[Security] Enforce one canonical local-audio resource budget before analysis

[seonghobae]

Canonical implementation authority

Resource Admission & Decode의 단일 source owner는 PR #866입니다. Live source head는 0cb51e4d042a8f4cd5742086156a307bfe1ffac6, protected base는 develop@314ddeae7b775a4957594b599358c8255617eb2e이며 현재 Open / Ready / mergeable입니다. 이 bounded context를 다른 PR로 fan-out하지 않고 dependent/preservation delta는 완전 승계 전까지 닫지 않습니다.

#1116만 docs/product-technical-gap-baseline.md를 쓰고, #970은 durable Project Persistence, #1160은 protected/released Resource Admission + Project Persistence의 Active Player 소비를 소유합니다. #985는 M4A/commercial-decoder evidence를 계속 보존합니다. #1197의 projectId whitespace/dot invariant는 canonical #866에 독립 RED → 최소 fix로 승계됐고, predecessor branch 자체를 merge/cherry-pick하지 않았습니다.

Current exact GREEN

#866은 344b273c49758d46181511940c4ac16eaa04208b까지 owned-production Python statement/branch 100%와 unintended warning 0을 달성했습니다. 이후 preservation #1197의 remaining invariant를 canonical lane에서 직접 재현했습니다.

• RED f920a4c2acce56b8eaa43cff09c2d74098c45c0b: " .. ", " . ", " project-1 " 거부와 project-1, my..id 보존.
• GREEN 0cb51e4d042a8f4cd5742086156a307bfe1ffac6: leading/trailing whitespace와 stripped ./..를 canonical validator에서 fail closed 처리.

Exact 0cb51e4d...의 repository ci run 34666905678은 terminal SUCCESS입니다. Canonical quickcheck와 owned-production 100% coverage gate를 포함하며 build-baseline, Security Scan, SBOM, Semgrep 및 protected 14 required context가 current exact head에서 terminal-success evidence를 보유합니다. 이전 Strix in-progress 기록은 historical이며 current merge blocker가 아닙니다.

Fresh formal review inventory에는 exact 0cb51e4d...에 대한 qualifying non-author APPROVED가 없습니다. 과거 CHANGES_REQUESTED는 dismissed predecessor evidence이고 이후 제출은 COMMENTED입니다. Automated check success를 formal approval로 바꾸어 해석하거나 self/admin approval을 사용하지 않습니다.

Central CodeQL prerequisite — refreshed 2026-09-14

BandScope required direct Analyze (javascript-typescript) / Analyze (python)은 GitHub-managed dynamic CodeQL에서 current-head success evidence를 보유합니다. 별도 organization CodeQL PR compatibility/settlement는 central .github owner 경계이며 BandScope가 copied workflow, synthetic status, duplicate scanner 또는 gate weakening으로 우회하지 않습니다.

Protected .github/main은 현재 ebc69a4016f7668beaef5e3b592d378f22ada684입니다. Bootstrap owner .github#2106은 protected-main advance 14 commits를 ordinary reverse PR #2185로 non-force reconciliation하여 exact 4288590362282074d55ef874291ffc2ba884e93d가 되었고, base도 current protected main@ebc69a...입니다. 이전 handler tuple #2106@1ba96e.../828eaa.../34773233399와 그 repository_dispatch run은 ancestry 변경 전 historical evidence입니다.

그 old handler run은 runner가 배정되지 않은 채 queued였고, central repository 전체에도 대규모 Actions queue가 관찰됐습니다. Queue-only delay는 BandScope source defect가 아니므로 consumer lane에서 cancel/rerun/no-op freshness commit을 만들지 않습니다. 새 #2106 exact head가 생성한 fresh checks와 독립 review만 이후 prerequisite evidence가 될 수 있습니다. #2106 bootstrap protected integration 후 #2040 producer/consumer rollout도 ordinary ancestry와 exact-head validation을 거쳐야 합니다.

Repository-wide warning-free/commercial acceptance는 별도 owner가 계속 소유합니다: clean npm ci moderate advisories는 #1206, production JS >500 kB warning은 #1208, GHAS configuration-comparison continuity는 #1209입니다. #866에 unrelated dependency/frontend/control-plane churn을 섞지 않습니다.

