From d4e908e72ed1ab24ac834a3bd45d4552b9b91f1f Mon Sep 17 00:00:00 2001 From: OpenAI Codex Date: Fri, 28 Aug 2026 17:39:14 +0900 Subject: [PATCH 01/73] docs(gaps): add exact-head readiness baseline --- docs/product-technical-gap-baseline.md | 71 ++++++++++++++++++++++++++ 1 file changed, 71 insertions(+) create mode 100644 docs/product-technical-gap-baseline.md diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md new file mode 100644 index 00000000..842a4a79 --- /dev/null +++ b/docs/product-technical-gap-baseline.md @@ -0,0 +1,71 @@ +# Product and technical gap baseline + +Snapshot date: 2026-08-28T17:38:19+09:00 (live exact-head GitHub inventory for `ContextualWisdomLab/wardnet`). + +## 1. Executive summary + +`main` is at commit `107117634764c901dff540044585d64088fafedb`. The product direction remains the Rust-first Wardnet gateway described in the current PRD/TRD and ADR set: + +- PRD/TRD: [docs/superpowers/specs/2026-07-02-waf-ids-ai-soc-design.md](docs/superpowers/specs/2026-07-02-waf-ids-ai-soc-design.md), [docs/superpowers/specs/2026-07-02-commercial-sale-readiness-design.md](docs/superpowers/specs/2026-07-02-commercial-sale-readiness-design.md), and [docs/superpowers/specs/2026-07-02-program-completion-baseline-design.md](docs/superpowers/specs/2026-07-02-program-completion-baseline-design.md) +- ADR: [docs/adr/0010-adaptive-contextual-orchestrator-default.md](docs/adr/0010-adaptive-contextual-orchestrator-default.md) + +Commercial-readiness progress is real, but protected-branch evidence does not yet support a merge-ready claim for the open delivery stack. The current blockers are not hypothetical: they are live GitHub branch-protection requirements, unresolved review findings on the exact current heads, and missing independent approval. + +## 2. Protected-branch gate + +Organization ruleset `18156473` currently requires: + +- 1 independent approving review +- resolved review threads +- required workflows for `Close Empty PR`, `Required OpenCode Review`, `Required PR Review Merge Scheduler`, `Security Scan`, `Strix Security Scan`, `SAST Semgrep`, and `Required Noema Review` + +No open PR may be treated as ready until its current head satisfies those exact rules. + +## 3. Open PR inventory + +There are 14 open PRs. + +| PR | Head | State | Exact-head evidence | Current next action | +| --- | --- | --- | --- | --- | +| [#129](https://github.com/ContextualWisdomLab/wardnet/pull/129) | `1a5d2c77a8` | Draft, blocked | No unresolved threads; independent review still required | Wait for current-head review and required checks | +| [#127](https://github.com/ContextualWisdomLab/wardnet/pull/127) | `aa29565948` | Blocked | No unresolved threads; independent review still required | Wait for approval and hosted gates | +| [#126](https://github.com/ContextualWisdomLab/wardnet/pull/126) | `41d7ba9e8f` | Blocked | No unresolved threads; independent review still required | Wait for approval and hosted gates | +| [#115](https://github.com/ContextualWisdomLab/wardnet/pull/115) | `9de0b21916` | Blocked | `opencode-review` failed on current head; `strix` failed; 2 unresolved info threads remain; no approval | Re-run external review gates on a fresh head and resolve remaining thread decisions | +| [#114](https://github.com/ContextualWisdomLab/wardnet/pull/114) | `95da92339f` | Blocked | No unresolved threads; independent review still required | Wait for approval and hosted gates | +| [#112](https://github.com/ContextualWisdomLab/wardnet/pull/112) | `bab3c72bb7` | Blocked | No unresolved threads; independent review still required | Wait for approval and hosted gates | +| [#111](https://github.com/ContextualWisdomLab/wardnet/pull/111) | `43369a8801` | Blocked | No unresolved threads; independent review still required | Wait for approval and hosted gates | +| [#95](https://github.com/ContextualWisdomLab/wardnet/pull/95) | `3c5b3eb65f` | Blocked | Current head was advanced on 2026-08-28; required checks re-queued; substantive review threads remain open; no approval | Let current-head workflows finish, then continue reducing review findings | +| [#94](https://github.com/ContextualWisdomLab/wardnet/pull/94) | `d7fa9a16a7` | Blocked | No unresolved threads; independent review still required | Wait for approval and hosted gates | +| [#93](https://github.com/ContextualWisdomLab/wardnet/pull/93) | `b38feb9489` | Blocked | No unresolved threads; independent review still required | Wait for approval and hosted gates | +| [#90](https://github.com/ContextualWisdomLab/wardnet/pull/90) | `e316d4b08e` | Blocked | No unresolved threads; independent review still required | Wait for approval and hosted gates | +| [#88](https://github.com/ContextualWisdomLab/wardnet/pull/88) | `cbe21a11ab` | Blocked | No unresolved threads; independent review still required | Wait for approval and hosted gates | +| [#77](https://github.com/ContextualWisdomLab/wardnet/pull/77) | `17cca73671` | Blocked | No unresolved threads; independent review still required | Wait for approval and hosted gates | +| [#72](https://github.com/ContextualWisdomLab/wardnet/pull/72) | `892f9277ba` | Blocked | No unresolved threads; independent review still required | Wait for approval and hosted gates | + +## 4. Open issue inventory + +There are 16 open issues. The highest-impact live backlog items are: + +- [#128](https://github.com/ContextualWisdomLab/wardnet/issues/128): gate AI-agent package installation against untrusted `llms.txt` and web instructions +- [#87](https://github.com/ContextualWisdomLab/wardnet/issues/87): close the evidence-backed production readiness gate +- [#86](https://github.com/ContextualWisdomLab/wardnet/issues/86): put proven WAF/IDS engines in the enforcement path and publish detection-quality evidence +- [#85](https://github.com/ContextualWisdomLab/wardnet/issues/85): establish production telemetry, SLOs, incident response, and disaster-recovery evidence +- [#84](https://github.com/ContextualWisdomLab/wardnet/issues/84): complete immutable signed release, promotion, and rollback evidence +- [#83](https://github.com/ContextualWisdomLab/wardnet/issues/83): add bounded admission control and trusted client attribution +- [#82](https://github.com/ContextualWisdomLab/wardnet/issues/82): integrate Keyverse identity and tenant authorization evidence + +## 5. Product gaps against current requirements + +Relative to the current PRD/TRD/ADR set, the main unproven or unmerged requirements are: + +- Proven-engine enforcement is still not merged to `main`, so Wardnet cannot yet truthfully claim in-path Coraza-backed enforcement on the protected branch. +- PostgreSQL control-plane authority, tenant-isolated backup and restore, and transactional outbox durability are still in the open PR stack rather than on `main`. +- The Wardnet rename is still incomplete on the protected branch; customer-facing and artifact-facing naming remains mixed until [#114](https://github.com/ContextualWisdomLab/wardnet/pull/114) lands. +- Exact-head hosted evidence is unstable for the highest-value stack: [#115](https://github.com/ContextualWisdomLab/wardnet/pull/115) currently has failing external review checks, and [#95](https://github.com/ContextualWisdomLab/wardnet/pull/95) is still mid-validation on a fresh head. +- Commercial-readiness proof remains incomplete for release promotion, telemetry/SLO evidence, accessibility/screenshot evidence, and customer-facing production-readiness packaging. + +## 6. Next-step order + +1. Land the exact-head review and hosted-check fixes on [#95](https://github.com/ContextualWisdomLab/wardnet/pull/95) and [#115](https://github.com/ContextualWisdomLab/wardnet/pull/115) without bypassing branch protection. +2. Merge blocked-but-clean documentation and rename PRs only after they receive an independent approval on their current heads. +3. Convert the remaining commercial-readiness gaps into reviewable PRs with runnable evidence, prioritizing production-readiness proof over broad scope expansion. From 25a1269359befe3d2ca7ed71c1c29c1c41d7bbdc Mon Sep 17 00:00:00 2001 From: OpenAI Codex Date: Fri, 28 Aug 2026 18:42:47 +0900 Subject: [PATCH 02/73] docs(gaps): fix PR inventory scope --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 842a4a79..c8d415a4 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -23,11 +23,11 @@ No open PR may be treated as ready until its current head satisfies those exact ## 3. Open PR inventory -There are 14 open PRs. +There are 14 other open PRs, excluding this baseline PR (`#130`). | PR | Head | State | Exact-head evidence | Current next action | | --- | --- | --- | --- | --- | -| [#129](https://github.com/ContextualWisdomLab/wardnet/pull/129) | `1a5d2c77a8` | Draft, blocked | No unresolved threads; independent review still required | Wait for current-head review and required checks | +| [#129](https://github.com/ContextualWisdomLab/wardnet/pull/129) | `1a5d2c77a8` | Draft, blocked | Current head is intentionally red; no unresolved threads; independent review still required | Resolve the intentionally red head, then rerun current-head checks and obtain approval | | [#127](https://github.com/ContextualWisdomLab/wardnet/pull/127) | `aa29565948` | Blocked | No unresolved threads; independent review still required | Wait for approval and hosted gates | | [#126](https://github.com/ContextualWisdomLab/wardnet/pull/126) | `41d7ba9e8f` | Blocked | No unresolved threads; independent review still required | Wait for approval and hosted gates | | [#115](https://github.com/ContextualWisdomLab/wardnet/pull/115) | `9de0b21916` | Blocked | `opencode-review` failed on current head; `strix` failed; 2 unresolved info threads remain; no approval | Re-run external review gates on a fresh head and resolve remaining thread decisions | From 024882906739327130cc0e4f631392635c9a4a5e Mon Sep 17 00:00:00 2001 From: OpenAI Codex Date: Sun, 30 Aug 2026 09:16:17 +0900 Subject: [PATCH 03/73] docs(gaps): refresh draft PR exact-head blockers --- docs/product-technical-gap-baseline.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index c8d415a4..b88ed3e2 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -23,11 +23,12 @@ No open PR may be treated as ready until its current head satisfies those exact ## 3. Open PR inventory -There are 14 other open PRs, excluding this baseline PR (`#130`). +There are 14 other open PRs at this exact head, intentionally excluding this +baseline PR (`#130`) from the table below. | PR | Head | State | Exact-head evidence | Current next action | | --- | --- | --- | --- | --- | -| [#129](https://github.com/ContextualWisdomLab/wardnet/pull/129) | `1a5d2c77a8` | Draft, blocked | Current head is intentionally red; no unresolved threads; independent review still required | Resolve the intentionally red head, then rerun current-head checks and obtain approval | +| [#129](https://github.com/ContextualWisdomLab/wardnet/pull/129) | `6eea1293bb` | Draft, intentionally blocked | Current exact head is intentionally RED: `noema-review`, `opencode-review`, and `strix` failed; no unresolved threads; independent review still required; must not be merged in this state | Keep the PR in draft, finish the remaining service/docs slices, then replace the intentionally red head with a green exact head before requesting approval | | [#127](https://github.com/ContextualWisdomLab/wardnet/pull/127) | `aa29565948` | Blocked | No unresolved threads; independent review still required | Wait for approval and hosted gates | | [#126](https://github.com/ContextualWisdomLab/wardnet/pull/126) | `41d7ba9e8f` | Blocked | No unresolved threads; independent review still required | Wait for approval and hosted gates | | [#115](https://github.com/ContextualWisdomLab/wardnet/pull/115) | `9de0b21916` | Blocked | `opencode-review` failed on current head; `strix` failed; 2 unresolved info threads remain; no approval | Re-run external review gates on a fresh head and resolve remaining thread decisions | From ee6e643697f379b8b6de8592cb90d7e7be63798f Mon Sep 17 00:00:00 2001 From: OpenAI Codex Date: Sun, 30 Aug 2026 10:24:34 +0900 Subject: [PATCH 04/73] docs(gaps): refresh exact-head PR gate state --- docs/product-technical-gap-baseline.md | 30 +++++++++++++------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index b88ed3e2..1bfc28a9 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # Product and technical gap baseline -Snapshot date: 2026-08-28T17:38:19+09:00 (live exact-head GitHub inventory for `ContextualWisdomLab/wardnet`). +Snapshot date: 2026-08-30T09:45:00+09:00 (live exact-head GitHub inventory for `ContextualWisdomLab/wardnet`). ## 1. Executive summary @@ -29,19 +29,19 @@ baseline PR (`#130`) from the table below. | PR | Head | State | Exact-head evidence | Current next action | | --- | --- | --- | --- | --- | | [#129](https://github.com/ContextualWisdomLab/wardnet/pull/129) | `6eea1293bb` | Draft, intentionally blocked | Current exact head is intentionally RED: `noema-review`, `opencode-review`, and `strix` failed; no unresolved threads; independent review still required; must not be merged in this state | Keep the PR in draft, finish the remaining service/docs slices, then replace the intentionally red head with a green exact head before requesting approval | -| [#127](https://github.com/ContextualWisdomLab/wardnet/pull/127) | `aa29565948` | Blocked | No unresolved threads; independent review still required | Wait for approval and hosted gates | -| [#126](https://github.com/ContextualWisdomLab/wardnet/pull/126) | `41d7ba9e8f` | Blocked | No unresolved threads; independent review still required | Wait for approval and hosted gates | -| [#115](https://github.com/ContextualWisdomLab/wardnet/pull/115) | `9de0b21916` | Blocked | `opencode-review` failed on current head; `strix` failed; 2 unresolved info threads remain; no approval | Re-run external review gates on a fresh head and resolve remaining thread decisions | -| [#114](https://github.com/ContextualWisdomLab/wardnet/pull/114) | `95da92339f` | Blocked | No unresolved threads; independent review still required | Wait for approval and hosted gates | -| [#112](https://github.com/ContextualWisdomLab/wardnet/pull/112) | `bab3c72bb7` | Blocked | No unresolved threads; independent review still required | Wait for approval and hosted gates | -| [#111](https://github.com/ContextualWisdomLab/wardnet/pull/111) | `43369a8801` | Blocked | No unresolved threads; independent review still required | Wait for approval and hosted gates | -| [#95](https://github.com/ContextualWisdomLab/wardnet/pull/95) | `3c5b3eb65f` | Blocked | Current head was advanced on 2026-08-28; required checks re-queued; substantive review threads remain open; no approval | Let current-head workflows finish, then continue reducing review findings | -| [#94](https://github.com/ContextualWisdomLab/wardnet/pull/94) | `d7fa9a16a7` | Blocked | No unresolved threads; independent review still required | Wait for approval and hosted gates | -| [#93](https://github.com/ContextualWisdomLab/wardnet/pull/93) | `b38feb9489` | Blocked | No unresolved threads; independent review still required | Wait for approval and hosted gates | -| [#90](https://github.com/ContextualWisdomLab/wardnet/pull/90) | `e316d4b08e` | Blocked | No unresolved threads; independent review still required | Wait for approval and hosted gates | -| [#88](https://github.com/ContextualWisdomLab/wardnet/pull/88) | `cbe21a11ab` | Blocked | No unresolved threads; independent review still required | Wait for approval and hosted gates | -| [#77](https://github.com/ContextualWisdomLab/wardnet/pull/77) | `17cca73671` | Blocked | No unresolved threads; independent review still required | Wait for approval and hosted gates | -| [#72](https://github.com/ContextualWisdomLab/wardnet/pull/72) | `892f9277ba` | Blocked | No unresolved threads; independent review still required | Wait for approval and hosted gates | +| [#127](https://github.com/ContextualWisdomLab/wardnet/pull/127) | `aa29565948` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | +| [#126](https://github.com/ContextualWisdomLab/wardnet/pull/126) | `41d7ba9e8f` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | +| [#115](https://github.com/ContextualWisdomLab/wardnet/pull/115) | `aad8224ab6` | Blocked | `opencode-review` and `strix` failed on the current head; no unresolved threads; independent review still required | Re-run the external review gates on a fresh head, then obtain approval | +| [#114](https://github.com/ContextualWisdomLab/wardnet/pull/114) | `95da92339f` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | +| [#112](https://github.com/ContextualWisdomLab/wardnet/pull/112) | `bab3c72bb7` | Blocked | No unresolved threads; all current hosted checks are green; independent review still required | Obtain an independent approval on the current head | +| [#111](https://github.com/ContextualWisdomLab/wardnet/pull/111) | `43369a8801` | Blocked | No unresolved threads; all current hosted checks are green; independent review still required | Obtain an independent approval on the current head | +| [#95](https://github.com/ContextualWisdomLab/wardnet/pull/95) | `0e025945c4` | Blocked | `required-workflow-bootstrap`, `noema-review`, and `strix` failed on the current head; 7 unresolved review threads remain; no independent approval | Clear the current review threads, rerun current-head gates, then obtain approval | +| [#94](https://github.com/ContextualWisdomLab/wardnet/pull/94) | `d7fa9a16a7` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | +| [#93](https://github.com/ContextualWisdomLab/wardnet/pull/93) | `b38feb9489` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | +| [#90](https://github.com/ContextualWisdomLab/wardnet/pull/90) | `e316d4b08e` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | +| [#88](https://github.com/ContextualWisdomLab/wardnet/pull/88) | `cbe21a11ab` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | +| [#77](https://github.com/ContextualWisdomLab/wardnet/pull/77) | `17cca73671` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | +| [#72](https://github.com/ContextualWisdomLab/wardnet/pull/72) | `892f9277ba` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | ## 4. Open issue inventory @@ -62,7 +62,7 @@ Relative to the current PRD/TRD/ADR set, the main unproven or unmerged requireme - Proven-engine enforcement is still not merged to `main`, so Wardnet cannot yet truthfully claim in-path Coraza-backed enforcement on the protected branch. - PostgreSQL control-plane authority, tenant-isolated backup and restore, and transactional outbox durability are still in the open PR stack rather than on `main`. - The Wardnet rename is still incomplete on the protected branch; customer-facing and artifact-facing naming remains mixed until [#114](https://github.com/ContextualWisdomLab/wardnet/pull/114) lands. -- Exact-head hosted evidence is unstable for the highest-value stack: [#115](https://github.com/ContextualWisdomLab/wardnet/pull/115) currently has failing external review checks, and [#95](https://github.com/ContextualWisdomLab/wardnet/pull/95) is still mid-validation on a fresh head. +- Exact-head hosted evidence is unstable for the highest-value stack: [#115](https://github.com/ContextualWisdomLab/wardnet/pull/115) currently has failing external review checks, and [#95](https://github.com/ContextualWisdomLab/wardnet/pull/95) still has multiple failed required workflows plus unresolved review threads on its current head. - Commercial-readiness proof remains incomplete for release promotion, telemetry/SLO evidence, accessibility/screenshot evidence, and customer-facing production-readiness packaging. ## 6. Next-step order From 55b91795023ff22d723db6707954a2535059cfb1 Mon Sep 17 00:00:00 2001 From: OpenAI Codex Date: Sun, 30 Aug 2026 14:14:51 +0900 Subject: [PATCH 05/73] docs(gaps): correct PR 112 gate evidence --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 1bfc28a9..ff7ee1f0 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # Product and technical gap baseline -Snapshot date: 2026-08-30T09:45:00+09:00 (live exact-head GitHub inventory for `ContextualWisdomLab/wardnet`). +Snapshot date: 2026-08-30T14:14:32+09:00 (live exact-head GitHub inventory for `ContextualWisdomLab/wardnet`). ## 1. Executive summary @@ -33,7 +33,7 @@ baseline PR (`#130`) from the table below. | [#126](https://github.com/ContextualWisdomLab/wardnet/pull/126) | `41d7ba9e8f` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | | [#115](https://github.com/ContextualWisdomLab/wardnet/pull/115) | `aad8224ab6` | Blocked | `opencode-review` and `strix` failed on the current head; no unresolved threads; independent review still required | Re-run the external review gates on a fresh head, then obtain approval | | [#114](https://github.com/ContextualWisdomLab/wardnet/pull/114) | `95da92339f` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | -| [#112](https://github.com/ContextualWisdomLab/wardnet/pull/112) | `bab3c72bb7` | Blocked | No unresolved threads; all current hosted checks are green; independent review still required | Obtain an independent approval on the current head | +| [#112](https://github.com/ContextualWisdomLab/wardnet/pull/112) | `bab3c72bb7` | Blocked | No unresolved threads; the current head has green hosted checks that ran, but the now-required `Strix Security Scan` result is absent; independent review still required | Run `Strix Security Scan` on the current head, then obtain an independent approval | | [#111](https://github.com/ContextualWisdomLab/wardnet/pull/111) | `43369a8801` | Blocked | No unresolved threads; all current hosted checks are green; independent review still required | Obtain an independent approval on the current head | | [#95](https://github.com/ContextualWisdomLab/wardnet/pull/95) | `0e025945c4` | Blocked | `required-workflow-bootstrap`, `noema-review`, and `strix` failed on the current head; 7 unresolved review threads remain; no independent approval | Clear the current review threads, rerun current-head gates, then obtain approval | | [#94](https://github.com/ContextualWisdomLab/wardnet/pull/94) | `d7fa9a16a7` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | From 64c783c80afde22bce404050e4d6006eea8d6f34 Mon Sep 17 00:00:00 2001 From: OpenAI Codex Date: Sun, 30 Aug 2026 15:27:07 +0900 Subject: [PATCH 06/73] docs(gaps): correct PR 112 gate wording --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index ff7ee1f0..7afecbe8 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -33,7 +33,7 @@ baseline PR (`#130`) from the table below. | [#126](https://github.com/ContextualWisdomLab/wardnet/pull/126) | `41d7ba9e8f` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | | [#115](https://github.com/ContextualWisdomLab/wardnet/pull/115) | `aad8224ab6` | Blocked | `opencode-review` and `strix` failed on the current head; no unresolved threads; independent review still required | Re-run the external review gates on a fresh head, then obtain approval | | [#114](https://github.com/ContextualWisdomLab/wardnet/pull/114) | `95da92339f` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | -| [#112](https://github.com/ContextualWisdomLab/wardnet/pull/112) | `bab3c72bb7` | Blocked | No unresolved threads; the current head has green hosted checks that ran, but the now-required `Strix Security Scan` result is absent; independent review still required | Run `Strix Security Scan` on the current head, then obtain an independent approval | +| [#112](https://github.com/ContextualWisdomLab/wardnet/pull/112) | `bab3c72bb7` | Blocked | No unresolved threads; some current-head hosted checks completed successfully, but the now-required `Strix Security Scan` result is absent, so the gate is not green; independent review still required | Re-run `Strix Security Scan` on the current head, then obtain an independent approval | | [#111](https://github.com/ContextualWisdomLab/wardnet/pull/111) | `43369a8801` | Blocked | No unresolved threads; all current hosted checks are green; independent review still required | Obtain an independent approval on the current head | | [#95](https://github.com/ContextualWisdomLab/wardnet/pull/95) | `0e025945c4` | Blocked | `required-workflow-bootstrap`, `noema-review`, and `strix` failed on the current head; 7 unresolved review threads remain; no independent approval | Clear the current review threads, rerun current-head gates, then obtain approval | | [#94](https://github.com/ContextualWisdomLab/wardnet/pull/94) | `d7fa9a16a7` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | From 8da77f691b938abaf717b222389b4249d6fe2364 Mon Sep 17 00:00:00 2001 From: OpenAI Codex Date: Sun, 30 Aug 2026 18:58:21 +0900 Subject: [PATCH 07/73] docs(gaps): refresh live exact-head inventory --- docs/product-technical-gap-baseline.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 7afecbe8..cc1165ab 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # Product and technical gap baseline -Snapshot date: 2026-08-30T14:14:32+09:00 (live exact-head GitHub inventory for `ContextualWisdomLab/wardnet`). +Snapshot date: 2026-08-30T18:57:50+09:00 (live exact-head GitHub inventory for `ContextualWisdomLab/wardnet`). ## 1. Executive summary @@ -23,11 +23,12 @@ No open PR may be treated as ready until its current head satisfies those exact ## 3. Open PR inventory -There are 14 other open PRs at this exact head, intentionally excluding this +There are 15 other open PRs at this exact head, intentionally excluding this baseline PR (`#130`) from the table below. | PR | Head | State | Exact-head evidence | Current next action | | --- | --- | --- | --- | --- | +| [#131](https://github.com/ContextualWisdomLab/wardnet/pull/131) | `66dbfd0cc3` | Blocked, current-head checks in progress | Fresh head pushed on 2026-08-30; `CI`, `CodeQL`, `Fuzz`, `Security Scan`, `Strix Security Scan`, `Required OpenCode Review`, and `Required Noema Review` are queued or in progress; independent review still required | Wait for the exact-head checks to finish, resolve any current findings, then obtain an independent approval | | [#129](https://github.com/ContextualWisdomLab/wardnet/pull/129) | `6eea1293bb` | Draft, intentionally blocked | Current exact head is intentionally RED: `noema-review`, `opencode-review`, and `strix` failed; no unresolved threads; independent review still required; must not be merged in this state | Keep the PR in draft, finish the remaining service/docs slices, then replace the intentionally red head with a green exact head before requesting approval | | [#127](https://github.com/ContextualWisdomLab/wardnet/pull/127) | `aa29565948` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | | [#126](https://github.com/ContextualWisdomLab/wardnet/pull/126) | `41d7ba9e8f` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | @@ -35,7 +36,7 @@ baseline PR (`#130`) from the table below. | [#114](https://github.com/ContextualWisdomLab/wardnet/pull/114) | `95da92339f` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | | [#112](https://github.com/ContextualWisdomLab/wardnet/pull/112) | `bab3c72bb7` | Blocked | No unresolved threads; some current-head hosted checks completed successfully, but the now-required `Strix Security Scan` result is absent, so the gate is not green; independent review still required | Re-run `Strix Security Scan` on the current head, then obtain an independent approval | | [#111](https://github.com/ContextualWisdomLab/wardnet/pull/111) | `43369a8801` | Blocked | No unresolved threads; all current hosted checks are green; independent review still required | Obtain an independent approval on the current head | -| [#95](https://github.com/ContextualWisdomLab/wardnet/pull/95) | `0e025945c4` | Blocked | `required-workflow-bootstrap`, `noema-review`, and `strix` failed on the current head; 7 unresolved review threads remain; no independent approval | Clear the current review threads, rerun current-head gates, then obtain approval | +| [#95](https://github.com/ContextualWisdomLab/wardnet/pull/95) | `fcf200b125` | Blocked | `required-workflow-bootstrap` and `noema-review` failed on the current head; `Strix Security Scan` also failed; 7 unresolved review threads remain; no independent approval | Clear the current review threads, rerun current-head gates, then obtain approval | | [#94](https://github.com/ContextualWisdomLab/wardnet/pull/94) | `d7fa9a16a7` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | | [#93](https://github.com/ContextualWisdomLab/wardnet/pull/93) | `b38feb9489` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | | [#90](https://github.com/ContextualWisdomLab/wardnet/pull/90) | `e316d4b08e` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | From 28fb359c648454896d0941a64520bd84779df661 Mon Sep 17 00:00:00 2001 From: OpenAI Codex Date: Sun, 30 Aug 2026 20:04:45 +0900 Subject: [PATCH 08/73] docs(gaps): refresh PR 131 exact-head status --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index cc1165ab..e1849241 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # Product and technical gap baseline -Snapshot date: 2026-08-30T18:57:50+09:00 (live exact-head GitHub inventory for `ContextualWisdomLab/wardnet`). +Snapshot date: 2026-08-30T20:10:00+09:00 (live exact-head GitHub inventory for `ContextualWisdomLab/wardnet`). ## 1. Executive summary @@ -28,7 +28,7 @@ baseline PR (`#130`) from the table below. | PR | Head | State | Exact-head evidence | Current next action | | --- | --- | --- | --- | --- | -| [#131](https://github.com/ContextualWisdomLab/wardnet/pull/131) | `66dbfd0cc3` | Blocked, current-head checks in progress | Fresh head pushed on 2026-08-30; `CI`, `CodeQL`, `Fuzz`, `Security Scan`, `Strix Security Scan`, `Required OpenCode Review`, and `Required Noema Review` are queued or in progress; independent review still required | Wait for the exact-head checks to finish, resolve any current findings, then obtain an independent approval | +| [#131](https://github.com/ContextualWisdomLab/wardnet/pull/131) | `82caad04c0` | Blocked, current-head checks in progress | Fresh head pushed on 2026-08-30; `CI`, `CodeQL`, `Fuzz`, `Security Scan`, `Strix Security Scan`, `Required OpenCode Review`, and `Required Noema Review` are queued or in progress on the new exact head; independent review still required | Wait for the exact-head checks to finish, resolve any current findings, then obtain an independent approval | | [#129](https://github.com/ContextualWisdomLab/wardnet/pull/129) | `6eea1293bb` | Draft, intentionally blocked | Current exact head is intentionally RED: `noema-review`, `opencode-review`, and `strix` failed; no unresolved threads; independent review still required; must not be merged in this state | Keep the PR in draft, finish the remaining service/docs slices, then replace the intentionally red head with a green exact head before requesting approval | | [#127](https://github.com/ContextualWisdomLab/wardnet/pull/127) | `aa29565948` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | | [#126](https://github.com/ContextualWisdomLab/wardnet/pull/126) | `41d7ba9e8f` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | From 4a1c626d691ae4fc2c5d12c386faf86b72d5d573 Mon Sep 17 00:00:00 2001 From: OpenAI Codex Date: Mon, 31 Aug 2026 03:16:31 +0900 Subject: [PATCH 09/73] docs(gaps): correct PR 95 gate evidence --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index e1849241..64740f6f 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -36,7 +36,7 @@ baseline PR (`#130`) from the table below. | [#114](https://github.com/ContextualWisdomLab/wardnet/pull/114) | `95da92339f` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | | [#112](https://github.com/ContextualWisdomLab/wardnet/pull/112) | `bab3c72bb7` | Blocked | No unresolved threads; some current-head hosted checks completed successfully, but the now-required `Strix Security Scan` result is absent, so the gate is not green; independent review still required | Re-run `Strix Security Scan` on the current head, then obtain an independent approval | | [#111](https://github.com/ContextualWisdomLab/wardnet/pull/111) | `43369a8801` | Blocked | No unresolved threads; all current hosted checks are green; independent review still required | Obtain an independent approval on the current head | -| [#95](https://github.com/ContextualWisdomLab/wardnet/pull/95) | `fcf200b125` | Blocked | `required-workflow-bootstrap` and `noema-review` failed on the current head; `Strix Security Scan` also failed; 7 unresolved review threads remain; no independent approval | Clear the current review threads, rerun current-head gates, then obtain approval | +| [#95](https://github.com/ContextualWisdomLab/wardnet/pull/95) | `304f053013` | Blocked | `required-workflow-bootstrap` failed on the current head; `Strix Security Scan` also failed; `opencode-review` did not produce a current-head verdict; 2 unresolved review threads remain; no independent approval | Clear the current review threads, rerun the current-head review gates, then obtain approval | | [#94](https://github.com/ContextualWisdomLab/wardnet/pull/94) | `d7fa9a16a7` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | | [#93](https://github.com/ContextualWisdomLab/wardnet/pull/93) | `b38feb9489` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | | [#90](https://github.com/ContextualWisdomLab/wardnet/pull/90) | `e316d4b08e` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | From e2c208dfad3ba4575fe749963621a110da70c801 Mon Sep 17 00:00:00 2001 From: OpenAI Codex Date: Mon, 31 Aug 2026 14:57:24 +0900 Subject: [PATCH 10/73] docs(gaps): refresh exact-head readiness baseline --- docs/product-technical-gap-baseline.md | 37 ++++++++++++++------------ 1 file changed, 20 insertions(+), 17 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 64740f6f..378bda2b 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,10 +1,10 @@ # Product and technical gap baseline -Snapshot date: 2026-08-30T20:10:00+09:00 (live exact-head GitHub inventory for `ContextualWisdomLab/wardnet`). +Snapshot date: 2026-08-31T14:25:00+09:00 (live exact-head GitHub inventory for `ContextualWisdomLab/wardnet`). ## 1. Executive summary -`main` is at commit `107117634764c901dff540044585d64088fafedb`. The product direction remains the Rust-first Wardnet gateway described in the current PRD/TRD and ADR set: +`main` is at commit `b2bcee3bf2c63f26c48e3be879e5349ef23fafcd`. The product direction remains the Rust-first Wardnet gateway described in the current PRD/TRD and ADR set: - PRD/TRD: [docs/superpowers/specs/2026-07-02-waf-ids-ai-soc-design.md](docs/superpowers/specs/2026-07-02-waf-ids-ai-soc-design.md), [docs/superpowers/specs/2026-07-02-commercial-sale-readiness-design.md](docs/superpowers/specs/2026-07-02-commercial-sale-readiness-design.md), and [docs/superpowers/specs/2026-07-02-program-completion-baseline-design.md](docs/superpowers/specs/2026-07-02-program-completion-baseline-design.md) - ADR: [docs/adr/0010-adaptive-contextual-orchestrator-default.md](docs/adr/0010-adaptive-contextual-orchestrator-default.md) @@ -23,25 +23,27 @@ No open PR may be treated as ready until its current head satisfies those exact ## 3. Open PR inventory -There are 15 other open PRs at this exact head, intentionally excluding this +There are 17 other open PRs at this exact head, intentionally excluding this baseline PR (`#130`) from the table below. | PR | Head | State | Exact-head evidence | Current next action | | --- | --- | --- | --- | --- | -| [#131](https://github.com/ContextualWisdomLab/wardnet/pull/131) | `82caad04c0` | Blocked, current-head checks in progress | Fresh head pushed on 2026-08-30; `CI`, `CodeQL`, `Fuzz`, `Security Scan`, `Strix Security Scan`, `Required OpenCode Review`, and `Required Noema Review` are queued or in progress on the new exact head; independent review still required | Wait for the exact-head checks to finish, resolve any current findings, then obtain an independent approval | +| [#135](https://github.com/ContextualWisdomLab/wardnet/pull/135) | `a9b88b9801` | Blocked | `opencode-review` and `strix` failed on the current head; 3 unresolved review threads remain; no independent approval | Resolve the current exact-head review findings, then rerun the external review gates and obtain an independent approval | +| [#134](https://github.com/ContextualWisdomLab/wardnet/pull/134) | `d98b9e25d7` | Behind | No unresolved review threads; prior hosted checks on 2026-08-30 were green except the required current-head `opencode-review` verdict; independent review still required | Rebase onto `main`, refresh current-head checks, then obtain an independent approval | +| [#131](https://github.com/ContextualWisdomLab/wardnet/pull/131) | `bcbb90132b` | Dirty | 1 unresolved review thread remains on the current head; merge conflicts with `main`; no independent approval | Rebase onto `main`, clear the remaining exact-head thread, rerun checks, then obtain an independent approval | | [#129](https://github.com/ContextualWisdomLab/wardnet/pull/129) | `6eea1293bb` | Draft, intentionally blocked | Current exact head is intentionally RED: `noema-review`, `opencode-review`, and `strix` failed; no unresolved threads; independent review still required; must not be merged in this state | Keep the PR in draft, finish the remaining service/docs slices, then replace the intentionally red head with a green exact head before requesting approval | -| [#127](https://github.com/ContextualWisdomLab/wardnet/pull/127) | `aa29565948` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | -| [#126](https://github.com/ContextualWisdomLab/wardnet/pull/126) | `41d7ba9e8f` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | +| [#127](https://github.com/ContextualWisdomLab/wardnet/pull/127) | `69884c95dd` | Blocked | No unresolved review threads; current head is blocked pending required review/gate outcomes; independent approval still required | Revalidate the current hosted gates, then obtain an independent approval | +| [#126](https://github.com/ContextualWisdomLab/wardnet/pull/126) | `5e00a3da49` | Blocked | No unresolved review threads; current head is blocked pending required review/gate outcomes; independent approval still required | Revalidate the current hosted gates, then obtain an independent approval | | [#115](https://github.com/ContextualWisdomLab/wardnet/pull/115) | `aad8224ab6` | Blocked | `opencode-review` and `strix` failed on the current head; no unresolved threads; independent review still required | Re-run the external review gates on a fresh head, then obtain approval | | [#114](https://github.com/ContextualWisdomLab/wardnet/pull/114) | `95da92339f` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | | [#112](https://github.com/ContextualWisdomLab/wardnet/pull/112) | `bab3c72bb7` | Blocked | No unresolved threads; some current-head hosted checks completed successfully, but the now-required `Strix Security Scan` result is absent, so the gate is not green; independent review still required | Re-run `Strix Security Scan` on the current head, then obtain an independent approval | -| [#111](https://github.com/ContextualWisdomLab/wardnet/pull/111) | `43369a8801` | Blocked | No unresolved threads; all current hosted checks are green; independent review still required | Obtain an independent approval on the current head | -| [#95](https://github.com/ContextualWisdomLab/wardnet/pull/95) | `304f053013` | Blocked | `required-workflow-bootstrap` failed on the current head; `Strix Security Scan` also failed; `opencode-review` did not produce a current-head verdict; 2 unresolved review threads remain; no independent approval | Clear the current review threads, rerun the current-head review gates, then obtain approval | -| [#94](https://github.com/ContextualWisdomLab/wardnet/pull/94) | `d7fa9a16a7` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | -| [#93](https://github.com/ContextualWisdomLab/wardnet/pull/93) | `b38feb9489` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | -| [#90](https://github.com/ContextualWisdomLab/wardnet/pull/90) | `e316d4b08e` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | -| [#88](https://github.com/ContextualWisdomLab/wardnet/pull/88) | `cbe21a11ab` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | -| [#77](https://github.com/ContextualWisdomLab/wardnet/pull/77) | `17cca73671` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | +| [#111](https://github.com/ContextualWisdomLab/wardnet/pull/111) | `d65d6cd178` | Blocked | 4 unresolved review threads remain on the current head; no independent approval | Resolve the current exact-head threads, then obtain an independent approval | +| [#95](https://github.com/ContextualWisdomLab/wardnet/pull/95) | `304f053013` | Dirty | `Strix Security Scan` failed; the current head also lacks a passing current-head `opencode-review` verdict; 2 unresolved review threads remain; no independent approval | Clear the current review threads, rerun the current-head review gates, then obtain approval | +| [#94](https://github.com/ContextualWisdomLab/wardnet/pull/94) | `0d2c4952ab` | Blocked | 7 unresolved review threads remain on the current head; no independent approval | Triage and resolve the current exact-head review threads before requesting refreshed gate runs or approval | +| [#93](https://github.com/ContextualWisdomLab/wardnet/pull/93) | `b0f4e1c4f2` | Blocked | No unresolved review threads; current head is blocked pending required review/gate outcomes; independent approval still required | Revalidate the current hosted gates, then obtain an independent approval | +| [#90](https://github.com/ContextualWisdomLab/wardnet/pull/90) | `8b13ba26c1` | Blocked | 2 unresolved review threads remain on the current head; no independent approval | Resolve the current exact-head review threads, then obtain an independent approval after gates are current | +| [#88](https://github.com/ContextualWisdomLab/wardnet/pull/88) | `e693a085b4` | Blocked | No unresolved review threads; current head is blocked pending required review/gate outcomes; independent approval still required | Revalidate the current hosted gates, then obtain an independent approval | +| [#77](https://github.com/ContextualWisdomLab/wardnet/pull/77) | `947394fcdc` | Blocked | 3 unresolved review threads remain on the current head; no independent approval | Resolve the current exact-head review threads, then obtain an independent approval | | [#72](https://github.com/ContextualWisdomLab/wardnet/pull/72) | `892f9277ba` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | ## 4. Open issue inventory @@ -63,11 +65,12 @@ Relative to the current PRD/TRD/ADR set, the main unproven or unmerged requireme - Proven-engine enforcement is still not merged to `main`, so Wardnet cannot yet truthfully claim in-path Coraza-backed enforcement on the protected branch. - PostgreSQL control-plane authority, tenant-isolated backup and restore, and transactional outbox durability are still in the open PR stack rather than on `main`. - The Wardnet rename is still incomplete on the protected branch; customer-facing and artifact-facing naming remains mixed until [#114](https://github.com/ContextualWisdomLab/wardnet/pull/114) lands. -- Exact-head hosted evidence is unstable for the highest-value stack: [#115](https://github.com/ContextualWisdomLab/wardnet/pull/115) currently has failing external review checks, and [#95](https://github.com/ContextualWisdomLab/wardnet/pull/95) still has multiple failed required workflows plus unresolved review threads on its current head. +- Exact-head hosted evidence is unstable for the highest-value stack: [#135](https://github.com/ContextualWisdomLab/wardnet/pull/135) currently has failing external review checks and unresolved threads on August 31, 2026, [#115](https://github.com/ContextualWisdomLab/wardnet/pull/115) still has failing external review checks, and [#95](https://github.com/ContextualWisdomLab/wardnet/pull/95) remains conflicted with failed required workflows plus unresolved review threads on its current head. - Commercial-readiness proof remains incomplete for release promotion, telemetry/SLO evidence, accessibility/screenshot evidence, and customer-facing production-readiness packaging. ## 6. Next-step order -1. Land the exact-head review and hosted-check fixes on [#95](https://github.com/ContextualWisdomLab/wardnet/pull/95) and [#115](https://github.com/ContextualWisdomLab/wardnet/pull/115) without bypassing branch protection. -2. Merge blocked-but-clean documentation and rename PRs only after they receive an independent approval on their current heads. -3. Convert the remaining commercial-readiness gaps into reviewable PRs with runnable evidence, prioritizing production-readiness proof over broad scope expansion. +1. Land the exact-head review and hosted-check fixes on [#135](https://github.com/ContextualWisdomLab/wardnet/pull/135), [#95](https://github.com/ContextualWisdomLab/wardnet/pull/95), and [#115](https://github.com/ContextualWisdomLab/wardnet/pull/115) without bypassing branch protection. +2. Rebase the behind-but-clean branches such as [#134](https://github.com/ContextualWisdomLab/wardnet/pull/134) and this baseline PR so current-head required workflows can rerun against `main`. +3. Merge blocked-but-clean documentation and rename PRs only after they receive an independent approval on their current heads. +4. Convert the remaining commercial-readiness gaps into reviewable PRs with runnable evidence, prioritizing production-readiness proof over broad scope expansion. From 2cafcd973cdbf861ca5af671f03176bf9904d997 Mon Sep 17 00:00:00 2001 From: OpenAI Codex Date: Mon, 31 Aug 2026 21:52:05 +0900 Subject: [PATCH 11/73] docs(gaps): fix baseline spec links --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 378bda2b..9e6c1b63 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -6,8 +6,8 @@ Snapshot date: 2026-08-31T14:25:00+09:00 (live exact-head GitHub inventory for ` `main` is at commit `b2bcee3bf2c63f26c48e3be879e5349ef23fafcd`. The product direction remains the Rust-first Wardnet gateway described in the current PRD/TRD and ADR set: -- PRD/TRD: [docs/superpowers/specs/2026-07-02-waf-ids-ai-soc-design.md](docs/superpowers/specs/2026-07-02-waf-ids-ai-soc-design.md), [docs/superpowers/specs/2026-07-02-commercial-sale-readiness-design.md](docs/superpowers/specs/2026-07-02-commercial-sale-readiness-design.md), and [docs/superpowers/specs/2026-07-02-program-completion-baseline-design.md](docs/superpowers/specs/2026-07-02-program-completion-baseline-design.md) -- ADR: [docs/adr/0010-adaptive-contextual-orchestrator-default.md](docs/adr/0010-adaptive-contextual-orchestrator-default.md) +- PRD/TRD: [superpowers/specs/2026-07-02-waf-ids-ai-soc-design.md](superpowers/specs/2026-07-02-waf-ids-ai-soc-design.md), [superpowers/specs/2026-07-02-commercial-sale-readiness-design.md](superpowers/specs/2026-07-02-commercial-sale-readiness-design.md), and [superpowers/specs/2026-07-02-program-completion-baseline-design.md](superpowers/specs/2026-07-02-program-completion-baseline-design.md) +- ADR: [adr/0010-adaptive-contextual-orchestrator-default.md](adr/0010-adaptive-contextual-orchestrator-default.md) Commercial-readiness progress is real, but protected-branch evidence does not yet support a merge-ready claim for the open delivery stack. The current blockers are not hypothetical: they are live GitHub branch-protection requirements, unresolved review findings on the exact current heads, and missing independent approval. From 8472b54e3dc83a690ef9302ee883f0bf5ffd2990 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 13:31:53 +0900 Subject: [PATCH 12/73] docs(gaps): track artifact admission DDD boundary --- docs/product-technical-gap-baseline.md | 31 +++++++++++++++++++++----- 1 file changed, 26 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 9e6c1b63..7d2d154e 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -2,6 +2,8 @@ Snapshot date: 2026-08-31T14:25:00+09:00 (live exact-head GitHub inventory for `ContextualWisdomLab/wardnet`). +> The inventory table in section 3 is the dated snapshot above, not a perpetual live-status claim. Section 1.1 records targeted later evidence without rewriting unrelated PR states from stale observations. + ## 1. Executive summary `main` is at commit `b2bcee3bf2c63f26c48e3be879e5349ef23fafcd`. The product direction remains the Rust-first Wardnet gateway described in the current PRD/TRD and ADR set: @@ -11,6 +13,21 @@ Snapshot date: 2026-08-31T14:25:00+09:00 (live exact-head GitHub inventory for ` Commercial-readiness progress is real, but protected-branch evidence does not yet support a merge-ready claim for the open delivery stack. The current blockers are not hypothetical: they are live GitHub branch-protection requirements, unresolved review findings on the exact current heads, and missing independent approval. +### 1.1 Targeted DDD and Agent Artifact Admission refresh — 2026-09-01 + +PR [#129](https://github.com/ContextualWisdomLab/wardnet/pull/129) now treats **Agent Artifact Admission** as a distinct bounded context inside Wardnet's Security Admission subdomain. Its current responsibility-aligned path is `crates/agent-artifact-admission`, rather than a generic `security`, `services`, `utils`, `common`, or `shared` dumping directory. ADR-0012 and the context map define its Ubiquitous Language, ownership and Anti-Corruption Layer boundaries, while `tests/ddd_architecture_contract.rs` rejects outward dependencies from `admission.rs`/`policy.rs` into Axum, Tokio, filesystem/listener/configuration concerns or concrete audit adapters. + +The context currently owns structured `InstallIntent`, reviewed `AdmissionPolicy`, deterministic allow/block evaluation, minimized admission audit facts, and the loopback-only delivery boundary. It explicitly does **not** own package execution/sandboxing, package discovery, Sigstore/TUF/SLSA provider schemas, model orchestration, SIEM projection, or organization-wide workflow/credential authority. Those responsibilities cross only through published contracts or future explicit adapters/Anti-Corruption Layers. + +The authenticated `/healthz`, `/v1/policy`, and `/v1/admissions` service, audit-before-response semantics, fail-closed audit outage behavior, OpenAPI contract, context-specific threat model, operations runbook, and standards/APA-7 traceability are implemented on the active PR branch. They are **not protected-main truth until #129 merges**. The exact #129 head observed for this targeted refresh is `ee495f4e90037c3255fc7ec2f8278f1147a485a7`; its repository CI/SAST/Security/Fuzz runs were queued at observation time and therefore non-passing. + +DDD fitness also exposes two explicit follow-ups rather than cosmetic refactors: + +- `audit.rs` currently contains both the audit contract and the single local file adapter. ADR-0012 deliberately permits this while there is only one concrete backend; adding a second persistence backend is the trigger to split the port from adapters. Splitting it now would add structure without an independently evolving responsibility. +- Wardnet's legacy gateway remains concentrated in a very large root `src/lib.rs` with multiple security concerns. File size alone is not proof that a service split is correct, but it is a monolith-growth signal. Before further broad feature expansion, map its stable responsibilities into bounded contexts, add dependency/ownership fitness tests, and move only responsibility-coherent modules. Prefer a modular monolith unless transaction, deployment, reuse, or policy-lifecycle evidence justifies a separate deployable. + +This PR (#130) remains the canonical owner for `docs/product-technical-gap-baseline.md`; #129 must not create a competing copy of this document. + ## 2. Protected-branch gate Organization ruleset `18156473` currently requires: @@ -31,7 +48,7 @@ baseline PR (`#130`) from the table below. | [#135](https://github.com/ContextualWisdomLab/wardnet/pull/135) | `a9b88b9801` | Blocked | `opencode-review` and `strix` failed on the current head; 3 unresolved review threads remain; no independent approval | Resolve the current exact-head review findings, then rerun the external review gates and obtain an independent approval | | [#134](https://github.com/ContextualWisdomLab/wardnet/pull/134) | `d98b9e25d7` | Behind | No unresolved review threads; prior hosted checks on 2026-08-30 were green except the required current-head `opencode-review` verdict; independent review still required | Rebase onto `main`, refresh current-head checks, then obtain an independent approval | | [#131](https://github.com/ContextualWisdomLab/wardnet/pull/131) | `bcbb90132b` | Dirty | 1 unresolved review thread remains on the current head; merge conflicts with `main`; no independent approval | Rebase onto `main`, clear the remaining exact-head thread, rerun checks, then obtain an independent approval | -| [#129](https://github.com/ContextualWisdomLab/wardnet/pull/129) | `6eea1293bb` | Draft, intentionally blocked | Current exact head is intentionally RED: `noema-review`, `opencode-review`, and `strix` failed; no unresolved threads; independent review still required; must not be merged in this state | Keep the PR in draft, finish the remaining service/docs slices, then replace the intentionally red head with a green exact head before requesting approval | +| [#129](https://github.com/ContextualWisdomLab/wardnet/pull/129) | `6eea1293bb` | Draft, intentionally blocked | Historical 2026-08-31 snapshot: the then-current head was intentionally RED and lacked independent review. See section 1.1 for the newer targeted #129 evidence. | Keep Draft until the unchanged current head is gate-clean and independently approved; do not transfer evidence from this historical head | | [#127](https://github.com/ContextualWisdomLab/wardnet/pull/127) | `69884c95dd` | Blocked | No unresolved review threads; current head is blocked pending required review/gate outcomes; independent approval still required | Revalidate the current hosted gates, then obtain an independent approval | | [#126](https://github.com/ContextualWisdomLab/wardnet/pull/126) | `5e00a3da49` | Blocked | No unresolved review threads; current head is blocked pending required review/gate outcomes; independent approval still required | Revalidate the current hosted gates, then obtain an independent approval | | [#115](https://github.com/ContextualWisdomLab/wardnet/pull/115) | `aad8224ab6` | Blocked | `opencode-review` and `strix` failed on the current head; no unresolved threads; independent review still required | Re-run the external review gates on a fresh head, then obtain approval | @@ -62,15 +79,19 @@ There are 16 open issues. The highest-impact live backlog items are: Relative to the current PRD/TRD/ADR set, the main unproven or unmerged requirements are: +- Agent Artifact Admission is implemented only on active PR #129. Until its exact head passes the live repository and organization gates and merges, protected `main` does not provide this pre-execution package-install admission control. - Proven-engine enforcement is still not merged to `main`, so Wardnet cannot yet truthfully claim in-path Coraza-backed enforcement on the protected branch. - PostgreSQL control-plane authority, tenant-isolated backup and restore, and transactional outbox durability are still in the open PR stack rather than on `main`. - The Wardnet rename is still incomplete on the protected branch; customer-facing and artifact-facing naming remains mixed until [#114](https://github.com/ContextualWisdomLab/wardnet/pull/114) lands. - Exact-head hosted evidence is unstable for the highest-value stack: [#135](https://github.com/ContextualWisdomLab/wardnet/pull/135) currently has failing external review checks and unresolved threads on August 31, 2026, [#115](https://github.com/ContextualWisdomLab/wardnet/pull/115) still has failing external review checks, and [#95](https://github.com/ContextualWisdomLab/wardnet/pull/95) remains conflicted with failed required workflows plus unresolved review threads on its current head. - Commercial-readiness proof remains incomplete for release promotion, telemetry/SLO evidence, accessibility/screenshot evidence, and customer-facing production-readiness packaging. +- The root gateway module remains a DDD fitness risk because multiple stable security responsibilities still accumulate under the legacy root `src` boundary. The next structural step is responsibility mapping and machine-checkable dependency/ownership constraints, not a mechanical folder shuffle or premature microservice split. ## 6. Next-step order -1. Land the exact-head review and hosted-check fixes on [#135](https://github.com/ContextualWisdomLab/wardnet/pull/135), [#95](https://github.com/ContextualWisdomLab/wardnet/pull/95), and [#115](https://github.com/ContextualWisdomLab/wardnet/pull/115) without bypassing branch protection. -2. Rebase the behind-but-clean branches such as [#134](https://github.com/ContextualWisdomLab/wardnet/pull/134) and this baseline PR so current-head required workflows can rerun against `main`. -3. Merge blocked-but-clean documentation and rename PRs only after they receive an independent approval on their current heads. -4. Convert the remaining commercial-readiness gaps into reviewable PRs with runnable evidence, prioritizing production-readiness proof over broad scope expansion. +1. Finish Agent Artifact Admission #129 as one coherent Security Admission bounded context, keeping its domain kernel independent of delivery/infrastructure and requiring unchanged exact-head gates plus independent approval before Ready/merge. +2. Land the exact-head review and hosted-check fixes on [#135](https://github.com/ContextualWisdomLab/wardnet/pull/135), [#95](https://github.com/ContextualWisdomLab/wardnet/pull/95), and [#115](https://github.com/ContextualWisdomLab/wardnet/pull/115) without bypassing branch protection. +3. Rebase the behind-but-clean branches such as [#134](https://github.com/ContextualWisdomLab/wardnet/pull/134) and this baseline PR so current-head required workflows can rerun against `main`. +4. Merge blocked-but-clean documentation and rename PRs only after they receive an independent approval on their current heads. +5. Map the legacy gateway's stable responsibilities into bounded contexts and add architecture fitness tests before another large feature expansion; extract modules only when ownership/reuse/transaction/deployment evidence supports the move. +6. Convert the remaining commercial-readiness gaps into reviewable PRs with runnable evidence, prioritizing production-readiness proof over broad scope expansion. From 816e367016fbc56c25bcb07ffd5dee264c4d80ac Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 19:16:29 +0900 Subject: [PATCH 13/73] docs(gaps): refresh live Wardnet commercial baseline --- docs/product-technical-gap-baseline.md | 123 +++++++++++-------------- 1 file changed, 55 insertions(+), 68 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 7d2d154e..a889c56f 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,97 +1,84 @@ # Product and technical gap baseline -Snapshot date: 2026-08-31T14:25:00+09:00 (live exact-head GitHub inventory for `ContextualWisdomLab/wardnet`). +Snapshot date: 2026-09-01T19:15:00+09:00. This is a dated GitHub inventory for `ContextualWisdomLab/wardnet`; every later execution must refetch live heads, bases, checks, rules and releases instead of treating this file as a scheduler cache. -> The inventory table in section 3 is the dated snapshot above, not a perpetual live-status claim. Section 1.1 records targeted later evidence without rewriting unrelated PR states from stale observations. +## Product boundary -## 1. Executive summary +Wardnet is the Rust-first gateway/SOC control plane and owns Gateway, Admission Policy, Artifact Identity, Security Analysis Integration, Network-Egress, SOC Evidence, Runtime Control, and Audit-Provenance responsibilities. The Agent Artifact Admission Controller is a separate bounded context inside Wardnet's Security Admission subdomain. -`main` is at commit `b2bcee3bf2c63f26c48e3be879e5349ef23fafcd`. The product direction remains the Rust-first Wardnet gateway described in the current PRD/TRD and ADR set: +Quarantine Sandbox Runtime owns hostile-workload execution isolation. `contextual-orchestrator` owns Agent/LLM orchestration. EgressWeave is the outbound HTTP-policy candidate. Wardnet consumes those capabilities through versioned ports and Anti-Corruption Layers; it must not copy their implementations or access their application databases. -- PRD/TRD: [superpowers/specs/2026-07-02-waf-ids-ai-soc-design.md](superpowers/specs/2026-07-02-waf-ids-ai-soc-design.md), [superpowers/specs/2026-07-02-commercial-sale-readiness-design.md](superpowers/specs/2026-07-02-commercial-sale-readiness-design.md), and [superpowers/specs/2026-07-02-program-completion-baseline-design.md](superpowers/specs/2026-07-02-program-completion-baseline-design.md) -- ADR: [adr/0010-adaptive-contextual-orchestrator-default.md](adr/0010-adaptive-contextual-orchestrator-default.md) +`context-graph-contracts` is the provider-neutral Context Fabric Shared Kernel for canonical references, authority, truth status/origin, valid/system time, provenance, Context Assertion, CloudEvents/schema/conformance/admission. `enterprise-architecture-core` is the Enterprise Architecture Decision Plane. While the dedicated Context Fabric writer is active, Wardnet treats both repositories as read-only source dependencies and forwards exact architecture/contract evidence through their owner path. Security findings, alerts, malware verdicts, artifact risk scores, prompts, and customer/runtime data do not become authoritative EA facts. -Commercial-readiness progress is real, but protected-branch evidence does not yet support a merge-ready claim for the open delivery stack. The current blockers are not hypothetical: they are live GitHub branch-protection requirements, unresolved review findings on the exact current heads, and missing independent approval. +## Protected truth and governance -### 1.1 Targeted DDD and Agent Artifact Admission refresh — 2026-09-01 +Protected/default `main` is `b2bcee3bf2c63f26c48e3be879e5349ef23fafcd` at this snapshot. There are no Wardnet GitHub releases. -PR [#129](https://github.com/ContextualWisdomLab/wardnet/pull/129) now treats **Agent Artifact Admission** as a distinct bounded context inside Wardnet's Security Admission subdomain. Its current responsibility-aligned path is `crates/agent-artifact-admission`, rather than a generic `security`, `services`, `utils`, `common`, or `shared` dumping directory. ADR-0012 and the context map define its Ubiquitous Language, ownership and Anti-Corruption Layer boundaries, while `tests/ddd_architecture_contract.rs` rejects outward dependencies from `admission.rs`/`policy.rs` into Axum, Tokio, filesystem/listener/configuration concerns or concrete audit adapters. +Organization ruleset `18156473` targets `~DEFAULT_BRANCH`. Its pull-request rule currently requires one approving review, dismisses stale approvals, requires conversation resolution, has no named required reviewer/team, no code-owner review requirement, and no last-push approval requirement. It also requires central workflow evidence for review, scheduling, security, Strix, Semgrep, and Noema plus deletion/non-fast-forward protection. -The context currently owns structured `InstallIntent`, reviewed `AdmissionPolicy`, deterministic allow/block evaluation, minimized admission audit facts, and the loopback-only delivery boundary. It explicitly does **not** own package execution/sandboxing, package discovery, Sigstore/TUF/SLSA provider schemas, model orchestration, SIEM projection, or organization-wide workflow/credential authority. Those responsibilities cross only through published contracts or future explicit adapters/Anti-Corruption Layers. +The bare approval-count requirement is structurally inconsistent with the declared solo-maintainer operating model when no eligible independent human exists. That is a central `.github` governance defect, not a Wardnet product gap and not a request to invent a human reviewer. Self-approval and bot/model-as-human approval remain forbidden. Central owner path `.github#772` has current Wardnet evidence and must repair only the unsatisfiable approval-count condition while preserving deterministic workflow/security/coverage/package/SBOM/provenance/thread/branch-integrity gates. -The authenticated `/healthz`, `/v1/policy`, and `/v1/admissions` service, audit-before-response semantics, fail-closed audit outage behavior, OpenAPI contract, context-specific threat model, operations runbook, and standards/APA-7 traceability are implemented on the active PR branch. They are **not protected-main truth until #129 merges**. The exact #129 head observed for this targeted refresh is `ee495f4e90037c3255fc7ec2f8278f1147a485a7`; its repository CI/SAST/Security/Fuzz runs were queued at observation time and therefore non-passing. +Current central Actions capacity is also a control-plane dependency. Multiple unchanged Wardnet heads have required jobs queued before execution. `.github#1531` has exact Wardnet queue evidence and must reduce the self-amplifying/obsolete queue at the central owner boundary. Queue starvation is non-passing evidence, but it is not a reason to mutate clean Wardnet source or stop independent Wardnet work. -DDD fitness also exposes two explicit follow-ups rather than cosmetic refactors: +## Live delivery queue -- `audit.rs` currently contains both the audit contract and the single local file adapter. ADR-0012 deliberately permits this while there is only one concrete backend; adding a second persistence backend is the trigger to split the port from adapters. Splitting it now would add structure without an independently evolving responsibility. -- Wardnet's legacy gateway remains concentrated in a very large root `src/lib.rs` with multiple security concerns. File size alone is not proof that a service split is correct, but it is a monolith-growth signal. Before further broad feature expansion, map its stable responsibilities into bounded contexts, add dependency/ownership fitness tests, and move only responsibility-coherent modules. Prefer a modular monolith unless transaction, deployment, reuse, or policy-lifecycle evidence justifies a separate deployable. +The fresh inventory contains 20 open PRs including this baseline PR. PR #94 was closed as superseded after its one unique issue-#78 doctoring artifact was ported to the clean successor #138. The remaining queue is: -This PR (#130) remains the canonical owner for `docs/product-technical-gap-baseline.md`; #129 must not create a competing copy of this document. +`#77, #88, #90, #93, #95, #111, #112, #114, #115, #126, #127, #129, #130, #131, #134, #135, #136, #137, #138, #140`. -## 2. Protected-branch gate +Key exact-current candidates verified during this refresh: -Organization ruleset `18156473` currently requires: +| PR | Exact head | Current classification | Evidence / next causal action | +| --- | --- | --- | --- | +| #129 Agent Artifact Admission | `3a23772b3ae56097d0e9d78333a1ceeaeb21a104` | Draft, ahead of main with `behind_by=0` | Predecessor CI failed only at `cargo fmt --check`; the three exact formatting defects were repaired on the current branch. Fresh CI/Fuzz/Security/SAST runs exist but are queued and therefore non-passing. Inline review threads are resolved. Keep Draft until the unchanged head is fully gate-clean. | +| #138 fail-closed management auth | `efca66ab86d9f8ec6cfd7e48d3471effd437df15` | Ready, mergeable | Clean successor for issue #78. It now also carries the preserved APA-7 doctoring artifact from superseded #94. Its new exact-head gates must complete before merge. | +| #140 runtime configuration snapshot | `7a5b41006b75485f0d09307be5697ed3501e856d` | Ready, mergeable | Current review threads are resolved, including secret/non-secret configuration ownership. Exact-current-head repository workflows were queued at the latest read. | +| #137 external administrator Secret boundary | `60805269e0a7406f5d32ad65a09b2f0c31027196` | Ready, mergeable | Repository CI/Security/SAST jobs were still queued before execution at the latest read. | +| #136 outbound destination hardening | `0af75ab614442cba43782d5e9edcd1ee9606a4a8` | Ready, mergeable | Repository CI/Fuzz/Security/SAST are terminal GREEN and inline findings are resolved. Central required OpenCode review remains queued with no executed steps; #79 remains only partially implemented because full versioned allowlist/deny-precedence and complete connector-policy acceptance are still open. | +| #135 bounded local limiter | `49abdd807aed0fd21310424ddfcb8200ec1dfd34` | Ready, mergeable | Repository CI/Fuzz/Security/SAST are terminal GREEN and current inline threads are resolved. Central governance/review evidence remains separate. | +| #134 support-bundle regression | `2193bfda7601eba9754b1783a7669077bb7efbc2` | Ready, mergeable | The stale shutdown title/body was corrected. The actual one-file delta binds support-bundle counts to KPI/evidence-manifest counts and asserts the administrator secret is absent. Repository CI/Fuzz/Security/SAST are GREEN; central gates remain. | +| #77 pinned Rust toolchain | `d30de04d717204373c643a1dd209cdcccc707391` | Ready, mergeable | Repository CI/Security/SAST are GREEN and inline findings are resolved. Auto-merge is enabled, but normal merge remains subject to the repaired live organization policy and current central required workflows. | -- 1 independent approving review -- resolved review threads -- required workflows for `Close Empty PR`, `Required OpenCode Review`, `Required PR Review Merge Scheduler`, `Security Scan`, `Strix Security Scan`, `SAST Semgrep`, and `Required Noema Review` +Do not transfer checks/reviews across a head, base, retarget, restack, or replacement PR. `queued`, `pending`, `skipped`, `cancelled`, `absent`, stale, predecessor-head, status-only, model-only, or synthetic evidence is non-passing. -No open PR may be treated as ready until its current head satisfies those exact rules. +## Open issues -## 3. Open PR inventory +There are 17 open issues at this snapshot: `#11, #38, #74, #75, #78, #79, #80, #81, #82, #83, #84, #85, #86, #87, #89, #128, #139`. -There are 17 other open PRs at this exact head, intentionally excluding this -baseline PR (`#130`) from the table below. +The production-risk order remains: -| PR | Head | State | Exact-head evidence | Current next action | -| --- | --- | --- | --- | --- | -| [#135](https://github.com/ContextualWisdomLab/wardnet/pull/135) | `a9b88b9801` | Blocked | `opencode-review` and `strix` failed on the current head; 3 unresolved review threads remain; no independent approval | Resolve the current exact-head review findings, then rerun the external review gates and obtain an independent approval | -| [#134](https://github.com/ContextualWisdomLab/wardnet/pull/134) | `d98b9e25d7` | Behind | No unresolved review threads; prior hosted checks on 2026-08-30 were green except the required current-head `opencode-review` verdict; independent review still required | Rebase onto `main`, refresh current-head checks, then obtain an independent approval | -| [#131](https://github.com/ContextualWisdomLab/wardnet/pull/131) | `bcbb90132b` | Dirty | 1 unresolved review thread remains on the current head; merge conflicts with `main`; no independent approval | Rebase onto `main`, clear the remaining exact-head thread, rerun checks, then obtain an independent approval | -| [#129](https://github.com/ContextualWisdomLab/wardnet/pull/129) | `6eea1293bb` | Draft, intentionally blocked | Historical 2026-08-31 snapshot: the then-current head was intentionally RED and lacked independent review. See section 1.1 for the newer targeted #129 evidence. | Keep Draft until the unchanged current head is gate-clean and independently approved; do not transfer evidence from this historical head | -| [#127](https://github.com/ContextualWisdomLab/wardnet/pull/127) | `69884c95dd` | Blocked | No unresolved review threads; current head is blocked pending required review/gate outcomes; independent approval still required | Revalidate the current hosted gates, then obtain an independent approval | -| [#126](https://github.com/ContextualWisdomLab/wardnet/pull/126) | `5e00a3da49` | Blocked | No unresolved review threads; current head is blocked pending required review/gate outcomes; independent approval still required | Revalidate the current hosted gates, then obtain an independent approval | -| [#115](https://github.com/ContextualWisdomLab/wardnet/pull/115) | `aad8224ab6` | Blocked | `opencode-review` and `strix` failed on the current head; no unresolved threads; independent review still required | Re-run the external review gates on a fresh head, then obtain approval | -| [#114](https://github.com/ContextualWisdomLab/wardnet/pull/114) | `95da92339f` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | -| [#112](https://github.com/ContextualWisdomLab/wardnet/pull/112) | `bab3c72bb7` | Blocked | No unresolved threads; some current-head hosted checks completed successfully, but the now-required `Strix Security Scan` result is absent, so the gate is not green; independent review still required | Re-run `Strix Security Scan` on the current head, then obtain an independent approval | -| [#111](https://github.com/ContextualWisdomLab/wardnet/pull/111) | `d65d6cd178` | Blocked | 4 unresolved review threads remain on the current head; no independent approval | Resolve the current exact-head threads, then obtain an independent approval | -| [#95](https://github.com/ContextualWisdomLab/wardnet/pull/95) | `304f053013` | Dirty | `Strix Security Scan` failed; the current head also lacks a passing current-head `opencode-review` verdict; 2 unresolved review threads remain; no independent approval | Clear the current review threads, rerun the current-head review gates, then obtain approval | -| [#94](https://github.com/ContextualWisdomLab/wardnet/pull/94) | `0d2c4952ab` | Blocked | 7 unresolved review threads remain on the current head; no independent approval | Triage and resolve the current exact-head review threads before requesting refreshed gate runs or approval | -| [#93](https://github.com/ContextualWisdomLab/wardnet/pull/93) | `b0f4e1c4f2` | Blocked | No unresolved review threads; current head is blocked pending required review/gate outcomes; independent approval still required | Revalidate the current hosted gates, then obtain an independent approval | -| [#90](https://github.com/ContextualWisdomLab/wardnet/pull/90) | `8b13ba26c1` | Blocked | 2 unresolved review threads remain on the current head; no independent approval | Resolve the current exact-head review threads, then obtain an independent approval after gates are current | -| [#88](https://github.com/ContextualWisdomLab/wardnet/pull/88) | `e693a085b4` | Blocked | No unresolved review threads; current head is blocked pending required review/gate outcomes; independent approval still required | Revalidate the current hosted gates, then obtain an independent approval | -| [#77](https://github.com/ContextualWisdomLab/wardnet/pull/77) | `947394fcdc` | Blocked | 3 unresolved review threads remain on the current head; no independent approval | Resolve the current exact-head review threads, then obtain an independent approval | -| [#72](https://github.com/ContextualWisdomLab/wardnet/pull/72) | `892f9277ba` | Blocked | `strix` failed on the current head; no unresolved threads; independent review still required | Wait for a current-head Strix verdict and an independent approval | +1. **Immediate exposure controls:** #78 fail-closed management auth, #79 fail-closed destination policy, #11 real attack-path CI, and the deployment credential boundary represented by #137/#75. +2. **Security admission:** #128 Agent Artifact Admission; protected `main` cannot claim this control until #129 integrates. +3. **Durable authority and effects:** #80 PostgreSQL production authority and tenant isolation, then #81 transactional outbox/leased workers. +4. **Identity and overload:** #82 Keyverse-backed identity/authorization/approval and #83 distributed/global admission authority with bounded local protection. +5. **Proven security engines:** #86 Coraza/CRS and Suricata production enforcement with reproducible false-positive/detection evidence. +6. **Immutable delivery and operation:** #84 signed/SBOM/provenance release promotion and rollback, then #85 OpenTelemetry/SLO/incident/restore evidence. +7. **Supporting correctness:** #74 deterministic persistence-failure testing, #77 pinned compiler, #139 coherent runtime configuration boundary, and #75 post-hardening Kubernetes filename migration. -## 4. Open issue inventory +Issues #78, #74, #89, #128, #139 have active implementation PRs. Do not close them from predecessor evidence; close only after the owning protected merge satisfies the issue acceptance contract. -There are 16 open issues. The highest-impact live backlog items are: +## DDD and implementation gaps -- [#128](https://github.com/ContextualWisdomLab/wardnet/issues/128): gate AI-agent package installation against untrusted `llms.txt` and web instructions -- [#87](https://github.com/ContextualWisdomLab/wardnet/issues/87): close the evidence-backed production readiness gate -- [#86](https://github.com/ContextualWisdomLab/wardnet/issues/86): put proven WAF/IDS engines in the enforcement path and publish detection-quality evidence -- [#85](https://github.com/ContextualWisdomLab/wardnet/issues/85): establish production telemetry, SLOs, incident response, and disaster-recovery evidence -- [#84](https://github.com/ContextualWisdomLab/wardnet/issues/84): complete immutable signed release, promotion, and rollback evidence -- [#83](https://github.com/ContextualWisdomLab/wardnet/issues/83): add bounded admission control and trusted client attribution -- [#82](https://github.com/ContextualWisdomLab/wardnet/issues/82): integrate Keyverse identity and tenant authorization evidence +Agent Artifact Admission has a responsibility-aligned crate under `crates/agent-artifact-admission` with domain-policy independence tests. The legacy gateway remains concentrated in the root `src/lib.rs`. File size by itself is not a service boundary, but current work repeatedly touches client attribution, outbound policy, runtime configuration, proxying, SOC integration, rate limiting, support evidence, and management APIs in the same module. The next structural work must add responsibility/dependency fitness before moving code and should favor a modular monolith until transaction, deployment, scaling, or reuse evidence justifies a separate deployable. -## 5. Product gaps against current requirements +PR #140 is the current coherent migration for the non-secret Runtime Configuration supporting subdomain. `CredentialRegistry` remains the secret-bearing bootstrap owner. New direct process-environment reads outside the approved bootstrap adapters are architectural defects. -Relative to the current PRD/TRD/ADR set, the main unproven or unmerged requirements are: +Network-Egress remains incomplete even after #136: the current slice closes literal/private/reserved destinations, ambient proxies, redirects, DNS rebinding through validated-address pinning, and related parsing bypasses. Issue #79 still requires a reusable versioned policy with hostname/suffix/IP/CIDR/scheme/port allowlists, deterministic deny-overrides precedence, complete connector parity, decision evidence, and operator migration/rollback/diagnostics. Do not claim #79 closed from #136 alone. -- Agent Artifact Admission is implemented only on active PR #129. Until its exact head passes the live repository and organization gates and merges, protected `main` does not provide this pre-execution package-install admission control. -- Proven-engine enforcement is still not merged to `main`, so Wardnet cannot yet truthfully claim in-path Coraza-backed enforcement on the protected branch. -- PostgreSQL control-plane authority, tenant-isolated backup and restore, and transactional outbox durability are still in the open PR stack rather than on `main`. -- The Wardnet rename is still incomplete on the protected branch; customer-facing and artifact-facing naming remains mixed until [#114](https://github.com/ContextualWisdomLab/wardnet/pull/114) lands. -- Exact-head hosted evidence is unstable for the highest-value stack: [#135](https://github.com/ContextualWisdomLab/wardnet/pull/135) currently has failing external review checks and unresolved threads on August 31, 2026, [#115](https://github.com/ContextualWisdomLab/wardnet/pull/115) still has failing external review checks, and [#95](https://github.com/ContextualWisdomLab/wardnet/pull/95) remains conflicted with failed required workflows plus unresolved review threads on its current head. -- Commercial-readiness proof remains incomplete for release promotion, telemetry/SLO evidence, accessibility/screenshot evidence, and customer-facing production-readiness packaging. -- The root gateway module remains a DDD fitness risk because multiple stable security responsibilities still accumulate under the legacy root `src` boundary. The next structural step is responsibility mapping and machine-checkable dependency/ownership constraints, not a mechanical folder shuffle or premature microservice split. +## Quality, security, and release gates -## 6. Next-step order +Wardnet-owned production code targets 100% statement and branch coverage and complete public rustdoc/docstrings. Security-critical changes require hostile/bypass/replay/race/DoS/network/cleanup tests and current-source verification of every review finding. Coverage exclusions, source rewriting, skipped required paths, or green statuses bound to a different revision are not acceptable evidence. -1. Finish Agent Artifact Admission #129 as one coherent Security Admission bounded context, keeping its domain kernel independent of delivery/infrastructure and requiring unchanged exact-head gates plus independent approval before Ready/merge. -2. Land the exact-head review and hosted-check fixes on [#135](https://github.com/ContextualWisdomLab/wardnet/pull/135), [#95](https://github.com/ContextualWisdomLab/wardnet/pull/95), and [#115](https://github.com/ContextualWisdomLab/wardnet/pull/115) without bypassing branch protection. -3. Rebase the behind-but-clean branches such as [#134](https://github.com/ContextualWisdomLab/wardnet/pull/134) and this baseline PR so current-head required workflows can rerun against `main`. -4. Merge blocked-but-clean documentation and rename PRs only after they receive an independent approval on their current heads. -5. Map the legacy gateway's stable responsibilities into bounded contexts and add architecture fitness tests before another large feature expansion; extract modules only when ownership/reuse/transaction/deployment evidence supports the move. -6. Convert the remaining commercial-readiness gaps into reviewable PRs with runnable evidence, prioritizing production-readiness proof over broad scope expansion. +Material architecture/security decisions must retain current NIST/OWASP/CWE/OCI/Linux/IETF or other authoritative primary standards and relevant peer-reviewed research in APA 7 traceability. Provider/vendor schemas stay behind adapters; research or scanner output does not become domain authority. + +A release is not authorized. Wardnet has no GitHub release at this snapshot and the production gate issue #87 remains open. Release requires one exact integrated protected head with required CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence and immutable artifact identity. No current active PR stack or readiness document substitutes for that evidence. + +## Next execution order + +1. Keep repairing exact-current-head source failures before waiting on central review/provider lanes; #129's formatting failure has been repaired and now awaits fresh exact-head execution evidence. +2. Let `.github` repair Actions queue starvation and the structurally impossible solo-maintainer approval count. Revalidate unchanged Wardnet heads afterward rather than changing source merely to retrigger infrastructure. +3. Integrate the immediate security roots in dependency-safe order as their exact gates become valid: #137 deployment credential hardening, #138 fail-closed runtime authentication, #136 destination-policy slice, then the remaining #79 policy work. +4. Finish #129 as one Agent Artifact Admission bounded context without absorbing hostile execution isolation or Agent/LLM orchestration. +5. Drain clean supporting PRs such as #77, #134, #135, and #140 when normal protected merge becomes available under current exact evidence. +6. Continue production-readiness work through #80/#81/#82/#83/#86/#84/#85 rather than widening unrelated feature scope. +7. Keep this baseline current when live queue topology, protected truth, release state, or responsibility boundaries materially change. From 6fae978864ab303644d68218b7a68fc9f3a65faa Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 19:40:39 +0900 Subject: [PATCH 14/73] docs(gaps): refresh live Wardnet queue and governance --- docs/product-technical-gap-baseline.md | 45 ++++++++++++++------------ 1 file changed, 25 insertions(+), 20 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index a889c56f..0de2ec34 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # Product and technical gap baseline -Snapshot date: 2026-09-01T19:15:00+09:00. This is a dated GitHub inventory for `ContextualWisdomLab/wardnet`; every later execution must refetch live heads, bases, checks, rules and releases instead of treating this file as a scheduler cache. +Snapshot date: 2026-09-01. This is a dated GitHub inventory for `ContextualWisdomLab/wardnet`; every later execution must refetch live heads, bases, checks, rules, releases, and foreign owner state instead of treating this file as a scheduler cache. ## Product boundary @@ -16,30 +16,33 @@ Protected/default `main` is `b2bcee3bf2c63f26c48e3be879e5349ef23fafcd` at this s Organization ruleset `18156473` targets `~DEFAULT_BRANCH`. Its pull-request rule currently requires one approving review, dismisses stale approvals, requires conversation resolution, has no named required reviewer/team, no code-owner review requirement, and no last-push approval requirement. It also requires central workflow evidence for review, scheduling, security, Strix, Semgrep, and Noema plus deletion/non-fast-forward protection. -The bare approval-count requirement is structurally inconsistent with the declared solo-maintainer operating model when no eligible independent human exists. That is a central `.github` governance defect, not a Wardnet product gap and not a request to invent a human reviewer. Self-approval and bot/model-as-human approval remain forbidden. Central owner path `.github#772` has current Wardnet evidence and must repair only the unsatisfiable approval-count condition while preserving deterministic workflow/security/coverage/package/SBOM/provenance/thread/branch-integrity gates. +The bare approval-count requirement is structurally inconsistent with the declared solo-maintainer operating model when no eligible independent human exists. That is a central `.github` governance defect, not a Wardnet product gap and not a request to invent a human reviewer. Self-approval and bot/model-as-human approval remain forbidden. Central owner path `.github#772` has fresh Wardnet evidence and must repair only the unsatisfiable approval-count condition while preserving deterministic workflow/security/coverage/package/SBOM/provenance/thread/branch-integrity gates. -Current central Actions capacity is also a control-plane dependency. Multiple unchanged Wardnet heads have required jobs queued before execution. `.github#1531` has exact Wardnet queue evidence and must reduce the self-amplifying/obsolete queue at the central owner boundary. Queue starvation is non-passing evidence, but it is not a reason to mutate clean Wardnet source or stop independent Wardnet work. +Required jobs that remain queued before any runner step are likewise central control-plane evidence rather than Wardnet source failures. `.github#712` has fresh Wardnet reproduction from #136: the repository-owned CI/Fuzz/Security/SAST lanes are terminal GREEN on exact head `0af75ab614442cba43782d5e9edcd1ee9606a4a8`, while central OpenCode job `99791887036` remains queued without executed steps. Queue starvation is non-passing evidence, but it is not a reason to mutate a clean Wardnet head or stop independent Wardnet work. ## Live delivery queue -The fresh inventory contains 20 open PRs including this baseline PR. PR #94 was closed as superseded after its one unique issue-#78 doctoring artifact was ported to the clean successor #138. The remaining queue is: +The fresh inventory contains 19 open PRs including this baseline PR: -`#77, #88, #90, #93, #95, #111, #112, #114, #115, #126, #127, #129, #130, #131, #134, #135, #136, #137, #138, #140`. +`#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #131, #134, #135, #136, #137, #138, #140`. + +PR #126 is no longer open and must not remain in the active queue. PR #94 was previously closed as superseded after its unique issue-#78 doctoring artifact was preserved on the clean successor #138. Key exact-current candidates verified during this refresh: | PR | Exact head | Current classification | Evidence / next causal action | | --- | --- | --- | --- | -| #129 Agent Artifact Admission | `3a23772b3ae56097d0e9d78333a1ceeaeb21a104` | Draft, ahead of main with `behind_by=0` | Predecessor CI failed only at `cargo fmt --check`; the three exact formatting defects were repaired on the current branch. Fresh CI/Fuzz/Security/SAST runs exist but are queued and therefore non-passing. Inline review threads are resolved. Keep Draft until the unchanged head is fully gate-clean. | -| #138 fail-closed management auth | `efca66ab86d9f8ec6cfd7e48d3471effd437df15` | Ready, mergeable | Clean successor for issue #78. It now also carries the preserved APA-7 doctoring artifact from superseded #94. Its new exact-head gates must complete before merge. | +| #129 Agent Artifact Admission | `3a23772b3ae56097d0e9d78333a1ceeaeb21a104` | Draft | The predecessor formatting failure was repaired. Fresh exact-head gates remain required; keep Draft until unchanged-head CI/Fuzz/Security/SAST and applicable central gates terminate successfully. | +| #138 fail-closed management auth | `78b21b9dad892e07cc454a150b7c84156ab57d20` | Ready, mergeable | Current-head review found that the smoke regression did not prove the generated administrator credential actually flows into `ADMIN_TOKEN`. The test now binds the exact `secrets.token_hex(16)` generator to forwarding, requires generation before use, and rejects a second `ADMIN_TOKEN=` fallback. That thread is resolved. CI/Fuzz/Security/SAST for this new head are queued and non-passing. A separate documentation/research-artifact review still requires a lawful redistributable ASVS/NIST artifact or equivalent verified resolution. | | #140 runtime configuration snapshot | `7a5b41006b75485f0d09307be5697ed3501e856d` | Ready, mergeable | Current review threads are resolved, including secret/non-secret configuration ownership. Exact-current-head repository workflows were queued at the latest read. | | #137 external administrator Secret boundary | `60805269e0a7406f5d32ad65a09b2f0c31027196` | Ready, mergeable | Repository CI/Security/SAST jobs were still queued before execution at the latest read. | -| #136 outbound destination hardening | `0af75ab614442cba43782d5e9edcd1ee9606a4a8` | Ready, mergeable | Repository CI/Fuzz/Security/SAST are terminal GREEN and inline findings are resolved. Central required OpenCode review remains queued with no executed steps; #79 remains only partially implemented because full versioned allowlist/deny-precedence and complete connector-policy acceptance are still open. | +| #136 outbound destination hardening | `0af75ab614442cba43782d5e9edcd1ee9606a4a8` | Ready, mergeable | Repository CI/Fuzz/Security/SAST are terminal GREEN and inline findings are resolved. Central required OpenCode remains queued before execution. #79 remains partial because the versioned allowlist/deny-precedence policy and full connector-policy acceptance are still open. | | #135 bounded local limiter | `49abdd807aed0fd21310424ddfcb8200ec1dfd34` | Ready, mergeable | Repository CI/Fuzz/Security/SAST are terminal GREEN and current inline threads are resolved. Central governance/review evidence remains separate. | -| #134 support-bundle regression | `2193bfda7601eba9754b1783a7669077bb7efbc2` | Ready, mergeable | The stale shutdown title/body was corrected. The actual one-file delta binds support-bundle counts to KPI/evidence-manifest counts and asserts the administrator secret is absent. Repository CI/Fuzz/Security/SAST are GREEN; central gates remain. | -| #77 pinned Rust toolchain | `d30de04d717204373c643a1dd209cdcccc707391` | Ready, mergeable | Repository CI/Security/SAST are GREEN and inline findings are resolved. Auto-merge is enabled, but normal merge remains subject to the repaired live organization policy and current central required workflows. | +| #134 support-bundle regression | `2193bfda7601eba9754b1783a7669077bb7efbc2` | Ready, mergeable | The actual delta binds support-bundle counts to KPI/evidence-manifest counts and asserts the administrator secret is absent. Repository CI/Fuzz/Security/SAST are GREEN; central gates remain. | +| #90 SIEM/OpenTelemetry export | `2d251183c41f49b07d443ff15fe9e54472d90f63` | Ready, mergeable | The last current review thread was informational and is now resolved. Exact-head CI/Fuzz/Security/SAST are queued, so this candidate is not yet merge-passing. | +| #77 pinned Rust toolchain | `d30de04d717204373c643a1dd209cdcccc707391` | Ready, mergeable | Repository CI/Security/SAST are GREEN and inline findings are resolved. Normal merge remains subject to the repaired live organization policy and current central required workflows. | -Do not transfer checks/reviews across a head, base, retarget, restack, or replacement PR. `queued`, `pending`, `skipped`, `cancelled`, `absent`, stale, predecessor-head, status-only, model-only, or synthetic evidence is non-passing. +Do not transfer checks, reviews, approvals, artifacts, or source-review conclusions across a head, base, retarget, restack, replacement PR, or protected-base movement. `queued`, `pending`, `skipped`, `cancelled`, `absent`, stale, predecessor-head, status-only, model-only, or synthetic evidence is non-passing. ## Open issues @@ -55,15 +58,17 @@ The production-risk order remains: 6. **Immutable delivery and operation:** #84 signed/SBOM/provenance release promotion and rollback, then #85 OpenTelemetry/SLO/incident/restore evidence. 7. **Supporting correctness:** #74 deterministic persistence-failure testing, #77 pinned compiler, #139 coherent runtime configuration boundary, and #75 post-hardening Kubernetes filename migration. -Issues #78, #74, #89, #128, #139 have active implementation PRs. Do not close them from predecessor evidence; close only after the owning protected merge satisfies the issue acceptance contract. +Issues #78, #74, #89, #128, and #139 have active implementation PRs. Do not close them from predecessor evidence; close only after the owning protected merge satisfies the issue acceptance contract. ## DDD and implementation gaps -Agent Artifact Admission has a responsibility-aligned crate under `crates/agent-artifact-admission` with domain-policy independence tests. The legacy gateway remains concentrated in the root `src/lib.rs`. File size by itself is not a service boundary, but current work repeatedly touches client attribution, outbound policy, runtime configuration, proxying, SOC integration, rate limiting, support evidence, and management APIs in the same module. The next structural work must add responsibility/dependency fitness before moving code and should favor a modular monolith until transaction, deployment, scaling, or reuse evidence justifies a separate deployable. +Agent Artifact Admission has a responsibility-aligned crate under `crates/agent-artifact-admission` with domain-policy independence tests. The legacy gateway remains concentrated in the root `src/lib.rs`. File size alone is not a service boundary, but current work repeatedly touches client attribution, outbound policy, runtime configuration, proxying, SOC integration, rate limiting, support evidence, and management APIs in the same module. Structural work must add responsibility/dependency fitness before moving code and should favor a modular monolith until transaction, deployment, scaling, or reuse evidence justifies another deployable. + +PR #140 is the current coherent migration for the non-secret Runtime Configuration supporting subdomain. `CredentialRegistry` remains the secret-bearing bootstrap owner. New direct process-environment reads outside approved bootstrap adapters are architectural defects. -PR #140 is the current coherent migration for the non-secret Runtime Configuration supporting subdomain. `CredentialRegistry` remains the secret-bearing bootstrap owner. New direct process-environment reads outside the approved bootstrap adapters are architectural defects. +Network-Egress remains incomplete even after #136. The current slice closes literal/private/reserved destinations, ambient proxies, redirects, DNS rebinding through validated-address pinning, and related parsing bypasses. Issue #79 still requires a reusable versioned policy with hostname/suffix/IP/CIDR/scheme/port allowlists, deterministic deny-overrides precedence, complete connector parity, decision evidence, and operator migration/rollback/diagnostics. Do not claim #79 closed from #136 alone. -Network-Egress remains incomplete even after #136: the current slice closes literal/private/reserved destinations, ambient proxies, redirects, DNS rebinding through validated-address pinning, and related parsing bypasses. Issue #79 still requires a reusable versioned policy with hostname/suffix/IP/CIDR/scheme/port allowlists, deterministic deny-overrides precedence, complete connector parity, decision evidence, and operator migration/rollback/diagnostics. Do not claim #79 closed from #136 alone. +The current Context Fabric owner state remains provisional. `context-graph-contracts` still reports live default `develop`; its latest Context Assertion/CloudEvent work remains on a Draft stack with queued exact-head conformance/package lanes and no immutable release. `enterprise-architecture-core` likewise still reports live default `develop`; its current Context Fabric projection Draft explicitly preserves the Quarantine Sandbox Runtime/Wardnet/contextual-orchestrator authority split and forbids malware verdict or artifact risk score as authoritative EA facts. Wardnet must consume only a released compatible Context Graph contract, never a sibling PR head. ## Quality, security, and release gates @@ -71,14 +76,14 @@ Wardnet-owned production code targets 100% statement and branch coverage and com Material architecture/security decisions must retain current NIST/OWASP/CWE/OCI/Linux/IETF or other authoritative primary standards and relevant peer-reviewed research in APA 7 traceability. Provider/vendor schemas stay behind adapters; research or scanner output does not become domain authority. -A release is not authorized. Wardnet has no GitHub release at this snapshot and the production gate issue #87 remains open. Release requires one exact integrated protected head with required CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence and immutable artifact identity. No current active PR stack or readiness document substitutes for that evidence. +A release is not authorized. Wardnet has no GitHub release at this snapshot and production gate issue #87 remains open. Release requires one exact integrated protected head with required CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence and immutable artifact identity. No active PR stack or readiness document substitutes for that evidence. ## Next execution order -1. Keep repairing exact-current-head source failures before waiting on central review/provider lanes; #129's formatting failure has been repaired and now awaits fresh exact-head execution evidence. -2. Let `.github` repair Actions queue starvation and the structurally impossible solo-maintainer approval count. Revalidate unchanged Wardnet heads afterward rather than changing source merely to retrigger infrastructure. -3. Integrate the immediate security roots in dependency-safe order as their exact gates become valid: #137 deployment credential hardening, #138 fail-closed runtime authentication, #136 destination-policy slice, then the remaining #79 policy work. +1. Repair exact-current-head source/review defects before waiting on central provider lanes; #138's smoke credential-flow regression is repaired and now requires fresh exact-head execution evidence plus the remaining research-artifact review resolution. +2. Let `.github` repair runner acquisition through #712 and the structurally impossible solo-maintainer approval count through #772. Revalidate unchanged Wardnet heads afterward rather than changing source merely to retrigger infrastructure. +3. Integrate immediate security roots in dependency-safe order as their exact gates become valid: #137 deployment credential hardening, #138 fail-closed runtime authentication, #136 destination-policy slice, then the remaining #79 policy work. 4. Finish #129 as one Agent Artifact Admission bounded context without absorbing hostile execution isolation or Agent/LLM orchestration. -5. Drain clean supporting PRs such as #77, #134, #135, and #140 when normal protected merge becomes available under current exact evidence. +5. Drain clean supporting PRs such as #77, #90, #134, #135, and #140 when normal protected merge becomes available under current exact evidence. 6. Continue production-readiness work through #80/#81/#82/#83/#86/#84/#85 rather than widening unrelated feature scope. 7. Keep this baseline current when live queue topology, protected truth, release state, or responsibility boundaries materially change. From 9e876d76804f6fd916ec5c2da89594cd5e1b6482 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 00:41:27 +0900 Subject: [PATCH 15/73] docs(gaps): refresh live queue and research grounding --- docs/product-technical-gap-baseline.md | 57 +++++++++++++++----------- 1 file changed, 34 insertions(+), 23 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 0de2ec34..4dcdc6ce 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # Product and technical gap baseline -Snapshot date: 2026-09-01. This is a dated GitHub inventory for `ContextualWisdomLab/wardnet`; every later execution must refetch live heads, bases, checks, rules, releases, and foreign owner state instead of treating this file as a scheduler cache. +Snapshot date: 2026-09-02. This is a dated GitHub inventory for `ContextualWisdomLab/wardnet`; every later execution must refetch live heads, bases, checks, rules, releases, and foreign-owner state instead of treating this file as scheduler state. ## Product boundary @@ -12,35 +12,35 @@ Quarantine Sandbox Runtime owns hostile-workload execution isolation. `contextua ## Protected truth and governance -Protected/default `main` is `b2bcee3bf2c63f26c48e3be879e5349ef23fafcd` at this snapshot. There are no Wardnet GitHub releases. +Protected/default `main` is `cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128` at this snapshot. That protected head includes PR #137's external, non-optional administrator Secret boundary. Wardnet still has no GitHub release. Organization ruleset `18156473` targets `~DEFAULT_BRANCH`. Its pull-request rule currently requires one approving review, dismisses stale approvals, requires conversation resolution, has no named required reviewer/team, no code-owner review requirement, and no last-push approval requirement. It also requires central workflow evidence for review, scheduling, security, Strix, Semgrep, and Noema plus deletion/non-fast-forward protection. -The bare approval-count requirement is structurally inconsistent with the declared solo-maintainer operating model when no eligible independent human exists. That is a central `.github` governance defect, not a Wardnet product gap and not a request to invent a human reviewer. Self-approval and bot/model-as-human approval remain forbidden. Central owner path `.github#772` has fresh Wardnet evidence and must repair only the unsatisfiable approval-count condition while preserving deterministic workflow/security/coverage/package/SBOM/provenance/thread/branch-integrity gates. +The bare approval-count requirement is structurally inconsistent with the declared solo-maintainer operating model when no eligible independent human exists. That is a central `.github` governance defect, not a Wardnet product gap and not a request to invent a human reviewer. Self-approval and bot/model-as-human approval remain forbidden. Central owner path `.github#772` owns the minimum repair of the unsatisfiable approval-count condition while preserving deterministic workflow/security/coverage/package/SBOM/provenance/thread/branch-integrity gates. -Required jobs that remain queued before any runner step are likewise central control-plane evidence rather than Wardnet source failures. `.github#712` has fresh Wardnet reproduction from #136: the repository-owned CI/Fuzz/Security/SAST lanes are terminal GREEN on exact head `0af75ab614442cba43782d5e9edcd1ee9606a4a8`, while central OpenCode job `99791887036` remains queued without executed steps. Queue starvation is non-passing evidence, but it is not a reason to mutate a clean Wardnet head or stop independent Wardnet work. +Required jobs that remain queued before any runner step are central control-plane evidence rather than Wardnet source failures. `.github#712` has fresh Wardnet reproductions where `ubuntu-latest` jobs remain `runner_id: 0` with no executed steps; the latest exact reproduction is PR #144 head `57386f0ef5ee5beeb8995003fdbfd584eb6ce950`, CI run `33526583284`, job `99918865509`. Queue starvation is non-passing evidence, but it is not a reason to mutate a clean Wardnet head or stop independent Wardnet work. ## Live delivery queue -The fresh inventory contains 19 open PRs including this baseline PR: +The fresh inventory contains 21 open PRs including this baseline PR: -`#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #131, #134, #135, #136, #137, #138, #140`. +`#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #131, #134, #135, #136, #138, #140, #141, #142, #144`. -PR #126 is no longer open and must not remain in the active queue. PR #94 was previously closed as superseded after its unique issue-#78 doctoring artifact was preserved on the clean successor #138. +PR #126 is closed and superseded by #141's current CodeQL SARIF uploader update. PR #137 is merged into protected `main`. PR #94 was previously closed as superseded after its unique issue-#78 doctoring artifact was preserved on successor work. Key exact-current candidates verified during this refresh: | PR | Exact head | Current classification | Evidence / next causal action | | --- | --- | --- | --- | -| #129 Agent Artifact Admission | `3a23772b3ae56097d0e9d78333a1ceeaeb21a104` | Draft | The predecessor formatting failure was repaired. Fresh exact-head gates remain required; keep Draft until unchanged-head CI/Fuzz/Security/SAST and applicable central gates terminate successfully. | -| #138 fail-closed management auth | `78b21b9dad892e07cc454a150b7c84156ab57d20` | Ready, mergeable | Current-head review found that the smoke regression did not prove the generated administrator credential actually flows into `ADMIN_TOKEN`. The test now binds the exact `secrets.token_hex(16)` generator to forwarding, requires generation before use, and rejects a second `ADMIN_TOKEN=` fallback. That thread is resolved. CI/Fuzz/Security/SAST for this new head are queued and non-passing. A separate documentation/research-artifact review still requires a lawful redistributable ASVS/NIST artifact or equivalent verified resolution. | -| #140 runtime configuration snapshot | `7a5b41006b75485f0d09307be5697ed3501e856d` | Ready, mergeable | Current review threads are resolved, including secret/non-secret configuration ownership. Exact-current-head repository workflows were queued at the latest read. | -| #137 external administrator Secret boundary | `60805269e0a7406f5d32ad65a09b2f0c31027196` | Ready, mergeable | Repository CI/Security/SAST jobs were still queued before execution at the latest read. | -| #136 outbound destination hardening | `0af75ab614442cba43782d5e9edcd1ee9606a4a8` | Ready, mergeable | Repository CI/Fuzz/Security/SAST are terminal GREEN and inline findings are resolved. Central required OpenCode remains queued before execution. #79 remains partial because the versioned allowlist/deny-precedence policy and full connector-policy acceptance are still open. | -| #135 bounded local limiter | `49abdd807aed0fd21310424ddfcb8200ec1dfd34` | Ready, mergeable | Repository CI/Fuzz/Security/SAST are terminal GREEN and current inline threads are resolved. Central governance/review evidence remains separate. | -| #134 support-bundle regression | `2193bfda7601eba9754b1783a7669077bb7efbc2` | Ready, mergeable | The actual delta binds support-bundle counts to KPI/evidence-manifest counts and asserts the administrator secret is absent. Repository CI/Fuzz/Security/SAST are GREEN; central gates remain. | -| #90 SIEM/OpenTelemetry export | `2d251183c41f49b07d443ff15fe9e54472d90f63` | Ready, mergeable | The last current review thread was informational and is now resolved. Exact-head CI/Fuzz/Security/SAST are queued, so this candidate is not yet merge-passing. | -| #77 pinned Rust toolchain | `d30de04d717204373c643a1dd209cdcccc707391` | Ready, mergeable | Repository CI/Security/SAST are GREEN and inline findings are resolved. Normal merge remains subject to the repaired live organization policy and current central required workflows. | +| #129 Agent Artifact Admission | `704e222a5d0e3f2951486eda46fa1ae6b5b0e9e6` | Draft | Feature branch is synchronized with protected `main`; regenerate every applicable exact-head repository/security/coverage/package/review-policy gate and keep Draft until terminal evidence is clean. | +| #131 trusted proxy attribution | `97d9c4b93ecc478c12c6529eae2366831d5ff9e5` | Ready, mergeable | Current review threads are resolved. CI/Fuzz/Security/SAST remain queued, so the candidate is non-passing until exact-head execution evidence terminates. | +| #134 support-bundle regression | `2b236057d6811cb7ca2ff4f01038796128f4fb6a` | Ready, mergeable | Unique delta is a test-only support-evidence consistency/secret-redaction contract; fresh exact-head gates remain required. | +| #136 outbound destination hardening | `b07d0d734fc41ec9f38beec7834bea78fa70cd6a` | Ready, mergeable | Shared URL validation, DNS-address validation/pinning, no ambient proxy, no automatic redirects, and bounded pinned-client lifecycle remain partial progress toward #79; explicit versioned allowlist/deny-precedence and complete connector parity remain open. | +| #138 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready, mergeable | Review findings are resolved; exact-head CI/Fuzz/Security/SAST are queued and remain non-passing pending runner acquisition. | +| #140 runtime configuration snapshot | `492fba145b2b501b3fffcf9e664f40d3ae9c12fa` | Ready, mergeable | Current review threads are resolved; exact-head repository workflows remain queued. | +| #141 CodeQL SARIF uploader | `fea3796a723080068cdc02e064065d6d53eeb3e0` | Ready, mergeable | Replaces stale #126 with the v4.37.9 immutable action pin; exact-head repository and central gates remain required. | +| #142 readiness metrics | `021d51dc18448964fb4aab8ea119bf37825af036` | Ready, mergeable | One current review finding remains: the Prometheus HELP text says `0=auth disabled` even though readonly-only authentication can be enabled while no write-capable credential exists. The owning review path has been asked for the minimal wording/test repair; do not classify merge-ready until the exact head moves or the thread is resolved. | +| #144 Kubernetes manifest path | `57386f0ef5ee5beeb8995003fdbfd584eb6ce950` | Ready, mergeable | The repository path migration preserves #137's hardened manifest. A newly added path-regression false positive was repaired by excluding only migration-history/negative-fixture files while retaining fail-closed scans for operational stale references. Fresh CI/Fuzz/Security/SAST are queued before runner assignment. | Do not transfer checks, reviews, approvals, artifacts, or source-review conclusions across a head, base, retarget, restack, replacement PR, or protected-base movement. `queued`, `pending`, `skipped`, `cancelled`, `absent`, stale, predecessor-head, status-only, model-only, or synthetic evidence is non-passing. @@ -50,7 +50,7 @@ There are 17 open issues at this snapshot: `#11, #38, #74, #75, #78, #79, #80, # The production-risk order remains: -1. **Immediate exposure controls:** #78 fail-closed management auth, #79 fail-closed destination policy, #11 real attack-path CI, and the deployment credential boundary represented by #137/#75. +1. **Immediate exposure controls:** #78 fail-closed management auth, #79 fail-closed destination policy, #11 real attack-path CI, and #75's repository-path migration now implemented by #144 on top of protected #137. 2. **Security admission:** #128 Agent Artifact Admission; protected `main` cannot claim this control until #129 integrates. 3. **Durable authority and effects:** #80 PostgreSQL production authority and tenant isolation, then #81 transactional outbox/leased workers. 4. **Identity and overload:** #82 Keyverse-backed identity/authorization/approval and #83 distributed/global admission authority with bounded local protection. @@ -58,17 +58,28 @@ The production-risk order remains: 6. **Immutable delivery and operation:** #84 signed/SBOM/provenance release promotion and rollback, then #85 OpenTelemetry/SLO/incident/restore evidence. 7. **Supporting correctness:** #74 deterministic persistence-failure testing, #77 pinned compiler, #139 coherent runtime configuration boundary, and #75 post-hardening Kubernetes filename migration. -Issues #78, #74, #89, #128, and #139 have active implementation PRs. Do not close them from predecessor evidence; close only after the owning protected merge satisfies the issue acceptance contract. +Do not close an issue from predecessor evidence. Close only after the owning protected merge satisfies the issue acceptance contract. ## DDD and implementation gaps -Agent Artifact Admission has a responsibility-aligned crate under `crates/agent-artifact-admission` with domain-policy independence tests. The legacy gateway remains concentrated in the root `src/lib.rs`. File size alone is not a service boundary, but current work repeatedly touches client attribution, outbound policy, runtime configuration, proxying, SOC integration, rate limiting, support evidence, and management APIs in the same module. Structural work must add responsibility/dependency fitness before moving code and should favor a modular monolith until transaction, deployment, scaling, or reuse evidence justifies another deployable. +Agent Artifact Admission has a responsibility-aligned crate under `crates/agent-artifact-admission` on PR #129 with domain-policy independence tests. Protected `main` does not yet contain that control. The legacy gateway remains concentrated in root `src/lib.rs`; file size alone is not a service boundary, but repeated changes to client attribution, outbound policy, runtime configuration, proxying, SOC integration, rate limiting, support evidence, and management APIs show a real responsibility-convergence pressure. Structural work must add responsibility/dependency fitness before moving code and should favor a modular monolith until transaction, deployment, scaling, or reuse evidence justifies another deployable. PR #140 is the current coherent migration for the non-secret Runtime Configuration supporting subdomain. `CredentialRegistry` remains the secret-bearing bootstrap owner. New direct process-environment reads outside approved bootstrap adapters are architectural defects. Network-Egress remains incomplete even after #136. The current slice closes literal/private/reserved destinations, ambient proxies, redirects, DNS rebinding through validated-address pinning, and related parsing bypasses. Issue #79 still requires a reusable versioned policy with hostname/suffix/IP/CIDR/scheme/port allowlists, deterministic deny-overrides precedence, complete connector parity, decision evidence, and operator migration/rollback/diagnostics. Do not claim #79 closed from #136 alone. -The current Context Fabric owner state remains provisional. `context-graph-contracts` still reports live default `develop`; its latest Context Assertion/CloudEvent work remains on a Draft stack with queued exact-head conformance/package lanes and no immutable release. `enterprise-architecture-core` likewise still reports live default `develop`; its current Context Fabric projection Draft explicitly preserves the Quarantine Sandbox Runtime/Wardnet/contextual-orchestrator authority split and forbids malware verdict or artifact risk score as authoritative EA facts. Wardnet must consume only a released compatible Context Graph contract, never a sibling PR head. +Context Fabric integration remains release-gated. `context-graph-contracts` and `enterprise-architecture-core` are read-only from Wardnet while their dedicated writer is active. Wardnet consumes only released compatible Context Graph contracts with conformance/admission evidence; sibling PR heads are candidate evidence, never production authority. EA projections may carry application/service/API/runtime technology identity, lifecycle, ownership, risk, remediation and transformation references, but not malware verdicts, artifact risk scores, prompts, or customer/runtime truth as authoritative architecture facts. + +## Research and standards grounding + +This baseline uses external standards and research as constraints and rationale, not as proof that Wardnet currently implements every control. + +- Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). *Zero trust architecture* (NIST SP 800-207). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-207 — supports explicit resource/identity trust decisions rather than implicit trust from network placement, which is consistent with Wardnet's fail-closed authentication, trusted-proxy, and bounded authority direction. +- Souppaya, M., Scarfone, K., & Dodson, D. (2022). *Secure Software Development Framework (SSDF) version 1.1* (NIST SP 800-218). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-218 — supports integrating secure-development practices, root-cause prevention, and evidence into the SDLC rather than treating scanning as a substitute for engineering controls. +- OWASP Foundation. (2025). *Application Security Verification Standard 5.0.0*. https://owasp.org/www-project-application-security-verification-standard/ — the current stable ASVS release provides the application/API verification baseline used for authentication, input, API, and security-control acceptance. Its repository is CC BY-SA 4.0; no additional copy is required in this baseline. +- Soldani, J., Tamburri, D. A., & van den Heuvel, W.-J. (2018). The pains and gains of microservices: A systematic grey literature review. *Journal of Systems and Software, 146*, 215–232. https://doi.org/10.1016/j.jss.2018.09.082 — used only to constrain decomposition claims: independent deployment can add operational and organizational costs, so Wardnet should split deployables only when responsibility, scaling, transaction, or reuse evidence justifies it rather than treating file size as an architectural mandate. + +The NIST publications are publicly distributed government standards and the OWASP ASVS project publishes redistributable CC BY-SA artifacts. The Elsevier article is linked by DOI rather than copied because repository redistribution rights are not established here. ## Quality, security, and release gates @@ -80,10 +91,10 @@ A release is not authorized. Wardnet has no GitHub release at this snapshot and ## Next execution order -1. Repair exact-current-head source/review defects before waiting on central provider lanes; #138's smoke credential-flow regression is repaired and now requires fresh exact-head execution evidence plus the remaining research-artifact review resolution. +1. Continue exact-current-head repair before waiting on central provider lanes; #142's HELP-text correctness finding is the immediate current review defect, while #144's repository-owned regression false positive is already repaired on its latest head. 2. Let `.github` repair runner acquisition through #712 and the structurally impossible solo-maintainer approval count through #772. Revalidate unchanged Wardnet heads afterward rather than changing source merely to retrigger infrastructure. -3. Integrate immediate security roots in dependency-safe order as their exact gates become valid: #137 deployment credential hardening, #138 fail-closed runtime authentication, #136 destination-policy slice, then the remaining #79 policy work. +3. Integrate immediate security roots in dependency-safe order as their exact gates become valid: #138 fail-closed runtime authentication and #136 destination-policy slice, while #144 completes the already-hardened #75 path migration. #137 is protected truth and is no longer an open dependency. 4. Finish #129 as one Agent Artifact Admission bounded context without absorbing hostile execution isolation or Agent/LLM orchestration. -5. Drain clean supporting PRs such as #77, #90, #134, #135, and #140 when normal protected merge becomes available under current exact evidence. +5. Drain clean supporting PRs such as #77, #90, #93, #131, #134, #135, #140, and #141 when normal protected merge becomes available under current exact evidence. 6. Continue production-readiness work through #80/#81/#82/#83/#86/#84/#85 rather than widening unrelated feature scope. 7. Keep this baseline current when live queue topology, protected truth, release state, or responsibility boundaries materially change. From 2a6c30728224cf1b76c5afdf6d97d2dd3db7a449 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 02:12:45 +0900 Subject: [PATCH 16/73] docs(gaps): record hosted-runner causal repair --- docs/product-technical-gap-baseline.md | 32 ++++++++++++++------------ 1 file changed, 17 insertions(+), 15 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 4dcdc6ce..4a492c3a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -18,13 +18,13 @@ Organization ruleset `18156473` targets `~DEFAULT_BRANCH`. Its pull-request rule The bare approval-count requirement is structurally inconsistent with the declared solo-maintainer operating model when no eligible independent human exists. That is a central `.github` governance defect, not a Wardnet product gap and not a request to invent a human reviewer. Self-approval and bot/model-as-human approval remain forbidden. Central owner path `.github#772` owns the minimum repair of the unsatisfiable approval-count condition while preserving deterministic workflow/security/coverage/package/SBOM/provenance/thread/branch-integrity gates. -Required jobs that remain queued before any runner step are central control-plane evidence rather than Wardnet source failures. `.github#712` has fresh Wardnet reproductions where `ubuntu-latest` jobs remain `runner_id: 0` with no executed steps; the latest exact reproduction is PR #144 head `57386f0ef5ee5beeb8995003fdbfd584eb6ce950`, CI run `33526583284`, job `99918865509`. Queue starvation is non-passing evidence, but it is not a reason to mutate a clean Wardnet head or stop independent Wardnet work. +Runner acquisition now has a repository-owned causal repair as well as a central/provider lane. Protected `main` still used the floating `ubuntu-latest` alias in CI, fuzz, and Scorecard. PR #145 added a RED workflow contract and pinned those runner-backed jobs to explicit `ubuntu-24.04`. On exact head `2d41c4079f9a4465c3142a0aa2dd5895cb11f793`, CI run `33535958878`, job `99950209851`, acquired GitHub-hosted runner `1001594621` with label `ubuntu-24.04`, completed checkout/toolchain/formatting, and proceeded through the repository tests. Security Scan also completed successfully. This proves the floating selector was a real Wardnet-owned control-plane defect rather than merely a reporting symptom. Fuzz matrix jobs initially remained `runner_id: 0` even with explicit `ubuntu-24.04`, so `.github#712` retains ownership of the independent central/provider capacity/dispatch class. Queue starvation is always non-passing evidence, but it is not a reason to mutate unrelated clean product source or stop independent Wardnet work. ## Live delivery queue -The fresh inventory contains 21 open PRs including this baseline PR: +The fresh inventory contains 22 open PRs including this baseline PR: -`#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #131, #134, #135, #136, #138, #140, #141, #142, #144`. +`#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #131, #134, #135, #136, #138, #140, #141, #142, #144, #145`. PR #126 is closed and superseded by #141's current CodeQL SARIF uploader update. PR #137 is merged into protected `main`. PR #94 was previously closed as superseded after its unique issue-#78 doctoring artifact was preserved on successor work. @@ -33,14 +33,15 @@ Key exact-current candidates verified during this refresh: | PR | Exact head | Current classification | Evidence / next causal action | | --- | --- | --- | --- | | #129 Agent Artifact Admission | `704e222a5d0e3f2951486eda46fa1ae6b5b0e9e6` | Draft | Feature branch is synchronized with protected `main`; regenerate every applicable exact-head repository/security/coverage/package/review-policy gate and keep Draft until terminal evidence is clean. | -| #131 trusted proxy attribution | `97d9c4b93ecc478c12c6529eae2366831d5ff9e5` | Ready, mergeable | Current review threads are resolved. CI/Fuzz/Security/SAST remain queued, so the candidate is non-passing until exact-head execution evidence terminates. | +| #131 trusted proxy attribution | `97d9c4b93ecc478c12c6529eae2366831d5ff9e5` | Ready, mergeable | Current review threads are resolved. Existing exact-head jobs were queued under the pre-#145 workflow source; after the runner repair reaches protected truth, regenerate exact-head evidence without transferring predecessor results. | | #134 support-bundle regression | `2b236057d6811cb7ca2ff4f01038796128f4fb6a` | Ready, mergeable | Unique delta is a test-only support-evidence consistency/secret-redaction contract; fresh exact-head gates remain required. | | #136 outbound destination hardening | `b07d0d734fc41ec9f38beec7834bea78fa70cd6a` | Ready, mergeable | Shared URL validation, DNS-address validation/pinning, no ambient proxy, no automatic redirects, and bounded pinned-client lifecycle remain partial progress toward #79; explicit versioned allowlist/deny-precedence and complete connector parity remain open. | -| #138 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready, mergeable | Review findings are resolved; exact-head CI/Fuzz/Security/SAST are queued and remain non-passing pending runner acquisition. | -| #140 runtime configuration snapshot | `492fba145b2b501b3fffcf9e664f40d3ae9c12fa` | Ready, mergeable | Current review threads are resolved; exact-head repository workflows remain queued. | +| #138 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready, mergeable | Review findings are resolved; exact-head runs remain non-passing until regenerated under protected runner/governance truth. | +| #140 runtime configuration snapshot | `492fba145b2b501b3fffcf9e664f40d3ae9c12fa` | Ready, mergeable | Current review threads are resolved; fresh exact-head repository evidence remains required. | | #141 CodeQL SARIF uploader | `fea3796a723080068cdc02e064065d6d53eeb3e0` | Ready, mergeable | Replaces stale #126 with the v4.37.9 immutable action pin; exact-head repository and central gates remain required. | | #142 readiness metrics | `021d51dc18448964fb4aab8ea119bf37825af036` | Ready, mergeable | One current review finding remains: the Prometheus HELP text says `0=auth disabled` even though readonly-only authentication can be enabled while no write-capable credential exists. The owning review path has been asked for the minimal wording/test repair; do not classify merge-ready until the exact head moves or the thread is resolved. | -| #144 Kubernetes manifest path | `57386f0ef5ee5beeb8995003fdbfd584eb6ce950` | Ready, mergeable | The repository path migration preserves #137's hardened manifest. A newly added path-regression false positive was repaired by excluding only migration-history/negative-fixture files while retaining fail-closed scans for operational stale references. Fresh CI/Fuzz/Security/SAST are queued before runner assignment. | +| #144 Kubernetes manifest path | `6cd0b16052fb8c35487c9da8ce96a3d17462371b` | Ready, mergeable | The path-regression review defect was repaired by replacing a whole-file documentation exemption with line-level migration-history/rollback rules plus negative operational examples. Security Scan and SAST are GREEN on this exact head; CI/Fuzz remain non-passing until terminal. | +| #145 explicit hosted runner | `2d41c4079f9a4465c3142a0aa2dd5895cb11f793` | Ready, blocked by remaining gates/policy | RED contract rejects floating `ubuntu-latest`; CI/Fuzz/Scorecard now pin `ubuntu-24.04`. Exact-head CI has acquired a real hosted runner and executed checkout/tests, establishing causal runner-selection progress. Merge only after all exact-head repository/security/review-policy gates terminate under then-live governance. | Do not transfer checks, reviews, approvals, artifacts, or source-review conclusions across a head, base, retarget, restack, replacement PR, or protected-base movement. `queued`, `pending`, `skipped`, `cancelled`, `absent`, stale, predecessor-head, status-only, model-only, or synthetic evidence is non-passing. @@ -56,7 +57,7 @@ The production-risk order remains: 4. **Identity and overload:** #82 Keyverse-backed identity/authorization/approval and #83 distributed/global admission authority with bounded local protection. 5. **Proven security engines:** #86 Coraza/CRS and Suricata production enforcement with reproducible false-positive/detection evidence. 6. **Immutable delivery and operation:** #84 signed/SBOM/provenance release promotion and rollback, then #85 OpenTelemetry/SLO/incident/restore evidence. -7. **Supporting correctness:** #74 deterministic persistence-failure testing, #77 pinned compiler, #139 coherent runtime configuration boundary, and #75 post-hardening Kubernetes filename migration. +7. **Supporting correctness:** #74 deterministic persistence-failure testing, #77 pinned compiler, #139 coherent runtime configuration boundary, #75 post-hardening Kubernetes filename migration, and #145 deterministic hosted-runner selection. Do not close an issue from predecessor evidence. Close only after the owning protected merge satisfies the issue acceptance contract. @@ -91,10 +92,11 @@ A release is not authorized. Wardnet has no GitHub release at this snapshot and ## Next execution order -1. Continue exact-current-head repair before waiting on central provider lanes; #142's HELP-text correctness finding is the immediate current review defect, while #144's repository-owned regression false positive is already repaired on its latest head. -2. Let `.github` repair runner acquisition through #712 and the structurally impossible solo-maintainer approval count through #772. Revalidate unchanged Wardnet heads afterward rather than changing source merely to retrigger infrastructure. -3. Integrate immediate security roots in dependency-safe order as their exact gates become valid: #138 fail-closed runtime authentication and #136 destination-policy slice, while #144 completes the already-hardened #75 path migration. #137 is protected truth and is no longer an open dependency. -4. Finish #129 as one Agent Artifact Admission bounded context without absorbing hostile execution isolation or Agent/LLM orchestration. -5. Drain clean supporting PRs such as #77, #90, #93, #131, #134, #135, #140, and #141 when normal protected merge becomes available under current exact evidence. -6. Continue production-readiness work through #80/#81/#82/#83/#86/#84/#85 rather than widening unrelated feature scope. -7. Keep this baseline current when live queue topology, protected truth, release state, or responsibility boundaries materially change. +1. Drive #145 through exact-head CI/Fuzz/Security/SAST and current review-policy evidence because it repairs the repository-owned runner selector and unblocks trustworthy regeneration of the older queue. Do not bypass the separate approval-count defect. +2. Continue exact-current-head repairs while #145/provider lanes execute; #142's HELP-text correctness finding is the immediate current review defect, while #144's line-level legacy-path review defect is repaired on its latest head. +3. Let `.github` continue independent central/provider runner acquisition work through #712 and the structurally impossible solo-maintainer approval count through #772. Revalidate unchanged Wardnet heads afterward rather than changing product source merely to retrigger infrastructure. +4. Integrate immediate security roots in dependency-safe order as their exact gates become valid: #138 fail-closed runtime authentication and #136 destination-policy slice, while #144 completes the already-hardened #75 path migration. #137 is protected truth and is no longer an open dependency. +5. Finish #129 as one Agent Artifact Admission bounded context without absorbing hostile execution isolation or Agent/LLM orchestration. +6. Drain clean supporting PRs such as #77, #90, #93, #131, #134, #135, #140, and #141 when normal protected merge becomes available under current exact evidence. +7. Continue production-readiness work through #80/#81/#82/#83/#86/#84/#85 rather than widening unrelated feature scope. +8. Keep this baseline current when live queue topology, protected truth, release state, or responsibility boundaries materially change. From fce6b83a7a8672f265e24fb1dd378722c4a46e93 Mon Sep 17 00:00:00 2001 From: OpenAI Codex Date: Wed, 2 Sep 2026 02:54:30 +0900 Subject: [PATCH 17/73] docs(gaps): narrow hosted runner causal claims --- docs/product-technical-gap-baseline.