audit(release): classify dev-to-main minor-release cherry-picks

[Yeachan-Heo]

Objective

Audit the complete current dev...main delta and classify every merged PR / direct commit for a possible owner-controlled minor release cherry-pick into main.

Required output:

• exact main/dev heads and ancestry
• complete commit and merged-PR inventory
• dependency closure and overlap graph
• user-facing behavior, schemas/config, generated artifacts, migrations, CI-only and test-only classification
• candidates safe to cherry-pick individually
• candidates safe only as an ordered bundle
• changes unsafe or unsuitable for a minor release
• minimum validation matrix and release risk

This issue authorizes analysis and evidence only. It does not authorize main mutation, cherry-pick, merge, tag, release, publish, workflow rerun, or deployment.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[Yeachan-Heo]

Audit execution started from exact refs:

• origin/main: 5666472818b71a1c37615408d9b4d3b5a77b7fa3
• origin/dev: 38f3b4077c870e41d061f8f2aa7f5c873a30e25f
• dedicated read-only audit lane: active

The audit will reconcile every main..dev commit and merged PR, build dependency/overlap closure, simulate plausible individual and bundled cherry-picks against exact main, and classify every item as individually eligible, bundle-only, unsuitable, support-only, or superseded/no-op. Main, dev, release, tag, publish, workflow, and deployment mutation remain explicitly prohibited. Terminal output will include low-risk, balanced, and full coherent minor-release sets plus validation and rollback risk.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[Yeachan-Heo]

Audit Report #4525: dev-vs-main Minor-Release Cherry-Pick Classification

STATUS: ANALYSIS COMPLETE | OWNER_CONFIRMATION_REQUIRED

---

Exact Heads (refreshed and verified)

Ref	SHA
origin/main	5666472818b71a1c37615408d9b4d3b5a77b7fa3
origin/dev	38f3b4077c870e41d061f8f2aa7f5c873a30e25f
merge-base	63ea66995c4e20ced48528f83af6e5b055fff372

Refs unchanged since lane creation. No head movement detected.

Raw Range Reconciliation (100% reconciled)

Metric	Count
Commits in origin/main..origin/dev	1,031
Merge commits in range	211
Non-merge commits in range	820
First-parent integration items	174
First-parent merge commits (total)	85
— GitHub PR-merge style	68
— Squash/rebase-merge style	17
First-parent non-merge with PR ref	96
First-parent direct (no PR ref)	10
Main-only commits (release/0.13.2)	16
Patch-equivalent (already on main)	5

Reconciliation method: git rev-list --first-parent origin/main..origin/dev yields 174 items covering all 1,031 raw commits. Each raw commit is reachable from exactly one first-parent integration item.

PR/Issue Inventory

Metric	Count
Unique PR/issue numbers referenced	175
Real PRs (exist on GitHub)	145
Issue-only refs (not PRs)	30
PRs with base=dev	144 (all MERGED)
Contributing authors	21

Classification Summary (174/174 — 0 unclassified)

Category	Count	Description
A	57	Individually cherry-pickable for minor release
B	89	Cherry-pickable only as named ordered dependency bundle
C	11	Unsuitable for minor release; dev promotion required
D	9	CI/test/docs/generated support only
E	8	Superseded/reverted/already-main/no-op

Category C items (11) — dev promotion required

PR	Files	Description	Blocker
#4098	228	refactor: SDK-owned session lifecycle	Massive refactor, 73K lines
#4281	109	fix: PR #4098 review-cohort fix gen 4-7	Depends on #4098
#4255	74	feat: abort SDK terminal	Depends on #4098 SDK surface
#4241	5	fix: runloop heartbeat containment	Conflicts on SDK bus files
#4242	27	fix: telegram orchestration topics	Conflicts on SDK bus files
#4270	9	fix: ACP cold timeout	Conflicts on SDK client/router
#4354	2	fix: capability cache corruption	Depends on #4098
#4372	3	fix: telegram delayed session titles	Conflicts on SDK bus
#4450	2	fix: session ENOENT managed predecessor	Conflicts on session storage
#4485	19	feat: master session supervisor	Depends on #4098 + #4199 chain
—	33	chore: merge main (v0.13.1) back into dev	Structural merge

Category E items (8) — superseded/already-main

PR	Status	Reason
#4252	noop	Already on main (patch-equivalent to 0.13.2 release)
#4297	changelog-only	Already on main (Apple Terminal fix)
#4312	changelog-only	Already on main (multi-Esc chunks)
#4346	changelog-only	Already on main (Windows PowerShell console)
#4347	noop	Already on main (prompt suggestions)
#4412	noop	Already on main (coordinator-mcp keepalive)
#4199	reverted	feat(master): add managed orchestration sessions — reverted by #4438
#4438	revert	Revert of #4199 — net-zero with #4199

Full 174-item table: docs/audit-4525-classification.tsv

---

Recommended Release Sets

Set 1: Minimal Low-Risk Patch Set (6 PRs)

