K8: record blocked owner review and release evidence

docs/linuxcnc-web-wasm-browser-matrix-remediation.md

@@ -0,0 +1,22 @@
+# Browser Matrix Remediation
+
+`coverage/browser-matrix-remediation.report.json` records K8-REL-12 browser
+matrix evidence.  The locked context still declares Chromium, Firefox and
+Safari minimums as `TBD` and the matrix status as `planned-for-m4`.
+
+This Linux environment can probe installed Chromium and Firefox binaries, but
+it has no Safari binary or browser farm.  Those smoke probes are recorded as
+environment observations only; they do not establish release minimums or
+cross-browser compatibility.  Safari remains explicitly unavailable and the
+overall release conclusion remains `STOP_RELEASE`.
+
+Unblocking requires a reviewed context update pinning all three minimums and
+executing the required workflow, offline/OPFS and failure matrix in each
+target browser.  No browser version is inferred, and the existing context
+lock is not overwritten.
+
+Regenerate it with:
+
+```bash
+python3 scripts/generate_browser_matrix_remediation.py
+```

docs/linuxcnc-web-wasm-configuration-resource-remediation.md

@@ -0,0 +1,23 @@
+# Configuration Resource Remediation
+
+`coverage/configuration-resource-remediation.report.json` is the K8-REL-11
+resource closure audit.  It retains all 997 missing rows, 91 unresolved rows,
+59 unindexed configuration entries and 3 unregistered kinematics startup
+entries.  It also classifies basename matches found elsewhere in the locked
+workspace as review candidates only; no reference is rewritten automatically.
+
+The graph has no orphan entrypoints or unowned templates, so the remaining
+work is reference resolution and resource ownership, not deletion of rows.
+The artifact resolves zero rows by itself and keeps
+`candidate_eligible: false`/`release_action: STOP_RELEASE`.
+
+Unblocking requires an approved search-path/reference contract, restoration or
+explicit review of missing resources, complete include/template indexing and
+registration or explicit blocking of every kinematics module.  A manifest or
+context hash change requires a new context rather than an in-place lock edit.
+
+Regenerate it with:
+
+```bash
+python3 scripts/generate_configuration_resource_remediation.py
+```

docs/linuxcnc-web-wasm-implementation-license-remediation.md

@@ -0,0 +1,21 @@
+# Implementation License Remediation
+
+`coverage/implementation-license-remediation.report.json` audits all 57
+`wasm-core/**` and `web/**` implementation entries.  Their source hashes and
+audit evidence are complete, but no repository LICENSE/NOTICE/SPDX declaration
+assigns a license to them.  The report confirms that LinuxCNC's upstream
+declarations are not inherited and keeps every entry `blocked_unassigned`.
+
+No SPDX expression is approved by this artifact.  Unblocking requires an
+explicit repository owner decision covering the SPDX expression,
+copyright/NOTICE policy and distribution obligations; metadata changes must
+be reviewed under a new context when they alter locked evidence.
+
+The release conclusion remains `blocked_not_release_candidate` with
+`release_action: STOP_RELEASE`.
+
+Regenerate it with:
+
+```bash
+python3 scripts/generate_implementation_license_remediation.py
+```

docs/linuxcnc-web-wasm-license-decision.md

@@ -0,0 +1,20 @@
+# Web/WASM License Decision
+
+Status: `blocked`, pending an explicit repository owner decision.
+
+The files under `wasm-core/**` and `web/**` are implementation work in this
+repository. They are not assigned a license by `linuxcnc/debian/copyright`,
+and this audit does not infer an upstream LinuxCNC license for them. No
+`LICENSE`, `NOTICE`, or `SPDX-License-Identifier` declaration is added by
+this task because doing so without an owner decision would be a fabricated
+license assignment.
+
+The deterministic per-entry source and license index records these paths with
+owner `web-wasm-license-owner`, `license_status: blocked_unassigned`, and this
+document as evidence. The entries remain blocked and cannot be promoted to an
+accepted release item until the owner supplies an approved SPDX expression,
+copyright notice policy, and distribution obligations.
+
+The LinuxCNC source tree is handled separately through the scoped declarations
+in `linuxcnc/debian/copyright`; those declarations are matched by path in
+`coverage/license-source-index.jsonl` and are not copied onto Web/WASM files.