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 4a492c3a..d1b7c0d5 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -18,7 +18,7 @@ Organization ruleset `18156473` targets `~DEFAULT_BRANCH`. Its pull-request rule The bare approval-count requirement is structurally inconsistent with the declared solo-maintainer operating model when no eligible independent human exists. That is a central `.github` governance defect, not a Wardnet product gap and not a request to invent a human reviewer. Self-approval and bot/model-as-human approval remain forbidden. Central owner path `.github#772` owns the minimum repair of the unsatisfiable approval-count condition while preserving deterministic workflow/security/coverage/package/SBOM/provenance/thread/branch-integrity gates. -Runner acquisition now has a repository-owned causal repair as well as a central/provider lane. Protected `main` still used the floating `ubuntu-latest` alias in CI, fuzz, and Scorecard. PR #145 added a RED workflow contract and pinned those runner-backed jobs to explicit `ubuntu-24.04`. On exact head `2d41c4079f9a4465c3142a0aa2dd5895cb11f793`, CI run `33535958878`, job `99950209851`, acquired GitHub-hosted runner `1001594621` with label `ubuntu-24.04`, completed checkout/toolchain/formatting, and proceeded through the repository tests. Security Scan also completed successfully. This proves the floating selector was a real Wardnet-owned control-plane defect rather than merely a reporting symptom. Fuzz matrix jobs initially remained `runner_id: 0` even with explicit `ubuntu-24.04`, so `.github#712` retains ownership of the independent central/provider capacity/dispatch class. Queue starvation is always non-passing evidence, but it is not a reason to mutate unrelated clean product source or stop independent Wardnet work. +Runner acquisition now has a repository-owned repair path as well as a central/provider lane. Protected `main` still used the floating `ubuntu-latest` alias in CI, fuzz, and Scorecard. PR #145 added a RED workflow contract and pinned those runner-backed jobs to explicit `ubuntu-24.04`. On exact head `2d41c4079f9a4465c3142a0aa2dd5895cb11f793`, CI run `33535958878`, job `99950209851`, acquired GitHub-hosted runner `1001594621` with label `ubuntu-24.04`, completed checkout/toolchain/formatting, and proceeded through the repository tests; Wardnet-owned Security Scan, SAST, and fuzz jobs also reached terminal GREEN on that head. This proves that explicit `ubuntu-24.04` is a valid deterministic selector for Wardnet-owned workflows, but it does not isolate the former `ubuntu-latest` alias as the sole cause because provider recovery is observationally compatible. Fuzz matrix jobs earlier remained `runner_id: 0` even with explicit `ubuntu-24.04`, so `.github#712` retains ownership of the independent central/provider capacity/dispatch class. Queue starvation is always non-passing evidence, but it is not a reason to mutate unrelated clean product source or stop independent Wardnet work. ## Live delivery queue @@ -39,9 +39,9 @@ Key exact-current candidates verified during this refresh: | #138 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready, mergeable | Review findings are resolved; exact-head runs remain non-passing until regenerated under protected runner/governance truth. | | #140 runtime configuration snapshot | `492fba145b2b501b3fffcf9e664f40d3ae9c12fa` | Ready, mergeable | Current review threads are resolved; fresh exact-head repository evidence remains required. | | #141 CodeQL SARIF uploader | `fea3796a723080068cdc02e064065d6d53eeb3e0` | Ready, mergeable | Replaces stale #126 with the v4.37.9 immutable action pin; exact-head repository and central gates remain required. | -| #142 readiness metrics | `021d51dc18448964fb4aab8ea119bf37825af036` | Ready, mergeable | One current review finding remains: the Prometheus HELP text says `0=auth disabled` even though readonly-only authentication can be enabled while no write-capable credential exists. The owning review path has been asked for the minimal wording/test repair; do not classify merge-ready until the exact head moves or the thread is resolved. | +| #142 readiness metrics | `6667046c19afcf7c08c4ff1f83024747d7d7c2ea` | Ready, mergeable | The Prometheus HELP-text defect was repaired on the current head so `0` now means no write-capable credential is configured while readonly auth may still exist. `cargo fmt --check` and the focused `admin_auth_metric_requires_a_write_capable_credential` regression pass locally; fresh exact-head hosted checks are queued and approval is still required. | | #144 Kubernetes manifest path | `6cd0b16052fb8c35487c9da8ce96a3d17462371b` | Ready, mergeable | The path-regression review defect was repaired by replacing a whole-file documentation exemption with line-level migration-history/rollback rules plus negative operational examples. Security Scan and SAST are GREEN on this exact head; CI/Fuzz remain non-passing until terminal. | -| #145 explicit hosted runner | `2d41c4079f9a4465c3142a0aa2dd5895cb11f793` | Ready, blocked by remaining gates/policy | RED contract rejects floating `ubuntu-latest`; CI/Fuzz/Scorecard now pin `ubuntu-24.04`. Exact-head CI has acquired a real hosted runner and executed checkout/tests, establishing causal runner-selection progress. Merge only after all exact-head repository/security/review-policy gates terminate under then-live governance. | +| #145 explicit hosted runner | `2d41c4079f9a4465c3142a0aa2dd5895cb11f793` | Ready, blocked by remaining gates/policy | RED contract rejects floating `ubuntu-latest`; CI/Fuzz/SAST/Security Scan/Devin are terminal GREEN on this exact head and CI has acquired a real hosted runner with `ubuntu-24.04`. CodeQL, OpenCode bootstrap, Noema, Close Empty, Strix, and independent approval are still non-passing, so merge remains forbidden until then-live governance permits it. | Do not transfer checks, reviews, approvals, artifacts, or source-review conclusions across a head, base, retarget, restack, replacement PR, or protected-base movement. `queued`, `pending`, `skipped`, `cancelled`, `absent`, stale, predecessor-head, status-only, model-only, or synthetic evidence is non-passing. From 56718b79a1c4a56970aee62c8b2dd9b75072674b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 03:17:44 +0900 Subject: [PATCH 18/73] docs(gaps): refresh current Wardnet delivery topology --- docs/product-technical-gap-baseline.md | 85 +++++++++++++------------- 1 file changed, 42 insertions(+), 43 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index d1b7c0d5..4a09d3ab 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -12,91 +12,90 @@ Quarantine Sandbox Runtime owns hostile-workload execution isolation. `contextua ## Protected truth and governance -Protected/default `main` is `cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128` at this snapshot. That protected head includes PR #137's external, non-optional administrator Secret boundary. Wardnet still has no GitHub release. +Protected/default `main` is `cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128` at this snapshot. That head contains PR #137's externally provisioned, non-optional administrator Secret boundary. Wardnet still has no GitHub release. -Organization ruleset `18156473` targets `~DEFAULT_BRANCH`. Its pull-request rule currently requires one approving review, dismisses stale approvals, requires conversation resolution, has no named required reviewer/team, no code-owner review requirement, and no last-push approval requirement. It also requires central workflow evidence for review, scheduling, security, Strix, Semgrep, and Noema plus deletion/non-fast-forward protection. +Organization ruleset `18156473` targets `~DEFAULT_BRANCH`. Its pull-request rule currently requires one approving review, dismisses stale approvals, requires review-thread resolution, has no named required reviewer/team, no code-owner review requirement, and no last-push approval requirement. It also requires central workflow evidence for review, scheduling, security, Strix, Semgrep, and Noema plus deletion/non-fast-forward protection. -The bare approval-count requirement is structurally inconsistent with the declared solo-maintainer operating model when no eligible independent human exists. That is a central `.github` governance defect, not a Wardnet product gap and not a request to invent a human reviewer. Self-approval and bot/model-as-human approval remain forbidden. Central owner path `.github#772` owns the minimum repair of the unsatisfiable approval-count condition while preserving deterministic workflow/security/coverage/package/SBOM/provenance/thread/branch-integrity gates. +The bare approval-count requirement is structurally inconsistent with the declared solo-maintainer operating model when no eligible independent human exists. That is a central `.github` governance defect, not a Wardnet product gap and not a request to invent a reviewer. Self-approval and bot/model-as-human approval remain forbidden. `.github#772` and its executable governance PR own the minimum repair while preserving deterministic workflow/security/coverage/package/SBOM/provenance/thread/branch-integrity controls. -Runner acquisition now has a repository-owned repair path as well as a central/provider lane. Protected `main` still used the floating `ubuntu-latest` alias in CI, fuzz, and Scorecard. PR #145 added a RED workflow contract and pinned those runner-backed jobs to explicit `ubuntu-24.04`. On exact head `2d41c4079f9a4465c3142a0aa2dd5895cb11f793`, CI run `33535958878`, job `99950209851`, acquired GitHub-hosted runner `1001594621` with label `ubuntu-24.04`, completed checkout/toolchain/formatting, and proceeded through the repository tests; Wardnet-owned Security Scan, SAST, and fuzz jobs also reached terminal GREEN on that head. This proves that explicit `ubuntu-24.04` is a valid deterministic selector for Wardnet-owned workflows, but it does not isolate the former `ubuntu-latest` alias as the sole cause because provider recovery is observationally compatible. Fuzz matrix jobs earlier remained `runner_id: 0` even with explicit `ubuntu-24.04`, so `.github#712` retains ownership of the independent central/provider capacity/dispatch class. Queue starvation is always non-passing evidence, but it is not a reason to mutate unrelated clean product source or stop independent Wardnet work. +Runner acquisition has both a Wardnet-owned deterministic selector repair and an independent central/provider lane. Clean replacement PR #147 pins Wardnet runner-backed CI, Fuzz, and Scorecard jobs to explicit `ubuntu-24.04` and carries the permanent regression that rejects `ubuntu-latest`. Its exact head is `2d41c4079f9a4465c3142a0aa2dd5895cb11f793`. Earlier repository-owned runs on this exact commit proved that the explicit selector can acquire a real hosted runner and complete CI/Fuzz/Security/SAST, but fresh PR #147 runs are again queued and therefore non-passing. This does not establish the former floating alias as the sole cause; `.github#712` retains the central/provider runner-capacity and dispatch defect class. + +The original runner PR #145 is closed and superseded. Its source branch was accidentally used as a feature-stack integration target, which expanded the branch beyond the four runner-control files. No protected-main merge occurred. The bounded runner delta is preserved by #147. ## Live delivery queue -The fresh inventory contains 22 open PRs including this baseline PR: +The fresh inventory contains 23 open PRs including this baseline PR: -`#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #131, #134, #135, #136, #138, #140, #141, #142, #144, #145`. +`#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #138, #140, #141, #142, #144, #146, #147, #148`. -PR #126 is closed and superseded by #141's current CodeQL SARIF uploader update. PR #137 is merged into protected `main`. PR #94 was previously closed as superseded after its unique issue-#78 doctoring artifact was preserved on successor work. +PR #126 is closed and superseded by #141. PR #137 is merged into protected `main`. PR #131 is closed after its trusted-proxy delta was integrated only into the obsolete #145 feature branch; it did not reach protected `main`. Canonical trusted-proxy delivery is replacement PR #148. PR #145 is closed as superseded by clean replacement #147. Key exact-current candidates verified during this refresh: | PR | Exact head | Current classification | Evidence / next causal action | | --- | --- | --- | --- | -| #129 Agent Artifact Admission | `704e222a5d0e3f2951486eda46fa1ae6b5b0e9e6` | Draft | Feature branch is synchronized with protected `main`; regenerate every applicable exact-head repository/security/coverage/package/review-policy gate and keep Draft until terminal evidence is clean. | -| #131 trusted proxy attribution | `97d9c4b93ecc478c12c6529eae2366831d5ff9e5` | Ready, mergeable | Current review threads are resolved. Existing exact-head jobs were queued under the pre-#145 workflow source; after the runner repair reaches protected truth, regenerate exact-head evidence without transferring predecessor results. | -| #134 support-bundle regression | `2b236057d6811cb7ca2ff4f01038796128f4fb6a` | Ready, mergeable | Unique delta is a test-only support-evidence consistency/secret-redaction contract; fresh exact-head gates remain required. | -| #136 outbound destination hardening | `b07d0d734fc41ec9f38beec7834bea78fa70cd6a` | Ready, mergeable | Shared URL validation, DNS-address validation/pinning, no ambient proxy, no automatic redirects, and bounded pinned-client lifecycle remain partial progress toward #79; explicit versioned allowlist/deny-precedence and complete connector parity remain open. | -| #138 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready, mergeable | Review findings are resolved; exact-head runs remain non-passing until regenerated under protected runner/governance truth. | -| #140 runtime configuration snapshot | `492fba145b2b501b3fffcf9e664f40d3ae9c12fa` | Ready, mergeable | Current review threads are resolved; fresh exact-head repository evidence remains required. | -| #141 CodeQL SARIF uploader | `fea3796a723080068cdc02e064065d6d53eeb3e0` | Ready, mergeable | Replaces stale #126 with the v4.37.9 immutable action pin; exact-head repository and central gates remain required. | -| #142 readiness metrics | `6667046c19afcf7c08c4ff1f83024747d7d7c2ea` | Ready, mergeable | The Prometheus HELP-text defect was repaired on the current head so `0` now means no write-capable credential is configured while readonly auth may still exist. `cargo fmt --check` and the focused `admin_auth_metric_requires_a_write_capable_credential` regression pass locally; fresh exact-head hosted checks are queued and approval is still required. | -| #144 Kubernetes manifest path | `6cd0b16052fb8c35487c9da8ce96a3d17462371b` | Ready, mergeable | The path-regression review defect was repaired by replacing a whole-file documentation exemption with line-level migration-history/rollback rules plus negative operational examples. Security Scan and SAST are GREEN on this exact head; CI/Fuzz remain non-passing until terminal. | -| #145 explicit hosted runner | `2d41c4079f9a4465c3142a0aa2dd5895cb11f793` | Ready, blocked by remaining gates/policy | RED contract rejects floating `ubuntu-latest`; CI/Fuzz/SAST/Security Scan/Devin are terminal GREEN on this exact head and CI has acquired a real hosted runner with `ubuntu-24.04`. CodeQL, OpenCode bootstrap, Noema, Close Empty, Strix, and independent approval are still non-passing, so merge remains forbidden until then-live governance permits it. | +| #129 Agent Artifact Admission | `704e222a5d0e3f2951486eda46fa1ae6b5b0e9e6` | Draft | Feature branch is synchronized with protected `main`; keep Draft until every applicable exact-head repository/security/coverage/package/review-policy gate is terminal and current. | +| #136 outbound destination hardening | `b07d0d734fc41ec9f38beec7834bea78fa70cd6a` | Ready | Shared URL validation, DNS-address validation/pinning, no ambient proxy, no automatic redirects, and bounded pinned-client lifecycle remain partial progress toward #79; versioned allowlist/deny precedence and complete connector parity remain open. | +| #138 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready | Review findings are resolved; regenerate exact-head evidence under current runner/governance truth before merge. | +| #140 runtime configuration snapshot | `492fba145b2b501b3fffcf9e664f40d3ae9c12fa` | Ready | Runtime Configuration remains a supporting bootstrap boundary distinct from secret-bearing Credential Registry; fresh exact-head evidence remains required. | +| #142 readiness metrics | `e7ef34d9f2c5d31873d7c09889b302279e8a4162` | Ready, stacked on #147 | The Prometheus HELP-text defect is resolved: `0` means no write-capable credential is configured while readonly auth may still exist. The branch non-destructively incorporates #147's runner prerequisite; fresh exact-head CI/Fuzz/Security/SAST are non-passing while queued. | +| #144 Kubernetes manifest path | `6cd0b16052fb8c35487c9da8ce96a3d17462371b` | Ready, main-based | Repository-path-only migration preserves #137's hardened Secret contract and live Kubernetes identities. Auto-merge is enabled, so keep this PR on protected `main`; do not retarget it to an unprotected feature base. | +| #146 support-bundle operability evidence | `28606b28b01df900d03ddeb3df7cb037fb3804da` | Ready | Adds readiness/metrics evidence to support-bundle and buyer-evidence surfaces. Treat as an independent concurrent lane and revalidate overlap before mutation. | +| #147 explicit hosted runner | `2d41c4079f9a4465c3142a0aa2dd5895cb11f793` | Ready, replacement root | Clean four-file runner-only replacement for superseded #145. Fresh PR-triggered CI/Fuzz/Security/SAST runs are queued; earlier same-commit successes are provenance, not substitute for current required evidence. | +| #148 trusted proxy attribution | `72ac1a2a2902a10aabc6e20169b9ae89adb5f9c8` | Ready, stacked on #147 | Replacement for #131. The merged tree preserves explicit `ubuntu-24.04` and the trusted-proxy fuzz target. Fresh replacement-PR evidence is required; predecessor #131 review/check results do not transfer. | Do not transfer checks, reviews, approvals, artifacts, or source-review conclusions across a head, base, retarget, restack, replacement PR, or protected-base movement. `queued`, `pending`, `skipped`, `cancelled`, `absent`, stale, predecessor-head, status-only, model-only, or synthetic evidence is non-passing. -## Open issues +## Open issues and production order There are 17 open issues at this snapshot: `#11, #38, #74, #75, #78, #79, #80, #81, #82, #83, #84, #85, #86, #87, #89, #128, #139`. -The production-risk order remains: - -1. **Immediate exposure controls:** #78 fail-closed management auth, #79 fail-closed destination policy, #11 real attack-path CI, and #75's repository-path migration now implemented by #144 on top of protected #137. +1. **Immediate exposure controls:** #78 fail-closed management auth, #79 fail-closed destination policy, #11 real attack-path CI, and #75's repository-path migration implemented by #144 on protected #137 truth. 2. **Security admission:** #128 Agent Artifact Admission; protected `main` cannot claim this control until #129 integrates. 3. **Durable authority and effects:** #80 PostgreSQL production authority and tenant isolation, then #81 transactional outbox/leased workers. -4. **Identity and overload:** #82 Keyverse-backed identity/authorization/approval and #83 distributed/global admission authority with bounded local protection. -5. **Proven security engines:** #86 Coraza/CRS and Suricata production enforcement with reproducible false-positive/detection evidence. +4. **Identity and overload:** #82 Keyverse-backed identity/authorization/approval and #83 distributed/global admission authority with bounded local protection. #148 is the current trusted-network-identity slice of #83; it does not close distributed admission. +5. **Proven security engines:** #86 Coraza/CRS and Suricata production enforcement with reproducible detection/false-positive evidence. 6. **Immutable delivery and operation:** #84 signed/SBOM/provenance release promotion and rollback, then #85 OpenTelemetry/SLO/incident/restore evidence. -7. **Supporting correctness:** #74 deterministic persistence-failure testing, #77 pinned compiler, #139 coherent runtime configuration boundary, #75 post-hardening Kubernetes filename migration, and #145 deterministic hosted-runner selection. +7. **Supporting correctness:** #74 deterministic persistence-failure testing, #77 pinned compiler, #139 coherent runtime configuration, #75 post-hardening Kubernetes filename migration, and #147 deterministic hosted-runner selection. Do not close an issue from predecessor evidence. Close only after the owning protected merge satisfies the issue acceptance contract. ## DDD and implementation gaps -Agent Artifact Admission has a responsibility-aligned crate under `crates/agent-artifact-admission` on PR #129 with domain-policy independence tests. Protected `main` does not yet contain that control. The legacy gateway remains concentrated in root `src/lib.rs`; file size alone is not a service boundary, but repeated changes to client attribution, outbound policy, runtime configuration, proxying, SOC integration, rate limiting, support evidence, and management APIs show a real responsibility-convergence pressure. Structural work must add responsibility/dependency fitness before moving code and should favor a modular monolith until transaction, deployment, scaling, or reuse evidence justifies another deployable. +Agent Artifact Admission has a responsibility-aligned crate under `crates/agent-artifact-admission` on #129 with domain-policy independence tests. Protected `main` does not yet contain that control. The legacy gateway remains concentrated in root `src/lib.rs`; file size alone is not a service boundary, but repeated changes to client attribution, outbound policy, runtime configuration, proxying, SOC integration, rate limiting, support evidence, and management APIs show genuine responsibility-convergence pressure. Structural work must add responsibility/dependency fitness before moving code and should favor a modular monolith until transaction, deployment, scaling, or reuse evidence justifies another deployable. -PR #140 is the current coherent migration for the non-secret Runtime Configuration supporting subdomain. `CredentialRegistry` remains the secret-bearing bootstrap owner. New direct process-environment reads outside approved bootstrap adapters are architectural defects. +#140 is the coherent Runtime Configuration migration. `CredentialRegistry` remains the secret-bearing bootstrap owner. New direct process-environment reads outside approved bootstrap adapters are architecture defects. -Network-Egress remains incomplete even after #136. The current slice closes literal/private/reserved destinations, ambient proxies, redirects, DNS rebinding through validated-address pinning, and related parsing bypasses. Issue #79 still requires a reusable versioned policy with hostname/suffix/IP/CIDR/scheme/port allowlists, deterministic deny-overrides precedence, complete connector parity, decision evidence, and operator migration/rollback/diagnostics. Do not claim #79 closed from #136 alone. +Network-Egress remains incomplete after #136. Issue #79 still requires reusable versioned hostname/suffix/IP/CIDR/scheme/port policy, deterministic deny-overrides precedence, complete connector parity, decision evidence, and operator migration/rollback/diagnostics. -Context Fabric integration remains release-gated. `context-graph-contracts` and `enterprise-architecture-core` are read-only from Wardnet while their dedicated writer is active. Wardnet consumes only released compatible Context Graph contracts with conformance/admission evidence; sibling PR heads are candidate evidence, never production authority. EA projections may carry application/service/API/runtime technology identity, lifecycle, ownership, risk, remediation and transformation references, but not malware verdicts, artifact risk scores, prompts, or customer/runtime truth as authoritative architecture facts. +The old #95 branch is not an acceptable production-integration vehicle. It is a large, diverged, non-mergeable branch that combines Coraza, PostgreSQL, outbox, egress and release responsibilities. Its unique tested deltas are preservation evidence for bounded successor work, not permission to merge a cross-context god-PR. #80, #81 and #86 remain unshipped on protected `main` and should be reconstructed/decomposed responsibility-first without losing unique tests or evidence. + +Context Fabric integration remains release-gated. `context-graph-contracts` and `enterprise-architecture-core` are read-only from Wardnet while their dedicated writer is active, and neither currently has a release. Wardnet consumes only released compatible Context Graph contracts with conformance/admission evidence; sibling PR heads are candidate evidence, never production authority. EA projections may carry application/service/API/runtime technology identity, lifecycle, ownership, risk, remediation and transformation references, but not malware verdicts, artifact risk scores, prompts, or customer/runtime truth as authoritative architecture facts. ## Research and standards grounding This baseline uses external standards and research as constraints and rationale, not as proof that Wardnet currently implements every control. -- Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). *Zero trust architecture* (NIST SP 800-207). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-207 — supports explicit resource/identity trust decisions rather than implicit trust from network placement, which is consistent with Wardnet's fail-closed authentication, trusted-proxy, and bounded authority direction. -- Souppaya, M., Scarfone, K., & Dodson, D. (2022). *Secure Software Development Framework (SSDF) version 1.1* (NIST SP 800-218). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-218 — supports integrating secure-development practices, root-cause prevention, and evidence into the SDLC rather than treating scanning as a substitute for engineering controls. -- OWASP Foundation. (2025). *Application Security Verification Standard 5.0.0*. https://owasp.org/www-project-application-security-verification-standard/ — the current stable ASVS release provides the application/API verification baseline used for authentication, input, API, and security-control acceptance. Its repository is CC BY-SA 4.0; no additional copy is required in this baseline. -- Soldani, J., Tamburri, D. A., & van den Heuvel, W.-J. (2018). The pains and gains of microservices: A systematic grey literature review. *Journal of Systems and Software, 146*, 215–232. https://doi.org/10.1016/j.jss.2018.09.082 — used only to constrain decomposition claims: independent deployment can add operational and organizational costs, so Wardnet should split deployables only when responsibility, scaling, transaction, or reuse evidence justifies it rather than treating file size as an architectural mandate. +- Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). *Zero trust architecture* (NIST SP 800-207). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-207. +- Souppaya, M., Scarfone, K., & Dodson, D. (2022). *Secure Software Development Framework (SSDF) version 1.1* (NIST SP 800-218). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-218. +- OWASP Foundation. (2025). *Application Security Verification Standard 5.0.0*. https://owasp.org/www-project-application-security-verification-standard/. +- Soldani, J., Tamburri, D. A., & van den Heuvel, W.-J. (2018). The pains and gains of microservices: A systematic grey literature review. *Journal of Systems and Software, 146*, 215–232. https://doi.org/10.1016/j.jss.2018.09.082. -The NIST publications are publicly distributed government standards and the OWASP ASVS project publishes redistributable CC BY-SA artifacts. The Elsevier article is linked by DOI rather than copied because repository redistribution rights are not established here. +The standards constrain trust, secure-development, verification and deployment decisions. The microservices evidence is used narrowly to prevent decomposition-by-file-size: split deployables only when responsibility, scaling, transaction, isolation, or reuse evidence justifies the operational cost. ## Quality, security, and release gates Wardnet-owned production code targets 100% statement and branch coverage and complete public rustdoc/docstrings. Security-critical changes require hostile/bypass/replay/race/DoS/network/cleanup tests and current-source verification of every review finding. Coverage exclusions, source rewriting, skipped required paths, or green statuses bound to a different revision are not acceptable evidence. -Material architecture/security decisions must retain current NIST/OWASP/CWE/OCI/Linux/IETF or other authoritative primary standards and relevant peer-reviewed research in APA 7 traceability. Provider/vendor schemas stay behind adapters; research or scanner output does not become domain authority. - A release is not authorized. Wardnet has no GitHub release at this snapshot and production gate issue #87 remains open. Release requires one exact integrated protected head with required CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence and immutable artifact identity. No active PR stack or readiness document substitutes for that evidence. ## Next execution order -1. Drive #145 through exact-head CI/Fuzz/Security/SAST and current review-policy evidence because it repairs the repository-owned runner selector and unblocks trustworthy regeneration of the older queue. Do not bypass the separate approval-count defect. -2. Continue exact-current-head repairs while #145/provider lanes execute; #142's HELP-text correctness finding is the immediate current review defect, while #144's line-level legacy-path review defect is repaired on its latest head. -3. Let `.github` continue independent central/provider runner acquisition work through #712 and the structurally impossible solo-maintainer approval count through #772. Revalidate unchanged Wardnet heads afterward rather than changing product source merely to retrigger infrastructure. -4. Integrate immediate security roots in dependency-safe order as their exact gates become valid: #138 fail-closed runtime authentication and #136 destination-policy slice, while #144 completes the already-hardened #75 path migration. #137 is protected truth and is no longer an open dependency. -5. Finish #129 as one Agent Artifact Admission bounded context without absorbing hostile execution isolation or Agent/LLM orchestration. -6. Drain clean supporting PRs such as #77, #90, #93, #131, #134, #135, #140, and #141 when normal protected merge becomes available under current exact evidence. -7. Continue production-readiness work through #80/#81/#82/#83/#86/#84/#85 rather than widening unrelated feature scope. -8. Keep this baseline current when live queue topology, protected truth, release state, or responsibility boundaries materially change. +1. Drive clean runner root #147 through fresh exact-head repository and central evidence while `.github#712` continues the independent central/provider acquisition repair and `.github#772` repairs solo-maintainer governance. +2. Keep working independent security/product lanes during queue waits. #142's HELP-text defect is fixed on `e7ef34d…`; #148 preserves the trusted-proxy security delta on top of #147; both require fresh replacement-head evidence. +3. Integrate immediate security roots as exact gates become valid: #138 fail-closed runtime authentication and #136 destination-policy slice. Keep #144 main-based so its enabled auto-merge cannot accidentally integrate into a feature branch. +4. Finish #129 as one Agent Artifact Admission bounded context without absorbing hostile execution isolation or Agent/LLM orchestration. +5. Drain clean supporting work such as #77, #90, #93, #134, #135, #140, #141 and #146 when live exact evidence permits. +6. Decompose/reconstruct #95's still-valuable PostgreSQL/outbox/Coraza evidence into bounded #80/#81/#86 successor lanes rather than merging the combined stale branch. +7. Continue #82/#83/#84/#85 production-readiness work only after their declared dependencies are protected truth. +8. Keep this baseline current whenever protected truth, queue topology, release state, or responsibility boundaries materially change. From 2074c84ce7f80c94712a3fd1abf3f0e810e64a5e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 07:06:58 +0900 Subject: [PATCH 19/73] docs(gaps): refresh clean replacement stack --- docs/product-technical-gap-baseline.md | 34 ++++++++++++++------------ 1 file changed, 18 insertions(+), 16 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 4a09d3ab..1a631527 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -16,19 +16,21 @@ Protected/default `main` is `cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128` at this s Organization ruleset `18156473` targets `~DEFAULT_BRANCH`. Its pull-request rule currently requires one approving review, dismisses stale approvals, requires review-thread resolution, has no named required reviewer/team, no code-owner review requirement, and no last-push approval requirement. It also requires central workflow evidence for review, scheduling, security, Strix, Semgrep, and Noema plus deletion/non-fast-forward protection. -The bare approval-count requirement is structurally inconsistent with the declared solo-maintainer operating model when no eligible independent human exists. That is a central `.github` governance defect, not a Wardnet product gap and not a request to invent a reviewer. Self-approval and bot/model-as-human approval remain forbidden. `.github#772` and its executable governance PR own the minimum repair while preserving deterministic workflow/security/coverage/package/SBOM/provenance/thread/branch-integrity controls. +The bare approval-count requirement is structurally inconsistent with the declared solo-maintainer operating model when no eligible independent human exists. That is a central `.github` governance defect, not a Wardnet product gap and not a request to invent a reviewer. Self-approval and bot/model-as-human approval remain forbidden. `.github#772` owns the minimum repair while preserving deterministic workflow/security/coverage/package/SBOM/provenance/thread/branch-integrity controls. -Runner acquisition has both a Wardnet-owned deterministic selector repair and an independent central/provider lane. Clean replacement PR #147 pins Wardnet runner-backed CI, Fuzz, and Scorecard jobs to explicit `ubuntu-24.04` and carries the permanent regression that rejects `ubuntu-latest`. Its exact head is `2d41c4079f9a4465c3142a0aa2dd5895cb11f793`. Earlier repository-owned runs on this exact commit proved that the explicit selector can acquire a real hosted runner and complete CI/Fuzz/Security/SAST, but fresh PR #147 runs are again queued and therefore non-passing. This does not establish the former floating alias as the sole cause; `.github#712` retains the central/provider runner-capacity and dispatch defect class. +Runner acquisition has a Wardnet-owned selector repair and an independent central/provider lane. Clean runner root PR #149 pins every Wardnet CI/Fuzz/Scorecard `runs-on:` declaration to explicit `ubuntu-24.04` and carries a regression that rejects any other runner value. Its exact head is `b663f9d200e5f385c7dd067d074940a02836c68e`. On that same source revision, repository-owned CI/Fuzz/Security/SAST has previously completed successfully, proving the explicit label itself is supported; fresh #149-triggered runs are again queued and therefore non-passing. -The original runner PR #145 is closed and superseded. Its source branch was accidentally used as a feature-stack integration target, which expanded the branch beyond the four runner-control files. No protected-main merge occurred. The bounded runner delta is preserved by #147. +A current central required-workflow run narrowed the remaining acquisition defect further. In Required OpenCode Review run `33550235908`, `cancel-superseded-opencode-review-runs` job `99997591272` and `required-workflow-bootstrap` job `99997591649` both acquired `ubuntu-24.04` hosted runners and completed, while downstream `coverage-source-tree` job `100011182700` remained queued with `runner_id=0`, an empty runner name/group, and zero steps. This is lane-specific central scheduling/control-plane evidence, not a Wardnet source failure. `.github#712` owns that causal repair. + +An intermediate stack repair exposed an unsafe interaction between PR base retargeting and previously enabled auto-merge. Former support PR #146 was retargeted from `main` to the then-runner feature branch; its existing auto-merge immediately merged the support delta into that feature branch, closing #146 and contaminating former runner PR #147. Protected `main` was not modified. Recovery was non-destructive: #147 was closed; #149 preserves the exact runner-only head, #150 preserves the support-bundle delta as a child of #149, #151 preserves trusted-proxy work on clean #149, and #152 reconstructs readiness metrics on clean #149. Future base retargets must inspect auto-merge state first and must never use an unprotected feature branch as final integration truth. ## Live delivery queue The fresh inventory contains 23 open PRs including this baseline PR: -`#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #138, #140, #141, #142, #144, #146, #147, #148`. +`#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #138, #140, #141, #144, #149, #150, #151, #152`. -PR #126 is closed and superseded by #141. PR #137 is merged into protected `main`. PR #131 is closed after its trusted-proxy delta was integrated only into the obsolete #145 feature branch; it did not reach protected `main`. Canonical trusted-proxy delivery is replacement PR #148. PR #145 is closed as superseded by clean replacement #147. +PR #126 is closed and superseded by #141. PR #137 is merged into protected `main`. PRs #131, #142, #145, #146, #147, and #148 are closed/superseded; their unique semantic deltas are preserved by the live replacements named below. No closed/predecessor check or review evidence transfers to a replacement PR. Key exact-current candidates verified during this refresh: @@ -38,11 +40,11 @@ Key exact-current candidates verified during this refresh: | #136 outbound destination hardening | `b07d0d734fc41ec9f38beec7834bea78fa70cd6a` | Ready | Shared URL validation, DNS-address validation/pinning, no ambient proxy, no automatic redirects, and bounded pinned-client lifecycle remain partial progress toward #79; versioned allowlist/deny precedence and complete connector parity remain open. | | #138 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready | Review findings are resolved; regenerate exact-head evidence under current runner/governance truth before merge. | | #140 runtime configuration snapshot | `492fba145b2b501b3fffcf9e664f40d3ae9c12fa` | Ready | Runtime Configuration remains a supporting bootstrap boundary distinct from secret-bearing Credential Registry; fresh exact-head evidence remains required. | -| #142 readiness metrics | `e7ef34d9f2c5d31873d7c09889b302279e8a4162` | Ready, stacked on #147 | The Prometheus HELP-text defect is resolved: `0` means no write-capable credential is configured while readonly auth may still exist. The branch non-destructively incorporates #147's runner prerequisite; fresh exact-head CI/Fuzz/Security/SAST are non-passing while queued. | -| #144 Kubernetes manifest path | `6cd0b16052fb8c35487c9da8ce96a3d17462371b` | Ready, main-based | Repository-path-only migration preserves #137's hardened Secret contract and live Kubernetes identities. Auto-merge is enabled, so keep this PR on protected `main`; do not retarget it to an unprotected feature base. | -| #146 support-bundle operability evidence | `28606b28b01df900d03ddeb3df7cb037fb3804da` | Ready | Adds readiness/metrics evidence to support-bundle and buyer-evidence surfaces. Treat as an independent concurrent lane and revalidate overlap before mutation. | -| #147 explicit hosted runner | `2d41c4079f9a4465c3142a0aa2dd5895cb11f793` | Ready, replacement root | Clean four-file runner-only replacement for superseded #145. Fresh PR-triggered CI/Fuzz/Security/SAST runs are queued; earlier same-commit successes are provenance, not substitute for current required evidence. | -| #148 trusted proxy attribution | `72ac1a2a2902a10aabc6e20169b9ae89adb5f9c8` | Ready, stacked on #147 | Replacement for #131. The merged tree preserves explicit `ubuntu-24.04` and the trusted-proxy fuzz target. Fresh replacement-PR evidence is required; predecessor #131 review/check results do not transfer. | +| #144 Kubernetes manifest path + public docs | `4b9869f015e552fe5c05c740162466b8d0539f88` | Ready, main-based | Repository-path migration preserves #137's hardened Secret contract and live Kubernetes identities; exact-head review thread is resolved. Keep main-based because auto-merge is enabled; never retarget to an unprotected feature branch. | +| #149 explicit hosted runner | `b663f9d200e5f385c7dd067d074940a02836c68e` | Ready, clean stack root | Exact four-file runner-only replacement. Fresh #149 repository runs are queued; prior same-SHA successes prove label support but are not current PR evidence. Central downstream coverage/review acquisition remains owned by `.github#712`. | +| #150 support-bundle operability evidence | `9ee83d6aa8ec2906bc31b799580ef3dbe07d088b` | Ready, stacked on #149 | Preserves former #146's six-file support/readiness/metrics delta as exactly one commit on #149. After #149 reaches protected `main`, retarget to fresh `main` and reacquire all base-sensitive evidence. | +| #151 trusted proxy attribution | `2ce83840bfc1b8d97cd707ffdaeca93efb4bbbf8` | Ready, stacked on #149 | Clean replacement for stale-base #148. Fresh comparison against #149 head reports `behind_by=0` and exactly 13 trusted-proxy/fuzz/runtime files. | +| #152 readiness metrics | `387a447f856093d02116dfadcf2c4a4a63c6d3ba` | Ready, stacked on #149 | Non-destructive reconstruction of reviewed #142 semantics on final clean runner head. Fresh comparison reports `behind_by=0` and exactly four observability files; all new PR evidence must be regenerated. | Do not transfer checks, reviews, approvals, artifacts, or source-review conclusions across a head, base, retarget, restack, replacement PR, or protected-base movement. `queued`, `pending`, `skipped`, `cancelled`, `absent`, stale, predecessor-head, status-only, model-only, or synthetic evidence is non-passing. @@ -53,10 +55,10 @@ There are 17 open issues at this snapshot: `#11, #38, #74, #75, #78, #79, #80, # 1. **Immediate exposure controls:** #78 fail-closed management auth, #79 fail-closed destination policy, #11 real attack-path CI, and #75's repository-path migration implemented by #144 on protected #137 truth. 2. **Security admission:** #128 Agent Artifact Admission; protected `main` cannot claim this control until #129 integrates. 3. **Durable authority and effects:** #80 PostgreSQL production authority and tenant isolation, then #81 transactional outbox/leased workers. -4. **Identity and overload:** #82 Keyverse-backed identity/authorization/approval and #83 distributed/global admission authority with bounded local protection. #148 is the current trusted-network-identity slice of #83; it does not close distributed admission. +4. **Identity and overload:** #82 Keyverse-backed identity/authorization/approval and #83 distributed/global admission authority with bounded local protection. #151 is the current trusted-network-identity slice of #83; it does not close distributed admission. 5. **Proven security engines:** #86 Coraza/CRS and Suricata production enforcement with reproducible detection/false-positive evidence. 6. **Immutable delivery and operation:** #84 signed/SBOM/provenance release promotion and rollback, then #85 OpenTelemetry/SLO/incident/restore evidence. -7. **Supporting correctness:** #74 deterministic persistence-failure testing, #77 pinned compiler, #139 coherent runtime configuration, #75 post-hardening Kubernetes filename migration, and #147 deterministic hosted-runner selection. +7. **Supporting correctness:** #74 deterministic persistence-failure testing, #77 pinned compiler, #139 coherent runtime configuration, #75 post-hardening Kubernetes filename migration, and #149 deterministic hosted-runner selection. Do not close an issue from predecessor evidence. Close only after the owning protected merge satisfies the issue acceptance contract. @@ -70,7 +72,7 @@ Network-Egress remains incomplete after #136. Issue #79 still requires reusable The old #95 branch is not an acceptable production-integration vehicle. It is a large, diverged, non-mergeable branch that combines Coraza, PostgreSQL, outbox, egress and release responsibilities. Its unique tested deltas are preservation evidence for bounded successor work, not permission to merge a cross-context god-PR. #80, #81 and #86 remain unshipped on protected `main` and should be reconstructed/decomposed responsibility-first without losing unique tests or evidence. -Context Fabric integration remains release-gated. `context-graph-contracts` and `enterprise-architecture-core` are read-only from Wardnet while their dedicated writer is active, and neither currently has a release. Wardnet consumes only released compatible Context Graph contracts with conformance/admission evidence; sibling PR heads are candidate evidence, never production authority. EA projections may carry application/service/API/runtime technology identity, lifecycle, ownership, risk, remediation and transformation references, but not malware verdicts, artifact risk scores, prompts, or customer/runtime truth as authoritative architecture facts. +Context Fabric integration remains release-gated. `context-graph-contracts` and `enterprise-architecture-core` are read-only from Wardnet while their dedicated writer is active. Wardnet consumes only released compatible Context Graph contracts with conformance/admission evidence; sibling PR heads are candidate evidence, never production authority. EA projections may carry application/service/API/runtime technology identity, lifecycle, ownership, risk, remediation and transformation references, but not malware verdicts, artifact risk scores, prompts, or customer/runtime truth as authoritative architecture facts. ## Research and standards grounding @@ -91,11 +93,11 @@ A release is not authorized. Wardnet has no GitHub release at this snapshot and ## Next execution order -1. Drive clean runner root #147 through fresh exact-head repository and central evidence while `.github#712` continues the independent central/provider acquisition repair and `.github#772` repairs solo-maintainer governance. -2. Keep working independent security/product lanes during queue waits. #142's HELP-text defect is fixed on `e7ef34d…`; #148 preserves the trusted-proxy security delta on top of #147; both require fresh replacement-head evidence. +1. Drive clean runner root #149 through fresh exact-head repository and central evidence while `.github#712` repairs the lane-specific downstream runner/control-plane failure and `.github#772` repairs solo-maintainer governance. +2. Keep independent work moving while #149 waits. #150, #151, and #152 preserve support, trusted-proxy, and readiness-metrics deltas on clean #149 without predecessor-evidence reuse. 3. Integrate immediate security roots as exact gates become valid: #138 fail-closed runtime authentication and #136 destination-policy slice. Keep #144 main-based so its enabled auto-merge cannot accidentally integrate into a feature branch. 4. Finish #129 as one Agent Artifact Admission bounded context without absorbing hostile execution isolation or Agent/LLM orchestration. -5. Drain clean supporting work such as #77, #90, #93, #134, #135, #140, #141 and #146 when live exact evidence permits. +5. Drain clean supporting work such as #77, #90, #93, #134, #135, #140, #141, #150, #151, and #152 when live exact evidence permits. 6. Decompose/reconstruct #95's still-valuable PostgreSQL/outbox/Coraza evidence into bounded #80/#81/#86 successor lanes rather than merging the combined stale branch. 7. Continue #82/#83/#84/#85 production-readiness work only after their declared dependencies are protected truth. 8. Keep this baseline current whenever protected truth, queue topology, release state, or responsibility boundaries materially change. From 6341b41ee216bcd8c777b39e0bbe6dad820dd6a4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 07:40:20 +0900 Subject: [PATCH 20/73] docs(gaps): refresh support and trusted-proxy repair heads --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 1a631527..2ce38128 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -42,8 +42,8 @@ Key exact-current candidates verified during this refresh: | #140 runtime configuration snapshot | `492fba145b2b501b3fffcf9e664f40d3ae9c12fa` | Ready | Runtime Configuration remains a supporting bootstrap boundary distinct from secret-bearing Credential Registry; fresh exact-head evidence remains required. | | #144 Kubernetes manifest path + public docs | `4b9869f015e552fe5c05c740162466b8d0539f88` | Ready, main-based | Repository-path migration preserves #137's hardened Secret contract and live Kubernetes identities; exact-head review thread is resolved. Keep main-based because auto-merge is enabled; never retarget to an unprotected feature branch. | | #149 explicit hosted runner | `b663f9d200e5f385c7dd067d074940a02836c68e` | Ready, clean stack root | Exact four-file runner-only replacement. Fresh #149 repository runs are queued; prior same-SHA successes prove label support but are not current PR evidence. Central downstream coverage/review acquisition remains owned by `.github#712`. | -| #150 support-bundle operability evidence | `9ee83d6aa8ec2906bc31b799580ef3dbe07d088b` | Ready, stacked on #149 | Preserves former #146's six-file support/readiness/metrics delta as exactly one commit on #149. After #149 reaches protected `main`, retarget to fresh `main` and reacquire all base-sensitive evidence. | -| #151 trusted proxy attribution | `2ce83840bfc1b8d97cd707ffdaeca93efb4bbbf8` | Ready, stacked on #149 | Clean replacement for stale-base #148. Fresh comparison against #149 head reports `behind_by=0` and exactly 13 trusted-proxy/fuzz/runtime files. | +| #150 support-bundle operability evidence | `76037b8ae206ace8dab0e6622dfc9fc88c57deb3` | Ready, stacked on #149 | Preserves former #146's six-file support/readiness/metrics delta on #149. Current-head review repaired the documentation contract: live `/readyz` and `/metrics` snapshots are in the support bundle, while the evidence manifest lists endpoint metadata. After #149 reaches protected `main`, retarget to fresh `main` and reacquire all base-sensitive evidence. | +| #151 trusted proxy attribution | `cd394176e6f34ecbe867ca35603572d1ea2025c4` | Ready, stacked on #149, RED repair head | Clean replacement for stale-base #148. Two verified current-head defects are now pinned by hostile regression tests: direct `build_app` serving must remain compatible without trusting forwarded headers, and one malformed `X-Forwarded-For` hop must invalidate the complete forwarded chain instead of permitting `X-Real-IP` fallback. The production causal fix and exact-head GREEN remain required. | | #152 readiness metrics | `387a447f856093d02116dfadcf2c4a4a63c6d3ba` | Ready, stacked on #149 | Non-destructive reconstruction of reviewed #142 semantics on final clean runner head. Fresh comparison reports `behind_by=0` and exactly four observability files; all new PR evidence must be regenerated. | Do not transfer checks, reviews, approvals, artifacts, or source-review conclusions across a head, base, retarget, restack, replacement PR, or protected-base movement. `queued`, `pending`, `skipped`, `cancelled`, `absent`, stale, predecessor-head, status-only, model-only, or synthetic evidence is non-passing. From cb962cc15e97ea26319f9f9db3208dc5cd845ebc Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 09:47:27 +0900 Subject: [PATCH 21/73] docs(gaps): refresh exact Wardnet delivery evidence --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 2ce38128..7da95228 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -37,13 +37,13 @@ Key exact-current candidates verified during this refresh: | PR | Exact head | Current classification | Evidence / next causal action | | --- | --- | --- | --- | | #129 Agent Artifact Admission | `704e222a5d0e3f2951486eda46fa1ae6b5b0e9e6` | Draft | Feature branch is synchronized with protected `main`; keep Draft until every applicable exact-head repository/security/coverage/package/review-policy gate is terminal and current. | -| #136 outbound destination hardening | `b07d0d734fc41ec9f38beec7834bea78fa70cd6a` | Ready | Shared URL validation, DNS-address validation/pinning, no ambient proxy, no automatic redirects, and bounded pinned-client lifecycle remain partial progress toward #79; versioned allowlist/deny precedence and complete connector parity remain open. | +| #136 outbound destination hardening | `b07d0d734fc41ec9f38beec7834bea78fa70cd6a` | Ready | Shared URL validation, DNS-address validation/pinning, no ambient proxy, no automatic redirects, and bounded pinned-client lifecycle remain partial progress toward #79. Repository CI `33501410418`, Fuzz `33501410345`, Security Scan `33501410275`, and SAST Semgrep `33501410435` are terminal-success on this exact head; central `coverage-source-tree` remains queued, so merge admission is still non-passing. Versioned allowlist/deny precedence and complete connector parity remain open. | | #138 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready | Review findings are resolved; regenerate exact-head evidence under current runner/governance truth before merge. | | #140 runtime configuration snapshot | `492fba145b2b501b3fffcf9e664f40d3ae9c12fa` | Ready | Runtime Configuration remains a supporting bootstrap boundary distinct from secret-bearing Credential Registry; fresh exact-head evidence remains required. | | #144 Kubernetes manifest path + public docs | `4b9869f015e552fe5c05c740162466b8d0539f88` | Ready, main-based | Repository-path migration preserves #137's hardened Secret contract and live Kubernetes identities; exact-head review thread is resolved. Keep main-based because auto-merge is enabled; never retarget to an unprotected feature branch. | | #149 explicit hosted runner | `b663f9d200e5f385c7dd067d074940a02836c68e` | Ready, clean stack root | Exact four-file runner-only replacement. Fresh #149 repository runs are queued; prior same-SHA successes prove label support but are not current PR evidence. Central downstream coverage/review acquisition remains owned by `.github#712`. | | #150 support-bundle operability evidence | `76037b8ae206ace8dab0e6622dfc9fc88c57deb3` | Ready, stacked on #149 | Preserves former #146's six-file support/readiness/metrics delta on #149. Current-head review repaired the documentation contract: live `/readyz` and `/metrics` snapshots are in the support bundle, while the evidence manifest lists endpoint metadata. After #149 reaches protected `main`, retarget to fresh `main` and reacquire all base-sensitive evidence. | -| #151 trusted proxy attribution | `cd394176e6f34ecbe867ca35603572d1ea2025c4` | Ready, stacked on #149, RED repair head | Clean replacement for stale-base #148. Two verified current-head defects are now pinned by hostile regression tests: direct `build_app` serving must remain compatible without trusting forwarded headers, and one malformed `X-Forwarded-For` hop must invalidate the complete forwarded chain instead of permitting `X-Real-IP` fallback. The production causal fix and exact-head GREEN remain required. | +| #151 trusted proxy attribution | `65a2b7fbf2827f69ae1aa288696b6c5630af28c4` | Ready, stacked on #149 | Clean replacement for stale-base #148. Direct `build_app(state)` now remains compatible without treating forwarded headers as trusted when peer metadata is absent, and any malformed/empty `X-Forwarded-For` hop invalidates the complete forwarded chain instead of falling through to `X-Real-IP`. The focused source-fix regressions passed on the repaired lineage, all current review threads are resolved, and fresh exact-head CI `33575028581` / Fuzz `33575028571` are queued and therefore non-passing. | | #152 readiness metrics | `387a447f856093d02116dfadcf2c4a4a63c6d3ba` | Ready, stacked on #149 | Non-destructive reconstruction of reviewed #142 semantics on final clean runner head. Fresh comparison reports `behind_by=0` and exactly four observability files; all new PR evidence must be regenerated. | Do not transfer checks, reviews, approvals, artifacts, or source-review conclusions across a head, base, retarget, restack, replacement PR, or protected-base movement. `queued`, `pending`, `skipped`, `cancelled`, `absent`, stale, predecessor-head, status-only, model-only, or synthetic evidence is non-passing. From c35c49d989e8e143336761a44b5fb1ab25e19604 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 10:41:47 +0900 Subject: [PATCH 22/73] docs(gaps): refresh security and control-plane state --- docs/product-technical-gap-baseline.md | 30 +++++++++++++++----------- 1 file changed, 17 insertions(+), 13 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 7da95228..fbfc0216 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -18,9 +18,11 @@ Organization ruleset `18156473` targets `~DEFAULT_BRANCH`. Its pull-request rule The bare approval-count requirement is structurally inconsistent with the declared solo-maintainer operating model when no eligible independent human exists. That is a central `.github` governance defect, not a Wardnet product gap and not a request to invent a reviewer. Self-approval and bot/model-as-human approval remain forbidden. `.github#772` owns the minimum repair while preserving deterministic workflow/security/coverage/package/SBOM/provenance/thread/branch-integrity controls. -Runner acquisition has a Wardnet-owned selector repair and an independent central/provider lane. Clean runner root PR #149 pins every Wardnet CI/Fuzz/Scorecard `runs-on:` declaration to explicit `ubuntu-24.04` and carries a regression that rejects any other runner value. Its exact head is `b663f9d200e5f385c7dd067d074940a02836c68e`. On that same source revision, repository-owned CI/Fuzz/Security/SAST has previously completed successfully, proving the explicit label itself is supported; fresh #149-triggered runs are again queued and therefore non-passing. +Runner acquisition has a Wardnet-owned selector repair and independent central/control-plane lanes. Clean runner root PR #149 pins every Wardnet CI/Fuzz/Scorecard `runs-on:` declaration to explicit `ubuntu-24.04` and carries a regression that rejects any other runner value. Its exact head is `b663f9d200e5f385c7dd067d074940a02836c68e`. On that same source revision, repository-owned CI/Fuzz/Security/SAST has previously completed successfully, proving the explicit label itself is supported; fresh #149-triggered runs are again queued and therefore non-passing. -A current central required-workflow run narrowed the remaining acquisition defect further. In Required OpenCode Review run `33550235908`, `cancel-superseded-opencode-review-runs` job `99997591272` and `required-workflow-bootstrap` job `99997591649` both acquired `ubuntu-24.04` hosted runners and completed, while downstream `coverage-source-tree` job `100011182700` remained queued with `runner_id=0`, an empty runner name/group, and zero steps. This is lane-specific central scheduling/control-plane evidence, not a Wardnet source failure. `.github#712` owns that causal repair. +A central Required OpenCode Review run narrowed one remaining acquisition defect. In run `33550235908`, `cancel-superseded-opencode-review-runs` job `99997591272` and `required-workflow-bootstrap` job `99997591649` both acquired `ubuntu-24.04` hosted runners and completed, while downstream `coverage-source-tree` job `100011182700` remained queued with `runner_id=0`, an empty runner name/group, and zero steps. This is lane-specific central scheduling/control-plane evidence, not a Wardnet source failure. `.github#712` owns that causal repair. + +A separate exact-head Required Noema Review run on #149 proves that runner acquisition can succeed while the semantic-review control path still fails. Run `33550235981`, job `99997877526`, acquired a hosted runner, validated `wardnet#149@b663f9d200e5f385c7dd067d074940a02836c68e`, minted the repository-scoped Noema token, booted `contextual-orchestrator`, and passed the `orchestrator/free` preflight. The model then cited line 2 even though it was not an exact changed-side line; deterministic validation correctly rejected that citation, but bounded repair exhausted a 900-second absolute deadline. `.github#1613` owns the causal repair: invalid changed-line identity must terminate as bounded `MODEL_OUTPUT_INVALID`/review-unavailable evidence unless an independently valid source-backed finding exists. Wardnet must not mutate a clean leaf to work around that central defect. An intermediate stack repair exposed an unsafe interaction between PR base retargeting and previously enabled auto-merge. Former support PR #146 was retargeted from `main` to the then-runner feature branch; its existing auto-merge immediately merged the support delta into that feature branch, closing #146 and contaminating former runner PR #147. Protected `main` was not modified. Recovery was non-destructive: #147 was closed; #149 preserves the exact runner-only head, #150 preserves the support-bundle delta as a child of #149, #151 preserves trusted-proxy work on clean #149, and #152 reconstructs readiness metrics on clean #149. Future base retargets must inspect auto-merge state first and must never use an unprotected feature branch as final integration truth. @@ -36,14 +38,14 @@ Key exact-current candidates verified during this refresh: | PR | Exact head | Current classification | Evidence / next causal action | | --- | --- | --- | --- | -| #129 Agent Artifact Admission | `704e222a5d0e3f2951486eda46fa1ae6b5b0e9e6` | Draft | Feature branch is synchronized with protected `main`; keep Draft until every applicable exact-head repository/security/coverage/package/review-policy gate is terminal and current. | -| #136 outbound destination hardening | `b07d0d734fc41ec9f38beec7834bea78fa70cd6a` | Ready | Shared URL validation, DNS-address validation/pinning, no ambient proxy, no automatic redirects, and bounded pinned-client lifecycle remain partial progress toward #79. Repository CI `33501410418`, Fuzz `33501410345`, Security Scan `33501410275`, and SAST Semgrep `33501410435` are terminal-success on this exact head; central `coverage-source-tree` remains queued, so merge admission is still non-passing. Versioned allowlist/deny precedence and complete connector parity remain open. | -| #138 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready | Review findings are resolved; regenerate exact-head evidence under current runner/governance truth before merge. | -| #140 runtime configuration snapshot | `492fba145b2b501b3fffcf9e664f40d3ae9c12fa` | Ready | Runtime Configuration remains a supporting bootstrap boundary distinct from secret-bearing Credential Registry; fresh exact-head evidence remains required. | +| #129 Agent Artifact Admission | `03ee83463604a1eafb13a69f4d34a5a21daed82d` | Draft | Fresh hostile-case TDD closes an explicit install-root capability escape: reviewed artifacts can no longer add global/user/prefix/target/root destination overrides and still receive `allow`. OpenAPI/threat-model contracts include stable `alternate_install_root`; exact-head CI `33580275993`, Fuzz `33580275997`, Security `33580276006`, and SAST `33580275992` are queued/pending and therefore non-passing. Keep Draft until all current repository/security/coverage/package/review-policy gates are terminal clean. | +| #136 outbound destination hardening | `edf5e88d84475ce3694e1cc206605a322ba53016` | Ready | Shared URL validation, resolved-address validation/pinning, no ambient proxy, no automatic redirects, bounded pinned-client lifecycle, safe first-hop response filtering, and executable outbound-policy architecture fitness are present. All current review threads are resolved. Fresh exact-head CI `33578188860`, Fuzz `33578188853`, Security `33578188827`, and SAST `33578188887` are queued; explicit versioned allowlist/deny precedence and complete decision-evidence/operator migration work remain open in #79. | +| #138 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready | Repository CI/Fuzz/Security/SAST are terminal GREEN on this exact head and review threads are resolved; central exact-head coverage/review-policy evidence remains independently non-passing until the central control-plane/governance repairs land. | +| #140 runtime configuration snapshot | `43d1b6e9122d8bb5cb882f8fc6e066c63b39ae45` | Ready | Runtime Configuration remains a supporting bootstrap boundary distinct from secret-bearing Credential Registry. Current review threads are resolved; fresh exact-head evidence is required after the latest configuration-seam adjustment. | | #144 Kubernetes manifest path + public docs | `4b9869f015e552fe5c05c740162466b8d0539f88` | Ready, main-based | Repository-path migration preserves #137's hardened Secret contract and live Kubernetes identities; exact-head review thread is resolved. Keep main-based because auto-merge is enabled; never retarget to an unprotected feature branch. | -| #149 explicit hosted runner | `b663f9d200e5f385c7dd067d074940a02836c68e` | Ready, clean stack root | Exact four-file runner-only replacement. Fresh #149 repository runs are queued; prior same-SHA successes prove label support but are not current PR evidence. Central downstream coverage/review acquisition remains owned by `.github#712`. | +| #149 explicit hosted runner | `b663f9d200e5f385c7dd067d074940a02836c68e` | Ready, clean stack root | Exact four-file runner-only replacement. Repository-owned exact-SHA success proves `ubuntu-24.04` support, but fresh PR-specific central evidence remains non-passing. `.github#712` owns downstream runner acquisition, `.github#1613` owns bounded invalid-model-line handling, and `.github#772` owns the solo-maintainer approval-rule mismatch. | | #150 support-bundle operability evidence | `76037b8ae206ace8dab0e6622dfc9fc88c57deb3` | Ready, stacked on #149 | Preserves former #146's six-file support/readiness/metrics delta on #149. Current-head review repaired the documentation contract: live `/readyz` and `/metrics` snapshots are in the support bundle, while the evidence manifest lists endpoint metadata. After #149 reaches protected `main`, retarget to fresh `main` and reacquire all base-sensitive evidence. | -| #151 trusted proxy attribution | `65a2b7fbf2827f69ae1aa288696b6c5630af28c4` | Ready, stacked on #149 | Clean replacement for stale-base #148. Direct `build_app(state)` now remains compatible without treating forwarded headers as trusted when peer metadata is absent, and any malformed/empty `X-Forwarded-For` hop invalidates the complete forwarded chain instead of falling through to `X-Real-IP`. The focused source-fix regressions passed on the repaired lineage, all current review threads are resolved, and fresh exact-head CI `33575028581` / Fuzz `33575028571` are queued and therefore non-passing. | +| #151 trusted proxy attribution | `65a2b7fbf2827f69ae1aa288696b6c5630af28c4` | Ready, stacked on #149 | Clean replacement for stale-base #148. Direct-router and malformed-forwarded-chain defects are repaired; all current review threads are resolved and fresh exact-head CI/Fuzz remain queued/non-passing. | | #152 readiness metrics | `387a447f856093d02116dfadcf2c4a4a63c6d3ba` | Ready, stacked on #149 | Non-destructive reconstruction of reviewed #142 semantics on final clean runner head. Fresh comparison reports `behind_by=0` and exactly four observability files; all new PR evidence must be regenerated. | Do not transfer checks, reviews, approvals, artifacts, or source-review conclusions across a head, base, retarget, restack, replacement PR, or protected-base movement. `queued`, `pending`, `skipped`, `cancelled`, `absent`, stale, predecessor-head, status-only, model-only, or synthetic evidence is non-passing. @@ -53,7 +55,7 @@ Do not transfer checks, reviews, approvals, artifacts, or source-review conclusi There are 17 open issues at this snapshot: `#11, #38, #74, #75, #78, #79, #80, #81, #82, #83, #84, #85, #86, #87, #89, #128, #139`. 1. **Immediate exposure controls:** #78 fail-closed management auth, #79 fail-closed destination policy, #11 real attack-path CI, and #75's repository-path migration implemented by #144 on protected #137 truth. -2. **Security admission:** #128 Agent Artifact Admission; protected `main` cannot claim this control until #129 integrates. +2. **Security admission:** #128 Agent Artifact Admission; protected `main` cannot claim this control until #129 integrates. The current candidate additionally blocks package-manager destination overrides that would widen a reviewed workspace install into a global/user/alternate-root mutation. 3. **Durable authority and effects:** #80 PostgreSQL production authority and tenant isolation, then #81 transactional outbox/leased workers. 4. **Identity and overload:** #82 Keyverse-backed identity/authorization/approval and #83 distributed/global admission authority with bounded local protection. #151 is the current trusted-network-identity slice of #83; it does not close distributed admission. 5. **Proven security engines:** #86 Coraza/CRS and Suricata production enforcement with reproducible detection/false-positive evidence. @@ -64,7 +66,9 @@ Do not close an issue from predecessor evidence. Close only after the owning pro ## DDD and implementation gaps -Agent Artifact Admission has a responsibility-aligned crate under `crates/agent-artifact-admission` on #129 with domain-policy independence tests. Protected `main` does not yet contain that control. The legacy gateway remains concentrated in root `src/lib.rs`; file size alone is not a service boundary, but repeated changes to client attribution, outbound policy, runtime configuration, proxying, SOC integration, rate limiting, support evidence, and management APIs show genuine responsibility-convergence pressure. Structural work must add responsibility/dependency fitness before moving code and should favor a modular monolith until transaction, deployment, scaling, or reuse evidence justifies another deployable. +Agent Artifact Admission has a responsibility-aligned crate under `crates/agent-artifact-admission` on #129 with domain-policy independence tests. Protected `main` does not yet contain that control. The latest candidate treats package-manager destination selection as part of the reviewed command capability: explicit global/user/prefix/target/root overrides fail closed at admission, while actual filesystem/mount/process isolation remains owned by the downstream execution broker/quarantine runtime. This preserves the bounded-context boundary instead of moving hostile execution into Wardnet. + +The legacy gateway remains concentrated in root `src/lib.rs`; file size alone is not a service boundary, but repeated changes to client attribution, outbound policy, runtime configuration, proxying, SOC integration, rate limiting, support evidence, and management APIs show genuine responsibility-convergence pressure. Structural work must add responsibility/dependency fitness before moving code and should favor a modular monolith until transaction, deployment, scaling, or reuse evidence justifies another deployable. #140 is the coherent Runtime Configuration migration. `CredentialRegistry` remains the secret-bearing bootstrap owner. New direct process-environment reads outside approved bootstrap adapters are architecture defects. @@ -72,7 +76,7 @@ Network-Egress remains incomplete after #136. Issue #79 still requires reusable The old #95 branch is not an acceptable production-integration vehicle. It is a large, diverged, non-mergeable branch that combines Coraza, PostgreSQL, outbox, egress and release responsibilities. Its unique tested deltas are preservation evidence for bounded successor work, not permission to merge a cross-context god-PR. #80, #81 and #86 remain unshipped on protected `main` and should be reconstructed/decomposed responsibility-first without losing unique tests or evidence. -Context Fabric integration remains release-gated. `context-graph-contracts` and `enterprise-architecture-core` are read-only from Wardnet while their dedicated writer is active. Wardnet consumes only released compatible Context Graph contracts with conformance/admission evidence; sibling PR heads are candidate evidence, never production authority. EA projections may carry application/service/API/runtime technology identity, lifecycle, ownership, risk, remediation and transformation references, but not malware verdicts, artifact risk scores, prompts, or customer/runtime truth as authoritative architecture facts. +Context Fabric integration remains release-gated. `context-graph-contracts` and `enterprise-architecture-core` are read-only from Wardnet while their dedicated writer is active. At this snapshot both repositories still have no GitHub release, so Wardnet consumes no sibling PR head as a production Context Graph contract. EA projections may carry application/service/API/runtime technology identity, lifecycle, ownership, risk, remediation and transformation references, but not malware verdicts, artifact risk scores, prompts, or customer/runtime truth as authoritative architecture facts. ## Research and standards grounding @@ -93,10 +97,10 @@ A release is not authorized. Wardnet has no GitHub release at this snapshot and ## Next execution order -1. Drive clean runner root #149 through fresh exact-head repository and central evidence while `.github#712` repairs the lane-specific downstream runner/control-plane failure and `.github#772` repairs solo-maintainer governance. +1. Drive clean runner root #149 through fresh exact-head repository and central evidence while `.github#712`, `.github#1613`, and `.github#772` repair their respective runner/review/governance control-plane defects. 2. Keep independent work moving while #149 waits. #150, #151, and #152 preserve support, trusted-proxy, and readiness-metrics deltas on clean #149 without predecessor-evidence reuse. 3. Integrate immediate security roots as exact gates become valid: #138 fail-closed runtime authentication and #136 destination-policy slice. Keep #144 main-based so its enabled auto-merge cannot accidentally integrate into a feature branch. -4. Finish #129 as one Agent Artifact Admission bounded context without absorbing hostile execution isolation or Agent/LLM orchestration. +4. Finish #129 as one Agent Artifact Admission bounded context, including the current alternate-install-root hostile-case repair, without absorbing hostile execution isolation or Agent/LLM orchestration. 5. Drain clean supporting work such as #77, #90, #93, #134, #135, #140, #141, #150, #151, and #152 when live exact evidence permits. 6. Decompose/reconstruct #95's still-valuable PostgreSQL/outbox/Coraza evidence into bounded #80/#81/#86 successor lanes rather than merging the combined stale branch. 7. Continue #82/#83/#84/#85 production-readiness work only after their declared dependencies are protected truth. From 0ef8ab3db60ea50be5c5d8cd824b7922981d6a9f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 11:47:01 +0900 Subject: [PATCH 23/73] docs(gaps): refresh exact-head readiness baseline --- docs/product-technical-gap-baseline.md | 108 ++++++++++++------------- 1 file changed, 54 insertions(+), 54 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index fbfc0216..5f592787 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,107 +1,107 @@ # Product and technical gap baseline -Snapshot date: 2026-09-02. This is a dated GitHub inventory for `ContextualWisdomLab/wardnet`; every later execution must refetch live heads, bases, checks, rules, releases, and foreign-owner state instead of treating this file as scheduler state. +Snapshot date: 2026-09-02. This file is a dated repository snapshot, not scheduler memory. Every later run must refetch live heads, bases, checks, review state, rulesets, releases, and foreign-owner state before acting. ## Product boundary -Wardnet is the Rust-first gateway/SOC control plane and owns Gateway, Admission Policy, Artifact Identity, Security Analysis Integration, Network-Egress, SOC Evidence, Runtime Control, and Audit-Provenance responsibilities. The Agent Artifact Admission Controller is a separate bounded context inside Wardnet's Security Admission subdomain. +Wardnet is the Rust-first gateway/SOC control plane. Its owned responsibilities are Gateway, Admission Policy, Artifact Identity, Security Analysis Integration, Network-Egress, SOC Evidence, Runtime Control, and Audit-Provenance. The Agent Artifact Admission Controller is a separate bounded context inside Wardnet's Security Admission subdomain. -Quarantine Sandbox Runtime owns hostile-workload execution isolation. `contextual-orchestrator` owns Agent/LLM orchestration. EgressWeave is the outbound HTTP-policy candidate. Wardnet consumes those capabilities through versioned ports and Anti-Corruption Layers; it must not copy their implementations or access their application databases. +Quarantine Sandbox Runtime owns hostile-workload execution isolation. `contextual-orchestrator` owns Agent/LLM orchestration. EgressWeave is the outbound HTTP-policy candidate. Wardnet consumes those capabilities through versioned ports and Anti-Corruption Layers; it does not copy their implementations or access their application databases. -`context-graph-contracts` is the provider-neutral Context Fabric Shared Kernel for canonical references, authority, truth status/origin, valid/system time, provenance, Context Assertion, CloudEvents/schema/conformance/admission. `enterprise-architecture-core` is the Enterprise Architecture Decision Plane. While the dedicated Context Fabric writer is active, Wardnet treats both repositories as read-only source dependencies and forwards exact architecture/contract evidence through their owner path. Security findings, alerts, malware verdicts, artifact risk scores, prompts, and customer/runtime data do not become authoritative EA facts. +`context-graph-contracts` is the provider-neutral Context Fabric Shared Kernel for canonical references, authority, truth status/origin, valid/system time, provenance, Context Assertion, CloudEvents/schema/conformance/admission. `enterprise-architecture-core` is the Enterprise Architecture Decision Plane. While the dedicated Context Fabric writer is active, both repositories are read-only source dependencies from Wardnet. Security findings, alerts, malware verdicts, artifact risk scores, prompts, and customer/runtime data do not become authoritative EA facts. ## Protected truth and governance -Protected/default `main` is `cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128` at this snapshot. That head contains PR #137's externally provisioned, non-optional administrator Secret boundary. Wardnet still has no GitHub release. +Protected/default Wardnet `main` is `cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. It contains PR #137's externally provisioned, non-optional administrator Secret boundary. Wardnet currently has no GitHub Release. -Organization ruleset `18156473` targets `~DEFAULT_BRANCH`. Its pull-request rule currently requires one approving review, dismisses stale approvals, requires review-thread resolution, has no named required reviewer/team, no code-owner review requirement, and no last-push approval requirement. It also requires central workflow evidence for review, scheduling, security, Strix, Semgrep, and Noema plus deletion/non-fast-forward protection. +Organization ruleset `18156473` targets `~DEFAULT_BRANCH`. It requires one approving review, dismisses stale approvals, requires review-thread resolution, names no required reviewer/team, does not require code-owner or last-push approval, and also requires central review/security workflow evidence plus deletion/non-fast-forward protection. -The bare approval-count requirement is structurally inconsistent with the declared solo-maintainer operating model when no eligible independent human exists. That is a central `.github` governance defect, not a Wardnet product gap and not a request to invent a reviewer. Self-approval and bot/model-as-human approval remain forbidden. `.github#772` owns the minimum repair while preserving deterministic workflow/security/coverage/package/SBOM/provenance/thread/branch-integrity controls. +The bare approval-count requirement is structurally inconsistent with the declared solo-maintainer operating model when no eligible independent human exists. This is a central `.github` governance defect, not a Wardnet staffing/product defect. Self-approval and bot/model-as-human approval remain forbidden. `.github#772` owns the minimum repair while deterministic workflow/security/coverage/package/SBOM/provenance/thread/branch-integrity controls stay enforced. -Runner acquisition has a Wardnet-owned selector repair and independent central/control-plane lanes. Clean runner root PR #149 pins every Wardnet CI/Fuzz/Scorecard `runs-on:` declaration to explicit `ubuntu-24.04` and carries a regression that rejects any other runner value. Its exact head is `b663f9d200e5f385c7dd067d074940a02836c68e`. On that same source revision, repository-owned CI/Fuzz/Security/SAST has previously completed successfully, proving the explicit label itself is supported; fresh #149-triggered runs are again queued and therefore non-passing. +Runner/control-plane work is split by ownership. Wardnet PR #149 pins every repository-owned CI/Fuzz/Scorecard `runs-on:` declaration to explicit `ubuntu-24.04` and rejects drift with a contract test. Its exact head `b663f9d200e5f385c7dd067d074940a02836c68e` has terminal-success repository CI/Fuzz/Security/SAST on the same SHA, proving the explicit hosted label works. Current central coverage/OpenCode lanes remain queued/non-passing, so `.github#712` remains the central acquisition/control-plane owner. -A central Required OpenCode Review run narrowed one remaining acquisition defect. In run `33550235908`, `cancel-superseded-opencode-review-runs` job `99997591272` and `required-workflow-bootstrap` job `99997591649` both acquired `ubuntu-24.04` hosted runners and completed, while downstream `coverage-source-tree` job `100011182700` remained queued with `runner_id=0`, an empty runner name/group, and zero steps. This is lane-specific central scheduling/control-plane evidence, not a Wardnet source failure. `.github#712` owns that causal repair. +Exact-head central review failures are tracked separately from source findings. On #138, Noema job `99848830883` reached model review and failed because the returned payload was malformed JSON; `.github#1637` owns typed fail-closed handling. Strix job `99848826685` materialized the exact head and passed gateway preflight but all bounded scanner LLM attempts were provider-unavailable, so no authoritative scan evidence existed; `.github#891` owns the scanner/readiness recovery contract. Wardnet must not mutate clean product source to satisfy either infrastructure failure. -A separate exact-head Required Noema Review run on #149 proves that runner acquisition can succeed while the semantic-review control path still fails. Run `33550235981`, job `99997877526`, acquired a hosted runner, validated `wardnet#149@b663f9d200e5f385c7dd067d074940a02836c68e`, minted the repository-scoped Noema token, booted `contextual-orchestrator`, and passed the `orchestrator/free` preflight. The model then cited line 2 even though it was not an exact changed-side line; deterministic validation correctly rejected that citation, but bounded repair exhausted a 900-second absolute deadline. `.github#1613` owns the causal repair: invalid changed-line identity must terminate as bounded `MODEL_OUTPUT_INVALID`/review-unavailable evidence unless an independently valid source-backed finding exists. Wardnet must not mutate a clean leaf to work around that central defect. +A prior base-retarget incident showed that enabled auto-merge can immediately integrate a child into a temporary feature-branch base. Recovery was non-destructive: #149 is the clean runner root; #150 preserves support-bundle work, #151 trusted-proxy work, and #152 readiness-metrics work as clean descendants. Future retargets must inspect auto-merge state first and must not use an unprotected feature branch as final integration truth. -An intermediate stack repair exposed an unsafe interaction between PR base retargeting and previously enabled auto-merge. Former support PR #146 was retargeted from `main` to the then-runner feature branch; its existing auto-merge immediately merged the support delta into that feature branch, closing #146 and contaminating former runner PR #147. Protected `main` was not modified. Recovery was non-destructive: #147 was closed; #149 preserves the exact runner-only head, #150 preserves the support-bundle delta as a child of #149, #151 preserves trusted-proxy work on clean #149, and #152 reconstructs readiness metrics on clean #149. Future base retargets must inspect auto-merge state first and must never use an unprotected feature branch as final integration truth. +## Context Fabric live boundary + +Fresh repository metadata still reports `develop` as the default branch for both `ContextualWisdomLab/context-graph-contracts` and `ContextualWisdomLab/enterprise-architecture-core`. Both currently expose zero GitHub Releases. The accepted protected-`main` transition and ruleset repair are therefore Context Fabric/central `.github` owner work, not a Wardnet source mutation. + +Wardnet must not consume an open Context Fabric PR head as a production dependency. Deployable application/service/API/runtime technology identity, lifecycle, ownership, risk, remediation, and transformation may be projected only through a released compatible Context Assertion/CloudEvent/API contract with provenance. Individual security findings and artifact verdicts remain Wardnet security evidence. ## Live delivery queue -The fresh inventory contains 23 open PRs including this baseline PR: +Fresh inventory contains 23 open PRs: `#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #138, #140, #141, #144, #149, #150, #151, #152`. -PR #126 is closed and superseded by #141. PR #137 is merged into protected `main`. PRs #131, #142, #145, #146, #147, and #148 are closed/superseded; their unique semantic deltas are preserved by the live replacements named below. No closed/predecessor check or review evidence transfers to a replacement PR. +PR #137 is protected-main truth. Closed/superseded predecessor checks, reviews, approvals, and artifacts do not transfer to replacements or moved heads. -Key exact-current candidates verified during this refresh: - -| PR | Exact head | Current classification | Evidence / next causal action | +| PR | Exact head | Classification | Current evidence / next action | | --- | --- | --- | --- | -| #129 Agent Artifact Admission | `03ee83463604a1eafb13a69f4d34a5a21daed82d` | Draft | Fresh hostile-case TDD closes an explicit install-root capability escape: reviewed artifacts can no longer add global/user/prefix/target/root destination overrides and still receive `allow`. OpenAPI/threat-model contracts include stable `alternate_install_root`; exact-head CI `33580275993`, Fuzz `33580275997`, Security `33580276006`, and SAST `33580275992` are queued/pending and therefore non-passing. Keep Draft until all current repository/security/coverage/package/review-policy gates are terminal clean. | -| #136 outbound destination hardening | `edf5e88d84475ce3694e1cc206605a322ba53016` | Ready | Shared URL validation, resolved-address validation/pinning, no ambient proxy, no automatic redirects, bounded pinned-client lifecycle, safe first-hop response filtering, and executable outbound-policy architecture fitness are present. All current review threads are resolved. Fresh exact-head CI `33578188860`, Fuzz `33578188853`, Security `33578188827`, and SAST `33578188887` are queued; explicit versioned allowlist/deny precedence and complete decision-evidence/operator migration work remain open in #79. | -| #138 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready | Repository CI/Fuzz/Security/SAST are terminal GREEN on this exact head and review threads are resolved; central exact-head coverage/review-policy evidence remains independently non-passing until the central control-plane/governance repairs land. | -| #140 runtime configuration snapshot | `43d1b6e9122d8bb5cb882f8fc6e066c63b39ae45` | Ready | Runtime Configuration remains a supporting bootstrap boundary distinct from secret-bearing Credential Registry. Current review threads are resolved; fresh exact-head evidence is required after the latest configuration-seam adjustment. | -| #144 Kubernetes manifest path + public docs | `4b9869f015e552fe5c05c740162466b8d0539f88` | Ready, main-based | Repository-path migration preserves #137's hardened Secret contract and live Kubernetes identities; exact-head review thread is resolved. Keep main-based because auto-merge is enabled; never retarget to an unprotected feature branch. | -| #149 explicit hosted runner | `b663f9d200e5f385c7dd067d074940a02836c68e` | Ready, clean stack root | Exact four-file runner-only replacement. Repository-owned exact-SHA success proves `ubuntu-24.04` support, but fresh PR-specific central evidence remains non-passing. `.github#712` owns downstream runner acquisition, `.github#1613` owns bounded invalid-model-line handling, and `.github#772` owns the solo-maintainer approval-rule mismatch. | -| #150 support-bundle operability evidence | `76037b8ae206ace8dab0e6622dfc9fc88c57deb3` | Ready, stacked on #149 | Preserves former #146's six-file support/readiness/metrics delta on #149. Current-head review repaired the documentation contract: live `/readyz` and `/metrics` snapshots are in the support bundle, while the evidence manifest lists endpoint metadata. After #149 reaches protected `main`, retarget to fresh `main` and reacquire all base-sensitive evidence. | -| #151 trusted proxy attribution | `65a2b7fbf2827f69ae1aa288696b6c5630af28c4` | Ready, stacked on #149 | Clean replacement for stale-base #148. Direct-router and malformed-forwarded-chain defects are repaired; all current review threads are resolved and fresh exact-head CI/Fuzz remain queued/non-passing. | -| #152 readiness metrics | `387a447f856093d02116dfadcf2c4a4a63c6d3ba` | Ready, stacked on #149 | Non-destructive reconstruction of reviewed #142 semantics on final clean runner head. Fresh comparison reports `behind_by=0` and exactly four observability files; all new PR evidence must be regenerated. | - -Do not transfer checks, reviews, approvals, artifacts, or source-review conclusions across a head, base, retarget, restack, replacement PR, or protected-base movement. `queued`, `pending`, `skipped`, `cancelled`, `absent`, stale, predecessor-head, status-only, model-only, or synthetic evidence is non-passing. +| #129 Agent Artifact Admission | `54e882f7d87a42f3d021d3b153fa5126de4337d7` | Draft | Alternate install-root denial and ambiguous npm script-suppression denial are implemented. CI `33582306622` is queued; Fuzz `33582306555`, Security `33582306597`, and SAST `33582306566` are cancelled/non-passing. Keep Draft and do not retrigger by source churn. | +| #136 Network-Egress | `45484a9c0c9cbf1ad44c49c9f54898fb2d4a1984` | Ready | Shared URL/resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, hop-by-hop response filtering, and architecture fitness are present. CI `33578027483` is queued; Fuzz `33578027532`, Security `33578027587`, and SAST `33578027398` are cancelled/non-passing. #79 still owns explicit allowlist/deny-precedence and decision-evidence completion. | +| #138 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready | Repository CI `33505620035`, Fuzz `33505619939`, Security `33505620205`, and SAST `33505620030` are GREEN. Remaining failures are central Noema/Strix/governance evidence tracked by `.github#1637`, `.github#891`, and `.github#772`. | +| #140 Runtime Configuration | `43d1b6e9122d8bb5cb882f8fc6e066c63b39ae45` | Ready | Current head supersedes the earlier formatting-failing candidate. Security `33556345110` and SAST `33556345038` are GREEN; CI `33556345223` and Fuzz `33556345021` are queued. Runtime Configuration remains a supporting bootstrap boundary distinct from secret-bearing Credential Registry. | +| #144 Kubernetes manifest path + public docs | `4b9869f015e552fe5c05c740162466b8d0539f88` | Ready, main-based | Repository-path migration preserves #137's hardened Secret contract and live Kubernetes identities. Keep main-based and reacquire all exact-head gates before merge. | +| #149 explicit hosted runner | `b663f9d200e5f385c7dd067d074940a02836c68e` | Ready, clean stack root | Repository-owned exact-SHA CI/Fuzz/Security/SAST are GREEN. Current central coverage/OpenCode evidence remains queued/non-passing; `.github#712` and `.github#772` own the remaining control-plane/governance defects. | +| #150 support-bundle operability evidence | `76037b8ae206ace8dab0e6622dfc9fc88c57deb3` | Ready, stacked on #149 | Preserves the six-file support/readiness/metrics delta. After #149 reaches protected `main`, retarget/reconstruct on fresh main and regenerate all base-sensitive evidence. | +| #151 trusted proxy attribution | `65a2b7fbf2827f69ae1aa288696b6c5630af28c4` | Ready, stacked on #149 | Missing-ConnectInfo and malformed-forwarded-chain defects are repaired; current review threads are resolved. Fresh exact-head CI/Fuzz remain queued/non-passing. | +| #152 readiness metrics | `387a447f856093d02116dfadcf2c4a4a63c6d3ba` | Ready, stacked on #149 | Four-file observability delta reconstructed on clean #149. Revalidate only after parent integration. | + +`queued`, `pending`, `skipped`, `cancelled`, `absent`, stale, predecessor-head, status-only, model-only, or synthetic evidence is non-passing. Do not transfer evidence after head/base movement. ## Open issues and production order -There are 17 open issues at this snapshot: `#11, #38, #74, #75, #78, #79, #80, #81, #82, #83, #84, #85, #86, #87, #89, #128, #139`. +Fresh inventory contains 17 open issues: `#11, #38, #74, #75, #78, #79, #80, #81, #82, #83, #84, #85, #86, #87, #89, #128, #139`. -1. **Immediate exposure controls:** #78 fail-closed management auth, #79 fail-closed destination policy, #11 real attack-path CI, and #75's repository-path migration implemented by #144 on protected #137 truth. -2. **Security admission:** #128 Agent Artifact Admission; protected `main` cannot claim this control until #129 integrates. The current candidate additionally blocks package-manager destination overrides that would widen a reviewed workspace install into a global/user/alternate-root mutation. -3. **Durable authority and effects:** #80 PostgreSQL production authority and tenant isolation, then #81 transactional outbox/leased workers. -4. **Identity and overload:** #82 Keyverse-backed identity/authorization/approval and #83 distributed/global admission authority with bounded local protection. #151 is the current trusted-network-identity slice of #83; it does not close distributed admission. -5. **Proven security engines:** #86 Coraza/CRS and Suricata production enforcement with reproducible detection/false-positive evidence. -6. **Immutable delivery and operation:** #84 signed/SBOM/provenance release promotion and rollback, then #85 OpenTelemetry/SLO/incident/restore evidence. -7. **Supporting correctness:** #74 deterministic persistence-failure testing, #77 pinned compiler, #139 coherent runtime configuration, #75 post-hardening Kubernetes filename migration, and #149 deterministic hosted-runner selection. +1. **Immediate exposure controls:** #78 fail-closed management auth, #79 fail-closed destination policy, #11 real attack-path CI, and #75 repository-path migration through #144. +2. **Security admission:** #128 Agent Artifact Admission through #129. Hostile execution remains quarantine-owned. +3. **Durable authority and effects:** #80 PostgreSQL production authority/tenant isolation, then #81 transactional outbox and leased workers. +4. **Identity and overload:** #82 Keyverse-backed identity/authorization/approval and #83 distributed/global admission. #151 is only the trusted-network-identity slice. +5. **Proven security engines:** #86 Coraza/CRS and Suricata production enforcement with detection/false-positive evidence. +6. **Immutable delivery and operation:** #84 signed/SBOM/provenance release promotion/rollback, then #85 OpenTelemetry/SLO/incident/restore evidence. +7. **Supporting correctness:** #74 deterministic persistence fault testing, #77 pinned compiler, #139 coherent runtime configuration, #75 manifest filename migration, and #149 deterministic hosted-runner selection. -Do not close an issue from predecessor evidence. Close only after the owning protected merge satisfies the issue acceptance contract. +Close an issue only after its owning protected merge satisfies the issue acceptance contract on current evidence. ## DDD and implementation gaps -Agent Artifact Admission has a responsibility-aligned crate under `crates/agent-artifact-admission` on #129 with domain-policy independence tests. Protected `main` does not yet contain that control. The latest candidate treats package-manager destination selection as part of the reviewed command capability: explicit global/user/prefix/target/root overrides fail closed at admission, while actual filesystem/mount/process isolation remains owned by the downstream execution broker/quarantine runtime. This preserves the bounded-context boundary instead of moving hostile execution into Wardnet. +Agent Artifact Admission has a responsibility-aligned crate under `crates/agent-artifact-admission` on #129 with domain-policy independence tests. The candidate now treats package-manager destination selection and script-suppression ambiguity as admitted capabilities. Actual filesystem/mount/process isolation remains downstream quarantine/executor responsibility. -The legacy gateway remains concentrated in root `src/lib.rs`; file size alone is not a service boundary, but repeated changes to client attribution, outbound policy, runtime configuration, proxying, SOC integration, rate limiting, support evidence, and management APIs show genuine responsibility-convergence pressure. Structural work must add responsibility/dependency fitness before moving code and should favor a modular monolith until transaction, deployment, scaling, or reuse evidence justifies another deployable. +The legacy gateway remains concentrated in root `src/lib.rs`. File size alone does not justify a deployable split, but repeated changes to client attribution, outbound policy, runtime configuration, proxying, SOC integration, rate limiting, support evidence, and management APIs show genuine responsibility-convergence pressure. Structural work should add dependency/ownership fitness first and prefer a modular monolith until transaction, deployment, scaling, or reuse evidence justifies another deployable. #140 is the coherent Runtime Configuration migration. `CredentialRegistry` remains the secret-bearing bootstrap owner. New direct process-environment reads outside approved bootstrap adapters are architecture defects. -Network-Egress remains incomplete after #136. Issue #79 still requires reusable versioned hostname/suffix/IP/CIDR/scheme/port policy, deterministic deny-overrides precedence, complete connector parity, decision evidence, and operator migration/rollback/diagnostics. - -The old #95 branch is not an acceptable production-integration vehicle. It is a large, diverged, non-mergeable branch that combines Coraza, PostgreSQL, outbox, egress and release responsibilities. Its unique tested deltas are preservation evidence for bounded successor work, not permission to merge a cross-context god-PR. #80, #81 and #86 remain unshipped on protected `main` and should be reconstructed/decomposed responsibility-first without losing unique tests or evidence. +Network-Egress remains incomplete after #136. Issue #79 still requires versioned hostname/suffix/IP/CIDR/scheme/port allowlists, deterministic deny-overrides precedence, connector parity, minimized decision evidence, and operator migration/rollback/diagnostics. -Context Fabric integration remains release-gated. `context-graph-contracts` and `enterprise-architecture-core` are read-only from Wardnet while their dedicated writer is active. At this snapshot both repositories still have no GitHub release, so Wardnet consumes no sibling PR head as a production Context Graph contract. EA projections may carry application/service/API/runtime technology identity, lifecycle, ownership, risk, remediation and transformation references, but not malware verdicts, artifact risk scores, prompts, or customer/runtime truth as authoritative architecture facts. +PR #95 is not an acceptable production integration vehicle. It is a large diverged cross-context branch combining Coraza, PostgreSQL, outbox, egress, and release responsibilities. Preserve its unique tests/evidence while reconstructing bounded #80/#81/#86 successor work rather than merging a god-PR. ## Research and standards grounding -This baseline uses external standards and research as constraints and rationale, not as proof that Wardnet currently implements every control. +External standards constrain design and verification; they do not prove Wardnet currently implements every control. - Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). *Zero trust architecture* (NIST SP 800-207). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-207. - Souppaya, M., Scarfone, K., & Dodson, D. (2022). *Secure Software Development Framework (SSDF) version 1.1* (NIST SP 800-218). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-218. - OWASP Foundation. (2025). *Application Security Verification Standard 5.0.0*. https://owasp.org/www-project-application-security-verification-standard/. - Soldani, J., Tamburri, D. A., & van den Heuvel, W.-J. (2018). The pains and gains of microservices: A systematic grey literature review. *Journal of Systems and Software, 146*, 215–232. https://doi.org/10.1016/j.jss.2018.09.082. -The standards constrain trust, secure-development, verification and deployment decisions. The microservices evidence is used narrowly to prevent decomposition-by-file-size: split deployables only when responsibility, scaling, transaction, isolation, or reuse evidence justifies the operational cost. +The microservices evidence is used narrowly to avoid decomposition-by-file-size: split deployables only when responsibility, scaling, transaction, isolation, or reuse evidence justifies the operating cost. ## Quality, security, and release gates -Wardnet-owned production code targets 100% statement and branch coverage and complete public rustdoc/docstrings. Security-critical changes require hostile/bypass/replay/race/DoS/network/cleanup tests and current-source verification of every review finding. Coverage exclusions, source rewriting, skipped required paths, or green statuses bound to a different revision are not acceptable evidence. +Wardnet-owned production code targets 100% statement and branch coverage and complete public rustdoc/docstrings. Security-critical changes require hostile/bypass/replay/race/DoS/network/cleanup tests and current-source verification of review findings. Coverage exclusions, source rewriting, skipped required paths, or green statuses bound to another revision are not acceptable evidence. -A release is not authorized. Wardnet has no GitHub release at this snapshot and production gate issue #87 remains open. Release requires one exact integrated protected head with required CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence and immutable artifact identity. No active PR stack or readiness document substitutes for that evidence. +A release is not authorized. Wardnet, `context-graph-contracts`, and `enterprise-architecture-core` expose no GitHub Release at this snapshot, and Wardnet production gate #87 remains open. Release requires one exact integrated protected head with CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence and immutable artifact identity. ## Next execution order -1. Drive clean runner root #149 through fresh exact-head repository and central evidence while `.github#712`, `.github#1613`, and `.github#772` repair their respective runner/review/governance control-plane defects. -2. Keep independent work moving while #149 waits. #150, #151, and #152 preserve support, trusted-proxy, and readiness-metrics deltas on clean #149 without predecessor-evidence reuse. -3. Integrate immediate security roots as exact gates become valid: #138 fail-closed runtime authentication and #136 destination-policy slice. Keep #144 main-based so its enabled auto-merge cannot accidentally integrate into a feature branch. -4. Finish #129 as one Agent Artifact Admission bounded context, including the current alternate-install-root hostile-case repair, without absorbing hostile execution isolation or Agent/LLM orchestration. -5. Drain clean supporting work such as #77, #90, #93, #134, #135, #140, #141, #150, #151, and #152 when live exact evidence permits. -6. Decompose/reconstruct #95's still-valuable PostgreSQL/outbox/Coraza evidence into bounded #80/#81/#86 successor lanes rather than merging the combined stale branch. -7. Continue #82/#83/#84/#85 production-readiness work only after their declared dependencies are protected truth. -8. Keep this baseline current whenever protected truth, queue topology, release state, or responsibility boundaries materially change. +1. Drive clean runner root #149 through current central evidence while `.github#712` and `.github#772` repair acquisition/governance defects; keep malformed-review classes in `.github#1613/#1637` and scanner evidence in `.github#891` at their central owner. +2. Keep independent work moving while #149 waits. Preserve #150/#151/#152 on clean #149 without predecessor-evidence reuse. +3. Integrate immediate security roots as exact gates become valid: #138 runtime authentication and #136 destination-policy slice. Keep #144 main-based. +4. Finish #129 as one Agent Artifact Admission bounded context without absorbing quarantine or Agent/LLM orchestration. +5. Drain clean supporting work such as #77, #90, #93, #134, #135, #140, and #141 when exact evidence permits. +6. Reconstruct #95's still-valuable PostgreSQL/outbox/Coraza evidence into bounded #80/#81/#86 lanes. +7. Continue #82/#83/#84/#85 only after their declared dependencies become protected truth. +8. Refresh this baseline whenever protected truth, queue topology, release state, or responsibility boundaries materially change. From 2da66665e5ab2f0118b24d1cac59b937333751c4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 12:24:38 +0900 Subject: [PATCH 24/73] docs(gaps): refresh admission and egress evidence --- docs/product-technical-gap-baseline.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 5f592787..f0f8383f 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -40,8 +40,8 @@ PR #137 is protected-main truth. Closed/superseded predecessor checks, reviews, | PR | Exact head | Classification | Current evidence / next action | | --- | --- | --- | --- | -| #129 Agent Artifact Admission | `54e882f7d87a42f3d021d3b153fa5126de4337d7` | Draft | Alternate install-root denial and ambiguous npm script-suppression denial are implemented. CI `33582306622` is queued; Fuzz `33582306555`, Security `33582306597`, and SAST `33582306566` are cancelled/non-passing. Keep Draft and do not retrigger by source churn. | -| #136 Network-Egress | `45484a9c0c9cbf1ad44c49c9f54898fb2d4a1984` | Ready | Shared URL/resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, hop-by-hop response filtering, and architecture fitness are present. CI `33578027483` is queued; Fuzz `33578027532`, Security `33578027587`, and SAST `33578027398` are cancelled/non-passing. #79 still owns explicit allowlist/deny-precedence and decision-evidence completion. | +| #129 Agent Artifact Admission | `ffe89e3caa7c88a925b6cae36fec475e2910af47` | Draft | Exact reviewed artifact/policy admission now rejects alternate install/trust roots including attached pip short-option forms (`-t/path`, `-iURL`, `-fURL`) and ambiguous npm script-suppression forms. CI `33586628076`, Fuzz `33586628050`, Security `33586628112`, and SAST `33586628057` are queued/non-passing; fresh exact-head review evidence must be reacquired before Ready. | +| #136 Network-Egress | `edf5e88d84475ce3694e1cc206605a322ba53016` | Ready | Shared URL/resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, hop-by-hop response filtering, and architecture fitness are present. CI `33578188860`, Fuzz `33578188853`, Security `33578188827`, and SAST `33578188887` are queued/non-passing. #79 still owns explicit allowlist/deny-precedence, decision-evidence completion, and any remaining unrepresented outbound surface. | | #138 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready | Repository CI `33505620035`, Fuzz `33505619939`, Security `33505620205`, and SAST `33505620030` are GREEN. Remaining failures are central Noema/Strix/governance evidence tracked by `.github#1637`, `.github#891`, and `.github#772`. | | #140 Runtime Configuration | `43d1b6e9122d8bb5cb882f8fc6e066c63b39ae45` | Ready | Current head supersedes the earlier formatting-failing candidate. Security `33556345110` and SAST `33556345038` are GREEN; CI `33556345223` and Fuzz `33556345021` are queued. Runtime Configuration remains a supporting bootstrap boundary distinct from secret-bearing Credential Registry. | | #144 Kubernetes manifest path + public docs | `4b9869f015e552fe5c05c740162466b8d0539f88` | Ready, main-based | Repository-path migration preserves #137's hardened Secret contract and live Kubernetes identities. Keep main-based and reacquire all exact-head gates before merge. | @@ -68,7 +68,7 @@ Close an issue only after its owning protected merge satisfies the issue accepta ## DDD and implementation gaps -Agent Artifact Admission has a responsibility-aligned crate under `crates/agent-artifact-admission` on #129 with domain-policy independence tests. The candidate now treats package-manager destination selection and script-suppression ambiguity as admitted capabilities. Actual filesystem/mount/process isolation remains downstream quarantine/executor responsibility. +Agent Artifact Admission has a responsibility-aligned crate under `crates/agent-artifact-admission` on #129 with domain-policy independence tests. The candidate now treats package-manager destination selection, attached short-option capability spellings, and script-suppression ambiguity as admitted capabilities. Actual filesystem/mount/process isolation remains downstream quarantine/executor responsibility. The legacy gateway remains concentrated in root `src/lib.rs`. File size alone does not justify a deployable split, but repeated changes to client attribution, outbound policy, runtime configuration, proxying, SOC integration, rate limiting, support evidence, and management APIs show genuine responsibility-convergence pressure. Structural work should add dependency/ownership fitness first and prefer a modular monolith until transaction, deployment, scaling, or reuse evidence justifies another deployable. From 7c42a24d3c84c7e1e470a2e95d2373e947bfe4ef Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 14:14:43 +0900 Subject: [PATCH 25/73] docs(gaps): refresh live replacement topology --- docs/product-technical-gap-baseline.md | 48 ++++++++++++++------------ 1 file changed, 25 insertions(+), 23 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index f0f8383f..13a87442 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -18,37 +18,39 @@ Organization ruleset `18156473` targets `~DEFAULT_BRANCH`. It requires one appro The bare approval-count requirement is structurally inconsistent with the declared solo-maintainer operating model when no eligible independent human exists. This is a central `.github` governance defect, not a Wardnet staffing/product defect. Self-approval and bot/model-as-human approval remain forbidden. `.github#772` owns the minimum repair while deterministic workflow/security/coverage/package/SBOM/provenance/thread/branch-integrity controls stay enforced. -Runner/control-plane work is split by ownership. Wardnet PR #149 pins every repository-owned CI/Fuzz/Scorecard `runs-on:` declaration to explicit `ubuntu-24.04` and rejects drift with a contract test. Its exact head `b663f9d200e5f385c7dd067d074940a02836c68e` has terminal-success repository CI/Fuzz/Security/SAST on the same SHA, proving the explicit hosted label works. Current central coverage/OpenCode lanes remain queued/non-passing, so `.github#712` remains the central acquisition/control-plane owner. +Runner/control-plane work is split by ownership. Clean replacement PR #153 pins every repository-owned CI/Fuzz/Scorecard `runs-on:` declaration to explicit `ubuntu-24.04` and rejects drift with a contract test. Its exact head `b663f9d200e5f385c7dd067d074940a02836c68e` has terminal-success repository CI/Fuzz/Security/SAST on the same SHA, proving the explicit hosted label works. The newest replacement-PR workflow wave and current central coverage/OpenCode lanes remain queued/non-passing, so `.github#712` remains the central acquisition/control-plane owner. Closed PR #149 is superseded branch-history evidence only. -Exact-head central review failures are tracked separately from source findings. On #138, Noema job `99848830883` reached model review and failed because the returned payload was malformed JSON; `.github#1637` owns typed fail-closed handling. Strix job `99848826685` materialized the exact head and passed gateway preflight but all bounded scanner LLM attempts were provider-unavailable, so no authoritative scan evidence existed; `.github#891` owns the scanner/readiness recovery contract. Wardnet must not mutate clean product source to satisfy either infrastructure failure. +Exact-head central review failures are tracked separately from source findings. Historical Noema evidence on clean runner head `b663f9d…` acquired `ubuntu-24.04`, completed exact-head/app-token/orchestrator preflight, then failed because the initial model verdict was malformed JSON and bounded repair exceeded its 900-second absolute deadline; `.github#1637` owns typed fail-closed handling for that class. Historical Strix evidence on auth source head `e6f05d7…` materialized the exact head and passed gateway preflight but all bounded scanner LLM attempts were provider-unavailable, so no authoritative scan evidence existed; `.github#891` owns the scanner/readiness recovery contract. Wardnet must not mutate clean product source to satisfy either infrastructure failure. -A prior base-retarget incident showed that enabled auto-merge can immediately integrate a child into a temporary feature-branch base. Recovery was non-destructive: #149 is the clean runner root; #150 preserves support-bundle work, #151 trusted-proxy work, and #152 readiness-metrics work as clean descendants. Future retargets must inspect auto-merge state first and must not use an unprotected feature branch as final integration truth. +A prior base-retarget incident showed that enabled auto-merge can immediately integrate a child into a temporary feature-branch base. Recovery was non-destructive: #153 is now the clean runner root; #156 preserves support-bundle work, #157 trusted-proxy work, and #158 readiness-metrics work as clean Draft descendants. Future retargets must inspect auto-merge state first and must not use an unprotected feature branch as final integration truth. ## Context Fabric live boundary -Fresh repository metadata still reports `develop` as the default branch for both `ContextualWisdomLab/context-graph-contracts` and `ContextualWisdomLab/enterprise-architecture-core`. Both currently expose zero GitHub Releases. The accepted protected-`main` transition and ruleset repair are therefore Context Fabric/central `.github` owner work, not a Wardnet source mutation. +Fresh repository metadata still reports `develop` as the default branch for both `ContextualWisdomLab/context-graph-contracts` and `ContextualWisdomLab/enterprise-architecture-core`. Both currently expose zero GitHub Releases. Context Graph Contracts PR #21 remains a Draft, non-mergeable child on an obsolete #20 base while its current parent is non-terminal; Enterprise Architecture Core PR #40 likewise remains a Draft, non-mergeable child on an obsolete #39 predecessor. The accepted protected-`main` transition, runner acquisition, and solo-maintainer ruleset repair are Context Fabric/central `.github` owner work, not Wardnet source mutations. -Wardnet must not consume an open Context Fabric PR head as a production dependency. Deployable application/service/API/runtime technology identity, lifecycle, ownership, risk, remediation, and transformation may be projected only through a released compatible Context Assertion/CloudEvent/API contract with provenance. Individual security findings and artifact verdicts remain Wardnet security evidence. +Quarantine Sandbox Runtime also exposes no GitHub Release. Foundation PR #1 remains Draft at `57a54dbe3a01f623c0e47301af2fd36568de21e7`; caller-scoped application-service child #6 is a coherent descendant at `949b0f71a1e022eb0ea48df93ffa7bbbfd1eb259`. Both remain development evidence with current pre-checkout/runner-acquisition gates non-passing. EgressWeave currently exposes no GitHub Release either. Wardnet issue #38 therefore remains release-gated rather than consuming sibling source. + +Wardnet must not consume an open Context Fabric, quarantine, or EgressWeave PR head as a production dependency. Deployable application/service/API/runtime technology identity, lifecycle, ownership, risk, remediation, and transformation may be projected only through a released compatible Context Assertion/CloudEvent/API contract with provenance. Individual security findings and artifact verdicts remain Wardnet security evidence. ## Live delivery queue -Fresh inventory contains 23 open PRs: +Fresh inventory contains 24 open PRs: -`#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #138, #140, #141, #144, #149, #150, #151, #152`. +`#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #153, #154, #155, #156, #157, #158`. PR #137 is protected-main truth. Closed/superseded predecessor checks, reviews, approvals, and artifacts do not transfer to replacements or moved heads. | PR | Exact head | Classification | Current evidence / next action | | --- | --- | --- | --- | -| #129 Agent Artifact Admission | `ffe89e3caa7c88a925b6cae36fec475e2910af47` | Draft | Exact reviewed artifact/policy admission now rejects alternate install/trust roots including attached pip short-option forms (`-t/path`, `-iURL`, `-fURL`) and ambiguous npm script-suppression forms. CI `33586628076`, Fuzz `33586628050`, Security `33586628112`, and SAST `33586628057` are queued/non-passing; fresh exact-head review evidence must be reacquired before Ready. | +| #129 Agent Artifact Admission | `ffe89e3caa7c88a925b6cae36fec475e2910af47` | Draft | Exact artifact/policy admission rejects alternate install/trust roots including attached pip short-option forms (`-t/path`, `-iURL`, `-fURL`) and ambiguous npm script-suppression forms. Current repository gates are queued/non-passing and current-head independent review evidence must be reacquired before Ready. | | #136 Network-Egress | `edf5e88d84475ce3694e1cc206605a322ba53016` | Ready | Shared URL/resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, hop-by-hop response filtering, and architecture fitness are present. CI `33578188860`, Fuzz `33578188853`, Security `33578188827`, and SAST `33578188887` are queued/non-passing. #79 still owns explicit allowlist/deny-precedence, decision-evidence completion, and any remaining unrepresented outbound surface. | -| #138 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready | Repository CI `33505620035`, Fuzz `33505619939`, Security `33505620205`, and SAST `33505620030` are GREEN. Remaining failures are central Noema/Strix/governance evidence tracked by `.github#1637`, `.github#891`, and `.github#772`. | -| #140 Runtime Configuration | `43d1b6e9122d8bb5cb882f8fc6e066c63b39ae45` | Ready | Current head supersedes the earlier formatting-failing candidate. Security `33556345110` and SAST `33556345038` are GREEN; CI `33556345223` and Fuzz `33556345021` are queued. Runtime Configuration remains a supporting bootstrap boundary distinct from secret-bearing Credential Registry. | -| #144 Kubernetes manifest path + public docs | `4b9869f015e552fe5c05c740162466b8d0539f88` | Ready, main-based | Repository-path migration preserves #137's hardened Secret contract and live Kubernetes identities. Keep main-based and reacquire all exact-head gates before merge. | -| #149 explicit hosted runner | `b663f9d200e5f385c7dd067d074940a02836c68e` | Ready, clean stack root | Repository-owned exact-SHA CI/Fuzz/Security/SAST are GREEN. Current central coverage/OpenCode evidence remains queued/non-passing; `.github#712` and `.github#772` own the remaining control-plane/governance defects. | -| #150 support-bundle operability evidence | `76037b8ae206ace8dab0e6622dfc9fc88c57deb3` | Ready, stacked on #149 | Preserves the six-file support/readiness/metrics delta. After #149 reaches protected `main`, retarget/reconstruct on fresh main and regenerate all base-sensitive evidence. | -| #151 trusted proxy attribution | `65a2b7fbf2827f69ae1aa288696b6c5630af28c4` | Ready, stacked on #149 | Missing-ConnectInfo and malformed-forwarded-chain defects are repaired; current review threads are resolved. Fresh exact-head CI/Fuzz remain queued/non-passing. | -| #152 readiness metrics | `387a447f856093d02116dfadcf2c4a4a63c6d3ba` | Ready, stacked on #149 | Four-file observability delta reconstructed on clean #149. Revalidate only after parent integration. | +| #140 Runtime Configuration | `43d1b6e9122d8bb5cb882f8fc6e066c63b39ae45` | Ready | Security `33556345110` and SAST `33556345038` are GREEN; current CI/Fuzz are queued. Runtime Configuration remains a supporting bootstrap boundary distinct from secret-bearing Credential Registry. | +| #144 Kubernetes manifest path + public docs | `4b9869f015e552fe5c05c740162466b8d0539f88` | Ready, main-based | Repository-path migration preserves #137's hardened Secret contract and live Kubernetes identities. Security/SAST are GREEN while current CI/Fuzz remain queued; keep main-based and reacquire every exact-head gate before merge. | +| #153 explicit hosted runner | `b663f9d200e5f385c7dd067d074940a02836c68e` | Ready, clean stack root | Repository-owned exact-SHA CI/Fuzz/Security/SAST have previously completed GREEN on this unchanged source. Current replacement-PR repository/central evidence is again queued/non-passing; `.github#712`, `.github#1637`, and `.github#772` own the remaining control-plane/governance classes. | +| #155 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready, clean main-based replacement | Restores the exact reviewed auth delta to protected-main lineage after predecessor #138 was absorbed into a temporary feature branch. Prior same-source repository CI/Fuzz/Security/SAST are GREEN, but the new #155 workflow wave and central review/security/governance evidence must terminate on this replacement PR. Devin's current comments are informational rather than source defects. | +| #156 support-bundle operability evidence | `76037b8ae206ace8dab0e6622dfc9fc88c57deb3` | Draft, stacked on #153 | Clean replacement for contaminated #150. After #153 reaches protected `main`, retarget/reconstruct on fresh main and regenerate all base-sensitive evidence. | +| #157 trusted proxy attribution | `65a2b7fbf2827f69ae1aa288696b6c5630af28c4` | Draft, stacked on #153 | Clean replacement for contaminated #151; forwarded identity is trusted only from configured proxy CIDRs. Revalidate after parent integration. | +| #158 readiness metrics | `387a447f856093d02116dfadcf2c4a4a63c6d3ba` | Draft, stacked on #153 | Clean replacement for contaminated #152; readiness gauges reuse existing authority and require fresh evidence after parent integration. | `queued`, `pending`, `skipped`, `cancelled`, `absent`, stale, predecessor-head, status-only, model-only, or synthetic evidence is non-passing. Do not transfer evidence after head/base movement. @@ -56,13 +58,13 @@ PR #137 is protected-main truth. Closed/superseded predecessor checks, reviews, Fresh inventory contains 17 open issues: `#11, #38, #74, #75, #78, #79, #80, #81, #82, #83, #84, #85, #86, #87, #89, #128, #139`. -1. **Immediate exposure controls:** #78 fail-closed management auth, #79 fail-closed destination policy, #11 real attack-path CI, and #75 repository-path migration through #144. +1. **Immediate exposure controls:** #78 fail-closed management auth through clean PR #155, #79 fail-closed destination policy through #136 plus its remaining allowlist/evidence work, #11 real attack-path CI, and #75 repository-path migration through #144. 2. **Security admission:** #128 Agent Artifact Admission through #129. Hostile execution remains quarantine-owned. 3. **Durable authority and effects:** #80 PostgreSQL production authority/tenant isolation, then #81 transactional outbox and leased workers. -4. **Identity and overload:** #82 Keyverse-backed identity/authorization/approval and #83 distributed/global admission. #151 is only the trusted-network-identity slice. +4. **Identity and overload:** #82 Keyverse-backed identity/authorization/approval and #83 distributed/global admission. #157 is only the trusted-network-identity slice and remains parent-gated on #153. 5. **Proven security engines:** #86 Coraza/CRS and Suricata production enforcement with detection/false-positive evidence. 6. **Immutable delivery and operation:** #84 signed/SBOM/provenance release promotion/rollback, then #85 OpenTelemetry/SLO/incident/restore evidence. -7. **Supporting correctness:** #74 deterministic persistence fault testing, #77 pinned compiler, #139 coherent runtime configuration, #75 manifest filename migration, and #149 deterministic hosted-runner selection. +7. **Supporting correctness:** #74 deterministic persistence fault testing, #77 pinned compiler, #139 coherent runtime configuration, #75 manifest filename migration, and #153 deterministic hosted-runner selection. Close an issue only after its owning protected merge satisfies the issue acceptance contract on current evidence. @@ -93,15 +95,15 @@ The microservices evidence is used narrowly to avoid decomposition-by-file-size: Wardnet-owned production code targets 100% statement and branch coverage and complete public rustdoc/docstrings. Security-critical changes require hostile/bypass/replay/race/DoS/network/cleanup tests and current-source verification of review findings. Coverage exclusions, source rewriting, skipped required paths, or green statuses bound to another revision are not acceptable evidence. -A release is not authorized. Wardnet, `context-graph-contracts`, and `enterprise-architecture-core` expose no GitHub Release at this snapshot, and Wardnet production gate #87 remains open. Release requires one exact integrated protected head with CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence and immutable artifact identity. +A release is not authorized. Wardnet, Quarantine Sandbox Runtime, EgressWeave, `context-graph-contracts`, and `enterprise-architecture-core` expose no GitHub Release at this snapshot, and Wardnet production gate #87 remains open. Release requires one exact integrated protected head with CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence and immutable artifact identity. ## Next execution order -1. Drive clean runner root #149 through current central evidence while `.github#712` and `.github#772` repair acquisition/governance defects; keep malformed-review classes in `.github#1613/#1637` and scanner evidence in `.github#891` at their central owner. -2. Keep independent work moving while #149 waits. Preserve #150/#151/#152 on clean #149 without predecessor-evidence reuse. -3. Integrate immediate security roots as exact gates become valid: #138 runtime authentication and #136 destination-policy slice. Keep #144 main-based. +1. Drive clean runner root #153 through current central evidence while `.github#712`, `.github#1637`, and `.github#772` repair acquisition/model-review/governance defects; keep scanner availability/evidence handling in `.github#891`. +2. Keep independent work moving while #153 waits. Preserve #156/#157/#158 on clean #153 without predecessor-evidence reuse. +3. Integrate immediate security roots as exact gates become valid: #155 runtime authentication and #136 destination-policy slice. Keep #144 main-based. 4. Finish #129 as one Agent Artifact Admission bounded context without absorbing quarantine or Agent/LLM orchestration. -5. Drain clean supporting work such as #77, #90, #93, #134, #135, #140, and #141 when exact evidence permits. +5. Drain clean supporting work such as #77, #90, #93, #134, #135, #140, #141, and #154 when exact evidence permits. 6. Reconstruct #95's still-valuable PostgreSQL/outbox/Coraza evidence into bounded #80/#81/#86 lanes. 7. Continue #82/#83/#84/#85 only after their declared dependencies become protected truth. 