docs: establish canonical LifeOS product and architecture baseline

[seonghobae]

Why

LifeOS had strong implementation evidence, feature specs, runbooks and research notes, but the whole product could not be reconstructed from one code-current documentation graph. Canonical PRD/TRD/ADR/data-model/UML/API/privacy/threat/test/operability/release/standards/traceability documents were missing, and the original 2026-08-02 combined design still contained assumptions superseded by protected main.

What this changes

• adds canonical docs/PRD.md and docs/TRD.md
• adds docs/DATA_MODEL.md with a service-owned logical ERD
• adds docs/UML.md with component, login/workspace, planning/Today, notification, calendar, AI, privacy, backup, deployment and degraded-mode views
• adds docs/API_CONTRACTS.md
• adds docs/PRIVACY_DATA_LIFECYCLE.md
• adds docs/RELEASE_AND_MIGRATION.md
• adds docs/STANDARDS_TRACEABILITY.md
• adds an ADR index plus decisions for product hosting/data evolution, UUIDv4, service-owned persistence, inert AI proposals, purpose-bound privacy access, work-conserving maintenance and the canonical documentation graph
• adds a repository threat model distinct from SECURITY.md
• adds canonical test strategy, operability and requirements/evidence traceability
• adds an explicit documentation completeness assessment
• reconciles historical local-first/browser-only, single-app, UUIDv7 and old post-MVP assumptions with current protected-main architecture
• updates root README/ARCHITECTURE/AGENTS/CLAUDE/CHANGELOG to expose and enforce the canonical graph
• adds documentation-contract.test.mjs so canonical presence, README links, ADR indexing/status, code fences, UUIDv4/MSA authority, service-owned persistence, inert AI authority, privacy/release gaps, and protected-main-vs-active-PR traceability cannot silently regress

Evidence discipline

Canonical docs use explicit statuses: Implemented on protected main, Implemented on active PR, Partial, Accepted architecture, Planned, Research only, Superseded, and Out of scope.

During this PR, #122 completed all exact-head CI/security/CodeRabbit gates and was guarded-squash-merged as protected main 876850018a17323900844e79845ba395b7bf6a9a; this branch was updated to treat the autonomous OpenCode development loop as protected-main evidence rather than stale active-PR evidence.

The documentation deliberately keeps incomplete outcomes explicit: durable Today multi-device reconciliation (#121), end-to-end tenant export/deletion (#55), hosted per-user calendar credentials/provider selection (#129), generic plugin runtime delivery, and stable-release evidence.

Additional repository-state improvements performed while this documentation PR remained open

• closed superseded duplicate scheduler issue Replace scheduled maintenance with NVIDIA NIM-backed OpenCode orchestration #119 in favor of current issue Add NVIDIA-backed OpenCode commercial development loop #120 / merged feat(agent): add NVIDIA-backed OpenCode development loop #122
• closed completed original CalDAV slice Add conflict-safe CalDAV time-block synchronization #51 and separated its hosted credential follow-up into Add encrypted per-user calendar credential lifecycle and provider selection #129
• opened Fix commercial-readiness false gap exhaustion from partial capability evidence #128 after proving the commercial-readiness audit can report 22/22, 100% configured maturity, and zero buyer gaps while live high-impact product gaps remain; Fix commercial-readiness false gap exhaustion from partial capability evidence #128 requires deterministic separation of capability-evidence maturity from whole-product gap exhaustion

Verification

A local clone/test attempt was made but the execution environment could not resolve github.com, so no local-pass claim is made. The PR must use exact-current-head repository CI/security/review evidence as the authoritative verification path. The new documentation contract is part of the normal @life-os/commercial-readiness test glob.

Continuation

Documentation completion is not the maintenance-loop exit condition. After this PR is gate-clean, the loop continues into the highest-value executable product/governance gap from live state, including #128, #121, #55, and #129 rather than treating a documentation pack as product completion.

Summary by CodeRabbit

• 문서

  • 제품 기능, 아키텍처, 데이터 모델, API 계약, 개인정보 처리, 보안 위협, 운영·배포·복구 기준을 체계적으로 정리했습니다.
  • 인증, 계획·습관·리뷰, 알림, 캘린더, AI 제안, 플러그인 및 데이터 권리의 현재 지원 범위와 제한사항을 명확히 했습니다.
  • 릴리스·마이그레이션 절차와 표준·연구 근거 추적성을 추가했습니다.

• 테스트

  • 필수 문서, 링크, ADR, 상태값 및 문서 간 일관성을 자동 검증하는 계약 테스트를 추가했습니다.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5da7ff12-eda0-4683-a9c1-a0329963b99a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

LifeOS의 canonical 제품·기술 문서 기준선을 확장했습니다. 서비스 경계, 데이터 소유권, 보안, 개인정보, 운영, 테스트, 릴리스, 추적성 규칙을 문서화했습니다. 문서 구조와 핵심 계약을 검증하는 테스트를 추가했습니다.

