Restore authoritative Dependency Review evidence for PolicyWeave PR #1

[seonghobae]

Fresh authority check — 2026-10-03

• Canonical root writer remains PR #1, develop → protected main, at exact head 60fd7fb5c3177984a993102742bb16e36a909e2d; stacked PR #25 remains based on that exact head at af8c0da17cdfb4786867f4e85401dbbb811b581e.
• PR feat: bootstrap PolicyWeave privacy policy workspace #1 exact-head CI 36241748023, SAST 36241747980, and CodeQL 36241747969 are terminal success. Required Security 36241747990 remains terminal failure because the authoritative base/head Dependency Review comparison returned HTTP 403 before the pinned action could run.
• The canonical owner incident ContextualWisdomLab/.github#810 remains open and blocked. Its current exit criteria still require an authorized availability/configuration repair plus fresh HTTP 200 ordinary and stacked canaries; no released owner repair exists to consume.
• Both PolicyWeave PRs remain Draft. PR feat: bootstrap PolicyWeave privacy policy workspace #1 has no qualifying independent approval; PR feat: cancel stale local draft imports #25 cannot integrate before its parent and likewise has no qualifying approval. Current inline-thread queries return zero unresolved threads.
• The dependency pin, build-time placement, lock, and CycloneDX implementation described below is already present in the canonical writer history. This issue is deliberately kept open under its corrected title to track the remaining authoritative Dependency Review evidence and ordinary protected integration—not to recreate completed product-source work.
• No blind rerun, lifecycle toggle, no-op commit, substitute scanner, synthetic status, protection weakening, merge, or issue closure was performed.

Exact-head security rerun — 2026-10-01

Required Security run 36241747990 was rerun without changing protected base 52f4fd6bb68f870d0519cf11dd471573a2f197c0 or PR #1 head 60fd7fb5c3177984a993102742bb16e36a909e2d. New dependency-review job 110221939186 reproduced the owner incident: authenticated exact-base/head compare returned HTTP 403, curl_exit=0; the pinned Dependency Review action was skipped and the required job failed closed. Scorecard, Trivy, and OSV passed again but do not replace the missing dependency diff.

The product source has no new repair delta for this owner-plane availability failure. PR #1 and this issue remain open/Draft pending ContextualWisdomLab/.github#810, a qualifying independent approval, and a fresh exact-head authoritative Dependency Review result. No gate weakening, synthetic success, issue closure, or merge is authorized.

Current integration state — 2026-09-30

The dependency pin/scope/SBOM repair from historical PR #13 is integrated into the product branch history. The canonical root writer remains PR #1, develop → protected main, exact head 60fd7fb5c3177984a993102742bb16e36a909e2d, tree 54c19ce3a7b46d8dda055bf778c6c7327fe8e0b9, protected base 52f4fd6bb68f870d0519cf11dd471573a2f197c0. Stacked Draft PR #25 is based on that unchanged head; it is not a replacement owner. PR #1 is Draft because required Security evidence is terminal-failing and qualifying approvals remain 0. This issue stays open; no valid delta is closed or retired.

Current exact-head CI 36241748023, Semgrep 36241747980, and CodeQL 36241747969 are terminal success. CI produced exact-head browser artifact 10913167115 (sha256:fdbe823578ce068ab23728f3835479ab8c689a51c68477704a777a0744bfb2a1) and exact-head CycloneDX artifact 10912873052 (sha256:4e06815ac5d0b6e128d8071fa18ca08ca707d153c2d1b684ab06d9bc44def2f7). Security 36241747990 is terminal failure: job 108815523383 verified the exact checkout, then the Dependency Review support request for the exact base/head returned HTTP 403, curl_exit=0; the pinned action was skipped and the workflow failed closed. Scorecard, Trivy and OSV success do not replace Dependency Review. All 17 inline threads are resolved, but there is no qualifying approval. Canonical owner incident: ContextualWisdomLab/.github#810.

Predecessor Direct-head CI 34682685358, attempt 1, job 103524109831, checked out the literal head f11fe7827160a5f54cc76101050c41f0c6e156f3 and completed successfully: clean install, lint, five local-preview pretests, 163 Vitest cases including dependency contracts, build, PostgreSQL 18.6 migration/concurrency/restart/restore and 23 browser passes plus 10 existing scoped skips.