8. Refresh this baseline whenever protected truth, queue topology, release state, or responsibility boundaries materially change. From 1ceb9f3dc1521a7399ede094d8071336d1a53666 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 17:16:20 +0900 Subject: [PATCH 26/73] docs(gaps): refresh exact-head delivery evidence --- docs/product-technical-gap-baseline.md | 33 +++++++++++++------------- 1 file changed, 17 insertions(+), 16 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 13a87442..2c095243 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -18,7 +18,7 @@ Organization ruleset `18156473` targets `~DEFAULT_BRANCH`. It requires one appro The bare approval-count requirement is structurally inconsistent with the declared solo-maintainer operating model when no eligible independent human exists. This is a central `.github` governance defect, not a Wardnet staffing/product defect. Self-approval and bot/model-as-human approval remain forbidden. `.github#772` owns the minimum repair while deterministic workflow/security/coverage/package/SBOM/provenance/thread/branch-integrity controls stay enforced. -Runner/control-plane work is split by ownership. Clean replacement PR #153 pins every repository-owned CI/Fuzz/Scorecard `runs-on:` declaration to explicit `ubuntu-24.04` and rejects drift with a contract test. Its exact head `b663f9d200e5f385c7dd067d074940a02836c68e` has terminal-success repository CI/Fuzz/Security/SAST on the same SHA, proving the explicit hosted label works. The newest replacement-PR workflow wave and current central coverage/OpenCode lanes remain queued/non-passing, so `.github#712` remains the central acquisition/control-plane owner. Closed PR #149 is superseded branch-history evidence only. +Runner/control-plane work is split by ownership. Clean replacement PR #153 pins every repository-owned CI/Fuzz/Scorecard `runs-on:` declaration to explicit `ubuntu-24.04` and rejects drift with a contract test. Its exact head `b663f9d200e5f385c7dd067d074940a02836c68e` has terminal-success repository CI/Fuzz/Security/SAST on the same SHA, proving the explicit hosted label works. Current pre-checkout starvation nevertheless also affects `ubuntu-latest` candidates: #155, #136, and the freshly repaired #144 replacement run all currently show required jobs with `runner_id=0`, no runner identity, and zero executed steps. `.github#712` remains the central acquisition/control-plane owner. Closed PR #149 is superseded branch-history evidence only. Exact-head central review failures are tracked separately from source findings. Historical Noema evidence on clean runner head `b663f9d…` acquired `ubuntu-24.04`, completed exact-head/app-token/orchestrator preflight, then failed because the initial model verdict was malformed JSON and bounded repair exceeded its 900-second absolute deadline; `.github#1637` owns typed fail-closed handling for that class. Historical Strix evidence on auth source head `e6f05d7…` materialized the exact head and passed gateway preflight but all bounded scanner LLM attempts were provider-unavailable, so no authoritative scan evidence existed; `.github#891` owns the scanner/readiness recovery contract. Wardnet must not mutate clean product source to satisfy either infrastructure failure. @@ -26,9 +26,9 @@ A prior base-retarget incident showed that enabled auto-merge can immediately in ## Context Fabric live boundary -Fresh repository metadata still reports `develop` as the default branch for both `ContextualWisdomLab/context-graph-contracts` and `ContextualWisdomLab/enterprise-architecture-core`. Both currently expose zero GitHub Releases. Context Graph Contracts PR #21 remains a Draft, non-mergeable child on an obsolete #20 base while its current parent is non-terminal; Enterprise Architecture Core PR #40 likewise remains a Draft, non-mergeable child on an obsolete #39 predecessor. The accepted protected-`main` transition, runner acquisition, and solo-maintainer ruleset repair are Context Fabric/central `.github` owner work, not Wardnet source mutations. +Fresh repository metadata still reports `develop` as the default branch for both `ContextualWisdomLab/context-graph-contracts` and `ContextualWisdomLab/enterprise-architecture-core`. Both currently expose zero GitHub Releases. Context Graph Contracts PR #20 is non-terminal at `475ce14185db697940e8219c3cda7f24d66f3ed7`; PR #21 remains a Draft child at `36d7b0fd8b4ba68f65a0d73565a3a3ddecdb2d67` on obsolete parent ancestry and carries the structured Context Assertion/CloudEvent envelope repair. Enterprise Architecture Core PR #39 is a non-terminal Draft at `c3879f172d97e2d814ff94d664be0a797e2228be`; PR #40 remains a Draft child at `b3ec93a42528ab0defc0116ac4695d669298240f` on obsolete #39 ancestry. The accepted protected-`main` transition and solo-maintainer ruleset repair are Context Fabric/central `.github` owner work, not Wardnet source mutations. -Quarantine Sandbox Runtime also exposes no GitHub Release. Foundation PR #1 remains Draft at `57a54dbe3a01f623c0e47301af2fd36568de21e7`; caller-scoped application-service child #6 is a coherent descendant at `949b0f71a1e022eb0ea48df93ffa7bbbfd1eb259`. Both remain development evidence with current pre-checkout/runner-acquisition gates non-passing. EgressWeave currently exposes no GitHub Release either. Wardnet issue #38 therefore remains release-gated rather than consuming sibling source. +Quarantine Sandbox Runtime also exposes no GitHub Release. Foundation PR #1 remains Draft at `57a54dbe3a01f623c0e47301af2fd36568de21e7`; caller-scoped application-service child #6 is a coherent descendant at `949b0f71a1e022eb0ea48df93ffa7bbbfd1eb259`. Effective-isolation/release/command-execution work remains in the Draft stack and current execution evidence is non-terminal. EgressWeave currently exposes no GitHub Release either. Wardnet issue #38 therefore remains release-gated rather than consuming sibling source. Wardnet must not consume an open Context Fabric, quarantine, or EgressWeave PR head as a production dependency. Deployable application/service/API/runtime technology identity, lifecycle, ownership, risk, remediation, and transformation may be projected only through a released compatible Context Assertion/CloudEvent/API contract with provenance. Individual security findings and artifact verdicts remain Wardnet security evidence. @@ -42,12 +42,12 @@ PR #137 is protected-main truth. Closed/superseded predecessor checks, reviews, | PR | Exact head | Classification | Current evidence / next action | | --- | --- | --- | --- | -| #129 Agent Artifact Admission | `ffe89e3caa7c88a925b6cae36fec475e2910af47` | Draft | Exact artifact/policy admission rejects alternate install/trust roots including attached pip short-option forms (`-t/path`, `-iURL`, `-fURL`) and ambiguous npm script-suppression forms. Current repository gates are queued/non-passing and current-head independent review evidence must be reacquired before Ready. | -| #136 Network-Egress | `edf5e88d84475ce3694e1cc206605a322ba53016` | Ready | Shared URL/resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, hop-by-hop response filtering, and architecture fitness are present. CI `33578188860`, Fuzz `33578188853`, Security `33578188827`, and SAST `33578188887` are queued/non-passing. #79 still owns explicit allowlist/deny-precedence, decision-evidence completion, and any remaining unrepresented outbound surface. | +| #129 Agent Artifact Admission | `79e8da09ef571f05a2eb7ac71aa80ed61c3b81b0` | Draft | Admission rejects alternate install/trust roots across uv, Cargo, pip attached short-option forms and contradictory npm script-suppression forms. The downstream executor/quarantine path remains responsible for independently verifying retrieved bytes or equivalent provenance before installation. Current repository gates are queued/non-passing and current-head review evidence must be reacquired before Ready. | +| #136 Network-Egress | `3e66c260bfcd09c7dc98dc5d1e931583f8379093` | Ready, source defect remains | Shared URL/resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, hop-by-hop response filtering, and architecture fitness are present. One verified defect remains: `validated_outbound_http_client` performs manual DNS resolution before the request timeout begins, so a stalled resolver can exceed the intended operation budget. It requires a deterministic bounded-resolution/deadline RED→GREEN repair before merge. Exact-head CI/Fuzz/Security/SAST are currently pre-checkout/queued; #155 must also become protected truth before final integration. | | #140 Runtime Configuration | `43d1b6e9122d8bb5cb882f8fc6e066c63b39ae45` | Ready | Security `33556345110` and SAST `33556345038` are GREEN; current CI/Fuzz are queued. Runtime Configuration remains a supporting bootstrap boundary distinct from secret-bearing Credential Registry. | -| #144 Kubernetes manifest path + public docs | `4b9869f015e552fe5c05c740162466b8d0539f88` | Ready, main-based | Repository-path migration preserves #137's hardened Secret contract and live Kubernetes identities. Security/SAST are GREEN while current CI/Fuzz remain queued; keep main-based and reacquire every exact-head gate before merge. | +| #144 Kubernetes manifest path + public docs | `8fd2461c6a1cadcf27f81f7fe29da62691eee7ff` | Ready, main-based | Repository-path migration preserves #137's hardened Secret contract and live Kubernetes identities. Predecessor CI acquired Ubuntu 24.04 and failed only `cargo fmt --check`; exact rustfmt output was applied in `4ab1e8a…` and `8fd2461…` without behavior change. Replacement CI `33607380492`, Security `33607380471`, SAST `33607380572`, and Fuzz `33607380609` are queued/pending, with CI currently pre-checkout at `runner_id=0`. Reacquire all exact-head evidence before merge. | | #153 explicit hosted runner | `b663f9d200e5f385c7dd067d074940a02836c68e` | Ready, clean stack root | Repository-owned exact-SHA CI/Fuzz/Security/SAST have previously completed GREEN on this unchanged source. Current replacement-PR repository/central evidence is again queued/non-passing; `.github#712`, `.github#1637`, and `.github#772` own the remaining control-plane/governance classes. | -| #155 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready, clean main-based replacement | Restores the exact reviewed auth delta to protected-main lineage after predecessor #138 was absorbed into a temporary feature branch. Prior same-source repository CI/Fuzz/Security/SAST are GREEN, but the new #155 workflow wave and central review/security/governance evidence must terminate on this replacement PR. Devin's current comments are informational rather than source defects. | +| #155 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready, clean main-based replacement | Restores the exact reviewed auth delta to protected-main lineage after predecessor #138 was absorbed into a temporary feature branch. Prior same-source repository CI/Fuzz/Security/SAST are GREEN, but the new #155 workflow wave and central review/security/governance evidence remain non-terminal; its current repository CI is pre-checkout with `runner_id=0`. Devin's current comments are informational rather than source defects. | | #156 support-bundle operability evidence | `76037b8ae206ace8dab0e6622dfc9fc88c57deb3` | Draft, stacked on #153 | Clean replacement for contaminated #150. After #153 reaches protected `main`, retarget/reconstruct on fresh main and regenerate all base-sensitive evidence. | | #157 trusted proxy attribution | `65a2b7fbf2827f69ae1aa288696b6c5630af28c4` | Draft, stacked on #153 | Clean replacement for contaminated #151; forwarded identity is trusted only from configured proxy CIDRs. Revalidate after parent integration. | | #158 readiness metrics | `387a447f856093d02116dfadcf2c4a4a63c6d3ba` | Draft, stacked on #153 | Clean replacement for contaminated #152; readiness gauges reuse existing authority and require fresh evidence after parent integration. | @@ -58,7 +58,7 @@ PR #137 is protected-main truth. Closed/superseded predecessor checks, reviews, Fresh inventory contains 17 open issues: `#11, #38, #74, #75, #78, #79, #80, #81, #82, #83, #84, #85, #86, #87, #89, #128, #139`. -1. **Immediate exposure controls:** #78 fail-closed management auth through clean PR #155, #79 fail-closed destination policy through #136 plus its remaining allowlist/evidence work, #11 real attack-path CI, and #75 repository-path migration through #144. +1. **Immediate exposure controls:** #78 fail-closed management auth through clean PR #155, #79 fail-closed destination policy through #136 plus its remaining allowlist/evidence work and DNS-deadline defect, #11 real attack-path CI, and #75 repository-path migration through #144. 2. **Security admission:** #128 Agent Artifact Admission through #129. Hostile execution remains quarantine-owned. 3. **Durable authority and effects:** #80 PostgreSQL production authority/tenant isolation, then #81 transactional outbox and leased workers. 4. **Identity and overload:** #82 Keyverse-backed identity/authorization/approval and #83 distributed/global admission. #157 is only the trusted-network-identity slice and remains parent-gated on #153. @@ -70,13 +70,13 @@ Close an issue only after its owning protected merge satisfies the issue accepta ## DDD and implementation gaps -Agent Artifact Admission has a responsibility-aligned crate under `crates/agent-artifact-admission` on #129 with domain-policy independence tests. The candidate now treats package-manager destination selection, attached short-option capability spellings, and script-suppression ambiguity as admitted capabilities. Actual filesystem/mount/process isolation remains downstream quarantine/executor responsibility. +Agent Artifact Admission has a responsibility-aligned crate under `crates/agent-artifact-admission` on #129 with domain-policy independence tests. The candidate now treats package-manager destination selection, attached short-option capability spellings, script-suppression ambiguity, and alternate Cargo/uv trust roots as admitted capabilities. Actual artifact retrieval verification, filesystem/mount/process isolation, and hostile execution remain downstream executor/quarantine responsibilities. The legacy gateway remains concentrated in root `src/lib.rs`. File size alone does not justify a deployable split, but repeated changes to client attribution, outbound policy, runtime configuration, proxying, SOC integration, rate limiting, support evidence, and management APIs show genuine responsibility-convergence pressure. Structural work should add dependency/ownership fitness first and prefer a modular monolith until transaction, deployment, scaling, or reuse evidence justifies another deployable. #140 is the coherent Runtime Configuration migration. `CredentialRegistry` remains the secret-bearing bootstrap owner. New direct process-environment reads outside approved bootstrap adapters are architecture defects. -Network-Egress remains incomplete after #136. Issue #79 still requires versioned hostname/suffix/IP/CIDR/scheme/port allowlists, deterministic deny-overrides precedence, connector parity, minimized decision evidence, and operator migration/rollback/diagnostics. +Network-Egress remains incomplete after #136. In addition to the verified DNS-resolution deadline defect, issue #79 still requires versioned hostname/suffix/IP/CIDR/scheme/port allowlists, deterministic deny-overrides precedence, connector parity, minimized decision evidence, and operator migration/rollback/diagnostics. PR #95 is not an acceptable production integration vehicle. It is a large diverged cross-context branch combining Coraza, PostgreSQL, outbox, egress, and release responsibilities. Preserve its unique tests/evidence while reconstructing bounded #80/#81/#86 successor work rather than merging a god-PR. @@ -101,9 +101,10 @@ A release is not authorized. Wardnet, Quarantine Sandbox Runtime, EgressWeave, ` 1. Drive clean runner root #153 through current central evidence while `.github#712`, `.github#1637`, and `.github#772` repair acquisition/model-review/governance defects; keep scanner availability/evidence handling in `.github#891`. 2. Keep independent work moving while #153 waits. Preserve #156/#157/#158 on clean #153 without predecessor-evidence reuse. -3. Integrate immediate security roots as exact gates become valid: #155 runtime authentication and #136 destination-policy slice. Keep #144 main-based. -4. Finish #129 as one Agent Artifact Admission bounded context without absorbing quarantine or Agent/LLM orchestration. -5. Drain clean supporting work such as #77, #90, #93, #134, #135, #140, #141, and #154 when exact evidence permits. -6. Reconstruct #95's still-valuable PostgreSQL/outbox/Coraza evidence into bounded #80/#81/#86 lanes. -7. Continue #82/#83/#84/#85 only after their declared dependencies become protected truth. -8. Refresh this baseline whenever protected truth, queue topology, release state, or responsibility boundaries materially change. +3. Repair #136's DNS-resolution deadline defect test-first, then revalidate it after #155 becomes protected truth; keep #144 main-based and continue its fresh exact-head gates. +4. Integrate immediate security root #155 as exact gates become valid. +5. Finish #129 as one Agent Artifact Admission bounded context without absorbing quarantine or Agent/LLM orchestration. +6. Drain clean supporting work such as #77, #90, #93, #134, #135, #140, #141, and #154 when exact evidence permits. +7. Reconstruct #95's still-valuable PostgreSQL/outbox/Coraza evidence into bounded #80/#81/#86 lanes. +8. Continue #82/#83/#84/#85 only after their declared dependencies become protected truth. +9. Refresh this baseline whenever protected truth, queue topology, release state, or responsibility boundaries materially change. From ddfa95be215aac3044453138fe159ce075acb0c1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 19:18:53 +0900 Subject: [PATCH 27/73] docs(gaps): refresh live commercial baseline --- docs/product-technical-gap-baseline.md | 109 ++++++++++++------------- 1 file changed, 53 insertions(+), 56 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 2c095243..64d4a0ae 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,36 +1,36 @@ # Product and technical gap baseline -Snapshot date: 2026-09-02. This file is a dated repository snapshot, not scheduler memory. Every later run must refetch live heads, bases, checks, review state, rulesets, releases, and foreign-owner state before acting. +Snapshot date: 2026-09-02. This document is a dated repository snapshot. Live refs, reviews, checks, rulesets, releases, and foreign-owner state must be re-read before any merge, release, or integration decision. -## Product boundary +## Product and authority boundary -Wardnet is the Rust-first gateway/SOC control plane. Its owned responsibilities are Gateway, Admission Policy, Artifact Identity, Security Analysis Integration, Network-Egress, SOC Evidence, Runtime Control, and Audit-Provenance. The Agent Artifact Admission Controller is a separate bounded context inside Wardnet's Security Admission subdomain. +Wardnet is the Rust-first gateway/SOC control plane and owns Gateway, Admission Policy, Artifact Identity, Security Analysis Integration, Network-Egress, SOC Evidence, Runtime Control, Audit-Provenance, and the Agent Artifact Admission bounded context. It does not execute hostile workloads or own provider/model orchestration. -Quarantine Sandbox Runtime owns hostile-workload execution isolation. `contextual-orchestrator` owns Agent/LLM orchestration. EgressWeave is the outbound HTTP-policy candidate. Wardnet consumes those capabilities through versioned ports and Anti-Corruption Layers; it does not copy their implementations or access their application databases. +`ContextualWisdomLab/quarantine-sandbox-runtime` owns reusable hostile-workload isolation, execution lifecycle, cleanup, and artifact-analysis evidence. `contextual-orchestrator` owns Agent/LLM orchestration and provider/model routing. EgressWeave is the canonical outbound HTTP-policy candidate. Wardnet consumes released/versioned ports and Anti-Corruption Layers; it does not copy those implementations or access foreign application databases. -`context-graph-contracts` is the provider-neutral Context Fabric Shared Kernel for canonical references, authority, truth status/origin, valid/system time, provenance, Context Assertion, CloudEvents/schema/conformance/admission. `enterprise-architecture-core` is the Enterprise Architecture Decision Plane. While the dedicated Context Fabric writer is active, both repositories are read-only source dependencies from Wardnet. Security findings, alerts, malware verdicts, artifact risk scores, prompts, and customer/runtime data do not become authoritative EA facts. +`context-graph-contracts` is the provider-neutral Context Fabric Shared Kernel for canonical object/authority references, truth status/origin, valid/system time, provenance, Context Assertion, CloudEvents, schema, conformance, and admission. `enterprise-architecture-core` is the EA Decision Plane. Both remain read-only source dependencies from this writer while the dedicated Context Fabric writer is active. Security findings, alerts, malware verdicts, artifact risk scores, prompts, and customer/runtime data do not become authoritative EA facts. ## Protected truth and governance -Protected/default Wardnet `main` is `cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. It contains PR #137's externally provisioned, non-optional administrator Secret boundary. Wardnet currently has no GitHub Release. +Protected/default Wardnet `main` is `cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. It contains PR #137's externally provisioned, non-optional Kubernetes administrator Secret boundary. Wardnet currently has no GitHub Release. -Organization ruleset `18156473` targets `~DEFAULT_BRANCH`. It requires one approving review, dismisses stale approvals, requires review-thread resolution, names no required reviewer/team, does not require code-owner or last-push approval, and also requires central review/security workflow evidence plus deletion/non-fast-forward protection. +Organization ruleset `18156473` follows `~DEFAULT_BRANCH`. It still requires one approving review while naming no required reviewer/team, with no code-owner or last-push approval requirement. Review-thread resolution, central required workflows, deletion protection, and non-fast-forward protection remain enabled. Self-approval and bot/model-as-human approval are forbidden. -The bare approval-count requirement is structurally inconsistent with the declared solo-maintainer operating model when no eligible independent human exists. This is a central `.github` governance defect, not a Wardnet staffing/product defect. Self-approval and bot/model-as-human approval remain forbidden. `.github#772` owns the minimum repair while deterministic workflow/security/coverage/package/SBOM/provenance/thread/branch-integrity controls stay enforced. +The bare approval count is structurally inconsistent with the declared solo-maintainer model. This is a central governance defect rather than a Wardnet staffing requirement. `.github#1644`, referencing #772 and related governance work, is the current owner-plane reconciliation candidate. Its source policy removes the impossible approval count while preserving deterministic workflow/security/coverage/SBOM/provenance/thread/branch-integrity controls. Source integration alone does not mutate live rulesets; the owner-plane apply remains separately privileged and must be proven from live settings before Wardnet treats the rule as repaired. -Runner/control-plane work is split by ownership. Clean replacement PR #153 pins every repository-owned CI/Fuzz/Scorecard `runs-on:` declaration to explicit `ubuntu-24.04` and rejects drift with a contract test. Its exact head `b663f9d200e5f385c7dd067d074940a02836c68e` has terminal-success repository CI/Fuzz/Security/SAST on the same SHA, proving the explicit hosted label works. Current pre-checkout starvation nevertheless also affects `ubuntu-latest` candidates: #155, #136, and the freshly repaired #144 replacement run all currently show required jobs with `runner_id=0`, no runner identity, and zero executed steps. `.github#712` remains the central acquisition/control-plane owner. Closed PR #149 is superseded branch-history evidence only. +Runner acquisition is also a central control-plane concern. PR #153 pins repository-owned CI/Fuzz/Scorecard runner declarations to explicit `ubuntu-24.04` and permanently rejects floating `ubuntu-latest`. Exact head `b663f9d200e5f385c7dd067d074940a02836c68e` has already completed repository CI/Fuzz/Security/SAST successfully on that same source, proving the full hosted image is executable when admitted. Later exact-head waves across Wardnet, Context Graph Contracts, and EA Core have again remained pre-checkout with `runner_id=0`. `.github#712` owns that acquisition/capacity/policy-routing defect. -Exact-head central review failures are tracked separately from source findings. Historical Noema evidence on clean runner head `b663f9d…` acquired `ubuntu-24.04`, completed exact-head/app-token/orchestrator preflight, then failed because the initial model verdict was malformed JSON and bounded repair exceeded its 900-second absolute deadline; `.github#1637` owns typed fail-closed handling for that class. Historical Strix evidence on auth source head `e6f05d7…` materialized the exact head and passed gateway preflight but all bounded scanner LLM attempts were provider-unavailable, so no authoritative scan evidence existed; `.github#891` owns the scanner/readiness recovery contract. Wardnet must not mutate clean product source to satisfy either infrastructure failure. - -A prior base-retarget incident showed that enabled auto-merge can immediately integrate a child into a temporary feature-branch base. Recovery was non-destructive: #153 is now the clean runner root; #156 preserves support-bundle work, #157 trusted-proxy work, and #158 readiness-metrics work as clean Draft descendants. Future retargets must inspect auto-merge state first and must not use an unprotected feature branch as final integration truth. +GitHub's current hosted-runner contract does not make `ubuntu-slim` an equivalent workaround: it is an unprivileged 1-vCPU/5-GB container runner with a 15-minute job ceiling intended for lightweight automation rather than typical heavyweight CI/CD. A successful slim job is therefore an admission canary, not justification to downgrade Wardnet CI/Fuzz/CodeQL/coverage workloads. ## Context Fabric live boundary -Fresh repository metadata still reports `develop` as the default branch for both `ContextualWisdomLab/context-graph-contracts` and `ContextualWisdomLab/enterprise-architecture-core`. Both currently expose zero GitHub Releases. Context Graph Contracts PR #20 is non-terminal at `475ce14185db697940e8219c3cda7f24d66f3ed7`; PR #21 remains a Draft child at `36d7b0fd8b4ba68f65a0d73565a3a3ddecdb2d67` on obsolete parent ancestry and carries the structured Context Assertion/CloudEvent envelope repair. Enterprise Architecture Core PR #39 is a non-terminal Draft at `c3879f172d97e2d814ff94d664be0a797e2228be`; PR #40 remains a Draft child at `b3ec93a42528ab0defc0116ac4695d669298240f` on obsolete #39 ancestry. The accepted protected-`main` transition and solo-maintainer ruleset repair are Context Fabric/central `.github` owner work, not Wardnet source mutations. +Fresh metadata still reports `develop` as the default branch for both `ContextualWisdomLab/context-graph-contracts` and `ContextualWisdomLab/enterprise-architecture-core`. Both expose zero GitHub Releases. The accepted protected-`main` transition remains central `.github`/Context Fabric owner work rather than a Wardnet source mutation. + +Context Graph Contracts #20 is Draft at exact `475ce14185db697940e8219c3cda7f24d66f3ed7`. Its current required jobs are non-terminal in the runner-acquisition class. Child #21 is Draft at exact `239a73d5f1a18b10ad317fdd51567b7fa040f570` on obsolete #20 ancestry and contains the structured Context Assertion/CloudEvent envelope and authority/conformance repair. No immutable CGC release exists, so Wardnet must not bind production behavior to either open PR head. -Quarantine Sandbox Runtime also exposes no GitHub Release. Foundation PR #1 remains Draft at `57a54dbe3a01f623c0e47301af2fd36568de21e7`; caller-scoped application-service child #6 is a coherent descendant at `949b0f71a1e022eb0ea48df93ffa7bbbfd1eb259`. Effective-isolation/release/command-execution work remains in the Draft stack and current execution evidence is non-terminal. EgressWeave currently exposes no GitHub Release either. Wardnet issue #38 therefore remains release-gated rather than consuming sibling source. +Enterprise Architecture Core #39 is Draft at exact `c3879f172d97e2d814ff94d664be0a797e2228be` with current runner-acquisition evidence non-terminal. Child #40 is Draft at exact `b3ec93a42528ab0defc0116ac4695d669298240f` on obsolete #39 ancestry. #40 already preserves the required Wardnet/quarantine authority boundary: `contextual-orchestrator -> quarantine application-service lease`, `Wardnet -> quarantine artifact-analysis evidence`, no malware verdict or artifact risk score as authoritative EA fact, and no direct database/source-copy integration. It must remain release-gated until a compatible immutable CGC package/provenance contract exists. -Wardnet must not consume an open Context Fabric, quarantine, or EgressWeave PR head as a production dependency. Deployable application/service/API/runtime technology identity, lifecycle, ownership, risk, remediation, and transformation may be projected only through a released compatible Context Assertion/CloudEvent/API contract with provenance. Individual security findings and artifact verdicts remain Wardnet security evidence. +Quarantine Sandbox Runtime and EgressWeave also expose no inspected immutable GitHub release usable as a production dependency. Open sibling branches are evidence, not release authority. ## Live delivery queue @@ -38,73 +38,70 @@ Fresh inventory contains 24 open PRs: `#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #153, #154, #155, #156, #157, #158`. -PR #137 is protected-main truth. Closed/superseded predecessor checks, reviews, approvals, and artifacts do not transfer to replacements or moved heads. +PR #137 is protected-main truth. Predecessor checks, reviews, approvals, and artifacts do not transfer after head/base movement. -| PR | Exact head | Classification | Current evidence / next action | +| PR | Exact head | State | Current decision | | --- | --- | --- | --- | -| #129 Agent Artifact Admission | `79e8da09ef571f05a2eb7ac71aa80ed61c3b81b0` | Draft | Admission rejects alternate install/trust roots across uv, Cargo, pip attached short-option forms and contradictory npm script-suppression forms. The downstream executor/quarantine path remains responsible for independently verifying retrieved bytes or equivalent provenance before installation. Current repository gates are queued/non-passing and current-head review evidence must be reacquired before Ready. | -| #136 Network-Egress | `3e66c260bfcd09c7dc98dc5d1e931583f8379093` | Ready, source defect remains | Shared URL/resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, hop-by-hop response filtering, and architecture fitness are present. One verified defect remains: `validated_outbound_http_client` performs manual DNS resolution before the request timeout begins, so a stalled resolver can exceed the intended operation budget. It requires a deterministic bounded-resolution/deadline RED→GREEN repair before merge. Exact-head CI/Fuzz/Security/SAST are currently pre-checkout/queued; #155 must also become protected truth before final integration. | -| #140 Runtime Configuration | `43d1b6e9122d8bb5cb882f8fc6e066c63b39ae45` | Ready | Security `33556345110` and SAST `33556345038` are GREEN; current CI/Fuzz are queued. Runtime Configuration remains a supporting bootstrap boundary distinct from secret-bearing Credential Registry. | -| #144 Kubernetes manifest path + public docs | `8fd2461c6a1cadcf27f81f7fe29da62691eee7ff` | Ready, main-based | Repository-path migration preserves #137's hardened Secret contract and live Kubernetes identities. Predecessor CI acquired Ubuntu 24.04 and failed only `cargo fmt --check`; exact rustfmt output was applied in `4ab1e8a…` and `8fd2461…` without behavior change. Replacement CI `33607380492`, Security `33607380471`, SAST `33607380572`, and Fuzz `33607380609` are queued/pending, with CI currently pre-checkout at `runner_id=0`. Reacquire all exact-head evidence before merge. | -| #153 explicit hosted runner | `b663f9d200e5f385c7dd067d074940a02836c68e` | Ready, clean stack root | Repository-owned exact-SHA CI/Fuzz/Security/SAST have previously completed GREEN on this unchanged source. Current replacement-PR repository/central evidence is again queued/non-passing; `.github#712`, `.github#1637`, and `.github#772` own the remaining control-plane/governance classes. | -| #155 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready, clean main-based replacement | Restores the exact reviewed auth delta to protected-main lineage after predecessor #138 was absorbed into a temporary feature branch. Prior same-source repository CI/Fuzz/Security/SAST are GREEN, but the new #155 workflow wave and central review/security/governance evidence remain non-terminal; its current repository CI is pre-checkout with `runner_id=0`. Devin's current comments are informational rather than source defects. | -| #156 support-bundle operability evidence | `76037b8ae206ace8dab0e6622dfc9fc88c57deb3` | Draft, stacked on #153 | Clean replacement for contaminated #150. After #153 reaches protected `main`, retarget/reconstruct on fresh main and regenerate all base-sensitive evidence. | -| #157 trusted proxy attribution | `65a2b7fbf2827f69ae1aa288696b6c5630af28c4` | Draft, stacked on #153 | Clean replacement for contaminated #151; forwarded identity is trusted only from configured proxy CIDRs. Revalidate after parent integration. | -| #158 readiness metrics | `387a447f856093d02116dfadcf2c4a4a63c6d3ba` | Draft, stacked on #153 | Clean replacement for contaminated #152; readiness gauges reuse existing authority and require fresh evidence after parent integration. | - -`queued`, `pending`, `skipped`, `cancelled`, `absent`, stale, predecessor-head, status-only, model-only, or synthetic evidence is non-passing. Do not transfer evidence after head/base movement. +| #129 Agent Artifact Admission | `1ea226df6ed871c64a0a749c7a4e4f5a6363e599` | Draft | Admission now also blocks npm workspace selectors (`--workspace`, `-w`, enabled `--workspaces`) in addition to previously covered uv/Cargo/pip/npm bypass classes. Current exact-head repository gates remain queued/non-passing; fresh review is required before Ready. Retrieval-byte/provenance verification and hostile execution stay executor/quarantine-owned. | +| #136 Network-Egress | `3e66c260bfcd09c7dc98dc5d1e931583f8379093` | Ready, source defect | Shared structural URL validation, resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, response hop filtering, and architecture fitness are present. A valid review finding remains: manual `lookup_host` occurs before request timeout accounting, so slow DNS can exceed the intended feed/TAXII/KEV operation budget. Repair with deterministic bounded-resolution/deadline RED→GREEN before merge. #155 must also become protected truth before final integration. | +| #140 Runtime Configuration | `43d1b6e9122d8bb5cb882f8fc6e066c63b39ae45` | Ready | Security/SAST are GREEN on the current head; CI/Fuzz remain non-terminal. Runtime Configuration remains a supporting bootstrap boundary; Credential Registry remains secret authority. | +| #144 Kubernetes path/public docs | `9616b94ac1ecf70038071a8c9395348694e6312c` | Ready | Hardened manifest source moves to `deploy/kubernetes/wardnet.yaml` without renaming live Kubernetes resources. Review-driven path/link regressions are resolved. Current CI `33616605266`, Security `33616605314`, SAST `33616605253`, and Fuzz `33616605334` remain queued/non-passing. | +| #153 explicit hosted runner | `b663f9d200e5f385c7dd067d074940a02836c68e` | Ready, clean stack root | Same-source repository CI/Fuzz/Security/SAST have terminal GREEN evidence. Current central runner/review/governance evidence is non-terminal. `ubuntu-slim` is only an acquisition canary, not a heavyweight-workload replacement. | +| #155 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready, main-based | Non-loopback startup fails closed without write-capable admin credentials; current review threads are resolved. Same-source repository CI/Fuzz/Security/SAST have terminal GREEN evidence, while the latest replacement wave/central gates remain non-terminal. Issue #78 closes only after protected merge. | +| #156 operability evidence | `76037b8ae206ace8dab0e6622dfc9fc88c57deb3` | Draft, child of #153 | Preserve support-bundle/readiness evidence; reconstruct/restack on fresh protected main after #153 integrates, then regenerate all base-sensitive evidence. | +| #157 trusted proxy | `65a2b7fbf2827f69ae1aa288696b6c5630af28c4` | Draft, child of #153 | Preserve fail-closed forwarded-IP attribution. Reconstruct/restack after #153 protected merge. | +| #158 readiness metrics | `387a447f856093d02116dfadcf2c4a4a63c6d3ba` | Draft, child of #153 | Preserve readiness gauges using existing readiness/KPI authority. Reconstruct/restack after #153 protected merge. | + +Auto-merge has been enabled on #144, #153, and #155, but none is protected truth until GitHub actually integrates the unchanged exact head through the live ruleset. Auto-merge state never transfers evidence or authorizes a weaker base. ## Open issues and production order -Fresh inventory contains 17 open issues: `#11, #38, #74, #75, #78, #79, #80, #81, #82, #83, #84, #85, #86, #87, #89, #128, #139`. +Fresh issue inventory remains `#11, #38, #74, #75, #78, #79, #80, #81, #82, #83, #84, #85, #86, #87, #89, #128, #139`. -1. **Immediate exposure controls:** #78 fail-closed management auth through clean PR #155, #79 fail-closed destination policy through #136 plus its remaining allowlist/evidence work and DNS-deadline defect, #11 real attack-path CI, and #75 repository-path migration through #144. -2. **Security admission:** #128 Agent Artifact Admission through #129. Hostile execution remains quarantine-owned. -3. **Durable authority and effects:** #80 PostgreSQL production authority/tenant isolation, then #81 transactional outbox and leased workers. -4. **Identity and overload:** #82 Keyverse-backed identity/authorization/approval and #83 distributed/global admission. #157 is only the trusted-network-identity slice and remains parent-gated on #153. -5. **Proven security engines:** #86 Coraza/CRS and Suricata production enforcement with detection/false-positive evidence. -6. **Immutable delivery and operation:** #84 signed/SBOM/provenance release promotion/rollback, then #85 OpenTelemetry/SLO/incident/restore evidence. -7. **Supporting correctness:** #74 deterministic persistence fault testing, #77 pinned compiler, #139 coherent runtime configuration, #75 manifest filename migration, and #153 deterministic hosted-runner selection. +1. Immediate exposure controls: #78 through #155, #79 through #136 plus remaining allowlist/evidence/deadline work, #11 real attack-path CI, and #75 through #144. +2. Security admission: #128 through #129, without absorbing quarantine execution authority. +3. Durable authority/effects: #80 PostgreSQL production authority and tenant isolation, then #81 transactional outbox/leased workers. +4. Identity/overload: #82 Keyverse-backed authorization/approval and #83 distributed/global admission. #157 is only the trusted-network attribution slice. +5. Proven security engines: #86 Coraza/CRS and Suricata with detection and false-positive evidence. +6. Immutable delivery/operation: #84 signed artifact/SBOM/provenance/rollback, then #85 telemetry/SLO/incident/restore evidence. +7. Supporting correctness: #74 deterministic persistence fault testing, #77 pinned compiler, #139 coherent runtime configuration, and #153 deterministic hosted-runner selection. Close an issue only after its owning protected merge satisfies the issue acceptance contract on current evidence. ## DDD and implementation gaps -Agent Artifact Admission has a responsibility-aligned crate under `crates/agent-artifact-admission` on #129 with domain-policy independence tests. The candidate now treats package-manager destination selection, attached short-option capability spellings, script-suppression ambiguity, and alternate Cargo/uv trust roots as admitted capabilities. Actual artifact retrieval verification, filesystem/mount/process isolation, and hostile execution remain downstream executor/quarantine responsibilities. - -The legacy gateway remains concentrated in root `src/lib.rs`. File size alone does not justify a deployable split, but repeated changes to client attribution, outbound policy, runtime configuration, proxying, SOC integration, rate limiting, support evidence, and management APIs show genuine responsibility-convergence pressure. Structural work should add dependency/ownership fitness first and prefer a modular monolith until transaction, deployment, scaling, or reuse evidence justifies another deployable. +Agent Artifact Admission has a responsibility-aligned crate and domain-policy independence tests. Artifact retrieval verification, filesystem/mount/process isolation, and hostile execution remain downstream executor/quarantine responsibilities. -#140 is the coherent Runtime Configuration migration. `CredentialRegistry` remains the secret-bearing bootstrap owner. New direct process-environment reads outside approved bootstrap adapters are architecture defects. +The legacy gateway remains concentrated in root `src/lib.rs`. File size alone is not a decomposition criterion, but repeated change pressure across client attribution, outbound policy, runtime configuration, proxying, SOC integration, rate limiting, support evidence, and management APIs is a real modularity signal. Add dependency/ownership fitness before structural movement and prefer a modular monolith until transaction, deployment, scaling, or reuse evidence justifies another deployable. -Network-Egress remains incomplete after #136. In addition to the verified DNS-resolution deadline defect, issue #79 still requires versioned hostname/suffix/IP/CIDR/scheme/port allowlists, deterministic deny-overrides precedence, connector parity, minimized decision evidence, and operator migration/rollback/diagnostics. +Network-Egress remains incomplete after #136. Besides the resolver-deadline defect, #79 still requires versioned hostname/suffix/IP/CIDR/scheme/port allowlists, deterministic deny-overrides precedence, connector parity, minimized policy-decision evidence, and operator migration/rollback/diagnostics. -PR #95 is not an acceptable production integration vehicle. It is a large diverged cross-context branch combining Coraza, PostgreSQL, outbox, egress, and release responsibilities. Preserve its unique tests/evidence while reconstructing bounded #80/#81/#86 successor work rather than merging a god-PR. +PR #95 remains too broad to serve as the production integration vehicle. Preserve its unique PostgreSQL/outbox/Coraza tests and evidence while reconstructing bounded #80/#81/#86 successor work instead of merging the cross-context god-PR. ## Research and standards grounding -External standards constrain design and verification; they do not prove Wardnet currently implements every control. +Standards constrain implementation and evidence; they do not prove controls are shipped. - Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). *Zero trust architecture* (NIST SP 800-207). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-207. - Souppaya, M., Scarfone, K., & Dodson, D. (2022). *Secure Software Development Framework (SSDF) version 1.1* (NIST SP 800-218). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-218. - OWASP Foundation. (2025). *Application Security Verification Standard 5.0.0*. https://owasp.org/www-project-application-security-verification-standard/. - Soldani, J., Tamburri, D. A., & van den Heuvel, W.-J. (2018). The pains and gains of microservices: A systematic grey literature review. *Journal of Systems and Software, 146*, 215–232. https://doi.org/10.1016/j.jss.2018.09.082. -The microservices evidence is used narrowly to avoid decomposition-by-file-size: split deployables only when responsibility, scaling, transaction, isolation, or reuse evidence justifies the operating cost. +The microservices evidence is used only to resist decomposition-by-file-size: deployable boundaries require responsibility, scaling, transaction, isolation, or reuse evidence that justifies their operating cost. -## Quality, security, and release gates +## Quality and release gates -Wardnet-owned production code targets 100% statement and branch coverage and complete public rustdoc/docstrings. Security-critical changes require hostile/bypass/replay/race/DoS/network/cleanup tests and current-source verification of review findings. Coverage exclusions, source rewriting, skipped required paths, or green statuses bound to another revision are not acceptable evidence. +Wardnet-owned production code targets 100% statement/branch coverage and complete public rustdoc/docstrings. Security-critical changes require realistic hostile/bypass/replay/race/DoS/network/cleanup tests and current-source verification of review findings. Coverage exclusions, source rewriting, skipped required paths, or statuses bound to another revision are not evidence. -A release is not authorized. Wardnet, Quarantine Sandbox Runtime, EgressWeave, `context-graph-contracts`, and `enterprise-architecture-core` expose no GitHub Release at this snapshot, and Wardnet production gate #87 remains open. Release requires one exact integrated protected head with CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence and immutable artifact identity. +No release is authorized. Wardnet, Context Graph Contracts, and EA Core expose no GitHub Release at this snapshot, and production release gate #87 remains open. Release requires one exact integrated protected head with CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence and immutable artifact identity. ## Next execution order -1. Drive clean runner root #153 through current central evidence while `.github#712`, `.github#1637`, and `.github#772` repair acquisition/model-review/governance defects; keep scanner availability/evidence handling in `.github#891`. -2. Keep independent work moving while #153 waits. Preserve #156/#157/#158 on clean #153 without predecessor-evidence reuse. -3. Repair #136's DNS-resolution deadline defect test-first, then revalidate it after #155 becomes protected truth; keep #144 main-based and continue its fresh exact-head gates. -4. Integrate immediate security root #155 as exact gates become valid. -5. Finish #129 as one Agent Artifact Admission bounded context without absorbing quarantine or Agent/LLM orchestration. -6. Drain clean supporting work such as #77, #90, #93, #134, #135, #140, #141, and #154 when exact evidence permits. -7. Reconstruct #95's still-valuable PostgreSQL/outbox/Coraza evidence into bounded #80/#81/#86 lanes. -8. Continue #82/#83/#84/#85 only after their declared dependencies become protected truth. -9. Refresh this baseline whenever protected truth, queue topology, release state, or responsibility boundaries materially change. +1. Continue #153/#155/#144 through current exact-head gates while `.github#712` repairs runner acquisition and `.github#1644`/related owner work repairs solo-maintainer ruleset semantics. +2. Preserve #156/#157/#158 until #153 is protected, then non-force reconstruct/restack each child on fresh main and reacquire all evidence. +3. Repair #136's DNS-resolution deadline defect test-first; after #155 becomes protected truth, refresh #136 against live main and revalidate. +4. Finish #129 as one Agent Artifact Admission bounded context without absorbing quarantine or Agent/LLM orchestration. +5. Drain clean supporting work (#77, #90, #93, #111, #134, #135, #140, #141, #154) only on unchanged exact heads with live evidence. +6. Reconstruct #95's valuable PostgreSQL/outbox/Coraza evidence into bounded #80/#81/#86 lanes. +7. Continue #82/#83/#84/#85 only after their declared prerequisites become protected/released truth. +8. Refresh this baseline whenever protected truth, queue topology, release state, or responsibility boundaries materially change. From 2ee2e7a57fad3544638ef5c5dec01ce56272fc54 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 20:36:21 +0900 Subject: [PATCH 28/73] docs(gaps): refresh live governance and dependency evidence --- docs/product-technical-gap-baseline.md | 29 +++++++++++++------------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 64d4a0ae..fabd6de7 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -14,23 +14,23 @@ Wardnet is the Rust-first gateway/SOC control plane and owns Gateway, Admission Protected/default Wardnet `main` is `cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. It contains PR #137's externally provisioned, non-optional Kubernetes administrator Secret boundary. Wardnet currently has no GitHub Release. -Organization ruleset `18156473` follows `~DEFAULT_BRANCH`. It still requires one approving review while naming no required reviewer/team, with no code-owner or last-push approval requirement. Review-thread resolution, central required workflows, deletion protection, and non-fast-forward protection remain enabled. Self-approval and bot/model-as-human approval are forbidden. +A fresh live read of organization ruleset `18156473` after its 2026-09-02 19:15 KST update still shows `~DEFAULT_BRANCH`, `required_approving_review_count=1`, `required_reviewers=[]`, no code-owner review, and no last-push approval requirement. Review-thread resolution, central required workflows, deletion protection, and non-fast-forward protection remain enabled. The live ruleset also still exposes routine `OrganizationAdmin/always` bypass capability; that existence is not normal merge authorization. Self-approval and bot/model-as-human approval are forbidden. -The bare approval count is structurally inconsistent with the declared solo-maintainer model. This is a central governance defect rather than a Wardnet staffing requirement. `.github#1644`, referencing #772 and related governance work, is the current owner-plane reconciliation candidate. Its source policy removes the impossible approval count while preserving deterministic workflow/security/coverage/SBOM/provenance/thread/branch-integrity controls. Source integration alone does not mutate live rulesets; the owner-plane apply remains separately privileged and must be proven from live settings before Wardnet treats the rule as repaired. +The bare approval count is structurally inconsistent with the declared solo-maintainer model. This is a central governance defect rather than a Wardnet staffing requirement. `.github#1644@8f95e06a5c6f7f471121344e4f1846c9893fbd38`, referencing #772 and related governance work, is the current owner-plane reconciliation candidate. Its source policy removes the impossible approval count while preserving deterministic workflow/security/coverage/SBOM/provenance/thread/branch-integrity controls. Source integration alone does not mutate live rulesets; the owner-plane apply remains separately privileged and must be proven from live settings before Wardnet treats the rule as repaired. -Runner acquisition is also a central control-plane concern. PR #153 pins repository-owned CI/Fuzz/Scorecard runner declarations to explicit `ubuntu-24.04` and permanently rejects floating `ubuntu-latest`. Exact head `b663f9d200e5f385c7dd067d074940a02836c68e` has already completed repository CI/Fuzz/Security/SAST successfully on that same source, proving the full hosted image is executable when admitted. Later exact-head waves across Wardnet, Context Graph Contracts, and EA Core have again remained pre-checkout with `runner_id=0`. `.github#712` owns that acquisition/capacity/policy-routing defect. +Runner acquisition is also a central control-plane concern. PR #153 pins repository-owned CI/Fuzz/Scorecard runner declarations to explicit `ubuntu-24.04` and permanently rejects floating `ubuntu-latest`. Exact head `b663f9d200e5f385c7dd067d074940a02836c68e` has already completed repository CI/Fuzz/Security/SAST successfully on that same source, proving the full hosted image is executable when admitted. Later exact-head waves across Wardnet, Context Graph Contracts, and EA Core have again remained pre-checkout with `runner_id=0`. `.github#712` owns that acquisition/capacity/policy-routing defect. `.github#1150@7981728db0862eb814588964182bf8aa107117b3` is the current read-only queue-health evidence successor: it preserves exact-current-head startup-failure evidence, but its own security/supply-chain checks are still queued or pending and it is not a runner-capacity repair by itself. GitHub's current hosted-runner contract does not make `ubuntu-slim` an equivalent workaround: it is an unprivileged 1-vCPU/5-GB container runner with a 15-minute job ceiling intended for lightweight automation rather than typical heavyweight CI/CD. A successful slim job is therefore an admission canary, not justification to downgrade Wardnet CI/Fuzz/CodeQL/coverage workloads. ## Context Fabric live boundary -Fresh metadata still reports `develop` as the default branch for both `ContextualWisdomLab/context-graph-contracts` and `ContextualWisdomLab/enterprise-architecture-core`. Both expose zero GitHub Releases. The accepted protected-`main` transition remains central `.github`/Context Fabric owner work rather than a Wardnet source mutation. +Fresh metadata still reports `develop` as the default branch for both `ContextualWisdomLab/context-graph-contracts` and `ContextualWisdomLab/enterprise-architecture-core`. Their protected `develop` tips remain `context-graph-contracts@99cb5468ba3c15c5e79688f53dee74724fae2d13` and `enterprise-architecture-core@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`. Both expose zero GitHub Releases. The accepted protected-`main` transition remains central `.github`/Context Fabric owner work rather than a Wardnet source mutation. -Context Graph Contracts #20 is Draft at exact `475ce14185db697940e8219c3cda7f24d66f3ed7`. Its current required jobs are non-terminal in the runner-acquisition class. Child #21 is Draft at exact `239a73d5f1a18b10ad317fdd51567b7fa040f570` on obsolete #20 ancestry and contains the structured Context Assertion/CloudEvent envelope and authority/conformance repair. No immutable CGC release exists, so Wardnet must not bind production behavior to either open PR head. +Context Graph Contracts now has a dependency-root release-provenance prerequisite: Draft #25 is exact `f184cc4d44637fc429ba5d1072838f5d1dd1dc61` on #19 and binds package/SBOM identities to protected source plus independently verifiable manifest-attestation evidence. Its exact-current repository workflows remain pre-checkout/queued. Draft #20 remains exact `475ce14185db697940e8219c3cda7f24d66f3ed7`; child #21 remains exact `239a73d5f1a18b10ad317fdd51567b7fa040f570` on obsolete #20 ancestry and contains the structured Context Assertion/CloudEvent envelope and authority/conformance repair. The intended rebuilt order is `#19 -> #25 -> #20 -> #21`. No immutable CGC release exists, so Wardnet must not bind production behavior to any open PR head. -Enterprise Architecture Core #39 is Draft at exact `c3879f172d97e2d814ff94d664be0a797e2228be` with current runner-acquisition evidence non-terminal. Child #40 is Draft at exact `b3ec93a42528ab0defc0116ac4695d669298240f` on obsolete #39 ancestry. #40 already preserves the required Wardnet/quarantine authority boundary: `contextual-orchestrator -> quarantine application-service lease`, `Wardnet -> quarantine artifact-analysis evidence`, no malware verdict or artifact risk score as authoritative EA fact, and no direct database/source-copy integration. It must remain release-gated until a compatible immutable CGC package/provenance contract exists. +Enterprise Architecture Core #39 remains Draft at exact `c3879f172d97e2d814ff94d664be0a797e2228be` with current runner-acquisition evidence non-terminal. Child #40 remains Draft at exact `b3ec93a42528ab0defc0116ac4695d669298240f` on obsolete #39 ancestry. #40 already preserves the required Wardnet/quarantine authority boundary: `contextual-orchestrator -> quarantine application-service lease`, `Wardnet -> quarantine artifact-analysis evidence`, no malware verdict or artifact risk score as authoritative EA fact, and no direct database/source-copy integration. It explicitly remains fail-closed until compatible immutable CGC source-bound release evidence and qualifying quarantine release evidence exist. -Quarantine Sandbox Runtime and EgressWeave also expose no inspected immutable GitHub release usable as a production dependency. Open sibling branches are evidence, not release authority. +Quarantine Sandbox Runtime and EgressWeave open branches remain evidence rather than Wardnet production dependency authority. Wardnet may consume them only after a compatible immutable released contract is available and validated. ## Live delivery queue @@ -43,16 +43,17 @@ PR #137 is protected-main truth. Predecessor checks, reviews, approvals, and art | PR | Exact head | State | Current decision | | --- | --- | --- | --- | | #129 Agent Artifact Admission | `1ea226df6ed871c64a0a749c7a4e4f5a6363e599` | Draft | Admission now also blocks npm workspace selectors (`--workspace`, `-w`, enabled `--workspaces`) in addition to previously covered uv/Cargo/pip/npm bypass classes. Current exact-head repository gates remain queued/non-passing; fresh review is required before Ready. Retrieval-byte/provenance verification and hostile execution stay executor/quarantine-owned. | -| #136 Network-Egress | `3e66c260bfcd09c7dc98dc5d1e931583f8379093` | Ready, source defect | Shared structural URL validation, resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, response hop filtering, and architecture fitness are present. A valid review finding remains: manual `lookup_host` occurs before request timeout accounting, so slow DNS can exceed the intended feed/TAXII/KEV operation budget. Repair with deterministic bounded-resolution/deadline RED→GREEN before merge. #155 must also become protected truth before final integration. | +| #136 Network-Egress | `3e66c260bfcd09c7dc98dc5d1e931583f8379093` | Ready, source defect | Shared structural URL validation, resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, response hop filtering, and architecture fitness are present. One exact-current review finding remains unresolved: manual `lookup_host` occurs before request timeout accounting, so slow DNS can exceed the intended feed/TAXII/KEV operation budget. Repair with deterministic bounded-resolution/deadline RED→GREEN before merge. #155 must also become protected truth before final integration. | | #140 Runtime Configuration | `43d1b6e9122d8bb5cb882f8fc6e066c63b39ae45` | Ready | Security/SAST are GREEN on the current head; CI/Fuzz remain non-terminal. Runtime Configuration remains a supporting bootstrap boundary; Credential Registry remains secret authority. | -| #144 Kubernetes path/public docs | `9616b94ac1ecf70038071a8c9395348694e6312c` | Ready | Hardened manifest source moves to `deploy/kubernetes/wardnet.yaml` without renaming live Kubernetes resources. Review-driven path/link regressions are resolved. Current CI `33616605266`, Security `33616605314`, SAST `33616605253`, and Fuzz `33616605334` remain queued/non-passing. | +| #144 Kubernetes path/public docs | `9616b94ac1ecf70038071a8c9395348694e6312c` | Ready | Hardened manifest source moves to `deploy/kubernetes/wardnet.yaml` without renaming live Kubernetes resources. Review-driven path/link regressions are resolved. Current repository gates remain queued/non-passing. | | #153 explicit hosted runner | `b663f9d200e5f385c7dd067d074940a02836c68e` | Ready, clean stack root | Same-source repository CI/Fuzz/Security/SAST have terminal GREEN evidence. Current central runner/review/governance evidence is non-terminal. `ubuntu-slim` is only an acquisition canary, not a heavyweight-workload replacement. | -| #155 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready, main-based | Non-loopback startup fails closed without write-capable admin credentials; current review threads are resolved. Same-source repository CI/Fuzz/Security/SAST have terminal GREEN evidence, while the latest replacement wave/central gates remain non-terminal. Issue #78 closes only after protected merge. | +| #154 commercial readiness target | `41098f76c8a823c20ba0e319c38cf24acb470346` | Ready | Aligns the shipped readiness threshold and buyer evidence to the 20B KRW target without rewriting historical plan artifacts. Current inline review-thread inventory is empty and the substantive automated review reports no source finding, but CI/Fuzz/Security/SAST are all queued on this exact head; queued evidence is non-passing. | +| #155 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready, main-based | Non-loopback startup fails closed without write-capable admin credentials; current review threads are resolved. Same-source repository CI/Fuzz/Security/SAST have terminal GREEN evidence, while the latest replacement wave and central coverage/review gates remain non-terminal on the same source SHA. Issue #78 closes only after protected merge. | | #156 operability evidence | `76037b8ae206ace8dab0e6622dfc9fc88c57deb3` | Draft, child of #153 | Preserve support-bundle/readiness evidence; reconstruct/restack on fresh protected main after #153 integrates, then regenerate all base-sensitive evidence. | | #157 trusted proxy | `65a2b7fbf2827f69ae1aa288696b6c5630af28c4` | Draft, child of #153 | Preserve fail-closed forwarded-IP attribution. Reconstruct/restack after #153 protected merge. | | #158 readiness metrics | `387a447f856093d02116dfadcf2c4a4a63c6d3ba` | Draft, child of #153 | Preserve readiness gauges using existing readiness/KPI authority. Reconstruct/restack after #153 protected merge. | -Auto-merge has been enabled on #144, #153, and #155, but none is protected truth until GitHub actually integrates the unchanged exact head through the live ruleset. Auto-merge state never transfers evidence or authorizes a weaker base. +Auto-merge state, where enabled, is state only, not protected truth or transferable evidence. A changed head/base must reacquire the then-live policy evidence. ## Open issues and production order @@ -64,7 +65,7 @@ Fresh issue inventory remains `#11, #38, #74, #75, #78, #79, #80, #81, #82, #83, 4. Identity/overload: #82 Keyverse-backed authorization/approval and #83 distributed/global admission. #157 is only the trusted-network attribution slice. 5. Proven security engines: #86 Coraza/CRS and Suricata with detection and false-positive evidence. 6. Immutable delivery/operation: #84 signed artifact/SBOM/provenance/rollback, then #85 telemetry/SLO/incident/restore evidence. -7. Supporting correctness: #74 deterministic persistence fault testing, #77 pinned compiler, #139 coherent runtime configuration, and #153 deterministic hosted-runner selection. +7. Supporting correctness: #74 deterministic persistence fault testing, #77 pinned compiler, #139 coherent runtime configuration, #153 deterministic hosted-runner selection, and #154 the 20B KRW commercial-readiness contract. Close an issue only after its owning protected merge satisfies the issue acceptance contract on current evidence. @@ -97,11 +98,11 @@ No release is authorized. Wardnet, Context Graph Contracts, and EA Core expose n ## Next execution order -1. Continue #153/#155/#144 through current exact-head gates while `.github#712` repairs runner acquisition and `.github#1644`/related owner work repairs solo-maintainer ruleset semantics. +1. Continue #153/#155/#144/#154 through current exact-head gates while `.github#712` repairs runner acquisition and `.github#1644`/related owner work repairs solo-maintainer ruleset semantics. 2. Preserve #156/#157/#158 until #153 is protected, then non-force reconstruct/restack each child on fresh main and reacquire all evidence. 3. Repair #136's DNS-resolution deadline defect test-first; after #155 becomes protected truth, refresh #136 against live main and revalidate. 4. Finish #129 as one Agent Artifact Admission bounded context without absorbing quarantine or Agent/LLM orchestration. -5. Drain clean supporting work (#77, #90, #93, #111, #134, #135, #140, #141, #154) only on unchanged exact heads with live evidence. +5. Drain clean supporting work (#77, #90, #93, #111, #134, #135, #140, #141) only on unchanged exact heads with live evidence. 6. Reconstruct #95's valuable PostgreSQL/outbox/Coraza evidence into bounded #80/#81/#86 lanes. 7. Continue #82/#83/#84/#85 only after their declared prerequisites become protected/released truth. 8. Refresh this baseline whenever protected truth, queue topology, release state, or responsibility boundaries materially change. From ff06e173b65c3ec8fa125845e1e1e4501042038c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 20:43:52 +0900 Subject: [PATCH 29/73] docs(gaps): record orchestrator ownership repair --- docs/product-technical-gap-baseline.md | 33 ++++++++++++++++---------- 1 file changed, 20 insertions(+), 13 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index fabd6de7..6e781f31 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -6,7 +6,9 @@ Snapshot date: 2026-09-02. This document is a dated repository snapshot. Live re Wardnet is the Rust-first gateway/SOC control plane and owns Gateway, Admission Policy, Artifact Identity, Security Analysis Integration, Network-Egress, SOC Evidence, Runtime Control, Audit-Provenance, and the Agent Artifact Admission bounded context. It does not execute hostile workloads or own provider/model orchestration. -`ContextualWisdomLab/quarantine-sandbox-runtime` owns reusable hostile-workload isolation, execution lifecycle, cleanup, and artifact-analysis evidence. `contextual-orchestrator` owns Agent/LLM orchestration and provider/model routing. EgressWeave is the canonical outbound HTTP-policy candidate. Wardnet consumes released/versioned ports and Anti-Corruption Layers; it does not copy those implementations or access foreign application databases. +`ContextualWisdomLab/quarantine-sandbox-runtime` owns reusable hostile-workload isolation, execution lifecycle, cleanup, and artifact-analysis evidence. `contextual-orchestrator` owns Agent/LLM orchestration, provider/model discovery and routing, concrete model selection, provider credentials, and free/paid policy. EgressWeave is the canonical outbound HTTP-policy candidate. Wardnet consumes released/versioned ports and Anti-Corruption Layers; it does not copy those implementations or access foreign application databases. + +The protected Wardnet tree still carries an integration debt at the optional SOC LLM seam: `soc_llm_chat_body(model, event)` accepts a caller model selector, and `tests/adaptive_orchestrator_default.rs` intentionally preserves that field. That is not the desired owner contract. Wardnet must eventually call a released/versioned contextual-orchestrator API/client/schema Agent without selecting a provider or concrete model. Fresh contextual-orchestrator release inventory is empty, so no mutable branch is promoted as the production replacement. Canonical CO owner PR #971 at `6fed18cf8d49248cea4904b14e4ed03b7e7fba88` already states that consumers must wait for integrated exact-head GREEN plus an immutable released API/client/schema before bumping. `context-graph-contracts` is the provider-neutral Context Fabric Shared Kernel for canonical object/authority references, truth status/origin, valid/system time, provenance, Context Assertion, CloudEvents, schema, conformance, and admission. `enterprise-architecture-core` is the EA Decision Plane. Both remain read-only source dependencies from this writer while the dedicated Context Fabric writer is active. Security findings, alerts, malware verdicts, artifact risk scores, prompts, and customer/runtime data do not become authoritative EA facts. @@ -30,7 +32,7 @@ Context Graph Contracts now has a dependency-root release-provenance prerequisit Enterprise Architecture Core #39 remains Draft at exact `c3879f172d97e2d814ff94d664be0a797e2228be` with current runner-acquisition evidence non-terminal. Child #40 remains Draft at exact `b3ec93a42528ab0defc0116ac4695d669298240f` on obsolete #39 ancestry. #40 already preserves the required Wardnet/quarantine authority boundary: `contextual-orchestrator -> quarantine application-service lease`, `Wardnet -> quarantine artifact-analysis evidence`, no malware verdict or artifact risk score as authoritative EA fact, and no direct database/source-copy integration. It explicitly remains fail-closed until compatible immutable CGC source-bound release evidence and qualifying quarantine release evidence exist. -Quarantine Sandbox Runtime and EgressWeave open branches remain evidence rather than Wardnet production dependency authority. Wardnet may consume them only after a compatible immutable released contract is available and validated. +Quarantine Sandbox Runtime, EgressWeave, and contextual-orchestrator expose no inspected immutable GitHub release usable as a Wardnet production dependency. Open sibling branches are evidence, not release authority. ## Live delivery queue @@ -42,12 +44,13 @@ PR #137 is protected-main truth. Predecessor checks, reviews, approvals, and art | PR | Exact head | State | Current decision | | --- | --- | --- | --- | +| #88 LiteLLM ingress proxy | `e693a085b43d1949f811108fe05cdb5335787d52` | GitHub Ready flag, architecture Draft-required; mergeable false | The direct LiteLLM virtual-key/provider proxy conflicts with contextual-orchestrator ownership. Preserve its unique fail-closed credential grammar, header minimization, streaming, zero-upstream-hit, property/fuzz and RFC 6750 evidence; do not close or merge it. Rework/transfer those valid Wardnet gateway/admission deltas behind a released CO ACL after CO publishes an immutable compatible client/schema/Agent. The connector Draft-state mutation currently fails before state change, so the UI Ready flag is not authority. | | #129 Agent Artifact Admission | `1ea226df6ed871c64a0a749c7a4e4f5a6363e599` | Draft | Admission now also blocks npm workspace selectors (`--workspace`, `-w`, enabled `--workspaces`) in addition to previously covered uv/Cargo/pip/npm bypass classes. Current exact-head repository gates remain queued/non-passing; fresh review is required before Ready. Retrieval-byte/provenance verification and hostile execution stay executor/quarantine-owned. | | #136 Network-Egress | `3e66c260bfcd09c7dc98dc5d1e931583f8379093` | Ready, source defect | Shared structural URL validation, resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, response hop filtering, and architecture fitness are present. One exact-current review finding remains unresolved: manual `lookup_host` occurs before request timeout accounting, so slow DNS can exceed the intended feed/TAXII/KEV operation budget. Repair with deterministic bounded-resolution/deadline RED→GREEN before merge. #155 must also become protected truth before final integration. | | #140 Runtime Configuration | `43d1b6e9122d8bb5cb882f8fc6e066c63b39ae45` | Ready | Security/SAST are GREEN on the current head; CI/Fuzz remain non-terminal. Runtime Configuration remains a supporting bootstrap boundary; Credential Registry remains secret authority. | | #144 Kubernetes path/public docs | `9616b94ac1ecf70038071a8c9395348694e6312c` | Ready | Hardened manifest source moves to `deploy/kubernetes/wardnet.yaml` without renaming live Kubernetes resources. Review-driven path/link regressions are resolved. Current repository gates remain queued/non-passing. | | #153 explicit hosted runner | `b663f9d200e5f385c7dd067d074940a02836c68e` | Ready, clean stack root | Same-source repository CI/Fuzz/Security/SAST have terminal GREEN evidence. Current central runner/review/governance evidence is non-terminal. `ubuntu-slim` is only an acquisition canary, not a heavyweight-workload replacement. | -| #154 commercial readiness target | `41098f76c8a823c20ba0e319c38cf24acb470346` | Ready | Aligns the shipped readiness threshold and buyer evidence to the 20B KRW target without rewriting historical plan artifacts. Current inline review-thread inventory is empty and the substantive automated review reports no source finding, but CI/Fuzz/Security/SAST are all queued on this exact head; queued evidence is non-passing. | +| #154 commercial readiness target | `41098f76c8a823c20ba0e319c38cf24acb470346` | Ready | Aligns the shipped readiness threshold and buyer evidence to the 20B KRW target without rewriting historical plan artifacts. Current inline review-thread inventory is empty and the substantive automated review reports no source finding, but CI/Fuzz/Security/SAST are all queued on this exact head; queued evidence is non-passing. Normal auto-merge is armed but cannot integrate until live policy is satisfied. | | #155 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready, main-based | Non-loopback startup fails closed without write-capable admin credentials; current review threads are resolved. Same-source repository CI/Fuzz/Security/SAST have terminal GREEN evidence, while the latest replacement wave and central coverage/review gates remain non-terminal on the same source SHA. Issue #78 closes only after protected merge. | | #156 operability evidence | `76037b8ae206ace8dab0e6622dfc9fc88c57deb3` | Draft, child of #153 | Preserve support-bundle/readiness evidence; reconstruct/restack on fresh protected main after #153 integrates, then regenerate all base-sensitive evidence. | | #157 trusted proxy | `65a2b7fbf2827f69ae1aa288696b6c5630af28c4` | Draft, child of #153 | Preserve fail-closed forwarded-IP attribution. Reconstruct/restack after #153 protected merge. | @@ -61,11 +64,12 @@ Fresh issue inventory remains `#11, #38, #74, #75, #78, #79, #80, #81, #82, #83, 1. Immediate exposure controls: #78 through #155, #79 through #136 plus remaining allowlist/evidence/deadline work, #11 real attack-path CI, and #75 through #144. 2. Security admission: #128 through #129, without absorbing quarantine execution authority. -3. Durable authority/effects: #80 PostgreSQL production authority and tenant isolation, then #81 transactional outbox/leased workers. -4. Identity/overload: #82 Keyverse-backed authorization/approval and #83 distributed/global admission. #157 is only the trusted-network attribution slice. -5. Proven security engines: #86 Coraza/CRS and Suricata with detection and false-positive evidence. -6. Immutable delivery/operation: #84 signed artifact/SBOM/provenance/rollback, then #85 telemetry/SLO/incident/restore evidence. -7. Supporting correctness: #74 deterministic persistence fault testing, #77 pinned compiler, #139 coherent runtime configuration, #153 deterministic hosted-runner selection, and #154 the 20B KRW commercial-readiness contract. +3. LLM ownership repair: keep #88 open but non-integrable until contextual-orchestrator ships the released provider-neutral contract; then preserve only Wardnet-owned credential/admission/streaming defenses and remove direct LiteLLM/provider/model authority. +4. Durable authority/effects: #80 PostgreSQL production authority and tenant isolation, then #81 transactional outbox/leased workers. +5. Identity/overload: #82 Keyverse-backed authorization/approval and #83 distributed/global admission. #157 is only the trusted-network attribution slice. +6. Proven security engines: #86 Coraza/CRS and Suricata with detection and false-positive evidence. +7. Immutable delivery/operation: #84 signed artifact/SBOM/provenance/rollback, then #85 telemetry/SLO/incident/restore evidence. +8. Supporting correctness: #74 deterministic persistence fault testing, #77 pinned compiler, #139 coherent runtime configuration, #153 deterministic hosted-runner selection, and #154 the 20B KRW commercial-readiness contract. Close an issue only after its owning protected merge satisfies the issue acceptance contract on current evidence. @@ -77,6 +81,8 @@ The legacy gateway remains concentrated in root `src/lib.rs`. File size alone is Network-Egress remains incomplete after #136. Besides the resolver-deadline defect, #79 still requires versioned hostname/suffix/IP/CIDR/scheme/port allowlists, deterministic deny-overrides precedence, connector parity, minimized policy-decision evidence, and operator migration/rollback/diagnostics. +The protected SOC LLM request builder and #88 together show the same ownership drift from two directions: caller-supplied model authority in current main and a direct LiteLLM proxy in an old feature branch. The repair is not another Wardnet provider adapter. It is a released contextual-orchestrator ACL followed by a Wardnet consumer bump and removal of local provider/model authority, with fail-closed behavior until that immutable dependency exists. + PR #95 remains too broad to serve as the production integration vehicle. Preserve its unique PostgreSQL/outbox/Coraza tests and evidence while reconstructing bounded #80/#81/#86 successor work instead of merging the cross-context god-PR. ## Research and standards grounding @@ -94,7 +100,7 @@ The microservices evidence is used only to resist decomposition-by-file-size: de Wardnet-owned production code targets 100% statement/branch coverage and complete public rustdoc/docstrings. Security-critical changes require realistic hostile/bypass/replay/race/DoS/network/cleanup tests and current-source verification of review findings. Coverage exclusions, source rewriting, skipped required paths, or statuses bound to another revision are not evidence. -No release is authorized. Wardnet, Context Graph Contracts, and EA Core expose no GitHub Release at this snapshot, and production release gate #87 remains open. Release requires one exact integrated protected head with CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence and immutable artifact identity. +No release is authorized. Wardnet, Context Graph Contracts, EA Core, contextual-orchestrator, Quarantine Sandbox Runtime, and EgressWeave expose no usable immutable GitHub Release at this snapshot for the dependencies described above, and production release gate #87 remains open. Release requires one exact integrated protected head with CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence and immutable artifact identity. ## Next execution order @@ -102,7 +108,8 @@ No release is authorized. Wardnet, Context Graph Contracts, and EA Core expose n 2. Preserve #156/#157/#158 until #153 is protected, then non-force reconstruct/restack each child on fresh main and reacquire all evidence. 3. Repair #136's DNS-resolution deadline defect test-first; after #155 becomes protected truth, refresh #136 against live main and revalidate. 4. Finish #129 as one Agent Artifact Admission bounded context without absorbing quarantine or Agent/LLM orchestration. -5. Drain clean supporting work (#77, #90, #93, #111, #134, #135, #140, #141) only on unchanged exact heads with live evidence. -6. Reconstruct #95's valuable PostgreSQL/outbox/Coraza evidence into bounded #80/#81/#86 lanes. -7. Continue #82/#83/#84/#85 only after their declared prerequisites become protected/released truth. -8. Refresh this baseline whenever protected truth, queue topology, release state, or responsibility boundaries materially change. +5. Keep #88 open and architecture-blocked while contextual-orchestrator #971 completes canonical routing/client work and publishes an immutable compatible release; then reconstruct the Wardnet consumer slice against that released contract without direct model/provider authority. +6. Drain clean supporting work (#77, #90, #93, #111, #134, #135, #140, #141) only on unchanged exact heads with live evidence. +7. Reconstruct #95's valuable PostgreSQL/outbox/Coraza evidence into bounded #80/#81/#86 lanes. +8. Continue #82/#83/#84/#85 only after their declared prerequisites become protected/released truth. +9. Refresh this baseline whenever protected truth, queue topology, release state, or responsibility boundaries materially change. From ed8adb4fc61d19fa263bf2e2d3423fe189ba1318 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 20:48:00 +0900 Subject: [PATCH 30/73] docs(gaps): bind LLM owner RED evidence --- docs/product-technical-gap-baseline.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 6e781f31..e89a44e3 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -44,7 +44,7 @@ PR #137 is protected-main truth. Predecessor checks, reviews, approvals, and art | PR | Exact head | State | Current decision | | --- | --- | --- | --- | -| #88 LiteLLM ingress proxy | `e693a085b43d1949f811108fe05cdb5335787d52` | GitHub Ready flag, architecture Draft-required; mergeable false | The direct LiteLLM virtual-key/provider proxy conflicts with contextual-orchestrator ownership. Preserve its unique fail-closed credential grammar, header minimization, streaming, zero-upstream-hit, property/fuzz and RFC 6750 evidence; do not close or merge it. Rework/transfer those valid Wardnet gateway/admission deltas behind a released CO ACL after CO publishes an immutable compatible client/schema/Agent. The connector Draft-state mutation currently fails before state change, so the UI Ready flag is not authority. | +| #88 LiteLLM ingress proxy | `98a935e4b058d0500d520425b8ebf6ff4106aa1b` | GitHub Ready flag, architecture Draft-required; mergeable false; RED | The direct LiteLLM virtual-key/provider proxy conflicts with contextual-orchestrator ownership. `tests/llm_owner_boundary.rs` now makes the repair gate executable: it remains RED while Wardnet ships the provider-specific proxy or chooses a SOC model. Preserve the unique fail-closed credential grammar, header minimization, streaming, zero-upstream-hit, property/fuzz and RFC 6750 evidence; do not close or merge it. Rework/transfer those valid Wardnet gateway/admission deltas behind a released CO ACL after CO publishes an immutable compatible client/schema/Agent. The connector Draft-state mutation currently fails before state change, so the UI Ready flag is not authority. | | #129 Agent Artifact Admission | `1ea226df6ed871c64a0a749c7a4e4f5a6363e599` | Draft | Admission now also blocks npm workspace selectors (`--workspace`, `-w`, enabled `--workspaces`) in addition to previously covered uv/Cargo/pip/npm bypass classes. Current exact-head repository gates remain queued/non-passing; fresh review is required before Ready. Retrieval-byte/provenance verification and hostile execution stay executor/quarantine-owned. | | #136 Network-Egress | `3e66c260bfcd09c7dc98dc5d1e931583f8379093` | Ready, source defect | Shared structural URL validation, resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, response hop filtering, and architecture fitness are present. One exact-current review finding remains unresolved: manual `lookup_host` occurs before request timeout accounting, so slow DNS can exceed the intended feed/TAXII/KEV operation budget. Repair with deterministic bounded-resolution/deadline RED→GREEN before merge. #155 must also become protected truth before final integration. | | #140 Runtime Configuration | `43d1b6e9122d8bb5cb882f8fc6e066c63b39ae45` | Ready | Security/SAST are GREEN on the current head; CI/Fuzz remain non-terminal. Runtime Configuration remains a supporting bootstrap boundary; Credential Registry remains secret authority. | @@ -64,7 +64,7 @@ Fresh issue inventory remains `#11, #38, #74, #75, #78, #79, #80, #81, #82, #83, 1. Immediate exposure controls: #78 through #155, #79 through #136 plus remaining allowlist/evidence/deadline work, #11 real attack-path CI, and #75 through #144. 2. Security admission: #128 through #129, without absorbing quarantine execution authority. -3. LLM ownership repair: keep #88 open but non-integrable until contextual-orchestrator ships the released provider-neutral contract; then preserve only Wardnet-owned credential/admission/streaming defenses and remove direct LiteLLM/provider/model authority. +3. LLM ownership repair: keep #88 open but non-integrable and RED until contextual-orchestrator ships the released provider-neutral contract; then preserve only Wardnet-owned credential/admission/streaming defenses and remove direct LiteLLM/provider/model authority. 4. Durable authority/effects: #80 PostgreSQL production authority and tenant isolation, then #81 transactional outbox/leased workers. 5. Identity/overload: #82 Keyverse-backed authorization/approval and #83 distributed/global admission. #157 is only the trusted-network attribution slice. 6. Proven security engines: #86 Coraza/CRS and Suricata with detection and false-positive evidence. @@ -81,7 +81,7 @@ The legacy gateway remains concentrated in root `src/lib.rs`. File size alone is Network-Egress remains incomplete after #136. Besides the resolver-deadline defect, #79 still requires versioned hostname/suffix/IP/CIDR/scheme/port allowlists, deterministic deny-overrides precedence, connector parity, minimized policy-decision evidence, and operator migration/rollback/diagnostics. -The protected SOC LLM request builder and #88 together show the same ownership drift from two directions: caller-supplied model authority in current main and a direct LiteLLM proxy in an old feature branch. The repair is not another Wardnet provider adapter. It is a released contextual-orchestrator ACL followed by a Wardnet consumer bump and removal of local provider/model authority, with fail-closed behavior until that immutable dependency exists. +The protected SOC LLM request builder and #88 together show the same ownership drift from two directions: caller-supplied model authority in current main and a direct LiteLLM proxy in an old feature branch. The repair is not another Wardnet provider adapter. It is a released contextual-orchestrator ACL followed by a Wardnet consumer bump and removal of local provider/model authority, with fail-closed behavior until that immutable dependency exists. The #88 architecture RED prevents this drift from becoming an accidental merge while the owner release is unavailable. PR #95 remains too broad to serve as the production integration vehicle. Preserve its unique PostgreSQL/outbox/Coraza tests and evidence while reconstructing bounded #80/#81/#86 successor work instead of merging the cross-context god-PR. From 2f0ca977df98eff5c96ed3048e1674c11ea23cf7 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 22:10:45 +0900 Subject: [PATCH 31/73] docs(gaps): refresh exact-head control-plane evidence --- docs/product-technical-gap-baseline.md | 28 ++++++++++++++------------ 1 file changed, 15 insertions(+), 13 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index e89a44e3..b97d04e2 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -8,7 +8,7 @@ Wardnet is the Rust-first gateway/SOC control plane and owns Gateway, Admission `ContextualWisdomLab/quarantine-sandbox-runtime` owns reusable hostile-workload isolation, execution lifecycle, cleanup, and artifact-analysis evidence. `contextual-orchestrator` owns Agent/LLM orchestration, provider/model discovery and routing, concrete model selection, provider credentials, and free/paid policy. EgressWeave is the canonical outbound HTTP-policy candidate. Wardnet consumes released/versioned ports and Anti-Corruption Layers; it does not copy those implementations or access foreign application databases. -The protected Wardnet tree still carries an integration debt at the optional SOC LLM seam: `soc_llm_chat_body(model, event)` accepts a caller model selector, and `tests/adaptive_orchestrator_default.rs` intentionally preserves that field. That is not the desired owner contract. Wardnet must eventually call a released/versioned contextual-orchestrator API/client/schema Agent without selecting a provider or concrete model. Fresh contextual-orchestrator release inventory is empty, so no mutable branch is promoted as the production replacement. Canonical CO owner PR #971 at `6fed18cf8d49248cea4904b14e4ed03b7e7fba88` already states that consumers must wait for integrated exact-head GREEN plus an immutable released API/client/schema before bumping. +The protected Wardnet tree still carries an integration debt at the optional SOC LLM seam: `soc_llm_chat_body(model, event)` accepts a caller model selector, and `tests/adaptive_orchestrator_default.rs` intentionally preserves that field. That is not the desired owner contract. Wardnet must eventually call a released/versioned contextual-orchestrator API/client/schema Agent without selecting a provider or concrete model. Fresh contextual-orchestrator release inventory is empty, so no mutable branch is promoted as the production replacement. Canonical CO owner PR #971 already states that consumers must wait for integrated exact-head GREEN plus an immutable released API/client/schema before bumping. `context-graph-contracts` is the provider-neutral Context Fabric Shared Kernel for canonical object/authority references, truth status/origin, valid/system time, provenance, Context Assertion, CloudEvents, schema, conformance, and admission. `enterprise-architecture-core` is the EA Decision Plane. Both remain read-only source dependencies from this writer while the dedicated Context Fabric writer is active. Security findings, alerts, malware verdicts, artifact risk scores, prompts, and customer/runtime data do not become authoritative EA facts. @@ -16,11 +16,13 @@ The protected Wardnet tree still carries an integration debt at the optional SOC Protected/default Wardnet `main` is `cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. It contains PR #137's externally provisioned, non-optional Kubernetes administrator Secret boundary. Wardnet currently has no GitHub Release. -A fresh live read of organization ruleset `18156473` after its 2026-09-02 19:15 KST update still shows `~DEFAULT_BRANCH`, `required_approving_review_count=1`, `required_reviewers=[]`, no code-owner review, and no last-push approval requirement. Review-thread resolution, central required workflows, deletion protection, and non-fast-forward protection remain enabled. The live ruleset also still exposes routine `OrganizationAdmin/always` bypass capability; that existence is not normal merge authorization. Self-approval and bot/model-as-human approval are forbidden. +A fresh live read of organization ruleset `18156473` after its 2026-09-02 19:15 KST update still shows `~DEFAULT_BRANCH`, `required_approving_review_count=1`, `required_reviewers=[]`, no code-owner review, and no last-push approval requirement. Review-thread resolution, central required workflows, deletion protection, and non-fast-forward protection remain enabled. The live ruleset also exposes `OrganizationAdmin/always` bypass capability; that existence is not normal merge authorization. Self-approval and bot/model-as-human approval are forbidden. -The bare approval count is structurally inconsistent with the declared solo-maintainer model. This is a central governance defect rather than a Wardnet staffing requirement. `.github#1644@8f95e06a5c6f7f471121344e4f1846c9893fbd38`, referencing #772 and related governance work, is the current owner-plane reconciliation candidate. Its source policy removes the impossible approval count while preserving deterministic workflow/security/coverage/SBOM/provenance/thread/branch-integrity controls. Source integration alone does not mutate live rulesets; the owner-plane apply remains separately privileged and must be proven from live settings before Wardnet treats the rule as repaired. +The bare approval count is structurally inconsistent with the declared solo-maintainer model. This is a central governance defect rather than a Wardnet staffing requirement. `.github#1644@fac1e32a8acfb363da49df75f3386b5edb4eb0ef`, referencing #772 and related governance work, is the current owner-plane reconciliation candidate. Its source policy removes the impossible approval count while preserving deterministic workflow/security/coverage/SBOM/provenance/thread/branch-integrity controls. Source integration alone does not mutate live rulesets; the owner-plane apply remains separately privileged and must be proven from live settings before Wardnet treats the rule as repaired. -Runner acquisition is also a central control-plane concern. PR #153 pins repository-owned CI/Fuzz/Scorecard runner declarations to explicit `ubuntu-24.04` and permanently rejects floating `ubuntu-latest`. Exact head `b663f9d200e5f385c7dd067d074940a02836c68e` has already completed repository CI/Fuzz/Security/SAST successfully on that same source, proving the full hosted image is executable when admitted. Later exact-head waves across Wardnet, Context Graph Contracts, and EA Core have again remained pre-checkout with `runner_id=0`. `.github#712` owns that acquisition/capacity/policy-routing defect. `.github#1150@7981728db0862eb814588964182bf8aa107117b3` is the current read-only queue-health evidence successor: it preserves exact-current-head startup-failure evidence, but its own security/supply-chain checks are still queued or pending and it is not a runner-capacity repair by itself. +Runner acquisition is also a central control-plane concern. PR #153 pins repository-owned CI/Fuzz/Scorecard runner declarations to explicit `ubuntu-24.04` and permanently rejects floating `ubuntu-latest`. Exact head `b663f9d200e5f385c7dd067d074940a02836c68e` has completed repository CI/Fuzz/Security/SAST successfully on that same source, proving the full hosted image is executable when admitted. Later exact-head waves across Wardnet, Context Graph Contracts, and EA Core again remained pre-checkout with `runner_id=0`. `.github#712` owns the acquisition/capacity/policy-routing defect. `.github#1150@7981728db0862eb814588964182bf8aa107117b3` is the current read-only queue-health evidence successor; it preserves exact-current-head startup-failure evidence, but its own required security/supply-chain gates remain non-terminal and it is not a runner-capacity repair by itself. + +A fresh Wardnet reproduction adds a separate evidence-identity defect to `.github#712`: required-workflow run `33550235908` / job `100100529632` is commit-scoped to `b663f9d…` but its durable runtime payload was `PR_NUMBER=147`; it failed because #147 had already moved away from that SHA. The same clean SHA is now the legitimate head of replacement PR #153, so the old failure is visible on the successor commit even though it evaluated the wrong PR identity. Central queue/review evidence must therefore bind at least `(repository, pr_number, head_sha, workflow/check lane)`, classify wrong-PR same-SHA runs as foreign/obsolete evidence, and never manufacture a new leaf SHA merely to escape commit-scoped contamination. GitHub's current hosted-runner contract does not make `ubuntu-slim` an equivalent workaround: it is an unprivileged 1-vCPU/5-GB container runner with a 15-minute job ceiling intended for lightweight automation rather than typical heavyweight CI/CD. A successful slim job is therefore an admission canary, not justification to downgrade Wardnet CI/Fuzz/CodeQL/coverage workloads. @@ -28,7 +30,7 @@ GitHub's current hosted-runner contract does not make `ubuntu-slim` an equivalen Fresh metadata still reports `develop` as the default branch for both `ContextualWisdomLab/context-graph-contracts` and `ContextualWisdomLab/enterprise-architecture-core`. Their protected `develop` tips remain `context-graph-contracts@99cb5468ba3c15c5e79688f53dee74724fae2d13` and `enterprise-architecture-core@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`. Both expose zero GitHub Releases. The accepted protected-`main` transition remains central `.github`/Context Fabric owner work rather than a Wardnet source mutation. -Context Graph Contracts now has a dependency-root release-provenance prerequisite: Draft #25 is exact `f184cc4d44637fc429ba5d1072838f5d1dd1dc61` on #19 and binds package/SBOM identities to protected source plus independently verifiable manifest-attestation evidence. Its exact-current repository workflows remain pre-checkout/queued. Draft #20 remains exact `475ce14185db697940e8219c3cda7f24d66f3ed7`; child #21 remains exact `239a73d5f1a18b10ad317fdd51567b7fa040f570` on obsolete #20 ancestry and contains the structured Context Assertion/CloudEvent envelope and authority/conformance repair. The intended rebuilt order is `#19 -> #25 -> #20 -> #21`. No immutable CGC release exists, so Wardnet must not bind production behavior to any open PR head. +Context Graph Contracts has a dependency-root release-provenance prerequisite: Draft #25 is exact `f184cc4d44637fc429ba5d1072838f5d1dd1dc61` on #19 and binds package/SBOM identities to protected source plus independently verifiable manifest-attestation evidence. Its exact-current repository workflows remain pre-checkout/queued. Draft #20 remains exact `475ce14185db697940e8219c3cda7f24d66f3ed7`; child #21 remains exact `239a73d5f1a18b10ad317fdd51567b7fa040f570` on obsolete #20 ancestry and contains the structured Context Assertion/CloudEvent envelope and authority/conformance repair. The intended rebuilt order is `#19 -> #25 -> #20 -> #21`. No immutable CGC release exists, so Wardnet must not bind production behavior to any open PR head. Enterprise Architecture Core #39 remains Draft at exact `c3879f172d97e2d814ff94d664be0a797e2228be` with current runner-acquisition evidence non-terminal. Child #40 remains Draft at exact `b3ec93a42528ab0defc0116ac4695d669298240f` on obsolete #39 ancestry. #40 already preserves the required Wardnet/quarantine authority boundary: `contextual-orchestrator -> quarantine application-service lease`, `Wardnet -> quarantine artifact-analysis evidence`, no malware verdict or artifact risk score as authoritative EA fact, and no direct database/source-copy integration. It explicitly remains fail-closed until compatible immutable CGC source-bound release evidence and qualifying quarantine release evidence exist. @@ -44,13 +46,13 @@ PR #137 is protected-main truth. Predecessor checks, reviews, approvals, and art | PR | Exact head | State | Current decision | | --- | --- | --- | --- | -| #88 LiteLLM ingress proxy | `98a935e4b058d0500d520425b8ebf6ff4106aa1b` | GitHub Ready flag, architecture Draft-required; mergeable false; RED | The direct LiteLLM virtual-key/provider proxy conflicts with contextual-orchestrator ownership. `tests/llm_owner_boundary.rs` now makes the repair gate executable: it remains RED while Wardnet ships the provider-specific proxy or chooses a SOC model. Preserve the unique fail-closed credential grammar, header minimization, streaming, zero-upstream-hit, property/fuzz and RFC 6750 evidence; do not close or merge it. Rework/transfer those valid Wardnet gateway/admission deltas behind a released CO ACL after CO publishes an immutable compatible client/schema/Agent. The connector Draft-state mutation currently fails before state change, so the UI Ready flag is not authority. | -| #129 Agent Artifact Admission | `1ea226df6ed871c64a0a749c7a4e4f5a6363e599` | Draft | Admission now also blocks npm workspace selectors (`--workspace`, `-w`, enabled `--workspaces`) in addition to previously covered uv/Cargo/pip/npm bypass classes. Current exact-head repository gates remain queued/non-passing; fresh review is required before Ready. Retrieval-byte/provenance verification and hostile execution stay executor/quarantine-owned. | -| #136 Network-Egress | `3e66c260bfcd09c7dc98dc5d1e931583f8379093` | Ready, source defect | Shared structural URL validation, resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, response hop filtering, and architecture fitness are present. One exact-current review finding remains unresolved: manual `lookup_host` occurs before request timeout accounting, so slow DNS can exceed the intended feed/TAXII/KEV operation budget. Repair with deterministic bounded-resolution/deadline RED→GREEN before merge. #155 must also become protected truth before final integration. | +| #88 LiteLLM ingress proxy | `98a935e4b058d0500d520425b8ebf6ff4106aa1b` | GitHub Ready flag, architecture Draft-required; mergeable false; RED | The direct LiteLLM virtual-key/provider proxy conflicts with contextual-orchestrator ownership. `tests/llm_owner_boundary.rs` makes the repair gate executable: it remains RED while Wardnet ships the provider-specific proxy or chooses a SOC model. Preserve the unique fail-closed credential grammar, header minimization, streaming, zero-upstream-hit, property/fuzz and RFC 6750 evidence; do not close or merge it. Rework/transfer those valid Wardnet gateway/admission deltas behind a released CO ACL after CO publishes an immutable compatible client/schema/Agent. The UI Ready flag is not architecture authority. | +| #129 Agent Artifact Admission | `1ea226df6ed871c64a0a749c7a4e4f5a6363e599` | Draft | Admission also blocks npm workspace selectors (`--workspace`, `-w`, enabled `--workspaces`) in addition to previously covered uv/Cargo/pip/npm bypass classes. Current exact-head repository gates remain queued/non-passing; fresh review is required before Ready. Retrieval-byte/provenance verification and hostile execution stay executor/quarantine-owned. | +| #136 Network-Egress | `83e2b4fdfae6eb927dd1b6ce5a263af654c52540` | Ready, source defect | Shared structural URL validation, resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, response hop filtering, and architecture fitness are present. RED `f408500d8aeb4beb386caa48a7525508d59da193` now requires one end-to-end deadline across manual DNS and the remaining request budget, and `83e2b4f…` enables Tokio `time`; production deadline propagation plus a deterministic stalled-resolution runtime regression are still required. #155 must also become protected truth before final integration. | | #140 Runtime Configuration | `43d1b6e9122d8bb5cb882f8fc6e066c63b39ae45` | Ready | Security/SAST are GREEN on the current head; CI/Fuzz remain non-terminal. Runtime Configuration remains a supporting bootstrap boundary; Credential Registry remains secret authority. | | #144 Kubernetes path/public docs | `9616b94ac1ecf70038071a8c9395348694e6312c` | Ready | Hardened manifest source moves to `deploy/kubernetes/wardnet.yaml` without renaming live Kubernetes resources. Review-driven path/link regressions are resolved. Current repository gates remain queued/non-passing. | -| #153 explicit hosted runner | `b663f9d200e5f385c7dd067d074940a02836c68e` | Ready, clean stack root | Same-source repository CI/Fuzz/Security/SAST have terminal GREEN evidence. Current central runner/review/governance evidence is non-terminal. `ubuntu-slim` is only an acquisition canary, not a heavyweight-workload replacement. | -| #154 commercial readiness target | `41098f76c8a823c20ba0e319c38cf24acb470346` | Ready | Aligns the shipped readiness threshold and buyer evidence to the 20B KRW target without rewriting historical plan artifacts. Current inline review-thread inventory is empty and the substantive automated review reports no source finding, but CI/Fuzz/Security/SAST are all queued on this exact head; queued evidence is non-passing. Normal auto-merge is armed but cannot integrate until live policy is satisfied. | +| #153 explicit hosted runner | `b663f9d200e5f385c7dd067d074940a02836c68e` | Ready, clean stack root | Same-source repository CI/Fuzz/Security/SAST have terminal GREEN evidence. Current central runner/review/governance evidence is non-terminal, and a stale same-SHA `opencode-review` failure is now proven to belong to superseded PR #147 rather than #153. A fresh #153-bound central verdict is required; `ubuntu-slim` is only an acquisition canary. | +| #154 commercial readiness target | `41098f76c8a823c20ba0e319c38cf24acb470346` | Ready | Aligns the shipped readiness threshold and buyer evidence to the 20B KRW target without rewriting historical plan artifacts. Current inline review-thread inventory is empty and the substantive automated review reports no source finding, but CI/Fuzz/Security/SAST are all queued on this exact head; queued evidence is non-passing. | | #155 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready, main-based | Non-loopback startup fails closed without write-capable admin credentials; current review threads are resolved. Same-source repository CI/Fuzz/Security/SAST have terminal GREEN evidence, while the latest replacement wave and central coverage/review gates remain non-terminal on the same source SHA. Issue #78 closes only after protected merge. | | #156 operability evidence | `76037b8ae206ace8dab0e6622dfc9fc88c57deb3` | Draft, child of #153 | Preserve support-bundle/readiness evidence; reconstruct/restack on fresh protected main after #153 integrates, then regenerate all base-sensitive evidence. | | #157 trusted proxy | `65a2b7fbf2827f69ae1aa288696b6c5630af28c4` | Draft, child of #153 | Preserve fail-closed forwarded-IP attribution. Reconstruct/restack after #153 protected merge. | @@ -98,17 +100,17 @@ The microservices evidence is used only to resist decomposition-by-file-size: de ## Quality and release gates -Wardnet-owned production code targets 100% statement/branch coverage and complete public rustdoc/docstrings. Security-critical changes require realistic hostile/bypass/replay/race/DoS/network/cleanup tests and current-source verification of review findings. Coverage exclusions, source rewriting, skipped required paths, or statuses bound to another revision are not evidence. +Wardnet-owned production code targets 100% statement/branch coverage and complete public rustdoc/docstrings. Security-critical changes require realistic hostile/bypass/replay/race/DoS/network/cleanup tests and current-source verification of review findings. Coverage exclusions, source rewriting, skipped required paths, or statuses bound to another revision or PR identity are not evidence. No release is authorized. Wardnet, Context Graph Contracts, EA Core, contextual-orchestrator, Quarantine Sandbox Runtime, and EgressWeave expose no usable immutable GitHub Release at this snapshot for the dependencies described above, and production release gate #87 remains open. Release requires one exact integrated protected head with CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence and immutable artifact identity. ## Next execution order -1. Continue #153/#155/#144/#154 through current exact-head gates while `.github#712` repairs runner acquisition and `.github#1644`/related owner work repairs solo-maintainer ruleset semantics. +1. Continue #153/#155/#144/#154 through current exact-head gates while `.github#712` repairs runner/evidence identity and `.github#1644` repairs solo-maintainer ruleset semantics. 2. Preserve #156/#157/#158 until #153 is protected, then non-force reconstruct/restack each child on fresh main and reacquire all evidence. 3. Repair #136's DNS-resolution deadline defect test-first; after #155 becomes protected truth, refresh #136 against live main and revalidate. 4. Finish #129 as one Agent Artifact Admission bounded context without absorbing quarantine or Agent/LLM orchestration. -5. Keep #88 open and architecture-blocked while contextual-orchestrator #971 completes canonical routing/client work and publishes an immutable compatible release; then reconstruct the Wardnet consumer slice against that released contract without direct model/provider authority. +5. Keep #88 open and architecture-blocked while contextual-orchestrator completes canonical routing/client work and publishes an immutable compatible release; then reconstruct the Wardnet consumer slice against that released contract without direct model/provider authority. 6. Drain clean supporting work (#77, #90, #93, #111, #134, #135, #140, #141) only on unchanged exact heads with live evidence. 7. Reconstruct #95's valuable PostgreSQL/outbox/Coraza evidence into bounded #80/#81/#86 lanes. 8. Continue #82/#83/#84/#85 only after their declared prerequisites become protected/released truth. From ef360dbe9dc1dcf490c96ce866e65ebb1ef449f6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 22:40:37 +0900 Subject: [PATCH 32/73] docs(gaps): refresh exact-head admission and dependency state --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index b97d04e2..edd88a47 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -34,7 +34,7 @@ Context Graph Contracts has a dependency-root release-provenance prerequisite: D Enterprise Architecture Core #39 remains Draft at exact `c3879f172d97e2d814ff94d664be0a797e2228be` with current runner-acquisition evidence non-terminal. Child #40 remains Draft at exact `b3ec93a42528ab0defc0116ac4695d669298240f` on obsolete #39 ancestry. #40 already preserves the required Wardnet/quarantine authority boundary: `contextual-orchestrator -> quarantine application-service lease`, `Wardnet -> quarantine artifact-analysis evidence`, no malware verdict or artifact risk score as authoritative EA fact, and no direct database/source-copy integration. It explicitly remains fail-closed until compatible immutable CGC source-bound release evidence and qualifying quarantine release evidence exist. -Quarantine Sandbox Runtime, EgressWeave, and contextual-orchestrator expose no inspected immutable GitHub release usable as a Wardnet production dependency. Open sibling branches are evidence, not release authority. +Fresh release reads for Quarantine Sandbox Runtime, EgressWeave, and contextual-orchestrator are empty. None exposes an immutable GitHub Release usable as a Wardnet production dependency. Open sibling branches are evidence, not release authority. ## Live delivery queue @@ -47,7 +47,7 @@ PR #137 is protected-main truth. Predecessor checks, reviews, approvals, and art | PR | Exact head | State | Current decision | | --- | --- | --- | --- | | #88 LiteLLM ingress proxy | `98a935e4b058d0500d520425b8ebf6ff4106aa1b` | GitHub Ready flag, architecture Draft-required; mergeable false; RED | The direct LiteLLM virtual-key/provider proxy conflicts with contextual-orchestrator ownership. `tests/llm_owner_boundary.rs` makes the repair gate executable: it remains RED while Wardnet ships the provider-specific proxy or chooses a SOC model. Preserve the unique fail-closed credential grammar, header minimization, streaming, zero-upstream-hit, property/fuzz and RFC 6750 evidence; do not close or merge it. Rework/transfer those valid Wardnet gateway/admission deltas behind a released CO ACL after CO publishes an immutable compatible client/schema/Agent. The UI Ready flag is not architecture authority. | -| #129 Agent Artifact Admission | `1ea226df6ed871c64a0a749c7a4e4f5a6363e599` | Draft | Admission also blocks npm workspace selectors (`--workspace`, `-w`, enabled `--workspaces`) in addition to previously covered uv/Cargo/pip/npm bypass classes. Current exact-head repository gates remain queued/non-passing; fresh review is required before Ready. Retrieval-byte/provenance verification and hostile execution stay executor/quarantine-owned. | +| #129 Agent Artifact Admission | `838e19400e42ac4138ff82f754c40f80a0b99d05` | Draft | Admission closes undeclared extra positional package/image operands and blocks pip/uv indirect requirement, editable, script, group, and project sources until a future versioned intent can bind their complete artifact/provenance closure. It retains the prior uv/Cargo/pip/npm workspace/root/index bypass defenses. Current exact-head repository gates are queued/pending and CodeQL ended in startup failure before source evaluation; fresh review is required before Ready. Retrieval-byte/provenance verification and hostile execution stay executor/quarantine-owned. | | #136 Network-Egress | `83e2b4fdfae6eb927dd1b6ce5a263af654c52540` | Ready, source defect | Shared structural URL validation, resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, response hop filtering, and architecture fitness are present. RED `f408500d8aeb4beb386caa48a7525508d59da193` now requires one end-to-end deadline across manual DNS and the remaining request budget, and `83e2b4f…` enables Tokio `time`; production deadline propagation plus a deterministic stalled-resolution runtime regression are still required. #155 must also become protected truth before final integration. | | #140 Runtime Configuration | `43d1b6e9122d8bb5cb882f8fc6e066c63b39ae45` | Ready | Security/SAST are GREEN on the current head; CI/Fuzz remain non-terminal. Runtime Configuration remains a supporting bootstrap boundary; Credential Registry remains secret authority. | | #144 Kubernetes path/public docs | `9616b94ac1ecf70038071a8c9395348694e6312c` | Ready | Hardened manifest source moves to `deploy/kubernetes/wardnet.yaml` without renaming live Kubernetes resources. Review-driven path/link regressions are resolved. Current repository gates remain queued/non-passing. | From 890da33542e79d868aa2db1a2fe6598dd1f25698 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 01:15:56 +0900 Subject: [PATCH 33/73] docs(gaps): refresh live Wardnet readiness baseline --- docs/product-technical-gap-baseline.md | 53 ++++++++++++++------------ 1 file changed, 28 insertions(+), 25 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index edd88a47..28d9b6a7 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # Product and technical gap baseline -Snapshot date: 2026-09-02. This document is a dated repository snapshot. Live refs, reviews, checks, rulesets, releases, and foreign-owner state must be re-read before any merge, release, or integration decision. +Snapshot date: 2026-09-03. This document is a dated repository snapshot. Live refs, reviews, checks, rulesets, releases, and foreign-owner state must be re-read before any merge, release, or integration decision. ## Product and authority boundary @@ -8,7 +8,7 @@ Wardnet is the Rust-first gateway/SOC control plane and owns Gateway, Admission `ContextualWisdomLab/quarantine-sandbox-runtime` owns reusable hostile-workload isolation, execution lifecycle, cleanup, and artifact-analysis evidence. `contextual-orchestrator` owns Agent/LLM orchestration, provider/model discovery and routing, concrete model selection, provider credentials, and free/paid policy. EgressWeave is the canonical outbound HTTP-policy candidate. Wardnet consumes released/versioned ports and Anti-Corruption Layers; it does not copy those implementations or access foreign application databases. -The protected Wardnet tree still carries an integration debt at the optional SOC LLM seam: `soc_llm_chat_body(model, event)` accepts a caller model selector, and `tests/adaptive_orchestrator_default.rs` intentionally preserves that field. That is not the desired owner contract. Wardnet must eventually call a released/versioned contextual-orchestrator API/client/schema Agent without selecting a provider or concrete model. Fresh contextual-orchestrator release inventory is empty, so no mutable branch is promoted as the production replacement. Canonical CO owner PR #971 already states that consumers must wait for integrated exact-head GREEN plus an immutable released API/client/schema before bumping. +The protected Wardnet tree still carries an integration debt at the optional SOC LLM seam: `soc_llm_chat_body(model, event)` accepts a caller model selector, and `tests/adaptive_orchestrator_default.rs` intentionally preserves that field. That is not the desired owner contract. Wardnet must eventually call a released/versioned contextual-orchestrator API/client/schema Agent without selecting a provider or concrete model. Fresh contextual-orchestrator release inventory is empty, so no mutable branch is promoted as the production replacement. `context-graph-contracts` is the provider-neutral Context Fabric Shared Kernel for canonical object/authority references, truth status/origin, valid/system time, provenance, Context Assertion, CloudEvents, schema, conformance, and admission. `enterprise-architecture-core` is the EA Decision Plane. Both remain read-only source dependencies from this writer while the dedicated Context Fabric writer is active. Security findings, alerts, malware verdicts, artifact risk scores, prompts, and customer/runtime data do not become authoritative EA facts. @@ -16,47 +16,50 @@ The protected Wardnet tree still carries an integration debt at the optional SOC Protected/default Wardnet `main` is `cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. It contains PR #137's externally provisioned, non-optional Kubernetes administrator Secret boundary. Wardnet currently has no GitHub Release. -A fresh live read of organization ruleset `18156473` after its 2026-09-02 19:15 KST update still shows `~DEFAULT_BRANCH`, `required_approving_review_count=1`, `required_reviewers=[]`, no code-owner review, and no last-push approval requirement. Review-thread resolution, central required workflows, deletion protection, and non-fast-forward protection remain enabled. The live ruleset also exposes `OrganizationAdmin/always` bypass capability; that existence is not normal merge authorization. Self-approval and bot/model-as-human approval are forbidden. +A fresh live read of organization ruleset `18156473` still shows `~DEFAULT_BRANCH`, `required_approving_review_count=1`, `required_reviewers=[]`, no code-owner review, and no last-push approval requirement. Review-thread resolution, central required workflows, deletion protection, and non-fast-forward protection remain enabled. The live ruleset also exposes `OrganizationAdmin/always` bypass capability; that existence is not normal merge authorization. Self-approval and bot/model-as-human approval are forbidden. -The bare approval count is structurally inconsistent with the declared solo-maintainer model. This is a central governance defect rather than a Wardnet staffing requirement. `.github#1644@fac1e32a8acfb363da49df75f3386b5edb4eb0ef`, referencing #772 and related governance work, is the current owner-plane reconciliation candidate. Its source policy removes the impossible approval count while preserving deterministic workflow/security/coverage/SBOM/provenance/thread/branch-integrity controls. Source integration alone does not mutate live rulesets; the owner-plane apply remains separately privileged and must be proven from live settings before Wardnet treats the rule as repaired. +The bare approval count is structurally inconsistent with the declared solo-maintainer model. This is a central governance defect rather than a Wardnet staffing requirement. `.github#1644@528139ff3c2a3680d67b8489c38fdb65cd31d98c`, referencing #772 and related governance work, is the current owner-plane reconciliation candidate. Its source policy removes the impossible approval count while preserving deterministic workflow/security/coverage/SBOM/provenance/thread/branch-integrity controls. Source integration alone does not mutate live rulesets; the owner-plane apply remains separately privileged and must be proven from live settings before Wardnet treats the rule as repaired. Wardnet #155 is now an explicit post-apply canary for that owner-plane repair. -Runner acquisition is also a central control-plane concern. PR #153 pins repository-owned CI/Fuzz/Scorecard runner declarations to explicit `ubuntu-24.04` and permanently rejects floating `ubuntu-latest`. Exact head `b663f9d200e5f385c7dd067d074940a02836c68e` has completed repository CI/Fuzz/Security/SAST successfully on that same source, proving the full hosted image is executable when admitted. Later exact-head waves across Wardnet, Context Graph Contracts, and EA Core again remained pre-checkout with `runner_id=0`. `.github#712` owns the acquisition/capacity/policy-routing defect. `.github#1150@7981728db0862eb814588964182bf8aa107117b3` is the current read-only queue-health evidence successor; it preserves exact-current-head startup-failure evidence, but its own required security/supply-chain gates remain non-terminal and it is not a runner-capacity repair by itself. +Runner acquisition is also a central control-plane concern. PR #153 pins repository-owned CI/Fuzz/Scorecard runner declarations to explicit `ubuntu-24.04` and permanently rejects floating `ubuntu-latest`. Exact head `b663f9d200e5f385c7dd067d074940a02836c68e` has completed repository CI/Fuzz/Security/SAST successfully on that same source, proving the full hosted image is executable when admitted. Later exact-head waves across Wardnet, Context Graph Contracts, and EA Core again remained pre-checkout with `runner_id=0`. `.github#712` owns acquisition/capacity/policy-routing and evidence-identity repair. -A fresh Wardnet reproduction adds a separate evidence-identity defect to `.github#712`: required-workflow run `33550235908` / job `100100529632` is commit-scoped to `b663f9d…` but its durable runtime payload was `PR_NUMBER=147`; it failed because #147 had already moved away from that SHA. The same clean SHA is now the legitimate head of replacement PR #153, so the old failure is visible on the successor commit even though it evaluated the wrong PR identity. Central queue/review evidence must therefore bind at least `(repository, pr_number, head_sha, workflow/check lane)`, classify wrong-PR same-SHA runs as foreign/obsolete evidence, and never manufacture a new leaf SHA merely to escape commit-scoped contamination. +PR #155 provides the clearest current-PR evidence. Exact head `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` has terminal repository-owned CI/Fuzz/Security/SAST and resolved inline review threads. Its correct current-PR required OpenCode run is `33590351182`: bootstrap job `100122902000` completed, while `coverage-source-tree` job `100272722468` remains queued before checkout with `runner_id=0`, no runner/group, and `steps=[]`. The same source SHA was previously used by PR #138, whose older required run is a different PR identity. Central required evidence must bind at least `(repository, pr_number, head_sha, workflow/check lane)`; wrong-PR same-SHA evidence must never be promoted to the current PR. -GitHub's current hosted-runner contract does not make `ubuntu-slim` an equivalent workaround: it is an unprivileged 1-vCPU/5-GB container runner with a 15-minute job ceiling intended for lightweight automation rather than typical heavyweight CI/CD. A successful slim job is therefore an admission canary, not justification to downgrade Wardnet CI/Fuzz/CodeQL/coverage workloads. +A separate #153 reproduction already proved the same identity class: required-workflow run `33550235908` / job `100100529632` was commit-scoped to `b663f9d…` but its durable payload was `PR_NUMBER=147`. The same clean SHA is now #153's head, so commit-only evidence lookup can surface the wrong PR's result. Do not manufacture new leaf SHAs to escape that contamination. + +GitHub's hosted-runner contract does not make `ubuntu-slim` an equivalent workaround: it is a constrained container runner intended for lightweight automation. A successful slim job is an admission canary, not justification to downgrade Wardnet CI/Fuzz/CodeQL/coverage workloads. ## Context Fabric live boundary Fresh metadata still reports `develop` as the default branch for both `ContextualWisdomLab/context-graph-contracts` and `ContextualWisdomLab/enterprise-architecture-core`. Their protected `develop` tips remain `context-graph-contracts@99cb5468ba3c15c5e79688f53dee74724fae2d13` and `enterprise-architecture-core@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`. Both expose zero GitHub Releases. The accepted protected-`main` transition remains central `.github`/Context Fabric owner work rather than a Wardnet source mutation. -Context Graph Contracts has a dependency-root release-provenance prerequisite: Draft #25 is exact `f184cc4d44637fc429ba5d1072838f5d1dd1dc61` on #19 and binds package/SBOM identities to protected source plus independently verifiable manifest-attestation evidence. Its exact-current repository workflows remain pre-checkout/queued. Draft #20 remains exact `475ce14185db697940e8219c3cda7f24d66f3ed7`; child #21 remains exact `239a73d5f1a18b10ad317fdd51567b7fa040f570` on obsolete #20 ancestry and contains the structured Context Assertion/CloudEvent envelope and authority/conformance repair. The intended rebuilt order is `#19 -> #25 -> #20 -> #21`. No immutable CGC release exists, so Wardnet must not bind production behavior to any open PR head. +Context Graph Contracts root #4 has advanced to exact `7bbb583487016c613c78ef86479986dc2b2d83cd`; all predecessor checks/reviews are historical after that movement. The dependency-root release-provenance prerequisite remains Draft #25 at exact `f184cc4d44637fc429ba5d1072838f5d1dd1dc61` on #19 and binds package/SBOM identities to protected source plus independently verifiable manifest-attestation evidence. #25 exact-current workflows remain pre-checkout/queued. Draft #20 remains exact `475ce14185db697940e8219c3cda7f24d66f3ed7`; child #21 remains exact `239a73d5f1a18b10ad317fdd51567b7fa040f570` on obsolete #20 ancestry and contains the structured Context Assertion/CloudEvent envelope and authority/conformance repair. The intended rebuilt order remains `#19 -> #25 -> #20 -> #21`. No immutable CGC release exists, so Wardnet must not bind production behavior to any open PR head. -Enterprise Architecture Core #39 remains Draft at exact `c3879f172d97e2d814ff94d664be0a797e2228be` with current runner-acquisition evidence non-terminal. Child #40 remains Draft at exact `b3ec93a42528ab0defc0116ac4695d669298240f` on obsolete #39 ancestry. #40 already preserves the required Wardnet/quarantine authority boundary: `contextual-orchestrator -> quarantine application-service lease`, `Wardnet -> quarantine artifact-analysis evidence`, no malware verdict or artifact risk score as authoritative EA fact, and no direct database/source-copy integration. It explicitly remains fail-closed until compatible immutable CGC source-bound release evidence and qualifying quarantine release evidence exist. +Enterprise Architecture Core #39 remains Draft at exact `c3879f172d97e2d814ff94d664be0a797e2228be` with current runner-acquisition evidence non-terminal. Child #40 remains Draft/non-mergeable at exact `b3ec93a42528ab0defc0116ac4695d669298240f` on obsolete #39 ancestry. #40 preserves the required Wardnet/quarantine authority boundary: `contextual-orchestrator -> quarantine application-service lease`, `Wardnet -> quarantine artifact-analysis evidence`, no malware verdict or artifact risk score as authoritative EA fact, and no direct database/source-copy integration. It remains fail-closed until compatible immutable CGC source-bound release evidence and qualifying quarantine release evidence exist. -Fresh release reads for Quarantine Sandbox Runtime, EgressWeave, and contextual-orchestrator are empty. None exposes an immutable GitHub Release usable as a Wardnet production dependency. Open sibling branches are evidence, not release authority. +Fresh release reads for Quarantine Sandbox Runtime, EgressWeave, contextual-orchestrator, Context Graph Contracts, and Enterprise Architecture Core are empty. None exposes an immutable GitHub Release usable as a Wardnet production dependency. Open sibling branches are evidence, not release authority. ## Live delivery queue -Fresh inventory contains 24 open PRs: +Fresh inventory contains 25 open PRs: -`#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #153, #154, #155, #156, #157, #158`. +`#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #153, #154, #155, #156, #157, #158, #159`. PR #137 is protected-main truth. Predecessor checks, reviews, approvals, and artifacts do not transfer after head/base movement. | PR | Exact head | State | Current decision | | --- | --- | --- | --- | -| #88 LiteLLM ingress proxy | `98a935e4b058d0500d520425b8ebf6ff4106aa1b` | GitHub Ready flag, architecture Draft-required; mergeable false; RED | The direct LiteLLM virtual-key/provider proxy conflicts with contextual-orchestrator ownership. `tests/llm_owner_boundary.rs` makes the repair gate executable: it remains RED while Wardnet ships the provider-specific proxy or chooses a SOC model. Preserve the unique fail-closed credential grammar, header minimization, streaming, zero-upstream-hit, property/fuzz and RFC 6750 evidence; do not close or merge it. Rework/transfer those valid Wardnet gateway/admission deltas behind a released CO ACL after CO publishes an immutable compatible client/schema/Agent. The UI Ready flag is not architecture authority. | -| #129 Agent Artifact Admission | `838e19400e42ac4138ff82f754c40f80a0b99d05` | Draft | Admission closes undeclared extra positional package/image operands and blocks pip/uv indirect requirement, editable, script, group, and project sources until a future versioned intent can bind their complete artifact/provenance closure. It retains the prior uv/Cargo/pip/npm workspace/root/index bypass defenses. Current exact-head repository gates are queued/pending and CodeQL ended in startup failure before source evaluation; fresh review is required before Ready. Retrieval-byte/provenance verification and hostile execution stay executor/quarantine-owned. | -| #136 Network-Egress | `83e2b4fdfae6eb927dd1b6ce5a263af654c52540` | Ready, source defect | Shared structural URL validation, resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, response hop filtering, and architecture fitness are present. RED `f408500d8aeb4beb386caa48a7525508d59da193` now requires one end-to-end deadline across manual DNS and the remaining request budget, and `83e2b4f…` enables Tokio `time`; production deadline propagation plus a deterministic stalled-resolution runtime regression are still required. #155 must also become protected truth before final integration. | +| #88 CO ownership repair | `98a935e4b058d0500d520425b8ebf6ff4106aa1b` | GitHub Ready flag, architecture Draft-required; mergeable false; RED | The direct LiteLLM virtual-key/provider/model proxy conflicts with contextual-orchestrator ownership. Preserve unique fail-closed credential grammar, header minimization, streaming, zero-upstream-hit, property/fuzz and RFC 6750 evidence; do not close or merge it. The PR has been retitled `draft(architecture): preserve credential-guard evidence pending CO release`. The connector's Draft mutation currently fails before state change because its GraphQL wrapper requests nonexistent Repository field `fullDatabaseId`; the UI Ready flag is not architecture authority. Rework valid Wardnet-owned gateway/admission deltas behind a released CO ACL after CO publishes an immutable compatible client/schema/Agent. | +| #129 Agent Artifact Admission | `350156bc16f1f5a14492ee961f19f38c4a2d468d` | Draft, mergeable | Current source binds package-manager executable families to canonical artifact ecosystems, retains indirect-source/root/index/workspace defenses, and adds the Yarn Classic `-W` / `--ignore-workspace-root-check` fail-closed repair. RED `080997cc…`, production fix `0a4f20da…`, traceability `a2d70431…`, and exact-head CHANGELOG are preserved. Hosted exact-head execution remains non-terminal; keep Draft. Retrieval-byte/provenance verification and hostile execution stay executor/quarantine-owned. | +| #136 Network-Egress | `83e2b4fdfae6eb927dd1b6ce5a263af654c52540` | Ready, source defect | Shared structural URL validation, resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, response hop filtering, and architecture fitness are present. RED `f408500d8aeb4beb386caa48a7525508d59da193` requires one end-to-end deadline across manual DNS and remaining HTTP work; production deadline propagation plus a deterministic stalled-resolution runtime regression remain required. #155 must become protected truth before final integration. | | #140 Runtime Configuration | `43d1b6e9122d8bb5cb882f8fc6e066c63b39ae45` | Ready | Security/SAST are GREEN on the current head; CI/Fuzz remain non-terminal. Runtime Configuration remains a supporting bootstrap boundary; Credential Registry remains secret authority. | | #144 Kubernetes path/public docs | `9616b94ac1ecf70038071a8c9395348694e6312c` | Ready | Hardened manifest source moves to `deploy/kubernetes/wardnet.yaml` without renaming live Kubernetes resources. Review-driven path/link regressions are resolved. Current repository gates remain queued/non-passing. | -| #153 explicit hosted runner | `b663f9d200e5f385c7dd067d074940a02836c68e` | Ready, clean stack root | Same-source repository CI/Fuzz/Security/SAST have terminal GREEN evidence. Current central runner/review/governance evidence is non-terminal, and a stale same-SHA `opencode-review` failure is now proven to belong to superseded PR #147 rather than #153. A fresh #153-bound central verdict is required; `ubuntu-slim` is only an acquisition canary. | -| #154 commercial readiness target | `41098f76c8a823c20ba0e319c38cf24acb470346` | Ready | Aligns the shipped readiness threshold and buyer evidence to the 20B KRW target without rewriting historical plan artifacts. Current inline review-thread inventory is empty and the substantive automated review reports no source finding, but CI/Fuzz/Security/SAST are all queued on this exact head; queued evidence is non-passing. | -| #155 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready, main-based | Non-loopback startup fails closed without write-capable admin credentials; current review threads are resolved. Same-source repository CI/Fuzz/Security/SAST have terminal GREEN evidence, while the latest replacement wave and central coverage/review gates remain non-terminal on the same source SHA. Issue #78 closes only after protected merge. | +| #153 explicit hosted runner | `b663f9d200e5f385c7dd067d074940a02836c68e` | Ready, clean stack root | Same-source repository CI/Fuzz/Security/SAST have terminal GREEN evidence. Current central runner/review/governance evidence is non-terminal, and stale same-SHA required evidence is proven capable of referring to superseded PR #147 rather than #153. A fresh #153-bound verdict is required; `ubuntu-slim` is only an acquisition canary. | +| #154 commercial readiness target | `41098f76c8a823c20ba0e319c38cf24acb470346` | Ready | Aligns the shipped readiness threshold and buyer evidence to the 20B KRW target without rewriting historical plan artifacts. Current repository gates remain non-terminal; queued evidence is non-passing. | +| #155 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready, main-based | Non-loopback startup fails closed without write-capable admin credentials; current review threads are resolved. Repository-owned CI/Fuzz/Security/SAST are terminal GREEN. Current-PR required OpenCode bootstrap succeeded, but coverage source materialization remains pre-checkout queued at job `100272722468`; predecessor #138 evidence does not transfer merely because the source SHA is identical. Issue #78 closes only after protected merge. | | #156 operability evidence | `76037b8ae206ace8dab0e6622dfc9fc88c57deb3` | Draft, child of #153 | Preserve support-bundle/readiness evidence; reconstruct/restack on fresh protected main after #153 integrates, then regenerate all base-sensitive evidence. | | #157 trusted proxy | `65a2b7fbf2827f69ae1aa288696b6c5630af28c4` | Draft, child of #153 | Preserve fail-closed forwarded-IP attribution. Reconstruct/restack after #153 protected merge. | | #158 readiness metrics | `387a447f856093d02116dfadcf2c4a4a63c6d3ba` | Draft, child of #153 | Preserve readiness gauges using existing readiness/KPI authority. Reconstruct/restack after #153 protected merge. | +| #159 CI concurrency | `89176e2cc57088e4d772de9b1686ab89a3e69aeb` | Ready | PR runs use PR-number concurrency so new heads supersede obsolete PR executions; push runs use unique run IDs so pending protected-main commits cannot replace each other. Two review findings are resolved. Current CI/Security/SAST/Scorecard/OSV remain queued and CodeQL ended startup failure before useful source execution; `.github#712` owns the organization control-plane class. | Auto-merge state, where enabled, is state only, not protected truth or transferable evidence. A changed head/base must reacquire the then-live policy evidence. @@ -66,12 +69,12 @@ Fresh issue inventory remains `#11, #38, #74, #75, #78, #79, #80, #81, #82, #83, 1. Immediate exposure controls: #78 through #155, #79 through #136 plus remaining allowlist/evidence/deadline work, #11 real attack-path CI, and #75 through #144. 