Retire the CWL-managed static Nginx delivery boundary

[seonghobae]

Current protected-branch defect

Fresh evidence on 2026-09-01 shows protected develop@2c328875e00e86537df3e965170be80532571cad still contains a CWL-managed Nginx delivery path:

• Dockerfile is based on the pinned nginx:1.25-alpine image, copies infra/nginx/default.conf, serves /usr/share/nginx/html, provisions Nginx PID/cache paths, and launches Nginx on port 8080;
• infra/k8s/deployment.yaml deploys scopeweave:1.0.0, exposes container port 8080, probes /, and mounts nginx-cache, nginx-run, and nginx-tmp volumes; and
• docs/deploy.md and docs/operations/kubernetes-persistence-roadmap.md still describe the Kubernetes/static-Nginx packaging as a deployable/reference path.

This is ACTIVE_RUNTIME + ACTIVE_DEPLOYMENT/CURRENT_PACKAGING evidence, not a historical mention.

DDD / hosting-owner correction

Do not assume that replacing this static Nginx image with Pingora is automatically the right product boundary. ScopeWeave's own AGENTS.md says the client must remain static-host compatible and forbids runtime dependencies, while .github/workflows/pages.yml already publishes the same standalone static file set from develop to managed GitHub Pages. That makes managed static hosting a live, simpler candidate owner for the standalone client.

The migration decision is therefore evidence-based:

1. If no current buyer/operator requires the container/Kubernetes static-only surface, retire the Nginx Docker/Kubernetes packaging and make the existing managed Pages path the canonical standalone-client delivery boundary.
2. If a real self-hosted/container consumer requires that surface, characterize its behavior first and migrate that delivery adapter to the shared ContextualWisdomLab/pingora-gateway only after the shared runtime has a reviewed/published immutable artifact and the required static-serving increment exists.

ScopeWeave-specific UI routing, fallback and response-header policy remains owned by ScopeWeave either way; it must not move into the shared gateway's Generic/Supporting edge domain.

Existing writer/PR overlap — freeze source mutation

PR #576 is currently Ready and mechanically mergeable, based on develop@2c328875e00e86537df3e965170be80532571cad, with exact contributor head 62484c2dbeb755fd80fbc123d34e55df7755bda8. It changes the same static-delivery surface by adding dialog-accessibility.js to GitHub Pages, the static Nginx Docker image and the server image, and it owns related response-header behavior.

Its repository-native workflows are reported terminal-success, but the PR itself records that those runs checked GitHub's synthetic merge commit rather than leaving HEAD at the immutable contributor SHA, and that no qualifying independent current-head/last-push approval exists. Do not race #576 or create a migration branch from stale develop; preserve its unique semantic delta after it integrates, or deliberately stack only after revalidating its exact head/base and ownership.

Shared-runtime dependency

ContextualWisdomLab/pingora-gateway PR #1 is still Draft and actively moving. During this sweep its head advanced from 74517b885d333419cc51ead4a1adb6ed94ba883d to 00acb954a86d8ce311893aa31ad5ec5f2e28e685 (feat: expose fail-closed startup boundary). Exact-head CI run 33472030919 was in progress and SAST/Security runs 33472030936 / 33472030904 were queued when checked. No formal reviews or review threads existed. This is active-writer evidence, not a consumable release; do not pin an invented tag/digest or race that branch.

RED characterization before any self-hosted replacement

Exercise the current production static-container path, not source-text substitutions, and lock down the behavior actually required by a current consumer:

• / plus known CSS/JS/JSON/docs assets;
• missing-resource status/body and 404.html behavior;
• GET and HEAD parity;
• MIME, ETag/cache/range/304/416 behavior actually observed;
• security/cache headers, including the policy introduced by security: harden response headers and dialog accessibility #576 after it lands;
• port 8080, non-root/read-only-root behavior, health/readiness and termination;
• deep-link/static-route semantics used by the buyer UI;
• compression and error responses if currently depended on.

The first migration acceptance must fail while a CWL-managed Nginx image/config/process path remains. The characterization suite itself should pass against the old runtime and then remain implementation-neutral so the replacement proves behavior preservation.

GREEN acceptance

• no active CWL-managed Nginx image/package/config/PID/cache/process/deployment path remains;
• the chosen delivery owner is explicitly justified: managed Pages for the standalone static client, or a versioned shared Pingora artifact for a proven self-hosted/container requirement;
• ScopeWeave-specific fallback/route/header policy remains in a ScopeWeave delivery adapter/config contract rather than leaking into pingora-gateway domain code;
• non-root/read-only-root, health/readiness, graceful termination and rollback are tested wherever a container remains;
• Docker/Compose/Kubernetes/operator docs, AGENTS/CLAUDE, architecture/context map/ubiquitous language, SECURITY/THREAT_MODEL, TEST_STRATEGY, OPERABILITY, docs/product-technical-gap-baseline.md, README and CHANGELOG are code-current;
• exact-current-head CI/security/coverage/SBOM/provenance gates pass and predecessor/synthetic-merge evidence is not reused; and
• any production image is pinned to an actually published immutable digest.

Smallest next safe action

Do not touch the overlapping static delivery files while #576 owns them. After #576 reaches protected develop (or is otherwise resolved), refetch develop, prove whether the static-only Docker/Kubernetes surface has a current consumer, then choose the managed-host retirement lane or add executable self-hosted characterization before the first replacement change.

[seonghobae]

Pingora migration owner-path handoff only; no ScopeWeave source/docs/ref/PR mutation requested. Fresh protected develop remains 2c328875e00e86537df3e965170be80532571cad, and overlapping PR #576 remains open/Ready/mergeable at exact 62484c2dbeb755fd80fbc123d34e55df7755bda8. The shared-runtime paragraph in this issue is now historical: canonical pingora-gateway authority is #58 on protected main@f8b4c99b8e5d3de79af1ff0c00c0c8fd63b52991; first integration root #1 is Draft 0da81a93... with the real derivative 2.2.0 / RUSTSEC-2024-0388 RED, and there is still no GitHub Release for ScopeWeave to consume. Please use that current gateway authority after #576 is resolved rather than the older moving #1/#47 snapshot in the body. The architectural disposition remains conditional: managed-host retirement if self-hosting is not a current buyer requirement; otherwise characterize the product-owned static boundary first and consume only a later release-qualified immutable gateway capability for genuinely reusable edge behavior.