[Context Fabric handoff] Admit Pingora edge migrations as versioned EA projections #1608

Ownership boundary

This is the handoff lane from the Pingora edge-migration writer to the Context Fabric owner. It does not authorize edits to ContextualWisdomLab/context-graph-contracts or ContextualWisdomLab/enterprise-architecture-core from the Pingora loop. Context Fabric remains the sole source/docs/ref/PR-state writer for those repositories.

Fresh producer / consumer evidence — 2026-09-01

Pingora edge producer

• ContextualWisdomLab/pingora-gateway default/integration branch is protected main@f8b4c99b8e5d3de79af1ff0c00c0c8fd63b52991 under organization ruleset 18156473.
• Bootstrap PR Add Palette journal for profile repo #1 remains Draft. Current exact branch head is 2f221846f14501898225228d3ceada3d3ed40307 on feat/initial-pingora-runtime; no predecessor check result transfers to this head.
• Exact 59a4853e736b14b587b77fe81e8b716ca27c9308 failed owned coverage (99.15% lines / 97.14% regions) and failed the HIGH/CRITICAL image vulnerability gate because its Debian 12 slim runtime carried 22 HIGH/CRITICAL OS findings.
• Coverage repairs removed an unreachable duplicate activation branch and added fail-closed proxy/startup characterization. 617877dbc0834b29348a9c40a5e55b46a56b5810 then exposed a rustfmt-only predecessor defect.
• Exact 70b4343e237f0ba531da2f8c3faaa5e4cdaf0474 proved compile/test, clippy and public rustdoc before head movement, but its least-privilege OCI exercise failed because distroless/base-debian13 lacked libgcc_s.so.1 for the dynamically linked Rust binary.
• Current 2f221... switches to immutable gcr.io/distroless/cc-debian13:nonroot@sha256:d97bc0a941b8d4be647dc0ee75b264ddbb772f1ac5ba690a4309c00723b23775, preserving explicit USER 65532:65532, no shell/package manager, read-only-root operation, dropped capabilities and no-new-privileges. Exact-head CI/Supply Chain/SAST/Security evidence is being reacquired and is non-transferable from predecessors.
• .github#1605 is an independent release/security-policy blocker: current immutable post-release Pingora commit 09696b51bc59315353d96686355861604d0bb48c resolves a patched lru 0.18.x, while the exact upstream 0.8.1 release uses an affected lru line and lacks the current pingora-prometheus adapter. No release/cutover is admissible until the policy owner selects and encodes a bounded path; silently downgrading or suppressing RUSTSEC-2026-0253 is prohibited.
• Current v1 gateway contract deliberately activates one explicit upstream per process. It is not yet authority for arbitrary product routing, identity/authentication policy, customer/business logic, or cross-service data access.

Live legacy-edge inventory relevant to eventual migration

Read-only organization search currently confirms these materially different edge surfaces:

• ContextualWisdomLab/linux-cluster-ops: live Nginx cluster reverse-proxy/routing and SSL recovery inventory. This is a true shared-edge candidate, but its multi-vhost/TLS/cutover contract exceeds current Pingora v1 capability and must not be cut over early.
• ContextualWisdomLab/pg-erd-cloud: Traefik is the production-style edge router for /api/*, /healthz, SPA routing and baseline response headers. Product/backend policy stays in the product; only edge routing/TLS/HTTP-policy responsibilities are migration candidates.
• ContextualWisdomLab/naruon: Kubernetes ingress currently assumes NGINX; Traefik is separately evaluated for gateway/OIDC scenarios and live E2E includes an Nginx reverse-proxy fixture. Authentication/Keycloak ownership must not move into Pingora; only transport/edge responsibilities may project as a migration.
• Static-file Nginx containers such as scopeweave, LineageWeave, and inkspan are not automatically shared-edge migrations merely because they use Nginx; responsibility boundary must be proven before adding them to the queue.
• life-os deliberately keeps product workloads ClusterIP-only and delegates ingress/service-mesh to a separately managed edge namespace; repository base manifests are therefore not evidence of an active embedded Nginx edge.
• No OpenResty usage was found in the current organization code search.

