fix(kpi): bind strict provenance to exact log bytes - #105
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughKPI 로그 수집기가 NDJSON 레코드 수, ChangesKPI 로그 provenance 강화
Estimated code review effort: 4 (Complex) | ~45 minutes Mergeability Score: ⚪ Minimal · up to The PR binds KPI results to exact retained log bytes and fails closed when strict evidence cannot be retained; no actionable merge-blocking risk remains after normal checks and review. Sequence Diagram(s)sequenceDiagram
participant Collector as collect-kpi-logs.sh
participant LogFile as KPI log file
participant Provenance as provenance JSON
participant Gate as kpi-gate.mjs
participant Snapshot as read-only snapshot
participant KPI as KPI checks
Collector->>LogFile: 로그 스트리밍
LogFile-->>Collector: 레코드와 바이트
Collector->>Provenance: records, logSha256, logBytes 기록
Gate->>Provenance: provenance 로드 및 형식 검증
Gate->>LogFile: 로그 identity 계산
LogFile-->>Gate: SHA-256 해시 및 바이트 수
Gate->>Snapshot: 검증된 로그 복사
Gate->>KPI: 스냅샷으로 KPI 검사 실행
Gate->>LogFile: 최종 로그 identity 재계산
Gate->>Provenance: identity 일치 여부 검증
Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/kpi-gate.mjs`:
- Around line 116-143: Update the KPI execution flow around the initial
provenance identity check to create a permission-restricted temporary snapshot
after validating the original log identity, then compare the snapshot identity
with provenance and pass the snapshot path to every KPI subcheck instead of
logPath. Ensure cleanup handles the snapshot on success and failure, add a
regression test covering replacement and restoration of the original file during
checks, and revise the observability KPI documentation to describe the
snapshot-based file-change guarantee.
In `@test/kpi-gate.test.ts`:
- Around line 169-189: Extend the regression coverage around the “rejects
malformed strict provenance log identity” test using a valid lowercase
64-character logSha256, and add separate cases for missing logBytes, logBytes
set to 0, and a non-safe-integer value. Each case should invoke runKpiGate and
assert status 1 plus the exact “logBytes must be a positive safe integer”
message, while preserving the existing cleanup and protocol assertions.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 4d97206d-478d-4cf9-b33d-54108a8463b4
📒 Files selected for processing (5)
docs/observability-kpi.mdscripts/collect-kpi-logs.shscripts/kpi-gate.mjstest/kpi-collect.test.tstest/kpi-gate.test.ts
|
@coderabbitai review Please review the current exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='41fa0f7b32e386203fefa19c823ca043c8495407'
actual="$(git rev-parse HEAD)"
printf 'HEAD=%s\nEXPECTED=%s\n' "$actual" "$expected"
git status --short
git diff --check "${expected}^" "$expected"
git diff --find-renames --unified=80 "${expected}^" "$expected" -- \
docs/observability-kpi.md \
scripts/collect-kpi-logs.sh \
scripts/kpi-gate.mjs \
test/kpi-collect.test.ts \
test/kpi-gate.test.ts
printf '\n== Source outlines ==\n'
ast-grep outline scripts/kpi-gate.mjs --items all
ast-grep outline test/kpi-gate.test.ts --items all
ast-grep outline test/kpi-collect.test.ts --items all
printf '\n== Identity-related references ==\n'
rg -n -C 5 -P '\b(logSha256|logBytes|loadProvenance|createHash|statSync|readFileSync|verified|snapshot)\b' \
scripts/kpi-gate.mjs scripts/collect-kpi-logs.sh test/kpi-gate.test.ts test/kpi-collect.test.ts docs/observability-kpi.mdLength of output: 29804 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== kpi-gate strict-mode control flow =='
sed -n '1,230p' scripts/kpi-gate.mjs
sed -n '219,390p' scripts/kpi-gate.mjs
printf '%s\n' '== kpi-gate regression tests =='
sed -n '1,420p' test/kpi-gate.test.ts
printf '%s\n' '== collector and collector tests =='
sed -n '1,150p' scripts/collect-kpi-logs.sh
sed -n '1,180p' test/kpi-collect.test.ts
printf '%s\n' '== parent version for changed strict-gate behavior =='
git show '41fa0f7b32e386203fefa19c823ca043c8495407^:scripts/kpi-gate.mjs' | sed -n '1,430p'
printf '%s\n' '== references to strict gate invocation and provenance shape =='
rg -n -C 4 -P '\b(kpi-gate|kpi:verify:strict|NOEMA_KPI_STRICT|logSha256|logBytes)\b' \
package.json scripts test .github 2>/dev/null || trueLength of output: 64781 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='41fa0f7b32e386203fefa19c823ca043c8495407'
printf '%s\n' '== Pull request metadata =='
