docs(readme): keep the default README customer/operator facing - #425
Draft
seonghobae wants to merge 78 commits into
Draft
docs(readme): keep the default README customer/operator facing#425seonghobae wants to merge 78 commits into
seonghobae wants to merge 78 commits into
Conversation
Rewrite the root README around product purpose, standalone run/deploy, host HTTP/OIDC calls, the orchestrator gateway contract, naruon/gyeot hub-and-leaf paths, GitHub App permissions, and operator configuration. Move hourly-loop, acquisition, saleable-program, and KPI collect links to docs/internal/README.md without deleting those files. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueThanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…424) * test(governance): distinguish observed controls from target gaps * fix(governance): expose observed live controls explicitly * test(governance): require complete observed-control fallback * fix(governance): preserve observed-control schema on collection failure * test(governance): align observed controls fixture
This was referenced Aug 18, 2026
* test(oidc): require immutable reusable-workflow source SHA * fix(oidc): bind reusable workflow source revision * test(oidc): exercise production source-SHA gate * config(oidc): pin allowed reusable workflow source SHA * refactor(oidc): keep source-trust response minimal * fix(readiness): require immutable workflow source SHA * test(readiness): cover reusable workflow source SHA * test(readiness): supply workflow source SHA in cache fixtures * test(oidc): authenticate before workflow source authorization * test(oidc): bind fallback workflow identity to source SHA * fix(oidc): bind fallback workflow source identity * test(oidc): cover immutable workflow prefilter boundaries * test(oidc): align delegated rejection contract * test(oidc): cover source-prefilter fallback branches * chore(oidc): roll trusted workflow SHA to current central main * test(oidc): preserve delegated workflow-config failure contract * test(oidc): reject oversized signed SHA mismatch * test(oidc): drop invalid oversized SHA expectation * test(oidc): require signed workflow SHA enforcement * fix(oidc): bind verifier to workflow source SHA * chore(oidc): roll trusted workflow source SHA * test(oidc): exercise verifier behind a valid limiter * test(readiness): include immutable workflow source binding * test(readiness): require workflow source configuration * test(readiness): keep ref fixtures source-bound * docs(architecture): describe candidate immutable OIDC source binding * test(architecture): track active immutable workflow binding * style(core): restore canonical newline * chore(oidc): roll immutable workflow source binding * test(oidc): prove signed exact source pairs * test(oidc): require source SHA in authoritative verifier * fix(oidc): fail closed without source SHA * test(oidc): align residual fixtures with source SHA trust * test(oidc): bind cache fixtures to trusted source SHA * test(oidc): bind success fixture to workflow source SHA * test(oidc): bind GitHub App runtime fixtures to source SHA * chore(oidc): roll trusted workflow source SHA * test(oidc): bind worker fixtures to source SHA trust * test(oidc): bind target authorization fixtures to source SHA * test(oidc): bind operational fixtures to source SHA * test(oidc): bind replay core fixtures to source SHA * test(oidc): bind request helper fixtures to source SHA * test(oidc): align denial prefilter expectation * docs(architecture): remove stale documentation owner * docs(traceability): record active workflow SHA owner * test(docs): bind active workflow trust maturity * fix(oidc): roll trusted workflow source revision * test(coverage): exercise authless runtime workflow prefilter * test(oidc): cover whitespace-only bearer prefilter * test(oidc): cover invalid authoritative workflow SHA config * chore(oidc): roll trusted workflow source SHA * chore(oidc): advance trusted workflow source pin * test(oidc): provide distributed limiter for prefilter delegation * fix(oidc): roll trusted workflow source to current central main
This was referenced Aug 19, 2026
* test(reviewer): reject unknown manifest evidence fields * fix(reviewer): fail closed on unknown manifest evidence
* fix(oidc): roll reviewed workflow source commit * chore(oidc): preserve wrangler byte shape