Context Graph dependency — read only

• ContextualWisdomLab/context-graph-contracts still reports default_branch=develop; live develop@99cb5468ba3c15c5e79688f53dee74724fae2d13 is protected while the accepted main transition remains centrally owned by .github#1137.
• Current stack remains unreleased. Root Add OpenCode review merge automation #4 is Ready at 99d230991b9d48fbf87489e0b375b7bbf09d8559 on develop@99cb...; current Context Assertion event-semantics tip 🧪 [testing improvement] iter_json_objects 함수에 대한 단위 테스트 추가 #21 remains Draft at exact beff93585dfb510841f66cae0cc52cb5caeb6a33 on 🧪 fetch_open_prs 페이지네이션 테스트 추가 #20 0044d7193a8e9f477e42e961d49b71dc1a956c47.
• 🧪 [testing improvement] iter_json_objects 함수에 대한 단위 테스트 추가 #21 supplies candidate structured Context Assertion CloudEvent semantics and context-assertion-event-semantics:v1, but its README change invalidated predecessor evidence and it explicitly remains an unreleased candidate. Open sibling heads are not consumer releases.
• Therefore Pingora migration facts must remain provisional until an immutable released bundle supplies canonical refs, truth status/origin, valid/system time, provenance, Context Assertion CloudEvent semantics, schema/profile/conformance/admission evidence.

EA consumer dependency — read only

• ContextualWisdomLab/enterprise-architecture-core still reports default_branch=develop; branch/default repair remains .github#1137.
• Draft PR ⚡ Bolt: JSON 파싱 성능 최적화 #40 is current Context Fabric consumer-projection work at exact 284f81eaf4be92e04fba273cd9e967a8e24c055e, based on current 보안: CI 스크립트 실행 실패 시 민감 정보 스크러빙 및 shell=False 명시 #39 b44635b686c66e78ebd7f1218343a933a510cd89.
• ⚡ Bolt: JSON 파싱 성능 최적화 #40 requires one versioned contracts/context-graph-dependency.json, exact ContextualWisdomLab/<repository> ownership, direction_code=inbound_projection, exchange_kind=context_assertion_cloudevent, ea_core_owns=false, canonical/source reference, truth status, effective/system time and provenance, and fails closed while the Context Graph dependency is provisional-pr-head.

Projection requested from the Context Fabric owner

Once both producer and shared-kernel evidence are immutable, model each approved migration as a versioned projection rather than copied runtime state:

current technology/interface -> migration initiative/scenario -> target technology/interface -> validated execution

For each migration, link the affected application/service/API, current and target technology component/version/provider, lifecycle, owner, security/operability risk, dependency, cutover state, rollback state, and acceptance evidence. Preserve source authority/provenance from the released Context Assertion event. Do not copy request bodies, headers/cookies, customer data, runtime logs, credentials, auth decisions, or product-domain facts into Context Graph/EA authoritative tables. Do not use cross-service SQL.

RED acceptance

1. pingora-gateway PR Add Palette journal for profile repo #1 is Draft/unreleased and current exact-head gates are not yet established as terminal GREEN.
2. .github#1605 remains an unresolved Pingora exact-release/security-policy decision.
3. Context Graph Context Assertion/CloudEvent semantics are not yet an immutable released dependency.
4. EA ⚡ Bolt: JSON 파싱 성능 최적화 #40 is Draft and explicitly provisional against the open Context Graph owner path.
5. No migration candidate may be represented as completed or production-cut-over from repository prose/search evidence alone.

GREEN acceptance

For a concrete migration instance, require all of the following before authoritative EA admission:

1. immutable released Context Graph contract bundle containing the exact Context Assertion + CloudEvent semantic profile consumed by EA, with schema/conformance/admission/provenance evidence;
2. immutable Pingora gateway release from the then-live protected integration branch, with exact source/artifact identity, resolved dependency-security policy, required security/SBOM/provenance, realistic traffic/TLS/failure tests, and owned production statement/branch coverage gates satisfied;
3. executable parity evidence against the legacy edge contract, followed by explicit shadow/canary evidence, production cutover evidence, graceful rollback evidence, and only then legacy-removal evidence;
4. EA projection preserves current/target component and interface identities, version/provider/lifecycle, initiative/scenario, owner, security/operability impact, temporal truth and provenance without taking ownership of runtime/product facts;
5. any missing or drifting schema/profile/admission/conformance evidence fails closed as a migration defect rather than being inferred.

Keep this issue as the cross-loop handoff surface; update exact refs/evidence here rather than writing Context Graph or EA source/PR state from the Pingora loop.