gh pr view 105 --repo ContextualWisdomLab/noema --json baseRefName,baseRefOid,headRefName,headRefOid,commits,files \
--jq '{baseRefName,baseRefOid,headRefName,headRefOid, commits: [.commits[] | {oid,messageHeadline}], files: [.files[] | {path,additions,deletions}]}' \
|| true
base="$(git merge-base "$head" "origin/HEAD" 2>/dev/null || true)"
if [[ -z "$base" ]]; then
base="$(git merge-base "$head" "origin/main" 2>/dev/null || true)"
fi
printf 'MERGE_BASE=%s\n' "$base"
if [[ -n "$base" ]]; then
git diff --check "$base" "$head"
git diff --name-status "$base" "$head"
git diff --unified=100 "$base" "$head" -- test/kpi-provenance-snapshot.test.ts scripts/kpi-gate.mjs
fi
printf '%s\n' '== Dedicated snapshot and byte-size regressions =='
ast-grep outline test/kpi-provenance-snapshot.test.ts --items all
sed -n '1,360p' test/kpi-provenance-snapshot.test.ts
printf '%s\n' '== Test and coverage configuration =='
sed -n '1,220p' package.json
fd -HI 'vitest*' . --exclude node_modules --exclude .git -x sh -c 'echo "== $1 =="; sed -n "1,240p" "$1"' sh {}Length of output: 30631
P2 — Test a valid but mismatched Add a case where provenance has the correct The verified-snapshot flow is otherwise consistent with the documented boundary. Strict mode validates the original bytes, validates the private snapshot bytes, passes only the snapshot path to KPI child processes, and rechecks the original bytes after child execution. The snapshot-race regression correctly exercises replacement and restoration of the original log during child processing. This is diagnostic review evidence only. It is not merge approval authority.
|
|
@coderabbitai review Please review the current exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='61b8c152698d2833fda6dfbb4a1b0dc951f468cd'
printf '%s\n' '== Exact revision and working tree =='
printf 'HEAD=%s\nREQUESTED=%s\n' "$(git rev-parse HEAD)" "$head"
git status --short
git cat-file -e "${head}^{commit}"
git diff --check "${head}^" "$head"
printf '%s\n' '== Changed files and patch =='
git diff --name-status "${head}^" "$head"
git diff --find-renames --unified=100 "${head}^" "$head" -- \
scripts/collect-kpi-logs.sh \
scripts/kpi-gate.mjs \
test/kpi-collect.test.ts \
test/kpi-gate.test.ts \
test/kpi-provenance-snapshot.test.ts \
docs/observability-kpi.md
printf '%s\n' '== Source maps =='
ast-grep outline scripts/kpi-gate.mjs --items all
ast-grep outline test/kpi-gate.test.ts --items all
ast-grep outline test/kpi-provenance-snapshot.test.ts --items all
ast-grep outline test/kpi-collect.test.ts --items all
printf '%s\n' '== Relevant definitions, invocation sites, and documentation =='
rg -n -C 5 -P '\b(logSha256|logBytes|records|loadProvenance|createHash|createReadStream|snapshot|verified|kpi-gate|collect-kpi-logs)\b' \
scripts test package.json docs .github 2>/dev/null || trueLength of output: 170400 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== Strict gate execution and identity functions =='
sed -n '1,220p' scripts/kpi-gate.mjs
sed -n '219,385p' scripts/kpi-gate.mjs
printf '%s\n' '== Collector tests =='
sed -n '1,180p' test/kpi-collect.test.ts
printf '%s\n' '== Strict gate provenance tests =='
sed -n '1,360p' test/kpi-gate.test.ts
printf '%s\n' '== Snapshot integrity tests =='
sed -n '1,220p' test/kpi-provenance-snapshot.test.ts
printf '%s\n' '== Exact logBytes mismatch regression search =='
rg -n -C 6 -P '(logBytes\s*[:=].*(\+|\-)|logBytes.*identity does not match|identity does not match.*logBytes|mismatched.*logBytes|logBytes.*mismatch)' \
test scripts docs 2>/dev/null || true
printf '%s\n' '== Commit ancestry and focused parent comparison =='
git show --no-patch --format='commit=%H%nauthor=%an%ndate=%cI%nparents=%P%nsubject=%s' HEAD
git diff --unified=80 '61b8c152698d2833fda6dfbb4a1b0dc951f468cd^' \
'61b8c152698d2833fda6dfbb4a1b0dc951f468cd' -- test/kpi-collect.test.ts test/kpi-provenance-snapshot.test.ts scripts/kpi-gate.mjsLength of output: 33917
I found one regression-coverage gap. P2 — Add a valid mismatched Add a case that retains the correct The changed-log test in The collector change is otherwise correct. The verified-snapshot flow is also consistent. Strict mode validates the original log identity, validates the copied read-only snapshot identity, passes only the snapshot path to KPI child processes, and rechecks the original identity after child execution. This is diagnostic review evidence only. It is not merge approval authority.