Next acceptance

1. fix(audio): establish canonical local-audio resource policy #866 source 0cb51e4d...를 새 source-backed finding이 없는 한 그대로 보존합니다.
2. Central #2106의 new exact head 428859...과 이후 #2040 rollout이 정상 protected integration되는지 fresh live metadata로 검증합니다. Queue-only 상태는 lane-local wait이며 BandScope rerun 사유가 아닙니다.
3. Unchanged fix(audio): establish canonical local-audio resource policy #866 current head에 대한 qualifying independent non-author approval을 확보하고, 그 review에서 valid finding이 나오면 같은 canonical lane에서 RED → minimal fix → exact-head GREEN으로 수리합니다.
4. Protected 14 required contexts, central settlement/evidence, independent approval, zero unresolved actionable threads를 같은 final fix(audio): establish canonical local-audio resource policy #866 identity에서 만족한 경우에만 normal protected merge합니다.
5. #1197과 #1194는 successor가 protected merge까지 source/test/contract/evidence를 완전 승계한 뒤에만 preservation close 후보가 됩니다. #985는 M4A/commercial-decoder capability가 별도로 충족되기 전에는 닫지 않습니다.
6. Protected fix(audio): establish canonical local-audio resource policy #866 이후 fix(project): stage saves before atomic publication #970 crash-safe Project Persistence → feat(player): admit and bind playable stem artifacts #1160 Active Player consumption 순으로 ordinary non-force reconciliation합니다.

Persistence and commercial boundary

Feature-cache manifest-last ordering은 content-generation binding이지 fsync-backed final rehearsal-result crash durability가 아닙니다. Final result cache, project restart/recovery, stale generation rejection은 Project Persistence owner에서 처리합니다.

Windows에는 race-free Job Object containment가 남아 있습니다. Rights-cleared full-length rehearsal audio로 cancellation latency, inherited handle/pipe return, abnormal-child cleanup, decoder/resampler/downstream peak RSS/VRAM, explicit CPU/GPU budgets, recognized MIR reproducibility metrics를 입증해야 합니다.

#866은 Ready이지만 아직 merge-authorized가 아닙니다. UI Delivery Gate: FAIL / Commercial Release Gate: FAIL. #1129, #1180, #1181은 각각 format/licensing, immutable model/update, separation-model commercial-rights owner boundary를 유지합니다.

[seonghobae]

Residual after ccda5980d8c40cab5a88c39148e19775c35e311d: stable caches missing separation.duration_seconds now fail closed, but this is not metadata-generation atomicity. The outer API retains the first metadata snapshot while archive admission performs a second read, so first-read/second-read replacement remains in scope for the immutable manifest/generation contract. Bind metadata + private NPZ replay bytes + #970-owned admitted-source digest/reference; do not add pathname/timestamp identity as a competing authority.

[seonghobae]

#866 current Resource Admission repair has advanced normally to exact 3476e31fa19df269efa6bbf6c767e539ce81335c on protected develop@314ddeae7b775a4957594b599358c8255617eb2e.

Fresh parser finding: persisted feature-cache JSON could contain duplicate object member names and Python's ordinary dictionary materialization could collapse them before semantic admission. RED c7721839fb31dcb6cb5720f03bf24ee73250b05b covers duplicate top-level schemaVersion and nested separation.duration_seconds. Production 10f7a369ef1277d8a50e6db2a80047185b35a6af uses one object_pairs_hook to reject duplicate members at every JSON object depth; the existing bounded ValueError path turns the sidecar into a cache miss. Doctoring/current descendant 3476e31fa19df269efa6bbf6c767e539ce81335c records RFC 8259/Python parser rationale and rejected first/last-wins alternatives.

This closes duplicate-member representation ambiguity only. It does not bind the first metadata snapshot, private NPZ snapshot, and native verified source digest into one immutable generation. The versioned manifest/generation remains the next persistence prerequisite. Hosted RED and exact-head Python GREEN are not claimed yet; #1176 remains sole owner of the inherited protected-base Ruff formatter prerequisite.

[seonghobae]

Fresh exact-head authority for canonical #866 remains 9bba38562b7827edeac0e5c6c82a0b992fc3ced5 on protected develop@314ddeae7b775a4957594b599358c8255617eb2e.

