docs(security): define coordinated disclosure lifecycle - #104
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthrough보안 정책을 지원 버전, 비공개 신고, 6단계 공개 수명주기, 세이프하버 및 릴리스 증거 기준으로 확장했습니다. 관련 문서와 정책 검증 테스트를 추가했습니다. Changes보안 공개 및 처리 정책
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related issues
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai full review Please review the exact current contributor head |
|
✅ Action performedFull review finished. |
|
@opencode-agent @cwl-noema-review Review exact current contributor head |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
SECURITY.md (2)
19-25: 🔒 Security & Privacy | 🔵 Trivial비공개 신고 경로의 저장소 설정을 확인하세요.
/security/advisories/new는 저장소 수준의 private vulnerability reporting이 활성화된 경우에만 비공개 신고 양식을 제공합니다. 이 설정과 보안 알림 수신자는 이 변경에 포함되지 않습니다. 병합 전에 기능 활성화와 알림 수신자를 확인하세요. 기능이 비활성화된 경우에는 대체 비공개 연락처를 정책에 제공하세요. GitHub 문서도 이 기능이SECURITY.md와 별도로 활성화되며, 비활성화된 저장소는 정책 안내 또는 공개 이슈를 사용한다고 설명합니다. (docs.github.com)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@SECURITY.md` around lines 19 - 25, Verify that private vulnerability reporting is enabled for the repository and that security notification recipients are configured before merging. If it cannot be enabled, update the SECURITY.md policy with an alternative private contact method; retain the existing public-issue fallback without exposing vulnerability details.Source: MCP tools
44-48: 🗄️ Data Integrity & Integration | 🔵 Trivial릴리스 증거 상태값을 canonical 릴리스 가이드와 연결하세요.
docs/RELEASE_GUIDE.md가 canonical 릴리스 절차를 정의하지만,SECURITY.md와docs/doctoring/security-disclosure-lifecycle.md는 이를 참조하지 않습니다. 현재 테스트도 상태 목록의 일치 여부를 검사하지 않습니다. canonical 가이드를 참조하도록 두 문서를 수정하고, 상태 목록과 exact integrated revision 요구사항을 검증하는 회귀 테스트를 추가하세요.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@SECURITY.md` around lines 44 - 48, Update the security release-evidence guidance and security-disclosure lifecycle documentation to reference the canonical release guide. Add a regression test that verifies both documents contain the complete canonical status list and require evidence for the exact integrated revision, including exclusion of non-passing states. Keep the existing release-policy requirements intact.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@SECURITY.md`:
- Around line 5-9: Update the Supported Versions section to explicitly state
that no stable release currently exists and that main is not a supported
release. Retain the existing guidance for when a stable release is published,
including adding its version or release line to the supported versions.
In `@tests/test_repository_security_metadata.py`:
- Around line 104-146: Strengthen
test_security_policy_documents_coordinated_disclosure_lifecycle by replacing the
broad policy_text token-only checks with section-scoped assertions and ordered
lifecycle checks. Verify all six lifecycle stages in sequence, the public-issue
rule requiring removal of secrets and personal data, the prohibited safe-harbor
items, and fail-closed release evidence requirements, while keeping the existing
doctoring_text checks. Align the expected wording and scope with
docs/doctoring/security-disclosure-lifecycle.md.
---
Nitpick comments:
In `@SECURITY.md`:
- Around line 19-25: Verify that private vulnerability reporting is enabled for
the repository and that security notification recipients are configured before
merging. If it cannot be enabled, update the SECURITY.md policy with an
alternative private contact method; retain the existing public-issue fallback
without exposing vulnerability details.
