated attachment metadata and a live Score workspace; reopened metadata-only projects or untrusted metadata fall back to adding a score or checking the range by ear. The same canonical branch was directly repaired in commits `5af64f5c3ddc85b237a4426678de0233ee4f5fdf`, `5a2abb1aa404eb0df133cbaeade44439621e56d6`, `893b87a53faaa08f3f972a4dc264c47ff9c83511`, and `8099e3b2525723474aca09db4d669167035263b3` so product guidance and production now express one invariant. -At the latest #1092 capture, exact head `8099e3b2525723474aca09db4d669167035263b3` had **27** fresh check runs. Required/security lanes including `dependency-review`, `scorecard`, and `trivy-fs` were still queued, while a skipped manual-evidence helper was not treated as passing required evidence. No predecessor success was promoted. +The recorded #1092 check observation belongs to historical exact head `8099e3b2525723474aca09db4d669167035263b3`: 27 check runs were observed, with required/security lanes including `dependency-review`, `scorecard`, and `trivy-fs` still queued at that capture. It was not freshly queried in the 17:33 KST cycle and is not current merge-readiness evidence. A skipped manual-evidence helper is not a substitute for required evidence, and no predecessor success is promoted. ### Release identity — #1126 @@ -52,15 +52,17 @@ The protected `.bscope` documentation currently describes structural schema vali ## Queue and causal-owner evidence -Issue #966 remains the dependency-aware merge-train control plane, while PR #968 retains unique executable queue machinery: bounded pagination, exact active-head capture, independently resolved target tips, deterministic ordering, malformed/incomplete/duplicate rejection, network-independent validation, and symlink-safe atomic publication. At the census pre-write capture #968 was `docs/bandscope-product-readiness-baseline@a1ccf9348343a835c640d0b7e830d9c10b0c0482` with base branch `docs/gap-baseline-2026-08-31` and base SHA `9e88ba2cf4dc0fdaf64f80b1f540c37bb4d9ce49`. That queue head was an ordinary non-force two-parent restack preserving its unique queue tree while taking the then-current baseline/doctoring blobs. Because #1116 has now advanced again, that base-tip receipt is predecessor evidence and #968 must reconcile to the new baseline before its checks/reviews can qualify. +Issue #966 remains the dependency-aware merge-train control plane, while PR #968 retains unique executable queue machinery: bounded pagination, exact active-head capture, independently resolved target tips, deterministic ordering, malformed/incomplete/duplicate rejection, network-independent validation, and symlink-safe atomic publication. Immediately before the current baseline write, #968 was `docs/bandscope-product-readiness-baseline@45ef3da0e40980bb9b532dd754d14f9e309536bf` with base branch `docs/gap-baseline-2026-08-31` and recorded base SHA `b947afd05fd4fa1e1e0489cdccab34f9cef714b4`. After #1116 advanced to `cafb0907e5cdf1c9ed479a6bd50a8d80fde38ca0`, a fresh GitHub read reported #968 `mergeable=false` while still exposing the predecessor base SHA. That is a live stack-reconciliation finding, not permission to discard #968's unique queue tree; #968 must be restacked or reconciled by ordinary non-force history against the new #1116 source before its checks/reviews can qualify. -The baseline owner #1116 and temporal-analysis PR #1117 are separate evidence lanes. The audited census pre-write #1116 source identity was `docs/gap-baseline-2026-08-31@9e88ba2cf4dc0fdaf64f80b1f540c37bb4d9ce49`, base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`; this run then advanced it through ordinary non-force documentation commits. PR #1117 remains a separate temporal-analysis lane; its review evidence does not constitute #1116 review evidence. +The baseline owner #1116 and temporal-analysis PR #1117 are separate evidence lanes. PR #1117's previously recorded `refactor/temporal-features-api@b98f266d2356d56be624fb617580b5252e85baaa` metadata and review state are historical in this cycle because they were not freshly queried after the current #1116 writes; that evidence never constitutes #1116 or #968 readiness. -Repository-local Trivy PR-head configuration remains owned by open BandScope #1119. Its fresh current head was re-fetched as `fix/trivy-pr-code-scanning@bb3a9735a00a64347e8a5d0e3f2d92243bdbc585`. Current source preserves semantic multiword organization-owned checker identifiers while retaining GitHub/YAML vendor keys at the external boundary. Two previously unresolved current-head Devin comments were re-read as informational/fail-closed design notes rather than actionable source defects and were resolved only after source verification. Fresh #1119 checks remain exact-head evidence; queued/non-terminal jobs are non-passing and were not spam-rerun. +Repository-local Trivy PR-head configuration remains owned by open BandScope #1119. Its previously recorded exact head was `fix/trivy-pr-code-scanning@bb3a9735a00a64347e8a5d0e3f2d92243bdbc585`; that identity must be freshly re-fetched before any new merge decision. Current source at the recorded capture preserved semantic multiword organization-owned checker identifiers while retaining GitHub/YAML vendor keys at the external boundary. Queued/non-terminal jobs remain non-passing and are not spam-rerun. The latest protected central control-plane evidence recorded by the baseline is `ContextualWisdomLab/.github@669505bdf267d92989298857c740a59807bbd735`. Issue `.github#712` remains the organization-wide runner-admission/queue-health owner. Earlier protected `.github#1658`, `.github#1656`, `.github#1665`, and `.github#1645` reduce avoidable queue/review pressure and review-routing ambiguity but do not turn a queued exact-head job into terminal success. -The connected repository write surface permits ordinary source/workflow/PR changes but does not expose organization runner-pool, Actions quota/billing, or equivalent admission-setting mutation. A fresh attempt to read the protected `develop` branch-protection endpoint in this run returned GitHub **403 `Resource not accessible by integration`**; therefore the previously recorded 16-context inventory is not promoted as newly revalidated branch-protection truth in this capture. Unchanged-head reruns and runner-label churn are not substitutes for causal evidence. Fresh #1009 workflow evidence also showed that hosted admission is delayed rather than uniformly dead: one exact-head npm gate eventually reached a GitHub-hosted runner and completed successfully while sibling jobs remained queued. That distinction prevents a blanket infrastructure diagnosis from replacing per-job RCA. +A current review suggestion named `.github#1567` as an unresolved central coverage prerequisite. Fresh revalidation in this cycle shows `ContextualWisdomLab/.github#1567` is **closed and unmerged** (`merged_at=null`), so it is not represented as a live prerequisite. Its historical body remains useful evidence that merged-tree coverage must reach 100% and that predecessor checks do not transfer, but any current coverage blocker must be re-established on the actual protected owner rather than inferred from that retired PR. + +The connected repository write surface permits ordinary source/workflow/PR changes but does not expose organization runner-pool, Actions quota/billing, or equivalent admission-setting mutation. A fresh attempt to read the protected `develop` branch-protection endpoint in this cycle returned GitHub **403 `Resource not accessible by integration`**; therefore the previously recorded 16-context inventory is not promoted as newly revalidated branch-protection truth. Unchanged-head reruns and runner-label churn are not substitutes for causal evidence. Fresh #1009 metadata also confirms its canonical source-selection authority: local, demo, YouTube, and Open Project intake share one synchronous `workspaceIntakeInFlightRef`; failed or cancelled replacement preserves the prior valid selection, and conflicting source/import/analysis controls respect the same pending boundary. The baseline state model now mirrors those semantics instead of leaving source replacement undefined. Canonical product ownership remains explicit: #961 owns active rehearsal player/transport, #962 owns crash-safe project persistence, **#963 owns diagnostics/support bundles**, and #960 owns trusted release/distribution. These scopes are distinct even when one leaf PR exercises more than one acceptance gate. @@ -70,7 +72,7 @@ This documentation change introduces no new runtime authority. The durable secur ## Historical observations and RCA -Historical queue observations remain useful only as dated evidence. On 2026-09-01 10:31 KST BandScope had 190 open pull requests. At 2026-09-01 13:29 KST, 72 repositories were visible and an organization recount reported 2,697 open pull requests, with BandScope at 188. Later 2026-09-02 sweeps observed 2,827/2,834 and 185 BandScope, 2,856/2,855 and 194 BandScope, then 2,865/2,866 and 196 BandScope, then 2,889/2,889 and 196 BandScope, then 2,894/2,894 and 196 BandScope before the current **2,894/2,894 and 193 BandScope** capture. None may be reused as an undated permanent count. +Historical queue observations remain useful only as dated evidence. On 2026-09-01 10:31 KST BandScope had 190 open pull requests. At 2026-09-01 13:29 KST, 72 repositories were visible and an organization recount reported 2,697 open pull requests, with BandScope at 188. Later 2026-09-02 sweeps observed 2,827/2,834 and 185 BandScope, 2,856/2,855 and 194 BandScope, then 2,865/2,866 and 196 BandScope, then 2,889/2,889 and 196 BandScope, then 2,894/2,894 and 196 BandScope, then 2,894/2,894 and 193 BandScope, before the current **2,907 sequential / 2,908 aggregate and 193 BandScope** capture. None may be reused as an undated permanent count. Review findings previously validated on #1116 included stale PR evidence, a false repository-wide Mermaid-absence claim, stale product-owner issue numbers, and prose-inherited live Noema/PR claims. The replacement baseline separates protected-source facts from timestamped GitHub observations and uses exact current-head examples instead of assigning one cause to the whole queue. @@ -101,4 +103,4 @@ World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines (WCAG) PR #1116 remains the canonical baseline owner. Its source contains the complete recovered PRD/TRD/DDD/naming/Rust/science/security/UI/quality/release/traceability contract plus current delivery evidence. PR #1025 is an older competing owner of the same path; it may only be closed as superseded when every unique semantic requirement remains executable or represented in the canonical source and its discussion history is preserved. -Future loops should refresh live counts and exact-head evidence when they materially change prioritization or causal ownership. They must not rewrite stable product/architecture sections merely to chase a volatile PR number, and they must never repeat the predecessor truncation failure by replacing a complete canonical document with a partial census fragment. +Future loops should refresh live counts and exact-head evidence when they materially change prioritization or causal ownership. They must not rewrite stable product/architecture sections merely to chase a volatile PR number, and they must never repeat the predecessor truncation failure by replacing a complete canonical document with a partial census fragment. \ No newline at end of file From 3f29e8d345494f48abc3309901c621d9b9873bee Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 17:56:56 +0900 Subject: [PATCH 48/80] docs(state): preserve source on cancelled replacement --- docs/product-technical-gap-baseline.md | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index beb934490..6614f454a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -149,7 +149,7 @@ flowchart LR UI[UI / Interaction] ING[Audio Ingestion] DEC[Resource Admission & Decode] - MIR[Signal / MIR Analysis] + MIR[Signal/MIR Analysis] RI[Rehearsal Insight] PLAYER[Active Player] PROJ[Project Persistence] @@ -228,12 +228,13 @@ If decode, analysis, persistence, or playback fails, the error remains typed and ```mermaid stateDiagram-v2 [*] --> NoSource - NoSource --> SourceSelecting: choose source + NoSource --> InitialSourceSelecting: choose source NoSource --> Recovering: project recovery requested - SourceSelecting --> Ready: source admitted - SourceSelecting --> NoSource: cancelled/failed with no prior source - Ready --> SourceSelecting: replace source - Ready --> Ready: cancelled/failed replacement keeps prior source + InitialSourceSelecting --> Ready: source admitted + InitialSourceSelecting --> NoSource: cancelled/failed initial selection + Ready --> ReplacementSourceSelecting: replace source + ReplacementSourceSelecting --> Ready: replacement admitted + ReplacementSourceSelecting --> Ready: cancelled/failed replacement keeps prior source Ready --> Playing: play Playing --> Paused: pause Paused --> Playing: resume @@ -246,17 +247,17 @@ stateDiagram-v2 Paused --> Ready: stop Looping --> Ready: stop LoopPaused --> Ready: stop - Playing --> SourceSelecting: replace source requested / stop transport - Paused --> SourceSelecting: replace source requested - Looping --> SourceSelecting: replace source requested / stop transport - LoopPaused --> SourceSelecting: replace source requested + Playing --> ReplacementSourceSelecting: replace source requested / stop transport + Paused --> ReplacementSourceSelecting: replace source requested + Looping --> ReplacementSourceSelecting: replace source requested / stop transport + LoopPaused --> ReplacementSourceSelecting: replace source requested Ready --> NoSource: clear source Ready --> Recovering: project recovery requested Recovering --> Ready: last-known-good restored Recovering --> RecoveryFailed: no valid recoverable snapshot ``` -The production player owns one transport state machine. Loop activation never removes pause or stop authority: active-loop playback may pause with the loop retained, resume into that loop, clear the loop into ordinary playback/paused state, or stop directly. Source replacement is transactional: a pending replacement must not erase the prior admitted source; conflicting source/import/analysis actions remain unavailable until selection resolves, and a cancelled or failed replacement returns to the prior source authority. UI components, cue cards, map cursors, and persisted project data project from the owning authority rather than creating competing writable state. Project publication **must become** atomic and crash-safe; that is a target persistence contract, not a shipped guarantee, and this state diagram does not prove it. +The production player owns one transport state machine. Loop activation never removes pause or stop authority: active-loop playback may pause with the loop retained, resume into that loop, clear the loop into ordinary playback/paused state, or stop directly. Initial admission and replacement use distinct selection-intent states so cancellation has one unambiguous outcome: a cancelled or failed initial selection returns to no source, while a cancelled or failed replacement returns to the prior admitted source. Source replacement is transactional: a pending replacement must not erase the prior admitted source; conflicting source/import/analysis actions remain unavailable until selection resolves. UI components, cue cards, map cursors, and persisted project data project from the owning authority rather than creating competing writable state. Project publication **must become** atomic and crash-safe; that is a target persistence contract, not a shipped guarantee, and this state diagram does not prove it. ### 7.4 Persistence and contract versioning From f29be7d5c3fa2d35a3cdb52428ba04e2938719c1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 18:31:00 +0900 Subject: [PATCH 49/80] test(docs): require recovery-failure exit contract --- scripts/checks/verify_docs.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/scripts/checks/verify_docs.py b/scripts/checks/verify_docs.py index 850921591..5299064f3 100644 --- a/scripts/checks/verify_docs.py +++ b/scripts/checks/verify_docs.py @@ -17,6 +17,7 @@ Path("docs/architecture/overview.md"), Path("docs/i18n/i18n-policy.md"), Path("docs/release/release-policy.md"), + Path("docs/product-technical-gap-baseline.md"), Path(".github/CODEOWNERS"), Path(".github/PULL_REQUEST_TEMPLATE.md"), Path(".github/ISSUE_TEMPLATE/bug_report.yml"), @@ -58,6 +59,10 @@ "docs/security/cross-platform-build-policy.md", "docs/workflow/github-bootstrap-execution-policy.md", ], + Path("docs/product-technical-gap-baseline.md"): [ + "Recovering --> RecoveryFailed: no valid recoverable snapshot", + "RecoveryFailed --> NoSource: recovery failure acknowledged", + ], } From 3caacc9592d27059ea28c599bdde8cc9bad36b05 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 18:36:08 +0900 Subject: [PATCH 50/80] fix(docs): make recovery failure escapable --- docs/product-technical-gap-baseline.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 6614f454a..e3b91f961 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -255,9 +255,10 @@ stateDiagram-v2 Ready --> Recovering: project recovery requested Recovering --> Ready: last-known-good restored Recovering --> RecoveryFailed: no valid recoverable snapshot + RecoveryFailed --> NoSource: recovery failure acknowledged ``` -The production player owns one transport state machine. Loop activation never removes pause or stop authority: active-loop playback may pause with the loop retained, resume into that loop, clear the loop into ordinary playback/paused state, or stop directly. Initial admission and replacement use distinct selection-intent states so cancellation has one unambiguous outcome: a cancelled or failed initial selection returns to no source, while a cancelled or failed replacement returns to the prior admitted source. Source replacement is transactional: a pending replacement must not erase the prior admitted source; conflicting source/import/analysis actions remain unavailable until selection resolves. UI components, cue cards, map cursors, and persisted project data project from the owning authority rather than creating competing writable state. Project publication **must become** atomic and crash-safe; that is a target persistence contract, not a shipped guarantee, and this state diagram does not prove it. +The production player owns one transport state machine. Loop activation never removes pause or stop authority: active-loop playback may pause with the loop retained, resume into that loop, clear the loop into ordinary playback/paused state, or stop directly. Initial admission and replacement use distinct selection-intent states so cancellation has one unambiguous outcome: a cancelled or failed initial selection returns to no source, while a cancelled or failed replacement returns to the prior admitted source. Source replacement is transactional: a pending replacement must not erase the prior admitted source; conflicting source/import/analysis actions remain unavailable until selection resolves. Acknowledging a failed project recovery clears the failed recovery attempt and returns to `NoSource`, where the user can select a source or explicitly request recovery again; it never manufactures a successful recovered state. UI components, cue cards, map cursors, and persisted project data project from the owning authority rather than creating competing writable state. Project publication **must become** atomic and crash-safe; that is a target persistence contract, not a shipped guarantee, and this state diagram does not prove it. ### 7.4 Persistence and contract versioning From 3c59ebc35c2a25178462da45b23f833de292b200 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 18:39:29 +0900 Subject: [PATCH 51/80] test(docs): preserve recovery origin on failure --- scripts/checks/verify_docs.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/scripts/checks/verify_docs.py b/scripts/checks/verify_docs.py index 5299064f3..417567ac7 100644 --- a/scripts/checks/verify_docs.py +++ b/scripts/checks/verify_docs.py @@ -60,8 +60,10 @@ "docs/workflow/github-bootstrap-execution-policy.md", ], Path("docs/product-technical-gap-baseline.md"): [ - "Recovering --> RecoveryFailed: no valid recoverable snapshot", - "RecoveryFailed --> NoSource: recovery failure acknowledged", + "NoSource --> RecoveringWithoutSource: project recovery requested", + "Ready --> RecoveringWithSource: project recovery requested", + "RecoveryFailedWithoutSource --> NoSource: recovery failure acknowledged", + "RecoveryFailedWithSource --> Ready: recovery failure acknowledged / keep prior source", ], } From cdc9d2b27ed7c9c81a49bd7dd6279d79de7f73a9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 18:41:41 +0900 Subject: [PATCH 52/80] fix(docs): preserve source across recovery failure --- docs/product-technical-gap-baseline.md | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index e3b91f961..09100947e 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -229,7 +229,7 @@ If decode, analysis, persistence, or playback fails, the error remains typed and stateDiagram-v2 [*] --> NoSource NoSource --> InitialSourceSelecting: choose source - NoSource --> Recovering: project recovery requested + NoSource --> RecoveringWithoutSource: project recovery requested InitialSourceSelecting --> Ready: source admitted InitialSourceSelecting --> NoSource: cancelled/failed initial selection Ready --> ReplacementSourceSelecting: replace source @@ -252,13 +252,16 @@ stateDiagram-v2 Looping --> ReplacementSourceSelecting: replace source requested / stop transport LoopPaused --> ReplacementSourceSelecting: replace source requested Ready --> NoSource: clear source - Ready --> Recovering: project recovery requested - Recovering --> Ready: last-known-good restored - Recovering --> RecoveryFailed: no valid recoverable snapshot - RecoveryFailed --> NoSource: recovery failure acknowledged + Ready --> RecoveringWithSource: project recovery requested + RecoveringWithoutSource --> Ready: last-known-good restored + RecoveringWithoutSource --> RecoveryFailedWithoutSource: no valid recoverable snapshot + RecoveryFailedWithoutSource --> NoSource: recovery failure acknowledged + RecoveringWithSource --> Ready: last-known-good restored + RecoveringWithSource --> RecoveryFailedWithSource: no valid recoverable snapshot + RecoveryFailedWithSource --> Ready: recovery failure acknowledged / keep prior source ``` -The production player owns one transport state machine. Loop activation never removes pause or stop authority: active-loop playback may pause with the loop retained, resume into that loop, clear the loop into ordinary playback/paused state, or stop directly. Initial admission and replacement use distinct selection-intent states so cancellation has one unambiguous outcome: a cancelled or failed initial selection returns to no source, while a cancelled or failed replacement returns to the prior admitted source. Source replacement is transactional: a pending replacement must not erase the prior admitted source; conflicting source/import/analysis actions remain unavailable until selection resolves. Acknowledging a failed project recovery clears the failed recovery attempt and returns to `NoSource`, where the user can select a source or explicitly request recovery again; it never manufactures a successful recovered state. UI components, cue cards, map cursors, and persisted project data project from the owning authority rather than creating competing writable state. Project publication **must become** atomic and crash-safe; that is a target persistence contract, not a shipped guarantee, and this state diagram does not prove it. +The production player owns one transport state machine. Loop activation never removes pause or stop authority: active-loop playback may pause with the loop retained, resume into that loop, clear the loop into ordinary playback/paused state, or stop directly. Initial admission and replacement use distinct selection-intent states so cancellation has one unambiguous outcome: a cancelled or failed initial selection returns to no source, while a cancelled or failed replacement returns to the prior admitted source. Source replacement is transactional: a pending replacement must not erase the prior admitted source; conflicting source/import/analysis actions remain unavailable until selection resolves. Recovery likewise preserves its origin: acknowledging a failed recovery requested from `NoSource` returns to `NoSource`, while a failed recovery requested from `Ready` returns to `Ready` with the prior admitted source unchanged. Either state can explicitly request recovery again, and failure never manufactures a successful recovered state. UI components, cue cards, map cursors, and persisted project data project from the owning authority rather than creating competing writable state. Project publication **must become** atomic and crash-safe; that is a target persistence contract, not a shipped guarantee, and this state diagram does not prove it. ### 7.4 Persistence and contract versioning From 0dc29d61a9e24663195e5c3c51737a598749aa55 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 18:49:16 +0900 Subject: [PATCH 53/80] docs(gap): refresh fleet census and control-plane evidence --- docs/product-technical-gap-baseline.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 09100947e..b8d6cc8d9 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -46,13 +46,13 @@ The near-term product order remains: merge-train convergence; trusted distributi ## 2. Live delivery authority -A fresh accessible-repository sweep begun at **2026-09-02 17:33 KST** queried all **74** repositories currently visible under `ContextualWisdomLab` individually. The sequential per-repository counts summed to **2,907 open pull requests**. An organization-wide aggregate captured immediately after that sweep returned **2,908 open pull requests** with `incomplete_results=false`. The one-PR difference proves only non-simultaneous queue movement during the census; it is not attributed to a particular repository without a separate exact observation. +A fresh complete accessible-repository sweep begun at **2026-09-02 18:30 KST** queried all **74** repositories currently visible under `ContextualWisdomLab` individually. The sequential per-repository counts summed to **2,914 open pull requests**. A later organization-wide aggregate returned **2,914 open pull requests** with `incomplete_results=false`. The matching totals are still non-atomic observations: PR creation and closure can occur during or after the sequential sweep, so this census remains dated evidence rather than permanent product truth. -At this census `ContextualWisdomLab/bandscope` had **193 open pull requests** and **19 open issues**, and remains the selected delivery boundary. Fresh high-backlog peers were `ContextualWisdomLab/naruon` (146), `ContextualWisdomLab/OriginWeave` (142), `ContextualWisdomLab/newsdom-api` (137), `ContextualWisdomLab/pg-erd-cloud` (136), `ContextualWisdomLab/TEPP` (130), `ContextualWisdomLab/html4tree` (127), `ContextualWisdomLab/.github` (121), `ContextualWisdomLab/Orgmetra` (117), and `ContextualWisdomLab/LineageWeave` (112). BandScope is selected not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. +At this census `ContextualWisdomLab/bandscope` had **193 open pull requests** and a fresh issue search returned **19 open issues**, so it remains the selected delivery boundary. Fresh high-backlog peers were `ContextualWisdomLab/naruon` (146), `ContextualWisdomLab/OriginWeave` (142), `ContextualWisdomLab/pg-erd-cloud` (137), `ContextualWisdomLab/newsdom-api` (137), `ContextualWisdomLab/TEPP` (130), `ContextualWisdomLab/html4tree` (127), `ContextualWisdomLab/.github` (123), `ContextualWisdomLab/Orgmetra` (117), and `ContextualWisdomLab/LineageWeave` (112). BandScope is selected not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. The exact 74-repository set for this same capture is enumerated verbatim in `docs/doctoring/product-gap-baseline-2026-09-01.md`; capitalization there is the GitHub repository identity and is not normalized. Because PR creation and closure can occur during a sequential organization census, later counts are historical observations unless a new complete sweep is performed. -Protected `develop` was previously recorded with these 16 required contexts: `ci / build-and-test`, `dependency-review`, `security-audit`, `sbom`, `release-preflight`, `gate / build / windows`, `gate / build / macos`, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, `Analyze (javascript-typescript)`, and `Analyze (python)`. A fresh branch-protection read in this run returned GitHub 403 `Resource not accessible by integration`, so this inventory is not represented as newly revalidated protection truth; merge decisions must refetch through an authorized surface. +A fresh protected-branch read confirms `develop@749511c3ad4000090048718f685c6bee6b3d2c25` remains protected with exactly these 16 required contexts: `ci / build-and-test`, `dependency-review`, `security-audit`, `sbom`, `release-preflight`, `gate / build / windows`, `gate / build / macos`, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, `Analyze (javascript-typescript)`, and `Analyze (python)`. Merge decisions still re-fetch protection because this is capture-time evidence. Operational evidence rule: queued, pending, skipped-required, cancelled, neutral, failed, absent, stale, predecessor-head, protected-base, model-only, status-only, self/author, or administrative-bypass evidence is non-passing. A head change prevents predecessor review/check receipts from transferring to the successor head; the original historical evidence remains preserved. Force-push, destructive rebase, self-approval, gate weakening, fabricated evidence, and unrelated rollback are prohibited. @@ -95,9 +95,9 @@ The product boundary, tests, contracts, and unique behavior decide succession— Backlog convergence is the primary engineering risk because micro-PR fan-out creates duplicate writers, stale evidence, dependency ambiguity, competing local state, and review/check churn. -PR #968 owns the unique executable queue machinery needed by #966: bounded GitHub pagination, exact active-head capture, independent base-tip resolution, deterministic ordering, malformed/incomplete/duplicate rejection, reviewed dependency/succession metadata, network-independent validation, deterministic human projection/parity, and symlink-safe atomic publication. It must not be discarded as stale documentation. +PR #968 owns the unique executable queue machinery needed by #966: bounded GitHub pagination, exact active-head capture, independent base-tip resolution, deterministic ordering, malformed/incomplete/duplicate rejection, symlink-safe atomic publication, reviewed dependency/succession metadata, network-independent validation, deterministic human projection/parity, and exact-head artifact preservation. It must not be discarded as stale documentation. -Current identities are deliberately separated rather than conflated. At this pre-write audit, canonical baseline PR #1116 was `docs/gap-baseline-2026-08-31@b947afd05fd4fa1e1e0489cdccab34f9cef714b4`, base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. A fresh GitHub read of PR #968 reported queue head `docs/bandscope-product-readiness-baseline@45ef3da0e40980bb9b532dd754d14f9e309536bf` and base SHA exactly `b947afd05fd4fa1e1e0489cdccab34f9cef714b4` for base branch `docs/gap-baseline-2026-08-31`; that head is the ordinary non-force two-parent restack that preserved #968 queue machinery while taking the then-current #1116 baseline/doctoring blobs. This #1116 advance makes that base-tip receipt predecessor evidence; #968 must reconcile again before its checks/reviews can qualify. +Current identities are deliberately separated rather than conflated. At this pre-write audit, canonical baseline PR #1116 was `docs/gap-baseline-2026-08-31@cdc9d2b27ed7c9c81a49bd7dd6279d79de7f73a9`, base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. A fresh GitHub read of PR #968 reported queue head `docs/bandscope-product-readiness-baseline@9f25cf669eaaad7e1e2296463a73eb2c5620dc66` and base SHA exactly `cdc9d2b27ed7c9c81a49bd7dd6279d79de7f73a9` for base branch `docs/gap-baseline-2026-08-31`; GitHub currently reports that stack mergeable. Any later #1116 advance changes the target tip and therefore requires fresh #968 base/check/review evidence even when its unique queue-control source remains intact. PR #1117 is a separate lane: `refactor/temporal-features-api@b98f266d2356d56be624fb617580b5252e85baaa`, base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. Its visible review threads are independently resolved; that review evidence belongs to #1117 and never substitutes for #1116 or #968 evidence. #1117 does not own `docs/product-technical-gap-baseline.md`, so no canonical baseline document blob is attributed to its exact ref. @@ -334,7 +334,7 @@ Ordinary logs/support bundles must not contain raw audio/project payloads, crede - **Artifact trust:** installers/updaters require owning-boundary signature, checksum, SBOM and provenance verification; staged rollout and rollback evidence remain part of release acceptance. - **Verification status:** queued, pending, neutral, skipped-required, cancelled, stale, predecessor or inaccessible-protection evidence is non-passing and cannot be promoted into security assurance. -The latest protected central control-plane evidence recorded by this baseline is `ContextualWisdomLab/.github@669505bdf267d92989298857c740a59807bbd735`. Issue `.github#712` remains the organization-wide Actions queue-health/runner-admission causal owner. Earlier protected `.github#1658`, `.github#1656`, `.github#1665`, and `.github#1645` reduce avoidable load/review-routing ambiguity but do not convert a queued current-head check into success. Repository-local BandScope #1119 remains the Trivy PR-head contract owner until normally integrated or superseded. +The latest protected central control-plane head revalidated in this run is `ContextualWisdomLab/.github@f610598c585d8dfdabe6fd82204173e23ad09841`. Issue `.github#712` remains the organization-wide Actions queue-health/runner-admission causal owner. Cross-repository exact-head evidence shows jobs waiting before checkout with no runner assignment across both `ubuntu-latest` and explicit `ubuntu-24.04`, including an unchanged Wardnet head that previously completed successfully on the same label. That evidence falsifies a simple leaf runner-label defect but does not identify whether the remaining owner cause is hosted-runner capacity, organization concurrency/admission policy, billing/quota, or provider scheduling. Earlier protected `.github#1658`, `.github#1656`, `.github#1665`, `.github#1645`, and subsequent scheduler fixes reduce avoidable load/review-routing/cancellation ambiguity but do not convert a queued current-head check into success. Fresh #1092 exact-head verification exists on `8099e3b2525723474aca09db4d669167035263b3`: 27 check runs were observed, with required/security lanes such as `dependency-review`, `scorecard`, and `trivy-fs` still queued at capture. A skipped manual-evidence helper is not a substitute for required evidence. No predecessor-head success is transferred. From 0335ba3d6d13086ab64dbf4af54d177f841fa39d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 18:54:00 +0900 Subject: [PATCH 54/80] docs(doctoring): align live census and queue evidence --- .../product-gap-baseline-2026-09-01.md | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/docs/doctoring/product-gap-baseline-2026-09-01.md b/docs/doctoring/product-gap-baseline-2026-09-01.md index 102753309..b3a38231d 100644 --- a/docs/doctoring/product-gap-baseline-2026-09-01.md +++ b/docs/doctoring/product-gap-baseline-2026-09-01.md @@ -6,9 +6,9 @@ This note records why `docs/product-technical-gap-baseline.md` is maintained on ## Current live-state correction — 2026-09-02 -Protected BandScope source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep begun at **2026-09-02 17:33 KST** queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,907 open pull requests**. An organization-wide aggregate captured immediately after the sweep returned **2,908 open pull requests** with `incomplete_results=false`. The one-PR difference establishes only non-simultaneous queue movement during the census and is not attributed to a particular repository without a separate exact observation. +Protected BandScope source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep begun at **2026-09-02 18:30 KST** queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,914 open pull requests**. A later organization-wide aggregate returned **2,914 open pull requests** with `incomplete_results=false`. Matching totals do not make the observation atomic: PR creation and closure can occur during or after a sequential census, so the result remains dated evidence rather than permanent product truth. -`ContextualWisdomLab/bandscope` was the highest observed backlog at **193 open pull requests** and **19 open issues**. Fresh high-backlog peers were `ContextualWisdomLab/naruon` 146, `ContextualWisdomLab/OriginWeave` 142, `ContextualWisdomLab/newsdom-api` 137, `ContextualWisdomLab/pg-erd-cloud` 136, `ContextualWisdomLab/TEPP` 130, `ContextualWisdomLab/html4tree` 127, `ContextualWisdomLab/.github` 121, `ContextualWisdomLab/Orgmetra` 117, and `ContextualWisdomLab/LineageWeave` 112. BandScope remains selected by both backlog and product responsibility: it owns the buyer-facing local-first rehearsal/audio path plus high-leverage release, security, persistence, workflow, and shared-contract boundaries. +`ContextualWisdomLab/bandscope` was the highest observed backlog at **193 open pull requests** and a fresh issue search returned **19 open issues**. Fresh high-backlog peers were `ContextualWisdomLab/naruon` 146, `ContextualWisdomLab/OriginWeave` 142, `ContextualWisdomLab/pg-erd-cloud` 137, `ContextualWisdomLab/newsdom-api` 137, `ContextualWisdomLab/TEPP` 130, `ContextualWisdomLab/html4tree` 127, `ContextualWisdomLab/.github` 123, `ContextualWisdomLab/Orgmetra` 117, and `ContextualWisdomLab/LineageWeave` 112. BandScope remains selected by both backlog and product responsibility: it owns the buyer-facing local-first rehearsal/audio path plus high-leverage release, security, persistence, workflow, and shared-contract boundaries. The accessible repository set for this capture was: `ContextualWisdomLab/kaefa`, `ContextualWisdomLab/aFIPC`, `ContextualWisdomLab/nonnest2`, `ContextualWisdomLab/html4tree`, `ContextualWisdomLab/mightyETL`, `ContextualWisdomLab/xtrmLLMBatchPython`, `ContextualWisdomLab/pg-erd-cloud`, `ContextualWisdomLab/clearfolio`, `ContextualWisdomLab/bandscope`, `ContextualWisdomLab/newsdom-api`, `ContextualWisdomLab/scopeweave`, `ContextualWisdomLab/naruon`, `ContextualWisdomLab/linux-cluster-ops`, `ContextualWisdomLab/argos`, `ContextualWisdomLab/codec-carver`, `ContextualWisdomLab/appguardrail`, `ContextualWisdomLab/vooster`, `ContextualWisdomLab/.github`, `ContextualWisdomLab/ContextualWisdomLab.github.io`, `ContextualWisdomLab/seedream_evasepic`, `ContextualWisdomLab/contextual-orchestrator`, `ContextualWisdomLab/hyosung-itx-slogan-brief`, `ContextualWisdomLab/fast-mlsirm`, `ContextualWisdomLab/semantic-data-portal`, `ContextualWisdomLab/noema`, `ContextualWisdomLab/wardnet`, `ContextualWisdomLab/feelanet-adfs`, `ContextualWisdomLab/gyeot`, `ContextualWisdomLab/pg-llm-batch`, `ContextualWisdomLab/keyverse`, `ContextualWisdomLab/inkspan`, `ContextualWisdomLab/disksage`, `ContextualWisdomLab/free-router`, `ContextualWisdomLab/RankWeave`, `ContextualWisdomLab/ThreadWeave`, `ContextualWisdomLab/EgressWeave`, `ContextualWisdomLab/IRT-bibliography-set`, `ContextualWisdomLab/g7`, `ContextualWisdomLab/saju-caldav`, `ContextualWisdomLab/xtrm-lead-pi-outbound`, `ContextualWisdomLab/ccube-jco-potential-customer`, `ContextualWisdomLab/9drive`, `ContextualWisdomLab/macos_utility_packs`, `ContextualWisdomLab/OmniRoute`, `ContextualWisdomLab/graphify`, `ContextualWisdomLab/life-os`, `ContextualWisdomLab/four-pillars`, `ContextualWisdomLab/DiagramWeave`, `ContextualWisdomLab/trivy-sarif-repro`, `ContextualWisdomLab/TEPP`, `ContextualWisdomLab/OriginWeave`, `ContextualWisdomLab/EmbedRelay`, `ContextualWisdomLab/mhtml-etl-gateway`, `ContextualWisdomLab/psychometrics-commons`, `ContextualWisdomLab/LineageWeave`, `ContextualWisdomLab/Orgmetra`, `ContextualWisdomLab/enterprise-architecture-core`, `ContextualWisdomLab/context-graph-contracts`, `ContextualWisdomLab/metering-billing-platform`, `ContextualWisdomLab/accounting-information-platform`, `ContextualWisdomLab/quarantine-sandbox-runtime`, `ContextualWisdomLab/governance-risk-compliance`, `ContextualWisdomLab/CalendarWeave`, `ContextualWisdomLab/j-planner`, `ContextualWisdomLab/learning-interoperability-contracts`, `ContextualWisdomLab/learning-record-store`, `ContextualWisdomLab/learning-management-platform`, `ContextualWisdomLab/learning-content-studio`, `ContextualWisdomLab/ELUNVERA`, `ContextualWisdomLab/PolicyWeave`, `ContextualWisdomLab/litellm-patched-proxy`, `ContextualWisdomLab/pingora-gateway`, `ContextualWisdomLab/ConceptWeave`, and `ContextualWisdomLab/supply-chain-control-plane`. @@ -18,9 +18,9 @@ Volatile queue counts are dated evidence, not product truth. Every branch advanc A source-integrity defect was verified on predecessor #1116 head `f6207ef2cadadb5d3852e0595ab2f0b62e20a06b`. That census-only commit unintentionally removed 83 lines from `docs/product-technical-gap-baseline.md` and left the canonical product/technical contract ending immediately after §7.4. The deleted material included the identifier-policy migration boundary, Rust compute ownership, real-audio scientific acceptance, security/privacy, UI/UX evidence, quality/operability, release-gate, and traceability sections. -The parent `adbd9df394957ee1a2c68893b8a6025cdcf058c9` was inspected as recovery evidence before editing. The canonical branch then advanced through ordinary non-force history to `ec67371791c653eed21705600775c06ecd531cc7`, restoring the lost contract. In the current 17:33 KST cycle, #1116 was re-fetched at `docs/gap-baseline-2026-08-31@b947afd05fd4fa1e1e0489cdccab34f9cef714b4`, base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`, before the baseline repair advanced it to `cafb0907e5cdf1c9ed479a6bd50a8d80fde38ca0`. A document cannot truthfully self-embed the SHA of the commit that contains that self-reference, so successor head identity is always fetched from GitHub immediately after each write rather than inferred from prose. +The parent `adbd9df394957ee1a2c68893b8a6025cdcf058c9` was inspected as recovery evidence before editing. The canonical branch then advanced through ordinary non-force history to `ec67371791c653eed21705600775c06ecd531cc7`, restoring the lost contract. In the current 18:30 KST cycle, #1116 was re-fetched at `docs/gap-baseline-2026-08-31@cdc9d2b27ed7c9c81a49bd7dd6279d79de7f73a9`, base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`, before the live census/control-plane repair advanced it through ordinary history to `0dc29d61a9e24663195e5c3c51737a598749aa55`. A document cannot truthfully self-embed the SHA of the commit that contains that self-reference, so successor head identity is always fetched from GitHub immediately after each write rather than inferred from prose. -The restored baseline carries the buyer PRD, end-to-end stories, DDD bounded contexts/context map/ubiquitous language/domain events, TRD topology and transport diagrams, persistence/versioning rules, organization naming and database migration rules, Rust-first compute ownership, persistence ERD discipline, rights-safe real-audio scientific acceptance, security/privacy, Storybook/Figma/shipped accessibility evidence, the 100% quality floor, release acceptance, and APA traceability. The current repair also makes project recovery reachable before source admission, makes source replacement/clearing explicit, preserves the prior valid source across cancelled or failed replacement, and distinguishes the target atomic/crash-safe project contract from shipped behavior. +The restored baseline carries the buyer PRD, end-to-end stories, DDD bounded contexts/context map/ubiquitous language/domain events, TRD topology and transport diagrams, persistence/versioning rules, organization naming and database migration rules, Rust-first compute ownership, persistence ERD discipline, rights-safe real-audio scientific acceptance, security/privacy, Storybook/Figma/shipped accessibility evidence, the 100% quality floor, release acceptance, and APA traceability. The current repair preserved that complete contract while refreshing the census, protected-branch evidence, merge-train identities, and organization queue RCA. It also preserves the project-recovery origin state model: recovery begun without a source fails back to `NoSource`, while recovery begun with an admitted source fails back to `Ready` without manufacturing successful recovery. ## Organization naming-contract evidence @@ -38,7 +38,7 @@ The focused RED commit `35dc521f03711d749771751ecf39b904f193057d` changed the re A CodeRabbit review also identified a truthful-documentation defect: `ARCHITECTURE.md`, `AGENTS.md`, `CHANGELOG.md`, and `CLAUDE.md` could be read as promising that any persisted score attachment is openable. Production actually requires both validated attachment metadata and a live Score workspace; reopened metadata-only projects or untrusted metadata fall back to adding a score or checking the range by ear. The same canonical branch was directly repaired in commits `5af64f5c3ddc85b237a4426678de0233ee4f5fdf`, `5a2abb1aa404eb0df133cbaeade44439621e56d6`, `893b87a53faaa08f3f972a4dc264c47ff9c83511`, and `8099e3b2525723474aca09db4d669167035263b3` so product guidance and production now express one invariant. -The recorded #1092 check observation belongs to historical exact head `8099e3b2525723474aca09db4d669167035263b3`: 27 check runs were observed, with required/security lanes including `dependency-review`, `scorecard`, and `trivy-fs` still queued at that capture. It was not freshly queried in the 17:33 KST cycle and is not current merge-readiness evidence. A skipped manual-evidence helper is not a substitute for required evidence, and no predecessor success is promoted. +The recorded #1092 check observation belongs to historical exact head `8099e3b2525723474aca09db4d669167035263b3`: 27 check runs were observed, with required/security lanes including `dependency-review`, `scorecard`, and `trivy-fs` still queued at that capture. It is historical evidence, not current merge-readiness evidence. A skipped manual-evidence helper is not a substitute for required evidence, and no predecessor success is promoted. ### Release identity — #1126 @@ -52,17 +52,17 @@ The protected `.bscope` documentation currently describes structural schema vali ## Queue and causal-owner evidence -Issue #966 remains the dependency-aware merge-train control plane, while PR #968 retains unique executable queue machinery: bounded pagination, exact active-head capture, independently resolved target tips, deterministic ordering, malformed/incomplete/duplicate rejection, network-independent validation, and symlink-safe atomic publication. Immediately before the current baseline write, #968 was `docs/bandscope-product-readiness-baseline@45ef3da0e40980bb9b532dd754d14f9e309536bf` with base branch `docs/gap-baseline-2026-08-31` and recorded base SHA `b947afd05fd4fa1e1e0489cdccab34f9cef714b4`. After #1116 advanced to `cafb0907e5cdf1c9ed479a6bd50a8d80fde38ca0`, a fresh GitHub read reported #968 `mergeable=false` while still exposing the predecessor base SHA. That is a live stack-reconciliation finding, not permission to discard #968's unique queue tree; #968 must be restacked or reconciled by ordinary non-force history against the new #1116 source before its checks/reviews can qualify. +Issue #966 remains the dependency-aware merge-train control plane, while PR #968 retains unique executable queue machinery: bounded pagination, exact active-head capture, independently resolved target tips, deterministic ordering, malformed/incomplete/duplicate rejection, network-independent validation, and symlink-safe atomic publication. Immediately before the current baseline write, #968 was `docs/bandscope-product-readiness-baseline@9f25cf669eaaad7e1e2296463a73eb2c5620dc66` with base branch `docs/gap-baseline-2026-08-31` and recorded base SHA `cdc9d2b27ed7c9c81a49bd7dd6279d79de7f73a9`; GitHub reported the stack mergeable. Advancing #1116 changes that target tip, so #968 must be freshly re-read and, if necessary, reconciled by ordinary non-force history without losing its unique queue-control/test tree. Predecessor checks and reviews do not transfer merely because the stack remains mergeable. -The baseline owner #1116 and temporal-analysis PR #1117 are separate evidence lanes. PR #1117's previously recorded `refactor/temporal-features-api@b98f266d2356d56be624fb617580b5252e85baaa` metadata and review state are historical in this cycle because they were not freshly queried after the current #1116 writes; that evidence never constitutes #1116 or #968 readiness. +The baseline owner #1116 and temporal-analysis PR #1117 are separate evidence lanes. PR #1117's previously recorded `refactor/temporal-features-api@b98f266d2356d56be624fb617580b5252e85baaa` metadata and review state are historical in this cycle; that evidence never constitutes #1116 or #968 readiness. -Repository-local Trivy PR-head configuration remains owned by open BandScope #1119. Its previously recorded exact head was `fix/trivy-pr-code-scanning@bb3a9735a00a64347e8a5d0e3f2d92243bdbc585`; that identity must be freshly re-fetched before any new merge decision. Current source at the recorded capture preserved semantic multiword organization-owned checker identifiers while retaining GitHub/YAML vendor keys at the external boundary. Queued/non-terminal jobs remain non-passing and are not spam-rerun. +Repository-local Trivy PR-head configuration remains owned by open BandScope #1119. Its freshly audited exact head was `fix/trivy-pr-code-scanning@bb3a9735a00a64347e8a5d0e3f2d92243bdbc585`. Its stale push-only policy test and intended Trivy `pull_request` contract have already been repaired on that canonical branch; visible review threads were resolved at audit, while queued/non-terminal exact-head jobs remain non-passing and are not spam-rerun. -The latest protected central control-plane evidence recorded by the baseline is `ContextualWisdomLab/.github@669505bdf267d92989298857c740a59807bbd735`. Issue `.github#712` remains the organization-wide runner-admission/queue-health owner. Earlier protected `.github#1658`, `.github#1656`, `.github#1665`, and `.github#1645` reduce avoidable queue/review pressure and review-routing ambiguity but do not turn a queued exact-head job into terminal success. +The latest protected central control-plane evidence revalidated in this cycle is `ContextualWisdomLab/.github@f610598c585d8dfdabe6fd82204173e23ad09841`. Issue `.github#712` remains the organization-wide runner-admission/queue-health owner. Cross-repository evidence shows jobs waiting before checkout with no runner assignment on both `ubuntu-latest` and explicit `ubuntu-24.04`, including the same Wardnet exact head that previously completed successfully on the same explicit label. That falsifies a simple leaf runner-label or source-code defect but does not by itself identify hosted-runner capacity, organization concurrency/admission policy, billing/quota, or provider scheduling as the final cause. Recent protected scheduler fixes, including #1712's rejected-cancellation accounting repair, reduce avoidable duplicate-dispatch ambiguity but do not convert queued exact-head evidence into success. A current review suggestion named `.github#1567` as an unresolved central coverage prerequisite. Fresh revalidation in this cycle shows `ContextualWisdomLab/.github#1567` is **closed and unmerged** (`merged_at=null`), so it is not represented as a live prerequisite. Its historical body remains useful evidence that merged-tree coverage must reach 100% and that predecessor checks do not transfer, but any current coverage blocker must be re-established on the actual protected owner rather than inferred from that retired PR. -The connected repository write surface permits ordinary source/workflow/PR changes but does not expose organization runner-pool, Actions quota/billing, or equivalent admission-setting mutation. A fresh attempt to read the protected `develop` branch-protection endpoint in this cycle returned GitHub **403 `Resource not accessible by integration`**; therefore the previously recorded 16-context inventory is not promoted as newly revalidated branch-protection truth. Unchanged-head reruns and runner-label churn are not substitutes for causal evidence. Fresh #1009 metadata also confirms its canonical source-selection authority: local, demo, YouTube, and Open Project intake share one synchronous `workspaceIntakeInFlightRef`; failed or cancelled replacement preserves the prior valid selection, and conflicting source/import/analysis controls respect the same pending boundary. The baseline state model now mirrors those semantics instead of leaving source replacement undefined. +The connected repository write surface permits ordinary source/workflow/PR changes but does not expose organization runner-pool, Actions quota/billing, or equivalent admission-setting mutation. A fresh protected `develop` read succeeded in this cycle and confirmed these 16 required contexts: `ci / build-and-test`, `dependency-review`, `security-audit`, `sbom`, `release-preflight`, `gate / build / windows`, `gate / build / macos`, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, `Analyze (javascript-typescript)`, and `Analyze (python)`. Unchanged-head reruns and runner-label churn are not substitutes for causal evidence. Fresh #1009 audit also confirmed its source-selection authority is already repaired: local, demo, YouTube, and Open Project intake share one synchronous `workspaceIntakeInFlightRef`; failed or cancelled replacement preserves the prior valid selection, and conflicting source/import/analysis controls respect the same pending boundary. The baseline state model mirrors those semantics instead of leaving source replacement undefined. Canonical product ownership remains explicit: #961 owns active rehearsal player/transport, #962 owns crash-safe project persistence, **#963 owns diagnostics/support bundles**, and #960 owns trusted release/distribution. These scopes are distinct even when one leaf PR exercises more than one acceptance gate. @@ -72,9 +72,9 @@ This documentation change introduces no new runtime authority. The durable secur ## Historical observations and RCA -Historical queue observations remain useful only as dated evidence. On 2026-09-01 10:31 KST BandScope had 190 open pull requests. At 2026-09-01 13:29 KST, 72 repositories were visible and an organization recount reported 2,697 open pull requests, with BandScope at 188. Later 2026-09-02 sweeps observed 2,827/2,834 and 185 BandScope, 2,856/2,855 and 194 BandScope, then 2,865/2,866 and 196 BandScope, then 2,889/2,889 and 196 BandScope, then 2,894/2,894 and 196 BandScope, then 2,894/2,894 and 193 BandScope, before the current **2,907 sequential / 2,908 aggregate and 193 BandScope** capture. None may be reused as an undated permanent count. +Historical queue observations remain useful only as dated evidence. On 2026-09-01 10:31 KST BandScope had 190 open pull requests. At 2026-09-01 13:29 KST, 72 repositories were visible and an organization recount reported 2,697 open pull requests, with BandScope at 188. Later 2026-09-02 sweeps observed 2,827/2,834 and 185 BandScope, 2,856/2,855 and 194 BandScope, then 2,865/2,866 and 196 BandScope, then 2,889/2,889 and 196 BandScope, then 2,894/2,894 and 196 BandScope, then 2,894/2,894 and 193 BandScope, then 2,907/2,908 and 193 BandScope, before the current **2,914 sequential / 2,914 aggregate and 193 BandScope** capture. None may be reused as an undated permanent count. -Review findings previously validated on #1116 included stale PR evidence, a false repository-wide Mermaid-absence claim, stale product-owner issue numbers, and prose-inherited live Noema/PR claims. The replacement baseline separates protected-source facts from timestamped GitHub observations and uses exact current-head examples instead of assigning one cause to the whole queue. +Review findings previously validated on #1116 included stale PR evidence, a false repository-wide Mermaid-absence claim, stale product-owner issue numbers, and prose-inherited live Noema/PR claims. In this cycle a fresh reviewer also reported that the documentation gate lacked four project-recovery transitions. Exact-head revalidation showed the finding had already become stale: `scripts/checks/verify_docs.py` requires the four origin-preserving transitions and the canonical baseline contains all four exactly. The stale thread was answered with exact-head evidence and resolved without weakening the checker or churning correct source. A historical review-gate example remains instructive. PR #956 once had a predecessor exact-head Strix failure unrelated to its articulation privacy code. The central workflow exhausted the NVIDIA primary, encountered an EOL NVIDIA fallback, then used GPT-5.4 through `/v1/chat/completions` with function tools plus non-none reasoning effort; the provider rejected that contract. `ContextualWisdomLab/.github#1350` repaired the GPT-5.4 tool/reasoning contract in commit `f655a901f7ccdfef0d62694c818ad2896a2f5da1`. At that historical capture, `.github/main@1186a9f4e5eda7683b23ae63d2c806831743432a` contained that fix. PR #956 was then advanced through ordinary history to `e46a7aa3121c902ebcf9ea9d256a199659a482df` using the identical tree so fresh workflows could be created. This evidence remains historical and must be re-fetched before any current action. From e156730ed5370fd579c3a8813493c67c5191b054 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 20:47:18 +0900 Subject: [PATCH 55/80] docs(gap): refresh 74-repository PR census --- docs/product-technical-gap-baseline.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index b8d6cc8d9..9091d3dc0 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -46,9 +46,9 @@ The near-term product order remains: merge-train convergence; trusted distributi ## 2. Live delivery authority -A fresh complete accessible-repository sweep begun at **2026-09-02 18:30 KST** queried all **74** repositories currently visible under `ContextualWisdomLab` individually. The sequential per-repository counts summed to **2,914 open pull requests**. A later organization-wide aggregate returned **2,914 open pull requests** with `incomplete_results=false`. The matching totals are still non-atomic observations: PR creation and closure can occur during or after the sequential sweep, so this census remains dated evidence rather than permanent product truth. +A fresh complete accessible-repository sweep begun at **2026-09-02 20:30 KST** queried all **74** repositories currently visible under `ContextualWisdomLab` individually. The sequential per-repository counts summed to **2,934 open pull requests**. A subsequent organization-wide aggregate also returned **2,934 open pull requests** with `incomplete_results=false`. The matching totals are still non-atomic observations: PR creation and closure can occur during or after the sequential sweep, so this census remains dated evidence rather than permanent product truth. -At this census `ContextualWisdomLab/bandscope` had **193 open pull requests** and a fresh issue search returned **19 open issues**, so it remains the selected delivery boundary. Fresh high-backlog peers were `ContextualWisdomLab/naruon` (146), `ContextualWisdomLab/OriginWeave` (142), `ContextualWisdomLab/pg-erd-cloud` (137), `ContextualWisdomLab/newsdom-api` (137), `ContextualWisdomLab/TEPP` (130), `ContextualWisdomLab/html4tree` (127), `ContextualWisdomLab/.github` (123), `ContextualWisdomLab/Orgmetra` (117), and `ContextualWisdomLab/LineageWeave` (112). BandScope is selected not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. +At this census `ContextualWisdomLab/bandscope` had **193 open pull requests** and a fresh issue search returned **19 open issues**, so it remains the selected delivery boundary. Fresh high-backlog peers were `ContextualWisdomLab/naruon` (147), `ContextualWisdomLab/OriginWeave` (142), `ContextualWisdomLab/newsdom-api` (139), `ContextualWisdomLab/pg-erd-cloud` (138), `ContextualWisdomLab/TEPP` (130), `ContextualWisdomLab/.github` (128), `ContextualWisdomLab/html4tree` (127), `ContextualWisdomLab/Orgmetra` (117), and `ContextualWisdomLab/LineageWeave` (113). BandScope is selected not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. The exact 74-repository set for this same capture is enumerated verbatim in `docs/doctoring/product-gap-baseline-2026-09-01.md`; capitalization there is the GitHub repository identity and is not normalized. Because PR creation and closure can occur during a sequential organization census, later counts are historical observations unless a new complete sweep is performed. @@ -97,7 +97,7 @@ Backlog convergence is the primary engineering risk because micro-PR fan-out cre PR #968 owns the unique executable queue machinery needed by #966: bounded GitHub pagination, exact active-head capture, independent base-tip resolution, deterministic ordering, malformed/incomplete/duplicate rejection, symlink-safe atomic publication, reviewed dependency/succession metadata, network-independent validation, deterministic human projection/parity, and exact-head artifact preservation. It must not be discarded as stale documentation. -Current identities are deliberately separated rather than conflated. At this pre-write audit, canonical baseline PR #1116 was `docs/gap-baseline-2026-08-31@cdc9d2b27ed7c9c81a49bd7dd6279d79de7f73a9`, base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. A fresh GitHub read of PR #968 reported queue head `docs/bandscope-product-readiness-baseline@9f25cf669eaaad7e1e2296463a73eb2c5620dc66` and base SHA exactly `cdc9d2b27ed7c9c81a49bd7dd6279d79de7f73a9` for base branch `docs/gap-baseline-2026-08-31`; GitHub currently reports that stack mergeable. Any later #1116 advance changes the target tip and therefore requires fresh #968 base/check/review evidence even when its unique queue-control source remains intact. +Current identities are deliberately separated rather than conflated. At the immediately pre-write audit, canonical baseline PR #1116 was `docs/gap-baseline-2026-08-31@0335ba3d6d13086ab64dbf4af54d177f841fa39d`, base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. A fresh GitHub read of PR #968 reported queue head `docs/bandscope-product-readiness-baseline@9f25cf669eaaad7e1e2296463a73eb2c5620dc66`, base branch `docs/gap-baseline-2026-08-31`, and recorded base SHA `cdc9d2b27ed7c9c81a49bd7dd6279d79de7f73a9`. Because the canonical baseline tip had already advanced beyond that recorded base SHA, the stack requires ordinary non-force reconciliation before #968 can claim current-base exact-head evidence even though GitHub still reports it mergeable. Any later #1116 advance again changes the target tip and therefore requires fresh #968 base/check/review evidence while preserving its unique queue-control source. PR #1117 is a separate lane: `refactor/temporal-features-api@b98f266d2356d56be624fb617580b5252e85baaa`, base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. Its visible review threads are independently resolved; that review evidence belongs to #1117 and never substitutes for #1116 or #968 evidence. #1117 does not own `docs/product-technical-gap-baseline.md`, so no canonical baseline document blob is attributed to its exact ref. From d68a809f8847bc3fd4cf7991b302f9d3b993fd63 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 20:49:06 +0900 Subject: [PATCH 56/80] docs(doctoring): record current backlog evidence --- .../product-gap-baseline-2026-09-01.md | 39 +++---------------- 1 file changed, 6 insertions(+), 33 deletions(-) diff --git a/docs/doctoring/product-gap-baseline-2026-09-01.md b/docs/doctoring/product-gap-baseline-2026-09-01.md index b3a38231d..c60d955b5 100644 --- a/docs/doctoring/product-gap-baseline-2026-09-01.md +++ b/docs/doctoring/product-gap-baseline-2026-09-01.md @@ -6,9 +6,9 @@ This note records why `docs/product-technical-gap-baseline.md` is maintained on ## Current live-state correction — 2026-09-02 -Protected BandScope source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep begun at **2026-09-02 18:30 KST** queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,914 open pull requests**. A later organization-wide aggregate returned **2,914 open pull requests** with `incomplete_results=false`. Matching totals do not make the observation atomic: PR creation and closure can occur during or after a sequential census, so the result remains dated evidence rather than permanent product truth. +Protected BandScope source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep begun at **2026-09-02 20:30 KST** queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,934 open pull requests**. A subsequent organization-wide aggregate also returned **2,934 open pull requests** with `incomplete_results=false`. Matching totals do not make the observation atomic: PR creation and closure can occur during or after a sequential census, so the result remains dated evidence rather than permanent product truth. -`ContextualWisdomLab/bandscope` was the highest observed backlog at **193 open pull requests** and a fresh issue search returned **19 open issues**. Fresh high-backlog peers were `ContextualWisdomLab/naruon` 146, `ContextualWisdomLab/OriginWeave` 142, `ContextualWisdomLab/pg-erd-cloud` 137, `ContextualWisdomLab/newsdom-api` 137, `ContextualWisdomLab/TEPP` 130, `ContextualWisdomLab/html4tree` 127, `ContextualWisdomLab/.github` 123, `ContextualWisdomLab/Orgmetra` 117, and `ContextualWisdomLab/LineageWeave` 112. BandScope remains selected by both backlog and product responsibility: it owns the buyer-facing local-first rehearsal/audio path plus high-leverage release, security, persistence, workflow, and shared-contract boundaries. +`ContextualWisdomLab/bandscope` was the highest observed backlog at **193 open pull requests** and a fresh issue search returned **19 open issues**. Fresh high-backlog peers were `ContextualWisdomLab/naruon` 147, `ContextualWisdomLab/OriginWeave` 142, `ContextualWisdomLab/newsdom-api` 139, `ContextualWisdomLab/pg-erd-cloud` 138, `ContextualWisdomLab/TEPP` 130, `ContextualWisdomLab/.github` 128, `ContextualWisdomLab/html4tree` 127, `ContextualWisdomLab/Orgmetra` 117, and `ContextualWisdomLab/LineageWeave` 113. BandScope remains selected by both backlog and product responsibility: it owns the buyer-facing local-first rehearsal/audio path plus high-leverage release, security, persistence, workflow, and shared-contract boundaries. The accessible repository set for this capture was: `ContextualWisdomLab/kaefa`, `ContextualWisdomLab/aFIPC`, `ContextualWisdomLab/nonnest2`, `ContextualWisdomLab/html4tree`, `ContextualWisdomLab/mightyETL`, `ContextualWisdomLab/xtrmLLMBatchPython`, `ContextualWisdomLab/pg-erd-cloud`, `ContextualWisdomLab/clearfolio`, `ContextualWisdomLab/bandscope`, `ContextualWisdomLab/newsdom-api`, `ContextualWisdomLab/scopeweave`, `ContextualWisdomLab/naruon`, `ContextualWisdomLab/linux-cluster-ops`, `ContextualWisdomLab/argos`, `ContextualWisdomLab/codec-carver`, `ContextualWisdomLab/appguardrail`, `ContextualWisdomLab/vooster`, `ContextualWisdomLab/.github`, `ContextualWisdomLab/ContextualWisdomLab.github.io`, `ContextualWisdomLab/seedream_evasepic`, `ContextualWisdomLab/contextual-orchestrator`, `ContextualWisdomLab/hyosung-itx-slogan-brief`, `ContextualWisdomLab/fast-mlsirm`, `ContextualWisdomLab/semantic-data-portal`, `ContextualWisdomLab/noema`, `ContextualWisdomLab/wardnet`, `ContextualWisdomLab/feelanet-adfs`, `ContextualWisdomLab/gyeot`, `ContextualWisdomLab/pg-llm-batch`, `ContextualWisdomLab/keyverse`, `ContextualWisdomLab/inkspan`, `ContextualWisdomLab/disksage`, `ContextualWisdomLab/free-router`, `ContextualWisdomLab/RankWeave`, `ContextualWisdomLab/ThreadWeave`, `ContextualWisdomLab/EgressWeave`, `ContextualWisdomLab/IRT-bibliography-set`, `ContextualWisdomLab/g7`, `ContextualWisdomLab/saju-caldav`, `ContextualWisdomLab/xtrm-lead-pi-outbound`, `ContextualWisdomLab/ccube-jco-potential-customer`, `ContextualWisdomLab/9drive`, `ContextualWisdomLab/macos_utility_packs`, `ContextualWisdomLab/OmniRoute`, `ContextualWisdomLab/graphify`, `ContextualWisdomLab/life-os`, `ContextualWisdomLab/four-pillars`, `ContextualWisdomLab/DiagramWeave`, `ContextualWisdomLab/trivy-sarif-repro`, `ContextualWisdomLab/TEPP`, `ContextualWisdomLab/OriginWeave`, `ContextualWisdomLab/EmbedRelay`, `ContextualWisdomLab/mhtml-etl-gateway`, `ContextualWisdomLab/psychometrics-commons`, `ContextualWisdomLab/LineageWeave`, `ContextualWisdomLab/Orgmetra`, `ContextualWisdomLab/enterprise-architecture-core`, `ContextualWisdomLab/context-graph-contracts`, `ContextualWisdomLab/metering-billing-platform`, `ContextualWisdomLab/accounting-information-platform`, `ContextualWisdomLab/quarantine-sandbox-runtime`, `ContextualWisdomLab/governance-risk-compliance`, `ContextualWisdomLab/CalendarWeave`, `ContextualWisdomLab/j-planner`, `ContextualWisdomLab/learning-interoperability-contracts`, `ContextualWisdomLab/learning-record-store`, `ContextualWisdomLab/learning-management-platform`, `ContextualWisdomLab/learning-content-studio`, `ContextualWisdomLab/ELUNVERA`, `ContextualWisdomLab/PolicyWeave`, `ContextualWisdomLab/litellm-patched-proxy`, `ContextualWisdomLab/pingora-gateway`, `ContextualWisdomLab/ConceptWeave`, and `ContextualWisdomLab/supply-chain-control-plane`. @@ -18,7 +18,7 @@ Volatile queue counts are dated evidence, not product truth. Every branch advanc A source-integrity defect was verified on predecessor #1116 head `f6207ef2cadadb5d3852e0595ab2f0b62e20a06b`. That census-only commit unintentionally removed 83 lines from `docs/product-technical-gap-baseline.md` and left the canonical product/technical contract ending immediately after §7.4. The deleted material included the identifier-policy migration boundary, Rust compute ownership, real-audio scientific acceptance, security/privacy, UI/UX evidence, quality/operability, release-gate, and traceability sections. -The parent `adbd9df394957ee1a2c68893b8a6025cdcf058c9` was inspected as recovery evidence before editing. The canonical branch then advanced through ordinary non-force history to `ec67371791c653eed21705600775c06ecd531cc7`, restoring the lost contract. In the current 18:30 KST cycle, #1116 was re-fetched at `docs/gap-baseline-2026-08-31@cdc9d2b27ed7c9c81a49bd7dd6279d79de7f73a9`, base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`, before the live census/control-plane repair advanced it through ordinary history to `0dc29d61a9e24663195e5c3c51737a598749aa55`. A document cannot truthfully self-embed the SHA of the commit that contains that self-reference, so successor head identity is always fetched from GitHub immediately after each write rather than inferred from prose. +The parent `adbd9df394957ee1a2c68893b8a6025cdcf058c9` was inspected as recovery evidence before editing. The canonical branch then advanced through ordinary non-force history to `ec67371791c653eed21705600775c06ecd531cc7`, restoring the lost contract. Historical 18:30 KST evidence recorded #1116 at `docs/gap-baseline-2026-08-31@cdc9d2b27ed7c9c81a49bd7dd6279d79de7f73a9` before subsequent repairs. In the current census correction, #1116 was re-fetched unchanged at `0335ba3d6d13086ab64dbf4af54d177f841fa39d`, then the canonical baseline advanced by ordinary non-force commit `e156730ed5370fd579c3a8813493c67c5191b054` with exactly three additions and three deletions: the 74-repository/2,934-PR census, high-backlog peer counts, and stale #968 stack evidence. A document cannot truthfully self-embed the SHA of the commit that contains that self-reference, so successor head identity is always fetched from GitHub immediately after each write rather than inferred from prose. The restored baseline carries the buyer PRD, end-to-end stories, DDD bounded contexts/context map/ubiquitous language/domain events, TRD topology and transport diagrams, persistence/versioning rules, organization naming and database migration rules, Rust-first compute ownership, persistence ERD discipline, rights-safe real-audio scientific acceptance, security/privacy, Storybook/Figma/shipped accessibility evidence, the 100% quality floor, release acceptance, and APA traceability. The current repair preserved that complete contract while refreshing the census, protected-branch evidence, merge-train identities, and organization queue RCA. It also preserves the project-recovery origin state model: recovery begun without a source fails back to `NoSource`, while recovery begun with an admitted source fails back to `Ready` without manufacturing successful recovery. @@ -52,11 +52,11 @@ The protected `.bscope` documentation currently describes structural schema vali ## Queue and causal-owner evidence -Issue #966 remains the dependency-aware merge-train control plane, while PR #968 retains unique executable queue machinery: bounded pagination, exact active-head capture, independently resolved target tips, deterministic ordering, malformed/incomplete/duplicate rejection, network-independent validation, and symlink-safe atomic publication. Immediately before the current baseline write, #968 was `docs/bandscope-product-readiness-baseline@9f25cf669eaaad7e1e2296463a73eb2c5620dc66` with base branch `docs/gap-baseline-2026-08-31` and recorded base SHA `cdc9d2b27ed7c9c81a49bd7dd6279d79de7f73a9`; GitHub reported the stack mergeable. Advancing #1116 changes that target tip, so #968 must be freshly re-read and, if necessary, reconciled by ordinary non-force history without losing its unique queue-control/test tree. Predecessor checks and reviews do not transfer merely because the stack remains mergeable. +Issue #966 remains the dependency-aware merge-train control plane, while PR #968 retains unique executable queue machinery: bounded pagination, exact active-head capture, independently resolved target tips, deterministic ordering, malformed/incomplete/duplicate rejection, network-independent validation, and symlink-safe atomic publication. Immediately before the current baseline write, #968 was `docs/bandscope-product-readiness-baseline@9f25cf669eaaad7e1e2296463a73eb2c5620dc66` with base branch `docs/gap-baseline-2026-08-31` and recorded base SHA `cdc9d2b27ed7c9c81a49bd7dd6279d79de7f73a9`, while #1116 had already advanced to `0335ba3d6d13086ab64dbf4af54d177f841fa39d`; GitHub still reported #968 mergeable. The baseline census repair then advanced #1116 again to `e156730ed5370fd579c3a8813493c67c5191b054`. Therefore #968 requires fresh ordinary non-force reconciliation to the canonical base while preserving its unique queue-control/test tree. Predecessor checks and reviews do not transfer merely because the stack remains mergeable. The baseline owner #1116 and temporal-analysis PR #1117 are separate evidence lanes. PR #1117's previously recorded `refactor/temporal-features-api@b98f266d2356d56be624fb617580b5252e85baaa` metadata and review state are historical in this cycle; that evidence never constitutes #1116 or #968 readiness. -Repository-local Trivy PR-head configuration remains owned by open BandScope #1119. Its freshly audited exact head was `fix/trivy-pr-code-scanning@bb3a9735a00a64347e8a5d0e3f2d92243bdbc585`. Its stale push-only policy test and intended Trivy `pull_request` contract have already been repaired on that canonical branch; visible review threads were resolved at audit, while queued/non-terminal exact-head jobs remain non-passing and are not spam-rerun. +Repository-local Trivy PR-head configuration remains owned by open BandScope #1119. Its freshly audited exact head is `fix/trivy-pr-code-scanning@bb3a9735a00a64347e8a5d0e3f2d92243bdbc585`. Its PR-body `current head` text still names predecessor `b005ae91cb0e41753554c2cea7627c7063207656`, so that metadata must be repaired separately without pretending predecessor checks transfer. Its stale push-only policy test and intended Trivy `pull_request` contract have already been repaired on the canonical branch; visible review threads were resolved at audit, while queued/non-terminal exact-head jobs remain non-passing and are not spam-rerun. The latest protected central control-plane evidence revalidated in this cycle is `ContextualWisdomLab/.github@f610598c585d8dfdabe6fd82204173e23ad09841`. Issue `.github#712` remains the organization-wide runner-admission/queue-health owner. Cross-repository evidence shows jobs waiting before checkout with no runner assignment on both `ubuntu-latest` and explicit `ubuntu-24.04`, including the same Wardnet exact head that previously completed successfully on the same explicit label. That falsifies a simple leaf runner-label or source-code defect but does not by itself identify hosted-runner capacity, organization concurrency/admission policy, billing/quota, or provider scheduling as the final cause. Recent protected scheduler fixes, including #1712's rejected-cancellation accounting repair, reduce avoidable duplicate-dispatch ambiguity but do not convert queued exact-head evidence into success. @@ -72,35 +72,8 @@ This documentation change introduces no new runtime authority. The durable secur ## Historical observations and RCA -Historical queue observations remain useful only as dated evidence. On 2026-09-01 10:31 KST BandScope had 190 open pull requests. At 2026-09-01 13:29 KST, 72 repositories were visible and an organization recount reported 2,697 open pull requests, with BandScope at 188. Later 2026-09-02 sweeps observed 2,827/2,834 and 185 BandScope, 2,856/2,855 and 194 BandScope, then 2,865/2,866 and 196 BandScope, then 2,889/2,889 and 196 BandScope, then 2,894/2,894 and 196 BandScope, then 2,894/2,894 and 193 BandScope, then 2,907/2,908 and 193 BandScope, before the current **2,914 sequential / 2,914 aggregate and 193 BandScope** capture. None may be reused as an undated permanent count. +Historical queue observations remain useful only as dated evidence. On 2026-09-01 10:31 KST BandScope had 190 open pull requests. At 2026-09-01 13:29 KST, 72 repositories were visible and an organization recount reported 2,697 open pull requests, with BandScope at 188. Later 2026-09-02 sweeps observed 2,827/2,834 and 185 BandScope, 2,856/2,855 and 194 BandScope, then 2,865/2,866 and 196 BandScope, then 2,889/2,889 and 196 BandScope, then 2,894/2,894 and 196 BandScope, then 2,894/2,894 and 193 BandScope, then 2,907/2,908 and 193 BandScope, then 2,914/2,914 and 193 BandScope, before the current **2,934 sequential / 2,934 aggregate and 193 BandScope** capture. None may be reused as an undated permanent count. Review findings previously validated on #1116 included stale PR evidence, a false repository-wide Mermaid-absence claim, stale product-owner issue numbers, and prose-inherited live Noema/PR claims. In this cycle a fresh reviewer also reported that the documentation gate lacked four project-recovery transitions. Exact-head revalidation showed the finding had already become stale: `scripts/checks/verify_docs.py` requires the four origin-preserving transitions and the canonical baseline contains all four exactly. The stale thread was answered with exact-head evidence and resolved without weakening the checker or churning correct source. A historical review-gate example remains instructive. PR #956 once had a predecessor exact-head Strix failure unrelated to its articulation privacy code. The central workflow exhausted the NVIDIA primary, encountered an EOL NVIDIA fallback, then used GPT-5.4 through `/v1/chat/completions` with function tools plus non-none reasoning effort; the provider rejected that contract. `ContextualWisdomLab/.github#1350` repaired the GPT-5.4 tool/reasoning contract in commit `f655a901f7ccdfef0d62694c818ad2896a2f5da1`. At that historical capture, `.github/main@1186a9f4e5eda7683b23ae63d2c806831743432a` contained that fix. PR #956 was then advanced through ordinary history to `e46a7aa3121c902ebcf9ea9d256a199659a482df` using the identical tree so fresh workflows could be created. This evidence remains historical and must be re-fetched before any current action. - -PR #1117 similarly demonstrated that the queue cannot be truthfully summarized as “all code checks fail”: at its historical capture, exact head `b98f266d2356d56be624fb617580b5252e85baaa` had successful repository CI/release/security/SBOM workflows while `opencode-review` remained in progress. Pending was still non-passing, but it had a different cause from older blanket claims. - -## Research / standards review - -The baseline uses current authoritative standards/research as acceptance anchors rather than decorative citations: - -- ISO/IEC 25010:2023 defines the current SQuaRE product-quality model and supports requirements, design objectives, testing objectives, acceptance criteria, and product-quality evaluation. -- NIST SP 800-218 SSDF v1.1 emphasizes tracked security requirements/design decisions, provenance, and root-cause-oriented secure development. -- WCAG 2.2 is a W3C Recommendation covering focus visibility, dragging alternatives, target size, consistent help, redundant entry, accessible authentication, and the broader accessibility baseline required by the product. -- MIREX real-recording evaluation practice supports rights-safe production-path MIR evidence rather than synthetic-only accuracy claims. - -### APA 7th references - -International Organization for Standardization, & International Electrotechnical Commission. (2023). *ISO/IEC 25010:2023 Systems and software engineering—Systems and software Quality Requirements and Evaluation (SQuaRE)—Product quality model* (2nd ed.). ISO. - -Music Information Retrieval Evaluation eXchange. (2025). *Audio beat tracking*. MIREX Wiki. https://music-ir.org/mirex/wiki/2025:Audio_Beat_Tracking - -Souppaya, M., Scarfone, K., & Dodson, D. (2022). *Secure Software Development Framework (SSDF) Version 1.1: Recommendations for mitigating the risk of software vulnerabilities* (NIST Special Publication 800-218). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-218 - -World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines (WCAG) 2.2*. https://www.w3.org/TR/WCAG22/ - -## Decision - -PR #1116 remains the canonical baseline owner. Its source contains the complete recovered PRD/TRD/DDD/naming/Rust/science/security/UI/quality/release/traceability contract plus current delivery evidence. PR #1025 is an older competing owner of the same path; it may only be closed as superseded when every unique semantic requirement remains executable or represented in the canonical source and its discussion history is preserved. - -Future loops should refresh live counts and exact-head evidence when they materially change prioritization or causal ownership. They must not rewrite stable product/architecture sections merely to chase a volatile PR number, and they must never repeat the predecessor truncation failure by replacing a complete canonical document with a partial census fragment. \ No newline at end of file From 02c4607aa2256e07b64cc9c50df8bca18a9e4f8f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 20:50:47 +0900 Subject: [PATCH 57/80] docs(doctoring): restore research traceability tail --- .../product-gap-baseline-2026-09-01.md | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/docs/doctoring/product-gap-baseline-2026-09-01.md b/docs/doctoring/product-gap-baseline-2026-09-01.md index c60d955b5..9ed1eb4b4 100644 --- a/docs/doctoring/product-gap-baseline-2026-09-01.md +++ b/docs/doctoring/product-gap-baseline-2026-09-01.md @@ -77,3 +77,30 @@ Historical queue observations remain useful only as dated evidence. On 2026-09-0 Review findings previously validated on #1116 included stale PR evidence, a false repository-wide Mermaid-absence claim, stale product-owner issue numbers, and prose-inherited live Noema/PR claims. In this cycle a fresh reviewer also reported that the documentation gate lacked four project-recovery transitions. Exact-head revalidation showed the finding had already become stale: `scripts/checks/verify_docs.py` requires the four origin-preserving transitions and the canonical baseline contains all four exactly. The stale thread was answered with exact-head evidence and resolved without weakening the checker or churning correct source. A historical review-gate example remains instructive. PR #956 once had a predecessor exact-head Strix failure unrelated to its articulation privacy code. The central workflow exhausted the NVIDIA primary, encountered an EOL NVIDIA fallback, then used GPT-5.4 through `/v1/chat/completions` with function tools plus non-none reasoning effort; the provider rejected that contract. `ContextualWisdomLab/.github#1350` repaired the GPT-5.4 tool/reasoning contract in commit `f655a901f7ccdfef0d62694c818ad2896a2f5da1`. At that historical capture, `.github/main@1186a9f4e5eda7683b23ae63d2c806831743432a` contained that fix. PR #956 was then advanced through ordinary history to `e46a7aa3121c902ebcf9ea9d256a199659a482df` using the identical tree so fresh workflows could be created. This evidence remains historical and must be re-fetched before any current action. + +PR #1117 similarly demonstrated that the queue cannot be truthfully summarized as “all code checks fail”: at its historical capture, exact head `b98f266d2356d56be624fb617580b5252e85baaa` had successful repository CI/release/security/SBOM workflows while `opencode-review` remained in progress. Pending was still non-passing, but it had a different cause from older blanket claims. + +## Research / standards review + +The baseline uses current authoritative standards/research as acceptance anchors rather than decorative citations: + +- ISO/IEC 25010:2023 defines the current SQuaRE product-quality model and supports requirements, design objectives, testing objectives, acceptance criteria, and product-quality evaluation. +- NIST SP 800-218 SSDF v1.1 emphasizes tracked security requirements/design decisions, provenance, and root-cause-oriented secure development. +- WCAG 2.2 is a W3C Recommendation covering focus visibility, dragging alternatives, target size, consistent help, redundant entry, accessible authentication, and the broader accessibility baseline required by the product. +- MIREX real-recording evaluation practice supports rights-safe production-path MIR evidence rather than synthetic-only accuracy claims. + +### APA 7th references + +International Organization for Standardization, & International Electrotechnical Commission. (2023). *ISO/IEC 25010:2023 Systems and software engineering—Systems and software Quality Requirements and Evaluation (SQuaRE)—Product quality model* (2nd ed.). ISO. + +Music Information Retrieval Evaluation eXchange. (2025). *Audio beat tracking*. MIREX Wiki. https://music-ir.org/mirex/wiki/2025:Audio_Beat_Tracking + +Souppaya, M., Scarfone, K., & Dodson, D. (2022). *Secure Software Development Framework (SSDF) Version 1.1: Recommendations for mitigating the risk of software vulnerabilities* (NIST Special Publication 800-218). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-218 + +World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines (WCAG) 2.2*. https://www.w3.org/TR/WCAG22/ + +## Decision + +PR #1116 remains the canonical baseline owner. Its source contains the complete recovered PRD/TRD/DDD/naming/Rust/science/security/UI/quality/release/traceability contract plus current delivery evidence. PR #1025 is an older competing owner of the same path; it may only be closed as superseded when every unique semantic requirement remains executable or represented in the canonical source and its discussion history is preserved. + +Future loops should refresh live counts and exact-head evidence when they materially change prioritization or causal ownership. They must not rewrite stable product/architecture sections merely to chase a volatile PR number, and they must never repeat the predecessor truncation failure by replacing a complete canonical document with a partial census fragment. From 4760123ee8d773f909de9e4551de126b4ce15cb6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 21:08:30 +0900 Subject: [PATCH 58/80] test(docs): require recovery transitions in state diagram --- scripts/checks/test_verify_docs.py | 56 ++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 scripts/checks/test_verify_docs.py diff --git a/scripts/checks/test_verify_docs.py b/scripts/checks/test_verify_docs.py new file mode 100644 index 000000000..9f2e4ebaa --- /dev/null +++ b/scripts/checks/test_verify_docs.py @@ -0,0 +1,56 @@ +"""Regression tests for structured documentation verification.""" + +import importlib.util +from pathlib import Path +import unittest + +MODULE_PATH = Path(__file__).with_name("verify_docs.py") +SPEC = importlib.util.spec_from_file_location("verify_docs", MODULE_PATH) +if SPEC is None or SPEC.loader is None: + raise RuntimeError(f"Unable to load {MODULE_PATH}") +VERIFY_DOCS = importlib.util.module_from_spec(SPEC) +SPEC.loader.exec_module(VERIFY_DOCS) + +RECOVERY_TRANSITIONS = ( + "NoSource --> RecoveringWithoutSource: project recovery requested", + "Ready --> RecoveringWithSource: project recovery requested", + "RecoveryFailedWithoutSource --> NoSource: recovery failure acknowledged", + "RecoveryFailedWithSource --> Ready: recovery failure acknowledged / keep prior source", +) + + +class StateDiagramReferenceTests(unittest.TestCase): + """Keep recovery transitions inside the executable Mermaid state model.""" + + def test_rejects_transition_text_that_only_exists_in_prose(self) -> None: + """Prose copies must not satisfy state-diagram structural requirements.""" + prose_only = "\n".join(RECOVERY_TRANSITIONS) + + missing = VERIFY_DOCS.missing_state_diagram_references( + prose_only, + RECOVERY_TRANSITIONS, + ) + + self.assertEqual(missing, list(RECOVERY_TRANSITIONS)) + + def test_accepts_transitions_in_state_diagram(self) -> None: + """A Mermaid stateDiagram-v2 containing every transition satisfies the gate.""" + diagram = "\n".join( + ( + "```mermaid", + "stateDiagram-v2", + *(f" {transition}" for transition in RECOVERY_TRANSITIONS), + "```", + ) + ) + + missing = VERIFY_DOCS.missing_state_diagram_references( + diagram, + RECOVERY_TRANSITIONS, + ) + + self.assertEqual(missing, []) + + +if __name__ == "__main__": + unittest.main() From 1d8098e3dd62e96e0b9e4b32168269aa7bff1dd2 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 21:08:52 +0900 Subject: [PATCH 59/80] test(docs): run structured verification regression --- scripts/harness/quickcheck.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/scripts/harness/quickcheck.sh b/scripts/harness/quickcheck.sh index f2b87e4e8..185fe7aba 100755 --- a/scripts/harness/quickcheck.sh +++ b/scripts/harness/quickcheck.sh @@ -4,6 +4,7 @@ set -euo pipefail REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" cd "$REPO_ROOT" +python3 scripts/checks/test_verify_docs.py python3 scripts/checks/verify_docs.py python3 scripts/checks/verify_security_notes.py python3 scripts/checks/security_gates.py From 17b53f4b2b6afb37405c4001b3d6435026502897 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 21:09:33 +0900 Subject: [PATCH 60/80] fix(docs): validate recovery transitions inside state diagram --- scripts/checks/verify_docs.py | 63 +++++++++++++++++++++++++++++++++-- 1 file changed, 61 insertions(+), 2 deletions(-) diff --git a/scripts/checks/verify_docs.py b/scripts/checks/verify_docs.py index 417567ac7..addaef2df 100644 --- a/scripts/checks/verify_docs.py +++ b/scripts/checks/verify_docs.py @@ -1,6 +1,7 @@ """Verify that required repository documentation files and references exist.""" from pathlib import Path +from collections.abc import Sequence REQUIRED_PATHS = [ Path("README.md"), @@ -59,15 +60,63 @@ "docs/security/cross-platform-build-policy.md", "docs/workflow/github-bootstrap-execution-policy.md", ], - Path("docs/product-technical-gap-baseline.md"): [ +} + +REQUIRED_STATE_DIAGRAM_REFERENCES = { + Path("docs/product-technical-gap-baseline.md"): ( "NoSource --> RecoveringWithoutSource: project recovery requested", "Ready --> RecoveringWithSource: project recovery requested", "RecoveryFailedWithoutSource --> NoSource: recovery failure acknowledged", "RecoveryFailedWithSource --> Ready: recovery failure acknowledged / keep prior source", - ], + ), } +def mermaid_state_diagrams(content: str) -> list[str]: + """Return only closed Mermaid fences whose diagram type is stateDiagram-v2.""" + diagrams: list[str] = [] + lines = content.splitlines() + index = 0 + + while index < len(lines): + if lines[index].strip() != "```mermaid": + index += 1 + continue + + index += 1 + block: list[str] = [] + closed = False + while index < len(lines): + if lines[index].strip() == "```": + closed = True + break + block.append(lines[index]) + index += 1 + + if closed: + first_content_line = next( + (line.strip() for line in block if line.strip()), + "", + ) + if first_content_line == "stateDiagram-v2": + diagrams.append("\n".join(block)) + + index += 1 + + return diagrams + + +def missing_state_diagram_references( + content: str, + required_texts: Sequence[str], +) -> list[str]: + """Require related transitions to coexist in one Mermaid state diagram.""" + diagrams = mermaid_state_diagrams(content) + if any(all(required_text in diagram for required_text in required_texts) for diagram in diagrams): + return [] + return list(required_texts) + + def main() -> int: """Return a failing exit code when required docs or references are missing.""" missing = [str(path) for path in REQUIRED_PATHS if not path.exists()] @@ -76,6 +125,7 @@ def main() -> int: for path in missing: print(f"- {path}") return 1 + broken_refs: list[str] = [] for path, required_texts in REQUIRED_REFERENCES.items(): content = path.read_text(encoding="utf-8") @@ -83,6 +133,15 @@ def main() -> int: if required_text not in content: broken_refs.append(f"{path} missing reference: {required_text}") + for path, required_texts in REQUIRED_STATE_DIAGRAM_REFERENCES.items(): + content = path.read_text(encoding="utf-8") + missing_transitions = missing_state_diagram_references(content, required_texts) + if missing_transitions: + broken_refs.append( + f"{path} missing required transitions from one Mermaid stateDiagram-v2: " + + "; ".join(missing_transitions) + ) + if broken_refs: print("Missing required doc references:") for item in broken_refs: From 2958dab046a2bf6bc5fc752d29ae4206fc67e094 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 22:12:13 +0900 Subject: [PATCH 61/80] docs(gap): refresh 74-repository live census --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 9091d3dc0..b7e1e56e0 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -46,9 +46,9 @@ The near-term product order remains: merge-train convergence; trusted distributi ## 2. Live delivery authority -A fresh complete accessible-repository sweep begun at **2026-09-02 20:30 KST** queried all **74** repositories currently visible under `ContextualWisdomLab` individually. The sequential per-repository counts summed to **2,934 open pull requests**. A subsequent organization-wide aggregate also returned **2,934 open pull requests** with `incomplete_results=false`. The matching totals are still non-atomic observations: PR creation and closure can occur during or after the sequential sweep, so this census remains dated evidence rather than permanent product truth. +A fresh complete accessible-repository sweep begun at **2026-09-02 21:56 KST** queried all **74** repositories currently visible under `ContextualWisdomLab` individually. The sequential per-repository counts summed to **2,940 open pull requests**. A subsequent organization-wide aggregate returned **2,941 open pull requests** with `incomplete_results=false`. The one-PR difference is a non-atomic observation, not attribution to a particular repository: PR creation and closure can occur during or after the sequential sweep, so this census remains dated evidence rather than permanent product truth. -At this census `ContextualWisdomLab/bandscope` had **193 open pull requests** and a fresh issue search returned **19 open issues**, so it remains the selected delivery boundary. Fresh high-backlog peers were `ContextualWisdomLab/naruon` (147), `ContextualWisdomLab/OriginWeave` (142), `ContextualWisdomLab/newsdom-api` (139), `ContextualWisdomLab/pg-erd-cloud` (138), `ContextualWisdomLab/TEPP` (130), `ContextualWisdomLab/.github` (128), `ContextualWisdomLab/html4tree` (127), `ContextualWisdomLab/Orgmetra` (117), and `ContextualWisdomLab/LineageWeave` (113). BandScope is selected not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. +At this census `ContextualWisdomLab/bandscope` had **194 open pull requests** and a fresh issue search returned **19 open issues**, so it remains the selected delivery boundary. Fresh high-backlog peers were `ContextualWisdomLab/naruon` (148), `ContextualWisdomLab/OriginWeave` (142), `ContextualWisdomLab/newsdom-api` (139), `ContextualWisdomLab/pg-erd-cloud` (138), `ContextualWisdomLab/TEPP` (130), `ContextualWisdomLab/.github` (128), `ContextualWisdomLab/html4tree` (127), `ContextualWisdomLab/Orgmetra` (117), and `ContextualWisdomLab/LineageWeave` (113). BandScope is selected not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. The exact 74-repository set for this same capture is enumerated verbatim in `docs/doctoring/product-gap-baseline-2026-09-01.md`; capitalization there is the GitHub repository identity and is not normalized. Because PR creation and closure can occur during a sequential organization census, later counts are historical observations unless a new complete sweep is performed. From 917bead17bf0df0a204b75bfe380c86deffd36f3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 22:15:15 +0900 Subject: [PATCH 62/80] docs(doctoring): record current organization census --- docs/doctoring/product-gap-baseline-2026-09-01.