Add docs/guides/CXX20_MODULES.md covering:
- When to use header-only vs module builds
- Compiler/CMake/generator compatibility matrix
- Fallback behavior when toolchain lacks module support
- Known limitations (Apple Clang, sanitizers, generators)
- Consuming the module target from downstream projects

Link the new guide from README.md documentation table.

Closes #644

Document the existing vcpkg-registry sync automation in docs/RELEASING.md so
release engineers understand that SHA512 hashes and port files are updated
automatically on GitHub release publish. Adds a new section covering:

- Trigger workflow (on-release-sync-registry.yml)
- Reusable sync workflow (sync-vcpkg-registry.yml)
- Prerequisites (VCPKG_REGISTRY_PAT secret)
- Verification commands
- How downstream ecosystem repos reuse the workflow

Closes #643

The README reference table already links docs/guides/CXX20_MODULES.md, but the
'C++20 Modules' usage section did not. Add a direct link so readers looking at
the usage example can discover the full dual-build strategy, toolchain matrix,
and fallback behavior without scrolling to the reference table.

Closes #644

Closes #651

- Add docs/compliance/ISO_OVERVIEW.md — single navigable index of every
  ISO standard the kcenon ecosystem touches (14882, 27001, 20000-1, 8601,
  9075, 12052, 27799), with per-standard summaries, status (Enforced,
  Documented, Implemented, Planned), and links to per-system mapping docs.
- Link logger_system's ISO 27001 mapping as the first Documented entry.
- Add README Compliance section and TOC entry.
- Document operator responsibilities that cannot be satisfied by libraries
  alone (key rotation, retention policy, incident response, training).

Part of #645 (ecosystem-wide ISO compliance EPIC).

Closes #652

- Add Versions section to docs/ECOSYSTEM_OVERVIEW.md covering all 8 kcenon
  vcpkg ports with current version, tier classification, and kcenon
  dependencies.
- Pin baseline SHA to b3fe244d03 (2026-04-10) and reference
  versions/baseline.json as the authoritative source.
- Include reproducible vcpkg-configuration.json snippet so downstream
  consumers can lock to the tested ecosystem composition.
- Document how versions advance (release.yml + sync-vcpkg-registry.yml)
  so pinned consumers know when and how to advance their baseline.
- Add README Ecosystem Version Baseline subsection linking to the
  Versions anchor.

Part of #646 (Ecosystem-wide vcpkg distribution readiness EPIC).

Publish v1.0 of the canonical directory-structure standard for the
kcenon ecosystem (8 systems: common, thread, logger, container,
monitoring, database, network, pacs).

The document specifies:
- include/kcenon/<name>/ public header path with kcenon:: namespace
- src/ implementation layout, header-source separation
- tests/ (GTest unit) and integration_tests/ split
- 8-module cmake/*.cmake decomposition (extracted from pacs_system)
- forwarding-header policy for breaking moves
- documented exceptions (pacs_system Catch2 retention)

Refs #658
Part of #656

Add a short Layout Standard subsection under Architecture pointing to
docs/kcenon-system-layout.md so the ecosystem-wide layout standard is
discoverable from the project entry point.

Closes #662

* chore(cmake): add kcenon-cmake-template suite

Extract pacs_system's modular CMake decomposition into a reusable,
project-agnostic template under cmake/template/. The template defines the
canonical eight-module layout described in docs/kcenon-system-layout.md
and is owned by common_system as the foundation tier.

Modules
  options.cmake       Standard option set + export-bridge / register helpers
  compiler.cmake      C++ standard, build type, IDE compile-commands baseline
  dependencies.cmake  find_package CONFIG/MODULE fallback, Homebrew probing
  warnings.cmake      Per-target warning flags scoped to project targets only
  targets.cmake       Include-directory and ALIAS conventions
  install.cmake       One-call install + config-package generation
  testing.cmake       enable_testing(), GTest discovery, gtest helper
  examples.cmake      Option-gated add_subdirectory + helper

The template is consumed by adding cmake/template to CMAKE_MODULE_PATH and
calling kcenon_template_*() helpers from the consuming root CMakeLists.txt.
README documents the adoption checklist, required variables, and the SemVer
version policy tracked in cmake/template/VERSION.

Part of #656.
Closes #659.

* chore(cmake): adopt kcenon-cmake-template in common_system root

Refactor the root CMakeLists.txt to consume the template suite added in
the previous commit. common_system serves as the reference adopter for
the other seven kcenon ecosystem systems.

