ci: preserve integration acceptance through protected main migration

[seonghobae]

Live integration/governance state — 2026-09-09 KST

Accepted Context Fabric integration/default target remains protected main, while fresh EA metadata still reports default_branch=develop. develop@dd71e40a86385fb7861b0f1be19891a3f3e29ece remains protected; main@ca6889497728e1a3f09d68790a9096576e13a3ff remains unprotected/non-default. Organization ruleset 18156473 still follows ~DEFAULT_BRANCH, with bare required_approving_review_count=1, no named/code-owner/last-push reviewer, required thread resolution and central workflows, deletion/non-fast-forward protection, and routine OrganizationAdmin/always bypass. .github#1137 owns protect-main-first/default migration, .github#772 owns the narrow solo-maintainer review/bypass repair, .github#712 owns workflow materialization/dispatch defects, and .github#810 owns Dependency Review availability.

The central owner repair remains Draft .github#1644@e35cdc5d6527dfa8634654719a6c3681f16ed82a on protected .github/main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db. Its current receipt states that live repository defaults/protection/rulesets/dependency-graph settings were not mutated and privileged owner-plane apply remains disabled pending the separately provisioned least-privilege Administration-write environment. Source validation does not imply owner-plane apply evidence.

Draft integration root #21@7231e58cd10d55c936ca08fb4f806af2a23bf247 and DDD parent #39@cd2a2471a53e34c5442aaf7194fb0a74df23b732 remain dependency anchors until reconstruction. Current Context Fabric/quarantine child is Draft/mergeable #40@6bbdadddca345ba6eb33ad86e3fba99f417ad529, directly stacked on exact #39@cd2a2471a53e34c5442aaf7194fb0a74df23b732. Fresh exact-head Actions lookup returns workflow_runs=[]; no predecessor checkout/PostgreSQL/coverage/package/runtime/security/SBOM/provenance evidence transfers.

Current Context Fabric projection candidate

#40 preserves the EA Decision Plane and foreign-authority boundary. The executable Quarantine Sandbox Runtime connector requires ContextualWisdomLab/quarantine-sandbox-runtime, ea_core_owns=false, independent reusable deployment, application-service lease/session lifecycle and artifact-analysis evidence capabilities, ContextualWisdomLab/contextual-orchestrator -> application_service_lease, and ContextualWisdomLab/wardnet -> artifact_analysis_evidence. It forbids direct foreign database access/source copy and rejects malware_verdict / artifact_risk_score as authoritative EA facts.

Fresh read-only producer anchors are root Draft quarantine-sandbox-runtime#1@5c6a44bb2b35eb17d0315d72db242f4488c3c426, application-service Draft #6@8daab565bba1b61e605488c080eb28de371990a3, and artifact-analysis worker/lifecycle Draft #70@da2e9e1616232e0e3c1f521d43eabe03213ce4ea. #6 is currently stale/non-mergeable against the moving root and is mutable caller-scoped lease evidence only. #70 supersedes prior 34de52819549e0362ebcd0a110a361146b3556d1; native CI 34319241574 on exact da2e9e... proved exact checkout/dependency-lock/repository-policy/coverage-parser/rustfmt plus hosted negative rootless/AppArmor evidence, while broad verify/coverage remained non-GREEN and positive effective-LSM remained queued. None of these producer heads is release authority.

Fresh source reinspection corrected the preceding lifecycle diagnosis. _connector_catalog_contracts.py::_validate_quarantine_runtime_boundary() already owned and enforced application_service_session_lifecycle=caller_scoped_lease; the public connector_catalog.py facade redundantly defined the same lifecycle constant/helper/check. RED f6ff8a1b0240beb74da69fba993d78b59127f81c adds a fitness assertion that this domain invariant has one production owner. Minimum production candidate 6bbdadddca345ba6eb33ad86e3fba99f417ad529 removes only the duplicate facade constant/helper/call while retaining the canonical private validator and existing hostile semantic rejection of embedded_caller_session. Fresh Actions lookup for both the RED and current candidate returns zero runs, so this is source-level RED -> minimum-candidate evidence only; hosted/full GREEN is not claimed.

