[Agent Runtime] Procedural graph core and guarded offline candidate evaluation

Parent: ContextualWisdomLab/.github#2067.

Current authority — 2026-09-18 KST

Fresh protected Noema is GitHub-verified main@f38962869307a45b3b6e65692b2acbabb075e0eb, the normal expected-head merge of documentation successor #721. There is currently 1 open Noema pull request, Draft #722. #722 repairs private-vulnerability-reporting audit authentication and does not alter procedural graph/evaluation, State / Checkpoint, Policy / Approval, publication-preflight, signer-trust or activation authority.

The protected procedural graph/evaluation chain remains the authority established through #585/#586/#589/#591/#592/#593/#594/#596/#597/#601/#603, with Workflow / Task current-state transport/admission hardening through #652/#653, #663/#664, #678, #699/#700 and #704/#705. #706/#708/#709/#710/#712 advance Noema release authorization/publication/source-admission/documentation contracts without transferring release/deployment authority into Agent Runtime.

Fresh owner-lane resolution — 2026-09-18 KST

The two owner prerequisites are now distinguishable rather than one generic "unreleased dependency" bucket.

context-graph-contracts#28 is still open and its GitHub Release inventory is still empty, but owner implementation work does exist. The current mutable CGC stack includes root #4 (794e20f31b3e0c1a7958c99cc8535d23b0c25f82) plus the conformance/release-evidence chain (#6/#7/#8/#12/#13/#14/#16/#17/#18/#19/#25/#20/#21). That stack is not consumer authority: live CGC governance still reports protected/default develop with unprotected main, current root gates are non-passing, and owner PR bodies explicitly require protect-main/default/ruleset convergence plus exact-head revalidation before immutable publication. Noema must therefore wait for the protected immutable CGC release rather than consume any of those mutable heads.

keyverse#156 is also still open and Keyverse's Release inventory is still empty, but the current open Keyverse PR set contains no implementation lane for #156's current/revocation-aware procedural-evaluation signer-trust contract. Open Keyverse work is on authorization, vault/custody, CI/dependencies and other product concerns; none is an immutable owner-issued trust-selection contract satisfying evaluator identity + audience + purpose + time/revocation/rotation/provenance acceptance. The next owner-side gap is therefore not a Noema adapter yet: Keyverse must first establish that contract in its own lane and release it immutably. Noema must not repurpose #103/#129/#151/#153 or copy their source as a substitute.

Noema's own GitHub Release inventory remains empty. These owner observations do not weaken #722's independent hosted-gate requirement and do not authorize a second Noema source writer while #722 is open.

Protected State / Checkpoint and Policy / Approval minimal-transaction foundation

#714 exact a1228e72565d4280d01e1f877377ee0d3e107178 earned terminal-success application CI 34826581397, reviewer-ci 34826581366, Security Scan 34826581441, and patch-validator-image 34826581359, then normally merged as GitHub-verified 159758c16f92dafb884d176fdbf23cb0f5bd69f7. #718/#716 converged that State / Checkpoint authority into canonical documentation.

#719 protects the analogous Policy / Approval invariant. Reviewed source exact de91e24fdac66c9963c92ca77971d870a48778e4 pre-reads and cryptographically verifies the complete retained approval chain and derives the immutable next-event SHA-256 before storage.transaction(...). Inside the short durable transaction it re-reads current retained state, requires canonical root/event/dense-array structured-clone shape, performs complete Object.is optimistic revalidation against the exact preverified structure, and then performs only exact replay return or one durable write. Runtime-untrusted retained identities and SHA-256 values must already be canonical strings before regex/hash admission; coercible non-string lookalikes fail closed as Policy / Approval conflicts.

#721 completed the canonical documentation convergence for that protected #719 authority. Final exact 2025bbf9d9235bb5f023d9ae87d5cb05d2c56127 earned terminal-success application CI 35143947374, reviewer-ci 35143947412, Security Scan 35143947427, and patch-validator-image 35143947490; current-head review reported no actionable finding and the earlier inline finding was resolved/outdated. After fresh head/base verification, #721 normally merged as GitHub-verified f38962869307a45b3b6e65692b2acbabb075e0eb. Issue #720 is completed because its valid documentation/test evidence is protected, not because it was administratively discarded.

Protected evidence boundary

ProceduralCandidateDecision remains Noema Agent Runtime authority, never activation authority. Exact paired receipts and evaluation envelopes bind graph/candidate/baseline/dataset/rubric/model/tool/protocol identities. Authenticated P-256 evaluator handoff verification is separated from signer identity/key custody. Durable evaluation/rejection history remains State / Checkpoint authority; approval/revocation remains Policy / Approval authority. Neither becomes Workflow / Task lifecycle truth.

