docs: baseline product and technical gaps

[seonghobae]

Scope

This PR publishes the buyer-facing product and technical gap baseline without
changing runtime behavior. It records protected-main evidence, product and
technical gaps, ADR/research constraints, and the current open-PR inventory.

Review repair

• restored the GitHub-flavored Markdown delimiter row for the open-PR inventory;
• recorded OpenCode, Noema, and Strix gateway migration as an external prerequisite until direct provider fallbacks are removed;
• kept exact heads, Checks, and approvals as dated evidence rather than standing approval.

Exact current identity

• Snapshot: 2026-08-21 Asia/Seoul
• Base: protected main at e226e11
• Head: dfe9aa4
• Runtime behavior: unchanged

No credentials or real records are included. Refetch the live head, required
Checks, review threads, and protected rules before relying on this snapshot.

Summary by CodeRabbit

• 문서
  • 제품·기술 기준선과 기준 시각, 최신 PR·이슈·검증 상태를 갱신했습니다.
  • 운영 요구사항, 제공자 연동 경계, 보호된 병합 승인 요건과 미완료 마이그레이션 상태를 명확히 했습니다.
  • 새로운 ADR을 추가해 게이트웨이 운영 원칙과 갭 관리 기준을 정리했습니다.
  • PII 처리, 암호화 추적, 보안 증거, 릴리스 및 고객 대상 주장 검증 원칙을 문서화했습니다.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6f9ecf65-03b0-4abc-831c-3d3a24211b39

📥 Commits

Reviewing files that changed from the base of the PR and between e107d18 and 6d36053.

📒 Files selected for processing (2)

• docs/planning/adrs/0023-product-technical-gap-baseline.md
• docs/product-technical-gap-baseline.md

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

ADR 0023을 추가하고 제품·기술 기준선 문서를 갱신했다. 운영 조건, 보호된 main 병합 요건, PR·이슈 스택 상태, 중앙 workflow 검증 증거를 최신 상태로 반영했다.

Changes

제품·기술 갭 기준선

Layer / File(s)	Summary
제품 전략과 기준선 범위 docs/planning/adrs/0023-product-technical-gap-baseline.md, docs/product-technical-gap-baseline.md	ADR 0023이 단일 OpenAI 호환 게이트웨이 전략과 갭 관리 원칙을 정의한다. 기준선 문서가 ADR 참조와 기준 시각을 갱신한다.
운영 및 보호된 전달 조건 docs/product-technical-gap-baseline.md	중앙 workflow의 직접 provider endpoint/key fallback 제거 조건과 Noema/Strix 마이그레이션 상태를 기록한다. 보호된 main의 승인, last-push 승인, thread 해결 및 필수 workflow 조건을 갱신한다.
PR 인벤토리와 통합 증거 docs/product-technical-gap-baseline.md	PR·이슈의 head, 상태, 검증 결과, 스택 병합 상태와 중앙 .github PR 정보를 갱신한다. framing 및 trace authorization 구현의 통합 상태와 provider boundary evidence를 반영한다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 6d360

This PR publishes a documentation baseline without changing runtime behavior, and no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 제품 및 기술 갭 기준선을 문서로 추가하는 PR의 주요 변경 사항을 정확하고 간결하게 설명합니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/product-technical-gap-baseline

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Please review the exact-head baseline. It records source SHA e226e11, all 9 open PRs, 13 open issues, ruleset 18156473, current PRD/TRD/UML gaps, Figma file ID vsZMd8WAv42HDRgcZuNcWk, and APA 7 research anchors. Documentation-only validation: git diff --check passed.

[seonghobae]

Update: ADR 0015 now records the product-boundary decision and required Figma file ID vsZMd8WAv42HDRgcZuNcWk. Exact head is 1f2322d; git diff --check passed. Hosted required Checks should evaluate this current head.

[seonghobae]

Collision check fixed: baseline ADR is now 0016 because stacked provider-catalog PR #764 owns ADR 0015. Current exact head: f81dd9e; git diff --check passed.

[seonghobae]

@opencode-agent Review exact current HEAD 1eb4773 only. Verify ADR 0016 numbering, Figma file ID traceability, snapshot labeling, open-PR/issue evidence, standards/research citations, and diff-clean documentation. Submit a formal verdict without pushing or creating another PR.

[seonghobae]

Validated and pushed normal commit at exact current HEAD 1eb4773 (base e226e11). The baseline documentation now passes git diff --check; the only fix removed Markdown trailing whitespace that contradicted the PR's own verification claim. Please review this exact SHA only and refresh hosted Checks.

[seonghobae]

Revalidated the cross-repository scheduler evidence and corrected the exact-head docs. The baseline now cites central .github organization-commercial-readiness-loop.yml (7 * * * *) as the hourly product owner and pr-review-merge-scheduler.yml as the protected PR sweep; the nonexistent provider-catalog-sync.yml reference is removed. git diff --check passed at fbe9767. Please review this exact SHA only.

[seonghobae]

Baseline refreshed at exact head a0f6db6: it now inventories PRs #774, #775, and #776, records #774's closed-base/no-required-checks condition, and links issue #119 to the stacked framing PR #776. git diff --check passed.