docs/linuxcnc-web-wasm-manifest-ownership-remediation.md

@@ -0,0 +1,25 @@
+# Manifest Ownership Remediation
+
+`coverage/manifest-ownership-remediation.report.json` is the K8-REL-08
+ownership assignment for all 6,249 `needs_owner` manifest seeds.  It assigns a
+deterministic WS-0..WS-7 workstream role from the source prefix and records an
+independent review owner, assignment rule, source hash and blocked status for
+each row.
+
+The report is intentionally additive.  `coverage/manifest.jsonl` is manifest
+v1 and has no owner field; changing it in place would invalidate the locked
+manifest hash.  Therefore the assignment status is
+`proposed_blocked_review`, not `accepted`.  Encoding a reviewed assignment in
+the manifest requires feature owner confirmation, feature/test/oracle
+evidence, and a new context id when the manifest hash changes.
+
+The report covers every unassigned seed exactly once, but does not claim that
+any seed is implemented, verified or accepted.  The release decision remains
+`blocked_not_release_candidate` with `release_action: STOP_RELEASE`.
+
+Regenerate and test it with:
+
+```bash
+python3 scripts/generate_manifest_ownership_remediation.py
+python3 scripts/test_manifest_ownership_remediation.py
+```

docs/linuxcnc-web-wasm-official-oracle-remediation.md

@@ -0,0 +1,23 @@
+# Official Oracle Remediation
+
+`coverage/official-oracle-remediation.report.json` is the K8-REL-10 audit of
+the locked LinuxCNC source for official kinematics and recovery oracle inputs.
+The locked commit contains `unit_tests/interp` and `unit_tests/tp`, but no
+`unit_tests/kinematics` or recovery oracle root.  The six `tests/matrixkins`
+files are retained as candidates and explicitly marked non-official.
+
+All 11 kinematics oracle samples remain blocked and no official golden is
+generated.  Recovery oracle scenarios also remain blocked.  The report keeps
+`candidate_eligible: false` and `release_action: STOP_RELEASE`.
+
+Unblocking requires adding or approving the official inputs under a locked
+source (or a reviewed replacement contract), then rerunning native/WASM
+comparisons and creating a new context when the source or schema changes.
+Nothing in this report promotes a derived configuration, deletes a blocked
+sample, or changes the current context lock.
+
+Regenerate it with:
+
+```bash
+python3 scripts/generate_official_oracle_remediation.py
+```

docs/linuxcnc-web-wasm-owner-review-gate-refresh.md

@@ -0,0 +1,17 @@
+# Owner Review Gate Refresh
+
+`coverage/owner-review-gate-refresh.report.json` is the K8-REL-15 final
+owner-review check.  It locates all six required owner actions but finds no
+approval input or new locked context in the workspace, so the report is
+`blocked` and the gate refresh is deliberately not run.
+
+The release conclusion remains `blocked_not_release_candidate` with
+`release_action: STOP_RELEASE`.  Once owners supply decisions, any source,
+manifest, browser, schema or license change must create a new context and
+regenerate closure, audit, gate and remediation evidence together.
+
+Regenerate it with:
+
+```bash
+python3 scripts/generate_owner_review_gate_refresh.py
+```

docs/linuxcnc-web-wasm-release-acceptance-remediation.md

@@ -0,0 +1,22 @@
+# Release Acceptance Remediation
+
+`coverage/release-acceptance-remediation.report.json` is the K8-REL-09
+acceptance-readiness audit.  It evaluates every one of the 1,804 affected
+manifest entries against the acceptance contract: owner, inputs, outputs,
+test, ready oracle, matching context and implementation/difference evidence.
+
+The result is deterministic: zero entries are eligible and all 1,804 remain
+blocked.  The 6,249 unassigned seeds remain a separate ownership dependency;
+no row is promoted to `accepted`, and no derived or blocked oracle is treated
+as an official golden.  The report keeps `candidate_eligible: false` and
+`release_action: STOP_RELEASE`.
+
+Regenerate it with:
+
+```bash
+python3 scripts/generate_release_acceptance_remediation.py
+```
+
+The next remediation is K8-REL-10, which requires the locked official
+kinematics and recovery oracle inputs before any affected row can become
+eligible for acceptance.