2. Security admission: #128 through #129, without absorbing quarantine execution authority. -3. LLM ownership repair: keep #88 open but non-integrable and RED until contextual-orchestrator ships the released provider-neutral contract; then preserve only Wardnet-owned credential/admission/streaming defenses and remove direct LiteLLM/provider/model authority. +3. LLM ownership repair: keep #88 open but non-integrable and architecture-RED until contextual-orchestrator ships the released provider-neutral contract; then preserve only Wardnet-owned credential/admission/streaming defenses and remove direct LiteLLM/provider/model authority. 4. Durable authority/effects: #80 PostgreSQL production authority and tenant isolation, then #81 transactional outbox/leased workers. 5. Identity/overload: #82 Keyverse-backed authorization/approval and #83 distributed/global admission. #157 is only the trusted-network attribution slice. 6. Proven security engines: #86 Coraza/CRS and Suricata with detection and false-positive evidence. 7. Immutable delivery/operation: #84 signed artifact/SBOM/provenance/rollback, then #85 telemetry/SLO/incident/restore evidence. -8. Supporting correctness: #74 deterministic persistence fault testing, #77 pinned compiler, #139 coherent runtime configuration, #153 deterministic hosted-runner selection, and #154 the 20B KRW commercial-readiness contract. +8. Supporting correctness: #74 deterministic persistence fault testing, #77 pinned compiler, #139 coherent runtime configuration, #153 deterministic hosted-runner selection, #159 repository-local concurrency, and #154 the 20B KRW commercial-readiness contract. Close an issue only after its owning protected merge satisfies the issue acceptance contract on current evidence. @@ -83,9 +86,9 @@ The legacy gateway remains concentrated in root `src/lib.rs`. File size alone is Network-Egress remains incomplete after #136. Besides the resolver-deadline defect, #79 still requires versioned hostname/suffix/IP/CIDR/scheme/port allowlists, deterministic deny-overrides precedence, connector parity, minimized policy-decision evidence, and operator migration/rollback/diagnostics. -The protected SOC LLM request builder and #88 together show the same ownership drift from two directions: caller-supplied model authority in current main and a direct LiteLLM proxy in an old feature branch. The repair is not another Wardnet provider adapter. It is a released contextual-orchestrator ACL followed by a Wardnet consumer bump and removal of local provider/model authority, with fail-closed behavior until that immutable dependency exists. The #88 architecture RED prevents this drift from becoming an accidental merge while the owner release is unavailable. +The protected SOC LLM request builder and #88 show the same ownership drift from two directions: caller-supplied model authority in current main and a direct LiteLLM proxy in an old feature branch. The repair is not another Wardnet provider adapter. It is a released contextual-orchestrator ACL followed by a Wardnet consumer bump and removal of local provider/model authority, with fail-closed behavior until that immutable dependency exists. -PR #95 remains too broad to serve as the production integration vehicle. Preserve its unique PostgreSQL/outbox/Coraza tests and evidence while reconstructing bounded #80/#81/#86 successor work instead of merging the cross-context god-PR. +PR #95 remains too broad to serve as the production integration vehicle. Preserve its unique PostgreSQL/outbox/Coraza tests and evidence while reconstructing bounded #80/#81/#86 successor work instead of merging a cross-context god-PR. ## Research and standards grounding @@ -100,13 +103,13 @@ The microservices evidence is used only to resist decomposition-by-file-size: de ## Quality and release gates -Wardnet-owned production code targets 100% statement/branch coverage and complete public rustdoc/docstrings. Security-critical changes require realistic hostile/bypass/replay/race/DoS/network/cleanup tests and current-source verification of review findings. Coverage exclusions, source rewriting, skipped required paths, or statuses bound to another revision or PR identity are not evidence. +Wardnet-owned production code targets 100% statement/branch/edge-case coverage and complete public rustdoc/docstrings. Security-critical changes require realistic hostile/bypass/replay/race/DoS/network/cleanup tests and current-source verification of review findings. Coverage exclusions, source rewriting, skipped required paths, or statuses bound to another revision or PR identity are not evidence. No release is authorized. Wardnet, Context Graph Contracts, EA Core, contextual-orchestrator, Quarantine Sandbox Runtime, and EgressWeave expose no usable immutable GitHub Release at this snapshot for the dependencies described above, and production release gate #87 remains open. Release requires one exact integrated protected head with CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence and immutable artifact identity. ## Next execution order -1. Continue #153/#155/#144/#154 through current exact-head gates while `.github#712` repairs runner/evidence identity and `.github#1644` repairs solo-maintainer ruleset semantics. +1. Continue #153/#155/#144/#154/#159 through current exact-head gates while `.github#712` repairs runner/evidence identity and `.github#1644` repairs solo-maintainer ruleset semantics. 2. Preserve #156/#157/#158 until #153 is protected, then non-force reconstruct/restack each child on fresh main and reacquire all evidence. 3. Repair #136's DNS-resolution deadline defect test-first; after #155 becomes protected truth, refresh #136 against live main and revalidate. 4. Finish #129 as one Agent Artifact Admission bounded context without absorbing quarantine or Agent/LLM orchestration. @@ -114,4 +117,4 @@ No release is authorized. Wardnet, Context Graph Contracts, EA Core, contextual- 6. Drain clean supporting work (#77, #90, #93, #111, #134, #135, #140, #141) only on unchanged exact heads with live evidence. 7. Reconstruct #95's valuable PostgreSQL/outbox/Coraza evidence into bounded #80/#81/#86 lanes. 8. Continue #82/#83/#84/#85 only after their declared prerequisites become protected/released truth. -9. Refresh this baseline whenever protected truth, queue topology, release state, or responsibility boundaries materially change. +9. Refresh this baseline whenever protected truth, queue topology, release state, or responsibility boundaries materially change. \ No newline at end of file From 0247a8c0f316419060b45cb458405ae7f76f9da3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 03:17:13 +0900 Subject: [PATCH 34/73] docs(gaps): refresh current Wardnet and Context Fabric heads --- docs/product-technical-gap-baseline.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 28d9b6a7..cd226819 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -32,9 +32,9 @@ GitHub's hosted-runner contract does not make `ubuntu-slim` an equivalent workar Fresh metadata still reports `develop` as the default branch for both `ContextualWisdomLab/context-graph-contracts` and `ContextualWisdomLab/enterprise-architecture-core`. Their protected `develop` tips remain `context-graph-contracts@99cb5468ba3c15c5e79688f53dee74724fae2d13` and `enterprise-architecture-core@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`. Both expose zero GitHub Releases. The accepted protected-`main` transition remains central `.github`/Context Fabric owner work rather than a Wardnet source mutation. -Context Graph Contracts root #4 has advanced to exact `7bbb583487016c613c78ef86479986dc2b2d83cd`; all predecessor checks/reviews are historical after that movement. The dependency-root release-provenance prerequisite remains Draft #25 at exact `f184cc4d44637fc429ba5d1072838f5d1dd1dc61` on #19 and binds package/SBOM identities to protected source plus independently verifiable manifest-attestation evidence. #25 exact-current workflows remain pre-checkout/queued. Draft #20 remains exact `475ce14185db697940e8219c3cda7f24d66f3ed7`; child #21 remains exact `239a73d5f1a18b10ad317fdd51567b7fa040f570` on obsolete #20 ancestry and contains the structured Context Assertion/CloudEvent envelope and authority/conformance repair. The intended rebuilt order remains `#19 -> #25 -> #20 -> #21`. No immutable CGC release exists, so Wardnet must not bind production behavior to any open PR head. +Context Graph Contracts root #4 is exact `03caa05e432a46227e16ecddd61ed825d1a104dd` on live `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`, a linear eight-commit advance over the previously recorded `7bbb583487016c613c78ef86479986dc2b2d83cd`. Its exact-current CI/security/supply-chain lanes remain queued or startup-failed; predecessor evidence is historical. The dependency-root release-provenance prerequisite remains Draft #25 at exact `f184cc4d44637fc429ba5d1072838f5d1dd1dc61` on #19 and binds package/SBOM identities to protected source plus independently verifiable manifest-attestation evidence. Draft #20 remains exact `475ce14185db697940e8219c3cda7f24d66f3ed7`; child #21 remains exact `239a73d5f1a18b10ad317fdd51567b7fa040f570` on obsolete #20 ancestry and contains the structured Context Assertion/CloudEvent envelope and authority/conformance repair. The intended rebuilt order remains `#19 -> #25 -> #20 -> #21`. No immutable CGC release exists, so Wardnet must not bind production behavior to any open PR head. -Enterprise Architecture Core #39 remains Draft at exact `c3879f172d97e2d814ff94d664be0a797e2228be` with current runner-acquisition evidence non-terminal. Child #40 remains Draft/non-mergeable at exact `b3ec93a42528ab0defc0116ac4695d669298240f` on obsolete #39 ancestry. #40 preserves the required Wardnet/quarantine authority boundary: `contextual-orchestrator -> quarantine application-service lease`, `Wardnet -> quarantine artifact-analysis evidence`, no malware verdict or artifact risk score as authoritative EA fact, and no direct database/source-copy integration. It remains fail-closed until compatible immutable CGC source-bound release evidence and qualifying quarantine release evidence exist. +Enterprise Architecture Core #39 remains Draft at exact `c063570bd9177578fa75be69defd81c99e6ba2f3`, non-force restacked on its live parent and with exact-current repository lanes queued/pre-checkout after predecessor GREEN became historical. Child #40 remains Draft/non-mergeable at exact `b3ec93a42528ab0defc0116ac4695d669298240f` on obsolete #39 ancestry. #40 preserves the required Wardnet/quarantine authority boundary: `contextual-orchestrator -> quarantine application-service lease`, `Wardnet -> quarantine artifact-analysis evidence`, no malware verdict or artifact risk score as authoritative EA fact, and no direct database/source-copy integration. It remains fail-closed until compatible immutable CGC source-bound release evidence and qualifying quarantine release evidence exist. Fresh release reads for Quarantine Sandbox Runtime, EgressWeave, contextual-orchestrator, Context Graph Contracts, and Enterprise Architecture Core are empty. None exposes an immutable GitHub Release usable as a Wardnet production dependency. Open sibling branches are evidence, not release authority. @@ -49,7 +49,7 @@ PR #137 is protected-main truth. Predecessor checks, reviews, approvals, and art | PR | Exact head | State | Current decision | | --- | --- | --- | --- | | #88 CO ownership repair | `98a935e4b058d0500d520425b8ebf6ff4106aa1b` | GitHub Ready flag, architecture Draft-required; mergeable false; RED | The direct LiteLLM virtual-key/provider/model proxy conflicts with contextual-orchestrator ownership. Preserve unique fail-closed credential grammar, header minimization, streaming, zero-upstream-hit, property/fuzz and RFC 6750 evidence; do not close or merge it. The PR has been retitled `draft(architecture): preserve credential-guard evidence pending CO release`. The connector's Draft mutation currently fails before state change because its GraphQL wrapper requests nonexistent Repository field `fullDatabaseId`; the UI Ready flag is not architecture authority. Rework valid Wardnet-owned gateway/admission deltas behind a released CO ACL after CO publishes an immutable compatible client/schema/Agent. | -| #129 Agent Artifact Admission | `350156bc16f1f5a14492ee961f19f38c4a2d468d` | Draft, mergeable | Current source binds package-manager executable families to canonical artifact ecosystems, retains indirect-source/root/index/workspace defenses, and adds the Yarn Classic `-W` / `--ignore-workspace-root-check` fail-closed repair. RED `080997cc…`, production fix `0a4f20da…`, traceability `a2d70431…`, and exact-head CHANGELOG are preserved. Hosted exact-head execution remains non-terminal; keep Draft. Retrieval-byte/provenance verification and hostile execution stay executor/quarantine-owned. | +| #129 Agent Artifact Admission | `43837309a042a4016b5497bcda25d8e80193f0ef` | Draft, mergeable | Current source binds package-manager executable families to canonical artifact ecosystems and retains indirect-source/root/index/workspace defenses through the Bun `--cwd`/`--filter`/`-F`/`--config` fail-closed repair. The current head is a one-commit linear advance from `86abdb91…` whose only delta makes Bun test argv construction explicit; it is seven commits ahead of the previously recorded `350156bc…`. Exact-head CI/Fuzz/Security/SAST/OSV/Scorecard remain queued or pending and CodeQL is `startup_failure`; keep Draft. Retrieval-byte/provenance verification and hostile execution stay executor/quarantine-owned. | | #136 Network-Egress | `83e2b4fdfae6eb927dd1b6ce5a263af654c52540` | Ready, source defect | Shared structural URL validation, resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, response hop filtering, and architecture fitness are present. RED `f408500d8aeb4beb386caa48a7525508d59da193` requires one end-to-end deadline across manual DNS and remaining HTTP work; production deadline propagation plus a deterministic stalled-resolution runtime regression remain required. #155 must become protected truth before final integration. | | #140 Runtime Configuration | `43d1b6e9122d8bb5cb882f8fc6e066c63b39ae45` | Ready | Security/SAST are GREEN on the current head; CI/Fuzz remain non-terminal. Runtime Configuration remains a supporting bootstrap boundary; Credential Registry remains secret authority. | | #144 Kubernetes path/public docs | `9616b94ac1ecf70038071a8c9395348694e6312c` | Ready | Hardened manifest source moves to `deploy/kubernetes/wardnet.yaml` without renaming live Kubernetes resources. Review-driven path/link regressions are resolved. Current repository gates remain queued/non-passing. | @@ -117,4 +117,4 @@ No release is authorized. Wardnet, Context Graph Contracts, EA Core, contextual- 6. Drain clean supporting work (#77, #90, #93, #111, #134, #135, #140, #141) only on unchanged exact heads with live evidence. 7. Reconstruct #95's valuable PostgreSQL/outbox/Coraza evidence into bounded #80/#81/#86 lanes. 8. Continue #82/#83/#84/#85 only after their declared prerequisites become protected/released truth. -9. Refresh this baseline whenever protected truth, queue topology, release state, or responsibility boundaries materially change. \ No newline at end of file +9. Refresh this baseline whenever protected truth, queue topology, release state, or responsibility boundaries materially change. From 4f29451140dd85df8f6b246aa050df638bd8d11f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 07:02:33 +0900 Subject: [PATCH 35/73] docs(gaps): refresh exact security and Context Fabric state --- docs/product-technical-gap-baseline.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index cd226819..7f728521 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -32,9 +32,9 @@ GitHub's hosted-runner contract does not make `ubuntu-slim` an equivalent workar Fresh metadata still reports `develop` as the default branch for both `ContextualWisdomLab/context-graph-contracts` and `ContextualWisdomLab/enterprise-architecture-core`. Their protected `develop` tips remain `context-graph-contracts@99cb5468ba3c15c5e79688f53dee74724fae2d13` and `enterprise-architecture-core@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`. Both expose zero GitHub Releases. The accepted protected-`main` transition remains central `.github`/Context Fabric owner work rather than a Wardnet source mutation. -Context Graph Contracts root #4 is exact `03caa05e432a46227e16ecddd61ed825d1a104dd` on live `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`, a linear eight-commit advance over the previously recorded `7bbb583487016c613c78ef86479986dc2b2d83cd`. Its exact-current CI/security/supply-chain lanes remain queued or startup-failed; predecessor evidence is historical. The dependency-root release-provenance prerequisite remains Draft #25 at exact `f184cc4d44637fc429ba5d1072838f5d1dd1dc61` on #19 and binds package/SBOM identities to protected source plus independently verifiable manifest-attestation evidence. Draft #20 remains exact `475ce14185db697940e8219c3cda7f24d66f3ed7`; child #21 remains exact `239a73d5f1a18b10ad317fdd51567b7fa040f570` on obsolete #20 ancestry and contains the structured Context Assertion/CloudEvent envelope and authority/conformance repair. The intended rebuilt order remains `#19 -> #25 -> #20 -> #21`. No immutable CGC release exists, so Wardnet must not bind production behavior to any open PR head. +Context Graph Contracts root #4 is exact `03caa05e432a46227e16ecddd61ed825d1a104dd` on live `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`, a linear eight-commit advance over the previously recorded `7bbb583487016c613c78ef86479986dc2b2d83cd`. Its exact-current CI/security/supply-chain lanes remain queued or startup-failed; predecessor evidence is historical. The dependency-root release-provenance prerequisite remains Draft #25 at exact `9283d7b8ed85b97b893eeacf339524177f3ffbfc` on #19 and binds package/SBOM identities to protected source plus independently verifiable manifest-attestation evidence. Its predecessor `f184cc4d44637fc429ba5d1072838f5d1dd1dc61` acquired real hosted runners and exposed a repository-owned Ruff line-length defect plus a stale installed-wheel `next_action` expectation; current #25 repairs only those causes. Fresh exact-head runs `ci 33685788137`, `receipt-package-smoke 33685787517`, `reproducibility 33685787529`, and `supply-chain 33685787648` remain non-passing until terminal success. Draft #20 remains exact `475ce14185db697940e8219c3cda7f24d66f3ed7`; child #21 remains exact `239a73d5f1a18b10ad317fdd51567b7fa040f570` on obsolete #20 ancestry and contains the structured Context Assertion/CloudEvent envelope and authority/conformance repair. The intended rebuilt order remains `#19 -> #25 -> #20 -> #21`. No immutable CGC release exists, so Wardnet must not bind production behavior to any open PR head. -Enterprise Architecture Core #39 remains Draft at exact `c063570bd9177578fa75be69defd81c99e6ba2f3`, non-force restacked on its live parent and with exact-current repository lanes queued/pre-checkout after predecessor GREEN became historical. Child #40 remains Draft/non-mergeable at exact `b3ec93a42528ab0defc0116ac4695d669298240f` on obsolete #39 ancestry. #40 preserves the required Wardnet/quarantine authority boundary: `contextual-orchestrator -> quarantine application-service lease`, `Wardnet -> quarantine artifact-analysis evidence`, no malware verdict or artifact risk score as authoritative EA fact, and no direct database/source-copy integration. It remains fail-closed until compatible immutable CGC source-bound release evidence and qualifying quarantine release evidence exist. +Enterprise Architecture Core #39 remains Draft at exact `c063570bd9177578fa75be69defd81c99e6ba2f3`, non-force restacked on its live parent and with exact-current repository lanes queued/pre-checkout after predecessor GREEN became historical. Child #40 remains Draft/non-mergeable at exact `cad03dbc10a6b91978664e51debd18b59effd940` on obsolete #39 ancestry. #40 preserves the required Wardnet/quarantine authority boundary: `contextual-orchestrator -> quarantine application-service lease`, `Wardnet -> quarantine artifact-analysis evidence`, no malware verdict or artifact risk score as authoritative EA fact, and no direct database/source-copy integration. It remains fail-closed until compatible immutable CGC source-bound release evidence and qualifying quarantine release evidence exist. Fresh release reads for Quarantine Sandbox Runtime, EgressWeave, contextual-orchestrator, Context Graph Contracts, and Enterprise Architecture Core are empty. None exposes an immutable GitHub Release usable as a Wardnet production dependency. Open sibling branches are evidence, not release authority. @@ -49,7 +49,7 @@ PR #137 is protected-main truth. Predecessor checks, reviews, approvals, and art | PR | Exact head | State | Current decision | | --- | --- | --- | --- | | #88 CO ownership repair | `98a935e4b058d0500d520425b8ebf6ff4106aa1b` | GitHub Ready flag, architecture Draft-required; mergeable false; RED | The direct LiteLLM virtual-key/provider/model proxy conflicts with contextual-orchestrator ownership. Preserve unique fail-closed credential grammar, header minimization, streaming, zero-upstream-hit, property/fuzz and RFC 6750 evidence; do not close or merge it. The PR has been retitled `draft(architecture): preserve credential-guard evidence pending CO release`. The connector's Draft mutation currently fails before state change because its GraphQL wrapper requests nonexistent Repository field `fullDatabaseId`; the UI Ready flag is not architecture authority. Rework valid Wardnet-owned gateway/admission deltas behind a released CO ACL after CO publishes an immutable compatible client/schema/Agent. | -| #129 Agent Artifact Admission | `43837309a042a4016b5497bcda25d8e80193f0ef` | Draft, mergeable | Current source binds package-manager executable families to canonical artifact ecosystems and retains indirect-source/root/index/workspace defenses through the Bun `--cwd`/`--filter`/`-F`/`--config` fail-closed repair. The current head is a one-commit linear advance from `86abdb91…` whose only delta makes Bun test argv construction explicit; it is seven commits ahead of the previously recorded `350156bc…`. Exact-head CI/Fuzz/Security/SAST/OSV/Scorecard remain queued or pending and CodeQL is `startup_failure`; keep Draft. Retrieval-byte/provenance verification and hostile execution stay executor/quarantine-owned. | +| #129 Agent Artifact Admission | `217108b31640afb1e9561f482c6d69a739de0595` | Draft, mergeable | Current source binds package-manager executable families to canonical artifact ecosystems and retains indirect-source/root/index/workspace defenses. The latest causal npm trust-root slices reject caller-selected `--userconfig`/`--globalconfig` configuration authority and registry TLS trust overrides through `--cafile`, `--ca`, and `--strict-ssl=false`. Current inline review inventory has no unresolved current finding. Exact-head CI/Fuzz/Security/SAST/OSV/Scorecard remain queued and CodeQL is `startup_failure`; keep Draft. Retrieval-byte/provenance verification and hostile execution stay executor/quarantine-owned. | | #136 Network-Egress | `83e2b4fdfae6eb927dd1b6ce5a263af654c52540` | Ready, source defect | Shared structural URL validation, resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, response hop filtering, and architecture fitness are present. RED `f408500d8aeb4beb386caa48a7525508d59da193` requires one end-to-end deadline across manual DNS and remaining HTTP work; production deadline propagation plus a deterministic stalled-resolution runtime regression remain required. #155 must become protected truth before final integration. | | #140 Runtime Configuration | `43d1b6e9122d8bb5cb882f8fc6e066c63b39ae45` | Ready | Security/SAST are GREEN on the current head; CI/Fuzz remain non-terminal. Runtime Configuration remains a supporting bootstrap boundary; Credential Registry remains secret authority. | | #144 Kubernetes path/public docs | `9616b94ac1ecf70038071a8c9395348694e6312c` | Ready | Hardened manifest source moves to `deploy/kubernetes/wardnet.yaml` without renaming live Kubernetes resources. Review-driven path/link regressions are resolved. Current repository gates remain queued/non-passing. | @@ -117,4 +117,4 @@ No release is authorized. Wardnet, Context Graph Contracts, EA Core, contextual- 6. Drain clean supporting work (#77, #90, #93, #111, #134, #135, #140, #141) only on unchanged exact heads with live evidence. 7. Reconstruct #95's valuable PostgreSQL/outbox/Coraza evidence into bounded #80/#81/#86 lanes. 8. Continue #82/#83/#84/#85 only after their declared prerequisites become protected/released truth. -9. Refresh this baseline whenever protected truth, queue topology, release state, or responsibility boundaries materially change. +9. Refresh this baseline whenever protected truth, queue topology, release state, or responsibility boundaries materially change. \ No newline at end of file From 203c1e738ed15b3a65948d2228770e5412dc75af Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 08:19:24 +0900 Subject: [PATCH 36/73] docs(gaps): refresh security and context fabric heads --- docs/product-technical-gap-baseline.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 7f728521..6aa0d4ad 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -32,9 +32,9 @@ GitHub's hosted-runner contract does not make `ubuntu-slim` an equivalent workar Fresh metadata still reports `develop` as the default branch for both `ContextualWisdomLab/context-graph-contracts` and `ContextualWisdomLab/enterprise-architecture-core`. Their protected `develop` tips remain `context-graph-contracts@99cb5468ba3c15c5e79688f53dee74724fae2d13` and `enterprise-architecture-core@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`. Both expose zero GitHub Releases. The accepted protected-`main` transition remains central `.github`/Context Fabric owner work rather than a Wardnet source mutation. -Context Graph Contracts root #4 is exact `03caa05e432a46227e16ecddd61ed825d1a104dd` on live `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`, a linear eight-commit advance over the previously recorded `7bbb583487016c613c78ef86479986dc2b2d83cd`. Its exact-current CI/security/supply-chain lanes remain queued or startup-failed; predecessor evidence is historical. The dependency-root release-provenance prerequisite remains Draft #25 at exact `9283d7b8ed85b97b893eeacf339524177f3ffbfc` on #19 and binds package/SBOM identities to protected source plus independently verifiable manifest-attestation evidence. Its predecessor `f184cc4d44637fc429ba5d1072838f5d1dd1dc61` acquired real hosted runners and exposed a repository-owned Ruff line-length defect plus a stale installed-wheel `next_action` expectation; current #25 repairs only those causes. Fresh exact-head runs `ci 33685788137`, `receipt-package-smoke 33685787517`, `reproducibility 33685787529`, and `supply-chain 33685787648` remain non-passing until terminal success. Draft #20 remains exact `475ce14185db697940e8219c3cda7f24d66f3ed7`; child #21 remains exact `239a73d5f1a18b10ad317fdd51567b7fa040f570` on obsolete #20 ancestry and contains the structured Context Assertion/CloudEvent envelope and authority/conformance repair. The intended rebuilt order remains `#19 -> #25 -> #20 -> #21`. No immutable CGC release exists, so Wardnet must not bind production behavior to any open PR head. +Context Graph Contracts root #4 is exact `03caa05e432a46227e16ecddd61ed825d1a104dd` on live `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`, a linear eight-commit advance over the previously recorded `7bbb583487016c613c78ef86479986dc2b2d83cd`. Its exact-current CI/security/supply-chain lanes remain queued or startup-failed; predecessor evidence is historical. The dependency-root release-provenance prerequisite remains Draft #25 at exact `9283d7b8ed85b97b893eeacf339524177f3ffbfc` on #19 and binds package/SBOM identities to protected source plus independently verifiable manifest-attestation evidence. Its predecessor `f184cc4d44637fc429ba5d1072838f5d1dd1dc61` acquired real hosted runners and exposed a repository-owned Ruff line-length defect plus a stale installed-wheel `next_action` expectation; current #25 repairs only those causes. Fresh exact-head runs `ci 33685788137`, `receipt-package-smoke 33685787517`, `reproducibility 33685787529`, and `supply-chain 33685787648` remain non-passing until terminal success. Draft #20 remains exact `475ce14185db697940e8219c3cda7f24d66f3ed7`; child #21 remains exact `0ca503b48371ae71815a632f8e25c7beba487fc7` on obsolete #20 ancestry and contains the structured Context Assertion/CloudEvent envelope and authority/conformance repair. The intended rebuilt order remains `#19 -> #25 -> #20 -> #21`. No immutable CGC release exists, so Wardnet must not bind production behavior to any open PR head. -Enterprise Architecture Core #39 remains Draft at exact `c063570bd9177578fa75be69defd81c99e6ba2f3`, non-force restacked on its live parent and with exact-current repository lanes queued/pre-checkout after predecessor GREEN became historical. Child #40 remains Draft/non-mergeable at exact `cad03dbc10a6b91978664e51debd18b59effd940` on obsolete #39 ancestry. #40 preserves the required Wardnet/quarantine authority boundary: `contextual-orchestrator -> quarantine application-service lease`, `Wardnet -> quarantine artifact-analysis evidence`, no malware verdict or artifact risk score as authoritative EA fact, and no direct database/source-copy integration. It remains fail-closed until compatible immutable CGC source-bound release evidence and qualifying quarantine release evidence exist. +Enterprise Architecture Core #39 remains Draft at exact `c063570bd9177578fa75be69defd81c99e6ba2f3`, non-force restacked on its live parent and with exact-current repository lanes queued/pre-checkout after predecessor GREEN became historical. Child #40 remains Draft/non-mergeable at exact `917815f4b56af1857f10d3f9eb946c78be471190` on obsolete #39 ancestry. #40 preserves the required Wardnet/quarantine authority boundary: `contextual-orchestrator -> quarantine application-service lease`, `Wardnet -> quarantine artifact-analysis evidence`, no malware verdict or artifact risk score as authoritative EA fact, and no direct database/source-copy integration. It remains fail-closed until compatible immutable CGC source-bound release evidence and qualifying quarantine release evidence exist. Fresh release reads for Quarantine Sandbox Runtime, EgressWeave, contextual-orchestrator, Context Graph Contracts, and Enterprise Architecture Core are empty. None exposes an immutable GitHub Release usable as a Wardnet production dependency. Open sibling branches are evidence, not release authority. @@ -48,9 +48,9 @@ PR #137 is protected-main truth. Predecessor checks, reviews, approvals, and art | PR | Exact head | State | Current decision | | --- | --- | --- | --- | -| #88 CO ownership repair | `98a935e4b058d0500d520425b8ebf6ff4106aa1b` | GitHub Ready flag, architecture Draft-required; mergeable false; RED | The direct LiteLLM virtual-key/provider/model proxy conflicts with contextual-orchestrator ownership. Preserve unique fail-closed credential grammar, header minimization, streaming, zero-upstream-hit, property/fuzz and RFC 6750 evidence; do not close or merge it. The PR has been retitled `draft(architecture): preserve credential-guard evidence pending CO release`. The connector's Draft mutation currently fails before state change because its GraphQL wrapper requests nonexistent Repository field `fullDatabaseId`; the UI Ready flag is not architecture authority. Rework valid Wardnet-owned gateway/admission deltas behind a released CO ACL after CO publishes an immutable compatible client/schema/Agent. | -| #129 Agent Artifact Admission | `217108b31640afb1e9561f482c6d69a739de0595` | Draft, mergeable | Current source binds package-manager executable families to canonical artifact ecosystems and retains indirect-source/root/index/workspace defenses. The latest causal npm trust-root slices reject caller-selected `--userconfig`/`--globalconfig` configuration authority and registry TLS trust overrides through `--cafile`, `--ca`, and `--strict-ssl=false`. Current inline review inventory has no unresolved current finding. Exact-head CI/Fuzz/Security/SAST/OSV/Scorecard remain queued and CodeQL is `startup_failure`; keep Draft. Retrieval-byte/provenance verification and hostile execution stay executor/quarantine-owned. | -| #136 Network-Egress | `83e2b4fdfae6eb927dd1b6ce5a263af654c52540` | Ready, source defect | Shared structural URL validation, resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, response hop filtering, and architecture fitness are present. RED `f408500d8aeb4beb386caa48a7525508d59da193` requires one end-to-end deadline across manual DNS and remaining HTTP work; production deadline propagation plus a deterministic stalled-resolution runtime regression remain required. #155 must become protected truth before final integration. | +| #88 CO ownership repair | `98a935e4b058d0500d520425b8ebf6ff4106aa1b` | Draft; mergeable false; RED | The direct LiteLLM virtual-key/provider/model proxy conflicts with contextual-orchestrator ownership. Preserve unique fail-closed credential grammar, header minimization, streaming, zero-upstream-hit, property/fuzz and RFC 6750 evidence; do not close or merge it. GitHub metadata now correctly records Draft. Rework valid Wardnet-owned gateway/admission deltas behind a released CO ACL after CO publishes an immutable compatible client/schema/Agent. | +| #129 Agent Artifact Admission | `2545b7591c75b98266d239c1884a009211c21eca` | Draft, mergeable | Current source binds package-manager executable families to canonical artifact ecosystems and retains indirect-source/root/index/workspace/config/TLS-trust defenses. RED `609cbde6b2907f0ec27225152b7e15f57b2429eb` proves Cargo `--target-dir` could redirect generated/intermediate build outputs outside the broker-selected workspace; GREEN `2545b7591c75b98266d239c1884a009211c21eca` classifies both joined and split `--target-dir` spellings as `alternate_install_root`. Current inline review inventory has no unresolved current finding. Exact-head CI/Fuzz/Security/SAST/OSV/Scorecard remain queued and CodeQL is `startup_failure`; keep Draft. Retrieval-byte/provenance verification and hostile execution stay executor/quarantine-owned. | +| #136 Network-Egress | `83e2b4fdfae6eb927dd1b6ce5a263af654c52540` | Draft, source defect | Shared structural URL validation, resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, response hop filtering, and architecture fitness are present. RED `f408500d8aeb4beb386caa48a7525508d59da193` requires one end-to-end deadline across manual DNS and remaining HTTP work; production deadline propagation plus a deterministic stalled-resolution runtime regression remain required. GitHub metadata is now Draft to match this executable RED. #155 must become protected truth before final integration. | | #140 Runtime Configuration | `43d1b6e9122d8bb5cb882f8fc6e066c63b39ae45` | Ready | Security/SAST are GREEN on the current head; CI/Fuzz remain non-terminal. Runtime Configuration remains a supporting bootstrap boundary; Credential Registry remains secret authority. | | #144 Kubernetes path/public docs | `9616b94ac1ecf70038071a8c9395348694e6312c` | Ready | Hardened manifest source moves to `deploy/kubernetes/wardnet.yaml` without renaming live Kubernetes resources. Review-driven path/link regressions are resolved. Current repository gates remain queued/non-passing. | | #153 explicit hosted runner | `b663f9d200e5f385c7dd067d074940a02836c68e` | Ready, clean stack root | Same-source repository CI/Fuzz/Security/SAST have terminal GREEN evidence. Current central runner/review/governance evidence is non-terminal, and stale same-SHA required evidence is proven capable of referring to superseded PR #147 rather than #153. A fresh #153-bound verdict is required; `ubuntu-slim` is only an acquisition canary. | From b83e07c67c3cf0ede4c3f8e2af152e45081c79aa Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 09:20:30 +0900 Subject: [PATCH 37/73] docs(gaps): refresh live security and EA heads --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 6aa0d4ad..01f45694 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -34,7 +34,7 @@ Fresh metadata still reports `develop` as the default branch for both `Contextua Context Graph Contracts root #4 is exact `03caa05e432a46227e16ecddd61ed825d1a104dd` on live `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`, a linear eight-commit advance over the previously recorded `7bbb583487016c613c78ef86479986dc2b2d83cd`. Its exact-current CI/security/supply-chain lanes remain queued or startup-failed; predecessor evidence is historical. The dependency-root release-provenance prerequisite remains Draft #25 at exact `9283d7b8ed85b97b893eeacf339524177f3ffbfc` on #19 and binds package/SBOM identities to protected source plus independently verifiable manifest-attestation evidence. Its predecessor `f184cc4d44637fc429ba5d1072838f5d1dd1dc61` acquired real hosted runners and exposed a repository-owned Ruff line-length defect plus a stale installed-wheel `next_action` expectation; current #25 repairs only those causes. Fresh exact-head runs `ci 33685788137`, `receipt-package-smoke 33685787517`, `reproducibility 33685787529`, and `supply-chain 33685787648` remain non-passing until terminal success. Draft #20 remains exact `475ce14185db697940e8219c3cda7f24d66f3ed7`; child #21 remains exact `0ca503b48371ae71815a632f8e25c7beba487fc7` on obsolete #20 ancestry and contains the structured Context Assertion/CloudEvent envelope and authority/conformance repair. The intended rebuilt order remains `#19 -> #25 -> #20 -> #21`. No immutable CGC release exists, so Wardnet must not bind production behavior to any open PR head. -Enterprise Architecture Core #39 remains Draft at exact `c063570bd9177578fa75be69defd81c99e6ba2f3`, non-force restacked on its live parent and with exact-current repository lanes queued/pre-checkout after predecessor GREEN became historical. Child #40 remains Draft/non-mergeable at exact `917815f4b56af1857f10d3f9eb946c78be471190` on obsolete #39 ancestry. #40 preserves the required Wardnet/quarantine authority boundary: `contextual-orchestrator -> quarantine application-service lease`, `Wardnet -> quarantine artifact-analysis evidence`, no malware verdict or artifact risk score as authoritative EA fact, and no direct database/source-copy integration. It remains fail-closed until compatible immutable CGC source-bound release evidence and qualifying quarantine release evidence exist. +Enterprise Architecture Core #39 remains Draft at exact `c063570bd9177578fa75be69defd81c99e6ba2f3`, non-force restacked on its live parent and with exact-current repository lanes queued/pre-checkout after predecessor GREEN became historical. Child #40 remains Draft/non-mergeable at exact `f330e1a964e83ae96aa2f395e4b5983a2f981a65` on obsolete #39 ancestry. #40 preserves the required Wardnet/quarantine authority boundary: `contextual-orchestrator -> quarantine application-service lease`, `Wardnet -> quarantine artifact-analysis evidence`, no malware verdict or artifact risk score as authoritative EA fact, and no direct database/source-copy integration. It remains fail-closed until compatible immutable CGC source-bound release evidence and qualifying quarantine release evidence exist. Fresh release reads for Quarantine Sandbox Runtime, EgressWeave, contextual-orchestrator, Context Graph Contracts, and Enterprise Architecture Core are empty. None exposes an immutable GitHub Release usable as a Wardnet production dependency. Open sibling branches are evidence, not release authority. @@ -50,7 +50,7 @@ PR #137 is protected-main truth. Predecessor checks, reviews, approvals, and art | --- | --- | --- | --- | | #88 CO ownership repair | `98a935e4b058d0500d520425b8ebf6ff4106aa1b` | Draft; mergeable false; RED | The direct LiteLLM virtual-key/provider/model proxy conflicts with contextual-orchestrator ownership. Preserve unique fail-closed credential grammar, header minimization, streaming, zero-upstream-hit, property/fuzz and RFC 6750 evidence; do not close or merge it. GitHub metadata now correctly records Draft. Rework valid Wardnet-owned gateway/admission deltas behind a released CO ACL after CO publishes an immutable compatible client/schema/Agent. | | #129 Agent Artifact Admission | `2545b7591c75b98266d239c1884a009211c21eca` | Draft, mergeable | Current source binds package-manager executable families to canonical artifact ecosystems and retains indirect-source/root/index/workspace/config/TLS-trust defenses. RED `609cbde6b2907f0ec27225152b7e15f57b2429eb` proves Cargo `--target-dir` could redirect generated/intermediate build outputs outside the broker-selected workspace; GREEN `2545b7591c75b98266d239c1884a009211c21eca` classifies both joined and split `--target-dir` spellings as `alternate_install_root`. Current inline review inventory has no unresolved current finding. Exact-head CI/Fuzz/Security/SAST/OSV/Scorecard remain queued and CodeQL is `startup_failure`; keep Draft. Retrieval-byte/provenance verification and hostile execution stay executor/quarantine-owned. | -| #136 Network-Egress | `83e2b4fdfae6eb927dd1b6ce5a263af654c52540` | Draft, source defect | Shared structural URL validation, resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, response hop filtering, and architecture fitness are present. RED `f408500d8aeb4beb386caa48a7525508d59da193` requires one end-to-end deadline across manual DNS and remaining HTTP work; production deadline propagation plus a deterministic stalled-resolution runtime regression remain required. GitHub metadata is now Draft to match this executable RED. #155 must become protected truth before final integration. | +| #136 Network-Egress | `3cb1047416c3aa7fa8eb352b842cc55ad8c21b19` | Draft, executable RED pending source fix | Shared structural URL validation, resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, response hop filtering, and architecture fitness are present. RED `f408500d8aeb4beb386caa48a7525508d59da193` requires one end-to-end deadline across manual DNS and remaining HTTP work; current head fixes only the rustfmt defect that prevented that RED harness from executing. Production deadline propagation plus a deterministic stalled-resolution runtime regression remain required. Exact-current CI is queued before source execution and CodeQL is startup-failed. #155 must become protected truth before final integration. | | #140 Runtime Configuration | `43d1b6e9122d8bb5cb882f8fc6e066c63b39ae45` | Ready | Security/SAST are GREEN on the current head; CI/Fuzz remain non-terminal. Runtime Configuration remains a supporting bootstrap boundary; Credential Registry remains secret authority. | | #144 Kubernetes path/public docs | `9616b94ac1ecf70038071a8c9395348694e6312c` | Ready | Hardened manifest source moves to `deploy/kubernetes/wardnet.yaml` without renaming live Kubernetes resources. Review-driven path/link regressions are resolved. Current repository gates remain queued/non-passing. | | #153 explicit hosted runner | `b663f9d200e5f385c7dd067d074940a02836c68e` | Ready, clean stack root | Same-source repository CI/Fuzz/Security/SAST have terminal GREEN evidence. Current central runner/review/governance evidence is non-terminal, and stale same-SHA required evidence is proven capable of referring to superseded PR #147 rather than #153. A fresh #153-bound verdict is required; `ubuntu-slim` is only an acquisition canary. | From d163d27d9437bc8641fb81b78b4d5619e8be7f94 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 10:14:16 +0900 Subject: [PATCH 38/73] docs(gaps): correct live runner and owner evidence --- docs/product-technical-gap-baseline.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 01f45694..dd3d6b5b 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -18,11 +18,11 @@ Protected/default Wardnet `main` is `cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. A fresh live read of organization ruleset `18156473` still shows `~DEFAULT_BRANCH`, `required_approving_review_count=1`, `required_reviewers=[]`, no code-owner review, and no last-push approval requirement. Review-thread resolution, central required workflows, deletion protection, and non-fast-forward protection remain enabled. The live ruleset also exposes `OrganizationAdmin/always` bypass capability; that existence is not normal merge authorization. Self-approval and bot/model-as-human approval are forbidden. -The bare approval count is structurally inconsistent with the declared solo-maintainer model. This is a central governance defect rather than a Wardnet staffing requirement. `.github#1644@528139ff3c2a3680d67b8489c38fdb65cd31d98c`, referencing #772 and related governance work, is the current owner-plane reconciliation candidate. Its source policy removes the impossible approval count while preserving deterministic workflow/security/coverage/SBOM/provenance/thread/branch-integrity controls. Source integration alone does not mutate live rulesets; the owner-plane apply remains separately privileged and must be proven from live settings before Wardnet treats the rule as repaired. Wardnet #155 is now an explicit post-apply canary for that owner-plane repair. +The bare approval count is structurally inconsistent with the declared solo-maintainer model. This is a central governance defect rather than a Wardnet staffing requirement. `.github#1644@79527b4bfd9ca1607b05de4f8e17ea8ee199b78a`, referencing #772 and related governance work, is the current owner-plane reconciliation candidate. Its source policy removes the impossible approval count while preserving deterministic workflow/security/coverage/SBOM/provenance/thread/branch-integrity controls. Source integration alone does not mutate live rulesets; the owner-plane apply remains separately privileged and must be proven from live settings before Wardnet treats the rule as repaired. Wardnet #155 is now an explicit post-apply canary for that owner-plane repair. Runner acquisition is also a central control-plane concern. PR #153 pins repository-owned CI/Fuzz/Scorecard runner declarations to explicit `ubuntu-24.04` and permanently rejects floating `ubuntu-latest`. Exact head `b663f9d200e5f385c7dd067d074940a02836c68e` has completed repository CI/Fuzz/Security/SAST successfully on that same source, proving the full hosted image is executable when admitted. Later exact-head waves across Wardnet, Context Graph Contracts, and EA Core again remained pre-checkout with `runner_id=0`. `.github#712` owns acquisition/capacity/policy-routing and evidence-identity repair. -PR #155 provides the clearest current-PR evidence. Exact head `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` has terminal repository-owned CI/Fuzz/Security/SAST and resolved inline review threads. Its correct current-PR required OpenCode run is `33590351182`: bootstrap job `100122902000` completed, while `coverage-source-tree` job `100272722468` remains queued before checkout with `runner_id=0`, no runner/group, and `steps=[]`. The same source SHA was previously used by PR #138, whose older required run is a different PR identity. Central required evidence must bind at least `(repository, pr_number, head_sha, workflow/check lane)`; wrong-PR same-SHA evidence must never be promoted to the current PR. +PR #155 provides the clearest current-PR evidence. Exact head `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` has terminal repository-owned CI/Fuzz/Security/SAST and resolved inline review threads. Its correct current-PR required OpenCode run is `33590351182`: bootstrap job `100122902000` completed; `coverage-source-tree` job `100272722468` later completed successfully on hosted runner `1001629411`; the downstream `coverage-evidence` job `100479589911` remains queued with `runner_id=0`, an empty runner name, and zero steps. The same source SHA was previously used by PR #138, whose older required run is a different PR identity. Central required evidence must bind at least `(repository, pr_number, head_sha, workflow/check lane)`; wrong-PR same-SHA evidence must never be promoted to the current PR. A separate #153 reproduction already proved the same identity class: required-workflow run `33550235908` / job `100100529632` was commit-scoped to `b663f9d…` but its durable payload was `PR_NUMBER=147`. The same clean SHA is now #153's head, so commit-only evidence lookup can surface the wrong PR's result. Do not manufacture new leaf SHAs to escape that contamination. @@ -34,7 +34,7 @@ Fresh metadata still reports `develop` as the default branch for both `Contextua Context Graph Contracts root #4 is exact `03caa05e432a46227e16ecddd61ed825d1a104dd` on live `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`, a linear eight-commit advance over the previously recorded `7bbb583487016c613c78ef86479986dc2b2d83cd`. Its exact-current CI/security/supply-chain lanes remain queued or startup-failed; predecessor evidence is historical. The dependency-root release-provenance prerequisite remains Draft #25 at exact `9283d7b8ed85b97b893eeacf339524177f3ffbfc` on #19 and binds package/SBOM identities to protected source plus independently verifiable manifest-attestation evidence. Its predecessor `f184cc4d44637fc429ba5d1072838f5d1dd1dc61` acquired real hosted runners and exposed a repository-owned Ruff line-length defect plus a stale installed-wheel `next_action` expectation; current #25 repairs only those causes. Fresh exact-head runs `ci 33685788137`, `receipt-package-smoke 33685787517`, `reproducibility 33685787529`, and `supply-chain 33685787648` remain non-passing until terminal success. Draft #20 remains exact `475ce14185db697940e8219c3cda7f24d66f3ed7`; child #21 remains exact `0ca503b48371ae71815a632f8e25c7beba487fc7` on obsolete #20 ancestry and contains the structured Context Assertion/CloudEvent envelope and authority/conformance repair. The intended rebuilt order remains `#19 -> #25 -> #20 -> #21`. No immutable CGC release exists, so Wardnet must not bind production behavior to any open PR head. -Enterprise Architecture Core #39 remains Draft at exact `c063570bd9177578fa75be69defd81c99e6ba2f3`, non-force restacked on its live parent and with exact-current repository lanes queued/pre-checkout after predecessor GREEN became historical. Child #40 remains Draft/non-mergeable at exact `f330e1a964e83ae96aa2f395e4b5983a2f981a65` on obsolete #39 ancestry. #40 preserves the required Wardnet/quarantine authority boundary: `contextual-orchestrator -> quarantine application-service lease`, `Wardnet -> quarantine artifact-analysis evidence`, no malware verdict or artifact risk score as authoritative EA fact, and no direct database/source-copy integration. It remains fail-closed until compatible immutable CGC source-bound release evidence and qualifying quarantine release evidence exist. +Enterprise Architecture Core #39 remains Draft at exact `c063570bd9177578fa75be69defd81c99e6ba2f3`, non-force restacked on its live parent and with exact-current repository lanes queued/pre-checkout after predecessor GREEN became historical. Child #40 remains Draft/non-mergeable at exact `f383ffac89fce0e9a13ef319d732e31ca962e848` on obsolete #39 ancestry. #40 preserves the required Wardnet/quarantine authority boundary: `contextual-orchestrator -> quarantine application-service lease`, `Wardnet -> quarantine artifact-analysis evidence`, no malware verdict or artifact risk score as authoritative EA fact, and no direct database/source-copy integration. It remains fail-closed until compatible immutable CGC source-bound release evidence and qualifying quarantine release evidence exist. Fresh release reads for Quarantine Sandbox Runtime, EgressWeave, contextual-orchestrator, Context Graph Contracts, and Enterprise Architecture Core are empty. None exposes an immutable GitHub Release usable as a Wardnet production dependency. Open sibling branches are evidence, not release authority. @@ -55,7 +55,7 @@ PR #137 is protected-main truth. Predecessor checks, reviews, approvals, and art | #144 Kubernetes path/public docs | `9616b94ac1ecf70038071a8c9395348694e6312c` | Ready | Hardened manifest source moves to `deploy/kubernetes/wardnet.yaml` without renaming live Kubernetes resources. Review-driven path/link regressions are resolved. Current repository gates remain queued/non-passing. | | #153 explicit hosted runner | `b663f9d200e5f385c7dd067d074940a02836c68e` | Ready, clean stack root | Same-source repository CI/Fuzz/Security/SAST have terminal GREEN evidence. Current central runner/review/governance evidence is non-terminal, and stale same-SHA required evidence is proven capable of referring to superseded PR #147 rather than #153. A fresh #153-bound verdict is required; `ubuntu-slim` is only an acquisition canary. | | #154 commercial readiness target | `41098f76c8a823c20ba0e319c38cf24acb470346` | Ready | Aligns the shipped readiness threshold and buyer evidence to the 20B KRW target without rewriting historical plan artifacts. Current repository gates remain non-terminal; queued evidence is non-passing. | -| #155 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready, main-based | Non-loopback startup fails closed without write-capable admin credentials; current review threads are resolved. Repository-owned CI/Fuzz/Security/SAST are terminal GREEN. Current-PR required OpenCode bootstrap succeeded, but coverage source materialization remains pre-checkout queued at job `100272722468`; predecessor #138 evidence does not transfer merely because the source SHA is identical. Issue #78 closes only after protected merge. | +| #155 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready, main-based | Non-loopback startup fails closed without write-capable admin credentials; current review threads are resolved. Repository-owned CI/Fuzz/Security/SAST are terminal GREEN. Current-PR required OpenCode bootstrap and coverage source-tree materialization are terminal successful; downstream `coverage-evidence` job `100479589911` remains pre-checkout queued with `runner_id=0`. Predecessor #138 evidence does not transfer merely because the source SHA is identical. Issue #78 closes only after protected merge. | | #156 operability evidence | `76037b8ae206ace8dab0e6622dfc9fc88c57deb3` | Draft, child of #153 | Preserve support-bundle/readiness evidence; reconstruct/restack on fresh protected main after #153 integrates, then regenerate all base-sensitive evidence. | | #157 trusted proxy | `65a2b7fbf2827f69ae1aa288696b6c5630af28c4` | Draft, child of #153 | Preserve fail-closed forwarded-IP attribution. Reconstruct/restack after #153 protected merge. | | #158 readiness metrics | `387a447f856093d02116dfadcf2c4a4a63c6d3ba` | Draft, child of #153 | Preserve readiness gauges using existing readiness/KPI authority. Reconstruct/restack after #153 protected merge. | From 702fa455092ef5d6f92f6c7fd555cdbbd0170804 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 13:41:47 +0900 Subject: [PATCH 39/73] docs(gaps): refresh live Wardnet delivery evidence --- docs/product-technical-gap-baseline.md | 46 +++++++++++++++----------- 1 file changed, 26 insertions(+), 20 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index dd3d6b5b..460dd41e 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -22,12 +22,14 @@ The bare approval count is structurally inconsistent with the declared solo-main Runner acquisition is also a central control-plane concern. PR #153 pins repository-owned CI/Fuzz/Scorecard runner declarations to explicit `ubuntu-24.04` and permanently rejects floating `ubuntu-latest`. Exact head `b663f9d200e5f385c7dd067d074940a02836c68e` has completed repository CI/Fuzz/Security/SAST successfully on that same source, proving the full hosted image is executable when admitted. Later exact-head waves across Wardnet, Context Graph Contracts, and EA Core again remained pre-checkout with `runner_id=0`. `.github#712` owns acquisition/capacity/policy-routing and evidence-identity repair. -PR #155 provides the clearest current-PR evidence. Exact head `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` has terminal repository-owned CI/Fuzz/Security/SAST and resolved inline review threads. Its correct current-PR required OpenCode run is `33590351182`: bootstrap job `100122902000` completed; `coverage-source-tree` job `100272722468` later completed successfully on hosted runner `1001629411`; the downstream `coverage-evidence` job `100479589911` remains queued with `runner_id=0`, an empty runner name, and zero steps. The same source SHA was previously used by PR #138, whose older required run is a different PR identity. Central required evidence must bind at least `(repository, pr_number, head_sha, workflow/check lane)`; wrong-PR same-SHA evidence must never be promoted to the current PR. +PR #155 provides the clearest current-PR evidence. Exact head `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` has terminal repository-owned CI/Fuzz/Security/SAST and resolved inline review threads. Its correct current-PR required OpenCode run is `33590351182`: bootstrap job `100122902000` completed; `coverage-source-tree` job `100272722468` completed successfully on hosted runner `1001629411`; the downstream `coverage-evidence` job `100479589911` remains queued with `runner_id=0`, an empty runner name, and zero steps. The same source SHA was previously used by PR #138, whose older required run is a different PR identity. Central required evidence must bind at least `(repository, pr_number, head_sha, workflow/check lane)`; wrong-PR same-SHA evidence must never be promoted to the current PR. A separate #153 reproduction already proved the same identity class: required-workflow run `33550235908` / job `100100529632` was commit-scoped to `b663f9d…` but its durable payload was `PR_NUMBER=147`. The same clean SHA is now #153's head, so commit-only evidence lookup can surface the wrong PR's result. Do not manufacture new leaf SHAs to escape that contamination. GitHub's hosted-runner contract does not make `ubuntu-slim` an equivalent workaround: it is a constrained container runner intended for lightweight automation. A successful slim job is an admission canary, not justification to downgrade Wardnet CI/Fuzz/CodeQL/coverage workloads. +A separate central ownership gap now exists for OpenSSF Scorecard posture refresh. Wardnet #160 attempted to delete the repository's default-branch/scheduled Scorecard workflow while the central reusable `scorecard-pr.yml` remains PR-only. That would stop authoritative default-branch SARIF refresh. #160 is therefore Draft with its review finding intentionally unresolved, and `.github#1777` owns the reusable default-branch Scorecard workflow plus exact-SHA thin-caller prerequisite. Do not merge deletion-only #160 or treat PR-only Scorecard evidence as equivalent. + ## Context Fabric live boundary Fresh metadata still reports `develop` as the default branch for both `ContextualWisdomLab/context-graph-contracts` and `ContextualWisdomLab/enterprise-architecture-core`. Their protected `develop` tips remain `context-graph-contracts@99cb5468ba3c15c5e79688f53dee74724fae2d13` and `enterprise-architecture-core@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`. Both expose zero GitHub Releases. The accepted protected-`main` transition remains central `.github`/Context Fabric owner work rather than a Wardnet source mutation. @@ -40,26 +42,29 @@ Fresh release reads for Quarantine Sandbox Runtime, EgressWeave, contextual-orch ## Live delivery queue -Fresh inventory contains 25 open PRs: +Fresh inventory contains 26 open PRs: -`#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #153, #154, #155, #156, #157, #158, #159`. +`#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #153, #154, #155, #156, #157, #158, #159, #160`. PR #137 is protected-main truth. Predecessor checks, reviews, approvals, and artifacts do not transfer after head/base movement. | PR | Exact head | State | Current decision | | --- | --- | --- | --- | +| #77 Rust toolchain | `2f96565b9452ea49627b28f7ae380e07b68af115` | Ready; auto-merge armed | The formerly stale Rust `1.97.1` pin was advanced by ordinary forward commits to current stable `1.98.0` and CLAUDE guidance was made code-current. The existing contract remains version-agnostic and requires an exact three-component numeric pin, CI consumption from `rust-toolchain.toml`, required components, Docker consumption and weekly Dependabot reviewability. Exact-current CI/Security/SAST/Scorecard/OSV are queued; no predecessor `1.97.1` result transfers. | | #88 CO ownership repair | `98a935e4b058d0500d520425b8ebf6ff4106aa1b` | Draft; mergeable false; RED | The direct LiteLLM virtual-key/provider/model proxy conflicts with contextual-orchestrator ownership. Preserve unique fail-closed credential grammar, header minimization, streaming, zero-upstream-hit, property/fuzz and RFC 6750 evidence; do not close or merge it. GitHub metadata now correctly records Draft. Rework valid Wardnet-owned gateway/admission deltas behind a released CO ACL after CO publishes an immutable compatible client/schema/Agent. | -| #129 Agent Artifact Admission | `2545b7591c75b98266d239c1884a009211c21eca` | Draft, mergeable | Current source binds package-manager executable families to canonical artifact ecosystems and retains indirect-source/root/index/workspace/config/TLS-trust defenses. RED `609cbde6b2907f0ec27225152b7e15f57b2429eb` proves Cargo `--target-dir` could redirect generated/intermediate build outputs outside the broker-selected workspace; GREEN `2545b7591c75b98266d239c1884a009211c21eca` classifies both joined and split `--target-dir` spellings as `alternate_install_root`. Current inline review inventory has no unresolved current finding. Exact-head CI/Fuzz/Security/SAST/OSV/Scorecard remain queued and CodeQL is `startup_failure`; keep Draft. Retrieval-byte/provenance verification and hostile execution stay executor/quarantine-owned. | +| #129 Agent Artifact Admission | `85f0f6542a13bfdcc05024b51423851b33ae2ed8` | Draft, mergeable | Current source additionally closes pnpmfile hook and Cargo build-variant authority gaps while preserving package-manager executable-family, indirect-source/root/index/workspace/config/TLS-trust defenses. Current inline review inventory has no unresolved source finding. Exact-head CI/Fuzz/Security/SAST/OSV/Scorecard are queued; keep Draft until terminal current-head evidence exists. Retrieval-byte/provenance verification and hostile execution stay executor/quarantine-owned. | | #136 Network-Egress | `3cb1047416c3aa7fa8eb352b842cc55ad8c21b19` | Draft, executable RED pending source fix | Shared structural URL validation, resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, response hop filtering, and architecture fitness are present. RED `f408500d8aeb4beb386caa48a7525508d59da193` requires one end-to-end deadline across manual DNS and remaining HTTP work; current head fixes only the rustfmt defect that prevented that RED harness from executing. Production deadline propagation plus a deterministic stalled-resolution runtime regression remain required. Exact-current CI is queued before source execution and CodeQL is startup-failed. #155 must become protected truth before final integration. | -| #140 Runtime Configuration | `43d1b6e9122d8bb5cb882f8fc6e066c63b39ae45` | Ready | Security/SAST are GREEN on the current head; CI/Fuzz remain non-terminal. Runtime Configuration remains a supporting bootstrap boundary; Credential Registry remains secret authority. | -| #144 Kubernetes path/public docs | `9616b94ac1ecf70038071a8c9395348694e6312c` | Ready | Hardened manifest source moves to `deploy/kubernetes/wardnet.yaml` without renaming live Kubernetes resources. Review-driven path/link regressions are resolved. Current repository gates remain queued/non-passing. | -| #153 explicit hosted runner | `b663f9d200e5f385c7dd067d074940a02836c68e` | Ready, clean stack root | Same-source repository CI/Fuzz/Security/SAST have terminal GREEN evidence. Current central runner/review/governance evidence is non-terminal, and stale same-SHA required evidence is proven capable of referring to superseded PR #147 rather than #153. A fresh #153-bound verdict is required; `ubuntu-slim` is only an acquisition canary. | -| #154 commercial readiness target | `41098f76c8a823c20ba0e319c38cf24acb470346` | Ready | Aligns the shipped readiness threshold and buyer evidence to the 20B KRW target without rewriting historical plan artifacts. Current repository gates remain non-terminal; queued evidence is non-passing. | -| #155 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready, main-based | Non-loopback startup fails closed without write-capable admin credentials; current review threads are resolved. Repository-owned CI/Fuzz/Security/SAST are terminal GREEN. Current-PR required OpenCode bootstrap and coverage source-tree materialization are terminal successful; downstream `coverage-evidence` job `100479589911` remains pre-checkout queued with `runner_id=0`. Predecessor #138 evidence does not transfer merely because the source SHA is identical. Issue #78 closes only after protected merge. | +| #140 Runtime Configuration | `9389a2d63f0875f688de5ef3adff1ce6b54e1ab1` | Ready; auto-merge armed | Review-derived environment-race, recursive architecture-fitness, bootstrap-authority and credential-path split defects are repaired/resolved. The exact head repaired a real nested-fitness test regression without adding a lockfile dependency. Current CodeQL is startup-failed and repository/central lanes remain queued; Credential Registry remains secret authority. | +| #141 CodeQL uploader | `fea3796a723080068cdc02e064065d6d53eeb3e0` | Ready; auto-merge armed | Immutable `github/codeql-action/upload-sarif` pin advances to current v4.37.9; repository CI/Security/SAST are terminal GREEN on this unchanged head. Normal central/governance evidence still applies. | +| #144 Kubernetes path/public docs | `b07e4d21057df4dd4e706b584e5fad00338f20b6` | Ready; auto-merge armed | Hardened manifest source moves to `deploy/kubernetes/wardnet.yaml` without renaming live Kubernetes resources. Review-driven path/link regressions are resolved. Current exact-head CI/Security/SAST/Fuzz/Scorecard/OSV remain queued and CodeQL is startup-failed; the older body SHA is historical. | +| #153 explicit hosted runner | `b663f9d200e5f385c7dd067d074940a02836c68e` | Ready, clean stack root; auto-merge armed | Same-source repository CI/Fuzz/Security/SAST have terminal GREEN evidence. Current central runner/review/governance evidence is non-terminal, and stale same-SHA required evidence is proven capable of referring to superseded PR #147 rather than #153. A fresh #153-bound verdict is required; `ubuntu-slim` is only an acquisition canary. | +| #154 commercial readiness target | `41098f76c8a823c20ba0e319c38cf24acb470346` | Ready; auto-merge armed | Aligns the shipped readiness threshold and buyer evidence to the 20B KRW target without rewriting historical plan artifacts. Repository-owned CI/Fuzz/Security/SAST are terminal GREEN on the unchanged exact head; then-live central/governance evidence still applies. | +| #155 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready, main-based; auto-merge armed | Non-loopback startup fails closed without write-capable admin credentials; current review threads are resolved. Repository-owned CI/Fuzz/Security/SAST are terminal GREEN. Current-PR required OpenCode bootstrap and coverage source-tree materialization are terminal successful; downstream `coverage-evidence` job `100479589911` remains pre-checkout queued with `runner_id=0`. Predecessor #138 evidence does not transfer merely because the source SHA is identical. Issue #78 closes only after protected merge. | | #156 operability evidence | `76037b8ae206ace8dab0e6622dfc9fc88c57deb3` | Draft, child of #153 | Preserve support-bundle/readiness evidence; reconstruct/restack on fresh protected main after #153 integrates, then regenerate all base-sensitive evidence. | | #157 trusted proxy | `65a2b7fbf2827f69ae1aa288696b6c5630af28c4` | Draft, child of #153 | Preserve fail-closed forwarded-IP attribution. Reconstruct/restack after #153 protected merge. | | #158 readiness metrics | `387a447f856093d02116dfadcf2c4a4a63c6d3ba` | Draft, child of #153 | Preserve readiness gauges using existing readiness/KPI authority. Reconstruct/restack after #153 protected merge. | -| #159 CI concurrency | `89176e2cc57088e4d772de9b1686ab89a3e69aeb` | Ready | PR runs use PR-number concurrency so new heads supersede obsolete PR executions; push runs use unique run IDs so pending protected-main commits cannot replace each other. Two review findings are resolved. Current CI/Security/SAST/Scorecard/OSV remain queued and CodeQL ended startup failure before useful source execution; `.github#712` owns the organization control-plane class. | +| #159 CI concurrency | `89176e2cc57088e4d772de9b1686ab89a3e69aeb` | Ready; auto-merge armed | PR runs use PR-number concurrency so new heads supersede obsolete PR executions; push runs use unique run IDs so pending protected-main commits cannot replace each other. Two review findings are resolved. Current CI/Security/SAST/Scorecard/OSV remain queued and CodeQL ended startup failure before useful source execution; `.github#712` owns the organization control-plane class. | +| #160 Scorecard deduplication | `b03037d4648a6282cb4029dff062ed7b55ff980a` | Draft; unresolved valid review finding | Deleting the leaf workflow now would remove default-branch push/scheduled SARIF refresh because central `scorecard-pr.yml` is PR-only. `.github#1777` is the canonical prerequisite for a reusable default-branch posture workflow and exact-SHA thin caller. Keep Draft and do not resolve the finding until that central repair integrates and this PR is reconstructed/revalidated. | Auto-merge state, where enabled, is state only, not protected truth or transferable evidence. A changed head/base must reacquire the then-live policy evidence. @@ -74,7 +79,7 @@ Fresh issue inventory remains `#11, #38, #74, #75, #78, #79, #80, #81, #82, #83, 5. Identity/overload: #82 Keyverse-backed authorization/approval and #83 distributed/global admission. #157 is only the trusted-network attribution slice. 6. Proven security engines: #86 Coraza/CRS and Suricata with detection and false-positive evidence. 7. Immutable delivery/operation: #84 signed artifact/SBOM/provenance/rollback, then #85 telemetry/SLO/incident/restore evidence. -8. Supporting correctness: #74 deterministic persistence fault testing, #77 pinned compiler, #139 coherent runtime configuration, #153 deterministic hosted-runner selection, #159 repository-local concurrency, and #154 the 20B KRW commercial-readiness contract. +8. Supporting correctness: #74 deterministic persistence fault testing, #77 pinned compiler, #139 coherent runtime configuration, #153 deterministic hosted-runner selection, #159 repository-local concurrency, #154 the 20B KRW commercial-readiness contract, and #160 only after `.github#1777` establishes central default-branch Scorecard authority. Close an issue only after its owning protected merge satisfies the issue acceptance contract on current evidence. @@ -109,12 +114,13 @@ No release is authorized. Wardnet, Context Graph Contracts, EA Core, contextual- ## Next execution order -1. Continue #153/#155/#144/#154/#159 through current exact-head gates while `.github#712` repairs runner/evidence identity and `.github#1644` repairs solo-maintainer ruleset semantics. -2. Preserve #156/#157/#158 until #153 is protected, then non-force reconstruct/restack each child on fresh main and reacquire all evidence. -3. Repair #136's DNS-resolution deadline defect test-first; after #155 becomes protected truth, refresh #136 against live main and revalidate. -4. Finish #129 as one Agent Artifact Admission bounded context without absorbing quarantine or Agent/LLM orchestration. -5. Keep #88 open and architecture-blocked while contextual-orchestrator completes canonical routing/client work and publishes an immutable compatible release; then reconstruct the Wardnet consumer slice against that released contract without direct model/provider authority. -6. Drain clean supporting work (#77, #90, #93, #111, #134, #135, #140, #141) only on unchanged exact heads with live evidence. -7. Reconstruct #95's valuable PostgreSQL/outbox/Coraza evidence into bounded #80/#81/#86 lanes. -8. Continue #82/#83/#84/#85 only after their declared prerequisites become protected/released truth. -9. Refresh this baseline whenever protected truth, queue topology, release state, or responsibility boundaries materially change. \ No newline at end of file +1. Continue #153/#155/#144/#154/#159/#140/#141/#77 through current exact-head gates while `.github#712` repairs runner/evidence identity and `.github#1644` repairs solo-maintainer ruleset semantics. +2. Keep #160 Draft while `.github#1777` establishes reusable default-branch Scorecard posture refresh; then rebuild it as an exact-SHA thin caller rather than deleting security evidence authority. +3. Preserve #156/#157/#158 until #153 is protected, then non-force reconstruct/restack each child on fresh main and reacquire all evidence. +4. Repair #136's DNS-resolution deadline defect test-first; after #155 becomes protected truth, refresh #136 against live main and revalidate. +5. Finish #129 as one Agent Artifact Admission bounded context without absorbing quarantine or Agent/LLM orchestration. +6. Keep #88 open and architecture-blocked while contextual-orchestrator completes canonical routing/client work and publishes an immutable compatible release; then reconstruct the Wardnet consumer slice against that released contract without direct model/provider authority. +7. Drain clean supporting work (#90, #93, #111, #134, #135) only on unchanged exact heads with live evidence. +8. Reconstruct #95's valuable PostgreSQL/outbox/Coraza evidence into bounded #80/#81/#86 lanes. +9. Continue #82/#83/#84/#85 only after their declared prerequisites become protected/released truth. +10. Refresh this baseline whenever protected truth, queue topology, release state, or responsibility boundaries materially change. From 8d083f3ba4da15cbf28effc9bed0b3b2551ee627 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 13:46:03 +0900 Subject: [PATCH 40/73] docs(gaps): refresh Context Fabric exact heads --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 460dd41e..9a920b64 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -34,9 +34,9 @@ A separate central ownership gap now exists for OpenSSF Scorecard posture refres Fresh metadata still reports `develop` as the default branch for both `ContextualWisdomLab/context-graph-contracts` and `ContextualWisdomLab/enterprise-architecture-core`. Their protected `develop` tips remain `context-graph-contracts@99cb5468ba3c15c5e79688f53dee74724fae2d13` and `enterprise-architecture-core@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`. Both expose zero GitHub Releases. The accepted protected-`main` transition remains central `.github`/Context Fabric owner work rather than a Wardnet source mutation. -Context Graph Contracts root #4 is exact `03caa05e432a46227e16ecddd61ed825d1a104dd` on live `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`, a linear eight-commit advance over the previously recorded `7bbb583487016c613c78ef86479986dc2b2d83cd`. Its exact-current CI/security/supply-chain lanes remain queued or startup-failed; predecessor evidence is historical. The dependency-root release-provenance prerequisite remains Draft #25 at exact `9283d7b8ed85b97b893eeacf339524177f3ffbfc` on #19 and binds package/SBOM identities to protected source plus independently verifiable manifest-attestation evidence. Its predecessor `f184cc4d44637fc429ba5d1072838f5d1dd1dc61` acquired real hosted runners and exposed a repository-owned Ruff line-length defect plus a stale installed-wheel `next_action` expectation; current #25 repairs only those causes. Fresh exact-head runs `ci 33685788137`, `receipt-package-smoke 33685787517`, `reproducibility 33685787529`, and `supply-chain 33685787648` remain non-passing until terminal success. Draft #20 remains exact `475ce14185db697940e8219c3cda7f24d66f3ed7`; child #21 remains exact `0ca503b48371ae71815a632f8e25c7beba487fc7` on obsolete #20 ancestry and contains the structured Context Assertion/CloudEvent envelope and authority/conformance repair. The intended rebuilt order remains `#19 -> #25 -> #20 -> #21`. No immutable CGC release exists, so Wardnet must not bind production behavior to any open PR head. +Context Graph Contracts root #4 is exact `03caa05e432a46227e16ecddd61ed825d1a104dd` on live `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`, a linear eight-commit advance over the previously recorded `7bbb583487016c613c78ef86479986dc2b2d83cd`. Its exact-current CI/security/supply-chain lanes remain queued or startup-failed; predecessor evidence is historical. The dependency-root release-provenance prerequisite remains Draft #25 at exact `9283d7b8ed85b97b893eeacf339524177f3ffbfc` on #19 and binds package/SBOM identities to protected source plus independently verifiable manifest-attestation evidence. Its predecessor `f184cc4d44637fc429ba5d1072838f5d1dd1dc61` acquired real hosted runners and exposed a repository-owned Ruff line-length defect plus a stale installed-wheel `next_action` expectation; current #25 repairs only those causes. Fresh exact-head runs `ci 33685788137`, `receipt-package-smoke 33685787517`, `reproducibility 33685787529`, and `supply-chain 33685787648` remain non-passing until terminal success. Draft #20 remains exact `475ce14185db697940e8219c3cda7f24d66f3ed7`; child #21 is now exact `b0c21f907a12b07a28cf38ed165ab6530855283e` on obsolete #20 ancestry and adds the outer structured-message admission boundary on top of the Context Assertion/CloudEvent envelope and authority/conformance repair. A fresh workflow lookup for that exact child returned no runs, so it carries no current remote GREEN. The intended rebuilt order remains `#19 -> #25 -> #20 -> #21`. No immutable CGC release exists, so Wardnet must not bind production behavior to any open PR head. -Enterprise Architecture Core #39 remains Draft at exact `c063570bd9177578fa75be69defd81c99e6ba2f3`, non-force restacked on its live parent and with exact-current repository lanes queued/pre-checkout after predecessor GREEN became historical. Child #40 remains Draft/non-mergeable at exact `f383ffac89fce0e9a13ef319d732e31ca962e848` on obsolete #39 ancestry. #40 preserves the required Wardnet/quarantine authority boundary: `contextual-orchestrator -> quarantine application-service lease`, `Wardnet -> quarantine artifact-analysis evidence`, no malware verdict or artifact risk score as authoritative EA fact, and no direct database/source-copy integration. It remains fail-closed until compatible immutable CGC source-bound release evidence and qualifying quarantine release evidence exist. +Enterprise Architecture Core #39 remains Draft at exact `c063570bd9177578fa75be69defd81c99e6ba2f3`, non-force restacked on its live parent and with exact-current repository lanes queued/pre-checkout after predecessor GREEN became historical. Child #40 is now Draft at exact `7297b510b511185458c9d3cad20cad044f554e24` on obsolete #39 ancestry. That exact child is intentionally test-only RED: architecture fitness now requires `SchedulingServiceHandler` and schedule/start command HTTP behavior to move from root `runtime.py` into the Strategy & Transformation HTTP owner, while production remains unchanged until the RED executes. A fresh workflow lookup for this exact head returned zero runs, so no predecessor GREEN transfers. #40 still preserves the Wardnet/quarantine authority boundary: `contextual-orchestrator -> quarantine application-service lease`, `Wardnet -> quarantine artifact-analysis evidence`, no malware verdict or artifact risk score as authoritative EA fact, and no direct database/source-copy integration. It remains fail-closed until compatible immutable CGC source-bound release evidence and qualifying quarantine release evidence exist. Fresh release reads for Quarantine Sandbox Runtime, EgressWeave, contextual-orchestrator, Context Graph Contracts, and Enterprise Architecture Core are empty. None exposes an immutable GitHub Release usable as a Wardnet production dependency. Open sibling branches are evidence, not release authority. From 71fd5a468dd7d485a1fe053d5d843bb27ebe8f5a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 17:16:43 +0900 Subject: [PATCH 41/73] docs(gaps): refresh live control-plane and Context Fabric state --- docs/product-technical-gap-baseline.md | 61 ++++++++++++++------------ 1 file changed, 33 insertions(+), 28 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 9a920b64..441d9c46 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -16,27 +16,29 @@ The protected Wardnet tree still carries an integration debt at the optional SOC Protected/default Wardnet `main` is `cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. It contains PR #137's externally provisioned, non-optional Kubernetes administrator Secret boundary. Wardnet currently has no GitHub Release. -A fresh live read of organization ruleset `18156473` still shows `~DEFAULT_BRANCH`, `required_approving_review_count=1`, `required_reviewers=[]`, no code-owner review, and no last-push approval requirement. Review-thread resolution, central required workflows, deletion protection, and non-fast-forward protection remain enabled. The live ruleset also exposes `OrganizationAdmin/always` bypass capability; that existence is not normal merge authorization. Self-approval and bot/model-as-human approval are forbidden. +A fresh live read of organization ruleset `18156473` shows `~DEFAULT_BRANCH`, `required_approving_review_count=1`, `required_reviewers=[]`, no code-owner review, no last-push approval requirement, required review-thread resolution, deletion protection, and non-fast-forward protection. The live ruleset exposes `OrganizationAdmin/always` bypass capability; that existence is not normal merge authorization. Self-approval and bot/model-as-human approval are forbidden. -The bare approval count is structurally inconsistent with the declared solo-maintainer model. This is a central governance defect rather than a Wardnet staffing requirement. `.github#1644@79527b4bfd9ca1607b05de4f8e17ea8ee199b78a`, referencing #772 and related governance work, is the current owner-plane reconciliation candidate. Its source policy removes the impossible approval count while preserving deterministic workflow/security/coverage/SBOM/provenance/thread/branch-integrity controls. Source integration alone does not mutate live rulesets; the owner-plane apply remains separately privileged and must be proven from live settings before Wardnet treats the rule as repaired. Wardnet #155 is now an explicit post-apply canary for that owner-plane repair. +The same fresh ruleset read exposes a second central control-plane regression: its required-workflow inventory currently contains nine paths and omits `.github/workflows/codeql-pr.yml`. Scorecard and OSV remain present. `.github#1719` is the current canonical owner path for the checked-in ten-workflow contract and live-reconciliation regression; exact live Wardnet evidence and RED/GREEN acceptance were handed there. Wardnet must not compensate by weakening or duplicating CodeQL locally. + +The bare approval count is structurally inconsistent with the declared solo-maintainer model. This is a central governance defect rather than a Wardnet staffing requirement. `.github#1644@79527b4bfd9ca1607b05de4f8e17ea8ee199b78a`, referencing #772 and related governance work, is the current owner-plane reconciliation candidate. Its source policy removes the impossible approval count while preserving deterministic workflow/security/coverage/SBOM/provenance/thread/branch-integrity controls. Source integration alone does not mutate live rulesets; the owner-plane apply remains separately privileged and must be proven from live settings before Wardnet treats the rule as repaired. Wardnet #155 remains an explicit post-apply canary. Runner acquisition is also a central control-plane concern. PR #153 pins repository-owned CI/Fuzz/Scorecard runner declarations to explicit `ubuntu-24.04` and permanently rejects floating `ubuntu-latest`. Exact head `b663f9d200e5f385c7dd067d074940a02836c68e` has completed repository CI/Fuzz/Security/SAST successfully on that same source, proving the full hosted image is executable when admitted. Later exact-head waves across Wardnet, Context Graph Contracts, and EA Core again remained pre-checkout with `runner_id=0`. `.github#712` owns acquisition/capacity/policy-routing and evidence-identity repair. -PR #155 provides the clearest current-PR evidence. Exact head `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` has terminal repository-owned CI/Fuzz/Security/SAST and resolved inline review threads. Its correct current-PR required OpenCode run is `33590351182`: bootstrap job `100122902000` completed; `coverage-source-tree` job `100272722468` completed successfully on hosted runner `1001629411`; the downstream `coverage-evidence` job `100479589911` remains queued with `runner_id=0`, an empty runner name, and zero steps. The same source SHA was previously used by PR #138, whose older required run is a different PR identity. Central required evidence must bind at least `(repository, pr_number, head_sha, workflow/check lane)`; wrong-PR same-SHA evidence must never be promoted to the current PR. +PR #155 provides the clearest current-PR evidence. Exact head `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` has terminal repository-owned CI/Fuzz/Security/SAST and resolved inline review threads. Its correct current-PR required OpenCode run is `33590351182`: bootstrap job `100122902000` completed; `coverage-source-tree` job `100272722468` completed successfully on hosted runner `1001629411`; the downstream `coverage-evidence` job `100479589911` remains queued with `runner_id=0`, an empty runner name, and zero steps. The same source SHA was previously used by PR #138, whose older required run is a different PR identity. Central required evidence must bind at least `(repository, pr_number, head_sha, workflow/check lane)`; wrong-PR same-SHA evidence must never be promoted to the current PR. Fresh runner evidence has been handed to `.github#712`; no leaf-source churn or routine bypass is justified. A separate #153 reproduction already proved the same identity class: required-workflow run `33550235908` / job `100100529632` was commit-scoped to `b663f9d…` but its durable payload was `PR_NUMBER=147`. The same clean SHA is now #153's head, so commit-only evidence lookup can surface the wrong PR's result. Do not manufacture new leaf SHAs to escape that contamination. GitHub's hosted-runner contract does not make `ubuntu-slim` an equivalent workaround: it is a constrained container runner intended for lightweight automation. A successful slim job is an admission canary, not justification to downgrade Wardnet CI/Fuzz/CodeQL/coverage workloads. -A separate central ownership gap now exists for OpenSSF Scorecard posture refresh. Wardnet #160 attempted to delete the repository's default-branch/scheduled Scorecard workflow while the central reusable `scorecard-pr.yml` remains PR-only. That would stop authoritative default-branch SARIF refresh. #160 is therefore Draft with its review finding intentionally unresolved, and `.github#1777` owns the reusable default-branch Scorecard workflow plus exact-SHA thin-caller prerequisite. Do not merge deletion-only #160 or treat PR-only Scorecard evidence as equivalent. +A separate central ownership gap exists for OpenSSF Scorecard posture refresh. Wardnet #160 attempted to delete the repository's default-branch/scheduled Scorecard workflow while the central reusable `scorecard-pr.yml` remains PR-only. That would stop authoritative default-branch SARIF refresh. #160 is therefore Draft with its review finding intentionally unresolved, and `.github#1777` owns the reusable default-branch Scorecard workflow plus exact-SHA thin-caller prerequisite. Do not merge deletion-only #160 or treat PR-only Scorecard evidence as equivalent. ## Context Fabric live boundary Fresh metadata still reports `develop` as the default branch for both `ContextualWisdomLab/context-graph-contracts` and `ContextualWisdomLab/enterprise-architecture-core`. Their protected `develop` tips remain `context-graph-contracts@99cb5468ba3c15c5e79688f53dee74724fae2d13` and `enterprise-architecture-core@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`. Both expose zero GitHub Releases. The accepted protected-`main` transition remains central `.github`/Context Fabric owner work rather than a Wardnet source mutation. -Context Graph Contracts root #4 is exact `03caa05e432a46227e16ecddd61ed825d1a104dd` on live `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`, a linear eight-commit advance over the previously recorded `7bbb583487016c613c78ef86479986dc2b2d83cd`. Its exact-current CI/security/supply-chain lanes remain queued or startup-failed; predecessor evidence is historical. The dependency-root release-provenance prerequisite remains Draft #25 at exact `9283d7b8ed85b97b893eeacf339524177f3ffbfc` on #19 and binds package/SBOM identities to protected source plus independently verifiable manifest-attestation evidence. Its predecessor `f184cc4d44637fc429ba5d1072838f5d1dd1dc61` acquired real hosted runners and exposed a repository-owned Ruff line-length defect plus a stale installed-wheel `next_action` expectation; current #25 repairs only those causes. Fresh exact-head runs `ci 33685788137`, `receipt-package-smoke 33685787517`, `reproducibility 33685787529`, and `supply-chain 33685787648` remain non-passing until terminal success. Draft #20 remains exact `475ce14185db697940e8219c3cda7f24d66f3ed7`; child #21 is now exact `b0c21f907a12b07a28cf38ed165ab6530855283e` on obsolete #20 ancestry and adds the outer structured-message admission boundary on top of the Context Assertion/CloudEvent envelope and authority/conformance repair. A fresh workflow lookup for that exact child returned no runs, so it carries no current remote GREEN. The intended rebuilt order remains `#19 -> #25 -> #20 -> #21`. No immutable CGC release exists, so Wardnet must not bind production behavior to any open PR head. +Context Graph Contracts release-provenance prerequisite #25 is Draft at exact `187f45927e697cfad9ac5b2523dfd86b695aa072` directly after #19 exact `db392d8aac550d88986a14011956e5e2e7fce677`. It binds package/SBOM identities to protected source plus independently verifiable release-source evidence and has repaired its repository-owned floating-runner selector by pinning the required workflows to `ubuntu-24.04`. Current exact-head runs `ci 33730255529`, `receipt-package-smoke 33730255606`, `reproducibility 33730255596`, and `supply-chain 33730255626` remain queued with no assigned runner, so the selector repair is source evidence rather than terminal hosted GREEN. #20 remains exact `475ce14185db697940e8219c3cda7f24d66f3ed7`; child #21 remains exact `b0c21f907a12b07a28cf38ed165ab6530855283e` on obsolete #20 ancestry and has no exact-current hosted GREEN. The intended rebuild order remains `#19 -> #25 -> #20 -> #21`. No immutable CGC release exists, so Wardnet must not bind production behavior to any open PR head. -Enterprise Architecture Core #39 remains Draft at exact `c063570bd9177578fa75be69defd81c99e6ba2f3`, non-force restacked on its live parent and with exact-current repository lanes queued/pre-checkout after predecessor GREEN became historical. Child #40 is now Draft at exact `7297b510b511185458c9d3cad20cad044f554e24` on obsolete #39 ancestry. That exact child is intentionally test-only RED: architecture fitness now requires `SchedulingServiceHandler` and schedule/start command HTTP behavior to move from root `runtime.py` into the Strategy & Transformation HTTP owner, while production remains unchanged until the RED executes. A fresh workflow lookup for this exact head returned zero runs, so no predecessor GREEN transfers. #40 still preserves the Wardnet/quarantine authority boundary: `contextual-orchestrator -> quarantine application-service lease`, `Wardnet -> quarantine artifact-analysis evidence`, no malware verdict or artifact risk score as authoritative EA fact, and no direct database/source-copy integration. It remains fail-closed until compatible immutable CGC source-bound release evidence and qualifying quarantine release evidence exist. +Enterprise Architecture Core #40 is Draft/non-mergeable at exact `fadf27f0df1a865261c15dc64de2a9dc350e02d4` on diverged parent/base `chatgpt/ddd-context-fitness-v1@b44635b686c66e78ebd7f1218343a933a510cd89`. Its DDD repair is now source-GREEN: Strategy & Transformation owns `SchedulingServiceHandler` and root `runtime.py` composes that bounded adapter instead of defining a duplicate handler. The branch also repairs the CGC consumer trust boundary: release admission requires semantic conformance plus independently authenticated source-bound release evidence, and the consumer accepts the producer's provider-valid wheel/sdist grammar rather than inventing a narrower EA-local package convention. No current-head hosted run exists, and predecessor evidence does not transfer. #40 preserves the Wardnet/quarantine authority boundary and remains fail closed until compatible immutable CGC and quarantine release evidence exists. Fresh release reads for Quarantine Sandbox Runtime, EgressWeave, contextual-orchestrator, Context Graph Contracts, and Enterprise Architecture Core are empty. None exposes an immutable GitHub Release usable as a Wardnet production dependency. Open sibling branches are evidence, not release authority. @@ -44,33 +46,33 @@ Fresh release reads for Quarantine Sandbox Runtime, EgressWeave, contextual-orch Fresh inventory contains 26 open PRs: -`#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #153, #154, #155, #156, #157, #158, #159, #160`. +`#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #153, #155, #156, #157, #158, #159, #160, #162`. -PR #137 is protected-main truth. Predecessor checks, reviews, approvals, and artifacts do not transfer after head/base movement. +PR #137 is protected-main truth. PR #154 is closed without merge after its effective delta was reverted to zero; issue #161 and Draft #162 now own the corrected commercial-authority separation. Predecessor checks, reviews, approvals, and artifacts do not transfer after head/base movement. | PR | Exact head | State | Current decision | | --- | --- | --- | --- | -| #77 Rust toolchain | `2f96565b9452ea49627b28f7ae380e07b68af115` | Ready; auto-merge armed | The formerly stale Rust `1.97.1` pin was advanced by ordinary forward commits to current stable `1.98.0` and CLAUDE guidance was made code-current. The existing contract remains version-agnostic and requires an exact three-component numeric pin, CI consumption from `rust-toolchain.toml`, required components, Docker consumption and weekly Dependabot reviewability. Exact-current CI/Security/SAST/Scorecard/OSV are queued; no predecessor `1.97.1` result transfers. | -| #88 CO ownership repair | `98a935e4b058d0500d520425b8ebf6ff4106aa1b` | Draft; mergeable false; RED | The direct LiteLLM virtual-key/provider/model proxy conflicts with contextual-orchestrator ownership. Preserve unique fail-closed credential grammar, header minimization, streaming, zero-upstream-hit, property/fuzz and RFC 6750 evidence; do not close or merge it. GitHub metadata now correctly records Draft. Rework valid Wardnet-owned gateway/admission deltas behind a released CO ACL after CO publishes an immutable compatible client/schema/Agent. | -| #129 Agent Artifact Admission | `85f0f6542a13bfdcc05024b51423851b33ae2ed8` | Draft, mergeable | Current source additionally closes pnpmfile hook and Cargo build-variant authority gaps while preserving package-manager executable-family, indirect-source/root/index/workspace/config/TLS-trust defenses. Current inline review inventory has no unresolved source finding. Exact-head CI/Fuzz/Security/SAST/OSV/Scorecard are queued; keep Draft until terminal current-head evidence exists. Retrieval-byte/provenance verification and hostile execution stay executor/quarantine-owned. | -| #136 Network-Egress | `3cb1047416c3aa7fa8eb352b842cc55ad8c21b19` | Draft, executable RED pending source fix | Shared structural URL validation, resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, response hop filtering, and architecture fitness are present. RED `f408500d8aeb4beb386caa48a7525508d59da193` requires one end-to-end deadline across manual DNS and remaining HTTP work; current head fixes only the rustfmt defect that prevented that RED harness from executing. Production deadline propagation plus a deterministic stalled-resolution runtime regression remain required. Exact-current CI is queued before source execution and CodeQL is startup-failed. #155 must become protected truth before final integration. | -| #140 Runtime Configuration | `9389a2d63f0875f688de5ef3adff1ce6b54e1ab1` | Ready; auto-merge armed | Review-derived environment-race, recursive architecture-fitness, bootstrap-authority and credential-path split defects are repaired/resolved. The exact head repaired a real nested-fitness test regression without adding a lockfile dependency. Current CodeQL is startup-failed and repository/central lanes remain queued; Credential Registry remains secret authority. | -| #141 CodeQL uploader | `fea3796a723080068cdc02e064065d6d53eeb3e0` | Ready; auto-merge armed | Immutable `github/codeql-action/upload-sarif` pin advances to current v4.37.9; repository CI/Security/SAST are terminal GREEN on this unchanged head. Normal central/governance evidence still applies. | -| #144 Kubernetes path/public docs | `b07e4d21057df4dd4e706b584e5fad00338f20b6` | Ready; auto-merge armed | Hardened manifest source moves to `deploy/kubernetes/wardnet.yaml` without renaming live Kubernetes resources. Review-driven path/link regressions are resolved. Current exact-head CI/Security/SAST/Fuzz/Scorecard/OSV remain queued and CodeQL is startup-failed; the older body SHA is historical. | +| #77 Rust toolchain | `2f96565b9452ea49627b28f7ae380e07b68af115` | Ready; auto-merge armed | The formerly stale Rust `1.97.1` pin was advanced by ordinary forward commits to current stable `1.98.0` and CLAUDE guidance was made code-current. Exact-current CI/Security/SAST/Scorecard/OSV are queued; no predecessor result transfers. | +| #88 CO ownership repair | `98a935e4b058d0500d520425b8ebf6ff4106aa1b` | Architecture-blocked preservation lane | The direct LiteLLM virtual-key/provider/model proxy conflicts with contextual-orchestrator ownership. Preserve unique fail-closed credential grammar, header minimization, streaming, zero-upstream-hit, property/fuzz and RFC 6750 evidence; do not merge it. Reconstruct valid Wardnet-owned gateway/admission deltas behind a released CO ACL after CO publishes an immutable compatible client/schema/Agent. | +| #129 Agent Artifact Admission | `85f0f6542a13bfdcc05024b51423851b33ae2ed8` | Draft, mergeable | Current source closes pnpmfile hook and Cargo build-variant authority gaps while preserving package-manager executable-family, indirect-source/root/index/workspace/config/TLS-trust defenses. Current inline review inventory has no unresolved source finding. Exact-head workflows have materialized but remain queued/pre-execution; keep Draft until terminal evidence exists. Retrieval-byte/provenance verification and hostile execution stay executor/quarantine-owned. | +| #136 Network-Egress | `3cb1047416c3aa7fa8eb352b842cc55ad8c21b19` | Draft, executable RED pending source fix | Shared structural URL validation, resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, response hop filtering, and architecture fitness are present. RED `f408500d8aeb4beb386caa48a7525508d59da193` requires one end-to-end deadline across manual DNS and remaining HTTP work; production deadline propagation plus a deterministic stalled-resolution runtime regression remain required. Exact-current CI is queued before source execution and CodeQL is startup-failed. #155 must become protected truth before final integration. | +| #140 Runtime Configuration | `9389a2d63f0875f688de5ef3adff1ce6b54e1ab1` | Ready; auto-merge armed | Review-derived environment-race, recursive architecture-fitness, bootstrap-authority and credential-path split defects are repaired/resolved. Current CodeQL is startup-failed and repository/central lanes remain queued; Credential Registry remains secret authority. | +| #141 CodeQL uploader | `fea3796a723080068cdc02e064065d6d53eeb3e0` | Ready; auto-merge armed | Immutable `github/codeql-action/upload-sarif` pin advances to v4.37.9; normal central/governance evidence still applies. | +| #144 Kubernetes path/public docs | `b07e4d21057df4dd4e706b584e5fad00338f20b6` | Ready; auto-merge armed | Hardened manifest source moves to `deploy/kubernetes/wardnet.yaml` without renaming live Kubernetes resources. Current exact-head repository/security lanes remain queued and CodeQL is startup-failed. | | #153 explicit hosted runner | `b663f9d200e5f385c7dd067d074940a02836c68e` | Ready, clean stack root; auto-merge armed | Same-source repository CI/Fuzz/Security/SAST have terminal GREEN evidence. Current central runner/review/governance evidence is non-terminal, and stale same-SHA required evidence is proven capable of referring to superseded PR #147 rather than #153. A fresh #153-bound verdict is required; `ubuntu-slim` is only an acquisition canary. | -| #154 commercial readiness target | `41098f76c8a823c20ba0e319c38cf24acb470346` | Ready; auto-merge armed | Aligns the shipped readiness threshold and buyer evidence to the 20B KRW target without rewriting historical plan artifacts. Repository-owned CI/Fuzz/Security/SAST are terminal GREEN on the unchanged exact head; then-live central/governance evidence still applies. | -| #155 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready, main-based; auto-merge armed | Non-loopback startup fails closed without write-capable admin credentials; current review threads are resolved. Repository-owned CI/Fuzz/Security/SAST are terminal GREEN. Current-PR required OpenCode bootstrap and coverage source-tree materialization are terminal successful; downstream `coverage-evidence` job `100479589911` remains pre-checkout queued with `runner_id=0`. Predecessor #138 evidence does not transfer merely because the source SHA is identical. Issue #78 closes only after protected merge. | +| #155 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready, main-based; auto-merge armed | Non-loopback startup fails closed without write-capable admin credentials; current review threads are resolved. Repository-owned CI/Fuzz/Security/SAST are terminal GREEN. Current-PR required OpenCode bootstrap and coverage source-tree are terminal successful; downstream `coverage-evidence` job `100479589911` remains pre-checkout queued with `runner_id=0`. Issue #78 closes only after protected merge. | | #156 operability evidence | `76037b8ae206ace8dab0e6622dfc9fc88c57deb3` | Draft, child of #153 | Preserve support-bundle/readiness evidence; reconstruct/restack on fresh protected main after #153 integrates, then regenerate all base-sensitive evidence. | | #157 trusted proxy | `65a2b7fbf2827f69ae1aa288696b6c5630af28c4` | Draft, child of #153 | Preserve fail-closed forwarded-IP attribution. Reconstruct/restack after #153 protected merge. | | #158 readiness metrics | `387a447f856093d02116dfadcf2c4a4a63c6d3ba` | Draft, child of #153 | Preserve readiness gauges using existing readiness/KPI authority. Reconstruct/restack after #153 protected merge. | -| #159 CI concurrency | `89176e2cc57088e4d772de9b1686ab89a3e69aeb` | Ready; auto-merge armed | PR runs use PR-number concurrency so new heads supersede obsolete PR executions; push runs use unique run IDs so pending protected-main commits cannot replace each other. Two review findings are resolved. Current CI/Security/SAST/Scorecard/OSV remain queued and CodeQL ended startup failure before useful source execution; `.github#712` owns the organization control-plane class. | -| #160 Scorecard deduplication | `b03037d4648a6282cb4029dff062ed7b55ff980a` | Draft; unresolved valid review finding | Deleting the leaf workflow now would remove default-branch push/scheduled SARIF refresh because central `scorecard-pr.yml` is PR-only. `.github#1777` is the canonical prerequisite for a reusable default-branch posture workflow and exact-SHA thin caller. Keep Draft and do not resolve the finding until that central repair integrates and this PR is reconstructed/revalidated. | +| #159 CI concurrency | `89176e2cc57088e4d772de9b1686ab89a3e69aeb` | Ready; auto-merge armed | PR runs use PR-number concurrency so new heads supersede obsolete PR executions; push runs use unique run IDs so pending protected-main commits cannot replace one another. Current repository/central evidence remains queued/startup-failing and `.github#712` owns the organization control-plane class. | +| #160 Scorecard deduplication | `b03037d4648a6282cb4029dff062ed7b55ff980a` | Draft; unresolved valid review finding | Deleting the leaf workflow now would remove default-branch push/scheduled SARIF refresh because central `scorecard-pr.yml` is PR-only. `.github#1777` is the canonical prerequisite. Keep Draft and do not resolve the finding until that central repair integrates and this PR is reconstructed/revalidated. | +| #162 commercial authority separation | `3b5aa81664ed8f2fd8b29438418be920f43f93e0` | Draft, mergeable | Separates the standing USD 20 billion software-sale quality ambition from the customer-contract readiness predicate. Runtime `TARGET_SALE_VALUE_KRW` remains 2B KRW; the canonical customer/readiness and USD 20B quality documents are distinct, and the old misleading path is retained only as a compatibility shim. Keep Draft until exact-head repository/security/coverage/review/governance evidence is terminal-valid. | Auto-merge state, where enabled, is state only, not protected truth or transferable evidence. A changed head/base must reacquire the then-live policy evidence. ## Open issues and production order -Fresh issue inventory remains `#11, #38, #74, #75, #78, #79, #80, #81, #82, #83, #84, #85, #86, #87, #89, #128, #139`. +Fresh issue inventory is `#11, #38, #74, #75, #78, #79, #80, #81, #82, #83, #84, #85, #86, #87, #89, #128, #139, #161`. 1. Immediate exposure controls: #78 through #155, #79 through #136 plus remaining allowlist/evidence/deadline work, #11 real attack-path CI, and #75 through #144. 2. Security admission: #128 through #129, without absorbing quarantine execution authority. @@ -78,8 +80,8 @@ Fresh issue inventory remains `#11, #38, #74, #75, #78, #79, #80, #81, #82, #83, 4. Durable authority/effects: #80 PostgreSQL production authority and tenant isolation, then #81 transactional outbox/leased workers. 5. Identity/overload: #82 Keyverse-backed authorization/approval and #83 distributed/global admission. #157 is only the trusted-network attribution slice. 6. Proven security engines: #86 Coraza/CRS and Suricata with detection and false-positive evidence. -7. Immutable delivery/operation: #84 signed artifact/SBOM/provenance/rollback, then #85 telemetry/SLO/incident/restore evidence. -8. Supporting correctness: #74 deterministic persistence fault testing, #77 pinned compiler, #139 coherent runtime configuration, #153 deterministic hosted-runner selection, #159 repository-local concurrency, #154 the 20B KRW commercial-readiness contract, and #160 only after `.github#1777` establishes central default-branch Scorecard authority. +7. Immutable delivery/operation: #84 signed artifact/SBOM/provenance/rollback, then #85 telemetry/SLO/incident/restore evidence and #87 final production-readiness closure on one immutable release identity. +8. Supporting correctness: #74 deterministic persistence fault testing, #77 pinned compiler, #139 coherent runtime configuration, #153 deterministic hosted-runner selection, #159 repository-local concurrency, and #161/#162 separation of the USD 20B software-sale quality bar from 2B KRW customer-contract readiness. #160 follows only after `.github#1777` establishes central default-branch Scorecard authority. Close an issue only after its owning protected merge satisfies the issue acceptance contract on current evidence. @@ -95,6 +97,8 @@ The protected SOC LLM request builder and #88 show the same ownership drift from PR #95 remains too broad to serve as the production integration vehicle. Preserve its unique PostgreSQL/outbox/Coraza tests and evidence while reconstructing bounded #80/#81/#86 successor work instead of merging a cross-context god-PR. +The commercial product contract now has a dedicated correction path rather than encoding the USD 20B quality ambition as tenant pricing. #162 keeps the existing 2B KRW customer-readiness predicate separate from a buyer-visible USD 20B quality bar spanning security, operability, supply chain, release, integration, supportability, performance, and governance. + ## Research and standards grounding Standards constrain implementation and evidence; they do not prove controls are shipped. @@ -114,13 +118,14 @@ No release is authorized. Wardnet, Context Graph Contracts, EA Core, contextual- ## Next execution order -1. Continue #153/#155/#144/#154/#159/#140/#141/#77 through current exact-head gates while `.github#712` repairs runner/evidence identity and `.github#1644` repairs solo-maintainer ruleset semantics. +1. Continue #153/#155/#144/#159/#140/#141/#77 through current exact-head gates while `.github#712` repairs runner/evidence identity, `.github#1644` repairs solo-maintainer ruleset semantics, and `.github#1719` restores/enforces the full CodeQL/Scorecard/OSV required-workflow inventory. 2. Keep #160 Draft while `.github#1777` establishes reusable default-branch Scorecard posture refresh; then rebuild it as an exact-SHA thin caller rather than deleting security evidence authority. 3. Preserve #156/#157/#158 until #153 is protected, then non-force reconstruct/restack each child on fresh main and reacquire all evidence. -4. Repair #136's DNS-resolution deadline defect test-first; after #155 becomes protected truth, refresh #136 against live main and revalidate. +4. Repair #136's DNS-resolution deadline defect test-first with one shared operation deadline and a deterministic stalled-resolution runtime regression; after #155 becomes protected truth, refresh #136 against live main and revalidate. 5. Finish #129 as one Agent Artifact Admission bounded context without absorbing quarantine or Agent/LLM orchestration. 6. Keep #88 open and architecture-blocked while contextual-orchestrator completes canonical routing/client work and publishes an immutable compatible release; then reconstruct the Wardnet consumer slice against that released contract without direct model/provider authority. -7. Drain clean supporting work (#90, #93, #111, #134, #135) only on unchanged exact heads with live evidence. -8. Reconstruct #95's valuable PostgreSQL/outbox/Coraza evidence into bounded #80/#81/#86 lanes. -9. Continue #82/#83/#84/#85 only after their declared prerequisites become protected/released truth. -10. Refresh this baseline whenever protected truth, queue topology, release state, or responsibility boundaries materially change. +7. Keep #162 Draft until its exact-head product-contract regression and then-live deterministic/security/coverage/review/governance evidence are terminal-valid; do not restore the closed #154 KRW-20B remapping. +8. Drain clean supporting work (#90, #93, #111, #134, #135) only on unchanged exact heads with live evidence. +9. Reconstruct #95's valuable PostgreSQL/outbox/Coraza evidence into bounded #80/#81/#86 lanes. +10. Continue #82/#83/#84/#85 only after their declared prerequisites become protected/released truth; close #87 only against one immutable protected release candidate satisfying the full production gate. +11. Refresh this baseline whenever protected truth, queue topology, release state, or responsibility boundaries materially change. From 0cdbd1417db0dc1d000ecea42b4b8fe710e99125 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 17:20:10 +0900 Subject: [PATCH 42/73] docs(gaps): cover every open delivery lane --- docs/product-technical-gap-baseline.md | 28 ++++++++++++++++++-------- 1 file changed, 20 insertions(+), 8 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 441d9c46..b0eeaaf2 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -50,11 +50,24 @@ Fresh inventory contains 26 open PRs: PR #137 is protected-main truth. PR #154 is closed without merge after its effective delta was reverted to zero; issue #161 and Draft #162 now own the corrected commercial-authority separation. Predecessor checks, reviews, approvals, and artifacts do not transfer after head/base movement. +The table intentionally covers every open PR so queue work cannot disappear merely because it is not currently on the shortest merge path. + | PR | Exact head | State | Current decision | | --- | --- | --- | --- | -| #77 Rust toolchain | `2f96565b9452ea49627b28f7ae380e07b68af115` | Ready; auto-merge armed | The formerly stale Rust `1.97.1` pin was advanced by ordinary forward commits to current stable `1.98.0` and CLAUDE guidance was made code-current. Exact-current CI/Security/SAST/Scorecard/OSV are queued; no predecessor result transfers. | -| #88 CO ownership repair | `98a935e4b058d0500d520425b8ebf6ff4106aa1b` | Architecture-blocked preservation lane | The direct LiteLLM virtual-key/provider/model proxy conflicts with contextual-orchestrator ownership. Preserve unique fail-closed credential grammar, header minimization, streaming, zero-upstream-hit, property/fuzz and RFC 6750 evidence; do not merge it. Reconstruct valid Wardnet-owned gateway/admission deltas behind a released CO ACL after CO publishes an immutable compatible client/schema/Agent. | +| #77 Rust toolchain | `2f96565b9452ea49627b28f7ae380e07b68af115` | Ready; auto-merge armed | The formerly stale Rust `1.97.1` pin was advanced by ordinary forward commits to current stable `1.98.0`. Exact-current CI/Security/SAST/Scorecard/OSV are queued; no predecessor result transfers. | +| #88 CO ownership repair | `98a935e4b058d0500d520425b8ebf6ff4106aa1b` | Architecture-blocked preservation lane | The direct LiteLLM virtual-key/provider/model proxy conflicts with contextual-orchestrator ownership. Preserve unique fail-closed credential grammar, header minimization, streaming, zero-upstream-hit, property/fuzz and RFC 6750 evidence; reconstruct valid Wardnet-owned gateway/admission deltas behind a released CO ACL instead of merging this shape. | +| #90 SIEM/OpenTelemetry export | `2d251183c41f49b07d443ff15fe9e54472d90f63` | Ready metadata; non-mergeable | Preserve the bounded OCSF/OTLP/RFC 5424 conversion and redaction evidence. Repair the stale/non-mergeable integration lineage non-force against current protected main and keep durable delivery/collector authentication/outbox ownership in #81/#85 rather than expanding this exporter. | +| #93 deterministic persistence faults | `e8a2b722c3c7dcbe0569130ccf937c6f2f755c12` | Ready, mergeable | The unique #74 delta is deterministic write/rename fault injection plus real-filesystem happy-path coverage. Reacquire exact-head gates on the synchronized candidate and merge only through ordinary protected policy. | +| #95 Coraza / broad production stack | `304f053013a76f11a03b5ed9b058ae1712f6ea12` | Ready metadata; non-mergeable and over-broad | Do not integrate this cross-context aggregate as-is. Preserve its unique PostgreSQL/outbox/Coraza/release tests and evidence, then transfer them into bounded #80/#81/#86/#84 successors before any retirement; wrong-base/non-mergeable state is a repair finding, not a Close reason. | +| #111 accepted ADR consolidation | `84cc6f6cee4bd29e8e9991a2646081c4febaca40` | Ready, mergeable | Current architecture text distinguishes protected truth from active-PR work and retains APA-backed decisions. Revalidate exact-head repository/security gates and ensure no feature-branch behavior is promoted to Accepted before ordinary merge. | +| #112 gateway route lifecycle | `bab3c72bb72e041ad494932ae07b0fb2401991ec` | Ready metadata; non-mergeable | Preserve item GET/conditional PUT/DELETE, ETag/If-Match, RBAC, persistence/audit and OpenAPI delta. Reconstruct non-force on current protected truth, preferably after #155 auth becomes protected, and reacquire attack/security/current-head evidence. | +| #114 product rename aggregate | `95da92339f21236326cdf4fb4aec5c7d0f909406` | Ready metadata; non-mergeable | The broad historical rename mixes package/runtime/deployment/resource migrations. Preserve still-unique compatibility/migration delta, but repair by bounded successors against current protected naming and #144 path migration rather than merging stale in-cluster renames wholesale. | +| #115 official threat-feed refresh | `aad8224ab664861b540bdf818e9580470cbe89fb` | Ready metadata; non-mergeable | Preserve source-registry, conditional refresh, last-known-good, attribution/terms and credential-boundary behavior. Reconstruct against current main after the shared Network-Egress policy is protected so feed I/O cannot retain a competing destination-security path. | +| #127 admin-console accessibility | `4e160077a6b163b03af65dfd16ac2a722dcbfbae` | Ready, mergeable; UI evidence incomplete | Source accessibility markup/tests are not sufficient release evidence. Add production-like browser E2E for keyboard/focus, accessible name/description, live-region semantics, responsive layouts, and loading/error/permission states under WCAG 2.2 AA before merge. | | #129 Agent Artifact Admission | `85f0f6542a13bfdcc05024b51423851b33ae2ed8` | Draft, mergeable | Current source closes pnpmfile hook and Cargo build-variant authority gaps while preserving package-manager executable-family, indirect-source/root/index/workspace/config/TLS-trust defenses. Current inline review inventory has no unresolved source finding. Exact-head workflows have materialized but remain queued/pre-execution; keep Draft until terminal evidence exists. Retrieval-byte/provenance verification and hostile execution stay executor/quarantine-owned. | +| #130 product/technical gap baseline | `71fd5a468dd7d485a1fe053d5d843bb27ebe8f5a` | Draft, mergeable | This document is the current owning snapshot. Its new exact-head repository/security runs are queued; predecessor review/check evidence does not transfer. Keep Draft while live state changes and until current review findings plus then-live gates are resolved. | +| #134 support-bundle regression | `2b236057d6811cb7ca2ff4f01038796128f4fb6a` | Ready, mergeable | Test-only hardening binds support-bundle counts to KPI/evidence surfaces and rejects administrator-secret leakage. Fresh exact-head repository/security runs remain non-passing until terminal; preserve the narrow test-only scope. | +| #135 bounded local limiter | `e9547c556f7c5aeb244371035675a50ce5c82e6f` | Ready, mergeable | Bound attacker-controlled local limiter cardinality/TTL and retain stable 429 evidence while #83 keeps distributed/global authority separate. The PR body still cites an earlier synchronization commit; this exact head is authoritative and must reacquire current-head gates before merge. | | #136 Network-Egress | `3cb1047416c3aa7fa8eb352b842cc55ad8c21b19` | Draft, executable RED pending source fix | Shared structural URL validation, resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, response hop filtering, and architecture fitness are present. RED `f408500d8aeb4beb386caa48a7525508d59da193` requires one end-to-end deadline across manual DNS and remaining HTTP work; production deadline propagation plus a deterministic stalled-resolution runtime regression remain required. Exact-current CI is queued before source execution and CodeQL is startup-failed. #155 must become protected truth before final integration. | | #140 Runtime Configuration | `9389a2d63f0875f688de5ef3adff1ce6b54e1ab1` | Ready; auto-merge armed | Review-derived environment-race, recursive architecture-fitness, bootstrap-authority and credential-path split defects are repaired/resolved. Current CodeQL is startup-failed and repository/central lanes remain queued; Credential Registry remains secret authority. | | #141 CodeQL uploader | `fea3796a723080068cdc02e064065d6d53eeb3e0` | Ready; auto-merge armed | Immutable `github/codeql-action/upload-sarif` pin advances to v4.37.9; normal central/governance evidence still applies. | @@ -78,7 +91,7 @@ Fresh issue inventory is `#11, #38, #74, #75, #78, #79, #80, #81, #82, #83, #84, 2. Security admission: #128 through #129, without absorbing quarantine execution authority. 3. LLM ownership repair: keep #88 open but non-integrable and architecture-RED until contextual-orchestrator ships the released provider-neutral contract; then preserve only Wardnet-owned credential/admission/streaming defenses and remove direct LiteLLM/provider/model authority. 4. Durable authority/effects: #80 PostgreSQL production authority and tenant isolation, then #81 transactional outbox/leased workers. -5. Identity/overload: #82 Keyverse-backed authorization/approval and #83 distributed/global admission. #157 is only the trusted-network attribution slice. +5. Identity/overload: #82 Keyverse-backed authorization/approval and #83 distributed/global admission. #135 and #157 are bounded local/network-attribution slices rather than a second cluster authority. 6. Proven security engines: #86 Coraza/CRS and Suricata with detection and false-positive evidence. 7. Immutable delivery/operation: #84 signed artifact/SBOM/provenance/rollback, then #85 telemetry/SLO/incident/restore evidence and #87 final production-readiness closure on one immutable release identity. 8. Supporting correctness: #74 deterministic persistence fault testing, #77 pinned compiler, #139 coherent runtime configuration, #153 deterministic hosted-runner selection, #159 repository-local concurrency, and #161/#162 separation of the USD 20B software-sale quality bar from 2B KRW customer-contract readiness. #160 follows only after `.github#1777` establishes central default-branch Scorecard authority. @@ -105,7 +118,7 @@ Standards constrain implementation and evidence; they do not prove controls are - Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). *Zero trust architecture* (NIST SP 800-207). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-207. - Souppaya, M., Scarfone, K., & Dodson, D. (2022). *Secure Software Development Framework (SSDF) version 1.1* (NIST SP 800-218). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-218. -- OWASP Foundation. (2025). *Application Security Verification Standard 5.0.0*. https://owasp.org/www-project-application-security-verification-standard/. +- OWASP Foundation. (2025). *Application Security Verification Standard 5.0.0*. https://owasp.org/www-project-application-security-standard/. - Soldani, J., Tamburri, D. A., & van den Heuvel, W.-J. (2018). The pains and gains of microservices: A systematic grey literature review. *Journal of Systems and Software, 146*, 215–232. https://doi.org/10.1016/j.jss.2018.09.082. The microservices evidence is used only to resist decomposition-by-file-size: deployable boundaries require responsibility, scaling, transaction, isolation, or reuse evidence that justifies their operating cost. @@ -125,7 +138,6 @@ No release is authorized. Wardnet, Context Graph Contracts, EA Core, contextual- 5. Finish #129 as one Agent Artifact Admission bounded context without absorbing quarantine or Agent/LLM orchestration. 6. Keep #88 open and architecture-blocked while contextual-orchestrator completes canonical routing/client work and publishes an immutable compatible release; then reconstruct the Wardnet consumer slice against that released contract without direct model/provider authority. 7. Keep #162 Draft until its exact-head product-contract regression and then-live deterministic/security/coverage/review/governance evidence are terminal-valid; do not restore the closed #154 KRW-20B remapping. -8. Drain clean supporting work (#90, #93, #111, #134, #135) only on unchanged exact heads with live evidence. -9. Reconstruct #95's valuable PostgreSQL/outbox/Coraza evidence into bounded #80/#81/#86 lanes. -10. Continue #82/#83/#84/#85 only after their declared prerequisites become protected/released truth; close #87 only against one immutable protected release candidate satisfying the full production gate. -11. Refresh this baseline whenever protected truth, queue topology, release state, or responsibility boundaries materially change. +8. Repair/restack every remaining open lane rather than letting it disappear from the queue: #90/#93/#111/#127/#134/#135 can be drained once exact-head evidence is current; #112/#114/#115 require non-force reconstruction against current protected truth; #95 must transfer its unique cross-context evidence into bounded successors before retirement. +9. Continue #82/#83/#84/#85 only after their declared prerequisites become protected/released truth; close #87 only against one immutable protected release candidate satisfying the full production gate. +10. Refresh this baseline whenever protected truth, queue topology, release state, or responsibility boundaries materially change. From da8cdbcf1aa785a7fb3e2df413aae4932800487e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 17:21:44 +0900 Subject: [PATCH 43/73] docs(gaps): make baseline self-consistent --- docs/product-technical-gap-baseline.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index b0eeaaf2..3d9b7d43 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -50,7 +50,7 @@ Fresh inventory contains 26 open PRs: PR #137 is protected-main truth. PR #154 is closed without merge after its effective delta was reverted to zero; issue #161 and Draft #162 now own the corrected commercial-authority separation. Predecessor checks, reviews, approvals, and artifacts do not transfer after head/base movement. -The table intentionally covers every open PR so queue work cannot disappear merely because it is not currently on the shortest merge path. +The table intentionally covers every open PR so queue work cannot disappear merely because it is not currently on the shortest merge path. The #130 head cell is self-referential by construction; its exact SHA must be read from live PR metadata rather than embedded into the document that creates that SHA. | PR | Exact head | State | Current decision | | --- | --- | --- | --- | @@ -65,7 +65,7 @@ The table intentionally covers every open PR so queue work cannot disappear mere | #115 official threat-feed refresh | `aad8224ab664861b540bdf818e9580470cbe89fb` | Ready metadata; non-mergeable | Preserve source-registry, conditional refresh, last-known-good, attribution/terms and credential-boundary behavior. Reconstruct against current main after the shared Network-Egress policy is protected so feed I/O cannot retain a competing destination-security path. | | #127 admin-console accessibility | `4e160077a6b163b03af65dfd16ac2a722dcbfbae` | Ready, mergeable; UI evidence incomplete | Source accessibility markup/tests are not sufficient release evidence. Add production-like browser E2E for keyboard/focus, accessible name/description, live-region semantics, responsive layouts, and loading/error/permission states under WCAG 2.2 AA before merge. | | #129 Agent Artifact Admission | `85f0f6542a13bfdcc05024b51423851b33ae2ed8` | Draft, mergeable | Current source closes pnpmfile hook and Cargo build-variant authority gaps while preserving package-manager executable-family, indirect-source/root/index/workspace/config/TLS-trust defenses. Current inline review inventory has no unresolved source finding. Exact-head workflows have materialized but remain queued/pre-execution; keep Draft until terminal evidence exists. Retrieval-byte/provenance verification and hostile execution stay executor/quarantine-owned. | -| #130 product/technical gap baseline | `71fd5a468dd7d485a1fe053d5d843bb27ebe8f5a` | Draft, mergeable | This document is the current owning snapshot. Its new exact-head repository/security runs are queued; predecessor review/check evidence does not transfer. Keep Draft while live state changes and until current review findings plus then-live gates are resolved. | +| #130 product/technical gap baseline | `self (read live PR head)` | Draft, mergeable | This document is the current owning snapshot. Exact-head repository/security runs materialize on each content update and predecessor review/check evidence does not transfer. Keep Draft while live state changes and until current review findings plus then-live gates are resolved. | | #134 support-bundle regression | `2b236057d6811cb7ca2ff4f01038796128f4fb6a` | Ready, mergeable | Test-only hardening binds support-bundle counts to KPI/evidence surfaces and rejects administrator-secret leakage. Fresh exact-head repository/security runs remain non-passing until terminal; preserve the narrow test-only scope. | | #135 bounded local limiter | `e9547c556f7c5aeb244371035675a50ce5c82e6f` | Ready, mergeable | Bound attacker-controlled local limiter cardinality/TTL and retain stable 429 evidence while #83 keeps distributed/global authority separate. The PR body still cites an earlier synchronization commit; this exact head is authoritative and must reacquire current-head gates before merge. | | #136 Network-Egress | `3cb1047416c3aa7fa8eb352b842cc55ad8c21b19` | Draft, executable RED pending source fix | Shared structural URL validation, resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, response hop filtering, and architecture fitness are present. RED `f408500d8aeb4beb386caa48a7525508d59da193` requires one end-to-end deadline across manual DNS and remaining HTTP work; production deadline propagation plus a deterministic stalled-resolution runtime regression remain required. Exact-current CI is queued before source execution and CodeQL is startup-failed. #155 must become protected truth before final integration. | @@ -118,7 +118,7 @@ Standards constrain implementation and evidence; they do not prove controls are - Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). *Zero trust architecture* (NIST SP 800-207). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-207. - Souppaya, M., Scarfone, K., & Dodson, D. (2022). *Secure Software Development Framework (SSDF) version 1.1* (NIST SP 800-218). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-218. -- OWASP Foundation. (2025). *Application Security Verification Standard 5.0.0*. https://owasp.org/www-project-application-security-standard/. +- OWASP Foundation. (2025). *Application Security Verification Standard 5.0.0*. https://owasp.org/www-project-application-security-verification-standard/. - Soldani, J., Tamburri, D. A., & van den Heuvel, W.-J. (2018). The pains and gains of microservices: A systematic grey literature review. *Journal of Systems and Software, 146*, 215–232. https://doi.org/10.1016/j.jss.2018.09.082. The microservices evidence is used only to resist decomposition-by-file-size: deployable boundaries require responsibility, scaling, transaction, isolation, or reuse evidence that justifies their operating cost. From a1a703a370c74725b6440d8f9231c86b6371a8c8 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 21:42:56 +0900 Subject: [PATCH 44/73] docs(gaps): reconcile live governance and Context Fabric state --- docs/product-technical-gap-baseline.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 3d9b7d43..4d11e1b2 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -18,9 +18,9 @@ Protected/default Wardnet `main` is `cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. A fresh live read of organization ruleset `18156473` shows `~DEFAULT_BRANCH`, `required_approving_review_count=1`, `required_reviewers=[]`, no code-owner review, no last-push approval requirement, required review-thread resolution, deletion protection, and non-fast-forward protection. The live ruleset exposes `OrganizationAdmin/always` bypass capability; that existence is not normal merge authorization. Self-approval and bot/model-as-human approval are forbidden. -The same fresh ruleset read exposes a second central control-plane regression: its required-workflow inventory currently contains nine paths and omits `.github/workflows/codeql-pr.yml`. Scorecard and OSV remain present. `.github#1719` is the current canonical owner path for the checked-in ten-workflow contract and live-reconciliation regression; exact live Wardnet evidence and RED/GREEN acceptance were handed there. Wardnet must not compensate by weakening or duplicating CodeQL locally. +The same fresh ruleset read shows nine required workflow paths and no `.github/workflows/codeql-pr.yml`. This is now the canonical protected owner contract rather than a ten-to-nine drift regression: merged `.github#1719` produced protected `.github/main@09ac6366ddd018fd0085368f4b669ba797fd0158`, whose `REQUIRED_WORKFLOW_PATHS` tuple contains the same nine paths and whose executable contract explicitly rejects adding CodeQL as a ruleset-required workflow because that execution mode reproduced the CodeQL startup-failure class. CodeQL PR analysis remains a separate security/control-plane lane. Wardnet must not weaken or duplicate it, and must not reintroduce CodeQL as a required-workflow item unless the canonical owner contract changes with executable evidence. -The bare approval count is structurally inconsistent with the declared solo-maintainer model. This is a central governance defect rather than a Wardnet staffing requirement. `.github#1644@79527b4bfd9ca1607b05de4f8e17ea8ee199b78a`, referencing #772 and related governance work, is the current owner-plane reconciliation candidate. Its source policy removes the impossible approval count while preserving deterministic workflow/security/coverage/SBOM/provenance/thread/branch-integrity controls. Source integration alone does not mutate live rulesets; the owner-plane apply remains separately privileged and must be proven from live settings before Wardnet treats the rule as repaired. Wardnet #155 remains an explicit post-apply canary. +The bare approval count is structurally inconsistent with the declared solo-maintainer model, and routine `OrganizationAdmin/always` bypass also remains outside the intended ordinary merge path. These are central governance defects rather than Wardnet staffing requirements. `.github#1644@c94faa446774d012d684304fb0ac505d03e2f765`, referencing #772 and related governance work, is the current owner-plane reconciliation candidate. Its source policy removes the impossible approval count and routine bypass while preserving deterministic workflow/security/coverage/SBOM/provenance/thread/branch-integrity controls. Source integration alone does not mutate live rulesets; the owner-plane apply must be proven from fresh live settings before Wardnet treats the rule as repaired. Wardnet #155 remains an explicit post-apply canary. Runner acquisition is also a central control-plane concern. PR #153 pins repository-owned CI/Fuzz/Scorecard runner declarations to explicit `ubuntu-24.04` and permanently rejects floating `ubuntu-latest`. Exact head `b663f9d200e5f385c7dd067d074940a02836c68e` has completed repository CI/Fuzz/Security/SAST successfully on that same source, proving the full hosted image is executable when admitted. Later exact-head waves across Wardnet, Context Graph Contracts, and EA Core again remained pre-checkout with `runner_id=0`. `.github#712` owns acquisition/capacity/policy-routing and evidence-identity repair. @@ -38,7 +38,7 @@ Fresh metadata still reports `develop` as the default branch for both `Contextua Context Graph Contracts release-provenance prerequisite #25 is Draft at exact `187f45927e697cfad9ac5b2523dfd86b695aa072` directly after #19 exact `db392d8aac550d88986a14011956e5e2e7fce677`. It binds package/SBOM identities to protected source plus independently verifiable release-source evidence and has repaired its repository-owned floating-runner selector by pinning the required workflows to `ubuntu-24.04`. Current exact-head runs `ci 33730255529`, `receipt-package-smoke 33730255606`, `reproducibility 33730255596`, and `supply-chain 33730255626` remain queued with no assigned runner, so the selector repair is source evidence rather than terminal hosted GREEN. #20 remains exact `475ce14185db697940e8219c3cda7f24d66f3ed7`; child #21 remains exact `b0c21f907a12b07a28cf38ed165ab6530855283e` on obsolete #20 ancestry and has no exact-current hosted GREEN. The intended rebuild order remains `#19 -> #25 -> #20 -> #21`. No immutable CGC release exists, so Wardnet must not bind production behavior to any open PR head. -Enterprise Architecture Core #40 is Draft/non-mergeable at exact `fadf27f0df1a865261c15dc64de2a9dc350e02d4` on diverged parent/base `chatgpt/ddd-context-fitness-v1@b44635b686c66e78ebd7f1218343a933a510cd89`. Its DDD repair is now source-GREEN: Strategy & Transformation owns `SchedulingServiceHandler` and root `runtime.py` composes that bounded adapter instead of defining a duplicate handler. The branch also repairs the CGC consumer trust boundary: release admission requires semantic conformance plus independently authenticated source-bound release evidence, and the consumer accepts the producer's provider-valid wheel/sdist grammar rather than inventing a narrower EA-local package convention. No current-head hosted run exists, and predecessor evidence does not transfer. #40 preserves the Wardnet/quarantine authority boundary and remains fail closed until compatible immutable CGC and quarantine release evidence exists. +Enterprise Architecture Core #40 is Draft/non-mergeable at exact `1f2e21ac0e6d1c54ca3591a1e43dc5c0ef9f4a38` on obsolete recorded parent/base `chatgpt/ddd-context-fitness-v1@b44635b686c66e78ebd7f1218343a933a510cd89`; live parent #39 is `c063570bd9177578fa75be69defd81c99e6ba2f3` and has terminal-success repository workflows. The current #40 child preserves the Wardnet/quarantine authority boundary, adds projection-receipt persistence/acceptance, and tightens the CGC transport-admission dependency so a future released contract must expose `CONTEXT_ASSERTION_STRUCTURED_MEDIA_TYPE` and `admit_context_assertion_message`. Fresh exact-head workflow lookup still provides no hosted GREEN, predecessor evidence does not transfer, and the child must be restacked non-force after owner-plane topology repair. EA remains fail closed until compatible immutable CGC and quarantine release evidence exists. Fresh release reads for Quarantine Sandbox Runtime, EgressWeave, contextual-orchestrator, Context Graph Contracts, and Enterprise Architecture Core are empty. None exposes an immutable GitHub Release usable as a Wardnet production dependency. Open sibling branches are evidence, not release authority. @@ -131,7 +131,7 @@ No release is authorized. Wardnet, Context Graph Contracts, EA Core, contextual- ## Next execution order -1. Continue #153/#155/#144/#159/#140/#141/#77 through current exact-head gates while `.github#712` repairs runner/evidence identity, `.github#1644` repairs solo-maintainer ruleset semantics, and `.github#1719` restores/enforces the full CodeQL/Scorecard/OSV required-workflow inventory. +1. Continue #153/#155/#144/#159/#140/#141/#77 through current exact-head gates while `.github#712` repairs runner/evidence identity and `.github#1644` repairs solo-maintainer/bypass ruleset semantics. Merged `.github#1719` is protected source truth for the canonical nine required workflows; CodeQL remains a separate security/control-plane lane rather than a ruleset-required workflow. 2. Keep #160 Draft while `.github#1777` establishes reusable default-branch Scorecard posture refresh; then rebuild it as an exact-SHA thin caller rather than deleting security evidence authority. 3. Preserve #156/#157/#158 until #153 is protected, then non-force reconstruct/restack each child on fresh main and reacquire all evidence. 4. Repair #136's DNS-resolution deadline defect test-first with one shared operation deadline and a deterministic stalled-resolution runtime regression; after #155 becomes protected truth, refresh #136 against live main and revalidate. @@ -140,4 +140,4 @@ No release is authorized. Wardnet, Context Graph Contracts, EA Core, contextual- 7. Keep #162 Draft until its exact-head product-contract regression and then-live deterministic/security/coverage/review/governance evidence are terminal-valid; do not restore the closed #154 KRW-20B remapping. 8. Repair/restack every remaining open lane rather than letting it disappear from the queue: #90/#93/#111/#127/#134/#135 can be drained once exact-head evidence is current; #112/#114/#115 require non-force reconstruction against current protected truth; #95 must transfer its unique cross-context evidence into bounded successors before retirement. 9. Continue #82/#83/#84/#85 only after their declared prerequisites become protected/released truth; close #87 only against one immutable protected release candidate satisfying the full production gate. -10. Refresh this baseline whenever protected truth, queue topology, release state, or responsibility boundaries materially change. +10. Refresh this baseline whenever protected truth, queue topology, release state, or responsibility boundaries materially change. \ No newline at end of file From 3f7e7001a340cbf9e26099dffc2147f46b8744de Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 22:42:52 +0900 Subject: [PATCH 45/73] docs(gaps): refresh exact live control-plane state --- docs/product-technical-gap-baseline.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 4d11e1b2..2796c7c3 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -18,13 +18,13 @@ Protected/default Wardnet `main` is `cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. A fresh live read of organization ruleset `18156473` shows `~DEFAULT_BRANCH`, `required_approving_review_count=1`, `required_reviewers=[]`, no code-owner review, no last-push approval requirement, required review-thread resolution, deletion protection, and non-fast-forward protection. The live ruleset exposes `OrganizationAdmin/always` bypass capability; that existence is not normal merge authorization. Self-approval and bot/model-as-human approval are forbidden. -The same fresh ruleset read shows nine required workflow paths and no `.github/workflows/codeql-pr.yml`. This is now the canonical protected owner contract rather than a ten-to-nine drift regression: merged `.github#1719` produced protected `.github/main@09ac6366ddd018fd0085368f4b669ba797fd0158`, whose `REQUIRED_WORKFLOW_PATHS` tuple contains the same nine paths and whose executable contract explicitly rejects adding CodeQL as a ruleset-required workflow because that execution mode reproduced the CodeQL startup-failure class. CodeQL PR analysis remains a separate security/control-plane lane. Wardnet must not weaken or duplicate it, and must not reintroduce CodeQL as a required-workflow item unless the canonical owner contract changes with executable evidence. +The same fresh ruleset read shows nine required workflow paths and no `.github/workflows/codeql-pr.yml`. This is now the canonical protected owner contract rather than a ten-to-nine drift regression: merged `.github#1719` produced protected `.github/main@09ac6366ddd018fd0085368f4b669ba797fd0158`, whose `REQUIRED_WORKFLOW_PATHS` tuple contains the same nine paths and whose executable contract explicitly rejects adding CodeQL as a ruleset-required workflow because that mode reproduced the CodeQL startup-failure class. CodeQL PR analysis remains a separate security/control-plane lane. Wardnet must not weaken or duplicate it, and must not reintroduce CodeQL as a required-workflow item unless the canonical owner contract changes with executable evidence. The bare approval count is structurally inconsistent with the declared solo-maintainer model, and routine `OrganizationAdmin/always` bypass also remains outside the intended ordinary merge path. These are central governance defects rather than Wardnet staffing requirements. `.github#1644@c94faa446774d012d684304fb0ac505d03e2f765`, referencing #772 and related governance work, is the current owner-plane reconciliation candidate. Its source policy removes the impossible approval count and routine bypass while preserving deterministic workflow/security/coverage/SBOM/provenance/thread/branch-integrity controls. Source integration alone does not mutate live rulesets; the owner-plane apply must be proven from fresh live settings before Wardnet treats the rule as repaired. Wardnet #155 remains an explicit post-apply canary. Runner acquisition is also a central control-plane concern. PR #153 pins repository-owned CI/Fuzz/Scorecard runner declarations to explicit `ubuntu-24.04` and permanently rejects floating `ubuntu-latest`. Exact head `b663f9d200e5f385c7dd067d074940a02836c68e` has completed repository CI/Fuzz/Security/SAST successfully on that same source, proving the full hosted image is executable when admitted. Later exact-head waves across Wardnet, Context Graph Contracts, and EA Core again remained pre-checkout with `runner_id=0`. `.github#712` owns acquisition/capacity/policy-routing and evidence-identity repair. -PR #155 provides the clearest current-PR evidence. Exact head `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` has terminal repository-owned CI/Fuzz/Security/SAST and resolved inline review threads. Its correct current-PR required OpenCode run is `33590351182`: bootstrap job `100122902000` completed; `coverage-source-tree` job `100272722468` completed successfully on hosted runner `1001629411`; the downstream `coverage-evidence` job `100479589911` remains queued with `runner_id=0`, an empty runner name, and zero steps. The same source SHA was previously used by PR #138, whose older required run is a different PR identity. Central required evidence must bind at least `(repository, pr_number, head_sha, workflow/check lane)`; wrong-PR same-SHA evidence must never be promoted to the current PR. Fresh runner evidence has been handed to `.github#712`; no leaf-source churn or routine bypass is justified. +PR #155 provides the clearest current-PR evidence. Exact head `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` has terminal repository-owned CI/Fuzz/Security/SAST and resolved inline review threads. Its correct current-PR Required OpenCode run is `33590351182`: `required-workflow-bootstrap` job `100122902000`, `coverage-source-tree` job `100272722468`, and `coverage-evidence` job `100479589911` have each acquired GitHub-hosted `ubuntu-24.04` runners and completed successfully. The remaining `opencode-review` job `100659819151` is queued pre-execution with `runner_id=0`, empty runner/group identity, and zero steps. The same source SHA was previously used by PR #138, whose older required run is a different PR identity. Central required evidence must bind at least `(repository, pr_number, head_sha, workflow/check lane)`; wrong-PR same-SHA evidence must never be promoted to the current PR. This exact final-job transition has been handed to `.github#712`; no leaf-source churn or routine bypass is justified. A separate #153 reproduction already proved the same identity class: required-workflow run `33550235908` / job `100100529632` was commit-scoped to `b663f9d…` but its durable payload was `PR_NUMBER=147`. The same clean SHA is now #153's head, so commit-only evidence lookup can surface the wrong PR's result. Do not manufacture new leaf SHAs to escape that contamination. @@ -38,7 +38,7 @@ Fresh metadata still reports `develop` as the default branch for both `Contextua Context Graph Contracts release-provenance prerequisite #25 is Draft at exact `187f45927e697cfad9ac5b2523dfd86b695aa072` directly after #19 exact `db392d8aac550d88986a14011956e5e2e7fce677`. It binds package/SBOM identities to protected source plus independently verifiable release-source evidence and has repaired its repository-owned floating-runner selector by pinning the required workflows to `ubuntu-24.04`. Current exact-head runs `ci 33730255529`, `receipt-package-smoke 33730255606`, `reproducibility 33730255596`, and `supply-chain 33730255626` remain queued with no assigned runner, so the selector repair is source evidence rather than terminal hosted GREEN. #20 remains exact `475ce14185db697940e8219c3cda7f24d66f3ed7`; child #21 remains exact `b0c21f907a12b07a28cf38ed165ab6530855283e` on obsolete #20 ancestry and has no exact-current hosted GREEN. The intended rebuild order remains `#19 -> #25 -> #20 -> #21`. No immutable CGC release exists, so Wardnet must not bind production behavior to any open PR head. -Enterprise Architecture Core #40 is Draft/non-mergeable at exact `1f2e21ac0e6d1c54ca3591a1e43dc5c0ef9f4a38` on obsolete recorded parent/base `chatgpt/ddd-context-fitness-v1@b44635b686c66e78ebd7f1218343a933a510cd89`; live parent #39 is `c063570bd9177578fa75be69defd81c99e6ba2f3` and has terminal-success repository workflows. The current #40 child preserves the Wardnet/quarantine authority boundary, adds projection-receipt persistence/acceptance, and tightens the CGC transport-admission dependency so a future released contract must expose `CONTEXT_ASSERTION_STRUCTURED_MEDIA_TYPE` and `admit_context_assertion_message`. Fresh exact-head workflow lookup still provides no hosted GREEN, predecessor evidence does not transfer, and the child must be restacked non-force after owner-plane topology repair. EA remains fail closed until compatible immutable CGC and quarantine release evidence exists. +Enterprise Architecture Core #40 is Draft/non-mergeable at exact `66d4db28303e41ca1cbe434798d0c9b5b50cdc2a` on obsolete recorded parent/base `chatgpt/ddd-context-fitness-v1@b44635b686c66e78ebd7f1218343a933a510cd89`; live parent #39 is `c063570bd9177578fa75be69defd81c99e6ba2f3` and has terminal-success repository workflows. The current #40 child preserves the Wardnet/quarantine authority boundary, adds projection-receipt persistence/acceptance, and tightens the CGC transport-admission dependency so a future released contract must expose `CONTEXT_ASSERTION_STRUCTURED_MEDIA_TYPE` and `admit_context_assertion_message`. Fresh exact-head workflow lookup still provides no hosted GREEN, predecessor evidence does not transfer, and the child must be restacked non-force after owner-plane topology repair. EA remains fail closed until compatible immutable CGC and quarantine release evidence exists. Fresh release reads for Quarantine Sandbox Runtime, EgressWeave, contextual-orchestrator, Context Graph Contracts, and Enterprise Architecture Core are empty. None exposes an immutable GitHub Release usable as a Wardnet production dependency. Open sibling branches are evidence, not release authority. @@ -73,13 +73,13 @@ The table intentionally covers every open PR so queue work cannot disappear mere | #141 CodeQL uploader | `fea3796a723080068cdc02e064065d6d53eeb3e0` | Ready; auto-merge armed | Immutable `github/codeql-action/upload-sarif` pin advances to v4.37.9; normal central/governance evidence still applies. | | #144 Kubernetes path/public docs | `b07e4d21057df4dd4e706b584e5fad00338f20b6` | Ready; auto-merge armed | Hardened manifest source moves to `deploy/kubernetes/wardnet.yaml` without renaming live Kubernetes resources. Current exact-head repository/security lanes remain queued and CodeQL is startup-failed. | | #153 explicit hosted runner | `b663f9d200e5f385c7dd067d074940a02836c68e` | Ready, clean stack root; auto-merge armed | Same-source repository CI/Fuzz/Security/SAST have terminal GREEN evidence. Current central runner/review/governance evidence is non-terminal, and stale same-SHA required evidence is proven capable of referring to superseded PR #147 rather than #153. A fresh #153-bound verdict is required; `ubuntu-slim` is only an acquisition canary. | -| #155 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready, main-based; auto-merge armed | Non-loopback startup fails closed without write-capable admin credentials; current review threads are resolved. Repository-owned CI/Fuzz/Security/SAST are terminal GREEN. Current-PR required OpenCode bootstrap and coverage source-tree are terminal successful; downstream `coverage-evidence` job `100479589911` remains pre-checkout queued with `runner_id=0`. Issue #78 closes only after protected merge. | +| #155 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready, main-based; auto-merge armed | Non-loopback startup fails closed without write-capable admin credentials; current review threads are resolved. Repository-owned CI/Fuzz/Security/SAST are terminal GREEN. Current-PR required OpenCode bootstrap, coverage source-tree, and coverage evidence are terminal successful; final `opencode-review` job `100659819151` remains pre-execution queued with `runner_id=0`. Issue #78 closes only after protected merge. | | #156 operability evidence | `76037b8ae206ace8dab0e6622dfc9fc88c57deb3` | Draft, child of #153 | Preserve support-bundle/readiness evidence; reconstruct/restack on fresh protected main after #153 integrates, then regenerate all base-sensitive evidence. | | #157 trusted proxy | `65a2b7fbf2827f69ae1aa288696b6c5630af28c4` | Draft, child of #153 | Preserve fail-closed forwarded-IP attribution. Reconstruct/restack after #153 protected merge. | | #158 readiness metrics | `387a447f856093d02116dfadcf2c4a4a63c6d3ba` | Draft, child of #153 | Preserve readiness gauges using existing readiness/KPI authority. Reconstruct/restack after #153 protected merge. | | #159 CI concurrency | `89176e2cc57088e4d772de9b1686ab89a3e69aeb` | Ready; auto-merge armed | PR runs use PR-number concurrency so new heads supersede obsolete PR executions; push runs use unique run IDs so pending protected-main commits cannot replace one another. Current repository/central evidence remains queued/startup-failing and `.github#712` owns the organization control-plane class. | | #160 Scorecard deduplication | `b03037d4648a6282cb4029dff062ed7b55ff980a` | Draft; unresolved valid review finding | Deleting the leaf workflow now would remove default-branch push/scheduled SARIF refresh because central `scorecard-pr.yml` is PR-only. `.github#1777` is the canonical prerequisite. Keep Draft and do not resolve the finding until that central repair integrates and this PR is reconstructed/revalidated. | -| #162 commercial authority separation | `3b5aa81664ed8f2fd8b29438418be920f43f93e0` | Draft, mergeable | Separates the standing USD 20 billion software-sale quality ambition from the customer-contract readiness predicate. Runtime `TARGET_SALE_VALUE_KRW` remains 2B KRW; the canonical customer/readiness and USD 20B quality documents are distinct, and the old misleading path is retained only as a compatibility shim. Keep Draft until exact-head repository/security/coverage/review/governance evidence is terminal-valid. | +| #162 commercial authority separation | `bd41d8430b269cbd9b440d225e1d53b28a4fe817` | Draft, mergeable | Separates the standing USD 20 billion software-sale quality ambition from the customer-contract readiness predicate. Runtime `TARGET_SALE_VALUE_KRW` remains 2B KRW; the canonical customer/readiness and USD 20B quality documents are distinct, and the old misleading path is retained only as a compatibility shim. Keep Draft until exact-head repository/security/coverage/review/governance evidence is terminal-valid. | Auto-merge state, where enabled, is state only, not protected truth or transferable evidence. A changed head/base must reacquire the then-live policy evidence. @@ -140,4 +140,4 @@ No release is authorized. Wardnet, Context Graph Contracts, EA Core, contextual- 7. Keep #162 Draft until its exact-head product-contract regression and then-live deterministic/security/coverage/review/governance evidence are terminal-valid; do not restore the closed #154 KRW-20B remapping. 8. Repair/restack every remaining open lane rather than letting it disappear from the queue: #90/#93/#111/#127/#134/#135 can be drained once exact-head evidence is current; #112/#114/#115 require non-force reconstruction against current protected truth; #95 must transfer its unique cross-context evidence into bounded successors before retirement. 9. Continue #82/#83/#84/#85 only after their declared prerequisites become protected/released truth; close #87 only against one immutable protected release candidate satisfying the full production gate. -10. Refresh this baseline whenever protected truth, queue topology, release state, or responsibility boundaries materially change. \ No newline at end of file +10. Refresh this baseline whenever protected truth, queue topology, release state, or responsibility boundaries materially change. From c0cb1a9fabb8232418621a8e289ee82204ef6d49 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 06:24:28 +0900 Subject: [PATCH 46/73] docs(gaps): refresh live security and release baseline --- docs/product-technical-gap-baseline.md | 179 ++++++++++++------------- 1 file changed, 86 insertions(+), 93 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 2796c7c3..6bca358b 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,143 +1,136 @@ # Product and technical gap baseline -Snapshot date: 2026-09-03. This document is a dated repository snapshot. Live refs, reviews, checks, rulesets, releases, and foreign-owner state must be re-read before any merge, release, or integration decision. +Snapshot date: 2026-09-04. This file records the current commercial/security integration baseline, not a substitute for live GitHub state. Before merge, release, restack, or foreign-owner handoff, re-read exact heads/bases, reviews/threads, checks, rulesets, releases, and branch protection. ## Product and authority boundary -Wardnet is the Rust-first gateway/SOC control plane and owns Gateway, Admission Policy, Artifact Identity, Security Analysis Integration, Network-Egress, SOC Evidence, Runtime Control, Audit-Provenance, and the Agent Artifact Admission bounded context. It does not execute hostile workloads or own provider/model orchestration. +Wardnet is the Rust-first gateway/SOC control plane. Its owned bounded contexts are Gateway, Admission Policy, Artifact Identity, Security Analysis Integration, Network-Egress, SOC Evidence, Runtime Control, Audit-Provenance, and Agent Artifact Admission. Wardnet does not execute hostile workloads and does not own model/provider routing. -`ContextualWisdomLab/quarantine-sandbox-runtime` owns reusable hostile-workload isolation, execution lifecycle, cleanup, and artifact-analysis evidence. `contextual-orchestrator` owns Agent/LLM orchestration, provider/model discovery and routing, concrete model selection, provider credentials, and free/paid policy. EgressWeave is the canonical outbound HTTP-policy candidate. Wardnet consumes released/versioned ports and Anti-Corruption Layers; it does not copy those implementations or access foreign application databases. +`quarantine-sandbox-runtime` owns hostile execution isolation/lifecycle/cleanup. `contextual-orchestrator` owns Agent/LLM orchestration, provider/model/key discovery and routing. EgressWeave is the outbound HTTP-policy candidate. `appguardrail` retains its own application-guardrail authority. Wardnet consumes only released/versioned ports or Anti-Corruption Layers and does not copy foreign source or use cross-service SQL. -The protected Wardnet tree still carries an integration debt at the optional SOC LLM seam: `soc_llm_chat_body(model, event)` accepts a caller model selector, and `tests/adaptive_orchestrator_default.rs` intentionally preserves that field. That is not the desired owner contract. Wardnet must eventually call a released/versioned contextual-orchestrator API/client/schema Agent without selecting a provider or concrete model. Fresh contextual-orchestrator release inventory is empty, so no mutable branch is promoted as the production replacement. +`context-graph-contracts` is the provider-neutral Context Fabric Shared Kernel for canonical object/authority references, truth status/origin, valid/system time, provenance, Context Assertion, CloudEvents/schema/conformance/admission. `enterprise-architecture-core` is the EA Decision Plane. Both repositories are read-only dependencies from this Wardnet writer while the Context Fabric owner loop is active; security findings/verdicts are not copied into EA as authoritative facts. -`context-graph-contracts` is the provider-neutral Context Fabric Shared Kernel for canonical object/authority references, truth status/origin, valid/system time, provenance, Context Assertion, CloudEvents, schema, conformance, and admission. `enterprise-architecture-core` is the EA Decision Plane. Both remain read-only source dependencies from this writer while the dedicated Context Fabric writer is active. Security findings, alerts, malware verdicts, artifact risk scores, prompts, and customer/runtime data do not become authoritative EA facts. +The optional SOC LLM seam in protected Wardnet still has ownership debt: provider/model selection must ultimately disappear behind a released contextual-orchestrator contract. No mutable CO branch may be promoted as production authority while CO has no compatible immutable release. -## Protected truth and governance +## Protected truth and central governance -Protected/default Wardnet `main` is `cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. It contains PR #137's externally provisioned, non-optional Kubernetes administrator Secret boundary. Wardnet currently has no GitHub Release. +Protected/default Wardnet `main` remains `cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. It contains the externally provisioned, non-optional Kubernetes administrator Secret boundary from protected PR #137. Wardnet still has no GitHub Release. -A fresh live read of organization ruleset `18156473` shows `~DEFAULT_BRANCH`, `required_approving_review_count=1`, `required_reviewers=[]`, no code-owner review, no last-push approval requirement, required review-thread resolution, deletion protection, and non-fast-forward protection. The live ruleset exposes `OrganizationAdmin/always` bypass capability; that existence is not normal merge authorization. Self-approval and bot/model-as-human approval are forbidden. +Live organization ruleset `18156473` remains active on `~DEFAULT_BRANCH` with `required_approving_review_count=1`, `required_reviewers=[]`, no code-owner or last-push approval requirement, required thread resolution, nine central required workflows, deletion/non-fast-forward protection, and `OrganizationAdmin/always` bypass. Under the declared solo-maintainer model, the generic approval count is structurally unsatisfiable without forbidden self/model approval; the bypass is not routine merge authorization. -The same fresh ruleset read shows nine required workflow paths and no `.github/workflows/codeql-pr.yml`. This is now the canonical protected owner contract rather than a ten-to-nine drift regression: merged `.github#1719` produced protected `.github/main@09ac6366ddd018fd0085368f4b669ba797fd0158`, whose `REQUIRED_WORKFLOW_PATHS` tuple contains the same nine paths and whose executable contract explicitly rejects adding CodeQL as a ruleset-required workflow because that mode reproduced the CodeQL startup-failure class. CodeQL PR analysis remains a separate security/control-plane lane. Wardnet must not weaken or duplicate it, and must not reintroduce CodeQL as a required-workflow item unless the canonical owner contract changes with executable evidence. +The owner repair remains `.github#1644@c94faa446774d012d684304fb0ac505d03e2f765` / #772. Fresh protected `.github/main` is `07d9ec23fb265c76539d23249e1dfa124ea7b23b`; #1644 is 19 protected-main commits behind/diverged and must adopt the intervening owner delta non-force before its governance evidence can become current. The intended repair keeps deterministic workflow/security/thread/deletion/non-fast-forward controls while removing the impossible generic approval requirement and routine bypass semantics. Source integration alone is not live-ruleset convergence. -The bare approval count is structurally inconsistent with the declared solo-maintainer model, and routine `OrganizationAdmin/always` bypass also remains outside the intended ordinary merge path. These are central governance defects rather than Wardnet staffing requirements. `.github#1644@c94faa446774d012d684304fb0ac505d03e2f765`, referencing #772 and related governance work, is the current owner-plane reconciliation candidate. Its source policy removes the impossible approval count and routine bypass while preserving deterministic workflow/security/coverage/SBOM/provenance/thread/branch-integrity controls. Source integration alone does not mutate live rulesets; the owner-plane apply must be proven from fresh live settings before Wardnet treats the rule as repaired. Wardnet #155 remains an explicit post-apply canary. +Runner acquisition remains separate central control-plane work under `.github#712`. A queued/pre-checkout job with `runner_id=0`, no runner/group identity and `steps=[]` is non-passing evidence but not a reason to churn Wardnet source, downgrade runners, reuse predecessor evidence, or bypass a required gate. -Runner acquisition is also a central control-plane concern. PR #153 pins repository-owned CI/Fuzz/Scorecard runner declarations to explicit `ubuntu-24.04` and permanently rejects floating `ubuntu-latest`. Exact head `b663f9d200e5f385c7dd067d074940a02836c68e` has completed repository CI/Fuzz/Security/SAST successfully on that same source, proving the full hosted image is executable when admitted. Later exact-head waves across Wardnet, Context Graph Contracts, and EA Core again remained pre-checkout with `runner_id=0`. `.github#712` owns acquisition/capacity/policy-routing and evidence-identity repair. +## Immediate protected-main security path -PR #155 provides the clearest current-PR evidence. Exact head `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` has terminal repository-owned CI/Fuzz/Security/SAST and resolved inline review threads. Its correct current-PR Required OpenCode run is `33590351182`: `required-workflow-bootstrap` job `100122902000`, `coverage-source-tree` job `100272722468`, and `coverage-evidence` job `100479589911` have each acquired GitHub-hosted `ubuntu-24.04` runners and completed successfully. The remaining `opencode-review` job `100659819151` is queued pre-execution with `runner_id=0`, empty runner/group identity, and zero steps. The same source SHA was previously used by PR #138, whose older required run is a different PR identity. Central required evidence must bind at least `(repository, pr_number, head_sha, workflow/check lane)`; wrong-PR same-SHA evidence must never be promoted to the current PR. This exact final-job transition has been handed to `.github#712`; no leaf-source churn or routine bypass is justified. +### #155 — fail-closed management authentication -A separate #153 reproduction already proved the same identity class: required-workflow run `33550235908` / job `100100529632` was commit-scoped to `b663f9d…` but its durable payload was `PR_NUMBER=147`. The same clean SHA is now #153's head, so commit-only evidence lookup can surface the wrong PR's result. Do not manufacture new leaf SHAs to escape that contamination. +PR #155 remains exact `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` on protected main and is mechanically mergeable. Repository-owned CI `33590350994`, Fuzz `33590350997`, Security Scan `33590350967`, and SAST `33590350991` are terminal GREEN; current inline review threads are resolved. -GitHub's hosted-runner contract does not make `ubuntu-slim` an equivalent workaround: it is a constrained container runner intended for lightweight automation. A successful slim job is an admission canary, not justification to downgrade Wardnet CI/Fuzz/CodeQL/coverage workloads. +Required OpenCode run `33590351182` has terminal-success bootstrap `100122902000`, coverage-source-tree `100272722468`, and coverage-evidence `100479589911`. Only `opencode-review` `100659819151` remains queued before checkout with `runner_id=0` and zero steps. This exact current-PR identity is already handed to `.github#712`; the same SHA's predecessor #138 evidence is not transferable. #78 closes only after this delta reaches protected main through satisfiable ordinary governance. -A separate central ownership gap exists for OpenSSF Scorecard posture refresh. Wardnet #160 attempted to delete the repository's default-branch/scheduled Scorecard workflow while the central reusable `scorecard-pr.yml` remains PR-only. That would stop authoritative default-branch SARIF refresh. #160 is therefore Draft with its review finding intentionally unresolved, and `.github#1777` owns the reusable default-branch Scorecard workflow plus exact-SHA thin-caller prerequisite. Do not merge deletion-only #160 or treat PR-only Scorecard evidence as equivalent. +### #77 — Rust toolchain plus duplicate-Deployment fail-closed review repair -## Context Fabric live boundary +PR #77 is Ready/mergeable at exact `46fef54c9b5916eb77196fb515a8fabad13a05d1`. In addition to pinning Rust `1.98.0`, the current lineage repairs a valid CodeRabbit security finding in the Kubernetes deployment regression contract. -Fresh metadata still reports `develop` as the default branch for both `ContextualWisdomLab/context-graph-contracts` and `ContextualWisdomLab/enterprise-architecture-core`. Their protected `develop` tips remain `context-graph-contracts@99cb5468ba3c15c5e79688f53dee74724fae2d13` and `enterprise-architecture-core@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4`. Both expose zero GitHub Releases. The accepted protected-`main` transition remains central `.github`/Context Fabric owner work rather than a Wardnet source mutation. +RED `43d2c874732063e418b3929e3435c388ccfa7c69` proved that first-match `find_map` validation could accept a valid first `Deployment` while ignoring a later YAML document with the same `waf-ids-ai-soc/waf-ids-ai-soc` resource identity. GREEN `17a2a1e833e6c4cab6101ef6a534589d75a5920a` requires exactly one canonical target Deployment and adds a hostile duplicate-resource regression whose second document contains a literal `ADMIN_TOKEN`. Cleanup/current `46fef54c...` removes only the temporary source-text RED scaffold; the behavior-level regression remains. -Context Graph Contracts release-provenance prerequisite #25 is Draft at exact `187f45927e697cfad9ac5b2523dfd86b695aa072` directly after #19 exact `db392d8aac550d88986a14011956e5e2e7fce677`. It binds package/SBOM identities to protected source plus independently verifiable release-source evidence and has repaired its repository-owned floating-runner selector by pinning the required workflows to `ubuntu-24.04`. Current exact-head runs `ci 33730255529`, `receipt-package-smoke 33730255606`, `reproducibility 33730255596`, and `supply-chain 33730255626` remain queued with no assigned runner, so the selector repair is source evidence rather than terminal hosted GREEN. #20 remains exact `475ce14185db697940e8219c3cda7f24d66f3ed7`; child #21 remains exact `b0c21f907a12b07a28cf38ed165ab6530855283e` on obsolete #20 ancestry and has no exact-current hosted GREEN. The intended rebuild order remains `#19 -> #25 -> #20 -> #21`. No immutable CGC release exists, so Wardnet must not bind production behavior to any open PR head. +Fresh current-head CI `33807338426`, Security `33807338277`, SAST `33807338221`, Scorecard `33807338399`, and OSV `33807339076` are queued. The review thread stays unresolved until exact-current-head GREEN exists; source repair alone is not terminal verification. -Enterprise Architecture Core #40 is Draft/non-mergeable at exact `66d4db28303e41ca1cbe434798d0c9b5b50cdc2a` on obsolete recorded parent/base `chatgpt/ddd-context-fitness-v1@b44635b686c66e78ebd7f1218343a933a510cd89`; live parent #39 is `c063570bd9177578fa75be69defd81c99e6ba2f3` and has terminal-success repository workflows. The current #40 child preserves the Wardnet/quarantine authority boundary, adds projection-receipt persistence/acceptance, and tightens the CGC transport-admission dependency so a future released contract must expose `CONTEXT_ASSERTION_STRUCTURED_MEDIA_TYPE` and `admit_context_assertion_message`. Fresh exact-head workflow lookup still provides no hosted GREEN, predecessor evidence does not transfer, and the child must be restacked non-force after owner-plane topology repair. EA remains fail closed until compatible immutable CGC and quarantine release evidence exists. +### #136 — Network-Egress DNS deadline defect -Fresh release reads for Quarantine Sandbox Runtime, EgressWeave, contextual-orchestrator, Context Graph Contracts, and Enterprise Architecture Core are empty. None exposes an immutable GitHub Release usable as a Wardnet production dependency. Open sibling branches are evidence, not release authority. +Draft #136 remains exact `3cb1047416c3aa7fa8eb352b842cc55ad8c21b19`. Its shared outbound client already rejects dangerous literal destinations, validates/pins resolved addresses, disables ambient proxy/redirect behavior, bounds client-cache lifetime, and retains executable ownership fitness. -## Live delivery queue +The current RED is real and source-bearing: `validated_outbound_http_client` awaits manual DNS resolution before the caller's request timeout begins. CI `33698726857` fails the intended end-to-end deadline contract. GREEN requires one absolute operation deadline shared across DNS validation and remaining HTTP work plus a deterministic stalled/delayed resolver runtime seam. Feed-specific/SOC/proxy timeout semantics must remain explicit; do not apply one phishing-feed constant globally. Final integration also follows protected #155 auth truth. -Fresh inventory contains 26 open PRs: +## Agent Artifact Admission -`#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #153, #155, #156, #157, #158, #159, #160, #162`. +Draft #129 is exact `75f003e4c76182280011ca7ef63a952b7ab89b5a`. It owns the pre-execution structured artifact-install admission boundary and keeps hostile execution downstream. Current policy covers executable/ecosystem binding, exact coordinates/digests, indirect source/config/root/workspace/TLS authority, lifecycle-script/trust/integrity bypasses, Cargo build variants, and OCI platform ambiguity. -PR #137 is protected-main truth. PR #154 is closed without merge after its effective delta was reverted to zero; issue #161 and Draft #162 now own the corrected commercial-authority separation. Predecessor checks, reviews, approvals, and artifacts do not transfer after head/base movement. +The current candidate adds fail-closed OCI platform-variant handling and hostile/edge coverage while preserving the public reason-code contract. Current workflows are queued/pre-execution, so keep Draft until exact-head deterministic/security/review evidence is terminal. Retrieved-byte or equivalent provenance verification and hostile execution remain executor/quarantine responsibilities. -The table intentionally covers every open PR so queue work cannot disappear merely because it is not currently on the shortest merge path. The #130 head cell is self-referential by construction; its exact SHA must be read from live PR metadata rather than embedded into the document that creates that SHA. +## Release and supply-chain path -| PR | Exact head | State | Current decision | -| --- | --- | --- | --- | -| #77 Rust toolchain | `2f96565b9452ea49627b28f7ae380e07b68af115` | Ready; auto-merge armed | The formerly stale Rust `1.97.1` pin was advanced by ordinary forward commits to current stable `1.98.0`. Exact-current CI/Security/SAST/Scorecard/OSV are queued; no predecessor result transfers. | -| #88 CO ownership repair | `98a935e4b058d0500d520425b8ebf6ff4106aa1b` | Architecture-blocked preservation lane | The direct LiteLLM virtual-key/provider/model proxy conflicts with contextual-orchestrator ownership. Preserve unique fail-closed credential grammar, header minimization, streaming, zero-upstream-hit, property/fuzz and RFC 6750 evidence; reconstruct valid Wardnet-owned gateway/admission deltas behind a released CO ACL instead of merging this shape. | -| #90 SIEM/OpenTelemetry export | `2d251183c41f49b07d443ff15fe9e54472d90f63` | Ready metadata; non-mergeable | Preserve the bounded OCSF/OTLP/RFC 5424 conversion and redaction evidence. Repair the stale/non-mergeable integration lineage non-force against current protected main and keep durable delivery/collector authentication/outbox ownership in #81/#85 rather than expanding this exporter. | -| #93 deterministic persistence faults | `e8a2b722c3c7dcbe0569130ccf937c6f2f755c12` | Ready, mergeable | The unique #74 delta is deterministic write/rename fault injection plus real-filesystem happy-path coverage. Reacquire exact-head gates on the synchronized candidate and merge only through ordinary protected policy. | -| #95 Coraza / broad production stack | `304f053013a76f11a03b5ed9b058ae1712f6ea12` | Ready metadata; non-mergeable and over-broad | Do not integrate this cross-context aggregate as-is. Preserve its unique PostgreSQL/outbox/Coraza/release tests and evidence, then transfer them into bounded #80/#81/#86/#84 successors before any retirement; wrong-base/non-mergeable state is a repair finding, not a Close reason. | -| #111 accepted ADR consolidation | `84cc6f6cee4bd29e8e9991a2646081c4febaca40` | Ready, mergeable | Current architecture text distinguishes protected truth from active-PR work and retains APA-backed decisions. Revalidate exact-head repository/security gates and ensure no feature-branch behavior is promoted to Accepted before ordinary merge. | -| #112 gateway route lifecycle | `bab3c72bb72e041ad494932ae07b0fb2401991ec` | Ready metadata; non-mergeable | Preserve item GET/conditional PUT/DELETE, ETag/If-Match, RBAC, persistence/audit and OpenAPI delta. Reconstruct non-force on current protected truth, preferably after #155 auth becomes protected, and reacquire attack/security/current-head evidence. | -| #114 product rename aggregate | `95da92339f21236326cdf4fb4aec5c7d0f909406` | Ready metadata; non-mergeable | The broad historical rename mixes package/runtime/deployment/resource migrations. Preserve still-unique compatibility/migration delta, but repair by bounded successors against current protected naming and #144 path migration rather than merging stale in-cluster renames wholesale. | -| #115 official threat-feed refresh | `aad8224ab664861b540bdf818e9580470cbe89fb` | Ready metadata; non-mergeable | Preserve source-registry, conditional refresh, last-known-good, attribution/terms and credential-boundary behavior. Reconstruct against current main after the shared Network-Egress policy is protected so feed I/O cannot retain a competing destination-security path. | -| #127 admin-console accessibility | `4e160077a6b163b03af65dfd16ac2a722dcbfbae` | Ready, mergeable; UI evidence incomplete | Source accessibility markup/tests are not sufficient release evidence. Add production-like browser E2E for keyboard/focus, accessible name/description, live-region semantics, responsive layouts, and loading/error/permission states under WCAG 2.2 AA before merge. | -| #129 Agent Artifact Admission | `85f0f6542a13bfdcc05024b51423851b33ae2ed8` | Draft, mergeable | Current source closes pnpmfile hook and Cargo build-variant authority gaps while preserving package-manager executable-family, indirect-source/root/index/workspace/config/TLS-trust defenses. Current inline review inventory has no unresolved source finding. Exact-head workflows have materialized but remain queued/pre-execution; keep Draft until terminal evidence exists. Retrieval-byte/provenance verification and hostile execution stay executor/quarantine-owned. | -| #130 product/technical gap baseline | `self (read live PR head)` | Draft, mergeable | This document is the current owning snapshot. Exact-head repository/security runs materialize on each content update and predecessor review/check evidence does not transfer. Keep Draft while live state changes and until current review findings plus then-live gates are resolved. | -| #134 support-bundle regression | `2b236057d6811cb7ca2ff4f01038796128f4fb6a` | Ready, mergeable | Test-only hardening binds support-bundle counts to KPI/evidence surfaces and rejects administrator-secret leakage. Fresh exact-head repository/security runs remain non-passing until terminal; preserve the narrow test-only scope. | -| #135 bounded local limiter | `e9547c556f7c5aeb244371035675a50ce5c82e6f` | Ready, mergeable | Bound attacker-controlled local limiter cardinality/TTL and retain stable 429 evidence while #83 keeps distributed/global authority separate. The PR body still cites an earlier synchronization commit; this exact head is authoritative and must reacquire current-head gates before merge. | -| #136 Network-Egress | `3cb1047416c3aa7fa8eb352b842cc55ad8c21b19` | Draft, executable RED pending source fix | Shared structural URL validation, resolved-address validation, DNS pinning, no ambient proxy/redirect, bounded client cache, response hop filtering, and architecture fitness are present. RED `f408500d8aeb4beb386caa48a7525508d59da193` requires one end-to-end deadline across manual DNS and remaining HTTP work; production deadline propagation plus a deterministic stalled-resolution runtime regression remain required. Exact-current CI is queued before source execution and CodeQL is startup-failed. #155 must become protected truth before final integration. | -| #140 Runtime Configuration | `9389a2d63f0875f688de5ef3adff1ce6b54e1ab1` | Ready; auto-merge armed | Review-derived environment-race, recursive architecture-fitness, bootstrap-authority and credential-path split defects are repaired/resolved. Current CodeQL is startup-failed and repository/central lanes remain queued; Credential Registry remains secret authority. | -| #141 CodeQL uploader | `fea3796a723080068cdc02e064065d6d53eeb3e0` | Ready; auto-merge armed | Immutable `github/codeql-action/upload-sarif` pin advances to v4.37.9; normal central/governance evidence still applies. | -| #144 Kubernetes path/public docs | `b07e4d21057df4dd4e706b584e5fad00338f20b6` | Ready; auto-merge armed | Hardened manifest source moves to `deploy/kubernetes/wardnet.yaml` without renaming live Kubernetes resources. Current exact-head repository/security lanes remain queued and CodeQL is startup-failed. | -| #153 explicit hosted runner | `b663f9d200e5f385c7dd067d074940a02836c68e` | Ready, clean stack root; auto-merge armed | Same-source repository CI/Fuzz/Security/SAST have terminal GREEN evidence. Current central runner/review/governance evidence is non-terminal, and stale same-SHA required evidence is proven capable of referring to superseded PR #147 rather than #153. A fresh #153-bound verdict is required; `ubuntu-slim` is only an acquisition canary. | -| #155 fail-closed management auth | `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` | Ready, main-based; auto-merge armed | Non-loopback startup fails closed without write-capable admin credentials; current review threads are resolved. Repository-owned CI/Fuzz/Security/SAST are terminal GREEN. Current-PR required OpenCode bootstrap, coverage source-tree, and coverage evidence are terminal successful; final `opencode-review` job `100659819151` remains pre-execution queued with `runner_id=0`. Issue #78 closes only after protected merge. | -| #156 operability evidence | `76037b8ae206ace8dab0e6622dfc9fc88c57deb3` | Draft, child of #153 | Preserve support-bundle/readiness evidence; reconstruct/restack on fresh protected main after #153 integrates, then regenerate all base-sensitive evidence. | -| #157 trusted proxy | `65a2b7fbf2827f69ae1aa288696b6c5630af28c4` | Draft, child of #153 | Preserve fail-closed forwarded-IP attribution. Reconstruct/restack after #153 protected merge. | -| #158 readiness metrics | `387a447f856093d02116dfadcf2c4a4a63c6d3ba` | Draft, child of #153 | Preserve readiness gauges using existing readiness/KPI authority. Reconstruct/restack after #153 protected merge. | -| #159 CI concurrency | `89176e2cc57088e4d772de9b1686ab89a3e69aeb` | Ready; auto-merge armed | PR runs use PR-number concurrency so new heads supersede obsolete PR executions; push runs use unique run IDs so pending protected-main commits cannot replace one another. Current repository/central evidence remains queued/startup-failing and `.github#712` owns the organization control-plane class. | -| #160 Scorecard deduplication | `b03037d4648a6282cb4029dff062ed7b55ff980a` | Draft; unresolved valid review finding | Deleting the leaf workflow now would remove default-branch push/scheduled SARIF refresh because central `scorecard-pr.yml` is PR-only. `.github#1777` is the canonical prerequisite. Keep Draft and do not resolve the finding until that central repair integrates and this PR is reconstructed/revalidated. | -| #162 commercial authority separation | `bd41d8430b269cbd9b440d225e1d53b28a4fe817` | Draft, mergeable | Separates the standing USD 20 billion software-sale quality ambition from the customer-contract readiness predicate. Runtime `TARGET_SALE_VALUE_KRW` remains 2B KRW; the canonical customer/readiness and USD 20B quality documents are distinct, and the old misleading path is retained only as a compatibility shim. Keep Draft until exact-head repository/security/coverage/review/governance evidence is terminal-valid. | +Wardnet still exposes no immutable GitHub Release. Issue #84 remains open and no branch may be represented as a production release merely because it can build an artifact. -Auto-merge state, where enabled, is state only, not protected truth or transferable evidence. A changed head/base must reacquire the then-live policy evidence. +Draft #164 is the new repository-owned release-evidence foundation. Its exact child head is `1d3f5a4bd618084031f3e722804b7c61303baeb5`. It was built from #77 parent `2f96565b9452ea49627b28f7ae380e07b68af115`; live #77 has since advanced to `46fef54c...` while repairing the deployment security finding, so #164 is currently non-mergeable and must be non-force restacked after #77 reaches protected main. -## Open issues and production order +#164's review-driven security lineage is nevertheless useful and must be preserved: -Fresh issue inventory is `#11, #38, #74, #75, #78, #79, #80, #81, #82, #83, #84, #85, #86, #87, #89, #128, #139, #161`. +- the PR-executable build/evidence job now has only `contents: read`; it cannot mint OIDC-backed attestations; +- attestation authority is isolated in a `workflow_dispatch`-only protected-main job with `id-token: write` and `attestations: write`; +- unnecessary `artifact-metadata: write` was removed; +- the attestation job downloads the exact SHA-named evidence bundle with an immutable `actions/download-artifact` pin, revalidates protected main, requested version, manifest source/version and SHA-256 records before provenance/SBOM attestation; +- a real zero-job workflow startup failure caused by job-level `runner.temp` use was reproduced and fixed by moving runner paths into step/runtime scope. -1. Immediate exposure controls: #78 through #155, #79 through #136 plus remaining allowlist/evidence/deadline work, #11 real attack-path CI, and #75 through #144. -2. Security admission: #128 through #129, without absorbing quarantine execution authority. -3. LLM ownership repair: keep #88 open but non-integrable and architecture-RED until contextual-orchestrator ships the released provider-neutral contract; then preserve only Wardnet-owned credential/admission/streaming defenses and remove direct LiteLLM/provider/model authority. -4. Durable authority/effects: #80 PostgreSQL production authority and tenant isolation, then #81 transactional outbox/leased workers. -5. Identity/overload: #82 Keyverse-backed authorization/approval and #83 distributed/global admission. #135 and #157 are bounded local/network-attribution slices rather than a second cluster authority. -6. Proven security engines: #86 Coraza/CRS and Suricata with detection and false-positive evidence. -7. Immutable delivery/operation: #84 signed artifact/SBOM/provenance/rollback, then #85 telemetry/SLO/incident/restore evidence and #87 final production-readiness closure on one immutable release identity. -8. Supporting correctness: #74 deterministic persistence fault testing, #77 pinned compiler, #139 coherent runtime configuration, #153 deterministic hosted-runner selection, #159 repository-local concurrency, and #161/#162 separation of the USD 20B software-sale quality bar from 2B KRW customer-contract readiness. #160 follows only after `.github#1777` establishes central default-branch Scorecard authority. +The repaired release workflow now materializes as run `33806666158`; build job `100818667579` remains queued before checkout with `runner_id=0`. Exact runner acceptance is on `.github#712`. #164 cannot tag, publish a GitHub Release, push an image, deploy, or promote from the feature branch. Final #84 evidence still needs immutable OCI identity/container-filesystem SBOM, admission-time verification, migration/canary/rollback and independent retention evidence on one protected release candidate. -Close an issue only after its owning protected merge satisfies the issue acceptance contract on current evidence. +## Scorecard and repository control-plane ownership -## DDD and implementation gaps +Draft #160 is exact `962623884347ccd52e653fb59504a7b848292086`. The first merged central reusable Scorecard owner (`.github@51b812d181989ed28366b5850d1a34f51df10187`) is not yet an acceptable immutable production pin because it uses Scorecard v2.4.3 while protected Wardnet already uses v2.4.4. `.github#1777` owns the forward-only reusable-owner repair. Wardnet must not restore a copied implementation or silently downgrade the scanner. -Agent Artifact Admission has a responsibility-aligned crate and domain-policy independence tests. Artifact retrieval verification, filesystem/mount/process isolation, and hostile execution remain downstream executor/quarantine responsibilities. +PR #153 remains the clean explicit-runner root at `b663f9d200e5f385c7dd067d074940a02836c68e`; #156/#157/#158 remain Draft children and are restacked only after #153 becomes protected truth. PR #159 retains PR-number concurrency and unique push run IDs so protected-main evidence is not replaced by another pending push. -The legacy gateway remains concentrated in root `src/lib.rs`. File size alone is not a decomposition criterion, but repeated change pressure across client attribution, outbound policy, runtime configuration, proxying, SOC integration, rate limiting, support evidence, and management APIs is a real modularity signal. Add dependency/ownership fitness before structural movement and prefer a modular monolith until transaction, deployment, scaling, or reuse evidence justifies another deployable. +## Context Fabric read-only boundary -Network-Egress remains incomplete after #136. Besides the resolver-deadline defect, #79 still requires versioned hostname/suffix/IP/CIDR/scheme/port allowlists, deterministic deny-overrides precedence, connector parity, minimized policy-decision evidence, and operator migration/rollback/diagnostics. +Fresh metadata still reports `develop` as default for both Context Graph Contracts and EA Core. In CGC, `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` is protected while `main` at the same commit is unprotected; there is no GitHub Release. Release-provenance prerequisite #25 remains Draft exact `187f45927e697cfad9ac5b2523dfd86b695aa072`; DDD child #20 is `475ce14185db697940e8219c3cda7f24d66f3ed7`; Context Assertion/CloudEvent admission child #21 is `5cfab7d4819b94f3679d649367868e60f9c0d55a` on stale ancestry. No open PR head is production contract authority. -The protected SOC LLM request builder and #88 show the same ownership drift from two directions: caller-supplied model authority in current main and a direct LiteLLM proxy in an old feature branch. The repair is not another Wardnet provider adapter. It is a released contextual-orchestrator ACL followed by a Wardnet consumer bump and removal of local provider/model authority, with fail-closed behavior until that immutable dependency exists. +In EA Core, `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4` is protected and current `main@ca6889497728e1a3f09d68790a9096576e13a3ff` is unprotected; there is no GitHub Release. Live parent #39 is `c063570bd9177578fa75be69defd81c99e6ba2f3`; Draft projection child #40 is exact `723b6b94cb8afceb69c185a9995ce6fbd2dd65a2` and remains non-mergeable on obsolete parent ancestry. It must fail closed on unreleased CGC transport/admission contracts and be rebuilt non-force by the Context Fabric owner. -PR #95 remains too broad to serve as the production integration vehicle. Preserve its unique PostgreSQL/outbox/Coraza tests and evidence while reconstructing bounded #80/#81/#86 successor work instead of merging a cross-context god-PR. +For both repositories, the accepted main/default transition is an owner-plane operational repair: protect main first, prove effective controls, switch default, re-read inherited rules, then rebuild roots/descendants. Wardnet does not mutate their source, refs, PR state, or branch topology. -The commercial product contract now has a dedicated correction path rather than encoding the USD 20B quality ambition as tenant pricing. #162 keeps the existing 2B KRW customer-readiness predicate separate from a buyer-visible USD 20B quality bar spanning security, operability, supply chain, release, integration, supportability, performance, and governance. +## Live Wardnet queue -## Research and standards grounding +Fresh open-PR inventory contains 27 lanes: -Standards constrain implementation and evidence; they do not prove controls are shipped. +`#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #153, #155, #156, #157, #158, #159, #160, #162, #164`. -- Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). *Zero trust architecture* (NIST SP 800-207). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-207. -- Souppaya, M., Scarfone, K., & Dodson, D. (2022). *Secure Software Development Framework (SSDF) version 1.1* (NIST SP 800-218). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-218. -- OWASP Foundation. (2025). *Application Security Verification Standard 5.0.0*. https://owasp.org/www-project-application-security-verification-standard/. -- Soldani, J., Tamburri, D. A., & van den Heuvel, W.-J. (2018). The pains and gains of microservices: A systematic grey literature review. *Journal of Systems and Software, 146*, 215–232. https://doi.org/10.1016/j.jss.2018.09.082. +The merge/rebuild order is responsibility- and prerequisite-driven rather than oldest-first: -The microservices evidence is used only to resist decomposition-by-file-size: deployable boundaries require responsibility, scaling, transaction, isolation, or reuse evidence that justifies their operating cost. +1. Protected exposure/security prerequisites: #155, then #77 when its repaired exact-head evidence is terminal; continue central governance/runner repair in parallel. +2. Network security: finish #136 DNS deadline/runtime RED and refresh it after #155 protected truth. +3. Supply chain: after #77 protected, non-force restack #164 and reacquire all release-evidence gates; #84 remains open until a real protected release identity exists. +4. Agent admission: finish #129 without absorbing quarantine execution or CO routing. +5. Control-plane foundations: #153, then restack #156/#157/#158; #159 can merge only on exact current deterministic/central evidence; #160 waits for the non-regressing central Scorecard owner. +6. Material UI #127 requires real-browser current-head WCAG 2.2 AA evidence for keyboard/focus, accessible name/description, responsive behavior and loading/error/permission states; source-string tests alone are insufficient. +7. #88 stays open but architecture-blocked until CO publishes a compatible immutable contract. Preserve unique credential/admission/streaming negative evidence while removing direct LiteLLM/provider/model authority in the eventual consumer reconstruction. +8. Broad/stale aggregates #90/#95/#112/#114/#115 are repair/transfer lanes, not Close candidates. Preserve unique OCSF/OTLP/syslog, PostgreSQL/outbox/Coraza, route lifecycle, rename/migration and official-feed deltas in bounded current-main successors before any retirement. +9. #162 remains the commercial-authority separation lane: the 2B KRW customer-readiness predicate is distinct from the standing USD 20B software-sale quality ambition. This file remains the sole writer for the product/technical gap baseline. -## Quality and release gates +Closed/no-delta predecessor #154 is not returned to the queue. A PR is retired only by protected merge, explicit user instruction, malicious/no-valid delta, or verified complete successor transfer of all useful code/tests/fixtures/contracts/evidence. -Wardnet-owned production code targets 100% statement/branch/edge-case coverage and complete public rustdoc/docstrings. Security-critical changes require realistic hostile/bypass/replay/race/DoS/network/cleanup tests and current-source verification of review findings. Coverage exclusions, source rewriting, skipped required paths, or statuses bound to another revision or PR identity are not evidence. +## Open production gaps -No release is authorized. Wardnet, Context Graph Contracts, EA Core, contextual-orchestrator, Quarantine Sandbox Runtime, and EgressWeave expose no usable immutable GitHub Release at this snapshot for the dependencies described above, and production release gate #87 remains open. Release requires one exact integrated protected head with CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence and immutable artifact identity. +The buyer-visible production order remains: -## Next execution order +- #78 fail-closed management authentication through #155; +- #79 complete outbound allowlist/deny-overrides/evidence/deadline semantics through #136 and successors; +- #11 real attack-path CI and #75 deployable public path hardening; +- #128 Agent Artifact Admission through #129; +- #80 PostgreSQL production authority/tenant isolation, then #81 transactional outbox/leased effects; +- #82 Keyverse-backed identity/approval and #83 distributed/global admission without duplicating local limiter authority; +- #86 proven Coraza/CRS and Suricata detection with false-positive evidence; +- #84 immutable artifact/SBOM/provenance/reproducibility/rollback; +- #85 telemetry/SLO/incident/restore evidence; +- #87 final production-readiness closure only against one immutable protected release identity. -1. Continue #153/#155/#144/#159/#140/#141/#77 through current exact-head gates while `.github#712` repairs runner/evidence identity and `.github#1644` repairs solo-maintainer/bypass ruleset semantics. Merged `.github#1719` is protected source truth for the canonical nine required workflows; CodeQL remains a separate security/control-plane lane rather than a ruleset-required workflow. -2. Keep #160 Draft while `.github#1777` establishes reusable default-branch Scorecard posture refresh; then rebuild it as an exact-SHA thin caller rather than deleting security evidence authority. -3. Preserve #156/#157/#158 until #153 is protected, then non-force reconstruct/restack each child on fresh main and reacquire all evidence. -4. Repair #136's DNS-resolution deadline defect test-first with one shared operation deadline and a deterministic stalled-resolution runtime regression; after #155 becomes protected truth, refresh #136 against live main and revalidate. -5. Finish #129 as one Agent Artifact Admission bounded context without absorbing quarantine or Agent/LLM orchestration. -6. Keep #88 open and architecture-blocked while contextual-orchestrator completes canonical routing/client work and publishes an immutable compatible release; then reconstruct the Wardnet consumer slice against that released contract without direct model/provider authority. -7. Keep #162 Draft until its exact-head product-contract regression and then-live deterministic/security/coverage/review/governance evidence are terminal-valid; do not restore the closed #154 KRW-20B remapping. -8. Repair/restack every remaining open lane rather than letting it disappear from the queue: #90/#93/#111/#127/#134/#135 can be drained once exact-head evidence is current; #112/#114/#115 require non-force reconstruction against current protected truth; #95 must transfer its unique cross-context evidence into bounded successors before retirement. -9. Continue #82/#83/#84/#85 only after their declared prerequisites become protected/released truth; close #87 only against one immutable protected release candidate satisfying the full production gate. -10. Refresh this baseline whenever protected truth, queue topology, release state, or responsibility boundaries materially change. +The root `src/lib.rs` remains a modularity pressure point, but file size alone does not justify a service split. Add dependency/ownership fitness first; prefer a modular monolith until transaction, isolation, scale, deployment or reuse evidence pays for another deployable boundary. + +## Standards and evidence + +Implementation and evidence remain grounded in current authoritative standards and primary/peer-reviewed work; citations constrain the design but do not prove a control is shipped. + +- Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). *Zero trust architecture* (NIST SP 800-207). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-207 +- Souppaya, M., Scarfone, K., & Dodson, D. (2022). *Secure Software Development Framework (SSDF) version 1.1* (NIST SP 800-218). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-218 +- OWASP Foundation. (2025). *Application Security Verification Standard 5.0.0*. https://owasp.org/www-project-application-security-verification-standard/ +- Lamb, C., & Zacchiroli, S. (2021). Reproducible builds: Increasing the integrity of software supply chains. *arXiv*. https://arxiv.org/abs/2104.06020 +- Soldani, J., Tamburri, D. A., & van den Heuvel, W.-J. (2018). The pains and gains of microservices: A systematic grey literature review. *Journal of Systems and Software, 146*, 215–232. https://doi.org/10.1016/j.jss.2018.09.082 + +Wardnet-owned production code targets 100% statement/branch/edge-case coverage and complete public rustdoc/docstrings. Security changes require realistic bypass/replay/race/DoS/network/cleanup tests and exact-source verification. Coverage exclusions, skipped paths, startup-failed/queued jobs, or evidence bound to another head/PR identity are not passing evidence. + +## Release gate + +No release is authorized at this snapshot. Wardnet, Context Graph Contracts, EA Core and the canonical external owners required by current integration work do not yet expose the complete compatible immutable release chain needed by Wardnet. + +Release requires one exact integrated protected head with current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact identity, and a verified publication path. A feature-branch artifact or attestation is evidence for the branch only; it is not a Wardnet release. From 6292b2b9bae4742386d980105fbf51c07422860f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 06:26:40 +0900 Subject: [PATCH 47/73] docs(gaps): adopt current EA projection head --- docs/product-technical-gap-baseline.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 6bca358b..ebc63b23 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -34,9 +34,9 @@ Required OpenCode run `33590351182` has terminal-success bootstrap `100122902000 PR #77 is Ready/mergeable at exact `46fef54c9b5916eb77196fb515a8fabad13a05d1`. In addition to pinning Rust `1.98.0`, the current lineage repairs a valid CodeRabbit security finding in the Kubernetes deployment regression contract. -RED `43d2c874732063e418b3929e3435c388ccfa7c69` proved that first-match `find_map` validation could accept a valid first `Deployment` while ignoring a later YAML document with the same `waf-ids-ai-soc/waf-ids-ai-soc` resource identity. GREEN `17a2a1e833e6c4cab6101ef6a534589d75a5920a` requires exactly one canonical target Deployment and adds a hostile duplicate-resource regression whose second document contains a literal `ADMIN_TOKEN`. Cleanup/current `46fef54c...` removes only the temporary source-text RED scaffold; the behavior-level regression remains. +RED `43d2c874732063e418b3929e3435c388ccfa7c69` proved that first-match `find_map` validation could accept a valid first `Deployment` while ignoring a later YAML document with the same `waf-ids-ai-soc/waf-ids-ai-soc` resource identity. GREEN `17a2a1e833e6c4cab6101ef6a534589d75a5920a` requires exactly one canonical target Deployment and adds a hostile duplicate-resource regression whose second document contains a literal `ADMIN_TOKEN`. Cleanup/current `46fef54c...` removes only the temporary source-text RED scaffold; the behavior-level regression remains. CodeRabbit subsequently revalidated the exact source and resolved that review thread; no review record is represented as independent human approval. -Fresh current-head CI `33807338426`, Security `33807338277`, SAST `33807338221`, Scorecard `33807338399`, and OSV `33807339076` are queued. The review thread stays unresolved until exact-current-head GREEN exists; source repair alone is not terminal verification. +Fresh current-head CI `33807338426`, Security `33807338277`, SAST `33807338221`, Scorecard `33807338399`, and OSV `33807339076` remain queued. Thread resolution therefore does not make the head merge-ready; exact-current-head execution is still required. ### #136 — Network-Egress DNS deadline defect @@ -74,9 +74,11 @@ PR #153 remains the clean explicit-runner root at `b663f9d200e5f385c7dd067d07494 ## Context Fabric read-only boundary -Fresh metadata still reports `develop` as default for both Context Graph Contracts and EA Core. In CGC, `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` is protected while `main` at the same commit is unprotected; there is no GitHub Release. Release-provenance prerequisite #25 remains Draft exact `187f45927e697cfad9ac5b2523dfd86b695aa072`; DDD child #20 is `475ce14185db697940e8219c3cda7f24d66f3ed7`; Context Assertion/CloudEvent admission child #21 is `5cfab7d4819b94f3679d649367868e60f9c0d55a` on stale ancestry. No open PR head is production contract authority. +Fresh metadata still reports `develop` as default for both Context Graph Contracts and EA Core. In CGC, `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` is protected while `main` at the same commit is unprotected; there is no GitHub Release. Release-provenance prerequisite #25 remains Draft exact `187f45927e697cfad9ac5b2523dfd86b695aa072` and its current `ci 33730255529`, `reproducibility 33730255596`, `receipt-package-smoke 33730255606`, and `supply-chain 33730255626` are terminal GREEN on that recorded ancestry. DDD child #20 is `475ce14185db697940e8219c3cda7f24d66f3ed7`; Context Assertion/CloudEvent admission child #21 is `5cfab7d4819b94f3679d649367868e60f9c0d55a` on stale ancestry with zero PR workflow runs. No open PR head is production contract authority. -In EA Core, `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4` is protected and current `main@ca6889497728e1a3f09d68790a9096576e13a3ff` is unprotected; there is no GitHub Release. Live parent #39 is `c063570bd9177578fa75be69defd81c99e6ba2f3`; Draft projection child #40 is exact `723b6b94cb8afceb69c185a9995ce6fbd2dd65a2` and remains non-mergeable on obsolete parent ancestry. It must fail closed on unreleased CGC transport/admission contracts and be rebuilt non-force by the Context Fabric owner. +In EA Core, `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4` is protected and current `main@ca6889497728e1a3f09d68790a9096576e13a3ff` is unprotected; there is no GitHub Release. Live parent #39 is `c063570bd9177578fa75be69defd81c99e6ba2f3`; Draft projection child #40 has advanced to exact `53a57266bccb603c114d0cf147d31541b23ce7e8` and remains non-mergeable on obsolete parent ancestry. + +#40's new child-owned compatibility repair must survive eventual reconstruction: RED `e49e053e3a637be8db8bf68ca5778f90ad2e02dd` adds real-PostgreSQL acceptance for CGC-admitted `application/cloudevents+json` structured media types with optional UTF-8 charset and SP/HTAB OWS while rejecting CR/VT/FF; GREEN `53a57266...` adds forward migration `0052_context_assertion_projection_media_type.sql` with the same fail-closed grammar. Fresh exact-head workflow lookup returns zero PR runs, so the source/PostgreSQL-test delta is not remote GREEN and predecessor `723b6b94...` evidence does not transfer. #40 must continue to fail closed on unreleased CGC contracts. For both repositories, the accepted main/default transition is an owner-plane operational repair: protect main first, prove effective controls, switch default, re-read inherited rules, then rebuild roots/descendants. Wardnet does not mutate their source, refs, PR state, or branch topology. From 19bdea230944fb1c2cc500d0469cdf47b902e728 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 11:06:16 +0900 Subject: [PATCH 48/73] docs(gaps): refresh live security evidence --- docs/product-technical-gap-baseline.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index ebc63b23..538e5a1d 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -28,7 +28,7 @@ Runner acquisition remains separate central control-plane work under `.github#71 PR #155 remains exact `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` on protected main and is mechanically mergeable. Repository-owned CI `33590350994`, Fuzz `33590350997`, Security Scan `33590350967`, and SAST `33590350991` are terminal GREEN; current inline review threads are resolved. -Required OpenCode run `33590351182` has terminal-success bootstrap `100122902000`, coverage-source-tree `100272722468`, and coverage-evidence `100479589911`. Only `opencode-review` `100659819151` remains queued before checkout with `runner_id=0` and zero steps. This exact current-PR identity is already handed to `.github#712`; the same SHA's predecessor #138 evidence is not transferable. #78 closes only after this delta reaches protected main through satisfiable ordinary governance. +Required OpenCode run `33590351182` has terminal-success bootstrap `100122902000`, coverage-source-tree `100272722468`, and coverage-evidence `100479589911`. Current-PR `opencode-review` job `100659819151` has now transitioned from pre-checkout queueing to actual execution without any Wardnet source churn: it acquired GitHub-hosted runner `1001655142`, started at `2026-09-04T01:37:43Z`, completed setup and the current-head review request, and is still `in_progress` at the fail-closed current-head verdict boundary. This state transition is recorded on `.github#712` as issue comment `5534622023`; do not rerun while the job is legitimately executing. Same-SHA predecessor #138 evidence remains non-transferable. #78 closes only after this exact delta reaches protected main through satisfiable ordinary governance. ### #77 — Rust toolchain plus duplicate-Deployment fail-closed review repair @@ -46,9 +46,9 @@ The current RED is real and source-bearing: `validated_outbound_http_client` awa ## Agent Artifact Admission -Draft #129 is exact `75f003e4c76182280011ca7ef63a952b7ab89b5a`. It owns the pre-execution structured artifact-install admission boundary and keeps hostile execution downstream. Current policy covers executable/ecosystem binding, exact coordinates/digests, indirect source/config/root/workspace/TLS authority, lifecycle-script/trust/integrity bypasses, Cargo build variants, and OCI platform ambiguity. +Draft #129 is exact `de69e7151913d246f4f1dffec08428aa32b2dc60`. It owns the pre-execution structured artifact-install admission boundary and keeps hostile execution downstream. Current policy covers executable/ecosystem binding, exact coordinates/digests, indirect source/config/root/workspace/TLS authority, lifecycle-script/trust/integrity bypasses, Cargo build variants, OCI platform ambiguity, and caller-selected Podman registry trust weakening. -The current candidate adds fail-closed OCI platform-variant handling and hostile/edge coverage while preserving the public reason-code contract. Current workflows are queued/pre-execution, so keep Draft until exact-head deterministic/security/review evidence is terminal. Retrieved-byte or equivalent provenance verification and hostile execution remain executor/quarantine responsibilities. +The current candidate rejects Docker/Podman platform selectors that are not represented by the approved artifact identity and also blocks Podman `--tls-verify=false` accepted false spellings plus caller-selected `--cert-dir` as alternate registry trust authority, while preserving explicit TLS verification. Exact-current CI `33816557436`, Fuzz `33816557351`, Security Scan `33816557337`, SAST `33816557347`, Scorecard `33816557380`, and OSV `33816557766` remain queued/non-passing. Retrieved-byte or equivalent provenance verification and hostile execution remain executor/quarantine responsibilities. ## Release and supply-chain path @@ -68,7 +68,7 @@ The repaired release workflow now materializes as run `33806666158`; build job ` ## Scorecard and repository control-plane ownership -Draft #160 is exact `962623884347ccd52e653fb59504a7b848292086`. The first merged central reusable Scorecard owner (`.github@51b812d181989ed28366b5850d1a34f51df10187`) is not yet an acceptable immutable production pin because it uses Scorecard v2.4.3 while protected Wardnet already uses v2.4.4. `.github#1777` owns the forward-only reusable-owner repair. Wardnet must not restore a copied implementation or silently downgrade the scanner. +Draft #160 is exact `962623884347ccd52e653fb59504a7b848292086`. The first merged central reusable Scorecard owner (`.github@51b812d181989ed28366b5850d1a34f51df10187`) is not an acceptable immutable production pin because it uses Scorecard v2.4.3 while protected Wardnet already uses v2.4.4. Canonical owner repair `.github#1275` has now been non-force reconciled and is Ready/mergeable at exact `61a8197a753e01d3275371d77b035ed44f6135eb` on protected `.github/main@07d9ec23fb265c76539d23249e1dfa124ea7b23b`, but all of its current owner workflows remain queued. Wardnet #160 therefore still waits for that lane to execute terminal-clean and merge normally so it can consume the resulting immutable protected owner SHA. Wardnet must not pin the mutable owner PR head, restore a copied implementation, or silently downgrade the scanner. PR #153 remains the clean explicit-runner root at `b663f9d200e5f385c7dd067d074940a02836c68e`; #156/#157/#158 remain Draft children and are restacked only after #153 becomes protected truth. PR #159 retains PR-number concurrency and unique push run IDs so protected-main evidence is not replaced by another pending push. @@ -76,9 +76,9 @@ PR #153 remains the clean explicit-runner root at `b663f9d200e5f385c7dd067d07494 Fresh metadata still reports `develop` as default for both Context Graph Contracts and EA Core. In CGC, `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` is protected while `main` at the same commit is unprotected; there is no GitHub Release. Release-provenance prerequisite #25 remains Draft exact `187f45927e697cfad9ac5b2523dfd86b695aa072` and its current `ci 33730255529`, `reproducibility 33730255596`, `receipt-package-smoke 33730255606`, and `supply-chain 33730255626` are terminal GREEN on that recorded ancestry. DDD child #20 is `475ce14185db697940e8219c3cda7f24d66f3ed7`; Context Assertion/CloudEvent admission child #21 is `5cfab7d4819b94f3679d649367868e60f9c0d55a` on stale ancestry with zero PR workflow runs. No open PR head is production contract authority. -In EA Core, `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4` is protected and current `main@ca6889497728e1a3f09d68790a9096576e13a3ff` is unprotected; there is no GitHub Release. Live parent #39 is `c063570bd9177578fa75be69defd81c99e6ba2f3`; Draft projection child #40 has advanced to exact `53a57266bccb603c114d0cf147d31541b23ce7e8` and remains non-mergeable on obsolete parent ancestry. +In EA Core, `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4` is protected and current `main@ca6889497728e1a3f09d68790a9096576e13a3ff` is unprotected; there is no GitHub Release. Live parent #39 is `c063570bd9177578fa75be69defd81c99e6ba2f3`; Draft projection child #40 is exact `4d16d3c5243591d5c440866536f9a3fdca16358c` and remains non-mergeable on obsolete parent ancestry. -#40's new child-owned compatibility repair must survive eventual reconstruction: RED `e49e053e3a637be8db8bf68ca5778f90ad2e02dd` adds real-PostgreSQL acceptance for CGC-admitted `application/cloudevents+json` structured media types with optional UTF-8 charset and SP/HTAB OWS while rejecting CR/VT/FF; GREEN `53a57266...` adds forward migration `0052_context_assertion_projection_media_type.sql` with the same fail-closed grammar. Fresh exact-head workflow lookup returns zero PR runs, so the source/PostgreSQL-test delta is not remote GREEN and predecessor `723b6b94...` evidence does not transfer. #40 must continue to fail closed on unreleased CGC contracts. +#40's current lineage preserves the real-PostgreSQL structured-CloudEvent media-type repair—RED `e49e053e3a637be8db8bf68ca5778f90ad2e02dd`, GREEN migration `0052_context_assertion_projection_media_type.sql`—and the bounded Noema Context Fabric projection. EA accepts only deployable/runtime/service/API/worker capability and technology/lifecycle/ownership/risk/remediation/transformation context through released Context Assertion admission; Agent task/result/reasoning, tool payload, workflow/checkpoint/prompt/model/user-business-data authority and direct foreign DB/source copying remain prohibited. Fresh exact-head workflow lookup for `4d16d3c...` returns zero PR runs, so no predecessor evidence transfers and #40 must continue to fail closed on unreleased CGC contracts. For both repositories, the accepted main/default transition is an owner-plane operational repair: protect main first, prove effective controls, switch default, re-read inherited rules, then rebuild roots/descendants. Wardnet does not mutate their source, refs, PR state, or branch topology. @@ -135,4 +135,4 @@ Wardnet-owned production code targets 100% statement/branch/edge-case coverage a No release is authorized at this snapshot. Wardnet, Context Graph Contracts, EA Core and the canonical external owners required by current integration work do not yet expose the complete compatible immutable release chain needed by Wardnet. -Release requires one exact integrated protected head with current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact identity, and a verified publication path. A feature-branch artifact or attestation is evidence for the branch only; it is not a Wardnet release. +Release requires one exact integrated protected head with current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact identity, and a verified publication path. A feature-branch artifact or attestation is evidence for the branch only; it is not a Wardnet release. \ No newline at end of file From 40490e6d5e72cde06c27ac5ba3718a90fd07e3b6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 15:12:54 +0900 Subject: [PATCH 49/73] docs(gaps): refresh exact-head security baseline --- docs/product-technical-gap-baseline.md | 100 ++++++++++++------------- 1 file changed, 46 insertions(+), 54 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 538e5a1d..3742131d 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,86 +1,80 @@ # Product and technical gap baseline -Snapshot date: 2026-09-04. This file records the current commercial/security integration baseline, not a substitute for live GitHub state. Before merge, release, restack, or foreign-owner handoff, re-read exact heads/bases, reviews/threads, checks, rulesets, releases, and branch protection. +Snapshot date: 2026-09-04. This file is the Wardnet-owned commercial/security integration baseline. It is not a substitute for live GitHub state: before merge, release, restack, or foreign-owner handoff, re-read exact heads/bases, reviews/threads, checks, security results, rulesets, releases, and branch protection. ## Product and authority boundary Wardnet is the Rust-first gateway/SOC control plane. Its owned bounded contexts are Gateway, Admission Policy, Artifact Identity, Security Analysis Integration, Network-Egress, SOC Evidence, Runtime Control, Audit-Provenance, and Agent Artifact Admission. Wardnet does not execute hostile workloads and does not own model/provider routing. -`quarantine-sandbox-runtime` owns hostile execution isolation/lifecycle/cleanup. `contextual-orchestrator` owns Agent/LLM orchestration, provider/model/key discovery and routing. EgressWeave is the outbound HTTP-policy candidate. `appguardrail` retains its own application-guardrail authority. Wardnet consumes only released/versioned ports or Anti-Corruption Layers and does not copy foreign source or use cross-service SQL. +`quarantine-sandbox-runtime` owns hostile execution isolation, lifecycle, cleanup, and artifact-analysis execution. `contextual-orchestrator` owns Agent/LLM orchestration plus provider/model/key discovery and routing. EgressWeave is the canonical outbound HTTP-policy candidate. `appguardrail` retains application-guardrail authority. Wardnet consumes released/versioned ports or Anti-Corruption Layers only; it does not copy foreign implementations or use cross-service SQL. -`context-graph-contracts` is the provider-neutral Context Fabric Shared Kernel for canonical object/authority references, truth status/origin, valid/system time, provenance, Context Assertion, CloudEvents/schema/conformance/admission. `enterprise-architecture-core` is the EA Decision Plane. Both repositories are read-only dependencies from this Wardnet writer while the Context Fabric owner loop is active; security findings/verdicts are not copied into EA as authoritative facts. +`context-graph-contracts` is the provider-neutral Context Fabric Shared Kernel for canonical object/authority references, truth status/origin, valid/system time, provenance, Context Assertion, CloudEvents, schemas, conformance, and shared admission grammar. `enterprise-architecture-core` is the EA Decision Plane. Both are read-only dependencies from this Wardnet lane while the Context Fabric owner loop is active. Wardnet security findings and verdicts remain Wardnet evidence; EA may reference validated risk/remediation evidence but must not copy those verdicts as authoritative architecture facts. -The optional SOC LLM seam in protected Wardnet still has ownership debt: provider/model selection must ultimately disappear behind a released contextual-orchestrator contract. No mutable CO branch may be promoted as production authority while CO has no compatible immutable release. +The optional SOC LLM seam remains ownership debt until a compatible immutable `contextual-orchestrator` release exists. No mutable CO branch, direct provider key, provider/model selector, or paid fallback is production authority for Wardnet. ## Protected truth and central governance -Protected/default Wardnet `main` remains `cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. It contains the externally provisioned, non-optional Kubernetes administrator Secret boundary from protected PR #137. Wardnet still has no GitHub Release. +Protected/default Wardnet `main` is `cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. Wardnet still exposes no GitHub Release. -Live organization ruleset `18156473` remains active on `~DEFAULT_BRANCH` with `required_approving_review_count=1`, `required_reviewers=[]`, no code-owner or last-push approval requirement, required thread resolution, nine central required workflows, deletion/non-fast-forward protection, and `OrganizationAdmin/always` bypass. Under the declared solo-maintainer model, the generic approval count is structurally unsatisfiable without forbidden self/model approval; the bypass is not routine merge authorization. +Live organization ruleset `18156473` targets `~DEFAULT_BRANCH` and still carries a generic one-approval requirement with no required reviewer/team, required conversation resolution, central required workflows, deletion/non-fast-forward protection, and routine `OrganizationAdmin/always` bypass. Under the declared solo-maintainer model, self-approval and model/bot-as-human approval remain forbidden. The bare approval count and routine bypass are central governance defects, not a reason to weaken Wardnet. `.github#772` and its live successor own reconciliation while deterministic CI/security/coverage/SBOM/provenance/thread/branch-integrity controls remain intact. -The owner repair remains `.github#1644@c94faa446774d012d684304fb0ac505d03e2f765` / #772. Fresh protected `.github/main` is `07d9ec23fb265c76539d23249e1dfa124ea7b23b`; #1644 is 19 protected-main commits behind/diverged and must adopt the intervening owner delta non-force before its governance evidence can become current. The intended repair keeps deterministic workflow/security/thread/deletion/non-fast-forward controls while removing the impossible generic approval requirement and routine bypass semantics. Source integration alone is not live-ruleset convergence. - -Runner acquisition remains separate central control-plane work under `.github#712`. A queued/pre-checkout job with `runner_id=0`, no runner/group identity and `steps=[]` is non-passing evidence but not a reason to churn Wardnet source, downgrade runners, reuse predecessor evidence, or bypass a required gate. +Runner/event/review materialization is separately owned by `.github#712` and related central control-plane lanes. `queued`, pre-checkout `runner_id=0`, empty `steps`, startup-failed CodeQL, and a model-review request that never produces a current-head verdict are non-passing evidence. They are not reasons for no-op consumer churn, runner downgrades, predecessor-evidence reuse, or routine bypass. ## Immediate protected-main security path ### #155 — fail-closed management authentication -PR #155 remains exact `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` on protected main and is mechanically mergeable. Repository-owned CI `33590350994`, Fuzz `33590350997`, Security Scan `33590350967`, and SAST `33590350991` are terminal GREEN; current inline review threads are resolved. +PR #155 remains Ready/mergeable at exact `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` on protected `main@cc15cc2c34daf8c104754eb83d52a6a66f3cd6e128`. Repository-owned CI `33590350994`, Fuzz `33590350997`, Security Scan `33590350967`, and SAST Semgrep `33590350991` are terminal GREEN; returned inline review threads are resolved. -Required OpenCode run `33590351182` has terminal-success bootstrap `100122902000`, coverage-source-tree `100272722468`, and coverage-evidence `100479589911`. Current-PR `opencode-review` job `100659819151` has now transitioned from pre-checkout queueing to actual execution without any Wardnet source churn: it acquired GitHub-hosted runner `1001655142`, started at `2026-09-04T01:37:43Z`, completed setup and the current-head review request, and is still `in_progress` at the fail-closed current-head verdict boundary. This state transition is recorded on `.github#712` as issue comment `5534622023`; do not rerun while the job is legitimately executing. Same-SHA predecessor #138 evidence remains non-transferable. #78 closes only after this exact delta reaches protected main through satisfiable ordinary governance. +Required OpenCode run `33590351182` has terminal-success bootstrap `100122902000`, coverage-source-tree `100272722468`, and coverage-evidence `100479589911`. Final `opencode-review` job `100659819151` did acquire GitHub-hosted runner `1001655142`, completed setup and the authenticated current-head review request, then remained at the fail-closed verdict boundary until the administrative three-hour limit and ended `cancelled` around `2026-09-04T04:37:15Z`. The current defect is therefore verdict materialization/timeout semantics, not runner acquisition. Exact evidence and GREEN acceptance are on `.github#712` comment `5535918616`. Do not rerun-storm this unchanged head. #78 closes only when this exact or a verified successor delta reaches protected main through satisfiable ordinary governance. -### #77 — Rust toolchain plus duplicate-Deployment fail-closed review repair +### #77 — Rust toolchain plus duplicate-Deployment fail-closed repair -PR #77 is Ready/mergeable at exact `46fef54c9b5916eb77196fb515a8fabad13a05d1`. In addition to pinning Rust `1.98.0`, the current lineage repairs a valid CodeRabbit security finding in the Kubernetes deployment regression contract. +PR #77 is Ready/mergeable at exact `46fef54c9b5916eb77196fb515a8fabad13a05d1`. The lineage pins Rust `1.98.0` and repairs a valid duplicate-Kubernetes-Deployment security finding. -RED `43d2c874732063e418b3929e3435c388ccfa7c69` proved that first-match `find_map` validation could accept a valid first `Deployment` while ignoring a later YAML document with the same `waf-ids-ai-soc/waf-ids-ai-soc` resource identity. GREEN `17a2a1e833e6c4cab6101ef6a534589d75a5920a` requires exactly one canonical target Deployment and adds a hostile duplicate-resource regression whose second document contains a literal `ADMIN_TOKEN`. Cleanup/current `46fef54c...` removes only the temporary source-text RED scaffold; the behavior-level regression remains. CodeRabbit subsequently revalidated the exact source and resolved that review thread; no review record is represented as independent human approval. +RED `43d2c874732063e418b3929e3435c388ccfa7c69` proved a first-match manifest validator could accept a valid target Deployment while a later YAML document with the same resource identity weakened the administrator Secret boundary. GREEN `17a2a1e833e6c4cab6101ef6a534589d75a5920a` requires exactly one canonical target Deployment and adds a hostile duplicate-resource regression. Current `46fef54c...` removes only the temporary source-text RED scaffold; the behavioral regression remains. The finding thread is resolved, but fresh exact-head CI `33807338426`, Security `33807338277`, SAST `33807338221`, Scorecard `33807338399`, and OSV `33807339076` remain queued/non-passing. -Fresh current-head CI `33807338426`, Security `33807338277`, SAST `33807338221`, Scorecard `33807338399`, and OSV `33807339076` remain queued. Thread resolution therefore does not make the head merge-ready; exact-current-head execution is still required. +### #136 — Network-Egress DNS deadline repair -### #136 — Network-Egress DNS deadline defect +Draft #136 is now exact `28e5776388b2fc31e1d0567382871a1f599aa3ed` on protected `main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`, and GitHub reports it mergeable. -Draft #136 remains exact `3cb1047416c3aa7fa8eb352b842cc55ad8c21b19`. Its shared outbound client already rejects dangerous literal destinations, validates/pins resolved addresses, disables ambient proxy/redirect behavior, bounds client-cache lifetime, and retains executable ownership fitness. +The original source-bearing RED remains immutable evidence: head `3cb1047416c3aa7fa8eb352b842cc55ad8c21b19` produced terminal CI failure `33698726857` at `phishing_feed_dns_resolution_shares_the_end_to_end_operation_deadline`, proving manual DNS resolution could outlive the intended feed/TAXII/KEV operation timeout. -The current RED is real and source-bearing: `validated_outbound_http_client` awaits manual DNS resolution before the caller's request timeout begins. CI `33698726857` fails the intended end-to-end deadline contract. GREEN requires one absolute operation deadline shared across DNS validation and remaining HTTP work plus a deterministic stalled/delayed resolver runtime seam. Feed-specific/SOC/proxy timeout semantics must remain explicit; do not apply one phishing-feed constant globally. Final integration also follows protected #155 auth truth. +Production repair was present by `9978f8c643433b5df0398e3d9f3608546fdadecd`: callers establish one absolute `tokio::time::Instant` deadline before destination validation, `validated_outbound_http_client` wraps the actual `lookup_host` future with `tokio::time::timeout_at(deadline, resolution)`, and request I/O receives only the remaining budget. Current head `28e5776388...` completes the deterministic acceptance by binding the architecture fence to that exact resolver primitive and exercising a forever-pending resolver surrogate against the shared deadline. Clearfolio/SOC/proxy timeout semantics remain separate. -## Agent Artifact Admission +Exact-current CI `33842763514`, Fuzz `33842763449`, Security Scan `33842763513`, and SAST Semgrep `33842763530` are queued. CI job `100928237991` is pre-checkout with `steps=[]` and `runner_id=0`. Exact runner evidence and acceptance are on `.github#712` comment `5536431288`. The DNS review thread intentionally remains unresolved until this unchanged head actually executes the regression and the relevant exact-head gate is terminal GREEN. After #155 becomes protected truth, refresh/revalidate #136 against the new protected base before integration. -Draft #129 is exact `de69e7151913d246f4f1dffec08428aa32b2dc60`. It owns the pre-execution structured artifact-install admission boundary and keeps hostile execution downstream. Current policy covers executable/ecosystem binding, exact coordinates/digests, indirect source/config/root/workspace/TLS authority, lifecycle-script/trust/integrity bypasses, Cargo build variants, OCI platform ambiguity, and caller-selected Podman registry trust weakening. +## Agent Artifact Admission -The current candidate rejects Docker/Podman platform selectors that are not represented by the approved artifact identity and also blocks Podman `--tls-verify=false` accepted false spellings plus caller-selected `--cert-dir` as alternate registry trust authority, while preserving explicit TLS verification. Exact-current CI `33816557436`, Fuzz `33816557351`, Security Scan `33816557337`, SAST `33816557347`, Scorecard `33816557380`, and OSV `33816557766` remain queued/non-passing. Retrieved-byte or equivalent provenance verification and hostile execution remain executor/quarantine responsibilities. +Draft #129 is exact `3a63247e412d17b7bbee2a1d1668dfc84adf1280`, mergeable on protected `main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. It owns the pre-execution structured artifact-install security admission boundary; it does not fetch or execute hostile workloads. -## Release and supply-chain path +The current lineage fail-closes executable/ecosystem confusion, undeclared operands, indirect source/config/workspace/root authority, lifecycle-script/trust/integrity bypasses, Cargo build variants, OCI platform ambiguity, Podman registry trust weakening, and repository-wide mutable OCI pull expansion. The latest RED `d7f429c37a3bd26ea746254defc5d65f33ef71f2` proves Docker/Podman `-a` / `--all-tags` can widen one reviewed digest pull into a mutable repository-wide artifact set; GREEN `7f06137453dc2296e4c4ac8c439777bf19ba7244` makes those switches fail closed as `artifact_not_approved`, and current `3a63247e...` carries the supporting primary Docker/Podman/NIST traceability. -Wardnet still exposes no immutable GitHub Release. Issue #84 remains open and no branch may be represented as a production release merely because it can build an artifact. +Exact-current CI `33825032608`, Fuzz `33825032507`, Security Scan `33825032518`, SAST `33825032753`, Scorecard `33825032564`, and OSV `33825033384` remain queued/non-passing. Returned inline threads are resolved. Cross-owner naming evidence is already handed to `context-graph-contracts#27` and `enterprise-architecture-core#45`: Wardnet owns pre-execution artifact security admission; Noema owns governed activation/orchestration. A released shared contract must preserve those producer authorities rather than collapse one receipt into the other. -Draft #164 is the new repository-owned release-evidence foundation. Its exact child head is `1d3f5a4bd618084031f3e722804b7c61303baeb5`. It was built from #77 parent `2f96565b9452ea49627b28f7ae380e07b68af115`; live #77 has since advanced to `46fef54c...` while repairing the deployment security finding, so #164 is currently non-mergeable and must be non-force restacked after #77 reaches protected main. +## Release and supply-chain path -#164's review-driven security lineage is nevertheless useful and must be preserved: +Wardnet still has no immutable GitHub Release. Issue #84 remains open; a feature-branch build or attestation is not a production release. -- the PR-executable build/evidence job now has only `contents: read`; it cannot mint OIDC-backed attestations; -- attestation authority is isolated in a `workflow_dispatch`-only protected-main job with `id-token: write` and `attestations: write`; -- unnecessary `artifact-metadata: write` was removed; -- the attestation job downloads the exact SHA-named evidence bundle with an immutable `actions/download-artifact` pin, revalidates protected main, requested version, manifest source/version and SHA-256 records before provenance/SBOM attestation; -- a real zero-job workflow startup failure caused by job-level `runner.temp` use was reproduced and fixed by moving runner paths into step/runtime scope. +Draft #164 is exact `1d3f5a4bd618084031f3e722804b7c61303baeb5`. It isolates PR build/evidence from OIDC attestation authority, removes unnecessary artifact-metadata write permission, binds source/version/hashes before protected-main attestation, and repairs a real zero-job workflow startup defect caused by job-level `runner.temp`. Its release workflow now materializes as run `33806666158`, while build job `100818667579` remains queued pre-checkout with `runner_id=0`; central runner evidence is on `.github#712`. -The repaired release workflow now materializes as run `33806666158`; build job `100818667579` remains queued before checkout with `runner_id=0`. Exact runner acceptance is on `.github#712`. #164 cannot tag, publish a GitHub Release, push an image, deploy, or promote from the feature branch. Final #84 evidence still needs immutable OCI identity/container-filesystem SBOM, admission-time verification, migration/canary/rollback and independent retention evidence on one protected release candidate. +#164 was built from an older #77 parent and is currently stale/non-mergeable relative to live #77. After #77 reaches protected main, preserve the child delta in a non-force restack and reacquire all exact-head release-evidence gates. Final #84 acceptance still requires immutable OCI identity/container-filesystem SBOM, admission-time verification, migration/canary/rollback, reproducibility, and independent retention on one protected release candidate. ## Scorecard and repository control-plane ownership -Draft #160 is exact `962623884347ccd52e653fb59504a7b848292086`. The first merged central reusable Scorecard owner (`.github@51b812d181989ed28366b5850d1a34f51df10187`) is not an acceptable immutable production pin because it uses Scorecard v2.4.3 while protected Wardnet already uses v2.4.4. Canonical owner repair `.github#1275` has now been non-force reconciled and is Ready/mergeable at exact `61a8197a753e01d3275371d77b035ed44f6135eb` on protected `.github/main@07d9ec23fb265c76539d23249e1dfa124ea7b23b`, but all of its current owner workflows remain queued. Wardnet #160 therefore still waits for that lane to execute terminal-clean and merge normally so it can consume the resulting immutable protected owner SHA. Wardnet must not pin the mutable owner PR head, restore a copied implementation, or silently downgrade the scanner. +Draft #160 is exact `962623884347ccd52e653fb59504a7b848292086`. The first merged reusable central owner at `.github@51b812d181989ed28366b5850d1a34f51df10187` would regress protected Wardnet from OSSF Scorecard v2.4.4 to v2.4.3. Current #160 therefore keeps only a thin caller shape and refuses to consume that regressing immutable owner. The corrective owner path is `.github#1777`; Wardnet must consume the resulting protected owner SHA only after the canonical reusable workflow is advanced without scanner-version regression. Do not restore a copied Scorecard implementation or pin a mutable central PR head. -PR #153 remains the clean explicit-runner root at `b663f9d200e5f385c7dd067d074940a02836c68e`; #156/#157/#158 remain Draft children and are restacked only after #153 becomes protected truth. PR #159 retains PR-number concurrency and unique push run IDs so protected-main evidence is not replaced by another pending push. +PR #153 remains the clean explicit-hosted-runner root at `b663f9d200e5f385c7dd067d074940a02836c68e`; #156/#157/#158 remain Draft dependents to rebuild only after #153 becomes protected truth. PR #159 retains PR-number concurrency for superseded PR runs while using unique push run IDs so protected-main evidence is not silently displaced. ## Context Fabric read-only boundary -Fresh metadata still reports `develop` as default for both Context Graph Contracts and EA Core. In CGC, `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` is protected while `main` at the same commit is unprotected; there is no GitHub Release. Release-provenance prerequisite #25 remains Draft exact `187f45927e697cfad9ac5b2523dfd86b695aa072` and its current `ci 33730255529`, `reproducibility 33730255596`, `receipt-package-smoke 33730255606`, and `supply-chain 33730255626` are terminal GREEN on that recorded ancestry. DDD child #20 is `475ce14185db697940e8219c3cda7f24d66f3ed7`; Context Assertion/CloudEvent admission child #21 is `5cfab7d4819b94f3679d649367868e60f9c0d55a` on stale ancestry with zero PR workflow runs. No open PR head is production contract authority. +Fresh repository metadata still reports `develop` as default for both Context Graph Contracts and EA Core. Their accepted integration/default target is protected `main`; branch topology/protection repair remains the Context Fabric/.github owner path, not a Wardnet source decision. -In EA Core, `develop@1c0fa8b15ceb9e72186274aeb255d6777eb84ef4` is protected and current `main@ca6889497728e1a3f09d68790a9096576e13a3ff` is unprotected; there is no GitHub Release. Live parent #39 is `c063570bd9177578fa75be69defd81c99e6ba2f3`; Draft projection child #40 is exact `4d16d3c5243591d5c440866536f9a3fdca16358c` and remains non-mergeable on obsolete parent ancestry. +For `context-graph-contracts`, the open dependency order remains `#4 -> #6 -> #7 -> #8 -> #12 -> #13 -> #14 -> #16 -> #17 -> #18 -> #19 -> #25 -> #20 -> #21`. Release-provenance prerequisite #25 remains exact `187f45927e697cfad9ac5b2523dfd86b695aa072` with current repository package/reproducibility/supply-chain workflows terminal GREEN on its recorded ancestry. #20 is exact `475ce14185db697940e8219c3cda7f24d66f3ed7`. Context Assertion/CloudEvent admission child #21 is exact `5cfab7d4819b94f3679d649367868e60f9c0d55a`, Draft/non-mergeable on stale ancestry, with zero current PR workflow runs. Issue #27 owns the future external-capability contract; issue #24 owns protected-source release evidence; issue #15 owns repository integration acceptance. No mutable PR head is production contract authority. -#40's current lineage preserves the real-PostgreSQL structured-CloudEvent media-type repair—RED `e49e053e3a637be8db8bf68ca5778f90ad2e02dd`, GREEN migration `0052_context_assertion_projection_media_type.sql`—and the bounded Noema Context Fabric projection. EA accepts only deployable/runtime/service/API/worker capability and technology/lifecycle/ownership/risk/remediation/transformation context through released Context Assertion admission; Agent task/result/reasoning, tool payload, workflow/checkpoint/prompt/model/user-business-data authority and direct foreign DB/source copying remain prohibited. Fresh exact-head workflow lookup for `4d16d3c...` returns zero PR runs, so no predecessor evidence transfers and #40 must continue to fail closed on unreleased CGC contracts. +For `enterprise-architecture-core`, parent #39 remains exact `c063570bd9177578fa75be69defd81c99e6ba2f3` with terminal-success repository workflows on its recorded ancestry. Draft projection child #40 is now exact `52645dd62d8ea2dbdc9f7dc3d7c59304f8fd5649`, non-mergeable on obsolete #39 ancestry, with zero current PR workflow runs. Its current lineage retains exact Context Assertion admission identity in the EA projection receipt, structured CloudEvent media-type compatibility, and bounded Noema/quarantine projection semantics. EA continues to fail closed on unreleased/mutable CGC contracts. Issue #45 owns portfolio-level external-capability adoption mapping; Wardnet remains read-only. -For both repositories, the accepted main/default transition is an owner-plane operational repair: protect main first, prove effective controls, switch default, re-read inherited rules, then rebuild roots/descendants. Wardnet does not mutate their source, refs, PR state, or branch topology. +The latest dependency sweep in this run found no compatible immutable GitHub Release chain across the foreign owners needed for current Wardnet integration. Therefore Wardnet does not promote mutable `context-graph-contracts`, EA Core, quarantine, EgressWeave, contextual-orchestrator, or appguardrail heads into production authority. ## Live Wardnet queue @@ -90,21 +84,21 @@ Fresh open-PR inventory contains 27 lanes: The merge/rebuild order is responsibility- and prerequisite-driven rather than oldest-first: -1. Protected exposure/security prerequisites: #155, then #77 when its repaired exact-head evidence is terminal; continue central governance/runner repair in parallel. -2. Network security: finish #136 DNS deadline/runtime RED and refresh it after #155 protected truth. -3. Supply chain: after #77 protected, non-force restack #164 and reacquire all release-evidence gates; #84 remains open until a real protected release identity exists. -4. Agent admission: finish #129 without absorbing quarantine execution or CO routing. -5. Control-plane foundations: #153, then restack #156/#157/#158; #159 can merge only on exact current deterministic/central evidence; #160 waits for the non-regressing central Scorecard owner. -6. Material UI #127 requires real-browser current-head WCAG 2.2 AA evidence for keyboard/focus, accessible name/description, responsive behavior and loading/error/permission states; source-string tests alone are insufficient. -7. #88 stays open but architecture-blocked until CO publishes a compatible immutable contract. Preserve unique credential/admission/streaming negative evidence while removing direct LiteLLM/provider/model authority in the eventual consumer reconstruction. -8. Broad/stale aggregates #90/#95/#112/#114/#115 are repair/transfer lanes, not Close candidates. Preserve unique OCSF/OTLP/syslog, PostgreSQL/outbox/Coraza, route lifecycle, rename/migration and official-feed deltas in bounded current-main successors before any retirement. -9. #162 remains the commercial-authority separation lane: the 2B KRW customer-readiness predicate is distinct from the standing USD 20B software-sale quality ambition. This file remains the sole writer for the product/technical gap baseline. +1. Protected exposure/security: #155 first, then #77 after its repaired exact-head evidence is terminal; central governance/review control-plane repair proceeds in parallel. +2. Network security: execute #136's exact pending-resolver regression, then refresh/revalidate it after #155 is protected truth. +3. Supply chain: after #77 protected, non-force restack #164 and reacquire all release-evidence gates; #84 remains open until one real protected release identity exists. +4. Agent admission: continue #129 without absorbing quarantine execution or Noema/CO orchestration. +5. Control-plane foundations: #153, then #156/#157/#158; #159 only on exact deterministic/central evidence; #160 waits for a non-regressing protected reusable Scorecard owner. +6. Material UI #127 requires real-browser current-head WCAG 2.2 AA evidence for keyboard/focus, accessible name/description, responsive behavior, and loading/error/permission states; source-string tests alone are insufficient. +7. #88 remains architecture-gated until CO publishes a compatible immutable contract. Preserve unique credential/admission/streaming negative evidence while removing direct LiteLLM/provider/model authority in the eventual reconstruction. +8. Broad/stale aggregates #90/#95/#112/#114/#115 are repair/transfer lanes, not Close candidates. Preserve their unique OCSF/OTLP/syslog, PostgreSQL/outbox/Coraza, route lifecycle, rename/migration, and official-feed deltas in bounded current-main successors before retirement. +9. #130 remains the sole writer for this baseline. #162 owns commercial-authority separation: the 2B KRW customer-readiness predicate is distinct from the standing USD 20B software-sale quality ambition. -Closed/no-delta predecessor #154 is not returned to the queue. A PR is retired only by protected merge, explicit user instruction, malicious/no-valid delta, or verified complete successor transfer of all useful code/tests/fixtures/contracts/evidence. +A PR is retired only by protected merge, explicit user instruction, malicious/no-valid delta, or verified complete successor transfer of all useful code/tests/fixtures/contracts/evidence. ## Open production gaps -The buyer-visible production order remains: +Buyer-visible production order remains: - #78 fail-closed management authentication through #155; - #79 complete outbound allowlist/deny-overrides/evidence/deadline semantics through #136 and successors; @@ -117,11 +111,11 @@ The buyer-visible production order remains: - #85 telemetry/SLO/incident/restore evidence; - #87 final production-readiness closure only against one immutable protected release identity. -The root `src/lib.rs` remains a modularity pressure point, but file size alone does not justify a service split. Add dependency/ownership fitness first; prefer a modular monolith until transaction, isolation, scale, deployment or reuse evidence pays for another deployable boundary. +The root `src/lib.rs` remains a modularity pressure point, but file size alone is not evidence for a service split. Add dependency/ownership fitness first and prefer a modular monolith until transaction, isolation, scale, deployment, or reuse evidence pays for another deployable boundary. ## Standards and evidence -Implementation and evidence remain grounded in current authoritative standards and primary/peer-reviewed work; citations constrain the design but do not prove a control is shipped. +Implementation/evidence remains grounded in authoritative standards and primary or peer-reviewed work; citations constrain design but do not prove a control is shipped. - Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). *Zero trust architecture* (NIST SP 800-207). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-207 - Souppaya, M., Scarfone, K., & Dodson, D. (2022). *Secure Software Development Framework (SSDF) version 1.1* (NIST SP 800-218). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-218 @@ -129,10 +123,8 @@ Implementation and evidence remain grounded in current authoritative standards a - Lamb, C., & Zacchiroli, S. (2021). Reproducible builds: Increasing the integrity of software supply chains. *arXiv*. https://arxiv.org/abs/2104.06020 - Soldani, J., Tamburri, D. A., & van den Heuvel, W.-J. (2018). The pains and gains of microservices: A systematic grey literature review. *Journal of Systems and Software, 146*, 215–232. https://doi.org/10.1016/j.jss.2018.09.082 -Wardnet-owned production code targets 100% statement/branch/edge-case coverage and complete public rustdoc/docstrings. Security changes require realistic bypass/replay/race/DoS/network/cleanup tests and exact-source verification. Coverage exclusions, skipped paths, startup-failed/queued jobs, or evidence bound to another head/PR identity are not passing evidence. +Wardnet-owned production code targets 100% statement/branch/edge-case coverage and complete public rustdoc/docstrings. Security changes require realistic bypass/replay/race/DoS/network/cleanup tests plus exact-source verification. Coverage exclusions, skipped paths, queued/startup-failed jobs, wrong-PR same-SHA evidence, or evidence bound to another head are non-passing. ## Release gate -No release is authorized at this snapshot. Wardnet, Context Graph Contracts, EA Core and the canonical external owners required by current integration work do not yet expose the complete compatible immutable release chain needed by Wardnet. - -Release requires one exact integrated protected head with current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact identity, and a verified publication path. A feature-branch artifact or attestation is evidence for the branch only; it is not a Wardnet release. \ No newline at end of file +No release is authorized at this snapshot. Release requires one exact integrated protected head with current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact identity, and a verified publication path. A feature-branch artifact or attestation is evidence for that branch only; it is not a Wardnet release. From b2358fca568c02eeb5791b1f1b64357ca359cd69 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 15:13:46 +0900 Subject: [PATCH 50/73] docs(gaps): correct protected-main identity --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 3742131d..def03239 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -24,7 +24,7 @@ Runner/event/review materialization is separately owned by `.github#712` and rel ### #155 — fail-closed management authentication -PR #155 remains Ready/mergeable at exact `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` on protected `main@cc15cc2c34daf8c104754eb83d52a6a66f3cd6e128`. Repository-owned CI `33590350994`, Fuzz `33590350997`, Security Scan `33590350967`, and SAST Semgrep `33590350991` are terminal GREEN; returned inline review threads are resolved. +PR #155 remains Ready/mergeable at exact `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` on protected `main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. Repository-owned CI `33590350994`, Fuzz `33590350997`, Security Scan `33590350967`, and SAST Semgrep `33590350991` are terminal GREEN; returned inline review threads are resolved. Required OpenCode run `33590351182` has terminal-success bootstrap `100122902000`, coverage-source-tree `100272722468`, and coverage-evidence `100479589911`. Final `opencode-review` job `100659819151` did acquire GitHub-hosted runner `1001655142`, completed setup and the authenticated current-head review request, then remained at the fail-closed verdict boundary until the administrative three-hour limit and ended `cancelled` around `2026-09-04T04:37:15Z`. The current defect is therefore verdict materialization/timeout semantics, not runner acquisition. Exact evidence and GREEN acceptance are on `.github#712` comment `5535918616`. Do not rerun-storm this unchanged head. #78 closes only when this exact or a verified successor delta reaches protected main through satisfiable ordinary governance. From 6fa4052bb2d3bb8e352080c61785593b3f9e6825 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 16:22:34 +0900 Subject: [PATCH 51/73] docs(gaps): refresh agent admission exact-head evidence --- docs/product-technical-gap-baseline.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index def03239..f71ee5f0 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -46,11 +46,13 @@ Exact-current CI `33842763514`, Fuzz `33842763449`, Security Scan `33842763513`, ## Agent Artifact Admission -Draft #129 is exact `3a63247e412d17b7bbee2a1d1668dfc84adf1280`, mergeable on protected `main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. It owns the pre-execution structured artifact-install security admission boundary; it does not fetch or execute hostile workloads. +Draft #129 is exact `6dfd777e1e9ce8b42c87c3311911a35f64f97190`, mergeable on protected `main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. It owns the pre-execution structured artifact-install security admission boundary; it does not fetch or execute hostile workloads. -The current lineage fail-closes executable/ecosystem confusion, undeclared operands, indirect source/config/workspace/root authority, lifecycle-script/trust/integrity bypasses, Cargo build variants, OCI platform ambiguity, Podman registry trust weakening, and repository-wide mutable OCI pull expansion. The latest RED `d7f429c37a3bd26ea746254defc5d65f33ef71f2` proves Docker/Podman `-a` / `--all-tags` can widen one reviewed digest pull into a mutable repository-wide artifact set; GREEN `7f06137453dc2296e4c4ac8c439777bf19ba7244` makes those switches fail closed as `artifact_not_approved`, and current `3a63247e...` carries the supporting primary Docker/Podman/NIST traceability. +The lineage fail-closes executable/ecosystem confusion, undeclared operands, indirect source/config/workspace/root authority, lifecycle-script/trust/integrity bypasses, Cargo build variants, OCI platform ambiguity, Podman registry trust weakening, and repository-wide mutable OCI pull expansion. The first OCI cardinality RED `d7f429c37a3bd26ea746254defc5d65f33ef71f2` proved bare Docker/Podman `-a` / `--all-tags` could widen one reviewed digest pull into a mutable repository-wide artifact set; GREEN `7f06137453dc2296e4c4ac8c439777bf19ba7244` rejected those switches as `artifact_not_approved`. -Exact-current CI `33825032608`, Fuzz `33825032507`, Security Scan `33825032518`, SAST `33825032753`, Scorecard `33825032564`, and OSV `33825033384` remain queued/non-passing. Returned inline threads are resolved. Cross-owner naming evidence is already handed to `context-graph-contracts#27` and `enterprise-architecture-core#45`: Wardnet owns pre-execution artifact security admission; Noema owns governed activation/orchestration. A released shared contract must preserve those producer authorities rather than collapse one receipt into the other. +Fresh review then found the same semantic authority could be expressed through Boolean assignment syntax. RED `883d1d37e05b0ccd9d30b2c1b25fd7d53c6fc8d8` adds hostile Docker/Podman `--all-tags=true` and `-a=true` cases that the prior exact-token predicate did not classify. Causal GREEN `e9e07e696c013dab88df6a5a6dc1be8306b9b688` recognizes true assignments in the existing artifact-variant boundary without creating a provider-specific transport owner or new public reason code. Coverage `2207a6f79522dc8b6cb95e817be648bb6ef9a7f3` includes long/short true spellings and explicit-false non-regression; current `6dfd777e...` records primary Docker/Podman/NIST traceability. + +Exact-current CI `33848015533`, SAST Semgrep `33848015479`, Security Scan `33848015485`, and Fuzz `33848015550` are queued/non-passing. CI job `100944222630` is pre-checkout with no steps materialized. Exact runner-acquisition evidence and acceptance are on `.github#712` comment `5537096153`; no rerun storm or leaf churn is justified. Returned inline threads are resolved. The read-only owner handoffs on `context-graph-contracts#27` and `enterprise-architecture-core#45` were refreshed against `6dfd777e...