Repository ci run 34386371232, job 102583699528, has now been read at raw-log level. It passes docs/Security Notes/security-pattern/supply-chain/GitHub-bootstrap/workspace ESLint/Python docstrings and uv run ruff check src tests, then repository-pinned Ruff 0.15.5 fails only at ruff format --check src tests for the five #866-owned files already named in this issue; pytest is not reached. test_supply_chain_policy.py is confirmed out of the failure set after the ordinary #1176 ancestry adoption. A canonical existing-branch OpenCode repair has been requested for those five files only; no competing PR, self-modifying formatter workflow, rebase/force-push, or gate weakening is being used.

CodeQL is a separate central-owner condition, not a BandScope source finding. Run 34386371122 successfully dispatches exact-head scans, then compatibility shards fail closed only because authenticated codeql-dispatch/<language> terminal verdicts remain pending. Fresh BandScope evidence has been handed to ContextualWisdomLab/.github#1929; do not rerun the compatibility shards before a terminal owner verdict because their own attempt>1 contract rejects a rerun without that verdict.

Current exact-head build-baseline, SBOM, Security Scan, and SAST Semgrep are terminal-success. Keep #866 Draft until formatter repair reaches causal pytest evidence, central required gates are terminal, and a qualifying independent current-head approval exists.

[seonghobae]

Fresh Resource Admission authority update: canonical #866 is still exact 9bba38562b7827edeac0e5c6c82a0b992fc3ced5, Draft/open/mergeable on protected develop@314ddeae7b775a4957594b599358c8255617eb2e. Raw exact-head CI reaches Ruff 0.15.5 and stops at ruff format --check src tests with exactly five #866-owned files; pytest is not reached. A same-branch formatter-only repair has been dispatched with no gate weakening or foreign-file edits.

Fresh overlap audit found #1197 (48b58ab05fa02563e07c44069ff7300837168ee0) mixed three owners. It has been converted to Draft. Its unique projectId whitespace admission regression is valid and must succeed into #866 after the formatter repair: current #866 rejects exact ./.. and separators but still admits leading/trailing whitespace. #1197's test_supply_chain_policy.py formatter delta remains #1176 ownership. Its setuptools CVE-2026-59890 floor is valid supply-chain work, but the current lock regeneration also drifts Torch 2.12.1→2.14.0 plus Triton/CUDA/cuDNN/NCCL; that ML-stack drift is not acceptable as incidental CVE repair and has been sent back for a minimal setuptools-only resolution if solvable. No #1197 checks/reviews transfer to #866.

[seonghobae]

2026-09-10 KST owner sweep: canonical #866 remains exact 9bba38562b7827edeac0e5c6c82a0b992fc3ced5, Draft/open, with repository CI still stopping before pytest at Ruff 0.15.5 formatting of the five Resource Admission-owned files already named in this issue. I re-dispatched only that formatter-equivalent repair on the existing #866 branch and separately requested an independent exact-head OpenCode verdict; no new source writer, retry commit, rebase, force-push, or gate bypass was created. Preservation authority was repaired in #985 so it no longer treats an old #866 Draft SHA or the now-implemented feature metadata/NPZ/source manifest as current truth; its unsuperseded M4A evidence remains preserved. #1194 authority was likewise refreshed to current #866 semantics and remains open until successor exact-head GREEN proves complete succession. Next causal source order remains: five-file Ruff descendant → first real pytest result → canonical projectId whitespace RED/fix from #1197 → final rehearsal-result generation binding.

[seonghobae]

Canonical live correction for #781: #866 is now exact 43938abaab610a67a1e68d5298d39849a8544fe7 on protected develop@314ddeae7b775a4957594b599358c8255617eb2e, not the older ceaca95f... state in the issue body. Ordinary descendants 0b23a19... and 43938... add focused traceback/path-leak regressions and the bounded traceback-free logging repair. Fresh hosted ci run 34564617166, job 103154639731 passes docs/Security Notes/security-pattern/supply-chain/GitHub-bootstrap/docstrings and Ruff 0.15.5 check, then fails first at Ruff format only: src/bandscope_analysis/api.py would be reformatted (1 file would be reformatted, 130 files already formatted). pytest/coverage therefore has not run on this exact head. The existing canonical writer has the exact pinned-formatter-only repair instruction; do not start a competing source writer. Producer/replay feature-cache admission symmetry remains the next semantic finding, then real Python 100%, then #1197 focused projectId whitespace succession.