docs/linuxcnc-web-wasm-release-closure.md

@@ -0,0 +1,41 @@
+# K8 Release Closure
+
+This is the K8 release evidence package for context `linuxcnc-2.10.0-pre0-wasm-m1-py-c1`. K8-REL-01 records compatibility blockers, K8-REL-02 records migration/rollback/offline recovery, and K8-REL-03 records scoped license/source evidence. It is not a release-candidate declaration. Regenerate it with:
+
+```bash
+python3 scripts/generate_release_closure.py
+```
+
+The generated artifacts are:
+
+| Artifact | Purpose |
+|---|---|
+| `coverage/release-closure.report.json` | Aggregate release decision and blocker summary |
+| `coverage/release-candidate-gate.report.json` | Final release-candidate gate, blocker reasons, evidence hashes and executable stop/allow action |
+| `coverage/compatibility-matrix.report.json` | ABI, protocol, schema, runtime, browser and oracle compatibility matrix |
+| `coverage/license-closure.report.json` | Source, upstream license declarations, download metadata and explicit `REAL-EXCLUDED` summary |
+| `coverage/license-source-index.jsonl` | Deterministic per-entry source hash, owner, scoped license evidence and closure status |
+| `docs/linuxcnc-web-wasm-license-decision.md` | Explicit blocked decision for unassigned Web/WASM SPDX/NOTICE metadata |
+| `coverage/workspace-migration.report.json` | Versioned package migration, rollback failure injection and offline cache exercise |
+| `coverage/workspace-rollback.package.json` | Hash-addressed rollback target for the nearest committed package |
+| `coverage/offline-cache.package.json` | Deterministic offline resource manifest and workspace package reference |
+| `coverage/release-evidence-index.json` | Hash-addressed evidence index and affected-manifest audit |
+
+The locked context and the existing source, manifest, Python runtime and configuration report hashes match. ABI/protocol/snapshot/event/workspace/manifest versions are all `1`, and the observed Worker schemas agree with the lock. Native/WASM and Worker evidence remains repeat-stable for the implemented slices.
+
+The release conclusion is explicitly `blocked_not_release_candidate`:
+
+The final gate in `coverage/release-candidate-gate.report.json` independently verifies context consistency, locked schema contracts, evidence integrity, license-source completeness and migration/rollback/offline readiness. It records `candidate_eligible: false`, `release_action: STOP_RELEASE`, and six hard blockers. This is an explicit stop decision, not a release-candidate declaration.
+
+- 6,249 of 8,053 manifest seed entries remain `needs_owner`; none is `accepted`.
+- 1,804 affected entries have derived owners from their non-unassigned manifest domain and retain inputs, outputs, test IDs, difference state and oracle status in the evidence index. Their oracle state is `blocked`, never accepted.
+- The configuration audit retains 997 missing-resource rows across 445 paths and 194 resource-blocked startup entries. Graph orphans, resource orphans and unowned templates remain zero.
+- The locked source has no `linuxcnc/unit_tests/kinematics` official oracle root. Derived configuration and recovery results are therefore not official goldens.
+- The browser matrix is still planned with Chromium, Firefox and Safari versions marked `TBD`.
+- `coverage/license-source-index.jsonl` contains all 8,053 manifest entries: all source hashes and license-audit owners are present, 7,996 LinuxCNC entries match the most-specific scoped declaration in `linuxcnc/debian/copyright`, and 57 Web/WASM entries remain `blocked_unassigned`. These audit owners do not replace manifest feature owners or promote `needs_owner` entries. The manifest v1 itself remains unchanged and has no license field; the external index is the auditable closure artifact rather than an inferred license assignment.
+- The Web/WASM implementation has no repository license/NOTICE/SPDX assignment. `docs/linuxcnc-web-wasm-license-decision.md` records the owner decision required; this remains a K8-REL-03 blocker and no upstream LinuxCNC license is inherited.
+- K8-REL-02 is implementation-verified: `workspace-package.v1` supports deterministic v1↔v2 envelope migration without changing locked event/snapshot/checkpoint/journal schemas; tampering and unsupported versions fail closed. A rollback package references the current hash and nearest committed package, never overwrites the old package, and recovers to the committed endpoint after an injected pre-commit failure. The offline bundle has deterministic resource hashes, starts with a complete cache, blocks missing/corrupt resources while offline, and reports `network_required` when online fallback is allowed. The official migration/browser/OPFS oracle is still absent and remains blocked.
+
+`REAL-EXCLUDED` is reserved for physical hardware, hard real-time kernel scheduling and host device/path access. These exclusions are listed in the compatibility and license reports and are not used to hide simulated spindle, tool, probe, HAL or recovery behavior.
+
+The audit and migration exercise do not change ABI, protocol, locked event/snapshot/workspace schema versions, source lock, or simulation behavior. They do not create official golden data or clear the remaining compatibility, resource, browser or license blockers.

