From d08a91ccf27dcd343cba473beef160293b33bca4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 08:56:21 +0900 Subject: [PATCH 001/173] docs: add current LifeOS product requirements --- docs/PRD.md | 76 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 76 insertions(+) create mode 100644 docs/PRD.md diff --git a/docs/PRD.md b/docs/PRD.md new file mode 100644 index 000000000..1d7ee5f75 --- /dev/null +++ b/docs/PRD.md @@ -0,0 +1,76 @@ +# LifeOS Product Requirements Document + +**Status:** Implemented on active PR + +This document is the canonical product-level requirements index for LifeOS. Protected-main code, migrations, tests, and current GitHub policy are authoritative for shipped behavior. + +## Product definition + +LifeOS is a privacy-first, multi-user, server-backed and self-hostable personal operating system that connects Goals, Projects, Tasks, Habits, Today planning, review, calendar/reminders, auditable AI assistance, privacy/data-rights controls, and operator recovery into one user-authoritative workflow. + +## Historical decisions + +- **Superseded:** login-free browser-only/local-first storage as the primary architecture. Browser-local state remains valid only for explicit drafts/cache/offline UX. +- **Superseded:** a single Docker application as the durable product architecture. Docker Compose remains a deployment profile; domain services keep independent authority. +- **Superseded:** UUIDv7 internal identifiers. Protected main uses opaque UUIDv4 internal identifiers. + +## Status vocabulary + +Canonical requirements use exactly one of: `Implemented on protected main`, `Implemented on active PR`, `Partial`, `Accepted architecture`, `Planned`, `Research only`, `Superseded`, `Out of scope`. + +## Primary customer journey + +1. Google/GitHub login and personal workspace provisioning. +2. Goal -> Project -> Task and recurring Habit organization. +3. Explicit Today planning and completion. +4. Durable cross-device synchronization without silent stale overwrites. +5. Daily/weekly review based on durable evidence. +6. Calendar synchronization and bounded reminders. +7. Optional AI proposal generation with evidence and explicit accept/reject. +8. Privacy/data-rights export/deletion lifecycle. +9. Backup/recovery and accessible Korean/English PWA operation. +10. Operator deployment, readiness, observability, migration and release evidence. + +## Functional requirements + +| ID | Requirement | Status | Evidence / tracking | +| --- | --- | --- | --- | +| PRD-ID-001 | Google and GitHub login with revocable server-side sessions and tenant-derived authority. | Implemented on protected main | identity service and OAuth/session tests | +| PRD-ID-002 | Internal identifiers are opaque UUIDv4; provider IDs remain mapped metadata. | Implemented on protected main | `AGENTS.md`, service validators/migrations | +| PRD-PLAN-001 | Persist Goals, Projects and Tasks in planning-service-owned PostgreSQL. | Implemented on protected main | planning migrations/repository tests | +| PRD-PLAN-002 | Explicit durable Today synchronization with strong preconditions, idempotency and stale conflict handling. | Implemented on protected main | PR #127 merged as protected main; browser and PostgreSQL concurrency tests | +| PRD-HAB-001 | Recurring habits and durable completion history. | Implemented on protected main | habit service PostgreSQL tests | +| PRD-REV-001 | Guided review without becoming planning mutation authority. | Implemented on protected main | review service boundary/tests | +| PRD-CAL-001 | Conflict-safe CalDAV/Google calendar synchronization. | Implemented on protected main | calendar adapter tests | +| PRD-CAL-002 | Derive calendar workspace authority from signed trusted context, not legacy client headers. | Implemented on protected main | PR #139 merged; trusted-context tests | +| PRD-CAL-003 | Per-user encrypted Google Calendar credential lifecycle, refresh/revocation and calendar selection. | Partial | issue #129 | +| PRD-NOT-001 | Timezone-correct bounded reminders with replay-safe delivery. | Implemented on protected main | notification persistence/scheduler tests | +| PRD-AI-001 | AI output is inert proposal evidence until explicit authorized decision. | Implemented on protected main | AI proposal/audit tests | +| PRD-AI-002 | Deterministic proposal-quality/safety gates remain independent of live provider availability. | Implemented on protected main | evaluator/live-conformance split | +| PRD-PRIV-001 | Sensitive data access is tenant/purpose/lifetime/audit bound rather than blanket-masked. | Implemented on protected main | privacy-service tests | +| PRD-PRIV-002 | Data-rights requests preserve recent-auth provenance and durable immutable request/terminal receipts. | Implemented on protected main | PRs #134, #136, #137, #138 and #144 integrated on main | +| PRD-PRIV-003 | Complete export/deletion orchestration across every owned domain, delivery lifecycle and reconciliation. | Partial | issue #55 | +| PRD-INT-001 | Versioned plugin SDK/validation without direct database authority. | Implemented on protected main | plugin SDK/integration-service tests | +| PRD-INT-002 | Plugin installation grants, encrypted secrets, SSRF-safe outbound delivery, retries and revocation. | Planned | issue #130 | +| PRD-WEB-001 | Responsive installable PWA with keyboard-operable core flows and Korean/English catalogs. | Implemented on protected main | browser/accessibility/localization tests | +| PRD-OPS-001 | Logical PostgreSQL backup/restore with integrity and unsafe-target refusal. | Implemented on protected main | backup scripts/tests/runbook | +| PRD-OPS-002 | Provider-neutral production reference deployment and bounded health/readiness/metrics. | Implemented on protected main | infra and observability tests | +| PRD-GOV-001 | Capability maturity and buyer-gap exhaustion are reported independently. | Implemented on protected main | buyer-gap registry and issue #21 report | +| PRD-GOV-002 | Required PR verification identifies the commit tree actually checked and does not conflate synthetic merge evidence with exact source-head evidence. | Planned | issue #132 | + +## Non-functional requirements + +- Fail closed on malformed ownership, UUIDs, signatures, digests, timestamps and untrusted provider data. +- Parameterize dynamic SQL and keep service-owned database authority explicit. +- Use idempotency and version/precondition controls wherever replay or stale overwrite can cause loss. +- Public errors/logs/metrics/artifacts exclude credentials, hidden reasoning and unbounded tenant content. +- Core customer journeys require realistic PostgreSQL and browser evidence, not mock-only success. +- Product-owned production packages maintain exact coverage gates where configured and beginner-readable public documentation. + +## Non-goals + +LifeOS does not claim medical diagnosis/treatment, autonomous consequential employment/credit/legal decisions, silent AI mutation of user data, provider availability guarantees, cross-service direct database access, certification without independent evidence, or unmeasured public SLA/RPO/RTO values. + +## Release outcome + +A stable release requires one exact protected integrated head where product journey, tenant/privacy boundaries, required CI/security/review, coverage, packaging, SBOM/provenance, migration/rollback, backup/restore, accessibility/localization, deployment and operational acceptance pass together. \ No newline at end of file From b2de55c3177d51a2c7fc845ad2df0e4623a70b72 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 08:56:43 +0900 Subject: [PATCH 002/173] docs: add current LifeOS technical requirements --- docs/TRD.md | 104 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 104 insertions(+) create mode 100644 docs/TRD.md diff --git a/docs/TRD.md b/docs/TRD.md new file mode 100644 index 000000000..a1b2627ef --- /dev/null +++ b/docs/TRD.md @@ -0,0 +1,104 @@ +# LifeOS Technical Requirements Document + +**Status:** Implemented on active PR + +## Purpose + +This document defines repository-wide technical requirements. Owning-service code, migrations, tests, versioned contracts and runbooks remain the implementation authority. + +## Runtime baseline + +LifeOS is a TypeScript-first monorepo with a Next.js PWA/BFF, independently bounded services, PostgreSQL service-owned persistence and NATS JetStream where durable asynchronous events are required. Optional external providers include Google/GitHub identity, Google/CalDAV calendar providers, NVIDIA NIM through approved AI boundaries, and versioned plugins. + +## Bounded contexts + +- **Web/PWA:** interaction state and explicitly local drafts/cache; never direct DB authority. +- **Gateway/BFF:** public composition and authenticated context derivation; not a shared domain store. +- **Identity:** internal users, external identity mappings, sessions, workspace membership/authorization context and data-rights request ownership. +- **Planning:** Goals, Projects, Tasks, durable Today aggregate and search. +- **Habit:** recurrence definitions and completion evidence. +- **Review:** review snapshots/projections; no direct planning mutation. +- **Calendar integration:** provider adapters, sync state and trusted workspace context. Per-user hosted credential lifecycle remains partial under #129. +- **Notification:** reminder occurrences, claims, outcomes and delivery recovery. +- **AI proposal:** proposals, evidence, explicit decisions and deterministic evaluation; no generic planning mutation authority. +- **Privacy:** purpose-bound sensitive-access decisions/grants/events. +- **Plugin integration:** versioned plugin contracts and validation; installation/secrets/outbound delivery remain planned under #130. + +## Data requirements + +1. Each service owns persistence, migrations and DB credentials; cross-service table access is prohibited. +2. Internal durable identifiers are opaque UUIDv4. +3. Product-owned database objects use descriptive multiword `snake_case`. +4. Persist instants in UTC and IANA timezone/local-calendar values where civil-time semantics matter. +5. Immutable audit/decision/completion/receipt evidence rejects mutation; mutable state uses explicit revision/digest/ETag/idempotency/fencing where loss or replay is plausible. +6. Browser-local state is not durable until the owning service accepts it. + +## Authentication and authorization + +- OAuth/OIDC callbacks validate state, provider and redirect boundaries. +- Browser sessions are revocable and server-verifiable. +- Client-selected workspace/actor identifiers are never trusted as authority. +- Signed private context binds exact actor/workspace/method/path and bounded issuance time where service separation requires it. +- Calendar synchronization uses the trusted signed workspace context implemented on protected main; legacy workspace headers cannot override it. +- Sensitive operations add purpose/resource/tenant authorization and, for data rights, recent-authentication policy derived from authentication provenance rather than session rotation. + +## HTTP/API requirements + +- Bound bodies and provider responses before retention. +- Derive ownership from authenticated/signed context. +- Use replay protection for repeatable mutations. +- Use explicit stale-write preconditions where silent overwrite is unacceptable. +- Return bounded credential-free problems. +- Never expose dependency bodies, tokens, stack traces or internal URLs. +- Version breaking shared-contract semantics. + +## Event requirements + +Versioned events carry opaque event ID, explicit type/version, validated actor/workspace/correlation/causation context and immutable payload semantics. Consumers are idempotent under replay. Cross-service events never grant direct database mutation authority. + +## Domain concurrency/idempotency + +- **Today:** protected-main aggregate uses explicit strong create/update preconditions, idempotency and stale-conflict handling with durable PostgreSQL concurrency evidence. +- **Habit completion:** tenant-scoped replay-safe persistence. +- **Notification:** expiring/fenced claims and duplicate-delivery refusal. +- **Calendar:** deterministic provider identity/preconditions and trusted context. +- **AI decisions:** bind decision to exact proposal digest/revision, actor/workspace and idempotency identity. +- **Data rights:** durable request identity and immutable terminal receipts; status lookup is scoped simultaneously by request, workspace and requesting user and fails closed on corruption. + +## AI / automation requirements + +Model output is untrusted structured data. Deterministic validators and user/product authorization remain authoritative. Live provider availability is separated from deterministic merge gates. Scheduled autonomous development uses reviewed OpenCode with `NVIDIA_NIM_API_KEY`; `COPILOT_GITHUB_TOKEN` is prohibited. A strong single-route baseline precedes deeper orchestration and evaluation records role, stage, reasoning effort, decomposition, recursion and access topology. + +## Security/privacy requirements + +- Treat external responses, stored JSON, environment values, model output and connector results as untrusted. +- Keep SQL structure static and parameterized. +- Use least-privilege GitHub/runtime/database permissions and bounded network/file/subprocess behavior. +- Public artifacts exclude credentials, raw model prompts/responses, hidden reasoning and unbounded tenant data. +- Sensitive access is purpose/lifetime/resource scoped with audit evidence; blanket masking is not the primary control. +- Data-rights end-to-end domain participation, durable reconciliation, retention/legal hold and protected export delivery remain partial under #55. + +## Web/accessibility/localization + +Core journeys remain keyboard operable with visible focus and non-color-only state. Korean/English catalogs remain structurally aligned. Offline/local drafts must never imply durable sync until server acceptance. Stale async responses cannot overwrite newer owned UI state. + +## Observability and operations + +Services expose bounded health/readiness appropriate to actual dependencies. Metrics are operator-only in production exposure. Logs are structured, bounded and credential-free. Logical backup/restore proves integrity and unsafe-target refusal; it does not imply PITR. Compose is a self-hosted composition profile and Kubernetes artifacts are a provider-neutral reference rather than managed infrastructure provisioning. + +## Verification model + +Required evidence classes are distinct: + +- exact contributor source-head verification; +- merge-tree/live-base compatibility evidence where intentionally retained; +- protected-main operational evidence; +- formal review evidence; +- security scanner evidence; +- optional model-backed conformance evidence. + +A green result for one class cannot be promoted to another. Issue #132 tracks repository-wide exact-source-head attribution hardening. + +## Release requirements + +Release requires one unchanged integrated protected head with required CI/security/review, exact configured coverage, package/container build, migration/rollback/recovery, accessibility/localization, SBOM/provenance/reproducibility and operational acceptance. A single merged feature or documentation PR is not release readiness. \ No newline at end of file From 3b075c3e00758951d8350695183ac68e667f2301 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 08:57:00 +0900 Subject: [PATCH 003/173] docs: add current LifeOS logical data model --- docs/DATA_MODEL.md | 114 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 114 insertions(+) create mode 100644 docs/DATA_MODEL.md diff --git a/docs/DATA_MODEL.md b/docs/DATA_MODEL.md new file mode 100644 index 000000000..246a7a8d7 --- /dev/null +++ b/docs/DATA_MODEL.md @@ -0,0 +1,114 @@ +# LifeOS Logical Data Model + +**Status:** Implemented on active PR + +This document describes service ownership and logical relationships. It does not authorize cross-service SQL joins. Physical schema truth remains in each owning service's migrations. + +## Ownership rules + +- Each bounded context owns its schema/database role, migrations and credentials. +- Shared opaque UUIDv4 values are logical references, not permission for direct cross-service table access. +- Product-owned database objects use descriptive multiword `snake_case`. +- Conceptual entities below are labeled when they are not persisted on protected main. + +## Logical ERD + +```mermaid +erDiagram + USER_ACCOUNT ||--o{ EXTERNAL_IDENTITY : maps + USER_ACCOUNT ||--o{ BROWSER_SESSION : owns + USER_ACCOUNT ||--o{ WORKSPACE_MEMBERSHIP : joins + WORKSPACE_RECORD ||--o{ WORKSPACE_MEMBERSHIP : contains + + WORKSPACE_RECORD ||--o{ GOAL_RECORD : contains + GOAL_RECORD ||--o{ PROJECT_RECORD : organizes + PROJECT_RECORD ||--o{ TASK_RECORD : contains + WORKSPACE_RECORD ||--o{ TODAY_AGGREGATE : owns + TODAY_AGGREGATE ||--o{ TODAY_ACTION : contains + + WORKSPACE_RECORD ||--o{ HABIT_RECORD : contains + HABIT_RECORD ||--o{ HABIT_COMPLETION : records + WORKSPACE_RECORD ||--o{ REVIEW_RECORD : contains + + WORKSPACE_RECORD ||--o{ CALENDAR_CONNECTION : authorizes + CALENDAR_CONNECTION ||--o{ CALENDAR_SYNC_RECORD : tracks + WORKSPACE_RECORD ||--o{ REMINDER_RECORD : contains + REMINDER_RECORD ||--o{ DELIVERY_OUTCOME : records + + WORKSPACE_RECORD ||--o{ AI_PROPOSAL : contains + AI_PROPOSAL ||--o{ AI_DECISION : decides + + WORKSPACE_RECORD ||--o{ PRIVACY_GRANT : authorizes + WORKSPACE_RECORD ||--o{ DATA_RIGHTS_REQUEST : owns + DATA_RIGHTS_REQUEST ||--o{ DATA_RIGHTS_RECEIPT : terminates + + WORKSPACE_RECORD ||--o{ PLUGIN_INSTALLATION : grants + PLUGIN_INSTALLATION ||--o{ PLUGIN_DELIVERY : attempts +``` + +## Service-owned entities + +### Identity service — persisted on protected main + +- `user_account` +- `external_identity` +- `browser_session` +- `workspace_record` +- `workspace_membership` +- `data_rights_request` and immutable terminal receipt state as defined by current migrations/repositories + +Authentication provenance is retained independently from session rotation so recent-auth policy can be enforced correctly. + +### Planning service — persisted on protected main + +- `goal_record` +- `project_record` +- `task_record` +- durable Today aggregate/action/revision/idempotency state introduced by PR #127 + +Planning migrations are authoritative; review/search projections are not mutation authority. + +### Habit service — persisted on protected main + +- `habit_record` +- `habit_completion` + +### Review service + +Review snapshots/projections are service-owned. They consume planning/habit evidence without becoming their source of truth. + +### Notification service — persisted on protected main + +- reminder occurrence/claim records +- immutable delivery outcomes/inbox evidence + +### AI proposal service — persisted on protected main + +- proposal evidence +- explicit accept/reject decision evidence + +### Privacy service — persisted on protected main + +- purpose-bound access decisions +- bounded grants +- append-only privacy/audit events + +### Calendar integration + +Current protected main includes sync/provider state and trusted signed workspace-context verification. `calendar_connection` as a complete hosted per-user encrypted credential lifecycle remains **conceptual/planned** under issue #129. + +### Plugin integration + +Manifest/contract validation exists on protected main. `plugin_installation` and `plugin_delivery` are **conceptual/planned** under issue #130; they are not persisted merely because they appear in this logical model. + +## Data-rights lifecycle + +Protected main currently proves recent-authentication provenance, authenticated ownership binding, durable request/terminal receipt persistence and tenant-scoped request lookup. The whole-product export/deletion participant/reconciliation/delivery model remains partial under issue #55. + +## Temporal/provenance fields + +Where current migrations define them, records retain creation/update/completion/expiry/revision/idempotency/digest evidence. Persist UTC instants and IANA timezone/local-calendar values where civil-time semantics matter. Do not add temporal columns solely to satisfy this diagram. + +## Cross-service relationships + +Every cross-service relationship is resolved through a versioned HTTP/event/saga/plugin contract. No foreign key or shared table is implied across bounded service ownership. \ No newline at end of file From 44e6f3ea620fee9000e1c5394a06a58bb095051b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 08:57:24 +0900 Subject: [PATCH 004/173] docs: add code-current LifeOS UML views --- docs/UML.md | 185 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 185 insertions(+) create mode 100644 docs/UML.md diff --git a/docs/UML.md b/docs/UML.md new file mode 100644 index 000000000..c206df07f --- /dev/null +++ b/docs/UML.md @@ -0,0 +1,185 @@ +# LifeOS UML and Interaction Views + +**Status:** Implemented on active PR + +These diagrams describe current protected-main behavior unless a node is explicitly marked `Partial` or `Planned`. + +## Bounded-context topology + +```mermaid +flowchart LR + U[Web / PWA] --> B[Gateway / BFF] + B --> I[Identity] + B --> P[Planning] + B --> H[Habit] + B --> R[Review] + B --> C[Calendar] + B --> N[Notification] + B --> A[AI Proposal] + B --> V[Privacy] + B --> X[Plugin Integration] + P -. domain events .-> J[(NATS JetStream)] + H -. domain events .-> J + R -. projection/events .-> J + J -. reminder/event inputs .-> N + + I --> IDB[(identity-owned PostgreSQL)] + P --> PDB[(planning-owned PostgreSQL)] + H --> HDB[(habit-owned PostgreSQL)] + N --> NDB[(notification-owned PostgreSQL)] + A --> ADB[(AI-owned PostgreSQL)] + V --> VDB[(privacy-owned PostgreSQL)] +``` + +## Login and workspace sequence + +```mermaid +sequenceDiagram + participant Browser + participant Web + participant Identity + participant Provider as Google/GitHub + Browser->>Web: begin login + Web->>Identity: create bounded OAuth transaction + Identity->>Provider: authorization request + Provider-->>Identity: callback code/state + Identity->>Identity: validate provider/state/redirect and map external identity + Identity->>Identity: provision/authorize personal workspace + Identity-->>Web: revocable session + opaque account/workspace UUIDv4 + Web-->>Browser: secure session cookie +``` + +## Goal / Project / Task / Today lifecycle + +```mermaid +stateDiagram-v2 + [*] --> LocalDraft + LocalDraft --> DurableToday: explicit save + If-None-Match/If-Match + DurableToday --> DurableToday: versioned update + DurableToday --> Conflict: stale strong precondition + Conflict --> DurableToday: recheck + explicit reconciliation + DurableToday --> Completed: explicit completion + Completed --> [*] +``` + +The durable Today aggregate, local-to-workspace migration, replay protection and stale reconciliation are implemented on protected main through PR #127. + +## Review flow + +```mermaid +sequenceDiagram + participant User + participant Review + participant Planning + participant Habit + User->>Review: start daily/weekly review + Review->>Planning: read bounded planning evidence + Review->>Habit: read completion evidence + Review->>Review: build review projection/snapshot + Review-->>User: guided review result + Note over Review,Planning: Review never mutates Planning tables directly. +``` + +## Calendar synchronization + +```mermaid +sequenceDiagram + participant Web + participant Identity + participant Calendar + participant Provider + Web->>Identity: validate session / derive workspace + Identity-->>Web: workspace authority + Web->>Calendar: signed workspace context + bounded sync request + Calendar->>Calendar: verify signature, issuance, method/path and UUIDv4 workspace + Calendar->>Provider: conflict-safe provider operation + Provider-->>Calendar: bounded untrusted response + Calendar-->>Web: sanitized sync result +``` + +Per-user encrypted credential persistence/refresh/revocation and calendar selection are **Partial** and tracked by issue #129. + +## AI proposal / evidence / decision + +```mermaid +sequenceDiagram + participant Browser + participant Web + participant Identity + participant AI + participant Audit + Browser->>Web: proposal request + Web->>Identity: validate session + Identity-->>Web: actor + workspace UUIDv4 + Web->>AI: signed actor/workspace/method/path context + AI->>AI: bound/validate untrusted model output + AI->>Audit: persist immutable proposal evidence + AI-->>Web: inert proposal + Browser->>Web: explicit accept/reject + Web->>AI: authorized decision bound to proposal digest/revision + AI->>Audit: append decision evidence +``` + +## Data-rights sequence + +```mermaid +sequenceDiagram + participant User + participant Web + participant Identity + participant Domains as Registered domain participants + User->>Web: export/delete request + Web->>Identity: validate session + recent-auth provenance + Identity->>Identity: bind request to workspace/requesting user + Identity->>Identity: persist durable request receipt + Identity->>Domains: bounded export / prepare-delete orchestration + Domains-->>Identity: domain evidence + Identity-->>User: bounded status / result +``` + +Recent-auth provenance, ownership binding, durable request/terminal receipt and tenant-scoped status lookup are protected-main behavior. Complete domain participation, durable reconciliation, retention/legal-hold and protected archive delivery remain **Partial** under issue #55. + +## Backup / restore + +```mermaid +sequenceDiagram + participant Operator + participant Backup + participant Store + participant Restore + Operator->>Backup: logical backup + Backup->>Backup: produce integrity/checksum evidence + Backup->>Store: write backup artifact + Operator->>Restore: restore into approved target + Restore->>Restore: reject corruption / unsafe non-empty target + Restore-->>Operator: verified restore evidence +``` + +## Deployment topology + +```mermaid +flowchart TB + Ingress[Ingress / TLS] --> Web[Web/BFF] + Web --> Services[Independent LifeOS services] + Services --> IStore[(identity role/schema)] + Services --> PStore[(planning role/schema)] + Services --> HStore[(habit role/schema)] + Services --> NStore[(notification role/schema)] + Services --> AStore[(AI role/schema)] + Services --> VStore[(privacy role/schema)] + Services <--> NATS[(NATS JetStream)] + Operator[Operator secret manager / network policy / backups / monitoring] -. configures .-> Services +``` + +The nodes represent separate service-owned database authority even when an operator co-locates them on one PostgreSQL cluster. + +## Degraded modes + +```mermaid +flowchart LR + ProviderDown[Identity/calendar/model provider unavailable] --> BoundedFailure[Sanitized dependency-unavailable result] + DbDown[Owning DB unavailable] --> NoFalseSuccess[Fail without durable-success claim] + StaleWrite[Stale revision/precondition] --> Conflict[Explicit conflict] + BadContext[Malformed/forged context] --> Deny[Fail closed] + ModelDown[Model unavailable] --> Deterministic[Deterministic product gates remain available] +``` From 50bda95e58e2c34979a1d0ec9ead7abcc99a0cd3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 08:57:40 +0900 Subject: [PATCH 005/173] docs: add LifeOS API and event contracts --- docs/API_CONTRACTS.md | 48 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 docs/API_CONTRACTS.md diff --git a/docs/API_CONTRACTS.md b/docs/API_CONTRACTS.md new file mode 100644 index 000000000..4a5053e4b --- /dev/null +++ b/docs/API_CONTRACTS.md @@ -0,0 +1,48 @@ +# LifeOS API and Event Contracts + +**Status:** Implemented on active PR + +This file indexes stable repository-level API/event invariants. Concrete route schemas remain owned by the implementing service and tests. + +## Common rules + +- Internal IDs are opaque UUIDv4. +- Ownership is derived from authenticated/signed context, never arbitrary browser headers or request bodies. +- Mutations use idempotency and/or strong preconditions where replay/stale overwrite is plausible. +- Public failures are bounded and credential-free. +- Provider responses and model output are untrusted until schema/boundary validation. +- Cross-service contracts never grant direct database authority. + +## Contract registry + +| Contract | Owner | Status | Notes | +| --- | --- | --- | --- | +| OAuth login/callback/session | identity-service | Implemented on protected main | Google/GitHub, bounded state/redirect/session lifecycle | +| Planning Goal/Project/Task APIs | planning-service | Implemented on protected main | tenant-derived authority | +| Durable Today aggregate | planning-service | Implemented on protected main | strong ETag/precondition, idempotency, explicit conflict semantics; PR #127 | +| Habit recurrence/completion | habit-service | Implemented on protected main | tenant-scoped replay-safe completion | +| Review projection | review-service | Implemented on protected main | read/projection authority only | +| Calendar sync request | calendar integration | Implemented on protected main | signed trusted workspace context; PR #139 | +| Per-user calendar connection OAuth/credential API | calendar integration | Planned | issue #129 | +| Reminder scheduling/delivery | notification-service | Implemented on protected main | bounded claims/retries/outcomes | +| AI proposal/evidence/decision | AI proposal service | Implemented on protected main | inert proposal, explicit decision | +| Purpose-bound privacy access | privacy-service | Implemented on protected main | actor/resource/purpose/lifetime bound | +| Data-rights request/status | identity-service | Partial | durable receipt and tenant-scoped lookup exist; complete public orchestration under #55 | +| Plugin manifest/event validation | integration-service | Implemented on protected main | versioned SDK/validation | +| Plugin installation/secrets/outbound delivery | integration-service | Planned | issue #130 | + +## Event envelope + +When asynchronous events are used, the envelope includes a unique opaque event ID, explicit event type/version, validated workspace/actor where applicable, correlation/causation identifiers, occurrence/publication time, and a bounded immutable payload. Consumers must be idempotent under at-least-once delivery. + +## Planning completion event + +`planning.task.completed.v1` and similar events are evidence notifications, not permission for a consumer to write planning tables. + +## Versioning + +Breaking route/event/schema semantics require explicit versioning or a reviewed migration contract. Unknown versions fail closed. + +## Evidence identity + +Verification tooling distinguishes contributor source head, PR-base snapshot, independently resolved live base, synthetic merge candidate, protected main and release artifact identities. Issue #132 tracks broad required-workflow exact-source attribution. \ No newline at end of file From 900575b06108943d94a78c2955f3580f895b66a1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 08:58:03 +0900 Subject: [PATCH 006/173] docs: add privacy and data lifecycle contract --- docs/PRIVACY_DATA_LIFECYCLE.md | 70 ++++++++++++++++++++++++++++++++++ 1 file changed, 70 insertions(+) create mode 100644 docs/PRIVACY_DATA_LIFECYCLE.md diff --git a/docs/PRIVACY_DATA_LIFECYCLE.md b/docs/PRIVACY_DATA_LIFECYCLE.md new file mode 100644 index 000000000..fe39ace71 --- /dev/null +++ b/docs/PRIVACY_DATA_LIFECYCLE.md @@ -0,0 +1,70 @@ +# LifeOS Privacy and Data Lifecycle + +**Status:** Implemented on active PR + +## Control model + +LifeOS preserves business utility while limiting sensitive-data access through tenant-derived authority, explicit purpose/resource/lifetime controls, least privilege, encryption/secret boundaries, retention and auditable privileged access. Blanket PII masking is not the product's primary control. + +## Data classes + +- identity/account and external-provider mapping; +- session/authentication provenance; +- planning, habit and review content; +- calendar connection/synchronization metadata; +- reminder/delivery evidence; +- AI proposal/evidence/decision records; +- privacy access decisions/grants/events; +- data-rights request/receipt evidence; +- operator logs/metrics and release/CI evidence. + +Provider credentials, browser cookies, raw model prompts/responses and hidden reasoning are protected secret/transient material and do not belong in public artifacts. + +## Lifecycle rules + +1. **Collect:** accept only bounded fields required by the owning service contract. +2. **Authorize:** derive workspace/actor from trusted authenticated/signed context. +3. **Use:** constrain sensitive access to explicit resource/purpose/lifetime. +4. **Persist:** store only in the owning service with service-owned credentials/migrations. +5. **Observe:** logs/metrics expose bounded credential-free operational evidence. +6. **Retain:** retention is explicit by data class; immutable evidence is retained only as required by product/legal/operator policy. +7. **Export/Delete:** recent-authenticated workspace owner requests are tracked through durable request evidence; complete domain orchestration remains partial. +8. **Backup:** backups follow the same sensitivity/tenant/operator controls and erasure claims must account for documented backup expiry rather than imply instantaneous physical disappearance. + +## Current protected-main data-rights evidence + +**Status:** Partial + +Protected main includes: + +- authentication-age provenance that survives session rotation; +- fail-closed recent-auth policy; +- authenticated workspace/requesting-user binding; +- durable data-rights request and immutable terminal receipt persistence; +- tenant-scoped request lookup bound simultaneously to request ID, workspace ID and requesting user ID. + +Tracking: issue #55 remains open for complete domain participation, durable async reconciliation/operator alerts, retention/legal-hold semantics, backup-expiry evidence, protected streamed archive delivery/encryption/expiry and download audit. + +## Calendar credentials + +**Status:** Partial + +Protected main verifies signed trusted workspace context for calendar synchronization. Hosted per-user encrypted access/refresh credential storage, refresh/revocation, OAuth/PKCE callback lifecycle and calendar selection remain tracked by issue #129. + +## Plugin credentials + +**Status:** Planned + +Issue #130 owns plugin installation grants, encrypted secret handles, SSRF-safe outbound delivery, retry/audit and revocation. Existing plugin validation does not imply runtime secret authority. + +## Deletion semantics + +No service may claim whole-workspace deletion merely because its own tables were erased. A complete deletion outcome requires every registered owning domain to participate in the exact request, deterministic reconciliation of partial outcomes, retention/legal-hold handling and immutable final evidence. Unknown/missing participants fail closed. + +## Security/privacy invariants + +- no browser-selected tenant authority; +- no cross-service direct database access; +- no plaintext third-party credential in logs, metrics, public errors, model prompts, CI artifacts or audit rows; +- no raw user content in release/provenance artifacts unless explicitly authorized and bounded; +- no data-rights success claim from a partial or unknown participant state. \ No newline at end of file From 9f2aeb23d2c4bcade5ffe1d678cc67a7fe49d5f0 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 08:58:21 +0900 Subject: [PATCH 007/173] docs: add LifeOS threat model --- docs/THREAT_MODEL.md | 70 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 70 insertions(+) create mode 100644 docs/THREAT_MODEL.md diff --git a/docs/THREAT_MODEL.md b/docs/THREAT_MODEL.md new file mode 100644 index 000000000..4ab6d0a58 --- /dev/null +++ b/docs/THREAT_MODEL.md @@ -0,0 +1,70 @@ +# LifeOS Threat Model + +**Status:** Implemented on active PR + +## Assets + +- tenant-owned planning/habit/review/calendar data; +- account/session/authentication provenance; +- provider credentials and signing keys; +- AI proposal/evidence/decision records; +- privacy grants and data-rights receipts; +- backup/release artifacts and CI evidence. + +## Trust boundaries + +```mermaid +flowchart LR + Browser[Untrusted browser inputs] --> Web[Authenticated web/BFF] + Web --> Identity[Identity service] + Web --> Planning[Planning service] + Web --> Calendar[Calendar service] + Web --> AI[AI proposal service] + Web --> Privacy[Privacy service] + Identity --> IDB[(identity-owned store)] + Planning --> PDB[(planning-owned store)] + Calendar --> CProvider[Untrusted calendar provider] + AI --> Model[Untrusted model provider] + AI --> ADB[(AI-owned store)] + Privacy --> VDB[(privacy-owned store)] +``` + +Co-location on one PostgreSQL cluster does not create shared-table authority. Each service owns its role/schema/migrations. + +## Threats and controls + +| Threat | Boundary | Primary controls | Current state | +| --- | --- | --- | --- | +| Tenant/workspace injection | browser -> services | authenticated/signed context; reject legacy/client ownership | Implemented on protected main | +| Cross-service DB privilege confusion | service -> PostgreSQL | service-owned credentials/schema/migrations; no cross-service table access | Implemented on protected main | +| OAuth state/redirect confusion | identity/provider | bounded transaction, state and redirect validation | Implemented on protected main | +| Calendar workspace spoofing | web/calendar | signed workspace/method/path/issuance context | Implemented on protected main | +| Calendar token theft/replay | calendar/provider | per-user encrypted lifecycle, refresh/revocation, PKCE/state | Partial — #129 | +| Stale multi-device overwrite | web/planning | strong preconditions, revisions, explicit conflict reconciliation | Implemented on protected main | +| Replay/duplicate side effects | mutable domains | idempotency keys, immutable outcomes, fencing where applicable | Implemented on protected main | +| AI prompt injection / silent mutation | model/AI | model output as untrusted inert proposal; deterministic validation; explicit decision | Implemented on protected main | +| Sensitive-data overexposure | privacy/public surfaces | purpose/resource/lifetime grants; bounded logs/errors/artifacts | Implemented on protected main | +| Data-rights false completion | identity/domain participants | durable request identity; immutable receipt; explicit participant/reconciliation contract | Partial — #55 | +| Plugin self-escalation/SSRF/secret leak | plugin integration | explicit grants, encrypted handles, authorized origins, rebinding/redirect/size/time controls | Planned — #130 | +| CI evidence identity confusion | GitHub workflow | explicit source-head vs merge-tree/live-base evidence classes | Partial — #132 | +| Backup corruption/unsafe restore | operator/backup | checksums, validation, non-empty target refusal | Implemented on protected main | + +## AI-specific controls + +AI proposals remain inert and auditable. Browser credentials and provider secrets are not model inputs. Live-provider availability cannot fabricate deterministic merge success. Deeper orchestration is permitted only after measured quality/control evidence over a strong single-route baseline. + +## Data-rights abuse cases + +- forged request/workspace/user UUIDs fail before SQL; +- cross-workspace or cross-requesting-user status lookup returns no existence signal; +- duplicate/corrupt persisted request rows fail closed; +- session rotation does not reset authentication age; +- whole-product erasure is not claimed until every required domain is reconciled. + +## Failure and recovery + +Dependency outage returns sanitized unavailable evidence and never false durable success. Partial durable workflows retain replay/reconciliation identity. Restore/migration/release claims require explicit evidence appropriate to the changed state. + +## Review triggers + +Update this threat model when a service gains new persistence/credential/network authority, a new external provider is introduced, the plugin runtime becomes executable, data-rights orchestration changes, or required verification evidence classes change. \ No newline at end of file From bd0c941815b562a4c9fb902a03cb743e6177463d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 08:58:40 +0900 Subject: [PATCH 008/173] docs: add LifeOS test strategy --- docs/TEST_STRATEGY.md | 83 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 83 insertions(+) create mode 100644 docs/TEST_STRATEGY.md diff --git a/docs/TEST_STRATEGY.md b/docs/TEST_STRATEGY.md new file mode 100644 index 000000000..4d9227732 --- /dev/null +++ b/docs/TEST_STRATEGY.md @@ -0,0 +1,83 @@ +# LifeOS Test Strategy + +**Status:** Implemented on active PR + +## Principles + +LifeOS tests prove domain behavior and authority boundaries, not only implementation reachability. Source changes follow RED -> minimal GREEN -> refactor where practical. Required checks are attributed to the revision they actually inspect. + +## Test layers + +### Unit/domain + +Validate UUIDv4, ownership, signatures, digests, recurrence, idempotency, stale preconditions, state transitions and bounded failure classes with deterministic tests. + +### PostgreSQL integration + +Use real PostgreSQL for service-owned persistence behavior, including tenant isolation, transactions, concurrent/replayed requests, immutable evidence, migration compatibility and restart durability. + +Current examples include durable planning/Today concurrency, habit persistence, notification claim/outcome behavior, AI/privacy persistence and identity data-rights ledgers. + +### HTTP integration + +Exercise actual authenticated/signed request boundaries, malformed input, content type, conflict and dependency-failure semantics. Tests must prove that client-selected ownership cannot create authority. + +### Browser acceptance + +Exercise real core journeys with Playwright where the user-visible contract is material: login/onboarding, capture/Today, durable Today synchronization/conflicts, accessibility/localization and PWA behavior. + +### Security regression + +Cover AppGuardrail/Semgrep/security classes, SQL/static structure, context signing, tenant substitution, untrusted provider responses, prompt injection, secret leakage, hostile URLs where networking is introduced, and bounded error/artifact behavior. + +### Backup/deployment/release + +Executable tests validate Compose/reference deployment sources, liveness/readiness, backup checksum/restore refusal and package/release/provenance contracts. + +## Coverage + +Packages with exact gates retain meaningful 100% statement, branch, function and line coverage. Coverage cannot be satisfied by deleting real behavior, broad exclusions or mock-only assertions. Public production declarations require explanatory documentation under the owning package's configured gate. + +## Concurrency and replay matrix + +- Today: duplicate idempotency key, conflicting reuse, stale precondition, concurrent create/update, connection cleanup. +- Habit: duplicate completion and tenant conflict. +- Notification: duplicate claim/delivery, expiry/recovery. +- AI: stale/replayed proposal decisions. +- Privacy: exact-expiry and single-use grant behavior. +- Data rights: request collision, immutable receipt, tenant-scoped lookup, future async reconciliation. +- Calendar: provider preconditions and trusted-context replay/issuance bounds. + +## Evidence identity + +A test/check must identify whether it inspected: + +1. exact contributor source head; +2. synthetic merge candidate; +3. independently resolved live-base compatibility state; +4. protected main; +5. release artifact. + +Evidence from one class cannot silently satisfy another. Issue #132 tracks the repository-wide required-workflow source-head attribution follow-up. + +## Documentation consistency + +Machine-checkable documentation tests should validate: + +- required canonical files and README/index links; +- all local Markdown link targets; +- exact status vocabulary; +- ADR index, actual targets, statuses and required sections; +- balanced Mermaid/Markdown fences; +- live service/API/event/state names; +- conceptual-vs-persisted labels in the data model; +- source/migration evidence for core claims such as UUIDv4, service-owned persistence and inert AI authority; +- active-PR versus protected-main lifecycle claims. + +## Live-provider separation + +NVIDIA/model/provider availability is bounded conformance evidence, not deterministic PR success. Deterministic fixtures test proposal safety/quality and provider failure behavior. `NVIDIA_NIM_API_KEY` is materialized only for the approved live model boundary. + +## Release acceptance + +A release candidate must pass required CI/security/review, exact configured coverage, browser/accessibility/localization evidence, package/container build, migration/rollback/recovery, backup/restore, SBOM/provenance/reproducibility and protected-main operational acceptance on one exact integrated revision. \ No newline at end of file From 655a01b0b975e5bdde22f393219e5db6bd96ac12 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 08:58:59 +0900 Subject: [PATCH 009/173] docs: add LifeOS operability contract --- docs/OPERABILITY.md | 72 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 72 insertions(+) create mode 100644 docs/OPERABILITY.md diff --git a/docs/OPERABILITY.md b/docs/OPERABILITY.md new file mode 100644 index 000000000..24efb0aa3 --- /dev/null +++ b/docs/OPERABILITY.md @@ -0,0 +1,72 @@ +# LifeOS Operability + +**Status:** Implemented on active PR + +## Deployment profiles + +### Self-hosted composition + +**Status:** Implemented on protected main + +Docker Compose composes independent LifeOS workloads with operator-owned PostgreSQL, NATS, secrets and provider configuration. Compose is a deployment profile, not a shared-service authority model. + +### Kubernetes reference + +**Status:** Implemented on protected main + +The repository provides provider-neutral Kubernetes/Kustomize reference artifacts with restricted defaults. Operators remain responsible for cluster provisioning, TLS/DNS/ingress, managed PostgreSQL/NATS, registry, secret management, backup storage and environment-specific network policy. + +## Liveness and readiness + +Liveness reports process/runtime health. Readiness must fail when a service cannot safely serve its contracted workload. Dependency-specific readiness must not be collapsed into generic process health. Metrics/readiness endpoints remain bounded and operator-facing. + +## Observability + +- structured credential-free logs; +- correlation/evidence IDs where implemented; +- bounded Prometheus-compatible metrics; +- no raw prompts/responses, bearer credentials, cookies or unbounded tenant text in retained operational evidence; +- provider failures classified without replaying upstream bodies. + +## Failure semantics + +- malformed authority/signatures/UUIDs fail closed; +- service database outage cannot return durable-success claims; +- provider outage degrades only the affected integration where possible; +- stale concurrent writes return explicit conflict rather than silently overwriting; +- retryable workers use bounded retries/claims and preserve replay identity; +- unknown data-rights participant state cannot become completed deletion/export. + +## Backup and restore + +**Status:** Implemented on protected main + +Logical PostgreSQL backup produces integrity evidence. Restore validates artifact integrity and refuses unsafe non-empty targets. This does not claim point-in-time recovery; WAL/archive/replication are operator-owned until explicitly implemented and measured. + +## Migration and rollback + +Schema changes require compatibility analysis, executable migration evidence and a rollback or forward-fix strategy appropriate to risk. Application rollback must not claim that already-completed irreversible database or external-provider changes are automatically reverted. + +## Incident priorities + +1. preserve tenant isolation and credentials; +2. prevent false durable-success/data-loss claims; +3. stop unsafe writes/delivery; +4. retain bounded evidence needed for diagnosis; +5. restore service through documented rollback/forward-fix/replay procedures; +6. reconcile delayed background work idempotently. + +## Current operational gaps + +- complete data-rights orchestration/reconciliation, retention and protected delivery: **Partial**, issue #55; +- per-user hosted calendar credential lifecycle: **Partial**, issue #129; +- plugin runtime delivery/secrets/revocation: **Planned**, issue #130; +- repository-wide exact contributor-head verification attribution: **Planned**, issue #132. + +## SLO discipline + +LifeOS does not publish fixed availability/RPO/RTO values without measured deployment-specific evidence. Runbooks may define profile-specific targets only when monitoring and recovery exercises support them. + +## Release operations + +A release is an exact protected integrated revision plus its CI/security/review/coverage/package/SBOM/provenance/migration/recovery/accessibility/operational evidence. A merged feature, generated documentation pack or 100% configured readiness score alone is not a release. \ No newline at end of file From 3b8ed9c15edf333c2d3b99c4c5b6d56d09fb1845 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 08:59:14 +0900 Subject: [PATCH 010/173] docs: add release and migration contract --- docs/RELEASE_AND_MIGRATION.md | 57 +++++++++++++++++++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 docs/RELEASE_AND_MIGRATION.md diff --git a/docs/RELEASE_AND_MIGRATION.md b/docs/RELEASE_AND_MIGRATION.md new file mode 100644 index 000000000..24bb38b1a --- /dev/null +++ b/docs/RELEASE_AND_MIGRATION.md @@ -0,0 +1,57 @@ +# LifeOS Release, Migration, and Rollback + +**Status:** Implemented on active PR + +## Release rule + +A merged feature is not automatically a release. Release only from one exact protected integrated head after all applicable repository policy and product acceptance evidence passes together. + +## Required release evidence + +- required CI and security scans; +- zero actionable unresolved review findings; +- configured exact production coverage/docstring gates; +- browser/accessibility/localization acceptance for affected journeys; +- package/container build and smoke evidence; +- migration compatibility and rollback/forward-fix evidence; +- backup/restore evidence where persistent state is affected; +- SBOM/provenance/reproducibility evidence required by repository policy; +- operator readiness/observability evidence; +- CHANGELOG/version alignment with the artifact. + +## Schema migrations + +Every owning service sequences its own migrations. Cross-service migrations are prohibited. Migrations must preserve the service's identifier, tenant, immutability and concurrency invariants. + +For risky migrations: + +1. establish a failing compatibility/migration test where practical; +2. define preconditions and data-shape assumptions; +3. stage constraints/backfill/validation when required for safe rollout; +4. verify old/new application compatibility where rolling deployment is supported; +5. define rollback or explicit forward-fix behavior; +6. prove restart/retry behavior and bounded diagnostics. + +## Application rollback + +Application rollback restores only application/configuration state that is actually reversible. It must not claim to undo already committed DB migrations, external provider revocations, delivered notifications/calendar mutations or deletion effects unless a tested compensating contract exists. + +## Data-rights changes + +Data-rights request/receipt migrations preserve request identity, tenant/requesting-user ownership, recent-auth provenance and immutable terminal evidence. Whole-product erasure/export completion remains governed by issue #55 until all domain participants and retention/backup-delivery semantics are complete. + +## Calendar credential migration + +The process-global development token may not be silently treated as a hosted multi-user credential model. Issue #129 requires an explicit migration path to per-user encrypted connection/refresh/revocation/selection semantics. + +## Plugin runtime migration + +Existing manifest/event validation remains backward-compatible unless a versioned contract states otherwise. Future installation/secrets/delivery under #130 must not grant authority to old validation-only manifests implicitly. + +## Versioning and CHANGELOG + +Keep buyer-visible unreleased work under `CHANGELOG.md` → `Unreleased`. Bump the product/package version and create release notes/tag only after the exact protected revision satisfies release acceptance. Published artifacts must be verified against recorded source/artifact identity. + +## Recovery exercises + +Backup/restore, migration failure, stale-write conflict, worker replay and provider outage exercises are product evidence. Do not publish fixed RPO/RTO claims without measured deployment-specific recovery evidence. \ No newline at end of file From 0d30461d19748c651a1835eabe918069504bc649 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 08:59:48 +0900 Subject: [PATCH 011/173] docs: add current standards traceability --- docs/STANDARDS_TRACEABILITY.md | 43 ++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 docs/STANDARDS_TRACEABILITY.md diff --git a/docs/STANDARDS_TRACEABILITY.md b/docs/STANDARDS_TRACEABILITY.md new file mode 100644 index 000000000..336bd99d7 --- /dev/null +++ b/docs/STANDARDS_TRACEABILITY.md @@ -0,0 +1,43 @@ +# LifeOS Standards and Research Traceability + +**Status:** Implemented on active PR + +This document records normative/current standards used for repository-wide decisions. Drafts are tracked as watch items and do not silently replace published requirements. + +## Standards matrix + +| Source | Publication status | LifeOS use | +| --- | --- | --- | +| IETF RFC 9562, *Universally Unique IDentifiers (UUIDs)* | Final RFC, 2024 | UUIDv4 identifier syntax/semantics; LifeOS intentionally chooses version 4 rather than version 7 | +| IETF RFC 9700 / BCP 240, *Best Current Practice for OAuth 2.0 Security* | Final BCP, January 2025 | OAuth redirect/state/PKCE/token security posture and deprecation of unsafe legacy patterns | +| W3C, *Web Content Accessibility Guidelines (WCAG) 2.2* | W3C Recommendation, 2023 | keyboard/focus/status/authentication accessibility and browser acceptance expectations | +| NIST SP 800-218, *Secure Software Development Framework (SSDF) Version 1.1* | Final, 2022 | secure-development, provenance and vulnerability-prevention practices | +| NIST SP 800-218 Rev. 1 / SSDF 1.2 | Initial Public Draft | watch item only until final publication; does not replace 1.1 requirements | +| NIST AI 100-1, *Artificial Intelligence Risk Management Framework 1.0* | Final, 2023 | AI governance/evidence/risk framing | +| NIST AI 600-1, *AI RMF: Generative Artificial Intelligence Profile* | Final, 2024 | GenAI prompt/provider/evidence risk controls | + +## Decision traceability + +- **UUIDv4 invariant:** RFC 9562 permits UUID version 4 and defines modern UUID representation; LifeOS's choice of opaque random UUIDv4 is a repository architecture decision, not a claim that v4 is universally superior. +- **OAuth security:** identity and future calendar authorization flows apply current OAuth security best current practice. Issue #129 must use provider-appropriate state/PKCE/redirect and credential lifecycle controls rather than copying browser-login credentials into calendar authority. +- **Accessibility:** core PWA journeys target WCAG 2.2-relevant keyboard/focus/non-color-only/status/authentication behavior with browser acceptance evidence. +- **Secure SDLC:** exact-head CI/security evidence, immutable action pins, least privilege, bounded untrusted input and provenance align with SSDF practices. SSDF 1.2 remains draft as of this baseline. +- **AI governance:** model output remains untrusted and inert, deterministic authorization/validation is separate, provider availability is not fabricated as merge success, and retained artifacts exclude secrets/raw prompts/responses/hidden reasoning. + +## Research traceability + +Feature-specific peer-reviewed and technical research remains in `docs/research/` and approved `docs/superpowers/specs/` documents. When a research result becomes a repository-wide architectural requirement, add an ADR linking the primary source, assumptions, alternatives and executable acceptance evidence. + +## APA 7 references + +Internet Engineering Task Force. (2024). *Universally Unique IDentifiers (UUIDs)* (RFC 9562). RFC Editor. https://doi.org/10.17487/RFC9562 + +Lodderstedt, T., Bradley, J., Labunets, A., & Fett, D. (2025). *Best current practice for OAuth 2.0 security* (RFC 9700; BCP 240). RFC Editor. https://doi.org/10.17487/RFC9700 + +National Institute of Standards and Technology. (2022). *Secure Software Development Framework (SSDF) version 1.1: Recommendations for mitigating the risk of software vulnerabilities* (NIST SP 800-218). https://doi.org/10.6028/NIST.SP.800-218 + +National Institute of Standards and Technology. (2023). *Artificial Intelligence Risk Management Framework (AI RMF 1.0)* (NIST AI 100-1). https://doi.org/10.6028/NIST.AI.100-1 + +National Institute of Standards and Technology. (2024). *Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile* (NIST AI 600-1). https://doi.org/10.6028/NIST.AI.600-1 + +World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines (WCAG) 2.2*. https://www.w3.org/TR/WCAG22/ From fea5dc9198541ac0f8a1e8f591ce346653fcb554 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 09:00:07 +0900 Subject: [PATCH 012/173] docs: add current requirements traceability --- docs/TRACEABILITY.md | 58 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 58 insertions(+) create mode 100644 docs/TRACEABILITY.md diff --git a/docs/TRACEABILITY.md b/docs/TRACEABILITY.md new file mode 100644 index 000000000..3abd383df --- /dev/null +++ b/docs/TRACEABILITY.md @@ -0,0 +1,58 @@ +# LifeOS Requirements and Evidence Traceability + +**Status:** Implemented on active PR + +This index maps product requirements and durable decisions to representative source/test/issue evidence. Protected-main source/migrations/tests outrank this index when evidence conflicts. + +| Requirement / decision | Status | Representative implementation/evidence | Open follow-up | +| --- | --- | --- | --- | +| PRD-ID-001 login/session/workspace authority | Implemented on protected main | identity OAuth/session runtime and tests | — | +| PRD-ID-002 UUIDv4 internal IDs | Implemented on protected main | `AGENTS.md`, validators/migrations | — | +| PRD-PLAN-001 durable planning | Implemented on protected main | planning PostgreSQL repository/migrations | — | +| PRD-PLAN-002 durable Today synchronization | Implemented on protected main | PR #127; Today aggregate, BFF, PostgreSQL concurrency and browser acceptance | — | +| PRD-HAB-001 recurring habits | Implemented on protected main | habit service/domain/PostgreSQL tests | — | +| PRD-REV-001 review projection boundary | Implemented on protected main | review service tests | — | +| PRD-CAL-001 conflict-safe calendar sync | Implemented on protected main | CalDAV/Google adapter tests | — | +| PRD-CAL-002 trusted calendar workspace context | Implemented on protected main | PR #139; signed context verifier/controller regressions | — | +| PRD-CAL-003 per-user hosted calendar credentials | Partial | development/provider adapters exist | issue #129 | +| PRD-NOT-001 bounded reminders | Implemented on protected main | notification scheduler/persistence tests | — | +| PRD-AI-001 inert auditable proposals | Implemented on protected main | AI proposal/audit service tests | — | +| PRD-AI-002 deterministic/live-provider separation | Implemented on protected main | proposal evaluator + NIM conformance workflow | — | +| PRD-PRIV-001 purpose-bound sensitive access | Implemented on protected main | privacy-service grants/events/tests | — | +| PRD-PRIV-002 data-rights auth/request ledger primitives | Implemented on protected main | PRs #134, #136, #137, #138, #144 | issue #55 for whole journey | +| PRD-PRIV-003 complete export/delete orchestration | Partial | identity core exists; full domain/reconciliation/delivery incomplete | issue #55 | +| PRD-INT-001 plugin SDK/validation | Implemented on protected main | plugin SDK/integration-service tests | — | +| PRD-INT-002 plugin runtime last mile | Planned | validation-only surface is intentionally non-runtime | issue #130 | +| PRD-WEB-001 accessible localized PWA | Implemented on protected main | browser/accessibility/localization tests | — | +| PRD-OPS-001 backup/restore | Implemented on protected main | backup scripts/tests/runbook | — | +| PRD-GOV-001 buyer-gap vs capability maturity separation | Implemented on protected main | repository buyer-gap registry; issue #21 rendering | — | +| PRD-GOV-002 exact source-head verification attribution | Planned | current workflows have mixed evidence classes | issue #132 | + +## Architecture decisions + +| Decision | Status | Evidence | +| --- | --- | --- | +| Multi-user server-backed/self-hostable MSA supersedes browser-only primary architecture | Accepted architecture | `ARCHITECTURE.md`, service layout, Compose/Kubernetes | +| UUIDv4 supersedes original UUIDv7 proposal | Accepted architecture | protected-main `AGENTS.md` and code/migrations | +| Service-owned persistence; no cross-service table authority | Accepted architecture | `ARCHITECTURE.md`, per-service repositories/migrations | +| AI output remains inert proposal evidence | Accepted architecture | AI service tests and architecture | +| Sensitive access is purpose/resource/lifetime/audit bound | Accepted architecture | privacy-service tests | +| Capability maturity cannot stand in for buyer-gap exhaustion | Accepted architecture | buyer-gap registry/reporting | +| Canonical documentation must distinguish shipped/active/planned/superseded state | Accepted architecture | this documentation line + contract tests on this PR | + +## Evidence hierarchy + +1. Current protected-main source, migrations, tests and live repository policy. +2. Accepted architecture/ADR decisions. +3. Canonical PRD/TRD/Data Model/UML/Security/Test/Operability docs. +4. Current active PR evidence explicitly labeled as active. +5. Issues/plans/research for incomplete work. +6. Historical chat/PR bodies only as rationale. + +## Buyer gaps from live readiness state + +The configured capability set can be fully mature while the product still has accepted buyer gaps. Current canonical open buyer gaps are #55 data portability completion, #129 per-user calendar credentials, and #130 plugin runtime delivery. Issue #132 is a reliability/governance hardening gap for verification identity rather than a buyer capability row. + +## Update rule + +Whenever a requirement changes maturity, update PRD status, this traceability row, relevant ADR/architecture/data/UML/security/operability views, regression evidence and CHANGELOG. Never label active/unmerged work `Implemented on protected main`. \ No newline at end of file From 0a47b52a2cab3090d9bb472b9ede0f95c1a0d655 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 09:00:28 +0900 Subject: [PATCH 013/173] docs: assess LifeOS documentation fitness --- docs/DOCUMENTATION_ASSESSMENT.md | 54 ++++++++++++++++++++++++++++++++ 1 file changed, 54 insertions(+) create mode 100644 docs/DOCUMENTATION_ASSESSMENT.md diff --git a/docs/DOCUMENTATION_ASSESSMENT.md b/docs/DOCUMENTATION_ASSESSMENT.md new file mode 100644 index 000000000..30c811761 --- /dev/null +++ b/docs/DOCUMENTATION_ASSESSMENT.md @@ -0,0 +1,54 @@ +# LifeOS Documentation Fitness Assessment + +**Status:** Implemented on active PR + +## Verdict + +Before this successor line, LifeOS had extensive implementation, feature specs and runbooks, but protected main did not contain a complete whole-product PRD/TRD/UML/logical-ERD/traceability graph. The old documentation PR #126 became materially diverged while protected-main product work continued. This branch is the clean current-main successor and must not be considered protected-main documentation until it merges. + +## Fitness matrix + +| Family | Assessment on this branch | Notes | +| --- | --- | --- | +| PRD | Present-current | Product journey, historical drift, live buyer gaps and protected-main maturity are explicit | +| TRD | Present-current | Bounded contexts, authority, data, HTTP/event, concurrency, AI/security/ops/release requirements | +| Root Architecture | Present-current on protected main | `ARCHITECTURE.md` remains durable implementation boundary and is not replaced by this pack | +| ADR index/detailed decisions | Present-current on this branch | Canonical status-bearing decisions are indexed under `docs/adr/` | +| Logical ERD/Data Model | Present-current | Service ownership and conceptual-vs-persisted status are explicit | +| UML | Present-current | topology, login, Today, review, calendar, AI, privacy, backup, deployment and degraded modes | +| API/event contracts | Present-current | repository-level contract registry and evidence identity | +| Security | Present-current on protected main | root `SECURITY.md`; threat model added here | +| Threat model | Present-current | trust boundaries and live planned/partial threats | +| Privacy/data lifecycle | Present-current | data classes, access model, data-rights/calendar/plugin lifecycle | +| Test strategy | Present-current | realistic DB/browser/security/concurrency and documentation consistency gates | +| Operability | Present-current | deployment/readiness/observability/failure/backup/migration/release boundaries | +| Release/migration/rollback | Present-current | exact integrated release and state-change recovery semantics | +| Standards/research | Present-current | final-vs-draft status and APA 7 references; feature research stays in `docs/research/` | +| Requirements traceability | Present-current | requirement/decision -> source/test/issue evidence | +| README/AGENTS/CLAUDE/CHANGELOG alignment | Partial | root protected-main files are intentionally preserved; this successor must add discoverability links/CHANGELOG without overwriting newer agent/architecture policy | +| Machine-checkable documentation consistency | Planned on this branch | required before Ready/merge | + +## Historical drift reconciled + +1. **Private/login-free local-first -> public multi-user server-backed/self-hostable:** browser-local state is draft/cache/offline state, not the system of record. +2. **Single Docker app -> modular MSA:** Compose remains a profile; service authority does not collapse. +3. **UUIDv7 proposal -> UUIDv4 protected-main invariant:** current internal IDs are opaque UUIDv4. +4. **Post-MVP labels -> evidence maturity:** capabilities are classified from live code/tests, not old roadmap labels. +5. **Configured capability maturity -> whole-product readiness:** buyer-gap exhaustion is a separate evidence dimension. + +## Current code/document changes that invalidate #126 as a mergeable baseline + +Protected main integrated durable Today synchronization (#127), readiness/buyer-gap accounting and OpenCode hardening, authentication-age/recent-auth data-rights prerequisites, durable data-rights request receipts/status lookup (#134/#136/#137/#138/#144), and calendar trusted workspace context (#139) after the old documentation branch diverged. A conflict-heavy merge of its 86-commit history would mix obsolete implementation ancestry with canonical documentation. + +## Current product gaps that must remain explicit + +- **Partial:** complete tenant export/deletion orchestration — #55. +- **Partial:** per-user encrypted calendar credential lifecycle — #129. +- **Planned:** plugin installation/secrets/outbound delivery — #130. +- **Planned reliability:** exact contributor-head verification attribution across required workflows — #132. + +## Sufficiency criteria + +This documentation line is **design-sufficient** only when all canonical files are discoverable, statuses use the exact vocabulary, ADR links/sections are valid, diagrams are syntactically bounded, key claims match source/migrations and current active PR/issues are accurately classified. + +The repository becomes **protected-main documentation sufficient** only after this clean successor passes exact-head CI/security/review/documentation contracts and merges without regressing live code/policy. Documentation sufficiency is not product completion; the maintenance loop must continue implementing #55/#129/#130/#132 and subsequent buyer/operator gaps. \ No newline at end of file From e5cffdbff792ecb2d35cd0c62afdb38a32a1d99a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 09:00:57 +0900 Subject: [PATCH 014/173] docs(adr): align identifier decision with canonical contract --- .../0001-opaque-non-numeric-identifiers.md | 64 +++++++++++++------ 1 file changed, 43 insertions(+), 21 deletions(-) diff --git a/docs/adr/0001-opaque-non-numeric-identifiers.md b/docs/adr/0001-opaque-non-numeric-identifiers.md index 9b900e250..0ab40153c 100644 --- a/docs/adr/0001-opaque-non-numeric-identifiers.md +++ b/docs/adr/0001-opaque-non-numeric-identifiers.md @@ -1,33 +1,55 @@ -# ADR 0001: Opaque non-numeric identifiers +# ADR 0001: Opaque UUIDv4 internal identifiers -- **Status:** Accepted -- **Date:** 2026-08-02 +**Status:** Accepted architecture +**Date:** 2026-08-02 ## Context -Sequential numeric identifiers expose record counts, creation order, and easily enumerable resource locators. They also encourage accidental trust in client-supplied IDs and make insecure direct object reference attacks easier to probe. +Sequential numeric identifiers expose cardinality/order and make authorization-locator enumeration easier. The original product exploration also proposed UUIDv7, which exposes temporal ordering. LifeOS is now a public multi-user server-backed product whose identifiers appear across APIs, events, logs, exports and persistence. -LifeOS is a public multi-user service, so identifiers visible in APIs, events, URLs, logs, exports, and database relationships must not reveal sequence or cardinality. +## Decision drivers -## Decision +- opaque non-enumerable internal identity; +- consistent service/API/event representation; +- no reuse of external provider identifiers; +- tenant authorization independent from identifier knowledge; +- compatibility with PostgreSQL `uuid` and current source contracts. + +## Alternatives considered -1. Internal entity identifiers use cryptographically random UUIDv4 values represented as strings in application code and as PostgreSQL `uuid` columns in persistence. -2. Numeric primary keys, auto-increment columns, database sequences, and numeric-only public identifiers are prohibited. -3. Workspace, user, session, goal, project, task, habit, review, event, correlation, causation, export-job, and integration identifiers follow the same rule. -4. Client-supplied identifiers are validated as non-empty, non-numeric opaque strings before repository access. -5. Third-party identifiers are never reused as LifeOS primary keys. Provider identity is stored separately as `(provider, provider_subject)` text and mapped to an independent LifeOS UUIDv4 user ID. -6. OAuth provider subjects that happen to be numeric, such as some GitHub account IDs, remain external attributes only and are never exposed as internal resource IDs. -7. Public pagination uses opaque signed or encrypted cursors rather than offsets or row IDs. -8. IDs are authorization locators, not authorization evidence. Every lookup remains workspace- and actor-scoped. +1. **Auto-increment integers:** rejected for enumeration/cardinality leakage and cross-service coupling pressure. +2. **UUIDv7:** rejected as the repository-wide internal invariant because time ordering is unnecessary and leaks creation ordering. +3. **Provider-native IDs:** rejected because providers can be numeric, mutable in semantics, or collide across providers. +4. **UUIDv4:** selected as the current protected-main contract. -## Why UUIDv4 +## Decision -UUIDv4 is preferred over sequential integers and time-ordered identifiers because it does not reveal creation time or ordering through the identifier itself. The collision probability is negligible for this system when generated with a cryptographically secure source. +1. Internal entity identifiers use cryptographically random UUIDv4 values represented as strings in application code and PostgreSQL `uuid` in persistence. +2. Numeric primary keys, auto-increment columns, database sequences and numeric-only internal identifiers are prohibited for product-owned domain objects. +3. Third-party identifiers remain explicit provider metadata and map to independent LifeOS UUIDv4 IDs. +4. IDs are locators, never authorization evidence; all access remains actor/workspace scoped. +5. Public pagination uses opaque bounded cursors instead of exposing row offsets/primary keys where cursor pagination is implemented. ## Consequences -- Database indexes are larger than integer indexes. -- Logs and URLs are less human-readable. -- Tests must verify generated IDs are UUIDv4 and reject numeric-only supplied identifiers. -- Foreign keys remain explicit and tenant-aware; opaque IDs do not replace authorization or tenant isolation. -- The earlier design note proposing UUIDv7 is superseded by this ADR. +Indexes are larger and identifiers less human-readable than integers, but provider coupling and ordering leakage are reduced. Tests must validate UUIDv4 at trust boundaries and continue tenant authorization independently. + +## Failure and recovery + +Malformed or non-v4 identifiers fail before persistence access where the shared invariant applies. Existing invalid data requires an explicit migration rather than runtime coercion. Provider IDs are never silently converted into internal IDs. + +## Security and privacy impact + +Opaque UUIDs reduce enumeration/order leakage but do not replace authorization. Logs and exported references remain potentially sensitive tenant metadata and follow normal retention/access controls. + +## Acceptance evidence + +Protected-main `AGENTS.md`, service validators, migrations and integration tests require/use UUIDv4 internal identifiers. RFC 9562 defines UUID version 4 representation/semantics; the choice of v4 over v7 is a LifeOS architecture decision. + +## Migration and rollback + +The earlier UUIDv7 proposal was never the protected-main invariant. New code uses UUIDv4. Any future identifier-version migration requires versioned API/data migration and cannot reinterpret existing IDs in place. + +## Supersession + +This ADR supersedes the original UUIDv7 design language. It may be superseded only by a reviewed repository-wide identifier ADR with compatibility, privacy, migration and authorization evidence. \ No newline at end of file From f65f49e7d29148d050e90a6fe7d39f6445b0d9b0 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 09:01:21 +0900 Subject: [PATCH 015/173] docs(adr): align OAuth decision with canonical contract --- ...2-oauth-transactions-and-session-tokens.md | 83 ++++++++++++------- 1 file changed, 51 insertions(+), 32 deletions(-) diff --git a/docs/adr/0002-oauth-transactions-and-session-tokens.md b/docs/adr/0002-oauth-transactions-and-session-tokens.md index 5d18cb60c..d65ced325 100644 --- a/docs/adr/0002-oauth-transactions-and-session-tokens.md +++ b/docs/adr/0002-oauth-transactions-and-session-tokens.md @@ -1,50 +1,69 @@ # ADR 0002: OAuth transactions and session tokens -- **Status:** Accepted -- **Date:** 2026-08-03 +**Status:** Accepted architecture +**Date:** 2026-08-03 ## Context -LifeOS accepts Google and GitHub sign-in while maintaining provider-neutral internal identity records. Authorization callbacks must resist cross-site request forgery, authorization-code injection, authorization-server mix-up, replay, redirect substitution, and bearer-token disclosure. Internal identifiers must remain opaque, non-numeric, and non-sequential. +LifeOS supports Google and GitHub sign-in while maintaining provider-neutral internal identity. Authorization callbacks must resist CSRF, code injection, mix-up, replay, redirect substitution and bearer-token disclosure. Session rotation must not erase authentication provenance needed by sensitive operations such as data-rights requests. -The repository already contained provider authorization and token-exchange builders. This decision hardens the shared `auth-security` transaction and session layer rather than introducing a second implementation. +## Decision drivers + +- provider-neutral internal identity; +- current OAuth security best practice; +- server-verifiable and revocable browser sessions; +- tenant/workspace binding independent from browser-selected IDs; +- recent-authentication evidence that survives token/session rotation. + +## Alternatives considered + +1. Trust client OAuth state/callback metadata: rejected. +2. Persist raw session bearer values: rejected. +3. Reuse provider account IDs as LifeOS IDs: rejected by ADR 0001. +4. Treat session rotation time as authentication time: rejected because it weakens sensitive-operation recency semantics. +5. Server-owned OAuth transaction + hashed bearer/session lifecycle: selected. ## Decision ### Authorization transactions -- Every authorization attempt receives a cryptographically random, one-time `state` value. -- The server persists only a SHA-256 digest of `state`. -- The transaction is bound to the selected provider, a digest of the initiating browser session identifier, and the normalized redirect URI. -- The same redirect URI must be used when building the authorization request and exchanging the authorization code. -- Transactions expire after ten minutes by default and are consumed once. -- Provider adapters must consume transactions atomically. A PostgreSQL adapter must use a conditional update or delete with `RETURNING`, scoped to the provider, state digest, browser-session digest, unconsumed status, and expiry. -- Authorization requests use PKCE with the `S256` method. The verifier is a 64-byte random base64url value and the challenge is `BASE64URL(SHA256(verifier))`. -- The verifier and Google OIDC nonce are server-side material. Persistent implementations must encrypt them at rest; neither is returned to the browser except that the nonce is included in the Google authorization request. -- Each provider uses a distinct callback route or equivalent issuer verification to prevent authorization-server mix-up. -- Redirect URIs require HTTPS, except for loopback HTTP during local development, and may not contain credentials or fragments. +- Use cryptographically random one-time `state`, storing only its SHA-256 digest. +- Bind transaction to provider, initiating browser-session digest and normalized redirect URI. +- Use the same exact redirect URI for authorization and token exchange. +- Expire transactions after a bounded lifetime and consume them once atomically. +- Use PKCE `S256` with server-held verifier and validate Google OIDC nonce where applicable. +- Encrypt persistent PKCE verifier/nonce material at rest. +- Use distinct provider callback/issuer validation to prevent mix-up. +- Require HTTPS redirects except documented loopback HTTP development cases. ### Application sessions -- Session bearer tokens are cryptographically random base64url values and are not entity identifiers. -- Only a SHA-256 digest of a session token is persisted. -- Session records use random UUIDv4 primary keys and bind both a user and one of that user's workspaces. -- The database enforces workspace ownership with a composite foreign key. -- Session rotation revokes the previous token before issuing a replacement and records the previous session ID. -- Revocation is idempotent and does not disclose whether a supplied token existed. -- Browser delivery uses `Secure`, `HttpOnly`, and an explicit `SameSite` policy. Production deployments must never place session tokens in URLs, logs, local storage, analytics payloads, or application telemetry. +- Session bearer tokens are random base64url secrets; only SHA-256 digests persist. +- Session records use UUIDv4 and bind user plus authorized workspace. +- Rotation revokes the predecessor before replacement and preserves lineage/authentication provenance. +- Authentication age is not reset merely by rotation. +- Browser delivery uses `Secure`, `HttpOnly` and explicit `SameSite`; tokens never enter URLs, logs, local storage or telemetry. -## Standards basis +## Consequences -- RFC 7636, *Proof Key for Code Exchange by OAuth Public Clients*: https://www.rfc-editor.org/rfc/rfc7636 -- RFC 9700 / BCP 240, *Best Current Practice for OAuth 2.0 Security*: https://www.rfc-editor.org/rfc/rfc9700 -- GitHub OAuth authorization flow: https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps +Production identity persistence requires cleanup and encryption-key management. Callers must supply exact transaction/session context instead of reconstructing authority from browser headers. Sensitive flows can enforce recent authentication correctly across rotation. -## Consequences +## Failure and recovery + +Unknown/expired/consumed/malformed transactions fail closed. Revocation remains idempotent and non-enumerating. Migration of authentication provenance is staged/validated so legacy rows cannot silently gain fresh-auth status. + +## Security and privacy impact + +Database compromise does not directly expose usable state/session bearer values. Authentication provenance itself is security-sensitive metadata and follows identity-service access/retention controls. + +## Acceptance evidence + +Protected-main identity source/migrations/tests cover OAuth transaction security, session hashing/rotation, authentication-age persistence and recent-authentication policy. RFC 9700 is the current OAuth 2.0 security BCP; PKCE remains part of the provider flow contract. + +## Migration and rollback + +Migrations introduce workspace/session binding and authentication provenance with validation before final enforcement. Rollback cannot reinterpret newer authentication evidence as fresh; use explicit forward-fix/migration procedures. + +## Supersession -- Stolen database rows do not directly reveal usable `state` or session bearer values. -- OAuth transactions and sessions require expiry cleanup jobs. -- A production repository needs encryption-key management for PKCE verifiers and OIDC nonces. -- Existing callers must supply the initiating browser-session identifier and the exact redirect URI when creating and consuming transactions. -- Existing sessions are backfilled to their owners' personal workspaces by migration `0003_oauth_binding_and_session_rotation.sql`. -- Provider callback adapters remain responsible for network exchange, provider response validation, ID-token validation for Google, and profile retrieval; this ADR supplies the transaction and session primitives they must use. +This ADR is superseded only by a reviewed identity/session architecture change with provider, migration, recent-auth and browser-security compatibility evidence. \ No newline at end of file From d214db4087e1dcd12acf87cf2eda39c5cf52ed8d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 09:01:35 +0900 Subject: [PATCH 016/173] docs(adr): record service-owned persistence --- docs/adr/0003-service-owned-persistence.md | 36 ++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 docs/adr/0003-service-owned-persistence.md diff --git a/docs/adr/0003-service-owned-persistence.md b/docs/adr/0003-service-owned-persistence.md new file mode 100644 index 000000000..8d6c8bb3e --- /dev/null +++ b/docs/adr/0003-service-owned-persistence.md @@ -0,0 +1,36 @@ +# ADR 0003: Domain-oriented service-owned persistence + +**Status:** Accepted architecture +**Date:** 2026-08-10 + +## Context +LifeOS evolved from a simple app concept into independently runnable bounded services. A shared database authority would make those boundaries nominal and increase tenant, migration and deployment coupling. + +## Decision drivers +Independent operation, modular MSA composition, least privilege, migration ownership, fault isolation, explicit versioned interoperability. + +## Alternatives considered +- shared tables/read access across services — rejected; +- one monolithic persistence layer — rejected as durable architecture; +- service-owned persistence with API/event/saga/plugin contracts — selected. + +## Decision +Each bounded service owns its persistence adapters, migrations and database credentials. Services never read or mutate another service's tables directly. Shared UUIDs are logical references only. Cross-service effects use versioned HTTP/event/saga/plugin contracts. + +## Consequences +More explicit integration contracts and eventual-consistency handling are required, but services remain independently deployable/testable and database privileges can be least-privilege. + +## Failure and recovery +A service/database outage fails only the affected authority where possible. Cross-service workflows retain idempotency/reconciliation evidence rather than bypassing ownership with emergency SQL. + +## Security and privacy impact +Compromise of one service credential must not imply access to every domain table. Tenant authorization remains enforced by the owning service. + +## Acceptance evidence +Protected-main service layout, per-service migrations/repositories and architecture tests; logical data model labels ownership explicitly. + +## Migration and rollback +Any shared-table legacy coupling must be inventoried and replaced with a versioned contract before privileges are removed. Rollback preserves service-owned authority. + +## Supersession +Only a reviewed repository-wide data-authority ADR with migration/security/operability evidence may supersede this decision. \ No newline at end of file From 6eb21bccc48f60845d236172410b52887a44d1c5 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 09:01:47 +0900 Subject: [PATCH 017/173] docs(adr): record inert AI authority --- docs/adr/0004-inert-auditable-ai-proposals.md | 36 +++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 docs/adr/0004-inert-auditable-ai-proposals.md diff --git a/docs/adr/0004-inert-auditable-ai-proposals.md b/docs/adr/0004-inert-auditable-ai-proposals.md new file mode 100644 index 000000000..3d8430665 --- /dev/null +++ b/docs/adr/0004-inert-auditable-ai-proposals.md @@ -0,0 +1,36 @@ +# ADR 0004: Inert, auditable AI proposals + +**Status:** Accepted architecture +**Date:** 2026-08-10 + +## Context +LifeOS can use models to propose planning assistance, but personal state must remain user/product-authorized and model/provider output is untrusted. + +## Decision drivers +User authority, auditability, provider independence, prompt-injection resistance, deterministic safety, graceful provider failure. + +## Alternatives considered +- model directly mutates planning state — rejected; +- model emits generic executable commands — rejected; +- model returns bounded proposal evidence with explicit accept/reject — selected. + +## Decision +AI output is inert structured proposal data. The AI service validates and persists proposal evidence before return, records explicit decisions, and has no generic planning mutation repository/command bus. Decisions bind actor/workspace and exact proposal revision/digest. Deterministic validation/authorization remains authoritative and live provider availability is not a deterministic PR merge gate. + +## Consequences +The product needs proposal/evidence/decision storage and explicit UX, but provider or orchestration changes cannot silently change user-owned state. + +## Failure and recovery +Malformed/unsafe/provider-unavailable output returns sanitized failure/unavailable evidence. Stale/replayed proposal decisions fail closed. Provider retry must not duplicate decisions. + +## Security and privacy impact +Browser credentials, provider credentials, raw prompts/responses and hidden reasoning are excluded from retained public artifacts. Page/document/model content cannot elevate itself to policy authority. + +## Acceptance evidence +Protected-main AI proposal/audit persistence, same-origin authenticated BFF, signed context, proposal-quality evaluator and explicit decision tests. + +## Migration and rollback +Proposal schema changes are versioned. Rollback preserves immutable historical proposal/decision evidence and cannot reinterpret old proposal content as commands. + +## Supersession +A future AI execution architecture requires a separate reviewed capability/authorization ADR and cannot silently widen this proposal authority. \ No newline at end of file From 375bf3abc170a975484153bad6e3cab50b1693ed Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 09:01:58 +0900 Subject: [PATCH 018/173] docs(adr): record purpose-bound sensitive access --- ...005-purpose-bound-sensitive-data-access.md | 36 +++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 docs/adr/0005-purpose-bound-sensitive-data-access.md diff --git a/docs/adr/0005-purpose-bound-sensitive-data-access.md b/docs/adr/0005-purpose-bound-sensitive-data-access.md new file mode 100644 index 000000000..8c9b7c9f1 --- /dev/null +++ b/docs/adr/0005-purpose-bound-sensitive-data-access.md @@ -0,0 +1,36 @@ +# ADR 0005: Purpose-bound sensitive-data access + +**Status:** Accepted architecture +**Date:** 2026-08-10 + +## Context +LifeOS contains personal planning, identity and integration data. Blanket masking would destroy legitimate product workflows while unrestricted access would undermine privacy and auditability. + +## Decision drivers +Business utility, tenant isolation, least privilege, controlled disclosure, auditability, retention, CSAP/SOC 2 evidence readiness without false certification claims. + +## Alternatives considered +- blanket PII masking — rejected as primary control; +- broad authenticated access — rejected; +- tenant/resource/purpose/lifetime-scoped authorization with audit evidence — selected. + +## Decision +Sensitive access requires authenticated actor/workspace authority plus bounded purpose/resource/lifetime rules. Grants are time-bounded/single-use where designed and access/decision evidence is append-only. Encryption/secret boundaries, least-privilege service roles and retention controls complement authorization. + +## Consequences +Callers must carry explicit purpose/resource context and systems need auditable grant/decision lifecycle, but valid workflows retain usable data. + +## Failure and recovery +Malformed/expired/replayed/cross-tenant grants fail closed. Provider or audit-store outage cannot be interpreted as authorization success. + +## Security and privacy impact +Raw credentials, prompts/responses and unnecessary tenant content remain outside public artifacts/logs. Pseudonymous identifiers are still sensitive metadata and retain access/retention controls. + +## Acceptance evidence +Protected-main privacy-service decisions/grants/events and exact-expiry/concurrency/immutability tests. + +## Migration and rollback +New sensitive resources must be registered with explicit purpose/authority semantics before use. Rollback may disable a new access path but must preserve immutable historical audit evidence. + +## Supersession +A future privacy model may supersede this only with equivalent or stronger tenant/purpose/audit evidence and a migration plan. \ No newline at end of file From 01d53aaa6efa6784bb2bad197e1f854c6fe73e95 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 09:02:10 +0900 Subject: [PATCH 019/173] docs(adr): record work-conserving maintenance --- ...-work-conserving-autonomous-maintenance.md | 37 +++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 docs/adr/0006-work-conserving-autonomous-maintenance.md diff --git a/docs/adr/0006-work-conserving-autonomous-maintenance.md b/docs/adr/0006-work-conserving-autonomous-maintenance.md new file mode 100644 index 000000000..e782fbb80 --- /dev/null +++ b/docs/adr/0006-work-conserving-autonomous-maintenance.md @@ -0,0 +1,37 @@ +# ADR 0006: Work-conserving autonomous maintenance + +**Status:** Accepted architecture +**Date:** 2026-08-10 + +## Context +LifeOS maintenance includes PR review/fixes, CI, documentation, buyer-gap development and release preparation. Treating one waiting PR or one completed action as run completion wastes available execution and lets product gaps persist. + +## Decision drivers +Exact-head evidence, safe single-writer behavior, bounded autonomy, auditability, progress during CI/reviewer latency, no gate bypass. + +## Alternatives considered +- stop after one useful action — rejected; +- poll one blocked PR until completion — rejected; +- parallel uncontrolled repository writers — rejected; +- one writer with a work-conserving queue and branch-local deferral — selected. + +## Decision +The dedicated LifeOS loop repeatedly selects the highest-value safe executable item. Waiting is local to an exact PR/head/run/review identity. Before each write it refetches target head/base/blob/review state. It fixes valid findings test-first, never fabricates approval/check evidence, and merges only unchanged exact heads satisfying live policy. Documentation and prompt changes are intermediate actions. + +## Consequences +Runs may perform several non-conflicting actions and require fresh-state discipline. Historical summaries/SHAs cannot be treated as current evidence. + +## Failure and recovery +If a branch moves under another writer, freeze that branch for the run and rotate elsewhere. Failed repair mechanisms become RCA evidence for another remedy. Scheduler/control-plane errors do not disable the recurring task unless truly unrecoverable. + +## Security and privacy impact +Least privilege and exact identity checks reduce accidental cross-branch or stale-state mutation. Model-assisted development remains separated from merge authority and uses approved NVIDIA/OpenCode boundaries. + +## Acceptance evidence +Protected-main `AGENTS.md`, commercial-development automation, buyer-gap/readiness tooling and merge behavior embody the queue/exact-head/no-bypass contract. + +## Migration and rollback +Automation prompt/workflow changes preserve a single LifeOS writer lease and hourly cadence. Rollback restores the last reviewed policy without weakening repository gates. + +## Supersession +A successor automation ADR must preserve equivalent safety/evidence semantics or explicitly justify each weakened/changed control. \ No newline at end of file From fc852f0047a57fab6a3c03872af56248cdef1c48 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 09:02:24 +0900 Subject: [PATCH 020/173] docs(adr): record canonical documentation graph --- .../adr/0007-canonical-documentation-graph.md | 36 +++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 docs/adr/0007-canonical-documentation-graph.md diff --git a/docs/adr/0007-canonical-documentation-graph.md b/docs/adr/0007-canonical-documentation-graph.md new file mode 100644 index 000000000..8c300cf59 --- /dev/null +++ b/docs/adr/0007-canonical-documentation-graph.md @@ -0,0 +1,36 @@ +# ADR 0007: Canonical documentation graph + +**Status:** Accepted architecture +**Date:** 2026-08-10 + +## Context +Feature specs, runbooks, PR bodies and chat history accumulated faster than a whole-product source of truth. Historical architecture also changed from local-first/single-app/UUIDv7 exploration to server-backed MSA/UUIDv4 behavior. + +## Decision drivers +Discoverability, code-current truth, explicit maturity, reviewability, machine-checkable consistency and acquisition diligence. + +## Alternatives considered +- rely on README/PR bodies/chat — rejected; +- duplicate architecture in many feature specs — rejected; +- one indexed canonical graph plus scoped feature docs — selected. + +## Decision +Maintain canonical PRD, TRD, root Architecture, ADR index/records, Data Model/ERD, UML, API/event contracts, Security/Threat Model, Privacy Lifecycle, Test Strategy, Operability, Release/Migration, Standards/Research and Traceability. Status fields use only the exact repository vocabulary and qualifiers/PR numbers belong in evidence prose. Diagrams distinguish conceptual/planned from actually persisted/shipped entities. + +## Consequences +Material product/authority changes require multi-view reconciliation, but GitHub can reconstruct product truth without conversation archaeology. + +## Failure and recovery +A stale/diverged canonical docs PR is not kept alive merely for ancestry. Create/reuse one clean successor from exact current main, preserve/reconcile unique content, prove it, then close the obsolete line as superseded. Resolved historical reviews are not permanent correctness evidence. + +## Security and privacy impact +Canonical docs must not embed credentials, raw tenant data, prompts/responses or hidden reasoning. Security boundaries and ownership are documented without exposing secret material. + +## Acceptance evidence +The canonical documentation consistency test validates required files/links/statuses/ADR targets/diagram fences and key source-aligned claims before protected-main integration. + +## Migration and rollback +When canonical names/paths change, update README/index/test links atomically. Rollback returns to the last coherent graph, not to chat-only authority. + +## Supersession +A future documentation architecture may supersede this ADR only if it preserves one discoverable code-current authority graph and explicit implementation maturity. \ No newline at end of file From dcea66eecc3d9132982604233b0e9cbbcdab7422 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 09:02:37 +0900 Subject: [PATCH 021/173] docs(adr): record buyer-gap evidence separation --- ...lity-maturity-from-buyer-gap-exhaustion.md | 36 +++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 docs/adr/0008-separate-capability-maturity-from-buyer-gap-exhaustion.md diff --git a/docs/adr/0008-separate-capability-maturity-from-buyer-gap-exhaustion.md b/docs/adr/0008-separate-capability-maturity-from-buyer-gap-exhaustion.md new file mode 100644 index 000000000..30bd7f5d3 --- /dev/null +++ b/docs/adr/0008-separate-capability-maturity-from-buyer-gap-exhaustion.md @@ -0,0 +1,36 @@ +# ADR 0008: Separate capability maturity from buyer-gap exhaustion + +**Status:** Accepted architecture +**Date:** 2026-08-10 + +## Context +The configured readiness capability manifest could reach 100% while accepted customer journeys still had explicit open gaps. Treating capability-evidence maturity as whole-product completeness creates misleading commercial readiness claims. + +## Decision drivers +Truthful product readiness, deterministic repository-owned gap identity, fail-closed unknown issue state, auditability and non-executable untrusted issue prose. + +## Alternatives considered +- use one aggregate capability score as completion — rejected; +- parse arbitrary issue text as product policy — rejected; +- maintain a versioned repository-owned buyer-gap registry and reconcile bounded issue state separately — selected. + +## Decision +Capability evidence maturity and canonical buyer-gap state are separate dimensions. The buyer-gap registry owns durable gap identity and links to issue/capability IDs. Issue title/body/comment/model/review prose is untrusted and never becomes executable policy. Gap state is `open`, `resolved` or `unknown`; missing/ambiguous evidence fails closed to unknown. + +## Consequences +A repository may correctly report 22/22 configured capabilities while still listing open buyer gaps. Product/release decisions must inspect both dimensions plus end-to-end/operational evidence. + +## Failure and recovery +GitHub evidence collection failure cannot turn a gap into resolved. Registry validation rejects duplicates, malformed IDs and unknown capability links. Recovery reruns bounded state collection without rewriting policy from remote prose. + +## Security and privacy impact +Only bounded issue identifiers/state are needed for readiness; untrusted bodies and unnecessary content are excluded from retained policy evidence. + +## Acceptance evidence +Protected-main buyer-gap registry/validation/rendering and issue #21 currently report configured maturity separately from #55/#129/#130 buyer gaps. + +## Migration and rollback +Existing capability maturity fields remain compatible. Buyer-gap fields are additive; rollback must not reinterpret absent buyer-gap evidence as zero gaps. + +## Supersession +A successor readiness model must preserve explicit distinction between configured evidence maturity and whole-product/customer outcome completeness. \ No newline at end of file From fe96eb4d6044662537aac85c99870b8fccf2368e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 09:02:51 +0900 Subject: [PATCH 022/173] docs(adr): record LifeOS product architecture evolution --- ...0009-product-hosting-and-data-evolution.md | 37 +++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 docs/adr/0009-product-hosting-and-data-evolution.md diff --git a/docs/adr/0009-product-hosting-and-data-evolution.md b/docs/adr/0009-product-hosting-and-data-evolution.md new file mode 100644 index 000000000..c242521d2 --- /dev/null +++ b/docs/adr/0009-product-hosting-and-data-evolution.md @@ -0,0 +1,37 @@ +# ADR 0009: Product hosting and data-authority evolution + +**Status:** Accepted architecture +**Date:** 2026-08-10 + +## Context +Early LifeOS exploration proposed a private/login-free local-first PWA and later a simple single-Docker application. The product then moved to a public multi-user cloud/self-hostable service with Google/GitHub login, PostgreSQL durability and domain-oriented services. Retaining all historical options as current created contradictory architecture claims. + +## Decision drivers +Cross-device durability, explicit account/workspace authority, public/self-hosted deployment, independent service ownership, privacy/auditability and modular CWL composition. + +## Alternatives considered +1. Browser-only IndexedDB as system of record — superseded as primary architecture. +2. Single durable application owning all domains — superseded as durable architecture. +3. Provider-hosted proprietary backend — rejected as product dependency. +4. Multi-user server-backed self-hostable modular MSA with explicit local-draft boundary — selected. + +## Decision +LifeOS is a multi-user server-backed and self-hostable modular MSA. Google/GitHub identity establishes server-authorized accounts/workspaces. Domain services own durable state in PostgreSQL and may use NATS/versioned HTTP/event contracts. Browser-local state is explicit draft/cache/offline UX until accepted by the owning service. Compose remains a valid self-hosted composition profile but does not collapse service authority. + +## Consequences +Operators provision durable infrastructure/secrets/provider registration, while users gain cross-device durability and auditable authority. Offline UX requires explicit reconciliation rather than pretending local state is globally durable. + +## Failure and recovery +Loss of browser-local draft does not imply loss of durable service state. Service/provider outages degrade bounded workflows without changing ownership. Backup/restore protects durable PostgreSQL within documented scope. + +## Security and privacy impact +Multi-user operation requires tenant isolation, server-derived authority, purpose-bound sensitive access and credential separation. Local drafts remain locally scoped until explicit upload/sync. + +## Acceptance evidence +Protected-main service layout, identity/workspace persistence, durable planning/Today, PostgreSQL/NATS composition, Kubernetes reference and `ARCHITECTURE.md`. + +## Migration and rollback +Historical local-first data is migrated only through explicit user-controlled/import/sync flows. Do not silently upload local drafts. Deployment rollback cannot collapse service-owned data authority into a shared monolith. + +## Supersession +Only a reviewed product-hosting/data-authority ADR with migration, privacy, offline, deployment and compatibility evidence may supersede this architecture. \ No newline at end of file From 20eb7b8d770bba6377adec30cb16df271337c339 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 09:03:02 +0900 Subject: [PATCH 023/173] docs(adr): add canonical ADR index --- docs/adr/README.md | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 docs/adr/README.md diff --git a/docs/adr/README.md b/docs/adr/README.md new file mode 100644 index 000000000..973e3efad --- /dev/null +++ b/docs/adr/README.md @@ -0,0 +1,27 @@ +# LifeOS Architecture Decision Records + +ADRs capture durable decisions that must not be reconstructed from chat history or old PR bodies. Protected-main source/tests remain implementation evidence. + +## Status vocabulary + +ADR status uses the same exact canonical documentation values: `Implemented on protected main`, `Implemented on active PR`, `Partial`, `Accepted architecture`, `Planned`, `Research only`, `Superseded`, `Out of scope`. + +## Index + +| ADR | Status | Decision | +| --- | --- | --- | +| [0001](0001-opaque-non-numeric-identifiers.md) | Accepted architecture | Internal identifiers are opaque UUIDv4; old UUIDv7 design language is superseded | +| [0002](0002-oauth-transactions-and-session-tokens.md) | Accepted architecture | Server-owned OAuth transaction/session security and authentication provenance | +| [0003](0003-service-owned-persistence.md) | Accepted architecture | Bounded services own persistence/migrations/credentials and never cross-write tables | +| [0004](0004-inert-auditable-ai-proposals.md) | Accepted architecture | AI output is inert auditable proposal evidence with explicit decisions | +| [0005](0005-purpose-bound-sensitive-data-access.md) | Accepted architecture | Sensitive access is tenant/resource/purpose/lifetime/audit bound | +| [0006](0006-work-conserving-autonomous-maintenance.md) | Accepted architecture | Autonomous maintenance is exact-state, single-writer and work-conserving | +| [0007](0007-canonical-documentation-graph.md) | Accepted architecture | One code-current canonical documentation graph with explicit maturity | +| [0008](0008-separate-capability-maturity-from-buyer-gap-exhaustion.md) | Accepted architecture | Capability maturity is separate from buyer-gap exhaustion | +| [0009](0009-product-hosting-and-data-evolution.md) | Accepted architecture | Server-backed self-hostable modular MSA supersedes browser-only/single-app primary architecture | + +## ADR quality contract + +Material ADRs contain: context; decision drivers; alternatives; decision; consequences; failure/recovery; security/privacy/governance impact; acceptance evidence; migration/rollback; and supersession conditions. + +A feature plan is not a substitute for an ADR when authority, identity, persistence, security, deployment, interoperability or release criteria change. \ No newline at end of file From 954c3fd145deb5fcfc84df6da4e456de694efc79 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 09:03:36 +0900 Subject: [PATCH 024/173] docs: link canonical product documentation --- README.md | 32 +++++++++++++++++++++++++++----- 1 file changed, 27 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 59412fabb..b76c29662 100644 --- a/README.md +++ b/README.md @@ -83,13 +83,13 @@ The calendar integration service supports explicit `caldav` and `google` provide CalDAV writes use deterministic resource names, `If-None-Match: *` for creation, and strong `If-Match` ETags for updates. Google Calendar writes use a deterministic API event identifier to prevent duplicate creation and the same strong-ETag precondition for updates. Neither adapter exposes delete, move, or copy operations through the LifeOS provider contract. -`GOOGLE_CALENDAR_ACCESS_TOKEN` is an operator-supplied runtime secret for this bounded adapter slice. Per-user OAuth credential storage, token refresh, revocation, calendar discovery, and encrypted persistence remain deferred and must be implemented before a multi-user hosted deployment enables Google Calendar synchronization. +The calendar service now derives workspace authority from a bounded signed server context rather than a client-selected legacy workspace header. `GOOGLE_CALENDAR_ACCESS_TOKEN` remains an operator-supplied development/runtime secret for the current provider slice. Per-user OAuth credential storage, token refresh, revocation, calendar discovery, selection, and encrypted persistence remain tracked by issue #129 before hosted multi-user Google Calendar operation can be considered complete. ## Plugin contract The `@life-os/plugin-sdk` package defines strict versioned manifests, tenant-scoped CloudEvents 1.0 structured JSON envelopes, deterministic canonical serialization, and HMAC-SHA256 delivery-proof helpers. The integration service exposes contract discovery, manifest validation, and event preparation only. -This slice deliberately has no plugin installation, secret persistence, outbound webhook delivery, inbound commands, or direct database access. Those require separately reviewed least-privilege authorization, durable audit, and SSRF-safe delivery boundaries. +This slice deliberately has no plugin installation, secret persistence, outbound webhook delivery, inbound commands, or direct database access. Those require separately reviewed least-privilege authorization, durable audit, and SSRF-safe delivery boundaries under issue #130. ## Backup and recovery @@ -109,9 +109,32 @@ This is a public repository. It contains synthetic examples only. Personal goals The upstream project does not operate every LifeOS deployment. A self-hosting organization controls its deployment data and must establish its own privacy notice, retention policy, security controls, subprocessors, and legal basis. See the [upstream privacy notice](docs/legal/privacy.md) and [upstream project terms](docs/legal/terms.md) for the upstream project boundary. -## Documentation +## Canonical product documentation + +The following graph is the whole-product source of truth alongside protected-main code and root `AGENTS.md` / `ARCHITECTURE.md`: + +- [Product requirements](docs/PRD.md) +- [Technical requirements](docs/TRD.md) +- [Architecture decisions](ARCHITECTURE.md) +- [ADR index](docs/adr/README.md) +- [Logical data model / ERD](docs/DATA_MODEL.md) +- [UML and interaction views](docs/UML.md) +- [API and event contracts](docs/API_CONTRACTS.md) +- [Threat model](docs/THREAT_MODEL.md) +- [Privacy and data lifecycle](docs/PRIVACY_DATA_LIFECYCLE.md) +- [Test strategy](docs/TEST_STRATEGY.md) +- [Operability](docs/OPERABILITY.md) +- [Release, migration, and rollback](docs/RELEASE_AND_MIGRATION.md) +- [Standards and research traceability](docs/STANDARDS_TRACEABILITY.md) +- [Requirements/evidence traceability](docs/TRACEABILITY.md) +- [Documentation fitness assessment](docs/DOCUMENTATION_ASSESSMENT.md) +- [Vulnerability reporting](SECURITY.md) + +Scoped feature designs, plans and runbooks remain useful evidence but do not override this code-current canonical graph. -- Product and architecture design: `docs/superpowers/specs/2026-08-02-life-os-design.md` +## Additional documentation + +- Product and architecture design history: `docs/superpowers/specs/2026-08-02-life-os-design.md` - Foundation implementation plan: `docs/superpowers/plans/2026-08-02-life-os-foundation.md` - Gateway service-level objectives: `docs/operations/service-level-objectives.md` - Planning-service service-level objectives: `docs/operations/planning-service-level-objectives.md` @@ -120,7 +143,6 @@ The upstream project does not operate every LifeOS deployment. A self-hosting or - [Production Kubernetes deployment runbook](docs/operations/production-deployment.md) - [Upstream privacy notice](docs/legal/privacy.md) - [Upstream project terms](docs/legal/terms.md) -- [Vulnerability reporting](SECURITY.md) ## Contributing From d6d63b8df317a2d1ac85acd445c940df4eb6d27e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 09:04:25 +0900 Subject: [PATCH 025/173] test(docs): enforce canonical documentation contract --- .../src/documentation-contract.test.mjs | 172 ++++++++++++++++++ 1 file changed, 172 insertions(+) create mode 100644 packages/commercial-readiness/src/documentation-contract.test.mjs diff --git a/packages/commercial-readiness/src/documentation-contract.test.mjs b/packages/commercial-readiness/src/documentation-contract.test.mjs new file mode 100644 index 000000000..62136ad09 --- /dev/null +++ b/packages/commercial-readiness/src/documentation-contract.test.mjs @@ -0,0 +1,172 @@ +import assert from 'node:assert/strict'; +import { existsSync, readFileSync, readdirSync } from 'node:fs'; +import { dirname, join } from 'node:path'; +import { fileURLToPath } from 'node:url'; +import test from 'node:test'; + +const ROOT = fileURLToPath(new URL('../../../', import.meta.url)); +const REQUIRED = Object.freeze([ + 'docs/PRD.md', + 'docs/TRD.md', + 'ARCHITECTURE.md', + 'docs/adr/README.md', + 'docs/DATA_MODEL.md', + 'docs/UML.md', + 'docs/API_CONTRACTS.md', + 'SECURITY.md', + 'docs/THREAT_MODEL.md', + 'docs/PRIVACY_DATA_LIFECYCLE.md', + 'docs/TEST_STRATEGY.md', + 'docs/OPERABILITY.md', + 'docs/RELEASE_AND_MIGRATION.md', + 'docs/STANDARDS_TRACEABILITY.md', + 'docs/TRACEABILITY.md', + 'docs/DOCUMENTATION_ASSESSMENT.md', +]); +const STATUSES = Object.freeze([ + 'Implemented on protected main', + 'Implemented on active PR', + 'Partial', + 'Accepted architecture', + 'Planned', + 'Research only', + 'Superseded', + 'Out of scope', +]); + +/** Reads a repository UTF-8 file. */ +function text(path) { + return readFileSync(join(ROOT, path), 'utf8'); +} + +/** Returns local Markdown link targets from one Markdown document. */ +function localLinks(relativePath) { + const body = text(relativePath); + return [...body.matchAll(/\[[^\]]+\]\(([^)]+)\)/gu)] + .map((match) => match[1].split('#', 1)[0]) + .filter((target) => target && !/^[a-z][a-z0-9+.-]*:/iu.test(target)); +} + +/** Resolves a local Markdown target from its containing document. */ +function resolveLocal(relativePath, target) { + return join(ROOT, dirname(relativePath), target); +} + +/** Extracts exact **Status:** metadata values. */ +function metadataStatuses(body) { + return [...body.matchAll(/^\*\*Status:\*\* ([^\r\n]+)$/gmu)].map((match) => + match[1].trim(), + ); +} + +/** Extracts the status column from canonical four-column requirement tables. */ +function tableStatuses(body) { + return body + .split('\n') + .filter((line) => /^\| [A-Z][A-Z0-9.-]+ /u.test(line)) + .map((line) => line.split('|').map((value) => value.trim())) + .filter((cells) => cells.length >= 6) + .map((cells) => cells[3]); +} + +test('canonical documentation files exist and are linked from README', () => { + const readme = text('README.md'); + for (const path of REQUIRED) { + assert.equal(existsSync(join(ROOT, path)), true, `missing ${path}`); + assert.ok(readme.includes(`](${path})`), `README missing link to ${path}`); + } +}); + +test('local README and canonical-document links resolve to repository files', () => { + for (const path of ['README.md', ...REQUIRED.filter((item) => item.endsWith('.md'))]) { + for (const target of localLinks(path)) { + assert.equal( + existsSync(resolveLocal(path, target)), + true, + `${path} has broken local link ${target}`, + ); + } + } +}); + +test('canonical status metadata and requirement tables use the exact vocabulary', () => { + for (const path of REQUIRED.filter((item) => item.endsWith('.md'))) { + const body = text(path); + for (const status of [...metadataStatuses(body), ...tableStatuses(body)]) { + assert.ok(STATUSES.includes(status), `${path} has invalid status: ${status}`); + } + } +}); + +test('ADR index targets every material ADR and ADRs satisfy the quality contract', () => { + const index = text('docs/adr/README.md'); + const files = readdirSync(join(ROOT, 'docs/adr')) + .filter((name) => /^\d{4}-.+\.md$/u.test(name)) + .sort(); + const requiredNumbers = new Set(['0001', '0002', '0003', '0004', '0005', '0006', '0007', '0008', '0009']); + + for (const number of requiredNumbers) { + assert.ok(files.some((name) => name.startsWith(`${number}-`)), `missing ADR ${number}`); + } + + for (const file of files) { + const number = file.slice(0, 4); + assert.ok(index.includes(`[${number}](${file})`), `${file} missing exact index target`); + const body = text(`docs/adr/${file}`); + const status = metadataStatuses(body)[0]; + assert.ok(status !== undefined && STATUSES.includes(status), `${file} has invalid status`); + for (const heading of [ + '## Context', + '## Decision', + '## Consequences', + '## Failure and recovery', + '## Security and privacy impact', + '## Acceptance evidence', + '## Migration and rollback', + '## Supersession', + ]) { + assert.ok(body.includes(heading), `${file} missing ${heading}`); + } + } +}); + +test('canonical Markdown keeps balanced fenced code blocks', () => { + for (const path of REQUIRED.filter((item) => item.endsWith('.md'))) { + const count = text(path) + .split('\n') + .filter((line) => line.trimStart().startsWith('```')).length; + assert.equal(count % 2, 0, `${path} has an unbalanced code fence`); + } +}); + +test('documentation claims are anchored to current source authority', () => { + const agents = text('AGENTS.md'); + const architecture = text('ARCHITECTURE.md'); + const dataRights = text('apps/identity-service/src/data-rights.ts'); + const proposals = text('apps/ai-service/src/proposal-service.ts'); + const dataModel = text('docs/DATA_MODEL.md'); + const threatModel = text('docs/THREAT_MODEL.md'); + + assert.match(agents, /Internal identifiers are opaque UUIDv4 strings/u); + assert.match(dataRights, /UUID_V4_PATTERN/u); + assert.match(dataRights, /-4\[0-9a-f\]\{3\}/u); + assert.match(architecture, /never read another service's database tables directly/u); + assert.match(dataModel, /do not authorize cross-service SQL joins|does not authorize cross-service SQL joins/iu); + assert.match(proposals, /requiresConfirmation: true/u); + assert.match(proposals, /cannot execute its own operations/u); + assert.match(threatModel, /AI prompt injection \/ silent mutation/u); +}); + +test('canonical lifecycle reflects protected-main integrations and remaining gaps', () => { + const prd = text('docs/PRD.md'); + const traceability = text('docs/TRACEABILITY.md'); + const assessment = text('docs/DOCUMENTATION_ASSESSMENT.md'); + + assert.match(prd, /PR #127 merged as protected main/u); + assert.match(prd, /PR #139 merged/u); + assert.match(prd, /PRs #134, #136, #137, #138 and #144 integrated on main/u); + assert.match(traceability, /#55 data portability completion/u); + assert.match(traceability, /#129 per-user calendar credentials/u); + assert.match(traceability, /#130 plugin runtime delivery/u); + assert.match(assessment, /old documentation PR #126 became materially diverged/u); +}); From 44b398601e471d701c755a6ddc70535d5aaf6167 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 09:04:59 +0900 Subject: [PATCH 026/173] test(docs): exclude table headers from status validation --- .../src/documentation-contract.test.mjs | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/packages/commercial-readiness/src/documentation-contract.test.mjs b/packages/commercial-readiness/src/documentation-contract.test.mjs index 62136ad09..7269e7ac9 100644 --- a/packages/commercial-readiness/src/documentation-contract.test.mjs +++ b/packages/commercial-readiness/src/documentation-contract.test.mjs @@ -59,13 +59,13 @@ function metadataStatuses(body) { ); } -/** Extracts the status column from canonical four-column requirement tables. */ +/** Extracts status values from canonical ID-keyed requirement tables. */ function tableStatuses(body) { return body .split('\n') .filter((line) => /^\| [A-Z][A-Z0-9.-]+ /u.test(line)) .map((line) => line.split('|').map((value) => value.trim())) - .filter((cells) => cells.length >= 6) + .filter((cells) => cells.length >= 6 && cells[1] !== 'ID') .map((cells) => cells[3]); } @@ -151,7 +151,7 @@ test('documentation claims are anchored to current source authority', () => { assert.match(dataRights, /UUID_V4_PATTERN/u); assert.match(dataRights, /-4\[0-9a-f\]\{3\}/u); assert.match(architecture, /never read another service's database tables directly/u); - assert.match(dataModel, /do not authorize cross-service SQL joins|does not authorize cross-service SQL joins/iu); + assert.match(dataModel, /does not authorize cross-service SQL joins/iu); assert.match(proposals, /requiresConfirmation: true/u); assert.match(proposals, /cannot execute its own operations/u); assert.match(threatModel, /AI prompt injection \/ silent mutation/u); From 0cf592fbc5376af8ce7d3573be06bf96940fa0f9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 09:05:27 +0900 Subject: [PATCH 027/173] docs: align Claude handoff with canonical documentation graph --- CLAUDE.md | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index 06439b77a..a796a89e8 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -1,6 +1,6 @@ # Claude operating contract for LifeOS -`AGENTS.md` is the canonical repository-wide instruction file. This document maps that contract into a concise execution order for Claude-compatible agents and must not override `AGENTS.md`, `ARCHITECTURE.md`, branch protection, or security policy. +`AGENTS.md` is the canonical repository-wide instruction file. `ARCHITECTURE.md` is the durable system-boundary source of truth. The canonical product documentation graph is indexed from `README.md` and includes PRD, TRD, ADRs, Data Model, UML, API contracts, threat/privacy/test/operability/release/standards/traceability views. This document maps those authorities into a concise execution order for Claude-compatible agents and must not override live repository policy. ## Execution order @@ -10,9 +10,9 @@ 4. Make the smallest complete correction, including tests and documentation. 5. Re-run the exact pull-request head and resolve only threads whose finding is actually addressed. 6. Merge only when required checks pass, no actionable findings remain, and the repository's merge policy accepts the exact head. -7. Continue with the highest-impact buyer-visible gap after the pull-request queue is empty. +7. Continue with the highest-impact buyer-visible gap after the pull-request queue is empty or a current lane becomes locally blocked. -Routine progress narration is not a substitute for repository evidence. Record decisions in code, tests, ADRs, specifications, plans, runbooks, issues, and pull-request descriptions. +Routine progress narration is not a substitute for repository evidence. Record durable decisions in canonical docs/ADRs, code, tests, runbooks, issues, and pull-request evidence with truthful protected-main/active-PR/planned maturity. ## Non-negotiable boundaries @@ -23,7 +23,9 @@ Routine progress narration is not a substitute for repository evidence. Record d - Internal identifiers are UUIDv4 strings; numeric external identifiers are mapped through an explicit provider-identity boundary. - Database objects use multiword `snake_case` names unless an external protocol mandates a different spelling. - Services do not read or mutate another service's database tables. +- Browser-local state is not durable until accepted by the owning service. - AI proposals remain inert until a separately authorized user-confirmed execution capability exists. +- Sensitive access is tenant/resource/purpose/lifetime/audit bound rather than relying on blanket masking. - Mathematical and psychometric numerical kernels require Rust, deterministic CPU/GPU execution boundaries, realistic parameter-recovery tests, multilevel or multiple-membership structure, and temporal modeling where applicable. ## LLM orchestration decisions @@ -36,12 +38,13 @@ Live model tests may use `NVIDIA_NIM_API_KEY`. Deterministic pull-request checks - Production declarations have explanatory docstrings. - Changed production code maintains 100% statement, branch, function, and line coverage where the package enforces those gates. -- Tests model realistic domain outcomes, not only mocked implementation calls. +- Tests model realistic domain outcomes, including PostgreSQL/browser/concurrency/security behavior where applicable. - Standards and research claims are documented with APA 7 references and publication status is distinguished from drafts or preprints. +- Canonical status fields use the exact repository vocabulary and never mix PR/issue qualifiers into the status value. - `CHANGELOG.md` records buyer-visible behavior. -- `ARCHITECTURE.md` and relevant feature ADR/specification files record boundary changes. +- PRD/TRD/Architecture/ADR/UML/Data Model/API/Security/Privacy/Test/Operability/Release/Traceability views are reconciled when their boundary changes. - Release tags and versions are created only after the repository proves release readiness; unreleased work stays under `Unreleased`. ## Safe escalation -Escalate only for a decision or permission that cannot be resolved from repository policy, tests, standards, or available credentials. Waiting for checks or reviews is not itself an escalation condition; continue independent analysis, documentation, or the next non-conflicting planned task while preserving merge safety. +Escalate only for a decision or permission that cannot be resolved from repository policy, tests, standards, or available credentials. Waiting for checks or reviews is not itself an escalation condition; continue independent analysis, documentation, testing, or the next non-conflicting planned task while preserving merge safety. From adbed7d668900e8fef51bac565c2bcfd5ef0e869 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 09:13:58 +0900 Subject: [PATCH 028/173] test(docs): parse only explicit status table columns --- .../src/documentation-contract.test.mjs | 41 +++++++++++++++---- 1 file changed, 34 insertions(+), 7 deletions(-) diff --git a/packages/commercial-readiness/src/documentation-contract.test.mjs b/packages/commercial-readiness/src/documentation-contract.test.mjs index 7269e7ac9..a27663582 100644 --- a/packages/commercial-readiness/src/documentation-contract.test.mjs +++ b/packages/commercial-readiness/src/documentation-contract.test.mjs @@ -59,14 +59,41 @@ function metadataStatuses(body) { ); } -/** Extracts status values from canonical ID-keyed requirement tables. */ +/** Splits a Markdown table row into normalized cells. */ +function tableCells(line) { + return line + .trim() + .replace(/^\|/u, '') + .replace(/\|$/u, '') + .split('|') + .map((value) => value.trim()); +} + +/** Returns whether cells form a Markdown table separator row. */ +function isSeparatorRow(cells) { + return cells.length > 0 && cells.every((cell) => /^:?-{3,}:?$/u.test(cell)); +} + +/** Extracts values only from table columns whose exact header is Status. */ function tableStatuses(body) { - return body - .split('\n') - .filter((line) => /^\| [A-Z][A-Z0-9.-]+ /u.test(line)) - .map((line) => line.split('|').map((value) => value.trim())) - .filter((cells) => cells.length >= 6 && cells[1] !== 'ID') - .map((cells) => cells[3]); + const lines = body.split('\n'); + const statuses = []; + for (let index = 0; index < lines.length - 1; index += 1) { + if (!lines[index].trimStart().startsWith('|')) continue; + const headers = tableCells(lines[index]); + const statusIndex = headers.indexOf('Status'); + if (statusIndex < 0) continue; + const separators = tableCells(lines[index + 1]); + if (separators.length !== headers.length || !isSeparatorRow(separators)) continue; + + for (let rowIndex = index + 2; rowIndex < lines.length; rowIndex += 1) { + if (!lines[rowIndex].trimStart().startsWith('|')) break; + const cells = tableCells(lines[rowIndex]); + if (cells.length !== headers.length || isSeparatorRow(cells)) continue; + statuses.push(cells[statusIndex]); + } + } + return statuses; } test('canonical documentation files exist and are linked from README', () => { From 68214ca5ff3caa8662da427fd7dacea8d359d607 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 09:27:26 +0900 Subject: [PATCH 029/173] docs: reconcile root architecture with current product authority --- ARCHITECTURE.md | 217 +++++++++++++++++++++++++++++++----------------- 1 file changed, 140 insertions(+), 77 deletions(-) diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 1b09f7e4c..3dc5a061c 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -1,10 +1,12 @@ # LifeOS architecture decisions -This document is the architectural source of truth for repository-wide boundaries. Feature-level specifications and runbooks may add detail, but they must not weaken these decisions. +This document is the architectural source of truth for repository-wide product and service authority. Protected-main source, migrations, tests and live repository policy are the executable evidence for shipped behavior. Canonical PRD/TRD/data/UML/security/operability documents add code-current views; feature specifications and runbooks may add detail but must not weaken these decisions. ## 1. Product and deployment boundary -LifeOS is a modular, self-hostable personal operating system. Every bounded service must work independently and remain composable inside the monorepo deployment. Services communicate through versioned HTTP/event contracts and never read another service's database tables directly. +LifeOS is a privacy-first, multi-user, server-backed and self-hostable personal operating system. It remains usable as an independent product while composing with other ContextualWisdomLab bounded contexts through explicit versioned interfaces. + +Earlier login-free/browser-only local-first, private-personal-only, UUIDv7 and single-application primary designs are **superseded**. Browser-local state remains valid for explicit draft/cache/offline interaction and Docker Compose remains a deployment profile, but neither becomes durable data authority or permission to collapse service ownership. ```mermaid flowchart LR @@ -14,36 +16,96 @@ flowchart LR G --> P[Planning service] G --> H[Habit service] G --> R[Review service] - G --> A[AI proposal service] G --> C[Calendar integration service] + G --> Q[Notification service] + G --> A[AI proposal service] G --> X[Plugin integration service] + G --> V[Privacy service] + P -. domain events .-> N[(NATS JetStream)] H -. domain events .-> N - R -. domain events .-> N - subgraph Data ownership - IDB[(Identity PostgreSQL schema)] - PDB[(Planning PostgreSQL schema)] - HDB[(Habit PostgreSQL schema)] - ADB[(AI audit PostgreSQL schema)] - NDB[(Notification PostgreSQL schema)] - end - I --> IDB - P --> PDB - H --> HDB - A --> ADB + R -. projection events .-> N + N -. reminder/event inputs .-> Q + + I --> IDB[(Identity-owned PostgreSQL)] + P --> PDB[(Planning-owned PostgreSQL)] + H --> HDB[(Habit-owned PostgreSQL)] + R --> RDB[(Review-owned PostgreSQL)] + Q --> NDB[(Notification-owned PostgreSQL)] + A --> ADB[(AI-owned PostgreSQL)] + V --> VDB[(Privacy-owned PostgreSQL)] ``` +Physical co-location on one PostgreSQL cluster does not create cross-service table authority. + ### Required invariants -- Internal object identifiers are opaque UUIDv4 strings. Numeric provider identifiers are never reused as internal primary keys. -- Database object names contain at least two words and use `snake_case` unless an external standard requires another form. -- Each service owns migrations, runtime configuration, persistence adapters, tests, and shutdown behavior. -- Cross-service writes require an explicit API, event, saga, or plugin contract; shared-table coupling is prohibited. -- Public errors, metrics, logs, artifacts, and review evidence exclude credentials and unbounded tenant data. +- Internal object identifiers are opaque UUIDv4 strings. Numeric or provider-native identifiers are explicit external mappings and never internal primary keys. +- Product-owned database object names use descriptive multiword `snake_case` unless an external standard mandates another spelling. +- Each service owns its persistence schema/role, migrations, credentials, runtime configuration, persistence adapters, tests, observability and shutdown behavior. +- Services never read or mutate another service's database tables directly. Cross-service relationships use a versioned HTTP, event, saga, plugin or MCP contract. +- Browser-local state is draft/cache/offline state until an authorized owning service confirms persistence. +- Public errors, metrics, logs, retained artifacts and review evidence exclude credentials, hidden reasoning and unnecessary unbounded tenant content. -## 2. AI proposal safety boundary +## 2. Identity, workspace and authentication provenance -AI output is an inert proposal, not an execution command. The AI service can generate, persist, retrieve, and record explicit decisions about proposals, but it has no planning mutation repository or generic command bus. +Identity service owns LifeOS user identity, external-provider mappings, workspace membership/authorization, browser sessions and authentication provenance. + +Google/GitHub OAuth transactions are server-owned and replay-resistant. Session issuance/rotation time and the underlying authentication ceremony time are different facts. Compatible session rotation preserves the original authentication instant so recent-authentication policy cannot be bypassed by refreshing a session. + +The identity service also owns durable data-rights request identity and immutable terminal receipt evidence. Protected main includes tenant-and-requesting-actor scoped request lookup; inaccessible cross-tenant status is not disclosed. Complete cross-domain export/erasure orchestration remains **Partial** under issue #55. + +```mermaid +sequenceDiagram + actor User + participant Web + participant Identity + participant Provider as Google/GitHub + participant Domain as Owning domain service + + User->>Web: Start login + Web->>Identity: Create bounded OAuth transaction + Identity->>Provider: Authorization request + Provider-->>Identity: Callback + Identity->>Identity: Validate provider/state/redirect and map identity + Identity->>Identity: Resolve authorized workspace and authentication instant + Identity-->>Web: Revocable session + User->>Web: Domain action + Web->>Identity: Validate session + Identity-->>Web: Actor/workspace/authentication provenance + Web->>Domain: Server-derived trusted context +``` + +## 3. Planning, Today, habits, reviews and reminders + +Planning service owns Goals, Projects, Tasks, planning search and durable Today state. Habit service owns recurring habit definitions and completion evidence. Review service owns guided-review snapshots/projections without becoming planning or habit mutation authority. Notification service owns reminder occurrences, claims/fencing, delivery attempts and bounded outcomes. + +Durable Today synchronization is protected-main behavior. The browser requires an explicit local-to-workspace save, uses strong preconditions plus idempotency, and receives explicit conflict/revision evidence rather than silent stale overwrite. + +```mermaid +flowchart TB + Goal[Goal] --> Project[Project] + Project --> Task[Task] + Goal -. motivates .-> Habit[Habit] + Project -. motivates .-> Habit + Task --> TaskEvidence[Task completion evidence] + Habit --> HabitEvidence[Habit completion evidence] + TaskEvidence --> Review[Daily / weekly review] + HabitEvidence --> Review + Review -. projection only .-> PlanningView[Planning view / recommendation] +``` + +## 4. Calendar integration boundary + +Conflict-safe CalDAV/Google synchronization and signed trusted workspace context are protected-main behavior. The calendar service rejects the legacy model in which an arbitrary client-selected workspace header could become tenant authority. + +A process/operator-supplied Google access token remains a bounded development/runtime credential path; the complete hosted per-user encrypted credential lifecycle, OAuth state/PKCE, refresh, revocation, discovery and explicit calendar selection remains **Partial** under issue #129. + +Provider identities/credentials never become LifeOS internal primary keys or general identity credentials. + +## 5. AI proposal safety boundary + +AI output is untrusted inert proposal data, not an execution command. The AI service can generate, persist, retrieve and record explicit decisions about proposals, but it has no generic planning mutation repository or command bus. ```mermaid sequenceDiagram @@ -51,79 +113,80 @@ sequenceDiagram participant Web as Authenticated web BFF participant Identity participant AI as AI proposal service - participant Audit as Append-only AI audit store + participant Audit as AI-owned audit store - Browser->>Web: Proposal request + opaque session cookie + Browser->>Web: Proposal request Web->>Identity: Validate session - Identity-->>Web: Workspace UUIDv4 + actor UUIDv4 - Web->>AI: Signed method/path/tenant/actor context + Identity-->>Web: Actor + workspace UUIDv4 + Web->>AI: Signed bounded actor/workspace/method/path context AI->>AI: Validate bounded request and model output - AI->>Audit: Persist immutable proposal evidence - Audit-->>AI: Recorded digest evidence - AI-->>Web: Inert proposal requiring confirmation - Web-->>Browser: Credential-free response + AI->>Audit: Persist proposal evidence + AI-->>Web: Inert proposal requiring explicit decision + Browser->>Web: Accept / reject + Web->>AI: Exact proposal digest/revision + authorized decision + AI->>Audit: Append decision evidence ``` -The signed private context uses one active HMAC key and at most one previous verification-only key. Key identifiers, method, path, workspace, actor, and issuance time are integrity protected. Browser credentials and provider keys never reach the AI service. +Deterministic authorization, schema and proposal-quality gates remain authoritative when model providers are unavailable. Live provider execution is bounded conformance evidence, not permission to weaken deterministic correctness. -## 3. Test-time compute and live conformance +## 6. Privacy and data-rights authority -The deterministic proposal evaluator is authoritative for proposal validity, operation conformance, grounding, benign utility, forbidden-text leakage, and prompt-injection resistance. Live provider execution is governance evidence and is not a pull-request availability gate. +Privacy service owns purpose-bound sensitive-access decisions, bounded grants and audit events. Sensitive access binds actor, workspace, resource/resource class, purpose and lifetime. Blanket masking is not the authorization model. -```mermaid -flowchart TB - F[Versioned realistic fixtures] --> E[Production ProposalQualityEvaluator] - E --> B[Strong single-route baseline] - E --> L[Lower reasoning-effort route] - E --> M[Bounded multi-agent conduct workflow] - B --> D[Counts, rates, and deltas] - L --> D - M --> D - D --> V[Validated credential-free report] - V --> Q{Measured quality gain without safety regression?} - Q -->|No| S[Keep single-route baseline] - Q -->|Yes| O[Permit bounded orchestration profile] -``` +Identity owns the cross-domain data-rights request/receipt lifecycle; each participating bounded context remains authoritative for its own export/erasure contribution. Whole-product completion requires durable contributor registration, reconciliation, protected delivery/erasure semantics, bounded retry/recovery, retention/legal-hold/backup-expiry handling and an immutable final receipt only after all required contributors confirm completion. + +## 7. Plugin integration boundary + +Protected main owns versioned plugin manifest/event validation and preparation. It does not imply generic installation, durable plaintext secrets, unrestricted outbound delivery, inbound arbitrary commands or direct cross-service database access. + +Issue #130 owns the planned runtime trust boundary: explicit installation/capability grants, encrypted secret handles, authorized-origin SSRF-safe outbound delivery, bounded retries/audit and immediate revocation. + +## 8. Test-time compute and model-assisted repository development -### Compute-allocation rules +A strong single-model route is measured before deeper orchestration. Reasoning effort, workflow stage, decomposition, recursion depth, role and access topology are explicit experimental dimensions; deeper orchestration is justified by measured quality or heterogeneous capability coverage rather than agent count. -- A strong single-model route is always measured first. -- Reasoning effort, workflow stage, decomposition, recursion depth, role, and access topology are explicit test cells rather than hidden defaults. -- Deeper orchestration is justified by measured fixture-level quality or heterogeneous capability coverage, not by agent count. -- Latency and token use are recorded for capacity review but are not the optimization objective. -- Unsupported capabilities remain explicit unavailable cells; tests never fabricate an ablation result. +Scheduled model-assisted repository development uses the reviewed OpenCode/NVIDIA boundary with `NVIDIA_NIM_API_KEY` where model access is required. Development models do not receive product-data authority, review-agent credentials, branch-protection authority, merge authority or release authority. Deterministic reverification remains independent of the model. -The hourly live workflow pins `ContextualWisdomLab/contextual-orchestrator` to an exact reviewed commit, installs hash-locked dependencies, seeds only `NVIDIA_NIM_API_KEY` through the encrypted credential bootstrap, executes the pinned checkout on loopback, and retains no prompts, responses, hidden reasoning, credentials, or raw traces. +## 9. Verification evidence identity and merge safety -## 4. Mathematical and psychometric modules +Repository evidence has distinct identities and must not be conflated: -LifeOS currently contains no psychometric computation service. Any future mathematical or psychometric module must follow these additional decisions before it can be treated as production-capable: +- contributor source head; +- PR base snapshot recorded by GitHub; +- independently resolved current live base-ref tip; +- synthetic merge tree; +- workflow/job checkout revision; +- protected-main integrated head; +- release artifact/source identity. -- the numerical kernel is implemented in Rust; -- CPU parallelism minimizes context switching and GPU acceleration is available behind a deterministic capability boundary; -- true-parameter recovery, bias, coverage, and RMSE are tested on realistic simulations; -- multilevel and multiple-membership structures are modeled to avoid atomistic inference; -- temporal change, repeated measurement, drift, and state evolution are explicit model dimensions; -- numerical reproducibility, precision, seed control, convergence diagnostics, and fallback behavior are documented; -- statistical assumptions and estimands are cited in APA 7 style. +Exact-source verification and merge-tree compatibility answer different questions. Active PR #147 advances issue #132 by making that distinction explicit in required workflows. Until it merges, its implementation is **Implemented on active PR**, not protected-main behavior. -## 5. Automation and merge safety +Pull requests follow a work-conserving loop: inspect current evidence, RCA failures, make the smallest test-first correction, rerun exact evidence, resolve only addressed threads, and merge only the unchanged exact head when live repository policy accepts it. A waiting check/reviewer/provider blocks only that lane. Administrative bypass, fabricated approval/checks and stale/predecessor evidence promotion are invalid. -Pull requests follow one loop: inspect every review and check, fix root causes, rerun the exact head, resolve addressed threads, and merge only after all required evidence passes. Administrative bypasses are prohibited. +## 10. Mathematical and psychometric modules -Scheduled model-assisted automation uses `NVIDIA_NIM_API_KEY`; `COPILOT_GITHUB_TOKEN` is prohibited. Existing dedicated review-agent credentials are not repurposed. Deterministic audit and merge eligibility remain independently enforceable even when a model provider is unavailable. +LifeOS currently contains no psychometric computation service. If future product scope introduces mathematical or psychometric computation, production numerical kernels are Rust-first; CPU/GPU parity, realistic true-parameter recovery, uncertainty/coverage, multilevel/multiple-membership structure, temporal/repeated-measurement semantics, convergence and reproducibility must be established before product claims. This is a future architecture constraint, not a claim that LifeOS currently implements those models. -The pinned OpenCode configuration disables project-local overrides, explicitly reloads reviewed repository instructions, enables only NVIDIA, registers and whitelists one model label independently of the bundled catalog, pins primary and small-model work to it, and checks that effective catalog offline before its credential bridge starts; the bridge exposes no provider-wide discovery route. Model-generated source verification runs without Docker authority. A later trusted operation parses the accepted candidate's explicitly selected Compose file, while credential-free pull-request CI starts digest-pinned images, proves PostgreSQL query execution and NATS JetStream availability, binds published ports to loopback, and tears down unconditionally. +## 11. Documentation hierarchy -## 6. Documentation hierarchy +GitHub must reconstruct current LifeOS without chat history or old PR archaeology. The canonical graph is: -1. `AGENTS.md` — repository-wide agent and merge rules. -2. `ARCHITECTURE.md` — durable architectural decisions and diagrams. -3. `CLAUDE.md` — Claude-compatible operational handoff that defers to `AGENTS.md`. -4. `docs/superpowers/specs/` — approved feature designs. -5. `docs/superpowers/plans/` — implementation sequences. -6. `docs/operations/` — operator runbooks and SLOs. -7. `docs/research/` — standards and research rationale with APA 7 references. -8. `CHANGELOG.md` — user-visible unreleased and released changes. +1. `AGENTS.md` — repository-wide agent/merge rules. +2. `ARCHITECTURE.md` — durable product/service authority and boundaries. +3. `docs/PRD.md` — buyer/user outcomes, requirements and maturity. +4. `docs/TRD.md` — shared technical/security/data/release requirements. +5. `docs/adr/README.md` plus ADRs — durable decisions, alternatives and supersession. +6. `docs/DATA_MODEL.md` — logical service-owned ERD; migrations remain physical truth. +7. `docs/UML.md` — product, authority, state, failure and deployment views. +8. `docs/API_CONTRACTS.md` — repository-level API/event ownership/evolution registry. +9. `SECURITY.md` and `docs/THREAT_MODEL.md` — reporting policy and architectural threats. +10. `docs/PRIVACY_DATA_LIFECYCLE.md` — sensitive-data, credential and rights lifecycle. +11. `docs/TEST_STRATEGY.md` — deterministic/live validation evidence. +12. `docs/OPERABILITY.md` — deployment, diagnostics, backup and recovery boundaries. +13. `docs/RELEASE_AND_MIGRATION.md` — versioning, migration and rollback contract. +14. `docs/STANDARDS_TRACEABILITY.md` — standards/research evidence classes. +15. `docs/TRACEABILITY.md` — requirement/decision -> source/test/issue/PR evidence. +16. `docs/DOCUMENTATION_ASSESSMENT.md` — documentation fitness and historical reconciliation. +17. `CLAUDE.md`, `README.md`, `CHANGELOG.md` and scoped specs/plans/runbooks — discoverability and supporting evidence. -A behavior or boundary change is incomplete until the relevant level is updated and executable tests prove the claim. +Canonical status fields use only `Implemented on protected main`, `Implemented on active PR`, `Partial`, `Accepted architecture`, `Planned`, `Research only`, `Superseded`, or `Out of scope`. File age, file presence and historically resolved review comments do not prove semantic currentness. A material behavior/authority change is documentation-incomplete until the corresponding canonical views and executable documentation contracts reconcile the claim. From 68b55802825735fdcea2e865d3f848026a4620dd Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 09:29:39 +0900 Subject: [PATCH 030/173] test(docs): expose semantic recency gaps --- .../src/documentation-contract.test.mjs | 40 ++++++++++++++++++- 1 file changed, 38 insertions(+), 2 deletions(-) diff --git a/packages/commercial-readiness/src/documentation-contract.test.mjs b/packages/commercial-readiness/src/documentation-contract.test.mjs index a27663582..b2a627e59 100644 --- a/packages/commercial-readiness/src/documentation-contract.test.mjs +++ b/packages/commercial-readiness/src/documentation-contract.test.mjs @@ -130,7 +130,18 @@ test('ADR index targets every material ADR and ADRs satisfy the quality contract const files = readdirSync(join(ROOT, 'docs/adr')) .filter((name) => /^\d{4}-.+\.md$/u.test(name)) .sort(); - const requiredNumbers = new Set(['0001', '0002', '0003', '0004', '0005', '0006', '0007', '0008', '0009']); + const requiredNumbers = new Set([ + '0001', + '0002', + '0003', + '0004', + '0005', + '0006', + '0007', + '0008', + '0009', + '0010', + ]); for (const number of requiredNumbers) { assert.ok(files.some((name) => name.startsWith(`${number}-`)), `missing ADR ${number}`); @@ -177,7 +188,13 @@ test('documentation claims are anchored to current source authority', () => { assert.match(agents, /Internal identifiers are opaque UUIDv4 strings/u); assert.match(dataRights, /UUID_V4_PATTERN/u); assert.match(dataRights, /-4\[0-9a-f\]\{3\}/u); - assert.match(architecture, /never read another service's database tables directly/u); + assert.match(architecture, /never read or mutate another service's database tables directly/u); + assert.match(architecture, /authentication ceremony time/u); + assert.match(architecture, /Durable Today synchronization is protected-main behavior/u); + assert.match(architecture, /signed trusted workspace context/u); + assert.match(architecture, /Privacy service owns purpose-bound sensitive-access decisions/u); + assert.match(architecture, /Notification service owns reminder occurrences/u); + assert.match(architecture, /docs\/PRD\.md/u); assert.match(dataModel, /does not authorize cross-service SQL joins/iu); assert.match(proposals, /requiresConfirmation: true/u); assert.match(proposals, /cannot execute its own operations/u); @@ -197,3 +214,22 @@ test('canonical lifecycle reflects protected-main integrations and remaining gap assert.match(traceability, /#130 plugin runtime delivery/u); assert.match(assessment, /old documentation PR #126 became materially diverged/u); }); + +test('active successor work is represented without promoting it to protected-main truth', () => { + const prd = text('docs/PRD.md'); + const traceability = text('docs/TRACEABILITY.md'); + const contracts = text('docs/API_CONTRACTS.md'); + const uml = text('docs/UML.md'); + const assessment = text('docs/DOCUMENTATION_ASSESSMENT.md'); + + assert.match(prd, /PR #146/u); + assert.match(prd, /PR #147/u); + assert.match(traceability, /PR #146/u); + assert.match(traceability, /PR #147/u); + assert.match(contracts, /PR #146/u); + assert.match(contracts, /PR #147/u); + assert.match(uml, /source head/u); + assert.match(uml, /synthetic merge/u); + assert.match(assessment, /machine-checkable documentation consistency.*Implemented on active PR/isu); + assert.match(assessment, /root Architecture.*Implemented on active PR/isu); +}); From 25db5fc6a87c6b40edbc984f0f99f08f7a690a69 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 09:40:24 +0900 Subject: [PATCH 031/173] docs(adr): separate verification evidence identities --- .../0010-verification-evidence-identity.md | 67 +++++++++++++++++++ 1 file changed, 67 insertions(+) create mode 100644 docs/adr/0010-verification-evidence-identity.md diff --git a/docs/adr/0010-verification-evidence-identity.md b/docs/adr/0010-verification-evidence-identity.md new file mode 100644 index 000000000..addce20d7 --- /dev/null +++ b/docs/adr/0010-verification-evidence-identity.md @@ -0,0 +1,67 @@ +# ADR 0010: Separate verification evidence identities + +**Status:** Accepted architecture + +## Context + +GitHub pull-request workflows can evaluate more than one commit identity. A contributor branch head, the base snapshot recorded when the pull request was created or updated, the current live base-branch tip, GitHub's synthetic merge tree, the commit actually checked out by a workflow job, protected main, and a released artifact answer different questions. Treating one of those identities as a substitute for another can create stale or false verification claims. + +Issue #132 identified this as a repository-governance reliability gap. PR #147 implements the bounded workflow correction as active-PR evidence; it is not protected-main behavior until merged. + +## Decision drivers + +- exact attribution of source-verification evidence; +- explicit integration-compatibility evidence; +- resistance to stale base assumptions; +- auditable merge and release decisions; +- no promotion of queued, predecessor or synthetic-only evidence into exact-head success. + +## Considered alternatives + +1. **Use the pull-request event/base metadata as the current base everywhere.** Rejected because a PR base snapshot can become stale as the protected base branch moves. +2. **Treat the synthetic merge tree as the contributor source head.** Rejected because it proves a different tree and can hide which source revision was directly evaluated. +3. **Run only source-head checks and ignore integration compatibility.** Rejected because a clean source branch can still fail when integrated with the current base. +4. **Track evidence identities separately and require the appropriate identity for each gate.** Selected. + +## Decision + +LifeOS verification and release evidence distinguishes at least: + +- `source_head_sha`: exact contributor/source branch head whose source correctness is being evaluated; +- `pr_base_snapshot_sha`: GitHub's immutable base snapshot associated with the pull-request representation/event; +- `live_base_tip_sha`: independently resolved current tip of the actual base branch immediately before a base-sensitive decision; +- `merge_tree_sha`: synthetic integration tree used for merge-compatibility evidence; +- `workflow_checkout_sha`: commit/tree a specific workflow job actually checked out; +- `protected_main_sha`: exact integrated protected-main revision; +- `release_source_sha`: protected source identity bound to a published release artifact. + +A check is evidence only for the tree it actually inspects. Source correctness checks bind to `source_head_sha`. Merge/integration compatibility may bind to `merge_tree_sha`, but that evidence is labeled separately. Base-sensitive merge decisions independently resolve `live_base_tip_sha`; `pr_base_snapshot_sha` cannot silently substitute for it. + +Required merge/release decisions may consume multiple evidence classes, but they do not collapse them into one generic green status. + +## Consequences + +- Workflow configuration and evidence payloads become more explicit. +- Existing required context names may remain stable while their checked-out revision contract is corrected. +- Operators can determine whether a failure belongs to source correctness, integration compatibility, current-base drift, infrastructure or release packaging. +- A synthetic merge success cannot prove that the exact contributor source head itself was directly checked where exact-head evidence is required. + +## Failure and recovery + +If the source head, live base, or relevant checked-out tree changes after evaluation, the affected evidence is stale and must be reacquired. If an evidence-producing workflow cannot determine which commit it inspected, it fails closed or is classified unavailable rather than being promoted to passing evidence. A failed integration tree blocks integration only; it does not create an invented source-code finding without source-backed evidence. + +## Security and privacy impact + +Explicit evidence identity reduces stale-check and confused-deputy risk in repository governance. Evidence remains credential-free and records opaque commit identities/status classifications rather than secrets or tenant content. It does not grant additional repository, review, merge or release authority. + +## Acceptance evidence + +Acceptance requires deterministic tests that distinguish source-head and synthetic-merge checkout semantics and hosted workflow evidence showing each lane evaluates the intended tree. PR #147 is `Implemented on active PR` for the initial CI/AppGuardrail/source-versus-merge correction while issue #132 remains open until protected-main integration and any remaining required-workflow attribution is reconciled. + +## Migration and rollback + +Adopt the distinction incrementally without renaming existing required check contexts unless repository policy requires it. A rollback must not restore ambiguous claims: if a source/merge separation is removed, affected evidence is explicitly classified unavailable or the older behavior is accompanied by an equivalent proof of exact source identity. No historical check is reinterpreted as evidence for a different commit tree. + +## Supersession + +This ADR remains authoritative until a later accepted decision provides an equal or stronger evidence-identity model and updates workflow contracts, documentation, merge governance and release acceptance together. From 61a658659f1a7a0f5c2376b3203b662154d5f3fd Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 09:40:45 +0900 Subject: [PATCH 032/173] docs(adr): index verification evidence identity --- docs/adr/README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/adr/README.md b/docs/adr/README.md index 973e3efad..67a3aa687 100644 --- a/docs/adr/README.md +++ b/docs/adr/README.md @@ -19,9 +19,10 @@ ADR status uses the same exact canonical documentation values: `Implemented on p | [0007](0007-canonical-documentation-graph.md) | Accepted architecture | One code-current canonical documentation graph with explicit maturity | | [0008](0008-separate-capability-maturity-from-buyer-gap-exhaustion.md) | Accepted architecture | Capability maturity is separate from buyer-gap exhaustion | | [0009](0009-product-hosting-and-data-evolution.md) | Accepted architecture | Server-backed self-hostable modular MSA supersedes browser-only/single-app primary architecture | +| [0010](0010-verification-evidence-identity.md) | Accepted architecture | Contributor source, PR-base snapshot, live base, synthetic merge, workflow checkout, protected-main and release identities remain separate evidence authorities | ## ADR quality contract Material ADRs contain: context; decision drivers; alternatives; decision; consequences; failure/recovery; security/privacy/governance impact; acceptance evidence; migration/rollback; and supersession conditions. -A feature plan is not a substitute for an ADR when authority, identity, persistence, security, deployment, interoperability or release criteria change. \ No newline at end of file +A feature plan is not a substitute for an ADR when authority, identity, persistence, security, deployment, interoperability or release criteria change. From c0eda4be82ba6fbcd4f8cb26b930a8b642ddf5da Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 09:41:16 +0900 Subject: [PATCH 033/173] docs(prd): trace active rights and verification slices --- docs/PRD.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/docs/PRD.md b/docs/PRD.md index 1d7ee5f75..bbb978f9b 100644 --- a/docs/PRD.md +++ b/docs/PRD.md @@ -27,7 +27,7 @@ Canonical requirements use exactly one of: `Implemented on protected main`, `Imp 5. Daily/weekly review based on durable evidence. 6. Calendar synchronization and bounded reminders. 7. Optional AI proposal generation with evidence and explicit accept/reject. -8. Privacy/data-rights export/deletion lifecycle. +8. Privacy/data-rights request, status, export and deletion lifecycle. 9. Backup/recovery and accessible Korean/English PWA operation. 10. Operator deployment, readiness, observability, migration and release evidence. @@ -50,13 +50,14 @@ Canonical requirements use exactly one of: `Implemented on protected main`, `Imp | PRD-PRIV-001 | Sensitive data access is tenant/purpose/lifetime/audit bound rather than blanket-masked. | Implemented on protected main | privacy-service tests | | PRD-PRIV-002 | Data-rights requests preserve recent-auth provenance and durable immutable request/terminal receipts. | Implemented on protected main | PRs #134, #136, #137, #138 and #144 integrated on main | | PRD-PRIV-003 | Complete export/deletion orchestration across every owned domain, delivery lifecycle and reconciliation. | Partial | issue #55 | +| PRD-PRIV-004 | An authenticated user can query one owned data-rights request through a tenant-and-actor scoped, bounded, non-cacheable public status resource without exposing workspace/user IDs, idempotency material or receipt digests. | Implemented on active PR | PR #146; follows protected-main #144 ledger lookup | | PRD-INT-001 | Versioned plugin SDK/validation without direct database authority. | Implemented on protected main | plugin SDK/integration-service tests | | PRD-INT-002 | Plugin installation grants, encrypted secrets, SSRF-safe outbound delivery, retries and revocation. | Planned | issue #130 | | PRD-WEB-001 | Responsive installable PWA with keyboard-operable core flows and Korean/English catalogs. | Implemented on protected main | browser/accessibility/localization tests | | PRD-OPS-001 | Logical PostgreSQL backup/restore with integrity and unsafe-target refusal. | Implemented on protected main | backup scripts/tests/runbook | | PRD-OPS-002 | Provider-neutral production reference deployment and bounded health/readiness/metrics. | Implemented on protected main | infra and observability tests | | PRD-GOV-001 | Capability maturity and buyer-gap exhaustion are reported independently. | Implemented on protected main | buyer-gap registry and issue #21 report | -| PRD-GOV-002 | Required PR verification identifies the commit tree actually checked and does not conflate synthetic merge evidence with exact source-head evidence. | Planned | issue #132 | +| PRD-GOV-002 | Required PR verification identifies the commit tree actually checked and does not conflate exact source-head verification, stale PR-base snapshots, independently resolved live-base state or synthetic-merge compatibility evidence. | Implemented on active PR | PR #147 advances issue #132; ADR 0010 defines the evidence identities | ## Non-functional requirements @@ -66,6 +67,7 @@ Canonical requirements use exactly one of: `Implemented on protected main`, `Imp - Public errors/logs/metrics/artifacts exclude credentials, hidden reasoning and unbounded tenant content. - Core customer journeys require realistic PostgreSQL and browser evidence, not mock-only success. - Product-owned production packages maintain exact coverage gates where configured and beginner-readable public documentation. +- Verification evidence remains bound to the exact commit tree it inspected rather than being promoted across source, merge, base or release identities. ## Non-goals @@ -73,4 +75,4 @@ LifeOS does not claim medical diagnosis/treatment, autonomous consequential empl ## Release outcome -A stable release requires one exact protected integrated head where product journey, tenant/privacy boundaries, required CI/security/review, coverage, packaging, SBOM/provenance, migration/rollback, backup/restore, accessibility/localization, deployment and operational acceptance pass together. \ No newline at end of file +A stable release requires one exact protected integrated head where product journey, tenant/privacy boundaries, required CI/security/review, coverage, packaging, SBOM/provenance, migration/rollback, backup/restore, accessibility/localization, deployment and operational acceptance pass together. From 44174f374d2001723f5cf38d7e98be4303faa0d0 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 09:41:43 +0900 Subject: [PATCH 034/173] docs(traceability): bind active rights and evidence work --- docs/TRACEABILITY.md | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/docs/TRACEABILITY.md b/docs/TRACEABILITY.md index 3abd383df..b996552d4 100644 --- a/docs/TRACEABILITY.md +++ b/docs/TRACEABILITY.md @@ -21,12 +21,13 @@ This index maps product requirements and durable decisions to representative sou | PRD-PRIV-001 purpose-bound sensitive access | Implemented on protected main | privacy-service grants/events/tests | — | | PRD-PRIV-002 data-rights auth/request ledger primitives | Implemented on protected main | PRs #134, #136, #137, #138, #144 | issue #55 for whole journey | | PRD-PRIV-003 complete export/delete orchestration | Partial | identity core exists; full domain/reconciliation/delivery incomplete | issue #55 | +| PRD-PRIV-004 authenticated bounded request-status resource | Implemented on active PR | PR #146 derives tenant/actor from session, uses protected-main ledger lookup, maps bounded HTTP states and hides internal authority/digest fields | issue #55 remains for whole-right completion | | PRD-INT-001 plugin SDK/validation | Implemented on protected main | plugin SDK/integration-service tests | — | | PRD-INT-002 plugin runtime last mile | Planned | validation-only surface is intentionally non-runtime | issue #130 | | PRD-WEB-001 accessible localized PWA | Implemented on protected main | browser/accessibility/localization tests | — | | PRD-OPS-001 backup/restore | Implemented on protected main | backup scripts/tests/runbook | — | | PRD-GOV-001 buyer-gap vs capability maturity separation | Implemented on protected main | repository buyer-gap registry; issue #21 rendering | — | -| PRD-GOV-002 exact source-head verification attribution | Planned | current workflows have mixed evidence classes | issue #132 | +| PRD-GOV-002 exact source/base/merge verification attribution | Implemented on active PR | ADR 0010; PR #147 separates contributor source-head verification from synthetic merge compatibility | issue #132 remains until protected-main integration and residual workflow attribution is reconciled | ## Architecture decisions @@ -38,21 +39,24 @@ This index maps product requirements and durable decisions to representative sou | AI output remains inert proposal evidence | Accepted architecture | AI service tests and architecture | | Sensitive access is purpose/resource/lifetime/audit bound | Accepted architecture | privacy-service tests | | Capability maturity cannot stand in for buyer-gap exhaustion | Accepted architecture | buyer-gap registry/reporting | -| Canonical documentation must distinguish shipped/active/planned/superseded state | Accepted architecture | this documentation line + contract tests on this PR | +| Canonical documentation must distinguish shipped/active/planned/superseded state | Accepted architecture | ADR 0007 and documentation contract tests on PR #145 | +| Verification evidence identities remain separate | Accepted architecture | ADR 0010; PR #147 is active implementation evidence | ## Evidence hierarchy 1. Current protected-main source, migrations, tests and live repository policy. -2. Accepted architecture/ADR decisions. -3. Canonical PRD/TRD/Data Model/UML/Security/Test/Operability docs. -4. Current active PR evidence explicitly labeled as active. +2. Current active PR source/tests, explicitly labeled active and bound to its exact head. +3. Accepted architecture/ADR decisions. +4. Canonical PRD/TRD/Data Model/UML/Security/Test/Operability docs. 5. Issues/plans/research for incomplete work. 6. Historical chat/PR bodies only as rationale. +A contributor source head, PR-base snapshot, independently resolved live base tip, synthetic merge tree, workflow checkout, protected-main head and release source are distinct evidence identities. Evidence is never promoted to another identity just because the status name is green. + ## Buyer gaps from live readiness state -The configured capability set can be fully mature while the product still has accepted buyer gaps. Current canonical open buyer gaps are #55 data portability completion, #129 per-user calendar credentials, and #130 plugin runtime delivery. Issue #132 is a reliability/governance hardening gap for verification identity rather than a buyer capability row. +The configured capability set can be fully mature while the product still has accepted buyer gaps. Current canonical open buyer gaps are #55 data portability completion, #129 per-user calendar credentials, and #130 plugin runtime delivery. PR #146 is a bounded active slice toward #55; it does not close the whole buyer gap. Issue #132 is a reliability/governance hardening gap for verification identity rather than a buyer capability row; PR #147 is its active implementation line. ## Update rule -Whenever a requirement changes maturity, update PRD status, this traceability row, relevant ADR/architecture/data/UML/security/operability views, regression evidence and CHANGELOG. Never label active/unmerged work `Implemented on protected main`. \ No newline at end of file +Whenever a requirement changes maturity, update PRD status, this traceability row, relevant ADR/architecture/data/UML/security/operability views, regression evidence and CHANGELOG. Never label active/unmerged work `Implemented on protected main`. From 938cdaf38cd0e7e15026ebc03316f0c812fd91e1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 09:42:10 +0900 Subject: [PATCH 035/173] docs(api): distinguish active rights and verification contracts --- docs/API_CONTRACTS.md | 32 +++++++++++++++++++++++++++++--- 1 file changed, 29 insertions(+), 3 deletions(-) diff --git a/docs/API_CONTRACTS.md b/docs/API_CONTRACTS.md index 4a5053e4b..86e075442 100644 --- a/docs/API_CONTRACTS.md +++ b/docs/API_CONTRACTS.md @@ -12,6 +12,7 @@ This file indexes stable repository-level API/event invariants. Concrete route s - Public failures are bounded and credential-free. - Provider responses and model output are untrusted until schema/boundary validation. - Cross-service contracts never grant direct database authority. +- Verification evidence is valid only for the exact tree a job inspected; source-head and integration-merge evidence remain separate. ## Contract registry @@ -23,13 +24,34 @@ This file indexes stable repository-level API/event invariants. Concrete route s | Habit recurrence/completion | habit-service | Implemented on protected main | tenant-scoped replay-safe completion | | Review projection | review-service | Implemented on protected main | read/projection authority only | | Calendar sync request | calendar integration | Implemented on protected main | signed trusted workspace context; PR #139 | -| Per-user calendar connection OAuth/credential API | calendar integration | Planned | issue #129 | +| Per-user calendar connection OAuth/credential API | calendar integration | Partial | issue #129; provider adapter exists but hosted encrypted credential lifecycle is incomplete | | Reminder scheduling/delivery | notification-service | Implemented on protected main | bounded claims/retries/outcomes | | AI proposal/evidence/decision | AI proposal service | Implemented on protected main | inert proposal, explicit decision | | Purpose-bound privacy access | privacy-service | Implemented on protected main | actor/resource/purpose/lifetime bound | -| Data-rights request/status | identity-service | Partial | durable receipt and tenant-scoped lookup exist; complete public orchestration under #55 | +| Data-rights durable request ledger/status lookup | identity-service | Implemented on protected main | #138/#144; actor+workspace scoped persistence primitive, immutable bounded receipt evidence | +| Authenticated public data-rights request status resource | identity-service | Implemented on active PR | PR #146; session-derived scope, `GET /v1/data-rights/requests/:requestId`, no-store and bounded 400/401/404/503 semantics | +| Complete cross-domain data export/erasure lifecycle | identity coordinator + domain contributors | Partial | issue #55; contributor/reconciliation/delivery/retention lifecycle remains incomplete | | Plugin manifest/event validation | integration-service | Implemented on protected main | versioned SDK/validation | | Plugin installation/secrets/outbound delivery | integration-service | Planned | issue #130 | +| Exact source-head and merge-tree verification evidence | repository workflows | Implemented on active PR | PR #147 advances issue #132; ADR 0010 defines distinct evidence identities | + +## Data-rights request status resource + +**Status:** Implemented on active PR + +PR #146 adds a bounded authenticated projection over the protected-main request ledger. The route derives workspace and requesting-user scope from the validated server session and never accepts those authority fields from the browser. + +The successful response contains only the public lifecycle projection: schema version, request ID, request kind, lifecycle state, requested instant and optional completion instant. It does not expose workspace/user IDs, idempotency keys, request digests or receipt digests. + +Expected failure semantics are: + +- malformed request identifier: bounded 400; +- invalid/expired session: bounded 401; +- absent or cross-tenant request: indistinguishable bounded 404; +- unexpected persistence/dependency failure: sanitized 503; +- every response path is non-cacheable where the controller contract requires it. + +This bounded status endpoint is not equivalent to complete export/erasure orchestration under issue #55. ## Event envelope @@ -45,4 +67,8 @@ Breaking route/event/schema semantics require explicit versioning or a reviewed ## Evidence identity -Verification tooling distinguishes contributor source head, PR-base snapshot, independently resolved live base, synthetic merge candidate, protected main and release artifact identities. Issue #132 tracks broad required-workflow exact-source attribution. \ No newline at end of file +**Status:** Accepted architecture + +Verification tooling distinguishes `source_head_sha`, `pr_base_snapshot_sha`, independently resolved `live_base_tip_sha`, `merge_tree_sha`, `workflow_checkout_sha`, protected-main identity and release-source identity. A pull-request base snapshot is not silently treated as the current base ref, and a synthetic merge result is not exact contributor-source verification. + +ADR 0010 is the durable decision. PR #147 is `Implemented on active PR` for the current bounded workflow correction while issue #132 remains open until protected-main integration and any residual required-workflow attribution is reconciled. From 813d4c0a9b1be8b5da6813f5a57de1b52a1378fd Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 09:42:48 +0900 Subject: [PATCH 036/173] docs(uml): add rights and verification evidence flows --- docs/UML.md | 135 ++++++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 125 insertions(+), 10 deletions(-) diff --git a/docs/UML.md b/docs/UML.md index c206df07f..2f0fd45aa 100644 --- a/docs/UML.md +++ b/docs/UML.md @@ -2,10 +2,12 @@ **Status:** Implemented on active PR -These diagrams describe current protected-main behavior unless a node is explicitly marked `Partial` or `Planned`. +These diagrams describe current protected-main behavior unless a section is explicitly labeled `Implemented on active PR`, `Partial`, `Planned`, or another canonical status. ## Bounded-context topology +**Status:** Implemented on protected main + ```mermaid flowchart LR U[Web / PWA] --> B[Gateway / BFF] @@ -26,13 +28,18 @@ flowchart LR I --> IDB[(identity-owned PostgreSQL)] P --> PDB[(planning-owned PostgreSQL)] H --> HDB[(habit-owned PostgreSQL)] + R --> RDB[(review-owned PostgreSQL)] N --> NDB[(notification-owned PostgreSQL)] A --> ADB[(AI-owned PostgreSQL)] V --> VDB[(privacy-owned PostgreSQL)] ``` +Physical co-location does not grant cross-service table authority. + ## Login and workspace sequence +**Status:** Implemented on protected main + ```mermaid sequenceDiagram participant Browser @@ -44,13 +51,17 @@ sequenceDiagram Identity->>Provider: authorization request Provider-->>Identity: callback code/state Identity->>Identity: validate provider/state/redirect and map external identity - Identity->>Identity: provision/authorize personal workspace + Identity->>Identity: provision/authorize personal workspace + authentication instant Identity-->>Web: revocable session + opaque account/workspace UUIDv4 Web-->>Browser: secure session cookie ``` +Session rotation does not manufacture a new authentication ceremony. + ## Goal / Project / Task / Today lifecycle +**Status:** Implemented on protected main + ```mermaid stateDiagram-v2 [*] --> LocalDraft @@ -66,6 +77,8 @@ The durable Today aggregate, local-to-workspace migration, replay protection and ## Review flow +**Status:** Implemented on protected main + ```mermaid sequenceDiagram participant User @@ -82,6 +95,8 @@ sequenceDiagram ## Calendar synchronization +**Status:** Implemented on protected main + ```mermaid sequenceDiagram participant Web @@ -101,6 +116,8 @@ Per-user encrypted credential persistence/refresh/revocation and calendar select ## AI proposal / evidence / decision +**Status:** Implemented on protected main + ```mermaid sequenceDiagram participant Browser @@ -120,27 +137,80 @@ sequenceDiagram AI->>Audit: append decision evidence ``` -## Data-rights sequence +## Data-rights durable foundation + +**Status:** Implemented on protected main ```mermaid sequenceDiagram participant User participant Web participant Identity - participant Domains as Registered domain participants + participant Ledger as identity.data_rights_requests User->>Web: export/delete request Web->>Identity: validate session + recent-auth provenance - Identity->>Identity: bind request to workspace/requesting user - Identity->>Identity: persist durable request receipt - Identity->>Domains: bounded export / prepare-delete orchestration - Domains-->>Identity: domain evidence - Identity-->>User: bounded status / result + Identity->>Ledger: persist workspace/user-bound request + Ledger-->>Identity: durable request / replay / conflict + Identity->>Ledger: tenant-and-requesting-actor scoped lookup + Ledger-->>Identity: request state or indistinguishable absence ``` -Recent-auth provenance, ownership binding, durable request/terminal receipt and tenant-scoped status lookup are protected-main behavior. Complete domain participation, durable reconciliation, retention/legal-hold and protected archive delivery remain **Partial** under issue #55. +Recent-auth provenance, ownership binding, durable request/terminal receipt and tenant-scoped status lookup are protected-main behavior through #134/#136/#137/#138/#144. + +## Authenticated data-rights status resource + +**Status:** Implemented on active PR + +**Evidence:** PR #146. + +```mermaid +sequenceDiagram + actor User + participant Web + participant Identity as Identity HTTP boundary + participant Session as Session introspection + participant Ledger as Request ledger + + User->>Identity: GET /v1/data-rights/requests/:requestId + opaque session cookie + Identity->>Session: introspect cookie + Session-->>Identity: userId + workspaceId + Identity->>Ledger: getRequest(requestId, workspaceId, userId) + alt owned request + Ledger-->>Identity: durable request + Identity-->>User: 200 bounded public lifecycle + no-store + else absent or other tenant + Ledger-->>Identity: undefined + Identity-->>User: indistinguishable 404 + no-store + else malformed request ID + Identity-->>User: bounded 400 + no-store + else invalid/expired session + Identity-->>User: bounded 401 + no-store + else dependency/persistence failure + Identity-->>User: sanitized 503 + no-store + end +``` + +The public projection excludes workspace/user IDs, idempotency keys and request/receipt digests. Complete contributor orchestration, reconciliation, retention/legal-hold and protected export delivery remain **Partial** under issue #55. + +## Purpose-bound sensitive-data access + +**Status:** Implemented on protected main + +```mermaid +sequenceDiagram + participant Caller + participant Privacy + participant Audit + Caller->>Privacy: actor + workspace + resource + purpose + lifetime + Privacy->>Privacy: validate policy/scope + Privacy->>Audit: append decision/grant evidence + Privacy-->>Caller: bounded grant/decision or denial +``` ## Backup / restore +**Status:** Implemented on protected main + ```mermaid sequenceDiagram participant Operator @@ -157,6 +227,8 @@ sequenceDiagram ## Deployment topology +**Status:** Implemented on protected main + ```mermaid flowchart TB Ingress[Ingress / TLS] --> Web[Web/BFF] @@ -164,6 +236,7 @@ flowchart TB Services --> IStore[(identity role/schema)] Services --> PStore[(planning role/schema)] Services --> HStore[(habit role/schema)] + Services --> RStore[(review role/schema)] Services --> NStore[(notification role/schema)] Services --> AStore[(AI role/schema)] Services --> VStore[(privacy role/schema)] @@ -173,8 +246,49 @@ flowchart TB The nodes represent separate service-owned database authority even when an operator co-locates them on one PostgreSQL cluster. +## Verification evidence identity + +**Status:** Implemented on active PR + +**Evidence:** ADR 0010 and PR #147. + +The exact **source head** and a GitHub **synthetic merge** tree are different evidence subjects. The PR base snapshot is also distinct from the current live base tip. + +```mermaid +flowchart LR + Source[source_head_sha] --> SourceCheck[Exact source verification] + BaseSnapshot[pr_base_snapshot_sha] --> PRMetadata[Historical PR-base evidence] + LiveBase[live_base_tip_sha] --> MergeDecision[Current base-sensitive decision] + Source --> MergeTree[merge_tree_sha] + LiveBase --> MergeTree + MergeTree --> MergeCheck[Integration compatibility] + SourceCheck --> Gate[Merge/release evidence decision] + MergeCheck --> Gate + MergeDecision --> Gate + Gate --> Main[protected_main_sha] + Main --> Release[release_source_sha] +``` + +```mermaid +sequenceDiagram + participant GitHub + participant SourceJob as source-head job + participant MergeJob as merge-compatibility job + participant Policy as merge policy + + GitHub->>SourceJob: checkout exact contributor source head + SourceJob-->>Policy: source-head evidence + GitHub->>MergeJob: checkout/construct synthetic merge against current base + MergeJob-->>Policy: separately classified compatibility evidence + Policy->>GitHub: re-resolve live base before base-sensitive decision +``` + +No green status is silently transferred across these identities. Issue #132 remains open until the active implementation is integrated and residual required-workflow attribution is reconciled. + ## Degraded modes +**Status:** Accepted architecture + ```mermaid flowchart LR ProviderDown[Identity/calendar/model provider unavailable] --> BoundedFailure[Sanitized dependency-unavailable result] @@ -182,4 +296,5 @@ flowchart LR StaleWrite[Stale revision/precondition] --> Conflict[Explicit conflict] BadContext[Malformed/forged context] --> Deny[Fail closed] ModelDown[Model unavailable] --> Deterministic[Deterministic product gates remain available] + UnknownEvidence[Unknown workflow checkout/evidence identity] --> EvidenceUnavailable[Fail closed / unavailable evidence] ``` From 1db908d65bdd13e876820a67b82b295e940ab44c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 09:43:21 +0900 Subject: [PATCH 037/173] docs(assessment): record semantic recency and active slices --- docs/DOCUMENTATION_ASSESSMENT.md | 95 +++++++++++++++++++++++--------- 1 file changed, 70 insertions(+), 25 deletions(-) diff --git a/docs/DOCUMENTATION_ASSESSMENT.md b/docs/DOCUMENTATION_ASSESSMENT.md index 30c811761..9651dc9bb 100644 --- a/docs/DOCUMENTATION_ASSESSMENT.md +++ b/docs/DOCUMENTATION_ASSESSMENT.md @@ -4,29 +4,37 @@ ## Verdict -Before this successor line, LifeOS had extensive implementation, feature specs and runbooks, but protected main did not contain a complete whole-product PRD/TRD/UML/logical-ERD/traceability graph. The old documentation PR #126 became materially diverged while protected-main product work continued. This branch is the clean current-main successor and must not be considered protected-main documentation until it merges. +The historical LifeOS material is extensive but was not sufficient as one code-current whole-product authority. The project moved through materially different product models: browser-only/login-free local-first, public multi-user server persistence, a single-Docker deployment direction, and finally domain-oriented modular MSA. Protected-main implementation also continued after the first canonical documentation branch diverged. + +PR #145 is the single clean current-main canonical successor. Its scope is **design-sufficient** when its semantic documentation contracts are green because it contains the required product, technical, architecture, ADR, logical ERD, UML, API/event, security/privacy, test, operability, release and traceability families. The repository remains **protected-main documentation insufficient** until this successor passes its own current-head checks/review and merges. Documentation sufficiency is not product or release completion. ## Fitness matrix -| Family | Assessment on this branch | Notes | -| --- | --- | --- | -| PRD | Present-current | Product journey, historical drift, live buyer gaps and protected-main maturity are explicit | -| TRD | Present-current | Bounded contexts, authority, data, HTTP/event, concurrency, AI/security/ops/release requirements | -| Root Architecture | Present-current on protected main | `ARCHITECTURE.md` remains durable implementation boundary and is not replaced by this pack | -| ADR index/detailed decisions | Present-current on this branch | Canonical status-bearing decisions are indexed under `docs/adr/` | -| Logical ERD/Data Model | Present-current | Service ownership and conceptual-vs-persisted status are explicit | -| UML | Present-current | topology, login, Today, review, calendar, AI, privacy, backup, deployment and degraded modes | -| API/event contracts | Present-current | repository-level contract registry and evidence identity | -| Security | Present-current on protected main | root `SECURITY.md`; threat model added here | -| Threat model | Present-current | trust boundaries and live planned/partial threats | -| Privacy/data lifecycle | Present-current | data classes, access model, data-rights/calendar/plugin lifecycle | -| Test strategy | Present-current | realistic DB/browser/security/concurrency and documentation consistency gates | -| Operability | Present-current | deployment/readiness/observability/failure/backup/migration/release boundaries | -| Release/migration/rollback | Present-current | exact integrated release and state-change recovery semantics | -| Standards/research | Present-current | final-vs-draft status and APA 7 references; feature research stays in `docs/research/` | -| Requirements traceability | Present-current | requirement/decision -> source/test/issue evidence | -| README/AGENTS/CLAUDE/CHANGELOG alignment | Partial | root protected-main files are intentionally preserved; this successor must add discoverability links/CHANGELOG without overwriting newer agent/architecture policy | -| Machine-checkable documentation consistency | Planned on this branch | required before Ready/merge | +| Family | Assessment on this branch | Maturity | Notes | +| --- | --- | --- | --- | +| PRD | Present-current | Implemented on active PR | Product journey, historical drift, live gaps, #146 and #147 active slices are explicit | +| TRD | Present-current | Implemented on active PR | Bounded contexts, authority, data, HTTP/event, concurrency, AI/security/ops/release requirements | +| Root Architecture | Present-current on this successor | Implemented on active PR | Semantic recency repair now includes Identity authentication/data-rights authority, durable Today, trusted calendar context, Notification/Privacy ownership, AI/plugin boundaries and the canonical graph; protected main still has the older root document until #145 merges | +| ADR index/detailed decisions | Present-current | Implemented on active PR | ADR 0001-0010, including verification evidence identity, are indexed under `docs/adr/` | +| Logical ERD/Data Model | Present-current | Implemented on active PR | Service ownership and conceptual-vs-persisted status are explicit; migrations remain physical truth | +| UML | Present-current | Implemented on active PR | topology, login, Today, review, calendar, AI, rights/status, verification evidence, backup, deployment and degraded modes | +| API/event contracts | Present-current | Implemented on active PR | Repository contract registry separates protected-main request ledger, active #146 public status, and active #147 verification evidence | +| Security | Present-current on protected main | Implemented on protected main | Root `SECURITY.md` remains vulnerability-reporting authority | +| Threat model | Present-current | Implemented on active PR | Trust boundaries and current partial/planned threats are explicit | +| Privacy/data lifecycle | Present-current | Implemented on active PR | Data classes, purpose-bound access, data-rights/calendar/plugin lifecycle | +| Test strategy | Present-current | Implemented on active PR | Realistic DB/browser/security/concurrency and documentation-evidence policy | +| Operability | Present-current | Implemented on active PR | Deployment/readiness/observability/failure/backup/migration/release boundaries | +| Release/migration/rollback | Present-current | Implemented on active PR | Exact integrated release and state-change recovery semantics | +| Standards/research | Present-current | Implemented on active PR | Final-vs-draft distinction and APA 7 anchors; scoped feature research remains detailed evidence | +| Requirements traceability | Present-current | Implemented on active PR | Requirement/decision -> source/test/issue/PR evidence | +| README/AGENTS/CLAUDE/CHANGELOG alignment | Partial | Partial | Discoverability is improved but protected-main integration has not occurred; root policies must remain semantically reconciled rather than copied by chronology | +| Machine-checkable documentation consistency | Present-current on this successor | Implemented on active PR | `documentation-contract.test.mjs` now checks required files/links, exact status vocabulary, ADR 0010, semantic root-Architecture claims, active PR #146/#147 traceability and source-vs-merge terminology | + +## Why file presence was not enough + +The prior baseline initially treated the existing root `ARCHITECTURE.md` as current because it was already on a newer protected-main commit than an older documentation donor. Semantic comparison showed that was wrong: the root file omitted later protected-main Identity authentication provenance/data-rights authority, durable Today, trusted calendar workspace context, Notification/Privacy persistence ownership and the canonical documentation graph. + +The correction is a repository rule: **semantic evidence outranks file age**. A newer root document can still be stale if protected-main source has outgrown its described authority. ## Historical drift reconciled @@ -35,20 +43,57 @@ Before this successor line, LifeOS had extensive implementation, feature specs a 3. **UUIDv7 proposal -> UUIDv4 protected-main invariant:** current internal IDs are opaque UUIDv4. 