[#49] merge risk report를 branch 조합 중심으로 구성한다

.agents/roles.md

@@ -37,15 +37,15 @@ Default role-to-model and execution assignment:
 | --- | --- | --- | --- |
 | Planner | active main agent | `Primary` | Always for live issues, PR scope, architecture scope, or implementation planning |
 | Implementer | active main agent | `Primary` | Always for TypeScript production code, tests, module boundaries, public exports, provider behavior, workflows, releases, or GitHub writes |
-| Architecture Watcher | `architecture_watcher` | `Lightweight` for preflight, `Primary` for final boundary verdict | Any finding is `Block` or `Needs Owner Decision`, or the change touches deterministic scoring, AI authority, external-service data, reusable workflow contracts, secrets, or release packaging |
+| Architecture Watcher | `architecture_watcher` | `Lightweight` for preflight, `Primary` for final boundary verdict | Any finding is `Block` or `Needs Owner Decision`, or the change touches deterministic pair classification, AI authority, external-service data, reusable workflow contracts, secrets, or release packaging |
 | Code Reviewer | `code_reviewer` | `Lightweight` for first pass, `Primary` for final blocking review | Findings involve runtime behavior, data loss, secret exposure, provider failure isolation, workflow behavior, or test strategy |
 | Verification Runner | `verification_runner` | `Lightweight` | Verification fails, the failure cause is unclear, or a source or workflow fix is needed |
 | GitHub/CI Analyst | `github_ci_analyst` | `Lightweight` | CI root cause requires code or workflow changes, release state is ambiguous, or review comments conflict |
-| Documentation Writer | `documentation_writer` | `Lightweight` | Text must explain score policy, AI behavior, security boundaries, reusable workflow contracts, release risk, CI root cause, or PR scope tradeoffs |
+| Documentation Writer | `documentation_writer` | `Lightweight` | Text must explain pair graph policy, AI behavior, security boundaries, reusable workflow contracts, release risk, CI root cause, or PR scope tradeoffs |
 
 Project-scoped custom agents live in `.codex/agents/`. Their TOML files pin the concrete model and sandbox for spawned sessions; this table is the canonical role-to-agent routing map.
 
-Do not assign `Lightweight` as the only model for production TypeScript implementation, deterministic score or status changes, provider contracts, reusable workflow inputs or secrets, release packaging, public exports, commits, pushes, PR creation, or final integration.
+Do not assign `Lightweight` as the only model for production TypeScript implementation, deterministic pair status or reason changes, provider contracts, reusable workflow inputs or secrets, release packaging, public exports, commits, pushes, PR creation, or final integration.
 