- Around line 44-48: Update the security release-evidence guidance and
security-disclosure lifecycle documentation to reference the canonical release
guide. Add a regression test that verifies both documents contain the complete
canonical status list and require evidence for the exact integrated revision,
including exclusion of non-passing states. Keep the existing release-policy
requirements intact.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 9b358819-0510-4f20-86e5-ade1488b31a3
📒 Files selected for processing (3)
SECURITY.mddocs/doctoring/security-disclosure-lifecycle.mdtests/test_repository_security_metadata.py
|
@opencode-agent @cwl-noema-review Review exact current contributor head |
|
Addressed the valid current-head findings from CodeRabbit comments 3763340542 and 3763340546, plus the release-evidence nitpick in 4912724007, at exact head @opencode-agent @cwl-noema-review Please review exact head |
|
@coderabbitai full review @opencode-agent @cwl-noema-review Review exact current contributor head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='5543d1b493ceb9dbac485e10347820929d6bee92'
head='2b7bf1a8bb8aa361bd1e9ec9038547b3807a730f'
git cat-file -e "${base}^{commit}"
git cat-file -e "${head}^{commit}"
printf '%s\n' '=== Commit range ==='
git diff --stat "$base" "$head"
git diff --name-status "$base" "$head"
printf '%s\n' '=== Changed-file diff ==='
git diff --no-ext-diff --unified=80 "$base" "$head" -- \
SECURITY.md \
docs/doctoring/security-disclosure-lifecycle.md \
tests/test_repository_security_metadata.py
printf '%s\n' '=== Referenced release guide ==='
if [ -f docs/RELEASE_GUIDE.md ]; then
cat -n docs/RELEASE_GUIDE.md
else
printf '%s\n' 'docs/RELEASE_GUIDE.md is absent'
fi
printf '%s\n' '=== Test module structure ==='
ast-grep outline tests/test_repository_security_metadata.py --items all --view expanded
printf '%s\n' '=== Security-policy test references ==='
rg -n -C 3 --glob 'tests/test_repository_security_metadata.py' \
'(SECURITY\.md|security-disclosure-lifecycle|RELEASE_GUIDE|private|stable-release|evidence|lifecycle)' \
tests/test_repository_security_metadata.pyLength of output: 43319 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='5543d1b493ceb9dbac485e10347820929d6bee92'
head='2b7bf1a8bb8aa361bd1e9ec9038547b3807a730f'
printf '%s\n' '=== Ref identity and ancestry ==='
printf 'checked_out_head='
git rev-parse HEAD
printf 'requested_head='
git rev-parse "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor_of_requested_head=true'
git merge-base --is-ancestor "$head" HEAD && echo 'requested_head_is_ancestor_of_checked_out_head=true' || true
printf '%s\n' '=== Diff whitespace validation ==='
git diff --check "$base" "$head"
printf '%s\n' '=== Markdown relative-link targets ==='
python - <<'PY'
from pathlib import Path
import re
for source in (Path("SECURITY.md"), Path("docs/doctoring/security-disclosure-lifecycle.md")):
text = source.read_text(encoding="utf-8")
for target in re.findall(r'\[[^\]]+\]\((?!https?://|#)([^)#]+)', text):
resolved = (source.parent / target).resolve()
print(f"{source}: {target}: {'OK' if resolved.is_file() else 'MISSING'}")
PY
printf '%s\n' '=== Repository security settings ==='
gh api repos/ContextualWisdomLab/contextual-orchestrator \
--jq '{default_branch, visibility, archived, security_and_analysis}' || true
gh api repos/ContextualWisdomLab/contextual-orchestrator/private-vulnerability-reporting \
--jq '{enabled}' || true
printf '%s\n' '=== Current PR range and mergeability metadata ==='
gh pr view 104 --repo ContextualWisdomLab/contextual-orchestrator \
--json number,headRefOid,baseRefOid,isDraft,mergeStateStatus,changedFiles \
--jq '{number, headRefOid, baseRefOid, isDraft, mergeStateStatus, changedFiles}' || trueLength of output: 2671 🤖 web_search executed:
Length of output: 8604
I confirmed that the PR changes only The policy, doctoring document, and test contract agree on the fail-closed release-evidence states and the exact integrated-revision requirement. The relative Markdown links resolve. GitHub currently reports private vulnerability reporting as disabled. This is not an actionable defect in this disclosure-only range. The policy correctly represents that state as a stable-release authorization block until maintainers enable the private channel and configure recipients, or document a monitored alternative private contact. No stable release exists. This review is automated review evidence. It is not independent human approval. ✅ Action performedFull review finished. |
32ca453
into
docs/canonical-product-architecture
1 participant
Buyer-visible gap
Protected
mainhas only a short vulnerability-reporting policy. It does not define supported versions, coordinated disclosure, safe research boundaries, advisory/CVE handling, exact released-revision evidence, or the difference between an acknowledgement target and a remediation SLA.Bounded slice
This PR changes only three repository-owned files relative to its live documentation base:
SECURITY.md: supported-version, scope, reporting, coordinated-disclosure, safe-harbor/research, advisory, and exact-release-evidence contracts;docs/doctoring/security-disclosure-lifecycle.md: APA 7 evidence for ISO/IEC 29147:2018, ISO/IEC 30111:2019, current GitHub primary documentation, and NIST SP 800-218 Rev. 1, explicitly identified as an Initial Public Draft;tests/test_repository_security_metadata.py: deterministic regression coverage for the buyer-visible contract.The original branch history added the disclosure-lifecycle contract test before the policy and evidence implementation.
