ContextualWisdomLab · seonghobae · Sep 5, 2026 · Sep 5, 2026 · Sep 5, 2026 · Sep 5, 2026
@@ -1,3 +1,5 @@
-## 2024-05-20 - Repository without UI Codebase
-**Learning:** This repository is a GitHub organization profile consisting entirely of Markdown documentation and static assets, and does not contain an active UI or frontend application codebase.
-**Action:** Since there is no UI, no UX enhancements can be applied. Aborting UX enhancements and PR creation as per instructions.
+## 2026-09-29 - Product UI boundary confirmed
+
+**Learning:** This repository owns the ContextualWisdomLab GitHub Actions control plane, including production CI scripts, tests, workflows, and documentation. It does not own an interactive product UI or frontend application.
+
+**Action:** Do not invent product UI work in this repository. Improve the control-plane artifacts here and route reusable product UI work to its canonical product owner.
@@ -14,6 +14,7 @@ on:
       - "tests/test_agent_mention_*.py"
       - "tests/test_pr_review_fix_scheduler_coverage.py"
       - "requirements-opencode-review-ci-hashes.txt"
+      - "requirements-noema-document-ci-hashes.txt"
   push:
     branches: [main]
     paths:
@@ -27,6 +28,7 @@ on:
       - "tests/test_agent_mention_*.py"
       - "tests/test_pr_review_fix_scheduler_coverage.py"
       - "requirements-opencode-review-ci-hashes.txt"
+      - "requirements-noema-document-ci-hashes.txt"
 
 concurrency:
   group: agent-mention-router-quality-${{ github.repository }}-${{ github.event.pull_request.number || github.ref }}
@@ -85,11 +87,14 @@ jobs:
         with:
           python-version: "3.14"
           cache: pip
-          cache-dependency-path: requirements-opencode-review-ci-hashes.txt
+          cache-dependency-path: |
+            requirements-opencode-review-ci-hashes.txt
+            requirements-noema-document-ci-hashes.txt
       - name: Install exact hash-locked tooling
         run: >-
           python -m pip install --disable-pip-version-check --require-hashes
           -r requirements-opencode-review-ci-hashes.txt
+          -r requirements-noema-document-ci-hashes.txt
       - name: Run complete repository suite and bounded branch coverage
         shell: bash --noprofile --norc -e -o pipefail {0}
         run: |

@@ -2,7 +2,7 @@ name: Agent Review Runtime Quality CI
 
 on:
   pull_request:
-    branches: [main]
+    # Scan every PR base ref, including stacked feature branches.
     paths:
       - ".github/workflows/agent-review-runtime-quality-ci.yml"
       - ".github/workflows/noema-review.yml"
@@ -22,6 +22,7 @@ on:
       - "scripts/ci/ensure_rust_llvm19.sh"
       - "tests/test_opencode_rust_coverage_toolchain_contract.py"
       - "tests/test_rust_coverage_timeout_not_measured.py"
+      - "tests/test_coverage_incomplete_summary.py"
       - "scripts/ci/resolve_base_rust_toolchain.py"
       - "tests/test_resolve_base_rust_toolchain.py"
       - "scripts/ci/place_maturin_extension.py"
@@ -211,6 +212,7 @@ jobs:
               scripts/ci/ensure_rust_llvm19.sh|\
               tests/test_opencode_rust_coverage_toolchain_contract.py|\
               tests/test_rust_coverage_timeout_not_measured.py|\
+              tests/test_coverage_incomplete_summary.py|\
               scripts/ci/resolve_base_rust_toolchain.py|\
               tests/test_resolve_base_rust_toolchain.py|\
               scripts/ci/place_maturin_extension.py|\
@@ -391,8 +393,8 @@ jobs:
         if: steps.affected_suites.outputs.opencode == 'true'
         run: |
           set -euo pipefail
-          python -m pytest -q tests/test_opencode_rust_coverage_toolchain_contract.py tests/test_rust_coverage_timeout_not_measured.py tests/test_resolve_base_rust_toolchain.py tests/test_place_maturin_extension.py
-          python -m compileall -q tests/test_opencode_rust_coverage_toolchain_contract.py tests/test_resolve_base_rust_toolchain.py tests/test_place_maturin_extension.py
+          python -m pytest -q tests/test_opencode_rust_coverage_toolchain_contract.py tests/test_rust_coverage_timeout_not_measured.py tests/test_coverage_incomplete_summary.py tests/test_resolve_base_rust_toolchain.py tests/test_place_maturin_extension.py
+          python -m compileall -q tests/test_opencode_rust_coverage_toolchain_contract.py tests/test_coverage_incomplete_summary.py tests/test_resolve_base_rust_toolchain.py tests/test_place_maturin_extension.py
 