`: Wardnet owns pre-execution artifact security admission, while Noema owns governed activation/orchestration. Shared conformance must reject activation that depends on missing/stale/blocking Wardnet evidence or semantically widened artifact identity/cardinality, while also rejecting a Wardnet allow receipt as sufficient product activation. ## Release and supply-chain path @@ -74,7 +76,7 @@ For `context-graph-contracts`, the open dependency order remains `#4 -> #6 -> #7 For `enterprise-architecture-core`, parent #39 remains exact `c063570bd9177578fa75be69defd81c99e6ba2f3` with terminal-success repository workflows on its recorded ancestry. Draft projection child #40 is now exact `52645dd62d8ea2dbdc9f7dc3d7c59304f8fd5649`, non-mergeable on obsolete #39 ancestry, with zero current PR workflow runs. Its current lineage retains exact Context Assertion admission identity in the EA projection receipt, structured CloudEvent media-type compatibility, and bounded Noema/quarantine projection semantics. EA continues to fail closed on unreleased/mutable CGC contracts. Issue #45 owns portfolio-level external-capability adoption mapping; Wardnet remains read-only. -The latest dependency sweep in this run found no compatible immutable GitHub Release chain across the foreign owners needed for current Wardnet integration. Therefore Wardnet does not promote mutable `context-graph-contracts`, EA Core, quarantine, EgressWeave, contextual-orchestrator, or appguardrail heads into production authority. +The latest dependency sweep re-read repository ownership and GitHub Releases for `context-graph-contracts`, EA Core, `contextual-orchestrator`, `quarantine-sandbox-runtime`, EgressWeave, and `appguardrail`; none exposes a compatible immutable GitHub Release for the current Wardnet integration path. Therefore Wardnet does not promote mutable sibling heads into production authority. ## Live Wardnet queue @@ -127,4 +129,4 @@ Wardnet-owned production code targets 100% statement/branch/edge-case coverage a ## Release gate -No release is authorized at this snapshot. Release requires one exact integrated protected head with current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact identity, and a verified publication path. A feature-branch artifact or attestation is evidence for that branch only; it is not a Wardnet release. +No release is authorized at this snapshot. Release requires one exact integrated protected head with current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact identity, and a verified publication path. A feature-branch artifact or attestation is evidence for that branch only; it is not a Wardnet release. \ No newline at end of file From c03fad09e63a2e55e4c8b50d73cbc440e025b8dd Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 16:29:29 +0900 Subject: [PATCH 52/73] docs(gaps): adopt current EA projection head --- docs/product-technical-gap-baseline.md | 127 +++++++------------------ 1 file changed, 33 insertions(+), 94 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index f71ee5f0..5f4054f4 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,132 +1,71 @@ # Product and technical gap baseline -Snapshot date: 2026-09-04. This file is the Wardnet-owned commercial/security integration baseline. It is not a substitute for live GitHub state: before merge, release, restack, or foreign-owner handoff, re-read exact heads/bases, reviews/threads, checks, security results, rulesets, releases, and branch protection. +Snapshot date: 2026-09-04. Re-read live refs, PRs, reviews/threads, exact-head checks, rulesets, security results and releases before any merge, release, restack or foreign-owner handoff. This is the Wardnet-owned current-state ledger, not an archive of superseded run state. -## Product and authority boundary +## Authority boundary -Wardnet is the Rust-first gateway/SOC control plane. Its owned bounded contexts are Gateway, Admission Policy, Artifact Identity, Security Analysis Integration, Network-Egress, SOC Evidence, Runtime Control, Audit-Provenance, and Agent Artifact Admission. Wardnet does not execute hostile workloads and does not own model/provider routing. +Wardnet owns the Rust-first gateway/SOC control plane and the Gateway, Admission Policy, Artifact Identity, Security Analysis Integration, Network-Egress, SOC Evidence, Runtime Control, Audit-Provenance and Agent Artifact Admission bounded contexts. It does not own hostile execution or Agent/LLM orchestration. -`quarantine-sandbox-runtime` owns hostile execution isolation, lifecycle, cleanup, and artifact-analysis execution. `contextual-orchestrator` owns Agent/LLM orchestration plus provider/model/key discovery and routing. EgressWeave is the canonical outbound HTTP-policy candidate. `appguardrail` retains application-guardrail authority. Wardnet consumes released/versioned ports or Anti-Corruption Layers only; it does not copy foreign implementations or use cross-service SQL. +`quarantine-sandbox-runtime` owns hostile execution isolation and cleanup; `contextual-orchestrator` owns Agent/LLM/provider routing; EgressWeave is the canonical outbound HTTP-policy candidate; `appguardrail` retains application-guardrail authority. Wardnet consumes released/versioned ports or ACLs only: no source copy, cross-service SQL or mutable sibling dependency. -`context-graph-contracts` is the provider-neutral Context Fabric Shared Kernel for canonical object/authority references, truth status/origin, valid/system time, provenance, Context Assertion, CloudEvents, schemas, conformance, and shared admission grammar. `enterprise-architecture-core` is the EA Decision Plane. Both are read-only dependencies from this Wardnet lane while the Context Fabric owner loop is active. Wardnet security findings and verdicts remain Wardnet evidence; EA may reference validated risk/remediation evidence but must not copy those verdicts as authoritative architecture facts. +`context-graph-contracts` is the provider-neutral Context Fabric Shared Kernel. `enterprise-architecture-core` is the EA Decision Plane. Both remain read-only from this lane while their Context Fabric owner is active. Wardnet findings/verdicts stay Wardnet evidence; EA may reference validated risk/remediation evidence but must not copy it as authoritative architecture truth. -The optional SOC LLM seam remains ownership debt until a compatible immutable `contextual-orchestrator` release exists. No mutable CO branch, direct provider key, provider/model selector, or paid fallback is production authority for Wardnet. +No compatible immutable GitHub Release currently exists for Wardnet, Context Graph Contracts, EA Core, contextual-orchestrator, quarantine-sandbox-runtime, EgressWeave or appguardrail. Mutable heads are non-authoritative. -## Protected truth and central governance +## Protected truth and control plane -Protected/default Wardnet `main` is `cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. Wardnet still exposes no GitHub Release. +Protected/default Wardnet truth is `main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. Live organization ruleset `18156473` still applies to `~DEFAULT_BRANCH` with one generic approving review, no required reviewer/team, required thread resolution and central workflows, deletion/non-fast-forward protection, plus routine `OrganizationAdmin/always` bypass. Under the declared solo-maintainer model, self-approval and model/bot-as-human approval remain forbidden. `.github#772` owns the narrow ruleset reconciliation; deterministic workflow/security/coverage/SBOM/provenance/thread/branch-integrity controls must remain. -Live organization ruleset `18156473` targets `~DEFAULT_BRANCH` and still carries a generic one-approval requirement with no required reviewer/team, required conversation resolution, central required workflows, deletion/non-fast-forward protection, and routine `OrganizationAdmin/always` bypass. Under the declared solo-maintainer model, self-approval and model/bot-as-human approval remain forbidden. The bare approval count and routine bypass are central governance defects, not a reason to weaken Wardnet. `.github#772` and its live successor own reconciliation while deterministic CI/security/coverage/SBOM/provenance/thread/branch-integrity controls remain intact. - -Runner/event/review materialization is separately owned by `.github#712` and related central control-plane lanes. `queued`, pre-checkout `runner_id=0`, empty `steps`, startup-failed CodeQL, and a model-review request that never produces a current-head verdict are non-passing evidence. They are not reasons for no-op consumer churn, runner downgrades, predecessor-evidence reuse, or routine bypass. +Runner/event/review materialization belongs to `.github#712` and related central lanes. Queued/pre-checkout jobs, `runner_id=0`, empty steps, startup failures and model-review requests that never materialize a current-head verdict are non-passing. They do not justify no-op source churn, predecessor-evidence reuse or routine bypass. ## Immediate protected-main security path -### #155 — fail-closed management authentication - -PR #155 remains Ready/mergeable at exact `e6f05d77858e91c176cff25c4b11e790bc5dcdd1` on protected `main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. Repository-owned CI `33590350994`, Fuzz `33590350997`, Security Scan `33590350967`, and SAST Semgrep `33590350991` are terminal GREEN; returned inline review threads are resolved. - -Required OpenCode run `33590351182` has terminal-success bootstrap `100122902000`, coverage-source-tree `100272722468`, and coverage-evidence `100479589911`. Final `opencode-review` job `100659819151` did acquire GitHub-hosted runner `1001655142`, completed setup and the authenticated current-head review request, then remained at the fail-closed verdict boundary until the administrative three-hour limit and ended `cancelled` around `2026-09-04T04:37:15Z`. The current defect is therefore verdict materialization/timeout semantics, not runner acquisition. Exact evidence and GREEN acceptance are on `.github#712` comment `5535918616`. Do not rerun-storm this unchanged head. #78 closes only when this exact or a verified successor delta reaches protected main through satisfiable ordinary governance. - -### #77 — Rust toolchain plus duplicate-Deployment fail-closed repair - -PR #77 is Ready/mergeable at exact `46fef54c9b5916eb77196fb515a8fabad13a05d1`. The lineage pins Rust `1.98.0` and repairs a valid duplicate-Kubernetes-Deployment security finding. - -RED `43d2c874732063e418b3929e3435c388ccfa7c69` proved a first-match manifest validator could accept a valid target Deployment while a later YAML document with the same resource identity weakened the administrator Secret boundary. GREEN `17a2a1e833e6c4cab6101ef6a534589d75a5920a` requires exactly one canonical target Deployment and adds a hostile duplicate-resource regression. Current `46fef54c...` removes only the temporary source-text RED scaffold; the behavioral regression remains. The finding thread is resolved, but fresh exact-head CI `33807338426`, Security `33807338277`, SAST `33807338221`, Scorecard `33807338399`, and OSV `33807339076` remain queued/non-passing. - -### #136 — Network-Egress DNS deadline repair - -Draft #136 is now exact `28e5776388b2fc31e1d0567382871a1f599aa3ed` on protected `main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`, and GitHub reports it mergeable. - -The original source-bearing RED remains immutable evidence: head `3cb1047416c3aa7fa8eb352b842cc55ad8c21b19` produced terminal CI failure `33698726857` at `phishing_feed_dns_resolution_shares_the_end_to_end_operation_deadline`, proving manual DNS resolution could outlive the intended feed/TAXII/KEV operation timeout. - -Production repair was present by `9978f8c643433b5df0398e3d9f3608546fdadecd`: callers establish one absolute `tokio::time::Instant` deadline before destination validation, `validated_outbound_http_client` wraps the actual `lookup_host` future with `tokio::time::timeout_at(deadline, resolution)`, and request I/O receives only the remaining budget. Current head `28e5776388...` completes the deterministic acceptance by binding the architecture fence to that exact resolver primitive and exercising a forever-pending resolver surrogate against the shared deadline. Clearfolio/SOC/proxy timeout semantics remain separate. - -Exact-current CI `33842763514`, Fuzz `33842763449`, Security Scan `33842763513`, and SAST Semgrep `33842763530` are queued. CI job `100928237991` is pre-checkout with `steps=[]` and `runner_id=0`. Exact runner evidence and acceptance are on `.github#712` comment `5536431288`. The DNS review thread intentionally remains unresolved until this unchanged head actually executes the regression and the relevant exact-head gate is terminal GREEN. After #155 becomes protected truth, refresh/revalidate #136 against the new protected base before integration. +- **#155 auth** — exact `e6f05d77858e91c176cff25c4b11e790bc5dcdd1`, Ready/mergeable. Repository CI/Fuzz/Security/SAST are terminal GREEN and returned inline threads are resolved. Required OpenCode bootstrap/source-tree/coverage passed, but final current-head review job `100659819151` acquired runner `1001655142`, issued the authenticated review request, then reached the three-hour administrative boundary without a verdict and ended cancelled. `.github#712` comment `5535918616` owns verdict/timeout RCA. #78 closes only after this delta reaches protected main through satisfiable ordinary governance. +- **#77 Rust/deployment hardening** — exact `46fef54c9b5916eb77196fb515a8fabad13a05d1`. RED `43d2c874732063e418b3929e3435c388ccfa7c69` proved a first-match Kubernetes manifest validator could hide a later duplicate target Deployment. GREEN `17a2a1e833e6c4cab6101ef6a534589d75a5920a` requires exactly one target identity and keeps the hostile duplicate-resource regression. Current CI/Security/SAST/Scorecard/OSV remain queued. +- **#136 Network-Egress** — exact `28e5776388b2fc31e1d0567382871a1f599aa3ed`, Draft/mergeable. Runnable RED `3cb1047416c3aa7fa8eb352b842cc55ad8c21b19` / CI `33698726857` proved manual DNS lookup could outlive the operation budget. Production now carries one absolute Tokio deadline through `lookup_host` and remaining HTTP work; current head adds a forever-pending resolver cancellation regression. CI/Fuzz/Security/SAST remain queued; the DNS review thread stays unresolved until unchanged-head hosted GREEN. Refresh against protected main after #155 integrates. ## Agent Artifact Admission -Draft #129 is exact `6dfd777e1e9ce8b42c87c3311911a35f64f97190`, mergeable on protected `main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. It owns the pre-execution structured artifact-install security admission boundary; it does not fetch or execute hostile workloads. +Draft #129 is exact `6dfd777e1e9ce8b42c87c3311911a35f64f97190`, mergeable on protected `main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. It is the pre-execution structured artifact-install security-admission boundary; it does not fetch or execute workloads. -The lineage fail-closes executable/ecosystem confusion, undeclared operands, indirect source/config/workspace/root authority, lifecycle-script/trust/integrity bypasses, Cargo build variants, OCI platform ambiguity, Podman registry trust weakening, and repository-wide mutable OCI pull expansion. The first OCI cardinality RED `d7f429c37a3bd26ea746254defc5d65f33ef71f2` proved bare Docker/Podman `-a` / `--all-tags` could widen one reviewed digest pull into a mutable repository-wide artifact set; GREEN `7f06137453dc2296e4c4ac8c439777bf19ba7244` rejected those switches as `artifact_not_approved`. +The lineage fail-closes executable/ecosystem confusion, undeclared operands, indirect source/config/workspace/root authority, lifecycle-script/trust/integrity bypasses, Cargo build variants, OCI platform ambiguity, Podman registry trust weakening and repository-wide mutable OCI tag expansion. Bare Docker/Podman `-a` / `--all-tags` was already blocked by RED `d7f429c37a3bd26ea746254defc5d65f33ef71f2` -> GREEN `7f06137453dc2296e4c4ac8c439777bf19ba7244`. -Fresh review then found the same semantic authority could be expressed through Boolean assignment syntax. RED `883d1d37e05b0ccd9d30b2c1b25fd7d53c6fc8d8` adds hostile Docker/Podman `--all-tags=true` and `-a=true` cases that the prior exact-token predicate did not classify. Causal GREEN `e9e07e696c013dab88df6a5a6dc1be8306b9b688` recognizes true assignments in the existing artifact-variant boundary without creating a provider-specific transport owner or new public reason code. Coverage `2207a6f79522dc8b6cb95e817be648bb6ef9a7f3` includes long/short true spellings and explicit-false non-regression; current `6dfd777e...` records primary Docker/Podman/NIST traceability. +Fresh hostile review found the equivalent Boolean-assignment bypass. RED `883d1d37e05b0ccd9d30b2c1b25fd7d53c6fc8d8` covers `--all-tags=true` / `-a=true`; causal GREEN `e9e07e696c013dab88df6a5a6dc1be8306b9b688` classifies true assignments as `artifact_not_approved`; coverage `2207a6f79522dc8b6cb95e817be648bb6ef9a7f3` adds long/short true forms and explicit-false non-regression. Exact `6dfd777e...` records Docker/Podman/NIST traceability. -Exact-current CI `33848015533`, SAST Semgrep `33848015479`, Security Scan `33848015485`, and Fuzz `33848015550` are queued/non-passing. CI job `100944222630` is pre-checkout with no steps materialized. Exact runner-acquisition evidence and acceptance are on `.github#712` comment `5537096153`; no rerun storm or leaf churn is justified. Returned inline threads are resolved. The read-only owner handoffs on `context-graph-contracts#27` and `enterprise-architecture-core#45` were refreshed against `6dfd777e...`: Wardnet owns pre-execution artifact security admission, while Noema owns governed activation/orchestration. Shared conformance must reject activation that depends on missing/stale/blocking Wardnet evidence or semantically widened artifact identity/cardinality, while also rejecting a Wardnet allow receipt as sufficient product activation. +Exact-head CI `33848015533`, SAST `33848015479`, Security `33848015485` and Fuzz `33848015550` remain queued; `.github#712` comment `5537096153` owns runner-acquisition acceptance. Returned inline threads are resolved. Context Fabric/EA owner handoffs remain on `context-graph-contracts#27` and `enterprise-architecture-core#45`: Wardnet security-artifact admission and Noema governed activation/orchestration are separate authorities; neither receipt may substitute for the other. -## Release and supply-chain path +## Release and repository supply chain -Wardnet still has no immutable GitHub Release. Issue #84 remains open; a feature-branch build or attestation is not a production release. +#164 is exact `1d3f5a4bd618084031f3e722804b7c61303baeb5`, Draft and stale on an older #77 parent. It separates PR build evidence from protected-main OIDC attestation authority, binds source/version/hashes and repairs a zero-job `runner.temp` workflow defect. Its release workflow materializes but the build remains runner-queued. After #77 reaches protected main, preserve the child delta in a non-force restack and reacquire exact-head evidence. #84 still requires immutable OCI identity/container-filesystem SBOM, admission-time verification, reproducibility, retention and tested migration/canary/rollback on one protected release candidate. -Draft #164 is exact `1d3f5a4bd618084031f3e722804b7c61303baeb5`. It isolates PR build/evidence from OIDC attestation authority, removes unnecessary artifact-metadata write permission, binds source/version/hashes before protected-main attestation, and repairs a real zero-job workflow startup defect caused by job-level `runner.temp`. Its release workflow now materializes as run `33806666158`, while build job `100818667579` remains queued pre-checkout with `runner_id=0`; central runner evidence is on `.github#712`. +#160 is exact `962623884347ccd52e653fb59504a7b848292086`. The first merged central reusable Scorecard owner would regress protected Wardnet from v2.4.4 to v2.4.3; `.github#1777` owns the non-regressing protected successor. Wardnet keeps a thin caller and will consume only the protected successor SHA. -#164 was built from an older #77 parent and is currently stale/non-mergeable relative to live #77. After #77 reaches protected main, preserve the child delta in a non-force restack and reacquire all exact-head release-evidence gates. Final #84 acceptance still requires immutable OCI identity/container-filesystem SBOM, admission-time verification, migration/canary/rollback, reproducibility, and independent retention on one protected release candidate. +#153 remains the clean explicit-hosted-runner root at `b663f9d200e5f385c7dd067d074940a02836c68e`; #156/#157/#158 remain Draft dependents. #159 retains PR-number cancellation for superseded PR runs while keeping push evidence unique per run. -## Scorecard and repository control-plane ownership +## Context Fabric read-only inventory -Draft #160 is exact `962623884347ccd52e653fb59504a7b848292086`. The first merged reusable central owner at `.github@51b812d181989ed28366b5850d1a34f51df10187` would regress protected Wardnet from OSSF Scorecard v2.4.4 to v2.4.3. Current #160 therefore keeps only a thin caller shape and refuses to consume that regressing immutable owner. The corrective owner path is `.github#1777`; Wardnet must consume the resulting protected owner SHA only after the canonical reusable workflow is advanced without scanner-version regression. Do not restore a copied Scorecard implementation or pin a mutable central PR head. +Live metadata still reports `develop` as default for both Context Graph Contracts and EA Core; accepted integration/default is protected `main`, so branch topology/protection repair remains the Context Fabric/.github owner path. -PR #153 remains the clean explicit-hosted-runner root at `b663f9d200e5f385c7dd067d074940a02836c68e`; #156/#157/#158 remain Draft dependents to rebuild only after #153 becomes protected truth. PR #159 retains PR-number concurrency for superseded PR runs while using unique push run IDs so protected-main evidence is not silently displaced. +For `context-graph-contracts`, dependency order remains `#4 -> #6 -> #7 -> #8 -> #12 -> #13 -> #14 -> #16 -> #17 -> #18 -> #19 -> #25 -> #20 -> #21`. #25 is exact `187f45927e697cfad9ac5b2523dfd86b695aa072` with current package/reproducibility/supply-chain workflows terminal GREEN on its recorded ancestry. #20 is exact `475ce14185db697940e8219c3cda7f24d66f3ed7`. #21 is exact `5cfab7d4819b94f3679d649367868e60f9c0d55a`, Draft/non-mergeable on stale ancestry with zero current PR workflows. #27 owns the external-capability/admission grammar repair. No mutable PR head is release authority. -## Context Fabric read-only boundary +For `enterprise-architecture-core`, parent #39 remains exact `c063570bd9177578fa75be69defd81c99e6ba2f3` with terminal-success repository workflows on its recorded ancestry. Projection child #40 advanced linearly to exact `8266a7841550963072ec00a4be05eac41e894b59`, remains Draft/non-mergeable on obsolete #39 ancestry and currently has zero PR workflow runs. Its one new owner commit, `test: require projection semantic profile identity`, adds `profile_id` to required projection-receipt semantics and rejects a quarantine connector receipt that keeps only a version while dropping its profile identity. Preserve that read-only owner progress; it is source/test evidence, not hosted GREEN. The separate Wardnet-security-admission versus Noema-activation architecture acceptance remains open on #45. -Fresh repository metadata still reports `develop` as default for both Context Graph Contracts and EA Core. Their accepted integration/default target is protected `main`; branch topology/protection repair remains the Context Fabric/.github owner path, not a Wardnet source decision. +## Live Wardnet queue and order -For `context-graph-contracts`, the open dependency order remains `#4 -> #6 -> #7 -> #8 -> #12 -> #13 -> #14 -> #16 -> #17 -> #18 -> #19 -> #25 -> #20 -> #21`. Release-provenance prerequisite #25 remains exact `187f45927e697cfad9ac5b2523dfd86b695aa072` with current repository package/reproducibility/supply-chain workflows terminal GREEN on its recorded ancestry. #20 is exact `475ce14185db697940e8219c3cda7f24d66f3ed7`. Context Assertion/CloudEvent admission child #21 is exact `5cfab7d4819b94f3679d649367868e60f9c0d55a`, Draft/non-mergeable on stale ancestry, with zero current PR workflow runs. Issue #27 owns the future external-capability contract; issue #24 owns protected-source release evidence; issue #15 owns repository integration acceptance. No mutable PR head is production contract authority. +Fresh open-PR inventory contains 27 lanes: `#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #153, #155, #156, #157, #158, #159, #160, #162, #164`. -For `enterprise-architecture-core`, parent #39 remains exact `c063570bd9177578fa75be69defd81c99e6ba2f3` with terminal-success repository workflows on its recorded ancestry. Draft projection child #40 is now exact `52645dd62d8ea2dbdc9f7dc3d7c59304f8fd5649`, non-mergeable on obsolete #39 ancestry, with zero current PR workflow runs. Its current lineage retains exact Context Assertion admission identity in the EA projection receipt, structured CloudEvent media-type compatibility, and bounded Noema/quarantine projection semantics. EA continues to fail closed on unreleased/mutable CGC contracts. Issue #45 owns portfolio-level external-capability adoption mapping; Wardnet remains read-only. +Integration is prerequisite-driven: #155, then repaired #77; #136 after #155 truth; #164 only after #77 protected; #129 continues without absorbing quarantine/Noema/CO; #153 before #156/#157/#158; #160 waits for the protected non-regressing central owner. #127 additionally requires real-browser current-head WCAG 2.2 AA evidence. #88 remains architecture-gated until CO publishes a compatible immutable contract. Broad/stale #90/#95/#112/#114/#115 are repair/transfer lanes, not Close candidates. #130 is the sole writer for this file; #162 separately owns the 2B-KRW customer-readiness versus USD-20B product-quality authority split. -The latest dependency sweep re-read repository ownership and GitHub Releases for `context-graph-contracts`, EA Core, `contextual-orchestrator`, `quarantine-sandbox-runtime`, EgressWeave, and `appguardrail`; none exposes a compatible immutable GitHub Release for the current Wardnet integration path. Therefore Wardnet does not promote mutable sibling heads into production authority. - -## Live Wardnet queue - -Fresh open-PR inventory contains 27 lanes: - -`#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #153, #155, #156, #157, #158, #159, #160, #162, #164`. - -The merge/rebuild order is responsibility- and prerequisite-driven rather than oldest-first: - -1. Protected exposure/security: #155 first, then #77 after its repaired exact-head evidence is terminal; central governance/review control-plane repair proceeds in parallel. -2. Network security: execute #136's exact pending-resolver regression, then refresh/revalidate it after #155 is protected truth. -3. Supply chain: after #77 protected, non-force restack #164 and reacquire all release-evidence gates; #84 remains open until one real protected release identity exists. -4. Agent admission: continue #129 without absorbing quarantine execution or Noema/CO orchestration. -5. Control-plane foundations: #153, then #156/#157/#158; #159 only on exact deterministic/central evidence; #160 waits for a non-regressing protected reusable Scorecard owner. -6. Material UI #127 requires real-browser current-head WCAG 2.2 AA evidence for keyboard/focus, accessible name/description, responsive behavior, and loading/error/permission states; source-string tests alone are insufficient. -7. #88 remains architecture-gated until CO publishes a compatible immutable contract. Preserve unique credential/admission/streaming negative evidence while removing direct LiteLLM/provider/model authority in the eventual reconstruction. -8. Broad/stale aggregates #90/#95/#112/#114/#115 are repair/transfer lanes, not Close candidates. Preserve their unique OCSF/OTLP/syslog, PostgreSQL/outbox/Coraza, route lifecycle, rename/migration, and official-feed deltas in bounded current-main successors before retirement. -9. #130 remains the sole writer for this baseline. #162 owns commercial-authority separation: the 2B KRW customer-readiness predicate is distinct from the standing USD 20B software-sale quality ambition. - -A PR is retired only by protected merge, explicit user instruction, malicious/no-valid delta, or verified complete successor transfer of all useful code/tests/fixtures/contracts/evidence. +PR retirement requires protected merge, explicit user instruction, malicious/no-valid delta, or verified complete successor transfer of useful code/tests/fixtures/contracts/evidence. ## Open production gaps -Buyer-visible production order remains: - -- #78 fail-closed management authentication through #155; -- #79 complete outbound allowlist/deny-overrides/evidence/deadline semantics through #136 and successors; -- #11 real attack-path CI and #75 deployable public path hardening; -- #128 Agent Artifact Admission through #129; -- #80 PostgreSQL production authority/tenant isolation, then #81 transactional outbox/leased effects; -- #82 Keyverse-backed identity/approval and #83 distributed/global admission without duplicating local limiter authority; -- #86 proven Coraza/CRS and Suricata detection with false-positive evidence; -- #84 immutable artifact/SBOM/provenance/reproducibility/rollback; -- #85 telemetry/SLO/incident/restore evidence; -- #87 final production-readiness closure only against one immutable protected release identity. - -The root `src/lib.rs` remains a modularity pressure point, but file size alone is not evidence for a service split. Add dependency/ownership fitness first and prefer a modular monolith until transaction, isolation, scale, deployment, or reuse evidence pays for another deployable boundary. - -## Standards and evidence - -Implementation/evidence remains grounded in authoritative standards and primary or peer-reviewed work; citations constrain design but do not prove a control is shipped. +Buyer-visible order remains: #78 management auth; #79 outbound policy/evidence/deadline; #11 real attack-path CI and #75 deployable public path; #128 Agent Artifact Admission; #80 PostgreSQL authority/tenant isolation then #81 transactional outbox; #82 Keyverse identity/approval and #83 distributed admission; #86 proven Coraza/CRS and Suricata detection; #84 immutable release evidence; #85 telemetry/SLO/incident/restore; #87 final readiness against one immutable protected release identity. -- Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). *Zero trust architecture* (NIST SP 800-207). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-207 -- Souppaya, M., Scarfone, K., & Dodson, D. (2022). *Secure Software Development Framework (SSDF) version 1.1* (NIST SP 800-218). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-218 -- OWASP Foundation. (2025). *Application Security Verification Standard 5.0.0*. https://owasp.org/www-project-application-security-verification-standard/ -- Lamb, C., & Zacchiroli, S. (2021). Reproducible builds: Increasing the integrity of software supply chains. *arXiv*. https://arxiv.org/abs/2104.06020 -- Soldani, J., Tamburri, D. A., & van den Heuvel, W.-J. (2018). The pains and gains of microservices: A systematic grey literature review. *Journal of Systems and Software, 146*, 215–232. https://doi.org/10.1016/j.jss.2018.09.082 +Root `src/lib.rs` remains a modularity pressure point, not evidence by itself for a service split. Prefer a modular monolith until transaction, isolation, scale, deployment or reuse evidence pays for another deployable boundary. -Wardnet-owned production code targets 100% statement/branch/edge-case coverage and complete public rustdoc/docstrings. Security changes require realistic bypass/replay/race/DoS/network/cleanup tests plus exact-source verification. Coverage exclusions, skipped paths, queued/startup-failed jobs, wrong-PR same-SHA evidence, or evidence bound to another head are non-passing. +## Standards and release gate -## Release gate +Implementation evidence remains grounded in NIST SP 800-207, NIST SP 800-218/SSDF 1.1, OWASP ASVS 5.0.0 and relevant primary/peer-reviewed work. Citations constrain design but do not prove a control is shipped. Wardnet-owned production code targets 100% statement/branch/edge-case coverage and complete public rustdoc/docstrings; realistic bypass/replay/race/DoS/network/cleanup cases are required where applicable. -No release is authorized at this snapshot. Release requires one exact integrated protected head with current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact identity, and a verified publication path. A feature-branch artifact or attestation is evidence for that branch only; it is not a Wardnet release. \ No newline at end of file +No release is authorized at this snapshot. Release requires one exact integrated protected head with current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact identity and a verified publication path. Feature-branch artifacts or attestations remain branch evidence only. \ No newline at end of file From 7f610731fef4526a31afa1da5344901b6e49049a Mon Sep 17 00:00:00 2001 From: OpenAI Codex Date: Fri, 4 Sep 2026 17:35:42 +0900 Subject: [PATCH 53/73] docs(gaps): refresh live exact-head blocker state --- docs/product-technical-gap-baseline.md | 53 +++++++++++++++++++++++--- 1 file changed, 47 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 5f4054f4..00a60b58 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,9 @@ # Product and technical gap baseline -Snapshot date: 2026-09-04. Re-read live refs, PRs, reviews/threads, exact-head checks, rulesets, security results and releases before any merge, release, restack or foreign-owner handoff. This is the Wardnet-owned current-state ledger, not an archive of superseded run state. +Snapshot date: 2026-09-04T16:45+09:00. Re-read live refs, PRs, +reviews/threads, exact-head checks, rulesets, security results and releases +before any merge, release, restack or foreign-owner handoff. This is the +Wardnet-owned current-state ledger, not an archive of superseded run state. ## Authority boundary @@ -20,9 +23,35 @@ Runner/event/review materialization belongs to `.github#712` and related central ## Immediate protected-main security path -- **#155 auth** — exact `e6f05d77858e91c176cff25c4b11e790bc5dcdd1`, Ready/mergeable. Repository CI/Fuzz/Security/SAST are terminal GREEN and returned inline threads are resolved. Required OpenCode bootstrap/source-tree/coverage passed, but final current-head review job `100659819151` acquired runner `1001655142`, issued the authenticated review request, then reached the three-hour administrative boundary without a verdict and ended cancelled. `.github#712` comment `5535918616` owns verdict/timeout RCA. #78 closes only after this delta reaches protected main through satisfiable ordinary governance. -- **#77 Rust/deployment hardening** — exact `46fef54c9b5916eb77196fb515a8fabad13a05d1`. RED `43d2c874732063e418b3929e3435c388ccfa7c69` proved a first-match Kubernetes manifest validator could hide a later duplicate target Deployment. GREEN `17a2a1e833e6c4cab6101ef6a534589d75a5920a` requires exactly one target identity and keeps the hostile duplicate-resource regression. Current CI/Security/SAST/Scorecard/OSV remain queued. -- **#136 Network-Egress** — exact `28e5776388b2fc31e1d0567382871a1f599aa3ed`, Draft/mergeable. Runnable RED `3cb1047416c3aa7fa8eb352b842cc55ad8c21b19` / CI `33698726857` proved manual DNS lookup could outlive the operation budget. Production now carries one absolute Tokio deadline through `lookup_host` and remaining HTTP work; current head adds a forever-pending resolver cancellation regression. CI/Fuzz/Security/SAST remain queued; the DNS review thread stays unresolved until unchanged-head hosted GREEN. Refresh against protected main after #155 integrates. +- **#155 auth** — exact `e6f05d77858e91c176cff25c4b11e790bc5dcdd1`, + Blocked on live governance, not source correctness. Repository + CI/Fuzz/Security/SAST are terminal GREEN and returned inline threads are + resolved. Required OpenCode bootstrap/source-tree/coverage passed, but final + current-head review job `100659819151` acquired runner `1001655142`, issued + the authenticated review request, then reached the three-hour administrative + boundary without a verdict and ended cancelled. Required Noema Review is also + failing on the exact head, and GitHub still records + `mergeStateStatus=BLOCKED` / `reviewDecision=REVIEW_REQUIRED`. `.github#712` + comment `5535918616` owns verdict/timeout RCA. #78 closes only after this + delta reaches protected main through satisfiable ordinary governance. +- **#77 Rust/deployment hardening** — exact + `46fef54c9b5916eb77196fb515a8fabad13a05d1`, Blocked. RED + `43d2c874732063e418b3929e3435c388ccfa7c69` proved a first-match Kubernetes + manifest validator could hide a later duplicate target Deployment. GREEN + `17a2a1e833e6c4cab6101ef6a534589d75a5920a` requires exactly one target + identity and keeps the hostile duplicate-resource regression. On the live + head, Required Noema Review is failing, Required OpenCode Review has + cancelled review-bootstrap attempts, and SAST/Scorecard/Security subchecks + remain queued. +- **#136 Network-Egress** — exact + `28e5776388b2fc31e1d0567382871a1f599aa3ed`, Draft/blocked. Runnable RED + `3cb1047416c3aa7fa8eb352b842cc55ad8c21b19` / CI `33698726857` proved manual + DNS lookup could outlive the operation budget. Production now carries one + absolute Tokio deadline through `lookup_host` and remaining HTTP work; + current head adds a forever-pending resolver cancellation regression. + Exact-head CI/Fuzz/Security/SAST/Noema/OpenCode/Strix remain queued, and the + DNS review thread stays unresolved until unchanged-head hosted GREEN. + Refresh against protected main after #155 integrates. ## Agent Artifact Admission @@ -54,7 +83,19 @@ For `enterprise-architecture-core`, parent #39 remains exact `c063570bd9177578fa Fresh open-PR inventory contains 27 lanes: `#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #153, #155, #156, #157, #158, #159, #160, #162, #164`. -Integration is prerequisite-driven: #155, then repaired #77; #136 after #155 truth; #164 only after #77 protected; #129 continues without absorbing quarantine/Noema/CO; #153 before #156/#157/#158; #160 waits for the protected non-regressing central owner. #127 additionally requires real-browser current-head WCAG 2.2 AA evidence. #88 remains architecture-gated until CO publishes a compatible immutable contract. Broad/stale #90/#95/#112/#114/#115 are repair/transfer lanes, not Close candidates. #130 is the sole writer for this file; #162 separately owns the 2B-KRW customer-readiness versus USD-20B product-quality authority split. +Integration is prerequisite-driven: #155, then repaired #77; #136 after #155 +truth; #164 only after #77 protected; #129 continues without absorbing +quarantine/Noema/CO; #153 before #156/#157/#158; #160 waits for the protected +non-regressing central owner. #127 additionally requires real-browser +current-head WCAG 2.2 AA evidence. #88 remains architecture-gated until CO +publishes a compatible immutable contract. Broad/stale +#90/#95/#112/#114/#115 are repair/transfer lanes, not Close candidates. #130 is +the sole writer for this file and is itself Draft/blocked with fresh exact-head +CI/CodeQL/OpenCode/Noema/Security/SAST/Strix runs queued on +`codex/main-gap-followup@c03fad0`. #140 is non-draft but equally blocked until +its fresh exact-head CI/Fuzz/CodeQL/OpenCode/Noema/Security/SAST/Strix results +land on `feat/runtime-config-bootstrap-snapshot@6b0219d`. #162 separately owns +the 2B-KRW customer-readiness versus USD-20B product-quality authority split. PR retirement requires protected merge, explicit user instruction, malicious/no-valid delta, or verified complete successor transfer of useful code/tests/fixtures/contracts/evidence. @@ -68,4 +109,4 @@ Root `src/lib.rs` remains a modularity pressure point, not evidence by itself fo Implementation evidence remains grounded in NIST SP 800-207, NIST SP 800-218/SSDF 1.1, OWASP ASVS 5.0.0 and relevant primary/peer-reviewed work. Citations constrain design but do not prove a control is shipped. Wardnet-owned production code targets 100% statement/branch/edge-case coverage and complete public rustdoc/docstrings; realistic bypass/replay/race/DoS/network/cleanup cases are required where applicable. -No release is authorized at this snapshot. Release requires one exact integrated protected head with current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact identity and a verified publication path. Feature-branch artifacts or attestations remain branch evidence only. \ No newline at end of file +No release is authorized at this snapshot. Release requires one exact integrated protected head with current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact identity and a verified publication path. Feature-branch artifacts or attestations remain branch evidence only. From 994ccbe75e2a23dc4d669692085391b463f09419 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 18:17:15 +0900 Subject: [PATCH 54/73] docs(gaps): refresh admission and control-plane evidence --- docs/product-technical-gap-baseline.md | 77 ++++++++++++-------------- 1 file changed, 36 insertions(+), 41 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 00a60b58..42800d5a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # Product and technical gap baseline -Snapshot date: 2026-09-04T16:45+09:00. Re-read live refs, PRs, +Snapshot date: 2026-09-04T18:00+09:00. Re-read live refs, PRs, reviews/threads, exact-head checks, rulesets, security results and releases before any merge, release, restack or foreign-owner handoff. This is the Wardnet-owned current-state ledger, not an archive of superseded run state. @@ -9,59 +9,62 @@ Wardnet-owned current-state ledger, not an archive of superseded run state. Wardnet owns the Rust-first gateway/SOC control plane and the Gateway, Admission Policy, Artifact Identity, Security Analysis Integration, Network-Egress, SOC Evidence, Runtime Control, Audit-Provenance and Agent Artifact Admission bounded contexts. It does not own hostile execution or Agent/LLM orchestration. -`quarantine-sandbox-runtime` owns hostile execution isolation and cleanup; `contextual-orchestrator` owns Agent/LLM/provider routing; EgressWeave is the canonical outbound HTTP-policy candidate; `appguardrail` retains application-guardrail authority. Wardnet consumes released/versioned ports or ACLs only: no source copy, cross-service SQL or mutable sibling dependency. +`quarantine-sandbox-runtime` owns hostile execution isolation and cleanup; `contextual-orchestrator` owns Agent/LLM/provider routing; EgressWeave owns outbound HTTP-policy authority; `appguardrail` owns deterministic static security analysis and scan receipts. Wardnet consumes released/versioned ports or ACLs only: no source copy, cross-service SQL or mutable sibling dependency. `context-graph-contracts` is the provider-neutral Context Fabric Shared Kernel. `enterprise-architecture-core` is the EA Decision Plane. Both remain read-only from this lane while their Context Fabric owner is active. Wardnet findings/verdicts stay Wardnet evidence; EA may reference validated risk/remediation evidence but must not copy it as authoritative architecture truth. -No compatible immutable GitHub Release currently exists for Wardnet, Context Graph Contracts, EA Core, contextual-orchestrator, quarantine-sandbox-runtime, EgressWeave or appguardrail. Mutable heads are non-authoritative. +Fresh release inventory on 2026-09-04 still finds no compatible immutable GitHub Release for Wardnet, Context Graph Contracts, EA Core, contextual-orchestrator, quarantine-sandbox-runtime, EgressWeave or appguardrail. Mutable heads are non-authoritative. ## Protected truth and control plane Protected/default Wardnet truth is `main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. Live organization ruleset `18156473` still applies to `~DEFAULT_BRANCH` with one generic approving review, no required reviewer/team, required thread resolution and central workflows, deletion/non-fast-forward protection, plus routine `OrganizationAdmin/always` bypass. Under the declared solo-maintainer model, self-approval and model/bot-as-human approval remain forbidden. `.github#772` owns the narrow ruleset reconciliation; deterministic workflow/security/coverage/SBOM/provenance/thread/branch-integrity controls must remain. -Runner/event/review materialization belongs to `.github#712` and related central lanes. Queued/pre-checkout jobs, `runner_id=0`, empty steps, startup failures and model-review requests that never materialize a current-head verdict are non-passing. They do not justify no-op source churn, predecessor-evidence reuse or routine bypass. +Runner/event/review materialization belongs to `.github#712` and related central lanes. Queued/pre-checkout jobs, missing workflow materialization, `runner_id=0`/null, empty steps, startup failures and model-review requests that never materialize a current-head verdict are non-passing. They do not justify no-op source churn, predecessor-evidence reuse or routine bypass. Fresh `.github#712` comment `5538305303` adds two current specimens: Wardnet #129 materializes jobs but cannot acquire a runner, while EA #40 used a zero-tree-delta `ci: re-dispatch` commit and still materialized no PR workflow at all. Empty/no-op commits are evidence of the control-plane defect, not an accepted dispatch mechanism. ## Immediate protected-main security path - **#155 auth** — exact `e6f05d77858e91c176cff25c4b11e790bc5dcdd1`, - Blocked on live governance, not source correctness. Repository - CI/Fuzz/Security/SAST are terminal GREEN and returned inline threads are - resolved. Required OpenCode bootstrap/source-tree/coverage passed, but final - current-head review job `100659819151` acquired runner `1001655142`, issued - the authenticated review request, then reached the three-hour administrative - boundary without a verdict and ended cancelled. Required Noema Review is also - failing on the exact head, and GitHub still records - `mergeStateStatus=BLOCKED` / `reviewDecision=REVIEW_REQUIRED`. `.github#712` - comment `5535918616` owns verdict/timeout RCA. #78 closes only after this - delta reaches protected main through satisfiable ordinary governance. + Blocked on live governance/control-plane review evidence, not a known source + regression. Repository CI/Fuzz/Security/SAST are terminal GREEN and returned + inline threads are resolved. Required OpenCode bootstrap/source-tree/coverage + passed, but final current-head review job `100659819151` acquired runner + `1001655142`, issued the authenticated review request, then reached the + three-hour administrative boundary without a verdict and ended cancelled. + `.github#712` comment `5535918616` owns verdict/timeout RCA. #78 closes only + after this delta reaches protected main through satisfiable ordinary + governance. - **#77 Rust/deployment hardening** — exact `46fef54c9b5916eb77196fb515a8fabad13a05d1`, Blocked. RED `43d2c874732063e418b3929e3435c388ccfa7c69` proved a first-match Kubernetes manifest validator could hide a later duplicate target Deployment. GREEN `17a2a1e833e6c4cab6101ef6a534589d75a5920a` requires exactly one target - identity and keeps the hostile duplicate-resource regression. On the live - head, Required Noema Review is failing, Required OpenCode Review has - cancelled review-bootstrap attempts, and SAST/Scorecard/Security subchecks - remain queued. + identity and keeps the hostile duplicate-resource regression. Current central + review/security evidence remains non-terminal. - **#136 Network-Egress** — exact `28e5776388b2fc31e1d0567382871a1f599aa3ed`, Draft/blocked. Runnable RED `3cb1047416c3aa7fa8eb352b842cc55ad8c21b19` / CI `33698726857` proved manual DNS lookup could outlive the operation budget. Production now carries one absolute Tokio deadline through `lookup_host` and remaining HTTP work; current head adds a forever-pending resolver cancellation regression. - Exact-head CI/Fuzz/Security/SAST/Noema/OpenCode/Strix remain queued, and the - DNS review thread stays unresolved until unchanged-head hosted GREEN. - Refresh against protected main after #155 integrates. + Exact-head CI/Fuzz/Security/SAST remain queued, and the DNS review thread + stays unresolved until unchanged-head hosted GREEN. Refresh against protected + main after #155 integrates. ## Agent Artifact Admission -Draft #129 is exact `6dfd777e1e9ce8b42c87c3311911a35f64f97190`, mergeable on protected `main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. It is the pre-execution structured artifact-install security-admission boundary; it does not fetch or execute workloads. +Draft #129 is exact `73098781acf2214df4b2fb54742152cf3d1a02a2`, mergeable on protected `main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. It is the pre-execution structured artifact-install security-admission boundary; it does not fetch or execute workloads and does not own Noema activation, quarantine execution, EgressWeave transport policy or AppGuardrail static analysis. -The lineage fail-closes executable/ecosystem confusion, undeclared operands, indirect source/config/workspace/root authority, lifecycle-script/trust/integrity bypasses, Cargo build variants, OCI platform ambiguity, Podman registry trust weakening and repository-wide mutable OCI tag expansion. Bare Docker/Podman `-a` / `--all-tags` was already blocked by RED `d7f429c37a3bd26ea746254defc5d65f33ef71f2` -> GREEN `7f06137453dc2296e4c4ac8c439777bf19ba7244`. +The lineage fail-closes executable/ecosystem confusion, undeclared operands, indirect source/config/workspace/root authority, lifecycle-script/trust/integrity bypasses, Cargo build variants, OCI platform ambiguity, Podman registry trust weakening and repository-wide mutable OCI tag expansion. The latest OCI cardinality sequence now covers parser-equivalent spellings rather than comparing only raw argv tokens: -Fresh hostile review found the equivalent Boolean-assignment bypass. RED `883d1d37e05b0ccd9d30b2c1b25fd7d53c6fc8d8` covers `--all-tags=true` / `-a=true`; causal GREEN `e9e07e696c013dab88df6a5a6dc1be8306b9b688` classifies true assignments as `artifact_not_approved`; coverage `2207a6f79522dc8b6cb95e817be648bb6ef9a7f3` adds long/short true forms and explicit-false non-regression. Exact `6dfd777e...` records Docker/Podman/NIST traceability. +- bare all-tags RED `d7f429c37a3bd26ea746254defc5d65f33ef71f2` -> GREEN `7f06137453dc2296e4c4ac8c439777bf19ba7244`; +- Boolean-assignment RED `883d1d37e05b0ccd9d30b2c1b25fd7d53c6fc8d8` -> GREEN `e9e07e696c013dab88df6a5a6dc1be8306b9b688`, with explicit-false coverage `2207a6f79522dc8b6cb95e817be648bb6ef9a7f3`; +- bundled-shorthand RED `a1105c5de234e8750ce3c9b4036de1669a67b818` -> GREEN `f35db9e712b243bd6e8cff9125aaa968b9d12362`, with quiet-only non-regression `897a790baf89347778a27dbb1356aaf2d002e032`; +- assigned-bundle RED `dd6b9309034a3f14f534d2eb0f81a9a49b32bfdd` -> GREEN `0f6a02a0b2dcdddd96e35f137923eefa27f8c8f2`: under pflag final-shorthand assignment semantics, `-aq=false` / `-aq=0` still enable preceding `-a` and block, whereas `-qa=false` / `-qa=0` leave final all-tags disabled and remain admissible; +- doctoring `578e4930134d4479c8a2f2f79a0d70da3e28f92c` records current Docker/Podman/pflag/NIST traceability; exact head `73098781...` keeps CHANGELOG code-current. -Exact-head CI `33848015533`, SAST `33848015479`, Security `33848015485` and Fuzz `33848015550` remain queued; `.github#712` comment `5537096153` owns runner-acquisition acceptance. Returned inline threads are resolved. Context Fabric/EA owner handoffs remain on `context-graph-contracts#27` and `enterprise-architecture-core#45`: Wardnet security-artifact admission and Noema governed activation/orchestration are separate authorities; neither receipt may substitute for the other. +The parser remains intentionally bounded to documented Docker/Podman pull Boolean `a`/`q` shorthands rather than reimplementing the provider CLI. Exact-head CI `33857187396`, SAST `33857187387`, Fuzz `33857187408` and Security Scan `33857187384` are queued. CI job `100973102564` is pre-checkout with `steps=[]` and no runner identity. Returned inline threads are resolved and current review submissions are COMMENTED only. `.github#712` comment `5538305303` owns current runner-acquisition acceptance. + +Context Fabric/EA owner handoffs are code-current on `context-graph-contracts#27` comment `5538237964` and `enterprise-architecture-core#45` comment `5538239807`: Wardnet security-artifact admission and Noema governed activation/orchestration are separate authorities; a digest plus opaque argv strings is insufficient if command semantics widen artifact identity/cardinality, and neither receipt substitutes for the other's authority. ## Release and repository supply chain @@ -73,29 +76,21 @@ Exact-head CI `33848015533`, SAST `33848015479`, Security `33848015485` and Fuzz ## Context Fabric read-only inventory -Live metadata still reports `develop` as default for both Context Graph Contracts and EA Core; accepted integration/default is protected `main`, so branch topology/protection repair remains the Context Fabric/.github owner path. +Live metadata still reports `develop` as default for both Context Graph Contracts and EA Core. CGC `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` is protected while `main` at the same initial commit is unprotected; accepted integration/default is protected `main`, so branch topology/protection repair remains the Context Fabric/.github owner path. EA `develop@dd71e40a86385fb7861b0f1be19891a3f3e29ece` is protected while current `main@ca6889497728e1a3f09d68790a9096576e13a3ff` remains outside the accepted final topology. Neither repository currently publishes a GitHub Release. + +For `context-graph-contracts`, dependency order remains `#4 -> #6 -> #7 -> #8 -> #12 -> #13 -> #14 -> #16 -> #17 -> #18 -> #19 -> #25 -> #20 -> #21`. #25 is exact `187f45927e697cfad9ac5b2523dfd86b695aa072` with current package/reproducibility/supply-chain workflows terminal GREEN on its recorded ancestry. #20 is exact `475ce14185db697940e8219c3cda7f24d66f3ed7`. #21 is exact `5cfab7d4819b94f3679d649367868e60f9c0d55a`, Draft/non-mergeable on stale ancestry with zero current PR workflows. #27 owns the provider-neutral external-capability/security-artifact-admission grammar repair. No mutable PR head is release authority. -For `context-graph-contracts`, dependency order remains `#4 -> #6 -> #7 -> #8 -> #12 -> #13 -> #14 -> #16 -> #17 -> #18 -> #19 -> #25 -> #20 -> #21`. #25 is exact `187f45927e697cfad9ac5b2523dfd86b695aa072` with current package/reproducibility/supply-chain workflows terminal GREEN on its recorded ancestry. #20 is exact `475ce14185db697940e8219c3cda7f24d66f3ed7`. #21 is exact `5cfab7d4819b94f3679d649367868e60f9c0d55a`, Draft/non-mergeable on stale ancestry with zero current PR workflows. #27 owns the external-capability/admission grammar repair. No mutable PR head is release authority. +For `enterprise-architecture-core`, parent #39 remains the dependency parent for projection work. Projection child #40 is now exact `8bc147a017259d1883bb8fb1c1f1bbb5ee3af050`, Draft/non-mergeable on obsolete #39 ancestry. Comparison from `8266a7841550963072ec00a4be05eac41e894b59` proves the new commit has zero file delta and only attempts `ci: re-dispatch projection receipt RED`; exact `8bc147a...` still has zero PR workflow runs. The underlying owner RED at `8266a784...` requires distinct `profile_id` retention in projection-receipt semantics, but the zero-tree redispatch neither changes that test nor supplies executed evidence. Preserve the real RED source; route missing materialization to `.github#712` instead of repeating no-op commits. The separate Wardnet-security-admission versus Noema-activation architecture acceptance remains open on #45. -For `enterprise-architecture-core`, parent #39 remains exact `c063570bd9177578fa75be69defd81c99e6ba2f3` with terminal-success repository workflows on its recorded ancestry. Projection child #40 advanced linearly to exact `8266a7841550963072ec00a4be05eac41e894b59`, remains Draft/non-mergeable on obsolete #39 ancestry and currently has zero PR workflow runs. Its one new owner commit, `test: require projection semantic profile identity`, adds `profile_id` to required projection-receipt semantics and rejects a quarantine connector receipt that keeps only a version while dropping its profile identity. Preserve that read-only owner progress; it is source/test evidence, not hosted GREEN. The separate Wardnet-security-admission versus Noema-activation architecture acceptance remains open on #45. +Canonical dependency lanes also remain open and unreleased: quarantine-sandbox-runtime #17 owns credential-free hostile plugin/artifact execution evidence; EgressWeave #240 owns exact external-extension/remote-MCP egress mediation and receipts; appguardrail #1036/#1099 own static skill/plugin supply-chain detectors and exact scan receipts; contextual-orchestrator remains model/provider-routing authority and currently has no immutable GitHub Release. None is copied into Wardnet. ## Live Wardnet queue and order Fresh open-PR inventory contains 27 lanes: `#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #153, #155, #156, #157, #158, #159, #160, #162, #164`. -Integration is prerequisite-driven: #155, then repaired #77; #136 after #155 -truth; #164 only after #77 protected; #129 continues without absorbing -quarantine/Noema/CO; #153 before #156/#157/#158; #160 waits for the protected -non-regressing central owner. #127 additionally requires real-browser -current-head WCAG 2.2 AA evidence. #88 remains architecture-gated until CO -publishes a compatible immutable contract. Broad/stale -#90/#95/#112/#114/#115 are repair/transfer lanes, not Close candidates. #130 is -the sole writer for this file and is itself Draft/blocked with fresh exact-head -CI/CodeQL/OpenCode/Noema/Security/SAST/Strix runs queued on -`codex/main-gap-followup@c03fad0`. #140 is non-draft but equally blocked until -its fresh exact-head CI/Fuzz/CodeQL/OpenCode/Noema/Security/SAST/Strix results -land on `feat/runtime-config-bootstrap-snapshot@6b0219d`. #162 separately owns -the 2B-KRW customer-readiness versus USD-20B product-quality authority split. +Integration is prerequisite-driven: #155, then repaired #77; #136 after #155 truth; #164 only after #77 protected; #129 continues without absorbing quarantine/Noema/CO/EgressWeave/AppGuardrail; #153 before #156/#157/#158; #160 waits for the protected non-regressing central owner. #127 additionally requires real-browser current-head WCAG 2.2 AA evidence. #88 remains architecture-gated until contextual-orchestrator publishes a compatible immutable contract. Broad/stale #90/#95/#112/#114/#115 are repair/transfer lanes, not Close candidates. #162 separately owns the 2B-KRW customer-readiness versus USD-20B product-quality authority split. + +#130 is the sole writer for this file. Its branch advanced concurrently from `c03fad09...` to `7f610731fef4526a31afa1da5344901b6e49049a` with only this baseline modified; this refresh adopts that intervening delta instead of treating it as a race. The exact commit containing this paragraph is necessarily newer than that pre-refresh branch head, so GitHub PR metadata—not a self-referential SHA embedded here—is the authority for #130's current head. Before this refresh, exact `7f610731...` CI `33854209782`, SAST `33854209756` and Security Scan `33854209841` were queued/non-passing; the new documentation head requires fresh exact-head evidence. #140's live GitHub head is `6b0219dad241cfea9969e7e05c11a9937131b36b`, despite its stale body still naming predecessor `9389a2d...`; source/PR metadata on the live head is authoritative and the body should be repaired without resetting the branch. PR retirement requires protected merge, explicit user instruction, malicious/no-valid delta, or verified complete successor transfer of useful code/tests/fixtures/contracts/evidence. From 66b9d1d183dfb733cf9c6283ec307cf9e06aff43 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 18:50:53 +0900 Subject: [PATCH 55/73] docs(gaps): refresh Wardnet security and owner evidence --- docs/product-technical-gap-baseline.md | 82 +++++++++----------------- 1 file changed, 27 insertions(+), 55 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 42800d5a..bdc99929 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,96 +1,68 @@ # Product and technical gap baseline -Snapshot date: 2026-09-04T18:00+09:00. Re-read live refs, PRs, -reviews/threads, exact-head checks, rulesets, security results and releases -before any merge, release, restack or foreign-owner handoff. This is the -Wardnet-owned current-state ledger, not an archive of superseded run state. +Snapshot date: 2026-09-04T18:50+09:00. Re-read live refs, PRs, reviews/threads, exact-head checks, rulesets, security results and releases before any merge, release, restack or foreign-owner handoff. This is Wardnet's sole commercial/product-technical current-state ledger, not an archive of superseded run state. ## Authority boundary -Wardnet owns the Rust-first gateway/SOC control plane and the Gateway, Admission Policy, Artifact Identity, Security Analysis Integration, Network-Egress, SOC Evidence, Runtime Control, Audit-Provenance and Agent Artifact Admission bounded contexts. It does not own hostile execution or Agent/LLM orchestration. +Wardnet owns the Rust-first gateway/SOC control plane and the Gateway, Admission Policy, Artifact Identity, Security Analysis Integration, Network-Egress, SOC Evidence, Runtime Control, Audit-Provenance and Agent Artifact Admission bounded contexts. `quarantine-sandbox-runtime` owns hostile execution isolation and cleanup; `contextual-orchestrator` owns Agent/LLM/provider routing; EgressWeave owns outbound HTTP-policy authority; `appguardrail` owns deterministic static security analysis and scan receipts. Wardnet consumes released/versioned ports or ACLs only: no source copy, cross-service SQL or mutable sibling dependency. -`quarantine-sandbox-runtime` owns hostile execution isolation and cleanup; `contextual-orchestrator` owns Agent/LLM/provider routing; EgressWeave owns outbound HTTP-policy authority; `appguardrail` owns deterministic static security analysis and scan receipts. Wardnet consumes released/versioned ports or ACLs only: no source copy, cross-service SQL or mutable sibling dependency. +`context-graph-contracts` is the provider-neutral Context Fabric Shared Kernel. `enterprise-architecture-core` is the EA Decision Plane. Both remain read-only from this lane while their Context Fabric owner is active. Wardnet security findings/verdicts remain Wardnet evidence; EA may reference validated risk/remediation evidence but must not copy it as authoritative architecture truth. -`context-graph-contracts` is the provider-neutral Context Fabric Shared Kernel. `enterprise-architecture-core` is the EA Decision Plane. Both remain read-only from this lane while their Context Fabric owner is active. Wardnet findings/verdicts stay Wardnet evidence; EA may reference validated risk/remediation evidence but must not copy it as authoritative architecture truth. - -Fresh release inventory on 2026-09-04 still finds no compatible immutable GitHub Release for Wardnet, Context Graph Contracts, EA Core, contextual-orchestrator, quarantine-sandbox-runtime, EgressWeave or appguardrail. Mutable heads are non-authoritative. +Fresh release inventory on 2026-09-04 still finds no compatible immutable GitHub Release for Wardnet, Context Graph Contracts, EA Core, contextual-orchestrator, quarantine-sandbox-runtime, EgressWeave or appguardrail. Mutable sibling heads are non-authoritative. ## Protected truth and control plane -Protected/default Wardnet truth is `main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. Live organization ruleset `18156473` still applies to `~DEFAULT_BRANCH` with one generic approving review, no required reviewer/team, required thread resolution and central workflows, deletion/non-fast-forward protection, plus routine `OrganizationAdmin/always` bypass. Under the declared solo-maintainer model, self-approval and model/bot-as-human approval remain forbidden. `.github#772` owns the narrow ruleset reconciliation; deterministic workflow/security/coverage/SBOM/provenance/thread/branch-integrity controls must remain. +Protected/default Wardnet truth remains `main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. Live organization ruleset `18156473` still applies to `~DEFAULT_BRANCH` with one generic approving review, no required reviewer/team, required review-thread resolution and central required workflows, deletion/non-fast-forward protection, plus `OrganizationAdmin/always` bypass. Under the declared solo-maintainer model, self-approval and bot/model-as-human approval remain forbidden. `.github#772` and its current owner-plane successor own the narrow ruleset reconciliation; deterministic workflow/security/coverage/SBOM/provenance/thread/branch-integrity controls must remain. -Runner/event/review materialization belongs to `.github#712` and related central lanes. Queued/pre-checkout jobs, missing workflow materialization, `runner_id=0`/null, empty steps, startup failures and model-review requests that never materialize a current-head verdict are non-passing. They do not justify no-op source churn, predecessor-evidence reuse or routine bypass. Fresh `.github#712` comment `5538305303` adds two current specimens: Wardnet #129 materializes jobs but cannot acquire a runner, while EA #40 used a zero-tree-delta `ci: re-dispatch` commit and still materialized no PR workflow at all. Empty/no-op commits are evidence of the control-plane defect, not an accepted dispatch mechanism. +Runner/event/review materialization belongs to `.github#712` and related central lanes. Queued/pre-checkout jobs, missing workflow materialization, `runner_id=0`/null, empty steps, startup failures and model-review requests that never materialize a current-head verdict are non-passing. They do not justify no-op source churn, predecessor-evidence reuse or routine bypass. Current Wardnet #129 runner specimen is recorded on `.github#712` comment `5538701621`. ## Immediate protected-main security path -- **#155 auth** — exact `e6f05d77858e91c176cff25c4b11e790bc5dcdd1`, - Blocked on live governance/control-plane review evidence, not a known source - regression. Repository CI/Fuzz/Security/SAST are terminal GREEN and returned - inline threads are resolved. Required OpenCode bootstrap/source-tree/coverage - passed, but final current-head review job `100659819151` acquired runner - `1001655142`, issued the authenticated review request, then reached the - three-hour administrative boundary without a verdict and ended cancelled. - `.github#712` comment `5535918616` owns verdict/timeout RCA. #78 closes only - after this delta reaches protected main through satisfiable ordinary - governance. -- **#77 Rust/deployment hardening** — exact - `46fef54c9b5916eb77196fb515a8fabad13a05d1`, Blocked. RED - `43d2c874732063e418b3929e3435c388ccfa7c69` proved a first-match Kubernetes - manifest validator could hide a later duplicate target Deployment. GREEN - `17a2a1e833e6c4cab6101ef6a534589d75a5920a` requires exactly one target - identity and keeps the hostile duplicate-resource regression. Current central - review/security evidence remains non-terminal. -- **#136 Network-Egress** — exact - `28e5776388b2fc31e1d0567382871a1f599aa3ed`, Draft/blocked. Runnable RED - `3cb1047416c3aa7fa8eb352b842cc55ad8c21b19` / CI `33698726857` proved manual - DNS lookup could outlive the operation budget. Production now carries one - absolute Tokio deadline through `lookup_host` and remaining HTTP work; - current head adds a forever-pending resolver cancellation regression. - Exact-head CI/Fuzz/Security/SAST remain queued, and the DNS review thread - stays unresolved until unchanged-head hosted GREEN. Refresh against protected - main after #155 integrates. +- **#155 management auth** — exact `e6f05d77858e91c176cff25c4b11e790bc5dcdd1`, mergeable but not merge-ready. Repository CI `33590350994`, Fuzz `33590350997`, Security Scan `33590350967` and SAST `33590350991` are terminal GREEN. Required OpenCode bootstrap/source-tree/coverage jobs also passed, but final review job `100659819151` acquired a hosted runner, successfully requested current-head review, then reached the central three-hour administrative boundary without a verdict and the run ended cancelled. `.github#712` comment `5535918616` owns verdict/timeout RCA. This is not a chicken-and-egg bypass case. +- **#77 Rust/deployment hardening** — exact `46fef54c9b5916eb77196fb515a8fabad13a05d1`. RED `43d2c874732063e418b3929e3435c388ccfa7c69` proved a first-match Kubernetes validator could hide a later duplicate target Deployment; GREEN `17a2a1e833e6c4cab6101ef6a534589d75a5920a` requires exactly one target identity and retains hostile duplicate-resource coverage. Fresh current-head CI `33807338426` and OSV `33807339076` are terminal success; Scorecard `33807338399`, Security Scan `33807338277` and SAST `33807338221` remain queued/non-passing, so no merge is authorized. +- **#136 Network-Egress** — exact `28e5776388b2fc31e1d0567382871a1f599aa3ed`, Draft/blocked. Runnable RED `3cb1047416c3aa7fa8eb352b842cc55ad8c21b19` / CI `33698726857` proved manual DNS lookup could outlive the operation budget. Production now carries one absolute Tokio deadline through DNS validation and remaining HTTP work; current head adds a pending-resolver cancellation regression. Exact-head CI/Fuzz/Security/SAST remain queued and the DNS review finding stays unresolved until unchanged-head hosted GREEN. Refresh against protected main after #155 integrates. ## Agent Artifact Admission -Draft #129 is exact `73098781acf2214df4b2fb54742152cf3d1a02a2`, mergeable on protected `main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. It is the pre-execution structured artifact-install security-admission boundary; it does not fetch or execute workloads and does not own Noema activation, quarantine execution, EgressWeave transport policy or AppGuardrail static analysis. +Draft #129 is now exact `c2ac4c2c0128e8875d8a45c857d3d771e96ca727`, mergeable on protected `main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. It is the pre-execution structured artifact-install security-admission boundary; it does not fetch, decrypt, install or execute workloads and does not own Noema activation, quarantine execution, EgressWeave transport policy or AppGuardrail static analysis. + +The branch fail-closes executable/ecosystem confusion, undeclared operands, indirect source/config/workspace/root authority, lifecycle-script/trust/integrity bypasses, Cargo build variants, OCI platform ambiguity and mutable tag-set expansion. Earlier Docker/Podman cardinality repair covers bare `-a`/`--all-tags`, Boolean assignments, bundled `-aq`/`-qa`, and pflag final-shorthand assignment semantics such as hostile `-aq=false` versus admissible `-qa=false`. -The lineage fail-closes executable/ecosystem confusion, undeclared operands, indirect source/config/workspace/root authority, lifecycle-script/trust/integrity bypasses, Cargo build variants, OCI platform ambiguity, Podman registry trust weakening and repository-wide mutable OCI tag expansion. The latest OCI cardinality sequence now covers parser-equivalent spellings rather than comparing only raw argv tokens: +Fresh 2026-09-04 Podman primary-source review added two more authority repairs: -- bare all-tags RED `d7f429c37a3bd26ea746254defc5d65f33ef71f2` -> GREEN `7f06137453dc2296e4c4ac8c439777bf19ba7244`; -- Boolean-assignment RED `883d1d37e05b0ccd9d30b2c1b25fd7d53c6fc8d8` -> GREEN `e9e07e696c013dab88df6a5a6dc1be8306b9b688`, with explicit-false coverage `2207a6f79522dc8b6cb95e817be648bb6ef9a7f3`; -- bundled-shorthand RED `a1105c5de234e8750ce3c9b4036de1669a67b818` -> GREEN `f35db9e712b243bd6e8cff9125aaa968b9d12362`, with quiet-only non-regression `897a790baf89347778a27dbb1356aaf2d002e032`; -- assigned-bundle RED `dd6b9309034a3f14f534d2eb0f81a9a49b32bfdd` -> GREEN `0f6a02a0b2dcdddd96e35f137923eefa27f8c8f2`: under pflag final-shorthand assignment semantics, `-aq=false` / `-aq=0` still enable preceding `-a` and block, whereas `-qa=false` / `-qa=0` leave final all-tags disabled and remain admissible; -- doctoring `578e4930134d4479c8a2f2f79a0d70da3e28f92c` records current Docker/Podman/pflag/NIST traceability; exact head `73098781...` keeps CHANGELOG code-current. +- registry-authentication RED `400c53265f21d684ab06232536b50341b5d524c0` proves attached `--authfile=...` and `--creds=...` could otherwise select authentication state/principal while an exact approved digest remained syntactically admissible; causal GREEN `3eade5d41c50d1ad4e48118014c50acf5d8f3793` rejects those options as `alternate_trust_root`; +- image-decryption RED `d7aa94fc3846e0ed189f90b5525df03d1a62e3ee` proves attached `--decryption-key=key:passphrase` could otherwise select secret-bearing decryption authority through untrusted argv; causal GREEN `261ecc20e280c3af45798cc396088260eb94ba50` rejects it at the same bounded authority predicate; +- doctoring `841abfd0a8494a2111afc8638ee6a863e1f75a18`, CHANGELOG `32c748e346f6dbe8b67514ffeb25dd19dfdbb531`, and current threat-model head `c2ac4c2c0128e8875d8a45c857d3d771e96ca727` keep the decision and downstream secret/runtime ownership code-current. -The parser remains intentionally bounded to documented Docker/Podman pull Boolean `a`/`q` shorthands rather than reimplementing the provider CLI. Exact-head CI `33857187396`, SAST `33857187387`, Fuzz `33857187408` and Security Scan `33857187384` are queued. CI job `100973102564` is pre-checkout with `steps=[]` and no runner identity. Returned inline threads are resolved and current review submissions are COMMENTED only. `.github#712` comment `5538305303` owns current runner-acquisition acceptance. +Wardnet never reads an authfile, credential, key, certificate or passphrase and does not authenticate to registries or decrypt images. Those authorities remain separately governed downstream secret/deployment/runtime boundaries. -Context Fabric/EA owner handoffs are code-current on `context-graph-contracts#27` comment `5538237964` and `enterprise-architecture-core#45` comment `5538239807`: Wardnet security-artifact admission and Noema governed activation/orchestration are separate authorities; a digest plus opaque argv strings is insufficient if command semantics widen artifact identity/cardinality, and neither receipt substitutes for the other's authority. +Exact-head #129 CI `33860116349`, SAST `33860116392`, Security Scan `33860116481` and Fuzz `33860116659` are queued. CI job `100982384456` is pre-checkout with `steps=[]`, `runner_id=null`, no runner/group identity and exact `head_sha=c2ac4c2c...`. Returned inline review threads are resolved; review submissions remain COMMENTED rather than independent approval. `.github#712` comment `5538701621` carries exact current runner-admission RED/GREEN acceptance. + +Context Fabric owner handoffs are current on `context-graph-contracts#27`: comment `5538703380` requires provider-neutral contracts to reject raw decryption keys/key paths/passphrases as artifact authority and to carry only bounded secret-policy/key-handle/profile references where needed. EA owner handoff `enterprise-architecture-core#45` comment `5538705406` requires architecture projections to retain only immutable provenance/authority/profile/evidence references, never raw secrets, Podman syntax or Wardnet verdicts as authoritative architecture facts. ## Release and repository supply chain #164 is exact `1d3f5a4bd618084031f3e722804b7c61303baeb5`, Draft and stale on an older #77 parent. It separates PR build evidence from protected-main OIDC attestation authority, binds source/version/hashes and repairs a zero-job `runner.temp` workflow defect. Its release workflow materializes but the build remains runner-queued. After #77 reaches protected main, preserve the child delta in a non-force restack and reacquire exact-head evidence. #84 still requires immutable OCI identity/container-filesystem SBOM, admission-time verification, reproducibility, retention and tested migration/canary/rollback on one protected release candidate. -#160 is exact `962623884347ccd52e653fb59504a7b848292086`. The first merged central reusable Scorecard owner would regress protected Wardnet from v2.4.4 to v2.4.3; `.github#1777` owns the non-regressing protected successor. Wardnet keeps a thin caller and will consume only the protected successor SHA. +#160 is exact `962623884347ccd52e653fb59504a7b848292086`. The first merged central reusable Scorecard owner would regress protected Wardnet from Scorecard v2.4.4 to v2.4.3; `.github#1777` owns the non-regressing protected successor. Wardnet keeps a thin caller and will consume only the protected successor SHA. #153 remains the clean explicit-hosted-runner root at `b663f9d200e5f385c7dd067d074940a02836c68e`; #156/#157/#158 remain Draft dependents. #159 retains PR-number cancellation for superseded PR runs while keeping push evidence unique per run. ## Context Fabric read-only inventory -Live metadata still reports `develop` as default for both Context Graph Contracts and EA Core. CGC `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` is protected while `main` at the same initial commit is unprotected; accepted integration/default is protected `main`, so branch topology/protection repair remains the Context Fabric/.github owner path. EA `develop@dd71e40a86385fb7861b0f1be19891a3f3e29ece` is protected while current `main@ca6889497728e1a3f09d68790a9096576e13a3ff` remains outside the accepted final topology. Neither repository currently publishes a GitHub Release. - -For `context-graph-contracts`, dependency order remains `#4 -> #6 -> #7 -> #8 -> #12 -> #13 -> #14 -> #16 -> #17 -> #18 -> #19 -> #25 -> #20 -> #21`. #25 is exact `187f45927e697cfad9ac5b2523dfd86b695aa072` with current package/reproducibility/supply-chain workflows terminal GREEN on its recorded ancestry. #20 is exact `475ce14185db697940e8219c3cda7f24d66f3ed7`. #21 is exact `5cfab7d4819b94f3679d649367868e60f9c0d55a`, Draft/non-mergeable on stale ancestry with zero current PR workflows. #27 owns the provider-neutral external-capability/security-artifact-admission grammar repair. No mutable PR head is release authority. +Live metadata still reports `develop` as default for both Context Graph Contracts and EA Core while their accepted integration target is protected `main`; branch topology/protection reconciliation remains a Context Fabric/.github owner-path defect, not a user choice. Neither repository currently publishes a GitHub Release. -For `enterprise-architecture-core`, parent #39 remains the dependency parent for projection work. Projection child #40 is now exact `8bc147a017259d1883bb8fb1c1f1bbb5ee3af050`, Draft/non-mergeable on obsolete #39 ancestry. Comparison from `8266a7841550963072ec00a4be05eac41e894b59` proves the new commit has zero file delta and only attempts `ci: re-dispatch projection receipt RED`; exact `8bc147a...` still has zero PR workflow runs. The underlying owner RED at `8266a784...` requires distinct `profile_id` retention in projection-receipt semantics, but the zero-tree redispatch neither changes that test nor supplies executed evidence. Preserve the real RED source; route missing materialization to `.github#712` instead of repeating no-op commits. The separate Wardnet-security-admission versus Noema-activation architecture acceptance remains open on #45. +Context Graph Contracts keeps its stacked provider-neutral contract/release work open, with #27 owning the external-capability/security-artifact-admission grammar. No mutable CGC PR head is release authority. Enterprise Architecture Core keeps its projection stack open; projection receipt work remains Draft/unreleased and #45 owns Wardnet security-control projection acceptance. Missing or zero-tree re-dispatch workflow evidence remains a central control-plane defect rather than architecture evidence. -Canonical dependency lanes also remain open and unreleased: quarantine-sandbox-runtime #17 owns credential-free hostile plugin/artifact execution evidence; EgressWeave #240 owns exact external-extension/remote-MCP egress mediation and receipts; appguardrail #1036/#1099 own static skill/plugin supply-chain detectors and exact scan receipts; contextual-orchestrator remains model/provider-routing authority and currently has no immutable GitHub Release. None is copied into Wardnet. +Canonical dependency lanes remain foreign-owner work and unreleased: quarantine-sandbox-runtime owns credential-free hostile execution evidence; EgressWeave owns exact external-extension/remote-MCP egress mediation; appguardrail owns static skill/plugin supply-chain detectors/receipts; contextual-orchestrator remains model/provider-routing authority. None is copied into Wardnet. ## Live Wardnet queue and order -Fresh open-PR inventory contains 27 lanes: `#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #153, #155, #156, #157, #158, #159, #160, #162, #164`. +Fresh open-PR inventory remains 27 lanes: `#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #153, #155, #156, #157, #158, #159, #160, #162, #164`. -Integration is prerequisite-driven: #155, then repaired #77; #136 after #155 truth; #164 only after #77 protected; #129 continues without absorbing quarantine/Noema/CO/EgressWeave/AppGuardrail; #153 before #156/#157/#158; #160 waits for the protected non-regressing central owner. #127 additionally requires real-browser current-head WCAG 2.2 AA evidence. #88 remains architecture-gated until contextual-orchestrator publishes a compatible immutable contract. Broad/stale #90/#95/#112/#114/#115 are repair/transfer lanes, not Close candidates. #162 separately owns the 2B-KRW customer-readiness versus USD-20B product-quality authority split. +Integration is prerequisite-driven: #155, then repaired #77; #136 after #155 truth; #164 only after #77 protected; #129 continues without absorbing quarantine/Noema/CO/EgressWeave/AppGuardrail; #153 before #156/#157/#158; #160 waits for the protected non-regressing central owner. #127 additionally requires real-browser current-head WCAG 2.2 AA evidence. #88 remains architecture-gated until contextual-orchestrator publishes a compatible immutable contract. Broad/stale #90/#95/#112/#114/#115 are repair/transfer lanes rather than Close candidates. #162 separately owns the 2B-KRW customer-readiness versus USD-20B product-quality authority split. -#130 is the sole writer for this file. Its branch advanced concurrently from `c03fad09...` to `7f610731fef4526a31afa1da5344901b6e49049a` with only this baseline modified; this refresh adopts that intervening delta instead of treating it as a race. The exact commit containing this paragraph is necessarily newer than that pre-refresh branch head, so GitHub PR metadata—not a self-referential SHA embedded here—is the authority for #130's current head. Before this refresh, exact `7f610731...` CI `33854209782`, SAST `33854209756` and Security Scan `33854209841` were queued/non-passing; the new documentation head requires fresh exact-head evidence. #140's live GitHub head is `6b0219dad241cfea9969e7e05c11a9937131b36b`, despite its stale body still naming predecessor `9389a2d...`; source/PR metadata on the live head is authoritative and the body should be repaired without resetting the branch. +#130 is the sole writer for this file. Its GitHub PR metadata, not a self-referential SHA inside this ledger, is the authority for its current exact head. This refresh adopts the live #129 security/authentication/decryption delta, current runner evidence and owner handoffs instead of duplicating the baseline on another branch. #140's PR body is now code-current at `6b0219dad241cfea9969e7e05c11a9937131b36b`; the older ledger statement that its body still named `9389a2d...` is retired. PR retirement requires protected merge, explicit user instruction, malicious/no-valid delta, or verified complete successor transfer of useful code/tests/fixtures/contracts/evidence. From 9046f71ec172adc633fa66425a1b00d975f12d67 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 02:15:05 +0900 Subject: [PATCH 56/73] docs(gaps): refresh Wardnet exact-head baseline --- docs/product-technical-gap-baseline.md | 79 +++++++++++++------------- 1 file changed, 39 insertions(+), 40 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index bdc99929..f1e4cba5 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,79 +1,78 @@ # Product and technical gap baseline -Snapshot date: 2026-09-04T18:50+09:00. Re-read live refs, PRs, reviews/threads, exact-head checks, rulesets, security results and releases before any merge, release, restack or foreign-owner handoff. This is Wardnet's sole commercial/product-technical current-state ledger, not an archive of superseded run state. +Snapshot date: 2026-09-05. Re-read live refs, PRs, review threads, exact-head checks, rulesets, security results and releases before any merge, release, restack or foreign-owner handoff. This is Wardnet's sole commercial/product-technical current-state ledger, not an archive of superseded run state. ## Authority boundary -Wardnet owns the Rust-first gateway/SOC control plane and the Gateway, Admission Policy, Artifact Identity, Security Analysis Integration, Network-Egress, SOC Evidence, Runtime Control, Audit-Provenance and Agent Artifact Admission bounded contexts. `quarantine-sandbox-runtime` owns hostile execution isolation and cleanup; `contextual-orchestrator` owns Agent/LLM/provider routing; EgressWeave owns outbound HTTP-policy authority; `appguardrail` owns deterministic static security analysis and scan receipts. Wardnet consumes released/versioned ports or ACLs only: no source copy, cross-service SQL or mutable sibling dependency. +Wardnet owns the Rust-first gateway/SOC control plane and the Gateway, Admission Policy, Artifact Identity, Security Analysis Integration, Network-Egress integration, SOC Evidence, Runtime Control, Audit-Provenance and Agent Artifact Admission bounded contexts. `quarantine-sandbox-runtime` owns hostile execution isolation and cleanup; `contextual-orchestrator` owns Agent/LLM/provider orchestration; EgressWeave owns reusable outbound HTTP policy; `appguardrail` owns static package/security analysis. Wardnet consumes released/versioned ports or ACLs only: no source copy, cross-service SQL or mutable sibling dependency. -`context-graph-contracts` is the provider-neutral Context Fabric Shared Kernel. `enterprise-architecture-core` is the EA Decision Plane. Both remain read-only from this lane while their Context Fabric owner is active. Wardnet security findings/verdicts remain Wardnet evidence; EA may reference validated risk/remediation evidence but must not copy it as authoritative architecture truth. +`context-graph-contracts` is the provider-neutral Context Fabric Shared Kernel. `enterprise-architecture-core` is the EA Decision Plane. Both remain read-only from this Wardnet lane while their Context Fabric owner is active. Wardnet findings and artifact verdicts remain Wardnet evidence; architecture may reference validated risk/remediation evidence without copying a raw verdict into authoritative EA truth. -Fresh release inventory on 2026-09-04 still finds no compatible immutable GitHub Release for Wardnet, Context Graph Contracts, EA Core, contextual-orchestrator, quarantine-sandbox-runtime, EgressWeave or appguardrail. Mutable sibling heads are non-authoritative. +Fresh release inventory remains empty for Wardnet, Context Graph Contracts, EA Core, contextual-orchestrator, quarantine-sandbox-runtime, EgressWeave and appguardrail. Mutable sibling heads are therefore not production/release authority. ## Protected truth and control plane -Protected/default Wardnet truth remains `main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. Live organization ruleset `18156473` still applies to `~DEFAULT_BRANCH` with one generic approving review, no required reviewer/team, required review-thread resolution and central required workflows, deletion/non-fast-forward protection, plus `OrganizationAdmin/always` bypass. Under the declared solo-maintainer model, self-approval and bot/model-as-human approval remain forbidden. `.github#772` and its current owner-plane successor own the narrow ruleset reconciliation; deterministic workflow/security/coverage/SBOM/provenance/thread/branch-integrity controls must remain. +Protected/default Wardnet truth is `main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. Organization ruleset `18156473` remains active on `~DEFAULT_BRANCH`; it retains one generic approving review, review-thread resolution, central required workflows, deletion/non-fast-forward protection and `OrganizationAdmin/always` bypass. Under the declared solo-maintainer model, self-approval and bot/model-as-human approval are forbidden. `.github#772` owns the narrow governance repair while deterministic workflow/security/coverage/SBOM/provenance/thread/branch-integrity controls remain or strengthen. -Runner/event/review materialization belongs to `.github#712` and related central lanes. Queued/pre-checkout jobs, missing workflow materialization, `runner_id=0`/null, empty steps, startup failures and model-review requests that never materialize a current-head verdict are non-passing. They do not justify no-op source churn, predecessor-evidence reuse or routine bypass. Current Wardnet #129 runner specimen is recorded on `.github#712` comment `5538701621`. +Runner/event/model-review materialization remains `.github#712` owner work. Queued/pre-checkout jobs with `runner_id=0`/null and `steps=[]`, startup failures, coverage materialization failures and review requests that never produce a current-head verdict are non-passing. They do not justify no-op source churn, predecessor evidence reuse, gate weakening or routine bypass. -## Immediate protected-main security path +## Agent Artifact Admission — current security lane -- **#155 management auth** — exact `e6f05d77858e91c176cff25c4b11e790bc5dcdd1`, mergeable but not merge-ready. Repository CI `33590350994`, Fuzz `33590350997`, Security Scan `33590350967` and SAST `33590350991` are terminal GREEN. Required OpenCode bootstrap/source-tree/coverage jobs also passed, but final review job `100659819151` acquired a hosted runner, successfully requested current-head review, then reached the central three-hour administrative boundary without a verdict and the run ended cancelled. `.github#712` comment `5535918616` owns verdict/timeout RCA. This is not a chicken-and-egg bypass case. -- **#77 Rust/deployment hardening** — exact `46fef54c9b5916eb77196fb515a8fabad13a05d1`. RED `43d2c874732063e418b3929e3435c388ccfa7c69` proved a first-match Kubernetes validator could hide a later duplicate target Deployment; GREEN `17a2a1e833e6c4cab6101ef6a534589d75a5920a` requires exactly one target identity and retains hostile duplicate-resource coverage. Fresh current-head CI `33807338426` and OSV `33807339076` are terminal success; Scorecard `33807338399`, Security Scan `33807338277` and SAST `33807338221` remain queued/non-passing, so no merge is authorized. -- **#136 Network-Egress** — exact `28e5776388b2fc31e1d0567382871a1f599aa3ed`, Draft/blocked. Runnable RED `3cb1047416c3aa7fa8eb352b842cc55ad8c21b19` / CI `33698726857` proved manual DNS lookup could outlive the operation budget. Production now carries one absolute Tokio deadline through DNS validation and remaining HTTP work; current head adds a pending-resolver cancellation regression. Exact-head CI/Fuzz/Security/SAST remain queued and the DNS review finding stays unresolved until unchanged-head hosted GREEN. Refresh against protected main after #155 integrates. +PR #129 is Draft/mergeable at exact `3f3da03884527d7ecea18cae9cab38b0bbbb0dbd`, directly ahead of protected `main` (`behind_by=0`). Its current scope is a pre-execution structured package-install admission boundary; it does not fetch, decrypt, install, execute, isolate or activate workloads. -## Agent Artifact Admission +The branch already fail-closes executable/ecosystem confusion, undeclared operands, indirect package sources, alternate registry/index/config/workspace/install roots, lifecycle/trust/integrity bypasses, Cargo source/version/build/overwrite/tracking authority, PyPI target/build variants and dependency expansion, npm-family resolver-selected transitive closure without a reviewed immutable material set, OCI platform/cardinality variants, and Podman TLS/authentication/decryption authority. -Draft #129 is now exact `c2ac4c2c0128e8875d8a45c857d3d771e96ca727`, mergeable on protected `main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. It is the pre-execution structured artifact-install security-admission boundary; it does not fetch, decrypt, install or execute workloads and does not own Noema activation, quarantine execution, EgressWeave transport policy or AppGuardrail static analysis. +Latest hostile TDD closes a pip parser-authority ambiguity: -The branch fail-closes executable/ecosystem confusion, undeclared operands, indirect source/config/workspace/root authority, lifecycle-script/trust/integrity bypasses, Cargo build variants, OCI platform ambiguity and mutable tag-set expansion. Earlier Docker/Podman cardinality repair covers bare `-a`/`--all-tags`, Boolean assignments, bundled `-aq`/`-qa`, and pflag final-shorthand assignment semantics such as hostile `-aq=false` versus admissible `-qa=false`. +- RED `032d74e060e778add00a2cc757ce3582c1135232` proves an otherwise approved direct PyPI request carrying both `--require-hashes` and hostile `--no-require-hashes` must not receive `allow`; +- classifier `4c0de8a3445d6b062b69440507cd3c81a3323308` isolates pip/pip3 hash-mode semantics in `pypi_hash_mode.rs`; +- admission repair `bba656c1d776da38a7315d9ec8e6cb5bdfd621d1` blocks the contradictory request with stable `missing_safety_flag` evidence; +- `CHANGELOG.md` and `docs/doctoring/pypi-hash-mode-authority.md` keep the code and current pip primary-source reasoning aligned. -Fresh 2026-09-04 Podman primary-source review added two more authority repairs: +An admission receipt still does not prove downloaded bytes. The downstream execution boundary must independently bind retrieved bytes or equivalent immutable provenance to the reviewed SHA-256 before installation/execution. -- registry-authentication RED `400c53265f21d684ab06232536b50341b5d524c0` proves attached `--authfile=...` and `--creds=...` could otherwise select authentication state/principal while an exact approved digest remained syntactically admissible; causal GREEN `3eade5d41c50d1ad4e48118014c50acf5d8f3793` rejects those options as `alternate_trust_root`; -- image-decryption RED `d7aa94fc3846e0ed189f90b5525df03d1a62e3ee` proves attached `--decryption-key=key:passphrase` could otherwise select secret-bearing decryption authority through untrusted argv; causal GREEN `261ecc20e280c3af45798cc396088260eb94ba50` rejects it at the same bounded authority predicate; -- doctoring `841abfd0a8494a2111afc8638ee6a863e1f75a18`, CHANGELOG `32c748e346f6dbe8b67514ffeb25dd19dfdbb531`, and current threat-model head `c2ac4c2c0128e8875d8a45c857d3d771e96ca727` keep the decision and downstream secret/runtime ownership code-current. +Exact-current-head runs are non-passing at runner acquisition: CI `33898982616`, Fuzz `33898982598`, CodeQL PR `33898982736`, SAST Semgrep `33898982757`, Security Scan `33898982652`. CI job `101108311380` is pre-checkout with `steps=[]`, `runner_id=0`, no runner/group identity and exact `head_sha=3f3da038...`. All returned inline review threads are resolved/outdated; no unresolved actionable thread is currently returned. `.github#712` comment `5543903041` owns this exact runner-acquisition specimen. No predecessor check/review conclusion transfers. -Wardnet never reads an authfile, credential, key, certificate or passphrase and does not authenticate to registries or decrypt images. Those authorities remain separately governed downstream secret/deployment/runtime boundaries. +No new Shared Kernel schema is required for the pip-local parser repair. `context-graph-contracts#27` owns provider-neutral external capability artifact/evidence/admission/activation grammar; `enterprise-architecture-core#45` owns architecture adoption/risk/provenance projection. Package-manager argv and Wardnet reason codes remain local implementation evidence. -Exact-head #129 CI `33860116349`, SAST `33860116392`, Security Scan `33860116481` and Fuzz `33860116659` are queued. CI job `100982384456` is pre-checkout with `steps=[]`, `runner_id=null`, no runner/group identity and exact `head_sha=c2ac4c2c...`. Returned inline review threads are resolved; review submissions remain COMMENTED rather than independent approval. `.github#712` comment `5538701621` carries exact current runner-admission RED/GREEN acceptance. +## Other immediate product/security lanes -Context Fabric owner handoffs are current on `context-graph-contracts#27`: comment `5538703380` requires provider-neutral contracts to reject raw decryption keys/key paths/passphrases as artifact authority and to carry only bounded secret-policy/key-handle/profile references where needed. EA owner handoff `enterprise-architecture-core#45` comment `5538705406` requires architecture projections to retain only immutable provenance/authority/profile/evidence references, never raw secrets, Podman syntax or Wardnet verdicts as authoritative architecture facts. +- **#155 management auth** — exact `e6f05d77858e91c176cff25c4b11e790bc5dcdd1`. Repository CI/Fuzz/Security/SAST are terminal GREEN, but the required OpenCode lane acquired a runner and then failed to materialize a current-head verdict before the central administrative boundary. `.github#712` owns that control-plane defect. Not a bypass case. +- **#77 Rust/deployment hardening** — exact `46fef54c9b5916eb77196fb515a8fabad13a05d1`; current candidate preserves the duplicate-Kubernetes-Deployment hostile regression and exact Rust toolchain pin. Current exact-head evidence must be re-read before any merge claim. +- **#136 outbound policy consumer evidence** — exact `28e5776388b2fc31e1d0567382871a1f599aa3ed`, Draft. Preserve the DNS/deadline/SSRF hostile evidence, but do not integrate its local egress-policy implementation. EgressWeave is the canonical policy owner and must publish an immutable compatible port/ACL before reconstruction. +- **#140 Runtime Configuration** — exact `6b0219dad241cfea9969e7e05c11a9937131b36b`; canonical owner for the immutable non-secret bootstrap snapshot. Feature lanes must adopt this foundation rather than create a competing configuration authority. +- **#159 workflow pressure repair** — exact `8dc374ed597292a9d97a25e7cdea832b5990b6dd`; sole writer for the CI/Fuzz workflow pressure slice, carrying explicit `ubuntu-24.04`, PR-number concurrency and a coalesced fuzz runner. Consumer lanes must not duplicate its workflow paths. +- **#165 trusted client attribution** — exact `3415b748bdf8c6ccd112f215b28cdc116895b861`, Draft/mergeable. It treats forwarding metadata as authority only behind configured trusted proxy CIDRs, keeps malformed chains fail-closed to the direct peer, and depends on #140 plus preservation of #157's still-unique fuzz evidence after workflow ownership settles. +- **#164 release evidence** — exact `1d3f5a4bd618084031f3e722804b7c61303baeb5`, Draft/stacked on #77. It separates PR build/SBOM evidence from protected-main OIDC attestation authority. Do not publish from the feature branch; restack after #77 becomes protected truth and reacquire all exact-head evidence. +- **#127 material UI/a11y** — source-level accessibility changes still require real-browser current-head keyboard/focus/accessibility/responsive/state evidence before merge; source-string tests alone are not WCAG 2.2 AA evidence. +- **#88 contextual-orchestrator boundary** — remains architecture-gated until contextual-orchestrator publishes a compatible immutable API/client/schema contract; retain useful credential grammar/negative tests, discard LiteLLM/provider-routing ownership from the eventual Wardnet consumer. -## Release and repository supply chain +## Baseline lane integrity -#164 is exact `1d3f5a4bd618084031f3e722804b7c61303baeb5`, Draft and stale on an older #77 parent. It separates PR build evidence from protected-main OIDC attestation authority, binds source/version/hashes and repairs a zero-job `runner.temp` workflow defect. Its release workflow materializes but the build remains runner-queued. After #77 reaches protected main, preserve the child delta in a non-force restack and reacquire exact-head evidence. #84 still requires immutable OCI identity/container-filesystem SBOM, admission-time verification, reproducibility, retention and tested migration/canary/rollback on one protected release candidate. +PR #130 remains the sole writer for this file. Fresh ancestry comparison corrects its stale PR-body narrative: branch `codex/main-gap-followup@66b9d1d183dfb733cf9c6283ec307cf9e06aff43` already contains current protected `main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128` (`behind_by=0`) and its effective diff against main is this baseline file only. A destructive rebase is neither required nor allowed. This refresh advances that branch linearly and invalidates predecessor checks for the new exact head. -#160 is exact `962623884347ccd52e653fb59504a7b848292086`. The first merged central reusable Scorecard owner would regress protected Wardnet from Scorecard v2.4.4 to v2.4.3; `.github#1777` owns the non-regressing protected successor. Wardnet keeps a thin caller and will consume only the protected successor SHA. +Fresh GitHub search returns 26 open Wardnet PR lanes: `#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #155, #156, #157, #158, #159, #162, #164, #165`. PRs not in this live set are not carried as open merely because an older snapshot listed them. -#153 remains the clean explicit-hosted-runner root at `b663f9d200e5f385c7dd067d074940a02836c68e`; #156/#157/#158 remain Draft dependents. #159 retains PR-number cancellation for superseded PR runs while keeping push evidence unique per run. +PR retirement still requires protected merge, explicit user instruction, malicious/no-valid delta, or verified complete successor transfer of every useful code/test/fixture/contract/evidence delta. ## Context Fabric read-only inventory -Live metadata still reports `develop` as default for both Context Graph Contracts and EA Core while their accepted integration target is protected `main`; branch topology/protection reconciliation remains a Context Fabric/.github owner-path defect, not a user choice. Neither repository currently publishes a GitHub Release. +Context Graph Contracts still reports default/protected `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`; `main` is the same tip but currently unprotected. Its active inherited ruleset is the same organization ruleset `18156473`; GitHub Release inventory is empty. Open stacked contract/release work remains unreleased, and #27 owns the external-capability artifact/evidence/admission/activation grammar. No mutable CGC head is consumer authority. -Context Graph Contracts keeps its stacked provider-neutral contract/release work open, with #27 owning the external-capability/security-artifact-admission grammar. No mutable CGC PR head is release authority. Enterprise Architecture Core keeps its projection stack open; projection receipt work remains Draft/unreleased and #45 owns Wardnet security-control projection acceptance. Missing or zero-tree re-dispatch workflow evidence remains a central control-plane defect rather than architecture evidence. +EA Core still reports default/protected `develop@dd71e40a86385fb7861b0f1be19891a3f3e29ece`; `main@ca6889497728e1a3f09d68790a9096576e13a3ff` remains a separate unprotected line. Its active inherited ruleset is `18156473`; GitHub Release inventory is empty. #45 owns portfolio architecture decisions for external capabilities and #20 tracks the protected-main/default transition and integration acceptance. Wardnet does not repair those repositories' source or PR state. -Canonical dependency lanes remain foreign-owner work and unreleased: quarantine-sandbox-runtime owns credential-free hostile execution evidence; EgressWeave owns exact external-extension/remote-MCP egress mediation; appguardrail owns static skill/plugin supply-chain detectors/receipts; contextual-orchestrator remains model/provider-routing authority. None is copied into Wardnet. +The default/protection mismatch in both owner repositories is an owner-plane operating defect, not a user-choice blocker. Context Fabric/.github owner automation must establish protected-main authority and then rebuild dependent stacks from fresh protected truth without transferring predecessor evidence. -## Live Wardnet queue and order +## Buyer-visible gap order -Fresh open-PR inventory remains 27 lanes: `#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #153, #155, #156, #157, #158, #159, #160, #162, #164`. +Current product-quality order remains security and authority first: #78 management authentication; #79 released outbound policy/evidence integration; #11 real attack-path CI and #75 deployable public path; #128 Agent Artifact Admission; #80 PostgreSQL authority/tenant isolation then #81 transactional outbox; #82 Keyverse identity/approval and #83 distributed admission; #86 proven Coraza/CRS and Suricata detection; #84 immutable release evidence; #85 telemetry/SLO/incident/restore; #87 final readiness against one immutable protected release identity. -Integration is prerequisite-driven: #155, then repaired #77; #136 after #155 truth; #164 only after #77 protected; #129 continues without absorbing quarantine/Noema/CO/EgressWeave/AppGuardrail; #153 before #156/#157/#158; #160 waits for the protected non-regressing central owner. #127 additionally requires real-browser current-head WCAG 2.2 AA evidence. #88 remains architecture-gated until contextual-orchestrator publishes a compatible immutable contract. Broad/stale #90/#95/#112/#114/#115 are repair/transfer lanes rather than Close candidates. #162 separately owns the 2B-KRW customer-readiness versus USD-20B product-quality authority split. +The USD 20 billion quality ambition is a product-quality bar, not a customer contract value or runtime pricing field. PR #162 owns that authority separation; this ledger tracks the resulting buyer-visible quality gaps rather than inventing valuation evidence. -#130 is the sole writer for this file. Its GitHub PR metadata, not a self-referential SHA inside this ledger, is the authority for its current exact head. This refresh adopts the live #129 security/authentication/decryption delta, current runner evidence and owner handoffs instead of duplicating the baseline on another branch. #140's PR body is now code-current at `6b0219dad241cfea9969e7e05c11a9937131b36b`; the older ledger statement that its body still named `9389a2d...` is retired. - -PR retirement requires protected merge, explicit user instruction, malicious/no-valid delta, or verified complete successor transfer of useful code/tests/fixtures/contracts/evidence. - -## Open production gaps - -Buyer-visible order remains: #78 management auth; #79 outbound policy/evidence/deadline; #11 real attack-path CI and #75 deployable public path; #128 Agent Artifact Admission; #80 PostgreSQL authority/tenant isolation then #81 transactional outbox; #82 Keyverse identity/approval and #83 distributed admission; #86 proven Coraza/CRS and Suricata detection; #84 immutable release evidence; #85 telemetry/SLO/incident/restore; #87 final readiness against one immutable protected release identity. - -Root `src/lib.rs` remains a modularity pressure point, not evidence by itself for a service split. Prefer a modular monolith until transaction, isolation, scale, deployment or reuse evidence pays for another deployable boundary. +Root `src/lib.rs` remains a modularity pressure point, not evidence by itself for a service split. Prefer a modular monolith until transaction, isolation, scale, deployment or reusable-owner evidence pays for another deployable boundary. ## Standards and release gate -Implementation evidence remains grounded in NIST SP 800-207, NIST SP 800-218/SSDF 1.1, OWASP ASVS 5.0.0 and relevant primary/peer-reviewed work. Citations constrain design but do not prove a control is shipped. Wardnet-owned production code targets 100% statement/branch/edge-case coverage and complete public rustdoc/docstrings; realistic bypass/replay/race/DoS/network/cleanup cases are required where applicable. +Implementation evidence remains grounded in current authoritative NIST/OWASP/CWE/IETF/OCI/Linux sources and primary/peer-reviewed research where the design depends on them. Citations constrain design but do not prove a control is shipped. Wardnet-owned production code targets 100% statement/branch/edge-case coverage and complete public rustdoc/docstrings with realistic bypass/replay/race/DoS/network/cleanup cases where applicable. No release is authorized at this snapshot. Release requires one exact integrated protected head with current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact identity and a verified publication path. Feature-branch artifacts or attestations remain branch evidence only. From 0f593ee0f4783717eea239d55db3ca77c0ab8891 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 03:15:26 +0900 Subject: [PATCH 57/73] docs(gaps): follow protected workflow foundation --- docs/product-technical-gap-baseline.md | 74 +++++++++++--------------- 1 file changed, 31 insertions(+), 43 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index f1e4cba5..2a77e6d2 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,78 +1,66 @@ # Product and technical gap baseline -Snapshot date: 2026-09-05. Re-read live refs, PRs, review threads, exact-head checks, rulesets, security results and releases before any merge, release, restack or foreign-owner handoff. This is Wardnet's sole commercial/product-technical current-state ledger, not an archive of superseded run state. +Snapshot date: 2026-09-05. Re-read live refs, PRs, reviews/threads, exact-head checks, rulesets, security evidence and releases before any merge, release, restack or foreign-owner handoff. This is Wardnet's sole commercial/product-technical current-state ledger, not an archive of predecessor evidence. ## Authority boundary -Wardnet owns the Rust-first gateway/SOC control plane and the Gateway, Admission Policy, Artifact Identity, Security Analysis Integration, Network-Egress integration, SOC Evidence, Runtime Control, Audit-Provenance and Agent Artifact Admission bounded contexts. `quarantine-sandbox-runtime` owns hostile execution isolation and cleanup; `contextual-orchestrator` owns Agent/LLM/provider orchestration; EgressWeave owns reusable outbound HTTP policy; `appguardrail` owns static package/security analysis. Wardnet consumes released/versioned ports or ACLs only: no source copy, cross-service SQL or mutable sibling dependency. +Wardnet owns the Rust-first gateway/SOC control plane and the Gateway, Admission Policy, Artifact Identity, Security Analysis Integration, Network-Egress integration, SOC Evidence, Runtime Control, Audit-Provenance and Agent Artifact Admission bounded contexts. `quarantine-sandbox-runtime` owns hostile execution isolation/cleanup; `contextual-orchestrator` owns Agent/LLM/provider orchestration; EgressWeave owns reusable outbound HTTP destination/address policy; `appguardrail` owns static package/security analysis. Wardnet consumes released/versioned ports or ACLs only: no source copy, cross-service SQL or mutable sibling production dependency. -`context-graph-contracts` is the provider-neutral Context Fabric Shared Kernel. `enterprise-architecture-core` is the EA Decision Plane. Both remain read-only from this Wardnet lane while their Context Fabric owner is active. Wardnet findings and artifact verdicts remain Wardnet evidence; architecture may reference validated risk/remediation evidence without copying a raw verdict into authoritative EA truth. +`context-graph-contracts` is the provider-neutral Context Fabric Shared Kernel and `enterprise-architecture-core` is the EA Decision Plane. Both remain read-only from this Wardnet writer while their Context Fabric owner is active. Wardnet findings/verdicts remain Wardnet evidence; EA may retain verified evidence references for technology risk/remediation/initiative context but must not copy raw security verdicts into authoritative architecture truth. -Fresh release inventory remains empty for Wardnet, Context Graph Contracts, EA Core, contextual-orchestrator, quarantine-sandbox-runtime, EgressWeave and appguardrail. Mutable sibling heads are therefore not production/release authority. +Fresh GitHub release inventories are empty for Wardnet, Context Graph Contracts, EA Core, `contextual-orchestrator`, `quarantine-sandbox-runtime`, EgressWeave and `appguardrail`. No mutable sibling head is production/release authority. ## Protected truth and control plane -Protected/default Wardnet truth is `main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128`. Organization ruleset `18156473` remains active on `~DEFAULT_BRANCH`; it retains one generic approving review, review-thread resolution, central required workflows, deletion/non-fast-forward protection and `OrganizationAdmin/always` bypass. Under the declared solo-maintainer model, self-approval and bot/model-as-human approval are forbidden. `.github#772` owns the narrow governance repair while deterministic workflow/security/coverage/SBOM/provenance/thread/branch-integrity controls remain or strengthen. +Protected/default Wardnet truth is now `main@5829a0f08d78de464dd24393ce5d0f25fba9d126`, produced by protected merge #159. #159 is no longer an open prerequisite: its CI/Fuzz/Scorecard pressure repair, explicit hosted-runner contract, `AGENTS.md` ownership guidance and workflow queue/runner regressions are protected truth and must be adopted by consumer lanes rather than copied or bypassed. -Runner/event/model-review materialization remains `.github#712` owner work. Queued/pre-checkout jobs with `runner_id=0`/null and `steps=[]`, startup failures, coverage materialization failures and review requests that never produce a current-head verdict are non-passing. They do not justify no-op source churn, predecessor evidence reuse, gate weakening or routine bypass. +Organization ruleset `18156473` remains active on `~DEFAULT_BRANCH`; live policy still requires one generic approving review with no named required reviewer, resolves review threads, requires central OpenCode/review-scheduler/Security/Strix/Semgrep/Noema/CodeQL workflows, and blocks deletion/non-fast-forward while exposing `OrganizationAdmin/always` bypass. Under the declared solo-maintainer model, self-approval and bot/model-as-human approval are forbidden. `.github#772` and its live owner-plane reconciliation lane own replacement of only the structurally impossible approval count/routine bypass while deterministic security/coverage/SBOM/provenance/thread/branch-integrity controls remain or strengthen. -## Agent Artifact Admission — current security lane +Runner/event/model-review acquisition/materialization remains `.github#712` owner work. Queued/pre-checkout jobs, `runner_id=0`, `steps=[]`, startup failure, coverage materialization failure or a started model-review request that never produces a current-head verdict are non-passing. They do not justify leaf no-op churn, predecessor evidence reuse, gate weakening or routine bypass. -PR #129 is Draft/mergeable at exact `3f3da03884527d7ecea18cae9cab38b0bbbb0dbd`, directly ahead of protected `main` (`behind_by=0`). Its current scope is a pre-execution structured package-install admission boundary; it does not fetch, decrypt, install, execute, isolate or activate workloads. +## Agent Artifact Admission -The branch already fail-closes executable/ecosystem confusion, undeclared operands, indirect package sources, alternate registry/index/config/workspace/install roots, lifecycle/trust/integrity bypasses, Cargo source/version/build/overwrite/tracking authority, PyPI target/build variants and dependency expansion, npm-family resolver-selected transitive closure without a reviewed immutable material set, OCI platform/cardinality variants, and Podman TLS/authentication/decryption authority. +PR #129 remains Draft/mergeable and is now non-destructively integrated onto protected #159 truth at exact `f6889079ce49b6f08865180dd6a1ffd8145a8192`; fresh ancestry reports `behind_by=0`. Its effective feature delta remains 67 files and does not duplicate the protected workflow-owner paths. -Latest hostile TDD closes a pip parser-authority ambiguity: +The bounded context is pre-execution structured installer security admission only. It binds reviewed workspace manifest/artifact identity, exact ecosystem/name/version/registry/owner/SHA-256, executable family, declared operands, policy revision and bounded provenance; it does not fetch, decrypt, install, execute, isolate, activate or route workloads. An `allow` receipt is admission authority, not downloaded-byte proof or runtime activation. -- RED `032d74e060e778add00a2cc757ce3582c1135232` proves an otherwise approved direct PyPI request carrying both `--require-hashes` and hostile `--no-require-hashes` must not receive `allow`; -- classifier `4c0de8a3445d6b062b69440507cd3c81a3323308` isolates pip/pip3 hash-mode semantics in `pypi_hash_mode.rs`; -- admission repair `bba656c1d776da38a7315d9ec8e6cb5bdfd621d1` blocks the contradictory request with stable `missing_safety_flag` evidence; -- `CHANGELOG.md` and `docs/doctoring/pypi-hash-mode-authority.md` keep the code and current pip primary-source reasoning aligned. +Current hostile TDD includes the PyPI hash-mode contradiction: RED `032d74e060e778add00a2cc757ce3582c1135232` proves `--require-hashes` plus hostile `--no-require-hashes` must not remain admissible; classifier `4c0de8a3445d6b062b69440507cd3c81a3323308` isolates pip/pip3 hash-mode authority; causal repair `bba656c1d776da38a7315d9ec8e6cb5bdfd621d1` fails the contradictory request closed. Earlier package-manager, Cargo, npm-family, OCI-cardinality/platform and Podman trust/auth/decryption hostile contracts remain preserved. -An admission receipt still does not prove downloaded bytes. The downstream execution boundary must independently bind retrieved bytes or equivalent immutable provenance to the reviewed SHA-256 before installation/execution. +Fresh current-head execution is non-passing/queued: CI `33904242427`, Fuzz `33904242501`, Security Scan `33904242429`, SAST Semgrep `33904242491`, CodeQL PR `33904242556`. No predecessor check/review conclusion transfers after the protected-main integration. -Exact-current-head runs are non-passing at runner acquisition: CI `33898982616`, Fuzz `33898982598`, CodeQL PR `33898982736`, SAST Semgrep `33898982757`, Security Scan `33898982652`. CI job `101108311380` is pre-checkout with `steps=[]`, `runner_id=0`, no runner/group identity and exact `head_sha=3f3da038...`. All returned inline review threads are resolved/outdated; no unresolved actionable thread is currently returned. `.github#712` comment `5543903041` owns this exact runner-acquisition specimen. No predecessor check/review conclusion transfers. +`context-graph-contracts#27` owns the future provider-neutral external-capability artifact/evidence/admission/activation grammar. The owner handoff requires security-artifact admission evidence to remain distinct from Noema governed activation/orchestration, with semantic request/artifact/policy/evidence identity and hostile fixtures preventing either authority from substituting for the other. Package-manager argv/parser semantics and Wardnet reason codes remain Wardnet-local. `enterprise-architecture-core#45` owns architecture adoption/risk/provenance projection and must retain evidence references without making Wardnet findings authoritative EA facts. -No new Shared Kernel schema is required for the pip-local parser repair. `context-graph-contracts#27` owns provider-neutral external capability artifact/evidence/admission/activation grammar; `enterprise-architecture-core#45` owns architecture adoption/risk/provenance projection. Package-manager argv and Wardnet reason codes remain local implementation evidence. +## Immediate product/security lanes -## Other immediate product/security lanes +- **#155 management auth** — exact `f74ff25a321dfb1d7109719e2a1fc77e47dc4898`, Ready/mergeable, non-destructively integrated onto current protected main with `behind_by=0`. Its 13-file delta fails closed before readiness when a non-loopback listener lacks a write-capable administrator credential. Fresh current-head CI `33904633002`, Fuzz `33904632999`, Security Scan `33904633208`, SAST `33904633082`, CodeQL PR `33904632978` are queued. The predecessor OpenCode run that acquired a runner but timed out waiting for a verdict is RCA evidence only. +- **#134 support-bundle regression** — exact `4db75680dcfa03d0592c62f08278fdef09c33694`, Ready/mergeable, `behind_by=0`; effective delta is 38 test lines in `src/lib.rs` binding support-bundle counts and administrator-secret redaction. Predecessor GREEN/cancelled review evidence does not transfer. +- **#140 Runtime Configuration** — canonical supporting-boundary owner for the immutable non-secret bootstrap snapshot. Feature lanes must adopt it rather than create a competing process-environment authority; it still requires fresh integration onto protected #159 truth before merge. +- **#157/#165 trusted client attribution** — #165 is the current production feature owner; #157 remains a preservation lane until all still-valid trusted-proxy fuzz/corpus/invariant evidence is demonstrably transferred after the workflow and Runtime Configuration foundations are protected. Do not close #157 merely because #165 exists. +- **#136 outbound policy** — preservation Draft only. Keep Wardnet-owned purpose/call-site/deadline/evidence hostile tests, but do not integrate the local destination/DNS/redirect/proxy/TLS policy implementation. EgressWeave must first publish an immutable Rust-consumable provider-neutral authorization/evidence boundary; current EgressWeave release inventory is empty. +- **#88 contextual-orchestrator consumer** — architecture-gated. Preserve unique fail-closed credential/header/streaming negative evidence, remove LiteLLM/provider-routing/virtual-key ownership when reconstructing, and consume only a released CO API/client/schema/Agent boundary. Current CO release inventory is empty. +- **#164 release evidence** — Draft stacked on #77. It separates PR build/SBOM evidence from protected-main OIDC attestation authority. Do not publish from a feature branch; after the Rust/toolchain parent is protected truth, restack on fresh main and reacquire exact-head package/SBOM/provenance/reproducibility evidence. +- **#127 material UI/a11y** — source accessibility changes still require current-head real-browser keyboard/focus/accessibility/responsive/normal-loading-empty-error-permission evidence; source-string tests alone are not WCAG 2.2 AA evidence. -- **#155 management auth** — exact `e6f05d77858e91c176cff25c4b11e790bc5dcdd1`. Repository CI/Fuzz/Security/SAST are terminal GREEN, but the required OpenCode lane acquired a runner and then failed to materialize a current-head verdict before the central administrative boundary. `.github#712` owns that control-plane defect. Not a bypass case. -- **#77 Rust/deployment hardening** — exact `46fef54c9b5916eb77196fb515a8fabad13a05d1`; current candidate preserves the duplicate-Kubernetes-Deployment hostile regression and exact Rust toolchain pin. Current exact-head evidence must be re-read before any merge claim. -- **#136 outbound policy consumer evidence** — exact `28e5776388b2fc31e1d0567382871a1f599aa3ed`, Draft. Preserve the DNS/deadline/SSRF hostile evidence, but do not integrate its local egress-policy implementation. EgressWeave is the canonical policy owner and must publish an immutable compatible port/ACL before reconstruction. -- **#140 Runtime Configuration** — exact `6b0219dad241cfea9969e7e05c11a9937131b36b`; canonical owner for the immutable non-secret bootstrap snapshot. Feature lanes must adopt this foundation rather than create a competing configuration authority. -- **#159 workflow pressure repair** — exact `8dc374ed597292a9d97a25e7cdea832b5990b6dd`; sole writer for the CI/Fuzz workflow pressure slice, carrying explicit `ubuntu-24.04`, PR-number concurrency and a coalesced fuzz runner. Consumer lanes must not duplicate its workflow paths. -- **#165 trusted client attribution** — exact `3415b748bdf8c6ccd112f215b28cdc116895b861`, Draft/mergeable. It treats forwarding metadata as authority only behind configured trusted proxy CIDRs, keeps malformed chains fail-closed to the direct peer, and depends on #140 plus preservation of #157's still-unique fuzz evidence after workflow ownership settles. -- **#164 release evidence** — exact `1d3f5a4bd618084031f3e722804b7c61303baeb5`, Draft/stacked on #77. It separates PR build/SBOM evidence from protected-main OIDC attestation authority. Do not publish from the feature branch; restack after #77 becomes protected truth and reacquire all exact-head evidence. -- **#127 material UI/a11y** — source-level accessibility changes still require real-browser current-head keyboard/focus/accessibility/responsive/state evidence before merge; source-string tests alone are not WCAG 2.2 AA evidence. -- **#88 contextual-orchestrator boundary** — remains architecture-gated until contextual-orchestrator publishes a compatible immutable API/client/schema contract; retain useful credential grammar/negative tests, discard LiteLLM/provider-routing ownership from the eventual Wardnet consumer. +## Open PR inventory and single-writer discipline -## Baseline lane integrity +Fresh search returns 25 open Wardnet PR lanes: `#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #155, #156, #157, #158, #162, #164, #165`. #159 is excluded because it is now protected-main truth. -PR #130 remains the sole writer for this file. Fresh ancestry comparison corrects its stale PR-body narrative: branch `codex/main-gap-followup@66b9d1d183dfb733cf9c6283ec307cf9e06aff43` already contains current protected `main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128` (`behind_by=0`) and its effective diff against main is this baseline file only. A destructive rebase is neither required nor allowed. This refresh advances that branch linearly and invalidates predecessor checks for the new exact head. - -Fresh GitHub search returns 26 open Wardnet PR lanes: `#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #155, #156, #157, #158, #159, #162, #164, #165`. PRs not in this live set are not carried as open merely because an older snapshot listed them. - -PR retirement still requires protected merge, explicit user instruction, malicious/no-valid delta, or verified complete successor transfer of every useful code/test/fixture/contract/evidence delta. +PR #130 remains the sole writer for this file. It has adopted protected #159 non-destructively; this refresh is the only concurrent edit to `docs/product-technical-gap-baseline.md`. Other lanes hand evidence into #130 rather than editing this path. PR retirement still requires protected merge, explicit user instruction, malicious/no-valid delta, or verified complete successor transfer of every useful code/test/fixture/contract/evidence delta. ## Context Fabric read-only inventory -Context Graph Contracts still reports default/protected `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`; `main` is the same tip but currently unprotected. Its active inherited ruleset is the same organization ruleset `18156473`; GitHub Release inventory is empty. Open stacked contract/release work remains unreleased, and #27 owns the external-capability artifact/evidence/admission/activation grammar. No mutable CGC head is consumer authority. +Context Graph Contracts still reports default/protected `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`; `main` points to the same tip but is unprotected. Ruleset `18156473` follows `~DEFAULT_BRANCH`, so it currently governs `develop`. GitHub Releases are empty. The open dependency stack remains Draft/unreleased; #27 owns external-capability artifact/evidence/admission/activation semantics. This branch-topology mismatch is Context Fabric/.github owner-plane work, not a Wardnet or user decision. -EA Core still reports default/protected `develop@dd71e40a86385fb7861b0f1be19891a3f3e29ece`; `main@ca6889497728e1a3f09d68790a9096576e13a3ff` remains a separate unprotected line. Its active inherited ruleset is `18156473`; GitHub Release inventory is empty. #45 owns portfolio architecture decisions for external capabilities and #20 tracks the protected-main/default transition and integration acceptance. Wardnet does not repair those repositories' source or PR state. - -The default/protection mismatch in both owner repositories is an owner-plane operating defect, not a user-choice blocker. Context Fabric/.github owner automation must establish protected-main authority and then rebuild dependent stacks from fresh protected truth without transferring predecessor evidence. +EA Core still reports default/protected `develop@dd71e40a86385fb7861b0f1be19891a3f3e29ece`; active product-line `main@ca6889497728e1a3f09d68790a9096576e13a3ff` remains outside default-branch authority. The same organization ruleset follows `develop`; GitHub Releases are empty. #45 owns external-capability portfolio/adoption decisions; #40 is a Draft Context Fabric projection consumer and currently reports missing exact-head workflow materialization. Wardnet does not mutate EA source/PR state. ## Buyer-visible gap order -Current product-quality order remains security and authority first: #78 management authentication; #79 released outbound policy/evidence integration; #11 real attack-path CI and #75 deployable public path; #128 Agent Artifact Admission; #80 PostgreSQL authority/tenant isolation then #81 transactional outbox; #82 Keyverse identity/approval and #83 distributed admission; #86 proven Coraza/CRS and Suricata detection; #84 immutable release evidence; #85 telemetry/SLO/incident/restore; #87 final readiness against one immutable protected release identity. - -The USD 20 billion quality ambition is a product-quality bar, not a customer contract value or runtime pricing field. PR #162 owns that authority separation; this ledger tracks the resulting buyer-visible quality gaps rather than inventing valuation evidence. +Current order remains authority/security before breadth: protected management authentication (#78/#155); immutable outbound policy/evidence integration (#79/#136 + EgressWeave owner release); real attack-path CI and deployable public path (#11/#75); Agent Artifact Admission (#128/#129); PostgreSQL authority/tenant isolation (#80) then transactional outbox (#81); Keyverse identity/approval (#82) and distributed admission/trusted attribution (#83); proven Coraza/CRS and Suricata detection (#86); immutable release evidence (#84); telemetry/SLO/incident/restore (#85); final readiness against one immutable protected release identity (#87). -Root `src/lib.rs` remains a modularity pressure point, not evidence by itself for a service split. Prefer a modular monolith until transaction, isolation, scale, deployment or reusable-owner evidence pays for another deployable boundary. +The USD 20 billion ambition is a product-quality bar, not a customer contract value, billing field or runtime pricing authority. #162 owns that documentation separation. Root `src/lib.rs` remains a modularity pressure point, not evidence by itself for a deployable service split; prefer a modular monolith until transaction/isolation/scale/deployment/reusable-owner evidence pays for another boundary. ## Standards and release gate -Implementation evidence remains grounded in current authoritative NIST/OWASP/CWE/IETF/OCI/Linux sources and primary/peer-reviewed research where the design depends on them. Citations constrain design but do not prove a control is shipped. Wardnet-owned production code targets 100% statement/branch/edge-case coverage and complete public rustdoc/docstrings with realistic bypass/replay/race/DoS/network/cleanup cases where applicable. +Security and runtime decisions remain traceable to current authoritative NIST/OWASP/CWE/IETF/OCI/Linux sources and primary/peer-reviewed research where the implementation depends on them. Citation is design evidence, not proof that a control is shipped. Wardnet-owned production targets 100% statement/branch/edge-case coverage and complete public rustdoc/docstrings, with realistic bypass/replay/race/DoS/network/cleanup tests where applicable. -No release is authorized at this snapshot. Release requires one exact integrated protected head with current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact identity and a verified publication path. Feature-branch artifacts or attestations remain branch evidence only. +No Wardnet release is authorized at this snapshot. Release requires one exact integrated protected head with terminal current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact/source identity and a verified publication path. Feature-branch artifacts or attestations remain candidate evidence only. From 0055829ca3036a629146b9274a4fa5723edc1b6f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 07:54:36 +0900 Subject: [PATCH 58/73] docs(gaps): refresh exact Wardnet readiness state --- docs/product-technical-gap-baseline.md | 38 ++++++++++++++------------ 1 file changed, 21 insertions(+), 17 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 2a77e6d2..1b02c1e6 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -8,50 +8,54 @@ Wardnet owns the Rust-first gateway/SOC control plane and the Gateway, Admission `context-graph-contracts` is the provider-neutral Context Fabric Shared Kernel and `enterprise-architecture-core` is the EA Decision Plane. Both remain read-only from this Wardnet writer while their Context Fabric owner is active. Wardnet findings/verdicts remain Wardnet evidence; EA may retain verified evidence references for technology risk/remediation/initiative context but must not copy raw security verdicts into authoritative architecture truth. -Fresh GitHub release inventories are empty for Wardnet, Context Graph Contracts, EA Core, `contextual-orchestrator`, `quarantine-sandbox-runtime`, EgressWeave and `appguardrail`. No mutable sibling head is production/release authority. +Fresh GitHub release inventories remain empty for Wardnet, Context Graph Contracts, EA Core, `contextual-orchestrator`, `quarantine-sandbox-runtime`, EgressWeave and `appguardrail`. No mutable sibling head is production/release authority. ## Protected truth and control plane -Protected/default Wardnet truth is now `main@5829a0f08d78de464dd24393ce5d0f25fba9d126`, produced by protected merge #159. #159 is no longer an open prerequisite: its CI/Fuzz/Scorecard pressure repair, explicit hosted-runner contract, `AGENTS.md` ownership guidance and workflow queue/runner regressions are protected truth and must be adopted by consumer lanes rather than copied or bypassed. +Protected/default Wardnet truth remains `main@5829a0f08d78de464dd24393ce5d0f25fba9d126`, produced by protected merge #159. #159 is protected workflow-control truth: its CI/Fuzz/Scorecard pressure repair, explicit hosted-runner contract, `AGENTS.md` ownership guidance and workflow queue/runner regressions must be adopted by consumer lanes rather than copied or bypassed. -Organization ruleset `18156473` remains active on `~DEFAULT_BRANCH`; live policy still requires one generic approving review with no named required reviewer, resolves review threads, requires central OpenCode/review-scheduler/Security/Strix/Semgrep/Noema/CodeQL workflows, and blocks deletion/non-fast-forward while exposing `OrganizationAdmin/always` bypass. Under the declared solo-maintainer model, self-approval and bot/model-as-human approval are forbidden. `.github#772` and its live owner-plane reconciliation lane own replacement of only the structurally impossible approval count/routine bypass while deterministic security/coverage/SBOM/provenance/thread/branch-integrity controls remain or strengthen. +Organization ruleset `18156473` remains active on `~DEFAULT_BRANCH`. Fresh live policy still requires one generic approving review with no named required reviewer, requires review-thread resolution and central OpenCode/review-scheduler/Security/Strix/Semgrep/Noema/CodeQL workflows, blocks deletion/non-fast-forward, and exposes `OrganizationAdmin/always` bypass. Under the declared solo-maintainer model, self-approval and bot/model-as-human approval remain forbidden. `.github#772` and its live successor own replacement of only the structurally impossible approval deadlock/routine-bypass defect while deterministic security/coverage/SBOM/provenance/thread/branch-integrity controls remain or strengthen. -Runner/event/model-review acquisition/materialization remains `.github#712` owner work. Queued/pre-checkout jobs, `runner_id=0`, `steps=[]`, startup failure, coverage materialization failure or a started model-review request that never produces a current-head verdict are non-passing. They do not justify leaf no-op churn, predecessor evidence reuse, gate weakening or routine bypass. +Runner/event/model-review acquisition/materialization remains `.github#712` owner work. Queued/pre-checkout jobs, `runner_id=0`, `steps=[]`, startup failure, coverage materialization failure or a started model-review request that never produces a current-head verdict are non-passing. They do not justify leaf no-op churn, predecessor evidence reuse, runner-label guessing, gate weakening or routine bypass. ## Agent Artifact Admission -PR #129 remains Draft/mergeable and is now non-destructively integrated onto protected #159 truth at exact `f6889079ce49b6f08865180dd6a1ffd8145a8192`; fresh ancestry reports `behind_by=0`. Its effective feature delta remains 67 files and does not duplicate the protected workflow-owner paths. +PR #129 remains Draft/mergeable on protected #159 truth at exact `f6889079ce49b6f08865180dd6a1ffd8145a8192`; its protected-main-relative feature slice remains the Agent Artifact Admission candidate rather than runtime execution/isolation/orchestration authority. The bounded context is pre-execution structured installer security admission only. It binds reviewed workspace manifest/artifact identity, exact ecosystem/name/version/registry/owner/SHA-256, executable family, declared operands, policy revision and bounded provenance; it does not fetch, decrypt, install, execute, isolate, activate or route workloads. An `allow` receipt is admission authority, not downloaded-byte proof or runtime activation. Current hostile TDD includes the PyPI hash-mode contradiction: RED `032d74e060e778add00a2cc757ce3582c1135232` proves `--require-hashes` plus hostile `--no-require-hashes` must not remain admissible; classifier `4c0de8a3445d6b062b69440507cd3c81a3323308` isolates pip/pip3 hash-mode authority; causal repair `bba656c1d776da38a7315d9ec8e6cb5bdfd621d1` fails the contradictory request closed. Earlier package-manager, Cargo, npm-family, OCI-cardinality/platform and Podman trust/auth/decryption hostile contracts remain preserved. -Fresh current-head execution is non-passing/queued: CI `33904242427`, Fuzz `33904242501`, Security Scan `33904242429`, SAST Semgrep `33904242491`, CodeQL PR `33904242556`. No predecessor check/review conclusion transfers after the protected-main integration. +Fresh current-head execution is terminal but non-passing: CI `33904242427`, Fuzz `33904242501`, Security Scan `33904242429`, SAST Semgrep `33904242491`, and CodeQL PR `33904242556` all completed `cancelled`. A cancelled Draft/current-head run is not GREEN and no predecessor evidence transfers. -`context-graph-contracts#27` owns the future provider-neutral external-capability artifact/evidence/admission/activation grammar. The owner handoff requires security-artifact admission evidence to remain distinct from Noema governed activation/orchestration, with semantic request/artifact/policy/evidence identity and hostile fixtures preventing either authority from substituting for the other. Package-manager argv/parser semantics and Wardnet reason codes remain Wardnet-local. `enterprise-architecture-core#45` owns architecture adoption/risk/provenance projection and must retain evidence references without making Wardnet findings authoritative EA facts. +`context-graph-contracts#27` owns the future provider-neutral external-capability artifact/evidence/admission/activation grammar. Package-manager argv/parser semantics and Wardnet reason codes remain Wardnet-local. `enterprise-architecture-core#45` owns architecture adoption/risk/provenance projection and must retain evidence references without making Wardnet findings authoritative EA facts. ## Immediate product/security lanes -- **#155 management auth** — exact `f74ff25a321dfb1d7109719e2a1fc77e47dc4898`, Ready/mergeable, non-destructively integrated onto current protected main with `behind_by=0`. Its 13-file delta fails closed before readiness when a non-loopback listener lacks a write-capable administrator credential. Fresh current-head CI `33904633002`, Fuzz `33904632999`, Security Scan `33904633208`, SAST `33904633082`, CodeQL PR `33904632978` are queued. The predecessor OpenCode run that acquired a runner but timed out waiting for a verdict is RCA evidence only. -- **#134 support-bundle regression** — exact `4db75680dcfa03d0592c62f08278fdef09c33694`, Ready/mergeable, `behind_by=0`; effective delta is 38 test lines in `src/lib.rs` binding support-bundle counts and administrator-secret redaction. Predecessor GREEN/cancelled review evidence does not transfer. -- **#140 Runtime Configuration** — canonical supporting-boundary owner for the immutable non-secret bootstrap snapshot. Feature lanes must adopt it rather than create a competing process-environment authority; it still requires fresh integration onto protected #159 truth before merge. -- **#157/#165 trusted client attribution** — #165 is the current production feature owner; #157 remains a preservation lane until all still-valid trusted-proxy fuzz/corpus/invariant evidence is demonstrably transferred after the workflow and Runtime Configuration foundations are protected. Do not close #157 merely because #165 exists. +- **#155 management auth** — exact `f74ff25a321dfb1d7109719e2a1fc77e47dc4898`, Ready/mergeable and aligned with current protected main. Its 13-file delta fails closed before readiness when a non-loopback listener lacks a write-capable administrator credential. Fresh exact-head CI `33904633002` and Fuzz `33904632999` are terminal `success`; Security Scan `33904633208`, SAST Semgrep `33904633082`, and CodeQL PR `33904632978` remain queued. This is partial exact-head evidence only. +- **#134 support-bundle regression** — exact `4db75680dcfa03d0592c62f08278fdef09c33694`, Ready/mergeable and aligned with protected main; effective delta is test-only support-bundle count/secret-redaction hardening in `src/lib.rs`. Fresh CI `33904089788` and Fuzz `33904089833` are terminal `success`; Security Scan `33904089875`, SAST Semgrep `33904089782`, and CodeQL PR `33904089799` remain queued. +- **#140 Runtime Configuration** — canonical supporting-boundary owner at exact `054c11aafe835e497d6149efb09f1ccdee9d03bd`, Ready/mergeable on current protected main. Hostile RED `0f22aaff...