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/doctoring/product-gap-baseline-2026-09-01.md b/docs/doctoring/product-gap-baseline-2026-09-01.md index 9ed1eb4b4..23fde1ea0 100644 --- a/docs/doctoring/product-gap-baseline-2026-09-01.md +++ b/docs/doctoring/product-gap-baseline-2026-09-01.md @@ -6,9 +6,9 @@ This note records why `docs/product-technical-gap-baseline.md` is maintained on ## Current live-state correction — 2026-09-02 -Protected BandScope source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep begun at **2026-09-02 20:30 KST** queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,934 open pull requests**. A subsequent organization-wide aggregate also returned **2,934 open pull requests** with `incomplete_results=false`. Matching totals do not make the observation atomic: PR creation and closure can occur during or after a sequential census, so the result remains dated evidence rather than permanent product truth. +Protected BandScope source remains `develop@749511c3ad4000090048718f685c6bee6b3d2c25` at this capture. A fresh complete accessible-repository sweep begun at **2026-09-02 21:56 KST** queried all **74** currently visible `ContextualWisdomLab` repositories individually and summed **2,940 open pull requests**. A subsequent organization-wide aggregate returned **2,941 open pull requests** with `incomplete_results=false`. The one-PR difference is a non-atomic observation, not attribution to a particular repository: PR creation and closure can occur during or after a sequential census, so the result remains dated evidence rather than permanent product truth. -`ContextualWisdomLab/bandscope` was the highest observed backlog at **193 open pull requests** and a fresh issue search returned **19 open issues**. Fresh high-backlog peers were `ContextualWisdomLab/naruon` 147, `ContextualWisdomLab/OriginWeave` 142, `ContextualWisdomLab/newsdom-api` 139, `ContextualWisdomLab/pg-erd-cloud` 138, `ContextualWisdomLab/TEPP` 130, `ContextualWisdomLab/.github` 128, `ContextualWisdomLab/html4tree` 127, `ContextualWisdomLab/Orgmetra` 117, and `ContextualWisdomLab/LineageWeave` 113. BandScope remains selected by both backlog and product responsibility: it owns the buyer-facing local-first rehearsal/audio path plus high-leverage release, security, persistence, workflow, and shared-contract boundaries. +`ContextualWisdomLab/bandscope` was the highest observed backlog at **194 open pull requests** and a fresh issue search returned **19 open issues**. Fresh high-backlog peers were `ContextualWisdomLab/naruon` 148, `ContextualWisdomLab/OriginWeave` 142, `ContextualWisdomLab/newsdom-api` 139, `ContextualWisdomLab/pg-erd-cloud` 138, `ContextualWisdomLab/TEPP` 130, `ContextualWisdomLab/.github` 128, `ContextualWisdomLab/html4tree` 127, `ContextualWisdomLab/Orgmetra` 117, and `ContextualWisdomLab/LineageWeave` 113. BandScope remains selected by both backlog and product responsibility: it owns the buyer-facing local-first rehearsal/audio path plus high-leverage release, security, persistence, workflow, and shared-contract boundaries. The accessible repository set for this capture was: `ContextualWisdomLab/kaefa`, `ContextualWisdomLab/aFIPC`, `ContextualWisdomLab/nonnest2`, `ContextualWisdomLab/html4tree`, `ContextualWisdomLab/mightyETL`, `ContextualWisdomLab/xtrmLLMBatchPython`, `ContextualWisdomLab/pg-erd-cloud`, `ContextualWisdomLab/clearfolio`, `ContextualWisdomLab/bandscope`, `ContextualWisdomLab/newsdom-api`, `ContextualWisdomLab/scopeweave`, `ContextualWisdomLab/naruon`, `ContextualWisdomLab/linux-cluster-ops`, `ContextualWisdomLab/argos`, `ContextualWisdomLab/codec-carver`, `ContextualWisdomLab/appguardrail`, `ContextualWisdomLab/vooster`, `ContextualWisdomLab/.github`, `ContextualWisdomLab/ContextualWisdomLab.github.io`, `ContextualWisdomLab/seedream_evasepic`, `ContextualWisdomLab/contextual-orchestrator`, `ContextualWisdomLab/hyosung-itx-slogan-brief`, `ContextualWisdomLab/fast-mlsirm`, `ContextualWisdomLab/semantic-data-portal`, `ContextualWisdomLab/noema`, `ContextualWisdomLab/wardnet`, `ContextualWisdomLab/feelanet-adfs`, `ContextualWisdomLab/gyeot`, `ContextualWisdomLab/pg-llm-batch`, `ContextualWisdomLab/keyverse`, `ContextualWisdomLab/inkspan`, `ContextualWisdomLab/disksage`, `ContextualWisdomLab/free-router`, `ContextualWisdomLab/RankWeave`, `ContextualWisdomLab/ThreadWeave`, `ContextualWisdomLab/EgressWeave`, `ContextualWisdomLab/IRT-bibliography-set`, `ContextualWisdomLab/g7`, `ContextualWisdomLab/saju-caldav`, `ContextualWisdomLab/xtrm-lead-pi-outbound`, `ContextualWisdomLab/ccube-jco-potential-customer`, `ContextualWisdomLab/9drive`, `ContextualWisdomLab/macos_utility_packs`, `ContextualWisdomLab/OmniRoute`, `ContextualWisdomLab/graphify`, `ContextualWisdomLab/life-os`, `ContextualWisdomLab/four-pillars`, `ContextualWisdomLab/DiagramWeave`, `ContextualWisdomLab/trivy-sarif-repro`, `ContextualWisdomLab/TEPP`, `ContextualWisdomLab/OriginWeave`, `ContextualWisdomLab/EmbedRelay`, `ContextualWisdomLab/mhtml-etl-gateway`, `ContextualWisdomLab/psychometrics-commons`, `ContextualWisdomLab/LineageWeave`, `ContextualWisdomLab/Orgmetra`, `ContextualWisdomLab/enterprise-architecture-core`, `ContextualWisdomLab/context-graph-contracts`, `ContextualWisdomLab/metering-billing-platform`, `ContextualWisdomLab/accounting-information-platform`, `ContextualWisdomLab/quarantine-sandbox-runtime`, `ContextualWisdomLab/governance-risk-compliance`, `ContextualWisdomLab/CalendarWeave`, `ContextualWisdomLab/j-planner`, `ContextualWisdomLab/learning-interoperability-contracts`, `ContextualWisdomLab/learning-record-store`, `ContextualWisdomLab/learning-management-platform`, `ContextualWisdomLab/learning-content-studio`, `ContextualWisdomLab/ELUNVERA`, `ContextualWisdomLab/PolicyWeave`, `ContextualWisdomLab/litellm-patched-proxy`, `ContextualWisdomLab/pingora-gateway`, `ContextualWisdomLab/ConceptWeave`, and `ContextualWisdomLab/supply-chain-control-plane`. @@ -18,7 +18,7 @@ Volatile queue counts are dated evidence, not product truth. Every branch advanc A source-integrity defect was verified on predecessor #1116 head `f6207ef2cadadb5d3852e0595ab2f0b62e20a06b`. That census-only commit unintentionally removed 83 lines from `docs/product-technical-gap-baseline.md` and left the canonical product/technical contract ending immediately after §7.4. The deleted material included the identifier-policy migration boundary, Rust compute ownership, real-audio scientific acceptance, security/privacy, UI/UX evidence, quality/operability, release-gate, and traceability sections. -The parent `adbd9df394957ee1a2c68893b8a6025cdcf058c9` was inspected as recovery evidence before editing. The canonical branch then advanced through ordinary non-force history to `ec67371791c653eed21705600775c06ecd531cc7`, restoring the lost contract. Historical 18:30 KST evidence recorded #1116 at `docs/gap-baseline-2026-08-31@cdc9d2b27ed7c9c81a49bd7dd6279d79de7f73a9` before subsequent repairs. In the current census correction, #1116 was re-fetched unchanged at `0335ba3d6d13086ab64dbf4af54d177f841fa39d`, then the canonical baseline advanced by ordinary non-force commit `e156730ed5370fd579c3a8813493c67c5191b054` with exactly three additions and three deletions: the 74-repository/2,934-PR census, high-backlog peer counts, and stale #968 stack evidence. A document cannot truthfully self-embed the SHA of the commit that contains that self-reference, so successor head identity is always fetched from GitHub immediately after each write rather than inferred from prose. +The parent `adbd9df394957ee1a2c68893b8a6025cdcf058c9` was inspected as recovery evidence before editing. The canonical branch then advanced through ordinary non-force history to `ec67371791c653eed21705600775c06ecd531cc7`, restoring the lost contract. Historical 18:30 KST evidence recorded #1116 at `docs/gap-baseline-2026-08-31@cdc9d2b27ed7c9c81a49bd7dd6279d79de7f73a9` before subsequent repairs. A prior census correction advanced the canonical baseline through ordinary non-force commit `e156730ed5370fd579c3a8813493c67c5191b054` with exactly three additions and three deletions for the 74-repository/2,934-PR capture, high-backlog peer counts, and stale #968 stack evidence. The current 21:56 KST census was then applied directly to the unchanged canonical source in ordinary non-force commit `2958dab046a2bf6bc5fc752d29ae4206fc67e094`, preserving the complete durable contract while updating only live delivery evidence. A document cannot truthfully self-embed the SHA of the commit that contains that self-reference, so successor head identity is always fetched from GitHub immediately after each write rather than inferred from prose. The restored baseline carries the buyer PRD, end-to-end stories, DDD bounded contexts/context map/ubiquitous language/domain events, TRD topology and transport diagrams, persistence/versioning rules, organization naming and database migration rules, Rust-first compute ownership, persistence ERD discipline, rights-safe real-audio scientific acceptance, security/privacy, Storybook/Figma/shipped accessibility evidence, the 100% quality floor, release acceptance, and APA traceability. The current repair preserved that complete contract while refreshing the census, protected-branch evidence, merge-train identities, and organization queue RCA. It also preserves the project-recovery origin state model: recovery begun without a source fails back to `NoSource`, while recovery begun with an admitted source fails back to `Ready` without manufacturing successful recovery. @@ -52,7 +52,7 @@ The protected `.bscope` documentation currently describes structural schema vali ## Queue and causal-owner evidence -Issue #966 remains the dependency-aware merge-train control plane, while PR #968 retains unique executable queue machinery: bounded pagination, exact active-head capture, independently resolved target tips, deterministic ordering, malformed/incomplete/duplicate rejection, network-independent validation, and symlink-safe atomic publication. Immediately before the current baseline write, #968 was `docs/bandscope-product-readiness-baseline@9f25cf669eaaad7e1e2296463a73eb2c5620dc66` with base branch `docs/gap-baseline-2026-08-31` and recorded base SHA `cdc9d2b27ed7c9c81a49bd7dd6279d79de7f73a9`, while #1116 had already advanced to `0335ba3d6d13086ab64dbf4af54d177f841fa39d`; GitHub still reported #968 mergeable. The baseline census repair then advanced #1116 again to `e156730ed5370fd579c3a8813493c67c5191b054`. Therefore #968 requires fresh ordinary non-force reconciliation to the canonical base while preserving its unique queue-control/test tree. Predecessor checks and reviews do not transfer merely because the stack remains mergeable. +Issue #966 remains the dependency-aware merge-train control plane, while PR #968 retains unique executable queue machinery: bounded pagination, exact active-head capture, independently resolved target tips, deterministic ordering, malformed/incomplete/duplicate rejection, network-independent validation, and symlink-safe atomic publication. Immediately before the current baseline write, #968 was `docs/bandscope-product-readiness-baseline@9f25cf669eaaad7e1e2296463a73eb2c5620dc66` with base branch `docs/gap-baseline-2026-08-31` and recorded base SHA `cdc9d2b27ed7c9c81a49bd7dd6279d79de7f73a9`, while #1116 had already advanced to `0335ba3d6d13086ab64dbf4af54d177f841fa39d`; GitHub still reported #968 mergeable. The 20:30 census repair advanced #1116 to `e156730ed5370fd579c3a8813493c67c5191b054`, and the 21:56 census repair advanced it again to `2958dab046a2bf6bc5fc752d29ae4206fc67e094`. Therefore #968 requires fresh ordinary non-force reconciliation to the canonical base while preserving its unique queue-control/test tree. Predecessor checks and reviews do not transfer merely because the stack remains mergeable. The baseline owner #1116 and temporal-analysis PR #1117 are separate evidence lanes. PR #1117's previously recorded `refactor/temporal-features-api@b98f266d2356d56be624fb617580b5252e85baaa` metadata and review state are historical in this cycle; that evidence never constitutes #1116 or #968 readiness. @@ -72,7 +72,7 @@ This documentation change introduces no new runtime authority. The durable secur ## Historical observations and RCA -Historical queue observations remain useful only as dated evidence. On 2026-09-01 10:31 KST BandScope had 190 open pull requests. At 2026-09-01 13:29 KST, 72 repositories were visible and an organization recount reported 2,697 open pull requests, with BandScope at 188. Later 2026-09-02 sweeps observed 2,827/2,834 and 185 BandScope, 2,856/2,855 and 194 BandScope, then 2,865/2,866 and 196 BandScope, then 2,889/2,889 and 196 BandScope, then 2,894/2,894 and 196 BandScope, then 2,894/2,894 and 193 BandScope, then 2,907/2,908 and 193 BandScope, then 2,914/2,914 and 193 BandScope, before the current **2,934 sequential / 2,934 aggregate and 193 BandScope** capture. None may be reused as an undated permanent count. +Historical queue observations remain useful only as dated evidence. On 2026-09-01 10:31 KST BandScope had 190 open pull requests. At 2026-09-01 13:29 KST, 72 repositories were visible and an organization recount reported 2,697 open pull requests, with BandScope at 188. Later 2026-09-02 sweeps observed 2,827/2,834 and 185 BandScope, 2,856/2,855 and 194 BandScope, then 2,865/2,866 and 196 BandScope, then 2,889/2,889 and 196 BandScope, then 2,894/2,894 and 196 BandScope, then 2,894/2,894 and 193 BandScope, then 2,907/2,908 and 193 BandScope, then 2,914/2,914 and 193 BandScope, then 2,934/2,934 and 193 BandScope, before the current **2,940 sequential / 2,941 aggregate and 194 BandScope** capture. None may be reused as an undated permanent count. Review findings previously validated on #1116 included stale PR evidence, a false repository-wide Mermaid-absence claim, stale product-owner issue numbers, and prose-inherited live Noema/PR claims. In this cycle a fresh reviewer also reported that the documentation gate lacked four project-recovery transitions. Exact-head revalidation showed the finding had already become stale: `scripts/checks/verify_docs.py` requires the four origin-preserving transitions and the canonical baseline contains all four exactly. The stale thread was answered with exact-head evidence and resolved without weakening the checker or churning correct source. @@ -103,4 +103,4 @@ World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines (WCAG) PR #1116 remains the canonical baseline owner. Its source contains the complete recovered PRD/TRD/DDD/naming/Rust/science/security/UI/quality/release/traceability contract plus current delivery evidence. PR #1025 is an older competing owner of the same path; it may only be closed as superseded when every unique semantic requirement remains executable or represented in the canonical source and its discussion history is preserved. -Future loops should refresh live counts and exact-head evidence when they materially change prioritization or causal ownership. They must not rewrite stable product/architecture sections merely to chase a volatile PR number, and they must never repeat the predecessor truncation failure by replacing a complete canonical document with a partial census fragment. +Future loops should refresh live counts and exact-head evidence when they materially change prioritization or causal ownership. They must not rewrite stable product/architecture sections merely to chase a volatile PR number, and they must never repeat the predecessor truncation failure by replacing a complete canonical document with a partial census fragment. \ No newline at end of file From 2625c8680761ac15992d6db97e719dc715810e04 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 08:06:56 +0900 Subject: [PATCH 63/80] test(docs): reject commented Mermaid transitions --- scripts/checks/test_verify_docs.py | 38 ++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) diff --git a/scripts/checks/test_verify_docs.py b/scripts/checks/test_verify_docs.py index 9f2e4ebaa..85c27f227 100644 --- a/scripts/checks/test_verify_docs.py +++ b/scripts/checks/test_verify_docs.py @@ -33,6 +33,44 @@ def test_rejects_transition_text_that_only_exists_in_prose(self) -> None: self.assertEqual(missing, list(RECOVERY_TRANSITIONS)) + def test_rejects_required_transition_that_only_exists_in_mermaid_comment(self) -> None: + """Commented-out transitions must not satisfy the executable diagram gate.""" + diagram = "\n".join( + ( + "```mermaid", + "stateDiagram-v2", + *(f" {transition}" for transition in RECOVERY_TRANSITIONS[:-1]), + f" %% {RECOVERY_TRANSITIONS[-1]}", + "```", + ) + ) + + missing = VERIFY_DOCS.missing_state_diagram_references( + diagram, + RECOVERY_TRANSITIONS, + ) + + self.assertEqual(missing, list(RECOVERY_TRANSITIONS)) + + def test_rejects_required_transition_embedded_in_another_statement(self) -> None: + """A required transition must be a complete statement, not label text.""" + diagram = "\n".join( + ( + "```mermaid", + "stateDiagram-v2", + *(f" {transition}" for transition in RECOVERY_TRANSITIONS[:-1]), + f" OtherState --> Ready: notes {RECOVERY_TRANSITIONS[-1]}", + "```", + ) + ) + + missing = VERIFY_DOCS.missing_state_diagram_references( + diagram, + RECOVERY_TRANSITIONS, + ) + + self.assertEqual(missing, list(RECOVERY_TRANSITIONS)) + def test_accepts_transitions_in_state_diagram(self) -> None: """A Mermaid stateDiagram-v2 containing every transition satisfies the gate.""" diagram = "\n".join( From 4522d69916bf8503c1714759c4a92caad8d8aea9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 08:07:32 +0900 Subject: [PATCH 64/80] fix(docs): validate executable Mermaid transitions --- scripts/checks/verify_docs.py | 36 ++++++++++++++++++++++++++++++++--- 1 file changed, 33 insertions(+), 3 deletions(-) diff --git a/scripts/checks/verify_docs.py b/scripts/checks/verify_docs.py index addaef2df..a815496b2 100644 --- a/scripts/checks/verify_docs.py +++ b/scripts/checks/verify_docs.py @@ -1,7 +1,7 @@ """Verify that required repository documentation files and references exist.""" -from pathlib import Path from collections.abc import Sequence +from pathlib import Path REQUIRED_PATHS = [ Path("README.md"), @@ -106,13 +106,43 @@ def mermaid_state_diagrams(content: str) -> list[str]: return diagrams +def mermaid_transition_statements(diagram: str) -> set[str]: + """Return normalized executable transition statements from one state diagram.""" + transitions: set[str] = set() + + for raw_line in diagram.splitlines(): + line = raw_line.strip() + if not line or line == "stateDiagram-v2" or line.startswith("%%"): + continue + if "%%" in line: + line = line.split("%%", maxsplit=1)[0].rstrip() + if "-->" not in line or ":" not in line: + continue + + transition_path, transition_label = line.split(":", maxsplit=1) + source_state, target_state = transition_path.split("-->", maxsplit=1) + source_state = " ".join(source_state.split()) + target_state = " ".join(target_state.split()) + transition_label = " ".join(transition_label.split()) + if not source_state or not target_state or not transition_label: + continue + + transitions.add(f"{source_state} --> {target_state}: {transition_label}") + + return transitions + + def missing_state_diagram_references( content: str, required_texts: Sequence[str], ) -> list[str]: - """Require related transitions to coexist in one Mermaid state diagram.""" + """Require exact related transitions to coexist in one Mermaid state diagram.""" diagrams = mermaid_state_diagrams(content) - if any(all(required_text in diagram for required_text in required_texts) for diagram in diagrams): + required_transitions = set(required_texts) + if any( + required_transitions.issubset(mermaid_transition_statements(diagram)) + for diagram in diagrams + ): return [] return list(required_texts) From 23abf78b5748cc112e792f6588e7f8f41ad71d6a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 13:41:17 +0900 Subject: [PATCH 65/80] test(docs): reject arrow-like Mermaid note text --- scripts/checks/test_verify_docs.py | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/scripts/checks/test_verify_docs.py b/scripts/checks/test_verify_docs.py index 85c27f227..d188f5dd5 100644 --- a/scripts/checks/test_verify_docs.py +++ b/scripts/checks/test_verify_docs.py @@ -71,6 +71,20 @@ def test_rejects_required_transition_embedded_in_another_statement(self) -> None self.assertEqual(missing, list(RECOVERY_TRANSITIONS)) + def test_ignores_note_text_with_colon_and_arrow(self) -> None: + """Mermaid notes containing arrow-like text must not crash transition parsing.""" + diagram = "\n".join( + ( + "stateDiagram-v2", + " note right of Ready: keep source --> after cancel", + *(f" {transition}" for transition in RECOVERY_TRANSITIONS), + ) + ) + + transitions = VERIFY_DOCS.mermaid_transition_statements(diagram) + + self.assertEqual(transitions, set(RECOVERY_TRANSITIONS)) + def test_accepts_transitions_in_state_diagram(self) -> None: """A Mermaid stateDiagram-v2 containing every transition satisfies the gate.""" diagram = "\n".join( From abf743f15731db3294281ff348c36a24c9e9d465 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 13:42:19 +0900 Subject: [PATCH 66/80] fix(docs): parse Mermaid transition syntax safely --- scripts/checks/verify_docs.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/scripts/checks/verify_docs.py b/scripts/checks/verify_docs.py index a815496b2..46bf7b092 100644 --- a/scripts/checks/verify_docs.py +++ b/scripts/checks/verify_docs.py @@ -116,10 +116,12 @@ def mermaid_transition_statements(diagram: str) -> set[str]: continue if "%%" in line: line = line.split("%%", maxsplit=1)[0].rstrip() - if "-->" not in line or ":" not in line: + if ":" not in line: continue transition_path, transition_label = line.split(":", maxsplit=1) + if "-->" not in transition_path: + continue source_state, target_state = transition_path.split("-->", maxsplit=1) source_state = " ".join(source_state.split()) target_state = " ".join(target_state.split()) From e83bd9268f4c24f6cf5bb9893660a65687aa7b6b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 16:07:14 +0900 Subject: [PATCH 67/80] docs: refresh protected product truth --- docs/product-technical-gap-baseline.md | 27 +++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index b7e1e56e0..e99851c6b 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,8 +1,8 @@ # BandScope Product-Technical Gap Baseline -Last updated: 2026-09-02 -Evidence capture: fresh live GitHub state from the current delivery run unless a paragraph is explicitly marked historical -Protected product truth: `develop@749511c3ad4000090048718f685c6bee6b3d2c25` +Last updated: 2026-09-04 +Evidence capture: live GitHub state is dated at observation; protected refs are revalidated when identified as current +Protected product truth: `develop@889d782e88b4df28dcbb4ae3cfd6d99ef85d9844` ## Purpose @@ -46,13 +46,13 @@ The near-term product order remains: merge-train convergence; trusted distributi ## 2. Live delivery authority -A fresh complete accessible-repository sweep begun at **2026-09-02 21:56 KST** queried all **74** repositories currently visible under `ContextualWisdomLab` individually. The sequential per-repository counts summed to **2,940 open pull requests**. A subsequent organization-wide aggregate returned **2,941 open pull requests** with `incomplete_results=false`. The one-PR difference is a non-atomic observation, not attribution to a particular repository: PR creation and closure can occur during or after the sequential sweep, so this census remains dated evidence rather than permanent product truth. +A complete accessible-repository sweep begun at **2026-09-02 21:56 KST** queried all **74** repositories visible under `ContextualWisdomLab` at that observation individually. The sequential per-repository counts summed to **2,940 open pull requests**. A subsequent organization-wide aggregate returned **2,941 open pull requests** with `incomplete_results=false`. The one-PR difference is a non-atomic observation, not attribution to a particular repository: PR creation and closure can occur during or after the sequential sweep, so this census remains dated evidence rather than permanent product truth. -At this census `ContextualWisdomLab/bandscope` had **194 open pull requests** and a fresh issue search returned **19 open issues**, so it remains the selected delivery boundary. Fresh high-backlog peers were `ContextualWisdomLab/naruon` (148), `ContextualWisdomLab/OriginWeave` (142), `ContextualWisdomLab/newsdom-api` (139), `ContextualWisdomLab/pg-erd-cloud` (138), `ContextualWisdomLab/TEPP` (130), `ContextualWisdomLab/.github` (128), `ContextualWisdomLab/html4tree` (127), `ContextualWisdomLab/Orgmetra` (117), and `ContextualWisdomLab/LineageWeave` (113). BandScope is selected not by name alone but because it combines the largest observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. +At this census `ContextualWisdomLab/bandscope` had **194 open pull requests** and the same capture's issue search returned **19 open issues**, so it remained the selected delivery boundary at that observation. High-backlog peers observed in that capture were `ContextualWisdomLab/naruon` (148), `ContextualWisdomLab/OriginWeave` (142), `ContextualWisdomLab/newsdom-api` (139), `ContextualWisdomLab/pg-erd-cloud` (138), `ContextualWisdomLab/TEPP` (130), `ContextualWisdomLab/.github` (128), `ContextualWisdomLab/html4tree` (127), `ContextualWisdomLab/Orgmetra` (117), and `ContextualWisdomLab/LineageWeave` (113). BandScope is selected not by name alone but because it combines a large observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. The exact 74-repository set for this same capture is enumerated verbatim in `docs/doctoring/product-gap-baseline-2026-09-01.md`; capitalization there is the GitHub repository identity and is not normalized. Because PR creation and closure can occur during a sequential organization census, later counts are historical observations unless a new complete sweep is performed. -A fresh protected-branch read confirms `develop@749511c3ad4000090048718f685c6bee6b3d2c25` remains protected with exactly these 16 required contexts: `ci / build-and-test`, `dependency-review`, `security-audit`, `sbom`, `release-preflight`, `gate / build / windows`, `gate / build / macos`, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, `Analyze (javascript-typescript)`, and `Analyze (python)`. Merge decisions still re-fetch protection because this is capture-time evidence. +A protected-branch read on **2026-09-04** confirms `develop@889d782e88b4df28dcbb4ae3cfd6d99ef85d9844` remains protected with exactly these 16 required contexts: `ci / build-and-test`, `dependency-review`, `security-audit`, `sbom`, `release-preflight`, `gate / build / windows`, `gate / build / macos`, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, `Analyze (javascript-typescript)`, and `Analyze (python)`. Merge decisions still re-fetch protection because this is capture-time evidence. Operational evidence rule: queued, pending, skipped-required, cancelled, neutral, failed, absent, stale, predecessor-head, protected-base, model-only, status-only, self/author, or administrative-bypass evidence is non-passing. A head change prevents predecessor review/check receipts from transferring to the successor head; the original historical evidence remains preserved. Force-push, destructive rebase, self-approval, gate weakening, fabricated evidence, and unrelated rollback are prohibited. @@ -60,11 +60,12 @@ Merge readiness is re-evaluated per unchanged exact PR head; an organization-wid ## 3. Shipped protected truth -Only behavior reachable from protected `develop@749511c3ad4000090048718f685c6bee6b3d2c25` belongs in this section. +Only behavior reachable from protected `develop@889d782e88b4df28dcbb4ae3cfd6d99ef85d9844` belongs in this section. - BandScope is a React/Vite desktop workspace hosted by Tauri with local orchestration and a Python analysis service plus Rust/PyO3 numerical kernels. - Typed Tauri IPC and bounded local process boundaries are the intended local execution model; ordinary rehearsal analysis does not require a public cloud service. - Protected dependency-security repair #783 is already in `develop` ancestry. Open branches must not reframe its historical dependency findings as an unmerged product blocker or suppress them locally. +- Protected dependency update #1027 advances the independently built Tauri lockfile to `uuid 1.25.0`; branches that predate it must adopt the protected lockfile result rather than overwrite it accidentally while restacking unrelated work. - The product already renders rehearsal-oriented section/role evidence, but protected truth does **not** yet satisfy the complete active-player, crash-recovery, real-audio acceptance, diagnostics, activation, accessibility-parity, or trusted-distribution contracts below. - The latest immutable GitHub Release revalidated in recent delivery evidence is `v0.1.3`, published 2026-04-28. It is historical release evidence, not proof that the current protected head satisfies the commercial release gate. @@ -75,9 +76,9 @@ Active work is not shipped truth until it is normally integrated into protected | Boundary | Canonical live owner / evidence | Current status | |---|---|---| | Merge-train control plane | Issue #966 with executable queue lane PR #968 | #968 remains Draft; its unique queue machinery must survive every restack and its exact current head is non-passing until hosted/current-head evidence exists | -| Canonical baseline | PR #1116, this file | Open; prior truncation is repaired and current census/contract corrections remain active until this branch normally integrates | +| Canonical baseline | PR #1116, this file | Draft; this branch includes the current protected `develop` ancestry and must obtain fresh exact-head evidence after each baseline repair before integration | | Workspace role naming | PR #1130 | The **active owner branch** uses `RehearsalRoleOption.roleId`/`roleName` with primary `roleOptions`; the previous `{ id, name }[]` projection exists only as a deprecated component compatibility input there. Protected `develop` is not claimed to contain this projection before integration | -| Score attachment naming | PR #1092 | Persisted project-format `scoreAttachments` retains compatibility keys `id`/`fileName`, while `trustedScoreAttachment` translates them immediately to workspace-owned `scoreId`/`scoreFileName`; current exact head at the recorded capture is `8099e3b2525723474aca09db4d669167035263b3`; no database or persisted-wire migration is introduced | +| Score attachment naming | PR #1092 | Persisted project-format `scoreAttachments` retains compatibility keys `id`/`fileName`, while `trustedScoreAttachment` translates them immediately to workspace-owned `scoreId`/`scoreFileName`; recorded exact-head evidence is historical until re-fetched; no database or persisted-wire migration is introduced | | Repository-local Trivy PR-head contract | PR #1119 | Quoted/commented YAML activity-list normalization is repaired on its canonical branch; current-head workflows remain non-passing until fresh terminal evidence exists | | Trusted distribution | Issue #960; active release-identity lane PR #1126 | Semantic release-identity naming is active work; Windows signing, macOS signing/notarization, checksums, SBOM/provenance, signature-verified updater, staged rollout, rollback/repair, and complete version-identity parity remain incomplete as one integrated protected-head receipt | | Active rehearsal player | Issue #961; implementation lane #971 | Real authorized local audio playback/seek/stop/loop/rate/cue transport is active work; count-in and any source-backed stem control must converge into one transport state machine | @@ -97,9 +98,9 @@ Backlog convergence is the primary engineering risk because micro-PR fan-out cre PR #968 owns the unique executable queue machinery needed by #966: bounded GitHub pagination, exact active-head capture, independent base-tip resolution, deterministic ordering, malformed/incomplete/duplicate rejection, symlink-safe atomic publication, reviewed dependency/succession metadata, network-independent validation, deterministic human projection/parity, and exact-head artifact preservation. It must not be discarded as stale documentation. -Current identities are deliberately separated rather than conflated. At the immediately pre-write audit, canonical baseline PR #1116 was `docs/gap-baseline-2026-08-31@0335ba3d6d13086ab64dbf4af54d177f841fa39d`, base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. A fresh GitHub read of PR #968 reported queue head `docs/bandscope-product-readiness-baseline@9f25cf669eaaad7e1e2296463a73eb2c5620dc66`, base branch `docs/gap-baseline-2026-08-31`, and recorded base SHA `cdc9d2b27ed7c9c81a49bd7dd6279d79de7f73a9`. Because the canonical baseline tip had already advanced beyond that recorded base SHA, the stack requires ordinary non-force reconciliation before #968 can claim current-base exact-head evidence even though GitHub still reports it mergeable. Any later #1116 advance again changes the target tip and therefore requires fresh #968 base/check/review evidence while preserving its unique queue-control source. +The canonical baseline branch already contains protected `develop@889d782e88b4df28dcbb4ae3cfd6d99ef85d9844` in its ancestry through an ordinary merge parent. PR #968 targets this baseline branch rather than protected `develop` directly. Every #1116 branch advance therefore changes #968's target tip: #968 must be re-resolved against that new base and obtain fresh exact-head checks/reviews before readiness, while preserving its unique queue-control source through ordinary non-force reconciliation. Historical #1116/#968 SHAs remain audit evidence only and are not described as current identities after either branch advances. -PR #1117 is a separate lane: `refactor/temporal-features-api@b98f266d2356d56be624fb617580b5252e85baaa`, base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. Its visible review threads are independently resolved; that review evidence belongs to #1117 and never substitutes for #1116 or #968 evidence. #1117 does not own `docs/product-technical-gap-baseline.md`, so no canonical baseline document blob is attributed to its exact ref. +A previously recorded #1117 snapshot was `refactor/temporal-features-api@b98f266d2356d56be624fb617580b5252e85baaa` with then-base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. Its visible review threads were independently resolved in that historical capture; that evidence belongs to #1117 and never substitutes for #1116 or #968 evidence. #1117 does not own `docs/product-technical-gap-baseline.md`, and the current protected product tip is now `develop@889d782e88b4df28dcbb4ae3cfd6d99ef85d9844`; any #1117 merge decision must re-fetch its live head/base and evidence rather than reuse this snapshot. PR #1007 is the canonical first-part-handoff lane only to the extent that its live semantic diff still preserves mounted selected-role wiring and the scientific prohibition against manufacturing handoffs from heuristic fallback. Any succession decision is rechecked against the independently resolved live head rather than a remembered PR-body SHA. @@ -334,9 +335,9 @@ Ordinary logs/support bundles must not contain raw audio/project payloads, crede - **Artifact trust:** installers/updaters require owning-boundary signature, checksum, SBOM and provenance verification; staged rollout and rollback evidence remain part of release acceptance. - **Verification status:** queued, pending, neutral, skipped-required, cancelled, stale, predecessor or inaccessible-protection evidence is non-passing and cannot be promoted into security assurance. -The latest protected central control-plane head revalidated in this run is `ContextualWisdomLab/.github@f610598c585d8dfdabe6fd82204173e23ad09841`. Issue `.github#712` remains the organization-wide Actions queue-health/runner-admission causal owner. Cross-repository exact-head evidence shows jobs waiting before checkout with no runner assignment across both `ubuntu-latest` and explicit `ubuntu-24.04`, including an unchanged Wardnet head that previously completed successfully on the same label. That evidence falsifies a simple leaf runner-label defect but does not identify whether the remaining owner cause is hosted-runner capacity, organization concurrency/admission policy, billing/quota, or provider scheduling. Earlier protected `.github#1658`, `.github#1656`, `.github#1665`, `.github#1645`, and subsequent scheduler fixes reduce avoidable load/review-routing/cancellation ambiguity but do not convert a queued current-head check into success. +The most recently recorded central control-plane head in this document is `ContextualWisdomLab/.github@f610598c585d8dfdabe6fd82204173e23ad09841`; it is historical evidence until that owner is freshly revalidated. Issue `.github#712` remains the recorded organization-wide Actions queue-health/runner-admission causal owner. The associated historical cross-repository evidence showed jobs waiting before checkout with no runner assignment across both `ubuntu-latest` and explicit `ubuntu-24.04`, including an unchanged Wardnet head that previously completed successfully on the same label. That evidence falsified a simple leaf runner-label defect for that observation but did not identify whether the remaining owner cause was hosted-runner capacity, organization concurrency/admission policy, billing/quota, or provider scheduling. Earlier protected `.github#1658`, `.github#1656`, `.github#1665`, `.github#1645`, and subsequent scheduler fixes reduce avoidable load/review-routing/cancellation ambiguity but do not convert a queued current-head check into success. -Fresh #1092 exact-head verification exists on `8099e3b2525723474aca09db4d669167035263b3`: 27 check runs were observed, with required/security lanes such as `dependency-review`, `scorecard`, and `trivy-fs` still queued at capture. A skipped manual-evidence helper is not a substitute for required evidence. No predecessor-head success is transferred. +A prior #1092 exact-head capture on `8099e3b2525723474aca09db4d669167035263b3` observed 27 check runs, with required/security lanes such as `dependency-review`, `scorecard`, and `trivy-fs` still queued at that capture. It is historical evidence and must be re-fetched before any #1092 merge decision. A skipped manual-evidence helper is not a substitute for required evidence. No predecessor-head success is transferred. ## 11. UI/UX evidence gate From f835224a1dcf5ccf5db6268806ea2fc714906497 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 20:13:15 +0900 Subject: [PATCH 68/80] docs(gap): refresh protected and stem delivery truth --- docs/product-technical-gap-baseline.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index e99851c6b..73deca103 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,7 +2,7 @@ Last updated: 2026-09-04 Evidence capture: live GitHub state is dated at observation; protected refs are revalidated when identified as current -Protected product truth: `develop@889d782e88b4df28dcbb4ae3cfd6d99ef85d9844` +Protected product truth: `develop@314ddeae7b775a4957594b599358c8255617eb2e` ## Purpose @@ -52,7 +52,7 @@ At this census `ContextualWisdomLab/bandscope` had **194 open pull requests** an The exact 74-repository set for this same capture is enumerated verbatim in `docs/doctoring/product-gap-baseline-2026-09-01.md`; capitalization there is the GitHub repository identity and is not normalized. Because PR creation and closure can occur during a sequential organization census, later counts are historical observations unless a new complete sweep is performed. -A protected-branch read on **2026-09-04** confirms `develop@889d782e88b4df28dcbb4ae3cfd6d99ef85d9844` remains protected with exactly these 16 required contexts: `ci / build-and-test`, `dependency-review`, `security-audit`, `sbom`, `release-preflight`, `gate / build / windows`, `gate / build / macos`, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, `Analyze (javascript-typescript)`, and `Analyze (python)`. Merge decisions still re-fetch protection because this is capture-time evidence. +A protected-branch read on **2026-09-04** confirms `develop@314ddeae7b775a4957594b599358c8255617eb2e` is protected with exactly these 14 required contexts after protected PR #1165 consolidated repository-local security backstops: `ci / build-and-test`, `dependency-review`, `sbom`, `gate / build / windows`, `gate / build / macos`, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, `Analyze (javascript-typescript)`, and `Analyze (python)`. `security-audit` and `release-preflight` are no longer protected required-context names at this capture; their underlying security/release obligations remain product/release acceptance requirements where applicable. Merge decisions still re-fetch protection because this is capture-time evidence. Operational evidence rule: queued, pending, skipped-required, cancelled, neutral, failed, absent, stale, predecessor-head, protected-base, model-only, status-only, self/author, or administrative-bypass evidence is non-passing. A head change prevents predecessor review/check receipts from transferring to the successor head; the original historical evidence remains preserved. Force-push, destructive rebase, self-approval, gate weakening, fabricated evidence, and unrelated rollback are prohibited. @@ -60,12 +60,13 @@ Merge readiness is re-evaluated per unchanged exact PR head; an organization-wid ## 3. Shipped protected truth -Only behavior reachable from protected `develop@889d782e88b4df28dcbb4ae3cfd6d99ef85d9844` belongs in this section. +Only behavior reachable from protected `develop@314ddeae7b775a4957594b599358c8255617eb2e` belongs in this section. - BandScope is a React/Vite desktop workspace hosted by Tauri with local orchestration and a Python analysis service plus Rust/PyO3 numerical kernels. - Typed Tauri IPC and bounded local process boundaries are the intended local execution model; ordinary rehearsal analysis does not require a public cloud service. - Protected dependency-security repair #783 is already in `develop` ancestry. Open branches must not reframe its historical dependency findings as an unmerged product blocker or suppress them locally. - Protected dependency update #1027 advances the independently built Tauri lockfile to `uuid 1.25.0`; branches that predate it must adopt the protected lockfile result rather than overwrite it accidentally while restacking unrelated work. +- Protected workflow consolidation #1165 removes duplicate repository PR scans and keeps bounded trusted-branch backstops while central required workflows own their PR evidence; product lanes must adopt that control-plane result rather than recreate removed Bandit/CodeQL/Trivy/secret-scan writers locally. - The product already renders rehearsal-oriented section/role evidence, but protected truth does **not** yet satisfy the complete active-player, crash-recovery, real-audio acceptance, diagnostics, activation, accessibility-parity, or trusted-distribution contracts below. - The latest immutable GitHub Release revalidated in recent delivery evidence is `v0.1.3`, published 2026-04-28. It is historical release evidence, not proof that the current protected head satisfies the commercial release gate. @@ -76,12 +77,12 @@ Active work is not shipped truth until it is normally integrated into protected | Boundary | Canonical live owner / evidence | Current status | |---|---|---| | Merge-train control plane | Issue #966 with executable queue lane PR #968 | #968 remains Draft; its unique queue machinery must survive every restack and its exact current head is non-passing until hosted/current-head evidence exists | -| Canonical baseline | PR #1116, this file | Draft; this branch includes the current protected `develop` ancestry and must obtain fresh exact-head evidence after each baseline repair before integration | +| Canonical baseline | PR #1116, this file | Draft; this branch must contain current protected `develop` ancestry and obtain fresh exact-head evidence after every baseline repair before integration | | Workspace role naming | PR #1130 | The **active owner branch** uses `RehearsalRoleOption.roleId`/`roleName` with primary `roleOptions`; the previous `{ id, name }[]` projection exists only as a deprecated component compatibility input there. Protected `develop` is not claimed to contain this projection before integration | | Score attachment naming | PR #1092 | Persisted project-format `scoreAttachments` retains compatibility keys `id`/`fileName`, while `trustedScoreAttachment` translates them immediately to workspace-owned `scoreId`/`scoreFileName`; recorded exact-head evidence is historical until re-fetched; no database or persisted-wire migration is introduced | | Repository-local Trivy PR-head contract | PR #1119 | Quoted/commented YAML activity-list normalization is repaired on its canonical branch; current-head workflows remain non-passing until fresh terminal evidence exists | | Trusted distribution | Issue #960; active release-identity lane PR #1126 | Semantic release-identity naming is active work; Windows signing, macOS signing/notarization, checksums, SBOM/provenance, signature-verified updater, staged rollout, rollback/repair, and complete version-identity parity remain incomplete as one integrated protected-head receipt | -| Active rehearsal player | Issue #961; implementation lane #971 | Real authorized local audio playback/seek/stop/loop/rate/cue transport is active work; count-in and any source-backed stem control must converge into one transport state machine | +| Active rehearsal player | Issue #961; canonical transport #971 with source-to-audible stack #1159 → #1160 | #971 `9c1b20e6df778e303fada3e170c93418c496394b` owns one playback authority/state machine; #1159 `22a9f18d960cc7df93db890b2a5aa9594428c2b4` publishes real PCM16 four-stem artifacts and path-free references; #1160 `91cc5ddecc4d59855811f9d170c1fa55065ed85a` performs strict process/file admission, atomic authority binding and terminal-event buffering. All remain Draft/unshipped. The next buyer gap is the opaque-handle `Full mix | Vocals | Bass | Drums | Other instruments` selector plus interaction, persistence/reload/stale-race, locale and rights-cleared audible desktop evidence | | Crash-safe project | Issue #962; implementation lane #970 | Atomic publication, explicit format versioning, recovery, migration, autosave, rollback/export and persisted transport state remain active work, not protected truth | | Real-audio science | Issue #770 and active benchmark lanes | Rights-safe decoded-audio MIR acceptance, recognized metrics, uncertainty and reproducible evidence remain incomplete | | Resource admission/decode | Issue #781 plus commercial dependency defect #1129 | No synthetic/mock success may substitute for production-path resource/cancellation evidence; the commercially supported decode path must remove the libsndfile-backed LGPL runtime boundary with equivalent real-audio behavior and cross-platform/SBOM proof | @@ -98,9 +99,9 @@ Backlog convergence is the primary engineering risk because micro-PR fan-out cre PR #968 owns the unique executable queue machinery needed by #966: bounded GitHub pagination, exact active-head capture, independent base-tip resolution, deterministic ordering, malformed/incomplete/duplicate rejection, symlink-safe atomic publication, reviewed dependency/succession metadata, network-independent validation, deterministic human projection/parity, and exact-head artifact preservation. It must not be discarded as stale documentation. -The canonical baseline branch already contains protected `develop@889d782e88b4df28dcbb4ae3cfd6d99ef85d9844` in its ancestry through an ordinary merge parent. PR #968 targets this baseline branch rather than protected `develop` directly. Every #1116 branch advance therefore changes #968's target tip: #968 must be re-resolved against that new base and obtain fresh exact-head checks/reviews before readiness, while preserving its unique queue-control source through ordinary non-force reconciliation. Historical #1116/#968 SHAs remain audit evidence only and are not described as current identities after either branch advances. +The canonical baseline branch must contain protected `develop@314ddeae7b775a4957594b599358c8255617eb2e` in its ancestry through an ordinary non-force reconciliation. PR #968 targets this baseline branch rather than protected `develop` directly. Every #1116 branch advance therefore changes #968's target tip: #968 must be re-resolved against that new base and obtain fresh exact-head checks/reviews before readiness, while preserving its unique queue-control source through ordinary non-force reconciliation. Historical #1116/#968 SHAs remain audit evidence only and are not described as current identities after either branch advances. -A previously recorded #1117 snapshot was `refactor/temporal-features-api@b98f266d2356d56be624fb617580b5252e85baaa` with then-base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. Its visible review threads were independently resolved in that historical capture; that evidence belongs to #1117 and never substitutes for #1116 or #968 evidence. #1117 does not own `docs/product-technical-gap-baseline.md`, and the current protected product tip is now `develop@889d782e88b4df28dcbb4ae3cfd6d99ef85d9844`; any #1117 merge decision must re-fetch its live head/base and evidence rather than reuse this snapshot. +A previously recorded #1117 snapshot was `refactor/temporal-features-api@b98f266d2356d56be624fb617580b5252e85baaa` with then-base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. Its visible review threads were independently resolved in that historical capture; that evidence belongs to #1117 and never substitutes for #1116 or #968 evidence. #1117 does not own `docs/product-technical-gap-baseline.md`, and the current protected product tip is now `develop@314ddeae7b775a4957594b599358c8255617eb2e`; any #1117 merge decision must re-fetch its live head/base and evidence rather than reuse this snapshot. PR #1007 is the canonical first-part-handoff lane only to the extent that its live semantic diff still preserves mounted selected-role wiring and the scientific prohibition against manufacturing handoffs from heuristic fallback. Any succession decision is rechecked against the independently resolved live head rather than a remembered PR-body SHA. From cff6495b0dbf06831981f148d4c3143f03ebc4e2 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 03:12:08 +0900 Subject: [PATCH 69/80] docs(gap): refresh Active Player stack truth --- docs/product-technical-gap-baseline.