Raw or malleable ECDSA signature bytes are not durable semantic identity; the stable handoff digest binds the authenticated signed claim tuple. Current/revoked trust still requires an external owner source rather than a caller-created CryptoKey/key-id pair.

Acceptance state

Current dependency order

Keep publication/activation fail closed while immutable owner releases are absent. Fresh 2026-09-18 reads confirm context-graph-contracts#28 and keyverse#156 both remain open, and CGC, Keyverse and Noema GitHub Release inventories remain empty. Do not copy source or consume mutable PR/branch/package heads.
CGC already has a mutable owner implementation stack; let that owner lane converge governance, exact-head gates, package/SBOM/provenance and immutable release rather than opening a competing Noema/CGC copy.
Keyverse currently has no fix(automation): reject neutral or skipped observed checks before merge #156 implementation PR in its open PR set; establish the signer-trust owner lane there before any Noema consumer adapter exists.
After immutable owner publication, version-bump only released contracts and wire current signer trust plus current lifecycle/revocation through narrow Noema ACLs.
Re-run publication preflight against those live authorities, then implement publication transaction without granting activation.
Obtain deployed recovery/performance and matched shadow/canary product evidence before any activation decision.
Bind one immutable Noema release to exact source/tag/package-or-image/SBOM/provenance/reproducibility/rollback evidence before any production activation claim.

Release boundary

Fresh Noema, context-graph-contracts, and Keyverse GitHub Release inventories on 2026-09-18 are all 0. Protected source, checks, review, verified merge and canonical documentation cannot be promoted to immutable release, deployed recovery, p95/heap or product-outcome evidence. #722's hosted wait is unrelated to these owner-release prerequisites.

Guardrails

Do not copy foreign owner truth, consume mutable sibling heads as production authority, add direct provider routing/credentials, import outbound/quarantine authority, weaken exact-head gates, self-approve, force-push/destructively rebase, infer production/statistical gains from deterministic screening, treat a local digest as a signature, use raw ECDSA signature instances as durable identity, store private signer material in Agent Runtime, create a second Workflow / Task/State/lifecycle truth, silently evict durable rejection evidence, or treat protected source integration as publication/activation authority.

Related: #5, #27, #30, #36, #96, #541, #555, #561, #584, #585, #586, #589, #591, #592, #593, #594, #596, #597, #601, #603, #652, #653, #663, #664, #678, #699, #700, #704, #705, #706, #708, #709, #710, #712, #714, #715, #716, #717, #718, #719, #720, #721, #722; ContextualWisdomLab/context-graph-contracts#28; ContextualWisdomLab/keyverse#156; ContextualWisdomLab/.github#712.

Read-only review of Draft #585 exact 5813ee1cb8958aa25e622fe31adfa8dc229f2e3c found two repair findings before this lane can become review-ready:

Protected test/rate-limit-public-api-docs.test.ts inventories every direct src/**/*.ts export, requires meaningful adjacent JSDoc (>80 chars), and requires @param/@returns on exported callables. The new procedural modules currently expose several undocumented interfaces/helpers and callable exports without those tags. The adapted 89-test local evidence did not exercise this repository-wide gate.
Protected main@b946d04236613544ceedb2160ed68b4e6d855dd8 already owns ADR 0016 (0016-avoid-repository-git-conversion-execution-in-acquisition-preflight.md). Draft feat(agent-runtime): add advisory procedural graphs and guarded candidate screening #585 adds a second ADR-0016 for procedural graphs. Fresh protected inventory is contiguous through 0016, so the procedural decision must be renumbered from a fresh unused slot (0017 is unused on this protected snapshot) and all in-PR references updated atomically; the protected acquisition ADR must not be renamed or overwritten.

Both findings are repair-not-close items under the Noema execution contract. I left the separately claimed source branch untouched. Current hosted gates are still queued/unassigned, so they are neither GREEN nor source-finding evidence.

Fresh repair pass on #585: protected main already owns the unrelated acquisition ADR-0016, so the procedural decision could not remain ADR-0016. The branch was repaired non-destructively at 5623f83b001aedfffcc0e28b734d864521655ecb: new docs/adr/0017-procedural-graph-guidance.md, removal of the conflicting procedural 0016 path, and implementation-plan retarget to ADR-0017. The ADR remains Proposed. Current changed-file inventory is again seven paths. No runtime behavior, provider routing, credentials, lifecycle authority, or sibling source changed in this repair.

