ContextualWisdomLab · seonghobae · Sep 1, 2026 · Sep 1, 2026 · Sep 1, 2026 · Sep 1, 2026
@@ -1,3 +1,5 @@
-## 2024-05-20 - Repository without UI Codebase
-**Learning:** This repository is a GitHub organization profile consisting entirely of Markdown documentation and static assets, and does not contain an active UI or frontend application codebase.
-**Action:** Since there is no UI, no UX enhancements can be applied. Aborting UX enhancements and PR creation as per instructions.
+## 2026-09-29 - Product UI boundary confirmed
+
+**Learning:** This repository owns the ContextualWisdomLab GitHub Actions control plane, including production CI scripts, tests, workflows, and documentation. It does not own an interactive product UI or frontend application.
+
+**Action:** Do not invent product UI work in this repository. Improve the control-plane artifacts here and route reusable product UI work to its canonical product owner.
@@ -13,7 +13,10 @@ on:
       - "scripts/ci/agent_mention_sweep.py"
       - "tests/test_agent_mention_*.py"
       - "tests/test_pr_review_fix_scheduler_coverage.py"
+      - "requirements-opencode-review-ci.txt"
+      - "requirements-noema-document-ci.txt"
       - "requirements-opencode-review-ci-hashes.txt"
+      - "scripts/ci/compile_opencode_review_lock.sh"
   push:
     branches: [main]
     paths:
@@ -26,7 +29,10 @@ on:
       - "scripts/ci/agent_mention_sweep.py"
       - "tests/test_agent_mention_*.py"
       - "tests/test_pr_review_fix_scheduler_coverage.py"
+      - "requirements-opencode-review-ci.txt"
+      - "requirements-noema-document-ci.txt"
       - "requirements-opencode-review-ci-hashes.txt"
+      - "scripts/ci/compile_opencode_review_lock.sh"
 
 concurrency:
   group: agent-mention-router-quality-${{ github.repository }}-${{ github.event.pull_request.number || github.ref }}

@@ -63,6 +63,8 @@ on:
       - "scripts/ci/contextual_orchestrator_review_sidecar.sh"
       - "tests/test_zdr_policy.py"
       - "tests/test_contextual_orchestrator_review_policy.py"
+      - "tests/test_contextual_orchestrator_review_launcher.py"
+      - "tests/test_review_preflight_concurrency.py"
       - "tests/test_contextual_orchestrator_review_sidecar_contract.py"
       - "tests/test_sidecar_disk_free_guard.py"
       - "tests/test_hourly_review_repair_callers.py"
@@ -116,9 +118,11 @@ on:
       - "docs/doctoring/exact-artifact-sbom-attestation.md"
       - "docs/doctoring/exact-artifact-sbom-quality-runner-consolidation-20260903.md"
       - "CHANGELOG.d/20260903-exact-artifact-quality-runner-consolidation.md"
+      - "requirements-opencode-review-ci.txt"
       - "requirements-opencode-review-ci-hashes.txt"
       - "requirements-noema-document-ci.txt"
       - "requirements-noema-document-ci-hashes.txt"
+      - "scripts/ci/compile_opencode_review_lock.sh"
 
 # PR validation only: a new head cancels only an older run of this workflow
 # for the same repository and pull request.
@@ -237,11 +241,13 @@ jobs:
               tests/test_strix_quality_timeout_fixture_budget.py)
                 strix_suite=true
                 ;;
-              requirements-opencode-review-ci-hashes.txt)
+              requirements-opencode-review-ci.txt|\
+              requirements-opencode-review-ci-hashes.txt|\
+              requirements-noema-document-ci.txt|\
+              scripts/ci/compile_opencode_review_lock.sh)
                 noema_suite=true
                 opencode_suite=true
                 ;;
-              requirements-noema-document-ci.txt|\
               requirements-noema-document-ci-hashes.txt)
                 noema_suite=true
                 ;;
@@ -267,6 +273,8 @@ jobs:
               scripts/ci/contextual_orchestrator_review_sidecar.sh|\
               tests/test_zdr_policy.py|\
               tests/test_contextual_orchestrator_review_policy.py|\
+              tests/test_contextual_orchestrator_review_launcher.py|\
+              tests/test_review_preflight_concurrency.py|\
               tests/test_contextual_orchestrator_review_sidecar_contract.py|\
               tests/test_sidecar_disk_free_guard.py|\
               tests/test_hourly_review_repair_callers.py|\
@@ -444,11 +452,14 @@ jobs:
             --cov=scripts.ci.pr_review_autofix_context \
             --cov=scripts.ci.zdr_policy \
             --cov=scripts.ci.contextual_orchestrator_review_policy \
+            --cov=scripts.ci.contextual_orchestrator_review_launcher \
             --cov-branch \
             --cov-fail-under=100 \
             tests/test_pr_review_conflict_scope.py \
             tests/test_zdr_policy.py \
             tests/test_contextual_orchestrator_review_policy.py \
+            tests/test_contextual_orchestrator_review_launcher.py \
+            tests/test_review_preflight_concurrency.py \
             tests/test_contextual_orchestrator_review_sidecar_contract.py \
             tests/test_sidecar_disk_free_guard.py \
             tests/test_hourly_review_repair_callers.py \
@@ -488,6 +499,8 @@ jobs:
             scripts/ci/contextual_orchestrator_review_launcher.py \
             tests/test_zdr_policy.py \
             tests/test_contextual_orchestrator_review_policy.py \
+            tests/test_contextual_orchestrator_review_launcher.py \
+            tests/test_review_preflight_concurrency.py \
             tests/test_contextual_orchestrator_review_sidecar_contract.py \
             tests/test_sidecar_disk_free_guard.py \
             tests/test_hourly_review_repair_callers.py \