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 73deca103..93c24fc88 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # BandScope Product-Technical Gap Baseline -Last updated: 2026-09-04 +Last updated: 2026-09-05 Evidence capture: live GitHub state is dated at observation; protected refs are revalidated when identified as current Protected product truth: `develop@314ddeae7b775a4957594b599358c8255617eb2e` @@ -52,7 +52,7 @@ At this census `ContextualWisdomLab/bandscope` had **194 open pull requests** an The exact 74-repository set for this same capture is enumerated verbatim in `docs/doctoring/product-gap-baseline-2026-09-01.md`; capitalization there is the GitHub repository identity and is not normalized. Because PR creation and closure can occur during a sequential organization census, later counts are historical observations unless a new complete sweep is performed. -A protected-branch read on **2026-09-04** confirms `develop@314ddeae7b775a4957594b599358c8255617eb2e` is protected with exactly these 14 required contexts after protected PR #1165 consolidated repository-local security backstops: `ci / build-and-test`, `dependency-review`, `sbom`, `gate / build / windows`, `gate / build / macos`, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, `Analyze (javascript-typescript)`, and `Analyze (python)`. `security-audit` and `release-preflight` are no longer protected required-context names at this capture; their underlying security/release obligations remain product/release acceptance requirements where applicable. Merge decisions still re-fetch protection because this is capture-time evidence. +A protected-branch read on **2026-09-05** confirms `develop@314ddeae7b775a4957594b599358c8255617eb2e` is protected with exactly these 14 required contexts after protected PR #1165 consolidated repository-local security backstops: `ci / build-and-test`, `dependency-review`, `sbom`, `gate / build / windows`, `gate / build / macos`, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, `Analyze (javascript-typescript)`, and `Analyze (python)`. `security-audit` and `release-preflight` are no longer protected required-context names at this capture; their underlying security/release obligations remain product/release acceptance requirements where applicable. Merge decisions still re-fetch protection because this is capture-time evidence. Operational evidence rule: queued, pending, skipped-required, cancelled, neutral, failed, absent, stale, predecessor-head, protected-base, model-only, status-only, self/author, or administrative-bypass evidence is non-passing. A head change prevents predecessor review/check receipts from transferring to the successor head; the original historical evidence remains preserved. Force-push, destructive rebase, self-approval, gate weakening, fabricated evidence, and unrelated rollback are prohibited. @@ -68,7 +68,7 @@ Only behavior reachable from protected `develop@314ddeae7b775a4957594b599358c825 - Protected dependency update #1027 advances the independently built Tauri lockfile to `uuid 1.25.0`; branches that predate it must adopt the protected lockfile result rather than overwrite it accidentally while restacking unrelated work. - Protected workflow consolidation #1165 removes duplicate repository PR scans and keeps bounded trusted-branch backstops while central required workflows own their PR evidence; product lanes must adopt that control-plane result rather than recreate removed Bandit/CodeQL/Trivy/secret-scan writers locally. - The product already renders rehearsal-oriented section/role evidence, but protected truth does **not** yet satisfy the complete active-player, crash-recovery, real-audio acceptance, diagnostics, activation, accessibility-parity, or trusted-distribution contracts below. -- The latest immutable GitHub Release revalidated in recent delivery evidence is `v0.1.3`, published 2026-04-28. It is historical release evidence, not proof that the current protected head satisfies the commercial release gate. +- The latest immutable GitHub Release revalidated on **2026-09-05** remains `v0.1.3`, published 2026-04-28. It is historical release evidence, not proof that the current protected head satisfies the commercial release gate. ## 4. Canonical active workstreams @@ -82,13 +82,13 @@ Active work is not shipped truth until it is normally integrated into protected | Score attachment naming | PR #1092 | Persisted project-format `scoreAttachments` retains compatibility keys `id`/`fileName`, while `trustedScoreAttachment` translates them immediately to workspace-owned `scoreId`/`scoreFileName`; recorded exact-head evidence is historical until re-fetched; no database or persisted-wire migration is introduced | | Repository-local Trivy PR-head contract | PR #1119 | Quoted/commented YAML activity-list normalization is repaired on its canonical branch; current-head workflows remain non-passing until fresh terminal evidence exists | | Trusted distribution | Issue #960; active release-identity lane PR #1126 | Semantic release-identity naming is active work; Windows signing, macOS signing/notarization, checksums, SBOM/provenance, signature-verified updater, staged rollout, rollback/repair, and complete version-identity parity remain incomplete as one integrated protected-head receipt | -| Active rehearsal player | Issue #961; canonical transport #971 with source-to-audible stack #1159 → #1160 | #971 `9c1b20e6df778e303fada3e170c93418c496394b` owns one playback authority/state machine; #1159 `22a9f18d960cc7df93db890b2a5aa9594428c2b4` publishes real PCM16 four-stem artifacts and path-free references; #1160 `91cc5ddecc4d59855811f9d170c1fa55065ed85a` performs strict process/file admission, atomic authority binding and terminal-event buffering. All remain Draft/unshipped. The next buyer gap is the opaque-handle `Full mix | Vocals | Bass | Drums | Other instruments` selector plus interaction, persistence/reload/stale-race, locale and rights-cleared audible desktop evidence | +| Active rehearsal player | Issue #961; canonical transport #971 with source-to-audible stack #1159 → #1160 | #971 `09bedd835475015379716292e63e6be376fceec9` owns one playback authority/state machine and removes the stale Tauri `http-range` lock orphan; #1159 `c27f3781ddcbcc013dce07a26c0baf6080e4b2ac` preserves the 10-file real PCM16 publication/path-free-reference delta on that current ancestry; #1160 `b41fdb4f6ef5606f91cb39daa211dea62160ab32` preserves strict process/file admission, atomic authority binding, renderer-safe availability/session admission, source-switch continuity, and target-authority/sequence-bound rejection of superseded media receipts. All remain Draft/unshipped. The next buyer gap is the mounted opaque-handle `Full mix | Vocals | Bass | Drums | Other instruments` selector and one stale-safe media-switch transaction, plus persistence/reload, eight-locale interaction/a11y and rights-cleared audible macOS/Windows evidence | | Crash-safe project | Issue #962; implementation lane #970 | Atomic publication, explicit format versioning, recovery, migration, autosave, rollback/export and persisted transport state remain active work, not protected truth | | Real-audio science | Issue #770 and active benchmark lanes | Rights-safe decoded-audio MIR acceptance, recognized metrics, uncertainty and reproducible evidence remain incomplete | | Resource admission/decode | Issue #781 plus commercial dependency defect #1129 | No synthetic/mock success may substitute for production-path resource/cancellation evidence; the commercially supported decode path must remove the libsndfile-backed LGPL runtime boundary with equivalent real-audio behavior and cross-platform/SBOM proof | | Diagnostics/supportability | Issue #963 | Typed redacted crash/hang evidence and user-previewable offline support bundle remain incomplete | | Activation | Issue #964 | A measured production-path first rehearsal remains incomplete | -| Accessibility/design parity | Issue #965 | WCAG 2.2 AA, keyboard/screen-reader parity, EN/KO expansion, exact-value alternatives and current-head UI evidence remain incomplete | +| Accessibility/design parity | Issue #965 | WCAG 2.2 AA, keyboard/screen-reader parity, KO/EN/JA/ZH/VI/ES/DE/FR expansion, exact-value alternatives and current-head UI evidence remain incomplete | | Quality floor | PR #1057 and successors | Repository-owned production statement/branch coverage and public API documentation target remain 100%; lower configured thresholds are a gap | The product boundary, tests, contracts, and unique behavior decide succession—not PR number or title. Duplicate closure requires a technical succession receipt naming the unique behavior/tests preserved in the successor. Checks, approvals, and model output never transfer to a changed successor head. @@ -344,7 +344,7 @@ A prior #1092 exact-head capture on `8099e3b2525723474aca09db4d669167035263b3` o The canonical Figma identity must be rediscovered from current protected BandScope docs/source before a material UI merge; the latest baseline reference is `zthWmqfNKUgJBECvv002Qk`, treated as a resolved design authority rather than a permanent remembered constant. -Storybook is the executable component/state inventory, Figma is the reviewed interaction/visual specification, and the shipped Tauri application is the final acceptance target. Material UI work must verify real pointer/touch/keyboard interaction, section/time-axis identity, playback cursor, persistence/reload, stale-response races, loading/partial/error/unsupported-codec/missing-stem states, responsive window sizes, visible focus, reduced motion, non-color-only status, screen-reader names/states, EN/KO expansion and exact-value/list/table alternatives for graph/timeline/waveform content. +Storybook is the executable component/state inventory, Figma is the reviewed interaction/visual specification, and the shipped Tauri application is the final acceptance target. Material UI work must verify real pointer/touch/keyboard interaction, section/time-axis identity, playback cursor, persistence/reload, stale-response races, loading/partial/error/unsupported-codec/missing-stem states, responsive window sizes, visible focus, reduced motion, non-color-only status, screen-reader names/states, KO/EN/JA/ZH/VI/ES/DE/FR expansion and exact-value/list/table alternatives for graph/timeline/waveform content. For the #1092 ready-workspace slice, product guidance now states the actual accessibility/authority condition consistently: the map names a score to open only when attachment metadata is validated and a live Score workspace is available; reopened metadata-only projects or untrusted score metadata fall back to adding a score or checking the range by ear. A screenshot from a predecessor head, a Storybook-only state, or a Figma-only mock is not shipped UI evidence. @@ -352,7 +352,7 @@ For the #1092 ready-workspace slice, product guidance now states the actual acce Repository-owned production statement coverage, branch/edge-case coverage, and public/repository-owned API documentation target **100%**. A lower configured JavaScript/Python threshold is a gap rather than equivalent evidence; denominator reduction, skip/xfail, generated-code relabeling, or source-text assertions cannot manufacture compliance. -Production-path tests include supported sample rates/channels, short/long recordings, pickup before bar one, odd meter and tempo changes where supported, silence near boundaries, unsupported codecs, moved/replaced files, cancellation, memory/CPU bounds, disk-full/partial-write recovery, corrupted project state, stale async response, missing stems, device changes, keyboard/screen-reader operation, EN/KO expansion, updater rollback, and redacted support export. Applicable scenarios are proven at the owning boundary rather than all forced into one test layer. +Production-path tests include supported sample rates/channels, short/long recordings, pickup before bar one, odd meter and tempo changes where supported, silence near boundaries, unsupported codecs, moved/replaced files, cancellation, memory/CPU bounds, disk-full/partial-write recovery, corrupted project state, stale async response, missing stems, device changes, keyboard/screen-reader operation, locale expansion, updater rollback, and redacted support export. Applicable scenarios are proven at the owning boundary rather than all forced into one test layer. For behavior- or contract-affecting renames, focused regressions must fail on old/new mismatches before production repair whenever practical, then prove serialization/deserialization, adapter compatibility, persistence behavior, migrations and rollback where applicable. Valid tests are never weakened, skipped, xfailed, suppressed, or quote-obfuscated to obtain green. From 145a61e5d4b5111a2d4bee547923408fb0c508d8 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 22:08:00 +0900 Subject: [PATCH 70/80] docs(gap): align active buyer and persistence truth --- docs/product-technical-gap-baseline.md | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 93c24fc88..21bfca4d5 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -77,18 +77,18 @@ Active work is not shipped truth until it is normally integrated into protected | Boundary | Canonical live owner / evidence | Current status | |---|---|---| | Merge-train control plane | Issue #966 with executable queue lane PR #968 | #968 remains Draft; its unique queue machinery must survive every restack and its exact current head is non-passing until hosted/current-head evidence exists | -| Canonical baseline | PR #1116, this file | Draft; this branch must contain current protected `develop` ancestry and obtain fresh exact-head evidence after every baseline repair before integration | +| Canonical baseline | PR #1116, this file | Draft; this branch is an ordinary descendant of current protected `develop`; every source repair requires fresh exact-head evidence and a non-force reconciliation of #968 before integration | | Workspace role naming | PR #1130 | The **active owner branch** uses `RehearsalRoleOption.roleId`/`roleName` with primary `roleOptions`; the previous `{ id, name }[]` projection exists only as a deprecated component compatibility input there. Protected `develop` is not claimed to contain this projection before integration | | Score attachment naming | PR #1092 | Persisted project-format `scoreAttachments` retains compatibility keys `id`/`fileName`, while `trustedScoreAttachment` translates them immediately to workspace-owned `scoreId`/`scoreFileName`; recorded exact-head evidence is historical until re-fetched; no database or persisted-wire migration is introduced | | Repository-local Trivy PR-head contract | PR #1119 | Quoted/commented YAML activity-list normalization is repaired on its canonical branch; current-head workflows remain non-passing until fresh terminal evidence exists | | Trusted distribution | Issue #960; active release-identity lane PR #1126 | Semantic release-identity naming is active work; Windows signing, macOS signing/notarization, checksums, SBOM/provenance, signature-verified updater, staged rollout, rollback/repair, and complete version-identity parity remain incomplete as one integrated protected-head receipt | -| Active rehearsal player | Issue #961; canonical transport #971 with source-to-audible stack #1159 → #1160 | #971 `09bedd835475015379716292e63e6be376fceec9` owns one playback authority/state machine and removes the stale Tauri `http-range` lock orphan; #1159 `c27f3781ddcbcc013dce07a26c0baf6080e4b2ac` preserves the 10-file real PCM16 publication/path-free-reference delta on that current ancestry; #1160 `b41fdb4f6ef5606f91cb39daa211dea62160ab32` preserves strict process/file admission, atomic authority binding, renderer-safe availability/session admission, source-switch continuity, and target-authority/sequence-bound rejection of superseded media receipts. All remain Draft/unshipped. The next buyer gap is the mounted opaque-handle `Full mix | Vocals | Bass | Drums | Other instruments` selector and one stale-safe media-switch transaction, plus persistence/reload, eight-locale interaction/a11y and rights-cleared audible macOS/Windows evidence | -| Crash-safe project | Issue #962; implementation lane #970 | Atomic publication, explicit format versioning, recovery, migration, autosave, rollback/export and persisted transport state remain active work, not protected truth | +| Active rehearsal player | Issue #961; canonical transport #971 with source-to-audible stack #1159 → #1160 | #971 `09bedd835475015379716292e63e6be376fceec9` owns one playback authority/state machine; #1159 `c27f3781ddcbcc013dce07a26c0baf6080e4b2ac` owns the real PCM16 stem-publication/path-free-reference layer; #1160 `332240dbba957602f217dc6e4e6a82a59d4d39b2` now contains the mounted five-source selector, exact same-project source-switch transaction, stale prior-resource `play()` retirement, selected-stem revocation/fallback, EN/KO selector/loading copy, and distinct verified Full-mix-only versus retryable discovery-error states. All remain Draft/unshipped. Remaining buyer work is durable selected-source persistence/reload, wider locale/a11y evidence, responsive/browser/screen-reader current-head evidence, and rights-cleared audible Windows/macOS acceptance | +| Crash-safe project | Issue #962; implementation lane #970 `1d2e0867d473b46869b845c9d07369822e667a5a` | Draft/unshipped. The branch is an ordinary descendant of protected `develop` with `behind_by=0`; it implements adjacent staged publication/recovery, a strict `projectFormatVersion: 1` envelope with legacy-read compatibility, typed shared-song/domain closure, Security Notes enforcement, Windows persistence-trigger coverage, and the exact 5 MiB size diagnostic. Selected-source semantic persistence, deterministic migrations beyond v1, backup rotation, global startup recovery, autosave, restore/compare/discard UX, player-state persistence, descriptor-bound parent authority, and exhaustive power-loss/fault injection remain open. Its current exact-head `build-baseline`, `sbom`, `CodeQL PR`, `Security Scan`, `ci`, and `SAST Semgrep` workflow runs are queued and therefore non-passing | | Real-audio science | Issue #770 and active benchmark lanes | Rights-safe decoded-audio MIR acceptance, recognized metrics, uncertainty and reproducible evidence remain incomplete | | Resource admission/decode | Issue #781 plus commercial dependency defect #1129 | No synthetic/mock success may substitute for production-path resource/cancellation evidence; the commercially supported decode path must remove the libsndfile-backed LGPL runtime boundary with equivalent real-audio behavior and cross-platform/SBOM proof | | Diagnostics/supportability | Issue #963 | Typed redacted crash/hang evidence and user-previewable offline support bundle remain incomplete | | Activation | Issue #964 | A measured production-path first rehearsal remains incomplete | -| Accessibility/design parity | Issue #965 | WCAG 2.2 AA, keyboard/screen-reader parity, KO/EN/JA/ZH/VI/ES/DE/FR expansion, exact-value alternatives and current-head UI evidence remain incomplete | +| Accessibility/design parity | Issue #965 | WCAG 2.2 AA, keyboard/screen-reader parity, KO/EN/JA/ZH/VI/ES/DE/FR expansion, exact-value alternatives and current-head UI evidence remain incomplete; #1160's EN/KO playback-source states are an active child slice, not completion of this owner | | Quality floor | PR #1057 and successors | Repository-owned production statement/branch coverage and public API documentation target remain 100%; lower configured thresholds are a gap | The product boundary, tests, contracts, and unique behavior decide succession—not PR number or title. Duplicate closure requires a technical succession receipt naming the unique behavior/tests preserved in the successor. Checks, approvals, and model output never transfer to a changed successor head. @@ -263,11 +263,11 @@ stateDiagram-v2 RecoveryFailedWithSource --> Ready: recovery failure acknowledged / keep prior source ``` -The production player owns one transport state machine. Loop activation never removes pause or stop authority: active-loop playback may pause with the loop retained, resume into that loop, clear the loop into ordinary playback/paused state, or stop directly. Initial admission and replacement use distinct selection-intent states so cancellation has one unambiguous outcome: a cancelled or failed initial selection returns to no source, while a cancelled or failed replacement returns to the prior admitted source. Source replacement is transactional: a pending replacement must not erase the prior admitted source; conflicting source/import/analysis actions remain unavailable until selection resolves. Recovery likewise preserves its origin: acknowledging a failed recovery requested from `NoSource` returns to `NoSource`, while a failed recovery requested from `Ready` returns to `Ready` with the prior admitted source unchanged. Either state can explicitly request recovery again, and failure never manufactures a successful recovered state. UI components, cue cards, map cursors, and persisted project data project from the owning authority rather than creating competing writable state. Project publication **must become** atomic and crash-safe; that is a target persistence contract, not a shipped guarantee, and this state diagram does not prove it. +The production player owns one transport state machine. Loop activation never removes pause or stop authority: active-loop playback may pause with the loop retained, resume into that loop, clear the loop into ordinary playback/paused state, or stop directly. Initial admission and replacement use distinct selection-intent states so cancellation has one unambiguous outcome: a cancelled or failed initial selection returns to no source, while a cancelled or failed replacement returns to the prior admitted source. Source replacement is transactional: a pending replacement must not erase the prior admitted source; conflicting source/import/analysis actions remain unavailable until selection resolves. Recovery likewise preserves its origin: acknowledging a failed recovery requested from `NoSource` returns to `NoSource`, while a failed recovery requested from `Ready` returns to `Ready` with the prior admitted source unchanged. Either state can explicitly request recovery again, and failure never manufactures a successful recovered state. UI components, cue cards, map cursors, and persisted project data project from the owning authority rather than creating competing writable state. Project publication **must become** atomic and crash-safe in protected product truth; #970 has an active Draft implementation, but this diagram does not promote it into a shipped guarantee. ### 7.4 Persistence and contract versioning -Protected `.bscope` documentation currently validates loaded JSON against the `RehearsalSong` contract and states that a format-version field **may be introduced** when future structural changes require one; it does not yet establish `project_format_version` as shipped persisted behavior. The target persistence contract therefore requires introducing explicit `project_format_version` before a breaking structural migration, plus deterministic/idempotent migration, atomic replacement only after a complete durable candidate exists, and a last-known-good backup/recovery path. Fault injection must prove that partial/truncated writes, disk-full conditions, interrupted migration, and failed replacement do not destroy the previous valid project. Portable export is versioned independently from in-memory implementation types. +Protected `.bscope` documentation currently validates loaded JSON against the `RehearsalSong` contract and states that a format-version field **may be introduced** when future structural changes require one; protected `develop` does not yet establish `projectFormatVersion` as shipped persisted behavior. Active canonical #970 introduces a strict `projectFormatVersion: 1` envelope, writes the current song inside that envelope, keeps legacy raw-song input readable, rejects unsupported future versions explicitly, and fails closed on unknown fields; that work remains Draft/unshipped. The next persistence evolution must preserve deterministic/idempotent migration, atomic replacement only after a complete durable candidate exists, last-known-good backup/recovery, and stable project semantics such as selected playback source without serializing revocable runtime authority. Fault injection must prove that partial/truncated writes, disk-full conditions, interrupted migration, and failed replacement do not destroy the previous valid project. Portable export is versioned independently from in-memory implementation types. Tauri IPC, shared types, project files, handoff schemas, updater manifests, and externally released event/contracts are versioned boundaries. A rename or ownership cleanup is never permission for an in-place breaking wire-format change. @@ -346,6 +346,8 @@ The canonical Figma identity must be rediscovered from current protected BandSco Storybook is the executable component/state inventory, Figma is the reviewed interaction/visual specification, and the shipped Tauri application is the final acceptance target. Material UI work must verify real pointer/touch/keyboard interaction, section/time-axis identity, playback cursor, persistence/reload, stale-response races, loading/partial/error/unsupported-codec/missing-stem states, responsive window sizes, visible focus, reduced motion, non-color-only status, screen-reader names/states, KO/EN/JA/ZH/VI/ES/DE/FR expansion and exact-value/list/table alternatives for graph/timeline/waveform content. +Active #1160 now distinguishes source-discovery loading, authoritative Full-mix-only empty, retryable discovery error, and normal multi-source selection. Empty/error copy is EN/KO only, native error detail is redacted, retry uses the existing discovery receipt path, and the selected source remains an opaque native authority at runtime. This is Draft source evidence only; persistence/reload, wider localization, responsive/browser/screen-reader evidence and rights-cleared desktop audible acceptance remain open. + For the #1092 ready-workspace slice, product guidance now states the actual accessibility/authority condition consistently: the map names a score to open only when attachment metadata is validated and a live Score workspace is available; reopened metadata-only projects or untrusted score metadata fall back to adding a score or checking the range by ear. A screenshot from a predecessor head, a Storybook-only state, or a Figma-only mock is not shipped UI evidence. ## 12. Quality and operability floor @@ -371,4 +373,4 @@ Primary normative/research anchors for this baseline include: - Music Information Retrieval Evaluation eXchange. (n.d.). *MIREX*. https://www.music-ir.org/mirex/ - Raffel, C., McFee, B., Humphrey, E. J., Salamon, J., Nieto, O., Liang, D., Ellis, D. P. W., & Raffel, C. C. (2014). mir_eval: A transparent implementation of common MIR metrics. *Proceedings of the 15th International Society for Music Information Retrieval Conference*, 367–372. -Repository ADRs, PRD/TRD, architecture/context-map documents, security/threat-model material, test strategy, operability/recovery guidance, UI/Storybook inventory and doctoring traceability must remain code-current. Active PRs, planned work and research results are never promoted into the shipped section before protected integration. \ No newline at end of file +Repository ADRs, PRD/TRD, architecture/context-map documents, security/threat-model material, test strategy, operability/recovery guidance, UI/Storybook inventory and doctoring traceability must remain code-current. Active PRs, planned work and research results are never promoted into the shipped section before protected integration. From 40817aaeaf446f32f3fda4117452b30e89884667 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 00:02:13 +0900 Subject: [PATCH 71/80] docs(gap): align persistence baseline with v2 contract --- docs/product-technical-gap-baseline.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 21bfca4d5..4b51a345f 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -82,8 +82,8 @@ Active work is not shipped truth until it is normally integrated into protected | Score attachment naming | PR #1092 | Persisted project-format `scoreAttachments` retains compatibility keys `id`/`fileName`, while `trustedScoreAttachment` translates them immediately to workspace-owned `scoreId`/`scoreFileName`; recorded exact-head evidence is historical until re-fetched; no database or persisted-wire migration is introduced | | Repository-local Trivy PR-head contract | PR #1119 | Quoted/commented YAML activity-list normalization is repaired on its canonical branch; current-head workflows remain non-passing until fresh terminal evidence exists | | Trusted distribution | Issue #960; active release-identity lane PR #1126 | Semantic release-identity naming is active work; Windows signing, macOS signing/notarization, checksums, SBOM/provenance, signature-verified updater, staged rollout, rollback/repair, and complete version-identity parity remain incomplete as one integrated protected-head receipt | -| Active rehearsal player | Issue #961; canonical transport #971 with source-to-audible stack #1159 → #1160 | #971 `09bedd835475015379716292e63e6be376fceec9` owns one playback authority/state machine; #1159 `c27f3781ddcbcc013dce07a26c0baf6080e4b2ac` owns the real PCM16 stem-publication/path-free-reference layer; #1160 `332240dbba957602f217dc6e4e6a82a59d4d39b2` now contains the mounted five-source selector, exact same-project source-switch transaction, stale prior-resource `play()` retirement, selected-stem revocation/fallback, EN/KO selector/loading copy, and distinct verified Full-mix-only versus retryable discovery-error states. All remain Draft/unshipped. Remaining buyer work is durable selected-source persistence/reload, wider locale/a11y evidence, responsive/browser/screen-reader current-head evidence, and rights-cleared audible Windows/macOS acceptance | -| Crash-safe project | Issue #962; implementation lane #970 `1d2e0867d473b46869b845c9d07369822e667a5a` | Draft/unshipped. The branch is an ordinary descendant of protected `develop` with `behind_by=0`; it implements adjacent staged publication/recovery, a strict `projectFormatVersion: 1` envelope with legacy-read compatibility, typed shared-song/domain closure, Security Notes enforcement, Windows persistence-trigger coverage, and the exact 5 MiB size diagnostic. Selected-source semantic persistence, deterministic migrations beyond v1, backup rotation, global startup recovery, autosave, restore/compare/discard UX, player-state persistence, descriptor-bound parent authority, and exhaustive power-loss/fault injection remain open. Its current exact-head `build-baseline`, `sbom`, `CodeQL PR`, `Security Scan`, `ci`, and `SAST Semgrep` workflow runs are queued and therefore non-passing | +| Active rehearsal player | Issue #961; canonical transport #971 with source-to-audible stack #1159 → #1160 | #971 `09bedd835475015379716292e63e6be376fceec9` owns one playback authority/state machine; #1159 `c27f3781ddcbcc013dce07a26c0baf6080e4b2ac` owns the real PCM16 stem-publication/path-free-reference layer; #1160 `332240dbba957602f217dc6e4e6a82a59d4d39b2` now contains the mounted five-source selector, exact same-project source-switch transaction, stale prior-resource `play()` retirement, selected-stem revocation/fallback, EN/KO selector/loading copy, and distinct verified Full-mix-only versus retryable discovery-error states. All remain Draft/unshipped. Remaining buyer work is the Tauri/TypeScript Save/Reopen bridge that supplies and consumes the durable selected-source semantic, fresh-authority reload resolution/fallback, wider locale/a11y evidence, responsive/browser/screen-reader current-head evidence, and rights-cleared audible Windows/macOS acceptance | +| Crash-safe project | Issue #962; implementation lane #970 `5320607434995b3eea43c341a04e51b9b320ccb9` | Draft/unshipped. The branch is an ordinary descendant of protected `develop` with `behind_by=0`; it implements adjacent staged publication/recovery, a strict `projectFormatVersion: 2` envelope, deterministic legacy/v1 migration to `preferences.selectedPlaybackSource = full_mix`, a closed durable source semantic (`full_mix | vocals | bass | drums | other`) that rejects revocable runtime authority, public typed current-document IPC admission, typed shared-song/domain closure, Security Notes enforcement, Windows persistence-trigger coverage, and the exact 5 MiB size diagnostic. The Tauri commands and TypeScript bridge still use the song-only compatibility view, so selected-source Save/Reopen is not yet wired end to end. Fresh-authority reopen resolution/fallback, backup rotation, global startup recovery, autosave, restore/compare/discard UX, broader player-state persistence, descriptor-bound parent authority, and exhaustive power-loss/fault injection remain open. Its current exact-head `build-baseline`, `sbom`, `CodeQL PR`, `Security Scan`, `ci`, and `SAST Semgrep` workflow runs are queued and therefore non-passing | | Real-audio science | Issue #770 and active benchmark lanes | Rights-safe decoded-audio MIR acceptance, recognized metrics, uncertainty and reproducible evidence remain incomplete | | Resource admission/decode | Issue #781 plus commercial dependency defect #1129 | No synthetic/mock success may substitute for production-path resource/cancellation evidence; the commercially supported decode path must remove the libsndfile-backed LGPL runtime boundary with equivalent real-audio behavior and cross-platform/SBOM proof | | Diagnostics/supportability | Issue #963 | Typed redacted crash/hang evidence and user-previewable offline support bundle remain incomplete | @@ -267,7 +267,7 @@ The production player owns one transport state machine. Loop activation never re ### 7.4 Persistence and contract versioning -Protected `.bscope` documentation currently validates loaded JSON against the `RehearsalSong` contract and states that a format-version field **may be introduced** when future structural changes require one; protected `develop` does not yet establish `projectFormatVersion` as shipped persisted behavior. Active canonical #970 introduces a strict `projectFormatVersion: 1` envelope, writes the current song inside that envelope, keeps legacy raw-song input readable, rejects unsupported future versions explicitly, and fails closed on unknown fields; that work remains Draft/unshipped. The next persistence evolution must preserve deterministic/idempotent migration, atomic replacement only after a complete durable candidate exists, last-known-good backup/recovery, and stable project semantics such as selected playback source without serializing revocable runtime authority. Fault injection must prove that partial/truncated writes, disk-full conditions, interrupted migration, and failed replacement do not destroy the previous valid project. Portable export is versioned independently from in-memory implementation types. +Protected `.bscope` documentation currently validates loaded JSON against the `RehearsalSong` contract and states that a format-version field **may be introduced** when future structural changes require one; protected `develop` does not yet establish `projectFormatVersion` as shipped persisted behavior. Active canonical #970 now introduces a strict `projectFormatVersion: 2` envelope with typed `song` and `preferences`, keeps legacy raw-song and v1 input readable through deterministic migration to `selectedPlaybackSource: full_mix`, rejects unsupported future versions and unknown fields, and limits the durable playback-source preference to `full_mix | vocals | bass | drums | other` rather than serializing a revocable runtime authority. Its current public Rust boundary admits renderer-shaped current documents with the same strict types, but Tauri `save_project`/`load_project` and the TypeScript bridge still use the song-only compatibility view, so selected-source Save/Reopen is not yet an end-to-end product behavior. The next persistence slice must wire that bridge and resolve the stored semantic against fresh native source availability on reopen, minting a new opaque playback authority and falling back to Full mix when the preferred stem is unavailable. Atomic replacement, last-known-good backup/recovery, deterministic/idempotent migration receipts, autosave/recovery UX, and fault injection for partial/truncated writes, disk-full conditions, interrupted migration, and failed replacement remain required before crash-safe persistence is complete. Portable export is versioned independently from in-memory implementation types. Tauri IPC, shared types, project files, handoff schemas, updater manifests, and externally released event/contracts are versioned boundaries. A rename or ownership cleanup is never permission for an in-place breaking wire-format change. @@ -346,7 +346,7 @@ The canonical Figma identity must be rediscovered from current protected BandSco Storybook is the executable component/state inventory, Figma is the reviewed interaction/visual specification, and the shipped Tauri application is the final acceptance target. Material UI work must verify real pointer/touch/keyboard interaction, section/time-axis identity, playback cursor, persistence/reload, stale-response races, loading/partial/error/unsupported-codec/missing-stem states, responsive window sizes, visible focus, reduced motion, non-color-only status, screen-reader names/states, KO/EN/JA/ZH/VI/ES/DE/FR expansion and exact-value/list/table alternatives for graph/timeline/waveform content. -Active #1160 now distinguishes source-discovery loading, authoritative Full-mix-only empty, retryable discovery error, and normal multi-source selection. Empty/error copy is EN/KO only, native error detail is redacted, retry uses the existing discovery receipt path, and the selected source remains an opaque native authority at runtime. This is Draft source evidence only; persistence/reload, wider localization, responsive/browser/screen-reader evidence and rights-cleared desktop audible acceptance remain open. +Active #1160 now distinguishes source-discovery loading, authoritative Full-mix-only empty, retryable discovery error, and normal multi-source selection. Empty/error copy is EN/KO only, native error detail is redacted, retry uses the existing discovery receipt path, and the selected source remains an opaque native authority at runtime. This is Draft source evidence only; the v2 durable semantic still needs the Tauri/TypeScript Save/Reopen bridge and fresh-authority reload resolution, and wider localization, responsive/browser/screen-reader evidence and rights-cleared desktop audible acceptance remain open. For the #1092 ready-workspace slice, product guidance now states the actual accessibility/authority condition consistently: the map names a score to open only when attachment metadata is validated and a live Score workspace is available; reopened metadata-only projects or untrusted score metadata fall back to adding a score or checking the range by ear. A screenshot from a predecessor head, a Storybook-only state, or a Figma-only mock is not shipped UI evidence. From a7fa2652922a32b3efb808f0c5304264019e5893 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 00:19:33 +0900 Subject: [PATCH 72/80] docs(gap): record v2 desktop persistence bridge --- docs/product-technical-gap-baseline.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 4b51a345f..26c7b2108 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -82,8 +82,8 @@ Active work is not shipped truth until it is normally integrated into protected | Score attachment naming | PR #1092 | Persisted project-format `scoreAttachments` retains compatibility keys `id`/`fileName`, while `trustedScoreAttachment` translates them immediately to workspace-owned `scoreId`/`scoreFileName`; recorded exact-head evidence is historical until re-fetched; no database or persisted-wire migration is introduced | | Repository-local Trivy PR-head contract | PR #1119 | Quoted/commented YAML activity-list normalization is repaired on its canonical branch; current-head workflows remain non-passing until fresh terminal evidence exists | | Trusted distribution | Issue #960; active release-identity lane PR #1126 | Semantic release-identity naming is active work; Windows signing, macOS signing/notarization, checksums, SBOM/provenance, signature-verified updater, staged rollout, rollback/repair, and complete version-identity parity remain incomplete as one integrated protected-head receipt | -| Active rehearsal player | Issue #961; canonical transport #971 with source-to-audible stack #1159 → #1160 | #971 `09bedd835475015379716292e63e6be376fceec9` owns one playback authority/state machine; #1159 `c27f3781ddcbcc013dce07a26c0baf6080e4b2ac` owns the real PCM16 stem-publication/path-free-reference layer; #1160 `332240dbba957602f217dc6e4e6a82a59d4d39b2` now contains the mounted five-source selector, exact same-project source-switch transaction, stale prior-resource `play()` retirement, selected-stem revocation/fallback, EN/KO selector/loading copy, and distinct verified Full-mix-only versus retryable discovery-error states. All remain Draft/unshipped. Remaining buyer work is the Tauri/TypeScript Save/Reopen bridge that supplies and consumes the durable selected-source semantic, fresh-authority reload resolution/fallback, wider locale/a11y evidence, responsive/browser/screen-reader current-head evidence, and rights-cleared audible Windows/macOS acceptance | -| Crash-safe project | Issue #962; implementation lane #970 `5320607434995b3eea43c341a04e51b9b320ccb9` | Draft/unshipped. The branch is an ordinary descendant of protected `develop` with `behind_by=0`; it implements adjacent staged publication/recovery, a strict `projectFormatVersion: 2` envelope, deterministic legacy/v1 migration to `preferences.selectedPlaybackSource = full_mix`, a closed durable source semantic (`full_mix | vocals | bass | drums | other`) that rejects revocable runtime authority, public typed current-document IPC admission, typed shared-song/domain closure, Security Notes enforcement, Windows persistence-trigger coverage, and the exact 5 MiB size diagnostic. The Tauri commands and TypeScript bridge still use the song-only compatibility view, so selected-source Save/Reopen is not yet wired end to end. Fresh-authority reopen resolution/fallback, backup rotation, global startup recovery, autosave, restore/compare/discard UX, broader player-state persistence, descriptor-bound parent authority, and exhaustive power-loss/fault injection remain open. Its current exact-head `build-baseline`, `sbom`, `CodeQL PR`, `Security Scan`, `ci`, and `SAST Semgrep` workflow runs are queued and therefore non-passing | +| Active rehearsal player | Issue #961; canonical transport #971 with source-to-audible stack #1159 → #1160 | #971 `09bedd835475015379716292e63e6be376fceec9` owns one playback authority/state machine; #1159 `c27f3781ddcbcc013dce07a26c0baf6080e4b2ac` owns the real PCM16 stem-publication/path-free-reference layer; #1160 `332240dbba957602f217dc6e4e6a82a59d4d39b2` now contains the mounted five-source selector, exact same-project source-switch transaction, stale prior-resource `play()` retirement, selected-stem revocation/fallback, EN/KO selector/loading copy, and distinct verified Full-mix-only versus retryable discovery-error states. All remain Draft/unshipped. Project Persistence #970 now exposes a typed v2 native/TypeScript document bridge for the durable selected-source semantic; remaining buyer work is mounted #1160 Save/Reopen composition, fresh-authority reopen resolution/fallback, wider locale/a11y evidence, responsive/browser/screen-reader current-head evidence, and rights-cleared audible Windows/macOS acceptance | +| Crash-safe project | Issue #962; implementation lane #970 `1a20bf5c9a0500dd9ff8143f492cd0b280a12849` | Draft/unshipped. The branch is an ordinary descendant of protected `develop` with `behind_by=0`; it implements adjacent staged publication/recovery, a strict `projectFormatVersion: 2` envelope, deterministic legacy/v1 migration to `preferences.selectedPlaybackSource = full_mix`, a closed durable source semantic (`full_mix | vocals | bass | drums | other`) that rejects revocable runtime authority, typed renderer/native current-document admission, a symmetric Tauri/TypeScript `saveProjectDocument`/`loadProjectDocument` bridge with song-only `full_mix` compatibility adapters, typed shared-song/domain closure, Security Notes enforcement, Windows persistence-trigger coverage, and the exact 5 MiB size diagnostic. The mounted #1160 composition still has to supply and consume the preference and resolve it against fresh native source availability after reopen. Backup rotation, global startup recovery, autosave, restore/compare/discard UX, broader player-state persistence, descriptor-bound parent authority, and exhaustive power-loss/fault injection remain open. Its current exact-head `build-baseline`, `sbom`, `CodeQL PR`, `Security Scan`, `ci`, and `SAST Semgrep` workflow runs are queued and therefore non-passing | | Real-audio science | Issue #770 and active benchmark lanes | Rights-safe decoded-audio MIR acceptance, recognized metrics, uncertainty and reproducible evidence remain incomplete | | Resource admission/decode | Issue #781 plus commercial dependency defect #1129 | No synthetic/mock success may substitute for production-path resource/cancellation evidence; the commercially supported decode path must remove the libsndfile-backed LGPL runtime boundary with equivalent real-audio behavior and cross-platform/SBOM proof | | Diagnostics/supportability | Issue #963 | Typed redacted crash/hang evidence and user-previewable offline support bundle remain incomplete | @@ -267,7 +267,7 @@ The production player owns one transport state machine. Loop activation never re ### 7.4 Persistence and contract versioning -Protected `.bscope` documentation currently validates loaded JSON against the `RehearsalSong` contract and states that a format-version field **may be introduced** when future structural changes require one; protected `develop` does not yet establish `projectFormatVersion` as shipped persisted behavior. Active canonical #970 now introduces a strict `projectFormatVersion: 2` envelope with typed `song` and `preferences`, keeps legacy raw-song and v1 input readable through deterministic migration to `selectedPlaybackSource: full_mix`, rejects unsupported future versions and unknown fields, and limits the durable playback-source preference to `full_mix | vocals | bass | drums | other` rather than serializing a revocable runtime authority. Its current public Rust boundary admits renderer-shaped current documents with the same strict types, but Tauri `save_project`/`load_project` and the TypeScript bridge still use the song-only compatibility view, so selected-source Save/Reopen is not yet an end-to-end product behavior. The next persistence slice must wire that bridge and resolve the stored semantic against fresh native source availability on reopen, minting a new opaque playback authority and falling back to Full mix when the preferred stem is unavailable. Atomic replacement, last-known-good backup/recovery, deterministic/idempotent migration receipts, autosave/recovery UX, and fault injection for partial/truncated writes, disk-full conditions, interrupted migration, and failed replacement remain required before crash-safe persistence is complete. Portable export is versioned independently from in-memory implementation types. +Protected `.bscope` documentation currently validates loaded JSON against the `RehearsalSong` contract and states that a format-version field **may be introduced** when future structural changes require one; protected `develop` does not yet establish `projectFormatVersion` as shipped persisted behavior. Active canonical #970 now introduces a strict `projectFormatVersion: 2` envelope with typed `song` and `preferences`, keeps legacy raw-song and v1 input readable through deterministic migration to `selectedPlaybackSource: full_mix`, rejects unsupported future versions and unknown fields, and limits the durable playback-source preference to `full_mix | vocals | bass | drums | other` rather than serializing a revocable runtime authority. Its current Rust/Tauri boundary and TypeScript Project Persistence adapter now admit and return the same typed current document through `saveProjectDocument`/`loadProjectDocument`; existing song-only callers remain compatibility adapters with deterministic `full_mix`. Selected-source Save/Reopen is still not a buyer-visible mounted behavior because #1160 has not yet supplied/consumed that preference or resolved it against fresh native source availability after reopen. The next Active Player slice must compose that bridge, mint a new opaque playback authority after reopen and fall back to Full mix when the preferred stem is unavailable. Atomic replacement, last-known-good backup/recovery, deterministic/idempotent migration receipts, autosave/recovery UX, and fault injection for partial/truncated