Remaining merge-blocking repository contract: #585 still needs an explicit CHANGELOG.md ## Unreleased entry for the Agent Runtime behavior change. Current-head hosted checks must be re-earned after the ADR repair; predecessor results do not transfer. Child #586 is now stale against the repaired parent and must be ordinary/non-force reconverged only after the parent source is stable.

fix(agent-runtime): retain canonical execution identities in procedur…

fix(agent-runtime): preserve unavailable procedural guidance and roll…

merge: reconverge procedural graph on protected documentation authority

merge: restack procedural execution on repaired procedural graph

Fresh post-#583 convergence update. Protected main is now 748970213509d1383115c4196ed99fc9ee49742e. Parent #585 was ordinary/non-force reconverged onto that exact protected source as 80f96aeb1fe83370d09e45e4177eb95ebefc64b2, preserving #583's docs/product-technical-gap-baseline.md and executable documentation-authority tests byte-for-byte and adding only the missing Proposed ADR-0017 index row. Exact protected-main→#585 compare is the intended 10-path procedural-graph candidate. Child #586 was then ordinary/non-force reconverged onto parent 80f96aeb... as fd9eb69c1fcf05a9acc5d1944be251b768038efb; exact parent→child compare remains five child paths only. No force push/destructive rebase or predecessor GREEN transfer was used.

The earlier JSDoc, ADR identity, Unreleased, structural-session admission, and execution-ID grammar findings are repaired in the current parent lineage. Current #585 exact has fresh application CI, reviewer-ci, required Security Scan, and patch-validator-image generations, all presently queued; application job 102698511498 is unassigned (ubuntu-24.04, runner_id=0, no steps), so queue state is not source failure or GREEN.

One documentation-to-code repair finding remains before calling the procedural-graph slice commercially code-current: Proposed ADR-0017 and its implementation/doctoring record describe the candidate, but canonical docs/PRD.md, docs/TRD.md, docs/UML.md/ARCHITECTURE.md, docs/TRACEABILITY.md, and the root product/technical gap baseline do not yet carry the procedural-graph candidate/acceptance boundaries. Do not overwrite #583's newly protected authority wording or rewrite historical evidence. Repair should be a scoped successor/current-lane documentation change after the parent source is stable, keeping ADR-0017 Proposed and explicitly separating source candidate, shadow evidence, immutable contract release, approval/CAS promotion, canary, and active deployment.

Fresh owner update: #585 advanced to exact a46ee0a865a66b256d78966ae8871c34fa750775 with a code-current root ARCHITECTURE.md section that records the procedural-graph bounded context, ownership/non-authority boundaries, non-durable status, verification contract, and activation non-claims. This is a partial documentation repair, not completion. Canonical PRD/TRD/UML/TRACEABILITY and docs/product-technical-gap-baseline.md still need the same candidate/source-vs-activation semantics before #585 can be called documentation-complete. Do not overwrite #583's live-authority/historical-evidence corrections while repairing those files.

Child #586 now sits at 9535fc6f70e7247fa38baeef66fd2d7454a2c5dd on parent a46ee0a...; compare remains exactly its five owned paths. Its latest RED→GREEN repair distinguishes malformed running procedural requests (invalid_procedural_request) from lifecycle-authority failures instead of collapsing both into invalid_execution_lifecycle. Keep stack order: #585 first, then non-force retarget/revalidation of #586 on protected main.

Current owner update: #585 is now exact 8b63edbb7d88bfc7536b3f66bd030e2c8b5d74af on protected branch point 748970213509d1383115c4196ed99fc9ee49742e. The canonical documentation finding is now repaired on that exact candidate across root ARCHITECTURE.md, docs/PRD.md, docs/TRD.md, docs/UML.md, docs/TRACEABILITY.md, docs/TEST_STRATEGY.md, docs/OPERABILITY.md, and docs/product-technical-gap-baseline.md, in addition to Proposed ADR-0017. Those documents consistently keep procedural graph/session identity and eligibleForApproval as Noema-local advisory evidence, retain activationAuthorized:false, and leave released schemas, enterprise adoption, model routing, credentials, Policy/Approval, durable history/canary and product outcome truth with their canonical owners.

This repairs the docs-to-code finding but does not complete the product/operational gap. #585 remains Draft until unchanged exact-head CI/reviewer/Security/image evidence is terminal and clean; integration still does not authenticate evaluator receipts, publish a released cross-service contract, create persistent activation authority, or prove canary/rollback/product outcomes. Keep #584 open for those later owner/evidence boundaries rather than closing it as documentation-complete.