* test(reviewer): bound GitHub CLI subprocess lifetime * test(reviewer): bound CodeGraph subprocess lifetime * fix(reviewer): bound evidence subprocess lifetimes * test(reviewer): bound retained subprocess diagnostics * fix(reviewer): bound retained subprocess diagnostics * test(reviewer): retain changed-file fetch failures * fix(reviewer): retain changed-file evidence failures * test(reviewer): reject malformed base64 changed-file evidence * fix(reviewer): fail closed on malformed base64 file evidence * test(reviewer): bind reserved changed-file paths to contents endpoint * fix(reviewer): encode changed-file paths for contents lookup * test(reviewer): preserve exact changed filename identity * fix(reviewer): preserve exact changed filename identity * test(reviewer): use line-safe changed filename fixtures * test(reviewer): emit JSON-safe changed filename fixtures * test(reviewer): emit JSON-safe UTF-8 filename fixture * test(reviewer): emit JSON-safe large-file fixture * test(reviewer): reject omitted non-empty changed-file contents * fix(reviewer): fail closed on omitted non-empty file evidence * test(reviewer): model zero-byte contents metadata * test(reviewer): cover fail-closed file evidence branches
* test(rate-limit): require bounded guard transport * fix(rate-limit): bound guard transport deadline * test(rate-limit): verify exact guard deadline
* test(oidc): require current central workflow source * fix(oidc): roll trusted central workflow source
* test(rate-limit): require rejected-response cleanup * fix(rate-limit): cancel rejected decision bodies * test(rate-limit): preserve rejection on cleanup failure * test(rate-limit): reject without awaiting cleanup * test(rate-limit): bound streamed-overflow cleanup * fix(rate-limit): never await best-effort cleanup
* test(oidc): require current central workflow source * fix(oidc): roll forward trusted workflow source
* test(oidc): require current central workflow source * fix(oidc): roll forward trusted workflow source
* test(oidc): require current central workflow source * fix(oidc): roll forward trusted workflow source * test(oidc): require latest central workflow source * fix(oidc): advance trusted workflow source again * chore(oidc): restore wrangler newline
* test(kpi): reject corrupt event metric evidence * fix(kpi): reject corrupt event metric evidence * test(kpi): preserve zero latency evidence * test(kpi): reject impossible HTTP status evidence * fix(kpi): reject impossible HTTP status evidence * test(kpi): reject future and invalid window evidence * fix(kpi): fail closed on invalid window authority * test(kpi): reject coercible latency evidence * test(kpi): reject coercible status evidence * fix(kpi): require typed status and latency evidence * test(kpi): reject out-of-domain threshold authority * fix(kpi): validate threshold authority domain * test(kpi): require canonical event identity * fix(kpi): require canonical event identity * test(kpi): cover threshold authority branches * test(kpi): cover empty event authority * test(kpi): require latency for every exchange event * fix(kpi): require complete latency evidence * test(kpi): reject whitespace event authority * fix(kpi): reject blank event authority
* test(oidc): require latest central workflow source * fix(oidc): roll forward trusted workflow source
* test(acquisition): reject non-canonical evidence timestamps * fix(acquisition): validate canonical evidence timestamps * test(acquisition): cover ISO timestamp parse boundaries * test(acquisition): reject future-dated evidence * fix(acquisition): reject future-dated evidence * test(acquisition): reject invalid evidence age authority * fix(acquisition): fail closed on invalid evidence age config * test(acquisition): reject coerced revenue metrics * fix(acquisition): require typed revenue metrics * test(acquisition): isolate revenue metric audit env * test(acquisition): reject coercible release asset sizes * fix(acquisition): require typed release asset sizes * test(acquisition): preserve canonical date-only evidence * docs(changelog): record acquisition fail-closed behavior * test(acquisition): preserve valid ahead-of-UTC civil dates * fix(acquisition): bound date-only civil-date future check
* test(oidc): require current central workflow source * fix(oidc): roll forward trusted workflow source
* test(security): reject future-dated evidence * fix(security): reject future-dated evidence
* test(oidc): require latest central workflow source * fix(oidc): trust current central workflow source
* test(release): require canonical lowercase source SHA * fix(release): require canonical lowercase source SHA * test(deployment): require canonical lowercase source SHA * fix(deployment): require canonical lowercase source SHA * test(deployment): require canonical lowercase evidence digests * fix(deployment): require canonical lowercase evidence digests * test(release): reject normalized source SHA authority * fix(release): reject normalized source SHA authority * test(deployment): reject normalized evidence identity * fix(deployment): reject normalized evidence identity * test(deployment): reject normalized timestamp authority * fix(deployment): reject normalized timestamp authority * test(acquisition): require canonical deployment identities * fix(acquisition): bind canonical deployment identities * fix(release): preserve protected-main truth after convergence
