Prerequisite batch: relay tx (#257), Idempotency-Key bound (#258), RFC promotions (#249), governance files (#242), vendor-neutral AI gates (#252)

.github/CODEOWNERS

@@ -0,0 +1,8 @@
+# Code owners for linkly. Syntax and precedence:
+# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+# The catch-all rule comes first because a later matching rule takes precedence.
+
+* @choiyounggi
+impl/lnpl/ @choiyounggi
+rfcs/ @choiyounggi
+.github/ @choiyounggi

.github/workflows/ai-gates-quality.yml

@@ -62,3 +62,40 @@ jobs:
     secrets:
       anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
       claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+
+  # generic-http는 두 번째 러너다(issue #252, 조정 판정 R-t252-1). 위 잡과 같은
+  # 게이트를 OpenAI 호환 엔드포인트로 한 번 더 돌린다. 리포지토리 변수
+  # `AI_GATE_HTTP_BASE_URL`이 등록돼야만 돌고, 그 전에는 Skipped 체크로 보인다.
+  # D7과 같이 `secrets: inherit` 없이 HTTP 키 하나만 넘긴다. 동시성 그룹은
+  # `_ai-gate.yml`이 러너 접미사로 따로 잡는다. 등록 절차는 `docs/CI-GATES.md`.
+  test-quality-generic-http:
+    if: vars.AI_GATE_HTTP_BASE_URL != ''
+    uses: ./.github/workflows/_ai-gate.yml
+    with:
+      gate_name: test-quality
+      prompt_file: .github/ai-gates/test-quality.md
+      blocking: false
+      expect_nonempty: true
+      paths_note: "impl/tests/** 의 변경분"
+      runner: generic-http
+      http_base_url: ${{ vars.AI_GATE_HTTP_BASE_URL }}
+      http_model: ${{ vars.AI_GATE_HTTP_MODEL }}
+      http_api_style: ${{ vars.AI_GATE_HTTP_API_STYLE }}
+    secrets:
+      ai_gate_http_api_key: ${{ secrets.AI_GATE_HTTP_API_KEY }}
+
+  prose-factcheck-generic-http:
+    if: vars.AI_GATE_HTTP_BASE_URL != ''
+    uses: ./.github/workflows/_ai-gate.yml
+    with:
+      gate_name: prose-factcheck
+      prompt_file: .github/ai-gates/prose-factcheck.md
+      blocking: false
+      expect_nonempty: true
+      paths_note: "PR 산문과 diff 전체"
+      runner: generic-http
+      http_base_url: ${{ vars.AI_GATE_HTTP_BASE_URL }}
+      http_model: ${{ vars.AI_GATE_HTTP_MODEL }}
+      http_api_style: ${{ vars.AI_GATE_HTTP_API_STYLE }}
+    secrets:
+      ai_gate_http_api_key: ${{ secrets.AI_GATE_HTTP_API_KEY }}