Stacked #586 is now exact 4730a0dcdffd818e5f17a1c8e9f2be9da2f3d373 on parent 8b63edbb...; GitHub compare remains exactly its five owned paths. Its source repair distinguishes malformed running procedural requests (invalid_procedural_request) from lifecycle-authority corruption. It must remain behind #585 and acquire fresh protected-main gates only after non-force reconvergence following parent integration.

Fresh child review after the research-doctoring commit moved #586 to 6bb1c7c0f4569d7026523904500bce05f2013fed: a lifecycle-authority gap remains in the stacked adapter. guideProceduralExecution() validates {executionId,state} shape and equality with a genuine admitted procedural session, but it accepts an ordinary canonical running snapshot and cannot establish that the snapshot is current. The source comment itself states it cannot detect replayed old running state. Thus the stronger child-PR claims that guidance is available only while the execution is currently running and cannot resume after cancellation/terminal state are not yet enforced against stale lifecycle replay.

Repair path is deliberately bounded to Noema Agent Runtime: either introduce/reuse a canonical current-lifecycle admission/capability boundary and prove stale running cannot reopen guidance after cancellation/terminal transition, or explicitly narrow #586/ADR/product semantics to a pure projection that requires independently authenticated fresh lifecycle authority. Do not weaken the procedural-session brand or import mutable foreign authority. Parent #585 remains first in the stack and is unaffected by this child finding.

Hosted exact-head reality update: #585 predecessor 8b63edbb7d88bfc7536b3f66bd030e2c8b5d74af finally acquired a runner. Application CI 34424836355 passed exact checkout, live-base/lockfile controls, install and typecheck, then failed release tests with 4,457 passed / 1 failed. The sole failure was executable documentation authority: test/documentation-current-trust-authority.test.ts still expected the historical pre-#583 observation main@b946d042..., while the candidate baseline correctly records the post-#583 protected observation main@748970213....

Minimal causal successor #585 exact a91098e3c6952d1c3ab9eba02f45172997aee7c9 changes only that expectation (one line, +1/-1). New application/reviewer/Security/image generations are queued on this exact; predecessor successes do not transfer. Because the parent branch moved, #586 is now stale/temporarily non-mergeable against its parent and must be ordinary/non-force reconverged by its source lane after the parent stabilizes. Do not close either PR to manufacture queue reduction.

Root-fixture correction: #585 is now exact 0ee2992825dfc79e07efa6aff6fc3f385db1a5ee. The intermediate a91098e3... merely replaced the stale historical SHA with the latest dated SHA; current review correctly rejected that as a repeatable maintenance defect. 0ee299... instead changes the executable documentation-authority assertion to require the category Dated protected observation ... main@<40 lowercase hex> while continuing to reject an evergreen Current protected source ... main@<sha> claim and retaining the immutable consumer-pin/current-authority checks. The two-commit compare from the hosted-failing 8b63... exact touches only this test file. Four new exact-head generations (ci 34426487378, reviewer 34426487390, Security 34426487462, image 34426487370) are queued; all predecessor/a910 evidence is invalid.

Fresh protected-doc sweep after #585 integration found a code-current attribution defect that should be repaired, not normalized away. Protected docs/PRD.md still says “Active PR #585 proposes” the procedural graph runtime, and protected docs/TRD.md §2.4 still says “Active PR #585 adds” the three procedural modules, although #585 is now normally integrated as main@3f5aad19e6bb9231ec6bde9724ad0bd51752bf9f. The behavior descriptions themselves remain aligned with protected #585; the stale part is candidate/active-PR authority classification. Because #586 is the only remaining source candidate and adds the execution-lifecycle projection, the efficient repair boundary is one successor documentation convergence after #586 either normally integrates or is fully superseded: mark graph core as protected, describe #586 lifecycle projection according to its actual integrated state, keep ADR-0017 Proposed/non-release, and preserve the existing later gaps (authenticated receipts, durable graph/rejection/current-lifecycle authority, Policy/Approval CAS, rollback/recovery, matched shadow pilot). Do not rewrite historical PR evidence or prematurely describe #586 as protected while its current exact gates are non-terminal.