Stack and exact identity
Integration order is #96 → #105 → this PR.
docs/canonical-product-architecture(PR docs: establish canonical product architecture and evidence model #105)952c21f62a49cce89ca9af2cbc5696f5e6f4461c/ef378546c59c22fb6ec9b6c901a00a74187b2e98(historical)5543d1b493ceb9dbac485e10347820929d6bee922b7bf1a8bb8aa361bd1e9ec9038547b3807a730fc7aeab9d9bc14446a09ca317a73839c59cf3d543and canonical base5543d1b493ceb9dbac485e10347820929d6bee92The normal two-parent synchronization imports #105's live canonical inventory repair while preserving only this PR's disclosure-policy range:
SECURITY.md,docs/doctoring/security-disclosure-lifecycle.md, andtests/test_repository_security_metadata.py. Focused documentation/security contracts passed 40 tests; the full merged suite passed 598 tests with 100% production statement/line coverage (3,667/3,667), 100% branch coverage (934/934), and 100% public-docstring coverage. A deletion mutant that removed the private-reporting release gate survived the predecessor test and fails the strengthened current test, proving the new regression assertion is behavior-sensitive. Hosted evidence on exact head2b7bf1a8bb8aa361bd1e9ec9038547b3807a730fis complete; predecessor workflow evidence does not transfer:31562234073, job94006750257: success, 598 passed, 100% production statement/line coverage (3,667/3,667), 100% branch coverage (934/934), and 100% public-docstring coverage.31562234040: success. Supply-chain job94006750072found no known vulnerabilities and published CycloneDX SBOM artifact9128152209with archive digestsha256:1552c2c9592874d04947449e70f8e9327dcf93d862575a07a56d6a81f4bebfe3; CodeQL job94006750118scanned 85/85 Python files and 3/3 GitHub Actions files successfully.31562234103: success. Hypothesis job94006750224passed 8 property tests; Atheris job94006750220completed the four bounded targets with 8,143,169 / 9,866,829 / 555,710 / 3,396 runs and no crash artifact.5262202801reports no actionable findings and independently confirms private vulnerability reporting is currently disabled; the policy therefore keeps stable-release authorization blocked until maintainers enable the private channel and configure recipients or document a monitored alternative private contact. This remains automated comment/status evidence, not formal or independent approval. The only formal review is a predecessor-head CodeRabbitCOMMENTEDreview; unresolved inline threads are zero and qualifying independent approval is absent.This PR remains Draft while #96/#105 remain unintegrated and while qualifying independent approval is absent.
