20억 매각 readiness evidence 확보

[seonghobae]

Current authority — 2026-09-07 KST

Historical objective NOEMA-GOAL-ACQUISITION-2B-2026-07-02 remains a product objective, not valuation evidence. Noema protected source is GitHub-verified main@0dec8d84b1e4744e7a9c6a77e2e2631a183ee2ab, the normal merge of trust-source prerequisite #554. Protected central .github/main is GitHub-verified c9052e607e5f3cc76e73207e7786b21500721b79.

There are 10 open Noema PRs and all remain Draft: #526, #535, #536, #540, #542, #543, #547, #548, #550 and #553. #539 and #554 are protected truth and are no longer open prerequisites.

Current source order is dependency/overlap aware rather than a single linear stack:

1. feat(workflow): add atomic durable task claim and checkpoint CAS #542 exact 4616b5e93e19d51973aea330aa4124b51725b795 owns the P0 durable workflow state/checkpoint/recovery boundary on current protected ancestry. Application CI, reviewer-ci and required Security Scan are terminal success; patch-validator-image remains in progress, so it is not yet merge authority.
2. fix(toolchain): replace Wrangler/Miniflare GPL-family path #540 exact 2eba9d6b1e3365f745dd43bb8e40e87b0f2ead3a owns the direct pinned workerd/esbuild commercial toolchain repair. Application CI, reviewer-ci and Security Scan are terminal success; image remains in progress. It overlaps ci(actions): isolate pull request concurrency #550 on CI/image workflow paths, so any integration must preserve both deltas through ordinary non-force convergence.
3. fix: pin NOEMA_LLM_MODEL routing alias to orchestrator/free #535 was freshly repaired test-first. Predecessor 9ec7fbb0a20fb771516682946d49a2755035c171 still accepted stale NOEMA_LLM_MODEL=contextual-orchestrator and silently normalized it to orchestrator/free. Test-only b07258e710797bfbc9b40bb5e0aac10a310ddc89 requires fail-closed rejection; production df85cf813f596faa99700f5cb2269e6fb349d592 removes legacy-alias normalization and requires the exact orchestrator/free contract while leaving provider/model discovery, routing, retry and failover with contextual-orchestrator. Its new exact-head workflow generation is non-terminal.
4. feat(reviewer): extract shared noema-core package (ADR-0014) #536/fix(reviewer): bind failed checks to actionable source evidence #548 overlap fix: pin NOEMA_LLM_MODEL routing alias to orchestrator/free #535 in reviewer/shared-core paths and must be integrated semantically rather than by overwriting one another. Their current pre-integration heads retain terminal application/reviewer/Security success but image is still in progress.
5. ci(actions): isolate pull request concurrency #550 exact 3ed5bd956c84e6dd2ebe604dc226fea82145ac29 owns work-conserving workflow concurrency/publication handoff; application CI, reviewer and Security are terminal success while image is in progress. It overlaps fix: pin NOEMA_LLM_MODEL routing alias to orchestrator/free #535 on hourly-product-development and fix(toolchain): replace Wrangler/Miniflare GPL-family path #540 on CI/image workflow paths.
6. test(ci): forbid docs-only required-gate suppression #543/docs: fix stale "active PR #80" references in automation-threat-model.md #553/fix(acquisition): bind commercial source records #526 are narrower lanes on current protected ancestry. Their application/reviewer/Security generations are terminal success where observed, with image evidence still non-terminal. fix(acquisition): bind commercial source records #526 also shares CHANGELOG with several product/config lanes and therefore requires semantic preservation on integration.
7. docs: reconcile protected runtime and commercial gap authority #547 exact 9e60f0434f7855f5d4a112cf5614d3fa07c2c43c remains the sole cross-lane docs/product-technical-gap-baseline.md writer. Its application CI and reviewer are terminal success, Security is queued and image is in progress; it should reconcile final current candidate/protected identities rather than become a parallel source owner.

No predecessor GREEN transfers across head or ancestry movement. Current review-thread evidence must be reread immediately before each merge; a resolved/empty thread set is necessary but not sufficient.

No GitHub release has yet been established as immutable Noema publication evidence. Repository checks, PR-head artifacts, reviewer output, issue prose, or a product-goal title therefore do not prove immutable publication, deployment, production KPI, customer/revenue, legal transfer, or final acquisition readiness.