|
|
@coderabbitai review Please review the unchanged current exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='5b97a85004fe05e553150a63351d7b0a5a2cfc82'
printf '%s\n' '== Exact revision =='
printf 'HEAD=%s\nREQUESTED=%s\n' "$(git rev-parse HEAD)" "$head"
git cat-file -e "${head}^{commit}"
git status --short
git show --no-patch --format='commit=%H%nparents=%P%nsubject=%s' "$head"
printf '%s\n' '== PR metadata and merge-base diff =='
gh pr view 105 --repo ContextualWisdomLab/noema \
--json baseRefOid,headRefOid,files \
--jq '{baseRefOid,headRefOid,files:[.files[]|{path,additions,deletions}]}' || true
base="$(git merge-base "$head" origin/main 2>/dev/null || true)"
printf 'MERGE_BASE=%s\n' "$base"
if [[ -n "$base" ]]; then
git diff --check "$base" "$head"
git diff --name-status "$base" "$head"
git diff --unified=100 "$base" "$head" -- \
scripts/collect-kpi-logs.sh \
scripts/kpi-gate.mjs \
test/kpi-collect.test.ts \
test/kpi-gate.test.ts \
test/kpi-provenance-snapshot.test.ts \
docs/observability-kpi.md
fi
printf '%s\n' '== Source outlines =='
ast-grep outline scripts/kpi-gate.mjs --items all
ast-grep outline test/kpi-collect.test.ts --items all
ast-grep outline test/kpi-gate.test.ts --items all
ast-grep outline test/kpi-provenance-snapshot.test.ts --items all
printf '%s\n' '== Focused source and tests =='
sed -n '1,240p' scripts/collect-kpi-logs.sh
sed -n '1,430p' scripts/kpi-gate.mjs
sed -n '1,260p' test/kpi-collect.test.ts
sed -n '1,420p' test/kpi-gate.test.ts
sed -n '1,300p' test/kpi-provenance-snapshot.test.ts
sed -n '1,240p' docs/observability-kpi.md
printf '%s\n' '== Targeted regression and invocation search =='
rg -n -C 5 -P '\b(logSha256|logBytes|records|snapshot|identity does not match|unterminated|createReadStream|createHash|kpi-gate)\b' \
scripts test docs package.json .github 2>/dev/null || trueLength of output: 230239
I found one regression-coverage gap. P2 — Test a valid mismatched Add a case that preserves the correct This test proves that strict identity comparison uses The implementation otherwise matches the stated contract:
Static inspection verified the requested exact head and passed This is diagnostic review evidence only. It is not merge approval authority.
|
|
@coderabbitai review Please review the unchanged current exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='b4055f30bbe1d93891cba04d909b183e6503e505'
printf '%s\n' '== Exact revision =='
printf 'HEAD=%s\nREQUESTED=%s\n' "$(git rev-parse HEAD)" "$head"
git cat-file -e "${head}^{commit}"
git status --short
git show --no-patch --format='commit=%H%nparents=%P%nsubject=%s' "$head"
printf '%s\n' '== PR metadata and merge-base change set =='
gh pr view 105 --repo ContextualWisdomLab/noema \
--json baseRefOid,headRefOid,files \
--jq '{baseRefOid,headRefOid,files:[.files[]|{path,additions,deletions}]}' || true
base="$(git merge-base "$head" origin/main 2>/dev/null || true)"
printf 'MERGE_BASE=%s\n' "$base"
if [[ -n "$base" ]]; then
git diff --check "$base" "$head"
git diff --name-status "$base" "$head"
git diff --unified=100 "$base" "$head" -- \
scripts/kpi-gate.mjs \
scripts/collect-kpi-logs.sh \
test/kpi-gate.test.ts \
test/kpi-provenance-snapshot.test.ts \
test/kpi-collect.test.ts \
docs/observability-kpi.md
fi
printf '%s\n' '== Source maps =='
ast-grep outline scripts/kpi-gate.mjs --items all
ast-grep outline test/kpi-gate.test.ts --items all
ast-grep outline test/kpi-provenance-snapshot.test.ts --items all
ast-grep outline test/kpi-collect.test.ts --items all
printf '%s\n' '== Strict mode and evidence retention =='
rg -n -C 8 -P '\b(NOEMA_KPI_EVIDENCE_PATH|evidence|PASS|process\.exit|exitCode|writeFile|writeFileSync|loadProvenance|logSha256|logBytes|snapshot|records)\b' \
scripts/kpi-gate.mjs scripts/collect-kpi-logs.sh test/kpi-gate.test.ts test/kpi-provenance-snapshot.test.ts test/kpi-collect.test.ts docs/observability-kpi.md