 ### Model dispatch requirements
 
@@ -141,7 +141,7 @@ Planner must produce this packet before handing work to another role.
 - Stop conditions:
 ```
 
-Use `Architecture risk: possible` when the task touches module ownership, deterministic scoring, AI authority or data shape, external-service boundaries, secret redaction, public exports, reusable workflow contracts, release packaging, or architecture documentation.
+Use `Architecture risk: possible` when the task touches module ownership, deterministic pair classification, AI authority or data shape, external-service boundaries, secret redaction, public exports, reusable workflow contracts, release packaging, or architecture documentation.
 
 ## Role activation
 
@@ -193,7 +193,7 @@ May:
 - Trace the owning source module, test file, workflow, and public documentation for the requested behavior.
 - Separate deterministic policy, AI assistance, report formatting, report delivery, debug output, and runtime orchestration scope.
 - Decide which roles are required and which checks can run without live services.
-- Ask the user when score policy, data exposure, public workflow contracts, release behavior, or ownership is ambiguous.
+- Ask the user when pair graph policy, data exposure, public workflow contracts, release behavior, or ownership is ambiguous.
 
 Must not:
 
@@ -272,7 +272,7 @@ Must inspect:
 
 - Current and proposed owning module for each changed behavior.
 - Imports and dependency direction among `branches`, `git`, `risks`, `ai`, `reports`, `reportChannels`, `debug`, and `workflows`.
-- Whether normalized input still produces the same deterministic score, status, reason, and report result when behavior is not in scope.
+- Whether normalized input still produces the same deterministic pair status, reason, and report result when behavior is not in scope.
 - Whether AI target selection and provider results remain additive and validated.
 - Whether provider failures remain isolated without removing deterministic results.
 - Data sent to GitHub, OpenAI, Discord, logs, and debug artifacts, including secret and raw-source exposure.
@@ -283,7 +283,7 @@ Must inspect:
 Must not:
 
 - Edit files.
-- Approve ambiguous score, security, workflow, public API, or release decisions by assumption.
+- Approve ambiguous pair graph, security, workflow, public API, or release decisions by assumption.
 - Treat a passing build as proof that deterministic or consumer-facing contracts are unchanged.
 - Hide architecture decisions inside refactor, test, build-fix, or documentation wording.
 
@@ -313,14 +313,14 @@ Code Reviewer is a read-only diff reviewer.
 May:
 
 - Inspect `git diff`, changed source, tests, package scripts, workflows, README, and related contracts.
-- Recompute representative deterministic cases from the tests and verify score caps, precedence, overlap suppression, skip/fail mapping, and report output.
+- Recompute representative deterministic cases from the tests and verify pair status precedence, overlap reasons, skip/fail mapping, and report output.
 - Check strict typing, async failure behavior, environment fallbacks, path handling, provider response validation, Discord chunking, and secret redaction.
 - Verify whether the change matches the task packet and current issue or PR body.
 
 Must prioritize:
 
-- Incorrect branch selection, Git signal interpretation, score or status changes, and report regressions.
-- Provider calls for the wrong targets, unvalidated output, lost deterministic results, or batch result misalignment.
+- Incorrect branch selection, Git signal interpretation, pair status or reason changes, and report regressions.
+- Provider calls for the wrong targets, unvalidated output, lost deterministic results, or pair result ordering errors.
 - Secret exposure, raw data expansion, unsafe error messages, or debug artifact regressions.
 - Reusable workflow, CI, release, or consumer contract drift.
 - Missing success, failure, boundary, and fallback tests.
@@ -437,7 +437,7 @@ Must:
 
 - Write PR and review content in Korean and end sentences in noun form.
 - Keep implementation names, paths, commands, environment variables, workflow names, branch names, issue numbers, and commit hashes unchanged.
-- Explain deterministic possibility separately from AI prediction.
+- Explain deterministic pair results separately from AI prediction.
 - Keep reusable workflow inputs, secrets, permissions, source resolution, debug artifact behavior, report fallback, and release contents aligned with implementation.
 - Mention only verification commands that were actually run.
 
@@ -469,7 +469,7 @@ Before reporting completion:
 - Confirm workflow changes were checked against inputs, secrets, permissions, source resolution, and README contracts.
 - Confirm docs-only changes received diff, file-presence, Markdown, and TOML checks without claiming TypeScript or live-service verification.
 - Confirm `git status --short` contains no generated or unrelated files added by the task.
-- Report unresolved owner decisions instead of silently changing score, security, workflow, public API, or release policy.
+- Report unresolved owner decisions instead of silently changing pair graph, security, workflow, public API, or release policy.
 
 ## Example workflows
 

.agents/rules/architecture.md

@@ -15,8 +15,8 @@ Watcher is a standalone TypeScript/Node automation repository. `package.json`, `
 Read this file before work that changes any of these areas:
 
 - Ownership or dependency direction across `src/branches`, `src/git`, `src/risks`, `src/ai`, `src/reports`, `src/reportChannels`, `src/debug`, or `src/workflows`.
-- Deterministic branch selection, merge signals, risk scores, statuses, reasons, or report results.
-- OpenAI target selection, prompt construction, response validation, failure isolation, or provider batching.