docs/linuxcnc-web-wasm-release-remediation-intake.md

@@ -0,0 +1,37 @@
+# K8 Release Remediation Intake
+
+`coverage/release-remediation-intake.report.json` is the deterministic intake
+for K8-REL-07.  It consumes the frozen K8 closeout, post-release audit, release
+gate, closure, evidence index and context lock.  Regenerate it with:
+
+```bash
+python3 scripts/generate_release_remediation_intake.py
+```
+
+The intake verifies the source hashes, context identity, blocker identity and
+owner/evidence fields before creating six ordered work items (`K8-REL-08` to
+`K8-REL-13`).  Each item remains `blocked` until its accountable owner supplies
+the required evidence and its review trigger is satisfied.  Intake completion
+therefore means that remediation is traceable; it does not mean that any
+release prerequisite is accepted.
+
+The release conclusion remains `blocked_not_release_candidate` with
+`release_action: STOP_RELEASE` and `candidate_eligible: false`.  The intake
+does not alter the ABI, protocol, schema versions, context lock, manifest
+classification, license decision, or any prior evidence.  Missing inputs,
+hash drift, context drift, deleted samples, lowered checks, `REAL-EXCLUDED`
+reclassification and promotion of blocked entries all remain stop conditions.
+
+The six work items are ordered by the audit's stable blocker order:
+
+| Task | Blocker | Required owner action |
+|---|---|---|
+| `K8-REL-08` | `manifest_seed_unassigned` | Assign feature owners to all `needs_owner` seeds and regenerate the index |
+| `K8-REL-09` | `accepted_entries_missing` | Produce acceptance evidence for eligible entries |
+| `K8-REL-10` | `official_oracle_missing` | Add locked official kinematics/recovery oracle inputs and rerun comparisons |
+| `K8-REL-11` | `configuration_resources_missing` | Resolve missing/unindexed resources without dropping rows |
+| `K8-REL-12` | `browser_matrix_unverified` | Pin Chromium, Firefox and Safari minimums and execute checks |
+| `K8-REL-13` | `license_closure_incomplete` | Approve SPDX/NOTICE metadata for the 57 Web/WASM entries |
+
+Each follow-up task must regenerate the release closure, post-release audit,
+milestone closeout and intake before it can change the release conclusion.

docs/linuxcnc-web-wasm-remediation-evidence-roundup.md

@@ -0,0 +1,22 @@
+# Remediation Evidence Roundup
+
+`coverage/remediation-evidence-roundup.report.json` is the K8-REL-14
+consolidation of the six remediation reports K8-REL-08 through K8-REL-13.  It
+verifies each report's self-hash and context, preserves the six blocker IDs,
+and checks that no remediation artifact promoted entries, generated official
+goldens, resolved resources by fiat, pinned an unreviewed browser matrix or
+approved an implementation license.
+
+The roundup is complete as an audit, but its `roundup_status` remains
+`blocked_pending_owner_actions`.  The release conclusion is still
+`blocked_not_release_candidate` with `release_action: STOP_RELEASE`.
+
+Remaining transitions require owner review and, where locked inputs change, a
+new context followed by closure, audit and gate regeneration.  The roundup
+does not mutate prior evidence or overwrite the context lock.
+
+Regenerate it with:
+
+```bash
+python3 scripts/generate_remediation_evidence_roundup.py
+```