` rejects zero positive bounds; causal repair `d28a0119...` fixes the positive-u64 bootstrap parser while preserving the distinct `RATE_LIMIT=0` disable semantic. Current CI `33923492873` is queued, Fuzz `33923492809` pending, Security `33923492923`, SAST `33923493032`, and CodeQL `33923492956` queued. Feature lanes must adopt #140 rather than create a competing process-environment authority. +- **#157/#165 trusted client attribution** — #165 is the current production feature owner at exact `99581e056645e98e866157443a6732a4bbd729c4`; #157 remains a preservation lane for unique trusted-proxy fuzz/corpus/invariant evidence. #165 must adopt #140 after that foundation reaches protected truth and prove complete #157 evidence transfer before #157 can retire. Current #165 CI/Fuzz/Security/SAST are cancelled and CodeQL `33923347950` remains pending; no GREEN transfers. +- **#166 Wardnet-local PR queue policy** — exact `95360a0261d9e5f5718fc434a13237d0abda260f`, intentionally Draft. RED `fbbcca...` now pins the `AGENTS.md` invariant that only genuinely superseded heads may be cancelled. CI/Fuzz use immutable `wardnet-ci`/`wardnet-fuzz` group identities, allow cancellation only on `synchronize`, keep `reopened`/`ready_for_review` state-only runs independent, and do not use Draft/closed state transitions as cancellation signals. Current Draft-event CI `33926977966` and Fuzz `33926977918` are `skipped`; Security `33926977976` queued, SAST `33926978027` pending, CodeQL `33926977882` queued. One canonical review finding remains unresolved because the CC BY 4.0 ICSE 2025/arXiv research PDF required by the repository evidence-pack rule is not yet committed at `docs/papers/ci-at-scale-lean-green-fast-arxiv-2501.03440.pdf`; citation-only evidence is insufficient. Keep Draft and do not treat skipped runs as GREEN. - **#136 outbound policy** — preservation Draft only. Keep Wardnet-owned purpose/call-site/deadline/evidence hostile tests, but do not integrate the local destination/DNS/redirect/proxy/TLS policy implementation. EgressWeave must first publish an immutable Rust-consumable provider-neutral authorization/evidence boundary; current EgressWeave release inventory is empty. -- **#88 contextual-orchestrator consumer** — architecture-gated. Preserve unique fail-closed credential/header/streaming negative evidence, remove LiteLLM/provider-routing/virtual-key ownership when reconstructing, and consume only a released CO API/client/schema/Agent boundary. Current CO release inventory is empty. +- **#88 contextual-orchestrator consumer** — architecture-gated preservation. Preserve unique fail-closed credential/header/streaming negative evidence, remove LiteLLM/provider-routing/virtual-key ownership when reconstructing, and consume only a released CO API/client/schema/Agent boundary. Current CO release inventory is empty. - **#164 release evidence** — Draft stacked on #77. It separates PR build/SBOM evidence from protected-main OIDC attestation authority. Do not publish from a feature branch; after the Rust/toolchain parent is protected truth, restack on fresh main and reacquire exact-head package/SBOM/provenance/reproducibility evidence. -- **#127 material UI/a11y** — source accessibility changes still require current-head real-browser keyboard/focus/accessibility/responsive/normal-loading-empty-error-permission evidence; source-string tests alone are not WCAG 2.2 AA evidence. +- **#127 material UI/a11y** — exact `35f4b7a261c15f4549f8e77f40688adc4bb501b0`, non-force aligned with protected main and intentionally Draft. Its effective protected-main-relative delta is only `src/lib.rs`; current CI `33926592588`, Fuzz `33926592516`, Security `33926592531`, SAST `33926592501`, and CodeQL `33926592522` remain queued. Before Ready it still requires production-like browser E2E for keyboard skip/focus, accessible names/descriptions, KPI live-region behavior, responsive widths, and applicable normal/loading/error/permission states; source-string tests alone are not WCAG 2.2 AA evidence. +- **#90 SIEM/OpenTelemetry preservation** — exact `2d251183c41f49b07d443ff15fe9e54472d90f63`, Draft/non-mergeable mixed aggregate branch. Preserve its unique Wardnet-owned OCSF/OTLP/RFC 5424 exporter/input/fuzz/security evidence through a bounded successor from fresh protected main; do not inherit stale `.github`, generic architecture/change-log, product-gap or other owner surfaces wholesale. Close only after complete verified successor transfer. ## Open PR inventory and single-writer discipline -Fresh search returns 25 open Wardnet PR lanes: `#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #155, #156, #157, #158, #162, #164, #165`. #159 is excluded because it is now protected-main truth. +Fresh search returns 26 open Wardnet PR lanes: `#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #155, #156, #157, #158, #162, #164, #165, #166`. #159 is excluded because it is protected-main truth. -PR #130 remains the sole writer for this file. It has adopted protected #159 non-destructively; this refresh is the only concurrent edit to `docs/product-technical-gap-baseline.md`. Other lanes hand evidence into #130 rather than editing this path. PR retirement still requires protected merge, explicit user instruction, malicious/no-valid delta, or verified complete successor transfer of every useful code/test/fixture/contract/evidence delta. +PR #130 remains the sole writer for this file. Other Wardnet lanes hand exact evidence into #130 rather than editing this path. PR retirement still requires protected merge, explicit user instruction, malicious/no-valid delta, or verified complete successor transfer of every useful code/test/fixture/contract/evidence delta. ## Context Fabric read-only inventory -Context Graph Contracts still reports default/protected `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13`; `main` points to the same tip but is unprotected. Ruleset `18156473` follows `~DEFAULT_BRANCH`, so it currently governs `develop`. GitHub Releases are empty. The open dependency stack remains Draft/unreleased; #27 owns external-capability artifact/evidence/admission/activation semantics. This branch-topology mismatch is Context Fabric/.github owner-plane work, not a Wardnet or user decision. +Context Graph Contracts still reports protected/default `develop`; its accepted integration/default target is protected `main`, and the open dependency stack remains Draft/unreleased. `context-graph-contracts#27` owns external-capability artifact/evidence/admission/activation semantics. The branch-topology mismatch and protected-main transition are Context Fabric/`.github` owner-plane work, not a Wardnet or user decision. -EA Core still reports default/protected `develop@dd71e40a86385fb7861b0f1be19891a3f3e29ece`; active product-line `main@ca6889497728e1a3f09d68790a9096576e13a3ff` remains outside default-branch authority. The same organization ruleset follows `develop`; GitHub Releases are empty. #45 owns external-capability portfolio/adoption decisions; #40 is a Draft Context Fabric projection consumer and currently reports missing exact-head workflow materialization. Wardnet does not mutate EA source/PR state. +EA Core likewise still reports protected/default `develop` while accepted integration/default is protected `main`. Its open Context Fabric projection work preserves quarantine as the canonical isolation-runtime/artifact-analysis-evidence owner and keeps `Wardnet -> artifact_analysis_evidence` directional. `malware_verdict` and `artifact_risk_score` remain forbidden as authoritative EA facts; direct foreign database access/source copying remain prohibited. EA #40 remains Draft and its exact-current repository workflow materialization is still an owner-plane concern. Wardnet does not mutate EA source/PR state. + +Both Context Fabric repositories remain without immutable GitHub Releases at this snapshot. Wardnet therefore fails closed on mutable Context Graph/EA heads as production authority. ## Buyer-visible gap order From c35e6598edb915fd01c841a121c64fe69ce40453 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 09:03:59 +0900 Subject: [PATCH 59/73] docs(gaps): track MISP fail-closed admission --- docs/product-technical-gap-baseline.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 1b02c1e6..9f944f97 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -32,6 +32,7 @@ Fresh current-head execution is terminal but non-passing: CI `33904242427`, Fuzz ## Immediate product/security lanes +- **#167 MISP `to_ids` admission** — exact `03da951e5e4b41cbde91f48c6a32a9c7f43db872`, Ready/mergeable on current protected main. The repair requires affirmative recognized `to_ids` evidence before a MISP attribute can materialize `ThreatIndicator`/`DnsblEntry` enforcement rows: object, array, `null`, and omitted values fail closed and increment `skipped_attributes`, while the pre-existing explicit scalar compatibility spellings remain unchanged. The focused hostile regression, primary MISP contract traceability, Saltzer–Schroeder fail-safe-default rationale, and the repository's archived Manès et al. fuzzing survey are on the exact head; current inline review inventory has zero unresolved findings/threads. Exact CI `33928902967`, Fuzz `33928902926`, Security Scan `33928902899`, SAST Semgrep `33928902901`, and CodeQL PR `33928902850` remain non-passing because their current jobs are pre-checkout/runner-unassigned (`runner_id=0`, `steps=[]`). Fresh exact owner handoff is `.github#712` comment `5547848609`; do not manufacture a no-op redispatch or use bypass while deterministic gates are non-GREEN. - **#155 management auth** — exact `f74ff25a321dfb1d7109719e2a1fc77e47dc4898`, Ready/mergeable and aligned with current protected main. Its 13-file delta fails closed before readiness when a non-loopback listener lacks a write-capable administrator credential. Fresh exact-head CI `33904633002` and Fuzz `33904632999` are terminal `success`; Security Scan `33904633208`, SAST Semgrep `33904633082`, and CodeQL PR `33904632978` remain queued. This is partial exact-head evidence only. - **#134 support-bundle regression** — exact `4db75680dcfa03d0592c62f08278fdef09c33694`, Ready/mergeable and aligned with protected main; effective delta is test-only support-bundle count/secret-redaction hardening in `src/lib.rs`. Fresh CI `33904089788` and Fuzz `33904089833` are terminal `success`; Security Scan `33904089875`, SAST Semgrep `33904089782`, and CodeQL PR `33904089799` remain queued. - **#140 Runtime Configuration** — canonical supporting-boundary owner at exact `054c11aafe835e497d6149efb09f1ccdee9d03bd`, Ready/mergeable on current protected main. Hostile RED `0f22aaff...` rejects zero positive bounds; causal repair `d28a0119...` fixes the positive-u64 bootstrap parser while preserving the distinct `RATE_LIMIT=0` disable semantic. Current CI `33923492873` is queued, Fuzz `33923492809` pending, Security `33923492923`, SAST `33923493032`, and CodeQL `33923492956` queued. Feature lanes must adopt #140 rather than create a competing process-environment authority. @@ -45,7 +46,7 @@ Fresh current-head execution is terminal but non-passing: CI `33904242427`, Fuzz ## Open PR inventory and single-writer discipline -Fresh search returns 26 open Wardnet PR lanes: `#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #155, #156, #157, #158, #162, #164, #165, #166`. #159 is excluded because it is protected-main truth. +Fresh search returns 27 open Wardnet PR lanes: `#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #155, #156, #157, #158, #162, #164, #165, #166, #167`. #159 is excluded because it is protected-main truth. PR #130 remains the sole writer for this file. Other Wardnet lanes hand exact evidence into #130 rather than editing this path. PR retirement still requires protected merge, explicit user instruction, malicious/no-valid delta, or verified complete successor transfer of every useful code/test/fixture/contract/evidence delta. From 978bbb201e58afab0f22175328709da1cb7e6c86 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 11:12:49 +0900 Subject: [PATCH 60/73] docs(gaps): refresh exact Wardnet and owner-plane evidence --- docs/product-technical-gap-baseline.md | 30 +++++++++++++++----------- 1 file changed, 17 insertions(+), 13 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 9f944f97..44b2523b 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -14,34 +14,38 @@ Fresh GitHub release inventories remain empty for Wardnet, Context Graph Contrac Protected/default Wardnet truth remains `main@5829a0f08d78de464dd24393ce5d0f25fba9d126`, produced by protected merge #159. #159 is protected workflow-control truth: its CI/Fuzz/Scorecard pressure repair, explicit hosted-runner contract, `AGENTS.md` ownership guidance and workflow queue/runner regressions must be adopted by consumer lanes rather than copied or bypassed. -Organization ruleset `18156473` remains active on `~DEFAULT_BRANCH`. Fresh live policy still requires one generic approving review with no named required reviewer, requires review-thread resolution and central OpenCode/review-scheduler/Security/Strix/Semgrep/Noema/CodeQL workflows, blocks deletion/non-fast-forward, and exposes `OrganizationAdmin/always` bypass. Under the declared solo-maintainer model, self-approval and bot/model-as-human approval remain forbidden. `.github#772` and its live successor own replacement of only the structurally impossible approval deadlock/routine-bypass defect while deterministic security/coverage/SBOM/provenance/thread/branch-integrity controls remain or strengthen. +Organization ruleset `18156473` remains active on `~DEFAULT_BRANCH` and was last updated 2026-09-04. Fresh live policy still requires one generic approving review with no named required reviewer, requires review-thread resolution and central OpenCode/review-scheduler/Security/Strix/Semgrep/Noema/CodeQL workflows, blocks deletion/non-fast-forward, and exposes `OrganizationAdmin/always` bypass. Under the declared solo-maintainer model, self-approval and bot/model-as-human approval remain forbidden. `.github#772` and its live successor own replacement of only the structurally impossible approval deadlock/routine-bypass defect while deterministic security/coverage/SBOM/provenance/thread/branch-integrity controls remain or strengthen. -Runner/event/model-review acquisition/materialization remains `.github#712` owner work. Queued/pre-checkout jobs, `runner_id=0`, `steps=[]`, startup failure, coverage materialization failure or a started model-review request that never produces a current-head verdict are non-passing. They do not justify leaf no-op churn, predecessor evidence reuse, runner-label guessing, gate weakening or routine bypass. +The central owner plane currently contains a policy conflict that must be reconciled there rather than converted into a product decision: `.github#1644` defines the accepted solo-maintainer contract as approval count `0`, no synthetic reviewer and no routine bypass, whereas newer `.github#1861` asks for approval count `2` plus last-push approval. Fresh exact evidence and RED/GREEN acceptance were handed to `.github#772` in comment `5548633961`. Wardnet does not modify either central PR from this writer. + +Runner/event/model-review acquisition/materialization remains `.github#712` owner work. Queued/pre-checkout jobs, `runner_id=0`, `steps=[]`, startup failure, coverage materialization failure or a started model-review request that never produces a current-head verdict are non-passing. They do not justify leaf no-op churn, predecessor evidence reuse, runner-label guessing, gate weakening or routine bypass. Current #167 runner evidence was refreshed to `.github#712` in comment `5548608200`. ## Agent Artifact Admission -PR #129 remains Draft/mergeable on protected #159 truth at exact `f6889079ce49b6f08865180dd6a1ffd8145a8192`; its protected-main-relative feature slice remains the Agent Artifact Admission candidate rather than runtime execution/isolation/orchestration authority. +PR #129 is now Ready/mergeable on protected #159 truth at unchanged exact `f6889079ce49b6f08865180dd6a1ffd8145a8192`; its protected-main-relative feature slice remains the Agent Artifact Admission candidate rather than runtime execution/isolation/orchestration authority. The bounded context is pre-execution structured installer security admission only. It binds reviewed workspace manifest/artifact identity, exact ecosystem/name/version/registry/owner/SHA-256, executable family, declared operands, policy revision and bounded provenance; it does not fetch, decrypt, install, execute, isolate, activate or route workloads. An `allow` receipt is admission authority, not downloaded-byte proof or runtime activation. Current hostile TDD includes the PyPI hash-mode contradiction: RED `032d74e060e778add00a2cc757ce3582c1135232` proves `--require-hashes` plus hostile `--no-require-hashes` must not remain admissible; classifier `4c0de8a3445d6b062b69440507cd3c81a3323308` isolates pip/pip3 hash-mode authority; causal repair `bba656c1d776da38a7315d9ec8e6cb5bdfd621d1` fails the contradictory request closed. Earlier package-manager, Cargo, npm-family, OCI-cardinality/platform and Podman trust/auth/decryption hostile contracts remain preserved. -Fresh current-head execution is terminal but non-passing: CI `33904242427`, Fuzz `33904242501`, Security Scan `33904242429`, SAST Semgrep `33904242491`, and CodeQL PR `33904242556` all completed `cancelled`. A cancelled Draft/current-head run is not GREEN and no predecessor evidence transfers. +The sole current review thread is resolved/outdated and formal review state has no current `CHANGES_REQUESTED`. Draft-state cancellations were not GREEN, so #129 was returned to Ready without moving the exact head and the same exact-head runs were reacquired without a no-op source commit. CI `33904242427`, Fuzz `33904242501`, Security Scan `33904242429`, SAST Semgrep `33904242491`, and CodeQL PR `33904242556` are now queued/non-passing on run attempt 2. Runner wait remains lane-local. `context-graph-contracts#27` owns the future provider-neutral external-capability artifact/evidence/admission/activation grammar. Package-manager argv/parser semantics and Wardnet reason codes remain Wardnet-local. `enterprise-architecture-core#45` owns architecture adoption/risk/provenance projection and must retain evidence references without making Wardnet findings authoritative EA facts. ## Immediate product/security lanes -- **#167 MISP `to_ids` admission** — exact `03da951e5e4b41cbde91f48c6a32a9c7f43db872`, Ready/mergeable on current protected main. The repair requires affirmative recognized `to_ids` evidence before a MISP attribute can materialize `ThreatIndicator`/`DnsblEntry` enforcement rows: object, array, `null`, and omitted values fail closed and increment `skipped_attributes`, while the pre-existing explicit scalar compatibility spellings remain unchanged. The focused hostile regression, primary MISP contract traceability, Saltzer–Schroeder fail-safe-default rationale, and the repository's archived Manès et al. fuzzing survey are on the exact head; current inline review inventory has zero unresolved findings/threads. Exact CI `33928902967`, Fuzz `33928902926`, Security Scan `33928902899`, SAST Semgrep `33928902901`, and CodeQL PR `33928902850` remain non-passing because their current jobs are pre-checkout/runner-unassigned (`runner_id=0`, `steps=[]`). Fresh exact owner handoff is `.github#712` comment `5547848609`; do not manufacture a no-op redispatch or use bypass while deterministic gates are non-GREEN. -- **#155 management auth** — exact `f74ff25a321dfb1d7109719e2a1fc77e47dc4898`, Ready/mergeable and aligned with current protected main. Its 13-file delta fails closed before readiness when a non-loopback listener lacks a write-capable administrator credential. Fresh exact-head CI `33904633002` and Fuzz `33904632999` are terminal `success`; Security Scan `33904633208`, SAST Semgrep `33904633082`, and CodeQL PR `33904632978` remain queued. This is partial exact-head evidence only. -- **#134 support-bundle regression** — exact `4db75680dcfa03d0592c62f08278fdef09c33694`, Ready/mergeable and aligned with protected main; effective delta is test-only support-bundle count/secret-redaction hardening in `src/lib.rs`. Fresh CI `33904089788` and Fuzz `33904089833` are terminal `success`; Security Scan `33904089875`, SAST Semgrep `33904089782`, and CodeQL PR `33904089799` remain queued. +- **#167 MISP `to_ids` admission** — exact `03da951e5e4b41cbde91f48c6a32a9c7f43db872`, Ready/mergeable on current protected main. The repair requires affirmative recognized `to_ids` evidence before a MISP attribute can materialize `ThreatIndicator`/`DnsblEntry` enforcement rows: object, array, `null`, and omitted values fail closed and increment `skipped_attributes`, while the pre-existing explicit scalar compatibility spellings remain unchanged. The focused hostile regression, primary MISP contract traceability, Saltzer–Schroeder fail-safe-default rationale, and repository fuzzing evidence are on the exact head; current inline review inventory has zero unresolved findings/threads. Exact CI `33928902967`, Fuzz `33928902926`, Security Scan `33928902899`, SAST Semgrep `33928902901`, and CodeQL PR `33928902850` remain queued/pending. CI job `101203274313` is pre-checkout with `steps=[]` and no runner identity. Fresh exact owner handoff is `.github#712` comment `5548608200`; do not manufacture a no-op redispatch or use bypass while deterministic gates are non-GREEN. +- **#155 management auth** — exact `f74ff25a321dfb1d7109719e2a1fc77e47dc4898`, Ready/mergeable and aligned with current protected main. Its 13-file delta fails closed before readiness when a non-loopback listener lacks a write-capable administrator credential. Fresh exact-head CI `33904633002`, Fuzz `33904632999`, Security Scan `33904633208`, and SAST Semgrep `33904633082` are terminal `success`; CodeQL PR `33904632978` remains in progress. All current inline threads are resolved. This is partial exact-head evidence only. +- **#93 deterministic persistence failure injection** — exact `4775abc66e5350bdbf07ccefca74c10ddb03701a`, Ready/mergeable and aligned with protected main. CI `33905750474`, Fuzz `33905750458`, Security Scan `33905750409`, and SAST Semgrep `33905750388` are terminal `success`; CodeQL PR `33905750435` remains in progress. Current review threads are resolved. Do not merge until CodeQL and every then-live central/governance gate is terminal-valid. +- **#77 Rust toolchain/reproducibility foundation** — exact `d386d6f57e0c8de3e4839d6c61b593e41f9d7e20`, now Ready/mergeable on protected main. It pins Rust `1.98.0`, keeps CI/toolchain/container alignment and retains the hostile duplicate-Deployment administrator-token regression plus reproducible-build evidence. All current review threads are resolved and the historical OpenCode `REQUEST_CHANGES` is dismissed. Its previous exact-head runs were cancelled while Draft, so the unchanged head was returned to Ready and SAST `33907688360`, Security `33907688421`, CI `33907688502`, and CodeQL `33907688467` were reacquired; they are queued/non-passing. CI attempt-2 job `101230414774` is pre-checkout with no assigned runner. Child #164 remains Draft until #77 or a verified successor reaches protected truth. +- **#134 support-bundle regression** — exact `4db75680dcfa03d0592c62f08278fdef09c33694`, Ready/mergeable and aligned with protected main; effective delta is test-only support-bundle count/secret-redaction hardening in `src/lib.rs`. Current exact-head evidence must be re-read before merge; no historical result is authority after any head movement. - **#140 Runtime Configuration** — canonical supporting-boundary owner at exact `054c11aafe835e497d6149efb09f1ccdee9d03bd`, Ready/mergeable on current protected main. Hostile RED `0f22aaff...` rejects zero positive bounds; causal repair `d28a0119...` fixes the positive-u64 bootstrap parser while preserving the distinct `RATE_LIMIT=0` disable semantic. Current CI `33923492873` is queued, Fuzz `33923492809` pending, Security `33923492923`, SAST `33923493032`, and CodeQL `33923492956` queued. Feature lanes must adopt #140 rather than create a competing process-environment authority. -- **#157/#165 trusted client attribution** — #165 is the current production feature owner at exact `99581e056645e98e866157443a6732a4bbd729c4`; #157 remains a preservation lane for unique trusted-proxy fuzz/corpus/invariant evidence. #165 must adopt #140 after that foundation reaches protected truth and prove complete #157 evidence transfer before #157 can retire. Current #165 CI/Fuzz/Security/SAST are cancelled and CodeQL `33923347950` remains pending; no GREEN transfers. -- **#166 Wardnet-local PR queue policy** — exact `95360a0261d9e5f5718fc434a13237d0abda260f`, intentionally Draft. RED `fbbcca...` now pins the `AGENTS.md` invariant that only genuinely superseded heads may be cancelled. CI/Fuzz use immutable `wardnet-ci`/`wardnet-fuzz` group identities, allow cancellation only on `synchronize`, keep `reopened`/`ready_for_review` state-only runs independent, and do not use Draft/closed state transitions as cancellation signals. Current Draft-event CI `33926977966` and Fuzz `33926977918` are `skipped`; Security `33926977976` queued, SAST `33926978027` pending, CodeQL `33926977882` queued. One canonical review finding remains unresolved because the CC BY 4.0 ICSE 2025/arXiv research PDF required by the repository evidence-pack rule is not yet committed at `docs/papers/ci-at-scale-lean-green-fast-arxiv-2501.03440.pdf`; citation-only evidence is insufficient. Keep Draft and do not treat skipped runs as GREEN. +- **#157/#165 trusted client attribution** — #165 is the current production feature owner at exact `99581e056645e98e866157443a6732a4bbd729c4`; #157 remains a preservation lane for unique trusted-proxy fuzz/corpus/invariant evidence. #165 must adopt #140 after that foundation reaches protected truth and prove complete #157 evidence transfer before #157 can retire. No predecessor GREEN transfers. +- **#166 Wardnet-local PR queue policy** — exact `95360a0261d9e5f5718fc434a13237d0abda260f`, intentionally Draft. RED `fbbcca...` pins the invariant that only genuinely superseded heads may be cancelled. CI/Fuzz use immutable `wardnet-ci`/`wardnet-fuzz` group identities, allow cancellation only on `synchronize`, keep `reopened`/`ready_for_review` state-only runs independent, and do not use Draft/closed state transitions as cancellation signals. One canonical review finding remains unresolved because the redistribution-permitted ICSE 2025/arXiv paper `CI at Scale: Lean, Green, and Fast` is cited but the required full-text PDF is not yet committed at `docs/papers/ci-at-scale-lean-green-fast-arxiv-2501.03440.pdf`. Keep Draft; skipped Draft runs are not GREEN. - **#136 outbound policy** — preservation Draft only. Keep Wardnet-owned purpose/call-site/deadline/evidence hostile tests, but do not integrate the local destination/DNS/redirect/proxy/TLS policy implementation. EgressWeave must first publish an immutable Rust-consumable provider-neutral authorization/evidence boundary; current EgressWeave release inventory is empty. - **#88 contextual-orchestrator consumer** — architecture-gated preservation. Preserve unique fail-closed credential/header/streaming negative evidence, remove LiteLLM/provider-routing/virtual-key ownership when reconstructing, and consume only a released CO API/client/schema/Agent boundary. Current CO release inventory is empty. - **#164 release evidence** — Draft stacked on #77. It separates PR build/SBOM evidence from protected-main OIDC attestation authority. Do not publish from a feature branch; after the Rust/toolchain parent is protected truth, restack on fresh main and reacquire exact-head package/SBOM/provenance/reproducibility evidence. -- **#127 material UI/a11y** — exact `35f4b7a261c15f4549f8e77f40688adc4bb501b0`, non-force aligned with protected main and intentionally Draft. Its effective protected-main-relative delta is only `src/lib.rs`; current CI `33926592588`, Fuzz `33926592516`, Security `33926592531`, SAST `33926592501`, and CodeQL `33926592522` remain queued. Before Ready it still requires production-like browser E2E for keyboard skip/focus, accessible names/descriptions, KPI live-region behavior, responsive widths, and applicable normal/loading/error/permission states; source-string tests alone are not WCAG 2.2 AA evidence. +- **#127 material UI/a11y** — exact `35f4b7a261c15f4549f8e77f40688adc4bb501b0`, non-force aligned with protected main and intentionally Draft. Before Ready it still requires production-like browser E2E for keyboard skip/focus, accessible names/descriptions, KPI live-region behavior, responsive widths, and applicable normal/loading/error/permission states; source-string tests alone are not WCAG 2.2 AA evidence. - **#90 SIEM/OpenTelemetry preservation** — exact `2d251183c41f49b07d443ff15fe9e54472d90f63`, Draft/non-mergeable mixed aggregate branch. Preserve its unique Wardnet-owned OCSF/OTLP/RFC 5424 exporter/input/fuzz/security evidence through a bounded successor from fresh protected main; do not inherit stale `.github`, generic architecture/change-log, product-gap or other owner surfaces wholesale. Close only after complete verified successor transfer. ## Open PR inventory and single-writer discipline @@ -52,11 +56,11 @@ PR #130 remains the sole writer for this file. Other Wardnet lanes hand exact ev ## Context Fabric read-only inventory -Context Graph Contracts still reports protected/default `develop`; its accepted integration/default target is protected `main`, and the open dependency stack remains Draft/unreleased. `context-graph-contracts#27` owns external-capability artifact/evidence/admission/activation semantics. The branch-topology mismatch and protected-main transition are Context Fabric/`.github` owner-plane work, not a Wardnet or user decision. +Context Graph Contracts still reports `default_branch=develop`. Protected `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` and unprotected byte-identical `main@99cb5468ba3c15c5e79688f53dee74724fae2d13` expose the still-unfinished default/protection transition. Its accepted integration/default target is protected `main`; open work remains Draft/unreleased and GitHub Releases are empty. The current dependency order remains `#4 -> #6 -> #7 -> #8 -> #12 -> #13 -> #14 -> #16 -> #17 -> #18 -> #19 -> #25 -> #20 -> #21`; #21 is exact `bd830530d69a8bf283188efefce56bf42ab45e31` and currently has no exact-head pull-request workflow runs. `context-graph-contracts#27` owns external-capability artifact/evidence/admission/activation semantics. Branch topology/default/protection repair remains Context Fabric/`.github#1137` owner work, not a Wardnet or user decision. -EA Core likewise still reports protected/default `develop` while accepted integration/default is protected `main`. Its open Context Fabric projection work preserves quarantine as the canonical isolation-runtime/artifact-analysis-evidence owner and keeps `Wardnet -> artifact_analysis_evidence` directional. `malware_verdict` and `artifact_risk_score` remain forbidden as authoritative EA facts; direct foreign database access/source copying remain prohibited. EA #40 remains Draft and its exact-current repository workflow materialization is still an owner-plane concern. Wardnet does not mutate EA source/PR state. +EA Core still reports `default_branch=develop`; protected `develop@dd71e40a86385fb7861b0f1be19891a3f3e29ece` remains live default authority while product-line `main@ca6889497728e1a3f09d68790a9096576e13a3ff` is not yet the coherent protected/default integration target. Releases are empty. DDD root #39 remains exact `c063570bd9177578fa75be69defd81c99e6ba2f3`; Context Fabric/quarantine projection #40 is Draft exact `ce41036d3fdb0e9787485b4e3a7aaf135e602dfc`, stale against current #39 and has no exact-head repository workflow runs. Its boundary keeps quarantine as canonical artifact-analysis runtime evidence and `Wardnet -> artifact_analysis_evidence` directional; `malware_verdict` and `artifact_risk_score` remain forbidden as authoritative EA facts. No direct foreign database access or source copying is permitted. -Both Context Fabric repositories remain without immutable GitHub Releases at this snapshot. Wardnet therefore fails closed on mutable Context Graph/EA heads as production authority. +The Context Fabric owner handoff was refreshed in `.github#1793` comment `5548619027`, including current Wardnet #167, quarantine-sandbox-runtime Draft #14 exact `5aa3260075cadb78b3f92a33928d4c92ba5e4558`, empty canonical-owner releases, CGC topology/stack and EA projection ancestry. Mutable producer heads remain evidence only, never released authority. ## Buyer-visible gap order From 40c1a1d2eca61adb9fe2b1cac720d3ab21d16206 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 15:16:05 +0900 Subject: [PATCH 61/73] docs(gaps): refresh security and admission lane state --- docs/product-technical-gap-baseline.md | 38 ++++++++++++-------------- 1 file changed, 18 insertions(+), 20 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 44b2523b..d717d21a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -14,43 +14,41 @@ Fresh GitHub release inventories remain empty for Wardnet, Context Graph Contrac Protected/default Wardnet truth remains `main@5829a0f08d78de464dd24393ce5d0f25fba9d126`, produced by protected merge #159. #159 is protected workflow-control truth: its CI/Fuzz/Scorecard pressure repair, explicit hosted-runner contract, `AGENTS.md` ownership guidance and workflow queue/runner regressions must be adopted by consumer lanes rather than copied or bypassed. -Organization ruleset `18156473` remains active on `~DEFAULT_BRANCH` and was last updated 2026-09-04. Fresh live policy still requires one generic approving review with no named required reviewer, requires review-thread resolution and central OpenCode/review-scheduler/Security/Strix/Semgrep/Noema/CodeQL workflows, blocks deletion/non-fast-forward, and exposes `OrganizationAdmin/always` bypass. Under the declared solo-maintainer model, self-approval and bot/model-as-human approval remain forbidden. `.github#772` and its live successor own replacement of only the structurally impossible approval deadlock/routine-bypass defect while deterministic security/coverage/SBOM/provenance/thread/branch-integrity controls remain or strengthen. +Organization ruleset `18156473` remains active on `~DEFAULT_BRANCH`. Fresh live policy still requires one generic approving review with no named required reviewer, requires review-thread resolution and central OpenCode/review-scheduler/Security/Strix/Semgrep/Noema/CodeQL workflows, blocks deletion/non-fast-forward, and exposes `OrganizationAdmin/always` bypass. Under the declared solo-maintainer model, self-approval and bot/model-as-human approval remain forbidden. `.github#772` and its live successor own replacement of only the structurally impossible approval deadlock/routine-bypass defect while deterministic security/coverage/SBOM/provenance/thread/branch-integrity controls remain or strengthen. -The central owner plane currently contains a policy conflict that must be reconciled there rather than converted into a product decision: `.github#1644` defines the accepted solo-maintainer contract as approval count `0`, no synthetic reviewer and no routine bypass, whereas newer `.github#1861` asks for approval count `2` plus last-push approval. Fresh exact evidence and RED/GREEN acceptance were handed to `.github#772` in comment `5548633961`. Wardnet does not modify either central PR from this writer. - -Runner/event/model-review acquisition/materialization remains `.github#712` owner work. Queued/pre-checkout jobs, `runner_id=0`, `steps=[]`, startup failure, coverage materialization failure or a started model-review request that never produces a current-head verdict are non-passing. They do not justify leaf no-op churn, predecessor evidence reuse, runner-label guessing, gate weakening or routine bypass. Current #167 runner evidence was refreshed to `.github#712` in comment `5548608200`. +Runner/event/model-review acquisition/materialization remains `.github#712` owner work. Queued/pre-checkout jobs, `runner_id=0`, `steps=[]`, startup failure, coverage materialization failure or a started model-review request that never produces a current-head verdict are non-passing. They do not justify leaf no-op churn, predecessor evidence reuse, runner-label guessing, gate weakening or routine bypass. ## Agent Artifact Admission -PR #129 is now Ready/mergeable on protected #159 truth at unchanged exact `f6889079ce49b6f08865180dd6a1ffd8145a8192`; its protected-main-relative feature slice remains the Agent Artifact Admission candidate rather than runtime execution/isolation/orchestration authority. +PR #129 is exact `f6889079ce49b6f08865180dd6a1ffd8145a8192`, mergeable but intentionally Draft after fresh exact-head CI exposed a deterministic formatting failure. CI run `33904242427`, job `101230630469`, successfully acquired Ubuntu 24.04 and reached `cargo fmt --check`; rustfmt drift across `crates/agent-artifact-admission` caused the job to fail before tests and Clippy. This is a source/build defect, not runner wait. Exact-head Fuzz `33904242501` is terminal success; Security Scan `33904242429`, SAST Semgrep `33904242491`, and CodeQL PR `33904242556` remain non-passing while queued. Rerunning the unchanged failing source is not useful. The bounded context is pre-execution structured installer security admission only. It binds reviewed workspace manifest/artifact identity, exact ecosystem/name/version/registry/owner/SHA-256, executable family, declared operands, policy revision and bounded provenance; it does not fetch, decrypt, install, execute, isolate, activate or route workloads. An `allow` receipt is admission authority, not downloaded-byte proof or runtime activation. -Current hostile TDD includes the PyPI hash-mode contradiction: RED `032d74e060e778add00a2cc757ce3582c1135232` proves `--require-hashes` plus hostile `--no-require-hashes` must not remain admissible; classifier `4c0de8a3445d6b062b69440507cd3c81a3323308` isolates pip/pip3 hash-mode authority; causal repair `bba656c1d776da38a7315d9ec8e6cb5bdfd621d1` fails the contradictory request closed. Earlier package-manager, Cargo, npm-family, OCI-cardinality/platform and Podman trust/auth/decryption hostile contracts remain preserved. - -The sole current review thread is resolved/outdated and formal review state has no current `CHANGES_REQUESTED`. Draft-state cancellations were not GREEN, so #129 was returned to Ready without moving the exact head and the same exact-head runs were reacquired without a no-op source commit. CI `33904242427`, Fuzz `33904242501`, Security Scan `33904242429`, SAST Semgrep `33904242491`, and CodeQL PR `33904242556` are now queued/non-passing on run attempt 2. Runner wait remains lane-local. +Current hostile TDD includes the PyPI hash-mode contradiction: RED `032d74e060e778add00a2cc757ce3582c1135232` proves `--require-hashes` plus hostile `--no-require-hashes` must not remain admissible; classifier `4c0de8a3445d6b062b69440507cd3c81a3323308` isolates pip/pip3 hash-mode authority; causal repair `bba656c1d776da38a7315d9ec8e6cb5bdfd621d1` fails the contradictory request closed. Earlier package-manager, Cargo, npm-family, OCI-cardinality/platform and Podman trust/auth/decryption hostile contracts remain preserved. GREEN now requires applying repository-effective rustfmt to the exact source, then reacquiring CI format/tests/Clippy and all then-live security/coverage/package/SBOM/provenance evidence on the resulting exact head. `context-graph-contracts#27` owns the future provider-neutral external-capability artifact/evidence/admission/activation grammar. Package-manager argv/parser semantics and Wardnet reason codes remain Wardnet-local. `enterprise-architecture-core#45` owns architecture adoption/risk/provenance projection and must retain evidence references without making Wardnet findings authoritative EA facts. ## Immediate product/security lanes -- **#167 MISP `to_ids` admission** — exact `03da951e5e4b41cbde91f48c6a32a9c7f43db872`, Ready/mergeable on current protected main. The repair requires affirmative recognized `to_ids` evidence before a MISP attribute can materialize `ThreatIndicator`/`DnsblEntry` enforcement rows: object, array, `null`, and omitted values fail closed and increment `skipped_attributes`, while the pre-existing explicit scalar compatibility spellings remain unchanged. The focused hostile regression, primary MISP contract traceability, Saltzer–Schroeder fail-safe-default rationale, and repository fuzzing evidence are on the exact head; current inline review inventory has zero unresolved findings/threads. Exact CI `33928902967`, Fuzz `33928902926`, Security Scan `33928902899`, SAST Semgrep `33928902901`, and CodeQL PR `33928902850` remain queued/pending. CI job `101203274313` is pre-checkout with `steps=[]` and no runner identity. Fresh exact owner handoff is `.github#712` comment `5548608200`; do not manufacture a no-op redispatch or use bypass while deterministic gates are non-GREEN. -- **#155 management auth** — exact `f74ff25a321dfb1d7109719e2a1fc77e47dc4898`, Ready/mergeable and aligned with current protected main. Its 13-file delta fails closed before readiness when a non-loopback listener lacks a write-capable administrator credential. Fresh exact-head CI `33904633002`, Fuzz `33904632999`, Security Scan `33904633208`, and SAST Semgrep `33904633082` are terminal `success`; CodeQL PR `33904632978` remains in progress. All current inline threads are resolved. This is partial exact-head evidence only. -- **#93 deterministic persistence failure injection** — exact `4775abc66e5350bdbf07ccefca74c10ddb03701a`, Ready/mergeable and aligned with protected main. CI `33905750474`, Fuzz `33905750458`, Security Scan `33905750409`, and SAST Semgrep `33905750388` are terminal `success`; CodeQL PR `33905750435` remains in progress. Current review threads are resolved. Do not merge until CodeQL and every then-live central/governance gate is terminal-valid. -- **#77 Rust toolchain/reproducibility foundation** — exact `d386d6f57e0c8de3e4839d6c61b593e41f9d7e20`, now Ready/mergeable on protected main. It pins Rust `1.98.0`, keeps CI/toolchain/container alignment and retains the hostile duplicate-Deployment administrator-token regression plus reproducible-build evidence. All current review threads are resolved and the historical OpenCode `REQUEST_CHANGES` is dismissed. Its previous exact-head runs were cancelled while Draft, so the unchanged head was returned to Ready and SAST `33907688360`, Security `33907688421`, CI `33907688502`, and CodeQL `33907688467` were reacquired; they are queued/non-passing. CI attempt-2 job `101230414774` is pre-checkout with no assigned runner. Child #164 remains Draft until #77 or a verified successor reaches protected truth. -- **#134 support-bundle regression** — exact `4db75680dcfa03d0592c62f08278fdef09c33694`, Ready/mergeable and aligned with protected main; effective delta is test-only support-bundle count/secret-redaction hardening in `src/lib.rs`. Current exact-head evidence must be re-read before merge; no historical result is authority after any head movement. -- **#140 Runtime Configuration** — canonical supporting-boundary owner at exact `054c11aafe835e497d6149efb09f1ccdee9d03bd`, Ready/mergeable on current protected main. Hostile RED `0f22aaff...` rejects zero positive bounds; causal repair `d28a0119...` fixes the positive-u64 bootstrap parser while preserving the distinct `RATE_LIMIT=0` disable semantic. Current CI `33923492873` is queued, Fuzz `33923492809` pending, Security `33923492923`, SAST `33923493032`, and CodeQL `33923492956` queued. Feature lanes must adopt #140 rather than create a competing process-environment authority. -- **#157/#165 trusted client attribution** — #165 is the current production feature owner at exact `99581e056645e98e866157443a6732a4bbd729c4`; #157 remains a preservation lane for unique trusted-proxy fuzz/corpus/invariant evidence. #165 must adopt #140 after that foundation reaches protected truth and prove complete #157 evidence transfer before #157 can retire. No predecessor GREEN transfers. -- **#166 Wardnet-local PR queue policy** — exact `95360a0261d9e5f5718fc434a13237d0abda260f`, intentionally Draft. RED `fbbcca...` pins the invariant that only genuinely superseded heads may be cancelled. CI/Fuzz use immutable `wardnet-ci`/`wardnet-fuzz` group identities, allow cancellation only on `synchronize`, keep `reopened`/`ready_for_review` state-only runs independent, and do not use Draft/closed state transitions as cancellation signals. One canonical review finding remains unresolved because the redistribution-permitted ICSE 2025/arXiv paper `CI at Scale: Lean, Green, and Fast` is cited but the required full-text PDF is not yet committed at `docs/papers/ci-at-scale-lean-green-fast-arxiv-2501.03440.pdf`. Keep Draft; skipped Draft runs are not GREEN. +- **#167 MISP admission + shared DNSBL snapshot ownership** — exact `ba5dd624e50eec63efc453a54beb57cbe28295a9`, Draft/mergeable on current protected main. The accepted MISP parser repair requires affirmative recognized `to_ids` evidence plus active lifecycle state at attribute and enclosing Object scope. A valid review finding then exposed a separate shared reconciler defect: `apply_threat_feed_import` reaps withdrawn `ThreatIndicator`s but does not reap withdrawn DNSBL material. Hostile RED `a639e626764e2caf593266dbf94d2b030626bbaf` was corrected at `ba5dd624...` so refresh remains a valid non-empty snapshot while withdrawing the target key; production GREEN is still pending. The causal fix belongs in the shared feed control-plane: one stable DNSBL identity matching `upsert_dnsbl`, backward-compatible persisted feed/operator ownership, no overwrite of operator-owned payloads, reap only when no other feed/operator owns the key, actual-write `upserted_dnsbl` counts, and persistence/replay/idempotency coverage. The valid review thread remains open until that production GREEN exists. Exact-current CI `33948790502`, Fuzz `33948790485`, Security `33948790480`, Semgrep `33948790524`, and CodeQL `33948790488` are non-passing while queued/pending. +- **#170 MISP threat-level severity child** — exact `034815040bca40af2732cd0222c3799c1abcd503`, Draft/mergeable, base exact #167 `ba5dd624...`. Non-force merge-restack adopted the parent DNSBL RED/doc delta without changing this child's unique three-file severity slice. It retains the source-correct MISP mapping `1 -> High`, `2 -> Medium`, `3 -> Low` and documented compatibility for `4 = Undefined`/missing values. Do not duplicate the parent's shared DNSBL reconciliation in this child; after #167 becomes protected truth, reacquire current-head evidence on the resulting protected ancestry. +- **#77 Rust toolchain/reproducibility foundation** — exact `d386d6f57e0c8de3e4839d6c61b593e41f9d7e20`, Ready/mergeable on protected main. Fresh exact-head CI `33907688502` is terminal success; Security `33907688421`, Semgrep `33907688360`, and CodeQL `33907688467` remain non-passing while queued. Child #164 remains Draft until #77 or a verified successor reaches protected truth. +- **#166 Wardnet-local PR queue policy** — exact `eda2decf22cf2bead5c56ea7d9bf1e59638bcdf3`, Ready/mergeable. It keeps Draft PRs from consuming Wardnet-owned CI/Fuzz runners, cancels only genuinely superseded `synchronize` heads, preserves state-only validation, and retains the Fuzz path filter. Exact current repository/security runs remain non-passing while queued; ordinary queued evidence is not bypass authority. +- **#155 management auth** — exact `f74ff25a321dfb1d7109719e2a1fc77e47dc4898`, aligned with current protected main. Its bounded delta fails closed before readiness when a non-loopback listener lacks a write-capable administrator credential. Re-read exact checks/reviews immediately before merge; no predecessor result transfers after any head movement. +- **#93 deterministic persistence failure injection** — exact `4775abc66e5350bdbf07ccefca74c10ddb03701a`, aligned with protected main. The deterministic write-temp/rename fault seam remains the owner-correct replacement for permission-dependent failure injection. Re-read every exact-current gate before integration. +- **#140 Runtime Configuration** — canonical supporting-boundary owner at exact `054c11aafe835e497d6149efb09f1ccdee9d03bd`, aligned with current protected main. Hostile RED `0f22aaff...` rejects zero positive bounds; causal repair `d28a0119...` fixes the positive-u64 bootstrap parser while preserving the distinct `RATE_LIMIT=0` disable semantic. Feature lanes must adopt #140 rather than create a competing process-environment authority. +- **#157/#165 trusted client attribution** — #165 remains the current production feature owner at exact `99581e056645e98e866157443a6732a4bbd729c4`; #157 is a preservation lane for unique trusted-proxy fuzz/corpus/invariant evidence. #165 must adopt #140 after that foundation reaches protected truth and prove complete #157 evidence transfer before #157 can retire. +- **#135 bounded local limiter** — exact `fb24394308ccdc835cce344b7e945f5537e99756`; repository-owned CI/Fuzz are terminal success while central Security/Semgrep/CodeQL remain non-passing while queued. Its local cardinality/rate-limit contract remains separate from #165 trusted-proxy attribution and any future distributed quota authority. - **#136 outbound policy** — preservation Draft only. Keep Wardnet-owned purpose/call-site/deadline/evidence hostile tests, but do not integrate the local destination/DNS/redirect/proxy/TLS policy implementation. EgressWeave must first publish an immutable Rust-consumable provider-neutral authorization/evidence boundary; current EgressWeave release inventory is empty. +- **#115 official threat-source refresh** — preservation Draft. Preserve Wardnet-owned source registry/parser/conditional-validator/last-known-good/SOC evidence delta, but reconstruct outbound authorization through a released EgressWeave port/ACL rather than retaining local reusable egress authority. EgressWeave has no immutable GitHub Release at this snapshot. - **#88 contextual-orchestrator consumer** — architecture-gated preservation. Preserve unique fail-closed credential/header/streaming negative evidence, remove LiteLLM/provider-routing/virtual-key ownership when reconstructing, and consume only a released CO API/client/schema/Agent boundary. Current CO release inventory is empty. - **#164 release evidence** — Draft stacked on #77. It separates PR build/SBOM evidence from protected-main OIDC attestation authority. Do not publish from a feature branch; after the Rust/toolchain parent is protected truth, restack on fresh main and reacquire exact-head package/SBOM/provenance/reproducibility evidence. -- **#127 material UI/a11y** — exact `35f4b7a261c15f4549f8e77f40688adc4bb501b0`, non-force aligned with protected main and intentionally Draft. Before Ready it still requires production-like browser E2E for keyboard skip/focus, accessible names/descriptions, KPI live-region behavior, responsive widths, and applicable normal/loading/error/permission states; source-string tests alone are not WCAG 2.2 AA evidence. +- **#127 material UI/a11y** — exact `35f4b7a261c15f4549f8e77f40688adc4bb501b0`, aligned with protected main and intentionally Draft. Before Ready it still requires production-like browser E2E for keyboard skip/focus, accessible names/descriptions, KPI live-region behavior, responsive widths, and applicable normal/loading/error/permission states; source-string tests alone are not WCAG 2.2 AA evidence. - **#90 SIEM/OpenTelemetry preservation** — exact `2d251183c41f49b07d443ff15fe9e54472d90f63`, Draft/non-mergeable mixed aggregate branch. Preserve its unique Wardnet-owned OCSF/OTLP/RFC 5424 exporter/input/fuzz/security evidence through a bounded successor from fresh protected main; do not inherit stale `.github`, generic architecture/change-log, product-gap or other owner surfaces wholesale. Close only after complete verified successor transfer. ## Open PR inventory and single-writer discipline -Fresh search returns 27 open Wardnet PR lanes: `#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #155, #156, #157, #158, #162, #164, #165, #166, #167`. #159 is excluded because it is protected-main truth. +Fresh search returns 28 open Wardnet PR lanes: `#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #155, #156, #157, #158, #162, #164, #165, #166, #167, #170`. #159 is excluded because it is protected-main truth. PR #130 remains the sole writer for this file. Other Wardnet lanes hand exact evidence into #130 rather than editing this path. PR retirement still requires protected merge, explicit user instruction, malicious/no-valid delta, or verified complete successor transfer of every useful code/test/fixture/contract/evidence delta. @@ -60,7 +58,7 @@ Context Graph Contracts still reports `default_branch=develop`. Protected `devel EA Core still reports `default_branch=develop`; protected `develop@dd71e40a86385fb7861b0f1be19891a3f3e29ece` remains live default authority while product-line `main@ca6889497728e1a3f09d68790a9096576e13a3ff` is not yet the coherent protected/default integration target. Releases are empty. DDD root #39 remains exact `c063570bd9177578fa75be69defd81c99e6ba2f3`; Context Fabric/quarantine projection #40 is Draft exact `ce41036d3fdb0e9787485b4e3a7aaf135e602dfc`, stale against current #39 and has no exact-head repository workflow runs. Its boundary keeps quarantine as canonical artifact-analysis runtime evidence and `Wardnet -> artifact_analysis_evidence` directional; `malware_verdict` and `artifact_risk_score` remain forbidden as authoritative EA facts. No direct foreign database access or source copying is permitted. -The Context Fabric owner handoff was refreshed in `.github#1793` comment `5548619027`, including current Wardnet #167, quarantine-sandbox-runtime Draft #14 exact `5aa3260075cadb78b3f92a33928d4c92ba5e4558`, empty canonical-owner releases, CGC topology/stack and EA projection ancestry. Mutable producer heads remain evidence only, never released authority. +Mutable producer heads remain evidence only, never released authority. Branch topology/default/protection mismatch remains Context Fabric/central-governance owner work, not a Wardnet or user decision. ## Buyer-visible gap order @@ -72,4 +70,4 @@ The USD 20 billion ambition is a product-quality bar, not a customer contract va Security and runtime decisions remain traceable to current authoritative NIST/OWASP/CWE/IETF/OCI/Linux sources and primary/peer-reviewed research where the implementation depends on them. Citation is design evidence, not proof that a control is shipped. Wardnet-owned production targets 100% statement/branch/edge-case coverage and complete public rustdoc/docstrings, with realistic bypass/replay/race/DoS/network/cleanup tests where applicable. -No Wardnet release is authorized at this snapshot. Release requires one exact integrated protected head with terminal current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact/source identity and a verified publication path. Feature-branch artifacts or attestations remain candidate evidence only. +No Wardnet release is authorized at this snapshot. Release requires one exact integrated protected head with terminal current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact/source identity and a verified publication path. Feature-branch artifacts or attestations remain candidate evidence only. \ No newline at end of file From 365e73a2ec4ad15f37aaf72a86904959658a7928 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 5 Sep 2026 19:40:55 +0900 Subject: [PATCH 62/73] docs(gaps): refresh exact Wardnet security state --- docs/product-technical-gap-baseline.md | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index d717d21a..39fbbd5c 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -16,11 +16,11 @@ Protected/default Wardnet truth remains `main@5829a0f08d78de464dd24393ce5d0f25fb Organization ruleset `18156473` remains active on `~DEFAULT_BRANCH`. Fresh live policy still requires one generic approving review with no named required reviewer, requires review-thread resolution and central OpenCode/review-scheduler/Security/Strix/Semgrep/Noema/CodeQL workflows, blocks deletion/non-fast-forward, and exposes `OrganizationAdmin/always` bypass. Under the declared solo-maintainer model, self-approval and bot/model-as-human approval remain forbidden. `.github#772` and its live successor own replacement of only the structurally impossible approval deadlock/routine-bypass defect while deterministic security/coverage/SBOM/provenance/thread/branch-integrity controls remain or strengthen. -Runner/event/model-review acquisition/materialization remains `.github#712` owner work. Queued/pre-checkout jobs, `runner_id=0`, `steps=[]`, startup failure, coverage materialization failure or a started model-review request that never produces a current-head verdict are non-passing. They do not justify leaf no-op churn, predecessor evidence reuse, runner-label guessing, gate weakening or routine bypass. +Runner/event/model-review acquisition/materialization remains `.github#712` owner work. Queued/pre-checkout jobs, `runner_id=0`, `steps=[]`, startup failure, coverage materialization failure or a started model-review request that never produces a current-head verdict are non-passing. They do not justify leaf no-op churn, predecessor evidence reuse, runner-label guessing, gate weakening or routine bypass. Current #77 exact-head CodeQL is a terminal control-plane failure rather than a queue snapshot: the preparation job completed, while the required current-head dispatch/verdict-enforcement matrix failed. That exact specimen has been handed to `.github#712`; Wardnet source remains unchanged pending owner repair and fresh exact-head revalidation. ## Agent Artifact Admission -PR #129 is exact `f6889079ce49b6f08865180dd6a1ffd8145a8192`, mergeable but intentionally Draft after fresh exact-head CI exposed a deterministic formatting failure. CI run `33904242427`, job `101230630469`, successfully acquired Ubuntu 24.04 and reached `cargo fmt --check`; rustfmt drift across `crates/agent-artifact-admission` caused the job to fail before tests and Clippy. This is a source/build defect, not runner wait. Exact-head Fuzz `33904242501` is terminal success; Security Scan `33904242429`, SAST Semgrep `33904242491`, and CodeQL PR `33904242556` remain non-passing while queued. Rerunning the unchanged failing source is not useful. +PR #129 is exact `f6889079ce49b6f08865180dd6a1ffd8145a8192`, mergeable but intentionally Draft after fresh exact-head CI exposed a deterministic formatting failure. CI run `33904242427`, job `101230630469`, successfully acquired Ubuntu 24.04 and reached `cargo fmt --check`; rustfmt drift across `crates/agent-artifact-admission` caused the job to fail before tests and Clippy. This is a source/build defect, not runner wait. Exact-head Fuzz `33904242501` is terminal success; Security Scan `33904242429`, SAST Semgrep `33904242491`, and CodeQL PR `33904242556` remain non-passing while queued. Rerunning the unchanged failing source is not useful. A bounded exact-head rustfmt-only repair has been delegated on the existing branch; the PR remains Draft until that causal change, if still applicable to the unchanged head, produces fresh exact-head evidence. The bounded context is pre-execution structured installer security admission only. It binds reviewed workspace manifest/artifact identity, exact ecosystem/name/version/registry/owner/SHA-256, executable family, declared operands, policy revision and bounded provenance; it does not fetch, decrypt, install, execute, isolate, activate or route workloads. An `allow` receipt is admission authority, not downloaded-byte proof or runtime activation. @@ -30,10 +30,12 @@ Current hostile TDD includes the PyPI hash-mode contradiction: RED `032d74e060e7 ## Immediate product/security lanes -- **#167 MISP admission + shared DNSBL snapshot ownership** — exact `ba5dd624e50eec63efc453a54beb57cbe28295a9`, Draft/mergeable on current protected main. The accepted MISP parser repair requires affirmative recognized `to_ids` evidence plus active lifecycle state at attribute and enclosing Object scope. A valid review finding then exposed a separate shared reconciler defect: `apply_threat_feed_import` reaps withdrawn `ThreatIndicator`s but does not reap withdrawn DNSBL material. Hostile RED `a639e626764e2caf593266dbf94d2b030626bbaf` was corrected at `ba5dd624...` so refresh remains a valid non-empty snapshot while withdrawing the target key; production GREEN is still pending. The causal fix belongs in the shared feed control-plane: one stable DNSBL identity matching `upsert_dnsbl`, backward-compatible persisted feed/operator ownership, no overwrite of operator-owned payloads, reap only when no other feed/operator owns the key, actual-write `upserted_dnsbl` counts, and persistence/replay/idempotency coverage. The valid review thread remains open until that production GREEN exists. Exact-current CI `33948790502`, Fuzz `33948790485`, Security `33948790480`, Semgrep `33948790524`, and CodeQL `33948790488` are non-passing while queued/pending. +- **#167 MISP admission + shared DNSBL snapshot ownership** — exact `ba5dd624e50eec63efc453a54beb57cbe28295a9`, Draft/mergeable on current protected main. The accepted MISP parser repair requires affirmative recognized `to_ids` evidence plus active lifecycle state at attribute and enclosing Object scope. A valid review finding then exposed a separate shared reconciler defect: `apply_threat_feed_import` reaps withdrawn `ThreatIndicator`s but does not reap withdrawn DNSBL material. Hostile RED `a639e626764e2caf593266dbf94d2b030626bbaf` was corrected at `ba5dd624...` so refresh remains a valid non-empty snapshot while withdrawing the target key; production GREEN is still pending. The causal fix belongs in the shared feed control-plane: one stable DNSBL identity matching `upsert_dnsbl`, backward-compatible persisted feed/operator ownership, no overwrite of operator-owned payloads, reap only when no other feed/operator owns the key, actual-write `upserted_dnsbl` counts, and persistence/replay/idempotency coverage. The valid review thread remains open until that production GREEN exists. Exact-current CI `33948790502`, Fuzz `33948790485`, Security `33948790480`, Semgrep `33948790524`, and CodeQL `33948790488` are non-passing while queued/pending. A bounded production-GREEN request is active on the existing exact branch and must abort rather than overwrite if intervening work moves the head. - **#170 MISP threat-level severity child** — exact `034815040bca40af2732cd0222c3799c1abcd503`, Draft/mergeable, base exact #167 `ba5dd624...`. Non-force merge-restack adopted the parent DNSBL RED/doc delta without changing this child's unique three-file severity slice. It retains the source-correct MISP mapping `1 -> High`, `2 -> Medium`, `3 -> Low` and documented compatibility for `4 = Undefined`/missing values. Do not duplicate the parent's shared DNSBL reconciliation in this child; after #167 becomes protected truth, reacquire current-head evidence on the resulting protected ancestry. -- **#77 Rust toolchain/reproducibility foundation** — exact `d386d6f57e0c8de3e4839d6c61b593e41f9d7e20`, Ready/mergeable on protected main. Fresh exact-head CI `33907688502` is terminal success; Security `33907688421`, Semgrep `33907688360`, and CodeQL `33907688467` remain non-passing while queued. Child #164 remains Draft until #77 or a verified successor reaches protected truth. -- **#166 Wardnet-local PR queue policy** — exact `eda2decf22cf2bead5c56ea7d9bf1e59638bcdf3`, Ready/mergeable. It keeps Draft PRs from consuming Wardnet-owned CI/Fuzz runners, cancels only genuinely superseded `synchronize` heads, preserves state-only validation, and retains the Fuzz path filter. Exact current repository/security runs remain non-passing while queued; ordinary queued evidence is not bypass authority. +- **#77 Rust toolchain/reproducibility foundation** — exact `d386d6f57e0c8de3e4839d6c61b593e41f9d7e20`, Ready/mergeable on protected main. Fresh exact-head CI `33907688502`, Security `33907688421`, and Semgrep `33907688360` are terminal success. CodeQL PR `33907688467` is terminal **failure** in the central current-head dispatch/verdict-enforcement path after its preparation job succeeded; this is not a Wardnet compile/test finding and the exact evidence is recorded on `.github#712`. Child #164 remains Draft until #77 or a verified successor reaches protected truth. No leaf no-op retrigger or guarded bypass is authorized for this ordinary central-gate failure. +- **#166 Wardnet-local PR queue policy** — exact `13fc6a1b9b3f5af0b7c6acfb79de6c46fd72de3a`, Ready/mergeable. It keeps Draft PRs from consuming Wardnet-owned CI/Fuzz runners, cancels only genuinely superseded `synchronize` heads, preserves state-only validation, and retains the Fuzz path filter. Fresh exact-head CI `33954367435`/job `101274865461` remains queued before checkout with `runner_id=0`, empty runner identity and `steps=[]`; Fuzz `33954367424`, CodeQL `33954367497`, Semgrep `33954367509`, and Security `33954367550` are also queued/non-passing. The exact specimen is already handed to `.github#712`; ordinary queue wait is not bypass authority. +- **#173 outbound site reputation** — exact `a14b28a10ea87dbcc1939fe0fdca6ce5b02259ed`, Ready/mergeable and documentation-only. Wardnet owns destination maliciousness/reputation evidence lifecycle, organizational admission policy and SOC accountability; EgressWeave remains authoritative for executable URL/address/DNS/peer/redirect/proxy/TLS/resource authorization. The pure-Rust reputation core and offline evidence/policy slices may proceed independently, but production transport composition requires an immutable compatible EgressWeave Rust-consumer boundary from `EgressWeave#237` or its verified successor. The four-document design is not runtime enforcement or a claim of company-wide traffic coverage; exact-head CI/Security/CodeQL/Semgrep remain non-passing until terminal evidence exists. +- **#171 anti-bot acquisition boundary** — exact `d94a4a6207a0d3ea79547a57fb0a7c5f6b2b30d5`, Draft/mergeable and documentation-only. It preserves only the still-valid ownership delta: browser acquisition/session/challenge/CAPTCHA handling stays outside Wardnet, while #173 carries Wardnet-owned destination reputation. Arbitrary metadata fetching must not be reintroduced into Wardnet; any required outbound retrieval must traverse a released EgressWeave authorization boundary or fail closed. - **#155 management auth** — exact `f74ff25a321dfb1d7109719e2a1fc77e47dc4898`, aligned with current protected main. Its bounded delta fails closed before readiness when a non-loopback listener lacks a write-capable administrator credential. Re-read exact checks/reviews immediately before merge; no predecessor result transfers after any head movement. - **#93 deterministic persistence failure injection** — exact `4775abc66e5350bdbf07ccefca74c10ddb03701a`, aligned with protected main. The deterministic write-temp/rename fault seam remains the owner-correct replacement for permission-dependent failure injection. Re-read every exact-current gate before integration. - **#140 Runtime Configuration** — canonical supporting-boundary owner at exact `054c11aafe835e497d6149efb09f1ccdee9d03bd`, aligned with current protected main. Hostile RED `0f22aaff...` rejects zero positive bounds; causal repair `d28a0119...` fixes the positive-u64 bootstrap parser while preserving the distinct `RATE_LIMIT=0` disable semantic. Feature lanes must adopt #140 rather than create a competing process-environment authority. @@ -48,7 +50,7 @@ Current hostile TDD includes the PyPI hash-mode contradiction: RED `032d74e060e7 ## Open PR inventory and single-writer discipline -Fresh search returns 28 open Wardnet PR lanes: `#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #155, #156, #157, #158, #162, #164, #165, #166, #167, #170`. #159 is excluded because it is protected-main truth. +Fresh search returns 30 open Wardnet PR lanes: `#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #155, #156, #157, #158, #162, #164, #165, #166, #167, #170, #171, #173`. #159 is excluded because it is protected-main truth. PR #130 remains the sole writer for this file. Other Wardnet lanes hand exact evidence into #130 rather than editing this path. PR retirement still requires protected merge, explicit user instruction, malicious/no-valid delta, or verified complete successor transfer of every useful code/test/fixture/contract/evidence delta. @@ -62,7 +64,7 @@ Mutable producer heads remain evidence only, never released authority. Branch to ## Buyer-visible gap order -Current order remains authority/security before breadth: protected management authentication (#78/#155); immutable outbound policy/evidence integration (#79/#136 + EgressWeave owner release); real attack-path CI and deployable public path (#11/#75); Agent Artifact Admission (#128/#129); PostgreSQL authority/tenant isolation (#80) then transactional outbox (#81); Keyverse identity/approval (#82) and distributed admission/trusted attribution (#83); proven Coraza/CRS and Suricata detection (#86); immutable release evidence (#84); telemetry/SLO/incident/restore (#85); final readiness against one immutable protected release identity (#87). +Current order remains authority/security before breadth: protected management authentication (#78/#155); immutable outbound policy/evidence integration (#79/#136 + EgressWeave owner release); Wardnet-owned outbound destination reputation evidence/policy with transport composition through the same immutable EgressWeave authority (#173); real attack-path CI and deployable public path (#11/#75); Agent Artifact Admission (#128/#129); PostgreSQL authority/tenant isolation (#80) then transactional outbox (#81); Keyverse identity/approval (#82) and distributed admission/trusted attribution (#83); proven Coraza/CRS and Suricata detection (#86); immutable release evidence (#84); telemetry/SLO/incident/restore (#85); final readiness against one immutable protected release identity (#87). The USD 20 billion ambition is a product-quality bar, not a customer contract value, billing field or runtime pricing authority. #162 owns that documentation separation. Root `src/lib.rs` remains a modularity pressure point, not evidence by itself for a deployable service split; prefer a modular monolith until transaction/isolation/scale/deployment/reusable-owner evidence pays for another boundary. @@ -70,4 +72,4 @@ The USD 20 billion ambition is a product-quality bar, not a customer contract va Security and runtime decisions remain traceable to current authoritative NIST/OWASP/CWE/IETF/OCI/Linux sources and primary/peer-reviewed research where the implementation depends on them. Citation is design evidence, not proof that a control is shipped. Wardnet-owned production targets 100% statement/branch/edge-case coverage and complete public rustdoc/docstrings, with realistic bypass/replay/race/DoS/network/cleanup tests where applicable. -No Wardnet release is authorized at this snapshot. Release requires one exact integrated protected head with terminal current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact/source identity and a verified publication path. Feature-branch artifacts or attestations remain candidate evidence only. \ No newline at end of file +No Wardnet release is authorized at this snapshot. Release requires one exact integrated protected head with terminal current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact/source identity and a verified publication path. Feature-branch artifacts or attestations remain candidate evidence only. From 405a3aff1d7c809fa28e755b37bee308ba8cab68 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 01:46:54 +0900 Subject: [PATCH 63/73] docs(gaps): refresh exact-head readiness baseline --- docs/product-technical-gap-baseline.md | 48 +++++++++++++------------- 1 file changed, 24 insertions(+), 24 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 39fbbd5c..3837b7f4 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # Product and technical gap baseline -Snapshot date: 2026-09-05. Re-read live refs, PRs, reviews/threads, exact-head checks, rulesets, security evidence and releases before any merge, release, restack or foreign-owner handoff. This is Wardnet's sole commercial/product-technical current-state ledger, not an archive of predecessor evidence. +Snapshot date: 2026-09-06. Re-read live refs, PRs, reviews/threads, exact-head checks, rulesets, security evidence and releases before any merge, release, restack or foreign-owner handoff. This is Wardnet's sole commercial/product-technical current-state ledger, not an archive of predecessor evidence. ## Authority boundary @@ -14,53 +14,53 @@ Fresh GitHub release inventories remain empty for Wardnet, Context Graph Contrac Protected/default Wardnet truth remains `main@5829a0f08d78de464dd24393ce5d0f25fba9d126`, produced by protected merge #159. #159 is protected workflow-control truth: its CI/Fuzz/Scorecard pressure repair, explicit hosted-runner contract, `AGENTS.md` ownership guidance and workflow queue/runner regressions must be adopted by consumer lanes rather than copied or bypassed. -Organization ruleset `18156473` remains active on `~DEFAULT_BRANCH`. Fresh live policy still requires one generic approving review with no named required reviewer, requires review-thread resolution and central OpenCode/review-scheduler/Security/Strix/Semgrep/Noema/CodeQL workflows, blocks deletion/non-fast-forward, and exposes `OrganizationAdmin/always` bypass. Under the declared solo-maintainer model, self-approval and bot/model-as-human approval remain forbidden. `.github#772` and its live successor own replacement of only the structurally impossible approval deadlock/routine-bypass defect while deterministic security/coverage/SBOM/provenance/thread/branch-integrity controls remain or strengthen. +Organization ruleset `18156473` remains active on `~DEFAULT_BRANCH`. Fresh live policy still requires one generic approving review with no named required reviewer, requires review-thread resolution and central OpenCode/review-scheduler/Security/Strix/Semgrep/Noema/CodeQL workflows, blocks deletion/non-fast-forward, and exposes `OrganizationAdmin/always` bypass. Under the declared solo-maintainer model, self-approval and bot/model-as-human approval remain forbidden. `.github#772` owns replacement of only the structurally impossible approval deadlock/routine-bypass defect while deterministic security/coverage/SBOM/provenance/thread/branch-integrity controls remain or strengthen. Its current implementation #1644 is not merge-ready: it has diverged from protected `.github/main` and its current-head CodeQL lane is not GREEN. -Runner/event/model-review acquisition/materialization remains `.github#712` owner work. Queued/pre-checkout jobs, `runner_id=0`, `steps=[]`, startup failure, coverage materialization failure or a started model-review request that never produces a current-head verdict are non-passing. They do not justify leaf no-op churn, predecessor evidence reuse, runner-label guessing, gate weakening or routine bypass. Current #77 exact-head CodeQL is a terminal control-plane failure rather than a queue snapshot: the preparation job completed, while the required current-head dispatch/verdict-enforcement matrix failed. That exact specimen has been handed to `.github#712`; Wardnet source remains unchanged pending owner repair and fresh exact-head revalidation. +Runner/event/model-review acquisition/materialization remains `.github#712` owner work. The protected central scheduler repair #1937 removed one self-cancellation cause, but unchanged Wardnet heads still expose hosted-runner acquisition stalls. #167 exact CI job `101334935550` on explicit `ubuntu-24.04` remains pre-checkout with `steps=[]`, `runner_id=0`. #173 narrows the same class inside an otherwise-progressing required OpenCode workflow: bootstrap, exact-head admission and `coverage-source-tree` all acquired hosted runners and completed, while downstream `coverage-evidence` job `101327483721` remains queued with `steps=[]`, `runner_id=0`. These are non-passing owner-plane specimens, not reasons for leaf no-op churn or bypass. + +Central CodeQL matrix serialization repair #1926 and trusted-dispatcher CSV parser repair #1932 are protected. Remaining dispatch authorization/settings convergence is `.github#1929`: both intended senders, `github-actions[bot]` and `opencode-agent[bot]`, must remain representable without weakening the actor==sender invariant. Leaf CodeQL reruns should wait for that owner setting/canary convergence rather than repeatedly consume runners. ## Agent Artifact Admission -PR #129 is exact `f6889079ce49b6f08865180dd6a1ffd8145a8192`, mergeable but intentionally Draft after fresh exact-head CI exposed a deterministic formatting failure. CI run `33904242427`, job `101230630469`, successfully acquired Ubuntu 24.04 and reached `cargo fmt --check`; rustfmt drift across `crates/agent-artifact-admission` caused the job to fail before tests and Clippy. This is a source/build defect, not runner wait. Exact-head Fuzz `33904242501` is terminal success; Security Scan `33904242429`, SAST Semgrep `33904242491`, and CodeQL PR `33904242556` remain non-passing while queued. Rerunning the unchanged failing source is not useful. A bounded exact-head rustfmt-only repair has been delegated on the existing branch; the PR remains Draft until that causal change, if still applicable to the unchanged head, produces fresh exact-head evidence. +PR #129 is exact `db921e7f855f52870b23de52a4e23f11ff996644`, mergeable but intentionally Draft. A predecessor acquired Ubuntu 24.04 and failed deterministically at `cargo fmt --check`; seven formatting-only commits applied the repository-effective formatter to all reported offenders without semantic broadening. Fresh exact-current CI `33977431401`, Fuzz `33977431523`, Security Scan `33977431400`, SAST Semgrep `33977431547`, and CodeQL PR `33977431418` remain queued/non-passing. Predecessor GREEN does not transfer. The bounded context is pre-execution structured installer security admission only. It binds reviewed workspace manifest/artifact identity, exact ecosystem/name/version/registry/owner/SHA-256, executable family, declared operands, policy revision and bounded provenance; it does not fetch, decrypt, install, execute, isolate, activate or route workloads. An `allow` receipt is admission authority, not downloaded-byte proof or runtime activation. -Current hostile TDD includes the PyPI hash-mode contradiction: RED `032d74e060e778add00a2cc757ce3582c1135232` proves `--require-hashes` plus hostile `--no-require-hashes` must not remain admissible; classifier `4c0de8a3445d6b062b69440507cd3c81a3323308` isolates pip/pip3 hash-mode authority; causal repair `bba656c1d776da38a7315d9ec8e6cb5bdfd621d1` fails the contradictory request closed. Earlier package-manager, Cargo, npm-family, OCI-cardinality/platform and Podman trust/auth/decryption hostile contracts remain preserved. GREEN now requires applying repository-effective rustfmt to the exact source, then reacquiring CI format/tests/Clippy and all then-live security/coverage/package/SBOM/provenance evidence on the resulting exact head. +Current hostile TDD includes the PyPI hash-mode contradiction: RED `032d74e060e778add00a2cc757ce3582c1135232` proves `--require-hashes` plus hostile `--no-require-hashes` must not remain admissible; classifier `4c0de8a3445d6b062b69440507cd3c81a3323308` isolates pip/pip3 hash-mode authority; causal repair `bba656c1d776da38a7315d9ec8e6cb5bdfd621d1` fails the contradictory request closed. Earlier package-manager, Cargo, npm-family, OCI-cardinality/platform and Podman trust/auth/decryption hostile contracts remain preserved. -`context-graph-contracts#27` owns the future provider-neutral external-capability artifact/evidence/admission/activation grammar. Package-manager argv/parser semantics and Wardnet reason codes remain Wardnet-local. `enterprise-architecture-core#45` owns architecture adoption/risk/provenance projection and must retain evidence references without making Wardnet findings authoritative EA facts. +`context-graph-contracts#27` owns the future provider-neutral external-capability artifact/evidence/admission/activation grammar. Package-manager argv/parser semantics and Wardnet reason codes remain Wardnet-local. `enterprise-architecture-core#45` owns architecture adoption/risk/provenance projection and must retain evidence references without making Wardnet findings authoritative EA facts. AppGuardrail #1099 owns deterministic static plugin/package scanning and scan receipts; quarantine owns hostile dynamic execution evidence; Noema owns activation/rollback. None currently exposes an immutable GitHub Release that Wardnet may treat as production authority. ## Immediate product/security lanes -- **#167 MISP admission + shared DNSBL snapshot ownership** — exact `ba5dd624e50eec63efc453a54beb57cbe28295a9`, Draft/mergeable on current protected main. The accepted MISP parser repair requires affirmative recognized `to_ids` evidence plus active lifecycle state at attribute and enclosing Object scope. A valid review finding then exposed a separate shared reconciler defect: `apply_threat_feed_import` reaps withdrawn `ThreatIndicator`s but does not reap withdrawn DNSBL material. Hostile RED `a639e626764e2caf593266dbf94d2b030626bbaf` was corrected at `ba5dd624...` so refresh remains a valid non-empty snapshot while withdrawing the target key; production GREEN is still pending. The causal fix belongs in the shared feed control-plane: one stable DNSBL identity matching `upsert_dnsbl`, backward-compatible persisted feed/operator ownership, no overwrite of operator-owned payloads, reap only when no other feed/operator owns the key, actual-write `upserted_dnsbl` counts, and persistence/replay/idempotency coverage. The valid review thread remains open until that production GREEN exists. Exact-current CI `33948790502`, Fuzz `33948790485`, Security `33948790480`, Semgrep `33948790524`, and CodeQL `33948790488` are non-passing while queued/pending. A bounded production-GREEN request is active on the existing exact branch and must abort rather than overwrite if intervening work moves the head. -- **#170 MISP threat-level severity child** — exact `034815040bca40af2732cd0222c3799c1abcd503`, Draft/mergeable, base exact #167 `ba5dd624...`. Non-force merge-restack adopted the parent DNSBL RED/doc delta without changing this child's unique three-file severity slice. It retains the source-correct MISP mapping `1 -> High`, `2 -> Medium`, `3 -> Low` and documented compatibility for `4 = Undefined`/missing values. Do not duplicate the parent's shared DNSBL reconciliation in this child; after #167 becomes protected truth, reacquire current-head evidence on the resulting protected ancestry. -- **#77 Rust toolchain/reproducibility foundation** — exact `d386d6f57e0c8de3e4839d6c61b593e41f9d7e20`, Ready/mergeable on protected main. Fresh exact-head CI `33907688502`, Security `33907688421`, and Semgrep `33907688360` are terminal success. CodeQL PR `33907688467` is terminal **failure** in the central current-head dispatch/verdict-enforcement path after its preparation job succeeded; this is not a Wardnet compile/test finding and the exact evidence is recorded on `.github#712`. Child #164 remains Draft until #77 or a verified successor reaches protected truth. No leaf no-op retrigger or guarded bypass is authorized for this ordinary central-gate failure. -- **#166 Wardnet-local PR queue policy** — exact `13fc6a1b9b3f5af0b7c6acfb79de6c46fd72de3a`, Ready/mergeable. It keeps Draft PRs from consuming Wardnet-owned CI/Fuzz runners, cancels only genuinely superseded `synchronize` heads, preserves state-only validation, and retains the Fuzz path filter. Fresh exact-head CI `33954367435`/job `101274865461` remains queued before checkout with `runner_id=0`, empty runner identity and `steps=[]`; Fuzz `33954367424`, CodeQL `33954367497`, Semgrep `33954367509`, and Security `33954367550` are also queued/non-passing. The exact specimen is already handed to `.github#712`; ordinary queue wait is not bypass authority. -- **#173 outbound site reputation** — exact `a14b28a10ea87dbcc1939fe0fdca6ce5b02259ed`, Ready/mergeable and documentation-only. Wardnet owns destination maliciousness/reputation evidence lifecycle, organizational admission policy and SOC accountability; EgressWeave remains authoritative for executable URL/address/DNS/peer/redirect/proxy/TLS/resource authorization. The pure-Rust reputation core and offline evidence/policy slices may proceed independently, but production transport composition requires an immutable compatible EgressWeave Rust-consumer boundary from `EgressWeave#237` or its verified successor. The four-document design is not runtime enforcement or a claim of company-wide traffic coverage; exact-head CI/Security/CodeQL/Semgrep remain non-passing until terminal evidence exists. -- **#171 anti-bot acquisition boundary** — exact `d94a4a6207a0d3ea79547a57fb0a7c5f6b2b30d5`, Draft/mergeable and documentation-only. It preserves only the still-valid ownership delta: browser acquisition/session/challenge/CAPTCHA handling stays outside Wardnet, while #173 carries Wardnet-owned destination reputation. Arbitrary metadata fetching must not be reintroduced into Wardnet; any required outbound retrieval must traverse a released EgressWeave authorization boundary or fail closed. -- **#155 management auth** — exact `f74ff25a321dfb1d7109719e2a1fc77e47dc4898`, aligned with current protected main. Its bounded delta fails closed before readiness when a non-loopback listener lacks a write-capable administrator credential. Re-read exact checks/reviews immediately before merge; no predecessor result transfers after any head movement. -- **#93 deterministic persistence failure injection** — exact `4775abc66e5350bdbf07ccefca74c10ddb03701a`, aligned with protected main. The deterministic write-temp/rename fault seam remains the owner-correct replacement for permission-dependent failure injection. Re-read every exact-current gate before integration. +- **#167 MISP admission + shared DNSBL snapshot ownership** — live branch/PR authority is exact `46615df5caca8e6ef1738aba1995f681524b585d`, Draft/mergeable on current protected main. The body still mentions predecessor formatting commit `b6581d45d1b4eacb0ceeb37e2114303d94a0c5b0`, but `b6581d...` is one commit behind live head and must not be promoted as current authority. The accepted MISP parser repair requires affirmative recognized `to_ids` evidence plus active lifecycle state at attribute and enclosing Object scope. A valid review finding then exposed a separate shared reconciler defect: `apply_threat_feed_import` reaps withdrawn `ThreatIndicator`s but does not reap withdrawn DNSBL material. Current test-bearing work executes the corrected non-empty-snapshot RED; production GREEN is still absent. The causal fix belongs in the shared feed control-plane: one stable DNSBL identity matching `DnsblEntry.address`, backward-compatible persisted feed/operator ownership, no overwrite of operator-owned payloads, reap only when no other feed/operator owns the key, actual-write `upserted_dnsbl` counts, and persistence/replay/idempotency/predecessor-deserialization coverage. The valid review thread remains unresolved. Exact-current CI `33976845233`, Fuzz `33976845240`, Security `33976845235`, Semgrep `33976845273`, and CodeQL `33976845781` remain queued/non-passing. +- **#170 MISP threat-level severity child** — exact child `034815040bca40af2732cd0222c3799c1abcd503`, Draft and currently non-mergeable. GitHub still records base `#167@ba5dd624e50eec63efc453a54beb57cbe28295a9`, while the live parent branch is `46615df5...`; this is a stack-repair finding, not grounds to close the child or duplicate parent production work. Preserve the unique three-file severity mapping (`1 -> High`, `2 -> Medium`, `3 -> Low`) and restack non-force only after rereading the parent so all current #167 RED/evidence is inherited exactly. +- **#77 Rust toolchain/reproducibility foundation** — exact `d386d6f57e0c8de3e4839d6c61b593e41f9d7e20`, Ready/mergeable on protected main. CI `33907688502`, Security `33907688421`, and Semgrep `33907688360` are terminal success; CodeQL PR `33907688467` is a historical terminal failure in the central dispatch/verdict path. #1926/#1932 are now protected, but `.github#1929` settings/canary convergence remains before a meaningful exact-head rerun. Child #164 stays Draft until #77 or a verified successor reaches protected truth. +- **#166 Wardnet-local PR queue policy** — exact `13fc6a1b9b3f5af0b7c6acfb79de6c46fd72de3a`, Ready/mergeable. Repository CI `33954367435` and Fuzz `33954367424` are terminal success; central Security/Semgrep/CodeQL worker lanes remain non-passing acquisition evidence already handed to `.github#712`. Ordinary queue wait is not bypass authority. +- **#173 outbound site reputation** — exact `a14b28a10ea87dbcc1939fe0fdca6ce5b02259ed`, Ready/mergeable and documentation-only. Repository CI `33949463493`, Security `33949463487`, Semgrep `33949463505`, and CodeQL PR `33949463499` are now terminal success. This still is not merge-ready: required OpenCode `coverage-evidence` job `101327483721` remains queued with `runner_id=0`, and live solo-maintainer governance remains unsatisfied. Wardnet owns destination maliciousness/reputation evidence lifecycle, organizational admission policy and SOC accountability; EgressWeave remains authoritative for executable URL/address/DNS/peer/redirect/proxy/TLS/resource authorization. Production transport composition requires an immutable compatible EgressWeave Rust-consumer boundary from issue #237 or its verified successor; EgressWeave has no release. +- **#171 anti-bot acquisition boundary** — exact `d94a4a6207a0d3ea79547a57fb0a7c5f6b2b30d5`, Draft/mergeable and documentation-only. It preserves only the still-valid ownership delta: browser acquisition/session/challenge/CAPTCHA handling stays outside Wardnet, while #173 carries Wardnet-owned destination reputation. Arbitrary metadata fetching must not be reintroduced into Wardnet; required outbound retrieval must traverse a released EgressWeave authorization boundary or fail closed. +- **#155 management auth** — exact `f74ff25a321dfb1d7109719e2a1fc77e47dc4898`, Ready/mergeable on protected main. CI/Fuzz/Security/Semgrep are terminal success; its prior CodeQL failure is central dispatch/verdict evidence, not an auth source finding. Do not rerun/churn until `.github#1929` convergence can produce a trustworthy current-head CodeQL result. The feature fails closed before readiness when a non-loopback listener lacks a write-capable administrator credential. +- **#93 deterministic persistence failure injection** — exact `4775abc66e5350bdbf07ccefca74c10ddb03701a`, aligned with protected main. The deterministic write-temp/rename fault seam remains the owner-correct replacement for permission-dependent failure injection. Its prior CodeQL failure is the same central owner class; re-read all exact-current gates only after the owner path is capable of producing a verdict. - **#140 Runtime Configuration** — canonical supporting-boundary owner at exact `054c11aafe835e497d6149efb09f1ccdee9d03bd`, aligned with current protected main. Hostile RED `0f22aaff...` rejects zero positive bounds; causal repair `d28a0119...` fixes the positive-u64 bootstrap parser while preserving the distinct `RATE_LIMIT=0` disable semantic. Feature lanes must adopt #140 rather than create a competing process-environment authority. - **#157/#165 trusted client attribution** — #165 remains the current production feature owner at exact `99581e056645e98e866157443a6732a4bbd729c4`; #157 is a preservation lane for unique trusted-proxy fuzz/corpus/invariant evidence. #165 must adopt #140 after that foundation reaches protected truth and prove complete #157 evidence transfer before #157 can retire. -- **#135 bounded local limiter** — exact `fb24394308ccdc835cce344b7e945f5537e99756`; repository-owned CI/Fuzz are terminal success while central Security/Semgrep/CodeQL remain non-passing while queued. Its local cardinality/rate-limit contract remains separate from #165 trusted-proxy attribution and any future distributed quota authority. -- **#136 outbound policy** — preservation Draft only. Keep Wardnet-owned purpose/call-site/deadline/evidence hostile tests, but do not integrate the local destination/DNS/redirect/proxy/TLS policy implementation. EgressWeave must first publish an immutable Rust-consumable provider-neutral authorization/evidence boundary; current EgressWeave release inventory is empty. -- **#115 official threat-source refresh** — preservation Draft. Preserve Wardnet-owned source registry/parser/conditional-validator/last-known-good/SOC evidence delta, but reconstruct outbound authorization through a released EgressWeave port/ACL rather than retaining local reusable egress authority. EgressWeave has no immutable GitHub Release at this snapshot. +- **#135 bounded local limiter** — exact `fb24394308ccdc835cce344b7e945f5537e99756`; repository-owned CI/Fuzz are terminal success while central Security/Semgrep/CodeQL remain non-passing. Its local cardinality/rate-limit contract remains separate from #165 trusted-proxy attribution and any future distributed quota authority. +- **#136 outbound policy** — preservation Draft only. Keep Wardnet-owned purpose/call-site/deadline/evidence hostile tests, but do not integrate the local destination/DNS/redirect/proxy/TLS policy implementation. EgressWeave issue #237 owns an immutable Rust-consumable provider-neutral authorization/evidence boundary; current release inventory is empty. +- **#115 official threat-source refresh** — preservation Draft. Preserve Wardnet-owned source registry/parser/conditional-validator/last-known-good/SOC evidence delta, but reconstruct outbound authorization through a released EgressWeave port/ACL rather than retaining local reusable egress authority. - **#88 contextual-orchestrator consumer** — architecture-gated preservation. Preserve unique fail-closed credential/header/streaming negative evidence, remove LiteLLM/provider-routing/virtual-key ownership when reconstructing, and consume only a released CO API/client/schema/Agent boundary. Current CO release inventory is empty. - **#164 release evidence** — Draft stacked on #77. It separates PR build/SBOM evidence from protected-main OIDC attestation authority. Do not publish from a feature branch; after the Rust/toolchain parent is protected truth, restack on fresh main and reacquire exact-head package/SBOM/provenance/reproducibility evidence. - **#127 material UI/a11y** — exact `35f4b7a261c15f4549f8e77f40688adc4bb501b0`, aligned with protected main and intentionally Draft. Before Ready it still requires production-like browser E2E for keyboard skip/focus, accessible names/descriptions, KPI live-region behavior, responsive widths, and applicable normal/loading/error/permission states; source-string tests alone are not WCAG 2.2 AA evidence. -- **#90 SIEM/OpenTelemetry preservation** — exact `2d251183c41f49b07d443ff15fe9e54472d90f63`, Draft/non-mergeable mixed aggregate branch. Preserve its unique Wardnet-owned OCSF/OTLP/RFC 5424 exporter/input/fuzz/security evidence through a bounded successor from fresh protected main; do not inherit stale `.github`, generic architecture/change-log, product-gap or other owner surfaces wholesale. Close only after complete verified successor transfer. +- **#90 SIEM/OpenTelemetry preservation** — exact `2d251183c41f49b07d443ff15fe9e54472d90f63`, Draft/non-mergeable mixed aggregate branch. Preserve its unique Wardnet-owned OCSF/OTLP/RFC 5424 exporter/input/fuzz/security evidence through a bounded successor from fresh protected main; do not inherit stale `.github`, generic architecture/changelog, product-gap or other owner surfaces wholesale. Close only after complete verified successor transfer. ## Open PR inventory and single-writer discipline -Fresh search returns 30 open Wardnet PR lanes: `#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #155, #156, #157, #158, #162, #164, #165, #166, #167, #170, #171, #173`. #159 is excluded because it is protected-main truth. +Fresh search still returns 30 open Wardnet PR lanes: `#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #155, #156, #157, #158, #162, #164, #165, #166, #167, #170, #171, #173`. #159 is excluded because it is protected-main truth. PR #130 remains the sole writer for this file. Other Wardnet lanes hand exact evidence into #130 rather than editing this path. PR retirement still requires protected merge, explicit user instruction, malicious/no-valid delta, or verified complete successor transfer of every useful code/test/fixture/contract/evidence delta. ## Context Fabric read-only inventory -Context Graph Contracts still reports `default_branch=develop`. Protected `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` and unprotected byte-identical `main@99cb5468ba3c15c5e79688f53dee74724fae2d13` expose the still-unfinished default/protection transition. Its accepted integration/default target is protected `main`; open work remains Draft/unreleased and GitHub Releases are empty. The current dependency order remains `#4 -> #6 -> #7 -> #8 -> #12 -> #13 -> #14 -> #16 -> #17 -> #18 -> #19 -> #25 -> #20 -> #21`; #21 is exact `bd830530d69a8bf283188efefce56bf42ab45e31` and currently has no exact-head pull-request workflow runs. `context-graph-contracts#27` owns external-capability artifact/evidence/admission/activation semantics. Branch topology/default/protection repair remains Context Fabric/`.github#1137` owner work, not a Wardnet or user decision. - -EA Core still reports `default_branch=develop`; protected `develop@dd71e40a86385fb7861b0f1be19891a3f3e29ece` remains live default authority while product-line `main@ca6889497728e1a3f09d68790a9096576e13a3ff` is not yet the coherent protected/default integration target. Releases are empty. DDD root #39 remains exact `c063570bd9177578fa75be69defd81c99e6ba2f3`; Context Fabric/quarantine projection #40 is Draft exact `ce41036d3fdb0e9787485b4e3a7aaf135e602dfc`, stale against current #39 and has no exact-head repository workflow runs. Its boundary keeps quarantine as canonical artifact-analysis runtime evidence and `Wardnet -> artifact_analysis_evidence` directional; `malware_verdict` and `artifact_risk_score` remain forbidden as authoritative EA facts. No direct foreign database access or source copying is permitted. +Context Graph Contracts still reports `default_branch=develop`. Protected `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` and unprotected byte-identical `main@99cb5468ba3c15c5e79688f53dee74724fae2d13` expose the unfinished default/protection transition. Accepted integration/default target remains protected `main`; open work is Draft/unreleased and GitHub Releases are empty. The current dependency order remains `#4 -> #6 -> #7 -> #8 -> #12 -> #13 -> #14 -> #16 -> #17 -> #18 -> #19 -> #25 -> #20 -> #21`. #21 is exact `497beb4cc5cf76100607c522fefac0422c995cb7`, Draft/non-mergeable and still records obsolete base #20 ancestry; current #20 is `b04fa4f82bb2e8007dd5f1c660e305ffc286f1cb` and prerequisite #25 is `10e5f4abc430437cfd15f79142703ac2b1fc612e`. `context-graph-contracts#27` owns future external-capability artifact/evidence/admission/activation semantics. Branch topology/default/protection repair remains Context Fabric/`.github#1137` owner work, not a Wardnet or user decision. -Mutable producer heads remain evidence only, never released authority. Branch topology/default/protection mismatch remains Context Fabric/central-governance owner work, not a Wardnet or user decision. +EA Core still reports `default_branch=develop`; protected `develop@dd71e40a86385fb7861b0f1be19891a3f3e29ece` remains live default authority while product-line `main@ca6889497728e1a3f09d68790a9096576e13a3ff` remains outside the intended protected/default topology. Releases are empty. DDD root #39 remains exact `c063570bd9177578fa75be69defd81c99e6ba2f3`; Context Fabric/quarantine projection #40 is Draft exact `ce41036d3fdb0e9787485b4e3a7aaf135e602dfc`, stale against current #39. Its boundary keeps quarantine as canonical artifact-analysis runtime evidence and `Wardnet -> artifact_analysis_evidence` directional; `malware_verdict` and `artifact_risk_score` remain forbidden as authoritative EA facts. EA #45 owns governed external-capability portfolio mapping; EA #49 owns the eventual Wardnet outbound-reputation architecture projection. Mutable producer heads remain evidence only, never released authority. ## Buyer-visible gap order @@ -72,4 +72,4 @@ The USD 20 billion ambition is a product-quality bar, not a customer contract va Security and runtime decisions remain traceable to current authoritative NIST/OWASP/CWE/IETF/OCI/Linux sources and primary/peer-reviewed research where the implementation depends on them. Citation is design evidence, not proof that a control is shipped. Wardnet-owned production targets 100% statement/branch/edge-case coverage and complete public rustdoc/docstrings, with realistic bypass/replay/race/DoS/network/cleanup tests where applicable. -No Wardnet release is authorized at this snapshot. Release requires one exact integrated protected head with terminal current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact/source identity and a verified publication path. Feature-branch artifacts or attestations remain candidate evidence only. +No Wardnet release is authorized at this snapshot. Release requires one exact integrated protected head with terminal current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact/source identity and a verified publication path. Feature-branch artifacts or attestations remain candidate evidence only. \ No newline at end of file From 4860936889c1985395199a21135b46d90fbeb577 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 01:53:22 +0900 Subject: [PATCH 64/73] docs(gaps): advance OpenCode acquisition evidence --- docs/product-technical-gap-baseline.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 3837b7f4..d5a52269 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -16,7 +16,7 @@ Protected/default Wardnet truth remains `main@5829a0f08d78de464dd24393ce5d0f25fb Organization ruleset `18156473` remains active on `~DEFAULT_BRANCH`. Fresh live policy still requires one generic approving review with no named required reviewer, requires review-thread resolution and central OpenCode/review-scheduler/Security/Strix/Semgrep/Noema/CodeQL workflows, blocks deletion/non-fast-forward, and exposes `OrganizationAdmin/always` bypass. Under the declared solo-maintainer model, self-approval and bot/model-as-human approval remain forbidden. `.github#772` owns replacement of only the structurally impossible approval deadlock/routine-bypass defect while deterministic security/coverage/SBOM/provenance/thread/branch-integrity controls remain or strengthen. Its current implementation #1644 is not merge-ready: it has diverged from protected `.github/main` and its current-head CodeQL lane is not GREEN. -Runner/event/model-review acquisition/materialization remains `.github#712` owner work. The protected central scheduler repair #1937 removed one self-cancellation cause, but unchanged Wardnet heads still expose hosted-runner acquisition stalls. #167 exact CI job `101334935550` on explicit `ubuntu-24.04` remains pre-checkout with `steps=[]`, `runner_id=0`. #173 narrows the same class inside an otherwise-progressing required OpenCode workflow: bootstrap, exact-head admission and `coverage-source-tree` all acquired hosted runners and completed, while downstream `coverage-evidence` job `101327483721` remains queued with `steps=[]`, `runner_id=0`. These are non-passing owner-plane specimens, not reasons for leaf no-op churn or bypass. +Runner/event/model-review acquisition/materialization remains `.github#712` owner work. The protected central scheduler repair #1937 removed one self-cancellation cause, but unchanged Wardnet heads still expose hosted-runner acquisition stalls. #167 exact CI job `101334935550` on explicit `ubuntu-24.04` remains pre-checkout with `steps=[]`, `runner_id=0`. #173 provides a more granular required-workflow specimen: bootstrap, exact-head admission, `coverage-source-tree`, and `coverage-evidence` have all acquired hosted runners and completed on the unchanged head; `coverage-evidence` job `101327483721` succeeded on runner `1001688014`. The newly materialized downstream `opencode-review` job `101340969657` is now queued with `steps=[]`, `runner_id=0`, empty runner/group identity. These are non-passing owner-plane specimens, not reasons for leaf no-op churn or bypass. Central CodeQL matrix serialization repair #1926 and trusted-dispatcher CSV parser repair #1932 are protected. Remaining dispatch authorization/settings convergence is `.github#1929`: both intended senders, `github-actions[bot]` and `opencode-agent[bot]`, must remain representable without weakening the actor==sender invariant. Leaf CodeQL reruns should wait for that owner setting/canary convergence rather than repeatedly consume runners. @@ -32,13 +32,13 @@ Current hostile TDD includes the PyPI hash-mode contradiction: RED `032d74e060e7 ## Immediate product/security lanes -- **#167 MISP admission + shared DNSBL snapshot ownership** — live branch/PR authority is exact `46615df5caca8e6ef1738aba1995f681524b585d`, Draft/mergeable on current protected main. The body still mentions predecessor formatting commit `b6581d45d1b4eacb0ceeb37e2114303d94a0c5b0`, but `b6581d...` is one commit behind live head and must not be promoted as current authority. The accepted MISP parser repair requires affirmative recognized `to_ids` evidence plus active lifecycle state at attribute and enclosing Object scope. A valid review finding then exposed a separate shared reconciler defect: `apply_threat_feed_import` reaps withdrawn `ThreatIndicator`s but does not reap withdrawn DNSBL material. Current test-bearing work executes the corrected non-empty-snapshot RED; production GREEN is still absent. The causal fix belongs in the shared feed control-plane: one stable DNSBL identity matching `DnsblEntry.address`, backward-compatible persisted feed/operator ownership, no overwrite of operator-owned payloads, reap only when no other feed/operator owns the key, actual-write `upserted_dnsbl` counts, and persistence/replay/idempotency/predecessor-deserialization coverage. The valid review thread remains unresolved. Exact-current CI `33976845233`, Fuzz `33976845240`, Security `33976845235`, Semgrep `33976845273`, and CodeQL `33976845781` remain queued/non-passing. -- **#170 MISP threat-level severity child** — exact child `034815040bca40af2732cd0222c3799c1abcd503`, Draft and currently non-mergeable. GitHub still records base `#167@ba5dd624e50eec63efc453a54beb57cbe28295a9`, while the live parent branch is `46615df5...`; this is a stack-repair finding, not grounds to close the child or duplicate parent production work. Preserve the unique three-file severity mapping (`1 -> High`, `2 -> Medium`, `3 -> Low`) and restack non-force only after rereading the parent so all current #167 RED/evidence is inherited exactly. -- **#77 Rust toolchain/reproducibility foundation** — exact `d386d6f57e0c8de3e4839d6c61b593e41f9d7e20`, Ready/mergeable on protected main. CI `33907688502`, Security `33907688421`, and Semgrep `33907688360` are terminal success; CodeQL PR `33907688467` is a historical terminal failure in the central dispatch/verdict path. #1926/#1932 are now protected, but `.github#1929` settings/canary convergence remains before a meaningful exact-head rerun. Child #164 stays Draft until #77 or a verified successor reaches protected truth. +- **#167 MISP admission + shared DNSBL snapshot ownership** — live branch/PR authority is exact `46615df5caca8e6ef1738aba1995f681524b585d`, Draft/mergeable on current protected main. The accepted MISP parser repair requires affirmative recognized `to_ids` evidence plus active lifecycle state at attribute and enclosing Object scope. A valid review finding then exposed a separate shared reconciler defect: `apply_threat_feed_import` reaps withdrawn `ThreatIndicator`s but does not reap withdrawn DNSBL material. Current head `46615...` repairs the async hostile harness so the corrected non-empty-snapshot DNSBL ownership RED assertions actually execute; production GREEN is still absent. The causal fix belongs in the shared feed control-plane: one stable DNSBL identity matching `DnsblEntry.address`, backward-compatible persisted feed/operator ownership, no overwrite of operator-owned payloads, reap only when no other feed/operator owns the key, actual-write `upserted_dnsbl` counts, and persistence/replay/idempotency/predecessor-deserialization coverage. The valid review thread remains unresolved. Exact-current CI `33976845233`, Fuzz `33976845240`, Security `33976845235`, Semgrep `33976845273`, and CodeQL `33976845781` remain queued/non-passing. +- **#170 MISP threat-level severity child** — exact child `034815040bca40af2732cd0222c3799c1abcd503`, Draft. Fresh compare against live parent #167 `46615df...` is `diverged`, `behind_by=2`, `ahead_by=7`, merge base `ba5dd624...`. This is a stack-repair finding, not grounds to close the child or duplicate parent production work. Preserve the unique three-file severity mapping (`1 -> High`, `2 -> Medium`, `3 -> Low`) and non-force adopt the exact then-live parent when a safe merge-capable path exists; force-push/destructive rewrite is forbidden. +- **#77 Rust toolchain/reproducibility foundation** — exact `d386d6f57e0c8de3e4839d6c61b593e41f9d7e20`, Ready/mergeable on protected main. CI `33907688502`, Security `33907688421`, and Semgrep `33907688360` are terminal success; CodeQL PR `33907688467` is historical central-dispatch failure. #1926/#1932 are protected, but `.github#1929` settings/canary convergence remains before a meaningful exact-head rerun. Child #164 stays Draft until #77 or a verified successor reaches protected truth. - **#166 Wardnet-local PR queue policy** — exact `13fc6a1b9b3f5af0b7c6acfb79de6c46fd72de3a`, Ready/mergeable. Repository CI `33954367435` and Fuzz `33954367424` are terminal success; central Security/Semgrep/CodeQL worker lanes remain non-passing acquisition evidence already handed to `.github#712`. Ordinary queue wait is not bypass authority. -- **#173 outbound site reputation** — exact `a14b28a10ea87dbcc1939fe0fdca6ce5b02259ed`, Ready/mergeable and documentation-only. Repository CI `33949463493`, Security `33949463487`, Semgrep `33949463505`, and CodeQL PR `33949463499` are now terminal success. This still is not merge-ready: required OpenCode `coverage-evidence` job `101327483721` remains queued with `runner_id=0`, and live solo-maintainer governance remains unsatisfied. Wardnet owns destination maliciousness/reputation evidence lifecycle, organizational admission policy and SOC accountability; EgressWeave remains authoritative for executable URL/address/DNS/peer/redirect/proxy/TLS/resource authorization. Production transport composition requires an immutable compatible EgressWeave Rust-consumer boundary from issue #237 or its verified successor; EgressWeave has no release. +- **#173 outbound site reputation** — exact `a14b28a10ea87dbcc1939fe0fdca6ce5b02259ed`, Ready/mergeable and documentation-only. Repository CI `33949463493`, Security `33949463487`, Semgrep `33949463505`, and CodeQL PR `33949463499` are terminal success. Required OpenCode bootstrap, exact-head admission, coverage-source-tree and coverage-evidence are also terminal success; downstream `opencode-review` job `101340969657` remains queued with `steps=[]`, `runner_id=0`. Live solo-maintainer governance also remains unsatisfied. Wardnet owns destination maliciousness/reputation evidence lifecycle, organizational admission policy and SOC accountability; EgressWeave remains authoritative for executable URL/address/DNS/peer/redirect/proxy/TLS/resource authorization. Production transport composition requires an immutable compatible EgressWeave Rust-consumer boundary from issue #237 or its verified successor; EgressWeave has no release. - **#171 anti-bot acquisition boundary** — exact `d94a4a6207a0d3ea79547a57fb0a7c5f6b2b30d5`, Draft/mergeable and documentation-only. It preserves only the still-valid ownership delta: browser acquisition/session/challenge/CAPTCHA handling stays outside Wardnet, while #173 carries Wardnet-owned destination reputation. Arbitrary metadata fetching must not be reintroduced into Wardnet; required outbound retrieval must traverse a released EgressWeave authorization boundary or fail closed. -- **#155 management auth** — exact `f74ff25a321dfb1d7109719e2a1fc77e47dc4898`, Ready/mergeable on protected main. CI/Fuzz/Security/Semgrep are terminal success; its prior CodeQL failure is central dispatch/verdict evidence, not an auth source finding. Do not rerun/churn until `.github#1929` convergence can produce a trustworthy current-head CodeQL result. The feature fails closed before readiness when a non-loopback listener lacks a write-capable administrator credential. +- **#155 management auth** — exact `f74ff25a321dfb1d7109719e2a1fc77e47dc4898`, Ready/mergeable on protected main. CI/Fuzz/Security/Semgrep are terminal success; its prior CodeQL failure is central dispatch/verdict evidence, not an auth source finding. #1926/#1932 are protected; wait for `.github#1929` settings/canary convergence before a meaningful current-head CodeQL rerun. The feature fails closed before readiness when a non-loopback listener lacks a write-capable administrator credential. - **#93 deterministic persistence failure injection** — exact `4775abc66e5350bdbf07ccefca74c10ddb03701a`, aligned with protected main. The deterministic write-temp/rename fault seam remains the owner-correct replacement for permission-dependent failure injection. Its prior CodeQL failure is the same central owner class; re-read all exact-current gates only after the owner path is capable of producing a verdict. - **#140 Runtime Configuration** — canonical supporting-boundary owner at exact `054c11aafe835e497d6149efb09f1ccdee9d03bd`, aligned with current protected main. Hostile RED `0f22aaff...` rejects zero positive bounds; causal repair `d28a0119...` fixes the positive-u64 bootstrap parser while preserving the distinct `RATE_LIMIT=0` disable semantic. Feature lanes must adopt #140 rather than create a competing process-environment authority. - **#157/#165 trusted client attribution** — #165 remains the current production feature owner at exact `99581e056645e98e866157443a6732a4bbd729c4`; #157 is a preservation lane for unique trusted-proxy fuzz/corpus/invariant evidence. #165 must adopt #140 after that foundation reaches protected truth and prove complete #157 evidence transfer before #157 can retire. From 748e0e3539a62c4b193208ee695bc77ad00ccccc Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 07:42:40 +0900 Subject: [PATCH 65/73] docs(gaps): refresh exact security and owner evidence --- docs/product-technical-gap-baseline.md | 38 +++++++++++++------------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index d5a52269..038f0554 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -8,59 +8,59 @@ Wardnet owns the Rust-first gateway/SOC control plane and the Gateway, Admission `context-graph-contracts` is the provider-neutral Context Fabric Shared Kernel and `enterprise-architecture-core` is the EA Decision Plane. Both remain read-only from this Wardnet writer while their Context Fabric owner is active. Wardnet findings/verdicts remain Wardnet evidence; EA may retain verified evidence references for technology risk/remediation/initiative context but must not copy raw security verdicts into authoritative architecture truth. -Fresh GitHub release inventories remain empty for Wardnet, Context Graph Contracts, EA Core, `contextual-orchestrator`, `quarantine-sandbox-runtime`, EgressWeave and `appguardrail`. No mutable sibling head is production/release authority. +Fresh GitHub release inventories remain empty for Wardnet, Context Graph Contracts and EA Core. The current Wardnet integration contract also continues to require immutable compatible releases rather than mutable heads from `contextual-orchestrator`, `quarantine-sandbox-runtime`, EgressWeave or `appguardrail`. No mutable sibling head is production/release authority. ## Protected truth and control plane Protected/default Wardnet truth remains `main@5829a0f08d78de464dd24393ce5d0f25fba9d126`, produced by protected merge #159. #159 is protected workflow-control truth: its CI/Fuzz/Scorecard pressure repair, explicit hosted-runner contract, `AGENTS.md` ownership guidance and workflow queue/runner regressions must be adopted by consumer lanes rather than copied or bypassed. -Organization ruleset `18156473` remains active on `~DEFAULT_BRANCH`. Fresh live policy still requires one generic approving review with no named required reviewer, requires review-thread resolution and central OpenCode/review-scheduler/Security/Strix/Semgrep/Noema/CodeQL workflows, blocks deletion/non-fast-forward, and exposes `OrganizationAdmin/always` bypass. Under the declared solo-maintainer model, self-approval and bot/model-as-human approval remain forbidden. `.github#772` owns replacement of only the structurally impossible approval deadlock/routine-bypass defect while deterministic security/coverage/SBOM/provenance/thread/branch-integrity controls remain or strengthen. Its current implementation #1644 is not merge-ready: it has diverged from protected `.github/main` and its current-head CodeQL lane is not GREEN. +Organization ruleset `18156473` remains active on `~DEFAULT_BRANCH`. Fresh live policy still requires one generic approving review with no named required reviewer, requires review-thread resolution and central OpenCode/review-scheduler/Security/Strix/Semgrep/Noema/CodeQL workflows, blocks deletion/non-fast-forward, and exposes `OrganizationAdmin/always` bypass. Under the declared solo-maintainer model, self-approval and bot/model-as-human approval remain forbidden. `.github#772` owns replacement of only the structurally impossible approval deadlock/routine-bypass defect while deterministic security/coverage/SBOM/provenance/thread/branch-integrity controls remain or strengthen. -Runner/event/model-review acquisition/materialization remains `.github#712` owner work. The protected central scheduler repair #1937 removed one self-cancellation cause, but unchanged Wardnet heads still expose hosted-runner acquisition stalls. #167 exact CI job `101334935550` on explicit `ubuntu-24.04` remains pre-checkout with `steps=[]`, `runner_id=0`. #173 provides a more granular required-workflow specimen: bootstrap, exact-head admission, `coverage-source-tree`, and `coverage-evidence` have all acquired hosted runners and completed on the unchanged head; `coverage-evidence` job `101327483721` succeeded on runner `1001688014`. The newly materialized downstream `opencode-review` job `101340969657` is now queued with `steps=[]`, `runner_id=0`, empty runner/group identity. These are non-passing owner-plane specimens, not reasons for leaf no-op churn or bypass. +Delegated model/code-analysis verdict execution and wake-up remain `.github#712` owner work. Two unchanged Wardnet canaries now narrow the defect beyond hosted-runner acquisition. On #129 exact `db921e7f855f52870b23de52a4e23f11ff996644`, CodeQL compatibility job `101354139576` acquired Ubuntu 24.04, completed OIDC and repository-scoped app-token exchange, successfully sent the exact `repository_dispatch`, then failed closed because no authenticated terminal `codeql-dispatch/actions` status appeared on that SHA. On #173 exact `a14b28a10ea87dbcc1939fe0fdca6ce5b02259ed`, required OpenCode job `101340969657` likewise acquired Ubuntu, completed bootstrap/admission/coverage evidence, OIDC/app-token exchange and dispatch, then failed closed because no authenticated exact-head `APPROVED` or `CHANGES_REQUESTED` verdict from `opencode-agent` appeared. These are central producer/status-publication/wake-path specimens, not reasons for Wardnet no-op commits, broad reruns or gate weakening. -Central CodeQL matrix serialization repair #1926 and trusted-dispatcher CSV parser repair #1932 are protected. Remaining dispatch authorization/settings convergence is `.github#1929`: both intended senders, `github-actions[bot]` and `opencode-agent[bot]`, must remain representable without weakening the actor==sender invariant. Leaf CodeQL reruns should wait for that owner setting/canary convergence rather than repeatedly consume runners. +Current #167 exact `340f20b1898099bbf2b58a2a2cbd34c8f6057b35` has newly materialized CI/Fuzz/Security/Semgrep/CodeQL runs, all presently queued. That is non-passing evidence only; the branch already has a causal source RED and should not be churned to manufacture runner activity. ## Agent Artifact Admission -PR #129 is exact `db921e7f855f52870b23de52a4e23f11ff996644`, mergeable but intentionally Draft. A predecessor acquired Ubuntu 24.04 and failed deterministically at `cargo fmt --check`; seven formatting-only commits applied the repository-effective formatter to all reported offenders without semantic broadening. Fresh exact-current CI `33977431401`, Fuzz `33977431523`, Security Scan `33977431400`, SAST Semgrep `33977431547`, and CodeQL PR `33977431418` remain queued/non-passing. Predecessor GREEN does not transfer. +PR #129 is exact `db921e7f855f52870b23de52a4e23f11ff996644`, mergeable but intentionally Draft. Four exact-current repository/security lanes are terminal GREEN without source churn: CI `33977431401`, Fuzz `33977431523`, Security Scan `33977431400`, and SAST Semgrep `33977431547`. CodeQL PR `33977431418` is terminal FAILURE only because the successfully dispatched exact-head delegated verdict remained pending; the causal owner handoff is recorded on `.github#712`. Combined commit status still lacks the required authenticated `codeql-dispatch/actions` terminal status. Preserve the four GREEN lanes and reacquire only the failed/required delegated lane after the central owner path can publish and wake an exact-head verdict. The bounded context is pre-execution structured installer security admission only. It binds reviewed workspace manifest/artifact identity, exact ecosystem/name/version/registry/owner/SHA-256, executable family, declared operands, policy revision and bounded provenance; it does not fetch, decrypt, install, execute, isolate, activate or route workloads. An `allow` receipt is admission authority, not downloaded-byte proof or runtime activation. Current hostile TDD includes the PyPI hash-mode contradiction: RED `032d74e060e778add00a2cc757ce3582c1135232` proves `--require-hashes` plus hostile `--no-require-hashes` must not remain admissible; classifier `4c0de8a3445d6b062b69440507cd3c81a3323308` isolates pip/pip3 hash-mode authority; causal repair `bba656c1d776da38a7315d9ec8e6cb5bdfd621d1` fails the contradictory request closed. Earlier package-manager, Cargo, npm-family, OCI-cardinality/platform and Podman trust/auth/decryption hostile contracts remain preserved. -`context-graph-contracts#27` owns the future provider-neutral external-capability artifact/evidence/admission/activation grammar. Package-manager argv/parser semantics and Wardnet reason codes remain Wardnet-local. `enterprise-architecture-core#45` owns architecture adoption/risk/provenance projection and must retain evidence references without making Wardnet findings authoritative EA facts. AppGuardrail #1099 owns deterministic static plugin/package scanning and scan receipts; quarantine owns hostile dynamic execution evidence; Noema owns activation/rollback. None currently exposes an immutable GitHub Release that Wardnet may treat as production authority. +`context-graph-contracts#27` owns the future provider-neutral external-capability artifact/evidence/admission/activation grammar. Package-manager argv/parser semantics and Wardnet reason codes remain Wardnet-local. `enterprise-architecture-core#45` owns architecture adoption/risk/provenance projection and must retain evidence references without making Wardnet findings authoritative EA facts. AppGuardrail owns deterministic static plugin/package scanning and scan receipts; quarantine owns hostile dynamic execution evidence; Noema owns activation/rollback. None of those mutable owner heads is production authority. ## Immediate product/security lanes -- **#167 MISP admission + shared DNSBL snapshot ownership** — live branch/PR authority is exact `46615df5caca8e6ef1738aba1995f681524b585d`, Draft/mergeable on current protected main. The accepted MISP parser repair requires affirmative recognized `to_ids` evidence plus active lifecycle state at attribute and enclosing Object scope. A valid review finding then exposed a separate shared reconciler defect: `apply_threat_feed_import` reaps withdrawn `ThreatIndicator`s but does not reap withdrawn DNSBL material. Current head `46615...