writes, disk-full conditions, interrupted migration, and failed replacement remain required before crash-safe persistence is complete. Portable export is versioned independently from in-memory implementation types. Tauri IPC, shared types, project files, handoff schemas, updater manifests, and externally released event/contracts are versioned boundaries. A rename or ownership cleanup is never permission for an in-place breaking wire-format change. @@ -346,7 +346,7 @@ The canonical Figma identity must be rediscovered from current protected BandSco Storybook is the executable component/state inventory, Figma is the reviewed interaction/visual specification, and the shipped Tauri application is the final acceptance target. Material UI work must verify real pointer/touch/keyboard interaction, section/time-axis identity, playback cursor, persistence/reload, stale-response races, loading/partial/error/unsupported-codec/missing-stem states, responsive window sizes, visible focus, reduced motion, non-color-only status, screen-reader names/states, KO/EN/JA/ZH/VI/ES/DE/FR expansion and exact-value/list/table alternatives for graph/timeline/waveform content. -Active #1160 now distinguishes source-discovery loading, authoritative Full-mix-only empty, retryable discovery error, and normal multi-source selection. Empty/error copy is EN/KO only, native error detail is redacted, retry uses the existing discovery receipt path, and the selected source remains an opaque native authority at runtime. This is Draft source evidence only; the v2 durable semantic still needs the Tauri/TypeScript Save/Reopen bridge and fresh-authority reload resolution, and wider localization, responsive/browser/screen-reader evidence and rights-cleared desktop audible acceptance remain open. +Active #1160 now distinguishes source-discovery loading, authoritative Full-mix-only empty, retryable discovery error, and normal multi-source selection. Empty/error copy is EN/KO only, native error detail is redacted, retry uses the existing discovery receipt path, and the selected source remains an opaque native authority at runtime. Project Persistence #970 now provides the typed v2 native/TypeScript Save/Reopen document bridge, but #1160 still has to pass its stable semantic into that bridge and resolve the reopened preference against fresh native availability before a new opaque authority is minted. This is Draft source evidence only; wider localization, responsive/browser/screen-reader evidence and rights-cleared desktop audible acceptance remain open. For the #1092 ready-workspace slice, product guidance now states the actual accessibility/authority condition consistently: the map names a score to open only when attachment metadata is validated and a live Score workspace is available; reopened metadata-only projects or untrusted score metadata fall back to adding a score or checking the range by ear. A screenshot from a predecessor head, a Storybook-only state, or a Figma-only mock is not shipped UI evidence. From fb77835eebb7b5a96003640a2c60c2a951f95370 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 09:08:16 +0900 Subject: [PATCH 73/80] docs(gap): align persistence and source-admission truth --- docs/product-technical-gap-baseline.md | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 26c7b2108..af5a81a50 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # BandScope Product-Technical Gap Baseline -Last updated: 2026-09-05 +Last updated: 2026-09-06 Evidence capture: live GitHub state is dated at observation; protected refs are revalidated when identified as current Protected product truth: `develop@314ddeae7b775a4957594b599358c8255617eb2e` @@ -52,7 +52,7 @@ At this census `ContextualWisdomLab/bandscope` had **194 open pull requests** an The exact 74-repository set for this same capture is enumerated verbatim in `docs/doctoring/product-gap-baseline-2026-09-01.md`; capitalization there is the GitHub repository identity and is not normalized. Because PR creation and closure can occur during a sequential organization census, later counts are historical observations unless a new complete sweep is performed. -A protected-branch read on **2026-09-05** confirms `develop@314ddeae7b775a4957594b599358c8255617eb2e` is protected with exactly these 14 required contexts after protected PR #1165 consolidated repository-local security backstops: `ci / build-and-test`, `dependency-review`, `sbom`, `gate / build / windows`, `gate / build / macos`, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, `Analyze (javascript-typescript)`, and `Analyze (python)`. `security-audit` and `release-preflight` are no longer protected required-context names at this capture; their underlying security/release obligations remain product/release acceptance requirements where applicable. Merge decisions still re-fetch protection because this is capture-time evidence. +A protected-branch read on **2026-09-06** confirms `develop@314ddeae7b775a4957594b599358c8255617eb2e` is protected with exactly these 14 required contexts after protected PR #1165 consolidated repository-local security backstops: `ci / build-and-test`, `dependency-review`, `sbom`, `gate / build / windows`, `gate / build / macos`, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, `Analyze (javascript-typescript)`, and `Analyze (python)`. `security-audit` and `release-preflight` are no longer protected required-context names at this capture; their underlying security/release obligations remain product/release acceptance requirements where applicable. Merge decisions still re-fetch protection because this is capture-time evidence. Operational evidence rule: queued, pending, skipped-required, cancelled, neutral, failed, absent, stale, predecessor-head, protected-base, model-only, status-only, self/author, or administrative-bypass evidence is non-passing. A head change prevents predecessor review/check receipts from transferring to the successor head; the original historical evidence remains preserved. Force-push, destructive rebase, self-approval, gate weakening, fabricated evidence, and unrelated rollback are prohibited. @@ -82,10 +82,10 @@ Active work is not shipped truth until it is normally integrated into protected | Score attachment naming | PR #1092 | Persisted project-format `scoreAttachments` retains compatibility keys `id`/`fileName`, while `trustedScoreAttachment` translates them immediately to workspace-owned `scoreId`/`scoreFileName`; recorded exact-head evidence is historical until re-fetched; no database or persisted-wire migration is introduced | | Repository-local Trivy PR-head contract | PR #1119 | Quoted/commented YAML activity-list normalization is repaired on its canonical branch; current-head workflows remain non-passing until fresh terminal evidence exists | | Trusted distribution | Issue #960; active release-identity lane PR #1126 | Semantic release-identity naming is active work; Windows signing, macOS signing/notarization, checksums, SBOM/provenance, signature-verified updater, staged rollout, rollback/repair, and complete version-identity parity remain incomplete as one integrated protected-head receipt | -| Active rehearsal player | Issue #961; canonical transport #971 with source-to-audible stack #1159 → #1160 | #971 `09bedd835475015379716292e63e6be376fceec9` owns one playback authority/state machine; #1159 `c27f3781ddcbcc013dce07a26c0baf6080e4b2ac` owns the real PCM16 stem-publication/path-free-reference layer; #1160 `332240dbba957602f217dc6e4e6a82a59d4d39b2` now contains the mounted five-source selector, exact same-project source-switch transaction, stale prior-resource `play()` retirement, selected-stem revocation/fallback, EN/KO selector/loading copy, and distinct verified Full-mix-only versus retryable discovery-error states. All remain Draft/unshipped. Project Persistence #970 now exposes a typed v2 native/TypeScript document bridge for the durable selected-source semantic; remaining buyer work is mounted #1160 Save/Reopen composition, fresh-authority reopen resolution/fallback, wider locale/a11y evidence, responsive/browser/screen-reader current-head evidence, and rights-cleared audible Windows/macOS acceptance | -| Crash-safe project | Issue #962; implementation lane #970 `1a20bf5c9a0500dd9ff8143f492cd0b280a12849` | Draft/unshipped. The branch is an ordinary descendant of protected `develop` with `behind_by=0`; it implements adjacent staged publication/recovery, a strict `projectFormatVersion: 2` envelope, deterministic legacy/v1 migration to `preferences.selectedPlaybackSource = full_mix`, a closed durable source semantic (`full_mix | vocals | bass | drums | other`) that rejects revocable runtime authority, typed renderer/native current-document admission, a symmetric Tauri/TypeScript `saveProjectDocument`/`loadProjectDocument` bridge with song-only `full_mix` compatibility adapters, typed shared-song/domain closure, Security Notes enforcement, Windows persistence-trigger coverage, and the exact 5 MiB size diagnostic. The mounted #1160 composition still has to supply and consume the preference and resolve it against fresh native source availability after reopen. Backup rotation, global startup recovery, autosave, restore/compare/discard UX, broader player-state persistence, descriptor-bound parent authority, and exhaustive power-loss/fault injection remain open. Its current exact-head `build-baseline`, `sbom`, `CodeQL PR`, `Security Scan`, `ci`, and `SAST Semgrep` workflow runs are queued and therefore non-passing | +| Active rehearsal player | Issue #961; canonical transport #971 with source-to-audible stack #1159 → #1160 | #971 `09bedd835475015379716292e63e6be376fceec9` owns one playback authority/state machine; #1159 `c27f3781ddcbcc013dce07a26c0baf6080e4b2ac` owns the real PCM16 stem-publication/path-free-reference layer; #1160 `332240dbba957602f217dc6e4e6a82a59d4d39b2` contains the mounted five-source selector, exact same-project source-switch transaction, stale prior-resource `play()` retirement, selected-stem revocation/fallback, EN/KO selector/loading copy, and distinct verified Full-mix-only versus retryable discovery-error states. All remain Draft/unshipped. Project Persistence #970 `04e813eb928ac057147d2a5438e3fd0f699a8b0c` owns the Draft v3 native/TypeScript document bridge with durable selected-source semantic and optional path-free source reference. Remaining buyer work is publication-bound native identity handoff from #866, restart source re-admission, mounted #1160 Save/Reopen composition, fresh-authority reopen resolution/fallback, wider locale/a11y evidence, responsive/browser/screen-reader current-head evidence, and rights-cleared audible Windows/macOS acceptance | +| Crash-safe project | Issue #962; implementation lane #970 `04e813eb928ac057147d2a5438e3fd0f699a8b0c` | Draft/unshipped and `behind_by=0` against protected develop at the current capture. It implements adjacent staged publication/recovery, a strict `projectFormatVersion: 3` envelope, deterministic legacy/v1/v2 migration, durable `preferences.selectedPlaybackSource = full_mix | vocals | bass | drums | other`, optional path-free `sourceReference` with validated project id, fixed app-owned artifact name, admitted extension, positive byte count and lowercase SHA-256, typed renderer/native current-document admission, symmetric Tauri/TypeScript save/load bridge, shared-song/domain closure, Security Notes enforcement, Windows persistence-trigger coverage and exact 5 MiB size diagnostics. Historical migration never invents source evidence. Publication-bound source identity still has to arrive from Resource Admission; restart re-admission, mounted Save/Reopen composition, backup rotation, global startup recovery, autosave, Restore/Compare/Discard UX, broader player-state persistence, descriptor-bound parent authority, downgrade/application-rollback policy and exhaustive power-loss/fault injection remain open | | Real-audio science | Issue #770 and active benchmark lanes | Rights-safe decoded-audio MIR acceptance, recognized metrics, uncertainty and reproducible evidence remain incomplete | -| Resource admission/decode | Issue #781 plus commercial dependency defect #1129 | No synthetic/mock success may substitute for production-path resource/cancellation evidence; the commercially supported decode path must remove the libsndfile-backed LGPL runtime boundary with equivalent real-audio behavior and cross-platform/SBOM proof | +| Resource admission/decode | Issue #781; canonical PR #866 `bdf8f87d5e5c9db423537c7633e7ff4b92bec5b6`; commercial dependency defect #1129 | #866 now uses `LocalAudioCopyReceipt { file_size_bytes, content_sha256 }` on the production local-file materializer, file-syncs and atomically renames the same-project stage, rejects a published path observed as symlink/non-file, reopens the app-owned publication, and requires `verify_local_audio_publication_receipt` size+SHA-256 equality before returning bootstrap authority. Test-first integration chain is `ed9fe7eba6261753dc0f68e820e2b642703fe2cd` → `bdf8f87d5e5c9db423537c7633e7ff4b92bec5b6`. Atomic platform no-follow descriptor acquisition, parent-directory crash durability, path-free digest handoff into #970, restart re-admission and the #1160 private SHA-256 consolidation remain open. No synthetic/mock success substitutes for production real-audio/resource evidence; #1129 still owns removal of the libsndfile-backed LGPL runtime boundary with equivalent cross-platform real-audio/SBOM proof | | Diagnostics/supportability | Issue #963 | Typed redacted crash/hang evidence and user-previewable offline support bundle remain incomplete | | Activation | Issue #964 | A measured production-path first rehearsal remains incomplete | | Accessibility/design parity | Issue #965 | WCAG 2.2 AA, keyboard/screen-reader parity, KO/EN/JA/ZH/VI/ES/DE/FR expansion, exact-value alternatives and current-head UI evidence remain incomplete; #1160's EN/KO playback-source states are an active child slice, not completion of this owner | @@ -267,7 +267,11 @@ The production player owns one transport state machine. Loop activation never re ### 7.4 Persistence and contract versioning -Protected `.bscope` documentation currently validates loaded JSON against the `RehearsalSong` contract and states that a format-version field **may be introduced** when future structural changes require one; protected `develop` does not yet establish `projectFormatVersion` as shipped persisted behavior. Active canonical #970 now introduces a strict `projectFormatVersion: 2` envelope with typed `song` and `preferences`, keeps legacy raw-song and v1 input readable through deterministic migration to `selectedPlaybackSource: full_mix`, rejects unsupported future versions and unknown fields, and limits the durable playback-source preference to `full_mix | vocals | bass | drums | other` rather than serializing a revocable runtime authority. Its current Rust/Tauri boundary and TypeScript Project Persistence adapter now admit and return the same typed current document through `saveProjectDocument`/`loadProjectDocument`; existing song-only callers remain compatibility adapters with deterministic `full_mix`. Selected-source Save/Reopen is still not a buyer-visible mounted behavior because #1160 has not yet supplied/consumed that preference or resolved it against fresh native source availability after reopen. The next Active Player slice must compose that bridge, mint a new opaque playback authority after reopen and fall back to Full mix when the preferred stem is unavailable. Atomic replacement, last-known-good backup/recovery, deterministic/idempotent migration receipts, autosave/recovery UX, and fault injection for partial/truncated writes, disk-full conditions, interrupted migration, and failed replacement remain required before crash-safe persistence is complete. Portable export is versioned independently from in-memory implementation types. +Protected `.bscope` documentation currently validates loaded JSON against the `RehearsalSong` contract and states that a format-version field **may be introduced** when future structural changes require one; protected `develop` does not yet establish `projectFormatVersion` as shipped persisted behavior. Active canonical #970 `04e813eb928ac057147d2a5438e3fd0f699a8b0c` introduces Draft/unreleased `projectFormatVersion: 3` with typed `song`, `preferences`, and optional path-free `sourceReference`. It keeps legacy raw-song plus v1/v2 input readable through deterministic migration; migration defaults the durable playback source intent to `full_mix` where required and never invents missing source evidence. The closed durable preference remains `full_mix | vocals | bass | drums | other`; `sourceReference` admits only a validated BandScope project id, fixed app-owned `source.` artifact name, admitted extension, positive bounded byte count and canonical lowercase SHA-256. Revocable playback URLs and user filesystem paths are not durable project truth. + +Resource Admission #866 `bdf8f87d5e5c9db423537c7633e7ff4b92bec5b6` now consumes its native staging receipt on the production local-file materializer and re-reads the published app-owned source through `verify_local_audio_publication_receipt` before returning bootstrap authority. This closes the earlier byte-count-only publication path, but the current bootstrap payload still does not hand the digest to #970 and portable path checks do not claim atomic platform `O_NOFOLLOW`/reparse-point semantics. Restart/reopen therefore remains incomplete: Project Persistence must receive publication-bound path-free evidence, resolve only the app-owned artifact, re-establish regular/no-link containment, bounded size/SHA-256 and applicable decode/admission, reconstruct a fresh bootstrap, and only then let #1160 resolve persisted selected-source intent against fresh native availability. A missing preferred stem fails closed to Full mix. + +Atomic replacement, last-known-good backup/recovery, deterministic/idempotent migration receipts, autosave/recovery UX, downgrade/application-rollback policy, parent-directory crash durability and fault injection for partial/truncated writes, disk-full conditions, interrupted migration and failed replacement remain required before crash-safe persistence is complete. Portable export is versioned independently from in-memory implementation types. Tauri IPC, shared types, project files, handoff schemas, updater manifests, and externally released event/contracts are versioned boundaries. A rename or ownership cleanup is never permission for an in-place breaking wire-format change. @@ -346,7 +350,7 @@ The canonical Figma identity must be rediscovered from current protected BandSco Storybook is the executable component/state inventory, Figma is the reviewed interaction/visual specification, and the shipped Tauri application is the final acceptance target. Material UI work must verify real pointer/touch/keyboard interaction, section/time-axis identity, playback cursor, persistence/reload, stale-response races, loading/partial/error/unsupported-codec/missing-stem states, responsive window sizes, visible focus, reduced motion, non-color-only status, screen-reader names/states, KO/EN/JA/ZH/VI/ES/DE/FR expansion and exact-value/list/table alternatives for graph/timeline/waveform content. -Active #1160 now distinguishes source-discovery loading, authoritative Full-mix-only empty, retryable discovery error, and normal multi-source selection. Empty/error copy is EN/KO only, native error detail is redacted, retry uses the existing discovery receipt path, and the selected source remains an opaque native authority at runtime. Project Persistence #970 now provides the typed v2 native/TypeScript Save/Reopen document bridge, but #1160 still has to pass its stable semantic into that bridge and resolve the reopened preference against fresh native availability before a new opaque authority is minted. This is Draft source evidence only; wider localization, responsive/browser/screen-reader evidence and rights-cleared desktop audible acceptance remain open. +Active #1160 distinguishes source-discovery loading, authoritative Full-mix-only empty, retryable discovery error, and normal multi-source selection. Empty/error copy is EN/KO only, native error detail is redacted, retry uses the existing discovery receipt path, and the selected source remains an opaque native authority at runtime. Project Persistence #970 `04e813eb928ac057147d2a5438e3fd0f699a8b0c` provides the Draft v3 native/TypeScript Save/Reopen document bridge and stable selected-source semantic, but #1160 still has to compose that preference with publication-bound/re-admitted source evidence and fresh native availability before a new opaque authority is minted. This is Draft source evidence only; wider localization, responsive/browser/screen-reader evidence and rights-cleared desktop audible acceptance remain open. For the #1092 ready-workspace slice, product guidance now states the actual accessibility/authority condition consistently: the map names a score to open only when attachment metadata is validated and a live Score workspace is available; reopened metadata-only projects or untrusted score metadata fall back to adding a score or checking the range by ear. A screenshot from a predecessor head, a Storybook-only state, or a Figma-only mock is not shipped UI evidence. From a7f9e696afb5ec441e20f8a1f7b925ca8cd3dcdd Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 09:21:34 +0900 Subject: [PATCH 74/80] docs(gap): follow current resource-admission head --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index af5a81a50..4b35bc670 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -85,7 +85,7 @@ Active work is not shipped truth until it is normally integrated into protected | Active rehearsal player | Issue #961; canonical transport #971 with source-to-audible stack #1159 → #1160 | #971 `09bedd835475015379716292e63e6be376fceec9` owns one playback authority/state machine; #1159 `c27f3781ddcbcc013dce07a26c0baf6080e4b2ac` owns the real PCM16 stem-publication/path-free-reference layer; #1160 `332240dbba957602f217dc6e4e6a82a59d4d39b2` contains the mounted five-source selector, exact same-project source-switch transaction, stale prior-resource `play()` retirement, selected-stem revocation/fallback, EN/KO selector/loading copy, and distinct verified Full-mix-only versus retryable discovery-error states. All remain Draft/unshipped. Project Persistence #970 `04e813eb928ac057147d2a5438e3fd0f699a8b0c` owns the Draft v3 native/TypeScript document bridge with durable selected-source semantic and optional path-free source reference. Remaining buyer work is publication-bound native identity handoff from #866, restart source re-admission, mounted #1160 Save/Reopen composition, fresh-authority reopen resolution/fallback, wider locale/a11y evidence, responsive/browser/screen-reader current-head evidence, and rights-cleared audible Windows/macOS acceptance | | Crash-safe project | Issue #962; implementation lane #970 `04e813eb928ac057147d2a5438e3fd0f699a8b0c` | Draft/unshipped and `behind_by=0` against protected develop at the current capture. It implements adjacent staged publication/recovery, a strict `projectFormatVersion: 3` envelope, deterministic legacy/v1/v2 migration, durable `preferences.selectedPlaybackSource = full_mix | vocals | bass | drums | other`, optional path-free `sourceReference` with validated project id, fixed app-owned artifact name, admitted extension, positive byte count and lowercase SHA-256, typed renderer/native current-document admission, symmetric Tauri/TypeScript save/load bridge, shared-song/domain closure, Security Notes enforcement, Windows persistence-trigger coverage and exact 5 MiB size diagnostics. Historical migration never invents source evidence. Publication-bound source identity still has to arrive from Resource Admission; restart re-admission, mounted Save/Reopen composition, backup rotation, global startup recovery, autosave, Restore/Compare/Discard UX, broader player-state persistence, descriptor-bound parent authority, downgrade/application-rollback policy and exhaustive power-loss/fault injection remain open | | Real-audio science | Issue #770 and active benchmark lanes | Rights-safe decoded-audio MIR acceptance, recognized metrics, uncertainty and reproducible evidence remain incomplete | -| Resource admission/decode | Issue #781; canonical PR #866 `bdf8f87d5e5c9db423537c7633e7ff4b92bec5b6`; commercial dependency defect #1129 | #866 now uses `LocalAudioCopyReceipt { file_size_bytes, content_sha256 }` on the production local-file materializer, file-syncs and atomically renames the same-project stage, rejects a published path observed as symlink/non-file, reopens the app-owned publication, and requires `verify_local_audio_publication_receipt` size+SHA-256 equality before returning bootstrap authority. Test-first integration chain is `ed9fe7eba6261753dc0f68e820e2b642703fe2cd` → `bdf8f87d5e5c9db423537c7633e7ff4b92bec5b6`. Atomic platform no-follow descriptor acquisition, parent-directory crash durability, path-free digest handoff into #970, restart re-admission and the #1160 private SHA-256 consolidation remain open. No synthetic/mock success substitutes for production real-audio/resource evidence; #1129 still owns removal of the libsndfile-backed LGPL runtime boundary with equivalent cross-platform real-audio/SBOM proof | +| Resource admission/decode | Issue #781; canonical PR #866 `539bd575d33bd494291899e21a6bcb688b3be202`; commercial dependency defect #1129 | #866 production implementation `bdf8f87d5e5c9db423537c7633e7ff4b92bec5b6` uses `LocalAudioCopyReceipt { file_size_bytes, content_sha256 }` on the local-file materializer, file-syncs and renames the same-project stage, rejects a published path observed as symlink/non-file, reopens the app-owned publication, and requires `verify_local_audio_publication_receipt` size+SHA-256 equality before returning bootstrap authority. Test-first integration chain is `ed9fe7eba6261753dc0f68e820e2b642703fe2cd` → `bdf8f87d5e5c9db423537c7633e7ff4b92bec5b6`; exact head `539bd575d33bd494291899e21a6bcb688b3be202` then makes the Resource Admission TRACEABILITY code-current. Atomic platform no-follow descriptor acquisition, parent-directory crash durability, path-free digest handoff into #970, restart re-admission and the #1160 private SHA-256 consolidation remain open. No synthetic/mock success substitutes for production real-audio/resource evidence; #1129 still owns removal of the libsndfile-backed LGPL runtime boundary with equivalent cross-platform real-audio/SBOM proof | | Diagnostics/supportability | Issue #963 | Typed redacted crash/hang evidence and user-previewable offline support bundle remain incomplete | | Activation | Issue #964 | A measured production-path first rehearsal remains incomplete | | Accessibility/design parity | Issue #965 | WCAG 2.2 AA, keyboard/screen-reader parity, KO/EN/JA/ZH/VI/ES/DE/FR expansion, exact-value alternatives and current-head UI evidence remain incomplete; #1160's EN/KO playback-source states are an active child slice, not completion of this owner | @@ -269,7 +269,7 @@ The production player owns one transport state machine. Loop activation never re Protected `.bscope` documentation currently validates loaded JSON against the `RehearsalSong` contract and states that a format-version field **may be introduced** when future structural changes require one; protected `develop` does not yet establish `projectFormatVersion` as shipped persisted behavior. Active canonical #970 `04e813eb928ac057147d2a5438e3fd0f699a8b0c` introduces Draft/unreleased `projectFormatVersion: 3` with typed `song`, `preferences`, and optional path-free `sourceReference`. It keeps legacy raw-song plus v1/v2 input readable through deterministic migration; migration defaults the durable playback source intent to `full_mix` where required and never invents missing source evidence. The closed durable preference remains `full_mix | vocals | bass | drums | other`; `sourceReference` admits only a validated BandScope project id, fixed app-owned `source.` artifact name, admitted extension, positive bounded byte count and canonical lowercase SHA-256. Revocable playback URLs and user filesystem paths are not durable project truth. -Resource Admission #866 `bdf8f87d5e5c9db423537c7633e7ff4b92bec5b6` now consumes its native staging receipt on the production local-file materializer and re-reads the published app-owned source through `verify_local_audio_publication_receipt` before returning bootstrap authority. This closes the earlier byte-count-only publication path, but the current bootstrap payload still does not hand the digest to #970 and portable path checks do not claim atomic platform `O_NOFOLLOW`/reparse-point semantics. Restart/reopen therefore remains incomplete: Project Persistence must receive publication-bound path-free evidence, resolve only the app-owned artifact, re-establish regular/no-link containment, bounded size/SHA-256 and applicable decode/admission, reconstruct a fresh bootstrap, and only then let #1160 resolve persisted selected-source intent against fresh native availability. A missing preferred stem fails closed to Full mix. +Resource Admission #866 exact head `539bd575d33bd494291899e21a6bcb688b3be202` includes production fix `bdf8f87d5e5c9db423537c7633e7ff4b92bec5b6`, which consumes its native staging receipt on the local-file materializer and re-reads the published app-owned source through `verify_local_audio_publication_receipt` before returning bootstrap authority. The head also aligns Resource Admission TRACEABILITY with that production behavior and records a further contract finding: current Rust/TypeScript/Python runtime `LocalAudioSource` is a narrower analysis contract without `contentSha256`, so path-free persistence identity should be a distinct bootstrap/persistence boundary rather than an unversioned field injection into strict analysis admission. The current bootstrap still does not hand the digest to #970 and portable path checks do not claim atomic platform `O_NOFOLLOW`/reparse-point semantics. Restart/reopen therefore remains incomplete: Project Persistence must receive publication-bound path-free evidence, resolve only the app-owned artifact, re-establish regular/no-link containment, bounded size/SHA-256 and applicable decode/admission, reconstruct a fresh bootstrap, and only then let #1160 resolve persisted selected-source intent against fresh native availability. A missing preferred stem fails closed to Full mix. Atomic replacement, last-known-good backup/recovery, deterministic/idempotent migration receipts, autosave/recovery UX, downgrade/application-rollback policy, parent-directory crash durability and fault injection for partial/truncated writes, disk-full conditions, interrupted migration and failed replacement remain required before crash-safe persistence is complete. Portable export is versioned independently from in-memory implementation types. From 34c58e0e29710ae236ad520c4ddd836818ee24c9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 09:47:52 +0900 Subject: [PATCH 75/80] docs(gap): align Resource Admission no-clobber truth --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 4b35bc670..f2b01bfd3 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -85,7 +85,7 @@ Active work is not shipped truth until it is normally integrated into protected | Active rehearsal player | Issue #961; canonical transport #971 with source-to-audible stack #1159 → #1160 | #971 `09bedd835475015379716292e63e6be376fceec9` owns one playback authority/state machine; #1159 `c27f3781ddcbcc013dce07a26c0baf6080e4b2ac` owns the real PCM16 stem-publication/path-free-reference layer; #1160 `332240dbba957602f217dc6e4e6a82a59d4d39b2` contains the mounted five-source selector, exact same-project source-switch transaction, stale prior-resource `play()` retirement, selected-stem revocation/fallback, EN/KO selector/loading copy, and distinct verified Full-mix-only versus retryable discovery-error states. All remain Draft/unshipped. Project Persistence #970 `04e813eb928ac057147d2a5438e3fd0f699a8b0c` owns the Draft v3 native/TypeScript document bridge with durable selected-source semantic and optional path-free source reference. Remaining buyer work is publication-bound native identity handoff from #866, restart source re-admission, mounted #1160 Save/Reopen composition, fresh-authority reopen resolution/fallback, wider locale/a11y evidence, responsive/browser/screen-reader current-head evidence, and rights-cleared audible Windows/macOS acceptance | | Crash-safe project | Issue #962; implementation lane #970 `04e813eb928ac057147d2a5438e3fd0f699a8b0c` | Draft/unshipped and `behind_by=0` against protected develop at the current capture. It implements adjacent staged publication/recovery, a strict `projectFormatVersion: 3` envelope, deterministic legacy/v1/v2 migration, durable `preferences.selectedPlaybackSource = full_mix | vocals | bass | drums | other`, optional path-free `sourceReference` with validated project id, fixed app-owned artifact name, admitted extension, positive byte count and lowercase SHA-256, typed renderer/native current-document admission, symmetric Tauri/TypeScript save/load bridge, shared-song/domain closure, Security Notes enforcement, Windows persistence-trigger coverage and exact 5 MiB size diagnostics. Historical migration never invents source evidence. Publication-bound source identity still has to arrive from Resource Admission; restart re-admission, mounted Save/Reopen composition, backup rotation, global startup recovery, autosave, Restore/Compare/Discard UX, broader player-state persistence, descriptor-bound parent authority, downgrade/application-rollback policy and exhaustive power-loss/fault injection remain open | | Real-audio science | Issue #770 and active benchmark lanes | Rights-safe decoded-audio MIR acceptance, recognized metrics, uncertainty and reproducible evidence remain incomplete | -| Resource admission/decode | Issue #781; canonical PR #866 `539bd575d33bd494291899e21a6bcb688b3be202`; commercial dependency defect #1129 | #866 production implementation `bdf8f87d5e5c9db423537c7633e7ff4b92bec5b6` uses `LocalAudioCopyReceipt { file_size_bytes, content_sha256 }` on the local-file materializer, file-syncs and renames the same-project stage, rejects a published path observed as symlink/non-file, reopens the app-owned publication, and requires `verify_local_audio_publication_receipt` size+SHA-256 equality before returning bootstrap authority. Test-first integration chain is `ed9fe7eba6261753dc0f68e820e2b642703fe2cd` → `bdf8f87d5e5c9db423537c7633e7ff4b92bec5b6`; exact head `539bd575d33bd494291899e21a6bcb688b3be202` then makes the Resource Admission TRACEABILITY code-current. Atomic platform no-follow descriptor acquisition, parent-directory crash durability, path-free digest handoff into #970, restart re-admission and the #1160 private SHA-256 consolidation remain open. No synthetic/mock success substitutes for production real-audio/resource evidence; #1129 still owns removal of the libsndfile-backed LGPL runtime boundary with equivalent cross-platform real-audio/SBOM proof | +| Resource admission/decode | Issue #781; canonical PR #866 `55b0da5abd5cf252c256d2cca2fc57b2d91ddab6`; commercial dependency defect #1129 | #866 production implementation is cumulative through receipt integration `bdf8f87d5e5c9db423537c7633e7ff4b92bec5b6`: `LocalAudioCopyReceipt { file_size_bytes, content_sha256 }` binds the staged bytes, the synchronized same-project stage is published as app-owned `source.`, and the publication is reopened and required to reproduce exact size+SHA-256 before bootstrap authority returns. Exact-head RED `45b1f72abeded4e478775d31085244621f68c9f0` then catches the check-then-rename clobber race; fix `eb972e951ef090c92b595c752b18d66f11f6b96e` replaces it with same-filesystem hard-link publication that fails if the fixed destination already exists, removes the private stage name, and retains publication receipt verification. `55b0da5abd5cf252c256d2cca2fc57b2d91ddab6` makes the owning TRACEABILITY current. Atomic platform no-follow descriptor acquisition, parent-directory crash durability, path-free digest handoff into #970, restart re-admission and the #1160 private SHA-256 consolidation remain open. No synthetic/mock success substitutes for production real-audio/resource evidence; #1129 still owns removal of the libsndfile-backed LGPL runtime boundary with equivalent cross-platform real-audio/SBOM proof | | Diagnostics/supportability | Issue #963 | Typed redacted crash/hang evidence and user-previewable offline support bundle remain incomplete | | Activation | Issue #964 | A measured production-path first rehearsal remains incomplete | | Accessibility/design parity | Issue #965 | WCAG 2.2 AA, keyboard/screen-reader parity, KO/EN/JA/ZH/VI/ES/DE/FR expansion, exact-value alternatives and current-head UI evidence remain incomplete; #1160's EN/KO playback-source states are an active child slice, not completion of this owner | @@ -269,7 +269,7 @@ The production player owns one transport state machine. Loop activation never re Protected `.bscope` documentation currently validates loaded JSON against the `RehearsalSong` contract and states that a format-version field **may be introduced** when future structural changes require one; protected `develop` does not yet establish `projectFormatVersion` as shipped persisted behavior. Active canonical #970 `04e813eb928ac057147d2a5438e3fd0f699a8b0c` introduces Draft/unreleased `projectFormatVersion: 3` with typed `song`, `preferences`, and optional path-free `sourceReference`. It keeps legacy raw-song plus v1/v2 input readable through deterministic migration; migration defaults the durable playback source intent to `full_mix` where required and never invents missing source evidence. The closed durable preference remains `full_mix | vocals | bass | drums | other`; `sourceReference` admits only a validated BandScope project id, fixed app-owned `source.` artifact name, admitted extension, positive bounded byte count and canonical lowercase SHA-256. Revocable playback URLs and user filesystem paths are not durable project truth. -Resource Admission #866 exact head `539bd575d33bd494291899e21a6bcb688b3be202` includes production fix `bdf8f87d5e5c9db423537c7633e7ff4b92bec5b6`, which consumes its native staging receipt on the local-file materializer and re-reads the published app-owned source through `verify_local_audio_publication_receipt` before returning bootstrap authority. The head also aligns Resource Admission TRACEABILITY with that production behavior and records a further contract finding: current Rust/TypeScript/Python runtime `LocalAudioSource` is a narrower analysis contract without `contentSha256`, so path-free persistence identity should be a distinct bootstrap/persistence boundary rather than an unversioned field injection into strict analysis admission. The current bootstrap still does not hand the digest to #970 and portable path checks do not claim atomic platform `O_NOFOLLOW`/reparse-point semantics. Restart/reopen therefore remains incomplete: Project Persistence must receive publication-bound path-free evidence, resolve only the app-owned artifact, re-establish regular/no-link containment, bounded size/SHA-256 and applicable decode/admission, reconstruct a fresh bootstrap, and only then let #1160 resolve persisted selected-source intent against fresh native availability. A missing preferred stem fails closed to Full mix. +Resource Admission #866 exact head `55b0da5abd5cf252c256d2cca2fc57b2d91ddab6` includes production receipt integration `bdf8f87d5e5c9db423537c7633e7ff4b92bec5b6` and no-clobber publication fix `eb972e951ef090c92b595c752b18d66f11f6b96e`. The local-file materializer consumes the native staging receipt, synchronizes the same-project stage, creates app-owned `source.` with a same-filesystem hard link that fails if the destination already exists, removes the private stage name, then reopens the published object and requires `verify_local_audio_publication_receipt` size+SHA-256 equality before returning bootstrap authority. The exact head also aligns the Resource Admission doctoring/security sources and records the contract boundary: current Rust/TypeScript/Python runtime `LocalAudioSource` is a narrower analysis contract without `contentSha256`, so path-free persistence identity should be a distinct bootstrap/persistence boundary rather than an unversioned field injection into strict analysis admission. Portable path checks still do not claim atomic platform `O_NOFOLLOW`/reparse-point semantics, and the project directory is not yet explicitly synchronized after destination-link creation/stage unlink. Restart/reopen therefore remains incomplete: Project Persistence must receive publication-bound path-free evidence, resolve only the app-owned artifact, re-establish regular/no-link containment, bounded size/SHA-256 and applicable decode/admission, reconstruct a fresh bootstrap, and only then let #1160 resolve persisted selected-source intent against fresh native availability. A missing preferred stem fails closed to Full mix. Atomic replacement, last-known-good backup/recovery, deterministic/idempotent migration receipts, autosave/recovery UX, downgrade/application-rollback policy, parent-directory crash durability and fault injection for partial/truncated writes, disk-full conditions, interrupted migration and failed replacement remain required before crash-safe persistence is complete. Portable export is versioned independently from in-memory implementation types. From 772b3be1f58b989bddff5c9763c96b9b73bf993d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 11:39:47 +0900 Subject: [PATCH 76/80] docs(gap): align active source identity and slider truth --- docs/product-technical-gap-baseline.md | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index f2b01bfd3..74b2217c5 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -52,7 +52,7 @@ At this census `ContextualWisdomLab/bandscope` had **194 open pull requests** an The exact 74-repository set for this same capture is enumerated verbatim in `docs/doctoring/product-gap-baseline-2026-09-01.md`; capitalization there is the GitHub repository identity and is not normalized. Because PR creation and closure can occur during a sequential organization census, later counts are historical observations unless a new complete sweep is performed. -A protected-branch read on **2026-09-06** confirms `develop@314ddeae7b775a4957594b599358c8255617eb2e` is protected with exactly these 14 required contexts after protected PR #1165 consolidated repository-local security backstops: `ci / build-and-test`, `dependency-review`, `sbom`, `gate / build / windows`, `gate / build / macos`, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, `Analyze (javascript-typescript)`, and `Analyze (python)`. `security-audit` and `release-preflight` are no longer protected required-context names at this capture; their underlying security/release obligations remain product/release acceptance requirements where applicable. Merge decisions still re-fetch protection because this is capture-time evidence. +A protected-branch read on **2026-09-06** confirms `develop@314ddeae7b775a4957594b599358c8255617eb2e` is protected with exactly these 14 required contexts after protected PR #1165 consolidated repository-local security backstops: `ci / build-and-test`, `dependency-review`, `sbom`, `gate / build / windows`, `gate / build / macos`, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, `Analyze (javascript-typescript)`, and `Analyze (python)`. `security-audit` and `release-preflight` are no longer protected required-context names at this capture; their underlying security/release obligations remain product/release acceptance requirements where applicable. Fresh #1172 evidence also shows the last two protected names are retired producer names: the central CodeQL workflow emits `CodeQL compatibility analysis (javascript-typescript)` and `CodeQL compatibility analysis (python)`. Until branch protection is migrated to those exact producer names, the protection contract is internally unsatisfiable even when central CodeQL succeeds. The repair is a context-name migration, not restoration of a duplicate repository scanner or removal of CodeQL coverage. Merge decisions still re-fetch protection because this is capture-time evidence. Operational evidence rule: queued, pending, skipped-required, cancelled, neutral, failed, absent, stale, predecessor-head, protected-base, model-only, status-only, self/author, or administrative-bypass evidence is non-passing. A head change prevents predecessor review/check receipts from transferring to the successor head; the original historical evidence remains preserved. Force-push, destructive rebase, self-approval, gate weakening, fabricated evidence, and unrelated rollback are prohibited. @@ -68,7 +68,7 @@ Only behavior reachable from protected `develop@314ddeae7b775a4957594b599358c825 - Protected dependency update #1027 advances the independently built Tauri lockfile to `uuid 1.25.0`; branches that predate it must adopt the protected lockfile result rather than overwrite it accidentally while restacking unrelated work. - Protected workflow consolidation #1165 removes duplicate repository PR scans and keeps bounded trusted-branch backstops while central required workflows own their PR evidence; product lanes must adopt that control-plane result rather than recreate removed Bandit/CodeQL/Trivy/secret-scan writers locally. - The product already renders rehearsal-oriented section/role evidence, but protected truth does **not** yet satisfy the complete active-player, crash-recovery, real-audio acceptance, diagnostics, activation, accessibility-parity, or trusted-distribution contracts below. -- The latest immutable GitHub Release revalidated on **2026-09-05** remains `v0.1.3`, published 2026-04-28. It is historical release evidence, not proof that the current protected head satisfies the commercial release gate. +- The latest immutable GitHub Release revalidated on **2026-09-06** remains `v0.1.3`, published 2026-04-28 UTC. It is historical release evidence, not proof that the current protected head satisfies the commercial release gate. ## 4. Canonical active workstreams @@ -82,13 +82,13 @@ Active work is not shipped truth until it is normally integrated into protected | Score attachment naming | PR #1092 | Persisted project-format `scoreAttachments` retains compatibility keys `id`/`fileName`, while `trustedScoreAttachment` translates them immediately to workspace-owned `scoreId`/`scoreFileName`; recorded exact-head evidence is historical until re-fetched; no database or persisted-wire migration is introduced | | Repository-local Trivy PR-head contract | PR #1119 | Quoted/commented YAML activity-list normalization is repaired on its canonical branch; current-head workflows remain non-passing until fresh terminal evidence exists | | Trusted distribution | Issue #960; active release-identity lane PR #1126 | Semantic release-identity naming is active work; Windows signing, macOS signing/notarization, checksums, SBOM/provenance, signature-verified updater, staged rollout, rollback/repair, and complete version-identity parity remain incomplete as one integrated protected-head receipt | -| Active rehearsal player | Issue #961; canonical transport #971 with source-to-audible stack #1159 → #1160 | #971 `09bedd835475015379716292e63e6be376fceec9` owns one playback authority/state machine; #1159 `c27f3781ddcbcc013dce07a26c0baf6080e4b2ac` owns the real PCM16 stem-publication/path-free-reference layer; #1160 `332240dbba957602f217dc6e4e6a82a59d4d39b2` contains the mounted five-source selector, exact same-project source-switch transaction, stale prior-resource `play()` retirement, selected-stem revocation/fallback, EN/KO selector/loading copy, and distinct verified Full-mix-only versus retryable discovery-error states. All remain Draft/unshipped. Project Persistence #970 `04e813eb928ac057147d2a5438e3fd0f699a8b0c` owns the Draft v3 native/TypeScript document bridge with durable selected-source semantic and optional path-free source reference. Remaining buyer work is publication-bound native identity handoff from #866, restart source re-admission, mounted #1160 Save/Reopen composition, fresh-authority reopen resolution/fallback, wider locale/a11y evidence, responsive/browser/screen-reader current-head evidence, and rights-cleared audible Windows/macOS acceptance | -| Crash-safe project | Issue #962; implementation lane #970 `04e813eb928ac057147d2a5438e3fd0f699a8b0c` | Draft/unshipped and `behind_by=0` against protected develop at the current capture. It implements adjacent staged publication/recovery, a strict `projectFormatVersion: 3` envelope, deterministic legacy/v1/v2 migration, durable `preferences.selectedPlaybackSource = full_mix | vocals | bass | drums | other`, optional path-free `sourceReference` with validated project id, fixed app-owned artifact name, admitted extension, positive byte count and lowercase SHA-256, typed renderer/native current-document admission, symmetric Tauri/TypeScript save/load bridge, shared-song/domain closure, Security Notes enforcement, Windows persistence-trigger coverage and exact 5 MiB size diagnostics. Historical migration never invents source evidence. Publication-bound source identity still has to arrive from Resource Admission; restart re-admission, mounted Save/Reopen composition, backup rotation, global startup recovery, autosave, Restore/Compare/Discard UX, broader player-state persistence, descriptor-bound parent authority, downgrade/application-rollback policy and exhaustive power-loss/fault injection remain open | +| Active rehearsal player | Issue #961; canonical transport #971 with source-to-audible stack #1159 → #1160 | #971 `09bedd835475015379716292e63e6be376fceec9` owns one playback authority/state machine; #1159 `c27f3781ddcbcc013dce07a26c0baf6080e4b2ac` owns the real PCM16 stem-publication/path-free-reference layer; #1160 `332240dbba957602f217dc6e4e6a82a59d4d39b2` contains the mounted five-source selector, exact same-project source-switch transaction, stale prior-resource `play()` retirement, selected-stem revocation/fallback, EN/KO selector/loading copy, and distinct verified Full-mix-only versus retryable discovery-error states. All remain Draft/unshipped. Project Persistence #970 `04e813eb928ac057147d2a5438e3fd0f699a8b0c` owns the Draft v3 native/TypeScript document bridge with durable selected-source semantic and optional path-free source reference. Resource Admission #866 now has a typed path-free publication identity contract, but production Tauri retention/handoff of that identity is still open. Remaining buyer work is native retention/handoff from #866, restart source re-admission, mounted #1160 Save/Reopen composition, fresh-authority reopen resolution/fallback, wider locale/a11y evidence, responsive/browser/screen-reader current-head evidence, and rights-cleared audible Windows/macOS acceptance | +| Crash-safe project | Issue #962; implementation lane #970 `04e813eb928ac057147d2a5438e3fd0f699a8b0c` | Draft/unshipped and `behind_by=0` against protected develop at the current capture. It implements adjacent staged publication/recovery, a strict `projectFormatVersion: 3` envelope, deterministic legacy/v1/v2 migration, durable `preferences.selectedPlaybackSource = full_mix | vocals | bass | drums | other`, optional path-free `sourceReference` with validated project id, fixed app-owned artifact name, admitted extension, positive byte count and lowercase SHA-256, typed renderer/native current-document admission, symmetric Tauri/TypeScript save/load bridge, shared-song/domain closure, Security Notes enforcement, Windows persistence-trigger coverage and exact 5 MiB size diagnostics. Historical migration never invents source evidence. #866 now supplies the matching typed path-free identity value/builder, but the verified publication receipt is not yet retained in Tauri native state and handed to #970. Restart re-admission, mounted Save/Reopen composition, backup rotation, global startup recovery, autosave, Restore/Compare/Discard UX, broader player-state persistence, descriptor-bound parent authority, downgrade/application-rollback policy and exhaustive power-loss/fault injection remain open | | Real-audio science | Issue #770 and active benchmark lanes | Rights-safe decoded-audio MIR acceptance, recognized metrics, uncertainty and reproducible evidence remain incomplete | -| Resource admission/decode | Issue #781; canonical PR #866 `55b0da5abd5cf252c256d2cca2fc57b2d91ddab6`; commercial dependency defect #1129 | #866 production implementation is cumulative through receipt integration `bdf8f87d5e5c9db423537c7633e7ff4b92bec5b6`: `LocalAudioCopyReceipt { file_size_bytes, content_sha256 }` binds the staged bytes, the synchronized same-project stage is published as app-owned `source.