docs/task-history.md

@@ -49,6 +49,21 @@
 
 | `K7-RECOVERY-01` | 固定 tick checkpoint/replay 与 workspace recovery 已接入；checkpoint 携带 context、cursor、snapshot/state hash 和 operation ledger；损坏 checkpoint、未知 schema、缺号/重复事件、未确认操作、abort 和恢复边界均 fail-closed；恢复终点与连续运行状态 hash 一致；native `sim_event_import` 与 Worker 对照通过，官方 recovery oracle 继续显式 blocked | `coverage/workspace-recovery.report.json`, `web/worker/replay.mjs`, `web/worker/sim-session.mjs`, `web/workspace/recovery.mjs`, `wasm-core/src/sim_event.c` |
 | `K8-REG-01` | 统一配置图确定性枚举 264 个运动学入口和 233 个 sim INI 入口；逐项资源/INI/注册表启动预检、缺失与未解析引用保留；图谱孤儿和未拥有模板为零；native/WASM kinematics/motion/feedback/home/IO 与 Worker replay/recovery 重复摘要稳定；官方 kinematics/recovery oracle 继续显式 blocked | `coverage/configuration-regression.report.json`, `scripts/generate_configuration_regression.py`, `scripts/test_configuration_regression.py`, `coverage/manifest.jsonl`, `context-lock.json` |
+| `K8-REL-01` | 兼容性、来源/许可证和发布闭合审计完成；ABI/protocol/schema/context lock 哈希一致；1,804 个已影响 manifest 条目在 evidence index 中保留 owner、输入、输出、测试、差异和 oracle 状态；6,249 个未分配种子、资源缺失、官方 oracle、浏览器矩阵、逐项许可证和迁移/回滚继续显式 blocked，不升级为发布候选 | `coverage/release-closure.report.json`, `coverage/compatibility-matrix.report.json`, `coverage/license-closure.report.json`, `coverage/release-evidence-index.json`, `docs/linuxcnc-web-wasm-release-closure.md`, `scripts/generate_release_closure.py`, `scripts/test_release_closure.py` |
+| `K8-REL-02` | workspace-package v1↔v2 封套迁移双向 hash 闭合；旧 event/snapshot/checkpoint/journal schema 保持不变且损坏、版本、上下文不兼容均 fail-closed；回滚包只生成新目标包，失败注入后恢复到最近已提交 seq=1；离线资源完整缓存 ready、缺件阻断、联网降级显式；迁移项在 release evidence index 标记 verified，K8-REL-01 的官方 oracle/资源/浏览器/许可证阻塞保留 | `coverage/workspace-migration.report.json`, `coverage/workspace-rollback.package.json`, `coverage/offline-cache.package.json`, `web/workspace/migration.mjs`, `web/workspace/test_migration.mjs`, `coverage/release-evidence-index.json`, `coverage/compatibility-matrix.report.json` |
+| `K8-REL-03` | 生成 8,053 条确定性 license/source index；全部来源 hash、审计责任人和证据状态完整；7,996 条 LinuxCNC 条目按最具体 Debian copyright scope 映射 SPDX，57 条 wasm-core/web 条目明确保持 `blocked_unassigned`；实现许可证决策写入独立文档，release 仍保留实现许可证阻塞，不升级为发布候选 | `coverage/license-source-index.jsonl`, `coverage/license-closure.report.json`, `docs/linuxcnc-web-wasm-license-decision.md`, `coverage/release-evidence-index.json`, `scripts/test_license_source_closure.py` |
+| `K8-REL-04` | 最终 release-candidate gate 独立汇总 closure 报告、context lock、schema contracts、license/source index、恢复和迁移证据；context/recovery hash、ABI/protocol/schema、license index、migration/rollback/offline checks verified；6 个硬阻塞保留，明确 `candidate_eligible=false`、`release_action=STOP_RELEASE`，不升级为发布候选 | `coverage/release-candidate-gate.report.json`, `coverage/release-closure.report.json`, `scripts/generate_release_closure.py`, `scripts/test_release_candidate_gate.py` |
+| `K8-REL-05` | post-release audit 逐项比较 gate 的 11 个输入哈希、closure 交叉引用和 context/schema/recovery/migration 检查；审计检查全部 verified，6 个 blocker 均有 owner、review owner、证据路径和 remediation；整体仍明确 `blocked`/`STOP_RELEASE`，未清除或重分类阻塞 | `coverage/post-release-audit.report.json`, `scripts/generate_post_release_audit.py`, `scripts/test_post_release_audit.py` |
+| `K8-REL-06` | K8 milestone closeout 冻结 post-release audit、release gate、closure、evidence index 和 context lock；输入哈希、审计自校验、context/schema、六项 blocker 保留和 `STOP_RELEASE` 均 verified；里程碑以 `closed_with_release_blockers` 结束，不升级为发布候选 | `coverage/k8-milestone-closeout.report.json`, `scripts/generate_k8_milestone_closeout.py`, `scripts/test_k8_milestone_closeout.py`, `coverage/post-release-audit.report.json` |
+| `K8-REL-07` | remediation intake 校验 closeout、audit、gate、closure、evidence index 和 context lock 的输入哈希与 context；六个 blocker identity、owner/evidence/review trigger 和 `STOP_RELEASE` 均 verified；生成 `K8-REL-08..13` 有序后续工作项，但全部保持 blocked，不升级为发布候选 | `coverage/release-remediation-intake.report.json`, `scripts/generate_release_remediation_intake.py`, `scripts/test_release_remediation_intake.py`, `docs/linuxcnc-web-wasm-release-remediation-intake.md` |