Historical exact-head evidence for
4c2beb3fd8d683e500bd012ebe219c3460e13de2Every repository-local workflow below explicitly fetched and checked out exact contributor head
4c2beb3fd8d683e500bd012ebe219c3460e13de2with checkout credentials disabled.d0a6ac8dc131a3db185265209286150b57b1c848: 18 commits ahead, 0 behind, changing onlySECURITY.md,docs/doctoring/security-disclosure-lifecycle.md, andtests/test_repository_security_metadata.py.31459823607, job93680939206: success, 582 passed, 100% production statement and branch coverage (3,667 statements / 934 branches), and 100% public-docstring coverage.31459823573: success.93680939244found no known vulnerabilities and published CycloneDX SBOM artifact9089384393with archive digestsha256:8c4a492bd7a0b90188e0af5233d9bb170c917eb2269c2835416bae3a27aa56eb.93680939225scanned 85/85 Python files and 3/3 GitHub Actions files successfully.31459823571: success.93680939070: 8 passed.93680939016: four 61-second targets completed 8,338,226 / 9,980,232 / 607,589 / 3,545 runs without a crash artifact; conditional upload was correctly skipped because the job succeeded.Predecessor evidence for
19cba12f54785ee1d6ca68c7d719abdd8797bcb4remains historical. This PR remains Draft. Repository-local exact-head evidence does not substitute for protected integration of #96/#105, required automated review evidence, or qualifying independent approval.Standards and authority boundary
NIST identifies SP 800-218 Rev. 1 / SSDF Version 1.2 as an Initial Public Draft published 2025-12-17; this PR does not present it as a final normative requirement. ISO/IEC 29147:2018 and ISO/IEC 30111:2019 remain the disclosure and handling standards, with GitHub first-party documentation governing repository reporting and advisory workflows.
This PR mutates only
ContextualWisdomLab/contextual-orchestrator. It does not write to or dispatch writers intoContextualWisdomLab/.github, naruon, inkspan, or any other repository.Acceptance
Keep Draft while upstream #96/#105 remain Draft or unintegrated. On every changed head, regenerate repository-required Tests, Fuzz, Security, Security Scan, SAST, coverage/docstring, automated-review, and independent-review evidence. Queued, pending, skipped-required, cancelled, absent, failed, predecessor-head, stale-base, author-only, status-only, rate-limited, infrastructure-only, or synthetic-merge evidence is not merge authority.
Historical exact-head evidence for
8e617b3220981fd03b980da5fd420a7d6bf42f81The two-parent synchronization head is
8e617b3220981fd03b980da5fd420a7d6bf42f81, based on exact #105 head3418993f48538f3a02c360648932eff4de8b3244. Exact comparison is 19 commits ahead, 0 behind and still changes onlySECURITY.md,docs/doctoring/security-disclosure-lifecycle.md, andtests/test_repository_security_metadata.py.All three repository-local workflows explicitly fetched and checked out exact contributor head
8e617b3220981fd03b980da5fd420a7d6bf42f81with checkout credentials disabled. Tests run31461441107, job93685564847, succeeded with 583 passed, 100% production statement/branch coverage (3,667 statements / 934 branches), and 100% public-docstring coverage. Security run31461441111succeeded: CodeQL job93685564960scanned 85/85 Python files and 3/3 workflow files; supply-chain job93685565002found no known vulnerabilities and published CycloneDX SBOM artifact9090114273with archive digestsha256:e332a193da8503b20eabcf3c3e4ddcbdb9d43da90cc7b94c240dfbc408ef0b02. Fuzz run31461441139succeeded: Hypothesis job93685565010passed 8 property tests and Atheris job93685565030completed four 61-second targets with 7,831,263 / 9,780,383 / 582,894 / 3,392 runs and no crash artifact. Formal reviews and unresolved inline threads remain zero; qualifying independent approval is absent. This PR remains Draft while #96/#105 are unintegrated.Historical exact-head evidence for
9e3138c29fba70190daef6b61927391cae449ec0The two-parent synchronization head is
9e3138c29fba70190daef6b61927391cae449ec0, with parents8e617b3220981fd03b980da5fd420a7d6bf42f81and exact #105 head12e868b53d32971a9642148217dfc0ad77535f5c. Exact comparison against that live base is 20 commits ahead, 0 behind and still changes onlySECURITY.md,docs/doctoring/security-disclosure-lifecycle.md, andtests/test_repository_security_metadata.py.All repository-local workflows explicitly fetched and checked out exact contributor head
9e3138c29fba70190daef6b61927391cae449ec0with checkout credentials disabled:31464394236, job93694146374: success, 583 passed, 100% production statement/branch coverage (3,667 statements / 934 branches), and 100% public-docstring coverage.31464394291: success. Supply-chain job93694146453found no known vulnerabilities and published CycloneDX SBOM artifact9090970730with archive digestsha256:d3d7b1234ef505d1453eb94db431197c0f24cc69c15d97a7c34e841617d650a8; CodeQL job93694146511scanned 85/85 Python files and 3/3 workflow files successfully.31464394241: success. Hypothesis job93694146214passed 8 property tests; Atheris job93694146406completed four 61-second targets with 8,281,605 / 9,796,039 / 726,102 / 3,472 runs and no crash artifact.The unchanged three-file diff proves the security-disclosure slice survived synchronization without taking ownership of canonical #105 content. This PR remains Draft while #96/#105 and the central review authority are unintegrated.