sed -n '1,460p' scripts/kpi-gate.mjs
sed -n '1,460p' test/kpi-gate.test.ts
sed -n '1,320p' test/kpi-provenance-snapshot.test.ts
sed -n '1,240p' test/kpi-collect.test.ts
sed -n '1,260p' docs/observability-kpi.md
printf '%s\n' '== Cited workflow runs =='
for run in 31417456928 31417626486 31417626505 31417626428; do
gh run view "$run" --repo ContextualWisdomLab/noema \
--json databaseId,headSha,workflowName,status,conclusion,event,url \
--jq '{databaseId,headSha,workflowName,status,conclusion,event,url}' || true
doneLength of output: 156181
I found one regression-coverage gap. P2 — Test a valid mismatched Add a case that keeps the correct This test proves that strict identity comparison uses The strict evidence-retention repair is correct by static inspection:
The existing provenance boundary remains consistent:
Static inspection verified the requested head. The cited application CI RED run This is diagnostic review evidence only. It is not merge approval authority. You are interacting with an AI system. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/kpi-gate.mjs`:
- Around line 376-383: Import constants from node:fs instead of node:crypto and
use fs.constants.O_NOFOLLOW in persistEvidence() when opening the evidence file.
Update the symlink test to preserve the target file and assert that the strict
execution exits with status 1.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 83d885f9-ae96-436c-ad66-2a715c46fb1d
📒 Files selected for processing (6)
docs/observability-kpi.mdscripts/collect-kpi-logs.shscripts/kpi-gate.mjstest/kpi-collect.test.tstest/kpi-gate.test.tstest/kpi-provenance-snapshot.test.ts
🚧 Files skipped from review as they are similar to previous changes (1)
- scripts/collect-kpi-logs.sh
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/kpi-collect.test.ts`:
- Line 136: Update both relevant tests in the provenance failure cases to also
assert that logPath does not exist, alongside the existing provenancePath
assertions. Preserve the current token non-disclosure and protocol-related
assertions while adding coverage for the absence of log files after URL
validation or HTTP failure.
- Line 135: Update the verify pipeline in scripts/collect-kpi-logs.sh so both
non-HTTPS URL and HTTP-error validation failures propagate exit status 1 to the
caller. Preserve the existing success status behavior and do not weaken the
assertions in test/kpi-collect.test.ts.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 146c25f5-9a88-4a7e-beb6-5f74dc50fdf0
📒 Files selected for processing (2)
scripts/kpi-gate.mjstest/kpi-collect.test.ts
🚧 Files skipped from review as they are similar to previous changes (1)
- scripts/kpi-gate.mjs
1 participant
Purpose
Test-first repair for #104: strict production KPI evidence must be bound to the exact retained
exchange-30d.ndjsonbytes that are scored. The gate authenticates exact bytes, scores a verified private snapshot rather than a mutable original path, derives provenance record count/digest/byte size from one retained-byte stream, and fails closed when an explicitly configured strict evidence sink cannot retain the result.Exact source identity
mainatc85d710804139c0697d7ef8fa47d02b1389e6d84;fix/kpi-provenance-integrity-on-main;a8fc068f0b3a2bdad3a72db4d3f6018dfaf18f20;e12e41d33b1b0d2cea9dfbb42550e94f850cac7b;b9c51582ab701f6851ee65e0f9283e90f5c6e53f;e80c6a8541b480cd7c381c7042ea9e233863dd20;676f31190226f1e9ebf566fc0914eb2666efd257;61b8c152698d2833fda6dfbb4a1b0dc951f468cd;807a867600249a1101e52965de47ed81f77e48e1;b4055f30bbe1d93891cba04d909b183e6503e505;logBytesmismatch regression coverage:825dd9b8c3f19270602735a0c78a417fe7213345.RCA -> RED -> GREEN
1. Provenance-to-evidence identity
Collection originally retained source metadata but did not authenticate the exact scored bytes. The repair records exact SHA-256 plus byte size and validates both before scoring.