`, and the publication is reopened and required to reproduce exact size+SHA-256 before bootstrap authority returns. Exact-head RED `45b1f72abeded4e478775d31085244621f68c9f0` then catches the check-then-rename clobber race; fix `eb972e951ef090c92b595c752b18d66f11f6b96e` replaces it with same-filesystem hard-link publication that fails if the fixed destination already exists, removes the private stage name, and retains publication receipt verification. `55b0da5abd5cf252c256d2cca2fc57b2d91ddab6` makes the owning TRACEABILITY current. Atomic platform no-follow descriptor acquisition, parent-directory crash durability, path-free digest handoff into #970, restart re-admission and the #1160 private SHA-256 consolidation remain open. No synthetic/mock success substitutes for production real-audio/resource evidence; #1129 still owns removal of the libsndfile-backed LGPL runtime boundary with equivalent cross-platform real-audio/SBOM proof | +| Resource admission/decode | Issue #781; canonical PR #866 `d8c57ce1d64d0bc9963219740aeaa83d9569a90b`; commercial dependency defect #1129 | #866 production materialization already stages selected bytes with `LocalAudioCopyReceipt { file_size_bytes, content_sha256 }`, synchronizes the stage, publishes app-owned `source.` through same-filesystem no-clobber hard-link creation, removes the private stage name, reopens the published object, and requires exact size+SHA-256 receipt equality before bootstrap authority returns. The core additionally defines and exports path-free `LocalAudioPublicationIdentity { project_id, artifact_name, extension, file_size_bytes, content_sha256 }`, with artifact name derived as `source.` and strict project-id/extension/size/lowercase-digest admission. A Tauri-retention RED was staged and then deliberately neutralized at `d8c57ce…` because production `main.rs` was not safely changed in the same series; those two latest commits leave no semantic production delta and native identity retention remains open. Atomic platform no-follow descriptor acquisition, parent-directory crash durability, Tauri native identity retention/handoff into #970, restart re-admission and #1160 private SHA-256 consolidation remain open. No synthetic/mock success substitutes for production real-audio/resource evidence; #1129 still owns removal of the libsndfile-backed LGPL runtime boundary with equivalent cross-platform real-audio/SBOM proof | | Diagnostics/supportability | Issue #963 | Typed redacted crash/hang evidence and user-previewable offline support bundle remain incomplete | | Activation | Issue #964 | A measured production-path first rehearsal remains incomplete | -| Accessibility/design parity | Issue #965 | WCAG 2.2 AA, keyboard/screen-reader parity, KO/EN/JA/ZH/VI/ES/DE/FR expansion, exact-value alternatives and current-head UI evidence remain incomplete; #1160's EN/KO playback-source states are an active child slice, not completion of this owner | +| Accessibility/design parity | Issue #965; reusable Slider infrastructure #1169 `4b4e6faaccaa55edab4d210e1b58c87b9f181f51` | WCAG 2.2 AA, keyboard/screen-reader parity, KO/EN/JA/ZH/VI/ES/DE/FR expansion, exact-value alternatives and current-head UI evidence remain incomplete. #1169 repairs the reusable Base UI slider's single-horizontal-scalar API, Thumb-level accessible naming/description, Track→Thumb anatomy, 24 CSS px Thumb and Control target, Base UI disabled state and nested-input focus-visible handling, with Storybook coverage; it remains Draft infrastructure and is not yet adoption/evidence for the material rehearsal seek/range path. #1160's EN/KO playback-source states are another active child slice, not completion of this owner | | Quality floor | PR #1057 and successors | Repository-owned production statement/branch coverage and public API documentation target remain 100%; lower configured thresholds are a gap | The product boundary, tests, contracts, and unique behavior decide succession—not PR number or title. Duplicate closure requires a technical succession receipt naming the unique behavior/tests preserved in the successor. Checks, approvals, and model output never transfer to a changed successor head. @@ -269,7 +269,7 @@ The production player owns one transport state machine. Loop activation never re Protected `.bscope` documentation currently validates loaded JSON against the `RehearsalSong` contract and states that a format-version field **may be introduced** when future structural changes require one; protected `develop` does not yet establish `projectFormatVersion` as shipped persisted behavior. Active canonical #970 `04e813eb928ac057147d2a5438e3fd0f699a8b0c` introduces Draft/unreleased `projectFormatVersion: 3` with typed `song`, `preferences`, and optional path-free `sourceReference`. It keeps legacy raw-song plus v1/v2 input readable through deterministic migration; migration defaults the durable playback source intent to `full_mix` where required and never invents missing source evidence. The closed durable preference remains `full_mix | vocals | bass | drums | other`; `sourceReference` admits only a validated BandScope project id, fixed app-owned `source.` artifact name, admitted extension, positive bounded byte count and canonical lowercase SHA-256. Revocable playback URLs and user filesystem paths are not durable project truth. -Resource Admission #866 exact head `55b0da5abd5cf252c256d2cca2fc57b2d91ddab6` includes production receipt integration `bdf8f87d5e5c9db423537c7633e7ff4b92bec5b6` and no-clobber publication fix `eb972e951ef090c92b595c752b18d66f11f6b96e`. The local-file materializer consumes the native staging receipt, synchronizes the same-project stage, creates app-owned `source.` with a same-filesystem hard link that fails if the destination already exists, removes the private stage name, then reopens the published object and requires `verify_local_audio_publication_receipt` size+SHA-256 equality before returning bootstrap authority. The exact head also aligns the Resource Admission doctoring/security sources and records the contract boundary: current Rust/TypeScript/Python runtime `LocalAudioSource` is a narrower analysis contract without `contentSha256`, so path-free persistence identity should be a distinct bootstrap/persistence boundary rather than an unversioned field injection into strict analysis admission. Portable path checks still do not claim atomic platform `O_NOFOLLOW`/reparse-point semantics, and the project directory is not yet explicitly synchronized after destination-link creation/stage unlink. Restart/reopen therefore remains incomplete: Project Persistence must receive publication-bound path-free evidence, resolve only the app-owned artifact, re-establish regular/no-link containment, bounded size/SHA-256 and applicable decode/admission, reconstruct a fresh bootstrap, and only then let #1160 resolve persisted selected-source intent against fresh native availability. A missing preferred stem fails closed to Full mix. +Resource Admission #866 exact head `d8c57ce1d64d0bc9963219740aeaa83d9569a90b` includes production receipt integration `bdf8f87d5e5c9db423537c7633e7ff4b92bec5b6` and no-clobber publication fix `eb972e951ef090c92b595c752b18d66f11f6b96e`. The local-file materializer consumes the native staging receipt, synchronizes the same-project stage, creates app-owned `source.` with a same-filesystem hard link that fails if the destination already exists, removes the private stage name, then reopens the published object and requires `verify_local_audio_publication_receipt` size+SHA-256 equality before returning bootstrap authority. The core now also defines/exports `LocalAudioPublicationIdentity` and `build_local_audio_publication_identity`, deriving the fixed artifact name and admitting only validated project id, canonical extension, positive bounded size and lowercase SHA-256. Current Rust/TypeScript/Python runtime `LocalAudioSource` remains the narrower analysis contract without `contentSha256`, so durable path-free identity stays a separate persistence handoff rather than an unversioned strict-analysis field injection. The remaining causal gap is production Tauri retention: the selector currently stores bootstrap source state but does not retain the typed publication identity for #970. A focused retention RED was neutralized rather than left failing because production `main.rs` was not changed in that series; `d8c57ce…` therefore carries no fabricated production-retention claim. Portable path checks still do not claim atomic platform `O_NOFOLLOW`/reparse-point semantics, and the project directory is not yet explicitly synchronized after destination-link creation/stage unlink. Restart/reopen therefore remains incomplete: Project Persistence must receive the publication-bound path-free identity from native state, resolve only the app-owned artifact, re-establish regular/no-link containment, bounded size/SHA-256 and applicable decode/admission, reconstruct a fresh bootstrap, and only then let #1160 resolve persisted selected-source intent against fresh native availability. A missing preferred stem fails closed to Full mix. Atomic replacement, last-known-good backup/recovery, deterministic/idempotent migration receipts, autosave/recovery UX, downgrade/application-rollback policy, parent-directory crash durability and fault injection for partial/truncated writes, disk-full conditions, interrupted migration and failed replacement remain required before crash-safe persistence is complete. Portable export is versioned independently from in-memory implementation types. @@ -352,6 +352,8 @@ Storybook is the executable component/state inventory, Figma is the reviewed int Active #1160 distinguishes source-discovery loading, authoritative Full-mix-only empty, retryable discovery error, and normal multi-source selection. Empty/error copy is EN/KO only, native error detail is redacted, retry uses the existing discovery receipt path, and the selected source remains an opaque native authority at runtime. Project Persistence #970 `04e813eb928ac057147d2a5438e3fd0f699a8b0c` provides the Draft v3 native/TypeScript Save/Reopen document bridge and stable selected-source semantic, but #1160 still has to compose that preference with publication-bound/re-admitted source evidence and fresh native availability before a new opaque authority is minted. This is Draft source evidence only; wider localization, responsive/browser/screen-reader evidence and rights-cleared desktop audible acceptance remain open. +Reusable Slider infrastructure #1169 `4b4e6faaccaa55edab4d210e1b58c87b9f181f51` is also Draft-only evidence. It re-establishes Base UI 1.7.0's Thumb-inside-Track anatomy, puts accessible name/description on the actual nested range input, restricts the wrapper to one horizontal scalar thumb, uses Base UI disabled/nested-input focus state, and makes both the Thumb and Control at least 24 CSS px in the pointer-target dimension. The default Storybook story is named and uses the repository's installed `@storybook/react-vite` integration. This does not prove material rehearsal UI delivery until the actual player seek/range controls adopt the primitive and current-head browser/touch/keyboard/screen-reader/responsive evidence exists. + For the #1092 ready-workspace slice, product guidance now states the actual accessibility/authority condition consistently: the map names a score to open only when attachment metadata is validated and a live Score workspace is available; reopened metadata-only projects or untrusted score metadata fall back to adding a score or checking the range by ear. A screenshot from a predecessor head, a Storybook-only state, or a Figma-only mock is not shipped UI evidence. ## 12. Quality and operability floor @@ -373,6 +375,7 @@ Unsigned validation artifacts are not releases. Queued evidence, stale Figma ver Primary normative/research anchors for this baseline include: - World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines (WCAG) 2.2*. https://www.w3.org/TR/WCAG22/ +- Base UI. (2026). *Slider*. https://base-ui.com/react/components/slider - National Institute of Standards and Technology. (2022). *Secure Software Development Framework (SSDF) Version 1.1 (NIST SP 800-218)*. https://csrc.nist.gov/pubs/sp/800/218/final - Music Information Retrieval Evaluation eXchange. (n.d.). *MIREX*. https://www.music-ir.org/mirex/ - Raffel, C., McFee, B., Humphrey, E. J., Salamon, J., Nieto, O., Liang, D., Ellis, D. P. W., & Raffel, C. C. (2014). mir_eval: A transparent implementation of common MIR metrics. *Proceedings of the 15th International Society for Music Information Retrieval Conference*, 367–372. From 3dbdecf33f4f60d21541af68ec5c7bf22f45b1d3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 12:07:28 +0900 Subject: [PATCH 77/80] docs(gap): align resource identity handoff --- docs/product-technical-gap-baseline.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 74b2217c5..103d818df 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -82,10 +82,10 @@ Active work is not shipped truth until it is normally integrated into protected | Score attachment naming | PR #1092 | Persisted project-format `scoreAttachments` retains compatibility keys `id`/`fileName`, while `trustedScoreAttachment` translates them immediately to workspace-owned `scoreId`/`scoreFileName`; recorded exact-head evidence is historical until re-fetched; no database or persisted-wire migration is introduced | | Repository-local Trivy PR-head contract | PR #1119 | Quoted/commented YAML activity-list normalization is repaired on its canonical branch; current-head workflows remain non-passing until fresh terminal evidence exists | | Trusted distribution | Issue #960; active release-identity lane PR #1126 | Semantic release-identity naming is active work; Windows signing, macOS signing/notarization, checksums, SBOM/provenance, signature-verified updater, staged rollout, rollback/repair, and complete version-identity parity remain incomplete as one integrated protected-head receipt | -| Active rehearsal player | Issue #961; canonical transport #971 with source-to-audible stack #1159 → #1160 | #971 `09bedd835475015379716292e63e6be376fceec9` owns one playback authority/state machine; #1159 `c27f3781ddcbcc013dce07a26c0baf6080e4b2ac` owns the real PCM16 stem-publication/path-free-reference layer; #1160 `332240dbba957602f217dc6e4e6a82a59d4d39b2` contains the mounted five-source selector, exact same-project source-switch transaction, stale prior-resource `play()` retirement, selected-stem revocation/fallback, EN/KO selector/loading copy, and distinct verified Full-mix-only versus retryable discovery-error states. All remain Draft/unshipped. Project Persistence #970 `04e813eb928ac057147d2a5438e3fd0f699a8b0c` owns the Draft v3 native/TypeScript document bridge with durable selected-source semantic and optional path-free source reference. Resource Admission #866 now has a typed path-free publication identity contract, but production Tauri retention/handoff of that identity is still open. Remaining buyer work is native retention/handoff from #866, restart source re-admission, mounted #1160 Save/Reopen composition, fresh-authority reopen resolution/fallback, wider locale/a11y evidence, responsive/browser/screen-reader current-head evidence, and rights-cleared audible Windows/macOS acceptance | -| Crash-safe project | Issue #962; implementation lane #970 `04e813eb928ac057147d2a5438e3fd0f699a8b0c` | Draft/unshipped and `behind_by=0` against protected develop at the current capture. It implements adjacent staged publication/recovery, a strict `projectFormatVersion: 3` envelope, deterministic legacy/v1/v2 migration, durable `preferences.selectedPlaybackSource = full_mix | vocals | bass | drums | other`, optional path-free `sourceReference` with validated project id, fixed app-owned artifact name, admitted extension, positive byte count and lowercase SHA-256, typed renderer/native current-document admission, symmetric Tauri/TypeScript save/load bridge, shared-song/domain closure, Security Notes enforcement, Windows persistence-trigger coverage and exact 5 MiB size diagnostics. Historical migration never invents source evidence. #866 now supplies the matching typed path-free identity value/builder, but the verified publication receipt is not yet retained in Tauri native state and handed to #970. Restart re-admission, mounted Save/Reopen composition, backup rotation, global startup recovery, autosave, Restore/Compare/Discard UX, broader player-state persistence, descriptor-bound parent authority, downgrade/application-rollback policy and exhaustive power-loss/fault injection remain open | +| Active rehearsal player | Issue #961; canonical transport #971 with source-to-audible stack #1159 → #1160 | #971 `09bedd835475015379716292e63e6be376fceec9` owns one playback authority/state machine; #1159 `c27f3781ddcbcc013dce07a26c0baf6080e4b2ac` owns the real PCM16 stem-publication/path-free-reference layer; #1160 `332240dbba957602f217dc6e4e6a82a59d4d39b2` contains the mounted five-source selector, exact same-project source-switch transaction, stale prior-resource `play()` retirement, selected-stem revocation/fallback, EN/KO selector/loading copy, and distinct verified Full-mix-only versus retryable discovery-error states. All remain Draft/unshipped. Project Persistence #970 `83127b55d121deff612160ed014e7a83abaf06c4` owns the Draft v3 native/TypeScript document bridge with durable selected-source semantic and optional path-free source reference, including fail-closed rejection of source byte claims above the 100 MiB Resource Admission ceiling. Resource Admission #866 `9a13d2bb91c05039481bc9eaef552f2222fcad2a` now has publication-bound byte evidence, a typed path-free publication identity contract, and production Tauri native retention of that identity after publication verification. Remaining buyer work is ordinary #866 ancestry adoption into #970, consumption of retained native identity as durable `sourceReference`, restart source re-admission, mounted #1160 Save/Reopen composition, fresh-authority reopen resolution/fallback, wider locale/a11y evidence, responsive/browser/screen-reader current-head evidence, and rights-cleared audible Windows/macOS acceptance | +| Crash-safe project | Issue #962; implementation lane #970 `83127b55d121deff612160ed014e7a83abaf06c4` | Draft/unshipped and an ordinary descendant of protected develop at the current capture. It implements adjacent staged publication/recovery, a strict `projectFormatVersion: 3` envelope, deterministic legacy/v1/v2 migration, durable `preferences.selectedPlaybackSource = full_mix | vocals | bass | drums | other`, optional path-free `sourceReference` with validated project id, fixed app-owned artifact name, admitted extension, byte count bounded to the 100 MiB Resource Admission ceiling and lowercase SHA-256, typed renderer/native current-document admission, symmetric Tauri/TypeScript save/load bridge, shared-song/domain closure, Security Notes enforcement, Windows persistence-trigger coverage and exact 5 MiB project-file size diagnostics. Historical migration never invents source evidence. #866 `9a13d2…` now supplies the matching typed path-free identity value/builder and retains verified publication identity in native Tauri state; #970 has not yet ordinarily adopted that ancestry or consumed the retained identity when constructing durable `sourceReference`. Restart re-admission, mounted Save/Reopen composition, backup rotation, global startup recovery, autosave, Restore/Compare/Discard UX, broader player-state persistence, descriptor-bound parent authority, downgrade/application-rollback policy and exhaustive power-loss/fault injection remain open | | Real-audio science | Issue #770 and active benchmark lanes | Rights-safe decoded-audio MIR acceptance, recognized metrics, uncertainty and reproducible evidence remain incomplete | -| Resource admission/decode | Issue #781; canonical PR #866 `d8c57ce1d64d0bc9963219740aeaa83d9569a90b`; commercial dependency defect #1129 | #866 production materialization already stages selected bytes with `LocalAudioCopyReceipt { file_size_bytes, content_sha256 }`, synchronizes the stage, publishes app-owned `source.` through same-filesystem no-clobber hard-link creation, removes the private stage name, reopens the published object, and requires exact size+SHA-256 receipt equality before bootstrap authority returns. The core additionally defines and exports path-free `LocalAudioPublicationIdentity { project_id, artifact_name, extension, file_size_bytes, content_sha256 }`, with artifact name derived as `source.` and strict project-id/extension/size/lowercase-digest admission. A Tauri-retention RED was staged and then deliberately neutralized at `d8c57ce…` because production `main.rs` was not safely changed in the same series; those two latest commits leave no semantic production delta and native identity retention remains open. Atomic platform no-follow descriptor acquisition, parent-directory crash durability, Tauri native identity retention/handoff into #970, restart re-admission and #1160 private SHA-256 consolidation remain open. No synthetic/mock success substitutes for production real-audio/resource evidence; #1129 still owns removal of the libsndfile-backed LGPL runtime boundary with equivalent cross-platform real-audio/SBOM proof | +| Resource admission/decode | Issue #781; canonical PR #866 `9a13d2bb91c05039481bc9eaef552f2222fcad2a`; commercial dependency defect #1129 | #866 production materialization stages selected bytes with `LocalAudioCopyReceipt { file_size_bytes, content_sha256 }`, synchronizes the stage, publishes app-owned `source.` through same-filesystem no-clobber hard-link creation, removes the private stage name, reopens the published object, and requires exact size+SHA-256 receipt equality before bootstrap authority returns. The core defines/exports path-free `LocalAudioPublicationIdentity { project_id, artifact_name, extension, file_size_bytes, content_sha256 }`, with artifact name derived as `source.` and strict project-id/extension/size/lowercase-digest admission. RED `106ae75cad85553e56964a9844ea7a01f6ce456c` and fix `e4e2ba734bc80304a754ce2eb52e473fd9ee3631` make native retention production code: materialization derives the identity only after publication verification, selection stores it in `LocalAudioPublicationIdentityState` keyed by the BandScope project id before bootstrap authority returns, and Tauri registers that state. Atomic platform no-follow descriptor acquisition, parent-directory crash durability, ordinary #970 adoption/consumption of retained identity, restart re-admission and #1160 private SHA-256 consolidation remain open. No synthetic/mock success substitutes for production real-audio/resource evidence; #1129 still owns removal of the libsndfile-backed LGPL runtime boundary with equivalent cross-platform real-audio/SBOM proof | | Diagnostics/supportability | Issue #963 | Typed redacted crash/hang evidence and user-previewable offline support bundle remain incomplete | | Activation | Issue #964 | A measured production-path first rehearsal remains incomplete | | Accessibility/design parity | Issue #965; reusable Slider infrastructure #1169 `4b4e6faaccaa55edab4d210e1b58c87b9f181f51` | WCAG 2.2 AA, keyboard/screen-reader parity, KO/EN/JA/ZH/VI/ES/DE/FR expansion, exact-value alternatives and current-head UI evidence remain incomplete. #1169 repairs the reusable Base UI slider's single-horizontal-scalar API, Thumb-level accessible naming/description, Track→Thumb anatomy, 24 CSS px Thumb and Control target, Base UI disabled state and nested-input focus-visible handling, with Storybook coverage; it remains Draft infrastructure and is not yet adoption/evidence for the material rehearsal seek/range path. #1160's EN/KO playback-source states are another active child slice, not completion of this owner | @@ -267,9 +267,9 @@ The production player owns one transport state machine. Loop activation never re ### 7.4 Persistence and contract versioning -Protected `.bscope` documentation currently validates loaded JSON against the `RehearsalSong` contract and states that a format-version field **may be introduced** when future structural changes require one; protected `develop` does not yet establish `projectFormatVersion` as shipped persisted behavior. Active canonical #970 `04e813eb928ac057147d2a5438e3fd0f699a8b0c` introduces Draft/unreleased `projectFormatVersion: 3` with typed `song`, `preferences`, and optional path-free `sourceReference`. It keeps legacy raw-song plus v1/v2 input readable through deterministic migration; migration defaults the durable playback source intent to `full_mix` where required and never invents missing source evidence. The closed durable preference remains `full_mix | vocals | bass | drums | other`; `sourceReference` admits only a validated BandScope project id, fixed app-owned `source.` artifact name, admitted extension, positive bounded byte count and canonical lowercase SHA-256. Revocable playback URLs and user filesystem paths are not durable project truth. +Protected `.bscope` documentation currently validates loaded JSON against the `RehearsalSong` contract and states that a format-version field **may be introduced** when future structural changes require one; protected `develop` does not yet establish `projectFormatVersion` as shipped persisted behavior. Active canonical #970 `83127b55d121deff612160ed014e7a83abaf06c4` introduces Draft/unreleased `projectFormatVersion: 3` with typed `song`, `preferences`, and optional path-free `sourceReference`. It keeps legacy raw-song plus v1/v2 input readable through deterministic migration; migration defaults the durable playback source intent to `full_mix` where required and never invents missing source evidence. The closed durable preference remains `full_mix | vocals | bass | drums | other`; `sourceReference` admits only a validated BandScope project id, fixed app-owned `source.` artifact name, admitted extension, positive byte count no greater than the current 100 MiB Resource Admission ceiling and canonical lowercase SHA-256. Revocable playback URLs and user filesystem paths are not durable project truth. -Resource Admission #866 exact head `d8c57ce1d64d0bc9963219740aeaa83d9569a90b` includes production receipt integration `bdf8f87d5e5c9db423537c7633e7ff4b92bec5b6` and no-clobber publication fix `eb972e951ef090c92b595c752b18d66f11f6b96e`. The local-file materializer consumes the native staging receipt, synchronizes the same-project stage, creates app-owned `source.` with a same-filesystem hard link that fails if the destination already exists, removes the private stage name, then reopens the published object and requires `verify_local_audio_publication_receipt` size+SHA-256 equality before returning bootstrap authority. The core now also defines/exports `LocalAudioPublicationIdentity` and `build_local_audio_publication_identity`, deriving the fixed artifact name and admitting only validated project id, canonical extension, positive bounded size and lowercase SHA-256. Current Rust/TypeScript/Python runtime `LocalAudioSource` remains the narrower analysis contract without `contentSha256`, so durable path-free identity stays a separate persistence handoff rather than an unversioned strict-analysis field injection. The remaining causal gap is production Tauri retention: the selector currently stores bootstrap source state but does not retain the typed publication identity for #970. A focused retention RED was neutralized rather than left failing because production `main.rs` was not changed in that series; `d8c57ce…` therefore carries no fabricated production-retention claim. Portable path checks still do not claim atomic platform `O_NOFOLLOW`/reparse-point semantics, and the project directory is not yet explicitly synchronized after destination-link creation/stage unlink. Restart/reopen therefore remains incomplete: Project Persistence must receive the publication-bound path-free identity from native state, resolve only the app-owned artifact, re-establish regular/no-link containment, bounded size/SHA-256 and applicable decode/admission, reconstruct a fresh bootstrap, and only then let #1160 resolve persisted selected-source intent against fresh native availability. A missing preferred stem fails closed to Full mix. +Resource Admission #866 exact head `9a13d2bb91c05039481bc9eaef552f2222fcad2a` includes production receipt integration `bdf8f87d5e5c9db423537c7633e7ff4b92bec5b6`, no-clobber publication fix `eb972e951ef090c92b595c752b18d66f11f6b96e`, and production native-retention fix `e4e2ba734bc80304a754ce2eb52e473fd9ee3631`. The local-file materializer consumes the native staging receipt, synchronizes the same-project stage, creates app-owned `source.` with a same-filesystem hard link that fails if the destination already exists, removes the private stage name, then reopens the published object and requires `verify_local_audio_publication_receipt` size+SHA-256 equality before returning bootstrap authority. The core defines/exports `LocalAudioPublicationIdentity` and `build_local_audio_publication_identity`, deriving the fixed artifact name and admitting only validated project id, canonical extension, positive bounded size and lowercase SHA-256. After publication verification, production materialization returns that identity with the runtime source payload, selection stores the identity in `LocalAudioPublicationIdentityState` keyed by the BandScope project id before bootstrap authority returns, and Tauri registers the state. Current Rust/TypeScript/Python runtime `LocalAudioSource` remains the narrower analysis contract without `contentSha256`, so durable path-free identity stays a separate persistence handoff rather than an unversioned strict-analysis field injection. The remaining cross-owner gap is #970 consumption: #970 has not yet ordinarily adopted #866 or consumed that retained native identity when constructing v3 `sourceReference`. Portable path checks still do not claim atomic platform `O_NOFOLLOW`/reparse-point semantics, and the project directory is not yet explicitly synchronized after destination-link creation/stage unlink. Restart/reopen therefore remains incomplete: Project Persistence must receive the retained publication-bound path-free identity from native state, resolve only the app-owned artifact, re-establish regular/no-link containment, bounded size/SHA-256 and applicable decode/admission, reconstruct a fresh bootstrap, and only then let #1160 resolve persisted selected-source intent against fresh native availability. A missing preferred stem fails closed to Full mix. Atomic replacement, last-known-good backup/recovery, deterministic/idempotent migration receipts, autosave/recovery UX, downgrade/application-rollback policy, parent-directory crash durability and fault injection for partial/truncated writes, disk-full conditions, interrupted migration and failed replacement remain required before crash-safe persistence is complete. Portable export is versioned independently from in-memory implementation types. @@ -350,7 +350,7 @@ The canonical Figma identity must be rediscovered from current protected BandSco Storybook is the executable component/state inventory, Figma is the reviewed interaction/visual specification, and the shipped Tauri application is the final acceptance target. Material UI work must verify real pointer/touch/keyboard interaction, section/time-axis identity, playback cursor, persistence/reload, stale-response races, loading/partial/error/unsupported-codec/missing-stem states, responsive window sizes, visible focus, reduced motion, non-color-only status, screen-reader names/states, KO/EN/JA/ZH/VI/ES/DE/FR expansion and exact-value/list/table alternatives for graph/timeline/waveform content. -Active #1160 distinguishes source-discovery loading, authoritative Full-mix-only empty, retryable discovery error, and normal multi-source selection. Empty/error copy is EN/KO only, native error detail is redacted, retry uses the existing discovery receipt path, and the selected source remains an opaque native authority at runtime. Project Persistence #970 `04e813eb928ac057147d2a5438e3fd0f699a8b0c` provides the Draft v3 native/TypeScript Save/Reopen document bridge and stable selected-source semantic, but #1160 still has to compose that preference with publication-bound/re-admitted source evidence and fresh native availability before a new opaque authority is minted. This is Draft source evidence only; wider localization, responsive/browser/screen-reader evidence and rights-cleared desktop audible acceptance remain open. +Active #1160 distinguishes source-discovery loading, authoritative Full-mix-only empty, retryable discovery error, and normal multi-source selection. Empty/error copy is EN/KO only, native error detail is redacted, retry uses the existing discovery receipt path, and the selected source remains an opaque native authority at runtime. Project Persistence #970 `83127b55d121deff612160ed014e7a83abaf06c4` provides the Draft v3 native/TypeScript Save/Reopen document bridge and stable selected-source semantic, but #1160 still has to compose that preference with publication-bound/re-admitted source evidence and fresh native availability before a new opaque authority is minted. This is Draft source evidence only; wider localization, responsive/browser/screen-reader evidence and rights-cleared desktop audible acceptance remain open. Reusable Slider infrastructure #1169 `4b4e6faaccaa55edab4d210e1b58c87b9f181f51` is also Draft-only evidence. It re-establishes Base UI 1.7.0's Thumb-inside-Track anatomy, puts accessible name/description on the actual nested range input, restricts the wrapper to one horizontal scalar thumb, uses Base UI disabled/nested-input focus state, and makes both the Thumb and Control at least 24 CSS px in the pointer-target dimension. The default Storybook story is named and uses the repository's installed `@storybook/react-vite` integration. This does not prove material rehearsal UI delivery until the actual player seek/range controls adopt the primitive and current-head browser/touch/keyboard/screen-reader/responsive evidence exists. From 10ccae149657cca18c0468b805e0a9bb3bc87e64 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 03:06:39 +0900 Subject: [PATCH 78/80] docs(gap): align baseline with current persistence and audio authority --- docs/product-technical-gap-baseline.md | 320 +++++++++++-------------- 1 file changed, 139 insertions(+), 181 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 103d818df..a693ed15e 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,16 +1,14 @@ # BandScope Product-Technical Gap Baseline -Last updated: 2026-09-06 -Evidence capture: live GitHub state is dated at observation; protected refs are revalidated when identified as current +Last updated: 2026-09-07 +Evidence capture: live GitHub state is dated at observation; protected refs are revalidated before merge/release claims Protected product truth: `develop@314ddeae7b775a4957594b599358c8255617eb2e` ## Purpose -This document is the canonical live product/technical gap synthesis for BandScope. It is governed by `AGENTS.md`, `ARCHITECTURE.md`, the security/repository/engineering sources they reference, and `docs/brand-story.md`; if this synthesis conflicts with those owning sources, the owning source wins and this baseline must be repaired. Mechanical enforcement remains in the repository's tests, root verification scripts, workflows, and protected-branch rules rather than in prose alone. +This document is the canonical live product/technical gap synthesis for BandScope. `AGENTS.md`, `CLAUDE.md`, `ARCHITECTURE.md`, owning ADR/PRD/TRD/security/test/release documents, protected source, and live GitHub state remain the detailed authorities. If this synthesis conflicts with an owning source, the owning source wins and this file must be repaired. -It separates protected shipped truth from active pull-request work, research/acceptance work, superseded work, and external control-plane dependencies. A PR body, predecessor check, model review, screenshot, remembered SHA, or generated routing manifest is never shipped truth. - -BandScope is a local-first rehearsal decision product. The commercial loop is complete only when a musician can admit a real local recording, obtain evidence-backed rehearsal guidance, rehearse a precise passage, save and recover the project, share a bounded handoff, diagnose failures without leaking private media, and install, update, repair, or roll back a verifiable signed build. +BandScope is a local-first rehearsal decision product. Commercial completion means a musician can admit an authorized real recording, obtain reproducible evidence-backed rehearsal guidance, move directly into audible rehearsal, preserve and recover the project without silent data loss, hand off only bounded intended data, diagnose failures without leaking private media, and install/update/rollback a verifiable signed build. BandScope is not a DAW, notation editor, mandatory cloud service, or an authority that presents uncertain machine analysis as unquestionable musical truth. @@ -21,127 +19,110 @@ BandScope is not a DAW, notation editor, mandatory cloud service, or an authorit The product must let a working musician or band member: 1. select an authorized local recording and reach useful rehearsal guidance without first exporting media to a cloud service; -2. understand form, section boundaries, harmony, groove/timing, entries/dropouts, range, overlap, handoffs, setup cues, and role-specific preparation with uncertainty visible where the evidence does not justify certainty; -3. move from an insight to audible rehearsal in the same product through one transport authority supporting play/pause/seek/stop, precise section/range loop, count-in, playback rate, cue navigation, and source-backed stem controls where real stems exist; +2. understand form, section boundaries, harmony, groove/timing, entries/dropouts, range, overlap, handoffs, setup cues, and role-specific preparation with uncertainty visible where evidence does not justify certainty; +3. move from an insight to audible rehearsal through one transport authority supporting play/pause/seek/stop, section/range loop, count-in, playback rate, cue navigation, and source-backed stem controls where admitted stems actually exist; 4. correct machine evidence without erasing the original estimate, confidence, model identity, source identity, or user-confirmed provenance; 5. close and reopen work, survive interrupted writes and migrations, and recover the last known-good project without a partial write replacing it; 6. export a bounded collaboration handoff without creating a second authoritative project store; 7. inspect redacted diagnostics and a user-previewable offline support bundle without ordinary logs containing raw audio, project payloads, credentials, or absolute paths; -8. install and update a build whose version, signature, checksum, SBOM, provenance, rollout state, and rollback/repair path can be verified. +8. install and update a build whose version, signature, checksum, SBOM, provenance, rollout state, model/dependency inventory, and rollback/repair path can be verified. -Representative user stories are intentionally end-to-end rather than one-card micro-features: +Representative end-to-end stories remain deliberately broader than micro-features: -- As a player, I can open my local song, see the first high-value rehearsal action, start the relevant passage, count it in, and loop it without rebuilding transport in another tool. -- As a band member, I can see section × role guidance and distinguish machine evidence from a user-confirmed correction. -- As a returning user, I can reopen the same project after a crash or interrupted save and recover the last known-good rehearsal state, including transport/loop state where the format supports it. +- As a player, I can open my local song, see the first high-value rehearsal action, start the relevant passage, count it in, and loop it without rebuilding transport elsewhere. +- As a returning user, I can reopen the same project after a crash or interrupted save and recover the last known-good rehearsal state and durable source intent without silently manufacturing new source authority. - As a user of keyboard or assistive technology, I can perform the same primary rehearsal actions and obtain exact-value alternatives to visual-only maps, timelines, or waveforms. -- As a maintainer or support recipient, I can preview exactly what diagnostic evidence will leave the machine and verify that private media and credentials are excluded. -- As an installer, I can distinguish an unsigned validation artifact from a verifiable production release and can roll back a bad staged update. +- As an installer, I can distinguish an unsigned validation artifact from a verifiable production release and roll back a bad staged update without app/model/dependency identity drifting silently. -### 1.2 Commercial acceptance boundaries +### 1.2 Commercial acceptance boundary -A buyer-visible capability is complete only when its production path, negative/error states, persistence/recovery behavior where applicable, security boundary, accessibility contract, and release evidence are all integrated on one protected identity. A static card, Storybook-only state, Figma-only mock, generated array, direct feature matrix, synthetic audio fixture, or predecessor-head check cannot substitute for the relevant production acceptance path. +A buyer-visible capability is complete only when its production path, negative/error states, persistence/recovery behavior where applicable, security boundary, accessibility contract, real-audio/scientific evidence where applicable, and release evidence are integrated on one protected identity. Storybook/Figma-only states, generated arrays, synthetic audio, direct feature matrices, predecessor-head checks, model reviews, or screenshots cannot substitute for the relevant production acceptance path. -The near-term product order remains: merge-train convergence; trusted distribution; active rehearsal player; crash-safe project; real-audio science/resource admission; diagnostics; activation; accessibility/design parity; 100% repository-owned production statement/branch coverage and public API documentation. +Near-term order remains: merge-train convergence; trusted distribution; active rehearsal player; crash-safe project; real-audio science/resource admission; diagnostics; activation; accessibility/design parity; 100% repository-owned production statement/branch/edge coverage and public API documentation. ## 2. Live delivery authority -A complete accessible-repository sweep begun at **2026-09-02 21:56 KST** queried all **74** repositories visible under `ContextualWisdomLab` at that observation individually. The sequential per-repository counts summed to **2,940 open pull requests**. A subsequent organization-wide aggregate returned **2,941 open pull requests** with `incomplete_results=false`. The one-PR difference is a non-atomic observation, not attribution to a particular repository: PR creation and closure can occur during or after the sequential sweep, so this census remains dated evidence rather than permanent product truth. - -At this census `ContextualWisdomLab/bandscope` had **194 open pull requests** and the same capture's issue search returned **19 open issues**, so it remained the selected delivery boundary at that observation. High-backlog peers observed in that capture were `ContextualWisdomLab/naruon` (148), `ContextualWisdomLab/OriginWeave` (142), `ContextualWisdomLab/newsdom-api` (139), `ContextualWisdomLab/pg-erd-cloud` (138), `ContextualWisdomLab/TEPP` (130), `ContextualWisdomLab/.github` (128), `ContextualWisdomLab/html4tree` (127), `ContextualWisdomLab/Orgmetra` (117), and `ContextualWisdomLab/LineageWeave` (113). BandScope is selected not by name alone but because it combines a large observed queue with direct buyer-facing rehearsal responsibility and high-leverage release/security/workflow reuse boundaries. - -The exact 74-repository set for this same capture is enumerated verbatim in `docs/doctoring/product-gap-baseline-2026-09-01.md`; capitalization there is the GitHub repository identity and is not normalized. Because PR creation and closure can occur during a sequential organization census, later counts are historical observations unless a new complete sweep is performed. - -A protected-branch read on **2026-09-06** confirms `develop@314ddeae7b775a4957594b599358c8255617eb2e` is protected with exactly these 14 required contexts after protected PR #1165 consolidated repository-local security backstops: `ci / build-and-test`, `dependency-review`, `sbom`, `gate / build / windows`, `gate / build / macos`, `trivy-fs`, `coverage-evidence`, `opencode-review`, `strix`, `scan-pr-queue`, `osv-scan`, `scorecard`, `Analyze (javascript-typescript)`, and `Analyze (python)`. `security-audit` and `release-preflight` are no longer protected required-context names at this capture; their underlying security/release obligations remain product/release acceptance requirements where applicable. Fresh #1172 evidence also shows the last two protected names are retired producer names: the central CodeQL workflow emits `CodeQL compatibility analysis (javascript-typescript)` and `CodeQL compatibility analysis (python)`. Until branch protection is migrated to those exact producer names, the protection contract is internally unsatisfiable even when central CodeQL succeeds. The repair is a context-name migration, not restoration of a duplicate repository scanner or removal of CodeQL coverage. Merge decisions still re-fetch protection because this is capture-time evidence. +A complete accessible-repository census begun 2026-09-02 21:56 KST observed 74 `ContextualWisdomLab` repositories. Sequential counts summed to 2,940 open pull requests and the subsequent organization aggregate returned 2,941 with `incomplete_results=false`; the one-PR difference is non-atomic observation, not attribution. BandScope had 194 open PRs and 19 open issues in that dated capture. Later counts are not inferred from