4. **Post-MVP labels -> evidence maturity:** capabilities are classified from live code/tests, not old roadmap labels. 5. **Configured capability maturity -> whole-product readiness:** buyer-gap exhaustion is a separate evidence dimension. +6. **Generic green check -> explicit evidence identity:** source head, PR-base snapshot, live base, synthetic merge, workflow checkout, protected main and release source are distinct authorities under ADR 0010. + +## Protected-main evolution reconciled + +Protected main currently includes: + +- durable Today synchronization (#127); +- readiness/buyer-gap accounting and bounded OpenCode hardening; +- authentication-age/recent-auth data-rights prerequisites (#134/#136/#137); +- durable data-rights request/terminal receipt persistence (#138); +- tenant-and-requesting-actor scoped request status lookup (#144); +- signed trusted calendar workspace context (#139). + +The old documentation PR #126 became materially diverged while these changes integrated and has been superseded by this clean current-main successor rather than merging obsolete implementation ancestry. + +## Active implementation that documentation must not promote prematurely -## Current code/document changes that invalidate #126 as a mergeable baseline +### PR #146 — authenticated data-rights request status -Protected main integrated durable Today synchronization (#127), readiness/buyer-gap accounting and OpenCode hardening, authentication-age/recent-auth data-rights prerequisites, durable data-rights request receipts/status lookup (#134/#136/#137/#138/#144), and calendar trusted workspace context (#139) after the old documentation branch diverged. A conflict-heavy merge of its 86-commit history would mix obsolete implementation ancestry with canonical documentation. +**Status:** Implemented on active PR + +The active slice adds a browser-facing authenticated status resource over the protected-main ledger. It derives workspace/requesting-user authority from session introspection, exposes only a bounded lifecycle projection, applies non-cacheable HTTP semantics and maps malformed/auth/absence/dependency states without disclosing cross-tenant existence or internal digest/idempotency material. Whole export/erasure completion remains issue #55. + +### PR #147 — verification evidence identity + +**Status:** Implemented on active PR + +The active slice advances issue #132 by separating exact contributor source-head verification from synthetic merge-tree compatibility and adding the required runtime support for merge compatibility evidence. ADR 0010 records the timeless identity model. The implementation must not be described as protected-main behavior until integration. ## Current product gaps that must remain explicit - **Partial:** complete tenant export/deletion orchestration — #55. - **Partial:** per-user encrypted calendar credential lifecycle — #129. - **Planned:** plugin installation/secrets/outbound delivery — #130. -- **Planned reliability:** exact contributor-head verification attribution across required workflows — #132. +- **Implemented on active PR:** verification evidence identity hardening — PR #147 / issue #132 until integration and residual workflow reconciliation. ## Sufficiency criteria -This documentation line is **design-sufficient** only when all canonical files are discoverable, statuses use the exact vocabulary, ADR links/sections are valid, diagrams are syntactically bounded, key claims match source/migrations and current active PR/issues are accurately classified. +The documentation line is design-sufficient only when: + +- every canonical family is discoverable; +- statuses use the exact vocabulary; +- ADR index/targets and required decision sections are valid; +- Mermaid/code fences are balanced; +- root Architecture and canonical documents match protected-main service ownership and implemented authority; +- active PR behavior is labeled active rather than shipped; +- requirements and buyer gaps map to source/test/issue/PR evidence; +- documentation contracts fail when semantic recency regresses, not merely when a file disappears. + +The repository becomes protected-main documentation sufficient only after PR #145 passes exact-current-head CI/security/review/documentation contracts and merges against a freshly verified live base without regressing current source/policy. + +## Continuation rule -The repository becomes **protected-main documentation sufficient** only after this clean successor passes exact-head CI/security/review/documentation contracts and merges without regressing live code/policy. Documentation sufficiency is not product completion; the maintenance loop must continue implementing #55/#129/#130/#132 and subsequent buyer/operator gaps. \ No newline at end of file +Documentation integration is a governance gate, never product-completion. After documentation work the autonomous maintenance queue immediately returns to non-documentation execution: complete the bounded #146 status resource, integrate #147 when review/policy permit, and continue #55/#129/#130 plus subsequently discovered buyer/security/reliability/operability gaps. From 2ad678801745dc956cd5cd8874f2dd96fc080987 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 09:49:13 +0900 Subject: [PATCH 038/173] docs(trd): reconcile active rights and evidence boundaries --- docs/TRD.md | 44 +++++++++++++++++++++++++++++++++----------- 1 file changed, 33 insertions(+), 11 deletions(-) diff --git a/docs/TRD.md b/docs/TRD.md index a1b2627ef..4e40c3ade 100644 --- a/docs/TRD.md +++ b/docs/TRD.md @@ -14,7 +14,7 @@ LifeOS is a TypeScript-first monorepo with a Next.js PWA/BFF, independently boun - **Web/PWA:** interaction state and explicitly local drafts/cache; never direct DB authority. - **Gateway/BFF:** public composition and authenticated context derivation; not a shared domain store. -- **Identity:** internal users, external identity mappings, sessions, workspace membership/authorization context and data-rights request ownership. +- **Identity:** internal users, external identity mappings, sessions, workspace membership/authorization context, authentication provenance and data-rights request/receipt authority. - **Planning:** Goals, Projects, Tasks, durable Today aggregate and search. - **Habit:** recurrence definitions and completion evidence. - **Review:** review snapshots/projections; no direct planning mutation. @@ -32,11 +32,13 @@ LifeOS is a TypeScript-first monorepo with a Next.js PWA/BFF, independently boun 4. Persist instants in UTC and IANA timezone/local-calendar values where civil-time semantics matter. 5. Immutable audit/decision/completion/receipt evidence rejects mutation; mutable state uses explicit revision/digest/ETag/idempotency/fencing where loss or replay is plausible. 6. Browser-local state is not durable until the owning service accepts it. +7. Logical cross-service references do not create physical foreign-key or SQL authority across service-owned schemas. ## Authentication and authorization - OAuth/OIDC callbacks validate state, provider and redirect boundaries. - Browser sessions are revocable and server-verifiable. +- Authentication ceremony time is preserved separately from compatible session issuance/rotation time. - Client-selected workspace/actor identifiers are never trusted as authority. - Signed private context binds exact actor/workspace/method/path and bounded issuance time where service separation requires it. - Calendar synchronization uses the trusted signed workspace context implemented on protected main; legacy workspace headers cannot override it. @@ -51,6 +53,23 @@ LifeOS is a TypeScript-first monorepo with a Next.js PWA/BFF, independently boun - Return bounded credential-free problems. - Never expose dependency bodies, tokens, stack traces or internal URLs. - Version breaking shared-contract semantics. +- Sensitive status resources use non-cacheable semantics and omit unrelated tenant/credential/idempotency/digest internals. + +### Data-rights public status + +**Status:** Implemented on active PR + +PR #146 advances issue #55 from the protected-main tenant-and-actor scoped ledger lookup to a browser-facing authenticated resource. The boundary must: + +- derive workspace and requesting-user scope exclusively from validated session introspection; +- combine request ID, session workspace and session user in the ledger query without a widening lookup; +- expose only request ID, request kind, lifecycle status and bounded timestamps; +- reject malformed request IDs before SQL; +- make absent and cross-tenant requests indistinguishable; +- return sanitized bounded dependency failures; +- apply `Cache-Control: no-store` on every response path. + +This endpoint is one lifecycle surface and does not imply complete cross-domain export/erasure orchestration. ## Event requirements @@ -67,7 +86,7 @@ Versioned events carry opaque event ID, explicit type/version, validated actor/w ## AI / automation requirements -Model output is untrusted structured data. Deterministic validators and user/product authorization remain authoritative. Live provider availability is separated from deterministic merge gates. Scheduled autonomous development uses reviewed OpenCode with `NVIDIA_NIM_API_KEY`; `COPILOT_GITHUB_TOKEN` is prohibited. A strong single-route baseline precedes deeper orchestration and evaluation records role, stage, reasoning effort, decomposition, recursion and access topology. +Model output is untrusted structured data. Deterministic validators and user/product authorization remain authoritative. Live provider availability is separated from deterministic merge gates. Scheduled autonomous development uses reviewed OpenCode with `NVIDIA_NIM_API_KEY`; `COPILOT_GITHUB_TOKEN` is prohibited as a development-model credential. A strong single-route baseline precedes deeper orchestration and evaluation records role, stage, reasoning effort, decomposition, recursion and access topology. ## Security/privacy requirements @@ -88,17 +107,20 @@ Services expose bounded health/readiness appropriate to actual dependencies. Met ## Verification model -Required evidence classes are distinct: +**Status:** Accepted architecture + +Required evidence classes are distinct and retain explicit identities: -- exact contributor source-head verification; -- merge-tree/live-base compatibility evidence where intentionally retained; -- protected-main operational evidence; -- formal review evidence; -- security scanner evidence; -- optional model-backed conformance evidence. +- `source_head_sha`: exact contributor/source branch head for direct source verification; +- `pr_base_snapshot_sha`: GitHub PR/event base snapshot, historical once the live base moves; +- `live_base_tip_sha`: independently resolved current base-ref tip for base-sensitive decisions; +- `merge_tree_sha`: synthetic integration tree used only for separately classified compatibility evidence; +- `workflow_checkout_sha`: exact tree inspected by one evidence-producing job; +- `protected_main_sha`: integrated protected-main evidence identity; +- `release_source_sha`: exact protected source bound to release artifacts. -A green result for one class cannot be promoted to another. Issue #132 tracks repository-wide exact-source-head attribution hardening. +A green result for one class cannot be promoted to another. SARIF/security evidence must be uploaded against the commit/ref actually analyzed. PR #147 is `Implemented on active PR` for the current source-head/merge-tree workflow correction and AppGuardrail SARIF attribution; issue #132 remains open until protected-main integration and remaining required-workflow attribution are reconciled. ## Release requirements -Release requires one unchanged integrated protected head with required CI/security/review, exact configured coverage, package/container build, migration/rollback/recovery, accessibility/localization, SBOM/provenance/reproducibility and operational acceptance. A single merged feature or documentation PR is not release readiness. \ No newline at end of file +Release requires one unchanged integrated protected head with required CI/security/review, exact configured coverage, package/container build, migration/rollback/recovery, accessibility/localization, SBOM/provenance/reproducibility and operational acceptance. A single merged feature or documentation PR is not release readiness. From 1cfe7c9e65418bd1c118da5e5ce2bea01b731b11 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:32:47 +0900 Subject: [PATCH 039/173] docs(prd): reconcile protected and active product evidence --- docs/PRD.md | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/docs/PRD.md b/docs/PRD.md index bbb978f9b..ae25c9690 100644 --- a/docs/PRD.md +++ b/docs/PRD.md @@ -43,16 +43,19 @@ Canonical requirements use exactly one of: `Implemented on protected main`, `Imp | PRD-REV-001 | Guided review without becoming planning mutation authority. | Implemented on protected main | review service boundary/tests | | PRD-CAL-001 | Conflict-safe CalDAV/Google calendar synchronization. | Implemented on protected main | calendar adapter tests | | PRD-CAL-002 | Derive calendar workspace authority from signed trusted context, not legacy client headers. | Implemented on protected main | PR #139 merged; trusted-context tests | -| PRD-CAL-003 | Per-user encrypted Google Calendar credential lifecycle, refresh/revocation and calendar selection. | Partial | issue #129 | +| PRD-CAL-003 | Complete per-user encrypted Google/CalDAV credential lifecycle, OAuth/PKCE, refresh/revocation, discovery and calendar selection. | Partial | issue #129 | +| PRD-CAL-004 | Persist a LifeOS-owned calendar-connection foundation scoped to workspace and user, with bounded provider metadata, normalized scopes and opaque secret handles rather than plaintext provider tokens. | Implemented on active PR | PR #150; migration and repository tests; does not complete #129 | | PRD-NOT-001 | Timezone-correct bounded reminders with replay-safe delivery. | Implemented on protected main | notification persistence/scheduler tests | | PRD-AI-001 | AI output is inert proposal evidence until explicit authorized decision. | Implemented on protected main | AI proposal/audit tests | | PRD-AI-002 | Deterministic proposal-quality/safety gates remain independent of live provider availability. | Implemented on protected main | evaluator/live-conformance split | | PRD-PRIV-001 | Sensitive data access is tenant/purpose/lifetime/audit bound rather than blanket-masked. | Implemented on protected main | privacy-service tests | | PRD-PRIV-002 | Data-rights requests preserve recent-auth provenance and durable immutable request/terminal receipts. | Implemented on protected main | PRs #134, #136, #137, #138 and #144 integrated on main | -| PRD-PRIV-003 | Complete export/deletion orchestration across every owned domain, delivery lifecycle and reconciliation. | Partial | issue #55 | -| PRD-PRIV-004 | An authenticated user can query one owned data-rights request through a tenant-and-actor scoped, bounded, non-cacheable public status resource without exposing workspace/user IDs, idempotency material or receipt digests. | Implemented on active PR | PR #146; follows protected-main #144 ledger lookup | +| PRD-PRIV-003 | Complete export/deletion orchestration across every owned domain, protected delivery lifecycle, retention/legal-hold handling and reconciliation. | Partial | issue #55 | +| PRD-PRIV-004 | An authenticated user can query one owned data-rights request through a tenant-and-actor scoped, bounded, non-cacheable public status resource without exposing workspace/user IDs, idempotency material or receipt digests. | Implemented on protected main | PR #146 merged; session-derived scope and bounded 400/401/404/503 behavior | +| PRD-PRIV-005 | Tenant-export sections carry contributor-defined safe record counts and deterministic per-section SHA-256 integrity evidence, with locale-independent property ordering and a whole-export digest. | Implemented on protected main | PR #149 merged; integrity regression and RFC 8785/FIPS 180-4 doctoring | | PRD-INT-001 | Versioned plugin SDK/validation without direct database authority. | Implemented on protected main | plugin SDK/integration-service tests | -| PRD-INT-002 | Plugin installation grants, encrypted secrets, SSRF-safe outbound delivery, retries and revocation. | Planned | issue #130 | +| PRD-INT-002 | Complete plugin runtime installation, encrypted secret storage, SSRF-safe outbound delivery, retries/dead-letter behavior and revocation. | Planned | issue #130 | +| PRD-INT-003 | Treat a validated manifest as untrusted intent and grant only explicit tenant-scoped installation capabilities with exact replay/conflict/revocation semantics. | Implemented on active PR | PR #151; application authority only, not durable secret/delivery runtime | | PRD-WEB-001 | Responsive installable PWA with keyboard-operable core flows and Korean/English catalogs. | Implemented on protected main | browser/accessibility/localization tests | | PRD-OPS-001 | Logical PostgreSQL backup/restore with integrity and unsafe-target refusal. | Implemented on protected main | backup scripts/tests/runbook | | PRD-OPS-002 | Provider-neutral production reference deployment and bounded health/readiness/metrics. | Implemented on protected main | infra and observability tests | @@ -65,6 +68,7 @@ Canonical requirements use exactly one of: `Implemented on protected main`, `Imp - Parameterize dynamic SQL and keep service-owned database authority explicit. - Use idempotency and version/precondition controls wherever replay or stale overwrite can cause loss. - Public errors/logs/metrics/artifacts exclude credentials, hidden reasoning and unbounded tenant content. +- Integrity digests are evidence, not authorization, confidentiality, provenance or digital signatures. - Core customer journeys require realistic PostgreSQL and browser evidence, not mock-only success. - Product-owned production packages maintain exact coverage gates where configured and beginner-readable public documentation. - Verification evidence remains bound to the exact commit tree it inspected rather than being promoted across source, merge, base or release identities. From a6f20c1f345259ca044ffdcf87849623aa202a03 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:33:51 +0900 Subject: [PATCH 040/173] docs(traceability): reconcile current protected and active evidence --- docs/TRACEABILITY.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/docs/TRACEABILITY.md b/docs/TRACEABILITY.md index b996552d4..48e92374b 100644 --- a/docs/TRACEABILITY.md +++ b/docs/TRACEABILITY.md @@ -14,16 +14,19 @@ This index maps product requirements and durable decisions to representative sou | PRD-REV-001 review projection boundary | Implemented on protected main | review service tests | — | | PRD-CAL-001 conflict-safe calendar sync | Implemented on protected main | CalDAV/Google adapter tests | — | | PRD-CAL-002 trusted calendar workspace context | Implemented on protected main | PR #139; signed context verifier/controller regressions | — | -| PRD-CAL-003 per-user hosted calendar credentials | Partial | development/provider adapters exist | issue #129 | +| PRD-CAL-003 complete hosted per-user calendar credentials | Partial | provider adapters and trusted workspace context exist | issue #129 | +| PRD-CAL-004 tenant+user calendar connection registry foundation | Implemented on active PR | PR #150; service-owned migration/repository with opaque credential references | issue #129 remains for complete lifecycle | | PRD-NOT-001 bounded reminders | Implemented on protected main | notification scheduler/persistence tests | — | | PRD-AI-001 inert auditable proposals | Implemented on protected main | AI proposal/audit service tests | — | | PRD-AI-002 deterministic/live-provider separation | Implemented on protected main | proposal evaluator + NIM conformance workflow | — | | PRD-PRIV-001 purpose-bound sensitive access | Implemented on protected main | privacy-service grants/events/tests | — | | PRD-PRIV-002 data-rights auth/request ledger primitives | Implemented on protected main | PRs #134, #136, #137, #138, #144 | issue #55 for whole journey | | PRD-PRIV-003 complete export/delete orchestration | Partial | identity core exists; full domain/reconciliation/delivery incomplete | issue #55 | -| PRD-PRIV-004 authenticated bounded request-status resource | Implemented on active PR | PR #146 derives tenant/actor from session, uses protected-main ledger lookup, maps bounded HTTP states and hides internal authority/digest fields | issue #55 remains for whole-right completion | +| PRD-PRIV-004 authenticated bounded request-status resource | Implemented on protected main | PR #146; session-derived tenant/actor scope, bounded public projection and non-cacheable responses | issue #55 remains for whole-right completion | +| PRD-PRIV-005 per-section export integrity evidence | Implemented on protected main | PR #149; safe record counts, deterministic section SHA-256 and whole-export digest | issue #55 remains for delivery/reconciliation completion | | PRD-INT-001 plugin SDK/validation | Implemented on protected main | plugin SDK/integration-service tests | — | -| PRD-INT-002 plugin runtime last mile | Planned | validation-only surface is intentionally non-runtime | issue #130 | +| PRD-INT-002 complete plugin secret/delivery runtime | Planned | validation-only surface is intentionally non-runtime | issue #130 | +| PRD-INT-003 explicit tenant-scoped plugin installation grants | Implemented on active PR | PR #151; bounded application authority, replay/conflict/revocation semantics | issue #130 remains for durable secret/delivery runtime | | PRD-WEB-001 accessible localized PWA | Implemented on protected main | browser/accessibility/localization tests | — | | PRD-OPS-001 backup/restore | Implemented on protected main | backup scripts/tests/runbook | — | | PRD-GOV-001 buyer-gap vs capability maturity separation | Implemented on protected main | repository buyer-gap registry; issue #21 rendering | — | @@ -55,7 +58,7 @@ A contributor source head, PR-base snapshot, independently resolved live base ti ## Buyer gaps from live readiness state -The configured capability set can be fully mature while the product still has accepted buyer gaps. Current canonical open buyer gaps are #55 data portability completion, #129 per-user calendar credentials, and #130 plugin runtime delivery. PR #146 is a bounded active slice toward #55; it does not close the whole buyer gap. Issue #132 is a reliability/governance hardening gap for verification identity rather than a buyer capability row; PR #147 is its active implementation line. +The configured capability set can be fully mature while the product still has accepted buyer gaps. Current canonical open buyer gaps are #55 data portability completion, #129 per-user calendar credentials, and #130 plugin runtime delivery. Protected-main #146 and #149 materially advance #55 without closing it. Active PR #150 advances #129 and active PR #151 advances #130 without promoting either whole gap to shipped completion. Issue #132 is a reliability/governance hardening gap; PR #147 is its active implementation line. ## Update rule From f8f656ece9aea2c6ea4ac344261b97263fcb3b80 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:34:21 +0900 Subject: [PATCH 041/173] docs(api): reconcile rights, calendar, and plugin contract maturity --- docs/API_CONTRACTS.md | 35 +++++++++++++++++++++++++++++++---- 1 file changed, 31 insertions(+), 4 deletions(-) diff --git a/docs/API_CONTRACTS.md b/docs/API_CONTRACTS.md index 86e075442..ffc25c1e7 100644 --- a/docs/API_CONTRACTS.md +++ b/docs/API_CONTRACTS.md @@ -24,20 +24,23 @@ This file indexes stable repository-level API/event invariants. Concrete route s | Habit recurrence/completion | habit-service | Implemented on protected main | tenant-scoped replay-safe completion | | Review projection | review-service | Implemented on protected main | read/projection authority only | | Calendar sync request | calendar integration | Implemented on protected main | signed trusted workspace context; PR #139 | -| Per-user calendar connection OAuth/credential API | calendar integration | Partial | issue #129; provider adapter exists but hosted encrypted credential lifecycle is incomplete | +| Calendar connection registry foundation | calendar integration | Implemented on active PR | PR #150; workspace+user scoped provider metadata and opaque credential references | +| Complete per-user calendar credential lifecycle | calendar integration | Partial | issue #129; OAuth/PKCE, concrete secret backend, refresh/revocation, discovery/selection remain incomplete | | Reminder scheduling/delivery | notification-service | Implemented on protected main | bounded claims/retries/outcomes | | AI proposal/evidence/decision | AI proposal service | Implemented on protected main | inert proposal, explicit decision | | Purpose-bound privacy access | privacy-service | Implemented on protected main | actor/resource/purpose/lifetime bound | | Data-rights durable request ledger/status lookup | identity-service | Implemented on protected main | #138/#144; actor+workspace scoped persistence primitive, immutable bounded receipt evidence | -| Authenticated public data-rights request status resource | identity-service | Implemented on active PR | PR #146; session-derived scope, `GET /v1/data-rights/requests/:requestId`, no-store and bounded 400/401/404/503 semantics | +| Authenticated public data-rights request status resource | identity-service | Implemented on protected main | PR #146; session-derived scope, `GET /v1/data-rights/requests/:requestId`, no-store and bounded 400/401/404/503 semantics | +| Tenant export integrity manifest | identity coordinator + domain contributors | Implemented on protected main | PR #149; safe per-section record counts, deterministic section SHA-256 and whole-export digest | | Complete cross-domain data export/erasure lifecycle | identity coordinator + domain contributors | Partial | issue #55; contributor/reconciliation/delivery/retention lifecycle remains incomplete | | Plugin manifest/event validation | integration-service | Implemented on protected main | versioned SDK/validation | -| Plugin installation/secrets/outbound delivery | integration-service | Planned | issue #130 | +| Explicit plugin installation grant authority | integration-service | Implemented on active PR | PR #151; exact manifest identity, explicit capability subset, replay/conflict/revocation semantics | +| Complete plugin secret/outbound delivery runtime | integration-service | Planned | issue #130; durable secret handling and delivery remain separate work | | Exact source-head and merge-tree verification evidence | repository workflows | Implemented on active PR | PR #147 advances issue #132; ADR 0010 defines distinct evidence identities | ## Data-rights request status resource -**Status:** Implemented on active PR +**Status:** Implemented on protected main PR #146 adds a bounded authenticated projection over the protected-main request ledger. The route derives workspace and requesting-user scope from the validated server session and never accepts those authority fields from the browser. @@ -53,6 +56,30 @@ Expected failure semantics are: This bounded status endpoint is not equivalent to complete export/erasure orchestration under issue #55. +## Tenant export integrity evidence + +**Status:** Implemented on protected main + +PR #149 requires each contributor export section to include a versioned schema and a safe non-negative business record count. LifeOS binds contributor identity, schema version, record count and bounded normalized JSON data into a deterministic SHA-256 section digest and retains a whole-export digest over the ordered manifest. + +Property ordering for integrity serialization is locale-independent and uses UTF-16 code-unit ordering. The repository cites RFC 8785 for the ordering rationale but does not claim complete JSON Canonicalization Scheme conformance. Digest evidence does not replace access control, confidentiality, provenance or digital signatures. + +## Calendar connection registry + +**Status:** Implemented on active PR + +PR #150 introduces a service-owned persistence foundation for a calendar connection scoped simultaneously to workspace and user. The active boundary carries bounded provider/account/calendar metadata, normalized scopes and opaque external credential references, uses fixed parameterized SQL, rejects malformed authority before persistence access and treats duplicate stored evidence as corruption. + +This foundation does not by itself implement the complete #129 OAuth/refresh/revocation/discovery/selection lifecycle. + +## Plugin installation authority + +**Status:** Implemented on active PR + +PR #151 treats a validated plugin manifest as intent rather than authority. A LifeOS host explicitly grants a bounded capability subset, binds installation identity to exact plugin/manifest evidence, accepts only exact idempotent replay, rejects conflicting reuse, hides cross-workspace/user installation existence and preserves revocation evidence. + +This application-level authority does not imply durable secret persistence, arbitrary outbound delivery or completion of issue #130. + ## Event envelope When asynchronous events are used, the envelope includes a unique opaque event ID, explicit event type/version, validated workspace/actor where applicable, correlation/causation identifiers, occurrence/publication time, and a bounded immutable payload. Consumers must be idempotent under at-least-once delivery. From 5867e945d834919a5c3234b7d74e434abe468ca2 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:35:03 +0900 Subject: [PATCH 042/173] docs(data): distinguish active calendar and plugin authority --- docs/DATA_MODEL.md | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/docs/DATA_MODEL.md b/docs/DATA_MODEL.md index 246a7a8d7..7e5bfe762 100644 --- a/docs/DATA_MODEL.md +++ b/docs/DATA_MODEL.md @@ -57,7 +57,7 @@ erDiagram - `workspace_membership` - `data_rights_request` and immutable terminal receipt state as defined by current migrations/repositories -Authentication provenance is retained independently from session rotation so recent-auth policy can be enforced correctly. +Authentication provenance is retained independently from session rotation so recent-auth policy can be enforced correctly. Protected-main export logic now binds each contributor section to an explicit business record count and deterministic SHA-256 integrity evidence before the whole-export digest is calculated. ### Planning service — persisted on protected main @@ -95,15 +95,21 @@ Review snapshots/projections are service-owned. They consume planning/habit evid ### Calendar integration -Current protected main includes sync/provider state and trusted signed workspace-context verification. `calendar_connection` as a complete hosted per-user encrypted credential lifecycle remains **conceptual/planned** under issue #129. +Protected main includes sync/provider behavior and trusted signed workspace-context verification. + +PR #150 is **Implemented on active PR** for the first persisted `calendar_connection` foundation. Its migration/repository scope binds one connection to workspace and user, stores bounded provider/account/calendar metadata and normalized scopes, and references external credential material through opaque handles. This active persistence must not be labeled protected-main until merge. + +The complete hosted lifecycle remains **Partial** under issue #129: authorization callback lifecycle, concrete managed secret storage, refresh/revocation, discovery/selection and migration from development provider configuration remain separate work. ### Plugin integration -Manifest/contract validation exists on protected main. `plugin_installation` and `plugin_delivery` are **conceptual/planned** under issue #130; they are not persisted merely because they appear in this logical model. +Manifest/contract validation exists on protected main. PR #151 is **Implemented on active PR** for an application-level `plugin_installation` authority model that grants an explicit capability subset and preserves replay/conflict/revocation evidence. It does not add durable persistence. + +Therefore persisted `plugin_installation`, plugin secret records and `plugin_delivery` attempts remain **Planned** under issue #130 until migrations/repositories and delivery runtime are merged. The logical ERD shows the intended ownership relationship, not physical protected-main tables. ## Data-rights lifecycle -Protected main currently proves recent-authentication provenance, authenticated ownership binding, durable request/terminal receipt persistence and tenant-scoped request lookup. The whole-product export/deletion participant/reconciliation/delivery model remains partial under issue #55. +Protected main proves recent-authentication provenance, authenticated ownership binding, durable request/terminal receipt persistence, tenant-scoped request lookup, an authenticated non-cacheable public status projection through PR #146, and per-section export integrity metadata through PR #149. The whole-product export/deletion participant/reconciliation/protected-delivery model remains partial under issue #55. ## Temporal/provenance fields @@ -111,4 +117,4 @@ Where current migrations define them, records retain creation/update/completion/ ## Cross-service relationships -Every cross-service relationship is resolved through a versioned HTTP/event/saga/plugin contract. No foreign key or shared table is implied across bounded service ownership. \ No newline at end of file +Every cross-service relationship is resolved through a versioned HTTP/event/saga/plugin contract. No foreign key or shared table is implied across bounded service ownership. From 7ee372e3fd6c9947f3ef9915375c52145ca38515 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:35:29 +0900 Subject: [PATCH 043/173] docs(privacy): reconcile protected rights evidence and active credentials --- docs/PRIVACY_DATA_LIFECYCLE.md | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/docs/PRIVACY_DATA_LIFECYCLE.md b/docs/PRIVACY_DATA_LIFECYCLE.md index fe39ace71..e72e76cbb 100644 --- a/docs/PRIVACY_DATA_LIFECYCLE.md +++ b/docs/PRIVACY_DATA_LIFECYCLE.md @@ -15,7 +15,7 @@ LifeOS preserves business utility while limiting sensitive-data access through t - reminder/delivery evidence; - AI proposal/evidence/decision records; - privacy access decisions/grants/events; -- data-rights request/receipt evidence; +- data-rights request/receipt/export-integrity evidence; - operator logs/metrics and release/CI evidence. Provider credentials, browser cookies, raw model prompts/responses and hidden reasoning are protected secret/transient material and do not belong in public artifacts. @@ -41,7 +41,11 @@ Protected main includes: - fail-closed recent-auth policy; - authenticated workspace/requesting-user binding; - durable data-rights request and immutable terminal receipt persistence; -- tenant-scoped request lookup bound simultaneously to request ID, workspace ID and requesting user ID. +- tenant-scoped request lookup bound simultaneously to request ID, workspace ID and requesting user ID; +- an authenticated public status resource from PR #146 that derives scope from the server session, returns a bounded non-cacheable lifecycle projection, and makes absent/cross-tenant requests indistinguishable; +- per-contributor export integrity evidence from PR #149 using safe business record counts, deterministic section SHA-256 and a whole-export digest. + +The PR #149 digest contract is integrity evidence only. It does not prove authorization, confidentiality, provenance or signature identity and does not complete protected export delivery. Tracking: issue #55 remains open for complete domain participation, durable async reconciliation/operator alerts, retention/legal-hold semantics, backup-expiry evidence, protected streamed archive delivery/encryption/expiry and download audit. @@ -49,13 +53,17 @@ Tracking: issue #55 remains open for complete domain participation, durable asyn **Status:** Partial -Protected main verifies signed trusted workspace context for calendar synchronization. Hosted per-user encrypted access/refresh credential storage, refresh/revocation, OAuth/PKCE callback lifecycle and calendar selection remain tracked by issue #129. +Protected main verifies signed trusted workspace context for calendar synchronization. PR #150 is `Implemented on active PR` for the first durable calendar-connection registry scoped simultaneously to workspace and user. The active repository stores bounded provider/account/calendar metadata, normalized scopes and opaque credential references rather than making provider credential content part of the row contract. + +The complete hosted lifecycle still requires authorization callback state/PKCE, a concrete managed secret backend, refresh/revocation, calendar discovery/selection and migration from the development provider configuration under issue #129. -## Plugin credentials +## Plugin credentials and installation authority + +**Status:** Partial -**Status:** Planned +Protected main validates plugin manifests/contracts but grants no generic runtime authority. PR #151 is `Implemented on active PR` for the first host-owned installation authority: the manifest is intent, the host grants an explicit capability subset, replay/conflict is deterministic, cross-tenant/user lookup does not disclose existence, and revocation preserves evidence while ending active authority. -Issue #130 owns plugin installation grants, encrypted secret handles, SSRF-safe outbound delivery, retry/audit and revocation. Existing plugin validation does not imply runtime secret authority. +Durable installation persistence, protected plugin secret storage, SSRF-safe outbound delivery, retry/dead-letter evidence and complete revocation enforcement remain issue #130. An active installation-grant object is therefore not evidence that the complete plugin runtime exists. ## Deletion semantics @@ -65,6 +73,7 @@ No service may claim whole-workspace deletion merely because its own tables were - no browser-selected tenant authority; - no cross-service direct database access; -- no plaintext third-party credential in logs, metrics, public errors, model prompts, CI artifacts or audit rows; +- no provider credential content in logs, metrics, public errors, model prompts, CI artifacts or audit rows; - no raw user content in release/provenance artifacts unless explicitly authorized and bounded; -- no data-rights success claim from a partial or unknown participant state. \ No newline at end of file +- no data-rights success claim from a partial or unknown participant state; +- no integrity digest is treated as an authorization or confidentiality control. From eda4049cc3c377dcbb261e82581064f6e61fc726 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:36:17 +0900 Subject: [PATCH 044/173] docs(architecture): reconcile rights, calendar, and plugin authority --- ARCHITECTURE.md | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 3dc5a061c..20ac67b70 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -53,7 +53,11 @@ Identity service owns LifeOS user identity, external-provider mappings, workspac Google/GitHub OAuth transactions are server-owned and replay-resistant. Session issuance/rotation time and the underlying authentication ceremony time are different facts. Compatible session rotation preserves the original authentication instant so recent-authentication policy cannot be bypassed by refreshing a session. -The identity service also owns durable data-rights request identity and immutable terminal receipt evidence. Protected main includes tenant-and-requesting-actor scoped request lookup; inaccessible cross-tenant status is not disclosed. Complete cross-domain export/erasure orchestration remains **Partial** under issue #55. +The identity service also owns durable data-rights request identity and immutable terminal receipt evidence. Protected main includes tenant-and-requesting-actor scoped request lookup plus the authenticated public status resource merged through PR #146. That resource derives authority from the validated session, exposes only bounded lifecycle fields, is non-cacheable and does not reveal cross-tenant request existence. + +Protected main also includes export-manifest integrity evidence from PR #149. Each contributor provides a safe business record count and LifeOS computes a deterministic SHA-256 over contributor/schema/count/bounded data plus a whole-export digest. This is integrity evidence only; it is not authorization, confidentiality, provenance or a digital signature. + +Complete cross-domain export/erasure orchestration remains **Partial** under issue #55 because contributor completion, durable reconciliation, protected delivery, retention/legal-hold/backup-expiry and terminal whole-product completion are separate requirements. ```mermaid sequenceDiagram @@ -99,7 +103,9 @@ flowchart TB Conflict-safe CalDAV/Google synchronization and signed trusted workspace context are protected-main behavior. The calendar service rejects the legacy model in which an arbitrary client-selected workspace header could become tenant authority. -A process/operator-supplied Google access token remains a bounded development/runtime credential path; the complete hosted per-user encrypted credential lifecycle, OAuth state/PKCE, refresh, revocation, discovery and explicit calendar selection remains **Partial** under issue #129. +PR #150 is **Implemented on active PR** for the first service-owned `calendar_connection` persistence foundation. The connection is scoped simultaneously to workspace and user, carries bounded provider/account/calendar metadata and normalized scopes, and refers to protected provider credential material through opaque handles. Its migration and repository do not become protected-main evidence before merge. + +The complete hosted per-user lifecycle remains **Partial** under issue #129: authorization callback state/PKCE, concrete managed secret storage, refresh/revocation, discovery/selection and migration from the development provider configuration are still separate work. Provider identities/credentials never become LifeOS internal primary keys or general identity credentials. @@ -133,13 +139,15 @@ Deterministic authorization, schema and proposal-quality gates remain authoritat Privacy service owns purpose-bound sensitive-access decisions, bounded grants and audit events. Sensitive access binds actor, workspace, resource/resource class, purpose and lifetime. Blanket masking is not the authorization model. -Identity owns the cross-domain data-rights request/receipt lifecycle; each participating bounded context remains authoritative for its own export/erasure contribution. Whole-product completion requires durable contributor registration, reconciliation, protected delivery/erasure semantics, bounded retry/recovery, retention/legal-hold/backup-expiry handling and an immutable final receipt only after all required contributors confirm completion. +Identity owns the cross-domain data-rights request/receipt lifecycle and export-manifest integrity boundary; each participating bounded context remains authoritative for its own export/erasure contribution. Whole-product completion requires durable contributor registration, reconciliation, protected delivery/erasure semantics, bounded retry/recovery, retention/legal-hold/backup-expiry handling and an immutable final receipt only after all required contributors confirm completion. ## 7. Plugin integration boundary -Protected main owns versioned plugin manifest/event validation and preparation. It does not imply generic installation, durable plaintext secrets, unrestricted outbound delivery, inbound arbitrary commands or direct cross-service database access. +Protected main owns versioned plugin manifest/event validation and preparation. It does not imply generic installation, durable secret persistence, unrestricted outbound delivery, inbound arbitrary commands or direct cross-service database access. + +PR #151 is **Implemented on active PR** for the first host-owned installation authority. A validated manifest remains intent rather than authority: LifeOS explicitly grants a bounded tenant-scoped capability subset, binds exact manifest/plugin evidence, permits exact replay, rejects conflicting reuse, hides cross-tenant/user installation existence and preserves revocation evidence while ending active authority. -Issue #130 owns the planned runtime trust boundary: explicit installation/capability grants, encrypted secret handles, authorized-origin SSRF-safe outbound delivery, bounded retries/audit and immediate revocation. +Issue #130 still owns the incomplete runtime trust boundary: durable installation/secret persistence, protected secret handles, authorized-origin SSRF-safe outbound delivery, bounded retries/dead-letter/audit and complete delivery-time revocation enforcement. An active installation object does not imply those capabilities exist. ## 8. Test-time compute and model-assisted repository development From 04a5ff1c04279f6f89fda159a00704a69243d3db Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:37:01 +0900 Subject: [PATCH 045/173] docs(uml): reconcile current rights, calendar, and plugin flows --- docs/UML.md | 148 +++++++++++++++++++++++++--------------------------- 1 file changed, 71 insertions(+), 77 deletions(-) diff --git a/docs/UML.md b/docs/UML.md index 2f0fd45aa..7e810a75b 100644 --- a/docs/UML.md +++ b/docs/UML.md @@ -65,7 +65,7 @@ Session rotation does not manufacture a new authentication ceremony. ```mermaid stateDiagram-v2 [*] --> LocalDraft - LocalDraft --> DurableToday: explicit save + If-None-Match/If-Match + LocalDraft --> DurableToday: explicit save + precondition DurableToday --> DurableToday: versioned update DurableToday --> Conflict: stale strong precondition Conflict --> DurableToday: recheck + explicit reconciliation @@ -112,7 +112,32 @@ sequenceDiagram Calendar-->>Web: sanitized sync result ``` -Per-user encrypted credential persistence/refresh/revocation and calendar selection are **Partial** and tracked by issue #129. +## Calendar connection registry foundation + +**Status:** Implemented on active PR + +**Evidence:** PR #150; full hosted credential lifecycle remains `Partial` under issue #129. + +```mermaid +sequenceDiagram + participant Caller + participant Calendar + participant Repo as Calendar connection repository + participant Pg as Calendar-owned PostgreSQL + + Caller->>Calendar: trusted workspace + user + provider/account/calendar metadata + opaque credential references + Calendar->>Calendar: validate UUIDv4 authority, provider and normalized scopes + Calendar->>Repo: create / scoped lookup + Repo->>Pg: fixed parameterized SQL + alt valid unique evidence + Pg-->>Repo: one workspace+user scoped connection record + Repo-->>Calendar: immutable bounded record + else malformed input or duplicate persisted evidence + Repo-->>Calendar: fail closed + end +``` + +The active migration/repository does not itself implement OAuth callback state, managed secret storage, refresh/revocation or discovery/selection. ## AI proposal / evidence / decision @@ -137,60 +162,50 @@ sequenceDiagram AI->>Audit: append decision evidence ``` -## Data-rights durable foundation +## Data-rights request and status lifecycle **Status:** Implemented on protected main -```mermaid -sequenceDiagram - participant User - participant Web - participant Identity - participant Ledger as identity.data_rights_requests - User->>Web: export/delete request - Web->>Identity: validate session + recent-auth provenance - Identity->>Ledger: persist workspace/user-bound request - Ledger-->>Identity: durable request / replay / conflict - Identity->>Ledger: tenant-and-requesting-actor scoped lookup - Ledger-->>Identity: request state or indistinguishable absence -``` - -Recent-auth provenance, ownership binding, durable request/terminal receipt and tenant-scoped status lookup are protected-main behavior through #134/#136/#137/#138/#144. - -## Authenticated data-rights status resource - -**Status:** Implemented on active PR - -**Evidence:** PR #146. - ```mermaid sequenceDiagram actor User - participant Web participant Identity as Identity HTTP boundary participant Session as Session introspection - participant Ledger as Request ledger + participant Ledger as identity.data_rights_requests - User->>Identity: GET /v1/data-rights/requests/:requestId + opaque session cookie - Identity->>Session: introspect cookie + User->>Identity: create or query data-rights request + Identity->>Session: validate session + recent-auth provenance where required Session-->>Identity: userId + workspaceId - Identity->>Ledger: getRequest(requestId, workspaceId, userId) + Identity->>Ledger: tenant+actor scoped request operation alt owned request Ledger-->>Identity: durable request - Identity-->>User: 200 bounded public lifecycle + no-store + Identity-->>User: bounded public lifecycle + no-store else absent or other tenant Ledger-->>Identity: undefined Identity-->>User: indistinguishable 404 + no-store - else malformed request ID - Identity-->>User: bounded 400 + no-store - else invalid/expired session - Identity-->>User: bounded 401 + no-store - else dependency/persistence failure - Identity-->>User: sanitized 503 + no-store + else malformed / unauthenticated / dependency failure + Identity-->>User: bounded 400 / 401 / 503 + no-store end ``` -The public projection excludes workspace/user IDs, idempotency keys and request/receipt digests. Complete contributor orchestration, reconciliation, retention/legal-hold and protected export delivery remain **Partial** under issue #55. +PR #146 is protected-main evidence for the authenticated public status resource. Complete cross-domain export/deletion remains `Partial` under issue #55. + +## Tenant export integrity flow + +**Status:** Implemented on protected main + +**Evidence:** PR #149. + +```mermaid +flowchart LR + C[Domain contributor] --> S[Schema version + safe record count + bounded JSON] + S --> N[Deterministic normalization / UTF-16 key ordering] + N --> D[Section SHA-256] + D --> M[Ordered export manifest] + M --> W[Whole-export SHA-256] +``` + +Integrity digests do not grant access authority, confidentiality, provenance or signature identity. ## Purpose-bound sensitive-data access @@ -207,25 +222,26 @@ sequenceDiagram Privacy-->>Caller: bounded grant/decision or denial ``` -## Backup / restore +## Plugin installation authority -**Status:** Implemented on protected main +**Status:** Implemented on active PR + +**Evidence:** PR #151; full runtime remains incomplete under issue #130. ```mermaid -sequenceDiagram - participant Operator - participant Backup - participant Store - participant Restore - Operator->>Backup: logical backup - Backup->>Backup: produce integrity/checksum evidence - Backup->>Store: write backup artifact - Operator->>Restore: restore into approved target - Restore->>Restore: reject corruption / unsafe non-empty target - Restore-->>Operator: verified restore evidence +stateDiagram-v2 + [*] --> ValidatedManifest + ValidatedManifest --> GrantedInstallation: explicit host capability subset + GrantedInstallation --> GrantedInstallation: exact replay + GrantedInstallation --> Conflict: incompatible installation-id reuse + GrantedInstallation --> Revoked: explicit revocation + Revoked --> [*] + Conflict --> [*] ``` -## Deployment topology +A manifest requests capabilities but does not grant them. This active application authority does not imply durable plugin-secret or outbound-delivery persistence exists. + +## Backup / restore and deployment **Status:** Implemented on protected main @@ -233,18 +249,12 @@ sequenceDiagram flowchart TB Ingress[Ingress / TLS] --> Web[Web/BFF] Web --> Services[Independent LifeOS services] - Services --> IStore[(identity role/schema)] - Services --> PStore[(planning role/schema)] - Services --> HStore[(habit role/schema)] - Services --> RStore[(review role/schema)] - Services --> NStore[(notification role/schema)] - Services --> AStore[(AI role/schema)] - Services --> VStore[(privacy role/schema)] + Services --> Pg[(Service-owned PostgreSQL authority)] Services <--> NATS[(NATS JetStream)] Operator[Operator secret manager / network policy / backups / monitoring] -. configures .-> Services ``` -The nodes represent separate service-owned database authority even when an operator co-locates them on one PostgreSQL cluster. +Logical backup/restore verifies integrity and unsafe-target refusal; it does not claim PITR or managed infrastructure ownership. ## Verification evidence identity @@ -252,8 +262,6 @@ The nodes represent separate service-owned database authority even when an opera **Evidence:** ADR 0010 and PR #147. -The exact **source head** and a GitHub **synthetic merge** tree are different evidence subjects. The PR base snapshot is also distinct from the current live base tip. - ```mermaid flowchart LR Source[source_head_sha] --> SourceCheck[Exact source verification] @@ -269,21 +277,7 @@ flowchart LR Main --> Release[release_source_sha] ``` -```mermaid -sequenceDiagram - participant GitHub - participant SourceJob as source-head job - participant MergeJob as merge-compatibility job - participant Policy as merge policy - - GitHub->>SourceJob: checkout exact contributor source head - SourceJob-->>Policy: source-head evidence - GitHub->>MergeJob: checkout/construct synthetic merge against current base - MergeJob-->>Policy: separately classified compatibility evidence - Policy->>GitHub: re-resolve live base before base-sensitive decision -``` - -No green status is silently transferred across these identities. Issue #132 remains open until the active implementation is integrated and residual required-workflow attribution is reconciled. +No green status is silently transferred across evidence identities. Issue #132 remains open until PR #147 integrates and residual required-workflow attribution is reconciled. ## Degraded modes From b8f245a43cb81083b53610826e3b67f07d35fbe5 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:37:42 +0900 Subject: [PATCH 046/173] docs(assessment): refresh whole-product documentation fitness --- docs/DOCUMENTATION_ASSESSMENT.md | 62 ++++++++++++++++++-------------- 1 file changed, 35 insertions(+), 27 deletions(-) diff --git a/docs/DOCUMENTATION_ASSESSMENT.md b/docs/DOCUMENTATION_ASSESSMENT.md index 9651dc9bb..ac4c81c91 100644 --- a/docs/DOCUMENTATION_ASSESSMENT.md +++ b/docs/DOCUMENTATION_ASSESSMENT.md @@ -6,35 +6,35 @@ The historical LifeOS material is extensive but was not sufficient as one code-current whole-product authority. The project moved through materially different product models: browser-only/login-free local-first, public multi-user server persistence, a single-Docker deployment direction, and finally domain-oriented modular MSA. Protected-main implementation also continued after the first canonical documentation branch diverged. -PR #145 is the single clean current-main canonical successor. Its scope is **design-sufficient** when its semantic documentation contracts are green because it contains the required product, technical, architecture, ADR, logical ERD, UML, API/event, security/privacy, test, operability, release and traceability families. The repository remains **protected-main documentation insufficient** until this successor passes its own current-head checks/review and merges. Documentation sufficiency is not product or release completion. +PR #145 is the single canonical successor. Its documentation family coverage is now **design-sufficient in scope**: PRD, TRD, root Architecture, detailed ADRs, logical ERD/Data Model, UML, API/event contracts, Security, Threat Model, Privacy/Data Lifecycle, Test Strategy, Operability, Release/Migration/Rollback, Standards/Research and Requirements Traceability are present with machine-checkable consistency rules. The repository remains **protected-main documentation insufficient** until this successor is reconciled with the current live base, passes exact-current-head checks/review, and merges. Documentation sufficiency is not product or release completion. ## Fitness matrix | Family | Assessment on this branch | Maturity | Notes | | --- | --- | --- | --- | -| PRD | Present-current | Implemented on active PR | Product journey, historical drift, live gaps, #146 and #147 active slices are explicit | -| TRD | Present-current | Implemented on active PR | Bounded contexts, authority, data, HTTP/event, concurrency, AI/security/ops/release requirements | -| Root Architecture | Present-current on this successor | Implemented on active PR | Semantic recency repair now includes Identity authentication/data-rights authority, durable Today, trusted calendar context, Notification/Privacy ownership, AI/plugin boundaries and the canonical graph; protected main still has the older root document until #145 merges | -| ADR index/detailed decisions | Present-current | Implemented on active PR | ADR 0001-0010, including verification evidence identity, are indexed under `docs/adr/` | -| Logical ERD/Data Model | Present-current | Implemented on active PR | Service ownership and conceptual-vs-persisted status are explicit; migrations remain physical truth | -| UML | Present-current | Implemented on active PR | topology, login, Today, review, calendar, AI, rights/status, verification evidence, backup, deployment and degraded modes | -| API/event contracts | Present-current | Implemented on active PR | Repository contract registry separates protected-main request ledger, active #146 public status, and active #147 verification evidence | +| PRD | Present-current | Implemented on active PR | Product journey, historical drift, protected #146/#149 and active #147/#150/#151 are explicit | +| TRD | Present-current | Implemented on active PR | Shared runtime, service authority, data, HTTP/event, concurrency, AI/security/ops/release requirements | +| Root Architecture | Present-current on this successor | Implemented on active PR | Semantically reconciles Identity rights/integrity, durable Today, trusted calendar context, active calendar registry/plugin authority, Notification/Privacy ownership and canonical graph | +| ADR index/detailed decisions | Present-current | Implemented on active PR | ADR 0001-0010 including verification evidence identity | +| Logical ERD/Data Model | Present-current | Implemented on active PR | Service ownership and conceptual-vs-persisted status are explicit; PR #150 persistence and PR #151 non-persistence are distinguished | +| UML | Present-current | Implemented on active PR | topology, login, Today, review, calendar, AI, rights/status/integrity, plugin authority, verification evidence, backup/deployment and degraded modes | +| API/event contracts | Present-current | Implemented on active PR | Registry separates protected-main #146/#149, active #150/#151/#147 and still-partial parent gaps | | Security | Present-current on protected main | Implemented on protected main | Root `SECURITY.md` remains vulnerability-reporting authority | | Threat model | Present-current | Implemented on active PR | Trust boundaries and current partial/planned threats are explicit | -| Privacy/data lifecycle | Present-current | Implemented on active PR | Data classes, purpose-bound access, data-rights/calendar/plugin lifecycle | +| Privacy/data lifecycle | Present-current | Implemented on active PR | Rights status/integrity plus active calendar/plugin authority are now separated from incomplete full lifecycles | | Test strategy | Present-current | Implemented on active PR | Realistic DB/browser/security/concurrency and documentation-evidence policy | | Operability | Present-current | Implemented on active PR | Deployment/readiness/observability/failure/backup/migration/release boundaries | | Release/migration/rollback | Present-current | Implemented on active PR | Exact integrated release and state-change recovery semantics | | Standards/research | Present-current | Implemented on active PR | Final-vs-draft distinction and APA 7 anchors; scoped feature research remains detailed evidence | -| Requirements traceability | Present-current | Implemented on active PR | Requirement/decision -> source/test/issue/PR evidence | -| README/AGENTS/CLAUDE/CHANGELOG alignment | Partial | Partial | Discoverability is improved but protected-main integration has not occurred; root policies must remain semantically reconciled rather than copied by chronology | -| Machine-checkable documentation consistency | Present-current on this successor | Implemented on active PR | `documentation-contract.test.mjs` now checks required files/links, exact status vocabulary, ADR 0010, semantic root-Architecture claims, active PR #146/#147 traceability and source-vs-merge terminology | +| Requirements traceability | Present-current | Implemented on active PR | Requirement/decision -> protected source or exact active PR -> remaining issue evidence | +| README/AGENTS/CLAUDE/CHANGELOG alignment | Partial | Partial | Canonical discoverability exists on the successor; protected-main integration is still pending and live root policy must be preserved semantically | +| Machine-checkable documentation consistency | Present-current on this successor | Implemented on active PR | Contract tests check required files/links/status vocabulary/ADRs/root semantic claims and current protected-vs-active maturity | ## Why file presence was not enough -The prior baseline initially treated the existing root `ARCHITECTURE.md` as current because it was already on a newer protected-main commit than an older documentation donor. Semantic comparison showed that was wrong: the root file omitted later protected-main Identity authentication provenance/data-rights authority, durable Today, trusted calendar workspace context, Notification/Privacy persistence ownership and the canonical documentation graph. +The prior baseline initially treated an existing root document as current because it was newer than an older documentation donor. Semantic comparison showed that chronology was not a sufficient correctness criterion. Root documentation had to be reconciled with later Identity authentication/data-rights authority, durable Today, trusted calendar workspace context, Notification/Privacy persistence ownership and the canonical documentation graph. -The correction is a repository rule: **semantic evidence outranks file age**. A newer root document can still be stale if protected-main source has outgrown its described authority. +The repository rule is therefore: **semantic evidence outranks file age**. A newer document is stale whenever protected-main source or accepted authority has outgrown the described contract. ## Historical drift reconciled @@ -47,36 +47,44 @@ The correction is a repository rule: **semantic evidence outranks file age**. A ## Protected-main evolution reconciled -Protected main currently includes: +Current protected main includes: - durable Today synchronization (#127); - readiness/buyer-gap accounting and bounded OpenCode hardening; - authentication-age/recent-auth data-rights prerequisites (#134/#136/#137); - durable data-rights request/terminal receipt persistence (#138); -- tenant-and-requesting-actor scoped request status lookup (#144); -- signed trusted calendar workspace context (#139). +- tenant-and-requesting-actor scoped request lookup (#144); +- signed trusted calendar workspace context (#139); +- authenticated non-cacheable public data-rights status resource (#146); +- per-section tenant-export integrity metadata and deterministic SHA-256 evidence (#149). -The old documentation PR #126 became materially diverged while these changes integrated and has been superseded by this clean current-main successor rather than merging obsolete implementation ancestry. +The old documentation PR #126 became materially diverged while protected work integrated and is superseded by the clean successor instead of being merged with obsolete implementation ancestry. ## Active implementation that documentation must not promote prematurely -### PR #146 — authenticated data-rights request status +### PR #147 — verification evidence identity **Status:** Implemented on active PR -The active slice adds a browser-facing authenticated status resource over the protected-main ledger. It derives workspace/requesting-user authority from session introspection, exposes only a bounded lifecycle projection, applies non-cacheable HTTP semantics and maps malformed/auth/absence/dependency states without disclosing cross-tenant existence or internal digest/idempotency material. Whole export/erasure completion remains issue #55. +PR #147 advances issue #132 by separating exact contributor source-head verification from synthetic merge-tree compatibility and making evidence attribution explicit. ADR 0010 records the timeless identity model. It is not protected-main behavior until integration. -### PR #147 — verification evidence identity +### PR #150 — calendar connection registry foundation + +**Status:** Implemented on active PR + +PR #150 adds the first durable calendar-connection migration/repository scoped to workspace and user, with bounded provider/account/calendar metadata, normalized scopes and opaque credential references. It does not complete issue #129's authorization callback, managed-secret, refresh/revocation, discovery/selection or migration lifecycle. + +### PR #151 — plugin installation authority **Status:** Implemented on active PR -The active slice advances issue #132 by separating exact contributor source-head verification from synthetic merge-tree compatibility and adding the required runtime support for merge compatibility evidence. ADR 0010 records the timeless identity model. The implementation must not be described as protected-main behavior until integration. +PR #151 makes plugin installation authority explicit at the application boundary: manifest intent is separated from host-granted capabilities, exact replay is bounded, conflicting reuse fails, cross-tenant/user lookup does not disclose existence and revocation ends active authority. Durable installation/secret persistence and outbound delivery remain issue #130. ## Current product gaps that must remain explicit -- **Partial:** complete tenant export/deletion orchestration — #55. -- **Partial:** per-user encrypted calendar credential lifecycle — #129. -- **Planned:** plugin installation/secrets/outbound delivery — #130. +- **Partial:** complete tenant export/deletion orchestration — #55, despite protected #146/#149 progress. +- **Partial:** complete per-user calendar credential lifecycle — #129, with active #150 foundation. +- **Planned/Partial by slice:** complete plugin secret/outbound delivery runtime — #130, with active #151 authority foundation. - **Implemented on active PR:** verification evidence identity hardening — PR #147 / issue #132 until integration and residual workflow reconciliation. ## Sufficiency criteria @@ -92,8 +100,8 @@ The documentation line is design-sufficient only when: - requirements and buyer gaps map to source/test/issue/PR evidence; - documentation contracts fail when semantic recency regresses, not merely when a file disappears. -The repository becomes protected-main documentation sufficient only after PR #145 passes exact-current-head CI/security/review/documentation contracts and merges against a freshly verified live base without regressing current source/policy. +The repository becomes protected-main documentation sufficient only after PR #145 passes exact-current-head CI/security/review/documentation contracts and integrates against a freshly verified live base without regressing current source/policy. ## Continuation rule -Documentation integration is a governance gate, never product-completion. After documentation work the autonomous maintenance queue immediately returns to non-documentation execution: complete the bounded #146 status resource, integrate #147 when review/policy permit, and continue #55/#129/#130 plus subsequently discovered buyer/security/reliability/operability gaps. +Documentation integration is a governance gate, never product-completion. After documentation work the autonomous maintenance queue immediately returns to non-documentation execution: integrate or repair #147 when policy permits, advance #150 and #151, and continue the remaining #55/#129/#130/#132 work plus subsequently discovered buyer/security/reliability/operability gaps. From d82375ea4a80b63cb8dc3b058de464048c78e685 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:38:50 +0900 Subject: [PATCH 047/173] test(docs): pin current protected and active maturity --- .../src/documentation-contract.test.mjs | 38 ++++++++++++------- 1 file changed, 25 insertions(+), 13 deletions(-) diff --git a/packages/commercial-readiness/src/documentation-contract.test.mjs b/packages/commercial-readiness/src/documentation-contract.test.mjs index b2a627e59..da00ac735 100644 --- a/packages/commercial-readiness/src/documentation-contract.test.mjs +++ b/packages/commercial-readiness/src/documentation-contract.test.mjs @@ -177,7 +177,7 @@ test('canonical Markdown keeps balanced fenced code blocks', () => { } }); -test('documentation claims are anchored to current source authority', () => { +test('documentation claims are anchored to repository authority', () => { const agents = text('AGENTS.md'); const architecture = text('ARCHITECTURE.md'); const dataRights = text('apps/identity-service/src/data-rights.ts'); @@ -204,32 +204,44 @@ test('documentation claims are anchored to current source authority', () => { test('canonical lifecycle reflects protected-main integrations and remaining gaps', () => { const prd = text('docs/PRD.md'); const traceability = text('docs/TRACEABILITY.md'); + const contracts = text('docs/API_CONTRACTS.md'); + const privacy = text('docs/PRIVACY_DATA_LIFECYCLE.md'); const assessment = text('docs/DOCUMENTATION_ASSESSMENT.md'); assert.match(prd, /PR #127 merged as protected main/u); assert.match(prd, /PR #139 merged/u); - assert.match(prd, /PRs #134, #136, #137, #138 and #144 integrated on main/u); + assert.match(prd, /PR #146 merged/u); + assert.match(prd, /PR #149 merged/u); + assert.match(traceability, /PRD-PRIV-004.*Implemented on protected main/u); + assert.match(traceability, /PRD-PRIV-005.*Implemented on protected main/u); + assert.match(contracts, /Tenant export integrity manifest.*Implemented on protected main/u); + assert.match(privacy, /authenticated public status resource from PR #146/u); + assert.match(privacy, /per-contributor export integrity evidence from PR #149/u); assert.match(traceability, /#55 data portability completion/u); assert.match(traceability, /#129 per-user calendar credentials/u); assert.match(traceability, /#130 plugin runtime delivery/u); assert.match(assessment, /old documentation PR #126 became materially diverged/u); }); -test('active successor work is represented without promoting it to protected-main truth', () => { +test('active successor work is represented without promotion to protected-main truth', () => { const prd = text('docs/PRD.md'); const traceability = text('docs/TRACEABILITY.md'); const contracts = text('docs/API_CONTRACTS.md'); + const dataModel = text('docs/DATA_MODEL.md'); const uml = text('docs/UML.md'); const assessment = text('docs/DOCUMENTATION_ASSESSMENT.md'); - assert.match(prd, /PR #146/u); - assert.match(prd, /PR #147/u); - assert.match(traceability, /PR #146/u); - assert.match(traceability, /PR #147/u); - assert.match(contracts, /PR #146/u); - assert.match(contracts, /PR #147/u); - assert.match(uml, /source head/u); - assert.match(uml, /synthetic merge/u); - assert.match(assessment, /machine-checkable documentation consistency.*Implemented on active PR/isu); - assert.match(assessment, /root Architecture.*Implemented on active PR/isu); + for (const pr of ['#147', '#150', '#151']) { + assert.match(prd, new RegExp(`PR ${pr}`, 'u')); + assert.match(traceability, new RegExp(`PR ${pr}`, 'u')); + assert.match(contracts, new RegExp(`PR ${pr}`, 'u')); + assert.match(assessment, new RegExp(`PR ${pr}`, 'u')); + } + assert.match(dataModel, /PR #150 is \*\*Implemented on active PR\*\*/u); + assert.match(dataModel, /PR #151 is \*\*Implemented on active PR\*\*/u); + assert.match(uml, /Calendar connection registry foundation/iu); + assert.match(uml, /Plugin installation authority/iu); + assert.match(uml, /source_head_sha/u); + assert.match(uml, /merge_tree_sha/u); + assert.match(assessment, /protected-main documentation insufficient/iu); }); From dd775cbf53af79c91ae90f0fa47c81abbffab31d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:39:26 +0900 Subject: [PATCH 048/173] docs(trd): reconcile current protected and active boundaries --- docs/TRD.md | 45 +++++++++++++++++++++++++++++---------------- 1 file changed, 29 insertions(+), 16 deletions(-) diff --git a/docs/TRD.md b/docs/TRD.md index 4e40c3ade..e37b99237 100644 --- a/docs/TRD.md +++ b/docs/TRD.md @@ -14,15 +14,15 @@ LifeOS is a TypeScript-first monorepo with a Next.js PWA/BFF, independently boun - **Web/PWA:** interaction state and explicitly local drafts/cache; never direct DB authority. - **Gateway/BFF:** public composition and authenticated context derivation; not a shared domain store. -- **Identity:** internal users, external identity mappings, sessions, workspace membership/authorization context, authentication provenance and data-rights request/receipt authority. +- **Identity:** internal users, external identity mappings, sessions, workspace membership/authorization context, authentication provenance, data-rights request/receipt authority and export-integrity composition. - **Planning:** Goals, Projects, Tasks, durable Today aggregate and search. - **Habit:** recurrence definitions and completion evidence. - **Review:** review snapshots/projections; no direct planning mutation. -- **Calendar integration:** provider adapters, sync state and trusted workspace context. Per-user hosted credential lifecycle remains partial under #129. +- **Calendar integration:** provider adapters, sync state and trusted workspace context. PR #150 is active for the first workspace+user scoped connection persistence foundation; complete hosted credential lifecycle remains partial under #129. - **Notification:** reminder occurrences, claims, outcomes and delivery recovery. - **AI proposal:** proposals, evidence, explicit decisions and deterministic evaluation; no generic planning mutation authority. - **Privacy:** purpose-bound sensitive-access decisions/grants/events. -- **Plugin integration:** versioned plugin contracts and validation; installation/secrets/outbound delivery remain planned under #130. +- **Plugin integration:** versioned plugin contracts and validation. PR #151 is active for explicit installation-grant authority; complete durable secret/delivery runtime remains under #130. ## Data requirements @@ -33,6 +33,7 @@ LifeOS is a TypeScript-first monorepo with a Next.js PWA/BFF, independently boun 5. Immutable audit/decision/completion/receipt evidence rejects mutation; mutable state uses explicit revision/digest/ETag/idempotency/fencing where loss or replay is plausible. 6. Browser-local state is not durable until the owning service accepts it. 7. Logical cross-service references do not create physical foreign-key or SQL authority across service-owned schemas. +8. External provider credentials remain behind least-authority secret boundaries and are not reused as identity or primary-key material. ## Authentication and authorization @@ -43,6 +44,7 @@ LifeOS is a TypeScript-first monorepo with a Next.js PWA/BFF, independently boun - Signed private context binds exact actor/workspace/method/path and bounded issuance time where service separation requires it. - Calendar synchronization uses the trusted signed workspace context implemented on protected main; legacy workspace headers cannot override it. - Sensitive operations add purpose/resource/tenant authorization and, for data rights, recent-authentication policy derived from authentication provenance rather than session rotation. +- Plugin capabilities are host-granted authority; a manifest expresses requested intent only. ## HTTP/API requirements @@ -51,25 +53,35 @@ LifeOS is a TypeScript-first monorepo with a Next.js PWA/BFF, independently boun - Use replay protection for repeatable mutations. - Use explicit stale-write preconditions where silent overwrite is unacceptable. - Return bounded credential-free problems. -- Never expose dependency bodies, tokens, stack traces or internal URLs. +- Never expose dependency bodies, credentials, stack traces or internal URLs. - Version breaking shared-contract semantics. - Sensitive status resources use non-cacheable semantics and omit unrelated tenant/credential/idempotency/digest internals. ### Data-rights public status +**Status:** Implemented on protected main + +PR #146 exposes the protected request ledger through a browser-facing authenticated resource. The boundary derives workspace and requesting-user scope from validated session introspection, combines request/workspace/user scope without a widening lookup, exposes only bounded public lifecycle fields, makes absent and cross-tenant requests indistinguishable, maps malformed/auth/dependency cases to bounded failures, and applies `Cache-Control: no-store`. + +This endpoint is one lifecycle surface and does not imply complete cross-domain export/erasure orchestration. + +### Data-rights export integrity + +**Status:** Implemented on protected main + +PR #149 requires each contributor export section to provide a versioned schema and safe non-negative business record count. LifeOS normalizes bounded JSON, uses locale-independent UTF-16 property ordering for deterministic hashing, computes a SHA-256 section digest over contributor/schema/count/data, and retains a whole-export digest. Digest evidence is not authorization, confidentiality, provenance or a digital signature. + +### Calendar connection registry + **Status:** Implemented on active PR -PR #146 advances issue #55 from the protected-main tenant-and-actor scoped ledger lookup to a browser-facing authenticated resource. The boundary must: +PR #150 defines a service-owned migration/repository for a connection scoped simultaneously to workspace and user, with bounded provider/account/calendar metadata, normalized scopes, opaque external credential references, fixed parameterized SQL and fail-closed duplicate persisted evidence. It does not complete issue #129. -- derive workspace and requesting-user scope exclusively from validated session introspection; -- combine request ID, session workspace and session user in the ledger query without a widening lookup; -- expose only request ID, request kind, lifecycle status and bounded timestamps; -- reject malformed request IDs before SQL; -- make absent and cross-tenant requests indistinguishable; -- return sanitized bounded dependency failures; -- apply `Cache-Control: no-store` on every response path. +### Plugin installation authority -This endpoint is one lifecycle surface and does not imply complete cross-domain export/erasure orchestration. +**Status:** Implemented on active PR + +PR #151 separates validated manifest intent from host authority. LifeOS grants only an explicit bounded capability subset, accepts exact replay, rejects conflicting installation-ID reuse, hides cross-tenant/user existence and preserves revocation evidence. It does not imply complete persistent secret or outbound-delivery runtime under #130. ## Event requirements @@ -80,9 +92,10 @@ Versioned events carry opaque event ID, explicit type/version, validated actor/w - **Today:** protected-main aggregate uses explicit strong create/update preconditions, idempotency and stale-conflict handling with durable PostgreSQL concurrency evidence. - **Habit completion:** tenant-scoped replay-safe persistence. - **Notification:** expiring/fenced claims and duplicate-delivery refusal. -- **Calendar:** deterministic provider identity/preconditions and trusted context. +- **Calendar:** deterministic provider identity/preconditions and trusted context; active #150 adds tenant+user+connection scoped repository invariants. - **AI decisions:** bind decision to exact proposal digest/revision, actor/workspace and idempotency identity. - **Data rights:** durable request identity and immutable terminal receipts; status lookup is scoped simultaneously by request, workspace and requesting user and fails closed on corruption. +- **Plugin installation:** active #151 requires exact replay/conflict/revocation semantics for host-granted authority. ## AI / automation requirements @@ -109,7 +122,7 @@ Services expose bounded health/readiness appropriate to actual dependencies. Met **Status:** Accepted architecture -Required evidence classes are distinct and retain explicit identities: +Required evidence classes retain explicit identities: - `source_head_sha`: exact contributor/source branch head for direct source verification; - `pr_base_snapshot_sha`: GitHub PR/event base snapshot, historical once the live base moves; @@ -119,7 +132,7 @@ Required evidence classes are distinct and retain explicit identities: - `protected_main_sha`: integrated protected-main evidence identity; - `release_source_sha`: exact protected source bound to release artifacts. -A green result for one class cannot be promoted to another. SARIF/security evidence must be uploaded against the commit/ref actually analyzed. PR #147 is `Implemented on active PR` for the current source-head/merge-tree workflow correction and AppGuardrail SARIF attribution; issue #132 remains open until protected-main integration and remaining required-workflow attribution are reconciled. +A green result for one class cannot be promoted to another. SARIF/security evidence must be attributed to the commit/ref actually analyzed. PR #147 is `Implemented on active PR` for the current source-head/merge-tree correction; issue #132 remains open until protected-main integration and residual attribution are reconciled. ## Release requirements From b44d046622af9ea129f0d3620ad44d58cbbb9763 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:41:44 +0900 Subject: [PATCH 049/173] docs(adr): define external integration authority boundary --- ...gration-authority-and-secret-references.md | 68 +++++++++++++++++++ 1 file changed, 68 insertions(+) create mode 100644 docs/adr/0011-external-integration-authority-and-secret-references.md diff --git a/docs/adr/0011-external-integration-authority-and-secret-references.md b/docs/adr/0011-external-integration-authority-and-secret-references.md new file mode 100644 index 000000000..b16d61d69 --- /dev/null +++ b/docs/adr/0011-external-integration-authority-and-secret-references.md @@ -0,0 +1,68 @@ +# ADR 0011: External integration authority and secret references + +**Status:** Accepted architecture +**Date:** 2026-08-10 + +## Context + +LifeOS integrates with external calendar providers and versioned plugins. Both domains need to persist or carry enough metadata to identify an external integration without turning external credentials or requested plugin capabilities into ambient authority. + +Two active implementation lines make the shared boundary concrete: PR #150 introduces a workspace-and-user-scoped calendar connection registry, and PR #151 introduces tenant-scoped plugin installation grants. The parent product gaps #129 and #130 remain incomplete, so this ADR defines the durable authority model without promoting those active implementations to protected-main behavior. + +## Decision drivers + +- least privilege and explicit tenant/user authority; +- separation of identity metadata from secret material; +- no authority escalation from untrusted provider/plugin input; +- revocation and replay safety; +- service-owned persistence and no cross-service table mutation; +- clear active-versus-protected maturity; +- compatibility with future managed secret/KMS adapters and outbound delivery controls. + +## Considered alternatives + +1. **Persist external credential content directly in integration metadata rows.** Rejected because integration metadata and secret lifecycle have different access, rotation, retention and audit requirements. +2. **Treat a plugin manifest's requested capabilities as granted authority.** Rejected because untrusted extension metadata cannot self-authorize host operations. +3. **Reuse provider account identifiers as LifeOS identity or primary keys.** Rejected because external identifiers are mappings, not internal authority. +4. **Use LifeOS-owned opaque integration records plus separate secret references and explicit host-granted capability sets.** Selected. + +## Decision + +1. LifeOS-owned integration records use opaque UUIDv4 identity and are scoped by the authenticated workspace and, where the provider relationship is personal, the owning user. +2. External provider/account/calendar/plugin identifiers remain bounded metadata and never replace LifeOS internal identity. +3. Persistent integration metadata may reference credential material through an opaque secret handle or equivalent least-authority secret-store reference. The metadata record is not a credential store. +4. A plugin manifest expresses requested intent. The host grants an explicit capability subset; requested-but-ungranted capabilities have no authority. +5. Exact replay of an installation/connection command may return the same result only when authority-relevant evidence matches. Conflicting identity reuse fails closed. +6. Revocation prevents future active authority while retaining the bounded evidence needed for audit/reconciliation according to policy. +7. Outbound delivery, provider refresh, managed secret storage, discovery and other runtime capabilities remain separately gated and cannot be inferred from the existence of an integration record. +8. Every owning service keeps its migrations/repository/API authority. Cross-service relationships use versioned contracts rather than direct table access. + +## Consequences + +- Calendar connection metadata and plugin installation authority can evolve independently from managed secret backends. +- Product code needs explicit lookups scoped by tenant and relevant actor rather than identifier-only retrieval. +- A stored integration record is not evidence that the full provider/plugin runtime is production complete. +- Secret-store/KMS and delivery adapters can be replaced without changing internal integration identity if their versioned contracts remain compatible. + +## Failure and recovery + +Malformed authority, unknown/revoked integration identity, capability escalation, incompatible replay and corrupted duplicate persistence fail closed. Secret-store or provider failures do not widen local authority. Recovery requires a newly authorized operation or a bounded operator repair that preserves audit/reconciliation evidence; editing another service's tables is not a recovery mechanism. + +## Security and privacy impact + +The decision reduces standing credential exposure and prevents untrusted integration metadata from becoming self-authorizing. Tenant/user scope, purpose, revocation and least privilege remain explicit. External provider identifiers and secret references are not authentication evidence for unrelated LifeOS domains. + +## Acceptance evidence + +- Protected main: signed trusted calendar workspace context from PR #139 and existing plugin manifest/event validation. +- Active PR #150: calendar connection migration/repository scoped to workspace+user with bounded metadata and opaque secret references. +- Active PR #151: explicit plugin capability grants, replay/conflict handling, tenant/user lookup isolation and revocation semantics. +- Parent gaps #129 and #130 remain incomplete until their full lifecycle/delivery acceptance criteria are satisfied on protected main. + +## Migration and rollback + +New integration persistence should introduce opaque internal IDs and secret references before removing legacy development configuration. Rollback may disable an integration path but must not reintroduce client-selected tenant authority, plaintext credential persistence as a general contract, implicit plugin capability grants or provider-native primary-key authority. + +## Supersession + +A later ADR may replace this model only with an equal-or-stronger separation of internal identity, external metadata, secret material and granted capability authority, plus an explicit migration/rollback path and protected-main acceptance evidence. From 7d2097760897e1e9b84eaca72f43637becd2b51a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:42:08 +0900 Subject: [PATCH 050/173] docs(adr): index external integration authority decision --- docs/adr/README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/adr/README.md b/docs/adr/README.md index 67a3aa687..c83c76e7a 100644 --- a/docs/adr/README.md +++ b/docs/adr/README.md @@ -20,6 +20,7 @@ ADR status uses the same exact canonical documentation values: `Implemented on p | [0008](0008-separate-capability-maturity-from-buyer-gap-exhaustion.md) | Accepted architecture | Capability maturity is separate from buyer-gap exhaustion | | [0009](0009-product-hosting-and-data-evolution.md) | Accepted architecture | Server-backed self-hostable modular MSA supersedes browser-only/single-app primary architecture | | [0010](0010-verification-evidence-identity.md) | Accepted architecture | Contributor source, PR-base snapshot, live base, synthetic merge, workflow checkout, protected-main and release identities remain separate evidence authorities | +| [0011](0011-external-integration-authority-and-secret-references.md) | Accepted architecture | External integration metadata uses LifeOS-owned identity, separate secret references and explicit host-granted capability authority | ## ADR quality contract From 40bf71c4df5ccc0448f0e5afedfac8aab3c6f236 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:42:47 +0900 Subject: [PATCH 051/173] test(docs): require integration authority ADR --- .../src/documentation-contract.test.mjs | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/packages/commercial-readiness/src/documentation-contract.test.mjs b/packages/commercial-readiness/src/documentation-contract.test.mjs index da00ac735..f699c19b1 100644 --- a/packages/commercial-readiness/src/documentation-contract.test.mjs +++ b/packages/commercial-readiness/src/documentation-contract.test.mjs @@ -141,6 +141,7 @@ test('ADR index targets every material ADR and ADRs satisfy the quality contract '0008', '0009', '0010', + '0011', ]); for (const number of requiredNumbers) { @@ -230,6 +231,9 @@ test('active successor work is represented without promotion to protected-main t const dataModel = text('docs/DATA_MODEL.md'); const uml = text('docs/UML.md'); const assessment = text('docs/DOCUMENTATION_ASSESSMENT.md'); + const integrationAuthority = text( + 'docs/adr/0011-external-integration-authority-and-secret-references.md', + ); for (const pr of ['#147', '#150', '#151']) { assert.match(prd, new RegExp(`PR ${pr}`, 'u')); @@ -244,4 +248,6 @@ test('active successor work is represented without promotion to protected-main t assert.match(uml, /source_head_sha/u); assert.match(uml, /merge_tree_sha/u); assert.match(assessment, /protected-main documentation insufficient/iu); + assert.match(integrationAuthority, /manifest expresses requested intent/iu); + assert.match(integrationAuthority, /opaque secret handle/iu); }); From ab3a70dc11c3fa9c3a3457be2eb9a1cf23dcfd85 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:51:42 +0900 Subject: [PATCH 052/173] docs(prd): promote merged calendar registry evidence --- docs/PRD.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/PRD.md b/docs/PRD.md index ae25c9690..f03e686f0 100644 --- a/docs/PRD.md +++ b/docs/PRD.md @@ -44,7 +44,7 @@ Canonical requirements use exactly one of: `Implemented on protected main`, `Imp | PRD-CAL-001 | Conflict-safe CalDAV/Google calendar synchronization. | Implemented on protected main | calendar adapter tests | | PRD-CAL-002 | Derive calendar workspace authority from signed trusted context, not legacy client headers. | Implemented on protected main | PR #139 merged; trusted-context tests | | PRD-CAL-003 | Complete per-user encrypted Google/CalDAV credential lifecycle, OAuth/PKCE, refresh/revocation, discovery and calendar selection. | Partial | issue #129 | -| PRD-CAL-004 | Persist a LifeOS-owned calendar-connection foundation scoped to workspace and user, with bounded provider metadata, normalized scopes and opaque secret handles rather than plaintext provider tokens. | Implemented on active PR | PR #150; migration and repository tests; does not complete #129 | +| PRD-CAL-004 | Persist a LifeOS-owned calendar-connection foundation scoped to workspace and user, with bounded provider metadata, normalized scopes and opaque secret handles rather than plaintext provider tokens. | Implemented on protected main | PR #150 merged as `1623df364925f84920c07c112f1ae96777277d20`; does not complete #129 | | PRD-NOT-001 | Timezone-correct bounded reminders with replay-safe delivery. | Implemented on protected main | notification persistence/scheduler tests | | PRD-AI-001 | AI output is inert proposal evidence until explicit authorized decision. | Implemented on protected main | AI proposal/audit tests | | PRD-AI-002 | Deterministic proposal-quality/safety gates remain independent of live provider availability. | Implemented on protected main | evaluator/live-conformance split | From b8c721c5dc4feb63c5c16b141268f8624477f50a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:52:11 +0900 Subject: [PATCH 053/173] docs(traceability): promote merged calendar registry --- docs/TRACEABILITY.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/docs/TRACEABILITY.md b/docs/TRACEABILITY.md index 48e92374b..82030a18a 100644 --- a/docs/TRACEABILITY.md +++ b/docs/TRACEABILITY.md @@ -14,8 +14,8 @@ This index maps product requirements and durable decisions to representative sou | PRD-REV-001 review projection boundary | Implemented on protected main | review service tests | — | | PRD-CAL-001 conflict-safe calendar sync | Implemented on protected main | CalDAV/Google adapter tests | — | | PRD-CAL-002 trusted calendar workspace context | Implemented on protected main | PR #139; signed context verifier/controller regressions | — | -| PRD-CAL-003 complete hosted per-user calendar credentials | Partial | provider adapters and trusted workspace context exist | issue #129 | -| PRD-CAL-004 tenant+user calendar connection registry foundation | Implemented on active PR | PR #150; service-owned migration/repository with opaque credential references | issue #129 remains for complete lifecycle | +| PRD-CAL-003 complete hosted per-user calendar credentials | Partial | provider adapters, trusted context and protected connection registry exist | issue #129 | +| PRD-CAL-004 tenant+user calendar connection registry foundation | Implemented on protected main | PR #150 merged as `1623df364925f84920c07c112f1ae96777277d20`; service-owned migration/repository with opaque credential references | issue #129 remains for complete lifecycle | | PRD-NOT-001 bounded reminders | Implemented on protected main | notification scheduler/persistence tests | — | | PRD-AI-001 inert auditable proposals | Implemented on protected main | AI proposal/audit service tests | — | | PRD-AI-002 deterministic/live-provider separation | Implemented on protected main | proposal evaluator + NIM conformance workflow | — | @@ -44,6 +44,7 @@ This index maps product requirements and durable decisions to representative sou | Capability maturity cannot stand in for buyer-gap exhaustion | Accepted architecture | buyer-gap registry/reporting | | Canonical documentation must distinguish shipped/active/planned/superseded state | Accepted architecture | ADR 0007 and documentation contract tests on PR #145 | | Verification evidence identities remain separate | Accepted architecture | ADR 0010; PR #147 is active implementation evidence | +| External integration metadata, secret material and granted authority remain separate | Accepted architecture | ADR 0011; protected #150 and active #151 evidence | ## Evidence hierarchy @@ -58,7 +59,7 @@ A contributor source head, PR-base snapshot, independently resolved live base ti ## Buyer gaps from live readiness state -The configured capability set can be fully mature while the product still has accepted buyer gaps. Current canonical open buyer gaps are #55 data portability completion, #129 per-user calendar credentials, and #130 plugin runtime delivery. Protected-main #146 and #149 materially advance #55 without closing it. Active PR #150 advances #129 and active PR #151 advances #130 without promoting either whole gap to shipped completion. Issue #132 is a reliability/governance hardening gap; PR #147 is its active implementation line. +The configured capability set can be fully mature while the product still has accepted buyer gaps. Current canonical open buyer gaps are #55 data portability completion, #129 per-user calendar credentials, and #130 plugin runtime delivery. Protected-main #146 and #149 materially advance #55 without closing it. Protected-main #150 advances #129 without completing its OAuth/secret/refresh/discovery lifecycle. Active PR #151 advances #130 without promoting the whole plugin-runtime gap to shipped completion. Issue #132 is a reliability/governance hardening gap; PR #147 is its active implementation line. ## Update rule From f7d85c8832ee9e91fdb8ff71698d80138876f8d9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:53:57 +0900 Subject: [PATCH 054/173] docs(api): promote calendar registry to protected main --- docs/API_CONTRACTS.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/API_CONTRACTS.md b/docs/API_CONTRACTS.md index ffc25c1e7..1d21fe841 100644 --- a/docs/API_CONTRACTS.md +++ b/docs/API_CONTRACTS.md @@ -24,7 +24,7 @@ This file indexes stable repository-level API/event invariants. Concrete route s | Habit recurrence/completion | habit-service | Implemented on protected main | tenant-scoped replay-safe completion | | Review projection | review-service | Implemented on protected main | read/projection authority only | | Calendar sync request | calendar integration | Implemented on protected main | signed trusted workspace context; PR #139 | -| Calendar connection registry foundation | calendar integration | Implemented on active PR | PR #150; workspace+user scoped provider metadata and opaque credential references | +| Calendar connection registry foundation | calendar integration | Implemented on protected main | PR #150 merged as `1623df364925f84920c07c112f1ae96777277d20`; workspace+user scoped provider metadata and opaque credential references | | Complete per-user calendar credential lifecycle | calendar integration | Partial | issue #129; OAuth/PKCE, concrete secret backend, refresh/revocation, discovery/selection remain incomplete | | Reminder scheduling/delivery | notification-service | Implemented on protected main | bounded claims/retries/outcomes | | AI proposal/evidence/decision | AI proposal service | Implemented on protected main | inert proposal, explicit decision | @@ -66,9 +66,9 @@ Property ordering for integrity serialization is locale-independent and uses UTF ## Calendar connection registry -**Status:** Implemented on active PR +**Status:** Implemented on protected main -PR #150 introduces a service-owned persistence foundation for a calendar connection scoped simultaneously to workspace and user. The active boundary carries bounded provider/account/calendar metadata, normalized scopes and opaque external credential references, uses fixed parameterized SQL, rejects malformed authority before persistence access and treats duplicate stored evidence as corruption. +PR #150 introduced the service-owned persistence foundation for a calendar connection scoped simultaneously to workspace and user. Protected main carries bounded provider/account/calendar metadata, normalized scopes and opaque external credential references, uses fixed parameterized SQL, rejects malformed authority before persistence access, uses descriptive multiword database naming, and treats duplicate stored evidence as corruption. This foundation does not by itself implement the complete #129 OAuth/refresh/revocation/discovery/selection lifecycle. From 0d8090d0122e0fd7524d51580f1b1bf571c92ce7 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:54:21 +0900 Subject: [PATCH 055/173] docs(data): promote calendar connection persistence --- docs/DATA_MODEL.md | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/docs/DATA_MODEL.md b/docs/DATA_MODEL.md index 7e5bfe762..19081d81d 100644 --- a/docs/DATA_MODEL.md +++ b/docs/DATA_MODEL.md @@ -93,11 +93,9 @@ Review snapshots/projections are service-owned. They consume planning/habit evid - bounded grants - append-only privacy/audit events -### Calendar integration +### Calendar integration — connection registry persisted on protected main -Protected main includes sync/provider behavior and trusted signed workspace-context verification. - -PR #150 is **Implemented on active PR** for the first persisted `calendar_connection` foundation. Its migration/repository scope binds one connection to workspace and user, stores bounded provider/account/calendar metadata and normalized scopes, and references external credential material through opaque handles. This active persistence must not be labeled protected-main until merge. +Protected main includes sync/provider behavior, trusted signed workspace-context verification, and after PR #150 the first persisted `calendar_connection` foundation. Migration/repository scope binds one connection to workspace and user, stores bounded provider/account/calendar metadata and normalized scopes, and references external credential material through opaque handles. The durable table uses the service-owned `calendar_integration.calendar_connection_record` namespace rather than a generic one-word schema. The complete hosted lifecycle remains **Partial** under issue #129: authorization callback lifecycle, concrete managed secret storage, refresh/revocation, discovery/selection and migration from development provider configuration remain separate work. From e063fa12fb65beb0b3157696b22b4fed64287347 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:54:44 +0900 Subject: [PATCH 056/173] docs(privacy): promote calendar connection foundation --- docs/PRIVACY_DATA_LIFECYCLE.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/PRIVACY_DATA_LIFECYCLE.md b/docs/PRIVACY_DATA_LIFECYCLE.md index e72e76cbb..a0ec3c52f 100644 --- a/docs/PRIVACY_DATA_LIFECYCLE.md +++ b/docs/PRIVACY_DATA_LIFECYCLE.md @@ -53,9 +53,9 @@ Tracking: issue #55 remains open for complete domain participation, durable asyn **Status:** Partial -Protected main verifies signed trusted workspace context for calendar synchronization. PR #150 is `Implemented on active PR` for the first durable calendar-connection registry scoped simultaneously to workspace and user. The active repository stores bounded provider/account/calendar metadata, normalized scopes and opaque credential references rather than making provider credential content part of the row contract. +Protected main verifies signed trusted workspace context for calendar synchronization and now includes the PR #150 durable calendar-connection registry scoped simultaneously to workspace and user. The protected repository stores bounded provider/account/calendar metadata, normalized scopes and opaque credential references rather than making provider credential plaintext part of the row contract. -The complete hosted lifecycle still requires authorization callback state/PKCE, a concrete managed secret backend, refresh/revocation, calendar discovery/selection and migration from the development provider configuration under issue #129. +That persistence foundation does not complete the hosted credential lifecycle. Authorization callback state/PKCE, a concrete managed secret backend, refresh/revocation, calendar discovery/selection and migration from the development provider configuration remain issue #129. ## Plugin credentials and installation authority From d9b38e3cafb971c3a9c1dfdd5c9e20b0ba9acecb Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:55:40 +0900 Subject: [PATCH 057/173] docs(architecture): promote protected calendar registry --- ARCHITECTURE.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 20ac67b70..6557b6354 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -101,9 +101,9 @@ flowchart TB ## 4. Calendar integration boundary -Conflict-safe CalDAV/Google synchronization and signed trusted workspace context are protected-main behavior. The calendar service rejects the legacy model in which an arbitrary client-selected workspace header could become tenant authority. +Conflict-safe CalDAV/Google synchronization, signed trusted workspace context and the first service-owned `calendar_connection` persistence foundation are protected-main behavior after PR #150. The calendar service rejects the legacy model in which an arbitrary client-selected workspace header could become tenant authority. -PR #150 is **Implemented on active PR** for the first service-owned `calendar_connection` persistence foundation. The connection is scoped simultaneously to workspace and user, carries bounded provider/account/calendar metadata and normalized scopes, and refers to protected provider credential material through opaque handles. Its migration and repository do not become protected-main evidence before merge. +A connection is scoped simultaneously to workspace and user, carries bounded provider/account/calendar metadata and normalized scopes, and refers to protected provider credential material through opaque handles. The durable table is owned by the `calendar_integration` service namespace rather than a generic shared schema. The complete hosted per-user lifecycle remains **Partial** under issue #129: authorization callback state/PKCE, concrete managed secret storage, refresh/revocation, discovery/selection and migration from the development provider configuration are still separate work. From 362c4b706842c12860eb9ad8a682a17d75a6fb71 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:56:22 +0900 Subject: [PATCH 058/173] docs(uml): promote calendar registry flow --- docs/UML.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/UML.md b/docs/UML.md index 7e810a75b..e8fd38e5f 100644 --- a/docs/UML.md +++ b/docs/UML.md @@ -114,9 +114,9 @@ sequenceDiagram ## Calendar connection registry foundation -**Status:** Implemented on active PR +**Status:** Implemented on protected main -**Evidence:** PR #150; full hosted credential lifecycle remains `Partial` under issue #129. +**Evidence:** PR #150 merged as `1623df364925f84920c07c112f1ae96777277d20`; full hosted credential lifecycle remains `Partial` under issue #129. ```mermaid sequenceDiagram @@ -137,7 +137,7 @@ sequenceDiagram end ``` -The active migration/repository does not itself implement OAuth callback state, managed secret storage, refresh/revocation or discovery/selection. +The protected migration/repository is a persistence foundation only; OAuth callback state, managed secret storage, refresh/revocation and discovery/selection remain separate issue #129 work. ## AI proposal / evidence / decision From ed6df4857139d1a9593d6f41ade307b81f6ea12b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:56:54 +0900 Subject: [PATCH 059/173] docs(assessment): reconcile merged calendar foundation --- docs/DOCUMENTATION_ASSESSMENT.md | 26 +++++++++++--------------- 1 file changed, 11 insertions(+), 15 deletions(-) diff --git a/docs/DOCUMENTATION_ASSESSMENT.md b/docs/DOCUMENTATION_ASSESSMENT.md index ac4c81c91..1d9ecc7bb 100644 --- a/docs/DOCUMENTATION_ASSESSMENT.md +++ b/docs/DOCUMENTATION_ASSESSMENT.md @@ -12,16 +12,16 @@ PR #145 is the single canonical successor. Its documentation family coverage is | Family | Assessment on this branch | Maturity | Notes | | --- | --- | --- | --- | -| PRD | Present-current | Implemented on active PR | Product journey, historical drift, protected #146/#149 and active #147/#150/#151 are explicit | +| PRD | Present-current | Implemented on active PR | Product journey, historical drift, protected #146/#149/#150 and active #147/#151 are explicit | | TRD | Present-current | Implemented on active PR | Shared runtime, service authority, data, HTTP/event, concurrency, AI/security/ops/release requirements | -| Root Architecture | Present-current on this successor | Implemented on active PR | Semantically reconciles Identity rights/integrity, durable Today, trusted calendar context, active calendar registry/plugin authority, Notification/Privacy ownership and canonical graph | -| ADR index/detailed decisions | Present-current | Implemented on active PR | ADR 0001-0010 including verification evidence identity | -| Logical ERD/Data Model | Present-current | Implemented on active PR | Service ownership and conceptual-vs-persisted status are explicit; PR #150 persistence and PR #151 non-persistence are distinguished | +| Root Architecture | Present-current on this successor | Implemented on active PR | Semantically reconciles Identity rights/integrity, durable Today, protected calendar registry, active plugin authority, Notification/Privacy ownership and canonical graph | +| ADR index/detailed decisions | Present-current | Implemented on active PR | ADR 0001-0011 including verification evidence identity and external integration authority | +| Logical ERD/Data Model | Present-current | Implemented on active PR | Service ownership and conceptual-vs-persisted status are explicit; protected #150 persistence and active #151 non-persistence are distinguished | | UML | Present-current | Implemented on active PR | topology, login, Today, review, calendar, AI, rights/status/integrity, plugin authority, verification evidence, backup/deployment and degraded modes | -| API/event contracts | Present-current | Implemented on active PR | Registry separates protected-main #146/#149, active #150/#151/#147 and still-partial parent gaps | +| API/event contracts | Present-current | Implemented on active PR | Registry separates protected-main #146/#149/#150, active #151/#147 and still-partial parent gaps | | Security | Present-current on protected main | Implemented on protected main | Root `SECURITY.md` remains vulnerability-reporting authority | | Threat model | Present-current | Implemented on active PR | Trust boundaries and current partial/planned threats are explicit | -| Privacy/data lifecycle | Present-current | Implemented on active PR | Rights status/integrity plus active calendar/plugin authority are now separated from incomplete full lifecycles | +| Privacy/data lifecycle | Present-current | Implemented on active PR | Rights status/integrity plus protected calendar metadata and active plugin authority remain separated from incomplete full lifecycles | | Test strategy | Present-current | Implemented on active PR | Realistic DB/browser/security/concurrency and documentation-evidence policy | | Operability | Present-current | Implemented on active PR | Deployment/readiness/observability/failure/backup/migration/release boundaries | | Release/migration/rollback | Present-current | Implemented on active PR | Exact integrated release and state-change recovery semantics | @@ -44,6 +44,7 @@ The repository rule is therefore: **semantic evidence outranks file age**. A new 4. **Post-MVP labels -> evidence maturity:** capabilities are classified from live code/tests, not old roadmap labels. 5. **Configured capability maturity -> whole-product readiness:** buyer-gap exhaustion is a separate evidence dimension. 6. **Generic green check -> explicit evidence identity:** source head, PR-base snapshot, live base, synthetic merge, workflow checkout, protected main and release source are distinct authorities under ADR 0010. +7. **External integration metadata -> ambient authority:** ADR 0011 separates LifeOS-owned integration identity, provider/plugin metadata, secret references and explicitly granted capabilities. ## Protected-main evolution reconciled @@ -56,7 +57,8 @@ Current protected main includes: - tenant-and-requesting-actor scoped request lookup (#144); - signed trusted calendar workspace context (#139); - authenticated non-cacheable public data-rights status resource (#146); -- per-section tenant-export integrity metadata and deterministic SHA-256 evidence (#149). +- per-section tenant-export integrity metadata and deterministic SHA-256 evidence (#149); +- workspace-and-user-scoped calendar connection persistence with opaque secret handles (#150), merged as `1623df364925f84920c07c112f1ae96777277d20`. The old documentation PR #126 became materially diverged while protected work integrated and is superseded by the clean successor instead of being merged with obsolete implementation ancestry. @@ -68,12 +70,6 @@ The old documentation PR #126 became materially diverged while protected work in PR #147 advances issue #132 by separating exact contributor source-head verification from synthetic merge-tree compatibility and making evidence attribution explicit. ADR 0010 records the timeless identity model. It is not protected-main behavior until integration. -### PR #150 — calendar connection registry foundation - -**Status:** Implemented on active PR - -PR #150 adds the first durable calendar-connection migration/repository scoped to workspace and user, with bounded provider/account/calendar metadata, normalized scopes and opaque credential references. It does not complete issue #129's authorization callback, managed-secret, refresh/revocation, discovery/selection or migration lifecycle. - ### PR #151 — plugin installation authority **Status:** Implemented on active PR @@ -83,7 +79,7 @@ PR #151 makes plugin installation authority explicit at the application boundary ## Current product gaps that must remain explicit - **Partial:** complete tenant export/deletion orchestration — #55, despite protected #146/#149 progress. -- **Partial:** complete per-user calendar credential lifecycle — #129, with active #150 foundation. +- **Partial:** complete per-user calendar credential lifecycle — #129, despite protected #150 persistence foundation. - **Planned/Partial by slice:** complete plugin secret/outbound delivery runtime — #130, with active #151 authority foundation. - **Implemented on active PR:** verification evidence identity hardening — PR #147 / issue #132 until integration and residual workflow reconciliation. @@ -104,4 +100,4 @@ The repository becomes protected-main documentation sufficient only after PR #14 ## Continuation rule -Documentation integration is a governance gate, never product-completion. After documentation work the autonomous maintenance queue immediately returns to non-documentation execution: integrate or repair #147 when policy permits, advance #150 and #151, and continue the remaining #55/#129/#130/#132 work plus subsequently discovered buyer/security/reliability/operability gaps. +Documentation integration is a governance gate, never product-completion. After documentation work the autonomous maintenance queue immediately returns to non-documentation execution: integrate or repair #147 when policy permits, finish #151 after its reliability prerequisite, and continue the remaining #55/#129/#130/#132 work plus subsequently discovered buyer/security/reliability/operability gaps. From e07ef7564740a98f8da00806c7a431ee500e0601 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:57:50 +0900 Subject: [PATCH 060/173] test(docs): promote merged calendar registry status --- .../src/documentation-contract.test.mjs | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/packages/commercial-readiness/src/documentation-contract.test.mjs b/packages/commercial-readiness/src/documentation-contract.test.mjs index f699c19b1..e22586ebe 100644 --- a/packages/commercial-readiness/src/documentation-contract.test.mjs +++ b/packages/commercial-readiness/src/documentation-contract.test.mjs @@ -208,16 +208,21 @@ test('canonical lifecycle reflects protected-main integrations and remaining gap const contracts = text('docs/API_CONTRACTS.md'); const privacy = text('docs/PRIVACY_DATA_LIFECYCLE.md'); const assessment = text('docs/DOCUMENTATION_ASSESSMENT.md'); + const dataModel = text('docs/DATA_MODEL.md'); assert.match(prd, /PR #127 merged as protected main/u); assert.match(prd, /PR #139 merged/u); assert.match(prd, /PR #146 merged/u); assert.match(prd, /PR #149 merged/u); + assert.match(prd, /PR #150 merged/u); + assert.match(traceability, /PRD-CAL-004.*Implemented on protected main/u); assert.match(traceability, /PRD-PRIV-004.*Implemented on protected main/u); assert.match(traceability, /PRD-PRIV-005.*Implemented on protected main/u); + assert.match(contracts, /Calendar connection registry foundation.*Implemented on protected main/u); assert.match(contracts, /Tenant export integrity manifest.*Implemented on protected main/u); assert.match(privacy, /authenticated public status resource from PR #146/u); assert.match(privacy, /per-contributor export integrity evidence from PR #149/u); + assert.match(dataModel, /Calendar integration — connection registry persisted on protected main/u); assert.match(traceability, /#55 data portability completion/u); assert.match(traceability, /#129 per-user calendar credentials/u); assert.match(traceability, /#130 plugin runtime delivery/u); @@ -235,15 +240,13 @@ test('active successor work is represented without promotion to protected-main t 'docs/adr/0011-external-integration-authority-and-secret-references.md', ); - for (const pr of ['#147', '#150', '#151']) { + for (const pr of ['#147', '#151']) { assert.match(prd, new RegExp(`PR ${pr}`, 'u')); assert.match(traceability, new RegExp(`PR ${pr}`, 'u')); assert.match(contracts, new RegExp(`PR ${pr}`, 'u')); assert.match(assessment, new RegExp(`PR ${pr}`, 'u')); } - assert.match(dataModel, /PR #150 is \*\*Implemented on active PR\*\*/u); assert.match(dataModel, /PR #151 is \*\*Implemented on active PR\*\*/u); - assert.match(uml, /Calendar connection registry foundation/iu); assert.match(uml, /Plugin installation authority/iu); assert.match(uml, /source_head_sha/u); assert.match(uml, /merge_tree_sha/u); From 825ab8e61f93bd5a2aa1b0417cefb68d23dc00a1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 11:06:47 +0900 Subject: [PATCH 061/173] docs(prd): promote plugin authority and verification successor --- docs/PRD.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/PRD.md b/docs/PRD.md index f03e686f0..197c7dfdd 100644 --- a/docs/PRD.md +++ b/docs/PRD.md @@ -54,13 +54,13 @@ Canonical requirements use exactly one of: `Implemented on protected main`, `Imp | PRD-PRIV-004 | An authenticated user can query one owned data-rights request through a tenant-and-actor scoped, bounded, non-cacheable public status resource without exposing workspace/user IDs, idempotency material or receipt digests. | Implemented on protected main | PR #146 merged; session-derived scope and bounded 400/401/404/503 behavior | | PRD-PRIV-005 | Tenant-export sections carry contributor-defined safe record counts and deterministic per-section SHA-256 integrity evidence, with locale-independent property ordering and a whole-export digest. | Implemented on protected main | PR #149 merged; integrity regression and RFC 8785/FIPS 180-4 doctoring | | PRD-INT-001 | Versioned plugin SDK/validation without direct database authority. | Implemented on protected main | plugin SDK/integration-service tests | -| PRD-INT-002 | Complete plugin runtime installation, encrypted secret storage, SSRF-safe outbound delivery, retries/dead-letter behavior and revocation. | Planned | issue #130 | -| PRD-INT-003 | Treat a validated manifest as untrusted intent and grant only explicit tenant-scoped installation capabilities with exact replay/conflict/revocation semantics. | Implemented on active PR | PR #151; application authority only, not durable secret/delivery runtime | +| PRD-INT-002 | Complete plugin runtime installation, encrypted secret storage, SSRF-safe outbound delivery, retries/dead-letter behavior and revocation. | Partial | protected installation authority now exists; durable secret/delivery runtime remains issue #130 | +| PRD-INT-003 | Treat a validated manifest as untrusted intent and grant only explicit tenant-scoped installation capabilities with exact replay/conflict/revocation semantics. | Implemented on protected main | PR #151 merged as `6971c4e11b3204ec41526c7c959a248e54440e1c`; no durable secret/delivery authority implied | | PRD-WEB-001 | Responsive installable PWA with keyboard-operable core flows and Korean/English catalogs. | Implemented on protected main | browser/accessibility/localization tests | | PRD-OPS-001 | Logical PostgreSQL backup/restore with integrity and unsafe-target refusal. | Implemented on protected main | backup scripts/tests/runbook | | PRD-OPS-002 | Provider-neutral production reference deployment and bounded health/readiness/metrics. | Implemented on protected main | infra and observability tests | | PRD-GOV-001 | Capability maturity and buyer-gap exhaustion are reported independently. | Implemented on protected main | buyer-gap registry and issue #21 report | -| PRD-GOV-002 | Required PR verification identifies the commit tree actually checked and does not conflate exact source-head verification, stale PR-base snapshots, independently resolved live-base state or synthetic-merge compatibility evidence. | Implemented on active PR | PR #147 advances issue #132; ADR 0010 defines the evidence identities | +| PRD-GOV-002 | Required PR verification identifies the commit tree actually checked and does not conflate exact source-head verification, stale PR-base snapshots, independently resolved live-base state or synthetic-merge compatibility evidence. | Implemented on active PR | clean successor PR #154 advances issue #132; ADR 0010 defines the evidence identities; #147 is superseded | ## Non-functional requirements From 99355e8dbfad26f8f005d283d4ce59248a4703f2 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 11:09:46 +0900 Subject: [PATCH 062/173] docs(adr): promote integration authority evidence to main --- ...rnal-integration-authority-and-secret-references.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/adr/0011-external-integration-authority-and-secret-references.md b/docs/adr/0011-external-integration-authority-and-secret-references.md index b16d61d69..d4be74bd7 100644 --- a/docs/adr/0011-external-integration-authority-and-secret-references.md +++ b/docs/adr/0011-external-integration-authority-and-secret-references.md @@ -7,7 +7,7 @@ LifeOS integrates with external calendar providers and versioned plugins. Both domains need to persist or carry enough metadata to identify an external integration without turning external credentials or requested plugin capabilities into ambient authority. -Two active implementation lines make the shared boundary concrete: PR #150 introduces a workspace-and-user-scoped calendar connection registry, and PR #151 introduces tenant-scoped plugin installation grants. The parent product gaps #129 and #130 remain incomplete, so this ADR defines the durable authority model without promoting those active implementations to protected-main behavior. +Protected-main PR #150 introduced a workspace-and-user-scoped calendar connection registry and protected-main PR #151 introduced tenant-scoped plugin installation grants. The parent product gaps #129 and #130 remain incomplete, so this ADR defines the durable authority model without confusing those bounded foundations with complete provider/plugin runtime lifecycles. ## Decision drivers @@ -54,10 +54,10 @@ The decision reduces standing credential exposure and prevents untrusted integra ## Acceptance evidence -- Protected main: signed trusted calendar workspace context from PR #139 and existing plugin manifest/event validation. -- Active PR #150: calendar connection migration/repository scoped to workspace+user with bounded metadata and opaque secret references. -- Active PR #151: explicit plugin capability grants, replay/conflict handling, tenant/user lookup isolation and revocation semantics. -- Parent gaps #129 and #130 remain incomplete until their full lifecycle/delivery acceptance criteria are satisfied on protected main. +- Protected main PR #139: signed trusted calendar workspace context. +- Protected main PR #150 (`1623df364925f84920c07c112f1ae96777277d20`): calendar connection migration/repository scoped to workspace+user with bounded metadata and opaque secret references. +- Protected main PR #151 (`6971c4e11b3204ec41526c7c959a248e54440e1c`): explicit plugin capability grants, replay/conflict handling, tenant/user lookup isolation and revocation semantics. +- Parent gaps #129 and #130 remain incomplete until their full credential/runtime delivery acceptance criteria are satisfied on protected main. ## Migration and rollback From 5d248bf550b18ca0fdd15ee9ecb60d1f017894bf Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 11:10:20 +0900 Subject: [PATCH 063/173] docs(trd): promote protected integration authority and clean verification successor --- docs/TRD.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/docs/TRD.md b/docs/TRD.md index e37b99237..fd5b3147a 100644 --- a/docs/TRD.md +++ b/docs/TRD.md @@ -18,11 +18,11 @@ LifeOS is a TypeScript-first monorepo with a Next.js PWA/BFF, independently boun - **Planning:** Goals, Projects, Tasks, durable Today aggregate and search. - **Habit:** recurrence definitions and completion evidence. - **Review:** review snapshots/projections; no direct planning mutation. -- **Calendar integration:** provider adapters, sync state and trusted workspace context. PR #150 is active for the first workspace+user scoped connection persistence foundation; complete hosted credential lifecycle remains partial under #129. +- **Calendar integration:** provider adapters, sync state, trusted workspace context and protected-main workspace+user scoped connection persistence. Complete hosted credential lifecycle remains partial under #129. - **Notification:** reminder occurrences, claims, outcomes and delivery recovery. - **AI proposal:** proposals, evidence, explicit decisions and deterministic evaluation; no generic planning mutation authority. - **Privacy:** purpose-bound sensitive-access decisions/grants/events. -- **Plugin integration:** versioned plugin contracts and validation. PR #151 is active for explicit installation-grant authority; complete durable secret/delivery runtime remains under #130. +- **Plugin integration:** versioned plugin contracts, validation and protected-main explicit installation-grant authority. Complete durable secret/delivery runtime remains partial under #130. ## Data requirements @@ -73,13 +73,13 @@ PR #149 requires each contributor export section to provide a versioned schema a ### Calendar connection registry -**Status:** Implemented on active PR +**Status:** Implemented on protected main -PR #150 defines a service-owned migration/repository for a connection scoped simultaneously to workspace and user, with bounded provider/account/calendar metadata, normalized scopes, opaque external credential references, fixed parameterized SQL and fail-closed duplicate persisted evidence. It does not complete issue #129. +PR #150 defines the protected service-owned migration/repository for a connection scoped simultaneously to workspace and user, with bounded provider/account/calendar metadata, normalized scopes, opaque external credential references, fixed parameterized SQL and fail-closed duplicate persisted evidence. It does not complete issue #129. ### Plugin installation authority -**Status:** Implemented on active PR +**Status:** Implemented on protected main PR #151 separates validated manifest intent from host authority. LifeOS grants only an explicit bounded capability subset, accepts exact replay, rejects conflicting installation-ID reuse, hides cross-tenant/user existence and preserves revocation evidence. It does not imply complete persistent secret or outbound-delivery runtime under #130. @@ -92,10 +92,10 @@ Versioned events carry opaque event ID, explicit type/version, validated actor/w - **Today:** protected-main aggregate uses explicit strong create/update preconditions, idempotency and stale-conflict handling with durable PostgreSQL concurrency evidence. - **Habit completion:** tenant-scoped replay-safe persistence. - **Notification:** expiring/fenced claims and duplicate-delivery refusal. -- **Calendar:** deterministic provider identity/preconditions and trusted context; active #150 adds tenant+user+connection scoped repository invariants. +- **Calendar:** deterministic provider identity/preconditions, trusted context and protected tenant+user+connection scoped repository invariants from #150. - **AI decisions:** bind decision to exact proposal digest/revision, actor/workspace and idempotency identity. - **Data rights:** durable request identity and immutable terminal receipts; status lookup is scoped simultaneously by request, workspace and requesting user and fails closed on corruption. -- **Plugin installation:** active #151 requires exact replay/conflict/revocation semantics for host-granted authority. +- **Plugin installation:** protected #151 requires exact replay/conflict/revocation semantics for host-granted authority. ## AI / automation requirements @@ -132,7 +132,7 @@ Required evidence classes retain explicit identities: - `protected_main_sha`: integrated protected-main evidence identity; - `release_source_sha`: exact protected source bound to release artifacts. -A green result for one class cannot be promoted to another. SARIF/security evidence must be attributed to the commit/ref actually analyzed. PR #147 is `Implemented on active PR` for the current source-head/merge-tree correction; issue #132 remains open until protected-main integration and residual attribution are reconciled. +A green result for one class cannot be promoted to another. SARIF/security evidence must be attributed to the commit/ref actually analyzed. Clean successor PR #154 is `Implemented on active PR` for the current source-head/merge-tree correction after #147 was superseded; issue #132 remains open until protected-main integration and residual attribution are reconciled. ## Release requirements From f6b6b9b73c1983920699b6bcc8dbae1259b2c755 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 11:13:32 +0900 Subject: [PATCH 064/173] docs(prd): reconcile calendar revocation and user context --- docs/PRD.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/PRD.md b/docs/PRD.md index 197c7dfdd..57fe5ac58 100644 --- a/docs/PRD.md +++ b/docs/PRD.md @@ -45,6 +45,8 @@ Canonical requirements use exactly one of: `Implemented on protected main`, `Imp | PRD-CAL-002 | Derive calendar workspace authority from signed trusted context, not legacy client headers. | Implemented on protected main | PR #139 merged; trusted-context tests | | PRD-CAL-003 | Complete per-user encrypted Google/CalDAV credential lifecycle, OAuth/PKCE, refresh/revocation, discovery and calendar selection. | Partial | issue #129 | | PRD-CAL-004 | Persist a LifeOS-owned calendar-connection foundation scoped to workspace and user, with bounded provider metadata, normalized scopes and opaque secret handles rather than plaintext provider tokens. | Implemented on protected main | PR #150 merged as `1623df364925f84920c07c112f1ae96777277d20`; does not complete #129 | +| PRD-CAL-005 | Revoke one owned calendar connection atomically under exact workspace+user scope while preserving a bounded revoked-state result and replay safety. | Implemented on protected main | PR #153 merged as `b13413e571bad82535f63d478e40746d12c3e680`; does not by itself revoke provider-side OAuth credentials | +| PRD-CAL-006 | Internal hosted calendar operations that require user authority use a short-lived signed context binding both workspace and requesting-user UUIDv4 identities under a version distinct from workspace-only synchronization context. | Implemented on active PR | PR #155; authenticated workspace+user authority prerequisite for later public disconnect/credential lifecycle | | PRD-NOT-001 | Timezone-correct bounded reminders with replay-safe delivery. | Implemented on protected main | notification persistence/scheduler tests | | PRD-AI-001 | AI output is inert proposal evidence until explicit authorized decision. | Implemented on protected main | AI proposal/audit tests | | PRD-AI-002 | Deterministic proposal-quality/safety gates remain independent of live provider availability. | Implemented on protected main | evaluator/live-conformance split | From d74b071f2cc983158402f6848308760f69dff24a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 11:16:02 +0900 Subject: [PATCH 065/173] docs(traceability): reconcile latest protected and active lanes --- docs/TRACEABILITY.md | 64 +++++++++++++++++++++++--------------------- 1 file changed, 33 insertions(+), 31 deletions(-) diff --git a/docs/TRACEABILITY.md b/docs/TRACEABILITY.md index 82030a18a..d7558f097 100644 --- a/docs/TRACEABILITY.md +++ b/docs/TRACEABILITY.md @@ -2,65 +2,67 @@ **Status:** Implemented on active PR -This index maps product requirements and durable decisions to representative source/test/issue evidence. Protected-main source/migrations/tests outrank this index when evidence conflicts. +This index maps canonical requirements and durable decisions to representative source/test/issue/PR evidence. Current protected-main source, migrations, tests and live repository policy outrank this index when evidence conflicts. | Requirement / decision | Status | Representative implementation/evidence | Open follow-up | | --- | --- | --- | --- | | PRD-ID-001 login/session/workspace authority | Implemented on protected main | identity OAuth/session runtime and tests | — | -| PRD-ID-002 UUIDv4 internal IDs | Implemented on protected main | `AGENTS.md`, validators/migrations | — | +| PRD-ID-002 opaque UUIDv4 internal IDs | Implemented on protected main | `AGENTS.md`, validators/migrations | — | | PRD-PLAN-001 durable planning | Implemented on protected main | planning PostgreSQL repository/migrations | — | | PRD-PLAN-002 durable Today synchronization | Implemented on protected main | PR #127; Today aggregate, BFF, PostgreSQL concurrency and browser acceptance | — | | PRD-HAB-001 recurring habits | Implemented on protected main | habit service/domain/PostgreSQL tests | — | | PRD-REV-001 review projection boundary | Implemented on protected main | review service tests | — | | PRD-CAL-001 conflict-safe calendar sync | Implemented on protected main | CalDAV/Google adapter tests | — | -| PRD-CAL-002 trusted calendar workspace context | Implemented on protected main | PR #139; signed context verifier/controller regressions | — | -| PRD-CAL-003 complete hosted per-user calendar credentials | Partial | provider adapters, trusted context and protected connection registry exist | issue #129 | -| PRD-CAL-004 tenant+user calendar connection registry foundation | Implemented on protected main | PR #150 merged as `1623df364925f84920c07c112f1ae96777277d20`; service-owned migration/repository with opaque credential references | issue #129 remains for complete lifecycle | +| PRD-CAL-002 trusted workspace calendar context | Implemented on protected main | PR #139 | — | +| PRD-CAL-003 complete hosted per-user calendar credential lifecycle | Partial | protected trusted context, connection registry and local revocation foundations exist | issue #129 | +| PRD-CAL-004 workspace+user calendar connection registry | Implemented on protected main | PR #150 / `1623df364925f84920c07c112f1ae96777277d20` | issue #129 remains for complete lifecycle | +| PRD-CAL-005 atomic tenant+user calendar connection revocation | Implemented on protected main | PR #153 / `b13413e571bad82535f63d478e40746d12c3e680` | provider-side OAuth revocation remains #129 | +| PRD-CAL-006 signed workspace+user calendar authority | Implemented on active PR | PR #155; distinct short-lived `life-os.calendar-user.v1` authority | subsequent #129 disconnect/runtime slices | | PRD-NOT-001 bounded reminders | Implemented on protected main | notification scheduler/persistence tests | — | -| PRD-AI-001 inert auditable proposals | Implemented on protected main | AI proposal/audit service tests | — | -| PRD-AI-002 deterministic/live-provider separation | Implemented on protected main | proposal evaluator + NIM conformance workflow | — | +| PRD-AI-001 inert auditable proposals | Implemented on protected main | AI proposal/audit tests | — | +| PRD-AI-002 deterministic/live-provider separation | Implemented on protected main | proposal evaluator + bounded NIM conformance | — | | PRD-PRIV-001 purpose-bound sensitive access | Implemented on protected main | privacy-service grants/events/tests | — | -| PRD-PRIV-002 data-rights auth/request ledger primitives | Implemented on protected main | PRs #134, #136, #137, #138, #144 | issue #55 for whole journey | -| PRD-PRIV-003 complete export/delete orchestration | Partial | identity core exists; full domain/reconciliation/delivery incomplete | issue #55 | -| PRD-PRIV-004 authenticated bounded request-status resource | Implemented on protected main | PR #146; session-derived tenant/actor scope, bounded public projection and non-cacheable responses | issue #55 remains for whole-right completion | -| PRD-PRIV-005 per-section export integrity evidence | Implemented on protected main | PR #149; safe record counts, deterministic section SHA-256 and whole-export digest | issue #55 remains for delivery/reconciliation completion | +| PRD-PRIV-002 recent-auth + durable rights request ledger | Implemented on protected main | #134/#136/#137/#138/#144 | issue #55 for whole journey | +| PRD-PRIV-003 complete export/delete orchestration | Partial | protected identity/integrity foundations exist; full contributor/reconciliation/delivery lifecycle incomplete | issue #55 | +| PRD-PRIV-004 authenticated bounded request-status resource | Implemented on protected main | PR #146 | issue #55 remains for whole-right completion | +| PRD-PRIV-005 per-section export integrity evidence | Implemented on protected main | PR #149 | issue #55 remains for protected delivery/reconciliation | | PRD-INT-001 plugin SDK/validation | Implemented on protected main | plugin SDK/integration-service tests | — | -| PRD-INT-002 complete plugin secret/delivery runtime | Planned | validation-only surface is intentionally non-runtime | issue #130 | -| PRD-INT-003 explicit tenant-scoped plugin installation grants | Implemented on active PR | PR #151; bounded application authority, replay/conflict/revocation semantics | issue #130 remains for durable secret/delivery runtime | +| PRD-INT-002 complete plugin secret/delivery runtime | Partial | protected host-owned installation authority exists; durable secret/delivery runtime incomplete | issue #130 | +| PRD-INT-003 explicit tenant-scoped installation grants | Implemented on protected main | PR #151 / `6971c4e11b3204ec41526c7c959a248e54440e1c` | issue #130 for persistent secrets/delivery | | PRD-WEB-001 accessible localized PWA | Implemented on protected main | browser/accessibility/localization tests | — | | PRD-OPS-001 backup/restore | Implemented on protected main | backup scripts/tests/runbook | — | -| PRD-GOV-001 buyer-gap vs capability maturity separation | Implemented on protected main | repository buyer-gap registry; issue #21 rendering | — | -| PRD-GOV-002 exact source/base/merge verification attribution | Implemented on active PR | ADR 0010; PR #147 separates contributor source-head verification from synthetic merge compatibility | issue #132 remains until protected-main integration and residual workflow attribution is reconciled | +| PRD-GOV-001 buyer-gap vs capability-maturity separation | Implemented on protected main | buyer-gap registry / issue #21 report | — | +| PRD-GOV-002 exact source/base/merge verification attribution | Implemented on active PR | ADR 0010; clean successor PR #154; old #147 superseded | issue #132 until integration/residual attribution closure | ## Architecture decisions | Decision | Status | Evidence | | --- | --- | --- | | Multi-user server-backed/self-hostable MSA supersedes browser-only primary architecture | Accepted architecture | `ARCHITECTURE.md`, service layout, Compose/Kubernetes | -| UUIDv4 supersedes original UUIDv7 proposal | Accepted architecture | protected-main `AGENTS.md` and code/migrations | -| Service-owned persistence; no cross-service table authority | Accepted architecture | `ARCHITECTURE.md`, per-service repositories/migrations | -| AI output remains inert proposal evidence | Accepted architecture | AI service tests and architecture | -| Sensitive access is purpose/resource/lifetime/audit bound | Accepted architecture | privacy-service tests | -| Capability maturity cannot stand in for buyer-gap exhaustion | Accepted architecture | buyer-gap registry/reporting | -| Canonical documentation must distinguish shipped/active/planned/superseded state | Accepted architecture | ADR 0007 and documentation contract tests on PR #145 | -| Verification evidence identities remain separate | Accepted architecture | ADR 0010; PR #147 is active implementation evidence | -| External integration metadata, secret material and granted authority remain separate | Accepted architecture | ADR 0011; protected #150 and active #151 evidence | +| UUIDv4 supersedes original UUIDv7 proposal | Accepted architecture | protected-main code/migrations + ADR 0001 | +| Service-owned persistence; no cross-service table authority | Accepted architecture | root Architecture + ADR 0003 | +| AI output remains an inert proposal | Accepted architecture | AI tests + ADR 0004 | +| Sensitive access is actor/workspace/resource/purpose/lifetime bound | Accepted architecture | privacy tests + ADR 0005 | +| Capability maturity cannot stand in for buyer-gap exhaustion | Accepted architecture | ADR 0008 + readiness registry | +| Canonical docs distinguish shipped/active/planned/superseded truth | Accepted architecture | ADR 0007 + documentation contract tests | +| Verification evidence identities remain separate | Accepted architecture | ADR 0010 + PR #154 active implementation | +| Integration identity, external metadata, secret references and granted authority remain separate | Accepted architecture | ADR 0011 + protected #150/#151/#153 + active #155 | ## Evidence hierarchy 1. Current protected-main source, migrations, tests and live repository policy. -2. Current active PR source/tests, explicitly labeled active and bound to its exact head. -3. Accepted architecture/ADR decisions. -4. Canonical PRD/TRD/Data Model/UML/Security/Test/Operability docs. -5. Issues/plans/research for incomplete work. +2. Exact current active-PR source/tests, explicitly labeled active. +3. Accepted Architecture/ADR decisions. +4. Canonical PRD/TRD/Data Model/UML/API/Security/Test/Operability documents. +5. Open issues/plans/research for incomplete work. 6. Historical chat/PR bodies only as rationale. -A contributor source head, PR-base snapshot, independently resolved live base tip, synthetic merge tree, workflow checkout, protected-main head and release source are distinct evidence identities. Evidence is never promoted to another identity just because the status name is green. +`source_head_sha`, PR-base snapshot, independently resolved live-base tip, synthetic merge tree, workflow checkout, protected-main head and release source are distinct evidence identities. A green status never transfers authority across them. -## Buyer gaps from live readiness state +## Buyer-gap state -The configured capability set can be fully mature while the product still has accepted buyer gaps. Current canonical open buyer gaps are #55 data portability completion, #129 per-user calendar credentials, and #130 plugin runtime delivery. Protected-main #146 and #149 materially advance #55 without closing it. Protected-main #150 advances #129 without completing its OAuth/secret/refresh/discovery lifecycle. Active PR #151 advances #130 without promoting the whole plugin-runtime gap to shipped completion. Issue #132 is a reliability/governance hardening gap; PR #147 is its active implementation line. +Canonical buyer gaps remain #55 data portability completion, #129 hosted per-user calendar credentials, and #130 plugin runtime delivery. Protected #146/#149 advance #55; protected #150/#153 and active #155 advance #129; protected #151 advances #130. None of those bounded slices closes the parent gap by implication. Issue #132 is verification/governance reliability; #154 is its clean active implementation after #147 was superseded. ## Update rule -Whenever a requirement changes maturity, update PRD status, this traceability row, relevant ADR/architecture/data/UML/security/operability views, regression evidence and CHANGELOG. Never label active/unmerged work `Implemented on protected main`. +Whenever maturity changes, reconcile PRD, this traceability index, relevant ADR/Architecture/Data/UML/API/Security/Privacy/Operability views, regression evidence and CHANGELOG. Never label active/unmerged work `Implemented on protected main`. From ad5b98ca12a5fd1498ab274b85d8df151eb91415 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 11:17:07 +0900 Subject: [PATCH 066/173] docs(api): reconcile calendar revocation, plugin authority, and verification successor --- docs/API_CONTRACTS.md | 94 ++++++++++++++++++++----------------------- 1 file changed, 44 insertions(+), 50 deletions(-) diff --git a/docs/API_CONTRACTS.md b/docs/API_CONTRACTS.md index 1d21fe841..93bd4696e 100644 --- a/docs/API_CONTRACTS.md +++ b/docs/API_CONTRACTS.md @@ -2,100 +2,94 @@ **Status:** Implemented on active PR -This file indexes stable repository-level API/event invariants. Concrete route schemas remain owned by the implementing service and tests. +This registry summarizes repository-level API/event invariants. Concrete route schemas remain owned by the implementing service and tests. ## Common rules - Internal IDs are opaque UUIDv4. -- Ownership is derived from authenticated/signed context, never arbitrary browser headers or request bodies. -- Mutations use idempotency and/or strong preconditions where replay/stale overwrite is plausible. +- Ownership comes from authenticated/signed context, never arbitrary browser fields. +- Replayable/stale-sensitive mutations use idempotency and/or strong preconditions. - Public failures are bounded and credential-free. -- Provider responses and model output are untrusted until schema/boundary validation. +- Provider responses, plugin metadata and model output are untrusted until validated. - Cross-service contracts never grant direct database authority. -- Verification evidence is valid only for the exact tree a job inspected; source-head and integration-merge evidence remain separate. +- Verification evidence is valid only for the exact tree actually inspected. ## Contract registry | Contract | Owner | Status | Notes | | --- | --- | --- | --- | -| OAuth login/callback/session | identity-service | Implemented on protected main | Google/GitHub, bounded state/redirect/session lifecycle | -| Planning Goal/Project/Task APIs | planning-service | Implemented on protected main | tenant-derived authority | -| Durable Today aggregate | planning-service | Implemented on protected main | strong ETag/precondition, idempotency, explicit conflict semantics; PR #127 | -| Habit recurrence/completion | habit-service | Implemented on protected main | tenant-scoped replay-safe completion | -| Review projection | review-service | Implemented on protected main | read/projection authority only | -| Calendar sync request | calendar integration | Implemented on protected main | signed trusted workspace context; PR #139 | -| Calendar connection registry foundation | calendar integration | Implemented on protected main | PR #150 merged as `1623df364925f84920c07c112f1ae96777277d20`; workspace+user scoped provider metadata and opaque credential references | -| Complete per-user calendar credential lifecycle | calendar integration | Partial | issue #129; OAuth/PKCE, concrete secret backend, refresh/revocation, discovery/selection remain incomplete | +| OAuth login/callback/session | identity-service | Implemented on protected main | Google/GitHub, bounded transaction/session lifecycle | +| Planning Goal/Project/Task | planning-service | Implemented on protected main | tenant-derived authority | +| Durable Today aggregate | planning-service | Implemented on protected main | PR #127; strong preconditions/idempotency/conflicts | +| Habit recurrence/completion | habit-service | Implemented on protected main | tenant-scoped replay safety | +| Review projection | review-service | Implemented on protected main | projection/read authority only | +| Calendar sync request | calendar integration | Implemented on protected main | PR #139 signed workspace context | +| Calendar connection registry | calendar integration | Implemented on protected main | PR #150; workspace+user scoped metadata + opaque secret references | +| Atomic calendar connection revocation | calendar integration | Implemented on protected main | PR #153; exact tenant+user scope and revocation replay | +| Signed calendar workspace+user context | calendar integration | Implemented on active PR | PR #155; distinct short-lived `life-os.calendar-user.v1` authority | +| Complete per-user calendar credential lifecycle | calendar integration | Partial | issue #129; OAuth/PKCE, managed secret backend, refresh/provider revoke, discovery/selection remain | | Reminder scheduling/delivery | notification-service | Implemented on protected main | bounded claims/retries/outcomes | -| AI proposal/evidence/decision | AI proposal service | Implemented on protected main | inert proposal, explicit decision | -| Purpose-bound privacy access | privacy-service | Implemented on protected main | actor/resource/purpose/lifetime bound | -| Data-rights durable request ledger/status lookup | identity-service | Implemented on protected main | #138/#144; actor+workspace scoped persistence primitive, immutable bounded receipt evidence | -| Authenticated public data-rights request status resource | identity-service | Implemented on protected main | PR #146; session-derived scope, `GET /v1/data-rights/requests/:requestId`, no-store and bounded 400/401/404/503 semantics | -| Tenant export integrity manifest | identity coordinator + domain contributors | Implemented on protected main | PR #149; safe per-section record counts, deterministic section SHA-256 and whole-export digest | -| Complete cross-domain data export/erasure lifecycle | identity coordinator + domain contributors | Partial | issue #55; contributor/reconciliation/delivery/retention lifecycle remains incomplete | +| AI proposal/evidence/decision | AI proposal service | Implemented on protected main | inert proposal + explicit decision | +| Purpose-bound sensitive access | privacy-service | Implemented on protected main | actor/resource/purpose/lifetime bound | +| Data-rights request ledger/status lookup | identity-service | Implemented on protected main | #138/#144 | +| Authenticated public data-rights status | identity-service | Implemented on protected main | PR #146; no-store bounded projection | +| Tenant export integrity manifest | identity coordinator + contributors | Implemented on protected main | PR #149; section/whole SHA-256 evidence | +| Complete cross-domain export/erasure | identity coordinator + contributors | Partial | issue #55 | | Plugin manifest/event validation | integration-service | Implemented on protected main | versioned SDK/validation | -| Explicit plugin installation grant authority | integration-service | Implemented on active PR | PR #151; exact manifest identity, explicit capability subset, replay/conflict/revocation semantics | -| Complete plugin secret/outbound delivery runtime | integration-service | Planned | issue #130; durable secret handling and delivery remain separate work | -| Exact source-head and merge-tree verification evidence | repository workflows | Implemented on active PR | PR #147 advances issue #132; ADR 0010 defines distinct evidence identities | +| Explicit plugin installation grants | integration-service | Implemented on protected main | PR #151; explicit subset, replay/conflict/revocation | +| Complete plugin secret/outbound delivery runtime | integration-service | Partial | issue #130 | +| Source-head vs merge-tree verification | repository workflows | Implemented on active PR | clean successor PR #154; #147 superseded; ADR 0010 | -## Data-rights request status resource +## Data-rights status **Status:** Implemented on protected main -PR #146 adds a bounded authenticated projection over the protected-main request ledger. The route derives workspace and requesting-user scope from the validated server session and never accepts those authority fields from the browser. +PR #146 derives workspace/user scope from the server session and exposes only request ID, request kind, lifecycle status and bounded timestamps. Malformed request IDs map to bounded 400, invalid sessions to 401, absent/cross-tenant requests to indistinguishable 404, dependency failures to sanitized 503, and responses are non-cacheable. This does not complete issue #55. -The successful response contains only the public lifecycle projection: schema version, request ID, request kind, lifecycle state, requested instant and optional completion instant. It does not expose workspace/user IDs, idempotency keys, request digests or receipt digests. +## Export integrity -Expected failure semantics are: +**Status:** Implemented on protected main -- malformed request identifier: bounded 400; -- invalid/expired session: bounded 401; -- absent or cross-tenant request: indistinguishable bounded 404; -- unexpected persistence/dependency failure: sanitized 503; -- every response path is non-cacheable where the controller contract requires it. +PR #149 binds contributor identity, schema version, safe business record count and bounded normalized JSON into deterministic per-section SHA-256 evidence plus an ordered whole-export digest. Locale-independent UTF-16 property ordering is used for digest stability. Digests are integrity evidence, not access control, confidentiality, provenance or digital signatures. -This bounded status endpoint is not equivalent to complete export/erasure orchestration under issue #55. +## Calendar connection lifecycle -## Tenant export integrity evidence +### Persistence foundation **Status:** Implemented on protected main -PR #149 requires each contributor export section to include a versioned schema and a safe non-negative business record count. LifeOS binds contributor identity, schema version, record count and bounded normalized JSON data into a deterministic SHA-256 section digest and retains a whole-export digest over the ordered manifest. - -Property ordering for integrity serialization is locale-independent and uses UTF-16 code-unit ordering. The repository cites RFC 8785 for the ordering rationale but does not claim complete JSON Canonicalization Scheme conformance. Digest evidence does not replace access control, confidentiality, provenance or digital signatures. +PR #150 persists a LifeOS-owned connection under exact workspace+user scope with bounded provider/account/calendar metadata, normalized scopes, fixed parameterized SQL and opaque secret references. The metadata row is not a credential store. -## Calendar connection registry +### Local connection revocation **Status:** Implemented on protected main -PR #150 introduced the service-owned persistence foundation for a calendar connection scoped simultaneously to workspace and user. Protected main carries bounded provider/account/calendar metadata, normalized scopes and opaque external credential references, uses fixed parameterized SQL, rejects malformed authority before persistence access, uses descriptive multiword database naming, and treats duplicate stored evidence as corruption. - -This foundation does not by itself implement the complete #129 OAuth/refresh/revocation/discovery/selection lifecycle. +PR #153 adds atomic tenant+user-scoped connection revocation and exact replay behavior. Revoking the LifeOS connection record does not by itself prove provider-side OAuth revocation or secret destruction; those remain issue #129 lifecycle requirements. -## Plugin installation authority +### Hosted user authority **Status:** Implemented on active PR -PR #151 treats a validated plugin manifest as intent rather than authority. A LifeOS host explicitly grants a bounded capability subset, binds installation identity to exact plugin/manifest evidence, accepts only exact idempotent replay, rejects conflicting reuse, hides cross-workspace/user installation existence and preserves revocation evidence. +PR #155 introduces a short-lived HMAC context that binds both workspace and user UUIDv4 identities under a version distinct from workspace-only sync context. It rejects identifier substitution, stale/future/malformed evidence and unusable verifier configuration. Public disconnect/runtime composition is a later #129 slice. -This application-level authority does not imply durable secret persistence, arbitrary outbound delivery or completion of issue #130. +## Plugin installation authority -## Event envelope +**Status:** Implemented on protected main -When asynchronous events are used, the envelope includes a unique opaque event ID, explicit event type/version, validated workspace/actor where applicable, correlation/causation identifiers, occurrence/publication time, and a bounded immutable payload. Consumers must be idempotent under at-least-once delivery. +PR #151 treats a validated manifest as requested intent, not granted authority. The host grants an explicit tenant-scoped capability subset, accepts exact replay, rejects conflicting reuse, hides cross-tenant/user existence and preserves revocation evidence. Durable secret persistence and outbound delivery remain incomplete under #130. -## Planning completion event +## Events -`planning.task.completed.v1` and similar events are evidence notifications, not permission for a consumer to write planning tables. +Asynchronous events use an opaque event ID, explicit type/version, validated tenant/actor/correlation/causation context and bounded immutable payload. Consumers are idempotent under replay. Receiving an event never grants producer-database authority. ## Versioning Breaking route/event/schema semantics require explicit versioning or a reviewed migration contract. Unknown versions fail closed. -## Evidence identity +## Verification evidence identity **Status:** Accepted architecture -Verification tooling distinguishes `source_head_sha`, `pr_base_snapshot_sha`, independently resolved `live_base_tip_sha`, `merge_tree_sha`, `workflow_checkout_sha`, protected-main identity and release-source identity. A pull-request base snapshot is not silently treated as the current base ref, and a synthetic merge result is not exact contributor-source verification. +`source_head_sha`, PR-base snapshot, independently resolved `live_base_tip_sha`, `merge_tree_sha`, `workflow_checkout_sha`, protected-main identity and release-source identity are separate authorities. Synthetic integration success is not exact contributor-source verification. -ADR 0010 is the durable decision. PR #147 is `Implemented on active PR` for the current bounded workflow correction while issue #132 remains open until protected-main integration and any residual required-workflow attribution is reconciled. +ADR 0010 is the durable decision. Clean successor PR #154 is `Implemented on active PR`; #147 is superseded. Issue #132 remains open until the correction integrates and residual required-workflow attribution is reconciled. From 2dc610f99e4ae1326c296a9f183d2695bc70fdfe Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 11:17:40 +0900 Subject: [PATCH 067/173] docs(data): reconcile protected calendar and plugin authority --- docs/DATA_MODEL.md | 65 +++++++++++++--------------------------------- 1 file changed, 18 insertions(+), 47 deletions(-) diff --git a/docs/DATA_MODEL.md b/docs/DATA_MODEL.md index 19081d81d..5cbee08be 100644 --- a/docs/DATA_MODEL.md +++ b/docs/DATA_MODEL.md @@ -46,72 +46,43 @@ erDiagram PLUGIN_INSTALLATION ||--o{ PLUGIN_DELIVERY : attempts ``` -## Service-owned entities +## Persisted protected-main ownership -### Identity service — persisted on protected main +### Identity -- `user_account` -- `external_identity` -- `browser_session` -- `workspace_record` -- `workspace_membership` -- `data_rights_request` and immutable terminal receipt state as defined by current migrations/repositories +Identity owns users, external identity mapping, browser sessions, workspace membership/authorization, authentication provenance, durable `data_rights_request`/terminal receipt evidence, authenticated request-status lookup and export-integrity composition. Authentication time remains distinct from session rotation. -Authentication provenance is retained independently from session rotation so recent-auth policy can be enforced correctly. Protected-main export logic now binds each contributor section to an explicit business record count and deterministic SHA-256 integrity evidence before the whole-export digest is calculated. +### Planning -### Planning service — persisted on protected main +Planning owns Goals, Projects, Tasks and the durable Today aggregate/action/revision/idempotency model introduced by PR #127. Review/search projections do not gain Planning mutation authority. -- `goal_record` -- `project_record` -- `task_record` -- durable Today aggregate/action/revision/idempotency state introduced by PR #127 +### Habit / Review / Notification / AI / Privacy -Planning migrations are authoritative; review/search projections are not mutation authority. +Habit owns recurrence/completion evidence; Review owns guided review snapshots/projections; Notification owns reminder occurrence/claim/delivery evidence; AI owns proposal/evidence/decision persistence; Privacy owns purpose-bound access decisions, grants and audit events. Logical cross-service references never authorize cross-schema SQL. -### Habit service — persisted on protected main +### Calendar integration -- `habit_record` -- `habit_completion` +**Status:** Implemented on protected main -### Review service +PR #150 added the service-owned `calendar_integration.calendar_connection_record` persistence foundation scoped simultaneously to workspace and user. The row stores bounded provider/account/calendar metadata, normalized scopes and opaque credential references rather than plaintext provider credentials. PR #153 added atomic tenant+user-scoped revocation and durable revoked-state/replay semantics. -Review snapshots/projections are service-owned. They consume planning/habit evidence without becoming their source of truth. - -### Notification service — persisted on protected main - -- reminder occurrence/claim records -- immutable delivery outcomes/inbox evidence - -### AI proposal service — persisted on protected main - -- proposal evidence -- explicit accept/reject decision evidence - -### Privacy service — persisted on protected main - -- purpose-bound access decisions -- bounded grants -- append-only privacy/audit events - -### Calendar integration — connection registry persisted on protected main - -Protected main includes sync/provider behavior, trusted signed workspace-context verification, and after PR #150 the first persisted `calendar_connection` foundation. Migration/repository scope binds one connection to workspace and user, stores bounded provider/account/calendar metadata and normalized scopes, and references external credential material through opaque handles. The durable table uses the service-owned `calendar_integration.calendar_connection_record` namespace rather than a generic one-word schema. - -The complete hosted lifecycle remains **Partial** under issue #129: authorization callback lifecycle, concrete managed secret storage, refresh/revocation, discovery/selection and migration from development provider configuration remain separate work. +PR #155 is **Implemented on active PR** for signed workspace+user request authority only; it adds no persistence. The complete hosted OAuth/managed-secret/refresh/provider-revocation/discovery/selection lifecycle remains **Partial** under #129. ### Plugin integration -Manifest/contract validation exists on protected main. PR #151 is **Implemented on active PR** for an application-level `plugin_installation` authority model that grants an explicit capability subset and preserves replay/conflict/revocation evidence. It does not add durable persistence. +**Status:** Implemented on protected main + +PR #151 protects the application-level `plugin_installation` authority model: validated manifest intent is separated from explicit host-granted capability subsets, exact replay/conflict semantics are deterministic, cross-tenant/user existence is hidden, and revocation ends active authority while preserving bounded evidence. -Therefore persisted `plugin_installation`, plugin secret records and `plugin_delivery` attempts remain **Planned** under issue #130 until migrations/repositories and delivery runtime are merged. The logical ERD shows the intended ownership relationship, not physical protected-main tables. +This is not yet a protected-main durable plugin-installation table. Persisted plugin secret records and outbound `plugin_delivery` attempts remain **Planned/Partial** under #130 until owning migrations/repositories and delivery runtime exist. The ERD therefore shows those as logical target entities, not physical tables. ## Data-rights lifecycle -Protected main proves recent-authentication provenance, authenticated ownership binding, durable request/terminal receipt persistence, tenant-scoped request lookup, an authenticated non-cacheable public status projection through PR #146, and per-section export integrity metadata through PR #149. The whole-product export/deletion participant/reconciliation/protected-delivery model remains partial under issue #55. +Protected main includes recent-authentication provenance, durable requests/immutable terminal receipts, tenant+actor scoped status lookup, authenticated non-cacheable status projection (#146), and per-section export integrity evidence (#149). Whole-product contributor orchestration, reconciliation, protected delivery, retention/legal-hold/backup-expiry and terminal completion remain **Partial** under #55. -## Temporal/provenance fields +## Temporal / provenance rules -Where current migrations define them, records retain creation/update/completion/expiry/revision/idempotency/digest evidence. Persist UTC instants and IANA timezone/local-calendar values where civil-time semantics matter. Do not add temporal columns solely to satisfy this diagram. +Use UTC instants plus explicit IANA timezone/local-calendar fields where civil-time behavior matters. Current migrations may retain creation/update/completion/revocation/expiry/revision/idempotency/digest evidence. Do not add fields solely to satisfy a diagram. ## Cross-service relationships From 3efddd0b068a2b7d99a66d14cb1394322f6fa986 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 11:18:15 +0900 Subject: [PATCH 068/173] docs(privacy): reconcile calendar and plugin authority lifecycle --- docs/PRIVACY_DATA_LIFECYCLE.md | 59 +++++++++++++++------------------- 1 file changed, 26 insertions(+), 33 deletions(-) diff --git a/docs/PRIVACY_DATA_LIFECYCLE.md b/docs/PRIVACY_DATA_LIFECYCLE.md index a0ec3c52f..85b744ec5 100644 --- a/docs/PRIVACY_DATA_LIFECYCLE.md +++ b/docs/PRIVACY_DATA_LIFECYCLE.md @@ -4,76 +4,69 @@ ## Control model -LifeOS preserves business utility while limiting sensitive-data access through tenant-derived authority, explicit purpose/resource/lifetime controls, least privilege, encryption/secret boundaries, retention and auditable privileged access. Blanket PII masking is not the product's primary control. +LifeOS preserves legitimate product utility while limiting sensitive-data access through tenant-derived authority, explicit purpose/resource/lifetime controls, least privilege, encryption/secret boundaries, bounded retention and auditable privileged access. Blanket masking is not the primary authorization model. ## Data classes -- identity/account and external-provider mapping; +- identity/account and external-provider mappings; - session/authentication provenance; - planning, habit and review content; -- calendar connection/synchronization metadata; +- calendar connection/synchronization metadata and credential references; - reminder/delivery evidence; - AI proposal/evidence/decision records; - privacy access decisions/grants/events; - data-rights request/receipt/export-integrity evidence; +- plugin installation/capability evidence; - operator logs/metrics and release/CI evidence. Provider credentials, browser cookies, raw model prompts/responses and hidden reasoning are protected secret/transient material and do not belong in public artifacts. ## Lifecycle rules -1. **Collect:** accept only bounded fields required by the owning service contract. -2. **Authorize:** derive workspace/actor from trusted authenticated/signed context. -3. **Use:** constrain sensitive access to explicit resource/purpose/lifetime. -4. **Persist:** store only in the owning service with service-owned credentials/migrations. -5. **Observe:** logs/metrics expose bounded credential-free operational evidence. +1. **Collect:** accept only bounded fields required by the owning-service contract. +2. **Authorize:** derive tenant/actor from trusted authenticated or signed context. +3. **Use:** constrain sensitive access to explicit purpose/resource/lifetime. +4. **Persist:** store only in the owning service under service-owned credentials/migrations. +5. **Observe:** logs/metrics use bounded credential-free evidence. 