docs: confirm REQ-021 implemented after BAT-017 merge

docs/batches/bat-017_20260708_import-provenance-sensitive-data-policy/implementation.md

@@ -1,6 +1,6 @@
 # BAT-017 Implementation Evidence
 
-- Status: implemented-awaiting-qc
+- Status: implemented-merged
 - Created At (KST): 2026-07-08 11:33 KST
 - Last Updated (KST): 2026-07-09T13:16:10+09:00
 
@@ -119,5 +119,6 @@
   - result: pass (`59 passed, 4 skipped`)
 
 ## Updated Residual Risks / Follow-up
-- Independent QC, PR creation/push, GitHub CI, and post-merge `confirm-req-implemented` remain pending.
+- Independent QC, PR publication, GitHub CI, and post-merge `confirm-req-implemented` are complete.
-- StagePilot doctor entrypoint is not present in the current workspace/runtime; this should be classified during QC as environment/tooling debt unless the lead requires a separate setup action before closure.
+- Existing operating DB sanitization remains intentionally out of scope and must stay in the separate follow-up Todo.
+- StagePilot doctor entrypoint is not present in the current workspace/runtime and is classified as environment/tooling debt, not a BAT-017 behavior blocker.

docs/batches/bat-017_20260708_import-provenance-sensitive-data-policy/index.md

@@ -1,7 +1,7 @@
 # BAT-017: Import provenance and sensitive-data policy
 
 - Profile: standard
-- Status: draft
+- Status: release-candidate
 - Included REQ: REQ-021
 - Source Discovery: dcy-014
 - Created At (KST): 2026-07-08 11:33 KST
@@ -33,3 +33,11 @@ Deliver the approved REQ-021 scope for normalized import provenance, `raw_payloa
 ## Delivery Notes
 - User explicitly prohibited Kanban; delivery execution must use direct branch/PR or a dedicated non-Kanban worktree if delegated.
 - Implementation should be sliced to avoid the previous BAT-016 large-card failure pattern: provenance helpers first, source adapters second, MCP/Streamlit exposure third, tests/docs last.
+
+
+## Merge Evidence
+- PR: https://github.com/genichin/jarca-ledger-mcp/pull/2
+- Merge commit: `d9182f28f286667fb7ff52115c33ab2e5003b269`
+- Merged At: 2026-07-09 18:44 KST
+- GitHub Actions: contract-regression, dashboard-app-test, dashboard-http-smoke, db-safety-smoke, lint, pytest-regression all passed before merge.
+- Local post-merge verification: `. .venv/bin/activate && python -m ruff check .` pass; `. .venv/bin/activate && python -m pytest -q` pass (`59 passed, 4 skipped`).

docs/batches/bat-017_20260708_import-provenance-sensitive-data-policy/verification.md

@@ -1,6 +1,6 @@
 # BAT-017 Verification Evidence
 
-- Status: ready-for-qc
+- Status: passed-merged
 - Created At (KST): 2026-07-08 11:33 KST
 
 ## Verification Commands
@@ -30,4 +30,20 @@
 - Full pytest includes the affected import/privacy regression suite and leaves 4 skips in place without introducing new failures.
 - Import batch debug-gated exposure now requires explicit `debug_provenance_gate=True`; the regression suite covers both deny-without-gate and allow-with-gate behavior.
 - BAT-017 touched MCP import batch exposure behavior but did not modify dashboard code paths directly; no additional dashboard-only code change was required in this slice.
-- QC still needs to independently inspect the changed surfaces, validate the documentation updates, and classify the missing StagePilot doctor entrypoint.
+- Independent QC completed through BAT-017 delivery; QC requested explicit debug gate enforcement, runner applied it, and the second QC handoff passed.
+
+
+## Merge-backed Verification
+- PR: https://github.com/genichin/jarca-ledger-mcp/pull/2
+- Merge commit: `d9182f28f286667fb7ff52115c33ab2e5003b269`
+- GitHub Actions before merge:
+  - `contract-regression`: pass
+  - `dashboard-app-test`: pass
+  - `dashboard-http-smoke`: pass
+  - `db-safety-smoke`: pass
+  - `lint`: pass
+  - `pytest-regression`: pass
+- Local main verification after merge:
+  - `. .venv/bin/activate && python -m ruff check .` → pass (`All checks passed!`)
+  - `. .venv/bin/activate && python -m pytest -q` → pass (`59 passed, 4 skipped`)
+- StagePilot doctor entrypoint remains unavailable in this runtime and is classified as environment/tooling debt, not a BAT-017 behavior blocker.

docs/batches/index.md

@@ -24,7 +24,8 @@
 | BAT-014 | standard | release-candidate | REQ-018 | dcy-011 | [bat-014_20260703_adapter-surface-narrowing-baseline-refresh](bat-014_20260703_adapter-surface-narrowing-baseline-refresh/) |
 | BAT-015 | standard | release-candidate | REQ-019 | dcy-013 | [bat-015_20260707_docker-network-mcp-deployment](bat-015_20260707_docker-network-mcp-deployment/) |
 | BAT-016 | standard | release-candidate | REQ-020 | dcy-012 | [bat-016_20260708_review-decision-reconciliation-workbench](bat-016_20260708_review-decision-reconciliation-workbench/) |
-| BAT-017 | standard | draft | REQ-021 | dcy-014 | [bat-017_20260708_import-provenance-sensitive-data-policy](bat-017_20260708_import-provenance-sensitive-data-policy/) |
+| BAT-017 | standard | release-candidate | REQ-021 | dcy-014 | [bat-017_20260708_import-provenance-sensitive-data-policy](bat-017_20260708_import-provenance-sensitive-data-policy/) |
 