@@ -493,6 +493,10 @@ jobs:
           trusted_archive="${RUNNER_TEMP}/trusted-noema-source.tar.gz"
           api_url="${GITHUB_API_URL:-https://api.github.com}"
           curl -fsSL \
+            --retry 3 \
+            --retry-all-errors \
+            --retry-delay 1 \
+            --retry-max-time 30 \
             -H "Authorization: Bearer ${GH_TOKEN}" \
             -H "Accept: application/vnd.github+json" \
             -o "$trusted_archive" \

@@ -152,6 +152,10 @@ jobs:
           api_url="${GITHUB_API_URL:-https://api.github.com}"
           mkdir -p "$trusted_source_dir"
           curl -fsSL \
+            --retry 3 \
+            --retry-all-errors \
+            --retry-delay 1 \
+            --retry-max-time 30 \
             -H "Authorization: Bearer ${GH_TOKEN}" \
             -H "Accept: application/vnd.github+json" \
             -o "$trusted_archive" \

@@ -354,6 +354,10 @@ jobs:
           trusted_archive="${RUNNER_TEMP}/trusted-scheduler-source.tar.gz"
           api_url="${GITHUB_API_URL:-https://api.github.com}"
           curl -fsSL \
+            --retry 3 \
+            --retry-all-errors \
+            --retry-delay 1 \
+            --retry-max-time 30 \
             -H "Authorization: Bearer ${GH_TOKEN}" \
             -H "Accept: application/vnd.github+json" \
             -o "$trusted_archive" \

@@ -5,6 +5,8 @@ on:
     paths:
       - "config/repository-metadata.json"
       - "config/repository-label-taxonomy.json"
+      - "docs/doctoring/repository-label-taxonomy-wave-3.md"
+      - "docs/doctoring/repository-public-surface-reconciliation.md"
       - "scripts/ci/reconcile_repository_metadata.py"
       - "scripts/ci/reconcile_repository_labels.py"
       - "tests/test_repository_metadata_reconciliation.py"
@@ -14,10 +16,15 @@ on:
       - "tests/test_repository_metadata_workflow.py"
       - "tests/test_repository_metadata_workflow_pages.py"
       - "tests/test_repository_label_taxonomy.py"
+      - "tests/test_repository_label_taxonomy_workflow_trigger.py"
       - "tests/test_repository_label_reconciliation.py"
       - "tests/test_repository_label_convergence.py"
       - "tests/test_repository_label_identity.py"
       - "tests/test_repository_label_live_verification.py"
+      - "requirements-opencode-review-ci.txt"
+      - "requirements-opencode-review-ci-hashes.txt"
+      - "requirements-noema-document-ci.txt"
+      - "scripts/ci/compile_opencode_review_lock.sh"
       - ".github/workflows/repository-metadata-reconcile.yml"
   schedule:
     - cron: "23 * * * *"
@@ -42,6 +49,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 0
           persist-credentials: false
       - name: Verify exact revision
         shell: bash