2026-09-10 fresh owner update: #586 exact 5351723f4ce3c2d41d463555986ba49e6c8f0f20 reached terminal SUCCESS on application CI, reviewer-ci, central Security Scan, and patch-validator-image and was normal-merged as GitHub-verified protected main@ae525cdc4ecc28e6caf5e5a45809f568388b3f7f. Source readiness for the #585/#586 procedural core/lifecycle adapter is therefore integrated, but ADR 0017 remains Proposed and activationAuthorized: false remains mandatory. Draft #587 now repairs the parent-local adoption record with an executable regression; its current exact is 66475ab1111d56349319071d3865205a74c7bff9 and current-head gates are pending. Separate valid docs-to-code debt remains on protected main: PRD/TRD/ARCHITECTURE/OPERABILITY/TEST_STRATEGY/product baseline still contain #585 active/candidate wording. Do not treat #587 as completion of that broader canonical convergence. Remaining product/runtime work is unchanged: authenticated evaluation receipts, durable graph/rejection history, fresh lifecycle revocation, Policy/Approval CAS, recovery, matched shadow evidence, immutable contract/release and product canary/rollback.

2026-09-10 current authority update: #587 is now integrated and fresh protected source is main@56550e5e6b0af81290800d7c5a0a4caa9040a39a. Draft #588 is the canonical documentation-convergence lane. During current-head review two valid documentation-authority defects were found and repaired rather than waved through: (1) UML had conflated Tool Capability external-extension lifecycle with the Agent Runtime ExecutionLifecycle actually consumed by #586; regression 99547b43... + causal separation dd8c82c1... now keep those bounded contexts distinct. (2) TEST_STRATEGY had accidentally dropped unrelated protected failure-triage and credential-exchange coverage authority; regression 7a7e80fe... + causal e76be4f8... restored §13–14 while retaining procedural-specific updates. Current #588 exact is e76be4f8cf9ade4eca4ce462ba10234fa2c63da1; application CI, reviewer-ci, central Security Scan and patch-validator-image have fresh generations but are still queued/non-terminal, so predecessor GREEN is not reused and Draft remains correct. ADR 0017 stays Proposed; authenticated evaluation, durable graph/rejection history, current-lifecycle/revocation authority, Policy/Approval CAS, canary/rollback and product-owner outcome evidence remain open after docs convergence.

2026-09-12 KST authority-boundary update: protected main advanced normally to 31c5ca87a907c08a124e23d4ec6ebd0339a873f2 through #672. #670/#672 concern Noema's bounded contextual-orchestrator /healthz consumer cleanup/liveness and canonical documentation only; they do not change procedural graph candidate admission, publication/activation, Workflow/Task lifecycle truth, Policy/Approval, State/Checkpoint durability, signer trust, or foreign owner contracts. ADR-0017 therefore remains Proposed. Fresh context-graph-contracts and Keyverse release inventories are still 0, so mutable sibling source remains ineligible and graph publication/activation stays fail closed pending immutable owner contracts and later deployed recovery/p95 evidence.

Procedural Agent Runtime authority delta — 2026-09-13 KST

Protected procedural current-state transport has advanced through #678 and documentation convergence #682. Current protected Noema is main@4569472d13e10645e837459035e7dd187cc86f6d.

#678 exact ac367cb535525742a1b6f3682d3ab5b14ef66f23, based on the already-integrated reviewer foundation #681, treats reader acquisition itself as part of the untrusted private Workflow / Task response boundary. If response.body.getReader() throws because the response body is already locked, Agent Runtime now fails closed with the same stable invalid_workflow_state_response diagnostic. Existing 1 MiB fixed retained buffer, copy-before-reject ceiling, cancellation-liveness semantics, fatal JSON admission and terminal reader-lock cleanup remain unchanged. The change does not create Workflow / Task lifecycle truth or publication/activation authority. Its CI/reviewer/Security/image gates were all rerun and terminal SUCCESS before normal merge a49d8532df6ac4d2eead11867047c1c4d0fa3359.

#682 exact 0bc4b0e11388321e5e6946a917c3e763b41a3b1f then used a test-first documentation RED to make CHANGELOG, product-gap baseline and executable documentation authority current for #678 (and the #681 reviewer foundation), with all four fresh exact-head gates terminal SUCCESS before normal merge 4569472d13e10645e837459035e7dd187cc86f6d.

ADR-0017 remains Proposed; publication and activation remain unavailable. context-graph-contracts and Keyverse still have 0 GitHub Releases, so mutable sibling source is not production authority. Actual graph publication transaction, live signer/lifecycle/revocation authority, immutable Noema release, deployed Durable Object recovery/p95, and matched shadow/canary outcome evidence remain open.