it. -Operational evidence rule: queued, pending, skipped-required, cancelled, neutral, failed, absent, stale, predecessor-head, protected-base, model-only, status-only, self/author, or administrative-bypass evidence is non-passing. A head change prevents predecessor review/check receipts from transferring to the successor head; the original historical evidence remains preserved. Force-push, destructive rebase, self-approval, gate weakening, fabricated evidence, and unrelated rollback are prohibited. +The current protected BandScope product source is `develop@314ddeae7b775a4957594b599358c8255617eb2e`. The recorded protection contract contains 14 required contexts, including retired producer names `Analyze (javascript-typescript)` and `Analyze (python)`. Issue #1172 owns migration to the central producer names `CodeQL compatibility analysis (javascript-typescript)` and `CodeQL compatibility analysis (python)`. Restoring a duplicate repository scanner or weakening/removing CodeQL coverage is not an acceptable workaround. -Merge readiness is re-evaluated per unchanged exact PR head; an organization-wide approval search is not a substitute for per-head proof. +Operational evidence rule: queued, pending, skipped-required, cancelled, neutral, failed, absent, stale, predecessor-head, protected-base, model-only, status-only, self/author, or administrative-bypass evidence is non-passing. A head change invalidates predecessor review/check receipts for readiness. Force-push, destructive rebase, self-approval, gate weakening, fabricated evidence, and unrelated rollback are prohibited. ## 3. Shipped protected truth -Only behavior reachable from protected `develop@314ddeae7b775a4957594b599358c8255617eb2e` belongs in this section. +Only behavior reachable from protected `develop@314ddeae7b775a4957594b599358c8255617eb2e` is shipped truth. -- BandScope is a React/Vite desktop workspace hosted by Tauri with local orchestration and a Python analysis service plus Rust/PyO3 numerical kernels. -- Typed Tauri IPC and bounded local process boundaries are the intended local execution model; ordinary rehearsal analysis does not require a public cloud service. -- Protected dependency-security repair #783 is already in `develop` ancestry. Open branches must not reframe its historical dependency findings as an unmerged product blocker or suppress them locally. -- Protected dependency update #1027 advances the independently built Tauri lockfile to `uuid 1.25.0`; branches that predate it must adopt the protected lockfile result rather than overwrite it accidentally while restacking unrelated work. -- Protected workflow consolidation #1165 removes duplicate repository PR scans and keeps bounded trusted-branch backstops while central required workflows own their PR evidence; product lanes must adopt that control-plane result rather than recreate removed Bandit/CodeQL/Trivy/secret-scan writers locally. -- The product already renders rehearsal-oriented section/role evidence, but protected truth does **not** yet satisfy the complete active-player, crash-recovery, real-audio acceptance, diagnostics, activation, accessibility-parity, or trusted-distribution contracts below. -- The latest immutable GitHub Release revalidated on **2026-09-06** remains `v0.1.3`, published 2026-04-28 UTC. It is historical release evidence, not proof that the current protected head satisfies the commercial release gate. +- BandScope is a React/Vite desktop workspace hosted by Tauri with local orchestration, a Python analysis service, and Rust/PyO3 numerical/native kernels. +- Typed Tauri IPC and bounded local process/stdin-stdout boundaries are the intended local execution model; ordinary rehearsal analysis does not require a public cloud service. +- Protected workflow consolidation #1165 removes duplicate repository PR scanners while central required workflows own PR evidence. Product branches must adopt that result rather than recreate removed security writers locally. +- Protected truth still does not satisfy the complete active-player, crash-recovery, rights-cleared real-audio, diagnostics, activation, accessibility-parity, or trusted-distribution contracts below. +- The latest immutable public GitHub release revalidated in the current delivery lineage remains `v0.1.3`, published 2026-04-28 UTC. It is historical release evidence, not proof that the current protected head is commercially release-ready. ## 4. Canonical active workstreams -Active work is not shipped truth until it is normally integrated into protected `develop` with current-head gates and qualifying independent review. +Active work is Draft/unshipped until normally integrated into protected `develop` with current-head gates and qualifying independent review. | Boundary | Canonical live owner / evidence | Current status | |---|---|---| -| Merge-train control plane | Issue #966 with executable queue lane PR #968 | #968 remains Draft; its unique queue machinery must survive every restack and its exact current head is non-passing until hosted/current-head evidence exists | -| Canonical baseline | PR #1116, this file | Draft; this branch is an ordinary descendant of current protected `develop`; every source repair requires fresh exact-head evidence and a non-force reconciliation of #968 before integration | -| Workspace role naming | PR #1130 | The **active owner branch** uses `RehearsalRoleOption.roleId`/`roleName` with primary `roleOptions`; the previous `{ id, name }[]` projection exists only as a deprecated component compatibility input there. Protected `develop` is not claimed to contain this projection before integration | -| Score attachment naming | PR #1092 | Persisted project-format `scoreAttachments` retains compatibility keys `id`/`fileName`, while `trustedScoreAttachment` translates them immediately to workspace-owned `scoreId`/`scoreFileName`; recorded exact-head evidence is historical until re-fetched; no database or persisted-wire migration is introduced | -| Repository-local Trivy PR-head contract | PR #1119 | Quoted/commented YAML activity-list normalization is repaired on its canonical branch; current-head workflows remain non-passing until fresh terminal evidence exists | -| Trusted distribution | Issue #960; active release-identity lane PR #1126 | Semantic release-identity naming is active work; Windows signing, macOS signing/notarization, checksums, SBOM/provenance, signature-verified updater, staged rollout, rollback/repair, and complete version-identity parity remain incomplete as one integrated protected-head receipt | -| Active rehearsal player | Issue #961; canonical transport #971 with source-to-audible stack #1159 → #1160 | #971 `09bedd835475015379716292e63e6be376fceec9` owns one playback authority/state machine; #1159 `c27f3781ddcbcc013dce07a26c0baf6080e4b2ac` owns the real PCM16 stem-publication/path-free-reference layer; #1160 `332240dbba957602f217dc6e4e6a82a59d4d39b2` contains the mounted five-source selector, exact same-project source-switch transaction, stale prior-resource `play()` retirement, selected-stem revocation/fallback, EN/KO selector/loading copy, and distinct verified Full-mix-only versus retryable discovery-error states. All remain Draft/unshipped. Project Persistence #970 `83127b55d121deff612160ed014e7a83abaf06c4` owns the Draft v3 native/TypeScript document bridge with durable selected-source semantic and optional path-free source reference, including fail-closed rejection of source byte claims above the 100 MiB Resource Admission ceiling. Resource Admission #866 `9a13d2bb91c05039481bc9eaef552f2222fcad2a` now has publication-bound byte evidence, a typed path-free publication identity contract, and production Tauri native retention of that identity after publication verification. Remaining buyer work is ordinary #866 ancestry adoption into #970, consumption of retained native identity as durable `sourceReference`, restart source re-admission, mounted #1160 Save/Reopen composition, fresh-authority reopen resolution/fallback, wider locale/a11y evidence, responsive/browser/screen-reader current-head evidence, and rights-cleared audible Windows/macOS acceptance | -| Crash-safe project | Issue #962; implementation lane #970 `83127b55d121deff612160ed014e7a83abaf06c4` | Draft/unshipped and an ordinary descendant of protected develop at the current capture. It implements adjacent staged publication/recovery, a strict `projectFormatVersion: 3` envelope, deterministic legacy/v1/v2 migration, durable `preferences.selectedPlaybackSource = full_mix | vocals | bass | drums | other`, optional path-free `sourceReference` with validated project id, fixed app-owned artifact name, admitted extension, byte count bounded to the 100 MiB Resource Admission ceiling and lowercase SHA-256, typed renderer/native current-document admission, symmetric Tauri/TypeScript save/load bridge, shared-song/domain closure, Security Notes enforcement, Windows persistence-trigger coverage and exact 5 MiB project-file size diagnostics. Historical migration never invents source evidence. #866 `9a13d2…` now supplies the matching typed path-free identity value/builder and retains verified publication identity in native Tauri state; #970 has not yet ordinarily adopted that ancestry or consumed the retained identity when constructing durable `sourceReference`. Restart re-admission, mounted Save/Reopen composition, backup rotation, global startup recovery, autosave, Restore/Compare/Discard UX, broader player-state persistence, descriptor-bound parent authority, downgrade/application-rollback policy and exhaustive power-loss/fault injection remain open | -| Real-audio science | Issue #770 and active benchmark lanes | Rights-safe decoded-audio MIR acceptance, recognized metrics, uncertainty and reproducible evidence remain incomplete | -| Resource admission/decode | Issue #781; canonical PR #866 `9a13d2bb91c05039481bc9eaef552f2222fcad2a`; commercial dependency defect #1129 | #866 production materialization stages selected bytes with `LocalAudioCopyReceipt { file_size_bytes, content_sha256 }`, synchronizes the stage, publishes app-owned `source.` through same-filesystem no-clobber hard-link creation, removes the private stage name, reopens the published object, and requires exact size+SHA-256 receipt equality before bootstrap authority returns. The core defines/exports path-free `LocalAudioPublicationIdentity { project_id, artifact_name, extension, file_size_bytes, content_sha256 }`, with artifact name derived as `source.` and strict project-id/extension/size/lowercase-digest admission. RED `106ae75cad85553e56964a9844ea7a01f6ce456c` and fix `e4e2ba734bc80304a754ce2eb52e473fd9ee3631` make native retention production code: materialization derives the identity only after publication verification, selection stores it in `LocalAudioPublicationIdentityState` keyed by the BandScope project id before bootstrap authority returns, and Tauri registers that state. Atomic platform no-follow descriptor acquisition, parent-directory crash durability, ordinary #970 adoption/consumption of retained identity, restart re-admission and #1160 private SHA-256 consolidation remain open. No synthetic/mock success substitutes for production real-audio/resource evidence; #1129 still owns removal of the libsndfile-backed LGPL runtime boundary with equivalent cross-platform real-audio/SBOM proof | -| Diagnostics/supportability | Issue #963 | Typed redacted crash/hang evidence and user-previewable offline support bundle remain incomplete | -| Activation | Issue #964 | A measured production-path first rehearsal remains incomplete | -| Accessibility/design parity | Issue #965; reusable Slider infrastructure #1169 `4b4e6faaccaa55edab4d210e1b58c87b9f181f51` | WCAG 2.2 AA, keyboard/screen-reader parity, KO/EN/JA/ZH/VI/ES/DE/FR expansion, exact-value alternatives and current-head UI evidence remain incomplete. #1169 repairs the reusable Base UI slider's single-horizontal-scalar API, Thumb-level accessible naming/description, Track→Thumb anatomy, 24 CSS px Thumb and Control target, Base UI disabled state and nested-input focus-visible handling, with Storybook coverage; it remains Draft infrastructure and is not yet adoption/evidence for the material rehearsal seek/range path. #1160's EN/KO playback-source states are another active child slice, not completion of this owner | -| Quality floor | PR #1057 and successors | Repository-owned production statement/branch coverage and public API documentation target remain 100%; lower configured thresholds are a gap | - -The product boundary, tests, contracts, and unique behavior decide succession—not PR number or title. Duplicate closure requires a technical succession receipt naming the unique behavior/tests preserved in the successor. Checks, approvals, and model output never transfer to a changed successor head. +| Merge-train control plane | Issue #966; queue lane PR #968 | #968 `7c773cdda932855c0e1b9d114c70bb14acc5adea` is Draft on #1116 and owns exactly 22 queue-control workflow/ADR/reference/manifest/script/test files. Every #1116 source move requires ordinary non-force reconciliation preserving those files and a non-divergent baseline blob. | +| Canonical baseline | PR #1116, this file | Draft. This source is the single writer for `docs/product-technical-gap-baseline.md`; active PR behavior is described as Draft evidence, never promoted into shipped truth. | +| Trusted distribution | Issue #960; release-identity lane #1126; dependency/model blockers #1129/#1180/#1181 | Windows signing, macOS signing/notarization, checksums, SBOM/provenance, signature-verified updater, staged rollout, rollback/repair, `libsndfile` removal, and a commercially admissible immutable separation model are not yet one integrated protected-head receipt. | +| Active rehearsal player | Issue #961; #971 with source stack #1159 → #1160 | #1160 `332240dbba957602f217dc6e4e6a82a59d4d39b2` remains Draft and has not yet adopted current #970. Native stem admission/playback/source switching exists on that branch, but persisted source intent must be reconciled with fresh Full mix/current-stem audible authority after reopen. Missing preferred stems must fail closed to Full mix. | +| Crash-safe project | Issue #962; PR #970 | #970 exact Draft head `767b87e3e2fec3116ec274c22db6995cbb2defc2` has ordinarily adopted Resource Admission #866 `841e1c9b7329dba6d0ff16daecc009a2c3face0c`. It implements v3 Save/load, path-free source evidence, restart exact-content re-admission, analysis-time source revalidation and snapshot-bound decode, local model admission, and mounted Open→Save preservation of native project selection plus `selectedPlaybackSource`. Autosave/global recovery UX, broader fault injection, descriptor-bound higher-parent authority, and Active Player audible-authority reconstruction remain open. | +| Real-audio science | Issue #770 and active benchmark lanes | Rights-cleared decoded-audio MIR acceptance, recognized task metrics, uncertainty and reproducibility remain incomplete. Synthetic/generated audio remains unit-test evidence only. | +| Resource admission/decode | Issue #781; PR #866; commercial dependency defect #1129 | #866 exact `841e1c9b7329dba6d0ff16daecc009a2c3face0c` owns app-owned audio materialization/publication and `LocalAudioPublicationIdentity`. #970 consumes it through typed persistence/re-admission ACLs. #1129 still owns removal of the `soundfile`/`libsndfile` LGPL runtime path with equivalent supported-platform real-audio/SBOM evidence. | +| Commercial separation model | Issue #1180; rights blocker #1181 | #970's local Demucs compatibility admission is technical Draft evidence only. Distribution still requires an immutable commercially admissible exact artifact with full provenance/size/digest-or-signature, safer or justified serialization, release inventory, updater/rollback behavior, and rights-cleared Windows/macOS real-audio evidence. #1181 independently blocks upstream pretrained weights absent explicit commercial-use/redistribution rights. | +| Diagnostics/supportability | Issue #963 | Typed redacted crash/hang evidence and a user-previewable offline support bundle remain incomplete. | +| Activation | Issue #964 | A measured production-path first rehearsal remains incomplete. | +| Accessibility/design parity | Issue #965 and active component/player lanes | WCAG 2.2 AA, keyboard/screen-reader parity, KO/EN/JA/ZH/VI/ES/DE/FR expansion, CJK/text expansion/font fallback, exact-value alternatives, and current-head material-UI evidence remain incomplete. | +| Quality floor | PR #1057 and successors | Repository-owned production Docstring/rustdoc, Test, and Edge Case Coverage targets remain 100%; denominator reduction, skip/xfail, generated-code relabeling, or source-text-only success cannot manufacture compliance. | + +The product boundary, tests, contracts, and unique behavior decide succession, not PR number or title. Duplicate closure requires a technical succession receipt naming the unique behavior/tests preserved in the successor. Checks, approvals, and model output do not transfer to a changed successor head. ## 5. Merge-train and succession contract -Backlog convergence is the primary engineering risk because micro-PR fan-out creates duplicate writers, stale evidence, dependency ambiguity, competing local state, and review/check churn. +Backlog convergence is an engineering risk because micro-PR fan-out creates duplicate writers, stale evidence, dependency ambiguity, competing local state, and review/check churn. -PR #968 owns the unique executable queue machinery needed by #966: bounded GitHub pagination, exact active-head capture, independent base-tip resolution, deterministic ordering, malformed/incomplete/duplicate rejection, symlink-safe atomic publication, reviewed dependency/succession metadata, network-independent validation, deterministic human projection/parity, and exact-head artifact preservation. It must not be discarded as stale documentation. +PR #968 owns the executable #966 queue machinery: bounded GitHub pagination, exact active-head capture, independent base-tip resolution, deterministic ordering, malformed/incomplete/duplicate rejection, symlink-safe atomic publication, dependency/succession metadata, network-independent validation, deterministic human projection/parity, and exact-head artifact preservation. It must not be discarded as stale documentation. -The canonical baseline branch must contain protected `develop@314ddeae7b775a4957594b599358c8255617eb2e` in its ancestry through an ordinary non-force reconciliation. PR #968 targets this baseline branch rather than protected `develop` directly. Every #1116 branch advance therefore changes #968's target tip: #968 must be re-resolved against that new base and obtain fresh exact-head checks/reviews before readiness, while preserving its unique queue-control source through ordinary non-force reconciliation. Historical #1116/#968 SHAs remain audit evidence only and are not described as current identities after either branch advances. +The canonical baseline branch must remain an ordinary descendant of current protected `develop`. PR #968 targets #1116 rather than protected `develop` directly. Every #1116 advance therefore changes #968's target tip and requires another ordinary non-force descendant on #968 that preserves its queue-owned files. Historical SHAs remain audit evidence only. -A previously recorded #1117 snapshot was `refactor/temporal-features-api@b98f266d2356d56be624fb617580b5252e85baaa` with then-base `develop@749511c3ad4000090048718f685c6bee6b3d2c25`. Its visible review threads were independently resolved in that historical capture; that evidence belongs to #1117 and never substitutes for #1116 or #968 evidence. #1117 does not own `docs/product-technical-gap-baseline.md`, and the current protected product tip is now `develop@314ddeae7b775a4957594b599358c8255617eb2e`; any #1117 merge decision must re-fetch its live head/base and evidence rather than reuse this snapshot. - -PR #1007 is the canonical first-part-handoff lane only to the extent that its live semantic diff still preserves mounted selected-role wiring and the scientific prohibition against manufacturing handoffs from heuristic fallback. Any succession decision is rechecked against the independently resolved live head rather than a remembered PR-body SHA. - -Draft status is used only for a real unverified or blocked boundary and is never toggled solely to manufacture CI. +Review/check waiting is lane-local rather than a global blocker: while one head waits for hosted evidence, other independent canonical work may proceed. Failed checks are RCA/fix/rerun work, not justification to weaken gates. ## 6. Domain model and ownership -For a musician, these boundaries serve one simple flow: pick a song, understand what matters tonight, rehearse it, save it safely, and share only what was intended. The technical split below exists so those actions do not fight over authority or expose private media. +For the musician the flow is simple: pick a song, understand what matters tonight, rehearse it, save it safely, and share only what was intended. The technical split exists so those actions do not fight over authority or expose private media. -BandScope keeps these bounded contexts distinct: +BandScope bounded contexts remain: 1. **Audio Ingestion** — user-selected source authority and intake intent. -2. **Resource Admission & Decode** — codec/MIME/path/resource/cancellation boundaries. -3. **Signal/MIR Analysis** — decoded-audio evidence and uncertainty. +2. **Resource Admission & Decode** — codec/MIME/path/resource/cancellation boundaries and admitted bytes. +3. **Signal/MIR Analysis** — decoded-audio evidence, model identity, uncertainty, reproducibility. 4. **Rehearsal Insight** — section × role decisions, cues, confidence and correction provenance. -5. **Active Player** — one authoritative transport state machine for play/pause/seek/stop/loop/count-in/rate/cue navigation and source-backed stem controls. -6. **Project Persistence** — format version, atomic publication, autosave, migration, backup/recovery and portable export. +5. **Active Player** — one authoritative transport state machine and fresh audible source/stem authority. +6. **Project Persistence** — versioned project format, atomic publication, migration, backup/recovery and portable export. 7. **Collaboration Handoff** — bounded share/export contracts, never a second project source of truth. -8. **Diagnostics/Support** — typed redacted evidence and support bundle lifecycle. -9. **Distribution/Update** — signed identity, SBOM/provenance, updater verification, rollout and rollback. -10. **UI/Interaction** — accessible, localized rendering of domain state; no duplicated transport/project stores. +8. **Diagnostics/Support** — typed redacted evidence and support-bundle lifecycle. +9. **Distribution/Update** — signed identity, SBOM/provenance, model/dependency inventory, updater verification, rollout and rollback. +10. **UI/Interaction** — accessible localized rendering of domain state; no duplicated transport/project stores. -Generic `utils`, `helpers`, `common`, `services`, `shared`, `core`, or `models` dumping that erases these responsibilities is a defect. Cross-context persistence and duplicated local transport stores are also defects. +Generic `utils`, `helpers`, `common`, `services`, `shared`, `core`, or `models` dumping that erases responsibility is a defect. Cross-context SQL, mutable sibling PR dependencies, source copying from canonical sibling owners, or parallel writable project/transport truth is prohibited. Released/versioned contracts and narrow anti-corruption layers are the integration mechanism. -### 6.1 Ubiquitous language, aggregates, invariants, and events +### 6.1 Ubiquitous language and invariants | Term | Meaning | Invariant / transaction boundary | |---|---|---| -| `RehearsalProject` | durable work for one admitted rehearsal source | one published format version; a partial write never replaces the last known-good snapshot | -| `AudioSourceRef` | authorized local source identity plus bounded metadata | source authority is explicit; raw media is not copied into ordinary logs or EA truth | -| `SongSection` | stable-ID time-bounded structural region | ordered, finite range inside admitted media duration; display label is not identity | -| `RehearsalRole` | instrument, vocal function, or useful subdivision | guidance belongs to project/section and retains evidence provenance | +| `RehearsalProject` | durable work for one admitted rehearsal source | one published format version; a partial write never silently replaces last known-good truth | +| `LocalAudioPublicationIdentity` | path-free native receipt for app-owned admitted audio | project id, fixed artifact name, extension, exact byte count and SHA-256 remain validated; renderer does not mint it | +| `ProjectSourceReference` | durable Project Persistence projection of admitted source identity | evidence only, not a filesystem capability; restart must re-admit current bytes before runtime authority returns | | `AnalysisEvidence` | versioned machine estimate | confidence/model/source provenance survives correction | -| `ManualOverride` | user-confirmed correction | original machine evidence remains auditable; confirmation is not silently reclassified as model truth | -| `RehearsalCue` | actionable entry/stop/pickup/handoff/range/setup/timing instruction | referenced section/time/role remains resolvable | +| `ManualOverride` | user-confirmed correction | original machine evidence remains auditable | | `RehearsalTransport` | count-in/loop/playback/navigation state | one authoritative state machine; no competing mounted/local stores | -| `SupportBundle` | user-previewable redacted diagnostic export | excludes raw audio/project payloads, credentials and absolute local paths by default | -| `ReleaseIdentity` | version/artifact/signature/checksum/provenance tuple | updater accepts only policy-valid signed identity and preserves rollback target | +| `SelectedPlaybackSource` | durable `full_mix | vocals | bass | drums | other` intent | never itself grants audible authority; current media must be freshly admitted after reopen | +| `PlaybackAuthority` | revocable runtime authority over an admitted audible source | stale/replaced/missing media cannot retain authority merely because prior analysis or persistence succeeded | +| `ReleaseIdentity` | app/model/artifact/signature/checksum/provenance tuple | updater accepts only policy-valid signed compatible identity and preserves rollback target | -Candidate domain events include `AudioSourceAdmitted`, `AnalysisCompleted`, `CueConfirmed`, `SectionBoundaryCorrected`, `LoopActivated`, `ProjectSnapshotPublished`, `ProjectRecovered`, `SupportBundlePrepared`, `UpdateStaged`, and `UpdateRollbackCompleted`. +Candidate domain events include `AudioSourceAdmitted`, `AnalysisCompleted`, `CueConfirmed`, `SectionBoundaryCorrected`, `LoopActivated`, `ProjectSnapshotPublished`, `ProjectRecovered`, `PlaybackSourceReadmitted`, `SupportBundlePrepared`, `UpdateStaged`, and `UpdateRollbackCompleted`. ### 6.2 Context map @@ -179,26 +160,22 @@ flowchart LR HANDOFF --> SK ``` -The diagram is logical responsibility, not a claim that each box is a separate process. Shared contracts stay small and versioned; external codec/model/platform types remain behind anti-corruption layers. - -`context-graph-contracts` remains the contract-only shared kernel for canonical refs, authority/truth status, bitemporal/provenance Context Assertions, CloudEvents, schemas and conformance. `enterprise-architecture-core` remains the EA Decision Plane. BandScope projects deployable/runtime/version/risk facts through released contracts and does not copy rehearsal audio/analysis/user truth into EA authoritative storage. +`context-graph-contracts` remains the contract-only shared kernel for canonical refs, authority/truth status, bitemporal/provenance Context Assertions, CloudEvents, schemas and conformance. `enterprise-architecture-core` remains the EA Decision Plane. BandScope does not copy rehearsal audio/analysis/user truth into sibling authoritative storage. ## 7. Technical design contract (TRD) -The technical design has one rehearsal-facing goal: every click should keep the musician on the same trusted song and project while the app does the complicated validation and analysis out of sight. - ### 7.1 Production topology and ports -Protected `develop` is a local desktop architecture with these principal implementation surfaces: +Principal surfaces are: -- `apps/desktop`: React/Vite UI rendered inside the Tauri desktop shell; -- `apps/desktop/src-tauri`: native command/orchestration boundary and platform integration; -- `apps/desktop/core`: Rust-owned local authority/input-validation helpers where currently implemented; +- `apps/desktop`: React/Vite UI inside Tauri; +- `apps/desktop/src-tauri`: native command/orchestration and platform boundary; +- `apps/desktop/core`: Rust-owned local authority/input-validation helpers where implemented; - `packages/shared-types`: versioned cross-layer request/response/domain contracts; -- `services/analysis-engine`: Python orchestration/compatibility plus still-mixed analysis code during migration; -- `services/analysis-engine/rust`: `bandscope_numeric` Rust/PyO3 numerical kernels. +- `services/analysis-engine`: Python orchestration/compatibility during Rust-first migration; +- `services/analysis-engine/rust`: Rust/PyO3 numerical kernels. -Typed allowlisted Tauri IPC and bounded local process/stdin-stdout boundaries are the intended orchestration ports. If an owning adapter requires loopback transport it is limited to `127.0.0.1`; public HTTP and other network-dependent paths are not ordinary local-analysis authority. Codec libraries, source-separation/model runtimes, filesystem/platform APIs, accelerators, update services, and external handoff contracts are adapters behind owning-context ports. +Typed allowlisted Tauri IPC and bounded local process/stdin-stdout are the normal orchestration ports. Public HTTP is not ordinary local-analysis authority. Codec/model/platform/accelerator/update services remain behind owning-context ports. ### 7.2 End-to-end rehearsal sequence @@ -218,90 +195,50 @@ sequenceDiagram Decode->>MIR: bounded decoded audio MIR->>Insight: evidence + uncertainty + provenance Insight-->>UI: section/role/cue decisions - User->>Player: play/seek/count-in/loop/rate/cue - Player->>Project: persist accepted transport/project state + User->>Player: play/seek/count-in/loop/rate/cue/source + Player->>Project: persist accepted intent/state Project-->>UI: published snapshot or recoverable failure ``` -If decode, analysis, persistence, or playback fails, the error remains typed and bounded; a synthetic analysis object is not substituted as production success. - -### 7.3 Transport, source replacement, and project state ownership +Decode, analysis, persistence, and playback failures remain typed and bounded. Production never substitutes a synthetic analysis object or stale playback source as success. -```mermaid -stateDiagram-v2 - [*] --> NoSource - NoSource --> InitialSourceSelecting: choose source - NoSource --> RecoveringWithoutSource: project recovery requested - InitialSourceSelecting --> Ready: source admitted - InitialSourceSelecting --> NoSource: cancelled/failed initial selection - Ready --> ReplacementSourceSelecting: replace source - ReplacementSourceSelecting --> Ready: replacement admitted - ReplacementSourceSelecting --> Ready: cancelled/failed replacement keeps prior source - Ready --> Playing: play - Playing --> Paused: pause - Paused --> Playing: resume - Playing --> Looping: precise loop active - Looping --> LoopPaused: pause (loop retained) - LoopPaused --> Looping: resume - Looping --> Playing: loop cleared - LoopPaused --> Paused: loop cleared - Playing --> Ready: stop - Paused --> Ready: stop - Looping --> Ready: stop - LoopPaused --> Ready: stop - Playing --> ReplacementSourceSelecting: replace source requested / stop transport - Paused --> ReplacementSourceSelecting: replace source requested - Looping --> ReplacementSourceSelecting: replace source requested / stop transport - LoopPaused --> ReplacementSourceSelecting: replace source requested - Ready --> NoSource: clear source - Ready --> RecoveringWithSource: project recovery requested - RecoveringWithoutSource --> Ready: last-known-good restored - RecoveringWithoutSource --> RecoveryFailedWithoutSource: no valid recoverable snapshot - RecoveryFailedWithoutSource --> NoSource: recovery failure acknowledged - RecoveringWithSource --> Ready: last-known-good restored - RecoveringWithSource --> RecoveryFailedWithSource: no valid recoverable snapshot - RecoveryFailedWithSource --> Ready: recovery failure acknowledged / keep prior source -``` +### 7.3 Project Persistence / Resource Admission truth -The production player owns one transport state machine. Loop activation never removes pause or stop authority: active-loop playback may pause with the loop retained, resume into that loop, clear the loop into ordinary playback/paused state, or stop directly. Initial admission and replacement use distinct selection-intent states so cancellation has one unambiguous outcome: a cancelled or failed initial selection returns to no source, while a cancelled or failed replacement returns to the prior admitted source. Source replacement is transactional: a pending replacement must not erase the prior admitted source; conflicting source/import/analysis actions remain unavailable until selection resolves. Recovery likewise preserves its origin: acknowledging a failed recovery requested from `NoSource` returns to `NoSource`, while a failed recovery requested from `Ready` returns to `Ready` with the prior admitted source unchanged. Either state can explicitly request recovery again, and failure never manufactures a successful recovered state. UI components, cue cards, map cursors, and persisted project data project from the owning authority rather than creating competing writable state. Project publication **must become** atomic and crash-safe in protected product truth; #970 has an active Draft implementation, but this diagram does not promote it into a shipped guarantee. +Current Draft #970 has ordinarily adopted #866 rather than duplicating its audio-publication policy. -### 7.4 Persistence and contract versioning +`#866@841e1c9b7329dba6d0ff16daecc009a2c3face0c` owns selected-local-audio copy/admission/publication. It stages selected bytes, synchronizes and publishes the app-owned `source.`, reopens the published object, verifies exact size + SHA-256 receipt equality, then creates a path-free `LocalAudioPublicationIdentity`. Native state retains that verified identity keyed by BandScope project id. -Protected `.bscope` documentation currently validates loaded JSON against the `RehearsalSong` contract and states that a format-version field **may be introduced** when future structural changes require one; protected `develop` does not yet establish `projectFormatVersion` as shipped persisted behavior. Active canonical #970 `83127b55d121deff612160ed014e7a83abaf06c4` introduces Draft/unreleased `projectFormatVersion: 3` with typed `song`, `preferences`, and optional path-free `sourceReference`. It keeps legacy raw-song plus v1/v2 input readable through deterministic migration; migration defaults the durable playback source intent to `full_mix` where required and never invents missing source evidence. The closed durable preference remains `full_mix | vocals | bass | drums | other`; `sourceReference` admits only a validated BandScope project id, fixed app-owned `source.` artifact name, admitted extension, positive byte count no greater than the current 100 MiB Resource Admission ceiling and canonical lowercase SHA-256. Revocable playback URLs and user filesystem paths are not durable project truth. +`#970@767b87e3e2fec3116ec274c22db6995cbb2defc2` consumes that identity. Draft `projectFormatVersion: 3` stores `song`, `preferences.selectedPlaybackSource`, and optional path-free `sourceReference = projectId + artifactName + extension + fileSizeBytes + contentSha256`. Legacy/v1/v2 input is migrated deterministically and never invents missing source evidence. Renderer-authored path, artifact name, byte count, digest, or `sourceReference` is rejected; the renderer may return only an already-minted project selector and durable playback-source intent to native Save. -Resource Admission #866 exact head `9a13d2bb91c05039481bc9eaef552f2222fcad2a` includes production receipt integration `bdf8f87d5e5c9db423537c7633e7ff4b92bec5b6`, no-clobber publication fix `eb972e951ef090c92b595c752b18d66f11f6b96e`, and production native-retention fix `e4e2ba734bc80304a754ce2eb52e473fd9ee3631`. The local-file materializer consumes the native staging receipt, synchronizes the same-project stage, creates app-owned `source.` with a same-filesystem hard link that fails if the destination already exists, removes the private stage name, then reopens the published object and requires `verify_local_audio_publication_receipt` size+SHA-256 equality before returning bootstrap authority. The core defines/exports `LocalAudioPublicationIdentity` and `build_local_audio_publication_identity`, deriving the fixed artifact name and admitting only validated project id, canonical extension, positive bounded size and lowercase SHA-256. After publication verification, production materialization returns that identity with the runtime source payload, selection stores the identity in `LocalAudioPublicationIdentityState` keyed by the BandScope project id before bootstrap authority returns, and Tauri registers the state. Current Rust/TypeScript/Python runtime `LocalAudioSource` remains the narrower analysis contract without `contentSha256`, so durable path-free identity stays a separate persistence handoff rather than an unversioned strict-analysis field injection. The remaining cross-owner gap is #970 consumption: #970 has not yet ordinarily adopted #866 or consumed that retained native identity when constructing v3 `sourceReference`. Portable path checks still do not claim atomic platform `O_NOFOLLOW`/reparse-point semantics, and the project directory is not yet explicitly synchronized after destination-link creation/stage unlink. Restart/reopen therefore remains incomplete: Project Persistence must receive the retained publication-bound path-free identity from native state, resolve only the app-owned artifact, re-establish regular/no-link containment, bounded size/SHA-256 and applicable decode/admission, reconstruct a fresh bootstrap, and only then let #1160 resolve persisted selected-source intent against fresh native availability. A missing preferred stem fails closed to Full mix. +On restart, production `load_project` resolves only an existing app-local aggregate, opens the fixed source through the canonical native opener, re-verifies exact bounded bytes, and restores native publication/bootstrap state only after that reverse admission succeeds. A persisted source reference is evidence, not authority. -Atomic replacement, last-known-good backup/recovery, deterministic/idempotent migration receipts, autosave/recovery UX, downgrade/application-rollback policy, parent-directory crash durability and fault injection for partial/truncated writes, disk-full conditions, interrupted migration and failed replacement remain required before crash-safe persistence is complete. Portable export is versioned independently from in-memory implementation types. +Before `start_analysis_job` queue admission, retained publication identity is revalidated again. The child process receives exact admitted byte count and SHA-256 through its bounded process contract. The analysis process copies the opened source into a private spooled snapshot, verifies exact size and SHA-256, and decodes that same snapshot. The earlier admitted-audio pathname replacement gap between verification and analysis decode is therefore closed for this Draft path. -Tauri IPC, shared types, project files, handoff schemas, updater manifests, and externally released event/contracts are versioned boundaries. A rename or ownership cleanup is never permission for an in-place breaking wire-format change. +Mounted Open→Save previously dropped the reopened source selector and reset non-default `selectedPlaybackSource`. RED `9ceeb2faa73317e591a1741a0d246b82f9311423` and fix `9a9151d1a5420c83218ac220d29cb144c9e3b45d` make `App` retain the validated path-free project selector plus versioned playback intent and return them through native-authoritative Save. It still cannot mint source evidence. -### 7.5 Identifier-policy migration boundary +Residual persistence work includes global/startup recovery policy, autosave/backup rotation and Restore/Compare/Discard UX, broader power-loss/disk-full/interrupted-migration fault injection, application downgrade/rollback policy, and descriptor-bound protection against concurrent replacement of higher parent directories. -The organization naming policy applies prospectively to new or materially changed **organization-owned internal identifiers**. Casing follows the host language/framework. Semantic multiword names such as `section_id`, `sectionId`, `SectionId`, `firstGrooveChange`, and `SectionRoadmap` are valid. Generic single-word organization-owned names such as bare `id`, `name`, `status`, `data`, `value`, `type`, `key`, `item`, `record`, `result`, `config`, `event`, `user`, or `role` are defects when a bounded-context name is available. +### 7.4 Active Player authority -When an existing bare field is already part of a persisted or cross-boundary contract, a semantic rename follows the owning contract's compatibility mechanism: +Project Persistence and analysis authority do not imply audible authority. On reopen, persisted `selectedPlaybackSource` is intent only. #1160 must ordinarily adopt current #970/#866 ancestry, remove its private duplicate SHA-256 implementation in favor of the canonical desktop-core reader, re-admit current Full mix and current stem artifacts, and only then mint fresh `PlaybackAuthority`. If the preferred persisted stem no longer exists or fails admission, the product falls back to Full mix without preserving stale prior authority. -- project files: first introduce an explicit format-version field (target name `project_format_version`) through the canonical persistence evolution path, then introduce any renamed persisted field behind that versioned migration; readers accept supported prior representations, migration is deterministic/idempotent, and writers emit one canonical current representation after migration; -- Tauri IPC/shared API: use an additive/versioned request or response contract or a bounded compatibility alias; do not remove the previous key until supported callers have migrated and contract tests prove interoperability; -- database-owned schemas: use explicit schema migration with backward-compatible read/write sequencing, foreign-key/index/constraint/ORM/query updates, rollback evidence, normalized ownership, UPSERT-path validation, and locking/hot-partition review rather than an uncoordinated column rename; -- released handoff/events/context contracts: retain mandated released spelling until the owning contract publishes a compatible version; anti-corruption layers translate at the boundary; -- external/vendor fields: preserve external spelling exactly and map into semantically owned internal names after admission. +The material UI must prove source selection, play/pause/seek/stop/loop/count-in/rate/cue navigation, source replacement, stale async/media events, persistence/reload, and exact accessible alternatives with actual admitted media. -Every compatibility-changing rename requires fixtures from the previous supported version, round-trip/no-data-loss tests, deterministic repeated migration, rollback/recovery evidence where persistence is involved, and removal criteria for any temporary alias. There is never dual writable truth after migration. +### 7.5 Signal/MIR model admission and distribution boundary -Current examples demonstrate the intended direction without breaking compatibility. PR #1130's active owner branch makes `roleId`, `roleName`, and `roleOptions` the switcher-owned vocabulary while accepting the old component projection only at one deprecated adapter input; protected `develop` is not claimed to contain that projection before normal integration. PR #1092 keeps the established persisted score attachment keys `id` and `fileName` unchanged but makes `trustedScoreAttachment` an explicit anti-corruption boundary that validates those keys and returns `scoreId` and `scoreFileName` for workspace logic. Its focused RED contract was commit `35dc521f03711d749771751ecf39b904f193057d`; the production semantic translation was commit `8cd6756ef242d99fc323181b21b58f96fe24c731`; subsequent documentation commits aligned `ARCHITECTURE.md`, `AGENTS.md`, `CHANGELOG.md`, and `CLAUDE.md` with the same live-workspace/fallback invariant. No database object or persisted project wire key changed in that repair. +#970's Draft compatibility path for Demucs local model loading is not release provenance. It rejects missing/non-regular/symlinked/empty/oversized/checksum-mismatched cache objects before resolution, materializes only the preflight descriptor size into a private temporary `LocalRepo`, rejects early EOF or any extra post-`fstat` byte, and resolves locally so mutation/deletion of the original cache pathname cannot change bytes for that load or reactivate `RemoteRepo`. -### 7.6 Rust compute ownership +The 128 MiB model ceiling and Demucs eight-hex filename checksum remain compatibility/integrity controls only. They are not exact release size, full digest/signature, provenance, or rights evidence. Upstream native Demucs checkpoint loading uses PyTorch serialization with class/constructor metadata, so it remains a trusted code-bearing deserialization boundary. -Protected code is still mixed: selected numerical kernels are Rust/PyO3 while material analysis orchestration and some arithmetic remain Python/NumPy. The target architecture is Rust-first for repository-owned DSP, mathematical, vector, linear/matrix, data-science/ranking, and token-size core arithmetic. +Issue #1180 therefore owns an immutable commercially admissible model artifact: exact identity/version/size/full digest or signed manifest, provenance/NOTICE/SBOM inventory, supported-platform placement, local-only loading, explicit serialization choice/removal condition, updater compatibility/rollback, and rights-cleared real-audio acceptance. #1181 separately owns the commercial-use/redistribution rights prerequisite for upstream pretrained weights; mirrors, conversions, or renamed files do not create rights. -Python is bounded orchestration/compatibility/fixture/reporting during migration. CPU reference behavior should be deterministic `f64` where scientifically appropriate, with bounded multithreading and unnecessary context switching removed. CUDA/OpenCL/MLX paths require real backend execution, parity and resource evidence where configured. A hidden Python numerical fallback is not the target architecture. +### 7.6 Rust compute ownership -Migration order follows buyer impact and dependency leverage: temporal/beat and harmony; range/pitch/role features; prioritization/weighting; source-separation integration; then remaining repository-owned vector/matrix utilities. Rust↔Python parity is migration evidence, not justification for permanent duplicated production arithmetic. +Repository-owned DSP, mathematical, vector/matrix, ranking/data-science and performance/security hot paths are Rust-first. Python remains bounded orchestration/compatibility/fixture/reporting only where no practical Rust replacement exists and must have documented rationale/removal conditions. Deterministic CPU reference behavior comes first; configured CPU multithreading/MLX/CUDA/OpenCL paths require actual backend execution, parity and resource evidence. Hidden Python numerical fallback is not the target architecture. ## 8. Persistence ERD and database discipline -BandScope's current durable project authority is file/project-format based rather than an organization-owned relational production schema. No database DDL changed in the #1092 naming repair. If relational persistence is introduced, database objects must use specific multiword snake_case names, be normalized to at least 3NF where relevant, and preserve one authoritative write path. +Current durable project authority is file/project-format based; BandScope does not currently require a separate organization-owned relational authoritative store. ```mermaid erDiagram @@ -313,71 +250,92 @@ erDiagram REHEARSAL_PROJECT ||--|| REHEARSAL_TRANSPORT : persists ``` -Any future SQL migration must verify foreign keys, indexes, constraints, sequences, ORM/query mappings, UPSERT semantics, hot-partition risk, lock duration, read/write separation, backward compatibility, rollback and recovery before it is considered complete. +If relational persistence is introduced, objects use specific multiword snake_case names, normalize to at least 3NF where relevant, and retain one authoritative write path. Any SQL migration must verify foreign keys, indexes, constraints, sequences, ORM/query mappings, UPSERT/idempotency semantics, hot-partition risk, lock duration, read/write separation, backward compatibility, rollback and recovery. Cross-service SQL remains prohibited. ## 9. Real-audio scientific acceptance -Synthetic arrays, mocked UI journeys, direct feature