 - 2026-07-08 07:11 KST: BAT-016을 local verification 통과 근거로 release-candidate 상태로 전환했다. Kanban은 사용자 명시 지시로 사용하지 않았다.
 - 2026-07-08 11:33 KST: BAT-017을 REQ-021 delivery batch로 draft 생성했다. Kanban은 사용자 명시 지시로 사용하지 않는다.
+- 2026-07-09 18:46 KST: PR #2 squash merge(`d9182f28`)와 CI/local verification 근거로 BAT-017을 release-candidate 상태로 전환했다.

docs/srs/Data/req-021_import-provenance-sensitive-data-policy.md

@@ -1,6 +1,6 @@
 # req-021: Import provenance and sensitive-data policy
 
-- Status: Approved
+- Status: Implemented
 - Type: Data
 - Priority: High
 - Owner: 렛저장인
@@ -160,3 +160,47 @@
 #### Validation Plan
 - Validate through source-specific import tests, sensitive-field filtering/static scan, MCP exposure-level contract checks, fixture/log safety checks, full pytest, lint, relevant dashboard/MCP smoke, and baseline document updates.
 
+### CHG-20260709-01
+- Date: 2026-07-09
+- Author: 가웨인
+
+#### Change Summary
+- PR #2 merge 및 GitHub Actions CI 통과 근거로 REQ-021을 Implemented 상태로 전환했다.
+
+#### Intent
+- BAT-017 구현이 main canonical codebase에 반영되었고, import provenance/sensitive-data policy acceptance 기준이 merge-backed evidence로 충족되었음을 문서 상태에 반영한다.
+
+#### Acceptance Criteria Delta
+- Added:
+  - none
+- Updated:
+  - none
+- Removed:
+  - none
+
+#### Impacted Area Delta
+- Docs:
+  - `docs/srs/Data/req-021_import-provenance-sensitive-data-policy.md`
+  - `docs/srs/index.md`
+  - `docs/batches/index.md`
+  - `docs/batches/bat-017_20260708_import-provenance-sensitive-data-policy/index.md`
+  - `docs/batches/bat-017_20260708_import-provenance-sensitive-data-policy/verification.md`
+- Modules:
+  - merge-backed BAT-017 implementation from PR #2
+- Tests:
+  - GitHub Actions CI: contract-regression, dashboard-app-test, dashboard-http-smoke, db-safety-smoke, lint, pytest-regression all passed.
+
+#### Delivery Trace Delta
+- Batches:
+  - BAT-017 moved to release-candidate after PR #2 squash merge (`d9182f28f286667fb7ff52115c33ab2e5003b269`).
+- Releases:
+  - none yet
+
+#### Revalidation Impact
+- Reverification Needed: no for current implementation gate; release grouping remains separate.
+- Existing Implementation Invalidated: no
+- Status Recommendation: implemented
+- Follow-up Action: keep existing operating DB import evidence sanitization as separate follow-up Todo; do not treat it as part of destructive migration scope for REQ-021.
+
+#### Validation Plan
+- Merge-backed evidence verified through PR #2 CI plus local main ruff/full pytest after merge.

docs/srs/index.md

@@ -60,7 +60,7 @@
 | REQ-018 | MCP/Streamlit adapter surface narrowing and baseline refresh for dcy-011 completion | Interface | Implemented | High | 렛저장인 | [req-018_adapter-surface-narrowing-baseline-refresh.md](Interface/req-018_adapter-surface-narrowing-baseline-refresh.md) |
 | REQ-019 | Docker network MCP deployment and operating DB migration | Deployment | Implemented | High | 렛저장인 | [req-019_docker-network-mcp-deployment.md](Deployment/req-019_docker-network-mcp-deployment.md) |
 | REQ-020 | Review decision persistence and reconciliation workbench | Interface | Implemented | High | 렛저장인 | [req-020_review-decision-persistence-reconciliation-workbench.md](Interface/req-020_review-decision-persistence-reconciliation-workbench.md) |
-| REQ-021 | Import provenance and sensitive-data policy | Data | Approved | High | 렛저장인 | [req-021_import-provenance-sensitive-data-policy.md](Data/req-021_import-provenance-sensitive-data-policy.md) |
+| REQ-021 | Import provenance and sensitive-data policy | Data | Implemented | High | 렛저장인 | [req-021_import-provenance-sensitive-data-policy.md](Data/req-021_import-provenance-sensitive-data-policy.md) |
 
 ## Recent Change Log Summary
 
@@ -102,3 +102,4 @@
 - 2026-07-08 07:11 KST: REQ-020을 BAT-016 local verification 근거로 Implemented 상태로 전환했다. CI/PR review는 후속 외부 gate로 남아 있다.
 - 2026-07-08 11:26 KST: dcy-014 confirmed 범위를 `REQ-021` Proposed 상태로 생성하고 import provenance 및 민감자료 저장 정책 요구사항으로 등록했다.
 - 2026-07-08 11:31 KST: REQ-021을 승인 게이트 검토 후 Approved 상태로 전환했다.
+- 2026-07-09 18:46 KST: PR #2 squash merge(`d9182f28`) 및 GitHub Actions/local main verification 근거로 REQ-021을 Implemented 상태로 전환했다.