Changes

문서 기준선 및 운영 계약

Layer / File(s)	Summary
저장소 운영·작성 계약 AGENTS.md, CLAUDE.md	정확한 PR 상태 확인, writer lease, 검증 게이트, 문서 상태, 보안, AI 제공자 및 에스컬레이션 규칙을 정의했습니다.
아키텍처·서비스 경계 ARCHITECTURE.md, README.md, docs/adr/0001-product-hosting-and-data-evolution.md, docs/adr/0002-internal-identifiers-uuidv4.md, docs/adr/0003-domain-oriented-service-data-ownership.md	멀티유저 MSA, 서비스별 데이터 소유권, UUIDv4, PostgreSQL 경계, 외부 연동 및 배포 범위를 정리했습니다.
제품·기술·데이터 계약 docs/PRD.md, docs/TRD.md, docs/API_CONTRACTS.md, docs/DATA_MODEL.md, docs/PRIVACY_DATA_LIFECYCLE.md, docs/RELEASE_AND_MIGRATION.md	제품 요구사항, API·이벤트, 논리 데이터 모델, 개인정보 lifecycle, 마이그레이션 및 릴리스 기준을 추가했습니다.
보안·운영·추적성 docs/UML.md, docs/THREAT_MODEL.md, docs/OPERABILITY.md, docs/TRACEABILITY.md, docs/STANDARDS_TRACEABILITY.md	서비스 상호작용, 인증, AI 제안, 개인정보 접근, 위협, 운영 책임 및 표준 근거 추적을 문서화했습니다.
ADR 및 기준선 계획 docs/adr/*, docs/superpowers/plans/*, CHANGELOG.md	호스팅, UUIDv4, 데이터 소유권, AI 제안, 민감 데이터, 자율 유지보수, canonical 문서 그래프 및 readiness 분리 결정을 기록했습니다.
문서 계약 및 검증 기준 docs/TEST_STRATEGY.md, packages/commercial-readiness/src/documentation-contract.test.mjs	테스트·릴리스 증거 기준과 문서·링크·상태·ADR·소스 일관성 검증을 추가했습니다.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related issues

• [Documentation] Close canonical architecture coverage and live traceability gaps mightyETL#159: canonical 문서·추적성 그래프와 기계 검증 및 live PR 상태 조정 목표가 직접 연결됩니다.

Possibly related PRs

• ContextualWisdomLab/life-os#114: AI 제안 안전성과 오케스트레이션 경계를 이 PR의 문서·계약 기준과 연결합니다.
• ContextualWisdomLab/life-os#122: exact-head 검증, 자율 유지보수, credential 격리 및 writer 안전성 규칙과 직접 연결됩니다.
• ContextualWisdomLab/life-os#131: capability maturity와 buyer-gap readiness를 분리하는 ADR-0008과 직접 연결됩니다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 LifeOS의 제품 및 아키텍처 문서 기준선을 수립하는 PR의 주요 변경을 정확하고 간결하게 설명합니다.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/canonical-product-architecture-baseline

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

Current-head CI has a real canonical-ADR identity collision that remains source-level on this head. Protected main already contains docs/adr/0001-opaque-non-numeric-identifiers.md; this PR adds a second 0001-product-hosting-and-data-evolution.md. The documentation contract enumerates every NNNN-*.md, indexes by the four-digit number, and therefore cannot map both files to one exact [0001](...) target. Do not weaken the test or delete historical rationale. Preserve the inherited 0001 as history (canonicalize its status/required sections and mark it superseded by the current UUIDv4 formulation if appropriate), keep the current UUIDv4 decision at its unique ADR identity, and renumber the new hosting/data-evolution decision to a free unique number (for example 0009), updating the ADR index, required material set, and TRACEABILITY.md architecture-decision rows accordingly. Then require a fresh exact-head CI run; predecessor success does not transfer.

[seonghobae]

@opencode-agent Reconcile canonical documentation PR #126 only if contributor head is still exactly 9b8857295b18a1e3fc5c096e64183919ede46bb1 and protected main is still 38dde3fa44f6ad24d848c378237e55cbee79b3f0. Refuse to write if either moved.

This is a semantic reconciliation, not an ours/theirs conflict shortcut. Preserve #126's canonical PRD/TRD/ADR/UML/ERD graph while incorporating current protected-main facts from merged #131 and #133 and current active-PR facts from #127 and #134.