Goal

Build independently verifiable commercial/acquisition evidence without collapsing distinct authority classes. Production, immutable release, customer/revenue, rights/transfer, deployment, live governance and operating evidence must exist before the final gate can pass.

Current owner boundaries

• chore(governance): protect main and enforce release checks #27: enforceable protected-main governance beyond the positively observed central Security required-workflow rule.
• chore(operations): provision and activate hourly maintainer App #29/[Fleet incident] Activate dedicated publication identity for the orchestrator-backed hourly loop #227: real repository-scoped Maintainer/Reviewer/publication identities, installation scope, key custody/rotation and activation evidence.
• chore(ci): prove and prevent intermittent GitHub Actions runner-assignment stalls #30 / ContextualWisdomLab/.github#712: runner-assignment evidence and organization/platform RCA; transient queue observations are not check success or merge authority.
• chore(governance): configure protected production environment #40: protected production-environment governance and deployment approval controls.
• feat(supply-chain): build, attest, and activate the patch-validator image #66: protected-main patch-validator execution plus immutable publication/signature/provenance/activation.
• security: enable and evidence private vulnerability reporting #73: current protected private-vulnerability-reporting execution plus reporter/staffing/benign-exercise proof.
• chore(repository): audit tmp-should-not-create lineage before any deletion #98: supported exact remote-ref deletion of frozen tmp-should-not-create; force-moving is not deletion.
• [Fleet incident] Disable orphaned candidate-repair and one-shot workflow identities #226: authorized live Actions-registry orphan disablement.
• Noema 판매 가능 목표: 30일 운영 KPI 로그 및 provenance 확보 #3: authenticated >=30-day production /exchange KPI evidence and provenance.
• feat(runtime): add atomic workflow scheduler state-store and recovery boundary #541/feat(workflow): add atomic durable task claim and checkpoint CAS #542: Noema-owned durable workflow execution/state/checkpoint/recovery authority.
• feat(tool-capability): govern external Claude community plugin admission and product-scoped activation #545: external capability/plugin admission, explicitly downstream of feat(runtime): add atomic workflow scheduler state-store and recovery boundary #541/feat(workflow): add atomic durable task claim and checkpoint CAS #542 and released foreign-owner contracts.

Foreign-owner provider routing, quarantine/security implementation and outbound policy remain outside Noema. A missing external control blocks only its evidence lane and never justifies weakening source gates.

Fail-closed acquisition path

exact protected source
→ current central workflow-source binding
→ unchanged exact-head + independently resolved live-base CI/security/review/image evidence
→ normal protected integration
→ protected-main operational receipts
→ immutable SemVer release + package/image/SBOM/provenance identities
→ explicit owner/legal outbound-rights and transfer evidence
→ governed production deployment + rollback/recovery proof
→ >=30-day authenticated production KPI evidence
→ customer/revenue/support/operating-cost evidence where material
→ transfer/data-room integrity audit
→ acquisition final gate

An earlier stage never proves a later stage.

Completion criteria

• Repository-owned governance observation/fail-closed audit logic exists on protected main.
• Canonical documentation graph and machine-readable API contract exist on protected lineage.
• Exact-source patch quarantine and patch-validator local image/runtime/supply-chain implementation exist on protected lineage.
• Pilot/commercial readiness evidence fails closed on ambiguous/placeholder/local-only authority.
• Immutable central-workflow OIDC source binding has been rolled to current central authority through normally merged fix(trust): roll audited central workflow source to c9052e6 #554 at protected main@0dec8d84....
• Every still-required downstream source lane reaches one unchanged exact head with all applicable terminal gates and zero valid unresolved findings, then integrates normally with all overlapping valid deltas preserved.
• chore(governance): protect main and enforce release checks #27 proves/enforces stronger target governance or an accepted owner decision supersedes it.
• chore(operations): provision and activate hourly maintainer App #29/[Fleet incident] Activate dedicated publication identity for the orchestrator-backed hourly loop #227 prove real independent Reviewer/Maintainer/publication identities and least-privilege installation state.
• npm run readiness:audit passes on one exact integrated protected head with real required evidence.
• Execute the patch-validator workflow from protected main and retain exact run/artifact identities.
• Create immutable SemVer release/publication evidence bound to exact source/tag/artifact digests and bind SBOM, dependency-license inventory, NOTICE/attribution and provenance.
• Obtain explicit owner/legal outbound-rights and contributor/IP transfer evidence; automation does not choose the outbound license.
• chore(governance): configure protected production environment #40 proves protected production-environment governance and deploys the exact immutable release with rollback/recovery evidence.
• Noema 판매 가능 목표: 30일 운영 KPI 로그 및 provenance 확보 #3 supplies >=30-day authenticated production evidence meeting the protected KPI contract.
• Bind customer/pilot, revenue/pipeline, support ownership and operating-cost evidence to authenticated records where material.
• Every required data-room entry resolves to exact retained bytes or authenticated external-evidence receipts.
• NOEMA_RELEASE_UNDER_DILIGENCE_TAG=<tag> npm run acquisition:audit passes reproducibly against the immutable release under diligence.