Historical exact-head evidence for
ec8669d8aeaece607bdceb167836aaf59f04dba9The two-parent synchronization head is
ec8669d8aeaece607bdceb167836aaf59f04dba9, with parents9e3138c29fba70190daef6b61927391cae449ec0and exact #105 head7630125307afae9b9c0cbdb1fd8f78ff347c8346. Exact comparison against that base is 21 commits ahead, 0 behind and still changes onlySECURITY.md,docs/doctoring/security-disclosure-lifecycle.md, andtests/test_repository_security_metadata.py.All repository-local workflows explicitly fetched and checked out exact head
ec8669d8aeaece607bdceb167836aaf59f04dba9with checkout credentials disabled:31467808551, job93704291777: success, 583 passed, 100% production statement/branch coverage (3,667 statements / 934 branches), and 100% public-docstring coverage.31467808510: success. Supply-chain job93704291435found no known vulnerabilities and published CycloneDX SBOM artifact9092218239with archive digestsha256:449bb9f325c157f98d78a75eeeccbcf3d57139841e45f4d2531a0d7a51a7ab1b; CodeQL job93704291531scanned 85/85 Python files and 3/3 workflow files successfully.31467808650: success. Hypothesis job93704291949passed 8 property tests; Atheris job93704291991completed four 61-second targets with 7,941,980 / 9,947,143 / 690,794 / 3,408 runs and no crash artifact.The unchanged three-file diff proves the disclosure slice survived synchronization. This PR remains Draft while #96/#105 and central review authority remain unintegrated.
Historical exact-head evidence for
4e22a9b0883d3f6acbe6ddee302fa623c66a44cfThe two-parent synchronization head is
4e22a9b0883d3f6acbe6ddee302fa623c66a44cf, with parentsec8669d8aeaece607bdceb167836aaf59f04dba9and exact #105 head8ce282ddf6c43bcb49301e95c8d9c12f1a72cd72. Exact comparison against that live base is 22 commits ahead, 0 behind and still changes onlySECURITY.md,docs/doctoring/security-disclosure-lifecycle.md, andtests/test_repository_security_metadata.py.31472945625, job93720119726: success, 584 passed, with the same coverage and docstring gates on the exact head.31472945655: success. Supply-chain job93720118796found no known vulnerabilities and published CycloneDX SBOM artifact9094235739with archive digestsha256:0f2da842efa4e1d0b6e5fe897e4357aabd0e6c401461506dca225ce3809d3df4; CodeQL job93720118794scanned 85/85 Python files and 3/3 workflow files successfully.31472945438: success. Hypothesis job93720117755passed 8 property tests; Atheris job93720117707completed four 61-second targets with 8,255,379 / 9,955,677 / 640,143 / 3,547 runs and no crash artifact.The unchanged three-file diff proves the disclosure slice survived synchronization without taking ownership of canonical #105 content. This exact-head repository-local proof does not substitute for protected integration of #96/#105, required automated review, or qualifying independent approval. The PR remains Draft.
2026-08-11 downstream library-status synchronization
Merge commit
8d537900b4179756ad16c8404fb17efce5f1e364synchronizes exact upstream #105 head12b65705b4657a677c54a8e520946067037eeb6athrough a normal two-parent commit while preserving this PR's unique disclosure-policy work. The exact base-to-head diff remains limited toSECURITY.md,docs/doctoring/security-disclosure-lifecycle.md, andtests/test_repository_security_metadata.py; the compare is 0 commits behind and contains no additional file drift.Repository-local workflows checked out this exact head with checkout credentials disabled:
31477191861, job93733513556: success, 585 passed, 100% production statement and branch coverage (3,667 statements / 934 branches, zero misses or partials), and 100% public-docstring coverage.31477191860: success. Supply-chain job93733513571found no known vulnerabilities and published CycloneDX SBOM artifact9095916666with archive digestsha256:70fd77041a16eb3cc00d5ae4980a70a032b8c842f49a65d4855bd39fc107e666; CodeQL job93733513504uploaded its result successfully.31477191858: success. Hypothesis job93733513451passed 8 property tests; Atheris job93733513437completed all four bounded targets without a crash artifact.This exact-head evidence is repository-local only. Upstream #105 and #96 remain Draft and unintegrated, so this PR remains Draft and no status substitutes for qualifying independent approval.
