docs(commercial): separate USD 20B quality from contract readiness

[seonghobae]

Fixes #161 only when this candidate reaches protected main.

Current repository-surface repair — 2026-09-26

The existing canonical README writer was reused; no competing metadata PR was created.

• RED 2f9de09c52ce697a1b0b1d9711e2d324c27aee70 added an executable Rust contract while the README had zero Wardnet DeepWiki targets and docs/index.md returned 404.
• GREEN/current head 25b640b36d61c89117e3df4484a2781d6c67865e adds exactly one repository-specific DeepWiki entry point to each public source and a deterministic Pages landing source.
• Exact blobs: test ff199d2db2bca0771df004e5cdd89b7c993e11b8, README 429cd8fe2762c7f6575a5a2305ac3c004743fdc8, Pages source c2cba8e61074216dad53084150e41e42f78cea5e.
• The landing page states Wardnet's gateway/SOC responsibility and explicitly rejects claims of complete WAF, IDS, SIEM, or SOAR coverage.
• Protected main remains the publication authority; this open Draft is Proposed evidence only.
• Exact-head CI, CodeQL PR, SAST Semgrep, and Security Scan runs are queued. Reviews: 0. Unresolved review threads: 0.

Effective protected-main-relative paths are now the prior six paths plus docs/index.md. Keep Draft until the exact current head has terminal required checks and independent review.

Product-contract repair

Wardnet had one misleading historical filename, docs/commercial/20b-krw-sale-readiness.md, even though the runtime contract and document body define a 2B KRW customer-contract readiness predicate. That naming defect made it too easy to conflate a customer field with the standing USD 20 billion software-sale quality ambition.

This slice keeps the two authorities separate without changing runtime pricing or readiness behavior:

• docs/commercial/2b-krw-customer-contract-readiness.md is the canonical customer-contract/readiness document and retains the existing 2_000_000_000 KRW predicate;
• docs/commercial/usd-20b-product-quality-bar.md defines the USD 20 billion ambition as a buyer-visible product/security/operability/release/integration quality bar, never as tenant pricing, billing, ARR, accounting, or annual_contract_value_krw;
• the old 20b-krw path becomes a compatibility shim because protected-main evidence manifests currently publish that path;
• README and CLAUDE guidance point to the canonical 2B customer-contract document plus the separate USD 20B quality document;
• the repository integration test rejects remapping TARGET_SALE_VALUE_KRW to 20B KRW and keeps customer/readiness, product-quality, and compatibility authorities explicit.

TDD / single-writer history

RED 6adb83af0be136ae96c95132fa625bf752f24642 added the executable authority-boundary contract before the canonical documents existed. GREEN lineage 007146411f4585ae8ee2410e4a54d44ff65e3cbd → 299ccbd124d8a74243c6a6a50d6e1ff97ca28806 → 2de85e45bf99225561728b45914182e9d2fed901, followed by formatting/reference repairs, supplies the separated authorities and compatibility shim.

A later gap-ledger attempt was removed after fresh inventory proved PR #130 already owns docs/product-technical-gap-baseline.md. Current effective delta does not touch that single-writer path. The runtime constant remains TARGET_SALE_VALUE_KRW = 2_000_000_000; this PR does not assert that 2B KRW is a product valuation and does not create billing/accounting authority.

Historical protected-main adoption — 2026-09-11 KST

Protected/default main advanced through merged #155 to exact f8260f1e03836039ff9463dd99fa982e4e270c4b. Reverse-direction restack #315 used exact protected main@f8260f1e03836039ff9463dd99fa982e4e270c4b as the source and this branch as the target, then merged normally with expected-head protection. That produced the then-current branch head 3e3a19a115448d5787ceaa34929018fb832fdd3d.

At that time, PR metadata reported base exactly main@f8260f1e03836039ff9463dd99fa982e4e270c4b, mergeable=true, Draft, with the effective protected-main-relative delta still exactly:

• CLAUDE.md;
• README.md;
• docs/commercial/20b-krw-sale-readiness.md;
• docs/commercial/2b-krw-customer-contract-readiness.md;
• docs/commercial/usd-20b-product-quality-bar.md;
• tests/commercial_authority_architecture.rs.

The #155 authentication/security delta is inherited from protected main rather than copied into commercial documentation. No force update, destructive rebase, broad source reconstruction, or foreign-owner state was introduced.

Historical exact-head evidence (superseded)

On unchanged exact 3e3a19a115448d5787ceaa34929018fb832fdd3d:

• CI 34577138782 — SUCCESS;
• SAST Semgrep 34577138762 — SUCCESS;
• Security Scan 34577138789 — SUCCESS;
• required CodeQL PR 34577138720 — FAILURE at the delegated current-head terminal-settlement boundary.

The Security lane briefly exposed a current-head runner/materialization specimen: Trivy job 103193395327 was queued with runner_id=0 while sibling jobs acquired hosted runners. Exact evidence was handed to .github#712; the same unchanged run subsequently acquired capacity and completed SUCCESS, so it is no longer a Wardnet blocker or reason for source churn. The CodeQL failure remains independently actionable under canonical owner issue .github#1929 and current mutable repair successor .github#2040; Wardnet does not pin the mutable successor as immutable production authority.

Live organization ruleset 18156473 still requires one generic approving review with no named/code-owner/last-push reviewer and exposes OrganizationAdmin/always bypass. .github#772 owns the solo-maintainer governance repair. Self/model approval and routine administrator bypass remain forbidden.

Keep Draft until one unchanged exact head has terminal then-live repository/security/coverage/package/SBOM/provenance/review/thread/governance evidence and fresh protected-base compatibility. No gate weakening, force push, destructive rebase, mutable foreign authority, source copy, cross-service SQL, no-op redispatch, or predecessor-evidence transfer.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

2026-09-26 repository-surface reconciliation (exact-head evidence)

• Reused this canonical README writer; no competing PR was created.
• RED 2f9de09c52ce697a1b0b1d9711e2d324c27aee70: the Rust integration contract required the exact Wardnet DeepWiki target and docs/index.md while the README count was 0 and the landing path returned 404.
• GREEN/current head 25b640b36d61c89117e3df4484a2781d6c67865e.
• Exact blobs: test ff199d2db2bca0771df004e5cdd89b7c993e11b8; README 429cd8fe2762c7f6575a5a2305ac3c004743fdc8; landing source c2cba8e61074216dad53084150e41e42f78cea5e.
• Direct readback: exact DeepWiki target count is 1 in README and 1 in docs/index.md; all boundary assertions are present.
• Effective delta is 7 paths, mergeable=true, Draft, reviews 0, unresolved threads 0.
• Exact-head CI 36234479320, CodeQL PR 36234479329, SAST Semgrep 36234479315, and Security Scan 36234479301 are queued.
• Conflicting type: docs was removed; canonical documentation / priority: medium remains.

Protected main, live repository settings, and live HTTP Pages publication remain unsettled and are not claimed.