6. **Retain:** retention is explicit by data class; immutable evidence is retained only as required by product/legal/operator policy. -7. **Export/Delete:** recent-authenticated workspace owner requests are tracked through durable request evidence; complete domain orchestration remains partial. -8. **Backup:** backups follow the same sensitivity/tenant/operator controls and erasure claims must account for documented backup expiry rather than imply instantaneous physical disappearance. +7. **Export/Delete:** recent-authenticated requests use durable rights evidence; complete cross-domain orchestration remains partial. +8. **Backup:** erasure claims account for documented backup expiry rather than imply instantaneous physical disappearance. -## Current protected-main data-rights evidence +## Data-rights lifecycle **Status:** Partial -Protected main includes: +Protected main includes authentication-age provenance, fail-closed recent-auth policy, durable requests and immutable terminal receipts, tenant+actor scoped lookup, the authenticated non-cacheable public status resource from PR #146, and per-contributor export integrity evidence from PR #149. -- authentication-age provenance that survives session rotation; -- fail-closed recent-auth policy; -- authenticated workspace/requesting-user binding; -- durable data-rights request and immutable terminal receipt persistence; -- tenant-scoped request lookup bound simultaneously to request ID, workspace ID and requesting user ID; -- an authenticated public status resource from PR #146 that derives scope from the server session, returns a bounded non-cacheable lifecycle projection, and makes absent/cross-tenant requests indistinguishable; -- per-contributor export integrity evidence from PR #149 using safe business record counts, deterministic section SHA-256 and a whole-export digest. +The section/whole SHA-256 evidence is integrity metadata only; it does not prove authorization, confidentiality, provenance or signature identity. Issue #55 remains open for complete contributor participation, durable reconciliation/operator recovery, retention/legal-hold/backup-expiry evidence, protected streamed delivery/encryption/expiry and download audit. -The PR #149 digest contract is integrity evidence only. It does not prove authorization, confidentiality, provenance or signature identity and does not complete protected export delivery. - -Tracking: issue #55 remains open for complete domain participation, durable async reconciliation/operator alerts, retention/legal-hold semantics, backup-expiry evidence, protected streamed archive delivery/encryption/expiry and download audit. - -## Calendar credentials +## Calendar credentials and connections **Status:** Partial -Protected main verifies signed trusted workspace context for calendar synchronization and now includes the PR #150 durable calendar-connection registry scoped simultaneously to workspace and user. The protected repository stores bounded provider/account/calendar metadata, normalized scopes and opaque credential references rather than making provider credential plaintext part of the row contract. +Protected main includes signed workspace context (#139), the workspace+user scoped connection registry (#150), and atomic local connection revocation (#153). Connection rows carry bounded provider/account/calendar metadata and opaque credential references rather than provider-token plaintext. Local revocation ends LifeOS connection authority but does not itself prove provider-side OAuth revocation or managed-secret deletion. -That persistence foundation does not complete the hosted credential lifecycle. Authorization callback state/PKCE, a concrete managed secret backend, refresh/revocation, calendar discovery/selection and migration from the development provider configuration remain issue #129. +PR #155 is `Implemented on active PR` for a distinct short-lived signed workspace+user context needed by hosted user-sensitive calendar operations. The complete #129 lifecycle still requires OAuth state/PKCE, a concrete managed secret backend, refresh/provider revocation, discovery/selection and public hosted disconnect/runtime composition. -## Plugin credentials and installation authority +## Plugin installation and secrets **Status:** Partial -Protected main validates plugin manifests/contracts but grants no generic runtime authority. PR #151 is `Implemented on active PR` for the first host-owned installation authority: the manifest is intent, the host grants an explicit capability subset, replay/conflict is deterministic, cross-tenant/user lookup does not disclose existence, and revocation preserves evidence while ending active authority. +Protected main validates plugin manifests and, through PR #151, separates manifest intent from host-granted installation authority. Explicit capability subsets, exact replay/conflict handling, tenant/user isolation and revocation are protected behavior. -Durable installation persistence, protected plugin secret storage, SSRF-safe outbound delivery, retry/dead-letter evidence and complete revocation enforcement remain issue #130. An active installation-grant object is therefore not evidence that the complete plugin runtime exists. +Durable installation/secret persistence, protected secret handles at rest, SSRF-safe outbound delivery, retry/dead-letter evidence and delivery-time revocation enforcement remain issue #130. A granted installation is not evidence that the complete plugin runtime exists. ## Deletion semantics -No service may claim whole-workspace deletion merely because its own tables were erased. A complete deletion outcome requires every registered owning domain to participate in the exact request, deterministic reconciliation of partial outcomes, retention/legal-hold handling and immutable final evidence. Unknown/missing participants fail closed. +No service may claim whole-workspace deletion merely because its own tables were erased. Complete deletion requires every registered owning domain to participate in the exact request, deterministic reconciliation of partial/unknown outcomes, retention/legal-hold handling and immutable final evidence. Unknown or missing contributors fail closed. ## Security/privacy invariants - no browser-selected tenant authority; - no cross-service direct database access; -- no provider credential content in logs, metrics, public errors, model prompts, CI artifacts or audit rows; +- no external credential content in logs, metrics, public errors, model prompts, CI artifacts or generic metadata rows; - no raw user content in release/provenance artifacts unless explicitly authorized and bounded; -- no data-rights success claim from a partial or unknown participant state; -- no integrity digest is treated as an authorization or confidentiality control. +- no whole-right success claim from partial/unknown contributor state; +- no integrity digest is treated as access control or confidentiality; +- no plugin manifest self-authorizes host capabilities; +- no LifeOS connection-record revocation is silently promoted to provider credential revocation. From 2a3fc063b7e0bcc233674c49fe91a661daf5fb35 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 11:18:59 +0900 Subject: [PATCH 069/173] docs(architecture): reconcile protected integration authority and verification successor --- ARCHITECTURE.md | 230 +++++++++++++++++------------------------------- 1 file changed, 79 insertions(+), 151 deletions(-) diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 6557b6354..cc68965fc 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -1,200 +1,128 @@ # LifeOS architecture decisions -This document is the architectural source of truth for repository-wide product and service authority. Protected-main source, migrations, tests and live repository policy are the executable evidence for shipped behavior. Canonical PRD/TRD/data/UML/security/operability documents add code-current views; feature specifications and runbooks may add detail but must not weaken these decisions. +This document is the architectural source of truth for repository-wide product and service authority. Protected-main source, migrations, tests and live repository policy are executable evidence for shipped behavior. Canonical PRD/TRD/Data Model/UML/Security/Privacy/Operability views add code-current detail without weakening these decisions. ## 1. Product and deployment boundary -LifeOS is a privacy-first, multi-user, server-backed and self-hostable personal operating system. It remains usable as an independent product while composing with other ContextualWisdomLab bounded contexts through explicit versioned interfaces. +LifeOS is a privacy-first, multi-user, server-backed and self-hostable personal operating system. It remains independently usable while composing with other ContextualWisdomLab bounded contexts only through explicit versioned interfaces. -Earlier login-free/browser-only local-first, private-personal-only, UUIDv7 and single-application primary designs are **superseded**. Browser-local state remains valid for explicit draft/cache/offline interaction and Docker Compose remains a deployment profile, but neither becomes durable data authority or permission to collapse service ownership. +Earlier login-free/browser-only local-first, private-personal-only, UUIDv7 and single-application primary designs are **Superseded**. Browser-local state remains valid as explicit draft/cache/offline state and Docker Compose remains a deployment profile, but neither becomes durable data authority or permission to collapse service ownership. ```mermaid flowchart LR - U[Web / PWA user] --> W[Next.js web boundary] - W --> G[Gateway / BFF] - G --> I[Identity service] - G --> P[Planning service] - G --> H[Habit service] - G --> R[Review service] - G --> C[Calendar integration service] - G --> Q[Notification service] - G --> A[AI proposal service] - G --> X[Plugin integration service] - G --> V[Privacy service] - - P -. domain events .-> N[(NATS JetStream)] - H -. domain events .-> N - R -. projection events .-> N - N -. reminder/event inputs .-> Q - - I --> IDB[(Identity-owned PostgreSQL)] - P --> PDB[(Planning-owned PostgreSQL)] - H --> HDB[(Habit-owned PostgreSQL)] - R --> RDB[(Review-owned PostgreSQL)] - Q --> NDB[(Notification-owned PostgreSQL)] - A --> ADB[(AI-owned PostgreSQL)] - V --> VDB[(Privacy-owned PostgreSQL)] + U[Web / PWA] --> G[Gateway / BFF] + G --> I[Identity] + G --> P[Planning] + G --> H[Habit] + G --> R[Review] + G --> C[Calendar] + G --> N[Notification] + G --> A[AI Proposal] + G --> X[Plugin Integration] + G --> V[Privacy] + P -. events .-> J[(NATS JetStream)] + H -. events .-> J + R -. projections/events .-> J + J -. reminder/event inputs .-> N ``` -Physical co-location on one PostgreSQL cluster does not create cross-service table authority. - ### Required invariants -- Internal object identifiers are opaque UUIDv4 strings. Numeric or provider-native identifiers are explicit external mappings and never internal primary keys. -- Product-owned database object names use descriptive multiword `snake_case` unless an external standard mandates another spelling. -- Each service owns its persistence schema/role, migrations, credentials, runtime configuration, persistence adapters, tests, observability and shutdown behavior. -- Services never read or mutate another service's database tables directly. Cross-service relationships use a versioned HTTP, event, saga, plugin or MCP contract. -- Browser-local state is draft/cache/offline state until an authorized owning service confirms persistence. -- Public errors, metrics, logs, retained artifacts and review evidence exclude credentials, hidden reasoning and unnecessary unbounded tenant content. - -## 2. Identity, workspace and authentication provenance +- Internal IDs are opaque UUIDv4; provider/native IDs remain explicit external mappings. +- Product-owned DB objects use descriptive multiword `snake_case` unless an external standard mandates otherwise. +- Each service owns persistence, migrations, DB credentials, runtime configuration, tests, observability and shutdown behavior. +- Services never read or mutate another service's tables directly; cross-service relationships use versioned HTTP/event/saga/plugin/MCP contracts. +- Browser-local state is not durable until the owning service confirms persistence. +- Public errors, logs, metrics, retained artifacts and review evidence exclude credentials, hidden reasoning and unnecessary unbounded tenant content. -Identity service owns LifeOS user identity, external-provider mappings, workspace membership/authorization, browser sessions and authentication provenance. +## 2. Identity, workspace and data-rights authority -Google/GitHub OAuth transactions are server-owned and replay-resistant. Session issuance/rotation time and the underlying authentication ceremony time are different facts. Compatible session rotation preserves the original authentication instant so recent-authentication policy cannot be bypassed by refreshing a session. +Identity owns LifeOS user identity, provider mappings, workspace membership/authorization, sessions, authentication provenance and the durable data-rights request/receipt boundary. -The identity service also owns durable data-rights request identity and immutable terminal receipt evidence. Protected main includes tenant-and-requesting-actor scoped request lookup plus the authenticated public status resource merged through PR #146. That resource derives authority from the validated session, exposes only bounded lifecycle fields, is non-cacheable and does not reveal cross-tenant request existence. +Google/GitHub OAuth transactions are server-owned and replay-resistant. Authentication-ceremony time is distinct from session issuance/rotation; compatible session rotation preserves authentication age so sensitive recent-auth policy cannot be bypassed by refreshing a session. -Protected main also includes export-manifest integrity evidence from PR #149. Each contributor provides a safe business record count and LifeOS computes a deterministic SHA-256 over contributor/schema/count/bounded data plus a whole-export digest. This is integrity evidence only; it is not authorization, confidentiality, provenance or a digital signature. +Protected main includes tenant+requesting-actor scoped request lookup, the authenticated non-cacheable public status resource from PR #146, and export-manifest integrity evidence from PR #149. Export section/whole SHA-256 digests are integrity evidence only, not authorization, confidentiality, provenance or signatures. -Complete cross-domain export/erasure orchestration remains **Partial** under issue #55 because contributor completion, durable reconciliation, protected delivery, retention/legal-hold/backup-expiry and terminal whole-product completion are separate requirements. +Complete cross-domain export/erasure remains **Partial** under #55 because contributor completion, durable reconciliation, protected delivery, retention/legal-hold/backup-expiry and terminal whole-product completion are separate requirements. -```mermaid -sequenceDiagram - actor User - participant Web - participant Identity - participant Provider as Google/GitHub - participant Domain as Owning domain service - - User->>Web: Start login - Web->>Identity: Create bounded OAuth transaction - Identity->>Provider: Authorization request - Provider-->>Identity: Callback - Identity->>Identity: Validate provider/state/redirect and map identity - Identity->>Identity: Resolve authorized workspace and authentication instant - Identity-->>Web: Revocable session - User->>Web: Domain action - Web->>Identity: Validate session - Identity-->>Web: Actor/workspace/authentication provenance - Web->>Domain: Server-derived trusted context -``` +## 3. Planning, habits, review and reminders -## 3. Planning, Today, habits, reviews and reminders +Planning owns Goals, Projects, Tasks, search and durable Today state. Habit owns recurring definitions/completions. Review owns snapshots/projections without Planning/Habit mutation authority. Notification owns reminder occurrences, claims/fencing, delivery attempts and bounded outcomes. -Planning service owns Goals, Projects, Tasks, planning search and durable Today state. Habit service owns recurring habit definitions and completion evidence. Review service owns guided-review snapshots/projections without becoming planning or habit mutation authority. Notification service owns reminder occurrences, claims/fencing, delivery attempts and bounded outcomes. - -Durable Today synchronization is protected-main behavior. The browser requires an explicit local-to-workspace save, uses strong preconditions plus idempotency, and receives explicit conflict/revision evidence rather than silent stale overwrite. - -```mermaid -flowchart TB - Goal[Goal] --> Project[Project] - Project --> Task[Task] - Goal -. motivates .-> Habit[Habit] - Project -. motivates .-> Habit - Task --> TaskEvidence[Task completion evidence] - Habit --> HabitEvidence[Habit completion evidence] - TaskEvidence --> Review[Daily / weekly review] - HabitEvidence --> Review - Review -. projection only .-> PlanningView[Planning view / recommendation] -``` +Durable Today synchronization is protected-main behavior: explicit local-to-workspace save, strong create/update preconditions, idempotency and explicit stale-conflict/reconciliation evidence prevent silent overwrite. ## 4. Calendar integration boundary -Conflict-safe CalDAV/Google synchronization, signed trusted workspace context and the first service-owned `calendar_connection` persistence foundation are protected-main behavior after PR #150. The calendar service rejects the legacy model in which an arbitrary client-selected workspace header could become tenant authority. - -A connection is scoped simultaneously to workspace and user, carries bounded provider/account/calendar metadata and normalized scopes, and refers to protected provider credential material through opaque handles. The durable table is owned by the `calendar_integration` service namespace rather than a generic shared schema. - -The complete hosted per-user lifecycle remains **Partial** under issue #129: authorization callback state/PKCE, concrete managed secret storage, refresh/revocation, discovery/selection and migration from the development provider configuration are still separate work. +Conflict-safe CalDAV/Google sync and signed trusted workspace context are protected main. PR #150 added the service-owned `calendar_integration.calendar_connection_record` persistence foundation scoped simultaneously to workspace and user, with bounded provider/account/calendar metadata, normalized scopes and opaque external credential references. PR #153 added atomic tenant+user-scoped local connection revocation and replay semantics. -Provider identities/credentials never become LifeOS internal primary keys or general identity credentials. +PR #155 is **Implemented on active PR** for a distinct short-lived signed `life-os.calendar-user.v1` context binding both workspace and requesting-user UUIDv4 identities for user-sensitive hosted operations. It adds authority evidence only, not the public disconnect/runtime composition. -## 5. AI proposal safety boundary +The complete hosted lifecycle remains **Partial** under #129: OAuth state/PKCE, concrete managed secret storage, refresh/provider-side revocation, discovery/selection and migration from development provider configuration are separate gates. Provider IDs/credentials never become LifeOS primary IDs or general login credentials. -AI output is untrusted inert proposal data, not an execution command. The AI service can generate, persist, retrieve and record explicit decisions about proposals, but it has no generic planning mutation repository or command bus. - -```mermaid -sequenceDiagram - participant Browser - participant Web as Authenticated web BFF - participant Identity - participant AI as AI proposal service - participant Audit as AI-owned audit store - - Browser->>Web: Proposal request - Web->>Identity: Validate session - Identity-->>Web: Actor + workspace UUIDv4 - Web->>AI: Signed bounded actor/workspace/method/path context - AI->>AI: Validate bounded request and model output - AI->>Audit: Persist proposal evidence - AI-->>Web: Inert proposal requiring explicit decision - Browser->>Web: Accept / reject - Web->>AI: Exact proposal digest/revision + authorized decision - AI->>Audit: Append decision evidence -``` +## 5. Plugin integration boundary -Deterministic authorization, schema and proposal-quality gates remain authoritative when model providers are unavailable. Live provider execution is bounded conformance evidence, not permission to weaken deterministic correctness. +Protected main owns versioned plugin manifest/event validation and, through PR #151, explicit host-owned installation authority. A validated manifest expresses requested intent; the host grants a bounded tenant-scoped capability subset. Exact replay is permitted only for matching authority evidence, conflicting installation-ID reuse fails, cross-tenant/user existence is not disclosed, and revocation ends active authority while preserving bounded audit evidence. -## 6. Privacy and data-rights authority +Issue #130 remains **Partial** because durable installation/secret persistence, protected secret handles, authorized-origin SSRF-safe delivery, retry/dead-letter/audit and delivery-time revocation enforcement are not yet the complete protected runtime. Installation authority does not imply those capabilities exist. -Privacy service owns purpose-bound sensitive-access decisions, bounded grants and audit events. Sensitive access binds actor, workspace, resource/resource class, purpose and lifetime. Blanket masking is not the authorization model. +## 6. AI proposal boundary -Identity owns the cross-domain data-rights request/receipt lifecycle and export-manifest integrity boundary; each participating bounded context remains authoritative for its own export/erasure contribution. Whole-product completion requires durable contributor registration, reconciliation, protected delivery/erasure semantics, bounded retry/recovery, retention/legal-hold/backup-expiry handling and an immutable final receipt only after all required contributors confirm completion. +AI output is untrusted inert proposal data, never an execution command. The AI service may generate/persist/retrieve proposal evidence and append explicit accept/reject decisions, but it has no generic Planning mutation repository or command bus. Deterministic schema, authorization and quality gates remain authoritative when model providers are unavailable. -## 7. Plugin integration boundary +## 7. Privacy authority -Protected main owns versioned plugin manifest/event validation and preparation. It does not imply generic installation, durable secret persistence, unrestricted outbound delivery, inbound arbitrary commands or direct cross-service database access. +Privacy owns purpose-bound sensitive-access decisions, bounded grants and audit events. Sensitive access binds actor, workspace, resource/resource class, purpose and lifetime. Blanket masking is not the authorization model. Identity owns whole-right request orchestration identity; each bounded service remains authoritative for its own export/erasure contribution. -PR #151 is **Implemented on active PR** for the first host-owned installation authority. A validated manifest remains intent rather than authority: LifeOS explicitly grants a bounded tenant-scoped capability subset, binds exact manifest/plugin evidence, permits exact replay, rejects conflicting reuse, hides cross-tenant/user installation existence and preserves revocation evidence while ending active authority. +## 8. External integration identity, secret references and grants -Issue #130 still owns the incomplete runtime trust boundary: durable installation/secret persistence, protected secret handles, authorized-origin SSRF-safe outbound delivery, bounded retries/dead-letter/audit and complete delivery-time revocation enforcement. An active installation object does not imply those capabilities exist. +ADR 0011 is authoritative: LifeOS integration records use internal UUIDv4 identity; external provider/plugin identifiers remain bounded metadata; credential material is referenced through opaque secret handles or equivalent least-authority secret-store references; manifests cannot self-authorize capabilities; revocation/replay/conflict semantics fail closed; owning services retain migrations/repositories/API authority. -## 8. Test-time compute and model-assisted repository development +Protected #150/#151/#153 and active #155 are evidence of this boundary. Their existence does not close parent #129/#130 runtime lifecycles. -A strong single-model route is measured before deeper orchestration. Reasoning effort, workflow stage, decomposition, recursion depth, role and access topology are explicit experimental dimensions; deeper orchestration is justified by measured quality or heterogeneous capability coverage rather than agent count. +## 9. Test-time compute and repository automation -Scheduled model-assisted repository development uses the reviewed OpenCode/NVIDIA boundary with `NVIDIA_NIM_API_KEY` where model access is required. Development models do not receive product-data authority, review-agent credentials, branch-protection authority, merge authority or release authority. Deterministic reverification remains independent of the model. +A strong single-model route is measured before deeper orchestration. Reasoning effort, stage, decomposition, recursion, role and access topology are explicit experimental variables. Scheduled model-assisted development uses reviewed OpenCode with `NVIDIA_NIM_API_KEY` where model access is required; development models receive no product-data, independent-review, branch-protection, merge or release authority. Deterministic reverification remains independent. -## 9. Verification evidence identity and merge safety +## 10. Verification evidence identity and merge safety -Repository evidence has distinct identities and must not be conflated: +Repository evidence identities are distinct: -- contributor source head; -- PR base snapshot recorded by GitHub; -- independently resolved current live base-ref tip; -- synthetic merge tree; -- workflow/job checkout revision; -- protected-main integrated head; -- release artifact/source identity. +- `source_head_sha` — exact contributor/source head; +- `pr_base_snapshot_sha` — PR/event base snapshot, historical once base moves; +- `live_base_tip_sha` — independently resolved current base-ref tip; +- `merge_tree_sha` — synthetic integration tree; +- `workflow_checkout_sha` — exact tree inspected by a job; +- `protected_main_sha` — integrated protected-main evidence; +- `release_source_sha` — protected source bound to released artifacts. -Exact-source verification and merge-tree compatibility answer different questions. Active PR #147 advances issue #132 by making that distinction explicit in required workflows. Until it merges, its implementation is **Implemented on active PR**, not protected-main behavior. +ADR 0010 is authoritative. Exact-source verification and merge-tree compatibility answer different questions. Old PR #147 is **Superseded**. Clean successor PR #154 is **Implemented on active PR** and binds source-verification jobs to contributor head, AppGuardrail SARIF to the analyzed source identity, and a distinct merge-compatibility job to current-source/current-live-base parent evidence. Issue #132 remains open until that line integrates and residual required-workflow attribution is reconciled. -Pull requests follow a work-conserving loop: inspect current evidence, RCA failures, make the smallest test-first correction, rerun exact evidence, resolve only addressed threads, and merge only the unchanged exact head when live repository policy accepts it. A waiting check/reviewer/provider blocks only that lane. Administrative bypass, fabricated approval/checks and stale/predecessor evidence promotion are invalid. +Pull requests are processed work-conservingly: inspect current evidence, RCA non-passing gates, make the smallest test-first correction, rerun exact evidence, resolve only addressed findings, and merge only an unchanged head accepted by live repository policy. Waiting on one lane never authorizes stale evidence or repository-wide idle time. -## 10. Mathematical and psychometric modules +## 11. Mathematical / psychometric future constraint -LifeOS currently contains no psychometric computation service. If future product scope introduces mathematical or psychometric computation, production numerical kernels are Rust-first; CPU/GPU parity, realistic true-parameter recovery, uncertainty/coverage, multilevel/multiple-membership structure, temporal/repeated-measurement semantics, convergence and reproducibility must be established before product claims. This is a future architecture constraint, not a claim that LifeOS currently implements those models. +LifeOS currently contains no psychometric computation service. If future scope introduces mathematical/psychometric computation, production numerical kernels are Rust-first; realistic parameter recovery, uncertainty/coverage, convergence, reproducibility, CPU/GPU parity where applicable, multilevel/multiple-membership structure and temporal/repeated-measurement semantics must be established before product claims. This is a future constraint, not a current capability claim. -## 11. Documentation hierarchy +## 12. Canonical documentation graph -GitHub must reconstruct current LifeOS without chat history or old PR archaeology. The canonical graph is: +GitHub must reconstruct LifeOS without chat/old-PR archaeology: -1. `AGENTS.md` — repository-wide agent/merge rules. -2. `ARCHITECTURE.md` — durable product/service authority and boundaries. -3. `docs/PRD.md` — buyer/user outcomes, requirements and maturity. -4. `docs/TRD.md` — shared technical/security/data/release requirements. -5. `docs/adr/README.md` plus ADRs — durable decisions, alternatives and supersession. -6. `docs/DATA_MODEL.md` — logical service-owned ERD; migrations remain physical truth. -7. `docs/UML.md` — product, authority, state, failure and deployment views. -8. `docs/API_CONTRACTS.md` — repository-level API/event ownership/evolution registry. -9. `SECURITY.md` and `docs/THREAT_MODEL.md` — reporting policy and architectural threats. -10. `docs/PRIVACY_DATA_LIFECYCLE.md` — sensitive-data, credential and rights lifecycle. -11. `docs/TEST_STRATEGY.md` — deterministic/live validation evidence. -12. `docs/OPERABILITY.md` — deployment, diagnostics, backup and recovery boundaries. -13. `docs/RELEASE_AND_MIGRATION.md` — versioning, migration and rollback contract. -14. `docs/STANDARDS_TRACEABILITY.md` — standards/research evidence classes. -15. `docs/TRACEABILITY.md` — requirement/decision -> source/test/issue/PR evidence. -16. `docs/DOCUMENTATION_ASSESSMENT.md` — documentation fitness and historical reconciliation. -17. `CLAUDE.md`, `README.md`, `CHANGELOG.md` and scoped specs/plans/runbooks — discoverability and supporting evidence. +1. `AGENTS.md` +2. `ARCHITECTURE.md` +3. `docs/PRD.md` +4. `docs/TRD.md` +5. `docs/adr/README.md` + ADRs +6. `docs/DATA_MODEL.md` +7. `docs/UML.md` +8. `docs/API_CONTRACTS.md` +9. `SECURITY.md` + `docs/THREAT_MODEL.md` +10. `docs/PRIVACY_DATA_LIFECYCLE.md` +11. `docs/TEST_STRATEGY.md` +12. `docs/OPERABILITY.md` +13. `docs/RELEASE_AND_MIGRATION.md` +14. `docs/STANDARDS_TRACEABILITY.md` +15. `docs/TRACEABILITY.md` +16. `docs/DOCUMENTATION_ASSESSMENT.md` +17. `CLAUDE.md`, `README.md`, `CHANGELOG.md`, scoped specs/plans/runbooks. -Canonical status fields use only `Implemented on protected main`, `Implemented on active PR`, `Partial`, `Accepted architecture`, `Planned`, `Research only`, `Superseded`, or `Out of scope`. File age, file presence and historically resolved review comments do not prove semantic currentness. A material behavior/authority change is documentation-incomplete until the corresponding canonical views and executable documentation contracts reconcile the claim. +Canonical status fields use only `Implemented on protected main`, `Implemented on active PR`, `Partial`, `Accepted architecture`, `Planned`, `Research only`, `Superseded`, or `Out of scope`. File age, presence and historically resolved reviews do not prove semantic currentness. A material authority change is documentation-incomplete until relevant canonical views and executable documentation contracts reconcile it. From 71ac058d82fda933e5a374a7e6d894d4184fcce5 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 11:19:42 +0900 Subject: [PATCH 070/173] docs(uml): reconcile current integration and verification flows --- docs/UML.md | 256 ++++++++++++++++++++++++---------------------------- 1 file changed, 120 insertions(+), 136 deletions(-) diff --git a/docs/UML.md b/docs/UML.md index e8fd38e5f..509e9f374 100644 --- a/docs/UML.md +++ b/docs/UML.md @@ -2,7 +2,7 @@ **Status:** Implemented on active PR -These diagrams describe current protected-main behavior unless a section is explicitly labeled `Implemented on active PR`, `Partial`, `Planned`, or another canonical status. +Sections are protected-main behavior unless explicitly labeled otherwise. ## Bounded-context topology @@ -20,194 +20,180 @@ flowchart LR B --> A[AI Proposal] B --> V[Privacy] B --> X[Plugin Integration] - P -. domain events .-> J[(NATS JetStream)] - H -. domain events .-> J - R -. projection/events .-> J + P -. events .-> J[(NATS JetStream)] + H -. events .-> J + R -. projections/events .-> J J -. reminder/event inputs .-> N - - I --> IDB[(identity-owned PostgreSQL)] - P --> PDB[(planning-owned PostgreSQL)] - H --> HDB[(habit-owned PostgreSQL)] - R --> RDB[(review-owned PostgreSQL)] - N --> NDB[(notification-owned PostgreSQL)] - A --> ADB[(AI-owned PostgreSQL)] - V --> VDB[(privacy-owned PostgreSQL)] ``` -Physical co-location does not grant cross-service table authority. +Every bounded context retains its own persistence/migration/credential authority. -## Login and workspace sequence +## Login / workspace authority **Status:** Implemented on protected main ```mermaid sequenceDiagram - participant Browser + actor User participant Web participant Identity participant Provider as Google/GitHub - Browser->>Web: begin login - Web->>Identity: create bounded OAuth transaction - Identity->>Provider: authorization request - Provider-->>Identity: callback code/state - Identity->>Identity: validate provider/state/redirect and map external identity - Identity->>Identity: provision/authorize personal workspace + authentication instant - Identity-->>Web: revocable session + opaque account/workspace UUIDv4 - Web-->>Browser: secure session cookie + User->>Web: begin login + Web->>Identity: bounded OAuth transaction + Identity->>Provider: authorization + Provider-->>Identity: callback + Identity->>Identity: validate provider/state/redirect + Identity->>Identity: map user + workspace + authentication instant + Identity-->>Web: revocable session ``` Session rotation does not manufacture a new authentication ceremony. -## Goal / Project / Task / Today lifecycle +## Goal / Project / Task / Habit / Today / Review **Status:** Implemented on protected main +```mermaid +flowchart TB + Goal --> Project --> Task + Goal -. motivates .-> Habit + Project -. motivates .-> Habit + Task --> TaskEvidence[Task completion] + Habit --> HabitEvidence[Habit completion] + TaskEvidence --> Review + HabitEvidence --> Review + Review -. projection only .-> PlanningView[Planning view] +``` + ```mermaid stateDiagram-v2 [*] --> LocalDraft LocalDraft --> DurableToday: explicit save + precondition - DurableToday --> DurableToday: versioned update - DurableToday --> Conflict: stale strong precondition - Conflict --> DurableToday: recheck + explicit reconciliation - DurableToday --> Completed: explicit completion + DurableToday --> DurableToday: versioned update / exact replay + DurableToday --> Conflict: stale precondition + Conflict --> DurableToday: explicit reconcile + DurableToday --> Completed Completed --> [*] ``` -The durable Today aggregate, local-to-workspace migration, replay protection and stale reconciliation are implemented on protected main through PR #127. +## Calendar sync and connection lifecycle -## Review flow - -**Status:** Implemented on protected main - -```mermaid -sequenceDiagram - participant User - participant Review - participant Planning - participant Habit - User->>Review: start daily/weekly review - Review->>Planning: read bounded planning evidence - Review->>Habit: read completion evidence - Review->>Review: build review projection/snapshot - Review-->>User: guided review result - Note over Review,Planning: Review never mutates Planning tables directly. -``` - -## Calendar synchronization +### Workspace-only sync context **Status:** Implemented on protected main ```mermaid sequenceDiagram participant Web - participant Identity participant Calendar participant Provider - Web->>Identity: validate session / derive workspace - Identity-->>Web: workspace authority Web->>Calendar: signed workspace context + bounded sync request - Calendar->>Calendar: verify signature, issuance, method/path and UUIDv4 workspace + Calendar->>Calendar: verify signature/freshness/workspace Calendar->>Provider: conflict-safe provider operation - Provider-->>Calendar: bounded untrusted response - Calendar-->>Web: sanitized sync result + Provider-->>Calendar: bounded response / precondition evidence + Calendar-->>Web: sanitized result ``` -## Calendar connection registry foundation +### Connection persistence and local revocation **Status:** Implemented on protected main -**Evidence:** PR #150 merged as `1623df364925f84920c07c112f1ae96777277d20`; full hosted credential lifecycle remains `Partial` under issue #129. +```mermaid +stateDiagram-v2 + [*] --> ConnectionCreated: #150 workspace+user scoped create + ConnectionCreated --> ConnectionCreated: exact scoped lookup/replay + ConnectionCreated --> Revoked: #153 atomic tenant+user revoke + Revoked --> Revoked: exact revocation replay + Revoked --> [*] +``` + +Connection metadata carries opaque secret references. Local revocation does not imply provider-side OAuth revocation. + +### User-aware hosted authority + +**Status:** Implemented on active PR + +**Evidence:** PR #155. ```mermaid sequenceDiagram participant Caller participant Calendar - participant Repo as Calendar connection repository - participant Pg as Calendar-owned PostgreSQL - - Caller->>Calendar: trusted workspace + user + provider/account/calendar metadata + opaque credential references - Calendar->>Calendar: validate UUIDv4 authority, provider and normalized scopes - Calendar->>Repo: create / scoped lookup - Repo->>Pg: fixed parameterized SQL - alt valid unique evidence - Pg-->>Repo: one workspace+user scoped connection record - Repo-->>Calendar: immutable bounded record - else malformed input or duplicate persisted evidence - Repo-->>Calendar: fail closed + Caller->>Calendar: workspace UUIDv4 + user UUIDv4 + issued-at + HMAC + Calendar->>Calendar: verify `life-os.calendar-user.v1`, identifiers, signature and freshness + alt valid + Calendar-->>Caller: frozen workspace+user authority + else substituted/stale/future/malformed/unconfigured + Calendar-->>Caller: fail closed without credential leakage end ``` -The protected migration/repository is a persistence foundation only; OAuth callback state, managed secret storage, refresh/revocation and discovery/selection remain separate issue #129 work. +Public disconnect, managed-secret operations, OAuth PKCE/refresh/provider revoke/discovery remain later #129 work. -## AI proposal / evidence / decision +## AI proposal / decision **Status:** Implemented on protected main ```mermaid sequenceDiagram - participant Browser + actor User participant Web participant Identity participant AI participant Audit - Browser->>Web: proposal request + User->>Web: request proposal Web->>Identity: validate session - Identity-->>Web: actor + workspace UUIDv4 - Web->>AI: signed actor/workspace/method/path context - AI->>AI: bound/validate untrusted model output - AI->>Audit: persist immutable proposal evidence - AI-->>Web: inert proposal - Browser->>Web: explicit accept/reject - Web->>AI: authorized decision bound to proposal digest/revision - AI->>Audit: append decision evidence + Identity-->>Web: actor + workspace + Web->>AI: signed bounded context + AI->>AI: validate untrusted model result + AI->>Audit: persist inert proposal evidence + AI-->>User: proposal + User->>AI: explicit accept/reject bound to exact proposal evidence + AI->>Audit: append decision ``` -## Data-rights request and status lifecycle +## Data-rights lifecycle + +### Request / status **Status:** Implemented on protected main ```mermaid sequenceDiagram actor User - participant Identity as Identity HTTP boundary - participant Session as Session introspection - participant Ledger as identity.data_rights_requests - - User->>Identity: create or query data-rights request - Identity->>Session: validate session + recent-auth provenance where required - Session-->>Identity: userId + workspaceId - Identity->>Ledger: tenant+actor scoped request operation - alt owned request - Ledger-->>Identity: durable request - Identity-->>User: bounded public lifecycle + no-store - else absent or other tenant - Ledger-->>Identity: undefined - Identity-->>User: indistinguishable 404 + no-store - else malformed / unauthenticated / dependency failure - Identity-->>User: bounded 400 / 401 / 503 + no-store + participant Boundary as Identity HTTP boundary + participant Session + participant Ledger + User->>Boundary: request or status query + Boundary->>Session: validate session / recent-auth as required + Session-->>Boundary: workspace + user + Boundary->>Ledger: request ID + workspace + requesting user + alt owned + Ledger-->>Boundary: durable state + Boundary-->>User: bounded no-store lifecycle projection + else absent/other tenant + Boundary-->>User: indistinguishable 404 + else invalid/dependency failure + Boundary-->>User: bounded 400/401/503 end ``` -PR #146 is protected-main evidence for the authenticated public status resource. Complete cross-domain export/deletion remains `Partial` under issue #55. - -## Tenant export integrity flow +### Export integrity **Status:** Implemented on protected main -**Evidence:** PR #149. - ```mermaid flowchart LR - C[Domain contributor] --> S[Schema version + safe record count + bounded JSON] - S --> N[Deterministic normalization / UTF-16 key ordering] - N --> D[Section SHA-256] - D --> M[Ordered export manifest] - M --> W[Whole-export SHA-256] + Contributor --> Section[Schema + safe record count + bounded JSON] + Section --> Normalize[Deterministic UTF-16 property ordering] + Normalize --> Digest[Section SHA-256] + Digest --> Manifest[Ordered manifest] + Manifest --> Whole[Whole-export SHA-256] ``` -Integrity digests do not grant access authority, confidentiality, provenance or signature identity. +Complete cross-domain orchestration/delivery remains **Partial** under #55. -## Purpose-bound sensitive-data access +## Purpose-bound sensitive access **Status:** Implemented on protected main @@ -224,71 +210,69 @@ sequenceDiagram ## Plugin installation authority -**Status:** Implemented on active PR - -**Evidence:** PR #151; full runtime remains incomplete under issue #130. +**Status:** Implemented on protected main ```mermaid stateDiagram-v2 [*] --> ValidatedManifest - ValidatedManifest --> GrantedInstallation: explicit host capability subset - GrantedInstallation --> GrantedInstallation: exact replay - GrantedInstallation --> Conflict: incompatible installation-id reuse - GrantedInstallation --> Revoked: explicit revocation + ValidatedManifest --> Granted: explicit host capability subset + Granted --> Granted: exact replay + Granted --> Conflict: incompatible installation identity reuse + Granted --> Revoked: explicit revoke Revoked --> [*] Conflict --> [*] ``` -A manifest requests capabilities but does not grant them. This active application authority does not imply durable plugin-secret or outbound-delivery persistence exists. +PR #151 protects this authority. Durable plugin-secret persistence/outbound delivery remain **Partial** under #130. -## Backup / restore and deployment +## Backup / deployment **Status:** Implemented on protected main ```mermaid flowchart TB - Ingress[Ingress / TLS] --> Web[Web/BFF] + Client --> Ingress[Operator-owned ingress/TLS/DNS] + Ingress --> Web Web --> Services[Independent LifeOS services] Services --> Pg[(Service-owned PostgreSQL authority)] Services <--> NATS[(NATS JetStream)] - Operator[Operator secret manager / network policy / backups / monitoring] -. configures .-> Services + Services --> Providers[Identity / Calendar / Model / Plugin endpoints] ``` -Logical backup/restore verifies integrity and unsafe-target refusal; it does not claim PITR or managed infrastructure ownership. +Logical backup/restore verifies integrity and safe targets; it does not claim PITR or managed surrounding infrastructure. -## Verification evidence identity +## Verification evidence state **Status:** Implemented on active PR -**Evidence:** ADR 0010 and PR #147. +**Evidence:** ADR 0010 and clean successor PR #154; #147 is Superseded. ```mermaid flowchart LR Source[source_head_sha] --> SourceCheck[Exact source verification] - BaseSnapshot[pr_base_snapshot_sha] --> PRMetadata[Historical PR-base evidence] + BaseSnapshot[pr_base_snapshot_sha] --> Metadata[Historical PR snapshot] LiveBase[live_base_tip_sha] --> MergeDecision[Current base-sensitive decision] Source --> MergeTree[merge_tree_sha] LiveBase --> MergeTree - MergeTree --> MergeCheck[Integration compatibility] - SourceCheck --> Gate[Merge/release evidence decision] + MergeTree --> MergeCheck[Compatibility evidence] + SourceCheck --> Gate MergeCheck --> Gate MergeDecision --> Gate Gate --> Main[protected_main_sha] Main --> Release[release_source_sha] ``` -No green status is silently transferred across evidence identities. Issue #132 remains open until PR #147 integrates and residual required-workflow attribution is reconciled. +No green result transfers authority across identities. PR #154 additionally requires the checked synthetic merge parents to match fresh current source and current live base evidence. ## Degraded modes **Status:** Accepted architecture -```mermaid -flowchart LR - ProviderDown[Identity/calendar/model provider unavailable] --> BoundedFailure[Sanitized dependency-unavailable result] - DbDown[Owning DB unavailable] --> NoFalseSuccess[Fail without durable-success claim] - StaleWrite[Stale revision/precondition] --> Conflict[Explicit conflict] - BadContext[Malformed/forged context] --> Deny[Fail closed] - ModelDown[Model unavailable] --> Deterministic[Deterministic product gates remain available] - UnknownEvidence[Unknown workflow checkout/evidence identity] --> EvidenceUnavailable[Fail closed / unavailable evidence] -``` +| Failure | Required behavior | +| --- | --- | +| Identity/calendar/model provider unavailable | Bounded dependency failure; unrelated product domains remain usable where safe | +| Owning PostgreSQL unavailable | Durable mutation fails closed; browser draft is not mislabeled durable | +| NATS unavailable | No fabricated delivery success; replay/recovery semantics apply | +| Stale write | Explicit conflict/revision evidence, never silent overwrite | +| Malformed/forged internal context | Fail closed without reflecting secrets or untrusted identifiers | +| Unknown/stale verification identity | Evidence unavailable/non-passing rather than promoted success | From 09f7d2403bbbcf8fd023caf380d757129b9342df Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 11:21:43 +0900 Subject: [PATCH 071/173] docs(assessment): refresh current protected and active maturity --- docs/DOCUMENTATION_ASSESSMENT.md | 111 ++++++++++++------------------- 1 file changed, 43 insertions(+), 68 deletions(-) diff --git a/docs/DOCUMENTATION_ASSESSMENT.md b/docs/DOCUMENTATION_ASSESSMENT.md index 1d9ecc7bb..9f8669bd7 100644 --- a/docs/DOCUMENTATION_ASSESSMENT.md +++ b/docs/DOCUMENTATION_ASSESSMENT.md @@ -4,100 +4,75 @@ ## Verdict -The historical LifeOS material is extensive but was not sufficient as one code-current whole-product authority. The project moved through materially different product models: browser-only/login-free local-first, public multi-user server persistence, a single-Docker deployment direction, and finally domain-oriented modular MSA. Protected-main implementation also continued after the first canonical documentation branch diverged. +Historical LifeOS material was extensive but not sufficient as one code-current whole-product authority. The project moved through materially different product models: browser-only/login-free local-first, public multi-user server persistence, a single-Docker direction, and finally domain-oriented modular MSA. Protected-main implementation also continued after the first canonical docs branch diverged. -PR #145 is the single canonical successor. Its documentation family coverage is now **design-sufficient in scope**: PRD, TRD, root Architecture, detailed ADRs, logical ERD/Data Model, UML, API/event contracts, Security, Threat Model, Privacy/Data Lifecycle, Test Strategy, Operability, Release/Migration/Rollback, Standards/Research and Requirements Traceability are present with machine-checkable consistency rules. The repository remains **protected-main documentation insufficient** until this successor is reconciled with the current live base, passes exact-current-head checks/review, and merges. Documentation sufficiency is not product or release completion. +PR #145 is the single canonical successor. Its family coverage is now **design-sufficient in scope**: PRD, TRD, root Architecture, detailed ADRs, logical ERD/Data Model, UML, API/event contracts, Security, Threat Model, Privacy/Data Lifecycle, Test Strategy, Operability, Release/Migration/Rollback, Standards/Research and Requirements Traceability exist with machine-checkable consistency rules. The repository remains **protected-main documentation insufficient** until this exact successor is current against live main, passes exact-head CI/security/review/documentation contracts, and integrates. Documentation sufficiency is never product/release completion. ## Fitness matrix -| Family | Assessment on this branch | Maturity | Notes | +| Family | Assessment on #145 | Maturity | Notes | | --- | --- | --- | --- | -| PRD | Present-current | Implemented on active PR | Product journey, historical drift, protected #146/#149/#150 and active #147/#151 are explicit | -| TRD | Present-current | Implemented on active PR | Shared runtime, service authority, data, HTTP/event, concurrency, AI/security/ops/release requirements | -| Root Architecture | Present-current on this successor | Implemented on active PR | Semantically reconciles Identity rights/integrity, durable Today, protected calendar registry, active plugin authority, Notification/Privacy ownership and canonical graph | -| ADR index/detailed decisions | Present-current | Implemented on active PR | ADR 0001-0011 including verification evidence identity and external integration authority | -| Logical ERD/Data Model | Present-current | Implemented on active PR | Service ownership and conceptual-vs-persisted status are explicit; protected #150 persistence and active #151 non-persistence are distinguished | -| UML | Present-current | Implemented on active PR | topology, login, Today, review, calendar, AI, rights/status/integrity, plugin authority, verification evidence, backup/deployment and degraded modes | -| API/event contracts | Present-current | Implemented on active PR | Registry separates protected-main #146/#149/#150, active #151/#147 and still-partial parent gaps | -| Security | Present-current on protected main | Implemented on protected main | Root `SECURITY.md` remains vulnerability-reporting authority | -| Threat model | Present-current | Implemented on active PR | Trust boundaries and current partial/planned threats are explicit | -| Privacy/data lifecycle | Present-current | Implemented on active PR | Rights status/integrity plus protected calendar metadata and active plugin authority remain separated from incomplete full lifecycles | -| Test strategy | Present-current | Implemented on active PR | Realistic DB/browser/security/concurrency and documentation-evidence policy | -| Operability | Present-current | Implemented on active PR | Deployment/readiness/observability/failure/backup/migration/release boundaries | -| Release/migration/rollback | Present-current | Implemented on active PR | Exact integrated release and state-change recovery semantics | -| Standards/research | Present-current | Implemented on active PR | Final-vs-draft distinction and APA 7 anchors; scoped feature research remains detailed evidence | -| Requirements traceability | Present-current | Implemented on active PR | Requirement/decision -> protected source or exact active PR -> remaining issue evidence | -| README/AGENTS/CLAUDE/CHANGELOG alignment | Partial | Partial | Canonical discoverability exists on the successor; protected-main integration is still pending and live root policy must be preserved semantically | -| Machine-checkable documentation consistency | Present-current on this successor | Implemented on active PR | Contract tests check required files/links/status vocabulary/ADRs/root semantic claims and current protected-vs-active maturity | - -## Why file presence was not enough - -The prior baseline initially treated an existing root document as current because it was newer than an older documentation donor. Semantic comparison showed that chronology was not a sufficient correctness criterion. Root documentation had to be reconciled with later Identity authentication/data-rights authority, durable Today, trusted calendar workspace context, Notification/Privacy persistence ownership and the canonical documentation graph. - -The repository rule is therefore: **semantic evidence outranks file age**. A newer document is stale whenever protected-main source or accepted authority has outgrown the described contract. +| PRD | Present-current | Implemented on active PR | protected #146/#149/#150/#151/#153 and active #154/#155 are separated | +| TRD | Present-current | Implemented on active PR | shared runtime, authority, data, API/event, concurrency, AI/security/ops/release contracts | +| Root Architecture | Present-current | Implemented on active PR | semantically reconciled with current Identity/Today/Calendar/Plugin/Privacy/Notification and verification authority | +| ADR index / decisions | Present-current | Implemented on active PR | ADR 0001-0011 including evidence identity and external-integration authority | +| Logical ERD / Data Model | Present-current | Implemented on active PR | protected calendar persistence/revocation and non-persisted plugin logical targets distinguished | +| UML | Present-current | Implemented on active PR | topology, login, Today/review, calendar, AI, rights, plugin, verification, deployment/degraded modes | +| API/event contracts | Present-current | Implemented on active PR | protected foundations, active successors and still-partial parent gaps separated | +| Security | Present-current | Implemented on protected main | root `SECURITY.md` vulnerability-reporting authority | +| Threat model | Present-current | Implemented on active PR | trust boundaries and residual gaps explicit | +| Privacy/Data Lifecycle | Present-current | Implemented on active PR | rights, credential-reference, revocation and plugin authority boundaries distinguished | +| Test Strategy | Present-current | Implemented on active PR | realistic DB/browser/security/concurrency/evidence policy | +| Operability | Present-current | Implemented on active PR | deployment/readiness/observability/failure/backup/recovery boundaries | +| Release/Migration/Rollback | Present-current | Implemented on active PR | one exact integrated release-source contract | +| Standards/Research | Present-current | Implemented on active PR | source-class/final-vs-draft discipline and APA 7 anchors | +| Requirements Traceability | Present-current | Implemented on active PR | requirement/decision -> protected source or exact active PR -> remaining issue | +| README/AGENTS/CLAUDE/CHANGELOG alignment | Partial | Partial | discoverability exists on successor; protected-main integration is still pending | +| Machine-checkable documentation consistency | Present-current | Implemented on active PR | semantic currentness, status vocabulary, ADRs, links, lifecycle maturity and evidence identity are gated | ## Historical drift reconciled -1. **Private/login-free local-first -> public multi-user server-backed/self-hostable:** browser-local state is draft/cache/offline state, not the system of record. -2. **Single Docker app -> modular MSA:** Compose remains a profile; service authority does not collapse. -3. **UUIDv7 proposal -> UUIDv4 protected-main invariant:** current internal IDs are opaque UUIDv4. -4. **Post-MVP labels -> evidence maturity:** capabilities are classified from live code/tests, not old roadmap labels. -5. **Configured capability maturity -> whole-product readiness:** buyer-gap exhaustion is a separate evidence dimension. -6. **Generic green check -> explicit evidence identity:** source head, PR-base snapshot, live base, synthetic merge, workflow checkout, protected main and release source are distinct authorities under ADR 0010. -7. **External integration metadata -> ambient authority:** ADR 0011 separates LifeOS-owned integration identity, provider/plugin metadata, secret references and explicitly granted capabilities. +1. **Private/login-free local-first -> public multi-user server-backed/self-hostable.** Browser-local state is explicit draft/cache/offline state. +2. **Single Docker application -> modular MSA.** Compose remains a profile, not authority collapse. +3. **UUIDv7 -> UUIDv4.** Internal product IDs are opaque UUIDv4. +4. **Old post-MVP labels -> evidence maturity.** Protected source/tests outrank roadmap prose. +5. **Capability maturity -> buyer-gap exhaustion.** These are independent evidence dimensions. +6. **Generic green status -> explicit evidence identity.** ADR 0010 separates source head, PR-base snapshot, live base, merge tree, workflow checkout, protected main and release source. +7. **External integration metadata -> ambient authority.** ADR 0011 separates LifeOS identity, provider/plugin metadata, secret references and explicit capability grants. -## Protected-main evolution reconciled +## Protected-main evolution currently represented -Current protected main includes: +Protected main includes durable Today (#127), trusted calendar workspace context (#139), recent-auth/data-rights prerequisites (#134/#136/#137), durable rights ledger (#138), tenant+actor status lookup (#144), authenticated public rights status (#146), export integrity evidence (#149), workspace+user calendar connection persistence (#150), explicit plugin installation grants (#151), migration-fixture reliability repair (#152), and atomic calendar connection revocation (#153). -- durable Today synchronization (#127); -- readiness/buyer-gap accounting and bounded OpenCode hardening; -- authentication-age/recent-auth data-rights prerequisites (#134/#136/#137); -- durable data-rights request/terminal receipt persistence (#138); -- tenant-and-requesting-actor scoped request lookup (#144); -- signed trusted calendar workspace context (#139); -- authenticated non-cacheable public data-rights status resource (#146); -- per-section tenant-export integrity metadata and deterministic SHA-256 evidence (#149); -- workspace-and-user-scoped calendar connection persistence with opaque secret handles (#150), merged as `1623df364925f84920c07c112f1ae96777277d20`. +The old documentation PR #126 is superseded. It is not evidence merely because historical review threads were once resolved. -The old documentation PR #126 became materially diverged while protected work integrated and is superseded by the clean successor instead of being merged with obsolete implementation ancestry. +## Active work represented without promotion -## Active implementation that documentation must not promote prematurely - -### PR #147 — verification evidence identity +### PR #154 — verification evidence identity **Status:** Implemented on active PR -PR #147 advances issue #132 by separating exact contributor source-head verification from synthetic merge-tree compatibility and making evidence attribution explicit. ADR 0010 records the timeless identity model. It is not protected-main behavior until integration. +Clean successor #154 replaces superseded #147. It separates exact contributor-head checks from synthetic merge compatibility, binds AppGuardrail SARIF to the analyzed source identity, obtains current source/live-base evidence through authenticated GitHub API calls, retains merge parents for verification and rejects identity mismatch. Issue #132 remains open until integration/residual workflow attribution closes. -### PR #151 — plugin installation authority +### PR #155 — calendar workspace+user authority **Status:** Implemented on active PR -PR #151 makes plugin installation authority explicit at the application boundary: manifest intent is separated from host-granted capabilities, exact replay is bounded, conflicting reuse fails, cross-tenant/user lookup does not disclose existence and revocation ends active authority. Durable installation/secret persistence and outbound delivery remain issue #130. +PR #155 adds the distinct short-lived `life-os.calendar-user.v1` authority context that binds both workspace and requesting user. It is a prerequisite for hosted user-sensitive calendar operations, not evidence that public disconnect/OAuth/managed-secret/refresh/provider-revocation/discovery are complete. -## Current product gaps that must remain explicit +## Remaining product gaps -- **Partial:** complete tenant export/deletion orchestration — #55, despite protected #146/#149 progress. -- **Partial:** complete per-user calendar credential lifecycle — #129, despite protected #150 persistence foundation. -- **Planned/Partial by slice:** complete plugin secret/outbound delivery runtime — #130, with active #151 authority foundation. -- **Implemented on active PR:** verification evidence identity hardening — PR #147 / issue #132 until integration and residual workflow reconciliation. +- **Partial:** #55 complete export/deletion orchestration, despite protected #146/#149. +- **Partial:** #129 complete per-user calendar credential lifecycle, despite protected #150/#153 and active #155. +- **Partial:** #130 complete plugin secret/outbound-delivery runtime, despite protected #151 installation authority. +- **Implemented on active PR:** #132 verification-evidence attribution via #154 until protected integration/residual closure. ## Sufficiency criteria -The documentation line is design-sufficient only when: - -- every canonical family is discoverable; -- statuses use the exact vocabulary; -- ADR index/targets and required decision sections are valid; -- Mermaid/code fences are balanced; -- root Architecture and canonical documents match protected-main service ownership and implemented authority; -- active PR behavior is labeled active rather than shipped; -- requirements and buyer gaps map to source/test/issue/PR evidence; -- documentation contracts fail when semantic recency regresses, not merely when a file disappears. +The documentation line is design-sufficient only when canonical families are discoverable, statuses use exact vocabulary, ADR targets/sections are valid, diagrams are balanced, root Architecture matches protected service authority, active behavior is not called shipped, requirements/gaps map to executable evidence, and semantic-regression tests fail when currentness drifts. -The repository becomes protected-main documentation sufficient only after PR #145 passes exact-current-head CI/security/review/documentation contracts and integrates against a freshly verified live base without regressing current source/policy. +The repository is protected-main documentation sufficient only after PR #145 passes current exact-head checks/security/review and integrates against a freshly resolved live base without regressing current source/policy. ## Continuation rule -Documentation integration is a governance gate, never product-completion. After documentation work the autonomous maintenance queue immediately returns to non-documentation execution: integrate or repair #147 when policy permits, finish #151 after its reliability prerequisite, and continue the remaining #55/#129/#130/#132 work plus subsequently discovered buyer/security/reliability/operability gaps. +Documentation completion is a governance gate only. The autonomous queue must continue #154/#155 and the remaining #55/#129/#130/#132 work, plus newly discovered buyer/security/reliability/operability gaps, rather than stopping on a green documentation pack. From 6bd1005345ee9eda7f3674026bd569482b0b93cc Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 11:22:32 +0900 Subject: [PATCH 072/173] test(docs): reconcile protected and active lifecycle truth --- .../src/documentation-contract.test.mjs | 96 ++++++++----------- 1 file changed, 40 insertions(+), 56 deletions(-) diff --git a/packages/commercial-readiness/src/documentation-contract.test.mjs b/packages/commercial-readiness/src/documentation-contract.test.mjs index e22586ebe..8fb306a7a 100644 --- a/packages/commercial-readiness/src/documentation-contract.test.mjs +++ b/packages/commercial-readiness/src/documentation-contract.test.mjs @@ -41,8 +41,7 @@ function text(path) { /** Returns local Markdown link targets from one Markdown document. */ function localLinks(relativePath) { - const body = text(relativePath); - return [...body.matchAll(/\[[^\]]+\]\(([^)]+)\)/gu)] + return [...text(relativePath).matchAll(/\[[^\]]+\]\(([^)]+)\)/gu)] .map((match) => match[1].split('#', 1)[0]) .filter((target) => target && !/^[a-z][a-z0-9+.-]*:/iu.test(target)); } @@ -69,7 +68,6 @@ function tableCells(line) { .map((value) => value.trim()); } -/** Returns whether cells form a Markdown table separator row. */ function isSeparatorRow(cells) { return cells.length > 0 && cells.every((cell) => /^:?-{3,}:?$/u.test(cell)); } @@ -89,8 +87,10 @@ function tableStatuses(body) { for (let rowIndex = index + 2; rowIndex < lines.length; rowIndex += 1) { if (!lines[rowIndex].trimStart().startsWith('|')) break; const cells = tableCells(lines[rowIndex]); - if (cells.length !== headers.length || isSeparatorRow(cells)) continue; - statuses.push(cells[statusIndex]); + if (cells.length !== headers.length && !isSeparatorRow(cells)) continue; + if (cells.length === headers.length && !isSeparatorRow(cells)) { + statuses.push(cells[statusIndex]); + } } } return statuses; @@ -131,17 +131,8 @@ test('ADR index targets every material ADR and ADRs satisfy the quality contract .filter((name) => /^\d{4}-.+\.md$/u.test(name)) .sort(); const requiredNumbers = new Set([ - '0001', - '0002', - '0003', - '0004', - '0005', - '0006', - '0007', - '0008', - '0009', - '0010', - '0011', + '0001', '0002', '0003', '0004', '0005', '0006', + '0007', '0008', '0009', '0010', '0011', ]); for (const number of requiredNumbers) { @@ -152,8 +143,7 @@ test('ADR index targets every material ADR and ADRs satisfy the quality contract const number = file.slice(0, 4); assert.ok(index.includes(`[${number}](${file})`), `${file} missing exact index target`); const body = text(`docs/adr/${file}`); - const status = metadataStatuses(body)[0]; - assert.ok(status !== undefined && STATUSES.includes(status), `${file} has invalid status`); + assert.ok(STATUSES.includes(metadataStatuses(body)[0]), `${file} has invalid status`); for (const heading of [ '## Context', '## Decision', @@ -178,79 +168,73 @@ test('canonical Markdown keeps balanced fenced code blocks', () => { } }); -test('documentation claims are anchored to repository authority', () => { - const agents = text('AGENTS.md'); +test('root architecture remains semantically anchored to protected-main authority', () => { const architecture = text('ARCHITECTURE.md'); + const agents = text('AGENTS.md'); const dataRights = text('apps/identity-service/src/data-rights.ts'); const proposals = text('apps/ai-service/src/proposal-service.ts'); - const dataModel = text('docs/DATA_MODEL.md'); - const threatModel = text('docs/THREAT_MODEL.md'); assert.match(agents, /Internal identifiers are opaque UUIDv4 strings/u); assert.match(dataRights, /UUID_V4_PATTERN/u); - assert.match(dataRights, /-4\[0-9a-f\]\{3\}/u); - assert.match(architecture, /never read or mutate another service's database tables directly/u); - assert.match(architecture, /authentication ceremony time/u); + assert.match(architecture, /never read or mutate another service's tables directly/u); + assert.match(architecture, /Authentication-ceremony time is distinct/u); assert.match(architecture, /Durable Today synchronization is protected-main behavior/u); - assert.match(architecture, /signed trusted workspace context/u); - assert.match(architecture, /Privacy service owns purpose-bound sensitive-access decisions/u); - assert.match(architecture, /Notification service owns reminder occurrences/u); + assert.match(architecture, /PR #150 added/u); + assert.match(architecture, /PR #153 added atomic/u); + assert.match(architecture, /PR #151/u); + assert.match(architecture, /Privacy owns purpose-bound sensitive-access decisions/u); + assert.match(architecture, /Notification owns reminder occurrences/u); assert.match(architecture, /docs\/PRD\.md/u); - assert.match(dataModel, /does not authorize cross-service SQL joins/iu); assert.match(proposals, /requiresConfirmation: true/u); assert.match(proposals, /cannot execute its own operations/u); - assert.match(threatModel, /AI prompt injection \/ silent mutation/u); }); -test('canonical lifecycle reflects protected-main integrations and remaining gaps', () => { +test('protected lifecycle and remaining parent gaps are represented truthfully', () => { const prd = text('docs/PRD.md'); const traceability = text('docs/TRACEABILITY.md'); const contracts = text('docs/API_CONTRACTS.md'); const privacy = text('docs/PRIVACY_DATA_LIFECYCLE.md'); - const assessment = text('docs/DOCUMENTATION_ASSESSMENT.md'); const dataModel = text('docs/DATA_MODEL.md'); - assert.match(prd, /PR #127 merged as protected main/u); - assert.match(prd, /PR #139 merged/u); - assert.match(prd, /PR #146 merged/u); - assert.match(prd, /PR #149 merged/u); - assert.match(prd, /PR #150 merged/u); + for (const protectedPr of ['#127', '#139', '#146', '#149', '#150', '#151', '#153']) { + assert.match(prd, new RegExp(`PR ${protectedPr}`, 'u')); + } assert.match(traceability, /PRD-CAL-004.*Implemented on protected main/u); + assert.match(traceability, /PRD-CAL-005.*Implemented on protected main/u); + assert.match(traceability, /PRD-INT-003.*Implemented on protected main/u); assert.match(traceability, /PRD-PRIV-004.*Implemented on protected main/u); assert.match(traceability, /PRD-PRIV-005.*Implemented on protected main/u); - assert.match(contracts, /Calendar connection registry foundation.*Implemented on protected main/u); - assert.match(contracts, /Tenant export integrity manifest.*Implemented on protected main/u); - assert.match(privacy, /authenticated public status resource from PR #146/u); - assert.match(privacy, /per-contributor export integrity evidence from PR #149/u); - assert.match(dataModel, /Calendar integration — connection registry persisted on protected main/u); + assert.match(contracts, /Atomic calendar connection revocation.*Implemented on protected main/u); + assert.match(contracts, /Explicit plugin installation grants.*Implemented on protected main/u); + assert.match(privacy, /atomic local connection revocation \(#153\)/u); + assert.match(dataModel, /PR #153 added atomic tenant\+user-scoped revocation/u); assert.match(traceability, /#55 data portability completion/u); - assert.match(traceability, /#129 per-user calendar credentials/u); + assert.match(traceability, /#129 hosted per-user calendar credentials/u); assert.match(traceability, /#130 plugin runtime delivery/u); - assert.match(assessment, /old documentation PR #126 became materially diverged/u); }); -test('active successor work is represented without promotion to protected-main truth', () => { +test('active successors are explicit and superseded lines are not promoted', () => { const prd = text('docs/PRD.md'); const traceability = text('docs/TRACEABILITY.md'); const contracts = text('docs/API_CONTRACTS.md'); - const dataModel = text('docs/DATA_MODEL.md'); const uml = text('docs/UML.md'); + const architecture = text('ARCHITECTURE.md'); const assessment = text('docs/DOCUMENTATION_ASSESSMENT.md'); const integrationAuthority = text( 'docs/adr/0011-external-integration-authority-and-secret-references.md', ); - for (const pr of ['#147', '#151']) { - assert.match(prd, new RegExp(`PR ${pr}`, 'u')); - assert.match(traceability, new RegExp(`PR ${pr}`, 'u')); - assert.match(contracts, new RegExp(`PR ${pr}`, 'u')); - assert.match(assessment, new RegExp(`PR ${pr}`, 'u')); + for (const activePr of ['#154', '#155']) { + assert.match(prd, new RegExp(`PR ${activePr}`, 'u')); + assert.match(traceability, new RegExp(`PR ${activePr}`, 'u')); + assert.match(contracts, new RegExp(`PR ${activePr}`, 'u')); + assert.match(assessment, new RegExp(`PR ${activePr}`, 'u')); } - assert.match(dataModel, /PR #151 is \*\*Implemented on active PR\*\*/u); - assert.match(uml, /Plugin installation authority/iu); - assert.match(uml, /source_head_sha/u); - assert.match(uml, /merge_tree_sha/u); + assert.match(architecture, /PR #155 is \*\*Implemented on active PR\*\*/u); + assert.match(architecture, /Old PR #147 is \*\*Superseded\*\*/u); + assert.match(uml, /clean successor PR #154/u); + assert.match(uml, /life-os\.calendar-user\.v1/u); assert.match(assessment, /protected-main documentation insufficient/iu); - assert.match(integrationAuthority, /manifest expresses requested intent/iu); assert.match(integrationAuthority, /opaque secret handle/iu); + assert.match(integrationAuthority, /manifest expresses requested intent/iu); }); From 83bc9cc13425a7a9974e9e92bfdaee6fbf3df826 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 11:23:15 +0900 Subject: [PATCH 073/173] docs(adr): extend integration authority acceptance evidence --- ...gration-authority-and-secret-references.md | 61 ++++++++++--------- 1 file changed, 32 insertions(+), 29 deletions(-) diff --git a/docs/adr/0011-external-integration-authority-and-secret-references.md b/docs/adr/0011-external-integration-authority-and-secret-references.md index d4be74bd7..044d01e49 100644 --- a/docs/adr/0011-external-integration-authority-and-secret-references.md +++ b/docs/adr/0011-external-integration-authority-and-secret-references.md @@ -5,64 +5,67 @@ ## Context -LifeOS integrates with external calendar providers and versioned plugins. Both domains need to persist or carry enough metadata to identify an external integration without turning external credentials or requested plugin capabilities into ambient authority. +LifeOS integrates with external calendar providers and versioned plugins. Both domains need enough metadata and authority evidence to operate without turning external credentials or untrusted requested capabilities into ambient authority. -Protected-main PR #150 introduced a workspace-and-user-scoped calendar connection registry and protected-main PR #151 introduced tenant-scoped plugin installation grants. The parent product gaps #129 and #130 remain incomplete, so this ADR defines the durable authority model without confusing those bounded foundations with complete provider/plugin runtime lifecycles. +Protected #150 introduced a workspace-and-user-scoped calendar connection registry, protected #151 introduced tenant-scoped plugin installation grants, protected #153 added atomic calendar connection revocation, and active #155 adds a distinct signed workspace+user context for hosted calendar operations. Parent gaps #129 and #130 remain incomplete, so these bounded foundations must not be confused with complete provider/plugin runtime lifecycles. ## Decision drivers - least privilege and explicit tenant/user authority; -- separation of identity metadata from secret material; -- no authority escalation from untrusted provider/plugin input; +- separation of internal identity, external metadata and secret material; +- no authority escalation from provider/plugin input; - revocation and replay safety; - service-owned persistence and no cross-service table mutation; -- clear active-versus-protected maturity; -- compatibility with future managed secret/KMS adapters and outbound delivery controls. +- truthful protected-vs-active maturity; +- replaceable managed secret/KMS and outbound-delivery adapters. ## Considered alternatives -1. **Persist external credential content directly in integration metadata rows.** Rejected because integration metadata and secret lifecycle have different access, rotation, retention and audit requirements. -2. **Treat a plugin manifest's requested capabilities as granted authority.** Rejected because untrusted extension metadata cannot self-authorize host operations. -3. **Reuse provider account identifiers as LifeOS identity or primary keys.** Rejected because external identifiers are mappings, not internal authority. -4. **Use LifeOS-owned opaque integration records plus separate secret references and explicit host-granted capability sets.** Selected. +1. **Persist provider credential plaintext in integration metadata rows.** Rejected: metadata and secrets have different access, rotation, retention and audit boundaries. +2. **Treat a plugin manifest's requested capabilities as grants.** Rejected: untrusted extension metadata cannot self-authorize host operations. +3. **Reuse provider account IDs as LifeOS identity/primary keys.** Rejected: external identifiers are mappings, not internal authority. +4. **Use LifeOS-owned UUIDv4 integration identity, separate secret references and explicit host-granted authority.** Selected. ## Decision -1. LifeOS-owned integration records use opaque UUIDv4 identity and are scoped by the authenticated workspace and, where the provider relationship is personal, the owning user. -2. External provider/account/calendar/plugin identifiers remain bounded metadata and never replace LifeOS internal identity. -3. Persistent integration metadata may reference credential material through an opaque secret handle or equivalent least-authority secret-store reference. The metadata record is not a credential store. +1. LifeOS-owned integration records use opaque UUIDv4 identity and are scoped by authenticated workspace and, where personal, owning user. +2. Provider/account/calendar/plugin identifiers remain bounded metadata and never replace LifeOS internal identity. +3. Persistent integration metadata may reference credential material only through an opaque secret handle or equivalent least-authority secret-store reference. The metadata row is not a credential store. 4. A plugin manifest expresses requested intent. The host grants an explicit capability subset; requested-but-ungranted capabilities have no authority. -5. Exact replay of an installation/connection command may return the same result only when authority-relevant evidence matches. Conflicting identity reuse fails closed. -6. Revocation prevents future active authority while retaining the bounded evidence needed for audit/reconciliation according to policy. -7. Outbound delivery, provider refresh, managed secret storage, discovery and other runtime capabilities remain separately gated and cannot be inferred from the existence of an integration record. -8. Every owning service keeps its migrations/repository/API authority. Cross-service relationships use versioned contracts rather than direct table access. +5. Exact replay may return the same result only when authority-relevant evidence matches; conflicting identity reuse fails closed. +6. Revocation ends future active local authority while retaining bounded audit/reconciliation evidence. Local record revocation is not automatically provider-side OAuth revocation or secret destruction. +7. User-sensitive internal calendar operations require authority that binds both workspace and requesting user; workspace-only context remains a distinct sync contract. +8. Outbound delivery, provider refresh/revoke, managed secret storage, discovery and related runtime features are separately gated and cannot be inferred from the existence of an integration record or grant. +9. Every owning service retains migration/repository/API authority. Cross-service relationships use versioned contracts rather than direct table access. ## Consequences -- Calendar connection metadata and plugin installation authority can evolve independently from managed secret backends. -- Product code needs explicit lookups scoped by tenant and relevant actor rather than identifier-only retrieval. -- A stored integration record is not evidence that the full provider/plugin runtime is production complete. -- Secret-store/KMS and delivery adapters can be replaced without changing internal integration identity if their versioned contracts remain compatible. +- Calendar metadata and plugin authority can evolve independently from managed secret backends. +- Product code requires exact tenant/actor scoped lookups instead of identifier-only retrieval. +- A stored integration record or grant does not prove the full provider/plugin runtime is production complete. +- Secret-store/KMS and delivery adapters can change without changing internal integration identity when contracts remain compatible. ## Failure and recovery -Malformed authority, unknown/revoked integration identity, capability escalation, incompatible replay and corrupted duplicate persistence fail closed. Secret-store or provider failures do not widen local authority. Recovery requires a newly authorized operation or a bounded operator repair that preserves audit/reconciliation evidence; editing another service's tables is not a recovery mechanism. +Malformed authority, identifier substitution, stale/future signed context, revoked integration identity, capability escalation, incompatible replay and corrupted persistence fail closed. Secret-store/provider failure never widens authority. Recovery requires a newly authorized operation or bounded operator repair preserving audit/reconciliation evidence; editing another service's tables is not recovery. ## Security and privacy impact -The decision reduces standing credential exposure and prevents untrusted integration metadata from becoming self-authorizing. Tenant/user scope, purpose, revocation and least privilege remain explicit. External provider identifiers and secret references are not authentication evidence for unrelated LifeOS domains. +The model reduces standing credential exposure and prevents untrusted metadata from self-authorizing. Tenant/user scope, revocation, least privilege and secret separation remain explicit. Provider identifiers/secret references are not authentication evidence for unrelated LifeOS domains. ## Acceptance evidence -- Protected main PR #139: signed trusted calendar workspace context. -- Protected main PR #150 (`1623df364925f84920c07c112f1ae96777277d20`): calendar connection migration/repository scoped to workspace+user with bounded metadata and opaque secret references. -- Protected main PR #151 (`6971c4e11b3204ec41526c7c959a248e54440e1c`): explicit plugin capability grants, replay/conflict handling, tenant/user lookup isolation and revocation semantics. -- Parent gaps #129 and #130 remain incomplete until their full credential/runtime delivery acceptance criteria are satisfied on protected main. +- Protected #139: signed trusted workspace calendar context. +- Protected #150 (`1623df364925f84920c07c112f1ae96777277d20`): workspace+user calendar connection persistence with bounded metadata and opaque secret references. +- Protected #151 (`6971c4e11b3204ec41526c7c959a248e54440e1c`): explicit plugin capability grants, replay/conflict isolation and revocation semantics. +- Protected #153 (`b13413e571bad82535f63d478e40746d12c3e680`): atomic tenant+user calendar connection revocation. +- Active #155: distinct short-lived signed workspace+user calendar context; not protected-main evidence before merge. +- Parent #129/#130 remain incomplete until full credential/runtime delivery acceptance criteria are satisfied. ## Migration and rollback -New integration persistence should introduce opaque internal IDs and secret references before removing legacy development configuration. Rollback may disable an integration path but must not reintroduce client-selected tenant authority, plaintext credential persistence as a general contract, implicit plugin capability grants or provider-native primary-key authority. +Introduce opaque internal IDs/secret references before removing legacy development configuration. Rollback may disable an integration path but must not reintroduce client-selected tenant authority, plaintext credential persistence as a general contract, implicit plugin grants, provider-native primary-key authority or workspace-only authorization for user-sensitive operations. ## Supersession -A later ADR may replace this model only with an equal-or-stronger separation of internal identity, external metadata, secret material and granted capability authority, plus an explicit migration/rollback path and protected-main acceptance evidence. +A later ADR may replace this model only with equal-or-stronger separation of internal identity, external metadata, secret material and granted authority, plus explicit migration/rollback and protected-main acceptance evidence. From e91118bdeb0c89308cbc87c636573deb348fbfb2 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 11:32:21 +0900 Subject: [PATCH 074/173] docs(prd): promote calendar user context and track plugin persistence --- docs/PRD.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/docs/PRD.md b/docs/PRD.md index 57fe5ac58..48ac6a225 100644 --- a/docs/PRD.md +++ b/docs/PRD.md @@ -46,7 +46,7 @@ Canonical requirements use exactly one of: `Implemented on protected main`, `Imp | PRD-CAL-003 | Complete per-user encrypted Google/CalDAV credential lifecycle, OAuth/PKCE, refresh/revocation, discovery and calendar selection. | Partial | issue #129 | | PRD-CAL-004 | Persist a LifeOS-owned calendar-connection foundation scoped to workspace and user, with bounded provider metadata, normalized scopes and opaque secret handles rather than plaintext provider tokens. | Implemented on protected main | PR #150 merged as `1623df364925f84920c07c112f1ae96777277d20`; does not complete #129 | | PRD-CAL-005 | Revoke one owned calendar connection atomically under exact workspace+user scope while preserving a bounded revoked-state result and replay safety. | Implemented on protected main | PR #153 merged as `b13413e571bad82535f63d478e40746d12c3e680`; does not by itself revoke provider-side OAuth credentials | -| PRD-CAL-006 | Internal hosted calendar operations that require user authority use a short-lived signed context binding both workspace and requesting-user UUIDv4 identities under a version distinct from workspace-only synchronization context. | Implemented on active PR | PR #155; authenticated workspace+user authority prerequisite for later public disconnect/credential lifecycle | +| PRD-CAL-006 | Internal hosted calendar operations that require user authority use a short-lived signed context binding both workspace and requesting-user UUIDv4 identities under a version distinct from workspace-only synchronization context. | Implemented on protected main | PR #155 merged as `7b34a5a584b037653d091ea661ae4627bb5dd2ea`; public disconnect/credential lifecycle remains #129 | | PRD-NOT-001 | Timezone-correct bounded reminders with replay-safe delivery. | Implemented on protected main | notification persistence/scheduler tests | | PRD-AI-001 | AI output is inert proposal evidence until explicit authorized decision. | Implemented on protected main | AI proposal/audit tests | | PRD-AI-002 | Deterministic proposal-quality/safety gates remain independent of live provider availability. | Implemented on protected main | evaluator/live-conformance split | @@ -56,8 +56,9 @@ Canonical requirements use exactly one of: `Implemented on protected main`, `Imp | PRD-PRIV-004 | An authenticated user can query one owned data-rights request through a tenant-and-actor scoped, bounded, non-cacheable public status resource without exposing workspace/user IDs, idempotency material or receipt digests. | Implemented on protected main | PR #146 merged; session-derived scope and bounded 400/401/404/503 behavior | | PRD-PRIV-005 | Tenant-export sections carry contributor-defined safe record counts and deterministic per-section SHA-256 integrity evidence, with locale-independent property ordering and a whole-export digest. | Implemented on protected main | PR #149 merged; integrity regression and RFC 8785/FIPS 180-4 doctoring | | PRD-INT-001 | Versioned plugin SDK/validation without direct database authority. | Implemented on protected main | plugin SDK/integration-service tests | -| PRD-INT-002 | Complete plugin runtime installation, encrypted secret storage, SSRF-safe outbound delivery, retries/dead-letter behavior and revocation. | Partial | protected installation authority now exists; durable secret/delivery runtime remains issue #130 | -| PRD-INT-003 | Treat a validated manifest as untrusted intent and grant only explicit tenant-scoped installation capabilities with exact replay/conflict/revocation semantics. | Implemented on protected main | PR #151 merged as `6971c4e11b3204ec41526c7c959a248e54440e1c`; no durable secret/delivery authority implied | +| PRD-INT-002 | Complete plugin runtime installation, encrypted secret storage, SSRF-safe outbound delivery, retries/dead-letter behavior and revocation. | Partial | protected installation authority exists; durable secret/delivery runtime remains issue #130 | +| PRD-INT-003 | Treat a validated manifest as untrusted intent and grant only explicit tenant-scoped installation capabilities with exact replay/conflict/revocation semantics. | Implemented on protected main | PR #151 merged as `6971c4e11b3204ec41526c7c959a248e54440e1c` | +| PRD-INT-004 | Persist restart-safe plugin installation authority with service-owned multiword schema/table naming, fixed SQL, explicit lifecycle evidence and workspace-scoped lookups at the persistence boundary. | Implemented on active PR | PR #156; tenant lookup hardening keeps workspace scope in SQL; no secret/delivery authority implied | | PRD-WEB-001 | Responsive installable PWA with keyboard-operable core flows and Korean/English catalogs. | Implemented on protected main | browser/accessibility/localization tests | | PRD-OPS-001 | Logical PostgreSQL backup/restore with integrity and unsafe-target refusal. | Implemented on protected main | backup scripts/tests/runbook | | PRD-OPS-002 | Provider-neutral production reference deployment and bounded health/readiness/metrics. | Implemented on protected main | infra and observability tests | From 62744aaa2098efb709a60df642c25f03f8dbb05e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 11:32:55 +0900 Subject: [PATCH 075/173] docs(traceability): promote calendar user context and track plugin persistence --- docs/TRACEABILITY.md | 88 +++++++++++++++++++++----------------------- 1 file changed, 41 insertions(+), 47 deletions(-) diff --git a/docs/TRACEABILITY.md b/docs/TRACEABILITY.md index d7558f097..ebffa6a7d 100644 --- a/docs/TRACEABILITY.md +++ b/docs/TRACEABILITY.md @@ -2,67 +2,61 @@ **Status:** Implemented on active PR -This index maps canonical requirements and durable decisions to representative source/test/issue/PR evidence. Current protected-main source, migrations, tests and live repository policy outrank this index when evidence conflicts. +Protected-main source/migrations/tests and live repository policy outrank this index. Active PR evidence is never shipped truth. -| Requirement / decision | Status | Representative implementation/evidence | Open follow-up | +| Requirement / decision | Status | Representative evidence | Open follow-up | | --- | --- | --- | --- | -| PRD-ID-001 login/session/workspace authority | Implemented on protected main | identity OAuth/session runtime and tests | — | -| PRD-ID-002 opaque UUIDv4 internal IDs | Implemented on protected main | `AGENTS.md`, validators/migrations | — | -| PRD-PLAN-001 durable planning | Implemented on protected main | planning PostgreSQL repository/migrations | — | -| PRD-PLAN-002 durable Today synchronization | Implemented on protected main | PR #127; Today aggregate, BFF, PostgreSQL concurrency and browser acceptance | — | -| PRD-HAB-001 recurring habits | Implemented on protected main | habit service/domain/PostgreSQL tests | — | -| PRD-REV-001 review projection boundary | Implemented on protected main | review service tests | — | -| PRD-CAL-001 conflict-safe calendar sync | Implemented on protected main | CalDAV/Google adapter tests | — | -| PRD-CAL-002 trusted workspace calendar context | Implemented on protected main | PR #139 | — | -| PRD-CAL-003 complete hosted per-user calendar credential lifecycle | Partial | protected trusted context, connection registry and local revocation foundations exist | issue #129 | -| PRD-CAL-004 workspace+user calendar connection registry | Implemented on protected main | PR #150 / `1623df364925f84920c07c112f1ae96777277d20` | issue #129 remains for complete lifecycle | -| PRD-CAL-005 atomic tenant+user calendar connection revocation | Implemented on protected main | PR #153 / `b13413e571bad82535f63d478e40746d12c3e680` | provider-side OAuth revocation remains #129 | -| PRD-CAL-006 signed workspace+user calendar authority | Implemented on active PR | PR #155; distinct short-lived `life-os.calendar-user.v1` authority | subsequent #129 disconnect/runtime slices | -| PRD-NOT-001 bounded reminders | Implemented on protected main | notification scheduler/persistence tests | — | -| PRD-AI-001 inert auditable proposals | Implemented on protected main | AI proposal/audit tests | — | -| PRD-AI-002 deterministic/live-provider separation | Implemented on protected main | proposal evaluator + bounded NIM conformance | — | -| PRD-PRIV-001 purpose-bound sensitive access | Implemented on protected main | privacy-service grants/events/tests | — | -| PRD-PRIV-002 recent-auth + durable rights request ledger | Implemented on protected main | #134/#136/#137/#138/#144 | issue #55 for whole journey | -| PRD-PRIV-003 complete export/delete orchestration | Partial | protected identity/integrity foundations exist; full contributor/reconciliation/delivery lifecycle incomplete | issue #55 | -| PRD-PRIV-004 authenticated bounded request-status resource | Implemented on protected main | PR #146 | issue #55 remains for whole-right completion | -| PRD-PRIV-005 per-section export integrity evidence | Implemented on protected main | PR #149 | issue #55 remains for protected delivery/reconciliation | -| PRD-INT-001 plugin SDK/validation | Implemented on protected main | plugin SDK/integration-service tests | — | -| PRD-INT-002 complete plugin secret/delivery runtime | Partial | protected host-owned installation authority exists; durable secret/delivery runtime incomplete | issue #130 | -| PRD-INT-003 explicit tenant-scoped installation grants | Implemented on protected main | PR #151 / `6971c4e11b3204ec41526c7c959a248e54440e1c` | issue #130 for persistent secrets/delivery | -| PRD-WEB-001 accessible localized PWA | Implemented on protected main | browser/accessibility/localization tests | — | -| PRD-OPS-001 backup/restore | Implemented on protected main | backup scripts/tests/runbook | — | -| PRD-GOV-001 buyer-gap vs capability-maturity separation | Implemented on protected main | buyer-gap registry / issue #21 report | — | -| PRD-GOV-002 exact source/base/merge verification attribution | Implemented on active PR | ADR 0010; clean successor PR #154; old #147 superseded | issue #132 until integration/residual attribution closure | +| Login/session/workspace authority | Implemented on protected main | identity OAuth/session runtime | — | +| UUIDv4 internal IDs | Implemented on protected main | validators/migrations + ADR 0001 | — | +| Durable Goals/Projects/Tasks/Today | Implemented on protected main | planning + PR #127 | — | +| Recurring habits / review projections / reminders | Implemented on protected main | owning services/tests | — | +| Conflict-safe calendar sync | Implemented on protected main | provider adapters + #139 | — | +| Calendar connection persistence | Implemented on protected main | #150 / `1623df364925f84920c07c112f1ae96777277d20` | #129 | +| Calendar local revocation | Implemented on protected main | #153 / `b13413e571bad82535f63d478e40746d12c3e680` | provider-side revoke remains #129 | +| Calendar workspace+user signed authority | Implemented on protected main | #155 / `7b34a5a584b037653d091ea661ae4627bb5dd2ea` | public hosted disconnect/runtime #129 | +| Complete hosted calendar credential lifecycle | Partial | protected foundations above | #129 | +| Inert auditable AI proposals | Implemented on protected main | AI proposal/audit tests | — | +| Purpose-bound sensitive access | Implemented on protected main | privacy-service evidence | — | +| Recent-auth + durable rights ledger | Implemented on protected main | #134/#136/#137/#138/#144 | #55 | +| Authenticated rights status | Implemented on protected main | #146 | #55 | +| Per-section export integrity | Implemented on protected main | #149 | #55 | +| Complete export/delete orchestration | Partial | protected rights/integrity foundations | #55 | +| Plugin SDK/manifest validation | Implemented on protected main | plugin SDK/integration tests | — | +| Explicit host-owned plugin installation grants | Implemented on protected main | #151 / `6971c4e11b3204ec41526c7c959a248e54440e1c` | #130 | +| Durable plugin installation persistence | Implemented on active PR | #156; workspace-scoped repository lookup + migration | #130 secret/delivery runtime | +| Complete plugin secret/outbound delivery runtime | Partial | protected grant authority + active persistence | #130 | +| Buyer-gap vs capability-maturity separation | Implemented on protected main | readiness registry | — | +| Source/base/merge evidence attribution | Implemented on active PR | ADR 0010 + clean #154; #147 Superseded | #132 | ## Architecture decisions | Decision | Status | Evidence | | --- | --- | --- | -| Multi-user server-backed/self-hostable MSA supersedes browser-only primary architecture | Accepted architecture | `ARCHITECTURE.md`, service layout, Compose/Kubernetes | -| UUIDv4 supersedes original UUIDv7 proposal | Accepted architecture | protected-main code/migrations + ADR 0001 | -| Service-owned persistence; no cross-service table authority | Accepted architecture | root Architecture + ADR 0003 | -| AI output remains an inert proposal | Accepted architecture | AI tests + ADR 0004 | -| Sensitive access is actor/workspace/resource/purpose/lifetime bound | Accepted architecture | privacy tests + ADR 0005 | -| Capability maturity cannot stand in for buyer-gap exhaustion | Accepted architecture | ADR 0008 + readiness registry | -| Canonical docs distinguish shipped/active/planned/superseded truth | Accepted architecture | ADR 0007 + documentation contract tests | -| Verification evidence identities remain separate | Accepted architecture | ADR 0010 + PR #154 active implementation | -| Integration identity, external metadata, secret references and granted authority remain separate | Accepted architecture | ADR 0011 + protected #150/#151/#153 + active #155 | +| Server-backed self-hostable MSA supersedes browser-only primary architecture | Accepted architecture | Architecture + ADR 0009 | +| UUIDv4 supersedes UUIDv7 | Accepted architecture | ADR 0001 | +| Service-owned persistence/no cross-table authority | Accepted architecture | ADR 0003 | +| AI remains inert proposal evidence | Accepted architecture | ADR 0004 | +| Purpose-bound sensitive access | Accepted architecture | ADR 0005 | +| Capability maturity != buyer-gap exhaustion | Accepted architecture | ADR 0008 | +| Canonical documentation uses explicit maturity | Accepted architecture | ADR 0007 | +| Verification identities remain separate | Accepted architecture | ADR 0010 + #154 | +| Integration identity, metadata, secret references and grants remain separate | Accepted architecture | ADR 0011 + protected #150/#151/#153/#155 + active #156 | ## Evidence hierarchy -1. Current protected-main source, migrations, tests and live repository policy. -2. Exact current active-PR source/tests, explicitly labeled active. -3. Accepted Architecture/ADR decisions. -4. Canonical PRD/TRD/Data Model/UML/API/Security/Test/Operability documents. -5. Open issues/plans/research for incomplete work. -6. Historical chat/PR bodies only as rationale. +1. protected-main source/migrations/tests/live policy; +2. exact current active-PR source/tests labeled active; +3. accepted Architecture/ADRs; +4. canonical product/technical/data/UML/security/operability documents; +5. issues/plans/research for incomplete work; +6. historical chat/old PRs as rationale only. -`source_head_sha`, PR-base snapshot, independently resolved live-base tip, synthetic merge tree, workflow checkout, protected-main head and release source are distinct evidence identities. A green status never transfers authority across them. +`source_head_sha`, PR-base snapshot, independently resolved live-base tip, synthetic merge tree, workflow checkout, protected-main head and release source are distinct evidence identities. ## Buyer-gap state -Canonical buyer gaps remain #55 data portability completion, #129 hosted per-user calendar credentials, and #130 plugin runtime delivery. Protected #146/#149 advance #55; protected #150/#153 and active #155 advance #129; protected #151 advances #130. None of those bounded slices closes the parent gap by implication. Issue #132 is verification/governance reliability; #154 is its clean active implementation after #147 was superseded. +Canonical buyer gaps remain #55, #129 and #130. Protected #146/#149 advance #55; protected #150/#153/#155 advance #129; protected #151 plus active #156 advance #130. None closes its parent gap by implication. #132 is verification reliability with clean active #154 after #147 supersession. ## Update rule -Whenever maturity changes, reconcile PRD, this traceability index, relevant ADR/Architecture/Data/UML/API/Security/Privacy/Operability views, regression evidence and CHANGELOG. Never label active/unmerged work `Implemented on protected main`. +When maturity changes, reconcile PRD, this index and every materially affected ADR/Architecture/Data/UML/API/Security/Privacy/Operability view. Never promote active work to protected-main truth before integration. From 57d0112c74c650d3cb95aa9c1b856aa2d37d8a1d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:39:28 +0900 Subject: [PATCH 076/173] docs(adr): define test-time compute authority --- ...nd-model-assisted-development-authority.md | 76 +++++++++++++++++++ 1 file changed, 76 insertions(+) create mode 100644 docs/adr/0012-test-time-compute-and-model-assisted-development-authority.md diff --git a/docs/adr/0012-test-time-compute-and-model-assisted-development-authority.md b/docs/adr/0012-test-time-compute-and-model-assisted-development-authority.md new file mode 100644 index 000000000..7f4c370cd --- /dev/null +++ b/docs/adr/0012-test-time-compute-and-model-assisted-development-authority.md @@ -0,0 +1,76 @@ +# ADR 0012: Test-time compute and model-assisted development authority + +**Status:** Accepted architecture +**Date:** 2026-08-10 + +## Context + +LifeOS uses model-backed evaluation for auditable AI-proposal quality and may use model-assisted repository development. These activities can consume different amounts of test-time compute, use single-route or multi-agent orchestration, and depend on external model providers. They must not blur model execution with product authorization, independent review, merge, or release authority. + +Protected-main `AGENTS.md` already requires a strong single-model baseline, explicit reasoning/stage/decomposition/recursion/access-topology ablations, `NVIDIA_NIM_API_KEY`, no `COPILOT_GITHUB_TOKEN`, and independent review-agent credentials. The approved live-conformance design records bounded `route_high`, `route_low`, and conducted evaluation cells through an exact contextual-orchestrator dependency, while unsupported cells remain explicit rather than simulated. + +## Decision drivers + +- correctness, evidence quality, reliability and controllability over agent count or latency; +- comparable-budget evidence before deeper orchestration is preferred; +- deterministic product authorization and proposal validation independent of model availability; +- least-privilege provider credentials and no credential leakage into retained evidence; +- independent review, merge and release authority; +- reproducible, explicitly versioned evaluation cells instead of hidden orchestration defaults; +- standalone LifeOS operation when model providers or contextual-orchestrator are unavailable. + +## Considered alternatives + +1. **Always use the deepest available multi-agent workflow.** Rejected because agent count is not evidence of quality and adds cost, failure modes and coordination confounds. +2. **Optimize primarily for latency or token count.** Rejected because the product requires defensible correctness and safety evidence; latency/cost remain measured capacity signals. +3. **Let model judgement satisfy deterministic CI, authorization, review, merge or release gates.** Rejected because model output is untrusted evidence, not repository or product authority. +4. **Use a strong single-route baseline and admit deeper orchestration only when retained comparable-budget evidence justifies it.** Selected. + +## Decision + +1. Every material model-evaluation campaign includes a strong single-model route as the mandatory comparison baseline. +2. Reasoning effort, workflow stages, planner/worker/verifier/synthesizer roles, task decomposition, recursion depth, access lists/communication topology, homogeneous-versus-heterogeneous model pools and verification strategy are explicit experimental/control dimensions when supported by the exact dependency revision. +3. Unsupported controls remain explicitly unavailable; LifeOS does not simulate or silently infer them. +4. Deeper orchestration is selected only when retained LifeOS evidence shows a material quality or heterogeneous-capability benefit without unacceptable safety/reliability regression under a reasonably comparable budget. This is a LifeOS product inference, not a claim of universal multi-agent superiority. +5. Latency, token usage and provider cost are recorded for capacity/cost review but are not the sole or primary optimization objective. +6. Model-backed tests and model-assisted development use GitHub Secret `NVIDIA_NIM_API_KEY` through an approved OpenCode or contextual-orchestrator boundary. `COPILOT_GITHUB_TOKEN` is prohibited. +7. Provider credentials materialize only for the bounded model call/credential-seeding boundary and are excluded from retained prompts, responses, hidden reasoning, logs and artifacts. +8. Review-agent identities and credential chains remain independent from development/model-execution identities. Model execution cannot self-approve, weaken protection, merge, release, or alter deterministic acceptance authority. +9. Deterministic authorization, schema validation, product evaluators, CI/security, exact-head evidence, review, merge and release gates remain authoritative when provider execution is unavailable or disagrees. +10. Normal LifeOS runtime/build/release paths remain independently usable without contextual-orchestrator or NVIDIA availability unless a separately accepted product contract explicitly changes that boundary. + +## Consequences + +- A deeper orchestration profile carries an evidence burden rather than becoming the default by availability. +- Live-provider results are dated conformance/governance evidence and do not become deterministic merge success. +- Evaluation reports must expose profile availability, limitations, quality deltas and bounded resource evidence without retaining sensitive model content. +- New orchestration controls require an explicit contract and regression evidence before they enter production evaluation policy. +- Model-provider outages degrade model-backed evidence collection but do not widen LifeOS product or repository authority. + +## Failure and recovery + +Missing provider credentials, unavailable provider/model inventory, unsupported orchestration controls, bounded provider failures or stochastic evaluation failures produce explicit sanitized unavailable/failure evidence. They do not fabricate quality results and do not weaken deterministic gates. Recovery is a later bounded rerun against an exact LifeOS/dependency revision or a reviewed fallback profile. A malformed report, unsafe credential/materialization path, invalid dependency identity or deterministic test failure fails closed. + +## Security, privacy, and governance impact + +Model execution receives only the minimum inputs and credentials required by the bounded evaluation/development operation. Raw prompts, raw responses, hidden reasoning, bearer material, provider credentials and unnecessary tenant content are excluded from retained artifacts. Independent review and merge/release governance remain separate authorities. Model output is untrusted even when the provider succeeds. + +## Compatibility and migration + +Existing deterministic LifeOS proposal evaluation remains unchanged and authoritative. Existing live-conformance cells can map to this ADR without changing their result schema. Future contextual-orchestrator pins or orchestration controls are reviewed source/configuration changes and must preserve explicit unsupported-state semantics and credential scoping. Existing review-agent credential names/scopes are not repurposed. + +## Acceptance evidence + +- Protected-main `AGENTS.md` encodes the strong-route baseline, explicit test-time-compute dimensions, NVIDIA NIM credential boundary, no-Copilot rule and review-identity separation. +- `docs/superpowers/specs/2026-08-06-ai-nim-live-conformance-design.md` defines exact route/conduct cells, credential scoping, bounded retained evidence, unsupported profiles and the quality-first decision rule. +- Canonical Standards/Research Traceability records Fugu, Conductor, TRINITY, the strong-single-agent counterevidence and NVIDIA NIM primary API documentation with publication status. +- Canonical UML shows model-execution authority flowing through deterministic evaluation into credential-free retained evidence and a governance decision, while review/merge/release authority remains separate. +- Documentation contracts fail if these authority boundaries or research anchors disappear. + +## Migration and rollback + +A policy change may disable or narrow a model-backed profile without affecting deterministic LifeOS operation. Rollback must not restore `COPILOT_GITHUB_TOKEN`, merge/release authority for development models, implicit orchestration controls, fabricated unsupported results, or provider availability as a deterministic merge prerequisite. + +## Supersession + +A later ADR may supersede this decision only with explicit comparable evidence for the replacement compute-allocation policy, preserved model/reviewer/merge/release authority separation, a credential migration plan, deterministic fallback behavior, and updated canonical traceability/tests. \ No newline at end of file From 48a3b1c305cf06362fd5407ccf427b4a4d2177ea Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:39:47 +0900 Subject: [PATCH 077/173] docs(adr): index test-time compute authority --- docs/adr/README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/adr/README.md b/docs/adr/README.md index c83c76e7a..855e0e98c 100644 --- a/docs/adr/README.md +++ b/docs/adr/README.md @@ -21,6 +21,7 @@ ADR status uses the same exact canonical documentation values: `Implemented on p | [0009](0009-product-hosting-and-data-evolution.md) | Accepted architecture | Server-backed self-hostable modular MSA supersedes browser-only/single-app primary architecture | | [0010](0010-verification-evidence-identity.md) | Accepted architecture | Contributor source, PR-base snapshot, live base, synthetic merge, workflow checkout, protected-main and release identities remain separate evidence authorities | | [0011](0011-external-integration-authority-and-secret-references.md) | Accepted architecture | External integration metadata uses LifeOS-owned identity, separate secret references and explicit host-granted capability authority | +| [0012](0012-test-time-compute-and-model-assisted-development-authority.md) | Accepted architecture | Strong single-route baseline, measured orchestration selection, NVIDIA/OpenCode credential boundary and model-vs-review/merge/release authority separation | ## ADR quality contract From 5cf8cd4a4d3d67d8cae2aefb929f77f88d338d54 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:40:21 +0900 Subject: [PATCH 078/173] docs(research): trace model orchestration evidence --- docs/STANDARDS_TRACEABILITY.md | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/docs/STANDARDS_TRACEABILITY.md b/docs/STANDARDS_TRACEABILITY.md index 336bd99d7..0f5e5a738 100644 --- a/docs/STANDARDS_TRACEABILITY.md +++ b/docs/STANDARDS_TRACEABILITY.md @@ -2,7 +2,7 @@ **Status:** Implemented on active PR -This document records normative/current standards used for repository-wide decisions. Drafts are tracked as watch items and do not silently replace published requirements. +This document records normative/current standards and repository-wide research used for durable LifeOS decisions. Drafts and preprints are labeled explicitly and do not silently replace published standards or peer-reviewed evidence. ## Standards matrix @@ -16,6 +16,18 @@ This document records normative/current standards used for repository-wide decis | NIST AI 100-1, *Artificial Intelligence Risk Management Framework 1.0* | Final, 2023 | AI governance/evidence/risk framing | | NIST AI 600-1, *AI RMF: Generative Artificial Intelligence Profile* | Final, 2024 | GenAI prompt/provider/evidence risk controls | +## Repository-wide model-orchestration research matrix + +| Source | Publication status | LifeOS use | +| --- | --- | --- | +| Sakana AI, *Sakana Fugu: One model to command them all* | Final product release and technical release evidence, 2026 | motivates measuring direct-route versus coordinated-expert execution rather than assuming one topology | +| Nielsen et al., *Learning to orchestrate agents in natural language with the Conductor* | Peer-reviewed ICLR 2026 conference paper | motivates explicit communication topology, targeted instructions, recursive selection and test-time-scaling evidence | +| Xu et al., *TRINITY: An evolved LLM coordinator* | Peer-reviewed ICLR 2026 conference paper | motivates explicit Thinker/Worker/Verifier roles and multi-turn coordination evidence | +| Xu et al., *Rethinking the value of multi-agent workflow: A strong single agent baseline* | arXiv preprint; submitted to ICLR 2026 | counterevidence requiring a strong single-agent baseline before claiming value from homogeneous multi-agent workflows | +| NVIDIA, *API reference—NVIDIA NIM for large language models* | Published primary vendor API documentation, 2026 | authoritative provider transport/API reference for the bounded live-conformance integration | + +These sources motivate the dimensions measured by LifeOS; they do **not** establish universal multi-agent superiority. ADR 0012 makes a repository-specific decision: a strong single-model route is the mandatory comparison baseline, deeper orchestration is admitted only from retained LifeOS evidence under reasonably comparable budgets, and deterministic LifeOS authorization/evaluation/review/merge/release authority remains separate from model execution. + ## Decision traceability - **UUIDv4 invariant:** RFC 9562 permits UUID version 4 and defines modern UUID representation; LifeOS's choice of opaque random UUIDv4 is a repository architecture decision, not a claim that v4 is universally superior. @@ -23,10 +35,11 @@ This document records normative/current standards used for repository-wide decis - **Accessibility:** core PWA journeys target WCAG 2.2-relevant keyboard/focus/non-color-only/status/authentication behavior with browser acceptance evidence. - **Secure SDLC:** exact-head CI/security evidence, immutable action pins, least privilege, bounded untrusted input and provenance align with SSDF practices. SSDF 1.2 remains draft as of this baseline. - **AI governance:** model output remains untrusted and inert, deterministic authorization/validation is separate, provider availability is not fabricated as merge success, and retained artifacts exclude secrets/raw prompts/responses/hidden reasoning. +- **Test-time compute:** ADR 0012 and `docs/superpowers/specs/2026-08-06-ai-nim-live-conformance-design.md` define the strong-route baseline, route/conduct cells, explicit reasoning/stage/decomposition/recursion/access-topology dimensions, unsupported-state handling, `NVIDIA_NIM_API_KEY` credential boundary and independent governance authority. ## Research traceability -Feature-specific peer-reviewed and technical research remains in `docs/research/` and approved `docs/superpowers/specs/` documents. When a research result becomes a repository-wide architectural requirement, add an ADR linking the primary source, assumptions, alternatives and executable acceptance evidence. +Feature-specific peer-reviewed and technical research remains in `docs/research/` and approved `docs/superpowers/specs/` documents. When a research result becomes a repository-wide architectural requirement, an ADR links the primary source, assumptions, alternatives and executable acceptance evidence. Detailed Fugu/Conductor/TRINITY/single-agent limitations and the exact live-conformance profile contract remain in `docs/superpowers/specs/2026-08-06-ai-nim-live-conformance-design.md`; this canonical file records only the repository-wide decision anchors and publication status. ## APA 7 references @@ -40,4 +53,14 @@ National Institute of Standards and Technology. (2023). *Artificial Intelligence National Institute of Standards and Technology. (2024). *Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile* (NIST AI 600-1). https://doi.org/10.6028/NIST.AI.600-1 +Nielsen, S., Cetin, E., Schwendeman, P., Sun, Q., Xu, J., & Tang, Y. (2026). *Learning to orchestrate agents in natural language with the Conductor* [Conference paper]. International Conference on Learning Representations. https://openreview.net/pdf/4a133f1e2ca67ceaedb45c3a123cc8125c694ff5.pdf + +NVIDIA Corporation. (2026). *API reference—NVIDIA NIM for large language models*. https://docs.nvidia.com/nim/large-language-models/latest/api-reference.html + +Sakana AI. (2026, June 22). *Sakana Fugu: One model to command them all* [Final product release]. https://sakana.ai/fugu-release/ + World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines (WCAG) 2.2*. https://www.w3.org/TR/WCAG22/ + +Xu, J., Koesdwiady, A., Bei, S., Han, Y., Huang, B., Wang, D., Chen, Y., Wang, Z., Wang, P., Li, P., & Ding, Y. (2026). *Rethinking the value of multi-agent workflow: A strong single agent baseline* [Preprint; submitted to ICLR 2026]. arXiv. https://doi.org/10.48550/arXiv.2601.12307 + +Xu, J., Sun, Q., Schwendeman, P., Nielsen, S., Cetin, E., & Tang, Y. (2026). *TRINITY: An evolved LLM coordinator* [Conference paper]. International Conference on Learning Representations. https://doi.org/10.48550/arXiv.2512.04695 From 3ffc6d51471f040f6aba327e1f59be2184103274 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:40:32 +0900 Subject: [PATCH 079/173] test(docs): require current model and evidence authority --- .../src/documentation-contract.test.mjs | 81 ++++++++++++++++--- 1 file changed, 71 insertions(+), 10 deletions(-) diff --git a/packages/commercial-readiness/src/documentation-contract.test.mjs b/packages/commercial-readiness/src/documentation-contract.test.mjs index 8fb306a7a..443e6e914 100644 --- a/packages/commercial-readiness/src/documentation-contract.test.mjs +++ b/packages/commercial-readiness/src/documentation-contract.test.mjs @@ -68,6 +68,7 @@ function tableCells(line) { .map((value) => value.trim()); } +/** Returns whether every cell is a Markdown table separator. */ function isSeparatorRow(cells) { return cells.length > 0 && cells.every((cell) => /^:?-{3,}:?$/u.test(cell)); } @@ -132,7 +133,7 @@ test('ADR index targets every material ADR and ADRs satisfy the quality contract .sort(); const requiredNumbers = new Set([ '0001', '0002', '0003', '0004', '0005', '0006', - '0007', '0008', '0009', '0010', '0011', + '0007', '0008', '0009', '0010', '0011', '0012', ]); for (const number of requiredNumbers) { @@ -196,7 +197,9 @@ test('protected lifecycle and remaining parent gaps are represented truthfully', const privacy = text('docs/PRIVACY_DATA_LIFECYCLE.md'); const dataModel = text('docs/DATA_MODEL.md'); - for (const protectedPr of ['#127', '#139', '#146', '#149', '#150', '#151', '#153']) { + for (const protectedPr of [ + '#127', '#139', '#146', '#149', '#150', '#151', '#153', '#154', '#155', + ]) { assert.match(prd, new RegExp(`PR ${protectedPr}`, 'u')); } assert.match(traceability, /PRD-CAL-004.*Implemented on protected main/u); @@ -213,28 +216,86 @@ test('protected lifecycle and remaining parent gaps are represented truthfully', assert.match(traceability, /#130 plugin runtime delivery/u); }); -test('active successors are explicit and superseded lines are not promoted', () => { +test('current successor maturity follows protected main and active work', () => { const prd = text('docs/PRD.md'); const traceability = text('docs/TRACEABILITY.md'); const contracts = text('docs/API_CONTRACTS.md'); const uml = text('docs/UML.md'); const architecture = text('ARCHITECTURE.md'); const assessment = text('docs/DOCUMENTATION_ASSESSMENT.md'); + const dataModel = text('docs/DATA_MODEL.md'); const integrationAuthority = text( 'docs/adr/0011-external-integration-authority-and-secret-references.md', ); - for (const activePr of ['#154', '#155']) { - assert.match(prd, new RegExp(`PR ${activePr}`, 'u')); - assert.match(traceability, new RegExp(`PR ${activePr}`, 'u')); - assert.match(contracts, new RegExp(`PR ${activePr}`, 'u')); - assert.match(assessment, new RegExp(`PR ${activePr}`, 'u')); + for (const protectedPr of ['#154', '#155']) { + assert.match(prd, new RegExp(`PR ${protectedPr}`, 'u')); + assert.match(traceability, new RegExp(`PR ${protectedPr}`, 'u')); + assert.match(assessment, new RegExp(`PR ${protectedPr}`, 'u')); } - assert.match(architecture, /PR #155 is \*\*Implemented on active PR\*\*/u); + assert.match(prd, /PR #156/u); + assert.match(traceability, /PR #156/u); + assert.match(assessment, /PR #156/u); + assert.match(dataModel, /PR #156/u); + assert.match(architecture, /PR #155.*Implemented on protected main/su); + assert.match(architecture, /PR #154.*Implemented on protected main/su); assert.match(architecture, /Old PR #147 is \*\*Superseded\*\*/u); - assert.match(uml, /clean successor PR #154/u); + assert.match(uml, /PR #154.*protected main/su); assert.match(uml, /life-os\.calendar-user\.v1/u); assert.match(assessment, /protected-main documentation insufficient/iu); assert.match(integrationAuthority, /opaque secret handle/iu); assert.match(integrationAuthority, /manifest expresses requested intent/iu); + assert.match(contracts, /PR #156/u); +}); + +test('model-assisted compute authority and counterevidence remain canonical', () => { + const architecture = text('ARCHITECTURE.md'); + const standards = text('docs/STANDARDS_TRACEABILITY.md'); + const uml = text('docs/UML.md'); + const traceability = text('docs/TRACEABILITY.md'); + const agents = text('AGENTS.md'); + const adr = text('docs/adr/0012-test-time-compute-and-model-development-authority.md'); + + assert.match(adr, /strong single-model route/iu); + assert.match(adr, /workflow stages/iu); + assert.match(adr, /decomposition/iu); + assert.match(adr, /recursion depth/iu); + assert.match(adr, /role-specific reasoning effort/iu); + assert.match(adr, /access (?:list|topology)/iu); + assert.match(adr, /NVIDIA_NIM_API_KEY/u); + assert.match(adr, /COPILOT_GITHUB_TOKEN/u); + assert.match(adr, /deterministic/iu); + + for (const evidenceName of ['AgentFugue', 'Conductor', 'TRINITY']) { + assert.match(standards, new RegExp(evidenceName, 'u')); + } + assert.match(standards, /Single-Agent LLMs Outperform Multi-Agent Systems/iu); + assert.match(standards, /preprint/iu); + assert.match(standards, /ICLR 2026/iu); + assert.match(standards, /NVIDIA NIM/iu); + assert.match(standards, /repository-specific/iu); + + assert.match(uml, /NVIDIA_NIM_API_KEY/u); + assert.match(uml, /contextual-orchestrator/iu); + assert.match(uml, /single-route/iu); + assert.match(uml, /conduct/iu); + assert.match(uml, /deterministic LifeOS proposal evaluator/iu); + assert.match(uml, /review.*merge.*release/isu); + + assert.match(traceability, /ADR 0012/u); + assert.match(traceability, /AgentFugue/iu); + assert.match(architecture, /A strong single-model route is measured before deeper orchestration/u); + assert.match(agents, /NVIDIA_NIM_API_KEY/u); + assert.doesNotMatch(agents, /use\s+COPILOT_GITHUB_TOKEN/iu); +}); + +test('canonical authority does not regress to superseded product identity', () => { + const canonical = REQUIRED + .filter((path) => path.endsWith('.md')) + .map((path) => text(path)) + .join('\n'); + + assert.doesNotMatch(canonical, /UUIDv7 is the (?:current|primary|required) LifeOS identifier/iu); + assert.doesNotMatch(canonical, /login-free local-first is the (?:current|primary|required) architecture/iu); + assert.doesNotMatch(canonical, /single[- ]application is the (?:current|primary|required) durable architecture/iu); }); From 720869746f5dde3d33e971538d124f03f39114e9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:41:32 +0900 Subject: [PATCH 080/173] docs(adr): satisfy compute authority contract --- ...me-compute-and-model-assisted-development-authority.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/adr/0012-test-time-compute-and-model-assisted-development-authority.md b/docs/adr/0012-test-time-compute-and-model-assisted-development-authority.md index 7f4c370cd..721b2454a 100644 --- a/docs/adr/0012-test-time-compute-and-model-assisted-development-authority.md +++ b/docs/adr/0012-test-time-compute-and-model-assisted-development-authority.md @@ -29,7 +29,7 @@ Protected-main `AGENTS.md` already requires a strong single-model baseline, expl ## Decision 1. Every material model-evaluation campaign includes a strong single-model route as the mandatory comparison baseline. -2. Reasoning effort, workflow stages, planner/worker/verifier/synthesizer roles, task decomposition, recursion depth, access lists/communication topology, homogeneous-versus-heterogeneous model pools and verification strategy are explicit experimental/control dimensions when supported by the exact dependency revision. +2. Reasoning effort, workflow stages, role-specific reasoning effort for planner/worker/verifier/synthesizer roles, task decomposition, recursion depth, access lists/communication topology, homogeneous-versus-heterogeneous model pools and verification strategy are explicit experimental/control dimensions when supported by the exact dependency revision. 3. Unsupported controls remain explicitly unavailable; LifeOS does not simulate or silently infer them. 4. Deeper orchestration is selected only when retained LifeOS evidence shows a material quality or heterogeneous-capability benefit without unacceptable safety/reliability regression under a reasonably comparable budget. This is a LifeOS product inference, not a claim of universal multi-agent superiority. 5. Latency, token usage and provider cost are recorded for capacity/cost review but are not the sole or primary optimization objective. @@ -51,9 +51,9 @@ Protected-main `AGENTS.md` already requires a strong single-model baseline, expl Missing provider credentials, unavailable provider/model inventory, unsupported orchestration controls, bounded provider failures or stochastic evaluation failures produce explicit sanitized unavailable/failure evidence. They do not fabricate quality results and do not weaken deterministic gates. Recovery is a later bounded rerun against an exact LifeOS/dependency revision or a reviewed fallback profile. A malformed report, unsafe credential/materialization path, invalid dependency identity or deterministic test failure fails closed. -## Security, privacy, and governance impact +## Security and privacy impact -Model execution receives only the minimum inputs and credentials required by the bounded evaluation/development operation. Raw prompts, raw responses, hidden reasoning, bearer material, provider credentials and unnecessary tenant content are excluded from retained artifacts. Independent review and merge/release governance remain separate authorities. Model output is untrusted even when the provider succeeds. +Model execution receives only the minimum inputs and credentials required by the bounded evaluation/development operation. Raw prompts, raw responses, hidden reasoning, bearer material, provider credentials and unnecessary tenant content are excluded from retained artifacts. Independent review and merge/release governance remain separate authorities. Model output is untrusted even when the provider succeeds. Governance impact is explicit: development-model identity cannot become counted independent review, merge or release authority. ## Compatibility and migration @@ -73,4 +73,4 @@ A policy change may disable or narrow a model-backed profile without affecting d ## Supersession -A later ADR may supersede this decision only with explicit comparable evidence for the replacement compute-allocation policy, preserved model/reviewer/merge/release authority separation, a credential migration plan, deterministic fallback behavior, and updated canonical traceability/tests. \ No newline at end of file +A later ADR may supersede this decision only with explicit comparable evidence for the replacement compute-allocation policy, preserved model/reviewer/merge/release authority separation, a credential migration plan, deterministic fallback behavior, and updated canonical traceability/tests. From 6d968a4499285c4fe4726fea4476e38f78c92de0 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:42:16 +0900 Subject: [PATCH 081/173] docs(adr): govern test-time compute and model development authority --- ...compute-and-model-development-authority.md | 84 +++++++++++++++++++ 1 file changed, 84 insertions(+) create mode 100644 docs/adr/0012-test-time-compute-and-model-development-authority.md diff --git a/docs/adr/0012-test-time-compute-and-model-development-authority.md b/docs/adr/0012-test-time-compute-and-model-development-authority.md new file mode 100644 index 000000000..1d7d2a1fc --- /dev/null +++ b/docs/adr/0012-test-time-compute-and-model-development-authority.md @@ -0,0 +1,84 @@ +# ADR 0012: Test-time compute and model-assisted development authority + +**Status:** Accepted architecture + +## Context + +LifeOS uses deterministic product logic for authorization, persistence, proposal validation, safety checks, merge eligibility and release acceptance, while selected development and live-conformance workflows may call language models. The repository already has a strong single-route proposal-quality baseline and a bounded contextual-orchestrator evaluation path. Repository-wide agent guidance also requires model-backed work to use `NVIDIA_NIM_API_KEY`, prohibits `COPILOT_GITHUB_TOKEN`, and keeps independent review credentials separate. + +Recent orchestration evidence does not justify a universal rule that more agents are better. Sakana Fugu exposes query-adaptive direct-or-orchestrated execution; the ICLR 2026 Conductor work learns worker selection, targeted instructions, communication topology and recursive orchestration; TRINITY assigns Thinker, Worker and Verifier roles over multiple turns. Counterevidence from a strong-single-agent baseline shows that homogeneous multi-agent workflows can sometimes be matched by one multi-turn agent with efficiency advantages. LifeOS therefore needs an explicit evidence-driven allocation rule rather than a fixed multi-agent preference. + +The detailed live-conformance implementation and references remain in `docs/superpowers/specs/2026-08-06-ai-nim-live-conformance-design.md`. This ADR promotes only the durable repository-wide authority decision. + +## Decision drivers + +- Product correctness, evidence quality, controllability and security outrank latency. +- Additional test-time compute must be justified against a strong simpler baseline under a comparable declared budget. +- Workflow stages, task decomposition, recursion depth, model/role selection, reasoning effort, verifier topology and access lists must remain explicit experimental variables instead of hidden orchestration defaults. +- Model/provider availability must not become authorization, review, merge or release authority. +- Live-provider evidence must be reproducible, bounded, credential-safe and separable from deterministic pull-request gates. +- LifeOS and contextual-orchestrator must remain independently deployable. + +## Alternatives + +### Always use a single model + +This minimizes orchestration complexity and is a necessary baseline, but it can prevent measured gains from heterogeneous specialization, parallel exploration or independent verification. + +### Always use a fixed multi-agent workflow + +This provides predictable topology but spends extra compute on tasks where it may not help, can hide which design dimension produced a gain, and conflicts with evidence that strong single-agent workflows may equal homogeneous multi-agent systems. + +### Adapt compute from measured evidence — selected + +Measure a strong single-model route first, compare additional bounded cells under explicit budgets and controls, and authorize deeper orchestration only when retained LifeOS evidence shows a meaningful quality/evidence gain without deterministic safety or conformance regression. + +## Decision + +1. **Strong baseline first.** Every material model-assisted evaluation includes a strong single-model route before any claim that a conducted or multi-agent profile is preferable. +2. **Explicit test cells.** Reasoning effort, workflow stage, decomposition, recursion depth, worker/model assignment, role, verifier topology, access list/topology and total provider-call/token budget are explicit configuration or evidence fields where supported. +3. **Comparable budgets.** Claims about orchestration benefit compare cells under documented comparable budgets or clearly disclose the budget difference as a limitation. More agents or tokens are never counted as an intrinsic product improvement. +4. **Quality-first selection.** Latency, tokens and provider cost are measured for capacity and commercial review but are not the primary optimization objective. Correctness, evidence quality, safety, reliability and controllability determine acceptance. +5. **Unsupported controls stay unavailable.** A pinned orchestrator that cannot expose a requested recursion, role-effort or generated-topology control returns explicit unsupported evidence. Tests do not simulate or fabricate that ablation. +6. **Credential boundary.** Model-backed LifeOS development/live tests use GitHub Secret `NVIDIA_NIM_API_KEY`, preferably through the exact reviewed contextual-orchestrator integration. `COPILOT_GITHUB_TOKEN` is prohibited for development-model execution. +7. **Independent reviewer boundary.** Existing review-agent identities, credentials and keys remain independent and are never repurposed as development-model authority. +8. **Deterministic authority.** Model outputs are untrusted proposals/evidence. Deterministic LifeOS authorization, schema validation, proposal evaluation, CI/security checks, formal review rules, branch protection, merge decision and release gates remain authoritative even if all models/providers are unavailable. +9. **No hidden reasoning retention.** Retained evidence is bounded and credential-free and excludes prompts, model responses, hidden reasoning and provider secrets unless a separately reviewed product contract explicitly requires otherwise. +10. **Standalone/MSA compatibility.** Normal LifeOS runtime, deterministic tests and release artifacts do not require contextual-orchestrator or NVIDIA availability. The integration composes versioned public contracts only. + +## Consequences + +- A simple route remains the default comparison rather than a second-class fallback. +- Multi-agent/conducted execution can be used when measured LifeOS evidence supports it, including heterogeneous-model settings where single-agent equivalence is not assumed. +- Evaluation reports become more verbose because they record supported/unsupported cells and budget limitations explicitly. +- Orchestrator capability changes require a reviewed pin/update and fresh evidence instead of silently changing the experiment. +- Provider outages can make live-conformance cells unavailable without turning deterministic CI green or red by inference. + +## Failure and recovery + +- Missing provider credentials or model inventory produces explicit unavailable evidence and no fabricated quality result. +- Provider/orchestrator failure cannot bypass deterministic proposal validation or repository gates. +- If a conducted cell regresses injection resistance, operation conformance, grounding or other primary quality criteria, retain the strong single-route profile. +- If a newer orchestrator changes workflow semantics, freeze the old reviewed pin until the new source, contract tests and result schema are reviewed. +- If evidence later shows a different baseline or budget-allocation method is materially better, supersede this ADR rather than weakening the comparison contract ad hoc. + +## Security and privacy impact + +Only the credential-seeding step may receive `NVIDIA_NIM_API_KEY`. LifeOS application code and retained artifacts do not receive or serialize provider credentials. Model execution receives bounded fixture/user data according to the reviewed feature contract and never gains database, branch-protection, review, merge or release authority. Secrets, raw prompts/responses and hidden reasoning are excluded from retained evidence by default. The contextual-orchestrator dependency is pinned to an exact reviewed commit when used. + +## Acceptance evidence + +- `AGENTS.md` preserves the NVIDIA NIM/no-Copilot and explicit orchestration-variable rules. +- Root `ARCHITECTURE.md` preserves the strong-route-first and deterministic-authority boundaries. +- `docs/UML.md` shows credential seeding, route/conduct cells, deterministic LifeOS evaluation, credential-free evidence and governance authority separation. +- `docs/STANDARDS_TRACEABILITY.md` records Fugu, Conductor, TRINITY, strong-single-agent counterevidence and NVIDIA NIM primary documentation with publication status and APA 7 references. +- `packages/commercial-readiness/src/documentation-contract.test.mjs` fails if these canonical decisions disappear. +- The live-conformance harness validates bounded report schemas, unsupported cells and credential scoping without making live provider availability a pull-request merge gate. + +## Migration and rollback + +Existing deterministic proposal behavior needs no data migration. Model-assisted workflows should migrate by adding explicit profile/budget evidence fields while preserving previous report versions for dated evidence. A rollback disables or removes a model-assisted profile without changing deterministic product authorization or stored LifeOS user data. Credential names and independent reviewer credentials are not migrated by this ADR. + +## Supersession + +Supersede this ADR if LifeOS adopts a materially different model-development authority, eliminates model-assisted evaluation entirely, changes the deterministic-vs-model governance split, or obtains stronger product evidence that requires a different baseline/budget-selection contract. A provider or model change alone does not supersede the decision. From cdc7ddbdfd3a95a49e9c3825dca16e98c8e7a0bd Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:42:21 +0900 Subject: [PATCH 082/173] docs(adr): align compute authority filename --- ...nd-model-assisted-development-authority.md | 76 ------------------- 1 file changed, 76 deletions(-) delete mode 100644 docs/adr/0012-test-time-compute-and-model-assisted-development-authority.md diff --git a/docs/adr/0012-test-time-compute-and-model-assisted-development-authority.md b/docs/adr/0012-test-time-compute-and-model-assisted-development-authority.md deleted file mode 100644 index 721b2454a..000000000 --- a/docs/adr/0012-test-time-compute-and-model-assisted-development-authority.md +++ /dev/null @@ -1,76 +0,0 @@ -# ADR 0012: Test-time compute and model-assisted development authority - -**Status:** Accepted architecture -**Date:** 2026-08-10 - -## Context - -LifeOS uses model-backed evaluation for auditable AI-proposal quality and may use model-assisted repository development. These activities can consume different amounts of test-time compute, use single-route or multi-agent orchestration, and depend on external model providers. They must not blur model execution with product authorization, independent review, merge, or release authority. - -Protected-main `AGENTS.md` already requires a strong single-model baseline, explicit reasoning/stage/decomposition/recursion/access-topology ablations, `NVIDIA_NIM_API_KEY`, no `COPILOT_GITHUB_TOKEN`, and independent review-agent credentials. The approved live-conformance design records bounded `route_high`, `route_low`, and conducted evaluation cells through an exact contextual-orchestrator dependency, while unsupported cells remain explicit rather than simulated. - -## Decision drivers - -- correctness, evidence quality, reliability and controllability over agent count or latency; -- comparable-budget evidence before deeper orchestration is preferred; -- deterministic product authorization and proposal validation independent of model availability; -- least-privilege provider credentials and no credential leakage into retained evidence; -- independent review, merge and release authority; -- reproducible, explicitly versioned evaluation cells instead of hidden orchestration defaults; -- standalone LifeOS operation when model providers or contextual-orchestrator are unavailable. - -## Considered alternatives - -1. **Always use the deepest available multi-agent workflow.** Rejected because agent count is not evidence of quality and adds cost, failure modes and coordination confounds. -2. **Optimize primarily for latency or token count.** Rejected because the product requires defensible correctness and safety evidence; latency/cost remain measured capacity signals. -3. **Let model judgement satisfy deterministic CI, authorization, review, merge or release gates.** Rejected because model output is untrusted evidence, not repository or product authority. -4. **Use a strong single-route baseline and admit deeper orchestration only when retained comparable-budget evidence justifies it.** Selected. - -## Decision - -1. Every material model-evaluation campaign includes a strong single-model route as the mandatory comparison baseline. -2. Reasoning effort, workflow stages, role-specific reasoning effort for planner/worker/verifier/synthesizer roles, task decomposition, recursion depth, access lists/communication topology, homogeneous-versus-heterogeneous model pools and verification strategy are explicit experimental/control dimensions when supported by the exact dependency revision. -3. Unsupported controls remain explicitly unavailable; LifeOS does not simulate or silently infer them. -4. Deeper orchestration is selected only when retained LifeOS evidence shows a material quality or heterogeneous-capability benefit without unacceptable safety/reliability regression under a reasonably comparable budget. This is a LifeOS product inference, not a claim of universal multi-agent superiority. -5. Latency, token usage and provider cost are recorded for capacity/cost review but are not the sole or primary optimization objective. -6. Model-backed tests and model-assisted development use GitHub Secret `NVIDIA_NIM_API_KEY` through an approved OpenCode or contextual-orchestrator boundary. `COPILOT_GITHUB_TOKEN` is prohibited. -7. Provider credentials materialize only for the bounded model call/credential-seeding boundary and are excluded from retained prompts, responses, hidden reasoning, logs and artifacts. -8. Review-agent identities and credential chains remain independent from development/model-execution identities. Model execution cannot self-approve, weaken protection, merge, release, or alter deterministic acceptance authority. -9. Deterministic authorization, schema validation, product evaluators, CI/security, exact-head evidence, review, merge and release gates remain authoritative when provider execution is unavailable or disagrees. -10. Normal LifeOS runtime/build/release paths remain independently usable without contextual-orchestrator or NVIDIA availability unless a separately accepted product contract explicitly changes that boundary. - -## Consequences - -- A deeper orchestration profile carries an evidence burden rather than becoming the default by availability. -- Live-provider results are dated conformance/governance evidence and do not become deterministic merge success. -- Evaluation reports must expose profile availability, limitations, quality deltas and bounded resource evidence without retaining sensitive model content. -- New orchestration controls require an explicit contract and regression evidence before they enter production evaluation policy. -- Model-provider outages degrade model-backed evidence collection but do not widen LifeOS product or repository authority. - -## Failure and recovery - -Missing provider credentials, unavailable provider/model inventory, unsupported orchestration controls, bounded provider failures or stochastic evaluation failures produce explicit sanitized unavailable/failure evidence. They do not fabricate quality results and do not weaken deterministic gates. Recovery is a later bounded rerun against an exact LifeOS/dependency revision or a reviewed fallback profile. A malformed report, unsafe credential/materialization path, invalid dependency identity or deterministic test failure fails closed. - -## Security and privacy impact - -Model execution receives only the minimum inputs and credentials required by the bounded evaluation/development operation. Raw prompts, raw responses, hidden reasoning, bearer material, provider credentials and unnecessary tenant content are excluded from retained artifacts. Independent review and merge/release governance remain separate authorities. Model output is untrusted even when the provider succeeds. Governance impact is explicit: development-model identity cannot become counted independent review, merge or release authority. - -## Compatibility and migration - -Existing deterministic LifeOS proposal evaluation remains unchanged and authoritative. Existing live-conformance cells can map to this ADR without changing their result schema. Future contextual-orchestrator pins or orchestration controls are reviewed source/configuration changes and must preserve explicit unsupported-state semantics and credential scoping. Existing review-agent credential names/scopes are not repurposed. - -## Acceptance evidence - -- Protected-main `AGENTS.md` encodes the strong-route baseline, explicit test-time-compute dimensions, NVIDIA NIM credential boundary, no-Copilot rule and review-identity separation. -- `docs/superpowers/specs/2026-08-06-ai-nim-live-conformance-design.md` defines exact route/conduct cells, credential scoping, bounded retained evidence, unsupported profiles and the quality-first decision rule. -- Canonical Standards/Research Traceability records Fugu, Conductor, TRINITY, the strong-single-agent counterevidence and NVIDIA NIM primary API documentation with publication status. -- Canonical UML shows model-execution authority flowing through deterministic evaluation into credential-free retained evidence and a governance decision, while review/merge/release authority remains separate. -- Documentation contracts fail if these authority boundaries or research anchors disappear. - -## Migration and rollback - -A policy change may disable or narrow a model-backed profile without affecting deterministic LifeOS operation. Rollback must not restore `COPILOT_GITHUB_TOKEN`, merge/release authority for development models, implicit orchestration controls, fabricated unsupported results, or provider availability as a deterministic merge prerequisite. - -## Supersession - -A later ADR may supersede this decision only with explicit comparable evidence for the replacement compute-allocation policy, preserved model/reviewer/merge/release authority separation, a credential migration plan, deterministic fallback behavior, and updated canonical traceability/tests. From eb2bbdcc015374324219fdabaa0f45a025c97d0e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:47:38 +0900 Subject: [PATCH 083/173] docs(adr): point compute authority to canonical ADR --- docs/adr/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/adr/README.md b/docs/adr/README.md index 855e0e98c..ff6e0193d 100644 --- a/docs/adr/README.md +++ b/docs/adr/README.md @@ -21,7 +21,7 @@ ADR status uses the same exact canonical documentation values: `Implemented on p | [0009](0009-product-hosting-and-data-evolution.md) | Accepted architecture | Server-backed self-hostable modular MSA supersedes browser-only/single-app primary architecture | | [0010](0010-verification-evidence-identity.md) | Accepted architecture | Contributor source, PR-base snapshot, live base, synthetic merge, workflow checkout, protected-main and release identities remain separate evidence authorities | | [0011](0011-external-integration-authority-and-secret-references.md) | Accepted architecture | External integration metadata uses LifeOS-owned identity, separate secret references and explicit host-granted capability authority | -| [0012](0012-test-time-compute-and-model-assisted-development-authority.md) | Accepted architecture | Strong single-route baseline, measured orchestration selection, NVIDIA/OpenCode credential boundary and model-vs-review/merge/release authority separation | +| [0012](0012-test-time-compute-and-model-development-authority.md) | Accepted architecture | Strong single-route baseline, measured orchestration selection, NVIDIA/OpenCode credential boundary and model-vs-review/merge/release authority separation | ## ADR quality contract From 53dbf6342daa6ff75941fee357639abb1fabbbd4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:48:03 +0900 Subject: [PATCH 084/173] docs(adr): make role effort dimension explicit --- .../0012-test-time-compute-and-model-development-authority.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/adr/0012-test-time-compute-and-model-development-authority.md b/docs/adr/0012-test-time-compute-and-model-development-authority.md index 1d7d2a1fc..dbf1cb13d 100644 --- a/docs/adr/0012-test-time-compute-and-model-development-authority.md +++ b/docs/adr/0012-test-time-compute-and-model-development-authority.md @@ -14,7 +14,7 @@ The detailed live-conformance implementation and references remain in `docs/supe - Product correctness, evidence quality, controllability and security outrank latency. - Additional test-time compute must be justified against a strong simpler baseline under a comparable declared budget. -- Workflow stages, task decomposition, recursion depth, model/role selection, reasoning effort, verifier topology and access lists must remain explicit experimental variables instead of hidden orchestration defaults. +- Workflow stages, task decomposition, recursion depth, model/role selection, role-specific reasoning effort, verifier topology and access lists must remain explicit experimental variables instead of hidden orchestration defaults. - Model/provider availability must not become authorization, review, merge or release authority. - Live-provider evidence must be reproducible, bounded, credential-safe and separable from deterministic pull-request gates. - LifeOS and contextual-orchestrator must remain independently deployable. @@ -36,7 +36,7 @@ Measure a strong single-model route first, compare additional bounded cells unde ## Decision 1. **Strong baseline first.** Every material model-assisted evaluation includes a strong single-model route before any claim that a conducted or multi-agent profile is preferable. -2. **Explicit test cells.** Reasoning effort, workflow stage, decomposition, recursion depth, worker/model assignment, role, verifier topology, access list/topology and total provider-call/token budget are explicit configuration or evidence fields where supported. +2. **Explicit test cells.** Reasoning effort, workflow stage, decomposition, recursion depth, worker/model assignment, role-specific reasoning effort, verifier topology, access list/topology and total provider-call/token budget are explicit configuration or evidence fields where supported. 3. **Comparable budgets.** Claims about orchestration benefit compare cells under documented comparable budgets or clearly disclose the budget difference as a limitation. More agents or tokens are never counted as an intrinsic product improvement. 4. **Quality-first selection.** Latency, tokens and provider cost are measured for capacity and commercial review but are not the primary optimization objective. Correctness, evidence quality, safety, reliability and controllability determine acceptance. 5. **Unsupported controls stay unavailable.** A pinned orchestrator that cannot expose a requested recursion, role-effort or generated-topology control returns explicit unsupported evidence. Tests do not simulate or fabricate that ablation. From 0d60fb9aa454596ae8440aaa187157d73e575cf8 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:48:42 +0900 Subject: [PATCH 085/173] test(docs): align compute authority with canonical sources --- .../src/documentation-contract.test.mjs | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/packages/commercial-readiness/src/documentation-contract.test.mjs b/packages/commercial-readiness/src/documentation-contract.test.mjs index 443e6e914..f341449cc 100644 --- a/packages/commercial-readiness/src/documentation-contract.test.mjs +++ b/packages/commercial-readiness/src/documentation-contract.test.mjs @@ -266,10 +266,10 @@ test('model-assisted compute authority and counterevidence remain canonical', () assert.match(adr, /COPILOT_GITHUB_TOKEN/u); assert.match(adr, /deterministic/iu); - for (const evidenceName of ['AgentFugue', 'Conductor', 'TRINITY']) { + for (const evidenceName of ['Fugu', 'Conductor', 'TRINITY']) { assert.match(standards, new RegExp(evidenceName, 'u')); } - assert.match(standards, /Single-Agent LLMs Outperform Multi-Agent Systems/iu); + assert.match(standards, /Rethinking the value of multi-agent workflow/iu); assert.match(standards, /preprint/iu); assert.match(standards, /ICLR 2026/iu); assert.match(standards, /NVIDIA NIM/iu); @@ -283,7 +283,7 @@ test('model-assisted compute authority and counterevidence remain canonical', () assert.match(uml, /review.*merge.*release/isu); assert.match(traceability, /ADR 0012/u); - assert.match(traceability, /AgentFugue/iu); + assert.match(traceability, /Fugu/iu); assert.match(architecture, /A strong single-model route is measured before deeper orchestration/u); assert.match(agents, /NVIDIA_NIM_API_KEY/u); assert.doesNotMatch(agents, /use\s+COPILOT_GITHUB_TOKEN/iu); From 28333d7994f6b8c9ccb5c69e984153db231146e4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:53:40 +0900 Subject: [PATCH 086/173] docs(traceability): reconcile protected verification evidence --- docs/TRACEABILITY.md | 57 +++++++++++++++++++++++++------------------- 1 file changed, 33 insertions(+), 24 deletions(-) diff --git a/docs/TRACEABILITY.md b/docs/TRACEABILITY.md index ebffa6a7d..e51e993bf 100644 --- a/docs/TRACEABILITY.md +++ b/docs/TRACEABILITY.md @@ -6,27 +6,35 @@ Protected-main source/migrations/tests and live repository policy outrank this i | Requirement / decision | Status | Representative evidence | Open follow-up | | --- | --- | --- | --- | -| Login/session/workspace authority | Implemented on protected main | identity OAuth/session runtime | — | -| UUIDv4 internal IDs | Implemented on protected main | validators/migrations + ADR 0001 | — | -| Durable Goals/Projects/Tasks/Today | Implemented on protected main | planning + PR #127 | — | -| Recurring habits / review projections / reminders | Implemented on protected main | owning services/tests | — | -| Conflict-safe calendar sync | Implemented on protected main | provider adapters + #139 | — | -| Calendar connection persistence | Implemented on protected main | #150 / `1623df364925f84920c07c112f1ae96777277d20` | #129 | -| Calendar local revocation | Implemented on protected main | #153 / `b13413e571bad82535f63d478e40746d12c3e680` | provider-side revoke remains #129 | -| Calendar workspace+user signed authority | Implemented on protected main | #155 / `7b34a5a584b037653d091ea661ae4627bb5dd2ea` | public hosted disconnect/runtime #129 | -| Complete hosted calendar credential lifecycle | Partial | protected foundations above | #129 | -| Inert auditable AI proposals | Implemented on protected main | AI proposal/audit tests | — | -| Purpose-bound sensitive access | Implemented on protected main | privacy-service evidence | — | -| Recent-auth + durable rights ledger | Implemented on protected main | #134/#136/#137/#138/#144 | #55 | -| Authenticated rights status | Implemented on protected main | #146 | #55 | -| Per-section export integrity | Implemented on protected main | #149 | #55 | -| Complete export/delete orchestration | Partial | protected rights/integrity foundations | #55 | -| Plugin SDK/manifest validation | Implemented on protected main | plugin SDK/integration tests | — | -| Explicit host-owned plugin installation grants | Implemented on protected main | #151 / `6971c4e11b3204ec41526c7c959a248e54440e1c` | #130 | -| Durable plugin installation persistence | Implemented on active PR | #156; workspace-scoped repository lookup + migration | #130 secret/delivery runtime | -| Complete plugin secret/outbound delivery runtime | Partial | protected grant authority + active persistence | #130 | -| Buyer-gap vs capability-maturity separation | Implemented on protected main | readiness registry | — | -| Source/base/merge evidence attribution | Implemented on active PR | ADR 0010 + clean #154; #147 Superseded | #132 | +| PRD-ID-001 login/session/workspace authority | Implemented on protected main | identity OAuth/session runtime | — | +| PRD-ID-002 opaque UUIDv4 internal IDs | Implemented on protected main | validators/migrations + ADR 0001 | — | +| PRD-PLAN-001 durable Goals/Projects/Tasks | Implemented on protected main | planning repository/migrations | — | +| PRD-PLAN-002 durable Today synchronization | Implemented on protected main | PR #127 + concurrency/browser evidence | — | +| PRD-HAB-001 recurring habits | Implemented on protected main | habit service persistence/tests | — | +| PRD-REV-001 review projection boundary | Implemented on protected main | review-service tests | — | +| PRD-CAL-001 conflict-safe calendar sync | Implemented on protected main | provider adapters | — | +| PRD-CAL-002 trusted workspace calendar context | Implemented on protected main | PR #139 | — | +| PRD-CAL-003 complete hosted per-user calendar credential lifecycle | Partial | protected foundations below | issue #129 | +| PRD-CAL-004 workspace+user calendar connection persistence | Implemented on protected main | PR #150 / `1623df364925f84920c07c112f1ae96777277d20` | #129 | +| PRD-CAL-005 atomic tenant+user calendar connection revocation | Implemented on protected main | PR #153 / `b13413e571bad82535f63d478e40746d12c3e680` | provider-side revoke remains #129 | +| PRD-CAL-006 signed workspace+user calendar authority | Implemented on protected main | PR #155 / `7b34a5a584b037653d091ea661ae4627bb5dd2ea` | hosted connection/disconnect runtime #129 | +| PRD-NOT-001 bounded reminders | Implemented on protected main | notification persistence/scheduler tests | — | +| PRD-AI-001 inert auditable proposals | Implemented on protected main | AI proposal/audit tests | — | +| PRD-AI-002 deterministic/live-provider separation | Implemented on protected main | proposal evaluator + bounded live conformance | — | +| PRD-PRIV-001 purpose-bound sensitive access | Implemented on protected main | privacy-service evidence | — | +| PRD-PRIV-002 recent-auth + durable rights request ledger | Implemented on protected main | #134/#136/#137/#138/#144 | #55 | +| PRD-PRIV-003 complete export/delete orchestration | Partial | protected rights/integrity foundations exist | #55 | +| PRD-PRIV-004 authenticated bounded rights status | Implemented on protected main | PR #146 | #55 | +| PRD-PRIV-005 per-section export integrity evidence | Implemented on protected main | PR #149 | #55 | +| PRD-INT-001 plugin SDK/manifest validation | Implemented on protected main | plugin SDK/integration tests | — | +| PRD-INT-002 complete plugin secret/outbound delivery runtime | Partial | protected grant authority + active durable persistence | #130 | +| PRD-INT-003 explicit tenant-scoped plugin installation grants | Implemented on protected main | PR #151 / `6971c4e11b3204ec41526c7c959a248e54440e1c` | #130 | +| PRD-INT-004 durable plugin installation persistence | Implemented on active PR | PR #156; workspace+installing-user-scoped migration/repository | #130 secret/delivery runtime | +| PRD-WEB-001 accessible localized PWA | Implemented on protected main | browser/accessibility/localization tests | — | +| PRD-OPS-001 backup/restore | Implemented on protected main | backup scripts/tests/runbook | — | +| PRD-OPS-002 provider-neutral deployment/readiness/metrics | Implemented on protected main | infra/observability tests | — | +| PRD-GOV-001 buyer-gap vs capability-maturity separation | Implemented on protected main | readiness registry | — | +| PRD-GOV-002 exact source/live-base/integration evidence attribution | Implemented on protected main | ADR 0010 + PR #154 merged as `2c272a404f8f3a74aa5796a1957d4a6ce0fabe8f`; #147 Superseded | #132 remains for residual central scanner evidence classification | ## Architecture decisions @@ -39,8 +47,9 @@ Protected-main source/migrations/tests and live repository policy outrank this i | Purpose-bound sensitive access | Accepted architecture | ADR 0005 | | Capability maturity != buyer-gap exhaustion | Accepted architecture | ADR 0008 | | Canonical documentation uses explicit maturity | Accepted architecture | ADR 0007 | -| Verification identities remain separate | Accepted architecture | ADR 0010 + #154 | +| Verification identities remain separate | Accepted architecture | ADR 0010 + protected PR #154 | | Integration identity, metadata, secret references and grants remain separate | Accepted architecture | ADR 0011 + protected #150/#151/#153/#155 + active #156 | +| Test-time compute and model-assisted development authority remain evidence-driven and separate from review/merge/release authority | Accepted architecture | ADR 0012 + protected `AGENTS.md` + live-conformance design + Fugu/Conductor/TRINITY/strong-single-agent evidence | ## Evidence hierarchy @@ -51,11 +60,11 @@ Protected-main source/migrations/tests and live repository policy outrank this i 5. issues/plans/research for incomplete work; 6. historical chat/old PRs as rationale only. -`source_head_sha`, PR-base snapshot, independently resolved live-base tip, synthetic merge tree, workflow checkout, protected-main head and release source are distinct evidence identities. +`source_head_sha`, `pr_base_snapshot_sha`, `live_base_tip_sha`, integration/synthetic tree identity, workflow checkout identity, protected-main head and release source are distinct evidence authorities. A green result never transfers from one identity to another. ## Buyer-gap state -Canonical buyer gaps remain #55, #129 and #130. Protected #146/#149 advance #55; protected #150/#153/#155 advance #129; protected #151 plus active #156 advance #130. None closes its parent gap by implication. #132 is verification reliability with clean active #154 after #147 supersession. +Canonical buyer gaps remain #55, #129 and #130. Protected #146/#149 advance #55; protected #150/#153/#155 advance #129; protected #151 plus active #156 advance #130. None closes its parent gap by implication. Issue #132 is now a narrower verification-governance gap: protected #154 fixed LifeOS source/live-base/integration evidence separation, while residual central SAST/Security scanner checkout/attribution taxonomy still requires auditable classification. ## Update rule From 80dc46808efa91a96e7f8c03bff94fd5b517e15d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:54:21 +0900 Subject: [PATCH 087/173] docs(uml): reconcile protected authority and model evaluation --- docs/UML.md | 42 +++++++++++++++++++++++++++++++++--------- 1 file changed, 33 insertions(+), 9 deletions(-) diff --git a/docs/UML.md b/docs/UML.md index 509e9f374..9c517f666 100644 --- a/docs/UML.md +++ b/docs/UML.md @@ -111,9 +111,9 @@ Connection metadata carries opaque secret references. Local revocation does not ### User-aware hosted authority -**Status:** Implemented on active PR +**Status:** Implemented on protected main -**Evidence:** PR #155. +**Evidence:** PR #155 merged as `7b34a5a584b037653d091ea661ae4627bb5dd2ea`. ```mermaid sequenceDiagram @@ -152,6 +152,30 @@ sequenceDiagram AI->>Audit: append decision ``` +## Model-assisted evaluation and development authority + +**Status:** Accepted architecture + +**Evidence:** ADR 0012, protected-main `AGENTS.md`, and the reviewed live-conformance design. + +```mermaid +flowchart LR + Secret[GitHub Secret NVIDIA_NIM_API_KEY] --> Seed[Approved contextual-orchestrator / credential seeding] + Seed --> Route[Strong single-route baseline] + Seed --> Conduct[Bounded conduct cells] + Route --> Eval[Deterministic LifeOS proposal evaluator] + Conduct --> Eval + Eval --> Evidence[Credential-free retained evidence] + Evidence --> Governance[Governance decision] + + Review[Independent review authority] --> Merge[Merge authority] + Merge --> Release[Release authority] + Governance -. evidence only .-> Review + Seed -. no review/merge/release authority .-> Review +``` + +Model execution can vary reasoning effort, workflow stages, decomposition, recursion depth, role-specific reasoning effort and access topology only when the exact reviewed dependency exposes those controls. Unsupported cells remain explicit. A conducted result does not self-approve or replace deterministic CI/security/review/merge/release authority. + ## Data-rights lifecycle ### Request / status @@ -223,7 +247,7 @@ stateDiagram-v2 Conflict --> [*] ``` -PR #151 protects this authority. Durable plugin-secret persistence/outbound delivery remain **Partial** under #130. +PR #151 protects this authority. Durable plugin installation persistence is active on PR #156; plugin-secret persistence/outbound delivery remain **Partial** under #130. ## Backup / deployment @@ -243,18 +267,18 @@ Logical backup/restore verifies integrity and safe targets; it does not claim PI ## Verification evidence state -**Status:** Implemented on active PR +**Status:** Implemented on protected main -**Evidence:** ADR 0010 and clean successor PR #154; #147 is Superseded. +**Evidence:** ADR 0010 and PR #154 merged as `2c272a404f8f3a74aa5796a1957d4a6ce0fabe8f`; #147 is Superseded. ```mermaid flowchart LR Source[source_head_sha] --> SourceCheck[Exact source verification] BaseSnapshot[pr_base_snapshot_sha] --> Metadata[Historical PR snapshot] LiveBase[live_base_tip_sha] --> MergeDecision[Current base-sensitive decision] - Source --> MergeTree[merge_tree_sha] - LiveBase --> MergeTree - MergeTree --> MergeCheck[Compatibility evidence] + Source --> Integration[integration_tree_sha] + LiveBase --> Integration + Integration --> MergeCheck[Compatibility evidence] SourceCheck --> Gate MergeCheck --> Gate MergeDecision --> Gate @@ -262,7 +286,7 @@ flowchart LR Main --> Release[release_source_sha] ``` -No green result transfers authority across identities. PR #154 additionally requires the checked synthetic merge parents to match fresh current source and current live base evidence. +No green result transfers authority across identities. Protected PR #154 reconstructs compatibility from the independently resolved current source and live base. Issue #132 remains open only for residual central SAST/Security scanner checkout and attribution classification; current central Semgrep synthetic-merge evidence must not be relabeled exact-source evidence. ## Degraded modes From 8771499a3ed5b08d5c628a44087331e93c548e5e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:54:59 +0900 Subject: [PATCH 088/173] docs(prd): reconcile verification maturity --- docs/PRD.