2026-09-13 KST fresh-head note: protected main advanced to GitHub-verified e977365032147720a74c4ed4b4df6b2e590529bf through documentation-authority PR #707. #707 does not modify procedural graph/session, Workflow / Task current-state ACL, Policy / Approval CAS, State / Checkpoint, publication preflight, or activation authority. The existing #585/#586/#589/#597/#601/#603/#652/#663/#678 source authority and the remaining released graph contract, live signer trust/lifecycle, immutable Noema release, deployed recovery/p95 and canary prerequisites are unchanged.

Canonical documentation successor is now explicit as #716. It is ordered after #714 normal protected integration: re-read the protected merge, then converge ADR-0017 and docs/product-technical-gap-baseline.md (plus only materially affected architecture/operability docs) with a section-scoped executable documentation regression. #716 must not consume mutable #714 branch text as protected authority and does not substitute for #715 Policy / Approval repair, deployed recovery/performance evidence, immutable release, publication, or activation.

Fresh authority correction for the active State / Checkpoint lane (2026-09-14 KST): the #584 body snapshot that names Draft #714 exact 3fc9a398f8f0999f1b5557717c4063e95fad7b1e is now historical. Protected Noema remains main@06c947ef783c81bb0a44ef6571b53960198e4f07; #714 is still Draft/open and mergeable, but its current exact is 61c305a5bc08f13dc4ab44cf1e44d43942eee933.

Since 3fc9a398..., review repaired three additional State / Checkpoint integrity cases without moving cryptographic chain verification back into the atomic section: transaction-local retained values are treated as runtime-untrusted so null/primitive replacement closes through ProceduralEvaluationHistoryConflictError; complete CAS equality no longer relies on JSON.stringify, so structured-clone scalar drift such as BigInt cannot leak native serialization errors; and canonical retained arrays now require every 0..length-1 index to be an own property in addition to exact enumerable-key count, rejecting sparse arrays whose holes are masked by custom properties. Append and exact replay both retain complete preverified-structure revalidation before write/return.

Current exact-head required evidence is still incomplete, not GREEN: application CI 34781141185 / 103788253642, reviewer-ci 34781141181 / 103788252786, required Security Scan 34781141220 / 103788253484, and patch-validator-image 34781141182 / 103788252617 remain queued with zero steps and no assigned runner identity. Security gitleaks 103788254055 is skipped and is not Security success. Therefore #714 remains mutable candidate evidence and must not be consumed as protected authority or merged yet.

Dependency order is unchanged: normal protected integration of unchanged #714 exact after fresh terminal-success gates first; then #716 converges ADR-0017/product-gap documentation from the protected merge; #715 independently reproduces the accepted invariant in Policy / Approval after re-reading that protected integration. No publication/activation, Workflow / Task lifecycle, provider routing, outbound, credential, quarantine/security, release/deployment, or foreign-domain authority moves into State / Checkpoint through this repair.

Fresh superseding State / Checkpoint authority note: #714 has advanced from the earlier 61c305... snapshot because exact-head review found a temporal authority gap, not because of queue churn. Test-first 7b8668d9b40d85c490601c9e5b2e804c1686a201 moves the clock past the authenticated evaluator handoff expiry only after retained-history preverification and before transaction authority, and requires both append and exact replay to reject rather than persist/return stale authority. Production repair c3eeb3b19d8c07177851bde397d286e1e003f8fd rechecks the existing process-local Agent Runtime freshness assertion after complete transaction-local history CAS and immediately before replay return / put; no SHA-256, signer-key discovery, or provider work moved into the transaction. Current exact 271f3b5d36b9da96d0c0a3eb21e1e9b8022995fb only consolidates those regressions into the existing minimal-transaction harness and removes duplicate test fixtures; production source is unchanged from c3eeb3b....

Protected main is still 06c947ef783c81bb0a44ef6571b53960198e4f07; #714 remains Draft/open and is not protected authority. Current exact required jobs are again unassigned/queued: CI 34782987957 / 103793266066, reviewer-ci 34782987991 / 103793265689, Security changed-scope 34782987960 / 103793266231, and patch-validator-image 34782988008 / 103793265526, all with zero steps and runner_id=0; gitleaks 103793266805 is skipped, not Security GREEN. Dependency order remains #714 normal protected integration first, then #716 documentation convergence and #715 independent Policy / Approval implementation from the protected invariant.