The CycloneDX artifact 10294182797 is bound to that head with ZIP digest sha256:28fde2bad87569a4657119a708d42c2943fa52beec3ead42d0d3cf4e515ac39a. The ZIP was downloaded and its SHA-256 independently verified before parsing its single policyweave-dependency-sbom.cdx.json file.

CycloneDX 1.5 describes 244 installed components on that CI platform. Declared-license counts: MIT 186, Apache-2.0 21, ISC 13, BSD-2-Clause 8, MPL-2.0 5, BlueOak-1.0.0 4, BSD-3-Clause 3, MIT-0 2, CC-BY-4.0 1 and CC0-1.0 1. No component lacks license metadata. The parsed inventory has no GPL/AGPL/SSPL license string. This is a scoped installed-component inventory, not the complete cross-platform lock graph and not a compatibility/legal approval.

The five MPL-2.0 components are @axe-core/playwright@4.13.0, axe-core@4.13.0, lightningcss@1.33.0, lightningcss-linux-x64-gnu@1.33.0 and lightningcss-linux-x64-musl@1.33.0; the CC-BY-4.0 component is caniuse-lite@1.0.30001810. Their SBOM optional scope must not be misread as proof that all distribution/NOTICE/attribution obligations are discharged. Review actual shipped output and the relevant dependency terms before release.

Predecessor Security run 34682687378, dependency-review job 103524153573, fails closed at the exact base/head compare with HTTP 403 and curl exit 0. Canonical incident: ContextualWisdomLab/.github#810. Successful OSV/Trivy/Scorecard or the presence of an SBOM cannot substitute for Dependency Review or the independent approval required by live branch protection. No issue close, protection change or synthetic status is authorized by this update.

Original problem and locked-version evidence — historical

At PolicyWeave PR #11 exact head b8171c9019dfbbd92c5d6ad71a0160bd8bfb11ee, package.json and the root package entry in package-lock.json used mutable latest declarations. The lock made npm ci reproducible for that tree, but manifest regeneration remained open to unreviewed major-version and license/provenance changes.

The manifest also placed @vitejs/plugin-react, typescript, and vite in runtime dependencies, although they are build/toolchain responsibilities for this static browser product.

The original locked-resolution evidence for those declarations was:

• runtime group before correction: @vitejs/plugin-react@6.1.1, lucide-react@1.38.0, react@19.2.8, react-dom@19.2.8, vite@8.2.2;
• development group: @eslint/js@10.0.1, @testing-library/jest-dom@7.0.1, @testing-library/react@16.3.3, @types/react@19.2.18, @types/react-dom@19.2.5, eslint@10.9.1, eslint-plugin-react-hooks@7.1.1, eslint-plugin-react-refresh@0.5.5, globals@17.11.0, jsdom@30.0.1, vitest@4.1.11.

The repository-level MIT grant does not relicense npm dependencies. Dependency-specific provenance/attribution is required, including license families such as BlueOak-1.0.0 already present in the lock.

Canonical repair contract — preserved

Use the existing product writer and preserve every valid prerequisite/foundation delta. The original PR #1–#11 stack has now integrated into develop; do not recreate it as a competing product tree or retire uncarried work.

1. Add a RED manifest contract rejecting latest and build-only packages in runtime dependencies.
2. Replace mutable declarations with explicit reviewed versions/ranges, beginning from locked evidence rather than silently upgrading.
3. Move @vitejs/plugin-react, typescript and vite to devDependencies; verify other direct build-only responsibilities before changing them.
4. Regenerate the lock from the corrected manifest and prove clean install, lint, unit tests, PostgreSQL contracts, production build and browser E2E at the same exact head.
5. Produce/reconcile exact-head SBOM and license/provenance evidence. Fail closed on GPL/LGPL/AGPL, noncommercial, research-only, unknown or incompatible inbound components; never replace license review with a root MIT label.
6. Update README, CHANGELOG, architecture/TRD and docs/product-technical-gap-baseline.md where the verified package and release boundary changes.

Exit evidence — unchanged

Completion requires the owner-side repair to be integrated through ordinary protection with exact-head checks, independent review, zero unresolved threads, immutable dependency/provenance evidence, and a consumer/release statement distinguishing application code from third-party obligations. An integrated side branch, a passing npm audit, optional/development scope or inventory metadata alone is not completion.

Historical PR #13 receipt — not current-head acceptance

PR #13 head eff7ec19f511cc5850f4fd1254f0a20d9c47fc9e pinned and classified the direct declarations. CI 34251045288 was terminal GREEN with separate browser/CycloneDX artifacts. It is historical evidence; that PR is now merged, not Draft/open.

The historical lock-entry inventory counted 267 package entries, including platform alternatives, rather than proving all 267 were installed together. Its recorded declared-license counts were MIT 200, Apache-2.0 21, MPL-2.0 14, ISC 13, BSD-2-Clause 8, BlueOak-1.0.0 4, BSD-3-Clause 3, MIT-0 2, CC-BY-4.0 1 and CC0-1.0 1. Historical string-level screening found no GPL, LGPL, AGPL, SSPL, BUSL, Commons Clause, noncommercial or CC-BY-NC declaration.

That inventory is retained without promotion to compatibility approval. The recorded MPL-2.0 and CC-BY-4.0 development-toolchain transitive packages still require distribution/NOTICE/attribution and shipped-artifact review. Protected integration, qualifying approval and current organization Checks remain outstanding.

[seonghobae]

Implemented as stacked PR #13 at exact head 71fe2751feb6dc4359093386f8cd30333e2f8795.

Test-first evidence:

• RED CI 34244619215: 73 predecessor tests passed; only pin and build-tool placement contracts failed.
• RED CI 34245711353: 75 tests passed; only the missing CycloneDX publication contract failed.
• RED CI 34246822467: 75 tests passed; only the SBOM/browser-artifact isolation contract failed.
• GREEN CI 34247624732: 76/76 Vitest, production build, PostgreSQL migration/concurrency/restart/restore, Playwright/axe 23 passed + 10 scoped skips.

Exact-head artifacts:

• browser evidence 10064709512, sha256:51af5a016c05b32563433b46cbb9a165f51d9eb7c60644649289dd830a7fbd35
• CycloneDX SBOM 10064710360, sha256:69bb27d0fdaea7d318a380a18e165abfc87e747e932273d39aaad91f63684ce2

PR #13 is Ready/open/mergeable with zero unresolved threads at this checkpoint. This issue remains open until independent review and organization-required exact-head gates complete; no license-approval or vulnerability-clearance claim is inferred from inventory generation.

[seonghobae]

Review repair update: PR #13 advanced by fast-forward to eff7ec19f511cc5850f4fd1254f0a20d9c47fc9e.

CodeRabbit's three findings were verified and repaired:

• TRD now lists react, react-dom, and lucide-react as the runtime set.
• Runtime and development dependency entries are checked independently, so overlapping names cannot overwrite a scope before lock comparison.
• The workflow contract independently binds browser evidence to test-results and the CycloneDX artifact to dependency-evidence.

Exact-head CI 34251045288 is terminal GREEN: 76/76 Vitest, production build, PostgreSQL migration/concurrency/restart/restore, and Playwright/axe 23 passed + 10 scoped skips.

Artifacts:

• browser 10066049041, sha256:f83f93f56d92aa18aba7cb262b9594b1658bd0793c47c0118dde217a16665545
• SBOM 10066049491, sha256:cd653257e2a23056f6cc811896cc17ff1d7ba23e931b1cc37db862c93c298b55

All three original threads are resolved. PR #13 is Ready/open/mergeable; Issue #12 remains open pending independent approval and organization-required exact-head gates.

[seonghobae]

Status 2026-09-09 (develop @ 632a08e): canonical repair items 1-4 are in develop via PRs #10/#11/#18/#19 - RED manifest contract (src/dependency-manifest-contract.test.ts), zero latest declarations, build packages in devDependencies, regenerated lock, CycloneDX SBOM in CI verify (all GREEN on exact heads). Remaining: PR #1 exact-head dependency-review still FAILs on the pinned tip and both CodeQL compatibility analyses still FAIL; central-workflow logs live in the org central repo (leaf API 404), so routing through the central owner path. Keeping open until the release gate clears.

[seonghobae]

2026-09-26 current candidate evidence update:

• PR feat: bootstrap PolicyWeave privacy policy workspace #1 exact head 9780f4fd8519ac263a202de705327705ad8a4d87, tree 513c077c2c42f4f7323a388b7a808b847551d567.
• Pending import feedback TDD: RED 3e2eba61… → GREEN fceddfe6…; follow-up announcement RED 9542d9be… → repair 85b194d4….
• The visible JSON import control now exposes disabled semantics/styling while the existing polite live region announces JSON 초안 확인 중. aria-busy remains on the editing fieldset rather than suppressing the live announcement.
• Local exact-tree verification: documentation contracts 6/6, Vitest 174/174 across 16 files, ESLint, TypeScript/Vite production build, and diff check all pass.
• Hosted exact-head CI 36238897921, Security 36238897928, Semgrep 36238897989, and CodeQL 36238897919 are runner-unassigned queued (steps=null). Exact-head review was requested; qualifying approval remains 0.

Issue #12 remains open because protected integration and hosted supply-chain acceptance are not yet complete; no gate was bypassed.

[seonghobae]

2026-09-26 current candidate update

• Final exact head: 60fd7fb5…, tree 54c19ce3a7b46d8dda055bf778c6c7327fe8e0b9.
• RED 52d252a2… reproduced the display: contents semantic-fieldset risk.
• GREEN 9d540895… keeps the native disabled/aria-busy fieldset as a normal grid item, resets only its UA box, and preserves bounded panel scroll.
• Local exact-source verification: docs 6/6, Vitest 175/175 (16 files), ESLint, TypeScript/Vite build, diff check.
• Exact-head runs are non-terminal: CI 36241748023, Security 36241747990, Semgrep 36241747980, CodeQL 36241747969. Runner-assigned jobs remain queued with steps=null; Security gitleaks is skipped before scope completion.
• CSS/jsdom evidence is not claimed as real screen-reader conformance. Protected integration, exact-head terminal Checks, qualifying approval, supply-chain acceptance, and manual assistive-technology evidence remain open.

[seonghobae]

Downstream exact-head evidence — 2026-09-27

Stacked PR #25 advanced from e48e44f5… to 8dc99df4858ab787a517c9d84503d108e6b01b0b with a test-first tablet pending-import reflow repair and corrected ADR evidence identities. It changes no dependency manifest, lockfile, workflow or SBOM contract; parent PR #1 remains unchanged at 60fd7fb5c3177984a993102742bb16e36a909e2d.

CI 36255588824 is queued and non-passing. PR #25 remains Draft; issue #12's protected-integration, exact-head SBOM/security and independent-review exit contract is not complete. No issue close, merge, release or gate bypass is claimed.

[seonghobae]

PR #25 exact head 2cdbdf6b867f81580360bc453148e5da0638bcd1 preserves the dependency boundary: the long-name reflow repair changes only UI tests/CSS and synchronized product evidence; it does not modify package.json, package-lock.json, workflows, SBOM generation, or the parent develop@60fd7fb5c3177984a993102742bb16e36a909e2d. Local documentation/configuration 6/6, Vitest 178/178, ESLint and production build pass. Exact-head CI 36256130629 remains runner-unassigned queued (steps=null), so Issue #12's protected integration/security/release evidence remains open and is not inferred from this UI repair.

[seonghobae]

2026-10-07 authoritative evidence update

The active ordinary stack is now:

1. PR feat: bootstrap PolicyWeave privacy policy workspace #1 develop@3d62bd07b823158f9c614f72f219032f4accd3b5
2. PR feat: cancel stale local draft imports #25 agent/import-cancellation@429c2d04a68c18bbab07e49730e173d57c0af93f (contains feat: bootstrap PolicyWeave privacy policy workspace #1)
3. PR feat: add deterministic local review summary #26 feat-mixed-agents-prd@6032df8abc03fe6810d880edeb906d6879b65535 targeting feat: cancel stale local draft imports #25, ahead 8 / behind 0

Local exact-tree integration passed preview contracts 6/6, focused 17/17, Vitest 238/238, ESLint, TypeScript/Vite build and diff checking. The three exact-head CI runs 37587641336, 37587907445 and 37588614486 all failed before executable steps; their jobs expose steps:null and log retrieval returns BlobNotFound. These observations are not Dependency Review success and do not replace authoritative protected-branch evidence. Issue remains open; no PR was closed or merged.

[seonghobae]

PR #26 final evidence-only successor is now 95e2388e61055e7c26946a235f9b0fee23ced209 (tree 72f9eb78cfcbbb828baa837e4ff1f6d88f96525d), stacked on exact PR #25 head 429c2d04a68c18bbab07e49730e173d57c0af93f; compare ahead 9 / behind 0 with that merge base. Exact-head CI run 37588982711 / job 112685666383 again stopped before steps and has no retrievable log blob. Issue #12 remains open for authoritative Dependency Review/protected evidence; local 6/6 preview, 238/238 Vitest, lint/build/diff GREEN does not substitute for that gate.