docs(gaps): refresh exact-head product evidence

[seonghobae]

Current documentation authority

This remains the Draft, documentation-only product/technical-gap baseline lane. Exact branch head remains 0c5336444f355ad1d9e5ce75c15413ecb61f2588; changed-file inventory is docs/product-technical-gap-baseline.md only and this PR is not merge/release authority.

The file's embedded 2026-09-13 20:27 KST overlay is a dated snapshot, not current authority. The live state superseding it is:

• protected main remains 83eba56149eb802cd63642c507c324c9976ec78e, protected with a valid verified signature;
• Customer Master security: separate resolved customer identity from source-post tenant ownership #1052/fix(customer-master): separate customer resolution from source ownership #1055 remains Draft at exact 50c4935eef1029467595f7004818643598b737c9; repository Tests/full PostgreSQL, Security, SAST and Strix are terminal GREEN while Required CodeQL/OpenCode/Noema remain non-GREEN at canonical owner boundaries;
• Strix 34746057545 completed SUCCESS but its artifact exposed a real Medium CWE-862 summary-read catalog mutation finding. security(summary): prevent post_read GET from mutating global corporate catalog #1078 is the canonical LineageWeave security owner;
• security(summary): prevent post_read GET from mutating global corporate catalog #1078 now has Draft source PR fix(security): gate summary shared-catalog enrichment #1079. Its causal product repair derives shared-catalog enrichment from post_admin, makes omission fail closed, forces reader Null hierarchy/verification clients, and makes reader team resolution lookup-only. The initial bounded source executor completed SUCCESS and was removed after publishing the product/docs/unit-test delta;
• review of fix(security): gate summary shared-catalog enrichment #1079 found an old API test that still expected reader-only summary GET to create/dedupe cataloged_team, so candidate validation is not yet admissible. A real PostgreSQL + Keycloak + Valkey reader/admin regression is being added on the same source lane. Its temporary patch job is currently queued without a runner; no GREEN claim transfers from predecessor heads;
• perf(catalog): release DB pool lease during hierarchy provider I/O #1077 remains the separate canonical corporate-catalog connection-lease/performance owner;
• fresh protected-main review found another distinct buyer-path lease defect now tracked as perf(summary): release DB pool lease during orchestrator derivation #1080: missing-summary GET retains one borrowed DB connection across body normalization and contextual-orchestrator summary derivation. perf(summary): release DB pool lease during orchestrator derivation #1080 is serialized after security(summary): prevent post_read GET from mutating global corporate catalog #1078 and stays distinct from perf(catalog): release DB pool lease during hierarchy provider I/O #1077;
• test(e2e): run authenticated FastAPI contract lane in hosted CI instead of service-wide skip #1057 retains real authenticated topology ownership and fix(release): synchronize protected v2.28 runtime identity #961/release: reconcile package and runtime version authority before next immutable release #1056 retain release/version ownership.

The prior bounded refresh workflow completed and removed itself before publishing 0c533644...; no helper remains on this docs branch. The baseline file itself still requires a new docs-only refresh before #1041 can claim code-current status. Do not edit competing product branches to refresh it.

Refs #963, #1052, #1056, #1057, #1077, #1078, #1079, #1080.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cwl-noema-review]

Noema LLM review

Documentation-only update refreshing the exact-head loop overlay with operational metadata and PR status. No code, configuration, or test changes; no security, correctness, or maintainability concerns identified. The new content is internally consistent and clearly marked as a non-authoritative operational snapshot.

Reviewed changed lines

• docs/product-technical-gap-baseline.md:3 (RIGHT): Adds a dated overlay header stating the protected main SHA and release version; purely informational.
• docs/product-technical-gap-baseline.md:4 (RIGHT): Provides live inventory counts (152 PRs, 28 issues) and explicitly labels them as operational metadata, not release evidence.
• docs/product-technical-gap-baseline.md:5 (RIGHT): States that all observed open PRs were Draft; clarifies skipped test jobs are not successful Checks.
• docs/product-technical-gap-baseline.md:6 (RIGHT): Describes PR #996 moving to Ready with squash auto-merge enabled; notes fresh tests and review are pending.
• docs/product-technical-gap-baseline.md:7 (RIGHT): References earlier CodeQL/Strix failures and requires an authoritative rerun; consistent with a conservative review stance.
• docs/product-technical-gap-baseline.md:8 (RIGHT): Lists prohibited actions (self-approval, Admin bypass, force push, stale-head transfer), reinforcing governance.
• docs/product-technical-gap-baseline.md:9 (RIGHT): Highlights the buyer-visible gap addressed by PR #996 and describes its intent without code references in this diff.

Adversarial validation

• docs/product-technical-gap-baseline.md:6 (RIGHT) falsified: The documentation inaccurately claims PR #996 was moved to Ready when it may still be Draft. — The change adds only markdown text; no CI or configuration changes could affect PR state. The statement is operational and cannot be contradicted by the diff alone.
• docs/product-technical-gap-baseline.md:16 (RIGHT) falsified: The document misleadingly implies that PR #996's code changes are part of this PR, while the diff only adds documentation. — The diff changes only docs/product-technical-gap-baseline.md; no API, schema, or code files are touched. The text is clearly a summary of an external PR's effect, not a claim about this PR's content.
• Residual risk: No remaining risks identified; the change is documentation-only with no executable impact and all claims are explicitly marked as operational/non-authoritative.