       - name: Verify JavaScript materializer documentation contract
         if: steps.affected_suites.outputs.opencode == 'true'

@@ -450,7 +450,10 @@ jobs:
             )"
           done < <(printf '%s' "$include_json" | jq -c '.[]')
 
-          statuses="$(gh api "repos/${TARGET_REPOSITORY}/commits/${PR_HEAD_SHA}/statuses")"
+          statuses="$(
+            gh api --paginate -f per_page=100 "repos/${TARGET_REPOSITORY}/commits/${PR_HEAD_SHA}/statuses" --jq '.[]' |
+              jq -s '.'
+          )"
           pending_matrix='[]'
           while IFS= read -r entry; do
             language="$(printf '%s' "$entry" | jq -r '.language // empty')"

@@ -221,7 +221,6 @@ jobs:
               exit 1
               ;;
           esac
-
           if [ "$SUPPLIED_HEAD_ENVELOPE" != "null" ]; then
             if [ "$(printf '%s' "$SUPPLIED_HEAD_ENVELOPE" | jq -r '
               type == "object"
@@ -264,7 +263,10 @@ jobs:
             exit 1
           fi
 
+          target_repository_component="${TARGET_REPOSITORY#ContextualWisdomLab/}"
           if ! [[ "$TARGET_REPOSITORY" =~ ^ContextualWisdomLab/[A-Za-z0-9_.-]+$ ]] ||
+            [[ "$target_repository_component" == *..* ]] ||
+            [[ "$target_repository_component" == *. ]] ||
             ! [[ "$PR_NUMBER" =~ ^[1-9][0-9]*$ ]]; then
             printf '::error::PR metadata validation rejected a target outside ContextualWisdomLab or an invalid pull request number. target=%s pr=%s\n' "${TARGET_REPOSITORY:-<empty>}" "${PR_NUMBER:-<empty>}"
             exit 1
@@ -1056,7 +1058,6 @@ jobs:
               "$RERUN_SCHEMA" "$rerun_languages" "$GITHUB_RUN_ID" "$GITHUB_RUN_ATTEMPT"
             exit 1
           fi
-
           if ! required_job_pages="$(github_api --paginate "repos/${TARGET_REPOSITORY}/actions/runs/${REQUIRED_RUN_ID}/jobs?per_page=100" | jq -s .)"; then
             echo "::error::CodeQL settlement could not read the required jobs."
             exit 1

@@ -2441,7 +2441,12 @@ jobs:
           if [ "$not_measured" -ne 0 ]; then
             append "- Not measured: ${not_measured} Rust coverage command(s) exceeded the 900 s per-command cap; line coverage for that code is unproven, not failed."
           fi
-          if [ "$failures" -eq 0 ]; then
+          if [ "$failures" -eq 0 ] && [ "$not_measured" -ne 0 ]; then
+            append "- Result: NOT MEASURED"
+            append "- Test evidence: incomplete; timed-out Rust suites are not proven passing."
+            append "- Coverage thresholds: not proven satisfied for unmeasured Rust code."
+            append "- Review handling: advisory only; this result is not approval evidence and does not replace required verification."
+          elif [ "$failures" -eq 0 ]; then
             append "- Result: PASS"
             if [ "$measured_any" -eq 0 ]; then
               append "- Test coverage: not applicable (no supported changed source files or package manifests)"
@@ -7052,6 +7057,12 @@ jobs:
               grep -Fq -- "- R test evidence: deferred package-load failures require a successful current-head peer R CMD check"
           }
 