#	PR	Hash	Description	CP Status
1	#4437	0bd4898d1845	fix(natives): wrapTextWithAnsi infinite loop on lone ESC	CLEAN
2	#4385	6add8ad61152	fix(ai): validate Synthetic API key via models endpoint	CLEAN
3	#4302	394cee75a8f6	fix(image-gen): redact API keys from provider errors	CLEAN
4	#4452	d2ac02f33272	fix(tui): resolve scratch roots at render time	CLEAN
5	#4481	38f3b4077c87	fix(tui): bound overlay geometry to stop main-thread spin	CL-only
6	#4353	1cd83d3f88e1	fix(test): keep G013 edit under shard-pressure deadline	CLEAN

• Dependency closure: None
• Validation: TS types clean (ai, tui, coding-agent); Rust text tests pass; image-gen redaction tests pass (12/12); overlay-scroll tests pass (21/21); streaming-edit-abort tests pass (18/18); synthetic-login tests pass (4/4)
• Rollback risk: Minimal — single git revert per item, no state/migration changes
• Simulated tree digest: 657b70fd1e3652286f4b0036c9418f32708dc3e5

Set 2: Balanced Minor Set (35 items from Category A)

All Category-A fix/feat items ≤15 files with clean or CHANGELOG-only cherry-picks. Adds: macOS TCC fix (#4275), Windows session reconciliation (#4373), coordinator fixes (#4483/#4484), TUI theme switching (#4429), crash report (#4271), model fallback (#4301), Kiro OAuth (#4304), Korean launcher alias (#4364), Paseo setup, thinking-block fixes, hook validation, and more.

• Validation: Each verified clean by git cherry-pick --no-commit -m 1 against origin/main
• Rollback risk: Per-item revert; no state/migration/schema changes
• Full list: All category=A rows in classification TSV

Set 3: Full Coherent Minor Set (57 items — all Category A)

Includes Sets 1+2 plus larger features: settings unification (#4245), hook convention normalization (#4289), skill zero-config discovery (#4349), MCP v2 protocol (#4292), multi-account auth (#4317), iTerm2 pet (#4468/#4499).

OWNER_CONFIRMATION_REQUIRED for Set 3 — includes user-visible feature scope changes.

---

Cherry-Pick vs. Dev Promotion

	Cherry-pick (Sets 1–3)	Dev wholesale promotion
Commits	6–57 curated	1,031 unreviewed
#4098 refactor	Excluded (Category C)	Included (228 files, 73K lines)
Risk	Low–medium (verified)	High (untested on main)
Recommendation	Sets 1–2 safe; Set 3 needs confirmation	Not recommended without full integration testing

Key Dependency Chains

1. refactor(sdk): make core own session lifecycle and attachments #4098 SDK lifecycle refactor → blocks 11 items (Category C). Cannot cherry-pick individually.
2. feat(master): add managed orchestration sessions #4199 → revert(master): remove managed orchestration runtime #4438 → feat(master): add gjc master resident session-supervision mode (#4448) #4485: Master orchestration added, reverted, re-added. Net: Category E + C.
3. chore: stop committing artifacts/ -- 175 tracked files, none consumed by any build, test, or CI path #4420 (remove artifacts/): 185 files, 45K deletions. Category B — large but isolated.

Items Requiring Owner Product Decision

• feat(settings): unify workflow settings behind one resolver + migrate config-root legacy #4245 (settings unify, 51 files): Config-root refactor
• feat(mcp): support MCP 2026-07-28 stateless protocol (MCP v2) #4292 (MCP v2 protocol, 29 files): New protocol support
• feat(cli): support 가재씨 as a Korean launcher alias for gjc #4364 (Korean launcher alias): Branding decision
• feat(mcp): activate conventional autoload for native .gjc MCP registrations (#4284) #4335 (MCP conventional autoload, 23 files): Activation behavior change
• Full dev promotion: Major release territory

Reproduction

git fetch origin main dev
git rev-list --count origin/main..origin/dev  # 1031
git rev-list --count --first-parent origin/main..origin/dev  # 174

# Simulate minimal set
git worktree add --detach /tmp/cp-sim origin/main
cd /tmp/cp-sim
git cherry-pick 0bd4898d1845 6add8ad61152
git cherry-pick -m 1 394cee75a8f6 d2ac02f33272
git cherry-pick 38f3b4077c87 1cd83d3f88e1
bun run --cwd=packages/ai check:types  # clean
bun run --cwd=packages/tui check:types  # clean
bun run --cwd=packages/coding-agent check:types  # clean

Evidence Artifacts

• Classification TSV (174 items)
• Full Markdown report
• Audit branch: audit/issue-4525-dev-main-minor-release @ 0ebe6796fc

OWNER_CONFIRMATION_REQUIRED: This audit is analysis/evidence only. No mutation of main/dev/release/tag/publish/GitHub Actions/settings/deployment was performed. No product PR opened. Cherry-pick onto a pushed branch was not performed.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[Yeachan-Heo]

Audit scope is complete and terminal.

• exact-ref inventory and first-parent reconciliation: completed
• 174/174 integration items classified with zero unclassified
• dependency/overlap closure, cherry-pickability classes, validation matrix, and release risk: published in the audit report above
• no main, tag, release, publish, deployment, or workflow mutation was performed

The report remains advisory evidence for an owner-controlled release decision; this analysis-only issue does not need to remain open while awaiting such a separate decision.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]