The inherited generic connector-direction repair remains valid source candidate evidence: missing or unknown direction_code values cannot bypass Context Graph dependency/preserved-semantics validation. Noema remains foreign Agent Runtime authority and package/repository connector validation fails closed on ea_core_owns=true. AppGuardrail remains an external security-evidence producer; its ACL requires explicit observed/inferred projection truth and cannot promote scanner/model output to EA authoritative truth. Projection migrations remain fail closed against fabricating exact Context Assertion admission history for provisional rows.

Current CGC dependency

Current CGC Context Assertion is Draft/unreleased #21@238773711aec5c22482fa073ccf3e73a0878d812, still recorded on obsolete stack ancestry. Fresh exact-head Actions lookup is empty and the repository currently has no GitHub Releases. Its candidate binds Context Assertion to one structured CloudEvent envelope with canonical identity/source, all six truth dispositions, separate valid/business and recorded/system time, typed provenance, strict structured-media admission and separate event/message/admission profile identity. EA remains fail closed until equivalent behavior is published from an immutable protected-source CGC release with conformance/package/SBOM/provenance/source identity.

Closure acceptance

Keep this issue open until protected/default main and effective rules converge; solo-compatible review governance is live without self/model approval or routine bypass; the stack is rebuilt dependency-first from fresh protected main; every moved candidate reacquires exact-head PostgreSQL/RLS/tenant isolation, Python/coverage/docstrings, runtime/security/SAST/package/SBOM/provenance/reproducibility/review evidence; protected-main post-integration workflows succeed on the exact integration SHA; CGC publishes the compatible Context Assertion release; and production EA projection consumes that immutable release. No predecessor, absent, queued, skipped, stale or model-only evidence transfers.

[seonghobae]

Live exact-head override — 2026-08-20: the predecessor ddeacbf... GREEN evidence in the issue body is historical only. Current owning prerequisite is #21@4ada32a811c2f5ba7ac2138c0826229c5d62e78b over unchanged main@ca6889497728e1a3f09d68790a9096576e13a3ff. Current repository evidence remains incomplete: ci 32282513998 queued, runtime-readiness 32282514306 pending, supply-chain 32282514165 queued. The head also binds package evidence naming to the actual default checkout commit ${{ github.sha }}. Keep the operational exit unchanged: #21 must first satisfy terminal exact-head gates plus qualifying counted independent review; then #14 must be rebuilt/revalidated against the fresh resulting main tip before protected develop synchronization, and the exact resulting develop SHA must materialize successful ci, runtime-readiness, and supply-chain. Do not transfer the older GREEN runs.

[seonghobae]

Live dependency update: PR #34 is now Ready at exact head 1c6db352822c493eb248fec8f4eebcb67f948a20, with the protected-main verifier symlink-race repair and local 137-test/100%-coverage evidence. PR #14 remains Draft on unchanged main@ca6889497728e1a3f09d68790a9096576e13a3ff; its attempt-2 attest-protected-main and installed-process-readiness reruns are still queued. No merge or protected-develop acceptance is inferred.

[seonghobae]

Orgmetra downstream publication/projection acceptance, refreshed 2026-09-01 UTC through the existing Context Fabric owner path. Orgmetra #159 exact head is now dc6ed990040d6767b9ce656befeabd1d28b221b3; the consumer remains fail-closed while EA Core has zero immutable releases/publications and will not treat open EA PRs or mutable branch state as authoritative production architecture.

Fresh EA owner evidence: #21 remains Ready/mergeable at exact head 4ada32a811c2f5ba7ac2138c0826229c5d62e78b on main@ca6889497728e1a3f09d68790a9096576e13a3ff, with repository-owned CI/runtime-readiness/supply-chain GREEN. The actual blockers remain owner/control-plane boundaries already recorded in this issue: intended main is still not the protected/default integration branch (.github#1137), central trusted coverage must honor EA Core's declared uv ==0.11.32 contract (.github#1234), and the generic approval rule must be made solo-compatible without manufacturing human independence (.github#772). Do not merge into unprotected main, retarget to stale develop, weaken the uv/coverage/docstring gates, or transfer predecessor evidence.

For Orgmetra, completion after those protected-main/governance/toolchain repairs must include an immutable EA publication identity, not only successful integration CI. Required GREEN: exact protected source commit + immutable version/tag/package/release (or repository-documented equivalent), artifact digest/provenance, repository CI/runtime/supply-chain on that exact integrated head, compatibility/migration evidence from the zero-release state, and a versioned projection contract consuming released Context Graph authority/provenance semantics. Orgmetra projects only deployable architecture facts (service/API/worker/database/runtime/provider/version/lifecycle/risk/ownership/remediation/transformation); person, employment, organization, job, position, assignment, candidate, assessment score/result and other HR authoritative facts must not be copied into EA authoritative tables.