matrices, source-text assertions, or generated audio may support unit tests but cannot prove product accuracy. +Synthetic arrays, generated/mock audio, mocked UI journeys, direct feature matrices, or source-text assertions may support unit tests but cannot prove product accuracy. -Commercial acceptance requires rights-safe real audio to pass the production intake → decode → analysis → UI path with exact fixture, annotation, integrity and license provenance. Metrics remain task-specific: chord/harmony evaluation uses a recognized chord metric such as benchmark-defined weighted chord recall; beat/timing uses recognized event metrics; separation uses SI-SDR plus task-appropriate robustness/perceptual evidence; range/pitch/transcription uses declared note/frame/event metrics; section/cue boundaries use tolerances derived from annotation uncertainty and rehearsal cost rather than an invented constant. +Commercial scientific acceptance requires rights-cleared real audio through production intake → decode → analysis → UI/playback with exact fixture identity, annotation, integrity and license provenance. Metrics remain task-specific: chord/harmony uses a recognized chord metric such as benchmark-defined weighted chord recall; beat/timing uses recognized event metrics; separation uses SI-SDR plus task-appropriate perceptual/robustness evidence; range/pitch/transcription uses declared note/frame/event metrics; section/cue boundaries use tolerances tied to annotation uncertainty and rehearsal cost rather than an invented constant. -Acceptance criteria are preregistered before tuning and report uncertainty across tracks. Candidate-vs-baseline comparisons disclose sample count, aggregation, confidence interval or other justified uncertainty method, exclusions, and missing-data handling. Configured GPU lanes must actually execute and report parity/peak-resource evidence; unsupported hardware is not converted into a passing claim. +Acceptance criteria are preregistered before tuning and report uncertainty across tracks. Candidate-vs-baseline comparisons disclose sample count, aggregation, confidence interval or another justified uncertainty method, exclusions, and missing-data handling. Configured accelerator lanes must actually execute and report parity/peak-resource evidence. ## 10. Security and privacy baseline -Local files, URLs, MIME/codec claims, decoder outputs, model artifacts, project files, updater manifests, subprocess output and support exports are untrusted. +Local files, URLs, MIME/codec claims, decoder outputs, model artifacts, project files, updater manifests, subprocess output, and support exports are untrusted. -Owning contexts must fail closed on path/symlink/reparse traversal, oversized/decompression/resource exhaustion, unsafe subprocess authority, credential/secret propagation and prompt-injection crossings. Valid source-backed GHAS/CodeQL/Semgrep/Strix/AppGuardrail findings are deduplicated by root cause and repaired in the canonical product lane. Scanner/control-plane defects remain with their owning repository; BandScope does not blanket-mask findings or weaken gates. +Owning contexts fail closed on traversal/symlink/reparse substitution, oversized/decompression/resource exhaustion, stale descriptor/path races, unsafe subprocess authority, credential/secret propagation, and prompt-injection crossings where an LLM boundary exists. Valid GHAS/CodeQL/Semgrep/Strix/AppGuardrail findings are deduplicated by root cause and repaired in the canonical lane. Scanner/control-plane defects remain with their owning repository; BandScope does not blanket-mask findings or weaken gates. -Ordinary logs/support bundles must not contain raw audio/project payloads, credentials or absolute local paths. Authorization is purpose-bound and least-privilege with field minimization, retention and access/export audit where relevant. +Ordinary logs/support bundles exclude raw audio/project payloads, credentials and absolute local paths. Authorization is purpose-bound and least-privilege with field minimization, retention and access/export audit where relevant. ### Security Notes -- **IPC/network boundary:** ordinary local analysis uses allowlisted Tauri IPC, bounded stdin/stdout, or an explicitly required loopback adapter limited to `127.0.0.1`. Public HTTP and other network-dependent paths are not local-analysis authority. -- **Input admission:** project/media/codec/model/update/subprocess inputs are untrusted and require strict schema/type/size/path validation before domain use. -- **Subprocess authority:** use argument arrays with non-shell execution (`shell=False`-equivalent); do not interpolate untrusted input into shell commands. -- **Privacy:** diagnostics and support exports redact credentials, raw audio/project payloads and absolute local paths by default, with user-previewable bounded export. -- **Artifact trust:** installers/updaters require owning-boundary signature, checksum, SBOM and provenance verification; staged rollout and rollback evidence remain part of release acceptance. -- **Verification status:** queued, pending, neutral, skipped-required, cancelled, stale, predecessor or inaccessible-protection evidence is non-passing and cannot be promoted into security assurance. +#### Attack surface -The most recently recorded central control-plane head in this document is `ContextualWisdomLab/.github@f610598c585d8dfdabe6fd82204173e23ad09841`; it is historical evidence until that owner is freshly revalidated. Issue `.github#712` remains the recorded organization-wide Actions queue-health/runner-admission causal owner. The associated historical cross-repository evidence showed jobs waiting before checkout with no runner assignment across both `ubuntu-latest` and explicit `ubuntu-24.04`, including an unchanged Wardnet head that previously completed successfully on the same label. That evidence falsified a simple leaf runner-label defect for that observation but did not identify whether the remaining owner cause was hosted-runner capacity, organization concurrency/admission policy, billing/quota, or provider scheduling. Earlier protected `.github#1658`, `.github#1656`, `.github#1665`, `.github#1645`, and subsequent scheduler fixes reduce avoidable load/review-routing/cancellation ambiguity but do not convert a queued current-head check into success. +Audio/model/project acquisition, filesystem lookup/publication/recovery, decoder/model loading, IPC/subprocess boundaries, playback media authority, diagnostics export, installer/updater and rollback. -A prior #1092 exact-head capture on `8099e3b2525723474aca09db4d669167035263b3` observed 27 check runs, with required/security lanes such as `dependency-review`, `scorecard`, and `trivy-fs` still queued at that capture. It is historical evidence and must be re-fetched before any #1092 merge decision. A skipped manual-evidence helper is not a substitute for required evidence. No predecessor-head success is transferred. +#### Trust boundary + +Audio Ingestion owns user source intent; Resource Admission owns admitted app-local bytes; Project Persistence stores only versioned path-free evidence; Signal/MIR consumes admitted snapshots; Active Player separately owns fresh audible authority; Distribution owns remotely acquired/shipped artifact provenance. No lower layer may treat a persisted string, renderer payload, previous analysis result, or mutable sibling branch as authority. + +#### Mitigations + +Strict type/schema/size/path validation, regular/no-link or descriptor-bound acquisition where implemented, exact byte receipts, private immutable-for-use snapshots, no-shell subprocess invocation, local-only model resolution, redacted diagnostics, signed release/update manifests, exact model/dependency inventory, fail-closed stale-source handling, and ordinary protected-branch gates. + +#### Realistic threats + +A moved/replaced local source or model is consumed after validation; an interrupted save publishes candidate bytes without recoverable ordering; a persisted source preference is mistaken for current playback authority; a malformed/corrupt/oversized artifact reaches decoder/deserializer; an implicit network model fetch occurs; release rights are inferred from code licensing; a stale updater/model combination changes rehearsal output; logs expose private local state. + +#### Safe failure + +Invalid/stale/missing authority is rejected with bounded buyer-facing diagnostics. The product does not manufacture synthetic analysis, reuse stale audible authority, silently downgrade to an unverified model/provider, or weaken required checks to make a run pass. + +#### Test points + +Moved/replaced/truncated/growing audio and model files; symlink/reparse and linked-parent cases; exact-size/hash mismatch; disk-full/interrupted publication/recovery; process-restart source re-admission; stale preferred stem fallback; malformed IPC/project data; corrupt/object-graph model artifacts where applicable; updater interruption/rollback; redacted support bundles; supported-platform real-audio execution. + +#### Remaining risk + +Higher-parent directory authority is not yet descriptor-bound against every concurrent replacement. Commercial model/dependency rights and release provenance remain unresolved. Active Player still needs fresh audible Full mix/stem authority on current #970 ancestry. Global autosave/recovery UX and broad fault injection remain incomplete. ## 11. UI/UX evidence gate -The canonical Figma identity must be rediscovered from current protected BandScope docs/source before a material UI merge; the latest baseline reference is `zthWmqfNKUgJBECvv002Qk`, treated as a resolved design authority rather than a permanent remembered constant. +Figma is the reviewed interaction/visual specification, Storybook the executable component/state inventory, and the shipped Tauri application the final acceptance target. The canonical Figma identity must be rediscovered from current protected docs/source before a material UI merge rather than treated as a permanent remembered constant. -Storybook is the executable component/state inventory, Figma is the reviewed interaction/visual specification, and the shipped Tauri application is the final acceptance target. Material UI work must verify real pointer/touch/keyboard interaction, section/time-axis identity, playback cursor, persistence/reload, stale-response races, loading/partial/error/unsupported-codec/missing-stem states, responsive window sizes, visible focus, reduced motion, non-color-only status, screen-reader names/states, KO/EN/JA/ZH/VI/ES/DE/FR expansion and exact-value/list/table alternatives for graph/timeline/waveform content. +Material UI work must verify actual pointer/touch/keyboard interaction, section/time-axis identity, playback cursor, persistence/reload, stale-response/media races, normal/loading/empty/error/permission/unsupported-codec/missing-stem states, responsive window sizes, visible focus, reduced motion, non-color-only status, screen-reader names/states, KO/EN/JA/ZH/VI/ES/DE/FR expansion, CJK/text expansion/font fallback, and exact-value/list/table alternatives for graph/timeline/waveform content. -Active #1160 distinguishes source-discovery loading, authoritative Full-mix-only empty, retryable discovery error, and normal multi-source selection. Empty/error copy is EN/KO only, native error detail is redacted, retry uses the existing discovery receipt path, and the selected source remains an opaque native authority at runtime. Project Persistence #970 `83127b55d121deff612160ed014e7a83abaf06c4` provides the Draft v3 native/TypeScript Save/Reopen document bridge and stable selected-source semantic, but #1160 still has to compose that preference with publication-bound/re-admitted source evidence and fresh native availability before a new opaque authority is minted. This is Draft source evidence only; wider localization, responsive/browser/screen-reader evidence and rights-cleared desktop audible acceptance remain open. +Current #970 preserves reopened project id and `selectedPlaybackSource` through mounted Open→Save, but that does not prove Active Player delivery. #1160 must still compose persisted intent with fresh native audible availability on the current Project Persistence/Resource Admission ancestry. Wider locale/accessibility/browser/screen-reader and rights-cleared desktop audible evidence remain open. -Reusable Slider infrastructure #1169 `4b4e6faaccaa55edab4d210e1b58c87b9f181f51` is also Draft-only evidence. It re-establishes Base UI 1.7.0's Thumb-inside-Track anatomy, puts accessible name/description on the actual nested range input, restricts the wrapper to one horizontal scalar thumb, uses Base UI disabled/nested-input focus state, and makes both the Thumb and Control at least 24 CSS px in the pointer-target dimension. The default Storybook story is named and uses the repository's installed `@storybook/react-vite` integration. This does not prove material rehearsal UI delivery until the actual player seek/range controls adopt the primitive and current-head browser/touch/keyboard/screen-reader/responsive evidence exists. +Anti-Slop is a delivery filter rather than a replacement visual style: components, copy, cards, decoration and motion must exist for actual rehearsal tasks/information hierarchy, not template completion. Displayed controls must work; generic marketing copy, decorative fake interactions, unverifiable metrics, and repetitive AI-default visual treatments do not pass material UI acceptance. -For the #1092 ready-workspace slice, product guidance now states the actual accessibility/authority condition consistently: the map names a score to open only when attachment metadata is validated and a live Score workspace is available; reopened metadata-only projects or untrusted score metadata fall back to adding a score or checking the range by ear. A screenshot from a predecessor head, a Storybook-only state, or a Figma-only mock is not shipped UI evidence. +**UI Delivery Gate: FAIL** until the material rehearsal player has current-head browser/Tauri evidence for real admitted audio, persistence/reload, stale authority, responsive states, keyboard/touch/pointer/screen-reader parity and required locales. ## 12. Quality and operability floor -Repository-owned production statement coverage, branch/edge-case coverage, and public/repository-owned API documentation target **100%**. A lower configured JavaScript/Python threshold is a gap rather than equivalent evidence; denominator reduction, skip/xfail, generated-code relabeling, or source-text assertions cannot manufacture compliance. +Repository-owned production Docstring/rustdoc, Test, and Edge Case Coverage targets are each 100%. Lower configured thresholds are gaps, not equivalent evidence. Denominator reduction, skip/xfail, source-text matching, generated-code relabeling, mocked production success, or shrinking performance samples cannot manufacture compliance. -Production-path tests include supported sample rates/channels, short/long recordings, pickup before bar one, odd meter and tempo changes where supported, silence near boundaries, unsupported codecs, moved/replaced files, cancellation, memory/CPU bounds, disk-full/partial-write recovery, corrupted project state, stale async response, missing stems, device changes, keyboard/screen-reader operation, locale expansion, updater rollback, and redacted support export. Applicable scenarios are proven at the owning boundary rather than all forced into one test layer. +Production-path tests include supported sample rates/channels, short/long recordings, pickup before bar one, odd meter/tempo change where supported, silence near boundaries, unsupported codecs, moved/replaced files, cancellation, memory/CPU/disk bounds, corrupted project state, stale async/media responses, missing stems, device changes, keyboard/screen-reader operation, locale expansion, updater rollback and redacted support export. -For behavior- or contract-affecting renames, focused regressions must fail on old/new mismatches before production repair whenever practical, then prove serialization/deserialization, adapter compatibility, persistence behavior, migrations and rollback where applicable. Valid tests are never weakened, skipped, xfailed, suppressed, or quote-obfuscated to obtain green. +Applicable buyer-facing web/API paths target measured p95 ≤20 ms where that budget is meaningful. Measurements exclude unrealistic warm-cache-only claims and are profiled before optimization. JS bundle/heap/DOM/hydration/main-thread/GC and native/process cleanup remain part of operability review. ## 13. Release gate -A release may be created only from one exact integrated protected head where all applicable CI/security/SAST/dependency/coverage/documentation/real-audio/build/package gates, Windows signing, macOS signing/notarization, checksums, SBOM/provenance, reproducibility, independent review, project migration/recovery, accessibility/supportability, updater rollback and operability evidence are terminal-success on that same identity. +A release may be created only from one exact integrated protected head where all applicable CI/security/SAST/dependency/coverage/documentation/real-audio/build/package gates, Windows signing, macOS signing/notarization, checksums, SBOM/provenance, reproducibility, independent review, project migration/recovery, accessibility/supportability, updater rollback, model/dependency rights and operability evidence are terminal-success on that same identity. + +Unsigned validation artifacts are not releases. Queued evidence, stale Figma states, mock-only audio journeys, predecessor check receipts, developer model caches, scientific-use-only pretrained weights, or package-name-only dependency substitutions cannot establish release readiness. -Unsigned validation artifacts are not releases. Queued evidence, stale Figma versions and mock-only audio journeys cannot establish release readiness. Merge requires all live required checks terminal-success, zero valid unresolved review findings/threads, a qualifying independent non-author approval current for the last push, and ordinary branch protection without bypass. +Commercial blockers currently include #1129 (`libsndfile` LGPL runtime path) and #1181 (upstream pretrained Demucs weight rights); #1180 owns the resulting immutable commercially admissible model artifact contract. No immutable release beyond historical `v0.1.3` is claimed by current Draft work. ## 14. Traceability -Primary normative/research anchors for this baseline include: +Primary normative/research anchors include: - World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines (WCAG) 2.2*. https://www.w3.org/TR/WCAG22/ -- Base UI. (2026). *Slider*. https://base-ui.com/react/components/slider - National Institute of Standards and Technology. (2022). *Secure Software Development Framework (SSDF) Version 1.1 (NIST SP 800-218)*. https://csrc.nist.gov/pubs/sp/800/218/final +- National Institute of Standards and Technology. (2015). *Secure Hash Standard (SHS) (FIPS PUB 180-4)*. https://doi.org/10.6028/NIST.FIPS.180-4 - Music Information Retrieval Evaluation eXchange. (n.d.). *MIREX*. https://www.music-ir.org/mirex/ - Raffel, C., McFee, B., Humphrey, E. J., Salamon, J., Nieto, O., Liang, D., Ellis, D. P. W., & Raffel, C. C. (2014). mir_eval: A transparent implementation of common MIR metrics. *Proceedings of the 15th International Society for Music Information Retrieval Conference*, 367–372. +- Défossez, A., Usunier, N., Bottou, L., & Bach, F. (2021). Music source separation in the waveform domain. *Transactions of the International Society for Music Information Retrieval, 4*(1), 197–208. https://doi.org/10.5334/tismir.76 +- Rouard, S., Massa, F., & Défossez, A. (2023). Hybrid transformers for music source separation. *Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)*. https://doi.org/10.1109/ICASSP49357.2023.10097003 -Repository ADRs, PRD/TRD, architecture/context-map documents, security/threat-model material, test strategy, operability/recovery guidance, UI/Storybook inventory and doctoring traceability must remain code-current. Active PRs, planned work and research results are never promoted into the shipped section before protected integration. +Repository ADRs, PRD/TRD, architecture/context-map documents, security/threat-model material, test strategy, operability/recovery guidance, UI/Storybook inventory, doctoring traceability and release documentation must remain code-current. Active PRs, planned work and research results are never promoted into shipped truth before protected integration. From 969070a3785ab7be1ccc7e78ec80636ab4051b89 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 03:10:15 +0900 Subject: [PATCH 79/80] docs(gap): avoid self-invalidating descendant head evidence --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index a693ed15e..2aa94f79b 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -64,7 +64,7 @@ Active work is Draft/unshipped until normally integrated into protected `develop | Boundary | Canonical live owner / evidence | Current status | |---|---|---| -| Merge-train control plane | Issue #966; queue lane PR #968 | #968 `7c773cdda932855c0e1b9d114c70bb14acc5adea` is Draft on #1116 and owns exactly 22 queue-control workflow/ADR/reference/manifest/script/test files. Every #1116 source move requires ordinary non-force reconciliation preserving those files and a non-divergent baseline blob. | +| Merge-train control plane | Issue #966; queue lane PR #968 | #968 is Draft on #1116 and owns exactly 22 queue-control workflow/ADR/reference/manifest/script/test files. Its exact head is intentionally not embedded here: every #1116 source movement deterministically creates the next ordinary #968 descendant, so live PR state is the exact-head authority. Every adoption must preserve those 22 files and a non-divergent baseline blob. | | Canonical baseline | PR #1116, this file | Draft. This source is the single writer for `docs/product-technical-gap-baseline.md`; active PR behavior is described as Draft evidence, never promoted into shipped truth. | | Trusted distribution | Issue #960; release-identity lane #1126; dependency/model blockers #1129/#1180/#1181 | Windows signing, macOS signing/notarization, checksums, SBOM/provenance, signature-verified updater, staged rollout, rollback/repair, `libsndfile` removal, and a commercially admissible immutable separation model are not yet one integrated protected-head receipt. | | Active rehearsal player | Issue #961; #971 with source stack #1159 → #1160 | #1160 `332240dbba957602f217dc6e4e6a82a59d4d39b2` remains Draft and has not yet adopted current #970. Native stem admission/playback/source switching exists on that branch, but persisted source intent must be reconciled with fresh Full mix/current-stem audible authority after reopen. Missing preferred stems must fail closed to Full mix. | @@ -85,7 +85,7 @@ Backlog convergence is an engineering risk because micro-PR fan-out creates dupl PR #968 owns the executable #966 queue machinery: bounded GitHub pagination, exact active-head capture, independent base-tip resolution, deterministic ordering, malformed/incomplete/duplicate rejection, symlink-safe atomic publication, dependency/succession metadata, network-independent validation, deterministic human projection/parity, and exact-head artifact preservation. It must not be discarded as stale documentation. -The canonical baseline branch must remain an ordinary descendant of current protected `develop`. PR #968 targets #1116 rather than protected `develop` directly. Every #1116 advance therefore changes #968's target tip and requires another ordinary non-force descendant on #968 that preserves its queue-owned files. Historical SHAs remain audit evidence only. +The canonical baseline branch must remain an ordinary descendant of current protected `develop`. PR #968 targets #1116 rather than protected `develop` directly. Every #1116 advance therefore changes #968's target tip and requires another ordinary non-force descendant on #968 that preserves its queue-owned files. The baseline deliberately avoids embedding the descendant #968 SHA because doing so would make the source self-invalidating at the moment the required adoption commit is created. The PR's live exact head and a fresh compare to #1116 are the authoritative reconciliation evidence. Historical SHAs remain audit evidence only. Review/check waiting is lane-local rather than a global blocker: while one head waits for hosted evidence, other independent canonical work may proceed. Failed checks are RCA/fix/rerun work, not justification to weaken gates. From 87d38b0d64dc7b162450ef0ccd2ea5f9df99e361 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 03:23:30 +0900 Subject: [PATCH 80/80] docs(gap): decouple baseline from mutable draft heads --- docs/product-technical-gap-baseline.md | 43 ++++++++++++++------------ 1 file changed, 24 insertions(+), 19 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 2aa94f79b..5f47f6566 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -8,6 +8,8 @@ Protected product truth: `develop@314ddeae7b775a4957594b599358c8255617eb2e` This document is the canonical live product/technical gap synthesis for BandScope. `AGENTS.md`, `CLAUDE.md`, `ARCHITECTURE.md`, owning ADR/PRD/TRD/security/test/release documents, protected source, and live GitHub state remain the detailed authorities. If this synthesis conflicts with an owning source, the owning source wins and this file must be repaired. +Mutable Draft heads are deliberately not embedded as long-lived truth in this source. The live PR/Issue state is the exact-head authority for active work; this baseline records the semantic contract and ownership. This avoids making the canonical baseline stale whenever a correctly progressing Draft gains an ordinary descendant commit. + BandScope is a local-first rehearsal decision product. Commercial completion means a musician can admit an authorized real recording, obtain reproducible evidence-backed rehearsal guidance, move directly into audible rehearsal, preserve and recover the project without silent data loss, hand off only bounded intended data, diagnose failures without leaking private media, and install/update/rollback a verifiable signed build. BandScope is not a DAW, notation editor, mandatory cloud service, or an authority that presents uncertain machine analysis as unquestionable musical truth. @@ -60,18 +62,18 @@ Only behavior reachable from protected `develop@314ddeae7b775a4957594b599358c825 ## 4. Canonical active workstreams -Active work is Draft/unshipped until normally integrated into protected `develop` with current-head gates and qualifying independent review. +Active work is Draft/unshipped until normally integrated into protected `develop` with current-head gates and qualifying independent review. Exact mutable heads below are intentionally delegated to the named live PR/Issue rather than copied into this source. | Boundary | Canonical live owner / evidence | Current status | |---|---|---| -| Merge-train control plane | Issue #966; queue lane PR #968 | #968 is Draft on #1116 and owns exactly 22 queue-control workflow/ADR/reference/manifest/script/test files. Its exact head is intentionally not embedded here: every #1116 source movement deterministically creates the next ordinary #968 descendant, so live PR state is the exact-head authority. Every adoption must preserve those 22 files and a non-divergent baseline blob. | +| Merge-train control plane | Issue #966; queue lane PR #968 | #968 is Draft on #1116 and owns exactly 22 queue-control workflow/ADR/reference/manifest/script/test files. Every #1116 source move requires ordinary non-force reconciliation preserving those files and a non-divergent baseline blob. Live #968 state plus fresh #1116→#968 compare is exact-head authority. | | Canonical baseline | PR #1116, this file | Draft. This source is the single writer for `docs/product-technical-gap-baseline.md`; active PR behavior is described as Draft evidence, never promoted into shipped truth. | | Trusted distribution | Issue #960; release-identity lane #1126; dependency/model blockers #1129/#1180/#1181 | Windows signing, macOS signing/notarization, checksums, SBOM/provenance, signature-verified updater, staged rollout, rollback/repair, `libsndfile` removal, and a commercially admissible immutable separation model are not yet one integrated protected-head receipt. | -| Active rehearsal player | Issue #961; #971 with source stack #1159 → #1160 | #1160 `332240dbba957602f217dc6e4e6a82a59d4d39b2` remains Draft and has not yet adopted current #970. Native stem admission/playback/source switching exists on that branch, but persisted source intent must be reconciled with fresh Full mix/current-stem audible authority after reopen. Missing preferred stems must fail closed to Full mix. | -| Crash-safe project | Issue #962; PR #970 | #970 exact Draft head `767b87e3e2fec3116ec274c22db6995cbb2defc2` has ordinarily adopted Resource Admission #866 `841e1c9b7329dba6d0ff16daecc009a2c3face0c`. It implements v3 Save/load, path-free source evidence, restart exact-content re-admission, analysis-time source revalidation and snapshot-bound decode, local model admission, and mounted Open→Save preservation of native project selection plus `selectedPlaybackSource`. Autosave/global recovery UX, broader fault injection, descriptor-bound higher-parent authority, and Active Player audible-authority reconstruction remain open. | +| Active rehearsal player | Issue #961; #971 with source stack #1159 → #1160 | #1160 remains Draft and has not yet adopted current #970. Native stem admission/playback/source switching exists on that branch, but persisted source intent must be reconciled with fresh Full mix/current-stem audible authority after reopen. Missing preferred stems must fail closed to Full mix. | +| Crash-safe project | Issue #962; PR #970 | #970 is Draft and has ordinarily adopted Resource Admission #866. It implements v3 Save/load, path-free source evidence, restart exact-content re-admission, analysis-time source revalidation and snapshot-bound decode, local Demucs compatibility admission, mounted Open→Save preservation of native project selection plus `selectedPlaybackSource`, and bounded PyTorch weights-only incompatibility handling. Autosave/global recovery UX, broader fault injection, descriptor-bound higher-parent authority, and Active Player audible-authority reconstruction remain open. | | Real-audio science | Issue #770 and active benchmark lanes | Rights-cleared decoded-audio MIR acceptance, recognized task metrics, uncertainty and reproducibility remain incomplete. Synthetic/generated audio remains unit-test evidence only. | -| Resource admission/decode | Issue #781; PR #866; commercial dependency defect #1129 | #866 exact `841e1c9b7329dba6d0ff16daecc009a2c3face0c` owns app-owned audio materialization/publication and `LocalAudioPublicationIdentity`. #970 consumes it through typed persistence/re-admission ACLs. #1129 still owns removal of the `soundfile`/`libsndfile` LGPL runtime path with equivalent supported-platform real-audio/SBOM evidence. | -| Commercial separation model | Issue #1180; rights blocker #1181 | #970's local Demucs compatibility admission is technical Draft evidence only. Distribution still requires an immutable commercially admissible exact artifact with full provenance/size/digest-or-signature, safer or justified serialization, release inventory, updater/rollback behavior, and rights-cleared Windows/macOS real-audio evidence. #1181 independently blocks upstream pretrained weights absent explicit commercial-use/redistribution rights. | +| Resource admission/decode | Issue #781; PR #866; commercial dependency defect #1129 | #866 owns app-owned audio materialization/publication and `LocalAudioPublicationIdentity`; #970 consumes it through typed persistence/re-admission ACLs. #1129 still owns removal of the `soundfile`/`libsndfile` LGPL runtime path with equivalent supported-platform real-audio/SBOM evidence. | +| Commercial separation model | Issue #1180; rights blocker #1181 | #970's local Demucs compatibility admission is technical Draft evidence only. Distribution still requires an immutable commercially admissible exact artifact with full provenance/size/digest-or-signature, explicit serialization/loader policy, release inventory, updater/rollback behavior, and rights-cleared Windows/macOS real-audio evidence. #1181 independently blocks upstream pretrained weights absent explicit commercial-use/redistribution rights. | | Diagnostics/supportability | Issue #963 | Typed redacted crash/hang evidence and a user-previewable offline support bundle remain incomplete. | | Activation | Issue #964 | A measured production-path first rehearsal remains incomplete. | | Accessibility/design parity | Issue #965 and active component/player lanes | WCAG 2.2 AA, keyboard/screen-reader parity, KO/EN/JA/ZH/VI/ES/DE/FR expansion, CJK/text expansion/font fallback, exact-value alternatives, and current-head material-UI evidence remain incomplete. | @@ -85,7 +87,7 @@ Backlog convergence is an engineering risk because micro-PR fan-out creates dupl PR #968 owns the executable #966 queue machinery: bounded GitHub pagination, exact active-head capture, independent base-tip resolution, deterministic ordering, malformed/incomplete/duplicate rejection, symlink-safe atomic publication, dependency/succession metadata, network-independent validation, deterministic human projection/parity, and exact-head artifact preservation. It must not be discarded as stale documentation. -The canonical baseline branch must remain an ordinary descendant of current protected `develop`. PR #968 targets #1116 rather than protected `develop` directly. Every #1116 advance therefore changes #968's target tip and requires another ordinary non-force descendant on #968 that preserves its queue-owned files. The baseline deliberately avoids embedding the descendant #968 SHA because doing so would make the source self-invalidating at the moment the required adoption commit is created. The PR's live exact head and a fresh compare to #1116 are the authoritative reconciliation evidence. Historical SHAs remain audit evidence only. +The canonical baseline branch must remain an ordinary descendant of current protected `develop`. PR #968 targets #1116 rather than protected `develop` directly. Every #1116 advance therefore changes #968's target tip and requires another ordinary non-force descendant on #968 that preserves its queue-owned files. The baseline deliberately avoids embedding the descendant #968 SHA because doing so would make the source self-invalidating at the moment the required adoption commit is created. The same principle applies to other moving Draft heads: their live PR state is exact-head authority while this document owns stable semantic status. Historical SHAs remain audit evidence only. Review/check waiting is lane-local rather than a global blocker: while one head waits for hosted evidence, other independent canonical work may proceed. Failed checks are RCA/fix/rerun work, not justification to weaken gates. @@ -204,17 +206,17 @@ Decode, analysis, persistence, and playback failures remain typed and bounded. P ### 7.3 Project Persistence / Resource Admission truth -Current Draft #970 has ordinarily adopted #866 rather than duplicating its audio-publication policy. +Current Draft #970 has ordinarily adopted #866 rather than duplicating its audio-publication policy. Live PR state is the exact-head authority for both moving Drafts. -`#866@841e1c9b7329dba6d0ff16daecc009a2c3face0c` owns selected-local-audio copy/admission/publication. It stages selected bytes, synchronizes and publishes the app-owned `source.`, reopens the published object, verifies exact size + SHA-256 receipt equality, then creates a path-free `LocalAudioPublicationIdentity`. Native state retains that verified identity keyed by BandScope project id. +#866 owns selected-local-audio copy/admission/publication. It stages selected bytes, synchronizes and publishes the app-owned `source.`, reopens the published object, verifies exact size + SHA-256 receipt equality, then creates a path-free `LocalAudioPublicationIdentity`. Native state retains that verified identity keyed by BandScope project id. -`#970@767b87e3e2fec3116ec274c22db6995cbb2defc2` consumes that identity. Draft `projectFormatVersion: 3` stores `song`, `preferences.selectedPlaybackSource`, and optional path-free `sourceReference = projectId + artifactName + extension + fileSizeBytes + contentSha256`. Legacy/v1/v2 input is migrated deterministically and never invents missing source evidence. Renderer-authored path, artifact name, byte count, digest, or `sourceReference` is rejected; the renderer may return only an already-minted project selector and durable playback-source intent to native Save. +#970 consumes that identity. Draft `projectFormatVersion: 3` stores `song`, `preferences.selectedPlaybackSource`, and optional path-free `sourceReference = projectId + artifactName + extension + fileSizeBytes + contentSha256`. Legacy/v1/v2 input is migrated deterministically and never invents missing source evidence. Renderer-authored path, artifact name, byte count, digest, or `sourceReference` is rejected; the renderer may return only an already-minted project selector and durable playback-source intent to native Save. On restart, production `load_project` resolves only an existing app-local aggregate, opens the fixed source through the canonical native opener, re-verifies exact bounded bytes, and restores native publication/bootstrap state only after that reverse admission succeeds. A persisted source reference is evidence, not authority. Before `start_analysis_job` queue admission, retained publication identity is revalidated again. The child process receives exact admitted byte count and SHA-256 through its bounded process contract. The analysis process copies the opened source into a private spooled snapshot, verifies exact size and SHA-256, and decodes that same snapshot. The earlier admitted-audio pathname replacement gap between verification and analysis decode is therefore closed for this Draft path. -Mounted Open→Save previously dropped the reopened source selector and reset non-default `selectedPlaybackSource`. RED `9ceeb2faa73317e591a1741a0d246b82f9311423` and fix `9a9151d1a5420c83218ac220d29cb144c9e3b45d` make `App` retain the validated path-free project selector plus versioned playback intent and return them through native-authoritative Save. It still cannot mint source evidence. +Mounted Open→Save previously dropped the reopened source selector and reset non-default `selectedPlaybackSource`. The current #970 lineage makes `App` retain the validated path-free project selector plus versioned playback intent and return them through native-authoritative Save. It still cannot mint source evidence. Residual persistence work includes global/startup recovery policy, autosave/backup rotation and Restore/Compare/Discard UX, broader power-loss/disk-full/interrupted-migration fault injection, application downgrade/rollback policy, and descriptor-bound protection against concurrent replacement of higher parent directories. @@ -228,9 +230,11 @@ The material UI must prove source selection, play/pause/seek/stop/loop/count-in/ #970's Draft compatibility path for Demucs local model loading is not release provenance. It rejects missing/non-regular/symlinked/empty/oversized/checksum-mismatched cache objects before resolution, materializes only the preflight descriptor size into a private temporary `LocalRepo`, rejects early EOF or any extra post-`fstat` byte, and resolves locally so mutation/deletion of the original cache pathname cannot change bytes for that load or reactivate `RemoteRepo`. -The 128 MiB model ceiling and Demucs eight-hex filename checksum remain compatibility/integrity controls only. They are not exact release size, full digest/signature, provenance, or rights evidence. Upstream native Demucs checkpoint loading uses PyTorch serialization with class/constructor metadata, so it remains a trusted code-bearing deserialization boundary. +The current analysis lock resolves `torch==2.12.1`. PyTorch releases from 2.6 changed `torch.load` to `weights_only=True` by default when a custom pickle module is not supplied, while native Demucs packages carry class/constructor metadata rather than only a plain tensor state dictionary. #970 therefore treats `pickle.UnpicklingError` from the admitted local `get_model` call as bounded model unavailability. It deliberately does not switch to `weights_only=False`, expose serialized class/global details, or re-enable a network fallback. This is compatibility/security behavior only; it does not prove the real checkpoint is runnable or scientifically accepted under the locked stack. + +The 128 MiB model ceiling and Demucs eight-hex filename checksum remain compatibility/integrity controls only. They are not exact release size, full digest/signature, provenance, or rights evidence. Native Demucs/PyTorch deserialization remains a trusted code-bearing boundary. -Issue #1180 therefore owns an immutable commercially admissible model artifact: exact identity/version/size/full digest or signed manifest, provenance/NOTICE/SBOM inventory, supported-platform placement, local-only loading, explicit serialization choice/removal condition, updater compatibility/rollback, and rights-cleared real-audio acceptance. #1181 separately owns the commercial-use/redistribution rights prerequisite for upstream pretrained weights; mirrors, conversions, or renamed files do not create rights. +Issue #1180 therefore owns an immutable commercially admissible model artifact: exact identity/version/size/full digest or signed manifest, provenance/NOTICE/SBOM inventory, supported-platform placement, local-only loading, explicit serialization/loader choice and removal condition, updater compatibility/rollback, and rights-cleared real-audio acceptance. #1181 separately owns the commercial-use/redistribution rights prerequisite for upstream pretrained weights; mirrors, conversions, renamed files, or loader flags do not create rights. ### 7.6 Rust compute ownership @@ -276,23 +280,23 @@ Audio/model/project acquisition, filesystem lookup/publication/recovery, decoder #### Trust boundary -Audio Ingestion owns user source intent; Resource Admission owns admitted app-local bytes; Project Persistence stores only versioned path-free evidence; Signal/MIR consumes admitted snapshots; Active Player separately owns fresh audible authority; Distribution owns remotely acquired/shipped artifact provenance. No lower layer may treat a persisted string, renderer payload, previous analysis result, or mutable sibling branch as authority. +Audio Ingestion owns user source intent; Resource Admission owns admitted app-local bytes; Project Persistence stores only versioned path-free evidence; Signal/MIR consumes admitted snapshots; Active Player separately owns fresh audible authority; Distribution owns remotely acquired/shipped artifact provenance. No lower layer may treat a persisted string, renderer payload, previous analysis result, mutable sibling branch, or compatibility model cache as release authority. #### Mitigations -Strict type/schema/size/path validation, regular/no-link or descriptor-bound acquisition where implemented, exact byte receipts, private immutable-for-use snapshots, no-shell subprocess invocation, local-only model resolution, redacted diagnostics, signed release/update manifests, exact model/dependency inventory, fail-closed stale-source handling, and ordinary protected-branch gates. +Strict type/schema/size/path validation, regular/no-link or descriptor-bound acquisition where implemented, exact byte receipts, private immutable-for-use snapshots, no-shell subprocess invocation, local-only model resolution, bounded PyTorch incompatibility without unsafe pickle downgrade, redacted diagnostics, signed release/update manifests, exact model/dependency inventory, fail-closed stale-source handling, and ordinary protected-branch gates. #### Realistic threats -A moved/replaced local source or model is consumed after validation; an interrupted save publishes candidate bytes without recoverable ordering; a persisted source preference is mistaken for current playback authority; a malformed/corrupt/oversized artifact reaches decoder/deserializer; an implicit network model fetch occurs; release rights are inferred from code licensing; a stale updater/model combination changes rehearsal output; logs expose private local state. +A moved/replaced local source or model is consumed after validation; an interrupted save publishes candidate bytes without recoverable ordering; a persisted source preference is mistaken for current playback authority; a malformed/corrupt/oversized artifact reaches decoder/deserializer; an implicit network model fetch occurs; a legacy serialized model triggers a loader compatibility failure and an operator bypasses the safer loader policy; release rights are inferred from code licensing; a stale updater/model combination changes rehearsal output; logs expose private local state. #### Safe failure -Invalid/stale/missing authority is rejected with bounded buyer-facing diagnostics. The product does not manufacture synthetic analysis, reuse stale audible authority, silently downgrade to an unverified model/provider, or weaken required checks to make a run pass. +Invalid/stale/missing/incompatible authority is rejected with bounded buyer-facing diagnostics. The product does not manufacture synthetic analysis, reuse stale audible authority, silently downgrade to an unverified model/provider or unsafe loader mode, or weaken required checks to make a run pass. #### Test points -Moved/replaced/truncated/growing audio and model files; symlink/reparse and linked-parent cases; exact-size/hash mismatch; disk-full/interrupted publication/recovery; process-restart source re-admission; stale preferred stem fallback; malformed IPC/project data; corrupt/object-graph model artifacts where applicable; updater interruption/rollback; redacted support bundles; supported-platform real-audio execution. +Moved/replaced/truncated/growing audio and model files; symlink/reparse and linked-parent cases; exact-size/hash mismatch; disk-full/interrupted publication/recovery; process-restart source re-admission; stale preferred stem fallback; malformed IPC/project data; PyTorch weights-only/object-graph incompatibility; updater interruption/rollback; redacted support bundles; supported-platform real-audio execution. #### Remaining risk @@ -322,7 +326,7 @@ Applicable buyer-facing web/API paths target measured p95 ≤20 ms where that bu A release may be created only from one exact integrated protected head where all applicable CI/security/SAST/dependency/coverage/documentation/real-audio/build/package gates, Windows signing, macOS signing/notarization, checksums, SBOM/provenance, reproducibility, independent review, project migration/recovery, accessibility/supportability, updater rollback, model/dependency rights and operability evidence are terminal-success on that same identity. -Unsigned validation artifacts are not releases. Queued evidence, stale Figma states, mock-only audio journeys, predecessor check receipts, developer model caches, scientific-use-only pretrained weights, or package-name-only dependency substitutions cannot establish release readiness. +Unsigned validation artifacts are not releases. Queued evidence, stale Figma states, mock-only audio journeys, predecessor check receipts, developer model caches, scientific-use-only pretrained weights, permissive legacy-deserialization flags, or package-name-only dependency substitutions cannot establish release readiness. Commercial blockers currently include #1129 (`libsndfile` LGPL runtime path) and #1181 (upstream pretrained Demucs weight rights); #1180 owns the resulting immutable commercially admissible model artifact contract. No immutable release beyond historical `v0.1.3` is claimed by current Draft work. @@ -337,5 +341,6 @@ Primary normative/research anchors include: - Raffel, C., McFee, B., Humphrey, E. J., Salamon, J., Nieto, O., Liang, D., Ellis, D. P. W., & Raffel, C. C. (2014). mir_eval: A transparent implementation of common MIR metrics. *Proceedings of the 15th International Society for Music Information Retrieval Conference*, 367–372. - Défossez, A., Usunier, N., Bottou, L., & Bach, F. (2021). Music source separation in the waveform domain. *Transactions of the International Society for Music Information Retrieval, 4*(1), 197–208. https://doi.org/10.5334/tismir.76 - Rouard, S., Massa, F., & Défossez, A. (2023). Hybrid transformers for music source separation. *Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)*. https://doi.org/10.1109/ICASSP49357.2023.10097003 +- Gawarecki, M. (2024, November 4). BC-breaking change: `torch.load` is being flipped to use `weights_only=True` by default in the nightlies after #137602. *PyTorch Developer Mailing List*. https://dev-discuss.pytorch.org/t/bc-breaking-change-torch-load-is-being-flipped-to-use-weights-only-true-by-default-in-the-nightlies-after-137602/2573 Repository ADRs, PRD/TRD, architecture/context-map documents, security/threat-model material, test strategy, operability/recovery guidance, UI/Storybook inventory, doctoring traceability and release documentation must remain code-current. Active PRs, planned work and research results are never promoted into shipped truth before protected integration.