[seonghobae]

Baseline exact-head refresh: #768 is now a4aef39 (prior d1e06d5 evidence stale) and #775 is fb8fb62 after the Atheris marker repair. Current baseline head 41f4a0a; documentation diff check passed.

[seonghobae]

Refreshed the baseline inventory at exact current queue state after #778 opened and concurrent agents advanced several heads. The table now records #778 and current heads #773=2e24c53, #768=88fee97, and #764=854d7a2; the scheduler evidence remains the actual central hourly owner. git diff --check passed at 2aeac55. Review this exact SHA only.

[seonghobae]

Baseline refreshed at exact head 8839c8c (remote full SHA 8839c8c0b13afeda5fa8f6d26e9dcfa6d5c8dc7f): added PR #784 fail-closed release-authority evidence, refreshed #778/#773 heads, and updated the #103/P1 gap actions. Revalidate this exact head; no merge while protected approval/Checks are incomplete.

[seonghobae]

Correction: authoritative current baseline head is 8839c8c5b617c6f1b635e8cf87ebaa371fa85311; the previous comment contained an incorrect full-SHA expansion. Use only this exact SHA for Checks and review evidence.

[seonghobae]

Baseline exact head is now 8f77e3c0e9ee000c58e824d0c2955cee9ecb4df1: refreshed #784 to 992e0f6, #781 to fc0ebae, #773 to 2f9d039, and retained #771 5bbec44. Revalidate this exact SHA; no merge while protected approval and Checks are incomplete.

[seonghobae]

Exact current head 238e359 refreshes the live snapshot at 2026-08-20 20:46 KST. It records current heads for #771/#772/#778/#781/#784 and their local evidence without treating queued Checks or missing independent approval as merge evidence. Review this exact SHA; protected normal merge remains required.

[seonghobae]

Exact full SHA for the snapshot refresh is 238e3599e1b9e48499bbf8d389b20cc5526508fe. Use this full SHA as the review target.

[seonghobae]

Exact current head 9daf80235e43b4ecb4dedfba86bd3cbf22e223d5 records PR #785, current remote Agent heads (#784/#781/#779), and removes the stale #777 row after GitHub returned 404. Review this exact baseline snapshot; normal protected auto-merge remains armed, with independent approval and current hosted Checks still required.

[seonghobae]

[seonghobae]

Current-head refresh on exact PR HEAD a9e9f0c62ad3ddbdb8cac66c4c2f43084ac7428f:

• Preserved the concurrent embedding-selection, opaque-session, and other baseline updates.
• Refreshed the snapshot timestamp and exact heads for fix(security): require trace purpose authorization #781 (caf1eb3), feat: opt in to client-owned tool loops #787 (36e3be0), and docs: baseline product and technical gaps #773 itself (43d7b88 at source snapshot).
• git diff --check: passed.
• This remains planning evidence only; normal merge still requires independent approval and protected Checks on each exact PR head.

@opencode-agent please review this exact documentation HEAD.

[seonghobae]

Exact-head correction: baseline PR is now 12acc52cd4baa82dbf2a83b19bf6f4531b0c1873. The concurrent evidence snapshot was preserved and #790 (5d989c6) was added to the open-PR inventory; git diff --check passed. Approval and protected Checks remain the merge boundary.

[seonghobae]

Exact-head documentation update: 5028b351ee8b6e1cafb52322a8eadf649bcc0ccc. The baseline now records #787 exact-head proof (1474 full-suite passes, 51 focused passes, Ruff/diff clean) and the current snapshot time; concurrent PR inventory remains intact.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[seonghobae]

Exact-head correction: baseline is now 0bf70171980257522bb3a00a3f9b8765cf3b2412; #790 is refreshed to concurrent HEAD 04761e4 with its new 25 passed verification. git diff --check passed and no concurrent inventory changes were overwritten.

[seonghobae]

Exact-head documentation update: baseline is now 80e967e27052327edeb9aeaf7ea2ef4d27893341; it records new integration PR #791 at 4c31c35 and the ADR-collision fix evidence. git diff --check passed.

[seonghobae]

Exact-head documentation update: baseline is now ea98f0962b471b2d61c8a86b4226b2a81110724b; #785 is refreshed to 21cb3e5 with the full 1460 passed proof and the omitted-token passthrough regression evidence. git diff --check passed.

[devin-ai-integration]

Devin Review found 1 new potential issue.

[devin-ai-integration]

🔍 ADR number uniqueness not verifiable from this checkout

CLAUDE.md now requires planning ADR filenames to be unique across main and every open PR. This PR adds 0023 and 0033; collisions with other open PRs cannot be checked from a single checkout. The baseline doc already records an earlier 0016→0023 rename to dodge a collision, so confirm these two numbers against the live open-PR set.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[seonghobae]

Merge-gate evidence (2026-08-25): All required checks green on current head except strix (org-wide NVIDIA NIM quota exhaustion — external provider-capacity blocker; serialization fix in ContextualWisdomLab/.github#1297). Local verification green.