@@ -2,28 +2,37 @@ name: Trusted uv Materializer Quality CI
 
 on:
   pull_request:
-    branches: [main]
     paths:
       - ".github/workflows/trusted-uv-materializer-quality-ci.yml"
       - "scripts/ci/materialize_base_python_requirements.py"
+      - "scripts/ci/verify_release_maturin_tool_assets.py"
       - "tests/conftest.py"
       - "tests/test_materialize*.py"
       - "tests/test_trusted_uv*.py"
       - "tests/test_uv*.py"
       - "tests/test_repository_branch_coverage_*.py"
+      - "tests/test_verify_release_maturin_tool_assets.py"
+      - "requirements-opencode-review-ci.txt"
+      - "requirements-noema-document-ci.txt"
       - "requirements-opencode-review-ci-hashes.txt"
+      - "scripts/ci/compile_opencode_review_lock.sh"
       - "pyproject.toml"
   push:
     branches: [main]
     paths:
       - ".github/workflows/trusted-uv-materializer-quality-ci.yml"
       - "scripts/ci/materialize_base_python_requirements.py"
+      - "scripts/ci/verify_release_maturin_tool_assets.py"
       - "tests/conftest.py"
       - "tests/test_materialize*.py"
       - "tests/test_trusted_uv*.py"
       - "tests/test_uv*.py"
       - "tests/test_repository_branch_coverage_*.py"
+      - "tests/test_verify_release_maturin_tool_assets.py"
+      - "requirements-opencode-review-ci.txt"
+      - "requirements-noema-document-ci.txt"
       - "requirements-opencode-review-ci-hashes.txt"
+      - "scripts/ci/compile_opencode_review_lock.sh"
       - "pyproject.toml"
 
 concurrency:
@@ -98,6 +107,7 @@ jobs:
         with:
           persist-credentials: false
           ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
 
       - name: Set up current stable Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0

@@ -0,0 +1,7 @@
+## Fixed
+
+- Close file-like `HTTPError` responses in the central CodeQL, Strix, Noema,
+  Pingora, review-preflight, Pages, and sandbox-readiness clients after bounded
+  status/telemetry extraction, preventing Python 3.14 resource leaks without
+  permitting redirects, suppressing warnings, or weakening bearer-token
+  authority checks; cap CodeQL diagnostic error-body reads at 400 bytes.
@@ -2,6 +2,8 @@
 