Pending, queued, in-progress, stale, predecessor, synthetic, status-only, model-only or manually edited evidence never substitutes for the current authoritative class.

[seonghobae]

업데이트(2026-07-02):

• 20억 매각 readiness 문서/게이트 PR: Noema 20억 매각 readiness 게이트 추가 #4
• FigJam value map: https://www.figma.com/board/8l2fELfENAABNhDTMEVJKt
• Figma Slides buyer briefing: Figma widget으로 생성됨(Code Connect 미사용)
• 로컬 검증:
  • npm run typecheck PASS
  • npm test PASS (4 files, 21 tests)
  • npm run release:verify PASS
  • npm run acquisition:audit EXPECTED FAIL: revenue/transfer/saleable evidence 미보유

현재 GitHub Actions는 runner queue 대기 중이며 review process 지연은 blocker로 보지 않습니다.

[seonghobae]

PR #4 최신 head를 10d333d로 갱신했습니다.

추가 조치:

• acquisition:audit가 revenue/transfer evidence의 owner, source_documents, 기본 45일 이내 updated_at을 요구하도록 보강했습니다.
• readiness:audit가 샘플/로컬 파일럿 로그를 완료 파일럿으로 인정하지 않도록 production HTTPS NOEMA URL, 증빙 출처: production, 계약/매출 증빙 경로를 요구하도록 보강했습니다.
• 기존 샘플 파일럿 완료 기록은 템플릿 상태로 낮췄고, Goal 문서의 상태도 production 파일럿 증빙 대기로 조정했습니다.

로컬 검증:

• npm run release:verify PASS: 5 files / 26 tests, npm audit high 0 vulnerabilities, KPI non-strict SKIP
• npm run readiness:audit expected FAIL: production KPI/provenance 및 production 파일럿 증빙 미보유
• npm run acquisition:audit expected FAIL: revenue/transfer/saleable evidence 미보유

GitHub Actions는 current head 기준 pending 상태이며, 이전 head 실행은 취소 요청을 넣었습니다. Review process 지연은 blocker로 처리하지 않습니다.

[seonghobae]

추가 진행 상황입니다.

• PR Noema 20억 매각 readiness 게이트 추가 #4 current head 10d333d에서 verify, coverage-evidence, scan-pr-queue, strix는 PASS입니다.
• opencode-review required workflow는 첫 실행이 30분 이상 로그 없이 in_progress라 force-cancel 후 rerun했습니다. 재실행 job 84744621264도 장시간 in_progress 상태입니다. Review process 지연은 blocker로 처리하지 않습니다.
• PR #4를 더 흔들지 않기 위해 다음 작업은 별도 브랜치 acquisition-data-room-manifest로 분리해 원격에 보존했습니다.
• 후속 브랜치 내용: npm run acquisition:manifest 추가, buyer data-room manifest SHA-256 색인 생성, acquisition:audit가 data-room manifest finalGatePassed를 요구하도록 연결.
• 후속 브랜치 로컬 검증: npm run release:verify PASS (6 files / 27 tests), npm run acquisition:manifest PASS with missing final-gate evidence listed, npm run acquisition:audit expected FAIL.