2026-08-11 canonical-guidance synchronization
Merge commit
8453f082672d96b564ff2c32d028b11e05d8729fhas parents8d537900b4179756ad16c8404fb17efce5f1e364and exact live base828ca54f2b96a3bdd7adec24a26c0d8164df47d1. The conflict-free merge preserves this PR's unique range as exactlySECURITY.md,docs/doctoring/security-disclosure-lifecycle.md, andtests/test_repository_security_metadata.py; no predecessor evidence was transferred.All repository-local workflows explicitly fetched and checked out this exact contributor head with credentials disabled:
31480171511, job93743066274: success, 586 passed, 100% production statement and branch coverage (3,667 statements / 934 branches, zero misses/partials), and 100% public-docstring coverage.31480171492: success. CodeQL job93743066072and supply-chain job93743066120both used the exact head; dependency audit found no known vulnerabilities and the SBOM upload completed.31480171506: success. Hypothesis job93743066151passed 8 property tests; Atheris job93743066102completed all four bounded targets without a crash artifact.This PR remains Draft while #105 and upstream #96 are unintegrated and while qualifying independent approval is absent.
2026-08-11 runtime-guide status synchronization
Merge commit
6b2a272b17c25d0bf2dc4e82cc18407b02a779dfhas parents8453f082672d96b564ff2c32d028b11e05d8729fand exact live base62a4983e4b5b237a8f5d30b0889cd5077d4ff356. The conflict-free merge preserves this PR's unique range as exactlySECURITY.md,docs/doctoring/security-disclosure-lifecycle.md, andtests/test_repository_security_metadata.py; no predecessor evidence was transferred.All repository-local workflows explicitly fetched and checked out this exact contributor head with credentials disabled:
31481938227, job93748672111: success, 587 passed, 100% production statement and branch coverage (3,667 statements / 934 branches, zero misses/partials), and 100% public-docstring coverage.31481938229: success. CodeQL job93748672225and supply-chain job93748672265used the exact head; dependency audit found no known vulnerabilities.31481938230: success. Hypothesis job93748672341passed 8 property tests; Atheris job93748672447completed all four bounded targets without a crash artifact.This PR remains Draft while #105 and #96 are unintegrated and qualifying independent approval is absent.
2026-08-12 canonical architecture refresh
Merge commit
ea6bcd66ec6affbed379aad6882e93b46060e8abhas parents6b2a272b17c25d0bf2dc4e82cc18407b02a779dfand exact live #105 head4a91606a82a1fc7ec9b68f4fe2150ae1f2160657. Exact comparison is 26 commits ahead, 0 behind and remains limited toSECURITY.md,docs/doctoring/security-disclosure-lifecycle.md, andtests/test_repository_security_metadata.py.Merge commit
2680fa092e56a8528dcc3e379b5349b978a18f1chas parentsea6bcd66ec6affbed379aad6882e93b46060e8aband exact #105 head21dba9907df28ffc9b64b0078a0ace2a35ceb0f8. Exact comparison is 27 commits ahead, 0 behind and remains limited to the same three disclosure files. Focused documentation/security contracts passed 40 tests; the complete merged suite passed locally with 598 tests, 100% production statement/line coverage (3,667/3,667), 100% branch coverage (934/934), and 100% public-docstring coverage. Hosted exact-head Tests31540849347/ job93942647803succeeded with 598 passed, 100% production statement/line coverage (3,667/3,667), 100% branch coverage (934/934), and 100% public-docstring coverage. Security31540849299succeeded: supply-chain job93942648042found no known vulnerabilities and published CycloneDX SBOM artifact9120790812(sha256:b1eb9e607f6b36f9ab9b7681f944dbb73651bda5538bb4d0c808bc7ace754d37), and CodeQL job93942648014succeeded. Fuzz31540849525succeeded: Hypothesis job93942648503passed 8 tests and Atheris job93942648511completed four 61-second targets with 7,994,890 / 9,734,480 / 670,240 / 3,320 runs and no crash artifact. Every job checked out exact head with persisted credentials disabled. Formal reviews remain absent, all inline threads are resolved, and qualifying independent approval is absent.The tested merge tree