.github/workflows/ai-gates.yml

@@ -70,3 +70,40 @@ jobs:
     secrets:
       anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
       claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+
+  # generic-http는 두 번째 러너다(issue #252, 조정 판정 R-t252-1). 위 잡과 같은
+  # 게이트를 OpenAI 호환 엔드포인트로 한 번 더 돌린다. 리포지토리 변수
+  # `AI_GATE_HTTP_BASE_URL`이 등록돼야만 돌고, 그 전에는 Skipped 체크로 보인다.
+  # D7과 같이 `secrets: inherit` 없이 HTTP 키 하나만 넘긴다. 동시성 그룹은
+  # `_ai-gate.yml`이 러너 접미사로 따로 잡는다. 등록 절차는 `docs/CI-GATES.md`.
+  rfc-conformance-generic-http:
+    if: vars.AI_GATE_HTTP_BASE_URL != ''
+    uses: ./.github/workflows/_ai-gate.yml
+    with:
+      gate_name: rfc-conformance
+      prompt_file: .github/ai-gates/rfc-conformance.md
+      blocking: false
+      expect_nonempty: true
+      paths_note: "rfcs/** 와 impl/lnpl/** 의 변경분"
+      runner: generic-http
+      http_base_url: ${{ vars.AI_GATE_HTTP_BASE_URL }}
+      http_model: ${{ vars.AI_GATE_HTTP_MODEL }}
+      http_api_style: ${{ vars.AI_GATE_HTTP_API_STYLE }}
+    secrets:
+      ai_gate_http_api_key: ${{ secrets.AI_GATE_HTTP_API_KEY }}
+
+  golden-approval-generic-http:
+    if: vars.AI_GATE_HTTP_BASE_URL != ''
+    uses: ./.github/workflows/_ai-gate.yml
+    with:
+      gate_name: golden-approval
+      prompt_file: .github/ai-gates/golden-approval.md
+      blocking: false
+      expect_nonempty: true
+      paths_note: "examples/** 골든 산출물"
+      runner: generic-http
+      http_base_url: ${{ vars.AI_GATE_HTTP_BASE_URL }}
+      http_model: ${{ vars.AI_GATE_HTTP_MODEL }}
+      http_api_style: ${{ vars.AI_GATE_HTTP_API_STYLE }}
+    secrets:
+      ai_gate_http_api_key: ${{ secrets.AI_GATE_HTTP_API_KEY }}

CHANGELOG.md

@@ -161,6 +161,32 @@ see [docs/compatibility.md](docs/compatibility.md) for what 0.x guarantees).
   more to retry. The backlog is now 128 (the kernel still caps it at
   `somaxconn`). Production serving through gunicorn is unaffected
   (issue #226).
+- `lnpl relay` drained the outbox outside any transaction, so on a driver
+  whose `drain_outbox` locks rows with `SELECT ... FOR UPDATE SKIP LOCKED`
+  (today `lnpl-postgres`) the locks ended with the statement and two
+  relays could publish the same row. Each relay batch (drain, publish or
+  POST, ack) now runs inside one driver transaction: `begin()` before the
+  drain, `commit()` after the batch, `rollback()` when an ack failure, an
+  unexpected publisher error or an interrupt escapes it; a row whose
+  publish fails stays un-acked and the batch still commits. A second relay
+  skips rows the first one holds until its commit (exactly-once per batch
+  on row-locking drivers; end-to-end delivery stays at-least-once).
+  Behaviour on sqlite is unchanged (issue #257).
+- `lnpl serve` / `build_app()`: an `Idempotency-Key` header longer than
+  255 bytes reached the repository driver, and on `lnpl-postgres` (whose
+  `lnpl_idempotency (workflow_id, key)` btree index cannot hold a key of
+  about 4000 characters) the request failed with an unhandled 500. Such a
+  request is now refused with 400 `idempotency-key-too-long`
+  (problem+json, M23) before any driver is opened, on every backend; keys
+  of up to 255 bytes, an empty key and requests without the header behave
+  as before. Separately, when the workflow behind `POST /-/events/<slug>`
+  raised an exception `run_workflow` does not catch, the claim on the
+  CloudEvents `id` was released while the workflow transaction was still
+  open, so the Postgres driver had to wait for a second pool connection
+  and sqlite committed the failed run's partial writes together with the
+  release. The open transaction is now rolled back first, so the key is
+  free at once and no partial write survives; if that rollback itself
+  fails, the claim is kept until its TTL instead (issue #258).
 
 ### Added
 - `RepositoryDriver.supports_idempotency()` and
@@ -353,6 +379,16 @@ see [docs/compatibility.md](docs/compatibility.md) for what 0.x guarantees).
   The generated OpenAPI workflow `"400"` description now also names
   `id-required` (issue #209); the six `examples/*.openapi.json` goldens
   are regenerated (issue #216).
+- AI gates can run on a second, vendor-neutral runner: the reusable
+  `.github/workflows/_ai-gate.yml` takes a `runner` input (`claude-code`
+  by default, unchanged; or `generic-http`), and
+  `scripts/ai_gate_http_runner.py` sends the gate prompt and the PR diff
+  to any OpenAI-compatible `/chat/completions` endpoint and writes the
+  same verdict JSON that `scripts/ai_gate_verdict.py` checks. Each AI
+  gate gets an advisory `<gate>-generic-http` job that runs only when the
+  repo variable `AI_GATE_HTTP_BASE_URL` is set and skips like the
+  Anthropic gates when the `AI_GATE_HTTP_API_KEY` secret is missing
+  (issue #252).
 