+- Deterministic branch selection, branch 조합, merge signals, graph statuses, reasons, or report results.
+- OpenAI 조합 대상 선택, prompt construction, response validation, failure isolation, or request ordering.
 - GitHub, OpenAI, Discord, filesystem, environment-variable, or child-process boundaries.
 - Reusable workflow inputs, secrets, permissions, source resolution, debug artifacts, or release packaging.
 - Public exports from `src/index.ts`, shared contracts, or README architecture explanations.
@@ -49,8 +49,9 @@ flowchart LR
 	Remote["Remote refs and GitHub metadata"]
 	Collection["Workflow runtime collection"]
 	Selection["Branch selection"]
-	Git["Virtual merge signal and changed hunks"]
-	Risk["Deterministic risk analysis"]
+	Pair["Branch pair construction"]
+	Git["Virtual merge and code context"]
+	Risk["Deterministic conflict graph"]
 	Target["AI target selection and evidence"]
 	OpenAI["Optional OpenAI prediction"]
 	Report["Report construction and Markdown"]
@@ -59,7 +60,8 @@ flowchart LR
 
 	Remote --> Collection
 	Collection --> Selection
-	Selection --> Git
+	Selection --> Pair
+	Pair --> Git
 	Git --> Risk
 	Risk --> Target
 	Target --> OpenAI
@@ -78,40 +80,41 @@ flowchart LR
 
 | Module | Owns | Ask before |
 | --- | --- | --- |
-| `src/branches` | Branch, check, and PR metadata contracts plus base/default exclusion and branch selection | Adding Git execution, risk analysis, report formatting, or provider calls |
+| `src/branches` | Branch, check, and PR metadata contracts plus base/default exclusion, branch selection, and pair construction | Adding Git execution, graph classification, report formatting, or provider calls |
 | `src/git` | Branch fetch, merge-base, virtual merge, changed-file, conflict-file, and merge-failure signals | Moving hunk parsing, GitHub metadata, product risk policy, or report text into this module |
-| `src/risks` | Deterministic score, status, reason, overlap, and precedence policy | Changing score values, thresholds, precedence, or same-input results |
-| `src/ai` | AI target selection, evidence shaping, prompt construction, provider call, response validation, and branch failure isolation | Replacing deterministic results, sending broader source data, changing provider contract, or exposing unvalidated responses |
+| `src/risks` | Deterministic pair graph status, reason, overlap, error, and precedence policy | Changing status classification, reason precedence, or same-input results |
+| `src/ai` | AI pair target selection, evidence shaping, prompt construction, provider call, response validation, and pair failure isolation | Replacing deterministic results, sending broader source data, changing provider contract, or exposing unvalidated responses |
 | `src/reports` | Provider-neutral report model construction and Markdown formatting | Adding transport behavior or leaking internal-only evidence |
 | `src/reportChannels` | Report delivery, Discord chunking, stdout fallback, and transport error redaction | Adding a new channel or changing secret and failure behavior |
 | `src/debug` | Optional redacted diagnostic artifacts | Adding secrets, raw file contents, raw diffs, or unbounded provider data |
-| `src/workflows` | Environment parsing, remote-ref listing, GitHub check and PR metadata collection, diff-hunk parsing, runtime orchestration, and delivery failure propagation | Adding deterministic score policy, AI response policy, report formatting, or channel transport policy |
+| `src/workflows` | Environment parsing, remote-ref listing, GitHub check and PR metadata collection, runtime orchestration, debug artifact composition, and delivery failure propagation | Adding deterministic graph policy, AI response policy, report formatting, or channel transport policy |
 | `src/index.ts` | Deliberate public exports | Expanding the public contract without consumer impact review |
 
 ## Boundary rules
 
-- Keep branch discovery and selection independent from risk scoring.
-- Keep Git signal collection independent from product score policy.
+- Keep branch discovery and selection independent from pair graph classification.
+- Keep Git signal collection independent from graph status and reason policy.
 - Keep deterministic results reproducible for the same normalized input.
-- Keep AI prediction additive. Provider output must not erase or rewrite deterministic possibility results.
-- Select AI targets from deterministic results and skip confirmed conflicts when the current policy requires no provider call.
+- Keep AI prediction additive. Provider output must not erase or rewrite deterministic graph results.
+- Select every `confirmed_conflict` pair and only `potential_overlap` pairs with `same_hunk_overlap` for AI prediction. Skip same-file-only, `clean`, and `error` pairs.
+- Do not create an AI client or call a provider when no pair is selected.
 - Validate provider responses before mapping them into reports.
-- Isolate provider failure by branch and retain deterministic reporting.
+- Run selected pair requests in order, isolate provider failure by pair, and retain deterministic reporting.
 - Keep report construction independent from Discord delivery.
 - Keep debug output optional, redacted, and bounded.
-- Preserve the current `src/workflows/mergeRiskWatch.ts` ownership of remote-ref listing, GitHub metadata collection, hunk parsing, and pipeline composition. Do not add deterministic score, AI response, report formatting, or report channel policy there.
+- Preserve the current `src/workflows/mergeRiskWatch.ts` ownership of remote-ref listing, GitHub metadata collection, pipeline composition, and optional debug artifact writes. Do not add deterministic graph, AI response, report formatting, or report channel policy there.
 
 ## Deterministic and AI decision boundary
 