* test(github): reproduce trailing-slash API base failure * fix(github): canonicalize accepted API root URLs * test(github): cover every accepted API root spelling * test(github): reproduce malformed success JSON classification * fix(github): classify malformed success JSON upstream * test(github): reproduce invalid success JSON shapes * fix(github): reject non-object success JSON * test(github): reject malformed installation fields * fix(github): validate installation response fields * test(egress): fail closed on response stream errors * fix(egress): classify response stream failures * test(egress): reject without awaiting cleanup * fix(egress): never await rejected-body cleanup * test(github): reject expired installation credentials * fix(github): reject expired installation credentials * test(github): reject implausibly long-lived installation tokens * fix(github): bound installation token lifetime * test(github): keep successful token fixtures within lifetime * test(github): use bounded success token expiry * test(github): bound replay success token lifetime * fix(ci): restore canonical source newline * test(github): keep exchange success expiry current * test(github): reject invalid configured installation ids * fix(github): validate configured installation id * test(github): align configured installation-id contract * test(readiness): reject unsafe GitHub numeric identifiers * fix(readiness): bound GitHub numeric identifiers * test(github): reject invalid App ids before egress * test(github): bind App id rejection to public edge * fix(github): reject invalid App ids at public edge * test(exchange): reject oversized body without awaiting cleanup * fix(exchange): never await rejected-body cleanup * test(exchange): require early rejection body cleanup * fix(exchange): release rejected request bodies * test(egress): classify credential transport failures * fix(egress): fail closed on transport rejection * fix(egress): scope transport failure to credentials * test(readiness): require immutable workflow source coherence * fix(readiness): bind immutable workflow ref to source sha * test(github): reject invalid installation id at request edge * fix(github): reject invalid installation id at request edge * test(github): bound installation id in credential egress path * fix(github): bound installation id in credential egress path * test(egress): clean up blocked redirect bodies * fix(egress): clean up blocked redirect bodies * test(github): clean up outbound read failures * fix(github): clean up outbound read failures * test(github): clean up exchange read failures * fix(github): clean up exchange read failures * test(oidc): reject non-numeric not-before claims * fix(oidc): reject non-numeric not-before claims * test(github): reject impossible token expiry * fix(github): validate token expiry calendar * test(oidc): reject non-finite NumericDate claims * fix(oidc): require finite NumericDate claims * test(oidc): reject invalid issued-at claims * fix(oidc): validate issued-at claims * test(oidc): bind repository owner immutable id * fix(oidc): reject mismatched repository owner identity * test(oidc): bind repository immutable identity * fix(oidc): bind repository immutable identity * test(oidc): preserve central workflow repository identity * fix(oidc): scope immutable repository id to Noema claim * test(oidc): bind central workflow repository identity * fix(oidc): bind trusted repository identity pairs * test(oidc): require current central workflow source * fix(oidc): trust current central workflow source * test(oidc): reject bearer credential whitespace at edge * fix(oidc): reject malformed bearer whitespace at edge * style(core): restore canonical newline * test(oidc): require current central workflow source * fix(oidc): roll forward trusted workflow source * test(oidc): require current central workflow source SHA * fix(oidc): roll forward central workflow source SHA * test(ci): require observable release verifier boundaries * fix(ci): expose release verifier failure boundaries * test(ci): align reproducibility contract with observable release gates * test(oidc): require latest central workflow source SHA * fix(oidc): follow latest central workflow source SHA * test(ci): require bounded release-test diagnostics * fix(ci): bound release-test