08e898d15a30870dcf591e245275ac7ce78e57eapassed the full local suite with 597 passed, 100% production statement and branch coverage (3,667 statements / 934 branches, zero misses or partials), and 100% public-docstring coverage. All hosted repository-local workflows explicitly fetched and checked out the same exact contributor head with credentials disabled:31534600722, job93922578771: success, 597 passed, with the same 100% production statement/branch and public-docstring gates.31534600752: success. Supply-chain job93922578760found no known vulnerabilities and published CycloneDX SBOM artifact9118560902with archive digestsha256:ebde68e15d3046d3491be1075affa9896336a3a79fe7c1f76b9836868c2b9347; CodeQL job93922578828completed successfully on the exact head.31534600716: success. Hypothesis job93922578679passed 8 property tests; Atheris job93922578523completed all four 61-second targets with 7,984,157 / 9,853,758 / 565,683 / 3,368 runs and no crash artifact.Predecessor workflow evidence does not transfer. This PR stays Draft while #96/#105 are unintegrated and required automated/independent review authority is absent.
2026-08-12 volatile-evidence boundary synchronization
Merge commit
ef378546c59c22fb6ec9b6c901a00a74187b2e98has parents disclosure predecessor2680fa092e56a8528dcc3e379b5349b978a18f1cand exact live #105 head952c21f62a49cce89ca9af2cbc5696f5e6f4461c. Exact comparison is 28 commits ahead, 0 behind and remains limited toSECURITY.md,docs/doctoring/security-disclosure-lifecycle.md, andtests/test_repository_security_metadata.py. The normal two-parent merge preserves #105's durable Traceability and dated evidence-appendix boundary without taking ownership of canonical documentation.Focused documentation/security contracts passed 40 tests. The complete merged tree passed locally with 598 tests, 100% production statement/line coverage (3,667/3,667), 100% branch coverage (934/934), and 100% public-docstring coverage. Hosted exact-head Tests
31549911202/ job93970184905succeeded with 598 passed, 100% production statement/line coverage (3,667/3,667), 100% branch coverage (934/934), and 100% public-docstring coverage. Security31549911201succeeded: supply-chain job93970184972found no known vulnerabilities and published CycloneDX SBOM artifact9123878985(sha256:31c7960c554135cf5f4b5ba6b585ef42eeed98aa69d728cc6276b1c1a69b3dab), and CodeQL job93970184988scanned 85/85 Python and 3/3 GitHub Actions files successfully. Fuzz31549911206succeeded: Hypothesis job93970184819passed 8 tests and Atheris job93970184710completed four 61-second targets with 7,990,033 / 9,846,930 / 584,837 / 3,405 runs and no crash artifact. Every job checked out exact head with persisted credentials disabled. Formal reviews and inline threads remain absent; qualifying independent non-author approval remains absent. This PR remains Draft while #96/#105 are unintegrated.Hosted exact-head evidence after stack refresh
At contributor head
c7aeab9d9bc14446a09ca317a73839c59cf3d543, all repository-local contributor-head workflows are terminal-success and explicitly fetched and checked out that exact SHA:31557758927, job93993516730: success; 598 passed, 100% production statement and branch coverage (3,667statements,934branches, zero misses/partials), and 100% public-docstring coverage.31557758958: success; CodeQL job93993516882analyzed 85/85 Python files and 3/3 workflow files, and Python supply-chain job93993516983reported no known vulnerabilities. CycloneDX artifact9126590338has ZIP SHA-2566eae8100da969d2c6a6c38108ce078080401ad834c418c13ecc443c49ceceb43.31557758976: success; Hypothesis job93993516915completed 8 property tests, while Atheris job93993516846completed bounded request-body, agent-config, secret-redaction, and orchestration-engine targets. Crash-artifact upload was skipped because no crash artifact existed.Formal reviews remain 0; qualifying independent approval remains absent. Unresolved inline threads remain 0. This is exact contributor-head evidence, not protected-main integration or independent approval. PR #104 remains Draft behind #105 and #96.
Summary by CodeRabbit
문서
테스트
2026-08-12 inventory-consistency stack refresh
Normal two-parent merge
5a737053f6d80c7800646170a0a3f0588767225dsynchronizes exact accepted #105 head5543d1b493ceb9dbac485e10347820929d6bee92onto disclosure predecessorc7aeab9d9bc14446a09ca317a73839c59cf3d543. Exact comparison is 30 commits ahead, 0 behind and remains limited toSECURITY.md,docs/doctoring/security-disclosure-lifecycle.md, andtests/test_repository_security_metadata.py.Focused inventory contract passed; the documentation/security subset passed 40 tests. The complete local merged suite passed 598 tests with 100% production statement/line coverage (3,667/3,667), 100% branch coverage (934/934), and 100% public-docstring coverage. Every repository-local workflow checked out exact head
5a737053f6d80c7800646170a0a3f0588767225dwith credentials disabled. Tests31560538966passed 598 tests, 100% production statement/line coverage (3,667/3,667), 100% branch coverage (934/934), and 100% public-docstring coverage. Security31560539280found no known dependency vulnerabilities, uploaded CycloneDX artifact9127564708(sha256:3c85ccc417274453c8578ba82d73411c9b50d4f3615270c677b72789c2f6220b), and completed CodeQL over 85/85 Python and 3/3 workflow files. Fuzz31560539088passed 8 Hypothesis tests and four 61-second Atheris targets with 7,988,821 / 10,116,936 / 573,816 / 3,418 runs and no crash artifact. Fresh exact-head OpenCode/Noema review is requested but pending. Formal independent approval remains absent. #104 remains Draft behind unintegrated #105 and #96.2026-08-12 disclosure-policy review remediation
CodeRabbit's exact predecessor review found that supported-version status was implicit, policy tests were global-token checks, and release-evidence states were not tied to the canonical release guide. The repair is test-first: the focused contract failed RED because the policy did not explicitly state that no stable release currently exists. Current head
e2ffd8552e5c9943e5deacb3453ef88aa01789c9now states the current support boundary, makes private-reporting configuration a stable-release admission gate, locks all six ordered lifecycle stages and section-scoped reporting/safe-harbor requirements, and aligns both policy documents with the canonical non-passing evidence states and exact integrated revision. Focused GREEN passed; the documentation/security subset passed 40 tests; the complete local suite passed 598 tests with 100% production statement/line coverage (3,667/3,667), 100% branch coverage (934/934), and 100% public-docstring coverage.Hosted exact-head Tests, Security, and Fuzz are complete as recorded above; exact-head CodeRabbit automated review reports no actionable findings. Private vulnerability reporting enablement and notification-recipient configuration remain an explicit stable-release operational gate; no private contact or configuration was invented. Qualifying independent approval remains absent, and #104 stays Draft behind unintegrated #105 and #96.
2026-08-12 snapshot-identity synchronization
Normal two-parent merge
7257092a9bb4ee4666e4a4ae9336326e7ba81df5synchronizes exact #105 headb62cc165b6c585cf4e03deca3d1236c630db64efonto disclosure predecessor2b7bf1a8bb8aa361bd1e9ec9038547b3807a730f. Exact comparison is 33 commits ahead, 0 behind and remains limited toSECURITY.md,docs/doctoring/security-disclosure-lifecycle.md, andtests/test_repository_security_metadata.py.Exact-head Tests
31572625571, Security31572625538, and Fuzz31572625541are queued. Queued evidence is not success and no predecessor-head result transfers. The sole formal review is a predecessor-head CodeRabbitCOMMENTEDreview, unresolved inline threads are zero, and qualifying independent approval is absent. Keep this PR Draft behind unintegrated #105 and #96.