 ```mermaid
 flowchart TD
-	Evidence["Normalized branch and Git evidence"]
-	Deterministic["Deterministic risk result"]
+	Evidence["Normalized pair and Git evidence"]
+	Deterministic["Deterministic graph edge"]
 	Eligible{"Eligible for AI prediction?"}
 	Skip["Keep deterministic result with skipped status"]
 	Predict["Build bounded evidence and call provider"]
 	Validate{"Response valid?"}
-	Add["Add prediction and recommended actions"]
+	Add["Add pair analysis and resolution"]
 	Fail["Keep deterministic result with failed status"]
 
 	Evidence --> Deterministic
@@ -123,12 +126,12 @@ flowchart TD
 	Validate -->|No| Fail
 ```
 
-Do not let provider output change deterministic scores, statuses, or reasons unless the user explicitly approves a product-contract change and the tests and README are updated together.
+Do not let provider output change deterministic pair statuses or reasons unless the user explicitly approves a product-contract change and the tests and README are updated together.
 
 ## External service boundaries
 
 - GitHub access belongs at branch and Git metadata collection or workflow orchestration boundaries.
-- OpenAI access belongs behind `openAiPredictionClient` and `predictionRunner`; prompt and response contracts remain separately testable.
+- OpenAI access belongs behind `openAiPredictionClient` and `predictionPairRunner`; prompt and response contracts remain separately testable.
 - Discord access belongs behind the report channel abstraction; missing `DISCORD_WEBHOOK_URL` preserves stdout fallback.
 - Tests must replace external providers and report channels with fakes or injected functions and must not call live services.
 - Error messages and debug artifacts must not expose credentials or webhook URLs.
@@ -154,7 +157,7 @@ Do not let provider output change deterministic scores, statuses, or reasons unl
 The runtime processing order is:
 
 ```text
-workflow collection -> branch selection -> virtual merge and hunk evidence -> risks -> AI assistance -> reports -> report channel
+workflow collection -> branch selection -> branch pairs -> virtual merge and code context -> conflict graph -> pair AI assistance -> reports -> report channel
 workflow orchestration writes optional debug artifacts throughout the run
 ```
 
@@ -176,7 +179,7 @@ Shared types should stay with the module that owns their meaning. Do not create
 
 Stop and ask the user before editing when any of these decisions are not already fixed by the request or current repository contract:
 
-- A score, threshold, signal precedence, branch exclusion, or report status changes.
+- A pair status, reason precedence, branch exclusion, or report status changes.
 - AI becomes authoritative over deterministic results.
 - Additional source, diff, PR, check, prompt, response, or secret data leaves the process or enters debug artifacts.
 - A reusable workflow input, secret, permission, default, trigger, or release resolution rule changes.

.agents/rules/project-workflows.md

@@ -65,7 +65,7 @@ This reference holds Watcher-specific working rules that should live with the pr
 ## Consumer workflow contract
 
 - Treat `.github/workflows/merge-risk-watch.yml` and the corresponding README sections as one consumer-facing contract.
-- Keep `repository`, `base_branch`, `default_branch`, `critical_file_patterns`, `watcher_version`, and `upload_debug_artifact` aligned across workflow and documentation.
+- Keep `repository`, `base_branch`, `default_branch`, `watcher_version`, and `upload_debug_artifact` aligned across workflow and documentation.
 - Keep `watcher_github_token`, `openai_api_key`, and optional `discord_webhook_url` aligned with runtime environment mapping.
 - Preserve release-tag asset download and branch/SHA source-build fallback behavior unless the change explicitly revises it.
 - Update consumer examples only when their public contract changes.
@@ -80,6 +80,6 @@ This reference holds Watcher-specific working rules that should live with the pr
 
 ## Documentation alignment
 
-- Update README behavior descriptions when public inputs, secrets, environment variables, score policy, AI behavior, debug artifacts, report behavior, or release behavior changes.
+- Update README behavior descriptions when public inputs, secrets, environment variables, pair graph policy, AI behavior, debug artifacts, report behavior, or release behavior changes.
 - Do not update README for an internal refactor that leaves the documented contract unchanged.
 - Keep AI workflow documents under `.agents/` and custom agent configurations under `.codex/agents/`.