[seonghobae]

진행 업데이트 (2026-07-02 KST)

• Follow-up stacked PR Buyer data room manifest 검증 의미 보강 #6 생성: Buyer data room manifest 검증 의미 보강 #6
• PR Buyer data room manifest 검증 의미 보강 #6 범위: buyer data room manifest의 final evidence가 file presence만 의미하며, 실제 유효성은 validatedBy/npm run acquisition:audit 통과로 판정된다는 계약 명시
• 기존 FigJam 보드에 readiness gate diagram 추가: https://www.figma.com/board/8l2fELfENAABNhDTMEVJKt
• 로컬 검증:
  • npm test -- test/acquisition-data-room-manifest.test.ts test/acquisition-readiness-audit.test.ts PASS (2 files / 5 tests)
  • npm run acquisition:manifest PASS, missing final evidence 4건 유지
  • npm run release:verify PASS (6 files / 27 tests, npm audit high 0 vulnerabilities, KPI non-strict SKIP)
  • npm run acquisition:audit expected FAIL: revenue evidence, transfer evidence, saleable readiness, data room final evidence 미충족
• Base PR #4는 required opencode-review가 아직 in_progress이며, review process 지연은 blocker로 보지 않습니다.

[seonghobae]

진행 업데이트 (2026-07-02 KST)

• PR Buyer data room manifest 검증 의미 보강 #6 최신 head: ff43a4310112175f8a8b8716d4a307b605f60496
• PR Buyer data room manifest 검증 의미 보강 #6 CI verify 통과: npm run release:verify 체인에 npm run acquisition:manifest 포함
• 의도: 앞으로 필수 buyer data-room 파일이 누락되면 일반 release verification에서도 감지
• PR #6은 Noema 20억 매각 readiness 게이트 추가 #4 위 stacked PR로 유지합니다. 지금 Noema 20억 매각 readiness 게이트 추가 #4 branch에 합치면 required OpenCode workflow가 새 head로 다시 시작되므로, 리뷰 지연을 blocker로 보지 않는 원칙에 맞춰 병렬 대기합니다.

[seonghobae]

진행 업데이트 (2026-07-02 KST)

• PR Buyer data room manifest 검증 의미 보강 #6 최신 head: 735c92f
• Product Design/Figma 산출물 보강:
  • 기존 FigJam value map에 readiness gate diagram 추가: https://www.figma.com/board/8l2fELfENAABNhDTMEVJKt
  • Figma Slides 생성은 Figma plan/team 선택이 필요하다는 도구 응답으로 중단. 이는 Goal blocker가 아니므로 동일 내용을 repo source of truth로 docs/buyer-pitch-deck-outline.md에 추가
  • 해당 outline을 buyer data-room manifest 필수 product asset으로 포함
• 로컬 검증:
  • npm test -- test/acquisition-data-room-manifest.test.ts PASS
  • npm run acquisition:manifest PASS
  • npm run release:verify PASS (manifest 포함)
• Figma Code Connect는 사용하지 않았습니다.

[seonghobae]

진행 업데이트 (2026-07-02 KST)

• PR Buyer data room manifest 검증 의미 보강 #6 최신 head: 8e024720af0e0272a0f8e78a145c55c1fb4d28e0
• Transfer readiness 보강:
  • docs/transfer-readiness-plan.md 추가
  • buyer data-room manifest의 transfer asset으로 포함
  • 최종 transfer pass는 여전히 artifacts/acquisition/transfer-evidence.json과 npm run acquisition:audit 통과가 필요
• 검증:
  • npm test -- test/acquisition-data-room-manifest.test.ts PASS
  • npm run acquisition:manifest PASS
  • npm run release:verify PASS
  • npm run acquisition:audit expected FAIL: production KPI, revenue evidence, transfer evidence, saleable readiness 미충족
• PR Buyer data room manifest 검증 의미 보강 #6 GitHub CI verify SUCCESS / mergeState CLEAN
• PR #4는 required opencode-review가 계속 in_progress입니다. 리뷰 대기는 blocker가 아니므로 #6은 stacked 상태로 유지합니다.