Adoption details
  * Add cmake/template to CMAKE_MODULE_PATH and include() all eight modules
  * kcenon_template_set_cpp_baseline / set_default_build_type / enable_compile_commands
    replace the inline CMAKE_CXX_STANDARD / build-type plumbing
  * kcenon_template_define_standard_options(COMMON) defines the canonical
    BUILD_TESTS / BUILD_EXAMPLES / BUILD_BENCHMARKS / BUILD_DOCS /
    BUILD_MODULES / WARNINGS_AS_ERRORS options. COMMON_BUILD_EXAMPLES is
    pre-set to ON via cache to preserve common_system's historical default.
  * kcenon_template_install_package consolidates install(TARGETS),
    configure_package_config_file, write_basic_package_version_file,
    install(EXPORT), install(FILES), and the build-tree export() into a
    single call.
  * kcenon_template_setup_testing wraps enable_testing + GTest discovery.
    Caller still owns the unit / integration test combination logic.
  * kcenon_template_create_aliases factors out the three historical
    namespaced ALIAS targets (kcenon::common, kcenon::common_system,
    common_system::common_system).

Preserved unchanged
  * VERSION file reading and project() declaration
  * features.cmake (KCENON_WITH_* feature flags) and
    KcenonCompilerRequirements.cmake — domain-specific kcenon helpers, not
    part of the build-infrastructure template
  * Event Bus ABI configure_file plumbing (abi_version.h / .cpp generation)
  * BUILD_INTEGRATION_TESTS umbrella flag handling
  * COMMON_HEADER_ONLY and the optional static-library variant
  * COMMON_BUILD_MODULES C++20 module support block
  * BUILD_WITH_YAML_CPP optional dependency block
  * COMMON_BUILD_DOCS Doxygen target
  * ENABLE_COVERAGE flag handling
  * Configuration summary print

Net change: 270-line root CMakeLists.txt down to ~280 lines including
adoption boilerplate and section headers. The reduction is offset by
clearer section separation and helper call sites that document intent.

Part of #656.
Closes #659.

Validates that structural changes to common_system (cmake/, include/) do not
silently break sibling consumers. Each of the 7 sibling systems is fetched at
its default branch and rebuilt against the PR's common_system in dependency
order:

  Tier 0: common_system  (this PR — header-only install)
  Tier 1: thread_system, container_system, database_system
  Tier 2: logger_system  (needs thread), network_system (needs thread)
  Tier 3: monitoring_system  (needs logger + network)
  Tier 4: pacs_system    (needs monitoring + container + database)

Per-tier install trees pass downstream via upload-artifact / download-artifact
so each sibling configures against the PR-built upstream chain rather than
released vcpkg ports. This complements ecosystem-vcpkg-integration.yml (which
validates released ports) by catching path renames, removed exports, and
CMake config changes pre-merge.

Triggers: push/PR to develop+main paths cmake/, include/, CMakeLists.txt,
CMakePresets.json, this workflow file. Also workflow_dispatch (with
sibling_ref input) and repository_dispatch type ecosystem-structural-change
so siblings can request a re-validation.

Escape hatch: PR label skip-cross-build short-circuits the matrix; the
rationale must be documented in the PR body when used.

Initial-rollout caveats:
- ubuntu-24.04 only; macOS to be added once cycle time is measured.
- database_system and pacs_system jobs are advisory (continue-on-error)
  until libpq/sqlite/DCMTK are reliably available in the runner image —
  both still emit logs and aggregate into the summary.

Layout doc cross-build CI section now points at the workflow file path
instead of the placeholder linking issue #660.

Refs #660

Add an Exceptions entry permitting common_system to keep its canonical
cmake modules under cmake/template/, enabling the template to be
version-tracked and copied verbatim by downstream systems. Bump the
standard version from v1.0 to v1.1 (additive convention, SemVer MINOR).

This amendment formalizes the deviation surfaced by DEV-01 in the
Phase 7 audit (#661) and preserves the obligation that all other
systems place their copied modules directly under cmake/.

Closes #671.

#673)

* chore(integration_tests): replace file(GLOB) with explicit source lists

Replaces four file(GLOB) calls in integration_tests/CMakeLists.txt with
explicit set(...) lists, satisfying layout standard rule R-19 (no
file(GLOB) for source discovery). Existing sources under scenarios/,
failures/, performance/, and stress/ are enumerated. Behavior is
unchanged because the previous globs already resolved to these files.

Closes part of #670 (DEV-03).

* chore(tests): drop improved_ prefix from test filenames

Renames tests/improved_result_test.cpp -> tests/result_test.cpp and
tests/improved_event_bus_test.cpp -> tests/event_bus_test.cpp to satisfy
layout standard rule R-33 (<unit>_test.cpp). The improved_ prefix was
historical, used to distinguish a revised test suite from an older
baseline that has since been superseded and removed.