diagnostic output * fix(ci): restore canonical source newline * fix(ci): preserve source formatting while restoring newline * test(oidc): require current central workflow source * fix(oidc): roll forward central workflow source * test(ci): require bounded failure diagnostics * fix(ci): bound release-test failure diagnostics * test(oidc): align Bearer whitespace with bounded envelope * test(readiness): keep immutable workflow ref and SHA coherent * test(github): satisfy earlier App-id trust gate in egress fixtures * test(exchange): satisfy App-id preflight in egress-boundary fixture * test(exchange): cover synchronous cleanup failure * test(github): cover expiry defensive branches * test(exchange): cover bodyless early rejection cleanup * test(github): cover noncanonical token expiry format * test(exchange): align bodyless request coverage * test(oidc): require current central workflow source * fix(oidc): trust current central workflow source * test(exchange): cover disappearing body cleanup race * test(exchange): cover rejected cleanup promise * test(oidc): require current central workflow source * fix(oidc): roll forward central workflow source
* test(rate-limit): bound internal limiter request bodies * fix(rate-limit): bound internal limiter request bodies * test(rate-limit): reject duplicate limit authority keys * fix(rate-limit): reject ambiguous limit authority JSON * test(rate-limit): clean up rejected request bodies * fix(rate-limit): clean up rejected request bodies * test(rate-limit): clean up wrong-path request bodies * fix(rate-limit): clean up wrong-path request bodies * test(rate-limit): require transactional alarm lifecycle * fix(rate-limit): make alarm lifecycle transactional * test(rate-limit): model transactional alarms * test(rate-limit): model sqlite transaction storage API * fix(rate-limit): use sqlite transaction storage alarm API * test(rate-limit): clean up read failures * fix(rate-limit): clean up request read failures * test(rate-limit): clean up decision read failures * fix(rate-limit): clean up decision read failures * test(rate-limit): bind decision to configured authority * fix(rate-limit): bind decision to configured authority * test(rate-limit): bind allow decisions to retry semantics * fix(rate-limit): enforce decision semantic invariants * test(rate-limit): fail closed on corrupt stored bucket * test(rate-limit): cover corrupt stored bucket shapes * fix(rate-limit): fail closed on corrupt stored buckets * fix(rate-limit): validate stored bucket shape * test(rate-limit): clean corrupt alarm state * fix(rate-limit): clean corrupt alarm state * test(rate-limit): reject future persisted windows * fix(rate-limit): reject future persisted windows * test(rate-limit): bound retry authority to fixed window * fix(rate-limit): bound retry guidance to fixed window * test(rate-limit): reject impossible persisted counts * fix(rate-limit): reject impossible persisted counts * test(rate-limit): require transactional alarm mutation * fix(rate-limit): keep alarm scheduling transactional * test(rate-limit): model SQLite alarm transaction API * fix(rate-limit): use SQLite storage alarm API in transaction * test(rate-limit): require corrupt state cleanup * fix(rate-limit): clear corrupt persisted bucket * test(rate-limit): reject impossible zero-count bucket * fix(rate-limit): reject impossible zero-count bucket * test(rate-limit): reject zero window start * fix(rate-limit): reject zero window start * fix(rate-limit): restore exact comment surface * test(rate-limit): reject unexpected decision fields * fix(rate-limit): require exact decision schema * chore(rate-limit): restore minimal decision-schema diff * test(rate-limit): reject unexpected request fields * fix(rate-limit): require exact request schema * test(rate-limit): reject persisted schema drift * fix(rate-limit): reject persisted schema drift * test(rate-limit): reject impossible allowed capacity * fix(rate-limit): reject impossible allowed capacity * test(rate-limit): align future-window corrupt-state fixture * test(rate-limit): align exact decision authority fixtures * test(rate-limit): cover bounded request residual branches * test(rate-limit): cover active-window alarm branch * test(rate-limit): use canonical bucket key in active-window fixture
opencode-agent
Bot
added
priority: medium
|
Caution Review failedAn error occurred during the review process. Please try again later. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Fail closed when buyer-facing release evidence output paths traverse symbolic-link parent components. Preserve existing release identity, SBOM, digest, timestamp, stable-read, and atomic leaf-write contracts.
