docs: make README product-first and integration-friendly - #530
Merged
Conversation
📝 WalkthroughWalkthroughApache License 2.0을 추가하고 package.json에 라이선스를 등록했습니다. README.md는 Noema의 제품 범위, 배포 절차, 보안 모델, 검증 범위 및 기여 절차를 설명하도록 재작성했습니다. Changes문서 및 라이선스 갱신
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: 🔵 Low · up to The README now documents deployment and credential exchange, but does not explicitly require HTTPS for non-local exchange endpoints, which could lead to an insecure transport configuration. Runtime protections remain unchanged, so the PR is mergeable with owner awareness and a documentation follow-up. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.) ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
seonghobae
added
the
enhancement
ChatGPT Codex Connector
* test(ci): expose floating runner selector starvation * fix(ci): pin reviewer runner image * fix(ci): pin verification runner image * fix(ci): pin image gate runner image * test(ci): reject quoted floating runner selectors * docs(changelog): record pinned runner repair
seonghobae
pushed a commit
that referenced
this pull request
Sep 2, 2026
…with README/license/runner-pin PR #530/#532 Fast-forwards this PR's branch past two merges it was behind (5aad3e4 -> 6b2b3e9): PR #532 (pinned GitHub-hosted runner selectors, fixing a floating-runner CI stall) and PR #530 (product-first README, Apache-2.0 root LICENSE + docs/index.md, dependency-license gap tracking for issue #531). Both merged cleanly via git's 3-way merge except for one genuine text conflict, plus one non-textual semantic incompatibility surfaced only by running the test suite. Text conflict resolved: - docs/product-technical-gap-baseline.md: both PRs independently rewrote the same "Authority and update rule" snapshot line and the same three-row "Live external observation" table (this PR's lane recorded open-PR/hourly-loop governance state as of dd6ff2a; #530's lane recorded README/license-lane state as of 5aad3e4). Combined both lanes' distinct observations into one merged snapshot paragraph and a six-row table (kept both PR lanes' rows, merged the two differently-worded "Release/publication" rows into one), and corrected the now-stale "PR #530 is open" claim to reflect that it has since merged into protected main at 6b2b3e9 (directly evidenced by this merge, not fabricated). No test asserts this table's exact wording (test/documentation-architecture-contract.test.ts only checks for specific issue-number substrings), so no other file needed this treatment. Files independently changed by only one side (ci.yml, patch-validator-image.yml, reviewer-ci.yml, README.md, docs/LICENSING_AND_IP_TRANSFER.md, docs/security/private-vulnerability-reporting-audit.md, scripts/lib/private-vulnerability-reporting-audit.mjs, scripts/private-vulnerability-reporting-audit.mjs, associated tests) and files both sides touched in disjoint regions (CHANGELOG.md; scripts/acquisition-readiness-audit.mjs, where this PR's new MAX_SOURCE_DOCUMENTS/source_documents digest-binding logic near the top of the file and #530's packageDistributionApplies/ packageMetadataDeclared licensing logic near the bottom do not overlap) merged automatically with no marker conflicts; verified by diffing each side against the merge base and confirming both sides' additions are present in the merged result. Semantic fix (not a git conflict, found via tests): - test/acquisition-source-only-license.test.ts (added by #530, so written without knowledge of this PR's stricter contract) built its transfer-evidence.json fixture with the pre-#526 loose format `source_documents: ["legal/review-record.pdf"]` (a bare string label). This PR's whole purpose is to replace that with bounded structured `{path, sha256}` retained-artifact bindings, so the new validateDigestBoundArtifact check correctly rejected the old-format fixture ("source_documents[0] artifact binding required"). Updated the fixture to emit a real digest-bound artifact via the file's own existing digestArtifact() helper, matching the same pattern already used by the currently-passing test/acquisition-transfer-rights.test.ts fixture. This is the deliberate, intended tightening this PR introduces; the fixture simply hadn't been written against it yet. Verification: - npm run typecheck: clean, no errors. - npm test (Node 24.19.0, matching devEngines/CI): 3737 passed, 0 failed, 1 pre-existing unrelated skip, after the fixture fix above. - Established a pre-existing-failure baseline by running the full suite twice on an unmodified fresh origin/main checkout: it is not perfectly stable under this sandbox's full-parallel test run (534/534 on one run, 1 failure in test/acquisition-review-regressions.test.ts on another, both with byte-identical source) - a pre-existing, environment-specific flake where tests that fail-closed-verify the live working tree against exact HEAD, or share one on-disk output directory, race against sibling test files under full-suite parallelism. The 5 non-source_documents failures initially observed on this branch before finishing the merge commit (acquisition-data- room-manifest x2, acquisition-output-symlink x2, dependency-license-inventory-release-wiring x1) were an artifact of running those exact-HEAD integrity checks against a working tree that legitimately did not yet match any commit (HEAD was still eaebeec while the tree already held the in-progress merge); each passes individually once run against a worktree whose HEAD matches its tree, confirmed by rerunning them standalone both before and after this commit. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BV96rXhqoR3tYZ9AeAVur4
This was referenced Sep 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Reframe Noema's repository landing page around its code-current product responsibility as an evidence-producing credential and maintenance control plane, and make the repository's owner-selected commercial source license explicit.
