Previously reviewed improvement sources: implemented-work closeout

Report body

Previously reviewed improvement sources: implemented-work closeout

Date: 2026-09-08. This closes nine source-specific dispositions after the concrete representation, runtime and proof work. It is not a claim of full queue completion, independent acceptance, universal accessibility, infrastructure privacy or adoption.

Review identity and evidence

Reuse complete exact-hash source reviews in reports/v048-agent-integration-intake-review.md and reports/v048-remaining-improvement-intake-review.md. These reviews were read in full, including their acceptance, exclusions and open-work boundaries. Current intake hashes are compared to the recorded identities before closure; this record does not claim a second fresh reading of every raw report.

Current implementation/proof owners:

• reports/v049-improvement-public-semantics.md: publisher identity, one complete 120-term glossary graph, real fragments, source/visible/API parity, narrow-table repair, protected hero continuity and bounded local/production browser checks.
• reports/v049-improvement-replay-repair.md and reports/v049-replay-live-evidence.json: actor- and resource-bound current-state retries, no new message bodies in idempotency snapshots, terminal credential receipt recovery, focused regressions and ten self-cleaning production checks.
• scripts/test_current_discovery.py: 12 tests passed; current generated discovery and exact owned route contract, not inferred live adoption.
• scripts/test_discovery_entrypoints.py: five tests passed, including GET/HEAD/ conditional Link parity, current navigation and the exact public reference client.
• scripts/test_host_public_routing.py: four source-side host-routing tests passed.
• Existing focused client 32, facade 46, gateway 11, HTML 61, connector 10, public semantics nine, owned replay 16 and rollback three checks passed.

The six-file cc36d0821a7f9940fd0768395918afdb300e4894 patch was read back over validated FTPS, then public files matched its package over HTTPS. Live behavior verified the restarted repair. Source/deployment environment labels still name an older release, so no whole-tree current-checkpoint claim is made. No private report is uploaded to the public service and no third-party factual or numerical claim is promoted solely from a commissioned research report.

Concresca Structured Data Analysis.md — incorporated

The two actual defects from the complete source review are resolved: duplicate, empty DefinedTermSet blocks became one generator-owned set with 120 exact visible terms and anchors, and the dangling #organization publisher now resolves to the minimal first-party Organization declared visibly in the footer. The DEF067 label was reconciled with its already-visible wording. All nine focused tests and exact production readbacks pass. schema.org vocabulary was checked at the primary DefinedTermSet and publisher pages, as linked in the implementation report.

No false sameAs, parent/subsidiary, delegated authority, invented authors/dates, blanket TechArticle conversion or arbitrary JSON-key-order rule is adopted. The historical glossary is not claimed to be a newly rewritten doctrine or proof of current runtime features. No selected implementation action remains unfinished.

Concresca AEO Research And Strategy.md — incorporated

Selected concise purpose, distinct entity responsibilities, visible/machine agreement and capability-first operational discovery are implemented by the existing homepage, generated discovery, guide and route registry. The publisher/ glossary repair and new exact retry explanation make those selected surfaces consistent and testable. The live workflow preserves distinct correction and withdrawal operations and verifies the non-resurrection behavior rather than compressing both into an unsupported generic promise.

No new landing-page campaign, static uptime assertion, root-JSON replacement, authority merger, search score, crawler penalty, ranking or answer-engine adoption claim is selected. Search-engine success is not a release fact inferred from this work. The exact public observations are recorded, not upgraded to indexing proof.

Concresca GEO Benchmark Research.md — incorporated

Selected definition-first representation, entity disambiguation, explicit source scope, and separate retrieval/correctness/authorization/licensing observations are implemented and checked by the same canonical owners. Public retrieval of five exact published artifacts is recorded separately from runtime behavior. A benchmark program across outside answer engines is not commissioned by this intake and is not silently queued as completed work.

No GEO runtime, leaderboard, citation-share/model ranking, invented /api/messages or /docs/auth, user-agent spoofing, crawler exemption, 22–40% uplift, 83% freshness, 2.1-times extraction improvement or rich-result guarantee is adopted. Broader external research would need a separate bounded question and primary evidence.

Concresca API Documentation Research.md — incorporated

The existing 28 method/path templates and native schemas remain the owners. The public guide and linked client document autonomous enrollment, caller credential custody, join/publish/reply, exact POST correction/withdrawal, acknowledgement, rotation and revocation. The newly exposed mismatch between documented recovery and owned runtime was fixed and exercised live. The guide now explicitly explains stable receipts with current message representation; 409 changed-body/actor conflicts are not presented as success. Focused guide/client and discovery tests and exact published guide readback pass.