Current-authority correction for #714: the candidate has advanced from stale 271f3b5... to exact 5367a237946a705fac1037b00828f2d2670c1631. Production State / Checkpoint source remains unchanged from causal repair c3eeb3b19d8c07177851bde397d286e1e003f8fd; 6191c631... added test-only complete-CAS hostile coverage after the hosted predecessor coverage RED, and 5367a237... completes the code-current CHANGELOG handoff-freshness repair. The former CHANGELOG inline finding is resolved; all three review threads are now resolved and an exact-head COMMENT review found no additional patch-level finding. Fresh required runs are ci 34798251729, reviewer-ci 34798251709, Security Scan 34798251785, patch-validator-image 34798251880; all remain queued/non-passing on this exact head, with their materialized jobs still unassigned (steps=[], runner_id=0). Therefore #714 is still candidate evidence only and must not be consumed until these exact-head gates are terminal GREEN and normal protected integration occurs. #716 has been refreshed to this exact authority and remains post-merge only.

Current #714 authority correction for 2026-09-14 KST: exact 5367a237946a705fac1037b00828f2d2670c1631 is unchanged, all inline threads remain resolved, and application CI 34798251729, reviewer-ci 34798251709, plus patch-validator-image 34798251880 are now terminal SUCCESS. Required Security Scan 34798251785 has partially admitted on the same head: Detect changed scope 103835491992 succeeded on GitHub-hosted runner 1001971840, while scorecard 103857472447 and trivy-fs 103857472453 remain queued/unassigned (steps=[], runner_id=0). The skipped scope-inapplicable scanner jobs are not Security GREEN. Therefore #714 is still candidate-only and Draft, but its blocker has narrowed to terminal completion of the unchanged-exact Security workflow. #716/#715 ordering and the protected-authority boundary are unchanged.

Current-authority correction: Draft #714 has advanced beyond the body’s 5367a237... snapshot. Test-only exact 076e7fba95abbf3e559fa2c724737c412453d3af fixes a newly verified hostile case: a retained 64-digit BigInt digest can satisfy JavaScript RegExp.test() through coercion and then reach BigInt-incompatible JSON hashing, leaking a native TypeError instead of the durable-history integrity conflict. Current repair exact 09478408066e963433bdc5034254d33bd872bbf4 adds non-coercive canonical SHA-256 string admission for every retained digest before rehashing; compare 076e7f...094784... is source-only (+15/-11), and the existing minimal transaction / complete CAS / replay / handoff-freshness boundaries are unchanged.

The earlier 5367a237... application/reviewer/image successes are predecessor evidence only and cannot authorize the new source exact. Fresh current runs are application CI 34818750438, reviewer-ci 34818750418, Security Scan 34818750490, and patch-validator-image 34818750434, all queued at this observation. #714 therefore remains candidate authority; #716 and #715 stay ordered behind its exact-head GREEN and normal protected merge.

Current authority supersedes the body’s 5367a237... gate snapshot. Draft #714 now points to exact 09478408066e963433bdc5034254d33bd872bbf4, after a focused runtime-untrusted retained-digest repair: retained SHA-256 fields must be canonical lowercase 64-hex strings before rehashing, preventing regex coercion of values such as BigInt from leaking native JSON serialization errors across the State / Checkpoint integrity boundary. Test-only predecessor 076e7fba95abbf3e559fa2c724737c412453d3af carries the focused hostile regression; current 094784... is the minimal source repair and does not alter the transaction/ownership boundary.

All predecessor GREEN is non-transferable. Fresh current-head runs are application CI 34818750438, reviewer-ci 34818750418, required Security Scan 34818750490, and patch-validator-image 34818750434. Current job reads still show pre-runner admission for application verify 103895186213, reviewer 103895185006, and Security Detect changed scope 103895187259 (steps=[], runner_id=0, empty runner identity); Security gitleaks is scope-skipped, not standalone GREEN. Keep #714 Draft until all required workflows are terminal-success, then normal merge → fresh protected read → #716 documentation convergence → #715 independent Policy / Approval repair.

Fresh owner prerequisites remain absent as immutable release authority: context-graph-contracts releases = 0 and Keyverse releases = 0. Publication/activation therefore remains fail closed and mutable sibling source remains ineligible.

Follow-up from fresh exact-head review: #714 is not source/review-complete yet. The current CHANGELOG.md Unreleased bullet still omits 09478408066e...'s retained SHA-256 string-type admission before rehashing. Inline COMMENT review 5195247978 leaves this finding unresolved on CHANGELOG line 6. Therefore the ordering is now: repair that #714 CHANGELOG clause → review resulting exact → fresh four-gate GREEN → normal protected merge → #716 canonical docs → #715 Policy / Approval. The prior comment’s current-head queue evidence remains valid for 094784..., but runner GREEN alone must not authorize merge while this code-current documentation finding remains open.