[seonghobae]

진행 업데이트 (2026-07-03 KST)

• PR Noema 20억 매각 readiness 게이트 추가 #4 merged: Noema 20억 매각 readiness 게이트 추가 #4
  • mergedAt: 2026-07-02T11:48:39Z
  • mergeCommit: d03846b3984f6fecf98d6fc28b628cc6f26702a5
• PR #6을 main 기준으로 재배치했습니다: Buyer data room manifest 검증 의미 보강 #6
  • old stacked head: 8e024720af0e0272a0f8e78a145c55c1fb4d28e0
  • new main-based head: 3e6d534cbf14f7bd2b9e78ca442ab4e4694f8e36
  • base: main
• 로컬 검증: rebase 후 npm run release:verify PASS
• GitHub required checks는 현재 queued이며, review/check 대기는 blocker로 보지 않습니다.

[seonghobae]

진행 업데이트 (2026-07-03 KST)

• PR Buyer data room manifest 검증 의미 보강 #6 최신 head: 044923e
• acquisition-readiness-audit workflow 추가: .github/workflows/acquisition-readiness-scan.yml
  • schedule: 매일 UTC 01:30
  • 실행: npm run acquisition:manifest 후 npm run acquisition:audit
  • artifact: artifacts/acquisition-readiness/**/* 업로드
  • 실제 revenue/transfer/saleable evidence가 없으면 실패하는 것이 정상이며, 숨기지 않는 readiness signal로 둠
• 로컬 검증:
  • npm test -- test/acquisition-data-room-manifest.test.ts PASS
  • npm run acquisition:manifest PASS
  • npm run release:verify PASS
  • npm run acquisition:audit expected FAIL
• PR Buyer data room manifest 검증 의미 보강 #6 GitHub checks는 새 head 기준으로 재실행 중입니다.

[seonghobae]

진행 업데이트 (2026-07-03 KST)

• PR Buyer data room manifest 검증 의미 보강 #6 auto-merge 설정을 시도했지만 repository 설정상 비활성화되어 실패했습니다: Auto merge is not allowed for this repository
• admin/bypass merge는 사용하지 않았습니다.
• 현재 PR #6은 base main, head 044923e8ba4d51cb7a5bedf34b1032b442f77f39, mergeable MERGEABLE이며 required checks queued 상태입니다.
• Obsolete old-head CI run 하나는 cancel 요청을 보냈습니다. 중앙 required workflow old run은 이 repo run ID로 직접 취소되지 않았습니다.
• 리뷰/check 대기는 blocker로 보지 않고, checks 완료 후 정상 merge flow를 계속합니다.

[seonghobae]

진행 업데이트 (2026-07-03 KST)

• PR Buyer data room manifest 검증 의미 보강 #6 최신 head: 895cea2
• Strategic pipeline route 보강:
  • 문서상 요구사항인 구매자별 보안/운영 실사 Q&A 로그를 npm run acquisition:audit에서 실제로 검사하도록 변경
  • revenue evidence의 strategic pipeline route는 이제 buyer_due_diligence_qna 배열이 1개 이상 있어야 통과
• 검증:
  • npm test -- test/acquisition-readiness-audit.test.ts PASS (5 tests)
  • npm run release:verify PASS (6 files / 28 tests, npm audit high 0 vulnerabilities, KPI non-strict SKIP, manifest PASS)
  • npm run acquisition:audit expected FAIL: 실제 production KPI/revenue/transfer/saleable evidence 미충족
• PR Buyer data room manifest 검증 의미 보강 #6 GitHub checks는 새 head 기준으로 다시 실행됩니다.

[seonghobae]

진행 업데이트 (2026-07-03 KST)

• PR Buyer data room manifest 검증 의미 보강 #6 최신 head: 5da0f95a1b02202ffaf073890e306715f10ace65
• Copilot review 대응:
  • sha256()를 readFileSync 전체 읽기에서 openSync/readSync chunked hashing으로 변경
  • NOEMA_DATA_ROOM_MANIFEST_PATH가 output dir 밖을 가리켜도 parent directory 생성
  • acquisition:audit가 data-room manifest objective까지 검증
  • manifest test의 spawnSync("node")를 process.execPath로 변경
• 검증:
  • npm test -- test/acquisition-data-room-manifest.test.ts PASS (2 tests)
  • npm test -- test/acquisition-readiness-audit.test.ts PASS (6 tests)
  • npm run release:verify PASS (6 files / 30 tests, npm audit high 0 vulnerabilities, KPI non-strict SKIP, manifest PASS)
  • npm run acquisition:audit expected FAIL: 실제 production KPI/revenue/transfer/saleable evidence 미충족
• 남은 review thread는 GraphQL resolveReviewThread로 resolved 처리했습니다. PR checks는 새 head 기준으로 queued 상태입니다.