Updates:
- tests/CMakeLists.txt source list
- docs/TRACEABILITY.md feature mapping
- @file doc comments inside the renamed files

Closes part of #670 (DEV-04).

* chore(cmake): remove redundant enable_testing() in test subdirs

Removes enable_testing() calls from tests/CMakeLists.txt and
integration_tests/CMakeLists.txt. The root CMakeLists.txt already
invokes kcenon_template_setup_testing() which calls enable_testing()
at the root scope. Subdirectory calls are redundant and would limit
CTest discovery scope when invoked from there.

Satisfies layout standard rule R-34.

Closes part of #670 (DEV-05).

* refactor(cmake): extract project-specific logic into common-*.cmake modules

Refactors the root CMakeLists.txt from 364 LOC of mixed orchestration
and inline target/install/extras logic into a thin orchestrator (110
LOC) plus seven project-specific cmake modules under cmake/. This
satisfies layout standard rule R-17 (root CMakeLists.txt MUST be a
thin orchestrator).

New modules (each carries the canonical Responsibility / Required
input / Side effects header block):

- cmake/common-abi.cmake      ABI version configure_file generation +
                              umbrella BUILD_INTEGRATION_TESTS forwarding
- cmake/common-targets.cmake  INTERFACE library, aliases, optional
                              static variant, optional yaml-cpp support
- cmake/common-modules.cmake  Optional C++20 named-modules build
- cmake/common-install.cmake  Header + package install rules
- cmake/common-tests.cmake    tests/ + integration_tests/ subdir wiring
- cmake/common-extras.cmake   examples / benchmarks / Doxygen / coverage
- cmake/common-summary.cmake  Configuration summary block

The root file now appends both cmake/template (template owner exception
per SA-01 amendment) and cmake (project-specific layer) to
CMAKE_MODULE_PATH, then includes the eight canonical template modules
followed by the seven common-* project modules in dependency order.

Behavior is unchanged. Targets, options, install rules, and configure
output are byte-identical to the previous root CMakeLists.txt.

Closes part of #670 (DEV-02).

Add an independent SHA512 verification step in sync-vcpkg-registry.yml
that re-downloads the release archive from GitHub and compares the
recomputed SHA against the value the workflow is about to write to
portfile.cmake. On mismatch the step prints both SHAs and exits 1
before any registry commit happens.

Mitigates the failure mode found in microsoft/vcpkg#51511 and
kcenon/vcpkg-registry#87, where every kcenon port shipped a SHA that
did not match the actual archive and cold-cache vcpkg installs failed.

The audit confirmed sync-vcpkg-registry.yml is the only workflow in
this repo that computes SHA512; release.yml and release-template.yml
build/test/publish but do not write portfile SHAs, so no changes were
needed there. on-release-sync-registry.yml is a thin caller that
inherits the new step automatically.

Implementation notes:
- New step runs between 'Download release archive and compute SHA512'
  (id: sha) and 'Update portfile.cmake with new SHA512 and REF', so a
  mismatch fails the run before any portfile mutation
- Downloads to a file (not pipe) so curl's --fail exit code is not
  masked by sha512sum producing the empty-input hash on fetch error
- curl uses --retry 3 --retry-delay 2 for transient network blips
- Runtime cost ~1-2s for a kcenon archive

Part of #674.

Add kcenon_template_add_build_interface_includes(<target> <visibility>
<dir>...) to cmake/template/targets.cmake. The helper wraps the common
pattern of attaching one or more $<BUILD_INTERFACE:...>-only include
directories to a target.

Use this when an include directory must be visible during the build but
should NOT be exported via INSTALL_INTERFACE (e.g., build-only test
fixtures, generated code that should not be installed). The existing
kcenon_template_setup_target_includes always pairs BUILD_INTERFACE with
INSTALL_INTERFACE, so it cannot serve this case.

Promoting this helper to the template lets pacs_system delete its local
inline equivalent (pacs_add_build_interface_include_dirs in
cmake/options.cmake) and aligns other ecosystem systems on the same
name.

Bump template VERSION 1.0.0 -> 1.1.0 (MINOR per template versioning
policy: new helper added). Update template README.md adoption checklist
with a usage example for the new helper.

Closes #667

Promote the build-configuration summary block (previously a pacs-only
helper) into the canonical template suite. The new
`kcenon_template_print_summary()` function accepts PROJECT, optional
VERSION/BANNER, and OPTIONS/TARGETS/DEPENDENCIES lists, replacing the
ad-hoc `message(STATUS ...)` blocks each system maintained at the end
of its root CMakeLists.txt.

common_system itself is migrated to use the new helper as the reference
adopter, replacing the inline summary in cmake/common-summary.cmake.
Template VERSION bumped 1.1.0 -> 1.2.0 (MINOR: new module added).