Reject symbolic-link report leaves and parent traversal for Maintainer App readiness evidence by reusing Noema's hardened private evidence writer. Preserve collection, governance, and readiness semantics.
Reject symbolic-link production-governance report leaves and parent traversal by reusing Noema's hardened private evidence writer. Preserve live GitHub environment collection and governance evaluation semantics.
Harden runner-assignment retained evidence by requiring canonical UTC observed_at, binding validation and report retention to one observed_at snapshot, rejecting unsafe report parents, and using one filesystem authority for parent validation and atomic writes. Add realistic regressions and Unreleased changelog coverage.
Fail closed when retained observability NDJSON begins as structured JSON but cannot be parsed, while preserving tolerance for plain Wrangler diagnostic noise. Adds a realistic CLI RED regression and keeps existing UTF-8, duplicate-key, timestamp/status/latency and alert semantics unchanged.
Fail closed when direct KPI NDJSON begins as structured JSON but is malformed, while preserving tolerance for ordinary Wrangler diagnostic noise. Exact-head application CI, reviewer-ci, and central Security Scan passed before merge.
Require canonical http_request identity, bounded integer HTTP status, and finite non-negative numeric latency in direct KPI computation while preserving zero-millisecond p95 samples. Exact-head application CI, reviewer-ci, and central Security Scan passed before merge.
Fail closed when threshold KPI NDJSON begins as structured JSON but is malformed, while preserving ordinary Wrangler diagnostic noise tolerance. Exact-head application CI, reviewer-ci, and central Security Scan passed on the current live base before merge.
Fail closed on future/impossible deployment chronology and reject string-coerced traffic/KPI authority. Exact-head application CI, reviewer-ci, and central Security Scan passed on the current live base before merge.
Reject whitespace-normalized updated_at evidence so acquisition freshness authority requires canonical ISO identity.
Require the GitHub release view and release API to report one exact, canonical target commitish identity before emitting a publication receipt. Reject normalization-dependent evidence and preserve existing immutable-release, resolved-tag, asset-digest, timestamp, and stable-file checks.
Require GitHub release view and API URL evidence to match the canonical tag URL byte-for-byte. Reject whitespace-normalized release identities while preserving target-commitish, immutable-release, asset-digest, timestamp, and stable-file contracts.
Reject whitespace-normalized KPI provenance/source identities across retained strict evidence and production preflight, preserve raw sourceKind/sourceId authority, and cover the fail-closed paths with realistic structured regressions.
Reject unreviewed KPI provenance collection methods at the strict production evidence boundary while preserving the reviewed log-url and tail-command collector methods.
Fail closed when optional KPI provenance logPath metadata is present but does not exactly identify the production log whose bytes, digest, record count, source identity, and reviewed collection method are authenticated by the strict KPI gate.
Preserve exact security-evidence updated_at identity instead of trimming surrounding whitespace into authoritative ISO evidence. The focused regression keeps valid ISO dates and RFC 3339 timestamps accepted while padded evidence fails closed.
