docs: reconcile protected runtime and commercial gap authority

[seonghobae]

Purpose

Keep docs/product-technical-gap-baseline.md and related canonical documentation code-current by separating protected truth, active candidate, transient workflow evidence and foreign-owner authority. Documentation must not promote predecessor/queued checks or foreign implementation into Noema release truth.

Current protected authority — 2026-09-06 KST

Protected Noema is main@5b8e620dbb01a794c1a38535bbcc32e41a80d0df. #546 semantic reviewer, #544 source-bound Context Graph consumer admission, #533 runner-assignment semantic evidence and #552 cross-session coordination guidance are protected truth. ADR-0012 remains Proposed for the broader runtime-orchestration decision.

Protected .github/main is 43024633eba9d96b0456970391360da5a171fbda. #527 exact d289bfcdb617249c90f9fcc1ba050a59334d07fd retains the corresponding exact OIDC source pin without copying central/provider authority.

Documentation repairs

• a87e2f1c7d95ecb2d2523167075e01644f435a54 refreshed the product/technical gap baseline around current protected/central authority and the current post-docs(agents): add cross-session coordination know-how #552 candidate heads.
• That source change exposed a deterministic executable RED in test/documentation-active-work-contract.test.ts: the test still required stale main@71cd0fb... and historical active-work assertions, so the code-current baseline could not satisfy its own documentation fitness gate.
• Test-only causal repair fbd2d7b11c3ed7e7f76e45663f7da0c1a50a4d34 now requires current main@5b8e620..., .github/main@43024633..., and current fix(trust): rebind audited central workflow source #527/fix: pin NOEMA_LLM_MODEL routing alias to orchestrator/free #535/fix(toolchain): replace Wrangler/Miniflare GPL-family path #540/feat(workflow): add atomic durable task claim and checkpoint CAS #542/fix(acquisition): bind commercial source records #526 exact heads while explicitly rejecting stale protected/head identities. It does not promote transient workflow conclusions into timeless documentation.
• The baseline records fix(acquisition): bind commercial source records #526 as a completed semantic source composition: bounded retained {path, sha256} source-document authority coexists with protected distributable package_metadata.sha256, raw-byte package validation, protected runner audit_status, and the lane's O_NONBLOCK regression; the global baseline itself was restored out of fix(acquisition): bind commercial source records #526 so this PR remains the cross-lane writer.
• docs/LICENSING_AND_IP_TRANSFER.md continues to separate the protected Apache-2.0 source grant from third-party compatibility, distribution rights and legal/acquisition authority.

Fresh compare against current protected main is 54 ahead / 0 behind, merge-base exactly 5b8e620...; the PR delta remains six documentation/contract-test files.

Current exact authority

• protected Noema: main@5b8e620dbb01a794c1a38535bbcc32e41a80d0df;
• documentation head: fbd2d7b11c3ed7e7f76e45663f7da0c1a50a4d34;
• lifecycle: open / Draft / mergeable;
• fresh exact-head ci 34022780955 and patch-validator-image 34022780938 are pending; required Security Scan 34022780935 and reviewer-ci 34022780923 are queued. Predecessor evidence does not transfer.

Provider/model routing, retry/failover, quarantine/security and outbound authority remain with contextual-orchestrator, .github, and their canonical owners. Keep Draft until this unchanged head has fresh terminal current gates and a clear current review state; documentation is not release evidence.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

2026-09-06 KST authority refresh: #546 is no longer a Draft prerequisite; exact 7d3de5a... was normally merged as protected main@85b17014b8d46eacc95e096ca114568c321d0263 after terminal reviewer/CI/Security/image GREEN. This docs lane was non-force restacked and then repaired at source: ebb9944d4319b2e7d3033a0641242634d6880f32 rewrites docs/product-technical-gap-baseline.md to the merged reviewer truth and current post-#546 candidate heads, and f1ca1997c9d1476c71885633275b6a90538d345b updates the executable documentation contract that still required the old protected SHA. Current exact head is f1ca1997...; CI/reviewer are pending and Security/image queued, so Draft remains and no predecessor evidence transfers.