Closes #668

…681)

Add the new `cmake/template/safety.cmake` module that hosts defensive
build-config guards. The first helper,
`kcenon_template_forbid_in_release(<flag_var> [REASON <text>])`, encodes
the "prohibit a mock-only flag in Release builds" idiom previously
re-implemented inline by individual systems (e.g. pacs_system's
`PACS_USE_MOCK_S3` guard in `cmake/options.cmake`).

The helper is multi-config-aware: on multi-config generators (Visual
Studio, Xcode, Ninja Multi-Config) `CMAKE_BUILD_TYPE` is empty at
configure time because the build type is selected per-build, so the
configure-time check is skipped. Per-config enforcement on multi-config
generators must be expressed as a generator-expression guard at the
call site if required.

Updates:
- New `cmake/template/safety.cmake` (single helper, include_guard GLOBAL).
- Template `README.md` directory layout, adoption checklist (now 10
  modules, new `include(safety)` step), and a new "Safety helpers"
  section documenting the helper signature, multi-config behaviour, and
  the optional REASON argument.
- Reference adopter `CMakeLists.txt` includes the new module.
- Template VERSION bumped 1.2.0 -> 1.3.0 (MINOR per template versioning
  policy: new module added).
- CHANGELOG entry under [Unreleased] / Added.

Closes #669

)

…odule-build skip (#695)

Add ADR-004 documenting the dual representation of Result<T> and event_bus
(classic headers under include/kcenon/common/ as the SSOT vs the C++20
named-module units under src/modules/ that re-export them) and a phased
consolidation roadmap with risks and a decoupled deprecation sequence.

Surface the macOS module-build coverage gap explicitly: add a dedicated
module-build-coverage job in ci.yml that emits a GitHub Actions warning
annotation stating the C++20 named-modules surface is not exercised on
macOS/AppleClang (which is omitted from the module-build matrix), and
correct the misleading "silently disabled with a warning" comment in
cmake/common-modules.cmake. Documentation/visibility only; no change to
which toolchains build modules and no source consolidation.

…concile coverage claim with gate (#692)

#694)

* chore(ci): consolidate Doxygen workflows; docs: mark governance SSOT

Make the reusable/caller relationship between the twin Doxygen
workflows explicit and mark a single source of truth for the root
vs docs governance files.

- doxygen.yml: document it as the canonical reusable (workflow_call)
  build/deploy workflow; build-Doxygen.yaml: document it as the thin
  event caller. No behavior change; clarifies role separation so the
  two files are not mistaken for duplicate twins.
- CONTRIBUTING.md (root): add SSOT marker designating
  docs/contributing/CONTRIBUTING.md (COM-PROJ-017) as canonical and
  this file as a brief quick-start redirect.
- CHANGELOG.md (root): add SSOT marker (canonical English changelog;
  Korean at docs/CHANGELOG.kr.md; registry mirror at docs/CHANGELOG.md
  COM-PROJ-002).
- README.md: point the Contributing doc-table link at the canonical
  docs/contributing/CONTRIBUTING.md for consistency.

doc-audit workflows are role-separated (PR-gate vs scheduled ecosystem
scan), not duplicates; left unchanged.

Closes #689

* docs: repoint README Contributing doc-table link to canonical docs/contributing/CONTRIBUTING.md

get_category_name reported any code>=0 as "Success", so positive codes
emitted into the shared error_info.code (monitoring 1000-4999 via
to_common_error, container 100+) were silently classified as success.
Only the success sentinel (0) now maps to "Success"; positive
out-of-range codes map to "Invalid". The negative-range category ladder
is unchanged.

Closes #698

error.cppm re-declared the registry inline and had drifted from
error_codes.h: it was missing the 6 DI error codes and still used the
pre-#698 classifier (code>=0 -> "Success"). Reconcile the module to the
header SSOT, add a std-lib Python guard
(scripts/check_error_registry_ssot.py) that fails CI on any header/module
divergence, wire it into conformance.yml, and add a runtime contract test
locking the classifier behaviour and disjoint reserved ranges.

Closes #699

…705)

README FetchContent example pointed at GIT_TAG v1.0.0, a tag that does
not exist (highest is v0.2.0). Refresh DEPENDENCY_MATRIX third-party rows
(OpenSSL 3.4.1, spdlog 1.15.3, gRPC 1.60.0, Protobuf 4.25.1, OTel 1.18.0,
libpqxx 7.9.2) and the internal ecosystem pins (thread/container/database
now v1.0.0-tagged; others at their real pre-1.0 tags) to match current
vcpkg.json and git tags; redate the footers.

Closes #702