Fail closed when saleable-readiness pilot evidence claims onboarding completion or operations handover on future calendar dates. Preserve real-calendar validation, record the behavior change, and retain exact-head CI/reviewer/security evidence.
Integrate the patch-validator image/runtime/supply-chain slice after exact-head Application CI, reviewer-ci, central Security Scan, and dedicated patch-validator-image all reached terminal success with no unresolved review findings.
* test(pilot): reject placeholder evidence references * fix(pilot): reject placeholder evidence references * test(pilot): cover every documented sample marker * test(pilot): reject placeholder trace evidence * fix(pilot): reject placeholder trace evidence * test(pilot): reject ambiguous duplicate evidence authority * fix(pilot): reject duplicate readiness authority * test(pilot): reject malformed duplicate authority labels * fix(pilot): count malformed duplicate authority labels * test(pilot): reject loopback production URLs * fix(pilot): reject loopback production URLs * test(pilot): reject absolute local DNS names * fix(pilot): normalize absolute local DNS hosts * test(pilot): reject IPv4-mapped loopback URL * fix(pilot): reject IPv4-mapped loopback URL * test(pilot): reject local support-channel evidence * fix(pilot): reject local support-channel evidence * test(pilot): reject local-only production listener identities * fix(pilot): reject local-only production listener identities
* test(oidc): require current central workflow source * fix(oidc): trust current central workflow source * test(oidc): require current central workflow source * fix(oidc): trust current central workflow source
19 tasks
* test(oidc): require current central workflow source * fix(oidc): trust current central workflow source
* test(exchange): reject non-canonical target repository * fix(exchange): preserve canonical target repository authority * fix(exchange): restore canonical source bytes
This was referenced Aug 24, 2026
Promotes the exact source tree of draft PR #500 at bfae9ee. Exact-head ci, reviewer-ci, and central Security Scan passed. The dedicated image workflow was actively rebuilding the unchanged patch-validator image content to populate the new cache; Dockerfile.patch-validator and patch-validator runtime sources are unchanged by this PR.
…506) Supersedes draft PR #495 by promoting GitHub's verified current-base merge result at `064d56562de00a369bdd58a0c17c7001023afe28`. The promotion incorporated protected main `06c6b864d22576d94d538e3f143b9b48d38c2957` and source head `9e38a848448cb21b2fab7f323af0d3ebfdf1deb7`. Exact current-base CI, reviewer-ci, and required Security Scan passed. The source exact head also passed the dedicated patch-validator image/SBOM gate; intervening root integration did not alter incompatible image build inputs.
Reapply PR #425's content onto current main after an unrelated git history rewrite orphaned the branch's original base commit (a779375, pre-#450) from main's history (root ab3ebde, from #450 onward). README.md was byte-identical between the old base and current main, so the PR's own README.md diff applies verbatim. - Rewrite README.md as a customer/operator surface: product purpose, standalone run/deploy, /health /ready /exchange, orchestrator gateway contract, naruon/gyeot hub table, GitHub App permissions, operator vars, and links to onboarding/runbook/API spec/threat-model/deployment guide/SLA/OpenAPI. - Add docs/internal/README.md so maintainers still find the hourly-loop, acquisition, saleable-program, and KPI collect internals that moved out of the customer README. - Update the CHANGELOG.md Unreleased entry to the PR's refined wording, replacing the earlier draft of the same bullet already present on main. test/readme-customer-facing.test.ts continues to pass.
…e) into current main origin/main's history was rewritten (new root ab3ebde at PR #450); this PR's original base commit a779375 (#423-era) and its one commit 7d95ca2 predate that rewrite and share no ancestor with current main, so a normal merge is refused ("refusing to merge unrelated histories"). This records the old branch tip as merged history (satisfying "merge base into head", not a rebase, and not a force-push) while keeping the tree from the preceding commit, which already carries the old branch's content reapplied onto current main by hand (README.md patch applied verbatim since it was byte-identical at the old base; docs/internal/README.md copied from the old head; CHANGELOG.md bullet updated to the old head's wording).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Status
Draft. Not Ready. Do not merge. Do not APPROVE. (author's original hold — see "Out of scope" below; left in place, not overridden.)
