docs: establish LifeOS product and technical gap baseline

[seonghobae]

Scope

Establishes the LifeOS product/technical gap baseline and machine-readable buyer-gap registry without promoting active PRs or WIP branches into shipped truth. Current documentation head is c8bc59c19c1e6330c0b20db3f47f339b01dcbd5e; protected main remains 193a87ef54c3fe6dcda4755bce4d6bc81e3a0297 with exact live protection to be rechecked before promotion.

Current evidence boundary

Protected main has the server-backed modular MSA foundation with service-owned persistence/migrations/credentials, explicit durable acceptance, purpose-bound sensitive access, and LifeOS-owned control-plane foundations. It is not yet a complete commercial product or release-ready artifact.

Data-rights contributors remain unshipped: #198 exact 8a9e417b15f89f972e242e07197a3a4a818ff82a; #199 exact f2669410df648acd876904033d691353a790b9a2. #198 still depends on immutable AppGuardrail scanner-owner repair ContextualWisdomLab/appguardrail#1106; no leaf suppression or cosmetic source rewrite is accepted.

Planning/data-rights repair #219 is exact 6d5bd2742e794b600b08dff8511fb285f865b094. Its transaction/shutdown, temporal, integer, canonical-digest, durable Today-payload, and Today idempotency result-kind evidence lineage is source-current. Result-kind RED ea74805353c4011c1002507efc0f85850e82e943 drives malformed persisted discriminator strings through the real export transaction while retaining canonical created/updated positive controls. Causal repair 98b031ff0d32b881b77174ebdf67b358b93cbdde requires the exact discriminator set already enforced by migration 0003_durable_today_sync.sql and PostgresTodayRepository; CHANGELOG descendant 6d5bd2742e794b600b08dff8511fb285f865b094 records the contract. Exact-head CI 34044477267, Commercial Readiness 34044477193, Security Scan 34044477116, CodeQL PR 34044477250, AppGuardrail 34044477180, and SAST Semgrep 34044477184 are queued/pending; focused evidence is not repository GREEN.

The #130 Plugin stack remains #205 → #235 → #241 → #242 → #243 → #244 → #245. #245 remains exact 0a6fe7b25664bc893a4ebeb9647d830b59202fc2, Draft/mergeable, with frozen-lock RED a0b5653426f0d55e50f6baff6ad66543a57d932f. The accepted next change remains importer-only pg 8.22.0 / @types/pg 8.20.3; broad lock regeneration or hand-reconstructed unrelated graph churn remains rejected.

Control-plane currentness

#247 is exact e14e88c530f9acf1f77e3dc8b0a9197bb1d3172b, open/non-Draft/mergeable and a non-force descendant of protected main. Findings #1–#50 remain preserved. Commercial Readiness 34038416827 and SAST Semgrep 34038416847 are terminal GREEN. AppGuardrail 34038416836 is terminal RED on the known scanner-owner false positive, with its current thread unresolved pending immutable ContextualWisdomLab/appguardrail#1106 repair. Security Scan 34038416842 is terminal RED specifically in exact-head Trivy job 101506824515, which reports only CVE-2026-82417 and CVE-2026-82562 against shared qs@6.15.3; #246 owns the package-manager/lock repair. CodeQL PR 34038416821 is terminal RED because all three compatibility jobs dispatched current-head scans but received VERDICT_STATE=pending; central .github#1925/#1927 own the dispatch-template and identity prerequisites. CI 34038416809 is terminal RED: four runtime/merge jobs are GREEN, while validate fails at Check formatting before lint/typecheck/test/build. The same formatter RED was already present on predecessor 6308261d... validate job 101489971622, so findings #49–#50 did not create it. Submitted reviews contain no APPROVED.

LifeOS does not weaken scanner, dependency, CodeQL, formatting, or review gates to manufacture merge authority.

Committed-source currentness

docs/product-technical-gap-baseline.md is source-current through #247 findings #49–#50, current terminal scanner/CodeQL/CI evidence, and #219 transaction/shutdown/temporal/integer/canonical-digest/Today-payload/result-kind evidence. Commit c8bc59c19c1e6330c0b20db3f47f339b01dcbd5e is an ahead-only one-commit descendant of c75ebcdfe89c612437ac4ebc5be65637f9604135, modifying only the baseline (+3/-3).

KO/EN/JA/ZH/VI/ES/DE/FR localization, DB-versioned translation-ledger separation, Figma/Storybook/accessibility states, applicable p95 evidence, released contextual-orchestrator authority, and immutable release-artifact gates remain required commercial evidence.

Keep #211 Draft until the unchanged exact head has applicable terminal evidence, current review/thread requirements, live-base compatibility, and normal protected integration. docs/index.md and README links remain source prerequisites only; they are not GitHub Pages publication evidence.

Refs #21, #55, #129, #130, #145, #198, #199, #202, #205, #209, #210, #211, #212, #214, #216, #217, #218, #219, #228, #230, #235, #236, #237, #238, #240, #241, #242, #243, #244, #245, #246, #247; ContextualWisdomLab/.github#1925; ContextualWisdomLab/.github#1927.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Code-current baseline refresh: exact head is now 05badc08982e11f1360c562ddb749b364d50c9e6. docs/product-technical-gap-baseline.md now tracks #205 30a3ef4e0219b9b29ed2b6bd01b50fd276f414e8 and non-force-restacked #235 64e29bfd685ad49b187fc3de39ac5ebef6356063, including the monotonic create-replay grantedAt invariant. Fresh compare from protected main@b84751674dd92bdcd0e266c7f002cdc43f5a938b remains ahead-only (behind_by=0) with the same five documentation/policy paths. Predecessor check/review evidence does not transfer to this head.

[seonghobae]

Latest code-current baseline head is 3f32daebcb9c2842b27de3839e4240b092642448. It now tracks #205 9f41c75f99a2670d1238a66548ea6e0e85d76212 and #235 603875229128baf2eee94e7fa28f9813ac9b379b, including malformed/future installation-time rejection and the latest non-force descendant restack. Fresh compare from protected main@b84751674dd92bdcd0e266c7f002cdc43f5a938b remains ahead-only (behind_by=0) with exactly the same five documentation/policy paths. Any earlier exact-head checks/reviews are stale.

[seonghobae]

Code-current baseline exact head is now 819f44c97ecec545bf53b95df4f6f068bc5f2336. The Plugin gap section tracks #205 b9300419324a94d21ccf951e605c06d7569b25ef and non-force-restacked #235 c2a649b3b1906150e85f0e9c95f75a799ae14d47, including installation→grant→read→revoke temporal durable-acceptance bounds. Fresh compare from protected main@b84751674dd92bdcd0e266c7f002cdc43f5a938b is ahead, behind_by=0, with exactly the same five documentation/policy paths. Predecessor check/review evidence is stale for this head.