fix(ci): retain exact-head full-product evidence

[seonghobae]

Current authority — 2026-09-08

• protected root: develop@042b0c70531b229af3acbd0421a2f23098d848b3
• direct prerequisite/base: fix(ci): run repo-local validation on stacked PR bases #1587 fix/stacked-pr-local-ci@48bd9efe3509496060386691a8c29d0f06b6b92e
• exact head: 02dd5747ba4bf110a2a148deb532442ce5eb0694
• lifecycle: Draft / evidence-integrity repair retained / concurrent Docker scope removed / fresh exact-head verification queued / not merge-authorized
• effective compare against fix(ci): run repo-local validation on stacked PR bases #1587: six files — Application CI, Bandit, Dependency Review, Docker checkout ref, screenshot-retention regression, exact-source-head regression.

Evidence-integrity repair

Application CI now pins pull-request checkout to ${{ github.event.pull_request.head.sha || github.sha }} and uploads only retained full-product PNG evidence using the pinned actions/upload-artifact action with if-no-files-found: error. Bandit, Dependency Review, and Docker validation use the same exact-source-head checkout contract; push/tag paths retain their natural github.sha fallback.

The source-order regression requires every checkout in these four repo-local validation workflows to carry that explicit ref. The screenshot-retention regression requires the upload step immediately after the full-product smoke, exact action pin, PNG-only path, source-head-bound artifact identity, 14-day retention, and fail-closed behavior when screenshots are absent.

Hosted predecessor receipt — development evidence only

Application CI run 34189161122 completed successfully at literal source head d30f0b7c403bcf2b06d84b27f2744d5c17177294 and published artifact 10042037726, naruon-full-product-smoke-1600-d30f0b7c403bcf2b06d84b27f2744d5c17177294, SHA-256 20fffaaf6a395f8b18d7d7e5b7e9511faf621d3f93ac839d79f627124c1ee40a, expiring 2026-09-22. The artifact was retrievable and its ten 1440×1024 PNGs were directly inspected. This proves the retention/source-identity mechanism on that predecessor but is not transferred as exact-head GREEN to 02dd574....

Concurrent-delta repair

After the verified d30f0b7... tree, ordinary child a10d180384133217ec5891802772ea5ac9233ead added Docker workflow-level concurrency plus release-governance assertions. The change was read rather than treated as a race, but it overlaps the active canonical Docker-concurrency owner #1592, which already owns superseded first-attempt versus manual-rerun identity and its focused regressions. Keeping a second Docker concurrency policy in this evidence-retention PR would violate the source single-writer boundary and risk conflicting semantics.

Ordinary child 02dd5747ba4bf110a2a148deb532442ce5eb0694 therefore restores only .github/workflows/docker-publish.yml and backend/tests/test_release_governance.py to their d30f0b7... blobs while preserving the intervening commit in ancestry. The branch advanced with force=false. Fresh d30f0b7... → 02dd574... comparison is two commits ahead with zero effective files changed, and the effective compare against #1587 is again exactly the intended six-file evidence-integrity slice. Docker concurrency remains #1592 authority.

Current verification boundary

Fresh repository-owned runs were generated for exact 02dd574...: Application CI 34191931339, Bandit 34191931363, and Docker 34191931493; they are queued at this authority update. Other required contexts are not inferred from predecessor runs or from the branch's tree equivalence.

Dependency Review remains a distinct admission concern: the supported workflow is required on protected develop, but absence of a current-head run is non-passing evidence until registry/runtime state explains or repairs it.

Merge/stack boundary

#1587 must land normally first. This PR must then be ordinary-restacked/retargeted onto protected develop without dropping the six-file delta and reacquire source-head-bound hosted evidence on the resulting SHA. Keep Draft until the unchanged exact head proves the workflow execution path, retained PNG artifact, Dependency Review admission, every then-live required context, and qualifying post-last-push independent review.

No force-push, destructive rebase, dummy/no-op requeue, self-approval, review fabrication/dismissal, authorization widening, synthetic status, central-workflow copy, or gate weakening.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Hosted Visual Inspection receipt for exact head d30f0b7c403bcf2b06d84b27f2744d5c17177294 and Application CI run 34189161122: backend and frontend jobs passed, and all 10 retained PNGs were downloaded and inspected at original resolution. Artifact preservation works. Product acceptance remains RED: (1) Home/Projects/Security expose the English focus label Skip to main content; (2) Mail toast and several captures obscure or clip the primary top navigation; (3) Search exposes sender_context, reply_count, raw source/thread identifiers and English action copy; (4) Data exposes verifier commands, schema/digest plumbing, and English integrity labels; (5) Security exposes signed-session, RBAC / ABAC, and raw audit event keys; (6) Settings exposes OIDC/provider plumbing and mixed English labels. These findings are product gaps now carried by successor #1602 and the localized focus repair stack #1578/#1601; they do not invalidate #1600’s evidence-retention delta.

[seonghobae]

Verified queue root cause: at2026-09-08 05:14:46–05:14:50UTC your predecessor runs34188430487 (ba6f42c) and34188631099 (722b4e3) each still had3 image-validation jobs in_progress. Both exact-head docker-publish.yml blobs are c3c33520a6473ed2c4a1c9539de4092f081833ff and omit concurrency. A separate local child based on d30f0b7 adds PR-scoped cancellation;36 release contracts pass, but review found default pending-release replacement remains unsafe. We are verifying native queue:max/conditional syntax before handing over; no push into your branch or manual cancellation yet. Source-head checkout/artifact changes remain intact. Latest GitHub native concurrency-group REST API is live and can provide post-integration evidence without inferring groups from run counts.

[seonghobae]

Ordinary descendant a10d180 is pushed atop preserved d30f0b7. Two-file delta24 lines adds workflow-level PR cancellation and conditional native release queue; matrix siblings remain together, release publication/deployment is non-cancelling and destination-serialized with queue:max (100 pending ceiling). Main independently reran36 release-governance tests, all passed/15.60s with warnings fatal, plus official @actions/workflow-parser0.3.61 and expression evaluator: PR single/true, push max/false; invalid queue literal rejected. git diff check clean. actionlint1.7.12 does NOT support queue and still rejects that key; no suppression and no full-lint-pass claim. Keep Draft for hosted parser/check evidence, actual group/cancellation observation, review, and protected prerequisite integration. No manual cancellation/rerun, tag push, image publication, or deployment performed. Original checkout/artifact changes retained.

[seonghobae]

First live admission receipt for a10d180: native concurrency API reports exactly one member, run34191701204, in group Build and Publish Docker Images-ContextualWisdomLab/naruon-1600. Run API binds pull_request/a10d1803/docker-publish.yml;3 validation jobs were created and queued, while publish/preflight/deploy are skipped. This proves GitHub admitted the conditional queue workflow and assigned the intended PR group, not that image tests passed or runners are executing. Group-member in_progress differs from run/job queued metadata and must not be counted as3 executing jobs. Supersession cancellation still needs a later legitimate source update; no dummy push will be used to manufacture that evidence.