 - `scripts/ci/verify_release_maturin_tool_assets.py` fetches from a fixed
   `https://github.com/PyO3/maturin/releases/download/v1.15.0/` origin, and `verify_assets` admits only
-  five literal asset names, but `p/default`'s `dynamic-urllib-use-detected` flagged the call on
-  main and failed Semgrep on every PR. The call now carries the repository's standard reasoned
-  `nosemgrep`/`nosec B310` suppression.
+  five literal asset names. The downloader now uses a standard-library opener
+  that admits one credential-free HTTPS redirect only from the exact GitHub
+  release path to `release-assets.githubusercontent.com`, bounds the response,
+  and closes it on every path. It uses neither `urlopen` nor
+  `HTTPSConnection`, and carries no `nosemgrep` or `nosec` suppression.
@@ -0,0 +1,5 @@
+## Fixed
+
+- Restore the complete product and technical gap baseline after a connector
+  display truncation replaced the source artifact, and add a regression guard
+  that rejects future truncation banners.
@@ -0,0 +1,5 @@
+### Noema document reader closes new transitive advisories
+
+- The generated npm lock now selects `fast-uri` 3.1.8 and `ip-address` 10.7.1,
+  removing the three medium-severity findings published against the previous
+  transitive versions while leaving the direct runtime manifest unchanged.
@@ -0,0 +1,8 @@
+### Noema document reader transitive security updates
+
+- Updated the locked `fast-uri` dependency from 3.1.7 to 3.1.8 and
+  `ip-address` from 10.7.0 to 10.7.1. These are the first releases outside
+  the affected ranges for GHSA-hrr3-gc8f-f4qj, GHSA-j6r3-76f7-8jcv, and
+  GHSA-h3mg-xc3c-68pw. The direct dependency ranges are unchanged.
+- Added a deterministic regression contract that rejects reintroduction of
+  vulnerable hoisted or nested copies of either transitive package.
@@ -0,0 +1,6 @@
+### Shared Strix LiteLLM security floor
+
+- Pinned LiteLLM 1.94.3 in the Strix source input and regenerated the complete
+  hash lock after exact-head `pip-audit` found CVE-2026-84377 in 1.94.1.
+- Added a source/lock parity regression contract and preserved the stacked Noema
+  document-reader transitive security repair without copying its implementation.
@@ -0,0 +1,6 @@
+### Central review source survives transient GitHub archive failures
+
+- Required Noema, Required OpenCode, and the PR review merge scheduler now use
+  bounded native `curl` retries when materializing the immutable trusted
+  `.github` source archive. Authentication, exact-SHA binding, extraction, and
+  fail-closed behavior are unchanged.
@@ -1,3 +1,81 @@
+### Maturin download failures close every transport response
+
+- Refactor the bounded Maturin asset downloader so successful and rejected
+  responses share one unconditional close path while `HTTPError` keeps its own
+  explicit close path. A new regression exercises a non-200 response and an
+  opener-raised HTTP error. This removes an impossible optional-response branch
+  without changing hosts, redirects, byte limits, hashes, or fail-closed error
+  mapping; the focused suite is 17 passed with 100% statement and branch
+  coverage. The trusted full-suite workflow now also tracks the verifier source
+  and its focused test, so a future lifecycle change cannot omit the repository
+  coverage gate that detected this regression. The pull-request trigger admits
+  stacked canonical-owner bases as well as `main`; the protected-branch push
+  trigger remains restricted to `main`.
+
+### Shared Strix lock advances beyond the PyJWT recursion DoS
+
+- Advance the explicit Strix source pin and generated hash lock from PyJWT
+  `2.14.0` to `2.15.0`, closing GHSA-42vr-xj54-vc7v / CVE-2026-101918. Exact Security
+  Scan run `36741151937` found the advisory in dependent PR #2540; the
+  canonical owner repair stays in #2531. A source/lock contract, deterministic
+  lock regeneration, and pip-audit evidence keep the dependent branch free of a
+  leaf workaround and prevent a return to `2.14.0`. Exact-head hosted security
+  Checks, independent approval, ordinary protected integration, and immutable
+  consumer-pin advancement remain required before release admission.
+
+### Shared urllib3 locks close proxy and streaming CVEs
+
+- Pin urllib3 2.8.0 as an explicit source input in both the pip-audit and
+  Strix security-tooling closures, regenerate their hash locks without unrelated
+  version movement, and add a four-file parity contract. This closes
+  CVE-2026-97687 and CVE-2026-97689 found by exact-head Python Security while
+  preserving hash checking and the existing Strix cryptography override.
+
+### Full-suite parser locks and honest branch coverage converge
+
+- Consolidated the complete valid ancestry of `.github#2521` into `.github#2530`
+  with ordinary two-parent merges so the parser-lock and repository-coverage
+  gates no longer wait on one another. Behavior-level tests exercise the final
+  branches in the OpenCode queue, Strix dependency classifier, release runtime
+  prescreener, and release dependency gate without exclusions, pragmas,
+  threshold reductions, or sample shrinking. Direct consumers of the common
+  generated lock now also track both source requirements and the canonical
+  compiler. `.github#2532`'s warning-fatal HTTP response-lifecycle repair is
+  carried in the same successor so the complete suite can regenerate one
+  exact-head receipt. Protected hosted Checks and qualifying independent review
+  remain mandatory before ordinary merge; predecessors remain open until
+  merged-tree equivalence is proven. The combined Python 3.14 warnings-fatal
+  suite passes 5,291 tests with 5 optional skips and 40 subtests; all 18,729
+  production statements and 7,642 branches are covered, and production
+  Docstring coverage is 100%. The durable review-repair owner also triggers,
+  executes, compiles, and measures both launcher runtime suites at 100%.
+  Exact Git blobs, Cargo development locks, runtime receipts, final fanout caps,
+  and the Python 3.10 TOML fallback are covered as explicit trust boundaries;
+  one unreachable postcondition was removed only after prior fail-closed
+  validation made that state mechanically impossible.
+
+### Full-suite quality environments install their collection parsers
+
+- The common OpenCode quality input now owns the existing hash-pinned
+  `defusedxml` document parser and `PyYAML` workflow parser used during complete
+  repository test collection. Its Python 3.14/Linux lock was regenerated by
+  the repository compiler without manual hash edits. Local verification
+  reproduced the lock byte-for-byte, installed the common and Noema locks
+  together, imported both parsers, and passed 73 focused contracts with two
+  optional skips. Hosted exact-head Checks and qualifying independent review
+  remain required before protected merge.
+
+### Shared security fixtures use patched PyJWT and PyO3 releases
+
+- The Strix hash lock now takes PyJWT `2.14.0` as an explicit source input,
+  closing CVE-2026-102274 without hiding the dependency in the cryptography-only
+  override file. The offline Rust coverage fixture advances from PyO3 `0.22.6`
+  to `0.29.2`, beyond the `0.29.0` fixes for GHSA-36hh-v3qg-5jq4 and
+  GHSA-chgr-c6px-7xpp. Source/lock parity tests prevent either generated lock
+  from silently returning to the vulnerable versions. Protected integration,
+  immutable consumer-pin advancement, and fresh exact-head hosted security
+  Checks remain required before release admission.
+
 ### Intel macOS native archives are bound to x86_64 bytes
 
 - The release prescreener now requires every native member in an Intel macOS