+          coverage_decision_is_pass() {
+            local coverage_decision
+            coverage_decision="$(printf '%s\n' "${COVERAGE_EVIDENCE_SUMMARY:-}" | grep '^- Result:' || true)"
+            [ "$coverage_decision" = '- Result: PASS' ]
+          }
+
           collect_successful_r_cmd_check_evidence() {
             local output_file="$1"
             if ! gh pr checks "$PR_NUMBER" \
@@ -7149,7 +7160,8 @@ jobs:
           publish_blockers_after_model_unavailable() {
             local pending_wait_status body
 
-            if [ "${COVERAGE_EVIDENCE_RESULT:-skipped}" != "success" ]; then
+            if [ "${COVERAGE_EVIDENCE_RESULT:-skipped}" != "success" ] ||
+              ! coverage_decision_is_pass; then
               return 1
             fi
 
@@ -7278,6 +7290,7 @@ jobs:
             printf '%s\n' "$reviews_json" |
               python3 scripts/ci/opencode_existing_approval_gate.py \
                 --head "$HEAD_SHA" \
+                --coverage-summary "$COVERAGE_EVIDENCE_SUMMARY" \
                 --require-opencode-app
           }
 
@@ -7481,6 +7494,10 @@ jobs:
                 echo "::endgroup::"
                 exit 1
               fi
+              if ! coverage_decision_is_pass; then
+                stop_approval_without_review "COVERAGE_NOT_MEASURED" \
+                  "Coverage measurement is incomplete or its decision is missing. A successful advisory job is not approval evidence and does not replace required verification."
+              fi
               if request_changes_for_merge_conflict_if_present; then
                 echo "::endgroup::"
                 exit 0
@@ -7862,6 +7879,7 @@ jobs:
           RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
           OPENCODE_MODEL_POOL_OUTCOME: ${{ steps.opencode_review_model_pool.outputs.review_status }}
           COVERAGE_EVIDENCE_RESULT: ${{ needs.coverage-evidence.result }}
+          COVERAGE_EVIDENCE_SUMMARY: ${{ needs.coverage-evidence.outputs.coverage_summary || 'Coverage evidence job did not run or did not publish coverage evidence.' }}
           OPENCODE_STATUS_TOKEN_SOURCE: ${{ needs.validate-pr-metadata.outputs.target_repository == github.repository && 'github-token' || secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN' || secrets.OPENCODE_APPROVE_TOKEN != '' && 'OPENCODE_APPROVE_TOKEN' || steps.opencode_app_token.outputs.available == 'true' && 'opencode-app' || 'github-token' }}
           OPENCODE_CHANGED_FILES_FILE: ${{ runner.temp }}/opencode-changed-files.txt
           OPENCODE_ARTIFACT_MANIFEST_SHA256: ${{ steps.seal_artifacts.outputs.manifest_sha256 }}
@@ -7895,6 +7913,7 @@ jobs:
               python3 scripts/ci/opencode_dispatch_status.py \
                 --model-outcome "${OPENCODE_MODEL_POOL_OUTCOME:-missing}" \
                 --coverage-result "${COVERAGE_EVIDENCE_RESULT:-missing}" \
+                --coverage-summary "${COVERAGE_EVIDENCE_SUMMARY:-}" \
                 --expected-head "$PR_HEAD_SHA" \
                 --pull-request-file "$pull_request_file" \
                 --reviews-file "$reviews_file"
@@ -7954,6 +7973,7 @@ jobs:
           PR_BASE_REF: ${{ needs.validate-pr-metadata.outputs.base_ref }}
           PR_NUMBER: ${{ needs.validate-pr-metadata.outputs.pr_number }}
           PR_HEAD_SHA: ${{ needs.validate-pr-metadata.outputs.head_sha }}
+          COVERAGE_EVIDENCE_SUMMARY: ${{ needs.coverage-evidence.outputs.coverage_summary || 'Coverage evidence job did not run or did not publish coverage evidence.' }}
           OPENCODE_CHANGED_FILES_FILE: ${{ runner.temp }}/opencode-changed-files.txt
           OPENCODE_ARTIFACT_MANIFEST_SHA256: ${{ steps.seal_artifacts.outputs.manifest_sha256 }}
           OPENCODE_SOURCE_WORKDIR: ${{ runner.temp }}/opencode-pr-head
@@ -7985,6 +8005,7 @@ jobs:
               if printf '%s\n' "$reviews_json" |
                 python3 scripts/ci/opencode_existing_approval_gate.py \
                   --head "$PR_HEAD_SHA" \
+                  --coverage-summary "$COVERAGE_EVIDENCE_SUMMARY" \
                   --require-opencode-app \
                   2>"$gate_error_file"; then
                 approval_visible=1