Findings

• No blocking findings.

• Result: APPROVE
• Head SHA: 8f7f54142afa9527da4996dc98ed1b4a745e6bd2
• Reviewer credential: noema-review-github-app-refresh
• Actor: cwl-noema-review[bot]

[seonghobae]

Live authority after the 16:54 KST file snapshot: #1055 exact 50c4935eef1029467595f7004818643598b737c9 now has repository Tests 34746058653 terminal SUCCESS including full PostgreSQL, Security 34746058657 SUCCESS, and SAST 34746058639 SUCCESS. Required CodeQL 34746058693, Required OpenCode 34746057593, and Required Noema 34746057619 are terminal FAILURE. Noema reached exact-head admission/credential/head-validation/visibility/CO-sidecar success, then failed at Prepare Noema model verdict; retained artifact id 10314028509, digest sha256:3e1362ba30338c8b605ffbed97795b01af7366961ab32669db1073f4ab21b199. Strix 34746057545 remains the only live validation lane and is executing Run Strix (quick). Therefore the embedded 16:54 overlay is now a dated snapshot, not current status. Keep this docs PR Draft; do not reinterpret the stale embedded statuses as merge/release authority. The next file refresh should carry these terminal states without duplicating #1057, .github#1929/#2106, .github#2045, or #961/#1056 ownership.

[seonghobae]

Live authority after the 16:54 KST embedded overlay

The file body remains a dated snapshot; current authority has advanced without changing protected main:

• fix(customer-master): separate customer resolution from source ownership #1055 remains exact 50c4935eef1029467595f7004818643598b737c9; Tests/Security/SAST are GREEN, Required CodeQL/OpenCode/Noema remain non-GREEN at canonical owner boundaries, and Strix 34746057545 / job 103694153476 is still genuinely in_progress. Keep the source head unchanged while that exact-head scan is live.
• feat(reports): leftover-map distance on grouping comparison graphic (v2.76.0) #859's eight stale comparison-only distance assertions have now been causally repaired on exact 2550e8d88339e30297fa0aa19ffae77f9b78b73b; its active descendant stack was non-force converged through feat(reports): leftover-map coordinate ticks on grouping comparison graphic (v2.77.0) #860→feat(reports): leftover-map axis share on leftover-axis ticks independently of leftover-map singular values (v2.91.0) #875, feat(reports): leftover-map item coordinates on leftover-map graphic leftover-map criterion markers independently of leftover-map post ξ markers (v2.92.0) #876/feat(reports): leftover-map origin on leftover-map comparison graphic leftover-map axis ticks independently of leftover-map axis share and leftover-map singular values (v2.92.0) #877 and test(reports): reconstruct #878 comparison criterion-coordinate contract #1033→test(reports): reconstruct #879 comparison post-coordinate contract #1034. feat(reports): leftover-map distance on grouping comparison graphic (v2.76.0) #859 is Draft because hosted validation identities did not reconcile on unchanged-head Ready; .github#2045 owns that canary. Historical feat(reports): leftover-map item coordinates on leftover-map comparison graphic leftover-map criterion markers independently of leftover-map post ξ markers (v2.93.0) #878/feat(reports): leftover-map person coordinates on leftover-map comparison graphic leftover-map post markers independently of leftover-map criterion leftover-map item coordinates (v2.94.0) #879 remain evidence/delta carriers rather than replay sources.
• New buyer-path resilience gap perf(catalog): release DB pool lease during hierarchy provider I/O #1077 records that canonical corporate-entity creation retains an asyncpg pool lease across hierarchy provider I/O even though its explicit transaction/advisory lock is correctly delayed. Acceptance is short DB snapshot lease → provider work with no DB lease → fresh under-lock recheck/write, preserving ADR 0010/0012/0160 and all existing callers. Do not fold this into Customer Master or contextual-orchestrator.

Do not label the 16:54 overlay current. Refresh the file itself after the live #1055 Strix lane settles or when the docs-only writer can publish a complete new snapshot without competing product source changes.

[seonghobae]

Live authority update for the gap baseline: #1078 is now broader than the initial Strix corporate-entity finding but remains one root-cause security owner. Fresh protected-main review proved post_summary_ingestion._replace_summary_projection also unconditionally upsert_team(...), so a post_read summary GET can mutate both shared corporate_entity and cataloged_team state. Source lease fix/summary-catalog-authorization-1078 is based on main@83eba56149eb802cd63642c507c324c9976ec78e; its bounded repair is queued and is designed to make reader materialization lookup-only for shared identities while preserving explicit post_admin enrichment. #1077 stays separate as DB connection-lease/performance ownership. Treat any older embedded baseline wording that names only corporate hierarchy mutation as a dated snapshot until the docs-only lane refreshes the file.