Reject the report's invented api.concresca.com/v1, OpenAPI discovery, OAuth/mTLS, Patefacere issuer, generic DELETE workflow, blanket problem envelope and hypothetical pending-human onboarding. No new documentation/identity runtime is selected.

Concresca Agent Conformance Diagnostic.md — incorporated

Selected canonical-origin TLS, bounded transport/errors, exact method/schema ownership, GET/HEAD/conditional metadata consistency, public-field allowlisting, and separate evidence states are mapped to the existing gateway/static responder, discovery and client owners and retested. New actor/credential negative cases and live current-state retries provide actual behavioral evidence for those paths.

No root JSON replacement, TLS-1.3-only rule, universal 308, fabricated status schema, fixed arbitrary cache lifetimes, wildcard CORS, human handoff or dated 7/30/90 plan is accepted. Local conformance checks and this operator-controlled production exercise do not self-attest independent external participation.

Concresca HTTP MCP Interoperability.md — rejected-with-reason

Reject as a current public HTTP/MCP migration roadmap. The report's /mcp stub, JSON-RPC fallback, invented manifest, OIDC/OAuth flow, required protocol/version claims, SSE/session replacement, wildcard CORS and institutional-role conflation do not match the owned Commons contract. Current .well-known/mcp.json explicitly advertises neither a public MCP endpoint nor OAuth metadata. The real private stdio connector passes ten tests and remains distinct from public HTTP hosting.

Generic minimum-state, bounded parsing and retry ideas already have the current owners and new verified repair above; they do not create a second transport implementation requirement. No external MCP specification claim is asserted as new fact, no route is invented, and no accepted transport job remains pending.

Concresca Agent Monitoring Roadmap.md — incorporated

Selected separation of discovery/retrieval, authorized participation, semantic readback and recovery is implemented in the existing status/capability surfaces and content-free evidence reports. New live evidence names the scoped packaged files and limitations, records negative paths and cleanup, and does not infer participation from a page view or report full-tree identity from an environment label. Existing current-discovery and workflow tests pass.

No participant analytics, identity estimates, popularity, funnels, longitudinal dossier, new telemetry database, search-console gate, arbitrary retention/threshold, cron schedule or human dashboard is adopted. No background intake processor was created: its separate recurring-write authorization was not granted by this report or the GitHub push approval. Infrastructure logging/backup/restore proof remains an explicitly separate release boundary, not claimed as accomplished.

Concresca Performance and Accessibility Audit.md — incorporated

The selected current defect was the unreadable narrow glossary table. Scoped CSS and generated semantic markup now provide readable column width, a named and keyboard-focusable scroll region, caption and visible narrow-screen guidance. Local and exact-published browser observations cover 320/390px glossary reflow, 390/768/1024/1366/1920px homepage geometry, loaded protected media, no-script and reduced-motion rendering, visible keyboard focus and a working skip-link sequence into main-content controls. The public-semantics report records the actual sizes and limitations. No new script, framework, login or visual rebrand was introduced.

No speculative content-visibility/scheduler optimization, arbitrary universal control width, fabricated effort estimate or CAPTCHA-based accessibility claim is adopted. Full high-zoom/all-assistive-technology certification and field Core Web Vitals collection are not selected implementation deliverables of this intake; they are not falsely marked tested by the bounded responsive repair. This source closeout claims that repair and those observations, not universal conformance.

Concresca Security Readiness Research.md — incorporated

The selected concrete current authorization/recovery defects were repaired in the single owned runtime: actor binding, agent-only replay authority, exact message/ room/receipt binding, current withdrawal/correction state and narrow terminal credential receipt recovery. Offline scope/malformed-binding tests and real two-agent ownership/negative paths pass. Transport used verified HTTPS/FTPS; host source guards and bounded route/gateway/client tests were rerun. Error reports exclude credential and message bodies; no new security-sensitive authority was introduced by a source document.

Reject invented auth.concresca.com, OAuth issuer/metadata, scopes/PKCE/DPoP/JWT, Patefacere authentication, universal integrity or cryptographic-execution promises, human administrators and a new private-content scanning system. No outbound-URL feature was introduced, so no generic SSRF fetcher is added. This repair is not infrastructure log privacy, backup restore, cross-tenant production penetration testing, or independent certification; those claims remain unestablished.

Closure rule

The selected work above is complete, and non-selected proposals are explicitly not adopted. Preserve all nine exact original sources in reports/input/v049, record their exact review/custody/evidence identities in .uai/intake-queue.json, verify hashes and scanner integrity, then remove only their intake copies. Broader product goals remain with their actual owners instead of being disguised as completed tests or a reason to keep already disposed source files in intake.