@@ -504,6 +504,7 @@ jobs:
           SCHEDULER_DISPATCH_TOKEN: ${{ github.token }}
           SCHEDULER_READ_TOKEN: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.target_repository != '' && github.event.client_payload.target_repository != github.repository && (secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.scheduler_app_token.outputs.token) || github.token }}
           SCHEDULER_MUTATION_TOKEN_SOURCE: ${{ secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN' || secrets.OPENCODE_APPROVE_TOKEN != '' && 'OPENCODE_APPROVE_TOKEN' || steps.scheduler_app_token.outputs.available == 'true' && 'opencode-app' || 'github-token' }}
+          SCHEDULER_WORKFLOW_TOKEN: ${{ github.token }}
           SCHEDULER_REQUIRED_WORKFLOW_REPOSITORY: ContextualWisdomLab/.github
           SCHEDULER_ALLOW_CROSS_REPO_REPOSITORY_DISPATCH: ${{ (secrets.PR_REVIEW_MERGE_TOKEN != '' || secrets.OPENCODE_APPROVE_TOKEN != '') && 'true' || 'false' }}
         run: |

@@ -24,8 +24,8 @@ name: Python Security
 
 on:
   pull_request:
+    # Scan every PR base ref, including stacked feature branches.
     types: [opened, synchronize, reopened, ready_for_review, closed]
-    branches: [main, master, develop]
   push:
     branches: [main, master, develop]
   # Periodic full-repo coverage so non-PR drift is caught (the removed local

@@ -18,6 +18,8 @@ on:
       - "tests/test_repository_label_convergence.py"
       - "tests/test_repository_label_identity.py"
       - "tests/test_repository_label_live_verification.py"
+      - "requirements-noema-document-ci.txt"
+      - "requirements-noema-document-ci-hashes.txt"
       - ".github/workflows/repository-metadata-reconcile.yml"
   schedule:
     - cron: "23 * * * *"
@@ -42,6 +44,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 0
           persist-credentials: false
       - name: Verify exact revision
         shell: bash
@@ -54,6 +57,7 @@ jobs:
         run: >-
           python -m pip install --disable-pip-version-check --require-hashes
           --only-binary=:all: -r requirements-opencode-review-ci-hashes.txt
+          -r requirements-noema-document-ci-hashes.txt
       - name: Validate desired state
         run: |
           set -euo pipefail

@@ -1,5 +1,8 @@
 name: Trusted uv Materializer Quality CI
 
+# Reuse the minimum-version and full-quality job for every main push; a
+# separate post-merge gate would repeat the full suite on materializer changes.
+
 on:
   pull_request:
     branches: [main]
@@ -12,19 +15,10 @@ on:
       - "tests/test_uv*.py"
       - "tests/test_repository_branch_coverage_*.py"
       - "requirements-opencode-review-ci-hashes.txt"
+      - "requirements-noema-document-ci-hashes.txt"
       - "pyproject.toml"
   push:
     branches: [main]
-    paths:
-      - ".github/workflows/trusted-uv-materializer-quality-ci.yml"
-      - "scripts/ci/materialize_base_python_requirements.py"
-      - "tests/conftest.py"
-      - "tests/test_materialize*.py"
-      - "tests/test_trusted_uv*.py"
-      - "tests/test_uv*.py"
-      - "tests/test_repository_branch_coverage_*.py"
-      - "requirements-opencode-review-ci-hashes.txt"
-      - "pyproject.toml"
 
