From ffc360e9cbbfe1e2ba44d222e9051ac9a1971d12 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 4 Aug 2026 13:39:14 +0900
Subject: [PATCH 1/4] docs: update renamed repo references in AGENTS.md

---
 AGENTS.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/AGENTS.md b/AGENTS.md
index b60b03d..07322fa 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -91,7 +91,7 @@ Applies to every agent (Claude, Codex, Cursor, opencode, ...) working in this re
   DOM-decomposes emails and files into a persisted knowledge graph). Every
   component is a **standalone program that must ALSO work as a git submodule**,
   grown separately and together.
-- Sibling components: **waf-ids-ai-soc** (WAF/IDS/AI SOC/LB/APIM),
+- Sibling components: **wardnet** (WAF/IDS/AI SOC/LB/APIM),
   **clearfolio** (document viewer), **pg-erd-cloud** (ERD tool),
   **contextual-orchestrator** (LLM cost/perf/upstream-LB gateway, beyond
   LiteLLM), **codec-carver** (STT/omni-modal speech-video codec),

From 73c59bd09758913dc0927f158bac58d60a9d539d Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 4 Aug 2026 23:05:32 +0900
Subject: [PATCH 2/4] docs(AGENTS.md): passwordless SSO is keyverse, not
 feelanet-adfs

Folds the remaining ecosystem-name correction into this sweep so a single
PR owns AGENTS.md per repo. keyverse (was cwl-idp) is the central
passwordless IdP; feelanet-adfs is the employer ADFS SSO integration
library it federates, per .github/docs/CWL-MASTER-CONTEXT.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 AGENTS.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/AGENTS.md b/AGENTS.md
index 07322fa..c714469 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -96,7 +96,7 @@ Applies to every agent (Claude, Codex, Cursor, opencode, ...) working in this re
   **contextual-orchestrator** (LLM cost/perf/upstream-LB gateway, beyond
   LiteLLM), **codec-carver** (STT/omni-modal speech-video codec),
   **fast-mlsirm** (LLM-as-a-Judge calibration + evaluation-item quality; uses
-  aFIPC FIPC + kaefa item-fit), **feelanet-adfs** (passwordless SSO:
+  aFIPC FIPC + kaefa item-fit), **keyverse** (passwordless SSO:
   OIDC/SCIM/ADFS/LDAP/FIDO2/OAuth2.1, eliminate passwords), **newsdom-api**
   (PDF to DOM sidecar), **semantic-data-portal** (upper ontology/catalog/governance
   plane with its own graph engine).

From 33ff7c59f450ad08ff59cd6fbc6e63d9c6ee4a14 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 12 Aug 2026 06:07:26 +0900
Subject: [PATCH 3/4] ci: rebuild R dependencies against pinned runtime

---
 .github/workflows/r.yml | 39 ++++++++++++++++++++++++++++++++++++++-
 1 file changed, 38 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/r.yml b/.github/workflows/r.yml
index cf2e656..93e921d 100644
--- a/.github/workflows/r.yml
+++ b/.github/workflows/r.yml
@@ -29,10 +29,15 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
+      - name: Install build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y cmake make
+
       - name: Set up R
         uses: r-lib/actions/setup-r@d3c5be51b12e724e68f33216ca3c148b66d5f0b6
         with:
-          r-version: release
+          r-version: '4.5.3'
           use-public-rspm: true
 
       - name: Set up R package dependencies
@@ -41,6 +46,38 @@ jobs:
           extra-packages: any::rcmdcheck
           needs: check
 
+      - name: Build verified ABI-compatible R dependencies
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          install_verified_source() {
+            local package="$1"
+            local version="$2"
+            local url="$3"
+            local expected_sha256="$4"
+            local archive
+            archive="$(mktemp --suffix=.tar.gz)"
+
+            curl --fail --show-error --silent --location \
+              --proto '=https' --tlsv1.2 "$url" --output "$archive"
+            printf '%s  %s\n' "$expected_sha256" "$archive" |
+              sha256sum --check --strict
+            R CMD INSTALL "$archive"
+            rm -f "$archive"
+
+            Rscript -e "stopifnot(as.character(packageVersion('$package')) == '$version'); cat(normalizePath(find.package('$package')), '\n')"
+          }
+
+          install_verified_source \
+            RcppParallel 6.2.0 \
+            https://cran.r-project.org/src/contrib/RcppParallel_6.2.0.tar.gz \
+            3b6eaf73a696059552186292c79233916267f8e2b5c9a309519391d16c5a8bbe
+          install_verified_source \
+            qs2 0.2.2 \
+            https://cran.r-project.org/src/contrib/qs2_0.2.2.tar.gz \
+            c59ff879e858aef0afb13de25127239624e65b20179c8631fa1f62edea25f48f
+
       - name: Run R CMD check
         uses: r-lib/actions/check-r-package@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590
         with:

From 5e5786ac9f4912df70ba3b8aef319f57969d140d Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 12 Aug 2026 06:19:56 +0900
Subject: [PATCH 4/4] ci: satisfy workflow line-length gate

---
 .github/workflows/r.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/r.yml b/.github/workflows/r.yml
index 93e921d..28f6b66 100644
--- a/.github/workflows/r.yml
+++ b/.github/workflows/r.yml
@@ -66,7 +66,8 @@ jobs:
             R CMD INSTALL "$archive"
             rm -f "$archive"
 
-            Rscript -e "stopifnot(as.character(packageVersion('$package')) == '$version'); cat(normalizePath(find.package('$package')), '\n')"
+            Rscript -e \
+              "stopifnot(as.character(packageVersion('$package')) == '$version'); cat(normalizePath(find.package('$package')), '\n')"
           }
 
           install_verified_source \