contextual-orchestratorboundary in product language;Licensing due diligence
Protected
mainhad no rootLICENSE, but absence of a license file was not treated as a reason to stop. Repository provenance and the owner's commercial-use policy support an Apache-2.0 source grant: Noema is an organization-owned non-fork repository and no inherited outbound source license was found that must be preserved instead.The npm package remains explicitly
privateand is not the product distribution channel. The source grant therefore lives at rootLICENSEplus the README without inventing npm publication metadata. Any distributable package still requires exact manifest/evidence license metadata alignment.Third-party tooling is not conflated with Noema source. Current lockfile evidence contains
LGPL-3.0-or-lateroptional development/build packages on thewrangler → miniflare → sharp → @img/sharp-libvips-*path. Repository runtime-image tests exclude Wrangler/Miniflare from the patch-validator image, so this is not evidence that LGPL code is bundled into that runtime. It remains an inbound-tooling policy defect under ContextualWisdomLab's no-GPL-family default; issue #531 owns removal/replacement and is not waived by this source-license PR.Exact-head repair lineage
README/documentation contract failures found by hosted CI were repaired on this same branch rather than deferred:
hourly-product-developmentdiscoverability is retained only as a documentation-map entry while internal procedure stays in contributor/internal docs;artifact_rights_metadataacquisition-integrity boundary is already integrated on protected main;mainadvanced through runner repair fix(ci): pin required GitHub-hosted runner selectors #532, the branch was non-destructively fast-forwarded to GitHub's inspected three-way merge object so the current base is an ancestor and no predecessor evidence was reused.Current exact authority
main@b505cb807536e9cf2bdbfcb05ad3fefe99999a14;c5e3635fa69556a74d3d0ba8601bf5d57f71e515;reviewer-ci,ci, andSecurity Scanare terminal success;patch-validator-imageis still in progress and therefore non-passing until terminal;mainremains without this Apache-2.0 grant until this exact head integrates;Evidence used
Checked against protected
mainand current canonical repository docs/code:docs/PRD.mdfor product responsibility, users/jobs, product principles, authority separation, and work-conserving behavior;package.json/package-lock.jsonfor runtime/toolchain metadata and third-party license provenance;docs/LICENSING_AND_IP_TRANSFER.mdand acquisition rights tests for source/dependency/package/transfer authority separation;scripts/acquisition-readiness-audit.mjsfor the executable source-vs-package licensing gate;openapi.json, deployment scripts, and API documentation for/health,/ready,/exchange, and the HTTPS transport boundary;ARCHITECTURE.mdas the canonical architecture/trust-boundary document.Scope
README, root source-license grant, README/documentation contract repair, licensing/product-gap documentation, and the acquisition licensing evidence boundary. No GitHub App permission, npm publication channel, release, deployment, security threshold, or transfer authority is weakened. Merge only through the normal protected path after fresh unchanged-head checks/reviews/base/mergeability satisfy live governance.