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/PRD.md b/docs/PRD.md index 48ac6a225..74e64f301 100644 --- a/docs/PRD.md +++ b/docs/PRD.md @@ -58,12 +58,12 @@ Canonical requirements use exactly one of: `Implemented on protected main`, `Imp | PRD-INT-001 | Versioned plugin SDK/validation without direct database authority. | Implemented on protected main | plugin SDK/integration-service tests | | PRD-INT-002 | Complete plugin runtime installation, encrypted secret storage, SSRF-safe outbound delivery, retries/dead-letter behavior and revocation. | Partial | protected installation authority exists; durable secret/delivery runtime remains issue #130 | | PRD-INT-003 | Treat a validated manifest as untrusted intent and grant only explicit tenant-scoped installation capabilities with exact replay/conflict/revocation semantics. | Implemented on protected main | PR #151 merged as `6971c4e11b3204ec41526c7c959a248e54440e1c` | -| PRD-INT-004 | Persist restart-safe plugin installation authority with service-owned multiword schema/table naming, fixed SQL, explicit lifecycle evidence and workspace-scoped lookups at the persistence boundary. | Implemented on active PR | PR #156; tenant lookup hardening keeps workspace scope in SQL; no secret/delivery authority implied | +| PRD-INT-004 | Persist restart-safe plugin installation authority with service-owned multiword schema/table naming, fixed SQL, explicit lifecycle evidence and workspace+installing-user-scoped lookups at the persistence boundary. | Implemented on active PR | PR #156; no secret/delivery authority implied | | PRD-WEB-001 | Responsive installable PWA with keyboard-operable core flows and Korean/English catalogs. | Implemented on protected main | browser/accessibility/localization tests | | PRD-OPS-001 | Logical PostgreSQL backup/restore with integrity and unsafe-target refusal. | Implemented on protected main | backup scripts/tests/runbook | | PRD-OPS-002 | Provider-neutral production reference deployment and bounded health/readiness/metrics. | Implemented on protected main | infra and observability tests | | PRD-GOV-001 | Capability maturity and buyer-gap exhaustion are reported independently. | Implemented on protected main | buyer-gap registry and issue #21 report | -| PRD-GOV-002 | Required PR verification identifies the commit tree actually checked and does not conflate exact source-head verification, stale PR-base snapshots, independently resolved live-base state or synthetic-merge compatibility evidence. | Implemented on active PR | clean successor PR #154 advances issue #132; ADR 0010 defines the evidence identities; #147 is superseded | +| PRD-GOV-002 | Required PR verification identifies the commit tree actually checked and does not conflate exact source-head verification, stale PR-base snapshots, independently resolved live-base state or integration compatibility evidence. | Implemented on protected main | PR #154 merged as `2c272a404f8f3a74aa5796a1957d4a6ce0fabe8f`; ADR 0010 defines evidence identities; issue #132 remains only for residual central scanner classification | ## Non-functional requirements @@ -74,7 +74,7 @@ Canonical requirements use exactly one of: `Implemented on protected main`, `Imp - Integrity digests are evidence, not authorization, confidentiality, provenance or digital signatures. - Core customer journeys require realistic PostgreSQL and browser evidence, not mock-only success. - Product-owned production packages maintain exact coverage gates where configured and beginner-readable public documentation. -- Verification evidence remains bound to the exact commit tree it inspected rather than being promoted across source, merge, base or release identities. +- Verification evidence remains bound to the exact commit tree it inspected rather than being promoted across source, integration, base or release identities. ## Non-goals From 4b3dc43c5eaa723bff0e4598f1e0ed8a09b83d0b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:56:42 +0900 Subject: [PATCH 089/173] docs(architecture): reconcile protected verification and compute authority --- ARCHITECTURE.md | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index cc68965fc..6be7aac2b 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -55,7 +55,7 @@ Durable Today synchronization is protected-main behavior: explicit local-to-work Conflict-safe CalDAV/Google sync and signed trusted workspace context are protected main. PR #150 added the service-owned `calendar_integration.calendar_connection_record` persistence foundation scoped simultaneously to workspace and user, with bounded provider/account/calendar metadata, normalized scopes and opaque external credential references. PR #153 added atomic tenant+user-scoped local connection revocation and replay semantics. -PR #155 is **Implemented on active PR** for a distinct short-lived signed `life-os.calendar-user.v1` context binding both workspace and requesting-user UUIDv4 identities for user-sensitive hosted operations. It adds authority evidence only, not the public disconnect/runtime composition. +PR #155 is **Implemented on protected main** and adds a distinct short-lived signed `life-os.calendar-user.v1` context binding both workspace and requesting-user UUIDv4 identities for user-sensitive hosted operations. It adds authority evidence only, not the public disconnect/runtime composition. The complete hosted lifecycle remains **Partial** under #129: OAuth state/PKCE, concrete managed secret storage, refresh/provider-side revocation, discovery/selection and migration from development provider configuration are separate gates. Provider IDs/credentials never become LifeOS primary IDs or general login credentials. @@ -63,7 +63,9 @@ The complete hosted lifecycle remains **Partial** under #129: OAuth state/PKCE, Protected main owns versioned plugin manifest/event validation and, through PR #151, explicit host-owned installation authority. A validated manifest expresses requested intent; the host grants a bounded tenant-scoped capability subset. Exact replay is permitted only for matching authority evidence, conflicting installation-ID reuse fails, cross-tenant/user existence is not disclosed, and revocation ends active authority while preserving bounded audit evidence. -Issue #130 remains **Partial** because durable installation/secret persistence, protected secret handles, authorized-origin SSRF-safe delivery, retry/dead-letter/audit and delivery-time revocation enforcement are not yet the complete protected runtime. Installation authority does not imply those capabilities exist. +PR #156 is **Implemented on active PR** for restart-safe plugin installation persistence with application and SQL lookup/revocation authority scoped by installation, workspace and installing user. It does not add secret storage or outbound delivery authority. + +Issue #130 remains **Partial** because protected secret handling, authorized-origin SSRF-safe delivery, retry/dead-letter/audit and delivery-time revocation enforcement are not yet the complete protected runtime. Installation authority or persistence does not imply those capabilities exist. ## 6. AI proposal boundary @@ -77,11 +79,15 @@ Privacy owns purpose-bound sensitive-access decisions, bounded grants and audit ADR 0011 is authoritative: LifeOS integration records use internal UUIDv4 identity; external provider/plugin identifiers remain bounded metadata; credential material is referenced through opaque secret handles or equivalent least-authority secret-store references; manifests cannot self-authorize capabilities; revocation/replay/conflict semantics fail closed; owning services retain migrations/repositories/API authority. -Protected #150/#151/#153 and active #155 are evidence of this boundary. Their existence does not close parent #129/#130 runtime lifecycles. +Protected #150/#151/#153/#155 and active #156 are evidence of this boundary. Their existence does not close parent #129/#130 runtime lifecycles. ## 9. Test-time compute and repository automation -A strong single-model route is measured before deeper orchestration. Reasoning effort, stage, decomposition, recursion, role and access topology are explicit experimental variables. Scheduled model-assisted development uses reviewed OpenCode with `NVIDIA_NIM_API_KEY` where model access is required; development models receive no product-data, independent-review, branch-protection, merge or release authority. Deterministic reverification remains independent. +ADR 0012 is authoritative. A strong single-model route is the mandatory comparison baseline before deeper orchestration. Reasoning effort, workflow stage, decomposition, recursion depth, role-specific reasoning effort, model/worker selection, verifier topology and access-list/communication topology are explicit experimental dimensions when the exact reviewed dependency supports them. Unsupported controls remain explicit rather than simulated. + +Deeper orchestration is selected only when retained LifeOS evidence demonstrates a material correctness/evidence/capability gain under a documented reasonably comparable budget without unacceptable safety/reliability regression. Latency, provider calls, tokens and cost are measured for capacity/commercial review but are not the sole or primary objective. + +Model-backed tests and model-assisted development use reviewed OpenCode or contextual-orchestrator boundaries with GitHub Secret `NVIDIA_NIM_API_KEY`; `COPILOT_GITHUB_TOKEN` is prohibited. Development-model identity receives no product-data authority beyond its bounded input, independent-review authority, branch-protection authority, merge authority or release authority. Retained evidence is credential-free and excludes raw prompts/responses/hidden reasoning. Deterministic authorization, evaluation, CI/security, formal review, merge and release gates remain authoritative when model providers are unavailable or disagree. ## 10. Verification evidence identity and merge safety @@ -90,12 +96,14 @@ Repository evidence identities are distinct: - `source_head_sha` — exact contributor/source head; - `pr_base_snapshot_sha` — PR/event base snapshot, historical once base moves; - `live_base_tip_sha` — independently resolved current base-ref tip; -- `merge_tree_sha` — synthetic integration tree; +- `integration_tree_sha` / synthetic merge identity — separately classified integration evidence; - `workflow_checkout_sha` — exact tree inspected by a job; - `protected_main_sha` — integrated protected-main evidence; - `release_source_sha` — protected source bound to released artifacts. -ADR 0010 is authoritative. Exact-source verification and merge-tree compatibility answer different questions. Old PR #147 is **Superseded**. Clean successor PR #154 is **Implemented on active PR** and binds source-verification jobs to contributor head, AppGuardrail SARIF to the analyzed source identity, and a distinct merge-compatibility job to current-source/current-live-base parent evidence. Issue #132 remains open until that line integrates and residual required-workflow attribution is reconciled. +ADR 0010 is authoritative. Exact-source verification and integration compatibility answer different questions. Old PR #147 is **Superseded**. PR #154 is **Implemented on protected main** as merge commit `2c272a404f8f3a74aa5796a1957d4a6ce0fabe8f`: LifeOS source-verification jobs bind to contributor head, AppGuardrail SARIF binds to the analyzed source identity, and the distinct merge-compatibility job reconstructs and verifies an integration tree from the current independently resolved source and live-base identities. + +Issue #132 remains open only for residual central reusable scanner classification: central SAST/Security jobs must make the actual checkout/evidence identity auditable and must not relabel synthetic/integration-tree evidence as exact-source evidence. Check names/ruleset strictness are preserved while that taxonomy is made explicit. Pull requests are processed work-conservingly: inspect current evidence, RCA non-passing gates, make the smallest test-first correction, rerun exact evidence, resolve only addressed findings, and merge only an unchanged head accepted by live repository policy. Waiting on one lane never authorizes stale evidence or repository-wide idle time. From 74a8bb47016dc2f65ba1231c6a26577c026e6375 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:57:26 +0900 Subject: [PATCH 090/173] docs(trd): reconcile protected evidence and plugin persistence --- docs/TRD.md | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) diff --git a/docs/TRD.md b/docs/TRD.md index fd5b3147a..f255aeee3 100644 --- a/docs/TRD.md +++ b/docs/TRD.md @@ -18,11 +18,11 @@ LifeOS is a TypeScript-first monorepo with a Next.js PWA/BFF, independently boun - **Planning:** Goals, Projects, Tasks, durable Today aggregate and search. - **Habit:** recurrence definitions and completion evidence. - **Review:** review snapshots/projections; no direct planning mutation. -- **Calendar integration:** provider adapters, sync state, trusted workspace context and protected-main workspace+user scoped connection persistence. Complete hosted credential lifecycle remains partial under #129. +- **Calendar integration:** provider adapters, sync state, trusted workspace and workspace+user signed context, and protected-main workspace+user scoped connection persistence/revocation. Complete hosted credential lifecycle remains partial under #129. - **Notification:** reminder occurrences, claims, outcomes and delivery recovery. - **AI proposal:** proposals, evidence, explicit decisions and deterministic evaluation; no generic planning mutation authority. - **Privacy:** purpose-bound sensitive-access decisions/grants/events. -- **Plugin integration:** versioned plugin contracts, validation and protected-main explicit installation-grant authority. Complete durable secret/delivery runtime remains partial under #130. +- **Plugin integration:** versioned plugin contracts, validation and protected-main explicit installation-grant authority; PR #156 is active for restart-safe installation persistence. Complete secret/delivery runtime remains partial under #130. ## Data requirements @@ -43,6 +43,7 @@ LifeOS is a TypeScript-first monorepo with a Next.js PWA/BFF, independently boun - Client-selected workspace/actor identifiers are never trusted as authority. - Signed private context binds exact actor/workspace/method/path and bounded issuance time where service separation requires it. - Calendar synchronization uses the trusted signed workspace context implemented on protected main; legacy workspace headers cannot override it. +- User-sensitive hosted calendar operations use the protected `life-os.calendar-user.v1` context from PR #155, binding workspace and requesting user under a version distinct from workspace-only sync authority. - Sensitive operations add purpose/resource/tenant authorization and, for data rights, recent-authentication policy derived from authentication provenance rather than session rotation. - Plugin capabilities are host-granted authority; a manifest expresses requested intent only. @@ -71,11 +72,11 @@ This endpoint is one lifecycle surface and does not imply complete cross-domain PR #149 requires each contributor export section to provide a versioned schema and safe non-negative business record count. LifeOS normalizes bounded JSON, uses locale-independent UTF-16 property ordering for deterministic hashing, computes a SHA-256 section digest over contributor/schema/count/data, and retains a whole-export digest. Digest evidence is not authorization, confidentiality, provenance or a digital signature. -### Calendar connection registry +### Calendar connection registry and local revocation **Status:** Implemented on protected main -PR #150 defines the protected service-owned migration/repository for a connection scoped simultaneously to workspace and user, with bounded provider/account/calendar metadata, normalized scopes, opaque external credential references, fixed parameterized SQL and fail-closed duplicate persisted evidence. It does not complete issue #129. +PR #150 defines the protected service-owned migration/repository for a connection scoped simultaneously to workspace and user, with bounded provider/account/calendar metadata, normalized scopes, opaque external credential references, fixed parameterized SQL and fail-closed duplicate persisted evidence. PR #153 adds an atomic tenant+user-scoped active-to-revoked transition. These foundations do not complete issue #129 or imply provider-side OAuth revocation. ### Plugin installation authority @@ -83,6 +84,12 @@ PR #150 defines the protected service-owned migration/repository for a connectio PR #151 separates validated manifest intent from host authority. LifeOS grants only an explicit bounded capability subset, accepts exact replay, rejects conflicting installation-ID reuse, hides cross-tenant/user existence and preserves revocation evidence. It does not imply complete persistent secret or outbound-delivery runtime under #130. +### Plugin installation persistence + +**Status:** Implemented on active PR + +PR #156 adds a service-owned `plugin_integration.plugin_installation_record` persistence foundation. Application and PostgreSQL read/revocation paths bind installation, workspace and installing-user authority; malformed or corrupt evidence fails closed. It stores installation authority/evidence only and does not add plugin credential plaintext, KMS lifecycle or outbound-delivery authority. + ## Event requirements Versioned events carry opaque event ID, explicit type/version, validated actor/workspace/correlation/causation context and immutable payload semantics. Consumers are idempotent under replay. Cross-service events never grant direct database mutation authority. @@ -92,14 +99,16 @@ Versioned events carry opaque event ID, explicit type/version, validated actor/w - **Today:** protected-main aggregate uses explicit strong create/update preconditions, idempotency and stale-conflict handling with durable PostgreSQL concurrency evidence. - **Habit completion:** tenant-scoped replay-safe persistence. - **Notification:** expiring/fenced claims and duplicate-delivery refusal. -- **Calendar:** deterministic provider identity/preconditions, trusted context and protected tenant+user+connection scoped repository invariants from #150. +- **Calendar:** deterministic provider identity/preconditions, trusted context, protected tenant+user+connection repository invariants from #150 and atomic local revocation from #153. - **AI decisions:** bind decision to exact proposal digest/revision, actor/workspace and idempotency identity. - **Data rights:** durable request identity and immutable terminal receipts; status lookup is scoped simultaneously by request, workspace and requesting user and fails closed on corruption. -- **Plugin installation:** protected #151 requires exact replay/conflict/revocation semantics for host-granted authority. +- **Plugin installation:** protected #151 requires exact replay/conflict/revocation semantics for host-granted authority; active #156 carries the same scope into restart-safe persistence. ## AI / automation requirements -Model output is untrusted structured data. Deterministic validators and user/product authorization remain authoritative. Live provider availability is separated from deterministic merge gates. Scheduled autonomous development uses reviewed OpenCode with `NVIDIA_NIM_API_KEY`; `COPILOT_GITHUB_TOKEN` is prohibited as a development-model credential. A strong single-route baseline precedes deeper orchestration and evaluation records role, stage, reasoning effort, decomposition, recursion and access topology. +ADR 0012 is the durable test-time-compute/development authority. Model output is untrusted structured data. Deterministic validators and user/product authorization remain authoritative. Live provider availability is separated from deterministic merge gates. Scheduled autonomous development uses reviewed OpenCode or contextual-orchestrator with `NVIDIA_NIM_API_KEY`; `COPILOT_GITHUB_TOKEN` is prohibited as a development-model credential and independent review-agent credentials are not reused. + +A strong single-route baseline precedes deeper orchestration. Evaluation records supported dimensions such as workflow stage, reasoning effort, role-specific reasoning effort, decomposition, recursion depth, worker/model selection, verifier topology and access-list/communication topology. Unsupported controls remain explicit rather than fabricated. Deeper orchestration is selected only from retained LifeOS quality/evidence under a documented reasonably comparable budget; latency/tokens/cost are measured but are not the sole or primary optimization objective. Model execution never becomes review, merge or release authority. ## Security/privacy requirements @@ -127,12 +136,12 @@ Required evidence classes retain explicit identities: - `source_head_sha`: exact contributor/source branch head for direct source verification; - `pr_base_snapshot_sha`: GitHub PR/event base snapshot, historical once the live base moves; - `live_base_tip_sha`: independently resolved current base-ref tip for base-sensitive decisions; -- `merge_tree_sha`: synthetic integration tree used only for separately classified compatibility evidence; +- `integration_tree_sha` or explicitly synthetic merge identity: separately classified compatibility evidence; - `workflow_checkout_sha`: exact tree inspected by one evidence-producing job; - `protected_main_sha`: integrated protected-main evidence identity; - `release_source_sha`: exact protected source bound to release artifacts. -A green result for one class cannot be promoted to another. SARIF/security evidence must be attributed to the commit/ref actually analyzed. Clean successor PR #154 is `Implemented on active PR` for the current source-head/merge-tree correction after #147 was superseded; issue #132 remains open until protected-main integration and residual attribution are reconciled. +A green result for one class cannot be promoted to another. SARIF/security evidence must be attributed to the commit/ref actually analyzed. PR #154 is implemented on protected main as `2c272a404f8f3a74aa5796a1957d4a6ce0fabe8f`: LifeOS source jobs and AppGuardrail attribution bind exact source, while the distinct compatibility path reconstructs the integration tree from fresh current source and live base. Issue #132 remains open only for residual central reusable SAST/Security checkout/evidence classification; a synthetic merge scan cannot be relabeled exact-source success. ## Release requirements From 22a8ef29a84ecf3b85bf9bdf5a57b100bf5fb1b4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:57:58 +0900 Subject: [PATCH 091/173] docs(api): reconcile protected calendar and verification contracts --- docs/API_CONTRACTS.md | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/docs/API_CONTRACTS.md b/docs/API_CONTRACTS.md index 93bd4696e..aba0cc182 100644 --- a/docs/API_CONTRACTS.md +++ b/docs/API_CONTRACTS.md @@ -26,8 +26,8 @@ This registry summarizes repository-level API/event invariants. Concrete route s | Calendar sync request | calendar integration | Implemented on protected main | PR #139 signed workspace context | | Calendar connection registry | calendar integration | Implemented on protected main | PR #150; workspace+user scoped metadata + opaque secret references | | Atomic calendar connection revocation | calendar integration | Implemented on protected main | PR #153; exact tenant+user scope and revocation replay | -| Signed calendar workspace+user context | calendar integration | Implemented on active PR | PR #155; distinct short-lived `life-os.calendar-user.v1` authority | -| Complete per-user calendar credential lifecycle | calendar integration | Partial | issue #129; OAuth/PKCE, managed secret backend, refresh/provider revoke, discovery/selection remain | +| Signed calendar workspace+user context | calendar integration | Implemented on protected main | PR #155 / `life-os.calendar-user.v1` | +| Complete per-user calendar credential lifecycle | calendar integration | Partial | issue #129; public connection/disconnect composition, OAuth/PKCE, managed secret backend, refresh/provider revoke, discovery/selection remain | | Reminder scheduling/delivery | notification-service | Implemented on protected main | bounded claims/retries/outcomes | | AI proposal/evidence/decision | AI proposal service | Implemented on protected main | inert proposal + explicit decision | | Purpose-bound sensitive access | privacy-service | Implemented on protected main | actor/resource/purpose/lifetime bound | @@ -37,8 +37,9 @@ This registry summarizes repository-level API/event invariants. Concrete route s | Complete cross-domain export/erasure | identity coordinator + contributors | Partial | issue #55 | | Plugin manifest/event validation | integration-service | Implemented on protected main | versioned SDK/validation | | Explicit plugin installation grants | integration-service | Implemented on protected main | PR #151; explicit subset, replay/conflict/revocation | +| Durable plugin installation persistence | integration-service | Implemented on active PR | PR #156; installation+workspace+installing-user scoped persistence; no credential/delivery authority | | Complete plugin secret/outbound delivery runtime | integration-service | Partial | issue #130 | -| Source-head vs merge-tree verification | repository workflows | Implemented on active PR | clean successor PR #154; #147 superseded; ADR 0010 | +| Source/live-base/integration verification evidence | repository workflows | Implemented on protected main | PR #154 / ADR 0010; residual central scanner attribution remains #132 | ## Data-rights status @@ -68,15 +69,23 @@ PR #153 adds atomic tenant+user-scoped connection revocation and exact replay be ### Hosted user authority -**Status:** Implemented on active PR +**Status:** Implemented on protected main -PR #155 introduces a short-lived HMAC context that binds both workspace and user UUIDv4 identities under a version distinct from workspace-only sync context. It rejects identifier substitution, stale/future/malformed evidence and unusable verifier configuration. Public disconnect/runtime composition is a later #129 slice. +PR #155 introduces a short-lived HMAC context that binds both workspace and user UUIDv4 identities under `life-os.calendar-user.v1`, distinct from workspace-only synchronization context. It rejects identifier substitution, stale/future/malformed evidence and unusable verifier configuration. Public connection/disconnect and managed-credential runtime composition remain later #129 slices. -## Plugin installation authority +## Plugin installation authority and persistence + +### Installation grants **Status:** Implemented on protected main -PR #151 treats a validated manifest as requested intent, not granted authority. The host grants an explicit tenant-scoped capability subset, accepts exact replay, rejects conflicting reuse, hides cross-tenant/user existence and preserves revocation evidence. Durable secret persistence and outbound delivery remain incomplete under #130. +PR #151 treats a validated manifest as requested intent, not granted authority. The host grants an explicit tenant-scoped capability subset, accepts exact replay, rejects conflicting reuse, hides cross-tenant/user existence and preserves revocation evidence. + +### Durable installation persistence + +**Status:** Implemented on active PR + +PR #156 persists bounded installation identity, workspace, installing-user, exact manifest/version/digest, granted capabilities and lifecycle evidence in the integration service. Direct reads and revocation operations carry workspace and installing-user authority into fixed parameterized SQL rather than widening by installation ID and filtering afterward. Plaintext plugin credential/KMS material and outbound delivery remain outside this active slice and incomplete under #130. ## Events @@ -88,8 +97,8 @@ Breaking route/event/schema semantics require explicit versioning or a reviewed ## Verification evidence identity -**Status:** Accepted architecture +**Status:** Implemented on protected main -`source_head_sha`, PR-base snapshot, independently resolved `live_base_tip_sha`, `merge_tree_sha`, `workflow_checkout_sha`, protected-main identity and release-source identity are separate authorities. Synthetic integration success is not exact contributor-source verification. +`source_head_sha`, `pr_base_snapshot_sha`, independently resolved `live_base_tip_sha`, separately classified integration/synthetic tree identity, `workflow_checkout_sha`, protected-main identity and release-source identity are separate authorities. Integration success is not exact contributor-source verification. -ADR 0010 is the durable decision. Clean successor PR #154 is `Implemented on active PR`; #147 is superseded. Issue #132 remains open until the correction integrates and residual required-workflow attribution is reconciled. +ADR 0010 is the durable decision. PR #154 merged as `2c272a404f8f3a74aa5796a1957d4a6ce0fabe8f`: LifeOS source jobs explicitly bind contributor head, AppGuardrail SARIF binds the analyzed source ref/SHA, and merge compatibility reconstructs the integration tree from fresh current source and live base. Issue #132 remains open only for residual central reusable SAST/Security scanner checkout and attribution classification; their umbrella green status cannot silently promote one evidence identity into another. From 86ed17f5e712a98818df7710be9c7676da9f8d82 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:58:23 +0900 Subject: [PATCH 092/173] docs(data): reconcile protected calendar and active plugin persistence --- docs/DATA_MODEL.md | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/docs/DATA_MODEL.md b/docs/DATA_MODEL.md index 5cbee08be..8ad0d4212 100644 --- a/docs/DATA_MODEL.md +++ b/docs/DATA_MODEL.md @@ -31,6 +31,7 @@ erDiagram WORKSPACE_RECORD ||--o{ REVIEW_RECORD : contains WORKSPACE_RECORD ||--o{ CALENDAR_CONNECTION : authorizes + USER_ACCOUNT ||--o{ CALENDAR_CONNECTION : owns CALENDAR_CONNECTION ||--o{ CALENDAR_SYNC_RECORD : tracks WORKSPACE_RECORD ||--o{ REMINDER_RECORD : contains REMINDER_RECORD ||--o{ DELIVERY_OUTCOME : records @@ -43,9 +44,12 @@ erDiagram DATA_RIGHTS_REQUEST ||--o{ DATA_RIGHTS_RECEIPT : terminates WORKSPACE_RECORD ||--o{ PLUGIN_INSTALLATION : grants + USER_ACCOUNT ||--o{ PLUGIN_INSTALLATION : installs PLUGIN_INSTALLATION ||--o{ PLUGIN_DELIVERY : attempts ``` +Logical USER_ACCOUNT relationships to calendar/plugin records represent authority/ownership identifiers, not cross-service foreign keys or direct SQL access. + ## Persisted protected-main ownership ### Identity @@ -64,17 +68,31 @@ Habit owns recurrence/completion evidence; Review owns guided review snapshots/p **Status:** Implemented on protected main -PR #150 added the service-owned `calendar_integration.calendar_connection_record` persistence foundation scoped simultaneously to workspace and user. The row stores bounded provider/account/calendar metadata, normalized scopes and opaque credential references rather than plaintext provider credentials. PR #153 added atomic tenant+user-scoped revocation and durable revoked-state/replay semantics. +PR #150 added the service-owned `calendar_integration.calendar_connection_record` persistence foundation scoped simultaneously to workspace and user. The row stores bounded provider/account/calendar metadata, normalized scopes and opaque credential references rather than plaintext provider credentials. PR #153 added atomic tenant+user-scoped revocation and durable revoked-state/replay semantics. PR #155 added signed workspace+user request authority without introducing additional persistence. -PR #155 is **Implemented on active PR** for signed workspace+user request authority only; it adds no persistence. The complete hosted OAuth/managed-secret/refresh/provider-revocation/discovery/selection lifecycle remains **Partial** under #129. +The complete hosted OAuth/managed-secret/refresh/provider-revocation/discovery/selection lifecycle remains **Partial** under #129. ### Plugin integration -**Status:** Implemented on protected main +Protected main through PR #151 owns the application-level plugin installation/grant authority: validated manifest intent is separated from explicit host-granted capability subsets, exact replay/conflict semantics are deterministic, cross-tenant/user existence is hidden, and revocation ends active authority while preserving bounded evidence. + +#### Durable plugin installation record + +**Status:** Implemented on active PR + +PR #156 adds the first owning integration-service migration/repository for `plugin_integration.plugin_installation_record`. Its durable logical fields include: + +- `installation_id` — opaque UUIDv4 primary installation identity; +- `workspace_id` — authenticated tenant authority; +- `installed_by_user_id` — installing/requesting user authority; +- `plugin_id` and `plugin_contract_version` — bounded plugin metadata; +- `manifest_sha256` — exact validated manifest integrity evidence; +- `granted_capabilities` — explicit bounded host-granted capability set; +- `installation_status`, `installed_at`, `revoked_at` — lifecycle evidence. -PR #151 protects the application-level `plugin_installation` authority model: validated manifest intent is separated from explicit host-granted capability subsets, exact replay/conflict semantics are deterministic, cross-tenant/user existence is hidden, and revocation ends active authority while preserving bounded evidence. +Application and repository lookup/revocation paths carry installation + workspace + installing-user authority to the fixed parameterized SQL boundary. Plaintext plugin credentials are not part of this record. The record is not evidence that outbound delivery or a managed secret/KMS lifecycle exists. -This is not yet a protected-main durable plugin-installation table. Persisted plugin secret records and outbound `plugin_delivery` attempts remain **Planned/Partial** under #130 until owning migrations/repositories and delivery runtime exist. The ERD therefore shows those as logical target entities, not physical tables. +Persisted plugin-secret records and `plugin_delivery` attempts therefore remain **Planned/Partial** under #130. The ERD shows those intended relationships as logical targets, not protected-main physical tables. ## Data-rights lifecycle From 87532de1f33d1c647d3838e42afcfe548fa4f459 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:59:04 +0900 Subject: [PATCH 093/173] docs(assessment): close semantic authority gaps --- docs/DOCUMENTATION_ASSESSMENT.md | 70 ++++++++++++++++++-------------- 1 file changed, 39 insertions(+), 31 deletions(-) diff --git a/docs/DOCUMENTATION_ASSESSMENT.md b/docs/DOCUMENTATION_ASSESSMENT.md index 9f8669bd7..c7ecbf9e0 100644 --- a/docs/DOCUMENTATION_ASSESSMENT.md +++ b/docs/DOCUMENTATION_ASSESSMENT.md @@ -6,29 +6,37 @@ Historical LifeOS material was extensive but not sufficient as one code-current whole-product authority. The project moved through materially different product models: browser-only/login-free local-first, public multi-user server persistence, a single-Docker direction, and finally domain-oriented modular MSA. Protected-main implementation also continued after the first canonical docs branch diverged. -PR #145 is the single canonical successor. Its family coverage is now **design-sufficient in scope**: PRD, TRD, root Architecture, detailed ADRs, logical ERD/Data Model, UML, API/event contracts, Security, Threat Model, Privacy/Data Lifecycle, Test Strategy, Operability, Release/Migration/Rollback, Standards/Research and Requirements Traceability exist with machine-checkable consistency rules. The repository remains **protected-main documentation insufficient** until this exact successor is current against live main, passes exact-head CI/security/review/documentation contracts, and integrates. Documentation sufficiency is never product/release completion. +PR #145 is the single canonical successor. Its family coverage is now **design-sufficient in scope** when its exact-head semantic documentation contracts are green: PRD, TRD, root Architecture, ADR 0001-0012, logical ERD/Data Model, UML, API/event contracts, Security, Threat Model, Privacy/Data Lifecycle, Test Strategy, Operability, Release/Migration/Rollback, Standards/Research and Requirements Traceability exist with machine-checkable consistency rules. The previously missing repository-wide test-time-compute/model-assisted-development authority is now represented by ADR 0012, canonical Fugu/Conductor/TRINITY/strong-single-agent/NVIDIA research traceability, and a UML authority flow that keeps model execution separate from deterministic review/merge/release authority. + +The repository remains **protected-main documentation insufficient** until this exact successor is current against live main, passes exact-head CI/security/review/documentation contracts, and integrates. Documentation sufficiency is never product or release completion. ## Fitness matrix | Family | Assessment on #145 | Maturity | Notes | | --- | --- | --- | --- | -| PRD | Present-current | Implemented on active PR | protected #146/#149/#150/#151/#153 and active #154/#155 are separated | -| TRD | Present-current | Implemented on active PR | shared runtime, authority, data, API/event, concurrency, AI/security/ops/release contracts | -| Root Architecture | Present-current | Implemented on active PR | semantically reconciled with current Identity/Today/Calendar/Plugin/Privacy/Notification and verification authority | -| ADR index / decisions | Present-current | Implemented on active PR | ADR 0001-0011 including evidence identity and external-integration authority | -| Logical ERD / Data Model | Present-current | Implemented on active PR | protected calendar persistence/revocation and non-persisted plugin logical targets distinguished | -| UML | Present-current | Implemented on active PR | topology, login, Today/review, calendar, AI, rights, plugin, verification, deployment/degraded modes | -| API/event contracts | Present-current | Implemented on active PR | protected foundations, active successors and still-partial parent gaps separated | -| Security | Present-current | Implemented on protected main | root `SECURITY.md` vulnerability-reporting authority | -| Threat model | Present-current | Implemented on active PR | trust boundaries and residual gaps explicit | -| Privacy/Data Lifecycle | Present-current | Implemented on active PR | rights, credential-reference, revocation and plugin authority boundaries distinguished | +| PRD | Present-current | Implemented on active PR | protected #146/#149/#150/#151/#153/#154/#155 and active #156 are separated; parent #55/#129/#130 remain partial | +| TRD | Present-current | Implemented on active PR | runtime, authority, data, API/event, concurrency, AI/security/ops/release, current evidence identity and active plugin persistence contracts | +| Root Architecture | Present-current | Implemented on active PR | current Identity/Today/Calendar/Plugin/Privacy/Notification, ADR 0012 and protected #154 verification authority reconciled | +| ADR index / decisions | Present-current | Implemented on active PR | ADR 0001-0012 including evidence identity, integration authority and test-time compute/model-development authority | +| Logical ERD / Data Model | Present-current | Implemented on active PR | protected calendar persistence/revocation, active #156 plugin persistence and planned secret/delivery entities are distinguished | +| UML | Present-current | Implemented on active PR | topology, login, Today/review, calendar, AI, model-execution/governance, rights, plugin, verification, deployment and degraded modes | +| API/event contracts | Present-current | Implemented on active PR | protected #154/#155, active #156 and still-partial parent gaps are separated | +| Security | Present-current | Implemented on protected main | root `SECURITY.md` remains vulnerability-reporting authority | +| Threat model | Present-current | Implemented on active PR | trust boundaries and residual product/runtime threats are explicit | +| Privacy/Data Lifecycle | Present-current | Implemented on active PR | rights, secret-reference, revocation and integration-authority boundaries remain separate from incomplete hosted runtimes | | Test Strategy | Present-current | Implemented on active PR | realistic DB/browser/security/concurrency/evidence policy | | Operability | Present-current | Implemented on active PR | deployment/readiness/observability/failure/backup/recovery boundaries | -| Release/Migration/Rollback | Present-current | Implemented on active PR | one exact integrated release-source contract | -| Standards/Research | Present-current | Implemented on active PR | source-class/final-vs-draft discipline and APA 7 anchors | -| Requirements Traceability | Present-current | Implemented on active PR | requirement/decision -> protected source or exact active PR -> remaining issue | -| README/AGENTS/CLAUDE/CHANGELOG alignment | Partial | Partial | discoverability exists on successor; protected-main integration is still pending | -| Machine-checkable documentation consistency | Present-current | Implemented on active PR | semantic currentness, status vocabulary, ADRs, links, lifecycle maturity and evidence identity are gated | +| Release/Migration/Rollback | Present-current | Implemented on active PR | one exact integrated release-source contract and fail-closed migration/rollback discipline | +| Standards/Research | Present-current | Implemented on active PR | final-vs-draft discipline, APA 7 anchors and repository-wide model-orchestration evidence/counterevidence | +| Requirements Traceability | Present-current | Implemented on active PR | requirement/decision -> protected source or exact active PR -> remaining issue evidence, including ADR 0012 | +| AGENTS authority | Present-current | Implemented on protected main | protected main already carries work-conserving maintenance, NVIDIA/no-Copilot, explicit test-time-compute dimensions and independent review credentials | +| CHANGELOG behavior history | Present-current | Implemented on protected main | existing Unreleased/live-conformance entries document shipped behavior; ADR 0012 adds architecture/governance authority rather than claiming a new protected product feature | +| README/CLAUDE canonical discoverability | Present-current on successor | Implemented on active PR | discoverability/link alignment becomes protected-main authority only after #145 integration | +| Machine-checkable documentation consistency | Present-current | Implemented on active PR | required files/links, maturity vocabulary, ADR 0001-0012, current lifecycle/evidence identity, model authority and stale-product semantics are gated | + +## Why the earlier assessment was still incomplete + +Broad file-family presence did not cover every durable conversation/repository decision. The canonical graph previously delegated model orchestration evidence to a scoped feature specification but did not give the repository-wide test-time-compute and development-authority decision its own ADR, canonical standards traceability, UML authority diagram or executable regression contract. Issue #148 correctly identified that semantic gap. Those missing views are now part of #145 rather than a parallel documentation branch. ## Historical drift reconciled @@ -37,42 +45,42 @@ PR #145 is the single canonical successor. Its family coverage is now **design-s 3. **UUIDv7 -> UUIDv4.** Internal product IDs are opaque UUIDv4. 4. **Old post-MVP labels -> evidence maturity.** Protected source/tests outrank roadmap prose. 5. **Capability maturity -> buyer-gap exhaustion.** These are independent evidence dimensions. -6. **Generic green status -> explicit evidence identity.** ADR 0010 separates source head, PR-base snapshot, live base, merge tree, workflow checkout, protected main and release source. +6. **Generic green status -> explicit evidence identity.** ADR 0010 separates source head, PR-base snapshot, live base, integration/synthetic tree, workflow checkout, protected main and release source. 7. **External integration metadata -> ambient authority.** ADR 0011 separates LifeOS identity, provider/plugin metadata, secret references and explicit capability grants. +8. **More agents -> assumed better output.** ADR 0012 instead requires a strong single-route baseline and measured, explicit stage/decomposition/recursion/role-effort/access-topology evidence under documented budgets before deeper orchestration is selected. +9. **Development model -> repository authority.** ADR 0012 and protected `AGENTS.md` keep NVIDIA/OpenCode model execution independent from deterministic CI/security, formal review, merge and release authority. ## Protected-main evolution currently represented -Protected main includes durable Today (#127), trusted calendar workspace context (#139), recent-auth/data-rights prerequisites (#134/#136/#137), durable rights ledger (#138), tenant+actor status lookup (#144), authenticated public rights status (#146), export integrity evidence (#149), workspace+user calendar connection persistence (#150), explicit plugin installation grants (#151), migration-fixture reliability repair (#152), and atomic calendar connection revocation (#153). +Protected main includes durable Today (#127), trusted calendar workspace context (#139), recent-auth/data-rights prerequisites (#134/#136/#137), durable rights ledger (#138), tenant+actor status lookup (#144), authenticated public rights status (#146), export integrity evidence (#149), workspace+user calendar connection persistence (#150), explicit plugin installation grants (#151), migration-fixture reliability repair (#152), atomic calendar connection revocation (#153), exact-source/current-live-base/integration verification hardening (#154), and signed calendar workspace+user authority (#155). -The old documentation PR #126 is superseded. It is not evidence merely because historical review threads were once resolved. +The old documentation PR #126 and old verification PR #147 are superseded. Historical resolved reviews/checks on those lines are not current evidence. ## Active work represented without promotion -### PR #154 — verification evidence identity +### PR #156 — durable plugin installation persistence **Status:** Implemented on active PR -Clean successor #154 replaces superseded #147. It separates exact contributor-head checks from synthetic merge compatibility, binds AppGuardrail SARIF to the analyzed source identity, obtains current source/live-base evidence through authenticated GitHub API calls, retains merge parents for verification and rejects identity mismatch. Issue #132 remains open until integration/residual workflow attribution closes. +PR #156 adds restart-safe integration-service persistence for plugin installation authority. The canonical graph records the application/SQL authority as installation + workspace + installing user, while keeping plugin credential/KMS handling and outbound delivery explicitly outside this active slice. It is not protected-main behavior until the exact head integrates. -### PR #155 — calendar workspace+user authority - -**Status:** Implemented on active PR +## Verification-governance residual -PR #155 adds the distinct short-lived `life-os.calendar-user.v1` authority context that binds both workspace and requesting user. It is a prerequisite for hosted user-sensitive calendar operations, not evidence that public disconnect/OAuth/managed-secret/refresh/provider-revocation/discovery are complete. +PR #154 is now **Implemented on protected main**. LifeOS-owned source verification, AppGuardrail attribution and current-live-base integration compatibility are separated by explicit evidence identity. Issue #132 remains open only for residual central reusable scanner taxonomy: central SAST/Security jobs must expose the actual tree they inspected so synthetic/integration evidence is not promoted to exact-source evidence. ## Remaining product gaps - **Partial:** #55 complete export/deletion orchestration, despite protected #146/#149. -- **Partial:** #129 complete per-user calendar credential lifecycle, despite protected #150/#153 and active #155. -- **Partial:** #130 complete plugin secret/outbound-delivery runtime, despite protected #151 installation authority. -- **Implemented on active PR:** #132 verification-evidence attribution via #154 until protected integration/residual closure. +- **Partial:** #129 complete hosted per-user calendar credential lifecycle, despite protected #150/#153/#155. +- **Partial:** #130 complete plugin secret/outbound-delivery runtime, despite protected #151 and active #156 persistence. +- **Residual governance gap:** #132 central scanner checkout/attribution taxonomy after protected #154. ## Sufficiency criteria -The documentation line is design-sufficient only when canonical families are discoverable, statuses use exact vocabulary, ADR targets/sections are valid, diagrams are balanced, root Architecture matches protected service authority, active behavior is not called shipped, requirements/gaps map to executable evidence, and semantic-regression tests fail when currentness drifts. +The documentation line is design-sufficient only when canonical families are discoverable, statuses use exact vocabulary, ADR targets/sections are valid, diagrams are balanced, root Architecture matches protected service authority, active behavior is not called shipped, requirements/gaps map to executable evidence, model-development authority and its counterevidence are canonical, and semantic-regression tests fail when currentness drifts. -The repository is protected-main documentation sufficient only after PR #145 passes current exact-head checks/security/review and integrates against a freshly resolved live base without regressing current source/policy. +The repository is protected-main documentation sufficient only after PR #145 passes current exact-head CI/security/review/documentation contracts and integrates against a freshly resolved live base without regressing current source/policy. ## Continuation rule -Documentation completion is a governance gate only. The autonomous queue must continue #154/#155 and the remaining #55/#129/#130/#132 work, plus newly discovered buyer/security/reliability/operability gaps, rather than stopping on a green documentation pack. +Documentation completion is a governance gate only. After #145 waits or integrates, the autonomous queue continues active #156 and the remaining #55/#129/#130/#132 work plus newly discovered buyer/security/reliability/operability gaps. A green documentation pack is not a product-completion or run-termination condition. From 63e9fff3757fc1268e7fa64f779688106fe3ff0a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:59:29 +0900 Subject: [PATCH 094/173] docs(privacy): reconcile integration maturity --- docs/PRIVACY_DATA_LIFECYCLE.md | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/docs/PRIVACY_DATA_LIFECYCLE.md b/docs/PRIVACY_DATA_LIFECYCLE.md index 85b744ec5..442f028bc 100644 --- a/docs/PRIVACY_DATA_LIFECYCLE.md +++ b/docs/PRIVACY_DATA_LIFECYCLE.md @@ -44,9 +44,9 @@ The section/whole SHA-256 evidence is integrity metadata only; it does not prove **Status:** Partial -Protected main includes signed workspace context (#139), the workspace+user scoped connection registry (#150), and atomic local connection revocation (#153). Connection rows carry bounded provider/account/calendar metadata and opaque credential references rather than provider-token plaintext. Local revocation ends LifeOS connection authority but does not itself prove provider-side OAuth revocation or managed-secret deletion. +Protected main includes signed workspace context (#139), the workspace+user scoped connection registry (#150), atomic local connection revocation (#153), and the distinct short-lived signed workspace+user authority from PR #155 (`life-os.calendar-user.v1`). Connection rows carry bounded provider/account/calendar metadata and opaque credential references rather than provider-token plaintext. Local revocation ends LifeOS connection authority but does not itself prove provider-side OAuth revocation or managed-secret deletion. -PR #155 is `Implemented on active PR` for a distinct short-lived signed workspace+user context needed by hosted user-sensitive calendar operations. The complete #129 lifecycle still requires OAuth state/PKCE, a concrete managed secret backend, refresh/provider revocation, discovery/selection and public hosted disconnect/runtime composition. +The complete #129 lifecycle still requires public authenticated connection/disconnect composition, OAuth state/PKCE, a concrete managed secret backend, refresh/provider revocation, discovery/selection and migration away from development-wide credentials. ## Plugin installation and secrets @@ -54,7 +54,15 @@ PR #155 is `Implemented on active PR` for a distinct short-lived signed workspac Protected main validates plugin manifests and, through PR #151, separates manifest intent from host-granted installation authority. Explicit capability subsets, exact replay/conflict handling, tenant/user isolation and revocation are protected behavior. -Durable installation/secret persistence, protected secret handles at rest, SSRF-safe outbound delivery, retry/dead-letter evidence and delivery-time revocation enforcement remain issue #130. A granted installation is not evidence that the complete plugin runtime exists. +PR #156 is **Implemented on active PR** for restart-safe plugin installation authority persistence. Its application and SQL lookup/revocation boundaries carry installation, workspace and installing-user authority, while the durable record stores only bounded installation/manifest/grant/lifecycle evidence. Plaintext plugin credentials are not part of that record. + +Protected secret/KMS lifecycle, SSRF-safe authorized-origin outbound delivery, retry/dead-letter evidence and delivery-time revocation enforcement remain issue #130. A granted or durably persisted installation is not evidence that the complete plugin runtime exists. + +## Model-assisted development evidence + +**Status:** Accepted architecture + +ADR 0012 keeps model/provider credentials and model execution separate from product/repository authority. `NVIDIA_NIM_API_KEY` may materialize only at the reviewed bounded model-call/development boundary; retained evidence excludes provider credentials, raw prompts/responses and hidden reasoning. Model output cannot become product authorization, independent review, merge or release authority. ## Deletion semantics @@ -69,4 +77,5 @@ No service may claim whole-workspace deletion merely because its own tables were - no whole-right success claim from partial/unknown contributor state; - no integrity digest is treated as access control or confidentiality; - no plugin manifest self-authorizes host capabilities; -- no LifeOS connection-record revocation is silently promoted to provider credential revocation. +- no LifeOS connection-record revocation is silently promoted to provider credential revocation; +- no development model or model credential is promoted to independent review, merge or release authority. From dcf3c6b250f7a4953b4a8a88ac73b495f7b06b21 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 13:00:24 +0900 Subject: [PATCH 095/173] docs(changelog): record canonical compute authority --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index bd3f85d98..df2b6cd97 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,7 @@ All notable changes to LifeOS are documented in this file. ### Added +- A canonical architecture/governance decision for model-assisted test-time compute and repository development: ADR 0012 requires a strong single-route baseline, explicit stage/decomposition/recursion/role-effort/access-topology evidence, comparable-budget justification for deeper orchestration, `NVIDIA_NIM_API_KEY` through approved OpenCode/contextual-orchestrator boundaries, and strict separation of model execution from deterministic review, merge, and release authority. This documents and reconciles existing protected-main governance/live-conformance behavior rather than claiming a new shipped product capability. - A durable PostgreSQL data-rights request ledger with workspace-scoped idempotency, immutable request and terminal receipt digests, one-way completion state, and real integration evidence that erasure receipts survive removal of the source workspace and user. - Migration `0006_data_rights_request_ledger.sql` for the service-owned identity ledger, retaining only bounded opaque authority references and digest/status/timestamp evidence rather than exported personal payloads. - An hourly and manually dispatchable NVIDIA NIM live-conformance harness that pins contextual-orchestrator to an exact reviewed commit, compares strong single-route reasoning with bounded conducted workflows, and retains only validated credential-free quality, safety, orchestration, usage, and ablation evidence. From 4601d81f3df28153ac907c95dd46932c6725bf0d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 13:34:13 +0900 Subject: [PATCH 096/173] docs(traceability): reconcile protected and active LifeOS authority --- docs/TRACEABILITY.md | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/docs/TRACEABILITY.md b/docs/TRACEABILITY.md index e51e993bf..2ec20c8a4 100644 --- a/docs/TRACEABILITY.md +++ b/docs/TRACEABILITY.md @@ -10,27 +10,33 @@ Protected-main source/migrations/tests and live repository policy outrank this i | PRD-ID-002 opaque UUIDv4 internal IDs | Implemented on protected main | validators/migrations + ADR 0001 | — | | PRD-PLAN-001 durable Goals/Projects/Tasks | Implemented on protected main | planning repository/migrations | — | | PRD-PLAN-002 durable Today synchronization | Implemented on protected main | PR #127 + concurrency/browser evidence | — | +| PRD-PLAN-003 signed workspace authority on every public Goal/Project/Task route | Implemented on active PR | PR #160 | protected integration and hosted gateway composition | | PRD-HAB-001 recurring habits | Implemented on protected main | habit service persistence/tests | — | +| PRD-HAB-002 signed workspace authority on every public Habit route | Implemented on active PR | PR #162 | protected integration and hosted gateway composition | | PRD-REV-001 review projection boundary | Implemented on protected main | review-service tests | — | +| PRD-REV-002 signed workspace authority on guided-review completion/history routes | Implemented on active PR | PR #165 | protected integration and hosted gateway composition | | PRD-CAL-001 conflict-safe calendar sync | Implemented on protected main | provider adapters | — | | PRD-CAL-002 trusted workspace calendar context | Implemented on protected main | PR #139 | — | | PRD-CAL-003 complete hosted per-user calendar credential lifecycle | Partial | protected foundations below | issue #129 | | PRD-CAL-004 workspace+user calendar connection persistence | Implemented on protected main | PR #150 / `1623df364925f84920c07c112f1ae96777277d20` | #129 | | PRD-CAL-005 atomic tenant+user calendar connection revocation | Implemented on protected main | PR #153 / `b13413e571bad82535f63d478e40746d12c3e680` | provider-side revoke remains #129 | | PRD-CAL-006 signed workspace+user calendar authority | Implemented on protected main | PR #155 / `7b34a5a584b037653d091ea661ae4627bb5dd2ea` | hosted connection/disconnect runtime #129 | +| PRD-CAL-007 authenticated local calendar disconnect boundary | Implemented on active PR | PR #157 | provider/KMS revoke and complete hosted lifecycle #129 | | PRD-NOT-001 bounded reminders | Implemented on protected main | notification persistence/scheduler tests | — | | PRD-AI-001 inert auditable proposals | Implemented on protected main | AI proposal/audit tests | — | | PRD-AI-002 deterministic/live-provider separation | Implemented on protected main | proposal evaluator + bounded live conformance | — | | PRD-PRIV-001 purpose-bound sensitive access | Implemented on protected main | privacy-service evidence | — | | PRD-PRIV-002 recent-auth + durable rights request ledger | Implemented on protected main | #134/#136/#137/#138/#144 | #55 | -| PRD-PRIV-003 complete export/delete orchestration | Partial | protected rights/integrity foundations exist | #55 | +| PRD-PRIV-003 complete export/delete orchestration | Partial | protected rights/integrity/contributor-contract foundations exist | #55 | | PRD-PRIV-004 authenticated bounded rights status | Implemented on protected main | PR #146 | #55 | | PRD-PRIV-005 per-section export integrity evidence | Implemented on protected main | PR #149 | #55 | +| PRD-PRIV-006 versioned service-owned data-rights contributor lifecycle contract | Implemented on protected main | PR #159 / `c88016e9f980d99054e9cb0886ee78377b5d0be9` | concrete service adapters, reconciliation and delivery remain #55 | | PRD-INT-001 plugin SDK/manifest validation | Implemented on protected main | plugin SDK/integration tests | — | | PRD-INT-002 complete plugin secret/outbound delivery runtime | Partial | protected grant authority + active durable persistence | #130 | | PRD-INT-003 explicit tenant-scoped plugin installation grants | Implemented on protected main | PR #151 / `6971c4e11b3204ec41526c7c959a248e54440e1c` | #130 | | PRD-INT-004 durable plugin installation persistence | Implemented on active PR | PR #156; workspace+installing-user-scoped migration/repository | #130 secret/delivery runtime | | PRD-WEB-001 accessible localized PWA | Implemented on protected main | browser/accessibility/localization tests | — | +| PRD-WEB-002 public Gateway Today endpoint must not return fabricated success | Implemented on active PR | PR #164 | issue #163 remains until authenticated Planning/Habit composition is real | | PRD-OPS-001 backup/restore | Implemented on protected main | backup scripts/tests/runbook | — | | PRD-OPS-002 provider-neutral deployment/readiness/metrics | Implemented on protected main | infra/observability tests | — | | PRD-GOV-001 buyer-gap vs capability-maturity separation | Implemented on protected main | readiness registry | — | @@ -48,7 +54,7 @@ Protected-main source/migrations/tests and live repository policy outrank this i | Capability maturity != buyer-gap exhaustion | Accepted architecture | ADR 0008 | | Canonical documentation uses explicit maturity | Accepted architecture | ADR 0007 | | Verification identities remain separate | Accepted architecture | ADR 0010 + protected PR #154 | -| Integration identity, metadata, secret references and grants remain separate | Accepted architecture | ADR 0011 + protected #150/#151/#153/#155 + active #156 | +| Integration identity, metadata, secret references and grants remain separate | Accepted architecture | ADR 0011 + protected #150/#151/#153/#155 + active #156/#157 | | Test-time compute and model-assisted development authority remain evidence-driven and separate from review/merge/release authority | Accepted architecture | ADR 0012 + protected `AGENTS.md` + live-conformance design + Fugu/Conductor/TRINITY/strong-single-agent evidence | ## Evidence hierarchy @@ -64,7 +70,7 @@ Protected-main source/migrations/tests and live repository policy outrank this i ## Buyer-gap state -Canonical buyer gaps remain #55, #129 and #130. Protected #146/#149 advance #55; protected #150/#153/#155 advance #129; protected #151 plus active #156 advance #130. None closes its parent gap by implication. Issue #132 is now a narrower verification-governance gap: protected #154 fixed LifeOS source/live-base/integration evidence separation, while residual central SAST/Security scanner checkout/attribution taxonomy still requires auditable classification. +Canonical buyer gaps remain #55, #129 and #130. Protected #146/#149/#159 advance #55; protected #150/#153/#155 plus active #157 advance #129; protected #151 plus active #156 advance #130. None closes its parent gap by implication. Issue #163 is an additional product-truthfulness gap: active #164 removes fabricated Gateway Today success but the issue remains open until authenticated Planning/Habit composition exists. Active #160/#162/#165 harden Planning/Habit/Review tenant authority and remain non-shipped until integration. Issue #132 is now a narrower verification-governance gap: protected #154 fixed LifeOS source/live-base/integration evidence separation, while residual central SAST/Security scanner checkout/attribution taxonomy still requires auditable classification. ## Update rule From 9b7d389f69a9e66ab7b5fba99644e9ad71260ca4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 19:14:20 +0900 Subject: [PATCH 097/173] docs(changelog): reconcile canonical line with protected main --- CHANGELOG.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index df2b6cd97..a4eee47dd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,8 @@ All notable changes to LifeOS are documented in this file. ### Added - A canonical architecture/governance decision for model-assisted test-time compute and repository development: ADR 0012 requires a strong single-route baseline, explicit stage/decomposition/recursion/role-effort/access-topology evidence, comparable-budget justification for deeper orchestration, `NVIDIA_NIM_API_KEY` through approved OpenCode/contextual-orchestrator boundaries, and strict separation of model execution from deterministic review, merge, and release authority. This documents and reconciles existing protected-main governance/live-conformance behavior rather than claiming a new shipped product capability. +- Durable PostgreSQL plugin-installation authority with opaque UUIDv4 installation/workspace/installer identity, exact manifest digests, normalized explicit grants, bounded conflict replay, and atomic revocation evidence in the service-owned `plugin_integration` schema. +- An authenticated calendar-connection disconnect application and optional hosted HTTP composition boundary that derives workspace and requesting-user authority only from the signed `life-os.calendar-user.v1` context and returns credential-free local revocation evidence. - A durable PostgreSQL data-rights request ledger with workspace-scoped idempotency, immutable request and terminal receipt digests, one-way completion state, and real integration evidence that erasure receipts survive removal of the source workspace and user. - Migration `0006_data_rights_request_ledger.sql` for the service-owned identity ledger, retaining only bounded opaque authority references and digest/status/timestamp evidence rather than exported personal payloads. - An hourly and manually dispatchable NVIDIA NIM live-conformance harness that pins contextual-orchestrator to an exact reviewed commit, compares strong single-route reasoning with bounded conducted workflows, and retains only validated credential-free quality, safety, orchestration, usage, and ablation evidence. @@ -26,6 +28,7 @@ All notable changes to LifeOS are documented in this file. ### Fixed +- The public Gateway Today endpoint now fails explicitly with bounded `today_composition_unavailable` problem details instead of returning fabricated successful composition data while authenticated Planning/Habit integration is absent; issue #163 remains open for the real composition path. - Data-rights request-ID and idempotency collisions now resolve through stable credential-free domain conflicts instead of exposing raw PostgreSQL uniqueness errors, including ambiguous dual-collision evidence. - The OpenCode development loop now prevents project settings from overriding its pinned offline NVIDIA model, records catalog failures accurately, parses the accepted candidate's exact Compose file outside the model account, and requires digest-pinned PostgreSQL queries plus NATS JetStream probes in pull-request CI. - Live contextual-orchestrator responses now classify successful empty bodies as evaluation failures, emit exactly one terminal observation, canonicalize retained timestamps safely, and preserve null metric denominators instead of fabricating deltas. @@ -37,6 +40,8 @@ All notable changes to LifeOS are documented in this file. ### Security +- Plugin installation lookup, conflict replay, and revocation now carry authenticated workspace and installing-user authority through the PostgreSQL boundary; the durable record contains no plaintext plugin secret, token, credential, or password material. +- Calendar local disconnect never accepts client-selected ownership as authority, never reads provider secret handles, revalidates durable revocation evidence against the signed workspace+user context, and maps absent or differently owned connections to the same public not-found result. - The data-rights request ledger keeps personal export payloads out of durable audit rows and normalizes primary-key/idempotency collisions before dependency errors can escape the service boundary. - The commercial-development model account no longer performs Docker commands, never receives Docker-socket authority, and cannot trigger provider-wide model discovery through the credential bridge. - The scheduled live-model harness uses only `NVIDIA_NIM_API_KEY`, seeds it through the encrypted contextual-orchestrator credential registry, installs hash-locked dependencies from an exact commit, confines LifeOS traffic to loopback, allowlists NVIDIA NIM egress, and excludes provider credentials, prompts, responses, traces, and hidden reasoning from retained artifacts. From bee0ba45a14186a338f87fe4a1d0d2a3bb0b4488 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 19:59:18 +0900 Subject: [PATCH 098/173] docs: reconcile documentation fitness with current protected main --- docs/DOCUMENTATION_ASSESSMENT.md | 76 +++++++++++++++----------------- 1 file changed, 36 insertions(+), 40 deletions(-) diff --git a/docs/DOCUMENTATION_ASSESSMENT.md b/docs/DOCUMENTATION_ASSESSMENT.md index c7ecbf9e0..4abf174f0 100644 --- a/docs/DOCUMENTATION_ASSESSMENT.md +++ b/docs/DOCUMENTATION_ASSESSMENT.md @@ -6,37 +6,33 @@ Historical LifeOS material was extensive but not sufficient as one code-current whole-product authority. The project moved through materially different product models: browser-only/login-free local-first, public multi-user server persistence, a single-Docker direction, and finally domain-oriented modular MSA. Protected-main implementation also continued after the first canonical docs branch diverged. -PR #145 is the single canonical successor. Its family coverage is now **design-sufficient in scope** when its exact-head semantic documentation contracts are green: PRD, TRD, root Architecture, ADR 0001-0012, logical ERD/Data Model, UML, API/event contracts, Security, Threat Model, Privacy/Data Lifecycle, Test Strategy, Operability, Release/Migration/Rollback, Standards/Research and Requirements Traceability exist with machine-checkable consistency rules. The previously missing repository-wide test-time-compute/model-assisted-development authority is now represented by ADR 0012, canonical Fugu/Conductor/TRINITY/strong-single-agent/NVIDIA research traceability, and a UML authority flow that keeps model execution separate from deterministic review/merge/release authority. +PR #145 remains the single canonical successor. Its family coverage is **design-sufficient in scope** when its exact-head semantic documentation contracts are green: PRD, TRD, root Architecture, ADR 0001-0012, logical ERD/Data Model, UML, API/event contracts, Security, Threat Model, Privacy/Data Lifecycle, Test Strategy, Operability, Release/Migration/Rollback, Standards/Research and Requirements Traceability exist with machine-checkable consistency rules. Repository-wide test-time-compute/model-assisted-development authority is represented by ADR 0012, canonical Fugu/Conductor/TRINITY/strong-single-agent/NVIDIA research traceability, and a UML authority flow that keeps model execution separate from deterministic review/merge/release authority. -The repository remains **protected-main documentation insufficient** until this exact successor is current against live main, passes exact-head CI/security/review/documentation contracts, and integrates. Documentation sufficiency is never product or release completion. +The repository remains **protected-main documentation insufficient** until this canonical successor is reconciled to current protected main, passes exact-head CI/security/review/documentation contracts, and integrates. Documentation sufficiency is never product or release completion. ## Fitness matrix | Family | Assessment on #145 | Maturity | Notes | | --- | --- | --- | --- | -| PRD | Present-current | Implemented on active PR | protected #146/#149/#150/#151/#153/#154/#155 and active #156 are separated; parent #55/#129/#130 remain partial | -| TRD | Present-current | Implemented on active PR | runtime, authority, data, API/event, concurrency, AI/security/ops/release, current evidence identity and active plugin persistence contracts | -| Root Architecture | Present-current | Implemented on active PR | current Identity/Today/Calendar/Plugin/Privacy/Notification, ADR 0012 and protected #154 verification authority reconciled | -| ADR index / decisions | Present-current | Implemented on active PR | ADR 0001-0012 including evidence identity, integration authority and test-time compute/model-development authority | -| Logical ERD / Data Model | Present-current | Implemented on active PR | protected calendar persistence/revocation, active #156 plugin persistence and planned secret/delivery entities are distinguished | -| UML | Present-current | Implemented on active PR | topology, login, Today/review, calendar, AI, model-execution/governance, rights, plugin, verification, deployment and degraded modes | -| API/event contracts | Present-current | Implemented on active PR | protected #154/#155, active #156 and still-partial parent gaps are separated | -| Security | Present-current | Implemented on protected main | root `SECURITY.md` remains vulnerability-reporting authority | -| Threat model | Present-current | Implemented on active PR | trust boundaries and residual product/runtime threats are explicit | -| Privacy/Data Lifecycle | Present-current | Implemented on active PR | rights, secret-reference, revocation and integration-authority boundaries remain separate from incomplete hosted runtimes | -| Test Strategy | Present-current | Implemented on active PR | realistic DB/browser/security/concurrency/evidence policy | -| Operability | Present-current | Implemented on active PR | deployment/readiness/observability/failure/backup/recovery boundaries | -| Release/Migration/Rollback | Present-current | Implemented on active PR | one exact integrated release-source contract and fail-closed migration/rollback discipline | -| Standards/Research | Present-current | Implemented on active PR | final-vs-draft discipline, APA 7 anchors and repository-wide model-orchestration evidence/counterevidence | -| Requirements Traceability | Present-current | Implemented on active PR | requirement/decision -> protected source or exact active PR -> remaining issue evidence, including ADR 0012 | -| AGENTS authority | Present-current | Implemented on protected main | protected main already carries work-conserving maintenance, NVIDIA/no-Copilot, explicit test-time-compute dimensions and independent review credentials | -| CHANGELOG behavior history | Present-current | Implemented on protected main | existing Unreleased/live-conformance entries document shipped behavior; ADR 0012 adds architecture/governance authority rather than claiming a new protected product feature | -| README/CLAUDE canonical discoverability | Present-current on successor | Implemented on active PR | discoverability/link alignment becomes protected-main authority only after #145 integration | -| Machine-checkable documentation consistency | Present-current | Implemented on active PR | required files/links, maturity vocabulary, ADR 0001-0012, current lifecycle/evidence identity, model authority and stale-product semantics are gated | - -## Why the earlier assessment was still incomplete - -Broad file-family presence did not cover every durable conversation/repository decision. The canonical graph previously delegated model orchestration evidence to a scoped feature specification but did not give the repository-wide test-time-compute and development-authority decision its own ADR, canonical standards traceability, UML authority diagram or executable regression contract. Issue #148 correctly identified that semantic gap. Those missing views are now part of #145 rather than a parallel documentation branch. +| PRD | Present-stale | Implemented on active PR | family coverage is complete, but protected #168/#169/#170/#172/#173 and active #165/#175/#176 require semantic reconciliation | +| TRD | Present-stale | Implemented on active PR | runtime, authority, data, API/event, concurrency, AI/security/ops/release and evidence-identity contracts exist; latest protected integration state must be folded in | +| Root Architecture | Present-stale | Implemented on active PR | bounded-context and authority spine exists, but latest Planning/Habit/plugin-credential protected behavior is newer than the current canonical snapshot | +| ADR index / decisions | Present-current | Implemented on active PR | ADR 0001-0012 cover identifiers, persistence, AI, privacy, maintenance, documentation, maturity, hosting, evidence identity, integration authority and test-time compute/model-development authority | +| Logical ERD / Data Model | Present-stale | Implemented on active PR | protected plugin installation persistence and credential-reference metadata now supersede the earlier active-PR-only representation; active #175/#176 remain non-shipped evidence | +| UML | Present-stale | Implemented on active PR | topology, login, Today/review, calendar, AI, model-governance, rights, plugin, verification, deployment and degraded modes exist; latest signed-authority rollouts require reconciliation | +| API/event contracts | Present-stale | Implemented on active PR | latest Planning/Habit signed workspace authority and plugin credential-reference boundaries are protected-main behavior; Review and evidence-identity hardening remain active PRs | +| Security | Present-current | Implemented on protected main | root `SECURITY.md` remains vulnerability-reporting authority; service-specific trust boundaries are tracked in architecture/research/test evidence | +| Threat model | Present-stale | Implemented on active PR | trust-boundary coverage exists but current protected signed-workspace and plugin-secret-reference evolution must be reflected | +| Privacy/Data Lifecycle | Present-stale | Implemented on active PR | purpose-bound rights and secret-reference boundaries exist; current plugin credential-reference protection and incomplete hosted runtimes must be reconciled | +| Test Strategy | Present-current | Implemented on active PR | realistic PostgreSQL/browser/security/concurrency/evidence policy remains current as a repository-wide contract | +| Operability | Present-current | Implemented on active PR | deployment/readiness/observability/failure/backup/recovery boundaries remain current at repository level | +| Release/Migration/Rollback | Present-current | Implemented on active PR | one exact integrated release-source contract and fail-closed migration/rollback discipline remain current | +| Standards/Research | Present-current | Implemented on active PR | final-vs-draft discipline, APA 7 anchors and repository-wide model-orchestration evidence/counterevidence are present | +| Requirements Traceability | Present-stale | Implemented on active PR | requirement/decision-to-source/test/issue/PR mapping exists but must absorb protected #168/#169/#170/#172/#173 and active #165/#175/#176 | +| AGENTS authority | Present-current | Implemented on protected main | protected main carries work-conserving maintenance, NVIDIA/no-Copilot, exact-evidence, service ownership and review/merge authority rules | +| CHANGELOG behavior history | Present-current | Implemented on protected main | protected feature/security changes continue to update the Unreleased history independently of canonical docs integration | +| README/CLAUDE canonical discoverability | Present-current on successor | Implemented on active PR | discoverability becomes protected-main authority only after #145 integration | +| Machine-checkable documentation consistency | Present-current | Implemented on active PR | required files/links, maturity vocabulary, ADR 0001-0012, evidence identity, model authority and stale-product semantics are gated | ## Historical drift reconciled @@ -47,40 +43,40 @@ Broad file-family presence did not cover every durable conversation/repository d 5. **Capability maturity -> buyer-gap exhaustion.** These are independent evidence dimensions. 6. **Generic green status -> explicit evidence identity.** ADR 0010 separates source head, PR-base snapshot, live base, integration/synthetic tree, workflow checkout, protected main and release source. 7. **External integration metadata -> ambient authority.** ADR 0011 separates LifeOS identity, provider/plugin metadata, secret references and explicit capability grants. -8. **More agents -> assumed better output.** ADR 0012 instead requires a strong single-route baseline and measured, explicit stage/decomposition/recursion/role-effort/access-topology evidence under documented budgets before deeper orchestration is selected. +8. **More agents -> assumed better output.** ADR 0012 requires a strong single-route baseline and measured stage/decomposition/recursion/role-effort/access-topology evidence under documented budgets before deeper orchestration is selected. 9. **Development model -> repository authority.** ADR 0012 and protected `AGENTS.md` keep NVIDIA/OpenCode model execution independent from deterministic CI/security, formal review, merge and release authority. -## Protected-main evolution currently represented +## Protected-main evolution represented or requiring current reconciliation -Protected main includes durable Today (#127), trusted calendar workspace context (#139), recent-auth/data-rights prerequisites (#134/#136/#137), durable rights ledger (#138), tenant+actor status lookup (#144), authenticated public rights status (#146), export integrity evidence (#149), workspace+user calendar connection persistence (#150), explicit plugin installation grants (#151), migration-fixture reliability repair (#152), atomic calendar connection revocation (#153), exact-source/current-live-base/integration verification hardening (#154), and signed calendar workspace+user authority (#155). +Protected main includes durable Today (#127), trusted calendar workspace context (#139), recent-auth/data-rights prerequisites (#134/#136/#137), durable rights ledger (#138), tenant+actor status lookup (#144), authenticated public rights status (#146), export integrity evidence (#149), workspace+user calendar connection persistence (#150), explicit plugin installation grants (#151), migration-fixture reliability repair (#152), atomic calendar connection revocation (#153), exact-source/current-live-base/integration verification hardening (#154), signed calendar workspace+user authority (#155), signed Planning workspace authority (#168), durable plugin installation persistence (#169), isolated data-rights ledger test ownership (#170), opaque plugin credential-reference persistence (#172), and signed Habit workspace authority (#173). -The old documentation PR #126 and old verification PR #147 are superseded. Historical resolved reviews/checks on those lines are not current evidence. +The old documentation PR #126, old verification PR #147, and superseded implementation lines such as #156 are historical evidence only. Their reviews/checks never substitute for current protected-main or current-head evidence. -## Active work represented without promotion +## Current active work represented without promotion -### PR #156 — durable plugin installation persistence +- **PR #165 — Review signed workspace authority:** `Implemented on active PR`. Review completion/history routes move from browser-selectable workspace authority to signed gateway context. It is not protected-main truth until integrated. +- **PR #175 — plugin installation evidence identity:** `Implemented on active PR`. Application-level install/replay and lookup must reject durable evidence for a different opaque installation identifier. +- **PR #176 — calendar connection lookup evidence identity:** `Implemented on active PR`. Calendar persistence must reject returned durable rows whose connection/workspace/user identity differs from exact lookup authority. -**Status:** Implemented on active PR - -PR #156 adds restart-safe integration-service persistence for plugin installation authority. The canonical graph records the application/SQL authority as installation + workspace + installing user, while keeping plugin credential/KMS handling and outbound delivery explicitly outside this active slice. It is not protected-main behavior until the exact head integrates. +These active PRs are verification/security hardening, not evidence that the parent hosted-runtime gaps are complete. ## Verification-governance residual -PR #154 is now **Implemented on protected main**. LifeOS-owned source verification, AppGuardrail attribution and current-live-base integration compatibility are separated by explicit evidence identity. Issue #132 remains open only for residual central reusable scanner taxonomy: central SAST/Security jobs must expose the actual tree they inspected so synthetic/integration evidence is not promoted to exact-source evidence. +PR #154 is **Implemented on protected main**. LifeOS-owned source verification, AppGuardrail attribution and current-live-base integration compatibility are separated by explicit evidence identity. Issue #132 remains open only for residual central reusable scanner taxonomy: central SAST/Security jobs must expose the actual tree they inspected so synthetic/integration evidence is not promoted to exact-source evidence. ## Remaining product gaps -- **Partial:** #55 complete export/deletion orchestration, despite protected #146/#149. -- **Partial:** #129 complete hosted per-user calendar credential lifecycle, despite protected #150/#153/#155. -- **Partial:** #130 complete plugin secret/outbound-delivery runtime, despite protected #151 and active #156 persistence. +- **Partial:** #55 complete export/deletion orchestration, despite protected public status/export-integrity and ledger foundations. +- **Partial:** #129 complete hosted per-user calendar credential lifecycle, despite protected calendar connection/revocation/signed user authority and active #176 evidence hardening. +- **Partial:** #130 complete plugin runtime delivery, despite protected grant authority, durable installation persistence, opaque credential-reference persistence and active #175 evidence hardening. Secret materialization/KMS implementation, outbound SSRF-safe delivery, retry/dead-letter/runtime composition and operator surfaces remain separate work. - **Residual governance gap:** #132 central scanner checkout/attribution taxonomy after protected #154. ## Sufficiency criteria The documentation line is design-sufficient only when canonical families are discoverable, statuses use exact vocabulary, ADR targets/sections are valid, diagrams are balanced, root Architecture matches protected service authority, active behavior is not called shipped, requirements/gaps map to executable evidence, model-development authority and its counterevidence are canonical, and semantic-regression tests fail when currentness drifts. -The repository is protected-main documentation sufficient only after PR #145 passes current exact-head CI/security/review/documentation contracts and integrates against a freshly resolved live base without regressing current source/policy. +The repository is protected-main documentation sufficient only after PR #145 is reconciled to a freshly resolved live base, passes current exact-head CI/security/review/documentation contracts, and integrates without regressing current source/policy. ## Continuation rule -Documentation completion is a governance gate only. After #145 waits or integrates, the autonomous queue continues active #156 and the remaining #55/#129/#130/#132 work plus newly discovered buyer/security/reliability/operability gaps. A green documentation pack is not a product-completion or run-termination condition. +Documentation completion is a governance gate only. While #145 is stale, conflicted, checking, or awaiting integration, the autonomous queue continues current security/reliability PRs and the remaining #55/#129/#130/#132 work plus newly discovered buyer/security/reliability/operability gaps. A green documentation pack is not a product-completion or run-termination condition. From 61b3704e482c201eb2cee8184960a2ae2cb87c71 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 20:15:02 +0900 Subject: [PATCH 099/173] docs: reconcile active successors and data-rights work --- docs/DOCUMENTATION_ASSESSMENT.md | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/docs/DOCUMENTATION_ASSESSMENT.md b/docs/DOCUMENTATION_ASSESSMENT.md index 4abf174f0..a6ae6910b 100644 --- a/docs/DOCUMENTATION_ASSESSMENT.md +++ b/docs/DOCUMENTATION_ASSESSMENT.md @@ -14,21 +14,21 @@ The repository remains **protected-main documentation insufficient** until this | Family | Assessment on #145 | Maturity | Notes | | --- | --- | --- | --- | -| PRD | Present-stale | Implemented on active PR | family coverage is complete, but protected #168/#169/#170/#172/#173 and active #165/#175/#176 require semantic reconciliation | +| PRD | Present-stale | Implemented on active PR | family coverage is complete, but protected #168/#169/#170/#172/#173 and active #175/#176/#178/#179 require semantic reconciliation | | TRD | Present-stale | Implemented on active PR | runtime, authority, data, API/event, concurrency, AI/security/ops/release and evidence-identity contracts exist; latest protected integration state must be folded in | | Root Architecture | Present-stale | Implemented on active PR | bounded-context and authority spine exists, but latest Planning/Habit/plugin-credential protected behavior is newer than the current canonical snapshot | | ADR index / decisions | Present-current | Implemented on active PR | ADR 0001-0012 cover identifiers, persistence, AI, privacy, maintenance, documentation, maturity, hosting, evidence identity, integration authority and test-time compute/model-development authority | -| Logical ERD / Data Model | Present-stale | Implemented on active PR | protected plugin installation persistence and credential-reference metadata now supersede the earlier active-PR-only representation; active #175/#176 remain non-shipped evidence | +| Logical ERD / Data Model | Present-stale | Implemented on active PR | protected plugin installation persistence and credential-reference metadata now supersede the earlier active-PR-only representation; active #175/#176 remain non-shipped evidence and Draft #179 must not invent Planning rights persistence before implementation | | UML | Present-stale | Implemented on active PR | topology, login, Today/review, calendar, AI, model-governance, rights, plugin, verification, deployment and degraded modes exist; latest signed-authority rollouts require reconciliation | -| API/event contracts | Present-stale | Implemented on active PR | latest Planning/Habit signed workspace authority and plugin credential-reference boundaries are protected-main behavior; Review and evidence-identity hardening remain active PRs | +| API/event contracts | Present-stale | Implemented on active PR | latest Planning/Habit signed workspace authority and plugin credential-reference boundaries are protected-main behavior; Review #178 and Draft Planning data-rights composition #179 remain active/non-shipped | | Security | Present-current | Implemented on protected main | root `SECURITY.md` remains vulnerability-reporting authority; service-specific trust boundaries are tracked in architecture/research/test evidence | | Threat model | Present-stale | Implemented on active PR | trust-boundary coverage exists but current protected signed-workspace and plugin-secret-reference evolution must be reflected | -| Privacy/Data Lifecycle | Present-stale | Implemented on active PR | purpose-bound rights and secret-reference boundaries exist; current plugin credential-reference protection and incomplete hosted runtimes must be reconciled | +| Privacy/Data Lifecycle | Present-stale | Implemented on active PR | purpose-bound rights and secret-reference boundaries exist; protected `life-os.data-rights-contributor.v1` plus Draft #179 Planning composition and incomplete hosted runtimes require explicit maturity separation | | Test Strategy | Present-current | Implemented on active PR | realistic PostgreSQL/browser/security/concurrency/evidence policy remains current as a repository-wide contract | | Operability | Present-current | Implemented on active PR | deployment/readiness/observability/failure/backup/recovery boundaries remain current at repository level | | Release/Migration/Rollback | Present-current | Implemented on active PR | one exact integrated release-source contract and fail-closed migration/rollback discipline remain current | | Standards/Research | Present-current | Implemented on active PR | final-vs-draft discipline, APA 7 anchors and repository-wide model-orchestration evidence/counterevidence are present | -| Requirements Traceability | Present-stale | Implemented on active PR | requirement/decision-to-source/test/issue/PR mapping exists but must absorb protected #168/#169/#170/#172/#173 and active #165/#175/#176 | +| Requirements Traceability | Present-stale | Implemented on active PR | requirement/decision-to-source/test/issue/PR mapping exists but must absorb protected #168/#169/#170/#172/#173 and active #175/#176/#178/#179 | | AGENTS authority | Present-current | Implemented on protected main | protected main carries work-conserving maintenance, NVIDIA/no-Copilot, exact-evidence, service ownership and review/merge authority rules | | CHANGELOG behavior history | Present-current | Implemented on protected main | protected feature/security changes continue to update the Unreleased history independently of canonical docs integration | | README/CLAUDE canonical discoverability | Present-current on successor | Implemented on active PR | discoverability becomes protected-main authority only after #145 integration | @@ -48,17 +48,18 @@ The repository remains **protected-main documentation insufficient** until this ## Protected-main evolution represented or requiring current reconciliation -Protected main includes durable Today (#127), trusted calendar workspace context (#139), recent-auth/data-rights prerequisites (#134/#136/#137), durable rights ledger (#138), tenant+actor status lookup (#144), authenticated public rights status (#146), export integrity evidence (#149), workspace+user calendar connection persistence (#150), explicit plugin installation grants (#151), migration-fixture reliability repair (#152), atomic calendar connection revocation (#153), exact-source/current-live-base/integration verification hardening (#154), signed calendar workspace+user authority (#155), signed Planning workspace authority (#168), durable plugin installation persistence (#169), isolated data-rights ledger test ownership (#170), opaque plugin credential-reference persistence (#172), and signed Habit workspace authority (#173). +Protected main includes durable Today (#127), trusted calendar workspace context (#139), recent-auth/data-rights prerequisites (#134/#136/#137), durable rights ledger (#138), tenant+actor status lookup (#144), authenticated public rights status (#146), export integrity evidence (#149), workspace+user calendar connection persistence (#150), explicit plugin installation grants (#151), migration-fixture reliability repair (#152), atomic calendar connection revocation (#153), exact-source/current-live-base/integration verification hardening (#154), signed calendar workspace+user authority (#155), protected versioned data-rights contributor contract (#159), signed Planning workspace authority (#168), durable plugin installation persistence (#169), isolated data-rights ledger test ownership (#170), opaque plugin credential-reference persistence (#172), and signed Habit workspace authority (#173). -The old documentation PR #126, old verification PR #147, and superseded implementation lines such as #156 are historical evidence only. Their reviews/checks never substitute for current protected-main or current-head evidence. +The old documentation PR #126, old verification PR #147, superseded plugin installation line #156, and superseded Review line #165 are historical evidence only. Their reviews/checks never substitute for current protected-main or current-head evidence. ## Current active work represented without promotion -- **PR #165 — Review signed workspace authority:** `Implemented on active PR`. Review completion/history routes move from browser-selectable workspace authority to signed gateway context. It is not protected-main truth until integrated. - **PR #175 — plugin installation evidence identity:** `Implemented on active PR`. Application-level install/replay and lookup must reject durable evidence for a different opaque installation identifier. - **PR #176 — calendar connection lookup evidence identity:** `Implemented on active PR`. Calendar persistence must reject returned durable rows whose connection/workspace/user identity differs from exact lookup authority. +- **PR #178 — Review signed workspace authority current-main successor:** `Implemented on active PR`. It preserves #165's five Review semantic paths on current protected-main ancestry after the old branch acquired unusable control-plane state. It is not protected-main truth until its exact current head passes and integrates. +- **PR #179 — Planning data-rights contributor v1:** `Implemented on active PR` only for the currently committed test-side composition contract. The Draft deliberately begins with a RED runtime requirement; no Planning export/erase/verify production capability may be described as implemented until test-first production work lands and passes. -These active PRs are verification/security hardening, not evidence that the parent hosted-runtime gaps are complete. +These active PRs are verification/security/privacy work, not evidence that the parent hosted-runtime or whole-right gaps are complete. ## Verification-governance residual @@ -66,7 +67,7 @@ PR #154 is **Implemented on protected main**. LifeOS-owned source verification, ## Remaining product gaps -- **Partial:** #55 complete export/deletion orchestration, despite protected public status/export-integrity and ledger foundations. +- **Partial:** #55 complete export/deletion orchestration. Protected main has the generic contributor contract from #159 plus public status/export-integrity and ledger foundations; Draft #179 starts the first concrete Planning contributor and is not shipped behavior. - **Partial:** #129 complete hosted per-user calendar credential lifecycle, despite protected calendar connection/revocation/signed user authority and active #176 evidence hardening. - **Partial:** #130 complete plugin runtime delivery, despite protected grant authority, durable installation persistence, opaque credential-reference persistence and active #175 evidence hardening. Secret materialization/KMS implementation, outbound SSRF-safe delivery, retry/dead-letter/runtime composition and operator surfaces remain separate work. - **Residual governance gap:** #132 central scanner checkout/attribution taxonomy after protected #154. From a4c39a1fd353080bdd6fdeb45ee946623ea89751 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 12 Aug 2026 21:11:29 +0900 Subject: [PATCH 100/173] test(docs): reject stale canonical maturity claims --- .../src/documentation-currentness.test.mjs | 61 +++++++++++++++++++ 1 file changed, 61 insertions(+) create mode 100644 packages/commercial-readiness/src/documentation-currentness.test.mjs diff --git a/packages/commercial-readiness/src/documentation-currentness.test.mjs b/packages/commercial-readiness/src/documentation-currentness.test.mjs new file mode 100644 index 000000000..4573ed57d --- /dev/null +++ b/packages/commercial-readiness/src/documentation-currentness.test.mjs @@ -0,0 +1,61 @@ +import assert from 'node:assert/strict'; +import { readFileSync } from 'node:fs'; +import { join } from 'node:path'; +import { fileURLToPath } from 'node:url'; +import test from 'node:test'; + +const ROOT = fileURLToPath(new URL('../../../', import.meta.url)); +const read = (path) => readFileSync(join(ROOT, path), 'utf8'); +const canonical = [ + 'ARCHITECTURE.md', + 'docs/PRD.md', + 'docs/TRD.md', + 'docs/DATA_MODEL.md', + 'docs/API_CONTRACTS.md', + 'docs/UML.md', + 'docs/THREAT_MODEL.md', + 'docs/PRIVACY_DATA_LIFECYCLE.md', + 'docs/TRACEABILITY.md', + 'docs/DOCUMENTATION_ASSESSMENT.md', +].map(read).join('\n'); +const traceability = read('docs/TRACEABILITY.md'); +const assessment = read('docs/DOCUMENTATION_ASSESSMENT.md'); + +test('canonical maturity follows protected main and current active work', () => { + for (const pullRequest of [ + 157, 159, 168, 169, 172, 173, 175, 176, 179, 184, 185, 186, + 187, 188, 189, 190, 191, 192, 193, 194, 196, 197, 200, 201, + ]) { + assert.match(canonical, new RegExp(`PR #${pullRequest}\\b`, 'u')); + } + + for (const requirement of [ + 'PRD-PLAN-003', 'PRD-HAB-002', 'PRD-REV-002', 'PRD-CAL-007', + 'PRD-CAL-008', 'PRD-PRIV-007', 'PRD-PRIV-008', 'PRD-INT-004', + 'PRD-INT-005', 'PRD-INT-006', 'PRD-WEB-002', + ]) { + assert.match( + traceability, + new RegExp(`${requirement}.*Implemented on protected main`, 'u'), + ); + } + + for (const pullRequest of [195, 198, 199]) { + assert.match( + assessment, + new RegExp(`PR #${pullRequest}.*Implemented on active PR`, 'su'), + ); + } + assert.match(assessment, /PR #200.*Implemented on protected main/su); + + assert.doesNotMatch( + canonical, + /PR #(?:156|160|162|165|175|176|178|179) (?:is \*\*Implemented on active PR\*\*|\| Implemented on active PR \|)/iu, + ); + assert.match(canonical, /Issue #163.*completed/iu); +}); + +test('canonical gaps remain bounded and truthful', () => { + assert.match(traceability, /Canonical buyer gaps remain #55, #129 and #130/u); + assert.match(assessment, /Issue #132.*Partial/su); +}); From 4065c9b3147900209dc8dd8120b2f13a028c967b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 12 Aug 2026 21:33:48 +0900 Subject: [PATCH 101/173] docs: align canonical maturity with protected main --- ARCHITECTURE.md | 166 +++++++------ docs/API_CONTRACTS.md | 139 ++++++----- docs/DATA_MODEL.md | 126 ++++++---- docs/DOCUMENTATION_ASSESSMENT.md | 156 ++++++------ docs/OPERABILITY.md | 104 +++++--- docs/PRD.md | 126 +++++----- docs/PRIVACY_DATA_LIFECYCLE.md | 127 ++++++---- docs/RELEASE_AND_MIGRATION.md | 92 +++++-- docs/TEST_STRATEGY.md | 128 ++++++---- docs/THREAT_MODEL.md | 156 ++++++++---- docs/TRACEABILITY.md | 141 +++++++---- docs/TRD.md | 184 +++++++------- docs/UML.md | 395 +++++++++++++++++-------------- 13 files changed, 1231 insertions(+), 809 deletions(-) diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 6be7aac2b..49810ebd1 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -1,12 +1,14 @@ # LifeOS architecture decisions -This document is the architectural source of truth for repository-wide product and service authority. Protected-main source, migrations, tests and live repository policy are executable evidence for shipped behavior. Canonical PRD/TRD/Data Model/UML/Security/Privacy/Operability views add code-current detail without weakening these decisions. +**Status:** Implemented on active PR + +Protected-main `AGENTS.md`, source, migrations, tests, and live repository policy are the executable authority for shipped behavior. This document is the canonical whole-product architecture view. Active pull requests are evidence only until integration. ## 1. Product and deployment boundary -LifeOS is a privacy-first, multi-user, server-backed and self-hostable personal operating system. It remains independently usable while composing with other ContextualWisdomLab bounded contexts only through explicit versioned interfaces. +LifeOS is a public, multi-user, server-backed, self-hostable personal operating system. It operates independently and composes with other bounded contexts only through explicit versioned interfaces. -Earlier login-free/browser-only local-first, private-personal-only, UUIDv7 and single-application primary designs are **Superseded**. Browser-local state remains valid as explicit draft/cache/offline state and Docker Compose remains a deployment profile, but neither becomes durable data authority or permission to collapse service ownership. +The earlier login-free/browser-only local-first primary design, UUIDv7 internal identifiers, private-personal-only positioning, and single-application durable architecture are **Superseded**. Browser-local state is not durable until the owning service confirms persistence. Offline drafts and Docker Compose remain explicit supported profiles, not alternate sources of durable authority. ```mermaid flowchart LR @@ -18,119 +20,143 @@ flowchart LR G --> C[Calendar] G --> N[Notification] G --> A[AI Proposal] - G --> X[Plugin Integration] G --> V[Privacy] - P -. events .-> J[(NATS JetStream)] - H -. events .-> J + G --> X[Plugin Integration] + P -. versioned events .-> J[(NATS JetStream)] + H -. versioned events .-> J R -. projections/events .-> J - J -. reminder/event inputs .-> N + J -. reminder inputs .-> N ``` ### Required invariants -- Internal IDs are opaque UUIDv4; provider/native IDs remain explicit external mappings. -- Product-owned DB objects use descriptive multiword `snake_case` unless an external standard mandates otherwise. -- Each service owns persistence, migrations, DB credentials, runtime configuration, tests, observability and shutdown behavior. -- Services never read or mutate another service's tables directly; cross-service relationships use versioned HTTP/event/saga/plugin/MCP contracts. -- Browser-local state is not durable until the owning service confirms persistence. -- Public errors, logs, metrics, retained artifacts and review evidence exclude credentials, hidden reasoning and unnecessary unbounded tenant content. +- Internal/public product IDs are opaque UUIDv4; provider IDs are bounded external metadata. +- Product-owned database objects use descriptive multiword `snake_case`. +- Every service owns its persistence, migrations, credentials, runtime composition, tests, observability, and shutdown behavior. +- Services never read or mutate another service's tables directly. +- Cross-service composition uses versioned HTTP, event, saga, plugin, or MCP contracts and never grants SQL authority. +- Public errors, logs, metrics, retained artifacts, and model inputs exclude credentials, hidden reasoning, and unnecessary tenant content. +- AI output is untrusted inert proposal data until an explicit authorized decision; proposal evidence cannot execute its own operations. + +## 2. Identity, workspace, and data-rights authority + +Identity owns internal user identity, external provider mappings, workspace membership, sessions, authentication provenance, whole-request data-rights identity, and durable aggregate request/receipt evidence. Authentication-ceremony time remains separate from compatible session issuance and rotation. + +Protected main includes: -## 2. Identity, workspace and data-rights authority +- recent-authentication provenance and policy; +- durable data-rights request and immutable terminal receipt evidence; +- authenticated tenant-and-requesting-user status lookup; +- deterministic contributor export integrity evidence; +- the versioned `life-os.data-rights-contributor.v1` contract from PR #159. -Identity owns LifeOS user identity, provider mappings, workspace membership/authorization, sessions, authentication provenance and the durable data-rights request/receipt boundary. +Planning is a protected contributor through PR #179 and its request-bound authenticated transport through PR #194. Habit is a protected contributor through PR #184 and its replay-safe authenticated transport through PR #192. Review contribution is **Implemented on active PR** in PR #195, Notification contribution is **Implemented on active PR** in PR #198, and AI contribution is **Implemented on active PR** in PR #199. -Google/GitHub OAuth transactions are server-owned and replay-resistant. Authentication-ceremony time is distinct from session issuance/rotation; compatible session rotation preserves authentication age so sensitive recent-auth policy cannot be bypassed by refreshing a session. +Issue #55 remains **Partial**. Active contributors do not become shipped truth, and even their future integration will not by itself finish Identity-owned data, Calendar, Privacy, Plugin Integration, durable reconciliation, retention/legal-hold/backup-expiry, protected export delivery, or final participant-set completion. -Protected main includes tenant+requesting-actor scoped request lookup, the authenticated non-cacheable public status resource from PR #146, and export-manifest integrity evidence from PR #149. Export section/whole SHA-256 digests are integrity evidence only, not authorization, confidentiality, provenance or signatures. +## 3. Planning, Habit, Review, Today, and Notification -Complete cross-domain export/erasure remains **Partial** under #55 because contributor completion, durable reconciliation, protected delivery, retention/legal-hold/backup-expiry and terminal whole-product completion are separate requirements. +Planning owns Goals, Projects, Tasks, search, and the durable Today aggregate. Habit owns recurring definitions and completion evidence. Review owns guided-review persistence/projections without Planning or Habit mutation authority. Notification owns reminder occurrences, claims, delivery attempts, outcomes, and recovery evidence. -## 3. Planning, habits, review and reminders +Protected main now requires signed tenant authority on Planning through PR #168 and request-bound signatures through PR #188. Habit signed authority is protected through PR #173. Review request-bound signed workspace authority is protected through PR #185. -Planning owns Goals, Projects, Tasks, search and durable Today state. Habit owns recurring definitions/completions. Review owns snapshots/projections without Planning/Habit mutation authority. Notification owns reminder occurrences, claims/fencing, delivery attempts and bounded outcomes. +Gateway Today composition is real protected behavior: PR #186 composes authenticated Planning state and PR #187 composes authenticated Habit state. Issue #163 is completed; the earlier PR #164 fail-closed placeholder removal remains historical safety evidence, not the current end state. -Durable Today synchronization is protected-main behavior: explicit local-to-workspace save, strong create/update preconditions, idempotency and explicit stale-conflict/reconciliation evidence prevent silent overwrite. +Durable Today uses explicit local-to-workspace acceptance, strong create/update preconditions, idempotency, and stale-conflict reconciliation. No browser draft is presented as durable before server acceptance. ## 4. Calendar integration boundary -Conflict-safe CalDAV/Google sync and signed trusted workspace context are protected main. PR #150 added the service-owned `calendar_integration.calendar_connection_record` persistence foundation scoped simultaneously to workspace and user, with bounded provider/account/calendar metadata, normalized scopes and opaque external credential references. PR #153 added atomic tenant+user-scoped local connection revocation and replay semantics. +Calendar synchronization and user credential lifecycles use different authority contexts. -PR #155 is **Implemented on protected main** and adds a distinct short-lived signed `life-os.calendar-user.v1` context binding both workspace and requesting-user UUIDv4 identities for user-sensitive hosted operations. It adds authority evidence only, not the public disconnect/runtime composition. +Protected-main foundations are: -The complete hosted lifecycle remains **Partial** under #129: OAuth state/PKCE, concrete managed secret storage, refresh/provider-side revocation, discovery/selection and migration from development provider configuration are separate gates. Provider IDs/credentials never become LifeOS primary IDs or general login credentials. +- trusted workspace synchronization context from PR #139; +- workspace-and-user scoped connection persistence from PR #150; +- atomic local revocation from PR #153; +- signed `life-os.calendar-user.v1` workspace-and-user authority from PR #155; +- authenticated local disconnect application/HTTP boundary from PR #157; +- exact returned lookup-evidence validation from PR #176; +- authenticated credential-free connection read lifecycle from PR #189; +- scoped credential materialization port from PR #193; +- authenticated connection creation with secret-first persistence and compensation boundaries from PR #197; +- returned durable create-evidence validation and reverse-order secret compensation from PR #201. + +Issue #129 remains **Partial** because protected main still lacks the complete concrete encrypted secret-store/KMS production adapter, Google OAuth state/PKCE/callback, refresh fencing, provider-side revoke/delete recovery, calendar discovery/selection, scoped sync composition, and retirement of the process-global development token path. Connection rows store only bounded metadata and opaque secret references; local revocation is not provider credential revocation. ## 5. Plugin integration boundary -Protected main owns versioned plugin manifest/event validation and, through PR #151, explicit host-owned installation authority. A validated manifest expresses requested intent; the host grants a bounded tenant-scoped capability subset. Exact replay is permitted only for matching authority evidence, conflicting installation-ID reuse fails, cross-tenant/user existence is not disclosed, and revocation ends active authority while preserving bounded audit evidence. +A plugin manifest expresses untrusted requested intent. Host-owned authority grants only an explicit bounded tenant/user capability subset. + +Protected main includes: -PR #156 is **Implemented on active PR** for restart-safe plugin installation persistence with application and SQL lookup/revocation authority scoped by installation, workspace and installing user. It does not add secret storage or outbound delivery authority. +- explicit grant/replay/conflict/revocation authority from PR #151; +- restart-safe PostgreSQL installation persistence from PR #169; +- opaque secret-reference credential binding and compensation from PR #172; +- exact opaque installation evidence validation from PR #175; +- request-bound one-time operator authority and durable replay protection from PR #191; +- fail-closed authenticated operator HTTP composition from PR #196. -Issue #130 remains **Partial** because protected secret handling, authorized-origin SSRF-safe delivery, retry/dead-letter/audit and delivery-time revocation enforcement are not yet the complete protected runtime. Installation authority or persistence does not imply those capabilities exist. +Issue #130 remains **Partial**. Protected main does not yet contain a concrete KMS adapter, host-authorized delivery-origin registry, SSRF/DNS-rebinding-safe outbound HTTPS runtime, delivery attempt/outcome persistence, retry/dead-letter worker, or complete operator-facing delivery lifecycle. Manifests and stored installations never self-authorize network capabilities. ## 6. AI proposal boundary -AI output is untrusted inert proposal data, never an execution command. The AI service may generate/persist/retrieve proposal evidence and append explicit accept/reject decisions, but it has no generic Planning mutation repository or command bus. Deterministic schema, authorization and quality gates remain authoritative when model providers are unavailable. +AI may generate, validate, persist, and retrieve inert proposal evidence and append explicit accept/reject decisions. It has no generic Planning mutation repository or command bus. Deterministic schema, authorization, quality, and release gates remain authoritative when model providers are unavailable or disagree. + +PR #199 is **Implemented on active PR** for an AI-owned data-rights contributor. Its active migrations and application code are not protected-main truth. ## 7. Privacy authority -Privacy owns purpose-bound sensitive-access decisions, bounded grants and audit events. Sensitive access binds actor, workspace, resource/resource class, purpose and lifetime. Blanket masking is not the authorization model. Identity owns whole-right request orchestration identity; each bounded service remains authoritative for its own export/erasure contribution. +Privacy owns purpose-bound sensitive-access decisions, bounded grants, and audit events. Sensitive access binds actor, workspace, purpose, resource/resource class, lifetime, and audit evidence. Blanket masking is not the authorization model. + +Whole-right orchestration remains Identity-owned. Every bounded service remains authoritative for its own export and erasure contribution and cannot claim whole-workspace completion independently. + +## 8. External identity, secret references, and grants -## 8. External integration identity, secret references and grants +ADR 0011 is authoritative: -ADR 0011 is authoritative: LifeOS integration records use internal UUIDv4 identity; external provider/plugin identifiers remain bounded metadata; credential material is referenced through opaque secret handles or equivalent least-authority secret-store references; manifests cannot self-authorize capabilities; revocation/replay/conflict semantics fail closed; owning services retain migrations/repositories/API authority. +- LifeOS integration identities are internal UUIDv4 values; +- external provider/plugin identifiers remain bounded metadata; +- credential material is separate from metadata and referenced through opaque least-authority handles; +- manifests never self-authorize capabilities; +- revocation, replay, conflict, compensation, and recovery fail closed; +- owning services retain migrations, repositories, and API authority. -Protected #150/#151/#153/#155 and active #156 are evidence of this boundary. Their existence does not close parent #129/#130 runtime lifecycles. +The protected Calendar and Plugin Integration lines above are executable evidence of this decision. Neither closes its parent buyer gap. -## 9. Test-time compute and repository automation +## 9. Model-assisted development and automation -ADR 0012 is authoritative. A strong single-model route is the mandatory comparison baseline before deeper orchestration. Reasoning effort, workflow stage, decomposition, recursion depth, role-specific reasoning effort, model/worker selection, verifier topology and access-list/communication topology are explicit experimental dimensions when the exact reviewed dependency supports them. Unsupported controls remain explicit rather than simulated. +ADR 0012 is authoritative. A strong single-model route is measured before deeper orchestration. Workflow stage, reasoning effort, decomposition, recursion depth, role-specific reasoning effort, worker/model selection, verifier topology, and access/communication topology are explicit experimental dimensions only when supported by the exact reviewed dependency. -Deeper orchestration is selected only when retained LifeOS evidence demonstrates a material correctness/evidence/capability gain under a documented reasonably comparable budget without unacceptable safety/reliability regression. Latency, provider calls, tokens and cost are measured for capacity/commercial review but are not the sole or primary objective. +Model-backed development uses reviewed OpenCode or contextual-orchestrator boundaries with GitHub Secret `NVIDIA_NIM_API_KEY`; `COPILOT_GITHUB_TOKEN` is prohibited. Model execution has no product-data authority beyond bounded inputs and no independent review, branch-protection, merge, or release authority. Retained evidence excludes credentials, raw prompts/responses, and hidden reasoning. -Model-backed tests and model-assisted development use reviewed OpenCode or contextual-orchestrator boundaries with GitHub Secret `NVIDIA_NIM_API_KEY`; `COPILOT_GITHUB_TOKEN` is prohibited. Development-model identity receives no product-data authority beyond its bounded input, independent-review authority, branch-protection authority, merge authority or release authority. Retained evidence is credential-free and excludes raw prompts/responses/hidden reasoning. Deterministic authorization, evaluation, CI/security, formal review, merge and release gates remain authoritative when model providers are unavailable or disagree. +PR #200 is **Implemented on protected main** for restoring the exact pinned OpenCode executable by allowing only the reviewed `opencode-ai` lifecycle script. It does not weaken deterministic governance or authorize unrelated dependency scripts. -## 10. Verification evidence identity and merge safety +## 10. Verification identity and merge safety -Repository evidence identities are distinct: +ADR 0010 keeps these identities separate: -- `source_head_sha` — exact contributor/source head; -- `pr_base_snapshot_sha` — PR/event base snapshot, historical once base moves; -- `live_base_tip_sha` — independently resolved current base-ref tip; -- `integration_tree_sha` / synthetic merge identity — separately classified integration evidence; -- `workflow_checkout_sha` — exact tree inspected by a job; -- `protected_main_sha` — integrated protected-main evidence; -- `release_source_sha` — protected source bound to released artifacts. +- `source_head_sha`; +- `pr_base_snapshot_sha`; +- independently resolved `live_base_tip_sha`; +- `integration_tree_sha` or separately classified synthetic merge identity; +- `workflow_checkout_sha`; +- `protected_main_sha`; +- `release_source_sha`. -ADR 0010 is authoritative. Exact-source verification and integration compatibility answer different questions. Old PR #147 is **Superseded**. PR #154 is **Implemented on protected main** as merge commit `2c272a404f8f3a74aa5796a1957d4a6ce0fabe8f`: LifeOS source-verification jobs bind to contributor head, AppGuardrail SARIF binds to the analyzed source identity, and the distinct merge-compatibility job reconstructs and verifies an integration tree from the current independently resolved source and live-base identities. +PR #154 is protected-main evidence for exact-source jobs, independently reconstructed live-base compatibility, and explicit AppGuardrail source attribution. Issue #132 remains **Partial** only for central reusable SAST/Security checkout and evidence taxonomy. A green status for one identity never transfers to another. -Issue #132 remains open only for residual central reusable scanner classification: central SAST/Security jobs must make the actual checkout/evidence identity auditable and must not relabel synthetic/integration-tree evidence as exact-source evidence. Check names/ruleset strictness are preserved while that taxonomy is made explicit. +PR #190 protects exact request-bound integration event authority. PR #191 and PR #196 protect the plugin operator request/replay/HTTP line. These product authorities are independent from merge authority. -Pull requests are processed work-conservingly: inspect current evidence, RCA non-passing gates, make the smallest test-first correction, rerun exact evidence, resolve only addressed findings, and merge only an unchanged head accepted by live repository policy. Waiting on one lane never authorizes stale evidence or repository-wide idle time. +## 11. Release and recovery boundary -## 11. Mathematical / psychometric future constraint +A release is cut from one exact integrated protected head only after applicable CI, security, review, coverage/docstrings, packaging, SBOM/provenance, reproducibility, compatibility, migrations/rollback, backup/restore/recovery, accessibility/localization, and operational acceptance pass together. No feature PR, documentation PR, or model judgment is release evidence by itself. -LifeOS currently contains no psychometric computation service. If future scope introduces mathematical/psychometric computation, production numerical kernels are Rust-first; realistic parameter recovery, uncertainty/coverage, convergence, reproducibility, CPU/GPU parity where applicable, multilevel/multiple-membership structure and temporal/repeated-measurement semantics must be established before product claims. This is a future constraint, not a current capability claim. +## 12. Mathematical and psychometric future constraint -## 12. Canonical documentation graph +LifeOS currently has no psychometric computation service. Future product-owned mathematical or psychometric kernels are Rust-first, use low-context-switch CPU multithreading, add parity-verified GPU paths where material, and prove parameter recovery, uncertainty/coverage, convergence, reproducibility, multilevel/multiple-membership structure, and temporal/repeated-measurement semantics before product claims. -GitHub must reconstruct LifeOS without chat/old-PR archaeology: +## 13. Canonical documentation graph -1. `AGENTS.md` -2. `ARCHITECTURE.md` -3. `docs/PRD.md` -4. `docs/TRD.md` -5. `docs/adr/README.md` + ADRs -6. `docs/DATA_MODEL.md` -7. `docs/UML.md` -8. `docs/API_CONTRACTS.md` -9. `SECURITY.md` + `docs/THREAT_MODEL.md` -10. `docs/PRIVACY_DATA_LIFECYCLE.md` -11. `docs/TEST_STRATEGY.md` -12. `docs/OPERABILITY.md` -13. `docs/RELEASE_AND_MIGRATION.md` -14. `docs/STANDARDS_TRACEABILITY.md` -15. `docs/TRACEABILITY.md` -16. `docs/DOCUMENTATION_ASSESSMENT.md` -17. `CLAUDE.md`, `README.md`, `CHANGELOG.md`, scoped specs/plans/runbooks. +The canonical line comprises `AGENTS.md`, this root Architecture, PRD, TRD, ADR index/details, UML/C4 views, logical Data Model, API/event/schema contracts, Security, Threat Model, Privacy/Data Lifecycle, Test Strategy, Operability/recovery, Release/Migration/Rollback/provenance, Standards/Research, Traceability, Documentation Assessment, README, CLAUDE, and CHANGELOG. -Canonical status fields use only `Implemented on protected main`, `Implemented on active PR`, `Partial`, `Accepted architecture`, `Planned`, `Research only`, `Superseded`, or `Out of scope`. File age, presence and historically resolved reviews do not prove semantic currentness. A material authority change is documentation-incomplete until relevant canonical views and executable documentation contracts reconcile it. +Canonical maturity uses only `Implemented on protected main`, `Implemented on active PR`, `Partial`, `Accepted architecture`, `Planned`, `Research only`, `Superseded`, and `Out of scope`. File presence and old green checks do not prove semantic currentness. diff --git a/docs/API_CONTRACTS.md b/docs/API_CONTRACTS.md index aba0cc182..fd6ebd51d 100644 --- a/docs/API_CONTRACTS.md +++ b/docs/API_CONTRACTS.md @@ -1,104 +1,123 @@ -# LifeOS API and Event Contracts +# LifeOS API, Event, and Schema Contracts **Status:** Implemented on active PR -This registry summarizes repository-level API/event invariants. Concrete route schemas remain owned by the implementing service and tests. +This registry summarizes repository-level contract invariants. Concrete route, event, and migration schemas remain owned by implementing services and tests. ## Common rules -- Internal IDs are opaque UUIDv4. +- Internal/public product IDs are opaque UUIDv4. - Ownership comes from authenticated/signed context, never arbitrary browser fields. -- Replayable/stale-sensitive mutations use idempotency and/or strong preconditions. -- Public failures are bounded and credential-free. -- Provider responses, plugin metadata and model output are untrusted until validated. +- Signed service context binds version, exact actor/workspace, method, path, issuance, and one-time evidence where replay matters. +- Replayable or stale-sensitive mutations use idempotency, fencing, and/or strong preconditions. +- Public failures are bounded, non-reflective, and credential-free. +- Provider responses, stored JSON, plugin metadata, and model output remain untrusted until validated. - Cross-service contracts never grant direct database authority. -- Verification evidence is valid only for the exact tree actually inspected. +- Unknown versions, malformed evidence, corrupt rows, and unavailable authority fail closed. +- Verification evidence is valid only for the exact tree inspected. ## Contract registry | Contract | Owner | Status | Notes | | --- | --- | --- | --- | -| OAuth login/callback/session | identity-service | Implemented on protected main | Google/GitHub, bounded transaction/session lifecycle | -| Planning Goal/Project/Task | planning-service | Implemented on protected main | tenant-derived authority | -| Durable Today aggregate | planning-service | Implemented on protected main | PR #127; strong preconditions/idempotency/conflicts | -| Habit recurrence/completion | habit-service | Implemented on protected main | tenant-scoped replay safety | -| Review projection | review-service | Implemented on protected main | projection/read authority only | -| Calendar sync request | calendar integration | Implemented on protected main | PR #139 signed workspace context | -| Calendar connection registry | calendar integration | Implemented on protected main | PR #150; workspace+user scoped metadata + opaque secret references | -| Atomic calendar connection revocation | calendar integration | Implemented on protected main | PR #153; exact tenant+user scope and revocation replay | -| Signed calendar workspace+user context | calendar integration | Implemented on protected main | PR #155 / `life-os.calendar-user.v1` | -| Complete per-user calendar credential lifecycle | calendar integration | Partial | issue #129; public connection/disconnect composition, OAuth/PKCE, managed secret backend, refresh/provider revoke, discovery/selection remain | -| Reminder scheduling/delivery | notification-service | Implemented on protected main | bounded claims/retries/outcomes | -| AI proposal/evidence/decision | AI proposal service | Implemented on protected main | inert proposal + explicit decision | -| Purpose-bound sensitive access | privacy-service | Implemented on protected main | actor/resource/purpose/lifetime bound | -| Data-rights request ledger/status lookup | identity-service | Implemented on protected main | #138/#144 | -| Authenticated public data-rights status | identity-service | Implemented on protected main | PR #146; no-store bounded projection | -| Tenant export integrity manifest | identity coordinator + contributors | Implemented on protected main | PR #149; section/whole SHA-256 evidence | -| Complete cross-domain export/erasure | identity coordinator + contributors | Partial | issue #55 | -| Plugin manifest/event validation | integration-service | Implemented on protected main | versioned SDK/validation | -| Explicit plugin installation grants | integration-service | Implemented on protected main | PR #151; explicit subset, replay/conflict/revocation | -| Durable plugin installation persistence | integration-service | Implemented on active PR | PR #156; installation+workspace+installing-user scoped persistence; no credential/delivery authority | -| Complete plugin secret/outbound delivery runtime | integration-service | Partial | issue #130 | -| Source/live-base/integration verification evidence | repository workflows | Implemented on protected main | PR #154 / ADR 0010; residual central scanner attribution remains #132 | - -## Data-rights status +| OAuth login/callback/session | Identity | Implemented on protected main | Google/GitHub, bounded state/redirect/session/auth-age lifecycle | +| Planning Goal/Project/Task | Planning | Implemented on protected main | signed/request-bound workspace authority through PR #168 and PR #188 | +| Durable Today aggregate | Planning | Implemented on protected main | PR #127; preconditions/idempotency/conflicts | +| Authenticated Today composition | Gateway + Planning + Habit | Implemented on protected main | PR #186 and PR #187; Issue #163 completed | +| Habit recurrence/completion | Habit | Implemented on protected main | signed workspace authority through PR #173 | +| Review completion/projection | Review | Implemented on protected main | request-bound signed authority through PR #185 | +| Integration event context | Integration | Implemented on protected main | exact request binding through PR #190 | +| Calendar sync request | Calendar Integration | Implemented on protected main | PR #139 signed workspace context | +| Calendar connection metadata | Calendar Integration | Implemented on protected main | PR #150 workspace+user scope, opaque secret references | +| Calendar local revocation | Calendar Integration | Implemented on protected main | PR #153 and authenticated disconnect PR #157 | +| Calendar connection read | Calendar Integration | Implemented on protected main | exact lookup PR #176 and authenticated read PR #189 | +| Calendar credential materialization | Calendar Integration | Implemented on protected main | PR #193; validated handles only | +| Calendar connection creation | Calendar Integration | Implemented on protected main | PR #197; authenticated secret-first persistence/compensation | +| Calendar create-evidence compensation hardening | Calendar Integration | Implemented on protected main | PR #201 | +| Complete hosted calendar credential lifecycle | Calendar Integration | Partial | issue #129 | +| Reminder scheduling/delivery | Notification | Implemented on protected main | bounded claims/retries/outcomes | +| AI proposal/evidence/decision | AI Proposal | Implemented on protected main | inert proposal + explicit decision | +| Purpose-bound sensitive access | Privacy | Implemented on protected main | actor/workspace/resource/purpose/lifetime bound | +| Data-rights request ledger/status | Identity | Implemented on protected main | durable request/receipt and bounded non-cacheable projection | +| Tenant export integrity manifest | Identity + contributors | Implemented on protected main | deterministic sections/whole digest | +| Contributor lifecycle v1 | Contracts | Implemented on protected main | PR #159 | +| Planning data-rights contributor | Planning | Implemented on protected main | PR #179 and authenticated transport PR #194 | +| Habit data-rights contributor | Habit | Implemented on protected main | PR #184 and authenticated transport PR #192 | +| Review data-rights contributor | Review | Implemented on active PR | PR #195 | +| Notification data-rights contributor | Notification | Implemented on active PR | PR #198 | +| AI data-rights contributor | AI Proposal | Implemented on active PR | PR #199 | +| Complete cross-domain export/erasure | Identity + every owner | Partial | issue #55 | +| Plugin manifest/event validation | Integration | Implemented on protected main | versioned SDK/validation | +| Plugin installation grants | Integration | Implemented on protected main | PR #151 | +| Durable plugin installation | Integration | Implemented on protected main | PR #169 and exact evidence PR #175 | +| Plugin credential binding | Integration | Implemented on protected main | PR #172; opaque secret reference only | +| Plugin operator request authority | Integration | Implemented on protected main | PR #191 one-time request/replay evidence | +| Plugin operator HTTP composition | Integration | Implemented on protected main | PR #196 fail-closed composition | +| Complete plugin secret/outbound runtime | Integration | Partial | issue #130 | +| Source/live-base/integration verification | Repository workflows | Implemented on protected main | PR #154; residual central taxonomy issue #132 | +| Exact pinned OpenCode bootstrap allowlist | Repository automation | Implemented on protected main | PR #200 | + +## Data-rights contributor v1 + +**Status:** Partial + +PR #159 protects the versioned operation set: + +- `export` returns bounded deterministic service-owned data, schema version, safe record count, and contributor digest evidence; +- `erase_preflight` reports explicit blockers without deleting; +- `erase` binds exact request/workspace/actor/idempotency authority and returns replay-safe owner receipt evidence; +- `verify_erased` proves the owner no longer retains scoped live records or fails closed. + +Planning and Habit are protected participants. Review, Notification, and AI are active-PR participants. The contract does not imply every owner participates or that whole-product reconciliation/delivery is complete. -**Status:** Implemented on protected main - -PR #146 derives workspace/user scope from the server session and exposes only request ID, request kind, lifecycle status and bounded timestamps. Malformed request IDs map to bounded 400, invalid sessions to 401, absent/cross-tenant requests to indistinguishable 404, dependency failures to sanitized 503, and responses are non-cacheable. This does not complete issue #55. +## Calendar connection lifecycle -## Export integrity +### Authority **Status:** Implemented on protected main -PR #149 binds contributor identity, schema version, safe business record count and bounded normalized JSON into deterministic per-section SHA-256 evidence plus an ordered whole-export digest. Locale-independent UTF-16 property ordering is used for digest stability. Digests are integrity evidence, not access control, confidentiality, provenance or digital signatures. +`life-os.calendar-user.v1` binds exact workspace and requesting-user UUIDv4 identities under short-lived HMAC evidence distinct from workspace-only synchronization authority. Stale, future, malformed, substituted, or unconfigured evidence fails closed. -## Calendar connection lifecycle - -### Persistence foundation +### Read, disconnect, materialize, create **Status:** Implemented on protected main -PR #150 persists a LifeOS-owned connection under exact workspace+user scope with bounded provider/account/calendar metadata, normalized scopes, fixed parameterized SQL and opaque secret references. The metadata row is not a credential store. +- PR #157 exposes authenticated local disconnect without reading provider secret handles. +- PR #176 prevents alternate/corrupt persistence adapters from returning a different connection/workspace/user record. +- PR #189 exposes only bounded credential-free active connection state. +- PR #193 materializes plaintext credential data only inside a validated secret-store port boundary. +- PR #197 writes secret material first, persists only opaque handles, validates returned durable authority, and compensates reviewed failure paths. -### Local connection revocation +PR #201 protects reverse-order compensation of all newly materialized handles when returned durable create evidence mismatches exact identity/handles. OAuth/PKCE, concrete KMS, refresh, provider-side cleanup, discovery/selection, and scoped synchronization remain **Partial** under #129. -**Status:** Implemented on protected main +## Plugin installation, credentials, and operator composition -PR #153 adds atomic tenant+user-scoped connection revocation and exact replay behavior. Revoking the LifeOS connection record does not by itself prove provider-side OAuth revocation or secret destruction; those remain issue #129 lifecycle requirements. - -### Hosted user authority +### Installation and credential binding **Status:** Implemented on protected main -PR #155 introduces a short-lived HMAC context that binds both workspace and user UUIDv4 identities under `life-os.calendar-user.v1`, distinct from workspace-only synchronization context. It rejects identifier substitution, stale/future/malformed evidence and unusable verifier configuration. Public connection/disconnect and managed-credential runtime composition remain later #129 slices. +PR #151 treats a manifest as requested intent. PR #169 persists exact bounded installation authority. PR #172 materializes credentials only through `PluginSecretStore` and persists only an opaque reference. PR #175 rejects mismatched returned installation identity. -## Plugin installation authority and persistence +Exact replay cannot rematerialize or overwrite an existing secret. Conflicting durable winners trigger compensation. Revocation ends durable authority before external cleanup and never restores authority during retry. -### Installation grants +### Operator requests **Status:** Implemented on protected main -PR #151 treats a validated manifest as requested intent, not granted authority. The host grants an explicit tenant-scoped capability subset, accepts exact replay, rejects conflicting reuse, hides cross-tenant/user existence and preserves revocation evidence. - -### Durable installation persistence +PR #191 binds installation/workspace/actor, exact method/path, freshness, and one-time evidence to an atomic replay store. PR #196 composes this authority behind a fail-closed HTTP boundary and maps malformed JSON, stale/replayed evidence, absent dependencies, and invalid durable evidence to bounded credential-free problems. -**Status:** Implemented on active PR - -PR #156 persists bounded installation identity, workspace, installing-user, exact manifest/version/digest, granted capabilities and lifecycle evidence in the integration service. Direct reads and revocation operations carry workspace and installing-user authority into fixed parameterized SQL rather than widening by installation ID and filtering afterward. Plaintext plugin credential/KMS material and outbound delivery remain outside this active slice and incomplete under #130. +No operator route grants arbitrary SQL, filesystem, subprocess, tool, or network authority. Outbound delivery remains **Partial** under #130. ## Events -Asynchronous events use an opaque event ID, explicit type/version, validated tenant/actor/correlation/causation context and bounded immutable payload. Consumers are idempotent under replay. Receiving an event never grants producer-database authority. +Asynchronous events use opaque event IDs, explicit type/version, validated workspace/actor/correlation/causation context, bounded immutable payloads, and idempotent consumers. PR #190 binds protected integration event authority to the exact request. Receiving an event never grants producer-database authority. -## Versioning +## Versioning and compatibility -Breaking route/event/schema semantics require explicit versioning or a reviewed migration contract. Unknown versions fail closed. +Breaking route/event/schema semantics require explicit versioning or a reviewed migration contract. Additive optional fields remain bounded and default-safe. Unknown versions fail closed. Migration rollback never fabricates restored external secret/provider state. ## Verification evidence identity **Status:** Implemented on protected main -`source_head_sha`, `pr_base_snapshot_sha`, independently resolved `live_base_tip_sha`, separately classified integration/synthetic tree identity, `workflow_checkout_sha`, protected-main identity and release-source identity are separate authorities. Integration success is not exact contributor-source verification. - -ADR 0010 is the durable decision. PR #154 merged as `2c272a404f8f3a74aa5796a1957d4a6ce0fabe8f`: LifeOS source jobs explicitly bind contributor head, AppGuardrail SARIF binds the analyzed source ref/SHA, and merge compatibility reconstructs the integration tree from fresh current source and live base. Issue #132 remains open only for residual central reusable SAST/Security scanner checkout and attribution classification; their umbrella green status cannot silently promote one evidence identity into another. +`source_head_sha`, `pr_base_snapshot_sha`, `live_base_tip_sha`, integration/synthetic tree identity, `workflow_checkout_sha`, `protected_main_sha`, and `release_source_sha` are separate authorities. PR #154 protects source and live-base compatibility separation. Issue #132 remains **Partial** for central reusable scanner attribution; a synthetic merge scan cannot be called exact-source evidence. diff --git a/docs/DATA_MODEL.md b/docs/DATA_MODEL.md index 8ad0d4212..5bd5c5b7c 100644 --- a/docs/DATA_MODEL.md +++ b/docs/DATA_MODEL.md @@ -2,14 +2,16 @@ **Status:** Implemented on active PR -This document describes service ownership and logical relationships. It does not authorize cross-service SQL joins. Physical schema truth remains in each owning service's migrations. +This document describes logical ownership, cardinality, immutability, and maturity. It never authorizes cross-service SQL. Physical schema truth remains in each owning service's migrations. ## Ownership rules -- Each bounded context owns its schema/database role, migrations and credentials. -- Shared opaque UUIDv4 values are logical references, not permission for direct cross-service table access. +- Every bounded context owns its database schema/role, migrations, repositories, credentials, transaction boundaries, and recovery behavior. +- Shared UUIDv4 values are logical references, not cross-service foreign keys or table access authority. - Product-owned database objects use descriptive multiword `snake_case`. -- Conceptual entities below are labeled when they are not persisted on protected main. +- Provider/plugin identifiers are bounded metadata. Secret references are separate and never become primary identity. +- Browser-local objects are drafts/cache until the owning service accepts them. +- Conceptual or active-PR records are explicitly labeled and are not protected-main persistence claims. ## Logical ERD @@ -30,78 +32,114 @@ erDiagram HABIT_RECORD ||--o{ HABIT_COMPLETION : records WORKSPACE_RECORD ||--o{ REVIEW_RECORD : contains - WORKSPACE_RECORD ||--o{ CALENDAR_CONNECTION : authorizes - USER_ACCOUNT ||--o{ CALENDAR_CONNECTION : owns - CALENDAR_CONNECTION ||--o{ CALENDAR_SYNC_RECORD : tracks - WORKSPACE_RECORD ||--o{ REMINDER_RECORD : contains - REMINDER_RECORD ||--o{ DELIVERY_OUTCOME : records + WORKSPACE_RECORD ||--o{ CALENDAR_CONNECTION_RECORD : authorizes + USER_ACCOUNT ||--o{ CALENDAR_CONNECTION_RECORD : owns + CALENDAR_CONNECTION_RECORD ||--o{ CALENDAR_SYNC_RECORD : tracks - WORKSPACE_RECORD ||--o{ AI_PROPOSAL : contains - AI_PROPOSAL ||--o{ AI_DECISION : decides + WORKSPACE_RECORD ||--o{ REMINDER_OCCURRENCE : contains + REMINDER_OCCURRENCE ||--o{ DELIVERY_OUTCOME : records + + WORKSPACE_RECORD ||--o{ AI_PROPOSAL_RECORD : contains + AI_PROPOSAL_RECORD ||--o{ AI_DECISION_RECORD : decides + + WORKSPACE_RECORD ||--o{ PRIVACY_ACCESS_DECISION : governs + PRIVACY_ACCESS_DECISION ||--o{ PRIVACY_ACCESS_GRANT : issues - WORKSPACE_RECORD ||--o{ PRIVACY_GRANT : authorizes WORKSPACE_RECORD ||--o{ DATA_RIGHTS_REQUEST : owns DATA_RIGHTS_REQUEST ||--o{ DATA_RIGHTS_RECEIPT : terminates - WORKSPACE_RECORD ||--o{ PLUGIN_INSTALLATION : grants - USER_ACCOUNT ||--o{ PLUGIN_INSTALLATION : installs - PLUGIN_INSTALLATION ||--o{ PLUGIN_DELIVERY : attempts + WORKSPACE_RECORD ||--o{ PLUGIN_INSTALLATION_RECORD : grants + USER_ACCOUNT ||--o{ PLUGIN_INSTALLATION_RECORD : installs + PLUGIN_INSTALLATION_RECORD ||--o{ PLUGIN_CREDENTIAL_BINDING_RECORD : binds ``` -Logical USER_ACCOUNT relationships to calendar/plugin records represent authority/ownership identifiers, not cross-service foreign keys or direct SQL access. +Relationships from `USER_ACCOUNT` to Calendar/Plugin records express logical ownership identifiers only. They do not imply cross-schema foreign keys. -## Persisted protected-main ownership +## Protected-main persistence ### Identity -Identity owns users, external identity mapping, browser sessions, workspace membership/authorization, authentication provenance, durable `data_rights_request`/terminal receipt evidence, authenticated request-status lookup and export-integrity composition. Authentication time remains distinct from session rotation. +Identity owns users, provider mappings, sessions, workspace membership, authentication provenance, `data_rights_request`, immutable terminal receipt evidence, tenant/requesting-user scoped status lookup, and aggregate export-integrity manifests. + +Authentication instant and session rotation instant are distinct. Request, idempotency, receipt, and digest evidence are immutable once terminal. ### Planning -Planning owns Goals, Projects, Tasks and the durable Today aggregate/action/revision/idempotency model introduced by PR #127. Review/search projections do not gain Planning mutation authority. +Planning owns Goal, Project, Task, search, Today aggregate/action/revision/idempotency state, and its service-owned data-rights erasure receipt. PR #179 protects the contributor; PR #194 protects request-bound authenticated contributor transport. + +### Habit + +Habit owns recurrence/completion evidence and its service-owned data-rights erasure/replay evidence. PR #184 protects the contributor; PR #192 protects the authenticated one-time transport/replay boundary. + +### Review + +Review owns guided-review completion/projection records. Request-bound workspace authority is protected through PR #185. -### Habit / Review / Notification / AI / Privacy +The Review data-rights erasure receipt migration and contributor are **Implemented on active PR** in PR #195. They are not protected-main persistence until integration. -Habit owns recurrence/completion evidence; Review owns guided review snapshots/projections; Notification owns reminder occurrence/claim/delivery evidence; AI owns proposal/evidence/decision persistence; Privacy owns purpose-bound access decisions, grants and audit events. Logical cross-service references never authorize cross-schema SQL. +### Notification -### Calendar integration +Notification owns reminder occurrences, expiring claims, delivery attempts/outcomes, and inbox evidence. Its data-rights erasure migration/receipt/contributor are **Implemented on active PR** in PR #198. + +### AI Proposal + +AI owns immutable proposal/evidence rows and append-only accept/reject decisions. Its data-rights erasure migration/receipt/contributor and cursor-capable export contract changes are **Implemented on active PR** in PR #199. + +### Privacy + +Privacy owns purpose-bound access decisions, grants, consumption/fencing, and audit events. Whole-right request identity remains Identity-owned; Privacy retains authority over its own eventual contributor. + +### Calendar Integration **Status:** Implemented on protected main -PR #150 added the service-owned `calendar_integration.calendar_connection_record` persistence foundation scoped simultaneously to workspace and user. The row stores bounded provider/account/calendar metadata, normalized scopes and opaque credential references rather than plaintext provider credentials. PR #153 added atomic tenant+user-scoped revocation and durable revoked-state/replay semantics. PR #155 added signed workspace+user request authority without introducing additional persistence. +`calendar_integration.calendar_connection_record` is scoped simultaneously to opaque connection, workspace, and user UUIDv4 identities. It stores bounded provider/account/calendar metadata, normalized scopes, lifecycle timestamps, and opaque access/refresh secret references—not plaintext provider credentials. -The complete hosted OAuth/managed-secret/refresh/provider-revocation/discovery/selection lifecycle remains **Partial** under #129. +Protected-main lifecycle evidence: -### Plugin integration +- PR #150 creates the owning record; +- PR #153 adds atomic active-to-revoked transition and replay; +- PR #176 validates returned lookup identity exactly; +- PR #189 exposes a credential-free authenticated read projection; +- PR #193 materializes secrets only through validated opaque handles; +- PR #197 composes authenticated secret-first creation and compensation boundaries; +- PR #201 compensates both newly written handles when persistence returns mismatched durable evidence. -Protected main through PR #151 owns the application-level plugin installation/grant authority: validated manifest intent is separated from explicit host-granted capability subsets, exact replay/conflict semantics are deterministic, cross-tenant/user existence is hidden, and revocation ends active authority while preserving bounded evidence. +Concrete provider/KMS/OAuth state is not invented here and remains **Partial** under #129. -#### Durable plugin installation record +### Plugin Integration -**Status:** Implemented on active PR +**Status:** Implemented on protected main -PR #156 adds the first owning integration-service migration/repository for `plugin_integration.plugin_installation_record`. Its durable logical fields include: +`plugin_integration.plugin_installation_record` is protected through PR #169 and retains opaque installation/workspace/installer UUIDv4 identities, bounded plugin/version metadata, exact manifest SHA-256 evidence, normalized explicit grants, lifecycle status, and timestamps. PR #175 requires exact opaque installation identity at application and repository boundaries. -- `installation_id` — opaque UUIDv4 primary installation identity; -- `workspace_id` — authenticated tenant authority; -- `installed_by_user_id` — installing/requesting user authority; -- `plugin_id` and `plugin_contract_version` — bounded plugin metadata; -- `manifest_sha256` — exact validated manifest integrity evidence; -- `granted_capabilities` — explicit bounded host-granted capability set; -- `installation_status`, `installed_at`, `revoked_at` — lifecycle evidence. +`plugin_integration.plugin_credential_binding_record` is protected through PR #172. It retains only bounded opaque `secret_reference` metadata and binding lifecycle evidence; plaintext credential material remains behind the `PluginSecretStore` port. -Application and repository lookup/revocation paths carry installation + workspace + installing-user authority to the fixed parameterized SQL boundary. Plaintext plugin credentials are not part of this record. The record is not evidence that outbound delivery or a managed secret/KMS lifecycle exists. +Operator request replay evidence is protected through PR #191 and consumed by the fail-closed HTTP composition from PR #196. Delivery attempt/outcome tables are not claimed because the complete runtime is **Partial** under #130. -Persisted plugin-secret records and `plugin_delivery` attempts therefore remain **Planned/Partial** under #130. The ERD shows those intended relationships as logical targets, not protected-main physical tables. +## Data-rights participant model -## Data-rights lifecycle +| Participant | Persistence owner | Status | Evidence | +| --- | --- | --- | --- | +| Identity coordinator/ledger | Identity | Implemented on protected main | durable request/terminal receipt and status | +| Planning contributor/receipt | Planning | Implemented on protected main | PR #179 and PR #194 | +| Habit contributor/receipt | Habit | Implemented on protected main | PR #184 and PR #192 | +| Review contributor/receipt | Review | Implemented on active PR | PR #195 | +| Notification contributor/receipt | Notification | Implemented on active PR | PR #198 | +| AI contributor/receipt | AI Proposal | Implemented on active PR | PR #199 | +| Remaining owning domains and whole-product reconciliation | Each owner + Identity coordinator | Partial | issue #55 | -Protected main includes recent-authentication provenance, durable requests/immutable terminal receipts, tenant+actor scoped status lookup, authenticated non-cacheable status projection (#146), and per-section export integrity evidence (#149). Whole-product contributor orchestration, reconciliation, protected delivery, retention/legal-hold/backup-expiry and terminal completion remain **Partial** under #55. +No participant row grants Identity direct access to another service's tables. Whole-product completion requires an explicit participant registry and reconciled exact request evidence. -## Temporal / provenance rules +## Cardinality and immutability -Use UTC instants plus explicit IANA timezone/local-calendar fields where civil-time behavior matters. Current migrations may retain creation/update/completion/revocation/expiry/revision/idempotency/digest evidence. Do not add fields solely to satisfy a diagram. +- One workspace may contain many planning, habit, review, reminder, proposal, calendar, privacy, and plugin records. +- One Calendar connection belongs to exactly one workspace and one user authority scope. +- One Plugin installation belongs to exactly one workspace and one installing user and may have bounded credential bindings. +- One data-rights request has zero or more contributor sections/receipts and at most one immutable terminal aggregate receipt. +- Proposal decisions, delivery outcomes, terminal data-rights receipts, and immutable audit evidence are append-only or mutation-denying by owning-service contract. +- Mutable lifecycle rows expose explicit state/version/timestamps and deterministic replay/conflict semantics. -## Cross-service relationships +## Temporal and provenance rules -Every cross-service relationship is resolved through a versioned HTTP/event/saga/plugin contract. No foreign key or shared table is implied across bounded service ownership. +Use UTC instants plus explicit IANA timezone/local-calendar fields where civil-time semantics matter. Creation, update, completion, revocation, expiry, revision, idempotency, fencing, digest, and provenance fields exist only when supported by owning migrations. Diagrams never authorize new columns. diff --git a/docs/DOCUMENTATION_ASSESSMENT.md b/docs/DOCUMENTATION_ASSESSMENT.md index a6ae6910b..2f7a59640 100644 --- a/docs/DOCUMENTATION_ASSESSMENT.md +++ b/docs/DOCUMENTATION_ASSESSMENT.md @@ -1,83 +1,97 @@ -# LifeOS Documentation Fitness Assessment +# LifeOS Documentation Assessment **Status:** Implemented on active PR -## Verdict - -Historical LifeOS material was extensive but not sufficient as one code-current whole-product authority. The project moved through materially different product models: browser-only/login-free local-first, public multi-user server persistence, a single-Docker direction, and finally domain-oriented modular MSA. Protected-main implementation also continued after the first canonical docs branch diverged. - -PR #145 remains the single canonical successor. Its family coverage is **design-sufficient in scope** when its exact-head semantic documentation contracts are green: PRD, TRD, root Architecture, ADR 0001-0012, logical ERD/Data Model, UML, API/event contracts, Security, Threat Model, Privacy/Data Lifecycle, Test Strategy, Operability, Release/Migration/Rollback, Standards/Research and Requirements Traceability exist with machine-checkable consistency rules. Repository-wide test-time-compute/model-assisted-development authority is represented by ADR 0012, canonical Fugu/Conductor/TRINITY/strong-single-agent/NVIDIA research traceability, and a UML authority flow that keeps model execution separate from deterministic review/merge/release authority. - -The repository remains **protected-main documentation insufficient** until this canonical successor is reconciled to current protected main, passes exact-head CI/security/review/documentation contracts, and integrates. Documentation sufficiency is never product or release completion. - -## Fitness matrix - -| Family | Assessment on #145 | Maturity | Notes | +## Assessment rule + +File presence, age, old review resolution, PR-body prose, and predecessor checks do not prove semantic fitness. Protected-main source/migrations/tests and live repository policy are authoritative. Active-PR behavior is labeled and remains non-shipped until integration. + +This assessment intentionally avoids embedding volatile head SHAs. Exact heads, live base, workflow checkout identities, reviews, and writer state must be refetched for every merge or mutation decision. + +## Canonical graph fitness + +| Dimension | Status | Evidence and remaining condition | +| --- | --- | --- | +| Product definition and supersession chain | Implemented on active PR | PRD/Architecture preserve server-backed modular MSA + UUIDv4 and explicit offline/draft/Compose profiles | +| Technical boundaries | Implemented on active PR | TRD aligns service ownership, signed authority, concurrency, and active contributor work | +| Root Architecture | Implemented on active PR | current through protected PR #201 | +| ADR index/details | Implemented on active PR | ADR 0001-0012 indexed with decision/recovery/security/acceptance/rollback/supersession sections | +| UML/C4/sequence/state/deployment/authority/recovery | Implemented on active PR | current protected and active boundaries are visually separated | +| Logical ERD/Data Model | Implemented on active PR | protected persistence vs active migrations vs incomplete conceptual delivery are explicit | +| API/event/schema/version contracts | Implemented on active PR | current Calendar, contributor, Plugin operator, and evidence-identity lines are reconciled | +| Security and Threat Model | Implemented on active PR | current request-binding, secret compensation, contributor omission, SSRF, model, and supply-chain threats are explicit | +| Privacy/Data Lifecycle | Implemented on active PR | protected/active contributors and remaining #55/#129/#130 obligations are separated | +| Test Strategy | Implemented on active PR | realistic PostgreSQL/browser/security/coverage/documentation contracts remain canonical | +| Operability/incident/recovery | Implemented on active PR | service-owned recovery and fail-closed degraded behavior remain canonical | +| Release/Migration/Rollback/provenance | Implemented on active PR | exact integrated protected source remains the only release authority | +| Standards/Research | Implemented on active PR | final standards and publication-status-aware APA 7 model-orchestration evidence remain linked | +| Traceability | Implemented on active PR | protected chronology, active PRs, parent gaps, and evidence hierarchy are current | +| README discoverability | Implemented on active PR | canonical files remain linked; integration is still required | +| Protected `AGENTS.md` authority | Implemented on protected main | live single-maintainer approval policy, writer lease, model credential, and exact-evidence rules | +| CLAUDE discoverability | Implemented on active PR | points contributors to protected authority and canonical graph | +| CHANGELOG product/governance history | Implemented on active PR | protected product entries and the ADR 0012 governance entry are preserved without inventing product behavior | +| Executable documentation contracts | Implemented on active PR | semantic tests reject stale active-PR labels and require protected/active/current gap distinctions | + +## Protected-main reconciliation + +The prior canonical branch snapshot stopped near PR #155 and therefore mislabeled several integrated capabilities as active or absent. This successor now represents these protected changes: + +- PR #157 authenticated Calendar disconnect; +- PR #159 versioned service-owned data-rights contributor lifecycle; +- PR #168 and PR #188 signed/request-bound Planning authority; +- PR #169, PR #172, and PR #175 durable plugin installation, opaque credential binding, and exact installation evidence; +- PR #173 signed Habit authority; +- PR #176 and PR #189 exact Calendar lookup and authenticated read; +- PR #179 and PR #194 Planning contributor and authenticated transport; +- PR #184 and PR #192 Habit contributor and authenticated replay-safe transport; +- PR #185 request-bound Review authority; +- PR #186 and PR #187 real authenticated Planning/Habit Today composition; +- PR #190 request-bound integration event authority; +- PR #191 and PR #196 one-time plugin operator authority and fail-closed HTTP composition; +- PR #193 scoped Calendar credential materialization port; +- PR #197 authenticated Calendar connection creation; +- PR #201 returned-create-evidence validation and reverse-order secret compensation. + +Issue #163 is completed. PR #164 remains the historical fake-success removal, while PR #186 and PR #187 are the protected real-composition completion evidence. + +PR #156, PR #160, PR #162, PR #165, PR #175, PR #176, PR #178, and PR #179 must not be described as current active PRs. Their relevant work is integrated, superseded, or historically replaced by the protected lines above. + +## Current active pull-request line + +| Pull request | Status | Documentation meaning | Current gate caveat | | --- | --- | --- | --- | -| PRD | Present-stale | Implemented on active PR | family coverage is complete, but protected #168/#169/#170/#172/#173 and active #175/#176/#178/#179 require semantic reconciliation | -| TRD | Present-stale | Implemented on active PR | runtime, authority, data, API/event, concurrency, AI/security/ops/release and evidence-identity contracts exist; latest protected integration state must be folded in | -| Root Architecture | Present-stale | Implemented on active PR | bounded-context and authority spine exists, but latest Planning/Habit/plugin-credential protected behavior is newer than the current canonical snapshot | -| ADR index / decisions | Present-current | Implemented on active PR | ADR 0001-0012 cover identifiers, persistence, AI, privacy, maintenance, documentation, maturity, hosting, evidence identity, integration authority and test-time compute/model-development authority | -| Logical ERD / Data Model | Present-stale | Implemented on active PR | protected plugin installation persistence and credential-reference metadata now supersede the earlier active-PR-only representation; active #175/#176 remain non-shipped evidence and Draft #179 must not invent Planning rights persistence before implementation | -| UML | Present-stale | Implemented on active PR | topology, login, Today/review, calendar, AI, model-governance, rights, plugin, verification, deployment and degraded modes exist; latest signed-authority rollouts require reconciliation | -| API/event contracts | Present-stale | Implemented on active PR | latest Planning/Habit signed workspace authority and plugin credential-reference boundaries are protected-main behavior; Review #178 and Draft Planning data-rights composition #179 remain active/non-shipped | -| Security | Present-current | Implemented on protected main | root `SECURITY.md` remains vulnerability-reporting authority; service-specific trust boundaries are tracked in architecture/research/test evidence | -| Threat model | Present-stale | Implemented on active PR | trust-boundary coverage exists but current protected signed-workspace and plugin-secret-reference evolution must be reflected | -| Privacy/Data Lifecycle | Present-stale | Implemented on active PR | purpose-bound rights and secret-reference boundaries exist; protected `life-os.data-rights-contributor.v1` plus Draft #179 Planning composition and incomplete hosted runtimes require explicit maturity separation | -| Test Strategy | Present-current | Implemented on active PR | realistic PostgreSQL/browser/security/concurrency/evidence policy remains current as a repository-wide contract | -| Operability | Present-current | Implemented on active PR | deployment/readiness/observability/failure/backup/recovery boundaries remain current at repository level | -| Release/Migration/Rollback | Present-current | Implemented on active PR | one exact integrated release-source contract and fail-closed migration/rollback discipline remain current | -| Standards/Research | Present-current | Implemented on active PR | final-vs-draft discipline, APA 7 anchors and repository-wide model-orchestration evidence/counterevidence are present | -| Requirements Traceability | Present-stale | Implemented on active PR | requirement/decision-to-source/test/issue/PR mapping exists but must absorb protected #168/#169/#170/#172/#173 and active #175/#176/#178/#179 | -| AGENTS authority | Present-current | Implemented on protected main | protected main carries work-conserving maintenance, NVIDIA/no-Copilot, exact-evidence, service ownership and review/merge authority rules | -| CHANGELOG behavior history | Present-current | Implemented on protected main | protected feature/security changes continue to update the Unreleased history independently of canonical docs integration | -| README/CLAUDE canonical discoverability | Present-current on successor | Implemented on active PR | discoverability becomes protected-main authority only after #145 integration | -| Machine-checkable documentation consistency | Present-current | Implemented on active PR | required files/links, maturity vocabulary, ADR 0001-0012, evidence identity, model authority and stale-product semantics are gated | - -## Historical drift reconciled - -1. **Private/login-free local-first -> public multi-user server-backed/self-hostable.** Browser-local state is explicit draft/cache/offline state. -2. **Single Docker application -> modular MSA.** Compose remains a profile, not authority collapse. -3. **UUIDv7 -> UUIDv4.** Internal product IDs are opaque UUIDv4. -4. **Old post-MVP labels -> evidence maturity.** Protected source/tests outrank roadmap prose. -5. **Capability maturity -> buyer-gap exhaustion.** These are independent evidence dimensions. -6. **Generic green status -> explicit evidence identity.** ADR 0010 separates source head, PR-base snapshot, live base, integration/synthetic tree, workflow checkout, protected main and release source. -7. **External integration metadata -> ambient authority.** ADR 0011 separates LifeOS identity, provider/plugin metadata, secret references and explicit capability grants. -8. **More agents -> assumed better output.** ADR 0012 requires a strong single-route baseline and measured stage/decomposition/recursion/role-effort/access-topology evidence under documented budgets before deeper orchestration is selected. -9. **Development model -> repository authority.