2. Replace-score-restore TOCTOU
A start/end identity comparison was insufficient: a process could replace the original log after initial verification, allow KPI child checks to score different bytes, and restore the original before the final identity check.
The deterministic RED at
b9c51582ab701f6851ee65e0f9283e90f5c6e53fuses a Node preload hook only in KPI child processes to replace the original log with a failing log and restore it on child exit. Application CI run31414867826, job93541377446, checked out that exact head and failed exactly the new snapshot-race regression; the other 652 tests passed.The narrow GREEN validates original SHA-256 and positive safe-integer byte size, copies verified source bytes into a process-private temporary snapshot, sets mode
0400, recomputes snapshot identity, passes only the verified snapshot to KPI child checks, retains a final original-path identity check, and removes temporary bytes on normal completion/process exit. This stabilizes scored bytes against original-path replacement/restoration without claiming an OS privilege boundary against same-account/higher-privilege tampering.3. Record-count/data-integrity boundary
Fresh collector inspection found shell
wc -lcomputedrecordsbefore a separate Node pass computedlogSha256/logBytes. An unterminated final NDJSON record therefore producedrecords: 0even though one valid record existed, and count versus digest/byte metadata came from separate reads.Exact RED
676f31190226f1e9ebf566fc0914eb2666efd257/ application CI31415905532, job93544736430, failed exactly the count regression while 653 tests passed. GREEN61b8c152698d2833fda6dfbb4a1b0dc951f468cdremoveswc -lauthority and derivesrecords,logSha256, andlogBytesfrom one retained-byte stream, including a final non-empty unterminated record.4. Strict evidence-retention boundary
Fresh exact-head inspection found
persistEvidence()logged anNOEMA_KPI_EVIDENCE_PATHwrite error but swallowed it, so strict mode could still exit0and emitPASSwhile explicitly configured retained evidence did not exist.RED
807a867600249a1101e52965de47ed81f77e48e1configures the evidence destination as a directory so persistence deterministically fails. Application CI run31417456928, job93549720229, checked out that exact head and failed only the new regression (statuswas0, expected1); 654 other tests passed.GREEN
b4055f30bbe1d93891cba04d909b183e6503e505makes evidence persistence return success/failure and requires successful retention before strict mode may emit finalPASS. Non-strict optional-evidence behavior is unchanged; already-failing strict paths remain failing even if best-effort diagnostic evidence cannot be written.5. Positive
logBytesidentity mismatch coverageA diagnostic review of exact head
b4055f30bbe1d93891cba04d909b183e6503e505found a current regression-coverage gap: missing/zero/unsafelogBytescases proved field validation, but no test kept a valid digest while supplying a different positive safe-integer byte size to prove the actual identity-mismatch path.Current head
825dd9b8c3f19270602735a0c78a417fe7213345adds that focused case. The provenance keeps the correct SHA-256, incrementslogBytesby one, and requires strict failure withKPI log identity does not match production provenance.No production implementation change was needed because the existing exact identity check already fails closed.Current exact-head technical evidence
For unchanged exact head
825dd9b8c3f19270602735a0c78a417fe7213345:cirun31418085423: terminal success;reviewer-cirun31418085451: terminal success;Security Scanrun31418085400: terminal success under current protected-base scanner semantics;b4055f30bbe1d93891cba04d909b183e6503e505is addressed by current head825dd9b8c3f19270602735a0c78a417fe7213345;COMMENTEDon much earlier predecessor43054db5bc8486d56db77bd17f2371d633e678a5, not qualifying independent approval;main.The ordinary release verification still treats absent real production KPI input as non-operational evidence. Acquisition evidence remains fail closed where real production, release/deployment, customer/revenue, owner/legal and transfer evidence is absent.
Evidence boundary
This change authenticates and stably scores the exact retained bytes supplied to the KPI gate, keeps provenance record/digest/byte metadata coherent for one retained-byte stream, prevents configured strict evidence-retention failure from producing a successful process result, and explicitly tests a valid-but-wrong byte count. It does not authenticate the upstream Logpush/archive provider, prove 30 days of real production operation, establish deployment/release state, provide customer/revenue evidence, choose an outbound license, establish owner/legal/IP-transfer authority, or turn the temporary snapshot into an OS privilege boundary.
Merge authority
Technical exact-head success is not merge authority. Live enforceable governance under #27 and the qualifying independent non-author formal-review path under #29 remain fail-closed where required. No self-approval, protection weakening, synthetic status, release, deployment or acquisition-readiness claim is made.
Related: #3, #5, #27, #29, #104
Summary by CodeRabbit
개선 사항
문서