 concurrency:
   group: trusted-uv-materializer-quality-${{ github.repository }}-${{ github.event.pull_request.number || github.ref }}
@@ -37,10 +31,10 @@ env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
 jobs:
-  minimum-python-contract:
-    name: Python 3.10 compatibility contract
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
+  full-quality-gate:
+    name: Python 3.14 full quality gate
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
     steps:
       - name: Harden runner
         uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
@@ -51,9 +45,11 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Set up minimum supported Python
+        id: minimum_python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.10"
@@ -83,33 +79,29 @@ jobs:
           assert materializer.tomllib.STUB_MARKER is True
           PY
 
-  full-quality-gate:
-    name: Python 3.14 full quality gate
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
-        with:
-          egress-policy: audit
-
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-          ref: ${{ github.event.pull_request.head.sha }}
-
       - name: Set up current stable Python
+        id: stable_python
+        # Keep the former independent full gate running after a 3.10 failure.
+        # A skipped minimum setup means hardening/checkout failed or cancellation.
+        if: ${{ !cancelled() && (steps.minimum_python.outcome == 'success' || steps.minimum_python.outcome == 'failure') }}
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.14"
           cache: pip
-          cache-dependency-path: requirements-opencode-review-ci-hashes.txt
+          cache-dependency-path: |
+            requirements-opencode-review-ci-hashes.txt
+            requirements-noema-document-ci-hashes.txt
 
       - name: Install hash-locked quality tooling
-        run: python -m pip install --disable-pip-version-check --require-hashes -r requirements-opencode-review-ci-hashes.txt
+        id: quality_tooling
+        if: ${{ !cancelled() && steps.stable_python.outcome == 'success' }}
+        run: >-
+          python -m pip install --disable-pip-version-check --require-hashes
+          -r requirements-opencode-review-ci-hashes.txt
+          -r requirements-noema-document-ci-hashes.txt
 
       - name: Run trusted uv tests with complete branch coverage
+        if: ${{ !cancelled() && steps.quality_tooling.outcome == 'success' }}
         run: |
           cat >"${RUNNER_TEMP}/trusted-uv-coveragerc" <<'EOF'
           [run]
@@ -134,20 +126,34 @@ jobs:
             tests/test_uv_redirect_boundary.py \
             tests/test_uv_workspace_fail_closed.py \
             tests/test_trusted_uv_materializer_quality_workflow_contract.py \
-            -q
+            -q -W error
           python -m coverage report
 
       - name: Run complete central test and branch coverage gate
+        if: ${{ !cancelled() && steps.quality_tooling.outcome == 'success' }}
         run: |
           unset COVERAGE_RCFILE
           python -m coverage erase
-          python -m coverage run -m pytest tests -q
+          # -W error keeps every warning this repository can act on fatal.
+          # PytestUnraisableExceptionWarning is exempted back to a printed
+          # warning because it reports a finalizer that raised during garbage
+          # collection inside a dependency (`_TemporaryFileCloser.__del__`);
+          # pytest attributes it to whichever test happens to be running at
+          # that moment, so with -W error alone it fails a rotating set of
+          # unrelated tests (11 of them on 2026-09-06, run 34024435377) and
+          # names none of them accurately. Reproduced on Python 3.12 with a
+          # three-arm control: the warning is raised in all arms, -W error
+          # alone turns it into a failure, and this exemption returns it to
+          # "passed, 1 warning" while every other class stays fatal.
+          python -m coverage run -m pytest tests -q -W error -W default::pytest.PytestUnraisableExceptionWarning
           python -m coverage report
 
       - name: Enforce complete production docstrings
-        run: python -m interrogate --fail-under 100 scripts/ci/materialize_base_python_requirements.py
+        if: ${{ !cancelled() && steps.quality_tooling.outcome == 'success' }}
+        run: python -m interrogate --fail-under 100
 
       - name: Compile production and quality contracts
+        if: ${{ !cancelled() && steps.stable_python.outcome == 'success' }}
         run: |
           python -m compileall -q \
             scripts/ci/materialize_base_python_requirements.py \