 ### Changed
 - `update`/`delete` (bare or `by <ref>`) that affects no row now fails its
@@ -432,6 +468,11 @@ see [docs/compatibility.md](docs/compatibility.md) for what 0.x guarantees).
   the request URL path. A document that compiled only through one of
   these gaps now fails with `LowerError`; references to fields no entity
   declares Password-family compile exactly as before, with an unchanged IR.
+- RFC-0049 through RFC-0064, whose implementations and tests are
+  already in this release, move from `Draft` to `Accepted` (RFC-0007
+  §2.1), and `scripts/rfc_lint.py` now fails when `CHANGELOG.md` cites
+  an RFC whose status is not `Accepted` or `Superseded`, or a number
+  with no document under `rfcs/` (issue #249).
 
 ## [0.8.0] — 2026-09-02
 "The Money-contract release." The RFC-0044/0045 designs accepted in 0.7.0

CODE_OF_CONDUCT.md

@@ -0,0 +1,85 @@
+
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste, color, religion, or sexual identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes, and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the overall community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or advances of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email address, without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of acceptable behavior and will take appropriate and fair corrective action in response to any behavior that they deem inappropriate, threatening, offensive, or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, and will communicate reasons for moderation decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when an individual is officially representing the community in public spaces. Examples of representing our community include using an official e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at the private report form at https://github.com/choiyounggi/linkly/security/advisories/new, which also takes conduct reports and reaches the maintainer, @choiyounggi. All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing clarity around the nature of the violation and an explanation of why the behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period of time. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period of time. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community standards, including sustained inappropriate behavior, harassment of an individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 2.1, available at [https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
+
+Community Impact Guidelines were inspired by [Mozilla's code of conduct enforcement ladder][Mozilla CoC].
+
+For answers to common questions about this code of conduct, see the FAQ at [https://www.contributor-covenant.org/faq][FAQ]. Translations are available at [https://www.contributor-covenant.org/translations][translations].
+
+[homepage]: https://www.contributor-covenant.org
+[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
+[Mozilla CoC]: https://github.com/mozilla/diversity
+[FAQ]: https://www.contributor-covenant.org/faq
+[translations]: https://www.contributor-covenant.org/translations
+