** ADR 0012 and protected `AGENTS.md` keep NVIDIA/OpenCode model execution independent from deterministic CI/security, formal review, merge and release authority. - -## Protected-main evolution represented or requiring current reconciliation - -Protected main includes durable Today (#127), trusted calendar workspace context (#139), recent-auth/data-rights prerequisites (#134/#136/#137), durable rights ledger (#138), tenant+actor status lookup (#144), authenticated public rights status (#146), export integrity evidence (#149), workspace+user calendar connection persistence (#150), explicit plugin installation grants (#151), migration-fixture reliability repair (#152), atomic calendar connection revocation (#153), exact-source/current-live-base/integration verification hardening (#154), signed calendar workspace+user authority (#155), protected versioned data-rights contributor contract (#159), signed Planning workspace authority (#168), durable plugin installation persistence (#169), isolated data-rights ledger test ownership (#170), opaque plugin credential-reference persistence (#172), and signed Habit workspace authority (#173). - -The old documentation PR #126, old verification PR #147, superseded plugin installation line #156, and superseded Review line #165 are historical evidence only. Their reviews/checks never substitute for current protected-main or current-head evidence. - -## Current active work represented without promotion - -- **PR #175 — plugin installation evidence identity:** `Implemented on active PR`. Application-level install/replay and lookup must reject durable evidence for a different opaque installation identifier. -- **PR #176 — calendar connection lookup evidence identity:** `Implemented on active PR`. Calendar persistence must reject returned durable rows whose connection/workspace/user identity differs from exact lookup authority. -- **PR #178 — Review signed workspace authority current-main successor:** `Implemented on active PR`. It preserves #165's five Review semantic paths on current protected-main ancestry after the old branch acquired unusable control-plane state. It is not protected-main truth until its exact current head passes and integrates. -- **PR #179 — Planning data-rights contributor v1:** `Implemented on active PR` only for the currently committed test-side composition contract. The Draft deliberately begins with a RED runtime requirement; no Planning export/erase/verify production capability may be described as implemented until test-first production work lands and passes. - -These active PRs are verification/security/privacy work, not evidence that the parent hosted-runtime or whole-right gaps are complete. - -## Verification-governance residual +| PR #145 | Implemented on active PR | single canonical whole-product documentation successor | Draft; exact-head CI/security/review and live-base validation required | +| PR #195 | Implemented on active PR | Review-owned contributor migration/application/runtime/tests | Draft; exact-head integration/coverage/security/review required | +| PR #198 | Implemented on active PR | Notification-owned contributor migration/application/runtime/tests | branch is independently active; refetch exact head and reject temporary writer machinery before merge | +| PR #199 | Implemented on active PR | AI-owned contributor plus additive cursor contract | branch is independently active; exact-head gates/reviews required | +| PR #200 | Implemented on protected main | narrow exact-pinned OpenCode lifecycle-script allowlist repair | fresh protected scheduled bootstrap remains acceptance evidence | -PR #154 is **Implemented on protected main**. LifeOS-owned source verification, AppGuardrail attribution and current-live-base integration compatibility are separated by explicit evidence identity. Issue #132 remains open only for residual central reusable scanner taxonomy: central SAST/Security jobs must expose the actual tree they inspected so synthetic/integration evidence is not promoted to exact-source evidence. +Active work may change while this document is reviewed. The table records bounded semantic scope, not merge eligibility, current head identity, or gate success. -## Remaining product gaps +## Open issue and buyer-gap fitness -- **Partial:** #55 complete export/deletion orchestration. Protected main has the generic contributor contract from #159 plus public status/export-integrity and ledger foundations; Draft #179 starts the first concrete Planning contributor and is not shipped behavior. -- **Partial:** #129 complete hosted per-user calendar credential lifecycle, despite protected calendar connection/revocation/signed user authority and active #176 evidence hardening. -- **Partial:** #130 complete plugin runtime delivery, despite protected grant authority, durable installation persistence, opaque credential-reference persistence and active #175 evidence hardening. Secret materialization/KMS implementation, outbound SSRF-safe delivery, retry/dead-letter/runtime composition and operator surfaces remain separate work. -- **Residual governance gap:** #132 central scanner checkout/attribution taxonomy after protected #154. +| Issue | Status | Current meaning | +| --- | --- | --- | +| #21 | Partial | umbrella commercial readiness; capability maturity does not close buyer gaps | +| #55 | Partial | complete participant inventory, remaining contributors, reconciliation, retention/legal hold, backup expiry, protected export delivery, and terminal whole-right evidence | +| #129 | Partial | concrete KMS/OAuth/refresh/provider cleanup/discovery/selection/scoped sync lifecycle | +| #130 | Partial | concrete plugin KMS, host-authorized outbound delivery, SSRF/rebinding controls, outcomes, retry/dead-letter, and operator recovery | +| Issue #132 | Partial | residual central reusable scanner checkout/SARIF/status attribution taxonomy | +| #148 | Partial | closes only when this exact canonical successor integrates and currentness evidence remains green | -## Sufficiency criteria +Canonical buyer-visible gaps are #55, #129, and #130. Issue #132 is verification governance. Issue #148 is documentation integration work. Neither should be silently counted as a buyer-visible product capability gap. -The documentation line is design-sufficient only when canonical families are discoverable, statuses use exact vocabulary, ADR targets/sections are valid, diagrams are balanced, root Architecture matches protected service authority, active behavior is not called shipped, requirements/gaps map to executable evidence, model-development authority and its counterevidence are canonical, and semantic-regression tests fail when currentness drifts. +## Semantic checks performed by this successor -The repository is protected-main documentation sufficient only after PR #145 is reconciled to a freshly resolved live base, passes current exact-head CI/security/review/documentation contracts, and integrates without regressing current source/policy. +- Protected-main capability chronology is reflected across PRD, TRD, Architecture, Data Model, UML, API, Threat Model, Privacy, and Traceability. +- Active PR #195, PR #198, and PR #199 are labeled `Implemented on active PR`, not shipped; PR #200 and PR #201 are protected. +- Parent issues remain `Partial` despite protected foundations and active slices. +- No cross-service persistence, provider revoke, KMS adapter, plugin delivery table, or whole-right completion is invented. +- The closed Today truthfulness issue is not kept open in canonical buyer-gap state. +- Exact source/live-base/integration/checkout/protected/release evidence identities remain separate. +- Model-assisted work cannot self-authorize review, merge, or release. +- Documentation contract tests fail when merged predecessor work reappears as active or current active work disappears from assessment. -## Continuation rule +## Remaining integration conditions -Documentation completion is a governance gate only. While #145 is stale, conflicted, checking, or awaiting integration, the autonomous queue continues current security/reliability PRs and the remaining #55/#129/#130/#132 work plus newly discovered buyer/security/reliability/operability gaps. A green documentation pack is not a product-completion or run-termination condition. +PR #145 remains documentation-incomplete until its unchanged exact head passes required CI, AppGuardrail, SAST Semgrep, Security Scan, Commercial Readiness, current review findings, and live-base compatibility, then integrates under live policy. Integration of this line does not complete LifeOS: maintenance immediately returns to product/security/reliability work and the buyer gaps #55/#129/#130. diff --git a/docs/OPERABILITY.md b/docs/OPERABILITY.md index 24efb0aa3..45184c908 100644 --- a/docs/OPERABILITY.md +++ b/docs/OPERABILITY.md @@ -1,4 +1,4 @@ -# LifeOS Operability +# LifeOS Operability, Incident, and Recovery **Status:** Implemented on active PR @@ -8,65 +8,107 @@ **Status:** Implemented on protected main -Docker Compose composes independent LifeOS workloads with operator-owned PostgreSQL, NATS, secrets and provider configuration. Compose is a deployment profile, not a shared-service authority model. +Docker Compose composes independent LifeOS workloads with operator-owned PostgreSQL, NATS, secrets, and provider configuration. Compose is a deployment profile, not shared persistence or credential authority. ### Kubernetes reference **Status:** Implemented on protected main -The repository provides provider-neutral Kubernetes/Kustomize reference artifacts with restricted defaults. Operators remain responsible for cluster provisioning, TLS/DNS/ingress, managed PostgreSQL/NATS, registry, secret management, backup storage and environment-specific network policy. +Kubernetes/Kustomize artifacts are provider-neutral restricted references. Operators own cluster provisioning, TLS/DNS/ingress, managed PostgreSQL/NATS, registry, KMS/secret stores, backup storage, network policy, egress controls, identity/provider configuration, and monitoring. + +## Runtime ownership and shutdown + +Each service owns process configuration, database pool, migrations, provider clients, health/readiness, metrics/logs, graceful shutdown, and retry/recovery. Shared process composition cannot create cross-service table authority. + +Shutdown must: + +1. reject new work where required; +2. stop/await workers and in-flight bounded operations; +3. release claims/leases according to owner semantics; +4. close provider clients and database pools exactly once; +5. emit bounded credential-free terminal evidence. ## Liveness and readiness -Liveness reports process/runtime health. Readiness must fail when a service cannot safely serve its contracted workload. Dependency-specific readiness must not be collapsed into generic process health. Metrics/readiness endpoints remain bounded and operator-facing. +Liveness reports process/runtime viability. Readiness fails when a service cannot safely serve the contracted workload. Dependency-specific readiness must not be collapsed into generic process health. + +Optional provider outage may yield explicit degraded behavior where unrelated domains remain safe. Owning persistence, signing authority, replay store, or required KMS absence must fail the affected durable/secret operation closed. ## Observability -- structured credential-free logs; -- correlation/evidence IDs where implemented; -- bounded Prometheus-compatible metrics; -- no raw prompts/responses, bearer credentials, cookies or unbounded tenant text in retained operational evidence; -- provider failures classified without replaying upstream bodies. +- structured bounded credential-free logs; +- correlation, request, idempotency, fencing, and evidence IDs where implemented; +- bounded operator-only metrics; +- no cookies, bearer credentials, secret handles, plaintext credentials, raw prompts/responses, hidden reasoning, provider bodies, or unbounded tenant content; +- explicit failure class and dependency boundary without reflecting attacker-controlled identifiers; +- exact source/integration/release identities on retained CI/provenance evidence. + +## Protected operational boundaries + +- PR #186 and PR #187 provide real authenticated Today composition; Issue #163 is completed. +- PR #157, PR #176, PR #189, PR #193, and PR #197 provide Calendar disconnect, lookup validation, read, materialization port, and secret-first creation. +- PR #179/PR #194 and PR #184/PR #192 provide protected Planning/Habit data-rights participant and transport evidence. +- PR #169, PR #172, PR #175, PR #191, and PR #196 provide durable Plugin installation/credential/operator boundaries. + +These boundaries have owner-specific degraded and replay semantics and do not close #55/#129/#130. ## Failure semantics -- malformed authority/signatures/UUIDs fail closed; -- service database outage cannot return durable-success claims; -- provider outage degrades only the affected integration where possible; -- stale concurrent writes return explicit conflict rather than silently overwriting; -- retryable workers use bounded retries/claims and preserve replay identity; -- unknown data-rights participant state cannot become completed deletion/export. +- malformed ownership, UUIDs, signatures, issuance, one-time evidence, cursors, digests, and persisted rows fail closed; +- database outage cannot return durable-success claims; +- provider/KMS outage never falls back to plaintext or process-global caller-visible credentials; +- stale concurrent writes return explicit conflict rather than overwrite; +- workers use bounded retries/claims/backoff and retain exact replay identity; +- unknown data-rights participant state cannot become terminal completion; +- local revoke never becomes provider revoke success without proof; +- external cleanup retry never restores revoked LifeOS authority; +- plugin/operator authority never becomes arbitrary egress/tool/process/filesystem authority; +- queued, stale, predecessor, or synthetic-only checks never become release evidence. + +## Incident priorities + +1. preserve tenant isolation, credentials, and authority boundaries; +2. prevent false durable-success, deletion, delivery, or provider-revocation claims; +3. stop unsafe writes, secret materialization, workers, or outbound behavior; +4. retain bounded evidence needed for diagnosis and replay; +5. restore through documented rollback, forward-fix, compensation, restore, or retry; +6. reconcile partial workflows idempotently without restoring revoked authority; +7. revalidate readiness and exact protected/release identity before resuming normal operation. ## Backup and restore **Status:** Implemented on protected main -Logical PostgreSQL backup produces integrity evidence. Restore validates artifact integrity and refuses unsafe non-empty targets. This does not claim point-in-time recovery; WAL/archive/replication are operator-owned until explicitly implemented and measured. +Logical PostgreSQL backup produces integrity evidence. Restore validates artifacts and refuses unsafe non-empty targets. This does not claim PITR; WAL/archive/replication and managed backup scheduling are operator-owned until implemented and measured. -## Migration and rollback +Backups preserve owning-service boundaries. A restored data-rights or credential record must still satisfy current schema, tenant, immutability, expiry/revocation, and secret-reference validation. Backup expiry remains explicit in whole-right deletion claims. -Schema changes require compatibility analysis, executable migration evidence and a rollback or forward-fix strategy appropriate to risk. Application rollback must not claim that already-completed irreversible database or external-provider changes are automatically reverted. +## Migration and rollback -## Incident priorities +Migrations require compatibility analysis, executable migration evidence, and rollback or forward-fix appropriate to risk. Rollback never claims to undo already committed destructive erasure, external provider revocation, delivered notification/calendar mutation, or secret-store write/delete unless a tested compensation contract exists. -1. preserve tenant isolation and credentials; -2. prevent false durable-success/data-loss claims; -3. stop unsafe writes/delivery; -4. retain bounded evidence needed for diagnosis; -5. restore service through documented rollback/forward-fix/replay procedures; -6. reconcile delayed background work idempotently. +Active PR #195, PR #198, and PR #199 introduce owner migrations and must prove restart, privilege, replay, and rollback/forward-fix semantics before integration. Protected PR #201 keeps compensation uncertainty fail-closed. Protected PR #200 narrows lifecycle authorization to the exact pinned OpenCode bootstrap; a fresh scheduled run remains operational acceptance evidence. ## Current operational gaps -- complete data-rights orchestration/reconciliation, retention and protected delivery: **Partial**, issue #55; -- per-user hosted calendar credential lifecycle: **Partial**, issue #129; -- plugin runtime delivery/secrets/revocation: **Planned**, issue #130; -- repository-wide exact contributor-head verification attribution: **Planned**, issue #132. +| Gap | Status | Remaining operational evidence | +| --- | --- | --- | +| Complete data-rights participant/reconciliation/retention/protected delivery | Partial | issue #55 | +| Complete per-user Calendar KMS/OAuth/refresh/provider cleanup/discovery/scoped sync | Partial | issue #129 | +| Complete Plugin KMS/authorized egress/outcomes/retry/dead-letter/operator recovery | Partial | issue #130 | +| Central reusable scanner checkout/SARIF/status identity taxonomy | Partial | issue #132 | +| Fixed public SLO/RPO/RTO commitments | Out of scope | unavailable without measured deployment-specific evidence | + +## Runbooks and recovery drills + +Required drills include database outage/restore, migration failure, stale-write conflict, worker replay, NATS outage, provider timeout, KMS create/delete partial failure, Calendar create compensation, data-rights stuck participant, plugin secret cleanup, and release rollback/provenance mismatch. + +Runbooks must identify owner, trigger, exact affected authority/evidence identity, safe-stop behavior, smallest recovery action, rollback/forward-fix/compensation limits, and acceptance evidence. ## SLO discipline -LifeOS does not publish fixed availability/RPO/RTO values without measured deployment-specific evidence. Runbooks may define profile-specific targets only when monitoring and recovery exercises support them. +LifeOS publishes no fixed availability, RPO, or RTO without measured profile-specific evidence. Operator runbooks may define targets only when monitoring and repeated recovery exercises support them. ## Release operations -A release is an exact protected integrated revision plus its CI/security/review/coverage/package/SBOM/provenance/migration/recovery/accessibility/operational evidence. A merged feature, generated documentation pack or 100% configured readiness score alone is not a release. \ No newline at end of file +A release is one exact protected integrated revision plus required CI/security/review/coverage/docstrings, package/container, SBOM/provenance/reproducibility, migration/rollback, backup/restore, accessibility/localization, and operational evidence. A merged feature, generated documentation pack, model score, or configured maturity percentage is not release readiness. diff --git a/docs/PRD.md b/docs/PRD.md index 74e64f301..dec8b803d 100644 --- a/docs/PRD.md +++ b/docs/PRD.md @@ -2,84 +2,94 @@ **Status:** Implemented on active PR -This document is the canonical product-level requirements index for LifeOS. Protected-main code, migrations, tests, and current GitHub policy are authoritative for shipped behavior. +Protected-main code, migrations, tests, and live GitHub policy are authoritative for shipped behavior. This PRD is the canonical product-level index; active pull requests are labeled and never promoted to protected truth. ## Product definition -LifeOS is a privacy-first, multi-user, server-backed and self-hostable personal operating system that connects Goals, Projects, Tasks, Habits, Today planning, review, calendar/reminders, auditable AI assistance, privacy/data-rights controls, and operator recovery into one user-authoritative workflow. +LifeOS is a privacy-first, multi-user, server-backed, self-hostable personal operating system connecting Goals, Projects, Tasks, Habits, Today planning, Review, Calendar, reminders, auditable AI proposals, privacy/data-rights controls, plugins, and operator recovery in one user-authoritative workflow. -## Historical decisions +## Superseded product assumptions -- **Superseded:** login-free browser-only/local-first storage as the primary architecture. Browser-local state remains valid only for explicit drafts/cache/offline UX. -- **Superseded:** a single Docker application as the durable product architecture. Docker Compose remains a deployment profile; domain services keep independent authority. -- **Superseded:** UUIDv7 internal identifiers. Protected main uses opaque UUIDv4 internal identifiers. - -## Status vocabulary - -Canonical requirements use exactly one of: `Implemented on protected main`, `Implemented on active PR`, `Partial`, `Accepted architecture`, `Planned`, `Research only`, `Superseded`, `Out of scope`. +- Login-free browser-only/local-first storage as the primary architecture is **Superseded**. +- UUIDv7 internal identifiers are **Superseded** by opaque UUIDv4 product IDs. +- A single durable application and private-personal-only positioning are **Superseded** by modular service ownership and public multi-user operation. +- Browser-local state remains supported only as explicit draft/cache/offline state until an owning service accepts it. ## Primary customer journey -1. Google/GitHub login and personal workspace provisioning. -2. Goal -> Project -> Task and recurring Habit organization. -3. Explicit Today planning and completion. -4. Durable cross-device synchronization without silent stale overwrites. -5. Daily/weekly review based on durable evidence. -6. Calendar synchronization and bounded reminders. -7. Optional AI proposal generation with evidence and explicit accept/reject. -8. Privacy/data-rights request, status, export and deletion lifecycle. -9. Backup/recovery and accessible Korean/English PWA operation. -10. Operator deployment, readiness, observability, migration and release evidence. +1. Authenticate with Google or GitHub and enter an authorized workspace. +2. Organize Goals, Projects, Tasks, and recurring Habits. +3. Create and synchronize an explicit Today plan without silent overwrite. +4. Complete work and inspect durable guided Review evidence. +5. Connect one authorized calendar account and run conflict-safe synchronization. +6. Receive bounded timezone-correct reminders. +7. Request an inert AI proposal and explicitly accept or reject its evidence. +8. Request, inspect, export, and delete personal/workspace data through service-owned contributors. +9. Install explicitly granted plugins without database or arbitrary network authority. +10. Recover, migrate, deploy, observe, and release from auditable protected evidence. ## Functional requirements | ID | Requirement | Status | Evidence / tracking | | --- | --- | --- | --- | -| PRD-ID-001 | Google and GitHub login with revocable server-side sessions and tenant-derived authority. | Implemented on protected main | identity service and OAuth/session tests | -| PRD-ID-002 | Internal identifiers are opaque UUIDv4; provider IDs remain mapped metadata. | Implemented on protected main | `AGENTS.md`, service validators/migrations | -| PRD-PLAN-001 | Persist Goals, Projects and Tasks in planning-service-owned PostgreSQL. | Implemented on protected main | planning migrations/repository tests | -| PRD-PLAN-002 | Explicit durable Today synchronization with strong preconditions, idempotency and stale conflict handling. | Implemented on protected main | PR #127 merged as protected main; browser and PostgreSQL concurrency tests | -| PRD-HAB-001 | Recurring habits and durable completion history. | Implemented on protected main | habit service PostgreSQL tests | -| PRD-REV-001 | Guided review without becoming planning mutation authority. | Implemented on protected main | review service boundary/tests | -| PRD-CAL-001 | Conflict-safe CalDAV/Google calendar synchronization. | Implemented on protected main | calendar adapter tests | -| PRD-CAL-002 | Derive calendar workspace authority from signed trusted context, not legacy client headers. | Implemented on protected main | PR #139 merged; trusted-context tests | -| PRD-CAL-003 | Complete per-user encrypted Google/CalDAV credential lifecycle, OAuth/PKCE, refresh/revocation, discovery and calendar selection. | Partial | issue #129 | -| PRD-CAL-004 | Persist a LifeOS-owned calendar-connection foundation scoped to workspace and user, with bounded provider metadata, normalized scopes and opaque secret handles rather than plaintext provider tokens. | Implemented on protected main | PR #150 merged as `1623df364925f84920c07c112f1ae96777277d20`; does not complete #129 | -| PRD-CAL-005 | Revoke one owned calendar connection atomically under exact workspace+user scope while preserving a bounded revoked-state result and replay safety. | Implemented on protected main | PR #153 merged as `b13413e571bad82535f63d478e40746d12c3e680`; does not by itself revoke provider-side OAuth credentials | -| PRD-CAL-006 | Internal hosted calendar operations that require user authority use a short-lived signed context binding both workspace and requesting-user UUIDv4 identities under a version distinct from workspace-only synchronization context. | Implemented on protected main | PR #155 merged as `7b34a5a584b037653d091ea661ae4627bb5dd2ea`; public disconnect/credential lifecycle remains #129 | -| PRD-NOT-001 | Timezone-correct bounded reminders with replay-safe delivery. | Implemented on protected main | notification persistence/scheduler tests | -| PRD-AI-001 | AI output is inert proposal evidence until explicit authorized decision. | Implemented on protected main | AI proposal/audit tests | -| PRD-AI-002 | Deterministic proposal-quality/safety gates remain independent of live provider availability. | Implemented on protected main | evaluator/live-conformance split | -| PRD-PRIV-001 | Sensitive data access is tenant/purpose/lifetime/audit bound rather than blanket-masked. | Implemented on protected main | privacy-service tests | -| PRD-PRIV-002 | Data-rights requests preserve recent-auth provenance and durable immutable request/terminal receipts. | Implemented on protected main | PRs #134, #136, #137, #138 and #144 integrated on main | -| PRD-PRIV-003 | Complete export/deletion orchestration across every owned domain, protected delivery lifecycle, retention/legal-hold handling and reconciliation. | Partial | issue #55 | -| PRD-PRIV-004 | An authenticated user can query one owned data-rights request through a tenant-and-actor scoped, bounded, non-cacheable public status resource without exposing workspace/user IDs, idempotency material or receipt digests. | Implemented on protected main | PR #146 merged; session-derived scope and bounded 400/401/404/503 behavior | -| PRD-PRIV-005 | Tenant-export sections carry contributor-defined safe record counts and deterministic per-section SHA-256 integrity evidence, with locale-independent property ordering and a whole-export digest. | Implemented on protected main | PR #149 merged; integrity regression and RFC 8785/FIPS 180-4 doctoring | -| PRD-INT-001 | Versioned plugin SDK/validation without direct database authority. | Implemented on protected main | plugin SDK/integration-service tests | -| PRD-INT-002 | Complete plugin runtime installation, encrypted secret storage, SSRF-safe outbound delivery, retries/dead-letter behavior and revocation. | Partial | protected installation authority exists; durable secret/delivery runtime remains issue #130 | -| PRD-INT-003 | Treat a validated manifest as untrusted intent and grant only explicit tenant-scoped installation capabilities with exact replay/conflict/revocation semantics. | Implemented on protected main | PR #151 merged as `6971c4e11b3204ec41526c7c959a248e54440e1c` | -| PRD-INT-004 | Persist restart-safe plugin installation authority with service-owned multiword schema/table naming, fixed SQL, explicit lifecycle evidence and workspace+installing-user-scoped lookups at the persistence boundary. | Implemented on active PR | PR #156; no secret/delivery authority implied | -| PRD-WEB-001 | Responsive installable PWA with keyboard-operable core flows and Korean/English catalogs. | Implemented on protected main | browser/accessibility/localization tests | -| PRD-OPS-001 | Logical PostgreSQL backup/restore with integrity and unsafe-target refusal. | Implemented on protected main | backup scripts/tests/runbook | -| PRD-OPS-002 | Provider-neutral production reference deployment and bounded health/readiness/metrics. | Implemented on protected main | infra and observability tests | -| PRD-GOV-001 | Capability maturity and buyer-gap exhaustion are reported independently. | Implemented on protected main | buyer-gap registry and issue #21 report | -| PRD-GOV-002 | Required PR verification identifies the commit tree actually checked and does not conflate exact source-head verification, stale PR-base snapshots, independently resolved live-base state or integration compatibility evidence. | Implemented on protected main | PR #154 merged as `2c272a404f8f3a74aa5796a1957d4a6ce0fabe8f`; ADR 0010 defines evidence identities; issue #132 remains only for residual central scanner classification | +| PRD-ID-001 | Google/GitHub login, revocable server sessions, workspace membership, and preserved authentication-age provenance. | Implemented on protected main | Identity source/migrations/tests | +| PRD-ID-002 | Internal/public product IDs are opaque UUIDv4; external IDs remain bounded metadata. | Implemented on protected main | `AGENTS.md`, validators, migrations, ADR 0001 | +| PRD-PLAN-001 | Planning owns durable Goals, Projects, Tasks, search, and Today persistence. | Implemented on protected main | Planning migrations/repositories | +| PRD-PLAN-002 | Today synchronization uses explicit acceptance, strong preconditions, idempotency, and stale-conflict reconciliation. | Implemented on protected main | PR #127 | +| PRD-PLAN-003 | Every public Planning route derives signed workspace authority and binds it to the exact method/path/request. | Implemented on protected main | PR #168 and PR #188 | +| PRD-HAB-001 | Habit owns recurring definitions and replay-safe completion history. | Implemented on protected main | Habit migrations/tests | +| PRD-HAB-002 | Every public Habit route derives signed workspace authority; trusted contributor transport consumes destructive authority once. | Implemented on protected main | PR #173 and PR #192 | +| PRD-REV-001 | Review owns guided-review persistence/projections without Planning or Habit mutation authority. | Implemented on protected main | Review service boundaries | +| PRD-REV-002 | Guided-review routes require request-bound signed workspace authority. | Implemented on protected main | PR #185 | +| PRD-CAL-001 | Google/CalDAV synchronization is conflict-safe and tenant-scoped. | Implemented on protected main | Calendar provider tests | +| PRD-CAL-002 | Calendar synchronization uses signed trusted workspace context, not browser-selected ownership. | Implemented on protected main | PR #139 | +| PRD-CAL-003 | Complete encrypted per-user credential lifecycle, OAuth/PKCE, refresh/revoke, discovery/selection, and scoped sync. | Partial | issue #129 | +| PRD-CAL-004 | Calendar-owned connection metadata is scoped to exact workspace and user and stores opaque secret references only. | Implemented on protected main | PR #150 | +| PRD-CAL-005 | Local connection revocation is atomic, replay-safe, and tenant/user scoped. | Implemented on protected main | PR #153 | +| PRD-CAL-006 | User-sensitive hosted operations use signed `life-os.calendar-user.v1` workspace+user authority. | Implemented on protected main | PR #155 | +| PRD-CAL-007 | Authenticated disconnect, exact lookup validation, bounded connection read, scoped credential materialization, and authenticated secret-first creation are protected behavior. | Implemented on protected main | PR #157, PR #176, PR #189, PR #193, PR #197 | +| PRD-CAL-008 | Create-evidence mismatch compensates every newly materialized credential before sanitized failure. | Implemented on protected main | PR #201 | +| PRD-NOT-001 | Notification owns bounded timezone-correct reminders, claims, outcomes, retries, and recovery evidence. | Implemented on protected main | Notification migrations/scheduler tests | +| PRD-AI-001 | AI output is inert auditable proposal evidence until explicit authorized accept/reject. | Implemented on protected main | AI proposal/audit service | +| PRD-AI-002 | Deterministic schema/quality/safety gates remain independent of live model availability. | Implemented on protected main | Proposal evaluator and live-conformance split | +| PRD-PRIV-001 | Sensitive access is tenant, actor, purpose, resource, lifetime, and audit bound. | Implemented on protected main | Privacy service | +| PRD-PRIV-002 | Data-rights requests preserve recent-auth provenance, durable request identity, immutable terminal receipts, and bounded status. | Implemented on protected main | PR #146 and predecessor foundations | +| PRD-PRIV-003 | Complete export/deletion orchestration covers every owning domain, reconciliation, retention/legal hold, backup expiry, protected artifact delivery, and final participant-set completion. | Partial | issue #55 | +| PRD-PRIV-004 | Export sections carry deterministic bounded data, safe record counts, and integrity evidence. | Implemented on protected main | PR #149 | +| PRD-PRIV-005 | Independent services use versioned `life-os.data-rights-contributor.v1`, never cross-service SQL. | Implemented on protected main | PR #159 | +| PRD-PRIV-007 | Planning owns a deterministic PostgreSQL-backed contributor and authenticated request-bound transport. | Implemented on protected main | PR #179 and PR #194 | +| PRD-PRIV-008 | Habit owns a deterministic PostgreSQL-backed contributor and replay-safe authenticated transport. | Implemented on protected main | PR #184 and PR #192 | +| PRD-PRIV-009 | Review, Notification, and AI own bounded contributors without widening Identity database authority. | Implemented on active PR | PR #195, PR #198, PR #199 | +| PRD-INT-001 | Plugin SDK/manifest/event contracts are versioned, bounded, and deny direct database authority. | Implemented on protected main | Plugin SDK/integration tests | +| PRD-INT-002 | Complete concrete secret/KMS, authorized-origin outbound delivery, retry/dead-letter, revocation fencing, and operator lifecycle. | Partial | issue #130 | +| PRD-INT-003 | A manifest is intent only; the host grants an explicit tenant/user-scoped capability subset. | Implemented on protected main | PR #151 | +| PRD-INT-004 | Plugin installation persistence is restart-safe and validates exact opaque installation/workspace/installer evidence. | Implemented on protected main | PR #169 and PR #175 | +| PRD-INT-005 | Credential binding stores only opaque secret references and compensates conflicting durable winners. | Implemented on protected main | PR #172 | +| PRD-INT-006 | Operator requests use exact request-bound one-time authority, durable replay protection, and fail-closed HTTP composition. | Implemented on protected main | PR #191 and PR #196 | +| PRD-WEB-001 | The PWA is responsive, keyboard-operable, installable, and structurally localized in Korean and English. | Implemented on protected main | Browser/accessibility/localization tests | +| PRD-WEB-002 | Gateway Today composes authenticated Planning and Habit state without fabricated success. | Implemented on protected main | PR #186 and PR #187; Issue #163 completed | +| PRD-OPS-001 | Logical PostgreSQL backup/restore proves integrity and refuses unsafe targets. | Implemented on protected main | Backup scripts/tests/runbook | +| PRD-OPS-002 | Deployment/readiness/metrics are provider-neutral and bounded. | Implemented on protected main | Compose/Kubernetes/observability evidence | +| PRD-GOV-001 | Capability maturity and canonical buyer-gap exhaustion are reported independently. | Implemented on protected main | Commercial Readiness registry | +| PRD-GOV-002 | Exact source, PR-base snapshot, live base, integration tree, workflow checkout, protected main, and release identities remain distinct. | Implemented on protected main | PR #154 and ADR 0010; issue #132 remains Partial | +| PRD-GOV-003 | Scheduled model-assisted development uses exact pinned OpenCode and independent deterministic gates. | Implemented on protected main | PR #200 repairs the reviewed bootstrap boundary | ## Non-functional requirements -- Fail closed on malformed ownership, UUIDs, signatures, digests, timestamps and untrusted provider data. -- Parameterize dynamic SQL and keep service-owned database authority explicit. -- Use idempotency and version/precondition controls wherever replay or stale overwrite can cause loss. -- Public errors/logs/metrics/artifacts exclude credentials, hidden reasoning and unbounded tenant content. -- Integrity digests are evidence, not authorization, confidentiality, provenance or digital signatures. +- Fail closed on malformed ownership, UUIDs, signatures, digests, timestamps, cursors, provider evidence, and persisted rows. +- Parameterize dynamic data and keep SQL structures fixed within service-owned schemas. +- Use idempotency, fencing, and version/precondition controls where replay or stale overwrite can cause loss. +- Bound request/response bodies, provider/model outputs, logs, errors, metrics, and retained evidence. +- Credentials, cookies, secret references, raw model prompts/responses, and hidden reasoning never enter public artifacts. +- Integrity digests are evidence, not authorization, confidentiality, provenance, or digital signatures. - Core customer journeys require realistic PostgreSQL and browser evidence, not mock-only success. -- Product-owned production packages maintain exact coverage gates where configured and beginner-readable public documentation. -- Verification evidence remains bound to the exact commit tree it inspected rather than being promoted across source, integration, base or release identities. +- Product-owned production packages maintain exact configured coverage and beginner-readable public docstrings. +- Pending, skipped, cancelled, absent, stale, predecessor, synthetic-only, or rate-limited evidence is never passing. ## Non-goals -LifeOS does not claim medical diagnosis/treatment, autonomous consequential employment/credit/legal decisions, silent AI mutation of user data, provider availability guarantees, cross-service direct database access, certification without independent evidence, or unmeasured public SLA/RPO/RTO values. +LifeOS does not claim medical diagnosis/treatment, autonomous consequential employment/credit/legal decisions, silent AI mutation, provider availability guarantees, cross-service SQL access, certification without independent evidence, arbitrary plugin code execution, or unmeasured public SLA/RPO/RTO values. ## Release outcome -A stable release requires one exact protected integrated head where product journey, tenant/privacy boundaries, required CI/security/review, coverage, packaging, SBOM/provenance, migration/rollback, backup/restore, accessibility/localization, deployment and operational acceptance pass together. +A stable release requires one unchanged integrated protected head where product journeys, tenant/privacy boundaries, required CI/security/review, coverage/docstrings, packaging, SBOM/provenance/reproducibility, migration/rollback/recovery, accessibility/localization, deployment, and operational acceptance pass together. diff --git a/docs/PRIVACY_DATA_LIFECYCLE.md b/docs/PRIVACY_DATA_LIFECYCLE.md index 442f028bc..d589436c0 100644 --- a/docs/PRIVACY_DATA_LIFECYCLE.md +++ b/docs/PRIVACY_DATA_LIFECYCLE.md @@ -4,78 +4,119 @@ ## Control model -LifeOS preserves legitimate product utility while limiting sensitive-data access through tenant-derived authority, explicit purpose/resource/lifetime controls, least privilege, encryption/secret boundaries, bounded retention and auditable privileged access. Blanket masking is not the primary authorization model. +LifeOS preserves legitimate product utility while constraining sensitive data through tenant-derived authority, exact actor/resource/purpose/lifetime binding, least privilege, service-owned persistence, explicit secret boundaries, bounded retention, and auditable privileged access. Blanket masking is not the authorization model. -## Data classes +## Data classes and owners -- identity/account and external-provider mappings; -- session/authentication provenance; -- planning, habit and review content; -- calendar connection/synchronization metadata and credential references; -- reminder/delivery evidence; -- AI proposal/evidence/decision records; -- privacy access decisions/grants/events; -- data-rights request/receipt/export-integrity evidence; -- plugin installation/capability evidence; -- operator logs/metrics and release/CI evidence. +- Identity: accounts, provider mappings, sessions, workspace membership, authentication provenance, and whole-request data-rights evidence. +- Planning: Goals, Projects, Tasks, search, Today, and Planning contributor receipts. +- Habit: recurring definitions/completions and Habit contributor receipts. +- Review: guided-review completion/projection records. +- Calendar Integration: connection/sync metadata and opaque credential references. +- Notification: reminder occurrences, claims, delivery outcomes, and inbox evidence. +- AI Proposal: inert proposals/evidence/decisions. +- Privacy: access decisions, bounded grants, and audit events. +- Plugin Integration: installation/grant/credential-binding/operator replay evidence. +- Operators: bounded logs/metrics, backup, migration, CI, provenance, and release evidence. -Provider credentials, browser cookies, raw model prompts/responses and hidden reasoning are protected secret/transient material and do not belong in public artifacts. +Provider credentials, browser cookies, private signing keys, raw model prompts/responses, and hidden reasoning are protected secret/transient material. They do not belong in public responses, logs, metrics, model evidence, CI artifacts, or portable exports. ## Lifecycle rules -1. **Collect:** accept only bounded fields required by the owning-service contract. -2. **Authorize:** derive tenant/actor from trusted authenticated or signed context. -3. **Use:** constrain sensitive access to explicit purpose/resource/lifetime. -4. **Persist:** store only in the owning service under service-owned credentials/migrations. -5. **Observe:** logs/metrics use bounded credential-free evidence. -6. **Retain:** retention is explicit by data class; immutable evidence is retained only as required by product/legal/operator policy. -7. **Export/Delete:** recent-authenticated requests use durable rights evidence; complete cross-domain orchestration remains partial. -8. **Backup:** erasure claims account for documented backup expiry rather than imply instantaneous physical disappearance. +1. **Collect:** accept only bounded fields required by an owning-service contract. +2. **Authorize:** derive workspace/actor from authenticated or signed context; client ownership fields are untrusted data. +3. **Use:** constrain sensitive access to explicit purpose/resource/lifetime and exact request authority. +4. **Persist:** store only under the owning service's schema/role/migrations; never cross-mutate another service's tables. +5. **Secret handling:** persist only opaque references where external credential material is required. +6. **Observe:** logs, metrics, traces, CI, and review evidence remain bounded and credential-free. +7. **Retain:** classify mutable records, immutable audit/receipt evidence, legal hold, and backup expiry separately. +8. **Export/Delete:** recent-authenticated whole requests invoke explicit registered service-owned contributors. +9. **Recover:** retries preserve exact idempotency/fencing authority and never fabricate terminal success. +10. **Release:** privacy claims bind one exact protected source and deployed artifact/provenance identity. ## Data-rights lifecycle **Status:** Partial -Protected main includes authentication-age provenance, fail-closed recent-auth policy, durable requests and immutable terminal receipts, tenant+actor scoped lookup, the authenticated non-cacheable public status resource from PR #146, and per-contributor export integrity evidence from PR #149. +Protected main includes: -The section/whole SHA-256 evidence is integrity metadata only; it does not prove authorization, confidentiality, provenance or signature identity. Issue #55 remains open for complete contributor participation, durable reconciliation/operator recovery, retention/legal-hold/backup-expiry evidence, protected streamed delivery/encryption/expiry and download audit. +- preserved authentication ceremony time and recent-authentication enforcement; +- durable request identity and immutable terminal aggregate receipt evidence; +- tenant/requesting-user scoped non-cacheable status lookup; +- deterministic per-section and whole-export integrity evidence; +- versioned `life-os.data-rights-contributor.v1` from PR #159; +- Planning contribution from PR #179 and authenticated request-bound transport from PR #194; +- Habit contribution from PR #184 and replay-safe authenticated transport from PR #192. + +Review contribution in PR #195 is **Implemented on active PR**. Notification contribution in PR #198 is **Implemented on active PR**. AI contribution in PR #199 is **Implemented on active PR**. Active branch migrations and receipts remain non-shipped until integration. + +Issue #55 remains **Partial** because required Identity-owned erasure, Calendar, Privacy, Plugin Integration, remaining service inventory, durable asynchronous reconciliation, operator recovery, retention/legal hold, backup expiry, protected streamed/encrypted export delivery, expiry/deletion/download audit, and exact terminal participant-set completion are not all protected. + +### Deletion semantics + +No service may claim whole-workspace deletion because its own records were erased. Complete deletion requires: + +- an exact immutable request and explicit required-participant inventory; +- successful preflight for every participant; +- owner-controlled replay-safe erasure in safe order; +- post-erasure verification by every owner; +- deterministic reconciliation of partial, unavailable, and unknown outcomes; +- retention/legal-hold and backup-expiry evidence; +- one final immutable whole-product receipt only after all required evidence is reconciled. + +Unknown or missing participants fail closed. Identity orchestration never receives another service's SQL credentials. ## Calendar credentials and connections **Status:** Partial -Protected main includes signed workspace context (#139), the workspace+user scoped connection registry (#150), atomic local connection revocation (#153), and the distinct short-lived signed workspace+user authority from PR #155 (`life-os.calendar-user.v1`). Connection rows carry bounded provider/account/calendar metadata and opaque credential references rather than provider-token plaintext. Local revocation ends LifeOS connection authority but does not itself prove provider-side OAuth revocation or managed-secret deletion. +Protected main includes signed workspace sync context (PR #139), workspace/user scoped metadata persistence (PR #150), atomic local revocation (PR #153), signed `life-os.calendar-user.v1` authority (PR #155), authenticated disconnect (PR #157), exact returned lookup validation (PR #176), authenticated credential-free read (PR #189), scoped materialization port (PR #193), and authenticated secret-first creation (PR #197). + +Connection rows retain bounded provider/account/calendar metadata and opaque secret references only. Plaintext access/refresh material exists only within the reviewed secret-store/materialization call boundary. Local record revocation does not prove provider-side OAuth revocation or secret destruction. -The complete #129 lifecycle still requires public authenticated connection/disconnect composition, OAuth state/PKCE, a concrete managed secret backend, refresh/provider revocation, discovery/selection and migration away from development-wide credentials. +PR #201 protects compensation of newly written secret handles when durable create evidence mismatches exact connection/workspace/user/handle authority. -## Plugin installation and secrets +Issue #129 remains **Partial** for concrete encrypted KMS/secret storage, OAuth state/PKCE/callback, refresh fencing, provider-side revoke/delete recovery, discovery/selection, scoped synchronization composition, migration from process-global credentials, rotation, and operator recovery. + +## Plugin installation, credentials, and outbound delivery **Status:** Partial -Protected main validates plugin manifests and, through PR #151, separates manifest intent from host-granted installation authority. Explicit capability subsets, exact replay/conflict handling, tenant/user isolation and revocation are protected behavior. +Protected main separates manifest intent from host authority and includes: + +- explicit installation grants from PR #151; +- restart-safe persistence from PR #169; +- opaque secret-reference credential binding and compensation from PR #172; +- exact installation-evidence validation from PR #175; +- one-time request-bound operator authority/replay evidence from PR #191; +- fail-closed operator HTTP composition from PR #196. + +Plaintext plugin credentials never belong in manifests, LifeOS persistence, public/application views, logs, metrics, prompts, CI artifacts, or audit rows. Exact replay cannot rematerialize an existing secret. Revocation ends LifeOS authority before external deletion retry and never restores authority. -PR #156 is **Implemented on active PR** for restart-safe plugin installation authority persistence. Its application and SQL lookup/revocation boundaries carry installation, workspace and installing-user authority, while the durable record stores only bounded installation/manifest/grant/lifecycle evidence. Plaintext plugin credentials are not part of that record. +Issue #130 remains **Partial** for a concrete KMS adapter, separately host-authorized delivery origins, DNS/IP/SSRF/rebinding-safe HTTPS, redirect/proxy/size/time controls, per-plugin signing/rotation, delivery attempt/outcome persistence, bounded retry/dead-letter, delivery-time revocation fencing, and operator-visible recovery. -Protected secret/KMS lifecycle, SSRF-safe authorized-origin outbound delivery, retry/dead-letter evidence and delivery-time revocation enforcement remain issue #130. A granted or durably persisted installation is not evidence that the complete plugin runtime exists. +## Purpose-bound access -## Model-assisted development evidence +**Status:** Implemented on protected main + +Privacy decisions bind exact actor, workspace, resource/resource class, purpose, and lifetime. Grants are bounded, signed/consumable where applicable, and auditable. Access denial and dependency failure remain credential-free. Masking can reduce disclosure but never replaces authorization. + +## AI and model-assisted evidence **Status:** Accepted architecture -ADR 0012 keeps model/provider credentials and model execution separate from product/repository authority. `NVIDIA_NIM_API_KEY` may materialize only at the reviewed bounded model-call/development boundary; retained evidence excludes provider credentials, raw prompts/responses and hidden reasoning. Model output cannot become product authorization, independent review, merge or release authority. +AI proposals remain inert until explicit authorized decision. Browser credentials and provider secrets are not model inputs. `NVIDIA_NIM_API_KEY` may materialize only inside the reviewed model-call/development boundary. Retained model evidence excludes the key, raw prompts/responses, and hidden reasoning. + +Model output cannot become product authorization, independent review, merge, or release authority. PR #200 is **Implemented on protected main** only for restoring the pinned OpenCode executable through a narrow lifecycle-script allowlist; it does not broaden model or repository authority. -## Deletion semantics +## Integrity, secrecy, and provenance -No service may claim whole-workspace deletion merely because its own tables were erased. Complete deletion requires every registered owning domain to participate in the exact request, deterministic reconciliation of partial/unknown outcomes, retention/legal-hold handling and immutable final evidence. Unknown or missing contributors fail closed. +- SHA-256 export/manifest/receipt digests detect deterministic content change but do not provide authorization, confidentiality, signer identity, or non-repudiation. +- Secret references identify least-authority external material; possession of metadata is not permission to materialize a secret. +- Provider/plugin IDs are metadata, not LifeOS primary identity. +- CI/SARIF/status evidence must identify the exact inspected source/integration identity; a green umbrella status is not privacy assurance for another tree. +- Backup retention and physical storage expiry remain explicit and cannot be hidden behind immediate logical deletion claims. -## Security/privacy invariants +## Privacy failure and recovery -- no browser-selected tenant authority; -- no cross-service direct database access; -- no external credential content in logs, metrics, public errors, model prompts, CI artifacts or generic metadata rows; -- no raw user content in release/provenance artifacts unless explicitly authorized and bounded; -- no whole-right success claim from partial/unknown contributor state; -- no integrity digest is treated as access control or confidentiality; -- no plugin manifest self-authorizes host capabilities; -- no LifeOS connection-record revocation is silently promoted to provider credential revocation; -- no development model or model credential is promoted to independent review, merge or release authority. +Dependency outages return sanitized unavailable evidence. Partial external cleanup retains replayable recovery identity without restoring revoked authority. Ambiguous persistence winners, mismatched durable evidence, malformed rows, and unavailable receipt storage fail closed. Recovery evidence never exposes plaintext secrets or tenant payloads. diff --git a/docs/RELEASE_AND_MIGRATION.md b/docs/RELEASE_AND_MIGRATION.md index 24bb38b1a..32b7c209e 100644 --- a/docs/RELEASE_AND_MIGRATION.md +++ b/docs/RELEASE_AND_MIGRATION.md @@ -1,57 +1,101 @@ -# LifeOS Release, Migration, and Rollback +# LifeOS Release, Migration, Rollback, and Provenance **Status:** Implemented on active PR ## Release rule -A merged feature is not automatically a release. Release only from one exact protected integrated head after all applicable repository policy and product acceptance evidence passes together. +Release only from one unchanged exact protected integrated head after every applicable repository policy and product acceptance class passes together. Feature-branch, synthetic-only, queued, predecessor, or model evidence cannot authorize release. ## Required release evidence -- required CI and security scans; -- zero actionable unresolved review findings; -- configured exact production coverage/docstring gates; +- required exact-source CI and security checks plus independently classified compatibility evidence; +- zero actionable unresolved human/CodeRabbit/GHAS/Dependabot/OpenCode/Noema/Strix findings; +- exact configured production coverage and public-docstring gates; - browser/accessibility/localization acceptance for affected journeys; - package/container build and smoke evidence; -- migration compatibility and rollback/forward-fix evidence; -- backup/restore evidence where persistent state is affected; -- SBOM/provenance/reproducibility evidence required by repository policy; -- operator readiness/observability evidence; -- CHANGELOG/version alignment with the artifact. +- migration compatibility, rollback/forward-fix, restart, and recovery evidence; +- backup/restore integrity and unsafe-target refusal where persistent state changes; +- SBOM, artifact attestation/provenance, reproducibility, dependency integrity, and publish verification required by policy; +- operator readiness, bounded telemetry, incident/recovery acceptance, and no production stub/fake-success path; +- version/CHANGELOG alignment with the exact artifact and source identity. -## Schema migrations +## Evidence identity -Every owning service sequences its own migrations. Cross-service migrations are prohibited. Migrations must preserve the service's identifier, tenant, immutability and concurrency invariants. +Release decisions retain separate: + +- `source_head_sha`; +- `pr_base_snapshot_sha`; +- independently resolved `live_base_tip_sha`; +- integration/synthetic tree identity; +- `workflow_checkout_sha`; +- `protected_main_sha`; +- `release_source_sha`; +- artifact digest/provenance identity. + +PR #154 protects local source/live-base separation. Issue #132 remains **Partial** for central reusable scanner taxonomy. A status is release evidence only for the tree and artifact it actually inspected. + +## Service-owned schema migrations + +Every service sequences its own migrations under its own role. Cross-service migrations and direct cross-schema mutation are prohibited. Migrations preserve UUIDv4, tenant scope, immutability, secret-reference, replay, concurrency, and recovery invariants. For risky migrations: -1. establish a failing compatibility/migration test where practical; -2. define preconditions and data-shape assumptions; -3. stage constraints/backfill/validation when required for safe rollout; -4. verify old/new application compatibility where rolling deployment is supported; +1. add failing migration/compatibility/privilege/restart evidence where practical; +2. define exact preconditions and current data-shape assumptions; +3. stage additive columns/constraints/backfill/validation where required; +4. prove old/new application compatibility for rolling deployment claims; 5. define rollback or explicit forward-fix behavior; -6. prove restart/retry behavior and bounded diagnostics. +6. prove retry/restart/duplicate/malformed/corrupt evidence handling; +7. verify backup/restore and retention interactions; +8. record irreversible effects and recovery limits. + +## Active migration line + +| Pull request | Status | Migration/release obligation | +| --- | --- | --- | +| PR #195 | Implemented on active PR | Review erasure receipt migration, owner privilege/replay/restart evidence | +| PR #198 | Implemented on active PR | Notification erasure migration, claims/outcome immutability, owner-only deletion/replay evidence | +| PR #199 | Implemented on active PR | AI erasure migration, append-only trigger authority, cursor compatibility, owner-only atomic deletion | +| PR #200 | Implemented on protected main | no product schema; exact pinned bootstrap and narrow lifecycle-script policy | + +Active work cannot enter a release until integrated and revalidated on the final protected head. ## Application rollback -Application rollback restores only application/configuration state that is actually reversible. It must not claim to undo already committed DB migrations, external provider revocations, delivered notifications/calendar mutations or deletion effects unless a tested compensating contract exists. +Application rollback restores only reversible application/configuration state. It never claims to undo committed database migrations, destructive erasure, delivered notifications/calendar mutations, provider revocations, or secret-store writes/deletes without a tested compensating contract. + +When rollback would reintroduce a binary unable to understand additive durable fields, cursor semantics, receipt rows, one-time replay records, or current signature versions, forward-fix or staged compatibility is required instead. -## Data-rights changes +## Data-rights migration and release -Data-rights request/receipt migrations preserve request identity, tenant/requesting-user ownership, recent-auth provenance and immutable terminal evidence. Whole-product erasure/export completion remains governed by issue #55 until all domain participants and retention/backup-delivery semantics are complete. +PR #159 protects the contributor contract. Planning PR #179/PR #194 and Habit PR #184/PR #192 are protected contributors/transports. Active Review/Notification/AI work remains non-shipped. + +Issue #55 remains **Partial** until exact participant inventory, remaining owners, durable reconciliation/recovery, retention/legal hold, backup expiry, protected artifact streaming/encryption/expiry/deletion/download audit, and terminal whole-right receipt evidence pass on one protected head. + +No release may claim complete export/deletion from partial or unknown participants. ## Calendar credential migration -The process-global development token may not be silently treated as a hosted multi-user credential model. Issue #129 requires an explicit migration path to per-user encrypted connection/refresh/revocation/selection semantics. +Protected PR #150, PR #153, PR #155, PR #157, PR #176, PR #189, PR #193, PR #197, and PR #201 establish metadata, authority, disconnect, validation, read, materialization, creation, and mismatch-compensation foundations. + +The process-global development token cannot be silently treated as hosted multi-user credentials. Issue #129 requires an explicit migration to a concrete encrypted KMS/secret store, OAuth/PKCE, refresh, provider cleanup, discovery/selection, scoped synchronization, rotation/recovery, and retirement of global production credentials. Rollback must preserve revoked authority and cannot resurrect deleted provider/KMS secrets. ## Plugin runtime migration -Existing manifest/event validation remains backward-compatible unless a versioned contract states otherwise. Future installation/secrets/delivery under #130 must not grant authority to old validation-only manifests implicitly. +Protected PR #151, PR #169, PR #172, PR #175, PR #191, and PR #196 establish grants, durable installation, opaque secret binding, exact evidence, one-time operator replay, and fail-closed HTTP composition. + +Issue #130 remains **Partial**. Future authorized-origin and delivery schemas/contracts must be explicit versions, must not infer network authority from old manifests/installations, and require concrete KMS, SSRF/DNS-rebinding-safe egress, outcomes, retries/dead-letter, revocation fencing, operator recovery, migration, and rollback evidence. + +## Package and automation changes + +Exact pinned development/review tooling is supply-chain-sensitive. Protected PR #200 allows only `opencode-ai`, preserves the exact pin, and keeps unrelated lifecycle scripts denied. A fresh protected scheduled run must still pass exact installation verification before release acceptance. ## Versioning and CHANGELOG -Keep buyer-visible unreleased work under `CHANGELOG.md` → `Unreleased`. Bump the product/package version and create release notes/tag only after the exact protected revision satisfies release acceptance. Published artifacts must be verified against recorded source/artifact identity. +Keep unreleased behavior under `CHANGELOG.md` -> `Unreleased`. Create version, tag, release notes, packages/images, SBOM, and provenance only after the exact protected source passes release acceptance. Verify published artifact digests and installed/runtime behavior against recorded source/provenance before announcing release. + +Documentation-only governance changes must not be described as shipped product capability. Conversely, protected behavior must not remain labeled active after integration. ## Recovery exercises -Backup/restore, migration failure, stale-write conflict, worker replay and provider outage exercises are product evidence. Do not publish fixed RPO/RTO claims without measured deployment-specific recovery evidence. \ No newline at end of file +Release acceptance includes relevant backup/restore, migration failure, stale-write conflict, worker replay, provider outage, KMS partial failure, data-rights stuck participant, plugin secret cleanup, provenance mismatch, rollback, and forward-fix exercises. No fixed public RPO/RTO is claimed without measured deployment-specific evidence. diff --git a/docs/TEST_STRATEGY.md b/docs/TEST_STRATEGY.md index 4d9227732..707083940 100644 --- a/docs/TEST_STRATEGY.md +++ b/docs/TEST_STRATEGY.md @@ -4,80 +4,128 @@ ## Principles -LifeOS tests prove domain behavior and authority boundaries, not only implementation reachability. Source changes follow RED -> minimal GREEN -> refactor where practical. Required checks are attributed to the revision they actually inspect. +LifeOS tests prove domain behavior, authority, recovery, and evidence identity—not only implementation reachability. Source changes follow realistic RED -> smallest root-cause GREEN -> focused/full validation. Required checks are attributed to the exact revision and checkout they inspect. ## Test layers -### Unit/domain +### Unit and domain -Validate UUIDv4, ownership, signatures, digests, recurrence, idempotency, stale preconditions, state transitions and bounded failure classes with deterministic tests. +Validate UUIDv4, authority derivation, exact method/path signing, freshness, one-time evidence, digest/cursor normalization, recurrence, idempotency, fencing, stale preconditions, state transitions, and bounded failure classes with deterministic tests. ### PostgreSQL integration -Use real PostgreSQL for service-owned persistence behavior, including tenant isolation, transactions, concurrent/replayed requests, immutable evidence, migration compatibility and restart durability. +Use real disposable PostgreSQL for service-owned migrations and repositories, including: -Current examples include durable planning/Today concurrency, habit persistence, notification claim/outcome behavior, AI/privacy persistence and identity data-rights ledgers. +- tenant isolation and fixed parameterized SQL; +- exact returned identity/evidence validation; +- transaction rollback and restart durability; +- concurrent/replayed requests and advisory/fencing semantics; +- immutable proposal/decision/reminder/receipt/audit evidence; +- owner-only destructive data-rights functions and post-erasure verification; +- privilege denial for ordinary application roles; +- compensation/recovery records where external secret material is introduced. -### HTTP integration +Mock-only success is insufficient for persistence, privilege, concurrency, replay, migration, or recovery claims. -Exercise actual authenticated/signed request boundaries, malformed input, content type, conflict and dependency-failure semantics. Tests must prove that client-selected ownership cannot create authority. +### HTTP and application integration + +Exercise actual authenticated/signed boundaries, exact method/path/actor/workspace binding, malformed JSON/content type/UUID/signature/cursor, replay, conflict, not-found isolation, response-size/schema validation, dependency outage, and credential-free problem mapping. Tests must prove browser-selected ownership cannot create authority. + +Protected examples include Planning/Habit Today composition, Calendar read/create/disconnect/materialization, Planning/Habit data-rights transport, integration events, and plugin operator HTTP composition. ### Browser acceptance -Exercise real core journeys with Playwright where the user-visible contract is material: login/onboarding, capture/Today, durable Today synchronization/conflicts, accessibility/localization and PWA behavior. +Use Playwright for material user journeys: login/onboarding, capture/Today, durable synchronization/conflict, explicit degraded state, accessibility, localization, and PWA behavior. Browser-local drafts must remain visibly non-durable until server acceptance. ### Security regression -Cover AppGuardrail/Semgrep/security classes, SQL/static structure, context signing, tenant substitution, untrusted provider responses, prompt injection, secret leakage, hostile URLs where networking is introduced, and bounded error/artifact behavior. +Cover: -### Backup/deployment/release +- tenant/actor/resource substitution; +- signed-context replay, stale/future evidence, and exact request binding; +- SQL structure/privileges and corrupt persisted evidence; +- secret/reference/log/error/artifact leakage; +- OAuth state/redirect/origin/PKCE when introduced; +- provider response limits and credential material lifetime; +- AI prompt injection, benign utility, and inert proposal enforcement; +- plugin manifest self-escalation, operator replay, and hostile URL/SSRF/DNS-rebinding cases before outbound networking can ship; +- package lifecycle-script allowlisting and exact dependency pins; +- source/base/integration/SARIF/status identity attribution. -Executable tests validate Compose/reference deployment sources, liveness/readiness, backup checksum/restore refusal and package/release/provenance contracts. +### Backup, deployment, migration, and release -## Coverage +Executable tests validate Compose/reference deployment sources, liveness/readiness, graceful shutdown, backup checksum/restore refusal, migration compatibility, rollback/forward-fix, package/container build, SBOM/provenance/reproducibility, and publish verification. -Packages with exact gates retain meaningful 100% statement, branch, function and line coverage. Coverage cannot be satisfied by deleting real behavior, broad exclusions or mock-only assertions. Public production declarations require explanatory documentation under the owning package's configured gate. +## Coverage and docstrings -## Concurrency and replay matrix +Packages with exact configured gates retain meaningful 100% statement, branch, function, and line coverage. Coverage cannot be satisfied through deleted behavior, broad exclusions, unreachable branches, or mock-only assertions. Public production declarations require beginner-readable explanatory documentation under the owning package's gate. -- Today: duplicate idempotency key, conflicting reuse, stale precondition, concurrent create/update, connection cleanup. -- Habit: duplicate completion and tenant conflict. -- Notification: duplicate claim/delivery, expiry/recovery. -- AI: stale/replayed proposal decisions. -- Privacy: exact-expiry and single-use grant behavior. -- Data rights: request collision, immutable receipt, tenant-scoped lookup, future async reconciliation. -- Calendar: provider preconditions and trusted-context replay/issuance bounds. +## Authority and replay matrices -## Evidence identity +| Domain | Required adversarial/concurrency evidence | Status | +| --- | --- | --- | +| Today | duplicate idempotency, conflicting reuse, stale precondition, concurrent create/update, cleanup | Implemented on protected main | +| Planning/Habit/Review routes | workspace/actor/method/path substitution, stale/future signature, replay as applicable | Implemented on protected main | +| Notification | duplicate claim/delivery, expiry/recovery, immutable outcome | Implemented on protected main | +| AI proposals | malformed model output, stale/replayed decision, explicit confirmation, no mutation authority | Implemented on protected main | +| Privacy | purpose/resource/lifetime, exact expiry, single-use grant, bounded audit | Implemented on protected main | +| Data rights | request/idempotency collision, deterministic export, owner preflight/erase/verify, participant omission, whole-right non-completion | Partial | +| Calendar | exact connection/workspace/user evidence, secret-first compensation, handle substitution, provider/KMS outage, local-vs-provider revoke | Partial | +| Plugin | manifest/grant conflict, exact installation/binding/operator evidence, credential compensation, replay/revoke; delivery SSRF/retry when introduced | Partial | -A test/check must identify whether it inspected: +## Data-rights acceptance -1. exact contributor source head; -2. synthetic merge candidate; -3. independently resolved live-base compatibility state; -4. protected main; -5. release artifact. +PR #159 protects the shared contract. Protected Planning evidence comes from PR #179 and PR #194; protected Habit evidence comes from PR #184 and PR #192. PR #195, PR #198, and PR #199 are **Implemented on active PR** and require exact-head real PostgreSQL, coverage, docstrings, security/review, and live-base compatibility before integration. + +Whole-product tests must fail when any required participant is missing, duplicate, unavailable, malformed, cross-tenant, partially completed, unverified after erasure, or absent from the exact participant registry. Export integrity evidence never substitutes for authorization or protected delivery. + +## Calendar acceptance + +Protected boundaries from PR #157, PR #176, PR #189, PR #193, and PR #197 require tests for authenticated disconnect, exact returned lookup identity, credential-free read, secret-handle validation/materialization, secret-first create, and compensation on persistence/secret-store failures. + +PR #201 protects returned-durable-evidence mismatch compensation. The remaining #129 lifecycle requires OAuth state/PKCE replay tests, concrete encrypted-store evidence, refresh single-flight/fencing, provider cleanup partial-failure recovery, discovery/selection bounds, scoped sync, restart/rotation, and no process-global credential fallback. + +## Plugin acceptance -Evidence from one class cannot silently satisfy another. Issue #132 tracks the repository-wide required-workflow source-head attribution follow-up. +Protected PR #151, PR #169, PR #172, PR #175, PR #191, and PR #196 require tests for explicit grants, durable exact installation identity, opaque credential binding, conflicting-winner compensation, one-time operator authority/replay, malformed JSON, unavailable composition, and credential-free errors. + +Before #130 outbound delivery can ship, tests must cover host-authorized origins, loopback/RFC1918/ULA/link-local/cloud-metadata/IPv4-mapped/encoded addresses, DNS rebinding, redirect/proxy policy, TLS/HTTP failure, byte/time/rate/concurrency bounds, signing/rotation, retry/dead-letter, restart, and revocation fencing. ## Documentation consistency -Machine-checkable documentation tests should validate: +Machine-checkable contracts validate: - required canonical files and README/index links; -- all local Markdown link targets; -- exact status vocabulary; -- ADR index, actual targets, statuses and required sections; -- balanced Mermaid/Markdown fences; -- live service/API/event/state names; -- conceptual-vs-persisted labels in the data model; -- source/migration evidence for core claims such as UUIDv4, service-owned persistence and inert AI authority; -- active-PR versus protected-main lifecycle claims. +- local Markdown links; +- exact maturity vocabulary; +- ADR index/targets/status/required sections; +- balanced Markdown/Mermaid fences; +- protected chronology versus active PR scope; +- current buyer gaps and closed/superseded issue state; +- conceptual versus persisted/active data-model labels; +- UUIDv4, service ownership, browser durability, inert AI, purpose-bound privacy, and evidence-identity invariants; +- model credential/orchestration/review authority boundaries; +- stale predecessor PRs cannot reappear as active truth. + +## Evidence identity + +A check must identify whether it inspected: + +1. exact contributor source head; +2. PR-base snapshot; +3. independently resolved live-base tip; +4. synthetic/integration tree; +5. protected main; +6. release artifact/provenance. + +Evidence from one class cannot satisfy another. PR #154 protects local source/live-base separation. Issue #132 remains **Partial** for residual central reusable scanner checkout/SARIF/status taxonomy. + +Pending, queued, skipped, cancelled, absent, neutral, failed, stale, predecessor, synthetic-only, model-only, or rate-limited evidence is non-passing. ## Live-provider separation -NVIDIA/model/provider availability is bounded conformance evidence, not deterministic PR success. Deterministic fixtures test proposal safety/quality and provider failure behavior. `NVIDIA_NIM_API_KEY` is materialized only for the approved live model boundary. +NVIDIA/model/provider availability supplies bounded conformance evidence, not deterministic PR success. Deterministic fixtures prove quality/safety and provider failure behavior. `NVIDIA_NIM_API_KEY` materializes only inside the approved model boundary. PR #200 is **Implemented on protected main** for the narrow exact-pinned OpenCode postinstall allowlist; a fresh protected scheduled run remains operational acceptance evidence rather than merge evidence. ## Release acceptance -A release candidate must pass required CI/security/review, exact configured coverage, browser/accessibility/localization evidence, package/container build, migration/rollback/recovery, backup/restore, SBOM/provenance/reproducibility and protected-main operational acceptance on one exact integrated revision. \ No newline at end of file +A release candidate must pass required CI/security/review, exact configured coverage/docstrings, browser/accessibility/localization, package/container build, compatibility, migration/rollback/recovery, backup/restore, SBOM/provenance/reproducibility, and protected-main operational acceptance on one unchanged integrated revision. diff --git a/docs/THREAT_MODEL.md b/docs/THREAT_MODEL.md index 4ab6d0a58..d737c348e 100644 --- a/docs/THREAT_MODEL.md +++ b/docs/THREAT_MODEL.md @@ -2,69 +2,141 @@ **Status:** Implemented on active PR +Protected-main source and tests are the current control evidence. Active PR controls remain non-shipped until integration. + ## Assets -- tenant-owned planning/habit/review/calendar data; -- account/session/authentication provenance; -- provider credentials and signing keys; -- AI proposal/evidence/decision records; -- privacy grants and data-rights receipts; -- backup/release artifacts and CI evidence. +- tenant-owned Planning, Habit, Review, Calendar, Notification, AI, Privacy, and Plugin data; +- account, workspace membership, sessions, and authentication-age provenance; +- provider credentials, secret references, signing/MAC keys, and KMS authority; +- AI proposals, evidence, and explicit decisions; +- data-rights requests, contributor exports/receipts, aggregate terminal evidence, and protected artifacts; +- plugin installations, grants, credential bindings, operator replay evidence, and future delivery outcomes; +- database migrations, backups, release artifacts, SBOM/provenance, CI/SARIF/status evidence, and operator recovery records. ## Trust boundaries ```mermaid flowchart LR - Browser[Untrusted browser inputs] --> Web[Authenticated web/BFF] - Web --> Identity[Identity service] - Web --> Planning[Planning service] - Web --> Calendar[Calendar service] - Web --> AI[AI proposal service] - Web --> Privacy[Privacy service] - Identity --> IDB[(identity-owned store)] - Planning --> PDB[(planning-owned store)] - Calendar --> CProvider[Untrusted calendar provider] + Browser[Untrusted browser] --> Web[Authenticated Web / Gateway] + Web --> Identity[Identity] + Web --> Planning[Planning] + Web --> Habit[Habit] + Web --> Review[Review] + Web --> Calendar[Calendar Integration] + Web --> Notification[Notification] + Web --> AI[AI Proposal] + Web --> Privacy[Privacy] + Web --> Plugin[Plugin Integration] + + Identity --> IDB[(Identity-owned DB)] + Planning --> PDB[(Planning-owned DB)] + Habit --> HDB[(Habit-owned DB)] + Review --> RDB[(Review-owned DB)] + Calendar --> CDB[(Calendar-owned DB)] + Notification --> NDB[(Notification-owned DB)] + AI --> ADB[(AI-owned DB)] + Privacy --> VDB[(Privacy-owned DB)] + Plugin --> XDB[(Integration-owned DB)] + + Calendar --> CalendarProvider[Untrusted calendar provider] + Calendar --> SecretStore[Secret store / KMS] AI --> Model[Untrusted model provider] - AI --> ADB[(AI-owned store)] - Privacy --> VDB[(privacy-owned store)] + Plugin --> PluginSecretStore[Plugin secret store / KMS] + Plugin -. future bounded delivery .-> Network[Untrusted network endpoint] ``` -Co-location on one PostgreSQL cluster does not create shared-table authority. Each service owns its role/schema/migrations. +Co-location on one PostgreSQL cluster never creates shared-table authority. Every service owns its schema/role/migrations and cannot borrow another service's credentials. ## Threats and controls -| Threat | Boundary | Primary controls | Current state | +| Threat | Boundary | Primary controls | Status | | --- | --- | --- | --- | -| Tenant/workspace injection | browser -> services | authenticated/signed context; reject legacy/client ownership | Implemented on protected main | -| Cross-service DB privilege confusion | service -> PostgreSQL | service-owned credentials/schema/migrations; no cross-service table access | Implemented on protected main | -| OAuth state/redirect confusion | identity/provider | bounded transaction, state and redirect validation | Implemented on protected main | -| Calendar workspace spoofing | web/calendar | signed workspace/method/path/issuance context | Implemented on protected main | -| Calendar token theft/replay | calendar/provider | per-user encrypted lifecycle, refresh/revocation, PKCE/state | Partial — #129 | -| Stale multi-device overwrite | web/planning | strong preconditions, revisions, explicit conflict reconciliation | Implemented on protected main | -| Replay/duplicate side effects | mutable domains | idempotency keys, immutable outcomes, fencing where applicable | Implemented on protected main | -| AI prompt injection / silent mutation | model/AI | model output as untrusted inert proposal; deterministic validation; explicit decision | Implemented on protected main | -| Sensitive-data overexposure | privacy/public surfaces | purpose/resource/lifetime grants; bounded logs/errors/artifacts | Implemented on protected main | -| Data-rights false completion | identity/domain participants | durable request identity; immutable receipt; explicit participant/reconciliation contract | Partial — #55 | -| Plugin self-escalation/SSRF/secret leak | plugin integration | explicit grants, encrypted handles, authorized origins, rebinding/redirect/size/time controls | Planned — #130 | -| CI evidence identity confusion | GitHub workflow | explicit source-head vs merge-tree/live-base evidence classes | Partial — #132 | -| Backup corruption/unsafe restore | operator/backup | checksums, validation, non-empty target refusal | Implemented on protected main | - -## AI-specific controls - -AI proposals remain inert and auditable. Browser credentials and provider secrets are not model inputs. Live-provider availability cannot fabricate deterministic merge success. Deeper orchestration is permitted only after measured quality/control evidence over a strong single-route baseline. +| Tenant/workspace/actor injection | Browser -> services | authenticated session or exact signed context; reject client-selected authority | Implemented on protected main | +| Method/path replay of signed context | Gateway -> services | exact method/path/version/issuance binding; one-time evidence where destructive | Implemented on protected main | +| Cross-service database privilege confusion | Service -> PostgreSQL | service-owned roles/schemas/migrations; no cross-table access | Implemented on protected main | +| OAuth state/redirect confusion | Identity -> provider | bounded transaction, state, provider, redirect/origin validation | Implemented on protected main | +| Calendar workspace/user substitution | Gateway -> Calendar | `life-os.calendar-user.v1`, exact returned evidence validation | Implemented on protected main | +| Orphaned calendar credential material | Calendar -> secret store/repository | secret-first persistence, reverse-order compensation, no caller-visible handles | Implemented on protected main | +| Calendar credential theft/replay | Calendar -> provider/KMS | opaque references, materialization port, concrete KMS/OAuth/refresh/revoke lifecycle | Partial | +| Stale multi-device overwrite | Web -> Planning | strong preconditions, versioning, ordered locks, explicit reconciliation | Implemented on protected main | +| Review/Habit/Planning authority replay | Gateway/contributor -> owner | exact request-bound signatures and atomic destructive replay guards | Implemented on protected main | +| Reminder duplicate delivery | Notification worker | fenced/expiring claims, idempotency, immutable outcomes | Implemented on protected main | +| AI prompt injection or silent mutation | Model -> AI/product | untrusted inert proposal, deterministic validation, explicit decision, no mutation bus | Implemented on protected main | +| Sensitive-data overexposure | Privacy/public/CI | tenant/purpose/resource/lifetime grants; bounded credential-free evidence | Implemented on protected main | +| Data-rights participant omission/false completion | Identity -> contributors | explicit versioned registry, owner verification, immutable aggregate receipt | Partial | +| Data-rights cross-tenant export/erase | Identity/contributor -> owner DB | exact workspace/actor/request binding, owner SQL only, deterministic evidence | Partial | +| Plugin manifest self-escalation | Manifest -> host | explicit host grant subset; manifest is intent only | Implemented on protected main | +| Plugin credential leakage | Host -> secret store/DB/public view | plaintext only at secret-store port; opaque binding record; compensation | Implemented on protected main | +| Plugin operator replay/identity substitution | Operator -> integration | exact one-time signed request, durable atomic replay evidence, fail-closed HTTP | Implemented on protected main | +| Plugin SSRF/DNS rebinding/outbound abuse | Integration -> network | separately host-authorized origins, address validation/pinning, redirect/proxy/size/time limits | Partial | +| Model credential or agent authority escalation | GitHub/model boundary | `NVIDIA_NIM_API_KEY` scoped to reviewed bridge; no review/merge/release authority | Accepted architecture | +| Dependency lifecycle-script escalation | Package install -> runner | exact pinned package and narrow build allowlist | Implemented on protected main | +| CI evidence identity confusion | GitHub workflows | explicit source/base/integration/checkout/protected/release identities | Partial | +| Backup corruption or unsafe restore | Operator -> storage | integrity manifest, safe-target refusal, readiness verification | Implemented on protected main | +| Release provenance mismatch | GitHub -> artifacts/deployment | exact protected source, SBOM/provenance/reproducibility and publish verification | Partial | + +## Protected authority milestones + +- PR #168 and PR #188 protect Planning tenant and request binding. +- PR #173 protects Habit tenant authority. +- PR #185 protects Review request-bound authority. +- PR #190 protects integration event request binding. +- PR #191 and PR #196 protect plugin operator one-time authority and HTTP composition. +- PR #157, PR #176, PR #189, PR #193, and PR #197 protect Calendar disconnect, returned evidence, read, materialization, and create boundaries. +- PR #159 protects the contributor contract; PR #179/PR #194 protect Planning contribution/transport; PR #184/PR #192 protect Habit contribution/transport. + +These milestones narrow but do not erase parent-gap threats. + +## Calendar abuse cases + +- forged workspace/user/connection UUIDs fail before secret materialization or SQL; +- returned connection rows whose identity differs from the exact lookup fail closed; +- connection reads omit secret handles and plaintext material; +- local disconnect cannot be interpreted as provider revoke success; +- secret-first create failure compensates newly written handles without returning them; +- PR #201 protects compensation when persistence returns invalid durable evidence; +- unavailable concrete KMS/OAuth/refresh/provider cleanup remains explicit under #129. ## Data-rights abuse cases -- forged request/workspace/user UUIDs fail before SQL; +- forged request/workspace/user/contributor UUIDs fail before SQL; - cross-workspace or cross-requesting-user status lookup returns no existence signal; -- duplicate/corrupt persisted request rows fail closed; -- session rotation does not reset authentication age; -- whole-product erasure is not claimed until every required domain is reconciled. +- duplicate, corrupt, ambiguous, or malformed persisted rows fail closed; +- session rotation cannot reset recent-authentication age; +- a contributor cannot read or delete another service's tables; +- exact destructive replay returns bounded existing evidence; conflicting reuse fails; +- unknown, unavailable, or omitted contributors prevent terminal whole-product success; +- export digests are not treated as authorization, confidentiality, or signer identity; +- Review PR #195, Notification PR #198, and AI PR #199 are active-PR evidence only. + +## Plugin abuse cases + +- a manifest requesting undeclared or ungranted capabilities cannot self-escalate; +- cross-workspace/installer/installation/binding identifiers fail closed; +- mismatched returned installation or binding evidence cannot become authority; +- exact credential replay cannot rematerialize or overwrite a secret; +- revocation ends durable authority before external cleanup and retries never restore it; +- operator authority is bound to exact request path/method and one-time evidence; +- no operator route grants arbitrary SQL, filesystem, subprocess, tool, or network access; +- outbound URLs remain untrusted until the separate #130 authority/runtime exists. + +## AI and development-model controls + +AI proposals remain inert and auditable. Model content cannot authorize product mutation. Live-provider availability cannot fabricate deterministic merge success. + +A strong single-route baseline precedes deeper orchestration. Conducted workflows are selected only from retained repository-specific quality/safety evidence under documented comparable budgets. `NVIDIA_NIM_API_KEY` is scoped to the reviewed model-call bridge; raw prompts/responses and hidden reasoning are not retained as public evidence. Protected PR #200 is bootstrap hardening, not model authority. + +## Verification and supply-chain controls + +PR #154 separates exact contributor-source evidence from independently reconstructed live-base compatibility. Issue #132 remains **Partial** because central reusable scanner checkout/SARIF/status taxonomy is not yet fully machine-auditable. + +Pending, queued, skipped, cancelled, absent, neutral, stale, predecessor, status-only, synthetic-only, model-only, and rate-limited evidence is non-passing. Package lifecycle scripts remain denied except for an exact reviewed need; PR #200 is **Implemented on protected main** for the pinned OpenCode package only. ## Failure and recovery -Dependency outage returns sanitized unavailable evidence and never false durable success. Partial durable workflows retain replay/reconciliation identity. Restore/migration/release claims require explicit evidence appropriate to the changed state. +Dependency outages return sanitized unavailable evidence and never false durable success. Partial external cleanup retains exact retry identity without restoring revoked authority. Corrupt durable evidence triggers fail-closed classification. Restore/migration/release claims require integrity, compatibility, rollback/recovery, and exact source/provenance evidence appropriate to the changed state. ## Review triggers -Update this threat model when a service gains new persistence/credential/network authority, a new external provider is introduced, the plugin runtime becomes executable, data-rights orchestration changes, or required verification evidence classes change. \ No newline at end of file +Update this threat model whenever a service gains persistence, credential, network, destructive, model, or release authority; a provider or contract version changes; a parent gap closes; an active PR integrates; required verification identity semantics change; or a recovery path can create orphaned external material. diff --git a/docs/TRACEABILITY.md b/docs/TRACEABILITY.md index 2ec20c8a4..10e6a566e 100644 --- a/docs/TRACEABILITY.md +++ b/docs/TRACEABILITY.md @@ -2,76 +2,115 @@ **Status:** Implemented on active PR -Protected-main source/migrations/tests and live repository policy outrank this index. Active PR evidence is never shipped truth. +Protected-main source/migrations/tests and live repository policy outrank this index. Active-PR evidence remains non-shipped until integration. + +## Requirement traceability | Requirement / decision | Status | Representative evidence | Open follow-up | | --- | --- | --- | --- | -| PRD-ID-001 login/session/workspace authority | Implemented on protected main | identity OAuth/session runtime | — | -| PRD-ID-002 opaque UUIDv4 internal IDs | Implemented on protected main | validators/migrations + ADR 0001 | — | -| PRD-PLAN-001 durable Goals/Projects/Tasks | Implemented on protected main | planning repository/migrations | — | -| PRD-PLAN-002 durable Today synchronization | Implemented on protected main | PR #127 + concurrency/browser evidence | — | -| PRD-PLAN-003 signed workspace authority on every public Goal/Project/Task route | Implemented on active PR | PR #160 | protected integration and hosted gateway composition | -| PRD-HAB-001 recurring habits | Implemented on protected main | habit service persistence/tests | — | -| PRD-HAB-002 signed workspace authority on every public Habit route | Implemented on active PR | PR #162 | protected integration and hosted gateway composition | -| PRD-REV-001 review projection boundary | Implemented on protected main | review-service tests | — | -| PRD-REV-002 signed workspace authority on guided-review completion/history routes | Implemented on active PR | PR #165 | protected integration and hosted gateway composition | -| PRD-CAL-001 conflict-safe calendar sync | Implemented on protected main | provider adapters | — | -| PRD-CAL-002 trusted workspace calendar context | Implemented on protected main | PR #139 | — | -| PRD-CAL-003 complete hosted per-user calendar credential lifecycle | Partial | protected foundations below | issue #129 | -| PRD-CAL-004 workspace+user calendar connection persistence | Implemented on protected main | PR #150 / `1623df364925f84920c07c112f1ae96777277d20` | #129 | -| PRD-CAL-005 atomic tenant+user calendar connection revocation | Implemented on protected main | PR #153 / `b13413e571bad82535f63d478e40746d12c3e680` | provider-side revoke remains #129 | -| PRD-CAL-006 signed workspace+user calendar authority | Implemented on protected main | PR #155 / `7b34a5a584b037653d091ea661ae4627bb5dd2ea` | hosted connection/disconnect runtime #129 | -| PRD-CAL-007 authenticated local calendar disconnect boundary | Implemented on active PR | PR #157 | provider/KMS revoke and complete hosted lifecycle #129 | -| PRD-NOT-001 bounded reminders | Implemented on protected main | notification persistence/scheduler tests | — | -| PRD-AI-001 inert auditable proposals | Implemented on protected main | AI proposal/audit tests | — | -| PRD-AI-002 deterministic/live-provider separation | Implemented on protected main | proposal evaluator + bounded live conformance | — | -| PRD-PRIV-001 purpose-bound sensitive access | Implemented on protected main | privacy-service evidence | — | -| PRD-PRIV-002 recent-auth + durable rights request ledger | Implemented on protected main | #134/#136/#137/#138/#144 | #55 | -| PRD-PRIV-003 complete export/delete orchestration | Partial | protected rights/integrity/contributor-contract foundations exist | #55 | -| PRD-PRIV-004 authenticated bounded rights status | Implemented on protected main | PR #146 | #55 | -| PRD-PRIV-005 per-section export integrity evidence | Implemented on protected main | PR #149 | #55 | -| PRD-PRIV-006 versioned service-owned data-rights contributor lifecycle contract | Implemented on protected main | PR #159 / `c88016e9f980d99054e9cb0886ee78377b5d0be9` | concrete service adapters, reconciliation and delivery remain #55 | -| PRD-INT-001 plugin SDK/manifest validation | Implemented on protected main | plugin SDK/integration tests | — | -| PRD-INT-002 complete plugin secret/outbound delivery runtime | Partial | protected grant authority + active durable persistence | #130 | -| PRD-INT-003 explicit tenant-scoped plugin installation grants | Implemented on protected main | PR #151 / `6971c4e11b3204ec41526c7c959a248e54440e1c` | #130 | -| PRD-INT-004 durable plugin installation persistence | Implemented on active PR | PR #156; workspace+installing-user-scoped migration/repository | #130 secret/delivery runtime | +| PRD-ID-001 login/session/workspace/authentication-age authority | Implemented on protected main | Identity runtime and migrations | — | +| PRD-ID-002 opaque UUIDv4 internal/public product IDs | Implemented on protected main | validators/migrations + ADR 0001 | — | +| PRD-PLAN-001 durable Goals/Projects/Tasks/search | Implemented on protected main | Planning repositories/migrations | — | +| PRD-PLAN-002 durable Today synchronization | Implemented on protected main | PR #127 | — | +| PRD-PLAN-003 signed and exact request-bound Planning authority | Implemented on protected main | PR #168 and PR #188 | — | +| PRD-HAB-001 recurring habits/completion evidence | Implemented on protected main | Habit persistence/tests | — | +| PRD-HAB-002 signed Habit authority and replay-safe contributor transport | Implemented on protected main | PR #173 and PR #192 | — | +| PRD-REV-001 guided Review projection/persistence boundary | Implemented on protected main | Review service tests | — | +| PRD-REV-002 exact request-bound signed Review authority | Implemented on protected main | PR #185 | — | +| PRD-CAL-001 conflict-safe Google/CalDAV synchronization | Implemented on protected main | Calendar provider tests | — | +| PRD-CAL-002 signed workspace synchronization context | Implemented on protected main | PR #139 | — | +| PRD-CAL-003 complete per-user encrypted provider credential lifecycle | Partial | protected foundations below | issue #129 | +| PRD-CAL-004 workspace+user connection metadata and opaque handles | Implemented on protected main | PR #150 | issue #129 | +| PRD-CAL-005 atomic local connection revocation | Implemented on protected main | PR #153 | provider cleanup #129 | +| PRD-CAL-006 signed workspace+user hosted authority | Implemented on protected main | PR #155 | — | +| PRD-CAL-007 authenticated disconnect/read/materialization/create with exact returned evidence | Implemented on protected main | PR #157, PR #176, PR #189, PR #193, PR #197 | issue #129 | +| PRD-CAL-008 returned-create-evidence secret compensation | Implemented on protected main | PR #201 | — | +| PRD-NOT-001 bounded reminders and durable outcomes | Implemented on protected main | Notification migrations/scheduler tests | — | +| PRD-AI-001 inert auditable proposals and explicit decisions | Implemented on protected main | AI proposal/audit tests | — | +| PRD-AI-002 deterministic/live-provider separation | Implemented on protected main | evaluator/live-conformance split | — | +| PRD-PRIV-001 purpose-bound sensitive access | Implemented on protected main | Privacy service | — | +| PRD-PRIV-002 recent-auth + durable request/receipt/status | Implemented on protected main | Identity data-rights foundations | issue #55 parent remains | +| PRD-PRIV-003 complete cross-domain export/deletion/reconciliation/delivery | Partial | protected and active contributors below | issue #55 | +| PRD-PRIV-004 deterministic export integrity evidence | Implemented on protected main | export manifest tests | issue #55 parent remains | +| PRD-PRIV-005 versioned service-owned contributor lifecycle | Implemented on protected main | PR #159 | issue #55 | +| PRD-PRIV-007 Planning contributor and authenticated transport | Implemented on protected main | PR #179 and PR #194 | issue #55 | +| PRD-PRIV-008 Habit contributor and authenticated transport | Implemented on protected main | PR #184 and PR #192 | issue #55 | +| PRD-PRIV-009 Review/Notification/AI contributors | Implemented on active PR | PR #195, PR #198, PR #199 | integrate; remaining owners/reconciliation | +| PRD-INT-001 plugin SDK/manifest/event validation | Implemented on protected main | Plugin SDK/integration tests | — | +| PRD-INT-002 complete concrete secret/outbound delivery runtime | Partial | protected authority foundations below | issue #130 | +| PRD-INT-003 explicit host-owned installation grants | Implemented on protected main | PR #151 | issue #130 parent remains | +| PRD-INT-004 durable exact plugin installation authority | Implemented on protected main | PR #169 and PR #175 | issue #130 | +| PRD-INT-005 opaque credential-binding secret references | Implemented on protected main | PR #172 | concrete KMS #130 | +| PRD-INT-006 one-time request-bound operator authority and HTTP composition | Implemented on protected main | PR #191 and PR #196 | delivery runtime #130 | | PRD-WEB-001 accessible localized PWA | Implemented on protected main | browser/accessibility/localization tests | — | -| PRD-WEB-002 public Gateway Today endpoint must not return fabricated success | Implemented on active PR | PR #164 | issue #163 remains until authenticated Planning/Habit composition is real | -| PRD-OPS-001 backup/restore | Implemented on protected main | backup scripts/tests/runbook | — | -| PRD-OPS-002 provider-neutral deployment/readiness/metrics | Implemented on protected main | infra/observability tests | — | -| PRD-GOV-001 buyer-gap vs capability-maturity separation | Implemented on protected main | readiness registry | — | -| PRD-GOV-002 exact source/live-base/integration evidence attribution | Implemented on protected main | ADR 0010 + PR #154 merged as `2c272a404f8f3a74aa5796a1957d4a6ce0fabe8f`; #147 Superseded | #132 remains for residual central scanner evidence classification | +| PRD-WEB-002 authenticated real Planning/Habit Today composition | Implemented on protected main | PR #186 and PR #187; Issue #163 completed | — | +| PRD-OPS-001 logical backup/restore integrity | Implemented on protected main | scripts/tests/runbook | — | +| PRD-OPS-002 provider-neutral deployment/readiness/metrics | Implemented on protected main | infrastructure/observability tests | — | +| PRD-GOV-001 buyer-gap vs capability-maturity separation | Implemented on protected main | Commercial Readiness registry | — | +| PRD-GOV-002 exact source/live-base/integration evidence separation | Implemented on protected main | PR #154 + ADR 0010 | Issue #132 remains Partial | +| PRD-GOV-003 exact pinned OpenCode bootstrap policy | Implemented on protected main | PR #200 | fresh protected scheduled-run verification | +| Integration event exact request authority | Implemented on protected main | PR #190 | — | ## Architecture decisions | Decision | Status | Evidence | | --- | --- | --- | -| Server-backed self-hostable MSA supersedes browser-only primary architecture | Accepted architecture | Architecture + ADR 0009 | +| Server-backed self-hostable modular MSA supersedes browser-only primary architecture | Accepted architecture | Architecture + ADR 0009 | | UUIDv4 supersedes UUIDv7 | Accepted architecture | ADR 0001 | | Service-owned persistence/no cross-table authority | Accepted architecture | ADR 0003 | | AI remains inert proposal evidence | Accepted architecture | ADR 0004 | | Purpose-bound sensitive access | Accepted architecture | ADR 0005 | -| Capability maturity != buyer-gap exhaustion | Accepted architecture | ADR 0008 | -| Canonical documentation uses explicit maturity | Accepted architecture | ADR 0007 | -| Verification identities remain separate | Accepted architecture | ADR 0010 + protected PR #154 | -| Integration identity, metadata, secret references and grants remain separate | Accepted architecture | ADR 0011 + protected #150/#151/#153/#155 + active #156/#157 | -| Test-time compute and model-assisted development authority remain evidence-driven and separate from review/merge/release authority | Accepted architecture | ADR 0012 + protected `AGENTS.md` + live-conformance design + Fugu/Conductor/TRINITY/strong-single-agent evidence | +| Capability maturity differs from buyer-gap exhaustion | Accepted architecture | ADR 0008 | +| Canonical documentation uses exact maturity vocabulary | Accepted architecture | ADR 0007 | +| Verification identities remain separate | Accepted architecture | ADR 0010 + PR #154 | +| Integration identity, metadata, secret references, and grants remain separate | Accepted architecture | ADR 0011 + protected Calendar/Plugin lines | +| Strong-route model baseline and deterministic review/merge/release authority remain separate | Accepted architecture | ADR 0012 + Fugu/Conductor/TRINITY/counterevidence | -## Evidence hierarchy +## Protected-main authority chronology since the prior canonical snapshot -1. protected-main source/migrations/tests/live policy; -2. exact current active-PR source/tests labeled active; -3. accepted Architecture/ADRs; -4. canonical product/technical/data/UML/security/operability documents; -5. issues/plans/research for incomplete work; -6. historical chat/old PRs as rationale only. +- PR #157: authenticated Calendar disconnect. +- PR #159: versioned data-rights contributor lifecycle. +- PR #168 and PR #188: Planning signed/request-bound authority. +- PR #169, PR #172, and PR #175: plugin durable installation, opaque credential binding, and exact evidence validation. +- PR #173: Habit signed authority. +- PR #176 and PR #189: Calendar exact lookup and authenticated read. +- PR #179 and PR #194: Planning contributor and authenticated transport. +- PR #184 and PR #192: Habit contributor and authenticated transport. +- PR #185: Review request-bound authority. +- PR #186 and PR #187: real authenticated Today composition. +- PR #190: request-bound integration event authority. +- PR #191 and PR #196: plugin operator one-time authority and fail-closed HTTP composition. +- PR #193: scoped Calendar credential materialization port. +- PR #197: authenticated Calendar connection creation. +- PR #201: returned-create-evidence validation and reverse-order secret compensation. + +## Active-PR evidence + +| Pull request | Status | Bounded meaning | +| --- | --- | --- | +| PR #145 | Implemented on active PR | this canonical documentation successor | +| PR #195 | Implemented on active PR | Review-owned data-rights contributor | +| PR #198 | Implemented on active PR | Notification-owned data-rights contributor | +| PR #199 | Implemented on active PR | AI-owned data-rights contributor and additive cursor contract | +| PR #200 | Implemented on protected main | exact pinned OpenCode bootstrap allowlist repair | -`source_head_sha`, `pr_base_snapshot_sha`, `live_base_tip_sha`, integration/synthetic tree identity, workflow checkout identity, protected-main head and release source are distinct evidence authorities. A green result never transfers from one identity to another. +No active row is shipped truth. Pending CI, draft state, unresolved review, branch movement, predecessor evidence, and merge compatibility remain independently evaluated. ## Buyer-gap state -Canonical buyer gaps remain #55, #129 and #130. Protected #146/#149/#159 advance #55; protected #150/#153/#155 plus active #157 advance #129; protected #151 plus active #156 advance #130. None closes its parent gap by implication. Issue #163 is an additional product-truthfulness gap: active #164 removes fabricated Gateway Today success but the issue remains open until authenticated Planning/Habit composition exists. Active #160/#162/#165 harden Planning/Habit/Review tenant authority and remain non-shipped until integration. Issue #132 is now a narrower verification-governance gap: protected #154 fixed LifeOS source/live-base/integration evidence separation, while residual central SAST/Security scanner checkout/attribution taxonomy still requires auditable classification. +Canonical buyer gaps remain #55, #129 and #130. Protected contributor, Calendar, and Plugin authority narrows them but does not close them. Issue #132 remains **Partial** as a verification-governance issue, not a canonical buyer-visible product gap. Issue #148 remains open until this exact documentation successor integrates. Issue #163 is completed by protected real Planning/Habit Today composition. + +## Evidence hierarchy + +1. protected-main source, migrations, tests, and live policy; +2. exact current active-PR source/tests labeled active; +3. accepted Architecture and ADRs; +4. canonical product/technical/data/UML/security/privacy/operability documents; +5. issues/plans/research for incomplete work; +6. historical chat, old PR bodies, old checks, and old SHAs as rationale only. + +`source_head_sha`, `pr_base_snapshot_sha`, `live_base_tip_sha`, integration/synthetic identity, `workflow_checkout_sha`, `protected_main_sha`, and `release_source_sha` remain distinct. A green result never transfers across identities. ## Update rule -When maturity changes, reconcile PRD, this index and every materially affected ADR/Architecture/Data/UML/API/Security/Privacy/Operability view. Never promote active work to protected-main truth before integration. +When maturity changes, reconcile PRD, TRD, Architecture, Data Model, UML, API, Threat Model, Privacy, Operability, Release, Standards, this index, Documentation Assessment, README/CLAUDE/CHANGELOG discoverability, and executable documentation contracts. Never promote active work before protected integration. diff --git a/docs/TRD.md b/docs/TRD.md index f255aeee3..6a4f0d298 100644 --- a/docs/TRD.md +++ b/docs/TRD.md @@ -2,147 +2,147 @@ **Status:** Implemented on active PR -## Purpose - -This document defines repository-wide technical requirements. Owning-service code, migrations, tests, versioned contracts and runbooks remain the implementation authority. +This TRD defines repository-wide technical requirements. Protected-main code, migrations, tests, workflow policy, and owning-service runbooks remain the implementation authority. ## Runtime baseline -LifeOS is a TypeScript-first monorepo with a Next.js PWA/BFF, independently bounded services, PostgreSQL service-owned persistence and NATS JetStream where durable asynchronous events are required. Optional external providers include Google/GitHub identity, Google/CalDAV calendar providers, NVIDIA NIM through approved AI boundaries, and versioned plugins. +LifeOS is a TypeScript-first monorepo with a Next.js PWA/BFF, independently bounded services, service-owned PostgreSQL persistence, and NATS JetStream where durable asynchronous delivery is required. Optional providers include Google/GitHub identity, Google/CalDAV calendar, NVIDIA NIM through reviewed AI boundaries, and versioned plugins. ## Bounded contexts -- **Web/PWA:** interaction state and explicitly local drafts/cache; never direct DB authority. -- **Gateway/BFF:** public composition and authenticated context derivation; not a shared domain store. -- **Identity:** internal users, external identity mappings, sessions, workspace membership/authorization context, authentication provenance, data-rights request/receipt authority and export-integrity composition. -- **Planning:** Goals, Projects, Tasks, durable Today aggregate and search. -- **Habit:** recurrence definitions and completion evidence. -- **Review:** review snapshots/projections; no direct planning mutation. -- **Calendar integration:** provider adapters, sync state, trusted workspace and workspace+user signed context, and protected-main workspace+user scoped connection persistence/revocation. Complete hosted credential lifecycle remains partial under #129. -- **Notification:** reminder occurrences, claims, outcomes and delivery recovery. -- **AI proposal:** proposals, evidence, explicit decisions and deterministic evaluation; no generic planning mutation authority. +- **Web/PWA:** interaction state, accessibility/localization, and explicitly local drafts/cache; no database authority. +- **Gateway/BFF:** authenticated public composition and short-lived service-context derivation; no shared domain store. +- **Identity:** users, provider mappings, sessions, workspace authority, authentication provenance, data-rights request/receipt orchestration, and export-integrity composition. +- **Planning:** Goals, Projects, Tasks, search, durable Today, and a protected data-rights contributor. +- **Habit:** recurring definitions/completions and a protected data-rights contributor. +- **Review:** guided-review persistence/projections; PR #195 is **Implemented on active PR** for its contributor. +- **Calendar Integration:** synchronization, connection metadata, workspace/user authority, credential ports, read/create/disconnect surfaces; complete hosted provider lifecycle remains **Partial** under #129. +- **Notification:** reminder occurrences/claims/outcomes; PR #198 is **Implemented on active PR** for its contributor. +- **AI Proposal:** inert proposals/evidence/decisions/evaluation; PR #199 is **Implemented on active PR** for its contributor. - **Privacy:** purpose-bound sensitive-access decisions/grants/events. -- **Plugin integration:** versioned plugin contracts, validation and protected-main explicit installation-grant authority; PR #156 is active for restart-safe installation persistence. Complete secret/delivery runtime remains partial under #130. +- **Plugin Integration:** contracts, installation/grant/credential/operator authority; delivery runtime remains **Partial** under #130. -## Data requirements +## Persistence and data requirements -1. Each service owns persistence, migrations and DB credentials; cross-service table access is prohibited. -2. Internal durable identifiers are opaque UUIDv4. -3. Product-owned database objects use descriptive multiword `snake_case`. -4. Persist instants in UTC and IANA timezone/local-calendar values where civil-time semantics matter. -5. Immutable audit/decision/completion/receipt evidence rejects mutation; mutable state uses explicit revision/digest/ETag/idempotency/fencing where loss or replay is plausible. -6. Browser-local state is not durable until the owning service accepts it. -7. Logical cross-service references do not create physical foreign-key or SQL authority across service-owned schemas. -8. External provider credentials remain behind least-authority secret boundaries and are not reused as identity or primary-key material. +1. Each service owns schemas/roles, migrations, repositories, credentials, transaction boundaries, backup semantics, and shutdown behavior. +2. Cross-service table reads, writes, joins, foreign keys, triggers, and shared mutation roles are prohibited. +3. Internal durable identifiers are opaque UUIDv4. +4. Product-owned database objects use descriptive multiword `snake_case`. +5. Instants use UTC; civil-time behavior also retains explicit IANA timezone/local-calendar evidence. +6. Immutable audit/decision/completion/receipt evidence rejects mutation. Mutable state uses revision, digest, ETag, idempotency, advisory locking, or fencing where loss/replay is plausible. +7. Browser-local state is not durable until the owning service accepts it. +8. External credentials remain behind least-authority secret-store/KMS ports and never become identity or primary-key material. +9. Persisted external identifiers are bounded metadata; opaque secret references are separate fields with separate authority. +10. Corrupt or ambiguous persisted evidence fails closed before it can become application authority. ## Authentication and authorization -- OAuth/OIDC callbacks validate state, provider and redirect boundaries. +- OAuth callbacks validate state, provider, redirect/origin, and bounded transaction lifetime. - Browser sessions are revocable and server-verifiable. -- Authentication ceremony time is preserved separately from compatible session issuance/rotation time. -- Client-selected workspace/actor identifiers are never trusted as authority. -- Signed private context binds exact actor/workspace/method/path and bounded issuance time where service separation requires it. -- Calendar synchronization uses the trusted signed workspace context implemented on protected main; legacy workspace headers cannot override it. -- User-sensitive hosted calendar operations use the protected `life-os.calendar-user.v1` context from PR #155, binding workspace and requesting user under a version distinct from workspace-only sync authority. -- Sensitive operations add purpose/resource/tenant authorization and, for data rights, recent-authentication policy derived from authentication provenance rather than session rotation. -- Plugin capabilities are host-granted authority; a manifest expresses requested intent only. - -## HTTP/API requirements - -- Bound bodies and provider responses before retention. -- Derive ownership from authenticated/signed context. -- Use replay protection for repeatable mutations. -- Use explicit stale-write preconditions where silent overwrite is unacceptable. -- Return bounded credential-free problems. -- Never expose dependency bodies, credentials, stack traces or internal URLs. -- Version breaking shared-contract semantics. -- Sensitive status resources use non-cacheable semantics and omit unrelated tenant/credential/idempotency/digest internals. - -### Data-rights public status +- Authentication ceremony time survives compatible session rotation. +- Browser-selected workspace, actor, installation, connection, or request identifiers are never ownership authority. +- Signed private contexts bind exact workspace/actor, method, path, issuance, version, and one-time evidence where destructive replay matters. +- Planning protected authority comes from PR #168 and exact request binding from PR #188. +- Habit protected authority comes from PR #173; destructive contributor transport is protected by PR #192. +- Review exact request-bound authority is protected by PR #185. +- Calendar user-sensitive operations use `life-os.calendar-user.v1` from PR #155. +- Integration event authority is exact-request-bound through PR #190. +- Plugin operator authority is one-time and replay-protected through PR #191 and fail-closed HTTP composition through PR #196. + +## HTTP and application boundaries + +- Bound request bodies and provider/model responses before retention. +- Derive authority from authenticated or signed context. +- Reject unsupported media types and malformed JSON with bounded credential-free problems. +- Use explicit replay and stale-write controls. +- Do not forward browser cookies or provider secrets to downstream services. +- Never expose dependency bodies, stack traces, credentials, internal origins, secret handles, or raw tenant payloads in public failures. +- Version breaking shared-contract semantics; unknown versions fail closed. +- Sensitive status resources are non-cacheable and omit unrelated authority/digest/idempotency internals. + +### Today composition **Status:** Implemented on protected main -PR #146 exposes the protected request ledger through a browser-facing authenticated resource. The boundary derives workspace and requesting-user scope from validated session introspection, combines request/workspace/user scope without a widening lookup, exposes only bounded public lifecycle fields, makes absent and cross-tenant requests indistinguishable, maps malformed/auth/dependency cases to bounded failures, and applies `Cache-Control: no-store`. - -This endpoint is one lifecycle surface and does not imply complete cross-domain export/erasure orchestration. +PR #186 composes authenticated Planning Today state and PR #187 composes authenticated Habit Today state. The Gateway derives authority from the authenticated session, signs exact downstream requests, validates bounded responses, and does not fabricate success. Issue #163 is completed. -### Data-rights export integrity +### Data-rights contributor transport -**Status:** Implemented on protected main +**Status:** Partial -PR #149 requires each contributor export section to provide a versioned schema and safe non-negative business record count. LifeOS normalizes bounded JSON, uses locale-independent UTF-16 property ordering for deterministic hashing, computes a SHA-256 section digest over contributor/schema/count/data, and retains a whole-export digest. Digest evidence is not authorization, confidentiality, provenance or a digital signature. +PR #159 defines `life-os.data-rights-contributor.v1` with explicit export, erase-preflight, erase, and verify-erased operations. Planning production contribution is protected through PR #179 and authenticated request-bound transport through PR #194. Habit production contribution is protected through PR #184 and transport/replay hardening through PR #192. -### Calendar connection registry and local revocation - -**Status:** Implemented on protected main +PR #195, PR #198, and PR #199 are **Implemented on active PR** for Review, Notification, and AI contributions. They remain non-shipped until integration. Whole-product completion remains **Partial** under #55. -PR #150 defines the protected service-owned migration/repository for a connection scoped simultaneously to workspace and user, with bounded provider/account/calendar metadata, normalized scopes, opaque external credential references, fixed parameterized SQL and fail-closed duplicate persisted evidence. PR #153 adds an atomic tenant+user-scoped active-to-revoked transition. These foundations do not complete issue #129 or imply provider-side OAuth revocation. +### Calendar connection lifecycle -### Plugin installation authority +**Status:** Partial -**Status:** Implemented on protected main +Protected main includes: -PR #151 separates validated manifest intent from host authority. LifeOS grants only an explicit bounded capability subset, accepts exact replay, rejects conflicting installation-ID reuse, hides cross-tenant/user existence and preserves revocation evidence. It does not imply complete persistent secret or outbound-delivery runtime under #130. +- workspace/user scoped metadata persistence from PR #150; +- atomic local revoke from PR #153; +- signed user authority from PR #155; +- authenticated disconnect from PR #157; +- exact lookup evidence validation from PR #176; +- authenticated bounded read from PR #189; +- scoped credential materialization port from PR #193; +- authenticated secret-first create from PR #197; +- reverse-order compensation on mismatched returned durable evidence from PR #201. -### Plugin installation persistence +Concrete encrypted storage, OAuth/PKCE, refresh, provider cleanup, discovery/selection, and scoped synchronization remain **Partial** under #129. -**Status:** Implemented on active PR +### Plugin installation and operator lifecycle -PR #156 adds a service-owned `plugin_integration.plugin_installation_record` persistence foundation. Application and PostgreSQL read/revocation paths bind installation, workspace and installing-user authority; malformed or corrupt evidence fails closed. It stores installation authority/evidence only and does not add plugin credential plaintext, KMS lifecycle or outbound-delivery authority. +**Status:** Partial -## Event requirements +Protected main includes explicit host grants (PR #151), durable installation persistence (PR #169), opaque credential binding (PR #172), exact installation-evidence validation (PR #175), one-time operator authority/replay storage (PR #191), and authenticated fail-closed operator HTTP composition (PR #196). -Versioned events carry opaque event ID, explicit type/version, validated actor/workspace/correlation/causation context and immutable payload semantics. Consumers are idempotent under replay. Cross-service events never grant direct database mutation authority. +The runtime still requires a concrete secret-store/KMS adapter, separately host-authorized delivery origins, SSRF/DNS-rebinding-safe outbound HTTPS, attempt/outcome persistence, retry/dead-letter, revocation fencing, and operator-visible delivery recovery under #130. -## Domain concurrency/idempotency +## Domain concurrency and idempotency -- **Today:** protected-main aggregate uses explicit strong create/update preconditions, idempotency and stale-conflict handling with durable PostgreSQL concurrency evidence. +- **Today:** strong create/update preconditions, ordered locking, exact replay, stale conflict, and explicit reconciliation. - **Habit completion:** tenant-scoped replay-safe persistence. - **Notification:** expiring/fenced claims and duplicate-delivery refusal. -- **Calendar:** deterministic provider identity/preconditions, trusted context, protected tenant+user+connection repository invariants from #150 and atomic local revocation from #153. -- **AI decisions:** bind decision to exact proposal digest/revision, actor/workspace and idempotency identity. -- **Data rights:** durable request identity and immutable terminal receipts; status lookup is scoped simultaneously by request, workspace and requesting user and fails closed on corruption. -- **Plugin installation:** protected #151 requires exact replay/conflict/revocation semantics for host-granted authority; active #156 carries the same scope into restart-safe persistence. +- **Calendar:** exact connection/workspace/user authority, secret-first create compensation, deterministic provider preconditions, and local revoke replay. +- **AI decisions:** exact proposal digest/revision, actor/workspace, and idempotency binding. +- **Data rights:** exact request/workspace/actor/contributor/replay identity, immutable terminal evidence, and owner-controlled erasure verification. +- **Plugin installation/operator:** exact installation/workspace/installer/manifest/grant/secret-binding/request evidence and atomic replay refusal. + +## AI and repository automation requirements -## AI / automation requirements +ADR 0012 is authoritative. Model output is untrusted structured data. Deterministic validators, authorization, tests, independent review, merge, and release gates remain authoritative. -ADR 0012 is the durable test-time-compute/development authority. Model output is untrusted structured data. Deterministic validators and user/product authorization remain authoritative. Live provider availability is separated from deterministic merge gates. Scheduled autonomous development uses reviewed OpenCode or contextual-orchestrator with `NVIDIA_NIM_API_KEY`; `COPILOT_GITHUB_TOKEN` is prohibited as a development-model credential and independent review-agent credentials are not reused. +A strong single-route baseline precedes conducted/deeper orchestration. Evaluation records supported workflow stage, reasoning effort, decomposition, recursion depth, role-specific reasoning effort, model/worker selection, verifier topology, and access/communication topology. Unsupported controls remain explicit rather than simulated. -A strong single-route baseline precedes deeper orchestration. Evaluation records supported dimensions such as workflow stage, reasoning effort, role-specific reasoning effort, decomposition, recursion depth, worker/model selection, verifier topology and access-list/communication topology. Unsupported controls remain explicit rather than fabricated. Deeper orchestration is selected only from retained LifeOS quality/evidence under a documented reasonably comparable budget; latency/tokens/cost are measured but are not the sole or primary optimization objective. Model execution never becomes review, merge or release authority. +Scheduled development uses reviewed OpenCode or contextual-orchestrator with `NVIDIA_NIM_API_KEY`; `COPILOT_GITHUB_TOKEN` is prohibited. PR #200 is **Implemented on protected main** for allowing only the exact reviewed `opencode-ai` lifecycle script needed to materialize the pinned executable. Unrelated lifecycle scripts remain denied. -## Security/privacy requirements +## Security and privacy requirements -- Treat external responses, stored JSON, environment values, model output and connector results as untrusted. +- Treat external responses, stored JSON, environment values, model output, and connector results as untrusted. - Keep SQL structure static and parameterized. -- Use least-privilege GitHub/runtime/database permissions and bounded network/file/subprocess behavior. -- Public artifacts exclude credentials, raw model prompts/responses, hidden reasoning and unbounded tenant data. -- Sensitive access is purpose/lifetime/resource scoped with audit evidence; blanket masking is not the primary control. -- Data-rights end-to-end domain participation, durable reconciliation, retention/legal hold and protected export delivery remain partial under #55. +- Use least-privilege GitHub/runtime/database/network/file/subprocess permissions. +- No credential, browser session, secret reference, raw prompt/response, hidden reasoning, or unbounded tenant content enters public/CI/release evidence. +- Sensitive access is tenant/actor/purpose/resource/lifetime/audit bound. +- No service claims whole-right completion from partial or unknown contributor state. +- No manifest self-authorizes plugin capability or delivery origin. +- No local calendar revoke is promoted to provider revoke. -## Web/accessibility/localization +## Accessibility, localization, and offline behavior -Core journeys remain keyboard operable with visible focus and non-color-only state. Korean/English catalogs remain structurally aligned. Offline/local drafts must never imply durable sync until server acceptance. Stale async responses cannot overwrite newer owned UI state. +Core journeys remain keyboard-operable with visible focus, semantic names, non-color-only state, and localized Korean/English live feedback. Offline/local drafts remain visibly distinct from durable workspace state. Stale asynchronous responses cannot overwrite newer owned UI state. ## Observability and operations -Services expose bounded health/readiness appropriate to actual dependencies. Metrics are operator-only in production exposure. Logs are structured, bounded and credential-free. Logical backup/restore proves integrity and unsafe-target refusal; it does not imply PITR. Compose is a self-hosted composition profile and Kubernetes artifacts are a provider-neutral reference rather than managed infrastructure provisioning. +Services expose bounded health/readiness reflecting actual dependencies. Metrics are operator-only in production exposure. Logs are structured and credential-free. Logical backup/restore proves integrity and unsafe-target refusal but does not claim PITR. Compose is a self-hosted profile; Kubernetes is a provider-neutral reference, not managed surrounding infrastructure. ## Verification model **Status:** Accepted architecture -Required evidence classes retain explicit identities: - -- `source_head_sha`: exact contributor/source branch head for direct source verification; -- `pr_base_snapshot_sha`: GitHub PR/event base snapshot, historical once the live base moves; -- `live_base_tip_sha`: independently resolved current base-ref tip for base-sensitive decisions; -- `integration_tree_sha` or explicitly synthetic merge identity: separately classified compatibility evidence; -- `workflow_checkout_sha`: exact tree inspected by one evidence-producing job; -- `protected_main_sha`: integrated protected-main evidence identity; -- `release_source_sha`: exact protected source bound to release artifacts. - -A green result for one class cannot be promoted to another. SARIF/security evidence must be attributed to the commit/ref actually analyzed. PR #154 is implemented on protected main as `2c272a404f8f3a74aa5796a1957d4a6ce0fabe8f`: LifeOS source jobs and AppGuardrail attribution bind exact source, while the distinct compatibility path reconstructs the integration tree from fresh current source and live base. Issue #132 remains open only for residual central reusable SAST/Security checkout/evidence classification; a synthetic merge scan cannot be relabeled exact-source success. +`source_head_sha`, `pr_base_snapshot_sha`, independently resolved `live_base_tip_sha`, `integration_tree_sha`/synthetic identity, `workflow_checkout_sha`, `protected_main_sha`, and `release_source_sha` are separate authorities. PR #154 implements exact source and live-base compatibility separation. Issue #132 remains **Partial** for residual central scanner attribution taxonomy. ## Release requirements -Release requires one unchanged integrated protected head with required CI/security/review, exact configured coverage, package/container build, migration/rollback/recovery, accessibility/localization, SBOM/provenance/reproducibility and operational acceptance. A single merged feature or documentation PR is not release readiness. +Release requires one unchanged integrated protected head with required CI/security/review, exact configured coverage/docstrings, package/container build, SBOM/provenance/reproducibility, compatibility, migration/rollback/recovery, accessibility/localization, and operational acceptance. A single merged feature, queued job, documentation line, or model result is not release readiness. diff --git a/docs/UML.md b/docs/UML.md index 9c517f666..95f8c9d38 100644 --- a/docs/UML.md +++ b/docs/UML.md @@ -1,34 +1,46 @@ -# LifeOS UML and Interaction Views +# LifeOS UML, C4, Authority, and Recovery Views **Status:** Implemented on active PR -Sections are protected-main behavior unless explicitly labeled otherwise. +Protected-main behavior is labeled explicitly. Active-PR diagrams describe reviewed branch scope only and are not shipped truth. -## Bounded-context topology +## C4 bounded-context topology **Status:** Implemented on protected main ```mermaid flowchart LR - U[Web / PWA] --> B[Gateway / BFF] - B --> I[Identity] - B --> P[Planning] - B --> H[Habit] - B --> R[Review] - B --> C[Calendar] - B --> N[Notification] - B --> A[AI Proposal] - B --> V[Privacy] - B --> X[Plugin Integration] - P -. events .-> J[(NATS JetStream)] - H -. events .-> J - R -. projections/events .-> J - J -. reminder/event inputs .-> N + User[User / Operator] --> Web[Web / PWA] + Web --> Gateway[Gateway / BFF] + Gateway --> Identity[Identity] + Gateway --> Planning[Planning] + Gateway --> Habit[Habit] + Gateway --> Review[Review] + Gateway --> Calendar[Calendar Integration] + Gateway --> Notification[Notification] + Gateway --> AI[AI Proposal] + Gateway --> Privacy[Privacy] + Gateway --> Plugin[Plugin Integration] + + Planning -. versioned events .-> NATS[(NATS JetStream)] + Habit -. versioned events .-> NATS + Review -. projections/events .-> NATS + NATS -. reminder inputs .-> Notification + + Identity --> IDB[(Identity-owned PostgreSQL)] + Planning --> PDB[(Planning-owned PostgreSQL)] + Habit --> HDB[(Habit-owned PostgreSQL)] + Review --> RDB[(Review-owned PostgreSQL)] + Calendar --> CDB[(Calendar-owned PostgreSQL)] + Notification --> NDB[(Notification-owned PostgreSQL)] + AI --> ADB[(AI-owned PostgreSQL)] + Privacy --> VDB[(Privacy-owned PostgreSQL)] + Plugin --> XDB[(Integration-owned PostgreSQL)] ``` -Every bounded context retains its own persistence/migration/credential authority. +No arrow authorizes cross-service SQL. Every service retains migrations, credentials, transactions, backup semantics, observability, and recovery ownership. -## Login / workspace authority +## Identity and workspace authority **Status:** Implemented on protected main @@ -38,99 +50,181 @@ sequenceDiagram participant Web participant Identity participant Provider as Google/GitHub - User->>Web: begin login - Web->>Identity: bounded OAuth transaction - Identity->>Provider: authorization + User->>Web: begin bounded login + Web->>Identity: create OAuth transaction + Identity->>Provider: authorize with exact redirect/state Provider-->>Identity: callback Identity->>Identity: validate provider/state/redirect - Identity->>Identity: map user + workspace + authentication instant + Identity->>Identity: map user, workspace, authentication instant Identity-->>Web: revocable session + Note over Identity: session rotation preserves authentication age ``` -Session rotation does not manufacture a new authentication ceremony. - -## Goal / Project / Task / Habit / Today / Review +## Planning, Habit, Review, and Today authority **Status:** Implemented on protected main ```mermaid -flowchart TB - Goal --> Project --> Task - Goal -. motivates .-> Habit - Project -. motivates .-> Habit - Task --> TaskEvidence[Task completion] - Habit --> HabitEvidence[Habit completion] - TaskEvidence --> Review - HabitEvidence --> Review - Review -. projection only .-> PlanningView[Planning view] +sequenceDiagram + actor User + participant Web + participant Identity + participant Gateway + participant Planning + participant Habit + participant Review + + User->>Web: open Today + Web->>Identity: validate session + Identity-->>Web: actor + workspace + Web->>Gateway: authenticated Today request + Gateway->>Planning: exact signed request context + Planning-->>Gateway: bounded durable Today state + Gateway->>Habit: exact signed request context + Habit-->>Gateway: bounded Today habit state + Gateway-->>Web: real composed Today response + User->>Review: complete guided review + Review->>Review: verify request-bound signed workspace context ``` +PR #168 and PR #188 protect Planning authority; PR #173 protects Habit authority; PR #185 protects Review authority; PR #186 and PR #187 protect real Planning/Habit Gateway composition. Issue #163 is completed. + ```mermaid stateDiagram-v2 [*] --> LocalDraft - LocalDraft --> DurableToday: explicit save + precondition - DurableToday --> DurableToday: versioned update / exact replay + LocalDraft --> DurableToday: explicit server acceptance + strong precondition + DurableToday --> DurableToday: exact replay or versioned update DurableToday --> Conflict: stale precondition - Conflict --> DurableToday: explicit reconcile + Conflict --> DurableToday: explicit reconciliation DurableToday --> Completed Completed --> [*] ``` -## Calendar sync and connection lifecycle +## Calendar connection and credential lifecycle -### Workspace-only sync context +### Protected-main lifecycle **Status:** Implemented on protected main ```mermaid -sequenceDiagram - participant Web - participant Calendar - participant Provider - Web->>Calendar: signed workspace context + bounded sync request - Calendar->>Calendar: verify signature/freshness/workspace - Calendar->>Provider: conflict-safe provider operation - Provider-->>Calendar: bounded response / precondition evidence - Calendar-->>Web: sanitized result +stateDiagram-v2 + [*] --> MaterializingSecrets: authenticated create (PR #197) + MaterializingSecrets --> PersistingMetadata: opaque handles only + MaterializingSecrets --> Compensating: secret-store failure + PersistingMetadata --> Active: exact returned authority validated + PersistingMetadata --> Compensating: persistence throw or invalid evidence + Active --> Active: authenticated read (PR #189) + Active --> MaterializedForUse: exact handle validation (PR #193) + MaterializedForUse --> Active: plaintext lifetime ends + Active --> Revoked: authenticated local disconnect (PR #157) + Revoked --> Revoked: exact replay + Compensating --> [*]: reverse-order cleanup proven ``` -### Connection persistence and local revocation +PR #150 protects connection metadata, PR #153 protects atomic local revocation, PR #155 protects `life-os.calendar-user.v1`, PR #176 protects exact lookup evidence, PR #189 protects bounded read, PR #193 protects materialization, and PR #197 protects authenticated creation. + +### Protected compensation hardening **Status:** Implemented on protected main ```mermaid -stateDiagram-v2 - [*] --> ConnectionCreated: #150 workspace+user scoped create - ConnectionCreated --> ConnectionCreated: exact scoped lookup/replay - ConnectionCreated --> Revoked: #153 atomic tenant+user revoke - Revoked --> Revoked: exact revocation replay - Revoked --> [*] +sequenceDiagram + participant Caller + participant Create as Calendar create application + participant SecretStore + participant Repository + Caller->>Create: signed workspace+user authority + bounded credentials + Create->>SecretStore: store access material + SecretStore-->>Create: opaque access handle + Create->>SecretStore: store refresh material + SecretStore-->>Create: opaque refresh handle + Create->>Repository: persist metadata + exact handles + Repository-->>Create: mismatched durable evidence + Create->>SecretStore: delete refresh handle + Create->>SecretStore: delete access handle + Create-->>Caller: bounded dependency failure ``` -Connection metadata carries opaque secret references. Local revocation does not imply provider-side OAuth revocation. +This PR #201 flow is protected-main evidence. Complete KMS/OAuth/refresh/provider cleanup/discovery/selection/scoped sync remains **Partial** under #129. -### User-aware hosted authority +## Data-rights orchestration and contributor authority -**Status:** Implemented on protected main +### Protected contributor contract -**Evidence:** PR #155 merged as `7b34a5a584b037653d091ea661ae4627bb5dd2ea`. +**Status:** Partial ```mermaid sequenceDiagram - participant Caller - participant Calendar - Caller->>Calendar: workspace UUIDv4 + user UUIDv4 + issued-at + HMAC - Calendar->>Calendar: verify `life-os.calendar-user.v1`, identifiers, signature and freshness - alt valid - Calendar-->>Caller: frozen workspace+user authority - else substituted/stale/future/malformed/unconfigured - Calendar-->>Caller: fail closed without credential leakage + actor User + participant Identity + participant Registry as Explicit participant registry + participant Contributor as Owning service contributor + participant Ledger + + User->>Identity: recent-authenticated export/delete request + Identity->>Ledger: create/replay exact request + Identity->>Registry: resolve exact required participants + loop each owner + Identity->>Contributor: versioned exact signed request + Contributor->>Contributor: use owner persistence only + Contributor-->>Identity: bounded export/preflight/erase/verify evidence end + Identity->>Identity: reconcile exact participant set + alt all required evidence verified + Identity->>Ledger: append immutable terminal receipt + Identity-->>User: bounded status/artifact lifecycle + else partial/unavailable/unknown + Identity-->>User: non-terminal or bounded failure + end +``` + +PR #159 protects the shared contract. Planning is protected through PR #179 and PR #194. Habit is protected through PR #184 and PR #192. Review PR #195, Notification PR #198, and AI PR #199 are **Implemented on active PR**. Issue #55 remains **Partial**. + +### Contributor maturity + +```mermaid +flowchart LR + Contract[PR #159 contributor v1] --> Planning[Planning: protected PR #179/#194] + Contract --> Habit[Habit: protected PR #184/#192] + Contract --> Review[Review: active PR #195] + Contract --> Notification[Notification: active PR #198] + Contract --> AI[AI: active PR #199] + Contract --> Remaining[Remaining owners + reconciliation/delivery] + Remaining --> Gap[Issue #55 Partial] +``` + +## Plugin installation, credential, and operator authority + +**Status:** Partial + +```mermaid +stateDiagram-v2 + [*] --> ValidatedManifest + ValidatedManifest --> Granted: explicit host subset (PR #151) + Granted --> Persisted: exact durable authority (PR #169/#175) + Persisted --> CredentialBound: opaque secret reference (PR #172) + CredentialBound --> OperatorAuthorized: exact one-time request (PR #191) + OperatorAuthorized --> OperatorResult: fail-closed HTTP composition (PR #196) + OperatorAuthorized --> ReplayDenied: reused evidence + CredentialBound --> Revoked: durable authority ends first + Revoked --> CleanupRetry: external secret cleanup retry + CleanupRetry --> Revoked: authority never restored +``` + +```mermaid +flowchart LR + Manifest[Manifest intent] --> HostGrant[Host grant] + HostGrant --> Installation[Durable installation] + Installation --> SecretRef[Opaque secret reference] + Installation --> Operator[Request-bound operator] + HostOrigin[Separately host-authorized delivery origin] -. Planned .-> Delivery[Bounded HTTPS delivery] + SecretRef -. no plaintext persistence .-> Delivery + Operator -. no arbitrary network authority .-> Delivery ``` -Public disconnect, managed-secret operations, OAuth PKCE/refresh/provider revoke/discovery remain later #129 work. +Concrete KMS, authorized-origin registry, SSRF/DNS-rebinding-safe delivery, outcomes, retry/dead-letter, and operator recovery remain **Partial** under #130. -## AI proposal / decision +## AI proposal and explicit decision **Status:** Implemented on protected main @@ -144,159 +238,94 @@ sequenceDiagram User->>Web: request proposal Web->>Identity: validate session Identity-->>Web: actor + workspace - Web->>AI: signed bounded context + Web->>AI: exact signed bounded context AI->>AI: validate untrusted model result AI->>Audit: persist inert proposal evidence - AI-->>User: proposal - User->>AI: explicit accept/reject bound to exact proposal evidence + AI-->>User: proposal requiring confirmation + User->>AI: explicit accept/reject bound to exact evidence AI->>Audit: append decision + Note over AI,Audit: no generic Planning mutation authority ``` -## Model-assisted evaluation and development authority +## Model-assisted evaluation and repository authority **Status:** Accepted architecture -**Evidence:** ADR 0012, protected-main `AGENTS.md`, and the reviewed live-conformance design. - ```mermaid flowchart LR Secret[GitHub Secret NVIDIA_NIM_API_KEY] --> Seed[Approved contextual-orchestrator / credential seeding] Seed --> Route[Strong single-route baseline] Seed --> Conduct[Bounded conduct cells] - Route --> Eval[Deterministic LifeOS proposal evaluator] - Conduct --> Eval - Eval --> Evidence[Credential-free retained evidence] - Evidence --> Governance[Governance decision] + Route --> Evaluator[deterministic LifeOS proposal evaluator] + Conduct --> Evaluator + Evaluator --> Evidence[Credential-free retained evidence] + Evidence --> Governance[Repository-specific governance decision] - Review[Independent review authority] --> Merge[Merge authority] + CI[Deterministic CI/security] --> Review[Independent review authority] + Review --> Merge[Merge authority] Merge --> Release[Release authority] Governance -. evidence only .-> Review Seed -. no review/merge/release authority .-> Review ``` -Model execution can vary reasoning effort, workflow stages, decomposition, recursion depth, role-specific reasoning effort and access topology only when the exact reviewed dependency exposes those controls. Unsupported cells remain explicit. A conducted result does not self-approve or replace deterministic CI/security/review/merge/release authority. - -## Data-rights lifecycle - -### Request / status - -**Status:** Implemented on protected main - -```mermaid -sequenceDiagram - actor User - participant Boundary as Identity HTTP boundary - participant Session - participant Ledger - User->>Boundary: request or status query - Boundary->>Session: validate session / recent-auth as required - Session-->>Boundary: workspace + user - Boundary->>Ledger: request ID + workspace + requesting user - alt owned - Ledger-->>Boundary: durable state - Boundary-->>User: bounded no-store lifecycle projection - else absent/other tenant - Boundary-->>User: indistinguishable 404 - else invalid/dependency failure - Boundary-->>User: bounded 400/401/503 - end -``` +Supported controls may include workflow stage, reasoning effort, decomposition, recursion depth, role-specific reasoning effort, worker/model choice, verifier topology, and access/communication topology. Unsupported controls remain explicit. PR #200 is **Implemented on protected main** only for restoring the exact pinned OpenCode postinstall boundary. -### Export integrity +## Verification evidence authority **Status:** Implemented on protected main ```mermaid flowchart LR - Contributor --> Section[Schema + safe record count + bounded JSON] - Section --> Normalize[Deterministic UTF-16 property ordering] - Normalize --> Digest[Section SHA-256] - Digest --> Manifest[Ordered manifest] - Manifest --> Whole[Whole-export SHA-256] -``` - -Complete cross-domain orchestration/delivery remains **Partial** under #55. - -## Purpose-bound sensitive access - -**Status:** Implemented on protected main - -```mermaid -sequenceDiagram - participant Caller - participant Privacy - participant Audit - Caller->>Privacy: actor + workspace + resource + purpose + lifetime - Privacy->>Privacy: validate policy/scope - Privacy->>Audit: append decision/grant evidence - Privacy-->>Caller: bounded grant/decision or denial -``` - -## Plugin installation authority - -**Status:** Implemented on protected main - -```mermaid -stateDiagram-v2 - [*] --> ValidatedManifest - ValidatedManifest --> Granted: explicit host capability subset - Granted --> Granted: exact replay - Granted --> Conflict: incompatible installation identity reuse - Granted --> Revoked: explicit revoke - Revoked --> [*] - Conflict --> [*] + Source[source_head_sha] --> SourceChecks[Exact-source checks] + Snapshot[pr_base_snapshot_sha] --> Historical[Historical metadata] + LiveBase[live_base_tip_sha] --> Integration[integration_tree_sha] + Source --> Integration + Integration --> Compatibility[Merge compatibility] + SourceChecks --> Policy[Live policy decision] + Compatibility --> Policy + Policy --> Main[protected_main_sha] + Main --> ReleaseSource[release_source_sha] ``` -PR #151 protects this authority. Durable plugin installation persistence is active on PR #156; plugin-secret persistence/outbound delivery remain **Partial** under #130. +PR #154 protects exact-source/live-base separation. Issue #132 remains **Partial** for central reusable scanner checkout/attribution taxonomy. A green result never transfers across evidence identities. -## Backup / deployment +## Deployment and recovery **Status:** Implemented on protected main ```mermaid flowchart TB - Client --> Ingress[Operator-owned ingress/TLS/DNS] + Client --> Ingress[Operator-owned TLS/DNS/ingress] Ingress --> Web Web --> Services[Independent LifeOS services] - Services --> Pg[(Service-owned PostgreSQL authority)] + Services --> Stores[(Service-owned PostgreSQL authority)] Services <--> NATS[(NATS JetStream)] - Services --> Providers[Identity / Calendar / Model / Plugin endpoints] + Services --> Providers[Identity / Calendar / Model / Plugin providers] + Backup[Logical backup + integrity manifest] --> Restore[Validated safe-target restore] + Restore --> Stores ``` -Logical backup/restore verifies integrity and safe targets; it does not claim PITR or managed surrounding infrastructure. - -## Verification evidence state - -**Status:** Implemented on protected main - -**Evidence:** ADR 0010 and PR #154 merged as `2c272a404f8f3a74aa5796a1957d4a6ce0fabe8f`; #147 is Superseded. - ```mermaid -flowchart LR - Source[source_head_sha] --> SourceCheck[Exact source verification] - BaseSnapshot[pr_base_snapshot_sha] --> Metadata[Historical PR snapshot] - LiveBase[live_base_tip_sha] --> MergeDecision[Current base-sensitive decision] - Source --> Integration[integration_tree_sha] - LiveBase --> Integration - Integration --> MergeCheck[Compatibility evidence] - SourceCheck --> Gate - MergeCheck --> Gate - MergeDecision --> Gate - Gate --> Main[protected_main_sha] - Main --> Release[release_source_sha] +stateDiagram-v2 + [*] --> Healthy + Healthy --> Degraded: optional provider unavailable + Healthy --> FailClosed: owning persistence/authority unavailable + Degraded --> Healthy: bounded retry/recovery + FailClosed --> Recovery: operator restores dependency/evidence + Recovery --> Healthy: readiness + integrity verified + Recovery --> FailClosed: evidence incomplete ``` -No green result transfers authority across identities. Protected PR #154 reconstructs compatibility from the independently resolved current source and live base. Issue #132 remains open only for residual central SAST/Security scanner checkout and attribution classification; current central Semgrep synthetic-merge evidence must not be relabeled exact-source evidence. +Logical backup/restore does not claim PITR. External provider cleanup/recovery and release rollback preserve explicit partial-state evidence rather than fabricate success. -## Degraded modes - -**Status:** Accepted architecture +## Degraded-mode matrix -| Failure | Required behavior | -| --- | --- | -| Identity/calendar/model provider unavailable | Bounded dependency failure; unrelated product domains remain usable where safe | -| Owning PostgreSQL unavailable | Durable mutation fails closed; browser draft is not mislabeled durable | -| NATS unavailable | No fabricated delivery success; replay/recovery semantics apply | -| Stale write | Explicit conflict/revision evidence, never silent overwrite | -| Malformed/forged internal context | Fail closed without reflecting secrets or untrusted identifiers | -| Unknown/stale verification identity | Evidence unavailable/non-passing rather than promoted success | +| Failure | Required behavior | Status | +| --- | --- | --- | +| Identity/calendar/model provider unavailable | Bounded dependency failure; unrelated domains remain usable where safe | Accepted architecture | +| Owning PostgreSQL unavailable | Durable mutation fails closed; local draft remains visibly non-durable | Implemented on protected main | +| NATS unavailable | No fabricated delivery success; replay/recovery evidence remains | Implemented on protected main | +| Stale write | Explicit conflict/revision evidence, never silent overwrite | Implemented on protected main | +| Malformed/forged service context | Fail closed without reflecting identifiers or secrets | Implemented on protected main | +| Unknown/stale verification identity | Non-passing evidence, never promoted success | Implemented on protected main | +| Partial external secret/provider cleanup | Retain retry identity without restoring revoked authority | Partial | From cdac1d034bd26004b471dc069d89818bfa3c03c5 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 12 Aug 2026 23:42:04 +0900 Subject: [PATCH 102/173] docs: reconcile active Calendar and AI authority work --- docs/DOCUMENTATION_ASSESSMENT.md | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/docs/DOCUMENTATION_ASSESSMENT.md b/docs/DOCUMENTATION_ASSESSMENT.md index 2f7a59640..44a736371 100644 --- a/docs/DOCUMENTATION_ASSESSMENT.md +++ b/docs/DOCUMENTATION_ASSESSMENT.md @@ -14,23 +14,23 @@ This assessment intentionally avoids embedding volatile head SHAs. Exact heads, | --- | --- | --- | | Product definition and supersession chain | Implemented on active PR | PRD/Architecture preserve server-backed modular MSA + UUIDv4 and explicit offline/draft/Compose profiles | | Technical boundaries | Implemented on active PR | TRD aligns service ownership, signed authority, concurrency, and active contributor work | -| Root Architecture | Implemented on active PR | current through protected PR #201 | +| Root Architecture | Partial | protected architecture is current through PR #201; active PR #203 and the latest PR #199 migration/runtime authority separation still require reconciliation across the canonical architecture graph | | ADR index/details | Implemented on active PR | ADR 0001-0012 indexed with decision/recovery/security/acceptance/rollback/supersession sections | -| UML/C4/sequence/state/deployment/authority/recovery | Implemented on active PR | current protected and active boundaries are visually separated | +| UML/C4/sequence/state/deployment/authority/recovery | Implemented on active PR | current protected and active boundaries are visually separated; active #203 remains a bounded Calendar credential-store implementation, not end-to-end #129 completion | | Logical ERD/Data Model | Implemented on active PR | protected persistence vs active migrations vs incomplete conceptual delivery are explicit | | API/event/schema/version contracts | Implemented on active PR | current Calendar, contributor, Plugin operator, and evidence-identity lines are reconciled | -| Security and Threat Model | Implemented on active PR | current request-binding, secret compensation, contributor omission, SSRF, model, and supply-chain threats are explicit | +| Security and Threat Model | Partial | protected controls remain current, while active #199 distinct migration/runtime DB authority and active #203 encrypted credential-store controls require canonical security/threat-model reconciliation before this documentation line can be called semantically complete | | Privacy/Data Lifecycle | Implemented on active PR | protected/active contributors and remaining #55/#129/#130 obligations are separated | | Test Strategy | Implemented on active PR | realistic PostgreSQL/browser/security/coverage/documentation contracts remain canonical | | Operability/incident/recovery | Implemented on active PR | service-owned recovery and fail-closed degraded behavior remain canonical | | Release/Migration/Rollback/provenance | Implemented on active PR | exact integrated protected source remains the only release authority | | Standards/Research | Implemented on active PR | final standards and publication-status-aware APA 7 model-orchestration evidence remain linked | -| Traceability | Implemented on active PR | protected chronology, active PRs, parent gaps, and evidence hierarchy are current | +| Traceability | Partial | protected chronology is current but active PR #203 and the latest #199 database-authority hardening must be propagated to traceability before integration | | README discoverability | Implemented on active PR | canonical files remain linked; integration is still required | | Protected `AGENTS.md` authority | Implemented on protected main | live single-maintainer approval policy, writer lease, model credential, and exact-evidence rules | | CLAUDE discoverability | Implemented on active PR | points contributors to protected authority and canonical graph | | CHANGELOG product/governance history | Implemented on active PR | protected product entries and the ADR 0012 governance entry are preserved without inventing product behavior | -| Executable documentation contracts | Implemented on active PR | semantic tests reject stale active-PR labels and require protected/active/current gap distinctions | +| Executable documentation contracts | Partial | existing semantic tests reject stale maturity labels, but the active-PR inventory now includes #203 and must be reflected by the remaining canonical documents/tests | ## Protected-main reconciliation @@ -63,8 +63,8 @@ PR #156, PR #160, PR #162, PR #165, PR #175, PR #176, PR #178, and PR #179 must | PR #145 | Implemented on active PR | single canonical whole-product documentation successor | Draft; exact-head CI/security/review and live-base validation required | | PR #195 | Implemented on active PR | Review-owned contributor migration/application/runtime/tests | Draft; exact-head integration/coverage/security/review required | | PR #198 | Implemented on active PR | Notification-owned contributor migration/application/runtime/tests | branch is independently active; refetch exact head and reject temporary writer machinery before merge | -| PR #199 | Implemented on active PR | AI-owned contributor plus additive cursor contract | branch is independently active; exact-head gates/reviews required | -| PR #200 | Implemented on protected main | narrow exact-pinned OpenCode lifecycle-script allowlist repair | fresh protected scheduled bootstrap remains acceptance evidence | +| PR #199 | Implemented on active PR | AI-owned contributor plus additive cursor contract; active hardening separates migration ownership from the lower-privilege runtime database role | exact-head CI/security/review/live-base validation required; active authority hardening is not protected truth until integration | +| PR #203 | Implemented on active PR | bounded Calendar-owned self-hostable encrypted credential-store adapter using AES-256-GCM, opaque handles, authenticated ciphertext binding, owner-only files, and fail-closed reads/deletes | active branch; does not claim end-to-end OAuth/KMS/provider-revoke/discovery/sync completion and must not close #129 before protected integration and remaining lifecycle work | Active work may change while this document is reviewed. The table records bounded semantic scope, not merge eligibility, current head identity, or gate success. @@ -74,7 +74,7 @@ Active work may change while this document is reviewed. The table records bounde | --- | --- | --- | | #21 | Partial | umbrella commercial readiness; capability maturity does not close buyer gaps | | #55 | Partial | complete participant inventory, remaining contributors, reconciliation, retention/legal hold, backup expiry, protected export delivery, and terminal whole-right evidence | -| #129 | Partial | concrete KMS/OAuth/refresh/provider cleanup/discovery/selection/scoped sync lifecycle | +| #129 | Partial | concrete encrypted credential storage is active in #203, but OAuth state/PKCE/callback, refresh fencing, provider revoke/delete recovery, calendar discovery/selection, scoped sync lifecycle, and protected integration remain incomplete | | #130 | Partial | concrete plugin KMS, host-authorized outbound delivery, SSRF/rebinding controls, outcomes, retry/dead-letter, and operator recovery | | Issue #132 | Partial | residual central reusable scanner checkout/SARIF/status attribution taxonomy | | #148 | Partial | closes only when this exact canonical successor integrates and currentness evidence remains green | @@ -84,14 +84,16 @@ Canonical buyer-visible gaps are #55, #129, and #130. Issue #132 is verification ## Semantic checks performed by this successor - Protected-main capability chronology is reflected across PRD, TRD, Architecture, Data Model, UML, API, Threat Model, Privacy, and Traceability. -- Active PR #195, PR #198, and PR #199 are labeled `Implemented on active PR`, not shipped; PR #200 and PR #201 are protected. +- Active PR #195, PR #198, PR #199, and PR #203 are labeled `Implemented on active PR`, not shipped. +- PR #199's current branch hardens the database authority boundary by separating migration ownership from runtime authority; this remains active-PR evidence until exact-head gates and integration complete. +- PR #203 is a bounded encrypted self-hosted Calendar credential-store slice; it narrows but does not complete buyer gap #129. - Parent issues remain `Partial` despite protected foundations and active slices. -- No cross-service persistence, provider revoke, KMS adapter, plugin delivery table, or whole-right completion is invented. +- No cross-service persistence, provider revoke, end-to-end OAuth/KMS composition, plugin delivery table, or whole-right completion is invented. - The closed Today truthfulness issue is not kept open in canonical buyer-gap state. - Exact source/live-base/integration/checkout/protected/release evidence identities remain separate. - Model-assisted work cannot self-authorize review, merge, or release. -- Documentation contract tests fail when merged predecessor work reappears as active or current active work disappears from assessment. +- Documentation contract tests must fail when merged predecessor work reappears as active, current active work disappears from assessment, or bounded active slices are promoted to protected truth. ## Remaining integration conditions -PR #145 remains documentation-incomplete until its unchanged exact head passes required CI, AppGuardrail, SAST Semgrep, Security Scan, Commercial Readiness, current review findings, and live-base compatibility, then integrates under live policy. Integration of this line does not complete LifeOS: maintenance immediately returns to product/security/reliability work and the buyer gaps #55/#129/#130. +PR #145 remains documentation-incomplete until the remaining canonical documents and executable documentation contracts reconcile active #203 and the latest #199 database-authority hardening, then its unchanged exact head passes required CI, AppGuardrail, SAST Semgrep, Security Scan, Commercial Readiness, current review findings, and live-base compatibility and integrates under live policy. Integration of this line does not complete LifeOS: maintenance immediately returns to product/security/reliability work and the buyer gaps #55/#129/#130. \ No newline at end of file From b838ac8830291bd237f01b4c93aa3006705e4429 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 13 Aug 2026 11:14:44 +0900 Subject: [PATCH 103/173] docs: reconcile protected contributor and calendar slices --- docs/DOCUMENTATION_ASSESSMENT.md | 29 +++++++++++++++-------------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/docs/DOCUMENTATION_ASSESSMENT.md b/docs/DOCUMENTATION_ASSESSMENT.md index 44a736371..04e8f625c 100644 --- a/docs/DOCUMENTATION_ASSESSMENT.md +++ b/docs/DOCUMENTATION_ASSESSMENT.md @@ -14,23 +14,23 @@ This assessment intentionally avoids embedding volatile head SHAs. Exact heads, | --- | --- | --- | | Product definition and supersession chain | Implemented on active PR | PRD/Architecture preserve server-backed modular MSA + UUIDv4 and explicit offline/draft/Compose profiles | | Technical boundaries | Implemented on active PR | TRD aligns service ownership, signed authority, concurrency, and active contributor work | -| Root Architecture | Partial | protected architecture is current through PR #201; active PR #203 and the latest PR #199 migration/runtime authority separation still require reconciliation across the canonical architecture graph | +| Root Architecture | Partial | protected architecture is current through Calendar encrypted credential storage (#203) and Review-owned data rights (#195); active #198/#199 contributor work still requires reconciliation across the canonical architecture graph | | ADR index/details | Implemented on active PR | ADR 0001-0012 indexed with decision/recovery/security/acceptance/rollback/supersession sections | -| UML/C4/sequence/state/deployment/authority/recovery | Implemented on active PR | current protected and active boundaries are visually separated; active #203 remains a bounded Calendar credential-store implementation, not end-to-end #129 completion | +| UML/C4/sequence/state/deployment/authority/recovery | Implemented on active PR | current protected and active boundaries are visually separated; protected #203 narrows Calendar credential storage but does not complete the remaining #129 OAuth/provider lifecycle | | Logical ERD/Data Model | Implemented on active PR | protected persistence vs active migrations vs incomplete conceptual delivery are explicit | | API/event/schema/version contracts | Implemented on active PR | current Calendar, contributor, Plugin operator, and evidence-identity lines are reconciled | -| Security and Threat Model | Partial | protected controls remain current, while active #199 distinct migration/runtime DB authority and active #203 encrypted credential-store controls require canonical security/threat-model reconciliation before this documentation line can be called semantically complete | +| Security and Threat Model | Partial | protected #203 encrypted credential-store controls are shipped evidence, while active #199 distinct migration/runtime DB authority still requires canonical security/threat-model reconciliation before this documentation line can be called semantically complete | | Privacy/Data Lifecycle | Implemented on active PR | protected/active contributors and remaining #55/#129/#130 obligations are separated | | Test Strategy | Implemented on active PR | realistic PostgreSQL/browser/security/coverage/documentation contracts remain canonical | | Operability/incident/recovery | Implemented on active PR | service-owned recovery and fail-closed degraded behavior remain canonical | | Release/Migration/Rollback/provenance | Implemented on active PR | exact integrated protected source remains the only release authority | | Standards/Research | Implemented on active PR | final standards and publication-status-aware APA 7 model-orchestration evidence remain linked | -| Traceability | Partial | protected chronology is current but active PR #203 and the latest #199 database-authority hardening must be propagated to traceability before integration | +| Traceability | Partial | protected chronology now includes #195/#203, while active #198/#199 still require final integration-state propagation before documentation merge | | README discoverability | Implemented on active PR | canonical files remain linked; integration is still required | | Protected `AGENTS.md` authority | Implemented on protected main | live single-maintainer approval policy, writer lease, model credential, and exact-evidence rules | | CLAUDE discoverability | Implemented on active PR | points contributors to protected authority and canonical graph | | CHANGELOG product/governance history | Implemented on active PR | protected product entries and the ADR 0012 governance entry are preserved without inventing product behavior | -| Executable documentation contracts | Partial | existing semantic tests reject stale maturity labels, but the active-PR inventory now includes #203 and must be reflected by the remaining canonical documents/tests | +| Executable documentation contracts | Partial | existing semantic tests reject stale maturity labels; current active work is now limited to #145/#198/#199 and must remain distinct from newly protected #195/#203 | ## Protected-main reconciliation @@ -50,21 +50,21 @@ The prior canonical branch snapshot stopped near PR #155 and therefore mislabele - PR #191 and PR #196 one-time plugin operator authority and fail-closed HTTP composition; - PR #193 scoped Calendar credential materialization port; - PR #197 authenticated Calendar connection creation; -- PR #201 returned-create-evidence validation and reverse-order secret compensation. +- PR #201 returned-create-evidence validation and reverse-order secret compensation; +- PR #203 Calendar-owned encrypted self-hosted credential storage; +- PR #195 Review-owned data-rights contributor. Issue #163 is completed. PR #164 remains the historical fake-success removal, while PR #186 and PR #187 are the protected real-composition completion evidence. -PR #156, PR #160, PR #162, PR #165, PR #175, PR #176, PR #178, and PR #179 must not be described as current active PRs. Their relevant work is integrated, superseded, or historically replaced by the protected lines above. +PR #156, PR #160, PR #162, PR #165, PR #175, PR #176, PR #178, PR #179, PR #195, and PR #203 must not be described as current active PRs. Their relevant work is integrated, superseded, or historically replaced by the protected lines above. ## Current active pull-request line | Pull request | Status | Documentation meaning | Current gate caveat | | --- | --- | --- | --- | | PR #145 | Implemented on active PR | single canonical whole-product documentation successor | Draft; exact-head CI/security/review and live-base validation required | -| PR #195 | Implemented on active PR | Review-owned contributor migration/application/runtime/tests | Draft; exact-head integration/coverage/security/review required | -| PR #198 | Implemented on active PR | Notification-owned contributor migration/application/runtime/tests | branch is independently active; refetch exact head and reject temporary writer machinery before merge | +| PR #198 | Implemented on active PR | Notification-owned contributor migration/application/runtime/tests | exact-head CI/security/review/live-base validation required before integration | | PR #199 | Implemented on active PR | AI-owned contributor plus additive cursor contract; active hardening separates migration ownership from the lower-privilege runtime database role | exact-head CI/security/review/live-base validation required; active authority hardening is not protected truth until integration | -| PR #203 | Implemented on active PR | bounded Calendar-owned self-hostable encrypted credential-store adapter using AES-256-GCM, opaque handles, authenticated ciphertext binding, owner-only files, and fail-closed reads/deletes | active branch; does not claim end-to-end OAuth/KMS/provider-revoke/discovery/sync completion and must not close #129 before protected integration and remaining lifecycle work | Active work may change while this document is reviewed. The table records bounded semantic scope, not merge eligibility, current head identity, or gate success. @@ -74,7 +74,7 @@ Active work may change while this document is reviewed. The table records bounde | --- | --- | --- | | #21 | Partial | umbrella commercial readiness; capability maturity does not close buyer gaps | | #55 | Partial | complete participant inventory, remaining contributors, reconciliation, retention/legal hold, backup expiry, protected export delivery, and terminal whole-right evidence | -| #129 | Partial | concrete encrypted credential storage is active in #203, but OAuth state/PKCE/callback, refresh fencing, provider revoke/delete recovery, calendar discovery/selection, scoped sync lifecycle, and protected integration remain incomplete | +| #129 | Partial | encrypted self-hosted credential storage is protected through #203, but OAuth state/PKCE/callback, refresh fencing, provider revoke/delete recovery, calendar discovery/selection, scoped sync lifecycle, and remaining credential lifecycle work remain incomplete | | #130 | Partial | concrete plugin KMS, host-authorized outbound delivery, SSRF/rebinding controls, outcomes, retry/dead-letter, and operator recovery | | Issue #132 | Partial | residual central reusable scanner checkout/SARIF/status attribution taxonomy | | #148 | Partial | closes only when this exact canonical successor integrates and currentness evidence remains green | @@ -84,9 +84,10 @@ Canonical buyer-visible gaps are #55, #129, and #130. Issue #132 is verification ## Semantic checks performed by this successor - Protected-main capability chronology is reflected across PRD, TRD, Architecture, Data Model, UML, API, Threat Model, Privacy, and Traceability. -- Active PR #195, PR #198, PR #199, and PR #203 are labeled `Implemented on active PR`, not shipped. +- PR #195 and PR #203 are protected-main evidence and are no longer labeled as active work. +- Active PR #198 and PR #199 are labeled `Implemented on active PR`, not shipped. - PR #199's current branch hardens the database authority boundary by separating migration ownership from runtime authority; this remains active-PR evidence until exact-head gates and integration complete. -- PR #203 is a bounded encrypted self-hosted Calendar credential-store slice; it narrows but does not complete buyer gap #129. +- Protected PR #203 narrows but does not complete buyer gap #129. - Parent issues remain `Partial` despite protected foundations and active slices. - No cross-service persistence, provider revoke, end-to-end OAuth/KMS composition, plugin delivery table, or whole-right completion is invented. - The closed Today truthfulness issue is not kept open in canonical buyer-gap state. @@ -96,4 +97,4 @@ Canonical buyer-visible gaps are #55, #129, and #130. Issue #132 is verification ## Remaining integration conditions -PR #145 remains documentation-incomplete until the remaining canonical documents and executable documentation contracts reconcile active #203 and the latest #199 database-authority hardening, then its unchanged exact head passes required CI, AppGuardrail, SAST Semgrep, Security Scan, Commercial Readiness, current review findings, and live-base compatibility and integrates under live policy. Integration of this line does not complete LifeOS: maintenance immediately returns to product/security/reliability work and the buyer gaps #55/#129/#130. \ No newline at end of file +PR #145 remains documentation-incomplete until the remaining canonical documents and executable documentation contracts reconcile protected #195/#203 and active #198/#199, then its unchanged exact head passes required CI, AppGuardrail, SAST Semgrep, Security Scan, Commercial Readiness, current review findings, and live-base compatibility and integrates under live policy. Integration of this line does not complete LifeOS: maintenance immediately returns to product/security/reliability work and the buyer gaps #55/#129/#130. \ No newline at end of file From 53bc2615222f14080c29fec1b552652e748d7963 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 13 Aug 2026 20:14:52 +0900 Subject: [PATCH 104/173] docs: reconcile protected review contributor maturity --- ARCHITECTURE.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 49810ebd1..fed376e01 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -40,7 +40,7 @@ flowchart LR ## 2. Identity, workspace, and data-rights authority -Identity owns internal user identity, external provider mappings, workspace membership, sessions, authentication provenance, whole-request data-rights identity, and durable aggregate request/receipt evidence. Authentication-ceremony time remains separate from compatible session issuance and rotation. +Identity owns internal user identity, external provider mappings, workspace membership, sessions, authentication provenance, whole-request data-rights identity, and durable aggregate request/receipt evidence. Authentication-ceremony time is distinct from compatible session issuance and rotation. Protected main includes: @@ -50,7 +50,7 @@ Protected main includes: - deterministic contributor export integrity evidence; - the versioned `life-os.data-rights-contributor.v1` contract from PR #159. -Planning is a protected contributor through PR #179 and its request-bound authenticated transport through PR #194. Habit is a protected contributor through PR #184 and its replay-safe authenticated transport through PR #192. Review contribution is **Implemented on active PR** in PR #195, Notification contribution is **Implemented on active PR** in PR #198, and AI contribution is **Implemented on active PR** in PR #199. +Planning is a protected contributor through PR #179 and its request-bound authenticated transport through PR #194. Habit is a protected contributor through PR #184 and its replay-safe authenticated transport through PR #192. Review contribution is **Implemented on protected main** in PR #195, Notification contribution is **Implemented on active PR** in PR #198, and AI contribution is **Implemented on active PR** in PR #199. Issue #55 remains **Partial**. Active contributors do not become shipped truth, and even their future integration will not by itself finish Identity-owned data, Calendar, Privacy, Plugin Integration, durable reconciliation, retention/legal-hold/backup-expiry, protected export delivery, or final participant-set completion. From 93bed5f5b28e8f0ba8c1fb08b70a514a85ee16e2 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 14 Aug 2026 01:10:30 +0900 Subject: [PATCH 105/173] docs: reconcile current protected and active maturity --- docs/DOCUMENTATION_ASSESSMENT.md | 34 ++++++++++++++++++++------------ 1 file changed, 21 insertions(+), 13 deletions(-) diff --git a/docs/DOCUMENTATION_ASSESSMENT.md b/docs/DOCUMENTATION_ASSESSMENT.md index 04e8f625c..e85ea4091 100644 --- a/docs/DOCUMENTATION_ASSESSMENT.md +++ b/docs/DOCUMENTATION_ASSESSMENT.md @@ -14,28 +14,31 @@ This assessment intentionally avoids embedding volatile head SHAs. Exact heads, | --- | --- | --- | | Product definition and supersession chain | Implemented on active PR | PRD/Architecture preserve server-backed modular MSA + UUIDv4 and explicit offline/draft/Compose profiles | | Technical boundaries | Implemented on active PR | TRD aligns service ownership, signed authority, concurrency, and active contributor work | -| Root Architecture | Partial | protected architecture is current through Calendar encrypted credential storage (#203) and Review-owned data rights (#195); active #198/#199 contributor work still requires reconciliation across the canonical architecture graph | +| Root Architecture | Partial | protected architecture is current through Calendar encrypted credential storage (#203) and Review-owned data rights (#195); active #198/#199 contributor work plus the bounded #205 plugin delivery-origin authority still require canonical reconciliation before integration | | ADR index/details | Implemented on active PR | ADR 0001-0012 indexed with decision/recovery/security/acceptance/rollback/supersession sections | | UML/C4/sequence/state/deployment/authority/recovery | Implemented on active PR | current protected and active boundaries are visually separated; protected #203 narrows Calendar credential storage but does not complete the remaining #129 OAuth/provider lifecycle | | Logical ERD/Data Model | Implemented on active PR | protected persistence vs active migrations vs incomplete conceptual delivery are explicit | -| API/event/schema/version contracts | Implemented on active PR | current Calendar, contributor, Plugin operator, and evidence-identity lines are reconciled | -| Security and Threat Model | Partial | protected #203 encrypted credential-store controls are shipped evidence, while active #199 distinct migration/runtime DB authority still requires canonical security/threat-model reconciliation before this documentation line can be called semantically complete | +| API/event/schema/version contracts | Partial | protected Calendar/contributor/Plugin operator contracts are reconciled; active #198/#199 and bounded #205 delivery-origin authority remain non-shipped until exact-head integration | +| Security and Threat Model | Partial | protected #203 encrypted credential-store controls are shipped evidence, while active #199 database authority hardening and active #205 host-owned delivery-origin authority remain non-shipped security evidence | | Privacy/Data Lifecycle | Implemented on active PR | protected/active contributors and remaining #55/#129/#130 obligations are separated | | Test Strategy | Implemented on active PR | realistic PostgreSQL/browser/security/coverage/documentation contracts remain canonical | | Operability/incident/recovery | Implemented on active PR | service-owned recovery and fail-closed degraded behavior remain canonical | | Release/Migration/Rollback/provenance | Implemented on active PR | exact integrated protected source remains the only release authority | | Standards/Research | Implemented on active PR | final standards and publication-status-aware APA 7 model-orchestration evidence remain linked | -| Traceability | Partial | protected chronology now includes #195/#203, while active #198/#199 still require final integration-state propagation before documentation merge | +| Traceability | Partial | protected chronology includes #195/#203; active #198/#199/#204/#205 still require final integration-state propagation before documentation merge | | README discoverability | Implemented on active PR | canonical files remain linked; integration is still required | | Protected `AGENTS.md` authority | Implemented on protected main | live single-maintainer approval policy, writer lease, model credential, and exact-evidence rules | | CLAUDE discoverability | Implemented on active PR | points contributors to protected authority and canonical graph | | CHANGELOG product/governance history | Implemented on active PR | protected product entries and the ADR 0012 governance entry are preserved without inventing product behavior | -| Executable documentation contracts | Partial | existing semantic tests reject stale maturity labels; current active work is now limited to #145/#198/#199 and must remain distinct from newly protected #195/#203 | +| Executable documentation contracts | Partial | semantic tests must distinguish protected #195/#200/#203 from current active #145/#198/#199/#204/#205 without cross-row regular-expression matches | ## Protected-main reconciliation The prior canonical branch snapshot stopped near PR #155 and therefore mislabeled several integrated capabilities as active or absent. This successor now represents these protected changes: +- PR #154 is **Implemented on protected main** for exact-source verification identity and independently reconstructed live-base compatibility; +- PR #155 is **Implemented on protected main** for signed workspace-and-user Calendar authority; +- PR #156 is **Implemented on protected main** in the protected lifecycle lineage captured by PRD, Traceability, Data Model, and API contracts; - PR #157 authenticated Calendar disconnect; - PR #159 versioned service-owned data-rights contributor lifecycle; - PR #168 and PR #188 signed/request-bound Planning authority; @@ -50,21 +53,24 @@ The prior canonical branch snapshot stopped near PR #155 and therefore mislabele - PR #191 and PR #196 one-time plugin operator authority and fail-closed HTTP composition; - PR #193 scoped Calendar credential materialization port; - PR #197 authenticated Calendar connection creation; +- PR #200 is **Implemented on protected main** for the exact pinned OpenCode bootstrap allowlist; - PR #201 returned-create-evidence validation and reverse-order secret compensation; - PR #203 Calendar-owned encrypted self-hosted credential storage; -- PR #195 Review-owned data-rights contributor. +- PR #195 is **Implemented on protected main** for the Review-owned data-rights contributor. Issue #163 is completed. PR #164 remains the historical fake-success removal, while PR #186 and PR #187 are the protected real-composition completion evidence. -PR #156, PR #160, PR #162, PR #165, PR #175, PR #176, PR #178, PR #179, PR #195, and PR #203 must not be described as current active PRs. Their relevant work is integrated, superseded, or historically replaced by the protected lines above. +PR #156, PR #160, PR #162, PR #165, PR #175, PR #176, PR #178, PR #179, PR #195, PR #200, and PR #203 must not be described as current active PRs. Their relevant work is integrated, superseded, or historically replaced by the protected lines above. ## Current active pull-request line | Pull request | Status | Documentation meaning | Current gate caveat | | --- | --- | --- | --- | | PR #145 | Implemented on active PR | single canonical whole-product documentation successor | Draft; exact-head CI/security/review and live-base validation required | -| PR #198 | Implemented on active PR | Notification-owned contributor migration/application/runtime/tests | exact-head CI/security/review/live-base validation required before integration | +| PR #198 | Implemented on active PR | Notification-owned contributor migration/application/runtime/tests | exact-head CI currently fails only on an unreachable coverage branch; source repair remains non-shipped until integrated | | PR #199 | Implemented on active PR | AI-owned contributor plus additive cursor contract; active hardening separates migration ownership from the lower-privilege runtime database role | exact-head CI/security/review/live-base validation required; active authority hardening is not protected truth until integration | +| PR #204 | Implemented on active PR | read-only Actions workflow-registry detector for active orphan identities and exact-tree evidence | required Strix evidence remains non-passing until a genuine exact-head run completes; detector does not authorize workflow mutation | +| PR #205 | Implemented on active PR | host-owned exact HTTPS delivery-origin grant authority scoped to installation/workspace/user | exact-head review/security/live-base validation required; no outbound HTTP, DNS/IP enforcement, durable grant adapter, or delivery outcome is protected truth | Active work may change while this document is reviewed. The table records bounded semantic scope, not merge eligibility, current head identity, or gate success. @@ -75,7 +81,7 @@ Active work may change while this document is reviewed. The table records bounde | #21 | Partial | umbrella commercial readiness; capability maturity does not close buyer gaps | | #55 | Partial | complete participant inventory, remaining contributors, reconciliation, retention/legal hold, backup expiry, protected export delivery, and terminal whole-right evidence | | #129 | Partial | encrypted self-hosted credential storage is protected through #203, but OAuth state/PKCE/callback, refresh fencing, provider revoke/delete recovery, calendar discovery/selection, scoped sync lifecycle, and remaining credential lifecycle work remain incomplete | -| #130 | Partial | concrete plugin KMS, host-authorized outbound delivery, SSRF/rebinding controls, outcomes, retry/dead-letter, and operator recovery | +| #130 | Partial | active #205 adds only a host-owned delivery-origin authority foundation; concrete plugin KMS, SSRF/DNS-rebinding-safe outbound delivery, durable delivery authority/persistence, outcomes, retry/dead-letter, and operator recovery remain incomplete | | Issue #132 | Partial | residual central reusable scanner checkout/SARIF/status attribution taxonomy | | #148 | Partial | closes only when this exact canonical successor integrates and currentness evidence remains green | @@ -84,12 +90,14 @@ Canonical buyer-visible gaps are #55, #129, and #130. Issue #132 is verification ## Semantic checks performed by this successor - Protected-main capability chronology is reflected across PRD, TRD, Architecture, Data Model, UML, API, Threat Model, Privacy, and Traceability. -- PR #195 and PR #203 are protected-main evidence and are no longer labeled as active work. -- Active PR #198 and PR #199 are labeled `Implemented on active PR`, not shipped. +- PR #195, PR #200, and PR #203 are protected-main evidence and are not labeled as active work. +- Active PR #198, PR #199, PR #204, and PR #205 are labeled `Implemented on active PR`, not shipped. - PR #199's current branch hardens the database authority boundary by separating migration ownership from runtime authority; this remains active-PR evidence until exact-head gates and integration complete. +- PR #204 is read-only control-plane evidence and does not grant authority to disable or mutate Actions workflow identities. +- PR #205 records bounded host-owned delivery-origin intent but performs no outbound network delivery and therefore does not close buyer gap #130. - Protected PR #203 narrows but does not complete buyer gap #129. - Parent issues remain `Partial` despite protected foundations and active slices. -- No cross-service persistence, provider revoke, end-to-end OAuth/KMS composition, plugin delivery table, or whole-right completion is invented. +- No cross-service persistence, provider revoke, end-to-end OAuth/KMS composition, plugin delivery table, SSRF-safe network runtime, or whole-right completion is invented. - The closed Today truthfulness issue is not kept open in canonical buyer-gap state. - Exact source/live-base/integration/checkout/protected/release evidence identities remain separate. - Model-assisted work cannot self-authorize review, merge, or release. @@ -97,4 +105,4 @@ Canonical buyer-visible gaps are #55, #129, and #130. Issue #132 is verification ## Remaining integration conditions -PR #145 remains documentation-incomplete until the remaining canonical documents and executable documentation contracts reconcile protected #195/#203 and active #198/#199, then its unchanged exact head passes required CI, AppGuardrail, SAST Semgrep, Security Scan, Commercial Readiness, current review findings, and live-base compatibility and integrates under live policy. Integration of this line does not complete LifeOS: maintenance immediately returns to product/security/reliability work and the buyer gaps #55/#129/#130. \ No newline at end of file +PR #145 remains documentation-incomplete until the canonical documents and executable documentation contracts reconcile protected #195/#200/#203 and active #198/#199/#204/#205, then its unchanged exact head passes required CI, AppGuardrail, SAST Semgrep, Security Scan, Commercial Readiness, current review findings, and live-base compatibility and integrates under live policy. Integration of this line does not complete LifeOS: maintenance immediately returns to product/security/reliability work and the buyer gaps #55/#129/#130. From b25f806529d1b382f4210055ca2cd1ed66cfa593 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 14 Aug 2026 01:11:31 +0900 Subject: [PATCH 106/173] test(docs): bind maturity checks to exact PR rows --- .../src/documentation-currentness.test.mjs | 33 ++++++++++++++----- 1 file changed, 25 insertions(+), 8 deletions(-) diff --git a/packages/commercial-readiness/src/documentation-currentness.test.mjs b/packages/commercial-readiness/src/documentation-currentness.test.mjs index 4573ed57d..e10354c29 100644 --- a/packages/commercial-readiness/src/documentation-currentness.test.mjs +++ b/packages/commercial-readiness/src/documentation-currentness.test.mjs @@ -21,10 +21,26 @@ const canonical = [ const traceability = read('docs/TRACEABILITY.md'); const assessment = read('docs/DOCUMENTATION_ASSESSMENT.md'); +/** Requires one exact current-active pull-request row with the requested maturity. */ +function assertActiveAssessmentRow(pullRequest, status = 'Implemented on active PR') { + const prefix = `| PR #${pullRequest} |`; + const row = assessment.split('\n').find((line) => line.startsWith(prefix)); + assert.ok(row, `missing active assessment row for PR #${pullRequest}`); + assert.match(row, new RegExp(`\\| ${status} \\|`, 'u')); +} + +/** Requires protected-main reconciliation on the same bounded line as the PR identity. */ +function assertProtectedAssessmentEvidence(pullRequest) { + assert.match( + assessment, + new RegExp(`^[-|].*PR #${pullRequest}\\b[^\\n]*Implemented on protected main`, 'mu'), + ); +} + test('canonical maturity follows protected main and current active work', () => { for (const pullRequest of [ 157, 159, 168, 169, 172, 173, 175, 176, 179, 184, 185, 186, - 187, 188, 189, 190, 191, 192, 193, 194, 196, 197, 200, 201, + 187, 188, 189, 190, 191, 192, 193, 194, 195, 196, 197, 200, 201, 203, ]) { assert.match(canonical, new RegExp(`PR #${pullRequest}\\b`, 'u')); } @@ -40,17 +56,16 @@ test('canonical maturity follows protected main and current active work', () => ); } - for (const pullRequest of [195, 198, 199]) { - assert.match( - assessment, - new RegExp(`PR #${pullRequest}.*Implemented on active PR`, 'su'), - ); + for (const pullRequest of [145, 198, 199, 204, 205]) { + assertActiveAssessmentRow(pullRequest); + } + for (const pullRequest of [154, 155, 156, 195, 200, 203]) { + assertProtectedAssessmentEvidence(pullRequest); } - assert.match(assessment, /PR #200.*Implemented on protected main/su); assert.doesNotMatch( canonical, - /PR #(?:156|160|162|165|175|176|178|179) (?:is \*\*Implemented on active PR\*\*|\| Implemented on active PR \|)/iu, + /PR #(?:156|160|162|165|175|176|178|179|195|200|203) (?:is \*\*Implemented on active PR\*\*|\| Implemented on active PR \|)/iu, ); assert.match(canonical, /Issue #163.*completed/iu); }); @@ -58,4 +73,6 @@ test('canonical maturity follows protected main and current active work', () => test('canonical gaps remain bounded and truthful', () => { assert.match(traceability, /Canonical buyer gaps remain #55, #129 and #130/u); assert.match(assessment, /Issue #132.*Partial/su); + assert.match(assessment, /PR #205[^\n]*host-owned delivery-origin authority foundation/iu); + assert.match(assessment, /PR #204[^\n]*read-only Actions workflow-registry detector/iu); }); From 46b955bf6f929dc668e6d534e78c33e871781ef6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 14 Aug 2026 01:12:17 +0900 Subject: [PATCH 107/173] docs(api): reconcile protected and active authority contracts --- docs/API_CONTRACTS.md | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/docs/API_CONTRACTS.md b/docs/API_CONTRACTS.md index fd6ebd51d..e0907e898 100644 --- a/docs/API_CONTRACTS.md +++ b/docs/API_CONTRACTS.md @@ -43,7 +43,7 @@ This registry summarizes repository-level contract invariants. Concrete route, e | Contributor lifecycle v1 | Contracts | Implemented on protected main | PR #159 | | Planning data-rights contributor | Planning | Implemented on protected main | PR #179 and authenticated transport PR #194 | | Habit data-rights contributor | Habit | Implemented on protected main | PR #184 and authenticated transport PR #192 | -| Review data-rights contributor | Review | Implemented on active PR | PR #195 | +| Review data-rights contributor | Review | Implemented on protected main | PR #195 | | Notification data-rights contributor | Notification | Implemented on active PR | PR #198 | | AI data-rights contributor | AI Proposal | Implemented on active PR | PR #199 | | Complete cross-domain export/erasure | Identity + every owner | Partial | issue #55 | @@ -53,9 +53,11 @@ This registry summarizes repository-level contract invariants. Concrete route, e | Plugin credential binding | Integration | Implemented on protected main | PR #172; opaque secret reference only | | Plugin operator request authority | Integration | Implemented on protected main | PR #191 one-time request/replay evidence | | Plugin operator HTTP composition | Integration | Implemented on protected main | PR #196 fail-closed composition | +| Plugin delivery-origin grant authority | Integration | Implemented on active PR | PR #205; host-owned exact HTTPS origin grant only, with no outbound HTTP or durable grant adapter claim | | Complete plugin secret/outbound runtime | Integration | Partial | issue #130 | | Source/live-base/integration verification | Repository workflows | Implemented on protected main | PR #154; residual central taxonomy issue #132 | | Exact pinned OpenCode bootstrap allowlist | Repository automation | Implemented on protected main | PR #200 | +| Actions workflow-registry orphan detector | Repository automation | Implemented on active PR | PR #204; read-only exact-tree/registry evidence and no workflow-mutation authority | ## Data-rights contributor v1 @@ -68,7 +70,7 @@ PR #159 protects the versioned operation set: - `erase` binds exact request/workspace/actor/idempotency authority and returns replay-safe owner receipt evidence; - `verify_erased` proves the owner no longer retains scoped live records or fails closed. -Planning and Habit are protected participants. Review, Notification, and AI are active-PR participants. The contract does not imply every owner participates or that whole-product reconciliation/delivery is complete. +Planning, Habit, and Review are protected participants. Notification and AI are active-PR participants. The contract does not imply every owner participates or that whole-product reconciliation/delivery is complete. ## Calendar connection lifecycle @@ -108,6 +110,12 @@ PR #191 binds installation/workspace/actor, exact method/path, freshness, and on No operator route grants arbitrary SQL, filesystem, subprocess, tool, or network authority. Outbound delivery remains **Partial** under #130. +### Delivery-origin authority + +**Status:** Implemented on active PR + +PR #205 adds a host-owned authority record for one exact normalized HTTPS origin scoped to opaque UUIDv4 grant, installation, workspace, and granting-user identities. A plugin manifest still expresses intent only and cannot self-authorize a destination. This active slice performs no outbound HTTP and does not yet provide DNS/IP rebinding resistance, connect-time address enforcement, redirect/proxy policy, durable PostgreSQL grant storage, delivery outcomes, retry/dead-letter handling, or operator recovery. Those remain **Partial** under #130. + ## Events Asynchronous events use opaque event IDs, explicit type/version, validated workspace/actor/correlation/causation context, bounded immutable payloads, and idempotent consumers. PR #190 binds protected integration event authority to the exact request. Receiving an event never grants producer-database authority. @@ -118,6 +126,8 @@ Breaking route/event/schema semantics require explicit versioning or a reviewed ## Verification evidence identity -**Status:** Implemented on protected main +**Status:** Implemented on active PR `source_head_sha`, `pr_base_snapshot_sha`, `live_base_tip_sha`, integration/synthetic tree identity, `workflow_checkout_sha`, `protected_main_sha`, and `release_source_sha` are separate authorities. PR #154 protects source and live-base compatibility separation. Issue #132 remains **Partial** for central reusable scanner attribution; a synthetic merge scan cannot be called exact-source evidence. + +PR #204 is an active, read-only extension that compares one exact protected-default-branch Git tree with the complete Actions workflow registry so deleted workflow files cannot silently leave active orphan identities. Its evidence is not protected truth until integration and it does not authorize workflow-state mutation. From 55dbe19431f0a81f880d21a4777321102d80340e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 14 Aug 2026 01:13:36 +0900 Subject: [PATCH 108/173] docs(architecture): reconcile protected stores and active authority --- ARCHITECTURE.md | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index fed376e01..b35eafefb 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -79,9 +79,10 @@ Protected-main foundations are: - authenticated credential-free connection read lifecycle from PR #189; - scoped credential materialization port from PR #193; - authenticated connection creation with secret-first persistence and compensation boundaries from PR #197; -- returned durable create-evidence validation and reverse-order secret compensation from PR #201. +- returned durable create-evidence validation and reverse-order secret compensation from PR #201; +- Calendar-owned AES-256-GCM encrypted self-hosted file credential storage from PR #203, using opaque UUIDv4-backed handles and no plaintext database persistence. -Issue #129 remains **Partial** because protected main still lacks the complete concrete encrypted secret-store/KMS production adapter, Google OAuth state/PKCE/callback, refresh fencing, provider-side revoke/delete recovery, calendar discovery/selection, scoped sync composition, and retirement of the process-global development token path. Connection rows store only bounded metadata and opaque secret references; local revocation is not provider credential revocation. +Issue #129 remains **Partial** because protected main still lacks complete Google OAuth state/PKCE/callback, refresh fencing, provider-side revoke/delete recovery, calendar discovery/selection, scoped synchronization composition, end-to-end KMS/runtime composition, and retirement of the process-global development token path. PR #203 protects one concrete self-hosted encrypted store, not the complete provider credential lifecycle. Connection rows store only bounded metadata and opaque secret references; local revocation is not provider credential revocation. ## 5. Plugin integration boundary @@ -96,7 +97,9 @@ Protected main includes: - request-bound one-time operator authority and durable replay protection from PR #191; - fail-closed authenticated operator HTTP composition from PR #196. -Issue #130 remains **Partial**. Protected main does not yet contain a concrete KMS adapter, host-authorized delivery-origin registry, SSRF/DNS-rebinding-safe outbound HTTPS runtime, delivery attempt/outcome persistence, retry/dead-letter worker, or complete operator-facing delivery lifecycle. Manifests and stored installations never self-authorize network capabilities. +PR #205 is **Implemented on active PR** for a host-owned exact HTTPS delivery-origin grant scoped to installation, workspace, granting user, and opaque UUIDv4 grant identity. It does not perform outbound HTTP and does not yet provide durable PostgreSQL grant persistence, connect-time DNS/IP enforcement, redirect/proxy controls, delivery outcomes, retry/dead-letter handling, or operator recovery. + +Issue #130 remains **Partial**. Protected main does not yet contain a concrete plugin KMS adapter, host-authorized delivery-origin registry, SSRF/DNS-rebinding-safe outbound HTTPS runtime, delivery attempt/outcome persistence, retry/dead-letter worker, or complete operator-facing delivery lifecycle. Active PR #205 is non-shipped authority evidence only. Manifests and stored installations never self-authorize network capabilities. ## 6. AI proposal boundary @@ -121,7 +124,7 @@ ADR 0011 is authoritative: - revocation, replay, conflict, compensation, and recovery fail closed; - owning services retain migrations, repositories, and API authority. -The protected Calendar and Plugin Integration lines above are executable evidence of this decision. Neither closes its parent buyer gap. +The protected Calendar and Plugin Integration lines above are executable evidence of this decision. Neither closes its parent buyer gap, and active PR #205 does not become protected authority until integration. ## 9. Model-assisted development and automation @@ -143,7 +146,9 @@ ADR 0010 keeps these identities separate: - `protected_main_sha`; - `release_source_sha`. -PR #154 is protected-main evidence for exact-source jobs, independently reconstructed live-base compatibility, and explicit AppGuardrail source attribution. Issue #132 remains **Partial** only for central reusable SAST/Security checkout and evidence taxonomy. A green status for one identity never transfers to another. +PR #154 is **Implemented on protected main** for exact-source jobs, independently reconstructed live-base compatibility, and explicit AppGuardrail source attribution. Issue #132 remains **Partial** only for central reusable SAST/Security checkout and evidence taxonomy. A green status for one identity never transfers to another. + +PR #204 is **Implemented on active PR** for a read-only detector that binds the complete Actions workflow registry to one exact protected-default-branch Git tree and reports active orphan workflow identities. It does not authorize workflow-state mutation and is not passing merge evidence until its exact-head required checks, including a genuine Strix run, pass. PR #190 protects exact request-bound integration event authority. PR #191 and PR #196 protect the plugin operator request/replay/HTTP line. These product authorities are independent from merge authority. From be31387b700471f0fcff7bbbfd7eac05a62cd3e9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 14 Aug 2026 01:16:02 +0900 Subject: [PATCH 109/173] docs(architecture): preserve executable semantic anchors --- ARCHITECTURE.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index b35eafefb..3430f974c 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -62,7 +62,7 @@ Protected main now requires signed tenant authority on Planning through PR #168 Gateway Today composition is real protected behavior: PR #186 composes authenticated Planning state and PR #187 composes authenticated Habit state. Issue #163 is completed; the earlier PR #164 fail-closed placeholder removal remains historical safety evidence, not the current end state. -Durable Today uses explicit local-to-workspace acceptance, strong create/update preconditions, idempotency, and stale-conflict reconciliation. No browser draft is presented as durable before server acceptance. +Durable Today synchronization is protected-main behavior. Durable Today uses explicit local-to-workspace acceptance, strong create/update preconditions, idempotency, and stale-conflict reconciliation. No browser draft is presented as durable before server acceptance. ## 4. Calendar integration boundary @@ -82,6 +82,8 @@ Protected-main foundations are: - returned durable create-evidence validation and reverse-order secret compensation from PR #201; - Calendar-owned AES-256-GCM encrypted self-hosted file credential storage from PR #203, using opaque UUIDv4-backed handles and no plaintext database persistence. +PR #150 added workspace-and-user scoped connection persistence with opaque secret references. PR #153 added atomic local connection revocation; neither grants provider-side credential revocation authority. + Issue #129 remains **Partial** because protected main still lacks complete Google OAuth state/PKCE/callback, refresh fencing, provider-side revoke/delete recovery, calendar discovery/selection, scoped synchronization composition, end-to-end KMS/runtime composition, and retirement of the process-global development token path. PR #203 protects one concrete self-hosted encrypted store, not the complete provider credential lifecycle. Connection rows store only bounded metadata and opaque secret references; local revocation is not provider credential revocation. ## 5. Plugin integration boundary @@ -148,6 +150,8 @@ ADR 0010 keeps these identities separate: PR #154 is **Implemented on protected main** for exact-source jobs, independently reconstructed live-base compatibility, and explicit AppGuardrail source attribution. Issue #132 remains **Partial** only for central reusable SAST/Security checkout and evidence taxonomy. A green status for one identity never transfers to another. +Old PR #147 is **Superseded** as verification authority; the protected PR #154 identity model above is the current canonical line. + PR #204 is **Implemented on active PR** for a read-only detector that binds the complete Actions workflow registry to one exact protected-default-branch Git tree and reports active orphan workflow identities. It does not authorize workflow-state mutation and is not passing merge evidence until its exact-head required checks, including a genuine Strix run, pass. PR #190 protects exact request-bound integration event authority. PR #191 and PR #196 protect the plugin operator request/replay/HTTP line. These product authorities are independent from merge authority. From ced4e4c6f37788bdf2afe6c5b27af1bd2add5d9b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 16:31:34 +0900 Subject: [PATCH 110/173] docs(adr): move service-owned persistence to ADR 0013 --- docs/adr/0013-service-owned-persistence.md | 36 ++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 docs/adr/0013-service-owned-persistence.md diff --git a/docs/adr/0013-service-owned-persistence.md b/docs/adr/0013-service-owned-persistence.md new file mode 100644 index 000000000..2119cbf3d --- /dev/null +++ b/docs/adr/0013-service-owned-persistence.md @@ -0,0 +1,36 @@ +# ADR 0013: Domain-oriented service-owned persistence + +**Status:** Accepted architecture +**Date:** 2026-08-10 + +## Context +LifeOS evolved from a simple app concept into independently runnable bounded services. A shared database authority would make those boundaries nominal and increase tenant, migration and deployment coupling. + +## Decision drivers +Independent operation, modular MSA composition, least privilege, migration ownership, fault isolation, explicit versioned interoperability. + +## Alternatives considered +- shared tables/read access across services — rejected; +- one monolithic persistence layer — rejected as durable architecture; +- service-owned persistence with API/event/saga/plugin contracts — selected. + +## Decision +Each bounded service owns its persistence adapters, migrations and database credentials. Services never read or mutate another service's tables directly. Shared UUIDs are logical references only. Cross-service effects use versioned HTTP/event/saga/plugin contracts. + +## Consequences +More explicit integration contracts and eventual-consistency handling are required, but services remain independently deployable/testable and database privileges can be least-privilege. + +## Failure and recovery +A service/database outage fails only the affected authority where possible. Cross-service workflows retain idempotency/reconciliation evidence rather than bypassing ownership with emergency SQL. + +## Security and privacy impact +Compromise of one service credential must not imply access to every domain table. Tenant authorization remains enforced by the owning service. + +## Acceptance evidence +Protected-main service layout, per-service migrations/repositories and architecture tests; logical data model labels ownership explicitly. + +## Migration and rollback +Any shared-table legacy coupling must be inventoried and replaced with a versioned contract before privileges are removed. Rollback preserves service-owned authority. + +## Supersession +Only a reviewed repository-wide data-authority ADR with migration/security/operability evidence may supersede this decision. From 03d430ec7d7589f150709f3392e94a0e6844f8aa Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 16:31:39 +0900 Subject: [PATCH 111/173] docs(adr): remove colliding ADR 0003 filename --- docs/adr/0003-service-owned-persistence.md | 36 ---------------------- 1 file changed, 36 deletions(-) delete mode 100644 docs/adr/0003-service-owned-persistence.md diff --git a/docs/adr/0003-service-owned-persistence.md b/docs/adr/0003-service-owned-persistence.md deleted file mode 100644 index 8d6c8bb3e..000000000 --- a/docs/adr/0003-service-owned-persistence.md +++ /dev/null @@ -1,36 +0,0 @@ -# ADR 0003: Domain-oriented service-owned persistence - -**Status:** Accepted architecture -**Date:** 2026-08-10 - -## Context -LifeOS evolved from a simple app concept into independently runnable bounded services. A shared database authority would make those boundaries nominal and increase tenant, migration and deployment coupling. - -## Decision drivers -Independent operation, modular MSA composition, least privilege, migration ownership, fault isolation, explicit versioned interoperability. - -## Alternatives considered -- shared tables/read access across services — rejected; -- one monolithic persistence layer — rejected as durable architecture; -- service-owned persistence with API/event/saga/plugin contracts — selected. - -## Decision -Each bounded service owns its persistence adapters, migrations and database credentials. Services never read or mutate another service's tables directly. Shared UUIDs are logical references only. Cross-service effects use versioned HTTP/event/saga/plugin contracts. - -## Consequences -More explicit integration contracts and eventual-consistency handling are required, but services remain independently deployable/testable and database privileges can be least-privilege. - -## Failure and recovery -A service/database outage fails only the affected authority where possible. Cross-service workflows retain idempotency/reconciliation evidence rather than bypassing ownership with emergency SQL. - -## Security and privacy impact -Compromise of one service credential must not imply access to every domain table. Tenant authorization remains enforced by the owning service. - -## Acceptance evidence -Protected-main service layout, per-service migrations/repositories and architecture tests; logical data model labels ownership explicitly. - -## Migration and rollback -Any shared-table legacy coupling must be inventoried and replaced with a versioned contract before privileges are removed. Rollback preserves service-owned authority. - -## Supersession -Only a reviewed repository-wide data-authority ADR with migration/security/operability evidence may supersede this decision. \ No newline at end of file From 91da2d45ced155db342064f86ad14c84872a3e68 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 16:31:59 +0900 Subject: [PATCH 112/173] docs(adr): resolve protected ADR 0003 collision --- docs/adr/README.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/adr/README.md b/docs/adr/README.md index ff6e0193d..810345e95 100644 --- a/docs/adr/README.md +++ b/docs/adr/README.md @@ -12,7 +12,7 @@ ADR status uses the same exact canonical documentation values: `Implemented on p | --- | --- | --- | | [0001](0001-opaque-non-numeric-identifiers.md) | Accepted architecture | Internal identifiers are opaque UUIDv4; old UUIDv7 design language is superseded | | [0002](0002-oauth-transactions-and-session-tokens.md) | Accepted architecture | Server-owned OAuth transaction/session security and authentication provenance | -| [0003](0003-service-owned-persistence.md) | Accepted architecture | Bounded services own persistence/migrations/credentials and never cross-write tables | +| [0003](0003-adaptive-contextual-orchestrator-proposal-default.md) | Implemented on protected main | Production proposal requests use adaptive contextual-orchestrator authority rather than provider-native structured-output routing | | [0004](0004-inert-auditable-ai-proposals.md) | Accepted architecture | AI output is inert auditable proposal evidence with explicit decisions | | [0005](0005-purpose-bound-sensitive-data-access.md) | Accepted architecture | Sensitive access is tenant/resource/purpose/lifetime/audit bound | | [0006](0006-work-conserving-autonomous-maintenance.md) | Accepted architecture | Autonomous maintenance is exact-state, single-writer and work-conserving | @@ -21,7 +21,8 @@ ADR status uses the same exact canonical documentation values: `Implemented on p | [0009](0009-product-hosting-and-data-evolution.md) | Accepted architecture | Server-backed self-hostable modular MSA supersedes browser-only/single-app primary architecture | | [0010](0010-verification-evidence-identity.md) | Accepted architecture | Contributor source, PR-base snapshot, live base, synthetic merge, workflow checkout, protected-main and release identities remain separate evidence authorities | | [0011](0011-external-integration-authority-and-secret-references.md) | Accepted architecture | External integration metadata uses LifeOS-owned identity, separate secret references and explicit host-granted capability authority | -| [0012](0012-test-time-compute-and-model-development-authority.md) | Accepted architecture | Strong single-route baseline, measured orchestration selection, NVIDIA/OpenCode credential boundary and model-vs-review/merge/release authority separation | +| [0012](0012-test-time-compute-and-model-development-authority.md) | Accepted architecture | Model-assisted development remains subordinate to deterministic review/merge/release authority and a governed contextual-orchestrator boundary | +| [0013](0013-service-owned-persistence.md) | Accepted architecture | Bounded services own persistence/migrations/credentials and never cross-write tables | ## ADR quality contract From 3aa944906415cb3728c50810ba6c41a810a3745c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 16:32:32 +0900 Subject: [PATCH 113/173] docs(adr): carry accepted identifier references into canonical graph --- docs/adr/0001-opaque-non-numeric-identifiers.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/docs/adr/0001-opaque-non-numeric-identifiers.md b/docs/adr/0001-opaque-non-numeric-identifiers.md index 0ab40153c..c16bcca2e 100644 --- a/docs/adr/0001-opaque-non-numeric-identifiers.md +++ b/docs/adr/0001-opaque-non-numeric-identifiers.md @@ -52,4 +52,12 @@ The earlier UUIDv7 proposal was never the protected-main invariant. New code use ## Supersession -This ADR supersedes the original UUIDv7 design language. It may be superseded only by a reviewed repository-wide identifier ADR with compatibility, privacy, migration and authorization evidence. \ No newline at end of file +This ADR supersedes the original UUIDv7 design language. It may be superseded only by a reviewed repository-wide identifier ADR with compatibility, privacy, migration and authorization evidence. + +## References + +Davis, K. R., Peabody, B. G., & Leach, P. J. (2024). *Universally unique IDentifiers (UUIDs)* (RFC 9562) [Published Standards Track RFC]. RFC Editor. https://doi.org/10.17487/RFC9562 + +OWASP Foundation. (n.d.). *Insecure direct object reference (IDOR)*. https://owasp.org/www-community/attacks/insecure_direct_object_reference + +OWASP Foundation. (2021). *A01:2021 – Broken access control*. https://owasp.org/Top10/2021/A01_2021-Broken_Access_Control/index.html From 23f1cf6f826d738c000a8e7d594f804153437339 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 16:32:51 +0900 Subject: [PATCH 114/173] docs(adr): carry accepted OAuth references into canonical graph --- docs/adr/0002-oauth-transactions-and-session-tokens.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/docs/adr/0002-oauth-transactions-and-session-tokens.md b/docs/adr/0002-oauth-transactions-and-session-tokens.md index d65ced325..fbecb9143 100644 --- a/docs/adr/0002-oauth-transactions-and-session-tokens.md +++ b/docs/adr/0002-oauth-transactions-and-session-tokens.md @@ -66,4 +66,12 @@ Migrations introduce workspace/session binding and authentication provenance wit ## Supersession -This ADR is superseded only by a reviewed identity/session architecture change with provider, migration, recent-auth and browser-security compatibility evidence. \ No newline at end of file +This ADR is superseded only by a reviewed identity/session architecture change with provider, migration, recent-auth and browser-security compatibility evidence. + +## References + +GitHub. (n.d.). *Authorizing OAuth apps*. https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps + +Lodderstedt, T., Bradley, J., Labunets, A., & Fett, D. (2025). *Best current practice for OAuth 2.0 security* (RFC 9700; BCP 240) [Published Best Current Practice]. RFC Editor. https://doi.org/10.17487/RFC9700 + +Sakimura, N., Bradley, J., & Agarwal, N. (2015). *Proof key for code exchange by OAuth public clients* (RFC 7636) [Published Standards Track RFC]. RFC Editor. https://doi.org/10.17487/RFC7636 From 4fcb952ff2d1fd2f1140554ea5bc0c6a25bb9b9c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 16:41:55 +0900 Subject: [PATCH 115/173] docs: restore canonical lane ownership boundaries --- .github/workflows/appguardrail.yml | 6 ++++ .github/workflows/commercial-readiness.yml | 13 +++++++++ ...ontextual-orchestrator-proposal-default.md | 28 +++++++++++++++++++ 3 files changed, 47 insertions(+) create mode 100644 docs/adr/0003-adaptive-contextual-orchestrator-proposal-default.md diff --git a/.github/workflows/appguardrail.yml b/.github/workflows/appguardrail.yml index 1b2b2c4f1..64b96eb0d 100644 --- a/.github/workflows/appguardrail.yml +++ b/.github/workflows/appguardrail.yml @@ -3,8 +3,14 @@ name: AppGuardrail on: pull_request: branches: [main] + paths-ignore: + - "docs/**" + - "*.md" push: branches: [main] + paths-ignore: + - "docs/**" + - "*.md" workflow_dispatch: permissions: diff --git a/.github/workflows/commercial-readiness.yml b/.github/workflows/commercial-readiness.yml index d413a9391..2f36a3b6f 100644 --- a/.github/workflows/commercial-readiness.yml +++ b/.github/workflows/commercial-readiness.yml @@ -56,6 +56,18 @@ jobs: --generated-at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \ --output "$EVIDENCE_DIR/github-snapshot.json" + - name: Detect active orphan Actions workflow identities + if: github.event_name != 'pull_request' + env: + GITHUB_TOKEN: ${{ github.token }} + run: | + set -euo pipefail + node packages/commercial-readiness/src/cli.mjs workflow-registry \ + --repository "$GITHUB_REPOSITORY" \ + --commit "$GITHUB_SHA" \ + --generated-at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \ + --output "$EVIDENCE_DIR/workflow-registry.json" + - name: Audit capability maturity and canonical buyer gaps env: GITHUB_TOKEN: ${{ github.token }} @@ -83,6 +95,7 @@ jobs: --output "$EVIDENCE_DIR/pr-drain-dry-run.json" - name: Upload commercial readiness evidence + if: always() uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: commercial-readiness-evidence-${{ github.run_id }} diff --git a/docs/adr/0003-adaptive-contextual-orchestrator-proposal-default.md b/docs/adr/0003-adaptive-contextual-orchestrator-proposal-default.md new file mode 100644 index 000000000..ea91cb8c6 --- /dev/null +++ b/docs/adr/0003-adaptive-contextual-orchestrator-proposal-default.md @@ -0,0 +1,28 @@ +# ADR-0003: Adaptive contextual-orchestrator mode is the proposal default + +- Status: Accepted +- Date: 2026-08-16 + +## Context + +LifeOS sent a provider-native JSON Schema response format to contextual-orchestrator. The current gateway deliberately proxies such requests to one worker because multi-agent tool and structured-output envelopes cannot be merged losslessly. Although the request omitted a mode and therefore appeared adaptive, the structured-output trigger made the effective path a fixed single-model passthrough. + +LifeOS already treats model output as untrusted. The technology-independent ProposalService validates exact keys, bounded text and arrays, operation kinds, and UUIDv4 targets before an inert proposal can be persisted or returned. + +## Decision + +Production proposal requests include `orchestration_mode: "auto"` and `include_orchestration_trace: false`, and they do not send provider-native `response_format`. + +The fixed system instruction still demands one JSON object. Contextual-orchestrator owns provider/model selection, workflow depth, verification, fallback, and known-price optimization. Quality sufficiency is the first constraint; cost is minimized among execution paths that satisfy it. LifeOS remains the final authority for strict parsing and domain validation and fails closed on malformed output. + +The live-conformance harness retains explicit route and conduct profiles because it is an ablation and measurement surface, not the production default. + +## Consequences + +Simple requests may still use one worker when adaptive policy finds that sufficient. Harder requests may use deeper orchestration. LifeOS no longer gains provider-side schema enforcement, but it does not rely on that enforcement for trust; the existing strict validator remains mandatory and fully tested. + +## References + +Omidvar, H., & Akhlaghi, V. (2026). *A communication-theoretic framework for LLM agents: Cost-aware adaptive reliability* [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2605.09121 + +Tang, Y., Cetin, E., Xu, J., Sun, Q., Nielsen, S., Richard, V., Goda, H., Tymchenko, I., Nguyen, N., Lee, H., Ashiga, M., Kotyan, S., Kuroki, S., & Clanuwat, T. (2026). *Sakana Fugu technical report* [Technical report]. arXiv. https://doi.org/10.48550/arXiv.2606.21228 From 5f2d22875ee7ac1949632af9eb6322725698c88a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 12:08:09 +0900 Subject: [PATCH 116/173] docs: refresh active architecture evidence --- ARCHITECTURE.md | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 3430f974c..79aeda50c 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -84,7 +84,9 @@ Protected-main foundations are: PR #150 added workspace-and-user scoped connection persistence with opaque secret references. PR #153 added atomic local connection revocation; neither grants provider-side credential revocation authority. -Issue #129 remains **Partial** because protected main still lacks complete Google OAuth state/PKCE/callback, refresh fencing, provider-side revoke/delete recovery, calendar discovery/selection, scoped synchronization composition, end-to-end KMS/runtime composition, and retirement of the process-global development token path. PR #203 protects one concrete self-hosted encrypted store, not the complete provider credential lifecycle. Connection rows store only bounded metadata and opaque secret references; local revocation is not provider credential revocation. +The current active Calendar stack advances this boundary without changing shipped truth. PR #216 rejects deployment-wide Google and CalDAV credentials from the hosted multi-user runtime until authenticated user-owned connection evidence and scoped secret materialization are composed. Stacked PR #228 adds five-minute Google OAuth authorization-state/PKCE authority with opaque durable state and secret-store-held verifier material, including hostile consumed-row validation before verifier materialization. Both remain Draft active-PR evidence. + +Issue #129 remains **Partial** because protected main still lacks complete hosted Google OAuth callback/token exchange, successful verifier cleanup after exchange, concrete PostgreSQL OAuth-state persistence, refresh fencing, provider-side revoke/delete recovery, calendar discovery/selection, scoped synchronization composition, end-to-end KMS/runtime composition, and retirement of process-global development credentials. PR #203 protects one concrete self-hosted encrypted store; PR #216/#228 do not become protected authority until normal integration. Connection rows store only bounded metadata and opaque secret references; local revocation is not provider credential revocation. ## 5. Plugin integration boundary @@ -99,9 +101,11 @@ Protected main includes: - request-bound one-time operator authority and durable replay protection from PR #191; - fail-closed authenticated operator HTTP composition from PR #196. -PR #205 is **Implemented on active PR** for a host-owned exact HTTPS delivery-origin grant scoped to installation, workspace, granting user, and opaque UUIDv4 grant identity. It does not perform outbound HTTP and does not yet provide durable PostgreSQL grant persistence, connect-time DNS/IP enforcement, redirect/proxy controls, delivery outcomes, retry/dead-letter handling, or operator recovery. +The active #130 stack is deeper than protected main and remains explicitly non-shipped. PR #205 defines host-owned exact HTTPS delivery-origin authority. PR #235 adds Integration-owned PostgreSQL grant persistence and active-installation fencing. PR #241 hardens credential authority and concurrent revocation admission. PR #242 adds an operator-configured Vault KV v2 secret-store adapter that keeps provider plaintext and Vault credentials out of durable LifeOS metadata. PR #243 composes authenticated Vault operator authority, PR #244 composes the hosted Integration runtime over one service-owned PostgreSQL pool, and PR #245 adds the concrete PostgreSQL/default-entrypoint runtime. A hosted acceptance run on an exact #245 ancestor exercised real Vault KV v2 plus migrated Integration-owned PostgreSQL across installation, credential creation and exact replay, installation-revocation fencing, runtime restart, credential revocation, and idempotent cleanup; that retained ancestor evidence is not current-head merge authority. + +Draft PR #250 is stacked on #245 and exposes the existing delivery-origin aggregate/store only through exact signed one-time operator grant/read/revoke authority. Its production route verifier now admits only canonical lowercase UUIDv4 delivery-origin collection/item/revoke paths with their exact POST/GET/POST methods. The slice deliberately stops before HTTP delivery-origin transport and outbound networking. -Issue #130 remains **Partial**. Protected main does not yet contain a concrete plugin KMS adapter, host-authorized delivery-origin registry, SSRF/DNS-rebinding-safe outbound HTTPS runtime, delivery attempt/outcome persistence, retry/dead-letter worker, or complete operator-facing delivery lifecycle. Active PR #205 is non-shipped authority evidence only. Manifests and stored installations never self-authorize network capabilities. +Issue #130 remains **Partial**. Protected main does not yet contain this Vault/PostgreSQL/delivery-origin active stack, and no active PR yet supplies complete host-authorized outbound HTTPS. The remaining network boundary requires immutable released/versioned canonical egress authority for connect-time DNS/IP and rebinding controls, redirect/proxy policy, bounded response/time behavior, plus LifeOS-owned delivery attempt/outcome persistence, retry/dead-letter and operator recovery. Durable origin identity is not network authorization. Manifests and stored installations never self-authorize network capabilities. ## 6. AI proposal boundary @@ -126,15 +130,15 @@ ADR 0011 is authoritative: - revocation, replay, conflict, compensation, and recovery fail closed; - owning services retain migrations, repositories, and API authority. -The protected Calendar and Plugin Integration lines above are executable evidence of this decision. Neither closes its parent buyer gap, and active PR #205 does not become protected authority until integration. +The protected Calendar and Plugin Integration lines above are executable evidence of this decision. Their active successors are evidence only until integration and do not close their parent buyer gaps. ## 9. Model-assisted development and automation ADR 0012 is authoritative. A strong single-model route is measured before deeper orchestration. Workflow stage, reasoning effort, decomposition, recursion depth, role-specific reasoning effort, worker/model selection, verifier topology, and access/communication topology are explicit experimental dimensions only when supported by the exact reviewed dependency. -Model-backed development uses reviewed OpenCode or contextual-orchestrator boundaries with GitHub Secret `NVIDIA_NIM_API_KEY`; `COPILOT_GITHUB_TOKEN` is prohibited. Model execution has no product-data authority beyond bounded inputs and no independent review, branch-protection, merge, or release authority. Retained evidence excludes credentials, raw prompts/responses, and hidden reasoning. +Protected main includes PR #200's exact pinned OpenCode executable bootstrap hardening; that historical line does not authorize direct provider selection as the target model-routing architecture. Current active PR #208 routes scheduled model-assisted work through contextual-orchestrator and virtual `orchestrator/free`, while preserving exact OpenCode identity verification. It remains Draft because the required contextual-orchestrator authentication/bootstrap contract and immutable reviewed upstream release are not yet available to LifeOS. LifeOS does not copy mutable upstream source or convert provider credentials into direct model-selection authority. -PR #200 is **Implemented on protected main** for restoring the exact pinned OpenCode executable by allowing only the reviewed `opencode-ai` lifecycle script. It does not weaken deterministic governance or authorize unrelated dependency scripts. +Model execution has no product-data authority beyond bounded inputs and no independent review, branch-protection, merge, or release authority. Retained evidence excludes credentials, raw prompts/responses, and hidden reasoning. Unsupported gateway capability fails closed and is repaired in the canonical owner rather than bypassed in LifeOS. ## 10. Verification identity and merge safety @@ -152,7 +156,7 @@ PR #154 is **Implemented on protected main** for exact-source jobs, independentl Old PR #147 is **Superseded** as verification authority; the protected PR #154 identity model above is the current canonical line. -PR #204 is **Implemented on active PR** for a read-only detector that binds the complete Actions workflow registry to one exact protected-default-branch Git tree and reports active orphan workflow identities. It does not authorize workflow-state mutation and is not passing merge evidence until its exact-head required checks, including a genuine Strix run, pass. +PR #204 is **Implemented on active PR** for a read-only detector that binds the complete Actions workflow registry to one exact protected-default-branch Git tree and reports active orphan workflow identities. It does not authorize workflow-state mutation and is not passing merge evidence until its exact-head required checks pass. PR #190 protects exact request-bound integration event authority. PR #191 and PR #196 protect the plugin operator request/replay/HTTP line. These product authorities are independent from merge authority. @@ -160,6 +164,8 @@ PR #190 protects exact request-bound integration event authority. PR #191 and PR A release is cut from one exact integrated protected head only after applicable CI, security, review, coverage/docstrings, packaging, SBOM/provenance, reproducibility, compatibility, migrations/rollback, backup/restore/recovery, accessibility/localization, and operational acceptance pass together. No feature PR, documentation PR, or model judgment is release evidence by itself. +Issue #210 remains **Partial**. Draft PR #217 adds a machine-readable exact release-evidence index with fail-closed structural validation, including artifact/checksum/provenance/signature coverage and nightly identity constraints. Stacked Draft #236 adds detached Ed25519 signature verification and a bounded operator CLI. Neither publishes an immutable release, distributes trust roots, completes key rotation/revocation/custody, or transfers ancestor checks into current release authority. + ## 12. Mathematical and psychometric future constraint LifeOS currently has no psychometric computation service. Future product-owned mathematical or psychometric kernels are Rust-first, use low-context-switch CPU multithreading, add parity-verified GPU paths where material, and prove parameter recovery, uncertainty/coverage, convergence, reproducibility, multilevel/multiple-membership structure, and temporal/repeated-measurement semantics before product claims. From bc53e08aeeb38cc8f27522dba5fecd87c3d23955 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 12:09:25 +0900 Subject: [PATCH 117/173] test(docs): require current active product stacks --- .../src/documentation-currentness.test.mjs | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/packages/commercial-readiness/src/documentation-currentness.test.mjs b/packages/commercial-readiness/src/documentation-currentness.test.mjs index e10354c29..fa5b5f507 100644 --- a/packages/commercial-readiness/src/documentation-currentness.test.mjs +++ b/packages/commercial-readiness/src/documentation-currentness.test.mjs @@ -56,7 +56,10 @@ test('canonical maturity follows protected main and current active work', () => ); } - for (const pullRequest of [145, 198, 199, 204, 205]) { + for (const pullRequest of [ + 145, 198, 199, 204, 205, 208, 214, 216, 217, 228, 229, 234, 236, 245, + 250, + ]) { assertActiveAssessmentRow(pullRequest); } for (const pullRequest of [154, 155, 156, 195, 200, 203]) { @@ -75,4 +78,8 @@ test('canonical gaps remain bounded and truthful', () => { assert.match(assessment, /Issue #132.*Partial/su); assert.match(assessment, /PR #205[^\n]*host-owned delivery-origin authority foundation/iu); assert.match(assessment, /PR #204[^\n]*read-only Actions workflow-registry detector/iu); + assert.match(assessment, /PR #228[^\n]*OAuth state\/PKCE/iu); + assert.match(assessment, /PR #250[^\n]*signed delivery-origin operator authority/iu); + assert.match(assessment, /#209[^\n]*Partial/iu); + assert.match(assessment, /#210[^\n]*Partial/iu); }); From d05edaf2077dd11a387d2329f742b6495304c1e9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 12:09:54 +0900 Subject: [PATCH 118/173] test(docs): include current commercial buyer gaps --- .../src/documentation-currentness.test.mjs | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/packages/commercial-readiness/src/documentation-currentness.test.mjs b/packages/commercial-readiness/src/documentation-currentness.test.mjs index fa5b5f507..ac9d9ea16 100644 --- a/packages/commercial-readiness/src/documentation-currentness.test.mjs +++ b/packages/commercial-readiness/src/documentation-currentness.test.mjs @@ -74,7 +74,10 @@ test('canonical maturity follows protected main and current active work', () => }); test('canonical gaps remain bounded and truthful', () => { - assert.match(traceability, /Canonical buyer gaps remain #55, #129 and #130/u); + assert.match( + traceability, + /Canonical buyer gaps remain #55, #129, #130, #209, and #210/u, + ); assert.match(assessment, /Issue #132.*Partial/su); assert.match(assessment, /PR #205[^\n]*host-owned delivery-origin authority foundation/iu); assert.match(assessment, /PR #204[^\n]*read-only Actions workflow-registry detector/iu); From 82b918a2a39a3151135ffff848ddbead57c8b801 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 12:10:52 +0900 Subject: [PATCH 119/173] docs: refresh buyer-gap requirements --- docs/PRD.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/PRD.md b/docs/PRD.md index dec8b803d..b11da8226 100644 --- a/docs/PRD.md +++ b/docs/PRD.md @@ -43,7 +43,7 @@ LifeOS is a privacy-first, multi-user, server-backed, self-hostable personal ope | PRD-REV-002 | Guided-review routes require request-bound signed workspace authority. | Implemented on protected main | PR #185 | | PRD-CAL-001 | Google/CalDAV synchronization is conflict-safe and tenant-scoped. | Implemented on protected main | Calendar provider tests | | PRD-CAL-002 | Calendar synchronization uses signed trusted workspace context, not browser-selected ownership. | Implemented on protected main | PR #139 | -| PRD-CAL-003 | Complete encrypted per-user credential lifecycle, OAuth/PKCE, refresh/revoke, discovery/selection, and scoped sync. | Partial | issue #129 | +| PRD-CAL-003 | Complete encrypted per-user credential lifecycle, OAuth/PKCE, callback/token exchange, refresh/revoke, discovery/selection, and scoped sync. | Partial | issue #129; active PR #216 and PR #228 narrow hosted credential and OAuth state/PKCE boundaries | | PRD-CAL-004 | Calendar-owned connection metadata is scoped to exact workspace and user and stores opaque secret references only. | Implemented on protected main | PR #150 | | PRD-CAL-005 | Local connection revocation is atomic, replay-safe, and tenant/user scoped. | Implemented on protected main | PR #153 | | PRD-CAL-006 | User-sensitive hosted operations use signed `life-os.calendar-user.v1` workspace+user authority. | Implemented on protected main | PR #155 | @@ -59,20 +59,22 @@ LifeOS is a privacy-first, multi-user, server-backed, self-hostable personal ope | PRD-PRIV-005 | Independent services use versioned `life-os.data-rights-contributor.v1`, never cross-service SQL. | Implemented on protected main | PR #159 | | PRD-PRIV-007 | Planning owns a deterministic PostgreSQL-backed contributor and authenticated request-bound transport. | Implemented on protected main | PR #179 and PR #194 | | PRD-PRIV-008 | Habit owns a deterministic PostgreSQL-backed contributor and replay-safe authenticated transport. | Implemented on protected main | PR #184 and PR #192 | -| PRD-PRIV-009 | Review, Notification, and AI own bounded contributors without widening Identity database authority. | Implemented on active PR | PR #195, PR #198, PR #199 | +| PRD-PRIV-009 | Review, Notification, and AI own bounded contributors without widening Identity database authority. | Partial | Review protected in PR #195; Notification PR #198 and AI PR #199 remain active until integration | | PRD-INT-001 | Plugin SDK/manifest/event contracts are versioned, bounded, and deny direct database authority. | Implemented on protected main | Plugin SDK/integration tests | -| PRD-INT-002 | Complete concrete secret/KMS, authorized-origin outbound delivery, retry/dead-letter, revocation fencing, and operator lifecycle. | Partial | issue #130 | +| PRD-INT-002 | Complete concrete secret/KMS, authorized-origin outbound delivery, retry/dead-letter, revocation fencing, and operator lifecycle. | Partial | issue #130; active #205/#235/#241/#242/#243/#244/#245/#250 narrow durable origin, Vault, PostgreSQL and signed operator boundaries but do not authorize outbound networking | | PRD-INT-003 | A manifest is intent only; the host grants an explicit tenant/user-scoped capability subset. | Implemented on protected main | PR #151 | | PRD-INT-004 | Plugin installation persistence is restart-safe and validates exact opaque installation/workspace/installer evidence. | Implemented on protected main | PR #169 and PR #175 | | PRD-INT-005 | Credential binding stores only opaque secret references and compensates conflicting durable winners. | Implemented on protected main | PR #172 | | PRD-INT-006 | Operator requests use exact request-bound one-time authority, durable replay protection, and fail-closed HTTP composition. | Implemented on protected main | PR #191 and PR #196 | | PRD-WEB-001 | The PWA is responsive, keyboard-operable, installable, and structurally localized in Korean and English. | Implemented on protected main | Browser/accessibility/localization tests | | PRD-WEB-002 | Gateway Today composes authenticated Planning and Habit state without fabricated success. | Implemented on protected main | PR #186 and PR #187; Issue #163 completed | +| PRD-WEB-003 | The first-party authenticated buyer journey covers Goals → Projects → Tasks → Habits → Review with durable server evidence, explicit normal/loading/empty/error/permission states, responsive keyboard/a11y behavior, Figma/Storybook traceability, and KO/EN/JA/ZH/VI/ES/DE/FR locale parity. | Partial | issue #209; active authenticated Goal BFF #214, durable Goals workspace #229 and stacked Weekly Review workspace #234 are bounded evidence only | | PRD-OPS-001 | Logical PostgreSQL backup/restore proves integrity and refuses unsafe targets. | Implemented on protected main | Backup scripts/tests/runbook | | PRD-OPS-002 | Deployment/readiness/metrics are provider-neutral and bounded. | Implemented on protected main | Compose/Kubernetes/observability evidence | | PRD-GOV-001 | Capability maturity and canonical buyer-gap exhaustion are reported independently. | Implemented on protected main | Commercial Readiness registry | | PRD-GOV-002 | Exact source, PR-base snapshot, live base, integration tree, workflow checkout, protected main, and release identities remain distinct. | Implemented on protected main | PR #154 and ADR 0010; issue #132 remains Partial | -| PRD-GOV-003 | Scheduled model-assisted development uses exact pinned OpenCode and independent deterministic gates. | Implemented on protected main | PR #200 repairs the reviewed bootstrap boundary | +| PRD-GOV-003 | Scheduled model-assisted development preserves exact reviewed OpenCode identity but routes model capability through a released contextual-orchestrator client/gateway using virtual `orchestrator/free`; provider credentials and model selection remain owner-side bootstrap authority. | Partial | protected #200 is bootstrap evidence; active PR #208 is blocked on the immutable contextual-orchestrator authentication/bootstrap release and current exact-head gates | +| PRD-REL-001 | A commercial release binds one unchanged protected source to version/CHANGELOG/tag/package plus immutable artifact, SBOM, provenance, signature verification, reproducibility, rollback/recovery and operator-verifiable evidence. | Partial | issue #210; active Draft #217 and stacked #236 narrow structural/signature evidence but do not publish a release | ## Non-functional requirements From 6cc9d07924a2091cc153a8a91cce1dae9d63d526 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 12:11:30 +0900 Subject: [PATCH 120/173] docs: reconcile active stack traceability --- docs/TRACEABILITY.md | 48 ++++++++++++++++++++++++++++++++------------ 1 file changed, 35 insertions(+), 13 deletions(-) diff --git a/docs/TRACEABILITY.md b/docs/TRACEABILITY.md index 10e6a566e..ae42e7776 100644 --- a/docs/TRACEABILITY.md +++ b/docs/TRACEABILITY.md @@ -19,7 +19,7 @@ Protected-main source/migrations/tests and live repository policy outrank this i | PRD-REV-002 exact request-bound signed Review authority | Implemented on protected main | PR #185 | — | | PRD-CAL-001 conflict-safe Google/CalDAV synchronization | Implemented on protected main | Calendar provider tests | — | | PRD-CAL-002 signed workspace synchronization context | Implemented on protected main | PR #139 | — | -| PRD-CAL-003 complete per-user encrypted provider credential lifecycle | Partial | protected foundations below | issue #129 | +| PRD-CAL-003 complete per-user encrypted provider credential lifecycle | Partial | protected #203 plus active #216/#228 hosted/OAuth-state boundaries | issue #129 callback/token exchange, durable OAuth-state persistence, refresh/provider cleanup/discovery/scoped sync | | PRD-CAL-004 workspace+user connection metadata and opaque handles | Implemented on protected main | PR #150 | issue #129 | | PRD-CAL-005 atomic local connection revocation | Implemented on protected main | PR #153 | provider cleanup #129 | | PRD-CAL-006 signed workspace+user hosted authority | Implemented on protected main | PR #155 | — | @@ -30,25 +30,27 @@ Protected-main source/migrations/tests and live repository policy outrank this i | PRD-AI-002 deterministic/live-provider separation | Implemented on protected main | evaluator/live-conformance split | — | | PRD-PRIV-001 purpose-bound sensitive access | Implemented on protected main | Privacy service | — | | PRD-PRIV-002 recent-auth + durable request/receipt/status | Implemented on protected main | Identity data-rights foundations | issue #55 parent remains | -| PRD-PRIV-003 complete cross-domain export/deletion/reconciliation/delivery | Partial | protected and active contributors below | issue #55 | +| PRD-PRIV-003 complete cross-domain export/deletion/reconciliation/delivery | Partial | protected and active contributors | issue #55 | | PRD-PRIV-004 deterministic export integrity evidence | Implemented on protected main | export manifest tests | issue #55 parent remains | | PRD-PRIV-005 versioned service-owned contributor lifecycle | Implemented on protected main | PR #159 | issue #55 | | PRD-PRIV-007 Planning contributor and authenticated transport | Implemented on protected main | PR #179 and PR #194 | issue #55 | | PRD-PRIV-008 Habit contributor and authenticated transport | Implemented on protected main | PR #184 and PR #192 | issue #55 | -| PRD-PRIV-009 Review/Notification/AI contributors | Implemented on active PR | PR #195, PR #198, PR #199 | integrate; remaining owners/reconciliation | +| PRD-PRIV-009 Review/Notification/AI contributors | Partial | Review protected in PR #195; Notification PR #198 and AI PR #199 active | integrate remaining contributors/reconciliation | | PRD-INT-001 plugin SDK/manifest/event validation | Implemented on protected main | Plugin SDK/integration tests | — | -| PRD-INT-002 complete concrete secret/outbound delivery runtime | Partial | protected authority foundations below | issue #130 | +| PRD-INT-002 complete concrete secret/outbound delivery runtime | Partial | protected foundations plus active #205/#235/#241/#242/#243/#244/#245/#250 | issue #130 outbound HTTPS/connect-time controls/outcomes/retry/recovery | | PRD-INT-003 explicit host-owned installation grants | Implemented on protected main | PR #151 | issue #130 parent remains | | PRD-INT-004 durable exact plugin installation authority | Implemented on protected main | PR #169 and PR #175 | issue #130 | -| PRD-INT-005 opaque credential-binding secret references | Implemented on protected main | PR #172 | concrete KMS #130 | -| PRD-INT-006 one-time request-bound operator authority and HTTP composition | Implemented on protected main | PR #191 and PR #196 | delivery runtime #130 | +| PRD-INT-005 opaque credential-binding secret references | Implemented on protected main | PR #172 | issue #130 | +| PRD-INT-006 one-time request-bound operator authority and HTTP composition | Implemented on protected main | PR #191 and PR #196 | issue #130 | | PRD-WEB-001 accessible localized PWA | Implemented on protected main | browser/accessibility/localization tests | — | | PRD-WEB-002 authenticated real Planning/Habit Today composition | Implemented on protected main | PR #186 and PR #187; Issue #163 completed | — | +| PRD-WEB-003 complete first-party authenticated buyer journey | Partial | active BFF/workspace stack including PR #214, PR #229, PR #234 | issue #209 Figma/Storybook, all states, full locale parity, authoritative Review projections, release E2E | | PRD-OPS-001 logical backup/restore integrity | Implemented on protected main | scripts/tests/runbook | — | | PRD-OPS-002 provider-neutral deployment/readiness/metrics | Implemented on protected main | infrastructure/observability tests | — | | PRD-GOV-001 buyer-gap vs capability-maturity separation | Implemented on protected main | Commercial Readiness registry | — | | PRD-GOV-002 exact source/live-base/integration evidence separation | Implemented on protected main | PR #154 + ADR 0010 | Issue #132 remains Partial | -| PRD-GOV-003 exact pinned OpenCode bootstrap policy | Implemented on protected main | PR #200 | fresh protected scheduled-run verification | +| PRD-GOV-003 contextual-orchestrator model authority with exact OpenCode identity | Partial | protected #200 bootstrap; active #208 `orchestrator/free` consumer lane | immutable contextual-orchestrator authentication/bootstrap release + exact consumer GREEN | +| PRD-REL-001 immutable commercial release evidence | Partial | active Draft #217 structural index + stacked #236 signature verification | issue #210 immutable release, trust roots/key lifecycle, packaging/SBOM/provenance/recovery | | Integration event exact request authority | Implemented on protected main | PR #190 | — | ## Architecture decisions @@ -63,8 +65,9 @@ Protected-main source/migrations/tests and live repository policy outrank this i | Capability maturity differs from buyer-gap exhaustion | Accepted architecture | ADR 0008 | | Canonical documentation uses exact maturity vocabulary | Accepted architecture | ADR 0007 | | Verification identities remain separate | Accepted architecture | ADR 0010 + PR #154 | -| Integration identity, metadata, secret references, and grants remain separate | Accepted architecture | ADR 0011 + protected Calendar/Plugin lines | -| Strong-route model baseline and deterministic review/merge/release authority remain separate | Accepted architecture | ADR 0012 + Fugu/Conductor/TRINITY/counterevidence | +| Integration identity, metadata, secret references, and grants remain separate | Accepted architecture | ADR 0011 + protected/active Calendar and Plugin lines | +| Model capability is owner-routed and deterministic review/merge/release authority remains separate | Accepted architecture | ADR 0012 + protected #200 + active #208 owner boundary | +| Service persistence/migrations/credentials remain service-owned | Accepted architecture | ADR 0013 + active Integration PostgreSQL/Vault composition | ## Protected-main authority chronology since the prior canonical snapshot @@ -81,24 +84,43 @@ Protected-main source/migrations/tests and live repository policy outrank this i - PR #190: request-bound integration event authority. - PR #191 and PR #196: plugin operator one-time authority and fail-closed HTTP composition. - PR #193: scoped Calendar credential materialization port. +- PR #195: Review-owned data-rights contributor. - PR #197: authenticated Calendar connection creation. +- PR #200: exact pinned OpenCode bootstrap allowlist. - PR #201: returned-create-evidence validation and reverse-order secret compensation. +- PR #203: Calendar-owned encrypted self-hosted credential storage. ## Active-PR evidence | Pull request | Status | Bounded meaning | | --- | --- | --- | -| PR #145 | Implemented on active PR | this canonical documentation successor | -| PR #195 | Implemented on active PR | Review-owned data-rights contributor | +| PR #145 | Implemented on active PR | canonical whole-product documentation successor | | PR #198 | Implemented on active PR | Notification-owned data-rights contributor | | PR #199 | Implemented on active PR | AI-owned data-rights contributor and additive cursor contract | -| PR #200 | Implemented on protected main | exact pinned OpenCode bootstrap allowlist repair | +| PR #204 | Implemented on active PR | read-only exact-tree Actions workflow-registry detector | +| PR #205 | Implemented on active PR | host-owned delivery-origin authority foundation | +| PR #208 | Implemented on active PR | exact OpenCode identity with contextual-orchestrator `orchestrator/free` routing; owner release/authentication blocker remains | +| PR #214 | Implemented on active PR | authenticated first-party Goal BFF foundation for #209 | +| PR #216 | Implemented on active PR | hosted Calendar rejects deployment-wide provider credentials pending user-owned composition | +| PR #217 | Implemented on active PR | structural release-evidence index/validator for #210 | +| PR #228 | Implemented on active PR | scoped Google OAuth state/PKCE authority; no callback/token exchange yet | +| PR #229 | Implemented on active PR | durable browser-safe Goals workspace on authenticated BFF stack | +| PR #234 | Implemented on active PR | durable Weekly Review workspace with persistence-aligned period uniqueness; prerequisite stack remains Draft | +| PR #236 | Implemented on active PR | detached Ed25519 release-evidence verification/operator CLI stacked on #217 | +| PR #245 | Implemented on active PR | concrete hosted Plugin Vault + Integration-owned PostgreSQL runtime with retained real-server acceptance ancestry | +| PR #250 | Implemented on active PR | signed delivery-origin operator authority stacked on #245; HTTP/outbound delivery intentionally absent | No active row is shipped truth. Pending CI, draft state, unresolved review, branch movement, predecessor evidence, and merge compatibility remain independently evaluated. ## Buyer-gap state -Canonical buyer gaps remain #55, #129 and #130. Protected contributor, Calendar, and Plugin authority narrows them but does not close them. Issue #132 remains **Partial** as a verification-governance issue, not a canonical buyer-visible product gap. Issue #148 remains open until this exact documentation successor integrates. Issue #163 is completed by protected real Planning/Habit Today composition. +Canonical buyer gaps remain #55, #129, #130, #209, and #210. Protected and active capability slices narrow them but do not close them. Issue #132 remains **Partial** as verification governance rather than buyer-visible product capability. Issue #148 remains documentation integration work. Issue #163 is completed by protected real Planning/Habit Today composition. + +- #55: all-owner data-rights participant inventory/reconciliation, retention/legal hold, backup expiry, protected delivery and terminal whole-right evidence. +- #129: complete per-user Calendar OAuth/provider credential lifecycle, discovery/selection and scoped synchronization. +- #130: complete Plugin secret/outbound network/delivery outcome/retry/recovery lifecycle. +- #209: complete first-party product journey, Figma/Storybook traceability, responsive/a11y states and KO/EN/JA/ZH/VI/ES/DE/FR parity. +- #210: exact protected-head immutable release with package/tag/SBOM/provenance/signature/reproducibility/rollback/recovery evidence. ## Evidence hierarchy From 7d63313227d9419ffa0e09232945e0a058f4e7d9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 12:12:21 +0900 Subject: [PATCH 121/173] docs: repair active-stack documentation assessment --- docs/DOCUMENTATION_ASSESSMENT.md | 144 ++++++++++++++++--------------- 1 file changed, 76 insertions(+), 68 deletions(-) diff --git a/docs/DOCUMENTATION_ASSESSMENT.md b/docs/DOCUMENTATION_ASSESSMENT.md index e85ea4091..d4adb34ad 100644 --- a/docs/DOCUMENTATION_ASSESSMENT.md +++ b/docs/DOCUMENTATION_ASSESSMENT.md @@ -12,65 +12,75 @@ This assessment intentionally avoids embedding volatile head SHAs. Exact heads, | Dimension | Status | Evidence and remaining condition | | --- | --- | --- | -| Product definition and supersession chain | Implemented on active PR | PRD/Architecture preserve server-backed modular MSA + UUIDv4 and explicit offline/draft/Compose profiles | -| Technical boundaries | Implemented on active PR | TRD aligns service ownership, signed authority, concurrency, and active contributor work | -| Root Architecture | Partial | protected architecture is current through Calendar encrypted credential storage (#203) and Review-owned data rights (#195); active #198/#199 contributor work plus the bounded #205 plugin delivery-origin authority still require canonical reconciliation before integration | -| ADR index/details | Implemented on active PR | ADR 0001-0012 indexed with decision/recovery/security/acceptance/rollback/supersession sections | -| UML/C4/sequence/state/deployment/authority/recovery | Implemented on active PR | current protected and active boundaries are visually separated; protected #203 narrows Calendar credential storage but does not complete the remaining #129 OAuth/provider lifecycle | -| Logical ERD/Data Model | Implemented on active PR | protected persistence vs active migrations vs incomplete conceptual delivery are explicit | -| API/event/schema/version contracts | Partial | protected Calendar/contributor/Plugin operator contracts are reconciled; active #198/#199 and bounded #205 delivery-origin authority remain non-shipped until exact-head integration | -| Security and Threat Model | Partial | protected #203 encrypted credential-store controls are shipped evidence, while active #199 database authority hardening and active #205 host-owned delivery-origin authority remain non-shipped security evidence | -| Privacy/Data Lifecycle | Implemented on active PR | protected/active contributors and remaining #55/#129/#130 obligations are separated | -| Test Strategy | Implemented on active PR | realistic PostgreSQL/browser/security/coverage/documentation contracts remain canonical | -| Operability/incident/recovery | Implemented on active PR | service-owned recovery and fail-closed degraded behavior remain canonical | -| Release/Migration/Rollback/provenance | Implemented on active PR | exact integrated protected source remains the only release authority | -| Standards/Research | Implemented on active PR | final standards and publication-status-aware APA 7 model-orchestration evidence remain linked | -| Traceability | Partial | protected chronology includes #195/#203; active #198/#199/#204/#205 still require final integration-state propagation before documentation merge | -| README discoverability | Implemented on active PR | canonical files remain linked; integration is still required | -| Protected `AGENTS.md` authority | Implemented on protected main | live single-maintainer approval policy, writer lease, model credential, and exact-evidence rules | -| CLAUDE discoverability | Implemented on active PR | points contributors to protected authority and canonical graph | -| CHANGELOG product/governance history | Implemented on active PR | protected product entries and the ADR 0012 governance entry are preserved without inventing product behavior | -| Executable documentation contracts | Partial | semantic tests must distinguish protected #195/#200/#203 from current active #145/#198/#199/#204/#205 without cross-row regular-expression matches | +| Product definition and supersession chain | Implemented on active PR | PRD/Architecture preserve server-backed modular MSA, UUIDv4, explicit offline/draft profiles, service-owned durability and active-vs-protected separation | +| Technical boundaries | Partial | protected service authority remains current; active Calendar, Plugin, model-routing, first-party journey and release stacks still require full TRD/API/UML/security propagation before docs integration | +| Root Architecture | Implemented on active PR | current active Calendar #216/#228, Plugin chain through #250, model-routing #208, and release #217/#236 are separated from protected truth | +| ADR index/details | Implemented on active PR | ADR 0001-0013 remain indexed; active evidence may narrow implementation without retroactively marking an architectural decision shipped | +| UML/C4/sequence/state/deployment/authority/recovery | Partial | existing views remain authoritative for protected boundaries; the current active #209/#129/#130/#210 stacks still need diagram-level propagation | +| Logical ERD/Data Model | Partial | protected ownership is preserved; active OAuth-state, Plugin grant/Vault/PostgreSQL and release-evidence structures need current active labeling across the logical model | +| API/event/schema/version contracts | Partial | protected contracts remain shipped truth; active #228/#250 and #209 BFF/workspace surfaces require current active contract propagation | +| Security and Threat Model | Partial | purpose-bound authority remains canonical; active Vault, OAuth verifier, delivery-origin and contextual-orchestrator authentication boundaries need current threat-model propagation | +| Privacy/Data Lifecycle | Partial | Review is protected while Notification/AI contributors remain active; #55 completion/reconciliation/retention/delivery is still open | +| Test Strategy | Partial | realistic PostgreSQL/browser/security evidence remains canonical; current exact-head and real-server evidence identities need active-stack propagation without inheriting predecessor GREEN | +| Operability/incident/recovery | Partial | service-owned recovery is canonical; Calendar provider cleanup, Plugin delivery retry/dead-letter and immutable release recovery remain open | +| Release/Migration/Rollback/provenance | Partial | issue #210 is now an explicit buyer gap; active #217/#236 narrow evidence validation but do not constitute an immutable release | +| Standards/Research | Implemented on active PR | final standards and publication-status-aware research remain linked; no active product slice changes authority of primary standards | +| Traceability | Implemented on active PR | protected chronology and selected current architecture-defining active stacks are now separated, including #209/#210 buyer gaps | +| README discoverability | Partial | canonical files remain linked; buyer-gap/current-active summaries still require final propagation before integration | +| Protected `AGENTS.md` authority | Implemented on protected main | live single-maintainer, exact-evidence and protected-branch policy remains superior authority | +| CLAUDE discoverability | Partial | contributor routing remains present; current owner-release/model-routing and buyer-gap summaries require reconciliation | +| CHANGELOG product/governance history | Partial | protected history remains; this documentation-currentness repair still needs an exact-head accepted changelog entry before integration | +| Executable documentation contracts | Implemented on active PR | currentness contract now requires selected architecture-defining active PR rows and canonical buyer gaps #55/#129/#130/#209/#210 | ## Protected-main reconciliation -The prior canonical branch snapshot stopped near PR #155 and therefore mislabeled several integrated capabilities as active or absent. This successor now represents these protected changes: - -- PR #154 is **Implemented on protected main** for exact-source verification identity and independently reconstructed live-base compatibility; -- PR #155 is **Implemented on protected main** for signed workspace-and-user Calendar authority; -- PR #156 is **Implemented on protected main** in the protected lifecycle lineage captured by PRD, Traceability, Data Model, and API contracts; -- PR #157 authenticated Calendar disconnect; -- PR #159 versioned service-owned data-rights contributor lifecycle; -- PR #168 and PR #188 signed/request-bound Planning authority; -- PR #169, PR #172, and PR #175 durable plugin installation, opaque credential binding, and exact installation evidence; -- PR #173 signed Habit authority; -- PR #176 and PR #189 exact Calendar lookup and authenticated read; -- PR #179 and PR #194 Planning contributor and authenticated transport; -- PR #184 and PR #192 Habit contributor and authenticated replay-safe transport; -- PR #185 request-bound Review authority; -- PR #186 and PR #187 real authenticated Planning/Habit Today composition; -- PR #190 request-bound integration event authority; -- PR #191 and PR #196 one-time plugin operator authority and fail-closed HTTP composition; -- PR #193 scoped Calendar credential materialization port; -- PR #197 authenticated Calendar connection creation; -- PR #200 is **Implemented on protected main** for the exact pinned OpenCode bootstrap allowlist; -- PR #201 returned-create-evidence validation and reverse-order secret compensation; -- PR #203 Calendar-owned encrypted self-hosted credential storage; -- PR #195 is **Implemented on protected main** for the Review-owned data-rights contributor. - -Issue #163 is completed. PR #164 remains the historical fake-success removal, while PR #186 and PR #187 are the protected real-composition completion evidence. - -PR #156, PR #160, PR #162, PR #165, PR #175, PR #176, PR #178, PR #179, PR #195, PR #200, and PR #203 must not be described as current active PRs. Their relevant work is integrated, superseded, or historically replaced by the protected lines above. +The canonical branch retains these shipped authorities. The same line must never be relabeled active merely because successor work exists: + +- PR #154 — **Implemented on protected main** for exact-source verification identity and independently reconstructed live-base compatibility. +- PR #155 — **Implemented on protected main** for signed workspace-and-user Calendar authority. +- PR #156 — **Implemented on protected main** in the protected Calendar lifecycle lineage. +- PR #157 — **Implemented on protected main** for authenticated Calendar disconnect. +- PR #159 — **Implemented on protected main** for the versioned service-owned data-rights contributor lifecycle. +- PR #168 and PR #188 — **Implemented on protected main** for Planning signed/request-bound authority. +- PR #169, PR #172 and PR #175 — **Implemented on protected main** for durable plugin installation, opaque credential binding and exact installation evidence. +- PR #173 — **Implemented on protected main** for signed Habit authority. +- PR #176 and PR #189 — **Implemented on protected main** for exact Calendar lookup and authenticated read. +- PR #179 and PR #194 — **Implemented on protected main** for Planning contribution and authenticated transport. +- PR #184 and PR #192 — **Implemented on protected main** for Habit contribution and authenticated replay-safe transport. +- PR #185 — **Implemented on protected main** for request-bound Review authority. +- PR #186 and PR #187 — **Implemented on protected main** for real authenticated Planning/Habit Today composition. +- PR #190 — **Implemented on protected main** for request-bound integration event authority. +- PR #191 and PR #196 — **Implemented on protected main** for one-time plugin operator authority and fail-closed HTTP composition. +- PR #193 — **Implemented on protected main** for scoped Calendar credential materialization. +- PR #195 — **Implemented on protected main** for the Review-owned data-rights contributor. +- PR #197 — **Implemented on protected main** for authenticated Calendar connection creation. +- PR #200 — **Implemented on protected main** for the exact pinned OpenCode bootstrap allowlist; this does not make direct-provider routing the current target architecture. +- PR #201 — **Implemented on protected main** for returned-create-evidence validation and reverse-order secret compensation. +- PR #203 — **Implemented on protected main** for Calendar-owned encrypted self-hosted credential storage. + +Issue #163 is completed. PR #164 remains historical fake-success-removal evidence; PR #186/#187 are the protected real-composition completion. + +PR #156, PR #160, PR #162, PR #165, PR #175, PR #176, PR #178, PR #179, PR #195, PR #200, and PR #203 must not be described as current active PRs. ## Current active pull-request line | Pull request | Status | Documentation meaning | Current gate caveat | | --- | --- | --- | --- | -| PR #145 | Implemented on active PR | single canonical whole-product documentation successor | Draft; exact-head CI/security/review and live-base validation required | -| PR #198 | Implemented on active PR | Notification-owned contributor migration/application/runtime/tests | exact-head CI currently fails only on an unreachable coverage branch; source repair remains non-shipped until integrated | -| PR #199 | Implemented on active PR | AI-owned contributor plus additive cursor contract; active hardening separates migration ownership from the lower-privilege runtime database role | exact-head CI/security/review/live-base validation required; active authority hardening is not protected truth until integration | -| PR #204 | Implemented on active PR | read-only Actions workflow-registry detector for active orphan identities and exact-tree evidence | required Strix evidence remains non-passing until a genuine exact-head run completes; detector does not authorize workflow mutation | -| PR #205 | Implemented on active PR | host-owned exact HTTPS delivery-origin grant authority scoped to installation/workspace/user | exact-head review/security/live-base validation required; no outbound HTTP, DNS/IP enforcement, durable grant adapter, or delivery outcome is protected truth | +| PR #145 | Implemented on active PR | single canonical whole-product documentation successor | Draft; exact-head docs/repository/security/review/live-base evidence required | +| PR #198 | Implemented on active PR | Notification-owned data-rights contributor | non-shipped until exact-head gates and normal integration | +| PR #199 | Implemented on active PR | AI-owned contributor plus additive cursor/runtime-authority hardening | non-shipped until exact-head gates and normal integration | +| PR #204 | Implemented on active PR | read-only Actions workflow-registry detector for exact-tree orphan evidence | detector grants no workflow mutation authority; exact-head policy/review still applies | +| PR #205 | Implemented on active PR | host-owned delivery-origin authority foundation | ancestor of the current #130 stack; no standalone outbound network authority | +| PR #208 | Implemented on active PR | exact OpenCode identity with contextual-orchestrator `orchestrator/free` routing | blocked on canonical owner authentication/bootstrap repair plus immutable upstream release and consumer GREEN | +| PR #214 | Implemented on active PR | authenticated first-party Goal BFF foundation for #209 | Draft base of a deep buyer-journey stack; exact-head gates must be reacquired after each restack | +| PR #216 | Implemented on active PR | hosted Calendar rejects deployment-wide provider credentials pending authenticated user-owned composition | does not itself implement Google OAuth callback/token lifecycle | +| PR #217 | Implemented on active PR | machine-readable structural release-evidence index/validator | Draft; no immutable release or current exact-head acceptance implied | +| PR #228 | Implemented on active PR | scoped Google OAuth state/PKCE authority with opaque durable state and secret-held verifier | no hosted callback/token exchange, durable PostgreSQL OAuth-state runtime or provider cleanup yet | +| PR #229 | Implemented on active PR | durable browser-safe Goals workspace consuming the authenticated BFF stack | does not complete Projects/Tasks/Habits/Review, Figma/Storybook or locale parity | +| PR #234 | Implemented on active PR | durable Weekly Review workspace with persistence-aligned `(ritual_kind, period_start_date)` uniqueness | stacked Draft; authoritative Planning/Habit review projections and full UI/localization gates remain open | +| PR #236 | Implemented on active PR | detached Ed25519 release-evidence verification and bounded operator CLI | stacked on #217; trust roots/key lifecycle and immutable release remain open | +| PR #245 | Implemented on active PR | concrete hosted Plugin Vault plus Integration-owned PostgreSQL runtime; retained ancestor real-server lifecycle acceptance | ancestor evidence is not current-head merge authority; outbound delivery remains absent | +| PR #250 | Implemented on active PR | signed delivery-origin operator authority over the existing service-owned aggregate/store | exact repair verifier is pending at current evidence point; HTTP delivery-origin transport and outbound networking are deliberately absent | Active work may change while this document is reviewed. The table records bounded semantic scope, not merge eligibility, current head identity, or gate success. @@ -79,30 +89,28 @@ Active work may change while this document is reviewed. The table records bounde | Issue | Status | Current meaning | | --- | --- | --- | | #21 | Partial | umbrella commercial readiness; capability maturity does not close buyer gaps | -| #55 | Partial | complete participant inventory, remaining contributors, reconciliation, retention/legal hold, backup expiry, protected export delivery, and terminal whole-right evidence | -| #129 | Partial | encrypted self-hosted credential storage is protected through #203, but OAuth state/PKCE/callback, refresh fencing, provider revoke/delete recovery, calendar discovery/selection, scoped sync lifecycle, and remaining credential lifecycle work remain incomplete | -| #130 | Partial | active #205 adds only a host-owned delivery-origin authority foundation; concrete plugin KMS, SSRF/DNS-rebinding-safe outbound delivery, durable delivery authority/persistence, outcomes, retry/dead-letter, and operator recovery remain incomplete | +| #55 | Partial | complete participant inventory, remaining contributors, reconciliation, retention/legal hold, backup expiry, protected export delivery and terminal whole-right evidence | +| #129 | Partial | protected encrypted storage plus active #216/#228 narrow hosted/OAuth state authority; callback/token exchange, durable OAuth-state runtime, refresh, provider cleanup/discovery and scoped sync remain incomplete | +| #130 | Partial | active chain through #250 narrows origin/Vault/PostgreSQL/operator authority; connect-time SSRF-safe outbound HTTPS, outcomes, retry/dead-letter and operator recovery remain incomplete | +| #209 | Partial | active first-party Goal/BFF/workspace/Review stack exists, but complete Goals→Projects→Tasks→Habits→Review journey, Figma/Storybook traceability, all UI states, authoritative Review projections and KO/EN/JA/ZH/VI/ES/DE/FR parity remain incomplete | +| #210 | Partial | active #217/#236 validate release evidence/signatures, but immutable version/tag/package/release, trust/key lifecycle, SBOM/provenance/reproducibility and rollback/recovery acceptance remain incomplete | | Issue #132 | Partial | residual central reusable scanner checkout/SARIF/status attribution taxonomy | | #148 | Partial | closes only when this exact canonical successor integrates and currentness evidence remains green | -Canonical buyer-visible gaps are #55, #129, and #130. Issue #132 is verification governance. Issue #148 is documentation integration work. Neither should be silently counted as a buyer-visible product capability gap. +Canonical buyer gaps are #55, #129, #130, #209, and #210. Issue #132 is verification governance and #148 is documentation integration; neither is silently counted as a buyer-visible product capability. ## Semantic checks performed by this successor -- Protected-main capability chronology is reflected across PRD, TRD, Architecture, Data Model, UML, API, Threat Model, Privacy, and Traceability. -- PR #195, PR #200, and PR #203 are protected-main evidence and are not labeled as active work. -- Active PR #198, PR #199, PR #204, and PR #205 are labeled `Implemented on active PR`, not shipped. -- PR #199's current branch hardens the database authority boundary by separating migration ownership from runtime authority; this remains active-PR evidence until exact-head gates and integration complete. -- PR #204 is read-only control-plane evidence and does not grant authority to disable or mutate Actions workflow identities. -- PR #205 records bounded host-owned delivery-origin intent but performs no outbound network delivery and therefore does not close buyer gap #130. -- Protected PR #203 narrows but does not complete buyer gap #129. -- Parent issues remain `Partial` despite protected foundations and active slices. -- No cross-service persistence, provider revoke, end-to-end OAuth/KMS composition, plugin delivery table, SSRF-safe network runtime, or whole-right completion is invented. -- The closed Today truthfulness issue is not kept open in canonical buyer-gap state. +- Protected-main chronology remains authoritative and current active work is never promoted before integration. +- Review-owned data rights (#195) and OpenCode bootstrap (#200) remain protected evidence while Notification/AI contribution and the contextual-orchestrator consumer lane remain active as applicable. +- Calendar documentation distinguishes protected encrypted storage from active hosted rejection and OAuth state/PKCE without inventing callback/token success. +- Plugin documentation distinguishes protected operator foundations from active origin/Vault/PostgreSQL/signed-operator layers and from still-missing connect-time outbound authority. +- Buyer-visible #209 UI work remains Draft and explicitly lacks Figma/Storybook/full locale/release parity where not proven. +- #210 structural/signature evidence remains distinct from publishing an immutable release. - Exact source/live-base/integration/checkout/protected/release evidence identities remain separate. -- Model-assisted work cannot self-authorize review, merge, or release. -- Documentation contract tests must fail when merged predecessor work reappears as active, current active work disappears from assessment, or bounded active slices are promoted to protected truth. +- Model-assisted work cannot self-authorize review, merge or release and does not copy mutable owner source into LifeOS. +- Documentation contract tests fail when protected work reappears as active, selected current active architecture work disappears, or the canonical buyer-gap set regresses. ## Remaining integration conditions -PR #145 remains documentation-incomplete until the canonical documents and executable documentation contracts reconcile protected #195/#200/#203 and active #198/#199/#204/#205, then its unchanged exact head passes required CI, AppGuardrail, SAST Semgrep, Security Scan, Commercial Readiness, current review findings, and live-base compatibility and integrates under live policy. Integration of this line does not complete LifeOS: maintenance immediately returns to product/security/reliability work and the buyer gaps #55/#129/#130. +PR #145 remains documentation-incomplete until PRD/TRD/Architecture/Data Model/UML/API/Security/Threat Model/Privacy/Test/Operability/Release/Standards/Traceability/Assessment/README/CLAUDE/CHANGELOG and executable contracts are mutually code-current, then its unchanged exact head passes required repository/security checks, current independent review/thread state and live-base compatibility and integrates under live policy. Integration of this documentation line does not complete LifeOS; maintenance returns immediately to #55/#129/#130/#209/#210 product gaps. From ed9072c912ba320165efa213ac6773740f36632a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 12:13:13 +0900 Subject: [PATCH 122/173] docs: add current first-party buyer journey --- ARCHITECTURE.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 79aeda50c..7fafd908b 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -54,7 +54,7 @@ Planning is a protected contributor through PR #179 and its request-bound authen Issue #55 remains **Partial**. Active contributors do not become shipped truth, and even their future integration will not by itself finish Identity-owned data, Calendar, Privacy, Plugin Integration, durable reconciliation, retention/legal-hold/backup-expiry, protected export delivery, or final participant-set completion. -## 3. Planning, Habit, Review, Today, and Notification +## 3. Planning, Habit, Review, Today, Notification, and first-party journey Planning owns Goals, Projects, Tasks, search, and the durable Today aggregate. Habit owns recurring definitions and completion evidence. Review owns guided-review persistence/projections without Planning or Habit mutation authority. Notification owns reminder occurrences, claims, delivery attempts, outcomes, and recovery evidence. @@ -64,6 +64,10 @@ Gateway Today composition is real protected behavior: PR #186 composes authentic Durable Today synchronization is protected-main behavior. Durable Today uses explicit local-to-workspace acceptance, strong create/update preconditions, idempotency, and stale-conflict reconciliation. No browser draft is presented as durable before server acceptance. +Issue #209 is **Partial** for the complete first-party buyer journey. The current Draft stack starts at PR #214 with an authenticated Goal BFF that keeps Identity-derived workspace authority and exact Planning request signing server-side. Descendants add the remaining BFF prerequisites and buyer-visible workspaces; PR #229 is the durable `/goals` workspace and PR #234 is the current stacked `/review` workspace with persistence-aligned ritual-period uniqueness. These pages consume validated server-authoritative evidence and do not move Planning/Review persistence or workspace authority into the browser. + +The active journey remains incomplete until the dependency-ordered Goals → Projects → Tasks → Habits → Review flow has current-head browser E2E and exact repository gates after final restack, Figma/Storybook traceability, normal/loading/empty/error/permission/responsive/interaction states, keyboard/focus/reduced-motion/a11y acceptance, authoritative Review read projections, and KO/EN/JA/ZH/VI/ES/DE/FR translation-ledger/font/text-expansion parity. Active browser work is not protected product truth and does not close #209. + ## 4. Calendar integration boundary Calendar synchronization and user credential lifecycles use different authority contexts. From eb0421f7cc5243302efee9bb56355d1f19343c1a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 12:14:32 +0900 Subject: [PATCH 123/173] docs: refresh technical active boundaries --- docs/TRD.md | 51 +++++++++++++++++++++++++++++++++------------------ 1 file changed, 33 insertions(+), 18 deletions(-) diff --git a/docs/TRD.md b/docs/TRD.md index 6a4f0d298..f4bee0c79 100644 --- a/docs/TRD.md +++ b/docs/TRD.md @@ -6,21 +6,21 @@ This TRD defines repository-wide technical requirements. Protected-main code, mi ## Runtime baseline -LifeOS is a TypeScript-first monorepo with a Next.js PWA/BFF, independently bounded services, service-owned PostgreSQL persistence, and NATS JetStream where durable asynchronous delivery is required. Optional providers include Google/GitHub identity, Google/CalDAV calendar, NVIDIA NIM through reviewed AI boundaries, and versioned plugins. +LifeOS is a TypeScript-first monorepo with a Next.js PWA/BFF, independently bounded services, service-owned PostgreSQL persistence, and NATS JetStream where durable asynchronous delivery is required. Optional providers include Google/GitHub identity and Google/CalDAV calendar. Model capability is consumed through the reviewed contextual-orchestrator boundary rather than direct provider selection in product/runtime code; plugins use versioned host-owned contracts. ## Bounded contexts -- **Web/PWA:** interaction state, accessibility/localization, and explicitly local drafts/cache; no database authority. +- **Web/PWA:** interaction state, accessibility/localization, and explicitly local drafts/cache; no database authority. The complete first-party buyer journey remains **Partial** under #209. - **Gateway/BFF:** authenticated public composition and short-lived service-context derivation; no shared domain store. - **Identity:** users, provider mappings, sessions, workspace authority, authentication provenance, data-rights request/receipt orchestration, and export-integrity composition. - **Planning:** Goals, Projects, Tasks, search, durable Today, and a protected data-rights contributor. - **Habit:** recurring definitions/completions and a protected data-rights contributor. -- **Review:** guided-review persistence/projections; PR #195 is **Implemented on active PR** for its contributor. -- **Calendar Integration:** synchronization, connection metadata, workspace/user authority, credential ports, read/create/disconnect surfaces; complete hosted provider lifecycle remains **Partial** under #129. +- **Review:** guided-review persistence/projections and a protected Review-owned contributor from PR #195. +- **Calendar Integration:** synchronization, connection metadata, workspace/user authority, credential ports, read/create/disconnect surfaces; complete hosted provider lifecycle remains **Partial** under #129, with active #216/#228 narrowing hosted credential and OAuth state/PKCE boundaries. - **Notification:** reminder occurrences/claims/outcomes; PR #198 is **Implemented on active PR** for its contributor. - **AI Proposal:** inert proposals/evidence/decisions/evaluation; PR #199 is **Implemented on active PR** for its contributor. - **Privacy:** purpose-bound sensitive-access decisions/grants/events. -- **Plugin Integration:** contracts, installation/grant/credential/operator authority; delivery runtime remains **Partial** under #130. +- **Plugin Integration:** contracts, installation/grant/credential/operator authority; active #205/#235/#241/#242/#243/#244/#245/#250 narrow durable origin, Vault, PostgreSQL and signed operator composition while outbound delivery remains **Partial** under #130. ## Persistence and data requirements @@ -34,20 +34,21 @@ LifeOS is a TypeScript-first monorepo with a Next.js PWA/BFF, independently boun 8. External credentials remain behind least-authority secret-store/KMS ports and never become identity or primary-key material. 9. Persisted external identifiers are bounded metadata; opaque secret references are separate fields with separate authority. 10. Corrupt or ambiguous persisted evidence fails closed before it can become application authority. +11. A service-owned PostgreSQL pool may back multiple repositories inside one bounded context; cross-service SQL or mutable sibling-source coupling is still prohibited. ## Authentication and authorization -- OAuth callbacks validate state, provider, redirect/origin, and bounded transaction lifetime. +- OAuth callbacks validate state, provider, redirect/origin, bounded transaction lifetime, exact user/workspace authority, and one-time consumption before credential exchange. - Browser sessions are revocable and server-verifiable. - Authentication ceremony time survives compatible session rotation. -- Browser-selected workspace, actor, installation, connection, or request identifiers are never ownership authority. +- Browser-selected workspace, actor, installation, connection, request, grant, or credential identifiers are never ownership authority. - Signed private contexts bind exact workspace/actor, method, path, issuance, version, and one-time evidence where destructive replay matters. - Planning protected authority comes from PR #168 and exact request binding from PR #188. - Habit protected authority comes from PR #173; destructive contributor transport is protected by PR #192. - Review exact request-bound authority is protected by PR #185. - Calendar user-sensitive operations use `life-os.calendar-user.v1` from PR #155. - Integration event authority is exact-request-bound through PR #190. -- Plugin operator authority is one-time and replay-protected through PR #191 and fail-closed HTTP composition through PR #196. +- Plugin operator authority is one-time and replay-protected through PR #191 and fail-closed HTTP composition through PR #196. Active #250 extends the internal application verifier to exact signed delivery-origin collection/item/revoke routes but does not yet expose their HTTP transport. ## HTTP and application boundaries @@ -70,9 +71,17 @@ PR #186 composes authenticated Planning Today state and PR #187 composes authent **Status:** Partial -PR #159 defines `life-os.data-rights-contributor.v1` with explicit export, erase-preflight, erase, and verify-erased operations. Planning production contribution is protected through PR #179 and authenticated request-bound transport through PR #194. Habit production contribution is protected through PR #184 and transport/replay hardening through PR #192. +PR #159 defines `life-os.data-rights-contributor.v1` with explicit export, erase-preflight, erase, and verify-erased operations. Planning production contribution is protected through PR #179 and authenticated request-bound transport through PR #194. Habit production contribution is protected through PR #184 and transport/replay hardening through PR #192. Review production contribution is protected through PR #195. -PR #195, PR #198, and PR #199 are **Implemented on active PR** for Review, Notification, and AI contributions. They remain non-shipped until integration. Whole-product completion remains **Partial** under #55. +PR #198 and PR #199 are **Implemented on active PR** for Notification and AI contributions. They remain non-shipped until integration. Whole-product completion remains **Partial** under #55. + +### First-party buyer journey + +**Status:** Partial + +Issue #209 requires a dependency-ordered authenticated Goals → Projects → Tasks → Habits → Review journey. Active PR #214 establishes the first-party Goal BFF and keeps workspace authority/request signing server-side. The stacked buyer-path line reaches the durable `/goals` workspace at PR #229 and `/review` at PR #234. Browser reducers accept only bounded durable server evidence, reject stale/duplicate/malformed authority, preserve safe prior evidence on failures, and do not manufacture durable IDs. + +The stack remains non-shipped. Final acceptance requires exact-head browser E2E after prerequisite restacks, Figma/Storybook traceability, normal/loading/empty/error/permission/responsive/interaction states, keyboard/focus/reduced-motion/a11y coverage, authoritative Review read projections, and KO/EN/JA/ZH/VI/ES/DE/FR DB-versioned translation-ledger/font/text-expansion parity. ### Calendar connection lifecycle @@ -88,9 +97,12 @@ Protected main includes: - authenticated bounded read from PR #189; - scoped credential materialization port from PR #193; - authenticated secret-first create from PR #197; -- reverse-order compensation on mismatched returned durable evidence from PR #201. +- reverse-order compensation on mismatched returned durable evidence from PR #201; +- Calendar-owned AES-256-GCM encrypted self-hosted credential storage from PR #203. + +Active PR #216 fails hosted multi-user startup closed when deployment-wide Google/CalDAV credentials would otherwise substitute for user-owned authority. Stacked PR #228 adds five-minute OAuth state/PKCE authority with opaque durable state and secret-store-held verifier material and revalidates consumed repository evidence before secret materialization. -Concrete encrypted storage, OAuth/PKCE, refresh, provider cleanup, discovery/selection, and scoped synchronization remain **Partial** under #129. +Hosted callback/token exchange, successful post-exchange verifier cleanup, concrete PostgreSQL OAuth-state persistence, refresh fencing, provider revoke/delete recovery, discovery/selection, scoped synchronization, and complete KMS/runtime composition remain **Partial** under #129. ### Plugin installation and operator lifecycle @@ -98,17 +110,19 @@ Concrete encrypted storage, OAuth/PKCE, refresh, provider cleanup, discovery/sel Protected main includes explicit host grants (PR #151), durable installation persistence (PR #169), opaque credential binding (PR #172), exact installation-evidence validation (PR #175), one-time operator authority/replay storage (PR #191), and authenticated fail-closed operator HTTP composition (PR #196). -The runtime still requires a concrete secret-store/KMS adapter, separately host-authorized delivery origins, SSRF/DNS-rebinding-safe outbound HTTPS, attempt/outcome persistence, retry/dead-letter, revocation fencing, and operator-visible delivery recovery under #130. +The active stack adds host-owned delivery-origin authority (#205), PostgreSQL grant persistence/active-installation fencing (#235), credential/revocation hardening (#241), Vault KV v2 secret storage (#242), authenticated Vault composition (#243), one Integration-owned hosted PostgreSQL pool (#244), and a concrete hosted/default-entrypoint runtime with retained exact ancestor real Vault + migrated PostgreSQL lifecycle evidence (#245). Draft #250 adds exact signed delivery-origin grant/read/revoke application authority and canonical route verification. + +No active slice yet authorizes arbitrary outbound HTTP. #130 still requires immutable/versioned egress authority, connect-time DNS/IP/rebinding checks, redirect/proxy controls, bounded time/response handling, delivery attempt/outcome persistence, retries/dead-letter, revocation fencing at the network boundary, and operator-visible recovery. Durable origin grant identity is necessary but not sufficient network authority. ## Domain concurrency and idempotency - **Today:** strong create/update preconditions, ordered locking, exact replay, stale conflict, and explicit reconciliation. - **Habit completion:** tenant-scoped replay-safe persistence. - **Notification:** expiring/fenced claims and duplicate-delivery refusal. -- **Calendar:** exact connection/workspace/user authority, secret-first create compensation, deterministic provider preconditions, and local revoke replay. +- **Calendar:** exact connection/workspace/user authority, secret-first create compensation, bounded OAuth ceremony state, deterministic provider preconditions, and local revoke replay. - **AI decisions:** exact proposal digest/revision, actor/workspace, and idempotency binding. - **Data rights:** exact request/workspace/actor/contributor/replay identity, immutable terminal evidence, and owner-controlled erasure verification. -- **Plugin installation/operator:** exact installation/workspace/installer/manifest/grant/secret-binding/request evidence and atomic replay refusal. +- **Plugin installation/operator:** exact installation/workspace/installer/manifest/grant/secret-binding/request evidence, atomic replay refusal, and active-installation revalidation across credential/origin admission races. ## AI and repository automation requirements @@ -116,7 +130,7 @@ ADR 0012 is authoritative. Model output is untrusted structured data. Determinis A strong single-route baseline precedes conducted/deeper orchestration. Evaluation records supported workflow stage, reasoning effort, decomposition, recursion depth, role-specific reasoning effort, model/worker selection, verifier topology, and access/communication topology. Unsupported controls remain explicit rather than simulated. -Scheduled development uses reviewed OpenCode or contextual-orchestrator with `NVIDIA_NIM_API_KEY`; `COPILOT_GITHUB_TOKEN` is prohibited. PR #200 is **Implemented on protected main** for allowing only the exact reviewed `opencode-ai` lifecycle script needed to materialize the pinned executable. Unrelated lifecycle scripts remain denied. +Protected PR #200 preserves the exact reviewed OpenCode bootstrap boundary. The target scheduled-development architecture is the active #208 line: exact OpenCode identity with model calls routed only through a reviewed immutable contextual-orchestrator API/client and virtual `orchestrator/free`. Provider credentials are contextual-orchestrator bootstrap material, not LifeOS model-selection authority. The current LifeOS consumer remains Draft until the canonical owner fixes its authentication/bootstrap contract, publishes an immutable reviewed release, and the exact released consumer passes hosted acceptance. Mutable owner source copying and direct-provider fallback are prohibited. ## Security and privacy requirements @@ -127,11 +141,12 @@ Scheduled development uses reviewed OpenCode or contextual-orchestrator with `NV - Sensitive access is tenant/actor/purpose/resource/lifetime/audit bound. - No service claims whole-right completion from partial or unknown contributor state. - No manifest self-authorizes plugin capability or delivery origin. +- No durable delivery-origin grant self-authorizes a resolved IP, redirect target, proxy route, or later rebinding result. - No local calendar revoke is promoted to provider revoke. ## Accessibility, localization, and offline behavior -Core journeys remain keyboard-operable with visible focus, semantic names, non-color-only state, and localized Korean/English live feedback. Offline/local drafts remain visibly distinct from durable workspace state. Stale asynchronous responses cannot overwrite newer owned UI state. +Core journeys remain keyboard-operable with visible focus, semantic names, non-color-only state, and bounded localized feedback. The complete commercial locale target is KO/EN/JA/ZH/VI/ES/DE/FR with CJK/font fallback and text-expansion acceptance. Translation resources use a DB-versioned screen-key ledger/cache and remain distinct from ontology label ledgers. Offline/local drafts remain visibly distinct from durable workspace state. Stale asynchronous responses cannot overwrite newer owned UI state. ## Observability and operations @@ -145,4 +160,4 @@ Services expose bounded health/readiness reflecting actual dependencies. Metrics ## Release requirements -Release requires one unchanged integrated protected head with required CI/security/review, exact configured coverage/docstrings, package/container build, SBOM/provenance/reproducibility, compatibility, migration/rollback/recovery, accessibility/localization, and operational acceptance. A single merged feature, queued job, documentation line, or model result is not release readiness. +Issue #210 is **Partial**. Active Draft #217 adds a structural release-evidence index/validator and stacked #236 adds detached Ed25519 verification/operator tooling. A release still requires one unchanged integrated protected head with version/CHANGELOG/tag/package/immutable publication plus required CI/security/review, exact configured coverage/docstrings, package/container build, SBOM/provenance/signatures/reproducibility, compatibility, migration/rollback/recovery, accessibility/localization, deployment, and operational acceptance. A feature PR, queued job, ancestor GREEN, documentation line, or model result is not release readiness. From 87c8116fc4ffd9ebecd48e051c906b2a1cc0d738 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 12:18:45 +0900 Subject: [PATCH 124/173] docs: reconcile active service-owned data model --- docs/DATA_MODEL.md | 40 +++++++++++++++++++++++++++------------- 1 file changed, 27 insertions(+), 13 deletions(-) diff --git a/docs/DATA_MODEL.md b/docs/DATA_MODEL.md index 5bd5c5b7c..19421981a 100644 --- a/docs/DATA_MODEL.md +++ b/docs/DATA_MODEL.md @@ -35,6 +35,7 @@ erDiagram WORKSPACE_RECORD ||--o{ CALENDAR_CONNECTION_RECORD : authorizes USER_ACCOUNT ||--o{ CALENDAR_CONNECTION_RECORD : owns CALENDAR_CONNECTION_RECORD ||--o{ CALENDAR_SYNC_RECORD : tracks + CALENDAR_CONNECTION_RECORD ||--o{ OAUTH_AUTHORIZATION_STATE : authorizes WORKSPACE_RECORD ||--o{ REMINDER_OCCURRENCE : contains REMINDER_OCCURRENCE ||--o{ DELIVERY_OUTCOME : records @@ -51,9 +52,10 @@ erDiagram WORKSPACE_RECORD ||--o{ PLUGIN_INSTALLATION_RECORD : grants USER_ACCOUNT ||--o{ PLUGIN_INSTALLATION_RECORD : installs PLUGIN_INSTALLATION_RECORD ||--o{ PLUGIN_CREDENTIAL_BINDING_RECORD : binds + PLUGIN_INSTALLATION_RECORD ||--o{ PLUGIN_DELIVERY_ORIGIN_GRANT : authorizes ``` -Relationships from `USER_ACCOUNT` to Calendar/Plugin records express logical ownership identifiers only. They do not imply cross-schema foreign keys. +Relationships from `USER_ACCOUNT` to Calendar/Plugin records express logical ownership identifiers only. They do not imply cross-schema foreign keys. `OAUTH_AUTHORIZATION_STATE` and `PLUGIN_DELIVERY_ORIGIN_GRANT` are active-line logical records until their owning migrations integrate; the diagram does not promote them to protected persistence. ## Protected-main persistence @@ -73,9 +75,7 @@ Habit owns recurrence/completion evidence and its service-owned data-rights eras ### Review -Review owns guided-review completion/projection records. Request-bound workspace authority is protected through PR #185. - -The Review data-rights erasure receipt migration and contributor are **Implemented on active PR** in PR #195. They are not protected-main persistence until integration. +Review owns guided-review completion/projection records. Request-bound workspace authority is protected through PR #185. The Review data-rights erasure receipt migration and contributor are **Implemented on protected main** through PR #195. ### Notification @@ -91,9 +91,9 @@ Privacy owns purpose-bound access decisions, grants, consumption/fencing, and au ### Calendar Integration -**Status:** Implemented on protected main +**Status:** Partial -`calendar_integration.calendar_connection_record` is scoped simultaneously to opaque connection, workspace, and user UUIDv4 identities. It stores bounded provider/account/calendar metadata, normalized scopes, lifecycle timestamps, and opaque access/refresh secret references—not plaintext provider credentials. +`calendar_integration.calendar_connection_record` is protected and scoped simultaneously to opaque connection, workspace, and user UUIDv4 identities. It stores bounded provider/account/calendar metadata, normalized scopes, lifecycle timestamps, and opaque access/refresh secret references—not plaintext provider credentials. Protected-main lifecycle evidence: @@ -103,19 +103,32 @@ Protected-main lifecycle evidence: - PR #189 exposes a credential-free authenticated read projection; - PR #193 materializes secrets only through validated opaque handles; - PR #197 composes authenticated secret-first creation and compensation boundaries; -- PR #201 compensates both newly written handles when persistence returns mismatched durable evidence. +- PR #201 compensates both newly written handles when persistence returns mismatched durable evidence; +- PR #203 provides Calendar-owned AES-256-GCM encrypted self-hosted credential storage. -Concrete provider/KMS/OAuth state is not invented here and remains **Partial** under #129. +Active PR #216 prevents deployment-wide Google/CalDAV credentials from substituting for user-owned hosted authority. Stacked PR #228 adds an OAuth authorization-state aggregate with opaque UUIDv4 state identity, exact workspace/user/provider/redirect evidence, bounded expiry/consumption state and an opaque PKCE verifier secret reference. Verifier plaintext remains secret-store-owned. This active aggregate is not protected persistence yet, and #129 still requires concrete PostgreSQL state persistence, callback/token exchange, successful verifier cleanup, refresh fencing, provider revoke/delete recovery, discovery/selection and scoped synchronization. ### Plugin Integration -**Status:** Implemented on protected main +**Status:** Partial `plugin_integration.plugin_installation_record` is protected through PR #169 and retains opaque installation/workspace/installer UUIDv4 identities, bounded plugin/version metadata, exact manifest SHA-256 evidence, normalized explicit grants, lifecycle status, and timestamps. PR #175 requires exact opaque installation identity at application and repository boundaries. `plugin_integration.plugin_credential_binding_record` is protected through PR #172. It retains only bounded opaque `secret_reference` metadata and binding lifecycle evidence; plaintext credential material remains behind the `PluginSecretStore` port. -Operator request replay evidence is protected through PR #191 and consumed by the fail-closed HTTP composition from PR #196. Delivery attempt/outcome tables are not claimed because the complete runtime is **Partial** under #130. +Operator request replay evidence is protected through PR #191 and consumed by the fail-closed HTTP composition from PR #196. + +The active #130 stack adds Integration-owned persistence without widening this ownership boundary: + +- #205 defines the host-owned normalized HTTPS delivery-origin aggregate; +- #235 persists delivery-origin grants in Integration-owned PostgreSQL and fences them against active installation evidence; +- #241 strengthens credential/revocation admission consistency; +- #242 stores provider secret material behind an operator-configured Vault KV v2 adapter; LifeOS durable rows retain only opaque references; +- #243/#244 compose Vault operator authority and one Integration-owned PostgreSQL pool; +- #245 supplies the concrete hosted/default-entrypoint PostgreSQL runtime and retained exact-ancestor real Vault+PostgreSQL lifecycle acceptance; +- #250 exposes delivery-origin grant/read/revoke only through signed one-time operator application authority. + +These active rows are not protected truth until integration. There is still no delivery attempt/outcome persistence for plugin outbound delivery, and a durable delivery-origin grant is not connect-time DNS/IP/redirect/proxy authorization. #130 remains Partial. ## Data-rights participant model @@ -124,7 +137,7 @@ Operator request replay evidence is protected through PR #191 and consumed by th | Identity coordinator/ledger | Identity | Implemented on protected main | durable request/terminal receipt and status | | Planning contributor/receipt | Planning | Implemented on protected main | PR #179 and PR #194 | | Habit contributor/receipt | Habit | Implemented on protected main | PR #184 and PR #192 | -| Review contributor/receipt | Review | Implemented on active PR | PR #195 | +| Review contributor/receipt | Review | Implemented on protected main | PR #195 | | Notification contributor/receipt | Notification | Implemented on active PR | PR #198 | | AI contributor/receipt | AI Proposal | Implemented on active PR | PR #199 | | Remaining owning domains and whole-product reconciliation | Each owner + Identity coordinator | Partial | issue #55 | @@ -134,8 +147,9 @@ No participant row grants Identity direct access to another service's tables. Wh ## Cardinality and immutability - One workspace may contain many planning, habit, review, reminder, proposal, calendar, privacy, and plugin records. -- One Calendar connection belongs to exactly one workspace and one user authority scope. -- One Plugin installation belongs to exactly one workspace and one installing user and may have bounded credential bindings. +- One Calendar connection belongs to exactly one workspace and one user authority scope; an OAuth authorization state is bound to one exact workspace/user/provider ceremony and is one-time/expiring. +- One Plugin installation belongs to exactly one workspace and one installing user and may have bounded credential bindings and delivery-origin grants. +- One durable delivery-origin grant remains scoped to its installation/workspace/granting-user evidence and may be revoked; it does not confer authority over later network resolution. - One data-rights request has zero or more contributor sections/receipts and at most one immutable terminal aggregate receipt. - Proposal decisions, delivery outcomes, terminal data-rights receipts, and immutable audit evidence are append-only or mutation-denying by owning-service contract. - Mutable lifecycle rows expose explicit state/version/timestamps and deterministic replay/conflict semantics. From 9ad946bc40afc84413a5610bded814cf33a6fd65 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 12:19:36 +0900 Subject: [PATCH 125/173] docs: reconcile active application contracts --- docs/API_CONTRACTS.md | 60 ++++++++++++++++++++++++++++++++++++++----- 1 file changed, 53 insertions(+), 7 deletions(-) diff --git a/docs/API_CONTRACTS.md b/docs/API_CONTRACTS.md index e0907e898..a5ea395f6 100644 --- a/docs/API_CONTRACTS.md +++ b/docs/API_CONTRACTS.md @@ -15,6 +15,7 @@ This registry summarizes repository-level contract invariants. Concrete route, e - Cross-service contracts never grant direct database authority. - Unknown versions, malformed evidence, corrupt rows, and unavailable authority fail closed. - Verification evidence is valid only for the exact tree inspected. +- Active-PR contracts are not shipped API authority until normal protected integration. ## Contract registry @@ -34,6 +35,9 @@ This registry summarizes repository-level contract invariants. Concrete route, e | Calendar credential materialization | Calendar Integration | Implemented on protected main | PR #193; validated handles only | | Calendar connection creation | Calendar Integration | Implemented on protected main | PR #197; authenticated secret-first persistence/compensation | | Calendar create-evidence compensation hardening | Calendar Integration | Implemented on protected main | PR #201 | +| Calendar encrypted self-hosted secret storage | Calendar Integration | Implemented on protected main | PR #203; Calendar-owned AES-256-GCM file-store profile | +| Hosted Calendar credential admission | Calendar Integration | Implemented on active PR | PR #216 rejects deployment-wide Google/CalDAV credentials as user authority | +| Google OAuth authorization state / PKCE | Calendar Integration | Implemented on active PR | PR #228; bounded one-time state and secret-held verifier; callback/token exchange not included | | Complete hosted calendar credential lifecycle | Calendar Integration | Partial | issue #129 | | Reminder scheduling/delivery | Notification | Implemented on protected main | bounded claims/retries/outcomes | | AI proposal/evidence/decision | AI Proposal | Implemented on protected main | inert proposal + explicit decision | @@ -53,11 +57,21 @@ This registry summarizes repository-level contract invariants. Concrete route, e | Plugin credential binding | Integration | Implemented on protected main | PR #172; opaque secret reference only | | Plugin operator request authority | Integration | Implemented on protected main | PR #191 one-time request/replay evidence | | Plugin operator HTTP composition | Integration | Implemented on protected main | PR #196 fail-closed composition | -| Plugin delivery-origin grant authority | Integration | Implemented on active PR | PR #205; host-owned exact HTTPS origin grant only, with no outbound HTTP or durable grant adapter claim | +| Plugin delivery-origin aggregate/grant | Integration | Implemented on active PR | PR #205 plus active PostgreSQL/runtime descendants; durable exact HTTPS origin is not network authorization | +| Plugin Vault secret-store/operator runtime | Integration | Implemented on active PR | PR #242/#243/#244/#245; provider plaintext remains Vault-owned and LifeOS rows retain opaque references | +| Signed plugin delivery-origin operator application | Integration | Implemented on active PR | PR #250 exact signed grant/read/revoke application authority; no public HTTP delivery-origin route yet | | Complete plugin secret/outbound runtime | Integration | Partial | issue #130 | +| First-party authenticated Goal BFF | Web/Gateway + Planning | Implemented on active PR | PR #214; browser credential is not forwarded and workspace/request authority stays server-side | +| Durable Goals workspace | Web/PWA | Implemented on active PR | PR #229; validated server-authoritative evidence only | +| Durable Weekly Review workspace | Web/PWA + Review | Implemented on active PR | PR #234; persistence-aligned ritual/period uniqueness; authoritative Planning/Habit read projections remain open | +| Complete first-party buyer journey | Web/PWA + BFF/services | Partial | issue #209 | | Source/live-base/integration verification | Repository workflows | Implemented on protected main | PR #154; residual central taxonomy issue #132 | -| Exact pinned OpenCode bootstrap allowlist | Repository automation | Implemented on protected main | PR #200 | +| Exact pinned OpenCode bootstrap allowlist | Repository automation | Implemented on protected main | PR #200 historical bootstrap authority | +| Contextual-orchestrator model route | Repository automation | Implemented on active PR | PR #208 exact OpenCode identity + virtual `orchestrator/free`; blocked on immutable owner authentication/bootstrap release | | Actions workflow-registry orphan detector | Repository automation | Implemented on active PR | PR #204; read-only exact-tree/registry evidence and no workflow-mutation authority | +| Release evidence structural index | Release tooling | Implemented on active PR | PR #217; exact-source structural admission only | +| Detached release signature verification | Release tooling | Implemented on active PR | PR #236; bounded Ed25519 verification/operator CLI | +| Immutable commercial release | Release tooling + protected main | Partial | issue #210 | ## Data-rights contributor v1 @@ -89,8 +103,16 @@ Planning, Habit, and Review are protected participants. Notification and AI are - PR #189 exposes only bounded credential-free active connection state. - PR #193 materializes plaintext credential data only inside a validated secret-store port boundary. - PR #197 writes secret material first, persists only opaque handles, validates returned durable authority, and compensates reviewed failure paths. +- PR #201 protects reverse-order compensation of all newly materialized handles when returned durable create evidence mismatches exact identity/handles. +- PR #203 provides the concrete Calendar-owned encrypted self-hosted secret-store profile. -PR #201 protects reverse-order compensation of all newly materialized handles when returned durable create evidence mismatches exact identity/handles. OAuth/PKCE, concrete KMS, refresh, provider-side cleanup, discovery/selection, and scoped synchronization remain **Partial** under #129. +### Hosted OAuth ceremony + +**Status:** Implemented on active PR + +PR #216 fails hosted startup closed rather than accepting process-global Google/CalDAV provider credentials as end-user authority. PR #228 adds an opaque, expiring, one-time Google OAuth authorization-state contract bound to exact workspace/user/provider/redirect evidence and an opaque PKCE-verifier secret reference. The repository-returned consumed row is revalidated before secret materialization. + +This active contract does not claim callback/token exchange, provider token persistence, successful verifier cleanup after exchange, concrete PostgreSQL OAuth-state runtime, refresh fencing, provider-side revoke/delete recovery, calendar discovery/selection or scoped synchronization. Those remain **Partial** under #129. ## Plugin installation, credentials, and operator composition @@ -108,13 +130,37 @@ Exact replay cannot rematerialize or overwrite an existing secret. Conflicting d PR #191 binds installation/workspace/actor, exact method/path, freshness, and one-time evidence to an atomic replay store. PR #196 composes this authority behind a fail-closed HTTP boundary and maps malformed JSON, stale/replayed evidence, absent dependencies, and invalid durable evidence to bounded credential-free problems. -No operator route grants arbitrary SQL, filesystem, subprocess, tool, or network authority. Outbound delivery remains **Partial** under #130. +No operator route grants arbitrary SQL, filesystem, subprocess, tool, or network authority. -### Delivery-origin authority +### Delivery-origin, Vault, and hosted Integration composition **Status:** Implemented on active PR -PR #205 adds a host-owned authority record for one exact normalized HTTPS origin scoped to opaque UUIDv4 grant, installation, workspace, and granting-user identities. A plugin manifest still expresses intent only and cannot self-authorize a destination. This active slice performs no outbound HTTP and does not yet provide DNS/IP rebinding resistance, connect-time address enforcement, redirect/proxy policy, durable PostgreSQL grant storage, delivery outcomes, retry/dead-letter handling, or operator recovery. Those remain **Partial** under #130. +PR #205 establishes a host-owned exact normalized HTTPS origin scoped to opaque UUIDv4 grant, installation, workspace, and granting-user identities. PR #235 adds service-owned PostgreSQL grant persistence and active-installation fencing; PR #241 strengthens credential/revocation admission; PR #242 adds the Vault KV v2 `PluginSecretStore`; PR #243/#244 compose authenticated Vault operator authority and the shared Integration-owned PostgreSQL pool; PR #245 supplies the concrete hosted/default-entrypoint runtime. + +Draft PR #250 composes existing delivery-origin authority only through exact signed one-time operator grant/read/revoke application methods. The canonical route verifier accepts only lowercase UUIDv4 delivery-origin collection/item/revoke paths and their exact POST/GET/POST methods. This is an internal application authority contract: #250 deliberately adds no public HTTP delivery-origin route and performs no outbound HTTPS. + +A durable origin grant never authorizes a resolved IP address, DNS rebinding result, redirect, proxy route, or later connection. Immutable/versioned canonical egress authority, connect-time SSRF enforcement, bounded response/time behavior, delivery attempts/outcomes, retry/dead-letter and operator recovery remain **Partial** under #130. + +## First-party buyer-path contracts + +**Status:** Partial + +Issue #209 is the commercial first-party Goals → Projects → Tasks → Habits → Review path. PR #214's active BFF contract authenticates through Identity, derives workspace authority server-side, signs the exact Planning method/path, forwards no browser credential downstream, and validates bounded returned ownership/schema evidence. PR #229 renders and mutates only validated durable Goal evidence. The stacked PR #234 Review page likewise consumes only browser-safe Review evidence and preserves persistence invariants such as one completion per `(workspace_id, ritual_kind, period_start_date)`. + +The active stack is not shipped. Complete contract acceptance still requires all prerequisite BFF/workspace descendants, Figma/Storybook identity, normal/loading/empty/error/permission/responsive/interaction and keyboard/a11y states, authoritative Review Planning/Habit projections, and KO/EN/JA/ZH/VI/ES/DE/FR translation-ledger parity on current exact heads. + +## Model-assisted development contract + +**Status:** Partial + +Protected PR #200 authorizes only the exact reviewed OpenCode bootstrap surface; it does not authorize direct provider model selection. Active PR #208 routes model-assisted work through contextual-orchestrator and virtual `orchestrator/free`. Provider credentials remain owner-side bootstrap material. LifeOS cannot promote the consumer until contextual-orchestrator repairs the currently mismatched authentication/bootstrap contract, publishes an immutable reviewed release, and the exact released LifeOS consumer passes acceptance. Mutable source copying or direct-provider fallback is not a compatibility mechanism. + +## Release evidence contract + +**Status:** Partial + +Active Draft #217 structurally validates one exact release-evidence index, including artifact/checksum/provenance/signature coverage and bounded nightly identity. Stacked #236 verifies detached Ed25519 evidence and provides a bounded operator interface. These contracts do not publish a release or distribute/rotate/revoke trust roots. #210 remains open until an unchanged protected release source is bound to version/CHANGELOG/tag/package, immutable artifact, SBOM, provenance/signature, reproducibility and rollback/recovery acceptance. ## Events @@ -126,7 +172,7 @@ Breaking route/event/schema semantics require explicit versioning or a reviewed ## Verification evidence identity -**Status:** Implemented on active PR +**Status:** Accepted architecture `source_head_sha`, `pr_base_snapshot_sha`, `live_base_tip_sha`, integration/synthetic tree identity, `workflow_checkout_sha`, `protected_main_sha`, and `release_source_sha` are separate authorities. PR #154 protects source and live-base compatibility separation. Issue #132 remains **Partial** for central reusable scanner attribution; a synthetic merge scan cannot be called exact-source evidence. From 9a43aab01580041bffc0aa9ce4f70c08a0a5c8bd Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 12:20:43 +0900 Subject: [PATCH 126/173] docs: refresh active security boundaries --- docs/THREAT_MODEL.md | 69 ++++++++++++++++++++++++++++++-------------- 1 file changed, 48 insertions(+), 21 deletions(-) diff --git a/docs/THREAT_MODEL.md b/docs/THREAT_MODEL.md index d737c348e..d4199b9b5 100644 --- a/docs/THREAT_MODEL.md +++ b/docs/THREAT_MODEL.md @@ -8,11 +8,11 @@ Protected-main source and tests are the current control evidence. Active PR cont - tenant-owned Planning, Habit, Review, Calendar, Notification, AI, Privacy, and Plugin data; - account, workspace membership, sessions, and authentication-age provenance; -- provider credentials, secret references, signing/MAC keys, and KMS authority; +- provider credentials, secret references, signing/MAC keys, PKCE verifier material, Vault/KMS authority, and gateway authentication material; - AI proposals, evidence, and explicit decisions; - data-rights requests, contributor exports/receipts, aggregate terminal evidence, and protected artifacts; -- plugin installations, grants, credential bindings, operator replay evidence, and future delivery outcomes; -- database migrations, backups, release artifacts, SBOM/provenance, CI/SARIF/status evidence, and operator recovery records. +- plugin installations, grants, credential bindings, delivery-origin grants, operator replay evidence, and future delivery outcomes; +- database migrations, backups, release artifacts, SBOM/provenance/signatures, CI/SARIF/status evidence, and operator recovery records. ## Trust boundaries @@ -40,13 +40,15 @@ flowchart LR Plugin --> XDB[(Integration-owned DB)] Calendar --> CalendarProvider[Untrusted calendar provider] - Calendar --> SecretStore[Secret store / KMS] - AI --> Model[Untrusted model provider] - Plugin --> PluginSecretStore[Plugin secret store / KMS] - Plugin -. future bounded delivery .-> Network[Untrusted network endpoint] + Calendar --> CalendarSecrets[Calendar secret store / KMS] + AI --> Orchestrator[contextual-orchestrator] + Orchestrator --> Model[Untrusted model providers] + Plugin --> Vault[Vault / Plugin secret store] + Plugin -. future bounded delivery .-> Egress[Canonical egress authority] + Egress -. connect-time policy .-> Network[Untrusted network endpoint] ``` -Co-location on one PostgreSQL cluster never creates shared-table authority. Every service owns its schema/role/migrations and cannot borrow another service's credentials. +Co-location on one PostgreSQL cluster never creates shared-table authority. Every service owns its schema/role/migrations and cannot borrow another service's credentials. A stored URL/origin is identity evidence only; it is not resolved-network authority. ## Threats and controls @@ -57,24 +59,31 @@ Co-location on one PostgreSQL cluster never creates shared-table authority. Ever | Cross-service database privilege confusion | Service -> PostgreSQL | service-owned roles/schemas/migrations; no cross-table access | Implemented on protected main | | OAuth state/redirect confusion | Identity -> provider | bounded transaction, state, provider, redirect/origin validation | Implemented on protected main | | Calendar workspace/user substitution | Gateway -> Calendar | `life-os.calendar-user.v1`, exact returned evidence validation | Implemented on protected main | +| Hosted process-global Calendar credential substitution | Runtime -> Calendar | active #216 rejects deployment-wide Google/CalDAV credentials as user authority | Implemented on active PR | +| Calendar OAuth state/PKCE replay or verifier disclosure | Browser/provider -> Calendar/secret store | active #228 exact workspace/user/provider/redirect binding, expiry/one-time state, opaque verifier handle, consumed-row revalidation before materialization | Implemented on active PR | | Orphaned calendar credential material | Calendar -> secret store/repository | secret-first persistence, reverse-order compensation, no caller-visible handles | Implemented on protected main | -| Calendar credential theft/replay | Calendar -> provider/KMS | opaque references, materialization port, concrete KMS/OAuth/refresh/revoke lifecycle | Partial | +| Calendar credential theft/replay | Calendar -> provider/KMS | opaque references, encrypted self-hosted store #203; hosted callback/token/refresh/provider-cleanup lifecycle remains incomplete | Partial | | Stale multi-device overwrite | Web -> Planning | strong preconditions, versioning, ordered locks, explicit reconciliation | Implemented on protected main | +| First-party browser durable-state fabrication | Browser -> BFF/services | server-derived workspace authority, exact signed downstream request, strict returned evidence, stale/duplicate rejection | Implemented on active PR | | Review/Habit/Planning authority replay | Gateway/contributor -> owner | exact request-bound signatures and atomic destructive replay guards | Implemented on protected main | | Reminder duplicate delivery | Notification worker | fenced/expiring claims, idempotency, immutable outcomes | Implemented on protected main | | AI prompt injection or silent mutation | Model -> AI/product | untrusted inert proposal, deterministic validation, explicit decision, no mutation bus | Implemented on protected main | +| Model credential/provider-routing escalation | LifeOS -> contextual-orchestrator/model | active #208 routes through virtual `orchestrator/free`; provider credentials remain owner-side bootstrap material; immutable owner release/authentication remains required | Partial | | Sensitive-data overexposure | Privacy/public/CI | tenant/purpose/resource/lifetime grants; bounded credential-free evidence | Implemented on protected main | | Data-rights participant omission/false completion | Identity -> contributors | explicit versioned registry, owner verification, immutable aggregate receipt | Partial | | Data-rights cross-tenant export/erase | Identity/contributor -> owner DB | exact workspace/actor/request binding, owner SQL only, deterministic evidence | Partial | | Plugin manifest self-escalation | Manifest -> host | explicit host grant subset; manifest is intent only | Implemented on protected main | -| Plugin credential leakage | Host -> secret store/DB/public view | plaintext only at secret-store port; opaque binding record; compensation | Implemented on protected main | +| Plugin credential leakage | Host -> Vault/DB/public view | plaintext only at Vault/secret-store port; durable rows retain opaque references; compensation/revocation fencing | Implemented on active PR | +| Plugin installation/revocation TOCTOU | Integration app -> repository/Vault | active stack revalidates installation authority around credential/origin admission and fails closed on revoked/mismatched durable evidence | Implemented on active PR | | Plugin operator replay/identity substitution | Operator -> integration | exact one-time signed request, durable atomic replay evidence, fail-closed HTTP | Implemented on protected main | -| Plugin SSRF/DNS rebinding/outbound abuse | Integration -> network | separately host-authorized origins, address validation/pinning, redirect/proxy/size/time limits | Partial | -| Model credential or agent authority escalation | GitHub/model boundary | `NVIDIA_NIM_API_KEY` scoped to reviewed bridge; no review/merge/release authority | Accepted architecture | +| Delivery-origin signature confusion | Operator -> Integration | active #250 exact canonical lowercase UUIDv4 delivery-origin paths and POST/GET/POST methods; cross-route signatures rejected | Implemented on active PR | +| Stored delivery origin promoted to network authority | Integration -> egress | explicit separation of durable origin identity from connect-time DNS/IP/redirect/proxy authority | Partial | +| Plugin SSRF/DNS rebinding/outbound abuse | Integration/egress -> network | immutable released/versioned egress authority, connect-time address checks, rebinding controls, redirect/proxy/size/time limits | Partial | | Dependency lifecycle-script escalation | Package install -> runner | exact pinned package and narrow build allowlist | Implemented on protected main | | CI evidence identity confusion | GitHub workflows | explicit source/base/integration/checkout/protected/release identities | Partial | +| Temporary verification workflow becomes permanent/self-modifying authority | GitHub workflow -> branch | purpose-bounded writer, exact changed-file denominator, ordinary descendant self-retirement only after proof; no force push/gate mutation | Partial | | Backup corruption or unsafe restore | Operator -> storage | integrity manifest, safe-target refusal, readiness verification | Implemented on protected main | -| Release provenance mismatch | GitHub -> artifacts/deployment | exact protected source, SBOM/provenance/reproducibility and publish verification | Partial | +| Release provenance/signature mismatch | GitHub -> artifacts/deployment | active #217 structural index + #236 detached verification; exact protected release source/immutable publication/trust lifecycle still required | Partial | ## Protected authority milestones @@ -83,8 +92,9 @@ Co-location on one PostgreSQL cluster never creates shared-table authority. Ever - PR #185 protects Review request-bound authority. - PR #190 protects integration event request binding. - PR #191 and PR #196 protect plugin operator one-time authority and HTTP composition. -- PR #157, PR #176, PR #189, PR #193, and PR #197 protect Calendar disconnect, returned evidence, read, materialization, and create boundaries. -- PR #159 protects the contributor contract; PR #179/PR #194 protect Planning contribution/transport; PR #184/PR #192 protect Habit contribution/transport. +- PR #157, PR #176, PR #189, PR #193, PR #197, PR #201 and PR #203 protect Calendar disconnect, returned evidence, read, materialization, create/compensation and self-hosted encrypted storage. +- PR #159 protects the contributor contract; PR #179/PR #194 protect Planning contribution/transport; PR #184/PR #192 protect Habit contribution/transport; PR #195 protects Review contribution. +- PR #200 protects the exact reviewed OpenCode bootstrap surface only; it is not direct-provider routing authority. These milestones narrow but do not erase parent-gap threats. @@ -96,7 +106,10 @@ These milestones narrow but do not erase parent-gap threats. - local disconnect cannot be interpreted as provider revoke success; - secret-first create failure compensates newly written handles without returning them; - PR #201 protects compensation when persistence returns invalid durable evidence; -- unavailable concrete KMS/OAuth/refresh/provider cleanup remains explicit under #129. +- active #216 cannot silently fall back to deployment-global hosted provider credentials; +- active #228 state is bounded to one exact ceremony and keeps PKCE verifier plaintext outside durable Calendar metadata; +- an expired/replayed/corrupt OAuth state cannot become callback/token authority; +- hosted token exchange, refresh fencing, successful verifier cleanup, provider revoke/delete and scoped sync remain explicit #129 gaps. ## Data-rights abuse cases @@ -108,24 +121,36 @@ These milestones narrow but do not erase parent-gap threats. - exact destructive replay returns bounded existing evidence; conflicting reuse fails; - unknown, unavailable, or omitted contributors prevent terminal whole-product success; - export digests are not treated as authorization, confidentiality, or signer identity; -- Review PR #195, Notification PR #198, and AI PR #199 are active-PR evidence only. +- Review PR #195 is protected; Notification PR #198 and AI PR #199 remain active evidence until integration. + +## First-party UI abuse cases + +- browser-provided workspace IDs, cookies, or durable object identities do not become downstream service authority; +- stale overlapping reads cannot replace a newer projection or newly accepted durable record; +- malformed/duplicate/non-canonical server evidence fails closed instead of being rendered as durable truth; +- error/conflict paths preserve prior safe durable evidence rather than fabricating success; +- material UI cannot be declared complete without current-head normal/loading/empty/error/permission/responsive/interaction and keyboard/a11y evidence; +- locale fallback cannot silently change resource identity or collapse the DB-versioned screen-key translation ledger into ontology labels. ## Plugin abuse cases - a manifest requesting undeclared or ungranted capabilities cannot self-escalate; -- cross-workspace/installer/installation/binding identifiers fail closed; -- mismatched returned installation or binding evidence cannot become authority; +- cross-workspace/installer/installation/binding/grant identifiers fail closed; +- mismatched returned installation, credential or origin evidence cannot become authority; - exact credential replay cannot rematerialize or overwrite a secret; - revocation ends durable authority before external cleanup and retries never restore it; +- Vault provider plaintext and Vault credentials do not enter LifeOS durable metadata or public evidence; - operator authority is bound to exact request path/method and one-time evidence; +- active #250 delivery-origin grant/read/revoke signatures are not credential signatures and aliases/case variants/wrong methods fail closed; - no operator route grants arbitrary SQL, filesystem, subprocess, tool, or network access; -- outbound URLs remain untrusted until the separate #130 authority/runtime exists. +- no durable origin grant is treated as approval for a later resolved IP, redirect, proxy route, or rebinding result; +- outbound URLs remain untrusted until the separate canonical egress/network slice exists under #130. ## AI and development-model controls AI proposals remain inert and auditable. Model content cannot authorize product mutation. Live-provider availability cannot fabricate deterministic merge success. -A strong single-route baseline precedes deeper orchestration. Conducted workflows are selected only from retained repository-specific quality/safety evidence under documented comparable budgets. `NVIDIA_NIM_API_KEY` is scoped to the reviewed model-call bridge; raw prompts/responses and hidden reasoning are not retained as public evidence. Protected PR #200 is bootstrap hardening, not model authority. +A strong single-route baseline precedes deeper orchestration. Protected #200 is bootstrap hardening only. Active #208 preserves exact OpenCode identity while routing model calls through contextual-orchestrator and virtual `orchestrator/free`; LifeOS does not choose direct providers or copy mutable owner source. The lane fails closed while the owner authentication/bootstrap contract and immutable release are unavailable. Raw prompts/responses, hidden reasoning and credentials are not retained as public evidence. ## Verification and supply-chain controls @@ -133,6 +158,8 @@ PR #154 separates exact contributor-source evidence from independently reconstru Pending, queued, skipped, cancelled, absent, neutral, stale, predecessor, status-only, synthetic-only, model-only, and rate-limited evidence is non-passing. Package lifecycle scripts remain denied except for an exact reviewed need; PR #200 is **Implemented on protected main** for the pinned OpenCode package only. +Temporary proof workflows are verification mechanisms, not product authority. Their failure is root-caused as code/config/runtime evidence; they may self-retire only after the intended exact proof succeeds and only by deleting their own purpose-complete workflow through an ordinary descendant. A successful ancestor proof does not silently become unrelated current-head merge authority. + ## Failure and recovery Dependency outages return sanitized unavailable evidence and never false durable success. Partial external cleanup retains exact retry identity without restoring revoked authority. Corrupt durable evidence triggers fail-closed classification. Restore/migration/release claims require integrity, compatibility, rollback/recovery, and exact source/provenance evidence appropriate to the changed state. From 84cfd1d9bf3084dc11a4f985e5e677a3f424a3f4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 12:21:25 +0900 Subject: [PATCH 127/173] docs: reconcile release and migration obligations --- docs/RELEASE_AND_MIGRATION.md | 72 ++++++++++++++++++++++++++--------- 1 file changed, 55 insertions(+), 17 deletions(-) diff --git a/docs/RELEASE_AND_MIGRATION.md b/docs/RELEASE_AND_MIGRATION.md index 32b7c209e..c4aa745be 100644 --- a/docs/RELEASE_AND_MIGRATION.md +++ b/docs/RELEASE_AND_MIGRATION.md @@ -6,6 +6,8 @@ Release only from one unchanged exact protected integrated head after every applicable repository policy and product acceptance class passes together. Feature-branch, synthetic-only, queued, predecessor, or model evidence cannot authorize release. +Issue #210 is **Partial**. Active Draft #217 and stacked #236 narrow structural release-evidence and detached-signature verification, but neither is an immutable release and neither transfers ancestor checks to a later source identity. + ## Required release evidence - required exact-source CI and security checks plus independently classified compatibility evidence; @@ -15,9 +17,11 @@ Release only from one unchanged exact protected integrated head after every appl - package/container build and smoke evidence; - migration compatibility, rollback/forward-fix, restart, and recovery evidence; - backup/restore integrity and unsafe-target refusal where persistent state changes; -- SBOM, artifact attestation/provenance, reproducibility, dependency integrity, and publish verification required by policy; +- version plus CHANGELOG plus immutable tag/package/release identity; +- SBOM, artifact attestation/provenance, detached signature verification, reproducibility, dependency integrity, and publish verification required by policy; +- trust-root distribution plus key custody/rotation/revocation evidence where signatures are relied upon; - operator readiness, bounded telemetry, incident/recovery acceptance, and no production stub/fake-success path; -- version/CHANGELOG alignment with the exact artifact and source identity. +- installed/runtime artifact verification against the exact protected release source. ## Evidence identity @@ -30,9 +34,9 @@ Release decisions retain separate: - `workflow_checkout_sha`; - `protected_main_sha`; - `release_source_sha`; -- artifact digest/provenance identity. +- artifact/checksum/SBOM/provenance/signature identities. -PR #154 protects local source/live-base separation. Issue #132 remains **Partial** for central reusable scanner taxonomy. A status is release evidence only for the tree and artifact it actually inspected. +PR #154 protects local source/live-base separation. Issue #132 remains **Partial** for central reusable scanner taxonomy. A status is release evidence only for the tree and artifact it actually inspected. Self-retiring verification workflows may prove an exact parent and then delete only themselves through an ordinary descendant; that deletion does not convert the parent proof into unrelated descendant merge/release authority. ## Service-owned schema migrations @@ -49,26 +53,34 @@ For risky migrations: 7. verify backup/restore and retention interactions; 8. record irreversible effects and recovery limits. -## Active migration line +## Active migration and release line | Pull request | Status | Migration/release obligation | | --- | --- | --- | -| PR #195 | Implemented on active PR | Review erasure receipt migration, owner privilege/replay/restart evidence | +| PR #195 | Implemented on protected main | Review-owned data-rights migration/contributor is shipped authority | | PR #198 | Implemented on active PR | Notification erasure migration, claims/outcome immutability, owner-only deletion/replay evidence | | PR #199 | Implemented on active PR | AI erasure migration, append-only trigger authority, cursor compatibility, owner-only atomic deletion | -| PR #200 | Implemented on protected main | no product schema; exact pinned bootstrap and narrow lifecycle-script policy | +| PR #200 | Implemented on protected main | no product schema; exact pinned OpenCode bootstrap and narrow lifecycle-script policy only | +| PR #216 | Implemented on active PR | hosted Calendar rejects deployment-global provider credential authority; no data migration by itself | +| PR #228 | Implemented on active PR | OAuth authorization-state/PKCE persistence semantics require eventual Calendar-owned PostgreSQL migration/runtime, expiry and cleanup acceptance | +| PR #235 | Implemented on active PR | Integration-owned PostgreSQL delivery-origin grant persistence and active-installation fencing | +| PR #242 | Implemented on active PR | Vault KV v2 adapter keeps provider plaintext outside LifeOS durable rows | +| PR #244 / #245 | Implemented on active PR | one Integration-owned PostgreSQL pool plus concrete hosted/default-entrypoint runtime; retained real-server ancestor acceptance is not current-head release authority | +| PR #250 | Implemented on active PR | signed delivery-origin operator application; exact route verification and full-suite runtime proof must complete before the temporary verifier retires | +| PR #217 | Implemented on active PR | machine-readable structural release-evidence index/validation | +| PR #236 | Implemented on active PR | detached Ed25519 release-evidence verification/operator CLI | Active work cannot enter a release until integrated and revalidated on the final protected head. ## Application rollback -Application rollback restores only reversible application/configuration state. It never claims to undo committed database migrations, destructive erasure, delivered notifications/calendar mutations, provider revocations, or secret-store writes/deletes without a tested compensating contract. +Application rollback restores only reversible application/configuration state. It never claims to undo committed database migrations, destructive erasure, delivered notifications/calendar mutations, provider revocations, Vault/secret-store writes/deletes, or externally published release artifacts without a tested compensating contract. -When rollback would reintroduce a binary unable to understand additive durable fields, cursor semantics, receipt rows, one-time replay records, or current signature versions, forward-fix or staged compatibility is required instead. +When rollback would reintroduce a binary unable to understand additive durable fields, OAuth-state semantics, delivery-origin grants, cursor semantics, receipt rows, one-time replay records, or current signature versions, forward-fix or staged compatibility is required instead. ## Data-rights migration and release -PR #159 protects the contributor contract. Planning PR #179/PR #194 and Habit PR #184/PR #192 are protected contributors/transports. Active Review/Notification/AI work remains non-shipped. +PR #159 protects the contributor contract. Planning PR #179/PR #194, Habit PR #184/PR #192, and Review PR #195 are protected contributors/transports. Notification #198 and AI #199 remain active. Issue #55 remains **Partial** until exact participant inventory, remaining owners, durable reconciliation/recovery, retention/legal hold, backup expiry, protected artifact streaming/encryption/expiry/deletion/download audit, and terminal whole-right receipt evidence pass on one protected head. @@ -76,26 +88,52 @@ No release may claim complete export/deletion from partial or unknown participan ## Calendar credential migration -Protected PR #150, PR #153, PR #155, PR #157, PR #176, PR #189, PR #193, PR #197, and PR #201 establish metadata, authority, disconnect, validation, read, materialization, creation, and mismatch-compensation foundations. +Protected PR #150, PR #153, PR #155, PR #157, PR #176, PR #189, PR #193, PR #197, PR #201 and PR #203 establish metadata, authority, disconnect, validation, read, materialization, creation/compensation and Calendar-owned encrypted self-hosted credential storage. -The process-global development token cannot be silently treated as hosted multi-user credentials. Issue #129 requires an explicit migration to a concrete encrypted KMS/secret store, OAuth/PKCE, refresh, provider cleanup, discovery/selection, scoped synchronization, rotation/recovery, and retirement of global production credentials. Rollback must preserve revoked authority and cannot resurrect deleted provider/KMS secrets. +Active #216 prevents process-global Google/CalDAV values from becoming hosted user authority. Active #228 adds bounded one-time OAuth state/PKCE authority with opaque verifier handles. Issue #129 still requires hosted callback/token exchange, successful verifier cleanup, Calendar-owned PostgreSQL OAuth-state runtime, refresh fencing, provider revoke/delete recovery, discovery/selection, scoped synchronization and end-to-end secret/KMS lifecycle acceptance. Rollback must preserve revoked/consumed authority and cannot resurrect deleted provider/KMS secrets or consumed authorization state. ## Plugin runtime migration Protected PR #151, PR #169, PR #172, PR #175, PR #191, and PR #196 establish grants, durable installation, opaque secret binding, exact evidence, one-time operator replay, and fail-closed HTTP composition. -Issue #130 remains **Partial**. Future authorized-origin and delivery schemas/contracts must be explicit versions, must not infer network authority from old manifests/installations, and require concrete KMS, SSRF/DNS-rebinding-safe egress, outcomes, retries/dead-letter, revocation fencing, operator recovery, migration, and rollback evidence. +The active #130 line adds host-owned origin identity (#205), Integration-owned PostgreSQL grant persistence/fencing (#235), credential/revocation hardening (#241), Vault KV v2 secret storage (#242), authenticated Vault/hosted PostgreSQL composition (#243/#244/#245), and signed delivery-origin operator application authority (#250). None of these may infer connect-time network authority from a stored manifest or origin. + +Issue #130 remains **Partial** until an immutable released/versioned canonical egress contract supplies connect-time DNS/IP and rebinding enforcement, redirect/proxy policy, bounded response/time behavior, and LifeOS owns durable delivery attempts/outcomes, retry/dead-letter, revocation fencing and operator recovery. Rollback cannot restore revoked installation/grant/credential authority or reveal/re-materialize a deleted Vault secret without an explicit reviewed recovery contract. + +## First-party buyer-journey release + +Issue #209 is **Partial**. Active first-party BFF/workspace descendants begin with #214 and include durable Goals #229 and Weekly Review #234. No release may advertise the complete buyer journey until the final dependency-ordered head has real browser E2E for normal/loading/empty/error/permission/responsive/interaction states, keyboard/focus/reduced-motion/a11y, Figma/Storybook traceability, authoritative Review read projections, and KO/EN/JA/ZH/VI/ES/DE/FR translation-ledger/font/text-expansion acceptance. + +## Package and model-automation changes + +Exact pinned development/review tooling is supply-chain-sensitive. Protected PR #200 allows only the reviewed `opencode-ai` bootstrap lifecycle needed to materialize the exact executable; it does not grant direct model-provider routing authority. + +Active #208 preserves exact OpenCode identity but routes model capability through contextual-orchestrator and virtual `orchestrator/free`. It cannot integrate or enter release evidence while the owner authentication/bootstrap contract is unrepaired or consumed from an unreleased mutable owner revision. The required order is owner RED → causal owner fix → immutable reviewed owner release → exact LifeOS consumer bump → hosted consumer acceptance. LifeOS does not copy mutable owner source or select a direct-provider fallback. + +## Release-evidence active stack + +Draft #217 validates a machine-readable exact release-evidence index and fails closed on malformed source/artifact/checksum/provenance/signature coverage and invalid nightly identity. Stacked Draft #236 adds detached Ed25519 verification and a bounded operator CLI. These are evidence-verification mechanisms, not publishing authority. + +Before #210 can close, one exact protected `release_source_sha` must produce and verify: -## Package and automation changes +1. source version and CHANGELOG identity; +2. immutable Git tag/release plus package/image identity; +3. checksums and SBOM bound to the actual retained artifacts; +4. provenance/attestation and detached signatures with explicit subject coverage; +5. distributed/verifiable trust roots and key lifecycle/custody evidence; +6. reproducible rebuild/compare evidence appropriate to the artifact class; +7. migration/upgrade/rollback/restore/recovery acceptance; +8. installed buyer-path/runtime verification; +9. exact protected-head CI/security/review/coverage/docstrings/accessibility/localization acceptance. -Exact pinned development/review tooling is supply-chain-sensitive. Protected PR #200 allows only `opencode-ai`, preserves the exact pin, and keeps unrelated lifecycle scripts denied. A fresh protected scheduled run must still pass exact installation verification before release acceptance. +Ancestor GREEN, a structurally valid evidence index, or a signature verifier does not satisfy this denominator alone. ## Versioning and CHANGELOG -Keep unreleased behavior under `CHANGELOG.md` -> `Unreleased`. Create version, tag, release notes, packages/images, SBOM, and provenance only after the exact protected source passes release acceptance. Verify published artifact digests and installed/runtime behavior against recorded source/provenance before announcing release. +Keep unreleased behavior under `CHANGELOG.md` -> `Unreleased`. Create version, tag, release notes, packages/images, SBOM, provenance and detached signatures only after the exact protected source passes release acceptance. Verify published artifact digests and installed/runtime behavior against recorded source/provenance before announcing release. Documentation-only governance changes must not be described as shipped product capability. Conversely, protected behavior must not remain labeled active after integration. ## Recovery exercises -Release acceptance includes relevant backup/restore, migration failure, stale-write conflict, worker replay, provider outage, KMS partial failure, data-rights stuck participant, plugin secret cleanup, provenance mismatch, rollback, and forward-fix exercises. No fixed public RPO/RTO is claimed without measured deployment-specific evidence. +Release acceptance includes relevant backup/restore, migration failure, stale-write conflict, worker replay, OAuth ceremony expiry/replay, provider outage, Vault/KMS partial failure, data-rights stuck participant, plugin secret cleanup, egress/delivery retry recovery, provenance/signature mismatch, trust-root/key-rotation failure, rollback, and forward-fix exercises. No fixed public RPO/RTO is claimed without measured deployment-specific evidence. From 6a79a8ef707248bf17c87f606eb212ed1814fe52 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 12:22:24 +0900 Subject: [PATCH 128/173] docs: refresh active authority and recovery views --- docs/UML.md | 190 ++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 133 insertions(+), 57 deletions(-) diff --git a/docs/UML.md b/docs/UML.md index 95f8c9d38..3233277de 100644 --- a/docs/UML.md +++ b/docs/UML.md @@ -60,7 +60,9 @@ sequenceDiagram Note over Identity: session rotation preserves authentication age ``` -## Planning, Habit, Review, and Today authority +## Planning, Habit, Review, Today, and first-party journey + +### Protected authority **Status:** Implemented on protected main @@ -100,6 +102,35 @@ stateDiagram-v2 Completed --> [*] ``` +### Active first-party buyer journey + +**Status:** Partial + +```mermaid +sequenceDiagram + actor User + participant Browser as Web/PWA + participant Identity + participant BFF as First-party BFF + participant Owner as Planning/Habit/Review + + User->>Browser: load workspace + Browser->>BFF: browser-safe request + BFF->>Identity: authenticate session/workspace + Identity-->>BFF: exact actor + workspace + BFF->>Owner: signed exact method/path authority + Owner-->>BFF: bounded durable evidence + BFF->>BFF: validate ownership/schema/evidence + BFF-->>Browser: browser-safe durable projection + User->>Browser: explicit mutation + Browser->>BFF: bounded mutation input + BFF->>Owner: authorized exact mutation + Owner-->>BFF: durable acceptance evidence + BFF-->>Browser: accepted durable record +``` + +Issue #209 is the complete Goals → Projects → Tasks → Habits → Review journey. PR #214 starts the active line with the authenticated Goal BFF; PR #229 adds the durable Goals workspace; stacked PR #234 is the current Weekly Review workspace. Browser state never creates workspace authority or durable identity. Completion still requires the full dependency stack, final current-head E2E, Figma/Storybook traceability, normal/loading/empty/error/permission/responsive/interaction states, keyboard/focus/reduced-motion/a11y, authoritative Review read projections, and KO/EN/JA/ZH/VI/ES/DE/FR parity. + ## Calendar connection and credential lifecycle ### Protected-main lifecycle @@ -121,31 +152,25 @@ stateDiagram-v2 Compensating --> [*]: reverse-order cleanup proven ``` -PR #150 protects connection metadata, PR #153 protects atomic local revocation, PR #155 protects `life-os.calendar-user.v1`, PR #176 protects exact lookup evidence, PR #189 protects bounded read, PR #193 protects materialization, and PR #197 protects authenticated creation. +PR #150 protects connection metadata, PR #153 protects atomic local revocation, PR #155 protects `life-os.calendar-user.v1`, PR #176 protects exact lookup evidence, PR #189 protects bounded read, PR #193 protects materialization, PR #197 protects authenticated creation, PR #201 protects returned-evidence compensation, and PR #203 protects the Calendar-owned encrypted self-hosted secret-store profile. -### Protected compensation hardening +### Active hosted OAuth authority -**Status:** Implemented on protected main +**Status:** Partial ```mermaid -sequenceDiagram - participant Caller - participant Create as Calendar create application - participant SecretStore - participant Repository - Caller->>Create: signed workspace+user authority + bounded credentials - Create->>SecretStore: store access material - SecretStore-->>Create: opaque access handle - Create->>SecretStore: store refresh material - SecretStore-->>Create: opaque refresh handle - Create->>Repository: persist metadata + exact handles - Repository-->>Create: mismatched durable evidence - Create->>SecretStore: delete refresh handle - Create->>SecretStore: delete access handle - Create-->>Caller: bounded dependency failure +stateDiagram-v2 + [*] --> HostedAdmission + HostedAdmission --> RejectedGlobalCredential: deployment-wide provider credential supplied + HostedAdmission --> AuthorizationState: authenticated user-owned ceremony + AuthorizationState --> PendingCallback: opaque state + PKCE verifier secret reference + PendingCallback --> Consumed: exact state/workspace/user/provider/redirect + expiry accepted + PendingCallback --> Rejected: expired/replayed/malformed/mismatched evidence + Consumed --> VerifierMaterialized: revalidate consumed row before secret read + VerifierMaterialized --> TokenExchangePending: active boundary ends ``` -This PR #201 flow is protected-main evidence. Complete KMS/OAuth/refresh/provider cleanup/discovery/selection/scoped sync remains **Partial** under #129. +Active PR #216 provides the fail-closed hosted admission boundary. Stacked PR #228 provides five-minute OAuth state/PKCE authority with verifier plaintext outside durable metadata. `TokenExchangePending` is deliberately not implemented by this stack: hosted callback/token exchange, successful verifier cleanup, concrete PostgreSQL OAuth-state runtime, refresh fencing, provider revoke/delete recovery, discovery/selection and scoped synchronization remain **Partial** under #129. ## Data-rights orchestration and contributor authority @@ -178,25 +203,27 @@ sequenceDiagram end ``` -PR #159 protects the shared contract. Planning is protected through PR #179 and PR #194. Habit is protected through PR #184 and PR #192. Review PR #195, Notification PR #198, and AI PR #199 are **Implemented on active PR**. Issue #55 remains **Partial**. +PR #159 protects the shared contract. Planning is protected through PR #179 and PR #194. Habit is protected through PR #184 and PR #192. Review is protected through PR #195. Notification PR #198 and AI PR #199 are **Implemented on active PR**. Issue #55 remains **Partial**. ### Contributor maturity ```mermaid flowchart LR - Contract[PR #159 contributor v1] --> Planning[Planning: protected PR #179/#194] - Contract --> Habit[Habit: protected PR #184/#192] - Contract --> Review[Review: active PR #195] - Contract --> Notification[Notification: active PR #198] - Contract --> AI[AI: active PR #199] + Contract[PR #159 contributor v1] --> Planning[Planning: protected #179/#194] + Contract --> Habit[Habit: protected #184/#192] + Contract --> Review[Review: protected #195] + Contract --> Notification[Notification: active #198] + Contract --> AI[AI: active #199] Contract --> Remaining[Remaining owners + reconciliation/delivery] Remaining --> Gap[Issue #55 Partial] ``` -## Plugin installation, credential, and operator authority +## Plugin installation, credential, delivery-origin, and operator authority **Status:** Partial +### Protected foundation + ```mermaid stateDiagram-v2 [*] --> ValidatedManifest @@ -211,18 +238,44 @@ stateDiagram-v2 CleanupRetry --> Revoked: authority never restored ``` +### Active #130 persistence and operator stack + ```mermaid flowchart LR - Manifest[Manifest intent] --> HostGrant[Host grant] - HostGrant --> Installation[Durable installation] - Installation --> SecretRef[Opaque secret reference] - Installation --> Operator[Request-bound operator] - HostOrigin[Separately host-authorized delivery origin] -. Planned .-> Delivery[Bounded HTTPS delivery] - SecretRef -. no plaintext persistence .-> Delivery - Operator -. no arbitrary network authority .-> Delivery + Manifest[Manifest intent] --> HostGrant[Explicit host grant] + HostGrant --> Installation[Installation authority] + Installation --> Credential[Opaque credential binding] + Installation --> Origin[Exact HTTPS origin grant] + Credential --> Vault[Vault KV v2] + Installation --> IPG[(Integration-owned PostgreSQL)] + Origin --> IPG + Operator[One-time signed operator context] --> Credential + Operator --> Origin + Origin -. identity only .-> Egress[Future canonical egress authority] + Egress -. connect-time policy .-> Network[Untrusted network] +``` + +Active #205 establishes the origin aggregate; #235 adds PostgreSQL grant persistence and installation fencing; #241 strengthens credential/revocation authority; #242 adds the Vault KV v2 secret store; #243/#244 compose Vault and one Integration-owned PostgreSQL pool; #245 supplies the concrete hosted/default-entrypoint runtime; #250 adds exact signed grant/read/revoke application authority for delivery origins. + +```mermaid +sequenceDiagram + participant Operator + participant Verify as One-time operator verifier + participant App as Delivery-origin application + participant Install as Installation repository + participant Origin as Delivery-origin store + + Operator->>Verify: signed exact method/path + actor/workspace/installation + Verify->>Verify: validate freshness/signature + consume replay identity + Verify->>App: exact authorized operation + App->>Install: read active installation authority + Install-->>App: exact durable evidence + App->>Origin: grant/read/revoke exact origin evidence + Origin-->>App: exact durable result + App-->>Operator: bounded result ``` -Concrete KMS, authorized-origin registry, SSRF/DNS-rebinding-safe delivery, outcomes, retry/dead-letter, and operator recovery remain **Partial** under #130. +#250 deliberately stops here. No public delivery-origin HTTP transport or outbound HTTPS is implied. #130 remains **Partial** until immutable released/versioned canonical egress authority enforces connect-time DNS/IP/rebinding, redirect/proxy and bounded time/response policy and LifeOS persists delivery attempts/outcomes with retry/dead-letter, revocation fencing and operator recovery. ## AI proposal and explicit decision @@ -247,28 +300,25 @@ sequenceDiagram Note over AI,Audit: no generic Planning mutation authority ``` -## Model-assisted evaluation and repository authority +## Model-assisted development and repository authority -**Status:** Accepted architecture +**Status:** Partial ```mermaid flowchart LR - Secret[GitHub Secret NVIDIA_NIM_API_KEY] --> Seed[Approved contextual-orchestrator / credential seeding] - Seed --> Route[Strong single-route baseline] - Seed --> Conduct[Bounded conduct cells] - Route --> Evaluator[deterministic LifeOS proposal evaluator] - Conduct --> Evaluator - Evaluator --> Evidence[Credential-free retained evidence] - Evidence --> Governance[Repository-specific governance decision] - - CI[Deterministic CI/security] --> Review[Independent review authority] - Review --> Merge[Merge authority] + OpenCode[Exact reviewed OpenCode] --> CO[contextual-orchestrator released API/client] + Secrets[Provider credentials] --> CO + CO --> Free[orchestrator/free] + Free --> Model[Provider selected by owner] + Model --> Evidence[Bounded credential-free retained evidence] + Evidence --> CI[Deterministic CI/security] + CI --> Review[Independent review authority] + Review --> Merge[Protected merge authority] Merge --> Release[Release authority] - Governance -. evidence only .-> Review - Seed -. no review/merge/release authority .-> Review + Evidence -. no independent authority .-> Review ``` -Supported controls may include workflow stage, reasoning effort, decomposition, recursion depth, role-specific reasoning effort, worker/model choice, verifier topology, and access/communication topology. Unsupported controls remain explicit. PR #200 is **Implemented on protected main** only for restoring the exact pinned OpenCode postinstall boundary. +Protected #200 covers only the exact OpenCode bootstrap allowlist. Active #208 is the target routing line: exact OpenCode identity plus contextual-orchestrator/`orchestrator/free`, with provider credentials/model selection remaining owner-side. It fails closed pending a repaired authentication/bootstrap owner contract, immutable reviewed owner release, and exact released consumer acceptance. Mutable owner source or direct-provider fallback is not authorized. ## Verification evidence authority @@ -289,6 +339,28 @@ flowchart LR PR #154 protects exact-source/live-base separation. Issue #132 remains **Partial** for central reusable scanner checkout/attribution taxonomy. A green result never transfers across evidence identities. +## Release-evidence authority + +**Status:** Partial + +```mermaid +flowchart LR + RS[Exact protected release_source_sha] --> Index[Release evidence index] + RS --> Artifact[Package / image] + Artifact --> Checksum[Checksums] + Artifact --> SBOM[SBOM] + Artifact --> Provenance[Provenance / attestation] + Artifact --> Signature[Detached signatures] + Checksum --> Verify[Structural + cryptographic verification] + Provenance --> Verify + Signature --> Verify + Verify --> Publish[Immutable tag/package/release] + Publish --> Install[Installed runtime acceptance] + Install --> Recovery[Upgrade/rollback/restore/recovery] +``` + +Active Draft #217 provides structural index validation and #236 adds detached Ed25519 verification/operator tooling. The diagram's `Publish`, trust-root/key lifecycle, installed acceptance and recovery nodes remain **Partial** under #210 until proved on one unchanged protected release source. + ## Deployment and recovery **Status:** Implemented on protected main @@ -322,10 +394,14 @@ Logical backup/restore does not claim PITR. External provider cleanup/recovery a | Failure | Required behavior | Status | | --- | --- | --- | -| Identity/calendar/model provider unavailable | Bounded dependency failure; unrelated domains remain usable where safe | Accepted architecture | -| Owning PostgreSQL unavailable | Durable mutation fails closed; local draft remains visibly non-durable | Implemented on protected main | -| NATS unavailable | No fabricated delivery success; replay/recovery evidence remains | Implemented on protected main | -| Stale write | Explicit conflict/revision evidence, never silent overwrite | Implemented on protected main | -| Malformed/forged service context | Fail closed without reflecting identifiers or secrets | Implemented on protected main | -| Unknown/stale verification identity | Non-passing evidence, never promoted success | Implemented on protected main | -| Partial external secret/provider cleanup | Retain retry identity without restoring revoked authority | Partial | +| Identity/calendar/model provider unavailable | bounded dependency failure; unrelated domains remain usable where safe | Accepted architecture | +| Owning PostgreSQL unavailable | durable mutation fails closed; local draft remains visibly non-durable | Implemented on protected main | +| Vault/secret store unavailable | credential/origin-dependent operation fails closed; no plaintext persistence fallback | Implemented on active PR | +| NATS unavailable | no fabricated delivery success; replay/recovery evidence remains | Implemented on protected main | +| Stale write | explicit conflict/revision evidence, never silent overwrite | Implemented on protected main | +| Malformed/forged service context | fail closed without reflecting identifiers or secrets | Implemented on protected main | +| Unknown/stale verification identity | non-passing evidence, never promoted success | Implemented on protected main | +| Partial external secret/provider cleanup | retain retry identity without restoring revoked authority | Partial | +| Missing canonical egress authority | plugin outbound delivery remains unavailable rather than treating stored origin as network authorization | Partial | +| Missing immutable contextual-orchestrator release/authentication contract | model-assisted lane fails closed; no direct-provider bypass | Partial | +| Release evidence mismatch or missing trust/recovery evidence | no immutable release promotion | Partial | From 6efed6a0ea2061cefa76446d6ff976bb2a4ae988 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 12:23:16 +0900 Subject: [PATCH 129/173] docs: refresh current acceptance strategy --- docs/TEST_STRATEGY.md | 73 +++++++++++++++++++++++++++++-------------- 1 file changed, 50 insertions(+), 23 deletions(-) diff --git a/docs/TEST_STRATEGY.md b/docs/TEST_STRATEGY.md index 707083940..d275fd8de 100644 --- a/docs/TEST_STRATEGY.md +++ b/docs/TEST_STRATEGY.md @@ -6,6 +6,8 @@ LifeOS tests prove domain behavior, authority, recovery, and evidence identity—not only implementation reachability. Source changes follow realistic RED -> smallest root-cause GREEN -> focused/full validation. Required checks are attributed to the exact revision and checkout they inspect. +A test harness is part of the evidence contract. Missing runtime builds, wrong checkout identity, skipped environment prerequisites, or purpose-workflow defects are root-caused and repaired rather than papered over with `PYTHONPATH`, broad skips, sample reduction, stale evidence, or gate weakening. + ## Test layers ### Unit and domain @@ -23,7 +25,8 @@ Use real disposable PostgreSQL for service-owned migrations and repositories, in - immutable proposal/decision/reminder/receipt/audit evidence; - owner-only destructive data-rights functions and post-erasure verification; - privilege denial for ordinary application roles; -- compensation/recovery records where external secret material is introduced. +- compensation/recovery records where external secret material is introduced; +- active Calendar OAuth-state and Plugin origin/credential/grant persistence when those migrations are under test. Mock-only success is insufficient for persistence, privilege, concurrency, replay, migration, or recovery claims. @@ -31,11 +34,22 @@ Mock-only success is insufficient for persistence, privilege, concurrency, repla Exercise actual authenticated/signed boundaries, exact method/path/actor/workspace binding, malformed JSON/content type/UUID/signature/cursor, replay, conflict, not-found isolation, response-size/schema validation, dependency outage, and credential-free problem mapping. Tests must prove browser-selected ownership cannot create authority. -Protected examples include Planning/Habit Today composition, Calendar read/create/disconnect/materialization, Planning/Habit data-rights transport, integration events, and plugin operator HTTP composition. +Protected examples include Planning/Habit Today composition, Calendar read/create/disconnect/materialization, Planning/Habit/Review data-rights transport, integration events, and plugin operator HTTP composition. Active contracts add Calendar OAuth ceremony boundaries, first-party BFF/workspace flows, Vault-backed Integration composition, and delivery-origin operator application authority without promoting those active surfaces to protected truth. ### Browser acceptance -Use Playwright for material user journeys: login/onboarding, capture/Today, durable synchronization/conflict, explicit degraded state, accessibility, localization, and PWA behavior. Browser-local drafts must remain visibly non-durable until server acceptance. +Use Playwright for material user journeys. The #209 commercial path is dependency ordered Goals → Projects → Tasks → Habits → Review and requires: + +- authenticated first-party BFF transport with no browser-derived tenant authority; +- durable create/read/update evidence rather than optimistic identifiers presented as accepted state; +- normal, loading, empty, error, permission, conflict and recovery states; +- desktop/mobile/intermediate widths without overflow, clipping or unusable touch targets; +- keyboard traversal, visible focus, semantic names, live-state announcements, contrast and reduced-motion behavior; +- Figma/Storybook component/page traceability where material UI is introduced; +- KO/EN/JA/ZH/VI/ES/DE/FR screen-key resource parity, CJK/font fallback and text-expansion acceptance; +- stale overlapping-response protection and prior-safe-evidence preservation on failure. + +Browser-local drafts remain visibly non-durable until server acceptance. A focused component test or ancestor browser run does not prove the final stacked current head. ### Security regression @@ -45,51 +59,67 @@ Cover: - signed-context replay, stale/future evidence, and exact request binding; - SQL structure/privileges and corrupt persisted evidence; - secret/reference/log/error/artifact leakage; -- OAuth state/redirect/origin/PKCE when introduced; +- OAuth state/redirect/origin/PKCE expiry, replay, consumed-row substitution and verifier lifetime; - provider response limits and credential material lifetime; -- AI prompt injection, benign utility, and inert proposal enforcement; -- plugin manifest self-escalation, operator replay, and hostile URL/SSRF/DNS-rebinding cases before outbound networking can ship; -- package lifecycle-script allowlisting and exact dependency pins; -- source/base/integration/SARIF/status identity attribution. +- AI prompt injection, benign utility, inert proposal enforcement and model-gateway authentication/bootstrap failure; +- plugin manifest self-escalation, credential/origin revocation TOCTOU, signed route confusion, hostile URL/SSRF/DNS-rebinding cases before outbound networking can ship; +- Vault plaintext/credential non-retention in durable LifeOS metadata and public evidence; +- package lifecycle-script allowlisting, workspace runtime dependency builds, and exact dependency pins; +- source/base/integration/SARIF/status/release identity attribution; +- release evidence subject/signature coverage, trust-root/key-lifecycle and provenance mismatch. ### Backup, deployment, migration, and release -Executable tests validate Compose/reference deployment sources, liveness/readiness, graceful shutdown, backup checksum/restore refusal, migration compatibility, rollback/forward-fix, package/container build, SBOM/provenance/reproducibility, and publish verification. +Executable tests validate Compose/reference deployment sources, liveness/readiness, graceful shutdown, backup checksum/restore refusal, migration compatibility, rollback/forward-fix, package/container build, SBOM/provenance/signature/reproducibility, and publish/install verification. ## Coverage and docstrings Packages with exact configured gates retain meaningful 100% statement, branch, function, and line coverage. Coverage cannot be satisfied through deleted behavior, broad exclusions, unreachable branches, or mock-only assertions. Public production declarations require beginner-readable explanatory documentation under the owning package's gate. +A green full test suite is not a 100% coverage claim. Coverage percentages and denominator evidence must be produced separately when the owning gate requires them. + ## Authority and replay matrices | Domain | Required adversarial/concurrency evidence | Status | | --- | --- | --- | | Today | duplicate idempotency, conflicting reuse, stale precondition, concurrent create/update, cleanup | Implemented on protected main | | Planning/Habit/Review routes | workspace/actor/method/path substitution, stale/future signature, replay as applicable | Implemented on protected main | +| First-party buyer path | BFF authority, durable response validation, stale response suppression, all UI states/a11y/locales/current-head E2E | Partial | | Notification | duplicate claim/delivery, expiry/recovery, immutable outcome | Implemented on protected main | | AI proposals | malformed model output, stale/replayed decision, explicit confirmation, no mutation authority | Implemented on protected main | | Privacy | purpose/resource/lifetime, exact expiry, single-use grant, bounded audit | Implemented on protected main | | Data rights | request/idempotency collision, deterministic export, owner preflight/erase/verify, participant omission, whole-right non-completion | Partial | -| Calendar | exact connection/workspace/user evidence, secret-first compensation, handle substitution, provider/KMS outage, local-vs-provider revoke | Partial | -| Plugin | manifest/grant conflict, exact installation/binding/operator evidence, credential compensation, replay/revoke; delivery SSRF/retry when introduced | Partial | +| Calendar | exact connection/workspace/user evidence, secret-first compensation, handle substitution, OAuth state/PKCE replay/expiry, provider/KMS outage, local-vs-provider revoke | Partial | +| Plugin | manifest/grant conflict, exact installation/binding/origin/operator evidence, credential compensation, replay/revoke/TOCTOU; Vault+PostgreSQL lifecycle; delivery SSRF/retry when introduced | Partial | +| Release | index structure, artifact/checksum/provenance/signature subject binding, crypto verification, immutable publication, reproducibility, rollback/recovery | Partial | ## Data-rights acceptance -PR #159 protects the shared contract. Protected Planning evidence comes from PR #179 and PR #194; protected Habit evidence comes from PR #184 and PR #192. PR #195, PR #198, and PR #199 are **Implemented on active PR** and require exact-head real PostgreSQL, coverage, docstrings, security/review, and live-base compatibility before integration. +PR #159 protects the shared contract. Protected Planning evidence comes from PR #179 and PR #194; protected Habit evidence comes from PR #184 and PR #192; protected Review evidence comes from PR #195. PR #198 and PR #199 are **Implemented on active PR** and require exact-head real PostgreSQL, coverage, docstrings, security/review, and live-base compatibility before integration. Whole-product tests must fail when any required participant is missing, duplicate, unavailable, malformed, cross-tenant, partially completed, unverified after erasure, or absent from the exact participant registry. Export integrity evidence never substitutes for authorization or protected delivery. ## Calendar acceptance -Protected boundaries from PR #157, PR #176, PR #189, PR #193, and PR #197 require tests for authenticated disconnect, exact returned lookup identity, credential-free read, secret-handle validation/materialization, secret-first create, and compensation on persistence/secret-store failures. +Protected boundaries from PR #157, PR #176, PR #189, PR #193, PR #197, PR #201 and PR #203 require tests for authenticated disconnect, exact returned lookup identity, credential-free read, secret-handle validation/materialization, secret-first create, returned-evidence compensation and encrypted self-hosted storage. + +Active #216 must prove hosted multi-user runtime rejects deployment-wide Google/CalDAV credentials instead of silently treating them as user authority. Active #228 must prove exact workspace/user/provider/redirect state binding, bounded expiry, one-time consumption, hostile consumed-row rejection before PKCE secret materialization, and secret-store cleanup/partial-failure semantics within its implemented boundary. -PR #201 protects returned-durable-evidence mismatch compensation. The remaining #129 lifecycle requires OAuth state/PKCE replay tests, concrete encrypted-store evidence, refresh single-flight/fencing, provider cleanup partial-failure recovery, discovery/selection bounds, scoped sync, restart/rotation, and no process-global credential fallback. +The remaining #129 lifecycle requires real PostgreSQL OAuth-state migration/runtime evidence, callback/token exchange, successful post-exchange verifier cleanup, refresh single-flight/fencing, provider cleanup partial-failure recovery, discovery/selection bounds, scoped sync, restart/rotation, and no process-global credential fallback. ## Plugin acceptance Protected PR #151, PR #169, PR #172, PR #175, PR #191, and PR #196 require tests for explicit grants, durable exact installation identity, opaque credential binding, conflicting-winner compensation, one-time operator authority/replay, malformed JSON, unavailable composition, and credential-free errors. -Before #130 outbound delivery can ship, tests must cover host-authorized origins, loopback/RFC1918/ULA/link-local/cloud-metadata/IPv4-mapped/encoded addresses, DNS rebinding, redirect/proxy policy, TLS/HTTP failure, byte/time/rate/concurrency bounds, signing/rotation, retry/dead-letter, restart, and revocation fencing. +The active #130 stack additionally requires real Integration-owned PostgreSQL and Vault KV v2 lifecycle acceptance across installation, credential create/exact replay, runtime restart, installation/credential revocation and cleanup. Active delivery-origin persistence must reject inactive/mismatched installation evidence and retain exact normalized HTTPS origin identity. Active #250 must prove signed grant/read/revoke application authority, cross-route signature rejection, exact lowercase UUIDv4 route/method admission and unavailable-composition failure. + +A temporary #250 verifier must build `@life-os/plugin-sdk` before the full Integration suite because its runtime package entry is `dist/index.js`. Failing to build that declared dependency is a harness RED, not grounds to skip the full suite. The purpose workflow may delete only itself after the exact proof passes. + +Before #130 outbound delivery can ship, tests must cover loopback/RFC1918/ULA/link-local/cloud-metadata/IPv4-mapped/encoded addresses, DNS rebinding, connect-time resolution, redirect/proxy policy, TLS/HTTP failure, byte/time/rate/concurrency bounds, signing/rotation, delivery attempt/outcome durability, retry/dead-letter, restart, and revocation fencing. + +## Model-assisted development acceptance + +Protected #200 proves only the exact reviewed OpenCode bootstrap surface. Active #208 must fail closed if the released contextual-orchestrator client/gateway cannot authenticate or supply required capability. The required acceptance sequence is canonical-owner RED, owner causal fix, immutable reviewed owner release, exact LifeOS consumer bump, then hosted consumer acceptance through `orchestrator/free`. Provider/model/group hard-coding, mutable source copy, direct-provider fallback, or elapsed-time-only reasoning/tool termination are not substitutes. ## Documentation consistency @@ -101,7 +131,7 @@ Machine-checkable contracts validate: - ADR index/targets/status/required sections; - balanced Markdown/Mermaid fences; - protected chronology versus active PR scope; -- current buyer gaps and closed/superseded issue state; +- current buyer gaps #55/#129/#130/#209/#210 and closed/superseded issue state; - conceptual versus persisted/active data-model labels; - UUIDv4, service ownership, browser durability, inert AI, purpose-bound privacy, and evidence-identity invariants; - model credential/orchestration/review authority boundaries; @@ -115,17 +145,14 @@ A check must identify whether it inspected: 2. PR-base snapshot; 3. independently resolved live-base tip; 4. synthetic/integration tree; -5. protected main; -6. release artifact/provenance. +5. workflow checkout/source identity; +6. protected main; +7. release source/artifact/provenance identity. Evidence from one class cannot satisfy another. PR #154 protects local source/live-base separation. Issue #132 remains **Partial** for residual central reusable scanner checkout/SARIF/status taxonomy. Pending, queued, skipped, cancelled, absent, neutral, failed, stale, predecessor, synthetic-only, model-only, or rate-limited evidence is non-passing. -## Live-provider separation - -NVIDIA/model/provider availability supplies bounded conformance evidence, not deterministic PR success. Deterministic fixtures prove quality/safety and provider failure behavior. `NVIDIA_NIM_API_KEY` materializes only inside the approved model boundary. PR #200 is **Implemented on protected main** for the narrow exact-pinned OpenCode postinstall allowlist; a fresh protected scheduled run remains operational acceptance evidence rather than merge evidence. - ## Release acceptance -A release candidate must pass required CI/security/review, exact configured coverage/docstrings, browser/accessibility/localization, package/container build, compatibility, migration/rollback/recovery, backup/restore, SBOM/provenance/reproducibility, and protected-main operational acceptance on one unchanged integrated revision. +Issue #210 remains Partial. Active Draft #217 provides structural release-evidence validation and stacked #236 detached Ed25519 verification. Final acceptance requires one unchanged protected release source to pass required CI/security/review, exact configured coverage/docstrings, browser/accessibility/localization, package/container build, version/CHANGELOG/tag/immutable publication, checksums, SBOM/provenance/signatures/trust-root lifecycle/reproducibility, compatibility, migration/rollback/recovery, backup/restore, installed runtime/buyer-path verification, and protected-main operational acceptance together. From b1648736062fa1872bdf64755882e643df1fd60b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 12:23:49 +0900 Subject: [PATCH 130/173] docs: refresh active operational boundaries --- docs/OPERABILITY.md | 55 +++++++++++++++++++++++++++++++-------------- 1 file changed, 38 insertions(+), 17 deletions(-) diff --git a/docs/OPERABILITY.md b/docs/OPERABILITY.md index 45184c908..96e4b1182 100644 --- a/docs/OPERABILITY.md +++ b/docs/OPERABILITY.md @@ -32,43 +32,58 @@ Shutdown must: Liveness reports process/runtime viability. Readiness fails when a service cannot safely serve the contracted workload. Dependency-specific readiness must not be collapsed into generic process health. -Optional provider outage may yield explicit degraded behavior where unrelated domains remain safe. Owning persistence, signing authority, replay store, or required KMS absence must fail the affected durable/secret operation closed. +Optional provider outage may yield explicit degraded behavior where unrelated domains remain safe. Owning persistence, signing authority, replay store, required secret store/KMS, or required released gateway authority absence must fail the affected durable/secret/model operation closed. ## Observability - structured bounded credential-free logs; - correlation, request, idempotency, fencing, and evidence IDs where implemented; - bounded operator-only metrics; -- no cookies, bearer credentials, secret handles, plaintext credentials, raw prompts/responses, hidden reasoning, provider bodies, or unbounded tenant content; +- no cookies, bearer credentials, secret handles, plaintext credentials, Vault credentials, raw prompts/responses, hidden reasoning, provider bodies, or unbounded tenant content; - explicit failure class and dependency boundary without reflecting attacker-controlled identifiers; - exact source/integration/release identities on retained CI/provenance evidence. ## Protected operational boundaries - PR #186 and PR #187 provide real authenticated Today composition; Issue #163 is completed. -- PR #157, PR #176, PR #189, PR #193, and PR #197 provide Calendar disconnect, lookup validation, read, materialization port, and secret-first creation. -- PR #179/PR #194 and PR #184/PR #192 provide protected Planning/Habit data-rights participant and transport evidence. +- PR #157, PR #176, PR #189, PR #193, PR #197, PR #201 and PR #203 provide Calendar disconnect, lookup validation, read, materialization, secret-first creation/compensation and encrypted self-hosted secret storage. +- PR #179/PR #194, PR #184/PR #192 and PR #195 provide protected Planning/Habit/Review data-rights participant evidence. - PR #169, PR #172, PR #175, PR #191, and PR #196 provide durable Plugin installation/credential/operator boundaries. +- PR #200 protects only the exact reviewed OpenCode bootstrap boundary. -These boundaries have owner-specific degraded and replay semantics and do not close #55/#129/#130. +These boundaries have owner-specific degraded and replay semantics and do not close #55/#129/#130/#209/#210. + +## Active operational boundaries + +- #216 rejects deployment-wide Google/CalDAV credentials in hosted multi-user composition; #228 adds bounded OAuth state/PKCE ceremony authority but not token exchange or refresh/provider cleanup. +- #242/#243/#244/#245 compose Vault KV v2 and one Integration-owned PostgreSQL pool for the hosted Plugin runtime. Retained real Vault+PostgreSQL lifecycle acceptance on an exact #245 ancestor is valuable recovery evidence but not current-head merge authority. +- #250 adds signed delivery-origin grant/read/revoke application authority and deliberately stops before public delivery-origin HTTP transport/outbound networking. +- #214/#229/#234 are active first-party journey evidence; browser-visible completion still requires current-head E2E/all-state/a11y/Figma/Storybook/8-locale acceptance. +- #208 consumes contextual-orchestrator/`orchestrator/free` but remains fail-closed until the canonical owner authentication/bootstrap contract is repaired and immutably released. +- #217/#236 validate release evidence/signatures but do not publish a release. + +No active line is production authority until normal protected integration. ## Failure semantics - malformed ownership, UUIDs, signatures, issuance, one-time evidence, cursors, digests, and persisted rows fail closed; - database outage cannot return durable-success claims; -- provider/KMS outage never falls back to plaintext or process-global caller-visible credentials; +- provider/Vault/KMS outage never falls back to plaintext or process-global caller-visible credentials; +- Calendar hosted configuration cannot replace user-owned credentials with deployment-global provider values; - stale concurrent writes return explicit conflict rather than overwrite; - workers use bounded retries/claims/backoff and retain exact replay identity; - unknown data-rights participant state cannot become terminal completion; - local revoke never becomes provider revoke success without proof; - external cleanup retry never restores revoked LifeOS authority; -- plugin/operator authority never becomes arbitrary egress/tool/process/filesystem authority; -- queued, stale, predecessor, or synthetic-only checks never become release evidence. +- plugin/operator origin authority never becomes arbitrary egress/tool/process/filesystem authority; +- a stored HTTPS origin is not authorization for later DNS/IP/redirect/proxy resolution; +- missing immutable contextual-orchestrator owner capability fails the model-assisted lane closed rather than selecting a direct provider; +- queued, stale, predecessor, synthetic-only, or temporary-writer-only checks never become release evidence. ## Incident priorities 1. preserve tenant isolation, credentials, and authority boundaries; -2. prevent false durable-success, deletion, delivery, or provider-revocation claims; +2. prevent false durable-success, deletion, delivery, provider-revocation, or release claims; 3. stop unsafe writes, secret materialization, workers, or outbound behavior; 4. retain bounded evidence needed for diagnosis and replay; 5. restore through documented rollback, forward-fix, compensation, restore, or retry; @@ -81,29 +96,35 @@ These boundaries have owner-specific degraded and replay semantics and do not cl Logical PostgreSQL backup produces integrity evidence. Restore validates artifacts and refuses unsafe non-empty targets. This does not claim PITR; WAL/archive/replication and managed backup scheduling are operator-owned until implemented and measured. -Backups preserve owning-service boundaries. A restored data-rights or credential record must still satisfy current schema, tenant, immutability, expiry/revocation, and secret-reference validation. Backup expiry remains explicit in whole-right deletion claims. +Backups preserve owning-service boundaries. A restored data-rights, OAuth-state, credential, or delivery-origin record must still satisfy current schema, tenant, immutability, expiry/revocation, and secret-reference validation. Backup expiry remains explicit in whole-right deletion claims. ## Migration and rollback -Migrations require compatibility analysis, executable migration evidence, and rollback or forward-fix appropriate to risk. Rollback never claims to undo already committed destructive erasure, external provider revocation, delivered notification/calendar mutation, or secret-store write/delete unless a tested compensation contract exists. +Migrations require compatibility analysis, executable migration evidence, and rollback or forward-fix appropriate to risk. Rollback never claims to undo already committed destructive erasure, external provider revocation, delivered notification/calendar mutation, consumed OAuth ceremony state, Vault/secret-store write/delete, or immutable release publication unless a tested compensation contract exists. -Active PR #195, PR #198, and PR #199 introduce owner migrations and must prove restart, privilege, replay, and rollback/forward-fix semantics before integration. Protected PR #201 keeps compensation uncertainty fail-closed. Protected PR #200 narrows lifecycle authorization to the exact pinned OpenCode bootstrap; a fresh scheduled run remains operational acceptance evidence. +Review PR #195 is now protected. Active #198/#199 introduce Notification/AI owner migrations. Active Calendar/Plugin stacks introduce additional owner-specific persistence/runtime obligations and must prove restart, privilege, replay, compensation and rollback/forward-fix semantics before integration. Protected #201 keeps Calendar compensation uncertainty fail-closed. ## Current operational gaps | Gap | Status | Remaining operational evidence | | --- | --- | --- | | Complete data-rights participant/reconciliation/retention/protected delivery | Partial | issue #55 | -| Complete per-user Calendar KMS/OAuth/refresh/provider cleanup/discovery/scoped sync | Partial | issue #129 | -| Complete Plugin KMS/authorized egress/outcomes/retry/dead-letter/operator recovery | Partial | issue #130 | +| Complete per-user Calendar OAuth/token/refresh/provider cleanup/discovery/scoped sync and hosted secret lifecycle | Partial | issue #129 | +| Complete Plugin canonical egress/outcomes/retry/dead-letter/operator recovery | Partial | issue #130 | +| Complete first-party buyer journey with all states/a11y/Figma/Storybook/8 locales/current-head E2E | Partial | issue #209 | +| Immutable protected release with package/SBOM/provenance/signature/trust/reproducibility/rollback/recovery | Partial | issue #210 | | Central reusable scanner checkout/SARIF/status identity taxonomy | Partial | issue #132 | | Fixed public SLO/RPO/RTO commitments | Out of scope | unavailable without measured deployment-specific evidence | ## Runbooks and recovery drills -Required drills include database outage/restore, migration failure, stale-write conflict, worker replay, NATS outage, provider timeout, KMS create/delete partial failure, Calendar create compensation, data-rights stuck participant, plugin secret cleanup, and release rollback/provenance mismatch. +Required drills include database outage/restore, migration failure, stale-write conflict, worker replay, NATS outage, OAuth expiry/replay and callback failure, provider timeout, Vault/KMS create/delete partial failure, Calendar create compensation, data-rights stuck participant, plugin credential/origin revocation races, delivery retry/dead-letter once introduced, contextual-orchestrator auth/capability outage, release provenance/signature/trust-root mismatch, rollback and forward-fix. + +Runbooks identify owner, trigger, exact affected authority/evidence identity, safe-stop behavior, smallest recovery action, rollback/forward-fix/compensation limits, and acceptance evidence. + +## Verification-writer recovery -Runbooks must identify owner, trigger, exact affected authority/evidence identity, safe-stop behavior, smallest recovery action, rollback/forward-fix/compensation limits, and acceptance evidence. +Purpose-bounded writer workflows are not permanent operational dependencies. A writer may change only its declared owner paths, prove the intended exact source, and retire by deleting only itself through an ordinary descendant after success. If its environment omits a declared runtime prerequisite—such as a workspace package whose `main` points to built `dist`—repair the harness by building the dependency; do not skip the full suite or reinterpret a collection failure as product GREEN. ## SLO discipline @@ -111,4 +132,4 @@ LifeOS publishes no fixed availability, RPO, or RTO without measured profile-spe ## Release operations -A release is one exact protected integrated revision plus required CI/security/review/coverage/docstrings, package/container, SBOM/provenance/reproducibility, migration/rollback, backup/restore, accessibility/localization, and operational evidence. A merged feature, generated documentation pack, model score, or configured maturity percentage is not release readiness. +Issue #210 remains Partial. Active #217/#236 narrow structural and cryptographic evidence validation. A release is one unchanged protected integrated revision plus version/CHANGELOG/tag/immutable package or image, required CI/security/review/coverage/docstrings, browser/accessibility/localization, SBOM/provenance/signatures/trust lifecycle/reproducibility, migration/rollback, backup/restore, installed buyer-path verification and operational evidence. A merged feature, generated documentation pack, model score, ancestor GREEN, or configured maturity percentage is not release readiness. From 1f2d9746f7aa6f18ed54165de07ea926249a4b81 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 12:24:33 +0900 Subject: [PATCH 131/173] docs: refresh privacy and credential lifecycles --- docs/PRIVACY_DATA_LIFECYCLE.md | 66 ++++++++++++++++++++-------------- 1 file changed, 40 insertions(+), 26 deletions(-) diff --git a/docs/PRIVACY_DATA_LIFECYCLE.md b/docs/PRIVACY_DATA_LIFECYCLE.md index d589436c0..6bdc98037 100644 --- a/docs/PRIVACY_DATA_LIFECYCLE.md +++ b/docs/PRIVACY_DATA_LIFECYCLE.md @@ -11,15 +11,15 @@ LifeOS preserves legitimate product utility while constraining sensitive data th - Identity: accounts, provider mappings, sessions, workspace membership, authentication provenance, and whole-request data-rights evidence. - Planning: Goals, Projects, Tasks, search, Today, and Planning contributor receipts. - Habit: recurring definitions/completions and Habit contributor receipts. -- Review: guided-review completion/projection records. -- Calendar Integration: connection/sync metadata and opaque credential references. -- Notification: reminder occurrences, claims, delivery outcomes, and inbox evidence. -- AI Proposal: inert proposals/evidence/decisions. +- Review: guided-review completion/projection records and protected Review contributor receipts. +- Calendar Integration: connection/sync metadata, active OAuth ceremony state where implemented, and opaque credential/verifier references. +- Notification: reminder occurrences, claims, delivery outcomes, inbox evidence, and active contributor receipts. +- AI Proposal: inert proposals/evidence/decisions and active contributor receipts. - Privacy: access decisions, bounded grants, and audit events. -- Plugin Integration: installation/grant/credential-binding/operator replay evidence. -- Operators: bounded logs/metrics, backup, migration, CI, provenance, and release evidence. +- Plugin Integration: installation/grant/credential-binding/delivery-origin/operator replay evidence; active hosted runtime secret material remains Vault-owned. +- Operators: bounded logs/metrics, backup, migration, CI, provenance, signature, and release evidence. -Provider credentials, browser cookies, private signing keys, raw model prompts/responses, and hidden reasoning are protected secret/transient material. They do not belong in public responses, logs, metrics, model evidence, CI artifacts, or portable exports. +Provider credentials, PKCE verifier plaintext, Vault credentials, browser cookies, private signing keys, raw model prompts/responses, and hidden reasoning are protected secret/transient material. They do not belong in public responses, logs, metrics, model evidence, CI artifacts, or portable exports. ## Lifecycle rules @@ -27,12 +27,12 @@ Provider credentials, browser cookies, private signing keys, raw model prompts/r 2. **Authorize:** derive workspace/actor from authenticated or signed context; client ownership fields are untrusted data. 3. **Use:** constrain sensitive access to explicit purpose/resource/lifetime and exact request authority. 4. **Persist:** store only under the owning service's schema/role/migrations; never cross-mutate another service's tables. -5. **Secret handling:** persist only opaque references where external credential material is required. +5. **Secret handling:** persist only opaque references where external credential material is required; secret plaintext lifetime is bounded to the owning adapter call. 6. **Observe:** logs, metrics, traces, CI, and review evidence remain bounded and credential-free. -7. **Retain:** classify mutable records, immutable audit/receipt evidence, legal hold, and backup expiry separately. +7. **Retain:** classify mutable records, immutable audit/receipt evidence, consumed/expired authorization state, legal hold, and backup expiry separately. 8. **Export/Delete:** recent-authenticated whole requests invoke explicit registered service-owned contributors. -9. **Recover:** retries preserve exact idempotency/fencing authority and never fabricate terminal success. -10. **Release:** privacy claims bind one exact protected source and deployed artifact/provenance identity. +9. **Recover:** retries preserve exact idempotency/fencing authority and never fabricate terminal success or restore revoked authority. +10. **Release:** privacy claims bind one exact protected source and deployed artifact/provenance/signature identity. ## Data-rights lifecycle @@ -46,9 +46,10 @@ Protected main includes: - deterministic per-section and whole-export integrity evidence; - versioned `life-os.data-rights-contributor.v1` from PR #159; - Planning contribution from PR #179 and authenticated request-bound transport from PR #194; -- Habit contribution from PR #184 and replay-safe authenticated transport from PR #192. +- Habit contribution from PR #184 and replay-safe authenticated transport from PR #192; +- Review contribution from PR #195. -Review contribution in PR #195 is **Implemented on active PR**. Notification contribution in PR #198 is **Implemented on active PR**. AI contribution in PR #199 is **Implemented on active PR**. Active branch migrations and receipts remain non-shipped until integration. +Notification contribution in PR #198 and AI contribution in PR #199 are **Implemented on active PR**. Their active branch migrations and receipts remain non-shipped until integration. Issue #55 remains **Partial** because required Identity-owned erasure, Calendar, Privacy, Plugin Integration, remaining service inventory, durable asynchronous reconciliation, operator recovery, retention/legal hold, backup expiry, protected streamed/encrypted export delivery, expiry/deletion/download audit, and exact terminal participant-set completion are not all protected. @@ -66,19 +67,19 @@ No service may claim whole-workspace deletion because its own records were erase Unknown or missing participants fail closed. Identity orchestration never receives another service's SQL credentials. -## Calendar credentials and connections +## Calendar credentials, OAuth state, and connections **Status:** Partial -Protected main includes signed workspace sync context (PR #139), workspace/user scoped metadata persistence (PR #150), atomic local revocation (PR #153), signed `life-os.calendar-user.v1` authority (PR #155), authenticated disconnect (PR #157), exact returned lookup validation (PR #176), authenticated credential-free read (PR #189), scoped materialization port (PR #193), and authenticated secret-first creation (PR #197). +Protected main includes signed workspace sync context (PR #139), workspace/user scoped metadata persistence (PR #150), atomic local revocation (PR #153), signed `life-os.calendar-user.v1` authority (PR #155), authenticated disconnect (PR #157), exact returned lookup validation (PR #176), authenticated credential-free read (PR #189), scoped materialization port (PR #193), authenticated secret-first creation (PR #197), returned-evidence compensation (PR #201), and Calendar-owned AES-256-GCM encrypted self-hosted secret storage (PR #203). -Connection rows retain bounded provider/account/calendar metadata and opaque secret references only. Plaintext access/refresh material exists only within the reviewed secret-store/materialization call boundary. Local record revocation does not prove provider-side OAuth revocation or secret destruction. +Connection rows retain bounded provider/account/calendar metadata and opaque secret references only. Plaintext access/refresh material exists only within the reviewed secret-store/materialization boundary. Local record revocation does not prove provider-side OAuth revocation or secret destruction. -PR #201 protects compensation of newly written secret handles when durable create evidence mismatches exact connection/workspace/user/handle authority. +Active #216 rejects deployment-wide Google/CalDAV credentials as hosted user authority. Active #228 adds a bounded OAuth authorization-state lifecycle with opaque UUIDv4 state, exact workspace/user/provider/redirect binding, expiry/one-time consumption, and an opaque PKCE verifier secret reference. PKCE verifier plaintext remains outside durable Calendar metadata, and consumed repository evidence is revalidated before materialization. -Issue #129 remains **Partial** for concrete encrypted KMS/secret storage, OAuth state/PKCE/callback, refresh fencing, provider-side revoke/delete recovery, discovery/selection, scoped synchronization composition, migration from process-global credentials, rotation, and operator recovery. +Issue #129 remains **Partial** for hosted callback/token exchange, successful post-exchange verifier cleanup, concrete Calendar-owned PostgreSQL OAuth-state runtime, refresh fencing, provider-side revoke/delete recovery, discovery/selection, scoped synchronization composition, complete KMS/runtime rotation and operator recovery. Expired/consumed/revoked ceremony or connection authority cannot be revived by rollback. -## Plugin installation, credentials, and outbound delivery +## Plugin installation, credentials, delivery origins, and outbound delivery **Status:** Partial @@ -93,7 +94,19 @@ Protected main separates manifest intent from host authority and includes: Plaintext plugin credentials never belong in manifests, LifeOS persistence, public/application views, logs, metrics, prompts, CI artifacts, or audit rows. Exact replay cannot rematerialize an existing secret. Revocation ends LifeOS authority before external deletion retry and never restores authority. -Issue #130 remains **Partial** for a concrete KMS adapter, separately host-authorized delivery origins, DNS/IP/SSRF/rebinding-safe HTTPS, redirect/proxy/size/time controls, per-plugin signing/rotation, delivery attempt/outcome persistence, bounded retry/dead-letter, delivery-time revocation fencing, and operator-visible recovery. +The active #130 stack preserves those boundaries while adding concrete service-owned runtime pieces: #205 host-owned normalized HTTPS origin identity, #235 Integration-owned PostgreSQL delivery-origin grants and active-installation fencing, #241 credential/revocation consistency hardening, #242 Vault KV v2 secret storage, #243/#244 authenticated Vault and one Integration-owned PostgreSQL pool, #245 concrete hosted/default-entrypoint runtime, and #250 exact signed one-time delivery-origin grant/read/revoke application authority. + +Vault holds provider plaintext; durable LifeOS rows keep opaque references only. A stored delivery origin remains bounded identity metadata, not approval for a later DNS/IP, redirect, proxy or rebinding result. #250 does not expose public delivery-origin HTTP transport and does not perform outbound HTTPS. + +Issue #130 remains **Partial** until immutable released/versioned canonical egress authority provides connect-time DNS/IP and rebinding enforcement, redirect/proxy/size/time controls, and LifeOS owns delivery attempts/outcomes, bounded retry/dead-letter, delivery-time revocation fencing, operator recovery, migration, rollback and retention semantics. + +## First-party browser data lifecycle + +**Status:** Partial + +Issue #209's active browser/BFF stack starts with #214 and includes durable Goals #229 and Weekly Review #234. Browser memory/local storage is never authoritative tenant or durable-record state. Workspace/actor authority is derived server-side, downstream service requests are signed by trusted BFF code, and returned records are validated before durable acceptance is shown. + +The commercial path remains incomplete until all Goals → Projects → Tasks → Habits → Review descendants have current-head E2E for normal/loading/empty/error/permission/conflict/recovery states, stale-response suppression, keyboard/a11y/responsive behavior, Figma/Storybook traceability, authoritative Review projections, and KO/EN/JA/ZH/VI/ES/DE/FR DB-versioned screen-key translation resources. Translation resources remain separate from ontology labels. ## Purpose-bound access @@ -103,20 +116,21 @@ Privacy decisions bind exact actor, workspace, resource/resource class, purpose, ## AI and model-assisted evidence -**Status:** Accepted architecture +**Status:** Partial -AI proposals remain inert until explicit authorized decision. Browser credentials and provider secrets are not model inputs. `NVIDIA_NIM_API_KEY` may materialize only inside the reviewed model-call/development boundary. Retained model evidence excludes the key, raw prompts/responses, and hidden reasoning. +AI proposals remain inert until explicit authorized decision. Browser credentials and provider secrets are not model inputs. Protected #200 authorizes only the exact reviewed OpenCode bootstrap surface. -Model output cannot become product authorization, independent review, merge, or release authority. PR #200 is **Implemented on protected main** only for restoring the pinned OpenCode executable through a narrow lifecycle-script allowlist; it does not broaden model or repository authority. +Active #208 routes model capability through a released contextual-orchestrator API/client and virtual `orchestrator/free`; provider keys and model selection remain owner-side bootstrap authority. LifeOS does not copy mutable owner source or fall back to direct providers if the gateway cannot authenticate or supply the required capability. Retained model evidence excludes credentials, raw prompts/responses, and hidden reasoning. Model output cannot become product authorization, independent review, merge, or release authority. ## Integrity, secrecy, and provenance - SHA-256 export/manifest/receipt digests detect deterministic content change but do not provide authorization, confidentiality, signer identity, or non-repudiation. - Secret references identify least-authority external material; possession of metadata is not permission to materialize a secret. -- Provider/plugin IDs are metadata, not LifeOS primary identity. -- CI/SARIF/status evidence must identify the exact inspected source/integration identity; a green umbrella status is not privacy assurance for another tree. +- Provider/plugin IDs and delivery origins are metadata, not LifeOS primary identity or connect-time network authority. +- CI/SARIF/status evidence identifies the exact inspected source/integration identity; a green umbrella status is not privacy assurance for another tree. +- Release signatures require subject binding, verifiable trust roots and key lifecycle evidence; active #217/#236 verification does not by itself create immutable release authority. - Backup retention and physical storage expiry remain explicit and cannot be hidden behind immediate logical deletion claims. ## Privacy failure and recovery -Dependency outages return sanitized unavailable evidence. Partial external cleanup retains replayable recovery identity without restoring revoked authority. Ambiguous persistence winners, mismatched durable evidence, malformed rows, and unavailable receipt storage fail closed. Recovery evidence never exposes plaintext secrets or tenant payloads. +Dependency outages return sanitized unavailable evidence. Partial external cleanup retains replayable recovery identity without restoring revoked authority. Ambiguous persistence winners, mismatched durable evidence, malformed rows, and unavailable receipt storage fail closed. Recovery evidence never exposes plaintext secrets or tenant payloads. Consumed OAuth/operator replay evidence and revoked installation/credential/origin authority remain consumed/revoked across retries, restarts and rollback unless a separate audited recovery contract explicitly proves otherwise. From 416f0b872faab51aaa6a30e53830778bfbc25ba1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 12:25:19 +0900 Subject: [PATCH 132/173] docs: align agent contract with orchestrator boundary --- CLAUDE.md | 31 +++++++++++++++++++------------ 1 file changed, 19 insertions(+), 12 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index a796a89e8..3ff834abe 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -10,41 +10,48 @@ 4. Make the smallest complete correction, including tests and documentation. 5. Re-run the exact pull-request head and resolve only threads whose finding is actually addressed. 6. Merge only when required checks pass, no actionable findings remain, and the repository's merge policy accepts the exact head. -7. Continue with the highest-impact buyer-visible gap after the pull-request queue is empty or a current lane becomes locally blocked. +7. Non-force restack dependent branches after an accepted parent change; never discard concurrent valid delta. +8. Continue with the highest-impact buyer-visible gap after the pull-request queue is empty or a current lane is independently blocked. Routine progress narration is not a substitute for repository evidence. Record durable decisions in canonical docs/ADRs, code, tests, runbooks, issues, and pull-request evidence with truthful protected-main/active-PR/planned maturity. ## Non-negotiable boundaries - Never use `COPILOT_GITHUB_TOKEN`. -- Scheduled model-assisted work uses `NVIDIA_NIM_API_KEY` through the approved OpenCode or contextual-orchestrator boundary. +- All model capability is consumed through an immutable reviewed `contextual-orchestrator` API/client/schema. GitHub Actions model-backed work uses only virtual `orchestrator/free` plus the gateway authentication token; provider/model/group selection and provider credentials remain contextual-orchestrator owner authority. +- `BYTEZ`, `NVIDIA_NIM`/`NVIDIA_NIM_SUB`, `OPENROUTER`, `OPENAI`, embedding, responses/completions, audio/video/image and other model/provider credential discovery stay in contextual-orchestrator. LifeOS does not copy mutable owner source or add a direct-provider fallback when a capability is missing. - Do not alter or repurpose the credential scheme of existing review agents. - Never forward browser cookies, provider credentials, hidden reasoning, raw prompts, raw model responses, or stack traces into retained artifacts. -- Internal identifiers are UUIDv4 strings; numeric external identifiers are mapped through an explicit provider-identity boundary. +- Internal identifiers are UUIDv4 strings; numeric/external provider identifiers are mapped through explicit provider-identity boundaries. - Database objects use multiword `snake_case` names unless an external protocol mandates a different spelling. -- Services do not read or mutate another service's database tables. +- Services own their persistence, migrations, credentials, transaction boundaries and recovery. They do not read or mutate another service's database tables. - Browser-local state is not durable until accepted by the owning service. - AI proposals remain inert until a separately authorized user-confirmed execution capability exists. - Sensitive access is tenant/resource/purpose/lifetime/audit bound rather than relying on blanket masking. -- Mathematical and psychometric numerical kernels require Rust, deterministic CPU/GPU execution boundaries, realistic parameter-recovery tests, multilevel or multiple-membership structure, and temporal modeling where applicable. +- Mathematical, psychometric, EDA, data-science, performance and security hot kernels are Rust-first; numerical claims require deterministic CPU/GPU parity as applicable, realistic parameter-recovery/error evidence, multilevel or multiple-membership structure, and temporal modeling where applicable. ## LLM orchestration decisions -Use a strong single-model route as the mandatory baseline. Allocate additional test-time compute only through explicit profiles that identify reasoning effort, workflow stages, role assignment, decomposition, recursive depth, and access topology. Use measured proposal validity, grounding, utility, and prompt-injection resistance to justify deeper orchestration. Do not optimize this decision for latency alone. +Use a strong single-route baseline before deeper orchestration. Allocate additional test-time compute only through explicit profiles that identify reasoning effort, workflow stages, role assignment, decomposition, recursive depth, worker/model choice where the owner exposes it, verifier topology, and access/communication topology. Use measured proposal validity, grounding, utility, and prompt-injection resistance to justify deeper orchestration. Fugu/Conductor/TRINITY-style experiments are evidence profiles, not authority. -Live model tests may use `NVIDIA_NIM_API_KEY`. Deterministic pull-request checks must remain meaningful when that secret or the provider is unavailable. Provider failures produce sanitized unavailable evidence, never fabricated scores. +LifeOS does not seed provider credentials directly. The target model-assisted line is the released contextual-orchestrator boundary with virtual `orchestrator/free`. If gateway authentication, a required capability, or the released owner contract is unavailable, fail closed and repair/release the canonical owner before bumping the LifeOS consumer. Model timeout defaults remain owner-contract-driven; user cancellation, provider termination, administrative timeout, stream/tool-call lifecycle and reasoning completion are distinct evidence classes. + +Deterministic pull-request checks remain meaningful when model capability is unavailable. Provider/gateway failures produce sanitized unavailable evidence, never fabricated scores or a direct-provider bypass. ## Verification standard -- Production declarations have explanatory docstrings. -- Changed production code maintains 100% statement, branch, function, and line coverage where the package enforces those gates. -- Tests model realistic domain outcomes, including PostgreSQL/browser/concurrency/security behavior where applicable. +- Production declarations have explanatory docstrings/rustdoc. +- Owned production code maintains the repository's exact configured statement, branch, function and line/edge coverage gates; a green suite alone is not a 100% coverage claim. +- Tests model realistic domain outcomes, including PostgreSQL/browser/concurrency/security behavior where applicable. Synthetic data is unit-test evidence, not production acceptance. +- Buyer-path web/API performance is measured end-to-end on applicable real paths; an asserted p95 target is not accepted without the actual denominator and profiling evidence. +- Material UI preserves reusable component/page composition, product-design/Figma/Storybook traceability, normal/loading/empty/error/permission/responsive/interaction states, keyboard/a11y evidence and KO/EN/JA/ZH/VI/ES/DE/FR locale behavior where the changed surface requires it. - Standards and research claims are documented with APA 7 references and publication status is distinguished from drafts or preprints. - Canonical status fields use the exact repository vocabulary and never mix PR/issue qualifiers into the status value. -- `CHANGELOG.md` records buyer-visible behavior. +- `CHANGELOG.md` records buyer-visible behavior and meaningful security/operational contract changes. - PRD/TRD/Architecture/ADR/UML/Data Model/API/Security/Privacy/Test/Operability/Release/Traceability views are reconciled when their boundary changes. +- Exact source, PR-base snapshot, live base, integration/synthetic tree, workflow checkout, protected main and release-source identities are never conflated. - Release tags and versions are created only after the repository proves release readiness; unreleased work stays under `Unreleased`. ## Safe escalation -Escalate only for a decision or permission that cannot be resolved from repository policy, tests, standards, or available credentials. Waiting for checks or reviews is not itself an escalation condition; continue independent analysis, documentation, testing, or the next non-conflicting planned task while preserving merge safety. +Escalate only for a decision or permission that cannot be resolved from repository policy, tests, standards, or available credentials. Waiting for checks or reviews is not itself an escalation condition; continue independent analysis, documentation, testing, restacking, owner-path repair, or the next non-conflicting planned task while preserving merge safety. From 84a71e60b02b3b9e662bd544eb198146847fb2fa Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 12:25:56 +0900 Subject: [PATCH 133/173] docs: refresh public architecture summary --- README.md | 45 ++++++++++++++++++++++++++++++++------------- 1 file changed, 32 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index b76c29662..2abbc2442 100644 --- a/README.md +++ b/README.md @@ -6,7 +6,7 @@ LifeOS connects everyday action to longer-term direction. It is designed as a mu ## Status -LifeOS is in active foundation development. The current `main` branch contains the monorepo, gateway, bounded services, shared contracts, responsive web shell, PostgreSQL persistence, NATS JetStream configuration, security gates, and commercial-readiness evidence loop. Interfaces and migrations may still change before the first stable release. +LifeOS is in active foundation development. The current protected `main` branch contains the monorepo, gateway, bounded services, shared contracts, responsive web shell, service-owned PostgreSQL persistence, NATS JetStream configuration, security gates, and commercial-readiness evidence loop. Interfaces and migrations may still change before the first stable release. Active pull requests are development evidence, not shipped capability. ## Architecture @@ -14,13 +14,14 @@ LifeOS is in active foundation development. The current `main` branch contains t Web / PWA | API Gateway / BFF - |---------------------------------------------| -Identity Planning Habit Review - | | | | -PostgreSQL schemas / databases + NATS JetStream events + |------------------------------------------------------------------| +Identity Planning Habit Review Calendar Notification AI Privacy Plugin + | | | | | | | | | + service-owned PostgreSQL + versioned HTTP/event contracts + NATS JetStream where required ``` -The MVP deliberately keeps goals, projects, milestones, and tasks in one Planning bounded context. Services own their persistence boundaries; direct cross-service table access is prohibited. +The product keeps goals, projects, milestones, and tasks in the Planning bounded context. Each service owns its persistence, migrations, credentials, transaction boundaries, runtime composition and recovery. Direct cross-service table access is prohibited. Browser-local state is not durable until the owning service accepts it. ## Repository layout @@ -75,21 +76,35 @@ Metrics endpoints contain operational data. Production ingress must restrict the ## Authentication -Google and GitHub OAuth are the required login providers. Provider credentials are supplied through environment variables and must never be committed. Deployment operators are responsible for provider registration, redirect URI policy, secret rotation, and production access controls. +Google and GitHub OAuth are the required login providers. Provider registration and bootstrap credentials are deployment configuration and must never be committed. Deployment operators are responsible for redirect URI policy, secret rotation, and production access controls. Browser-supplied workspace or user identifiers never replace authenticated server authority. ## Calendar synchronization -The calendar integration service supports explicit `caldav` and `google` provider modes. Set `CALENDAR_PROVIDER` and the matching variables in `.env.example` before starting the service. +The calendar integration service supports explicit `caldav` and `google` provider modes. CalDAV writes use deterministic resource names, `If-None-Match: *` for creation, and strong `If-Match` ETags for updates. Google Calendar writes use a deterministic API event identifier to prevent duplicate creation and the same strong-ETag precondition for updates. Neither adapter exposes delete, move, or copy operations through the LifeOS provider contract. -CalDAV writes use deterministic resource names, `If-None-Match: *` for creation, and strong `If-Match` ETags for updates. Google Calendar writes use a deterministic API event identifier to prevent duplicate creation and the same strong-ETag precondition for updates. Neither adapter exposes delete, move, or copy operations through the LifeOS provider contract. +Protected main derives Calendar workspace/user authority from signed server context and stores only bounded connection metadata plus opaque secret references. It includes local disconnect, credential-free reads, scoped materialization, secret-first create/compensation, and a Calendar-owned encrypted self-hosted credential-store profile. -The calendar service now derives workspace authority from a bounded signed server context rather than a client-selected legacy workspace header. `GOOGLE_CALENDAR_ACCESS_TOKEN` remains an operator-supplied development/runtime secret for the current provider slice. Per-user OAuth credential storage, token refresh, revocation, calendar discovery, selection, and encrypted persistence remain tracked by issue #129 before hosted multi-user Google Calendar operation can be considered complete. +Hosted multi-user provider lifecycle is still incomplete under issue #129. Active work rejects deployment-wide Google/CalDAV credentials as end-user authority and adds bounded Google OAuth state/PKCE authority, but callback/token exchange, concrete PostgreSQL OAuth-state runtime, refresh fencing, provider revoke/delete recovery, discovery/selection and scoped synchronization remain unshipped until normal integration and completion. -## Plugin contract +## Plugin integration -The `@life-os/plugin-sdk` package defines strict versioned manifests, tenant-scoped CloudEvents 1.0 structured JSON envelopes, deterministic canonical serialization, and HMAC-SHA256 delivery-proof helpers. The integration service exposes contract discovery, manifest validation, and event preparation only. +The `@life-os/plugin-sdk` package defines strict versioned manifests, tenant-scoped CloudEvents 1.0 structured JSON envelopes, deterministic canonical serialization, and bounded signing helpers. A manifest expresses requested intent only; it never self-authorizes capabilities, secrets, database access or network destinations. -This slice deliberately has no plugin installation, secret persistence, outbound webhook delivery, inbound commands, or direct database access. Those require separately reviewed least-privilege authorization, durable audit, and SSRF-safe delivery boundaries under issue #130. +Protected main contains explicit installation grants, restart-safe Integration-owned PostgreSQL installation persistence, opaque credential-binding references, exact returned-evidence validation, one-time signed operator authority and fail-closed operator HTTP composition. Active issue #130 work adds host-owned normalized HTTPS delivery-origin grants, Vault KV v2 secret storage, Integration-owned PostgreSQL runtime composition and signed delivery-origin application authority. These active slices remain non-shipped and deliberately stop before complete outbound HTTPS. + +A stored delivery origin is not connect-time network authorization. Complete plugin delivery still requires immutable released/versioned canonical egress authority for DNS/IP/rebinding, redirect/proxy and bounded response/time enforcement, plus durable delivery attempts/outcomes, retry/dead-letter, revocation fencing and operator recovery. + +## First-party product journey + +Protected main contains durable server-side Planning/Habit/Review foundations and real authenticated Today composition. Issue #209 tracks the complete first-party Goals → Projects → Tasks → Habits → Review journey. Active stacked work begins with an authenticated Goal BFF and includes durable Goals and Weekly Review workspaces, but remains Draft/non-shipped. + +Commercial completion requires current-head browser E2E, Figma/Storybook traceability, normal/loading/empty/error/permission/responsive/interaction states, keyboard/focus/reduced-motion/accessibility acceptance, authoritative Review projections, and KO/EN/JA/ZH/VI/ES/DE/FR translation-ledger/font/text-expansion parity. + +## Model-assisted development + +LifeOS treats model output as untrusted evidence and keeps review, merge and release authority deterministic. The target automation boundary is an immutable reviewed `contextual-orchestrator` API/client with virtual `orchestrator/free`. Provider credentials, provider/model/group selection and multimodal capability discovery belong to contextual-orchestrator rather than LifeOS workflows or product code. + +Protected OpenCode bootstrap hardening does not authorize direct-provider routing. Active consumer work remains fail-closed until the contextual-orchestrator authentication/bootstrap contract is repaired and published as an immutable reviewed release. LifeOS does not copy mutable owner source or fall back to direct provider selection. ## Backup and recovery @@ -103,6 +118,10 @@ This logical-dump tier is not point-in-time recovery and does not schedule, encr The manual deployment workflow accepts only digest-pinned images and an exact HTTPS web origin, uses one shared renderer, optionally applies forward-only migrations, runs through the protected GitHub `production` environment, and performs server-side dry-run and diff. Before applying, it captures whether each Deployment exists and its current revision. A failed apply or rollout must either verify rollback to that captured revision or verify deletion of a first-time Deployment; a separate failure is reported when workload-state recovery itself fails. Namespace policy, completed migrations, external infrastructure, and other non-Deployment resources are not automatically reversed. The reference does not provision a cluster, database, NATS, ingress, TLS, DNS, image pipeline, or secret manager. Operators must follow the [production deployment runbook](docs/operations/production-deployment.md) and preserve those explicit ownership boundaries. +## Release status + +Issue #210 tracks immutable commercial release readiness. Active Draft release-evidence work validates structural artifact/checksum/provenance/signature evidence and detached Ed25519 signatures, but no active PR is itself a release. A stable release requires one unchanged protected source bound to version, CHANGELOG, tag, package/image, SBOM, provenance/signatures, trust-root/key lifecycle, reproducibility, migration/rollback/recovery, installed buyer-path verification and all required CI/security/review/coverage/docstring/accessibility/localization evidence. + ## Privacy and deployment responsibility This is a public repository. It contains synthetic examples only. Personal goals, health information, relationship data, credentials, access tokens, private prompts, customer data, and production exports must not be committed. From 9f73cb7d574d871170f0d8586d11b450003529fe Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 12:27:12 +0900 Subject: [PATCH 134/173] docs: refresh standards and orchestration evidence --- docs/STANDARDS_TRACEABILITY.md | 53 ++++++++++++++++++++-------------- 1 file changed, 32 insertions(+), 21 deletions(-) diff --git a/docs/STANDARDS_TRACEABILITY.md b/docs/STANDARDS_TRACEABILITY.md index 0f5e5a738..d7a41f38a 100644 --- a/docs/STANDARDS_TRACEABILITY.md +++ b/docs/STANDARDS_TRACEABILITY.md @@ -2,17 +2,18 @@ **Status:** Implemented on active PR -This document records normative/current standards and repository-wide research used for durable LifeOS decisions. Drafts and preprints are labeled explicitly and do not silently replace published standards or peer-reviewed evidence. +This document records normative/current standards and repository-wide research used for durable LifeOS decisions. Drafts, preprints, vendor claims, and product-release evidence are labeled explicitly and do not silently replace final standards or peer-reviewed evidence. Publication status below was refreshed against primary sources in September 2026. ## Standards matrix | Source | Publication status | LifeOS use | | --- | --- | --- | | IETF RFC 9562, *Universally Unique IDentifiers (UUIDs)* | Final RFC, 2024 | UUIDv4 identifier syntax/semantics; LifeOS intentionally chooses version 4 rather than version 7 | -| IETF RFC 9700 / BCP 240, *Best Current Practice for OAuth 2.0 Security* | Final BCP, January 2025 | OAuth redirect/state/PKCE/token security posture and deprecation of unsafe legacy patterns | -| W3C, *Web Content Accessibility Guidelines (WCAG) 2.2* | W3C Recommendation, 2023 | keyboard/focus/status/authentication accessibility and browser acceptance expectations | +| IETF RFC 9700 / BCP 240, *Best Current Practice for OAuth 2.0 Security* | Final Best Current Practice, January 2025 | exact redirect matching, state/PKCE/token and mix-up/open-redirect security posture; unsafe legacy patterns are not copied into Calendar authority | +| W3C, *Web Content Accessibility Guidelines (WCAG) 2.2* | W3C Recommendation, latest Recommendation revision December 2024 | keyboard/focus/status/authentication accessibility and browser acceptance expectations | +| ISO/IEC 40500:2025, *W3C Web Content Accessibility Guidelines (WCAG) 2.2* | Published international standard, October 2025; identical to the October 2023 WCAG 2.2 text | international-standard traceability for the material UI acceptance baseline; W3C's later WCAG 2.2 Recommendation remains the current web-standard reference | | NIST SP 800-218, *Secure Software Development Framework (SSDF) Version 1.1* | Final, 2022 | secure-development, provenance and vulnerability-prevention practices | -| NIST SP 800-218 Rev. 1 / SSDF 1.2 | Initial Public Draft | watch item only until final publication; does not replace 1.1 requirements | +| NIST SP 800-218 Rev. 1 / SSDF Version 1.2 | Initial Public Draft published December 17, 2025; public comment closed January 30, 2026; not final as of the September 2026 verification | watch item only; does not replace SSDF 1.1 normative use until NIST publishes a final revision | | NIST AI 100-1, *Artificial Intelligence Risk Management Framework 1.0* | Final, 2023 | AI governance/evidence/risk framing | | NIST AI 600-1, *AI RMF: Generative Artificial Intelligence Profile* | Final, 2024 | GenAI prompt/provider/evidence risk controls | @@ -20,47 +21,57 @@ This document records normative/current standards and repository-wide research u | Source | Publication status | LifeOS use | | --- | --- | --- | -| Sakana AI, *Sakana Fugu: One model to command them all* | Final product release and technical release evidence, 2026 | motivates measuring direct-route versus coordinated-expert execution rather than assuming one topology | -| Nielsen et al., *Learning to orchestrate agents in natural language with the Conductor* | Peer-reviewed ICLR 2026 conference paper | motivates explicit communication topology, targeted instructions, recursive selection and test-time-scaling evidence | -| Xu et al., *TRINITY: An evolved LLM coordinator* | Peer-reviewed ICLR 2026 conference paper | motivates explicit Thinker/Worker/Verifier roles and multi-turn coordination evidence | -| Xu et al., *Rethinking the value of multi-agent workflow: A strong single agent baseline* | arXiv preprint; submitted to ICLR 2026 | counterevidence requiring a strong single-agent baseline before claiming value from homogeneous multi-agent workflows | -| NVIDIA, *API reference—NVIDIA NIM for large language models* | Published primary vendor API documentation, 2026 | authoritative provider transport/API reference for the bounded live-conformance integration | +| Sakana AI, *Sakana Fugu: One model to command them all* | Primary vendor product/technical release, June 22, 2026; Fugu-Ultra v1.1 product update July 24, 2026 | motivates measuring direct-route versus dynamically coordinated expert execution rather than assuming one topology; vendor benchmark claims are not independent research evidence | +| Nielsen et al., *Learning to orchestrate agents in natural language with the Conductor* | Reported by Sakana AI as an ICLR 2026 paper in its June 2026 Fugu release | motivates explicit communication topology, targeted instructions, recursive selection and test-time-scaling evidence | +| Xu et al., *TRINITY: An evolved LLM coordinator* | Reported by Sakana AI as an ICLR 2026 paper in its June 2026 Fugu release | motivates explicit Thinker/Worker/Verifier roles and multi-turn coordination evidence | +| Xu et al., *Rethinking the value of multi-agent workflow: A strong single agent baseline* | arXiv preprint / conference-submission evidence in the repository bibliography; no final publication status is inferred here | counterevidence requiring a strong single-agent baseline before claiming value from homogeneous multi-agent workflows | These sources motivate the dimensions measured by LifeOS; they do **not** establish universal multi-agent superiority. ADR 0012 makes a repository-specific decision: a strong single-model route is the mandatory comparison baseline, deeper orchestration is admitted only from retained LifeOS evidence under reasonably comparable budgets, and deterministic LifeOS authorization/evaluation/review/merge/release authority remains separate from model execution. +The runtime/provider implementation boundary is independently governed by the canonical `contextual-orchestrator` owner. LifeOS does not use the presence of any provider-specific research or benchmark as authority to seed provider credentials, choose provider/model/group names, or bypass the released gateway contract. Active PR #208 consumes the owner through virtual `orchestrator/free`; provider and multimodal capability discovery remain owner-side. + ## Decision traceability - **UUIDv4 invariant:** RFC 9562 permits UUID version 4 and defines modern UUID representation; LifeOS's choice of opaque random UUIDv4 is a repository architecture decision, not a claim that v4 is universally superior. -- **OAuth security:** identity and future calendar authorization flows apply current OAuth security best current practice. Issue #129 must use provider-appropriate state/PKCE/redirect and credential lifecycle controls rather than copying browser-login credentials into calendar authority. -- **Accessibility:** core PWA journeys target WCAG 2.2-relevant keyboard/focus/non-color-only/status/authentication behavior with browser acceptance evidence. -- **Secure SDLC:** exact-head CI/security evidence, immutable action pins, least privilege, bounded untrusted input and provenance align with SSDF practices. SSDF 1.2 remains draft as of this baseline. -- **AI governance:** model output remains untrusted and inert, deterministic authorization/validation is separate, provider availability is not fabricated as merge success, and retained artifacts exclude secrets/raw prompts/responses/hidden reasoning. -- **Test-time compute:** ADR 0012 and `docs/superpowers/specs/2026-08-06-ai-nim-live-conformance-design.md` define the strong-route baseline, route/conduct cells, explicit reasoning/stage/decomposition/recursion/access-topology dimensions, unsupported-state handling, `NVIDIA_NIM_API_KEY` credential boundary and independent governance authority. +- **OAuth security:** RFC 9700 remains BCP 240 and requires exact registered redirect matching for redirect-based flows (with its documented native-localhost exception) and rejects unsafe open redirectors. Identity and active Calendar OAuth work bind state/PKCE/redirect/provider/user/workspace evidence accordingly. Issue #129 must not copy browser-login credentials or deployment-global provider credentials into end-user Calendar authority. +- **Accessibility:** material PWA journeys target current WCAG 2.2 keyboard/focus/non-color-only/status/authentication requirements. ISO/IEC 40500:2025 adds international-standard traceability but does not justify pinning LifeOS to the older October 2023 text when W3C publishes a newer WCAG 2.2 Recommendation revision. +- **Secure SDLC:** exact-head CI/security evidence, immutable action pins, least privilege, bounded untrusted input, provenance and root-cause remediation align with final SSDF 1.1. SSDF 1.2 remains an Initial Public Draft at the latest primary-source verification and therefore remains a watch item. +- **AI governance:** model output remains untrusted and inert, deterministic authorization/validation is separate, gateway/provider availability is not fabricated as merge success, and retained artifacts exclude secrets/raw prompts/responses/hidden reasoning. +- **Test-time compute:** ADR 0012 defines the strong-route baseline and explicit reasoning/stage/decomposition/recursion/role/access-topology dimensions. Fugu/Conductor/TRINITY are research/product evidence for orchestration dimensions, not direct runtime dependencies or provider authority. +- **Model runtime ownership:** all LifeOS model-backed automation and product-facing model capability consumes a reviewed immutable contextual-orchestrator API/client/schema. GitHub Actions uses virtual `orchestrator/free` plus gateway authentication only; provider credentials and discovery are canonical-owner concerns. ## Research traceability -Feature-specific peer-reviewed and technical research remains in `docs/research/` and approved `docs/superpowers/specs/` documents. When a research result becomes a repository-wide architectural requirement, an ADR links the primary source, assumptions, alternatives and executable acceptance evidence. Detailed Fugu/Conductor/TRINITY/single-agent limitations and the exact live-conformance profile contract remain in `docs/superpowers/specs/2026-08-06-ai-nim-live-conformance-design.md`; this canonical file records only the repository-wide decision anchors and publication status. +Feature-specific peer-reviewed and technical research remains in `docs/research/` and approved `docs/superpowers/specs/` documents. Historical NIM-specific specs/plans describe the evidence available when they were written and are not promoted into current provider-routing authority. When a research result becomes a repository-wide architectural requirement, an ADR links the primary source, assumptions, alternatives and executable acceptance evidence. + +Fugu/Conductor/TRINITY/single-agent research remains relevant to TTC ablation design. The live consumer architecture is separately constrained by ADR 0012, current LifeOS contracts, and the released contextual-orchestrator owner boundary. Unsupported orchestration controls remain explicit rather than simulated. ## APA 7 references Internet Engineering Task Force. (2024). *Universally Unique IDentifiers (UUIDs)* (RFC 9562). RFC Editor. https://doi.org/10.17487/RFC9562 +International Organization for Standardization & International Electrotechnical Commission. (2025). *Information technology—W3C Web Content Accessibility Guidelines (WCAG) 2.2* (ISO/IEC 40500:2025). https://www.iso.org/standard/91056.html + Lodderstedt, T., Bradley, J., Labunets, A., & Fett, D. (2025). *Best current practice for OAuth 2.0 security* (RFC 9700; BCP 240). RFC Editor. https://doi.org/10.17487/RFC9700 National Institute of Standards and Technology. (2022). *Secure Software Development Framework (SSDF) version 1.1: Recommendations for mitigating the risk of software vulnerabilities* (NIST SP 800-218). https://doi.org/10.6028/NIST.SP.800-218 +National Institute of Standards and Technology. (2025). *Secure Software Development Framework (SSDF) version 1.2: Recommendations for mitigating the risk of software vulnerabilities* (NIST SP 800-218 Rev. 1, Initial Public Draft). https://csrc.nist.gov/pubs/sp/800/218/r1/ipd + National Institute of Standards and Technology. (2023). *Artificial Intelligence Risk Management Framework (AI RMF 1.0)* (NIST AI 100-1). https://doi.org/10.6028/NIST.AI.100-1 National Institute of Standards and Technology. (2024). *Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile* (NIST AI 600-1). https://doi.org/10.6028/NIST.AI.600-1 -Nielsen, S., Cetin, E., Schwendeman, P., Sun, Q., Xu, J., & Tang, Y. (2026). *Learning to orchestrate agents in natural language with the Conductor* [Conference paper]. International Conference on Learning Representations. https://openreview.net/pdf/4a133f1e2ca67ceaedb45c3a123cc8125c694ff5.pdf +Nielsen, S., Cetin, E., Schwendeman, P., Sun, Q., Xu, J., & Tang, Y. (2026). *Learning to orchestrate agents in natural language with the Conductor* [ICLR 2026 paper]. https://arxiv.org/abs/2512.04388 + +Sakana AI. (2026, June 22). *Sakana Fugu: One model to command them all* [Product and technical release]. https://sakana.ai/fugu-release/ -NVIDIA Corporation. (2026). *API reference—NVIDIA NIM for large language models*. https://docs.nvidia.com/nim/large-language-models/latest/api-reference.html +Sakana AI. (2026, July 24). *Announcing Fugu-Ultra v1.1 and Claude Code interface for Fugu* [Product release update]. https://sakana.ai/fugu-1-1-claude-code-interface/ -Sakana AI. (2026, June 22). *Sakana Fugu: One model to command them all* [Final product release]. https://sakana.ai/fugu-release/ +World Wide Web Consortium. (2024, December 12). *Web Content Accessibility Guidelines (WCAG) 2.2* [W3C Recommendation]. https://www.w3.org/TR/WCAG22/ -World Wide Web Consortium. (2023). *Web Content Accessibility Guidelines (WCAG) 2.2*. https://www.w3.org/TR/WCAG22/ +World Wide Web Consortium. (2025, October 21). *Web Content Accessibility Guidelines 2.2 approved as ISO/IEC international standard*. https://www.w3.org/press-releases/2025/wcag22-iso-pas/ -Xu, J., Koesdwiady, A., Bei, S., Han, Y., Huang, B., Wang, D., Chen, Y., Wang, Z., Wang, P., Li, P., & Ding, Y. (2026). *Rethinking the value of multi-agent workflow: A strong single agent baseline* [Preprint; submitted to ICLR 2026]. arXiv. https://doi.org/10.48550/arXiv.2601.12307 +Xu, J., Koesdwiady, A., Bei, S., Han, Y., Huang, B., Wang, D., Chen, Y., Wang, Z., Wang, P., Li, P., & Ding, Y. (2026). *Rethinking the value of multi-agent workflow: A strong single agent baseline* [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2601.12307 -Xu, J., Sun, Q., Schwendeman, P., Nielsen, S., Cetin, E., & Tang, Y. (2026). *TRINITY: An evolved LLM coordinator* [Conference paper]. International Conference on Learning Representations. https://doi.org/10.48550/arXiv.2512.04695 +Xu, J., Sun, Q., Schwendeman, P., Nielsen, S., Cetin, E., & Tang, Y. (2026). *TRINITY: An evolved LLM coordinator* [ICLR 2026 paper]. https://doi.org/10.48550/arXiv.2512.04695 From 5cd7ae0adbf3da30a65dc8530bd241fd09e4d574 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 13:44:35 +0900 Subject: [PATCH 135/173] docs: align plugin architecture with HTTP and delivery admission --- ARCHITECTURE.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 7fafd908b..8aed35f68 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -107,9 +107,13 @@ Protected main includes: The active #130 stack is deeper than protected main and remains explicitly non-shipped. PR #205 defines host-owned exact HTTPS delivery-origin authority. PR #235 adds Integration-owned PostgreSQL grant persistence and active-installation fencing. PR #241 hardens credential authority and concurrent revocation admission. PR #242 adds an operator-configured Vault KV v2 secret-store adapter that keeps provider plaintext and Vault credentials out of durable LifeOS metadata. PR #243 composes authenticated Vault operator authority, PR #244 composes the hosted Integration runtime over one service-owned PostgreSQL pool, and PR #245 adds the concrete PostgreSQL/default-entrypoint runtime. A hosted acceptance run on an exact #245 ancestor exercised real Vault KV v2 plus migrated Integration-owned PostgreSQL across installation, credential creation and exact replay, installation-revocation fencing, runtime restart, credential revocation, and idempotent cleanup; that retained ancestor evidence is not current-head merge authority. -Draft PR #250 is stacked on #245 and exposes the existing delivery-origin aggregate/store only through exact signed one-time operator grant/read/revoke authority. Its production route verifier now admits only canonical lowercase UUIDv4 delivery-origin collection/item/revoke paths with their exact POST/GET/POST methods. The slice deliberately stops before HTTP delivery-origin transport and outbound networking. +Draft PR #250 is stacked on #245 and composes the existing delivery-origin aggregate/store through exact signed one-time operator grant/read/revoke authority. It deliberately stops before HTTP delivery-origin transport and outbound networking. -Issue #130 remains **Partial**. Protected main does not yet contain this Vault/PostgreSQL/delivery-origin active stack, and no active PR yet supplies complete host-authorized outbound HTTPS. The remaining network boundary requires immutable released/versioned canonical egress authority for connect-time DNS/IP and rebinding controls, redirect/proxy policy, bounded response/time behavior, plus LifeOS-owned delivery attempt/outcome persistence, retry/dead-letter and operator recovery. Durable origin identity is not network authorization. Manifests and stored installations never self-authorize network capabilities. +Draft PR #251 is stacked exactly on #250 and adds real signed delivery-origin HTTP grant/read/revoke transport without adding outbound HTTPS. Its current review line also treats raw-route canonicalization as a shared signed-operator transport invariant: byte-different percent-encoded route aliases must be rejected against the server-observed raw URL/method before decoded route parameters can become HMAC authority. The current hosted verifier is still pending, so this is active-PR source and regression evidence rather than terminal GREEN or shipped truth. + +Draft PR #252 proceeds in parallel from #245 and establishes Integration-owned durable delivery-attempt admission without depending on mutable #250/#251 transport. It introduces opaque `life-os.plugin-delivery-attempt.v1` work identity plus service-owned PostgreSQL migration/store, exact idempotency scope, bounded retry budget metadata, and a durable INSERT-time fence requiring both the exact active origin grant and active installation under matching workspace/user authority. The table intentionally stores no origin copy, credential, request payload, response body, or network authorization. Real PostgreSQL acceptance is committed but the current hosted RED/GREEN verifier is still pending. + +Issue #130 remains **Partial**. Protected main does not yet contain this Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes admission only; worker claim/lease, bounded retry/backoff, append-only sanitized outcomes, dead-letter/pause/resume, per-attempt revocation fencing, operator-visible status and restart/recovery remain successor work. No active LifeOS PR supplies complete host-authorized outbound HTTPS. The network boundary still requires immutable released/versioned canonical egress authority for connect-time DNS/IP and rebinding controls, redirect/proxy policy, bounded response/time behavior and non-leaking failures. Durable origin identity and durable delivery identity are not network authorization. Manifests and stored installations never self-authorize network capabilities. ## 6. AI proposal boundary @@ -178,4 +182,4 @@ LifeOS currently has no psychometric computation service. Future product-owned m The canonical line comprises `AGENTS.md`, this root Architecture, PRD, TRD, ADR index/details, UML/C4 views, logical Data Model, API/event/schema contracts, Security, Threat Model, Privacy/Data Lifecycle, Test Strategy, Operability/recovery, Release/Migration/Rollback/provenance, Standards/Research, Traceability, Documentation Assessment, README, CLAUDE, and CHANGELOG. -Canonical maturity uses only `Implemented on protected main`, `Implemented on active PR`, `Partial`, `Accepted architecture`, `Planned`, `Research only`, `Superseded`, and `Out of scope`. File presence and old green checks do not prove semantic currentness. +Canonical maturity uses only `Implemented on protected main`, `Implemented on active PR`, `Partial`, `Accepted architecture`, `Planned`, `Research only`, `Superseded`, and `Out of scope`. File presence and old green checks do not prove semantic currentness. \ No newline at end of file From 5f7780aa06d752e6dd76e3057bd7f7f874f9dc9b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 13:52:51 +0900 Subject: [PATCH 136/173] docs: trace PostgreSQL replay snapshot semantics --- docs/STANDARDS_TRACEABILITY.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docs/STANDARDS_TRACEABILITY.md b/docs/STANDARDS_TRACEABILITY.md index d7a41f38a..21753ed8f 100644 --- a/docs/STANDARDS_TRACEABILITY.md +++ b/docs/STANDARDS_TRACEABILITY.md @@ -12,6 +12,7 @@ This document records normative/current standards and repository-wide research u | IETF RFC 9700 / BCP 240, *Best Current Practice for OAuth 2.0 Security* | Final Best Current Practice, January 2025 | exact redirect matching, state/PKCE/token and mix-up/open-redirect security posture; unsafe legacy patterns are not copied into Calendar authority | | W3C, *Web Content Accessibility Guidelines (WCAG) 2.2* | W3C Recommendation, latest Recommendation revision December 2024 | keyboard/focus/status/authentication accessibility and browser acceptance expectations | | ISO/IEC 40500:2025, *W3C Web Content Accessibility Guidelines (WCAG) 2.2* | Published international standard, October 2025; identical to the October 2023 WCAG 2.2 text | international-standard traceability for the material UI acceptance baseline; W3C's later WCAG 2.2 Recommendation remains the current web-standard reference | +| PostgreSQL 18, §13.2 *Transaction Isolation* | Current supported PostgreSQL major-version documentation; 18.6 is the current minor release as of August 13, 2026 | Read Committed command-snapshot semantics; `ON CONFLICT DO NOTHING` can suppress an insert because of a concurrent winner not visible to that statement snapshot, so exact replay requiring the winner uses a subsequent bounded read rather than same-statement visibility assumptions | | NIST SP 800-218, *Secure Software Development Framework (SSDF) Version 1.1* | Final, 2022 | secure-development, provenance and vulnerability-prevention practices | | NIST SP 800-218 Rev. 1 / SSDF Version 1.2 | Initial Public Draft published December 17, 2025; public comment closed January 30, 2026; not final as of the September 2026 verification | watch item only; does not replace SSDF 1.1 normative use until NIST publishes a final revision | | NIST AI 100-1, *Artificial Intelligence Risk Management Framework 1.0* | Final, 2023 | AI governance/evidence/risk framing | @@ -35,6 +36,7 @@ The runtime/provider implementation boundary is independently governed by the ca - **UUIDv4 invariant:** RFC 9562 permits UUID version 4 and defines modern UUID representation; LifeOS's choice of opaque random UUIDv4 is a repository architecture decision, not a claim that v4 is universally superior. - **OAuth security:** RFC 9700 remains BCP 240 and requires exact registered redirect matching for redirect-based flows (with its documented native-localhost exception) and rejects unsafe open redirectors. Identity and active Calendar OAuth work bind state/PKCE/redirect/provider/user/workspace evidence accordingly. Issue #129 must not copy browser-login credentials or deployment-global provider credentials into end-user Calendar authority. - **Accessibility:** material PWA journeys target current WCAG 2.2 keyboard/focus/non-color-only/status/authentication requirements. ISO/IEC 40500:2025 adds international-standard traceability but does not justify pinning LifeOS to the older October 2023 text when W3C publishes a newer WCAG 2.2 Recommendation revision. +- **PostgreSQL replay concurrency:** PostgreSQL's current Read Committed documentation explicitly distinguishes statement snapshots and notes that `INSERT ... ON CONFLICT DO NOTHING` can decline an insert because of a concurrent transaction whose effects are not visible to that INSERT snapshot. Active #252 therefore does not assume a same-statement fallback SELECT can always observe the exact idempotency winner; after a no-row conflict it performs a second exact-scope command and validates the returned durable evidence fail closed. - **Secure SDLC:** exact-head CI/security evidence, immutable action pins, least privilege, bounded untrusted input, provenance and root-cause remediation align with final SSDF 1.1. SSDF 1.2 remains an Initial Public Draft at the latest primary-source verification and therefore remains a watch item. - **AI governance:** model output remains untrusted and inert, deterministic authorization/validation is separate, gateway/provider availability is not fabricated as merge success, and retained artifacts exclude secrets/raw prompts/responses/hidden reasoning. - **Test-time compute:** ADR 0012 defines the strong-route baseline and explicit reasoning/stage/decomposition/recursion/role/access-topology dimensions. Fugu/Conductor/TRINITY are research/product evidence for orchestration dimensions, not direct runtime dependencies or provider authority. @@ -64,6 +66,10 @@ National Institute of Standards and Technology. (2024). *Artificial Intelligence Nielsen, S., Cetin, E., Schwendeman, P., Sun, Q., Xu, J., & Tang, Y. (2026). *Learning to orchestrate agents in natural language with the Conductor* [ICLR 2026 paper]. https://arxiv.org/abs/2512.04388 +PostgreSQL Global Development Group. (2026). *PostgreSQL 18 documentation: Transaction isolation*. https://www.postgresql.org/docs/18/transaction-iso.html + +PostgreSQL Global Development Group. (2026, August 13). *PostgreSQL 18.6, 17.11, 16.15, 15.19, 14.24 and 19 Beta 3 released!*. https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released/ + Sakana AI. (2026, June 22). *Sakana Fugu: One model to command them all* [Product and technical release]. https://sakana.ai/fugu-release/ Sakana AI. (2026, July 24). *Announcing Fugu-Ultra v1.1 and Claude Code interface for Fugu* [Product release update]. https://sakana.ai/fugu-1-1-claude-code-interface/ From 3f7d8049d96be4e9ac1a26ee3954e62d11acf830 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 13:53:46 +0900 Subject: [PATCH 137/173] docs: correct PostgreSQL release primary source --- docs/STANDARDS_TRACEABILITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/STANDARDS_TRACEABILITY.md b/docs/STANDARDS_TRACEABILITY.md index 21753ed8f..c2318407b 100644 --- a/docs/STANDARDS_TRACEABILITY.md +++ b/docs/STANDARDS_TRACEABILITY.md @@ -68,7 +68,7 @@ Nielsen, S., Cetin, E., Schwendeman, P., Sun, Q., Xu, J., & Tang, Y. (2026). *Le PostgreSQL Global Development Group. (2026). *PostgreSQL 18 documentation: Transaction isolation*. https://www.postgresql.org/docs/18/transaction-iso.html -PostgreSQL Global Development Group. (2026, August 13). *PostgreSQL 18.6, 17.11, 16.15, 15.19, 14.24 and 19 Beta 3 released!*. https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released/ +PostgreSQL Global Development Group. (2026, August 13). *PostgreSQL 18.6, 17.11, 16.15, 15.19, 14.24 and 19 Beta 3 released!*. https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/ Sakana AI. (2026, June 22). *Sakana Fugu: One model to command them all* [Product and technical release]. https://sakana.ai/fugu-release/ From f61c1d5f07e5c06199de3565612ec7956f7f48af Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 14:21:38 +0900 Subject: [PATCH 138/173] ci(docs): refresh canonical Architecture Integration currentness --- ...l-architecture-integration-currentness.yml | 60 +++++++++++++++++++ 1 file changed, 60 insertions(+) create mode 100644 .github/workflows/refresh-lifeos-canonical-architecture-integration-currentness.yml diff --git a/.github/workflows/refresh-lifeos-canonical-architecture-integration-currentness.yml b/.github/workflows/refresh-lifeos-canonical-architecture-integration-currentness.yml new file mode 100644 index 000000000..fd3fb7614 --- /dev/null +++ b/.github/workflows/refresh-lifeos-canonical-architecture-integration-currentness.yml @@ -0,0 +1,60 @@ +name: Refresh LifeOS canonical architecture Integration currentness + +on: + push: + branches: [docs/canonical-product-architecture-mainline] + +permissions: + contents: write + +concurrency: + group: refresh-lifeos-canonical-architecture-integration-currentness-${{ github.ref }} + cancel-in-progress: true + +jobs: + refresh-and-retire: + runs-on: ubuntu-24.04 + timeout-minutes: 10 + steps: + - name: Checkout exact canonical documentation head + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + ref: ${{ github.sha }} + fetch-depth: 0 + + - name: Refresh bounded Plugin Integration transport evidence + shell: bash + run: | + set -euo pipefail + python3 - <<'PY' + from pathlib import Path + path = Path('ARCHITECTURE.md') + text = path.read_text(encoding='utf-8') + start_marker = 'Draft PR #251 is stacked exactly on #250 and adds real signed delivery-origin HTTP grant/read/revoke transport without adding outbound HTTPS.' + end_marker = '\n\nDraft PR #252 proceeds in parallel from #245' + if text.count(start_marker) != 1 or text.count(end_marker) != 1: + raise SystemExit('canonical Architecture #251 markers are not unique') + start = text.index(start_marker) + end = text.index(end_marker, start) + replacement = 'Draft PR #251 is stacked exactly on #250 and retains the signed delivery-origin HTTP grant/read/revoke transport at `5641005c5ed0193b6206848f9c4c807050271ef7` without adding outbound HTTPS. Hosted verifier run `34186936889`, job `101937064591`, first proved the exact #250 parent lacks the routes and then proved the pre-repair percent-encoded raw-route/HMAC canonicalization defect. The minimum transport repair compares the server-observed raw method and URL byte-for-byte with each canonical signed plugin-operator route before decoded parameters can reach durable authority. Focused real-HTTP GREEN passed 2 files / 4 tests, Integration typecheck passed, and the complete Integration suite passed 59 files / 376 tests with 5 files / 17 environment-dependent tests skipped. The successful run ordinary-pushed the retained repair and removed only its purpose-complete verifier. This is active-PR evidence only: it is neither protected-main shipped truth nor independent review/security merge authority.' + path.write_text(text[:start] + replacement + text[end:], encoding='utf-8') + PY + git diff --check + + - name: Publish architecture refresh and retire writer + shell: bash + env: + TARGET_BRANCH: docs/canonical-product-architecture-mainline + run: | + set -euo pipefail + git fetch origin "refs/heads/${TARGET_BRANCH}:refs/remotes/origin/${TARGET_BRANCH}" + test "$(git rev-parse "refs/remotes/origin/${TARGET_BRANCH}")" = "${GITHUB_SHA}" + git add ARCHITECTURE.md + git rm .github/workflows/refresh-lifeos-canonical-architecture-integration-currentness.yml + actual="$(git diff --cached --name-only | sort)" + expected="$(printf '%s\n' '.github/workflows/refresh-lifeos-canonical-architecture-integration-currentness.yml' 'ARCHITECTURE.md' | sort)" + test "${actual}" = "${expected}" + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git commit -m "docs(architecture): refresh Integration transport evidence" + git push origin "HEAD:refs/heads/${TARGET_BRANCH}" From 0c150f7d20d525b077356d25c0949bc1788c561c Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 8 Sep 2026 05:43:45 +0000 Subject: [PATCH 139/173] docs(architecture): refresh Integration transport evidence --- ...l-architecture-integration-currentness.yml | 60 ------------------- ARCHITECTURE.md | 2 +- 2 files changed, 1 insertion(+), 61 deletions(-) delete mode 100644 .github/workflows/refresh-lifeos-canonical-architecture-integration-currentness.yml diff --git a/.github/workflows/refresh-lifeos-canonical-architecture-integration-currentness.yml b/.github/workflows/refresh-lifeos-canonical-architecture-integration-currentness.yml deleted file mode 100644 index fd3fb7614..000000000 --- a/.github/workflows/refresh-lifeos-canonical-architecture-integration-currentness.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Refresh LifeOS canonical architecture Integration currentness - -on: - push: - branches: [docs/canonical-product-architecture-mainline] - -permissions: - contents: write - -concurrency: - group: refresh-lifeos-canonical-architecture-integration-currentness-${{ github.ref }} - cancel-in-progress: true - -jobs: - refresh-and-retire: - runs-on: ubuntu-24.04 - timeout-minutes: 10 - steps: - - name: Checkout exact canonical documentation head - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - with: - ref: ${{ github.sha }} - fetch-depth: 0 - - - name: Refresh bounded Plugin Integration transport evidence - shell: bash - run: | - set -euo pipefail - python3 - <<'PY' - from pathlib import Path - path = Path('ARCHITECTURE.md') - text = path.read_text(encoding='utf-8') - start_marker = 'Draft PR #251 is stacked exactly on #250 and adds real signed delivery-origin HTTP grant/read/revoke transport without adding outbound HTTPS.' - end_marker = '\n\nDraft PR #252 proceeds in parallel from #245' - if text.count(start_marker) != 1 or text.count(end_marker) != 1: - raise SystemExit('canonical Architecture #251 markers are not unique') - start = text.index(start_marker) - end = text.index(end_marker, start) - replacement = 'Draft PR #251 is stacked exactly on #250 and retains the signed delivery-origin HTTP grant/read/revoke transport at `5641005c5ed0193b6206848f9c4c807050271ef7` without adding outbound HTTPS. Hosted verifier run `34186936889`, job `101937064591`, first proved the exact #250 parent lacks the routes and then proved the pre-repair percent-encoded raw-route/HMAC canonicalization defect. The minimum transport repair compares the server-observed raw method and URL byte-for-byte with each canonical signed plugin-operator route before decoded parameters can reach durable authority. Focused real-HTTP GREEN passed 2 files / 4 tests, Integration typecheck passed, and the complete Integration suite passed 59 files / 376 tests with 5 files / 17 environment-dependent tests skipped. The successful run ordinary-pushed the retained repair and removed only its purpose-complete verifier. This is active-PR evidence only: it is neither protected-main shipped truth nor independent review/security merge authority.' - path.write_text(text[:start] + replacement + text[end:], encoding='utf-8') - PY - git diff --check - - - name: Publish architecture refresh and retire writer - shell: bash - env: - TARGET_BRANCH: docs/canonical-product-architecture-mainline - run: | - set -euo pipefail - git fetch origin "refs/heads/${TARGET_BRANCH}:refs/remotes/origin/${TARGET_BRANCH}" - test "$(git rev-parse "refs/remotes/origin/${TARGET_BRANCH}")" = "${GITHUB_SHA}" - git add ARCHITECTURE.md - git rm .github/workflows/refresh-lifeos-canonical-architecture-integration-currentness.yml - actual="$(git diff --cached --name-only | sort)" - expected="$(printf '%s\n' '.github/workflows/refresh-lifeos-canonical-architecture-integration-currentness.yml' 'ARCHITECTURE.md' | sort)" - test "${actual}" = "${expected}" - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - git commit -m "docs(architecture): refresh Integration transport evidence" - git push origin "HEAD:refs/heads/${TARGET_BRANCH}" diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 8aed35f68..01da30293 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -109,7 +109,7 @@ The active #130 stack is deeper than protected main and remains explicitly non-s Draft PR #250 is stacked on #245 and composes the existing delivery-origin aggregate/store through exact signed one-time operator grant/read/revoke authority. It deliberately stops before HTTP delivery-origin transport and outbound networking. -Draft PR #251 is stacked exactly on #250 and adds real signed delivery-origin HTTP grant/read/revoke transport without adding outbound HTTPS. Its current review line also treats raw-route canonicalization as a shared signed-operator transport invariant: byte-different percent-encoded route aliases must be rejected against the server-observed raw URL/method before decoded route parameters can become HMAC authority. The current hosted verifier is still pending, so this is active-PR source and regression evidence rather than terminal GREEN or shipped truth. +Draft PR #251 is stacked exactly on #250 and retains the signed delivery-origin HTTP grant/read/revoke transport at `5641005c5ed0193b6206848f9c4c807050271ef7` without adding outbound HTTPS. Hosted verifier run `34186936889`, job `101937064591`, first proved the exact #250 parent lacks the routes and then proved the pre-repair percent-encoded raw-route/HMAC canonicalization defect. The minimum transport repair compares the server-observed raw method and URL byte-for-byte with each canonical signed plugin-operator route before decoded parameters can reach durable authority. Focused real-HTTP GREEN passed 2 files / 4 tests, Integration typecheck passed, and the complete Integration suite passed 59 files / 376 tests with 5 files / 17 environment-dependent tests skipped. The successful run ordinary-pushed the retained repair and removed only its purpose-complete verifier. This is active-PR evidence only: it is neither protected-main shipped truth nor independent review/security merge authority. Draft PR #252 proceeds in parallel from #245 and establishes Integration-owned durable delivery-attempt admission without depending on mutable #250/#251 transport. It introduces opaque `life-os.plugin-delivery-attempt.v1` work identity plus service-owned PostgreSQL migration/store, exact idempotency scope, bounded retry budget metadata, and a durable INSERT-time fence requiring both the exact active origin grant and active installation under matching workspace/user authority. The table intentionally stores no origin copy, credential, request payload, response body, or network authorization. Real PostgreSQL acceptance is committed but the current hosted RED/GREEN verifier is still pending. From 4c968e722d9e78ca3c7fc4b9ffc3c1fccf41649c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 18:44:54 +0900 Subject: [PATCH 140/173] chore(actions): add bounded architecture currentness writer --- ...rchitecture-plugin-attempt-currentness.yml | 54 +++++++++++++++++++ 1 file changed, 54 insertions(+) create mode 100644 .github/workflows/repair-architecture-plugin-attempt-currentness.yml diff --git a/.github/workflows/repair-architecture-plugin-attempt-currentness.yml b/.github/workflows/repair-architecture-plugin-attempt-currentness.yml new file mode 100644 index 000000000..41bc58489 --- /dev/null +++ b/.github/workflows/repair-architecture-plugin-attempt-currentness.yml @@ -0,0 +1,54 @@ +name: Repair Architecture Plugin Attempt Currentness + +on: + push: + branches: [docs/canonical-product-architecture-mainline] + +permissions: + contents: write + +concurrency: + group: repair-architecture-plugin-attempt-currentness + cancel-in-progress: false + +jobs: + repair: + runs-on: ubuntu-24.04 + timeout-minutes: 10 + steps: + - name: Checkout exact architecture head + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + ref: ${{ github.sha }} + fetch-depth: 0 + + - name: Replace only stale delivery-attempt evidence sentence + shell: bash + run: | + set -euo pipefail + python - <<'PY' + from pathlib import Path + + path = Path('ARCHITECTURE.md') + text = path.read_text() + old = ('Draft PR #252 proceeds in parallel from #245 and establishes Integration-owned durable delivery-attempt admission without depending on mutable #250/#251 transport. It introduces opaque `life-os.plugin-delivery-attempt.v1` work identity plus service-owned PostgreSQL migration/store, exact idempotency scope, bounded retry budget metadata, and a durable INSERT-time fence requiring both the exact active origin grant and active installation under matching workspace/user authority. The table intentionally stores no origin copy, credential, request payload, response body, or network authorization. Real PostgreSQL acceptance is committed but the current hosted RED/GREEN verifier is still pending.') + new = ('Draft PR #252 proceeds in parallel from #245 and establishes Integration-owned durable delivery-attempt admission without depending on mutable #250/#251 transport. It introduces opaque `life-os.plugin-delivery-attempt.v1` work identity plus service-owned PostgreSQL migration/store, exact idempotency scope, bounded retry budget metadata, and a durable INSERT-time fence requiring both the exact active origin grant and active installation under matching workspace/user authority. The table intentionally stores no origin copy, credential, request payload, response body, or network authorization. Exact review-repair proof head `9e6e88e49e14d0b2d247e747df968e2494697666` completed hosted run `34209314512`, job `102006262067`, GREEN on Ubuntu 24.04/PostgreSQL 16 after replaying the timestamp, PostgreSQL/TLS target, IPv6 loopback and table-contract RED ancestors for their intended reasons, passing focused delivery-attempt acceptance, Integration typecheck and the complete Integration suite. Current #252 head `cbb3caaddf3ad8d84ef27a6c7ba9aa624bed972a` removes only that purpose-complete verifier; this remains active-PR evidence, not protected shipped truth.') + if text.count(old) != 1: + raise SystemExit(f'expected exactly one stale #252 architecture paragraph, found {text.count(old)}') + path.write_text(text.replace(old, new, 1)) + PY + rm .github/workflows/repair-architecture-plugin-attempt-currentness.yml + git diff --check + changed="$(git diff --name-only | sort)" + expected="$(printf '%s\n' '.github/workflows/repair-architecture-plugin-attempt-currentness.yml' 'ARCHITECTURE.md' | sort)" + test "${changed}" = "${expected}" + + - name: Publish preservation-safe architecture repair + shell: bash + run: | + set -euo pipefail + git config user.name 'github-actions[bot]' + git config user.email '41898282+github-actions[bot]@users.noreply.github.com' + git add ARCHITECTURE.md .github/workflows/repair-architecture-plugin-attempt-currentness.yml + git commit -m 'docs: refresh plugin attempt architecture evidence' + git push origin HEAD:docs/canonical-product-architecture-mainline From 1bc7ef4ac49ca5c0378377644720ac50b0298cc6 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 8 Sep 2026 09:48:16 +0000 Subject: [PATCH 141/173] docs: refresh plugin attempt architecture evidence --- ...rchitecture-plugin-attempt-currentness.yml | 54 ------------------- ARCHITECTURE.md | 2 +- 2 files changed, 1 insertion(+), 55 deletions(-) delete mode 100644 .github/workflows/repair-architecture-plugin-attempt-currentness.yml diff --git a/.github/workflows/repair-architecture-plugin-attempt-currentness.yml b/.github/workflows/repair-architecture-plugin-attempt-currentness.yml deleted file mode 100644 index 41bc58489..000000000 --- a/.github/workflows/repair-architecture-plugin-attempt-currentness.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: Repair Architecture Plugin Attempt Currentness - -on: - push: - branches: [docs/canonical-product-architecture-mainline] - -permissions: - contents: write - -concurrency: - group: repair-architecture-plugin-attempt-currentness - cancel-in-progress: false - -jobs: - repair: - runs-on: ubuntu-24.04 - timeout-minutes: 10 - steps: - - name: Checkout exact architecture head - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - with: - ref: ${{ github.sha }} - fetch-depth: 0 - - - name: Replace only stale delivery-attempt evidence sentence - shell: bash - run: | - set -euo pipefail - python - <<'PY' - from pathlib import Path - - path = Path('ARCHITECTURE.md') - text = path.read_text() - old = ('Draft PR #252 proceeds in parallel from #245 and establishes Integration-owned durable delivery-attempt admission without depending on mutable #250/#251 transport. It introduces opaque `life-os.plugin-delivery-attempt.v1` work identity plus service-owned PostgreSQL migration/store, exact idempotency scope, bounded retry budget metadata, and a durable INSERT-time fence requiring both the exact active origin grant and active installation under matching workspace/user authority. The table intentionally stores no origin copy, credential, request payload, response body, or network authorization. Real PostgreSQL acceptance is committed but the current hosted RED/GREEN verifier is still pending.') - new = ('Draft PR #252 proceeds in parallel from #245 and establishes Integration-owned durable delivery-attempt admission without depending on mutable #250/#251 transport. It introduces opaque `life-os.plugin-delivery-attempt.v1` work identity plus service-owned PostgreSQL migration/store, exact idempotency scope, bounded retry budget metadata, and a durable INSERT-time fence requiring both the exact active origin grant and active installation under matching workspace/user authority. The table intentionally stores no origin copy, credential, request payload, response body, or network authorization. Exact review-repair proof head `9e6e88e49e14d0b2d247e747df968e2494697666` completed hosted run `34209314512`, job `102006262067`, GREEN on Ubuntu 24.04/PostgreSQL 16 after replaying the timestamp, PostgreSQL/TLS target, IPv6 loopback and table-contract RED ancestors for their intended reasons, passing focused delivery-attempt acceptance, Integration typecheck and the complete Integration suite. Current #252 head `cbb3caaddf3ad8d84ef27a6c7ba9aa624bed972a` removes only that purpose-complete verifier; this remains active-PR evidence, not protected shipped truth.') - if text.count(old) != 1: - raise SystemExit(f'expected exactly one stale #252 architecture paragraph, found {text.count(old)}') - path.write_text(text.replace(old, new, 1)) - PY - rm .github/workflows/repair-architecture-plugin-attempt-currentness.yml - git diff --check - changed="$(git diff --name-only | sort)" - expected="$(printf '%s\n' '.github/workflows/repair-architecture-plugin-attempt-currentness.yml' 'ARCHITECTURE.md' | sort)" - test "${changed}" = "${expected}" - - - name: Publish preservation-safe architecture repair - shell: bash - run: | - set -euo pipefail - git config user.name 'github-actions[bot]' - git config user.email '41898282+github-actions[bot]@users.noreply.github.com' - git add ARCHITECTURE.md .github/workflows/repair-architecture-plugin-attempt-currentness.yml - git commit -m 'docs: refresh plugin attempt architecture evidence' - git push origin HEAD:docs/canonical-product-architecture-mainline diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 01da30293..4ae952c50 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -111,7 +111,7 @@ Draft PR #250 is stacked on #245 and composes the existing delivery-origin aggre Draft PR #251 is stacked exactly on #250 and retains the signed delivery-origin HTTP grant/read/revoke transport at `5641005c5ed0193b6206848f9c4c807050271ef7` without adding outbound HTTPS. Hosted verifier run `34186936889`, job `101937064591`, first proved the exact #250 parent lacks the routes and then proved the pre-repair percent-encoded raw-route/HMAC canonicalization defect. The minimum transport repair compares the server-observed raw method and URL byte-for-byte with each canonical signed plugin-operator route before decoded parameters can reach durable authority. Focused real-HTTP GREEN passed 2 files / 4 tests, Integration typecheck passed, and the complete Integration suite passed 59 files / 376 tests with 5 files / 17 environment-dependent tests skipped. The successful run ordinary-pushed the retained repair and removed only its purpose-complete verifier. This is active-PR evidence only: it is neither protected-main shipped truth nor independent review/security merge authority. -Draft PR #252 proceeds in parallel from #245 and establishes Integration-owned durable delivery-attempt admission without depending on mutable #250/#251 transport. It introduces opaque `life-os.plugin-delivery-attempt.v1` work identity plus service-owned PostgreSQL migration/store, exact idempotency scope, bounded retry budget metadata, and a durable INSERT-time fence requiring both the exact active origin grant and active installation under matching workspace/user authority. The table intentionally stores no origin copy, credential, request payload, response body, or network authorization. Real PostgreSQL acceptance is committed but the current hosted RED/GREEN verifier is still pending. +Draft PR #252 proceeds in parallel from #245 and establishes Integration-owned durable delivery-attempt admission without depending on mutable #250/#251 transport. It introduces opaque `life-os.plugin-delivery-attempt.v1` work identity plus service-owned PostgreSQL migration/store, exact idempotency scope, bounded retry budget metadata, and a durable INSERT-time fence requiring both the exact active origin grant and active installation under matching workspace/user authority. The table intentionally stores no origin copy, credential, request payload, response body, or network authorization. Exact review-repair proof head `9e6e88e49e14d0b2d247e747df968e2494697666` completed hosted run `34209314512`, job `102006262067`, GREEN on Ubuntu 24.04/PostgreSQL 16 after replaying the timestamp, PostgreSQL/TLS target, IPv6 loopback and table-contract RED ancestors for their intended reasons, passing focused delivery-attempt acceptance, Integration typecheck and the complete Integration suite. Current #252 head `cbb3caaddf3ad8d84ef27a6c7ba9aa624bed972a` removes only that purpose-complete verifier; this remains active-PR evidence, not protected shipped truth. Issue #130 remains **Partial**. Protected main does not yet contain this Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes admission only; worker claim/lease, bounded retry/backoff, append-only sanitized outcomes, dead-letter/pause/resume, per-attempt revocation fencing, operator-visible status and restart/recovery remain successor work. No active LifeOS PR supplies complete host-authorized outbound HTTPS. The network boundary still requires immutable released/versioned canonical egress authority for connect-time DNS/IP and rebinding controls, redirect/proxy policy, bounded response/time behavior and non-leaking failures. Durable origin identity and durable delivery identity are not network authorization. Manifests and stored installations never self-authorize network capabilities. From 24cbe7fa68ccf61886d19d1058d28097a04e055a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 19:17:36 +0900 Subject: [PATCH 142/173] ci(docs): refresh plugin SQL architecture evidence --- ...epair-architecture-plugin-sql-evidence.yml | 68 +++++++++++++++++++ 1 file changed, 68 insertions(+) create mode 100644 .github/workflows/repair-architecture-plugin-sql-evidence.yml diff --git a/.github/workflows/repair-architecture-plugin-sql-evidence.yml b/.github/workflows/repair-architecture-plugin-sql-evidence.yml new file mode 100644 index 000000000..2867f0ec7 --- /dev/null +++ b/.github/workflows/repair-architecture-plugin-sql-evidence.yml @@ -0,0 +1,68 @@ +name: Repair Architecture Plugin SQL Evidence + +on: + push: + branches: [docs/canonical-product-architecture-mainline] + +permissions: + contents: write + +concurrency: + group: repair-architecture-plugin-sql-evidence + cancel-in-progress: true + +jobs: + repair: + runs-on: ubuntu-24.04 + timeout-minutes: 10 + steps: + - name: Checkout exact writer head + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + ref: ${{ github.sha }} + fetch-depth: 0 + + - name: Replace only the active #252 Architecture paragraph + shell: bash + run: | + set -euo pipefail + python - <<'PY' + from pathlib import Path + + path = Path('ARCHITECTURE.md') + text = path.read_text() + start = 'Draft PR #252 proceeds in parallel from #245 and establishes Integration-owned durable delivery-attempt admission without depending on mutable #250/#251 transport.' + end = '\n\nIssue #130 remains **Partial**.' + if text.count(start) != 1: + raise SystemExit(f'expected exactly one #252 Architecture paragraph, found {text.count(start)}') + start_index = text.index(start) + end_index = text.index(end, start_index) + replacement = '''Draft PR #252 proceeds in parallel from #245 and establishes Integration-owned durable delivery-attempt admission without depending on mutable #250/#251 transport. It introduces opaque `life-os.plugin-delivery-attempt.v1` work identity plus service-owned PostgreSQL migration/store, exact idempotency scope, bounded retry budget metadata, and a durable INSERT-time fence requiring both the exact active origin grant and active installation under matching workspace/user authority. The table intentionally stores no origin copy, credential, request payload, response body, or network authorization. Exact review-repair proof head `9e6e88e49e14d0b2d247e747df968e2494697666` completed hosted run `34209314512`, job `102006262067`, GREEN on Ubuntu 24.04/PostgreSQL 16 after replaying the timestamp, PostgreSQL/TLS target, IPv6 loopback and table-contract RED ancestors for their intended reasons. A subsequent repository-boundary review found that SQL result envelopes, durable row getters and stored timestamp conversion could throw native dependency detail before the fixed persistence-evidence boundary. Reality RED `b390f37ed651ce2d9cb74d862fbae02641f3a55f` demonstrates that hostile evidence leak; minimum repair `e9a8b212b24b4914069a48a113d118ff4e4c0a56` snapshots and bounds those evidence reads without changing SQL/schema/admission authority. Exact proof head `ec2353a003c15c9f464b5d5d2454d3593427d768`, run `34213508199`, job `102019765395`, completed GREEN with the focused delivery-attempt suite 24/24, Integration typecheck and the complete Integration suite 403 passed / 3 environment-dependent skipped across 65 files. CHANGELOG descendant `fe51a79c1e19cc7fb14e5296f04b3f91b41bf535` also completed exact run `34213937828` / job `102021136219` GREEN. Current #252 head `9ed7847d3106d9418e1ff6e04e45c1c7d84d0b0d` removes only the purpose-complete hostile-SQL verifier. This remains active-PR evidence, not protected shipped truth.''' + path.write_text(text[:start_index] + replacement + text[end_index:]) + PY + + - name: Verify exact writer lease and diff hygiene + shell: bash + run: | + set -euo pipefail + git fetch origin docs/canonical-product-architecture-mainline + test "$(git rev-parse origin/docs/canonical-product-architecture-mainline)" = "${GITHUB_SHA}" + git diff --check + git diff -- ARCHITECTURE.md + + - name: Publish bounded source repair and retire writer + shell: bash + run: | + set -euo pipefail + rm .github/workflows/repair-architecture-plugin-sql-evidence.yml + git config user.name "LifeOS Architecture Writer" + git config user.email "actions@users.noreply.github.com" + git add ARCHITECTURE.md .github/workflows/repair-architecture-plugin-sql-evidence.yml + if git diff --cached --quiet; then + echo "No bounded Architecture repair to publish" >&2 + exit 1 + fi + git commit -m "docs: refresh plugin SQL architecture evidence" + git fetch origin docs/canonical-product-architecture-mainline + test "$(git rev-parse origin/docs/canonical-product-architecture-mainline)" = "${GITHUB_SHA}" + git push origin HEAD:docs/canonical-product-architecture-mainline From a412b4ac9a91b4c64c714815528afdf5c4a9864a Mon Sep 17 00:00:00 2001 From: LifeOS Architecture Writer Date: Tue, 8 Sep 2026 10:22:04 +0000 Subject: [PATCH 143/173] docs: refresh plugin SQL architecture evidence --- ...epair-architecture-plugin-sql-evidence.yml | 68 ------------------- ARCHITECTURE.md | 2 +- 2 files changed, 1 insertion(+), 69 deletions(-) delete mode 100644 .github/workflows/repair-architecture-plugin-sql-evidence.yml diff --git a/.github/workflows/repair-architecture-plugin-sql-evidence.yml b/.github/workflows/repair-architecture-plugin-sql-evidence.yml deleted file mode 100644 index 2867f0ec7..000000000 --- a/.github/workflows/repair-architecture-plugin-sql-evidence.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Repair Architecture Plugin SQL Evidence - -on: - push: - branches: [docs/canonical-product-architecture-mainline] - -permissions: - contents: write - -concurrency: - group: repair-architecture-plugin-sql-evidence - cancel-in-progress: true - -jobs: - repair: - runs-on: ubuntu-24.04 - timeout-minutes: 10 - steps: - - name: Checkout exact writer head - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - with: - ref: ${{ github.sha }} - fetch-depth: 0 - - - name: Replace only the active #252 Architecture paragraph - shell: bash - run: | - set -euo pipefail - python - <<'PY' - from pathlib import Path - - path = Path('ARCHITECTURE.md') - text = path.read_text() - start = 'Draft PR #252 proceeds in parallel from #245 and establishes Integration-owned durable delivery-attempt admission without depending on mutable #250/#251 transport.' - end = '\n\nIssue #130 remains **Partial**.' - if text.count(start) != 1: - raise SystemExit(f'expected exactly one #252 Architecture paragraph, found {text.count(start)}') - start_index = text.index(start) - end_index = text.index(end, start_index) - replacement = '''Draft PR #252 proceeds in parallel from #245 and establishes Integration-owned durable delivery-attempt admission without depending on mutable #250/#251 transport. It introduces opaque `life-os.plugin-delivery-attempt.v1` work identity plus service-owned PostgreSQL migration/store, exact idempotency scope, bounded retry budget metadata, and a durable INSERT-time fence requiring both the exact active origin grant and active installation under matching workspace/user authority. The table intentionally stores no origin copy, credential, request payload, response body, or network authorization. Exact review-repair proof head `9e6e88e49e14d0b2d247e747df968e2494697666` completed hosted run `34209314512`, job `102006262067`, GREEN on Ubuntu 24.04/PostgreSQL 16 after replaying the timestamp, PostgreSQL/TLS target, IPv6 loopback and table-contract RED ancestors for their intended reasons. A subsequent repository-boundary review found that SQL result envelopes, durable row getters and stored timestamp conversion could throw native dependency detail before the fixed persistence-evidence boundary. Reality RED `b390f37ed651ce2d9cb74d862fbae02641f3a55f` demonstrates that hostile evidence leak; minimum repair `e9a8b212b24b4914069a48a113d118ff4e4c0a56` snapshots and bounds those evidence reads without changing SQL/schema/admission authority. Exact proof head `ec2353a003c15c9f464b5d5d2454d3593427d768`, run `34213508199`, job `102019765395`, completed GREEN with the focused delivery-attempt suite 24/24, Integration typecheck and the complete Integration suite 403 passed / 3 environment-dependent skipped across 65 files. CHANGELOG descendant `fe51a79c1e19cc7fb14e5296f04b3f91b41bf535` also completed exact run `34213937828` / job `102021136219` GREEN. Current #252 head `9ed7847d3106d9418e1ff6e04e45c1c7d84d0b0d` removes only the purpose-complete hostile-SQL verifier. This remains active-PR evidence, not protected shipped truth.''' - path.write_text(text[:start_index] + replacement + text[end_index:]) - PY - - - name: Verify exact writer lease and diff hygiene - shell: bash - run: | - set -euo pipefail - git fetch origin docs/canonical-product-architecture-mainline - test "$(git rev-parse origin/docs/canonical-product-architecture-mainline)" = "${GITHUB_SHA}" - git diff --check - git diff -- ARCHITECTURE.md - - - name: Publish bounded source repair and retire writer - shell: bash - run: | - set -euo pipefail - rm .github/workflows/repair-architecture-plugin-sql-evidence.yml - git config user.name "LifeOS Architecture Writer" - git config user.email "actions@users.noreply.github.com" - git add ARCHITECTURE.md .github/workflows/repair-architecture-plugin-sql-evidence.yml - if git diff --cached --quiet; then - echo "No bounded Architecture repair to publish" >&2 - exit 1 - fi - git commit -m "docs: refresh plugin SQL architecture evidence" - git fetch origin docs/canonical-product-architecture-mainline - test "$(git rev-parse origin/docs/canonical-product-architecture-mainline)" = "${GITHUB_SHA}" - git push origin HEAD:docs/canonical-product-architecture-mainline diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 4ae952c50..9c02f2af6 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -111,7 +111,7 @@ Draft PR #250 is stacked on #245 and composes the existing delivery-origin aggre Draft PR #251 is stacked exactly on #250 and retains the signed delivery-origin HTTP grant/read/revoke transport at `5641005c5ed0193b6206848f9c4c807050271ef7` without adding outbound HTTPS. Hosted verifier run `34186936889`, job `101937064591`, first proved the exact #250 parent lacks the routes and then proved the pre-repair percent-encoded raw-route/HMAC canonicalization defect. The minimum transport repair compares the server-observed raw method and URL byte-for-byte with each canonical signed plugin-operator route before decoded parameters can reach durable authority. Focused real-HTTP GREEN passed 2 files / 4 tests, Integration typecheck passed, and the complete Integration suite passed 59 files / 376 tests with 5 files / 17 environment-dependent tests skipped. The successful run ordinary-pushed the retained repair and removed only its purpose-complete verifier. This is active-PR evidence only: it is neither protected-main shipped truth nor independent review/security merge authority. -Draft PR #252 proceeds in parallel from #245 and establishes Integration-owned durable delivery-attempt admission without depending on mutable #250/#251 transport. It introduces opaque `life-os.plugin-delivery-attempt.v1` work identity plus service-owned PostgreSQL migration/store, exact idempotency scope, bounded retry budget metadata, and a durable INSERT-time fence requiring both the exact active origin grant and active installation under matching workspace/user authority. The table intentionally stores no origin copy, credential, request payload, response body, or network authorization. Exact review-repair proof head `9e6e88e49e14d0b2d247e747df968e2494697666` completed hosted run `34209314512`, job `102006262067`, GREEN on Ubuntu 24.04/PostgreSQL 16 after replaying the timestamp, PostgreSQL/TLS target, IPv6 loopback and table-contract RED ancestors for their intended reasons, passing focused delivery-attempt acceptance, Integration typecheck and the complete Integration suite. Current #252 head `cbb3caaddf3ad8d84ef27a6c7ba9aa624bed972a` removes only that purpose-complete verifier; this remains active-PR evidence, not protected shipped truth. +Draft PR #252 proceeds in parallel from #245 and establishes Integration-owned durable delivery-attempt admission without depending on mutable #250/#251 transport. It introduces opaque `life-os.plugin-delivery-attempt.v1` work identity plus service-owned PostgreSQL migration/store, exact idempotency scope, bounded retry budget metadata, and a durable INSERT-time fence requiring both the exact active origin grant and active installation under matching workspace/user authority. The table intentionally stores no origin copy, credential, request payload, response body, or network authorization. Exact review-repair proof head `9e6e88e49e14d0b2d247e747df968e2494697666` completed hosted run `34209314512`, job `102006262067`, GREEN on Ubuntu 24.04/PostgreSQL 16 after replaying the timestamp, PostgreSQL/TLS target, IPv6 loopback and table-contract RED ancestors for their intended reasons. A subsequent repository-boundary review found that SQL result envelopes, durable row getters and stored timestamp conversion could throw native dependency detail before the fixed persistence-evidence boundary. Reality RED `b390f37ed651ce2d9cb74d862fbae02641f3a55f` demonstrates that hostile evidence leak; minimum repair `e9a8b212b24b4914069a48a113d118ff4e4c0a56` snapshots and bounds those evidence reads without changing SQL/schema/admission authority. Exact proof head `ec2353a003c15c9f464b5d5d2454d3593427d768`, run `34213508199`, job `102019765395`, completed GREEN with the focused delivery-attempt suite 24/24, Integration typecheck and the complete Integration suite 403 passed / 3 environment-dependent skipped across 65 files. CHANGELOG descendant `fe51a79c1e19cc7fb14e5296f04b3f91b41bf535` also completed exact run `34213937828` / job `102021136219` GREEN. Current #252 head `9ed7847d3106d9418e1ff6e04e45c1c7d84d0b0d` removes only the purpose-complete hostile-SQL verifier. This remains active-PR evidence, not protected shipped truth. Issue #130 remains **Partial**. Protected main does not yet contain this Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes admission only; worker claim/lease, bounded retry/backoff, append-only sanitized outcomes, dead-letter/pause/resume, per-attempt revocation fencing, operator-visible status and restart/recovery remain successor work. No active LifeOS PR supplies complete host-authorized outbound HTTPS. The network boundary still requires immutable released/versioned canonical egress authority for connect-time DNS/IP and rebinding controls, redirect/proxy policy, bounded response/time behavior and non-leaking failures. Durable origin identity and durable delivery identity are not network authorization. Manifests and stored installations never self-authorize network capabilities. From aed3271d2cfade69bd101605d92495900934b310 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 20:09:36 +0900 Subject: [PATCH 144/173] ci(docs): publish architecture claim lease currentness --- .../write-architecture-plugin-claim-lease.yml | 45 +++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 .github/workflows/write-architecture-plugin-claim-lease.yml diff --git a/.github/workflows/write-architecture-plugin-claim-lease.yml b/.github/workflows/write-architecture-plugin-claim-lease.yml new file mode 100644 index 000000000..526727ad6 --- /dev/null +++ b/.github/workflows/write-architecture-plugin-claim-lease.yml @@ -0,0 +1,45 @@ +name: Write Architecture Plugin Claim Lease + +on: + push: + branches: + - docs/canonical-product-architecture-mainline + +permissions: + contents: write + +jobs: + write: + runs-on: ubuntu-24.04 + timeout-minutes: 10 + steps: + - name: Checkout exact writer input + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 + with: + ref: ${{ github.sha }} + fetch-depth: 0 + + - name: Publish bounded architecture insertion + shell: bash + env: + PARAGRAPH_B64: RHJhZnQgUFIgIzI1MyBpcyB0aGUgZGlyZWN0IGNoaWxkIG9mICMyNTIgYW5kIGVzdGFibGlzaGVzIGRldGVybWluaXN0aWMgSW50ZWdyYXRpb24tb3duZWQgZGVsaXZlcnktYXR0ZW1wdCBjbGFpbS9sZWFzZSBhdXRob3JpdHkgd2l0aG91dCBhZGRpbmcgcHJvdmlkZXIgZXhlY3V0aW9uIG9yIG91dGJvdW5kIEhUVFBTLiBgbGlmZS1vcy5wbHVnaW4tZGVsaXZlcnktYXR0ZW1wdC1jbGFpbS52MWAgcmV0dXJucyBhbiBvcGFxdWUgVVVJRHY0IGNsYWltIHRva2VuIG9ubHkgdG8gdGhlIHdvcmtlciB3aGlsZSBwZXJzaXN0ZW5jZSByZXRhaW5zIG9ubHkgaXRzIFNIQS0yNTYgZGlnZXN0LCBleGFjdCBjbGFpbSBzdGFydC9leHBpcnkgZXZpZGVuY2UgYW5kIHRoZSBhdG9taWMgcmV0cnktYnVkZ2V0IHRyYW5zaXRpb24uIEFwcGxpY2F0aW9uIGFuZCByZXBvc2l0b3J5IHZhbGlkYXRpb24gYm91bmQgYSBsZWFzZSB0byAzMOKAkzM2MDAgc2Vjb25kcy4gQSBkdXJhYmxlLWJvdW5kIHJldmlldyBmb3VuZCBtaWdyYXRpb24gYDAwMDdfcGx1Z2luX2RlbGl2ZXJ5X2F0dGVtcHRfY2xhaW1fbGVhc2Uuc3FsYCBkaWQgbm90IHlldCBlbmZvcmNlIHRoZSBzYW1lIGxvd2VyL3VwcGVyIGJvdW5kczogcmVncmVzc2lvbiBgMzJjMDJmM2NhMmVhZDc2MTdiMDhkMzU5NzNkNTE4YjI1ZWQ0ZjY5MWAsIGlzb2xhdGVkIGF0IHJlYWxpdHktUkVEIGA0MDBlODgxNjNjYTlkODc4ODA2YWFlZTExZWY4Y2EyOTE3ZWMzM2RjYCwgZGVtb25zdHJhdGVkIHJlYWwgbWlncmF0ZWQgUG9zdGdyZVNRTCBhY2NlcHRpbmcgMjkuOTk5LXNlY29uZCBhbmQgMzYwMC4wMDEtc2Vjb25kIGxlYXNlcy4gTWluaW11bSByZXBhaXIgYGUyNWE5NmQ5MDJhZGM2ZDZhNjQyMmNhNGJjMTE0YzViZjE4OWY0N2ZgIGFkZHMgdGhlIHNhbWUgaW5jbHVzaXZlIDMw4oCTMzYwMCBzZWNvbmQgZGF0YWJhc2UgaW52YXJpYW50LiBFeGFjdCBwcm9vZiBoZWFkIGA5NGVmMDRlODU0ZDI0ODBmNDUyMDI0MzUyMWJkZDlhNzU1MDg4OWVhYCwgcnVuIGAzNDIxNzc1NDQ0N2AsIGpvYiBgMTAyMDMzNDQzNjI5YCwgY29tcGxldGVkIEdSRUVOIG9uIFVidW50dSAyNC4wNC9Qb3N0Z3JlU1FMIDE2IGFjcm9zcyByZXRhaW5lZCBjYXBhYmlsaXR5L3BlcnNpc3RlbmNlL2R1cmFibGUtYm91bmQgUkVEcywgZm9ybWF0dGluZy9kaWZmIGh5Z2llbmUsIGZvY3VzZWQgY2xhaW0vbGVhc2UgYWNjZXB0YW5jZSwgSW50ZWdyYXRpb24gdHlwZWNoZWNrIGFuZCB0aGUgY29tcGxldGUgSW50ZWdyYXRpb24gc3VpdGUuIEN1cnJlbnQgIzI1MyBleGFjdCBgNjJiNmZkMmMzMzg4ZjYwMzg2NDE5NDVkZjM0YWZlZGQ1YjVmM2I3OGAgcmVtb3ZlcyBvbmx5IHRoZSBwdXJwb3NlLWNvbXBsZXRlIHZlcmlmaWVyLiBUaGlzIGlzIGFjdGl2ZS1QUiBldmlkZW5jZSBvbmx5IGFuZCBkb2VzIG5vdCBtb3ZlIG5ldHdvcmsgYXV0aG9yaXR5IGludG8gTGlmZU9TLg== + run: | + set -euo pipefail + branch='docs/canonical-product-architecture-mainline' + remote_head="$(git ls-remote origin "refs/heads/${branch}" | cut -f1)" + test "${remote_head}" = "${GITHUB_SHA}" + + python -c 'import base64,os; from pathlib import Path; p=Path("ARCHITECTURE.md"); t=p.read_text(encoding="utf-8"); m="Issue #130 remains **Partial**."; para=base64.b64decode(os.environ["PARAGRAPH_B64"]).decode("utf-8"); assert "Draft PR #253 is the direct child of #252" not in t; i=t.index(m); p.write_text(t[:i]+para+"\n\n"+t[i:],encoding="utf-8")' + + git diff --check + rm .github/workflows/write-architecture-plugin-claim-lease.yml + git diff --check + git config user.name 'github-actions[bot]' + git config user.email '41898282+github-actions[bot]@users.noreply.github.com' + git add ARCHITECTURE.md .github/workflows/write-architecture-plugin-claim-lease.yml + git commit -m 'docs(architecture): record plugin claim lease boundary' + + git fetch origin "${branch}" + remote_head="$(git rev-parse "origin/${branch}")" + test "${remote_head}" = "${GITHUB_SHA}" + git push origin "HEAD:${branch}" From af74d0066df97ffdcf68c2b1b6efd10f06a233ef Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 8 Sep 2026 11:12:48 +0000 Subject: [PATCH 145/173] docs(architecture): record plugin claim lease boundary --- .../write-architecture-plugin-claim-lease.yml | 45 ------------------- ARCHITECTURE.md | 2 + 2 files changed, 2 insertions(+), 45 deletions(-) delete mode 100644 .github/workflows/write-architecture-plugin-claim-lease.yml diff --git a/.github/workflows/write-architecture-plugin-claim-lease.yml b/.github/workflows/write-architecture-plugin-claim-lease.yml deleted file mode 100644 index 526727ad6..000000000 --- a/.github/workflows/write-architecture-plugin-claim-lease.yml +++ /dev/null @@ -1,45 +0,0 @@ -name: Write Architecture Plugin Claim Lease - -on: - push: - branches: - - docs/canonical-product-architecture-mainline - -permissions: - contents: write - -jobs: - write: - runs-on: ubuntu-24.04 - timeout-minutes: 10 - steps: - - name: Checkout exact writer input - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 - with: - ref: ${{ github.sha }} - fetch-depth: 0 - - - name: Publish bounded architecture insertion - shell: bash - env: - PARAGRAPH_B64: RHJhZnQgUFIgIzI1MyBpcyB0aGUgZGlyZWN0IGNoaWxkIG9mICMyNTIgYW5kIGVzdGFibGlzaGVzIGRldGVybWluaXN0aWMgSW50ZWdyYXRpb24tb3duZWQgZGVsaXZlcnktYXR0ZW1wdCBjbGFpbS9sZWFzZSBhdXRob3JpdHkgd2l0aG91dCBhZGRpbmcgcHJvdmlkZXIgZXhlY3V0aW9uIG9yIG91dGJvdW5kIEhUVFBTLiBgbGlmZS1vcy5wbHVnaW4tZGVsaXZlcnktYXR0ZW1wdC1jbGFpbS52MWAgcmV0dXJucyBhbiBvcGFxdWUgVVVJRHY0IGNsYWltIHRva2VuIG9ubHkgdG8gdGhlIHdvcmtlciB3aGlsZSBwZXJzaXN0ZW5jZSByZXRhaW5zIG9ubHkgaXRzIFNIQS0yNTYgZGlnZXN0LCBleGFjdCBjbGFpbSBzdGFydC9leHBpcnkgZXZpZGVuY2UgYW5kIHRoZSBhdG9taWMgcmV0cnktYnVkZ2V0IHRyYW5zaXRpb24uIEFwcGxpY2F0aW9uIGFuZCByZXBvc2l0b3J5IHZhbGlkYXRpb24gYm91bmQgYSBsZWFzZSB0byAzMOKAkzM2MDAgc2Vjb25kcy4gQSBkdXJhYmxlLWJvdW5kIHJldmlldyBmb3VuZCBtaWdyYXRpb24gYDAwMDdfcGx1Z2luX2RlbGl2ZXJ5X2F0dGVtcHRfY2xhaW1fbGVhc2Uuc3FsYCBkaWQgbm90IHlldCBlbmZvcmNlIHRoZSBzYW1lIGxvd2VyL3VwcGVyIGJvdW5kczogcmVncmVzc2lvbiBgMzJjMDJmM2NhMmVhZDc2MTdiMDhkMzU5NzNkNTE4YjI1ZWQ0ZjY5MWAsIGlzb2xhdGVkIGF0IHJlYWxpdHktUkVEIGA0MDBlODgxNjNjYTlkODc4ODA2YWFlZTExZWY4Y2EyOTE3ZWMzM2RjYCwgZGVtb25zdHJhdGVkIHJlYWwgbWlncmF0ZWQgUG9zdGdyZVNRTCBhY2NlcHRpbmcgMjkuOTk5LXNlY29uZCBhbmQgMzYwMC4wMDEtc2Vjb25kIGxlYXNlcy4gTWluaW11bSByZXBhaXIgYGUyNWE5NmQ5MDJhZGM2ZDZhNjQyMmNhNGJjMTE0YzViZjE4OWY0N2ZgIGFkZHMgdGhlIHNhbWUgaW5jbHVzaXZlIDMw4oCTMzYwMCBzZWNvbmQgZGF0YWJhc2UgaW52YXJpYW50LiBFeGFjdCBwcm9vZiBoZWFkIGA5NGVmMDRlODU0ZDI0ODBmNDUyMDI0MzUyMWJkZDlhNzU1MDg4OWVhYCwgcnVuIGAzNDIxNzc1NDQ0N2AsIGpvYiBgMTAyMDMzNDQzNjI5YCwgY29tcGxldGVkIEdSRUVOIG9uIFVidW50dSAyNC4wNC9Qb3N0Z3JlU1FMIDE2IGFjcm9zcyByZXRhaW5lZCBjYXBhYmlsaXR5L3BlcnNpc3RlbmNlL2R1cmFibGUtYm91bmQgUkVEcywgZm9ybWF0dGluZy9kaWZmIGh5Z2llbmUsIGZvY3VzZWQgY2xhaW0vbGVhc2UgYWNjZXB0YW5jZSwgSW50ZWdyYXRpb24gdHlwZWNoZWNrIGFuZCB0aGUgY29tcGxldGUgSW50ZWdyYXRpb24gc3VpdGUuIEN1cnJlbnQgIzI1MyBleGFjdCBgNjJiNmZkMmMzMzg4ZjYwMzg2NDE5NDVkZjM0YWZlZGQ1YjVmM2I3OGAgcmVtb3ZlcyBvbmx5IHRoZSBwdXJwb3NlLWNvbXBsZXRlIHZlcmlmaWVyLiBUaGlzIGlzIGFjdGl2ZS1QUiBldmlkZW5jZSBvbmx5IGFuZCBkb2VzIG5vdCBtb3ZlIG5ldHdvcmsgYXV0aG9yaXR5IGludG8gTGlmZU9TLg== - run: | - set -euo pipefail - branch='docs/canonical-product-architecture-mainline' - remote_head="$(git ls-remote origin "refs/heads/${branch}" | cut -f1)" - test "${remote_head}" = "${GITHUB_SHA}" - - python -c 'import base64,os; from pathlib import Path; p=Path("ARCHITECTURE.md"); t=p.read_text(encoding="utf-8"); m="Issue #130 remains **Partial**."; para=base64.b64decode(os.environ["PARAGRAPH_B64"]).decode("utf-8"); assert "Draft PR #253 is the direct child of #252" not in t; i=t.index(m); p.write_text(t[:i]+para+"\n\n"+t[i:],encoding="utf-8")' - - git diff --check - rm .github/workflows/write-architecture-plugin-claim-lease.yml - git diff --check - git config user.name 'github-actions[bot]' - git config user.email '41898282+github-actions[bot]@users.noreply.github.com' - git add ARCHITECTURE.md .github/workflows/write-architecture-plugin-claim-lease.yml - git commit -m 'docs(architecture): record plugin claim lease boundary' - - git fetch origin "${branch}" - remote_head="$(git rev-parse "origin/${branch}")" - test "${remote_head}" = "${GITHUB_SHA}" - git push origin "HEAD:${branch}" diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 9c02f2af6..3b0a17755 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -113,6 +113,8 @@ Draft PR #251 is stacked exactly on #250 and retains the signed delivery-origin Draft PR #252 proceeds in parallel from #245 and establishes Integration-owned durable delivery-attempt admission without depending on mutable #250/#251 transport. It introduces opaque `life-os.plugin-delivery-attempt.v1` work identity plus service-owned PostgreSQL migration/store, exact idempotency scope, bounded retry budget metadata, and a durable INSERT-time fence requiring both the exact active origin grant and active installation under matching workspace/user authority. The table intentionally stores no origin copy, credential, request payload, response body, or network authorization. Exact review-repair proof head `9e6e88e49e14d0b2d247e747df968e2494697666` completed hosted run `34209314512`, job `102006262067`, GREEN on Ubuntu 24.04/PostgreSQL 16 after replaying the timestamp, PostgreSQL/TLS target, IPv6 loopback and table-contract RED ancestors for their intended reasons. A subsequent repository-boundary review found that SQL result envelopes, durable row getters and stored timestamp conversion could throw native dependency detail before the fixed persistence-evidence boundary. Reality RED `b390f37ed651ce2d9cb74d862fbae02641f3a55f` demonstrates that hostile evidence leak; minimum repair `e9a8b212b24b4914069a48a113d118ff4e4c0a56` snapshots and bounds those evidence reads without changing SQL/schema/admission authority. Exact proof head `ec2353a003c15c9f464b5d5d2454d3593427d768`, run `34213508199`, job `102019765395`, completed GREEN with the focused delivery-attempt suite 24/24, Integration typecheck and the complete Integration suite 403 passed / 3 environment-dependent skipped across 65 files. CHANGELOG descendant `fe51a79c1e19cc7fb14e5296f04b3f91b41bf535` also completed exact run `34213937828` / job `102021136219` GREEN. Current #252 head `9ed7847d3106d9418e1ff6e04e45c1c7d84d0b0d` removes only the purpose-complete hostile-SQL verifier. This remains active-PR evidence, not protected shipped truth. +Draft PR #253 is the direct child of #252 and establishes deterministic Integration-owned delivery-attempt claim/lease authority without adding provider execution or outbound HTTPS. `life-os.plugin-delivery-attempt-claim.v1` returns an opaque UUIDv4 claim token only to the worker while persistence retains only its SHA-256 digest, exact claim start/expiry evidence and the atomic retry-budget transition. Application and repository validation bound a lease to 30–3600 seconds. A durable-bound review found migration `0007_plugin_delivery_attempt_claim_lease.sql` did not yet enforce the same lower/upper bounds: regression `32c02f3ca2ead7617b08d35973d518b25ed4f691`, isolated at reality-RED `400e88163ca9d878806aaee11ef8ca2917ec33dc`, demonstrated real migrated PostgreSQL accepting 29.999-second and 3600.001-second leases. Minimum repair `e25a96d902adc6d6a6422ca4bc114c5bf189f47f` adds the same inclusive 30–3600 second database invariant. Exact proof head `94ef04e854d2480f4520243521bdd9a7550889ea`, run `34217754447`, job `102033443629`, completed GREEN on Ubuntu 24.04/PostgreSQL 16 across retained capability/persistence/durable-bound REDs, formatting/diff hygiene, focused claim/lease acceptance, Integration typecheck and the complete Integration suite. Current #253 exact `62b6fd2c3388f6038641945df34afedd5b5f3b78` removes only the purpose-complete verifier. This is active-PR evidence only and does not move network authority into LifeOS. + Issue #130 remains **Partial**. Protected main does not yet contain this Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes admission only; worker claim/lease, bounded retry/backoff, append-only sanitized outcomes, dead-letter/pause/resume, per-attempt revocation fencing, operator-visible status and restart/recovery remain successor work. No active LifeOS PR supplies complete host-authorized outbound HTTPS. The network boundary still requires immutable released/versioned canonical egress authority for connect-time DNS/IP and rebinding controls, redirect/proxy policy, bounded response/time behavior and non-leaking failures. Durable origin identity and durable delivery identity are not network authorization. Manifests and stored installations never self-authorize network capabilities. ## 6. AI proposal boundary From f9f6e1181e3381f92fbf5287b07db598384d8902 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 20:17:49 +0900 Subject: [PATCH 146/173] ci(docs): repair plugin successor currentness --- ...ir-architecture-plugin-gap-currentness.yml | 53 +++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 .github/workflows/repair-architecture-plugin-gap-currentness.yml diff --git a/.github/workflows/repair-architecture-plugin-gap-currentness.yml b/.github/workflows/repair-architecture-plugin-gap-currentness.yml new file mode 100644 index 000000000..d21db75e1 --- /dev/null +++ b/.github/workflows/repair-architecture-plugin-gap-currentness.yml @@ -0,0 +1,53 @@ +name: Repair Architecture Plugin Gap Currentness + +on: + push: + branches: + - docs/canonical-product-architecture-mainline + +permissions: + contents: write + +jobs: + repair: + runs-on: ubuntu-24.04 + timeout-minutes: 10 + steps: + - name: Checkout exact repair input + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 + with: + ref: ${{ github.sha }} + fetch-depth: 0 + + - name: Repair bounded successor statement and self-retire + shell: bash + run: | + set -euo pipefail + branch='docs/canonical-product-architecture-mainline' + remote_head="$(git ls-remote origin "refs/heads/${branch}" | cut -f1)" + test "${remote_head}" = "${GITHUB_SHA}" + + python - <<'PY' + from pathlib import Path + + path = Path('ARCHITECTURE.md') + text = path.read_text(encoding='utf-8') + old = '#252 establishes admission only; worker claim/lease, bounded retry/backoff, append-only sanitized outcomes, dead-letter/pause/resume, per-attempt revocation fencing, operator-visible status and restart/recovery remain successor work.' + new = '#252 establishes durable admission and #253 adds deterministic finite worker claim/lease; bounded retry/backoff, append-only sanitized outcomes, dead-letter/pause/resume, per-attempt revocation fencing, operator-visible status and restart/recovery remain successor work.' + if text.count(old) != 1: + raise SystemExit('expected exactly one stale #130 successor statement') + path.write_text(text.replace(old, new), encoding='utf-8') + PY + + git diff --check + rm .github/workflows/repair-architecture-plugin-gap-currentness.yml + git diff --check + git config user.name 'github-actions[bot]' + git config user.email '41898282+github-actions[bot]@users.noreply.github.com' + git add ARCHITECTURE.md .github/workflows/repair-architecture-plugin-gap-currentness.yml + git commit -m 'docs(architecture): align plugin successor gap' + + git fetch origin "${branch}" + remote_head="$(git rev-parse "origin/${branch}")" + test "${remote_head}" = "${GITHUB_SHA}" + git push origin "HEAD:${branch}" From 9c908f71e25fb25c48b55327291bd2dab05a332e Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 8 Sep 2026 11:20:08 +0000 Subject: [PATCH 147/173] docs(architecture): align plugin successor gap --- ...ir-architecture-plugin-gap-currentness.yml | 53 ------------------- ARCHITECTURE.md | 2 +- 2 files changed, 1 insertion(+), 54 deletions(-) delete mode 100644 .github/workflows/repair-architecture-plugin-gap-currentness.yml diff --git a/.github/workflows/repair-architecture-plugin-gap-currentness.yml b/.github/workflows/repair-architecture-plugin-gap-currentness.yml deleted file mode 100644 index d21db75e1..000000000 --- a/.github/workflows/repair-architecture-plugin-gap-currentness.yml +++ /dev/null @@ -1,53 +0,0 @@ -name: Repair Architecture Plugin Gap Currentness - -on: - push: - branches: - - docs/canonical-product-architecture-mainline - -permissions: - contents: write - -jobs: - repair: - runs-on: ubuntu-24.04 - timeout-minutes: 10 - steps: - - name: Checkout exact repair input - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 - with: - ref: ${{ github.sha }} - fetch-depth: 0 - - - name: Repair bounded successor statement and self-retire - shell: bash - run: | - set -euo pipefail - branch='docs/canonical-product-architecture-mainline' - remote_head="$(git ls-remote origin "refs/heads/${branch}" | cut -f1)" - test "${remote_head}" = "${GITHUB_SHA}" - - python - <<'PY' - from pathlib import Path - - path = Path('ARCHITECTURE.md') - text = path.read_text(encoding='utf-8') - old = '#252 establishes admission only; worker claim/lease, bounded retry/backoff, append-only sanitized outcomes, dead-letter/pause/resume, per-attempt revocation fencing, operator-visible status and restart/recovery remain successor work.' - new = '#252 establishes durable admission and #253 adds deterministic finite worker claim/lease; bounded retry/backoff, append-only sanitized outcomes, dead-letter/pause/resume, per-attempt revocation fencing, operator-visible status and restart/recovery remain successor work.' - if text.count(old) != 1: - raise SystemExit('expected exactly one stale #130 successor statement') - path.write_text(text.replace(old, new), encoding='utf-8') - PY - - git diff --check - rm .github/workflows/repair-architecture-plugin-gap-currentness.yml - git diff --check - git config user.name 'github-actions[bot]' - git config user.email '41898282+github-actions[bot]@users.noreply.github.com' - git add ARCHITECTURE.md .github/workflows/repair-architecture-plugin-gap-currentness.yml - git commit -m 'docs(architecture): align plugin successor gap' - - git fetch origin "${branch}" - remote_head="$(git rev-parse "origin/${branch}")" - test "${remote_head}" = "${GITHUB_SHA}" - git push origin "HEAD:${branch}" diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 3b0a17755..467d7f181 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -115,7 +115,7 @@ Draft PR #252 proceeds in parallel from #245 and establishes Integration-owned d Draft PR #253 is the direct child of #252 and establishes deterministic Integration-owned delivery-attempt claim/lease authority without adding provider execution or outbound HTTPS. `life-os.plugin-delivery-attempt-claim.v1` returns an opaque UUIDv4 claim token only to the worker while persistence retains only its SHA-256 digest, exact claim start/expiry evidence and the atomic retry-budget transition. Application and repository validation bound a lease to 30–3600 seconds. A durable-bound review found migration `0007_plugin_delivery_attempt_claim_lease.sql` did not yet enforce the same lower/upper bounds: regression `32c02f3ca2ead7617b08d35973d518b25ed4f691`, isolated at reality-RED `400e88163ca9d878806aaee11ef8ca2917ec33dc`, demonstrated real migrated PostgreSQL accepting 29.999-second and 3600.001-second leases. Minimum repair `e25a96d902adc6d6a6422ca4bc114c5bf189f47f` adds the same inclusive 30–3600 second database invariant. Exact proof head `94ef04e854d2480f4520243521bdd9a7550889ea`, run `34217754447`, job `102033443629`, completed GREEN on Ubuntu 24.04/PostgreSQL 16 across retained capability/persistence/durable-bound REDs, formatting/diff hygiene, focused claim/lease acceptance, Integration typecheck and the complete Integration suite. Current #253 exact `62b6fd2c3388f6038641945df34afedd5b5f3b78` removes only the purpose-complete verifier. This is active-PR evidence only and does not move network authority into LifeOS. -Issue #130 remains **Partial**. Protected main does not yet contain this Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes admission only; worker claim/lease, bounded retry/backoff, append-only sanitized outcomes, dead-letter/pause/resume, per-attempt revocation fencing, operator-visible status and restart/recovery remain successor work. No active LifeOS PR supplies complete host-authorized outbound HTTPS. The network boundary still requires immutable released/versioned canonical egress authority for connect-time DNS/IP and rebinding controls, redirect/proxy policy, bounded response/time behavior and non-leaking failures. Durable origin identity and durable delivery identity are not network authorization. Manifests and stored installations never self-authorize network capabilities. +Issue #130 remains **Partial**. Protected main does not yet contain this Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission and #253 adds deterministic finite worker claim/lease; bounded retry/backoff, append-only sanitized outcomes, dead-letter/pause/resume, per-attempt revocation fencing, operator-visible status and restart/recovery remain successor work. No active LifeOS PR supplies complete host-authorized outbound HTTPS. The network boundary still requires immutable released/versioned canonical egress authority for connect-time DNS/IP and rebinding controls, redirect/proxy policy, bounded response/time behavior and non-leaking failures. Durable origin identity and durable delivery identity are not network authorization. Manifests and stored installations never self-authorize network capabilities. ## 6. AI proposal boundary From 0cd5dd7e3a95c5719d784ac46ce66e2dfe30221a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 23:28:10 +0900 Subject: [PATCH 148/173] docs(architecture): stage plugin retry currentness writer --- ...-architecture-plugin-retry-currentness.yml | 71 +++++++++++++++++++ 1 file changed, 71 insertions(+) create mode 100644 .github/workflows/repair-architecture-plugin-retry-currentness.yml diff --git a/.github/workflows/repair-architecture-plugin-retry-currentness.yml b/.github/workflows/repair-architecture-plugin-retry-currentness.yml new file mode 100644 index 000000000..18c031279 --- /dev/null +++ b/.github/workflows/repair-architecture-plugin-retry-currentness.yml @@ -0,0 +1,71 @@ +name: Repair architecture plugin retry currentness + +on: + push: + branches: + - docs/canonical-product-architecture-mainline + +permissions: + contents: write + +concurrency: + group: repair-architecture-plugin-retry-currentness + cancel-in-progress: false + +jobs: + write: + runs-on: ubuntu-24.04 + timeout-minutes: 10 + steps: + - name: Checkout exact writer input + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + ref: ${{ github.sha }} + fetch-depth: 2 + + - name: Verify single-writer branch ownership + shell: bash + run: | + set -Eeuo pipefail + remote_head="$(git ls-remote origin refs/heads/docs/canonical-product-architecture-mainline | cut -f1)" + test "$remote_head" = "$GITHUB_SHA" + + - name: Apply bounded plugin lifecycle currentness repair + shell: bash + run: | + set -Eeuo pipefail + python - <<'PY' + from pathlib import Path + + path = Path('ARCHITECTURE.md') + text = path.read_text() + old_claim = '''Draft PR #253 is the direct child of #252 and establishes deterministic Integration-owned delivery-attempt claim/lease authority without adding provider execution or outbound HTTPS. `life-os.plugin-delivery-attempt-claim.v1` returns an opaque UUIDv4 claim token only to the worker while persistence retains only its SHA-256 digest, exact claim start/expiry evidence and the atomic retry-budget transition. Application and repository validation bound a lease to 30–3600 seconds. A durable-bound review found migration `0007_plugin_delivery_attempt_claim_lease.sql` did not yet enforce the same lower/upper bounds: regression `32c02f3ca2ead7617b08d35973d518b25ed4f691`, isolated at reality-RED `400e88163ca9d878806aaee11ef8ca2917ec33dc`, demonstrated real migrated PostgreSQL accepting 29.999-second and 3600.001-second leases. Minimum repair `e25a96d902adc6d6a6422ca4bc114c5bf189f47f` adds the same inclusive 30–3600 second database invariant. Exact proof head `94ef04e854d2480f4520243521bdd9a7550889ea`, run `34217754447`, job `102033443629`, completed GREEN on Ubuntu 24.04/PostgreSQL 16 across retained capability/persistence/durable-bound REDs, formatting/diff hygiene, focused claim/lease acceptance, Integration typecheck and the complete Integration suite. Current #253 exact `62b6fd2c3388f6038641945df34afedd5b5f3b78` removes only the purpose-complete verifier. This is active-PR evidence only and does not move network authority into LifeOS. + +''' + new_claim = '''Draft PR #253 is the direct child of #252 and establishes deterministic Integration-owned delivery-attempt claim/lease authority without adding provider execution or outbound HTTPS. `life-os.plugin-delivery-attempt-claim.v1` returns an opaque UUIDv4 claim token only to the worker while persistence retains only its SHA-256 digest, exact claim start/expiry evidence and the atomic retry-budget transition. Application and repository validation bound a lease to 30–3600 seconds. A durable-bound review found migration `0007_plugin_delivery_attempt_claim_lease.sql` did not yet enforce the same lower/upper bounds: regression `32c02f3ca2ead7617b08d35973d518b25ed4f691`, isolated at reality-RED `400e88163ca9d878806aaee11ef8ca2917ec33dc`, demonstrated real migrated PostgreSQL accepting 29.999-second and 3600.001-second leases. Minimum repair `e25a96d902adc6d6a6422ca4bc114c5bf189f47f` adds the same inclusive 30–3600 second database invariant. Its later hostile-envelope and application-context repairs retain fixed credential-free failure boundaries. Current #253 exact `8252575a510254883cb62c44198cb665daa0d0b5` removes only completed/exploratory verifier work after the retained exact GREEN lineage. This is active-PR evidence only and does not move network authority into LifeOS. + +Draft PR #254 is the direct #253 child and adds the Integration-owned claim-bound retry/backoff transition without provider execution or outbound HTTPS. Reality RED `a588428d105c2fd8f2078bcd807cb4f895e760a5` / run `34232017394` proved terminal `attempt_limit` evidence could be accepted without proving the durable row's configured `max_attempts`; the causal repair carries `max_attempts` through repository/application durable evidence and requires pending `attempt_number < max_attempts` and terminal equality. Exact `43bcd6dc73d108b5690b29541ecb91ff074e7d5a` / run `34236816710` / job `102096552714` then passed the focused application/repository gates and failed at the intended real PostgreSQL boundary because migrations 0006/0007 admitted only admission/active-claim row shapes. Migration `0008_plugin_delivery_attempt_retry_transition.sql` is the minimum service-owned schema evolution: it preserves per-row retry budgets and the finite claim-lease constraints while admitting explicit initial-admission, active-claim, claimless scheduled-retry and terminal-exhaustion shapes. Exact proof head `ca22c71e4f2ec11de6539df79632376d4134f90a`, run `34237354956`, job `102098403313`, completed GREEN on Ubuntu 24.04/PostgreSQL 16 across frozen install, formatting/diff hygiene, Plugin SDK build, focused retry acceptance, real PostgreSQL retry/exhaustion acceptance, Integration typecheck and the complete Integration suite. Current #254 exact `edc79d1291025b8787a9ccf16c39a10df4157023` removes only the purpose-complete verifier and remains Draft/unshipped. + +''' + old_gap = '''Issue #130 remains **Partial**. Protected main does not yet contain this Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission and #253 adds deterministic finite worker claim/lease; bounded retry/backoff, append-only sanitized outcomes, dead-letter/pause/resume, per-attempt revocation fencing, operator-visible status and restart/recovery remain successor work. No active LifeOS PR supplies complete host-authorized outbound HTTPS. The network boundary still requires immutable released/versioned canonical egress authority for connect-time DNS/IP and rebinding controls, redirect/proxy policy, bounded response/time behavior and non-leaking failures. Durable origin identity and durable delivery identity are not network authorization. Manifests and stored installations never self-authorize network capabilities.''' + new_gap = '''Issue #130 remains **Partial**. Protected main does not yet contain this Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 adds deterministic finite worker claim/lease, and #254 adds claim-bound bounded retry/backoff plus terminal retry-budget exhaustion. Append-only sanitized execution outcomes beyond retry scheduling, dead-letter/pause/resume, per-attempt revocation fencing, operator-visible status, restart/recovery, and provider execution remain successor work. No active LifeOS PR supplies complete host-authorized outbound HTTPS. The network boundary still requires immutable released/versioned canonical egress authority for connect-time DNS/IP and rebinding controls, redirect/proxy policy, bounded response/time behavior and non-leaking failures. Durable origin identity, durable delivery identity, and retry lifecycle identity are not network authorization. Manifests and stored installations never self-authorize network capabilities.''' + if text.count(old_claim) != 1 or text.count(old_gap) != 1: + raise SystemExit('architecture bounded replacement target is not unique') + text = text.replace(old_claim, new_claim, 1).replace(old_gap, new_gap, 1) + path.write_text(text) + PY + git diff --check + rm .github/workflows/repair-architecture-plugin-retry-currentness.yml + git diff --check + + - name: Publish exact bounded architecture descendant + shell: bash + run: | + set -Eeuo pipefail + git config user.name 'Seongho Bae' + git config user.email 'me@seonghobae.me' + git add ARCHITECTURE.md .github/workflows/repair-architecture-plugin-retry-currentness.yml + git commit -m 'docs(architecture): record plugin retry lifecycle authority' + remote_head="$(git ls-remote origin refs/heads/docs/canonical-product-architecture-mainline | cut -f1)" + test "$remote_head" = "$GITHUB_SHA" + git push origin HEAD:refs/heads/docs/canonical-product-architecture-mainline From 9b50a1cedfff05f1c7cb716a2089b4e9ed50b2bd Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 23:29:29 +0900 Subject: [PATCH 149/173] docs(architecture): isolate retry currentness repair script --- ...ir-architecture-plugin-retry-currentness.py | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 .github/scripts/repair-architecture-plugin-retry-currentness.py diff --git a/.github/scripts/repair-architecture-plugin-retry-currentness.py b/.github/scripts/repair-architecture-plugin-retry-currentness.py new file mode 100644 index 000000000..c3aaa8210 --- /dev/null +++ b/.github/scripts/repair-architecture-plugin-retry-currentness.py @@ -0,0 +1,18 @@ +from pathlib import Path + +path = Path("ARCHITECTURE.md") +text = path.read_text() +old_claim = """Draft PR #253 is the direct child of #252 and establishes deterministic Integration-owned delivery-attempt claim/lease authority without adding provider execution or outbound HTTPS. `life-os.plugin-delivery-attempt-claim.v1` returns an opaque UUIDv4 claim token only to the worker while persistence retains only its SHA-256 digest, exact claim start/expiry evidence and the atomic retry-budget transition. Application and repository validation bound a lease to 30–3600 seconds. A durable-bound review found migration `0007_plugin_delivery_attempt_claim_lease.sql` did not yet enforce the same lower/upper bounds: regression `32c02f3ca2ead7617b08d35973d518b25ed4f691`, isolated at reality-RED `400e88163ca9d878806aaee11ef8ca2917ec33dc`, demonstrated real migrated PostgreSQL accepting 29.999-second and 3600.001-second leases. Minimum repair `e25a96d902adc6d6a6422ca4bc114c5bf189f47f` adds the same inclusive 30–3600 second database invariant. Exact proof head `94ef04e854d2480f4520243521bdd9a7550889ea`, run `34217754447`, job `102033443629`, completed GREEN on Ubuntu 24.04/PostgreSQL 16 across retained capability/persistence/durable-bound REDs, formatting/diff hygiene, focused claim/lease acceptance, Integration typecheck and the complete Integration suite. Current #253 exact `62b6fd2c3388f6038641945df34afedd5b5f3b78` removes only the purpose-complete verifier. This is active-PR evidence only and does not move network authority into LifeOS. + +""" +new_claim = """Draft PR #253 is the direct child of #252 and establishes deterministic Integration-owned delivery-attempt claim/lease authority without adding provider execution or outbound HTTPS. `life-os.plugin-delivery-attempt-claim.v1` returns an opaque UUIDv4 claim token only to the worker while persistence retains only its SHA-256 digest, exact claim start/expiry evidence and the atomic retry-budget transition. Application and repository validation bound a lease to 30–3600 seconds. A durable-bound review found migration `0007_plugin_delivery_attempt_claim_lease.sql` did not yet enforce the same lower/upper bounds: regression `32c02f3ca2ead7617b08d35973d518b25ed4f691`, isolated at reality-RED `400e88163ca9d878806aaee11ef8ca2917ec33dc`, demonstrated real migrated PostgreSQL accepting 29.999-second and 3600.001-second leases. Minimum repair `e25a96d902adc6d6a6422ca4bc114c5bf189f47f` adds the same inclusive 30–3600 second database invariant. Its later hostile-envelope and application-context repairs retain fixed credential-free failure boundaries. Current #253 exact `8252575a510254883cb62c44198cb665daa0d0b5` removes only completed/exploratory verifier work after the retained exact GREEN lineage. This is active-PR evidence only and does not move network authority into LifeOS. + +Draft PR #254 is the direct #253 child and adds the Integration-owned claim-bound retry/backoff transition without provider execution or outbound HTTPS. Reality RED `a588428d105c2fd8f2078bcd807cb4f895e760a5` / run `34232017394` proved terminal `attempt_limit` evidence could be accepted without proving the durable row's configured `max_attempts`; the causal repair carries `max_attempts` through repository/application durable evidence and requires pending `attempt_number < max_attempts` and terminal equality. Exact `43bcd6dc73d108b5690b29541ecb91ff074e7d5a` / run `34236816710` / job `102096552714` then passed the focused application/repository gates and failed at the intended real PostgreSQL boundary because migrations 0006/0007 admitted only admission/active-claim row shapes. Migration `0008_plugin_delivery_attempt_retry_transition.sql` is the minimum service-owned schema evolution: it preserves per-row retry budgets and the finite claim-lease constraints while admitting explicit initial-admission, active-claim, claimless scheduled-retry and terminal-exhaustion shapes. Exact proof head `ca22c71e4f2ec11de6539df79632376d4134f90a`, run `34237354956`, job `102098403313`, completed GREEN on Ubuntu 24.04/PostgreSQL 16 across frozen install, formatting/diff hygiene, Plugin SDK build, focused retry acceptance, real PostgreSQL retry/exhaustion acceptance, Integration typecheck and the complete Integration suite. Current #254 exact `edc79d1291025b8787a9ccf16c39a10df4157023` removes only the purpose-complete verifier and remains Draft/unshipped. + +""" +old_gap = """Issue #130 remains **Partial**. Protected main does not yet contain this Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission and #253 adds deterministic finite worker claim/lease; bounded retry/backoff, append-only sanitized outcomes, dead-letter/pause/resume, per-attempt revocation fencing, operator-visible status and restart/recovery remain successor work. No active LifeOS PR supplies complete host-authorized outbound HTTPS. The network boundary still requires immutable released/versioned canonical egress authority for connect-time DNS/IP and rebinding controls, redirect/proxy policy, bounded response/time behavior and non-leaking failures. Durable origin identity and durable delivery identity are not network authorization. Manifests and stored installations never self-authorize network capabilities.""" +new_gap = """Issue #130 remains **Partial**. Protected main does not yet contain this Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 adds deterministic finite worker claim/lease, and #254 adds claim-bound bounded retry/backoff plus terminal retry-budget exhaustion. Append-only sanitized execution outcomes beyond retry scheduling, dead-letter/pause/resume, per-attempt revocation fencing, operator-visible status, restart/recovery, and provider execution remain successor work. No active LifeOS PR supplies complete host-authorized outbound HTTPS. The network boundary still requires immutable released/versioned canonical egress authority for connect-time DNS/IP and rebinding controls, redirect/proxy policy, bounded response/time behavior and non-leaking failures. Durable origin identity, durable delivery identity, and retry lifecycle identity are not network authorization. Manifests and stored installations never self-authorize network capabilities.""" + +if text.count(old_claim) != 1 or text.count(old_gap) != 1: + raise SystemExit("architecture bounded replacement target is not unique") +path.write_text(text.replace(old_claim, new_claim, 1).replace(old_gap, new_gap, 1)) From 783c5908e6b8c1e2b1b6150a373e772ad1f90330 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 23:42:58 +0900 Subject: [PATCH 150/173] ci(docs): repair architecture writer syntax --- ...-architecture-plugin-retry-currentness.yml | 40 +++---------------- 1 file changed, 6 insertions(+), 34 deletions(-) diff --git a/.github/workflows/repair-architecture-plugin-retry-currentness.yml b/.github/workflows/repair-architecture-plugin-retry-currentness.yml index 18c031279..e489f40e0 100644 --- a/.github/workflows/repair-architecture-plugin-retry-currentness.yml +++ b/.github/workflows/repair-architecture-plugin-retry-currentness.yml @@ -10,10 +10,10 @@ permissions: concurrency: group: repair-architecture-plugin-retry-currentness - cancel-in-progress: false + cancel-in-progress: true jobs: - write: + repair: runs-on: ubuntu-24.04 timeout-minutes: 10 steps: @@ -23,48 +23,20 @@ jobs: ref: ${{ github.sha }} fetch-depth: 2 - - name: Verify single-writer branch ownership + - name: Apply bounded repair and self-retire shell: bash run: | set -Eeuo pipefail remote_head="$(git ls-remote origin refs/heads/docs/canonical-product-architecture-mainline | cut -f1)" test "$remote_head" = "$GITHUB_SHA" - - - name: Apply bounded plugin lifecycle currentness repair - shell: bash - run: | - set -Eeuo pipefail - python - <<'PY' - from pathlib import Path - - path = Path('ARCHITECTURE.md') - text = path.read_text() - old_claim = '''Draft PR #253 is the direct child of #252 and establishes deterministic Integration-owned delivery-attempt claim/lease authority without adding provider execution or outbound HTTPS. `life-os.plugin-delivery-attempt-claim.v1` returns an opaque UUIDv4 claim token only to the worker while persistence retains only its SHA-256 digest, exact claim start/expiry evidence and the atomic retry-budget transition. Application and repository validation bound a lease to 30–3600 seconds. A durable-bound review found migration `0007_plugin_delivery_attempt_claim_lease.sql` did not yet enforce the same lower/upper bounds: regression `32c02f3ca2ead7617b08d35973d518b25ed4f691`, isolated at reality-RED `400e88163ca9d878806aaee11ef8ca2917ec33dc`, demonstrated real migrated PostgreSQL accepting 29.999-second and 3600.001-second leases. Minimum repair `e25a96d902adc6d6a6422ca4bc114c5bf189f47f` adds the same inclusive 30–3600 second database invariant. Exact proof head `94ef04e854d2480f4520243521bdd9a7550889ea`, run `34217754447`, job `102033443629`, completed GREEN on Ubuntu 24.04/PostgreSQL 16 across retained capability/persistence/durable-bound REDs, formatting/diff hygiene, focused claim/lease acceptance, Integration typecheck and the complete Integration suite. Current #253 exact `62b6fd2c3388f6038641945df34afedd5b5f3b78` removes only the purpose-complete verifier. This is active-PR evidence only and does not move network authority into LifeOS. - -''' - new_claim = '''Draft PR #253 is the direct child of #252 and establishes deterministic Integration-owned delivery-attempt claim/lease authority without adding provider execution or outbound HTTPS. `life-os.plugin-delivery-attempt-claim.v1` returns an opaque UUIDv4 claim token only to the worker while persistence retains only its SHA-256 digest, exact claim start/expiry evidence and the atomic retry-budget transition. Application and repository validation bound a lease to 30–3600 seconds. A durable-bound review found migration `0007_plugin_delivery_attempt_claim_lease.sql` did not yet enforce the same lower/upper bounds: regression `32c02f3ca2ead7617b08d35973d518b25ed4f691`, isolated at reality-RED `400e88163ca9d878806aaee11ef8ca2917ec33dc`, demonstrated real migrated PostgreSQL accepting 29.999-second and 3600.001-second leases. Minimum repair `e25a96d902adc6d6a6422ca4bc114c5bf189f47f` adds the same inclusive 30–3600 second database invariant. Its later hostile-envelope and application-context repairs retain fixed credential-free failure boundaries. Current #253 exact `8252575a510254883cb62c44198cb665daa0d0b5` removes only completed/exploratory verifier work after the retained exact GREEN lineage. This is active-PR evidence only and does not move network authority into LifeOS. - -Draft PR #254 is the direct #253 child and adds the Integration-owned claim-bound retry/backoff transition without provider execution or outbound HTTPS. Reality RED `a588428d105c2fd8f2078bcd807cb4f895e760a5` / run `34232017394` proved terminal `attempt_limit` evidence could be accepted without proving the durable row's configured `max_attempts`; the causal repair carries `max_attempts` through repository/application durable evidence and requires pending `attempt_number < max_attempts` and terminal equality. Exact `43bcd6dc73d108b5690b29541ecb91ff074e7d5a` / run `34236816710` / job `102096552714` then passed the focused application/repository gates and failed at the intended real PostgreSQL boundary because migrations 0006/0007 admitted only admission/active-claim row shapes. Migration `0008_plugin_delivery_attempt_retry_transition.sql` is the minimum service-owned schema evolution: it preserves per-row retry budgets and the finite claim-lease constraints while admitting explicit initial-admission, active-claim, claimless scheduled-retry and terminal-exhaustion shapes. Exact proof head `ca22c71e4f2ec11de6539df79632376d4134f90a`, run `34237354956`, job `102098403313`, completed GREEN on Ubuntu 24.04/PostgreSQL 16 across frozen install, formatting/diff hygiene, Plugin SDK build, focused retry acceptance, real PostgreSQL retry/exhaustion acceptance, Integration typecheck and the complete Integration suite. Current #254 exact `edc79d1291025b8787a9ccf16c39a10df4157023` removes only the purpose-complete verifier and remains Draft/unshipped. - -''' - old_gap = '''Issue #130 remains **Partial**. Protected main does not yet contain this Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission and #253 adds deterministic finite worker claim/lease; bounded retry/backoff, append-only sanitized outcomes, dead-letter/pause/resume, per-attempt revocation fencing, operator-visible status and restart/recovery remain successor work. No active LifeOS PR supplies complete host-authorized outbound HTTPS. The network boundary still requires immutable released/versioned canonical egress authority for connect-time DNS/IP and rebinding controls, redirect/proxy policy, bounded response/time behavior and non-leaking failures. Durable origin identity and durable delivery identity are not network authorization. Manifests and stored installations never self-authorize network capabilities.''' - new_gap = '''Issue #130 remains **Partial**. Protected main does not yet contain this Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 adds deterministic finite worker claim/lease, and #254 adds claim-bound bounded retry/backoff plus terminal retry-budget exhaustion. Append-only sanitized execution outcomes beyond retry scheduling, dead-letter/pause/resume, per-attempt revocation fencing, operator-visible status, restart/recovery, and provider execution remain successor work. No active LifeOS PR supplies complete host-authorized outbound HTTPS. The network boundary still requires immutable released/versioned canonical egress authority for connect-time DNS/IP and rebinding controls, redirect/proxy policy, bounded response/time behavior and non-leaking failures. Durable origin identity, durable delivery identity, and retry lifecycle identity are not network authorization. Manifests and stored installations never self-authorize network capabilities.''' - if text.count(old_claim) != 1 or text.count(old_gap) != 1: - raise SystemExit('architecture bounded replacement target is not unique') - text = text.replace(old_claim, new_claim, 1).replace(old_gap, new_gap, 1) - path.write_text(text) - PY + python3 .github/scripts/repair-architecture-plugin-retry-currentness.py git diff --check + rm .github/scripts/repair-architecture-plugin-retry-currentness.py rm .github/workflows/repair-architecture-plugin-retry-currentness.yml git diff --check - - - name: Publish exact bounded architecture descendant - shell: bash - run: | - set -Eeuo pipefail git config user.name 'Seongho Bae' git config user.email 'me@seonghobae.me' - git add ARCHITECTURE.md .github/workflows/repair-architecture-plugin-retry-currentness.yml + git add ARCHITECTURE.md .github/scripts/repair-architecture-plugin-retry-currentness.py .github/workflows/repair-architecture-plugin-retry-currentness.yml git commit -m 'docs(architecture): record plugin retry lifecycle authority' remote_head="$(git ls-remote origin refs/heads/docs/canonical-product-architecture-mainline | cut -f1)" test "$remote_head" = "$GITHUB_SHA" From c7bc168157ce6cc7339f6b94abf0bd049efc5816 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 14:46:56 +0000 Subject: [PATCH 151/173] docs(architecture): record plugin retry lifecycle authority --- ...r-architecture-plugin-retry-currentness.py | 18 -------- ...-architecture-plugin-retry-currentness.yml | 43 ------------------- ARCHITECTURE.md | 6 ++- 3 files changed, 4 insertions(+), 63 deletions(-) delete mode 100644 .github/scripts/repair-architecture-plugin-retry-currentness.py delete mode 100644 .github/workflows/repair-architecture-plugin-retry-currentness.yml diff --git a/.github/scripts/repair-architecture-plugin-retry-currentness.py b/.github/scripts/repair-architecture-plugin-retry-currentness.py deleted file mode 100644 index c3aaa8210..000000000 --- a/.github/scripts/repair-architecture-plugin-retry-currentness.py +++ /dev/null @@ -1,18 +0,0 @@ -from pathlib import Path - -path = Path("ARCHITECTURE.md") -text = path.read_text() -old_claim = """Draft PR #253 is the direct child of #252 and establishes deterministic Integration-owned delivery-attempt claim/lease authority without adding provider execution or outbound HTTPS. `life-os.plugin-delivery-attempt-claim.v1` returns an opaque UUIDv4 claim token only to the worker while persistence retains only its SHA-256 digest, exact claim start/expiry evidence and the atomic retry-budget transition. Application and repository validation bound a lease to 30–3600 seconds. A durable-bound review found migration `0007_plugin_delivery_attempt_claim_lease.sql` did not yet enforce the same lower/upper bounds: regression `32c02f3ca2ead7617b08d35973d518b25ed4f691`, isolated at reality-RED `400e88163ca9d878806aaee11ef8ca2917ec33dc`, demonstrated real migrated PostgreSQL accepting 29.999-second and 3600.001-second leases. Minimum repair `e25a96d902adc6d6a6422ca4bc114c5bf189f47f` adds the same inclusive 30–3600 second database invariant. Exact proof head `94ef04e854d2480f4520243521bdd9a7550889ea`, run `34217754447`, job `102033443629`, completed GREEN on Ubuntu 24.04/PostgreSQL 16 across retained capability/persistence/durable-bound REDs, formatting/diff hygiene, focused claim/lease acceptance, Integration typecheck and the complete Integration suite. Current #253 exact `62b6fd2c3388f6038641945df34afedd5b5f3b78` removes only the purpose-complete verifier. This is active-PR evidence only and does not move network authority into LifeOS. - -""" -new_claim = """Draft PR #253 is the direct child of #252 and establishes deterministic Integration-owned delivery-attempt claim/lease authority without adding provider execution or outbound HTTPS. `life-os.plugin-delivery-attempt-claim.v1` returns an opaque UUIDv4 claim token only to the worker while persistence retains only its SHA-256 digest, exact claim start/expiry evidence and the atomic retry-budget transition. Application and repository validation bound a lease to 30–3600 seconds. A durable-bound review found migration `0007_plugin_delivery_attempt_claim_lease.sql` did not yet enforce the same lower/upper bounds: regression `32c02f3ca2ead7617b08d35973d518b25ed4f691`, isolated at reality-RED `400e88163ca9d878806aaee11ef8ca2917ec33dc`, demonstrated real migrated PostgreSQL accepting 29.999-second and 3600.001-second leases. Minimum repair `e25a96d902adc6d6a6422ca4bc114c5bf189f47f` adds the same inclusive 30–3600 second database invariant. Its later hostile-envelope and application-context repairs retain fixed credential-free failure boundaries. Current #253 exact `8252575a510254883cb62c44198cb665daa0d0b5` removes only completed/exploratory verifier work after the retained exact GREEN lineage. This is active-PR evidence only and does not move network authority into LifeOS. - -Draft PR #254 is the direct #253 child and adds the Integration-owned claim-bound retry/backoff transition without provider execution or outbound HTTPS. Reality RED `a588428d105c2fd8f2078bcd807cb4f895e760a5` / run `34232017394` proved terminal `attempt_limit` evidence could be accepted without proving the durable row's configured `max_attempts`; the causal repair carries `max_attempts` through repository/application durable evidence and requires pending `attempt_number < max_attempts` and terminal equality. Exact `43bcd6dc73d108b5690b29541ecb91ff074e7d5a` / run `34236816710` / job `102096552714` then passed the focused application/repository gates and failed at the intended real PostgreSQL boundary because migrations 0006/0007 admitted only admission/active-claim row shapes. Migration `0008_plugin_delivery_attempt_retry_transition.sql` is the minimum service-owned schema evolution: it preserves per-row retry budgets and the finite claim-lease constraints while admitting explicit initial-admission, active-claim, claimless scheduled-retry and terminal-exhaustion shapes. Exact proof head `ca22c71e4f2ec11de6539df79632376d4134f90a`, run `34237354956`, job `102098403313`, completed GREEN on Ubuntu 24.04/PostgreSQL 16 across frozen install, formatting/diff hygiene, Plugin SDK build, focused retry acceptance, real PostgreSQL retry/exhaustion acceptance, Integration typecheck and the complete Integration suite. Current #254 exact `edc79d1291025b8787a9ccf16c39a10df4157023` removes only the purpose-complete verifier and remains Draft/unshipped. - -""" -old_gap = """Issue #130 remains **Partial**. Protected main does not yet contain this Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission and #253 adds deterministic finite worker claim/lease; bounded retry/backoff, append-only sanitized outcomes, dead-letter/pause/resume, per-attempt revocation fencing, operator-visible status and restart/recovery remain successor work. No active LifeOS PR supplies complete host-authorized outbound HTTPS. The network boundary still requires immutable released/versioned canonical egress authority for connect-time DNS/IP and rebinding controls, redirect/proxy policy, bounded response/time behavior and non-leaking failures. Durable origin identity and durable delivery identity are not network authorization. Manifests and stored installations never self-authorize network capabilities.""" -new_gap = """Issue #130 remains **Partial**. Protected main does not yet contain this Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 adds deterministic finite worker claim/lease, and #254 adds claim-bound bounded retry/backoff plus terminal retry-budget exhaustion. Append-only sanitized execution outcomes beyond retry scheduling, dead-letter/pause/resume, per-attempt revocation fencing, operator-visible status, restart/recovery, and provider execution remain successor work. No active LifeOS PR supplies complete host-authorized outbound HTTPS. The network boundary still requires immutable released/versioned canonical egress authority for connect-time DNS/IP and rebinding controls, redirect/proxy policy, bounded response/time behavior and non-leaking failures. Durable origin identity, durable delivery identity, and retry lifecycle identity are not network authorization. Manifests and stored installations never self-authorize network capabilities.""" - -if text.count(old_claim) != 1 or text.count(old_gap) != 1: - raise SystemExit("architecture bounded replacement target is not unique") -path.write_text(text.replace(old_claim, new_claim, 1).replace(old_gap, new_gap, 1)) diff --git a/.github/workflows/repair-architecture-plugin-retry-currentness.yml b/.github/workflows/repair-architecture-plugin-retry-currentness.yml deleted file mode 100644 index e489f40e0..000000000 --- a/.github/workflows/repair-architecture-plugin-retry-currentness.yml +++ /dev/null @@ -1,43 +0,0 @@ -name: Repair architecture plugin retry currentness - -on: - push: - branches: - - docs/canonical-product-architecture-mainline - -permissions: - contents: write - -concurrency: - group: repair-architecture-plugin-retry-currentness - cancel-in-progress: true - -jobs: - repair: - runs-on: ubuntu-24.04 - timeout-minutes: 10 - steps: - - name: Checkout exact writer input - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - with: - ref: ${{ github.sha }} - fetch-depth: 2 - - - name: Apply bounded repair and self-retire - shell: bash - run: | - set -Eeuo pipefail - remote_head="$(git ls-remote origin refs/heads/docs/canonical-product-architecture-mainline | cut -f1)" - test "$remote_head" = "$GITHUB_SHA" - python3 .github/scripts/repair-architecture-plugin-retry-currentness.py - git diff --check - rm .github/scripts/repair-architecture-plugin-retry-currentness.py - rm .github/workflows/repair-architecture-plugin-retry-currentness.yml - git diff --check - git config user.name 'Seongho Bae' - git config user.email 'me@seonghobae.me' - git add ARCHITECTURE.md .github/scripts/repair-architecture-plugin-retry-currentness.py .github/workflows/repair-architecture-plugin-retry-currentness.yml - git commit -m 'docs(architecture): record plugin retry lifecycle authority' - remote_head="$(git ls-remote origin refs/heads/docs/canonical-product-architecture-mainline | cut -f1)" - test "$remote_head" = "$GITHUB_SHA" - git push origin HEAD:refs/heads/docs/canonical-product-architecture-mainline diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 467d7f181..0b361fa04 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -113,9 +113,11 @@ Draft PR #251 is stacked exactly on #250 and retains the signed delivery-origin Draft PR #252 proceeds in parallel from #245 and establishes Integration-owned durable delivery-attempt admission without depending on mutable #250/#251 transport. It introduces opaque `life-os.plugin-delivery-attempt.v1` work identity plus service-owned PostgreSQL migration/store, exact idempotency scope, bounded retry budget metadata, and a durable INSERT-time fence requiring both the exact active origin grant and active installation under matching workspace/user authority. The table intentionally stores no origin copy, credential, request payload, response body, or network authorization. Exact review-repair proof head `9e6e88e49e14d0b2d247e747df968e2494697666` completed hosted run `34209314512`, job `102006262067`, GREEN on Ubuntu 24.04/PostgreSQL 16 after replaying the timestamp, PostgreSQL/TLS target, IPv6 loopback and table-contract RED ancestors for their intended reasons. A subsequent repository-boundary review found that SQL result envelopes, durable row getters and stored timestamp conversion could throw native dependency detail before the fixed persistence-evidence boundary. Reality RED `b390f37ed651ce2d9cb74d862fbae02641f3a55f` demonstrates that hostile evidence leak; minimum repair `e9a8b212b24b4914069a48a113d118ff4e4c0a56` snapshots and bounds those evidence reads without changing SQL/schema/admission authority. Exact proof head `ec2353a003c15c9f464b5d5d2454d3593427d768`, run `34213508199`, job `102019765395`, completed GREEN with the focused delivery-attempt suite 24/24, Integration typecheck and the complete Integration suite 403 passed / 3 environment-dependent skipped across 65 files. CHANGELOG descendant `fe51a79c1e19cc7fb14e5296f04b3f91b41bf535` also completed exact run `34213937828` / job `102021136219` GREEN. Current #252 head `9ed7847d3106d9418e1ff6e04e45c1c7d84d0b0d` removes only the purpose-complete hostile-SQL verifier. This remains active-PR evidence, not protected shipped truth. -Draft PR #253 is the direct child of #252 and establishes deterministic Integration-owned delivery-attempt claim/lease authority without adding provider execution or outbound HTTPS. `life-os.plugin-delivery-attempt-claim.v1` returns an opaque UUIDv4 claim token only to the worker while persistence retains only its SHA-256 digest, exact claim start/expiry evidence and the atomic retry-budget transition. Application and repository validation bound a lease to 30–3600 seconds. A durable-bound review found migration `0007_plugin_delivery_attempt_claim_lease.sql` did not yet enforce the same lower/upper bounds: regression `32c02f3ca2ead7617b08d35973d518b25ed4f691`, isolated at reality-RED `400e88163ca9d878806aaee11ef8ca2917ec33dc`, demonstrated real migrated PostgreSQL accepting 29.999-second and 3600.001-second leases. Minimum repair `e25a96d902adc6d6a6422ca4bc114c5bf189f47f` adds the same inclusive 30–3600 second database invariant. Exact proof head `94ef04e854d2480f4520243521bdd9a7550889ea`, run `34217754447`, job `102033443629`, completed GREEN on Ubuntu 24.04/PostgreSQL 16 across retained capability/persistence/durable-bound REDs, formatting/diff hygiene, focused claim/lease acceptance, Integration typecheck and the complete Integration suite. Current #253 exact `62b6fd2c3388f6038641945df34afedd5b5f3b78` removes only the purpose-complete verifier. This is active-PR evidence only and does not move network authority into LifeOS. +Draft PR #253 is the direct child of #252 and establishes deterministic Integration-owned delivery-attempt claim/lease authority without adding provider execution or outbound HTTPS. `life-os.plugin-delivery-attempt-claim.v1` returns an opaque UUIDv4 claim token only to the worker while persistence retains only its SHA-256 digest, exact claim start/expiry evidence and the atomic retry-budget transition. Application and repository validation bound a lease to 30–3600 seconds. A durable-bound review found migration `0007_plugin_delivery_attempt_claim_lease.sql` did not yet enforce the same lower/upper bounds: regression `32c02f3ca2ead7617b08d35973d518b25ed4f691`, isolated at reality-RED `400e88163ca9d878806aaee11ef8ca2917ec33dc`, demonstrated real migrated PostgreSQL accepting 29.999-second and 3600.001-second leases. Minimum repair `e25a96d902adc6d6a6422ca4bc114c5bf189f47f` adds the same inclusive 30–3600 second database invariant. Its later hostile-envelope and application-context repairs retain fixed credential-free failure boundaries. Current #253 exact `8252575a510254883cb62c44198cb665daa0d0b5` removes only completed/exploratory verifier work after the retained exact GREEN lineage. This is active-PR evidence only and does not move network authority into LifeOS. -Issue #130 remains **Partial**. Protected main does not yet contain this Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission and #253 adds deterministic finite worker claim/lease; bounded retry/backoff, append-only sanitized outcomes, dead-letter/pause/resume, per-attempt revocation fencing, operator-visible status and restart/recovery remain successor work. No active LifeOS PR supplies complete host-authorized outbound HTTPS. The network boundary still requires immutable released/versioned canonical egress authority for connect-time DNS/IP and rebinding controls, redirect/proxy policy, bounded response/time behavior and non-leaking failures. Durable origin identity and durable delivery identity are not network authorization. Manifests and stored installations never self-authorize network capabilities. +Draft PR #254 is the direct #253 child and adds the Integration-owned claim-bound retry/backoff transition without provider execution or outbound HTTPS. Reality RED `a588428d105c2fd8f2078bcd807cb4f895e760a5` / run `34232017394` proved terminal `attempt_limit` evidence could be accepted without proving the durable row's configured `max_attempts`; the causal repair carries `max_attempts` through repository/application durable evidence and requires pending `attempt_number < max_attempts` and terminal equality. Exact `43bcd6dc73d108b5690b29541ecb91ff074e7d5a` / run `34236816710` / job `102096552714` then passed the focused application/repository gates and failed at the intended real PostgreSQL boundary because migrations 0006/0007 admitted only admission/active-claim row shapes. Migration `0008_plugin_delivery_attempt_retry_transition.sql` is the minimum service-owned schema evolution: it preserves per-row retry budgets and the finite claim-lease constraints while admitting explicit initial-admission, active-claim, claimless scheduled-retry and terminal-exhaustion shapes. Exact proof head `ca22c71e4f2ec11de6539df79632376d4134f90a`, run `34237354956`, job `102098403313`, completed GREEN on Ubuntu 24.04/PostgreSQL 16 across frozen install, formatting/diff hygiene, Plugin SDK build, focused retry acceptance, real PostgreSQL retry/exhaustion acceptance, Integration typecheck and the complete Integration suite. Current #254 exact `edc79d1291025b8787a9ccf16c39a10df4157023` removes only the purpose-complete verifier and remains Draft/unshipped. + +Issue #130 remains **Partial**. Protected main does not yet contain this Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 adds deterministic finite worker claim/lease, and #254 adds claim-bound bounded retry/backoff plus terminal retry-budget exhaustion. Append-only sanitized execution outcomes beyond retry scheduling, dead-letter/pause/resume, per-attempt revocation fencing, operator-visible status, restart/recovery, and provider execution remain successor work. No active LifeOS PR supplies complete host-authorized outbound HTTPS. The network boundary still requires immutable released/versioned canonical egress authority for connect-time DNS/IP and rebinding controls, redirect/proxy policy, bounded response/time behavior and non-leaking failures. Durable origin identity, durable delivery identity, and retry lifecycle identity are not network authorization. Manifests and stored installations never self-authorize network capabilities. ## 6. AI proposal boundary From ed03809ba942d717f050766e55253061d76bd955 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 9 Sep 2026 01:29:27 +0900 Subject: [PATCH 152/173] docs: stage plugin outcome architecture currentness --- ...lugin-outcome-architecture-currentness.yml | 61 +++++++++++++++++++ 1 file changed, 61 insertions(+) create mode 100644 .github/workflows/write-plugin-outcome-architecture-currentness.yml diff --git a/.github/workflows/write-plugin-outcome-architecture-currentness.yml b/.github/workflows/write-plugin-outcome-architecture-currentness.yml new file mode 100644 index 000000000..ce55ae9b4 --- /dev/null +++ b/.github/workflows/write-plugin-outcome-architecture-currentness.yml @@ -0,0 +1,61 @@ +name: Write plugin outcome architecture currentness + +on: + push: + branches: + - docs/canonical-product-architecture-mainline + +permissions: + contents: write + +concurrency: + group: write-plugin-outcome-architecture-currentness-${{ github.ref }} + cancel-in-progress: true + +jobs: + write-and-retire: + runs-on: ubuntu-24.04 + timeout-minutes: 10 + steps: + - name: Checkout exact pushed head + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + fetch-depth: 2 + ref: ${{ github.sha }} + + - name: Replace only terminal Plugin delivery currentness block + shell: bash + run: | + set -Eeuo pipefail + python3 - <<'PY' + from pathlib import Path + + path = Path('ARCHITECTURE.md') + text = path.read_text() + start = 'Draft PR #254 is the direct #253 child' + end = 'Manifests and stored installations never self-authorize network capabilities.' + if text.count(start) != 1 or text.count(end) != 1: + raise SystemExit('bounded Plugin currentness markers are not unique') + a = text.index(start) + b = text.index(end, a) + len(end) + replacement = '''Draft PR #254 is the direct #253 child and adds Integration-owned claim-bound retry/backoff without provider execution or outbound HTTPS. Migration `0008_plugin_delivery_attempt_retry_transition.sql` preserves row-owned retry budgets and finite claim leases while admitting only explicit admission, active-claim, scheduled-retry and terminal-exhaustion shapes. Exact proof head `ca22c71e4f2ec11de6539df79632376d4134f90a`, run `34237354956`, job `102098403313`, completed GREEN on Ubuntu 24.04/PostgreSQL 16 across frozen install, formatting/diff hygiene, Plugin SDK build, focused retry acceptance, real PostgreSQL retry/exhaustion acceptance, Integration typecheck and the complete Integration suite. Current #254 exact `edc79d1291025b8787a9ccf16c39a10df4157023` removes only the purpose verifier and remains Draft/unshipped.\n\nDraft PR #255 is the direct #254 child and owns append-only sanitized retry/exhaustion outcome evidence. Migration `0009_plugin_delivery_attempt_outcome_record.sql` keeps provider payloads, response bodies, credentials, origin URI and network authority out of the ledger; `(delivery_id, attempt_number)` plus a bounded outcome discriminator and occurrence instant are retained as same-database lifecycle evidence. After the original missing-table RED and claim-identity/chronology repair, fresh review proved that UPDATE/DELETE immutability alone did not prevent a direct INSERT from fabricating immutable-looking evidence. Regression exact `f113c09dd6f818471051f74440708363bf289103`, run `34250512787`, job `102143453765`, passed checkout/PostgreSQL/frozen-install/format/build gates and failed at real PostgreSQL acceptance for that direct-forgery boundary. Minimum migration-only repair `885163b16c0904a07bb217725e7ab4e71671aac6` adds a `BEFORE INSERT` source-transition guard: accepted evidence must be emitted from nested trigger execution and match the exact post-consumption attempt number, outcome, occurrence time, cleared claim state and retry/terminal lifecycle shape. Exact run `34250976172`, job `102145020949`, completed GREEN across original + forgery real-PostgreSQL acceptance, Integration typecheck and the complete Integration suite. Current #255 exact `102b4b9360897c69c598d2a34397412ac1c36f51` removes only the purpose-complete verifier after that proven head and remains active-PR evidence rather than protected shipped truth.\n\nIssue #130 remains **Partial**. Protected main does not yet contain this Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 deterministic finite worker claim/lease, #254 claim-bound bounded retry/backoff and #255 append-only source-bound outcome evidence. Dead-letter/pause/resume, the per-attempt revocation fence immediately before execution, operator-visible status, restart/recovery and provider execution remain successor work. No active LifeOS PR supplies complete host-authorized outbound HTTPS. Fresh `ContextualWisdomLab/EgressWeave` release inventory is empty, so the network boundary remains fail closed rather than consuming mutable sibling source. Durable origin/delivery/claim/retry/outcome identity is not network authorization. Manifests and stored installations never self-authorize network capabilities.''' + path.write_text(text[:a] + replacement + text[b:]) + PY + git diff --check + test "$(git diff --name-only | tr '\n' ' ')" = "ARCHITECTURE.md " + + - name: Retire writer and publish ordinary descendant + shell: bash + env: + EXPECTED_HEAD: ${{ github.sha }} + BRANCH_NAME: ${{ github.ref_name }} + run: | + set -Eeuo pipefail + remote_head="$(git ls-remote origin "refs/heads/${BRANCH_NAME}" | cut -f1)" + test "${remote_head}" = "${EXPECTED_HEAD}" + git config user.name 'github-actions[bot]' + git config user.email '41898282+github-actions[bot]@users.noreply.github.com' + git add ARCHITECTURE.md + git rm .github/workflows/write-plugin-outcome-architecture-currentness.yml + git commit -m 'docs: record plugin outcome source-transition architecture' + git push origin "HEAD:${BRANCH_NAME}" From 8fbba54afc6723f404d5944fd292e5c91bcf1048 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 8 Sep 2026 16:30:28 +0000 Subject: [PATCH 153/173] docs: record plugin outcome source-transition architecture --- ...lugin-outcome-architecture-currentness.yml | 61 ------------------- ARCHITECTURE.md | 6 +- 2 files changed, 4 insertions(+), 63 deletions(-) delete mode 100644 .github/workflows/write-plugin-outcome-architecture-currentness.yml diff --git a/.github/workflows/write-plugin-outcome-architecture-currentness.yml b/.github/workflows/write-plugin-outcome-architecture-currentness.yml deleted file mode 100644 index ce55ae9b4..000000000 --- a/.github/workflows/write-plugin-outcome-architecture-currentness.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Write plugin outcome architecture currentness - -on: - push: - branches: - - docs/canonical-product-architecture-mainline - -permissions: - contents: write - -concurrency: - group: write-plugin-outcome-architecture-currentness-${{ github.ref }} - cancel-in-progress: true - -jobs: - write-and-retire: - runs-on: ubuntu-24.04 - timeout-minutes: 10 - steps: - - name: Checkout exact pushed head - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - with: - fetch-depth: 2 - ref: ${{ github.sha }} - - - name: Replace only terminal Plugin delivery currentness block - shell: bash - run: | - set -Eeuo pipefail - python3 - <<'PY' - from pathlib import Path - - path = Path('ARCHITECTURE.md') - text = path.read_text() - start = 'Draft PR #254 is the direct #253 child' - end = 'Manifests and stored installations never self-authorize network capabilities.' - if text.count(start) != 1 or text.count(end) != 1: - raise SystemExit('bounded Plugin currentness markers are not unique') - a = text.index(start) - b = text.index(end, a) + len(end) - replacement = '''Draft PR #254 is the direct #253 child and adds Integration-owned claim-bound retry/backoff without provider execution or outbound HTTPS. Migration `0008_plugin_delivery_attempt_retry_transition.sql` preserves row-owned retry budgets and finite claim leases while admitting only explicit admission, active-claim, scheduled-retry and terminal-exhaustion shapes. Exact proof head `ca22c71e4f2ec11de6539df79632376d4134f90a`, run `34237354956`, job `102098403313`, completed GREEN on Ubuntu 24.04/PostgreSQL 16 across frozen install, formatting/diff hygiene, Plugin SDK build, focused retry acceptance, real PostgreSQL retry/exhaustion acceptance, Integration typecheck and the complete Integration suite. Current #254 exact `edc79d1291025b8787a9ccf16c39a10df4157023` removes only the purpose verifier and remains Draft/unshipped.\n\nDraft PR #255 is the direct #254 child and owns append-only sanitized retry/exhaustion outcome evidence. Migration `0009_plugin_delivery_attempt_outcome_record.sql` keeps provider payloads, response bodies, credentials, origin URI and network authority out of the ledger; `(delivery_id, attempt_number)` plus a bounded outcome discriminator and occurrence instant are retained as same-database lifecycle evidence. After the original missing-table RED and claim-identity/chronology repair, fresh review proved that UPDATE/DELETE immutability alone did not prevent a direct INSERT from fabricating immutable-looking evidence. Regression exact `f113c09dd6f818471051f74440708363bf289103`, run `34250512787`, job `102143453765`, passed checkout/PostgreSQL/frozen-install/format/build gates and failed at real PostgreSQL acceptance for that direct-forgery boundary. Minimum migration-only repair `885163b16c0904a07bb217725e7ab4e71671aac6` adds a `BEFORE INSERT` source-transition guard: accepted evidence must be emitted from nested trigger execution and match the exact post-consumption attempt number, outcome, occurrence time, cleared claim state and retry/terminal lifecycle shape. Exact run `34250976172`, job `102145020949`, completed GREEN across original + forgery real-PostgreSQL acceptance, Integration typecheck and the complete Integration suite. Current #255 exact `102b4b9360897c69c598d2a34397412ac1c36f51` removes only the purpose-complete verifier after that proven head and remains active-PR evidence rather than protected shipped truth.\n\nIssue #130 remains **Partial**. Protected main does not yet contain this Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 deterministic finite worker claim/lease, #254 claim-bound bounded retry/backoff and #255 append-only source-bound outcome evidence. Dead-letter/pause/resume, the per-attempt revocation fence immediately before execution, operator-visible status, restart/recovery and provider execution remain successor work. No active LifeOS PR supplies complete host-authorized outbound HTTPS. Fresh `ContextualWisdomLab/EgressWeave` release inventory is empty, so the network boundary remains fail closed rather than consuming mutable sibling source. Durable origin/delivery/claim/retry/outcome identity is not network authorization. Manifests and stored installations never self-authorize network capabilities.''' - path.write_text(text[:a] + replacement + text[b:]) - PY - git diff --check - test "$(git diff --name-only | tr '\n' ' ')" = "ARCHITECTURE.md " - - - name: Retire writer and publish ordinary descendant - shell: bash - env: - EXPECTED_HEAD: ${{ github.sha }} - BRANCH_NAME: ${{ github.ref_name }} - run: | - set -Eeuo pipefail - remote_head="$(git ls-remote origin "refs/heads/${BRANCH_NAME}" | cut -f1)" - test "${remote_head}" = "${EXPECTED_HEAD}" - git config user.name 'github-actions[bot]' - git config user.email '41898282+github-actions[bot]@users.noreply.github.com' - git add ARCHITECTURE.md - git rm .github/workflows/write-plugin-outcome-architecture-currentness.yml - git commit -m 'docs: record plugin outcome source-transition architecture' - git push origin "HEAD:${BRANCH_NAME}" diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 0b361fa04..6e06aa60b 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -115,9 +115,11 @@ Draft PR #252 proceeds in parallel from #245 and establishes Integration-owned d Draft PR #253 is the direct child of #252 and establishes deterministic Integration-owned delivery-attempt claim/lease authority without adding provider execution or outbound HTTPS. `life-os.plugin-delivery-attempt-claim.v1` returns an opaque UUIDv4 claim token only to the worker while persistence retains only its SHA-256 digest, exact claim start/expiry evidence and the atomic retry-budget transition. Application and repository validation bound a lease to 30–3600 seconds. A durable-bound review found migration `0007_plugin_delivery_attempt_claim_lease.sql` did not yet enforce the same lower/upper bounds: regression `32c02f3ca2ead7617b08d35973d518b25ed4f691`, isolated at reality-RED `400e88163ca9d878806aaee11ef8ca2917ec33dc`, demonstrated real migrated PostgreSQL accepting 29.999-second and 3600.001-second leases. Minimum repair `e25a96d902adc6d6a6422ca4bc114c5bf189f47f` adds the same inclusive 30–3600 second database invariant. Its later hostile-envelope and application-context repairs retain fixed credential-free failure boundaries. Current #253 exact `8252575a510254883cb62c44198cb665daa0d0b5` removes only completed/exploratory verifier work after the retained exact GREEN lineage. This is active-PR evidence only and does not move network authority into LifeOS. -Draft PR #254 is the direct #253 child and adds the Integration-owned claim-bound retry/backoff transition without provider execution or outbound HTTPS. Reality RED `a588428d105c2fd8f2078bcd807cb4f895e760a5` / run `34232017394` proved terminal `attempt_limit` evidence could be accepted without proving the durable row's configured `max_attempts`; the causal repair carries `max_attempts` through repository/application durable evidence and requires pending `attempt_number < max_attempts` and terminal equality. Exact `43bcd6dc73d108b5690b29541ecb91ff074e7d5a` / run `34236816710` / job `102096552714` then passed the focused application/repository gates and failed at the intended real PostgreSQL boundary because migrations 0006/0007 admitted only admission/active-claim row shapes. Migration `0008_plugin_delivery_attempt_retry_transition.sql` is the minimum service-owned schema evolution: it preserves per-row retry budgets and the finite claim-lease constraints while admitting explicit initial-admission, active-claim, claimless scheduled-retry and terminal-exhaustion shapes. Exact proof head `ca22c71e4f2ec11de6539df79632376d4134f90a`, run `34237354956`, job `102098403313`, completed GREEN on Ubuntu 24.04/PostgreSQL 16 across frozen install, formatting/diff hygiene, Plugin SDK build, focused retry acceptance, real PostgreSQL retry/exhaustion acceptance, Integration typecheck and the complete Integration suite. Current #254 exact `edc79d1291025b8787a9ccf16c39a10df4157023` removes only the purpose-complete verifier and remains Draft/unshipped. +Draft PR #254 is the direct #253 child and adds Integration-owned claim-bound retry/backoff without provider execution or outbound HTTPS. Migration `0008_plugin_delivery_attempt_retry_transition.sql` preserves row-owned retry budgets and finite claim leases while admitting only explicit admission, active-claim, scheduled-retry and terminal-exhaustion shapes. Exact proof head `ca22c71e4f2ec11de6539df79632376d4134f90a`, run `34237354956`, job `102098403313`, completed GREEN on Ubuntu 24.04/PostgreSQL 16 across frozen install, formatting/diff hygiene, Plugin SDK build, focused retry acceptance, real PostgreSQL retry/exhaustion acceptance, Integration typecheck and the complete Integration suite. Current #254 exact `edc79d1291025b8787a9ccf16c39a10df4157023` removes only the purpose verifier and remains Draft/unshipped. -Issue #130 remains **Partial**. Protected main does not yet contain this Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 adds deterministic finite worker claim/lease, and #254 adds claim-bound bounded retry/backoff plus terminal retry-budget exhaustion. Append-only sanitized execution outcomes beyond retry scheduling, dead-letter/pause/resume, per-attempt revocation fencing, operator-visible status, restart/recovery, and provider execution remain successor work. No active LifeOS PR supplies complete host-authorized outbound HTTPS. The network boundary still requires immutable released/versioned canonical egress authority for connect-time DNS/IP and rebinding controls, redirect/proxy policy, bounded response/time behavior and non-leaking failures. Durable origin identity, durable delivery identity, and retry lifecycle identity are not network authorization. Manifests and stored installations never self-authorize network capabilities. +Draft PR #255 is the direct #254 child and owns append-only sanitized retry/exhaustion outcome evidence. Migration `0009_plugin_delivery_attempt_outcome_record.sql` keeps provider payloads, response bodies, credentials, origin URI and network authority out of the ledger; `(delivery_id, attempt_number)` plus a bounded outcome discriminator and occurrence instant are retained as same-database lifecycle evidence. After the original missing-table RED and claim-identity/chronology repair, fresh review proved that UPDATE/DELETE immutability alone did not prevent a direct INSERT from fabricating immutable-looking evidence. Regression exact `f113c09dd6f818471051f74440708363bf289103`, run `34250512787`, job `102143453765`, passed checkout/PostgreSQL/frozen-install/format/build gates and failed at real PostgreSQL acceptance for that direct-forgery boundary. Minimum migration-only repair `885163b16c0904a07bb217725e7ab4e71671aac6` adds a `BEFORE INSERT` source-transition guard: accepted evidence must be emitted from nested trigger execution and match the exact post-consumption attempt number, outcome, occurrence time, cleared claim state and retry/terminal lifecycle shape. Exact run `34250976172`, job `102145020949`, completed GREEN across original + forgery real-PostgreSQL acceptance, Integration typecheck and the complete Integration suite. Current #255 exact `102b4b9360897c69c598d2a34397412ac1c36f51` removes only the purpose-complete verifier after that proven head and remains active-PR evidence rather than protected shipped truth. + +Issue #130 remains **Partial**. Protected main does not yet contain this Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 deterministic finite worker claim/lease, #254 claim-bound bounded retry/backoff and #255 append-only source-bound outcome evidence. Dead-letter/pause/resume, the per-attempt revocation fence immediately before execution, operator-visible status, restart/recovery and provider execution remain successor work. No active LifeOS PR supplies complete host-authorized outbound HTTPS. Fresh `ContextualWisdomLab/EgressWeave` release inventory is empty, so the network boundary remains fail closed rather than consuming mutable sibling source. Durable origin/delivery/claim/retry/outcome identity is not network authorization. Manifests and stored installations never self-authorize network capabilities. ## 6. AI proposal boundary From d8148aa52ce5dc66f9db2399526862cdf53d1c06 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 9 Sep 2026 01:42:53 +0900 Subject: [PATCH 154/173] docs: schedule outcome truncation architecture currentness --- ...come-truncate-architecture-currentness.yml | 61 +++++++++++++++++++ 1 file changed, 61 insertions(+) create mode 100644 .github/workflows/write-plugin-outcome-truncate-architecture-currentness.yml diff --git a/.github/workflows/write-plugin-outcome-truncate-architecture-currentness.yml b/.github/workflows/write-plugin-outcome-truncate-architecture-currentness.yml new file mode 100644 index 000000000..7fa9d5578 --- /dev/null +++ b/.github/workflows/write-plugin-outcome-truncate-architecture-currentness.yml @@ -0,0 +1,61 @@ +name: Write plugin outcome truncation architecture currentness + +on: + push: + branches: + - docs/canonical-product-architecture-mainline + +permissions: + contents: write + +concurrency: + group: write-plugin-outcome-truncate-architecture-currentness-${{ github.ref }} + cancel-in-progress: true + +jobs: + write-and-retire: + runs-on: ubuntu-24.04 + timeout-minutes: 10 + steps: + - name: Checkout exact pushed head + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + fetch-depth: 2 + ref: ${{ github.sha }} + + - name: Replace only terminal Plugin delivery currentness block + shell: bash + run: | + set -Eeuo pipefail + python3 - <<'PY' + from pathlib import Path + + path = Path('ARCHITECTURE.md') + text = path.read_text() + start = 'Draft PR #254 is the direct #253 child' + end = 'Manifests and stored installations never self-authorize network capabilities.' + if text.count(start) != 1 or text.count(end) != 1: + raise SystemExit('bounded Plugin currentness markers are not unique') + a = text.index(start) + b = text.index(end, a) + len(end) + replacement = '''Draft PR #254 is the direct #253 child and adds Integration-owned claim-bound retry/backoff without provider execution or outbound HTTPS. Migration `0008_plugin_delivery_attempt_retry_transition.sql` preserves row-owned retry budgets and finite claim leases while admitting only explicit admission, active-claim, scheduled-retry and terminal-exhaustion shapes. Exact proof head `ca22c71e4f2ec11de6539df79632376d4134f90a`, run `34237354956`, job `102098403313`, completed GREEN on Ubuntu 24.04/PostgreSQL 16 across frozen install, formatting/diff hygiene, Plugin SDK build, focused retry acceptance, real PostgreSQL retry/exhaustion acceptance, Integration typecheck and the complete Integration suite. Current #254 exact `edc79d1291025b8787a9ccf16c39a10df4157023` removes only the purpose verifier and remains Draft/unshipped.\n\nDraft PR #255 is the direct #254 child and owns append-only sanitized retry/exhaustion outcome evidence. Migration `0009_plugin_delivery_attempt_outcome_record.sql` keeps provider payloads, response bodies, credentials, origin URI and network authority out of the ledger; `(delivery_id, attempt_number)` plus a bounded outcome discriminator and occurrence instant are retained as same-database lifecycle evidence. After the missing-table and claim-binding repairs, source-transition review proved and repaired direct forged INSERT. A subsequent append-only review found row-level UPDATE/DELETE immutability still allowed PostgreSQL `TRUNCATE` to erase accepted evidence. Regression `675460dbc0803e188b4d49aed43eb51f2a683cd8` plus verifier exact `f728835cbb57efb6840cd97f96d1e9ef392546c0`, run `34252044527`, job `102148573723`, passed checkout/PostgreSQL/frozen-install/format/build gates and failed at real PostgreSQL acceptance exactly because TRUNCATE succeeded while the other six focused outcome tests passed. Minimum migration-only repair `d731abda5da6931a684c73b2786a276c4288ab29` adds a statement-level `BEFORE TRUNCATE` guard that reuses the fixed SQLSTATE `55000` append-only rejection function. Exact run `34252162271`, job `102148973258`, completed GREEN with focused outcome acceptance 7/7, Integration typecheck and the complete Integration suite 434 passed / 3 environment-dependent skipped across 74 files (72 passed / 2 skipped). Current #255 exact `e201b649cdea7d50ee2b856ac98a01d2b6c1368e` removes only the purpose-complete truncation verifier after that proven head and remains active-PR evidence rather than protected shipped truth.\n\nIssue #130 remains **Partial**. Protected main does not yet contain this Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 deterministic finite worker claim/lease, #254 claim-bound bounded retry/backoff and #255 append-only source-bound outcome evidence including UPDATE/DELETE/TRUNCATE mutation rejection. Dead-letter/pause/resume, the per-attempt revocation fence immediately before execution, operator-visible status, restart/recovery and provider execution remain successor work. No active LifeOS PR supplies complete host-authorized outbound HTTPS. Fresh `ContextualWisdomLab/EgressWeave` release inventory is empty, so the network boundary remains fail closed rather than consuming mutable sibling source. Durable origin/delivery/claim/retry/outcome identity is not network authorization. Manifests and stored installations never self-authorize network capabilities.''' + path.write_text(text[:a] + replacement + text[b:]) + PY + git diff --check + test "$(git diff --name-only | tr '\n' ' ')" = "ARCHITECTURE.md " + + - name: Retire writer and publish ordinary descendant + shell: bash + env: + EXPECTED_HEAD: ${{ github.sha }} + BRANCH_NAME: ${{ github.ref_name }} + run: | + set -Eeuo pipefail + remote_head="$(git ls-remote origin "refs/heads/${BRANCH_NAME}" | cut -f1)" + test "${remote_head}" = "${EXPECTED_HEAD}" + git config user.name 'github-actions[bot]' + git config user.email '41898282+github-actions[bot]@users.noreply.github.com' + git add ARCHITECTURE.md + git rm .github/workflows/write-plugin-outcome-truncate-architecture-currentness.yml + git commit -m 'docs: record outcome truncation architecture proof' + git push origin "HEAD:${BRANCH_NAME}" From 090e1ea982685269c83f1fe2c69ca5526db931cb Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 8 Sep 2026 16:43:02 +0000 Subject: [PATCH 155/173] docs: record outcome truncation architecture proof --- ...come-truncate-architecture-currentness.yml | 61 ------------------- ARCHITECTURE.md | 4 +- 2 files changed, 2 insertions(+), 63 deletions(-) delete mode 100644 .github/workflows/write-plugin-outcome-truncate-architecture-currentness.yml diff --git a/.github/workflows/write-plugin-outcome-truncate-architecture-currentness.yml b/.github/workflows/write-plugin-outcome-truncate-architecture-currentness.yml deleted file mode 100644 index 7fa9d5578..000000000 --- a/.github/workflows/write-plugin-outcome-truncate-architecture-currentness.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: Write plugin outcome truncation architecture currentness - -on: - push: - branches: - - docs/canonical-product-architecture-mainline - -permissions: - contents: write - -concurrency: - group: write-plugin-outcome-truncate-architecture-currentness-${{ github.ref }} - cancel-in-progress: true - -jobs: - write-and-retire: - runs-on: ubuntu-24.04 - timeout-minutes: 10 - steps: - - name: Checkout exact pushed head - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - with: - fetch-depth: 2 - ref: ${{ github.sha }} - - - name: Replace only terminal Plugin delivery currentness block - shell: bash - run: | - set -Eeuo pipefail - python3 - <<'PY' - from pathlib import Path - - path = Path('ARCHITECTURE.md') - text = path.read_text() - start = 'Draft PR #254 is the direct #253 child' - end = 'Manifests and stored installations never self-authorize network capabilities.' - if text.count(start) != 1 or text.count(end) != 1: - raise SystemExit('bounded Plugin currentness markers are not unique') - a = text.index(start) - b = text.index(end, a) + len(end) - replacement = '''Draft PR #254 is the direct #253 child and adds Integration-owned claim-bound retry/backoff without provider execution or outbound HTTPS. Migration `0008_plugin_delivery_attempt_retry_transition.sql` preserves row-owned retry budgets and finite claim leases while admitting only explicit admission, active-claim, scheduled-retry and terminal-exhaustion shapes. Exact proof head `ca22c71e4f2ec11de6539df79632376d4134f90a`, run `34237354956`, job `102098403313`, completed GREEN on Ubuntu 24.04/PostgreSQL 16 across frozen install, formatting/diff hygiene, Plugin SDK build, focused retry acceptance, real PostgreSQL retry/exhaustion acceptance, Integration typecheck and the complete Integration suite. Current #254 exact `edc79d1291025b8787a9ccf16c39a10df4157023` removes only the purpose verifier and remains Draft/unshipped.\n\nDraft PR #255 is the direct #254 child and owns append-only sanitized retry/exhaustion outcome evidence. Migration `0009_plugin_delivery_attempt_outcome_record.sql` keeps provider payloads, response bodies, credentials, origin URI and network authority out of the ledger; `(delivery_id, attempt_number)` plus a bounded outcome discriminator and occurrence instant are retained as same-database lifecycle evidence. After the missing-table and claim-binding repairs, source-transition review proved and repaired direct forged INSERT. A subsequent append-only review found row-level UPDATE/DELETE immutability still allowed PostgreSQL `TRUNCATE` to erase accepted evidence. Regression `675460dbc0803e188b4d49aed43eb51f2a683cd8` plus verifier exact `f728835cbb57efb6840cd97f96d1e9ef392546c0`, run `34252044527`, job `102148573723`, passed checkout/PostgreSQL/frozen-install/format/build gates and failed at real PostgreSQL acceptance exactly because TRUNCATE succeeded while the other six focused outcome tests passed. Minimum migration-only repair `d731abda5da6931a684c73b2786a276c4288ab29` adds a statement-level `BEFORE TRUNCATE` guard that reuses the fixed SQLSTATE `55000` append-only rejection function. Exact run `34252162271`, job `102148973258`, completed GREEN with focused outcome acceptance 7/7, Integration typecheck and the complete Integration suite 434 passed / 3 environment-dependent skipped across 74 files (72 passed / 2 skipped). Current #255 exact `e201b649cdea7d50ee2b856ac98a01d2b6c1368e` removes only the purpose-complete truncation verifier after that proven head and remains active-PR evidence rather than protected shipped truth.\n\nIssue #130 remains **Partial**. Protected main does not yet contain this Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 deterministic finite worker claim/lease, #254 claim-bound bounded retry/backoff and #255 append-only source-bound outcome evidence including UPDATE/DELETE/TRUNCATE mutation rejection. Dead-letter/pause/resume, the per-attempt revocation fence immediately before execution, operator-visible status, restart/recovery and provider execution remain successor work. No active LifeOS PR supplies complete host-authorized outbound HTTPS. Fresh `ContextualWisdomLab/EgressWeave` release inventory is empty, so the network boundary remains fail closed rather than consuming mutable sibling source. Durable origin/delivery/claim/retry/outcome identity is not network authorization. Manifests and stored installations never self-authorize network capabilities.''' - path.write_text(text[:a] + replacement + text[b:]) - PY - git diff --check - test "$(git diff --name-only | tr '\n' ' ')" = "ARCHITECTURE.md " - - - name: Retire writer and publish ordinary descendant - shell: bash - env: - EXPECTED_HEAD: ${{ github.sha }} - BRANCH_NAME: ${{ github.ref_name }} - run: | - set -Eeuo pipefail - remote_head="$(git ls-remote origin "refs/heads/${BRANCH_NAME}" | cut -f1)" - test "${remote_head}" = "${EXPECTED_HEAD}" - git config user.name 'github-actions[bot]' - git config user.email '41898282+github-actions[bot]@users.noreply.github.com' - git add ARCHITECTURE.md - git rm .github/workflows/write-plugin-outcome-truncate-architecture-currentness.yml - git commit -m 'docs: record outcome truncation architecture proof' - git push origin "HEAD:${BRANCH_NAME}" diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 6e06aa60b..e228f8fe2 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -117,9 +117,9 @@ Draft PR #253 is the direct child of #252 and establishes deterministic Integrat Draft PR #254 is the direct #253 child and adds Integration-owned claim-bound retry/backoff without provider execution or outbound HTTPS. Migration `0008_plugin_delivery_attempt_retry_transition.sql` preserves row-owned retry budgets and finite claim leases while admitting only explicit admission, active-claim, scheduled-retry and terminal-exhaustion shapes. Exact proof head `ca22c71e4f2ec11de6539df79632376d4134f90a`, run `34237354956`, job `102098403313`, completed GREEN on Ubuntu 24.04/PostgreSQL 16 across frozen install, formatting/diff hygiene, Plugin SDK build, focused retry acceptance, real PostgreSQL retry/exhaustion acceptance, Integration typecheck and the complete Integration suite. Current #254 exact `edc79d1291025b8787a9ccf16c39a10df4157023` removes only the purpose verifier and remains Draft/unshipped. -Draft PR #255 is the direct #254 child and owns append-only sanitized retry/exhaustion outcome evidence. Migration `0009_plugin_delivery_attempt_outcome_record.sql` keeps provider payloads, response bodies, credentials, origin URI and network authority out of the ledger; `(delivery_id, attempt_number)` plus a bounded outcome discriminator and occurrence instant are retained as same-database lifecycle evidence. After the original missing-table RED and claim-identity/chronology repair, fresh review proved that UPDATE/DELETE immutability alone did not prevent a direct INSERT from fabricating immutable-looking evidence. Regression exact `f113c09dd6f818471051f74440708363bf289103`, run `34250512787`, job `102143453765`, passed checkout/PostgreSQL/frozen-install/format/build gates and failed at real PostgreSQL acceptance for that direct-forgery boundary. Minimum migration-only repair `885163b16c0904a07bb217725e7ab4e71671aac6` adds a `BEFORE INSERT` source-transition guard: accepted evidence must be emitted from nested trigger execution and match the exact post-consumption attempt number, outcome, occurrence time, cleared claim state and retry/terminal lifecycle shape. Exact run `34250976172`, job `102145020949`, completed GREEN across original + forgery real-PostgreSQL acceptance, Integration typecheck and the complete Integration suite. Current #255 exact `102b4b9360897c69c598d2a34397412ac1c36f51` removes only the purpose-complete verifier after that proven head and remains active-PR evidence rather than protected shipped truth. +Draft PR #255 is the direct #254 child and owns append-only sanitized retry/exhaustion outcome evidence. Migration `0009_plugin_delivery_attempt_outcome_record.sql` keeps provider payloads, response bodies, credentials, origin URI and network authority out of the ledger; `(delivery_id, attempt_number)` plus a bounded outcome discriminator and occurrence instant are retained as same-database lifecycle evidence. After the missing-table and claim-binding repairs, source-transition review proved and repaired direct forged INSERT. A subsequent append-only review found row-level UPDATE/DELETE immutability still allowed PostgreSQL `TRUNCATE` to erase accepted evidence. Regression `675460dbc0803e188b4d49aed43eb51f2a683cd8` plus verifier exact `f728835cbb57efb6840cd97f96d1e9ef392546c0`, run `34252044527`, job `102148573723`, passed checkout/PostgreSQL/frozen-install/format/build gates and failed at real PostgreSQL acceptance exactly because TRUNCATE succeeded while the other six focused outcome tests passed. Minimum migration-only repair `d731abda5da6931a684c73b2786a276c4288ab29` adds a statement-level `BEFORE TRUNCATE` guard that reuses the fixed SQLSTATE `55000` append-only rejection function. Exact run `34252162271`, job `102148973258`, completed GREEN with focused outcome acceptance 7/7, Integration typecheck and the complete Integration suite 434 passed / 3 environment-dependent skipped across 74 files (72 passed / 2 skipped). Current #255 exact `e201b649cdea7d50ee2b856ac98a01d2b6c1368e` removes only the purpose-complete truncation verifier after that proven head and remains active-PR evidence rather than protected shipped truth. -Issue #130 remains **Partial**. Protected main does not yet contain this Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 deterministic finite worker claim/lease, #254 claim-bound bounded retry/backoff and #255 append-only source-bound outcome evidence. Dead-letter/pause/resume, the per-attempt revocation fence immediately before execution, operator-visible status, restart/recovery and provider execution remain successor work. No active LifeOS PR supplies complete host-authorized outbound HTTPS. Fresh `ContextualWisdomLab/EgressWeave` release inventory is empty, so the network boundary remains fail closed rather than consuming mutable sibling source. Durable origin/delivery/claim/retry/outcome identity is not network authorization. Manifests and stored installations never self-authorize network capabilities. +Issue #130 remains **Partial**. Protected main does not yet contain this Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 deterministic finite worker claim/lease, #254 claim-bound bounded retry/backoff and #255 append-only source-bound outcome evidence including UPDATE/DELETE/TRUNCATE mutation rejection. Dead-letter/pause/resume, the per-attempt revocation fence immediately before execution, operator-visible status, restart/recovery and provider execution remain successor work. No active LifeOS PR supplies complete host-authorized outbound HTTPS. Fresh `ContextualWisdomLab/EgressWeave` release inventory is empty, so the network boundary remains fail closed rather than consuming mutable sibling source. Durable origin/delivery/claim/retry/outcome identity is not network authorization. Manifests and stored installations never self-authorize network capabilities. ## 6. AI proposal boundary From a79f2c4f09c3849ae4530f87c08cf736276b74f6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 9 Sep 2026 03:21:14 +0900 Subject: [PATCH 156/173] docs(ci): refresh architecture currentness once --- ...efresh-lifeos-architecture-currentness.yml | 60 +++++++++++++++++++ 1 file changed, 60 insertions(+) create mode 100644 .github/workflows/refresh-lifeos-architecture-currentness.yml diff --git a/.github/workflows/refresh-lifeos-architecture-currentness.yml b/.github/workflows/refresh-lifeos-architecture-currentness.yml new file mode 100644 index 000000000..008c0a9c9 --- /dev/null +++ b/.github/workflows/refresh-lifeos-architecture-currentness.yml @@ -0,0 +1,60 @@ +name: Refresh LifeOS architecture currentness + +on: + push: + branches: + - docs/canonical-product-architecture-mainline + +permissions: + contents: write + +concurrency: + group: refresh-lifeos-architecture-currentness-${{ github.ref }} + cancel-in-progress: true + +jobs: + refresh: + runs-on: ubuntu-24.04 + timeout-minutes: 10 + steps: + - name: Checkout exact pushed head + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + persist-credentials: true + fetch-depth: 2 + ref: ${{ github.sha }} + + - name: Refuse stale branch publication + shell: bash + run: | + set -euo pipefail + remote_head="$(git ls-remote origin refs/heads/docs/canonical-product-architecture-mainline | cut -f1)" + test "$remote_head" = "$GITHUB_SHA" + + - name: Replace bounded Plugin terminal currentness block + shell: bash + run: | + python - <<'PY' + from pathlib import Path + + path = Path('ARCHITECTURE.md') + text = path.read_text() + start_marker = 'Draft PR #255 is the direct #254 child' + end_marker = '## 6. AI proposal boundary' + start = text.index(start_marker) + end = text.index(end_marker, start) + replacement = '''Draft PR #255 is the direct #254 child and owns append-only sanitized retry/exhaustion outcome evidence. Migration `0009_plugin_delivery_attempt_outcome_record.sql` keeps provider payloads, response bodies, credentials, origin URI and network authority out of the ledger. Its retained PostgreSQL lineage repairs missing-table admission, claim binding, direct forged INSERT, and UPDATE/DELETE/TRUNCATE immutability. Current #255 exact `e201b649cdea7d50ee2b856ac98a01d2b6c1368e` removes only its purpose verifier and remains active-PR evidence rather than protected shipped truth.\n\nDraft PR #256 is the direct #255 child and owns Integration-controlled pause/resume/dead-letter transitions plus a source-bound append-only `life-os.plugin-delivery-attempt-control.v1` evidence ledger. Pause cannot steal an active worker claim; resume retains retry identity; dead-letter is admitted only after real durable `attempt_limit` exhaustion and preserves the terminal instant. Direct forged inserts and UPDATE/DELETE/TRUNCATE mutation of accepted control evidence fail closed. Initial real-PostgreSQL durable-control RED `5d50c56ae714b7ca620f3c4b790002bcdf83aa8d` / run `34255006068` / job `102158492416` established the missing lifecycle; repaired exact `a576d3fd85e1f1d0845ed10200d1849b04c8f1b2` / run `34256983815` / job `102165175608` completed GREEN across focused control acceptance, Integration typecheck and the complete Integration suite.\n\nFresh review found that `control_sequence` could advance while the accepted control timestamp moved backward, producing durable sequence evidence with contradictory chronology. Real PostgreSQL RED `8f25181033b44d89dd08ed965d8d258410629e58` / run `34261784625` / job `102181270911` failed specifically at the backdated-resume regression after environment setup, frozen install, formatting/diff hygiene and Plugin SDK build passed. Forward migration `0011_plugin_delivery_attempt_control_chronology_guard.sql` adds only the missing non-decreasing `NEW.updated_at >= OLD.updated_at` transition invariant. Exact proof `c98734fcf50bfc197141aed6469fcf1e0adffcd6` / run `34261947610` / job `102181894242` completed GREEN across the real chronology regression, Integration typecheck and the complete Integration suite. Current #256 exact `0c6221e1fe32bf6594784219a7bd710ad0c1a993` removes only the purpose-complete chronology verifier.\n\nIssue #130 remains **Partial**. Protected main does not yet contain the Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 deterministic finite worker claim/lease, #254 claim-bound bounded retry/backoff, #255 append-only sanitized outcome evidence, and #256 durable pause/resume/dead-letter control evidence with non-decreasing chronology. The next LifeOS-owned execution boundary is a per-attempt revocation fence immediately before execution, followed by operator-visible status, restart/recovery and bounded provider execution. No active LifeOS PR supplies complete host-authorized outbound HTTPS. Outbound authority must come only from an immutable released/versioned canonical egress contract; otherwise the network boundary remains fail closed. Durable origin/delivery/claim/retry/outcome/control identity is not network authorization.\n\n''' + path.write_text(text[:start] + replacement + text[end:]) + PY + rm .github/workflows/refresh-lifeos-architecture-currentness.yml + git diff --check + + - name: Publish bounded source-current update and retire writer + shell: bash + run: | + set -euo pipefail + git config user.name 'LifeOS Maintainer' + git config user.email 'actions@users.noreply.github.com' + git add ARCHITECTURE.md .github/workflows/refresh-lifeos-architecture-currentness.yml + git commit -m 'docs: refresh Plugin delivery architecture currentness' + git push origin HEAD:docs/canonical-product-architecture-mainline From a297445672e4735e7e37170a301f5172fad3573c Mon Sep 17 00:00:00 2001 From: LifeOS Maintainer Date: Tue, 8 Sep 2026 18:21:35 +0000 Subject: [PATCH 157/173] docs: refresh Plugin delivery architecture currentness --- ...efresh-lifeos-architecture-currentness.yml | 60 ------------------- ARCHITECTURE.md | 8 ++- 2 files changed, 6 insertions(+), 62 deletions(-) delete mode 100644 .github/workflows/refresh-lifeos-architecture-currentness.yml diff --git a/.github/workflows/refresh-lifeos-architecture-currentness.yml b/.github/workflows/refresh-lifeos-architecture-currentness.yml deleted file mode 100644 index 008c0a9c9..000000000 --- a/.github/workflows/refresh-lifeos-architecture-currentness.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Refresh LifeOS architecture currentness - -on: - push: - branches: - - docs/canonical-product-architecture-mainline - -permissions: - contents: write - -concurrency: - group: refresh-lifeos-architecture-currentness-${{ github.ref }} - cancel-in-progress: true - -jobs: - refresh: - runs-on: ubuntu-24.04 - timeout-minutes: 10 - steps: - - name: Checkout exact pushed head - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - with: - persist-credentials: true - fetch-depth: 2 - ref: ${{ github.sha }} - - - name: Refuse stale branch publication - shell: bash - run: | - set -euo pipefail - remote_head="$(git ls-remote origin refs/heads/docs/canonical-product-architecture-mainline | cut -f1)" - test "$remote_head" = "$GITHUB_SHA" - - - name: Replace bounded Plugin terminal currentness block - shell: bash - run: | - python - <<'PY' - from pathlib import Path - - path = Path('ARCHITECTURE.md') - text = path.read_text() - start_marker = 'Draft PR #255 is the direct #254 child' - end_marker = '## 6. AI proposal boundary' - start = text.index(start_marker) - end = text.index(end_marker, start) - replacement = '''Draft PR #255 is the direct #254 child and owns append-only sanitized retry/exhaustion outcome evidence. Migration `0009_plugin_delivery_attempt_outcome_record.sql` keeps provider payloads, response bodies, credentials, origin URI and network authority out of the ledger. Its retained PostgreSQL lineage repairs missing-table admission, claim binding, direct forged INSERT, and UPDATE/DELETE/TRUNCATE immutability. Current #255 exact `e201b649cdea7d50ee2b856ac98a01d2b6c1368e` removes only its purpose verifier and remains active-PR evidence rather than protected shipped truth.\n\nDraft PR #256 is the direct #255 child and owns Integration-controlled pause/resume/dead-letter transitions plus a source-bound append-only `life-os.plugin-delivery-attempt-control.v1` evidence ledger. Pause cannot steal an active worker claim; resume retains retry identity; dead-letter is admitted only after real durable `attempt_limit` exhaustion and preserves the terminal instant. Direct forged inserts and UPDATE/DELETE/TRUNCATE mutation of accepted control evidence fail closed. Initial real-PostgreSQL durable-control RED `5d50c56ae714b7ca620f3c4b790002bcdf83aa8d` / run `34255006068` / job `102158492416` established the missing lifecycle; repaired exact `a576d3fd85e1f1d0845ed10200d1849b04c8f1b2` / run `34256983815` / job `102165175608` completed GREEN across focused control acceptance, Integration typecheck and the complete Integration suite.\n\nFresh review found that `control_sequence` could advance while the accepted control timestamp moved backward, producing durable sequence evidence with contradictory chronology. Real PostgreSQL RED `8f25181033b44d89dd08ed965d8d258410629e58` / run `34261784625` / job `102181270911` failed specifically at the backdated-resume regression after environment setup, frozen install, formatting/diff hygiene and Plugin SDK build passed. Forward migration `0011_plugin_delivery_attempt_control_chronology_guard.sql` adds only the missing non-decreasing `NEW.updated_at >= OLD.updated_at` transition invariant. Exact proof `c98734fcf50bfc197141aed6469fcf1e0adffcd6` / run `34261947610` / job `102181894242` completed GREEN across the real chronology regression, Integration typecheck and the complete Integration suite. Current #256 exact `0c6221e1fe32bf6594784219a7bd710ad0c1a993` removes only the purpose-complete chronology verifier.\n\nIssue #130 remains **Partial**. Protected main does not yet contain the Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 deterministic finite worker claim/lease, #254 claim-bound bounded retry/backoff, #255 append-only sanitized outcome evidence, and #256 durable pause/resume/dead-letter control evidence with non-decreasing chronology. The next LifeOS-owned execution boundary is a per-attempt revocation fence immediately before execution, followed by operator-visible status, restart/recovery and bounded provider execution. No active LifeOS PR supplies complete host-authorized outbound HTTPS. Outbound authority must come only from an immutable released/versioned canonical egress contract; otherwise the network boundary remains fail closed. Durable origin/delivery/claim/retry/outcome/control identity is not network authorization.\n\n''' - path.write_text(text[:start] + replacement + text[end:]) - PY - rm .github/workflows/refresh-lifeos-architecture-currentness.yml - git diff --check - - - name: Publish bounded source-current update and retire writer - shell: bash - run: | - set -euo pipefail - git config user.name 'LifeOS Maintainer' - git config user.email 'actions@users.noreply.github.com' - git add ARCHITECTURE.md .github/workflows/refresh-lifeos-architecture-currentness.yml - git commit -m 'docs: refresh Plugin delivery architecture currentness' - git push origin HEAD:docs/canonical-product-architecture-mainline diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index e228f8fe2..5d7895616 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -117,9 +117,13 @@ Draft PR #253 is the direct child of #252 and establishes deterministic Integrat Draft PR #254 is the direct #253 child and adds Integration-owned claim-bound retry/backoff without provider execution or outbound HTTPS. Migration `0008_plugin_delivery_attempt_retry_transition.sql` preserves row-owned retry budgets and finite claim leases while admitting only explicit admission, active-claim, scheduled-retry and terminal-exhaustion shapes. Exact proof head `ca22c71e4f2ec11de6539df79632376d4134f90a`, run `34237354956`, job `102098403313`, completed GREEN on Ubuntu 24.04/PostgreSQL 16 across frozen install, formatting/diff hygiene, Plugin SDK build, focused retry acceptance, real PostgreSQL retry/exhaustion acceptance, Integration typecheck and the complete Integration suite. Current #254 exact `edc79d1291025b8787a9ccf16c39a10df4157023` removes only the purpose verifier and remains Draft/unshipped. -Draft PR #255 is the direct #254 child and owns append-only sanitized retry/exhaustion outcome evidence. Migration `0009_plugin_delivery_attempt_outcome_record.sql` keeps provider payloads, response bodies, credentials, origin URI and network authority out of the ledger; `(delivery_id, attempt_number)` plus a bounded outcome discriminator and occurrence instant are retained as same-database lifecycle evidence. After the missing-table and claim-binding repairs, source-transition review proved and repaired direct forged INSERT. A subsequent append-only review found row-level UPDATE/DELETE immutability still allowed PostgreSQL `TRUNCATE` to erase accepted evidence. Regression `675460dbc0803e188b4d49aed43eb51f2a683cd8` plus verifier exact `f728835cbb57efb6840cd97f96d1e9ef392546c0`, run `34252044527`, job `102148573723`, passed checkout/PostgreSQL/frozen-install/format/build gates and failed at real PostgreSQL acceptance exactly because TRUNCATE succeeded while the other six focused outcome tests passed. Minimum migration-only repair `d731abda5da6931a684c73b2786a276c4288ab29` adds a statement-level `BEFORE TRUNCATE` guard that reuses the fixed SQLSTATE `55000` append-only rejection function. Exact run `34252162271`, job `102148973258`, completed GREEN with focused outcome acceptance 7/7, Integration typecheck and the complete Integration suite 434 passed / 3 environment-dependent skipped across 74 files (72 passed / 2 skipped). Current #255 exact `e201b649cdea7d50ee2b856ac98a01d2b6c1368e` removes only the purpose-complete truncation verifier after that proven head and remains active-PR evidence rather than protected shipped truth. +Draft PR #255 is the direct #254 child and owns append-only sanitized retry/exhaustion outcome evidence. Migration `0009_plugin_delivery_attempt_outcome_record.sql` keeps provider payloads, response bodies, credentials, origin URI and network authority out of the ledger. Its retained PostgreSQL lineage repairs missing-table admission, claim binding, direct forged INSERT, and UPDATE/DELETE/TRUNCATE immutability. Current #255 exact `e201b649cdea7d50ee2b856ac98a01d2b6c1368e` removes only its purpose verifier and remains active-PR evidence rather than protected shipped truth. -Issue #130 remains **Partial**. Protected main does not yet contain this Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 deterministic finite worker claim/lease, #254 claim-bound bounded retry/backoff and #255 append-only source-bound outcome evidence including UPDATE/DELETE/TRUNCATE mutation rejection. Dead-letter/pause/resume, the per-attempt revocation fence immediately before execution, operator-visible status, restart/recovery and provider execution remain successor work. No active LifeOS PR supplies complete host-authorized outbound HTTPS. Fresh `ContextualWisdomLab/EgressWeave` release inventory is empty, so the network boundary remains fail closed rather than consuming mutable sibling source. Durable origin/delivery/claim/retry/outcome identity is not network authorization. Manifests and stored installations never self-authorize network capabilities. +Draft PR #256 is the direct #255 child and owns Integration-controlled pause/resume/dead-letter transitions plus a source-bound append-only `life-os.plugin-delivery-attempt-control.v1` evidence ledger. Pause cannot steal an active worker claim; resume retains retry identity; dead-letter is admitted only after real durable `attempt_limit` exhaustion and preserves the terminal instant. Direct forged inserts and UPDATE/DELETE/TRUNCATE mutation of accepted control evidence fail closed. Initial real-PostgreSQL durable-control RED `5d50c56ae714b7ca620f3c4b790002bcdf83aa8d` / run `34255006068` / job `102158492416` established the missing lifecycle; repaired exact `a576d3fd85e1f1d0845ed10200d1849b04c8f1b2` / run `34256983815` / job `102165175608` completed GREEN across focused control acceptance, Integration typecheck and the complete Integration suite. + +Fresh review found that `control_sequence` could advance while the accepted control timestamp moved backward, producing durable sequence evidence with contradictory chronology. Real PostgreSQL RED `8f25181033b44d89dd08ed965d8d258410629e58` / run `34261784625` / job `102181270911` failed specifically at the backdated-resume regression after environment setup, frozen install, formatting/diff hygiene and Plugin SDK build passed. Forward migration `0011_plugin_delivery_attempt_control_chronology_guard.sql` adds only the missing non-decreasing `NEW.updated_at >= OLD.updated_at` transition invariant. Exact proof `c98734fcf50bfc197141aed6469fcf1e0adffcd6` / run `34261947610` / job `102181894242` completed GREEN across the real chronology regression, Integration typecheck and the complete Integration suite. Current #256 exact `0c6221e1fe32bf6594784219a7bd710ad0c1a993` removes only the purpose-complete chronology verifier. + +Issue #130 remains **Partial**. Protected main does not yet contain the Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 deterministic finite worker claim/lease, #254 claim-bound bounded retry/backoff, #255 append-only sanitized outcome evidence, and #256 durable pause/resume/dead-letter control evidence with non-decreasing chronology. The next LifeOS-owned execution boundary is a per-attempt revocation fence immediately before execution, followed by operator-visible status, restart/recovery and bounded provider execution. No active LifeOS PR supplies complete host-authorized outbound HTTPS. Outbound authority must come only from an immutable released/versioned canonical egress contract; otherwise the network boundary remains fail closed. Durable origin/delivery/claim/retry/outcome/control identity is not network authorization. ## 6. AI proposal boundary From 7a0efb8df1f3d709dbc7187cc340ec7a321a53b8 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 9 Sep 2026 04:19:47 +0900 Subject: [PATCH 158/173] ci(docs): update Architecture for Integration 257 --- .../update-architecture-integration-257.yml | 59 +++++++++++++++++++ 1 file changed, 59 insertions(+) create mode 100644 .github/workflows/update-architecture-integration-257.yml diff --git a/.github/workflows/update-architecture-integration-257.yml b/.github/workflows/update-architecture-integration-257.yml new file mode 100644 index 000000000..a356576e1 --- /dev/null +++ b/.github/workflows/update-architecture-integration-257.yml @@ -0,0 +1,59 @@ +name: Update architecture for Integration 257 + +on: + push: + branches: + - docs/canonical-product-architecture-mainline + +permissions: + contents: write + +concurrency: + group: update-architecture-integration-257 + cancel-in-progress: true + +jobs: + update: + runs-on: ubuntu-24.04 + timeout-minutes: 10 + steps: + - name: Checkout exact pushed head + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + persist-credentials: true + fetch-depth: 2 + ref: ${{ github.ref_name }} + + - name: Replace bounded Plugin currentness tail + shell: bash + run: | + python - <<'PY' + from pathlib import Path + + path = Path('ARCHITECTURE.md') + text = path.read_text() + start_marker = 'Issue #130 remains **Partial**.' + end_marker = '## 6. AI proposal boundary' + start = text.index(start_marker) + end = text.index(end_marker, start) + paragraphs = [ + 'Draft PR #257 is the direct #256 child and adds the Integration-owned per-attempt pre-execution revocation fence. Immediately before provider execution, the exact unexpired worker claim, active delivery-origin grant and active owning installation must still agree under the same workspace/user scope. The fence consumes neither provider credentials nor outbound-network authority. Exact `61c179a5886a79e2fa6bbca53b704275bcb3a0ea`, run `34266240410`, job `102196214538`, completed GREEN on Ubuntu 24.04/PostgreSQL 16 across focused real-PostgreSQL fence acceptance, Integration typecheck and the complete Integration suite.', + 'Fresh authority review found that the raw UUIDv4 claim token was case-normalized before SHA-256 hashing, allowing a hex-case alias to acquire the same durable claim digest despite the exact raw-token capability contract. Regression-only `48b823903d14c3ca0c868bf335d023904b2dcf9d` / run `34267014048` / job `102198804685` passed exact checkout, frozen install, formatting and Plugin SDK build and then failed at the focused execution-fence acceptance as intended. Minimum repair `a40098db19ea9830367b6cabd1bc552a019a990a` requires the raw token to already be canonical lowercase UUIDv4 text and hashes those exact bytes without normalization. Exact run `34267152261` / job `102199270687` completed GREEN across focused execution-fence/PostgreSQL acceptance, Integration typecheck and the complete Integration suite. Current #257 exact `5ac3d2fcdf30e97be006405cf599f3d666cf5946` removes only the purpose-complete verifier.', + 'Issue #130 remains **Partial**. Protected main does not yet contain the Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 deterministic finite worker claim/lease, #254 claim-bound bounded retry/backoff, #255 append-only sanitized outcome evidence, #256 durable pause/resume/dead-letter control evidence with non-decreasing chronology, and #257 exact pre-execution claim/grant/installation revocation fencing. Remaining LifeOS-owned work is bounded provider execution/outcome integration, operator-visible status and restart/recovery acceptance. No active LifeOS PR supplies complete host-authorized outbound HTTPS. Outbound authority must come only from an immutable released/versioned canonical egress contract; otherwise the network boundary remains fail closed. Durable origin/delivery/claim/retry/outcome/control/fence identity is not network authorization.', + ] + replacement = '\n\n'.join(paragraphs) + '\n\n' + path.write_text(text[:start] + replacement + text[end:]) + PY + rm .github/workflows/update-architecture-integration-257.yml + git diff --check + + - name: Publish only if branch head is unchanged + shell: bash + run: | + remote_head="$(git ls-remote origin "refs/heads/${GITHUB_REF_NAME}" | cut -f1)" + test "$remote_head" = "$GITHUB_SHA" + git config user.name "life-os-maintainer" + git config user.email "actions@users.noreply.github.com" + git add ARCHITECTURE.md .github/workflows/update-architecture-integration-257.yml + git commit -m "docs: record Integration execution fence architecture" + git push origin "HEAD:${GITHUB_REF_NAME}" From e9b68fa9ace20b75ffda6c01829543e2f14955bd Mon Sep 17 00:00:00 2001 From: life-os-maintainer Date: Tue, 8 Sep 2026 19:20:01 +0000 Subject: [PATCH 159/173] docs: record Integration execution fence architecture --- .../update-architecture-integration-257.yml | 59 ------------------- ARCHITECTURE.md | 6 +- 2 files changed, 5 insertions(+), 60 deletions(-) delete mode 100644 .github/workflows/update-architecture-integration-257.yml diff --git a/.github/workflows/update-architecture-integration-257.yml b/.github/workflows/update-architecture-integration-257.yml deleted file mode 100644 index a356576e1..000000000 --- a/.github/workflows/update-architecture-integration-257.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Update architecture for Integration 257 - -on: - push: - branches: - - docs/canonical-product-architecture-mainline - -permissions: - contents: write - -concurrency: - group: update-architecture-integration-257 - cancel-in-progress: true - -jobs: - update: - runs-on: ubuntu-24.04 - timeout-minutes: 10 - steps: - - name: Checkout exact pushed head - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - with: - persist-credentials: true - fetch-depth: 2 - ref: ${{ github.ref_name }} - - - name: Replace bounded Plugin currentness tail - shell: bash - run: | - python - <<'PY' - from pathlib import Path - - path = Path('ARCHITECTURE.md') - text = path.read_text() - start_marker = 'Issue #130 remains **Partial**.' - end_marker = '## 6. AI proposal boundary' - start = text.index(start_marker) - end = text.index(end_marker, start) - paragraphs = [ - 'Draft PR #257 is the direct #256 child and adds the Integration-owned per-attempt pre-execution revocation fence. Immediately before provider execution, the exact unexpired worker claim, active delivery-origin grant and active owning installation must still agree under the same workspace/user scope. The fence consumes neither provider credentials nor outbound-network authority. Exact `61c179a5886a79e2fa6bbca53b704275bcb3a0ea`, run `34266240410`, job `102196214538`, completed GREEN on Ubuntu 24.04/PostgreSQL 16 across focused real-PostgreSQL fence acceptance, Integration typecheck and the complete Integration suite.', - 'Fresh authority review found that the raw UUIDv4 claim token was case-normalized before SHA-256 hashing, allowing a hex-case alias to acquire the same durable claim digest despite the exact raw-token capability contract. Regression-only `48b823903d14c3ca0c868bf335d023904b2dcf9d` / run `34267014048` / job `102198804685` passed exact checkout, frozen install, formatting and Plugin SDK build and then failed at the focused execution-fence acceptance as intended. Minimum repair `a40098db19ea9830367b6cabd1bc552a019a990a` requires the raw token to already be canonical lowercase UUIDv4 text and hashes those exact bytes without normalization. Exact run `34267152261` / job `102199270687` completed GREEN across focused execution-fence/PostgreSQL acceptance, Integration typecheck and the complete Integration suite. Current #257 exact `5ac3d2fcdf30e97be006405cf599f3d666cf5946` removes only the purpose-complete verifier.', - 'Issue #130 remains **Partial**. Protected main does not yet contain the Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 deterministic finite worker claim/lease, #254 claim-bound bounded retry/backoff, #255 append-only sanitized outcome evidence, #256 durable pause/resume/dead-letter control evidence with non-decreasing chronology, and #257 exact pre-execution claim/grant/installation revocation fencing. Remaining LifeOS-owned work is bounded provider execution/outcome integration, operator-visible status and restart/recovery acceptance. No active LifeOS PR supplies complete host-authorized outbound HTTPS. Outbound authority must come only from an immutable released/versioned canonical egress contract; otherwise the network boundary remains fail closed. Durable origin/delivery/claim/retry/outcome/control/fence identity is not network authorization.', - ] - replacement = '\n\n'.join(paragraphs) + '\n\n' - path.write_text(text[:start] + replacement + text[end:]) - PY - rm .github/workflows/update-architecture-integration-257.yml - git diff --check - - - name: Publish only if branch head is unchanged - shell: bash - run: | - remote_head="$(git ls-remote origin "refs/heads/${GITHUB_REF_NAME}" | cut -f1)" - test "$remote_head" = "$GITHUB_SHA" - git config user.name "life-os-maintainer" - git config user.email "actions@users.noreply.github.com" - git add ARCHITECTURE.md .github/workflows/update-architecture-integration-257.yml - git commit -m "docs: record Integration execution fence architecture" - git push origin "HEAD:${GITHUB_REF_NAME}" diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 5d7895616..f61f0cecf 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -123,7 +123,11 @@ Draft PR #256 is the direct #255 child and owns Integration-controlled pause/res Fresh review found that `control_sequence` could advance while the accepted control timestamp moved backward, producing durable sequence evidence with contradictory chronology. Real PostgreSQL RED `8f25181033b44d89dd08ed965d8d258410629e58` / run `34261784625` / job `102181270911` failed specifically at the backdated-resume regression after environment setup, frozen install, formatting/diff hygiene and Plugin SDK build passed. Forward migration `0011_plugin_delivery_attempt_control_chronology_guard.sql` adds only the missing non-decreasing `NEW.updated_at >= OLD.updated_at` transition invariant. Exact proof `c98734fcf50bfc197141aed6469fcf1e0adffcd6` / run `34261947610` / job `102181894242` completed GREEN across the real chronology regression, Integration typecheck and the complete Integration suite. Current #256 exact `0c6221e1fe32bf6594784219a7bd710ad0c1a993` removes only the purpose-complete chronology verifier. -Issue #130 remains **Partial**. Protected main does not yet contain the Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 deterministic finite worker claim/lease, #254 claim-bound bounded retry/backoff, #255 append-only sanitized outcome evidence, and #256 durable pause/resume/dead-letter control evidence with non-decreasing chronology. The next LifeOS-owned execution boundary is a per-attempt revocation fence immediately before execution, followed by operator-visible status, restart/recovery and bounded provider execution. No active LifeOS PR supplies complete host-authorized outbound HTTPS. Outbound authority must come only from an immutable released/versioned canonical egress contract; otherwise the network boundary remains fail closed. Durable origin/delivery/claim/retry/outcome/control identity is not network authorization. +Draft PR #257 is the direct #256 child and adds the Integration-owned per-attempt pre-execution revocation fence. Immediately before provider execution, the exact unexpired worker claim, active delivery-origin grant and active owning installation must still agree under the same workspace/user scope. The fence consumes neither provider credentials nor outbound-network authority. Exact `61c179a5886a79e2fa6bbca53b704275bcb3a0ea`, run `34266240410`, job `102196214538`, completed GREEN on Ubuntu 24.04/PostgreSQL 16 across focused real-PostgreSQL fence acceptance, Integration typecheck and the complete Integration suite. + +Fresh authority review found that the raw UUIDv4 claim token was case-normalized before SHA-256 hashing, allowing a hex-case alias to acquire the same durable claim digest despite the exact raw-token capability contract. Regression-only `48b823903d14c3ca0c868bf335d023904b2dcf9d` / run `34267014048` / job `102198804685` passed exact checkout, frozen install, formatting and Plugin SDK build and then failed at the focused execution-fence acceptance as intended. Minimum repair `a40098db19ea9830367b6cabd1bc552a019a990a` requires the raw token to already be canonical lowercase UUIDv4 text and hashes those exact bytes without normalization. Exact run `34267152261` / job `102199270687` completed GREEN across focused execution-fence/PostgreSQL acceptance, Integration typecheck and the complete Integration suite. Current #257 exact `5ac3d2fcdf30e97be006405cf599f3d666cf5946` removes only the purpose-complete verifier. + +Issue #130 remains **Partial**. Protected main does not yet contain the Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 deterministic finite worker claim/lease, #254 claim-bound bounded retry/backoff, #255 append-only sanitized outcome evidence, #256 durable pause/resume/dead-letter control evidence with non-decreasing chronology, and #257 exact pre-execution claim/grant/installation revocation fencing. Remaining LifeOS-owned work is bounded provider execution/outcome integration, operator-visible status and restart/recovery acceptance. No active LifeOS PR supplies complete host-authorized outbound HTTPS. Outbound authority must come only from an immutable released/versioned canonical egress contract; otherwise the network boundary remains fail closed. Durable origin/delivery/claim/retry/outcome/control/fence identity is not network authorization. ## 6. AI proposal boundary From 2985dfe632fbe8eb0e9010e088226d1970e0d420 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 9 Sep 2026 05:42:39 +0900 Subject: [PATCH 160/173] chore(docs): stage Integration architecture currentness writer --- ...efresh-lifeos-integration-architecture.yml | 60 +++++++++++++++++++ 1 file changed, 60 insertions(+) create mode 100644 .github/workflows/refresh-lifeos-integration-architecture.yml diff --git a/.github/workflows/refresh-lifeos-integration-architecture.yml b/.github/workflows/refresh-lifeos-integration-architecture.yml new file mode 100644 index 000000000..060742202 --- /dev/null +++ b/.github/workflows/refresh-lifeos-integration-architecture.yml @@ -0,0 +1,60 @@ +name: Refresh LifeOS Integration architecture currentness + +on: + push: + branches: + - docs/canonical-product-architecture-mainline + +permissions: + contents: write + +concurrency: + group: refresh-lifeos-integration-architecture-${{ github.ref }} + cancel-in-progress: true + +jobs: + refresh: + runs-on: ubuntu-24.04 + timeout-minutes: 10 + steps: + - name: Checkout exact writer head + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 + with: + ref: ${{ github.sha }} + fetch-depth: 2 + + - name: Replace bounded Integration currentness and retire writer + env: + WRITER_PATH: .github/workflows/refresh-lifeos-integration-architecture.yml + TARGET_PATH: ARCHITECTURE.md + BRANCH_NAME: docs/canonical-product-architecture-mainline + INPUT_SHA: ${{ github.sha }} + run: | + python - <<'PY' + from pathlib import Path + + target = Path('ARCHITECTURE.md') + text = target.read_text() + old = "Remaining LifeOS-owned delivery work is bounded provider execution/outcome integration, operator-visible status and restart/recovery acceptance." + new = """#258 extends the active unshipped Integration lifecycle with a read-only, exact delivery/workspace/requesting-user-scoped durable status boundary that is reconstructable after repository/runtime restart. Exact proof head `8855427b8fcfa3b364223e91cd088546df84d684`, run `34276065348`, job `102229247458`, completed GREEN on Ubuntu 24.04/PostgreSQL 16.15 after both application and PostgreSQL repository chronology boundaries were repaired to reject durable status evidence updated after the trusted read instant. Focused status/restart acceptance passed 2 files / 10 tests, Integration typecheck passed, and the complete Integration suite passed 460 tests with 3 environment-dependent skips across 81 files (79 passed / 2 skipped). Current #258 exact `33d15c0d40806bb6a76f291dd265690f94c34186` removes only the purpose-complete verifier. The status contract remains credential-free, exposes only derived claim state, creates no new persistence owner or migration, and grants no provider-execution or outbound-network authority. Remaining LifeOS-owned delivery work is bounded provider execution/outcome integration and authenticated operator HTTP composition; outbound I/O remains fail closed until an immutable released/versioned canonical egress contract exists.""" + count = text.count(old) + if count != 1: + raise SystemExit(f'expected exactly one Integration currentness target, found {count}') + target.write_text(text.replace(old, new, 1)) + Path('.github/workflows/refresh-lifeos-integration-architecture.yml').unlink() + PY + git diff --check + git diff -- "$TARGET_PATH" "$WRITER_PATH" + + - name: Publish only if branch head is unchanged + env: + BRANCH_NAME: docs/canonical-product-architecture-mainline + INPUT_SHA: ${{ github.sha }} + run: | + remote_head="$(git ls-remote origin "refs/heads/${BRANCH_NAME}" | cut -f1)" + test "$remote_head" = "$INPUT_SHA" + git config user.name "LifeOS documentation writer" + git config user.email "actions@users.noreply.github.com" + git add ARCHITECTURE.md .github/workflows/refresh-lifeos-integration-architecture.yml + git commit -m "docs: refresh plugin delivery status architecture" + git push origin "HEAD:${BRANCH_NAME}" From 7462bcec866bf6607d082a7dab5f76d5773c461e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 9 Sep 2026 05:43:54 +0900 Subject: [PATCH 161/173] fix(docs): target current Integration architecture text --- .github/workflows/refresh-lifeos-integration-architecture.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/refresh-lifeos-integration-architecture.yml b/.github/workflows/refresh-lifeos-integration-architecture.yml index 060742202..497eb9336 100644 --- a/.github/workflows/refresh-lifeos-integration-architecture.yml +++ b/.github/workflows/refresh-lifeos-integration-architecture.yml @@ -35,7 +35,7 @@ jobs: target = Path('ARCHITECTURE.md') text = target.read_text() - old = "Remaining LifeOS-owned delivery work is bounded provider execution/outcome integration, operator-visible status and restart/recovery acceptance." + old = "Remaining LifeOS-owned work is bounded provider execution/outcome integration, operator-visible status and restart/recovery acceptance." new = """#258 extends the active unshipped Integration lifecycle with a read-only, exact delivery/workspace/requesting-user-scoped durable status boundary that is reconstructable after repository/runtime restart. Exact proof head `8855427b8fcfa3b364223e91cd088546df84d684`, run `34276065348`, job `102229247458`, completed GREEN on Ubuntu 24.04/PostgreSQL 16.15 after both application and PostgreSQL repository chronology boundaries were repaired to reject durable status evidence updated after the trusted read instant. Focused status/restart acceptance passed 2 files / 10 tests, Integration typecheck passed, and the complete Integration suite passed 460 tests with 3 environment-dependent skips across 81 files (79 passed / 2 skipped). Current #258 exact `33d15c0d40806bb6a76f291dd265690f94c34186` removes only the purpose-complete verifier. The status contract remains credential-free, exposes only derived claim state, creates no new persistence owner or migration, and grants no provider-execution or outbound-network authority. Remaining LifeOS-owned delivery work is bounded provider execution/outcome integration and authenticated operator HTTP composition; outbound I/O remains fail closed until an immutable released/versioned canonical egress contract exists.""" count = text.count(old) if count != 1: From b37862a62bd475090b4c484ea1e367082d2c2300 Mon Sep 17 00:00:00 2001 From: LifeOS documentation writer Date: Tue, 8 Sep 2026 20:44:03 +0000 Subject: [PATCH 162/173] docs: refresh plugin delivery status architecture --- ...efresh-lifeos-integration-architecture.yml | 60 ------------------- ARCHITECTURE.md | 2 +- 2 files changed, 1 insertion(+), 61 deletions(-) delete mode 100644 .github/workflows/refresh-lifeos-integration-architecture.yml diff --git a/.github/workflows/refresh-lifeos-integration-architecture.yml b/.github/workflows/refresh-lifeos-integration-architecture.yml deleted file mode 100644 index 497eb9336..000000000 --- a/.github/workflows/refresh-lifeos-integration-architecture.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: Refresh LifeOS Integration architecture currentness - -on: - push: - branches: - - docs/canonical-product-architecture-mainline - -permissions: - contents: write - -concurrency: - group: refresh-lifeos-integration-architecture-${{ github.ref }} - cancel-in-progress: true - -jobs: - refresh: - runs-on: ubuntu-24.04 - timeout-minutes: 10 - steps: - - name: Checkout exact writer head - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 - with: - ref: ${{ github.sha }} - fetch-depth: 2 - - - name: Replace bounded Integration currentness and retire writer - env: - WRITER_PATH: .github/workflows/refresh-lifeos-integration-architecture.yml - TARGET_PATH: ARCHITECTURE.md - BRANCH_NAME: docs/canonical-product-architecture-mainline - INPUT_SHA: ${{ github.sha }} - run: | - python - <<'PY' - from pathlib import Path - - target = Path('ARCHITECTURE.md') - text = target.read_text() - old = "Remaining LifeOS-owned work is bounded provider execution/outcome integration, operator-visible status and restart/recovery acceptance." - new = """#258 extends the active unshipped Integration lifecycle with a read-only, exact delivery/workspace/requesting-user-scoped durable status boundary that is reconstructable after repository/runtime restart. Exact proof head `8855427b8fcfa3b364223e91cd088546df84d684`, run `34276065348`, job `102229247458`, completed GREEN on Ubuntu 24.04/PostgreSQL 16.15 after both application and PostgreSQL repository chronology boundaries were repaired to reject durable status evidence updated after the trusted read instant. Focused status/restart acceptance passed 2 files / 10 tests, Integration typecheck passed, and the complete Integration suite passed 460 tests with 3 environment-dependent skips across 81 files (79 passed / 2 skipped). Current #258 exact `33d15c0d40806bb6a76f291dd265690f94c34186` removes only the purpose-complete verifier. The status contract remains credential-free, exposes only derived claim state, creates no new persistence owner or migration, and grants no provider-execution or outbound-network authority. Remaining LifeOS-owned delivery work is bounded provider execution/outcome integration and authenticated operator HTTP composition; outbound I/O remains fail closed until an immutable released/versioned canonical egress contract exists.""" - count = text.count(old) - if count != 1: - raise SystemExit(f'expected exactly one Integration currentness target, found {count}') - target.write_text(text.replace(old, new, 1)) - Path('.github/workflows/refresh-lifeos-integration-architecture.yml').unlink() - PY - git diff --check - git diff -- "$TARGET_PATH" "$WRITER_PATH" - - - name: Publish only if branch head is unchanged - env: - BRANCH_NAME: docs/canonical-product-architecture-mainline - INPUT_SHA: ${{ github.sha }} - run: | - remote_head="$(git ls-remote origin "refs/heads/${BRANCH_NAME}" | cut -f1)" - test "$remote_head" = "$INPUT_SHA" - git config user.name "LifeOS documentation writer" - git config user.email "actions@users.noreply.github.com" - git add ARCHITECTURE.md .github/workflows/refresh-lifeos-integration-architecture.yml - git commit -m "docs: refresh plugin delivery status architecture" - git push origin "HEAD:${BRANCH_NAME}" diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index f61f0cecf..bad0ab4fe 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -127,7 +127,7 @@ Draft PR #257 is the direct #256 child and adds the Integration-owned per-attemp Fresh authority review found that the raw UUIDv4 claim token was case-normalized before SHA-256 hashing, allowing a hex-case alias to acquire the same durable claim digest despite the exact raw-token capability contract. Regression-only `48b823903d14c3ca0c868bf335d023904b2dcf9d` / run `34267014048` / job `102198804685` passed exact checkout, frozen install, formatting and Plugin SDK build and then failed at the focused execution-fence acceptance as intended. Minimum repair `a40098db19ea9830367b6cabd1bc552a019a990a` requires the raw token to already be canonical lowercase UUIDv4 text and hashes those exact bytes without normalization. Exact run `34267152261` / job `102199270687` completed GREEN across focused execution-fence/PostgreSQL acceptance, Integration typecheck and the complete Integration suite. Current #257 exact `5ac3d2fcdf30e97be006405cf599f3d666cf5946` removes only the purpose-complete verifier. -Issue #130 remains **Partial**. Protected main does not yet contain the Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 deterministic finite worker claim/lease, #254 claim-bound bounded retry/backoff, #255 append-only sanitized outcome evidence, #256 durable pause/resume/dead-letter control evidence with non-decreasing chronology, and #257 exact pre-execution claim/grant/installation revocation fencing. Remaining LifeOS-owned work is bounded provider execution/outcome integration, operator-visible status and restart/recovery acceptance. No active LifeOS PR supplies complete host-authorized outbound HTTPS. Outbound authority must come only from an immutable released/versioned canonical egress contract; otherwise the network boundary remains fail closed. Durable origin/delivery/claim/retry/outcome/control/fence identity is not network authorization. +Issue #130 remains **Partial**. Protected main does not yet contain the Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 deterministic finite worker claim/lease, #254 claim-bound bounded retry/backoff, #255 append-only sanitized outcome evidence, #256 durable pause/resume/dead-letter control evidence with non-decreasing chronology, and #257 exact pre-execution claim/grant/installation revocation fencing. #258 extends the active unshipped Integration lifecycle with a read-only, exact delivery/workspace/requesting-user-scoped durable status boundary that is reconstructable after repository/runtime restart. Exact proof head `8855427b8fcfa3b364223e91cd088546df84d684`, run `34276065348`, job `102229247458`, completed GREEN on Ubuntu 24.04/PostgreSQL 16.15 after both application and PostgreSQL repository chronology boundaries were repaired to reject durable status evidence updated after the trusted read instant. Focused status/restart acceptance passed 2 files / 10 tests, Integration typecheck passed, and the complete Integration suite passed 460 tests with 3 environment-dependent skips across 81 files (79 passed / 2 skipped). Current #258 exact `33d15c0d40806bb6a76f291dd265690f94c34186` removes only the purpose-complete verifier. The status contract remains credential-free, exposes only derived claim state, creates no new persistence owner or migration, and grants no provider-execution or outbound-network authority. Remaining LifeOS-owned delivery work is bounded provider execution/outcome integration and authenticated operator HTTP composition; outbound I/O remains fail closed until an immutable released/versioned canonical egress contract exists. No active LifeOS PR supplies complete host-authorized outbound HTTPS. Outbound authority must come only from an immutable released/versioned canonical egress contract; otherwise the network boundary remains fail closed. Durable origin/delivery/claim/retry/outcome/control/fence identity is not network authorization. ## 6. AI proposal boundary From be4c13a592f381d26c7b1ab230f6de29168fa97f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 9 Sep 2026 06:14:09 +0900 Subject: [PATCH 163/173] docs: refresh plugin status claim chronology architecture --- ...n-status-claim-chronology-architecture.yml | 63 +++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 .github/workflows/refresh-plugin-status-claim-chronology-architecture.yml diff --git a/.github/workflows/refresh-plugin-status-claim-chronology-architecture.yml b/.github/workflows/refresh-plugin-status-claim-chronology-architecture.yml new file mode 100644 index 000000000..9057e3b86 --- /dev/null +++ b/.github/workflows/refresh-plugin-status-claim-chronology-architecture.yml @@ -0,0 +1,63 @@ +name: Refresh Plugin Status Claim Chronology Architecture + +on: + push: + branches: [docs/canonical-product-architecture-mainline] + +permissions: + contents: write + +concurrency: + group: refresh-plugin-status-claim-chronology-architecture + cancel-in-progress: true + +jobs: + publish: + runs-on: ubuntu-24.04 + timeout-minutes: 10 + steps: + - name: Checkout exact writer head + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + ref: ${{ github.sha }} + fetch-depth: 0 + + - name: Replace bounded Plugin Integration currentness paragraph + shell: python + run: | + from pathlib import Path + + path = Path('ARCHITECTURE.md') + text = path.read_text() + start_marker = 'Issue #130 remains **Partial**. Protected main does not yet contain the Vault/PostgreSQL/delivery-origin/delivery-attempt active stack.' + end_marker = '\n\n## 6. AI proposal boundary' + if text.count(start_marker) != 1 or text.count(end_marker) != 1: + raise SystemExit('expected one bounded Plugin Integration currentness region') + start = text.index(start_marker) + end = text.index(end_marker, start) + replacement = '''Issue #130 remains **Partial**. Protected main does not yet contain the Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 deterministic finite worker claim/lease, #254 claim-bound bounded retry/backoff, #255 append-only sanitized outcome evidence, #256 durable pause/resume/dead-letter control evidence with non-decreasing chronology, and #257 exact pre-execution claim/grant/installation revocation fencing. #258 extends the active unshipped Integration lifecycle with a read-only, exact delivery/workspace/requesting-user-scoped durable status boundary that is reconstructable after repository/runtime restart. Earlier exact proof head `8855427b8fcfa3b364223e91cd088546df84d684`, run `34276065348`, job `102229247458`, completed GREEN after both application and PostgreSQL repository boundaries were repaired to reject durable status evidence updated after the trusted read instant. + +Fresh migration-parity review then found that the status repository could still certify hostile durable rows impossible under migration 0007: a claim beginning before `requested_at`, or a claim beginning after aggregate `updated_at`. Regression-only exact `a84c265afa07a54900afba1af148a9f51dfb6f94`, run `34278422118`, job `102237052398`, reached Ubuntu 24.04 and failed both focused tests because both impossible rows resolved to status snapshots instead of fixed persistence-evidence rejection. Minimum causal repair `6c29a685a457ad7d199a502e82c99711b39219c2` binds claim chronology back to the already-validated aggregate instants, enforcing `claim_started_at >= requested_at` and `updated_at >= claim_started_at` at the repository evidence boundary without changing schema, query scope or ownership. Exact run `34279136682`, job `102239393667`, completed GREEN: focused chronology 2/2, focused status 9/9, Integration typecheck, and complete Integration suite 420 passed / 45 environment-dependent skipped across 82 files (68 passed / 14 skipped). Current #258 exact `e9eec8f8dc99c80f2712d452a94c205db78bf3d5` removes only the purpose-complete chronology verifier from the proven head. + +The status contract remains credential-free, exposes only derived claim state, creates no new persistence owner or migration, and grants no provider-execution or outbound-network authority. Remaining LifeOS-owned delivery work is bounded provider execution/outcome integration and authenticated operator HTTP composition; outbound I/O remains fail closed until an immutable released/versioned canonical egress contract exists. No active LifeOS PR supplies complete host-authorized outbound HTTPS. Outbound authority must come only from an immutable released/versioned canonical egress contract; otherwise the network boundary remains fail closed. Durable origin/delivery/claim/retry/outcome/control/fence/status identity is not network authorization.''' + path.write_text(text[:start] + replacement + text[end:]) + + - name: Verify bounded documentation delta + run: | + git diff --check + git diff -- ARCHITECTURE.md + test -n "$(git status --short ARCHITECTURE.md)" + + - name: Fence concurrent branch movement and publish + env: + INPUT_SHA: ${{ github.sha }} + BRANCH: docs/canonical-product-architecture-mainline + run: | + remote_sha="$(git ls-remote origin "refs/heads/${BRANCH}" | cut -f1)" + test "${remote_sha}" = "${INPUT_SHA}" + git config user.name "LifeOS commercial maintainer" + git config user.email "actions@users.noreply.github.com" + git rm .github/workflows/refresh-plugin-status-claim-chronology-architecture.yml + git add ARCHITECTURE.md + git commit -m "docs: record plugin claim chronology repair" + git push origin "HEAD:${BRANCH}" From 38876a24bf2d06d0c8871eb42da2724863a2b4b1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 9 Sep 2026 06:15:08 +0900 Subject: [PATCH 164/173] ci(docs): repair architecture currentness writer --- ...esh-plugin-status-claim-chronology-architecture.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/refresh-plugin-status-claim-chronology-architecture.yml b/.github/workflows/refresh-plugin-status-claim-chronology-architecture.yml index 9057e3b86..1e5502635 100644 --- a/.github/workflows/refresh-plugin-status-claim-chronology-architecture.yml +++ b/.github/workflows/refresh-plugin-status-claim-chronology-architecture.yml @@ -35,11 +35,11 @@ jobs: raise SystemExit('expected one bounded Plugin Integration currentness region') start = text.index(start_marker) end = text.index(end_marker, start) - replacement = '''Issue #130 remains **Partial**. Protected main does not yet contain the Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 deterministic finite worker claim/lease, #254 claim-bound bounded retry/backoff, #255 append-only sanitized outcome evidence, #256 durable pause/resume/dead-letter control evidence with non-decreasing chronology, and #257 exact pre-execution claim/grant/installation revocation fencing. #258 extends the active unshipped Integration lifecycle with a read-only, exact delivery/workspace/requesting-user-scoped durable status boundary that is reconstructable after repository/runtime restart. Earlier exact proof head `8855427b8fcfa3b364223e91cd088546df84d684`, run `34276065348`, job `102229247458`, completed GREEN after both application and PostgreSQL repository boundaries were repaired to reject durable status evidence updated after the trusted read instant. - -Fresh migration-parity review then found that the status repository could still certify hostile durable rows impossible under migration 0007: a claim beginning before `requested_at`, or a claim beginning after aggregate `updated_at`. Regression-only exact `a84c265afa07a54900afba1af148a9f51dfb6f94`, run `34278422118`, job `102237052398`, reached Ubuntu 24.04 and failed both focused tests because both impossible rows resolved to status snapshots instead of fixed persistence-evidence rejection. Minimum causal repair `6c29a685a457ad7d199a502e82c99711b39219c2` binds claim chronology back to the already-validated aggregate instants, enforcing `claim_started_at >= requested_at` and `updated_at >= claim_started_at` at the repository evidence boundary without changing schema, query scope or ownership. Exact run `34279136682`, job `102239393667`, completed GREEN: focused chronology 2/2, focused status 9/9, Integration typecheck, and complete Integration suite 420 passed / 45 environment-dependent skipped across 82 files (68 passed / 14 skipped). Current #258 exact `e9eec8f8dc99c80f2712d452a94c205db78bf3d5` removes only the purpose-complete chronology verifier from the proven head. - -The status contract remains credential-free, exposes only derived claim state, creates no new persistence owner or migration, and grants no provider-execution or outbound-network authority. Remaining LifeOS-owned delivery work is bounded provider execution/outcome integration and authenticated operator HTTP composition; outbound I/O remains fail closed until an immutable released/versioned canonical egress contract exists. No active LifeOS PR supplies complete host-authorized outbound HTTPS. Outbound authority must come only from an immutable released/versioned canonical egress contract; otherwise the network boundary remains fail closed. Durable origin/delivery/claim/retry/outcome/control/fence/status identity is not network authorization.''' + replacement = ( + 'Issue #130 remains **Partial**. Protected main does not yet contain the Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 deterministic finite worker claim/lease, #254 claim-bound bounded retry/backoff, #255 append-only sanitized outcome evidence, #256 durable pause/resume/dead-letter control evidence with non-decreasing chronology, and #257 exact pre-execution claim/grant/installation revocation fencing. #258 extends the active unshipped Integration lifecycle with a read-only, exact delivery/workspace/requesting-user-scoped durable status boundary that is reconstructable after repository/runtime restart. Earlier exact proof head `8855427b8fcfa3b364223e91cd088546df84d684`, run `34276065348`, job `102229247458`, completed GREEN after both application and PostgreSQL repository boundaries were repaired to reject durable status evidence updated after the trusted read instant.\n\n' + 'Fresh migration-parity review then found that the status repository could still certify hostile durable rows impossible under migration 0007: a claim beginning before `requested_at`, or a claim beginning after aggregate `updated_at`. Regression-only exact `a84c265afa07a54900afba1af148a9f51dfb6f94`, run `34278422118`, job `102237052398`, reached Ubuntu 24.04 and failed both focused tests because both impossible rows resolved to status snapshots instead of fixed persistence-evidence rejection. Minimum causal repair `6c29a685a457ad7d199a502e82c99711b39219c2` binds claim chronology back to the already-validated aggregate instants, enforcing `claim_started_at >= requested_at` and `updated_at >= claim_started_at` at the repository evidence boundary without changing schema, query scope or ownership. Exact run `34279136682`, job `102239393667`, completed GREEN: focused chronology 2/2, focused status 9/9, Integration typecheck, and complete Integration suite 420 passed / 45 environment-dependent skipped across 82 files (68 passed / 14 skipped). Current #258 exact `e9eec8f8dc99c80f2712d452a94c205db78bf3d5` removes only the purpose-complete chronology verifier from the proven head.\n\n' + 'The status contract remains credential-free, exposes only derived claim state, creates no new persistence owner or migration, and grants no provider-execution or outbound-network authority. Remaining LifeOS-owned delivery work is bounded provider execution/outcome integration and authenticated operator HTTP composition; outbound I/O remains fail closed until an immutable released/versioned canonical egress contract exists. No active LifeOS PR supplies complete host-authorized outbound HTTPS. Outbound authority must come only from an immutable released/versioned canonical egress contract; otherwise the network boundary remains fail closed. Durable origin/delivery/claim/retry/outcome/control/fence/status identity is not network authorization.' + ) path.write_text(text[:start] + replacement + text[end:]) - name: Verify bounded documentation delta From 6ab00c7608575b52b7807bf6b355f895f2464b41 Mon Sep 17 00:00:00 2001 From: LifeOS commercial maintainer Date: Tue, 8 Sep 2026 21:17:48 +0000 Subject: [PATCH 165/173] docs: record plugin claim chronology repair --- ...n-status-claim-chronology-architecture.yml | 63 ------------------- ARCHITECTURE.md | 6 +- 2 files changed, 5 insertions(+), 64 deletions(-) delete mode 100644 .github/workflows/refresh-plugin-status-claim-chronology-architecture.yml diff --git a/.github/workflows/refresh-plugin-status-claim-chronology-architecture.yml b/.github/workflows/refresh-plugin-status-claim-chronology-architecture.yml deleted file mode 100644 index 1e5502635..000000000 --- a/.github/workflows/refresh-plugin-status-claim-chronology-architecture.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Refresh Plugin Status Claim Chronology Architecture - -on: - push: - branches: [docs/canonical-product-architecture-mainline] - -permissions: - contents: write - -concurrency: - group: refresh-plugin-status-claim-chronology-architecture - cancel-in-progress: true - -jobs: - publish: - runs-on: ubuntu-24.04 - timeout-minutes: 10 - steps: - - name: Checkout exact writer head - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - with: - ref: ${{ github.sha }} - fetch-depth: 0 - - - name: Replace bounded Plugin Integration currentness paragraph - shell: python - run: | - from pathlib import Path - - path = Path('ARCHITECTURE.md') - text = path.read_text() - start_marker = 'Issue #130 remains **Partial**. Protected main does not yet contain the Vault/PostgreSQL/delivery-origin/delivery-attempt active stack.' - end_marker = '\n\n## 6. AI proposal boundary' - if text.count(start_marker) != 1 or text.count(end_marker) != 1: - raise SystemExit('expected one bounded Plugin Integration currentness region') - start = text.index(start_marker) - end = text.index(end_marker, start) - replacement = ( - 'Issue #130 remains **Partial**. Protected main does not yet contain the Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 deterministic finite worker claim/lease, #254 claim-bound bounded retry/backoff, #255 append-only sanitized outcome evidence, #256 durable pause/resume/dead-letter control evidence with non-decreasing chronology, and #257 exact pre-execution claim/grant/installation revocation fencing. #258 extends the active unshipped Integration lifecycle with a read-only, exact delivery/workspace/requesting-user-scoped durable status boundary that is reconstructable after repository/runtime restart. Earlier exact proof head `8855427b8fcfa3b364223e91cd088546df84d684`, run `34276065348`, job `102229247458`, completed GREEN after both application and PostgreSQL repository boundaries were repaired to reject durable status evidence updated after the trusted read instant.\n\n' - 'Fresh migration-parity review then found that the status repository could still certify hostile durable rows impossible under migration 0007: a claim beginning before `requested_at`, or a claim beginning after aggregate `updated_at`. Regression-only exact `a84c265afa07a54900afba1af148a9f51dfb6f94`, run `34278422118`, job `102237052398`, reached Ubuntu 24.04 and failed both focused tests because both impossible rows resolved to status snapshots instead of fixed persistence-evidence rejection. Minimum causal repair `6c29a685a457ad7d199a502e82c99711b39219c2` binds claim chronology back to the already-validated aggregate instants, enforcing `claim_started_at >= requested_at` and `updated_at >= claim_started_at` at the repository evidence boundary without changing schema, query scope or ownership. Exact run `34279136682`, job `102239393667`, completed GREEN: focused chronology 2/2, focused status 9/9, Integration typecheck, and complete Integration suite 420 passed / 45 environment-dependent skipped across 82 files (68 passed / 14 skipped). Current #258 exact `e9eec8f8dc99c80f2712d452a94c205db78bf3d5` removes only the purpose-complete chronology verifier from the proven head.\n\n' - 'The status contract remains credential-free, exposes only derived claim state, creates no new persistence owner or migration, and grants no provider-execution or outbound-network authority. Remaining LifeOS-owned delivery work is bounded provider execution/outcome integration and authenticated operator HTTP composition; outbound I/O remains fail closed until an immutable released/versioned canonical egress contract exists. No active LifeOS PR supplies complete host-authorized outbound HTTPS. Outbound authority must come only from an immutable released/versioned canonical egress contract; otherwise the network boundary remains fail closed. Durable origin/delivery/claim/retry/outcome/control/fence/status identity is not network authorization.' - ) - path.write_text(text[:start] + replacement + text[end:]) - - - name: Verify bounded documentation delta - run: | - git diff --check - git diff -- ARCHITECTURE.md - test -n "$(git status --short ARCHITECTURE.md)" - - - name: Fence concurrent branch movement and publish - env: - INPUT_SHA: ${{ github.sha }} - BRANCH: docs/canonical-product-architecture-mainline - run: | - remote_sha="$(git ls-remote origin "refs/heads/${BRANCH}" | cut -f1)" - test "${remote_sha}" = "${INPUT_SHA}" - git config user.name "LifeOS commercial maintainer" - git config user.email "actions@users.noreply.github.com" - git rm .github/workflows/refresh-plugin-status-claim-chronology-architecture.yml - git add ARCHITECTURE.md - git commit -m "docs: record plugin claim chronology repair" - git push origin "HEAD:${BRANCH}" diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index bad0ab4fe..1fcb2b3b3 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -127,7 +127,11 @@ Draft PR #257 is the direct #256 child and adds the Integration-owned per-attemp Fresh authority review found that the raw UUIDv4 claim token was case-normalized before SHA-256 hashing, allowing a hex-case alias to acquire the same durable claim digest despite the exact raw-token capability contract. Regression-only `48b823903d14c3ca0c868bf335d023904b2dcf9d` / run `34267014048` / job `102198804685` passed exact checkout, frozen install, formatting and Plugin SDK build and then failed at the focused execution-fence acceptance as intended. Minimum repair `a40098db19ea9830367b6cabd1bc552a019a990a` requires the raw token to already be canonical lowercase UUIDv4 text and hashes those exact bytes without normalization. Exact run `34267152261` / job `102199270687` completed GREEN across focused execution-fence/PostgreSQL acceptance, Integration typecheck and the complete Integration suite. Current #257 exact `5ac3d2fcdf30e97be006405cf599f3d666cf5946` removes only the purpose-complete verifier. -Issue #130 remains **Partial**. Protected main does not yet contain the Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 deterministic finite worker claim/lease, #254 claim-bound bounded retry/backoff, #255 append-only sanitized outcome evidence, #256 durable pause/resume/dead-letter control evidence with non-decreasing chronology, and #257 exact pre-execution claim/grant/installation revocation fencing. #258 extends the active unshipped Integration lifecycle with a read-only, exact delivery/workspace/requesting-user-scoped durable status boundary that is reconstructable after repository/runtime restart. Exact proof head `8855427b8fcfa3b364223e91cd088546df84d684`, run `34276065348`, job `102229247458`, completed GREEN on Ubuntu 24.04/PostgreSQL 16.15 after both application and PostgreSQL repository chronology boundaries were repaired to reject durable status evidence updated after the trusted read instant. Focused status/restart acceptance passed 2 files / 10 tests, Integration typecheck passed, and the complete Integration suite passed 460 tests with 3 environment-dependent skips across 81 files (79 passed / 2 skipped). Current #258 exact `33d15c0d40806bb6a76f291dd265690f94c34186` removes only the purpose-complete verifier. The status contract remains credential-free, exposes only derived claim state, creates no new persistence owner or migration, and grants no provider-execution or outbound-network authority. Remaining LifeOS-owned delivery work is bounded provider execution/outcome integration and authenticated operator HTTP composition; outbound I/O remains fail closed until an immutable released/versioned canonical egress contract exists. No active LifeOS PR supplies complete host-authorized outbound HTTPS. Outbound authority must come only from an immutable released/versioned canonical egress contract; otherwise the network boundary remains fail closed. Durable origin/delivery/claim/retry/outcome/control/fence identity is not network authorization. +Issue #130 remains **Partial**. Protected main does not yet contain the Vault/PostgreSQL/delivery-origin/delivery-attempt active stack. #252 establishes durable admission, #253 deterministic finite worker claim/lease, #254 claim-bound bounded retry/backoff, #255 append-only sanitized outcome evidence, #256 durable pause/resume/dead-letter control evidence with non-decreasing chronology, and #257 exact pre-execution claim/grant/installation revocation fencing. #258 extends the active unshipped Integration lifecycle with a read-only, exact delivery/workspace/requesting-user-scoped durable status boundary that is reconstructable after repository/runtime restart. Earlier exact proof head `8855427b8fcfa3b364223e91cd088546df84d684`, run `34276065348`, job `102229247458`, completed GREEN after both application and PostgreSQL repository boundaries were repaired to reject durable status evidence updated after the trusted read instant. + +Fresh migration-parity review then found that the status repository could still certify hostile durable rows impossible under migration 0007: a claim beginning before `requested_at`, or a claim beginning after aggregate `updated_at`. Regression-only exact `a84c265afa07a54900afba1af148a9f51dfb6f94`, run `34278422118`, job `102237052398`, reached Ubuntu 24.04 and failed both focused tests because both impossible rows resolved to status snapshots instead of fixed persistence-evidence rejection. Minimum causal repair `6c29a685a457ad7d199a502e82c99711b39219c2` binds claim chronology back to the already-validated aggregate instants, enforcing `claim_started_at >= requested_at` and `updated_at >= claim_started_at` at the repository evidence boundary without changing schema, query scope or ownership. Exact run `34279136682`, job `102239393667`, completed GREEN: focused chronology 2/2, focused status 9/9, Integration typecheck, and complete Integration suite 420 passed / 45 environment-dependent skipped across 82 files (68 passed / 14 skipped). Current #258 exact `e9eec8f8dc99c80f2712d452a94c205db78bf3d5` removes only the purpose-complete chronology verifier from the proven head. + +The status contract remains credential-free, exposes only derived claim state, creates no new persistence owner or migration, and grants no provider-execution or outbound-network authority. Remaining LifeOS-owned delivery work is bounded provider execution/outcome integration and authenticated operator HTTP composition; outbound I/O remains fail closed until an immutable released/versioned canonical egress contract exists. No active LifeOS PR supplies complete host-authorized outbound HTTPS. Outbound authority must come only from an immutable released/versioned canonical egress contract; otherwise the network boundary remains fail closed. Durable origin/delivery/claim/retry/outcome/control/fence/status identity is not network authorization. ## 6. AI proposal boundary From 830534f62cabc713c974f6008cd8562097bee7da Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 9 Sep 2026 07:48:30 +0900 Subject: [PATCH 166/173] docs(architecture): stage plugin status currentness writer --- ...architecture-plugin-status-currentness.yml | 72 +++++++++++++++++++ 1 file changed, 72 insertions(+) create mode 100644 .github/workflows/publish-architecture-plugin-status-currentness.yml diff --git a/.github/workflows/publish-architecture-plugin-status-currentness.yml b/.github/workflows/publish-architecture-plugin-status-currentness.yml new file mode 100644 index 000000000..ffbf05ca1 --- /dev/null +++ b/.github/workflows/publish-architecture-plugin-status-currentness.yml @@ -0,0 +1,72 @@ +name: Publish Architecture Plugin Status Currentness + +on: + push: + branches: [docs/canonical-product-architecture-mainline] + +permissions: + contents: write + +concurrency: + group: publish-architecture-plugin-status-currentness-${{ github.ref }} + cancel-in-progress: true + +jobs: + publish: + runs-on: ubuntu-24.04 + timeout-minutes: 15 + steps: + - name: Checkout exact input head + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + ref: ${{ github.sha }} + fetch-depth: 1 + + - name: Apply bounded Architecture currentness replacement + run: | + python - <<'PY' + from pathlib import Path + + path = Path("ARCHITECTURE.md") + text = path.read_text() + anchor = "\nThe status contract remains credential-free, exposes only derived claim state, creates no new persistence owner or migration, and grants no provider-execution or outbound-network authority." + if text.count(anchor) != 1: + raise SystemExit("expected exactly one Plugin status-contract anchor") + paragraph = """ + Draft PR #259 is the direct #258 child and exposes that restart-recoverable, credential-free status through the authenticated Plugin operator HTTP boundary without adding provider execution or outbound HTTPS. Regression-only exact `7398b9051c99bc39b137ea697129dba4dab57249`, run `34284401430`, job `102256491368`, reached GitHub-hosted Ubuntu 24.04 and proved the route was absent: the signed delivery-status GET returned framework `404` rather than the bounded fixed credential-free `503` required when durable status composition is unavailable. Minimum product repair `ccdea29238ef11a3a6866c735dc989d2b24633ad` adds exact signed GET authority, replay-before-dependency ordering, server-observed raw method/URL equality before decoded dynamic parameters, bounded HTTP problems, and hosted composition of #258's status application/repository over the Integration-owned PostgreSQL pool. Final exact candidate `097267ddf583b6d4d93047ff8bcfba089b1e979e` was created and verified before publication by run `34287096996`, job `102265083137`: formatting/diff hygiene, Plugin SDK build, focused status HTTP + hosted-runtime acceptance 26/26, Integration typecheck, and the complete Integration suite 423 passed / 45 environment-dependent skipped across 83 files. Both purpose workflows were retired before the verified candidate was ordinary-pushed. #259 remains Draft active-PR evidence rather than protected-main shipped or release authority. + """.strip() + text = text.replace(anchor, "\n\n" + paragraph + anchor, 1) + old = "Remaining LifeOS-owned delivery work is bounded provider execution/outcome integration and authenticated operator HTTP composition;" + new = "Remaining LifeOS-owned delivery work is bounded provider execution/outcome integration;" + if text.count(old) != 1: + raise SystemExit("expected exactly one remaining-work sentence") + text = text.replace(old, new, 1) + path.write_text(text) + PY + grep -F 'Draft PR #259 is the direct #258 child' ARCHITECTURE.md + grep -F 'Final exact candidate `097267ddf583b6d4d93047ff8bcfba089b1e979e`' ARCHITECTURE.md + grep -F 'Remaining LifeOS-owned delivery work is bounded provider execution/outcome integration;' ARCHITECTURE.md + ! grep -F 'Remaining LifeOS-owned delivery work is bounded provider execution/outcome integration and authenticated operator HTTP composition;' ARCHITECTURE.md + rm .github/workflows/publish-architecture-plugin-status-currentness.yml + changed="$(git diff --name-only | sort)" + allowed="$(printf '%s\n' ARCHITECTURE.md .github/workflows/publish-architecture-plugin-status-currentness.yml | sort)" + test "$changed" = "$allowed" + git diff --check + + - name: Verify Markdown formatting + run: pnpm exec prettier --check ARCHITECTURE.md + + - name: Publish verified bounded currentness candidate + env: + BRANCH: docs/canonical-product-architecture-mainline + run: | + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git add ARCHITECTURE.md .github/workflows/publish-architecture-plugin-status-currentness.yml + git commit -m "docs(architecture): record delivery status HTTP proof" + candidate="$(git rev-parse HEAD)" + git fetch origin "$BRANCH" + test "$(git rev-parse FETCH_HEAD)" = "${GITHUB_SHA}" + test -z "$(git status --porcelain)" + git push origin "${candidate}:$BRANCH" + echo "PUBLISHED_ARCHITECTURE_SHA=${candidate}" \ No newline at end of file From 1b61a45d023d5a9bf409c7351aa67a95304720cf Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 9 Sep 2026 07:52:57 +0900 Subject: [PATCH 167/173] ci(docs): remove unavailable formatter dependency --- .../publish-architecture-plugin-status-currentness.yml | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/.github/workflows/publish-architecture-plugin-status-currentness.yml b/.github/workflows/publish-architecture-plugin-status-currentness.yml index ffbf05ca1..6f81a22f3 100644 --- a/.github/workflows/publish-architecture-plugin-status-currentness.yml +++ b/.github/workflows/publish-architecture-plugin-status-currentness.yml @@ -22,7 +22,7 @@ jobs: ref: ${{ github.sha }} fetch-depth: 1 - - name: Apply bounded Architecture currentness replacement + - name: Apply and verify bounded Architecture currentness replacement run: | python - <<'PY' from pathlib import Path @@ -53,9 +53,6 @@ jobs: test "$changed" = "$allowed" git diff --check - - name: Verify Markdown formatting - run: pnpm exec prettier --check ARCHITECTURE.md - - name: Publish verified bounded currentness candidate env: BRANCH: docs/canonical-product-architecture-mainline @@ -65,6 +62,7 @@ jobs: git add ARCHITECTURE.md .github/workflows/publish-architecture-plugin-status-currentness.yml git commit -m "docs(architecture): record delivery status HTTP proof" candidate="$(git rev-parse HEAD)" + git show --check --stat --oneline HEAD git fetch origin "$BRANCH" test "$(git rev-parse FETCH_HEAD)" = "${GITHUB_SHA}" test -z "$(git status --porcelain)" From 8e0e5e53e1fbbdbdcec52364ce7582dab3bf21c6 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 8 Sep 2026 22:55:58 +0000 Subject: [PATCH 168/173] docs(architecture): record delivery status HTTP proof --- ...architecture-plugin-status-currentness.yml | 70 ------------------- ARCHITECTURE.md | 4 +- 2 files changed, 3 insertions(+), 71 deletions(-) delete mode 100644 .github/workflows/publish-architecture-plugin-status-currentness.yml diff --git a/.github/workflows/publish-architecture-plugin-status-currentness.yml b/.github/workflows/publish-architecture-plugin-status-currentness.yml deleted file mode 100644 index 6f81a22f3..000000000 --- a/.github/workflows/publish-architecture-plugin-status-currentness.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Publish Architecture Plugin Status Currentness - -on: - push: - branches: [docs/canonical-product-architecture-mainline] - -permissions: - contents: write - -concurrency: - group: publish-architecture-plugin-status-currentness-${{ github.ref }} - cancel-in-progress: true - -jobs: - publish: - runs-on: ubuntu-24.04 - timeout-minutes: 15 - steps: - - name: Checkout exact input head - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - with: - ref: ${{ github.sha }} - fetch-depth: 1 - - - name: Apply and verify bounded Architecture currentness replacement - run: | - python - <<'PY' - from pathlib import Path - - path = Path("ARCHITECTURE.md") - text = path.read_text() - anchor = "\nThe status contract remains credential-free, exposes only derived claim state, creates no new persistence owner or migration, and grants no provider-execution or outbound-network authority." - if text.count(anchor) != 1: - raise SystemExit("expected exactly one Plugin status-contract anchor") - paragraph = """ - Draft PR #259 is the direct #258 child and exposes that restart-recoverable, credential-free status through the authenticated Plugin operator HTTP boundary without adding provider execution or outbound HTTPS. Regression-only exact `7398b9051c99bc39b137ea697129dba4dab57249`, run `34284401430`, job `102256491368`, reached GitHub-hosted Ubuntu 24.04 and proved the route was absent: the signed delivery-status GET returned framework `404` rather than the bounded fixed credential-free `503` required when durable status composition is unavailable. Minimum product repair `ccdea29238ef11a3a6866c735dc989d2b24633ad` adds exact signed GET authority, replay-before-dependency ordering, server-observed raw method/URL equality before decoded dynamic parameters, bounded HTTP problems, and hosted composition of #258's status application/repository over the Integration-owned PostgreSQL pool. Final exact candidate `097267ddf583b6d4d93047ff8bcfba089b1e979e` was created and verified before publication by run `34287096996`, job `102265083137`: formatting/diff hygiene, Plugin SDK build, focused status HTTP + hosted-runtime acceptance 26/26, Integration typecheck, and the complete Integration suite 423 passed / 45 environment-dependent skipped across 83 files. Both purpose workflows were retired before the verified candidate was ordinary-pushed. #259 remains Draft active-PR evidence rather than protected-main shipped or release authority. - """.strip() - text = text.replace(anchor, "\n\n" + paragraph + anchor, 1) - old = "Remaining LifeOS-owned delivery work is bounded provider execution/outcome integration and authenticated operator HTTP composition;" - new = "Remaining LifeOS-owned delivery work is bounded provider execution/outcome integration;" - if text.count(old) != 1: - raise SystemExit("expected exactly one remaining-work sentence") - text = text.replace(old, new, 1) - path.write_text(text) - PY - grep -F 'Draft PR #259 is the direct #258 child' ARCHITECTURE.md - grep -F 'Final exact candidate `097267ddf583b6d4d93047ff8bcfba089b1e979e`' ARCHITECTURE.md - grep -F 'Remaining LifeOS-owned delivery work is bounded provider execution/outcome integration;' ARCHITECTURE.md - ! grep -F 'Remaining LifeOS-owned delivery work is bounded provider execution/outcome integration and authenticated operator HTTP composition;' ARCHITECTURE.md - rm .github/workflows/publish-architecture-plugin-status-currentness.yml - changed="$(git diff --name-only | sort)" - allowed="$(printf '%s\n' ARCHITECTURE.md .github/workflows/publish-architecture-plugin-status-currentness.yml | sort)" - test "$changed" = "$allowed" - git diff --check - - - name: Publish verified bounded currentness candidate - env: - BRANCH: docs/canonical-product-architecture-mainline - run: | - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - git add ARCHITECTURE.md .github/workflows/publish-architecture-plugin-status-currentness.yml - git commit -m "docs(architecture): record delivery status HTTP proof" - candidate="$(git rev-parse HEAD)" - git show --check --stat --oneline HEAD - git fetch origin "$BRANCH" - test "$(git rev-parse FETCH_HEAD)" = "${GITHUB_SHA}" - test -z "$(git status --porcelain)" - git push origin "${candidate}:$BRANCH" - echo "PUBLISHED_ARCHITECTURE_SHA=${candidate}" \ No newline at end of file diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 1fcb2b3b3..3e2a92b42 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -131,7 +131,9 @@ Issue #130 remains **Partial**. Protected main does not yet contain the Vault/Po Fresh migration-parity review then found that the status repository could still certify hostile durable rows impossible under migration 0007: a claim beginning before `requested_at`, or a claim beginning after aggregate `updated_at`. Regression-only exact `a84c265afa07a54900afba1af148a9f51dfb6f94`, run `34278422118`, job `102237052398`, reached Ubuntu 24.04 and failed both focused tests because both impossible rows resolved to status snapshots instead of fixed persistence-evidence rejection. Minimum causal repair `6c29a685a457ad7d199a502e82c99711b39219c2` binds claim chronology back to the already-validated aggregate instants, enforcing `claim_started_at >= requested_at` and `updated_at >= claim_started_at` at the repository evidence boundary without changing schema, query scope or ownership. Exact run `34279136682`, job `102239393667`, completed GREEN: focused chronology 2/2, focused status 9/9, Integration typecheck, and complete Integration suite 420 passed / 45 environment-dependent skipped across 82 files (68 passed / 14 skipped). Current #258 exact `e9eec8f8dc99c80f2712d452a94c205db78bf3d5` removes only the purpose-complete chronology verifier from the proven head. -The status contract remains credential-free, exposes only derived claim state, creates no new persistence owner or migration, and grants no provider-execution or outbound-network authority. Remaining LifeOS-owned delivery work is bounded provider execution/outcome integration and authenticated operator HTTP composition; outbound I/O remains fail closed until an immutable released/versioned canonical egress contract exists. No active LifeOS PR supplies complete host-authorized outbound HTTPS. Outbound authority must come only from an immutable released/versioned canonical egress contract; otherwise the network boundary remains fail closed. Durable origin/delivery/claim/retry/outcome/control/fence/status identity is not network authorization. + +Draft PR #259 is the direct #258 child and exposes that restart-recoverable, credential-free status through the authenticated Plugin operator HTTP boundary without adding provider execution or outbound HTTPS. Regression-only exact `7398b9051c99bc39b137ea697129dba4dab57249`, run `34284401430`, job `102256491368`, reached GitHub-hosted Ubuntu 24.04 and proved the route was absent: the signed delivery-status GET returned framework `404` rather than the bounded fixed credential-free `503` required when durable status composition is unavailable. Minimum product repair `ccdea29238ef11a3a6866c735dc989d2b24633ad` adds exact signed GET authority, replay-before-dependency ordering, server-observed raw method/URL equality before decoded dynamic parameters, bounded HTTP problems, and hosted composition of #258's status application/repository over the Integration-owned PostgreSQL pool. Final exact candidate `097267ddf583b6d4d93047ff8bcfba089b1e979e` was created and verified before publication by run `34287096996`, job `102265083137`: formatting/diff hygiene, Plugin SDK build, focused status HTTP + hosted-runtime acceptance 26/26, Integration typecheck, and the complete Integration suite 423 passed / 45 environment-dependent skipped across 83 files. Both purpose workflows were retired before the verified candidate was ordinary-pushed. #259 remains Draft active-PR evidence rather than protected-main shipped or release authority. +The status contract remains credential-free, exposes only derived claim state, creates no new persistence owner or migration, and grants no provider-execution or outbound-network authority. Remaining LifeOS-owned delivery work is bounded provider execution/outcome integration; outbound I/O remains fail closed until an immutable released/versioned canonical egress contract exists. No active LifeOS PR supplies complete host-authorized outbound HTTPS. Outbound authority must come only from an immutable released/versioned canonical egress contract; otherwise the network boundary remains fail closed. Durable origin/delivery/claim/retry/outcome/control/fence/status identity is not network authorization. ## 6. AI proposal boundary From 2596490c8ab1e434a4a8031c10104538370fca97 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 9 Sep 2026 09:57:02 +0900 Subject: [PATCH 169/173] docs: publish #260 performance evidence to architecture --- .../publish-architecture-currentness-v24.yml | 91 +++++++++++++++++++ 1 file changed, 91 insertions(+) create mode 100644 .github/workflows/publish-architecture-currentness-v24.yml diff --git a/.github/workflows/publish-architecture-currentness-v24.yml b/.github/workflows/publish-architecture-currentness-v24.yml new file mode 100644 index 000000000..3d0bd1483 --- /dev/null +++ b/.github/workflows/publish-architecture-currentness-v24.yml @@ -0,0 +1,91 @@ +name: Publish architecture currentness v24 + +on: + push: + branches: + - docs/canonical-product-architecture-mainline + +permissions: + contents: write + +concurrency: + group: publish-architecture-currentness-v24 + cancel-in-progress: false + +jobs: + publish: + runs-on: ubuntu-24.04 + timeout-minutes: 5 + steps: + - name: Checkout exact writer input + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + ref: ${{ github.sha }} + fetch-depth: 0 + + - name: 'Replace bounded #260 architecture block' + shell: bash + run: | + set -Eeuo pipefail + python3 - <<'PY' + from pathlib import Path + import re + + path = Path('ARCHITECTURE.md') + text = path.read_text(encoding='utf-8') + start = '' + end = '' + block = '\n'.join([ + start, + 'Draft PR #260 is the direct #259 performance-acceptance descendant and remains active-PR evidence rather than protected shipped truth. The first production-faithful hosted k6 proof, run `34293875857` / job `102286121337`, completed 1,000/1,000 signed status requests with 3,000/3,000 checks and zero HTTP failures but missed the unchanged buyer-path gate at p95 21.7 ms. The successful path was doing three sequential PostgreSQL invocations: durable replay expiry cleanup, replay insert/conflict, then the scoped status read. The minimum Integration-owned repair collapses replay consumption to one database invocation through `plugin_integration.consume_plugin_operator_context_replay(...)`, preserves exactly one current replay winner, bounds winner-only opportunistic expiry cleanup to 32 other rows with the existing expiry index plus `FOR UPDATE SKIP LOCKED`, and leaves the scoped status read, service-owned persistence, verified TLS, credential-free response and no-cross-service-SQL boundary intact.', + '', + 'Exact proof head `a24862ee07b6522f37f60f17013b09f546c923f2`, run `34296446935`, job `102294001154`, completed GREEN on Ubuntu 24.04/PostgreSQL 16/k6 2.2.0: Integration typecheck/build and canonical formatting passed; the complete Integration unit suite passed 423 tests with 48 environment-dependent skips across 84 files; focused real-PostgreSQL replay acceptance passed 3/3 under peer-verified TLS; and the actual hosted executable completed all 1,000 measured requests at 10 VUs with no warm-up exclusion, 3,000/3,000 checks, zero HTTP failures and p95 15.27 ms under the unchanged p95 < 20 ms gate. Current #260 exact `a81c8f243eaedb5f7efddc8a6c208083c8c256e3` removes only the purpose-complete verifier after that terminal GREEN.', + '', + 'This performance repair does not move provider-execution, credential or outbound-network authority into LifeOS. Durable replay/delivery/status identity remains insufficient to authorize DNS/IP/redirect/proxy/connect behavior; provider HTTPS stays fail closed until an immutable released/versioned canonical egress contract can be consumed. The active candidate also lacks an owned coverage-percentage artifact, so 100% Test/Edge Coverage is not claimed.', + end, + ]) + + if start in text or end in text: + pattern = re.compile(re.escape(start) + r'.*?' + re.escape(end), re.S) + if len(pattern.findall(text)) != 1: + raise SystemExit('expected exactly one existing #260 architecture block') + text = pattern.sub(block, text) + else: + anchors = list(re.finditer(r'\n## 6\.', text)) + if len(anchors) != 1: + raise SystemExit('expected exactly one section 6 anchor') + pos = anchors[0].start() + text = text[:pos] + '\n\n' + block + '\n' + text[pos:] + + path.write_text(text, encoding='utf-8') + PY + + - name: Verify bounded publication and retire writer + shell: bash + run: | + set -Eeuo pipefail + git diff --check + grep -Fq 'p95 15.27 ms' ARCHITECTURE.md + grep -Fq 'a24862ee07b6522f37f60f17013b09f546c923f2' ARCHITECTURE.md + grep -Fq 'a81c8f243eaedb5f7efddc8a6c208083c8c256e3' ARCHITECTURE.md + git rm .github/workflows/publish-architecture-currentness-v24.yml + mapfile -t changed < <(git diff --name-only HEAD) + printf '%s\n' "${changed[@]}" | sort > /tmp/changed + printf '%s\n' \ + '.github/workflows/publish-architecture-currentness-v24.yml' \ + 'ARCHITECTURE.md' | sort > /tmp/allowed + diff -u /tmp/allowed /tmp/changed + + - name: Publish only if writer input is still branch head + shell: bash + env: + INPUT_SHA: ${{ github.sha }} + run: | + set -Eeuo pipefail + git fetch origin docs/canonical-product-architecture-mainline + test "$(git rev-parse origin/docs/canonical-product-architecture-mainline)" = "$INPUT_SHA" + git config user.name 'LifeOS commercial-development writer' + git config user.email 'actions@users.noreply.github.com' + git add ARCHITECTURE.md + git commit -m 'docs: record #260 performance acceptance in architecture' + git push origin HEAD:docs/canonical-product-architecture-mainline From 994675d53541161e8fa7fde715d28bcfb1ddde04 Mon Sep 17 00:00:00 2001 From: LifeOS commercial-development writer Date: Wed, 9 Sep 2026 00:57:11 +0000 Subject: [PATCH 170/173] docs: record #260 performance acceptance in architecture --- .../publish-architecture-currentness-v24.yml | 91 ------------------- ARCHITECTURE.md | 9 ++ 2 files changed, 9 insertions(+), 91 deletions(-) delete mode 100644 .github/workflows/publish-architecture-currentness-v24.yml diff --git a/.github/workflows/publish-architecture-currentness-v24.yml b/.github/workflows/publish-architecture-currentness-v24.yml deleted file mode 100644 index 3d0bd1483..000000000 --- a/.github/workflows/publish-architecture-currentness-v24.yml +++ /dev/null @@ -1,91 +0,0 @@ -name: Publish architecture currentness v24 - -on: - push: - branches: - - docs/canonical-product-architecture-mainline - -permissions: - contents: write - -concurrency: - group: publish-architecture-currentness-v24 - cancel-in-progress: false - -jobs: - publish: - runs-on: ubuntu-24.04 - timeout-minutes: 5 - steps: - - name: Checkout exact writer input - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - with: - ref: ${{ github.sha }} - fetch-depth: 0 - - - name: 'Replace bounded #260 architecture block' - shell: bash - run: | - set -Eeuo pipefail - python3 - <<'PY' - from pathlib import Path - import re - - path = Path('ARCHITECTURE.md') - text = path.read_text(encoding='utf-8') - start = '' - end = '' - block = '\n'.join([ - start, - 'Draft PR #260 is the direct #259 performance-acceptance descendant and remains active-PR evidence rather than protected shipped truth. The first production-faithful hosted k6 proof, run `34293875857` / job `102286121337`, completed 1,000/1,000 signed status requests with 3,000/3,000 checks and zero HTTP failures but missed the unchanged buyer-path gate at p95 21.7 ms. The successful path was doing three sequential PostgreSQL invocations: durable replay expiry cleanup, replay insert/conflict, then the scoped status read. The minimum Integration-owned repair collapses replay consumption to one database invocation through `plugin_integration.consume_plugin_operator_context_replay(...)`, preserves exactly one current replay winner, bounds winner-only opportunistic expiry cleanup to 32 other rows with the existing expiry index plus `FOR UPDATE SKIP LOCKED`, and leaves the scoped status read, service-owned persistence, verified TLS, credential-free response and no-cross-service-SQL boundary intact.', - '', - 'Exact proof head `a24862ee07b6522f37f60f17013b09f546c923f2`, run `34296446935`, job `102294001154`, completed GREEN on Ubuntu 24.04/PostgreSQL 16/k6 2.2.0: Integration typecheck/build and canonical formatting passed; the complete Integration unit suite passed 423 tests with 48 environment-dependent skips across 84 files; focused real-PostgreSQL replay acceptance passed 3/3 under peer-verified TLS; and the actual hosted executable completed all 1,000 measured requests at 10 VUs with no warm-up exclusion, 3,000/3,000 checks, zero HTTP failures and p95 15.27 ms under the unchanged p95 < 20 ms gate. Current #260 exact `a81c8f243eaedb5f7efddc8a6c208083c8c256e3` removes only the purpose-complete verifier after that terminal GREEN.', - '', - 'This performance repair does not move provider-execution, credential or outbound-network authority into LifeOS. Durable replay/delivery/status identity remains insufficient to authorize DNS/IP/redirect/proxy/connect behavior; provider HTTPS stays fail closed until an immutable released/versioned canonical egress contract can be consumed. The active candidate also lacks an owned coverage-percentage artifact, so 100% Test/Edge Coverage is not claimed.', - end, - ]) - - if start in text or end in text: - pattern = re.compile(re.escape(start) + r'.*?' + re.escape(end), re.S) - if len(pattern.findall(text)) != 1: - raise SystemExit('expected exactly one existing #260 architecture block') - text = pattern.sub(block, text) - else: - anchors = list(re.finditer(r'\n## 6\.', text)) - if len(anchors) != 1: - raise SystemExit('expected exactly one section 6 anchor') - pos = anchors[0].start() - text = text[:pos] + '\n\n' + block + '\n' + text[pos:] - - path.write_text(text, encoding='utf-8') - PY - - - name: Verify bounded publication and retire writer - shell: bash - run: | - set -Eeuo pipefail - git diff --check - grep -Fq 'p95 15.27 ms' ARCHITECTURE.md - grep -Fq 'a24862ee07b6522f37f60f17013b09f546c923f2' ARCHITECTURE.md - grep -Fq 'a81c8f243eaedb5f7efddc8a6c208083c8c256e3' ARCHITECTURE.md - git rm .github/workflows/publish-architecture-currentness-v24.yml - mapfile -t changed < <(git diff --name-only HEAD) - printf '%s\n' "${changed[@]}" | sort > /tmp/changed - printf '%s\n' \ - '.github/workflows/publish-architecture-currentness-v24.yml' \ - 'ARCHITECTURE.md' | sort > /tmp/allowed - diff -u /tmp/allowed /tmp/changed - - - name: Publish only if writer input is still branch head - shell: bash - env: - INPUT_SHA: ${{ github.sha }} - run: | - set -Eeuo pipefail - git fetch origin docs/canonical-product-architecture-mainline - test "$(git rev-parse origin/docs/canonical-product-architecture-mainline)" = "$INPUT_SHA" - git config user.name 'LifeOS commercial-development writer' - git config user.email 'actions@users.noreply.github.com' - git add ARCHITECTURE.md - git commit -m 'docs: record #260 performance acceptance in architecture' - git push origin HEAD:docs/canonical-product-architecture-mainline diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 3e2a92b42..402c150df 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -135,6 +135,15 @@ Fresh migration-parity review then found that the status repository could still Draft PR #259 is the direct #258 child and exposes that restart-recoverable, credential-free status through the authenticated Plugin operator HTTP boundary without adding provider execution or outbound HTTPS. Regression-only exact `7398b9051c99bc39b137ea697129dba4dab57249`, run `34284401430`, job `102256491368`, reached GitHub-hosted Ubuntu 24.04 and proved the route was absent: the signed delivery-status GET returned framework `404` rather than the bounded fixed credential-free `503` required when durable status composition is unavailable. Minimum product repair `ccdea29238ef11a3a6866c735dc989d2b24633ad` adds exact signed GET authority, replay-before-dependency ordering, server-observed raw method/URL equality before decoded dynamic parameters, bounded HTTP problems, and hosted composition of #258's status application/repository over the Integration-owned PostgreSQL pool. Final exact candidate `097267ddf583b6d4d93047ff8bcfba089b1e979e` was created and verified before publication by run `34287096996`, job `102265083137`: formatting/diff hygiene, Plugin SDK build, focused status HTTP + hosted-runtime acceptance 26/26, Integration typecheck, and the complete Integration suite 423 passed / 45 environment-dependent skipped across 83 files. Both purpose workflows were retired before the verified candidate was ordinary-pushed. #259 remains Draft active-PR evidence rather than protected-main shipped or release authority. The status contract remains credential-free, exposes only derived claim state, creates no new persistence owner or migration, and grants no provider-execution or outbound-network authority. Remaining LifeOS-owned delivery work is bounded provider execution/outcome integration; outbound I/O remains fail closed until an immutable released/versioned canonical egress contract exists. No active LifeOS PR supplies complete host-authorized outbound HTTPS. Outbound authority must come only from an immutable released/versioned canonical egress contract; otherwise the network boundary remains fail closed. Durable origin/delivery/claim/retry/outcome/control/fence/status identity is not network authorization. + + +Draft PR #260 is the direct #259 performance-acceptance descendant and remains active-PR evidence rather than protected shipped truth. The first production-faithful hosted k6 proof, run `34293875857` / job `102286121337`, completed 1,000/1,000 signed status requests with 3,000/3,000 checks and zero HTTP failures but missed the unchanged buyer-path gate at p95 21.7 ms. The successful path was doing three sequential PostgreSQL invocations: durable replay expiry cleanup, replay insert/conflict, then the scoped status read. The minimum Integration-owned repair collapses replay consumption to one database invocation through `plugin_integration.consume_plugin_operator_context_replay(...)`, preserves exactly one current replay winner, bounds winner-only opportunistic expiry cleanup to 32 other rows with the existing expiry index plus `FOR UPDATE SKIP LOCKED`, and leaves the scoped status read, service-owned persistence, verified TLS, credential-free response and no-cross-service-SQL boundary intact. + +Exact proof head `a24862ee07b6522f37f60f17013b09f546c923f2`, run `34296446935`, job `102294001154`, completed GREEN on Ubuntu 24.04/PostgreSQL 16/k6 2.2.0: Integration typecheck/build and canonical formatting passed; the complete Integration unit suite passed 423 tests with 48 environment-dependent skips across 84 files; focused real-PostgreSQL replay acceptance passed 3/3 under peer-verified TLS; and the actual hosted executable completed all 1,000 measured requests at 10 VUs with no warm-up exclusion, 3,000/3,000 checks, zero HTTP failures and p95 15.27 ms under the unchanged p95 < 20 ms gate. Current #260 exact `a81c8f243eaedb5f7efddc8a6c208083c8c256e3` removes only the purpose-complete verifier after that terminal GREEN. + +This performance repair does not move provider-execution, credential or outbound-network authority into LifeOS. Durable replay/delivery/status identity remains insufficient to authorize DNS/IP/redirect/proxy/connect behavior; provider HTTPS stays fail closed until an immutable released/versioned canonical egress contract can be consumed. The active candidate also lacks an owned coverage-percentage artifact, so 100% Test/Edge Coverage is not claimed. + + ## 6. AI proposal boundary AI may generate, validate, persist, and retrieve inert proposal evidence and append explicit accept/reject decisions. It has no generic Planning mutation repository or command bus. Deterministic schema, authorization, quality, and release gates remain authoritative when model providers are unavailable or disagree. From f0a56a682359a8d5972468e01c5002e6b750bf42 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 9 Sep 2026 10:22:51 +0900 Subject: [PATCH 171/173] ci(docs): publish Architecture coverage currentness --- .../update-architecture-261-currentness.yml | 57 +++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 .github/workflows/update-architecture-261-currentness.yml diff --git a/.github/workflows/update-architecture-261-currentness.yml b/.github/workflows/update-architecture-261-currentness.yml new file mode 100644 index 000000000..ccc476f17 --- /dev/null +++ b/.github/workflows/update-architecture-261-currentness.yml @@ -0,0 +1,57 @@ +name: Update Architecture 261 currentness + +on: + push: + branches: [docs/canonical-product-architecture-mainline] + +permissions: + contents: write + +concurrency: + group: update-architecture-261-currentness + cancel-in-progress: true + +jobs: + publish: + runs-on: ubuntu-24.04 + timeout-minutes: 10 + steps: + - name: Checkout exact writer input + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + fetch-depth: 0 + ref: ${{ github.sha }} + + - name: Replace only the stale coverage sentence + shell: bash + run: | + set -Eeuo pipefail + python3 - <<'PY' + from pathlib import Path + + path = Path('ARCHITECTURE.md') + text = path.read_text() + old = "The active candidate also lacks an owned coverage-percentage artifact, so 100% Test/Edge Coverage is not claimed." + new = """Draft PR #261 is the direct #260 quality-evidence descendant. It introduces direct Integration ownership of `@vitest/coverage-v8`, explicit `test:coverage`, and unchanged 100% statements/branches/functions/lines thresholds over production `src/**/*.ts`. Hosted verification first repaired two harness defects without weakening the gate: Plugin SDK build order, then replay PostgreSQL test isolation by applying production migrations `0003_plugin_operator_context_replay_record.sql` and `0012_plugin_operator_context_replay_consume.sql` to the guarded disposable schema. Exact head `20e8af0edd8cb2044cf18c21ba510cddd924a8ac`, run `34298516686`, job `102300245764`, completed frozen install, canonical formatting, Plugin SDK build, Integration typecheck and all enabled tests: 82 test files passed / 2 skipped and 468 tests passed / 3 skipped. V8 then produced the current real RED baseline of 89.38% statements, 81.15% branches, 93.85% functions and 89.38% lines against the unchanged 100% gates. The remaining skips are separately provisioned Vault/PostgreSQL acceptance; uncovered production branches remain a test gap, so 100% Test/Edge Coverage is not claimed.""" + if text.count(old) != 1: + raise SystemExit(f'expected exactly one stale coverage sentence, found {text.count(old)}') + path.write_text(text.replace(old, new, 1)) + PY + git diff --check + test "$(git diff --name-only | sort)" = "ARCHITECTURE.md" + + - name: Publish bounded currentness and retire writer + shell: bash + run: | + set -Eeuo pipefail + remote_sha="$(git ls-remote origin refs/heads/docs/canonical-product-architecture-mainline | cut -f1)" + if [ "$remote_sha" != "$GITHUB_SHA" ]; then + echo "Architecture branch moved from ${GITHUB_SHA} to ${remote_sha}; refusing publication." >&2 + exit 1 + fi + git config user.name 'github-actions[bot]' + git config user.email '41898282+github-actions[bot]@users.noreply.github.com' + git add ARCHITECTURE.md + git rm .github/workflows/update-architecture-261-currentness.yml + git commit -m 'docs: record Integration coverage RED' + git push origin HEAD:refs/heads/docs/canonical-product-architecture-mainline From eb7aa3e418a6051e1be0922fd218252d03561835 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 9 Sep 2026 01:23:17 +0000 Subject: [PATCH 172/173] docs: record Integration coverage RED --- .../update-architecture-261-currentness.yml | 57 ------------------- ARCHITECTURE.md | 2 +- 2 files changed, 1 insertion(+), 58 deletions(-) delete mode 100644 .github/workflows/update-architecture-261-currentness.yml diff --git a/.github/workflows/update-architecture-261-currentness.yml b/.github/workflows/update-architecture-261-currentness.yml deleted file mode 100644 index ccc476f17..000000000 --- a/.github/workflows/update-architecture-261-currentness.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Update Architecture 261 currentness - -on: - push: - branches: [docs/canonical-product-architecture-mainline] - -permissions: - contents: write - -concurrency: - group: update-architecture-261-currentness - cancel-in-progress: true - -jobs: - publish: - runs-on: ubuntu-24.04 - timeout-minutes: 10 - steps: - - name: Checkout exact writer input - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - with: - fetch-depth: 0 - ref: ${{ github.sha }} - - - name: Replace only the stale coverage sentence - shell: bash - run: | - set -Eeuo pipefail - python3 - <<'PY' - from pathlib import Path - - path = Path('ARCHITECTURE.md') - text = path.read_text() - old = "The active candidate also lacks an owned coverage-percentage artifact, so 100% Test/Edge Coverage is not claimed." - new = """Draft PR #261 is the direct #260 quality-evidence descendant. It introduces direct Integration ownership of `@vitest/coverage-v8`, explicit `test:coverage`, and unchanged 100% statements/branches/functions/lines thresholds over production `src/**/*.ts`. Hosted verification first repaired two harness defects without weakening the gate: Plugin SDK build order, then replay PostgreSQL test isolation by applying production migrations `0003_plugin_operator_context_replay_record.sql` and `0012_plugin_operator_context_replay_consume.sql` to the guarded disposable schema. Exact head `20e8af0edd8cb2044cf18c21ba510cddd924a8ac`, run `34298516686`, job `102300245764`, completed frozen install, canonical formatting, Plugin SDK build, Integration typecheck and all enabled tests: 82 test files passed / 2 skipped and 468 tests passed / 3 skipped. V8 then produced the current real RED baseline of 89.38% statements, 81.15% branches, 93.85% functions and 89.38% lines against the unchanged 100% gates. The remaining skips are separately provisioned Vault/PostgreSQL acceptance; uncovered production branches remain a test gap, so 100% Test/Edge Coverage is not claimed.""" - if text.count(old) != 1: - raise SystemExit(f'expected exactly one stale coverage sentence, found {text.count(old)}') - path.write_text(text.replace(old, new, 1)) - PY - git diff --check - test "$(git diff --name-only | sort)" = "ARCHITECTURE.md" - - - name: Publish bounded currentness and retire writer - shell: bash - run: | - set -Eeuo pipefail - remote_sha="$(git ls-remote origin refs/heads/docs/canonical-product-architecture-mainline | cut -f1)" - if [ "$remote_sha" != "$GITHUB_SHA" ]; then - echo "Architecture branch moved from ${GITHUB_SHA} to ${remote_sha}; refusing publication." >&2 - exit 1 - fi - git config user.name 'github-actions[bot]' - git config user.email '41898282+github-actions[bot]@users.noreply.github.com' - git add ARCHITECTURE.md - git rm .github/workflows/update-architecture-261-currentness.yml - git commit -m 'docs: record Integration coverage RED' - git push origin HEAD:refs/heads/docs/canonical-product-architecture-mainline diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 402c150df..ae2fd08a5 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -141,7 +141,7 @@ Draft PR #260 is the direct #259 performance-acceptance descendant and remains a Exact proof head `a24862ee07b6522f37f60f17013b09f546c923f2`, run `34296446935`, job `102294001154`, completed GREEN on Ubuntu 24.04/PostgreSQL 16/k6 2.2.0: Integration typecheck/build and canonical formatting passed; the complete Integration unit suite passed 423 tests with 48 environment-dependent skips across 84 files; focused real-PostgreSQL replay acceptance passed 3/3 under peer-verified TLS; and the actual hosted executable completed all 1,000 measured requests at 10 VUs with no warm-up exclusion, 3,000/3,000 checks, zero HTTP failures and p95 15.27 ms under the unchanged p95 < 20 ms gate. Current #260 exact `a81c8f243eaedb5f7efddc8a6c208083c8c256e3` removes only the purpose-complete verifier after that terminal GREEN. -This performance repair does not move provider-execution, credential or outbound-network authority into LifeOS. Durable replay/delivery/status identity remains insufficient to authorize DNS/IP/redirect/proxy/connect behavior; provider HTTPS stays fail closed until an immutable released/versioned canonical egress contract can be consumed. The active candidate also lacks an owned coverage-percentage artifact, so 100% Test/Edge Coverage is not claimed. +This performance repair does not move provider-execution, credential or outbound-network authority into LifeOS. Durable replay/delivery/status identity remains insufficient to authorize DNS/IP/redirect/proxy/connect behavior; provider HTTPS stays fail closed until an immutable released/versioned canonical egress contract can be consumed. Draft PR #261 is the direct #260 quality-evidence descendant. It introduces direct Integration ownership of `@vitest/coverage-v8`, explicit `test:coverage`, and unchanged 100% statements/branches/functions/lines thresholds over production `src/**/*.ts`. Hosted verification first repaired two harness defects without weakening the gate: Plugin SDK build order, then replay PostgreSQL test isolation by applying production migrations `0003_plugin_operator_context_replay_record.sql` and `0012_plugin_operator_context_replay_consume.sql` to the guarded disposable schema. Exact head `20e8af0edd8cb2044cf18c21ba510cddd924a8ac`, run `34298516686`, job `102300245764`, completed frozen install, canonical formatting, Plugin SDK build, Integration typecheck and all enabled tests: 82 test files passed / 2 skipped and 468 tests passed / 3 skipped. V8 then produced the current real RED baseline of 89.38% statements, 81.15% branches, 93.85% functions and 89.38% lines against the unchanged 100% gates. The remaining skips are separately provisioned Vault/PostgreSQL acceptance; uncovered production branches remain a test gap, so 100% Test/Edge Coverage is not claimed. ## 6. AI proposal boundary From d6db4c198e7d585f6d251f9542553b145e07f090 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 9 Sep 2026 11:36:07 +0900 Subject: [PATCH 173/173] docs: route model capability through contextual orchestrator --- AGENTS.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 4021d92d1..68cf12465 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -44,10 +44,13 @@ As of 2026-08-04, code-owner review requirements (`require_code_owner_reviews` i - AI proposals are inert, explainable suggestions and cannot silently mutate user-owned data. - `COPILOT_GITHUB_TOKEN` is prohibited. -- Model-assisted tests and scheduled agents use `NVIDIA_NIM_API_KEY` through the approved OpenCode or contextual-orchestrator boundary. +- All model capability is consumed through an immutable released `contextual-orchestrator` API/client/schema boundary. Model-assisted tests and scheduled agents use only virtual `orchestrator/free` plus the gateway authentication token; LifeOS does not select provider/model/group routes or configure a paid/provider fallback. +- `BYTEZ`, `NVIDIA_NIM`/`NVIDIA_NIM_SUB`, `OPENROUTER`, `OPENAI`, embedding, responses/completions, audio/video/image and other provider capability or credential discovery remain contextual-orchestrator owner authority. LifeOS does not copy mutable owner source or seed those provider credentials directly. +- If the released contextual-orchestrator contract or a required capability is unavailable, fail closed and repair/release the canonical owner before bumping the LifeOS consumer. Do not bypass an unavailable owner capability with direct-provider calls. - Do not alter or reuse the key scheme of existing review agents. - Provider credentials, browser cookies, bearer material, raw prompts, raw responses, hidden reasoning, and stack traces do not enter retained artifacts. -- Live-provider availability is not a deterministic pull-request merge requirement; missing or unavailable providers produce explicit sanitized evidence. +- Model timeout defaults remain owner-contract-driven; user cancellation, provider termination, administrative timeout, stream/tool-call lifecycle, and reasoning completion are distinct evidence classes rather than elapsed-time-only termination signals. +- Live-provider availability is not a deterministic pull-request merge requirement; missing or unavailable provider capability produces explicit sanitized evidence. ### Test-time compute allocation