+| `K8-REL-08` | 为全部 6,249 个 `needs_owner` manifest seed 生成确定性 WS-0/WS-1/WS-2/WS-6 workstream owner 和 review owner；源哈希、唯一覆盖、context 与 `STOP_RELEASE` 均 verified；assignment 保持 `proposed_blocked_review`，不修改 manifest/context lock、不升级 accepted，下一步处理 acceptance evidence | `coverage/manifest-ownership-remediation.report.json`, `scripts/generate_manifest_ownership_remediation.py`, `scripts/test_manifest_ownership_remediation.py`, `docs/linuxcnc-web-wasm-manifest-ownership-remediation.md` |
+| `K8-REL-09` | acceptance readiness 审计覆盖全部 1,804 affected entry；owner/inputs/outputs/test 字段虽可追踪，但 oracle/context 阻塞导致 eligible=0，manifest accepted=0；6 项检查与 `STOP_RELEASE` verified，不 promotion 或重分类，下一步处理 official oracle | `coverage/release-acceptance-remediation.report.json`, `scripts/generate_release_acceptance_remediation.py`, `scripts/test_release_acceptance_remediation.py`, `docs/linuxcnc-web-wasm-release-acceptance-remediation.md` |
+| `K8-REL-10` | 锁定 source commit 与 context 匹配；`linuxcnc/unit_tests/kinematics`、recovery roots 缺失，6 个 matrixkins 文件明确非官方，11 个 kinematics samples/recovery scenarios 保持 blocked；未新增官方输入或 golden，`STOP_RELEASE` verified，下一步处理 configuration resources | `coverage/official-oracle-remediation.report.json`, `scripts/generate_official_oracle_remediation.py`, `scripts/test_official_oracle_remediation.py`, `docs/linuxcnc-web-wasm-official-oracle-remediation.md` |
+| `K8-REL-11` | 配置资源 remediation 保留 16,093 rows：997 missing、91 unresolved、59 unindexed、3 unregistered startup；956 basename candidates 仅作只读审查，实际 resolve=0，资源图 orphan=0，`STOP_RELEASE` verified，下一步处理 browser matrix | `coverage/configuration-resource-remediation.report.json`, `scripts/generate_configuration_resource_remediation.py`, `scripts/test_configuration_resource_remediation.py`, `docs/linuxcnc-web-wasm-configuration-resource-remediation.md` |
+| `K8-REL-12` | browser matrix remediation 读取锁定 TBD minimums；Chromium 151/Firefox 154 headless smoke passed，Safari 在 Linux 环境 unavailable，时间戳输出归一化且所有结果显式；`STOP_RELEASE` verified，不就地修改 context lock，下一步处理 implementation license | `coverage/browser-matrix-remediation.report.json`, `scripts/generate_browser_matrix_remediation.py`, `scripts/test_browser_matrix_remediation.py`, `docs/linuxcnc-web-wasm-browser-matrix-remediation.md` |
+| `K8-REL-13` | implementation license remediation 覆盖 57/57 wasm-core/web entries；源哈希与 audit evidence verified，blocked_unassigned=57、approved_spdx=0、未批准声明=0，上游 license 不继承，`STOP_RELEASE` verified，下一步汇总 remediation evidence | `coverage/implementation-license-remediation.report.json`, `scripts/generate_implementation_license_remediation.py`, `scripts/test_implementation_license_remediation.py`, `docs/linuxcnc-web-wasm-implementation-license-remediation.md` |
+| `K8-REL-14` | remediation evidence roundup 汇总 K8-REL-08..13；6 份报告 self-hash/context、六个 blocker identity、无 promotion/fabrication 和 gate/audit/closeout/intake 的 `STOP_RELEASE` 均 verified；状态为 `blocked_pending_owner_actions`，下一步 owner review 与新 context/gate refresh | `coverage/remediation-evidence-roundup.report.json`, `scripts/generate_remediation_evidence_roundup.py`, `scripts/test_remediation_evidence_roundup.py`, `docs/linuxcnc-web-wasm-remediation-evidence-roundup.md` |
+| `K8-REL-15` | owner-review gate refresh 定位六项 owner decision，但 workspace 没有批准输入或新 context；owner_inputs=0、gate_refresh=blocked，`STOP_RELEASE` verified，任务保持 blocked，后续仅在 owner 决策后创建新 context 并刷新 gate | `coverage/owner-review-gate-refresh.report.json`, `scripts/generate_owner_review_gate_refresh.py`, `scripts/test_owner_review_gate_refresh.py`, `docs/linuxcnc-web-wasm-owner-review-gate-refresh.md` |
 
 ## 追溯规则