This is a docs-only, unstacked pull request. Originally opened against live
mainata779375(2026-08-18).Update 2026-08-30 — root cause of the 12-day stall, now fixed
This PR was not stuck on unfinished work: its content (README.md rewrite,
docs/internal/README.md, CHANGELOG bullet) was complete from the first commit. It was stuck becausemain's git history was rewritten at some point at/after PR #450 (new root commitab3ebde, replacing the old roota6efba6). This PR's original base commita7793751(#423-era) predates that rewrite and shares no common ancestor with currentmain, so every normalgit merge/GitHub "Update branch" attempt failed with "refusing to merge unrelated histories" — surfacing on GitHub only as a silentmergeable_state: dirty, not an explicit rewrite warning. Any other long-lived branch based on pre-#450 history would hit the same wall.Fix applied and pushed to this same branch (
cursor/readme-operator-facing-3324, non-force, fast-forward — old commits1ac1ccb..7d95ca2remain in history as a merge parent):README.mdwas byte-identical between the old base (a7793751) and currentmain— no drift to reconcile — so the PR's own README diff applies verbatim onto currentmain.docs/internal/README.mdfrom this PR's head, and updated theCHANGELOG.mdUnreleased bullet to this PR's refined wording (currentmainhad already picked up the earlier draft wording of that same bullet from another commit; replaced it with this PR's wording).test/readme-customer-facing.test.ts(the existing contract test pinning "no bot-manual leftover" / required customer-facing terms) passes against the new README.npm run typecheck,npm test(full suite),npm run security:scan,npm run kpi:verify— all clean. (A handful of unrelated root-filesystem-permission tests —acquisition-data-room-manifest,acquisition-output-symlink,acquisition-review-regressions,immutable-release-publication— fail identically on a stockmaincheckout when run asroot; confirmed pre-existing/environmental, not a regression from this change.)mainis now clean at the git level (git merge-baseresolves tomain's tip); GitHub's own diff/mergeable-state cache may take a bit to catch up after the push.Problem (original)
The default-branch README already explained the product (GitHub App credential broker + independent LLM PR reviewer, MSA leaf, naruon/gyeot hubs). After the operator HTTP/OIDC sections it turned into a bot/sale-process manual: hourly commercial-readiness, hourly product development, acquisition audit, saleable-program goals, KPI provenance recipes, and readiness-scan internals. Buyers should not see that in README.
What changed
README.mdas a customer/operator surface: product purpose, standalone run/deploy,/health/ready/exchange, orchestrator gateway contract, naruon and gyeot composition-hub table, GitHub App permissions, operator vars a customer actually sets, and links to onboarding, runbook, API spec, threat model, deployment guide, SLA, and OpenAPI.docs/internal/README.mdso maintainers still find hourly-loop, acquisition, saleable-program, and KPI collect internals. Those files are not deleted.CHANGELOG.mdUnreleased docs entry.MSA: Noema remains a leaf. It must run independently and be callable. Naruon and gyeot stay composition hubs. Noema is not folded into a hub.
Files
README.mdCHANGELOG.mddocs/internal/README.mdNot in this PR: product code, workflows, CODEOWNERS, Semgrep, sandbox images, reviewer Python,
wrangler.tomlsecrets, ADR 0001–0011 bodies.Out of scope
Do not mark Ready. Do not merge. Do not treat this Draft as a review-comment deliverable. (This iteration honored that instruction: content is finished and verified, but the PR was left in Draft rather than flipped to ready-for-review, since that original hold reads as a deliberate scope/messaging decision for a human to lift, not a statement of unfinished work.)
<img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png">