Post-#719 documentation authority now has a concrete single-writer lane: #720. Fresh protected reads at main@4433c3009d4c6bc900bf5c8346f75b07185ff985 show CHANGELOG.md, ADR-0017, and docs/product-technical-gap-baseline.md are materially stale with respect to #719 Policy / Approval minimal-transaction/type-admission authority, while TRD/ARCHITECTURE/doctoring require section-level inspection before deciding whether to mutate them. #720 owns that convergence and its section-scoped executable documentation regression; it must not change protected runtime semantics or promote source integration to release/deployment/publication/activation authority.

Fresh owner prerequisite reads also reconfirm context-graph-contracts#28 and keyverse#156 are open and both repositories have zero GitHub Releases. Noema therefore remains fail closed on released graph-contract and current signer-trust composition until immutable owner artifacts exist.

Fresh dependency sweep after #721 protected integration (2026-09-17 KST): Noema remains at verified main@f38962869307a45b3b6e65692b2acbabb075e0eb with no open PR, so there is no local candidate to restack or merge.

The first external prerequisite is now more precisely bounded than “CGC has no release.” context-graph-contracts#28 is still open and its current dependency-root PR #4 is Draft at 794e20f31b3e0c1a7958c99cc8535d23b0c25f82; #4 records default_branch=develop, intended protected integration main, and current exact-head failures in central CodeQL and Dependency Review. The corresponding owner paths remain .github#1137 (protect/adopt main), .github#712 (Actions/CodeQL dispatch-verdict), .github#810 (Dependency Review availability/baseline provenance), and .github#772 (solo-maintainer review-rule satisfiability). CGC release inventory remains empty, so Noema must not consume the staged stack.

keyverse#156 is also still open; fresh open-PR search found no PR explicitly implementing that signer-trust handoff and Keyverse release inventory remains empty. I added fresh consumer handoff comments to both owner issues so their release work has the current Noema protected identity and fail-closed consumer requirements.

Dependency order for this lane therefore remains: owner governance/security repair -> immutable CGC graph/evaluation release + immutable Keyverse signer-trust release -> Noema released-version bumps/narrow ACLs -> hostile stale/revoked/mismatched composition regressions -> actual publication transaction, still without activation. No local source mutation or mutable-owner workaround is justified before those owner releases exist.

Navigation Menu

Repository navigation

[Agent Runtime] Procedural graph core and guarded offline candidate evaluation #584

Current authority — 2026-09-18 KST

Fresh owner-lane resolution — 2026-09-18 KST

Protected State / Checkpoint and Policy / Approval minimal-transaction foundation

Protected evidence boundary

Acceptance state

Current dependency order

Release boundary

Guardrails

20 remaining items

Procedural Agent Runtime authority delta — 2026-09-13 KST

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Agent Runtime] Procedural graph core and guarded offline candidate evaluation #584

Description

Current authority — 2026-09-18 KST

Fresh owner-lane resolution — 2026-09-18 KST

Protected State / Checkpoint and Policy / Approval minimal-transaction foundation

Protected evidence boundary

Acceptance state

Current dependency order

Release boundary

Guardrails

Activity

seonghobae commented on Sep 9, 2026

seonghobae commented on Sep 10, 2026

seonghobae commented on Sep 10, 2026

seonghobae commented on Sep 10, 2026

seonghobae commented on Sep 10, 2026

seonghobae commented on Sep 10, 2026

seonghobae commented on Sep 10, 2026

seonghobae commented on Sep 10, 2026

seonghobae commented on Sep 10, 2026

seonghobae commented on Sep 10, 2026

seonghobae commented on Sep 10, 2026

20 remaining items

seonghobae commented on Sep 12, 2026

seonghobae commented on Sep 12, 2026

Procedural Agent Runtime authority delta — 2026-09-13 KST

seonghobae commented on Sep 13, 2026

seonghobae commented on Sep 13, 2026

seonghobae commented on Sep 13, 2026

seonghobae commented on Sep 13, 2026

seonghobae commented on Sep 14, 2026

seonghobae commented on Sep 14, 2026

seonghobae commented on Sep 14, 2026

seonghobae commented on Sep 14, 2026

seonghobae commented on Sep 14, 2026

seonghobae commented on Sep 16, 2026

seonghobae commented on Sep 17, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions