[Production readiness] Close the evidence-backed Wardnet production gate

[seonghobae]

Current verdict

Wardnet is not production-ready on protected/default main@f8260f1e03836039ff9463dd99fa982e4e270c4b. Protected #155 has landed fail-closed management-authentication/public-bind hardening, but Wardnet still has no immutable GitHub Release. Draft heads, stacked-child GREEN, predecessor checks, bot/model reviews and mutable foreign-owner heads are development evidence only until one exact protected release identity satisfies the complete gate.

Live ruleset 18156473 remains fail-closed and requires approving review, resolved review threads and organization-required workflows while preserving deletion/non-fast-forward protection. .github#772 remains generic solo-maintainer governance owner. Runner/materialization/OpenCode control-plane defects remain .github#712/#1234 or verified successors; delegated current-head CodeQL settlement remains .github#1929 or verified successor. Wardnet does not self/model approve, manufacture statuses, copy central workflows, create no-op source churn solely to redispatch, or routinely bypass this contract.

docs/product-technical-gap-baseline.md in Draft #130 is the sole detailed commercial/product-technical current-state ledger. This issue keeps only the production-gate convergence graph and intentionally does not copy per-run workflow/review/thread snapshots; every integration decision must re-read live exact heads and #130.

Convergence graph

• Product/technical ledger — PR docs(gaps): add exact-head readiness baseline #130. Sole writer for docs/product-technical-gap-baseline.md; current live exact-head/check/review/release inventory belongs there, not in this issue.
• Agent Artifact Admission — issue [Security] Gate AI-agent package installs from untrusted llms.txt and web instructions #128 / PR feat(security): gate AI-agent artifact installation #129. Canonical Draft root remains 9efc804006057f099190d8ffcaa7096c955abe0d, based on protected main. Repository-owned CI/Fuzz/SAST/Security evidence on this unchanged root is GREEN; required CodeQL is failed only at the delegated current-head settlement boundary owned by central .github#1929. Keep [Security] Gate AI-agent package installs from untrusted llms.txt and web instructions #128/security(admission): preserve uv Python-provider evidence when a global option value is run #438 and predecessor admission findings open until effective deltas reach protected main or a verified complete successor.
• Runtime Configuration — issue [DDD] Replace direct runtime env reads with a bounded configuration registry #139 / PR refactor(config): centralize runtime bootstrap snapshot #140. Canonical Draft root remains 99c7c6c798f13c9c37d00d9f586f102585ad3494, based on protected main. Repository-owned CI/Fuzz/SAST/Security evidence is GREEN; CodeQL remains a central .github#1929 settlement failure rather than Wardnet source/test RED. PostgreSQL/trusted-proxy dependents stay preserved and parked until unchanged-root governance is terminal-valid.
• PostgreSQL production-state stack. Preserve dependency order #140 -> #193 -> #194 -> #196 -> #198 -> #199 -> #200 -> #207 -> #208 -> #209 -> #212 -> #216 -> #217 -> #219 -> #221 -> #223 -> #224 -> #225 -> #226 -> #228 -> #229 -> #231 -> #233 -> #234 -> #236 -> #241 -> #242 -> #244. Old-parent PostgreSQL 18.4/RLS/publication/pool/recovery/failover/p95 evidence remains implementation evidence until foundation-first non-force restack. Issue [P0] Bound PostgreSQL half-open network loss without replaying started work #243 remains the machine-verifiable 100% owned-production statement/line, branch, edge and public-rustdoc gate. Never hold explicit database locks or long-lived transactions across LLM calls, external I/O, sandbox execution or long-running computation.
• Coraza/CRS live enforcement — issue [P0][Coraza] Put header-borne CRS attacks through the live proven-engine path #434 / PR fix(security): harden live Coraza authority boundary #435. fix(security): harden live Coraza authority boundary #435 is the canonical Draft implementation/evidence lane for proven Coraza authority, including the valid-U+FFFD versus lossy-invalid-byte body-identity follow-up. [P0][Coraza] Put header-borne CRS attacks through the live proven-engine path #434 keeps the stable security contract and repair lineage; live exact-head checks/reviews/threads are read from fix(security): harden live Coraza authority boundary #435 and docs(gaps): add exact-head readiness baseline #130 rather than duplicated here.
• Gateway end-to-end HTTP mediation — issue [P0] Preserve bounded end-to-end HTTP headers across the gateway proxy #440 / PR fix(gateway): enforce bounded HTTP header mediation #441. Test-only Draft proves that current proxying loses admitted end-to-end metadata while blanket passthrough would leak or trust management credentials, forwarding/proxy identity, Host, framing/hop-by-hop and dynamic Connection nominations. Production implementation remains serialized behind active source owners and must preserve explicit allow/deny mediation rather than becoming a competing src/lib.rs writer.
• Gateway response streaming/backpressure — issue [P0] Stream generic gateway upstream responses with bounded backpressure #442 / PR test(gateway): reproduce whole-response buffering #443. Test-only Draft uses a loopback upstream that emits an immediate first chunk and withholds the tail, requiring Wardnet to expose response/first admitted chunk before tail release. Production repair must remain bounded/asynchronous with backpressure, cancellation, partial-failure and concurrent-stream behavior while EgressWeave retains transport authority and contextual-orchestrator retains provider/model/LLM streaming semantics.
• MISP admission/severity — issue fix(misp): preserve MISP threat-level severity semantics #169 / PR fix(security): require affirmative MISP to_ids evidence #167. Preserve the lane until protected integration or a verified complete successor; its delegated CodeQL settlement remains central ownership rather than justification for Wardnet source churn.
• Gateway route boundary / outbound reputation / SSRF. test(gateway): require URI path-segment route boundaries #181 owns route-selection semantics; docs(egress): plan Wardnet outbound site reputation engine #173 owns Wardnet destination-reputation policy while EgressWeave remains executable transport authority; fix(security): resolve phishing-database feed URLs server-side (SSRF) #291 owns the bounded Phishing.Database server-owned-source SSRF repair. Do not merge these responsibilities.
• Admin console — PR feat(ui): strengthen admin console accessibility landmarks #127. Browser evidence remains Draft implementation evidence. Material UI completion requires reusable design/tokens/components plus Figma/Storybook evidence, normal/loading/empty/error/permission/responsive/keyboard/a11y E2E and KO/EN/JA/ZH/VI/ES/DE/FR robustness.
• PRD/TRD/UML / ADR / architecture docs. Protected AGENTS.md, CLAUDE.md and docs/architecture.md remain protected authority. Draft docs(architecture): establish canonical PRD TRD and UML contract #361 is the canonical PRD/TRD/UML lane; docs(adr): accepted architecture decisions with verified APA 7th citations #111 remains accepted-ADR consolidation; test(docs): keep CodeGraph agent guidance code-current #333 remains sole CodeGraph-guidance repair; refactor(config): centralize runtime bootstrap snapshot #140 owns Runtime Configuration architecture convergence; docs(gaps): add exact-head readiness baseline #130 alone writes the detailed commercial gap ledger.
• Release / issue [P1] Build an immutable signed release, promotion, and rollback pipeline #84. Protected main still has no immutable GitHub Release. PR build(release): bind reviewed source to SBOM and provenance evidence #164 is release-evidence foundation only, not a release. Completion requires one protected SHA bound to version/CHANGELOG/tag/package or image digest, SBOM, signature/provenance, reproducibility, deployment promotion, measured rollback/roll-forward and recovery evidence.
• LLM / issue Preserve fail-closed LLM gateway admission evidence behind contextual-orchestrator #89 and outbound / issue [P0] Enforce a fail-closed destination policy for all outbound traffic #79. Production integration stays fail closed until immutable compatible contextual-orchestrator and EgressWeave releases/contracts exist. Wardnet preserves consumer evidence without copying provider-routing or reusable egress-policy source.

Context Fabric / EA and foreign-owner release boundary

Wardnet inventories CGC, EA, quarantine-sandbox-runtime, EgressWeave, contextual-orchestrator and AppGuardrail protected/default refs read-only and projects only through released compatible contracts/provenance. Wardnet writes neither CGC nor EA while the Context Fabric writer owns them. Mutable owner heads are compatibility evidence only; exact current refs and Release inventories belong in #130 rather than being duplicated here.

Wardnet findings, destination/artifact verdicts, IOCs and incidents remain Wardnet truth. Architecture-relevant lifecycle/ownership/risk/remediation may project only through released compatible CGC contracts/provenance.

Mandatory production gate

Dependency-first completion still requires protected Runtime Configuration integration; authoritative PostgreSQL/RLS/recovery and exact coverage/rustdoc; transactional durable effects; identity/tenant authorization/separation-of-duties/human approval; bounded/distributed admission and trusted-client attribution; proven Coraza/CRS + Suricata enforcement with deployed attack evidence; bounded end-to-end gateway metadata mediation and bounded streaming/backpressure/cancellation semantics; Agent Artifact Admission integrated only through released foreign-owner ports; graceful shutdown/cleanup; production telemetry/SLO/incident/restore evidence; and immutable version/package/image/SBOM/signature/provenance/reproducibility/promotion/rollback.

Close only after every mandatory gap reaches protected truth and one unchanged immutable protected candidate simultaneously proves fail-closed auth/tenant/security boundaries, released foreign-owner contracts, PostgreSQL authority/recovery, durable external effects, bounded admission, human approval, WAF/IDS + real attack behavior, bounded request/response metadata mediation plus bounded response streaming/backpressure/cancellation, Agent Artifact Admission, lifecycle cleanup, 100% owned-production statement/branch/edge/public-rustdoc evidence, realistic asynchronous owned buyer-path p95 <=20 ms, exact security/review/thread/governance gates, immutable supply-chain evidence, deployment/recovery/rollback and OTel/SLO/incident evidence with zero valid unresolved release findings.

Do not close because a document, Draft branch, stacked child, predecessor check, mutable foreign head, p95 fixture or readiness endpoint reports success. Guarded bypass remains limited to a proven control-plane chicken-and-egg with unchanged exact head and every runnable deterministic/security/coverage/package/SBOM/provenance gate GREEN, no unresolved findings, candidate-base compatibility, fixed expected head and immediate protection restoration; ordinary failed/queued checks never qualify.

[seonghobae]

Fresh readiness override — 2026-09-03: protected truth is still main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128 with no GitHub Release. Current owners are #155 e6f05d77858e91c176cff25c4b11e790bc5dcdd1, #136 3cb1047416c3aa7fa8eb352b842cc55ad8c21b19, #129 85f0f6542a13bfdcc05024b51423851b33ae2ed8, and #140 9389a2d63f0875f688de5ef3adff1ce6b54e1ab1. #155 coverage-source-tree is now successful; downstream coverage-evidence remains queued. These corrections do not change the NOT production-ready verdict and do not authorize predecessor-evidence reuse or routine bypass.

[seonghobae]

Production-gate evidence refresh (2026-09-04 KST), superseding only the stale #155 queue sentence in the issue body: #155@e6f05d77858e91c176cff25c4b11e790bc5dcdd1 is still the unchanged mergeable P0 auth candidate on protected main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128. Repository CI/Fuzz/Security/SAST are terminal GREEN and current inline threads are resolved. In Required OpenCode run 33590351182, bootstrap, coverage-source-tree 100272722468, and coverage-evidence 100479589911 are now terminal success; only opencode-review 100659819151 remains queued before checkout with runner_id=0 and no steps. .github#712 owns that narrowed selective runner-acquisition defect. The central solo-maintainer approval-count defect remains independently live under .github#772 / its owner-plane successor. Neither condition changes the production verdict, permits a routine bypass, or transfers predecessor #138 evidence.

[seonghobae]

Fresh production-gate delta, 2026-09-04: protected main is still cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128 and Wardnet still has zero GitHub Releases. #78/#155 remains the nearest protected-main merge candidate at unchanged e6f05d77858e91c176cff25c4b11e790bc5dcdd1: repository CI/Fuzz/Security/SAST are GREEN, Required OpenCode bootstrap + source-tree + coverage-evidence are now GREEN, and only current-PR opencode-review job 100659819151 remains queued/pre-checkout; .github#712 has the exact owner-plane specimen. Live organization ruleset 18156473 still requires one approving review with no declared required reviewer/code-owner/last-push reviewer and exposes routine OrganizationAdmin bypass, so normal solo-maintainer merge remains structurally unsatisfied; .github#772 now carries a fresh handoff showing reconciler PR #1644 is 19 protected-main commits behind and must be non-force reconciled before live-policy apply/canary verification. #79/#136 has independently advanced from queued evidence to a truthful terminal RED: exact 3cb1047416c3aa7fa8eb352b842cc55ad8c21b19 CI 33698726857 completed failure at the Test step, while Fuzz/Security/SAST/Scorecard/OSV are terminal success and CodeQL remains startup_failure. The valid DNS-resolution deadline source finding therefore remains the next causal Network-Egress repair; no control-plane wait may be misclassified as its cause.

[seonghobae]

Fresh production-gate delta for 2026-09-04; this supersedes only the stale live-state snippets in the issue body, not the production definition or blocker graph.

• fix(auth): fail closed without write-capable admin on public bind #155 remains exact e6f05d77858e91c176cff25c4b11e790bc5dcdd1: repository CI/Fuzz/Security/SAST GREEN; Required OpenCode bootstrap/source-tree/coverage now GREEN; current-PR opencode-review job 100659819151 acquired runner 1001655142 and is in_progress at the fail-closed current-head verdict boundary after successful dispatch. No leaf rerun while executing.
• feat(security): gate AI-agent artifact installation #129 Agent Artifact Admission is now exact de69e7151913d246f4f1dffec08428aa32b2dc60, not 85f0f654...; it additionally rejects unrepresented OCI platform selectors and Podman registry trust weakening (--tls-verify=false, alternate --cert-dir) while leaving registry transport/quarantine execution to canonical owners. Exact-current repository/security runs are still queued/non-passing.
• docs(gaps): add exact-head readiness baseline #130 code-current product/technical baseline advanced to exact 19bdea230944fb1c2cc500d0469cdf47b902e728; predecessor baseline evidence is reset and its fresh CI/Security/SAST/Scorecard/OSV materialized queued.
• Central Scorecard owner repair .github#1275 is Ready/mergeable at exact 61a8197a753e01d3275371d77b035ed44f6135eb on protected .github/main@07d9ec23fb265c76539d23249e1dfa124ea7b23b, but all current owner workflows remain queued, so Wardnet fix(actions): delegate default-branch Scorecard to immutable central owner #160 still cannot consume a protected successor SHA.
• draft(architecture): preserve outbound-policy RED pending EgressWeave release #136 remains a real source-bearing RED: manual DNS resolution is still outside the caller's end-to-end operation deadline. No bypass applies.

Wardnet remains not production-ready and still has no immutable GitHub Release. The production gate stays open until one exact protected release identity satisfies all listed security/data/availability/identity/supply-chain/operations/integration/review contracts.

[seonghobae]

Production-gate live-state override (2026-09-04): protected truth remains main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128; Wardnet still has zero GitHub Releases, so the production-ready verdict remains false.

P0 #78 / PR #155 is unchanged at e6f05d77858e91c176cff25c4b11e790bc5dcdd1: repository CI/Fuzz/Security/SAST are terminal GREEN and Required OpenCode 33590351182 now has bootstrap, source-tree and coverage-evidence terminal GREEN. Current-PR opencode-review job 100659819151 is genuinely in_progress after the current-head review request succeeded, at Fail closed without a current-head OpenCode verdict; do not rerun or substitute predecessor evidence.

P0 #79 / PR #136 remains exact 3cb1047416c3aa7fa8eb352b842cc55ad8c21b19 with intended source RED: CI 33698726857 fails the end-to-end DNS+HTTP deadline contract because manual lookup_host still precedes the request timeout. Fuzz/Security/SAST/Scorecard/OSV are GREEN; CodeQL is startup-failed. Its Required OpenCode run has progressed through coverage-source-tree; downstream coverage-evidence 100871445912 remains queued pre-checkout. GREEN still requires one absolute caller-specific operation deadline spanning DNS and remaining HTTP plus a deterministic pending/delayed resolver regression; this is not a bypass case.

P0 #128 / PR #129 is now Draft/mergeable at 3a63247e412d17b7bbee2a1d1668dfc84adf1280, not the older issue-body SHA. New RED→GREEN blocks Docker/Podman -a/--all-tags repository-wide pull expansion from escaping the exact reviewed artifact set. All current repository runs on that head remain queued. Its Context Fabric dependency also exposed an authority-name defect: Wardnet pre-execution artifact security admission must remain separate from Noema governed activation/orchestration. Exact contract acceptance is handed to CGC #27 and EA projection acceptance to EA #45; neither foreign repository was modified from Wardnet.

Central governance remains non-mergeable under the declared solo-maintainer model because active ruleset 18156473 still carries required_approving_review_count=1 with no required reviewer/team; .github#772 remains the causal owner while deterministic workflow/security/thread/branch-integrity gates stay intact. OrganizationAdmin bypass remains emergency-only and does not convert the above waits/source RED into release authority.

[seonghobae]

2026-09-05 KST production-gate refresh. The former #153/#159 workflow-control lane is no longer a candidate: #159 reached protected main, so current protected/default truth is 5829a0f08d78de464dd24393ce5d0f25fba9d126. Wardnet still has zero GitHub Releases; production-ready remains false.

The nearest current protected-main candidates now separate cleanly by cause:

• P0 management auth fix(auth): fail closed without write-capable admin on public bind #155 exact f74ff25a321dfb1d7109719e2a1fc77e47dc4898: CI/Fuzz/Security/SAST all GREEN. Required OpenCode bootstrap/admission/source-tree/coverage are also GREEN; only opencode-review 101281544719 fails because the successful exact-head repository dispatch does not produce an authenticated downstream verdict. Exact owner-plane acceptance is on .github#1929 comment 5552078997. CodeQL remains independently blocked by the central current-head verdict producer.
• Runtime Configuration refactor(config): centralize runtime bootstrap snapshot #140 exact 054c11aafe835e497d6149efb09f1ccdee9d03bd: CI/Fuzz/Security/SAST all GREEN; CodeQL 33923492956 alone fails after successfully dispatching the exact scan and receiving no terminal authenticated codeql-dispatch/actions verdict. This and build(rust): pin and track Rust 1.98.0 #77 are exact downstream specimens on .github#1925 comment 5552050347.
• Rust/toolchain build(rust): pin and track Rust 1.98.0 #77 exact d386d6f57e0c8de3e4839d6c61b593e41f9d7e20: CI/Security/SAST GREEN; CodeQL retry still finds no authenticated terminal verdict. No branch-source defect is present in that run.
• Agent Artifact Admission feat(security): gate AI-agent artifact installation #129 exact 45d14cd5bbfd172440e706ea1819763032493897 remains Draft after its real formatting repair; its new exact runs are still pending/queued, so no predecessor gate transfers.
• MISP admission fix(security): require affirmative MISP to_ids evidence #167 exact ba5dd624e50eec63efc453a54beb57cbe28295a9 remains intentionally Draft because shared feed reconciliation still has a real production RED tracked by security(feeds): reconcile DNSBL snapshot ownership on refresh #172: DNSBL snapshot ownership is not reaped on withdrawal while preserving overlapping feed/operator ownership. This is a Wardnet source repair, not a central queue diagnosis.

Central governance also remains unsatisfied for the declared solo-maintainer model: active org ruleset 18156473 still carries generic approving-review count 1 with no required reviewer/team. .github#772 owns the causal policy repair while deterministic workflow/security/coverage/SBOM/provenance/thread/branch-integrity gates stay intact.

None of the current central CodeQL/OpenCode failures, queued scanners, Draft states, or generic approval deadlock qualify for routine bypass. Release remains blocked until the relevant source REDs are repaired, owner-plane verdict production/governance is restored, and one exact protected release identity has complete immutable package/SBOM/provenance/reproducibility/rollback evidence.