` repairs the async hostile harness so the corrected non-empty-snapshot DNSBL ownership RED assertions actually execute; production GREEN is still absent. The causal fix belongs in the shared feed control-plane: one stable DNSBL identity matching `DnsblEntry.address`, backward-compatible persisted feed/operator ownership, no overwrite of operator-owned payloads, reap only when no other feed/operator owns the key, actual-write `upserted_dnsbl` counts, and persistence/replay/idempotency/predecessor-deserialization coverage. The valid review thread remains unresolved. Exact-current CI `33976845233`, Fuzz `33976845240`, Security `33976845235`, Semgrep `33976845273`, and CodeQL `33976845781` remain queued/non-passing. -- **#170 MISP threat-level severity child** — exact child `034815040bca40af2732cd0222c3799c1abcd503`, Draft. Fresh compare against live parent #167 `46615df...` is `diverged`, `behind_by=2`, `ahead_by=7`, merge base `ba5dd624...`. This is a stack-repair finding, not grounds to close the child or duplicate parent production work. Preserve the unique three-file severity mapping (`1 -> High`, `2 -> Medium`, `3 -> Low`) and non-force adopt the exact then-live parent when a safe merge-capable path exists; force-push/destructive rewrite is forbidden. -- **#77 Rust toolchain/reproducibility foundation** — exact `d386d6f57e0c8de3e4839d6c61b593e41f9d7e20`, Ready/mergeable on protected main. CI `33907688502`, Security `33907688421`, and Semgrep `33907688360` are terminal success; CodeQL PR `33907688467` is historical central-dispatch failure. #1926/#1932 are protected, but `.github#1929` settings/canary convergence remains before a meaningful exact-head rerun. Child #164 stays Draft until #77 or a verified successor reaches protected truth. -- **#166 Wardnet-local PR queue policy** — exact `13fc6a1b9b3f5af0b7c6acfb79de6c46fd72de3a`, Ready/mergeable. Repository CI `33954367435` and Fuzz `33954367424` are terminal success; central Security/Semgrep/CodeQL worker lanes remain non-passing acquisition evidence already handed to `.github#712`. Ordinary queue wait is not bypass authority. -- **#173 outbound site reputation** — exact `a14b28a10ea87dbcc1939fe0fdca6ce5b02259ed`, Ready/mergeable and documentation-only. Repository CI `33949463493`, Security `33949463487`, Semgrep `33949463505`, and CodeQL PR `33949463499` are terminal success. Required OpenCode bootstrap, exact-head admission, coverage-source-tree and coverage-evidence are also terminal success; downstream `opencode-review` job `101340969657` remains queued with `steps=[]`, `runner_id=0`. Live solo-maintainer governance also remains unsatisfied. Wardnet owns destination maliciousness/reputation evidence lifecycle, organizational admission policy and SOC accountability; EgressWeave remains authoritative for executable URL/address/DNS/peer/redirect/proxy/TLS/resource authorization. Production transport composition requires an immutable compatible EgressWeave Rust-consumer boundary from issue #237 or its verified successor; EgressWeave has no release. +- **#167 MISP admission + shared DNSBL snapshot ownership** — live branch/PR authority is exact `340f20b1898099bbf2b58a2a2cbd34c8f6057b35`, Draft/mergeable on current protected main. The retained MISP parser repair requires affirmative recognized `to_ids` evidence plus active lifecycle state at attribute and enclosing Object scope. A valid review finding then exposed a separate shared reconciler defect: `apply_threat_feed_import` reaps withdrawn `ThreatIndicator`s but historically only upserts DNSBL material. The DNSBL TDD lineage now includes corrected non-empty withdrawal fixtures, an async harness repair, restart/predecessor-state/persistence-rollback/retry REDs, an intentionally reverted raw-`IpAddr` schema attempt, and exact predecessor CI `33983682746`, which compiled and failed exactly stale withdrawal plus operator-owned overlap write/count while the shared-owner/operator-withdrawal cases passed. Current `340f20b...` corrects the predecessor-state hostile test to target the accepted future `operator_dnsbl_keys` field. Production GREEN remains absent. The shared control-plane fix requires a documented serializable/hashable `DnsblEntryKey` keyed only by `DnsblEntry.address`, serde-default feed/operator ownership, atomic threat+DNSBL snapshot reconciliation, operator-first ownership, no feed overwrite of operator payloads, reap only when no other feed/operator owns the key, actual-write `upserted_dnsbl` counts, and complete persistence/replay/idempotency rollback semantics. The valid review thread remains unresolved. Exact-current CI `33996187652`, Fuzz `33996187641`, Security `33996187499`, Semgrep `33996187565`, and CodeQL `33996187707` are queued/non-passing. +- **#170 MISP threat-level severity child** — exact child `7b383859257d2f317e0c40f68b3d8d706628ad9d`, Draft. It last non-force adopted #167 through parent `28d0ac12d37b4c97ea58b2d55831a6c1e7b9cf98`; live parent is now `340f20b...` because of the one-line predecessor-state RED correction. Preserve the unique three-file severity mapping (`1 -> High`, `2 -> Medium`, `3 -> Low`) and do not restack merely for transient parent test churn. After #167 reaches stable shared-reconciler GREEN, re-read every intervening parent delta and non-force adopt the complete parent lineage once, then reacquire all child exact-head gates. +- **#77 Rust toolchain/reproducibility foundation** — exact `d386d6f57e0c8de3e4839d6c61b593e41f9d7e20`, Ready/mergeable on protected main. CI `33907688502`, Security `33907688421`, and Semgrep `33907688360` are terminal success; its prior CodeQL result is delegated-control-plane evidence rather than toolchain-source GREEN. Child #164 stays Draft until #77 or a verified successor reaches protected truth and current delegated gates can be reacquired. +- **#166 Wardnet-local PR queue policy** — exact `13fc6a1b9b3f5af0b7c6acfb79de6c46fd72de3a`, Ready/mergeable. Repository CI `33954367435` and Fuzz `33954367424` are terminal success; central Security/Semgrep/CodeQL worker lanes remain non-passing owner-plane evidence already handed to `.github#712`. Ordinary queue wait is not bypass authority. +- **#173 outbound site reputation** — exact `a14b28a10ea87dbcc1939fe0fdca6ce5b02259ed`, Ready/mergeable and documentation-only. Repository CI `33949463493`, Security `33949463487`, Semgrep `33949463505`, CodeQL PR `33949463499`, and required review merge scheduler `33949463529` are terminal success. Required OpenCode run `33949463777` is terminal FAILURE only after its exact-head job acquired a real Ubuntu runner, completed bootstrap/admission/coverage evidence, OIDC/app-token exchange and dispatch, then received no authenticated exact-head model-review verdict. That current specimen is handed to `.github#712`; do not alter this docs head merely to redispatch. Live solo-maintainer governance also remains unsatisfied. Wardnet owns destination maliciousness/reputation evidence lifecycle, organizational admission policy and SOC accountability; EgressWeave remains authoritative for executable URL/address/DNS/peer/redirect/proxy/TLS/resource authorization. Production transport composition requires an immutable compatible EgressWeave Rust-consumer boundary; no mutable owner head qualifies. - **#171 anti-bot acquisition boundary** — exact `d94a4a6207a0d3ea79547a57fb0a7c5f6b2b30d5`, Draft/mergeable and documentation-only. It preserves only the still-valid ownership delta: browser acquisition/session/challenge/CAPTCHA handling stays outside Wardnet, while #173 carries Wardnet-owned destination reputation. Arbitrary metadata fetching must not be reintroduced into Wardnet; required outbound retrieval must traverse a released EgressWeave authorization boundary or fail closed. -- **#155 management auth** — exact `f74ff25a321dfb1d7109719e2a1fc77e47dc4898`, Ready/mergeable on protected main. CI/Fuzz/Security/Semgrep are terminal success; its prior CodeQL failure is central dispatch/verdict evidence, not an auth source finding. #1926/#1932 are protected; wait for `.github#1929` settings/canary convergence before a meaningful current-head CodeQL rerun. The feature fails closed before readiness when a non-loopback listener lacks a write-capable administrator credential. -- **#93 deterministic persistence failure injection** — exact `4775abc66e5350bdbf07ccefca74c10ddb03701a`, aligned with protected main. The deterministic write-temp/rename fault seam remains the owner-correct replacement for permission-dependent failure injection. Its prior CodeQL failure is the same central owner class; re-read all exact-current gates only after the owner path is capable of producing a verdict. +- **#155 management auth** — exact `f74ff25a321dfb1d7109719e2a1fc77e47dc4898`, Ready/mergeable on protected main. CI/Fuzz/Security/Semgrep are terminal success; its prior CodeQL failure is central delegated-verdict evidence, not an auth source finding. The feature fails closed before readiness when a non-loopback listener lacks a write-capable administrator credential. +- **#93 deterministic persistence failure injection** — exact `4775abc66e5350bdbf07ccefca74c10ddb03701a`, aligned with protected main. The deterministic write-temp/rename fault seam remains the owner-correct replacement for permission-dependent failure injection. Its prior CodeQL failure belongs to the same central delegated-verdict class; re-read all exact-current gates only after the owner plane can issue a current verdict. - **#140 Runtime Configuration** — canonical supporting-boundary owner at exact `054c11aafe835e497d6149efb09f1ccdee9d03bd`, aligned with current protected main. Hostile RED `0f22aaff...` rejects zero positive bounds; causal repair `d28a0119...` fixes the positive-u64 bootstrap parser while preserving the distinct `RATE_LIMIT=0` disable semantic. Feature lanes must adopt #140 rather than create a competing process-environment authority. - **#157/#165 trusted client attribution** — #165 remains the current production feature owner at exact `99581e056645e98e866157443a6732a4bbd729c4`; #157 is a preservation lane for unique trusted-proxy fuzz/corpus/invariant evidence. #165 must adopt #140 after that foundation reaches protected truth and prove complete #157 evidence transfer before #157 can retire. - **#135 bounded local limiter** — exact `fb24394308ccdc835cce344b7e945f5537e99756`; repository-owned CI/Fuzz are terminal success while central Security/Semgrep/CodeQL remain non-passing. Its local cardinality/rate-limit contract remains separate from #165 trusted-proxy attribution and any future distributed quota authority. -- **#136 outbound policy** — preservation Draft only. Keep Wardnet-owned purpose/call-site/deadline/evidence hostile tests, but do not integrate the local destination/DNS/redirect/proxy/TLS policy implementation. EgressWeave issue #237 owns an immutable Rust-consumable provider-neutral authorization/evidence boundary; current release inventory is empty. +- **#136 outbound policy** — preservation Draft only. Keep Wardnet-owned purpose/call-site/deadline/evidence hostile tests, but do not integrate the local destination/DNS/redirect/proxy/TLS policy implementation. EgressWeave issue #237 owns an immutable Rust-consumable provider-neutral authorization/evidence boundary; current mutable work is not release authority. - **#115 official threat-source refresh** — preservation Draft. Preserve Wardnet-owned source registry/parser/conditional-validator/last-known-good/SOC evidence delta, but reconstruct outbound authorization through a released EgressWeave port/ACL rather than retaining local reusable egress authority. -- **#88 contextual-orchestrator consumer** — architecture-gated preservation. Preserve unique fail-closed credential/header/streaming negative evidence, remove LiteLLM/provider-routing/virtual-key ownership when reconstructing, and consume only a released CO API/client/schema/Agent boundary. Current CO release inventory is empty. +- **#88 contextual-orchestrator consumer** — architecture-gated preservation. Preserve unique fail-closed credential/header/streaming negative evidence, remove LiteLLM/provider-routing/virtual-key ownership when reconstructing, and consume only a released CO API/client/schema/Agent boundary. Mutable CO source is not production authority. - **#164 release evidence** — Draft stacked on #77. It separates PR build/SBOM evidence from protected-main OIDC attestation authority. Do not publish from a feature branch; after the Rust/toolchain parent is protected truth, restack on fresh main and reacquire exact-head package/SBOM/provenance/reproducibility evidence. - **#127 material UI/a11y** — exact `35f4b7a261c15f4549f8e77f40688adc4bb501b0`, aligned with protected main and intentionally Draft. Before Ready it still requires production-like browser E2E for keyboard skip/focus, accessible names/descriptions, KPI live-region behavior, responsive widths, and applicable normal/loading/error/permission states; source-string tests alone are not WCAG 2.2 AA evidence. - **#90 SIEM/OpenTelemetry preservation** — exact `2d251183c41f49b07d443ff15fe9e54472d90f63`, Draft/non-mergeable mixed aggregate branch. Preserve its unique Wardnet-owned OCSF/OTLP/RFC 5424 exporter/input/fuzz/security evidence through a bounded successor from fresh protected main; do not inherit stale `.github`, generic architecture/changelog, product-gap or other owner surfaces wholesale. Close only after complete verified successor transfer. ## Open PR inventory and single-writer discipline -Fresh search still returns 30 open Wardnet PR lanes: `#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #155, #156, #157, #158, #162, #164, #165, #166, #167, #170, #171, #173`. #159 is excluded because it is protected-main truth. +Fresh search returns 30 open Wardnet PR lanes: `#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #155, #156, #157, #158, #162, #164, #165, #166, #167, #170, #171, #173`. #159 is excluded because it is protected-main truth. PR #130 remains the sole writer for this file. Other Wardnet lanes hand exact evidence into #130 rather than editing this path. PR retirement still requires protected merge, explicit user instruction, malicious/no-valid delta, or verified complete successor transfer of every useful code/test/fixture/contract/evidence delta. ## Context Fabric read-only inventory -Context Graph Contracts still reports `default_branch=develop`. Protected `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` and unprotected byte-identical `main@99cb5468ba3c15c5e79688f53dee74724fae2d13` expose the unfinished default/protection transition. Accepted integration/default target remains protected `main`; open work is Draft/unreleased and GitHub Releases are empty. The current dependency order remains `#4 -> #6 -> #7 -> #8 -> #12 -> #13 -> #14 -> #16 -> #17 -> #18 -> #19 -> #25 -> #20 -> #21`. #21 is exact `497beb4cc5cf76100607c522fefac0422c995cb7`, Draft/non-mergeable and still records obsolete base #20 ancestry; current #20 is `b04fa4f82bb2e8007dd5f1c660e305ffc286f1cb` and prerequisite #25 is `10e5f4abc430437cfd15f79142703ac2b1fc612e`. `context-graph-contracts#27` owns future external-capability artifact/evidence/admission/activation semantics. Branch topology/default/protection repair remains Context Fabric/`.github#1137` owner work, not a Wardnet or user decision. +Context Graph Contracts still reports `default_branch=develop`. Protected `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` and unprotected byte-identical `main@99cb5468ba3c15c5e79688f53dee74724fae2d13` expose the unfinished default/protection transition; organization ruleset `18156473` is active and therefore still follows the live default topology. GitHub Releases remain empty. The intended dependency order remains `#4 -> #6 -> #7 -> #8 -> #12 -> #13 -> #14 -> #16 -> #17 -> #18 -> #19 -> #25 -> #20 -> #21`. Live dependency root #4 is `7503b7da50efcad8256e5b6d3214e438c829cd50`; current #25 is `10e5f4abc430437cfd15f79142703ac2b1fc612e`, #20 is `b04fa4f82bb2e8007dd5f1c660e305ffc286f1cb`, and #21 has advanced to `637aead5cd5e379fed4dca2c650a86b71ea895ac`. Root #4's fresh owner evidence still separates real defects from source truth: Semgrep is GREEN, Dependency Review failed closed on a GitHub 403 owned by `.github#810`, delegated CodeQL remains `.github#712`, and repository bootstrap workflows have not yet established immutable release authority. `context-graph-contracts#27` owns future external-capability artifact/evidence/admission/activation semantics. Branch topology/default/protection repair remains Context Fabric/central owner work, not a Wardnet or user decision. -EA Core still reports `default_branch=develop`; protected `develop@dd71e40a86385fb7861b0f1be19891a3f3e29ece` remains live default authority while product-line `main@ca6889497728e1a3f09d68790a9096576e13a3ff` remains outside the intended protected/default topology. Releases are empty. DDD root #39 remains exact `c063570bd9177578fa75be69defd81c99e6ba2f3`; Context Fabric/quarantine projection #40 is Draft exact `ce41036d3fdb0e9787485b4e3a7aaf135e602dfc`, stale against current #39. Its boundary keeps quarantine as canonical artifact-analysis runtime evidence and `Wardnet -> artifact_analysis_evidence` directional; `malware_verdict` and `artifact_risk_score` remain forbidden as authoritative EA facts. EA #45 owns governed external-capability portfolio mapping; EA #49 owns the eventual Wardnet outbound-reputation architecture projection. Mutable producer heads remain evidence only, never released authority. +EA Core likewise reports `default_branch=develop`; protected `develop@dd71e40a86385fb7861b0f1be19891a3f3e29ece` remains live default authority while product-line `main@ca6889497728e1a3f09d68790a9096576e13a3ff` remains outside the intended protected/default topology. Releases are empty and organization ruleset `18156473` remains active. DDD root #39 is exact `c063570bd9177578fa75be69defd81c99e6ba2f3`; Context Fabric/quarantine projection #40 has advanced to exact `9cea817b15a92710e0677d30e5103965b58f0699` but remains Draft/stale against its parent; tenant-GUC restoration #48 is exact `3fd334f71dfaa44ae7567fac4228cd883f4a1300` with source RED→GREEN but no exact-head workflow materialization. The #40 boundary keeps quarantine as canonical artifact-analysis runtime evidence and `Wardnet -> artifact_analysis_evidence` directional; `malware_verdict` and `artifact_risk_score` remain forbidden as authoritative EA facts. EA #45 owns governed external-capability portfolio mapping; EA #49 owns the eventual Wardnet outbound-reputation architecture projection. Mutable producer heads remain evidence only, never released authority. ## Buyer-visible gap order @@ -72,4 +72,4 @@ The USD 20 billion ambition is a product-quality bar, not a customer contract va Security and runtime decisions remain traceable to current authoritative NIST/OWASP/CWE/IETF/OCI/Linux sources and primary/peer-reviewed research where the implementation depends on them. Citation is design evidence, not proof that a control is shipped. Wardnet-owned production targets 100% statement/branch/edge-case coverage and complete public rustdoc/docstrings, with realistic bypass/replay/race/DoS/network/cleanup tests where applicable. -No Wardnet release is authorized at this snapshot. Release requires one exact integrated protected head with terminal current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact/source identity and a verified publication path. Feature-branch artifacts or attestations remain candidate evidence only. \ No newline at end of file +No Wardnet release is authorized at this snapshot. Release requires one exact integrated protected head with terminal current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact/source identity and a verified publication path. Feature-branch artifacts or attestations remain candidate evidence only. From 5d2ec78de46b3131da9b5c39e77b26f317e3d7d4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 07:45:48 +0900 Subject: [PATCH 66/73] docs(gaps): adopt current Context Graph head evidence --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 038f0554..f14c8b7e 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -58,7 +58,7 @@ PR #130 remains the sole writer for this file. Other Wardnet lanes hand exact ev ## Context Fabric read-only inventory -Context Graph Contracts still reports `default_branch=develop`. Protected `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` and unprotected byte-identical `main@99cb5468ba3c15c5e79688f53dee74724fae2d13` expose the unfinished default/protection transition; organization ruleset `18156473` is active and therefore still follows the live default topology. GitHub Releases remain empty. The intended dependency order remains `#4 -> #6 -> #7 -> #8 -> #12 -> #13 -> #14 -> #16 -> #17 -> #18 -> #19 -> #25 -> #20 -> #21`. Live dependency root #4 is `7503b7da50efcad8256e5b6d3214e438c829cd50`; current #25 is `10e5f4abc430437cfd15f79142703ac2b1fc612e`, #20 is `b04fa4f82bb2e8007dd5f1c660e305ffc286f1cb`, and #21 has advanced to `637aead5cd5e379fed4dca2c650a86b71ea895ac`. Root #4's fresh owner evidence still separates real defects from source truth: Semgrep is GREEN, Dependency Review failed closed on a GitHub 403 owned by `.github#810`, delegated CodeQL remains `.github#712`, and repository bootstrap workflows have not yet established immutable release authority. `context-graph-contracts#27` owns future external-capability artifact/evidence/admission/activation semantics. Branch topology/default/protection repair remains Context Fabric/central owner work, not a Wardnet or user decision. +Context Graph Contracts still reports `default_branch=develop`. Protected `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` and unprotected byte-identical `main@99cb5468ba3c15c5e79688f53dee74724fae2d13` expose the unfinished default/protection transition; organization ruleset `18156473` is active and therefore still follows the live default topology. GitHub Releases remain empty. The intended dependency order remains `#4 -> #6 -> #7 -> #8 -> #12 -> #13 -> #14 -> #16 -> #17 -> #18 -> #19 -> #25 -> #20 -> #21`. Live dependency root #4 is `7503b7da50efcad8256e5b6d3214e438c829cd50`; current #25 is `10e5f4abc430437cfd15f79142703ac2b1fc612e`, #20 is `b04fa4f82bb2e8007dd5f1c660e305ffc286f1cb`, and #21 has advanced to `b6826016d7ec2251e1ce96940e841c1ae8f23f49`. Root #4's fresh owner evidence still separates real defects from source truth: Semgrep is GREEN, Dependency Review failed closed on a GitHub 403 owned by `.github#810`, delegated CodeQL remains `.github#712`, and repository bootstrap workflows have not yet established immutable release authority. `context-graph-contracts#27` owns future external-capability artifact/evidence/admission/activation semantics. Branch topology/default/protection repair remains Context Fabric/central owner work, not a Wardnet or user decision. EA Core likewise reports `default_branch=develop`; protected `develop@dd71e40a86385fb7861b0f1be19891a3f3e29ece` remains live default authority while product-line `main@ca6889497728e1a3f09d68790a9096576e13a3ff` remains outside the intended protected/default topology. Releases are empty and organization ruleset `18156473` remains active. DDD root #39 is exact `c063570bd9177578fa75be69defd81c99e6ba2f3`; Context Fabric/quarantine projection #40 has advanced to exact `9cea817b15a92710e0677d30e5103965b58f0699` but remains Draft/stale against its parent; tenant-GUC restoration #48 is exact `3fd334f71dfaa44ae7567fac4228cd883f4a1300` with source RED→GREEN but no exact-head workflow materialization. The #40 boundary keeps quarantine as canonical artifact-analysis runtime evidence and `Wardnet -> artifact_analysis_evidence` directional; `malware_verdict` and `artifact_risk_score` remain forbidden as authoritative EA facts. EA #45 owns governed external-capability portfolio mapping; EA #49 owns the eventual Wardnet outbound-reputation architecture projection. Mutable producer heads remain evidence only, never released authority. From 48848711f80b107020b6ed2708d90583ff76da2b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 07:49:29 +0900 Subject: [PATCH 67/73] docs(gaps): bind actual Context Graph PR head --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index f14c8b7e..94295112 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -58,7 +58,7 @@ PR #130 remains the sole writer for this file. Other Wardnet lanes hand exact ev ## Context Fabric read-only inventory -Context Graph Contracts still reports `default_branch=develop`. Protected `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` and unprotected byte-identical `main@99cb5468ba3c15c5e79688f53dee74724fae2d13` expose the unfinished default/protection transition; organization ruleset `18156473` is active and therefore still follows the live default topology. GitHub Releases remain empty. The intended dependency order remains `#4 -> #6 -> #7 -> #8 -> #12 -> #13 -> #14 -> #16 -> #17 -> #18 -> #19 -> #25 -> #20 -> #21`. Live dependency root #4 is `7503b7da50efcad8256e5b6d3214e438c829cd50`; current #25 is `10e5f4abc430437cfd15f79142703ac2b1fc612e`, #20 is `b04fa4f82bb2e8007dd5f1c660e305ffc286f1cb`, and #21 has advanced to `b6826016d7ec2251e1ce96940e841c1ae8f23f49`. Root #4's fresh owner evidence still separates real defects from source truth: Semgrep is GREEN, Dependency Review failed closed on a GitHub 403 owned by `.github#810`, delegated CodeQL remains `.github#712`, and repository bootstrap workflows have not yet established immutable release authority. `context-graph-contracts#27` owns future external-capability artifact/evidence/admission/activation semantics. Branch topology/default/protection repair remains Context Fabric/central owner work, not a Wardnet or user decision. +Context Graph Contracts still reports `default_branch=develop`. Protected `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` and unprotected byte-identical `main@99cb5468ba3c15c5e79688f53dee74724fae2d13` expose the unfinished default/protection transition; organization ruleset `18156473` is active and therefore still follows the live default topology. GitHub Releases remain empty. The intended dependency order remains `#4 -> #6 -> #7 -> #8 -> #12 -> #13 -> #14 -> #16 -> #17 -> #18 -> #19 -> #25 -> #20 -> #21`. Live dependency root #4 is `7503b7da50efcad8256e5b6d3214e438c829cd50`; current #25 is `10e5f4abc430437cfd15f79142703ac2b1fc612e`, #20 is `b04fa4f82bb2e8007dd5f1c660e305ffc286f1cb`, and the actual #21 branch head is `243cb66452883c63a6ff2d7370534629db3a358e`. Its PR body still names predecessor `b6826016d7ec2251e1ce96940e841c1ae8f23f49` as current; exact owner handoff is recorded on CGC issue #15 and the later `243cb664...` TRD provenance delta must be adopted rather than overwritten. Root #4's fresh owner evidence still separates real defects from source truth: Semgrep is GREEN, Dependency Review failed closed on a GitHub 403 owned by `.github#810`, delegated CodeQL remains `.github#712`, and repository bootstrap workflows have not yet established immutable release authority. `context-graph-contracts#27` owns future external-capability artifact/evidence/admission/activation semantics. Branch topology/default/protection repair remains Context Fabric/central owner work, not a Wardnet or user decision. EA Core likewise reports `default_branch=develop`; protected `develop@dd71e40a86385fb7861b0f1be19891a3f3e29ece` remains live default authority while product-line `main@ca6889497728e1a3f09d68790a9096576e13a3ff` remains outside the intended protected/default topology. Releases are empty and organization ruleset `18156473` remains active. DDD root #39 is exact `c063570bd9177578fa75be69defd81c99e6ba2f3`; Context Fabric/quarantine projection #40 has advanced to exact `9cea817b15a92710e0677d30e5103965b58f0699` but remains Draft/stale against its parent; tenant-GUC restoration #48 is exact `3fd334f71dfaa44ae7567fac4228cd883f4a1300` with source RED→GREEN but no exact-head workflow materialization. The #40 boundary keeps quarantine as canonical artifact-analysis runtime evidence and `Wardnet -> artifact_analysis_evidence` directional; `malware_verdict` and `artifact_risk_score` remain forbidden as authoritative EA facts. EA #45 owns governed external-capability portfolio mapping; EA #49 owns the eventual Wardnet outbound-reputation architecture projection. Mutable producer heads remain evidence only, never released authority. From 3be6d5543f31215c7898fd8206ff7a7d4130f78b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 08:24:51 +0900 Subject: [PATCH 68/73] docs(gaps): record protected anti-bot merge and governance evidence --- docs/product-technical-gap-baseline.md | 35 +++++++++++++------------- 1 file changed, 18 insertions(+), 17 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 94295112..f6093421 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -12,13 +12,15 @@ Fresh GitHub release inventories remain empty for Wardnet, Context Graph Contrac ## Protected truth and control plane -Protected/default Wardnet truth remains `main@5829a0f08d78de464dd24393ce5d0f25fba9d126`, produced by protected merge #159. #159 is protected workflow-control truth: its CI/Fuzz/Scorecard pressure repair, explicit hosted-runner contract, `AGENTS.md` ownership guidance and workflow queue/runner regressions must be adopted by consumer lanes rather than copied or bypassed. +Protected/default Wardnet truth advanced through protected squash merge #171 to `main@a52ccd0a24a727d9349bb32def7713882d8cad1e`, whose verified parent is prior protected `5829a0f08d78de464dd24393ce5d0f25fba9d126`. #159 remains the protected workflow-control foundation: its CI/Fuzz/Scorecard pressure repair, explicit hosted-runner contract, `AGENTS.md` ownership guidance and workflow queue/runner regressions must be adopted by consumer lanes rather than copied or bypassed. #171 adds the protected bounded-context decision that browser acquisition/session/challenge/CAPTCHA handling stays outside Wardnet while destination maliciousness/reputation policy and security evidence remain Wardnet-owned; arbitrary metadata fetching must not be reintroduced into Wardnet, and required outbound retrieval must traverse a released EgressWeave authorization boundary or fail closed. -Organization ruleset `18156473` remains active on `~DEFAULT_BRANCH`. Fresh live policy still requires one generic approving review with no named required reviewer, requires review-thread resolution and central OpenCode/review-scheduler/Security/Strix/Semgrep/Noema/CodeQL workflows, blocks deletion/non-fast-forward, and exposes `OrganizationAdmin/always` bypass. Under the declared solo-maintainer model, self-approval and bot/model-as-human approval remain forbidden. `.github#772` owns replacement of only the structurally impossible approval deadlock/routine-bypass defect while deterministic security/coverage/SBOM/provenance/thread/branch-integrity controls remain or strengthen. +Organization ruleset `18156473` remains active on `~DEFAULT_BRANCH`. Fresh live policy still requires one generic approving review with no named required reviewer, requires review-thread resolution and central OpenCode/review-scheduler/Security/Strix/Semgrep/Noema/CodeQL workflows, blocks deletion/non-fast-forward, and exposes `OrganizationAdmin/always` bypass with the current principal reporting `current_user_can_bypass=always`. Under the declared solo-maintainer model, self-approval and bot/model-as-human approval remain forbidden. -Delegated model/code-analysis verdict execution and wake-up remain `.github#712` owner work. Two unchanged Wardnet canaries now narrow the defect beyond hosted-runner acquisition. On #129 exact `db921e7f855f52870b23de52a4e23f11ff996644`, CodeQL compatibility job `101354139576` acquired Ubuntu 24.04, completed OIDC and repository-scoped app-token exchange, successfully sent the exact `repository_dispatch`, then failed closed because no authenticated terminal `codeql-dispatch/actions` status appeared on that SHA. On #173 exact `a14b28a10ea87dbcc1939fe0fdca6ce5b02259ed`, required OpenCode job `101340969657` likewise acquired Ubuntu, completed bootstrap/admission/coverage evidence, OIDC/app-token exchange and dispatch, then failed closed because no authenticated exact-head `APPROVED` or `CHANGES_REQUESTED` verdict from `opencode-agent` appeared. These are central producer/status-publication/wake-path specimens, not reasons for Wardnet no-op commits, broad reruns or gate weakening. +#171 supplied a concrete governance defect specimen. Exact Ready head `d94a4a6207a0d3ea79547a57fb0a7c5f6b2b30d5` had no human `APPROVED` review, no `CHANGES_REQUESTED`, all inline threads resolved, and nine exact-head workflows terminal success. A standard expected-head squash merge call nevertheless succeeded and produced protected `a52ccd0...` while the ruleset still reported `required_approving_review_count=1` and `OrganizationAdmin/always`. Therefore an ordinary merge API call by this principal cannot be treated as proof that the approval gate is satisfiable without bypass. Exact evidence and acceptance criteria are recorded on `.github#772` comment `5555475361`: repair the solo-incompatible generic approval requirement while retaining deterministic workflows/thread/non-fast-forward/deletion controls, constrain routine administrator bypass, and make normal protected admission distinguishable from explicit emergency bypass. Wardnet will not use further merge calls merely to probe governance until that repair is live. -Current #167 exact `340f20b1898099bbf2b58a2a2cbd34c8f6057b35` has newly materialized CI/Fuzz/Security/Semgrep/CodeQL runs, all presently queued. That is non-passing evidence only; the branch already has a causal source RED and should not be churned to manufacture runner activity. +Delegated model/code-analysis verdict execution and wake-up remain `.github#712` owner work. On #129 exact `db921e7f855f52870b23de52a4e23f11ff996644`, CodeQL compatibility job `101354139576` acquired Ubuntu 24.04, completed OIDC and repository-scoped app-token exchange, successfully sent the exact `repository_dispatch`, then failed closed because no authenticated terminal `codeql-dispatch/actions` status appeared on that SHA. On #173 exact `a14b28a10ea87dbcc1939fe0fdca6ce5b02259ed`, required OpenCode job `101340969657` likewise acquired Ubuntu, completed bootstrap/admission/coverage evidence, OIDC/app-token exchange and dispatch, then failed closed because no authenticated exact-head `APPROVED` or `CHANGES_REQUESTED` verdict from `opencode-agent` appeared. These are central producer/status-publication/wake-path specimens, not reasons for Wardnet no-op commits, broad reruns or gate weakening. + +The runner/materialization class also remains live. #167's bounded temporary exact-head DNSBL-repair workflow run `33998138472` on `dac89ce0d07c4603c26daa570ed38ec57054eaad` is still queued with no executed source-test evidence at the latest read; its exact owner handoff is `.github#712` comment `5555453476`. Post-merge protected-main validation is likewise incomplete: a fresh lookup for `main@a52ccd0...` returned three push workflows, with Scorecard `33998430707` and CI `33998430723` explicitly still queued at the read. This protected-head specimen is on `.github#712` comment `5555481746`. Queued state is non-passing evidence, not release GREEN and not a reason for source churn. ## Agent Artifact Admission @@ -32,27 +34,26 @@ Current hostile TDD includes the PyPI hash-mode contradiction: RED `032d74e060e7 ## Immediate product/security lanes -- **#167 MISP admission + shared DNSBL snapshot ownership** — live branch/PR authority is exact `340f20b1898099bbf2b58a2a2cbd34c8f6057b35`, Draft/mergeable on current protected main. The retained MISP parser repair requires affirmative recognized `to_ids` evidence plus active lifecycle state at attribute and enclosing Object scope. A valid review finding then exposed a separate shared reconciler defect: `apply_threat_feed_import` reaps withdrawn `ThreatIndicator`s but historically only upserts DNSBL material. The DNSBL TDD lineage now includes corrected non-empty withdrawal fixtures, an async harness repair, restart/predecessor-state/persistence-rollback/retry REDs, an intentionally reverted raw-`IpAddr` schema attempt, and exact predecessor CI `33983682746`, which compiled and failed exactly stale withdrawal plus operator-owned overlap write/count while the shared-owner/operator-withdrawal cases passed. Current `340f20b...` corrects the predecessor-state hostile test to target the accepted future `operator_dnsbl_keys` field. Production GREEN remains absent. The shared control-plane fix requires a documented serializable/hashable `DnsblEntryKey` keyed only by `DnsblEntry.address`, serde-default feed/operator ownership, atomic threat+DNSBL snapshot reconciliation, operator-first ownership, no feed overwrite of operator payloads, reap only when no other feed/operator owns the key, actual-write `upserted_dnsbl` counts, and complete persistence/replay/idempotency rollback semantics. The valid review thread remains unresolved. Exact-current CI `33996187652`, Fuzz `33996187641`, Security `33996187499`, Semgrep `33996187565`, and CodeQL `33996187707` are queued/non-passing. -- **#170 MISP threat-level severity child** — exact child `7b383859257d2f317e0c40f68b3d8d706628ad9d`, Draft. It last non-force adopted #167 through parent `28d0ac12d37b4c97ea58b2d55831a6c1e7b9cf98`; live parent is now `340f20b...` because of the one-line predecessor-state RED correction. Preserve the unique three-file severity mapping (`1 -> High`, `2 -> Medium`, `3 -> Low`) and do not restack merely for transient parent test churn. After #167 reaches stable shared-reconciler GREEN, re-read every intervening parent delta and non-force adopt the complete parent lineage once, then reacquire all child exact-head gates. -- **#77 Rust toolchain/reproducibility foundation** — exact `d386d6f57e0c8de3e4839d6c61b593e41f9d7e20`, Ready/mergeable on protected main. CI `33907688502`, Security `33907688421`, and Semgrep `33907688360` are terminal success; its prior CodeQL result is delegated-control-plane evidence rather than toolchain-source GREEN. Child #164 stays Draft until #77 or a verified successor reaches protected truth and current delegated gates can be reacquired. -- **#166 Wardnet-local PR queue policy** — exact `13fc6a1b9b3f5af0b7c6acfb79de6c46fd72de3a`, Ready/mergeable. Repository CI `33954367435` and Fuzz `33954367424` are terminal success; central Security/Semgrep/CodeQL worker lanes remain non-passing owner-plane evidence already handed to `.github#712`. Ordinary queue wait is not bypass authority. -- **#173 outbound site reputation** — exact `a14b28a10ea87dbcc1939fe0fdca6ce5b02259ed`, Ready/mergeable and documentation-only. Repository CI `33949463493`, Security `33949463487`, Semgrep `33949463505`, CodeQL PR `33949463499`, and required review merge scheduler `33949463529` are terminal success. Required OpenCode run `33949463777` is terminal FAILURE only after its exact-head job acquired a real Ubuntu runner, completed bootstrap/admission/coverage evidence, OIDC/app-token exchange and dispatch, then received no authenticated exact-head model-review verdict. That current specimen is handed to `.github#712`; do not alter this docs head merely to redispatch. Live solo-maintainer governance also remains unsatisfied. Wardnet owns destination maliciousness/reputation evidence lifecycle, organizational admission policy and SOC accountability; EgressWeave remains authoritative for executable URL/address/DNS/peer/redirect/proxy/TLS/resource authorization. Production transport composition requires an immutable compatible EgressWeave Rust-consumer boundary; no mutable owner head qualifies. -- **#171 anti-bot acquisition boundary** — exact `d94a4a6207a0d3ea79547a57fb0a7c5f6b2b30d5`, Draft/mergeable and documentation-only. It preserves only the still-valid ownership delta: browser acquisition/session/challenge/CAPTCHA handling stays outside Wardnet, while #173 carries Wardnet-owned destination reputation. Arbitrary metadata fetching must not be reintroduced into Wardnet; required outbound retrieval must traverse a released EgressWeave authorization boundary or fail closed. -- **#155 management auth** — exact `f74ff25a321dfb1d7109719e2a1fc77e47dc4898`, Ready/mergeable on protected main. CI/Fuzz/Security/Semgrep are terminal success; its prior CodeQL failure is central delegated-verdict evidence, not an auth source finding. The feature fails closed before readiness when a non-loopback listener lacks a write-capable administrator credential. -- **#93 deterministic persistence failure injection** — exact `4775abc66e5350bdbf07ccefca74c10ddb03701a`, aligned with protected main. The deterministic write-temp/rename fault seam remains the owner-correct replacement for permission-dependent failure injection. Its prior CodeQL failure belongs to the same central delegated-verdict class; re-read all exact-current gates only after the owner plane can issue a current verdict. -- **#140 Runtime Configuration** — canonical supporting-boundary owner at exact `054c11aafe835e497d6149efb09f1ccdee9d03bd`, aligned with current protected main. Hostile RED `0f22aaff...` rejects zero positive bounds; causal repair `d28a0119...` fixes the positive-u64 bootstrap parser while preserving the distinct `RATE_LIMIT=0` disable semantic. Feature lanes must adopt #140 rather than create a competing process-environment authority. +- **#167 MISP admission + shared DNSBL snapshot ownership** — live branch head has advanced from the retained causal RED source head `340f20b1898099bbf2b58a2a2cbd34c8f6057b35` to exact `dac89ce0d07c4603c26daa570ed38ec57054eaad` solely to stage a bounded self-removing repair workflow after the first workflow-YAML attempt failed to parse. The valid CodeRabbit finding remains: `apply_threat_feed_import` reaps withdrawn `ThreatIndicator`s but historically only upserts DNSBL material. Hostile integration tests cover stale withdrawal, shared feed ownership, operator ownership/overwrite, restart/predecessor serde, persistence rollback/retry and actual-write counting. The planned causal GREEN uses stable `DnsblEntryKey(DnsblEntry.address)`, serde-default feed/operator ownership, atomic threat+DNSBL snapshot reconciliation, operator-first ownership, no feed overwrite of operator payloads, reap only when no other feed/operator owns the key, and actual-write `upserted_dnsbl` counts. Temporary workflow `wardnet-dnsbl-repair.yml` pins the triggering SHA, refuses a stale parent, applies only that repair, runs workspace tests and strict Clippy, verifies the source-only delta, deletes itself, and non-force pushes only if the branch head is unchanged. Run `33998138472` is queued, so production GREEN is not yet established and the valid review thread remains intentionally unresolved. +- **#170 MISP threat-level severity child** — exact child `7b383859257d2f317e0c40f68b3d8d706628ad9d`, Draft. It last non-force adopted #167 through parent `28d0ac12d37b4c97ea58b2d55831a6c1e7b9cf98`. Do not churn this child through the temporary #167 repair-workflow commits. After #167 reaches stable shared-reconciler GREEN, re-read every intervening parent delta and non-force adopt the complete causal parent lineage once, then prove the child still differs only by the three-file severity mapping and reacquire all child exact-head gates. +- **#77 Rust toolchain/reproducibility foundation** — exact `d386d6f57e0c8de3e4839d6c61b593e41f9d7e20`, Ready on its source head. CI `33907688502`, Security `33907688421`, and Semgrep `33907688360` are terminal success; prior CodeQL is delegated-control-plane evidence rather than toolchain-source GREEN. Protected main has since advanced by the orthogonal #171 documentation decision, so fresh candidate-base compatibility remains required. Child #164 stays Draft until #77 or a verified successor reaches protected truth and current delegated gates can be reacquired. +- **#166 Wardnet-local PR queue policy** — exact `13fc6a1b9b3f5af0b7c6acfb79de6c46fd72de3a`, Ready on its source head. Repository CI `33954367435` and Fuzz `33954367424` are terminal success; central Security/Semgrep/CodeQL worker lanes remain non-passing owner-plane evidence already handed to `.github#712`. Protected main has since advanced, and ordinary queue wait or base drift is not bypass authority. +- **#173 outbound site reputation** — exact `a14b28a10ea87dbcc1939fe0fdca6ce5b02259ed`, Ready and documentation-only. After #171 advanced protected main to `a52ccd0...`, GitHub freshly recomputed this unchanged head as mergeable and its four-file reputation delta does not overlap #171's two-file anti-bot ADR/index delta. Repository CI `33949463493`, Security `33949463487`, Semgrep `33949463505`, CodeQL PR `33949463499`, and required review merge scheduler `33949463529` are terminal success on the source head but predate the protected-base movement and are not final candidate-base evidence. Required OpenCode run `33949463777` is terminal FAILURE because no authenticated exact-head model-review verdict arrived after successful dispatch. That owner defect remains on `.github#712`. Wardnet owns destination maliciousness/reputation evidence lifecycle, organizational admission policy and SOC accountability; EgressWeave remains authoritative for executable URL/address/DNS/peer/redirect/proxy/TLS/resource authorization. Production transport composition requires an immutable compatible EgressWeave Rust-consumer boundary; no mutable owner head qualifies. Further merge calls are paused until `.github#772` removes the silent routine-bypass ambiguity. +- **#155 management auth** — exact `f74ff25a321dfb1d7109719e2a1fc77e47dc4898`. CI/Fuzz/Security/Semgrep are terminal success on that source head; its prior CodeQL failure is central delegated-verdict evidence, not an auth source finding. The feature fails closed before readiness when a non-loopback listener lacks a write-capable administrator credential. Fresh candidate-base compatibility is required after #171. +- **#93 deterministic persistence failure injection** — exact `4775abc66e5350bdbf07ccefca74c10ddb03701a`. The deterministic write-temp/rename fault seam remains the owner-correct replacement for permission-dependent failure injection. Its prior CodeQL failure belongs to the same central delegated-verdict class; re-read all exact-current gates and current-base compatibility only after the owner plane can issue a current verdict. +- **#140 Runtime Configuration** — canonical supporting-boundary owner at exact `054c11aafe835e497d6149efb09f1ccdee9d03bd`. Hostile RED `0f22aaff...` rejects zero positive bounds; causal repair `d28a0119...` fixes the positive-u64 bootstrap parser while preserving the distinct `RATE_LIMIT=0` disable semantic. Feature lanes must adopt #140 rather than create a competing process-environment authority. Its source head predates #171 and therefore needs fresh base compatibility before integration. - **#157/#165 trusted client attribution** — #165 remains the current production feature owner at exact `99581e056645e98e866157443a6732a4bbd729c4`; #157 is a preservation lane for unique trusted-proxy fuzz/corpus/invariant evidence. #165 must adopt #140 after that foundation reaches protected truth and prove complete #157 evidence transfer before #157 can retire. - **#135 bounded local limiter** — exact `fb24394308ccdc835cce344b7e945f5537e99756`; repository-owned CI/Fuzz are terminal success while central Security/Semgrep/CodeQL remain non-passing. Its local cardinality/rate-limit contract remains separate from #165 trusted-proxy attribution and any future distributed quota authority. - **#136 outbound policy** — preservation Draft only. Keep Wardnet-owned purpose/call-site/deadline/evidence hostile tests, but do not integrate the local destination/DNS/redirect/proxy/TLS policy implementation. EgressWeave issue #237 owns an immutable Rust-consumable provider-neutral authorization/evidence boundary; current mutable work is not release authority. - **#115 official threat-source refresh** — preservation Draft. Preserve Wardnet-owned source registry/parser/conditional-validator/last-known-good/SOC evidence delta, but reconstruct outbound authorization through a released EgressWeave port/ACL rather than retaining local reusable egress authority. - **#88 contextual-orchestrator consumer** — architecture-gated preservation. Preserve unique fail-closed credential/header/streaming negative evidence, remove LiteLLM/provider-routing/virtual-key ownership when reconstructing, and consume only a released CO API/client/schema/Agent boundary. Mutable CO source is not production authority. - **#164 release evidence** — Draft stacked on #77. It separates PR build/SBOM evidence from protected-main OIDC attestation authority. Do not publish from a feature branch; after the Rust/toolchain parent is protected truth, restack on fresh main and reacquire exact-head package/SBOM/provenance/reproducibility evidence. -- **#127 material UI/a11y** — exact `35f4b7a261c15f4549f8e77f40688adc4bb501b0`, aligned with protected main and intentionally Draft. Before Ready it still requires production-like browser E2E for keyboard skip/focus, accessible names/descriptions, KPI live-region behavior, responsive widths, and applicable normal/loading/error/permission states; source-string tests alone are not WCAG 2.2 AA evidence. +- **#127 material UI/a11y** — exact `35f4b7a261c15f4549f8e77f40688adc4bb501b0`, intentionally Draft. Before Ready it still requires production-like browser E2E for keyboard skip/focus, accessible names/descriptions, KPI live-region behavior, responsive widths, and applicable normal/loading/error/permission states; source-string tests alone are not WCAG 2.2 AA evidence. The source head predates #171, so current-base browser evidence must be reacquired when this lane resumes. - **#90 SIEM/OpenTelemetry preservation** — exact `2d251183c41f49b07d443ff15fe9e54472d90f63`, Draft/non-mergeable mixed aggregate branch. Preserve its unique Wardnet-owned OCSF/OTLP/RFC 5424 exporter/input/fuzz/security evidence through a bounded successor from fresh protected main; do not inherit stale `.github`, generic architecture/changelog, product-gap or other owner surfaces wholesale. Close only after complete verified successor transfer. ## Open PR inventory and single-writer discipline -Fresh search returns 30 open Wardnet PR lanes: `#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #155, #156, #157, #158, #162, #164, #165, #166, #167, #170, #171, #173`. #159 is excluded because it is protected-main truth. +Fresh search after protected merge #171 returns 29 open Wardnet PR lanes: `#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #155, #156, #157, #158, #162, #164, #165, #166, #167, #170, #173`. #159 and #171 are excluded because they are protected-main truth. PR #130 remains the sole writer for this file. Other Wardnet lanes hand exact evidence into #130 rather than editing this path. PR retirement still requires protected merge, explicit user instruction, malicious/no-valid delta, or verified complete successor transfer of every useful code/test/fixture/contract/evidence delta. @@ -60,7 +61,7 @@ PR #130 remains the sole writer for this file. Other Wardnet lanes hand exact ev Context Graph Contracts still reports `default_branch=develop`. Protected `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` and unprotected byte-identical `main@99cb5468ba3c15c5e79688f53dee74724fae2d13` expose the unfinished default/protection transition; organization ruleset `18156473` is active and therefore still follows the live default topology. GitHub Releases remain empty. The intended dependency order remains `#4 -> #6 -> #7 -> #8 -> #12 -> #13 -> #14 -> #16 -> #17 -> #18 -> #19 -> #25 -> #20 -> #21`. Live dependency root #4 is `7503b7da50efcad8256e5b6d3214e438c829cd50`; current #25 is `10e5f4abc430437cfd15f79142703ac2b1fc612e`, #20 is `b04fa4f82bb2e8007dd5f1c660e305ffc286f1cb`, and the actual #21 branch head is `243cb66452883c63a6ff2d7370534629db3a358e`. Its PR body still names predecessor `b6826016d7ec2251e1ce96940e841c1ae8f23f49` as current; exact owner handoff is recorded on CGC issue #15 and the later `243cb664...` TRD provenance delta must be adopted rather than overwritten. Root #4's fresh owner evidence still separates real defects from source truth: Semgrep is GREEN, Dependency Review failed closed on a GitHub 403 owned by `.github#810`, delegated CodeQL remains `.github#712`, and repository bootstrap workflows have not yet established immutable release authority. `context-graph-contracts#27` owns future external-capability artifact/evidence/admission/activation semantics. Branch topology/default/protection repair remains Context Fabric/central owner work, not a Wardnet or user decision. -EA Core likewise reports `default_branch=develop`; protected `develop@dd71e40a86385fb7861b0f1be19891a3f3e29ece` remains live default authority while product-line `main@ca6889497728e1a3f09d68790a9096576e13a3ff` remains outside the intended protected/default topology. Releases are empty and organization ruleset `18156473` remains active. DDD root #39 is exact `c063570bd9177578fa75be69defd81c99e6ba2f3`; Context Fabric/quarantine projection #40 has advanced to exact `9cea817b15a92710e0677d30e5103965b58f0699` but remains Draft/stale against its parent; tenant-GUC restoration #48 is exact `3fd334f71dfaa44ae7567fac4228cd883f4a1300` with source RED→GREEN but no exact-head workflow materialization. The #40 boundary keeps quarantine as canonical artifact-analysis runtime evidence and `Wardnet -> artifact_analysis_evidence` directional; `malware_verdict` and `artifact_risk_score` remain forbidden as authoritative EA facts. EA #45 owns governed external-capability portfolio mapping; EA #49 owns the eventual Wardnet outbound-reputation architecture projection. Mutable producer heads remain evidence only, never released authority. +EA Core likewise reports `default_branch=develop`; protected `develop@dd71e40a86385fb7861b0f1be19891a3f3e29ece` remains live default authority while product-line `main@ca6889497728e1a3f09d68790a9096576e13a3ff` remains outside the intended protected/default topology. Releases are empty and organization ruleset `18156473` remains active. DDD root #39 is exact `c063570bd9177578fa75be69defd81c99e6ba2f3`; Context Fabric/quarantine projection #40 is exact `9cea817b15a92710e0677d30e5103965b58f0699` but remains Draft/stale against its parent; tenant-GUC restoration #48 is exact `3fd334f71dfaa44ae7567fac4228cd883f4a1300` with source RED→GREEN but no exact-head workflow materialization. The #40 boundary keeps quarantine as canonical artifact-analysis runtime evidence and `Wardnet -> artifact_analysis_evidence` directional; `malware_verdict` and `artifact_risk_score` remain forbidden as authoritative EA facts. EA #45 owns governed external-capability portfolio mapping; EA #49 owns the eventual Wardnet outbound-reputation architecture projection. Mutable producer heads remain evidence only, never released authority. ## Buyer-visible gap order @@ -72,4 +73,4 @@ The USD 20 billion ambition is a product-quality bar, not a customer contract va Security and runtime decisions remain traceable to current authoritative NIST/OWASP/CWE/IETF/OCI/Linux sources and primary/peer-reviewed research where the implementation depends on them. Citation is design evidence, not proof that a control is shipped. Wardnet-owned production targets 100% statement/branch/edge-case coverage and complete public rustdoc/docstrings, with realistic bypass/replay/race/DoS/network/cleanup tests where applicable. -No Wardnet release is authorized at this snapshot. Release requires one exact integrated protected head with terminal current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact/source identity and a verified publication path. Feature-branch artifacts or attestations remain candidate evidence only. +No Wardnet release is authorized at this snapshot. Release requires one exact integrated protected head with terminal current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact/source identity and a verified publication path. Protected `main@a52ccd0...` is documentation truth but not release-ready while its post-merge push workflows remain non-terminal. Feature-branch artifacts or attestations remain candidate evidence only. \ No newline at end of file From 4bc9f1a8a546ca47a4771ed5a61ad2effa14bd29 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 09:33:22 +0900 Subject: [PATCH 69/73] docs(gaps): record DNSBL GREEN and current control plane --- docs/product-technical-gap-baseline.md | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index f6093421..6697ede4 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -12,19 +12,19 @@ Fresh GitHub release inventories remain empty for Wardnet, Context Graph Contrac ## Protected truth and control plane -Protected/default Wardnet truth advanced through protected squash merge #171 to `main@a52ccd0a24a727d9349bb32def7713882d8cad1e`, whose verified parent is prior protected `5829a0f08d78de464dd24393ce5d0f25fba9d126`. #159 remains the protected workflow-control foundation: its CI/Fuzz/Scorecard pressure repair, explicit hosted-runner contract, `AGENTS.md` ownership guidance and workflow queue/runner regressions must be adopted by consumer lanes rather than copied or bypassed. #171 adds the protected bounded-context decision that browser acquisition/session/challenge/CAPTCHA handling stays outside Wardnet while destination maliciousness/reputation policy and security evidence remain Wardnet-owned; arbitrary metadata fetching must not be reintroduced into Wardnet, and required outbound retrieval must traverse a released EgressWeave authorization boundary or fail closed. +Protected/default Wardnet truth remains protected squash merge #171 at `main@a52ccd0a24a727d9349bb32def7713882d8cad1e`, whose verified parent is prior protected `5829a0f08d78de464dd24393ce5d0f25fba9d126`. #159 remains the protected workflow-control foundation: its CI/Fuzz/Scorecard pressure repair, explicit hosted-runner contract, `AGENTS.md` ownership guidance and workflow queue/runner regressions must be adopted by consumer lanes rather than copied or bypassed. #171 adds the protected bounded-context decision that browser acquisition/session/challenge/CAPTCHA handling stays outside Wardnet while destination maliciousness/reputation policy and security evidence remain Wardnet-owned; arbitrary metadata fetching must not be reintroduced into Wardnet, and required outbound retrieval must traverse a released EgressWeave authorization boundary or fail closed. -Organization ruleset `18156473` remains active on `~DEFAULT_BRANCH`. Fresh live policy still requires one generic approving review with no named required reviewer, requires review-thread resolution and central OpenCode/review-scheduler/Security/Strix/Semgrep/Noema/CodeQL workflows, blocks deletion/non-fast-forward, and exposes `OrganizationAdmin/always` bypass with the current principal reporting `current_user_can_bypass=always`. Under the declared solo-maintainer model, self-approval and bot/model-as-human approval remain forbidden. +Organization ruleset `18156473` remains active on `~DEFAULT_BRANCH`. Fresh owner evidence still records one generic approving review with no named required reviewer, review-thread resolution plus deterministic central workflow gates, deletion/non-fast-forward protection, and `OrganizationAdmin/always` bypass with the current principal able to bypass. Under the declared solo-maintainer model, self-approval and bot/model-as-human approval remain forbidden. -#171 supplied a concrete governance defect specimen. Exact Ready head `d94a4a6207a0d3ea79547a57fb0a7c5f6b2b30d5` had no human `APPROVED` review, no `CHANGES_REQUESTED`, all inline threads resolved, and nine exact-head workflows terminal success. A standard expected-head squash merge call nevertheless succeeded and produced protected `a52ccd0...` while the ruleset still reported `required_approving_review_count=1` and `OrganizationAdmin/always`. Therefore an ordinary merge API call by this principal cannot be treated as proof that the approval gate is satisfiable without bypass. Exact evidence and acceptance criteria are recorded on `.github#772` comment `5555475361`: repair the solo-incompatible generic approval requirement while retaining deterministic workflows/thread/non-fast-forward/deletion controls, constrain routine administrator bypass, and make normal protected admission distinguishable from explicit emergency bypass. Wardnet will not use further merge calls merely to probe governance until that repair is live. +#171 supplied the concrete governance defect specimen. Exact Ready head `d94a4a6207a0d3ea79547a57fb0a7c5f6b2b30d5` had no human `APPROVED` review, no `CHANGES_REQUESTED`, all inline threads resolved, and nine exact-head workflows terminal success. A standard expected-head squash merge call nevertheless succeeded and produced protected `a52ccd0...` while the ruleset still reported `required_approving_review_count=1` and `OrganizationAdmin/always`. Therefore an ordinary merge API call by this principal cannot be treated as proof that the approval gate is satisfiable without bypass. Exact evidence and acceptance criteria remain on `.github#772` comment `5555475361`: repair the solo-incompatible generic approval requirement while retaining deterministic workflows/thread/non-fast-forward/deletion controls, constrain routine administrator bypass, and make normal protected admission distinguishable from explicit emergency bypass. Wardnet will not use further merge calls merely to probe governance until that repair is live. -Delegated model/code-analysis verdict execution and wake-up remain `.github#712` owner work. On #129 exact `db921e7f855f52870b23de52a4e23f11ff996644`, CodeQL compatibility job `101354139576` acquired Ubuntu 24.04, completed OIDC and repository-scoped app-token exchange, successfully sent the exact `repository_dispatch`, then failed closed because no authenticated terminal `codeql-dispatch/actions` status appeared on that SHA. On #173 exact `a14b28a10ea87dbcc1939fe0fdca6ce5b02259ed`, required OpenCode job `101340969657` likewise acquired Ubuntu, completed bootstrap/admission/coverage evidence, OIDC/app-token exchange and dispatch, then failed closed because no authenticated exact-head `APPROVED` or `CHANGES_REQUESTED` verdict from `opencode-agent` appeared. These are central producer/status-publication/wake-path specimens, not reasons for Wardnet no-op commits, broad reruns or gate weakening. +Delegated model/code-analysis verdict execution remains a central owner path. `.github#1932` has merged the comma-separated trusted-dispatcher parser across OpenCode, CodeQL and review-fix consumers as `6f8c51d7389c22ebaf294fe8fe9ef495257883c0`; `.github#1926` has separately repaired CodeQL's array-valued matrix binding as `3f88e13af9dcde4b9da6958c02a78ce3b5c85800`. Neither source repair proves the live authorization setting is reconciled. A fresh post-repair CodeQL repository-dispatch on central protected `.github/main@fe827e133e7d867015d088777553e22736344c55`, run `33997332726`, was emitted by `opencode-agent[bot]`, acquired Ubuntu and exchanged the app token, then failed in `validate-dispatch` before scan execution. `.github#1929` therefore remains the causal owner path: the live trusted-dispatcher setting must represent exactly the proven `github-actions[bot]` scheduler identity and `opencode-agent[bot]` app identity while preserving actor==sender, exact repository/PR/head binding and fail-closed rejection of unlisted or mismatched identities. Do not churn Wardnet heads or broaden the leaf gate to compensate. -The runner/materialization class also remains live. #167's bounded temporary exact-head DNSBL-repair workflow run `33998138472` on `dac89ce0d07c4603c26daa570ed38ec57054eaad` is still queued with no executed source-test evidence at the latest read; its exact owner handoff is `.github#712` comment `5555453476`. Post-merge protected-main validation is likewise incomplete: a fresh lookup for `main@a52ccd0...` returned three push workflows, with Scorecard `33998430707` and CI `33998430723` explicitly still queued at the read. This protected-head specimen is on `.github#712` comment `5555481746`. Queued state is non-passing evidence, not release GREEN and not a reason for source churn. +Protected-main push validation has partially converged without source churn. On exact `main@a52ccd0...`, CI `33998430723` is terminal success and dynamic CodeQL push run `33998430384` is terminal success; Scorecard `33998430707` remains queued. The exact protected head is therefore still not release GREEN. Queued state remains `.github#712` control-plane evidence and is not authority for no-op commits, rerun storms or gate weakening. ## Agent Artifact Admission -PR #129 is exact `db921e7f855f52870b23de52a4e23f11ff996644`, mergeable but intentionally Draft. Four exact-current repository/security lanes are terminal GREEN without source churn: CI `33977431401`, Fuzz `33977431523`, Security Scan `33977431400`, and SAST Semgrep `33977431547`. CodeQL PR `33977431418` is terminal FAILURE only because the successfully dispatched exact-head delegated verdict remained pending; the causal owner handoff is recorded on `.github#712`. Combined commit status still lacks the required authenticated `codeql-dispatch/actions` terminal status. Preserve the four GREEN lanes and reacquire only the failed/required delegated lane after the central owner path can publish and wake an exact-head verdict. +PR #129 is exact `db921e7f855f52870b23de52a4e23f11ff996644`, mergeable but intentionally Draft. Four exact-current repository/security lanes are terminal GREEN without source churn: CI `33977431401`, Fuzz `33977431523`, Security Scan `33977431400`, and SAST Semgrep `33977431547`. CodeQL PR `33977431418` is terminal FAILURE only because the successfully dispatched exact-head delegated verdict remained pending; the causal owner handoff is recorded on the central control-plane path. Combined commit status still lacks the required authenticated `codeql-dispatch/actions` terminal status. Preserve the four GREEN lanes and reacquire only the failed/required delegated lane after the central owner path can publish and wake an exact-head verdict. The bounded context is pre-execution structured installer security admission only. It binds reviewed workspace manifest/artifact identity, exact ecosystem/name/version/registry/owner/SHA-256, executable family, declared operands, policy revision and bounded provenance; it does not fetch, decrypt, install, execute, isolate, activate or route workloads. An `allow` receipt is admission authority, not downloaded-byte proof or runtime activation. @@ -34,11 +34,11 @@ Current hostile TDD includes the PyPI hash-mode contradiction: RED `032d74e060e7 ## Immediate product/security lanes -- **#167 MISP admission + shared DNSBL snapshot ownership** — live branch head has advanced from the retained causal RED source head `340f20b1898099bbf2b58a2a2cbd34c8f6057b35` to exact `dac89ce0d07c4603c26daa570ed38ec57054eaad` solely to stage a bounded self-removing repair workflow after the first workflow-YAML attempt failed to parse. The valid CodeRabbit finding remains: `apply_threat_feed_import` reaps withdrawn `ThreatIndicator`s but historically only upserts DNSBL material. Hostile integration tests cover stale withdrawal, shared feed ownership, operator ownership/overwrite, restart/predecessor serde, persistence rollback/retry and actual-write counting. The planned causal GREEN uses stable `DnsblEntryKey(DnsblEntry.address)`, serde-default feed/operator ownership, atomic threat+DNSBL snapshot reconciliation, operator-first ownership, no feed overwrite of operator payloads, reap only when no other feed/operator owns the key, and actual-write `upserted_dnsbl` counts. Temporary workflow `wardnet-dnsbl-repair.yml` pins the triggering SHA, refuses a stale parent, applies only that repair, runs workspace tests and strict Clippy, verifies the source-only delta, deletes itself, and non-force pushes only if the branch head is unchanged. Run `33998138472` is queued, so production GREEN is not yet established and the valid review thread remains intentionally unresolved. -- **#170 MISP threat-level severity child** — exact child `7b383859257d2f317e0c40f68b3d8d706628ad9d`, Draft. It last non-force adopted #167 through parent `28d0ac12d37b4c97ea58b2d55831a6c1e7b9cf98`. Do not churn this child through the temporary #167 repair-workflow commits. After #167 reaches stable shared-reconciler GREEN, re-read every intervening parent delta and non-force adopt the complete causal parent lineage once, then prove the child still differs only by the three-file severity mapping and reacquire all child exact-head gates. +- **#167 MISP admission + shared DNSBL snapshot ownership** — exact current Draft head is `0c83cd5956f512d79c6600e823fcfa6d6f32af4e` on protected `main@a52ccd0...`. The shared DNSBL ownership finding has reached causal production-source GREEN instead of remaining a planned repair. Temporary run `34000662730` executed the repaired Rust working tree: all locked workspace tests passed, including stale-withdrawal, shared-feed, operator-overwrite/count, restart and persistence rollback/retry cases, and strict workspace Clippy passed. Source repair `7042aa19267886e3af9c378dddd879929837877b` adds stable `DnsblEntryKey(address)`, serde-default feed/operator ownership, shared snapshot reconciliation, operator payload preservation, conditional stale reaping and actual-write accounting; the valid DNSBL review thread was resolved against that implementation. Temporary restack run `34000892973` then pinned both refs, non-force adopted protected `main@a52ccd0...`, ran the full locked workspace tests and strict Clippy GREEN, removed the temporary workflow and pushed merge commit `d8b452cf1d609bb6e9c9a8a33f265c0a32dce7c9`. Current `0c83cd...` is the code-current doctoring child. Exact-current standard gates remain non-passing: CI `34000987921`, Fuzz `34000988028`, Security Scan `34000987843` and CodeQL PR `34000987911` are queued while SAST Semgrep `34000987891` is pending. Keep Draft until current-head gates and governance are terminal-valid; do not promote temporary-workflow GREEN to merge evidence. +- **#170 MISP threat-level severity child** — exact current child `2c8d499a5772b0be64d7cc3fc42ed2825ba1499e`, Draft, based on exact parent `0c83cd5956f512d79c6600e823fcfa6d6f32af4e`. Causal restack run `34001140916` pinned child and parent, non-force merged the complete parent lineage, formatted only the expected severity code/test files under the pinned toolchain, ran the full locked workspace tests and strict Clippy GREEN, removed its temporary workflow, and proved the effective child-versus-parent delta remains exactly `docs/doctoring/misp-threat-level-severity.md`, `src/misp_import.rs` and `tests/misp_threat_level_severity.rs`. Current child CI `34001236320` is queued and Fuzz `34001236319` is pending. Parent #167 must first reach protected truth; no parent check or temporary-restack result transfers to the child final gate. - **#77 Rust toolchain/reproducibility foundation** — exact `d386d6f57e0c8de3e4839d6c61b593e41f9d7e20`, Ready on its source head. CI `33907688502`, Security `33907688421`, and Semgrep `33907688360` are terminal success; prior CodeQL is delegated-control-plane evidence rather than toolchain-source GREEN. Protected main has since advanced by the orthogonal #171 documentation decision, so fresh candidate-base compatibility remains required. Child #164 stays Draft until #77 or a verified successor reaches protected truth and current delegated gates can be reacquired. -- **#166 Wardnet-local PR queue policy** — exact `13fc6a1b9b3f5af0b7c6acfb79de6c46fd72de3a`, Ready on its source head. Repository CI `33954367435` and Fuzz `33954367424` are terminal success; central Security/Semgrep/CodeQL worker lanes remain non-passing owner-plane evidence already handed to `.github#712`. Protected main has since advanced, and ordinary queue wait or base drift is not bypass authority. -- **#173 outbound site reputation** — exact `a14b28a10ea87dbcc1939fe0fdca6ce5b02259ed`, Ready and documentation-only. After #171 advanced protected main to `a52ccd0...`, GitHub freshly recomputed this unchanged head as mergeable and its four-file reputation delta does not overlap #171's two-file anti-bot ADR/index delta. Repository CI `33949463493`, Security `33949463487`, Semgrep `33949463505`, CodeQL PR `33949463499`, and required review merge scheduler `33949463529` are terminal success on the source head but predate the protected-base movement and are not final candidate-base evidence. Required OpenCode run `33949463777` is terminal FAILURE because no authenticated exact-head model-review verdict arrived after successful dispatch. That owner defect remains on `.github#712`. Wardnet owns destination maliciousness/reputation evidence lifecycle, organizational admission policy and SOC accountability; EgressWeave remains authoritative for executable URL/address/DNS/peer/redirect/proxy/TLS/resource authorization. Production transport composition requires an immutable compatible EgressWeave Rust-consumer boundary; no mutable owner head qualifies. Further merge calls are paused until `.github#772` removes the silent routine-bypass ambiguity. +- **#166 Wardnet-local PR queue policy** — exact `13fc6a1b9b3f5af0b7c6acfb79de6c46fd72de3a`, Ready on its source head. Repository CI `33954367435` and Fuzz `33954367424` are terminal success; central Security/Semgrep/CodeQL worker lanes remain non-passing owner-plane evidence already handed to the central control plane. Protected main has since advanced, and ordinary queue wait or base drift is not bypass authority. +- **#173 outbound site reputation** — exact `a14b28a10ea87dbcc1939fe0fdca6ce5b02259ed`, Ready and documentation-only. After #171 advanced protected main to `a52ccd0...`, GitHub recomputed this unchanged head as mergeable and its four-file reputation delta does not overlap #171's two-file anti-bot ADR/index delta. Repository CI `33949463493`, Security `33949463487`, Semgrep `33949463505`, CodeQL PR `33949463499`, and required review merge scheduler `33949463529` are terminal success on the source head but predate the protected-base movement and are not final candidate-base evidence. Required OpenCode run `33949463777` is terminal FAILURE because no authenticated exact-head model-review verdict arrived after successful dispatch. Wardnet owns destination maliciousness/reputation evidence lifecycle, organizational admission policy and SOC accountability; EgressWeave remains authoritative for executable URL/address/DNS/peer/redirect/proxy/TLS/resource authorization. Production transport composition requires an immutable compatible EgressWeave Rust-consumer boundary; no mutable owner head qualifies. Further merge calls are paused until `.github#772` removes the silent routine-bypass ambiguity. - **#155 management auth** — exact `f74ff25a321dfb1d7109719e2a1fc77e47dc4898`. CI/Fuzz/Security/Semgrep are terminal success on that source head; its prior CodeQL failure is central delegated-verdict evidence, not an auth source finding. The feature fails closed before readiness when a non-loopback listener lacks a write-capable administrator credential. Fresh candidate-base compatibility is required after #171. - **#93 deterministic persistence failure injection** — exact `4775abc66e5350bdbf07ccefca74c10ddb03701a`. The deterministic write-temp/rename fault seam remains the owner-correct replacement for permission-dependent failure injection. Its prior CodeQL failure belongs to the same central delegated-verdict class; re-read all exact-current gates and current-base compatibility only after the owner plane can issue a current verdict. - **#140 Runtime Configuration** — canonical supporting-boundary owner at exact `054c11aafe835e497d6149efb09f1ccdee9d03bd`. Hostile RED `0f22aaff...` rejects zero positive bounds; causal repair `d28a0119...` fixes the positive-u64 bootstrap parser while preserving the distinct `RATE_LIMIT=0` disable semantic. Feature lanes must adopt #140 rather than create a competing process-environment authority. Its source head predates #171 and therefore needs fresh base compatibility before integration. @@ -73,4 +73,4 @@ The USD 20 billion ambition is a product-quality bar, not a customer contract va Security and runtime decisions remain traceable to current authoritative NIST/OWASP/CWE/IETF/OCI/Linux sources and primary/peer-reviewed research where the implementation depends on them. Citation is design evidence, not proof that a control is shipped. Wardnet-owned production targets 100% statement/branch/edge-case coverage and complete public rustdoc/docstrings, with realistic bypass/replay/race/DoS/network/cleanup tests where applicable. -No Wardnet release is authorized at this snapshot. Release requires one exact integrated protected head with terminal current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact/source identity and a verified publication path. Protected `main@a52ccd0...` is documentation truth but not release-ready while its post-merge push workflows remain non-terminal. Feature-branch artifacts or attestations remain candidate evidence only. \ No newline at end of file +No Wardnet release is authorized at this snapshot. Release requires one exact integrated protected head with terminal current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact/source identity and a verified publication path. Protected `main@a52ccd0...` is documentation truth but not release-ready: its CI and dynamic CodeQL push validations are GREEN, yet Scorecard `33998430707` remains queued, governance normal-vs-bypass admission remains unresolved, GitHub Releases is empty, and multiple mandatory product/security gaps above remain candidate-only. Feature-branch artifacts or attestations remain candidate evidence only. \ No newline at end of file From a0a4ead50c72460bae57f9056ff6e1422d887226 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 09:35:04 +0900 Subject: [PATCH 70/73] docs(gaps): refresh EA projection owner evidence --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 6697ede4..9774f550 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -61,7 +61,7 @@ PR #130 remains the sole writer for this file. Other Wardnet lanes hand exact ev Context Graph Contracts still reports `default_branch=develop`. Protected `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` and unprotected byte-identical `main@99cb5468ba3c15c5e79688f53dee74724fae2d13` expose the unfinished default/protection transition; organization ruleset `18156473` is active and therefore still follows the live default topology. GitHub Releases remain empty. The intended dependency order remains `#4 -> #6 -> #7 -> #8 -> #12 -> #13 -> #14 -> #16 -> #17 -> #18 -> #19 -> #25 -> #20 -> #21`. Live dependency root #4 is `7503b7da50efcad8256e5b6d3214e438c829cd50`; current #25 is `10e5f4abc430437cfd15f79142703ac2b1fc612e`, #20 is `b04fa4f82bb2e8007dd5f1c660e305ffc286f1cb`, and the actual #21 branch head is `243cb66452883c63a6ff2d7370534629db3a358e`. Its PR body still names predecessor `b6826016d7ec2251e1ce96940e841c1ae8f23f49` as current; exact owner handoff is recorded on CGC issue #15 and the later `243cb664...` TRD provenance delta must be adopted rather than overwritten. Root #4's fresh owner evidence still separates real defects from source truth: Semgrep is GREEN, Dependency Review failed closed on a GitHub 403 owned by `.github#810`, delegated CodeQL remains `.github#712`, and repository bootstrap workflows have not yet established immutable release authority. `context-graph-contracts#27` owns future external-capability artifact/evidence/admission/activation semantics. Branch topology/default/protection repair remains Context Fabric/central owner work, not a Wardnet or user decision. -EA Core likewise reports `default_branch=develop`; protected `develop@dd71e40a86385fb7861b0f1be19891a3f3e29ece` remains live default authority while product-line `main@ca6889497728e1a3f09d68790a9096576e13a3ff` remains outside the intended protected/default topology. Releases are empty and organization ruleset `18156473` remains active. DDD root #39 is exact `c063570bd9177578fa75be69defd81c99e6ba2f3`; Context Fabric/quarantine projection #40 is exact `9cea817b15a92710e0677d30e5103965b58f0699` but remains Draft/stale against its parent; tenant-GUC restoration #48 is exact `3fd334f71dfaa44ae7567fac4228cd883f4a1300` with source RED→GREEN but no exact-head workflow materialization. The #40 boundary keeps quarantine as canonical artifact-analysis runtime evidence and `Wardnet -> artifact_analysis_evidence` directional; `malware_verdict` and `artifact_risk_score` remain forbidden as authoritative EA facts. EA #45 owns governed external-capability portfolio mapping; EA #49 owns the eventual Wardnet outbound-reputation architecture projection. Mutable producer heads remain evidence only, never released authority. +EA Core still reports `default_branch=develop`; protected `develop@dd71e40a86385fb7861b0f1be19891a3f3e29ece` remains live default authority while product-line `main@ca6889497728e1a3f09d68790a9096576e13a3ff` remains outside the intended protected/default topology. Releases are empty and organization ruleset `18156473` remains active. DDD root #39 remains exact `c063570bd9177578fa75be69defd81c99e6ba2f3`. Context Fabric/quarantine projection #40 has advanced linearly/non-force to exact `4d06ad56c102230d4300a3733d8e5b67f8c0ab04`; it remains Draft/non-mergeable because GitHub records obsolete #39 ancestry, and fresh exact-head Actions inventory is empty. Its current machine contract requires exactly one non-EA-owned inbound `ContextualWisdomLab/wardnet` Context Assertion evidence boundary, permits only `observed` Wardnet projection truth, forbids `malware_verdict` and `artifact_risk_score` as authoritative EA facts, and forbids direct database/source copying. The same head has adopted the tenant-GUC restoration repair from #48 while #48 remains the dependency-root evidence anchor at exact `3fd334f71dfaa44ae7567fac4228cd883f4a1300`; neither mutable head is released authority. EA #45 owns governed external-capability portfolio mapping and EA #49 owns the eventual Wardnet outbound-reputation architecture projection. Mutable producer heads remain compatibility evidence only. ## Buyer-visible gap order From 63ebb2f37e277782e91a9a2769bed96467d7c895 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 09:37:46 +0900 Subject: [PATCH 71/73] docs(gaps): clear superseded CGC head drift --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 9774f550..33cc7f2f 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -59,7 +59,7 @@ PR #130 remains the sole writer for this file. Other Wardnet lanes hand exact ev ## Context Fabric read-only inventory -Context Graph Contracts still reports `default_branch=develop`. Protected `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` and unprotected byte-identical `main@99cb5468ba3c15c5e79688f53dee74724fae2d13` expose the unfinished default/protection transition; organization ruleset `18156473` is active and therefore still follows the live default topology. GitHub Releases remain empty. The intended dependency order remains `#4 -> #6 -> #7 -> #8 -> #12 -> #13 -> #14 -> #16 -> #17 -> #18 -> #19 -> #25 -> #20 -> #21`. Live dependency root #4 is `7503b7da50efcad8256e5b6d3214e438c829cd50`; current #25 is `10e5f4abc430437cfd15f79142703ac2b1fc612e`, #20 is `b04fa4f82bb2e8007dd5f1c660e305ffc286f1cb`, and the actual #21 branch head is `243cb66452883c63a6ff2d7370534629db3a358e`. Its PR body still names predecessor `b6826016d7ec2251e1ce96940e841c1ae8f23f49` as current; exact owner handoff is recorded on CGC issue #15 and the later `243cb664...` TRD provenance delta must be adopted rather than overwritten. Root #4's fresh owner evidence still separates real defects from source truth: Semgrep is GREEN, Dependency Review failed closed on a GitHub 403 owned by `.github#810`, delegated CodeQL remains `.github#712`, and repository bootstrap workflows have not yet established immutable release authority. `context-graph-contracts#27` owns future external-capability artifact/evidence/admission/activation semantics. Branch topology/default/protection repair remains Context Fabric/central owner work, not a Wardnet or user decision. +Context Graph Contracts still reports `default_branch=develop`. Protected `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` and unprotected byte-identical `main@99cb5468ba3c15c5e79688f53dee74724fae2d13` expose the unfinished default/protection transition; organization ruleset `18156473` is active and therefore still follows the live default topology. GitHub Releases remain empty. The intended dependency order remains `#4 -> #6 -> #7 -> #8 -> #12 -> #13 -> #14 -> #16 -> #17 -> #18 -> #19 -> #25 -> #20 -> #21`. Live dependency root #4 is `7503b7da50efcad8256e5b6d3214e438c829cd50`; current #25 is `10e5f4abc430437cfd15f79142703ac2b1fc612e`, #20 is `b04fa4f82bb2e8007dd5f1c660e305ffc286f1cb`, and current #21 is exact `243cb66452883c63a6ff2d7370534629db3a358e`. The #21 body now names that exact head and records the intervening three-commit documentation-only provenance delta, so the older `b6826016d7ec2251e1ce96940e841c1ae8f23f49` head-drift observation is superseded; no predecessor execution evidence transfers. Root #4's fresh owner evidence still separates real defects from source truth: Semgrep is GREEN, Dependency Review failed closed on a GitHub 403 owned by `.github#810`, delegated CodeQL remains `.github#712`, and repository bootstrap workflows have not yet established immutable release authority. `context-graph-contracts#27` owns future external-capability artifact/evidence/admission/activation semantics. Branch topology/default/protection repair remains Context Fabric/central owner work, not a Wardnet or user decision. EA Core still reports `default_branch=develop`; protected `develop@dd71e40a86385fb7861b0f1be19891a3f3e29ece` remains live default authority while product-line `main@ca6889497728e1a3f09d68790a9096576e13a3ff` remains outside the intended protected/default topology. Releases are empty and organization ruleset `18156473` remains active. DDD root #39 remains exact `c063570bd9177578fa75be69defd81c99e6ba2f3`. Context Fabric/quarantine projection #40 has advanced linearly/non-force to exact `4d06ad56c102230d4300a3733d8e5b67f8c0ab04`; it remains Draft/non-mergeable because GitHub records obsolete #39 ancestry, and fresh exact-head Actions inventory is empty. Its current machine contract requires exactly one non-EA-owned inbound `ContextualWisdomLab/wardnet` Context Assertion evidence boundary, permits only `observed` Wardnet projection truth, forbids `malware_verdict` and `artifact_risk_score` as authoritative EA facts, and forbids direct database/source copying. The same head has adopted the tenant-GUC restoration repair from #48 while #48 remains the dependency-root evidence anchor at exact `3fd334f71dfaa44ae7567fac4228cd883f4a1300`; neither mutable head is released authority. EA #45 owns governed external-capability portfolio mapping and EA #49 owns the eventual Wardnet outbound-reputation architecture projection. Mutable producer heads remain compatibility evidence only. From 690dbb7c1fd5e4a8481a490b7cbbf41fa517d7f5 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 09:40:54 +0900 Subject: [PATCH 72/73] docs(gaps): record protected-main gate convergence --- docs/product-technical-gap-baseline.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 33cc7f2f..9a9df0ff 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -18,9 +18,9 @@ Organization ruleset `18156473` remains active on `~DEFAULT_BRANCH`. Fresh owner #171 supplied the concrete governance defect specimen. Exact Ready head `d94a4a6207a0d3ea79547a57fb0a7c5f6b2b30d5` had no human `APPROVED` review, no `CHANGES_REQUESTED`, all inline threads resolved, and nine exact-head workflows terminal success. A standard expected-head squash merge call nevertheless succeeded and produced protected `a52ccd0...` while the ruleset still reported `required_approving_review_count=1` and `OrganizationAdmin/always`. Therefore an ordinary merge API call by this principal cannot be treated as proof that the approval gate is satisfiable without bypass. Exact evidence and acceptance criteria remain on `.github#772` comment `5555475361`: repair the solo-incompatible generic approval requirement while retaining deterministic workflows/thread/non-fast-forward/deletion controls, constrain routine administrator bypass, and make normal protected admission distinguishable from explicit emergency bypass. Wardnet will not use further merge calls merely to probe governance until that repair is live. -Delegated model/code-analysis verdict execution remains a central owner path. `.github#1932` has merged the comma-separated trusted-dispatcher parser across OpenCode, CodeQL and review-fix consumers as `6f8c51d7389c22ebaf294fe8fe9ef495257883c0`; `.github#1926` has separately repaired CodeQL's array-valued matrix binding as `3f88e13af9dcde4b9da6958c02a78ce3b5c85800`. Neither source repair proves the live authorization setting is reconciled. A fresh post-repair CodeQL repository-dispatch on central protected `.github/main@fe827e133e7d867015d088777553e22736344c55`, run `33997332726`, was emitted by `opencode-agent[bot]`, acquired Ubuntu and exchanged the app token, then failed in `validate-dispatch` before scan execution. `.github#1929` therefore remains the causal owner path: the live trusted-dispatcher setting must represent exactly the proven `github-actions[bot]` scheduler identity and `opencode-agent[bot]` app identity while preserving actor==sender, exact repository/PR/head binding and fail-closed rejection of unlisted or mismatched identities. Do not churn Wardnet heads or broaden the leaf gate to compensate. +Delegated model/code-analysis verdict execution remains a central owner path. `.github#1932` has merged the comma-separated trusted-dispatcher parser across OpenCode, CodeQL and review-fix consumers as `6f8c51d7389c22ebaf294fe8fe9ef495257883c0`; `.github#1926` has separately repaired CodeQL's array-valued matrix binding as `3f88e13af9dcde4b9da6958c02a78ce3b5c85800`. Neither source repair proves the live authorization setting is reconciled. Post-#1932 owner evidence on `.github#1929` measured 83 of 83 completed OpenCode Review Dispatch runs since 2026-09-05T17:00Z as failed; two inspected failures rejected `actor=opencode-agent[bot] sender=opencode-agent[bot]` while the comma-list parser was active but `ALLOWED_DISPATCH_ACTOR` still resolved only to `github-actions[bot]`. The causal owner action therefore remains the live setting `OPENCODE_REPOSITORY_DISPATCH_ACTOR=github-actions[bot],opencode-agent[bot]`, preserving actor==sender, exact repository/PR/head binding and fail-closed rejection of unlisted or mismatched identities. Wardnet consumer pushes/reruns cannot repair that setting and must not broaden the leaf gate. -Protected-main push validation has partially converged without source churn. On exact `main@a52ccd0...`, CI `33998430723` is terminal success and dynamic CodeQL push run `33998430384` is terminal success; Scorecard `33998430707` remains queued. The exact protected head is therefore still not release GREEN. Queued state remains `.github#712` control-plane evidence and is not authority for no-op commits, rerun storms or gate weakening. +Protected-main push validation has now converged without source churn. On exact `main@a52ccd0...`, CI `33998430723`, Scorecard `33998430707`, and dynamic CodeQL push run `33998430384` are all terminal success. This removes the protected-head push-queue finding but does not make the product release-ready: governance admission remains ambiguous, immutable Wardnet release authority is absent, and mandatory product/security gaps remain candidate-only. ## Agent Artifact Admission @@ -73,4 +73,4 @@ The USD 20 billion ambition is a product-quality bar, not a customer contract va Security and runtime decisions remain traceable to current authoritative NIST/OWASP/CWE/IETF/OCI/Linux sources and primary/peer-reviewed research where the implementation depends on them. Citation is design evidence, not proof that a control is shipped. Wardnet-owned production targets 100% statement/branch/edge-case coverage and complete public rustdoc/docstrings, with realistic bypass/replay/race/DoS/network/cleanup tests where applicable. -No Wardnet release is authorized at this snapshot. Release requires one exact integrated protected head with terminal current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact/source identity and a verified publication path. Protected `main@a52ccd0...` is documentation truth but not release-ready: its CI and dynamic CodeQL push validations are GREEN, yet Scorecard `33998430707` remains queued, governance normal-vs-bypass admission remains unresolved, GitHub Releases is empty, and multiple mandatory product/security gaps above remain candidate-only. Feature-branch artifacts or attestations remain candidate evidence only. \ No newline at end of file +No Wardnet release is authorized at this snapshot. Release requires one exact integrated protected head with terminal current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact/source identity and a verified publication path. Protected `main@a52ccd0...` now has all three observed push validations terminal GREEN (CI, Scorecard, dynamic CodeQL), but that is only protected-head execution evidence: governance normal-vs-bypass admission remains unresolved, GitHub Releases is empty, and multiple mandatory product/security gaps above remain candidate-only. Feature-branch artifacts or attestations remain candidate evidence only. \ No newline at end of file From 15de2ed7f819a067d72e09df5702d9daa3f73ac4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 6 Sep 2026 12:05:08 +0900 Subject: [PATCH 73/73] docs(gaps): refresh current security and control-plane evidence --- docs/product-technical-gap-baseline.md | 63 +++++++++++++------------- 1 file changed, 31 insertions(+), 32 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 9a9df0ff..09bf690b 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -8,69 +8,68 @@ Wardnet owns the Rust-first gateway/SOC control plane and the Gateway, Admission `context-graph-contracts` is the provider-neutral Context Fabric Shared Kernel and `enterprise-architecture-core` is the EA Decision Plane. Both remain read-only from this Wardnet writer while their Context Fabric owner is active. Wardnet findings/verdicts remain Wardnet evidence; EA may retain verified evidence references for technology risk/remediation/initiative context but must not copy raw security verdicts into authoritative architecture truth. -Fresh GitHub release inventories remain empty for Wardnet, Context Graph Contracts and EA Core. The current Wardnet integration contract also continues to require immutable compatible releases rather than mutable heads from `contextual-orchestrator`, `quarantine-sandbox-runtime`, EgressWeave or `appguardrail`. No mutable sibling head is production/release authority. +Fresh GitHub release inventories remain empty for Wardnet, Context Graph Contracts, EA Core, EgressWeave, contextual-orchestrator, quarantine-sandbox-runtime and AppGuardrail. The Wardnet integration contract therefore continues to require future immutable compatible releases rather than mutable sibling heads. No open foreign-owner PR is production/release authority. ## Protected truth and control plane -Protected/default Wardnet truth remains protected squash merge #171 at `main@a52ccd0a24a727d9349bb32def7713882d8cad1e`, whose verified parent is prior protected `5829a0f08d78de464dd24393ce5d0f25fba9d126`. #159 remains the protected workflow-control foundation: its CI/Fuzz/Scorecard pressure repair, explicit hosted-runner contract, `AGENTS.md` ownership guidance and workflow queue/runner regressions must be adopted by consumer lanes rather than copied or bypassed. #171 adds the protected bounded-context decision that browser acquisition/session/challenge/CAPTCHA handling stays outside Wardnet while destination maliciousness/reputation policy and security evidence remain Wardnet-owned; arbitrary metadata fetching must not be reintroduced into Wardnet, and required outbound retrieval must traverse a released EgressWeave authorization boundary or fail closed. +Protected/default Wardnet truth remains protected squash merge #171 at `main@a52ccd0a24a727d9349bb32def7713882d8cad1e`, whose verified parent is prior protected `5829a0f08d78de464dd24393ce5d0f25fba9d126`. #159 remains the protected workflow-control foundation. #171 adds the protected bounded-context decision that browser acquisition/session/challenge/CAPTCHA handling stays outside Wardnet while destination maliciousness/reputation policy and security evidence remain Wardnet-owned; arbitrary metadata fetching must not be reintroduced into Wardnet, and required outbound retrieval must traverse a released EgressWeave authorization boundary or fail closed. -Organization ruleset `18156473` remains active on `~DEFAULT_BRANCH`. Fresh owner evidence still records one generic approving review with no named required reviewer, review-thread resolution plus deterministic central workflow gates, deletion/non-fast-forward protection, and `OrganizationAdmin/always` bypass with the current principal able to bypass. Under the declared solo-maintainer model, self-approval and bot/model-as-human approval remain forbidden. +Organization ruleset `18156473` remains active on `~DEFAULT_BRANCH`. Fresh payload still requires `required_approving_review_count=1` with `required_reviewers=[]`, no code-owner or last-push approval requirement, stale-review dismissal and review-thread resolution, seven central required workflows, deletion/non-fast-forward protection, and `OrganizationAdmin/always` bypass available to the current principal. Under the declared solo-maintainer model, self-approval and bot/model-as-human approval remain forbidden. -#171 supplied the concrete governance defect specimen. Exact Ready head `d94a4a6207a0d3ea79547a57fb0a7c5f6b2b30d5` had no human `APPROVED` review, no `CHANGES_REQUESTED`, all inline threads resolved, and nine exact-head workflows terminal success. A standard expected-head squash merge call nevertheless succeeded and produced protected `a52ccd0...` while the ruleset still reported `required_approving_review_count=1` and `OrganizationAdmin/always`. Therefore an ordinary merge API call by this principal cannot be treated as proof that the approval gate is satisfiable without bypass. Exact evidence and acceptance criteria remain on `.github#772` comment `5555475361`: repair the solo-incompatible generic approval requirement while retaining deterministic workflows/thread/non-fast-forward/deletion controls, constrain routine administrator bypass, and make normal protected admission distinguishable from explicit emergency bypass. Wardnet will not use further merge calls merely to probe governance until that repair is live. +#171 remains the concrete governance defect specimen: a standard expected-head squash merge reached protected truth while the same live ruleset still exposed both the unsatisfiable generic approval count and routine admin bypass. `.github#772` remains the causal owner path. Its latest Wardnet canary records protected `main@a52ccd0...` and current-base #174; the accepted repair remains removal/replacement only of the impossible generic count and routine-bypass ambiguity while deterministic workflow/security/coverage/package/SBOM/provenance/thread/deletion/non-fast-forward controls remain fail closed. Wardnet will not issue further merge calls merely to probe governance. -Delegated model/code-analysis verdict execution remains a central owner path. `.github#1932` has merged the comma-separated trusted-dispatcher parser across OpenCode, CodeQL and review-fix consumers as `6f8c51d7389c22ebaf294fe8fe9ef495257883c0`; `.github#1926` has separately repaired CodeQL's array-valued matrix binding as `3f88e13af9dcde4b9da6958c02a78ce3b5c85800`. Neither source repair proves the live authorization setting is reconciled. Post-#1932 owner evidence on `.github#1929` measured 83 of 83 completed OpenCode Review Dispatch runs since 2026-09-05T17:00Z as failed; two inspected failures rejected `actor=opencode-agent[bot] sender=opencode-agent[bot]` while the comma-list parser was active but `ALLOWED_DISPATCH_ACTOR` still resolved only to `github-actions[bot]`. The causal owner action therefore remains the live setting `OPENCODE_REPOSITORY_DISPATCH_ACTOR=github-actions[bot],opencode-agent[bot]`, preserving actor==sender, exact repository/PR/head binding and fail-closed rejection of unlisted or mismatched identities. Wardnet consumer pushes/reruns cannot repair that setting and must not broaden the leaf gate. +Delegated model/code-analysis verdict execution also remains a central owner path. `.github#1932` and `.github#1926` repaired parser/matrix source, but `.github#1929` is still open. Fresh owner evidence now distinguishes three producer identities rather than a simple two-bot allowlist: OpenCode/CodeQL app-token dispatches use `opencode-agent[bot]`, a legacy machine path has emitted `github-actions[bot]`, and measured review-fix dispatches have arrived as the human account. The least-widening central repair is to migrate review-fix dispatch off the user token onto a dedicated repository-scoped machine principal, then authorize only machine identities still intentionally emitted while preserving `actor == sender` and exact repository/PR/base/head/wake binding. Wardnet must not add a human account to a machine-dispatch allowlist or broaden a leaf gate. -Protected-main push validation has now converged without source churn. On exact `main@a52ccd0...`, CI `33998430723`, Scorecard `33998430707`, and dynamic CodeQL push run `33998430384` are all terminal success. This removes the protected-head push-queue finding but does not make the product release-ready: governance admission remains ambiguous, immutable Wardnet release authority is absent, and mandatory product/security gaps remain candidate-only. +Protected-main push validation remains converged without source churn. On exact `main@a52ccd0...`, CI `33998430723`, Scorecard `33998430707`, and dynamic CodeQL push run `33998430384` are terminal success. This is protected-head execution evidence only: governance admission remains ambiguous, Wardnet has no immutable release, and mandatory product/security gaps remain candidate-only. ## Agent Artifact Admission -PR #129 is exact `db921e7f855f52870b23de52a4e23f11ff996644`, mergeable but intentionally Draft. Four exact-current repository/security lanes are terminal GREEN without source churn: CI `33977431401`, Fuzz `33977431523`, Security Scan `33977431400`, and SAST Semgrep `33977431547`. CodeQL PR `33977431418` is terminal FAILURE only because the successfully dispatched exact-head delegated verdict remained pending; the causal owner handoff is recorded on the central control-plane path. Combined commit status still lacks the required authenticated `codeql-dispatch/actions` terminal status. Preserve the four GREEN lanes and reacquire only the failed/required delegated lane after the central owner path can publish and wake an exact-head verdict. +PR #129 remains exact `db921e7f855f52870b23de52a4e23f11ff996644`, mergeable but intentionally Draft. Four repository/security lanes are terminal GREEN on that source head: CI `33977431401`, Fuzz `33977431523`, Security Scan `33977431400`, and SAST Semgrep `33977431547`. CodeQL PR `33977431418` is a central delegated-verdict failure, not an Agent Artifact Admission source finding. Preserve those GREEN lanes and reacquire only then-required delegated evidence after the central producer can publish an authenticated exact-head verdict. The bounded context is pre-execution structured installer security admission only. It binds reviewed workspace manifest/artifact identity, exact ecosystem/name/version/registry/owner/SHA-256, executable family, declared operands, policy revision and bounded provenance; it does not fetch, decrypt, install, execute, isolate, activate or route workloads. An `allow` receipt is admission authority, not downloaded-byte proof or runtime activation. Current hostile TDD includes the PyPI hash-mode contradiction: RED `032d74e060e778add00a2cc757ce3582c1135232` proves `--require-hashes` plus hostile `--no-require-hashes` must not remain admissible; classifier `4c0de8a3445d6b062b69440507cd3c81a3323308` isolates pip/pip3 hash-mode authority; causal repair `bba656c1d776da38a7315d9ec8e6cb5bdfd621d1` fails the contradictory request closed. Earlier package-manager, Cargo, npm-family, OCI-cardinality/platform and Podman trust/auth/decryption hostile contracts remain preserved. -`context-graph-contracts#27` owns the future provider-neutral external-capability artifact/evidence/admission/activation grammar. Package-manager argv/parser semantics and Wardnet reason codes remain Wardnet-local. `enterprise-architecture-core#45` owns architecture adoption/risk/provenance projection and must retain evidence references without making Wardnet findings authoritative EA facts. AppGuardrail owns deterministic static plugin/package scanning and scan receipts; quarantine owns hostile dynamic execution evidence; Noema owns activation/rollback. None of those mutable owner heads is production authority. +`context-graph-contracts#27` owns future provider-neutral external-capability artifact/evidence/admission/activation grammar. Package-manager argv/parser semantics and Wardnet reason codes remain Wardnet-local. EA projection must retain Wardnet evidence references without making Wardnet findings authoritative EA facts. AppGuardrail owns deterministic static plugin/package scanning and scan receipts; quarantine owns hostile dynamic execution evidence; Noema owns activation/rollback. None of those mutable owner heads is production authority. ## Immediate product/security lanes -- **#167 MISP admission + shared DNSBL snapshot ownership** — exact current Draft head is `0c83cd5956f512d79c6600e823fcfa6d6f32af4e` on protected `main@a52ccd0...`. The shared DNSBL ownership finding has reached causal production-source GREEN instead of remaining a planned repair. Temporary run `34000662730` executed the repaired Rust working tree: all locked workspace tests passed, including stale-withdrawal, shared-feed, operator-overwrite/count, restart and persistence rollback/retry cases, and strict workspace Clippy passed. Source repair `7042aa19267886e3af9c378dddd879929837877b` adds stable `DnsblEntryKey(address)`, serde-default feed/operator ownership, shared snapshot reconciliation, operator payload preservation, conditional stale reaping and actual-write accounting; the valid DNSBL review thread was resolved against that implementation. Temporary restack run `34000892973` then pinned both refs, non-force adopted protected `main@a52ccd0...`, ran the full locked workspace tests and strict Clippy GREEN, removed the temporary workflow and pushed merge commit `d8b452cf1d609bb6e9c9a8a33f265c0a32dce7c9`. Current `0c83cd...` is the code-current doctoring child. Exact-current standard gates remain non-passing: CI `34000987921`, Fuzz `34000988028`, Security Scan `34000987843` and CodeQL PR `34000987911` are queued while SAST Semgrep `34000987891` is pending. Keep Draft until current-head gates and governance are terminal-valid; do not promote temporary-workflow GREEN to merge evidence. -- **#170 MISP threat-level severity child** — exact current child `2c8d499a5772b0be64d7cc3fc42ed2825ba1499e`, Draft, based on exact parent `0c83cd5956f512d79c6600e823fcfa6d6f32af4e`. Causal restack run `34001140916` pinned child and parent, non-force merged the complete parent lineage, formatted only the expected severity code/test files under the pinned toolchain, ran the full locked workspace tests and strict Clippy GREEN, removed its temporary workflow, and proved the effective child-versus-parent delta remains exactly `docs/doctoring/misp-threat-level-severity.md`, `src/misp_import.rs` and `tests/misp_threat_level_severity.rs`. Current child CI `34001236320` is queued and Fuzz `34001236319` is pending. Parent #167 must first reach protected truth; no parent check or temporary-restack result transfers to the child final gate. -- **#77 Rust toolchain/reproducibility foundation** — exact `d386d6f57e0c8de3e4839d6c61b593e41f9d7e20`, Ready on its source head. CI `33907688502`, Security `33907688421`, and Semgrep `33907688360` are terminal success; prior CodeQL is delegated-control-plane evidence rather than toolchain-source GREEN. Protected main has since advanced by the orthogonal #171 documentation decision, so fresh candidate-base compatibility remains required. Child #164 stays Draft until #77 or a verified successor reaches protected truth and current delegated gates can be reacquired. -- **#166 Wardnet-local PR queue policy** — exact `13fc6a1b9b3f5af0b7c6acfb79de6c46fd72de3a`, Ready on its source head. Repository CI `33954367435` and Fuzz `33954367424` are terminal success; central Security/Semgrep/CodeQL worker lanes remain non-passing owner-plane evidence already handed to the central control plane. Protected main has since advanced, and ordinary queue wait or base drift is not bypass authority. -- **#173 outbound site reputation** — exact `a14b28a10ea87dbcc1939fe0fdca6ce5b02259ed`, Ready and documentation-only. After #171 advanced protected main to `a52ccd0...`, GitHub recomputed this unchanged head as mergeable and its four-file reputation delta does not overlap #171's two-file anti-bot ADR/index delta. Repository CI `33949463493`, Security `33949463487`, Semgrep `33949463505`, CodeQL PR `33949463499`, and required review merge scheduler `33949463529` are terminal success on the source head but predate the protected-base movement and are not final candidate-base evidence. Required OpenCode run `33949463777` is terminal FAILURE because no authenticated exact-head model-review verdict arrived after successful dispatch. Wardnet owns destination maliciousness/reputation evidence lifecycle, organizational admission policy and SOC accountability; EgressWeave remains authoritative for executable URL/address/DNS/peer/redirect/proxy/TLS/resource authorization. Production transport composition requires an immutable compatible EgressWeave Rust-consumer boundary; no mutable owner head qualifies. Further merge calls are paused until `.github#772` removes the silent routine-bypass ambiguity. -- **#155 management auth** — exact `f74ff25a321dfb1d7109719e2a1fc77e47dc4898`. CI/Fuzz/Security/Semgrep are terminal success on that source head; its prior CodeQL failure is central delegated-verdict evidence, not an auth source finding. The feature fails closed before readiness when a non-loopback listener lacks a write-capable administrator credential. Fresh candidate-base compatibility is required after #171. -- **#93 deterministic persistence failure injection** — exact `4775abc66e5350bdbf07ccefca74c10ddb03701a`. The deterministic write-temp/rename fault seam remains the owner-correct replacement for permission-dependent failure injection. Its prior CodeQL failure belongs to the same central delegated-verdict class; re-read all exact-current gates and current-base compatibility only after the owner plane can issue a current verdict. -- **#140 Runtime Configuration** — canonical supporting-boundary owner at exact `054c11aafe835e497d6149efb09f1ccdee9d03bd`. Hostile RED `0f22aaff...` rejects zero positive bounds; causal repair `d28a0119...` fixes the positive-u64 bootstrap parser while preserving the distinct `RATE_LIMIT=0` disable semantic. Feature lanes must adopt #140 rather than create a competing process-environment authority. Its source head predates #171 and therefore needs fresh base compatibility before integration. -- **#157/#165 trusted client attribution** — #165 remains the current production feature owner at exact `99581e056645e98e866157443a6732a4bbd729c4`; #157 is a preservation lane for unique trusted-proxy fuzz/corpus/invariant evidence. #165 must adopt #140 after that foundation reaches protected truth and prove complete #157 evidence transfer before #157 can retire. -- **#135 bounded local limiter** — exact `fb24394308ccdc835cce344b7e945f5537e99756`; repository-owned CI/Fuzz are terminal success while central Security/Semgrep/CodeQL remain non-passing. Its local cardinality/rate-limit contract remains separate from #165 trusted-proxy attribution and any future distributed quota authority. -- **#136 outbound policy** — preservation Draft only. Keep Wardnet-owned purpose/call-site/deadline/evidence hostile tests, but do not integrate the local destination/DNS/redirect/proxy/TLS policy implementation. EgressWeave issue #237 owns an immutable Rust-consumable provider-neutral authorization/evidence boundary; current mutable work is not release authority. -- **#115 official threat-source refresh** — preservation Draft. Preserve Wardnet-owned source registry/parser/conditional-validator/last-known-good/SOC evidence delta, but reconstruct outbound authorization through a released EgressWeave port/ACL rather than retaining local reusable egress authority. -- **#88 contextual-orchestrator consumer** — architecture-gated preservation. Preserve unique fail-closed credential/header/streaming negative evidence, remove LiteLLM/provider-routing/virtual-key ownership when reconstructing, and consume only a released CO API/client/schema/Agent boundary. Mutable CO source is not production authority. -- **#164 release evidence** — Draft stacked on #77. It separates PR build/SBOM evidence from protected-main OIDC attestation authority. Do not publish from a feature branch; after the Rust/toolchain parent is protected truth, restack on fresh main and reacquire exact-head package/SBOM/provenance/reproducibility evidence. -- **#127 material UI/a11y** — exact `35f4b7a261c15f4549f8e77f40688adc4bb501b0`, intentionally Draft. Before Ready it still requires production-like browser E2E for keyboard skip/focus, accessible names/descriptions, KPI live-region behavior, responsive widths, and applicable normal/loading/error/permission states; source-string tests alone are not WCAG 2.2 AA evidence. The source head predates #171, so current-base browser evidence must be reacquired when this lane resumes. -- **#90 SIEM/OpenTelemetry preservation** — exact `2d251183c41f49b07d443ff15fe9e54472d90f63`, Draft/non-mergeable mixed aggregate branch. Preserve its unique Wardnet-owned OCSF/OTLP/RFC 5424 exporter/input/fuzz/security evidence through a bounded successor from fresh protected main; do not inherit stale `.github`, generic architecture/changelog, product-gap or other owner surfaces wholesale. Close only after complete verified successor transfer. +- **#167 MISP admission + shared DNSBL snapshot ownership** — exact current Draft head `0c83cd5956f512d79c6600e823fcfa6d6f32af4e` is on protected `main@a52ccd0...`. The causal DNSBL repair remains `7042aa19267886e3af9c378dddd879929837877b`, preserving shared feed/operator ownership, operator payloads, stale withdrawal, restart and rollback/retry semantics. Temporary repair/restack GREEN is retained only as causal evidence. Fresh normal exact-head evidence has now converged for CI `34000987921`, Fuzz `34000988028`, Security Scan `34000987843`, and SAST Semgrep `34000987891`; all four are terminal success. CodeQL PR `34000987911` is terminal failure only after exact-head checkout and a successful current-head dispatch request, because the delegated verdict was unavailable at the fail-closed enforcement step. Keep Draft until the central verdict path and governance are terminal-valid; do not rerun-storm or promote temporary workflow evidence. +- **#170 MISP threat-level severity child** — exact `2c8d499a5772b0be64d7cc3fc42ed2825ba1499e`, Draft, base exactly parent #167 `0c83cd5956f512d79c6600e823fcfa6d6f32af4e`. The retained RED/GREEN maps MISP `1/2/3` to Wardnet `High/Medium/Low` and preserves the documented Undefined/missing compatibility behavior without touching the parent admission/DNSBL boundary. Full parent adoption/restack run `34001140916` is causal evidence only. Current child CI `34001236320` and Fuzz `34001236319` are now terminal success. Parent #167 must first reach protected truth; after retarget/restack the child must reacquire its own then-live security/review/governance evidence. +- **#174 CodeQL SARIF uploader successor** — Draft/mergeable exact head `028caa05167f9e8f2589b681a8f79c633f406c30` is exactly one commit ahead and zero behind protected `main@a52ccd0...`. It changes only `.github/workflows/scorecard-analysis.yml`, pinning `github/codeql-action/upload-sarif` from immutable v4.37.7 SHA to v4.37.9 `cdf488f595d80d6e07e03d4674febd5ab45fa938`; #141 remains predecessor evidence until complete transfer reaches protected truth. Repository CI `34005444829` is terminal success. Security classifier, CodeQL language detection and Semgrep classifier have each acquired hosted runners and succeeded, while downstream `scorecard` `101416546887`, `trivy-fs` `101416546904`, CodeQL compatibility `101416634299`, and Semgrep `101416892247` remain queued with `steps=[]` and `runner_id=0`. Exact evidence and RED/GREEN acceptance are on `.github#712`; no no-op push or sole-current-head cancellation is valid. +- **#77 Rust toolchain/reproducibility foundation** — exact `d386d6f57e0c8de3e4839d6c61b593e41f9d7e20`, Ready on its source head. CI `33907688502`, Security `33907688421`, and Semgrep `33907688360` are terminal success; prior CodeQL is delegated-control-plane evidence rather than toolchain-source GREEN. Protected main has advanced since the source head, so fresh candidate-base compatibility remains required. Child #164 stays Draft until #77 or a verified successor reaches protected truth and current package/SBOM/provenance evidence is reacquired. +- **#166 Wardnet-local PR queue policy** — exact `13fc6a1b9b3f5af0b7c6acfb79de6c46fd72de3a`, Ready on its source head. Repository CI/Fuzz are terminal success; central worker lanes remain owner-plane evidence. Protected main has advanced, and ordinary queue wait or base drift is not bypass authority. +- **#173 outbound site reputation** — exact `a14b28a10ea87dbcc1939fe0fdca6ce5b02259ed`, Ready/documentation-only. Its source-head repository lanes were terminal success but the required OpenCode verdict failed to arrive, and its evidence predates the protected-base movement. Wardnet owns destination maliciousness/reputation evidence lifecycle, organizational admission policy and SOC accountability; EgressWeave owns executable URL/address/DNS/peer/redirect/proxy/TLS/resource authorization. Production transport composition still requires an immutable compatible EgressWeave Rust-consumer boundary; current EgressWeave GitHub Releases remain empty. +- **#155 management auth** — exact `f74ff25a321dfb1d7109719e2a1fc77e47dc4898`; source-head CI/Fuzz/Security/Semgrep are terminal success while prior CodeQL belongs to the central delegated-verdict class. The feature fails closed before readiness when a non-loopback listener lacks a write-capable administrator credential; fresh current-base compatibility remains required. +- **#93 deterministic persistence failure injection** — exact `4775abc66e5350bdbf07ccefca74c10ddb03701a`. The deterministic write-temp/rename fault seam remains the owner-correct replacement for permission-dependent failure injection. Prior CodeQL belongs to the same central delegated-verdict class; re-read all exact-current gates and current-base compatibility before integration. +- **#140 Runtime Configuration** — canonical supporting-boundary owner at exact `054c11aafe835e497d6149efb09f1ccdee9d03bd`. Hostile RED `0f22aaff...` rejects zero positive bounds; causal repair `d28a0119...` fixes the positive-u64 bootstrap parser while preserving the distinct `RATE_LIMIT=0` disable semantic. Feature lanes adopt #140 rather than create a competing process-environment authority. +- **#157/#165 trusted client attribution** — #165 remains the current production feature owner; #157 is a preservation lane for unique trusted-proxy fuzz/corpus/invariant evidence. #165 must adopt #140 after that foundation reaches protected truth and prove complete #157 evidence transfer before #157 retires. +- **#135 bounded local limiter** — repository-owned CI/Fuzz are terminal success while central security/delegated lanes remain non-passing. Its local cardinality/rate-limit contract remains separate from #165 trusted-proxy attribution and future distributed quota authority. +- **#136 outbound policy** — preservation Draft only. Keep Wardnet-owned purpose/call-site/deadline/evidence hostile tests, but do not integrate local reusable destination/DNS/redirect/proxy/TLS authority. EgressWeave issue #237 remains the canonical immutable Rust-consumable authorization/evidence owner path. +- **#115 official threat-source refresh** — preservation Draft. Preserve Wardnet-owned source registry/parser/conditional-validator/last-known-good/SOC evidence delta, but reconstruct outbound authorization through a released EgressWeave port/ACL. +- **#88 contextual-orchestrator consumer** — architecture-gated preservation. Preserve unique fail-closed credential/header/streaming negative evidence, remove LiteLLM/provider-routing/virtual-key ownership when reconstructing, and consume only a released CO API/client/schema/Agent boundary. Contextual-orchestrator GitHub Releases remain empty. +- **#164 release evidence** — Draft stacked on #77. It separates PR build/SBOM evidence from protected-main OIDC attestation authority. Do not publish from a feature branch. +- **#127 material UI/a11y** — intentionally Draft. Before Ready it still requires production-like browser E2E for keyboard skip/focus, accessible names/descriptions, KPI live-region behavior, responsive widths, and applicable normal/loading/error/permission states; source-string tests alone are not WCAG 2.2 AA evidence. +- **#90 SIEM/OpenTelemetry preservation** — Draft/non-mergeable mixed aggregate branch. Preserve unique Wardnet-owned OCSF/OTLP/RFC 5424 exporter/input/fuzz/security evidence through a bounded successor from fresh protected main; do not inherit unrelated owner surfaces wholesale. Close only after complete verified successor transfer. ## Open PR inventory and single-writer discipline -Fresh search after protected merge #171 returns 29 open Wardnet PR lanes: `#77, #88, #90, #93, #95, #111, #112, #114, #115, #127, #129, #130, #134, #135, #136, #140, #141, #144, #155, #156, #157, #158, #162, #164, #165, #166, #167, #170, #173`. #159 and #171 are excluded because they are protected-main truth. - -PR #130 remains the sole writer for this file. Other Wardnet lanes hand exact evidence into #130 rather than editing this path. PR retirement still requires protected merge, explicit user instruction, malicious/no-valid delta, or verified complete successor transfer of every useful code/test/fixture/contract/evidence delta. +Fresh GitHub search reports 30 open Wardnet PRs. The prior 29-lane inventory is superseded by new current-base successor #174. #159 and #171 remain excluded because they are protected-main truth. PR #130 remains the sole writer for this file; other lanes hand exact evidence into #130 rather than editing this path. PR retirement still requires protected merge, explicit user instruction, malicious/no-valid delta, or verified complete successor transfer of every useful code/test/fixture/contract/evidence delta. ## Context Fabric read-only inventory -Context Graph Contracts still reports `default_branch=develop`. Protected `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` and unprotected byte-identical `main@99cb5468ba3c15c5e79688f53dee74724fae2d13` expose the unfinished default/protection transition; organization ruleset `18156473` is active and therefore still follows the live default topology. GitHub Releases remain empty. The intended dependency order remains `#4 -> #6 -> #7 -> #8 -> #12 -> #13 -> #14 -> #16 -> #17 -> #18 -> #19 -> #25 -> #20 -> #21`. Live dependency root #4 is `7503b7da50efcad8256e5b6d3214e438c829cd50`; current #25 is `10e5f4abc430437cfd15f79142703ac2b1fc612e`, #20 is `b04fa4f82bb2e8007dd5f1c660e305ffc286f1cb`, and current #21 is exact `243cb66452883c63a6ff2d7370534629db3a358e`. The #21 body now names that exact head and records the intervening three-commit documentation-only provenance delta, so the older `b6826016d7ec2251e1ce96940e841c1ae8f23f49` head-drift observation is superseded; no predecessor execution evidence transfers. Root #4's fresh owner evidence still separates real defects from source truth: Semgrep is GREEN, Dependency Review failed closed on a GitHub 403 owned by `.github#810`, delegated CodeQL remains `.github#712`, and repository bootstrap workflows have not yet established immutable release authority. `context-graph-contracts#27` owns future external-capability artifact/evidence/admission/activation semantics. Branch topology/default/protection repair remains Context Fabric/central owner work, not a Wardnet or user decision. +Context Graph Contracts still reports `default_branch=develop`. Protected `develop@99cb5468ba3c15c5e79688f53dee74724fae2d13` remains live while current accepted integration/default is protected `main`; GitHub Releases remain empty. The intended dependency order remains `#4 -> #6 -> #7 -> #8 -> #12 -> #13 -> #14 -> #16 -> #17 -> #18 -> #19 -> #25 -> #20 -> #21`. Live root #4 is `7503b7da50efcad8256e5b6d3214e438c829cd50`; source-provenance prerequisite #25 is `10e5f4abc430437cfd15f79142703ac2b1fc612e`; DDD fitness #20 is `b04fa4f82bb2e8007dd5f1c660e305ffc286f1cb`; current Context Assertion/CloudEvent child #21 is `b4dced3d0d0e758b5624f3cbfe513c723a788f97`. #21 now binds repository CI/package/reproducibility/supply-chain checkout to the immutable source head, but fresh exact-head Actions inventory remains empty. `.github#1137` owns protect-main-first/default migration, `.github#772` owns the solo-review rule, and `.github#712` owns remaining materialization/runner defects after repository causes are removed. Wardnet does not mutate this stack. -EA Core still reports `default_branch=develop`; protected `develop@dd71e40a86385fb7861b0f1be19891a3f3e29ece` remains live default authority while product-line `main@ca6889497728e1a3f09d68790a9096576e13a3ff` remains outside the intended protected/default topology. Releases are empty and organization ruleset `18156473` remains active. DDD root #39 remains exact `c063570bd9177578fa75be69defd81c99e6ba2f3`. Context Fabric/quarantine projection #40 has advanced linearly/non-force to exact `4d06ad56c102230d4300a3733d8e5b67f8c0ab04`; it remains Draft/non-mergeable because GitHub records obsolete #39 ancestry, and fresh exact-head Actions inventory is empty. Its current machine contract requires exactly one non-EA-owned inbound `ContextualWisdomLab/wardnet` Context Assertion evidence boundary, permits only `observed` Wardnet projection truth, forbids `malware_verdict` and `artifact_risk_score` as authoritative EA facts, and forbids direct database/source copying. The same head has adopted the tenant-GUC restoration repair from #48 while #48 remains the dependency-root evidence anchor at exact `3fd334f71dfaa44ae7567fac4228cd883f4a1300`; neither mutable head is released authority. EA #45 owns governed external-capability portfolio mapping and EA #49 owns the eventual Wardnet outbound-reputation architecture projection. Mutable producer heads remain compatibility evidence only. +EA Core still reports `default_branch=develop`; protected `develop@dd71e40a86385fb7861b0f1be19891a3f3e29ece` remains live while product `main@ca6889497728e1a3f09d68790a9096576e13a3ff` is outside the intended protected/default topology. GitHub Releases remain empty. DDD parent #39 remains `c063570bd9177578fa75be69defd81c99e6ba2f3`; Context Fabric/quarantine projection child #40 is now exact `c6b38732754fdea9ee45c0cabcc49c6a62fbb118`, still Draft with obsolete recorded #39 ancestry and zero exact-head workflow runs. Its source now binds repository-owned CI/runtime/supply-chain checkout to the immutable PR source head and retains the adopted tenant-GUC restoration repair. The machine contract requires exactly one non-EA-owned inbound Wardnet Context Assertion evidence boundary, permits only `observed` Wardnet projection truth, forbids `malware_verdict` and `artifact_risk_score` as authoritative EA facts, and forbids direct database/source copying. Mutable CGC/EA heads remain compatibility evidence only; Wardnet does not mutate either owner repository. ## Buyer-visible gap order -Current order remains authority/security before breadth: protected management authentication (#78/#155); immutable outbound policy/evidence integration (#79/#136 + EgressWeave owner release); Wardnet-owned outbound destination reputation evidence/policy with transport composition through the same immutable EgressWeave authority (#173); real attack-path CI and deployable public path (#11/#75); Agent Artifact Admission (#128/#129); PostgreSQL authority/tenant isolation (#80) then transactional outbox (#81); Keyverse identity/approval (#82) and distributed admission/trusted attribution (#83); proven Coraza/CRS and Suricata detection (#86); immutable release evidence (#84); telemetry/SLO/incident/restore (#85); final readiness against one immutable protected release identity (#87). +Current order remains authority/security before breadth: protected management authentication (#78/#155); immutable outbound policy/evidence integration (#79/#136 + EgressWeave release); Wardnet-owned outbound destination reputation evidence/policy with transport composition through the same immutable EgressWeave authority (#173); real attack-path CI and deployable public path (#11/#75); Agent Artifact Admission (#128/#129); PostgreSQL authority/tenant isolation (#80) then transactional outbox (#81); Keyverse identity/approval (#82) and distributed admission/trusted attribution (#83); proven Coraza/CRS and Suricata detection (#86); immutable release evidence (#84); telemetry/SLO/incident/restore (#85); final readiness against one immutable protected release identity (#87). The USD 20 billion ambition is a product-quality bar, not a customer contract value, billing field or runtime pricing authority. #162 owns that documentation separation. Root `src/lib.rs` remains a modularity pressure point, not evidence by itself for a deployable service split; prefer a modular monolith until transaction/isolation/scale/deployment/reusable-owner evidence pays for another boundary. ## Standards and release gate -Security and runtime decisions remain traceable to current authoritative NIST/OWASP/CWE/IETF/OCI/Linux sources and primary/peer-reviewed research where the implementation depends on them. Citation is design evidence, not proof that a control is shipped. Wardnet-owned production targets 100% statement/branch/edge-case coverage and complete public rustdoc/docstrings, with realistic bypass/replay/race/DoS/network/cleanup tests where applicable. +Security and runtime decisions remain traceable to current authoritative NIST/OWASP/CWE/IETF/OCI/Linux sources and primary/peer-reviewed research where implementation depends on them. Citation is design evidence, not proof that a control is shipped. Wardnet-owned production targets 100% statement/branch/edge-case coverage and complete public rustdoc/docstrings, with realistic bypass/replay/race/DoS/network/cleanup tests where applicable. -No Wardnet release is authorized at this snapshot. Release requires one exact integrated protected head with terminal current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact/source identity and a verified publication path. Protected `main@a52ccd0...` now has all three observed push validations terminal GREEN (CI, Scorecard, dynamic CodeQL), but that is only protected-head execution evidence: governance normal-vs-bypass admission remains unresolved, GitHub Releases is empty, and multiple mandatory product/security gaps above remain candidate-only. Feature-branch artifacts or attestations remain candidate evidence only. \ No newline at end of file +No Wardnet release is authorized at this snapshot. Release requires one exact integrated protected head with terminal current CI/security/coverage/docstrings/package/SBOM/provenance/reproducibility/review/migration/rollback/recovery/operability evidence, immutable artifact/source identity and a verified publication path. Protected `main@a52ccd0...` has observed push validations terminal GREEN, but governance normal-vs-bypass admission remains unresolved, GitHub Releases is empty, and multiple mandatory product/security gaps remain candidate-only. Feature-branch artifacts or attestations remain candidate evidence only. \ No newline at end of file