Consumer RED remains fail-closed: an EA handoff lacking immutable EA publication identity or released Context Graph provenance stays candidate-only. Once EA Core publication exists, Orgmetra will refetch exact tag/version/commit/artifact digest and revalidate its projection adapter against that immutable authority before promotion.

[seonghobae]

Orgmetra EA projection consumer acceptance — fresh 2026-09-01 handoff

ContextualWisdomLab/Orgmetra#159 is the downstream EA-projection admission consumer. Current exact Orgmetra head: dc6ed990040d6767b9ce656befeabd1d28b221b3, base develop@9e3e4847510e1e612b48474ba42b177b8ed824df, Draft/mergeable. A fresh EA Core release collection read still returns zero immutable releases.

Orgmetra preserves the SoR split: only deployable architecture metadata may leave Orgmetra as a proposed candidate. Person, employment, organization, job, position, assignment, candidate, performance, selection/assessment scores/results, and other HR authoritative facts must not be copied into EA authoritative tables. No cross-service SQL or direct EA mutation is permitted.

Downstream GREEN after #20's protected-main and central-tooling prerequisites converge requires the existing EA owner path to provide a canonical immutable publication/acceptance identity that can consume the released Context Graph contract and accept a proposed Orgmetra projection with:

• canonical object/authority refs, truth status/origin, effective and recorded/system time, and provenance from the released Context Graph contract;
• exact Orgmetra source repository/revision and candidate-evidence digest retained through the handoff;
• architecture-only owner/dependency references and explicit rejection of HR payload transport;
• lifecycle/risk/ownership/remediation/transformation semantics only where EA owns them;
• deterministic conformance/admission evidence and compatibility/migration evidence bound to the exact published contract/release;
• no automatic promotion from proposed to EA authoritative truth.

The current zero-release state is therefore an owner-path work item, not an Orgmetra completion condition. Once the Context Graph and EA publication paths exist, Orgmetra will re-read exact tag/version/commit/artifact identities and run released-version consumer RED→GREEN before production integration. Please keep this work in #20 / the existing Context Fabric owner path; Orgmetra will not mutate EA source or PR state.

[seonghobae]

Orgmetra downstream EA publication/projection acceptance — fresh 2026-09-01.

ContextualWisdomLab/Orgmetra#159 is the current downstream EA handoff consumer, exact head dc6ed990040d6767b9ce656befeabd1d28b221b3, protected base develop@9e3e4847510e1e612b48474ba42b177b8ed824df. Fresh EA Core repository metadata still reports default develop and its GitHub Releases collection is empty. Orgmetra therefore keeps every architecture handoff fail-closed/proposed-only and does not treat an EA open PR, mutable branch or transient artifact as authoritative architecture publication.

After this issue's main/protection/toolchain/governance prerequisites reach protected truth, the downstream GREEN criterion is an immutable EA publication path that can accept a released Context Graph-bound proposed projection while retaining source authority and provenance. The accepted EA projection may contain only deployable Orgmetra architecture concerns (application/service/API/worker/database/runtime/provider/version, lifecycle, capability/dependency, risk/ownership/remediation/transformation/initiative). Person, candidate, employment, organization, job, position, assignment, performance, assessment score/result and selection facts remain Orgmetra authority and must not be copied into EA authoritative tables.

Required projection evidence from Orgmetra#159: exact Orgmetra source repository/revision, deterministic digest of the exact candidate evidence snapshot, separate effective and recorded timestamps, non-person owner/dependency references, and the exact immutable Context Graph release/conformance/bundle/provenance identities used for admission. Even after those are valid, Orgmetra emits only proposed; EA Core remains the authority that accepts/rejects/supersedes architecture truth.

Consumer RED: absent an immutable released Context Graph contract or EA publication/admission path, Orgmetra remains not-ready and must not invent a foreign schema or promote its own candidate to EA truth.

No EA Core source/ref/PR-state mutation was performed from the Orgmetra writer.