[seonghobae]

진행 업데이트 (2026-07-03 KST)

• 후속 stacked PR Production evidence preflight 추가 #7 생성: Production evidence preflight 추가 #7
• 범위: production evidence 수집 전 입력 preflight 추가
  • npm run production:preflight
  • NOEMA_EXCHANGE_URL HTTPS /exchange 확인
  • NOEMA_KPI_SOURCE_KIND=production 확인
  • 비밀이 아닌 NOEMA_KPI_SOURCE_ID 확인
  • NOEMA_KPI_LOG_URL 또는 NOEMA_KPI_TAIL_COMMAND 확인
• 현재 환경 실행 결과: expected FAIL. repo variables/secrets가 비어 있어 production URL/KPI source가 없음
• 검증:
  • npm test -- test/production-evidence-preflight.test.ts PASS (2 tests)
  • npm test -- test/acquisition-data-room-manifest.test.ts PASS (2 tests)
  • npm run release:verify PASS (7 files / 32 tests, npm audit high 0 vulnerabilities, KPI non-strict SKIP, manifest PASS)
  • npm run acquisition:audit expected FAIL
• PR #7은 PR Buyer data room manifest 검증 의미 보강 #6 위 stacked follow-up입니다. PR Buyer data room manifest 검증 의미 보강 #6 queued checks를 초기화하지 않기 위해 별도 PR로 분리했습니다.

[seonghobae]

2026-07-03 진행 로그

• PR Production evidence preflight 추가 #7 head 갱신: 3c61ca422089f67c4d32557476a61979e07c7806
• 추가 내용:
  • npm run acquisition:audit가 production 유료 파일럿 로그를 직접 검증하도록 연결
  • NOEMA_PILOT_LOG_PATH 지원 추가
  • buyer data-room manifest에서 pilot-log는 presence/hash 색인이고 내용 유효성은 npm run acquisition:audit가 판정하도록 명시
  • README, buyer due diligence index, acquisition goal 문서 갱신
• 검증:
  • npm test -- test/acquisition-readiness-audit.test.ts PASS, 7 tests
  • npm test -- test/acquisition-data-room-manifest.test.ts PASS, 2 tests
  • npm run release:verify PASS, 7 files / 33 tests, audit 0 high vulnerabilities, non-strict KPI SKIP as expected without exchange-30d.ndjson
  • npm run acquisition:audit expected FAIL: pilot production evidence pass, revenue, transfer, saleable, data-room final evidence missing
  • npm run production:preflight expected FAIL: production URL/KPI source inputs absent
• 현재 PR 상태:
  • PR Buyer data room manifest 검증 의미 보강 #6: mergeable, required checks queued
  • PR Production evidence preflight 추가 #7: mergeable, required verify queued, unresolved review threads 없음
• 남은 실제 증거:
  • production HTTPS /exchange URL
  • 30일 production KPI 로그/provenance
  • paid production pilot record
  • revenue/LOI/pipeline evidence
  • transfer evidence

Review process, review bot, queued required checks는 Goal blocker로 취급하지 않습니다.

[seonghobae]

2026-07-03 추가 진행 로그

• PR Production evidence preflight 추가 #7 head 갱신: 51a0387fda087c4f05617fa4a5758aa18c09d9cc
• 추가 내용:
  • kpi:verify:strict가 production provenance sourceId를 비밀이 아닌 안정적 라벨로 강제
  • URL, query string, token, secret, key가 포함된 source id는 strict KPI gate에서 실패 처리
  • docs/observability-kpi.md에 strict source id 기준 명시
• 검증:
  • npm test -- test/kpi-gate.test.ts PASS, 3 tests
  • git diff --check PASS
  • npm run release:verify PASS, 7 files / 34 tests, audit 0 high vulnerabilities, non-strict KPI SKIP without exchange-30d.ndjson
  • npm run acquisition:audit expected FAIL: 실제 pilot/revenue/transfer/saleable/data-room final evidence missing
• 현재 PR Production evidence preflight 추가 #7 상태:
  • mergeable
  • required verify queued
  • unresolved review threads 없음

Review process, review bot, queued required checks는 Goal blocker로 취급하지 않습니다.