Required outcomes:

1. Resolve branch conflicts against current main without discarding protected-main fix(readiness): separate canonical buyer gaps from capability maturity #131 buyer-gap accounting or fix(agent): verify explicit model catalog and Compose runtime #133 OpenCode/model/Compose hardening.
2. Enforce the exact canonical status vocabulary everywhere applicable: Implemented on protected main, Implemented on active PR, Partial, Accepted architecture, Planned, Research only, Superseded, Out of scope. Move PR numbers/scope qualifiers into evidence/notes, never composite status cells/fields.
3. Update traceability so fix(readiness): separate canonical buyer gaps from capability maturity #131/fix(agent): verify explicit model catalog and Compose runtime #133 are protected-main evidence; feat(planning): add durable Today synchronization #127 durable Today and feat(identity): preserve authentication age across session rotation #134 authentication-age/data-rights prerequisite are Implemented on active PR where their code actually exists; retain Add complete tenant export and deletion orchestration #55/Add durable Today workspace synchronization with optimistic concurrency #121/Add encrypted per-user calendar credential lifecycle and provider selection #129/Complete plugin installation, secrets, and outbound delivery trust boundary #130 as unresolved/partial buyer gaps until their end-to-end contracts are protected-main complete.
4. Make documentation-contract tests validate real local link targets, exact ADR index targets/material ADR set, exact status vocabulary, and source/config/migration evidence for key UUIDv4/service-owned-persistence/inert-AI claims—not prose presence alone.
5. Do not claim feat(planning): add durable Today synchronization #127/feat(identity): preserve authentication age across session rotation #134 checks or merge completion. Do not modify their branches.
6. Run focused documentation-contract/commercial-readiness tests and root formatting/lint/typecheck relevant to changed root docs; leave the branch mergeable against current main with no conflict markers.

Do not change product behavior, dependencies, secrets, merge/release policy, or unrelated source in this task.

[seonghobae]

@opencode-agent Reconcile canonical documentation PR #126 only if contributor head is still exactly 9b8857295b18a1e3fc5c096e64183919ede46bb1 and protected main is still exactly ab6c15fcc12509f286e99cd36faf3047c40cee75; refuse to write if either moved.

The previous reconciliation request is intentionally stale because #134 has now merged. Perform one semantic current-main reconciliation, not an ours/theirs shortcut. Preserve #126's canonical PRD/TRD/ADR/UML/ERD graph while incorporating protected-main #131 buyer-gap accounting, #133 OpenCode/model/Compose hardening, and #134 session authentication-age provenance. Keep #127 as Implemented on active PR only where its current branch actually implements durable Today synchronization.

Required outcomes:

1. Resolve the current branch conflicts against ab6c15f... without discarding any protected-main source/test/workflow/documentation change.
2. Preserve the unique canonical ADR numbering already established on this branch and retain inherited historical ADR rationale with explicit supersession rather than deleting it.
3. Enforce only the exact canonical status values: Implemented on protected main, Implemented on active PR, Partial, Accepted architecture, Planned, Research only, Superseded, Out of scope; move qualifiers and PR numbers to evidence/notes.
4. Update PRD/TRD/TRACEABILITY/DATA_MODEL/UML/API/privacy/security/operability/release documentation for feat(identity): preserve authentication age across session rotation #134's authenticatedAt identity-session provenance as protected-main evidence and Add complete tenant export and deletion orchestration #55 as still Partial beyond that prerequisite.
5. Keep feat(planning): add durable Today synchronization #127 represented as active-PR evidence, not protected-main evidence, and keep Add encrypted per-user calendar credential lifecycle and provider selection #129/Complete plugin installation, secrets, and outbound delivery trust boundary #130 as open gaps unless fresh GitHub state proves otherwise.
6. Strengthen/retain machine-checkable documentation contracts against current source/migrations, actual local link targets, exact ADR targets/statuses, source-owned persistence, inert AI authority, and active-PR/protected-main distinctions.
7. Run the exact documentation/commercial-readiness tests plus root formatting/lint/typecheck/build relevant to changed files, then leave normal exact-head CI/security/review to GitHub.

Do not modify product implementation outside what is necessary to reconcile canonical documentation and its deterministic contract.

[seonghobae]

Superseded by #145, the clean canonical-documentation successor built directly from current protected main. The old branch is now 86 commits ahead and 10 commits behind with a common ancestor at the pre-#127/#139/#144 baseline, so preserving its ancestry would mix obsolete implementation history into a documentation-only integration. #145 reconciles the unique canonical PRD/TRD/ADR/UML/ERD/API/privacy/threat/test/operability/release/standards/traceability intent against current protected-main behavior and carries fresh exact-head documentation contract checks. Old #126 reviews/checks remain historical and do not transfer.

[seonghobae]

Superseded by #145. The canonical documentation families were preserved/reconciled onto a clean branch from current protected main instead of carrying this branch's heavily diverged implementation ancestry. #145 is now the single canonical documentation line; current protected-main root policy is retained and semantic gaps are being reconciled there. No checks/reviews from this historical head transfer to the successor.