CONTRIBUTING.md

@@ -0,0 +1,104 @@
+# Contributing to linkly
+
+Thank you for helping. This guide takes you from a fresh clone to a pull request, in the order the repository's checks expect.
+
+## Before you start
+
+- Read [AGENTS.md](AGENTS.md). It routes each kind of change (writing `.lnpl`, editing an RFC, running the mutation harness) to the skill that owns the rules for it. The skills live under `plugins/lnpl/skills/` and `plugins/lnpl-dev/skills/`.
+- Report security problems privately as described in [SECURITY.md](SECURITY.md), never in a public issue.
+- Everyone taking part follows the [Code of Conduct](CODE_OF_CONDUCT.md).
+
+## 1. Set up and check your environment
+
+You need Python 3.13 and an LLVM/MLIR toolchain. `scripts/dev_doctor.sh` checks both and prints a fix for anything missing.
+
+Create a virtual environment inside your checkout and install linkly with the lint extra:
+
+```bash
+python3.13 -m venv .venv
+.venv/bin/pip install '.[lint]'
+```
+
+macOS (Homebrew): install the toolchain with `brew install llvm`, then export these paths in every shell that runs the suite:
+
+```bash
+export PATH="/opt/homebrew/opt/llvm/bin:$PATH"
+SDK="$(xcrun --show-sdk-path)"
+export CPATH="$SDK/usr/include"
+export LIBRARY_PATH="$SDK/usr/lib"
+```
+
+Linux: skip the block above. Install the `clang-<N>`, `mlir-<N>-tools` and `libmlir-<N>-dev` packages from [apt.llvm.org](https://apt.llvm.org/), where `<N>` is the major version in `mlir/llvm.pin`, and put them on your `PATH` with `export PATH="/usr/lib/llvm-<N>/bin:$PATH"`. The environment check looks for `mlir-opt`, `mlir-translate` and `clang` on `PATH`. Its install hints (`brew install python@3.13`, `brew install llvm`, `/opt/homebrew`) are written for macOS; on Linux, install the same tools with your package manager.
+
+Then run the environment check:
+
+```bash
+bash scripts/dev_doctor.sh
+```
+
+Exit 0 means you are ready. Otherwise apply the fixes it prints and run it again. A missing prerequisite does not stop the suite; it shows up later as test failures that look like code regressions. The background is in [plugins/lnpl-dev/skills/lnpl-dev-env/SKILL.md](plugins/lnpl-dev/skills/lnpl-dev-env/SKILL.md).
+
+If you work in several git worktrees, give each worktree its own `.venv` and call it by the relative path `.venv/bin/python`.
+
+## 2. Run the test suite
+
+From the repository root:
+
+```bash
+PYTHONPATH=impl .venv/bin/python -m unittest discover -s impl/tests -t impl \
+  2>&1 | grep -E "^(OK|FAILED|Ran )"
+```
+
+Read the summary through `grep`: tests print runtime traces to stdout, so the summary is buried if you only look at the last lines. After editing anything under `impl/lnpl/`, reinstall before running the suite again:
+
+```bash
+.venv/bin/pip install --force-reinstall --no-deps .
+```
+
+Run the suite once on your branch's starting point before you change anything. A change is ready when it adds no new failures to that result.
+
+## 3. Change the language through an RFC
+
+Language and toolchain behaviour is specified in [rfcs/](rfcs/). The process is defined in [rfcs/0007-rfc-process-v2.md](rfcs/0007-rfc-process-v2.md):
+
+- A new behaviour starts as a new RFC with the next free number, written from the template in section 7 of RFC-0007.
+- An Accepted RFC is never edited in place. Replace it with a new RFC that **Supersedes** it, or amend named sections with a new RFC that **Updates** it.
+- Check every RFC change with the linter before you open a pull request:
+
+```bash
+.venv/bin/python scripts/rfc_lint.py
+```
+
+Breaking changes follow the compatibility policy in [docs/compatibility.md](docs/compatibility.md) and are announced under `Changed` in [CHANGELOG.md](CHANGELOG.md).
+
+## 4. Pull request checklist
+
+Before you open a pull request:
+
+- [ ] `bash scripts/dev_doctor.sh` exits with status zero.
+- [ ] The test suite adds no new failures compared with your starting point.
+- [ ] New behaviour and bug fixes come with tests.
+- [ ] A language change cites the RFC that specifies it.
+- [ ] User-visible changes have an entry under `## [Unreleased]` in [CHANGELOG.md](CHANGELOG.md).
+- [ ] The deterministic checks CI runs pass locally:
+
+```bash
+.venv/bin/python scripts/rfc_lint.py
+.venv/bin/python scripts/gen_plugin_references.py --check
+.venv/bin/python scripts/check_version_sync.py
+.venv/bin/python scripts/check_doc_snippets.py
+.venv/bin/ruff check impl/lnpl scripts
+```
+
+### What CI runs on your pull request
+
+Deterministic gates: the test suite, `rfc_lint.py`, `gen_plugin_references.py --check`, `check_version_sync.py`, `check_doc_snippets.py`, and ruff.
+
+AI gates review the pull request with a language model and report a schema-validated verdict:
+
+- `rfc-conformance`: places where an RFC and the code disagree.
+- `golden-approval`: whether a change to a golden scenario is justified.
+- `test-quality`: tests that grade their own implementation, and passes that test nothing.
+- `prose-factcheck`: claims in the pull request description or comments that the diff contradicts.
+
+Which gates block a merge and which are advisory changes over time. [docs/CI-GATES.md](docs/CI-GATES.md) is the current roster and explains how to re-run a gate that failed to run.