[seonghobae]

Orgmetra downstream acceptance handoff (fresh 2026-09-01 evidence): the EA Core releases collection is still empty. Orgmetra PR #159 current head 635eeef538e73289a8aadfbcd8b9ebbaf3b39b24 keeps HRIS/HCM truth local and will hand over only deployable architecture metadata (service/API/worker/database/runtime/provider/version/lifecycle/risk/ownership/remediation/transformation) as proposed. Person, employment, organization, job, position, assignment, candidate, performance and assessment-result facts must not be copied into EA authoritative tables. After Context Graph has an immutable release and Orgmetra consumer conformance is GREEN, EA acceptance still requires the EA owner’s protected integration/publication and provenance-bound projection path; an open EA PR or mutable branch is candidate evidence only. Please retain this boundary when rebuilding/restacking the current EA projection stack and when defining release/provenance admission.

[seonghobae]

Orgmetra consumer-driven publication acceptance, fresh 2026-09-01: ContextualWisdomLab/enterprise-architecture-core still exposes zero immutable releases. Orgmetra PR #159 exact head c52b9b9864c278d3ae3829204903252bf344fc50 therefore keeps EA handoff fail-closed and proposed only. After this owner path reaches coherent protected main, please continue through the repository's canonical immutable publication/release evidence rather than stopping at integration. Orgmetra's GREEN acceptance is: EA Core consumes a released compatible Context Graph contract; an immutable EA version/source/artifact identity is available with applicable package/SBOM/provenance/compatibility/rollback evidence; Orgmetra can project only deployable service/API/worker/database/runtime/provider/version/lifecycle/risk/ownership/remediation/transformation metadata through versioned contracts. Person, employment, organization, Job, Position, Assignment, candidate, assessment/result and other HR authoritative facts must not be copied into EA authoritative tables, and an Orgmetra projection remains proposed until EA-owner acceptance.

[seonghobae]

Fresh integration-state override — 2026-09-04 KST. Repository metadata still reports default_branch=develop, but the live protected develop ref has advanced from the issue body's historical 1c0fa8b... to exact dd71e40a86385fb7861b0f1be19891a3f3e29ece (revert: remove accidental empty path, 2026-09-04T04:24:38Z). Intended main remains exact ca6889497728e1a3f09d68790a9096576e13a3ff and is still not the coherent protected/default integration authority. Root PR #21 remains unchanged at 4ada32a811c2f5ba7ac2138c0826229c5d62e78b, Ready/mergeable on that main base, with its recorded repository-owned CI/runtime/supply-chain evidence unchanged; that evidence does not transfer across the pending default/protection transition. The accepted causal order remains .github#1137: protect main first, prove effective deterministic controls, preserve develop only as needed for transition, switch default, reread ~DEFAULT_BRANCH, then rebuild/revalidate the product stacks from fresh protected truth. Do not treat the new develop commit as a reason to revive main→develop synchronization, retarget product work, or carry predecessor evidence.

[seonghobae]

Fresh read-only quarantine dependency override — 2026-09-07 KST. Revalidation supersedes the body’s historical #70@5d32eb56... anchor only; it does not change EA authority or authorize mutation of the producer.

ContextualWisdomLab/quarantine-sandbox-runtime#6 remains Draft at 8daab565bba1b61e605488c080eb28de371990a3. Artifact-analysis parent #18 remains Draft at c0647152ec052d82969b2ae078891e25e6d4d69a. The isolated Analyzer Worker Execution prerequisite has advanced linearly/non-force to Draft #70@1a5d6f5898845f33202e2d29d6fb8d282e71ac80, still rooted directly on exact #18. The new head is formatting-only after the intended RED was repeatedly masked by cargo fmt --check; its native CI is 34066121053, with hosted/positive-LSM jobs materialized but not yet qualifying as GREEN. The branch remains RED-only and explicitly treats request/receipt identity, isolation-policy digest, budget agreement and normalized worker outcome as anti-contradiction/input evidence—not proof that any backend enforced isolation.

EA #40 therefore keeps the same fail-closed architecture boundary: quarantine remains independent isolation/application-service/artifact-analysis evidence authority; provider/backend mechanics stay producer-local; malware_verdict/artifact_risk_score remain non-authoritative EA evidence; no mutable quarantine head is release authority. Re-fetch #70 again before any protected-main reconstruction or EA mutation.